@capxul/mcp 4.20.0-beta.26 → 4.20.0-beta.28

package/dist/main.mjs

@@ -1227,7 +1227,7 @@ const FIELD_RULES = {
 	},
 	anonymousId: {
 		maxLength: 128,
-		pattern: /^anon_[A-Za-z0-9-]+$/u
+		pattern: /^(?:anon_[A-Za-z0-9-]+|[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})$/u
 	},
 	traceparent: {
 		maxLength: 55,
@@ -9610,10 +9610,19 @@ const ApprovalNetworkSchema = Schema.Struct({
 	name: Schema.String,
 	explorerUrl: Schema.String
 });
+/**
+* Whose money the operation moves: the person's own, or an Organization's,
+* which a reader follows through that Organization's scope.
+*/
+const ApprovalActorSchema = Schema.Union([Schema.Struct({ kind: Schema.Literal("personal") }), Schema.Struct({
+	kind: Schema.Literal("organization"),
+	orgId: Schema.NonEmptyString
+})]);
 /** What the person reads before they sign. */
 const ApprovalSummarySchema = Schema.Struct({
 	title: Schema.String,
 	from: Schema.Struct({
+		kind: Schema.Literals(["personal", "organization"]),
 		label: Schema.String,
 		address: AddressSchema$1
 	}),
@@ -9635,6 +9644,7 @@ const ApprovalSchema = Schema.Struct({
 	url: Schema.String,
 	kind: Schema.Literals(APPROVAL_KINDS),
 	state: Schema.Literals(APPROVAL_STATES),
+	actor: ApprovalActorSchema,
 	summary: ApprovalSummarySchema,
 	operation: ApprovalOperationSchema,
 	/** Who must sign: the owner key of the paying Safe. */
@@ -10302,6 +10312,28 @@ const probes = {
 	})
 };
 //#endregion
+//#region ../../packages/protocol/src/evm/role-dsl.ts
+const ORG_BUDGET_ACTIONS = [
+	"send",
+	"sendBatch",
+	"createCommitment"
+];
+/**
+* How a capped Budget's allowance refills (#2298). `monthly` refills the
+* allowance to its cap every 30 days. Roles v2 counts fixed periods from the
+* moment the allowance is set; it has no calendar month. Absent means `none`:
+* the cap is one pot that spending drains for good.
+*/
+const ORG_BUDGET_REFILLS = ["monthly", "none"];
+/** The fixed Roles v2 refill period of a `monthly` Budget: 30 days, in seconds. */
+const MONTHLY_REFILL_PERIOD_SECONDS = 30n * 24n * 60n * 60n;
+/** Derive the Zodiac substrate key for one durable Permission identity. */
+function roleKeyForPermission(permissionId) {
+	const normalized = permissionId.trim();
+	if (normalized.length === 0 || normalized !== permissionId) throw Errors.invalidInput("permissionId", "must be a non-empty canonical Permission ID");
+	return keccak256$1(toBytes$1(`permission ${permissionId}`));
+}
+//#endregion
 //#region ../../packages/protocol/src/permissions/permission-schema.ts
 /**
 * One stored `setAllowance` call inside a command's expected authority set.
@@ -10340,12 +10372,19 @@ const BudgetScopeSchema = Schema.Struct({
 	})]),
 	actions: Schema.NonEmptyArray(Schema.Literals(["pay", "commitments"]))
 }).pipe(Schema.refine((scope) => new Set(scope.actions).size === scope.actions.length && (scope.recipients.type === "anyone" || scope.recipients.accounts.length >= 1 && scope.recipients.accounts.length <= 32 && new Set(scope.recipients.accounts).size === scope.recipients.accounts.length), { message: "Budget scope requires unique actions and one to 32 unique allowed Accounts" }));
+/**
+* How a capped Budget refills (#2298): `monthly` tops the cap back up every 30
+* days (a fixed Roles v2 period, not a calendar month); `none` never refills.
+* Absent means `none`, and writers store only `monthly`.
+*/
+const BudgetRefillSchema = Schema.Literals(ORG_BUDGET_REFILLS);
 /** The accepted product policy stored with one Permission revision. */
 const CurrentPolicySchema = Schema.Union([Schema.Struct({
 	type: Schema.Literal("budget"),
 	asset: AssetIdSchema,
 	limit: Schema.NullOr(Schema.String),
-	scope: BudgetScopeSchema
+	scope: BudgetScopeSchema,
+	refill: Schema.optional(BudgetRefillSchema)
 }), Schema.Struct({ type: Schema.Literal("managePeople") })]);
 const BudgetIntentSchema = CurrentPolicySchema.pipe(Schema.refine((value) => {
 	if (value.type !== "budget") return false;
@@ -10410,7 +10449,8 @@ const ResolvedPermissionBudgetPolicySchema = Schema.Struct({
 		"send",
 		"sendBatch",
 		"createCommitment"
-	]))
+	])),
+	refill: Schema.optional(BudgetRefillSchema)
 });
 const PermissionRecipientBindingSchema = Schema.Struct({
 	accountId: AccountIdSchema$1,
@@ -10422,16 +10462,22 @@ const StoredPermissionIntentSchema = Schema.Union([Schema.Struct({
 	type: Schema.Literal("budget"),
 	asset: AssetIdSchema,
 	limit: Schema.NullOr(AssetAmountSchema),
-	scope: Schema.optional(BudgetScopeSchema)
+	scope: Schema.optional(BudgetScopeSchema),
+	refill: Schema.optional(BudgetRefillSchema)
 }).pipe(Schema.refine((intent) => intent.limit === null || intent.limit.asset === intent.asset, { message: "Budget limit must use the Budget asset" })), Schema.Struct({ type: Schema.Literal("managePeople") })]);
 /** Writes state every granted right and use a finite positive AssetAmount cap. */
 const PermissionIntentSchema = Schema.Union([Schema.Struct({
 	type: Schema.Literal("budget"),
 	asset: AssetIdSchema,
 	limit: AssetAmountSchema,
-	scope: BudgetScopeSchema
+	scope: BudgetScopeSchema,
+	refill: Schema.optional(BudgetRefillSchema)
 }).pipe(Schema.refine((intent) => intent.limit.asset === intent.asset && /[1-9]/u.test(intent.limit.value), { message: "Budget cap must be positive and use the Budget asset" })), Schema.Struct({ type: Schema.Literal("managePeople") })]);
-/** Decode once and give set-like scope fields one stable command representation. */
+/**
+* Decode once and give set-like scope fields one stable command representation.
+* An explicit `refill: "none"` is kept: on a change it turns a refill off,
+* where a missing `refill` keeps the Budget's current one (`keepRefillOnChange`).
+*/
 function decodePermissionIntent$1(input) {
 	const intent = Schema.decodeUnknownSync(PermissionIntentSchema, { onExcessProperty: "error" })(input);
 	if (intent.type === "managePeople") return intent;
@@ -10446,6 +10492,19 @@ function decodePermissionIntent$1(input) {
 		}
 	});
 }
+/**
+* A Budget change that leaves `refill` out keeps the Budget's current refill:
+* a change never turns a refill off by omission. An explicit `"none"` turns it
+* off. The backend plans, the SDK verifies and the CLI confirms the same
+* result. A create has no current refill, so a missing one means `none`.
+*/
+function keepRefillOnChange(intent, before) {
+	if (intent.type !== "budget" || intent.refill !== void 0 || before?.type !== "budget" || before.refill !== "monthly") return intent;
+	return {
+		...intent,
+		refill: before.refill
+	};
+}
 //#endregion
 //#region ../../packages/protocol/src/permissions/replacement-schema.ts
 const InvitationPhaseSchema = Schema.Literals([
@@ -10650,7 +10709,7 @@ const InviteGrantsSchema = Schema.Array(Schema.Union([
 	Schema.Struct({
 		type: Schema.Literal("new_budget"),
 		label: Schema.String.pipe(Schema.refine((value) => value.trim().length >= 1 && value.trim().length <= 128)),
-		intent: BudgetIntentSchema
+		intent: BudgetIntentSchema.pipe(Schema.refine((intent) => intent.refill !== "monthly", { message: "An invitation's new Budget cannot refill; change it once granted" }))
 	})
 ])).pipe(Schema.refine((grants) => {
 	if (grants.length < 1 || grants.length > 16) return false;
@@ -13524,7 +13583,9 @@ const PEOPLE_OPERATIONS = {
 			emitSafeConfirmed: "accounts.safes.emitSafeConfirmed",
 			readSafe: "accounts.safes.readSafe",
 			recordDeployment: "accounts.safes.recordDeployment"
-		}
+		},
+		/** The home's requests to pay and Payments to retry, read in one query. */
+		summaries: { loadNeedsYou: "accounts.summaries.loadNeedsYou" }
 	},
 	/** The host observer's names for `client.approvals.*`. */
 	approvals: {
@@ -13705,7 +13766,11 @@ const ORGANIZATION_OPERATIONS = {
 			seedNativeReadiness: "operator.fixtures.seedNativeReadiness",
 			seedPrerequisites: "operator.fixtures.seedPrerequisites"
 		},
-		identities: { purgeByEmail: "operator.identities.purgeByEmail" }
+		identities: {
+			purgeByEmail: "operator.identities.purgeByEmail",
+			/** One Account and every row that refers to it, unless it has Payments or an Organization tie. */
+			purgeAccount: "operator.identities.purgeAccount"
+		}
 	},
 	/** Organizations' internal functions; its public rows join from `OPERATIONS`. */
 	organizations: {
@@ -13779,7 +13844,9 @@ emitSaved: "activity.annotations.emitSaved" },
 		pay: "organizationPayments.pay",
 		payBatch: "organizationPayments.payBatch",
 		prepareExecution: "organizationPayments.prepareExecution",
-		retry: "organizationPayments.retry"
+		retry: "organizationPayments.retry",
+		cancel: "organizationPayments.cancel",
+		redirect: "organizationPayments.redirect"
 	},
 	/**
 	* Payments' internal functions and the client's own method names; its public
@@ -13801,7 +13868,9 @@ emitSaved: "activity.annotations.emitSaved" },
 			loadContext: "payments.commands.loadContext",
 			loadExecutionContext: "payments.commands.loadExecutionContext",
 			/** The capped Budget a prepared Organization command spends from, before its allowance is read on chain. */
-			loadBudgetAllowance: "payments.commands.loadBudgetAllowance"
+			loadBudgetAllowance: "payments.commands.loadBudgetAllowance",
+			/** What a new Payment command would spend and from which Safe, read before it is born. */
+			loadBirthFunding: "payments.commands.loadBirthFunding"
 		},
 		lifecycles: { prepareIntent: "payments.lifecycles.prepareIntent" },
 		/** The stored UserOperation of every money command: Payment, Permission and configuration. */
@@ -13955,7 +14024,11 @@ const PLATFORM_OPERATIONS = {
 			recordUse: "applications.bootstraps.recordUse",
 			resolve: "applications.bootstraps.resolve"
 		},
-		keys: { issue: "applications.keys.issue" },
+		keys: {
+			issue: "applications.keys.issue",
+			/** Operator-only: revoke one key by its id, whoever owns it. */
+			revokeById: "applications.keys.revokeById"
+		},
 		quickstarts: {
 			claim: "applications.quickstarts.claim",
 			mint: "applications.quickstarts.mint"
@@ -14234,6 +14307,42 @@ const UiStepProps = {
 	organization_id: OptionalOrgId,
 	reason_code: OptionalReasonCode
 };
+/**
+* A journey's variants (`JOURNEYS`): the way a person came into a journey, or
+* the way they took through it. A variant is a property of the journey's step
+* events, never a journey of its own, so each journey funnel breaks down by
+* it. A step event takes only the variants that a journey contract names on
+* it, picked one by one; the analytics plan test checks both directions.
