@capxul/mcp 4.20.0-beta.27 → 4.20.0-beta.28

package/dist/main.mjs

@@ -1227,7 +1227,7 @@ const FIELD_RULES = {
 	},
 	anonymousId: {
 		maxLength: 128,
-		pattern: /^anon_[A-Za-z0-9-]+$/u
+		pattern: /^(?:anon_[A-Za-z0-9-]+|[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})$/u
 	},
 	traceparent: {
 		maxLength: 55,
@@ -10312,6 +10312,28 @@ const probes = {
 	})
 };
 //#endregion
+//#region ../../packages/protocol/src/evm/role-dsl.ts
+const ORG_BUDGET_ACTIONS = [
+	"send",
+	"sendBatch",
+	"createCommitment"
+];
+/**
+* How a capped Budget's allowance refills (#2298). `monthly` refills the
+* allowance to its cap every 30 days. Roles v2 counts fixed periods from the
+* moment the allowance is set; it has no calendar month. Absent means `none`:
+* the cap is one pot that spending drains for good.
+*/
+const ORG_BUDGET_REFILLS = ["monthly", "none"];
+/** The fixed Roles v2 refill period of a `monthly` Budget: 30 days, in seconds. */
+const MONTHLY_REFILL_PERIOD_SECONDS = 30n * 24n * 60n * 60n;
+/** Derive the Zodiac substrate key for one durable Permission identity. */
+function roleKeyForPermission(permissionId) {
+	const normalized = permissionId.trim();
+	if (normalized.length === 0 || normalized !== permissionId) throw Errors.invalidInput("permissionId", "must be a non-empty canonical Permission ID");
+	return keccak256$1(toBytes$1(`permission ${permissionId}`));
+}
+//#endregion
 //#region ../../packages/protocol/src/permissions/permission-schema.ts
 /**
 * One stored `setAllowance` call inside a command's expected authority set.
@@ -10350,12 +10372,19 @@ const BudgetScopeSchema = Schema.Struct({
 	})]),
 	actions: Schema.NonEmptyArray(Schema.Literals(["pay", "commitments"]))
 }).pipe(Schema.refine((scope) => new Set(scope.actions).size === scope.actions.length && (scope.recipients.type === "anyone" || scope.recipients.accounts.length >= 1 && scope.recipients.accounts.length <= 32 && new Set(scope.recipients.accounts).size === scope.recipients.accounts.length), { message: "Budget scope requires unique actions and one to 32 unique allowed Accounts" }));
+/**
+* How a capped Budget refills (#2298): `monthly` tops the cap back up every 30
+* days (a fixed Roles v2 period, not a calendar month); `none` never refills.
+* Absent means `none`, and writers store only `monthly`.
+*/
+const BudgetRefillSchema = Schema.Literals(ORG_BUDGET_REFILLS);
 /** The accepted product policy stored with one Permission revision. */
 const CurrentPolicySchema = Schema.Union([Schema.Struct({
 	type: Schema.Literal("budget"),
 	asset: AssetIdSchema,
 	limit: Schema.NullOr(Schema.String),
-	scope: BudgetScopeSchema
+	scope: BudgetScopeSchema,
+	refill: Schema.optional(BudgetRefillSchema)
 }), Schema.Struct({ type: Schema.Literal("managePeople") })]);
 const BudgetIntentSchema = CurrentPolicySchema.pipe(Schema.refine((value) => {
 	if (value.type !== "budget") return false;
@@ -10420,7 +10449,8 @@ const ResolvedPermissionBudgetPolicySchema = Schema.Struct({
 		"send",
 		"sendBatch",
 		"createCommitment"
-	]))
+	])),
+	refill: Schema.optional(BudgetRefillSchema)
 });
 const PermissionRecipientBindingSchema = Schema.Struct({
 	accountId: AccountIdSchema$1,
@@ -10432,16 +10462,22 @@ const StoredPermissionIntentSchema = Schema.Union([Schema.Struct({
 	type: Schema.Literal("budget"),
 	asset: AssetIdSchema,
 	limit: Schema.NullOr(AssetAmountSchema),
-	scope: Schema.optional(BudgetScopeSchema)
+	scope: Schema.optional(BudgetScopeSchema),
+	refill: Schema.optional(BudgetRefillSchema)
 }).pipe(Schema.refine((intent) => intent.limit === null || intent.limit.asset === intent.asset, { message: "Budget limit must use the Budget asset" })), Schema.Struct({ type: Schema.Literal("managePeople") })]);
 /** Writes state every granted right and use a finite positive AssetAmount cap. */
 const PermissionIntentSchema = Schema.Union([Schema.Struct({
 	type: Schema.Literal("budget"),
 	asset: AssetIdSchema,
 	limit: AssetAmountSchema,
-	scope: BudgetScopeSchema
+	scope: BudgetScopeSchema,
+	refill: Schema.optional(BudgetRefillSchema)
 }).pipe(Schema.refine((intent) => intent.limit.asset === intent.asset && /[1-9]/u.test(intent.limit.value), { message: "Budget cap must be positive and use the Budget asset" })), Schema.Struct({ type: Schema.Literal("managePeople") })]);
-/** Decode once and give set-like scope fields one stable command representation. */
+/**
+* Decode once and give set-like scope fields one stable command representation.
