@capxul/sdk 1.0.0-alpha.12 → 1.0.0-alpha.13

package/dist/index.mjs

@@ -1,17 +1,181 @@
-import { n as BrowserAuthCacheAdapter, o as AuthCachePortTag, t as InMemoryAuthCacheAdapter } from "./InMemoryAuthCacheAdapter-EBzKEJmQ.mjs";
-import { CapxulError, Errors, isCapxulError, isCapxulError as isCapxulError$1 } from "@capxul/errors";
-import { CapxulError as CapxulError$2, Errors as Errors$1, USDX_CURRENCY, USDX_DECIMALS, compileOrgRoleDefinitions, decodeConvexError, isCapxulError as isCapxulError$2, normalizeBindingEmail, orgRoleKeyForLabel, orgRoleTemplateDefinitions } from "@capxul/config";
-import { toAccountId, toAddress, toAllowedOrigin, toAnonymousDistinctId, toAppId, toAuthUserId, toChainId, toCountryCode, toCurrencyCode, toDurationMs, toEmail, toEpochMs, toEpochSeconds, toJwtToken, toKycTier, toOrgId, toPublishableKey, toPublishableKeyId, toRoleKey, toSessionToken, toSubAccountId } from "@capxul/types";
+import { A as toSessionToken, C as toEpochSeconds, D as toPublishableKey, E as toOrgId, F as isCapxulError, M as decodeConvexError, N as CapxulError, O as toPublishableKeyId, P as Errors, S as toEpochMs, T as toKycTier, _ as toChainId, b as toDurationMs, c as BYTES32_RE, d as toAccountId, f as toAddress, g as toAuthUserId, h as toAppId, j as toSubAccountId, k as toRoleKey, l as EVM_ADDRESS_RE$1, m as toAnonymousDistinctId, n as BrowserAuthCacheAdapter, o as AuthCachePortTag, p as toAllowedOrigin, s as APP_ID_RE, t as InMemoryAuthCacheAdapter, u as SUPPORTED_CURRENCY_CODES, v as toCountryCode, w as toJwtToken, x as toEmail, y as toCurrencyCode } from "./InMemoryAuthCacheAdapter-v5W-XB5M.mjs";
+import { formatUnits, keccak256, padHex, parseUnits, recoverAddress, stringToHex, toBytes } from "viem";
 import { Context, Data, Deferred, Duration, Effect, Either, Exit, Layer, Ref, Request, Scope } from "effect";
 import { getFunctionName, makeFunctionReference } from "convex/server";
 import { privateKeyToAccount } from "viem/accounts";
-import { formatUnits, keccak256, parseUnits, recoverAddress, stringToHex } from "viem";
 import { Schema, TreeFormatter } from "@effect/schema";
-import { BootstrapEnvelope } from "@capxul/wire";
 import { ConvexClient } from "convex/browser";
-import { redactTelemetryProps } from "@capxul/observability";
 import { AccountTypeEnum, ChainTypeEnum, EmbeddedState, Openfort, RecoveryMethod, ThirdPartyOAuthProvider } from "@openfort/openfort-js";
 import { Machine } from "@effect/experimental";
+//#region ../config/src/tokens.ts
+/** `TestUSDC` ("USDX") — Base Sepolia, 6 decimals, open `mint`. (Canon §1.) */
+const USDX_ADDRESS_BASE_SEPOLIA = "0xf09fcbb6df9f8f918e58f9c8ab15a76ade862b77";
+USDX_ADDRESS_BASE_SEPOLIA.toLowerCase();
+//#endregion
+//#region ../config/src/safe.ts
+const BASE_SEPOLIA_CHAIN_ID = 84532;
+/**
+* Normalize an email for use as a Capxul Safe salt input.
+*
+* Trims surrounding whitespace and lowercases the address so that
+* `"  User+Demo@Example.COM  "` and `"user+demo@example.com"` derive
+* the same `safeAddress`. This is the canonical normalization rule —
+* any future change here would shift every existing user's Safe
+* address, so the rule is pinned by the fixture matrix in
+* `packages/config/tests/safe-address-conformance.test.ts`.
+*
+* @param email - The raw email address to normalize
+* @returns The trimmed, lowercased email
+*/
+function normalizeSafeSaltEmail(email) {
+	return email.trim().toLowerCase();
+}
+/**
+* Normalize a raw email for binding id + Safe salt derivation.
+* Delegates to {@link normalizeSafeSaltEmail} so binding resolution and
+* `deriveCapxulSafeAddress` never drift apart.
+*/
+function normalizeBindingEmail(email) {
+	return normalizeSafeSaltEmail(email);
+}
+//#endregion
+//#region ../config/src/route.ts
+/** USDX on Base Sepolia — the only settlement token in v1. */
+const USDX_BASE_SEPOLIA_TOKEN = {
+	chainId: BASE_SEPOLIA_CHAIN_ID,
+	address: USDX_ADDRESS_BASE_SEPOLIA,
+	decimals: 6
+};
+USDX_BASE_SEPOLIA_TOKEN.chainId;
+USDX_BASE_SEPOLIA_TOKEN.chainId;
+//#endregion
+//#region ../config/src/role-dsl.ts
+const USD_DECIMALS = 6;
+const USD_SCALE = 10n ** BigInt(USD_DECIMALS);
+const USD_DISPLAY_RE = /^\d+(?:\.\d{1,6})?$/;
+const USD_BASE_UNIT_RE = /^\d+$/;
+const EXEC_TRANSACTION_WITH_ROLE = "zodiac.roles.execTransactionWithRole";
+const ASSIGN_ROLES = "zodiac.roles.assignRoles";
+const SCOPE_TARGET = "zodiac.roles.scopeTarget";
+const OWNER_ROLE_LABEL = "Owner";
+const MARKETING_SUB_ACCOUNT_ID = "subaccount_marketing";
+const PAYROLL_SUB_ACCOUNT_ID = "subaccount_payroll";
+function usd(value) {
+	return {
+		currency: "USD",
+		value: usdDisplayToBaseUnits(value),
+		decimals: USD_DECIMALS
+	};
+}
+function usdDisplayToBaseUnits(value) {
+	if (value.trim() !== value || !USD_DISPLAY_RE.test(value)) throw Errors.invalidInput("role.spend", "USD caps must be unsigned decimal strings with at most 6 fractional digits");
+	const parts = value.split(".");
+	const whole = parts[0] ?? "0";
+	const fraction = parts[1] ?? "";
+	return (BigInt(whole) * USD_SCALE + BigInt(fraction.padEnd(USD_DECIMALS, "0"))).toString();
+}
+function normalizeOrgRoleMoney(money, field) {
+	if (money.currency !== "USD" || money.decimals !== USD_DECIMALS || !USD_BASE_UNIT_RE.test(money.value)) throw Errors.invalidInput(field, `must be USD base units with ${USD_DECIMALS} decimals`);
+	return money;
+}
+function normalizeOrgRoleSpendCap(spend) {
+	if (spend === void 0) return void 0;
+	return {
+		...spend.perTx === void 0 ? {} : { perTx: normalizeOrgRoleMoney(spend.perTx, "roles.spend.perTx") },
+		...spend.perDay === void 0 ? {} : { perDay: normalizeOrgRoleMoney(spend.perDay, "roles.spend.perDay") },
+		...spend.toRecipients === void 0 ? {} : { toRecipients: spend.toRecipients }
+	};
+}
+function normalizeOrgRoleLabel(label) {
+	const normalized = label.trim().replace(/\s+/g, " ");
+	if (normalized.length === 0) throw Errors.invalidInput("role.label", "must be a non-empty role label");
+	return normalized;
+}
+function orgRoleKeyForLabel(label) {
+	return keccak256(toBytes(normalizeOrgRoleLabel(label).toLowerCase()));
+}
+function soloOrgRoleTemplate() {
+	return [{
+		label: "Owner",
+		subAccounts: { scope: "all" },
+		canManageMembers: true,
+		canManageRoles: true
+	}];
+}
+function startupOrgRoleTemplate() {
+	return [
+		...soloOrgRoleTemplate(),
+		{
+			label: "Finance Manager",
+			spend: {
+				perTx: usd("25000"),
+				perDay: usd("100000"),
+				toRecipients: "anyone"
+			},
+			subAccounts: { scope: [MARKETING_SUB_ACCOUNT_ID] }
+		},
+		{
+			label: "Team Lead",
+			spend: {
+				perTx: usd("5000"),
+				perDay: usd("15000"),
+				toRecipients: "anyone"
+			},
+			subAccounts: { scope: [PAYROLL_SUB_ACCOUNT_ID] }
+		}
+	];
+}
+function orgRoleTemplateDefinitions(template, customRoles = []) {
+	switch (template) {
+		case "Solo": return soloOrgRoleTemplate();
+		case "Startup": return startupOrgRoleTemplate();
+		case "Custom": return customRoles.length === 0 ? soloOrgRoleTemplate() : customRoles;
+		default: return template;
+	}
+}
+function compileOrgRoleDefinitions(definitions) {
+	if (definitions.length === 0) throw Errors.invalidInput("roles", "must include at least one role");
+	const seen = /* @__PURE__ */ new Set();
+	const roles = definitions.map((definition) => {
+		const label = normalizeOrgRoleLabel(definition.label);
+		const roleKey = orgRoleKeyForLabel(label);
+		if (seen.has(roleKey)) throw Errors.invalidInput("roles", `duplicate role label: ${label}`);
+		seen.add(roleKey);
+		const spend = normalizeOrgRoleSpendCap(definition.spend);
+		const permissions = [];
+		if (spend !== void 0 || label === OWNER_ROLE_LABEL) permissions.push(EXEC_TRANSACTION_WITH_ROLE);
+		if (definition.canManageMembers === true) permissions.push(ASSIGN_ROLES);
+		if (definition.canManageRoles === true) permissions.push(SCOPE_TARGET);
+		return {
+			label,
+			roleKey,
+			definition: {
+				...definition,
+				label,
+				...spend === void 0 ? {} : { spend }
+			},
+			permissions,
+			allowance: spend ?? null
+		};
+	});
+	const manager = roles.find((role) => role.definition.canManageMembers === true);
+	if (manager === void 0) throw Errors.invalidInput("roles.canManageMembers", "at least one role must compile to the on-chain member-management permission");
+	return {
+		roles,
+		memberManagementRole: {
+			roleKey: manager.roleKey,
+			permission: ASSIGN_ROLES
+		}
+	};
+}
+padHex(stringToHex("FM_DAILY"), {
+	size: 32,
+	dir: "right"
+}), padHex(stringToHex("TL_DAILY"), {
+	size: 32,
+	dir: "right"
+});
+//#endregion
 //#region src/telemetry/stack-frame-parser.ts
 /**
 * Regex for V8/Chrome stack trace frame lines.
@@ -101,7 +265,7 @@ function isFailureMode(value) {
 * unrecognised cause.
 */
 function getFailureMode(error) {
-	if (!isCapxulError$2(error)) return void 0;
+	if (!isCapxulError(error)) return void 0;
 	const details = error.details;
 	if (details === void 0) return void 0;
 	return isFailureMode(details.failure_mode) ? details.failure_mode : void 0;
@@ -138,7 +302,7 @@ function resolveFailureMode(error, contextFailureMode) {
 function captureException(telemetry, error, context) {
 	return Effect.catchAllDefect(Effect.sync(() => {
 		const exceptionList = buildExceptionList(error instanceof Error ? parseV8StackFrames(error) : []);
-		const capxulError = isCapxulError$2(error) ? error : null;
+		const capxulError = isCapxulError(error) ? error : null;
 		const props = {
 			capxul_error_code: capxulError?.code ?? context?.capxul_error_code ?? "UNKNOWN",
 			layer: capxulError?.layer ?? context?.layer,
@@ -245,7 +409,7 @@ const accountStatusProgram = Effect.gen(function* () {
 	};
 	const signerAddress = yield* Effect.tryPromise({
 		try: () => signer.getAddress(),
-		catch: (cause) => isCapxulError$2(cause) ? cause : Errors$1.providerError("signer", "getAddress", cause)
+		catch: (cause) => isCapxulError(cause) ? cause : Errors.providerError("signer", "getAddress", cause)
 	});
 	return {
 		status: "accountProviderReady",
@@ -926,7 +1090,7 @@ function refLabel(ref) {
 //#endregion
 //#region src/client/to-capxul-result.ts
 async function toCapxulResult(program, layer) {
-	const result = await Effect.runPromise(program.pipe(Effect.provide(layer), Effect.catchAllDefect((defect) => Effect.fail(Errors$1.unknown(defect))), Effect.either));
+	const result = await Effect.runPromise(program.pipe(Effect.provide(layer), Effect.catchAllDefect((defect) => Effect.fail(Errors.unknown(defect))), Effect.either));
 	if (Either.isLeft(result)) return {
 		ok: false,
 		error: result.left
@@ -955,13 +1119,13 @@ function makeAccountMethods(deps) {
 				value: void 0
 			};
 		} catch (cause) {
-			if (cause instanceof CapxulError$2) return {
+			if (cause instanceof CapxulError) return {
 				ok: false,
 				error: cause
 			};
 			return {
 				ok: false,
-				error: Errors$1.providerError("signer", "getAddress", cause)
+				error: Errors.providerError("signer", "getAddress", cause)
 			};
 		}
 	};
@@ -992,7 +1156,7 @@ function makeAccountMethods(deps) {
 		const session = await currentSession(deps.actor, deps.authCache);
 		if (session === null) return {
 			ok: false,
-			error: Errors$1.notAuthenticated()
+			error: Errors.notAuthenticated()
 		};
 		const profileReady = await ensureIdentityProfile(session);
 		if (!profileReady.ok) return {
@@ -1015,12 +1179,12 @@ function makeAccountMethods(deps) {
 		const session = await currentSession(deps.actor, deps.authCache);
 		if (session === null) return {
 			ok: false,
-			error: Errors$1.notAuthenticated()
+			error: Errors.notAuthenticated()
 		};
 		const signer = deps.signer;
 		if (signer === void 0) return {
 			ok: false,
-			error: Errors$1.smartAccountMissing("deploySafe")
+			error: Errors.smartAccountMissing("deploySafe")
 		};
 		const existing = await runPortEffect(deps.smartAccountPort.loadByAuthUserId(session.authUserId));
 		if (!existing.ok) return existing;
@@ -1093,7 +1257,7 @@ function makeAccountMethods(deps) {
 		let accountId;
 		if (status.value.status !== "notAuthenticated" && (phase.status === "ready" || isRequirementMet(status.value, requirement))) {
 			const accountReadPort = deps.accountReadPort;
-			if (accountReadPort === void 0) return reportAndReturn(Errors$1.invalidInput("account", "accountReadPort is required to resolve ready lifecycle"));
+			if (accountReadPort === void 0) return reportAndReturn(Errors.invalidInput("account", "accountReadPort is required to resolve ready lifecycle"));
 			const account = await runPortEffect(accountReadPort.readBalance({ chainId: toChainId(deps.chainId) }));
 			if (!account.ok) return reportAndReturn(account.error);
 			accountId = String(account.value.id);
@@ -1154,7 +1318,7 @@ async function runBackendClaim(input) {
 	} catch (cause) {
 		return {
 			ok: false,
-			error: Errors$1.providerError("signer", "getAddress", cause)
+			error: Errors.providerError("signer", "getAddress", cause)
 		};
 	}
 	const claimed = await runPortEffect(input.smartAccountPort.claim({
@@ -1203,7 +1367,7 @@ function eip1193AccountProvider(input) {
 				const first = firstAccount(await input.provider.request({ method: "eth_accounts" }));
 				if (first === null) return {
 					ok: false,
-					error: Errors$1.smartAccountMissing("eip1193-account")
+					error: Errors.smartAccountMissing("eip1193-account")
 				};
 				const address = toAddress(first);
 				cachedAddress = address;
@@ -1214,7 +1378,7 @@ function eip1193AccountProvider(input) {
 			} catch (err) {
 				return {
 					ok: false,
-					error: Errors$1.providerError("eip1193", "eth_accounts", err)
+					error: Errors.providerError("eip1193", "eth_accounts", err)
 				};
 			} finally {
 				inFlight = null;
@@ -1228,7 +1392,7 @@ function eip1193AccountProvider(input) {
 		async getDeployAccount() {
 			return {
 				ok: false,
-				error: Errors$1.notImplemented("Eip1193AccountProvider", "getDeployAccount")
+				error: Errors.notImplemented("Eip1193AccountProvider", "getDeployAccount")
 			};
 		}
 	};
@@ -1436,7 +1600,7 @@ async function recoverRawDigestSigner(input) {
 }
 //#endregion
 //#region package.json
-var version = "1.0.0-alpha.12";
+var version = "1.0.0-alpha.13";
 //#endregion
 //#region src/ports/auth-client.ts
 var AuthClientError = class extends Data.TaggedError("AuthClientError") {};
@@ -1523,18 +1687,18 @@ function mapBetterAuthError(operation, body) {
 	if (typeof body === "object" && body !== null) {
 		const errBody = body;
 		const code = typeof errBody.code === "string" ? errBody.code : "";
-		if (code === "OTP_EXPIRED") return Errors$1.otpExpired();
-		if (code === "INVALID_OTP") return Errors$1.invalidInput("otp", errBody.message ?? "invalid OTP");
-		if (code === "VALIDATION_ERROR" || code === "INVALID_EMAIL") return Errors$1.invalidInput("email", errBody.message ?? "invalid email");
+		if (code === "OTP_EXPIRED") return Errors.otpExpired();
+		if (code === "INVALID_OTP") return Errors.invalidInput("otp", errBody.message ?? "invalid OTP");
+		if (code === "VALIDATION_ERROR" || code === "INVALID_EMAIL") return Errors.invalidInput("email", errBody.message ?? "invalid email");
 	}
-	return Errors$1.providerError("better-auth", operation, new Error(String(body)));
+	return Errors.providerError("better-auth", operation, new Error(String(body)));
