@capxul/sdk 1.0.0-alpha.11 → 1.0.0-alpha.12

package/dist/index.mjs

@@ -1,181 +1,17 @@
-import { A as toSessionToken, C as toEpochSeconds, D as toPublishableKey, E as toOrgId, F as isCapxulError, M as decodeConvexError, N as CapxulError, O as toPublishableKeyId, P as Errors, S as toEpochMs, T as toKycTier, _ as toChainId, b as toDurationMs, c as BYTES32_RE, d as toAccountId, f as toAddress, g as toAuthUserId, h as toAppId, j as toSubAccountId, k as toRoleKey, l as EVM_ADDRESS_RE$1, m as toAnonymousDistinctId, n as BrowserAuthCacheAdapter, o as AuthCachePortTag, p as toAllowedOrigin, s as APP_ID_RE, t as InMemoryAuthCacheAdapter, u as SUPPORTED_CURRENCY_CODES, v as toCountryCode, w as toJwtToken, x as toEmail, y as toCurrencyCode } from "./InMemoryAuthCacheAdapter-v5W-XB5M.mjs";
-import { formatUnits, keccak256, padHex, parseUnits, recoverAddress, stringToHex, toBytes } from "viem";
+import { n as BrowserAuthCacheAdapter, o as AuthCachePortTag, t as InMemoryAuthCacheAdapter } from "./InMemoryAuthCacheAdapter-EBzKEJmQ.mjs";
+import { CapxulError, Errors, isCapxulError, isCapxulError as isCapxulError$1 } from "@capxul/errors";
+import { CapxulError as CapxulError$2, Errors as Errors$1, USDX_CURRENCY, USDX_DECIMALS, compileOrgRoleDefinitions, decodeConvexError, isCapxulError as isCapxulError$2, normalizeBindingEmail, orgRoleKeyForLabel, orgRoleTemplateDefinitions } from "@capxul/config";
+import { toAccountId, toAddress, toAllowedOrigin, toAnonymousDistinctId, toAppId, toAuthUserId, toChainId, toCountryCode, toCurrencyCode, toDurationMs, toEmail, toEpochMs, toEpochSeconds, toJwtToken, toKycTier, toOrgId, toPublishableKey, toPublishableKeyId, toRoleKey, toSessionToken, toSubAccountId } from "@capxul/types";
 import { Context, Data, Deferred, Duration, Effect, Either, Exit, Layer, Ref, Request, Scope } from "effect";
 import { getFunctionName, makeFunctionReference } from "convex/server";
 import { privateKeyToAccount } from "viem/accounts";
+import { formatUnits, keccak256, parseUnits, recoverAddress, stringToHex } from "viem";
 import { Schema, TreeFormatter } from "@effect/schema";
+import { BootstrapEnvelope } from "@capxul/wire";
 import { ConvexClient } from "convex/browser";
+import { redactTelemetryProps } from "@capxul/observability";
 import { AccountTypeEnum, ChainTypeEnum, EmbeddedState, Openfort, RecoveryMethod, ThirdPartyOAuthProvider } from "@openfort/openfort-js";
 import { Machine } from "@effect/experimental";
-//#region ../config/src/tokens.ts
-/** `TestUSDC` ("USDX") — Base Sepolia, 6 decimals, open `mint`. (Canon §1.) */
-const USDX_ADDRESS_BASE_SEPOLIA = "0xf09fcbb6df9f8f918e58f9c8ab15a76ade862b77";
-USDX_ADDRESS_BASE_SEPOLIA.toLowerCase();
-//#endregion
-//#region ../config/src/safe.ts
-const BASE_SEPOLIA_CHAIN_ID = 84532;
-/**
-* Normalize an email for use as a Capxul Safe salt input.
-*
-* Trims surrounding whitespace and lowercases the address so that
-* `"  User+Demo@Example.COM  "` and `"user+demo@example.com"` derive
-* the same `safeAddress`. This is the canonical normalization rule —
-* any future change here would shift every existing user's Safe
-* address, so the rule is pinned by the fixture matrix in
-* `packages/config/tests/safe-address-conformance.test.ts`.
-*
-* @param email - The raw email address to normalize
-* @returns The trimmed, lowercased email
-*/
-function normalizeSafeSaltEmail(email) {
-	return email.trim().toLowerCase();
-}
-/**
-* Normalize a raw email for binding id + Safe salt derivation.
-* Delegates to {@link normalizeSafeSaltEmail} so binding resolution and
-* `deriveCapxulSafeAddress` never drift apart.
-*/
-function normalizeBindingEmail(email) {
-	return normalizeSafeSaltEmail(email);
-}
-//#endregion
-//#region ../config/src/route.ts
-/** USDX on Base Sepolia — the only settlement token in v1. */
-const USDX_BASE_SEPOLIA_TOKEN = {
-	chainId: BASE_SEPOLIA_CHAIN_ID,
-	address: USDX_ADDRESS_BASE_SEPOLIA,
-	decimals: 6
-};
-USDX_BASE_SEPOLIA_TOKEN.chainId;
-USDX_BASE_SEPOLIA_TOKEN.chainId;
-//#endregion
-//#region ../config/src/role-dsl.ts
-const USD_DECIMALS = 6;
-const USD_SCALE = 10n ** BigInt(USD_DECIMALS);
-const USD_DISPLAY_RE = /^\d+(?:\.\d{1,6})?$/;
-const USD_BASE_UNIT_RE = /^\d+$/;
-const EXEC_TRANSACTION_WITH_ROLE = "zodiac.roles.execTransactionWithRole";
-const ASSIGN_ROLES = "zodiac.roles.assignRoles";
-const SCOPE_TARGET = "zodiac.roles.scopeTarget";
-const OWNER_ROLE_LABEL = "Owner";
-const MARKETING_SUB_ACCOUNT_ID = "subaccount_marketing";
-const PAYROLL_SUB_ACCOUNT_ID = "subaccount_payroll";
-function usd(value) {
-	return {
-		currency: "USD",
-		value: usdDisplayToBaseUnits(value),
-		decimals: USD_DECIMALS
-	};
-}
-function usdDisplayToBaseUnits(value) {
-	if (value.trim() !== value || !USD_DISPLAY_RE.test(value)) throw Errors.invalidInput("role.spend", "USD caps must be unsigned decimal strings with at most 6 fractional digits");
-	const parts = value.split(".");
-	const whole = parts[0] ?? "0";
-	const fraction = parts[1] ?? "";
-	return (BigInt(whole) * USD_SCALE + BigInt(fraction.padEnd(USD_DECIMALS, "0"))).toString();
-}
-function normalizeOrgRoleMoney(money, field) {
-	if (money.currency !== "USD" || money.decimals !== USD_DECIMALS || !USD_BASE_UNIT_RE.test(money.value)) throw Errors.invalidInput(field, `must be USD base units with ${USD_DECIMALS} decimals`);
-	return money;
-}
-function normalizeOrgRoleSpendCap(spend) {
-	if (spend === void 0) return void 0;
-	return {
-		...spend.perTx === void 0 ? {} : { perTx: normalizeOrgRoleMoney(spend.perTx, "roles.spend.perTx") },
-		...spend.perDay === void 0 ? {} : { perDay: normalizeOrgRoleMoney(spend.perDay, "roles.spend.perDay") },
-		...spend.toRecipients === void 0 ? {} : { toRecipients: spend.toRecipients }
-	};
-}
-function normalizeOrgRoleLabel(label) {
-	const normalized = label.trim().replace(/\s+/g, " ");
-	if (normalized.length === 0) throw Errors.invalidInput("role.label", "must be a non-empty role label");
-	return normalized;
-}
-function orgRoleKeyForLabel(label) {
-	return keccak256(toBytes(normalizeOrgRoleLabel(label).toLowerCase()));
-}
-function soloOrgRoleTemplate() {
-	return [{
-		label: "Owner",
-		subAccounts: { scope: "all" },
-		canManageMembers: true,
-		canManageRoles: true
-	}];
-}
-function startupOrgRoleTemplate() {
-	return [
-		...soloOrgRoleTemplate(),
-		{
-			label: "Finance Manager",
-			spend: {
-				perTx: usd("25000"),
-				perDay: usd("100000"),
-				toRecipients: "anyone"
-			},
-			subAccounts: { scope: [MARKETING_SUB_ACCOUNT_ID] }
-		},
-		{
-			label: "Team Lead",
-			spend: {
-				perTx: usd("5000"),
-				perDay: usd("15000"),
-				toRecipients: "anyone"
-			},
-			subAccounts: { scope: [PAYROLL_SUB_ACCOUNT_ID] }
-		}
-	];
-}
-function orgRoleTemplateDefinitions(template, customRoles = []) {
-	switch (template) {
-		case "Solo": return soloOrgRoleTemplate();
-		case "Startup": return startupOrgRoleTemplate();
-		case "Custom": return customRoles.length === 0 ? soloOrgRoleTemplate() : customRoles;
-		default: return template;
-	}
-}
-function compileOrgRoleDefinitions(definitions) {
-	if (definitions.length === 0) throw Errors.invalidInput("roles", "must include at least one role");
-	const seen = /* @__PURE__ */ new Set();
-	const roles = definitions.map((definition) => {
-		const label = normalizeOrgRoleLabel(definition.label);
-		const roleKey = orgRoleKeyForLabel(label);
-		if (seen.has(roleKey)) throw Errors.invalidInput("roles", `duplicate role label: ${label}`);
-		seen.add(roleKey);
-		const spend = normalizeOrgRoleSpendCap(definition.spend);
-		const permissions = [];
-		if (spend !== void 0 || label === OWNER_ROLE_LABEL) permissions.push(EXEC_TRANSACTION_WITH_ROLE);
-		if (definition.canManageMembers === true) permissions.push(ASSIGN_ROLES);
-		if (definition.canManageRoles === true) permissions.push(SCOPE_TARGET);
-		return {
-			label,
-			roleKey,
-			definition: {
-				...definition,
-				label,
-				...spend === void 0 ? {} : { spend }
-			},
-			permissions,
-			allowance: spend ?? null
-		};
-	});
-	const manager = roles.find((role) => role.definition.canManageMembers === true);
-	if (manager === void 0) throw Errors.invalidInput("roles.canManageMembers", "at least one role must compile to the on-chain member-management permission");
-	return {
-		roles,
-		memberManagementRole: {
-			roleKey: manager.roleKey,
-			permission: ASSIGN_ROLES
-		}
-	};
-}
-padHex(stringToHex("FM_DAILY"), {
-	size: 32,
-	dir: "right"
-}), padHex(stringToHex("TL_DAILY"), {
-	size: 32,
-	dir: "right"
-});
-//#endregion
 //#region src/telemetry/stack-frame-parser.ts
 /**
 * Regex for V8/Chrome stack trace frame lines.
@@ -265,7 +101,7 @@ function isFailureMode(value) {
 * unrecognised cause.
 */
 function getFailureMode(error) {
-	if (!isCapxulError(error)) return void 0;
+	if (!isCapxulError$2(error)) return void 0;
 	const details = error.details;
 	if (details === void 0) return void 0;
 	return isFailureMode(details.failure_mode) ? details.failure_mode : void 0;
@@ -302,7 +138,7 @@ function resolveFailureMode(error, contextFailureMode) {
 function captureException(telemetry, error, context) {
 	return Effect.catchAllDefect(Effect.sync(() => {
 		const exceptionList = buildExceptionList(error instanceof Error ? parseV8StackFrames(error) : []);
-		const capxulError = isCapxulError(error) ? error : null;
+		const capxulError = isCapxulError$2(error) ? error : null;
 		const props = {
 			capxul_error_code: capxulError?.code ?? context?.capxul_error_code ?? "UNKNOWN",
 			layer: capxulError?.layer ?? context?.layer,
@@ -409,7 +245,7 @@ const accountStatusProgram = Effect.gen(function* () {
 	};
 	const signerAddress = yield* Effect.tryPromise({
 		try: () => signer.getAddress(),
-		catch: (cause) => isCapxulError(cause) ? cause : Errors.providerError("signer", "getAddress", cause)
+		catch: (cause) => isCapxulError$2(cause) ? cause : Errors$1.providerError("signer", "getAddress", cause)
 	});
 	return {
 		status: "accountProviderReady",
@@ -1090,7 +926,7 @@ function refLabel(ref) {
 //#endregion
 //#region src/client/to-capxul-result.ts
 async function toCapxulResult(program, layer) {
-	const result = await Effect.runPromise(program.pipe(Effect.provide(layer), Effect.catchAllDefect((defect) => Effect.fail(Errors.unknown(defect))), Effect.either));
+	const result = await Effect.runPromise(program.pipe(Effect.provide(layer), Effect.catchAllDefect((defect) => Effect.fail(Errors$1.unknown(defect))), Effect.either));
 	if (Either.isLeft(result)) return {
 		ok: false,
 		error: result.left
@@ -1119,13 +955,13 @@ function makeAccountMethods(deps) {
 				value: void 0
 			};
 		} catch (cause) {
-			if (cause instanceof CapxulError) return {
+			if (cause instanceof CapxulError$2) return {
 				ok: false,
 				error: cause
 			};
 			return {
 				ok: false,
-				error: Errors.providerError("signer", "getAddress", cause)
+				error: Errors$1.providerError("signer", "getAddress", cause)
 			};
 		}
 	};
@@ -1156,7 +992,7 @@ function makeAccountMethods(deps) {
 		const session = await currentSession(deps.actor, deps.authCache);
 		if (session === null) return {
 			ok: false,
-			error: Errors.notAuthenticated()
+			error: Errors$1.notAuthenticated()
 		};
 		const profileReady = await ensureIdentityProfile(session);
 		if (!profileReady.ok) return {
@@ -1179,12 +1015,12 @@ function makeAccountMethods(deps) {
 		const session = await currentSession(deps.actor, deps.authCache);
 		if (session === null) return {
 			ok: false,
-			error: Errors.notAuthenticated()
+			error: Errors$1.notAuthenticated()
 		};
 		const signer = deps.signer;
 		if (signer === void 0) return {
 			ok: false,
-			error: Errors.smartAccountMissing("deploySafe")
+			error: Errors$1.smartAccountMissing("deploySafe")
 		};
 		const existing = await runPortEffect(deps.smartAccountPort.loadByAuthUserId(session.authUserId));
 		if (!existing.ok) return existing;
@@ -1257,7 +1093,7 @@ function makeAccountMethods(deps) {
 		let accountId;
 		if (status.value.status !== "notAuthenticated" && (phase.status === "ready" || isRequirementMet(status.value, requirement))) {
 			const accountReadPort = deps.accountReadPort;
-			if (accountReadPort === void 0) return reportAndReturn(Errors.invalidInput("account", "accountReadPort is required to resolve ready lifecycle"));
+			if (accountReadPort === void 0) return reportAndReturn(Errors$1.invalidInput("account", "accountReadPort is required to resolve ready lifecycle"));
 			const account = await runPortEffect(accountReadPort.readBalance({ chainId: toChainId(deps.chainId) }));
 			if (!account.ok) return reportAndReturn(account.error);
 			accountId = String(account.value.id);
@@ -1318,7 +1154,7 @@ async function runBackendClaim(input) {
 	} catch (cause) {
 		return {
 			ok: false,
-			error: Errors.providerError("signer", "getAddress", cause)
+			error: Errors$1.providerError("signer", "getAddress", cause)
 		};
 	}
 	const claimed = await runPortEffect(input.smartAccountPort.claim({
@@ -1367,7 +1203,7 @@ function eip1193AccountProvider(input) {
 				const first = firstAccount(await input.provider.request({ method: "eth_accounts" }));
 				if (first === null) return {
 					ok: false,
-					error: Errors.smartAccountMissing("eip1193-account")
+					error: Errors$1.smartAccountMissing("eip1193-account")
 				};
 				const address = toAddress(first);
 				cachedAddress = address;
@@ -1378,7 +1214,7 @@ function eip1193AccountProvider(input) {
 			} catch (err) {
 				return {
 					ok: false,
-					error: Errors.providerError("eip1193", "eth_accounts", err)
+					error: Errors$1.providerError("eip1193", "eth_accounts", err)
 				};
 			} finally {
 				inFlight = null;
@@ -1392,7 +1228,7 @@ function eip1193AccountProvider(input) {
 		async getDeployAccount() {
 			return {
 				ok: false,
-				error: Errors.notImplemented("Eip1193AccountProvider", "getDeployAccount")
+				error: Errors$1.notImplemented("Eip1193AccountProvider", "getDeployAccount")
 			};
 		}
 	};
@@ -1600,7 +1436,7 @@ async function recoverRawDigestSigner(input) {
 }
 //#endregion
 //#region package.json
-var version = "1.0.0-alpha.11";
+var version = "1.0.0-alpha.12";
 //#endregion
 //#region src/ports/auth-client.ts
 var AuthClientError = class extends Data.TaggedError("AuthClientError") {};
@@ -1687,18 +1523,18 @@ function mapBetterAuthError(operation, body) {
 	if (typeof body === "object" && body !== null) {
 		const errBody = body;
 		const code = typeof errBody.code === "string" ? errBody.code : "";
-		if (code === "OTP_EXPIRED") return Errors.otpExpired();
-		if (code === "INVALID_OTP") return Errors.invalidInput("otp", errBody.message ?? "invalid OTP");
-		if (code === "VALIDATION_ERROR" || code === "INVALID_EMAIL") return Errors.invalidInput("email", errBody.message ?? "invalid email");
+		if (code === "OTP_EXPIRED") return Errors$1.otpExpired();
+		if (code === "INVALID_OTP") return Errors$1.invalidInput("otp", errBody.message ?? "invalid OTP");
+		if (code === "VALIDATION_ERROR" || code === "INVALID_EMAIL") return Errors$1.invalidInput("email", errBody.message ?? "invalid email");
 	}
-	return Errors.providerError("better-auth", operation, new Error(String(body)));
+	return Errors$1.providerError("better-auth", operation, new Error(String(body)));
 }
 function isAbortError$1(err, signal) {
 	return signal?.aborted === true || err instanceof Error && err.name === "AbortError" || typeof DOMException !== "undefined" && err instanceof DOMException && err.name === "AbortError";
 }
 function mapFetchError$1(operation, err, signal) {
-	if (isAbortError$1(err, signal)) return Errors.cancelled({ operation });
-	return Errors.networkError(operation, err instanceof Error ? err : new Error(String(err)));
+	if (isAbortError$1(err, signal)) return Errors$1.cancelled({ operation });
+	return Errors$1.networkError(operation, err instanceof Error ? err : new Error(String(err)));
 }
 var BetterAuthBrowserAdapter = class {
 	authBaseUrl;
@@ -1713,7 +1549,7 @@ var BetterAuthBrowserAdapter = class {
 	async canSendOtp(_input, options) {
 		if (options?.signal?.aborted) return {
 			ok: false,
-			error: Errors.cancelled({ operation: "canSendOtp" })
+			error: Errors$1.cancelled({ operation: "canSendOtp" })
 		};
 		return {
 			ok: true,
@@ -1726,7 +1562,7 @@ var BetterAuthBrowserAdapter = class {
 	async sendOtp(input, options) {
 		if (options?.signal?.aborted) return {
 			ok: false,
-			error: Errors.cancelled({ operation: "sendOtp" })
+			error: Errors$1.cancelled({ operation: "sendOtp" })
 		};
 		try {