+* An explicit `refill: "none"` is kept: on a change it turns a refill off,
+* where a missing `refill` keeps the Budget's current one (`keepRefillOnChange`).
+*/
 function decodePermissionIntent$1(input) {
 	const intent = Schema.decodeUnknownSync(PermissionIntentSchema, { onExcessProperty: "error" })(input);
 	if (intent.type === "managePeople") return intent;
@@ -10456,6 +10492,19 @@ function decodePermissionIntent$1(input) {
 		}
 	});
 }
+/**
+* A Budget change that leaves `refill` out keeps the Budget's current refill:
+* a change never turns a refill off by omission. An explicit `"none"` turns it
+* off. The backend plans, the SDK verifies and the CLI confirms the same
+* result. A create has no current refill, so a missing one means `none`.
+*/
+function keepRefillOnChange(intent, before) {
+	if (intent.type !== "budget" || intent.refill !== void 0 || before?.type !== "budget" || before.refill !== "monthly") return intent;
+	return {
+		...intent,
+		refill: before.refill
+	};
+}
 //#endregion
 //#region ../../packages/protocol/src/permissions/replacement-schema.ts
 const InvitationPhaseSchema = Schema.Literals([
@@ -10660,7 +10709,7 @@ const InviteGrantsSchema = Schema.Array(Schema.Union([
 	Schema.Struct({
 		type: Schema.Literal("new_budget"),
 		label: Schema.String.pipe(Schema.refine((value) => value.trim().length >= 1 && value.trim().length <= 128)),
-		intent: BudgetIntentSchema
+		intent: BudgetIntentSchema.pipe(Schema.refine((intent) => intent.refill !== "monthly", { message: "An invitation's new Budget cannot refill; change it once granted" }))
 	})
 ])).pipe(Schema.refine((grants) => {
 	if (grants.length < 1 || grants.length > 16) return false;
@@ -13534,7 +13583,9 @@ const PEOPLE_OPERATIONS = {
 			emitSafeConfirmed: "accounts.safes.emitSafeConfirmed",
 			readSafe: "accounts.safes.readSafe",
 			recordDeployment: "accounts.safes.recordDeployment"
-		}
+		},
+		/** The home's requests to pay and Payments to retry, read in one query. */
+		summaries: { loadNeedsYou: "accounts.summaries.loadNeedsYou" }
 	},
 	/** The host observer's names for `client.approvals.*`. */
 	approvals: {
@@ -13793,7 +13844,9 @@ emitSaved: "activity.annotations.emitSaved" },
 		pay: "organizationPayments.pay",
 		payBatch: "organizationPayments.payBatch",
 		prepareExecution: "organizationPayments.prepareExecution",
-		retry: "organizationPayments.retry"
+		retry: "organizationPayments.retry",
+		cancel: "organizationPayments.cancel",
+		redirect: "organizationPayments.redirect"
 	},
 	/**
 	* Payments' internal functions and the client's own method names; its public
@@ -13815,7 +13868,9 @@ emitSaved: "activity.annotations.emitSaved" },
 			loadContext: "payments.commands.loadContext",
 			loadExecutionContext: "payments.commands.loadExecutionContext",
 			/** The capped Budget a prepared Organization command spends from, before its allowance is read on chain. */
-			loadBudgetAllowance: "payments.commands.loadBudgetAllowance"
+			loadBudgetAllowance: "payments.commands.loadBudgetAllowance",
+			/** What a new Payment command would spend and from which Safe, read before it is born. */
+			loadBirthFunding: "payments.commands.loadBirthFunding"
 		},
 		lifecycles: { prepareIntent: "payments.lifecycles.prepareIntent" },
 		/** The stored UserOperation of every money command: Payment, Permission and configuration. */
@@ -14252,6 +14307,42 @@ const UiStepProps = {
 	organization_id: OptionalOrgId,
 	reason_code: OptionalReasonCode
 };
+/**
+* A journey's variants (`JOURNEYS`): the way a person came into a journey, or
+* the way they took through it. A variant is a property of the journey's step
+* events, never a journey of its own, so each journey funnel breaks down by
+* it. A step event takes only the variants that a journey contract names on
+* it, picked one by one; the analytics plan test checks both directions.
+* `pay_path` and `funding_source` have no carrier until their Phase 2 events.
+* `payment_*` events already carry `recipient_is_capxul_account`, and
+* `invoice_issued` carries `issuer_scope_kind`; neither is repeated here.