+* `pay_path` and `funding_source` have no carrier until their Phase 2 events.
+* `payment_*` events already carry `recipient_is_capxul_account`, and
+* `invoice_issued` carries `issuer_scope_kind`; neither is repeated here.
+*/
+const JourneyVariantProps = {
+	/** How a person came to Get started: by themselves, an invite, money that waited, or an invoice. */
+	entry_path: Schema.optional(Schema.Literals([
+		"signup",
+		"invite",
+		"claim",
+		"invoice"
+	])),
+	/** Where the person acted. `agent` is an AI agent driving the CLI. */
+	surface: Schema.optional(Schema.Literals([
+		"web",
+		"cli",
+		"agent"
+	])),
+	/** Who pays: a person from their own account, or an Organization from a Budget. */
+	payer_kind: Schema.optional(Schema.Literals(["person", "organization"])),
+	/** How a request was paid: from the payer's inbox, or by its link at checkout. */
+	pay_path: Schema.optional(Schema.Literals(["inbox", "link"])),
+	/** Where an account's first money came from. `bank` is the planned on-ramp. */
+	funding_source: Schema.optional(Schema.Literals([
+		"deposit",
+		"payment",
+		"claim",
+		"bank"
+	]))
+};
 //#endregion
 //#region ../../packages/observability/src/events/money.ts
 /**
@@ -14323,6 +14432,8 @@ const PaymentInitiatedProps = Schema.Struct({
 	execution_id: OptionalString,
 	payment_lifecycle_id: OptionalString,
 	...TelemetryEnvelopeProps,
+	payer_kind: JourneyVariantProps.payer_kind,
+	surface: JourneyVariantProps.surface,
 	...RecipientTelemetryProps,
 	kind: Schema.String,
 	payment_id: Schema.String
@@ -14338,6 +14449,8 @@ const PaymentLifecycleProps = {
 const PaymentSettledL2Props = Schema.Struct({
 	...PaymentLifecycleProps,
 	...TelemetryEnvelopeProps,
+	payer_kind: JourneyVariantProps.payer_kind,
+	surface: JourneyVariantProps.surface,
 	...RecipientTelemetryProps,
 	kind: Schema.String,
 	chain_id: Schema.Finite,
@@ -14545,6 +14658,7 @@ const OrganizationCreationStartedProps = Schema.Struct({
 });
 const OrganizationCreationReadyProps = Schema.Struct({
 	...TelemetryEnvelopeProps,
+	surface: JourneyVariantProps.surface,
 	$insert_id: Schema.String,
 	organization_id: OrgIdTelemetrySchema,
 	attempt_number: AttemptNumberSchema,
@@ -14569,45 +14683,6 @@ const OrganizationCreationFailedProps = Schema.Struct({
 		...ORGANIZATION_SETUP_REASONS
 	]))
 });
-const OrgCreateStartedProps = Schema.Struct({
-	...TelemetryEnvelopeProps,
-	org_id: OptionalOrgId,
-	email_domain: OptionalString,
-	template: OptionalString
-});
-const OrgSafeCreatedProps = Schema.Struct({
-	...TelemetryEnvelopeProps,
-	org_id: OptionalOrgId,
-	chainId: OptionalChainId,
-	safe_address: OptionalAddress
-});
-const OrgSafeConfirmedProps = Schema.Struct({
-	...TelemetryEnvelopeProps,
-	org_id: OptionalOrgId,
-	chainId: OptionalChainId,
-	safe_address: OptionalAddress,
-	durationMs: OptionalDurationMs
-});
-const OrgRolesSeededProps = Schema.Struct({
-	...TelemetryEnvelopeProps,
-	org_id: OptionalOrgId,
-	chainId: OptionalChainId,
-	role: OptionalString,
-	txHash: OptionalTxHash
-});
-const OrgCreatedProps = Schema.Struct({
-	...TelemetryEnvelopeProps,
-	org_id: OptionalOrgId,
-	chainId: OptionalChainId,
-	safe_address: OptionalAddress,
-	durationMs: OptionalDurationMs
-});
-const OrgCreateFailedProps = Schema.Struct({
-	...TelemetryEnvelopeProps,
-	...ChainCauseTelemetryProps,
-	org_id: OptionalOrgId,
-	reason: OptionalString
-});
 const OrgInviteSentProps = Schema.Struct({
 	...TelemetryEnvelopeProps,
 	org_id: OptionalOrgId,
@@ -14652,30 +14727,6 @@ Schema.Struct({
 	name: Schema.Literal("organization_creation_failed"),
 	props: OrganizationCreationFailedProps
 });
-Schema.Struct({
-	name: Schema.Literal("org_create_started"),
-	props: OrgCreateStartedProps
-});
-Schema.Struct({
-	name: Schema.Literal("org_safe_created"),
-	props: OrgSafeCreatedProps
-});
-Schema.Struct({
-	name: Schema.Literal("org_safe_confirmed"),
-	props: OrgSafeConfirmedProps
-});
-Schema.Struct({
-	name: Schema.Literal("org_roles_seeded"),
-	props: OrgRolesSeededProps
-});
-Schema.Struct({
-	name: Schema.Literal("org_created"),
-	props: OrgCreatedProps
-});
-Schema.Struct({
-	name: Schema.Literal("org_create_failed"),
-	props: OrgCreateFailedProps
-});
 Schema.Struct({
 	name: Schema.Literal("org_invite_sent"),
 	props: OrgInviteSentProps
@@ -15549,10 +15600,14 @@ const BootstrapFailedProps = Schema.Struct({
 });
 const MemberActivationStartedProps = Schema.Struct({
 	...TelemetryEnvelopeProps,
+	entry_path: JourneyVariantProps.entry_path,
+	surface: JourneyVariantProps.surface,
 	$insert_id: Schema.String
 });
 const MemberActivationReadyProps = Schema.Struct({
 	...TelemetryEnvelopeProps,
+	entry_path: JourneyVariantProps.entry_path,
+	surface: JourneyVariantProps.surface,
 	$insert_id: Schema.String,
 	duration_ms: DurationMsSchema
 });
@@ -17098,7 +17153,7 @@ function mapAccountLifecycle(input) {
 }
 //#endregion
 //#region ../../packages/sdk/package.json
-var version$2 = "4.20.0-beta.26";
+var version$2 = "4.20.0-beta.28";
 //#endregion
 //#region ../../packages/sdk/src/observability/telemetry/exception-projection.ts
 /** Fixed fallback for failures that have no safe message. */
@@ -20356,6 +20411,12 @@ function paymentsV2Signature(name) {
 const SEND_SIGNATURE = paymentsV2Signature("send");
 const SEND_BATCH_SIGNATURE = paymentsV2Signature("sendBatch");
 const CREATE_COMMITMENT_SIGNATURE = paymentsV2Signature("createCommitment");
+/**
+* #2299 ruling C: only an Owner cancels or redirects an Organization-funded
+* commitment, so these two sit in the Owner role's scope, never a Budget's.
+* The contract admits only the commitment's creator, the Organization Safe.
+*/
+const OWNER_COMMITMENT_SIGNATURES = [paymentsV2Signature("cancel"), paymentsV2Signature("redirect")];
 //#endregion
 //#region ../../packages/protocol/src/evm/organization-payments.ts
 /** Zodiac ModuleProxyFactory on Base Sepolia. */
@@ -20592,24 +20653,18 @@ function encodePreparedPaymentCallData(command) {
 		}));
 	}
 	const [item] = command.items;
-	if (command.executionRoute.kind !== "direct" || command.items.length !== 1 || item === void 0 || isBirth(item)) throw Errors.invalidInput("items", "Commitment lifecycle requires one direct execution");
-	return safe4337ExecuteUserOpCallData({
+	const route = command.executionRoute;
+	if (command.items.length !== 1 || item === void 0 || isBirth(item) || route.kind !== "direct" && item.operation === "claim_commitment") throw Errors.invalidInput("items", "Commitment lifecycle requires one lone execution");
+	const call = {
 		to: command.contractAddress,
+		value: 0n,
 		data: lifecycleData(item)
-	});
-}
-//#endregion
-//#region ../../packages/protocol/src/evm/role-dsl.ts
-const ORG_BUDGET_ACTIONS = [
-	"send",
-	"sendBatch",
-	"createCommitment"
-];
-/** Derive the Zodiac substrate key for one durable Permission identity. */
-function roleKeyForPermission(permissionId) {
-	const normalized = permissionId.trim();
-	if (normalized.length === 0 || normalized !== permissionId) throw Errors.invalidInput("permissionId", "must be a non-empty canonical Permission ID");
-	return keccak256$1(toBytes$1(`permission ${permissionId}`));
+	};
+	return route.kind === "direct" ? safe4337ExecuteUserOpCallData(call) : buildOrgRoleSpendPersonalCallData(buildOrgRoleMultiCall({
+		rolesModuleAddress: route.rolesModule,
+		roleKey: route.roleKey,
+		calls: [call]
+	}));
 }
 //#endregion
 //#region ../../packages/sdk/src/payments/operation-verification.ts
@@ -20638,6 +20693,16 @@ function moneySafeOpDigest(operation, chainId) {
 		userOp: safe4337UserOperation(operation)
 	});
 }
+/**
+* An Organization-funded cancel or redirect runs through the Owner role
+* (#2299), which no Budget names. Its role key cannot widen what the signer
+* may do: the Roles module admits only a role the signer's Safe holds, and the
+* contract admits only the commitment's creator.
+*/
+function isOwnerLifecycle(command) {
+	const [item] = command.items;
+	return command.items.length === 1 && (item?.operation === "cancel_commitment" || item?.operation === "redirect_commitment");
+}
 /** Verify every actual Money signing target against configured trust anchors. */
 function verifiesMoneyOperation(evidence, expectedSafe, chainId, permissionId) {
 	try {
@@ -20648,7 +20713,7 @@ function verifiesMoneyOperation(evidence, expectedSafe, chainId, permissionId) {
 		const route = command.executionRoute;
 		if (route.kind === "direct") {
 			if (permissionId !== void 0 || command.senderSafe.toLowerCase() !== expectedSafe.toLowerCase()) return false;
-		} else if (permissionId === void 0 || route.roleKey.toLowerCase() !== roleKeyForPermission(permissionId).toLowerCase() || command.senderSafe.toLowerCase() !== route.organizationSafe.toLowerCase()) return false;
+		} else if ((permissionId === void 0 ? !isOwnerLifecycle(command) : route.roleKey.toLowerCase() !== roleKeyForPermission(permissionId).toLowerCase()) || command.senderSafe.toLowerCase() !== route.organizationSafe.toLowerCase()) return false;
 		if (operation.callData.toLowerCase() !== encodePreparedPaymentCallData(command).toLowerCase()) return false;
 		const digest = moneySafeOpDigest(operation, chainId);
 		return evidence.digest.toLowerCase() === digest.toLowerCase() && evidence.executionId === `money_execution_${digest.slice(2).toLowerCase()}`;
@@ -21365,6 +21430,15 @@ function subscribeFreshQuery(deps, args, listener, operation, projection, option
 }
 //#endregion
 //#region ../../packages/sdk/src/payments/lifecycle-execution.ts
+/**
+* The prepared command is this lifecycle intent; a retry also names the
+* original birth command of the scope it was asked for. A claim, and an
+* Account's own cancel or redirect, runs directly from the signer's Safe; an
+* Organization's cancel or redirect runs through its Owner role (#2299).
