@capxul/sdk 1.2.2 → 2.0.0

package/dist/{create-capxul-client-C7H5b68l.d.mts → create-capxul-client-klbklLYW.d.mts}

@@ -1,5 +1,5 @@
-import { A as CurrencyCode, B as RunId, C as AnonymousDistinctId, D as BlockNumber, E as AuthUserId, F as Money, G as TxHash, H as SmartAccount, I as OrgId, J as CapxulError, L as Profile, M as DurationMs, N as Email, O as ChainId, P as EpochMs, Q as FailureMode, R as PublishableKey, S as AllowedOrigin, T as AuthSession, U as SubAccount, V as SessionToken, W as SubAccountId, X as CapxulErrorDetails, Y as CapxulErrorCode, Z as Failure, b as AccountId, d as CapxulResult, f as Profile$1, g as AuthCachePort, j as DocumentHash, k as CountryCode, m as SmartAccount$1, n as CapxulSigner, o as AccountProviderSource, p as Session$1, s as AccountRequirement, v as CachedJwt, w as AppId, x as Address, y as Account$1, z as RoleKey } from "./signer-CJT0pPiO.mjs";
-import { Hex } from "viem";
+import { $ as CapxulErrorDetails, A as CountryCode, B as PermissionAssignmentId, C as AllowedOrigin, D as AuthUserId, E as AuthSession, F as EpochMs, G as SessionToken, H as Profile, I as Money, J as WeiAmount, K as SmartAccount, L as MovementId, M as DocumentHash, N as DurationMs, O as BlockNumber, P as Email, Q as CapxulErrorCode, R as OrgId, S as AllowanceKey, T as AppId, U as PublishableKey, V as PermissionId, W as RoleKey, Z as CapxulError, d as CapxulResult, et as Failure, f as Profile$1, g as AuthCachePort, j as CurrencyCode, k as ChainId, m as SmartAccount$1, n as CapxulSigner, o as AccountProviderSource, p as Session$1, q as TxHash, s as AccountRequirement, tt as FailureMode, v as CachedJwt, w as AnonymousDistinctId, x as Address$1, y as Account$1, z as PaymentCommandId } from "./signer-ZijoFiUs.mjs";
+import { Address, Hex } from "viem";
 import { Context, Effect, Layer, Schema, Scope, Tracer } from "effect";
 import { FunctionReference } from "convex/server";
 
@@ -224,6 +224,10 @@ type Destination$1 = {
  */
 declare const destination: (state: IdentityState) => Destination$1 | null;
 //#endregion
+//#region ../config/src/capxul-payments-v2.d.ts
+/** Immutable CapxulPaymentsV2 deployment on Base Sepolia. */
+declare const CAPXUL_PAYMENTS_V2_ADDRESS: Address;
+//#endregion
 //#region src/ports/auth-client.d.ts
 type AuthClientOperationOptions = {
   readonly signal?: AbortSignal;
@@ -307,7 +311,7 @@ interface TelemetryPort {
 }
 //#endregion
 //#region ../observability/src/index.d.ts
-declare const TELEMETRY_EVENT_NAMES: readonly ["auth_otp_requested", "auth_otp_delivered", "auth_otp_expired", "auth_verified", "auth_failed", "auth_signed_out", "onboarding_intent_selected", "onboarding_profile_submitted", "onboarding_organization_submitted", "onboarding_dashboard_reached", "provisioning_safe_created", "provisioning_safe_confirmed", "bootstrap_resolved", "bootstrap_failed", "member_activation_started", "member_activation_ready", "member_activation_failed", "organization_creation_started", "organization_creation_ready", "organization_creation_failed", "account_balance_read", "account_balance_failed", "faucet_requested", "faucet_confirmed", "faucet_failed", "subaccount_created", "subaccount_renamed", "subaccount_deleted", "subaccount_op_failed", "transfer_requested", "transfer_backend_received", "transfer_confirmed", "transfer_failed", "org_create_started", "org_safe_created", "org_safe_confirmed", "org_roles_seeded", "org_created", "org_create_failed", "org_invite_sent", "org_invite_accepted", "org_role_granted", "org_member_active", "org_member_removed", "org_invite_expired", "org_role_grant_failed", "payment_requested", "payment_resolved", "payment_document_attached", "payment_submitted", "payment_settled", "payment_claimed", "payment_cancelled", "payment_redirected", "payment_failed", "stream_created", "stream_claimed", "stream_cancelled", "stream_completed", "stream_failed", "withdrawal_requested", "withdrawal_submitted", "withdrawal_settled", "withdrawal_failed"];
+declare const TELEMETRY_EVENT_NAMES: readonly ["auth_otp_requested", "auth_otp_delivered", "auth_otp_expired", "auth_verified", "auth_failed", "auth_signed_out", "onboarding_intent_selected", "onboarding_profile_submitted", "onboarding_organization_submitted", "onboarding_dashboard_reached", "provisioning_safe_created", "provisioning_safe_confirmed", "bootstrap_resolved", "bootstrap_failed", "member_activation_started", "member_activation_ready", "member_activation_failed", "organization_creation_started", "organization_creation_ready", "organization_creation_failed", "account_balance_read", "account_balance_failed", "faucet_requested", "faucet_confirmed", "faucet_failed", "org_create_started", "org_safe_created", "org_safe_confirmed", "org_roles_seeded", "org_created", "org_create_failed", "org_invite_sent", "org_invite_accepted", "org_invite_expired", "payment_initiated", "payment_settled", "payment_failed", "deposit_initiated", "deposit_settled", "permission_mirror_verification", "movement_scan_window", "movement_scan_checkpoint", "movement_scan_incident"];
 type TelemetryEventName = (typeof TELEMETRY_EVENT_NAMES)[number];
 type TelemetryProps = Record<string, unknown>;
 type TelemetryEvent = {
@@ -341,6 +345,278 @@ interface TelemetryGroupInput {
   readonly properties?: TelemetryProps;
 }
 //#endregion
+//#region ../wire/src/bootstrap.d.ts
+declare const EngineeringTelemetryBootstrapPolicy: Schema.Struct<{
+  readonly host: Schema.refine<string, Schema.String>;
+  readonly projectToken: Schema.refine<string, Schema.String>;
+  readonly capxulEnv: Schema.Union<readonly [Schema.Literal<"development">, Schema.Literal<"e2e">, Schema.Literal<"staging">, Schema.Literal<"production">]>;
+}>;
+type EngineeringTelemetryBootstrapPolicyV1 = Schema.Schema.Type<typeof EngineeringTelemetryBootstrapPolicy>;
+//#endregion
+//#region ../wire/src/status.d.ts
+/** The closed L2 Payment status authority. */
+declare const L2_PAYMENT_STATUSES: readonly ["pending", "settling", "scheduled", "streaming", "pending_claim", "settled", "cancelled", "failed"];
+type L2PaymentStatus = (typeof L2_PAYMENT_STATUSES)[number];
+/** What a payment is FOR. Pairs with `PAYMENT_DOCUMENT_KINDS`. */
+declare const PAYMENT_TYPES: readonly ["unspecified", "invoice", "payroll", "reimbursement"];
+type PaymentType$1 = (typeof PAYMENT_TYPES)[number];
+/** Attachable document kinds; each maps to exactly one `PaymentType`. */
+declare const PAYMENT_DOCUMENT_KINDS: readonly ["memo", "invoice", "payslip", "receipt", "withdrawal"];
+type PaymentDocumentKind$1 = (typeof PAYMENT_DOCUMENT_KINDS)[number];
+/** Lifecycle of a payment REQUEST as its issuer sees it. */
+declare const REQUEST_STATUSES: readonly ["draft", "sent", "viewed", "pending_settlement", "paid", "declined", "cancelled", "expired"];
+type RequestStatus = (typeof REQUEST_STATUSES)[number];
+/** The same request as its RECIPIENT sees it, in the approval inbox. */
+declare const INBOX_STATUSES: readonly ["open", "approved", "declined", "paid", "cancelled", "expired"];
+type InboxStatus = (typeof INBOX_STATUSES)[number];
+//#endregion
+//#region ../wire/src/financial-ops.d.ts
+declare const AttachablePaymentDocumentEnvelope: Schema.Union<readonly [Schema.Struct<{
+  readonly protocol: Schema.Literal<"capxul.payment-document">;
+  readonly version: Schema.Literal<1>;
+  readonly domain: Schema.Struct<{
+    readonly name: Schema.Literal<"CapxulPayments">;
+    readonly version: Schema.Literal<"1">;
+    readonly chainId: Schema.Codec<ChainId, number, never, never>;
+    readonly verifyingContract: Schema.Literal<"0xe740ea65521edc9bef0ea75d30b5334711db99f4">;
+  }>;
+  readonly primaryType: Schema.Literal<"Memo">;
+  readonly message: Schema.Struct<{
+    readonly kind: Schema.Literal<0>;
+    readonly reference: Schema.String;
+    readonly note: Schema.String;
+    readonly issuedAt: Schema.Number;
+  }>;
+}>, Schema.Struct<{
+  readonly protocol: Schema.Literal<"capxul.payment-document">;
+  readonly version: Schema.Literal<1>;
+  readonly domain: Schema.Struct<{
+    readonly name: Schema.Literal<"CapxulPayments">;
+    readonly version: Schema.Literal<"1">;
+    readonly chainId: Schema.Codec<ChainId, number, never, never>;
+    readonly verifyingContract: Schema.Literal<"0xe740ea65521edc9bef0ea75d30b5334711db99f4">;
+  }>;
+  readonly primaryType: Schema.Literal<"Invoice">;
+  readonly message: Schema.Struct<{
+    readonly kind: Schema.Literal<1>;
+    readonly invoiceNumber: Schema.String;
+    readonly payerRef: Schema.String;
+    readonly payeeRef: Schema.String;
+    readonly amount: Schema.String;
+    readonly currency: Schema.Codec<CurrencyCode, string, never, never>;
+    readonly decimals: Schema.Number;
+    readonly issuedAt: Schema.Number;
+    readonly dueAt: Schema.Number;
+    readonly lineItemsHash: Schema.Codec<DocumentHash, string, never, never>;
+  }>;
+}>, Schema.Struct<{
+  readonly protocol: Schema.Literal<"capxul.payment-document">;
+  readonly version: Schema.Literal<1>;
+  readonly domain: Schema.Struct<{
+    readonly name: Schema.Literal<"CapxulPayments">;
+    readonly version: Schema.Literal<"1">;
+    readonly chainId: Schema.Codec<ChainId, number, never, never>;
+    readonly verifyingContract: Schema.Literal<"0xe740ea65521edc9bef0ea75d30b5334711db99f4">;
+  }>;
+  readonly primaryType: Schema.Literal<"Payslip">;
+  readonly message: Schema.Struct<{
+    readonly kind: Schema.Literal<2>;
+    readonly employerRef: Schema.String;
+    readonly employeeRef: Schema.String;
+    readonly period: Schema.String;
+    readonly gross: Schema.String;
+    readonly net: Schema.String;
+    readonly currency: Schema.Codec<CurrencyCode, string, never, never>;
+    readonly decimals: Schema.Number;
+    readonly issuedAt: Schema.Number;
+  }>;
+}>, Schema.Struct<{
+  readonly protocol: Schema.Literal<"capxul.payment-document">;
+  readonly version: Schema.Literal<1>;
+  readonly domain: Schema.Struct<{
+    readonly name: Schema.Literal<"CapxulPayments">;
+    readonly version: Schema.Literal<"1">;
+    readonly chainId: Schema.Codec<ChainId, number, never, never>;
+    readonly verifyingContract: Schema.Literal<"0xe740ea65521edc9bef0ea75d30b5334711db99f4">;
+  }>;
+  readonly primaryType: Schema.Literal<"Receipt">;
+  readonly message: Schema.Struct<{
+    readonly kind: Schema.Literal<3>;
+    readonly reference: Schema.String;
+    readonly amount: Schema.String;
+    readonly currency: Schema.Codec<CurrencyCode, string, never, never>;
+    readonly decimals: Schema.Number;
+    readonly paidAt: Schema.Number;
+    readonly note: Schema.String;
+  }>;
+}>]>;
+/**
+ * #592 invoice line item. `quantity` is a positive integer; `unitMinor` is the
+ * per-unit price in integer minor units. The list is canonically hashed by
+ * `hashLineItems` (payment-document-hash.ts) into the Invoice `lineItemsHash`,
+ * and Σ(quantity × unitMinor) MUST equal the invoice `amount`. The hash binds
+ * the documentHash to the exact items; the sum-check makes the items add up to
+ * the amount due. See the financial-operations contract in `packages/wire/CONTEXT.md`.