 			const res = await this.fetchImpl(this.url("/api/auth/email-otp/send-verification-otp"), withSignal$1({
@@ -1740,7 +1576,7 @@ var BetterAuthBrowserAdapter = class {
 			}, options?.signal));
 			if (options?.signal?.aborted) return {
 				ok: false,
-				error: Errors.cancelled({ operation: "sendOtp" })
+				error: Errors$1.cancelled({ operation: "sendOtp" })
 			};
 			if (res.ok) return {
 				ok: true,
@@ -1748,19 +1584,19 @@ var BetterAuthBrowserAdapter = class {
 			};
 			if (res.status === 429) return {
 				ok: false,
-				error: Errors.rateLimited({ resource: "better-auth/sendOtp" })
+				error: Errors$1.rateLimited({ resource: "better-auth/sendOtp" })
 			};
 			const body = await safeJson$1(res);
 			if (typeof body === "object" && body !== null) {
 				const errBody = body;
 				if (errBody.code === "INVALID_EMAIL" || errBody.code === "VALIDATION_ERROR") return {
 					ok: false,
-					error: Errors.invalidInput("email", errBody.message ?? "invalid email")
+					error: Errors$1.invalidInput("email", errBody.message ?? "invalid email")
 				};
 			}
 			return {
 				ok: false,
-				error: Errors.providerError("better-auth", "sendOtp", /* @__PURE__ */ new Error(`HTTP ${res.status}`))
+				error: Errors$1.providerError("better-auth", "sendOtp", /* @__PURE__ */ new Error(`HTTP ${res.status}`))
 			};
 		} catch (err) {
 			return {
@@ -1772,7 +1608,7 @@ var BetterAuthBrowserAdapter = class {
 	async verifyOtp(input, options) {
 		if (options?.signal?.aborted) return {
 			ok: false,
-			error: Errors.cancelled({ operation: "verifyOtp" })
+			error: Errors$1.cancelled({ operation: "verifyOtp" })
 		};
 		try {
 			const res = await this.fetchImpl(this.url("/api/auth/sign-in/email-otp"), withSignal$1({
@@ -1786,7 +1622,7 @@ var BetterAuthBrowserAdapter = class {
 			}, options?.signal));
 			if (options?.signal?.aborted) return {
 				ok: false,
-				error: Errors.cancelled({ operation: "verifyOtp" })
+				error: Errors$1.cancelled({ operation: "verifyOtp" })
 			};
 			const body = await safeJson$1(res);
 			if (res.ok) {
@@ -1799,7 +1635,7 @@ var BetterAuthBrowserAdapter = class {
 				}
 				return {
 					ok: false,
-					error: Errors.providerError("better-auth", "verifyOtp", /* @__PURE__ */ new Error("unexpected 200 body"))
+					error: Errors$1.providerError("better-auth", "verifyOtp", /* @__PURE__ */ new Error("unexpected 200 body"))
 				};
 			}
 			return {
@@ -1816,7 +1652,7 @@ var BetterAuthBrowserAdapter = class {
 	async getSession(options) {
 		if (options?.signal?.aborted) return {
 			ok: false,
-			error: Errors.cancelled({ operation: "getSession" })
+			error: Errors$1.cancelled({ operation: "getSession" })
 		};
 		try {
 			const res = await this.fetchImpl(this.url("/api/auth/get-session"), withSignal$1({
@@ -1825,11 +1661,11 @@ var BetterAuthBrowserAdapter = class {
 			}, options?.signal));
 			if (options?.signal?.aborted) return {
 				ok: false,
-				error: Errors.cancelled({ operation: "getSession" })
+				error: Errors$1.cancelled({ operation: "getSession" })
 			};
 			if (!res.ok) return {
 				ok: false,
-				error: Errors.providerError("better-auth", "getSession", /* @__PURE__ */ new Error(`HTTP ${res.status}`))
+				error: Errors$1.providerError("better-auth", "getSession", /* @__PURE__ */ new Error(`HTTP ${res.status}`))
 			};
 			const body = await safeJson$1(res);
 			if (body === null) return {
@@ -1857,7 +1693,7 @@ var BetterAuthBrowserAdapter = class {
 	async signOut(options) {
 		if (options?.signal?.aborted) return {
 			ok: false,
-			error: Errors.cancelled({ operation: "signOut" })
+			error: Errors$1.cancelled({ operation: "signOut" })
 		};
 		try {
 			const res = await this.fetchImpl(this.url("/api/auth/sign-out"), withSignal$1({
@@ -1868,7 +1704,7 @@ var BetterAuthBrowserAdapter = class {
 			}, options?.signal));
 			if (options?.signal?.aborted) return {
 				ok: false,
-				error: Errors.cancelled({ operation: "signOut" })
+				error: Errors$1.cancelled({ operation: "signOut" })
 			};
 			if (res.ok) return {
 				ok: true,
@@ -1876,7 +1712,7 @@ var BetterAuthBrowserAdapter = class {
 			};
 			return {
 				ok: false,
-				error: Errors.providerError("better-auth", "signOut", /* @__PURE__ */ new Error(`HTTP ${res.status}`))
+				error: Errors$1.providerError("better-auth", "signOut", /* @__PURE__ */ new Error(`HTTP ${res.status}`))
 			};
 		} catch (err) {
 			return {
@@ -1888,7 +1724,7 @@ var BetterAuthBrowserAdapter = class {
 	async getConvexJwt(options) {
 		if (options?.signal?.aborted) return {
 			ok: false,
-			error: Errors.cancelled({ operation: "getConvexJwt" })
+			error: Errors$1.cancelled({ operation: "getConvexJwt" })
 		};
 		try {
 			const res = await this.fetchImpl(this.url("/api/auth/convex/token"), withSignal$1({
@@ -1897,15 +1733,15 @@ var BetterAuthBrowserAdapter = class {
 			}, options?.signal));
 			if (options?.signal?.aborted) return {
 				ok: false,
-				error: Errors.cancelled({ operation: "getConvexJwt" })
+				error: Errors$1.cancelled({ operation: "getConvexJwt" })
 			};
 			if (res.status === 401) return {
 				ok: false,
-				error: Errors.notAuthenticated()
+				error: Errors$1.notAuthenticated()
 			};
 			if (!res.ok) return {
 				ok: false,
-				error: Errors.providerError("better-auth", "getConvexJwt", /* @__PURE__ */ new Error(`HTTP ${res.status}`))
+				error: Errors$1.providerError("better-auth", "getConvexJwt", /* @__PURE__ */ new Error(`HTTP ${res.status}`))
 			};
 			const body = await safeJson$1(res);
 			if (typeof body === "object" && body !== null) {
@@ -1920,7 +1756,7 @@ var BetterAuthBrowserAdapter = class {
 			}
 			return {
 				ok: false,
-				error: Errors.providerError("better-auth", "getConvexJwt", /* @__PURE__ */ new Error("unexpected body"))
+				error: Errors$1.providerError("better-auth", "getConvexJwt", /* @__PURE__ */ new Error("unexpected body"))
 			};
 		} catch (err) {
 			return {
@@ -2096,8 +1932,8 @@ function isAbortError(err, signal) {
 	return signal?.aborted === true || err instanceof Error && err.name === "AbortError" || typeof DOMException !== "undefined" && err instanceof DOMException && err.name === "AbortError";
 }
 function mapFetchError(operation, err, signal) {
-	if (isAbortError(err, signal)) return Errors.cancelled({ operation });
-	return Errors.networkError(operation, err instanceof Error ? err : new Error(String(err)));
+	if (isAbortError(err, signal)) return Errors$1.cancelled({ operation });
+	return Errors$1.networkError(operation, err instanceof Error ? err : new Error(String(err)));
 }
 var BetterAuthNodeAdapter = class {
 	authBaseUrl;
@@ -2125,7 +1961,7 @@ var BetterAuthNodeAdapter = class {
 	async canSendOtp(_input, options) {
 		if (options?.signal?.aborted) return {
 			ok: false,
-			error: Errors.cancelled({ operation: "canSendOtp" })
+			error: Errors$1.cancelled({ operation: "canSendOtp" })
 		};
 		return {
 			ok: true,
@@ -2138,7 +1974,7 @@ var BetterAuthNodeAdapter = class {
 	async sendOtp(input, options) {
 		if (options?.signal?.aborted) return {
 			ok: false,
-			error: Errors.cancelled({ operation: "sendOtp" })
+			error: Errors$1.cancelled({ operation: "sendOtp" })
 		};
 		try {
 			const res = await this.fetchImpl(this.url("/api/auth/email-otp/send-verification-otp"), withSignal({
@@ -2154,7 +1990,7 @@ var BetterAuthNodeAdapter = class {
 			}, options?.signal));
 			if (options?.signal?.aborted) return {
 				ok: false,
-				error: Errors.cancelled({ operation: "sendOtp" })
+				error: Errors$1.cancelled({ operation: "sendOtp" })
 			};
 			if (res.ok) return {
 				ok: true,
@@ -2162,19 +1998,19 @@ var BetterAuthNodeAdapter = class {
 			};
 			if (res.status === 429) return {
 				ok: false,
-				error: Errors.rateLimited({ resource: "better-auth/sendOtp" })
+				error: Errors$1.rateLimited({ resource: "better-auth/sendOtp" })
 			};
 			const body = await safeJson(res);
 			if (typeof body === "object" && body !== null) {
 				const errBody = body;
 				if (errBody.code === "INVALID_EMAIL" || errBody.code === "VALIDATION_ERROR") return {
 					ok: false,
-					error: Errors.invalidInput("email", errBody.message ?? "invalid email")
+					error: Errors$1.invalidInput("email", errBody.message ?? "invalid email")
 				};
 			}
 			return {
 				ok: false,
-				error: Errors.providerError("better-auth", "sendOtp", /* @__PURE__ */ new Error(`HTTP ${res.status}`))
+				error: Errors$1.providerError("better-auth", "sendOtp", /* @__PURE__ */ new Error(`HTTP ${res.status}`))
 			};
 		} catch (err) {
 			return {
@@ -2186,7 +2022,7 @@ var BetterAuthNodeAdapter = class {
 	async verifyOtp(input, options) {
 		if (options?.signal?.aborted) return {
 			ok: false,
-			error: Errors.cancelled({ operation: "verifyOtp" })
+			error: Errors$1.cancelled({ operation: "verifyOtp" })
 		};
 		try {
 			const res = await this.fetchImpl(this.url("/api/auth/sign-in/email-otp"), withSignal({
@@ -2202,7 +2038,7 @@ var BetterAuthNodeAdapter = class {
 			}, options?.signal));
 			if (options?.signal?.aborted) return {
 				ok: false,
-				error: Errors.cancelled({ operation: "verifyOtp" })
+				error: Errors$1.cancelled({ operation: "verifyOtp" })
 			};
 			setCookiesFromResponse(this.cookieJar, this.host, res);
 			const body = await safeJson(res);
@@ -2218,17 +2054,17 @@ var BetterAuthNodeAdapter = class {
 					const errBody = body;
 					if (errBody.code === "OTP_EXPIRED") return {
 						ok: false,
-						error: Errors.otpExpired()
+						error: Errors$1.otpExpired()
 					};
 					if (errBody.code === "INVALID_OTP") return {
 						ok: false,
-						error: Errors.invalidInput("otp", errBody.message ?? "invalid OTP")
+						error: Errors$1.invalidInput("otp", errBody.message ?? "invalid OTP")
 					};
 				}
 			}
 			return {
 				ok: false,
-				error: Errors.providerError("better-auth", "verifyOtp", /* @__PURE__ */ new Error(`HTTP ${res.status}`))
+				error: Errors$1.providerError("better-auth", "verifyOtp", /* @__PURE__ */ new Error(`HTTP ${res.status}`))
 			};
 		} catch (err) {
 			return {
@@ -2240,7 +2076,7 @@ var BetterAuthNodeAdapter = class {
 	async getSession(options) {
 		if (options?.signal?.aborted) return {
 			ok: false,
-			error: Errors.cancelled({ operation: "getSession" })
+			error: Errors$1.cancelled({ operation: "getSession" })
 		};
 		try {
 			const res = await this.fetchImpl(this.url("/api/auth/get-session"), withSignal({
@@ -2249,11 +2085,11 @@ var BetterAuthNodeAdapter = class {
 			}, options?.signal));
 			if (options?.signal?.aborted) return {
 				ok: false,
-				error: Errors.cancelled({ operation: "getSession" })
+				error: Errors$1.cancelled({ operation: "getSession" })
 			};
 			if (!res.ok) return {
 				ok: false,
-				error: Errors.providerError("better-auth", "getSession", /* @__PURE__ */ new Error(`HTTP ${res.status}`))
+				error: Errors$1.providerError("better-auth", "getSession", /* @__PURE__ */ new Error(`HTTP ${res.status}`))
 			};
 			const body = await safeJson(res);
 			if (body === null) return {
@@ -2281,7 +2117,7 @@ var BetterAuthNodeAdapter = class {
 	async signOut(options) {
 		if (options?.signal?.aborted) return {
 			ok: false,
-			error: Errors.cancelled({ operation: "signOut" })
+			error: Errors$1.cancelled({ operation: "signOut" })
 		};
 		try {
 			const signOutOrigin = originFromBaseUrl(this.authBaseUrl) ?? this.origin;
@@ -2295,7 +2131,7 @@ var BetterAuthNodeAdapter = class {
 			}, options?.signal));
 			if (options?.signal?.aborted) return {
 				ok: false,
-				error: Errors.cancelled({ operation: "signOut" })
+				error: Errors$1.cancelled({ operation: "signOut" })
 			};
 			setCookiesFromResponse(this.cookieJar, this.host, res);
 			if (res.ok) return {
@@ -2304,7 +2140,7 @@ var BetterAuthNodeAdapter = class {
 			};
 			return {
 				ok: false,
-				error: Errors.providerError("better-auth", "signOut", /* @__PURE__ */ new Error(`HTTP ${res.status}`))
+				error: Errors$1.providerError("better-auth", "signOut", /* @__PURE__ */ new Error(`HTTP ${res.status}`))
 			};
 		} catch (err) {
 			return {
@@ -2316,7 +2152,7 @@ var BetterAuthNodeAdapter = class {
 	async getConvexJwt(options) {
 		if (options?.signal?.aborted) return {
 			ok: false,
-			error: Errors.cancelled({ operation: "getConvexJwt" })
+			error: Errors$1.cancelled({ operation: "getConvexJwt" })
 		};
 		try {
 			const res = await this.fetchImpl(this.url("/api/auth/convex/token"), withSignal({
@@ -2325,15 +2161,15 @@ var BetterAuthNodeAdapter = class {
 			}, options?.signal));
 			if (options?.signal?.aborted) return {
 				ok: false,
-				error: Errors.cancelled({ operation: "getConvexJwt" })
+				error: Errors$1.cancelled({ operation: "getConvexJwt" })
 			};
 			if (res.status === 401) return {
 				ok: false,
-				error: Errors.notAuthenticated()
+				error: Errors$1.notAuthenticated()
 			};
 			if (!res.ok) return {
 				ok: false,
-				error: Errors.providerError("better-auth", "getConvexJwt", /* @__PURE__ */ new Error(`HTTP ${res.status}`))
+				error: Errors$1.providerError("better-auth", "getConvexJwt", /* @__PURE__ */ new Error(`HTTP ${res.status}`))
 			};
 			const body = await safeJson(res);
 			if (typeof body === "object" && body !== null) {
@@ -2348,7 +2184,7 @@ var BetterAuthNodeAdapter = class {
 			}
 			return {
 				ok: false,
-				error: Errors.providerError("better-auth", "getConvexJwt", /* @__PURE__ */ new Error("unexpected body"))
+				error: Errors$1.providerError("better-auth", "getConvexJwt", /* @__PURE__ */ new Error("unexpected body"))
 			};
 		} catch (err) {
 			return {
@@ -2362,377 +2198,6 @@ function BetterAuthNodeLayer(deps) {
 	return Layer.succeed(AuthClientPortTag, authClientPortFromPromiseAdapter(new BetterAuthNodeAdapter(deps)));
 }
 //#endregion
-//#region ../wire/src/brands.ts
-/**
-* `AppId` schema. Mirrors `toAppId` from `@capxul/types`:
-* `app_` + Crockford-base32 ULID (26 chars, first char in `[0-7]`).
-*/
-const AppIdSchema$1 = Schema.String.pipe(Schema.filter((s) => APP_ID_RE.test(s), { message: () => "must be app_ plus a ULID" }));
-/**
-* `ChainId` schema. Mirrors `toChainId`: positive safe integer.
-*/
-const ChainIdSchema$1 = Schema.Number.pipe(Schema.filter((n) => Number.isSafeInteger(n) && n > 0, { message: () => "must be a positive safe integer" }));
-/**
-* `CurrencyCode` schema. Mirrors `toCurrencyCode`: currently supported
-* consumer-facing ISO-ish currency code set.
-*/
-const CurrencyCodeSchema$1 = Schema.String.pipe(Schema.filter((s) => SUPPORTED_CURRENCY_CODES.includes(s), { message: () => "must be a supported currency code" }));
-const DOCUMENT_HASH_HEX_RE = /^[0-9a-fA-F]{64}$/;
-/**
-* `DocumentHash` schema. Mirrors `toDocumentHash`: bare or 0x-prefixed bytes32,
-* normalized to lowercase 0x-prefixed form.
-*/
-const DocumentHashSchema$1 = Schema.String.pipe(Schema.transform(Schema.String, {
-	decode: (s) => {
-		const stripped = s.startsWith("0x") || s.startsWith("0X") ? s.slice(2) : s;
-		return DOCUMENT_HASH_HEX_RE.test(stripped) ? `0x${stripped.toLowerCase()}` : s;
-	},
-	encode: (s) => s
-}), Schema.filter((s) => BYTES32_RE.test(s), { message: () => "must be 32 bytes of hex" }));
-/**
-* `SessionToken` schema. Mirrors `toSessionToken`: non-empty string.
-* Issuance source distinguishes SDK-handshake tokens from auth-session
-* tokens; the brand itself is opaque.
-*/
-const SessionTokenSchema = Schema.String.pipe(Schema.filter((s) => s.length > 0, { message: () => "must be a non-empty string" }));
-/**
-* `EpochMs` schema. Mirrors `toEpochMs`: non-negative safe integer.
-*/
-const EpochMsSchema$1 = Schema.Number.pipe(Schema.filter((n) => Number.isSafeInteger(n) && n >= 0, { message: () => "must be a non-negative safe integer" }));
-/**
-* `DurationMs` schema. Mirrors `toDurationMs`: non-negative safe integer.
-*/
-const DurationMsSchema$1 = Schema.Number.pipe(Schema.filter((n) => Number.isSafeInteger(n) && n >= 0, { message: () => "must be a non-negative safe integer" }));
-//#endregion
-//#region ../wire/src/bootstrap.ts
-/**
-* `BootstrapEnvelope` v1.
-*
-* - `protocol`: discriminator that lets future protocols coexist on the
-*   same endpoint without a wire-shape conflict.
-* - `version`: numeric version inside the protocol. Unknown versions MUST
-*   fail decode with an INVALID_INPUT-class `CapxulError` at the SDK seam.
-* - `state`: the resolved bootstrap payload. Field shape matches the
-*   `BootstrapResolution` port; the SDK consumer can pass `state`
-*   directly (after `normalizeRuntimeUrl` on the two URL fields) into
-*   the port without re-branding.
