@capxul/mcp 4.20.0-beta.26 → 4.20.0-beta.27

package/dist/main.mjs

@@ -9610,10 +9610,19 @@ const ApprovalNetworkSchema = Schema.Struct({
 	name: Schema.String,
 	explorerUrl: Schema.String
 });
+/**
+* Whose money the operation moves: the person's own, or an Organization's,
+* which a reader follows through that Organization's scope.
+*/
+const ApprovalActorSchema = Schema.Union([Schema.Struct({ kind: Schema.Literal("personal") }), Schema.Struct({
+	kind: Schema.Literal("organization"),
+	orgId: Schema.NonEmptyString
+})]);
 /** What the person reads before they sign. */
 const ApprovalSummarySchema = Schema.Struct({
 	title: Schema.String,
 	from: Schema.Struct({
+		kind: Schema.Literals(["personal", "organization"]),
 		label: Schema.String,
 		address: AddressSchema$1
 	}),
@@ -9635,6 +9644,7 @@ const ApprovalSchema = Schema.Struct({
 	url: Schema.String,
 	kind: Schema.Literals(APPROVAL_KINDS),
 	state: Schema.Literals(APPROVAL_STATES),
+	actor: ApprovalActorSchema,
 	summary: ApprovalSummarySchema,
 	operation: ApprovalOperationSchema,
 	/** Who must sign: the owner key of the paying Safe. */
@@ -13705,7 +13715,11 @@ const ORGANIZATION_OPERATIONS = {
 			seedNativeReadiness: "operator.fixtures.seedNativeReadiness",
 			seedPrerequisites: "operator.fixtures.seedPrerequisites"
 		},
-		identities: { purgeByEmail: "operator.identities.purgeByEmail" }
+		identities: {
+			purgeByEmail: "operator.identities.purgeByEmail",
+			/** One Account and every row that refers to it, unless it has Payments or an Organization tie. */
+			purgeAccount: "operator.identities.purgeAccount"
+		}
 	},
 	/** Organizations' internal functions; its public rows join from `OPERATIONS`. */
 	organizations: {
@@ -13955,7 +13969,11 @@ const PLATFORM_OPERATIONS = {
 			recordUse: "applications.bootstraps.recordUse",
 			resolve: "applications.bootstraps.resolve"
 		},
-		keys: { issue: "applications.keys.issue" },
+		keys: {
+			issue: "applications.keys.issue",
+			/** Operator-only: revoke one key by its id, whoever owns it. */
+			revokeById: "applications.keys.revokeById"
+		},
 		quickstarts: {
 			claim: "applications.quickstarts.claim",
 			mint: "applications.quickstarts.mint"
@@ -17098,7 +17116,7 @@ function mapAccountLifecycle(input) {
 }
 //#endregion
 //#region ../../packages/sdk/package.json
-var version$2 = "4.20.0-beta.26";
+var version$2 = "4.20.0-beta.27";
 //#endregion
 //#region ../../packages/sdk/src/observability/telemetry/exception-projection.ts
 /** Fixed fallback for failures that have no safe message. */
@@ -21365,6 +21383,13 @@ function subscribeFreshQuery(deps, args, listener, operation, projection, option
 }
 //#endregion
 //#region ../../packages/sdk/src/payments/lifecycle-execution.ts
+/**
+* The prepared command is this lifecycle intent; a retry also names the
+* original birth command of the scope it was asked for.
+*/
+const lifecycleCommandCheck = (intent, expectedOrganizationId) => async (request, evidence) => await matchesIntent(intent)(request, evidence) && (intent.kind !== "retry" || (expectedOrganizationId === void 0 ? evidence.sourceCommand?.kind === "birth" && evidence.sourceCommand.actor.kind === "account" : evidence.sourceCommand?.kind === "birth" && evidence.sourceCommand.actor.kind === "organization" && evidence.sourceCommand.actor.orgId === expectedOrganizationId));
+/** The prepared command pays exactly the request the payer confirmed. */
+const requestPaymentCheck = (confirmation) => async (request) => "kind" in request && request.kind === "payment_request" && canonicalJson(request.confirmation) === canonicalJson(confirmation);
 function executePaymentLifecycle(deps, intent, signal, controls, expectedOrganizationId, onPrepared) {
 	return executePrepared(deps, (signerAddress) => runIfActive(signal, CAPXUL_OPERATIONS.payments.prepareLifecycleExecution, () => withInvocationParentSpan(Effect.suspend(() => callOperation(deps.convexCall, lifecycles.prepareScoped, copyInvocationObservation(controls, {
 		signerAddress,
@@ -21373,13 +21398,13 @@ function executePaymentLifecycle(deps, intent, signal, controls, expectedOrganiz
 			kind: "organization",
 			orgId: expectedOrganizationId
 		}
-	})).pipe(Effect.mapError((publicError) => ({ publicError })))), controls), deps.runPromise), async (request, evidence) => await matchesIntent(intent)(request, evidence) && (intent.kind !== "retry" || (expectedOrganizationId === void 0 ? evidence.sourceCommand?.kind === "birth" && evidence.sourceCommand.actor.kind === "account" : evidence.sourceCommand?.kind === "birth" && evidence.sourceCommand.actor.kind === "organization" && evidence.sourceCommand.actor.orgId === expectedOrganizationId)), false, void 0, signal, controls, onPrepared);
+	})).pipe(Effect.mapError((publicError) => ({ publicError })))), controls), deps.runPromise), lifecycleCommandCheck(intent, expectedOrganizationId), false, void 0, signal, controls, onPrepared);
 }
 function executeRequestPayment(deps, confirmation, controls, onPrepared) {
 	return executePrepared(deps, (signerAddress) => runIfActive(controls?.signal, commands$1.prepareRequest.name, () => withInvocationParentSpan(Effect.suspend(() => callOperation(deps.convexCall, commands$1.prepareRequest, copyInvocationObservation(controls, {
 		confirmation,
 		signerAddress
-	})).pipe(Effect.mapError((publicError) => ({ publicError })))), controls), deps.runPromise), async (request) => "kind" in request && request.kind === "payment_request" && canonicalJson(request.confirmation) === canonicalJson(confirmation), false, void 0, controls?.signal, controls, onPrepared);
+	})).pipe(Effect.mapError((publicError) => ({ publicError })))), controls), deps.runPromise), requestPaymentCheck(confirmation), false, void 0, controls?.signal, controls, onPrepared);
 }
