@capxul/observability 4.2.0 → 4.20.0-beta.1

package/dist/operations-sJPrehYY.mjs

@@ -0,0 +1,748 @@
+//#region ../errors/src/secret-material.ts
+const CREDENTIAL_FIELDS = /* @__PURE__ */ new Set([
+	"password",
+	"passwd",
+	"pwd",
+	"pass",
+	"passphrase",
+	"currentpassword",
+	"newpassword",
+	"confirmpassword",
+	"passwordconfirmation",
+	"passwordhash",
+	"hashedpassword",
+	"pin",
+	"privatekey",
+	"walletprivatekey",
+	"secretkey",
+	"signingkey",
+	"signingsecret",
+	"seed",
+	"seedphrase",
+	"mnemonic",
+	"recoveryphrase",
+	"recovery",
+	"recoverycode",
+	"recoverycodes",
+	"keyshare",
+	"signingmaterial",
+	"recoverymaterial",
+	"privatekeybytes",
+	"signingprivatekey",
+	"encryptionkey",
+	"decryptionkey",
+	"authtoken",
+	"apitoken",
+	"bearertoken",
+	"oauthtoken",
+	"csrftoken",
+	"clientassertion",
+	"token",
+	"accesstoken",
+	"refreshtoken",
+	"idtoken",
+	"sessiontoken",
+	"session",
+	"sessionkey",
+	"sessionsecret",
+	"authsessionid",
+	"sessioncredential",
+	"sessioncredentials",
+	"sessioncookie",
+	"auth",
+	"authentication",
+	"authorization",
+	"proxyauthorization",
+	"cookie",
+	"cookies",
+	"setcookie",
+	"apikey",
+	"xapikey",
+	"xauthtoken",
+	"clientsecret",
+	"secret",
+	"secrets",
+	"credential",
+	"credentials",
+	"signature",
+	"otp",
+	"otpcode",
+	"totpsecret",
+	"onetimecode",
+	"onetimepassword",
+	"verificationcode",
+	"authcode",
+	"authorizationcode",
+	"oauthcode",
+	"codeverifier"
+]);
+/** Match credential fields by meaning, without hiding token addresses or replay IDs. */
+function isCredentialField(name, context) {
+	const normalized = name.toLowerCase().replace(/[^a-z0-9]/gu, "");
+	return CREDENTIAL_FIELDS.has(normalized) || /(?:password(?:hash)?|passwd|passphrase|privatekey|signingkey|apikey|clientsecret|accesstoken|refreshtoken|sessiontoken)$/u.test(normalized) || context === "authentication" && (normalized === "code" || normalized === "sessionid") || context === "header" && /(?:token|secret|apikey|privatekey|signingkey|password|authorization|cookie|session)$/u.test(normalized);
+}
+function decodeUrlComponent(text) {
+	try {
+		return decodeURIComponent(text);
+	} catch {
+		return text;
+	}
+}
+/** Preserve URL diagnostics while removing credentials from their declared components. */
+function redactUrlSecrets(value, source) {
+	try {
+		const absolute = /^[a-z][a-z0-9+.-]*:/iu.test(value);
+		const protocolRelative = value.startsWith("//");
+		const url = new URL(value, "https://redaction.invalid");
+		if (url.protocol !== "https:" && url.protocol !== "http:") return maskText(value);
+		let changed = url.username.length > 0 || url.password.length > 0;
+		const maskParams = (params) => new URLSearchParams(Array.from(params, ([name, entry]) => {
+			const safeName = maskText(name);
+			const safeEntry = isCredentialField(name) || /^(?:code|draft|__posthog)$/iu.test(name) ? "[REDACTED]" : maskText(entry);
+			changed ||= safeName !== name || safeEntry !== entry;
+			return [safeName, safeEntry];
+		})).toString();
+		const provider = source === "alchemy" || source === "infura" || /(?:^|\.)(?:alchemy\.com|alchemyapi\.io|infura\.io)$/iu.test(url.hostname);
+		const rawPath = absolute || protocolRelative ? url.pathname : value.split(/[?#]/u)[0] ?? "";
