@capxul/sdk 1.2.2 → 2.0.0

package/dist/{create-capxul-client-DVzm78RU.mjs → create-capxul-client-N36cHqE2.mjs}

@@ -1,4 +1,4 @@
-import { D as toRoleKey, M as EXPECTED_OPERATION_OUTCOMES, N as Errors, P as isCapxulError, T as toOrgId, _ as toCountryCode, b as toEmail, c as BYTES32_RE, d as toAccountId, f as toAddress, g as toChainId, h as toAuthUserId, j as CapxulError, k as toSubAccountId, l as EVM_ADDRESS_RE$1, n as BrowserAuthCacheAdapter, s as APP_ID_RE, t as InMemoryAuthCacheAdapter, u as SUPPORTED_CURRENCY_CODES, v as toCurrencyCode } from "./InMemoryAuthCacheAdapter-Dr1sEd9y.mjs";
+import { D as toOrgId, F as isCapxulError, M as CapxulError, N as EXPECTED_OPERATION_OUTCOMES, P as Errors, S as toEmail, _ as toAuthUserId, b as toCurrencyCode, c as BYTES32_RE, d as WEI_RE, f as ZERO_BYTES32, k as toRoleKey, l as EVM_ADDRESS_RE$1, m as toAddress, n as BrowserAuthCacheAdapter, p as toAccountId, s as APP_ID_RE, t as InMemoryAuthCacheAdapter, u as SUPPORTED_CURRENCY_CODES, v as toChainId, y as toCountryCode } from "./InMemoryAuthCacheAdapter-Rc8tCtml.mjs";
 import { concat, encodeAbiParameters, encodeFunctionData, encodePacked, formatUnits, getContractAddress, keccak256, padHex, parseUnits, stringToHex, toBytes, toEventSelector, toFunctionSelector } from "viem";
 import { Context, Data, Deferred, Effect, Exit, Fiber, Layer, Queue, Ref, Result, Schema, SchemaGetter, Scope } from "effect";
 import { makeFunctionReference } from "convex/server";
@@ -591,8 +591,6 @@ const EXEC_TRANSACTION_WITH_ROLE = "zodiac.roles.execTransactionWithRole";
 const ASSIGN_ROLES = "zodiac.roles.assignRoles";
 const SCOPE_TARGET = "zodiac.roles.scopeTarget";
 const OWNER_ROLE_LABEL = "Owner";
-const MARKETING_SUB_ACCOUNT_ID = "subaccount_marketing";
-const PAYROLL_SUB_ACCOUNT_ID = "subaccount_payroll";
 function usd(value) {
 	return {
 		currency: "USD",
@@ -630,7 +628,6 @@ function orgRoleKeyForLabel(label) {
 function soloOrgRoleTemplate() {
 	return [{
 		label: "Owner",
-		subAccounts: { scope: "all" },
 		canManageMembers: true,
 		canManageRoles: true
 	}];
@@ -644,8 +641,7 @@ function startupOrgRoleTemplate() {
 				perTx: usd("25000"),
 				perDay: usd("100000"),
 				toRecipients: "anyone"
-			},
-			subAccounts: { scope: [MARKETING_SUB_ACCOUNT_ID] }
+			}
 		},
 		{
 			label: "Team Lead",
@@ -653,8 +649,7 @@ function startupOrgRoleTemplate() {
 				perTx: usd("5000"),
 				perDay: usd("15000"),
 				toRecipients: "anyone"
-			},
-			subAccounts: { scope: [PAYROLL_SUB_ACCOUNT_ID] }
+			}
 		}
 	];
 }
@@ -723,6 +718,10 @@ new Map([
 	["setAllowance(bytes32,uint128,uint128,uint128,uint64,uint64)", "SetAllowance(bytes32,uint128,uint128,uint128,uint64,uint64)"]
 ].map(([functionSignature, eventSignature]) => [toFunctionSelector(functionSignature), toEventSelector(eventSignature)]));
 //#endregion
+//#region ../config/src/capxul-payments-v2.ts
+/** Immutable CapxulPaymentsV2 deployment on Base Sepolia. */
+const CAPXUL_PAYMENTS_V2_ADDRESS = "0xA3ACDD016f706eD432A9a0545C45F0943f996b60";
+//#endregion
 //#region src/telemetry/stack-frame-parser.ts
 /**
 * Regex for V8/Chrome stack trace frame lines.
@@ -925,6 +924,50 @@ function isProvisioningTelemetryDebugEnabled() {
 	return globalThis.process?.env?.CAPXUL_DEBUG_TELEMETRY === "1";
 }
 //#endregion
+//#region src/internal/invocation-observation.ts
+const INVOCATION_OBSERVATION = Symbol("capxul.invocation-observation");
+const FAILURE_INVOCATION_SNAPSHOT = Symbol("capxul.failure-invocation-snapshot");
+/** @internal Attach one immutable, non-wire invocation snapshot to an SDK-owned object. */
+function attachInvocationObservation(target, source) {
+	const snapshot = Object.freeze(source.context === void 0 ? { active: source.active } : {
+		active: source.active,
+		context: Object.freeze({ ...source.context })
+	});
+	Object.defineProperty(target, INVOCATION_OBSERVATION, {
+		configurable: false,
+		enumerable: false,
+		value: snapshot,
+		writable: false
+	});
+	return target;
+}
+/** @internal Read the snapshot without exposing its symbol or adding a wire field. */
+function readInvocationObservation(source) {
+	if (typeof source !== "object" || source === null) return void 0;
+	return source[INVOCATION_OBSERVATION];
+}
+/** @internal Carry a snapshot across an SDK adapter projection without resolving again. */
+function copyInvocationObservation(source, target) {
+	const snapshot = readInvocationObservation(source);
+	return snapshot === void 0 ? target : attachInvocationObservation(target, snapshot);
+}
+/** @internal Carry the public call-start delivery decision with its failure envelope. */
+function markFailureInvocationSnapshot(failure, snapshot) {
+	Object.defineProperty(failure, FAILURE_INVOCATION_SNAPSHOT, {
+		configurable: false,
+		enumerable: false,
+		value: Object.freeze(snapshot),
+		writable: false
+	});
+	return failure;
+}
+/** @internal Read the call-start delivery decision; undefined means a direct adapter call. */
+function readFailureInvocationSnapshot(failure) {
+	if (typeof failure !== "object" || failure === null) return void 0;
+	const snapshot = failure[FAILURE_INVOCATION_SNAPSHOT];
+	return typeof snapshot === "object" && snapshot !== null && "active" in snapshot ? snapshot : void 0;
+}
+//#endregion
 //#region src/domain/machine/telemetry.ts
 const definedEntries = (values) => Object.fromEntries(Object.entries(values).filter((entry) => entry[1] !== void 0));
 const SAFE_ENGINEERING_ID = /^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$/u;
@@ -1067,7 +1110,7 @@ const boot = (spec, options = {}) => Effect.gen(function* () {
 	const makeFailure = (state, event, reason, details) => new ActorFailure(reason, spec.machine, spec.label(state), event._tag, details);
 	const nonApplied = (state, event, reason, outcome, env) => {
 		const slot = env.origin?.slot ?? spec.slot(event);
-		return {
+		return copyInvocationObservation(env.invocation, {
 			machine: spec.machine,
 			state: spec.label(state),
 			event: event._tag,
@@ -1077,9 +1120,9 @@ const boot = (spec, options = {}) => Effect.gen(function* () {
 			duration_ms: duration(env.startedAt),
 			...withCarriage(env.invocation),
 			...outcome === "refused" ? { refusal_code: reason } : { error_code: reason }
-		};
+		});
 	};
-	const applied = (from, to, event, slot, epoch, env) => ({
+	const applied = (from, to, event, slot, epoch, env) => copyInvocationObservation(env.invocation, {
 		machine: spec.machine,
 		from: spec.label(from),
 		event: event._tag,
@@ -1564,6 +1607,24 @@ function mapAccountLifecycle(input) {
 }
 //#endregion
 //#region ../wire/src/brands.ts
+const lowercasedString = Schema.String.pipe(Schema.decodeTo(Schema.String, {
+	decode: SchemaGetter.transform((value) => value.toLowerCase()),
+	encode: SchemaGetter.transform((value) => value)
+}));
+const addressSchema = (name) => lowercasedString.pipe(Schema.refine((value) => EVM_ADDRESS_RE$1.test(value), { message: `${name} must be a 0x-prefixed EVM address` }));
+const bytes32BrandSchema = (name) => lowercasedString.pipe(Schema.refine((value) => BYTES32_RE.test(value), { message: `${name} must be a 0x-prefixed bytes32 value` }));
+/** Lowercase, 0x-prefixed bytes32 evidence without a public brand. */
+const Bytes32Schema = bytes32BrandSchema("value");
+const AddressSchema$1 = addressSchema("address");
+const SafeAddressSchema = addressSchema("safe address");
+const ModuleAddressSchema = addressSchema("module address");
+const TxHashSchema$1 = bytes32BrandSchema("transaction hash");
+const RoleKeySchema = bytes32BrandSchema("role key");
+const AllowanceKeySchema = bytes32BrandSchema("allowance key");
+const BlockNumberSchema$1 = Schema.Number.pipe(Schema.refine((value) => Number.isSafeInteger(value) && value >= 0, { message: "must be a non-negative safe integer" }));
+const LogIndexSchema = Schema.Number.pipe(Schema.refine((value) => Number.isSafeInteger(value) && value >= 0, { message: "must be a non-negative safe integer" }));
+const WeiAmountSchema$1 = Schema.String.pipe(Schema.refine((value) => WEI_RE.test(value), { message: "must be a non-negative integer string" }));
+const SettlementIdSchema = bytes32BrandSchema("settlementId").pipe(Schema.refine((value) => value !== ZERO_BYTES32, { message: "settlementId must not be zero" }));
 /**
 * `AppId` schema. Mirrors `toAppId` from `@capxul/types`:
 * `app_` + Crockford-base32 ULID (26 chars, first char in `[0-7]`).
@@ -1583,13 +1644,15 @@ const DOCUMENT_HASH_HEX_RE = /^[0-9a-fA-F]{64}$/;
 * `DocumentHash` schema. Mirrors `toDocumentHash`: bare or 0x-prefixed bytes32,
 * normalized to lowercase 0x-prefixed form.
 */
-const DocumentHashSchema$1 = Schema.String.pipe(Schema.decodeTo(Schema.String, {
+const DocumentHashSchema = Schema.String.pipe(Schema.decodeTo(Schema.String, {
 	decode: SchemaGetter.transform((s) => {
 		const stripped = s.startsWith("0x") || s.startsWith("0X") ? s.slice(2) : s;
 		return DOCUMENT_HASH_HEX_RE.test(stripped) ? `0x${stripped.toLowerCase()}` : s;
 	}),
 	encode: SchemaGetter.transform((s) => s)
 }), Schema.refine((s) => BYTES32_RE.test(s), { message: "must be 32 bytes of hex" }));
+/** L2 orchestrated money evidence requires a nonzero Document hash. */
+const NonzeroDocumentHashSchema = DocumentHashSchema.pipe(Schema.refine((value) => value !== ZERO_BYTES32, { message: "documentHash must not be zero" }));
 /**
 * `SessionToken` schema. Mirrors `toSessionToken`: non-empty string.
 * Issuance source distinguishes SDK-handshake tokens from auth-session
@@ -1606,6 +1669,25 @@ const EpochMsSchema$1 = Schema.Number.pipe(Schema.refine((n) => Number.isSafeInt
 const DurationMsSchema$1 = Schema.Number.pipe(Schema.refine((n) => Number.isSafeInteger(n) && n >= 0, { message: "must be a non-negative safe integer" }));
 //#endregion
 //#region ../wire/src/bootstrap.ts
+const PUBLIC_POSTHOG_PROJECT_TOKEN = /^phc_[A-Za-z0-9_-]{1,191}$/u;
+const PostHogIngestOrigin = Schema.String.pipe(Schema.refine((value) => {
+	try {
+		const url = new URL(value);
+		return url.protocol === "https:" && url.username.length === 0 && url.password.length === 0 && url.pathname === "/" && url.search.length === 0 && url.hash.length === 0 && (url.hostname === "posthog.com" || url.hostname.endsWith(".posthog.com"));
+	} catch {
+		return false;
+	}
+}, { message: "must be a credential-free PostHog HTTPS ingest origin" }));
+const EngineeringTelemetryBootstrapPolicy = Schema.Struct({
+	host: PostHogIngestOrigin,
+	projectToken: Schema.String.pipe(Schema.refine((value) => PUBLIC_POSTHOG_PROJECT_TOKEN.test(value), { message: "must be a public PostHog project token" })),
+	capxulEnv: Schema.Union([
+		Schema.Literal("development"),
+		Schema.Literal("e2e"),
+		Schema.Literal("staging"),
+		Schema.Literal("production")
+	])
+});
 /**
 * `BootstrapEnvelope` v1.
 *
@@ -1631,7 +1713,8 @@ const BootstrapEnvelope = Schema.Struct({
 		convexUrl: Schema.String,
 		siteBaseUrl: Schema.String,
 		openfortPublishableKey: Schema.String,
-		shieldPublishableKey: Schema.String
+		shieldPublishableKey: Schema.String,
+		engineeringTelemetry: Schema.optional(EngineeringTelemetryBootstrapPolicy)
 	})
 });
 //#endregion
@@ -1646,15 +1729,6 @@ const CAPXUL_FUNCTIONS = {
 		faucetMint: "account/actions:faucetMint",
 		readBalance: "account/actions:readBalance"
 	},
-	"financialOps/actions": {
-		cancelCommitment: "financialOps/actions:cancelCommitment",
-		claimCommitment: "financialOps/actions:claimCommitment",
-		markCommitmentCreated: "financialOps/actions:markCommitmentCreated",
-		markPaymentSettled: "financialOps/actions:markPaymentSettled",
-		markWithdrawalSettled: "financialOps/actions:markWithdrawalSettled",
-		recordOrgPayment: "financialOps/actions:recordOrgPayment",
-		redirectCommitment: "financialOps/actions:redirectCommitment"
-	},
 	"financialOps/addressBook": {
 		add: "financialOps/addressBook:add",
 		get: "financialOps/addressBook:get",
@@ -1666,28 +1740,11 @@ const CAPXUL_FUNCTIONS = {
 	"financialOps/destinations": {
 		add: "financialOps/destinations:add",
 		list: "financialOps/destinations:list",
-		payout: "financialOps/destinations:payout",
 		remove: "financialOps/destinations:remove"
 	},
-	"financialOps/insights": {
-		history: "financialOps/insights:history",
-		summary: "financialOps/insights:summary"
-	},
-	"financialOps/mutations": {
-		createPayee: "financialOps/mutations:createPayee",
-		pay: "financialOps/mutations:pay",
-		withdraw: "financialOps/mutations:withdraw"
-	},
-	"financialOps/payrollRoster": {
-		add: "financialOps/payrollRoster:add",
-		list: "financialOps/payrollRoster:list",
-		remove: "financialOps/payrollRoster:remove",
-		run: "financialOps/payrollRoster:run",
-		update: "financialOps/payrollRoster:update"
-	},
+	"financialOps/mutations": { createPayee: "financialOps/mutations:createPayee" },
 	"financialOps/queries": {
 		depositInstructions: "financialOps/queries:depositInstructions",
-		getCommitmentRef: "financialOps/queries:getCommitmentRef",
 		getPayee: "financialOps/queries:getPayee",
 		getPayment: "financialOps/queries:getPayment",
 		listPayments: "financialOps/queries:listPayments",
@@ -1704,8 +1761,7 @@ const CAPXUL_FUNCTIONS = {
 		get: "financialOps/requestsInbox:get",
 		inboxList: "financialOps/requestsInbox:inboxList",
 		issue: "financialOps/requestsInbox:issue",
-		list: "financialOps/requestsInbox:list",
-		reconcile: "financialOps/requestsInbox:reconcile"
+		list: "financialOps/requestsInbox:list"
 	},
 	"identity/mutations": {
 		completeOnboarding: "identity/mutations:completeOnboarding",
@@ -1716,24 +1772,44 @@ const CAPXUL_FUNCTIONS = {
 		loadByAuthUserId: "identity/queries:loadByAuthUserId",
 		usernameAvailable: "identity/queries:usernameAvailable"
 	},
+	"holdings/actions": { current: "holdings/actions:current" },
+	"movement/activity": {
+		annotate: "movement/activity:annotate",
+		get: "movement/activity:get",
+		list: "movement/activity:list"
+	},
+	"moneyExecution/actions": {
+		preparePermissionExecution: "moneyExecution/actions:preparePermissionExecution",
+		preparePaymentExecution: "moneyExecution/actions:preparePaymentExecution",
+		submitPermissionExecution: "moneyExecution/actions:submitPermissionExecution",
+		submitPaymentExecution: "moneyExecution/actions:submitPaymentExecution"
+	},
+	"moneyExecution/paymentCommandActions": {
+		preparePaymentLifecycleExecution: "moneyExecution/paymentCommandActions:preparePaymentLifecycleExecution",
+		prepareOrganizationPaymentExecution: "moneyExecution/paymentCommandActions:prepareOrganizationPaymentExecution",
+		submitPaymentCommandExecution: "moneyExecution/paymentCommandActions:submitPaymentCommandExecution"
+	},
 	media: {
 		generateUploadUrl: "media:generateUploadUrl",
 		setOrgLogo: "media:setOrgLogo",
 		setProfileImage: "media:setProfileImage"
 	},
 	"org/actions": {
-		assignRole: "org/actions:assignRole",
 		confirmBootstrap: "org/actions:confirmBootstrap",
-		deployOrgRoles: "org/actions:deployOrgRoles",
 		detectAndAcceptPendingInvitations: "org/actions:detectAndAcceptPendingInvitations",
 		inviteMember: "org/actions:inviteMember",
 		prepareBootstrap: "org/actions:prepareBootstrap",
 		prepareFounderAccount: "org/actions:prepareFounderAccount",
 		readTreasury: "org/actions:readTreasury",
-		removeMember: "org/actions:removeMember",
 		resumeBootstrapSubmission: "org/actions:resumeBootstrapSubmission",
 		submitBootstrap: "org/actions:submitBootstrap"
 	},
+	"permission/actions": { verify: "permission/actions:verify" },
+	"permission/mutations": { command: "permission/mutations:command" },
+	"permission/queries": {
+		authorize: "permission/queries:authorize",
+		read: "permission/queries:read"
+	},
 	"org/lifecycle": {
 		getProofReceipt: "org/lifecycle:getProofReceipt",
 		load: "org/lifecycle:load",
@@ -1761,31 +1837,19 @@ const CAPXUL_FUNCTIONS = {
 		loadByAuthUserId: "smartAccount/queries:loadByAuthUserId",
 		loadBySmartAccountAddress: "smartAccount/queries:loadBySmartAccountAddress"
 	},
-	"subAccount/actions": { transfer: "subAccount/actions:transfer" },
-	"subAccount/mutations": {
-		create: "subAccount/mutations:create",
-		remove: "subAccount/mutations:remove",
-		rename: "subAccount/mutations:rename"
-	},
-	"subAccount/queries": {
-		get: "subAccount/queries:get",
-		list: "subAccount/queries:list"
-	},
 	system: { health: "system:health" }
 };
 //#endregion
 //#region ../wire/src/status.ts
-/** Payment lifecycle states carried on the wire (ADR-0018 P1). */
-const PAYMENT_STATUSES = [
+/** The closed L2 Payment status authority. */
+const L2_PAYMENT_STATUSES = [
 	"pending",
-	"submitted",
-	"pending_claim",
+	"settling",
 	"scheduled",
 	"streaming",
+	"pending_claim",
 	"settled",
 	"cancelled",
-	"redirected",
-	"expired",
 	"failed"
 ];
 /** What a payment is FOR. Pairs with `PAYMENT_DOCUMENT_KINDS`. */
@@ -1824,7 +1888,7 @@ const HANDLE_RE = /^@?[a-z0-9][a-z0-9-]{2,31}$/;
 const ORG_HANDLE_RE = /^[a-z0-9][a-z0-9-]{2,31}$/;
 const EMAIL_RE = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
 const MinorUnitStringSchema = Schema.String.pipe(Schema.check(Schema.makeFilter((value) => MINOR_UNIT_STRING_RE.test(value), { message: "must be a non-negative integer minor-unit string" })));
-const PaymentIdSchema = Schema.String.pipe(Schema.check(Schema.makeFilter((value) => PAYMENT_ID_RE.test(value), { message: "must be payment_ plus an alphanumeric id" })));
+const PaymentIdSchema$1 = Schema.String.pipe(Schema.check(Schema.makeFilter((value) => PAYMENT_ID_RE.test(value), { message: "must be payment_ plus an alphanumeric id" })));
 const PayeeIdSchema = Schema.String.pipe(Schema.check(Schema.makeFilter((value) => PAYEE_ID_RE.test(value), { message: "must be payee_ plus an alphanumeric id" })));
 const OrgIdSchema = Schema.String.pipe(Schema.check(Schema.makeFilter((value) => ORG_ID_RE.test(value), { message: "must be org_ plus an alphanumeric id" })));
 const UserIdSchema = Schema.String.pipe(Schema.check(Schema.makeFilter((value) => USER_ID_RE.test(value), { message: "must be user_ plus an alphanumeric id" })));
@@ -1832,7 +1896,7 @@ const DecimalStringSchema = Schema.String.pipe(Schema.check(Schema.makeFilter((v
 const HandleValueSchema = Schema.String.pipe(Schema.check(Schema.makeFilter((value) => !EVM_ADDRESS_RE.test(value) && HANDLE_RE.test(value), { message: "must be a handle; raw addresses are not accepted" })));
 const OrgHandleValueSchema = Schema.String.pipe(Schema.check(Schema.makeFilter((value) => !EVM_ADDRESS_RE.test(value) && ORG_HANDLE_RE.test(value), { message: "must be an org handle; raw addresses are not accepted" })));
 const EmailValueSchema = Schema.String.pipe(Schema.check(Schema.makeFilter((value) => !EVM_ADDRESS_RE.test(value) && EMAIL_RE.test(value), { message: "must be an email; raw addresses are not accepted" })));
-const Uint8Schema = Schema.Number.pipe(Schema.check(Schema.makeFilter((value) => Number.isSafeInteger(value) && value >= 0 && value <= 255, { message: "must be a uint8" })));
+const Uint8Schema$1 = Schema.Number.pipe(Schema.check(Schema.makeFilter((value) => Number.isSafeInteger(value) && value >= 0 && value <= 255, { message: "must be a uint8" })));
 const Uint64Schema = Schema.Number.pipe(Schema.check(Schema.makeFilter((value) => Number.isSafeInteger(value) && value >= 0, { message: "must be a non-negative safe integer" })));
 const PaymentDocumentDomain = Schema.Struct({
 	name: Schema.Literal("CapxulPayments"),
@@ -1853,10 +1917,10 @@ const InvoiceDocument = Schema.Struct({
 	payeeRef: Schema.String,
 	amount: MinorUnitStringSchema,
 	currency: CurrencyCodeSchema$1,
-	decimals: Uint8Schema,
+	decimals: Uint8Schema$1,
 	issuedAt: Uint64Schema,
 	dueAt: Uint64Schema,
-	lineItemsHash: DocumentHashSchema$1
+	lineItemsHash: DocumentHashSchema
 });
 const PayslipDocument = Schema.Struct({
 	kind: Schema.Literal(2),
@@ -1866,7 +1930,7 @@ const PayslipDocument = Schema.Struct({
 	gross: MinorUnitStringSchema,
 	net: MinorUnitStringSchema,
 	currency: CurrencyCodeSchema$1,
-	decimals: Uint8Schema,
+	decimals: Uint8Schema$1,
 	issuedAt: Uint64Schema
 });
 const ReceiptDocument = Schema.Struct({
@@ -1874,7 +1938,7 @@ const ReceiptDocument = Schema.Struct({
 	reference: Schema.String,
 	amount: MinorUnitStringSchema,
 	currency: CurrencyCodeSchema$1,
-	decimals: Uint8Schema,
+	decimals: Uint8Schema$1,
 	paidAt: Uint64Schema,
 	note: Schema.String
 });
@@ -1884,7 +1948,7 @@ const WithdrawalDocument = Schema.Struct({
 	reference: Schema.String,
 	amount: MinorUnitStringSchema,
 	currency: CurrencyCodeSchema$1,
-	decimals: Uint8Schema,
+	decimals: Uint8Schema$1,
 	destChain: ChainIdSchema$1,
 	destAddress: WithdrawalDestAddressSchema,
 	settledAt: Uint64Schema,
@@ -1897,7 +1961,7 @@ const FinancialOpsMoney = Schema.Struct({
 	decimals: Schema.Number.pipe(Schema.check(Schema.makeFilter((value) => Number.isSafeInteger(value) && value >= 0, { message: "must be a non-negative safe integer" })))
 });
 const PaymentDocument = Schema.Struct({
-	documentHash: DocumentHashSchema$1,
+	documentHash: DocumentHashSchema,
 	kind: Schema.Literals(PAYMENT_DOCUMENT_KINDS),
 	title: Schema.optional(Schema.String),
 	uri: Schema.optional(Schema.String),
@@ -2023,8 +2087,8 @@ const PaymentRef = Schema.Union([
 	})
 ]);
 const Payment = Schema.Struct({
-	id: PaymentIdSchema,
-	status: Schema.Literals(PAYMENT_STATUSES),
+	id: PaymentIdSchema$1,
+	status: Schema.Literals(L2_PAYMENT_STATUSES),
 	amount: FinancialOpsMoney,
 	paymentType: PaymentType,
 	recipient: PaymentRecipient,
@@ -2088,260 +2152,1276 @@ Schema.Struct({
 	version: Schema.Literal(1),
 	payments: Schema.Array(Payment)
 });
-`
-.capxul-doc{--ink:#1d1d1f;--muted:#6e6e73;--line:#e7e7ea;--accent:#0a7d4b;--bg:#fff;
-  font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Inter,system-ui,sans-serif;
-  color:var(--ink);background:var(--bg);max-width:44rem;margin:0 auto;padding:2.75rem 3rem;
-  border:1px solid var(--line);border-radius:16px;box-shadow:0 1px 2px rgba(0,0,0,.04),0 12px 32px rgba(0,0,0,.06);
-  line-height:1.5;font-size:15px;overflow-wrap:anywhere;word-break:break-word}
-.capxul-doc *{box-sizing:border-box;min-width:0}
-.capxul-doc .doc-header{display:flex;flex-direction:column;gap:1.25rem;padding-bottom:1.5rem;border-bottom:1px solid var(--line);margin-bottom:1.75rem}
-.capxul-doc .doc-brand{display:flex;align-items:center;gap:.5rem;color:var(--accent);font-weight:600}
-.capxul-doc .doc-brand-mark{font-size:1.1rem}
-.capxul-doc .doc-brand-name{letter-spacing:.02em}
-.capxul-doc .doc-headline{display:flex;align-items:baseline;justify-content:space-between;gap:1rem;flex-wrap:wrap}
-.capxul-doc .doc-title{font-size:1.9rem;font-weight:700;letter-spacing:-.02em;margin:0}
-.capxul-doc .doc-badge{font-size:.7rem;font-weight:700;text-transform:uppercase;letter-spacing:.08em;
-  color:var(--accent);background:rgba(10,125,75,.1);padding:.3rem .6rem;border-radius:999px;max-width:100%;text-align:right}
-.capxul-doc .doc-parties{display:grid;grid-template-columns:1fr 1fr;gap:1.25rem;margin-bottom:1.75rem}
-.capxul-doc .doc-party{display:flex;flex-direction:column;gap:.15rem}
-.capxul-doc .doc-party-label{font-size:.72rem;text-transform:uppercase;letter-spacing:.06em;color:var(--muted)}
-.capxul-doc .doc-party-name{font-weight:600}
-.capxul-doc .doc-meta{display:flex;flex-direction:column;gap:.4rem;margin-bottom:1.75rem}
-.capxul-doc .doc-meta-row{display:flex;justify-content:space-between;gap:1rem;font-size:.92rem}
-.capxul-doc .doc-meta-label{color:var(--muted);flex-shrink:0}
-.capxul-doc .doc-meta-value{font-weight:500;text-align:right}
-.capxul-doc time{color:var(--ink);font-variant-numeric:tabular-nums}
-.capxul-doc .doc-line-items{width:100%;border-collapse:collapse;margin:.5rem 0 1.5rem;font-size:.92rem}
-.capxul-doc .doc-line-items th{text-align:left;font-size:.7rem;text-transform:uppercase;letter-spacing:.05em;
-  color:var(--muted);font-weight:600;padding:.5rem .25rem;border-bottom:1px solid var(--line)}
-.capxul-doc .doc-line-items td{padding:.7rem .25rem;border-bottom:1px solid var(--line)}
-.capxul-doc .doc-li-qty,.capxul-doc .doc-li-unit,.capxul-doc .doc-li-total{text-align:right;font-variant-numeric:tabular-nums;white-space:nowrap}
-.capxul-doc .doc-li-desc{width:100%}
-.capxul-doc .doc-totals{display:flex;flex-direction:column;gap:.5rem;margin-top:.5rem}
-.capxul-doc .doc-total-line{display:flex;justify-content:space-between;align-items:baseline;gap:1rem}
-.capxul-doc .doc-total-label{color:var(--muted)}
-.capxul-doc .doc-total-deduction .doc-amount-value{color:var(--muted)}
-.capxul-doc .doc-total-grand{border-top:2px solid var(--ink);margin-top:.5rem;padding-top:.75rem;font-size:1.15rem}
-.capxul-doc .doc-total-grand .doc-amount-value{font-weight:700}
-.capxul-doc .doc-amount-value{font-variant-numeric:tabular-nums;font-weight:600}
-.capxul-doc .doc-hero{text-align:center;padding:1.5rem 0 2rem}
-.capxul-doc .doc-hero-label{font-size:.72rem;text-transform:uppercase;letter-spacing:.06em;color:var(--muted)}
-.capxul-doc .doc-hero-amount{font-size:2.6rem;font-weight:700;letter-spacing:-.02em;margin-top:.35rem}
-.capxul-doc .doc-note{color:var(--ink);background:#f7f7f8;border-radius:10px;padding:.9rem 1.1rem;margin:0}
-.capxul-doc .doc-dest-address{font-family:ui-monospace,SFMono-Regular,Menlo,monospace;font-size:.9rem}
-.capxul-doc .doc-footer{margin-top:1.75rem;padding-top:1.25rem;border-top:1px solid var(--line);color:var(--muted);font-size:.9rem}
-.capxul-doc code{font-family:ui-monospace,SFMono-Regular,Menlo,monospace;font-size:.82rem;color:var(--muted);word-break:break-all}
-@media (max-width:540px){.capxul-doc{padding:1.75rem 1.25rem}.capxul-doc .doc-parties{grid-template-columns:1fr}}
-`.trim();
-//#endregion
-//#region ../wire/src/secret-material.ts
-const SENSITIVE_MATERIAL_PATTERNS = [
-	/0x[a-fA-F0-9]{40,}/u,
-	/(?:^|[^a-fA-F0-9])[a-fA-F0-9]{64}(?:$|[^a-fA-F0-9])/u,
-	/eyJ[A-Za-z0-9_-]*\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+/u,
-	/(?:(?:sk|pk|rk)_(?:live|test)|(?:phc|phx|ghp|gho|ghu|ghs|ghr|whsec)_|github_pat_|xox[baprs]-|AKIA[0-9A-Z]{16}|AIza)[A-Za-z0-9_-]*/iu
-];
-/**
-* Reject: does the value carry any known secret material? Best effort — callers
-* drop the whole value on a match; a false negative is a leak, a false positive
-* merely omits an observation field.