 }
 function isAbortError$1(err, signal) {
 	return signal?.aborted === true || err instanceof Error && err.name === "AbortError" || typeof DOMException !== "undefined" && err instanceof DOMException && err.name === "AbortError";
 }
 function mapFetchError$1(operation, err, signal) {
-	if (isAbortError$1(err, signal)) return Errors$1.cancelled({ operation });
-	return Errors$1.networkError(operation, err instanceof Error ? err : new Error(String(err)));
+	if (isAbortError$1(err, signal)) return Errors.cancelled({ operation });
+	return Errors.networkError(operation, err instanceof Error ? err : new Error(String(err)));
 }
 var BetterAuthBrowserAdapter = class {
 	authBaseUrl;
@@ -1549,7 +1713,7 @@ var BetterAuthBrowserAdapter = class {
 	async canSendOtp(_input, options) {
 		if (options?.signal?.aborted) return {
 			ok: false,
-			error: Errors$1.cancelled({ operation: "canSendOtp" })
+			error: Errors.cancelled({ operation: "canSendOtp" })
 		};
 		return {
 			ok: true,
@@ -1562,7 +1726,7 @@ var BetterAuthBrowserAdapter = class {
 	async sendOtp(input, options) {
 		if (options?.signal?.aborted) return {
 			ok: false,
-			error: Errors$1.cancelled({ operation: "sendOtp" })
+			error: Errors.cancelled({ operation: "sendOtp" })
 		};
 		try {
 			const res = await this.fetchImpl(this.url("/api/auth/email-otp/send-verification-otp"), withSignal$1({
@@ -1576,7 +1740,7 @@ var BetterAuthBrowserAdapter = class {
 			}, options?.signal));
 			if (options?.signal?.aborted) return {
 				ok: false,
-				error: Errors$1.cancelled({ operation: "sendOtp" })
+				error: Errors.cancelled({ operation: "sendOtp" })
 			};
 			if (res.ok) return {
 				ok: true,
@@ -1584,19 +1748,19 @@ var BetterAuthBrowserAdapter = class {
 			};
 			if (res.status === 429) return {
 				ok: false,
-				error: Errors$1.rateLimited({ resource: "better-auth/sendOtp" })
+				error: Errors.rateLimited({ resource: "better-auth/sendOtp" })
 			};
 			const body = await safeJson$1(res);
 			if (typeof body === "object" && body !== null) {
 				const errBody = body;
 				if (errBody.code === "INVALID_EMAIL" || errBody.code === "VALIDATION_ERROR") return {
 					ok: false,
-					error: Errors$1.invalidInput("email", errBody.message ?? "invalid email")
+					error: Errors.invalidInput("email", errBody.message ?? "invalid email")
 				};
 			}
 			return {
 				ok: false,
-				error: Errors$1.providerError("better-auth", "sendOtp", /* @__PURE__ */ new Error(`HTTP ${res.status}`))
+				error: Errors.providerError("better-auth", "sendOtp", /* @__PURE__ */ new Error(`HTTP ${res.status}`))
 			};
 		} catch (err) {
 			return {
@@ -1608,7 +1772,7 @@ var BetterAuthBrowserAdapter = class {
 	async verifyOtp(input, options) {
 		if (options?.signal?.aborted) return {
 			ok: false,
-			error: Errors$1.cancelled({ operation: "verifyOtp" })
+			error: Errors.cancelled({ operation: "verifyOtp" })
 		};
 		try {
 			const res = await this.fetchImpl(this.url("/api/auth/sign-in/email-otp"), withSignal$1({
@@ -1622,7 +1786,7 @@ var BetterAuthBrowserAdapter = class {
 			}, options?.signal));
 			if (options?.signal?.aborted) return {
 				ok: false,
-				error: Errors$1.cancelled({ operation: "verifyOtp" })
+				error: Errors.cancelled({ operation: "verifyOtp" })
 			};
 			const body = await safeJson$1(res);
 			if (res.ok) {
@@ -1635,7 +1799,7 @@ var BetterAuthBrowserAdapter = class {
 				}
 				return {
 					ok: false,
-					error: Errors$1.providerError("better-auth", "verifyOtp", /* @__PURE__ */ new Error("unexpected 200 body"))
+					error: Errors.providerError("better-auth", "verifyOtp", /* @__PURE__ */ new Error("unexpected 200 body"))
 				};
 			}
 			return {
@@ -1652,7 +1816,7 @@ var BetterAuthBrowserAdapter = class {
 	async getSession(options) {
 		if (options?.signal?.aborted) return {
 			ok: false,
-			error: Errors$1.cancelled({ operation: "getSession" })
+			error: Errors.cancelled({ operation: "getSession" })
 		};
 		try {
 			const res = await this.fetchImpl(this.url("/api/auth/get-session"), withSignal$1({
@@ -1661,11 +1825,11 @@ var BetterAuthBrowserAdapter = class {
 			}, options?.signal));
 			if (options?.signal?.aborted) return {
 				ok: false,
-				error: Errors$1.cancelled({ operation: "getSession" })
+				error: Errors.cancelled({ operation: "getSession" })
 			};
 			if (!res.ok) return {
 				ok: false,
-				error: Errors$1.providerError("better-auth", "getSession", /* @__PURE__ */ new Error(`HTTP ${res.status}`))
+				error: Errors.providerError("better-auth", "getSession", /* @__PURE__ */ new Error(`HTTP ${res.status}`))
 			};
 			const body = await safeJson$1(res);
 			if (body === null) return {
@@ -1693,7 +1857,7 @@ var BetterAuthBrowserAdapter = class {
 	async signOut(options) {
 		if (options?.signal?.aborted) return {
 			ok: false,
-			error: Errors$1.cancelled({ operation: "signOut" })
+			error: Errors.cancelled({ operation: "signOut" })
 		};
 		try {
 			const res = await this.fetchImpl(this.url("/api/auth/sign-out"), withSignal$1({
@@ -1704,7 +1868,7 @@ var BetterAuthBrowserAdapter = class {
 			}, options?.signal));
 			if (options?.signal?.aborted) return {
 				ok: false,
-				error: Errors$1.cancelled({ operation: "signOut" })
+				error: Errors.cancelled({ operation: "signOut" })
 			};
 			if (res.ok) return {
 				ok: true,
@@ -1712,7 +1876,7 @@ var BetterAuthBrowserAdapter = class {
 			};
 			return {
 				ok: false,
-				error: Errors$1.providerError("better-auth", "signOut", /* @__PURE__ */ new Error(`HTTP ${res.status}`))
+				error: Errors.providerError("better-auth", "signOut", /* @__PURE__ */ new Error(`HTTP ${res.status}`))
 			};
 		} catch (err) {
 			return {
@@ -1724,7 +1888,7 @@ var BetterAuthBrowserAdapter = class {
 	async getConvexJwt(options) {
 		if (options?.signal?.aborted) return {
 			ok: false,
-			error: Errors$1.cancelled({ operation: "getConvexJwt" })
+			error: Errors.cancelled({ operation: "getConvexJwt" })
 		};
 		try {
 			const res = await this.fetchImpl(this.url("/api/auth/convex/token"), withSignal$1({
@@ -1733,15 +1897,15 @@ var BetterAuthBrowserAdapter = class {
 			}, options?.signal));
 			if (options?.signal?.aborted) return {
 				ok: false,
-				error: Errors$1.cancelled({ operation: "getConvexJwt" })
+				error: Errors.cancelled({ operation: "getConvexJwt" })
 			};
 			if (res.status === 401) return {
 				ok: false,
-				error: Errors$1.notAuthenticated()
+				error: Errors.notAuthenticated()
 			};
 			if (!res.ok) return {
 				ok: false,
-				error: Errors$1.providerError("better-auth", "getConvexJwt", /* @__PURE__ */ new Error(`HTTP ${res.status}`))
+				error: Errors.providerError("better-auth", "getConvexJwt", /* @__PURE__ */ new Error(`HTTP ${res.status}`))
 			};
 			const body = await safeJson$1(res);
 			if (typeof body === "object" && body !== null) {
@@ -1756,7 +1920,7 @@ var BetterAuthBrowserAdapter = class {
 			}
 			return {
 				ok: false,
-				error: Errors$1.providerError("better-auth", "getConvexJwt", /* @__PURE__ */ new Error("unexpected body"))
+				error: Errors.providerError("better-auth", "getConvexJwt", /* @__PURE__ */ new Error("unexpected body"))
 			};
 		} catch (err) {
 			return {
@@ -1932,8 +2096,8 @@ function isAbortError(err, signal) {
 	return signal?.aborted === true || err instanceof Error && err.name === "AbortError" || typeof DOMException !== "undefined" && err instanceof DOMException && err.name === "AbortError";
 }
 function mapFetchError(operation, err, signal) {
-	if (isAbortError(err, signal)) return Errors$1.cancelled({ operation });
-	return Errors$1.networkError(operation, err instanceof Error ? err : new Error(String(err)));
+	if (isAbortError(err, signal)) return Errors.cancelled({ operation });
+	return Errors.networkError(operation, err instanceof Error ? err : new Error(String(err)));
 }
 var BetterAuthNodeAdapter = class {
 	authBaseUrl;
@@ -1961,7 +2125,7 @@ var BetterAuthNodeAdapter = class {
 	async canSendOtp(_input, options) {
 		if (options?.signal?.aborted) return {
 			ok: false,
-			error: Errors$1.cancelled({ operation: "canSendOtp" })
+			error: Errors.cancelled({ operation: "canSendOtp" })
 		};
 		return {
 			ok: true,
@@ -1974,7 +2138,7 @@ var BetterAuthNodeAdapter = class {
 	async sendOtp(input, options) {
 		if (options?.signal?.aborted) return {
 			ok: false,
-			error: Errors$1.cancelled({ operation: "sendOtp" })
+			error: Errors.cancelled({ operation: "sendOtp" })
 		};
 		try {
 			const res = await this.fetchImpl(this.url("/api/auth/email-otp/send-verification-otp"), withSignal({
@@ -1990,7 +2154,7 @@ var BetterAuthNodeAdapter = class {
 			}, options?.signal));
 			if (options?.signal?.aborted) return {
 				ok: false,
-				error: Errors$1.cancelled({ operation: "sendOtp" })
+				error: Errors.cancelled({ operation: "sendOtp" })
 			};
 			if (res.ok) return {
 				ok: true,
@@ -1998,19 +2162,19 @@ var BetterAuthNodeAdapter = class {
 			};
 			if (res.status === 429) return {
 				ok: false,
-				error: Errors$1.rateLimited({ resource: "better-auth/sendOtp" })
+				error: Errors.rateLimited({ resource: "better-auth/sendOtp" })
 			};
 			const body = await safeJson(res);
 			if (typeof body === "object" && body !== null) {
 				const errBody = body;
 				if (errBody.code === "INVALID_EMAIL" || errBody.code === "VALIDATION_ERROR") return {
 					ok: false,
-					error: Errors$1.invalidInput("email", errBody.message ?? "invalid email")
+					error: Errors.invalidInput("email", errBody.message ?? "invalid email")
 				};
 			}
 			return {
 				ok: false,
-				error: Errors$1.providerError("better-auth", "sendOtp", /* @__PURE__ */ new Error(`HTTP ${res.status}`))
+				error: Errors.providerError("better-auth", "sendOtp", /* @__PURE__ */ new Error(`HTTP ${res.status}`))
 			};
 		} catch (err) {
 			return {
@@ -2022,7 +2186,7 @@ var BetterAuthNodeAdapter = class {
 	async verifyOtp(input, options) {
 		if (options?.signal?.aborted) return {
 			ok: false,
-			error: Errors$1.cancelled({ operation: "verifyOtp" })
+			error: Errors.cancelled({ operation: "verifyOtp" })
 		};
 		try {
 			const res = await this.fetchImpl(this.url("/api/auth/sign-in/email-otp"), withSignal({
@@ -2038,7 +2202,7 @@ var BetterAuthNodeAdapter = class {
 			}, options?.signal));
 			if (options?.signal?.aborted) return {
 				ok: false,
-				error: Errors$1.cancelled({ operation: "verifyOtp" })
+				error: Errors.cancelled({ operation: "verifyOtp" })
 			};
 			setCookiesFromResponse(this.cookieJar, this.host, res);
 			const body = await safeJson(res);
@@ -2054,17 +2218,17 @@ var BetterAuthNodeAdapter = class {
 					const errBody = body;
 					if (errBody.code === "OTP_EXPIRED") return {
 						ok: false,
-						error: Errors$1.otpExpired()
+						error: Errors.otpExpired()
 					};
 					if (errBody.code === "INVALID_OTP") return {
 						ok: false,
-						error: Errors$1.invalidInput("otp", errBody.message ?? "invalid OTP")
+						error: Errors.invalidInput("otp", errBody.message ?? "invalid OTP")
 					};
 				}
 			}
 			return {
 				ok: false,
-				error: Errors$1.providerError("better-auth", "verifyOtp", /* @__PURE__ */ new Error(`HTTP ${res.status}`))
+				error: Errors.providerError("better-auth", "verifyOtp", /* @__PURE__ */ new Error(`HTTP ${res.status}`))
 			};
 		} catch (err) {
 			return {
@@ -2076,7 +2240,7 @@ var BetterAuthNodeAdapter = class {
 	async getSession(options) {
 		if (options?.signal?.aborted) return {
 			ok: false,
-			error: Errors$1.cancelled({ operation: "getSession" })
+			error: Errors.cancelled({ operation: "getSession" })
 		};
 		try {
 			const res = await this.fetchImpl(this.url("/api/auth/get-session"), withSignal({
@@ -2085,11 +2249,11 @@ var BetterAuthNodeAdapter = class {
 			}, options?.signal));
 			if (options?.signal?.aborted) return {
 				ok: false,
-				error: Errors$1.cancelled({ operation: "getSession" })
+				error: Errors.cancelled({ operation: "getSession" })
 			};
 			if (!res.ok) return {
 				ok: false,
-				error: Errors$1.providerError("better-auth", "getSession", /* @__PURE__ */ new Error(`HTTP ${res.status}`))
+				error: Errors.providerError("better-auth", "getSession", /* @__PURE__ */ new Error(`HTTP ${res.status}`))
 			};
 			const body = await safeJson(res);
 			if (body === null) return {
@@ -2117,7 +2281,7 @@ var BetterAuthNodeAdapter = class {
 	async signOut(options) {
 		if (options?.signal?.aborted) return {
 			ok: false,
-			error: Errors$1.cancelled({ operation: "signOut" })
+			error: Errors.cancelled({ operation: "signOut" })
 		};
 		try {
 			const signOutOrigin = originFromBaseUrl(this.authBaseUrl) ?? this.origin;
@@ -2131,7 +2295,7 @@ var BetterAuthNodeAdapter = class {
 			}, options?.signal));
 			if (options?.signal?.aborted) return {
 				ok: false,
-				error: Errors$1.cancelled({ operation: "signOut" })
+				error: Errors.cancelled({ operation: "signOut" })
 			};
 			setCookiesFromResponse(this.cookieJar, this.host, res);
 			if (res.ok) return {
@@ -2140,7 +2304,7 @@ var BetterAuthNodeAdapter = class {
 			};
 			return {
 				ok: false,
-				error: Errors$1.providerError("better-auth", "signOut", /* @__PURE__ */ new Error(`HTTP ${res.status}`))
+				error: Errors.providerError("better-auth", "signOut", /* @__PURE__ */ new Error(`HTTP ${res.status}`))
 			};
 		} catch (err) {
 			return {
@@ -2152,7 +2316,7 @@ var BetterAuthNodeAdapter = class {
 	async getConvexJwt(options) {
 		if (options?.signal?.aborted) return {
 			ok: false,
-			error: Errors$1.cancelled({ operation: "getConvexJwt" })
+			error: Errors.cancelled({ operation: "getConvexJwt" })
 		};
 		try {
 			const res = await this.fetchImpl(this.url("/api/auth/convex/token"), withSignal({
@@ -2161,15 +2325,15 @@ var BetterAuthNodeAdapter = class {
 			}, options?.signal));
 			if (options?.signal?.aborted) return {
 				ok: false,
-				error: Errors$1.cancelled({ operation: "getConvexJwt" })
+				error: Errors.cancelled({ operation: "getConvexJwt" })
 			};
 			if (res.status === 401) return {
 				ok: false,
-				error: Errors$1.notAuthenticated()
+				error: Errors.notAuthenticated()
 			};
 			if (!res.ok) return {
 				ok: false,
-				error: Errors$1.providerError("better-auth", "getConvexJwt", /* @__PURE__ */ new Error(`HTTP ${res.status}`))
+				error: Errors.providerError("better-auth", "getConvexJwt", /* @__PURE__ */ new Error(`HTTP ${res.status}`))
 			};
 			const body = await safeJson(res);
 			if (typeof body === "object" && body !== null) {
@@ -2184,7 +2348,7 @@ var BetterAuthNodeAdapter = class {
 			}
 			return {
 				ok: false,
-				error: Errors$1.providerError("better-auth", "getConvexJwt", /* @__PURE__ */ new Error("unexpected body"))
+				error: Errors.providerError("better-auth", "getConvexJwt", /* @__PURE__ */ new Error("unexpected body"))
 			};
 		} catch (err) {
 			return {
@@ -2198,6 +2362,377 @@ function BetterAuthNodeLayer(deps) {
 	return Layer.succeed(AuthClientPortTag, authClientPortFromPromiseAdapter(new BetterAuthNodeAdapter(deps)));
 }
 //#endregion
+//#region ../wire/src/brands.ts
+/**
+* `AppId` schema. Mirrors `toAppId` from `@capxul/types`:
+* `app_` + Crockford-base32 ULID (26 chars, first char in `[0-7]`).