+		const segments = rawPath.split("/");
+		let path = segments.map((segment, index) => {
+			const decoded = decodeUrlComponent(segment);
+			const masked = provider && /^v[23]$/u.test(decodeUrlComponent(segments[index - 1] ?? "")) && decoded.length > 0 ? "[REDACTED]" : maskText(decoded);
+			changed ||= masked !== decoded;
+			return masked === decoded ? segment : encodeURIComponent(masked);
+		}).join("/");
+		if (source === "gateway" && rawPath.length > 0) {
+			path = `${rawPath.startsWith("/") ? "/" : ""}${encodeURIComponent("[REDACTED]")}`;
+			changed = true;
+		}
+		const query = maskParams(url.searchParams);
+		const fragment = url.hash.slice(1);
+		const decodedFragment = decodeUrlComponent(fragment);
+		const maskedFragment = maskText(decodedFragment);
+		changed ||= maskedFragment !== decodedFragment;
+		const fragmentQuery = fragment.indexOf("?");
+		const fragmentPath = fragment.slice(0, fragmentQuery);
+		const maskedFragmentPath = maskText(decodeUrlComponent(fragmentPath));
+		changed ||= maskedFragmentPath !== decodeUrlComponent(fragmentPath);
+		const hash = fragmentQuery >= 0 ? `${maskedFragmentPath === decodeUrlComponent(fragmentPath) ? fragmentPath : encodeURIComponent(maskedFragmentPath)}?${maskParams(new URLSearchParams(fragment.slice(fragmentQuery + 1)))}` : fragment.includes("=") ? maskParams(new URLSearchParams(fragment)) : maskedFragment === decodedFragment ? fragment : encodeURIComponent(maskedFragment);
+		const origin = absolute ? url.origin : protocolRelative ? `//${url.host}` : "";
+		if (!changed) return value;
+		return `${origin}${path}${query ? `?${query}` : ""}${hash ? `#${hash}` : ""}`;
+	} catch {
+		if (source === "gateway") return "[REDACTED]";
+		return maskText(value.replace(/(https?:\/\/)[^/\s@]+@/giu, "$1[REDACTED]@").replace(/([?&#])([^=&#]+)=([^&#]*)/gu, (whole, separator, name) => isCredentialField(decodeUrlComponent(name)) || /^(?:code|draft|__posthog)$/iu.test(decodeUrlComponent(name)) ? `${separator}${name}=[REDACTED]` : whole));
+	}
+}
+const JSON_FIELD = /("(?:[^"\\]|\\.)*")(\s*:\s*)("(?:[^"\\]|\\.)*"|-?\d+(?:\.\d+)?(?:[eE][+-]?\d+)?|true|false|null)/gu;
+const PROSE_FIELD = /(?=(\b([A-Za-z][A-Za-z0-9_-]*(?:[ \t]+[A-Za-z][A-Za-z0-9_-]*){0,3})\s*[:=]\s*((?:Bearer|Basic)[ \t]+[^\s,;"']+|"(?:[^"\\]|\\.)*"|'(?:[^'\\]|\\.)*'|[^\s,;&"']+)))/gu;
+const EMBEDDED_URL = /(https?:\/\/[^\s"<>]*)/giu;
+function isSecretLabel(name) {
+	return isCredentialField(name) || /^request[ _-]?body$/iu.test(name);
+}
+const JSON_ENCODING_MAX = 8;
+const JSON_NESTING_MAX = 64;
+const JSON_KEY = /("(?:[^"\\]|\\.)*")\s*:/gu;
+const JSON_CONTAINER_START = /(?:\{\s*["}]|\[\s*[[\]{}"0-9tfn-])/uy;
+function hasSecretJsonKey(value) {
+	for (const match of value.matchAll(JSON_KEY)) try {
+		if (match[1] !== void 0 && isSecretLabel(JSON.parse(match[1]))) return true;
+	} catch {}
+	return false;
+}
+/** Project a complete fragment once. Never retry all of its nested substrings. */
+function projectJsonFragment(value, encodingDepth, overDepth) {
+	if (overDepth || encodingDepth >= JSON_ENCODING_MAX) return "[REDACTED]";
+	let parsed;
+	try {
+		parsed = JSON.parse(value);
+	} catch {
+		return hasSecretJsonKey(value) ? "[REDACTED]" : value;
+	}
+	try {
+		let changed = false;