-*/
-function containsSensitiveMaterial(value) {
-	return SENSITIVE_MATERIAL_PATTERNS.some((pattern) => pattern.test(value));
-}
-//#endregion
-//#region ../wire/src/observation-context.ts
-/** Single bounded HTTP carrier used before a Convex action envelope exists. */
-const OBSERVATION_CONTEXT_HEADER = "x-capxul-observation-context";
-const FIELD_RULES = {
-	application: {
-		maxLength: 64,
-		pattern: /^[A-Za-z0-9][A-Za-z0-9._-]*$/u
-	},
-	applicationId: {
-		maxLength: 30,
-		pattern: APP_ID_RE
-	},
-	release: {
-		maxLength: 128,
-		pattern: /^[A-Za-z0-9][A-Za-z0-9._+@:/-]*$/u
-	},
-	sessionId: {
-		maxLength: 128,
-		pattern: /^[A-Za-z0-9][A-Za-z0-9._:-]*$/u
-	},
-	organizationId: {
-		maxLength: 128,
-		pattern: /^[A-Za-z0-9][A-Za-z0-9._:-]*$/u
-	},
-	journeyId: {
-		maxLength: 128,
-		pattern: /^[A-Za-z0-9][A-Za-z0-9._:-]*$/u
-	},
-	correlationId: {
-		maxLength: 128,
-		pattern: /^[A-Za-z0-9][A-Za-z0-9._:-]*$/u
-	},
-	anonymousId: {
-		maxLength: 128,
-		pattern: /^anon_[A-Za-z0-9-]+$/u
-	},
-	traceparent: {
-		maxLength: 55,
-		pattern: /^00-[0-9a-f]{32}-[0-9a-f]{16}-0[01]$/u
-	}
-};
-/**
-* Copy only the canonical allowlist and silently omit malformed/sensitive
-* values. Observation metadata is best effort and may never reject a domain
-* operation.
-*/
-function sanitizeObservationContext(input) {
-	if (typeof input !== "object" || input === null || Array.isArray(input)) return void 0;
-	const source = input;
-	const sanitized = {};
-	for (const field of Object.keys(FIELD_RULES)) {
-		const value = source[field];
-		if (!isSafeField(field, value)) continue;
-		sanitized[field] = value;
-	}
-	return Object.keys(sanitized).length === 0 ? void 0 : sanitized;
-}
-/** Encode only the sanitized allowlist; absence stays absence. */
-function encodeObservationContextHeader(input) {
-	const sanitized = sanitizeObservationContext(input);
-	return sanitized === void 0 ? void 0 : JSON.stringify(sanitized);
-}
-function isSafeField(field, value) {
-	if (typeof value !== "string") return false;
-	const rule = FIELD_RULES[field];
-	return value.length > 0 && value.length <= rule.maxLength && value === value.trim() && !value.includes("://") && !containsSensitiveMaterial(value) && rule.pattern.test(value);
-}
 //#endregion
-//#region src/contract/actor-scope.ts
-const actorScopeContract = {
-	addressBookList: makeFunctionReference(CAPXUL_FUNCTIONS["financialOps/addressBook"].list),
-	addressBookGet: makeFunctionReference(CAPXUL_FUNCTIONS["financialOps/addressBook"].get),
-	addressBookAdd: makeFunctionReference(CAPXUL_FUNCTIONS["financialOps/addressBook"].add),
-	addressBookHide: makeFunctionReference(CAPXUL_FUNCTIONS["financialOps/addressBook"].hide),
-	addressBookUnhide: makeFunctionReference(CAPXUL_FUNCTIONS["financialOps/addressBook"].unhide),
-	addressBookLabel: makeFunctionReference(CAPXUL_FUNCTIONS["financialOps/addressBook"].label),
-	requestsIssue: makeFunctionReference(CAPXUL_FUNCTIONS["financialOps/requestsInbox"].issue),
-	requestsList: makeFunctionReference(CAPXUL_FUNCTIONS["financialOps/requestsInbox"].list),
-	requestsGet: makeFunctionReference(CAPXUL_FUNCTIONS["financialOps/requestsInbox"].get),
-	requestsCancel: makeFunctionReference(CAPXUL_FUNCTIONS["financialOps/requestsInbox"].cancel),
-	requestsReconcile: makeFunctionReference(CAPXUL_FUNCTIONS["financialOps/requestsInbox"].reconcile),
-	inboxList: makeFunctionReference(CAPXUL_FUNCTIONS["financialOps/requestsInbox"].inboxList),
-	inboxApprove: makeFunctionReference(CAPXUL_FUNCTIONS["financialOps/requestsInbox"].approve),
-	inboxDecline: makeFunctionReference(CAPXUL_FUNCTIONS["financialOps/requestsInbox"].decline),
-	insightsSummary: makeFunctionReference(CAPXUL_FUNCTIONS["financialOps/insights"].summary),
-	insightsHistory: makeFunctionReference(CAPXUL_FUNCTIONS["financialOps/insights"].history)
+//#region ../wire/src/l2-money.ts
+const nonEmpty = (name) => Schema.String.pipe(Schema.refine((value) => value.length > 0, { message: `${name} must not be empty` }));
+const nonNegativeInteger = (name) => Schema.Number.pipe(Schema.refine((value) => Number.isSafeInteger(value) && value >= 0, { message: `${name} must be a non-negative safe integer` }));
+const BaseSepoliaChainIdSchema = ChainIdSchema$1.pipe(Schema.refine((value) => value === 84532, { message: "chainId must be 84532" }));
+const Uint16Schema = Schema.Number.pipe(Schema.refine((value) => Number.isSafeInteger(value) && value >= 0 && value <= 65535, { message: "kind must be a uint16 value" }));
+const Uint8Schema = Schema.Number.pipe(Schema.refine((value) => Number.isSafeInteger(value) && value >= 0 && value <= 255, { message: "must be a uint8 value" }));
+const Bytes4Schema = Schema.String.pipe(Schema.refine((value) => /^0x[0-9a-fA-F]{8}$/u.test(value), { message: "must be a 0x-prefixed bytes4 value" }));
+const HexDataSchema = Schema.String.pipe(Schema.refine((value) => /^0x(?:[0-9a-fA-F]{2})*$/u.test(value), { message: "must be 0x-prefixed byte data" }));
+const Uint48Schema = Schema.Number.pipe(Schema.refine((value) => Number.isSafeInteger(value) && value >= 0 && value <= 0xffffffffffff, { message: "must be a uint48 value" }));
+const Uint256StringSchema = Schema.String.pipe(Schema.refine((value) => {
+	if (!/^(0|[1-9][0-9]*)$/u.test(value)) return false;
+	return BigInt(value) < 1n << 256n;
+}, { message: "must be a uint256 base-10 string" }));
+const PaymentIdSchema = nonEmpty("paymentId").pipe(Schema.refine((value) => value.length > 0));
+const MovementIdSchema = nonEmpty("movementId").pipe(Schema.refine((value) => value.length > 0));
+const PermissionIdSchema = nonEmpty("permissionId").pipe(Schema.refine((value) => value.length > 0));
+const PermissionAssignmentIdSchema = nonEmpty("permissionAssignmentId").pipe(Schema.refine((value) => value.length > 0));
+const PaymentCommandIdSchema = nonEmpty("commandId").pipe(Schema.refine((value) => value.length > 0));
+const PAYMENT_PURPOSE_KIND_CODES = {
+	quick_pay: 0,
+	invoice: 1,
+	payroll: 2,
+	reimbursement: 3
 };
-//#endregion
-//#region src/surface/contacts.ts
-function makeActorRelationshipMethods(deps) {
-	const domain = deps.actor.kind === "account" ? "account" : "org";
-	const actor = deps.actor;
-	const convexCall = deps.convexCall;
-	if (convexCall === void 0) return makeNotImplementedActorRelationshipMethods(deps, domain);
-	const fns = actorScopeContract;
-	return {
-		addressBook: {
-			list: (options) => mapOk$2(awaitableConvex(options?.signal, "addressBook.list", () => convexCall.query(fns.addressBookList, { actor })), (entries) => entries.map(mapAddressBookEntry)),
-			get: async (entryId, options) => {
-				const ref = refFromEntryId(entryId);
-				if (!ref.ok) return ref;
-				return mapOk$2(await awaitableConvex(options?.signal, "addressBook.get", () => convexCall.query(fns.addressBookGet, {
-					actor,
-					ref: ref.value
-				})), (entry) => entry === null ? null : mapAddressBookEntry(entry));
-			},
-			add: async (input, options) => {
-				const ref = normalizeRefForBackend$1(input.ref, "ref");
-				if (!ref.ok) return ref;
-				return mapOk$2(await awaitableConvex(options?.signal, "addressBook.add", () => convexCall.mutation(fns.addressBookAdd, {
-					actor,
-					ref: ref.value,
-					...input.label === void 0 ? {} : { label: input.label }
-				})), mapAddressBookEntry);
-			},
-			hide: async (entryId, options) => {
-				const ref = refFromEntryId(entryId);
-				if (!ref.ok) return ref;
-				return mapOk$2(await awaitableConvex(options?.signal, "addressBook.hide", () => convexCall.mutation(fns.addressBookHide, {
-					actor,
-					ref: ref.value
-				})), mapAddressBookEntry);
-			},
-			unhide: async (entryId, options) => {
-				const ref = refFromEntryId(entryId);
-				if (!ref.ok) return ref;
-				return mapOk$2(await awaitableConvex(options?.signal, "addressBook.unhide", () => convexCall.mutation(fns.addressBookUnhide, {
-					actor,
-					ref: ref.value
-				})), mapAddressBookEntry);
-			},
-			label: async (input, options) => {
-				const ref = refFromEntryId(input.entryId);
-				if (!ref.ok) return ref;
-				return mapOk$2(await awaitableConvex(options?.signal, "addressBook.label", () => convexCall.mutation(fns.addressBookLabel, {
-					actor,
-					ref: ref.value,
-					label: input.label
-				})), mapAddressBookEntry);
-			}
-		},
-		requests: {
-			issue: async (input, options) => {
-				const payer = normalizeRefForBackend$1(input.payer, "payer");
-				if (!payer.ok) return payer;
-				return mapOk$2(await awaitableConvex(options?.signal, "requests.issue", () => convexCall.mutation(fns.requestsIssue, {
-					actor,
-					payer: payer.value,
-					amount: input.amount,
+const PaymentPurposeKindSchema = Schema.String.pipe(Schema.refine((value) => Object.hasOwn(PAYMENT_PURPOSE_KIND_CODES, value), { message: "purposeKind must be a registered L2 value" }));
+const AccountActorRefSchema = Schema.Struct({
+	kind: Schema.Literal("account"),
+	accountId: nonEmpty("accountId")
+});
+const OrganizationActorRefSchema = Schema.Struct({
+	kind: Schema.Literal("organization"),
+	orgId: nonEmpty("orgId")
+});
+const ActorRefSchema = Schema.Union([AccountActorRefSchema, OrganizationActorRefSchema]);
+const hasActorBoundPermission = (actor, orgId, permissionId) => actor.kind === "organization" ? orgId === actor.orgId && permissionId !== void 0 : orgId === void 0 && permissionId === void 0;
+const ActorOrDestinationRefSchema = Schema.Union([ActorRefSchema, Schema.Struct({
+	kind: Schema.Literal("destination"),
+	destinationId: nonEmpty("destinationId")
+})]);
+Schema.Literals([
+	"Payment",
+	"Payout",
+	"Deposit"
+]);
+const PaymentStatusSchema = Schema.Literals(L2_PAYMENT_STATUSES);
+const ReleaseTermsSchema = PaymentTiming;
+const PaymentLedgerBaseSchema = Schema.Struct({
+	paymentId: PaymentIdSchema,
+	status: PaymentStatusSchema,
+	actor: ActorRefSchema,
+	recipient: ActorOrDestinationRefSchema,
+	amount: FinancialOpsMoney,
+	chainId: ChainIdSchema$1,
+	tokenAddress: AddressSchema$1,
+	release: ReleaseTermsSchema,
+	createdAt: nonNegativeInteger("createdAt"),
+	updatedAt: nonNegativeInteger("updatedAt")
+});
+const PaymentLedgerRecordSchema = Schema.Union([Schema.Struct({
+	...PaymentLedgerBaseSchema.fields,
+	ledgerKind: Schema.Literals(["Payment", "Payout"]),
+	purposeKind: PaymentPurposeKindSchema,
+	permissionId: Schema.optional(PermissionIdSchema),
+	settlementId: SettlementIdSchema,
+	movementId: Schema.optional(MovementIdSchema),
+	documentHash: NonzeroDocumentHashSchema,
+	userOpHash: Schema.optional(Bytes32Schema),
+	txHash: Schema.optional(TxHashSchema$1),
+	settlementLogIndex: Schema.optional(LogIndexSchema),
+	settledBlockNumber: Schema.optional(BlockNumberSchema$1),
+	settledBlockHash: Schema.optional(Bytes32Schema),
+	settledEventLogIndex: Schema.optional(LogIndexSchema)
+}), Schema.Struct({
+	...PaymentLedgerBaseSchema.fields,
+	ledgerKind: Schema.Literal("Deposit"),
+	movementId: MovementIdSchema,
+	settlementId: Schema.optional(Schema.Never),
+	documentHash: Schema.optional(Schema.Never),
+	permissionId: Schema.optional(Schema.Never),
+	purposeKind: Schema.optional(Schema.Never)
+})]).pipe(Schema.refine((record) => record.ledgerKind === "Deposit" || hasActorBoundPermission(record.actor, record.actor.kind === "organization" ? record.actor.orgId : void 0, record.permissionId), { message: "Organization Payment and Payout records require permissionId; personal records forbid it" }));
+const MovementIdentitySchema = Schema.Struct({
+	chainId: ChainIdSchema$1,
+	tokenAddress: AddressSchema$1,
+	txHash: TxHashSchema$1,
+	logIndex: LogIndexSchema
+});
+const MovementCanonicalStateSchema = Schema.Literals([
+	"observed",
+	"finalized",
+	"removed"
+]);
+const MovementSchema = Schema.Struct({
+	...MovementIdentitySchema.fields,
+	movementId: MovementIdSchema,
+	blockNumber: BlockNumberSchema$1,
+	blockHash: Bytes32Schema,
+	source: AddressSchema$1,
+	destination: AddressSchema$1,
+	rawAmount: WeiAmountSchema$1,
+	canonicalState: MovementCanonicalStateSchema
+});
+const MovementClassificationSchema = Schema.Literals([
+	"protocol_settlement",
+	"deposit",
+	"movement_only_outflow"
+]);
+const MovementAttributionSchema = Schema.Struct({
+	movementId: MovementIdSchema,
+	actor: ActorRefSchema,
+	side: Schema.Literals(["source", "destination"]),
+	classification: MovementClassificationSchema
+});
+Schema.Struct({
+	movementId: MovementIdSchema,
+	actor: ActorRefSchema,
+	counterpartyLabel: Schema.optional(Schema.String),
+	accountingCategory: Schema.optional(Schema.String),
+	memo: Schema.optional(Schema.String),
+	lastEditor: ActorRefSchema,
+	updatedAt: nonNegativeInteger("updatedAt")
+});
+const ReceiptRefSchema = Schema.Struct({
+	chainId: BaseSepoliaChainIdSchema,
+	userOpHash: Bytes32Schema,
+	transactionHash: TxHashSchema$1,
+	blockNumber: BlockNumberSchema$1,
+	blockHash: Bytes32Schema
+});
+const EventRefSchema = Schema.Struct({
+	...ReceiptRefSchema.fields,
+	emitter: AddressSchema$1,
+	transactionIndex: LogIndexSchema,
+	logIndex: LogIndexSchema,
+	topic0: Bytes32Schema,
+	dataHash: Bytes32Schema
+});
+const PermissionOperationSchema = Schema.Literals([
+	"create",
+	"change",
+	"assign",
+	"revoke",
+	"replace"
+]);
+const PermissionStateSchema = Schema.Literals([
+	"pending",
+	"active",
+	"suspended",
+	"revoked",
+	"superseded",
+	"quarantined"
+]);
+const StoredPermissionCommandSchema = Schema.Struct({
+	commandId: PaymentCommandIdSchema,
+	orgId: nonEmpty("orgId"),
+	operation: PermissionOperationSchema,
+	permissionId: PermissionIdSchema,
+	permissionAssignmentId: Schema.NullOr(PermissionAssignmentIdSchema),
+	expectedRevision: nonNegativeInteger("expectedRevision"),
+	userOpSenderSafe: SafeAddressSchema,
+	organizationSafe: SafeAddressSchema,
+	rolesModule: ModuleAddressSchema,
+	roleKey: RoleKeySchema,
+	allowanceKey: Schema.NullOr(AllowanceKeySchema),
+	memberSafe: Schema.NullOr(SafeAddressSchema),
+	expectedAuthorityEvents: Schema.Array(Bytes32Schema)
+});
+Schema.Struct({
+	command: StoredPermissionCommandSchema,
+	userOpHash: Bytes32Schema
+});
+Schema.Union([
+	Schema.Struct({
+		status: Schema.Literal("pending"),
+		reason: Schema.Literals(["receipt_missing", "not_finalized"]),
+		receipt: Schema.optional(ReceiptRefSchema)
+	}),
+	Schema.Struct({
+		status: Schema.Literal("verified"),
+		commandId: PaymentCommandIdSchema,
+		receipt: ReceiptRefSchema,
+		events: Schema.Array(EventRefSchema),
+		factsHash: Bytes32Schema
+	}),
+	Schema.Struct({
+		status: Schema.Literal("mismatch"),
+		code: Schema.Literals([
+			"wrong_chain",
+			"wrong_sender",
+			"failed_user_operation",
+			"non_canonical_block",
+			"wrong_contract_identity",
+			"missing_event",
+			"extra_authority_event",
+			"wrong_event_order",
+			"wrong_fact_tuple",
+			"wrong_state",
+			"conflicting_replay"
+		]),
+		receipt: Schema.optional(ReceiptRefSchema)
+	}),
+	Schema.Struct({
+		status: Schema.Literal("provider_failure"),
+		retryable: Schema.Literal(true)
+	})
+]);
+Schema.Struct({
+	commandId: PaymentCommandIdSchema,
+	expectedRevision: nonNegativeInteger("expectedRevision"),
+	verification: Schema.Struct({
+		status: Schema.Literal("verified"),
+		commandId: PaymentCommandIdSchema,
+		receipt: ReceiptRefSchema,
+		events: Schema.Array(EventRefSchema),
+		factsHash: Bytes32Schema
+	})
+});
+Schema.Union([Schema.Struct({
+	status: Schema.Literals(["applied", "replayed"]),
+	revision: nonNegativeInteger("revision")
+}), Schema.Struct({ status: Schema.Literals(["revision_mismatch", "conflicting_replay"]) })]);
+const PermissionSchema = Schema.Struct({
+	permissionId: PermissionIdSchema,
+	orgId: nonEmpty("orgId"),
+	type: Schema.Literals(["budget", "managePeople"]),
+	state: PermissionStateSchema,
+	revision: nonNegativeInteger("revision"),
+	roleKey: RoleKeySchema,
+	tokenAddress: Schema.optional(AddressSchema$1),
+	limitRaw: Schema.optional(WeiAmountSchema$1),
+	allowanceKey: Schema.optional(AllowanceKeySchema)
+});
+const PermissionAssignmentSchema = Schema.Struct({
+	permissionAssignmentId: PermissionAssignmentIdSchema,
+	permissionId: PermissionIdSchema,
+	actor: ActorRefSchema,
+	state: PermissionStateSchema
+});
+Schema.Struct({
+	orgId: nonEmpty("orgId"),
+	actor: ActorRefSchema,
+	permissionId: PermissionIdSchema,
+	tokenAddress: AddressSchema$1,
+	rawAmount: WeiAmountSchema$1
+});
+Schema.Struct({
+	permission: PermissionSchema,
+	assignment: PermissionAssignmentSchema
+});
+Schema.Struct({
+	chainId: ChainIdSchema$1,
+	tokenAddress: AddressSchema$1,
+	symbol: nonEmpty("symbol"),
+	decimals: nonNegativeInteger("decimals"),
+	deploymentStartBlock: BlockNumberSchema$1
+});
+const HoldingRowSchema = Schema.Union([Schema.Struct({
+	assetKind: Schema.Literal("native"),
+	symbol: Schema.optional(Schema.String),
+	decimals: Schema.optional(nonNegativeInteger("decimals")),
+	rawBalance: WeiAmountSchema$1
+}), Schema.Struct({
+	assetKind: Schema.Literal("erc20"),
+	tokenAddress: AddressSchema$1,
+	symbol: Schema.optional(Schema.String),
+	decimals: Schema.optional(nonNegativeInteger("decimals")),
+	rawBalance: WeiAmountSchema$1
+})]);
+Schema.Struct({
+	actor: ActorRefSchema,
+	chainId: ChainIdSchema$1,
+	observedAt: nonNegativeInteger("observedAt"),
+	stale: Schema.Boolean,
+	rows: Schema.Array(HoldingRowSchema)
+});
+const PaymentCoreErrorSchema = Schema.Union([
+	Schema.Struct({
+		code: Schema.Literal("INVALID_TRANSITION"),
+		status: PaymentStatusSchema,
+		event: nonEmpty("event")
+	}),
+	Schema.Struct({
+		code: Schema.Literal("ALREADY_SETTLED"),
+		paymentId: PaymentIdSchema
+	}),
+	Schema.Struct({ code: Schema.Literals([
+		"EVIDENCE_MISSING",
+		"EVIDENCE_MISMATCH",
+		"EVIDENCE_REPLAY"
+	]) })
+]);
+Schema.Union([
+	Schema.Struct({ type: Schema.Literal("commitment_created") }),
+	Schema.Struct({
+		type: Schema.Literal("claim"),
+		rawAmount: WeiAmountSchema$1
+	}),
+	Schema.Struct({ type: Schema.Literal("cancel") }),
+	Schema.Struct({
+		type: Schema.Literal("redirect"),
+		recipient: ActorOrDestinationRefSchema
+	}),
+	Schema.Struct({
+		type: Schema.Literal("fail"),
+		reasonCode: nonEmpty("reasonCode")
+	})
+]);
+const PaymentTransitionEventSchema = Schema.Union([
+	Schema.Struct({
+		type: Schema.Literal("claim"),
+		rawAmount: WeiAmountSchema$1
+	}),
+	Schema.Struct({ type: Schema.Literal("cancel") }),
+	Schema.Struct({
+		type: Schema.Literal("redirect"),
+		recipient: ActorOrDestinationRefSchema
+	}),
+	Schema.Struct({
+		type: Schema.Literal("fail"),
+		reasonCode: nonEmpty("reasonCode")
+	})
+]);
+const ExpectedPaymentCommonSchema = Schema.Struct({
+	chainId: BaseSepoliaChainIdSchema,
+	contractAddress: AddressSchema$1,
+	userOpHash: Bytes32Schema,
+	userOpSenderSafe: SafeAddressSchema
+});
+Schema.Union([
+	Schema.Struct({
+		...ExpectedPaymentCommonSchema.fields,
+		operation: Schema.Literal("send"),
+		paymentSenderSafe: SafeAddressSchema,
+		itemIndex: nonNegativeInteger("itemIndex"),
+		settlementId: SettlementIdSchema,
+		purposeKind: PaymentPurposeKindSchema,
+		kind: Uint16Schema,
+		documentHash: NonzeroDocumentHashSchema,
+		tokenAddress: AddressSchema$1,
+		recipient: AddressSchema$1,
+		rawAmount: WeiAmountSchema$1
+	}),
+	Schema.Struct({
+		...ExpectedPaymentCommonSchema.fields,
+		operation: Schema.Literal("create_commitment"),
+		paymentSenderSafe: SafeAddressSchema,
+		settlementId: SettlementIdSchema,
+		purposeKind: PaymentPurposeKindSchema,
+		kind: Uint16Schema,
+		documentHash: NonzeroDocumentHashSchema,
+		tokenAddress: AddressSchema$1,
+		recipient: AddressSchema$1,
+		totalAmount: WeiAmountSchema$1,
+		startTime: Uint48Schema,
+		cliffTime: Uint48Schema,
+		endTime: Uint48Schema
+	}),
+	Schema.Struct({
+		...ExpectedPaymentCommonSchema.fields,
+		operation: Schema.Literal("claim_commitment"),
+		commitmentId: Uint256StringSchema,
+		settlementId: SettlementIdSchema,
+		documentHash: NonzeroDocumentHashSchema,
+		tokenAddress: AddressSchema$1,
+		creator: AddressSchema$1,
+		currentRecipient: AddressSchema$1,
+		totalAmount: WeiAmountSchema$1,
+		claimedBefore: WeiAmountSchema$1
+	}),
+	Schema.Struct({
+		...ExpectedPaymentCommonSchema.fields,
+		operation: Schema.Literal("cancel_commitment"),
+		commitmentId: Uint256StringSchema,
+		settlementId: SettlementIdSchema,
+		documentHash: NonzeroDocumentHashSchema,
+		tokenAddress: AddressSchema$1,
+		creator: AddressSchema$1,
+		currentRecipient: AddressSchema$1,
+		totalAmount: WeiAmountSchema$1,
+		claimedBefore: WeiAmountSchema$1
+	}),
+	Schema.Struct({
+		...ExpectedPaymentCommonSchema.fields,
+		operation: Schema.Literal("redirect_commitment"),
+		commitmentId: Uint256StringSchema,
+		settlementId: SettlementIdSchema,
+		documentHash: NonzeroDocumentHashSchema,
+		creator: AddressSchema$1,
+		currentRecipient: AddressSchema$1,
+		newRecipient: AddressSchema$1,
+		claimedBefore: Schema.Literal("0")
+	})
+]);
+const PaymentVerificationMismatchCodeSchema = Schema.Literals([
+	"wrong_chain",
+	"wrong_sender",
+	"failed_user_operation",
+	"wrong_transaction",
+	"failed_transaction",
+	"non_canonical_block",
+	"wrong_contract_identity",
+	"missing_event",
+	"wrong_commitment_id",
+	"wrong_settlement_id",
+	"wrong_event_sender",
+	"wrong_event_recipient",
+	"wrong_event_token",
+	"wrong_event_amount",
+	"wrong_kind",
+	"zero_document_hash",
+	"wrong_document_hash",
+	"missing_bound_transfer",
+	"wrong_token",
+	"wrong_source",
+	"wrong_destination",
+	"wrong_amount"
+]);
+const FinalizedTransferRangeSchema = Schema.Struct({
+	chainId: BaseSepoliaChainIdSchema,
+	tokenAddress: AddressSchema$1,
+	fromBlock: BlockNumberSchema$1,
+	toBlock: BlockNumberSchema$1
+}).pipe(Schema.refine((range) => range.toBlock >= range.fromBlock && range.toBlock - range.fromBlock < 1e4, { message: "toBlock must be at or after fromBlock and the range must contain fewer than 10,000 block intervals" }));
+const FinalizedTransferEvidenceSchema = Schema.Struct({
+	...MovementIdentitySchema.fields,
+	blockNumber: BlockNumberSchema$1,
+	blockHash: Bytes32Schema,
+	source: AddressSchema$1,
+	destination: AddressSchema$1,
+	rawAmount: WeiAmountSchema$1,
+	removed: Schema.Boolean
+});
+const FinalizedBlockReferenceSchema = Schema.Struct({
+	chainId: BaseSepoliaChainIdSchema,
+	blockNumber: BlockNumberSchema$1,
+	blockHash: Bytes32Schema
+});
+Schema.Struct({
+	range: FinalizedTransferRangeSchema,
+	finalizedHead: FinalizedBlockReferenceSchema,
+	anchor: FinalizedBlockReferenceSchema,
+	transfers: Schema.Array(FinalizedTransferEvidenceSchema),
+	requestCount: nonNegativeInteger("requestCount")
+});
+const FinalizedPermissionFactRangeSchema = Schema.Struct({
+	chainId: BaseSepoliaChainIdSchema,
+	organizationSafe: SafeAddressSchema,
+	rolesModules: Schema.Array(ModuleAddressSchema),
+	fromBlock: BlockNumberSchema$1,
+	toBlock: BlockNumberSchema$1
+}).pipe(Schema.refine((range) => range.toBlock >= range.fromBlock && range.toBlock - range.fromBlock < 1e4, { message: "toBlock must be at or after fromBlock and the range must contain fewer than 10,000 block intervals" }));
+const FinalizedPermissionFactCommonSchema = Schema.Struct({
+	chainId: BaseSepoliaChainIdSchema,
+	transactionHash: TxHashSchema$1,
+	blockNumber: BlockNumberSchema$1,
+	blockHash: Bytes32Schema,
+	logIndex: LogIndexSchema,
+	emitter: AddressSchema$1,
+	topic0: Bytes32Schema,
+	dataHash: Bytes32Schema,
+	authorityHash: Bytes32Schema
+});
+const FinalizedPermissionModuleFactSchema = Schema.Struct({
+	...FinalizedPermissionFactCommonSchema.fields,