-*/
-const BootstrapEnvelope = Schema.Struct({
-	protocol: Schema.Literal("capxul.bootstrap"),
-	version: Schema.Literal(1),
-	state: Schema.Struct({
-		applicationId: AppIdSchema$1,
-		chainId: ChainIdSchema$1,
-		sessionToken: SessionTokenSchema,
-		issuedAt: EpochMsSchema$1,
-		expiresIn: DurationMsSchema$1,
-		authBaseUrl: Schema.String,
-		convexUrl: Schema.String,
-		siteBaseUrl: Schema.String,
-		openfortPublishableKey: Schema.String,
-		shieldPublishableKey: Schema.String
-	})
-});
-//#endregion
-//#region ../wire/src/financial-ops.ts
-const MINOR_UNIT_STRING_RE = /^[0-9]+$/;
-const DECIMAL_STRING_RE = /^[0-9]+(?:\.[0-9]+)?$/;
-const EVM_ADDRESS_RE = /^0x[a-fA-F0-9]{40}$/;
-/**
-* The canonical on-chain domain anchor for the v1 payment-document EIP-712
-* `domain` (payment-document-spec.md v1). The `PaymentDocumentDomain` schema
-* validates against this exact literal, and the backend's receipt builder mints
-* envelopes carrying it — so it MUST stay byte-identical across both. Exported
-* once here to remove the drift risk of a mirrored declaration.
-*/
-const PAYMENT_DOCUMENT_VERIFYING_CONTRACT = "0xe740ea65521edc9bef0ea75d30b5334711db99f4";
-const PAYMENT_ID_RE = /^payment_[0-9A-Za-z]+$/;
-const PAYEE_ID_RE = /^payee_[0-9A-Za-z]+$/;
-const ORG_ID_RE = /^org_[0-9A-Za-z]+$/;
-const USER_ID_RE = /^user_[0-9A-Za-z]+$/;
-const HANDLE_RE = /^@?[a-z0-9][a-z0-9-]{2,31}$/;
-const ORG_HANDLE_RE = /^[a-z0-9][a-z0-9-]{2,31}$/;
-const EMAIL_RE = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
-const MinorUnitStringSchema = Schema.String.pipe(Schema.filter((value) => MINOR_UNIT_STRING_RE.test(value), { message: () => "must be a non-negative integer minor-unit string" }));
-const PaymentIdSchema = Schema.String.pipe(Schema.filter((value) => PAYMENT_ID_RE.test(value), { message: () => "must be payment_ plus an alphanumeric id" }));
-const PayeeIdSchema = Schema.String.pipe(Schema.filter((value) => PAYEE_ID_RE.test(value), { message: () => "must be payee_ plus an alphanumeric id" }));
-const OrgIdSchema = Schema.String.pipe(Schema.filter((value) => ORG_ID_RE.test(value), { message: () => "must be org_ plus an alphanumeric id" }));
-const UserIdSchema = Schema.String.pipe(Schema.filter((value) => USER_ID_RE.test(value), { message: () => "must be user_ plus an alphanumeric id" }));
-const DecimalStringSchema = Schema.String.pipe(Schema.filter((value) => DECIMAL_STRING_RE.test(value), { message: () => "must be a non-negative decimal string" }));
-const HandleValueSchema = Schema.String.pipe(Schema.filter((value) => !EVM_ADDRESS_RE.test(value) && HANDLE_RE.test(value), { message: () => "must be a handle; raw addresses are not accepted" }));
-const OrgHandleValueSchema = Schema.String.pipe(Schema.filter((value) => !EVM_ADDRESS_RE.test(value) && ORG_HANDLE_RE.test(value), { message: () => "must be an org handle; raw addresses are not accepted" }));
-const EmailValueSchema = Schema.String.pipe(Schema.filter((value) => !EVM_ADDRESS_RE.test(value) && EMAIL_RE.test(value), { message: () => "must be an email; raw addresses are not accepted" }));
-const Uint8Schema = Schema.Number.pipe(Schema.filter((value) => Number.isSafeInteger(value) && value >= 0 && value <= 255, { message: () => "must be a uint8" }));
-const Uint64Schema = Schema.Number.pipe(Schema.filter((value) => Number.isSafeInteger(value) && value >= 0, { message: () => "must be a non-negative safe integer" }));
-const PaymentDocumentDomain = Schema.Struct({
-	name: Schema.Literal("CapxulPayments"),
-	version: Schema.Literal("1"),
-	chainId: ChainIdSchema$1,
-	verifyingContract: Schema.Literal(PAYMENT_DOCUMENT_VERIFYING_CONTRACT)
-});
-const MemoDocument = Schema.Struct({
-	kind: Schema.Literal(0),
-	reference: Schema.String,
-	note: Schema.String,
-	issuedAt: Uint64Schema
-});
-const InvoiceDocument = Schema.Struct({
-	kind: Schema.Literal(1),
-	invoiceNumber: Schema.String,
-	payerRef: Schema.String,
-	payeeRef: Schema.String,
-	amount: MinorUnitStringSchema,
-	currency: CurrencyCodeSchema$1,
-	decimals: Uint8Schema,
-	issuedAt: Uint64Schema,
-	dueAt: Uint64Schema,
-	lineItemsHash: DocumentHashSchema$1
-});
-const PayslipDocument = Schema.Struct({
-	kind: Schema.Literal(2),
-	employerRef: Schema.String,
-	employeeRef: Schema.String,
-	period: Schema.String,
-	gross: MinorUnitStringSchema,
-	net: MinorUnitStringSchema,
-	currency: CurrencyCodeSchema$1,
-	decimals: Uint8Schema,
-	issuedAt: Uint64Schema
-});
-const ReceiptDocument = Schema.Struct({
-	kind: Schema.Literal(3),
-	reference: Schema.String,
-	amount: MinorUnitStringSchema,
-	currency: CurrencyCodeSchema$1,
-	decimals: Uint8Schema,
-	paidAt: Uint64Schema,
-	note: Schema.String
-});
-const WithdrawalDestAddressSchema = Schema.String.pipe(Schema.filter((value) => EVM_ADDRESS_RE.test(value), { message: () => "must be a 0x EVM address" }));
-const WithdrawalDocument = Schema.Struct({
-	kind: Schema.Literal(4),
-	reference: Schema.String,
-	amount: MinorUnitStringSchema,
-	currency: CurrencyCodeSchema$1,
-	decimals: Uint8Schema,
-	destChain: ChainIdSchema$1,
-	destAddress: WithdrawalDestAddressSchema,
-	settledAt: Uint64Schema,
-	provider: Schema.String,
-	note: Schema.String
-});
-const FinancialOpsMoney = Schema.Struct({
-	currency: CurrencyCodeSchema$1,
-	value: DecimalStringSchema,
-	decimals: Schema.Number.pipe(Schema.filter((value) => Number.isSafeInteger(value) && value >= 0, { message: () => "must be a non-negative safe integer" }))
-});
-const PaymentDocument = Schema.Struct({
-	documentHash: DocumentHashSchema$1,
-	kind: Schema.Literal("invoice", "receipt", "payslip", "memo", "withdrawal"),
-	title: Schema.optional(Schema.String),
-	uri: Schema.optional(Schema.String),
-	issuedAt: Schema.optional(EpochMsSchema$1)
-});
-const PaymentType = Schema.Literal("unspecified", "invoice", "payroll", "reimbursement");
-function paymentTypeForDocumentKind(kind) {
-	switch (kind) {
-		case "memo": return "unspecified";
-		case "invoice": return "invoice";
-		case "payslip": return "payroll";
-		case "receipt": return "reimbursement";
-		case "withdrawal": return "unspecified";
-	}
-}
-const AttachablePaymentDocumentEnvelope = Schema.Union(Schema.Struct({
-	protocol: Schema.Literal("capxul.payment-document"),
-	version: Schema.Literal(1),
-	domain: PaymentDocumentDomain,
-	primaryType: Schema.Literal("Memo"),
-	message: MemoDocument
-}), Schema.Struct({
-	protocol: Schema.Literal("capxul.payment-document"),
-	version: Schema.Literal(1),
-	domain: PaymentDocumentDomain,
-	primaryType: Schema.Literal("Invoice"),
-	message: InvoiceDocument
-}), Schema.Struct({
-	protocol: Schema.Literal("capxul.payment-document"),
-	version: Schema.Literal(1),
-	domain: PaymentDocumentDomain,
-	primaryType: Schema.Literal("Payslip"),
-	message: PayslipDocument
-}), Schema.Struct({
-	protocol: Schema.Literal("capxul.payment-document"),
-	version: Schema.Literal(1),
-	domain: PaymentDocumentDomain,
-	primaryType: Schema.Literal("Receipt"),
-	message: ReceiptDocument
-}));
-const WithdrawalDocumentEnvelope = Schema.Struct({
-	protocol: Schema.Literal("capxul.payment-document"),
-	version: Schema.Literal(1),
-	domain: PaymentDocumentDomain,
-	primaryType: Schema.Literal("Withdrawal"),
-	message: WithdrawalDocument
-});
-Schema.Union(AttachablePaymentDocumentEnvelope, WithdrawalDocumentEnvelope);
-Schema.Struct({
-	payeeId: PayeeIdSchema,
-	label: Schema.String,
-	trustState: Schema.Literal("unverified", "trusted", "blocked"),
-	destinationKind: Schema.Literal("handle", "email", "saved-payee", "org")
-});
-const PaymentRecipient = Schema.Struct({
-	kind: Schema.Literal("handle", "email", "payee", "capxulUserId", "me", "org", "external_address"),
-	label: Schema.String,
-	payeeId: Schema.optional(PayeeIdSchema)
-});
-/**
-* A raw external EVM address for the B3 withdraw lane — the cash-out
-* destination. This is the ONE schema that ACCEPTS a bare 0x (the withdraw
-* mutation args use it), as opposed to `PaymentRecipientRefSchema` which
-* REJECTS bare addresses to protect the pay lane. The full address never
-* crosses the model wire; it lives on the kind:4 Withdrawal document only.
-*/
-const ExternalAddressSchema = Schema.String.pipe(Schema.filter((value) => EVM_ADDRESS_RE.test(value), { message: () => "must be a 0x EVM address (40 hex chars)" }));
-const PaymentTiming = Schema.Union(Schema.Struct({ kind: Schema.Literal("instant") }), Schema.Struct({
-	kind: Schema.Literal("scheduled"),
-	at: EpochMsSchema$1
-}), Schema.Struct({
-	kind: Schema.Literal("stream"),
-	startsAt: EpochMsSchema$1,
-	endsAt: EpochMsSchema$1,
-	cliffAt: Schema.optional(EpochMsSchema$1)
-}));
-const PaymentRef = Schema.Union(Schema.Struct({
-	kind: Schema.Literal("handle"),
-	handle: HandleValueSchema
-}), Schema.Struct({
-	kind: Schema.Literal("email"),
-	email: EmailValueSchema
-}), Schema.Struct({
-	kind: Schema.Literal("orgHandle"),
-	orgHandle: OrgHandleValueSchema
-}), Schema.Struct({
-	kind: Schema.Literal("capxulUserId"),
-	capxulUserId: UserIdSchema
-}), Schema.Struct({
-	kind: Schema.Literal("payeeId"),
-	payeeId: PayeeIdSchema
-}));
-const Payment = Schema.Struct({
-	id: PaymentIdSchema,
-	status: Schema.Literal("pending", "submitted", "pending_claim", "scheduled", "streaming", "settled", "cancelled", "redirected", "expired", "failed"),
-	amount: FinancialOpsMoney,
-	paymentType: PaymentType,
-	recipient: PaymentRecipient,
-	documents: Schema.Array(PaymentDocument),
-	timing: PaymentTiming,
-	released: FinancialOpsMoney,
-	availableToClaim: FinancialOpsMoney,
-	createdAt: EpochMsSchema$1,
-	updatedAt: EpochMsSchema$1
-}).pipe(Schema.filter((payment) => payment.documents.every((document) => paymentTypeForDocumentKind(document.kind) === payment.paymentType), { message: () => "document kind must map to paymentType" }));
-const PaymentSource = Schema.Union(Schema.Struct({
-	kind: Schema.Literal("me"),
-	orgId: Schema.optional(Schema.Undefined)
-}), Schema.Struct({
-	kind: Schema.Literal("org"),
-	orgId: OrgIdSchema
-}));
-/**
-* #592 invoice line item. `quantity` is a positive integer; `unitMinor` is the
-* per-unit price in integer minor units. The list is canonically hashed by
-* `hashLineItems` (payment-document-hash.ts) into the Invoice `lineItemsHash`,
-* and Σ(quantity × unitMinor) MUST equal the invoice `amount`. The hash binds
-* the documentHash to the exact items; the sum-check makes the items add up to
-* the amount due. See the payment-document spec (canon/mcp/financial-ops.md).
-*/
-const LineItem = Schema.Struct({
-	description: Schema.String,
-	quantity: Schema.Number.pipe(Schema.filter((value) => Number.isSafeInteger(value) && value > 0, { message: () => "quantity must be a positive integer" })),
-	unitMinor: MinorUnitStringSchema
-});
-Schema.Struct({
-	from: Schema.optional(PaymentSource),
-	to: PaymentRef,
-	amount: FinancialOpsMoney,
-	timing: Schema.optional(PaymentTiming),
-	document: Schema.optional(AttachablePaymentDocumentEnvelope),
-	lineItems: Schema.optional(Schema.Array(LineItem))
-});
-Schema.Struct({
-	to: ExternalAddressSchema,
-	amount: FinancialOpsMoney,
-	document: WithdrawalDocumentEnvelope
-});
-Schema.Struct({
-	protocol: Schema.Literal("capxul.me"),
-	version: Schema.Literal(1),
-	me: Schema.Struct({
-		displayName: Schema.NullOr(Schema.String),
-		handle: Schema.NullOr(Schema.String),
-		defaultCurrency: CurrencyCodeSchema$1,
-		depositInstructions: Schema.Array(Schema.Struct({
-			network: Schema.String,
-			asset: CurrencyCodeSchema$1,
-			depositTarget: Schema.String,
-			memo: Schema.optional(Schema.String)
-		}))
-	})
-});
-Schema.Struct({
-	protocol: Schema.Literal("capxul.payments"),
-	version: Schema.Literal(1),
-	payments: Schema.Array(Payment)
-});
-`
-.capxul-doc{--ink:#1d1d1f;--muted:#6e6e73;--line:#e7e7ea;--accent:#0a7d4b;--bg:#fff;
-  font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Inter,system-ui,sans-serif;
-  color:var(--ink);background:var(--bg);max-width:44rem;margin:0 auto;padding:2.75rem 3rem;
-  border:1px solid var(--line);border-radius:16px;box-shadow:0 1px 2px rgba(0,0,0,.04),0 12px 32px rgba(0,0,0,.06);
-  line-height:1.5;font-size:15px;overflow-wrap:anywhere;word-break:break-word}
-.capxul-doc *{box-sizing:border-box;min-width:0}
-.capxul-doc .doc-header{display:flex;flex-direction:column;gap:1.25rem;padding-bottom:1.5rem;border-bottom:1px solid var(--line);margin-bottom:1.75rem}
-.capxul-doc .doc-brand{display:flex;align-items:center;gap:.5rem;color:var(--accent);font-weight:600}
-.capxul-doc .doc-brand-mark{font-size:1.1rem}
-.capxul-doc .doc-brand-name{letter-spacing:.02em}
-.capxul-doc .doc-headline{display:flex;align-items:baseline;justify-content:space-between;gap:1rem;flex-wrap:wrap}
-.capxul-doc .doc-title{font-size:1.9rem;font-weight:700;letter-spacing:-.02em;margin:0}
-.capxul-doc .doc-badge{font-size:.7rem;font-weight:700;text-transform:uppercase;letter-spacing:.08em;
-  color:var(--accent);background:rgba(10,125,75,.1);padding:.3rem .6rem;border-radius:999px;max-width:100%;text-align:right}
-.capxul-doc .doc-parties{display:grid;grid-template-columns:1fr 1fr;gap:1.25rem;margin-bottom:1.75rem}
-.capxul-doc .doc-party{display:flex;flex-direction:column;gap:.15rem}
-.capxul-doc .doc-party-label{font-size:.72rem;text-transform:uppercase;letter-spacing:.06em;color:var(--muted)}
-.capxul-doc .doc-party-name{font-weight:600}
-.capxul-doc .doc-meta{display:flex;flex-direction:column;gap:.4rem;margin-bottom:1.75rem}
-.capxul-doc .doc-meta-row{display:flex;justify-content:space-between;gap:1rem;font-size:.92rem}
-.capxul-doc .doc-meta-label{color:var(--muted);flex-shrink:0}
-.capxul-doc .doc-meta-value{font-weight:500;text-align:right}
-.capxul-doc time{color:var(--ink);font-variant-numeric:tabular-nums}
-.capxul-doc .doc-line-items{width:100%;border-collapse:collapse;margin:.5rem 0 1.5rem;font-size:.92rem}
-.capxul-doc .doc-line-items th{text-align:left;font-size:.7rem;text-transform:uppercase;letter-spacing:.05em;
-  color:var(--muted);font-weight:600;padding:.5rem .25rem;border-bottom:1px solid var(--line)}
-.capxul-doc .doc-line-items td{padding:.7rem .25rem;border-bottom:1px solid var(--line)}
-.capxul-doc .doc-li-qty,.capxul-doc .doc-li-unit,.capxul-doc .doc-li-total{text-align:right;font-variant-numeric:tabular-nums;white-space:nowrap}
-.capxul-doc .doc-li-desc{width:100%}
-.capxul-doc .doc-totals{display:flex;flex-direction:column;gap:.5rem;margin-top:.5rem}
-.capxul-doc .doc-total-line{display:flex;justify-content:space-between;align-items:baseline;gap:1rem}
-.capxul-doc .doc-total-label{color:var(--muted)}
-.capxul-doc .doc-total-deduction .doc-amount-value{color:var(--muted)}
-.capxul-doc .doc-total-grand{border-top:2px solid var(--ink);margin-top:.5rem;padding-top:.75rem;font-size:1.15rem}
-.capxul-doc .doc-total-grand .doc-amount-value{font-weight:700}
-.capxul-doc .doc-amount-value{font-variant-numeric:tabular-nums;font-weight:600}
-.capxul-doc .doc-hero{text-align:center;padding:1.5rem 0 2rem}
-.capxul-doc .doc-hero-label{font-size:.72rem;text-transform:uppercase;letter-spacing:.06em;color:var(--muted)}
-.capxul-doc .doc-hero-amount{font-size:2.6rem;font-weight:700;letter-spacing:-.02em;margin-top:.35rem}
-.capxul-doc .doc-note{color:var(--ink);background:#f7f7f8;border-radius:10px;padding:.9rem 1.1rem;margin:0}
-.capxul-doc .doc-dest-address{font-family:ui-monospace,SFMono-Regular,Menlo,monospace;font-size:.9rem}
-.capxul-doc .doc-footer{margin-top:1.75rem;padding-top:1.25rem;border-top:1px solid var(--line);color:var(--muted);font-size:.9rem}
-.capxul-doc code{font-family:ui-monospace,SFMono-Regular,Menlo,monospace;font-size:.82rem;color:var(--muted);word-break:break-all}
-@media (max-width:540px){.capxul-doc{padding:1.75rem 1.25rem}.capxul-doc .doc-parties{grid-template-columns:1fr}}
-`.trim();
-//#endregion
 //#region src/ports/bootstrap.ts
 var BootstrapError = class extends Data.TaggedError("BootstrapError") {};
 function bootstrapErrorFromCapxul(kind, error) {
@@ -2774,7 +2239,7 @@ var HttpBootstrapAdapter = class {
 					body: JSON.stringify({ publishableKey: input.publishableKey })
 				});
 			},
-			catch: (cause) => bootstrapErrorFromCapxul("network", Errors.networkError("bootstrap", cause))
+			catch: (cause) => bootstrapErrorFromCapxul("network", Errors$1.networkError("bootstrap", cause))
 		}).pipe(Effect.flatMap((res) => this.mapResponse(res)));
 	}
 	mapResponse(res) {
@@ -2782,7 +2247,7 @@ var HttpBootstrapAdapter = class {
 			try: async () => {
 				const body = await res.json();
 				const decoded = Schema.decodeUnknownEither(BootstrapEnvelope)(body);
-				if (Either.isLeft(decoded)) throw Errors.invalidInput("bootstrapEnvelope", decoded.left.message);
+				if (Either.isLeft(decoded)) throw Errors$1.invalidInput("bootstrapEnvelope", decoded.left.message);
 				const { state } = decoded.right;
 				return {
 					applicationId: state.applicationId,
@@ -2798,14 +2263,14 @@ var HttpBootstrapAdapter = class {
 				};
 			},
 			catch: (cause) => {
-				if (cause instanceof CapxulError && cause.code === "INVALID_INPUT") return bootstrapErrorFromCapxul("invalidInput", cause);
-				return bootstrapErrorFromCapxul("malformedBody", Errors.providerError("convex", "bootstrap", cause instanceof Error ? cause : new Error(String(cause))));