+		const masked = JSON.stringify(parsed, (name, nested) => {
+			if (isSecretLabel(name)) {
+				changed ||= nested !== "[REDACTED]";
+				return "[REDACTED]";
+			}
+			if (typeof nested === "string") {
+				const projected = maskJsonFragments(nested, encodingDepth + 1);
+				changed ||= projected !== nested;
+				return projected;
+			}
+			return nested;
+		});
+		return changed ? masked : value;
+	} catch {
+		return "[REDACTED]";
+	}
+}
+/** Scan balanced object/array fragments once, respecting JSON quotes and escapes. */
+function maskJsonFragments(value, encodingDepth = 0) {
+	if (value.trimStart().startsWith("\"")) try {
+		const decoded = JSON.parse(value);
+		if (typeof decoded === "string") {
+			if (encodingDepth >= JSON_ENCODING_MAX) return "\"[REDACTED]\"";
+			const masked = maskJsonFragments(decoded, encodingDepth + 1);
+			return masked === decoded ? value : JSON.stringify(masked);
+		}
+	} catch {}
+	let output = "";
+	let cursor = 0;
+	let start = -1;
+	let depth = 0;
+	let overDepth = false;
+	let quoted = false;
+	let escaped = false;
+	for (let index = 0; index < value.length; index++) {
+		const character = value[index];
+		if (start < 0) {
+			JSON_CONTAINER_START.lastIndex = index;
+			if (!JSON_CONTAINER_START.test(value)) continue;
+			start = index;
+			depth = 1;
+			overDepth = false;
+			continue;
+		}
+		if (quoted) {
+			if (escaped) escaped = false;
+			else if (character === "\\") escaped = true;
+			else if (character === "\"") quoted = false;
+			continue;
+		}
+		if (character === "\"") quoted = true;
+		else if (character === "{" || character === "[") {
+			depth++;
+			overDepth ||= depth > JSON_NESTING_MAX;
+		} else if (character === "}" || character === "]") {
+			depth--;
+			if (depth !== 0) continue;
+			output += value.slice(cursor, start) + projectJsonFragment(value.slice(start, index + 1), encodingDepth, overDepth);
+			cursor = index + 1;
+			start = -1;
+		}
+	}
+	if (start >= 0) {
+		const fragment = value.slice(start);
+		output += value.slice(cursor, start) + (overDepth || hasSecretJsonKey(fragment) ? "[REDACTED]" : fragment);
+		cursor = value.length;
+	}
+	return output + value.slice(cursor);
+}
+function maskLabelledText(value) {
+	const jsonMasked = maskJsonFragments(value).replace(JSON_FIELD, (whole, quotedName, separator) => {
+		try {
+			return isSecretLabel(JSON.parse(quotedName)) ? `${quotedName}${separator}"[REDACTED]"` : whole;
+		} catch {
+			return whole;
+		}
+	});
+	let output = "";
+	let cursor = 0;
+	for (const match of jsonMasked.matchAll(PROSE_FIELD)) {
+		const [, whole, label, entry] = match;
+		if (whole === void 0 || label === void 0 || entry === void 0 || match.index < cursor || /^Bearer[ \t]+/iu.test(entry)) continue;
+		const words = label.split(/[ \t]+/u);
+		for (let index = 0; index < words.length; index++) {
+			const name = words.slice(index).join(" ");
+			if (isSecretLabel(name)) {
+				const prefix = words.slice(0, index).join(" ");
+				output += jsonMasked.slice(cursor, match.index) + `${prefix ? `${prefix} ` : ""}${name}=[REDACTED]`;
+				cursor = match.index + whole.length;
+				break;
+			}
+		}
+	}
+	return output + jsonMasked.slice(cursor);
+}
+const TOKEN_MASKS = [