+	kind: Schema.Literals(["module_enabled", "module_disabled"]),
+	organizationSafe: SafeAddressSchema,
+	module: ModuleAddressSchema
+});
+const FinalizedPermissionRoleAssignmentFactSchema = Schema.Struct({
+	...FinalizedPermissionFactCommonSchema.fields,
+	kind: Schema.Literal("assignment"),
+	rolesModule: ModuleAddressSchema,
+	memberSafe: SafeAddressSchema,
+	roleKeys: Schema.Array(RoleKeySchema),
+	memberOf: Schema.Array(Schema.Boolean)
+});
+const FinalizedPermissionTargetAuthorityFactSchema = Schema.Union([Schema.Struct({
+	...FinalizedPermissionFactCommonSchema.fields,
+	kind: Schema.Literal("allow_target"),
+	rolesModule: ModuleAddressSchema,
+	roleKey: RoleKeySchema,
+	target: AddressSchema$1,
+	options: Uint8Schema
+}), Schema.Struct({
+	...FinalizedPermissionFactCommonSchema.fields,
+	kind: Schema.Literals(["scope_target", "revoke_target"]),
+	rolesModule: ModuleAddressSchema,
+	roleKey: RoleKeySchema,
+	target: AddressSchema$1
+})]);
+const PermissionScopeConditionSchema = Schema.Struct({
+	parent: Uint8Schema,
+	paramType: Uint8Schema,
+	operator: Uint8Schema,
+	compValue: HexDataSchema
+});
+const FinalizedPermissionFunctionAuthorityFactSchema = Schema.Union([
+	Schema.Struct({
+		...FinalizedPermissionFactCommonSchema.fields,
+		kind: Schema.Literal("allow_function"),
+		rolesModule: ModuleAddressSchema,
+		roleKey: RoleKeySchema,
+		target: AddressSchema$1,
+		selector: Bytes4Schema,
+		options: Uint8Schema
+	}),
+	Schema.Struct({
+		...FinalizedPermissionFactCommonSchema.fields,
+		kind: Schema.Literal("scope_function"),
+		rolesModule: ModuleAddressSchema,
+		roleKey: RoleKeySchema,
+		target: AddressSchema$1,
+		selector: Bytes4Schema,
+		options: Uint8Schema,
+		conditions: Schema.Array(PermissionScopeConditionSchema)
+	}),
+	Schema.Struct({
+		...FinalizedPermissionFactCommonSchema.fields,
+		kind: Schema.Literal("revoke_function"),
+		rolesModule: ModuleAddressSchema,
+		roleKey: RoleKeySchema,
+		target: AddressSchema$1,
+		selector: Bytes4Schema
+	})
+]);
+const FinalizedPermissionAllowanceAuthorityFactSchema = Schema.Struct({
+	...FinalizedPermissionFactCommonSchema.fields,
+	kind: Schema.Literal("allowance"),
+	rolesModule: ModuleAddressSchema,
+	allowanceKey: AllowanceKeySchema,
+	balance: WeiAmountSchema$1,
+	maxRefill: WeiAmountSchema$1,
+	refill: WeiAmountSchema$1,
+	period: Uint256StringSchema,
+	timestamp: Uint256StringSchema
+});
+const FinalizedPermissionFactSchema = Schema.Union([
+	FinalizedPermissionModuleFactSchema,
+	FinalizedPermissionRoleAssignmentFactSchema,
+	FinalizedPermissionTargetAuthorityFactSchema,
+	FinalizedPermissionFunctionAuthorityFactSchema,
+	FinalizedPermissionAllowanceAuthorityFactSchema
+]);
+Schema.Struct({
+	range: FinalizedPermissionFactRangeSchema,
+	finalizedHead: FinalizedBlockReferenceSchema,
+	anchor: FinalizedBlockReferenceSchema,
+	facts: Schema.Array(FinalizedPermissionFactSchema),
+	requestCount: nonNegativeInteger("requestCount")
+});
+const FinalizedMoneyEvidenceCommonSchema = Schema.Struct({
+	chainId: BaseSepoliaChainIdSchema,
+	contractAddress: AddressSchema$1,
+	userOpHash: Bytes32Schema,
+	txHash: TxHashSchema$1,
+	blockNumber: BlockNumberSchema$1,
+	blockHash: Bytes32Schema,
+	blockTimestamp: Uint48Schema,
+	eventLogIndex: LogIndexSchema
+});
+const FinalizedPaymentEvidenceSchema = Schema.Struct({
+	...FinalizedMoneyEvidenceCommonSchema.fields,
+	operation: Schema.Literal("send"),
+	settlementId: SettlementIdSchema,
+	purposeKind: PaymentPurposeKindSchema,
+	kind: Uint16Schema,
+	documentHash: NonzeroDocumentHashSchema,
+	tokenAddress: AddressSchema$1,
+	transferLogIndex: LogIndexSchema,
+	source: AddressSchema$1,
+	destination: AddressSchema$1,
+	rawAmount: WeiAmountSchema$1
+});
+const FinalizedCommitmentCreationEvidenceSchema = Schema.Struct({
+	...FinalizedMoneyEvidenceCommonSchema.fields,
+	operation: Schema.Literal("create_commitment"),
+	commitmentId: Uint256StringSchema,
+	settlementId: SettlementIdSchema,
+	creator: AddressSchema$1,
+	recipient: AddressSchema$1,
+	tokenAddress: AddressSchema$1,
+	totalAmount: WeiAmountSchema$1,
+	startTime: Uint48Schema,
+	cliffTime: Uint48Schema,
+	endTime: Uint48Schema,
+	kind: Uint16Schema,
+	purposeKind: PaymentPurposeKindSchema,
+	documentHash: NonzeroDocumentHashSchema,
+	transferLogIndex: LogIndexSchema
+});
+const FinalizedCommitmentClaimEvidenceSchema = Schema.Struct({
+	...FinalizedMoneyEvidenceCommonSchema.fields,
+	operation: Schema.Literal("claim_commitment"),
+	commitmentId: Uint256StringSchema,
+	settlementId: SettlementIdSchema,
+	creator: AddressSchema$1,
+	recipient: AddressSchema$1,
+	tokenAddress: AddressSchema$1,
+	totalAmount: WeiAmountSchema$1,
+	claimedBefore: WeiAmountSchema$1,
+	rawAmount: WeiAmountSchema$1,
+	documentHash: NonzeroDocumentHashSchema,
+	transferLogIndex: LogIndexSchema
+});
+const FinalizedCommitmentCancelEvidenceSchema = Schema.Struct({
+	...FinalizedMoneyEvidenceCommonSchema.fields,
+	operation: Schema.Literal("cancel_commitment"),
+	commitmentId: Uint256StringSchema,
+	settlementId: SettlementIdSchema,
+	creator: AddressSchema$1,
+	currentRecipient: AddressSchema$1,
+	tokenAddress: AddressSchema$1,
+	totalAmount: WeiAmountSchema$1,
+	claimedBefore: WeiAmountSchema$1,
+	vestedUnclaimed: WeiAmountSchema$1,
+	unvestedReturned: WeiAmountSchema$1,
+	documentHash: NonzeroDocumentHashSchema,
+	transfer: Schema.NullOr(FinalizedTransferEvidenceSchema)
+});
+const FinalizedCommitmentRedirectEvidenceSchema = Schema.Struct({
+	...FinalizedMoneyEvidenceCommonSchema.fields,
+	operation: Schema.Literal("redirect_commitment"),
+	commitmentId: Uint256StringSchema,
+	settlementId: SettlementIdSchema,
+	creator: AddressSchema$1,
+	oldRecipient: AddressSchema$1,
+	newRecipient: AddressSchema$1,
+	claimedBefore: Schema.Literal("0"),
+	documentHash: NonzeroDocumentHashSchema,
+	transfer: Schema.Null
+});
+const FinalizedMoneyEvidenceSchema = Schema.Union([
+	FinalizedPaymentEvidenceSchema,
+	FinalizedCommitmentCreationEvidenceSchema,
+	FinalizedCommitmentClaimEvidenceSchema,
+	FinalizedCommitmentCancelEvidenceSchema,
+	FinalizedCommitmentRedirectEvidenceSchema
+]);
+Schema.Union([
+	Schema.Struct({
+		status: Schema.Literal("pending"),
+		reason: Schema.Literals(["receipt_missing", "not_finalized"]),
+		receipt: Schema.optional(ReceiptRefSchema)
+	}),
+	Schema.Struct({
+		status: Schema.Literal("verified"),
+		evidence: FinalizedMoneyEvidenceSchema
+	}),
+	Schema.Struct({
+		status: Schema.Literal("mismatch"),
+		code: PaymentVerificationMismatchCodeSchema,
+		receipt: Schema.optional(ReceiptRefSchema)
+	}),
+	Schema.Struct({
+		status: Schema.Literal("provider_failure"),
+		retryable: Schema.Literal(true)
+	})
+]);
+const FinalizedAttributedInboundMovementSchema = Schema.Struct({
+	movement: MovementSchema,
+	attribution: MovementAttributionSchema
+});
+const PaymentCommandLineageSchema = Schema.Union([Schema.Struct({
+	kind: Schema.Literal("payroll"),
+	runId: nonEmpty("runId")
+}), Schema.Struct({
+	kind: Schema.Literal("payment_request"),
+	requestId: nonEmpty("requestId")
+})]);
+const ProtocolBirthInputSchema = Schema.Struct({
+	requestKey: nonEmpty("requestKey"),
+	actor: ActorRefSchema,
+	recipient: ActorOrDestinationRefSchema,
+	recipientSafe: SafeAddressSchema,
+	paymentSenderSafe: SafeAddressSchema,
+	amount: FinancialOpsMoney,
+	ledgerKind: Schema.Literals(["Payment", "Payout"]),
+	purposeKind: PaymentPurposeKindSchema,
+	permissionId: Schema.optional(PermissionIdSchema),
+	settlementId: SettlementIdSchema,
+	documentHash: NonzeroDocumentHashSchema,
+	release: ReleaseTermsSchema,
+	lineage: Schema.optional(PaymentCommandLineageSchema)
+}).pipe(Schema.refine((birth) => hasActorBoundPermission(birth.actor, birth.actor.kind === "organization" ? birth.actor.orgId : void 0, birth.permissionId), { message: "Organization Payment and Payout births require permissionId; personal births forbid it" }));
+Schema.Union([
+	Schema.Struct({
+		kind: Schema.Literal("birth"),
+		birth: ProtocolBirthInputSchema
+	}),
+	Schema.Struct({
+		kind: Schema.Literal("birth_deposit"),
+		movement: FinalizedAttributedInboundMovementSchema
+	}),
+	Schema.Struct({
+		kind: Schema.Literal("rollback_deposit"),
+		movementId: MovementIdSchema
+	}),
+	Schema.Struct({
+		kind: Schema.Literal("record_submission"),
+		commandId: PaymentCommandIdSchema,
+		paymentIds: Schema.Array(PaymentIdSchema),
+		userOpHash: Bytes32Schema
+	}),
+	Schema.Struct({
+		kind: Schema.Literal("apply_finalized_evidence"),
+		paymentId: PaymentIdSchema,
+		evidence: FinalizedMoneyEvidenceSchema
+	}),
+	Schema.Struct({
+		kind: Schema.Literal("transition"),
+		paymentId: PaymentIdSchema,
+		event: PaymentTransitionEventSchema
+	})
+]);
+Schema.Union([
+	Schema.Struct({
+		outcome: Schema.Literal("created"),
+		payments: Schema.Array(PaymentLedgerRecordSchema)
+	}),
+	Schema.Struct({
+		outcome: Schema.Literal("changed"),
+		payment: PaymentLedgerRecordSchema
+	}),
+	Schema.Struct({
+		outcome: Schema.Literal("replayed"),
+		payment: PaymentLedgerRecordSchema
+	}),
+	Schema.Struct({
+		outcome: Schema.Literal("removed"),
+		paymentId: PaymentIdSchema,
+		movementId: MovementIdSchema
+	}),
+	Schema.Struct({
+		outcome: Schema.Literal("refused"),
+		error: PaymentCoreErrorSchema
+	})
+]);
+const PaymentBirthItemSchema = Schema.Union([Schema.Struct({
+	operation: Schema.Literal("send"),
+	recipient: ActorOrDestinationRefSchema,
+	amount: FinancialOpsMoney,
+	purposeKind: PaymentPurposeKindSchema,
+	documentHash: Schema.optional(NonzeroDocumentHashSchema)
+}), Schema.Struct({
+	operation: Schema.Literal("create_commitment"),
+	recipient: ActorOrDestinationRefSchema,
+	amount: FinancialOpsMoney,
+	release: ReleaseTermsSchema.pipe(Schema.refine((release) => release.kind === "scheduled" || release.kind === "stream", { message: "Commitment release must be scheduled or stream" })),
+	purposeKind: PaymentPurposeKindSchema,
+	documentHash: Schema.optional(NonzeroDocumentHashSchema)
+})]);
+const PaymentBirthCommandSchema = Schema.Struct({
+	kind: Schema.Literal("birth"),
+	requestKey: nonEmpty("requestKey"),
+	actor: ActorRefSchema,
+	orgId: Schema.optional(nonEmpty("orgId")),
+	permissionId: Schema.optional(PermissionIdSchema),
+	lineage: Schema.optional(PaymentCommandLineageSchema),
+	items: Schema.Array(PaymentBirthItemSchema)
+}).pipe(Schema.refine((command) => hasActorBoundPermission(command.actor, command.orgId, command.permissionId), { message: "Organization Payment commands require matching orgId and permissionId; personal commands forbid both" }));
+Schema.Union([
+	PaymentBirthCommandSchema,
+	Schema.Struct({
+		kind: Schema.Literal("claim_commitment"),
+		actor: AccountActorRefSchema,
+		paymentId: PaymentIdSchema
+	}),
+	Schema.Struct({
+		kind: Schema.Literal("cancel_commitment"),
+		actor: ActorRefSchema,
+		paymentId: PaymentIdSchema
+	}),
+	Schema.Struct({
+		kind: Schema.Literal("redirect_commitment"),
+		actor: ActorRefSchema,
+		paymentId: PaymentIdSchema,
+		recipient: ActorOrDestinationRefSchema
+	})
+]);
+const PaymentExecutionRouteSchema = Schema.Union([Schema.Struct({
+	kind: Schema.Literal("direct"),
+	userOpSenderSafe: SafeAddressSchema
+}), Schema.Struct({
+	kind: Schema.Literal("zodiac_role"),
+	userOpSenderSafe: SafeAddressSchema,
+	organizationSafe: SafeAddressSchema,
+	rolesModule: ModuleAddressSchema,
+	roleKey: RoleKeySchema
+})]);
+const PreparedMoneyItemSchema = Schema.Union([
+	Schema.Struct({
+		operation: Schema.Literal("send"),
+		paymentId: PaymentIdSchema,
+		settlementId: SettlementIdSchema,
+		recipientSafe: SafeAddressSchema,
+		tokenAddress: AddressSchema$1,
+		rawAmount: WeiAmountSchema$1,
+		kind: Uint16Schema,
+		documentHash: NonzeroDocumentHashSchema
+	}),
+	Schema.Struct({
+		operation: Schema.Literal("create_commitment"),
+		paymentId: PaymentIdSchema,
+		settlementId: SettlementIdSchema,
+		recipientSafe: SafeAddressSchema,
+		tokenAddress: AddressSchema$1,
+		totalAmount: WeiAmountSchema$1,
+		startTime: Uint48Schema,
+		cliffTime: Uint48Schema,
+		endTime: Uint48Schema,
+		kind: Uint16Schema,
+		documentHash: NonzeroDocumentHashSchema
+	}),
+	Schema.Struct({
+		operation: Schema.Literal("claim_commitment"),
+		paymentId: PaymentIdSchema,
+		commitmentId: Uint256StringSchema
+	}),
+	Schema.Struct({
+		operation: Schema.Literal("cancel_commitment"),
+		paymentId: PaymentIdSchema,
+		commitmentId: Uint256StringSchema,
+		documentHash: NonzeroDocumentHashSchema
+	}),
+	Schema.Struct({
+		operation: Schema.Literal("redirect_commitment"),
+		paymentId: PaymentIdSchema,
+		commitmentId: Uint256StringSchema,
+		recipientSafe: SafeAddressSchema,
+		documentHash: NonzeroDocumentHashSchema
+	})
+]);
+Schema.Struct({
+	commandId: PaymentCommandIdSchema,
+	chainId: ChainIdSchema$1,
+	contractAddress: AddressSchema$1,
+	senderSafe: SafeAddressSchema,
+	executionRoute: PaymentExecutionRouteSchema,
+	items: Schema.Array(PreparedMoneyItemSchema)
+});
+Schema.Struct({
+	commandId: PaymentCommandIdSchema,
+	paymentIds: Schema.Array(PaymentIdSchema),
+	userOpHash: Bytes32Schema
+});
+const MoneyExecutionIdSchema = Schema.String.pipe(Schema.refine((value) => /^money_execution_[0-9a-f]{64}$/u.test(value), { message: "executionId must be a money_execution_ identifier" }));
+const OwnerSignatureSchema = Schema.String.pipe(Schema.refine((value) => /^0x[0-9a-fA-F]{130}$/u.test(value), { message: "signature must be a 65-byte 0x value" }));
+const PaymentExecutionIntentSchema = Schema.Struct({
+	to: PaymentRef,
+	amount: FinancialOpsMoney,
+	paymentType: Schema.optional(Schema.Literals([
+		"unspecified",
+		"invoice",
+		"payroll",
+		"reimbursement"
+	])),
+	document: Schema.optional(AttachablePaymentDocumentEnvelope),
+	timing: Schema.optional(PaymentTiming),
+	lineItems: Schema.optional(Schema.Array(LineItem))
+});
+Schema.Struct({
+	requestKey: nonEmpty("requestKey"),
+	signerAddress: AddressSchema$1,
+	payment: PaymentExecutionIntentSchema
+});
+Schema.Struct({
+	executionId: MoneyExecutionIdSchema,
+	commandId: PaymentCommandIdSchema,
+	paymentId: PaymentIdSchema,
+	requestKey: nonEmpty("requestKey"),
+	payment: PaymentExecutionIntentSchema,
+	purposeKind: PaymentPurposeKindSchema,
+	emitPaymentInitiated: Schema.Boolean,
+	chainId: BaseSepoliaChainIdSchema,
+	signerAddress: AddressSchema$1,
+	userOpSenderSafe: SafeAddressSchema,
+	digest: Bytes32Schema
+});
+Schema.Struct({
+	executionId: MoneyExecutionIdSchema,
+	signature: OwnerSignatureSchema
+});
+Schema.Struct({
+	executionId: MoneyExecutionIdSchema,
+	commandId: PaymentCommandIdSchema,
+	userOpHash: Bytes32Schema,
+	payment: Payment
+});
+Schema.Struct({
+	executionId: MoneyExecutionIdSchema,
+	commandId: PaymentCommandIdSchema,
+	userOpHash: Bytes32Schema,
+	payments: Schema.Array(Payment)
+});
+const PaymentLifecycleExecutionIntentSchema = Schema.Union([
+	Schema.Struct({
+		kind: Schema.Literal("claim"),
+		paymentId: PaymentIdSchema
+	}),
+	Schema.Struct({
+		kind: Schema.Literal("cancel"),
+		paymentId: PaymentIdSchema
+	}),
+	Schema.Struct({
+		kind: Schema.Literal("redirect"),
+		paymentId: PaymentIdSchema,
+		recipient: PaymentRef
+	})
+]);
+Schema.Struct({
+	signerAddress: AddressSchema$1,
+	intent: PaymentLifecycleExecutionIntentSchema
+});
+const OrganizationPaymentExecutionItemSchema = Schema.Struct({
+	to: PaymentRef,
+	amount: FinancialOpsMoney,
+	paymentType: Schema.optional(Schema.Literals([
+		"unspecified",
+		"invoice",
+		"payroll",
+		"reimbursement"
+	])),
+	document: Schema.optional(AttachablePaymentDocumentEnvelope)
+});
+Schema.Struct({
+	orgId: nonEmpty("orgId"),
+	permissionId: PermissionIdSchema,
+	requestKey: nonEmpty("requestKey"),
+	signerAddress: AddressSchema$1,
+	items: Schema.Array(OrganizationPaymentExecutionItemSchema),
+	lineage: Schema.optional(PaymentCommandLineageSchema)
+});
+Schema.Struct({
+	executionId: MoneyExecutionIdSchema,
+	commandId: PaymentCommandIdSchema,
+	paymentIds: Schema.Array(PaymentIdSchema),
+	request: Schema.Union([PaymentLifecycleExecutionIntentSchema, Schema.Struct({
+		orgId: nonEmpty("orgId"),
+		permissionId: PermissionIdSchema,
+		requestKey: nonEmpty("requestKey"),
+		items: Schema.Array(OrganizationPaymentExecutionItemSchema),
+		lineage: Schema.optional(PaymentCommandLineageSchema)
+	})]),
+	chainId: BaseSepoliaChainIdSchema,
+	signerAddress: AddressSchema$1,
+	userOpSenderSafe: SafeAddressSchema,
+	digest: Bytes32Schema
+});
+const PermissionIntentSchema = Schema.Union([Schema.Struct({
+	type: Schema.Literal("budget"),
+	limit: FinancialOpsMoney
+}), Schema.Struct({ type: Schema.Literal("managePeople") })]);
+const PermissionCommandSchema = Schema.Union([
+	Schema.Struct({
+		operation: Schema.Literal("create"),
+		requestKey: nonEmpty("requestKey"),
+		intent: PermissionIntentSchema
+	}),
+	Schema.Struct({
+		operation: Schema.Literal("change"),
+		requestKey: nonEmpty("requestKey"),
+		permissionId: PermissionIdSchema,
+		intent: PermissionIntentSchema
+	}),
+	Schema.Struct({
+		operation: Schema.Literal("assign"),
+		requestKey: nonEmpty("requestKey"),
+		permissionId: PermissionIdSchema,
+		accountId: nonEmpty("accountId")
+	}),
+	Schema.Struct({
+		operation: Schema.Literal("revoke"),
+		requestKey: nonEmpty("requestKey"),
+		permissionAssignmentId: PermissionAssignmentIdSchema
+	}),
+	Schema.Struct({
+		operation: Schema.Literal("replace"),
+		requestKey: nonEmpty("requestKey")
+	})
+]);
+const PermissionChainCallSchema = Schema.Struct({
+	to: AddressSchema$1,
+	value: Schema.Literal("0"),
+	data: HexDataSchema
+});
+const PermissionResourceSchema = Schema.Union([
+	PermissionSchema,
+	PermissionAssignmentSchema,
+	Schema.Array(PermissionSchema)
+]);
+Schema.Struct({
+	status: Schema.Literal("prepared"),
+	commandId: PaymentCommandIdSchema,
+	operation: PermissionOperationSchema,
+	expectedRevision: nonNegativeInteger("expectedRevision"),
+	userOpSenderSafe: SafeAddressSchema,
+	organizationSafe: SafeAddressSchema,
+	calls: Schema.Array(PermissionChainCallSchema),
+	value: PermissionResourceSchema
+});
+Schema.Struct({
+	orgId: nonEmpty("orgId"),
+	signerAddress: AddressSchema$1,
+	command: PermissionCommandSchema
+});
+Schema.Struct({
+	executionId: MoneyExecutionIdSchema,
+	commandId: PaymentCommandIdSchema,
+	operation: PermissionOperationSchema,
+	orgId: nonEmpty("orgId"),
+	command: PermissionCommandSchema,
+	expectedRevision: nonNegativeInteger("expectedRevision"),
+	chainId: BaseSepoliaChainIdSchema,
+	signerAddress: AddressSchema$1,
+	userOpSenderSafe: SafeAddressSchema,
+	digest: Bytes32Schema,
+	value: PermissionResourceSchema
+});
+Schema.Struct({
+	status: Schema.Literal("submitted"),
+	executionId: MoneyExecutionIdSchema,
+	commandId: PaymentCommandIdSchema,
+	userOpHash: Bytes32Schema,
+	value: PermissionResourceSchema
+});
+`
+.capxul-doc{--ink:#1d1d1f;--muted:#6e6e73;--line:#e7e7ea;--accent:#0a7d4b;--bg:#fff;
+  font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Inter,system-ui,sans-serif;
+  color:var(--ink);background:var(--bg);max-width:44rem;margin:0 auto;padding:2.75rem 3rem;
+  border:1px solid var(--line);border-radius:16px;box-shadow:0 1px 2px rgba(0,0,0,.04),0 12px 32px rgba(0,0,0,.06);
+  line-height:1.5;font-size:15px;overflow-wrap:anywhere;word-break:break-word}
+.capxul-doc *{box-sizing:border-box;min-width:0}
+.capxul-doc .doc-header{display:flex;flex-direction:column;gap:1.25rem;padding-bottom:1.5rem;border-bottom:1px solid var(--line);margin-bottom:1.75rem}
+.capxul-doc .doc-brand{display:flex;align-items:center;gap:.5rem;color:var(--accent);font-weight:600}
+.capxul-doc .doc-brand-mark{font-size:1.1rem}
+.capxul-doc .doc-brand-name{letter-spacing:.02em}
+.capxul-doc .doc-headline{display:flex;align-items:baseline;justify-content:space-between;gap:1rem;flex-wrap:wrap}
+.capxul-doc .doc-title{font-size:1.9rem;font-weight:700;letter-spacing:-.02em;margin:0}
+.capxul-doc .doc-badge{font-size:.7rem;font-weight:700;text-transform:uppercase;letter-spacing:.08em;
+  color:var(--accent);background:rgba(10,125,75,.1);padding:.3rem .6rem;border-radius:999px;max-width:100%;text-align:right}
+.capxul-doc .doc-parties{display:grid;grid-template-columns:1fr 1fr;gap:1.25rem;margin-bottom:1.75rem}
+.capxul-doc .doc-party{display:flex;flex-direction:column;gap:.15rem}
+.capxul-doc .doc-party-label{font-size:.72rem;text-transform:uppercase;letter-spacing:.06em;color:var(--muted)}
+.capxul-doc .doc-party-name{font-weight:600}
+.capxul-doc .doc-meta{display:flex;flex-direction:column;gap:.4rem;margin-bottom:1.75rem}
+.capxul-doc .doc-meta-row{display:flex;justify-content:space-between;gap:1rem;font-size:.92rem}
+.capxul-doc .doc-meta-label{color:var(--muted);flex-shrink:0}
+.capxul-doc .doc-meta-value{font-weight:500;text-align:right}
+.capxul-doc time{color:var(--ink);font-variant-numeric:tabular-nums}
+.capxul-doc .doc-line-items{width:100%;border-collapse:collapse;margin:.5rem 0 1.5rem;font-size:.92rem}
+.capxul-doc .doc-line-items th{text-align:left;font-size:.7rem;text-transform:uppercase;letter-spacing:.05em;
+  color:var(--muted);font-weight:600;padding:.5rem .25rem;border-bottom:1px solid var(--line)}
+.capxul-doc .doc-line-items td{padding:.7rem .25rem;border-bottom:1px solid var(--line)}
+.capxul-doc .doc-li-qty,.capxul-doc .doc-li-unit,.capxul-doc .doc-li-total{text-align:right;font-variant-numeric:tabular-nums;white-space:nowrap}
+.capxul-doc .doc-li-desc{width:100%}
+.capxul-doc .doc-totals{display:flex;flex-direction:column;gap:.5rem;margin-top:.5rem}
+.capxul-doc .doc-total-line{display:flex;justify-content:space-between;align-items:baseline;gap:1rem}
+.capxul-doc .doc-total-label{color:var(--muted)}
+.capxul-doc .doc-total-deduction .doc-amount-value{color:var(--muted)}
+.capxul-doc .doc-total-grand{border-top:2px solid var(--ink);margin-top:.5rem;padding-top:.75rem;font-size:1.15rem}
+.capxul-doc .doc-total-grand .doc-amount-value{font-weight:700}
+.capxul-doc .doc-amount-value{font-variant-numeric:tabular-nums;font-weight:600}
+.capxul-doc .doc-hero{text-align:center;padding:1.5rem 0 2rem}
+.capxul-doc .doc-hero-label{font-size:.72rem;text-transform:uppercase;letter-spacing:.06em;color:var(--muted)}
+.capxul-doc .doc-hero-amount{font-size:2.6rem;font-weight:700;letter-spacing:-.02em;margin-top:.35rem}
+.capxul-doc .doc-note{color:var(--ink);background:#f7f7f8;border-radius:10px;padding:.9rem 1.1rem;margin:0}
+.capxul-doc .doc-dest-address{font-family:ui-monospace,SFMono-Regular,Menlo,monospace;font-size:.9rem}
+.capxul-doc .doc-footer{margin-top:1.75rem;padding-top:1.25rem;border-top:1px solid var(--line);color:var(--muted);font-size:.9rem}
+.capxul-doc code{font-family:ui-monospace,SFMono-Regular,Menlo,monospace;font-size:.82rem;color:var(--muted);word-break:break-all}
+@media (max-width:540px){.capxul-doc{padding:1.75rem 1.25rem}.capxul-doc .doc-parties{grid-template-columns:1fr}}
+`.trim();
+//#endregion
+//#region ../wire/src/secret-material.ts
+const SENSITIVE_MATERIAL_PATTERNS = [
+	/0x[a-fA-F0-9]{40,}/u,
+	/(?:^|[^a-fA-F0-9])[a-fA-F0-9]{64}(?:$|[^a-fA-F0-9])/u,
+	/eyJ[A-Za-z0-9_-]*\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+/u,
+	/(?:(?:sk|pk|rk)_(?:live|test)|(?:phc|phx|ghp|gho|ghu|ghs|ghr|whsec)_|github_pat_|xox[baprs]-|AKIA[0-9A-Z]{16}|AIza)[A-Za-z0-9_-]*/iu
+];
+/**
+* Reject: does the value carry any known secret material? Best effort — callers
+* drop the whole value on a match; a false negative is a leak, a false positive
+* merely omits an observation field.