+ */
+declare const LineItem: Schema.Struct<{
+  readonly description: Schema.String;
+  readonly quantity: Schema.Number;
+  readonly unitMinor: Schema.String;
+}>;
+type AttachablePaymentDocumentEnvelopeV1 = Schema.Schema.Type<typeof AttachablePaymentDocumentEnvelope>;
+type LineItemV1 = Schema.Schema.Type<typeof LineItem>;
+//#endregion
+//#region ../wire/src/l2-money.d.ts
+declare const MovementAnnotationSchema: Schema.Struct<{
+  readonly movementId: Schema.Codec<MovementId, string, never, never>;
+  readonly actor: Schema.Union<readonly [Schema.Struct<{
+    readonly kind: Schema.Literal<"account">;
+    readonly accountId: Schema.refine<string, Schema.String>;
+  }>, Schema.Struct<{
+    readonly kind: Schema.Literal<"organization">;
+    readonly orgId: Schema.refine<string, Schema.String>;
+  }>]>;
+  readonly counterpartyLabel: Schema.optional<Schema.String>;
+  readonly accountingCategory: Schema.optional<Schema.String>;
+  readonly memo: Schema.optional<Schema.String>;
+  readonly lastEditor: Schema.Union<readonly [Schema.Struct<{
+    readonly kind: Schema.Literal<"account">;
+    readonly accountId: Schema.refine<string, Schema.String>;
+  }>, Schema.Struct<{
+    readonly kind: Schema.Literal<"organization">;
+    readonly orgId: Schema.refine<string, Schema.String>;
+  }>]>;
+  readonly updatedAt: Schema.refine<number, Schema.Number>;
+}>;
+type MovementAnnotation = Schema.Schema.Type<typeof MovementAnnotationSchema>;
+declare const PermissionSchema: Schema.Struct<{
+  readonly permissionId: Schema.Codec<PermissionId, string, never, never>;
+  readonly orgId: Schema.refine<string, Schema.String>;
+  readonly type: Schema.Literals<readonly ["budget", "managePeople"]>;
+  readonly state: Schema.Literals<readonly ["pending", "active", "suspended", "revoked", "superseded", "quarantined"]>;
+  readonly revision: Schema.refine<number, Schema.Number>;
+  readonly roleKey: Schema.Codec<RoleKey, string, never, never>;
+  readonly tokenAddress: Schema.optional<Schema.Codec<Address$1, string, never, never>>;
+  readonly limitRaw: Schema.optional<Schema.Codec<WeiAmount, string, never, never>>;
+  readonly allowanceKey: Schema.optional<Schema.Codec<AllowanceKey, string, never, never>>;
+}>;
+type Permission = Schema.Schema.Type<typeof PermissionSchema>;
+declare const PermissionAssignmentSchema: Schema.Struct<{
+  readonly permissionAssignmentId: Schema.Codec<PermissionAssignmentId, string, never, never>;
+  readonly permissionId: Schema.Codec<PermissionId, string, never, never>;
+  readonly actor: Schema.Union<readonly [Schema.Struct<{
+    readonly kind: Schema.Literal<"account">;
+    readonly accountId: Schema.refine<string, Schema.String>;
+  }>, Schema.Struct<{
+    readonly kind: Schema.Literal<"organization">;
+    readonly orgId: Schema.refine<string, Schema.String>;
+  }>]>;
+  readonly state: Schema.Literals<readonly ["pending", "active", "suspended", "revoked", "superseded", "quarantined"]>;
+}>;
+type PermissionAssignment = Schema.Schema.Type<typeof PermissionAssignmentSchema>;
+declare const CurrentHoldingsSchema: Schema.Struct<{
+  readonly actor: Schema.Union<readonly [Schema.Struct<{
+    readonly kind: Schema.Literal<"account">;
+    readonly accountId: Schema.refine<string, Schema.String>;
+  }>, Schema.Struct<{
+    readonly kind: Schema.Literal<"organization">;
+    readonly orgId: Schema.refine<string, Schema.String>;
+  }>]>;
+  readonly chainId: Schema.Codec<ChainId, number, never, never>;
+  readonly observedAt: Schema.refine<number, Schema.Number>;
+  readonly stale: Schema.Boolean;
+  readonly rows: Schema.$Array<Schema.Union<readonly [Schema.Struct<{
+    readonly assetKind: Schema.Literal<"native">;
+    readonly symbol: Schema.optional<Schema.String>;
+    readonly decimals: Schema.optional<Schema.refine<number, Schema.Number>>;
+    readonly rawBalance: Schema.Codec<WeiAmount, string, never, never>;
+  }>, Schema.Struct<{
+    readonly assetKind: Schema.Literal<"erc20">;
+    readonly tokenAddress: Schema.Codec<Address$1, string, never, never>;
+    readonly symbol: Schema.optional<Schema.String>;
+    readonly decimals: Schema.optional<Schema.refine<number, Schema.Number>>;
+    readonly rawBalance: Schema.Codec<WeiAmount, string, never, never>;
+  }>]>>;
+}>;
+type CurrentHoldings = Schema.Schema.Type<typeof CurrentHoldingsSchema>;
+declare const PaymentCommandLineageSchema: Schema.Union<readonly [Schema.Struct<{
+  readonly kind: Schema.Literal<"payroll">;
+  readonly runId: Schema.refine<string, Schema.String>;
+}>, Schema.Struct<{
+  readonly kind: Schema.Literal<"payment_request">;
+  readonly requestId: Schema.refine<string, Schema.String>;
+}>]>;
+type PaymentCommandLineage = Schema.Schema.Type<typeof PaymentCommandLineageSchema>;
+declare const PermissionIntentSchema: Schema.Union<readonly [Schema.Struct<{
+  readonly type: Schema.Literal<"budget">;
+  readonly limit: Schema.Struct<{
+    readonly currency: Schema.Codec<CurrencyCode, string, never, never>;
+    readonly value: Schema.String;
+    readonly decimals: Schema.Number;
+  }>;
+}>, Schema.Struct<{
+  readonly type: Schema.Literal<"managePeople">;
+}>]>;
+type PermissionIntent = Schema.Schema.Type<typeof PermissionIntentSchema>;
+declare const SubmittedPermissionExecutionSchema: Schema.Struct<{
+  readonly status: Schema.Literal<"submitted">;
+  readonly executionId: Schema.refine<string, Schema.String>;
+  readonly commandId: Schema.Codec<PaymentCommandId, string, never, never>;
+  readonly userOpHash: Schema.Codec<string, string, never, never>;
+  readonly value: Schema.Union<readonly [Schema.Struct<{
+    readonly permissionId: Schema.Codec<PermissionId, string, never, never>;
+    readonly orgId: Schema.refine<string, Schema.String>;
+    readonly type: Schema.Literals<readonly ["budget", "managePeople"]>;
+    readonly state: Schema.Literals<readonly ["pending", "active", "suspended", "revoked", "superseded", "quarantined"]>;
+    readonly revision: Schema.refine<number, Schema.Number>;
+    readonly roleKey: Schema.Codec<RoleKey, string, never, never>;
+    readonly tokenAddress: Schema.optional<Schema.Codec<Address$1, string, never, never>>;
+    readonly limitRaw: Schema.optional<Schema.Codec<WeiAmount, string, never, never>>;
+    readonly allowanceKey: Schema.optional<Schema.Codec<AllowanceKey, string, never, never>>;
+  }>, Schema.Struct<{
+    readonly permissionAssignmentId: Schema.Codec<PermissionAssignmentId, string, never, never>;
+    readonly permissionId: Schema.Codec<PermissionId, string, never, never>;
+    readonly actor: Schema.Union<readonly [Schema.Struct<{
+      readonly kind: Schema.Literal<"account">;
+      readonly accountId: Schema.refine<string, Schema.String>;
+    }>, Schema.Struct<{
+      readonly kind: Schema.Literal<"organization">;
+      readonly orgId: Schema.refine<string, Schema.String>;
+    }>]>;
+    readonly state: Schema.Literals<readonly ["pending", "active", "suspended", "revoked", "superseded", "quarantined"]>;
+  }>, Schema.$Array<Schema.Struct<{
+    readonly permissionId: Schema.Codec<PermissionId, string, never, never>;
+    readonly orgId: Schema.refine<string, Schema.String>;
+    readonly type: Schema.Literals<readonly ["budget", "managePeople"]>;
+    readonly state: Schema.Literals<readonly ["pending", "active", "suspended", "revoked", "superseded", "quarantined"]>;
+    readonly revision: Schema.refine<number, Schema.Number>;
+    readonly roleKey: Schema.Codec<RoleKey, string, never, never>;
+    readonly tokenAddress: Schema.optional<Schema.Codec<Address$1, string, never, never>>;
+    readonly limitRaw: Schema.optional<Schema.Codec<WeiAmount, string, never, never>>;
+    readonly allowanceKey: Schema.optional<Schema.Codec<AllowanceKey, string, never, never>>;
+  }>>]>;
+}>;
+type SubmittedPermissionExecution = Schema.Schema.Type<typeof SubmittedPermissionExecutionSchema>;
+//#endregion
+//#region ../wire/src/observation-context.d.ts
+/**
+ * Bounded, non-authoritative observation metadata carried by selected SDK
+ * calls. Actor identity is deliberately absent: the backend derives it from
+ * the authenticated session and verifies organization/application hints.