+*/
+const JourneyVariantProps = {
+	/** How a person came to Get started: by themselves, an invite, money that waited, or an invoice. */
+	entry_path: Schema.optional(Schema.Literals([
+		"signup",
+		"invite",
+		"claim",
+		"invoice"
+	])),
+	/** Where the person acted. `agent` is an AI agent driving the CLI. */
+	surface: Schema.optional(Schema.Literals([
+		"web",
+		"cli",
+		"agent"
+	])),
+	/** Who pays: a person from their own account, or an Organization from a Budget. */
+	payer_kind: Schema.optional(Schema.Literals(["person", "organization"])),
+	/** How a request was paid: from the payer's inbox, or by its link at checkout. */
+	pay_path: Schema.optional(Schema.Literals(["inbox", "link"])),
+	/** Where an account's first money came from. `bank` is the planned on-ramp. */
+	funding_source: Schema.optional(Schema.Literals([
+		"deposit",
+		"payment",
+		"claim",
+		"bank"
+	]))
+};
 //#endregion
 //#region ../../packages/observability/src/events/money.ts
 /**
@@ -14341,6 +14432,8 @@ const PaymentInitiatedProps = Schema.Struct({
 	execution_id: OptionalString,
 	payment_lifecycle_id: OptionalString,
 	...TelemetryEnvelopeProps,
+	payer_kind: JourneyVariantProps.payer_kind,
+	surface: JourneyVariantProps.surface,
 	...RecipientTelemetryProps,
 	kind: Schema.String,
 	payment_id: Schema.String
@@ -14356,6 +14449,8 @@ const PaymentLifecycleProps = {
 const PaymentSettledL2Props = Schema.Struct({
 	...PaymentLifecycleProps,
 	...TelemetryEnvelopeProps,
+	payer_kind: JourneyVariantProps.payer_kind,
+	surface: JourneyVariantProps.surface,
 	...RecipientTelemetryProps,
 	kind: Schema.String,
 	chain_id: Schema.Finite,
@@ -14563,6 +14658,7 @@ const OrganizationCreationStartedProps = Schema.Struct({
 });
 const OrganizationCreationReadyProps = Schema.Struct({
 	...TelemetryEnvelopeProps,
+	surface: JourneyVariantProps.surface,
 	$insert_id: Schema.String,
 	organization_id: OrgIdTelemetrySchema,
 	attempt_number: AttemptNumberSchema,
@@ -14587,45 +14683,6 @@ const OrganizationCreationFailedProps = Schema.Struct({
 		...ORGANIZATION_SETUP_REASONS
 	]))
 });
-const OrgCreateStartedProps = Schema.Struct({
-	...TelemetryEnvelopeProps,
-	org_id: OptionalOrgId,
-	email_domain: OptionalString,
-	template: OptionalString
-});
-const OrgSafeCreatedProps = Schema.Struct({
-	...TelemetryEnvelopeProps,
-	org_id: OptionalOrgId,
-	chainId: OptionalChainId,
-	safe_address: OptionalAddress
-});
-const OrgSafeConfirmedProps = Schema.Struct({
-	...TelemetryEnvelopeProps,
-	org_id: OptionalOrgId,
-	chainId: OptionalChainId,
-	safe_address: OptionalAddress,
-	durationMs: OptionalDurationMs
-});
-const OrgRolesSeededProps = Schema.Struct({
-	...TelemetryEnvelopeProps,
-	org_id: OptionalOrgId,
-	chainId: OptionalChainId,
-	role: OptionalString,
-	txHash: OptionalTxHash
-});
-const OrgCreatedProps = Schema.Struct({
-	...TelemetryEnvelopeProps,
-	org_id: OptionalOrgId,
-	chainId: OptionalChainId,
-	safe_address: OptionalAddress,
-	durationMs: OptionalDurationMs
-});
-const OrgCreateFailedProps = Schema.Struct({
-	...TelemetryEnvelopeProps,
-	...ChainCauseTelemetryProps,
-	org_id: OptionalOrgId,
-	reason: OptionalString
-});
 const OrgInviteSentProps = Schema.Struct({
 	...TelemetryEnvelopeProps,
 	org_id: OptionalOrgId,
@@ -14670,30 +14727,6 @@ Schema.Struct({
 	name: Schema.Literal("organization_creation_failed"),
 	props: OrganizationCreationFailedProps
 });
-Schema.Struct({
-	name: Schema.Literal("org_create_started"),
-	props: OrgCreateStartedProps
-});
-Schema.Struct({
-	name: Schema.Literal("org_safe_created"),
-	props: OrgSafeCreatedProps
-});
-Schema.Struct({
-	name: Schema.Literal("org_safe_confirmed"),
-	props: OrgSafeConfirmedProps
-});
-Schema.Struct({
-	name: Schema.Literal("org_roles_seeded"),
-	props: OrgRolesSeededProps
-});
-Schema.Struct({
-	name: Schema.Literal("org_created"),
-	props: OrgCreatedProps
-});
-Schema.Struct({
-	name: Schema.Literal("org_create_failed"),
-	props: OrgCreateFailedProps
-});
 Schema.Struct({
 	name: Schema.Literal("org_invite_sent"),
 	props: OrgInviteSentProps
@@ -15567,10 +15600,14 @@ const BootstrapFailedProps = Schema.Struct({
 });
 const MemberActivationStartedProps = Schema.Struct({
 	...TelemetryEnvelopeProps,
+	entry_path: JourneyVariantProps.entry_path,
+	surface: JourneyVariantProps.surface,
 	$insert_id: Schema.String
 });
 const MemberActivationReadyProps = Schema.Struct({
 	...TelemetryEnvelopeProps,
+	entry_path: JourneyVariantProps.entry_path,
+	surface: JourneyVariantProps.surface,
 	$insert_id: Schema.String,
 	duration_ms: DurationMsSchema
 });
@@ -17116,7 +17153,7 @@ function mapAccountLifecycle(input) {
 }
 //#endregion
 //#region ../../packages/sdk/package.json
-var version$2 = "4.20.0-beta.27";
+var version$2 = "4.20.0-beta.28";
 //#endregion
 //#region ../../packages/sdk/src/observability/telemetry/exception-projection.ts
 /** Fixed fallback for failures that have no safe message. */
@@ -20374,6 +20411,12 @@ function paymentsV2Signature(name) {
 const SEND_SIGNATURE = paymentsV2Signature("send");
 const SEND_BATCH_SIGNATURE = paymentsV2Signature("sendBatch");
 const CREATE_COMMITMENT_SIGNATURE = paymentsV2Signature("createCommitment");
+/**
+* #2299 ruling C: only an Owner cancels or redirects an Organization-funded
+* commitment, so these two sit in the Owner role's scope, never a Budget's.