+*/
+function containsSensitiveMaterial(value) {
+	return SENSITIVE_MATERIAL_PATTERNS.some((pattern) => pattern.test(value));
+}
+//#endregion
+//#region ../wire/src/observation-context.ts
+/** Single bounded HTTP carrier used before a Convex action envelope exists. */
+const OBSERVATION_CONTEXT_HEADER = "x-capxul-observation-context";
+const FIELD_RULES = {
+	application: {
+		maxLength: 64,
+		pattern: /^[A-Za-z0-9][A-Za-z0-9._-]*$/u
+	},
+	applicationId: {
+		maxLength: 30,
+		pattern: APP_ID_RE
+	},
+	release: {
+		maxLength: 128,
+		pattern: /^[A-Za-z0-9][A-Za-z0-9._+@:/-]*$/u
+	},
+	sessionId: {
+		maxLength: 128,
+		pattern: /^[A-Za-z0-9][A-Za-z0-9._:-]*$/u
+	},
+	organizationId: {
+		maxLength: 128,
+		pattern: /^[A-Za-z0-9][A-Za-z0-9._:-]*$/u
+	},
+	journeyId: {
+		maxLength: 128,
+		pattern: /^[A-Za-z0-9][A-Za-z0-9._:-]*$/u
+	},
+	correlationId: {
+		maxLength: 128,
+		pattern: /^[A-Za-z0-9][A-Za-z0-9._:-]*$/u
+	},
+	anonymousId: {
+		maxLength: 128,
+		pattern: /^anon_[A-Za-z0-9-]+$/u
+	},
+	traceparent: {
+		maxLength: 55,
+		pattern: /^00-[0-9a-f]{32}-[0-9a-f]{16}-0[01]$/u
+	}
+};
+/**
+* Copy only the canonical allowlist and silently omit malformed/sensitive
+* values. Observation metadata is best effort and may never reject a domain
+* operation.
+*/
+function sanitizeObservationContext(input) {
+	if (typeof input !== "object" || input === null || Array.isArray(input)) return void 0;
+	const source = input;
+	const sanitized = {};
+	for (const field of Object.keys(FIELD_RULES)) {
+		const value = source[field];
+		if (!isSafeField(field, value)) continue;
+		sanitized[field] = value;
+	}
+	return Object.keys(sanitized).length === 0 ? void 0 : sanitized;
+}
+/** Encode only the sanitized allowlist; absence stays absence. */
+function encodeObservationContextHeader(input) {
+	const sanitized = sanitizeObservationContext(input);
+	return sanitized === void 0 ? void 0 : JSON.stringify(sanitized);
+}
+function isSafeField(field, value) {
+	if (typeof value !== "string") return false;
+	const rule = FIELD_RULES[field];
+	return value.length > 0 && value.length <= rule.maxLength && value === value.trim() && !value.includes("://") && !containsSensitiveMaterial(value) && rule.pattern.test(value);
+}
+//#endregion
+//#region src/contract/actor-scope.ts
+const actorScopeContract = {
+	addressBookList: makeFunctionReference(CAPXUL_FUNCTIONS["financialOps/addressBook"].list),
+	addressBookGet: makeFunctionReference(CAPXUL_FUNCTIONS["financialOps/addressBook"].get),
+	addressBookAdd: makeFunctionReference(CAPXUL_FUNCTIONS["financialOps/addressBook"].add),
+	addressBookHide: makeFunctionReference(CAPXUL_FUNCTIONS["financialOps/addressBook"].hide),
+	addressBookUnhide: makeFunctionReference(CAPXUL_FUNCTIONS["financialOps/addressBook"].unhide),
+	addressBookLabel: makeFunctionReference(CAPXUL_FUNCTIONS["financialOps/addressBook"].label),
+	requestsIssue: makeFunctionReference(CAPXUL_FUNCTIONS["financialOps/requestsInbox"].issue),
+	requestsList: makeFunctionReference(CAPXUL_FUNCTIONS["financialOps/requestsInbox"].list),
+	requestsGet: makeFunctionReference(CAPXUL_FUNCTIONS["financialOps/requestsInbox"].get),
+	requestsCancel: makeFunctionReference(CAPXUL_FUNCTIONS["financialOps/requestsInbox"].cancel),
+	inboxList: makeFunctionReference(CAPXUL_FUNCTIONS["financialOps/requestsInbox"].inboxList),
+	inboxApprove: makeFunctionReference(CAPXUL_FUNCTIONS["financialOps/requestsInbox"].approve),
+	inboxDecline: makeFunctionReference(CAPXUL_FUNCTIONS["financialOps/requestsInbox"].decline)
+};
+//#endregion
+//#region src/surface/contacts.ts
+function makeActorRelationshipMethods(deps) {
+	const domain = deps.actor.kind === "account" ? "account" : "org";
+	const actor = deps.actor;
+	const convexCall = deps.convexCall;
+	if (convexCall === void 0) return makeNotImplementedActorRelationshipMethods(deps, domain);
+	const fns = actorScopeContract;
+	return {
+		addressBook: {
+			list: (options) => mapOk$1(awaitableConvex(options?.signal, "addressBook.list", () => convexCall.query(fns.addressBookList, { actor })), (entries) => entries.map(mapAddressBookEntry)),
+			get: async (entryId, options) => {
+				const ref = refFromEntryId(entryId);
+				if (!ref.ok) return ref;
+				return mapOk$1(await awaitableConvex(options?.signal, "addressBook.get", () => convexCall.query(fns.addressBookGet, {
+					actor,
+					ref: ref.value
+				})), (entry) => entry === null ? null : mapAddressBookEntry(entry));
+			},
+			add: async (input, options) => {
+				const ref = normalizeRefForBackend$1(input.ref, "ref");
+				if (!ref.ok) return ref;
+				return mapOk$1(await awaitableConvex(options?.signal, "addressBook.add", () => convexCall.mutation(fns.addressBookAdd, {
+					actor,
+					ref: ref.value,
+					...input.label === void 0 ? {} : { label: input.label }
+				})), mapAddressBookEntry);
+			},
+			hide: async (entryId, options) => {
+				const ref = refFromEntryId(entryId);
+				if (!ref.ok) return ref;
+				return mapOk$1(await awaitableConvex(options?.signal, "addressBook.hide", () => convexCall.mutation(fns.addressBookHide, {
+					actor,
+					ref: ref.value
+				})), mapAddressBookEntry);
+			},
+			unhide: async (entryId, options) => {
+				const ref = refFromEntryId(entryId);
+				if (!ref.ok) return ref;
+				return mapOk$1(await awaitableConvex(options?.signal, "addressBook.unhide", () => convexCall.mutation(fns.addressBookUnhide, {
+					actor,
+					ref: ref.value
+				})), mapAddressBookEntry);
+			},
+			label: async (input, options) => {
+				const ref = refFromEntryId(input.entryId);
+				if (!ref.ok) return ref;
+				return mapOk$1(await awaitableConvex(options?.signal, "addressBook.label", () => convexCall.mutation(fns.addressBookLabel, {
+					actor,
+					ref: ref.value,
+					label: input.label
+				})), mapAddressBookEntry);
+			}
+		},
+		requests: {
+			issue: async (input, options) => {
+				const payer = normalizeRefForBackend$1(input.payer, "payer");
+				if (!payer.ok) return payer;
+				return mapOk$1(await awaitableConvex(options?.signal, "requests.issue", () => convexCall.mutation(fns.requestsIssue, {
+					actor,
+					payer: payer.value,
+					amount: input.amount,
 					reference: input.reference,
 					...input.memo === void 0 ? {} : { memo: input.memo },
 					...input.expiresAt === void 0 ? {} : { expiresAt: input.expiresAt }
 				})), (request) => mapActorRequest(request, input.payer));
 			},
-			list: (options) => mapOk$2(awaitableConvex(options?.signal, "requests.list", () => convexCall.query(fns.requestsList, { actor })), (requests) => requests.map((request) => mapActorRequest(request))),
-			get: (requestId, options) => mapOk$2(awaitableConvex(options?.signal, "requests.get", () => convexCall.query(fns.requestsGet, {
+			list: (options) => mapOk$1(awaitableConvex(options?.signal, "requests.list", () => convexCall.query(fns.requestsList, { actor })), (requests) => requests.map((request) => mapActorRequest(request))),
+			get: (requestId, options) => mapOk$1(awaitableConvex(options?.signal, "requests.get", () => convexCall.query(fns.requestsGet, {
 				actor,
 				paymentRequestId: requestId
 			})), (request) => request === null ? null : mapActorRequest(request)),
-			cancel: (requestId, options) => mapOk$2(awaitableConvex(options?.signal, "requests.cancel", () => convexCall.mutation(fns.requestsCancel, {
+			cancel: (requestId, options) => mapOk$1(awaitableConvex(options?.signal, "requests.cancel", () => convexCall.mutation(fns.requestsCancel, {
 				actor,
 				paymentRequestId: requestId
-			})), (request) => mapActorRequest(request)),
-			reconcile: async (options) => {
-				return mapOk$2(awaitableConvex(options?.signal, "requests.reconcile", () => convexCall.query(fns.requestsReconcile, { actor })), (entries) => entries.map(mapReconciliationEntry));
-			}
+			})), (request) => mapActorRequest(request))
 		},
 		inbox: {
-			list: (options) => mapOk$2(awaitableConvex(options?.signal, "inbox.list", () => convexCall.query(fns.inboxList, { actor })), (items) => items.map(mapInboxItem)),
-			approve: (input, options) => mapOk$2(awaitableConvex(options?.signal, "inbox.approve", () => convexCall.mutation(fns.inboxApprove, {
+			list: (options) => mapOk$1(awaitableConvex(options?.signal, "inbox.list", () => convexCall.query(fns.inboxList, { actor })), (items) => items.map(mapInboxItem)),
+			approve: (input, options) => mapOk$1(awaitableConvex(options?.signal, "inbox.approve", () => convexCall.mutation(fns.inboxApprove, {
 				actor,
 				paymentRequestId: input.requestId,
 				...input.timing === void 0 ? {} : { timing: input.timing }
 			})), mapApprovedInboxPayment),
-			decline: (requestId, options) => mapOk$2(awaitableConvex(options?.signal, "inbox.decline", () => convexCall.mutation(fns.inboxDecline, {
+			decline: (requestId, options) => mapOk$1(awaitableConvex(options?.signal, "inbox.decline", () => convexCall.mutation(fns.inboxDecline, {
 				actor,
 				paymentRequestId: requestId
 			})), mapInboxItem)
 		},
-		insights: {
-			summary: (options) => awaitableConvex(options?.signal, "insights.summary", () => convexCall.query(fns.insightsSummary, { actor })),
-			history: (options) => mapOk$2(awaitableConvex(options?.signal, "insights.history", () => convexCall.query(fns.insightsHistory, { actor })), (history) => history.transactions.map(normalizePaymentTiming$2))
-		},
 		profile: {
 			get: (options) => {
 				if (deps.actor.kind === "account" && deps.accountProfileMethods !== void 0) return mapAccountProfile(deps.accountProfileMethods.get(options));
-				return missingConvexCall$1(`${domain}.profile.get`);
+				return missingConvexCall(`${domain}.profile.get`);
 			},
 			depositInstructions: (options) => {
 				if (deps.actor.kind === "account" && deps.accountProfileMethods !== void 0) return deps.accountProfileMethods.depositInstructions(options);
-				return missingConvexCall$1(`${domain}.profile.depositInstructions`);
+				return missingConvexCall(`${domain}.profile.depositInstructions`);
 			}
 		}
 	};
@@ -2349,37 +3429,32 @@ function makeActorRelationshipMethods(deps) {
 function makeNotImplementedActorRelationshipMethods(deps, domain) {
 	return {
 		addressBook: {
-			list: () => missingConvexCall$1("addressBook.list"),
-			get: () => missingConvexCall$1("addressBook.get"),
-			add: () => missingConvexCall$1("addressBook.add"),
-			hide: () => missingConvexCall$1("addressBook.hide"),
-			unhide: () => missingConvexCall$1("addressBook.unhide"),
-			label: () => missingConvexCall$1("addressBook.label")
+			list: () => missingConvexCall("addressBook.list"),
+			get: () => missingConvexCall("addressBook.get"),
+			add: () => missingConvexCall("addressBook.add"),
+			hide: () => missingConvexCall("addressBook.hide"),
+			unhide: () => missingConvexCall("addressBook.unhide"),
+			label: () => missingConvexCall("addressBook.label")
 		},
 		requests: {
-			issue: () => missingConvexCall$1("requests.issue"),
-			list: () => missingConvexCall$1("requests.list"),
-			get: () => missingConvexCall$1("requests.get"),
-			cancel: () => missingConvexCall$1("requests.cancel"),
-			reconcile: () => missingConvexCall$1("requests.reconcile")
+			issue: () => missingConvexCall("requests.issue"),
+			list: () => missingConvexCall("requests.list"),
+			get: () => missingConvexCall("requests.get"),
+			cancel: () => missingConvexCall("requests.cancel")
 		},
 		inbox: {
-			list: () => missingConvexCall$1("inbox.list"),
-			approve: () => missingConvexCall$1("inbox.approve"),
-			decline: () => missingConvexCall$1("inbox.decline")
-		},
-		insights: {
-			summary: () => missingConvexCall$1("insights.summary"),
-			history: () => missingConvexCall$1("insights.history")
+			list: () => missingConvexCall("inbox.list"),
+			approve: () => missingConvexCall("inbox.approve"),
+			decline: () => missingConvexCall("inbox.decline")
 		},
 		profile: {
 			get: (options) => {
 				if (deps.actor.kind === "account" && deps.accountProfileMethods !== void 0) return mapAccountProfile(deps.accountProfileMethods.get(options));
-				return missingConvexCall$1(`${domain}.profile.get`);
+				return missingConvexCall(`${domain}.profile.get`);
 			},
 			depositInstructions: (options) => {
 				if (deps.actor.kind === "account" && deps.accountProfileMethods !== void 0) return deps.accountProfileMethods.depositInstructions(options);
-				return missingConvexCall$1(`${domain}.profile.depositInstructions`);
+				return missingConvexCall(`${domain}.profile.depositInstructions`);
 			}
 		}
 	};
@@ -2396,13 +3471,13 @@ async function mapAccountProfile(resultPromise) {
 		}
 	};
 }
-function missingConvexCall$1(operation) {
+function missingConvexCall(operation) {
 	return Promise.resolve({
 		ok: false,
 		error: Errors.providerError("convex", operation, "ConvexCallPort is required")
 	});
 }
-async function mapOk$2(resultOrPromise, f) {
+async function mapOk$1(resultOrPromise, f) {
 	const result = await resultOrPromise;
 	if (!result.ok) return result;
 	return {
@@ -2448,17 +3523,8 @@ function mapInboxItem(item) {
 		status: mapInboxStatus(item.status)
 	};
 }
-function mapReconciliationEntry(entry) {
-	return {
-		paymentRequestId: entry.paymentRequestId,
-		reference: entry.reference,
-		status: entry.status,
-		settledPaymentId: entry.settledPaymentId ?? null,
-		receiptDocumentHash: entry.receiptDocumentHash ?? null
-	};
-}
 function mapApprovedInboxPayment(item) {
-	if (item.settledPayment !== void 0) return normalizePaymentTiming$2(item.settledPayment);
+	if (item.settledPayment !== void 0) return normalizePaymentTiming$1(item.settledPayment);
 	const zero = {
 		...item.amount,
 		value: "0"
@@ -2528,7 +3594,7 @@ function mapInboxStatus(status) {
 		default: return "open";
 	}
 }
-function normalizePaymentTiming$2(payment) {
+function normalizePaymentTiming$1(payment) {
 	const { release: _release, ...rest } = payment;
 	return {
 		...rest,
@@ -2879,6 +3945,9 @@ function makeAccountMethods(deps) {
 	};
 }
 //#endregion
+//#region package.json
+var version = "2.0.0";
+//#endregion
 //#region src/ports/auth-client.ts
 var AuthClientError = class extends Data.TaggedError("AuthClientError") {};
 var AuthClientPortTag = class extends Context.Service()("@capxul/sdk/ports/AuthClientPort") {};
@@ -2904,11 +3973,11 @@ function fromResult(operation, run) {
 		})
 	}).pipe(Effect.flatMap((result) => result.ok ? Effect.succeed(result.value) : Effect.fail(new AuthClientError({
 		operation,
-		kind: errorKind(result.error),
+		kind: errorKind$1(result.error),
 		cause: result.error
 	}))));
 }
-function errorKind(error) {
+function errorKind$1(error) {
 	if (error.code === "CANCELLED") return "cancelled";
 	if (error.code === "NETWORK_ERROR") return "network";
 	if (error.code === "INVALID_INPUT" || error.code === "OTP_EXPIRED") return "validation";
@@ -2945,45 +4014,6 @@ function convexCallErrorFromCapxul(operation, error) {
 }
 var ConvexCallPortTag = class extends Context.Service()("@capxul/sdk/ports/ConvexCallPort") {};
 //#endregion
-//#region src/internal/invocation-observation.ts
-const INVOCATION_OBSERVATION = Symbol("capxul.invocation-observation");
-const FAILURE_INVOCATION_SNAPSHOT = Symbol("capxul.failure-invocation-snapshot");
-/** @internal Attach one immutable, non-wire invocation snapshot to an SDK-owned object. */
-function attachInvocationObservation(target, context) {
-	const snapshot = Object.freeze(context === void 0 ? {} : { context: Object.freeze({ ...context }) });
-	Object.defineProperty(target, INVOCATION_OBSERVATION, {
-		configurable: false,
-		enumerable: false,
-		value: snapshot,
-		writable: false
-	});
-	return target;
-}
-/** @internal Read the snapshot without exposing its symbol or adding a wire field. */
-function readInvocationObservation(source) {
-	if (typeof source !== "object" || source === null) return void 0;
-	return source[INVOCATION_OBSERVATION];
-}
-/** @internal Carry a snapshot across an SDK adapter projection without resolving again. */
-function copyInvocationObservation(source, target) {
-	const snapshot = readInvocationObservation(source);
-	return snapshot === void 0 ? target : attachInvocationObservation(target, snapshot.context);
-}
-/** @internal Mark a failure envelope as already resolved at the public invocation boundary. */
-function markFailureInvocationSnapshot(failure) {
-	Object.defineProperty(failure, FAILURE_INVOCATION_SNAPSHOT, {
-		configurable: false,
-		enumerable: false,
-		value: true,
-		writable: false
-	});
-	return failure;
-}
-/** @internal Distinguish public-boundary failures from direct adapter calls. */
-function hasFailureInvocationSnapshot(failure) {
-	return typeof failure === "object" && failure !== null && failure[FAILURE_INVOCATION_SNAPSHOT] === true;
-}
-//#endregion
 //#region src/ports/identity.ts
 var IdentityError = class extends Data.TaggedError("IdentityError") {};
 function identityErrorFromCapxul(operation, error, cause = error) {
@@ -3061,19 +4091,6 @@ function fromWei(rawBalance, decimals, currency) {
 	};
 }
 //#endregion
-//#region src/ports/sub-account.ts
-var SubAccountError = class extends Data.TaggedError("SubAccountError") {};
-function subAccountErrorFromCapxul(operation, error, cause = error) {
-	return new SubAccountError({
-		operation,
-		publicCode: error.code,
-		publicError: error,
-		cause,
-		...error.details === void 0 ? {} : { details: error.details }
-	});
-}
-var SubAccountPortTag = class extends Context.Service()("@capxul/sdk/ports/SubAccountPort") {};
-//#endregion
 //#region src/ports/smart-account.ts
 var SmartAccountError = class extends Data.TaggedError("SmartAccountError") {};
 function smartAccountErrorFromCapxul(operation, error, cause = error) {
@@ -3102,31 +4119,15 @@ const EpochMsSchema = Schema.Number.pipe(Schema.refine((value) => Number.isSafeI
 const PublishableKeyIdSchema = Schema.String.pipe(Schema.refine((value) => value.length > 0, { message: "must be a non-empty string" }));
 const TxHashSchema = Schema.String.pipe(Schema.refine((value) => BYTES32_RE.test(value), { message: "must be 0x + 64 hex chars" }));
 const ACCOUNT_ID_TELEMETRY_RE = /^account_[0-9A-Za-z]+$/;
-const SUBACCOUNT_ID_TELEMETRY_RE = /^subaccount_[0-9A-Za-z]+$/;
 const WEI_AMOUNT_TELEMETRY_RE = /^[0-9]+$/;
 const AccountIdSchema = Schema.String.pipe(Schema.refine((value) => ACCOUNT_ID_TELEMETRY_RE.test(value), { message: "must be account_ plus an alphanumeric id" }));
-const SubAccountIdSchema = Schema.String.pipe(Schema.refine((value) => SUBACCOUNT_ID_TELEMETRY_RE.test(value), { message: "must be subaccount_ plus an alphanumeric id" }));
 const WeiAmountSchema = Schema.String.pipe(Schema.refine((value) => WEI_AMOUNT_TELEMETRY_RE.test(value), { message: "must be a non-negative integer string" }));
 const CurrencyCodeSchema = Schema.String.pipe(Schema.refine((value) => value.length > 0, { message: "must be a non-empty currency code" }));
 const BalanceBucketSchema = Schema.Literals(["zero", "nonzero"]);
-const TransferDirectionSchema = Schema.Literals([
-	"add",
-	"out",
-	"between"
-]);
-const SubAccountOpSchema = Schema.Literals([
-	"create",
-	"rename",
-	"delete"
-]);
 const OptionalAccountId = Schema.optional(AccountIdSchema);
-const OptionalSubAccountId = Schema.optional(SubAccountIdSchema);
 const OptionalWeiAmount = Schema.optional(WeiAmountSchema);
 const OptionalCurrencyCode = Schema.optional(CurrencyCodeSchema);
 const OptionalBalanceBucket = Schema.optional(BalanceBucketSchema);
-const OptionalTransferDirection = Schema.optional(TransferDirectionSchema);
-const OptionalSubAccountOp = Schema.optional(SubAccountOpSchema);
-const OptionalTrue = Schema.optional(Schema.Literal(true));
 const OptionalAddress = Schema.optional(AddressSchema);
 const OptionalAppId = Schema.optional(AppIdSchema);
 const OptionalBlockNumber = Schema.optional(BlockNumberSchema);
@@ -3135,11 +4136,6 @@ const OptionalDurationMs = Schema.optional(DurationMsSchema);
 const OptionalEpochMs = Schema.optional(EpochMsSchema);
 const OptionalPublishableKeyId = Schema.optional(PublishableKeyIdSchema);
 const OptionalTxHash = Schema.optional(TxHashSchema);
-const PAYMENT_ID_TELEMETRY_RE = /^payment_[0-9A-Za-z]+$/;
-const PAYEE_ID_TELEMETRY_RE = /^payee_[0-9A-Za-z]+$/;
-const PaymentIdTelemetrySchema = Schema.String.pipe(Schema.refine((value) => PAYMENT_ID_TELEMETRY_RE.test(value), { message: "must be payment_ plus an alphanumeric id" }));
-const PayeeIdTelemetrySchema = Schema.String.pipe(Schema.refine((value) => PAYEE_ID_TELEMETRY_RE.test(value), { message: "must be payee_ plus an alphanumeric id" }));
-const DocumentHashSchema = Schema.String.pipe(Schema.refine((value) => BYTES32_RE.test(value), { message: "must be 0x + 64 hex chars" }));
 /**
 * The canonical envelope (ADR-0020 A4): snake_case ONLY. `capxul_env` and
 * `producer` are REQUIRED — a boundary that forgets to stamp them fails schema
@@ -3162,7 +4158,6 @@ const TelemetryEnvelopeProps = {
 		"mcp",
 		"e2e"
 	]),
-	capxul_e2e_run_id: OptionalString,
 	journey_id: OptionalString,
 	correlation_id: OptionalString,
 	sdk_version: OptionalString
@@ -3266,45 +4261,6 @@ const FaucetFailedProps = Schema.Struct({
 	...TelemetryEnvelopeProps,
 	reason: OptionalString
 });
-const SubaccountCreatedProps = Schema.Struct({
-	...TelemetryEnvelopeProps,
-	sub_account_id: OptionalSubAccountId,
-	durationMs: OptionalDurationMs
-});
-const SubaccountRenamedProps = Schema.Struct({
-	...TelemetryEnvelopeProps,
-	sub_account_id: OptionalSubAccountId
-});
-const SubaccountDeletedProps = Schema.Struct({
-	...TelemetryEnvelopeProps,
-	sub_account_id: OptionalSubAccountId
-});
-const SubaccountOpFailedProps = Schema.Struct({
-	...TelemetryEnvelopeProps,
-	op: OptionalSubAccountOp,
-	reason: OptionalString
-});
-const TransferRequestedProps = Schema.Struct({
-	...TelemetryEnvelopeProps,
-	amount: OptionalWeiAmount,
-	direction: OptionalTransferDirection
-});
-const TransferBackendReceivedProps = Schema.Struct({
-	...TelemetryEnvelopeProps,
-	direction: OptionalTransferDirection
-});
-const TransferConfirmedProps = Schema.Struct({
-	...TelemetryEnvelopeProps,
-	amount: OptionalWeiAmount,
-	direction: OptionalTransferDirection,
-	available_bucket: OptionalBalanceBucket,
-	txless: OptionalTrue,
-	durationMs: OptionalDurationMs
-});
-const TransferFailedProps = Schema.Struct({
-	...TelemetryEnvelopeProps,
-	reason: OptionalString
-});
 const ORG_ID_TELEMETRY_RE = /^org_[0-9A-Za-z]+$/;
 const OrgIdTelemetrySchema = Schema.String.pipe(Schema.refine((value) => ORG_ID_TELEMETRY_RE.test(value), { message: "must be org_ plus an alphanumeric id" }));
 const OptionalOrgId = Schema.optional(OrgIdTelemetrySchema);