+ */
+interface WireObservationContext {
+  readonly application?: string;
+  readonly applicationId?: string;
+  readonly release?: string;
+  readonly sessionId?: string;
+  readonly organizationId?: string;
+  readonly journeyId?: string;
+  readonly correlationId?: string;
+  readonly anonymousId?: string;
+  /** W3C trace carrier for the explicit Convex action hop; never product identity. */
+  readonly traceparent?: string;
+}
+//#endregion
 //#region src/ports/bootstrap.d.ts
 type BootstrapInput = {
   readonly publishableKey: PublishableKey;
@@ -367,6 +643,7 @@ type BootstrapResolution = {
   readonly siteBaseUrl: string;
   readonly openfortPublishableKey: string;
   readonly shieldPublishableKey: string;
+  readonly engineeringTelemetry?: EngineeringTelemetryBootstrapPolicyV1;
 };
 type BootstrapErrorKind = "notAuthenticated" | "network" | "provider" | "malformedBody" | "invalidInput" | "rateLimited";
 declare const BootstrapError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P] }>) => import("effect/Cause").YieldableError & {
@@ -472,7 +749,7 @@ type CompleteOnboardingIdentityInput = {
   readonly email: Email;
   readonly displayName: string;
   readonly country: CountryCode;
-  readonly withdrawalAddress?: Address; /** #1062: optional globally-unique handle — store-when-present, backend-normalized. */
+  readonly withdrawalAddress?: Address$1; /** #1062: optional globally-unique handle — store-when-present, backend-normalized. */
   readonly username?: string;
 };
 declare const IdentityError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P] }>) => import("effect/Cause").YieldableError & {
@@ -535,15 +812,16 @@ type SafeDeploymentConfig = {
  */
 type SafeDeploymentEvidence = {
   readonly chainId: ChainId;
-  readonly signerAddress: Address;
-  readonly safeAddress: Address;
+  readonly signerAddress: Address$1;
+  readonly safeAddress: Address$1;
   readonly txHash?: TxHash;
   readonly userOpHash?: TxHash;
   readonly blockNumber?: BlockNumber;
 };
 type ProvisionInput = {
   readonly authUserId: AuthUserId;
-  readonly chainId: ChainId;
+  readonly chainId: ChainId; /** Verified session email. The backend reads the same value from BetterAuth. */
+  readonly email: Email;
 };
 /**
  * Input to `SmartAccountPort.confirmDeployment` (#161 · γ-B).
@@ -562,14 +840,8 @@ type ProvisionInput = {
 type ConfirmDeploymentInput = {
   readonly authUserId: AuthUserId;
   readonly chainId: ChainId;
-  readonly safeAddress: Address;
+  readonly safeAddress: Address$1;
   readonly evidence: SafeDeploymentEvidence;
-  /**
-   * Optional live-E2E correlation id. This does not prove deployment; the
-   * backend still re-verifies chain evidence and only mirrors this branded
-   * id onto telemetry for PostHog run joins.
-   */
-  readonly telemetryRunId?: RunId;
 };
 /**
  * Input to `SmartAccountPort.claim` (PRD #462). The authenticated session
@@ -580,8 +852,7 @@ type ConfirmDeploymentInput = {
 type ClaimInput = {
   readonly authUserId: AuthUserId;
   readonly chainId: ChainId;
-  readonly signerAddress: Address;
-  readonly telemetryRunId?: RunId;
+  readonly signerAddress: Address$1;
 };
 declare const SmartAccountError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P] }>) => import("effect/Cause").YieldableError & {
   readonly _tag: "SmartAccountError";
@@ -595,7 +866,7 @@ declare class SmartAccountError extends SmartAccountError_base<{
 }> {}
 interface SmartAccountPort {
   loadByAuthUserId(authUserId: AuthUserId): Effect.Effect<SmartAccount | null, SmartAccountError, never>;
-  loadBySmartAccountAddress(address: Address): Effect.Effect<SmartAccount | null, SmartAccountError, never>;
+  loadBySmartAccountAddress(address: Address$1): Effect.Effect<SmartAccount | null, SmartAccountError, never>;
   provision(input: ProvisionInput): Effect.Effect<SmartAccount, SmartAccountError, never>;
   /**
    * Persist on-chain Safe-deployment evidence. The backend re-verifies
@@ -647,71 +918,9 @@ interface AccountReadPort {
   fundFromFaucet(input: FundFromFaucetInput): Effect.Effect<FundFromFaucetResult, AccountReadError, never>;
 }
 //#endregion
-//#region src/ports/sub-account.d.ts
-declare const SubAccountError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P] }>) => import("effect/Cause").YieldableError & {
-  readonly _tag: "SubAccountError";
-} & Readonly<A>;
-declare class SubAccountError extends SubAccountError_base<{
-  readonly operation: string;
-  readonly publicCode: CapxulErrorCode;
-  readonly publicError: CapxulError;
-  readonly cause: unknown;
-  readonly details?: CapxulErrorDetails;
-}> {}
-type CreateSubAccountInput = {
-  readonly accountId: AccountId;
-  readonly name: string;
-};
-type SubAccountIdInput = {
-  readonly subAccountId: SubAccountId;
-};
-type RenameSubAccountInput = {
-  readonly subAccountId: SubAccountId;
-  readonly name: string;
-};
-/**
- * A `transfer` endpoint is either the Account's MAIN balance (the remainder
- * left over after every sub-account is funded — never a stored row) or a
- * specific sub-account, addressed by its `SubAccountId` (canon
- * `account-balance-model.md` §5, §12).
- */
-type TransferEndpoint = "main" | SubAccountId;
-/**
- * Move money between two of the SAME Account's balances (canon §12). The
- * backend resolves the Account from auth (v1 = one Account per user), so the
- * input carries no `accountId` — only the from/to endpoints and the `Money`
- * amount. One verb covers money in (`main → sub`), money out (`sub → main`),
- * and `sub → sub`.
- */
-type TransferInput = {
-  readonly from: TransferEndpoint;
-  readonly to: TransferEndpoint;
-  readonly amount: Money;
-};
-/**
- * Result of a `transfer`: the recomputed `available` (`balanceOf − Σ`), plus
- * the updated source/destination sub-account rows. An endpoint that is `"main"`
- * has no stored row, so its slot is `null`.
- */
-type TransferResult = {
-  readonly available: Money;
-  readonly from: SubAccount | null;
-  readonly to: SubAccount | null;
-};
-interface SubAccountPort {
-  create(input: CreateSubAccountInput): Effect.Effect<SubAccount, SubAccountError, never>;
-  get(input: SubAccountIdInput): Effect.Effect<SubAccount | null, SubAccountError, never>;
-  list(input: {
-    readonly accountId: AccountId;
-  }): Effect.Effect<readonly SubAccount[], SubAccountError, never>;
-  rename(input: RenameSubAccountInput): Effect.Effect<SubAccount, SubAccountError, never>;
-  delete(input: SubAccountIdInput): Effect.Effect<void, SubAccountError, never>;
-  transfer(input: TransferInput): Effect.Effect<TransferResult, SubAccountError, never>;
-}
-//#endregion
 //#region src/flows/types.d.ts
 /**
- * The full 10-port bundle that `assembleCapxulClient` (slice 5) consumes.
+ * The full port bundle that `assembleCapxulClient` consumes.
  * (Was 13 before #1145 / DEMOLITION §D4 deleted the credentials, env and
  * transport ports — built by `production.ts`, read by nobody.)
  *
@@ -725,7 +934,6 @@ interface FlowPorts {
   readonly identity: IdentityPort;
   readonly smartAccount: SmartAccountPort;
   readonly accountRead: AccountReadPort;
-  readonly subAccount: SubAccountPort;
   readonly bootstrap: BootstrapPort;
   readonly clock: ClockPort;
   readonly telemetry: TelemetryPort;
@@ -733,29 +941,10 @@ interface FlowPorts {
 }
 /** Legacy method input retained by the imperative auth surface. */
 interface ExternalSigner {
-  readonly address: Address;
+  readonly address: Address$1;
   readonly signedProof: string;
 }
 //#endregion
-//#region ../wire/src/observation-context.d.ts
-/**
- * Bounded, non-authoritative observation metadata carried by selected SDK
- * calls. Actor identity is deliberately absent: the backend derives it from
- * the authenticated session and verifies organization/application hints.
- */
-interface WireObservationContext {
-  readonly application?: string;
-  readonly applicationId?: string;
-  readonly release?: string;
-  readonly sessionId?: string;
-  readonly organizationId?: string;
-  readonly journeyId?: string;
-  readonly correlationId?: string;
-  readonly anonymousId?: string;
-  /** W3C trace carrier for the explicit Convex action hop; never product identity. */
-  readonly traceparent?: string;
-}
-//#endregion
 //#region src/surface/org-lifecycle.d.ts
 type OrgSetupStep = "preparingFounderAccount" | "awaitingFounderAuthorization" | "submittingBootstrap" | "confirmingBootstrap";
 /** Leak-safe readiness for exactly one Organization. */
@@ -867,308 +1056,54 @@ interface SmartAccountMethods {
 interface IdentityMethods {
   loadCurrent(options?: {
     readonly signal?: AbortSignal;
-  }): Promise<CapxulResult<Profile$1 | null>>;
-  /**
-   * #1062: availability probe for the username the user is typing. Returns the
-   * canonical stored form so the UI can echo it.