+* The contract admits only the commitment's creator, the Organization Safe.
+*/
+const OWNER_COMMITMENT_SIGNATURES = [paymentsV2Signature("cancel"), paymentsV2Signature("redirect")];
 //#endregion
 //#region ../../packages/protocol/src/evm/organization-payments.ts
 /** Zodiac ModuleProxyFactory on Base Sepolia. */
@@ -20610,24 +20653,18 @@ function encodePreparedPaymentCallData(command) {
 		}));
 	}
 	const [item] = command.items;
-	if (command.executionRoute.kind !== "direct" || command.items.length !== 1 || item === void 0 || isBirth(item)) throw Errors.invalidInput("items", "Commitment lifecycle requires one direct execution");
-	return safe4337ExecuteUserOpCallData({
+	const route = command.executionRoute;
+	if (command.items.length !== 1 || item === void 0 || isBirth(item) || route.kind !== "direct" && item.operation === "claim_commitment") throw Errors.invalidInput("items", "Commitment lifecycle requires one lone execution");
+	const call = {
 		to: command.contractAddress,
+		value: 0n,
 		data: lifecycleData(item)
-	});
-}
-//#endregion
-//#region ../../packages/protocol/src/evm/role-dsl.ts
-const ORG_BUDGET_ACTIONS = [
-	"send",
-	"sendBatch",
-	"createCommitment"
-];
-/** Derive the Zodiac substrate key for one durable Permission identity. */
-function roleKeyForPermission(permissionId) {
-	const normalized = permissionId.trim();
-	if (normalized.length === 0 || normalized !== permissionId) throw Errors.invalidInput("permissionId", "must be a non-empty canonical Permission ID");
-	return keccak256$1(toBytes$1(`permission ${permissionId}`));
+	};
+	return route.kind === "direct" ? safe4337ExecuteUserOpCallData(call) : buildOrgRoleSpendPersonalCallData(buildOrgRoleMultiCall({
+		rolesModuleAddress: route.rolesModule,
+		roleKey: route.roleKey,
+		calls: [call]
+	}));
 }
 //#endregion
 //#region ../../packages/sdk/src/payments/operation-verification.ts
@@ -20656,6 +20693,16 @@ function moneySafeOpDigest(operation, chainId) {
 		userOp: safe4337UserOperation(operation)
 	});
 }
+/**
+* An Organization-funded cancel or redirect runs through the Owner role
+* (#2299), which no Budget names. Its role key cannot widen what the signer
+* may do: the Roles module admits only a role the signer's Safe holds, and the
+* contract admits only the commitment's creator.
+*/
+function isOwnerLifecycle(command) {
+	const [item] = command.items;
+	return command.items.length === 1 && (item?.operation === "cancel_commitment" || item?.operation === "redirect_commitment");
+}
 /** Verify every actual Money signing target against configured trust anchors. */
 function verifiesMoneyOperation(evidence, expectedSafe, chainId, permissionId) {
 	try {
@@ -20666,7 +20713,7 @@ function verifiesMoneyOperation(evidence, expectedSafe, chainId, permissionId) {
 		const route = command.executionRoute;
 		if (route.kind === "direct") {
 			if (permissionId !== void 0 || command.senderSafe.toLowerCase() !== expectedSafe.toLowerCase()) return false;
-		} else if (permissionId === void 0 || route.roleKey.toLowerCase() !== roleKeyForPermission(permissionId).toLowerCase() || command.senderSafe.toLowerCase() !== route.organizationSafe.toLowerCase()) return false;
+		} else if ((permissionId === void 0 ? !isOwnerLifecycle(command) : route.roleKey.toLowerCase() !== roleKeyForPermission(permissionId).toLowerCase()) || command.senderSafe.toLowerCase() !== route.organizationSafe.toLowerCase()) return false;
 		if (operation.callData.toLowerCase() !== encodePreparedPaymentCallData(command).toLowerCase()) return false;
 		const digest = moneySafeOpDigest(operation, chainId);
 		return evidence.digest.toLowerCase() === digest.toLowerCase() && evidence.executionId === `money_execution_${digest.slice(2).toLowerCase()}`;
@@ -21385,9 +21432,11 @@ function subscribeFreshQuery(deps, args, listener, operation, projection, option
 //#region ../../packages/sdk/src/payments/lifecycle-execution.ts
 /**
 * The prepared command is this lifecycle intent; a retry also names the
-* original birth command of the scope it was asked for.