 function executeOrganizationPayment(deps, input, signal, onPreparedClosed, controls, onPrepared) {
 	return executePrepared(deps, (signerAddress) => runIfActive(signal, CAPXUL_OPERATIONS.organizationPayments.prepareExecution, () => withInvocationParentSpan(Effect.suspend(() => callOperation(deps.convexCall, commands$1.prepareOrganization, copyInvocationObservation(controls, {
@@ -23859,6 +23884,524 @@ function sleep(ms, signal) {
 	});
 }
 //#endregion
+//#region ../../packages/protocol/src/payroll/model.ts
+function toPayrollRunId(raw) {
+	return toNonEmptyStringBrand(raw, "payrollRunId", (value) => isNonEmptyString(value));
+}
+function toPayrollGroupId(raw) {
+	return toNonEmptyStringBrand(raw, "payrollGroupId", (value) => isNonEmptyString(value));
+}
+//#endregion
+//#region ../../packages/sdk/src/payroll/run-checks.ts
+/** Match the caller's compensation to the committed V3 Payslip. */
+function payslipIdentityMatches(message, item, index, runId, period) {
+	return message.runId === runId && message.itemIndex === index && message.employeeRef === item.partyId && message.periodStart === period.start && message.periodEnd === period.end && message.adjustmentsHash === hashAdjustmentsV3(item.adjustments);
+}
+function payslipAmountMatches(message, item) {
+	const exact = toExactAssetAmount(item.amount, CONFIGURED_MONEY_ASSETS);
+	return message.gross.asset === exact.asset && message.gross.minorUnits === item.gross && message.gross.decimals === exact.decimals && message.net.asset === exact.asset && message.net.minorUnits === item.net && message.net.decimals === exact.decimals;
+}
+function isRunItem(prepared, item, evidence, index, runId, period) {
+	if (prepared === void 0) return false;
+	const bundle = evidence.preparedCommand?.documentBundles?.[index];
+	const preparedItem = evidence.preparedCommand?.items[index];
+	const payslip = bundle?.envelope;
+	if (bundle === void 0 || payslip?.primaryType !== "Payslip") return false;
+	return canonicalJson(prepared.to) === canonicalJson(item.to) && prepared.paymentType === "payroll" && canonicalJson(prepared.amount) === canonicalJson(item.amount) && bundle.adjustments !== void 0 && canonicalJson(bundle.adjustments) === canonicalJson(item.adjustments) && payslipIdentityMatches(payslip.message, item, index, runId, period) && payslipAmountMatches(payslip.message, item) && (preparedItem?.operation === "send" || preparedItem?.operation === "create_commitment") && preparedItem.documentHash === evidence.preparedCommand?.instructionDocuments?.[index]?.documentHash;
+}
+/**
+* The batch the backend derived from a payroll intent must be the batch this
+* caller asked for, checked before the digest is signed.
+*
+* The payslip envelope on each item is server-built and carries the run row's
+* own `issuedAt`, so the batch cannot be fingerprinted against a local copy
+* (`matchesIntent` is unavailable here). What CAN be verified is every field
+* the caller supplied — the org, the Budget, the request key, and per item the
+* recipient, the amount and the payslip figures — plus the lineage binding the
+* batch to the run just written. A prepared command that pays a different
+* person, a different amount, from a different Budget, or under a different
+* run never reaches the signer.
+*/
+function isRunBatch(input) {
+	return (batch, evidence) => Promise.resolve(!("kind" in batch) && batch.orgId === input.orgId && batch.permissionId === input.permissionId && batch.requestKey === input.requestKey && batch.lineage?.kind === "payroll" && batch.lineage.runId === input.runId && batch.items.length === input.items.length && batch.items.every((item) => item.amount.asset === input.asset) && input.items.every((item, index) => isRunItem(batch.items[index], item, evidence, index, input.runId, input.period)));
+}
+/**
+* The batch is `isRunBatch` for the run the backend just wrote, and that run
+* is the period the caller asked for: the payslip's `period` is a
+* server-formatted label, so the stored run is where the caller's own two
+* numbers are checkable.
+*/
+function isAuthorizedRunBatch(input, run) {
+	return (request, evidence) => run === void 0 || run.periodStart !== input.period.start || run.periodEnd !== input.period.end ? Promise.resolve(false) : isRunBatch({
+		...input,
+		runId: run.id
+	})(request, evidence);
+}
+/** A decoded detail is the run asked for, whole: its scope, membership and quantities agree. */
+function checkPayrollRunDetail(value, orgId, runId) {
+	if (value === null) return {
+		ok: true,
+		value: null
+	};
+	if (value.orgId !== orgId || value.run.id !== runId || value.items.length === 0 || value.items.length !== value.run.recipientCount || new Set(value.items.map((item) => item.payment.id)).size !== value.items.length || value.items.some((item, index) => item.itemIndex !== index || item.amount.asset !== value.run.total.asset || item.payment.amount.asset !== item.amount.asset || item.payment.paymentType !== "payroll")) return {
+		ok: false,
+		error: Errors.invalidInput("run", "Payroll run scope or membership does not match")
+	};
+	try {
+		const total = toExactAssetAmount(value.run.total, CONFIGURED_MONEY_ASSETS);
+		let rawTotal = 0n;
+		for (const item of value.items) {
+			const amount = toExactAssetAmount(item.amount, CONFIGURED_MONEY_ASSETS);
+			const payment = toExactAssetAmount(item.payment.amount, CONFIGURED_MONEY_ASSETS);
+			if (amount.minorUnits !== payment.minorUnits) return {
+				ok: false,
+				error: Errors.invalidInput("run", "Payroll item quantity does not match its Payment")
+			};
+			rawTotal += BigInt(amount.minorUnits);
+		}
+		if (rawTotal !== BigInt(total.minorUnits)) return {
+			ok: false,
+			error: Errors.invalidInput("run", "Payroll run total does not match its items")
+		};
+	} catch {
+		return {
+			ok: false,
+			error: Errors.invalidInput("run", "Payroll run quantities are invalid")