+*/
+const AppIdSchema$1 = Schema.String.pipe(Schema.filter((s) => APP_ID_RE.test(s), { message: () => "must be app_ plus a ULID" }));
+/**
+* `ChainId` schema. Mirrors `toChainId`: positive safe integer.
+*/
+const ChainIdSchema$1 = Schema.Number.pipe(Schema.filter((n) => Number.isSafeInteger(n) && n > 0, { message: () => "must be a positive safe integer" }));
+/**
+* `CurrencyCode` schema. Mirrors `toCurrencyCode`: currently supported
+* consumer-facing ISO-ish currency code set.
+*/
+const CurrencyCodeSchema$1 = Schema.String.pipe(Schema.filter((s) => SUPPORTED_CURRENCY_CODES.includes(s), { message: () => "must be a supported currency code" }));
+const DOCUMENT_HASH_HEX_RE = /^[0-9a-fA-F]{64}$/;
+/**
+* `DocumentHash` schema. Mirrors `toDocumentHash`: bare or 0x-prefixed bytes32,
+* normalized to lowercase 0x-prefixed form.
+*/
+const DocumentHashSchema$1 = Schema.String.pipe(Schema.transform(Schema.String, {
+	decode: (s) => {
+		const stripped = s.startsWith("0x") || s.startsWith("0X") ? s.slice(2) : s;
+		return DOCUMENT_HASH_HEX_RE.test(stripped) ? `0x${stripped.toLowerCase()}` : s;
+	},
+	encode: (s) => s
+}), Schema.filter((s) => BYTES32_RE.test(s), { message: () => "must be 32 bytes of hex" }));
+/**
+* `SessionToken` schema. Mirrors `toSessionToken`: non-empty string.
+* Issuance source distinguishes SDK-handshake tokens from auth-session
+* tokens; the brand itself is opaque.
+*/
+const SessionTokenSchema = Schema.String.pipe(Schema.filter((s) => s.length > 0, { message: () => "must be a non-empty string" }));
+/**
+* `EpochMs` schema. Mirrors `toEpochMs`: non-negative safe integer.
+*/
+const EpochMsSchema$1 = Schema.Number.pipe(Schema.filter((n) => Number.isSafeInteger(n) && n >= 0, { message: () => "must be a non-negative safe integer" }));
+/**
+* `DurationMs` schema. Mirrors `toDurationMs`: non-negative safe integer.
+*/
+const DurationMsSchema$1 = Schema.Number.pipe(Schema.filter((n) => Number.isSafeInteger(n) && n >= 0, { message: () => "must be a non-negative safe integer" }));
+//#endregion
+//#region ../wire/src/bootstrap.ts
+/**
+* `BootstrapEnvelope` v1.
+*
+* - `protocol`: discriminator that lets future protocols coexist on the
+*   same endpoint without a wire-shape conflict.
+* - `version`: numeric version inside the protocol. Unknown versions MUST
+*   fail decode with an INVALID_INPUT-class `CapxulError` at the SDK seam.
+* - `state`: the resolved bootstrap payload. Field shape matches the
+*   `BootstrapResolution` port; the SDK consumer can pass `state`
+*   directly (after `normalizeRuntimeUrl` on the two URL fields) into
+*   the port without re-branding.
+*/
+const BootstrapEnvelope = Schema.Struct({
+	protocol: Schema.Literal("capxul.bootstrap"),
+	version: Schema.Literal(1),
+	state: Schema.Struct({
+		applicationId: AppIdSchema$1,
+		chainId: ChainIdSchema$1,
+		sessionToken: SessionTokenSchema,
+		issuedAt: EpochMsSchema$1,
+		expiresIn: DurationMsSchema$1,
+		authBaseUrl: Schema.String,
+		convexUrl: Schema.String,
+		siteBaseUrl: Schema.String,
+		openfortPublishableKey: Schema.String,
+		shieldPublishableKey: Schema.String
+	})
+});
+//#endregion
+//#region ../wire/src/financial-ops.ts
+const MINOR_UNIT_STRING_RE = /^[0-9]+$/;
+const DECIMAL_STRING_RE = /^[0-9]+(?:\.[0-9]+)?$/;
+const EVM_ADDRESS_RE = /^0x[a-fA-F0-9]{40}$/;
+/**
+* The canonical on-chain domain anchor for the v1 payment-document EIP-712
+* `domain` (payment-document-spec.md v1). The `PaymentDocumentDomain` schema
+* validates against this exact literal, and the backend's receipt builder mints
+* envelopes carrying it — so it MUST stay byte-identical across both. Exported
+* once here to remove the drift risk of a mirrored declaration.
+*/
+const PAYMENT_DOCUMENT_VERIFYING_CONTRACT = "0xe740ea65521edc9bef0ea75d30b5334711db99f4";
+const PAYMENT_ID_RE = /^payment_[0-9A-Za-z]+$/;
+const PAYEE_ID_RE = /^payee_[0-9A-Za-z]+$/;
+const ORG_ID_RE = /^org_[0-9A-Za-z]+$/;
+const USER_ID_RE = /^user_[0-9A-Za-z]+$/;
+const HANDLE_RE = /^@?[a-z0-9][a-z0-9-]{2,31}$/;
+const ORG_HANDLE_RE = /^[a-z0-9][a-z0-9-]{2,31}$/;
+const EMAIL_RE = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
+const MinorUnitStringSchema = Schema.String.pipe(Schema.filter((value) => MINOR_UNIT_STRING_RE.test(value), { message: () => "must be a non-negative integer minor-unit string" }));
+const PaymentIdSchema = Schema.String.pipe(Schema.filter((value) => PAYMENT_ID_RE.test(value), { message: () => "must be payment_ plus an alphanumeric id" }));
+const PayeeIdSchema = Schema.String.pipe(Schema.filter((value) => PAYEE_ID_RE.test(value), { message: () => "must be payee_ plus an alphanumeric id" }));
+const OrgIdSchema = Schema.String.pipe(Schema.filter((value) => ORG_ID_RE.test(value), { message: () => "must be org_ plus an alphanumeric id" }));
+const UserIdSchema = Schema.String.pipe(Schema.filter((value) => USER_ID_RE.test(value), { message: () => "must be user_ plus an alphanumeric id" }));
+const DecimalStringSchema = Schema.String.pipe(Schema.filter((value) => DECIMAL_STRING_RE.test(value), { message: () => "must be a non-negative decimal string" }));
+const HandleValueSchema = Schema.String.pipe(Schema.filter((value) => !EVM_ADDRESS_RE.test(value) && HANDLE_RE.test(value), { message: () => "must be a handle; raw addresses are not accepted" }));
+const OrgHandleValueSchema = Schema.String.pipe(Schema.filter((value) => !EVM_ADDRESS_RE.test(value) && ORG_HANDLE_RE.test(value), { message: () => "must be an org handle; raw addresses are not accepted" }));
+const EmailValueSchema = Schema.String.pipe(Schema.filter((value) => !EVM_ADDRESS_RE.test(value) && EMAIL_RE.test(value), { message: () => "must be an email; raw addresses are not accepted" }));
+const Uint8Schema = Schema.Number.pipe(Schema.filter((value) => Number.isSafeInteger(value) && value >= 0 && value <= 255, { message: () => "must be a uint8" }));
+const Uint64Schema = Schema.Number.pipe(Schema.filter((value) => Number.isSafeInteger(value) && value >= 0, { message: () => "must be a non-negative safe integer" }));
+const PaymentDocumentDomain = Schema.Struct({
+	name: Schema.Literal("CapxulPayments"),
+	version: Schema.Literal("1"),
+	chainId: ChainIdSchema$1,
+	verifyingContract: Schema.Literal(PAYMENT_DOCUMENT_VERIFYING_CONTRACT)
+});
+const MemoDocument = Schema.Struct({
+	kind: Schema.Literal(0),
+	reference: Schema.String,
+	note: Schema.String,
+	issuedAt: Uint64Schema
+});
+const InvoiceDocument = Schema.Struct({
+	kind: Schema.Literal(1),
+	invoiceNumber: Schema.String,
+	payerRef: Schema.String,
+	payeeRef: Schema.String,
+	amount: MinorUnitStringSchema,
+	currency: CurrencyCodeSchema$1,
+	decimals: Uint8Schema,
+	issuedAt: Uint64Schema,
+	dueAt: Uint64Schema,
+	lineItemsHash: DocumentHashSchema$1
+});
+const PayslipDocument = Schema.Struct({
+	kind: Schema.Literal(2),
+	employerRef: Schema.String,
+	employeeRef: Schema.String,
+	period: Schema.String,
+	gross: MinorUnitStringSchema,
+	net: MinorUnitStringSchema,
+	currency: CurrencyCodeSchema$1,
+	decimals: Uint8Schema,
+	issuedAt: Uint64Schema
+});
+const ReceiptDocument = Schema.Struct({
+	kind: Schema.Literal(3),
+	reference: Schema.String,
+	amount: MinorUnitStringSchema,
+	currency: CurrencyCodeSchema$1,
+	decimals: Uint8Schema,
+	paidAt: Uint64Schema,
+	note: Schema.String
+});
+const WithdrawalDestAddressSchema = Schema.String.pipe(Schema.filter((value) => EVM_ADDRESS_RE.test(value), { message: () => "must be a 0x EVM address" }));
+const WithdrawalDocument = Schema.Struct({
+	kind: Schema.Literal(4),
+	reference: Schema.String,
+	amount: MinorUnitStringSchema,
+	currency: CurrencyCodeSchema$1,
+	decimals: Uint8Schema,
+	destChain: ChainIdSchema$1,
+	destAddress: WithdrawalDestAddressSchema,
+	settledAt: Uint64Schema,
+	provider: Schema.String,
+	note: Schema.String
+});
+const FinancialOpsMoney = Schema.Struct({
+	currency: CurrencyCodeSchema$1,
+	value: DecimalStringSchema,
+	decimals: Schema.Number.pipe(Schema.filter((value) => Number.isSafeInteger(value) && value >= 0, { message: () => "must be a non-negative safe integer" }))
+});
+const PaymentDocument = Schema.Struct({
+	documentHash: DocumentHashSchema$1,
+	kind: Schema.Literal("invoice", "receipt", "payslip", "memo", "withdrawal"),
+	title: Schema.optional(Schema.String),
+	uri: Schema.optional(Schema.String),
+	issuedAt: Schema.optional(EpochMsSchema$1)
+});
+const PaymentType = Schema.Literal("unspecified", "invoice", "payroll", "reimbursement");
+function paymentTypeForDocumentKind(kind) {
+	switch (kind) {
+		case "memo": return "unspecified";
+		case "invoice": return "invoice";
+		case "payslip": return "payroll";
+		case "receipt": return "reimbursement";
+		case "withdrawal": return "unspecified";
+	}
+}
+const AttachablePaymentDocumentEnvelope = Schema.Union(Schema.Struct({
+	protocol: Schema.Literal("capxul.payment-document"),
+	version: Schema.Literal(1),
+	domain: PaymentDocumentDomain,
+	primaryType: Schema.Literal("Memo"),
+	message: MemoDocument
+}), Schema.Struct({
+	protocol: Schema.Literal("capxul.payment-document"),
+	version: Schema.Literal(1),
+	domain: PaymentDocumentDomain,
+	primaryType: Schema.Literal("Invoice"),
+	message: InvoiceDocument
+}), Schema.Struct({
+	protocol: Schema.Literal("capxul.payment-document"),
+	version: Schema.Literal(1),
+	domain: PaymentDocumentDomain,
+	primaryType: Schema.Literal("Payslip"),
+	message: PayslipDocument
+}), Schema.Struct({
+	protocol: Schema.Literal("capxul.payment-document"),
+	version: Schema.Literal(1),
+	domain: PaymentDocumentDomain,
+	primaryType: Schema.Literal("Receipt"),
+	message: ReceiptDocument
+}));
+const WithdrawalDocumentEnvelope = Schema.Struct({
+	protocol: Schema.Literal("capxul.payment-document"),
+	version: Schema.Literal(1),
+	domain: PaymentDocumentDomain,
+	primaryType: Schema.Literal("Withdrawal"),
+	message: WithdrawalDocument
+});
+Schema.Union(AttachablePaymentDocumentEnvelope, WithdrawalDocumentEnvelope);
+Schema.Struct({
+	payeeId: PayeeIdSchema,
+	label: Schema.String,
+	trustState: Schema.Literal("unverified", "trusted", "blocked"),
+	destinationKind: Schema.Literal("handle", "email", "saved-payee", "org")
+});
+const PaymentRecipient = Schema.Struct({
+	kind: Schema.Literal("handle", "email", "payee", "capxulUserId", "me", "org", "external_address"),
+	label: Schema.String,
+	payeeId: Schema.optional(PayeeIdSchema)
+});
+/**
+* A raw external EVM address for the B3 withdraw lane — the cash-out
+* destination. This is the ONE schema that ACCEPTS a bare 0x (the withdraw
+* mutation args use it), as opposed to `PaymentRecipientRefSchema` which
+* REJECTS bare addresses to protect the pay lane. The full address never
+* crosses the model wire; it lives on the kind:4 Withdrawal document only.
+*/
+const ExternalAddressSchema = Schema.String.pipe(Schema.filter((value) => EVM_ADDRESS_RE.test(value), { message: () => "must be a 0x EVM address (40 hex chars)" }));
+const PaymentTiming = Schema.Union(Schema.Struct({ kind: Schema.Literal("instant") }), Schema.Struct({
+	kind: Schema.Literal("scheduled"),
+	at: EpochMsSchema$1
+}), Schema.Struct({
+	kind: Schema.Literal("stream"),
+	startsAt: EpochMsSchema$1,
+	endsAt: EpochMsSchema$1,
+	cliffAt: Schema.optional(EpochMsSchema$1)
+}));
+const PaymentRef = Schema.Union(Schema.Struct({
+	kind: Schema.Literal("handle"),
+	handle: HandleValueSchema
+}), Schema.Struct({
+	kind: Schema.Literal("email"),
+	email: EmailValueSchema
+}), Schema.Struct({
+	kind: Schema.Literal("orgHandle"),
+	orgHandle: OrgHandleValueSchema
+}), Schema.Struct({
+	kind: Schema.Literal("capxulUserId"),
+	capxulUserId: UserIdSchema
+}), Schema.Struct({
+	kind: Schema.Literal("payeeId"),
+	payeeId: PayeeIdSchema
+}));
+const Payment = Schema.Struct({
+	id: PaymentIdSchema,
+	status: Schema.Literal("pending", "submitted", "pending_claim", "scheduled", "streaming", "settled", "cancelled", "redirected", "expired", "failed"),
+	amount: FinancialOpsMoney,
+	paymentType: PaymentType,
+	recipient: PaymentRecipient,
+	documents: Schema.Array(PaymentDocument),
+	timing: PaymentTiming,
+	released: FinancialOpsMoney,
+	availableToClaim: FinancialOpsMoney,
+	createdAt: EpochMsSchema$1,
+	updatedAt: EpochMsSchema$1
+}).pipe(Schema.filter((payment) => payment.documents.every((document) => paymentTypeForDocumentKind(document.kind) === payment.paymentType), { message: () => "document kind must map to paymentType" }));
+const PaymentSource = Schema.Union(Schema.Struct({
+	kind: Schema.Literal("me"),
+	orgId: Schema.optional(Schema.Undefined)
+}), Schema.Struct({
+	kind: Schema.Literal("org"),
+	orgId: OrgIdSchema
+}));
+/**
+* #592 invoice line item. `quantity` is a positive integer; `unitMinor` is the
+* per-unit price in integer minor units. The list is canonically hashed by
+* `hashLineItems` (payment-document-hash.ts) into the Invoice `lineItemsHash`,
+* and Σ(quantity × unitMinor) MUST equal the invoice `amount`. The hash binds
+* the documentHash to the exact items; the sum-check makes the items add up to
+* the amount due. See the payment-document spec (canon/mcp/financial-ops.md).