+* original birth command of the scope it was asked for. A claim, and an
+* Account's own cancel or redirect, runs directly from the signer's Safe; an
+* Organization's cancel or redirect runs through its Owner role (#2299).
 */
-const lifecycleCommandCheck = (intent, expectedOrganizationId) => async (request, evidence) => await matchesIntent(intent)(request, evidence) && (intent.kind !== "retry" || (expectedOrganizationId === void 0 ? evidence.sourceCommand?.kind === "birth" && evidence.sourceCommand.actor.kind === "account" : evidence.sourceCommand?.kind === "birth" && evidence.sourceCommand.actor.kind === "organization" && evidence.sourceCommand.actor.orgId === expectedOrganizationId));
+const lifecycleCommandCheck = (intent, expectedOrganizationId) => async (request, evidence) => await matchesIntent(intent)(request, evidence) && (intent.kind === "retry" ? expectedOrganizationId === void 0 ? evidence.sourceCommand?.kind === "birth" && evidence.sourceCommand.actor.kind === "account" : evidence.sourceCommand?.kind === "birth" && evidence.sourceCommand.actor.kind === "organization" && evidence.sourceCommand.actor.orgId === expectedOrganizationId : evidence.preparedCommand?.executionRoute.kind === (intent.kind === "claim" || expectedOrganizationId === void 0 ? "direct" : "zodiac_role"));
 /** The prepared command pays exactly the request the payer confirmed. */
 const requestPaymentCheck = (confirmation) => async (request) => "kind" in request && request.kind === "payment_request" && canonicalJson(request.confirmation) === canonicalJson(confirmation);
 function executePaymentLifecycle(deps, intent, signal, controls, expectedOrganizationId, onPrepared) {
@@ -22277,17 +22326,21 @@ function paymentExecutionIntent(input) {
 	const to = normalizeTargetForBackend(input.to, "to");
 	if (!to.ok) return to;
 	try {
-		return {
+		const decoded = Schema.decodeResult(PaymentExecutionIntentSchema, { onExcessProperty: "error" })({
+			to: to.value,
+			amount: input.amount,
+			...input.externalAddressAcknowledged === void 0 ? {} : { externalAddressAcknowledged: input.externalAddressAcknowledged },
+			...input.paymentType === void 0 ? {} : { paymentType: input.paymentType },
+			...input.document === void 0 ? {} : { document: input.document },
+			...input.supportingReceipts === void 0 ? {} : { supportingReceipts: input.supportingReceipts },
+			...input.timing === void 0 ? {} : { timing: input.timing }
+		});
+		return Result.isSuccess(decoded) ? {
 			ok: true,
-			value: Schema.decodeSync(PaymentExecutionIntentSchema, { onExcessProperty: "error" })({
-				to: to.value,
-				amount: input.amount,
-				...input.externalAddressAcknowledged === void 0 ? {} : { externalAddressAcknowledged: input.externalAddressAcknowledged },
-				...input.paymentType === void 0 ? {} : { paymentType: input.paymentType },
-				...input.document === void 0 ? {} : { document: input.document },
-				...input.supportingReceipts === void 0 ? {} : { supportingReceipts: input.supportingReceipts },
-				...input.timing === void 0 ? {} : { timing: input.timing }
-			})
+			value: decoded.success
+		} : {
+			ok: false,
+			error: invalidPaymentField(decoded.failure.issue)
 		};
 	} catch {
 		return {
@@ -22296,6 +22349,13 @@ function paymentExecutionIntent(input) {
 		};
 	}
 }
+const formatIssue = SchemaIssue.makeFormatterStandardSchemaV1();
+/** The first failing field and why, e.g. `amount.value`, as the backend's row decode names it (#2381). */
+function invalidPaymentField(issue) {
+	const first = formatIssue(issue).issues[0];
+	const field = first?.path?.map((segment) => String(typeof segment === "object" ? segment.key : segment)).join(".");
+	return Errors.invalidInput(field === void 0 || field.length === 0 ? "payment" : field, first?.message ?? "invalid personal payment input");
+}
 function normalizePaymentTiming(payment) {
 	const { release: _release, ...rest } = payment;
 	return {
@@ -23112,6 +23172,27 @@ function makeOrganizationPaymentsMethods(deps, orgId) {
 		flights: /* @__PURE__ */ new Map()
 	};
 	const execute = (input, signal, operation = "organization-pay-batch", controls, onPrepared) => executeOrganizationBatch(scope, input, signal, operation, controls, onPrepared);
+	/** One Owner-signed cancel or redirect, answering the one Payment it acted on (#2299). */
+	const ownerLifecycle = (intent, controls, operation) => runCapxulEffect(Effect.gen(function* () {
+		const captured = carryInvocationParentSpan(controls, yield* Effect.currentSpan.pipe(Effect.orDie));
+		return yield* awaitCapxulResult(async () => {
+			const execution = executionDependencies$1(deps);
+			if (execution === null) return {
+				ok: false,
+				error: Errors.notImplemented("organizationPayments", "executionComposition")
+			};
+			const result = await executePaymentLifecycle(execution, intent, controls?.signal, captured, orgId);
+			if (!result.ok) return result;