+		};
+	}
+	return {
+		ok: true,
+		value
+	};
+}
+//#endregion
+//#region ../../packages/sdk/src/payroll/run-decoding.ts
+function toPayrollRun(wire) {
+	return {
+		id: toPayrollRunId(wire.id),
+		status: wire.status,
+		periodStart: wire.periodStart,
+		periodEnd: wire.periodEnd,
+		total: wire.total,
+		recipientCount: wire.recipientCount
+	};
+}
+function toPayrollRuns(wire) {
+	return {
+		...mapPage(wire, toPayrollRun),
+		settledThisMonth: wire.settledThisMonth
+	};
+}
+function toPayrollGroup(wire) {
+	return {
+		id: toPayrollGroupId(wire.id),
+		name: wire.name,
+		tone: wire.tone,
+		members: wire.members.map((member) => ({
+			partyId: member.partyId,
+			amount: member.amount,
+			currency: member.currency
+		}))
+	};
+}
+function validateRunItems(input) {
+	for (const [index, item] of input.items.entries()) {
+		if (Schema.decodeResult(PayrollRunItemInputSchema, { onExcessProperty: "error" })(item)._tag === "Failure") return Errors.invalidInput(`items.${index}`, "invalid Payroll item");
+		try {
+			const exact = toExactAssetAmount(item.amount, CONFIGURED_MONEY_ASSETS);
+			const net = BigInt(item.net);
+			const gross = BigInt(item.gross);
+			const adjustments = item.adjustments.reduce((sum, row) => sum + BigInt(row.amount), 0n);
+			if (item.amount.asset !== input.asset || item.net !== exact.minorUnits || gross + adjustments !== net) return Errors.invalidInput(`items.${index}`, "invalid Payroll units");
+		} catch {
+			return Errors.invalidInput(`items.${index}`, "invalid Payroll units");
+		}
+	}
+	return null;
+}
+const RunInputSchema = Schema.Struct({
+	permissionId: AuthorizePayrollRunExecutionInputSchema.fields.permissionId,
+	asset: AuthorizePayrollRunExecutionInputSchema.fields.asset,
+	period: AuthorizePayrollRunExecutionInputSchema.fields.period,
+	items: AuthorizePayrollRunExecutionInputSchema.fields.items,
+	requestKey: Schema.optional(AuthorizePayrollRunExecutionInputSchema.fields.requestKey)
+});
+/** Decode caller input before session or signer work. Keep routing outside the input. */
+function decodePayrollRunInput(value) {
+	try {
+		const decoded = Schema.decodeUnknownSync(RunInputSchema, { onExcessProperty: "error" })(value);
+		const input = {
+			permissionId: decoded.permissionId,
+			asset: decoded.asset,
+			period: decoded.period,
+			...decoded.requestKey === void 0 ? {} : { requestKey: decoded.requestKey },
+			items: decoded.items.map((item) => ({
+				amount: item.amount,
+				gross: item.gross,
+				net: item.net,
+				adjustments: item.adjustments,
+				partyId: toPartyId(item.partyId),
+				to: item.to.kind === "party" ? {
+					kind: "party",
+					partyId: toPartyId(item.to.partyId)
+				} : item.to.kind === "address" ? {
+					kind: "address",
+					address: toAddress(item.to.address)
+				} : item.to
+			}))
+		};
+		if (input.items.length === 0 || input.period.start > input.period.end) throw Errors.invalidInput("input", "Payroll requires items and an ordered period");
+		const error = validateRunItems(input);
+		if (error !== null) throw error;
+		return input;
+	} catch (cause) {
+		throw cause instanceof CapxulError ? cause : Errors.invalidInput("input", "Invalid Payroll input");
+	}
+}
+/** Read only the exact backend prepare receipt, never an arbitrary signer failure. */
+function payrollResolution(error, requestKey) {
+	const details = error.details;
+	if (error.code !== "WRONG_STATE" || details?.method !== runs.authorize.name || details.requestKey !== requestKey || typeof details.commandId !== "string" || typeof details.runId !== "string") return void 0;
+	return details.payrollResolution === "failed" || details.payrollResolution === "settled" ? details.payrollResolution : void 0;
+}
+function validatePayrollRunLookup(orgId, runId) {
+	return !Schema.is(PayrollRunIdSchema)(runId) || orgId.length === 0 ? {
+		ok: false,
+		error: Errors.invalidInput("runId", "Organization and run ID must be valid")
+	} : {
+		ok: true,
+		value: void 0
+	};
+}
+/** Strict saved detail decoder shared by the read and fresh stream. */
+function decodePayrollRunDetail(raw, orgId, runId) {
+	const decoded = Schema.decodeUnknownResult(Schema.NullOr(PayrollRunDetailSchema), { onExcessProperty: "error" })(raw);
+	if (decoded._tag === "Failure") return {
+		ok: false,
+		error: Errors.invalidInput("run", "Invalid Payroll run detail")
+	};
+	return checkPayrollRunDetail(decoded.success, orgId, runId);
+}
+//#endregion
+//#region ../../packages/sdk/src/payroll/run-subscription.ts
+function detailValue(result) {
+	if (!result.ok) throw result.error;
+	return result.value;
+}
+function subscribePayrollRun(deps, orgId, runId, listener, options) {
+	const operation = CAPXUL_OPERATIONS.org.payroll.subscribeRun;
+	const valid = deps.validate(orgId, runId);
+	if (!valid.ok) return runCapxulEffect(Effect.fail(valid.error), observationOnlyControls(deps.invocationControls?.(options) ?? options), operation, deps.runPromise);
+	const decode = (raw) => detailValue(deps.decode(raw, orgId, runId));
+	return subscribeFreshQuery(deps, {
+		orgId,
+		runId
+	}, listener, operation, {
+		decode,
+		validateCached: (raw) => {
+			decode(raw);
+		},
+		invalidValue: (cause) => isCapxulError(cause) ? cause : Errors.invalidInput("run", "Invalid Payroll run detail"),
+		invalidScope: () => Errors.invalidInput("run", "Payroll run subscription scope does not match"),
+		lostValue: () => Errors.invalidInput("run", "Payroll run is no longer readable"),
+		unavailable: () => Errors.notImplemented("payroll", "subscribeRun")
+	}, options);
+}
+//#endregion
+//#region ../../packages/sdk/src/payroll/run-authorization.ts
+/**
+* Authorize one payroll run: a stable request key, the prepared batch checked
+* against the run the caller asked for, the signature, and the submission.