+	[/\bBearer\s+(?!(?:realm|error|error_description|scope|authorization_uri|resource|claims)\s*=)[^\s,;"']+/giu, "Bearer [REDACTED]"],
+	[/\beyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\b/gu, "[REDACTED]"],
+	[/(^|[^a-fA-F0-9])(?<!0[xX])[a-fA-F0-9]{64}(?=$|[^a-fA-F0-9])/gu, "$1[REDACTED]"],
+	[/(?:(?:sk|pk|rk)_(?:live|test)|(?:phc|phx|ghp|gho|ghu|ghs|ghr|whsec)_|github_pat_|xox[baprs]-|AKIA[0-9A-Z]{16}|AIza)[A-Za-z0-9_-]*/giu, "[REDACTED]"]
+];
+/** URL components and malformed URLs use this non-recursive masking layer. */
+function maskText(value) {
+	let text = maskLabelledText(value);
+	for (const [pattern, replacement] of TOKEN_MASKS) text = text.replace(pattern, replacement);
+	return text;
+}
+/** Mask credential fields and embedded URLs while preserving surrounding evidence. */
+function redactSecrets(value, source) {
+	return maskLabelledText(value).split(EMBEDDED_URL).map((part, index) => index % 2 === 1 ? redactUrlSecrets(part, source).replaceAll("%5BREDACTED%5D", "[REDACTED]") : maskText(part)).join("");
+}
+//#endregion
+//#region ../errors/src/chain-cause.ts
+/**
+* Why an operation failed — the one flat vocabulary. The first four are the
+* auth/provider diagnoses that predate this file. The rest name the chain
+* path. `FailureMode` is derived from this list so a runtime membership check
+* (the SDK's `$exception` projection, the observability schema) and the type
+* can never drift apart.
+*/
+const FAILURE_MODES = [
+	"auth-origin-mismatch",
+	"stale-openfort-cache",
+	"app-env-allowlist",
+	"no-secure-context",
+	"signer-not-ready",
+	"rate-limited",
+	"timeout",
+	"upstream-down",
+	"revert",
+	"insufficient-balance",
+	"insufficient-allowance",
+	"rejected",
+	"unauthorized",
+	"forbidden",
+	"bad-request",
+	"method-unsupported",
+	"unknown"
+];
+/** Who answered. `alto` is the bundler; `gateway` is the AA gateway's own logic. */
+const CHAIN_UPSTREAMS = [
+	"alchemy",
+	"infura",
+	"public",
+	"alto",
+	"gateway"
+];
+//#endregion
+//#region ../errors/src/errors.ts
+const CAPXUL_ERROR_CODES = [
+	"NOT_AUTHENTICATED",
+	"EMAIL_DELIVERY_FAILED",
+	"PROFILE_NOT_FOUND",
+	"SMART_ACCOUNT_MISSING",
+	"PLAYER_NOT_FOUND",
+	"ACCOUNT_NOT_FOUND",
+	"ACCOUNT_CLAIMED_BY_OTHER_SIGNER",
+	"PROVIDER_ERROR",
+	"CAPABILITY_UNAVAILABLE",
+	"INVALID_INPUT",
+	"ENV_MISSING",
+	"NOT_IMPLEMENTED",
+	"VERIFICATION_REQUIRED",
+	"INSUFFICIENT_BALANCE",
+	"INVALID_RECIPIENT",
+	"ROLE_PERMISSION_DENIED",
+	"TRANSACTION_FAILED",
+	"RATE_LIMITED",
+	"NETWORK_ERROR",
+	"UNKNOWN",
+	"OTP_EXPIRED",
+	"SIGNER_REJECTED",
+	"CANCELLED",
+	"WRONG_STATE",
+	"STALE_EPOCH",
+	"SUPERSEDED",
+	"WORK_DIED",
+	"ACTOR_STOPPED"
+];
+new Set(CAPXUL_ERROR_CODES);
+//#endregion
+//#region src/operations.ts
+const CAPXUL_OPERATIONS = {
+	account: {
+		addressBook: {
+			add: "account.addressBook.add",
+			get: "account.addressBook.get",
+			hide: "account.addressBook.hide",
+			label: "account.addressBook.label",
+			list: "account.addressBook.list",
+			unhide: "account.addressBook.unhide"
+		},
+		balance: "account.balance",
+		faucetMint: "account.faucetMint",
+		getLifecycle: "account.getLifecycle",
+		readBalance: "account.readBalance",
+		retrySetup: "account.retrySetup",
+		status: "account.status",
+		profile: {