-   */
-  usernameAvailable(username: string, options?: {
-    readonly signal?: AbortSignal;
-  }): Promise<CapxulResult<{
-    readonly available: boolean;
-    readonly normalized: string;
-  }>>;
-}
-//#endregion
-//#region src/surface/account-lifecycle.d.ts
-type ProvisioningFailureStep = "wallet" | "identity" | "provision" | "deploy";
-type ProvisioningPhase = {
-  readonly status: "idle";
-} | {
-  readonly status: "wallet";
-} | {
-  readonly status: "identity";
-} | {
-  readonly status: "provision";
-} | {
-  readonly status: "deploy";
-} | {
-  readonly status: "ready";
-} | {
-  readonly status: "failed";
-  readonly at: ProvisioningFailureStep;
-  readonly error: CapxulError;
-};
-type AccountSetupStep = "connecting" | "confirmingIdentity" | "registering" | "activating";
-type AccountLifecycle = {
-  readonly status: "loading";
-} | {
-  readonly status: "settingUp";
-  readonly step: AccountSetupStep;
-} | {
-  readonly status: "ready";
-  readonly accountId: string;
-  readonly canTransact: boolean;
-} | {
-  readonly status: "failed";
-  readonly at: AccountSetupStep;
-  readonly error: CapxulError;
-};
-declare function isSettingUpLifecycle(lifecycle: AccountLifecycle): boolean;
-//#endregion
-//#region ../wire/src/status.d.ts
-/** Payment lifecycle states carried on the wire (ADR-0018 P1). */
-declare const PAYMENT_STATUSES: readonly ["pending", "submitted", "pending_claim", "scheduled", "streaming", "settled", "cancelled", "redirected", "expired", "failed"];
-type PaymentStatus$1 = (typeof PAYMENT_STATUSES)[number];
-/** What a payment is FOR. Pairs with `PAYMENT_DOCUMENT_KINDS`. */
-declare const PAYMENT_TYPES: readonly ["unspecified", "invoice", "payroll", "reimbursement"];
-type PaymentType$1 = (typeof PAYMENT_TYPES)[number];
-/** Attachable document kinds; each maps to exactly one `PaymentType`. */
-declare const PAYMENT_DOCUMENT_KINDS: readonly ["memo", "invoice", "payslip", "receipt", "withdrawal"];
-type PaymentDocumentKind$1 = (typeof PAYMENT_DOCUMENT_KINDS)[number];
-/** Lifecycle of a payment REQUEST as its issuer sees it. */
-declare const REQUEST_STATUSES: readonly ["draft", "sent", "viewed", "pending_settlement", "paid", "declined", "cancelled", "expired"];
-type RequestStatus = (typeof REQUEST_STATUSES)[number];
-/** The same request as its RECIPIENT sees it, in the approval inbox. */
-declare const INBOX_STATUSES: readonly ["open", "approved", "declined", "paid", "cancelled", "expired"];
-type InboxStatus = (typeof INBOX_STATUSES)[number];
-//#endregion
-//#region ../wire/src/financial-ops.d.ts
-declare const AttachablePaymentDocumentEnvelope: Schema.Union<readonly [Schema.Struct<{
-  readonly protocol: Schema.Literal<"capxul.payment-document">;
-  readonly version: Schema.Literal<1>;
-  readonly domain: Schema.Struct<{
-    readonly name: Schema.Literal<"CapxulPayments">;
-    readonly version: Schema.Literal<"1">;
-    readonly chainId: Schema.Codec<ChainId, number, never, never>;
-    readonly verifyingContract: Schema.Literal<"0xe740ea65521edc9bef0ea75d30b5334711db99f4">;
-  }>;
-  readonly primaryType: Schema.Literal<"Memo">;
-  readonly message: Schema.Struct<{
-    readonly kind: Schema.Literal<0>;
-    readonly reference: Schema.String;
-    readonly note: Schema.String;
-    readonly issuedAt: Schema.Number;
-  }>;
-}>, Schema.Struct<{
-  readonly protocol: Schema.Literal<"capxul.payment-document">;
-  readonly version: Schema.Literal<1>;
-  readonly domain: Schema.Struct<{
-    readonly name: Schema.Literal<"CapxulPayments">;
-    readonly version: Schema.Literal<"1">;
-    readonly chainId: Schema.Codec<ChainId, number, never, never>;
-    readonly verifyingContract: Schema.Literal<"0xe740ea65521edc9bef0ea75d30b5334711db99f4">;
-  }>;
-  readonly primaryType: Schema.Literal<"Invoice">;
-  readonly message: Schema.Struct<{
-    readonly kind: Schema.Literal<1>;
-    readonly invoiceNumber: Schema.String;
-    readonly payerRef: Schema.String;
-    readonly payeeRef: Schema.String;
-    readonly amount: Schema.String;
-    readonly currency: Schema.Codec<CurrencyCode, string, never, never>;
-    readonly decimals: Schema.Number;
-    readonly issuedAt: Schema.Number;
-    readonly dueAt: Schema.Number;
-    readonly lineItemsHash: Schema.Codec<DocumentHash, string, never, never>;
-  }>;
-}>, Schema.Struct<{
-  readonly protocol: Schema.Literal<"capxul.payment-document">;
-  readonly version: Schema.Literal<1>;
-  readonly domain: Schema.Struct<{
-    readonly name: Schema.Literal<"CapxulPayments">;
-    readonly version: Schema.Literal<"1">;
-    readonly chainId: Schema.Codec<ChainId, number, never, never>;
-    readonly verifyingContract: Schema.Literal<"0xe740ea65521edc9bef0ea75d30b5334711db99f4">;
-  }>;
-  readonly primaryType: Schema.Literal<"Payslip">;
-  readonly message: Schema.Struct<{
-    readonly kind: Schema.Literal<2>;
-    readonly employerRef: Schema.String;
-    readonly employeeRef: Schema.String;
-    readonly period: Schema.String;
-    readonly gross: Schema.String;
-    readonly net: Schema.String;
-    readonly currency: Schema.Codec<CurrencyCode, string, never, never>;
-    readonly decimals: Schema.Number;
-    readonly issuedAt: Schema.Number;
-  }>;
-}>, Schema.Struct<{
-  readonly protocol: Schema.Literal<"capxul.payment-document">;
-  readonly version: Schema.Literal<1>;
-  readonly domain: Schema.Struct<{
-    readonly name: Schema.Literal<"CapxulPayments">;
-    readonly version: Schema.Literal<"1">;
-    readonly chainId: Schema.Codec<ChainId, number, never, never>;
-    readonly verifyingContract: Schema.Literal<"0xe740ea65521edc9bef0ea75d30b5334711db99f4">;
-  }>;
-  readonly primaryType: Schema.Literal<"Receipt">;
-  readonly message: Schema.Struct<{
-    readonly kind: Schema.Literal<3>;
-    readonly reference: Schema.String;
-    readonly amount: Schema.String;
-    readonly currency: Schema.Codec<CurrencyCode, string, never, never>;
-    readonly decimals: Schema.Number;
-    readonly paidAt: Schema.Number;
-    readonly note: Schema.String;
-  }>;
-}>]>;
-declare const WithdrawalDocumentEnvelope: Schema.Struct<{
-  readonly protocol: Schema.Literal<"capxul.payment-document">;
-  readonly version: Schema.Literal<1>;
-  readonly domain: Schema.Struct<{
-    readonly name: Schema.Literal<"CapxulPayments">;
-    readonly version: Schema.Literal<"1">;
-    readonly chainId: Schema.Codec<ChainId, number, never, never>;
-    readonly verifyingContract: Schema.Literal<"0xe740ea65521edc9bef0ea75d30b5334711db99f4">;
-  }>;
-  readonly primaryType: Schema.Literal<"Withdrawal">;
-  readonly message: Schema.Struct<{
-    readonly kind: Schema.Literal<4>;
-    readonly reference: Schema.String;
-    readonly amount: Schema.String;
-    readonly currency: Schema.Codec<CurrencyCode, string, never, never>;
-    readonly decimals: Schema.Number;
-    readonly destChain: Schema.Codec<ChainId, number, never, never>;
-    readonly destAddress: Schema.String;
-    readonly settledAt: Schema.Number;
-    readonly provider: Schema.String;
-    readonly note: Schema.String;
-  }>;
-}>;
-declare const PaymentDocumentEnvelope: Schema.Union<readonly [Schema.Union<readonly [Schema.Struct<{
-  readonly protocol: Schema.Literal<"capxul.payment-document">;
-  readonly version: Schema.Literal<1>;
-  readonly domain: Schema.Struct<{
-    readonly name: Schema.Literal<"CapxulPayments">;
-    readonly version: Schema.Literal<"1">;
-    readonly chainId: Schema.Codec<ChainId, number, never, never>;
-    readonly verifyingContract: Schema.Literal<"0xe740ea65521edc9bef0ea75d30b5334711db99f4">;
-  }>;
-  readonly primaryType: Schema.Literal<"Memo">;
-  readonly message: Schema.Struct<{
-    readonly kind: Schema.Literal<0>;
-    readonly reference: Schema.String;
-    readonly note: Schema.String;
-    readonly issuedAt: Schema.Number;
-  }>;
-}>, Schema.Struct<{
-  readonly protocol: Schema.Literal<"capxul.payment-document">;
-  readonly version: Schema.Literal<1>;
-  readonly domain: Schema.Struct<{
-    readonly name: Schema.Literal<"CapxulPayments">;
-    readonly version: Schema.Literal<"1">;
-    readonly chainId: Schema.Codec<ChainId, number, never, never>;
-    readonly verifyingContract: Schema.Literal<"0xe740ea65521edc9bef0ea75d30b5334711db99f4">;
-  }>;
-  readonly primaryType: Schema.Literal<"Invoice">;
-  readonly message: Schema.Struct<{
-    readonly kind: Schema.Literal<1>;
-    readonly invoiceNumber: Schema.String;
-    readonly payerRef: Schema.String;
-    readonly payeeRef: Schema.String;
-    readonly amount: Schema.String;
-    readonly currency: Schema.Codec<CurrencyCode, string, never, never>;
-    readonly decimals: Schema.Number;
-    readonly issuedAt: Schema.Number;
-    readonly dueAt: Schema.Number;
-    readonly lineItemsHash: Schema.Codec<DocumentHash, string, never, never>;
-  }>;
-}>, Schema.Struct<{
-  readonly protocol: Schema.Literal<"capxul.payment-document">;
-  readonly version: Schema.Literal<1>;
-  readonly domain: Schema.Struct<{
-    readonly name: Schema.Literal<"CapxulPayments">;
-    readonly version: Schema.Literal<"1">;
-    readonly chainId: Schema.Codec<ChainId, number, never, never>;
-    readonly verifyingContract: Schema.Literal<"0xe740ea65521edc9bef0ea75d30b5334711db99f4">;
-  }>;
-  readonly primaryType: Schema.Literal<"Payslip">;
-  readonly message: Schema.Struct<{
-    readonly kind: Schema.Literal<2>;
-    readonly employerRef: Schema.String;
-    readonly employeeRef: Schema.String;
-    readonly period: Schema.String;
-    readonly gross: Schema.String;
-    readonly net: Schema.String;
-    readonly currency: Schema.Codec<CurrencyCode, string, never, never>;
-    readonly decimals: Schema.Number;
-    readonly issuedAt: Schema.Number;
-  }>;
-}>, Schema.Struct<{
-  readonly protocol: Schema.Literal<"capxul.payment-document">;
-  readonly version: Schema.Literal<1>;
-  readonly domain: Schema.Struct<{
-    readonly name: Schema.Literal<"CapxulPayments">;
-    readonly version: Schema.Literal<"1">;
-    readonly chainId: Schema.Codec<ChainId, number, never, never>;
-    readonly verifyingContract: Schema.Literal<"0xe740ea65521edc9bef0ea75d30b5334711db99f4">;
-  }>;
-  readonly primaryType: Schema.Literal<"Receipt">;
-  readonly message: Schema.Struct<{
-    readonly kind: Schema.Literal<3>;
-    readonly reference: Schema.String;
-    readonly amount: Schema.String;
-    readonly currency: Schema.Codec<CurrencyCode, string, never, never>;
-    readonly decimals: Schema.Number;
-    readonly paidAt: Schema.Number;
-    readonly note: Schema.String;
-  }>;
-}>]>, Schema.Struct<{
-  readonly protocol: Schema.Literal<"capxul.payment-document">;
-  readonly version: Schema.Literal<1>;
-  readonly domain: Schema.Struct<{
-    readonly name: Schema.Literal<"CapxulPayments">;
-    readonly version: Schema.Literal<"1">;
-    readonly chainId: Schema.Codec<ChainId, number, never, never>;
-    readonly verifyingContract: Schema.Literal<"0xe740ea65521edc9bef0ea75d30b5334711db99f4">;
-  }>;
-  readonly primaryType: Schema.Literal<"Withdrawal">;
-  readonly message: Schema.Struct<{
-    readonly kind: Schema.Literal<4>;
-    readonly reference: Schema.String;
-    readonly amount: Schema.String;
-    readonly currency: Schema.Codec<CurrencyCode, string, never, never>;
-    readonly decimals: Schema.Number;
-    readonly destChain: Schema.Codec<ChainId, number, never, never>;
-    readonly destAddress: Schema.String;
-    readonly settledAt: Schema.Number;
-    readonly provider: Schema.String;
-    readonly note: Schema.String;
-  }>;
-}>]>;
-/**
- * #592 invoice line item. `quantity` is a positive integer; `unitMinor` is the
- * per-unit price in integer minor units. The list is canonically hashed by
- * `hashLineItems` (payment-document-hash.ts) into the Invoice `lineItemsHash`,
- * and Σ(quantity × unitMinor) MUST equal the invoice `amount`. The hash binds
- * the documentHash to the exact items; the sum-check makes the items add up to
- * the amount due. See the financial-operations contract in `packages/wire/CONTEXT.md`.