+*/
+const lifecycleCommandCheck = (intent, expectedOrganizationId) => async (request, evidence) => await matchesIntent(intent)(request, evidence) && (intent.kind === "retry" ? expectedOrganizationId === void 0 ? evidence.sourceCommand?.kind === "birth" && evidence.sourceCommand.actor.kind === "account" : evidence.sourceCommand?.kind === "birth" && evidence.sourceCommand.actor.kind === "organization" && evidence.sourceCommand.actor.orgId === expectedOrganizationId : evidence.preparedCommand?.executionRoute.kind === (intent.kind === "claim" || expectedOrganizationId === void 0 ? "direct" : "zodiac_role"));
+/** The prepared command pays exactly the request the payer confirmed. */
+const requestPaymentCheck = (confirmation) => async (request) => "kind" in request && request.kind === "payment_request" && canonicalJson(request.confirmation) === canonicalJson(confirmation);
 function executePaymentLifecycle(deps, intent, signal, controls, expectedOrganizationId, onPrepared) {
 	return executePrepared(deps, (signerAddress) => runIfActive(signal, CAPXUL_OPERATIONS.payments.prepareLifecycleExecution, () => withInvocationParentSpan(Effect.suspend(() => callOperation(deps.convexCall, lifecycles.prepareScoped, copyInvocationObservation(controls, {
 		signerAddress,
@@ -21373,13 +21447,13 @@ function executePaymentLifecycle(deps, intent, signal, controls, expectedOrganiz
 			kind: "organization",
 			orgId: expectedOrganizationId
 		}
-	})).pipe(Effect.mapError((publicError) => ({ publicError })))), controls), deps.runPromise), async (request, evidence) => await matchesIntent(intent)(request, evidence) && (intent.kind !== "retry" || (expectedOrganizationId === void 0 ? evidence.sourceCommand?.kind === "birth" && evidence.sourceCommand.actor.kind === "account" : evidence.sourceCommand?.kind === "birth" && evidence.sourceCommand.actor.kind === "organization" && evidence.sourceCommand.actor.orgId === expectedOrganizationId)), false, void 0, signal, controls, onPrepared);
+	})).pipe(Effect.mapError((publicError) => ({ publicError })))), controls), deps.runPromise), lifecycleCommandCheck(intent, expectedOrganizationId), false, void 0, signal, controls, onPrepared);
 }
 function executeRequestPayment(deps, confirmation, controls, onPrepared) {
 	return executePrepared(deps, (signerAddress) => runIfActive(controls?.signal, commands$1.prepareRequest.name, () => withInvocationParentSpan(Effect.suspend(() => callOperation(deps.convexCall, commands$1.prepareRequest, copyInvocationObservation(controls, {
 		confirmation,
 		signerAddress
-	})).pipe(Effect.mapError((publicError) => ({ publicError })))), controls), deps.runPromise), async (request) => "kind" in request && request.kind === "payment_request" && canonicalJson(request.confirmation) === canonicalJson(confirmation), false, void 0, controls?.signal, controls, onPrepared);
+	})).pipe(Effect.mapError((publicError) => ({ publicError })))), controls), deps.runPromise), requestPaymentCheck(confirmation), false, void 0, controls?.signal, controls, onPrepared);
 }
 function executeOrganizationPayment(deps, input, signal, onPreparedClosed, controls, onPrepared) {
 	return executePrepared(deps, (signerAddress) => runIfActive(signal, CAPXUL_OPERATIONS.organizationPayments.prepareExecution, () => withInvocationParentSpan(Effect.suspend(() => callOperation(deps.convexCall, commands$1.prepareOrganization, copyInvocationObservation(controls, {
@@ -22252,17 +22326,21 @@ function paymentExecutionIntent(input) {
 	const to = normalizeTargetForBackend(input.to, "to");
 	if (!to.ok) return to;
 	try {
-		return {
+		const decoded = Schema.decodeResult(PaymentExecutionIntentSchema, { onExcessProperty: "error" })({
+			to: to.value,
+			amount: input.amount,
+			...input.externalAddressAcknowledged === void 0 ? {} : { externalAddressAcknowledged: input.externalAddressAcknowledged },
+			...input.paymentType === void 0 ? {} : { paymentType: input.paymentType },
+			...input.document === void 0 ? {} : { document: input.document },
+			...input.supportingReceipts === void 0 ? {} : { supportingReceipts: input.supportingReceipts },
+			...input.timing === void 0 ? {} : { timing: input.timing }
+		});
+		return Result.isSuccess(decoded) ? {
 			ok: true,
-			value: Schema.decodeSync(PaymentExecutionIntentSchema, { onExcessProperty: "error" })({
-				to: to.value,
-				amount: input.amount,
-				...input.externalAddressAcknowledged === void 0 ? {} : { externalAddressAcknowledged: input.externalAddressAcknowledged },
-				...input.paymentType === void 0 ? {} : { paymentType: input.paymentType },
-				...input.document === void 0 ? {} : { document: input.document },
-				...input.supportingReceipts === void 0 ? {} : { supportingReceipts: input.supportingReceipts },
-				...input.timing === void 0 ? {} : { timing: input.timing }
-			})
+			value: decoded.success
+		} : {
+			ok: false,
+			error: invalidPaymentField(decoded.failure.issue)
 		};
 	} catch {
 		return {
@@ -22271,6 +22349,13 @@ function paymentExecutionIntent(input) {
 		};
 	}
 }
+const formatIssue = SchemaIssue.makeFormatterStandardSchemaV1();
+/** The first failing field and why, e.g. `amount.value`, as the backend's row decode names it (#2381). */
+function invalidPaymentField(issue) {
+	const first = formatIssue(issue).issues[0];
+	const field = first?.path?.map((segment) => String(typeof segment === "object" ? segment.key : segment)).join(".");
+	return Errors.invalidInput(field === void 0 || field.length === 0 ? "payment" : field, first?.message ?? "invalid personal payment input");
+}
 function normalizePaymentTiming(payment) {
 	const { release: _release, ...rest } = payment;
 	return {
@@ -23087,6 +23172,27 @@ function makeOrganizationPaymentsMethods(deps, orgId) {
 		flights: /* @__PURE__ */ new Map()
 	};
 	const execute = (input, signal, operation = "organization-pay-batch", controls, onPrepared) => executeOrganizationBatch(scope, input, signal, operation, controls, onPrepared);
+	/** One Owner-signed cancel or redirect, answering the one Payment it acted on (#2299). */
+	const ownerLifecycle = (intent, controls, operation) => runCapxulEffect(Effect.gen(function* () {
+		const captured = carryInvocationParentSpan(controls, yield* Effect.currentSpan.pipe(Effect.orDie));
+		return yield* awaitCapxulResult(async () => {
+			const execution = executionDependencies$1(deps);
+			if (execution === null) return {
+				ok: false,
+				error: Errors.notImplemented("organizationPayments", "executionComposition")
+			};
+			const result = await executePaymentLifecycle(execution, intent, controls?.signal, captured, orgId);
+			if (!result.ok) return result;
+			const [payment, ...rest] = result.value.payments;
+			return payment === void 0 || rest.length !== 0 ? {
+				ok: false,
+				error: Errors.unknown()
+			} : {
+				ok: true,
+				value: normalizePaymentTiming(payment)
+			};
+		});
+	}), observationOnlyControls(controls), operation, deps.runPromise);
 	return {
 		...makeOrganizationPaymentReadMethods(deps, orgId),
 		retry: (paymentId, options) => {
@@ -23145,6 +23251,19 @@ function makeOrganizationPaymentsMethods(deps, orgId) {
 				});
 			}), observationOnlyControls(controls), CAPXUL_OPERATIONS.organizationPayments.pay, deps.runPromise);
 		},
+		cancel: (paymentId, options) => ownerLifecycle({
+			kind: "cancel",
+			paymentId
+		}, deps.invocationControls?.(options) ?? options, CAPXUL_OPERATIONS.organizationPayments.cancel),
+		redirect: (input, options) => {
+			const controls = deps.invocationControls?.(options) ?? options;
+			const recipient = normalizeTargetForBackend(input.to, "to");
+			return recipient.ok ? ownerLifecycle({
+				kind: "redirect",
+				paymentId: input.paymentId,
+				recipient: recipient.value
+			}, controls, CAPXUL_OPERATIONS.organizationPayments.redirect) : runCapxulEffect(Effect.fail(recipient.error), observationOnlyControls(controls), CAPXUL_OPERATIONS.organizationPayments.redirect, deps.runPromise);
+		},
 		payBatch: (input, options) => {
 			const controls = deps.invocationControls?.(options) ?? options;
 			return runCapxulEffect(Effect.gen(function* () {
@@ -23859,6 +23978,524 @@ function sleep(ms, signal) {
 	});
 }
 //#endregion
+//#region ../../packages/protocol/src/payroll/model.ts
+function toPayrollRunId(raw) {
+	return toNonEmptyStringBrand(raw, "payrollRunId", (value) => isNonEmptyString(value));
+}
+function toPayrollGroupId(raw) {
+	return toNonEmptyStringBrand(raw, "payrollGroupId", (value) => isNonEmptyString(value));
+}
+//#endregion
+//#region ../../packages/sdk/src/payroll/run-checks.ts
+/** Match the caller's compensation to the committed V3 Payslip. */
+function payslipIdentityMatches(message, item, index, runId, period) {
+	return message.runId === runId && message.itemIndex === index && message.employeeRef === item.partyId && message.periodStart === period.start && message.periodEnd === period.end && message.adjustmentsHash === hashAdjustmentsV3(item.adjustments);
+}
+function payslipAmountMatches(message, item) {
+	const exact = toExactAssetAmount(item.amount, CONFIGURED_MONEY_ASSETS);
+	return message.gross.asset === exact.asset && message.gross.minorUnits === item.gross && message.gross.decimals === exact.decimals && message.net.asset === exact.asset && message.net.minorUnits === item.net && message.net.decimals === exact.decimals;
+}
+function isRunItem(prepared, item, evidence, index, runId, period) {
+	if (prepared === void 0) return false;
+	const bundle = evidence.preparedCommand?.documentBundles?.[index];
+	const preparedItem = evidence.preparedCommand?.items[index];
+	const payslip = bundle?.envelope;
+	if (bundle === void 0 || payslip?.primaryType !== "Payslip") return false;
+	return canonicalJson(prepared.to) === canonicalJson(item.to) && prepared.paymentType === "payroll" && canonicalJson(prepared.amount) === canonicalJson(item.amount) && bundle.adjustments !== void 0 && canonicalJson(bundle.adjustments) === canonicalJson(item.adjustments) && payslipIdentityMatches(payslip.message, item, index, runId, period) && payslipAmountMatches(payslip.message, item) && (preparedItem?.operation === "send" || preparedItem?.operation === "create_commitment") && preparedItem.documentHash === evidence.preparedCommand?.instructionDocuments?.[index]?.documentHash;
+}
+/**
+* The batch the backend derived from a payroll intent must be the batch this
+* caller asked for, checked before the digest is signed.