+			const [payment, ...rest] = result.value.payments;
+			return payment === void 0 || rest.length !== 0 ? {
+				ok: false,
+				error: Errors.unknown()
+			} : {
+				ok: true,
+				value: normalizePaymentTiming(payment)
+			};
+		});
+	}), observationOnlyControls(controls), operation, deps.runPromise);
 	return {
 		...makeOrganizationPaymentReadMethods(deps, orgId),
 		retry: (paymentId, options) => {
@@ -23170,6 +23251,19 @@ function makeOrganizationPaymentsMethods(deps, orgId) {
 				});
 			}), observationOnlyControls(controls), CAPXUL_OPERATIONS.organizationPayments.pay, deps.runPromise);
 		},
+		cancel: (paymentId, options) => ownerLifecycle({
+			kind: "cancel",
+			paymentId
+		}, deps.invocationControls?.(options) ?? options, CAPXUL_OPERATIONS.organizationPayments.cancel),
+		redirect: (input, options) => {
+			const controls = deps.invocationControls?.(options) ?? options;
+			const recipient = normalizeTargetForBackend(input.to, "to");
+			return recipient.ok ? ownerLifecycle({
+				kind: "redirect",
+				paymentId: input.paymentId,
+				recipient: recipient.value
+			}, controls, CAPXUL_OPERATIONS.organizationPayments.redirect) : runCapxulEffect(Effect.fail(recipient.error), observationOnlyControls(controls), CAPXUL_OPERATIONS.organizationPayments.redirect, deps.runPromise);
+		},
 		payBatch: (input, options) => {
 			const controls = deps.invocationControls?.(options) ?? options;
 			return runCapxulEffect(Effect.gen(function* () {
@@ -37099,13 +37193,15 @@ function normalizeOrgBudgetPolicy(policy) {
 		if (actionSet.has(action)) throw Errors.invalidInput("policy.actions", `duplicate Budget action: ${action}`);
 		actionSet.add(action);
 	}
+	if (policy.refill === "monthly" && limit.kind === "unlimited") throw Errors.invalidInput("policy.refill", "only a capped Budget can refill");
 	return {
 		assetId,
 		tokenAddress,
 		decimals: policy.asset.decimals,
 		limit,
 		recipients,
-		actions: ORG_BUDGET_ACTIONS.filter((action) => actionSet.has(action))
+		actions: ORG_BUDGET_ACTIONS.filter((action) => actionSet.has(action)),
+		refillPeriod: policy.refill === "monthly" ? MONTHLY_REFILL_PERIOD_SECONDS : 0n
 	};
 }
 function resolvedBudgetApprovalPermission(tokenAddress) {
@@ -37180,8 +37276,8 @@ function buildOrgBudgetCallsWithEncoder(input, encodeRoles) {
 				allowanceKey,
 				BigInt(policy.limit.rawUnits),
 				BigInt(policy.limit.rawUnits),
-				0n,
-				0n,
+				policy.refillPeriod === 0n ? 0n : BigInt(policy.limit.rawUnits),
+				policy.refillPeriod,
 				0n
 			]
 		}),
@@ -37375,13 +37471,20 @@ function buildExplicitBootstrapRoleCalls(input, encodeRoles) {
 		roles: [{
 			key: managementRoleKey,
 			members: [input.ownerAddress],
-			permissions: [{
-				targetAddress: input.rolesModuleAddress,
-				signature: "assignRoles(address,bytes32[],bool[])"
-			}, ...ROLE_MANAGEMENT_SIGNATURES.map((signature) => ({
-				targetAddress: input.rolesModuleAddress,
-				signature
-			}))]
+			permissions: [
+				{
+					targetAddress: input.rolesModuleAddress,
+					signature: "assignRoles(address,bytes32[],bool[])"
+				},
+				...ROLE_MANAGEMENT_SIGNATURES.map((signature) => ({
+					targetAddress: input.rolesModuleAddress,
+					signature
+				})),
+				...OWNER_COMMITMENT_SIGNATURES.map((signature) => ({
+					targetAddress: CAPXUL_PAYMENTS_V2_ADDRESS,
+					signature
+				}))
+			]
 		}]
 	}).map((call) => ({
 		to: toLowerHex(call.to, "setUpRoles.call.to"),
@@ -37846,7 +37949,7 @@ function matchesCurrentPolicy(intent, policy) {
 		asset: policy.asset,
 		value: policy.limit
 	}, CONFIGURED_MONEY_ASSETS).minorUnits;
-	return policy.asset === intent.asset && raw === recorded && (intent.scope === void 0 || canonicalJson(intent.scope) === canonicalJson(policy.scope));
+	return policy.asset === intent.asset && raw === recorded && intent.refill === "monthly" === (policy.refill === "monthly") && (intent.scope === void 0 || canonicalJson(intent.scope) === canonicalJson(policy.scope));
 }
 function previousPolicyForChange(effect, command) {
 	if (effect.previousIntent.type === "budget" && (effect.previousIntent.scope === void 0 || effect.previousRecipientBindings === void 0)) throw new EvidenceMismatch("Prior complete Budget proof is unavailable");
@@ -37864,8 +37967,9 @@ function policyCalls(evidence, context, command) {
 	const roleKey = effect.operation === "change" ? effect.roleKey : roleKeyForPermission(permissionId);
 	const revision = effect.operation === "change" ? effect.revision : 0;
 	if (effect.operation !== command.operation || effect.operation === "change" && effect.permissionId !== permissionId || evidence.expectedRevision !== revision) throw new EvidenceMismatch("Permission policy binding mismatch");
+	const intent = effect.operation === "change" ? keepRefillOnChange(command.intent, effect.previousCurrentPolicy) : command.intent;
 	const value = evidence.value;