+			depositInstructions: "account.profile.depositInstructions",
+			get: "account.profile.get"
+		},
+		inbox: {
+			approve: "account.inbox.approve",
+			decline: "account.inbox.decline",
+			list: "account.inbox.list"
+		},
+		requests: {
+			cancel: "account.requests.cancel",
+			get: "account.requests.get",
+			issue: "account.requests.issue",
+			list: "account.requests.list"
+		}
+	},
+	accounts: {
+		fund: "accounts.fund",
+		read: "accounts.read"
+	},
+	activity: {
+		annotate: "activity.annotate",
+		emitAnnotationSaved: "activity.emitAnnotationSaved",
+		get: "activity.get",
+		list: "activity.list",
+		/** The SDK's live Activity read over the indexer's SSE stream. */
+		subscribe: "activity.subscribe",
+		summary: "activity.summary"
+	},
+	addressBook: {
+		add: "addressBook.add",
+		emitRelationshipChanged: "addressBook.emitRelationshipChanged",
+		get: "addressBook.get",
+		hide: "addressBook.hide",
+		label: "addressBook.label",
+		list: "addressBook.list",
+		unhide: "addressBook.unhide"
+	},
+	applications: { create: "applications.create" },
+	auth: {
+		canSendOtp: "auth.canSendOtp",
+		getSession: "auth.getSession",
+		signIn: "auth.signIn",
+		signOut: "auth.signOut",
+		sendVerificationOtp: "auth.sendVerificationOTP",
+		verifyOtp: "auth.verifyOtp"
+	},
+	client: {
+		createOrg: "createOrg",
+		orgs: "orgs"
+	},
+	credentials: {
+		bootstrapClient: "credentials.bootstrapClient",
+		mintQuickstartKey: "credentials.mintQuickstartKey"
+	},
+	currentUser: { get: "currentUser.get" },
+	devIdentity: { seedFinancialOpsOrg: "devIdentity.seedFinancialOpsOrg" },
+	dev: { browserSeed: "dev.browserSeed" },
+	destinations: {
+		add: "destinations.add",
+		list: "destinations.list",
+		remove: "destinations.remove"
+	},
+	faucetSafe: { deploy: "FaucetSafe.deploy" },
+	financialOps: {
+		addDestination: "financialOps.addDestination",
+		approveRequest: "financialOps.approveRequest",
+		cancelRequest: "financialOps.cancelRequest",
+		createPayee: "financialOps.createPayee",
+		declineRequest: "financialOps.declineRequest",
+		emitInvoiceIssued: "financialOps.emitInvoiceIssued",
+		emitInvoiceRequestTransitioned: "financialOps.emitInvoiceRequestTransitioned",
+		emitPaymentWriterTelemetry: "financialOps.emitPaymentWriterTelemetry",
+		issueRequest: "financialOps.issueRequest",
+		migrateEvidenceIdentity: "financialOps.migrateEvidenceIdentity",
+		planEvidenceIdentity: "financialOps.planEvidenceIdentity",
+		recoverSettlementVerification: "financialOps.recoverSettlementVerification",
+		removeDestination: "financialOps.removeDestination",
+		verifySettlement: "financialOps.verifySettlement"
+	},
+	holdings: {
+		current: "holdings.current",
+		primary: "holdings.primary"
+	},
+	indexer: { reconcile: "indexer.reconcile" },
+	identity: {
+		accountAt: "identity.AccountAt",
+		accountClaimed: "identity.AccountClaimed",
+		accountClaiming: "identity.AccountClaiming",
+		accountDerived: "identity.AccountDerived",
+		accountFailed: "identity.AccountFailed",
+		attachOrganization: "identity.AttachOrganization",
+		claimAccount: "identity.ClaimAccount",
+		completeOnboarding: "identity.completeOnboarding",
+		completeProfile: "identity.completeProfile",
+		create: "identity.create",
+		createOrganization: "identity.CreateOrganization",