+*/
+const LineItem = Schema.Struct({
+	description: Schema.String,
+	quantity: Schema.Number.pipe(Schema.filter((value) => Number.isSafeInteger(value) && value > 0, { message: () => "quantity must be a positive integer" })),
+	unitMinor: MinorUnitStringSchema
+});
+Schema.Struct({
+	from: Schema.optional(PaymentSource),
+	to: PaymentRef,
+	amount: FinancialOpsMoney,
+	timing: Schema.optional(PaymentTiming),
+	document: Schema.optional(AttachablePaymentDocumentEnvelope),
+	lineItems: Schema.optional(Schema.Array(LineItem))
+});
+Schema.Struct({
+	to: ExternalAddressSchema,
+	amount: FinancialOpsMoney,
+	document: WithdrawalDocumentEnvelope
+});
+Schema.Struct({
+	protocol: Schema.Literal("capxul.me"),
+	version: Schema.Literal(1),
+	me: Schema.Struct({
+		displayName: Schema.NullOr(Schema.String),
+		handle: Schema.NullOr(Schema.String),
+		defaultCurrency: CurrencyCodeSchema$1,
+		depositInstructions: Schema.Array(Schema.Struct({
+			network: Schema.String,
+			asset: CurrencyCodeSchema$1,
+			depositTarget: Schema.String,
+			memo: Schema.optional(Schema.String)
+		}))
+	})
+});
+Schema.Struct({
+	protocol: Schema.Literal("capxul.payments"),
+	version: Schema.Literal(1),
+	payments: Schema.Array(Payment)
+});
+`
+.capxul-doc{--ink:#1d1d1f;--muted:#6e6e73;--line:#e7e7ea;--accent:#0a7d4b;--bg:#fff;
+  font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Inter,system-ui,sans-serif;
+  color:var(--ink);background:var(--bg);max-width:44rem;margin:0 auto;padding:2.75rem 3rem;
+  border:1px solid var(--line);border-radius:16px;box-shadow:0 1px 2px rgba(0,0,0,.04),0 12px 32px rgba(0,0,0,.06);
+  line-height:1.5;font-size:15px;overflow-wrap:anywhere;word-break:break-word}
+.capxul-doc *{box-sizing:border-box;min-width:0}
+.capxul-doc .doc-header{display:flex;flex-direction:column;gap:1.25rem;padding-bottom:1.5rem;border-bottom:1px solid var(--line);margin-bottom:1.75rem}
+.capxul-doc .doc-brand{display:flex;align-items:center;gap:.5rem;color:var(--accent);font-weight:600}
+.capxul-doc .doc-brand-mark{font-size:1.1rem}
+.capxul-doc .doc-brand-name{letter-spacing:.02em}
+.capxul-doc .doc-headline{display:flex;align-items:baseline;justify-content:space-between;gap:1rem;flex-wrap:wrap}
+.capxul-doc .doc-title{font-size:1.9rem;font-weight:700;letter-spacing:-.02em;margin:0}
+.capxul-doc .doc-badge{font-size:.7rem;font-weight:700;text-transform:uppercase;letter-spacing:.08em;
+  color:var(--accent);background:rgba(10,125,75,.1);padding:.3rem .6rem;border-radius:999px;max-width:100%;text-align:right}
+.capxul-doc .doc-parties{display:grid;grid-template-columns:1fr 1fr;gap:1.25rem;margin-bottom:1.75rem}
+.capxul-doc .doc-party{display:flex;flex-direction:column;gap:.15rem}
+.capxul-doc .doc-party-label{font-size:.72rem;text-transform:uppercase;letter-spacing:.06em;color:var(--muted)}
+.capxul-doc .doc-party-name{font-weight:600}
+.capxul-doc .doc-meta{display:flex;flex-direction:column;gap:.4rem;margin-bottom:1.75rem}
+.capxul-doc .doc-meta-row{display:flex;justify-content:space-between;gap:1rem;font-size:.92rem}
+.capxul-doc .doc-meta-label{color:var(--muted);flex-shrink:0}
+.capxul-doc .doc-meta-value{font-weight:500;text-align:right}
+.capxul-doc time{color:var(--ink);font-variant-numeric:tabular-nums}
+.capxul-doc .doc-line-items{width:100%;border-collapse:collapse;margin:.5rem 0 1.5rem;font-size:.92rem}
+.capxul-doc .doc-line-items th{text-align:left;font-size:.7rem;text-transform:uppercase;letter-spacing:.05em;
+  color:var(--muted);font-weight:600;padding:.5rem .25rem;border-bottom:1px solid var(--line)}
+.capxul-doc .doc-line-items td{padding:.7rem .25rem;border-bottom:1px solid var(--line)}
+.capxul-doc .doc-li-qty,.capxul-doc .doc-li-unit,.capxul-doc .doc-li-total{text-align:right;font-variant-numeric:tabular-nums;white-space:nowrap}
+.capxul-doc .doc-li-desc{width:100%}
+.capxul-doc .doc-totals{display:flex;flex-direction:column;gap:.5rem;margin-top:.5rem}
+.capxul-doc .doc-total-line{display:flex;justify-content:space-between;align-items:baseline;gap:1rem}
+.capxul-doc .doc-total-label{color:var(--muted)}
+.capxul-doc .doc-total-deduction .doc-amount-value{color:var(--muted)}
+.capxul-doc .doc-total-grand{border-top:2px solid var(--ink);margin-top:.5rem;padding-top:.75rem;font-size:1.15rem}
+.capxul-doc .doc-total-grand .doc-amount-value{font-weight:700}
+.capxul-doc .doc-amount-value{font-variant-numeric:tabular-nums;font-weight:600}
+.capxul-doc .doc-hero{text-align:center;padding:1.5rem 0 2rem}
+.capxul-doc .doc-hero-label{font-size:.72rem;text-transform:uppercase;letter-spacing:.06em;color:var(--muted)}
+.capxul-doc .doc-hero-amount{font-size:2.6rem;font-weight:700;letter-spacing:-.02em;margin-top:.35rem}
+.capxul-doc .doc-note{color:var(--ink);background:#f7f7f8;border-radius:10px;padding:.9rem 1.1rem;margin:0}
+.capxul-doc .doc-dest-address{font-family:ui-monospace,SFMono-Regular,Menlo,monospace;font-size:.9rem}
+.capxul-doc .doc-footer{margin-top:1.75rem;padding-top:1.25rem;border-top:1px solid var(--line);color:var(--muted);font-size:.9rem}
+.capxul-doc code{font-family:ui-monospace,SFMono-Regular,Menlo,monospace;font-size:.82rem;color:var(--muted);word-break:break-all}
+@media (max-width:540px){.capxul-doc{padding:1.75rem 1.25rem}.capxul-doc .doc-parties{grid-template-columns:1fr}}
+`.trim();
+//#endregion
 //#region src/ports/bootstrap.ts
 var BootstrapError = class extends Data.TaggedError("BootstrapError") {};
 function bootstrapErrorFromCapxul(kind, error) {
@@ -2239,7 +2774,7 @@ var HttpBootstrapAdapter = class {
 					body: JSON.stringify({ publishableKey: input.publishableKey })
 				});
 			},
-			catch: (cause) => bootstrapErrorFromCapxul("network", Errors$1.networkError("bootstrap", cause))
+			catch: (cause) => bootstrapErrorFromCapxul("network", Errors.networkError("bootstrap", cause))
 		}).pipe(Effect.flatMap((res) => this.mapResponse(res)));
 	}
 	mapResponse(res) {
@@ -2247,7 +2782,7 @@ var HttpBootstrapAdapter = class {
 			try: async () => {
 				const body = await res.json();
 				const decoded = Schema.decodeUnknownEither(BootstrapEnvelope)(body);
-				if (Either.isLeft(decoded)) throw Errors$1.invalidInput("bootstrapEnvelope", decoded.left.message);
+				if (Either.isLeft(decoded)) throw Errors.invalidInput("bootstrapEnvelope", decoded.left.message);
 				const { state } = decoded.right;
 				return {
 					applicationId: state.applicationId,
@@ -2263,14 +2798,14 @@ var HttpBootstrapAdapter = class {
 				};
 			},
 			catch: (cause) => {
-				if (cause instanceof CapxulError$2 && cause.code === "INVALID_INPUT") return bootstrapErrorFromCapxul("invalidInput", cause);
-				return bootstrapErrorFromCapxul("malformedBody", Errors$1.providerError("convex", "bootstrap", cause instanceof Error ? cause : new Error(String(cause))));
+				if (cause instanceof CapxulError && cause.code === "INVALID_INPUT") return bootstrapErrorFromCapxul("invalidInput", cause);
+				return bootstrapErrorFromCapxul("malformedBody", Errors.providerError("convex", "bootstrap", cause instanceof Error ? cause : new Error(String(cause))));
 			}
 		});
 		return Effect.promise(() => safeText(res)).pipe(Effect.flatMap((body) => {
-			if (res.status === 401 || body.startsWith("NOT_AUTHENTICATED")) return Effect.fail(bootstrapErrorFromCapxul("notAuthenticated", Errors$1.notAuthenticated()));
-			if (res.status === 400 || body.startsWith("INVALID_INPUT")) return Effect.fail(bootstrapErrorFromCapxul("invalidInput", Errors$1.invalidInput("publishableKey", "rejected by bootstrap")));
-			return Effect.fail(bootstrapErrorFromCapxul("provider", Errors$1.providerError("convex", "bootstrap", /* @__PURE__ */ new Error(`HTTP ${res.status}`))));
+			if (res.status === 401 || body.startsWith("NOT_AUTHENTICATED")) return Effect.fail(bootstrapErrorFromCapxul("notAuthenticated", Errors.notAuthenticated()));
+			if (res.status === 400 || body.startsWith("INVALID_INPUT")) return Effect.fail(bootstrapErrorFromCapxul("invalidInput", Errors.invalidInput("publishableKey", "rejected by bootstrap")));
+			return Effect.fail(bootstrapErrorFromCapxul("provider", Errors.providerError("convex", "bootstrap", /* @__PURE__ */ new Error(`HTTP ${res.status}`))));
 		}));
 	}
 };
@@ -2282,9 +2817,9 @@ function normalizeRuntimeUrl(field, raw) {
 	try {
 		parsed = new URL(raw);
 	} catch {
-		throw Errors$1.invalidInput(field, "must be an http or https URL");
+		throw Errors.invalidInput(field, "must be an http or https URL");
 	}
-	if (parsed.protocol !== "http:" && parsed.protocol !== "https:") throw Errors$1.invalidInput(field, "must be an http or https URL");
+	if (parsed.protocol !== "http:" && parsed.protocol !== "https:") throw Errors.invalidInput(field, "must be an http or https URL");
 	return parsed.toString().replace(/\/$/, "");
 }
 //#endregion
@@ -2388,12 +2923,12 @@ function ConvexCallLayer(deps) {
 function mapToCapxulError(operation, err) {
 	const decoded = decodeConvexError(err);
 	if (decoded !== null) return decoded;
-	if (err instanceof CapxulError$2) return err;
+	if (err instanceof CapxulError) return err;
 	if (err instanceof Error) {
-		if (isTransportError(err)) return Errors$1.networkError(operation, err);
-		return Errors$1.providerError("convex", operation, err);
+		if (isTransportError(err)) return Errors.networkError(operation, err);
+		return Errors.providerError("convex", operation, err);
 	}
-	return Errors$1.providerError("convex", operation, new Error(String(err)));
+	return Errors.providerError("convex", operation, new Error(String(err)));
 }
 function mapToConvexCallError(operation, err) {
 	return convexCallErrorFromCapxul(operation, mapToCapxulError(operation, err));
@@ -2530,8 +3065,8 @@ function brandPublishableKeyRecord(row) {
 	};
 }
 function credentialsErrorFromUnknown(operation, cause) {
-	if (cause instanceof CapxulError$2) return credentialsErrorFromCapxul(operation, cause);
-	return credentialsErrorFromCapxul(operation, Errors$1.providerError("credentials", operation, cause instanceof Error ? cause : new Error(String(cause))), cause);
+	if (cause instanceof CapxulError) return credentialsErrorFromCapxul(operation, cause);
+	return credentialsErrorFromCapxul(operation, Errors.providerError("credentials", operation, cause instanceof Error ? cause : new Error(String(cause))), cause);
 }
 //#endregion
 //#region src/ports/env.ts
@@ -2847,7 +3382,7 @@ function schemaFor(kind) {
 		}, { message: () => "Invalid url" }));
 		default: {
 			const unsupported = kind;
-			throw Errors$1.invalidInput(String(unsupported), "unsupported environment field kind");
+			throw Errors.invalidInput(String(unsupported), "unsupported environment field kind");
 		}
 	}
 }
@@ -2856,14 +3391,14 @@ const envShapeSchema = Schema.Struct(envShapeFields);
 Schema.partial(envShapeSchema);
 function parseEnvValue$1(key, raw, required) {
 	const field = envFields[key];
-	if (field === void 0) throw Errors$1.invalidInput(key, "unknown environment key");
+	if (field === void 0) throw Errors.invalidInput(key, "unknown environment key");
 	const normalized = normalizeEnvRaw(raw);
 	if (normalized === void 0) {
-		if (required) throw Errors$1.envMissing(key);
+		if (required) throw Errors.envMissing(key);
 		return;
 	}
 	const result = Schema.decodeUnknownEither(schemaFor(field.kind))(normalized);
-	if (Either.isLeft(result)) throw Errors$1.invalidInput(key, TreeFormatter.formatErrorSync(result.left));
+	if (Either.isLeft(result)) throw Errors.invalidInput(key, TreeFormatter.formatErrorSync(result.left));
 	return result.right;
 }
 function normalizeEnvRaw(raw) {
@@ -2879,14 +3414,14 @@ function parseEnvValue(key, raw, required) {
 	return parseEnvValue$1(key, raw, required);
 }
 function hasEnvValue(key, raw) {
-	if (envFields[key] === void 0) throw envErrorFromCapxul(key, Errors$1.invalidInput(key, "unknown environment key"));
+	if (envFields[key] === void 0) throw envErrorFromCapxul(key, Errors.invalidInput(key, "unknown environment key"));
 	return normalizeEnvRaw(raw) !== void 0;
 }
 function catchEnvError(key, cause) {
 	if (cause instanceof EnvError) return cause;
-	if (isCapxulError$2(cause)) return envErrorFromCapxul(key, cause, cause);
+	if (isCapxulError(cause)) return envErrorFromCapxul(key, cause, cause);
 	const redactedCause = /* @__PURE__ */ new Error(`env ${key} read failed`);
-	return envErrorFromCapxul(key, Errors$1.providerError("env", key, redactedCause), redactedCause);
+	return envErrorFromCapxul(key, Errors.providerError("env", key, redactedCause), redactedCause);
 }
 //#endregion
 //#region src/adapters/env/SystemEnvAdapter.ts
@@ -2975,8 +3510,8 @@ function brandProfile(raw) {
 	};
 }
 function identityErrorFromUnknown(operation, cause) {
-	if (cause instanceof CapxulError$2) return identityErrorFromCapxul(operation, cause);
-	return identityErrorFromCapxul(operation, Errors$1.providerError("convex", operation, cause), cause);
+	if (cause instanceof CapxulError) return identityErrorFromCapxul(operation, cause);
+	return identityErrorFromCapxul(operation, Errors.providerError("convex", operation, cause), cause);
 }
 //#endregion
 //#region src/money/to-wei.ts
@@ -3065,8 +3600,8 @@ function brandAccount(wire) {
 	};
 }
 function accountReadErrorFromUnknown(operation, cause) {
-	if (cause instanceof CapxulError$2) return accountReadErrorFromCapxul(operation, cause);
-	return accountReadErrorFromCapxul(operation, Errors$1.providerError("convex", operation, cause), cause);
+	if (cause instanceof CapxulError) return accountReadErrorFromCapxul(operation, cause);
+	return accountReadErrorFromCapxul(operation, Errors.providerError("convex", operation, cause), cause);
 }
 //#endregion
 //#region src/ports/sub-account.ts
@@ -3164,8 +3699,8 @@ function brandSubAccount(wire) {
 	};
 }
 function subAccountErrorFromUnknown(operation, cause) {
-	if (cause instanceof CapxulError$2) return subAccountErrorFromCapxul(operation, cause);
-	return subAccountErrorFromCapxul(operation, Errors$1.providerError("convex", operation, cause), cause);
+	if (cause instanceof CapxulError) return subAccountErrorFromCapxul(operation, cause);
+	return subAccountErrorFromCapxul(operation, Errors.providerError("convex", operation, cause), cause);
 }
 //#endregion
 //#region src/ports/smart-account.ts
@@ -3259,16 +3794,705 @@ function brandNonNullSmartAccount(wire) {