+				if (cause instanceof CapxulError$2 && cause.code === "INVALID_INPUT") return bootstrapErrorFromCapxul("invalidInput", cause);
+				return bootstrapErrorFromCapxul("malformedBody", Errors$1.providerError("convex", "bootstrap", cause instanceof Error ? cause : new Error(String(cause))));
 			}
 		});
 		return Effect.promise(() => safeText(res)).pipe(Effect.flatMap((body) => {
-			if (res.status === 401 || body.startsWith("NOT_AUTHENTICATED")) return Effect.fail(bootstrapErrorFromCapxul("notAuthenticated", Errors.notAuthenticated()));
-			if (res.status === 400 || body.startsWith("INVALID_INPUT")) return Effect.fail(bootstrapErrorFromCapxul("invalidInput", Errors.invalidInput("publishableKey", "rejected by bootstrap")));
-			return Effect.fail(bootstrapErrorFromCapxul("provider", Errors.providerError("convex", "bootstrap", /* @__PURE__ */ new Error(`HTTP ${res.status}`))));
+			if (res.status === 401 || body.startsWith("NOT_AUTHENTICATED")) return Effect.fail(bootstrapErrorFromCapxul("notAuthenticated", Errors$1.notAuthenticated()));
+			if (res.status === 400 || body.startsWith("INVALID_INPUT")) return Effect.fail(bootstrapErrorFromCapxul("invalidInput", Errors$1.invalidInput("publishableKey", "rejected by bootstrap")));
+			return Effect.fail(bootstrapErrorFromCapxul("provider", Errors$1.providerError("convex", "bootstrap", /* @__PURE__ */ new Error(`HTTP ${res.status}`))));
 		}));
 	}
 };
@@ -2817,9 +2282,9 @@ function normalizeRuntimeUrl(field, raw) {
 	try {
 		parsed = new URL(raw);
 	} catch {
-		throw Errors.invalidInput(field, "must be an http or https URL");
+		throw Errors$1.invalidInput(field, "must be an http or https URL");
 	}
-	if (parsed.protocol !== "http:" && parsed.protocol !== "https:") throw Errors.invalidInput(field, "must be an http or https URL");
+	if (parsed.protocol !== "http:" && parsed.protocol !== "https:") throw Errors$1.invalidInput(field, "must be an http or https URL");
 	return parsed.toString().replace(/\/$/, "");
 }
 //#endregion
@@ -2923,12 +2388,12 @@ function ConvexCallLayer(deps) {
 function mapToCapxulError(operation, err) {
 	const decoded = decodeConvexError(err);
 	if (decoded !== null) return decoded;
-	if (err instanceof CapxulError) return err;
+	if (err instanceof CapxulError$2) return err;
 	if (err instanceof Error) {
-		if (isTransportError(err)) return Errors.networkError(operation, err);
-		return Errors.providerError("convex", operation, err);
+		if (isTransportError(err)) return Errors$1.networkError(operation, err);
+		return Errors$1.providerError("convex", operation, err);
 	}
-	return Errors.providerError("convex", operation, new Error(String(err)));
+	return Errors$1.providerError("convex", operation, new Error(String(err)));
 }
 function mapToConvexCallError(operation, err) {
 	return convexCallErrorFromCapxul(operation, mapToCapxulError(operation, err));
@@ -3065,8 +2530,8 @@ function brandPublishableKeyRecord(row) {
 	};
 }
 function credentialsErrorFromUnknown(operation, cause) {
-	if (cause instanceof CapxulError) return credentialsErrorFromCapxul(operation, cause);
-	return credentialsErrorFromCapxul(operation, Errors.providerError("credentials", operation, cause instanceof Error ? cause : new Error(String(cause))), cause);
+	if (cause instanceof CapxulError$2) return credentialsErrorFromCapxul(operation, cause);
+	return credentialsErrorFromCapxul(operation, Errors$1.providerError("credentials", operation, cause instanceof Error ? cause : new Error(String(cause))), cause);
 }
 //#endregion
 //#region src/ports/env.ts
@@ -3382,7 +2847,7 @@ function schemaFor(kind) {
 		}, { message: () => "Invalid url" }));
 		default: {
 			const unsupported = kind;
-			throw Errors.invalidInput(String(unsupported), "unsupported environment field kind");
+			throw Errors$1.invalidInput(String(unsupported), "unsupported environment field kind");
 		}
 	}
 }
@@ -3391,14 +2856,14 @@ const envShapeSchema = Schema.Struct(envShapeFields);
 Schema.partial(envShapeSchema);
 function parseEnvValue$1(key, raw, required) {
 	const field = envFields[key];
-	if (field === void 0) throw Errors.invalidInput(key, "unknown environment key");
+	if (field === void 0) throw Errors$1.invalidInput(key, "unknown environment key");
 	const normalized = normalizeEnvRaw(raw);
 	if (normalized === void 0) {
-		if (required) throw Errors.envMissing(key);
+		if (required) throw Errors$1.envMissing(key);
 		return;
 	}
 	const result = Schema.decodeUnknownEither(schemaFor(field.kind))(normalized);
-	if (Either.isLeft(result)) throw Errors.invalidInput(key, TreeFormatter.formatErrorSync(result.left));
+	if (Either.isLeft(result)) throw Errors$1.invalidInput(key, TreeFormatter.formatErrorSync(result.left));
 	return result.right;
 }
 function normalizeEnvRaw(raw) {
@@ -3414,14 +2879,14 @@ function parseEnvValue(key, raw, required) {
 	return parseEnvValue$1(key, raw, required);
 }
 function hasEnvValue(key, raw) {
-	if (envFields[key] === void 0) throw envErrorFromCapxul(key, Errors.invalidInput(key, "unknown environment key"));
+	if (envFields[key] === void 0) throw envErrorFromCapxul(key, Errors$1.invalidInput(key, "unknown environment key"));
 	return normalizeEnvRaw(raw) !== void 0;
 }
 function catchEnvError(key, cause) {
 	if (cause instanceof EnvError) return cause;
-	if (isCapxulError(cause)) return envErrorFromCapxul(key, cause, cause);
+	if (isCapxulError$2(cause)) return envErrorFromCapxul(key, cause, cause);
 	const redactedCause = /* @__PURE__ */ new Error(`env ${key} read failed`);
-	return envErrorFromCapxul(key, Errors.providerError("env", key, redactedCause), redactedCause);
+	return envErrorFromCapxul(key, Errors$1.providerError("env", key, redactedCause), redactedCause);
 }
 //#endregion
 //#region src/adapters/env/SystemEnvAdapter.ts
@@ -3510,8 +2975,8 @@ function brandProfile(raw) {
 	};
 }
 function identityErrorFromUnknown(operation, cause) {
-	if (cause instanceof CapxulError) return identityErrorFromCapxul(operation, cause);
-	return identityErrorFromCapxul(operation, Errors.providerError("convex", operation, cause), cause);
+	if (cause instanceof CapxulError$2) return identityErrorFromCapxul(operation, cause);
+	return identityErrorFromCapxul(operation, Errors$1.providerError("convex", operation, cause), cause);
 }
 //#endregion
 //#region src/money/to-wei.ts
@@ -3600,8 +3065,8 @@ function brandAccount(wire) {
 	};
 }
 function accountReadErrorFromUnknown(operation, cause) {
-	if (cause instanceof CapxulError) return accountReadErrorFromCapxul(operation, cause);
-	return accountReadErrorFromCapxul(operation, Errors.providerError("convex", operation, cause), cause);
+	if (cause instanceof CapxulError$2) return accountReadErrorFromCapxul(operation, cause);
+	return accountReadErrorFromCapxul(operation, Errors$1.providerError("convex", operation, cause), cause);
 }
 //#endregion
 //#region src/ports/sub-account.ts
@@ -3699,8 +3164,8 @@ function brandSubAccount(wire) {
 	};
 }
 function subAccountErrorFromUnknown(operation, cause) {
-	if (cause instanceof CapxulError) return subAccountErrorFromCapxul(operation, cause);
-	return subAccountErrorFromCapxul(operation, Errors.providerError("convex", operation, cause), cause);
+	if (cause instanceof CapxulError$2) return subAccountErrorFromCapxul(operation, cause);
+	return subAccountErrorFromCapxul(operation, Errors$1.providerError("convex", operation, cause), cause);
 }
 //#endregion
 //#region src/ports/smart-account.ts
@@ -3794,705 +3259,16 @@ function brandNonNullSmartAccount(wire) {
 	};
 }
 function brandProvisionedSmartAccount(requestedAuthUserId, wire) {
-	if (wire.authUserId !== String(requestedAuthUserId)) throw Errors.notAuthenticated();
+	if (wire.authUserId !== String(requestedAuthUserId)) throw Errors$1.notAuthenticated();
 	return brandNonNullSmartAccount(wire);
 }
 function smartAccountErrorFromUnknown(operation, cause) {
-	if (cause instanceof CapxulError) return smartAccountErrorFromCapxul(operation, cause);
-	return smartAccountErrorFromCapxul(operation, Errors.providerError("convex", operation, cause), cause);
+	if (cause instanceof CapxulError$2) return smartAccountErrorFromCapxul(operation, cause);
+	return smartAccountErrorFromCapxul(operation, Errors$1.providerError("convex", operation, cause), cause);
 }
 toAddress("0xa6b71e26c5e0845f74c812102ca7114b6a896ab2");
 keccak256("0x");
 //#endregion
-//#region ../observability/src/index.ts
-const PII = Schema.String.pipe(Schema.brand("PII"));
-const OptionalString = Schema.optional(Schema.String);
-const AddressSchema = Schema.String.pipe(Schema.transform(Schema.String, {
-	decode: (value) => value.toLowerCase(),
-	encode: (value) => value
-}), Schema.filter((value) => EVM_ADDRESS_RE$1.test(value), { message: () => "must be 0x + 40 hex chars" }));
-const AppIdSchema = Schema.String.pipe(Schema.filter((value) => APP_ID_RE.test(value), { message: () => "must be app_ plus a ULID" }));
-const BlockNumberSchema = Schema.Number.pipe(Schema.filter((value) => Number.isSafeInteger(value) && value >= 0, { message: () => "must be a non-negative safe integer" }));
-const ChainIdSchema = Schema.Number.pipe(Schema.filter((value) => Number.isSafeInteger(value) && value > 0, { message: () => "must be a positive safe integer" }));
-const DurationMsSchema = Schema.Number.pipe(Schema.filter((value) => Number.isSafeInteger(value) && value >= 0, { message: () => "must be a non-negative safe integer" }));
-const EpochMsSchema = Schema.Number.pipe(Schema.filter((value) => Number.isSafeInteger(value) && value >= 0, { message: () => "must be a non-negative safe integer" }));
-const PublishableKeyIdSchema = Schema.String.pipe(Schema.filter((value) => value.length > 0, { message: () => "must be a non-empty string" }));
-const TxHashSchema = Schema.String.pipe(Schema.filter((value) => BYTES32_RE.test(value), { message: () => "must be 0x + 64 hex chars" }));
-const ACCOUNT_ID_TELEMETRY_RE = /^account_[0-9A-Za-z]+$/;
-const SUBACCOUNT_ID_TELEMETRY_RE = /^subaccount_[0-9A-Za-z]+$/;
-const WEI_AMOUNT_TELEMETRY_RE = /^[0-9]+$/;
-const AccountIdSchema = Schema.String.pipe(Schema.filter((value) => ACCOUNT_ID_TELEMETRY_RE.test(value), { message: () => "must be account_ plus an alphanumeric id" }));
-const SubAccountIdSchema = Schema.String.pipe(Schema.filter((value) => SUBACCOUNT_ID_TELEMETRY_RE.test(value), { message: () => "must be subaccount_ plus an alphanumeric id" }));
-const WeiAmountSchema = Schema.String.pipe(Schema.filter((value) => WEI_AMOUNT_TELEMETRY_RE.test(value), { message: () => "must be a non-negative integer string" }));
-const CurrencyCodeSchema = Schema.String.pipe(Schema.filter((value) => value.length > 0, { message: () => "must be a non-empty currency code" }));
-const BalanceBucketSchema = Schema.Literal("zero", "nonzero");
-const TransferDirectionSchema = Schema.Literal("add", "out", "between");
-const SubAccountOpSchema = Schema.Literal("create", "rename", "delete");
-const OptionalAccountId = Schema.optional(AccountIdSchema);
-const OptionalSubAccountId = Schema.optional(SubAccountIdSchema);
-const OptionalWeiAmount = Schema.optional(WeiAmountSchema);
-const OptionalCurrencyCode = Schema.optional(CurrencyCodeSchema);
-const OptionalBalanceBucket = Schema.optional(BalanceBucketSchema);
-const OptionalTransferDirection = Schema.optional(TransferDirectionSchema);
-const OptionalSubAccountOp = Schema.optional(SubAccountOpSchema);
-const OptionalTrue = Schema.optional(Schema.Literal(true));
-const OptionalAddress = Schema.optional(AddressSchema);
-const OptionalAppId = Schema.optional(AppIdSchema);
-const OptionalBlockNumber = Schema.optional(BlockNumberSchema);
-const OptionalChainId = Schema.optional(ChainIdSchema);
-const OptionalDurationMs = Schema.optional(DurationMsSchema);
-const OptionalEpochMs = Schema.optional(EpochMsSchema);
-const OptionalPublishableKeyId = Schema.optional(PublishableKeyIdSchema);
-const OptionalTxHash = Schema.optional(TxHashSchema);
-const PAYMENT_ID_TELEMETRY_RE = /^payment_[0-9A-Za-z]+$/;
-const PAYEE_ID_TELEMETRY_RE = /^payee_[0-9A-Za-z]+$/;
-const PaymentIdTelemetrySchema = Schema.String.pipe(Schema.filter((value) => PAYMENT_ID_TELEMETRY_RE.test(value), { message: () => "must be payment_ plus an alphanumeric id" }));
-const PayeeIdTelemetrySchema = Schema.String.pipe(Schema.filter((value) => PAYEE_ID_TELEMETRY_RE.test(value), { message: () => "must be payee_ plus an alphanumeric id" }));
-const DocumentHashSchema = Schema.String.pipe(Schema.filter((value) => BYTES32_RE.test(value), { message: () => "must be 0x + 64 hex chars" }));
-const TelemetryEnvelopeProps = {
-	capxul_e2e_run_id: OptionalString,
-	correlationId: OptionalString,
-	capxulEnv: OptionalString,
-	sdkVersion: OptionalString,
-	producer: OptionalString
-};
-const AuthOtpRequestedProps = Schema.Struct({
-	...TelemetryEnvelopeProps,
-	email: Schema.optional(PII),
-	email_domain: OptionalString
-});
-const AuthOtpDeliveredProps = Schema.Struct({
-	...TelemetryEnvelopeProps,
-	durationMs: OptionalDurationMs,
-	email: Schema.optional(PII),
-	email_domain: OptionalString,
-	resendMessageId: OptionalString
-});
-const AuthOtpExpiredProps = Schema.Struct({
-	...TelemetryEnvelopeProps,
-	email: Schema.optional(PII),
-	email_domain: OptionalString
-});
-const AuthVerifiedProps = Schema.Struct({
-	...TelemetryEnvelopeProps,
-	auth_type: OptionalString
-});
-const AuthFailedProps = Schema.Struct({
-	...TelemetryEnvelopeProps,
-	email: Schema.optional(PII),
-	auth_type: OptionalString,
-	reason: OptionalString
-});
-const AuthSignedOutProps = Schema.Struct(TelemetryEnvelopeProps);
-const ProvisioningSafeCreatedProps = Schema.Struct({
-	...TelemetryEnvelopeProps,
-	safe_address: OptionalAddress
-});
-const ProvisioningSafeConfirmedProps = Schema.Struct({
-	...TelemetryEnvelopeProps,
-	chainId: OptionalChainId,
-	deployedAt: OptionalEpochMs,
-	deployedAtBlock: OptionalBlockNumber,
-	deployTxHash: OptionalTxHash,
-	durationMs: OptionalDurationMs,
-	safe_address: OptionalAddress,
-	userOpHash: OptionalTxHash
-});
-const BootstrapResolvedProps = Schema.Struct({
-	...TelemetryEnvelopeProps,
-	applicationId: OptionalAppId,
-	durationMs: OptionalDurationMs,
-	env: OptionalString,
-	keyId: OptionalPublishableKeyId,
-	origin: OptionalString
-});
-const BootstrapFailedProps = Schema.Struct({
-	...TelemetryEnvelopeProps,
-	applicationId: OptionalAppId,
-	durationMs: OptionalDurationMs,
-	origin: OptionalString,
-	reason: OptionalString
-});
-const AccountBalanceReadProps = Schema.Struct({
-	...TelemetryEnvelopeProps,
-	account_id: OptionalAccountId,
-	currency: OptionalCurrencyCode,
-	balance_bucket: OptionalBalanceBucket,
-	durationMs: OptionalDurationMs
-});
-const AccountBalanceFailedProps = Schema.Struct({
-	...TelemetryEnvelopeProps,
-	reason: OptionalString
-});
-const FaucetRequestedProps = Schema.Struct({
-	...TelemetryEnvelopeProps,
-	amount: OptionalWeiAmount,
-	chainId: OptionalChainId
-});
-const FaucetConfirmedProps = Schema.Struct({
-	...TelemetryEnvelopeProps,
-	amount: OptionalWeiAmount,
-	chainId: OptionalChainId,
-	txHash: OptionalTxHash,
-	durationMs: OptionalDurationMs
-});
-const FaucetFailedProps = Schema.Struct({
-	...TelemetryEnvelopeProps,
-	reason: OptionalString
-});
-const SubaccountCreatedProps = Schema.Struct({
-	...TelemetryEnvelopeProps,
-	sub_account_id: OptionalSubAccountId,
-	durationMs: OptionalDurationMs
-});
-const SubaccountRenamedProps = Schema.Struct({
-	...TelemetryEnvelopeProps,
-	sub_account_id: OptionalSubAccountId
-});
-const SubaccountDeletedProps = Schema.Struct({
-	...TelemetryEnvelopeProps,
-	sub_account_id: OptionalSubAccountId
-});
-const SubaccountOpFailedProps = Schema.Struct({
-	...TelemetryEnvelopeProps,
-	op: OptionalSubAccountOp,
-	reason: OptionalString
-});
-const TransferRequestedProps = Schema.Struct({
-	...TelemetryEnvelopeProps,
-	amount: OptionalWeiAmount,
-	direction: OptionalTransferDirection
-});
-const TransferConfirmedProps = Schema.Struct({
-	...TelemetryEnvelopeProps,
-	amount: OptionalWeiAmount,
-	direction: OptionalTransferDirection,
-	available_bucket: OptionalBalanceBucket,
-	txless: OptionalTrue,
-	durationMs: OptionalDurationMs
-});
-const TransferFailedProps = Schema.Struct({
-	...TelemetryEnvelopeProps,
-	reason: OptionalString
-});
-const ORG_ID_TELEMETRY_RE = /^org_[0-9A-Za-z]+$/;
-const OrgIdTelemetrySchema = Schema.String.pipe(Schema.filter((value) => ORG_ID_TELEMETRY_RE.test(value), { message: () => "must be org_ plus an alphanumeric id" }));
-const OptionalOrgId = Schema.optional(OrgIdTelemetrySchema);
-const OrgCreateStartedProps = Schema.Struct({
-	...TelemetryEnvelopeProps,
-	org_id: OptionalOrgId,
-	email_domain: OptionalString,
-	template: OptionalString
-});
-const OrgSafeCreatedProps = Schema.Struct({
-	...TelemetryEnvelopeProps,
-	org_id: OptionalOrgId,
-	chainId: OptionalChainId,
-	safe_address: OptionalAddress
-});
-const OrgSafeConfirmedProps = Schema.Struct({
-	...TelemetryEnvelopeProps,
-	org_id: OptionalOrgId,
-	chainId: OptionalChainId,
-	safe_address: OptionalAddress,
-	durationMs: OptionalDurationMs
-});
-const OrgRolesSeededProps = Schema.Struct({