-	if (Array.isArray(value) || !("type" in value) || !matchesCurrentPolicy(command.intent, value.currentPolicy) || !permissionMatches(value, context.orgId, permissionId, command.operation === "create" ? 0 : revision + 1, command.intent, roleKey)) throw new EvidenceMismatch("Permission value mismatch");
+	if (Array.isArray(value) || !("type" in value) || !matchesCurrentPolicy(intent, value.currentPolicy) || !permissionMatches(value, context.orgId, permissionId, command.operation === "create" ? 0 : revision + 1, intent, roleKey)) throw new EvidenceMismatch("Permission value mismatch");
 	const planned = compilePermissionPolicyCallsWithEncoder({
 		permissionId,
 		roleKey,
@@ -37873,7 +37977,7 @@ function policyCalls(evidence, context, command) {
 		actorSafe: evidence.userOpSenderSafe,
 		rolesModule: context.rolesModule,
 		managerRoleKey: context.managerRoleKey,
-		nextIntent: encodingIntent(command.intent, effect.recipientBindings),
+		nextIntent: encodingIntent(intent, effect.recipientBindings),
 		...previous === void 0 ? {} : { previousIntent: previous },
 		...effect.operation !== "change" || effect.previousAllowanceKey === null ? {} : { previousAllowanceKey: effect.previousAllowanceKey }
 	}, encodeRoles);
@@ -37925,7 +38029,8 @@ function encodingIntent(intent, bindings) {
 				"send",
 				"sendBatch",
 				"createCommitment"
-			].filter((action) => action === "createCommitment" ? intent.scope.actions.includes("commitments") : intent.scope.actions.includes("pay"))
+			].filter((action) => action === "createCommitment" ? intent.scope.actions.includes("commitments") : intent.scope.actions.includes("pay")),
+			...intent.refill === "monthly" ? { refill: intent.refill } : {}
 		}
 	};
 }
@@ -62352,6 +62457,22 @@ function normalizeRuntimeUrl(field, raw) {
 }
 //#endregion
 //#region ../../packages/sdk/src/applications/bootstrap-adapter.ts
+/** A cached envelope this close to its expiry is fetched again, so it cannot lapse mid-command. */
+const CACHE_EXPIRY_MARGIN_MS = 3e4;
+/**
+* The cached envelope, when it is still inside its own lifetime. It is decoded
+* as a fresh body is; anything that does not decode, or a store that fails,
+* is a miss.
+*/
+async function cachedEnvelope(cache, now) {
+	try {
+		const cached = decodeBootstrapBody(await cache.load());
+		const expiresAt = cached.issuedAt + cached.expiresIn - CACHE_EXPIRY_MARGIN_MS;
+		return cached.issuedAt <= now && now < expiresAt ? cached : null;
+	} catch {
+		return null;
+	}
+}
 const DEFAULT_RETRY = {
 	attempts: 2,
 	baseDelayMs: 400
@@ -62392,19 +62513,24 @@ var HttpBootstrapAdapter = class {
 	fetchImpl;
 	observation;
 	retry;
+	cache;
 	constructor(deps) {
 		this.bootstrapBaseUrl = deps.bootstrapBaseUrl.replace(/\/$/, "");
 		this.bootstrapHost = hostOf(this.bootstrapBaseUrl);
 		this.observation = deps.observation;
 		this.retry = deps.retry ?? DEFAULT_RETRY;
+		this.cache = deps.cache;
 		this.fetchImpl = deps.fetch ?? ((input, init) => globalThis.fetch(input, init));
 	}
 	resolve(input) {
-		return this.attempt(input).pipe(Effect.retry({
+		const fetched = this.attempt(input).pipe(Effect.retry({
 			times: this.retry.attempts,
 			while: isTransientBootstrapFailure,
 			schedule: Schedule.exponential(Duration.millis(this.retry.baseDelayMs))
 		}));
+		const cache = this.cache;
+		if (cache === void 0) return fetched;
+		return Effect.promise(() => cachedEnvelope(cache, Date.now())).pipe(Effect.filterOrElse((cached) => cached !== null, () => fetched));
 	}
 	attempt(input) {
 		return Effect.tryPromise({
@@ -62429,7 +62555,13 @@ var HttpBootstrapAdapter = class {
 	}
 	mapResponse(res, input) {
 		if (res.ok) return Effect.tryPromise({
-			try: async () => decodeBootstrapBody(await res.json()),
+			try: async () => {
+				const body = await res.json();
+				const resolution = decodeBootstrapBody(body);
+				const cache = this.cache;
+				if (cache !== void 0) await Promise.resolve().then(() => cache.save(body)).catch(() => void 0);
+				return resolution;
+			},
 			catch: (cause) => {
 				if (cause instanceof CapxulError && cause.code === "INVALID_INPUT") return bootstrapErrorFromCapxul("invalidInput", cause);
 				return bootstrapErrorFromCapxul("malformedBody", Errors.providerError("convex", "bootstrap", cause instanceof Error ? cause : new Error(String(cause))));
@@ -64096,7 +64228,9 @@ function makeNotImplementedOrganizationPaymentsMethods() {
 		subscribe: organizationPaymentExecutionUnavailable,
 		pay: organizationPaymentExecutionUnavailable,
 		payBatch: organizationPaymentExecutionUnavailable,
-		retry: organizationPaymentExecutionUnavailable
+		retry: organizationPaymentExecutionUnavailable,
+		cancel: organizationPaymentExecutionUnavailable,
+		redirect: organizationPaymentExecutionUnavailable
 	};
 }
 const orgMeUnavailable = () => Promise.resolve({
@@ -68289,6 +68423,23 @@ function subscribeConvexQuery(client, fn, args, callback, options) {
 * ever needs a different one.