- */
-declare const LineItem: Schema.Struct<{
-  readonly description: Schema.String;
-  readonly quantity: Schema.Number;
-  readonly unitMinor: Schema.String;
-}>;
-type AttachablePaymentDocumentEnvelopeV1 = Schema.Schema.Type<typeof AttachablePaymentDocumentEnvelope>;
-type PaymentDocumentEnvelopeV1 = Schema.Schema.Type<typeof PaymentDocumentEnvelope>;
-type WithdrawalDocumentEnvelopeV1 = Schema.Schema.Type<typeof WithdrawalDocumentEnvelope>;
-type LineItemV1 = Schema.Schema.Type<typeof LineItem>;
+  }): Promise<CapxulResult<Profile$1 | null>>;
+  /**
+   * #1062: availability probe for the username the user is typing. Returns the
+   * canonical stored form so the UI can echo it.
+   */
+  usernameAvailable(username: string, options?: {
+    readonly signal?: AbortSignal;
+  }): Promise<CapxulResult<{
+    readonly available: boolean;
+    readonly normalized: string;
+  }>>;
+}
 //#endregion
-//#region ../wire/src/leak-safety.d.ts
-declare const OnchainEvidenceBrand: unique symbol;
-/**
- * The branded `{ userOpHash, txHash }` pair. On-chain settlement evidence is
- * INTERNAL — it flows on the server-internal channel only, never onto a wire
- * Payment or any MCP tool output. The brand makes "this is internal evidence"
- * a type, so a loose pair can't be passed where a wire field is expected.
- */
-type OnchainEvidence = {
-  readonly userOpHash: string;
-  readonly txHash: string;
-} & {
-  readonly [OnchainEvidenceBrand]: "OnchainEvidence";
+//#region src/surface/account-lifecycle.d.ts
+type ProvisioningFailureStep = "wallet" | "identity" | "provision" | "deploy";
+type ProvisioningPhase = {
+  readonly status: "idle";
+} | {
+  readonly status: "wallet";
+} | {
+  readonly status: "identity";
+} | {
+  readonly status: "provision";
+} | {
+  readonly status: "deploy";
+} | {
+  readonly status: "ready";
+} | {
+  readonly status: "failed";
+  readonly at: ProvisioningFailureStep;
+  readonly error: CapxulError;
+};
+type AccountSetupStep = "connecting" | "confirmingIdentity" | "registering" | "activating";
+type AccountLifecycle = {
+  readonly status: "loading";
+} | {
+  readonly status: "settingUp";
+  readonly step: AccountSetupStep;
+} | {
+  readonly status: "ready";
+  readonly accountId: string;
+  readonly canTransact: boolean;
+} | {
+  readonly status: "failed";
+  readonly at: AccountSetupStep;
+  readonly error: CapxulError;
 };
+declare function isSettingUpLifecycle(lifecycle: AccountLifecycle): boolean;
 //#endregion
 //#region src/surface/money.d.ts
 type ActorReference = {
@@ -1291,7 +1226,7 @@ interface PaymentMoney {
   readonly value: string;
   readonly decimals: number;
 }
-type PaymentStatus = PaymentStatus$1;
+type PaymentStatus = L2PaymentStatus;
 type PaymentType = PaymentType$1;
 type PaymentDocumentKind = PaymentDocumentKind$1;
 interface PaymentDocumentRef {
@@ -1330,6 +1265,8 @@ interface Payment {
   readonly updatedAt: number;
 }
 interface PaymentsPayInput {
+  /** Stable idempotency key for caller retries. Omit only for a one-shot payment. */
+  readonly requestKey?: string;
   readonly actor?: ActorReference;
   readonly to: TargetReference;
   readonly amount: PaymentMoney;
@@ -1357,28 +1294,6 @@ interface PaymentsPayInput {
    */
   readonly lineItems?: readonly LineItemV1[];
 }
-/**
- * B3 withdraw / cash-out input. Stripe-shaped: `to` is the EXTERNAL 0x wallet
- * (the ONE place the SDK accepts a raw address — the pay lane never does),
- * `amount` is a Money, `document` is the REQUIRED kind:4 Withdrawal envelope
- * (carries the audit-visible destAddress). No chain / Safe / token / hash
- * custody substrate on the input. Returns a leak-safe `Payment` whose recipient
- * label is the redacted address — never the full 0x.
- */
-interface PaymentsWithdrawInput {
-  readonly to: string;
-  readonly amount: PaymentMoney;
-  readonly document: WithdrawalDocumentEnvelopeV1;
-}
-/**
- * Payout via a saved destination. The caller selects the destination by opaque
- * id and never re-enters a raw wallet address on this path.
- */
-interface PaymentsPayoutInput {
-  readonly actor?: ActorReference;
-  readonly destinationId: string;
-  readonly amount: PaymentMoney;
-}
 type DestinationKind = "bank_account" | "mobile_money" | "external_account";
 type DestinationRail = {
   readonly kind: "bank";
@@ -1469,31 +1384,98 @@ interface ActivityListParams {
   readonly actor?: ActorReference;
   readonly cursor?: string;
   readonly limit?: number;
-  readonly paymentType?: PaymentType;
-  readonly timing?: PaymentTiming["kind"];
 }
-interface ActivityItem {
+type ActivityReference = {
+  readonly kind: "payment";
+  readonly id: string;
+} | {
+  readonly kind: "movement";
+  readonly id: string;
+};
+type ActivityItem = {
+  readonly kind: "payment";
   readonly id: string;
-  readonly actor: ActorReference;
-  readonly kind: "payment" | "payout" | "withdrawal" | "deposit" | "claim";
-  readonly direction: "in" | "out" | "internal";
+  readonly ledgerKind: "Payment" | "Payout" | "Deposit";
   readonly status: PaymentStatus;
   readonly amount: PaymentMoney;
-  readonly title: string;
-  readonly subtitle: string | null;
-  readonly target: TargetReference | null;
-  readonly paymentId: string | null;
   readonly createdAt: number;
   readonly updatedAt: number;
-}
+} | {
+  readonly kind: "movement";
+  readonly id: string;
+  readonly classification: "movement_only_outflow";
+  readonly createdAt: number;
+  readonly updatedAt: number;
+};
 interface ActivityPage {
   readonly items: readonly ActivityItem[];
-  readonly nextCursor: string | null;
+  readonly cursor: string | null;
+  readonly checkpoint: number;
+}
+interface PaymentActivityEvidence {
+  readonly chainId: 84532;
+  readonly contractAddress: string;
+  readonly tokenAddress: string;
+  readonly transactionHash: string;
+  readonly blockNumber: number;
+  readonly blockHash: string;
+  readonly finality: "finalized";
+  readonly paymentEventLogIndex: number | null;
+  readonly transferLogIndex: number;
+  readonly settlementId: string | null;
+  readonly source: string;
+  readonly destination: string;
+  readonly rawAmount: string;
+  readonly link: {
+    readonly paymentId: string;
+    readonly movementId: string | null;
+    readonly transactionHash: string;
+  };
+}
+interface MovementActivityEvidence {
+  readonly chainId: number;
+  readonly contractAddress: string;
+  readonly tokenAddress: string;
+  readonly transactionHash: string;
+  readonly blockNumber: number;
+  readonly blockHash: string;
+  readonly canonicalState: "finalized";
+  readonly transferLogIndex: number;
+  readonly source: string;
+  readonly destination: string;
+  readonly rawAmount: string;
+  readonly link: {
+    readonly movementId: string;
+    readonly depositPaymentId: string | null;
+  };
+}
+type ActivityDetail = {
+  readonly kind: "payment";
+  readonly payment: Payment;
+  readonly evidence: PaymentActivityEvidence;
+} | {
+  readonly kind: "movement";
+  readonly movementId: string;
+  readonly annotation: MovementAnnotation | null;
+  readonly evidence: MovementActivityEvidence;
+};
+interface ActivityAnnotationInput {
+  readonly actor?: ActorReference;
+  readonly movementId: string;
+  readonly counterpartyLabel?: string;
+  readonly accountingCategory?: string;
+  readonly memo?: string;
 }
 interface ActivityMethods {
   list(params?: ActivityListParams, options?: {
     readonly signal?: AbortSignal;
   }): Promise<CapxulResult<ActivityPage>>;
+  get(reference: ActivityReference, options?: {
+    readonly signal?: AbortSignal;
+  }): Promise<CapxulResult<ActivityDetail | null>>;
+  annotate(input: ActivityAnnotationInput, options?: {
+    readonly signal?: AbortSignal;
+  }): Promise<CapxulResult<MovementAnnotation>>;
 }
 interface OfframpQuoteInput {
   readonly actor?: ActorReference;
@@ -1522,75 +1504,6 @@ interface OfframpMethods {
     readonly signal?: AbortSignal;
   }): Promise<CapxulResult<OfframpStatus>>;
 }
-interface PaymentSettlementInput {
-  readonly paymentId: string;
-  readonly evidence: OnchainEvidence;
-}
-/**
- * Host-execution callback recording the on-chain escrow of a commitment
- * (G3 · #546): `createCommitment` returned `onchainCommitmentId`, escrowing
- * the total. `onchainCommitmentId` + the userOp/tx hashes are internal evidence,
- * never on the wire (internal channel only).
- */
-interface CommitmentCreatedInput {
-  readonly paymentId: string;
-  readonly onchainCommitmentId: string;
-  readonly evidence: OnchainEvidence;
-}
-/** Host-execution callback recording a recipient-side `claim` (G3 · #546). */
-interface CommitmentClaimInput {
-  readonly paymentId: string;
-  readonly evidence: OnchainEvidence;
-}
-/**
- * Host-execution callback recording a creator-side `cancel` (G3 · #546):
- * on-chain the unvested remainder returns to the creator; vested-unclaimed
- * stays the recipient's. An optional credit-note document is appended.
- */
-interface CommitmentCancelInput {
-  readonly paymentId: string;
-  readonly evidence: OnchainEvidence;
-  readonly document?: PaymentDocumentEnvelopeV1;
-}
-/**
- * Host-execution callback recording a pre-claim `redirect` to a new validated
- * recipient (G3 · #546). `to` is a validated recipient (handle/email/payee id),
- * never a raw address.