@@ -3429,75 +4385,70 @@ const OrgInviteAcceptedProps = Schema.Struct({
 	role: OptionalString,
 	status: OptionalString
 });
-const OrgRoleGrantedProps = Schema.Struct({
+const OrgInviteExpiredProps = Schema.Struct({
 	...TelemetryEnvelopeProps,
 	org_id: OptionalOrgId,
+	email_domain: OptionalString,
+	reason: OptionalString,
 	role: OptionalString,
-	status: OptionalString,
-	txHash: OptionalTxHash
+	status: OptionalString
 });
-const OrgMemberActiveProps = Schema.Struct({
+const PaymentInitiatedProps = Schema.Struct({
 	...TelemetryEnvelopeProps,
-	org_id: OptionalOrgId,
-	role: OptionalString,
-	status: OptionalString,
-	durationMs: OptionalDurationMs
+	kind: Schema.String,
+	payment_id: Schema.String
 });
-const OrgMemberRemovedProps = Schema.Struct({
+const PaymentSettledL2Props = Schema.Struct({
 	...TelemetryEnvelopeProps,
-	org_id: OptionalOrgId,
-	role: OptionalString,
-	status: OptionalString,
-	txHash: OptionalTxHash
+	kind: Schema.String,
+	chain_id: Schema.Number,
+	settlement_id: Schema.String
 });
-const OrgInviteExpiredProps = Schema.Struct({
+const PaymentFailedL2Props = Schema.Struct({
 	...TelemetryEnvelopeProps,
-	org_id: OptionalOrgId,
-	email_domain: OptionalString,
-	reason: OptionalString,
-	role: OptionalString,
-	status: OptionalString
+	kind: Schema.String,
+	payment_id: Schema.String,
+	reason_code: Schema.String
 });
-const OrgRoleGrantFailedProps = Schema.Struct({
+const DepositInitiatedProps = Schema.Struct({ ...TelemetryEnvelopeProps });
+const DepositSettledProps = Schema.Struct({
 	...TelemetryEnvelopeProps,
-	org_id: OptionalOrgId,
-	reason: OptionalString,
-	role: OptionalString
+	chain_id: Schema.Number,
+	tx_hash: Schema.String,
+	log_index: Schema.Number
 });
-const OptionalPaymentId = Schema.optional(PaymentIdTelemetrySchema);
-const OptionalPayeeId = Schema.optional(PayeeIdTelemetrySchema);
-const OptionalDocumentHash = Schema.optional(DocumentHashSchema);
-const PaymentTargetTelemetryProps = Schema.Struct({
+const PermissionMirrorVerificationProps = Schema.Struct({
 	...TelemetryEnvelopeProps,
-	payment_id: OptionalPaymentId,
-	payee_id: OptionalPayeeId,
-	document_hash: OptionalDocumentHash,
-	amount: OptionalWeiAmount,
-	currency: OptionalCurrencyCode,
-	status: OptionalString,
-	reason: OptionalString,
-	durationMs: OptionalDurationMs
-});
-const StreamTargetTelemetryProps = Schema.Struct({
+	outcome: Schema.String,
+	reason: Schema.String,
+	chain_id: Schema.Number,
+	finality: Schema.String,
+	lag_blocks: Schema.Number,
+	retry_count: Schema.Number
+});
+const MovementScanWindowProps = Schema.Struct({
 	...TelemetryEnvelopeProps,
-	payment_id: OptionalPaymentId,
-	document_hash: OptionalDocumentHash,
-	amount: OptionalWeiAmount,
-	currency: OptionalCurrencyCode,
-	status: OptionalString,
-	available_bucket: OptionalBalanceBucket,
-	reason: OptionalString,
-	durationMs: OptionalDurationMs
+	chain_id: Schema.Number,
+	token_address: Schema.String,
+	from_block: Schema.Number,
+	to_block: Schema.Number,
+	log_count: Schema.Number,
+	request_count: Schema.Number,
+	outcome: Schema.String
+});
+const MovementScanCheckpointProps = Schema.Struct({
+	...TelemetryEnvelopeProps,
+	chain_id: Schema.Number,
+	token_address: Schema.String,
+	next_block: Schema.Number,
+	anchor_block_number: Schema.Number
 });
-const WithdrawalTargetTelemetryProps = Schema.Struct({
+const MovementScanIncidentProps = Schema.Struct({
 	...TelemetryEnvelopeProps,
-	payment_id: OptionalPaymentId,
-	document_hash: OptionalDocumentHash,
-	amount: OptionalWeiAmount,
-	currency: OptionalCurrencyCode,
-	status: OptionalString,
-	reason: OptionalString,
-	durationMs: OptionalDurationMs
+	chain_id: Schema.Number,
+	token_address: Schema.String,
+	incident_kind: Schema.String,
+	anchor_block_number: Schema.Number
 });
 Schema.Struct({
 	name: Schema.Literal("auth_otp_requested"),
@@ -3576,60 +4527,28 @@ Schema.Struct({
 	props: OrganizationCreationReadyProps
 });
 Schema.Struct({
-	name: Schema.Literal("organization_creation_failed"),
-	props: OrganizationCreationFailedProps
-});
-Schema.Struct({
-	name: Schema.Literal("account_balance_read"),
-	props: AccountBalanceReadProps
-});
-Schema.Struct({
-	name: Schema.Literal("account_balance_failed"),
-	props: AccountBalanceFailedProps
-});
-Schema.Struct({
-	name: Schema.Literal("faucet_requested"),
-	props: FaucetRequestedProps
-});
-Schema.Struct({
-	name: Schema.Literal("faucet_confirmed"),
-	props: FaucetConfirmedProps
-});
-Schema.Struct({
-	name: Schema.Literal("faucet_failed"),
-	props: FaucetFailedProps
-});
-Schema.Struct({
-	name: Schema.Literal("subaccount_created"),
-	props: SubaccountCreatedProps
-});
-Schema.Struct({
-	name: Schema.Literal("subaccount_renamed"),
-	props: SubaccountRenamedProps
-});
-Schema.Struct({
-	name: Schema.Literal("subaccount_deleted"),
-	props: SubaccountDeletedProps
+	name: Schema.Literal("organization_creation_failed"),
+	props: OrganizationCreationFailedProps
 });
 Schema.Struct({
-	name: Schema.Literal("subaccount_op_failed"),
-	props: SubaccountOpFailedProps
+	name: Schema.Literal("account_balance_read"),
+	props: AccountBalanceReadProps
 });
 Schema.Struct({
-	name: Schema.Literal("transfer_requested"),
-	props: TransferRequestedProps
+	name: Schema.Literal("account_balance_failed"),
+	props: AccountBalanceFailedProps
 });
 Schema.Struct({
-	name: Schema.Literal("transfer_backend_received"),
-	props: TransferBackendReceivedProps
+	name: Schema.Literal("faucet_requested"),
+	props: FaucetRequestedProps
 });
 Schema.Struct({
-	name: Schema.Literal("transfer_confirmed"),
-	props: TransferConfirmedProps
+	name: Schema.Literal("faucet_confirmed"),
+	props: FaucetConfirmedProps
 });
 Schema.Struct({
-	name: Schema.Literal("transfer_failed"),
-	props: TransferFailedProps
+	name: Schema.Literal("faucet_failed"),
+	props: FaucetFailedProps
 });
 Schema.Struct({
 	name: Schema.Literal("org_create_started"),
@@ -3663,97 +4582,45 @@ Schema.Struct({
 	name: Schema.Literal("org_invite_accepted"),
 	props: OrgInviteAcceptedProps
 });
-Schema.Struct({
-	name: Schema.Literal("org_role_granted"),
-	props: OrgRoleGrantedProps
-});
-Schema.Struct({
-	name: Schema.Literal("org_member_active"),
-	props: OrgMemberActiveProps
-});
-Schema.Struct({
-	name: Schema.Literal("org_member_removed"),
-	props: OrgMemberRemovedProps
-});
 Schema.Struct({
 	name: Schema.Literal("org_invite_expired"),
 	props: OrgInviteExpiredProps
 });
 Schema.Struct({
-	name: Schema.Literal("org_role_grant_failed"),
-	props: OrgRoleGrantFailedProps
-});
-Schema.Struct({
-	name: Schema.Literal("payment_requested"),
-	props: PaymentTargetTelemetryProps
-});
-Schema.Struct({
-	name: Schema.Literal("payment_resolved"),
-	props: PaymentTargetTelemetryProps
-});
-Schema.Struct({
-	name: Schema.Literal("payment_document_attached"),
-	props: PaymentTargetTelemetryProps
-});
-Schema.Struct({
-	name: Schema.Literal("payment_submitted"),
-	props: PaymentTargetTelemetryProps
+	name: Schema.Literal("payment_initiated"),
+	props: PaymentInitiatedProps
 });
 Schema.Struct({
 	name: Schema.Literal("payment_settled"),
-	props: PaymentTargetTelemetryProps
-});
-Schema.Struct({
-	name: Schema.Literal("payment_claimed"),
-	props: PaymentTargetTelemetryProps
-});
-Schema.Struct({
-	name: Schema.Literal("payment_cancelled"),
-	props: PaymentTargetTelemetryProps
-});
-Schema.Struct({
-	name: Schema.Literal("payment_redirected"),
-	props: PaymentTargetTelemetryProps
+	props: PaymentSettledL2Props
 });
 Schema.Struct({
 	name: Schema.Literal("payment_failed"),
-	props: PaymentTargetTelemetryProps
+	props: PaymentFailedL2Props
 });
 Schema.Struct({
-	name: Schema.Literal("stream_created"),
-	props: StreamTargetTelemetryProps
+	name: Schema.Literal("deposit_initiated"),
+	props: DepositInitiatedProps
 });
 Schema.Struct({
-	name: Schema.Literal("stream_claimed"),
-	props: StreamTargetTelemetryProps
+	name: Schema.Literal("deposit_settled"),
+	props: DepositSettledProps
 });
 Schema.Struct({
-	name: Schema.Literal("stream_cancelled"),
-	props: StreamTargetTelemetryProps
+	name: Schema.Literal("permission_mirror_verification"),
+	props: PermissionMirrorVerificationProps
 });
 Schema.Struct({
-	name: Schema.Literal("stream_completed"),
-	props: StreamTargetTelemetryProps
+	name: Schema.Literal("movement_scan_window"),
+	props: MovementScanWindowProps
 });
 Schema.Struct({
-	name: Schema.Literal("stream_failed"),
-	props: StreamTargetTelemetryProps
+	name: Schema.Literal("movement_scan_checkpoint"),
+	props: MovementScanCheckpointProps
 });
 Schema.Struct({
-	name: Schema.Literal("withdrawal_requested"),
-	props: WithdrawalTargetTelemetryProps
-});
-Schema.Struct({
-	name: Schema.Literal("withdrawal_submitted"),
-	props: WithdrawalTargetTelemetryProps
-});
-Schema.Struct({
-	name: Schema.Literal("withdrawal_settled"),
-	props: WithdrawalTargetTelemetryProps
-});
-Schema.Struct({
-	name: Schema.Literal("withdrawal_failed"),
-	props: WithdrawalTargetTelemetryProps
+	name: Schema.Literal("movement_scan_incident"),
+	props: MovementScanIncidentProps
 });
 function redactTelemetryEvent(event, options = {}) {
 	const props = redactTelemetryProps(event.name, event.props, options);
@@ -3764,7 +4631,7 @@ function redactTelemetryEvent(event, options = {}) {
 }
 function redactTelemetryProps(name, props, options = {}) {
 	if (props === void 0) return void 0;
-	const clone = cloneProps(props);
+	const clone = cloneProps$1(props);
 	if (options.rawMode === true) return clone;
 	for (const key of PII_PROP_KEYS_BY_EVENT[name] ?? []) redactProperty(clone, key);
 	return clone;
@@ -3779,17 +4646,17 @@ function redactProperty(props, key) {
 	const value = props[key];
 	if (typeof value === "string") props[key] = sha256Hex(value).slice(0, 12);
 }
-function cloneProps(props) {
+function cloneProps$1(props) {
 	const cloned = {};
-	for (const [key, value] of Object.entries(props)) cloned[key] = cloneTelemetryValue(value);
+	for (const [key, value] of Object.entries(props)) cloned[key] = cloneTelemetryValue$1(value);
 	return cloned;
 }
-function cloneTelemetryValue(value) {
-	if (Array.isArray(value)) return value.map(cloneTelemetryValue);
+function cloneTelemetryValue$1(value) {
+	if (Array.isArray(value)) return value.map(cloneTelemetryValue$1);
 	if (value === null || typeof value !== "object") return value;
 	if (Object.getPrototypeOf(value) !== Object.prototype) return value;
 	const cloned = {};
-	for (const [key, nested] of Object.entries(value)) cloned[key] = cloneTelemetryValue(nested);
+	for (const [key, nested] of Object.entries(value)) cloned[key] = cloneTelemetryValue$1(nested);
 	return cloned;
 }
 const SHA256_INITIAL_HASH = [
@@ -3947,6 +4814,90 @@ function rotr(value, bits) {
 //#region src/ports/telemetry.ts
 var TelemetryPortTag = class extends Context.Service()("@capxul/sdk/ports/TelemetryPort") {};
 //#endregion
+//#region src/adapters/telemetry/PostHogTelemetryAdapter.ts
+var PostHogTelemetryAdapter = class {
+	#capture;
+	#identify;
+	#group;
+	#reset;
+	constructor(deps) {
+		this.#capture = deps.capture;
+		this.#identify = deps.identify ?? (() => void 0);
+		this.#group = deps.group ?? (() => void 0);
+		this.#reset = deps.reset ?? (() => void 0);
+	}
+	emit(event) {
+		return this.#run(() => this.#capture(event.name, redactTelemetryProps(event.name, cloneProps(event.props)), event), "emit", event.name);
+	}
+	identify(input) {
+		return this.#run(() => this.#identify(cloneIdentifyInput(input)), "identify");
+	}
+	group(input) {
+		return this.#run(() => this.#group(cloneGroupInput(input)), "group");
+	}
+	reset() {
+		return this.#run(() => this.#reset(), "reset");
+	}
+	#run(operation, operationName, eventName) {
+		const diagnose = Effect.logWarning("product.telemetry.transport.dropped").pipe(Effect.annotateLogs({
+			operation: operationName,
+			...eventName === void 0 ? {} : { product_event: eventName }
+		}), Effect.catchCause(() => Effect.void));
+		return Effect.suspend(() => {
+			let pending;
+			try {
+				pending = operation();
+			} catch {
+				return diagnose;
+			}
+			if (pending === void 0) return Effect.void;
+			const transport = Effect.tryPromise({
+				try: () => pending,
+				catch: () => void 0
+			}).pipe(Effect.catch(() => diagnose));
+			return Effect.forkDetach(transport, { startImmediately: true }).pipe(Effect.asVoid);
+		});
+	}
+};
+function PostHogTelemetryLayer(deps) {
+	return Layer.succeed(TelemetryPortTag, new PostHogTelemetryAdapter(deps));
+}
+function cloneIdentifyInput(input) {
+	const traits = input.traits === void 0 ? void 0 : cloneProps(input.traits);
+	const properties = input.properties === void 0 ? void 0 : cloneProps(input.properties);
+	return {
+		distinctId: input.distinctId,
+		...input.anonDistinctId === void 0 ? {} : { anonDistinctId: input.anonDistinctId },
+		...traits === void 0 ? {} : { traits },
+		...properties === void 0 ? {} : { properties }
+	};
+}
+function cloneGroupInput(input) {
+	const properties = input.properties === void 0 ? void 0 : cloneProps(input.properties);
+	return properties === void 0 ? {
+		groupType: input.groupType,
+		groupKey: input.groupKey
+	} : {
+		groupType: input.groupType,
+		groupKey: input.groupKey,
+		properties
+	};
+}
+function cloneProps(props) {
+	if (props === void 0) return void 0;
+	const cloned = {};
+	for (const [key, value] of Object.entries(props)) cloned[key] = cloneTelemetryValue(value);
+	return cloned;
+}
+function cloneTelemetryValue(value) {
+	if (Array.isArray(value)) return value.map(cloneTelemetryValue);
+	if (value === null || typeof value !== "object") return value;
+	if (Object.getPrototypeOf(value) !== Object.prototype) return value;
+	const cloned = {};
+	for (const [key, nested] of Object.entries(value)) cloned[key] = cloneTelemetryValue(nested);
+	return cloned;
+}
+//#endregion
 //#region src/flows/identity.ts
 const IDENTITY_SLOT = {
 	session: "identity:session",
@@ -4056,7 +5007,8 @@ const accountLane = (input, config, session, send) => Effect.gen(function* () {
 	if (Result.isFailure(existing)) return yield* failAt("provision", existing.failure);
 	const provisioned = yield* Effect.result(existing.success === null ? call("smart-account.provision", input.ports.smartAccount.provision({
 		authUserId: toAuthUserId(session.authUserId),
-		chainId: toChainId(input.chainId)
+		chainId: toChainId(input.chainId),
+		email: toEmail(session.email)
 	})) : Effect.succeed(existing.success));
 	if (Result.isFailure(provisioned)) return yield* failAt("provision", provisioned.failure);
 	const account = provisioned.success;
@@ -4288,7 +5240,7 @@ const identitySpec = (input, sessionStore = { current: null }) => {
 				case "RequestOtp": return {
 					slot: IDENTITY_SLOT.auth,
 					port: "auth-client",
-					run: (send) => call("auth-client.send-otp", input.ports.authClient.sendOtp({ email: toEmail(event.email) })).pipe(Effect.andThen(call("clock.now", input.ports.clock.now)), Effect.flatMap((at) => send({
+					run: (send, controls) => call("auth-client.send-otp", input.ports.authClient.sendOtp(copyInvocationObservation(controls, { email: toEmail(event.email) }))).pipe(Effect.andThen(call("clock.now", input.ports.clock.now)), Effect.flatMap((at) => send({
 						_tag: "OtpSent",
 						at
 					})), Effect.catch((failure) => send({
@@ -4299,10 +5251,10 @@ const identitySpec = (input, sessionStore = { current: null }) => {
 				case "VerifyOtp": return {
 					slot: IDENTITY_SLOT.auth,
 					port: "auth-client",
-					run: (send) => call("auth-client.verify-otp", input.ports.authClient.verifyOtp({
+					run: (send, controls) => call("auth-client.verify-otp", input.ports.authClient.verifyOtp(copyInvocationObservation(controls, {
 						email: toEmail(event.email),
 						otp: event.otp
-					})).pipe(Effect.tap((session) => Effect.sync(() => {
+					}))).pipe(Effect.tap((session) => Effect.sync(() => {
 						sessionStore.current = session;
 					})), Effect.flatMap((session) => sessionProfile(input, session).pipe(Effect.flatMap((loaded) => send({
 						_tag: "Verified",
@@ -4316,7 +5268,7 @@ const identitySpec = (input, sessionStore = { current: null }) => {
 				case "ReadSession": return {
 					slot: IDENTITY_SLOT.session,
 					port: "auth-client",
-					run: (send) => call("auth-client.get-session", input.ports.authClient.getSession()).pipe(Effect.tap((session) => Effect.sync(() => {
+					run: (send, controls) => call("auth-client.get-session", input.ports.authClient.getSession(copyInvocationObservation(controls, {}))).pipe(Effect.tap((session) => Effect.sync(() => {
 						sessionStore.current = session;
 					})), Effect.flatMap((session) => sessionProfile(input, session)), Effect.flatMap((loaded) => send({
 						_tag: "SessionRead",
@@ -4331,7 +5283,7 @@ const identitySpec = (input, sessionStore = { current: null }) => {
 				case "SignOut": return {
 					slot: IDENTITY_SLOT.auth,
 					port: "auth-client",
-					run: (send) => call("auth-client.sign-out", input.ports.authClient.signOut()).pipe(Effect.andThen(send({ _tag: "SignedOut" })), Effect.catch((failure) => send({
+					run: (send, controls) => call("auth-client.sign-out", input.ports.authClient.signOut(copyInvocationObservation(controls, {}))).pipe(Effect.andThen(send({ _tag: "SignedOut" })), Effect.catch((failure) => send({
 						_tag: "SignOutFailed",
 						failure
 					}).pipe(Effect.andThen(Effect.fail(failure)))), Effect.ensuring(Effect.sync(() => {
@@ -4706,7 +5658,8 @@ function provisionSmartAccountProgram() {
 		if (session === null) return yield* Effect.fail(Errors.notAuthenticated());
 		const provisioned = yield* deps.smartAccountPort.provision({
 			authUserId: session.authUserId,
-			chainId: deps.chainId
+			chainId: deps.chainId,
+			email: session.email
 		}).pipe(Effect.mapError((failure) => failure.publicError));
 		yield* Effect.promise(() => emitProvisioningTelemetry(deps.telemetry, provisioned));
 		return provisioned;
@@ -4792,11 +5745,6 @@ function makeIdentityMethods(deps) {
 function moneyToWeiAmount(money) {
 	return toWei(money);
 }
-function transferDirection(from, to) {
-	if (from === "main") return "add";
-	if (to === "main") return "out";
-	return "between";
-}
 /** Fire-and-forget emit through an optional port; never throws. */
 async function emitMoneyTelemetry(telemetry, event) {
 	if (telemetry === void 0) return;
@@ -4830,52 +5778,18 @@ function emitAccountBalanceFailed(telemetry, reason) {
 		props: { reason }
 	});
 }
-function emitTransferRequested(telemetry, input) {
-	let amount;
-	try {
-		amount = moneyToWeiAmount(input.amount);
-	} catch (cause) {
-		reportMoneyTelemetryFailure("defect", "transfer_requested", cause);
-		return Promise.resolve();
-	}
-	return emitMoneyTelemetry(telemetry, {
-		name: "transfer_requested",
-		props: {
-			amount,
-			direction: transferDirection(input.from, input.to)
-		}
-	});
-}
-function emitTransferFailed(telemetry, reason) {
-	return emitMoneyTelemetry(telemetry, {
-		name: "transfer_failed",
-		props: { reason }
-	});
-}
-function emitSubAccountCreated(telemetry, subAccountId) {
-	return emitMoneyTelemetry(telemetry, {
-		name: "subaccount_created",
-		props: { sub_account_id: subAccountId }
-	});
-}
-function emitSubAccountRenamed(telemetry, subAccountId) {
-	return emitMoneyTelemetry(telemetry, {
-		name: "subaccount_renamed",
-		props: { sub_account_id: subAccountId }
-	});
-}
-function emitSubAccountDeleted(telemetry, subAccountId) {
+function emitDepositInitiated(telemetry) {
 	return emitMoneyTelemetry(telemetry, {
-		name: "subaccount_deleted",
-		props: { sub_account_id: subAccountId }
+		name: "deposit_initiated",
+		props: {}
 	});
 }
-function emitSubAccountOpFailed(telemetry, op, reason) {
+function emitPaymentInitiated(telemetry, input) {
 	return emitMoneyTelemetry(telemetry, {
-		name: "subaccount_op_failed",
+		name: "payment_initiated",
 		props: {
-			op,
-			reason
+			kind: input.kind,
+			payment_id: input.paymentId
 		}
 	});
 }
@@ -5009,23 +5923,160 @@ const financialOpsContract = {
 	addDestination: makeFunctionReference(CAPXUL_FUNCTIONS["financialOps/destinations"].add),
 	listDestinations: makeFunctionReference(CAPXUL_FUNCTIONS["financialOps/destinations"].list),
 	removeDestination: makeFunctionReference(CAPXUL_FUNCTIONS["financialOps/destinations"].remove),
-	pay: makeFunctionReference(CAPXUL_FUNCTIONS["financialOps/mutations"].pay),
-	payout: makeFunctionReference(CAPXUL_FUNCTIONS["financialOps/destinations"].payout),
-	withdraw: makeFunctionReference(CAPXUL_FUNCTIONS["financialOps/mutations"].withdraw),
-	markPaymentSettled: makeFunctionReference(CAPXUL_FUNCTIONS["financialOps/actions"].markPaymentSettled),
-	markWithdrawalSettled: makeFunctionReference(CAPXUL_FUNCTIONS["financialOps/actions"].markWithdrawalSettled),
-	recordOrgPayment: makeFunctionReference(CAPXUL_FUNCTIONS["financialOps/actions"].recordOrgPayment),
-	markCommitmentCreated: makeFunctionReference(CAPXUL_FUNCTIONS["financialOps/actions"].markCommitmentCreated),
-	claimCommitment: makeFunctionReference(CAPXUL_FUNCTIONS["financialOps/actions"].claimCommitment),
-	cancelCommitment: makeFunctionReference(CAPXUL_FUNCTIONS["financialOps/actions"].cancelCommitment),
-	redirectCommitment: makeFunctionReference(CAPXUL_FUNCTIONS["financialOps/actions"].redirectCommitment),
 	listPayments: makeFunctionReference(CAPXUL_FUNCTIONS["financialOps/queries"].listPayments),
 	getPayment: makeFunctionReference(CAPXUL_FUNCTIONS["financialOps/queries"].getPayment),
+	activityList: makeFunctionReference(CAPXUL_FUNCTIONS["movement/activity"].list),
+	activityGet: makeFunctionReference(CAPXUL_FUNCTIONS["movement/activity"].get),
+	activityAnnotate: makeFunctionReference(CAPXUL_FUNCTIONS["movement/activity"].annotate),
 	verifyPaymentDocument: makeFunctionReference(CAPXUL_FUNCTIONS["financialOps/queries"].verifyPaymentDocument),
-	renderStoredDocument: makeFunctionReference(CAPXUL_FUNCTIONS["financialOps/queries"].renderStoredDocument),
-	getCommitmentRef: makeFunctionReference(CAPXUL_FUNCTIONS["financialOps/queries"].getCommitmentRef)
+	renderStoredDocument: makeFunctionReference(CAPXUL_FUNCTIONS["financialOps/queries"].renderStoredDocument)
 };
 //#endregion
+//#region src/contract/money-execution.ts
+const moneyExecutionContract = {
+	preparePermissionExecution: makeFunctionReference(CAPXUL_FUNCTIONS["moneyExecution/actions"].preparePermissionExecution),
+	preparePaymentExecution: makeFunctionReference(CAPXUL_FUNCTIONS["moneyExecution/actions"].preparePaymentExecution),
+	prepareOrganizationPaymentExecution: makeFunctionReference(CAPXUL_FUNCTIONS["moneyExecution/paymentCommandActions"].prepareOrganizationPaymentExecution),