 	};
 }
 function brandProvisionedSmartAccount(requestedAuthUserId, wire) {
-	if (wire.authUserId !== String(requestedAuthUserId)) throw Errors$1.notAuthenticated();
+	if (wire.authUserId !== String(requestedAuthUserId)) throw Errors.notAuthenticated();
 	return brandNonNullSmartAccount(wire);
 }
 function smartAccountErrorFromUnknown(operation, cause) {
-	if (cause instanceof CapxulError$2) return smartAccountErrorFromCapxul(operation, cause);
-	return smartAccountErrorFromCapxul(operation, Errors$1.providerError("convex", operation, cause), cause);
+	if (cause instanceof CapxulError) return smartAccountErrorFromCapxul(operation, cause);
+	return smartAccountErrorFromCapxul(operation, Errors.providerError("convex", operation, cause), cause);
 }
 toAddress("0xa6b71e26c5e0845f74c812102ca7114b6a896ab2");
 keccak256("0x");
 //#endregion
+//#region ../observability/src/index.ts
+const PII = Schema.String.pipe(Schema.brand("PII"));
+const OptionalString = Schema.optional(Schema.String);
+const AddressSchema = Schema.String.pipe(Schema.transform(Schema.String, {
+	decode: (value) => value.toLowerCase(),
+	encode: (value) => value
+}), Schema.filter((value) => EVM_ADDRESS_RE$1.test(value), { message: () => "must be 0x + 40 hex chars" }));
+const AppIdSchema = Schema.String.pipe(Schema.filter((value) => APP_ID_RE.test(value), { message: () => "must be app_ plus a ULID" }));
+const BlockNumberSchema = Schema.Number.pipe(Schema.filter((value) => Number.isSafeInteger(value) && value >= 0, { message: () => "must be a non-negative safe integer" }));
+const ChainIdSchema = Schema.Number.pipe(Schema.filter((value) => Number.isSafeInteger(value) && value > 0, { message: () => "must be a positive safe integer" }));
+const DurationMsSchema = Schema.Number.pipe(Schema.filter((value) => Number.isSafeInteger(value) && value >= 0, { message: () => "must be a non-negative safe integer" }));
+const EpochMsSchema = Schema.Number.pipe(Schema.filter((value) => Number.isSafeInteger(value) && value >= 0, { message: () => "must be a non-negative safe integer" }));
+const PublishableKeyIdSchema = Schema.String.pipe(Schema.filter((value) => value.length > 0, { message: () => "must be a non-empty string" }));
+const TxHashSchema = Schema.String.pipe(Schema.filter((value) => BYTES32_RE.test(value), { message: () => "must be 0x + 64 hex chars" }));
+const ACCOUNT_ID_TELEMETRY_RE = /^account_[0-9A-Za-z]+$/;
+const SUBACCOUNT_ID_TELEMETRY_RE = /^subaccount_[0-9A-Za-z]+$/;
+const WEI_AMOUNT_TELEMETRY_RE = /^[0-9]+$/;
+const AccountIdSchema = Schema.String.pipe(Schema.filter((value) => ACCOUNT_ID_TELEMETRY_RE.test(value), { message: () => "must be account_ plus an alphanumeric id" }));
+const SubAccountIdSchema = Schema.String.pipe(Schema.filter((value) => SUBACCOUNT_ID_TELEMETRY_RE.test(value), { message: () => "must be subaccount_ plus an alphanumeric id" }));
+const WeiAmountSchema = Schema.String.pipe(Schema.filter((value) => WEI_AMOUNT_TELEMETRY_RE.test(value), { message: () => "must be a non-negative integer string" }));
+const CurrencyCodeSchema = Schema.String.pipe(Schema.filter((value) => value.length > 0, { message: () => "must be a non-empty currency code" }));
+const BalanceBucketSchema = Schema.Literal("zero", "nonzero");
+const TransferDirectionSchema = Schema.Literal("add", "out", "between");
+const SubAccountOpSchema = Schema.Literal("create", "rename", "delete");
+const OptionalAccountId = Schema.optional(AccountIdSchema);
+const OptionalSubAccountId = Schema.optional(SubAccountIdSchema);
+const OptionalWeiAmount = Schema.optional(WeiAmountSchema);
+const OptionalCurrencyCode = Schema.optional(CurrencyCodeSchema);
+const OptionalBalanceBucket = Schema.optional(BalanceBucketSchema);
+const OptionalTransferDirection = Schema.optional(TransferDirectionSchema);
+const OptionalSubAccountOp = Schema.optional(SubAccountOpSchema);
+const OptionalTrue = Schema.optional(Schema.Literal(true));
+const OptionalAddress = Schema.optional(AddressSchema);
+const OptionalAppId = Schema.optional(AppIdSchema);
+const OptionalBlockNumber = Schema.optional(BlockNumberSchema);
+const OptionalChainId = Schema.optional(ChainIdSchema);
+const OptionalDurationMs = Schema.optional(DurationMsSchema);
+const OptionalEpochMs = Schema.optional(EpochMsSchema);
+const OptionalPublishableKeyId = Schema.optional(PublishableKeyIdSchema);
+const OptionalTxHash = Schema.optional(TxHashSchema);
+const PAYMENT_ID_TELEMETRY_RE = /^payment_[0-9A-Za-z]+$/;
+const PAYEE_ID_TELEMETRY_RE = /^payee_[0-9A-Za-z]+$/;
+const PaymentIdTelemetrySchema = Schema.String.pipe(Schema.filter((value) => PAYMENT_ID_TELEMETRY_RE.test(value), { message: () => "must be payment_ plus an alphanumeric id" }));
+const PayeeIdTelemetrySchema = Schema.String.pipe(Schema.filter((value) => PAYEE_ID_TELEMETRY_RE.test(value), { message: () => "must be payee_ plus an alphanumeric id" }));
+const DocumentHashSchema = Schema.String.pipe(Schema.filter((value) => BYTES32_RE.test(value), { message: () => "must be 0x + 64 hex chars" }));
+const TelemetryEnvelopeProps = {
+	capxul_e2e_run_id: OptionalString,
+	correlationId: OptionalString,
+	capxulEnv: OptionalString,
+	sdkVersion: OptionalString,
+	producer: OptionalString
+};
+const AuthOtpRequestedProps = Schema.Struct({
+	...TelemetryEnvelopeProps,
+	email: Schema.optional(PII),
+	email_domain: OptionalString
+});
+const AuthOtpDeliveredProps = Schema.Struct({
+	...TelemetryEnvelopeProps,
+	durationMs: OptionalDurationMs,
+	email: Schema.optional(PII),
+	email_domain: OptionalString,
+	resendMessageId: OptionalString
+});
+const AuthOtpExpiredProps = Schema.Struct({
+	...TelemetryEnvelopeProps,
+	email: Schema.optional(PII),
+	email_domain: OptionalString
+});
+const AuthVerifiedProps = Schema.Struct({
+	...TelemetryEnvelopeProps,
+	auth_type: OptionalString
+});
+const AuthFailedProps = Schema.Struct({
+	...TelemetryEnvelopeProps,
+	email: Schema.optional(PII),
+	auth_type: OptionalString,
+	reason: OptionalString
+});
+const AuthSignedOutProps = Schema.Struct(TelemetryEnvelopeProps);
+const ProvisioningSafeCreatedProps = Schema.Struct({
+	...TelemetryEnvelopeProps,
+	safe_address: OptionalAddress
+});
+const ProvisioningSafeConfirmedProps = Schema.Struct({
+	...TelemetryEnvelopeProps,
+	chainId: OptionalChainId,
+	deployedAt: OptionalEpochMs,
+	deployedAtBlock: OptionalBlockNumber,
+	deployTxHash: OptionalTxHash,
+	durationMs: OptionalDurationMs,
+	safe_address: OptionalAddress,
+	userOpHash: OptionalTxHash
+});
+const BootstrapResolvedProps = Schema.Struct({
+	...TelemetryEnvelopeProps,
+	applicationId: OptionalAppId,
+	durationMs: OptionalDurationMs,
+	env: OptionalString,
+	keyId: OptionalPublishableKeyId,
+	origin: OptionalString
+});
+const BootstrapFailedProps = Schema.Struct({
+	...TelemetryEnvelopeProps,
+	applicationId: OptionalAppId,
+	durationMs: OptionalDurationMs,
+	origin: OptionalString,
+	reason: OptionalString
+});
+const AccountBalanceReadProps = Schema.Struct({
+	...TelemetryEnvelopeProps,
+	account_id: OptionalAccountId,
+	currency: OptionalCurrencyCode,
+	balance_bucket: OptionalBalanceBucket,
+	durationMs: OptionalDurationMs
+});
+const AccountBalanceFailedProps = Schema.Struct({
+	...TelemetryEnvelopeProps,
+	reason: OptionalString
+});
+const FaucetRequestedProps = Schema.Struct({
+	...TelemetryEnvelopeProps,
+	amount: OptionalWeiAmount,
+	chainId: OptionalChainId
+});
+const FaucetConfirmedProps = Schema.Struct({
+	...TelemetryEnvelopeProps,
+	amount: OptionalWeiAmount,
+	chainId: OptionalChainId,
+	txHash: OptionalTxHash,
+	durationMs: OptionalDurationMs
+});
+const FaucetFailedProps = Schema.Struct({
+	...TelemetryEnvelopeProps,
+	reason: OptionalString
+});
+const SubaccountCreatedProps = Schema.Struct({
+	...TelemetryEnvelopeProps,
+	sub_account_id: OptionalSubAccountId,
+	durationMs: OptionalDurationMs
+});
+const SubaccountRenamedProps = Schema.Struct({
+	...TelemetryEnvelopeProps,
+	sub_account_id: OptionalSubAccountId
+});
+const SubaccountDeletedProps = Schema.Struct({
+	...TelemetryEnvelopeProps,
+	sub_account_id: OptionalSubAccountId
+});
+const SubaccountOpFailedProps = Schema.Struct({
+	...TelemetryEnvelopeProps,
+	op: OptionalSubAccountOp,
+	reason: OptionalString
+});
+const TransferRequestedProps = Schema.Struct({
+	...TelemetryEnvelopeProps,
+	amount: OptionalWeiAmount,
+	direction: OptionalTransferDirection
+});
+const TransferConfirmedProps = Schema.Struct({
+	...TelemetryEnvelopeProps,
+	amount: OptionalWeiAmount,
+	direction: OptionalTransferDirection,
+	available_bucket: OptionalBalanceBucket,
+	txless: OptionalTrue,
+	durationMs: OptionalDurationMs
+});
+const TransferFailedProps = Schema.Struct({
+	...TelemetryEnvelopeProps,
+	reason: OptionalString
+});
+const ORG_ID_TELEMETRY_RE = /^org_[0-9A-Za-z]+$/;
+const OrgIdTelemetrySchema = Schema.String.pipe(Schema.filter((value) => ORG_ID_TELEMETRY_RE.test(value), { message: () => "must be org_ plus an alphanumeric id" }));
+const OptionalOrgId = Schema.optional(OrgIdTelemetrySchema);
+const OrgCreateStartedProps = Schema.Struct({
+	...TelemetryEnvelopeProps,
+	org_id: OptionalOrgId,
+	email_domain: OptionalString,
+	template: OptionalString
+});
+const OrgSafeCreatedProps = Schema.Struct({
+	...TelemetryEnvelopeProps,
+	org_id: OptionalOrgId,
+	chainId: OptionalChainId,
+	safe_address: OptionalAddress
+});
+const OrgSafeConfirmedProps = Schema.Struct({
+	...TelemetryEnvelopeProps,
+	org_id: OptionalOrgId,
+	chainId: OptionalChainId,
+	safe_address: OptionalAddress,
+	durationMs: OptionalDurationMs
+});
+const OrgRolesSeededProps = Schema.Struct({
+	...TelemetryEnvelopeProps,
+	org_id: OptionalOrgId,
+	chainId: OptionalChainId,
+	role: OptionalString,
+	txHash: OptionalTxHash
+});
+const OrgCreatedProps = Schema.Struct({
+	...TelemetryEnvelopeProps,
+	org_id: OptionalOrgId,
+	chainId: OptionalChainId,
+	safe_address: OptionalAddress,
+	durationMs: OptionalDurationMs
+});
+const OrgCreateFailedProps = Schema.Struct({
+	...TelemetryEnvelopeProps,
+	org_id: OptionalOrgId,
+	reason: OptionalString
+});
+const OrgInviteSentProps = Schema.Struct({
+	...TelemetryEnvelopeProps,
+	org_id: OptionalOrgId,
+	email_domain: OptionalString,
+	role: OptionalString,
+	status: OptionalString
+});
+const OrgInviteAcceptedProps = Schema.Struct({
+	...TelemetryEnvelopeProps,
+	org_id: OptionalOrgId,
+	role: OptionalString,
+	status: OptionalString
+});
+const OrgRoleGrantedProps = Schema.Struct({
+	...TelemetryEnvelopeProps,
+	org_id: OptionalOrgId,
+	role: OptionalString,
+	status: OptionalString,
+	txHash: OptionalTxHash
+});
+const OrgMemberActiveProps = Schema.Struct({
+	...TelemetryEnvelopeProps,
+	org_id: OptionalOrgId,
+	role: OptionalString,
+	status: OptionalString,
+	durationMs: OptionalDurationMs
+});
+const OrgMemberRemovedProps = Schema.Struct({
+	...TelemetryEnvelopeProps,
+	org_id: OptionalOrgId,
+	role: OptionalString,
+	status: OptionalString,
+	txHash: OptionalTxHash
+});
+const OrgInviteExpiredProps = Schema.Struct({
+	...TelemetryEnvelopeProps,
+	org_id: OptionalOrgId,
+	email_domain: OptionalString,
+	reason: OptionalString,
+	role: OptionalString,
+	status: OptionalString
+});
+const OrgRoleGrantFailedProps = Schema.Struct({
+	...TelemetryEnvelopeProps,
+	org_id: OptionalOrgId,
+	reason: OptionalString,
+	role: OptionalString
+});
+const OptionalPaymentId = Schema.optional(PaymentIdTelemetrySchema);
+const OptionalPayeeId = Schema.optional(PayeeIdTelemetrySchema);
+const OptionalDocumentHash = Schema.optional(DocumentHashSchema);
+const PaymentTargetTelemetryProps = Schema.Struct({
+	...TelemetryEnvelopeProps,
+	payment_id: OptionalPaymentId,
+	payee_id: OptionalPayeeId,
+	document_hash: OptionalDocumentHash,
+	amount: OptionalWeiAmount,
+	currency: OptionalCurrencyCode,
+	status: OptionalString,
+	reason: OptionalString,
+	durationMs: OptionalDurationMs
+});
+const StreamTargetTelemetryProps = Schema.Struct({
+	...TelemetryEnvelopeProps,
+	payment_id: OptionalPaymentId,
+	document_hash: OptionalDocumentHash,
+	amount: OptionalWeiAmount,
+	currency: OptionalCurrencyCode,
+	status: OptionalString,
+	available_bucket: OptionalBalanceBucket,
+	reason: OptionalString,
+	durationMs: OptionalDurationMs
+});
+const WithdrawalTargetTelemetryProps = Schema.Struct({
+	...TelemetryEnvelopeProps,
+	payment_id: OptionalPaymentId,
+	document_hash: OptionalDocumentHash,
+	amount: OptionalWeiAmount,
+	currency: OptionalCurrencyCode,
+	status: OptionalString,
+	reason: OptionalString,
+	durationMs: OptionalDurationMs
+});
+Schema.Struct({
+	name: Schema.Literal("auth_otp_requested"),
+	props: Schema.optional(AuthOtpRequestedProps)
+});
+Schema.Struct({
+	name: Schema.Literal("auth_otp_delivered"),
+	props: Schema.optional(AuthOtpDeliveredProps)
+});
+Schema.Struct({
+	name: Schema.Literal("auth_otp_expired"),
+	props: Schema.optional(AuthOtpExpiredProps)
+});
+Schema.Struct({
+	name: Schema.Literal("auth_verified"),
+	props: Schema.optional(AuthVerifiedProps)
+});
+Schema.Struct({
+	name: Schema.Literal("auth_failed"),
+	props: Schema.optional(AuthFailedProps)
+});
+Schema.Struct({
+	name: Schema.Literal("auth_signed_out"),
+	props: Schema.optional(AuthSignedOutProps)
+});
+Schema.Struct({
+	name: Schema.Literal("provisioning_safe_created"),
+	props: Schema.optional(ProvisioningSafeCreatedProps)
+});
+Schema.Struct({
+	name: Schema.Literal("provisioning_safe_confirmed"),
+	props: Schema.optional(ProvisioningSafeConfirmedProps)
+});
+Schema.Struct({
+	name: Schema.Literal("bootstrap_resolved"),
+	props: Schema.optional(BootstrapResolvedProps)
+});
+Schema.Struct({
+	name: Schema.Literal("bootstrap_failed"),
+	props: Schema.optional(BootstrapFailedProps)
+});
+Schema.Struct({
+	name: Schema.Literal("account_balance_read"),
+	props: Schema.optional(AccountBalanceReadProps)
+});
+Schema.Struct({
+	name: Schema.Literal("account_balance_failed"),
+	props: Schema.optional(AccountBalanceFailedProps)
+});
+Schema.Struct({
+	name: Schema.Literal("faucet_requested"),
+	props: Schema.optional(FaucetRequestedProps)
+});
+Schema.Struct({
+	name: Schema.Literal("faucet_confirmed"),
+	props: Schema.optional(FaucetConfirmedProps)
+});
+Schema.Struct({
+	name: Schema.Literal("faucet_failed"),
+	props: Schema.optional(FaucetFailedProps)
+});
+Schema.Struct({
+	name: Schema.Literal("subaccount_created"),