+		ensureAccount: "identity.EnsureAccount",
+		leaveOrganization: "identity.LeaveOrganization",
+		loadByAuthUserId: "identity.loadByAuthUserId",
+		loadCurrent: "identity.loadCurrent",
+		orgAt: "identity.OrgAt",
+		orgFailed: "identity.OrgFailed",
+		orgReady: "identity.OrgReady",
+		otpFailed: "identity.OtpFailed",
+		otpSent: "identity.OtpSent",
+		readSession: "identity.ReadSession",
+		requestOtp: "identity.RequestOtp",
+		reset: "identity.Reset",
+		restoreSession: "identity.RestoreSession",
+		resumeOtpEntry: "identity.ResumeOtpEntry",
+		retryAccount: "identity.RetryAccount",
+		retryOrganization: "identity.RetryOrganization",
+		sessionAbsent: "identity.SessionAbsent",
+		sessionRead: "identity.SessionRead",
+		sessionReadFailed: "identity.SessionReadFailed",
+		sessionRestored: "identity.SessionRestored",
+		signedOut: "identity.SignedOut",
+		signOut: "identity.SignOut",
+		signOutFailed: "identity.SignOutFailed",
+		update: "identity.update",
+		handleAvailable: "identity.handleAvailable",
+		verified: "identity.Verified",
+		verifyFailed: "identity.VerifyFailed",
+		verifyOtp: "identity.VerifyOtp"
+	},
+	media: {
+		generateUploadUrl: "media.generateUploadUrl",
+		setOrgLogo: "media.setOrgLogo",
+		setProfileImage: "media.setProfileImage",
+		uploadImage: "media.uploadImage"
+	},
+	me: {
+		depositInstructions: "me.depositInstructions",
+		get: "me.get"
+	},
+	moneyExecution: {
+		abandonPaymentExecution: "moneyExecution.abandonPaymentExecution",
+		prepareOrganizationPaymentExecution: "moneyExecution.prepareOrganizationPaymentExecution",
+		preparePaymentExecution: "moneyExecution.preparePaymentExecution",
+		preparePaymentLifecycleExecution: "moneyExecution.preparePaymentLifecycleExecution",
+		preparePermissionExecution: "moneyExecution.preparePermissionExecution",
+		recoverSubmissionClaims: "moneyExecution.recoverSubmissionClaims",
+		submit: "moneyExecution.submit",
+		submitPaymentCommandExecution: "moneyExecution.submitPaymentCommandExecution",
+		submitPaymentExecution: "moneyExecution.submitPaymentExecution",
+		submitPermissionExecution: "moneyExecution.submitPermissionExecution"
+	},
+	movement: {
+		emitDepositSettled: "movement.emitDepositSettled",
+		scan: "movement.scan"
+	},
+	inbox: {
+		approve: "inbox.approve",
+		decline: "inbox.decline",
+		list: "inbox.list"
+	},
+	offramp: {
+		quote: "offramp.quote",
+		status: "offramp.status"
+	},
+	onboarding: {
+		completeOrganization: "onboarding.completeOrganization",
+		completePerson: "onboarding.completePerson"
+	},
+	org: {
+		acceptInvitations: "org.acceptInvitations",
+		account: { get: "org.account.get" },
+		activateMember: "org.activateMember",
+		auditLog: "org.auditLog",
+		confirmBootstrap: "org.confirmBootstrap",
+		createOrg: "org.createOrg",
+		create: "org.create",
+		detectAndAcceptPendingInvitations: "org.detectAndAcceptPendingInvitations",
+		emitInviteProgressed: "org.emitInviteProgressed",
+		expireInvitations: "org.expireInvitations",
+		getLifecycle: "org.getLifecycle",
+		getProofReceipt: "org.getProofReceipt",
+		invite: "org.invite",
+		inviteMember: "org.inviteMember",
+		list: "org.list",
+		load: "org.load",
+		me: "org.me",
+		members: "org.members",
+		orgs: "org.orgs",
+		payment: "org.payment",