 */
 const DEFAULT_CLOSE_TIMEOUT_MS = 5e3;
+/**
+* The fetcher the Convex client's auth handshake gets. Convex first asks for
+* "a possibly cached token" (`forceRefreshToken: false`) and, as soon as the
+* server accepts it, for a fresh one (`true`): the token whose `exp` it
+* schedules the next refresh from. The Better Auth clients keep no token: each
+* ask mints one over the network, so the cached ask was a second token fetch
+* and a second server verification (a JWKS read) on every session restore. It
+* answers "none" instead, and Convex makes its one fetch forced, as a fresh
+* token. Every forced ask still reaches the auth client: that first fetch, the
+* refresh before `exp`, and the retry after the server rejects a token.
+* ponytail: the OAuth bearer client can hold a cached exchange; it now pays one
+* exchange for the first authentication instead of reusing it (never more
+* fetches than before). Pass the cache through if that start ever matters.
+*/
+function freshTokenHandshake(fetchToken) {
+	return async (args) => args.forceRefreshToken ? fetchToken(args) : null;
+}
 /** Run a Convex call under the current trace parent, when there is one. */
 const withTraceparent = (run) => Effect.flatMap(Effect.serviceOption(Tracer.ParentSpan), (parent) => run(parent._tag === "Some" ? formatTraceparent(parent.value) : void 0));
 var ConvexCallAdapter = class {
@@ -68313,10 +68464,10 @@ var ConvexCallAdapter = class {
 		this.#tokenProvider = deps.tokenProvider;
 		this.#applicationId = deps.applicationId;
 		this.#observation = deps.observation;
-		if (this.#tokenProvider) this.#client.setAuth(this.#tokenProvider);
+		this.refreshAuth();
 	}
 	refreshAuth() {
-		if (this.#tokenProvider) this.#client.setAuth(this.#tokenProvider);
+		if (this.#tokenProvider) this.#client.setAuth(freshTokenHandshake(this.#tokenProvider));
 	}
 	observeConnection(observer) {
 		return this.#connectionMonitor.observe(this.#client, observer);
@@ -69754,7 +69905,8 @@ async function createProductionAdapters(input) {
 	const bootstrapLayer = HttpBootstrapLayer({
 		bootstrapBaseUrl: resolvedInput.value.bootstrapBaseUrl,
 		...input.fetch === void 0 ? {} : { fetch: input.fetch },
-		...invocationObservation === void 0 ? {} : { observation: invocationObservation }
+		...invocationObservation === void 0 ? {} : { observation: invocationObservation },
+		...input.bootstrapCache === void 0 ? {} : { cache: input.bootstrapCache }
 	});
 	try {
 		const bootstrapContext = await Effect.runPromise(Layer.buildWithScope(bootstrapLayer, scope));
@@ -71199,7 +71351,7 @@ function stdioIdentity(env = process.env, options = {}) {
 }
 //#endregion
 //#region package.json
-var version = "4.20.0-beta.27";
+var version = "4.20.0-beta.28";
 //#endregion
 //#region src/deps.ts
 const NO_IDENTITY = async () => void 0;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@capxul/mcp",
-  "version": "4.20.0-beta.27",
+  "version": "4.20.0-beta.28",
   "private": false,
   "description": "Capxul MCP server for auth, Account readiness, identity, Organizations, relationships, requests, destinations, and testnet funding over Streamable HTTP.",
   "keywords": [
@@ -54,8 +54,8 @@
     "typescript": "npm:@typescript/typescript6@6.0.2",
     "vite": "npm:@voidzero-dev/vite-plus-core@1.0.0",
     "vite-plus": "1.0.0",
-    "@capxul/protocol": "0.2.0-beta.1",
-    "@capxul/sdk": "4.20.0-beta.27",
+    "@capxul/protocol": "0.2.0-beta.2",
+    "@capxul/sdk": "4.20.0-beta.28",
     "@capxul/typescript-config": "0.0.0"
   },
   "scripts": {