+*
+* The payslip envelope on each item is server-built and carries the run row's
+* own `issuedAt`, so the batch cannot be fingerprinted against a local copy
+* (`matchesIntent` is unavailable here). What CAN be verified is every field
+* the caller supplied — the org, the Budget, the request key, and per item the
+* recipient, the amount and the payslip figures — plus the lineage binding the
+* batch to the run just written. A prepared command that pays a different
+* person, a different amount, from a different Budget, or under a different
+* run never reaches the signer.
+*/
+function isRunBatch(input) {
+	return (batch, evidence) => Promise.resolve(!("kind" in batch) && batch.orgId === input.orgId && batch.permissionId === input.permissionId && batch.requestKey === input.requestKey && batch.lineage?.kind === "payroll" && batch.lineage.runId === input.runId && batch.items.length === input.items.length && batch.items.every((item) => item.amount.asset === input.asset) && input.items.every((item, index) => isRunItem(batch.items[index], item, evidence, index, input.runId, input.period)));
+}
+/**
+* The batch is `isRunBatch` for the run the backend just wrote, and that run
+* is the period the caller asked for: the payslip's `period` is a
+* server-formatted label, so the stored run is where the caller's own two
+* numbers are checkable.
+*/
+function isAuthorizedRunBatch(input, run) {
+	return (request, evidence) => run === void 0 || run.periodStart !== input.period.start || run.periodEnd !== input.period.end ? Promise.resolve(false) : isRunBatch({
+		...input,
+		runId: run.id
+	})(request, evidence);
+}
+/** A decoded detail is the run asked for, whole: its scope, membership and quantities agree. */
+function checkPayrollRunDetail(value, orgId, runId) {
+	if (value === null) return {
+		ok: true,
+		value: null
+	};
+	if (value.orgId !== orgId || value.run.id !== runId || value.items.length === 0 || value.items.length !== value.run.recipientCount || new Set(value.items.map((item) => item.payment.id)).size !== value.items.length || value.items.some((item, index) => item.itemIndex !== index || item.amount.asset !== value.run.total.asset || item.payment.amount.asset !== item.amount.asset || item.payment.paymentType !== "payroll")) return {
+		ok: false,
+		error: Errors.invalidInput("run", "Payroll run scope or membership does not match")
+	};
+	try {
+		const total = toExactAssetAmount(value.run.total, CONFIGURED_MONEY_ASSETS);
+		let rawTotal = 0n;
+		for (const item of value.items) {
+			const amount = toExactAssetAmount(item.amount, CONFIGURED_MONEY_ASSETS);
+			const payment = toExactAssetAmount(item.payment.amount, CONFIGURED_MONEY_ASSETS);
+			if (amount.minorUnits !== payment.minorUnits) return {
+				ok: false,
+				error: Errors.invalidInput("run", "Payroll item quantity does not match its Payment")
+			};
+			rawTotal += BigInt(amount.minorUnits);
+		}
+		if (rawTotal !== BigInt(total.minorUnits)) return {
+			ok: false,
+			error: Errors.invalidInput("run", "Payroll run total does not match its items")
+		};
+	} catch {
+		return {
+			ok: false,
+			error: Errors.invalidInput("run", "Payroll run quantities are invalid")
+		};
+	}
+	return {
+		ok: true,
+		value
+	};
+}
+//#endregion
+//#region ../../packages/sdk/src/payroll/run-decoding.ts
+function toPayrollRun(wire) {
+	return {
+		id: toPayrollRunId(wire.id),
+		status: wire.status,
+		periodStart: wire.periodStart,
+		periodEnd: wire.periodEnd,
+		total: wire.total,
+		recipientCount: wire.recipientCount
+	};
+}
+function toPayrollRuns(wire) {
+	return {
+		...mapPage(wire, toPayrollRun),
+		settledThisMonth: wire.settledThisMonth
+	};
+}
+function toPayrollGroup(wire) {
+	return {
+		id: toPayrollGroupId(wire.id),
+		name: wire.name,
+		tone: wire.tone,
+		members: wire.members.map((member) => ({
+			partyId: member.partyId,
+			amount: member.amount,
+			currency: member.currency
+		}))
+	};
+}
+function validateRunItems(input) {
+	for (const [index, item] of input.items.entries()) {
+		if (Schema.decodeResult(PayrollRunItemInputSchema, { onExcessProperty: "error" })(item)._tag === "Failure") return Errors.invalidInput(`items.${index}`, "invalid Payroll item");
+		try {
+			const exact = toExactAssetAmount(item.amount, CONFIGURED_MONEY_ASSETS);
+			const net = BigInt(item.net);
+			const gross = BigInt(item.gross);
+			const adjustments = item.adjustments.reduce((sum, row) => sum + BigInt(row.amount), 0n);
+			if (item.amount.asset !== input.asset || item.net !== exact.minorUnits || gross + adjustments !== net) return Errors.invalidInput(`items.${index}`, "invalid Payroll units");
+		} catch {
+			return Errors.invalidInput(`items.${index}`, "invalid Payroll units");
+		}
+	}
+	return null;
+}
+const RunInputSchema = Schema.Struct({
+	permissionId: AuthorizePayrollRunExecutionInputSchema.fields.permissionId,
+	asset: AuthorizePayrollRunExecutionInputSchema.fields.asset,
+	period: AuthorizePayrollRunExecutionInputSchema.fields.period,
+	items: AuthorizePayrollRunExecutionInputSchema.fields.items,
+	requestKey: Schema.optional(AuthorizePayrollRunExecutionInputSchema.fields.requestKey)
+});
+/** Decode caller input before session or signer work. Keep routing outside the input. */
+function decodePayrollRunInput(value) {
+	try {
+		const decoded = Schema.decodeUnknownSync(RunInputSchema, { onExcessProperty: "error" })(value);
+		const input = {
+			permissionId: decoded.permissionId,
+			asset: decoded.asset,
+			period: decoded.period,
+			...decoded.requestKey === void 0 ? {} : { requestKey: decoded.requestKey },
+			items: decoded.items.map((item) => ({
+				amount: item.amount,
+				gross: item.gross,
+				net: item.net,
+				adjustments: item.adjustments,
+				partyId: toPartyId(item.partyId),
+				to: item.to.kind === "party" ? {
+					kind: "party",
+					partyId: toPartyId(item.to.partyId)
+				} : item.to.kind === "address" ? {
+					kind: "address",
+					address: toAddress(item.to.address)
+				} : item.to
+			}))
+		};
+		if (input.items.length === 0 || input.period.start > input.period.end) throw Errors.invalidInput("input", "Payroll requires items and an ordered period");
+		const error = validateRunItems(input);
+		if (error !== null) throw error;
+		return input;
+	} catch (cause) {
+		throw cause instanceof CapxulError ? cause : Errors.invalidInput("input", "Invalid Payroll input");
+	}
+}
+/** Read only the exact backend prepare receipt, never an arbitrary signer failure. */
+function payrollResolution(error, requestKey) {
+	const details = error.details;
+	if (error.code !== "WRONG_STATE" || details?.method !== runs.authorize.name || details.requestKey !== requestKey || typeof details.commandId !== "string" || typeof details.runId !== "string") return void 0;
+	return details.payrollResolution === "failed" || details.payrollResolution === "settled" ? details.payrollResolution : void 0;
+}
+function validatePayrollRunLookup(orgId, runId) {
+	return !Schema.is(PayrollRunIdSchema)(runId) || orgId.length === 0 ? {
+		ok: false,
+		error: Errors.invalidInput("runId", "Organization and run ID must be valid")
+	} : {
+		ok: true,
+		value: void 0
+	};
+}
+/** Strict saved detail decoder shared by the read and fresh stream. */
+function decodePayrollRunDetail(raw, orgId, runId) {
+	const decoded = Schema.decodeUnknownResult(Schema.NullOr(PayrollRunDetailSchema), { onExcessProperty: "error" })(raw);
+	if (decoded._tag === "Failure") return {
+		ok: false,
+		error: Errors.invalidInput("run", "Invalid Payroll run detail")
+	};
+	return checkPayrollRunDetail(decoded.success, orgId, runId);
+}
+//#endregion
+//#region ../../packages/sdk/src/payroll/run-subscription.ts
+function detailValue(result) {
+	if (!result.ok) throw result.error;
+	return result.value;
+}
+function subscribePayrollRun(deps, orgId, runId, listener, options) {
+	const operation = CAPXUL_OPERATIONS.org.payroll.subscribeRun;
+	const valid = deps.validate(orgId, runId);
+	if (!valid.ok) return runCapxulEffect(Effect.fail(valid.error), observationOnlyControls(deps.invocationControls?.(options) ?? options), operation, deps.runPromise);
+	const decode = (raw) => detailValue(deps.decode(raw, orgId, runId));
+	return subscribeFreshQuery(deps, {
+		orgId,
+		runId
+	}, listener, operation, {
+		decode,
+		validateCached: (raw) => {
+			decode(raw);
+		},
+		invalidValue: (cause) => isCapxulError(cause) ? cause : Errors.invalidInput("run", "Invalid Payroll run detail"),
+		invalidScope: () => Errors.invalidInput("run", "Payroll run subscription scope does not match"),
+		lostValue: () => Errors.invalidInput("run", "Payroll run is no longer readable"),
+		unavailable: () => Errors.notImplemented("payroll", "subscribeRun")
+	}, options);
+}
+//#endregion
+//#region ../../packages/sdk/src/payroll/run-authorization.ts
+/**
+* Authorize one payroll run: a stable request key, the prepared batch checked
+* against the run the caller asked for, the signature, and the submission.