- */
-interface CommitmentRedirectInput {
-  readonly paymentId: string;
-  readonly to: Ref$1;
-  readonly evidence: OnchainEvidence;
-  readonly document?: PaymentDocumentEnvelopeV1;
-}
-/**
- * Host-execution callback recording a settled ORG spend/payroll on the ONE
- * `payments` ledger (D3 · #565). An org spend is a KIND of Payment — it lands a
- * real `payments` row with `source:"org"` + `orgId` (no parallel `orgSpends`
- * table, no synthetic client-side fabrication). The signer-side host calls this
- * AFTER the on-chain Roles-modifier spend settles; `evidence` carries the
- * internal userOp/tx hashes (never wire fields). `recipient` is the validated
- * recipient ref label; `recipientSafeAddress` is internal evidence on the row.
- */
-interface OrgPaymentRecordInput {
-  readonly orgId: string;
-  readonly recipientLabel: string;
-  readonly recipientKind?: "handle" | "email" | "payee" | "capxulUserId" | "me" | "org";
-  readonly recipientRef?: string;
-  readonly recipientPayeeId?: string;
-  readonly recipientSafeAddress: string;
-  readonly amount: PaymentMoney;
-  readonly paymentType: PaymentType;
-  readonly document?: PaymentDocumentEnvelopeV1;
-  /** The org Safe the spend debited — bound as the `from` of the settlement transfer. */
-  readonly orgSafeAddress: string;
-  /**
-   * 0-based occurrence among batch runs with the same (recipient, amount), so
-   * each run binds to + de-dupes on its own on-chain `Transfer` (D3 · #565).
-   */
-  readonly occurrenceIndex: number;
-  readonly evidence: OnchainEvidence;
-}
 interface PaymentDocumentVerification {
   readonly documentHash: string;
   readonly ok: boolean;
@@ -1609,73 +1522,6 @@ interface PaymentDocumentRender {
   readonly kind: PaymentDocumentKind;
   readonly html: string;
 }
-/**
- * Internal commitment execution reference (G3 · #546). The on-chain
- * `onchainCommitmentId` is internal evidence (like userOp/tx hashes) — it never
- * appears on the wire `Payment` or any MCP tool output, but the signer-side host
- * needs it to build a claim/cancel/redirect UserOp. This is the server-internal
- * channel that carries it (and the recipient Safe address for an auto-claim
- * relayer), never a consumer-facing surface.
- */
-interface PaymentCommitmentRef {
-  readonly paymentId: string;
-  readonly onchainCommitmentId: string | null;
-  readonly status: PaymentStatus;
-}
-/**
- * The host-execution + on-chain-evidence channel for Payments (D2 · #564).
- * SPLIT OFF the public `PaymentsMethods` so an external builder consuming
- * `@capxul/sdk` directly never sees the custody substrate. Reached only via
- * `client.payments._internal` (mirrors `client._internal.*`); the signer-side
- * host (the dev MCP edge / a self-custody integrator) drives it AFTER executing
- * a UserOp. Every input carries the `OnchainEvidence` brand — never a wire field.
- */
-interface PaymentsInternalMethods {
-  /** Report on-chain settlement evidence for an instant payment. */
-  markSettled(input: PaymentSettlementInput, options?: {
-    readonly signal?: AbortSignal;
-  }): Promise<CapxulResult<Payment>>;
-  /**
-   * B3: report on-chain settlement evidence for a withdraw/cash-out. The
-   * backend binds the userOp to a matching external `Transfer` before settling.
-   */
-  markWithdrawalSettled(input: PaymentSettlementInput, options?: {
-    readonly signal?: AbortSignal;
-  }): Promise<CapxulResult<Payment>>;
-  /**
-   * Record the on-chain escrow of a commitment after `createCommitment` returns
-   * its `onchainCommitmentId` (G3 · #546).
-   */
-  markCommitmentCreated(input: CommitmentCreatedInput, options?: {
-    readonly signal?: AbortSignal;
-  }): Promise<CapxulResult<Payment>>;
-  /**
-   * Record a settled ORG spend/payroll on the one `payments` ledger
-   * (D3 · #565) — `source:"org"` + `orgId`, read back as a leak-safe Payment.
-   */
-  recordOrgPayment(input: OrgPaymentRecordInput, options?: {
-    readonly signal?: AbortSignal;
-  }): Promise<CapxulResult<Payment>>;
-  /** Record a recipient-side `claim` after the on-chain claim UserOp settles. */
-  claim(input: CommitmentClaimInput, options?: {
-    readonly signal?: AbortSignal;
-  }): Promise<CapxulResult<Payment>>;
-  /** Record a creator-side `cancel` reclaiming only the unvested remainder. */
-  cancel(input: CommitmentCancelInput, options?: {
-    readonly signal?: AbortSignal;
-  }): Promise<CapxulResult<Payment>>;
-  /** Record a pre-claim `redirect` to a new validated recipient. */
-  redirect(input: CommitmentRedirectInput, options?: {
-    readonly signal?: AbortSignal;
-  }): Promise<CapxulResult<Payment>>;
-  /**
-   * The on-chain commitment reference the signer-side host needs to build a
-   * claim/cancel/redirect UserOp. `onchainCommitmentId` is internal evidence.
-   */
-  commitmentRef(paymentId: string, options?: {
-    readonly signal?: AbortSignal;
-  }): Promise<CapxulResult<PaymentCommitmentRef | null>>;
-}
 /**
  * The PUBLIC, Stripe-shaped Payments surface (D2 · #564). Genus verbs only —
  * `pay` / `list` / `get`. No `userOpHash` / `txHash` / `onchainCommitmentId` /
@@ -1686,15 +1532,14 @@ interface PaymentsMethods {
   pay(input: PaymentsPayInput, options?: {
     readonly signal?: AbortSignal;
   }): Promise<CapxulResult<Payment>>;
-  payout(input: PaymentsPayoutInput, options?: {
+  createCommitment(input: PaymentsPayInput & {
+    readonly timing: Exclude<PaymentTiming, {
+      readonly kind: "instant";
+    }>;
+  }, options?: {
     readonly signal?: AbortSignal;
   }): Promise<CapxulResult<Payment>>;
-  /**
-   * B3 withdraw / cash-out: send USDX from the user's custody Safe to an
-   * external 0x wallet, minting a kind:4 Withdrawal document. Returns a
-   * leak-safe `Payment` (recipient label is the redacted address).
-   */
-  withdraw(input: PaymentsWithdrawInput, options?: {
+  claim(paymentId: string, options?: {
     readonly signal?: AbortSignal;
   }): Promise<CapxulResult<Payment>>;
   list(options?: {
@@ -1706,14 +1551,12 @@ interface PaymentsMethods {
   cancel(paymentId: string, options?: {
     readonly signal?: AbortSignal;
   }): Promise<CapxulResult<Payment>>;
-  /**
-   * Host-execution + on-chain-evidence channel — off the public surface
-   * (production-surface-policy.md pattern). Self-custody integrators drive this;
-   * a Stripe-shaped consumer never does.
-   *
-   * @internal-use
-   */
-  readonly _internal: PaymentsInternalMethods;
+  redirect(input: {
+    readonly paymentId: string;
+    readonly to: TargetReference;
+  }, options?: {
+    readonly signal?: AbortSignal;
+  }): Promise<CapxulResult<Payment>>;
 }
 interface PaymentDocumentsMethods {
   verify(documentHash: string, options?: {
@@ -1728,13 +1571,6 @@ interface PaymentDocumentsMethods {
     readonly signal?: AbortSignal;
   }): Promise<CapxulResult<PaymentDocumentRender>>;
 }
-interface ReconciliationEntry {
-  readonly paymentRequestId: string;
-  readonly reference: string;
-  readonly status: "paid" | "exception";
-  readonly settledPaymentId: string | null;
-  readonly receiptDocumentHash: string | null;
-}
 interface FinancialOpsMethods {
   readonly me: MeMethods;
   readonly handles: HandlesMethods;
@@ -1823,9 +1659,6 @@ interface ActorRequestsMethods {
   cancel(requestId: string, options?: {
     readonly signal?: AbortSignal;
   }): Promise<CapxulResult<ActorRequest>>;
-  reconcile(options?: {
-    readonly signal?: AbortSignal;
-  }): Promise<CapxulResult<readonly ReconciliationEntry[]>>;
 }
 interface InboxItem {
   readonly id: string;
@@ -1849,31 +1682,6 @@ interface InboxMethods {
     readonly signal?: AbortSignal;
   }): Promise<CapxulResult<InboxItem>>;
 }
-interface InsightsSummary {
-  readonly pending: {
-    readonly count: number;
-    readonly total: PaymentMoney;
-  };
-  readonly paidThisMonth: {
-    readonly count: number;
-    readonly total: PaymentMoney;
-  };
-  readonly drafts: {
-    readonly count: number;
-  };
-  readonly reconciliation: {
-    readonly open: number;
-    readonly exceptions: number;
-  };
-}
-interface InsightsMethods {
-  summary(options?: {
-    readonly signal?: AbortSignal;
-  }): Promise<CapxulResult<InsightsSummary>>;
-  history(options?: {
-    readonly signal?: AbortSignal;
-  }): Promise<CapxulResult<readonly Payment[]>>;
-}
 interface ActorProfileMethods {
   get(options?: {
     readonly signal?: AbortSignal;
@@ -1886,7 +1694,6 @@ interface ActorRelationshipMethods {
   readonly addressBook: AddressBookMethods;
   readonly requests: ActorRequestsMethods;
   readonly inbox: InboxMethods;
-  readonly insights: InsightsMethods;
   readonly profile: ActorProfileMethods;
 }
 //#endregion
@@ -1902,7 +1709,7 @@ type AccountStatus = {
   readonly requirement: AccountRequirement;
   readonly chainId: number;
   readonly source: AccountProviderSource;
-  readonly signerAddress: Address;
+  readonly signerAddress: Address$1;
 } | {
   readonly status: "accountPrepared";
   readonly requirement: AccountRequirement;
@@ -1996,35 +1803,7 @@ interface AccountsFaucetMethods {
   }>>;
 }
 //#endregion
-//#region src/domain/org/spend-gate.d.ts
-/**
- * The role's allowed recipients. The address form backs the S4 `spend` path
- * (recipient is a resolved `Address`); the string form backs the G4
- * `spendViaPayments` / `batchPayroll` path, whose recipient is a VALIDATED REF
- * (handle/email/payee/org) compared in the same ref space as the role's set.
- * Comparison is case-insensitive over the raw string value either way.
- */
-type SpendGateRecipients = "anyone" | readonly (Address | string)[];
-type SpendGateSubAccountScope = {
-  readonly scope: "all";
-} | {
-  readonly scope: "only";
-  readonly subAccountIds: readonly SubAccountId[];
-};
-//#endregion
 //#region src/ports/org.d.ts
-/**
- * The minimal `{from, to, amount}` spend shape the authority read keys off
- * (D3 #565). The legacy address-keyed `OrgSpendInput`/`org.spend` lane was
- * hard-removed when `orgSpends` folded into the one `payments` ledger; the
- * leak-safe ref-based lane (`spendViaPayments`/`batchPayroll`) constructs this
- * internally and enforces the real validated recipient on the gate.