+	props: Schema.optional(SubaccountCreatedProps)
+});
+Schema.Struct({
+	name: Schema.Literal("subaccount_renamed"),
+	props: Schema.optional(SubaccountRenamedProps)
+});
+Schema.Struct({
+	name: Schema.Literal("subaccount_deleted"),
+	props: Schema.optional(SubaccountDeletedProps)
+});
+Schema.Struct({
+	name: Schema.Literal("subaccount_op_failed"),
+	props: Schema.optional(SubaccountOpFailedProps)
+});
+Schema.Struct({
+	name: Schema.Literal("transfer_requested"),
+	props: Schema.optional(TransferRequestedProps)
+});
+Schema.Struct({
+	name: Schema.Literal("transfer_confirmed"),
+	props: Schema.optional(TransferConfirmedProps)
+});
+Schema.Struct({
+	name: Schema.Literal("transfer_failed"),
+	props: Schema.optional(TransferFailedProps)
+});
+Schema.Struct({
+	name: Schema.Literal("org_create_started"),
+	props: Schema.optional(OrgCreateStartedProps)
+});
+Schema.Struct({
+	name: Schema.Literal("org_safe_created"),
+	props: Schema.optional(OrgSafeCreatedProps)
+});
+Schema.Struct({
+	name: Schema.Literal("org_safe_confirmed"),
+	props: Schema.optional(OrgSafeConfirmedProps)
+});
+Schema.Struct({
+	name: Schema.Literal("org_roles_seeded"),
+	props: Schema.optional(OrgRolesSeededProps)
+});
+Schema.Struct({
+	name: Schema.Literal("org_created"),
+	props: Schema.optional(OrgCreatedProps)
+});
+Schema.Struct({
+	name: Schema.Literal("org_create_failed"),
+	props: Schema.optional(OrgCreateFailedProps)
+});
+Schema.Struct({
+	name: Schema.Literal("org_invite_sent"),
+	props: Schema.optional(OrgInviteSentProps)
+});
+Schema.Struct({
+	name: Schema.Literal("org_invite_accepted"),
+	props: Schema.optional(OrgInviteAcceptedProps)
+});
+Schema.Struct({
+	name: Schema.Literal("org_role_granted"),
+	props: Schema.optional(OrgRoleGrantedProps)
+});
+Schema.Struct({
+	name: Schema.Literal("org_member_active"),
+	props: Schema.optional(OrgMemberActiveProps)
+});
+Schema.Struct({
+	name: Schema.Literal("org_member_removed"),
+	props: Schema.optional(OrgMemberRemovedProps)
+});
+Schema.Struct({
+	name: Schema.Literal("org_invite_expired"),
+	props: Schema.optional(OrgInviteExpiredProps)
+});
+Schema.Struct({
+	name: Schema.Literal("org_role_grant_failed"),
+	props: Schema.optional(OrgRoleGrantFailedProps)
+});
+Schema.Struct({
+	name: Schema.Literal("payment_requested"),
+	props: Schema.optional(PaymentTargetTelemetryProps)
+});
+Schema.Struct({
+	name: Schema.Literal("payment_resolved"),
+	props: Schema.optional(PaymentTargetTelemetryProps)
+});
+Schema.Struct({
+	name: Schema.Literal("payment_document_attached"),
+	props: Schema.optional(PaymentTargetTelemetryProps)
+});
+Schema.Struct({
+	name: Schema.Literal("payment_submitted"),
+	props: Schema.optional(PaymentTargetTelemetryProps)
+});
+Schema.Struct({
+	name: Schema.Literal("payment_settled"),
+	props: Schema.optional(PaymentTargetTelemetryProps)
+});
+Schema.Struct({
+	name: Schema.Literal("payment_claimed"),
+	props: Schema.optional(PaymentTargetTelemetryProps)
+});
+Schema.Struct({
+	name: Schema.Literal("payment_cancelled"),
+	props: Schema.optional(PaymentTargetTelemetryProps)
+});
+Schema.Struct({
+	name: Schema.Literal("payment_redirected"),
+	props: Schema.optional(PaymentTargetTelemetryProps)
+});
+Schema.Struct({
+	name: Schema.Literal("payment_failed"),
+	props: Schema.optional(PaymentTargetTelemetryProps)
+});
+Schema.Struct({
+	name: Schema.Literal("stream_created"),
+	props: Schema.optional(StreamTargetTelemetryProps)
+});
+Schema.Struct({
+	name: Schema.Literal("stream_claimed"),
+	props: Schema.optional(StreamTargetTelemetryProps)
+});
+Schema.Struct({
+	name: Schema.Literal("stream_cancelled"),
+	props: Schema.optional(StreamTargetTelemetryProps)
+});
+Schema.Struct({
+	name: Schema.Literal("stream_completed"),
+	props: Schema.optional(StreamTargetTelemetryProps)
+});
+Schema.Struct({
+	name: Schema.Literal("stream_failed"),
+	props: Schema.optional(StreamTargetTelemetryProps)
+});
+Schema.Struct({
+	name: Schema.Literal("withdrawal_requested"),
+	props: Schema.optional(WithdrawalTargetTelemetryProps)
+});
+Schema.Struct({
+	name: Schema.Literal("withdrawal_submitted"),
+	props: Schema.optional(WithdrawalTargetTelemetryProps)
+});
+Schema.Struct({
+	name: Schema.Literal("withdrawal_settled"),
+	props: Schema.optional(WithdrawalTargetTelemetryProps)
+});
+Schema.Struct({
+	name: Schema.Literal("withdrawal_failed"),
+	props: Schema.optional(WithdrawalTargetTelemetryProps)
+});
+function redactTelemetryProps(name, props, options = {}) {
+	if (props === void 0) return void 0;
+	const clone = cloneProps$1(props);
+	if (options.rawMode === true) return clone;
+	for (const key of PII_PROP_KEYS_BY_EVENT[name] ?? []) redactProperty(clone, key);
+	return clone;
+}
+const PII_PROP_KEYS_BY_EVENT = {
+	auth_otp_requested: ["email"],
+	auth_otp_delivered: ["email"],
+	auth_otp_expired: ["email"],
+	auth_failed: ["email"]
+};
+function redactProperty(props, key) {
+	const value = props[key];
+	if (typeof value === "string") props[key] = sha256Hex(value).slice(0, 12);
+}
+function cloneProps$1(props) {
+	const cloned = {};
+	for (const [key, value] of Object.entries(props)) cloned[key] = cloneTelemetryValue$1(value);
+	return cloned;
+}
+function cloneTelemetryValue$1(value) {
+	if (Array.isArray(value)) return value.map(cloneTelemetryValue$1);
+	if (value === null || typeof value !== "object") return value;
+	if (Object.getPrototypeOf(value) !== Object.prototype) return value;
+	const cloned = {};
+	for (const [key, nested] of Object.entries(value)) cloned[key] = cloneTelemetryValue$1(nested);
+	return cloned;
+}
+const SHA256_INITIAL_HASH = [
+	1779033703,
+	3144134277,
+	1013904242,
+	2773480762,
+	1359893119,
+	2600822924,
+	528734635,
+	1541459225
+];
+const SHA256_K = [
+	1116352408,
+	1899447441,
+	3049323471,
+	3921009573,
+	961987163,
+	1508970993,
+	2453635748,
+	2870763221,
+	3624381080,
+	310598401,
+	607225278,
+	1426881987,
+	1925078388,
+	2162078206,
+	2614888103,
+	3248222580,
+	3835390401,
+	4022224774,
+	264347078,
+	604807628,
+	770255983,
+	1249150122,
+	1555081692,
+	1996064986,
+	2554220882,
+	2821834349,
+	2952996808,
+	3210313671,
+	3336571891,
+	3584528711,
+	113926993,
+	338241895,
+	666307205,
+	773529912,
+	1294757372,
+	1396182291,
+	1695183700,
+	1986661051,
+	2177026350,
+	2456956037,
+	2730485921,
+	2820302411,
+	3259730800,
+	3345764771,
+	3516065817,
+	3600352804,
+	4094571909,
+	275423344,
+	430227734,
+	506948616,
+	659060556,
+	883997877,
+	958139571,
+	1322822218,
+	1537002063,
+	1747873779,
+	1955562222,
+	2024104815,
+	2227730452,
+	2361852424,
+	2428436474,
+	2756734187,
+	3204031479,
+	3329325298
+];
+function sha256Hex(input) {
+	const padded = padSha256Message(new TextEncoder().encode(input));
+	const view = new DataView(padded.buffer, padded.byteOffset, padded.byteLength);
+	const words = new Uint32Array(64);
+	let h0 = SHA256_INITIAL_HASH[0];
+	let h1 = SHA256_INITIAL_HASH[1];
+	let h2 = SHA256_INITIAL_HASH[2];
+	let h3 = SHA256_INITIAL_HASH[3];
+	let h4 = SHA256_INITIAL_HASH[4];
+	let h5 = SHA256_INITIAL_HASH[5];
+	let h6 = SHA256_INITIAL_HASH[6];
+	let h7 = SHA256_INITIAL_HASH[7];
+	for (let offset = 0; offset < padded.byteLength; offset += 64) {
+		for (let i = 0; i < 16; i++) words[i] = view.getUint32(offset + i * 4);
+		for (let i = 16; i < 64; i++) {
+			const s0 = rotr(words[i - 15], 7) ^ rotr(words[i - 15], 18) ^ words[i - 15] >>> 3;
+			const s1 = rotr(words[i - 2], 17) ^ rotr(words[i - 2], 19) ^ words[i - 2] >>> 10;
+			words[i] = words[i - 16] + s0 + words[i - 7] + s1 >>> 0;
+		}
+		let a = h0;
+		let b = h1;
+		let c = h2;
+		let d = h3;
+		let e = h4;
+		let f = h5;
+		let g = h6;
+		let h = h7;
+		for (let i = 0; i < 64; i++) {
+			const s1 = rotr(e, 6) ^ rotr(e, 11) ^ rotr(e, 25);
+			const ch = e & f ^ ~e & g;
+			const temp1 = h + s1 + ch + SHA256_K[i] + words[i] >>> 0;
+			const temp2 = (rotr(a, 2) ^ rotr(a, 13) ^ rotr(a, 22)) + (a & b ^ a & c ^ b & c) >>> 0;
+			h = g;
+			g = f;
+			f = e;
+			e = d + temp1 >>> 0;
+			d = c;
+			c = b;
+			b = a;
+			a = temp1 + temp2 >>> 0;
+		}
+		h0 = h0 + a >>> 0;
+		h1 = h1 + b >>> 0;
+		h2 = h2 + c >>> 0;
+		h3 = h3 + d >>> 0;
+		h4 = h4 + e >>> 0;
+		h5 = h5 + f >>> 0;
+		h6 = h6 + g >>> 0;
+		h7 = h7 + h >>> 0;
+	}
+	return [
+		h0,
+		h1,
+		h2,
+		h3,
+		h4,
+		h5,
+		h6,
+		h7
+	].map((word) => word.toString(16).padStart(8, "0")).join("");
+}
+function padSha256Message(bytes) {
+	const bitLength = bytes.byteLength * 8;
+	const zeroPadLength = (64 - (bytes.byteLength + 1 + 8) % 64) % 64;
+	const output = new Uint8Array(bytes.byteLength + 1 + zeroPadLength + 8);
+	output.set(bytes);
+	output[bytes.byteLength] = 128;
+	const view = new DataView(output.buffer);
+	view.setUint32(output.byteLength - 8, Math.floor(bitLength / 4294967296));
+	view.setUint32(output.byteLength - 4, bitLength >>> 0);
+	return output;
+}
+function rotr(value, bits) {
+	return value >>> bits | value << 32 - bits;
+}
+//#endregion
 //#region src/ports/telemetry.ts
 var TelemetryPortTag = class extends Context.Tag("@capxul/sdk/ports/TelemetryPort")() {};
 //#endregion
@@ -3408,7 +4632,7 @@ function asRecordArgs(args) {
 	return { value: args };
 }
 function transportErrorFromThrown(operation, request, cause) {
-	return transportErrorFromCapxul(operation, request, cause instanceof Error ? Errors$1.providerError("transport", request.name, cause) : Errors$1.providerError("transport", request.name, new Error(String(cause))), cause);
+	return transportErrorFromCapxul(operation, request, cause instanceof Error ? Errors.providerError("transport", request.name, cause) : Errors.providerError("transport", request.name, new Error(String(cause))), cause);
 }
 //#endregion
 //#region src/openfort/create-openfort-browser-signer.ts
@@ -3464,7 +4688,7 @@ function createOpenfortBrowserSignerFromBootstrap(bootstrap, options = {}) {
 			ok: false,
 			failure_mode: "no-secure-context"
 		});
-		const error = Errors$1.providerError("openfort", "configure", /* @__PURE__ */ new Error("Web Crypto unavailable: browser is not a secure context"), { failure_mode: "no-secure-context" });
+		const error = Errors.providerError("openfort", "configure", /* @__PURE__ */ new Error("Web Crypto unavailable: browser is not a secure context"), { failure_mode: "no-secure-context" });
 		if (telemetry) captureExceptionSync(telemetry, error, {
 			layer: "openfort",
 			operation: "configure",
@@ -3510,7 +4734,7 @@ function createOpenfortBrowserSignerFromBootstrap(bootstrap, options = {}) {
 			if (isInsecureBrowserContext()) failNoSecureContext();
 			await openfort.waitForInitialization();
 			const accessToken = await fetchBetterAuthAccessToken();
-			if (accessToken === null) throw Errors$1.notAuthenticated();
+			if (accessToken === null) throw Errors.notAuthenticated();
 			const encryptionResponse = await fetch(encryptionSessionUrl(), {
 				method: "POST",
 				credentials: "include",
@@ -3523,10 +4747,10 @@ function createOpenfortBrowserSignerFromBootstrap(bootstrap, options = {}) {
 			diagnostic?.trace("openfort.encryptionSession", { httpStatus: encryptionResponse.status });
 			if (!encryptionResponse.ok) {
 				const detail = await encryptionResponse.text();
-				throw Errors$1.providerError("openfort", "encryptionSession", /* @__PURE__ */ new Error(`Openfort encryption session failed (${encryptionResponse.status}): ${detail.slice(0, 200)}`));
+				throw Errors.providerError("openfort", "encryptionSession", /* @__PURE__ */ new Error(`Openfort encryption session failed (${encryptionResponse.status}): ${detail.slice(0, 200)}`));
 			}
 			const encryptionBody = await encryptionResponse.json();
-			if (typeof encryptionBody.sessionId !== "string" || encryptionBody.sessionId.length === 0) throw Errors$1.providerError("openfort", "encryptionSession", /* @__PURE__ */ new Error("Openfort encryption session response missing sessionId"));
+			if (typeof encryptionBody.sessionId !== "string" || encryptionBody.sessionId.length === 0) throw Errors.providerError("openfort", "encryptionSession", /* @__PURE__ */ new Error("Openfort encryption session response missing sessionId"));
 			const embeddedState = await openfort.embeddedWallet.getEmbeddedState();
 			diagnostic?.trace("openfort.embeddedState", { state: embeddedState });
 			if (embeddedState !== EmbeddedState.READY) {
@@ -3715,7 +4939,7 @@ function createAuthFlowMachine() {
 			if (!/^\d{6}$/.test(context.request.otp)) return yield* Effect.fail(new AuthFlowError({
 				operation: "verifyOtp",
 				state: context.state.state,
-				publicError: Errors$1.invalidInput("otp", "must be a six digit code"),
+				publicError: Errors.invalidInput("otp", "must be a six digit code"),
 				publicCode: "INVALID_INPUT"
 			}));
 			if (!canTransition(context.state.state, "VerifyOtp")) return yield* Effect.fail(wrongState("VerifyOtp", context.state.state));
@@ -3724,7 +4948,7 @@ function createAuthFlowMachine() {
 			const now = yield* (yield* ClockPortTag).now.pipe(Effect.mapError((cause) => new AuthFlowError({
 				operation: "verifyOtp",
 				state: current.state,
-				publicError: Errors$1.providerError("clock", "now", cause),
+				publicError: Errors.providerError("clock", "now", cause),
 				publicCode: "PROVIDER_ERROR",
 				cause
 			})));
@@ -3732,7 +4956,7 @@ function createAuthFlowMachine() {
 				const failure = new AuthFlowError({
 					operation: "verifyOtp",
 					state: "otp_requested",
-					publicError: Errors$1.otpExpired({ expiredAt: Number(current.otpRequestedAt) + normalized.otpTtlMs }),
+					publicError: Errors.otpExpired({ expiredAt: Number(current.otpRequestedAt) + normalized.otpTtlMs }),
 					publicCode: "OTP_EXPIRED"
 				});
 				yield* emitTelemetry({
@@ -3793,7 +5017,7 @@ function createAuthFlowMachine() {
 			const now = yield* (yield* ClockPortTag).now.pipe(Effect.mapError((cause) => new AuthFlowError({
 				operation: "verifyOtp",
 				state: current.state,
-				publicError: Errors$1.providerError("clock", "now", cause),
+				publicError: Errors.providerError("clock", "now", cause),
 				publicCode: "PROVIDER_ERROR",
 				cause
 			})));
@@ -3801,7 +5025,7 @@ function createAuthFlowMachine() {
 				const failure = new AuthFlowError({
 					operation: "verifyOtp",
 					state: "error",
-					publicError: Errors$1.otpExpired({ expiredAt: Number(current.otpRequestedAt) + normalized.otpTtlMs }),