+*/
+async function authorizePayrollRun(scope, input, controls, onRequestKey, onResolved) {
+	const { deps, orgId, requestKeyScope } = scope;
+	const signal = controls?.signal;
+	const execution = executionDependencies(deps);
+	if (execution === null) return {
+		ok: false,
+		error: Errors.notImplemented("payroll", "executionComposition")
+	};
+	try {
+		input = decodePayrollRunInput(input);
+	} catch (cause) {
+		return {
+			ok: false,
+			error: asCapxulError(cause)
+		};
+	}
+	const { requestKey: provided, ...canonicalInput } = input;
+	const actorId = onRequestKey === void 0 ? void 0 : execution.actor.authSession()?.authUserId;
+	if (onRequestKey !== void 0 && actorId === void 0) return {
+		ok: false,
+		error: Errors.notAuthenticated()
+	};
+	const requestKey = await paymentRequestKeyLifecycle(`${requestKeyScope}:${AUTHORIZE_RUN}`, onRequestKey === void 0 ? {
+		orgId,
+		input
+	} : {
+		actorId,
+		orgId,
+		input: canonicalInput
+	}, provided, onRequestKey === void 0 ? void 0 : { manageProvidedKey: true });
+	try {
+		await onRequestKey?.(requestKey.key);
+		if (onRequestKey !== void 0 && execution.actor.authSession()?.authUserId !== actorId) {
+			await requestKey.finish(false).catch(() => void 0);
+			return {
+				ok: false,
+				error: Errors.notAuthenticated()
+			};
+		}
+	} catch (cause) {
+		await requestKey.finish(false).catch(() => void 0);
+		return {
+			ok: false,
+			error: asCapxulError(cause)
+		};
+	}
+	let authorized;
+	let acceptedReplay;
+	let preparedClosed = false;
+	let terminalReplay;
+	const submitted = await executePrepared(execution, async (signerAddress) => {
+		const prepared = await runIfActive(signal, AUTHORIZE_RUN, () => withInvocationParentSpan(Effect.suspend(() => callOperation(deps.convexCall, runs.authorize, copyInvocationObservation(controls, {
+			orgId,
+			permissionId: input.permissionId,
+			asset: input.asset,
+			requestKey: requestKey.key,
+			signerAddress,
+			period: input.period,
+			items: input.items
+		}))).pipe(Effect.mapError((publicError) => ({ publicError }))), controls), deps.runPromise);
+		if (!prepared.ok) {
+			terminalReplay = payrollResolution(prepared.error, requestKey.key);
+			return prepared;
+		}
+		authorized = prepared.value.run;
+		acceptedReplay = prepared.value.replay.kind === "accepted" ? prepared.value.replay.submission : void 0;
+		return {
+			ok: true,
+			value: prepared.value.execution
+		};
+	}, (request, evidence) => isAuthorizedRunBatch({
+		orgId,
+		permissionId: input.permissionId,
+		requestKey: requestKey.key,
+		asset: input.asset,
+		period: input.period,
+		items: input.items
+	}, authorized)(request, evidence), true, () => preparedClosed = true, signal, controls, void 0, () => acceptedReplay);
+	const resolution = preparedClosed ? "failed" : terminalReplay;
+	if (resolution !== void 0) try {
+		await onResolved?.(resolution);
+	} catch {}
+	try {
+		await requestKey.finish(submitted.ok || resolution !== void 0);
+	} catch {}
+	if (!submitted.ok) return submitted;
+	return authorized === void 0 ? {
+		ok: false,
+		error: Errors.unknown()
+	} : {
+		ok: true,
+		value: toPayrollRun(authorized)
+	};
+}
+const AUTHORIZE_RUN = runs.authorize.name;
+function executionDependencies(deps) {
+	return deps.actor === void 0 || deps.chainId === void 0 || deps.signer === void 0 ? null : {
+		actor: deps.actor,
+		chainId: deps.chainId,
+		convexCall: deps.convexCall,
+		runPromise: deps.runPromise,
+		signer: deps.signer,
+		...deps.telemetry === void 0 ? {} : { telemetry: deps.telemetry }
+	};
+}
+//#endregion
+//#region ../../packages/sdk/src/payroll/runs.ts
+function makePayrollMethods(deps, orgId) {
+	const requestKeyScope = deps.requestKeyScope ?? `client-${crypto.randomUUID()}`;
+	/** One observed call of one payroll row, its reply projected inside the call, under the row's name. */
+	const call = (row, args, options, project) => {
+		const controls = deps.invocationControls?.(options) ?? options;
+		return runPortEffect(callOperation(deps.convexCall, row, copyInvocationObservation(controls, args)).pipe(Effect.map(project), Effect.mapError((publicError) => ({ publicError }))), controls, row.name, deps.runPromise);
+	};
+	return {
+		subscribeRun: (runId, listener, options) => subscribePayrollRun({
+			actor: deps.actor,
+			convexCall: deps.convexCall,
+			query: reference(runs.get),
+			runPromise: deps.runPromise,
+			invocationControls: deps.invocationControls,
+			decode: decodePayrollRunDetail,
+			validate: validatePayrollRunLookup
+		}, orgId, runId, listener, options),
+		getRun: (runId, options) => {
+			const controls = deps.invocationControls?.(options) ?? options;
+			const lifetime = deps.actor?.authLifetime();
+			const operation = runs.get.name;
+			return runCapxulEffect(Effect.gen(function* () {
+				const lookup = validatePayrollRunLookup(orgId, runId);
+				if (!lookup.ok) return yield* Effect.fail(lookup.error);
+				if (lifetime === void 0 || lifetime.authUserId === null || deps.actor === void 0) return yield* Effect.fail(Errors.notAuthenticated());
+				const current = () => deps.actor?.matchesAuthLifetime(lifetime, lifetime.authUserId) === true;
+				if (!current()) return yield* Effect.fail(Errors.notAuthenticated());
+				const parent = yield* Effect.currentSpan.pipe(Effect.orDie);
+				const captured = carryInvocationParentSpan(controls, parent);
+				const run = yield* awaitCapxulResult(() => runIfActive(controls?.signal, operation, () => withInvocationParentSpan(Effect.suspend(() => callOperation(deps.convexCall, runs.get, copyInvocationObservation(captured, {
+					orgId,
+					runId
+				}))).pipe(Effect.mapError((publicError) => ({ publicError }))), captured), deps.runPromise));
+				if (!current()) return yield* Effect.fail(Errors.cancelled({ operation }));
+				const checked = checkPayrollRunDetail(run, orgId, runId);
+				return yield* checked.ok ? Effect.succeed(checked.value) : Effect.fail(checked.error);
+			}), observationOnlyControls(controls), operation, deps.runPromise);
+		},
+		runs: (options) => call(runs.list, { orgId }, options, toPayrollRuns),
+		authorizeRun: (input, options) => {
+			const controls = deps.invocationControls?.(options) ?? options;
+			return runCapxulEffect(Effect.gen(function* () {
+				if (controls?.signal?.aborted === true) return yield* Effect.fail(Errors.cancelled({ operation: AUTHORIZE_RUN }));
+				const parent = yield* Effect.currentSpan.pipe(Effect.orDie);
+				return yield* awaitCapxulResult(() => authorizePayrollRun({
+					deps,
+					orgId,
+					requestKeyScope
+				}, input, carryInvocationParentSpan(controls, parent), options?.onRequestKey, options?.onResolved));
+			}), observationOnlyControls(controls), AUTHORIZE_RUN, deps.runPromise);
+		},
+		terms: (options) => call(terms.list, { orgId }, options, (rates) => rates),
+		groups: {
+			list: (options) => call(groups.list, { orgId }, options, (saved) => mapPage(saved, toPayrollGroup)),
+			save: (input, options) => call(groups.save, {
+				orgId,
+				...input.id === void 0 ? {} : { id: String(input.id) },
+				name: input.name,
+				tone: input.tone,
+				members: input.members
+			}, options, toPayrollGroup),
+			remove: (id, options) => call(groups.remove, {
+				orgId,
+				id
+			}, options, () => void 0)
+		}
+	};
+}
+const payrollUnavailable = () => Promise.resolve({
+	ok: false,
+	error: Errors.notImplemented("payroll", "executionComposition")
+});
+/** The bundle an unconfigured client exposes — every verb refuses, none throws. */
+function makeUnavailablePayrollMethods() {
+	return {
+		getRun: payrollUnavailable,
+		subscribeRun: payrollUnavailable,
+		runs: payrollUnavailable,
+		authorizeRun: payrollUnavailable,
+		terms: payrollUnavailable,
+		groups: {
+			list: payrollUnavailable,
+			save: payrollUnavailable,
+			remove: payrollUnavailable
+		}
+	};
+}
+//#endregion
+//#region ../../packages/sdk/src/accounts/command-approvals.ts
+/**
+* Keep a prepared command only when it is the one asked for and its operation
+* is the person's own. A mismatch is closed unsent when `close`, as the signed
+* path closes a new Payment; a retry or a request keeps its Payment open.
+*/
+async function checked(deps, signerAddress, prepared, expected, close) {
+	if (!prepared.ok) return prepared;
+	const session = deps.actor?.authSession() ?? null;
+	if (session === null || deps.chainId === void 0) return {
+		ok: false,
+		error: Errors.notAuthenticated()
+	};
+	const evidence = prepared.value;
+	if (await expected(evidence.request, evidence) && await verifiedPreparedCommand(evidence, session.email, signerAddress, deps.chainId)) return prepared;
+	const refused = {
+		ok: false,
+		error: Errors.invalidInput("execution", "prepared command mismatch")
+	};
+	return close ? abandonPrepared(deps, evidence.executionId, "prepared_mismatch", refused) : refused;
+}
+/** A retry, a request payment or a payroll run, rather than a new Payment. */
+const isCommandApproval = (input) => "retry" in input || "request" in input || "payrollRun" in input;
+/** Prepare a retry, a request payment or a payroll run for `signerAddress`, checked. */
+function prepareVerifiedCommand(deps, input, signerAddress, signal) {
+	if ("retry" in input) return prepareVerifiedRetry(deps, input, signerAddress, signal);
+	if ("request" in input) return prepareVerifiedRequestPayment(deps, input, signerAddress, signal);
+	return prepareVerifiedPayrollRun(deps, input, signerAddress, signal);
+}
+/** The retry of one Payment, prepared in the scope that paid it. */
+async function prepareVerifiedRetry(deps, input, signerAddress, signal) {
+	const intent = {
+		kind: "retry",
+		paymentId: input.retry
+	};
+	return checked(deps, signerAddress, await runIfActive(signal, CAPXUL_OPERATIONS.payments.prepareLifecycleExecution, () => callOperation(deps.convexCall, lifecycles.prepareScoped, {
+		signerAddress,
+		intent,
+		expectedScope: input.organizationId === void 0 ? { kind: "account" } : {
+			kind: "organization",
+			orgId: input.organizationId
+		}
+	}).pipe(Effect.mapError((publicError) => ({ publicError }))), deps.runPromise), lifecycleCommandCheck(intent, input.organizationId), false);
+}
+/** The Payment of one request, exactly as the request froze it. */
+async function prepareVerifiedRequestPayment(deps, input, signerAddress, signal) {
+	const decoded = Schema.decodeResult(RequestPaymentConfirmationSchema, { onExcessProperty: "error" })(input.request);
+	if (decoded._tag === "Failure") return {
+		ok: false,
+		error: Errors.invalidInput("confirmation", "invalid request confirmation")
+	};
+	const confirmation = decoded.success;
+	return checked(deps, signerAddress, await runIfActive(signal, commands$1.prepareRequest.name, () => callOperation(deps.convexCall, commands$1.prepareRequest, {
+		confirmation,
+		signerAddress
+	}).pipe(Effect.mapError((publicError) => ({ publicError }))), deps.runPromise), requestPaymentCheck(confirmation), false);
+}