+*/
+async function authorizePayrollRun(scope, input, controls, onRequestKey, onResolved) {
+	const { deps, orgId, requestKeyScope } = scope;
+	const signal = controls?.signal;
+	const execution = executionDependencies(deps);
+	if (execution === null) return {
+		ok: false,
+		error: Errors.notImplemented("payroll", "executionComposition")
+	};
+	try {
+		input = decodePayrollRunInput(input);
+	} catch (cause) {
+		return {
+			ok: false,
+			error: asCapxulError(cause)
+		};
+	}
+	const { requestKey: provided, ...canonicalInput } = input;
+	const actorId = onRequestKey === void 0 ? void 0 : execution.actor.authSession()?.authUserId;
+	if (onRequestKey !== void 0 && actorId === void 0) return {
+		ok: false,
+		error: Errors.notAuthenticated()
+	};
+	const requestKey = await paymentRequestKeyLifecycle(`${requestKeyScope}:${AUTHORIZE_RUN}`, onRequestKey === void 0 ? {
+		orgId,
+		input
+	} : {
+		actorId,
+		orgId,
+		input: canonicalInput
+	}, provided, onRequestKey === void 0 ? void 0 : { manageProvidedKey: true });
+	try {
+		await onRequestKey?.(requestKey.key);
+		if (onRequestKey !== void 0 && execution.actor.authSession()?.authUserId !== actorId) {
+			await requestKey.finish(false).catch(() => void 0);
+			return {
+				ok: false,
+				error: Errors.notAuthenticated()
+			};
+		}
+	} catch (cause) {
+		await requestKey.finish(false).catch(() => void 0);
+		return {
+			ok: false,
+			error: asCapxulError(cause)
+		};
+	}
+	let authorized;
+	let acceptedReplay;
+	let preparedClosed = false;
+	let terminalReplay;
+	const submitted = await executePrepared(execution, async (signerAddress) => {
+		const prepared = await runIfActive(signal, AUTHORIZE_RUN, () => withInvocationParentSpan(Effect.suspend(() => callOperation(deps.convexCall, runs.authorize, copyInvocationObservation(controls, {
+			orgId,
+			permissionId: input.permissionId,
+			asset: input.asset,
+			requestKey: requestKey.key,
+			signerAddress,
+			period: input.period,
+			items: input.items
+		}))).pipe(Effect.mapError((publicError) => ({ publicError }))), controls), deps.runPromise);
+		if (!prepared.ok) {
+			terminalReplay = payrollResolution(prepared.error, requestKey.key);
+			return prepared;
+		}
+		authorized = prepared.value.run;
+		acceptedReplay = prepared.value.replay.kind === "accepted" ? prepared.value.replay.submission : void 0;
+		return {
+			ok: true,
+			value: prepared.value.execution
+		};
+	}, (request, evidence) => isAuthorizedRunBatch({
+		orgId,
+		permissionId: input.permissionId,
+		requestKey: requestKey.key,
+		asset: input.asset,
+		period: input.period,
+		items: input.items
+	}, authorized)(request, evidence), true, () => preparedClosed = true, signal, controls, void 0, () => acceptedReplay);
+	const resolution = preparedClosed ? "failed" : terminalReplay;
+	if (resolution !== void 0) try {
+		await onResolved?.(resolution);
+	} catch {}
+	try {
+		await requestKey.finish(submitted.ok || resolution !== void 0);
+	} catch {}
+	if (!submitted.ok) return submitted;
+	return authorized === void 0 ? {
+		ok: false,
+		error: Errors.unknown()
+	} : {
+		ok: true,
+		value: toPayrollRun(authorized)
+	};
+}
+const AUTHORIZE_RUN = runs.authorize.name;
+function executionDependencies(deps) {
+	return deps.actor === void 0 || deps.chainId === void 0 || deps.signer === void 0 ? null : {
+		actor: deps.actor,
+		chainId: deps.chainId,
+		convexCall: deps.convexCall,
+		runPromise: deps.runPromise,
+		signer: deps.signer,
+		...deps.telemetry === void 0 ? {} : { telemetry: deps.telemetry }
+	};
+}
+//#endregion
+//#region ../../packages/sdk/src/payroll/runs.ts
+function makePayrollMethods(deps, orgId) {
+	const requestKeyScope = deps.requestKeyScope ?? `client-${crypto.randomUUID()}`;
+	/** One observed call of one payroll row, its reply projected inside the call, under the row's name. */
+	const call = (row, args, options, project) => {
+		const controls = deps.invocationControls?.(options) ?? options;
+		return runPortEffect(callOperation(deps.convexCall, row, copyInvocationObservation(controls, args)).pipe(Effect.map(project), Effect.mapError((publicError) => ({ publicError }))), controls, row.name, deps.runPromise);
+	};
+	return {
+		subscribeRun: (runId, listener, options) => subscribePayrollRun({
+			actor: deps.actor,
+			convexCall: deps.convexCall,
+			query: reference(runs.get),
+			runPromise: deps.runPromise,
+			invocationControls: deps.invocationControls,
+			decode: decodePayrollRunDetail,
+			validate: validatePayrollRunLookup
+		}, orgId, runId, listener, options),
+		getRun: (runId, options) => {
+			const controls = deps.invocationControls?.(options) ?? options;
+			const lifetime = deps.actor?.authLifetime();
+			const operation = runs.get.name;
+			return runCapxulEffect(Effect.gen(function* () {
+				const lookup = validatePayrollRunLookup(orgId, runId);
+				if (!lookup.ok) return yield* Effect.fail(lookup.error);
+				if (lifetime === void 0 || lifetime.authUserId === null || deps.actor === void 0) return yield* Effect.fail(Errors.notAuthenticated());
+				const current = () => deps.actor?.matchesAuthLifetime(lifetime, lifetime.authUserId) === true;
+				if (!current()) return yield* Effect.fail(Errors.notAuthenticated());
+				const parent = yield* Effect.currentSpan.pipe(Effect.orDie);
+				const captured = carryInvocationParentSpan(controls, parent);
+				const run = yield* awaitCapxulResult(() => runIfActive(controls?.signal, operation, () => withInvocationParentSpan(Effect.suspend(() => callOperation(deps.convexCall, runs.get, copyInvocationObservation(captured, {
+					orgId,
+					runId
+				}))).pipe(Effect.mapError((publicError) => ({ publicError }))), captured), deps.runPromise));
+				if (!current()) return yield* Effect.fail(Errors.cancelled({ operation }));
+				const checked = checkPayrollRunDetail(run, orgId, runId);
+				return yield* checked.ok ? Effect.succeed(checked.value) : Effect.fail(checked.error);
+			}), observationOnlyControls(controls), operation, deps.runPromise);
+		},
+		runs: (options) => call(runs.list, { orgId }, options, toPayrollRuns),
+		authorizeRun: (input, options) => {
+			const controls = deps.invocationControls?.(options) ?? options;
+			return runCapxulEffect(Effect.gen(function* () {
+				if (controls?.signal?.aborted === true) return yield* Effect.fail(Errors.cancelled({ operation: AUTHORIZE_RUN }));
+				const parent = yield* Effect.currentSpan.pipe(Effect.orDie);
+				return yield* awaitCapxulResult(() => authorizePayrollRun({
+					deps,
+					orgId,
+					requestKeyScope
+				}, input, carryInvocationParentSpan(controls, parent), options?.onRequestKey, options?.onResolved));
+			}), observationOnlyControls(controls), AUTHORIZE_RUN, deps.runPromise);
+		},
+		terms: (options) => call(terms.list, { orgId }, options, (rates) => rates),
+		groups: {
+			list: (options) => call(groups.list, { orgId }, options, (saved) => mapPage(saved, toPayrollGroup)),
+			save: (input, options) => call(groups.save, {
+				orgId,
+				...input.id === void 0 ? {} : { id: String(input.id) },
+				name: input.name,
+				tone: input.tone,
+				members: input.members
+			}, options, toPayrollGroup),
+			remove: (id, options) => call(groups.remove, {
+				orgId,
+				id
+			}, options, () => void 0)
+		}
+	};
+}
+const payrollUnavailable = () => Promise.resolve({
+	ok: false,
+	error: Errors.notImplemented("payroll", "executionComposition")
+});
+/** The bundle an unconfigured client exposes — every verb refuses, none throws. */
+function makeUnavailablePayrollMethods() {
+	return {
+		getRun: payrollUnavailable,
+		subscribeRun: payrollUnavailable,
+		runs: payrollUnavailable,
+		authorizeRun: payrollUnavailable,
+		terms: payrollUnavailable,
+		groups: {
+			list: payrollUnavailable,
+			save: payrollUnavailable,
+			remove: payrollUnavailable
+		}
+	};
+}
+//#endregion
+//#region ../../packages/sdk/src/accounts/command-approvals.ts
+/**
+* Keep a prepared command only when it is the one asked for and its operation
+* is the person's own. A mismatch is closed unsent when `close`, as the signed
+* path closes a new Payment; a retry or a request keeps its Payment open.