-	...TelemetryEnvelopeProps,
-	org_id: OptionalOrgId,
-	chainId: OptionalChainId,
-	role: OptionalString,
-	txHash: OptionalTxHash
-});
-const OrgCreatedProps = Schema.Struct({
-	...TelemetryEnvelopeProps,
-	org_id: OptionalOrgId,
-	chainId: OptionalChainId,
-	safe_address: OptionalAddress,
-	durationMs: OptionalDurationMs
-});
-const OrgCreateFailedProps = Schema.Struct({
-	...TelemetryEnvelopeProps,
-	org_id: OptionalOrgId,
-	reason: OptionalString
-});
-const OrgInviteSentProps = Schema.Struct({
-	...TelemetryEnvelopeProps,
-	org_id: OptionalOrgId,
-	email_domain: OptionalString,
-	role: OptionalString,
-	status: OptionalString
-});
-const OrgInviteAcceptedProps = Schema.Struct({
-	...TelemetryEnvelopeProps,
-	org_id: OptionalOrgId,
-	role: OptionalString,
-	status: OptionalString
-});
-const OrgRoleGrantedProps = Schema.Struct({
-	...TelemetryEnvelopeProps,
-	org_id: OptionalOrgId,
-	role: OptionalString,
-	status: OptionalString,
-	txHash: OptionalTxHash
-});
-const OrgMemberActiveProps = Schema.Struct({
-	...TelemetryEnvelopeProps,
-	org_id: OptionalOrgId,
-	role: OptionalString,
-	status: OptionalString,
-	durationMs: OptionalDurationMs
-});
-const OrgMemberRemovedProps = Schema.Struct({
-	...TelemetryEnvelopeProps,
-	org_id: OptionalOrgId,
-	role: OptionalString,
-	status: OptionalString,
-	txHash: OptionalTxHash
-});
-const OrgInviteExpiredProps = Schema.Struct({
-	...TelemetryEnvelopeProps,
-	org_id: OptionalOrgId,
-	email_domain: OptionalString,
-	reason: OptionalString,
-	role: OptionalString,
-	status: OptionalString
-});
-const OrgRoleGrantFailedProps = Schema.Struct({
-	...TelemetryEnvelopeProps,
-	org_id: OptionalOrgId,
-	reason: OptionalString,
-	role: OptionalString
-});
-const OptionalPaymentId = Schema.optional(PaymentIdTelemetrySchema);
-const OptionalPayeeId = Schema.optional(PayeeIdTelemetrySchema);
-const OptionalDocumentHash = Schema.optional(DocumentHashSchema);
-const PaymentTargetTelemetryProps = Schema.Struct({
-	...TelemetryEnvelopeProps,
-	payment_id: OptionalPaymentId,
-	payee_id: OptionalPayeeId,
-	document_hash: OptionalDocumentHash,
-	amount: OptionalWeiAmount,
-	currency: OptionalCurrencyCode,
-	status: OptionalString,
-	reason: OptionalString,
-	durationMs: OptionalDurationMs
-});
-const StreamTargetTelemetryProps = Schema.Struct({
-	...TelemetryEnvelopeProps,
-	payment_id: OptionalPaymentId,
-	document_hash: OptionalDocumentHash,
-	amount: OptionalWeiAmount,
-	currency: OptionalCurrencyCode,
-	status: OptionalString,
-	available_bucket: OptionalBalanceBucket,
-	reason: OptionalString,
-	durationMs: OptionalDurationMs
-});
-const WithdrawalTargetTelemetryProps = Schema.Struct({
-	...TelemetryEnvelopeProps,
-	payment_id: OptionalPaymentId,
-	document_hash: OptionalDocumentHash,
-	amount: OptionalWeiAmount,
-	currency: OptionalCurrencyCode,
-	status: OptionalString,
-	reason: OptionalString,
-	durationMs: OptionalDurationMs
-});
-Schema.Struct({
-	name: Schema.Literal("auth_otp_requested"),
-	props: Schema.optional(AuthOtpRequestedProps)
-});
-Schema.Struct({
-	name: Schema.Literal("auth_otp_delivered"),
-	props: Schema.optional(AuthOtpDeliveredProps)
-});
-Schema.Struct({
-	name: Schema.Literal("auth_otp_expired"),
-	props: Schema.optional(AuthOtpExpiredProps)
-});
-Schema.Struct({
-	name: Schema.Literal("auth_verified"),
-	props: Schema.optional(AuthVerifiedProps)
-});
-Schema.Struct({
-	name: Schema.Literal("auth_failed"),
-	props: Schema.optional(AuthFailedProps)
-});
-Schema.Struct({
-	name: Schema.Literal("auth_signed_out"),
-	props: Schema.optional(AuthSignedOutProps)
-});
-Schema.Struct({
-	name: Schema.Literal("provisioning_safe_created"),
-	props: Schema.optional(ProvisioningSafeCreatedProps)
-});
-Schema.Struct({
-	name: Schema.Literal("provisioning_safe_confirmed"),
-	props: Schema.optional(ProvisioningSafeConfirmedProps)
-});
-Schema.Struct({
-	name: Schema.Literal("bootstrap_resolved"),
-	props: Schema.optional(BootstrapResolvedProps)
-});
-Schema.Struct({
-	name: Schema.Literal("bootstrap_failed"),
-	props: Schema.optional(BootstrapFailedProps)
-});
-Schema.Struct({
-	name: Schema.Literal("account_balance_read"),
-	props: Schema.optional(AccountBalanceReadProps)
-});
-Schema.Struct({
-	name: Schema.Literal("account_balance_failed"),
-	props: Schema.optional(AccountBalanceFailedProps)
-});
-Schema.Struct({
-	name: Schema.Literal("faucet_requested"),
-	props: Schema.optional(FaucetRequestedProps)
-});
-Schema.Struct({
-	name: Schema.Literal("faucet_confirmed"),
-	props: Schema.optional(FaucetConfirmedProps)
-});
-Schema.Struct({
-	name: Schema.Literal("faucet_failed"),
-	props: Schema.optional(FaucetFailedProps)
-});
-Schema.Struct({
-	name: Schema.Literal("subaccount_created"),
-	props: Schema.optional(SubaccountCreatedProps)
-});
-Schema.Struct({
-	name: Schema.Literal("subaccount_renamed"),
-	props: Schema.optional(SubaccountRenamedProps)
-});
-Schema.Struct({
-	name: Schema.Literal("subaccount_deleted"),
-	props: Schema.optional(SubaccountDeletedProps)
-});
-Schema.Struct({
-	name: Schema.Literal("subaccount_op_failed"),
-	props: Schema.optional(SubaccountOpFailedProps)
-});
-Schema.Struct({
-	name: Schema.Literal("transfer_requested"),
-	props: Schema.optional(TransferRequestedProps)
-});
-Schema.Struct({
-	name: Schema.Literal("transfer_confirmed"),
-	props: Schema.optional(TransferConfirmedProps)
-});
-Schema.Struct({
-	name: Schema.Literal("transfer_failed"),
-	props: Schema.optional(TransferFailedProps)
-});
-Schema.Struct({
-	name: Schema.Literal("org_create_started"),
-	props: Schema.optional(OrgCreateStartedProps)
-});
-Schema.Struct({
-	name: Schema.Literal("org_safe_created"),
-	props: Schema.optional(OrgSafeCreatedProps)
-});
-Schema.Struct({
-	name: Schema.Literal("org_safe_confirmed"),
-	props: Schema.optional(OrgSafeConfirmedProps)
-});
-Schema.Struct({
-	name: Schema.Literal("org_roles_seeded"),
-	props: Schema.optional(OrgRolesSeededProps)
-});
-Schema.Struct({
-	name: Schema.Literal("org_created"),
-	props: Schema.optional(OrgCreatedProps)
-});
-Schema.Struct({
-	name: Schema.Literal("org_create_failed"),
-	props: Schema.optional(OrgCreateFailedProps)
-});
-Schema.Struct({
-	name: Schema.Literal("org_invite_sent"),
-	props: Schema.optional(OrgInviteSentProps)
-});
-Schema.Struct({
-	name: Schema.Literal("org_invite_accepted"),
-	props: Schema.optional(OrgInviteAcceptedProps)
-});
-Schema.Struct({
-	name: Schema.Literal("org_role_granted"),
-	props: Schema.optional(OrgRoleGrantedProps)
-});
-Schema.Struct({
-	name: Schema.Literal("org_member_active"),
-	props: Schema.optional(OrgMemberActiveProps)
-});
-Schema.Struct({
-	name: Schema.Literal("org_member_removed"),
-	props: Schema.optional(OrgMemberRemovedProps)
-});
-Schema.Struct({
-	name: Schema.Literal("org_invite_expired"),
-	props: Schema.optional(OrgInviteExpiredProps)
-});
-Schema.Struct({
-	name: Schema.Literal("org_role_grant_failed"),
-	props: Schema.optional(OrgRoleGrantFailedProps)
-});
-Schema.Struct({
-	name: Schema.Literal("payment_requested"),
-	props: Schema.optional(PaymentTargetTelemetryProps)
-});
-Schema.Struct({
-	name: Schema.Literal("payment_resolved"),
-	props: Schema.optional(PaymentTargetTelemetryProps)
-});
-Schema.Struct({
-	name: Schema.Literal("payment_document_attached"),
-	props: Schema.optional(PaymentTargetTelemetryProps)
-});
-Schema.Struct({
-	name: Schema.Literal("payment_submitted"),
-	props: Schema.optional(PaymentTargetTelemetryProps)
-});
-Schema.Struct({
-	name: Schema.Literal("payment_settled"),
-	props: Schema.optional(PaymentTargetTelemetryProps)
-});
-Schema.Struct({
-	name: Schema.Literal("payment_claimed"),
-	props: Schema.optional(PaymentTargetTelemetryProps)
-});
-Schema.Struct({
-	name: Schema.Literal("payment_cancelled"),
-	props: Schema.optional(PaymentTargetTelemetryProps)
-});
-Schema.Struct({
-	name: Schema.Literal("payment_redirected"),
-	props: Schema.optional(PaymentTargetTelemetryProps)
-});
-Schema.Struct({
-	name: Schema.Literal("payment_failed"),
-	props: Schema.optional(PaymentTargetTelemetryProps)
-});
-Schema.Struct({
-	name: Schema.Literal("stream_created"),
-	props: Schema.optional(StreamTargetTelemetryProps)
-});
-Schema.Struct({
-	name: Schema.Literal("stream_claimed"),
-	props: Schema.optional(StreamTargetTelemetryProps)
-});
-Schema.Struct({
-	name: Schema.Literal("stream_cancelled"),
-	props: Schema.optional(StreamTargetTelemetryProps)
-});
-Schema.Struct({
-	name: Schema.Literal("stream_completed"),
-	props: Schema.optional(StreamTargetTelemetryProps)
-});
-Schema.Struct({
-	name: Schema.Literal("stream_failed"),
-	props: Schema.optional(StreamTargetTelemetryProps)
-});
-Schema.Struct({
-	name: Schema.Literal("withdrawal_requested"),
-	props: Schema.optional(WithdrawalTargetTelemetryProps)
-});
-Schema.Struct({
-	name: Schema.Literal("withdrawal_submitted"),
-	props: Schema.optional(WithdrawalTargetTelemetryProps)
-});
-Schema.Struct({
-	name: Schema.Literal("withdrawal_settled"),
-	props: Schema.optional(WithdrawalTargetTelemetryProps)
-});
-Schema.Struct({
-	name: Schema.Literal("withdrawal_failed"),
-	props: Schema.optional(WithdrawalTargetTelemetryProps)
-});
-function redactTelemetryProps(name, props, options = {}) {
-	if (props === void 0) return void 0;
-	const clone = cloneProps$1(props);
-	if (options.rawMode === true) return clone;
-	for (const key of PII_PROP_KEYS_BY_EVENT[name] ?? []) redactProperty(clone, key);
-	return clone;
-}
-const PII_PROP_KEYS_BY_EVENT = {
-	auth_otp_requested: ["email"],
-	auth_otp_delivered: ["email"],
-	auth_otp_expired: ["email"],
-	auth_failed: ["email"]
-};
-function redactProperty(props, key) {
-	const value = props[key];
-	if (typeof value === "string") props[key] = sha256Hex(value).slice(0, 12);
-}
-function cloneProps$1(props) {
-	const cloned = {};
-	for (const [key, value] of Object.entries(props)) cloned[key] = cloneTelemetryValue$1(value);
-	return cloned;
-}
-function cloneTelemetryValue$1(value) {
-	if (Array.isArray(value)) return value.map(cloneTelemetryValue$1);
-	if (value === null || typeof value !== "object") return value;
-	if (Object.getPrototypeOf(value) !== Object.prototype) return value;
-	const cloned = {};
-	for (const [key, nested] of Object.entries(value)) cloned[key] = cloneTelemetryValue$1(nested);
-	return cloned;
-}
-const SHA256_INITIAL_HASH = [
-	1779033703,
-	3144134277,
-	1013904242,
-	2773480762,
-	1359893119,
-	2600822924,
-	528734635,
-	1541459225
-];
-const SHA256_K = [
-	1116352408,
-	1899447441,
-	3049323471,
-	3921009573,
-	961987163,
-	1508970993,
-	2453635748,
-	2870763221,
-	3624381080,
-	310598401,
-	607225278,
-	1426881987,
-	1925078388,
-	2162078206,
-	2614888103,
-	3248222580,
-	3835390401,
-	4022224774,
-	264347078,
-	604807628,
-	770255983,
-	1249150122,
-	1555081692,
-	1996064986,
-	2554220882,
-	2821834349,
-	2952996808,
-	3210313671,
-	3336571891,
-	3584528711,
-	113926993,
-	338241895,
-	666307205,
-	773529912,
-	1294757372,
-	1396182291,
-	1695183700,
-	1986661051,
-	2177026350,
-	2456956037,
-	2730485921,
-	2820302411,
-	3259730800,
-	3345764771,
-	3516065817,
-	3600352804,
-	4094571909,
-	275423344,
-	430227734,
-	506948616,
-	659060556,
-	883997877,
-	958139571,
-	1322822218,
-	1537002063,
-	1747873779,
-	1955562222,
-	2024104815,
-	2227730452,
-	2361852424,
-	2428436474,
-	2756734187,
-	3204031479,
-	3329325298
-];
-function sha256Hex(input) {
-	const padded = padSha256Message(new TextEncoder().encode(input));
-	const view = new DataView(padded.buffer, padded.byteOffset, padded.byteLength);
-	const words = new Uint32Array(64);
-	let h0 = SHA256_INITIAL_HASH[0];
-	let h1 = SHA256_INITIAL_HASH[1];
-	let h2 = SHA256_INITIAL_HASH[2];
-	let h3 = SHA256_INITIAL_HASH[3];
-	let h4 = SHA256_INITIAL_HASH[4];
-	let h5 = SHA256_INITIAL_HASH[5];
-	let h6 = SHA256_INITIAL_HASH[6];
-	let h7 = SHA256_INITIAL_HASH[7];
-	for (let offset = 0; offset < padded.byteLength; offset += 64) {
-		for (let i = 0; i < 16; i++) words[i] = view.getUint32(offset + i * 4);
-		for (let i = 16; i < 64; i++) {
-			const s0 = rotr(words[i - 15], 7) ^ rotr(words[i - 15], 18) ^ words[i - 15] >>> 3;
-			const s1 = rotr(words[i - 2], 17) ^ rotr(words[i - 2], 19) ^ words[i - 2] >>> 10;
-			words[i] = words[i - 16] + s0 + words[i - 7] + s1 >>> 0;
-		}
-		let a = h0;
-		let b = h1;
-		let c = h2;
-		let d = h3;
-		let e = h4;
-		let f = h5;
-		let g = h6;
-		let h = h7;
-		for (let i = 0; i < 64; i++) {
-			const s1 = rotr(e, 6) ^ rotr(e, 11) ^ rotr(e, 25);
-			const ch = e & f ^ ~e & g;
-			const temp1 = h + s1 + ch + SHA256_K[i] + words[i] >>> 0;
-			const temp2 = (rotr(a, 2) ^ rotr(a, 13) ^ rotr(a, 22)) + (a & b ^ a & c ^ b & c) >>> 0;
-			h = g;
-			g = f;
-			f = e;
-			e = d + temp1 >>> 0;
-			d = c;
-			c = b;
-			b = a;
-			a = temp1 + temp2 >>> 0;
-		}
-		h0 = h0 + a >>> 0;
-		h1 = h1 + b >>> 0;
-		h2 = h2 + c >>> 0;
-		h3 = h3 + d >>> 0;
-		h4 = h4 + e >>> 0;
-		h5 = h5 + f >>> 0;
-		h6 = h6 + g >>> 0;
-		h7 = h7 + h >>> 0;
-	}
-	return [
-		h0,
-		h1,
-		h2,
-		h3,
-		h4,
-		h5,
-		h6,
-		h7
-	].map((word) => word.toString(16).padStart(8, "0")).join("");
-}
-function padSha256Message(bytes) {
-	const bitLength = bytes.byteLength * 8;
-	const zeroPadLength = (64 - (bytes.byteLength + 1 + 8) % 64) % 64;
-	const output = new Uint8Array(bytes.byteLength + 1 + zeroPadLength + 8);
-	output.set(bytes);
-	output[bytes.byteLength] = 128;
-	const view = new DataView(output.buffer);
-	view.setUint32(output.byteLength - 8, Math.floor(bitLength / 4294967296));
-	view.setUint32(output.byteLength - 4, bitLength >>> 0);
-	return output;
-}
-function rotr(value, bits) {
-	return value >>> bits | value << 32 - bits;
-}
-//#endregion
 //#region src/ports/telemetry.ts
 var TelemetryPortTag = class extends Context.Tag("@capxul/sdk/ports/TelemetryPort")() {};
 //#endregion
@@ -4632,7 +3408,7 @@ function asRecordArgs(args) {
 	return { value: args };
 }
 function transportErrorFromThrown(operation, request, cause) {
-	return transportErrorFromCapxul(operation, request, cause instanceof Error ? Errors.providerError("transport", request.name, cause) : Errors.providerError("transport", request.name, new Error(String(cause))), cause);
+	return transportErrorFromCapxul(operation, request, cause instanceof Error ? Errors$1.providerError("transport", request.name, cause) : Errors$1.providerError("transport", request.name, new Error(String(cause))), cause);
 }
 //#endregion
 //#region src/openfort/create-openfort-browser-signer.ts
@@ -4688,7 +3464,7 @@ function createOpenfortBrowserSignerFromBootstrap(bootstrap, options = {}) {
 			ok: false,
 			failure_mode: "no-secure-context"
 		});
-		const error = Errors.providerError("openfort", "configure", /* @__PURE__ */ new Error("Web Crypto unavailable: browser is not a secure context"), { failure_mode: "no-secure-context" });
+		const error = Errors$1.providerError("openfort", "configure", /* @__PURE__ */ new Error("Web Crypto unavailable: browser is not a secure context"), { failure_mode: "no-secure-context" });
 		if (telemetry) captureExceptionSync(telemetry, error, {
 			layer: "openfort",
 			operation: "configure",
@@ -4734,7 +3510,7 @@ function createOpenfortBrowserSignerFromBootstrap(bootstrap, options = {}) {
 			if (isInsecureBrowserContext()) failNoSecureContext();
 			await openfort.waitForInitialization();
 			const accessToken = await fetchBetterAuthAccessToken();
-			if (accessToken === null) throw Errors.notAuthenticated();
+			if (accessToken === null) throw Errors$1.notAuthenticated();
 			const encryptionResponse = await fetch(encryptionSessionUrl(), {
 				method: "POST",
 				credentials: "include",
@@ -4747,10 +3523,10 @@ function createOpenfortBrowserSignerFromBootstrap(bootstrap, options = {}) {
 			diagnostic?.trace("openfort.encryptionSession", { httpStatus: encryptionResponse.status });
 			if (!encryptionResponse.ok) {
 				const detail = await encryptionResponse.text();
-				throw Errors.providerError("openfort", "encryptionSession", /* @__PURE__ */ new Error(`Openfort encryption session failed (${encryptionResponse.status}): ${detail.slice(0, 200)}`));
+				throw Errors$1.providerError("openfort", "encryptionSession", /* @__PURE__ */ new Error(`Openfort encryption session failed (${encryptionResponse.status}): ${detail.slice(0, 200)}`));
 			}
 			const encryptionBody = await encryptionResponse.json();
-			if (typeof encryptionBody.sessionId !== "string" || encryptionBody.sessionId.length === 0) throw Errors.providerError("openfort", "encryptionSession", /* @__PURE__ */ new Error("Openfort encryption session response missing sessionId"));
+			if (typeof encryptionBody.sessionId !== "string" || encryptionBody.sessionId.length === 0) throw Errors$1.providerError("openfort", "encryptionSession", /* @__PURE__ */ new Error("Openfort encryption session response missing sessionId"));
 			const embeddedState = await openfort.embeddedWallet.getEmbeddedState();
 			diagnostic?.trace("openfort.embeddedState", { state: embeddedState });
 			if (embeddedState !== EmbeddedState.READY) {
@@ -4939,7 +3715,7 @@ function createAuthFlowMachine() {
 			if (!/^\d{6}$/.test(context.request.otp)) return yield* Effect.fail(new AuthFlowError({
 				operation: "verifyOtp",