+/** One payroll run: the run the backend writes and the batch that pays it, checked together. */
+async function prepareVerifiedPayrollRun(deps, input, signerAddress, signal) {
+	let run;
+	try {
+		run = decodePayrollRunInput(input.payrollRun);
+	} catch (cause) {
+		return {
+			ok: false,
+			error: asCapxulError(cause)
+		};
+	}
+	const orgId = input.organizationId;
+	const requestKey = run.requestKey ?? `payroll_${crypto.randomUUID()}`;
+	const { permissionId, asset, period, items } = run;
+	const authorized = await runIfActive(signal, runs.authorize.name, () => callOperation(deps.convexCall, runs.authorize, {
+		orgId,
+		permissionId,
+		asset,
+		requestKey,
+		signerAddress,
+		period,
+		items
+	}).pipe(Effect.mapError((publicError) => ({ publicError }))), deps.runPromise);
+	if (!authorized.ok) return authorized;
+	return checked(deps, signerAddress, {
+		ok: true,
+		value: authorized.value.execution
+	}, isAuthorizedRunBatch({
+		orgId,
+		permissionId,
+		requestKey,
+		asset,
+		period,
+		items
+	}, authorized.value.run), authorized.value.replay.kind !== "accepted");
+}
+//#endregion
 //#region ../../packages/sdk/src/accounts/organization-approvals.ts
 /** The Organization Payment prepared for `signerAddress` and checked, before any approval. */
 async function prepareVerifiedOrganizationPayment(deps, input, signerAddress, signal) {
@@ -23965,6 +24602,7 @@ function makeApprovalsMethods(deps) {
 	};
 	const prepare = async (input, options) => {
 		const signal = options?.signal;
+		if (isCommandApproval(input)) return openApproval(signal, (signerAddress) => prepareVerifiedCommand(deps, input, signerAddress, signal));
 		if ("organizationId" in input) return openApproval(signal, (signerAddress) => prepareVerifiedOrganizationPayment(deps, input, signerAddress, signal));
 		const intent = paymentExecutionIntent(input);
 		if (!intent.ok) return intent;
@@ -24057,7 +24695,7 @@ function makeApprovalsMethods(deps) {
 			ok: true,
 			value: null
 		};
-		const payments = await readApprovalPayments(deps, approval.operation.paymentIds, organizationId, signal);
+		const payments = await readApprovalPayments(deps, approval.operation.paymentIds, organizationId ?? (approval.actor.kind === "organization" ? approval.actor.orgId : void 0), signal);
 		if (!payments.ok) return payments;
 		if (unsent(approval, payments.value)) {
 			const sent = await submit(approvalId);
@@ -26894,14 +27532,6 @@ function executeIdentityProductObservation(telemetry, record, state) {
 	return ignoreTransportFailure(() => invocationTelemetry.emit(mapped), "emit", mapped.name).pipe(Effect.andThen(ignoreTransportFailure(after, mapped.name === "auth_signed_out" ? "reset" : "identify", mapped.name)));
 }
 //#endregion
-//#region ../../packages/protocol/src/payroll/model.ts
-function toPayrollRunId(raw) {
-	return toNonEmptyStringBrand(raw, "payrollRunId", (value) => isNonEmptyString(value));
-}
-function toPayrollGroupId(raw) {
-	return toNonEmptyStringBrand(raw, "payrollGroupId", (value) => isNonEmptyString(value));
-}
-//#endregion
 //#region ../../packages/sdk/src/permissions/command-decoding.ts
 /** The caller's input as a command: ids branded and the intent decoded, or invalid input thrown. */
 const buildCommand = {
@@ -36563,13 +37193,15 @@ function normalizeOrgBudgetPolicy(policy) {
 		if (actionSet.has(action)) throw Errors.invalidInput("policy.actions", `duplicate Budget action: ${action}`);
 		actionSet.add(action);
 	}
+	if (policy.refill === "monthly" && limit.kind === "unlimited") throw Errors.invalidInput("policy.refill", "only a capped Budget can refill");
 	return {
 		assetId,
 		tokenAddress,
 		decimals: policy.asset.decimals,
 		limit,
 		recipients,
-		actions: ORG_BUDGET_ACTIONS.filter((action) => actionSet.has(action))
+		actions: ORG_BUDGET_ACTIONS.filter((action) => actionSet.has(action)),
+		refillPeriod: policy.refill === "monthly" ? MONTHLY_REFILL_PERIOD_SECONDS : 0n
 	};
 }
 function resolvedBudgetApprovalPermission(tokenAddress) {
@@ -36644,8 +37276,8 @@ function buildOrgBudgetCallsWithEncoder(input, encodeRoles) {
 				allowanceKey,
 				BigInt(policy.limit.rawUnits),
 				BigInt(policy.limit.rawUnits),
-				0n,
-				0n,
+				policy.refillPeriod === 0n ? 0n : BigInt(policy.limit.rawUnits),
+				policy.refillPeriod,
 				0n
 			]
 		}),
@@ -36839,13 +37471,20 @@ function buildExplicitBootstrapRoleCalls(input, encodeRoles) {
 		roles: [{
 			key: managementRoleKey,
 			members: [input.ownerAddress],
-			permissions: [{
-				targetAddress: input.rolesModuleAddress,
-				signature: "assignRoles(address,bytes32[],bool[])"
-			}, ...ROLE_MANAGEMENT_SIGNATURES.map((signature) => ({
-				targetAddress: input.rolesModuleAddress,
-				signature
-			}))]
+			permissions: [
+				{
+					targetAddress: input.rolesModuleAddress,
+					signature: "assignRoles(address,bytes32[],bool[])"
+				},
+				...ROLE_MANAGEMENT_SIGNATURES.map((signature) => ({
+					targetAddress: input.rolesModuleAddress,
+					signature
+				})),
+				...OWNER_COMMITMENT_SIGNATURES.map((signature) => ({
+					targetAddress: CAPXUL_PAYMENTS_V2_ADDRESS,
+					signature
+				}))
+			]
 		}]
 	}).map((call) => ({
 		to: toLowerHex(call.to, "setUpRoles.call.to"),
@@ -37310,7 +37949,7 @@ function matchesCurrentPolicy(intent, policy) {
 		asset: policy.asset,
 		value: policy.limit
 	}, CONFIGURED_MONEY_ASSETS).minorUnits;
-	return policy.asset === intent.asset && raw === recorded && (intent.scope === void 0 || canonicalJson(intent.scope) === canonicalJson(policy.scope));
+	return policy.asset === intent.asset && raw === recorded && intent.refill === "monthly" === (policy.refill === "monthly") && (intent.scope === void 0 || canonicalJson(intent.scope) === canonicalJson(policy.scope));
 }
 function previousPolicyForChange(effect, command) {
 	if (effect.previousIntent.type === "budget" && (effect.previousIntent.scope === void 0 || effect.previousRecipientBindings === void 0)) throw new EvidenceMismatch("Prior complete Budget proof is unavailable");
@@ -37328,8 +37967,9 @@ function policyCalls(evidence, context, command) {
 	const roleKey = effect.operation === "change" ? effect.roleKey : roleKeyForPermission(permissionId);
 	const revision = effect.operation === "change" ? effect.revision : 0;
 	if (effect.operation !== command.operation || effect.operation === "change" && effect.permissionId !== permissionId || evidence.expectedRevision !== revision) throw new EvidenceMismatch("Permission policy binding mismatch");
+	const intent = effect.operation === "change" ? keepRefillOnChange(command.intent, effect.previousCurrentPolicy) : command.intent;
 	const value = evidence.value;
-	if (Array.isArray(value) || !("type" in value) || !matchesCurrentPolicy(command.intent, value.currentPolicy) || !permissionMatches(value, context.orgId, permissionId, command.operation === "create" ? 0 : revision + 1, command.intent, roleKey)) throw new EvidenceMismatch("Permission value mismatch");
+	if (Array.isArray(value) || !("type" in value) || !matchesCurrentPolicy(intent, value.currentPolicy) || !permissionMatches(value, context.orgId, permissionId, command.operation === "create" ? 0 : revision + 1, intent, roleKey)) throw new EvidenceMismatch("Permission value mismatch");
 	const planned = compilePermissionPolicyCallsWithEncoder({
 		permissionId,
 		roleKey,
@@ -37337,7 +37977,7 @@ function policyCalls(evidence, context, command) {
 		actorSafe: evidence.userOpSenderSafe,
 		rolesModule: context.rolesModule,
 		managerRoleKey: context.managerRoleKey,
-		nextIntent: encodingIntent(command.intent, effect.recipientBindings),
+		nextIntent: encodingIntent(intent, effect.recipientBindings),
 		...previous === void 0 ? {} : { previousIntent: previous },
 		...effect.operation !== "change" || effect.previousAllowanceKey === null ? {} : { previousAllowanceKey: effect.previousAllowanceKey }
 	}, encodeRoles);
@@ -37389,7 +38029,8 @@ function encodingIntent(intent, bindings) {
 				"send",
 				"sendBatch",
 				"createCommitment"
-			].filter((action) => action === "createCommitment" ? intent.scope.actions.includes("commitments") : intent.scope.actions.includes("pay"))
+			].filter((action) => action === "createCommitment" ? intent.scope.actions.includes("commitments") : intent.scope.actions.includes("pay")),
+			...intent.refill === "monthly" ? { refill: intent.refill } : {}
 		}
 	};
 }
@@ -38042,411 +38683,6 @@ function makePermissionMethods(deps, orgId) {
 	};
 }
 //#endregion
-//#region ../../packages/sdk/src/payroll/run-checks.ts
-/** Match the caller's compensation to the committed V3 Payslip. */
-function payslipIdentityMatches(message, item, index, runId, period) {
-	return message.runId === runId && message.itemIndex === index && message.employeeRef === item.partyId && message.periodStart === period.start && message.periodEnd === period.end && message.adjustmentsHash === hashAdjustmentsV3(item.adjustments);
-}
-function payslipAmountMatches(message, item) {
-	const exact = toExactAssetAmount(item.amount, CONFIGURED_MONEY_ASSETS);
-	return message.gross.asset === exact.asset && message.gross.minorUnits === item.gross && message.gross.decimals === exact.decimals && message.net.asset === exact.asset && message.net.minorUnits === item.net && message.net.decimals === exact.decimals;
-}
-function isRunItem(prepared, item, evidence, index, runId, period) {
-	if (prepared === void 0) return false;
-	const bundle = evidence.preparedCommand?.documentBundles?.[index];
-	const preparedItem = evidence.preparedCommand?.items[index];
-	const payslip = bundle?.envelope;
-	if (bundle === void 0 || payslip?.primaryType !== "Payslip") return false;
-	return canonicalJson(prepared.to) === canonicalJson(item.to) && prepared.paymentType === "payroll" && canonicalJson(prepared.amount) === canonicalJson(item.amount) && bundle.adjustments !== void 0 && canonicalJson(bundle.adjustments) === canonicalJson(item.adjustments) && payslipIdentityMatches(payslip.message, item, index, runId, period) && payslipAmountMatches(payslip.message, item) && (preparedItem?.operation === "send" || preparedItem?.operation === "create_commitment") && preparedItem.documentHash === evidence.preparedCommand?.instructionDocuments?.[index]?.documentHash;
-}
-/**
-* The batch the backend derived from a payroll intent must be the batch this
-* caller asked for, checked before the digest is signed.
-*
-* The payslip envelope on each item is server-built and carries the run row's
-* own `issuedAt`, so the batch cannot be fingerprinted against a local copy
-* (`matchesIntent` is unavailable here). What CAN be verified is every field
-* the caller supplied — the org, the Budget, the request key, and per item the
-* recipient, the amount and the payslip figures — plus the lineage binding the
-* batch to the run just written. A prepared command that pays a different
-* person, a different amount, from a different Budget, or under a different
-* run never reaches the signer.