+*/
+async function checked(deps, signerAddress, prepared, expected, close) {
+	if (!prepared.ok) return prepared;
+	const session = deps.actor?.authSession() ?? null;
+	if (session === null || deps.chainId === void 0) return {
+		ok: false,
+		error: Errors.notAuthenticated()
+	};
+	const evidence = prepared.value;
+	if (await expected(evidence.request, evidence) && await verifiedPreparedCommand(evidence, session.email, signerAddress, deps.chainId)) return prepared;
+	const refused = {
+		ok: false,
+		error: Errors.invalidInput("execution", "prepared command mismatch")
+	};
+	return close ? abandonPrepared(deps, evidence.executionId, "prepared_mismatch", refused) : refused;
+}
+/** A retry, a request payment or a payroll run, rather than a new Payment. */
+const isCommandApproval = (input) => "retry" in input || "request" in input || "payrollRun" in input;
+/** Prepare a retry, a request payment or a payroll run for `signerAddress`, checked. */
+function prepareVerifiedCommand(deps, input, signerAddress, signal) {
+	if ("retry" in input) return prepareVerifiedRetry(deps, input, signerAddress, signal);
+	if ("request" in input) return prepareVerifiedRequestPayment(deps, input, signerAddress, signal);
+	return prepareVerifiedPayrollRun(deps, input, signerAddress, signal);
+}
+/** The retry of one Payment, prepared in the scope that paid it. */
+async function prepareVerifiedRetry(deps, input, signerAddress, signal) {
+	const intent = {
+		kind: "retry",
+		paymentId: input.retry
+	};
+	return checked(deps, signerAddress, await runIfActive(signal, CAPXUL_OPERATIONS.payments.prepareLifecycleExecution, () => callOperation(deps.convexCall, lifecycles.prepareScoped, {
+		signerAddress,
+		intent,
+		expectedScope: input.organizationId === void 0 ? { kind: "account" } : {
+			kind: "organization",
+			orgId: input.organizationId
+		}
+	}).pipe(Effect.mapError((publicError) => ({ publicError }))), deps.runPromise), lifecycleCommandCheck(intent, input.organizationId), false);
+}
+/** The Payment of one request, exactly as the request froze it. */
+async function prepareVerifiedRequestPayment(deps, input, signerAddress, signal) {
+	const decoded = Schema.decodeResult(RequestPaymentConfirmationSchema, { onExcessProperty: "error" })(input.request);
+	if (decoded._tag === "Failure") return {
+		ok: false,
+		error: Errors.invalidInput("confirmation", "invalid request confirmation")
+	};
+	const confirmation = decoded.success;
+	return checked(deps, signerAddress, await runIfActive(signal, commands$1.prepareRequest.name, () => callOperation(deps.convexCall, commands$1.prepareRequest, {
+		confirmation,
+		signerAddress
+	}).pipe(Effect.mapError((publicError) => ({ publicError }))), deps.runPromise), requestPaymentCheck(confirmation), false);
+}
+/** One payroll run: the run the backend writes and the batch that pays it, checked together. */
+async function prepareVerifiedPayrollRun(deps, input, signerAddress, signal) {
+	let run;
+	try {
+		run = decodePayrollRunInput(input.payrollRun);
+	} catch (cause) {
+		return {
+			ok: false,
+			error: asCapxulError(cause)
+		};
+	}
+	const orgId = input.organizationId;
+	const requestKey = run.requestKey ?? `payroll_${crypto.randomUUID()}`;
+	const { permissionId, asset, period, items } = run;
+	const authorized = await runIfActive(signal, runs.authorize.name, () => callOperation(deps.convexCall, runs.authorize, {
+		orgId,
+		permissionId,
+		asset,
+		requestKey,
+		signerAddress,
+		period,
+		items
+	}).pipe(Effect.mapError((publicError) => ({ publicError }))), deps.runPromise);
+	if (!authorized.ok) return authorized;
+	return checked(deps, signerAddress, {
+		ok: true,
+		value: authorized.value.execution
+	}, isAuthorizedRunBatch({
+		orgId,
+		permissionId,
+		requestKey,
+		asset,
+		period,
+		items
+	}, authorized.value.run), authorized.value.replay.kind !== "accepted");
+}
+//#endregion
 //#region ../../packages/sdk/src/accounts/organization-approvals.ts
 /** The Organization Payment prepared for `signerAddress` and checked, before any approval. */
 async function prepareVerifiedOrganizationPayment(deps, input, signerAddress, signal) {
@@ -23965,6 +24508,7 @@ function makeApprovalsMethods(deps) {
 	};
 	const prepare = async (input, options) => {
 		const signal = options?.signal;
+		if (isCommandApproval(input)) return openApproval(signal, (signerAddress) => prepareVerifiedCommand(deps, input, signerAddress, signal));
 		if ("organizationId" in input) return openApproval(signal, (signerAddress) => prepareVerifiedOrganizationPayment(deps, input, signerAddress, signal));
 		const intent = paymentExecutionIntent(input);
 		if (!intent.ok) return intent;
@@ -24057,7 +24601,7 @@ function makeApprovalsMethods(deps) {
 			ok: true,
 			value: null
 		};
-		const payments = await readApprovalPayments(deps, approval.operation.paymentIds, organizationId, signal);
+		const payments = await readApprovalPayments(deps, approval.operation.paymentIds, organizationId ?? (approval.actor.kind === "organization" ? approval.actor.orgId : void 0), signal);
 		if (!payments.ok) return payments;
 		if (unsent(approval, payments.value)) {
 			const sent = await submit(approvalId);
@@ -26894,14 +27438,6 @@ function executeIdentityProductObservation(telemetry, record, state) {
 	return ignoreTransportFailure(() => invocationTelemetry.emit(mapped), "emit", mapped.name).pipe(Effect.andThen(ignoreTransportFailure(after, mapped.name === "auth_signed_out" ? "reset" : "identify", mapped.name)));
 }
 //#endregion
-//#region ../../packages/protocol/src/payroll/model.ts
-function toPayrollRunId(raw) {
-	return toNonEmptyStringBrand(raw, "payrollRunId", (value) => isNonEmptyString(value));
-}
-function toPayrollGroupId(raw) {
-	return toNonEmptyStringBrand(raw, "payrollGroupId", (value) => isNonEmptyString(value));
-}
-//#endregion
 //#region ../../packages/sdk/src/permissions/command-decoding.ts
 /** The caller's input as a command: ids branded and the intent decoded, or invalid input thrown. */
 const buildCommand = {
@@ -38042,411 +38578,6 @@ function makePermissionMethods(deps, orgId) {
 	};
 }
 //#endregion
-//#region ../../packages/sdk/src/payroll/run-checks.ts
-/** Match the caller's compensation to the committed V3 Payslip. */
-function payslipIdentityMatches(message, item, index, runId, period) {
-	return message.runId === runId && message.itemIndex === index && message.employeeRef === item.partyId && message.periodStart === period.start && message.periodEnd === period.end && message.adjustmentsHash === hashAdjustmentsV3(item.adjustments);
-}
-function payslipAmountMatches(message, item) {
-	const exact = toExactAssetAmount(item.amount, CONFIGURED_MONEY_ASSETS);
-	return message.gross.asset === exact.asset && message.gross.minorUnits === item.gross && message.gross.decimals === exact.decimals && message.net.asset === exact.asset && message.net.minorUnits === item.net && message.net.decimals === exact.decimals;
-}
-function isRunItem(prepared, item, evidence, index, runId, period) {
-	if (prepared === void 0) return false;
-	const bundle = evidence.preparedCommand?.documentBundles?.[index];
-	const preparedItem = evidence.preparedCommand?.items[index];
-	const payslip = bundle?.envelope;
-	if (bundle === void 0 || payslip?.primaryType !== "Payslip") return false;
-	return canonicalJson(prepared.to) === canonicalJson(item.to) && prepared.paymentType === "payroll" && canonicalJson(prepared.amount) === canonicalJson(item.amount) && bundle.adjustments !== void 0 && canonicalJson(bundle.adjustments) === canonicalJson(item.adjustments) && payslipIdentityMatches(payslip.message, item, index, runId, period) && payslipAmountMatches(payslip.message, item) && (preparedItem?.operation === "send" || preparedItem?.operation === "create_commitment") && preparedItem.documentHash === evidence.preparedCommand?.instructionDocuments?.[index]?.documentHash;
-}
-/**
-* The batch the backend derived from a payroll intent must be the batch this
-* caller asked for, checked before the digest is signed.