 				state: context.state.state,
-				publicError: Errors.invalidInput("otp", "must be a six digit code"),
+				publicError: Errors$1.invalidInput("otp", "must be a six digit code"),
 				publicCode: "INVALID_INPUT"
 			}));
 			if (!canTransition(context.state.state, "VerifyOtp")) return yield* Effect.fail(wrongState("VerifyOtp", context.state.state));
@@ -4948,7 +3724,7 @@ function createAuthFlowMachine() {
 			const now = yield* (yield* ClockPortTag).now.pipe(Effect.mapError((cause) => new AuthFlowError({
 				operation: "verifyOtp",
 				state: current.state,
-				publicError: Errors.providerError("clock", "now", cause),
+				publicError: Errors$1.providerError("clock", "now", cause),
 				publicCode: "PROVIDER_ERROR",
 				cause
 			})));
@@ -4956,7 +3732,7 @@ function createAuthFlowMachine() {
 				const failure = new AuthFlowError({
 					operation: "verifyOtp",
 					state: "otp_requested",
-					publicError: Errors.otpExpired({ expiredAt: Number(current.otpRequestedAt) + normalized.otpTtlMs }),
+					publicError: Errors$1.otpExpired({ expiredAt: Number(current.otpRequestedAt) + normalized.otpTtlMs }),
 					publicCode: "OTP_EXPIRED"
 				});
 				yield* emitTelemetry({
@@ -5017,7 +3793,7 @@ function createAuthFlowMachine() {
 			const now = yield* (yield* ClockPortTag).now.pipe(Effect.mapError((cause) => new AuthFlowError({
 				operation: "verifyOtp",
 				state: current.state,
-				publicError: Errors.providerError("clock", "now", cause),
+				publicError: Errors$1.providerError("clock", "now", cause),
 				publicCode: "PROVIDER_ERROR",
 				cause
 			})));
@@ -5025,7 +3801,7 @@ function createAuthFlowMachine() {
 				const failure = new AuthFlowError({
 					operation: "verifyOtp",
 					state: "error",
-					publicError: Errors.otpExpired({ expiredAt: Number(current.otpRequestedAt) + normalized.otpTtlMs }),
+					publicError: Errors$1.otpExpired({ expiredAt: Number(current.otpRequestedAt) + normalized.otpTtlMs }),
 					publicCode: "OTP_EXPIRED"
 				});
 				yield* emitTelemetry({
@@ -5078,12 +3854,12 @@ function bootAuthFlow(machine, input) {
 				return Ref.get(statusRef).pipe(Effect.flatMap((status) => status === "active" ? actor.send(toMachineRequest(request)).pipe(Effect.raceFirst(Deferred.await(stopDeferred).pipe(Effect.flatMap(() => Effect.fail(new AuthFlowError({
 					operation: "transition",
 					state: Effect.runSync(actor.get).state,
-					publicError: Errors.cancelled({ operation: "authFlow.send" }),
+					publicError: Errors$1.cancelled({ operation: "authFlow.send" }),
 					publicCode: "CANCELLED"
 				})))))) : Effect.fail(new AuthFlowError({
 					operation: "transition",
 					state: Effect.runSync(actor.get).state,
-					publicError: Errors.cancelled({ operation: "authFlow.send" }),
+					publicError: Errors$1.cancelled({ operation: "authFlow.send" }),
 					publicCode: "CANCELLED"
 				}))), Effect.tapError((failure) => failure.publicCode === "OTP_EXPIRED" ? Effect.void : emitTelemetry({
 					name: "auth_failed",
@@ -5130,7 +3906,7 @@ function requestOtpCompletion(email, anonDistinctId, options) {
 		const now = yield* (yield* ClockPortTag).now.pipe(Effect.mapError((cause) => new AuthFlowError({
 			operation: "requestOtp",
 			state: "sending_otp",
-			publicError: Errors.providerError("clock", "now", cause),
+			publicError: Errors$1.providerError("clock", "now", cause),
 			publicCode: "PROVIDER_ERROR",
 			cause
 		})));
@@ -5207,7 +3983,7 @@ function withAuthFlowTimeout(effect, operation, state, options) {
 		onTimeout: () => new AuthFlowError({
 			operation,
 			state,
-			publicError: Errors.providerTimeout("auth-flow", operation, timeoutMs),
+			publicError: Errors$1.providerTimeout("auth-flow", operation, timeoutMs),
 			publicCode: "PROVIDER_ERROR"
 		})
 	}));
@@ -5229,7 +4005,7 @@ function completeRequest(commit, deferred, input, control, effect, toFailureCont
 		const failure = new AuthFlowError({
 			operation: "transition",
 			state: "error",
-			publicError: Errors.unknown(cause),
+			publicError: Errors$1.unknown(cause),
 			publicCode: "UNKNOWN",
 			cause
 		});
@@ -5273,7 +4049,7 @@ function stoppedFailure() {
 	return new AuthFlowError({
 		operation: "transition",
 		state: "error",
-		publicError: Errors.cancelled({ operation: "authFlow.request" }),
+		publicError: Errors$1.cancelled({ operation: "authFlow.request" }),
 		publicCode: "CANCELLED"
 	});
 }
@@ -5302,7 +4078,7 @@ function wrongState(request, state) {
 	return new AuthFlowError({
 		operation: "transition",
 		state,
-		publicError: Errors.wrongState({
+		publicError: Errors$1.wrongState({
 			method: request,
 			currentState: state,
 			validStates: AUTH_FLOW_TRANSITION_TABLE[state].valid
@@ -5321,9 +4097,9 @@ function toAuthFlowError(operation, state, error) {
 	});
 }
 function toCapxulError(operation, error) {
-	if (error.cause instanceof CapxulError) return error.cause;
-	if (operation === "requestOtp" && error.kind === "provider") return Errors.emailDeliveryFailed("provider rejected OTP request");
-	return Errors.providerError("auth-client", operation, /* @__PURE__ */ new Error("auth-client provider failure"));
+	if (error.cause instanceof CapxulError$2) return error.cause;
+	if (operation === "requestOtp" && error.kind === "provider") return Errors$1.emailDeliveryFailed("provider rejected OTP request");
+	return Errors$1.providerError("auth-client", operation, /* @__PURE__ */ new Error("auth-client provider failure"));
 }
 function emitTelemetry(event) {
 	return Effect.gen(function* () {
@@ -5389,7 +4165,7 @@ function hasMachineActor(actor) {
 */
 const getSessionProgramWithOptions = (options) => Effect.gen(function* () {
 	const deps = yield* CapxulDepsTag;
-	const cached = yield* deps.authCache.getSession.pipe(Effect.mapError((e) => Errors.providerError("auth-cache", "getSession", e)));
+	const cached = yield* deps.authCache.getSession.pipe(Effect.mapError((e) => Errors$1.providerError("auth-cache", "getSession", e)));
 	const actorState = String(deps.actor.getSnapshot().value);
 	if (cached === null && (actorState === "otp_requested" || actorState === "sending_otp" || actorState === "verifying")) return null;
 	if (cached !== null && actorState !== "idle") return cached;
@@ -5429,25 +4205,25 @@ getSessionProgramWithOptions();
 function verifyOtpProgram(input, options) {
 	return Effect.gen(function* () {
 		const deps = yield* CapxulDepsTag;
-		if (!/^\d{6}$/.test(input.code)) return yield* Effect.fail(Errors.invalidInput("otp", "must be 6 digits"));
+		if (!/^\d{6}$/.test(input.code)) return yield* Effect.fail(Errors$1.invalidInput("otp", "must be 6 digits"));
 		let email;
 		try {
 			email = toEmail(input.email);
 		} catch (err) {
-			return yield* Effect.fail(err instanceof CapxulError ? err : Errors.invalidInput("email", "invalid email"));
+			return yield* Effect.fail(err instanceof CapxulError$2 ? err : Errors$1.invalidInput("email", "invalid email"));
 		}
 		let value = String(deps.actor.getSnapshot().value);
 		if (value === "error") {
 			yield* sendAuthFlowRequest(deps.actor, { _tag: "ResumeOtpEntry" }).pipe(Effect.provide(authFlowLayer(deps)), Effect.mapError((failure) => failure.publicError));
 			value = "otp_requested";
-		} else if (value !== "otp_requested") return yield* Effect.fail(Errors.wrongState({
+		} else if (value !== "otp_requested") return yield* Effect.fail(Errors$1.wrongState({
 			method: "verifyOtp",
 			currentState: value,
 			validStates: ["otp_requested"]
 		}));
 		if (!hasMachineActor(deps.actor)) {
 			const next = deps.actor.getSnapshot();
-			if (String(next.value) === "error") return yield* Effect.fail(next.context.error ?? Errors.unknown({ method: "verifyOtp" }));
+			if (String(next.value) === "error") return yield* Effect.fail(next.context.error ?? Errors$1.unknown({ method: "verifyOtp" }));
 		}
 		const session = yield* sendAuthFlowRequest(deps.actor, {
 			_tag: "VerifyOtp",
@@ -5455,8 +4231,8 @@ function verifyOtpProgram(input, options) {
 			otp: input.code,
 			...depsRequestOptions(deps, options?.signal)
 		}).pipe(Effect.provide(authFlowLayer(deps)), Effect.map((snapshot) => snapshot[1].session), Effect.mapError((failure) => failure.publicError));
-		if (session === null) return yield* Effect.fail(Errors.notAuthenticated());
-		yield* deps.authCache.setSession(session).pipe(Effect.mapError((e) => Errors.providerError("auth-cache", "setSession", e)));
+		if (session === null) return yield* Effect.fail(Errors$1.notAuthenticated());
+		yield* deps.authCache.setSession(session).pipe(Effect.mapError((e) => Errors$1.providerError("auth-cache", "setSession", e)));
 		return session;
 	});
 }
@@ -5480,7 +4256,7 @@ function depsRequestOptions(deps, signal) {
 * JWT clear on failure, matching the original's sequential `if (!ok) return`.
 */
 function clearAuthCacheEffect(authCache) {
-	return authCache.clearSession.pipe(Effect.mapError((cause) => Errors.providerError("auth-cache", "clearSession", cause)), Effect.zipRight(authCache.clearJwt.pipe(Effect.mapError((cause) => Errors.providerError("auth-cache", "clearJwt", cause)))));
+	return authCache.clearSession.pipe(Effect.mapError((cause) => Errors$1.providerError("auth-cache", "clearSession", cause)), Effect.zipRight(authCache.clearJwt.pipe(Effect.mapError((cause) => Errors$1.providerError("auth-cache", "clearJwt", cause)))));
 }
 function cryptoRandomId() {
 	const bytes = new Uint8Array(8);
@@ -5492,9 +4268,9 @@ const canSendOtpProgram = (input, options) => Effect.gen(function* () {
 	const deps = yield* CapxulDepsTag;
 	const email = yield* Effect.try({
 		try: () => toEmail(input.email),
-		catch: (err) => err instanceof CapxulError ? err : Errors.invalidInput("email", "invalid email")
+		catch: (err) => err instanceof CapxulError$2 ? err : Errors$1.invalidInput("email", "invalid email")
 	});
-	return yield* deps.authClient.canSendOtp({ email }, options?.signal === void 0 ? void 0 : { signal: options.signal }).pipe(Effect.mapError((failure) => failure.cause instanceof CapxulError ? failure.cause : Errors.providerError("auth-client", "canSendOtp", failure.cause)));
+	return yield* deps.authClient.canSendOtp({ email }, options?.signal === void 0 ? void 0 : { signal: options.signal }).pipe(Effect.mapError((failure) => failure.cause instanceof CapxulError$2 ? failure.cause : Errors$1.providerError("auth-client", "canSendOtp", failure.cause)));
 });
 /**
 * `signIn` as a single Effect requiring ONLY `CapxulDepsTag`. Faithful
@@ -5507,10 +4283,10 @@ const signInProgram = (input, options) => Effect.gen(function* () {
 	const deps = yield* CapxulDepsTag;
 	const email = yield* Effect.try({
 		try: () => toEmail(input.email),
-		catch: (err) => err instanceof CapxulError ? err : Errors.invalidInput("email", "invalid email")
+		catch: (err) => err instanceof CapxulError$2 ? err : Errors$1.invalidInput("email", "invalid email")
 	});
 	const value = String(deps.actor.getSnapshot().value);
-	if (value !== "idle" && value !== "otp_requested" && value !== "error") return yield* Effect.fail(Errors.wrongState({
+	if (value !== "idle" && value !== "otp_requested" && value !== "error") return yield* Effect.fail(Errors$1.wrongState({
 		method: "signIn",
 		currentState: value,
 		validStates: [
@@ -5528,7 +4304,7 @@ const signInProgram = (input, options) => Effect.gen(function* () {
 		email,
 		...depsRequestOptions(deps, options?.signal)
 	}).pipe(Effect.provide(authFlowLayer(deps)), Effect.mapError((failure) => failure.publicError));
-	const now = yield* deps.clock.now.pipe(Effect.mapError((cause) => Errors.providerError("clock", "now", cause)));
+	const now = yield* deps.clock.now.pipe(Effect.mapError((cause) => Errors$1.providerError("clock", "now", cause)));
 	return {
 		sessionId: cryptoRandomId(),
 		expiresAt: now + (deps.otpTtlMs ?? 3e5)
@@ -5547,7 +4323,7 @@ const signOutProgramWithOptions = (options) => Effect.gen(function* () {
 	const deps = yield* CapxulDepsTag;
 	let value = String(deps.actor.getSnapshot().value);
 	if (value === "idle") {
-		const cached = yield* deps.authCache.getSession.pipe(Effect.mapError((e) => Errors.providerError("auth-cache", "getSession", e)));
+		const cached = yield* deps.authCache.getSession.pipe(Effect.mapError((e) => Errors$1.providerError("auth-cache", "getSession", e)));
 		if (cached !== null) {
 			yield* sendAuthFlowRequest(deps.actor, {
 				_tag: "RestoreCachedSession",
@@ -5555,7 +4331,7 @@ const signOutProgramWithOptions = (options) => Effect.gen(function* () {
 			}).pipe(Effect.provide(authFlowLayer(deps)), Effect.mapError((failure) => failure.publicError));
 			value = String(deps.actor.getSnapshot().value);
 		}
-		if (value === "idle") return yield* Effect.fail(Errors.wrongState({
+		if (value === "idle") return yield* Effect.fail(Errors$1.wrongState({
 			method: "signOut",
 			currentState: value,
 			validStates: [
@@ -5590,21 +4366,21 @@ function makeAuthMethods(deps) {
 		async canSendOtp(input, options) {
 			if (options?.signal?.aborted) return {
 				ok: false,
-				error: Errors.cancelled({ operation: "canSendOtp" })
+				error: Errors$1.cancelled({ operation: "canSendOtp" })
 			};
 			return toCapxulResult(canSendOtpProgram(input, options), capxulDepsLayer(deps));
 		},
 		async signIn(input, options) {
 			if (options?.signal?.aborted) return {
 				ok: false,
-				error: Errors.cancelled({ operation: "signIn" })
+				error: Errors$1.cancelled({ operation: "signIn" })
 			};
 			return toCapxulResult(signInProgram(input, options), capxulDepsLayer(deps));
 		},
 		async verifyOtp(input, options) {
 			if (options?.signal?.aborted) return {
 				ok: false,
-				error: Errors.cancelled({ operation: "verifyOtp" })
+				error: Errors$1.cancelled({ operation: "verifyOtp" })
 			};
 			const result = await toCapxulResult(verifyOtpProgram(input, options), capxulDepsLayer(deps));
 			if (!result.ok) return result;
@@ -5613,13 +4389,13 @@ function makeAuthMethods(deps) {
 			try {
 				await afterVerifyOtp();
 			} catch (cause) {
-				if (cause instanceof CapxulError) return {
+				if (cause instanceof CapxulError$2) return {
 					ok: false,
 					error: cause
 				};
 				return {
 					ok: false,
-					error: Errors.providerError("sdk", "afterVerifyOtp", cause)
+					error: Errors$1.providerError("sdk", "afterVerifyOtp", cause)
 				};
 			}
 			return result;
@@ -5627,14 +4403,14 @@ function makeAuthMethods(deps) {
 		async signOut(options) {
 			if (options?.signal?.aborted) return {
 				ok: false,
-				error: Errors.cancelled({ operation: "signOut" })
+				error: Errors$1.cancelled({ operation: "signOut" })
 			};
 			return toCapxulResult(signOutProgramWithOptions(options), capxulDepsLayer(deps));
 		},
 		async getSession(options) {
 			if (options?.signal?.aborted) return {
 				ok: false,
-				error: Errors.cancelled({ operation: "getSession" })
+				error: Errors$1.cancelled({ operation: "getSession" })
 			};
 			return toCapxulResult(getSessionProgramWithOptions(options), capxulDepsLayer(deps));
 		}
@@ -5682,13 +4458,13 @@ function provisionSmartAccountProgram() {
 		const deps = yield* SmartAccountDepsTag;
 		const snap = deps.actor.getSnapshot();
 		const value = snap.value;
-		if (value !== "authenticated") return yield* Effect.fail(Errors.wrongState({
+		if (value !== "authenticated") return yield* Effect.fail(Errors$1.wrongState({
 			method: "smartAccount.provision",
 			currentState: value,
 			validStates: ["authenticated"]
 		}));
 		const session = snap.context.session;
-		if (session === null) return yield* Effect.fail(Errors.notAuthenticated());
+		if (session === null) return yield* Effect.fail(Errors$1.notAuthenticated());
 		const provisioned = yield* deps.smartAccountPort.provision({
 			authUserId: session.authUserId,
 			chainId: deps.chainId
@@ -5704,7 +4480,7 @@ function makeSmartAccountMethods(deps) {
 		async loadCurrent(options) {
 			if (options?.signal?.aborted) return {
 				ok: false,
-				error: Errors.cancelled({ operation: "smartAccount.loadCurrent" })
+				error: Errors$1.cancelled({ operation: "smartAccount.loadCurrent" })
 			};
 			return toCapxulResult(loadSmartAccountProgram, smartAccountDepsLayer(deps));
 		},
@@ -5732,13 +4508,13 @@ function identityDepsLayer(deps) {
 */
 const loadIdentityProgram = Effect.gen(function* () {
 	const deps = yield* IdentityDepsTag;
-	if (deps.actor === void 0) return yield* Effect.fail(Errors.notAuthenticated());
+	if (deps.actor === void 0) return yield* Effect.fail(Errors$1.notAuthenticated());
 	const snapshot = deps.actor.getSnapshot();
 	const existingError = snapshot.context.error;
-	if (existingError instanceof CapxulError) return yield* Effect.fail(existingError);
+	if (existingError instanceof CapxulError$2) return yield* Effect.fail(existingError);
 	const authUserId = snapshot.context.session?.authUserId;
 	if (authUserId === void 0) return null;
-	return yield* deps.identityPort.loadByAuthUserId(authUserId).pipe(Effect.catchAllDefect((cause) => Effect.fail(identityErrorFromCapxul("loadByAuthUserId", cause instanceof CapxulError ? cause : Errors.unknown(cause), cause))), Effect.mapError((failure) => failure.publicError));