- */
-type OrgSpendShape = {
-  readonly from: SubAccountId;
-  readonly to: Address;
-  readonly amount: Money;
-};
 type CreateOrgPortInput = {
   readonly input: CreateOrgInput;
 };
@@ -2050,36 +1829,6 @@ type DetectPendingOrgInvitationsInput = Record<never, never>;
 type DetectPendingOrgInvitationsResult$1 = {
   readonly matched: readonly OrgId[];
 };
-type DeployOrgRolesInput = {
-  readonly orgId: OrgId;
-};
-type OrgRolesDeploymentResult = {
-  readonly orgId: OrgId;
-  readonly roles: readonly RoleView[];
-};
-type GrantOrgRoleInput = {
-  readonly orgId: OrgId;
-  readonly input: AssignRoleInput;
-};
-type RevokeOrgRoleInput = {
-  readonly orgId: OrgId;
-  readonly input: RemoveMemberInput;
-};
-type OrgSpendAuthority = {
-  readonly activeMember: boolean;
-  readonly subAccountBalanceRaw: string;
-  readonly recipients: SpendGateRecipients;
-  readonly subAccounts: SpendGateSubAccountScope;
-  readonly perTxCapRaw?: string | null;
-  readonly perDayCapRaw?: string | null;
-  readonly spentTodayRaw?: string | null;
-  readonly role?: string;
-};
-type ReadOrgSpendAuthorityInput = {
-  readonly orgId: OrgId;
-  readonly input: OrgSpendShape;
-  readonly amountRaw: string;
-};
 declare const OrgError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P] }>) => import("effect/Cause").YieldableError & {
   readonly _tag: "OrgError";
 } & Readonly<A>;
@@ -2107,39 +1856,71 @@ interface OrgPort {
   resendInviteToken?(input: ResendOrgInviteTokenInput): Effect.Effect<MemberView, OrgError, never>;
   detectAndAcceptPendingInvitations(input: DetectPendingOrgInvitationsInput): Effect.Effect<DetectPendingOrgInvitationsResult$1, OrgError, never>;
 }
-interface OrgRolesDeploymentPort {
-  deployRoles(input: DeployOrgRolesInput): Effect.Effect<OrgRolesDeploymentResult, OrgError, never>;
-  grantRole(input: GrantOrgRoleInput): Effect.Effect<MemberView, OrgError, never>;
-  revokeRole(input: RevokeOrgRoleInput): Effect.Effect<void, OrgError, never>;
+//#endregion
+//#region src/contract/permission.d.ts
+interface PermissionReadResult {
+  readonly permissions: readonly Permission[];
+  readonly assignments: readonly PermissionAssignment[];
 }
-type SubmitOrgSpendViaPaymentsInput = {
-  readonly orgId: OrgId;
-  readonly input: OrgSpendViaPaymentsInput;
-  readonly amountRaw: string;
-  readonly authority: OrgSpendAuthority;
+//#endregion
+//#region src/surface/permissions.d.ts
+type PermissionOptions = {
+  readonly signal?: AbortSignal;
 };
-type SubmitOrgBatchPayrollInput = {
-  readonly orgId: OrgId;
-  readonly from: OrgSpendViaPaymentsInput["from"];
-  readonly runs: readonly {
-    readonly run: OrgPayrollRun;
-    readonly amountRaw: string;
-  }[];
-  readonly authorities: readonly OrgSpendAuthority[];
+type PermissionCreateInput = {
+  readonly requestKey: string;
+  readonly intent: PermissionIntent;
 };
-interface OrgSpendPort {
-  readSpendAuthority(input: ReadOrgSpendAuthorityInput): Effect.Effect<OrgSpendAuthority, OrgError, never>;
-  /**
-   * Leak-safe org spend (G4 · #547; D3 #565 — the one ledger of record): execute
-   * the spend through the payments engine (Roles modifier → CapxulPayments),
-   * write a real `payments` row (`source:"org"`) and read it back as a `Payment`
-   * — the wire carries no `txHash` / Safe / userOp internals. Optional so a
-   * hermetic adapter without a payments-submit lane still compiles; absent ⇒ the
-   * program falls back to a deterministic hermetic `Payment`.
-   */
-  submitSpendViaPayments?(input: SubmitOrgSpendViaPaymentsInput): Effect.Effect<Payment, OrgError, never>;
-  /** Leak-safe org payroll batch (G4 · #547): one MultiSend, one Payment per run. */
-  submitBatchPayroll?(input: SubmitOrgBatchPayrollInput): Effect.Effect<readonly Payment[], OrgError, never>;
+type PermissionChangeInput = PermissionCreateInput & {
+  readonly permissionId: string;
+};
+type PermissionAssignInput = {
+  readonly requestKey: string;
+  readonly permissionId: string;
+  readonly accountId: string;
+};
+type PermissionRevokeInput = {
+  readonly requestKey: string;
+  readonly permissionAssignmentId: string;
+};
+type PermissionReplaceInput = {
+  readonly requestKey: string;
+};
+interface PermissionMethods {
+  create(input: PermissionCreateInput, options?: PermissionOptions): Promise<CapxulResult<SubmittedPermissionExecution>>;
+  change(input: PermissionChangeInput, options?: PermissionOptions): Promise<CapxulResult<SubmittedPermissionExecution>>;
+  assign(input: PermissionAssignInput, options?: PermissionOptions): Promise<CapxulResult<SubmittedPermissionExecution>>;
+  revoke(input: PermissionRevokeInput, options?: PermissionOptions): Promise<CapxulResult<SubmittedPermissionExecution>>;
+  replace(input: PermissionReplaceInput, options?: PermissionOptions): Promise<CapxulResult<SubmittedPermissionExecution>>;
+  list(options?: PermissionOptions): Promise<CapxulResult<PermissionReadResult>>;
+  get(permissionId: string, options?: PermissionOptions): Promise<CapxulResult<Permission | null>>;
+}
+//#endregion
+//#region src/surface/organization-payments.d.ts
+interface OrganizationPaymentItemInput {
+  readonly to: Ref$1;
+  readonly amount: PaymentMoney;
+  readonly paymentType?: PaymentType;
+  readonly document?: AttachablePaymentDocumentEnvelopeV1;
+}
+interface OrganizationPaymentInput extends OrganizationPaymentItemInput {
+  readonly permissionId: string;
+  readonly requestKey: string;
+  readonly lineage?: PaymentCommandLineage;
+}
+interface OrganizationPaymentBatchInput {
+  readonly permissionId: string;
+  readonly requestKey: string;
+  readonly items: readonly OrganizationPaymentItemInput[];
+  readonly lineage?: PaymentCommandLineage;
+}
+interface OrganizationPaymentsMethods {
+  pay(input: OrganizationPaymentInput, options?: {
+    readonly signal?: AbortSignal;
+  }): Promise<CapxulResult<Payment>>;
+  payBatch(input: OrganizationPaymentBatchInput, options?: {
+    readonly signal?: AbortSignal;
+  }): Promise<CapxulResult<readonly Payment[]>>;
 }
 //#endregion
 //#region src/surface/org.d.ts
@@ -2162,7 +1943,7 @@ type OrgView = {
   readonly id: OrgId;
   readonly name: string;
   readonly handle: string;
-  readonly safeAddress: Address; /** The viewing member's own role label within this org. */
+  readonly safeAddress: Address$1; /** The viewing member's own role label within this org. */
   readonly role: string; /** The Org treasury — the real M2 Account over the Org Safe (D3). */
   readonly treasury: Account$1; /** #1064: onboarding-collected description + size bucket; null when unset. */
   readonly bio: string | null;
@@ -2194,7 +1975,7 @@ type MemberView = {
   readonly orgId: OrgId;
   readonly email: Email;
   readonly name: string | null; /** Member-identity key (D7). `null` until the invitee provisions a Safe. */
-  readonly personalSafeAddress: Address | null; /** The member's role label (maps deterministically to the on-chain `roleKey`, D9). */
+  readonly personalSafeAddress: Address$1 | null; /** The member's role label (maps deterministically to the on-chain `roleKey`, D9). */
   readonly role: string;
   readonly roleKey: RoleKey | null;
   readonly status: MemberStatus;
@@ -2210,20 +1991,16 @@ type MemberView = {
 type RoleSpendCap = {
   readonly perTx?: Money;
   readonly perDay?: Money;
-  readonly toRecipients?: "anyone" | readonly Address[];
+  readonly toRecipients?: "anyone" | readonly Address$1[];
 };
 /**
  * The Capxul-owned Role DSL definition (D4). `label` becomes the sticky
  * bytes32 `roleKey` on-chain. `spend` compiles to Level-1 on-chain Zodiac
- * conditions; `subAccounts` + `canManage*` compile to Level-2 off-chain Convex
- * guards (D5).
+ * conditions. Management flags compile to off-chain guards.
  */
 type RoleDefinition = {
   readonly label: string;
   readonly spend?: RoleSpendCap;
-  readonly subAccounts?: {
-    readonly scope: "all" | readonly SubAccountId[];
-  };
   readonly canManageMembers?: boolean;
   readonly canManageRoles?: boolean;
 };
@@ -2257,8 +2034,8 @@ type CreateOrgInput = {
 /**
  * Input to `org(orgId).invite` (S3, D8). Email is the universal entry point —
  * inviting an address that is not yet a Capxul user auto-creates a `pending`
- * membership that resolves on sign-in (the virality loop). `role` names the
- * role label the invitee is granted on accept.
+ * membership that resolves on sign-in. `role` is invitation metadata. It does
+ * not grant an L2 Permission.
  */
 type InviteMemberInput = {
   readonly email: string;
@@ -2267,62 +2044,7 @@ type InviteMemberInput = {
 type ResendInviteTokenInput = {
   readonly email: string;
 };
-/**
- * Input to `org(orgId).removeMember` (S3, D8). Keyed on the member's personal
- * Safe address (D7 — Safe-as-identity). Drives the on-chain REVOKE + Convex
- * mirror.
- */
-type RemoveMemberInput = {
-  readonly memberSafeAddress: Address;
-};
-/**
- * Input to `org(orgId).assignRole` (S3, D7/D9). Keyed on the member's personal
- * Safe address (D7). Drives the on-chain GRANT + Convex mirror; the `role`
- * label maps deterministically to the on-chain `roleKey`.
- */
-type AssignRoleInput = {
-  readonly memberSafeAddress: Address;
-  readonly role: string;
-};
-/**
- * Input to `org(orgId).spendViaPayments` (G4 · #547). The LEAK-SAFE org spend:
- * delegates `org.spend` to the payments engine WITH the member's org role
- * authority and returns a `Payment`, not a `txHash`. `to` is a VALIDATED
- * recipient ref (handle / email / payee id / org handle) — never a raw
- * `Address` (the legacy address-keyed `org.spend` lane was hard-removed in D3
- * #565 when `orgSpends` was folded into the one `payments` ledger).