-*/
-function isRunBatch(input) {
-	return (batch, evidence) => Promise.resolve(!("kind" in batch) && batch.orgId === input.orgId && batch.permissionId === input.permissionId && batch.requestKey === input.requestKey && batch.lineage?.kind === "payroll" && batch.lineage.runId === input.runId && batch.items.length === input.items.length && batch.items.every((item) => item.amount.asset === input.asset) && input.items.every((item, index) => isRunItem(batch.items[index], item, evidence, index, input.runId, input.period)));
-}
-/** A decoded detail is the run asked for, whole: its scope, membership and quantities agree. */
-function checkPayrollRunDetail(value, orgId, runId) {
-	if (value === null) return {
-		ok: true,
-		value: null
-	};
-	if (value.orgId !== orgId || value.run.id !== runId || value.items.length === 0 || value.items.length !== value.run.recipientCount || new Set(value.items.map((item) => item.payment.id)).size !== value.items.length || value.items.some((item, index) => item.itemIndex !== index || item.amount.asset !== value.run.total.asset || item.payment.amount.asset !== item.amount.asset || item.payment.paymentType !== "payroll")) return {
-		ok: false,
-		error: Errors.invalidInput("run", "Payroll run scope or membership does not match")
-	};
-	try {
-		const total = toExactAssetAmount(value.run.total, CONFIGURED_MONEY_ASSETS);
-		let rawTotal = 0n;
-		for (const item of value.items) {
-			const amount = toExactAssetAmount(item.amount, CONFIGURED_MONEY_ASSETS);
-			const payment = toExactAssetAmount(item.payment.amount, CONFIGURED_MONEY_ASSETS);
-			if (amount.minorUnits !== payment.minorUnits) return {
-				ok: false,
-				error: Errors.invalidInput("run", "Payroll item quantity does not match its Payment")
-			};
-			rawTotal += BigInt(amount.minorUnits);
-		}
-		if (rawTotal !== BigInt(total.minorUnits)) return {
-			ok: false,
-			error: Errors.invalidInput("run", "Payroll run total does not match its items")
-		};
-	} catch {
-		return {
-			ok: false,
-			error: Errors.invalidInput("run", "Payroll run quantities are invalid")
-		};
-	}
-	return {
-		ok: true,
-		value
-	};
-}
-//#endregion
-//#region ../../packages/sdk/src/payroll/run-decoding.ts
-function toPayrollRun(wire) {
-	return {
-		id: toPayrollRunId(wire.id),
-		status: wire.status,
-		periodStart: wire.periodStart,
-		periodEnd: wire.periodEnd,
-		total: wire.total,
-		recipientCount: wire.recipientCount
-	};
-}
-function toPayrollRuns(wire) {
-	return {
-		...mapPage(wire, toPayrollRun),
-		settledThisMonth: wire.settledThisMonth
-	};
-}
-function toPayrollGroup(wire) {
-	return {
-		id: toPayrollGroupId(wire.id),
-		name: wire.name,
-		tone: wire.tone,
-		members: wire.members.map((member) => ({
-			partyId: member.partyId,
-			amount: member.amount,
-			currency: member.currency
-		}))
-	};
-}
-function validateRunItems(input) {
-	for (const [index, item] of input.items.entries()) {
-		if (Schema.decodeResult(PayrollRunItemInputSchema, { onExcessProperty: "error" })(item)._tag === "Failure") return Errors.invalidInput(`items.${index}`, "invalid Payroll item");
-		try {
-			const exact = toExactAssetAmount(item.amount, CONFIGURED_MONEY_ASSETS);
-			const net = BigInt(item.net);
-			const gross = BigInt(item.gross);
-			const adjustments = item.adjustments.reduce((sum, row) => sum + BigInt(row.amount), 0n);
-			if (item.amount.asset !== input.asset || item.net !== exact.minorUnits || gross + adjustments !== net) return Errors.invalidInput(`items.${index}`, "invalid Payroll units");
-		} catch {
-			return Errors.invalidInput(`items.${index}`, "invalid Payroll units");
-		}
-	}
-	return null;
-}
-const RunInputSchema = Schema.Struct({
-	permissionId: AuthorizePayrollRunExecutionInputSchema.fields.permissionId,
-	asset: AuthorizePayrollRunExecutionInputSchema.fields.asset,
-	period: AuthorizePayrollRunExecutionInputSchema.fields.period,
-	items: AuthorizePayrollRunExecutionInputSchema.fields.items,
-	requestKey: Schema.optional(AuthorizePayrollRunExecutionInputSchema.fields.requestKey)
-});
-/** Decode caller input before session or signer work. Keep routing outside the input. */
-function decodePayrollRunInput(value) {
-	try {
-		const decoded = Schema.decodeUnknownSync(RunInputSchema, { onExcessProperty: "error" })(value);
-		const input = {
-			permissionId: decoded.permissionId,
-			asset: decoded.asset,
-			period: decoded.period,
-			...decoded.requestKey === void 0 ? {} : { requestKey: decoded.requestKey },
-			items: decoded.items.map((item) => ({
-				amount: item.amount,
-				gross: item.gross,
-				net: item.net,
-				adjustments: item.adjustments,
-				partyId: toPartyId(item.partyId),
-				to: item.to.kind === "party" ? {
-					kind: "party",
-					partyId: toPartyId(item.to.partyId)
-				} : item.to.kind === "address" ? {
-					kind: "address",
-					address: toAddress(item.to.address)
-				} : item.to
-			}))
-		};
-		if (input.items.length === 0 || input.period.start > input.period.end) throw Errors.invalidInput("input", "Payroll requires items and an ordered period");
-		const error = validateRunItems(input);
-		if (error !== null) throw error;
-		return input;
-	} catch (cause) {
-		throw cause instanceof CapxulError ? cause : Errors.invalidInput("input", "Invalid Payroll input");
-	}
-}
-/** Read only the exact backend prepare receipt, never an arbitrary signer failure. */
-function payrollResolution(error, requestKey) {
-	const details = error.details;
-	if (error.code !== "WRONG_STATE" || details?.method !== runs.authorize.name || details.requestKey !== requestKey || typeof details.commandId !== "string" || typeof details.runId !== "string") return void 0;
-	return details.payrollResolution === "failed" || details.payrollResolution === "settled" ? details.payrollResolution : void 0;
-}
-function validatePayrollRunLookup(orgId, runId) {
-	return !Schema.is(PayrollRunIdSchema)(runId) || orgId.length === 0 ? {
-		ok: false,
-		error: Errors.invalidInput("runId", "Organization and run ID must be valid")
-	} : {
-		ok: true,
-		value: void 0
-	};
-}
-/** Strict saved detail decoder shared by the read and fresh stream. */
-function decodePayrollRunDetail(raw, orgId, runId) {
-	const decoded = Schema.decodeUnknownResult(Schema.NullOr(PayrollRunDetailSchema), { onExcessProperty: "error" })(raw);
-	if (decoded._tag === "Failure") return {
-		ok: false,
-		error: Errors.invalidInput("run", "Invalid Payroll run detail")
-	};
-	return checkPayrollRunDetail(decoded.success, orgId, runId);
-}
-//#endregion
-//#region ../../packages/sdk/src/payroll/run-subscription.ts
-function detailValue(result) {
-	if (!result.ok) throw result.error;
-	return result.value;
-}
-function subscribePayrollRun(deps, orgId, runId, listener, options) {
-	const operation = CAPXUL_OPERATIONS.org.payroll.subscribeRun;
-	const valid = deps.validate(orgId, runId);
-	if (!valid.ok) return runCapxulEffect(Effect.fail(valid.error), observationOnlyControls(deps.invocationControls?.(options) ?? options), operation, deps.runPromise);
-	const decode = (raw) => detailValue(deps.decode(raw, orgId, runId));
-	return subscribeFreshQuery(deps, {
-		orgId,
-		runId
-	}, listener, operation, {
-		decode,
-		validateCached: (raw) => {
-			decode(raw);
-		},
-		invalidValue: (cause) => isCapxulError(cause) ? cause : Errors.invalidInput("run", "Invalid Payroll run detail"),
-		invalidScope: () => Errors.invalidInput("run", "Payroll run subscription scope does not match"),
-		lostValue: () => Errors.invalidInput("run", "Payroll run is no longer readable"),
-		unavailable: () => Errors.notImplemented("payroll", "subscribeRun")
-	}, options);
-}
-//#endregion
-//#region ../../packages/sdk/src/payroll/run-authorization.ts
-/**
-* Authorize one payroll run: a stable request key, the prepared batch checked
-* against the run the caller asked for, the signature, and the submission.
-*/
-async function authorizePayrollRun(scope, input, controls, onRequestKey, onResolved) {
-	const { deps, orgId, requestKeyScope } = scope;
-	const signal = controls?.signal;
-	const execution = executionDependencies(deps);
-	if (execution === null) return {
-		ok: false,
-		error: Errors.notImplemented("payroll", "executionComposition")
-	};
-	try {
-		input = decodePayrollRunInput(input);
-	} catch (cause) {
-		return {
-			ok: false,
-			error: asCapxulError(cause)
-		};
-	}
-	const { requestKey: provided, ...canonicalInput } = input;
-	const actorId = onRequestKey === void 0 ? void 0 : execution.actor.authSession()?.authUserId;
-	if (onRequestKey !== void 0 && actorId === void 0) return {
-		ok: false,
-		error: Errors.notAuthenticated()
-	};
-	const requestKey = await paymentRequestKeyLifecycle(`${requestKeyScope}:${AUTHORIZE_RUN}`, onRequestKey === void 0 ? {
-		orgId,
-		input
-	} : {
-		actorId,
-		orgId,
-		input: canonicalInput
-	}, provided, onRequestKey === void 0 ? void 0 : { manageProvidedKey: true });
-	try {
-		await onRequestKey?.(requestKey.key);
-		if (onRequestKey !== void 0 && execution.actor.authSession()?.authUserId !== actorId) {
-			await requestKey.finish(false).catch(() => void 0);
-			return {
-				ok: false,
-				error: Errors.notAuthenticated()
-			};
-		}
-	} catch (cause) {
-		await requestKey.finish(false).catch(() => void 0);
-		return {
-			ok: false,
-			error: asCapxulError(cause)
-		};
-	}
-	let authorized;
-	let acceptedReplay;
-	let preparedClosed = false;
-	let terminalReplay;
-	const submitted = await executePrepared(execution, async (signerAddress) => {
-		const prepared = await runIfActive(signal, AUTHORIZE_RUN, () => withInvocationParentSpan(Effect.suspend(() => callOperation(deps.convexCall, runs.authorize, copyInvocationObservation(controls, {
-			orgId,
-			permissionId: input.permissionId,
-			asset: input.asset,
-			requestKey: requestKey.key,
-			signerAddress,
-			period: input.period,
-			items: input.items
-		}))).pipe(Effect.mapError((publicError) => ({ publicError }))), controls), deps.runPromise);
-		if (!prepared.ok) {
-			terminalReplay = payrollResolution(prepared.error, requestKey.key);
-			return prepared;
-		}
-		authorized = prepared.value.run;
-		acceptedReplay = prepared.value.replay.kind === "accepted" ? prepared.value.replay.submission : void 0;
-		return {
-			ok: true,
-			value: prepared.value.execution
-		};
-	}, (request, evidence) => authorized === void 0 || authorized.periodStart !== input.period.start || authorized.periodEnd !== input.period.end ? Promise.resolve(false) : isRunBatch({
-		orgId,
-		permissionId: input.permissionId,
-		requestKey: requestKey.key,
-		runId: authorized.id,
-		asset: input.asset,
-		period: input.period,
-		items: input.items
-	})(request, evidence), true, () => preparedClosed = true, signal, controls, void 0, () => acceptedReplay);
-	const resolution = preparedClosed ? "failed" : terminalReplay;
-	if (resolution !== void 0) try {
-		await onResolved?.(resolution);
-	} catch {}
-	try {
-		await requestKey.finish(submitted.ok || resolution !== void 0);
-	} catch {}
-	if (!submitted.ok) return submitted;