+	preparePaymentLifecycleExecution: makeFunctionReference(CAPXUL_FUNCTIONS["moneyExecution/paymentCommandActions"].preparePaymentLifecycleExecution),
+	submitPaymentExecution: makeFunctionReference(CAPXUL_FUNCTIONS["moneyExecution/actions"].submitPaymentExecution),
+	submitPermissionExecution: makeFunctionReference(CAPXUL_FUNCTIONS["moneyExecution/actions"].submitPermissionExecution),
+	submitPaymentCommandExecution: makeFunctionReference(CAPXUL_FUNCTIONS["moneyExecution/paymentCommandActions"].submitPaymentCommandExecution)
+};
+//#endregion
+//#region src/surface/payment-execution.ts
+function mismatch(field, message) {
+	return {
+		ok: false,
+		error: Errors.invalidInput(field, message)
+	};
+}
+function cancelled(operation) {
+	return {
+		ok: false,
+		error: Errors.cancelled({ operation })
+	};
+}
+function isAborted$2(signal) {
+	return signal?.aborted === true;
+}
+async function signerCall(operation, run) {
+	try {
+		return {
+			ok: true,
+			value: await run()
+		};
+	} catch (cause) {
+		return {
+			ok: false,
+			error: cause instanceof CapxulError ? cause : Errors.providerError("wallet-signer", operation, cause)
+		};
+	}
+}
+async function executePersonalPayment(deps, payment, signal, requestKey) {
+	if (isAborted$2(signal)) return cancelled("payments.pay");
+	if (deps.signer === void 0) return mismatch("signer", "payments.pay requires a configured CapxulSigner");
+	const session = deps.actor.authSession();
+	if (session === null) return {
+		ok: false,
+		error: Errors.notAuthenticated()
+	};
+	const signerAddress = await signerCall("getAddress", () => deps.signer.getAddress());
+	if (!signerAddress.ok) return signerAddress;
+	const expectedSafe = deriveCapxulSafeAddress({ email: session.email });
+	const resolvedRequestKey = requestKey ?? `pay_${crypto.randomUUID()}`;
+	const prepared = await runIfActive(signal, "payments.prepareExecution", () => deps.convexCall.action(deps.functions.preparePaymentExecution, { input: {
+		requestKey: resolvedRequestKey,
+		signerAddress: signerAddress.value,
+		payment
+	} }));
+	if (!prepared.ok) return prepared;
+	if (prepared.value.requestKey !== resolvedRequestKey || JSON.stringify(prepared.value.payment) !== JSON.stringify(payment)) return mismatch("payment", "prepared Payment execution uses another request");
+	if (prepared.value.chainId !== deps.chainId) return mismatch("chainId", "prepared Payment execution uses another chain");
+	if (prepared.value.signerAddress.toLowerCase() !== signerAddress.value.toLowerCase()) return mismatch("signerAddress", "prepared Payment execution uses another signer");
+	if (prepared.value.userOpSenderSafe.toLowerCase() !== expectedSafe.toLowerCase()) return mismatch("userOpSenderSafe", "prepared Payment execution uses another Account Safe");
+	if (prepared.value.emitPaymentInitiated) await emitPaymentInitiated(deps.telemetry, {
+		kind: prepared.value.purposeKind,
+		paymentId: prepared.value.paymentId
+	});
+	if (isAborted$2(signal)) return cancelled("payments.pay");
+	const signature = await signerCall("signUserOpHash", () => deps.signer.signUserOpHash(prepared.value.digest));
+	if (!signature.ok) return signature;
+	if (isAborted$2(signal)) return cancelled("payments.pay");
+	return runIfActive(void 0, "payments.submitExecution", () => deps.convexCall.action(deps.functions.submitPaymentExecution, { input: {
+		executionId: prepared.value.executionId,
+		signature: signature.value
+	} }));
+}
+//#endregion
+//#region src/surface/payment-command-execution.ts
+function isAborted$1(signal) {
+	return signal?.aborted === true;
+}
+function signerFailure(operation, cause) {
+	return {
+		ok: false,
+		error: cause instanceof CapxulError ? cause : Errors.providerError("wallet-signer", operation, cause)
+	};
+}
+async function executePrepared(deps, prepare, expectedRequest, signal) {
+	if (isAborted$1(signal)) return {
+		ok: false,
+		error: Errors.cancelled({ operation: "payments" })
+	};
+	const session = deps.actor.authSession();
+	if (session === null) return {
+		ok: false,
+		error: Errors.notAuthenticated()
+	};
+	let signerAddress;
+	try {
+		signerAddress = await deps.signer.getAddress();
+	} catch (cause) {
+		return signerFailure("getAddress", cause);
+	}
+	const prepared = await prepare(signerAddress);
+	if (!prepared.ok) return prepared;
+	if (JSON.stringify(prepared.value.request) !== JSON.stringify(expectedRequest)) return {
+		ok: false,
+		error: Errors.invalidInput("payment", "prepared command mismatch")
+	};
+	const expectedSafe = deriveCapxulSafeAddress({ email: session.email });
+	if (prepared.value.chainId !== deps.chainId || prepared.value.signerAddress.toLowerCase() !== signerAddress.toLowerCase() || prepared.value.userOpSenderSafe.toLowerCase() !== expectedSafe.toLowerCase()) return {
+		ok: false,
+		error: Errors.invalidInput("payment", "prepared authority mismatch")
+	};
+	if (isAborted$1(signal)) return {
+		ok: false,
+		error: Errors.cancelled({ operation: "payments" })
+	};
+	let signature;
+	try {
+		signature = await deps.signer.signUserOpHash(prepared.value.digest);
+	} catch (cause) {
+		return signerFailure("signUserOpHash", cause);
+	}
+	if (isAborted$1(signal)) return {
+		ok: false,
+		error: Errors.cancelled({ operation: "payments" })
+	};
+	return runIfActive(void 0, "payments.submitCommandExecution", () => deps.convexCall.action(deps.functions.submitPaymentCommandExecution, { input: {
+		executionId: prepared.value.executionId,
+		signature
+	} }));
+}
+function executePaymentLifecycle(deps, intent, signal) {
+	return executePrepared(deps, (signerAddress) => runIfActive(signal, "payments.prepareLifecycleExecution", () => deps.convexCall.action(deps.functions.preparePaymentLifecycleExecution, { input: {
+		signerAddress,
+		intent
+	} })), intent, signal);
+}
+function executeOrganizationPayment(deps, input, signal) {
+	return executePrepared(deps, (signerAddress) => runIfActive(signal, "organizationPayments.prepareExecution", () => deps.convexCall.action(deps.functions.prepareOrganizationPaymentExecution, { input: {
+		...input,
+		signerAddress
+	} })), input, signal);
+}
+//#endregion
 //#region src/surface/money.ts
 function actorReferenceToBackend(actor) {
 	if (actor === void 0) return void 0;
@@ -5039,12 +6090,74 @@ function actorReferenceToBackend(actor) {
 		case "org": return actor;
 	}
 }
+function paymentExecutionIntent(input) {
+	if (actorReferenceToBackend(input.actor)?.kind === "org") return {
+		ok: false,
+		error: Errors.notImplemented("payments", "pay.organizationActor")
+	};
+	const to = normalizeTargetForBackend(input.to, "to");
+	if (!to.ok) return to;
+	return {
+		ok: true,
+		value: {
+			to: to.value,
+			amount: input.amount,
+			...input.paymentType === void 0 ? {} : { paymentType: input.paymentType },
+			...input.document === void 0 ? {} : { document: input.document },
+			...input.timing === void 0 ? {} : { timing: input.timing },
+			...input.lineItems === void 0 ? {} : { lineItems: input.lineItems }
+		}
+	};
+}
 function makeFinancialOpsMethods(deps) {
 	const fns = deps.functions ?? financialOpsContract;
+	const executionFns = deps.moneyExecutionFunctions ?? moneyExecutionContract;
+	const pay = async (input, options) => {
+		if (options?.signal?.aborted === true) return {
+			ok: false,
+			error: Errors.cancelled({ operation: "payments.pay" })
+		};
+		const payment = paymentExecutionIntent(input);
+		if (!payment.ok) return payment;
+		if (deps.actor === void 0 || deps.chainId === void 0) return {
+			ok: false,
+			error: Errors.notImplemented("payments", "executionComposition")
+		};
+		return mapOk(await executePersonalPayment({
+			actor: deps.actor,
+			chainId: deps.chainId,
+			convexCall: deps.convexCall,
+			functions: executionFns,
+			...deps.signer === void 0 ? {} : { signer: deps.signer },
+			...deps.telemetry === void 0 ? {} : { telemetry: deps.telemetry }
+		}, payment.value, options?.signal, input.requestKey), (submitted) => normalizePaymentTiming(submitted.payment));
+	};
+	const lifecycleDependencies = () => deps.actor === void 0 || deps.chainId === void 0 || deps.signer === void 0 ? {
+		ok: false,
+		error: Errors.notImplemented("payments", "executionComposition")
+	} : {
+		ok: true,
+		value: {
+			actor: deps.actor,
+			chainId: deps.chainId,
+			convexCall: deps.convexCall,
+			functions: executionFns,
+			signer: deps.signer
+		}
+	};
+	const runLifecycle = async (intent, signal) => {
+		const execution = lifecycleDependencies();
+		if (!execution.ok) return execution;
+		return mapOk(await executePaymentLifecycle(execution.value, intent, signal), (submitted) => {
+			const payment = submitted.payments[0];
+			if (payment === void 0 || submitted.payments.length !== 1) throw Errors.unknown();
+			return normalizePaymentTiming(payment);
+		});
+	};
 	return {
 		me: {
 			get: (options) => runIfActive(options?.signal, "me.get", () => deps.convexCall.query(fns.me, {})),
-			depositInstructions: (options) => runIfActive(options?.signal, "me.depositInstructions", () => deps.convexCall.query(fns.depositInstructions, {}))
+			depositInstructions: (options) => runIfActive(options?.signal, "me.depositInstructions", () => deps.convexCall.query(fns.depositInstructions, {}).pipe(Effect.tap(() => Effect.promise(() => emitDepositInitiated(deps.telemetry)))))
 		},
 		handles: { resolve: (handle, options) => runIfActive(options?.signal, "handles.resolve", () => deps.convexCall.query(fns.resolveHandle, { handle })) },
 		payees: {
@@ -5058,8 +6171,8 @@ function makeFinancialOpsMethods(deps) {
 		},
 		targets: { resolve: async (reference, options) => {
 			switch (reference.kind) {
-				case "handle": return mapOk$1(await runIfActive(options?.signal, "targets.resolve.handle", () => deps.convexCall.query(fns.resolveHandle, { handle: reference.handle })), (target) => resolvedTargetFromResolution(reference, target));
-				case "email": return mapOk$1(await runIfActive(options?.signal, "targets.resolve.email", () => deps.convexCall.query(fns.resolvePayee, { recipient: reference.email })), (target) => resolvedTargetFromResolution(reference, target));
+				case "handle": return mapOk(await runIfActive(options?.signal, "targets.resolve.handle", () => deps.convexCall.query(fns.resolveHandle, { handle: reference.handle })), (target) => resolvedTargetFromResolution(reference, target));
+				case "email": return mapOk(await runIfActive(options?.signal, "targets.resolve.email", () => deps.convexCall.query(fns.resolvePayee, { recipient: reference.email })), (target) => resolvedTargetFromResolution(reference, target));
 				case "organization": {
 					const resolved = await runIfActive(options?.signal, "targets.resolve.organization", () => deps.convexCall.query(fns.resolveHandle, { handle: reference.handle }));
 					if (!resolved.ok) return {
@@ -5109,7 +6222,7 @@ function makeFinancialOpsMethods(deps) {
 					error: Errors.invalidInput("target", DESTINATION_SCOPE_MESSAGE)
 				};
 				const backendActor = actorReferenceToBackend(input.actor);
-				return mapOk$1(await runIfActive(options?.signal, "destinations.add", () => deps.convexCall.mutation(fns.addDestination, {
+				return mapOk(await runIfActive(options?.signal, "destinations.add", () => deps.convexCall.mutation(fns.addDestination, {
 					...backendActor === void 0 ? {} : { actor: backendActor },
 					...isSelfTarget(scopeValue) ? { self: true } : { ref: scopeValue },
 					kind: destinationKindToBackend(input.kind),
@@ -5124,7 +6237,7 @@ function makeFinancialOpsMethods(deps) {
 					error: scope.error
 				};
 				const scopeValue = scope.value;
-				return mapOk$1(await runIfActive(options?.signal, "destinations.list", () => deps.convexCall.query(fns.listDestinations, {
+				return mapOk(await runIfActive(options?.signal, "destinations.list", () => deps.convexCall.query(fns.listDestinations, {
 					...input.actor === void 0 ? {} : { actor: actorReferenceToBackend(input.actor) },
 					...scopeValue !== void 0 && isSelfTarget(scopeValue) ? { self: true } : {},
 					...scopeValue !== void 0 && !isSelfTarget(scopeValue) ? { ref: scopeValue } : {}
@@ -5136,117 +6249,49 @@ function makeFinancialOpsMethods(deps) {
 			}))
 		},
 		payments: {
-			pay: async (input, options) => {
-				if (actorReferenceToBackend(input.actor)?.kind === "org") return {
-					ok: false,
-					error: Errors.notImplemented("payments", "pay.organizationActor")
-				};
-				const to = normalizeTargetForBackend(input.to, "to");
-				if (!to.ok) return {
-					ok: false,
-					error: to.error
-				};
-				return mapOk$1(await runIfActive(options?.signal, "payments.pay", () => deps.convexCall.mutation(fns.pay, {
-					to: to.value,
-					amount: input.amount,
-					...input.paymentType === void 0 ? {} : { paymentType: input.paymentType },
-					...input.document === void 0 ? {} : { document: input.document },
-					...input.timing === void 0 ? {} : { timing: input.timing },
-					...input.lineItems === void 0 ? {} : { lineItems: input.lineItems }
-				})), normalizePaymentTiming$1);
-			},
-			payout: async (input, options) => mapOk$1(await runIfActive(options?.signal, "payments.payout", () => deps.convexCall.mutation(fns.payout, {
-				...input.actor === void 0 ? {} : { actor: actorReferenceToBackend(input.actor) },
-				destinationId: input.destinationId,
-				amount: input.amount
-			})), normalizePaymentTiming$1),
-			withdraw: (input, options) => runIfActive(options?.signal, "payments.withdraw", () => deps.convexCall.mutation(fns.withdraw, {
-				to: input.to,
-				amount: input.amount,
-				document: input.document
-			})),
-			list: async (options) => mapOk$1(await runIfActive(options?.signal, "payments.list", () => deps.convexCall.query(fns.listPayments, {})), (payments) => payments.map(normalizePaymentTiming$1)),
-			get: async (paymentId, options) => mapOk$1(await runIfActive(options?.signal, "payments.get", () => deps.convexCall.query(fns.getPayment, { paymentId })), (payment) => payment === null ? null : normalizePaymentTiming$1(payment)),
-			cancel: (paymentId, options) => {
-				if (options?.signal?.aborted) return Promise.resolve({
-					ok: false,
-					error: Errors.cancelled({ operation: "payments.cancel" })
-				});
-				return Promise.resolve({
-					ok: false,
-					error: Errors.notImplemented("payments", "cancel")
-				});
-			},
-			_internal: {
-				markSettled: (input, options) => runIfActive(options?.signal, "payments.markSettled", () => deps.convexCall.action(fns.markPaymentSettled, {
-					paymentId: input.paymentId,
-					userOpHash: input.evidence.userOpHash,
-					txHash: input.evidence.txHash
-				})),
-				markWithdrawalSettled: (input, options) => runIfActive(options?.signal, "payments.markWithdrawalSettled", () => deps.convexCall.action(fns.markWithdrawalSettled, {
-					paymentId: input.paymentId,
-					userOpHash: input.evidence.userOpHash,
-					txHash: input.evidence.txHash
-				})),
-				recordOrgPayment: (input, options) => runIfActive(options?.signal, "payments.recordOrgPayment", () => deps.convexCall.action(fns.recordOrgPayment, {
-					orgId: input.orgId,
-					recipientLabel: input.recipientLabel,
-					...input.recipientKind === void 0 ? {} : { recipientKind: input.recipientKind },
-					...input.recipientRef === void 0 ? {} : { recipientRef: input.recipientRef },
-					...input.recipientPayeeId === void 0 ? {} : { recipientPayeeId: input.recipientPayeeId },
-					recipientSafeAddress: input.recipientSafeAddress,
-					amount: input.amount,
-					paymentType: input.paymentType,
-					...input.document === void 0 ? {} : { document: input.document },
-					orgSafeAddress: input.orgSafeAddress,
-					occurrenceIndex: input.occurrenceIndex,
-					userOpHash: input.evidence.userOpHash,
-					txHash: input.evidence.txHash
-				})),
-				markCommitmentCreated: (input, options) => runIfActive(options?.signal, "payments.markCommitmentCreated", () => deps.convexCall.action(fns.markCommitmentCreated, {
-					paymentId: input.paymentId,
-					onchainCommitmentId: input.onchainCommitmentId,
-					userOpHash: input.evidence.userOpHash,
-					txHash: input.evidence.txHash
-				})),
-				claim: (input, options) => runIfActive(options?.signal, "payments.claim", () => deps.convexCall.action(fns.claimCommitment, {
+			pay,
+			createCommitment: (input, options) => pay(input, options),
+			claim: (paymentId, options) => runLifecycle({
+				kind: "claim",
+				paymentId
+			}, options?.signal),
+			list: async (options) => mapOk(await runIfActive(options?.signal, "payments.list", () => deps.convexCall.query(fns.listPayments, {})), (payments) => payments.map(normalizePaymentTiming)),
+			get: async (paymentId, options) => mapOk(await runIfActive(options?.signal, "payments.get", () => deps.convexCall.query(fns.getPayment, { paymentId })), (payment) => payment === null ? null : normalizePaymentTiming(payment)),
+			cancel: (paymentId, options) => runLifecycle({
+				kind: "cancel",
+				paymentId
+			}, options?.signal),
+			redirect: async (input, options) => {
+				const recipient = normalizeTargetForBackend(input.to, "to");
+				if (!recipient.ok) return recipient;
+				return runLifecycle({
+					kind: "redirect",
 					paymentId: input.paymentId,
-					userOpHash: input.evidence.userOpHash,
-					txHash: input.evidence.txHash
-				})),
-				cancel: (input, options) => runIfActive(options?.signal, "payments.cancel", () => deps.convexCall.action(fns.cancelCommitment, {
-					paymentId: input.paymentId,
-					userOpHash: input.evidence.userOpHash,
-					txHash: input.evidence.txHash,
-					...input.document === void 0 ? {} : { document: input.document }
-				})),
-				redirect: async (input, options) => {
-					const to = normalizeRefForBackend(input.to, "to");
-					if (!to.ok) return {
-						ok: false,
-						error: to.error
-					};
-					return mapOk$1(await runIfActive(options?.signal, "payments.redirect", () => deps.convexCall.action(fns.redirectCommitment, {
-						paymentId: input.paymentId,
-						to: to.value,
-						userOpHash: input.evidence.userOpHash,
-						txHash: input.evidence.txHash,
-						...input.document === void 0 ? {} : { document: input.document }
-					})), normalizePaymentTiming$1);
-				},
-				commitmentRef: (paymentId, options) => runIfActive(options?.signal, "payments.commitmentRef", () => deps.convexCall.query(fns.getCommitmentRef, { paymentId }))
+					recipient: recipient.value
+				}, options?.signal);
 			}
 		},
-		activity: { list: (params, options) => {
-			if (options?.signal?.aborted) return Promise.resolve({
-				ok: false,
-				error: Errors.cancelled({ operation: "activity.list" })
-			});
-			return Promise.resolve({
-				ok: false,
-				error: Errors.notImplemented("activity", "list")
-			});
-		} },
+		activity: {
+			list: (params, options) => runIfActive(options?.signal, "activity.list", () => deps.convexCall.query(fns.activityList, { input: {
+				...params?.actor?.kind === "organization" ? { actor: {
+					kind: "organization",
+					orgId: params.actor.organizationId
+				} } : {},
+				...params?.cursor === void 0 ? {} : { cursor: params.cursor },
+				...params?.limit === void 0 ? {} : { limit: params.limit }
+			} })),
+			get: (reference, options) => runIfActive(options?.signal, "activity.get", () => deps.convexCall.query(fns.activityGet, { input: reference })),
+			annotate: (input, options) => runIfActive(options?.signal, "activity.annotate", () => deps.convexCall.mutation(fns.activityAnnotate, { input: {
+				...input.actor?.kind === "organization" ? { actor: {
+					kind: "organization",
+					orgId: input.actor.organizationId
+				} } : {},
+				movementId: input.movementId,
+				...input.counterpartyLabel === void 0 ? {} : { counterpartyLabel: input.counterpartyLabel },
+				...input.accountingCategory === void 0 ? {} : { accountingCategory: input.accountingCategory },
+				...input.memo === void 0 ? {} : { memo: input.memo }
+			} }))
+		},
 		offramp: {
 			quote: (input, options) => {
 				if (options?.signal?.aborted) return Promise.resolve({
@@ -5275,18 +6320,6 @@ function makeFinancialOpsMethods(deps) {
 		}
 	};
 }
-function refToRecipientString(ref) {
-	if (typeof ref === "string") throw Errors.invalidInput("to", "recipient must be a typed Ref variant");
-	if (typeof ref !== "object" || ref === null || !("kind" in ref)) throw Errors.invalidInput("to", "recipient must be a typed Ref variant");
-	switch (ref.kind) {
-		case "handle": return handleRefValue(ref.handle, "handle");
-		case "email": return nonEmptyRefValue(ref.email, "email");
-		case "orgHandle": return nonEmptyRefValue(ref.orgHandle, "orgHandle");
-		case "capxulUserId": return nonEmptyRefValue(ref.capxulUserId, "capxulUserId");
-		case "payeeId": return nonEmptyRefValue(ref.payeeId, "payeeId");
-		default: throw Errors.invalidInput("to", "recipient must be a known Ref variant");
-	}
-}
 function nonEmptyRefValue(value, field) {
 	const trimmed = value.trim();
 	if (trimmed.length === 0) throw Errors.invalidInput(field, "Ref value must be non-empty");
@@ -5534,14 +6567,14 @@ function normalizeRefForBackend(ref, field) {
 		};
 	}
 }
-function normalizePaymentTiming$1(payment) {
+function normalizePaymentTiming(payment) {
 	const { release: _release, ...rest } = payment;
 	return {
 		...rest,
 		timing: payment.timing ?? payment.release ?? { kind: "instant" }
 	};
 }
-function mapOk$1(result, f) {
+function mapOk(result, f) {
 	if (!result.ok) return result;
 	try {
 		return {
@@ -5614,120 +6647,157 @@ function makeSystemMethods(deps) {
 	return { health: (nonce, options) => runIfActive(options?.signal, "system.health", () => deps.convexCall.query(healthQuery, { nonce })) };
 }
 //#endregion
-//#region src/surface/sub-accounts-deps.ts
-var SubAccountsDepsTag = class extends Context.Service()("@capxul/sdk/SubAccountsDeps") {};
-function subAccountsDepsLayer(deps) {
-	return Layer.succeed(SubAccountsDepsTag, deps);
-}
-function createSubAccountProgram(accountId, name) {
-	return Effect.gen(function* () {
-		const deps = yield* SubAccountsDepsTag;
-		const created = yield* deps.subAccountPort.create({
-			accountId,
-			name
-		}).pipe(Effect.tapError((error) => Effect.promise(() => emitSubAccountOpFailed(deps.telemetry, "create", error.publicCode))), Effect.mapError((error) => error.publicError));
-		yield* Effect.promise(() => emitSubAccountCreated(deps.telemetry, created.id));
-		return created;
-	});
-}
-function getSubAccountProgram(subAccountId) {
-	return Effect.gen(function* () {
-		return yield* (yield* SubAccountsDepsTag).subAccountPort.get({ subAccountId }).pipe(Effect.mapError((error) => error.publicError));