+					publicError: Errors.otpExpired({ expiredAt: Number(current.otpRequestedAt) + normalized.otpTtlMs }),
 					publicCode: "OTP_EXPIRED"
 				});
 				yield* emitTelemetry({
@@ -3854,12 +5078,12 @@ function bootAuthFlow(machine, input) {
 				return Ref.get(statusRef).pipe(Effect.flatMap((status) => status === "active" ? actor.send(toMachineRequest(request)).pipe(Effect.raceFirst(Deferred.await(stopDeferred).pipe(Effect.flatMap(() => Effect.fail(new AuthFlowError({
 					operation: "transition",
 					state: Effect.runSync(actor.get).state,
-					publicError: Errors$1.cancelled({ operation: "authFlow.send" }),
+					publicError: Errors.cancelled({ operation: "authFlow.send" }),
 					publicCode: "CANCELLED"
 				})))))) : Effect.fail(new AuthFlowError({
 					operation: "transition",
 					state: Effect.runSync(actor.get).state,
-					publicError: Errors$1.cancelled({ operation: "authFlow.send" }),
+					publicError: Errors.cancelled({ operation: "authFlow.send" }),
 					publicCode: "CANCELLED"
 				}))), Effect.tapError((failure) => failure.publicCode === "OTP_EXPIRED" ? Effect.void : emitTelemetry({
 					name: "auth_failed",
@@ -3906,7 +5130,7 @@ function requestOtpCompletion(email, anonDistinctId, options) {
 		const now = yield* (yield* ClockPortTag).now.pipe(Effect.mapError((cause) => new AuthFlowError({
 			operation: "requestOtp",
 			state: "sending_otp",
-			publicError: Errors$1.providerError("clock", "now", cause),
+			publicError: Errors.providerError("clock", "now", cause),
 			publicCode: "PROVIDER_ERROR",
 			cause
 		})));
@@ -3983,7 +5207,7 @@ function withAuthFlowTimeout(effect, operation, state, options) {
 		onTimeout: () => new AuthFlowError({
 			operation,
 			state,
-			publicError: Errors$1.providerTimeout("auth-flow", operation, timeoutMs),
+			publicError: Errors.providerTimeout("auth-flow", operation, timeoutMs),
 			publicCode: "PROVIDER_ERROR"
 		})
 	}));
@@ -4005,7 +5229,7 @@ function completeRequest(commit, deferred, input, control, effect, toFailureCont
 		const failure = new AuthFlowError({
 			operation: "transition",
 			state: "error",
-			publicError: Errors$1.unknown(cause),
+			publicError: Errors.unknown(cause),
 			publicCode: "UNKNOWN",
 			cause
 		});
@@ -4049,7 +5273,7 @@ function stoppedFailure() {
 	return new AuthFlowError({
 		operation: "transition",
 		state: "error",
-		publicError: Errors$1.cancelled({ operation: "authFlow.request" }),
+		publicError: Errors.cancelled({ operation: "authFlow.request" }),
 		publicCode: "CANCELLED"
 	});
 }
@@ -4078,7 +5302,7 @@ function wrongState(request, state) {
 	return new AuthFlowError({
 		operation: "transition",
 		state,
-		publicError: Errors$1.wrongState({
+		publicError: Errors.wrongState({
 			method: request,
 			currentState: state,
 			validStates: AUTH_FLOW_TRANSITION_TABLE[state].valid
@@ -4097,9 +5321,9 @@ function toAuthFlowError(operation, state, error) {
 	});
 }
 function toCapxulError(operation, error) {
-	if (error.cause instanceof CapxulError$2) return error.cause;
-	if (operation === "requestOtp" && error.kind === "provider") return Errors$1.emailDeliveryFailed("provider rejected OTP request");
-	return Errors$1.providerError("auth-client", operation, /* @__PURE__ */ new Error("auth-client provider failure"));
+	if (error.cause instanceof CapxulError) return error.cause;
+	if (operation === "requestOtp" && error.kind === "provider") return Errors.emailDeliveryFailed("provider rejected OTP request");
+	return Errors.providerError("auth-client", operation, /* @__PURE__ */ new Error("auth-client provider failure"));
 }
 function emitTelemetry(event) {
 	return Effect.gen(function* () {
@@ -4165,7 +5389,7 @@ function hasMachineActor(actor) {
 */
 const getSessionProgramWithOptions = (options) => Effect.gen(function* () {
 	const deps = yield* CapxulDepsTag;
-	const cached = yield* deps.authCache.getSession.pipe(Effect.mapError((e) => Errors$1.providerError("auth-cache", "getSession", e)));
+	const cached = yield* deps.authCache.getSession.pipe(Effect.mapError((e) => Errors.providerError("auth-cache", "getSession", e)));
 	const actorState = String(deps.actor.getSnapshot().value);
 	if (cached === null && (actorState === "otp_requested" || actorState === "sending_otp" || actorState === "verifying")) return null;
 	if (cached !== null && actorState !== "idle") return cached;
@@ -4205,25 +5429,25 @@ getSessionProgramWithOptions();
 function verifyOtpProgram(input, options) {
 	return Effect.gen(function* () {
 		const deps = yield* CapxulDepsTag;
-		if (!/^\d{6}$/.test(input.code)) return yield* Effect.fail(Errors$1.invalidInput("otp", "must be 6 digits"));
+		if (!/^\d{6}$/.test(input.code)) return yield* Effect.fail(Errors.invalidInput("otp", "must be 6 digits"));
 		let email;
 		try {
 			email = toEmail(input.email);
 		} catch (err) {
-			return yield* Effect.fail(err instanceof CapxulError$2 ? err : Errors$1.invalidInput("email", "invalid email"));
+			return yield* Effect.fail(err instanceof CapxulError ? err : Errors.invalidInput("email", "invalid email"));
 		}
 		let value = String(deps.actor.getSnapshot().value);
 		if (value === "error") {
 			yield* sendAuthFlowRequest(deps.actor, { _tag: "ResumeOtpEntry" }).pipe(Effect.provide(authFlowLayer(deps)), Effect.mapError((failure) => failure.publicError));
 			value = "otp_requested";
-		} else if (value !== "otp_requested") return yield* Effect.fail(Errors$1.wrongState({
+		} else if (value !== "otp_requested") return yield* Effect.fail(Errors.wrongState({
 			method: "verifyOtp",
 			currentState: value,
 			validStates: ["otp_requested"]
 		}));
 		if (!hasMachineActor(deps.actor)) {
 			const next = deps.actor.getSnapshot();
-			if (String(next.value) === "error") return yield* Effect.fail(next.context.error ?? Errors$1.unknown({ method: "verifyOtp" }));
+			if (String(next.value) === "error") return yield* Effect.fail(next.context.error ?? Errors.unknown({ method: "verifyOtp" }));
 		}
 		const session = yield* sendAuthFlowRequest(deps.actor, {
 			_tag: "VerifyOtp",
@@ -4231,8 +5455,8 @@ function verifyOtpProgram(input, options) {
 			otp: input.code,
 			...depsRequestOptions(deps, options?.signal)
 		}).pipe(Effect.provide(authFlowLayer(deps)), Effect.map((snapshot) => snapshot[1].session), Effect.mapError((failure) => failure.publicError));
-		if (session === null) return yield* Effect.fail(Errors$1.notAuthenticated());
-		yield* deps.authCache.setSession(session).pipe(Effect.mapError((e) => Errors$1.providerError("auth-cache", "setSession", e)));
+		if (session === null) return yield* Effect.fail(Errors.notAuthenticated());
+		yield* deps.authCache.setSession(session).pipe(Effect.mapError((e) => Errors.providerError("auth-cache", "setSession", e)));
 		return session;
 	});
 }
@@ -4256,7 +5480,7 @@ function depsRequestOptions(deps, signal) {
 * JWT clear on failure, matching the original's sequential `if (!ok) return`.
 */
 function clearAuthCacheEffect(authCache) {
-	return authCache.clearSession.pipe(Effect.mapError((cause) => Errors$1.providerError("auth-cache", "clearSession", cause)), Effect.zipRight(authCache.clearJwt.pipe(Effect.mapError((cause) => Errors$1.providerError("auth-cache", "clearJwt", cause)))));
+	return authCache.clearSession.pipe(Effect.mapError((cause) => Errors.providerError("auth-cache", "clearSession", cause)), Effect.zipRight(authCache.clearJwt.pipe(Effect.mapError((cause) => Errors.providerError("auth-cache", "clearJwt", cause)))));
 }
 function cryptoRandomId() {
 	const bytes = new Uint8Array(8);
@@ -4268,9 +5492,9 @@ const canSendOtpProgram = (input, options) => Effect.gen(function* () {
 	const deps = yield* CapxulDepsTag;
 	const email = yield* Effect.try({
 		try: () => toEmail(input.email),
-		catch: (err) => err instanceof CapxulError$2 ? err : Errors$1.invalidInput("email", "invalid email")
+		catch: (err) => err instanceof CapxulError ? err : Errors.invalidInput("email", "invalid email")
 	});
-	return yield* deps.authClient.canSendOtp({ email }, options?.signal === void 0 ? void 0 : { signal: options.signal }).pipe(Effect.mapError((failure) => failure.cause instanceof CapxulError$2 ? failure.cause : Errors$1.providerError("auth-client", "canSendOtp", failure.cause)));
+	return yield* deps.authClient.canSendOtp({ email }, options?.signal === void 0 ? void 0 : { signal: options.signal }).pipe(Effect.mapError((failure) => failure.cause instanceof CapxulError ? failure.cause : Errors.providerError("auth-client", "canSendOtp", failure.cause)));
 });
 /**
 * `signIn` as a single Effect requiring ONLY `CapxulDepsTag`. Faithful
@@ -4283,10 +5507,10 @@ const signInProgram = (input, options) => Effect.gen(function* () {
 	const deps = yield* CapxulDepsTag;
 	const email = yield* Effect.try({
 		try: () => toEmail(input.email),
-		catch: (err) => err instanceof CapxulError$2 ? err : Errors$1.invalidInput("email", "invalid email")
+		catch: (err) => err instanceof CapxulError ? err : Errors.invalidInput("email", "invalid email")
 	});
 	const value = String(deps.actor.getSnapshot().value);
-	if (value !== "idle" && value !== "otp_requested" && value !== "error") return yield* Effect.fail(Errors$1.wrongState({
+	if (value !== "idle" && value !== "otp_requested" && value !== "error") return yield* Effect.fail(Errors.wrongState({
 		method: "signIn",
 		currentState: value,
 		validStates: [
@@ -4304,7 +5528,7 @@ const signInProgram = (input, options) => Effect.gen(function* () {
 		email,
 		...depsRequestOptions(deps, options?.signal)
 	}).pipe(Effect.provide(authFlowLayer(deps)), Effect.mapError((failure) => failure.publicError));
-	const now = yield* deps.clock.now.pipe(Effect.mapError((cause) => Errors$1.providerError("clock", "now", cause)));
+	const now = yield* deps.clock.now.pipe(Effect.mapError((cause) => Errors.providerError("clock", "now", cause)));
 	return {
 		sessionId: cryptoRandomId(),
 		expiresAt: now + (deps.otpTtlMs ?? 3e5)
@@ -4323,7 +5547,7 @@ const signOutProgramWithOptions = (options) => Effect.gen(function* () {
 	const deps = yield* CapxulDepsTag;
 	let value = String(deps.actor.getSnapshot().value);
 	if (value === "idle") {
-		const cached = yield* deps.authCache.getSession.pipe(Effect.mapError((e) => Errors$1.providerError("auth-cache", "getSession", e)));
+		const cached = yield* deps.authCache.getSession.pipe(Effect.mapError((e) => Errors.providerError("auth-cache", "getSession", e)));
 		if (cached !== null) {
 			yield* sendAuthFlowRequest(deps.actor, {
 				_tag: "RestoreCachedSession",
@@ -4331,7 +5555,7 @@ const signOutProgramWithOptions = (options) => Effect.gen(function* () {
 			}).pipe(Effect.provide(authFlowLayer(deps)), Effect.mapError((failure) => failure.publicError));
 			value = String(deps.actor.getSnapshot().value);
 		}
-		if (value === "idle") return yield* Effect.fail(Errors$1.wrongState({
+		if (value === "idle") return yield* Effect.fail(Errors.wrongState({
 			method: "signOut",
 			currentState: value,
 			validStates: [
@@ -4366,21 +5590,21 @@ function makeAuthMethods(deps) {
 		async canSendOtp(input, options) {
 			if (options?.signal?.aborted) return {
 				ok: false,
-				error: Errors$1.cancelled({ operation: "canSendOtp" })
+				error: Errors.cancelled({ operation: "canSendOtp" })
 			};
 			return toCapxulResult(canSendOtpProgram(input, options), capxulDepsLayer(deps));
 		},
 		async signIn(input, options) {
 			if (options?.signal?.aborted) return {
 				ok: false,
-				error: Errors$1.cancelled({ operation: "signIn" })
+				error: Errors.cancelled({ operation: "signIn" })
 			};
 			return toCapxulResult(signInProgram(input, options), capxulDepsLayer(deps));
 		},
 		async verifyOtp(input, options) {
 			if (options?.signal?.aborted) return {
 				ok: false,
-				error: Errors$1.cancelled({ operation: "verifyOtp" })
+				error: Errors.cancelled({ operation: "verifyOtp" })
 			};
 			const result = await toCapxulResult(verifyOtpProgram(input, options), capxulDepsLayer(deps));
 			if (!result.ok) return result;
@@ -4389,13 +5613,13 @@ function makeAuthMethods(deps) {
 			try {
 				await afterVerifyOtp();
 			} catch (cause) {
-				if (cause instanceof CapxulError$2) return {
+				if (cause instanceof CapxulError) return {
 					ok: false,
 					error: cause
 				};
 				return {
 					ok: false,
-					error: Errors$1.providerError("sdk", "afterVerifyOtp", cause)
+					error: Errors.providerError("sdk", "afterVerifyOtp", cause)
 				};
 			}
 			return result;
@@ -4403,14 +5627,14 @@ function makeAuthMethods(deps) {
 		async signOut(options) {
 			if (options?.signal?.aborted) return {
 				ok: false,
-				error: Errors$1.cancelled({ operation: "signOut" })
+				error: Errors.cancelled({ operation: "signOut" })
 			};
 			return toCapxulResult(signOutProgramWithOptions(options), capxulDepsLayer(deps));
 		},
 		async getSession(options) {
 			if (options?.signal?.aborted) return {
 				ok: false,
-				error: Errors$1.cancelled({ operation: "getSession" })
+				error: Errors.cancelled({ operation: "getSession" })
 			};
 			return toCapxulResult(getSessionProgramWithOptions(options), capxulDepsLayer(deps));
 		}
@@ -4458,13 +5682,13 @@ function provisionSmartAccountProgram() {
 		const deps = yield* SmartAccountDepsTag;
 		const snap = deps.actor.getSnapshot();
 		const value = snap.value;
-		if (value !== "authenticated") return yield* Effect.fail(Errors$1.wrongState({
+		if (value !== "authenticated") return yield* Effect.fail(Errors.wrongState({
 			method: "smartAccount.provision",
 			currentState: value,
 			validStates: ["authenticated"]
 		}));
 		const session = snap.context.session;
-		if (session === null) return yield* Effect.fail(Errors$1.notAuthenticated());
+		if (session === null) return yield* Effect.fail(Errors.notAuthenticated());
 		const provisioned = yield* deps.smartAccountPort.provision({
 			authUserId: session.authUserId,
 			chainId: deps.chainId
@@ -4480,7 +5704,7 @@ function makeSmartAccountMethods(deps) {
 		async loadCurrent(options) {
 			if (options?.signal?.aborted) return {
 				ok: false,
-				error: Errors$1.cancelled({ operation: "smartAccount.loadCurrent" })
+				error: Errors.cancelled({ operation: "smartAccount.loadCurrent" })
 			};
 			return toCapxulResult(loadSmartAccountProgram, smartAccountDepsLayer(deps));