-	return authorized === void 0 ? {
-		ok: false,
-		error: Errors.unknown()
-	} : {
-		ok: true,
-		value: toPayrollRun(authorized)
-	};
-}
-const AUTHORIZE_RUN = runs.authorize.name;
-function executionDependencies(deps) {
-	return deps.actor === void 0 || deps.chainId === void 0 || deps.signer === void 0 ? null : {
-		actor: deps.actor,
-		chainId: deps.chainId,
-		convexCall: deps.convexCall,
-		runPromise: deps.runPromise,
-		signer: deps.signer,
-		...deps.telemetry === void 0 ? {} : { telemetry: deps.telemetry }
-	};
-}
-//#endregion
-//#region ../../packages/sdk/src/payroll/runs.ts
-function makePayrollMethods(deps, orgId) {
-	const requestKeyScope = deps.requestKeyScope ?? `client-${crypto.randomUUID()}`;
-	/** One observed call of one payroll row, its reply projected inside the call, under the row's name. */
-	const call = (row, args, options, project) => {
-		const controls = deps.invocationControls?.(options) ?? options;
-		return runPortEffect(callOperation(deps.convexCall, row, copyInvocationObservation(controls, args)).pipe(Effect.map(project), Effect.mapError((publicError) => ({ publicError }))), controls, row.name, deps.runPromise);
-	};
-	return {
-		subscribeRun: (runId, listener, options) => subscribePayrollRun({
-			actor: deps.actor,
-			convexCall: deps.convexCall,
-			query: reference(runs.get),
-			runPromise: deps.runPromise,
-			invocationControls: deps.invocationControls,
-			decode: decodePayrollRunDetail,
-			validate: validatePayrollRunLookup
-		}, orgId, runId, listener, options),
-		getRun: (runId, options) => {
-			const controls = deps.invocationControls?.(options) ?? options;
-			const lifetime = deps.actor?.authLifetime();
-			const operation = runs.get.name;
-			return runCapxulEffect(Effect.gen(function* () {
-				const lookup = validatePayrollRunLookup(orgId, runId);
-				if (!lookup.ok) return yield* Effect.fail(lookup.error);
-				if (lifetime === void 0 || lifetime.authUserId === null || deps.actor === void 0) return yield* Effect.fail(Errors.notAuthenticated());
-				const current = () => deps.actor?.matchesAuthLifetime(lifetime, lifetime.authUserId) === true;
-				if (!current()) return yield* Effect.fail(Errors.notAuthenticated());
-				const parent = yield* Effect.currentSpan.pipe(Effect.orDie);
-				const captured = carryInvocationParentSpan(controls, parent);
-				const run = yield* awaitCapxulResult(() => runIfActive(controls?.signal, operation, () => withInvocationParentSpan(Effect.suspend(() => callOperation(deps.convexCall, runs.get, copyInvocationObservation(captured, {
-					orgId,
-					runId
-				}))).pipe(Effect.mapError((publicError) => ({ publicError }))), captured), deps.runPromise));
-				if (!current()) return yield* Effect.fail(Errors.cancelled({ operation }));
-				const checked = checkPayrollRunDetail(run, orgId, runId);
-				return yield* checked.ok ? Effect.succeed(checked.value) : Effect.fail(checked.error);
-			}), observationOnlyControls(controls), operation, deps.runPromise);
-		},
-		runs: (options) => call(runs.list, { orgId }, options, toPayrollRuns),
-		authorizeRun: (input, options) => {
-			const controls = deps.invocationControls?.(options) ?? options;
-			return runCapxulEffect(Effect.gen(function* () {
-				if (controls?.signal?.aborted === true) return yield* Effect.fail(Errors.cancelled({ operation: AUTHORIZE_RUN }));
-				const parent = yield* Effect.currentSpan.pipe(Effect.orDie);
-				return yield* awaitCapxulResult(() => authorizePayrollRun({
-					deps,
-					orgId,
-					requestKeyScope
-				}, input, carryInvocationParentSpan(controls, parent), options?.onRequestKey, options?.onResolved));
-			}), observationOnlyControls(controls), AUTHORIZE_RUN, deps.runPromise);
-		},
-		terms: (options) => call(terms.list, { orgId }, options, (rates) => rates),
-		groups: {
-			list: (options) => call(groups.list, { orgId }, options, (saved) => mapPage(saved, toPayrollGroup)),
-			save: (input, options) => call(groups.save, {
-				orgId,
-				...input.id === void 0 ? {} : { id: String(input.id) },
-				name: input.name,
-				tone: input.tone,
-				members: input.members
-			}, options, toPayrollGroup),
-			remove: (id, options) => call(groups.remove, {
-				orgId,
-				id
-			}, options, () => void 0)
-		}
-	};
-}
-const payrollUnavailable = () => Promise.resolve({
-	ok: false,
-	error: Errors.notImplemented("payroll", "executionComposition")
-});
-/** The bundle an unconfigured client exposes — every verb refuses, none throws. */
-function makeUnavailablePayrollMethods() {
-	return {
-		getRun: payrollUnavailable,
-		subscribeRun: payrollUnavailable,
-		runs: payrollUnavailable,
-		authorizeRun: payrollUnavailable,
-		terms: payrollUnavailable,
-		groups: {
-			list: payrollUnavailable,
-			save: payrollUnavailable,
-			remove: payrollUnavailable
-		}
-	};
-}
-//#endregion
 //#region ../../node_modules/.pnpm/axios@1.17.0/node_modules/axios/lib/helpers/bind.js
 /**
 * Create a bound version of a function with a specified `this` context
@@ -62221,6 +62457,22 @@ function normalizeRuntimeUrl(field, raw) {
 }
 //#endregion
 //#region ../../packages/sdk/src/applications/bootstrap-adapter.ts
+/** A cached envelope this close to its expiry is fetched again, so it cannot lapse mid-command. */
+const CACHE_EXPIRY_MARGIN_MS = 3e4;
+/**
+* The cached envelope, when it is still inside its own lifetime. It is decoded
+* as a fresh body is; anything that does not decode, or a store that fails,
+* is a miss.
+*/
+async function cachedEnvelope(cache, now) {
+	try {
+		const cached = decodeBootstrapBody(await cache.load());
+		const expiresAt = cached.issuedAt + cached.expiresIn - CACHE_EXPIRY_MARGIN_MS;
+		return cached.issuedAt <= now && now < expiresAt ? cached : null;
+	} catch {
+		return null;
+	}
+}
 const DEFAULT_RETRY = {
 	attempts: 2,
 	baseDelayMs: 400
@@ -62261,19 +62513,24 @@ var HttpBootstrapAdapter = class {
 	fetchImpl;
 	observation;
 	retry;
+	cache;
 	constructor(deps) {
 		this.bootstrapBaseUrl = deps.bootstrapBaseUrl.replace(/\/$/, "");
 		this.bootstrapHost = hostOf(this.bootstrapBaseUrl);
 		this.observation = deps.observation;
 		this.retry = deps.retry ?? DEFAULT_RETRY;
+		this.cache = deps.cache;
 		this.fetchImpl = deps.fetch ?? ((input, init) => globalThis.fetch(input, init));
 	}
 	resolve(input) {
-		return this.attempt(input).pipe(Effect.retry({
+		const fetched = this.attempt(input).pipe(Effect.retry({
 			times: this.retry.attempts,
 			while: isTransientBootstrapFailure,
 			schedule: Schedule.exponential(Duration.millis(this.retry.baseDelayMs))
 		}));
+		const cache = this.cache;
+		if (cache === void 0) return fetched;
+		return Effect.promise(() => cachedEnvelope(cache, Date.now())).pipe(Effect.filterOrElse((cached) => cached !== null, () => fetched));
 	}
 	attempt(input) {
 		return Effect.tryPromise({
@@ -62298,7 +62555,13 @@ var HttpBootstrapAdapter = class {
 	}
 	mapResponse(res, input) {
 		if (res.ok) return Effect.tryPromise({
-			try: async () => decodeBootstrapBody(await res.json()),
+			try: async () => {
+				const body = await res.json();
+				const resolution = decodeBootstrapBody(body);
+				const cache = this.cache;
+				if (cache !== void 0) await Promise.resolve().then(() => cache.save(body)).catch(() => void 0);
+				return resolution;
+			},
 			catch: (cause) => {
 				if (cause instanceof CapxulError && cause.code === "INVALID_INPUT") return bootstrapErrorFromCapxul("invalidInput", cause);
 				return bootstrapErrorFromCapxul("malformedBody", Errors.providerError("convex", "bootstrap", cause instanceof Error ? cause : new Error(String(cause))));
@@ -63965,7 +64228,9 @@ function makeNotImplementedOrganizationPaymentsMethods() {
 		subscribe: organizationPaymentExecutionUnavailable,
 		pay: organizationPaymentExecutionUnavailable,
 		payBatch: organizationPaymentExecutionUnavailable,
-		retry: organizationPaymentExecutionUnavailable
+		retry: organizationPaymentExecutionUnavailable,
+		cancel: organizationPaymentExecutionUnavailable,
+		redirect: organizationPaymentExecutionUnavailable
 	};
 }
 const orgMeUnavailable = () => Promise.resolve({
@@ -68158,6 +68423,23 @@ function subscribeConvexQuery(client, fn, args, callback, options) {
 * ever needs a different one.
 */
 const DEFAULT_CLOSE_TIMEOUT_MS = 5e3;
+/**
+* The fetcher the Convex client's auth handshake gets. Convex first asks for
+* "a possibly cached token" (`forceRefreshToken: false`) and, as soon as the
+* server accepts it, for a fresh one (`true`): the token whose `exp` it
+* schedules the next refresh from. The Better Auth clients keep no token: each
+* ask mints one over the network, so the cached ask was a second token fetch
+* and a second server verification (a JWKS read) on every session restore. It
+* answers "none" instead, and Convex makes its one fetch forced, as a fresh
+* token. Every forced ask still reaches the auth client: that first fetch, the
+* refresh before `exp`, and the retry after the server rejects a token.
+* ponytail: the OAuth bearer client can hold a cached exchange; it now pays one
+* exchange for the first authentication instead of reusing it (never more
+* fetches than before). Pass the cache through if that start ever matters.
+*/
+function freshTokenHandshake(fetchToken) {
+	return async (args) => args.forceRefreshToken ? fetchToken(args) : null;
+}
 /** Run a Convex call under the current trace parent, when there is one. */
 const withTraceparent = (run) => Effect.flatMap(Effect.serviceOption(Tracer.ParentSpan), (parent) => run(parent._tag === "Some" ? formatTraceparent(parent.value) : void 0));
 var ConvexCallAdapter = class {
@@ -68182,10 +68464,10 @@ var ConvexCallAdapter = class {
 		this.#tokenProvider = deps.tokenProvider;
 		this.#applicationId = deps.applicationId;
 		this.#observation = deps.observation;
-		if (this.#tokenProvider) this.#client.setAuth(this.#tokenProvider);
+		this.refreshAuth();
 	}
 	refreshAuth() {
-		if (this.#tokenProvider) this.#client.setAuth(this.#tokenProvider);
+		if (this.#tokenProvider) this.#client.setAuth(freshTokenHandshake(this.#tokenProvider));
 	}
 	observeConnection(observer) {
 		return this.#connectionMonitor.observe(this.#client, observer);
@@ -69623,7 +69905,8 @@ async function createProductionAdapters(input) {
 	const bootstrapLayer = HttpBootstrapLayer({
 		bootstrapBaseUrl: resolvedInput.value.bootstrapBaseUrl,
 		...input.fetch === void 0 ? {} : { fetch: input.fetch },
-		...invocationObservation === void 0 ? {} : { observation: invocationObservation }
+		...invocationObservation === void 0 ? {} : { observation: invocationObservation },
+		...input.bootstrapCache === void 0 ? {} : { cache: input.bootstrapCache }
 	});
 	try {
 		const bootstrapContext = await Effect.runPromise(Layer.buildWithScope(bootstrapLayer, scope));
@@ -71068,7 +71351,7 @@ function stdioIdentity(env = process.env, options = {}) {
 }
 //#endregion
 //#region package.json
-var version = "4.20.0-beta.26";
+var version = "4.20.0-beta.28";
 //#endregion
 //#region src/deps.ts
 const NO_IDENTITY = async () => void 0;