-	});
-}
-function listSubAccountsProgram(accountId) {
-	return Effect.gen(function* () {
-		return yield* (yield* SubAccountsDepsTag).subAccountPort.list({ accountId }).pipe(Effect.mapError((error) => error.publicError));
-	});
-}
-function renameSubAccountProgram(subAccountId, name) {
-	return Effect.gen(function* () {
-		const deps = yield* SubAccountsDepsTag;
-		const renamed = yield* deps.subAccountPort.rename({
-			subAccountId,
-			name
-		}).pipe(Effect.tapError((error) => Effect.promise(() => emitSubAccountOpFailed(deps.telemetry, "rename", error.publicCode))), Effect.mapError((error) => error.publicError));
-		yield* Effect.promise(() => emitSubAccountRenamed(deps.telemetry, renamed.id));
-		return renamed;
-	});
+//#region src/contract/permission.ts
+const permissionContract = { read: makeFunctionReference(CAPXUL_FUNCTIONS["permission/queries"].read) };
+//#endregion
+//#region src/surface/permissions.ts
+function isAborted(signal) {
+	return signal?.aborted === true;
 }
-function deleteSubAccountProgram(subAccountId) {
-	return Effect.gen(function* () {
-		const deps = yield* SubAccountsDepsTag;
-		yield* deps.subAccountPort.delete({ subAccountId }).pipe(Effect.tapError((error) => Effect.promise(() => emitSubAccountOpFailed(deps.telemetry, "delete", error.publicCode))), Effect.mapError((error) => error.publicError));
-		yield* Effect.promise(() => emitSubAccountDeleted(deps.telemetry, subAccountId));
-	});
+function fail$1(cause, operation) {
+	return {
+		ok: false,
+		error: cause instanceof CapxulError ? cause : Errors.providerError("wallet-signer", operation, cause)
+	};
 }
-function transferSubAccountProgram(input) {
-	return Effect.gen(function* () {
-		const deps = yield* SubAccountsDepsTag;
-		yield* Effect.promise(() => emitTransferRequested(deps.telemetry, {
-			amount: input.amount,
-			from: input.from,
-			to: input.to
-		}));
-		return yield* deps.subAccountPort.transfer(input).pipe(Effect.tapError((error) => Effect.promise(() => emitTransferFailed(deps.telemetry, error.publicCode))), Effect.mapError((error) => error.publicError));
-	});
+async function execute(deps, orgId, command, signal) {
+	if (isAborted(signal)) return {
+		ok: false,
+		error: Errors.cancelled({ operation: "permissions" })
+	};
+	if (deps.actor === void 0 || deps.chainId === void 0 || deps.signer === void 0) return {
+		ok: false,
+		error: Errors.notImplemented("permissions", "executionComposition")
+	};
+	const session = deps.actor.authSession();
+	if (session === null) return {
+		ok: false,
+		error: Errors.notAuthenticated()
+	};
+	let signerAddress;
+	try {
+		signerAddress = await deps.signer.getAddress();
+	} catch (cause) {
+		return fail$1(cause, "getAddress");
+	}
+	const executionFns = deps.executionFunctions ?? moneyExecutionContract;
+	const prepared = await runIfActive(signal, "permissions.prepareExecution", () => deps.convexCall.action(executionFns.preparePermissionExecution, { input: {
+		orgId,
+		signerAddress,
+		command
+	} }));
+	if (!prepared.ok) return prepared;
+	const expectedSafe = deriveCapxulSafeAddress({ email: session.email });
+	if (prepared.value.chainId !== deps.chainId || prepared.value.signerAddress.toLowerCase() !== signerAddress.toLowerCase() || prepared.value.userOpSenderSafe.toLowerCase() !== expectedSafe.toLowerCase() || prepared.value.operation !== command.operation || prepared.value.orgId !== orgId || JSON.stringify(prepared.value.command) !== JSON.stringify(command)) return {
+		ok: false,
+		error: Errors.invalidInput("permission", "prepared authority mismatch")
+	};
+	if (isAborted(signal)) return {
+		ok: false,
+		error: Errors.cancelled({ operation: "permissions" })
+	};
+	let signature;
+	try {
+		signature = await deps.signer.signUserOpHash(prepared.value.digest);
+	} catch (cause) {
+		return fail$1(cause, "signUserOpHash");
+	}
+	if (isAborted(signal)) return {
+		ok: false,
+		error: Errors.cancelled({ operation: "permissions" })
+	};
+	return runIfActive(void 0, "permissions.submitExecution", () => deps.convexCall.action(executionFns.submitPermissionExecution, { input: {
+		executionId: prepared.value.executionId,
+		signature
+	} }));
 }
-//#endregion
-//#region src/surface/sub-accounts.ts
-function makeSubAccountsMethods(deps) {
-	const layer = subAccountsDepsLayer(deps);
+function makePermissionMethods(deps, orgId) {
+	const reads = deps.permissionFunctions ?? permissionContract;
 	return {
-		async create(accountId, input, options) {
-			if (options?.signal?.aborted) return {
-				ok: false,
-				error: Errors.cancelled({ operation: "subAccounts.create" })
-			};
-			return toCapxulResult(createSubAccountProgram(accountId, input.name), layer);
-		},
-		async get(subAccountId, options) {
-			if (options?.signal?.aborted) return {
-				ok: false,
-				error: Errors.cancelled({ operation: "subAccounts.get" })
-			};
-			return toCapxulResult(getSubAccountProgram(subAccountId), layer);
-		},
-		async list(accountId, options) {
-			if (options?.signal?.aborted) return {
-				ok: false,
-				error: Errors.cancelled({ operation: "subAccounts.list" })
-			};
-			return toCapxulResult(listSubAccountsProgram(accountId), layer);
-		},
-		async rename(subAccountId, name, options) {
-			if (options?.signal?.aborted) return {
-				ok: false,
-				error: Errors.cancelled({ operation: "subAccounts.rename" })
+		create: (input, options) => execute(deps, orgId, {
+			operation: "create",
+			...input
+		}, options?.signal),
+		change: (input, options) => execute(deps, orgId, {
+			operation: "change",
+			...input
+		}, options?.signal),
+		assign: (input, options) => execute(deps, orgId, {
+			operation: "assign",
+			...input
+		}, options?.signal),
+		revoke: (input, options) => execute(deps, orgId, {
+			operation: "revoke",
+			...input
+		}, options?.signal),
+		replace: (input, options) => execute(deps, orgId, {
+			operation: "replace",
+			...input
+		}, options?.signal),
+		list: (options) => runIfActive(options?.signal, "permissions.list", () => deps.convexCall.query(reads.read, { orgId })),
+		get: async (permissionId, options) => {
+			const listed = await runIfActive(options?.signal, "permissions.get", () => deps.convexCall.query(reads.read, { orgId }));
+			if (!listed.ok) return listed;
+			return {
+				ok: true,
+				value: listed.value.permissions.find((row) => row.permissionId === permissionId) ?? null
 			};
-			return toCapxulResult(renameSubAccountProgram(subAccountId, name), layer);
-		},
-		async delete(subAccountId, options) {
-			if (options?.signal?.aborted) return {
+		}
+	};
+}
+//#endregion
+//#region src/surface/organization-payments.ts
+function executionDependencies(input) {
+	return input.actor === void 0 || input.chainId === void 0 || input.signer === void 0 ? null : {
+		actor: input.actor,
+		chainId: input.chainId,
+		convexCall: input.convexCall,
+		functions: moneyExecutionContract,
+		signer: input.signer
+	};
+}
+function makeOrganizationPaymentsMethods(deps, orgId) {
+	const execute = async (input, signal) => {
+		const execution = executionDependencies(deps);
+		if (execution === null) return {
+			ok: false,
+			error: Errors.notImplemented("organizationPayments", "executionComposition")
+		};
+		const result = await executeOrganizationPayment(execution, {
+			orgId,
+			permissionId: input.permissionId,
+			requestKey: input.requestKey,
+			items: input.items,
+			...input.lineage === void 0 ? {} : { lineage: input.lineage }
+		}, signal);
+		return result.ok ? {
+			ok: true,
+			value: result.value.payments.map((payment) => normalizePaymentTiming(payment))
+		} : result;
+	};
+	return {
+		pay: async (input, options) => {
+			const { permissionId, requestKey, lineage, ...item } = input;
+			const result = await execute({
+				permissionId,
+				requestKey,
+				items: [item],
+				...lineage === void 0 ? {} : { lineage }
+			}, options?.signal);
+			if (!result.ok) return result;
+			const payment = result.value[0];
+			return payment === void 0 ? {
 				ok: false,
-				error: Errors.cancelled({ operation: "subAccounts.delete" })
+				error: Errors.unknown()
+			} : {
+				ok: true,
+				value: payment
 			};
-			return toCapxulResult(deleteSubAccountProgram(subAccountId), layer);
 		},
-		async transfer(input, options) {
-			if (options?.signal?.aborted) return {
-				ok: false,
-				error: Errors.cancelled({ operation: "subAccounts.transfer" })
-			};
-			return toCapxulResult(transferSubAccountProgram(input), layer);
-		}
+		payBatch: (input, options) => execute(input, options?.signal)
 	};
 }
 //#endregion
-//#region src/contract/payroll.ts
-const payrollContract = {
-	add: makeFunctionReference(CAPXUL_FUNCTIONS["financialOps/payrollRoster"].add),
-	list: makeFunctionReference(CAPXUL_FUNCTIONS["financialOps/payrollRoster"].list),
-	update: makeFunctionReference(CAPXUL_FUNCTIONS["financialOps/payrollRoster"].update),
-	remove: makeFunctionReference(CAPXUL_FUNCTIONS["financialOps/payrollRoster"].remove),
-	run: makeFunctionReference(CAPXUL_FUNCTIONS["financialOps/payrollRoster"].run)
-};
-//#endregion
 //#region src/surface/_shared/org-telemetry.ts
 /** Extract the domain from an email for telemetry (never the local part / PII). */
 function emailDomain$1(email) {
@@ -5823,59 +6893,11 @@ function isOrgTelemetryDebugEnabled() {
 	return globalThis.process?.env?.CAPXUL_DEBUG_TELEMETRY === "1";
 }
 //#endregion
-//#region src/domain/org/spend-gate.ts
-function evaluateSpendGate(input) {
-	if (!input.activeMember) return reject("not_member", Errors.invalidInput("member", "you are not an active member"));
-	if (!recipientAllowed(input.recipients, input.recipient)) return reject("invalid_recipient", Errors.invalidRecipient("recipient is not allowed by this role"));
-	if (!subAccountAllowed(input.subAccounts, input.subAccountId)) return reject("wrong_envelope", Errors.invalidInput("subAccountId", "sub-account not in scope for this role"));
-	const amount = parseRaw(input.amountRaw, "amountRaw");
-	const balance = parseRaw(input.subAccountBalanceRaw, "subAccountBalanceRaw");
-	if (amount > balance) return reject("insufficient_subaccount_balance", Errors.insufficientBalance(input.currency, balance.toString(10), amount.toString(10)));
-	const perTxCap = parseOptionalRaw(input.perTxCapRaw, "perTxCapRaw");
-	if (perTxCap !== null && amount > perTxCap) return reject("over_cap", Errors.insufficientBalance("role per-transaction cap", perTxCap.toString(10), amount.toString(10)));
-	const perDayCap = parseOptionalRaw(input.perDayCapRaw, "perDayCapRaw");
-	if (perDayCap !== null) {
-		const remaining = perDayCap - (parseOptionalRaw(input.spentTodayRaw, "spentTodayRaw") ?? 0n);
-		if (remaining < amount) return reject("daily_cap_exhausted", Errors.insufficientBalance("role daily cap", remaining.toString(10), amount.toString(10)));
-	}
-	return { ok: true };
-}
-function reject(reason, error) {
-	return {
-		ok: false,
-		reason,
-		error
-	};
-}
-function recipientAllowed(recipients, recipient) {
-	if (recipients === "anyone") return true;
-	const normalized = String(recipient).toLowerCase();
-	return recipients.some((allowed) => String(allowed).toLowerCase() === normalized);
-}
-function subAccountAllowed(scope, subAccountId) {
-	if (scope.scope === "all") return true;
-	return scope.subAccountIds.includes(subAccountId);
-}
-function parseOptionalRaw(value, field) {
-	if (value === null || value === void 0) return null;
-	return parseRaw(value, field);
-}
-function parseRaw(value, field) {
-	if (!/^[0-9]+$/.test(value)) throw Errors.invalidInput(field, "must be a non-negative integer string");
-	return BigInt(value);
-}
-//#endregion
 //#region src/surface/org-deps.ts
 var OrgDepsTag = class extends Context.Service()("@capxul/sdk/OrgDeps") {};
 function orgDepsLayer(deps) {
 	return Layer.succeed(OrgDepsTag, deps);
 }
-function isHermeticOrgDeps(deps) {
-	return deps.orgPort === void 0 && deps.orgRolesDeploymentPort === void 0 && deps.orgSpendPort === void 0;
-}
-function missingLiveOrgDep(portName) {
-	return Errors.invalidInput("orgDeps", `${portName} is required in live org mode`);
-}
 /** Zero `Money` in the USDX-backed display currency (a fresh Org's treasury). */
 function zeroMoney() {
 	return fromWei("0", 6, "USD");
@@ -5932,14 +6954,8 @@ function recipientsFromConfig(toRecipients) {
 	if (toRecipients === void 0 || toRecipients === "anyone") return toRecipients;
 	return toRecipients.map((recipient) => toAddress(recipient));
 }
-function subAccountsFromConfig(subAccounts) {
-	if (subAccounts === void 0) return void 0;
-	if (subAccounts.scope === "all") return { scope: "all" };
-	return { scope: subAccounts.scope.map((subAccountId) => toSubAccountId(subAccountId)) };
-}
 function roleDefinitionFromConfig(definition) {
 	const toRecipients = recipientsFromConfig(definition.spend?.toRecipients);
-	const subAccounts = subAccountsFromConfig(definition.subAccounts);
 	return {
 		label: definition.label,
 		...definition.spend === void 0 ? {} : { spend: {
@@ -5947,7 +6963,6 @@ function roleDefinitionFromConfig(definition) {
 			...definition.spend.perDay === void 0 ? {} : { perDay: moneyFromConfig(definition.spend.perDay) },
 			...toRecipients === void 0 ? {} : { toRecipients }
 		} },
-		...subAccounts === void 0 ? {} : { subAccounts },
 		...definition.canManageMembers === void 0 ? {} : { canManageMembers: definition.canManageMembers },
 		...definition.canManageRoles === void 0 ? {} : { canManageRoles: definition.canManageRoles }
 	};
@@ -5973,36 +6988,6 @@ function hermeticMember(input) {
 		revokeTxHash: input.revokeTxHash ?? null
 	};
 }
-function hermeticSpendAuthority(input) {
-	return {
-		activeMember: true,
-		subAccountBalanceRaw: "100000000000",
-		recipients: "anyone",
-		subAccounts: {
-			scope: "only",
-			subAccountIds: [input.from]
-		},
-		perTxCapRaw: "25000000000",
-		perDayCapRaw: "100000000000",
-		spentTodayRaw: "0",
-		role: "Finance Manager"
-	};
-}
-function spendGateInput(input) {
-	return {
-		activeMember: input.authority.activeMember,
-		subAccountId: input.spend.from,
-		subAccountBalanceRaw: input.authority.subAccountBalanceRaw,
-		amountRaw: input.amountRaw,
-		currency: input.currency,
-		recipient: input.spend.to,
-		recipients: input.authority.recipients,
-		subAccounts: input.authority.subAccounts,
-		...input.authority.perTxCapRaw === void 0 ? {} : { perTxCapRaw: input.authority.perTxCapRaw },
-		...input.authority.perDayCapRaw === void 0 ? {} : { perDayCapRaw: input.authority.perDayCapRaw },
-		...input.authority.spentTodayRaw === void 0 ? {} : { spentTodayRaw: input.authority.spentTodayRaw }
-	};
-}
 function createOrgProgram(input) {
 	return Effect.gen(function* () {
 		const deps = yield* OrgDepsTag;
@@ -6094,14 +7079,6 @@ function listRolesProgram(orgId) {
 		return startupRoleViews(orgId);
 	});
 }
-function deployRolesProgram(orgId) {
-	return Effect.gen(function* () {
-		const deps = yield* OrgDepsTag;
-		if (deps.orgRolesDeploymentPort !== void 0) return (yield* deps.orgRolesDeploymentPort.deployRoles({ orgId }).pipe(Effect.mapError((error) => error.publicError))).roles;
-		if (!isHermeticOrgDeps(deps)) return yield* Effect.fail(missingLiveOrgDep("orgRolesDeploymentPort"));
-		return startupRoleViews(orgId);
-	});
-}
 function listMembersProgram(orgId) {
 	return Effect.gen(function* () {
 		const deps = yield* OrgDepsTag;
@@ -6137,188 +7114,6 @@ function detectAndAcceptPendingInvitationsProgram() {
 		return { matched: [] };
 	});
 }
-function assignRoleProgram(orgId, input) {
-	return Effect.gen(function* () {
-		const deps = yield* OrgDepsTag;
-		if (deps.orgRolesDeploymentPort !== void 0) return yield* deps.orgRolesDeploymentPort.grantRole({
-			orgId,
-			input
-		}).pipe(Effect.mapError((error) => error.publicError));
-		if (!isHermeticOrgDeps(deps)) return yield* Effect.fail(missingLiveOrgDep("orgRolesDeploymentPort"));
-		return hermeticMember({
-			orgId,
-			email: "member@example.com",
-			role: input.role,
-			status: "active",
-			personalSafeAddress: input.memberSafeAddress,
-			grantTxHash: `0x${"0".repeat(64)}`
-		});
-	});
-}
-function removeMemberProgram(orgId, input) {
-	return Effect.gen(function* () {
-		const deps = yield* OrgDepsTag;
-		if (deps.orgRolesDeploymentPort !== void 0) return yield* deps.orgRolesDeploymentPort.revokeRole({
-			orgId,
-			input
-		}).pipe(Effect.mapError((error) => error.publicError));
-		if (!isHermeticOrgDeps(deps)) return yield* Effect.fail(missingLiveOrgDep("orgRolesDeploymentPort"));
-	});
-}
-/**
-* Build a leak-safe settled `Payment` for an org spend (G4 · #547). NO `txHash`
-* / userOp / Safe internals and NO raw recipient address ever reach this record
-* — only the validated recipient ref label + the committed `documentHash`.
-*/
-function leakSafeOrgPayment(input) {
-	const now = Date.now();
-	const id = `payment_${toHexSeed(`${input.orgId}:${input.to}:${input.amount.value}:${input.index}`)}`;
-	const money = {
-		currency: String(input.amount.currency),
-		value: input.amount.value,
-		decimals: input.amount.decimals
-	};
-	return {
-		id,
-		status: "settled",
-		amount: money,
-		paymentType: input.paymentType,
-		recipient: {
-			kind: "email",
-			label: input.to
-		},
-		documents: input.documentHash === void 0 ? [] : [{
-			documentHash: input.documentHash,
-			kind: input.paymentType === "payroll" ? "payslip" : "memo"
-		}],
-		timing: { kind: "instant" },
-		released: money,
-		availableToClaim: {
-			...money,
-			value: "0"
-		},
-		createdAt: now,
-		updatedAt: now
-	};
-}
-/** Resolve authority + run the spend gate for one org spend run (G4 · #547). */
-function gateOneRun(input) {
-	return Effect.gen(function* () {
-		const amountRaw = yield* Effect.try({
-			try: () => toWei(input.amount),
-			catch: (cause) => Errors.invalidInput("amount", cause instanceof Error ? cause.message : "invalid money")
-		});
-		const currency = String(input.amount.currency);
-		const spendShaped = {
-			from: input.from,
-			to: toAddress(`0x${"0".repeat(40)}`),
-			amount: input.amount
-		};
-		const authority = input.deps.orgSpendPort === void 0 ? hermeticSpendAuthority(spendShaped) : yield* input.deps.orgSpendPort.readSpendAuthority({
-			orgId: input.orgId,
-			input: spendShaped,
-			amountRaw
-		}).pipe(Effect.mapError((error) => error.publicError));
-		const accumulated = BigInt(input.accumulatedRaw ?? "0");
-		const baseGateInput = spendGateInput({
-			authority,
-			spend: spendShaped,
-			amountRaw,
-			currency
-		});
-		const decision = yield* Effect.try({
-			try: () => evaluateSpendGate({
-				...baseGateInput,
-				recipient: input.to,
-				subAccountBalanceRaw: subtractNonNegative(baseGateInput.subAccountBalanceRaw, accumulated),
-				spentTodayRaw: (BigInt(authority.spentTodayRaw ?? "0") + accumulated).toString(10)
-			}),
-			catch: (cause) => isCapxulError(cause) ? cause : Errors.unknown(cause)
-		});
-		if (!decision.ok) return yield* Effect.fail(decision.error);
-		return {
-			authority,
-			amountRaw
-		};
-	});
-}
-/** Subtract `delta` from a raw amount, flooring at zero (never negative). */
-function subtractNonNegative(raw, delta) {
-	const remaining = BigInt(raw) - delta;
-	return (remaining < 0n ? 0n : remaining).toString(10);
-}
-function spendViaPaymentsProgram(orgId, input) {
-	return Effect.gen(function* () {
-		const deps = yield* OrgDepsTag;
-		if (deps.orgSpendPort === void 0 && !isHermeticOrgDeps(deps)) return yield* Effect.fail(missingLiveOrgDep("orgSpendPort"));
-		const to = yield* Effect.try({
-			try: () => refToRecipientString(input.to),
-			catch: (cause) => isCapxulError(cause) ? cause : Errors.invalidInput("to", "invalid Ref")
-		});
-		const gated = yield* gateOneRun({
-			deps,
-			orgId,
-			from: input.from,
-			to,
-			amount: input.amount
-		});
-		const paymentType = input.paymentType ?? "unspecified";
-		if (deps.orgSpendPort?.submitSpendViaPayments !== void 0) return yield* deps.orgSpendPort.submitSpendViaPayments({
-			orgId,
-			input,
-			amountRaw: gated.amountRaw,
-			authority: gated.authority
-		}).pipe(Effect.mapError((error) => error.publicError));
-		return leakSafeOrgPayment({
-			orgId,
-			to,
-			amount: input.amount,
-			paymentType,
-			index: 0
-		});
-	});
-}
-function batchPayrollProgram(orgId, input) {
-	return Effect.gen(function* () {
-		const deps = yield* OrgDepsTag;
-		if (deps.orgSpendPort === void 0 && !isHermeticOrgDeps(deps)) return yield* Effect.fail(missingLiveOrgDep("orgSpendPort"));
-		if (input.runs.length === 0) return yield* Effect.fail(Errors.invalidInput("runs", "payroll batch must include at least one run"));
-		const gated = [];
-		const recipients = yield* Effect.try({
-			try: () => input.runs.map((run) => refToRecipientString(run.to)),
-			catch: (cause) => isCapxulError(cause) ? cause : Errors.invalidInput("to", "invalid Ref")
-		});
-		let accumulatedRaw = 0n;
-		for (const [index, run] of input.runs.entries()) {
-			const result = yield* gateOneRun({
-				deps,
-				orgId,
-				from: input.from,
-				to: recipients[index],
-				amount: run.amount,
-				accumulatedRaw: accumulatedRaw.toString(10)
-			});
-			accumulatedRaw += BigInt(result.amountRaw);
-			gated.push(result);
-		}
-		if (deps.orgSpendPort?.submitBatchPayroll !== void 0) return yield* deps.orgSpendPort.submitBatchPayroll({
-			orgId,
-			from: input.from,
-			runs: input.runs.map((run, index) => ({
-				run,
-				amountRaw: gated[index].amountRaw
-			})),
-			authorities: gated.map((g) => g.authority)
-		}).pipe(Effect.mapError((error) => error.publicError));
-		return input.runs.map((run, index) => leakSafeOrgPayment({
-			orgId,
-			to: recipients[index],
-			amount: run.amount,
-			paymentType: "payroll",
-			index
-		}));
-	});
-}
 function listOrgsProgram() {
 	return Effect.gen(function* () {
 		const deps = yield* OrgDepsTag;
@@ -6405,18 +7200,13 @@ function isRetryableOrganizationSetupFailure(error) {
 //#endregion
 //#region src/surface/org.ts
 /**
-* Org method surface (canon §C2/§C3, D13). S1 (#274) wires `createOrg` /
-* `orgs` / `treasury` to their Effect programs (`org-deps.ts`); the S2→S4
-* member/role/spend verbs stay `Errors.notImplemented("org", "<verb>")` until
-* their slices land. The entity-scoped bundle is constructed per `org(orgId)`
-* call (D13 — explicit scoping, no shared mutable "active org" state); the
-* closed-over `orgId` is the only entity reference.
+* Org method surface (canon §C2/§C3, D13). The entity-scoped bundle is
+* constructed for each `org(orgId)` call. It has no shared mutable active-Org
+* state. The closed-over `orgId` is its only entity reference.