+	return yield* deps.identityPort.loadByAuthUserId(authUserId).pipe(Effect.catchAllDefect((cause) => Effect.fail(identityErrorFromCapxul("loadByAuthUserId", cause instanceof CapxulError$2 ? cause : Errors$1.unknown(cause), cause))), Effect.mapError((failure) => failure.publicError));
 });
 //#endregion
 //#region src/client/identity.ts
@@ -5746,7 +4522,7 @@ function makeIdentityMethods(deps) {
 	return { async loadCurrent(options) {
 		if (options?.signal?.aborted) return {
 			ok: false,
-			error: Errors.cancelled({ operation: "identity.loadCurrent" })
+			error: Errors$1.cancelled({ operation: "identity.loadCurrent" })
 		};
 		return toCapxulResult(loadIdentityProgram, identityDepsLayer(deps));
 	} };
@@ -5895,21 +4671,91 @@ function makeAccountsMethods(deps) {
 		async read(options) {
 			if (options?.signal?.aborted) return {
 				ok: false,
-				error: Errors.cancelled({ operation: "accounts.read" })
+				error: Errors$1.cancelled({ operation: "accounts.read" })
 			};
 			return toCapxulResult(readAccountProgram, accountsDepsLayer(deps));
 		},
 		async fund(amount, options) {
 			if (options?.signal?.aborted) return {
 				ok: false,
-				error: Errors.cancelled({ operation: "accounts.fund" })
+				error: Errors$1.cancelled({ operation: "accounts.fund" })
 			};
 			return toCapxulResult(fundFromFaucetProgram(amount), accountsDepsLayer(deps));
 		}
 	};
 }
 //#endregion
+//#region src/client/current-user.ts
+function makeCurrentUserMethods(deps) {
+	return { async get(options) {
+		if (options?.signal?.aborted) return {
+			ok: false,
+			error: Errors.cancelled({ operation: "currentUser.get" })
+		};
+		const user = await deps.me.get(options);
+		if (!user.ok) return {
+			ok: false,
+			error: user.error
+		};
+		const [account, smartAccount, organizations] = await Promise.all([
+			deps.accounts.read(options),
+			deps.smartAccount.loadCurrent(options),
+			deps.orgs(options)
+		]);
+		if (!account.ok) return {
+			ok: false,
+			error: account.error
+		};
+		if (!smartAccount.ok) return {
+			ok: false,
+			error: smartAccount.error
+		};
+		if (!organizations.ok) return {
+			ok: false,
+			error: organizations.error
+		};
+		return {
+			ok: true,
+			value: {
+				user: {
+					id: user.value.authUserId,
+					email: user.value.email,
+					displayName: user.value.displayName,
+					handle: null,
+					paymentLink: null
+				},
+				personalAccount: {
+					id: account.value.id,
+					address: smartAccount.value?.smartAccountAddress ?? null
+				},
+				organizations: organizations.value.map((organization) => ({
+					id: organization.id,
+					name: organization.name,
+					handle: organization.handle,
+					role: organization.role,
+					account: {
+						id: organization.treasury.id,
+						address: organization.safeAddress
+					}
+				}))
+			}
+		};
+	} };
+}
+//#endregion
 //#region src/client/financial-ops.ts
+function actorReferenceToBackend(actor) {
+	if (actor === void 0) return void 0;
+	switch (actor.kind) {
+		case "personal": return { kind: "account" };
+		case "organization": return {
+			kind: "org",
+			orgId: actor.organizationId
+		};
+		case "account":
+		case "org": return actor;
+	}
+}
 const DEFAULT_FUNCTIONS = {
 	me: makeFunctionReference("financialOps/queries:me"),
 	depositInstructions: makeFunctionReference("financialOps/queries:depositInstructions"),
@@ -5969,40 +4815,88 @@ function makeFinancialOpsMethods(deps) {
 			get: (payeeId, options) => runIfActive(options?.signal, "payees.get", () => deps.convexCall.query(fns.getPayee, { payeeId })),
 			resolve: (recipient, options) => runIfActive(options?.signal, "payees.resolve", () => deps.convexCall.query(fns.resolvePayee, { recipient }))
 		},
+		targets: { resolve: async (reference, options) => {
+			switch (reference.kind) {
+				case "handle": return mapOk$1(await runIfActive(options?.signal, "targets.resolve.handle", () => deps.convexCall.query(fns.resolveHandle, { handle: reference.handle })), (target) => resolvedTargetFromResolution(reference, target));
+				case "email": return mapOk$1(await runIfActive(options?.signal, "targets.resolve.email", () => deps.convexCall.query(fns.resolvePayee, { recipient: reference.email })), (target) => resolvedTargetFromResolution(reference, target));
+				case "organization": {
+					const resolved = await runIfActive(options?.signal, "targets.resolve.organization", () => deps.convexCall.query(fns.resolveHandle, { handle: reference.handle }));
+					if (!resolved.ok) return {
+						ok: false,
+						error: resolved.error
+					};
+					if (resolved.value.kind !== "org") return {
+						ok: false,
+						error: Errors.invalidInput("reference", "organization handle could not be resolved")
+					};
+					return {
+						ok: true,
+						value: resolvedTargetFromResolution(reference, resolved.value)
+					};
+				}
+				case "payee": {
+					const payee = await runIfActive(options?.signal, "targets.resolve.payee", () => deps.convexCall.query(fns.getPayee, { payeeId: reference.id }));
+					if (!payee.ok) return {
+						ok: false,
+						error: payee.error
+					};
+					if (payee.value === null) return {
+						ok: false,
+						error: Errors.invalidInput("reference", "payee not found")
+					};
+					return {
+						ok: true,
+						value: resolvedTargetFromPayee(reference, payee.value)
+					};
+				}
+				case "destination": return Promise.resolve({
+					ok: false,
+					error: Errors.notImplemented("targets", "resolve.destination")
+				});
+			}
+		} },
 		destinations: {
 			add: async (input, options) => {
-				const ref = normalizeRefForBackend(input.ref, "ref");
+				const ref = normalizeDestinationInputRef(input, "target");
 				if (!ref.ok) return {
 					ok: false,
 					error: ref.error
 				};
-				return runIfActive(options?.signal, "destinations.add", () => deps.convexCall.mutation(fns.addDestination, {
-					...input.actor === void 0 ? {} : { actor: input.actor },
+				if (ref.value === void 0) return {
+					ok: false,
+					error: Errors.invalidInput("target", "required for destinations.add")
+				};
+				return mapOk$1(await runIfActive(options?.signal, "destinations.add", () => deps.convexCall.mutation(fns.addDestination, {
+					...input.actor === void 0 ? {} : { actor: actorReferenceToBackend(input.actor) },
 					ref: ref.value,
-					kind: input.kind,
+					kind: destinationKindToBackend(input.kind),
 					...input.label === void 0 ? {} : { label: input.label },
 					payload: input.payload
-				}));
+				})), destinationFromBackend);
 			},
 			list: async (input, options) => {
-				const ref = normalizeRefForBackend(input.ref, "ref");
+				const ref = normalizeDestinationInputRef(input, "target");
 				if (!ref.ok) return {
 					ok: false,
 					error: ref.error
 				};
-				return runIfActive(options?.signal, "destinations.list", () => deps.convexCall.query(fns.listDestinations, {
-					...input.actor === void 0 ? {} : { actor: input.actor },
-					ref: ref.value
-				}));
+				return mapOk$1(await runIfActive(options?.signal, "destinations.list", () => deps.convexCall.query(fns.listDestinations, {
+					...input.actor === void 0 ? {} : { actor: actorReferenceToBackend(input.actor) },
+					...ref.value === void 0 ? {} : { ref: ref.value }
+				})), (destinations) => destinations.map(destinationFromBackend).filter((destination) => input.kind === void 0 || destination.kind === input.kind));
 			},
 			remove: (input, options) => runIfActive(options?.signal, "destinations.remove", () => deps.convexCall.mutation(fns.removeDestination, {
-				...input.actor === void 0 ? {} : { actor: input.actor },
+				...input.actor === void 0 ? {} : { actor: actorReferenceToBackend(input.actor) },
 				destinationId: input.destinationId
 			}))
 		},
 		payments: {
 			pay: async (input, options) => {
-				const to = normalizeRefForBackend(input.to, "to");
+				if (actorReferenceToBackend(input.actor)?.kind === "org") return {
+					ok: false,
+					error: Errors.notImplemented("payments", "pay.organizationActor")
+				};
+				const to = normalizeTargetForBackend(input.to, "to");
 				if (!to.ok) return {
 					ok: false,
 					error: to.error
@@ -6010,13 +4904,14 @@ function makeFinancialOpsMethods(deps) {
 				return mapOk$1(await runIfActive(options?.signal, "payments.pay", () => deps.convexCall.mutation(fns.pay, {
 					to: to.value,
 					amount: input.amount,
+					...input.paymentType === void 0 ? {} : { paymentType: input.paymentType },
 					...input.document === void 0 ? {} : { document: input.document },
 					...input.timing === void 0 ? {} : { timing: input.timing },
 					...input.lineItems === void 0 ? {} : { lineItems: input.lineItems }
 				})), normalizePaymentTiming$1);
 			},
 			payout: async (input, options) => mapOk$1(await runIfActive(options?.signal, "payments.payout", () => deps.convexCall.mutation(fns.payout, {
-				...input.actor === void 0 ? {} : { actor: input.actor },
+				...input.actor === void 0 ? {} : { actor: actorReferenceToBackend(input.actor) },
 				destinationId: input.destinationId,
 				amount: input.amount
 			})), normalizePaymentTiming$1),
@@ -6027,6 +4922,16 @@ function makeFinancialOpsMethods(deps) {
 			})),
 			list: async (options) => mapOk$1(await runIfActive(options?.signal, "payments.list", () => deps.convexCall.query(fns.listPayments, {})), (payments) => payments.map(normalizePaymentTiming$1)),
 			get: async (paymentId, options) => mapOk$1(await runIfActive(options?.signal, "payments.get", () => deps.convexCall.query(fns.getPayment, { paymentId })), (payment) => payment === null ? null : normalizePaymentTiming$1(payment)),
+			cancel: (paymentId, options) => {
+				if (options?.signal?.aborted) return Promise.resolve({
+					ok: false,
+					error: Errors.cancelled({ operation: "payments.cancel" })
+				});
+				return Promise.resolve({
+					ok: false,
+					error: Errors.notImplemented("payments", "cancel")
+				});
+			},
 			_internal: {
 				markSettled: (input, options) => runIfActive(options?.signal, "payments.markSettled", () => deps.convexCall.action(fns.markPaymentSettled, {
 					paymentId: input.paymentId,
@@ -6087,6 +4992,38 @@ function makeFinancialOpsMethods(deps) {
 				commitmentRef: (paymentId, options) => runIfActive(options?.signal, "payments.commitmentRef", () => deps.convexCall.query(fns.getCommitmentRef, { paymentId }))
 			}
 		},
+		activity: { list: (params, options) => {
+			if (options?.signal?.aborted) return Promise.resolve({
+				ok: false,
+				error: Errors.cancelled({ operation: "activity.list" })
+			});
+			return Promise.resolve({
+				ok: false,
+				error: Errors.notImplemented("activity", "list")
+			});
+		} },
+		offramp: {
+			quote: (input, options) => {
+				if (options?.signal?.aborted) return Promise.resolve({
+					ok: false,
+					error: Errors.cancelled({ operation: "offramp.quote" })
+				});
+				return Promise.resolve({
+					ok: false,
+					error: Errors.notImplemented("offramp", "quote")
+				});
+			},
+			status: (offrampId, options) => {
+				if (options?.signal?.aborted) return Promise.resolve({
+					ok: false,
+					error: Errors.cancelled({ operation: "offramp.status" })
+				});
+				return Promise.resolve({
+					ok: false,
+					error: Errors.notImplemented("offramp", "status")
+				});
+			}
+		},
 		paymentDocuments: {
 			verify: (documentHash, options) => runIfActive(options?.signal, "paymentDocuments.verify", () => deps.convexCall.query(fns.verifyPaymentDocument, { documentHash })),
 			render: (documentHash, options) => runIfActive(options?.signal, "paymentDocuments.render", () => deps.convexCall.query(fns.renderStoredDocument, { documentHash }))
@@ -6166,6 +5103,169 @@ function handleRefValue(value, field) {
 	const trimmed = nonEmptyRefValue(value, field);
 	return trimmed.startsWith("@") ? trimmed.slice(1) : trimmed;
 }
+function refFromTargetReference(reference, field) {
+	try {
+		if (typeof reference === "string") throw Errors.invalidInput(field, "target must be a typed TargetReference variant");
+		if (typeof reference !== "object" || reference === null || !("kind" in reference)) throw Errors.invalidInput(field, "target must be a typed TargetReference variant");
+		switch (reference.kind) {
+			case "handle": return {
+				ok: true,
+				value: {
+					kind: "handle",
+					handle: reference.handle
+				}
+			};
+			case "email": return {
+				ok: true,
+				value: {
+					kind: "email",
+					email: reference.email
+				}
+			};
+			case "organization": return {
+				ok: true,
+				value: {
+					kind: "orgHandle",
+					orgHandle: reference.handle
+				}
+			};
+			case "payee": return {
+				ok: true,
+				value: {
+					kind: "payeeId",
+					payeeId: reference.id
+				}
+			};
+			case "destination": return {
+				ok: false,
+				error: Errors.notImplemented("targets", "reference.destination")
+			};
+			default: throw Errors.invalidInput(field, "target must be a known TargetReference variant");
+		}
+	} catch (cause) {
+		if (cause instanceof Error && "code" in cause) return {
+			ok: false,
+			error: cause
+		};
+		return {
+			ok: false,
+			error: Errors.invalidInput(field, "target must be a typed TargetReference variant")
+		};
+	}
+}
+function normalizeTargetForBackend(reference, field) {
+	const ref = refFromTargetReference(reference, field);
+	return ref.ok ? normalizeRefForBackend(ref.value, field) : ref;
+}
+function normalizeDestinationInputRef(input, field) {
+	if (input.target !== void 0) return normalizeTargetForBackend(input.target, field);
+	if (input.ref !== void 0) return normalizeDestinationRefForBackend(input.ref, "ref");
+	return {
+		ok: true,
+		value: void 0
+	};
+}
+function targetReferenceFromBackendRef(ref) {
+	switch (ref.kind) {
+		case "handle": return {
+			kind: "handle",
+			handle: ref.handle
+		};
+		case "email": return {
+			kind: "email",
+			email: ref.email
+		};
+		case "orgHandle": return {
+			kind: "organization",
+			handle: ref.orgHandle
+		};
+		case "payeeId": return {
+			kind: "payee",
+			id: ref.payeeId
+		};
+		case "capxulUserId": throw Errors.notImplemented("targets", "reference.capxulUserId");
+	}
+}
+function resolvedTargetFromResolution(reference, resolution) {
+	const kind = resolution.kind === "org" ? "organization" : resolution.kind === "payee" ? "payee" : "person";
+	return {
+		reference,
+		label: resolution.label,
+		kind,
+		capabilities: {
+			canPay: true,
+			canRequest: true,
+			canPayout: false
+		}
+	};
+}
+function resolvedTargetFromPayee(reference, payee) {
+	return {
+		reference,
+		label: payee.label,
+		kind: "payee",
+		capabilities: {
+			canPay: true,
+			canRequest: true,
+			canPayout: false
+		}
+	};
+}
+function destinationKindToBackend(kind) {
+	switch (kind) {
+		case "bank_account": return "bank";
+		case "mobile_money": return "mobile-money";
+		case "external_account": return "wallet";
+	}
+}
+function destinationKindFromBackend(kind) {
+	switch (kind) {
+		case "bank": return "bank_account";
+		case "mobile-money": return "mobile_money";
+		case "wallet": return "external_account";
+	}
+}
+function destinationRailFromBackend(destination) {
+	switch (destination.kind) {
+		case "bank": {
+			const payload = destination.payload;
+			return {
+				kind: "bank",
+				country: payload.country,
+				currency: payload.currency
+			};
+		}
+		case "mobile-money": {
+			const payload = destination.payload;
+			return {
+				kind: "mobile_money",
+				country: payload.country,
+				currency: payload.currency,
+				provider: payload.provider
+			};
+		}
+		case "wallet": return {
+			kind: "chain",
+			network: destination.payload.network,
+			asset: "USD"
+		};
+	}
+}
+function destinationFromBackend(destination) {
+	return {
+		...destination,
+		target: targetReferenceFromBackendRef(destination.ref),
+		kind: destinationKindFromBackend(destination.kind),
+		rail: destinationRailFromBackend(destination)
+	};
+}
+function normalizeDestinationRefForBackend(ref, field) {
+	if (typeof ref === "object" && ref !== null && "kind" in ref && ref.kind === "capxulUserId") return {
+		ok: false,
+		error: Errors.notImplemented("targets", "reference.capxulUserId")
+	};
+	return normalizeRefForBackend(ref, field);
+}
 function normalizeRefForBackend(ref, field) {
 	try {
 		if (typeof ref === "string") throw Errors.invalidInput(field, "recipient must be a typed Ref variant");
@@ -6228,10 +5328,18 @@ function normalizePaymentTiming$1(payment) {
 }
 function mapOk$1(result, f) {
 	if (!result.ok) return result;
-	return {
-		ok: true,
-		value: f(result.value)
-	};
+	try {
+		return {
+			ok: true,
+			value: f(result.value)
+		};
+	} catch (cause) {
+		if (cause instanceof Error && "code" in cause) return {
+			ok: false,
+			error: cause
+		};
+		throw cause;
+	}
 }
 async function runIfActive(signal, operation, effect) {
 	if (signal?.aborted === true) return {
@@ -6312,42 +5420,42 @@ function makeSubAccountsMethods(deps) {
 		async create(accountId, input, options) {
 			if (options?.signal?.aborted) return {
 				ok: false,
-				error: Errors.cancelled({ operation: "subAccounts.create" })
+				error: Errors$1.cancelled({ operation: "subAccounts.create" })
 			};
 			return toCapxulResult(createSubAccountProgram(accountId, input.name), layer);