-*
-* The payslip envelope on each item is server-built and carries the run row's
-* own `issuedAt`, so the batch cannot be fingerprinted against a local copy
-* (`matchesIntent` is unavailable here). What CAN be verified is every field
-* the caller supplied — the org, the Budget, the request key, and per item the
-* recipient, the amount and the payslip figures — plus the lineage binding the
-* batch to the run just written. A prepared command that pays a different
-* person, a different amount, from a different Budget, or under a different
-* run never reaches the signer.
-*/
-function isRunBatch(input) {
-	return (batch, evidence) => Promise.resolve(!("kind" in batch) && batch.orgId === input.orgId && batch.permissionId === input.permissionId && batch.requestKey === input.requestKey && batch.lineage?.kind === "payroll" && batch.lineage.runId === input.runId && batch.items.length === input.items.length && batch.items.every((item) => item.amount.asset === input.asset) && input.items.every((item, index) => isRunItem(batch.items[index], item, evidence, index, input.runId, input.period)));
-}
-/** A decoded detail is the run asked for, whole: its scope, membership and quantities agree. */
-function checkPayrollRunDetail(value, orgId, runId) {
-	if (value === null) return {
-		ok: true,
-		value: null
-	};
-	if (value.orgId !== orgId || value.run.id !== runId || value.items.length === 0 || value.items.length !== value.run.recipientCount || new Set(value.items.map((item) => item.payment.id)).size !== value.items.length || value.items.some((item, index) => item.itemIndex !== index || item.amount.asset !== value.run.total.asset || item.payment.amount.asset !== item.amount.asset || item.payment.paymentType !== "payroll")) return {
-		ok: false,
-		error: Errors.invalidInput("run", "Payroll run scope or membership does not match")
-	};
-	try {
-		const total = toExactAssetAmount(value.run.total, CONFIGURED_MONEY_ASSETS);
-		let rawTotal = 0n;
-		for (const item of value.items) {
-			const amount = toExactAssetAmount(item.amount, CONFIGURED_MONEY_ASSETS);
-			const payment = toExactAssetAmount(item.payment.amount, CONFIGURED_MONEY_ASSETS);
-			if (amount.minorUnits !== payment.minorUnits) return {
-				ok: false,
-				error: Errors.invalidInput("run", "Payroll item quantity does not match its Payment")
-			};
-			rawTotal += BigInt(amount.minorUnits);
-		}
-		if (rawTotal !== BigInt(total.minorUnits)) return {
-			ok: false,
-			error: Errors.invalidInput("run", "Payroll run total does not match its items")
-		};
-	} catch {
-		return {
-			ok: false,
-			error: Errors.invalidInput("run", "Payroll run quantities are invalid")
-		};
-	}
-	return {
-		ok: true,
-		value
-	};
-}
-//#endregion
-//#region ../../packages/sdk/src/payroll/run-decoding.ts
-function toPayrollRun(wire) {
-	return {
-		id: toPayrollRunId(wire.id),
-		status: wire.status,
-		periodStart: wire.periodStart,
-		periodEnd: wire.periodEnd,
-		total: wire.total,
-		recipientCount: wire.recipientCount
-	};
-}
-function toPayrollRuns(wire) {
-	return {
-		...mapPage(wire, toPayrollRun),
-		settledThisMonth: wire.settledThisMonth
-	};
-}
-function toPayrollGroup(wire) {
-	return {
-		id: toPayrollGroupId(wire.id),
-		name: wire.name,
-		tone: wire.tone,
-		members: wire.members.map((member) => ({
-			partyId: member.partyId,
-			amount: member.amount,
-			currency: member.currency
-		}))
-	};
-}
-function validateRunItems(input) {
-	for (const [index, item] of input.items.entries()) {
-		if (Schema.decodeResult(PayrollRunItemInputSchema, { onExcessProperty: "error" })(item)._tag === "Failure") return Errors.invalidInput(`items.${index}`, "invalid Payroll item");
-		try {
-			const exact = toExactAssetAmount(item.amount, CONFIGURED_MONEY_ASSETS);
-			const net = BigInt(item.net);
-			const gross = BigInt(item.gross);
-			const adjustments = item.adjustments.reduce((sum, row) => sum + BigInt(row.amount), 0n);
-			if (item.amount.asset !== input.asset || item.net !== exact.minorUnits || gross + adjustments !== net) return Errors.invalidInput(`items.${index}`, "invalid Payroll units");
-		} catch {
-			return Errors.invalidInput(`items.${index}`, "invalid Payroll units");
-		}
-	}
-	return null;
-}
-const RunInputSchema = Schema.Struct({
-	permissionId: AuthorizePayrollRunExecutionInputSchema.fields.permissionId,
-	asset: AuthorizePayrollRunExecutionInputSchema.fields.asset,
-	period: AuthorizePayrollRunExecutionInputSchema.fields.period,
-	items: AuthorizePayrollRunExecutionInputSchema.fields.items,
-	requestKey: Schema.optional(AuthorizePayrollRunExecutionInputSchema.fields.requestKey)
-});
-/** Decode caller input before session or signer work. Keep routing outside the input. */
-function decodePayrollRunInput(value) {
-	try {
-		const decoded = Schema.decodeUnknownSync(RunInputSchema, { onExcessProperty: "error" })(value);
-		const input = {
-			permissionId: decoded.permissionId,
-			asset: decoded.asset,
-			period: decoded.period,
-			...decoded.requestKey === void 0 ? {} : { requestKey: decoded.requestKey },
-			items: decoded.items.map((item) => ({
-				amount: item.amount,
-				gross: item.gross,
-				net: item.net,
-				adjustments: item.adjustments,
-				partyId: toPartyId(item.partyId),
-				to: item.to.kind === "party" ? {
-					kind: "party",
-					partyId: toPartyId(item.to.partyId)
-				} : item.to.kind === "address" ? {
-					kind: "address",
-					address: toAddress(item.to.address)
-				} : item.to
-			}))
-		};
-		if (input.items.length === 0 || input.period.start > input.period.end) throw Errors.invalidInput("input", "Payroll requires items and an ordered period");
-		const error = validateRunItems(input);
-		if (error !== null) throw error;
-		return input;
-	} catch (cause) {
-		throw cause instanceof CapxulError ? cause : Errors.invalidInput("input", "Invalid Payroll input");
-	}
-}