 		},
@@ -4508,13 +5732,13 @@ function identityDepsLayer(deps) {
 */
 const loadIdentityProgram = Effect.gen(function* () {
 	const deps = yield* IdentityDepsTag;
-	if (deps.actor === void 0) return yield* Effect.fail(Errors$1.notAuthenticated());
+	if (deps.actor === void 0) return yield* Effect.fail(Errors.notAuthenticated());
 	const snapshot = deps.actor.getSnapshot();
 	const existingError = snapshot.context.error;
-	if (existingError instanceof CapxulError$2) return yield* Effect.fail(existingError);
+	if (existingError instanceof CapxulError) return yield* Effect.fail(existingError);
 	const authUserId = snapshot.context.session?.authUserId;
 	if (authUserId === void 0) return null;
-	return yield* deps.identityPort.loadByAuthUserId(authUserId).pipe(Effect.catchAllDefect((cause) => Effect.fail(identityErrorFromCapxul("loadByAuthUserId", cause instanceof CapxulError$2 ? cause : Errors$1.unknown(cause), cause))), Effect.mapError((failure) => failure.publicError));
+	return yield* deps.identityPort.loadByAuthUserId(authUserId).pipe(Effect.catchAllDefect((cause) => Effect.fail(identityErrorFromCapxul("loadByAuthUserId", cause instanceof CapxulError ? cause : Errors.unknown(cause), cause))), Effect.mapError((failure) => failure.publicError));
 });
 //#endregion
 //#region src/client/identity.ts
@@ -4522,7 +5746,7 @@ function makeIdentityMethods(deps) {
 	return { async loadCurrent(options) {
 		if (options?.signal?.aborted) return {
 			ok: false,
-			error: Errors$1.cancelled({ operation: "identity.loadCurrent" })
+			error: Errors.cancelled({ operation: "identity.loadCurrent" })
 		};
 		return toCapxulResult(loadIdentityProgram, identityDepsLayer(deps));
 	} };
@@ -4671,14 +5895,14 @@ function makeAccountsMethods(deps) {
 		async read(options) {
 			if (options?.signal?.aborted) return {
 				ok: false,
-				error: Errors$1.cancelled({ operation: "accounts.read" })
+				error: Errors.cancelled({ operation: "accounts.read" })
 			};
 			return toCapxulResult(readAccountProgram, accountsDepsLayer(deps));
 		},
 		async fund(amount, options) {
 			if (options?.signal?.aborted) return {
 				ok: false,
-				error: Errors$1.cancelled({ operation: "accounts.fund" })
+				error: Errors.cancelled({ operation: "accounts.fund" })
 			};
 			return toCapxulResult(fundFromFaucetProgram(amount), accountsDepsLayer(deps));
 		}
@@ -5420,42 +6644,42 @@ function makeSubAccountsMethods(deps) {
 		async create(accountId, input, options) {
 			if (options?.signal?.aborted) return {
 				ok: false,
-				error: Errors$1.cancelled({ operation: "subAccounts.create" })
+				error: Errors.cancelled({ operation: "subAccounts.create" })
 			};
 			return toCapxulResult(createSubAccountProgram(accountId, input.name), layer);
 		},
 		async get(subAccountId, options) {
 			if (options?.signal?.aborted) return {
 				ok: false,
-				error: Errors$1.cancelled({ operation: "subAccounts.get" })
+				error: Errors.cancelled({ operation: "subAccounts.get" })
 			};
 			return toCapxulResult(getSubAccountProgram(subAccountId), layer);
 		},
 		async list(accountId, options) {
 			if (options?.signal?.aborted) return {
 				ok: false,
-				error: Errors$1.cancelled({ operation: "subAccounts.list" })
+				error: Errors.cancelled({ operation: "subAccounts.list" })
 			};
 			return toCapxulResult(listSubAccountsProgram(accountId), layer);
 		},
 		async rename(subAccountId, name, options) {
 			if (options?.signal?.aborted) return {
 				ok: false,
-				error: Errors$1.cancelled({ operation: "subAccounts.rename" })
+				error: Errors.cancelled({ operation: "subAccounts.rename" })
 			};
 			return toCapxulResult(renameSubAccountProgram(subAccountId, name), layer);
 		},
 		async delete(subAccountId, options) {
 			if (options?.signal?.aborted) return {
 				ok: false,
-				error: Errors$1.cancelled({ operation: "subAccounts.delete" })
+				error: Errors.cancelled({ operation: "subAccounts.delete" })
 			};
 			return toCapxulResult(deleteSubAccountProgram(subAccountId), layer);
 		},
 		async transfer(input, options) {
 			if (options?.signal?.aborted) return {
 				ok: false,
-				error: Errors$1.cancelled({ operation: "subAccounts.transfer" })
+				error: Errors.cancelled({ operation: "subAccounts.transfer" })
 			};
 			return toCapxulResult(transferSubAccountProgram(input), layer);
 		}
@@ -5559,18 +6783,18 @@ function isOrgTelemetryDebugEnabled() {
 //#endregion
 //#region src/client/org-spend-gate.ts
 function evaluateSpendGate(input) {
-	if (!input.activeMember) return reject("not_member", Errors$1.invalidInput("member", "you are not an active member"));
-	if (!recipientAllowed(input.recipients, input.recipient)) return reject("invalid_recipient", Errors$1.invalidRecipient("recipient is not allowed by this role"));
-	if (!subAccountAllowed(input.subAccounts, input.subAccountId)) return reject("wrong_envelope", Errors$1.invalidInput("subAccountId", "sub-account not in scope for this role"));
+	if (!input.activeMember) return reject("not_member", Errors.invalidInput("member", "you are not an active member"));
+	if (!recipientAllowed(input.recipients, input.recipient)) return reject("invalid_recipient", Errors.invalidRecipient("recipient is not allowed by this role"));
+	if (!subAccountAllowed(input.subAccounts, input.subAccountId)) return reject("wrong_envelope", Errors.invalidInput("subAccountId", "sub-account not in scope for this role"));
 	const amount = parseRaw(input.amountRaw, "amountRaw");
 	const balance = parseRaw(input.subAccountBalanceRaw, "subAccountBalanceRaw");
-	if (amount > balance) return reject("insufficient_subaccount_balance", Errors$1.insufficientBalance(input.currency, balance.toString(10), amount.toString(10)));
+	if (amount > balance) return reject("insufficient_subaccount_balance", Errors.insufficientBalance(input.currency, balance.toString(10), amount.toString(10)));
 	const perTxCap = parseOptionalRaw(input.perTxCapRaw, "perTxCapRaw");
-	if (perTxCap !== null && amount > perTxCap) return reject("over_cap", Errors$1.insufficientBalance("role per-transaction cap", perTxCap.toString(10), amount.toString(10)));
+	if (perTxCap !== null && amount > perTxCap) return reject("over_cap", Errors.insufficientBalance("role per-transaction cap", perTxCap.toString(10), amount.toString(10)));
 	const perDayCap = parseOptionalRaw(input.perDayCapRaw, "perDayCapRaw");
 	if (perDayCap !== null) {
 		const remaining = perDayCap - (parseOptionalRaw(input.spentTodayRaw, "spentTodayRaw") ?? 0n);
-		if (remaining < amount) return reject("daily_cap_exhausted", Errors$1.insufficientBalance("role daily cap", remaining.toString(10), amount.toString(10)));
+		if (remaining < amount) return reject("daily_cap_exhausted", Errors.insufficientBalance("role daily cap", remaining.toString(10), amount.toString(10)));
 	}
 	return { ok: true };
 }
@@ -5595,7 +6819,7 @@ function parseOptionalRaw(value, field) {
 	return parseRaw(value, field);
 }
 function parseRaw(value, field) {
-	if (!/^[0-9]+$/.test(value)) throw Errors$1.invalidInput(field, "must be a non-negative integer string");
+	if (!/^[0-9]+$/.test(value)) throw Errors.invalidInput(field, "must be a non-negative integer string");
 	return BigInt(value);
 }
 //#endregion
@@ -5612,7 +6836,7 @@ function missingLiveOrgDep(portName) {
 }
 /** Zero `Money` in the USDX-backed display currency (a fresh Org's treasury). */
 function zeroMoney() {
-	return fromWei("0", USDX_DECIMALS, USDX_CURRENCY);
+	return fromWei("0", 6, "USD");
 }
 /** A fresh Org's treasury Account: `$0` balance, `available === balance`. */
 function zeroTreasury(orgId) {
@@ -5964,7 +7188,7 @@ function gateOneRun(input) {
 				subAccountBalanceRaw: subtractNonNegative(baseGateInput.subAccountBalanceRaw, accumulated),
 				spentTodayRaw: (BigInt(authority.spentTodayRaw ?? "0") + accumulated).toString(10)
 			}),
-			catch: (cause) => isCapxulError$1(cause) ? cause : Errors.unknown(cause)
+			catch: (cause) => isCapxulError(cause) ? cause : Errors.unknown(cause)
 		});
 		if (!decision.ok) return yield* Effect.fail(decision.error);
 		return {
@@ -5984,7 +7208,7 @@ function spendViaPaymentsProgram(orgId, input) {
 		if (deps.orgSpendPort === void 0 && !isHermeticOrgDeps(deps)) return yield* Effect.fail(missingLiveOrgDep("orgSpendPort"));
 		const to = yield* Effect.try({
 			try: () => refToRecipientString(input.to),
-			catch: (cause) => isCapxulError$1(cause) ? cause : Errors.invalidInput("to", "invalid Ref")
+			catch: (cause) => isCapxulError(cause) ? cause : Errors.invalidInput("to", "invalid Ref")
 		});
 		const gated = yield* gateOneRun({
 			deps,
@@ -6017,7 +7241,7 @@ function batchPayrollProgram(orgId, input) {
 		const gated = [];
 		const recipients = yield* Effect.try({
 			try: () => input.runs.map((run) => refToRecipientString(run.to)),
-			catch: (cause) => isCapxulError$1(cause) ? cause : Errors.invalidInput("to", "invalid Ref")
+			catch: (cause) => isCapxulError(cause) ? cause : Errors.invalidInput("to", "invalid Ref")
 		});
 		let accumulatedRaw = 0n;
 		for (const [index, run] of input.runs.entries()) {
@@ -6337,7 +7561,7 @@ async function runCompletePersonalOnboarding(ops, input) {
 	const validated = validatePersonalInput(input);
 	if (!validated.ok) return validated;
 	const session = await ops.currentSession();
-	if (session === null) return fail(Errors$1.notAuthenticated());
+	if (session === null) return fail(Errors.notAuthenticated());
 	const written = await ops.completeIdentityOnboarding({
 		authUserId: session.authUserId,
 		email: session.email,
@@ -6360,7 +7584,7 @@ async function runCompleteOrganizationOnboarding(ops, input) {
 	const validated = validateOrganizationInput(input);
 	if (!validated.ok) return validated;
 	const session = await ops.currentSession();
-	if (session === null) return fail(Errors$1.notAuthenticated());
+	if (session === null) return fail(Errors.notAuthenticated());
 	const written = await ops.completeIdentityOnboarding({
 		authUserId: session.authUserId,
 		email: session.email,
@@ -6432,7 +7656,7 @@ function validateOrganizationInput(input) {
 }
 function requireNonEmpty(value, field) {
 	const trimmed = typeof value === "string" ? value.trim() : "";
-	if (trimmed.length === 0) return fail(Errors$1.invalidInput(field, "must be a non-empty string"));
+	if (trimmed.length === 0) return fail(Errors.invalidInput(field, "must be a non-empty string"));
 	return {
 		ok: true,
 		value: trimmed
@@ -6460,12 +7684,12 @@ function parseAddress(value, field) {
 }
 function invalidFrom(field, cause, fallback) {
 	const message = cause instanceof Error && cause.message.length > 0 ? cause.message : fallback;
-	return Errors$1.invalidInput(field, message);
+	return Errors.invalidInput(field, message);
 }
 function fail(error) {
 	return {
 		ok: false,
-		error: error instanceof CapxulError$2 ? error : Errors$1.unknown(error)
+		error: error instanceof CapxulError ? error : Errors.unknown(error)
 	};
 }
 //#endregion
@@ -6482,14 +7706,14 @@ function makeOnboardingMethods(ops) {
 		completePersonal(input, options) {
 			if (options?.signal?.aborted) return Promise.resolve({
 				ok: false,
-				error: Errors$1.cancelled({ operation: "onboarding.completePersonal" })
+				error: Errors.cancelled({ operation: "onboarding.completePersonal" })
 			});
 			return runCompletePersonalOnboarding(ops, input);
 		},
 		completeOrganization(input, options) {
 			if (options?.signal?.aborted) return Promise.resolve({
 				ok: false,
-				error: Errors$1.cancelled({ operation: "onboarding.completeOrganization" })
+				error: Errors.cancelled({ operation: "onboarding.completeOrganization" })
 			});
 			return runCompleteOrganizationOnboarding(ops, input);
 		}
@@ -6950,7 +8174,7 @@ function validateCreateCapxulClientInput(input) {
 	const runtime = input.runtime ?? detectRuntime();
 	if ((input.requirement ?? "none") === "deployed" && input.signer === void 0 && runtime !== "browser") return {
 		ok: false,
-		error: Errors$1.invalidInput("signer", "required when requirement is \"deployed\"")
+		error: Errors.invalidInput("signer", "required when requirement is \"deployed\"")
 	};
 	return {
 		ok: true,
@@ -6983,10 +8207,10 @@ function detectRuntime() {
 	return globalAny.window !== void 0 || globalAny.document !== void 0 ? "browser" : "node";
 }
 function derivedBrowserOrigin(runtime) {
-	if (runtime !== "browser") throw Errors$1.invalidInput("origin", "required outside browser runtime");
+	if (runtime !== "browser") throw Errors.invalidInput("origin", "required outside browser runtime");
 	const globalAny = globalThis;
 	if (typeof globalAny.location?.origin === "string" && globalAny.location.origin.length > 0) return globalAny.location.origin;
-	throw Errors$1.invalidInput("origin", "required when browser location is unavailable");
+	throw Errors.invalidInput("origin", "required when browser location is unavailable");
 }
 /**
 * Browser local dev serves `/api/auth` via the Vite proxy on `window.location.origin`
@@ -7055,20 +8279,20 @@ function normalizeHttpUrl(field, raw) {
 	try {
 		parsed = new URL(raw);
 	} catch {
-		throw Errors$1.invalidInput(field, "must be an http or https URL");
+		throw Errors.invalidInput(field, "must be an http or https URL");
 	}
-	if (parsed.protocol !== "http:" && parsed.protocol !== "https:") throw Errors$1.invalidInput(field, "must be an http or https URL");
+	if (parsed.protocol !== "http:" && parsed.protocol !== "https:") throw Errors.invalidInput(field, "must be an http or https URL");
 	return parsed.toString().replace(/\/$/, "");
 }
 function toPublicError(cause, operation) {
-	if (cause instanceof CapxulError$2) return cause;
+	if (cause instanceof CapxulError) return cause;
 	if (typeof cause === "object" && cause !== null) {
 		const publicError = cause.publicError;
-		if (publicError instanceof CapxulError$2) return publicError;
+		if (publicError instanceof CapxulError) return publicError;
 		const nestedCause = cause.cause;
-		if (nestedCause instanceof CapxulError$2) return nestedCause;
+		if (nestedCause instanceof CapxulError) return nestedCause;
 	}
-	return Errors$1.providerError("sdk-production-adapters", operation, cause);
+	return Errors.providerError("sdk-production-adapters", operation, cause);
 }
 function idempotentClose(close) {
 	let closed = false;