 		},
 		async get(subAccountId, options) {
 			if (options?.signal?.aborted) return {
 				ok: false,
-				error: Errors.cancelled({ operation: "subAccounts.get" })
+				error: Errors$1.cancelled({ operation: "subAccounts.get" })
 			};
 			return toCapxulResult(getSubAccountProgram(subAccountId), layer);
 		},
 		async list(accountId, options) {
 			if (options?.signal?.aborted) return {
 				ok: false,
-				error: Errors.cancelled({ operation: "subAccounts.list" })
+				error: Errors$1.cancelled({ operation: "subAccounts.list" })
 			};
 			return toCapxulResult(listSubAccountsProgram(accountId), layer);
 		},
 		async rename(subAccountId, name, options) {
 			if (options?.signal?.aborted) return {
 				ok: false,
-				error: Errors.cancelled({ operation: "subAccounts.rename" })
+				error: Errors$1.cancelled({ operation: "subAccounts.rename" })
 			};
 			return toCapxulResult(renameSubAccountProgram(subAccountId, name), layer);
 		},
 		async delete(subAccountId, options) {
 			if (options?.signal?.aborted) return {
 				ok: false,
-				error: Errors.cancelled({ operation: "subAccounts.delete" })
+				error: Errors$1.cancelled({ operation: "subAccounts.delete" })
 			};
 			return toCapxulResult(deleteSubAccountProgram(subAccountId), layer);
 		},
 		async transfer(input, options) {
 			if (options?.signal?.aborted) return {
 				ok: false,
-				error: Errors.cancelled({ operation: "subAccounts.transfer" })
+				error: Errors$1.cancelled({ operation: "subAccounts.transfer" })
 			};
 			return toCapxulResult(transferSubAccountProgram(input), layer);
 		}
@@ -6451,18 +5559,18 @@ function isOrgTelemetryDebugEnabled() {
 //#endregion
 //#region src/client/org-spend-gate.ts
 function evaluateSpendGate(input) {
-	if (!input.activeMember) return reject("not_member", Errors.invalidInput("member", "you are not an active member"));
-	if (!recipientAllowed(input.recipients, input.recipient)) return reject("invalid_recipient", Errors.invalidRecipient("recipient is not allowed by this role"));
-	if (!subAccountAllowed(input.subAccounts, input.subAccountId)) return reject("wrong_envelope", Errors.invalidInput("subAccountId", "sub-account not in scope for this role"));
+	if (!input.activeMember) return reject("not_member", Errors$1.invalidInput("member", "you are not an active member"));
+	if (!recipientAllowed(input.recipients, input.recipient)) return reject("invalid_recipient", Errors$1.invalidRecipient("recipient is not allowed by this role"));
+	if (!subAccountAllowed(input.subAccounts, input.subAccountId)) return reject("wrong_envelope", Errors$1.invalidInput("subAccountId", "sub-account not in scope for this role"));
 	const amount = parseRaw(input.amountRaw, "amountRaw");
 	const balance = parseRaw(input.subAccountBalanceRaw, "subAccountBalanceRaw");
-	if (amount > balance) return reject("insufficient_subaccount_balance", Errors.insufficientBalance(input.currency, balance.toString(10), amount.toString(10)));
+	if (amount > balance) return reject("insufficient_subaccount_balance", Errors$1.insufficientBalance(input.currency, balance.toString(10), amount.toString(10)));
 	const perTxCap = parseOptionalRaw(input.perTxCapRaw, "perTxCapRaw");
-	if (perTxCap !== null && amount > perTxCap) return reject("over_cap", Errors.insufficientBalance("role per-transaction cap", perTxCap.toString(10), amount.toString(10)));
+	if (perTxCap !== null && amount > perTxCap) return reject("over_cap", Errors$1.insufficientBalance("role per-transaction cap", perTxCap.toString(10), amount.toString(10)));
 	const perDayCap = parseOptionalRaw(input.perDayCapRaw, "perDayCapRaw");
 	if (perDayCap !== null) {
 		const remaining = perDayCap - (parseOptionalRaw(input.spentTodayRaw, "spentTodayRaw") ?? 0n);
-		if (remaining < amount) return reject("daily_cap_exhausted", Errors.insufficientBalance("role daily cap", remaining.toString(10), amount.toString(10)));
+		if (remaining < amount) return reject("daily_cap_exhausted", Errors$1.insufficientBalance("role daily cap", remaining.toString(10), amount.toString(10)));
 	}
 	return { ok: true };
 }
@@ -6487,7 +5595,7 @@ function parseOptionalRaw(value, field) {
 	return parseRaw(value, field);
 }
 function parseRaw(value, field) {
-	if (!/^[0-9]+$/.test(value)) throw Errors.invalidInput(field, "must be a non-negative integer string");
+	if (!/^[0-9]+$/.test(value)) throw Errors$1.invalidInput(field, "must be a non-negative integer string");
 	return BigInt(value);
 }
 //#endregion
@@ -6504,7 +5612,7 @@ function missingLiveOrgDep(portName) {
 }
 /** Zero `Money` in the USDX-backed display currency (a fresh Org's treasury). */
 function zeroMoney() {
-	return fromWei("0", 6, "USD");
+	return fromWei("0", USDX_DECIMALS, USDX_CURRENCY);
 }
 /** A fresh Org's treasury Account: `$0` balance, `available === balance`. */
 function zeroTreasury(orgId) {
@@ -6753,30 +5861,6 @@ function inviteMemberProgram(orgId, input) {
 		return member;
 	});
 }
-function pendingMembersProgram(orgId) {
-	return Effect.gen(function* () {
-		const deps = yield* OrgDepsTag;
-		if (deps.orgPort?.pendingMembers !== void 0) return yield* deps.orgPort.pendingMembers({ orgId }).pipe(Effect.mapError((error) => error.publicError));
-		if (deps.orgPort !== void 0) return (yield* deps.orgPort.listMembers({ orgId }).pipe(Effect.mapError((error) => error.publicError))).filter((member) => member.status === "pending" || member.status === "pending_safe" || member.status === "pending_grant");
-		return [];
-	});
-}
-function resendInviteTokenProgram(orgId, email) {
-	return Effect.gen(function* () {
-		const deps = yield* OrgDepsTag;
-		if (deps.orgPort?.resendInviteToken !== void 0) return yield* deps.orgPort.resendInviteToken({
-			orgId,
-			email
-		}).pipe(Effect.mapError((error) => error.publicError));
-		if (!isHermeticOrgDeps(deps)) return yield* Effect.fail(missingLiveOrgDep("orgPort.resendInviteToken"));
-		return hermeticMember({
-			orgId,
-			email,
-			role: "Member",
-			status: "pending"
-		});
-	});
-}
 function detectAndAcceptPendingInvitationsProgram() {
 	return Effect.gen(function* () {
 		const deps = yield* OrgDepsTag;
@@ -6880,7 +5964,7 @@ function gateOneRun(input) {
 				subAccountBalanceRaw: subtractNonNegative(baseGateInput.subAccountBalanceRaw, accumulated),
 				spentTodayRaw: (BigInt(authority.spentTodayRaw ?? "0") + accumulated).toString(10)
 			}),
-			catch: (cause) => isCapxulError(cause) ? cause : Errors.unknown(cause)
+			catch: (cause) => isCapxulError$1(cause) ? cause : Errors.unknown(cause)
 		});
 		if (!decision.ok) return yield* Effect.fail(decision.error);
 		return {
@@ -6900,7 +5984,7 @@ function spendViaPaymentsProgram(orgId, input) {
 		if (deps.orgSpendPort === void 0 && !isHermeticOrgDeps(deps)) return yield* Effect.fail(missingLiveOrgDep("orgSpendPort"));
 		const to = yield* Effect.try({
 			try: () => refToRecipientString(input.to),
-			catch: (cause) => isCapxulError(cause) ? cause : Errors.invalidInput("to", "invalid Ref")
+			catch: (cause) => isCapxulError$1(cause) ? cause : Errors.invalidInput("to", "invalid Ref")
 		});
 		const gated = yield* gateOneRun({
 			deps,
@@ -6933,7 +6017,7 @@ function batchPayrollProgram(orgId, input) {
 		const gated = [];
 		const recipients = yield* Effect.try({
 			try: () => input.runs.map((run) => refToRecipientString(run.to)),
-			catch: (cause) => isCapxulError(cause) ? cause : Errors.invalidInput("to", "invalid Ref")
+			catch: (cause) => isCapxulError$1(cause) ? cause : Errors.invalidInput("to", "invalid Ref")
 		});
 		let accumulatedRaw = 0n;
 		for (const [index, run] of input.runs.entries()) {
@@ -7045,6 +6129,32 @@ function makeOrgMethods(deps) {
 					});
 					return toCapxulResult(readTreasuryProgram(orgId), layer);
 				},
+				account: { async get(options) {
+					if (options?.signal?.aborted) return {
+						ok: false,
+						error: Errors.cancelled({ operation: "org.account.get" })
+					};
+					const treasury = await toCapxulResult(readTreasuryProgram(orgId), layer);
+					if (!treasury.ok) return {
+						ok: false,
+						error: treasury.error
+					};
+					const orgs = await toCapxulResult(listOrgsProgram(), layer);
+					if (!orgs.ok) return {
+						ok: false,
+						error: orgs.error
+					};
+					const org = orgs.value.find((candidate) => candidate.id === orgId);
+					return {
+						ok: true,
+						value: {
+							id: treasury.value.id,
+							address: org?.safeAddress ?? null,
+							balance: treasury.value.balance,
+							available: treasury.value.available
+						}
+					};
+				} },
 				members(_options) {
 					if (_options?.signal?.aborted) return Promise.resolve({
 						ok: false,
@@ -7073,20 +6183,6 @@ function makeOrgMethods(deps) {
 					});
 					return toCapxulResult(inviteMemberProgram(orgId, _input), layer);
 				},
-				pendingMembers(_options) {
-					if (_options?.signal?.aborted) return Promise.resolve({
-						ok: false,
-						error: Errors.cancelled({ operation: "org.pendingMembers" })
-					});
-					return toCapxulResult(pendingMembersProgram(orgId), layer);
-				},
-				inviteToken: { resend(_input, _options) {
-					if (_options?.signal?.aborted) return Promise.resolve({
-						ok: false,
-						error: Errors.cancelled({ operation: "org.inviteToken.resend" })
-					});
-					return toCapxulResult(resendInviteTokenProgram(orgId, String(_input.email)), layer);
-				} },
 				removeMember(_input, _options) {
 					if (_options?.signal?.aborted) return Promise.resolve({
 						ok: false,
@@ -7115,6 +6211,16 @@ function makeOrgMethods(deps) {
 					});
 					return toCapxulResult(batchPayrollProgram(orgId, _input), layer);
 				},
+				auditLog(_options) {
+					if (_options?.signal?.aborted) return Promise.resolve({
+						ok: false,
+						error: Errors.cancelled({ operation: "org.auditLog" })
+					});
+					return Promise.resolve({
+						ok: false,
+						error: Errors.notImplemented("organizationAuditLog", "list")
+					});
+				},
 				payroll: convexCall === void 0 ? makeNotImplementedPayrollMethods() : makePayrollMethods({
 					orgId: String(orgId),
 					convexCall
@@ -7231,7 +6337,7 @@ async function runCompletePersonalOnboarding(ops, input) {
 	const validated = validatePersonalInput(input);
 	if (!validated.ok) return validated;
 	const session = await ops.currentSession();
-	if (session === null) return fail(Errors.notAuthenticated());
+	if (session === null) return fail(Errors$1.notAuthenticated());
 	const written = await ops.completeIdentityOnboarding({
 		authUserId: session.authUserId,
 		email: session.email,
@@ -7254,7 +6360,7 @@ async function runCompleteOrganizationOnboarding(ops, input) {
 	const validated = validateOrganizationInput(input);
 	if (!validated.ok) return validated;
 	const session = await ops.currentSession();
-	if (session === null) return fail(Errors.notAuthenticated());
+	if (session === null) return fail(Errors$1.notAuthenticated());
 	const written = await ops.completeIdentityOnboarding({
 		authUserId: session.authUserId,
 		email: session.email,
@@ -7326,7 +6432,7 @@ function validateOrganizationInput(input) {
 }
 function requireNonEmpty(value, field) {
 	const trimmed = typeof value === "string" ? value.trim() : "";
-	if (trimmed.length === 0) return fail(Errors.invalidInput(field, "must be a non-empty string"));
+	if (trimmed.length === 0) return fail(Errors$1.invalidInput(field, "must be a non-empty string"));
 	return {
 		ok: true,
 		value: trimmed
@@ -7354,12 +6460,12 @@ function parseAddress(value, field) {
 }
 function invalidFrom(field, cause, fallback) {
 	const message = cause instanceof Error && cause.message.length > 0 ? cause.message : fallback;
-	return Errors.invalidInput(field, message);
+	return Errors$1.invalidInput(field, message);
 }
 function fail(error) {
 	return {
 		ok: false,
-		error: error instanceof CapxulError ? error : Errors.unknown(error)
+		error: error instanceof CapxulError$2 ? error : Errors$1.unknown(error)
 	};
 }
 //#endregion
@@ -7376,14 +6482,14 @@ function makeOnboardingMethods(ops) {
 		completePersonal(input, options) {
 			if (options?.signal?.aborted) return Promise.resolve({
 				ok: false,
-				error: Errors.cancelled({ operation: "onboarding.completePersonal" })
+				error: Errors$1.cancelled({ operation: "onboarding.completePersonal" })
 			});
 			return runCompletePersonalOnboarding(ops, input);
 		},
 		completeOrganization(input, options) {
 			if (options?.signal?.aborted) return Promise.resolve({
 				ok: false,
-				error: Errors.cancelled({ operation: "onboarding.completeOrganization" })
+				error: Errors$1.cancelled({ operation: "onboarding.completeOrganization" })
 			});
 			return runCompleteOrganizationOnboarding(ops, input);
 		}
@@ -7469,6 +6575,12 @@ function assembleCapxulClient(input) {
 	if (selectedOrgPort !== void 0) detectPendingOrgInvitations = async () => {
 		await orgMethods.orgs.detectAndAcceptPendingInvitations();
 	};
+	const currentUser = makeCurrentUserMethods({
+		me: financialOps.me,
+		accounts,
+		smartAccount,
+		orgs: orgMethods.orgs
+	});
 	const onboarding = makeOnboardingMethods({
 		currentSession: async () => {
 			const session = await currentSession(actor, authCache);
@@ -7489,11 +6601,15 @@ function assembleCapxulClient(input) {
 		identity,
 		account,
 		accounts,
+		currentUser,
 		me: financialOps.me,
 		handles: financialOps.handles,
 		payees: financialOps.payees,
+		targets: financialOps.targets,
 		destinations: financialOps.destinations,
 		payments: financialOps.payments,
+		activity: financialOps.activity,
+		offramp: financialOps.offramp,
 		paymentDocuments: financialOps.paymentDocuments,
 		paymentRequests: financialOps.paymentRequests,
 		workbench: financialOps.workbench,
@@ -7834,7 +6950,7 @@ function validateCreateCapxulClientInput(input) {
 	const runtime = input.runtime ?? detectRuntime();
 	if ((input.requirement ?? "none") === "deployed" && input.signer === void 0 && runtime !== "browser") return {
 		ok: false,
-		error: Errors.invalidInput("signer", "required when requirement is \"deployed\"")
+		error: Errors$1.invalidInput("signer", "required when requirement is \"deployed\"")
 	};
 	return {
 		ok: true,
@@ -7867,10 +6983,10 @@ function detectRuntime() {
 	return globalAny.window !== void 0 || globalAny.document !== void 0 ? "browser" : "node";
 }
 function derivedBrowserOrigin(runtime) {
-	if (runtime !== "browser") throw Errors.invalidInput("origin", "required outside browser runtime");
+	if (runtime !== "browser") throw Errors$1.invalidInput("origin", "required outside browser runtime");
 	const globalAny = globalThis;
 	if (typeof globalAny.location?.origin === "string" && globalAny.location.origin.length > 0) return globalAny.location.origin;
-	throw Errors.invalidInput("origin", "required when browser location is unavailable");
+	throw Errors$1.invalidInput("origin", "required when browser location is unavailable");
 }
 /**
 * Browser local dev serves `/api/auth` via the Vite proxy on `window.location.origin`
@@ -7939,20 +7055,20 @@ function normalizeHttpUrl(field, raw) {
 	try {
 		parsed = new URL(raw);
 	} catch {
-		throw Errors.invalidInput(field, "must be an http or https URL");
+		throw Errors$1.invalidInput(field, "must be an http or https URL");
 	}
-	if (parsed.protocol !== "http:" && parsed.protocol !== "https:") throw Errors.invalidInput(field, "must be an http or https URL");
+	if (parsed.protocol !== "http:" && parsed.protocol !== "https:") throw Errors$1.invalidInput(field, "must be an http or https URL");
 	return parsed.toString().replace(/\/$/, "");
 }
 function toPublicError(cause, operation) {
-	if (cause instanceof CapxulError) return cause;
+	if (cause instanceof CapxulError$2) return cause;
 	if (typeof cause === "object" && cause !== null) {
 		const publicError = cause.publicError;
-		if (publicError instanceof CapxulError) return publicError;
+		if (publicError instanceof CapxulError$2) return publicError;
 		const nestedCause = cause.cause;
-		if (nestedCause instanceof CapxulError) return nestedCause;
+		if (nestedCause instanceof CapxulError$2) return nestedCause;
 	}
-	return Errors.providerError("sdk-production-adapters", operation, cause);
+	return Errors$1.providerError("sdk-production-adapters", operation, cause);
 }
 function idempotentClose(close) {
 	let closed = false;
@@ -7969,6 +7085,6 @@ async function createCapxulClient(input) {
 	return createCapxulClient$1(input);
 }
 //#endregion
-export { captureException, captureExceptionSync, createCapxulClient, deriveDevPrivateKey, devPrivateKeySigner, eip1193AccountProvider, embeddedSigner, injectedWalletSigner, isSettingUpLifecycle, localPrivateKeyAccountProvider, openfortEmbeddedSigner, openfortEmbeddedSignerFromWallet, openfortEmbeddedWalletPort };
+export { CapxulError, captureException, captureExceptionSync, createCapxulClient, deriveDevPrivateKey, devPrivateKeySigner, eip1193AccountProvider, embeddedSigner, injectedWalletSigner, isCapxulError, isSettingUpLifecycle, localPrivateKeyAccountProvider, openfortEmbeddedSigner, openfortEmbeddedSignerFromWallet, openfortEmbeddedWalletPort };
 
 //# sourceMappingURL=index.mjs.map