-/** Read only the exact backend prepare receipt, never an arbitrary signer failure. */
-function payrollResolution(error, requestKey) {
-	const details = error.details;
-	if (error.code !== "WRONG_STATE" || details?.method !== runs.authorize.name || details.requestKey !== requestKey || typeof details.commandId !== "string" || typeof details.runId !== "string") return void 0;
-	return details.payrollResolution === "failed" || details.payrollResolution === "settled" ? details.payrollResolution : void 0;
-}
-function validatePayrollRunLookup(orgId, runId) {
-	return !Schema.is(PayrollRunIdSchema)(runId) || orgId.length === 0 ? {
-		ok: false,
-		error: Errors.invalidInput("runId", "Organization and run ID must be valid")
-	} : {
-		ok: true,
-		value: void 0
-	};
-}
-/** Strict saved detail decoder shared by the read and fresh stream. */
-function decodePayrollRunDetail(raw, orgId, runId) {
-	const decoded = Schema.decodeUnknownResult(Schema.NullOr(PayrollRunDetailSchema), { onExcessProperty: "error" })(raw);
-	if (decoded._tag === "Failure") return {
-		ok: false,
-		error: Errors.invalidInput("run", "Invalid Payroll run detail")
-	};
-	return checkPayrollRunDetail(decoded.success, orgId, runId);
-}
-//#endregion
-//#region ../../packages/sdk/src/payroll/run-subscription.ts
-function detailValue(result) {
-	if (!result.ok) throw result.error;
-	return result.value;
-}
-function subscribePayrollRun(deps, orgId, runId, listener, options) {
-	const operation = CAPXUL_OPERATIONS.org.payroll.subscribeRun;
-	const valid = deps.validate(orgId, runId);
-	if (!valid.ok) return runCapxulEffect(Effect.fail(valid.error), observationOnlyControls(deps.invocationControls?.(options) ?? options), operation, deps.runPromise);
-	const decode = (raw) => detailValue(deps.decode(raw, orgId, runId));
-	return subscribeFreshQuery(deps, {
-		orgId,
-		runId
-	}, listener, operation, {
-		decode,
-		validateCached: (raw) => {
-			decode(raw);
-		},
-		invalidValue: (cause) => isCapxulError(cause) ? cause : Errors.invalidInput("run", "Invalid Payroll run detail"),
-		invalidScope: () => Errors.invalidInput("run", "Payroll run subscription scope does not match"),
-		lostValue: () => Errors.invalidInput("run", "Payroll run is no longer readable"),
-		unavailable: () => Errors.notImplemented("payroll", "subscribeRun")
-	}, options);
-}
-//#endregion
-//#region ../../packages/sdk/src/payroll/run-authorization.ts
-/**
-* Authorize one payroll run: a stable request key, the prepared batch checked
-* against the run the caller asked for, the signature, and the submission.
-*/
-async function authorizePayrollRun(scope, input, controls, onRequestKey, onResolved) {
-	const { deps, orgId, requestKeyScope } = scope;
-	const signal = controls?.signal;
-	const execution = executionDependencies(deps);
-	if (execution === null) return {
-		ok: false,
-		error: Errors.notImplemented("payroll", "executionComposition")
-	};
-	try {
-		input = decodePayrollRunInput(input);
-	} catch (cause) {
-		return {
-			ok: false,
-			error: asCapxulError(cause)
-		};
-	}
-	const { requestKey: provided, ...canonicalInput } = input;
-	const actorId = onRequestKey === void 0 ? void 0 : execution.actor.authSession()?.authUserId;
-	if (onRequestKey !== void 0 && actorId === void 0) return {
-		ok: false,
-		error: Errors.notAuthenticated()
-	};
-	const requestKey = await paymentRequestKeyLifecycle(`${requestKeyScope}:${AUTHORIZE_RUN}`, onRequestKey === void 0 ? {
-		orgId,
-		input
-	} : {
-		actorId,
-		orgId,
-		input: canonicalInput
-	}, provided, onRequestKey === void 0 ? void 0 : { manageProvidedKey: true });
-	try {
-		await onRequestKey?.(requestKey.key);
-		if (onRequestKey !== void 0 && execution.actor.authSession()?.authUserId !== actorId) {
-			await requestKey.finish(false).catch(() => void 0);
-			return {
-				ok: false,
-				error: Errors.notAuthenticated()
-			};
-		}
-	} catch (cause) {
-		await requestKey.finish(false).catch(() => void 0);
-		return {
-			ok: false,
-			error: asCapxulError(cause)
-		};
-	}
-	let authorized;
-	let acceptedReplay;
-	let preparedClosed = false;
-	let terminalReplay;
-	const submitted = await executePrepared(execution, async (signerAddress) => {
-		const prepared = await runIfActive(signal, AUTHORIZE_RUN, () => withInvocationParentSpan(Effect.suspend(() => callOperation(deps.convexCall, runs.authorize, copyInvocationObservation(controls, {
-			orgId,
-			permissionId: input.permissionId,
-			asset: input.asset,
-			requestKey: requestKey.key,
-			signerAddress,
-			period: input.period,
-			items: input.items
-		}))).pipe(Effect.mapError((publicError) => ({ publicError }))), controls), deps.runPromise);
-		if (!prepared.ok) {
-			terminalReplay = payrollResolution(prepared.error, requestKey.key);
-			return prepared;
-		}
-		authorized = prepared.value.run;
-		acceptedReplay = prepared.value.replay.kind === "accepted" ? prepared.value.replay.submission : void 0;
-		return {
-			ok: true,
-			value: prepared.value.execution
-		};
-	}, (request, evidence) => authorized === void 0 || authorized.periodStart !== input.period.start || authorized.periodEnd !== input.period.end ? Promise.resolve(false) : isRunBatch({
-		orgId,
-		permissionId: input.permissionId,
-		requestKey: requestKey.key,
-		runId: authorized.id,
-		asset: input.asset,
-		period: input.period,
-		items: input.items
-	})(request, evidence), true, () => preparedClosed = true, signal, controls, void 0, () => acceptedReplay);
-	const resolution = preparedClosed ? "failed" : terminalReplay;
-	if (resolution !== void 0) try {
-		await onResolved?.(resolution);
-	} catch {}
-	try {
-		await requestKey.finish(submitted.ok || resolution !== void 0);
-	} catch {}
-	if (!submitted.ok) return submitted;
-	return authorized === void 0 ? {
-		ok: false,
-		error: Errors.unknown()
-	} : {
-		ok: true,
-		value: toPayrollRun(authorized)