+		permissions: {
+			assign: "org.permissions.assign",
+			change: "org.permissions.change",
+			create: "org.permissions.create",
+			get: "org.permissions.get",
+			list: "org.permissions.list",
+			replace: "org.permissions.replace",
+			revoke: "org.permissions.revoke"
+		},
+		payments: {
+			pay: "org.payments.pay",
+			payBatch: "org.payments.payBatch"
+		},
+		payroll: {
+			authorizeRun: "org.payroll.authorizeRun",
+			groups: {
+				list: "org.payroll.groups.list",
+				remove: "org.payroll.groups.remove",
+				save: "org.payroll.groups.save"
+			},
+			runs: "org.payroll.runs",
+			terms: "org.payroll.terms"
+		},
+		addressBook: {
+			add: "org.addressBook.add",
+			get: "org.addressBook.get",
+			hide: "org.addressBook.hide",
+			label: "org.addressBook.label",
+			list: "org.addressBook.list",
+			unhide: "org.addressBook.unhide"
+		},
+		inbox: {
+			approve: "org.inbox.approve",
+			decline: "org.inbox.decline",
+			list: "org.inbox.list"
+		},
+		lifecycle: { startOrResume: "org.lifecycle.startOrResume" },
+		prepareBootstrap: "org.prepareBootstrap",
+		prepareFounderAccount: "org.prepareFounderAccount",
+		profile: {
+			depositInstructions: "org.profile.depositInstructions",
+			get: "org.profile.get"
+		},
+		readTreasury: "org.readTreasury",
+		requests: {
+			cancel: "org.requests.cancel",
+			get: "org.requests.get",
+			issue: "org.requests.issue",
+			list: "org.requests.list"
+		},
+		recordFailure: "org.recordFailure",
+		recordProgress: "org.recordProgress",
+		resendInviteToken: "org.resendInviteToken",
+		resumeBootstrapSubmission: "org.resumeBootstrapSubmission",
+		retry: "org.retry",
+		retrySetup: "org.retrySetup",
+		roles: "org.roles",
+		startOrResume: "org.startOrResume",
+		submitBootstrap: "org.submitBootstrap",
+		treasury: "org.treasury"
+	},
+	organization: { setup: "organization.setup" },
+	organizationPayments: {
+		pay: "organizationPayments.pay",
+		payBatch: "organizationPayments.payBatch",
+		prepareExecution: "organizationPayments.prepareExecution",
+		retry: "organizationPayments.retry"
+	},
+	organizationSetup: { getProofReceipt: "organizationSetup.getProofReceipt" },
+	organizations: { detectAndAcceptPendingInvitations: "orgs.detectAndAcceptPendingInvitations" },
+	payments: {
+		cancel: "payments.cancel",
+		claim: "payments.claim",
+		createCommitment: "payments.createCommitment",
+		get: "payments.get",
+		ledger: "payments",
+		list: "payments.list",
+		pay: "payments.pay",
+		prepareExecution: "payments.prepareExecution",
+		prepareLifecycleExecution: "payments.prepareLifecycleExecution",
+		redirect: "payments.redirect",
+		retry: "payments.retry",
+		submitCommandExecution: "payments.submitCommandExecution",
+		submitExecution: "payments.submitExecution"
+	},
+	paymentDocuments: {
+		render: "paymentDocuments.render",
+		verify: "paymentDocuments.verify"
+	},
+	recipient: { resolve: "recipient.resolve" },
+	payroll: {
+		authorizeRun: "payroll.authorizeRun",
+		emitGroupChanged: "payroll.emitGroupChanged",
+		emitRunTransitioned: "payroll.emitRunTransitioned",
+		groups: {
+			access: "payroll.groups",
+			list: "payroll.groups.list",
+			remove: "payroll.groups.remove",
+			save: "payroll.groups.save"
+		},