 */
 function makeOrgMethods(deps) {
 	const layer = orgDepsLayer({
 		...deps.orgPort === void 0 ? {} : { orgPort: deps.orgPort },
-		...deps.orgRolesDeploymentPort === void 0 ? {} : { orgRolesDeploymentPort: deps.orgRolesDeploymentPort },
-		...deps.orgSpendPort === void 0 ? {} : { orgSpendPort: deps.orgSpendPort },
 		...deps.chainId === void 0 ? {} : { chainId: deps.chainId },
 		...deps.telemetry === void 0 ? {} : { telemetry: deps.telemetry }
 	});
@@ -6547,13 +7337,6 @@ function makeOrgMethods(deps) {
 					});
 					return toCapxulResult(listRolesProgram(orgId), layer);
 				},
-				deployRoles(_options) {
-					if (_options?.signal?.aborted) return Promise.resolve({
-						ok: false,
-						error: Errors.cancelled({ operation: "org.deployRoles" })
-					});
-					return toCapxulResult(deployRolesProgram(orgId), layer);
-				},
 				invite(_input, _options) {
 					if (_options?.signal?.aborted) return Promise.resolve({
 						ok: false,
@@ -6561,34 +7344,6 @@ function makeOrgMethods(deps) {
 					});
 					return toCapxulResult(inviteMemberProgram(orgId, _input), layer);
 				},
-				removeMember(_input, _options) {
-					if (_options?.signal?.aborted) return Promise.resolve({
-						ok: false,
-						error: Errors.cancelled({ operation: "org.removeMember" })
-					});
-					return toCapxulResult(removeMemberProgram(orgId, _input), layer);
-				},
-				assignRole(_input, _options) {
-					if (_options?.signal?.aborted) return Promise.resolve({
-						ok: false,
-						error: Errors.cancelled({ operation: "org.assignRole" })
-					});
-					return toCapxulResult(assignRoleProgram(orgId, _input), layer);
-				},
-				spendViaPayments(_input, _options) {
-					if (_options?.signal?.aborted) return Promise.resolve({
-						ok: false,
-						error: Errors.cancelled({ operation: "org.spendViaPayments" })
-					});
-					return toCapxulResult(spendViaPaymentsProgram(orgId, _input), layer);
-				},
-				batchPayroll(_input, _options) {
-					if (_options?.signal?.aborted) return Promise.resolve({
-						ok: false,
-						error: Errors.cancelled({ operation: "org.batchPayroll" })
-					});
-					return toCapxulResult(batchPayrollProgram(orgId, _input), layer);
-				},
 				auditLog(_options) {
 					if (_options?.signal?.aborted) return Promise.resolve({
 						ok: false,
@@ -6599,114 +7354,334 @@ function makeOrgMethods(deps) {
 						error: Errors.notImplemented("organizationAuditLog", "list")
 					});
 				},
-				payroll: convexCall === void 0 ? makeNotImplementedPayrollMethods() : makePayrollMethods({
-					orgId: String(orgId),
-					convexCall
-				})
+				permissions: convexCall === void 0 ? makeNotImplementedPermissionMethods() : makePermissionMethods({
+					convexCall,
+					...deps.actor === void 0 ? {} : { actor: deps.actor },
+					...deps.chainId === void 0 ? {} : { chainId: Number(deps.chainId) },
+					...deps.signer === void 0 ? {} : { signer: deps.signer }
+				}, String(orgId)),
+				payments: convexCall === void 0 ? makeNotImplementedOrganizationPaymentsMethods() : makeOrganizationPaymentsMethods({
+					convexCall,
+					...deps.actor === void 0 ? {} : { actor: deps.actor },
+					...deps.chainId === void 0 ? {} : { chainId: Number(deps.chainId) },
+					...deps.signer === void 0 ? {} : { signer: deps.signer }
+				}, String(orgId))
 			};
 		}
 	};
 }
-function makePayrollMethods(deps) {
-	const fns = payrollContract;
+function makeNotImplementedPermissionMethods() {
 	return {
-		roster: {
-			add: async (input, options) => {
-				const employee = normalizeRefForBackend$1(input.employee, "employee");
-				if (!employee.ok) return employee;
-				return mapOk(runIfActive(options?.signal, "payroll.roster.add", () => deps.convexCall.mutation(fns.add, {
-					orgId: deps.orgId,
-					employee: employee.value,
-					amount: input.amount,
-					timing: input.timing,
-					payslipTemplate: toPayrollTemplate(input.payslipTemplate)
-				})), mapPayrollRosterLine);
-			},
-			list: (options) => mapOk(runIfActive(options?.signal, "payroll.roster.list", () => deps.convexCall.query(fns.list, { orgId: deps.orgId })), (lines) => lines.map(mapPayrollRosterLine)),
-			update: async (rosterLineId, input, options) => {
-				const employee = input.employee === void 0 ? void 0 : normalizeRefForBackend$1(input.employee, "employee");
-				if (employee !== void 0 && !employee.ok) return employee;
-				return mapOk(runIfActive(options?.signal, "payroll.roster.update", () => deps.convexCall.mutation(fns.update, {
-					orgId: deps.orgId,
-					rosterLineId,
-					...employee === void 0 ? {} : { employee: employee.value },
-					...input.amount === void 0 ? {} : { amount: input.amount },
-					...input.timing === void 0 ? {} : { timing: input.timing },
-					...input.payslipTemplate === void 0 ? {} : { payslipTemplate: toPayrollTemplate(input.payslipTemplate) }
-				})), mapPayrollRosterLine);
-			},
-			remove: (rosterLineId, options) => mapOk(runIfActive(options?.signal, "payroll.roster.remove", () => deps.convexCall.mutation(fns.remove, {
-				orgId: deps.orgId,
-				rosterLineId
-			})), mapPayrollRosterLine)
-		},
-		run: (input, options) => mapOk(runIfActive(options?.signal, "payroll.run", () => deps.convexCall.mutation(fns.run, {
-			orgId: deps.orgId,
-			period: input.period,
-			from: String(input.from)
-		})), (run) => run.payments.map(normalizePaymentTiming))
+		create: permissionExecutionUnavailable,
+		change: permissionExecutionUnavailable,
+		assign: permissionExecutionUnavailable,
+		revoke: permissionExecutionUnavailable,
+		replace: permissionExecutionUnavailable,
+		list: permissionExecutionUnavailable,
+		get: permissionExecutionUnavailable
+	};
+}
+function makeNotImplementedOrganizationPaymentsMethods() {
+	return {
+		pay: organizationPaymentExecutionUnavailable,
+		payBatch: organizationPaymentExecutionUnavailable
 	};
 }
-function makeNotImplementedPayrollMethods() {
+const permissionExecutionUnavailable = () => Promise.resolve({
+	ok: false,
+	error: Errors.notImplemented("permissions", "executionComposition")
+});
+const organizationPaymentExecutionUnavailable = () => Promise.resolve({
+	ok: false,
+	error: Errors.notImplemented("organizationPayments", "executionComposition")
+});
+//#endregion
+//#region src/contract/holdings.ts
+const holdingsContract = { current: makeFunctionReference(CAPXUL_FUNCTIONS["holdings/actions"].current) };
+//#endregion
+//#region src/surface/holdings.ts
+function makeHoldingsMethods(deps) {
+	const functions = deps.functions ?? holdingsContract;
+	return { current: (input, options) => runIfActive(options?.signal, "holdings.current", () => deps.convexCall.action(functions.current, input?.actor?.kind === "organization" ? { actor: {
+		kind: "organization",
+		orgId: input.actor.organizationId
+	} } : {})) };
+}
+//#endregion
+//#region src/surface/factory.ts
+function detectAuthCacheAdapter() {
+	const globalAny = globalThis;
+	if (globalAny.window?.localStorage !== void 0) return new BrowserAuthCacheAdapter(globalAny.window.localStorage);
+	return new InMemoryAuthCacheAdapter();
+}
+//#endregion
+//#region src/observation.ts
+const SDK_VERSION = version;
+/** Stable PostHog event used for typed failures that are expected product outcomes. */
+const CAPXUL_SDK_EXPECTED_OUTCOME_EVENT = "capxul_sdk_expected_outcome";
+/**
+* Adapt the host's already-initialized PostHog-like client. This function does
+* not import, initialize, configure, or own PostHog.
+*/
+function postHogFailureObservation(policy, fixedSnapshot) {
+	const prepare = (failure) => {
+		const callStartSnapshot = readFailureInvocationSnapshot(failure) ?? fixedSnapshot;
+		const directSnapshot = callStartSnapshot === void 0 ? policy.snapshot() : void 0;
+		if (!(callStartSnapshot?.active ?? directSnapshot?.active) || policy.client === null || policy.client === void 0) return;
+		const safeFailure = sanitizeFailureObservation(failure);
+		return [safeFailure, postHogProperties(safeFailure, callStartSnapshot?.context ?? directSnapshot?.context)];
+	};
+	const captureOperationFailure = (failure) => {
+		const prepared = prepare(failure);
+		if (prepared === void 0 || policy.client === null || policy.client === void 0) return;
+		const [safeFailure, properties] = prepared;
+		if (classifyOperationOutcome(safeFailure.errorKind) === "expected") {
+			policy.deliver(() => policy.client.capture(CAPXUL_SDK_EXPECTED_OUTCOME_EVENT, {
+				...properties,
+				outcome_class: "expected"
+			}));
+			return;
+		}
+		policy.deliver(() => policy.client.capture("$exception", postHogExceptionProperties(safeFailure, properties)));
+	};
+	const captureException = (failure) => {
+		const prepared = prepare(failure);
+		if (prepared === void 0 || policy.client === null || policy.client === void 0) return;
+		const [safeFailure, properties] = prepared;
+		policy.deliver(() => policy.client.capture("$exception", postHogExceptionProperties(safeFailure, properties)));
+	};
 	return {
-		roster: {
-			add: () => missingConvexCall("payroll.roster.add"),
-			list: () => missingConvexCall("payroll.roster.list"),
-			update: () => missingConvexCall("payroll.roster.update"),
-			remove: () => missingConvexCall("payroll.roster.remove")
+		resolveContext: () => {
+			const snapshot = fixedSnapshot ?? policy.snapshot();
+			if (!snapshot.active) return void 0;
+			return snapshot.context ?? {};
 		},
-		run: () => missingConvexCall("payroll.run")
+		captureOperationFailure,
+		captureException
 	};
 }
-function missingConvexCall(operation) {
-	return Promise.resolve({
-		ok: false,
-		error: Errors.providerError("convex", operation, "ConvexCallPort is required")
+function classifyOperationOutcome(kind) {
+	return EXPECTED_OPERATION_OUTCOMES.has(kind) ? "expected" : "unexpected";
+}
+/** @internal Reports a factory-level typed failure without changing its identity. */
+function observeFailedResult(result, adapter, operation) {
+	if (adapter !== void 0 && isFailedResult(result)) report(adapter, "operation", operation, result.error, resolveAdapterContext(adapter));
+	return result;
+}
+function report(adapter, kind, operation, cause, invocationContext) {
+	const operationName = normalizeOperation(operation);
+	const kindName = normalizeErrorKind(errorKind(cause));
+	const context = sanitizeObservationContext({
+		...invocationContext,
+		...isCapxulError(cause) && cause.correlationId !== void 0 ? { correlationId: cause.correlationId } : {}
+	});
+	const failure = markFailureInvocationSnapshot({
+		exception: syntheticException(operationName, kindName),
+		sdkVersion: SDK_VERSION,
+		operation: operationName,
+		errorKind: kindName,
+		...context === void 0 ? {} : { context }
+	}, {
+		active: invocationContext !== void 0,
+		...context === void 0 ? {} : { context }
 	});
+	try {
+		ignoreDeliveryFailure(kind === "operation" ? adapter.captureOperationFailure(failure) : adapter.captureException(failure));
+	} catch {}
 }
-async function mapOk(resultOrPromise, f) {
-	const result = await resultOrPromise;
-	if (!result.ok) return result;
+function resolveAdapterContext(adapter) {
+	try {
+		return adapter.resolveContext?.();
+	} catch {
+		return;
+	}
+}
+function ignoreDeliveryFailure(delivery) {
+	if (!isPromiseLike(delivery)) return;
+	try {
+		Promise.resolve(delivery).catch(() => void 0);
+	} catch {}
+}
+/**
+* Map an ALREADY-sanitized observation context to the snake_case PostHog
+* property keys. Shared by the failure boundary here and the host
+* success-telemetry seam (`telemetry/from-posthog.ts`) so both attach identical
+* correlation fields from one definition.
+*/
+function observationContextProps(context) {
+	const props = {};
+	if (context?.application !== void 0) props.application = context.application;
+	if (context?.release !== void 0) props.release = context.release;
+	if (context?.sessionId !== void 0) props.session_id = context.sessionId;
+	if (context?.organizationId !== void 0) props.organization_id = context.organizationId;
+	if (context?.journeyId !== void 0) props.journey_id = context.journeyId;
+	if (context?.correlationId !== void 0) props.correlation_id = context.correlationId;
+	if (context?.anonymousId !== void 0) props.anonymous_id = context.anonymousId;
+	return props;
+}
+function postHogProperties(failure, context) {
+	const merged = sanitizeObservationContext({
+		...context,
+		...failure.context
+	});
 	return {
-		ok: true,
-		value: f(result.value)
+		sdk_version: failure.sdkVersion,
+		operation: failure.operation,
+		error_kind: failure.errorKind,
+		handled: true,
+		...observationContextProps(merged)
 	};
 }
-function mapPayrollRosterLine(line) {
+function postHogExceptionProperties(failure, properties) {
+	const filename = `capxul-sdk-observation://boundary/${failure.operation}`;
 	return {
-		id: line.id,
-		employee: line.employee,
-		amount: line.amount,
-		timing: line.timing,
-		status: line.status === "removed" ? "ended" : line.status
+		...properties,
+		$exception_type: failure.errorKind,
+		$exception_message: EXCEPTION_MESSAGE,
+		$exception_level: "error",
+		$exception_list: [{
+			type: failure.errorKind,
+			value: EXCEPTION_MESSAGE,
+			mechanism: {
+				type: "capxul_sdk_boundary",
+				handled: true,
+				synthetic: true
+			},
+			stacktrace: {
+				type: "raw",
+				frames: [{
+					platform: "javascript",
+					filename,
+					function: `CapxulSdkBoundary.${failure.operation}`,
+					lineno: 1,
+					colno: 1,
+					in_app: true
+				}]
+			}
+		}]
 	};
 }
-function toPayrollTemplate(document) {
-	if (document === void 0) return { title: "Payroll" };
-	if ("title" in document) return {
-		title: document.title,
-		...typeof document.memo === "string" ? { memo: document.memo } : {}
-	};
-	if (document.primaryType === "Payslip") return { title: `Payslip ${document.message.period}` };
-	if ("reference" in document.message) return {
-		title: document.primaryType,
-		memo: document.message.reference
-	};
-	return { title: document.primaryType };
+function errorKind(cause) {
+	try {
+		if (isCapxulError(cause)) return normalizeErrorKind(cause.code);
+		if (cause instanceof Error) return normalizeErrorKind(cause.name);
+		return "UnknownFailure";
+	} catch {
+		return "Error";
+	}
 }
-function normalizePaymentTiming(payment) {
-	const { release: _release, ...rest } = payment;
+function sanitizeFailureObservation(failure) {
+	const operation = normalizeOperation(failure.operation);
+	const kind = normalizeErrorKind(failure.errorKind);
+	const context = sanitizeObservationContext(failure.context);
 	return {
-		...rest,
-		timing: payment.timing ?? payment.release ?? { kind: "instant" }
+		exception: syntheticException(operation, kind),
+		sdkVersion: normalizeSdkVersion(failure.sdkVersion),
+		operation,
+		errorKind: kind,
+		...context === void 0 ? {} : { context }
 	};
 }
+function normalizeSdkVersion(value) {
+	return typeof value === "string" && /^[A-Za-z0-9][A-Za-z0-9.+_-]{0,127}$/u.test(value) ? value : "unknown";
+}
+function normalizeOperation(value) {
+	return typeof value === "string" && /^[A-Za-z0-9_][A-Za-z0-9_.-]{0,255}$/u.test(value) ? value : "unknown";
+}
+function normalizeErrorKind(value) {
+	return typeof value === "string" && /^[A-Za-z][A-Za-z0-9_.-]{0,63}$/u.test(value) ? value : "Error";
+}
+function syntheticException(operation, kind) {
+	const error = /* @__PURE__ */ new Error(EXCEPTION_MESSAGE);
+	error.name = kind;
+	error.stack = `${kind}: ${error.message}\n    at CapxulSdkBoundary.${operation} (capxul-sdk-observation://boundary/${operation}:1:1)`;
+	return error;
+}
+function isPromiseLike(value) {
+	return (typeof value === "object" || typeof value === "function") && value !== null && typeof value.then === "function";
+}
+function isPlainObject(value) {
+	if (typeof value !== "object" || value === null) return false;
+	const prototype = Object.getPrototypeOf(value);
+	return prototype === Object.prototype || prototype === null;
+}
+function isCapxulResult(value) {
+	return isPlainObject(value) && typeof value.ok === "boolean";
+}
+function isFailedResult(value) {
+	return isCapxulResult(value) && value.ok === false && "error" in value;
+}
 //#endregion
-//#region src/surface/factory.ts
-function detectAuthCacheAdapter() {
-	const globalAny = globalThis;
-	if (globalAny.window?.localStorage !== void 0) return new BrowserAuthCacheAdapter(globalAny.window.localStorage);
-	return new InMemoryAuthCacheAdapter();
+//#region src/telemetry/from-posthog.ts
+const PRODUCT_INVOCATION = Symbol("capxul.product-telemetry-invocation");
+/** @internal Bind paired emit/identify/reset work to one call-start snapshot. */
+function bindProductTelemetryInvocation(telemetry, source) {
+	return telemetry[PRODUCT_INVOCATION]?.(source) ?? telemetry;
+}
+/**
+* Drop props that must never cross to a host-owned external sink. Today that is
+* the `$exception` `details` blob: `captureException` serializes
+* `CapxulError.details` (e.g. `{ asset, available, required }`, `{ name }`,
+* `{ accountId }` — errors.ts) into it, and the shared redactor has no
+* `$exception` rule, so it is stripped here at the boundary (infra#1037). The
+* safe fields (error code, operation, failure_mode, the fixed leak-safe message,
+* stack frames) are preserved.
+*/
+function stripHostUnsafeProps(props) {
+	if (props === void 0) return void 0;
+	const { details: _details, ...safe } = props;
+	return safe;
+}
+/**
+* The subset of a posthog-js client the seam calls. `identify` / `group` /
+* `reset` are optional — a host that only wants event capture can omit them.
+*/
+/**
+* Adapt the host's already-initialized posthog-like client into a
+* `TelemetryPort` for the `telemetry` prop / input. This port SUPPLANTS the
+* SDK's no-op default telemetry sink (`production.ts` binds it via
+* `Layer.succeed`, not `compose` — there is no client-side success relay to
+* compose with); it is additive to Capxul's backend first-party record and
+* never owns the client.
+*/
+function postHogProductTelemetry(policy, fixedSnapshot) {
+	const telemetry = new PostHogTelemetryAdapter({
+		capture: (name, props, source) => {
+			const snapshot = readInvocationObservation(source) ?? fixedSnapshot ?? policy.snapshot();
+			if (!snapshot.active || policy.client === null || policy.client === void 0) return;
+			const event = stampTelemetryEnvelope({
+				name,
+				props
+			}, {
+				capxul_env: policy.capxulEnv,
+				producer: "sdk"
+			});
+			policy.deliver(() => policy.client.capture(name, {
+				...stripHostUnsafeProps(event.props),
+				...observationContextProps(snapshot.context)
+			}));
+		},
+		identify: (input) => {
+			if (!(fixedSnapshot ?? policy.snapshot()).active || policy.client?.identify === void 0) return;
+			policy.deliver(() => policy.client.identify(input.distinctId, {
+				...input.traits,
+				...input.properties
+			}));
+		},
+		group: (input) => {
+			if (!(fixedSnapshot ?? policy.snapshot()).active || policy.client?.group === void 0) return;
+			policy.deliver(() => policy.client.group(input.groupType, input.groupKey, input.properties === void 0 ? void 0 : { ...input.properties }));
+		},
+		reset: () => {
+			if (!(fixedSnapshot ?? policy.snapshot()).active || policy.client?.reset === void 0) return;
+			policy.deliver(() => policy.client.reset());
+		}
+	});
+	Object.defineProperty(telemetry, PRODUCT_INVOCATION, {
+		enumerable: false,
+		value: (source) => postHogProductTelemetry(policy, readInvocationObservation(source) ?? fixedSnapshot ?? policy.snapshot())
+	});
+	return telemetry;
 }
 //#endregion
 //#region src/telemetry/identity-product.ts
@@ -6791,13 +7766,15 @@ const ignoreTransportFailure = (operation, operationName, eventName) => Effect.s
 	product_event: eventName
 }), Effect.catchCause(() => Effect.void))));
 function executeIdentityProductObservation(telemetry, record, state) {
-	const observation = mapIdentityProductObservation(record, state);
-	if (observation === null) return Effect.void;
-	const after = () => observation.name === "auth_verified" && state.phase === "authenticated" ? telemetry.identify({
+	const mapped = mapIdentityProductObservation(record, state);
+	if (mapped === null) return Effect.void;
+	copyInvocationObservation(record, mapped);
+	const invocationTelemetry = bindProductTelemetryInvocation(telemetry, mapped);
+	const after = () => mapped.name === "auth_verified" && state.phase === "authenticated" ? invocationTelemetry.identify({
 		distinctId: state.session.authUserId,
 		traits: { email_domain: emailDomain(state.session.email) }
-	}) : observation.name === "auth_signed_out" ? telemetry.reset() : Effect.void;
-	return ignoreTransportFailure(() => telemetry.emit(observation), "emit", observation.name).pipe(Effect.andThen(ignoreTransportFailure(after, observation.name === "auth_signed_out" ? "reset" : "identify", observation.name)));
+	}) : mapped.name === "auth_signed_out" ? invocationTelemetry.reset() : Effect.void;
+	return ignoreTransportFailure(() => invocationTelemetry.emit(mapped), "emit", mapped.name).pipe(Effect.andThen(ignoreTransportFailure(after, mapped.name === "auth_signed_out" ? "reset" : "identify", mapped.name)));
 }
 //#endregion
 //#region src/surface/create-capxul-client.ts
@@ -6808,14 +7785,14 @@ function assembleCapxulClient(input) {
 		runPromise: Effect.runPromise
 	};
 	const scope = effectRunner.runSync(Scope.make());
-	const actor = effectRunner.runSync(Scope.provide(bootIdentityFlow({
+	const actor = withHostObservation(effectRunner.runSync(Scope.provide(bootIdentityFlow({
 		ports: input.ports,
 		chainId: input.bootstrap.chainId,
 		requirement: input.requirement,
 		...input.signer === void 0 ? {} : { signer: input.signer },
 		...input.organizationSetup === void 0 ? {} : { organizationSetup: input.organizationSetup },
 		...input.otpTtlMs === void 0 ? {} : { otpTtlMs: input.otpTtlMs }
-	}), scope));
+	}), scope)), input.hostObservationSnapshot);
 	const unsubscribeProductTelemetry = actor.subscribeTransitions((record) => {
 		effectRunner.runPromise(executeIdentityProductObservation(input.ports.telemetry, record, actor.snapshot())).catch(() => {});
 	});
@@ -6831,7 +7808,13 @@ function assembleCapxulClient(input) {
 	const selectedOrgPort = input.orgPort ?? input.orgDeploymentPort;
 	let detectPendingOrgInvitations;
 	let kickProvisioning;
-	const financialOps = makeFinancialOpsMethods({ convexCall: input.ports.convexCall });
+	const financialOps = makeFinancialOpsMethods({
+		actor,
+		chainId: input.bootstrap.chainId,
+		convexCall: input.ports.convexCall,
+		...input.signer === void 0 ? {} : { signer: input.signer },
+		telemetry: input.ports.telemetry
+	});
 	const accountBundle = makeAccountMethods({
 		actor,
 		authCache,
@@ -6876,22 +7859,19 @@ function assembleCapxulClient(input) {
 	});
 	const system = makeSystemMethods({ convexCall: input.ports.convexCall });
 	const media = makeMediaMethods({ convexCall: input.ports.convexCall });
+	const holdings = makeHoldingsMethods({ convexCall: input.ports.convexCall });
 	const accounts = makeAccountsMethods({
 		accountReadPort: input.ports.accountRead,
 		chainId: input.bootstrap.chainId,
 		telemetry: input.ports.telemetry
 	});
-	const subAccounts = makeSubAccountsMethods({
-		subAccountPort: input.ports.subAccount,
-		telemetry: input.ports.telemetry
-	});
 	const orgMethods = makeOrgMethods({
+		actor,
 		chainId: input.bootstrap.chainId,
 		telemetry: input.ports.telemetry,
 		...selectedOrgPort === void 0 ? {} : { orgPort: selectedOrgPort },
-		...input.orgRolesDeploymentPort === void 0 ? {} : { orgRolesDeploymentPort: input.orgRolesDeploymentPort },
-		...input.orgSpendPort === void 0 ? {} : { orgSpendPort: input.orgSpendPort },
 		convexCall: input.ports.convexCall,
+		...input.signer === void 0 ? {} : { signer: input.signer },
 		...input.organizationSetup === void 0 ? {} : { organizationSetup: input.organizationSetup }
 	});
 	if (selectedOrgPort !== void 0) detectPendingOrgInvitations = async () => {
@@ -6980,10 +7960,10 @@ function assembleCapxulClient(input) {
 		destinations: financialOps.destinations,
 		payments: financialOps.payments,
 		activity: financialOps.activity,
+		holdings,
 		offramp: financialOps.offramp,
 		paymentDocuments: financialOps.paymentDocuments,
 		media,
-		subAccounts,
 		createOrg: orgMethods.createOrg,
 		orgs: orgMethods.orgs,
 		org: orgMethods.org,
@@ -6997,7 +7977,19 @@ function assembleCapxulClient(input) {
 		}
 	};
 }
+function withHostObservation(actor, snapshot) {
+	if (snapshot === void 0) return actor;
+	const controls = (input) => {
+		const captured = snapshot();
+		const copied = { ...input };
+		return captured === void 0 ? copied : attachInvocationObservation(copied, captured);
+	};
+	return {
+		...actor,
+		ask: (event, input) => actor.ask(event, controls(input)),
+		tell: (event, input) => actor.tell(event, controls(input)),
+		restoreAuthSession: (session, input) => actor.restoreAuthSession(session, controls(input))
+	};
+}
 //#endregion
-export { OBSERVATION_CONTEXT_HEADER as A, normalizeBindingEmail as B, convexCallErrorFromCapxul as C, bootstrapErrorFromCapxul as D, BootstrapPortTag as E, isSettingUpLifecycle as F, deriveCapxulSafeAddress as H, formatTraceparent as I, EXCEPTION_MESSAGE as L, sanitizeObservationContext as M, CAPXUL_FUNCTIONS as N, authClientPortFromPromiseAdapter as O, BootstrapEnvelope as P, captureException as R, ConvexCallPortTag as S, ClockPortTag as T, destination as U, BASE_SEPOLIA_CHAIN_ID as V, identityErrorFromCapxul as _, redactTelemetryProps as a, markFailureInvocationSnapshot as b, smartAccountErrorFromCapxul as c, fromWei as d, AccountReadPortTag as f, IdentityPortTag as g, wireChainId as h, redactTelemetryEvent as i, encodeObservationContextHeader as j, AuthClientPortTag as k, SubAccountPortTag as l, toWei as m, detectAuthCacheAdapter as n, stampTelemetryEnvelope as o, accountReadErrorFromCapxul as p, TelemetryPortTag as r, SmartAccountPortTag as s, assembleCapxulClient as t, subAccountErrorFromCapxul as u, copyInvocationObservation as v, ClockError as w, readInvocationObservation as x, hasFailureInvocationSnapshot as y, captureExceptionSync as z };
-
-//# sourceMappingURL=create-capxul-client-DVzm78RU.mjs.map
+export { encodeObservationContextHeader as A, captureExceptionSync as B, ClockPortTag as C, AuthClientPortTag as D, authClientPortFromPromiseAdapter as E, isSettingUpLifecycle as F, destination as G, normalizeBindingEmail as H, formatTraceparent as I, copyInvocationObservation as L, CAPXUL_FUNCTIONS as M, BootstrapEnvelope as N, version as O, EngineeringTelemetryBootstrapPolicy as P, readInvocationObservation as R, ClockError as S, bootstrapErrorFromCapxul as T, BASE_SEPOLIA_CHAIN_ID as U, CAPXUL_PAYMENTS_V2_ADDRESS as V, deriveCapxulSafeAddress as W, wireChainId as _, observeFailedResult as a, ConvexCallPortTag as b, PostHogTelemetryLayer as c, SmartAccountPortTag as d, smartAccountErrorFromCapxul as f, toWei as g, accountReadErrorFromCapxul as h, observationContextProps as i, sanitizeObservationContext as j, OBSERVATION_CONTEXT_HEADER as k, TelemetryPortTag as l, AccountReadPortTag as m, postHogProductTelemetry as n, postHogFailureObservation as o, fromWei as p, CAPXUL_SDK_EXPECTED_OUTCOME_EVENT as r, detectAuthCacheAdapter as s, assembleCapxulClient as t, redactTelemetryEvent as u, IdentityPortTag as v, BootstrapPortTag as w, convexCallErrorFromCapxul as x, identityErrorFromCapxul as y, captureException as z };