-	};
-}
-const AUTHORIZE_RUN = runs.authorize.name;
-function executionDependencies(deps) {
-	return deps.actor === void 0 || deps.chainId === void 0 || deps.signer === void 0 ? null : {
-		actor: deps.actor,
-		chainId: deps.chainId,
-		convexCall: deps.convexCall,
-		runPromise: deps.runPromise,
-		signer: deps.signer,
-		...deps.telemetry === void 0 ? {} : { telemetry: deps.telemetry }
-	};
-}
-//#endregion
-//#region ../../packages/sdk/src/payroll/runs.ts
-function makePayrollMethods(deps, orgId) {
-	const requestKeyScope = deps.requestKeyScope ?? `client-${crypto.randomUUID()}`;
-	/** One observed call of one payroll row, its reply projected inside the call, under the row's name. */
-	const call = (row, args, options, project) => {
-		const controls = deps.invocationControls?.(options) ?? options;
-		return runPortEffect(callOperation(deps.convexCall, row, copyInvocationObservation(controls, args)).pipe(Effect.map(project), Effect.mapError((publicError) => ({ publicError }))), controls, row.name, deps.runPromise);
-	};
-	return {
-		subscribeRun: (runId, listener, options) => subscribePayrollRun({
-			actor: deps.actor,
-			convexCall: deps.convexCall,
-			query: reference(runs.get),
-			runPromise: deps.runPromise,
-			invocationControls: deps.invocationControls,
-			decode: decodePayrollRunDetail,
-			validate: validatePayrollRunLookup
-		}, orgId, runId, listener, options),
-		getRun: (runId, options) => {
-			const controls = deps.invocationControls?.(options) ?? options;
-			const lifetime = deps.actor?.authLifetime();
-			const operation = runs.get.name;
-			return runCapxulEffect(Effect.gen(function* () {
-				const lookup = validatePayrollRunLookup(orgId, runId);
-				if (!lookup.ok) return yield* Effect.fail(lookup.error);
-				if (lifetime === void 0 || lifetime.authUserId === null || deps.actor === void 0) return yield* Effect.fail(Errors.notAuthenticated());
-				const current = () => deps.actor?.matchesAuthLifetime(lifetime, lifetime.authUserId) === true;
-				if (!current()) return yield* Effect.fail(Errors.notAuthenticated());
-				const parent = yield* Effect.currentSpan.pipe(Effect.orDie);
-				const captured = carryInvocationParentSpan(controls, parent);
-				const run = yield* awaitCapxulResult(() => runIfActive(controls?.signal, operation, () => withInvocationParentSpan(Effect.suspend(() => callOperation(deps.convexCall, runs.get, copyInvocationObservation(captured, {
-					orgId,
-					runId
-				}))).pipe(Effect.mapError((publicError) => ({ publicError }))), captured), deps.runPromise));
-				if (!current()) return yield* Effect.fail(Errors.cancelled({ operation }));
-				const checked = checkPayrollRunDetail(run, orgId, runId);
-				return yield* checked.ok ? Effect.succeed(checked.value) : Effect.fail(checked.error);
-			}), observationOnlyControls(controls), operation, deps.runPromise);
-		},
-		runs: (options) => call(runs.list, { orgId }, options, toPayrollRuns),
-		authorizeRun: (input, options) => {
-			const controls = deps.invocationControls?.(options) ?? options;
-			return runCapxulEffect(Effect.gen(function* () {
-				if (controls?.signal?.aborted === true) return yield* Effect.fail(Errors.cancelled({ operation: AUTHORIZE_RUN }));
-				const parent = yield* Effect.currentSpan.pipe(Effect.orDie);
-				return yield* awaitCapxulResult(() => authorizePayrollRun({
-					deps,
-					orgId,
-					requestKeyScope
-				}, input, carryInvocationParentSpan(controls, parent), options?.onRequestKey, options?.onResolved));
-			}), observationOnlyControls(controls), AUTHORIZE_RUN, deps.runPromise);
-		},
-		terms: (options) => call(terms.list, { orgId }, options, (rates) => rates),
-		groups: {
-			list: (options) => call(groups.list, { orgId }, options, (saved) => mapPage(saved, toPayrollGroup)),
-			save: (input, options) => call(groups.save, {
-				orgId,
-				...input.id === void 0 ? {} : { id: String(input.id) },
-				name: input.name,
-				tone: input.tone,
-				members: input.members
-			}, options, toPayrollGroup),
-			remove: (id, options) => call(groups.remove, {
-				orgId,
-				id
-			}, options, () => void 0)
-		}
-	};
-}
-const payrollUnavailable = () => Promise.resolve({
-	ok: false,
-	error: Errors.notImplemented("payroll", "executionComposition")
-});
-/** The bundle an unconfigured client exposes — every verb refuses, none throws. */
-function makeUnavailablePayrollMethods() {
-	return {
-		getRun: payrollUnavailable,
-		subscribeRun: payrollUnavailable,
-		runs: payrollUnavailable,
-		authorizeRun: payrollUnavailable,
-		terms: payrollUnavailable,
-		groups: {
-			list: payrollUnavailable,
-			save: payrollUnavailable,
-			remove: payrollUnavailable
-		}
-	};
-}
-//#endregion
 //#region ../../node_modules/.pnpm/axios@1.17.0/node_modules/axios/lib/helpers/bind.js
 /**
 * Create a bound version of a function with a specified `this` context
@@ -71068,7 +71199,7 @@ function stdioIdentity(env = process.env, options = {}) {
 }
 //#endregion
 //#region package.json
-var version = "4.20.0-beta.26";
+var version = "4.20.0-beta.27";
 //#endregion
 //#region src/deps.ts
 const NO_IDENTITY = async () => void 0;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@capxul/mcp",
-  "version": "4.20.0-beta.26",
+  "version": "4.20.0-beta.27",
   "private": false,
   "description": "Capxul MCP server for auth, Account readiness, identity, Organizations, relationships, requests, destinations, and testnet funding over Streamable HTTP.",
   "keywords": [
@@ -54,8 +54,8 @@
     "typescript": "npm:@typescript/typescript6@6.0.2",
     "vite": "npm:@voidzero-dev/vite-plus-core@1.0.0",
     "vite-plus": "1.0.0",
-    "@capxul/protocol": "0.2.0-beta.0",
-    "@capxul/sdk": "4.20.0-beta.26",
+    "@capxul/protocol": "0.2.0-beta.1",
+    "@capxul/sdk": "4.20.0-beta.27",
     "@capxul/typescript-config": "0.0.0"
   },
   "scripts": {