+		removeGroup: "payroll.removeGroup",
+		runs: "payroll.runs",
+		saveGroup: "payroll.saveGroup",
+		terms: "payroll.terms"
+	},
+	permission: {
+		command: "permission.command",
+		retryVerification: "permission.retryVerification",
+		verify: "permission.verify",
+		verifySubmitted: "permission.verifySubmitted"
+	},
+	permissions: {
+		assign: "permissions.assign",
+		change: "permissions.change",
+		create: "permissions.create",
+		get: "permissions.get",
+		list: "permissions.list",
+		prepareExecution: "permissions.prepareExecution",
+		replace: "permissions.replace",
+		revoke: "permissions.revoke",
+		submitExecution: "permissions.submitExecution"
+	},
+	publishableKeys: {
+		mint: "publishableKeys.mint",
+		revoke: "publishableKeys.revoke",
+		rotate: "publishableKeys.rotate"
+	},
+	requests: {
+		cancel: "requests.cancel",
+		get: "requests.get",
+		issue: "requests.issue",
+		list: "requests.list"
+	},
+	runtime: {
+		assign: "assign",
+		canSendOtp: "canSendOtp",
+		cancelCommitment: "cancel_commitment",
+		change: "change",
+		claimCommitment: "claim_commitment",
+		create: "create",
+		createCapxulClient: "createCapxulClient",
+		createCapxulClientWithOrgDeploymentSeams: "createCapxulClientWithOrgDeploymentSeams",
+		createCommitment: "create_commitment",
+		getConvexJwt: "getConvexJwt",
+		getSession: "getSession",
+		initialize: "initialize",
+		mutation: "mutation",
+		now: "now",
+		port: "port",
+		query: "query",
+		redirectCommitment: "redirect_commitment",
+		replace: "replace",
+		resolve: "resolve",
+		revoke: "revoke",
+		send: "send",
+		sendOtp: "sendOtp",
+		signIn: "signIn",
+		signOut: "signOut",
+		sleep: "sleep",
+		verifyOtp: "verifyOtp",
+		wallet: "wallet"
+	},
+	smartAccount: {
+		claim: "smartAccount.claim",
+		confirmDeployment: "smartAccount.confirmDeployment",
+		loadByAuthUserId: "smartAccount.loadByAuthUserId",
+		loadCurrent: "smartAccount.loadCurrent",
+		provision: "smartAccount.provision"
+	},
+	system: {
+		health: "system.health",
+		ping: "system.ping",
+		runtimeChain: "system.runtimeChain"
+	},
+	testUsdc: { mint: "TestUSDC.mint" },
+	_internal: {
+		accounts: { fund: "_internal.accounts.fund" },
+		close: "_internal.close",
+		identity: {
+			completeProfile: "_internal.identity.completeProfile",
+			runFacade: "_internal.identity.runFacade",
+			send: "_internal.identity.send"
+		},
+		organizationSetup: { getProofReceipt: "_internal.organizationSetup.getProofReceipt" }
+	},
+	tenancy: {
+		revokeBackendTenancyConsent: "tenancy.revokeBackendTenancyConsent",
+		seedBackendTenancy: "tenancy.seedBackendTenancy"
+	}
+};
+function collectOperations(tree) {
+	return Object.values(tree).flatMap((value) => typeof value === "string" ? [value] : collectOperations(value));
+}
+const operations = new Set(collectOperations(CAPXUL_OPERATIONS));
+function isCapxulOperation(value) {
+	return typeof value === "string" && operations.has(value);
+}
+function normalizeCapxulOperation(value) {
+	return isCapxulOperation(value) ? value : "unknown";
+}
+//#endregion
+export { CHAIN_UPSTREAMS as a, redactSecrets as c, CAPXUL_ERROR_CODES as i, redactUrlSecrets as l, isCapxulOperation as n, FAILURE_MODES as o, normalizeCapxulOperation as r, isCredentialField as s, CAPXUL_OPERATIONS as t };