- * `from` is the Level-2 sub-account envelope the spend draws from (D5).
- */
-type OrgSpendViaPaymentsInput = {
-  readonly from: SubAccountId; /** Validated recipient ref (handle/email/payee/org) — never a raw address. */
-  readonly to: Ref$1;
-  readonly amount: Money; /** Full EIP-712 payment document; hashed + stored, committed on-chain. */
-  readonly document?: PaymentDocumentEnvelopeV1;
-  readonly timing?: PaymentTiming;
-  readonly paymentType?: PaymentType;
-};
-/**
- * One run in an `org(orgId).batchPayroll` batch (G4 · #547): a validated
- * recipient, an amount, and an optional payslip document. Each run is gated
- * independently against the role's per-tx / per-day / recipient conditions.
- */
-type OrgPayrollRun = {
-  /** Validated recipient ref (handle/email/payee/org) — never a raw address. */readonly to: Ref$1;
-  readonly amount: Money;
-  readonly timing?: PaymentTiming; /** The payslip — an EIP-712 payment document, committed by `documentHash`. */
-  readonly payslip?: PaymentDocumentEnvelopeV1;
-};
-/**
- * Input to `org(orgId).batchPayroll` (G4 · #547). Pays N employees in one
- * MultiSend through the Roles modifier; each carries a payslip and settles as
- * `paymentType = payroll`. Every run is gated; an over-cap run REJECTS the
- * whole batch (no partial treasury drain). Returns one leak-safe `Payment` per
- * run.
- */
-type OrgBatchPayrollInput = {
-  readonly from: SubAccountId;
-  readonly runs: readonly OrgPayrollRun[];
-};
+/** Organization ids whose pending invitations match the current Account. */
 type DetectPendingOrgInvitationsResult = {
   readonly matched: readonly OrgId[];
 };
@@ -2332,46 +2054,6 @@ type DetectPendingOrgInvitationsResult = {
  * stateful active context). `treasury()` returns the real M2 `Account` over
  * the Org Safe (D3).
  */
-interface PayrollRosterLine {
-  readonly id: string;
-  readonly employee: Ref$1;
-  readonly amount: Money;
-  readonly timing: PaymentTiming;
-  readonly status: "active" | "paused" | "ended";
-}
-interface PayrollPayslipTemplate {
-  readonly title: string;
-  readonly memo?: string;
-}
-interface PayrollRosterAddInput {
-  readonly employee: Ref$1;
-  readonly amount: Money;
-  readonly timing: PaymentTiming;
-  readonly payslipTemplate?: PaymentDocumentEnvelopeV1 | PayrollPayslipTemplate;
-}
-interface PayrollRunInput {
-  readonly from: SubAccountId;
-  readonly period: string;
-}
-interface PayrollMethods {
-  readonly roster: {
-    add(input: PayrollRosterAddInput, options?: {
-      readonly signal?: AbortSignal;
-    }): Promise<CapxulResult<PayrollRosterLine>>;
-    list(options?: {
-      readonly signal?: AbortSignal;
-    }): Promise<CapxulResult<readonly PayrollRosterLine[]>>;
-    update(rosterLineId: string, input: Partial<PayrollRosterAddInput>, options?: {
-      readonly signal?: AbortSignal;
-    }): Promise<CapxulResult<PayrollRosterLine>>;
-    remove(rosterLineId: string, options?: {
-      readonly signal?: AbortSignal;
-    }): Promise<CapxulResult<PayrollRosterLine>>;
-  };
-  run(input: PayrollRunInput, options?: {
-    readonly signal?: AbortSignal;
-  }): Promise<CapxulResult<readonly Payment[]>>;
-}
 interface OrgScopedMethods extends ActorRelationshipMethods {
   /** Observe the durable, leak-safe lifecycle for this Organization only. */
   getLifecycle(options?: {
@@ -2396,36 +2078,17 @@ interface OrgScopedMethods extends ActorRelationshipMethods {
   roles(options?: {
     readonly signal?: AbortSignal;
   }): Promise<CapxulResult<readonly RoleView[]>>;
-  deployRoles(options?: {
-    readonly signal?: AbortSignal;
-  }): Promise<CapxulResult<readonly RoleView[]>>;
   invite(input: InviteMemberInput, options?: {
     readonly signal?: AbortSignal;
   }): Promise<CapxulResult<MemberView>>;
-  removeMember(input: RemoveMemberInput, options?: {
-    readonly signal?: AbortSignal;
-  }): Promise<CapxulResult<void>>;
-  assignRole(input: AssignRoleInput, options?: {
-    readonly signal?: AbortSignal;
-  }): Promise<CapxulResult<MemberView>>;
   /**
-   * Leak-safe org spend (G4 · #547; D3 #565 — the one ledger of record): execute
-   * the spend through the payments engine with the member's org role authority
+   * Leak-safe Organization payment: execute through the payments engine with
+   * the selected receipt-verified Budget Permission
    * and return a `Payment` (no `to: Address`, no `txHash`, no Safe / userOp
    * internals). Writes a real `payments` row (`source:"org"`).
    */
-  spendViaPayments(input: OrgSpendViaPaymentsInput, options?: {
-    readonly signal?: AbortSignal;
-  }): Promise<CapxulResult<Payment>>;
-  /**
-   * Org payroll batch (G4 · #547): pay N employees in one MultiSend through the
-   * Roles modifier, each with a payslip. Every run is gated; an over-cap run
-   * rejects the whole batch. Returns one leak-safe `Payment` per run.
-   */
-  batchPayroll(input: OrgBatchPayrollInput, options?: {
-    readonly signal?: AbortSignal;
-  }): Promise<CapxulResult<readonly Payment[]>>;
-  readonly payroll: PayrollMethods;
+  readonly permissions: PermissionMethods;
+  readonly payments: OrganizationPaymentsMethods;
   auditLog(options?: {
     readonly signal?: AbortSignal;
   }): Promise<CapxulResult<readonly OrganizationAuditLogItem[]>>;
@@ -2526,28 +2189,13 @@ interface SystemMethods {
   }): Promise<CapxulResult<SystemHealth>>;
 }
 //#endregion
-//#region src/surface/sub-accounts.d.ts
-interface SubAccountsMethods {
-  create(accountId: AccountId, input: {
-    readonly name: string;
+//#region src/surface/holdings.d.ts
+interface HoldingsMethods {
+  current(input?: {
+    readonly actor?: ActorReference;
   }, options?: {
     readonly signal?: AbortSignal;
-  }): Promise<CapxulResult<SubAccount>>;
-  get(subAccountId: SubAccountId, options?: {
-    readonly signal?: AbortSignal;
-  }): Promise<CapxulResult<SubAccount | null>>;
-  list(accountId: AccountId, options?: {
-    readonly signal?: AbortSignal;
-  }): Promise<CapxulResult<readonly SubAccount[]>>;
-  rename(subAccountId: SubAccountId, name: string, options?: {
-    readonly signal?: AbortSignal;
-  }): Promise<CapxulResult<SubAccount>>;
-  delete(subAccountId: SubAccountId, options?: {
-    readonly signal?: AbortSignal;
-  }): Promise<CapxulResult<void>>;
-  transfer(input: TransferInput, options?: {
-    readonly signal?: AbortSignal;
-  }): Promise<CapxulResult<TransferResult>>;
+  }): Promise<CapxulResult<CurrentHoldings>>;
 }
 //#endregion
 //#region src/surface/_shared/effect-actor-bridge.d.ts
@@ -2642,6 +2290,7 @@ interface CapxulClient {
    */
   readonly payments: PaymentsMethods;
   readonly activity: ActivityMethods;
+  readonly holdings: HoldingsMethods;
   readonly offramp: OfframpMethods;
   /** Payment document verification (G2 · #545): re-derive the EIP-712 hash. */
   readonly paymentDocuments: PaymentDocumentsMethods;
@@ -2649,13 +2298,11 @@ interface CapxulClient {
    * Media surface (#1061 / ADR-0014): profile-image + org-logo upload/record.
    */
   readonly media: MediaMethods;
-  /** Sub-account lifecycle (M2 Slice S2a · #267). Transfer lands in S2b. */
-  readonly subAccounts: SubAccountsMethods;
   /**
    * Organization domain surface (canon `org-domain-model.md` §C2/§C3, D13).
    * `createOrg(input)` creates an Org; `orgs()` lists the Orgs you belong to;
-   * `org(orgId)` resolves the entity-scoped bundle (treasury / members / roles
-   * / invite / removeMember / assignRole / spend). Explicit entity scoping —
+   * `org(orgId)` resolves the entity-scoped bundle (treasury / members / roles,
+   * invitations, Permissions, and payments). Explicit entity scoping —
    * NO stateful active context (D13). RED until the S1→S4 slices fill it.
    */
   readonly createOrg: OrgMethods["createOrg"];
@@ -2743,10 +2390,6 @@ interface CreateCapxulClientInput {
   readonly orgDeploymentPort?: OrgPort;
   /** Locked D6 data-port name. Prefer over `orgDeploymentPort` in new code. */
   readonly orgPort?: OrgPort;
-  /** S2 deploy/grant/revoke port. S2 uses deploy; S3 adds grant/revoke. */
-  readonly orgRolesDeploymentPort?: OrgRolesDeploymentPort;
-  /** S4 treasury-spend authority + submit port. */
-  readonly orgSpendPort?: OrgSpendPort;
   /**
    * Internal Organization lifecycle capability. The Core SDK owns its
    * choreography; production composition supplies the provider/backend steps.
@@ -2760,5 +2403,4 @@ interface CreateCapxulClientInput {
   };
 }
 //#endregion
-export { InsightsSummary as $, OrgSetupStep as $t, PayrollRosterLine as A, PaymentMoney as At, ActorProfileMethods as B, RecipientResolutionKind as Bt, OrgTemplate as C, PayeesMethods as Ct, PayrollMethods as D, PaymentDocumentRender as Dt, OrganizationAuditLogItem as E, PaymentDocumentRef as Et, RoleSpendCap as F, PaymentsMethods as Ft, AddressBookAddInput as G, TargetsMethods as Gt, ActorRequest as H, Ref$1 as Ht, RoleView as I, PaymentsPayInput as It, AddressBookMethods as J, isSettingUpLifecycle as Jt, AddressBookEntry as K, AccountLifecycle as Kt, AccountsMethods as L, PaymentsPayoutInput as Lt, RemoveMemberInput as M, PaymentStatus as Mt, ResendInviteTokenInput as N, PaymentTiming as Nt, PayrollPayslipTemplate as O, PaymentDocumentVerification as Ot, RoleDefinition as P, PaymentType as Pt, InsightsMethods as Q, OrgLifecycle as Qt, AccountMethods as R, PaymentsWithdrawInput as Rt, OrgSpendViaPaymentsInput as S, Payee as St, OrganizationAccount as T, PaymentDocumentKind as Tt, ActorRequestIssueInput as U, ResolvedTarget as Ut, ActorRelationshipMethods as V, ReconciliationEntry as Vt, ActorRequestsMethods as W, TargetReference as Wt, InboxItem as X, SmartAccountMethods as Xt, InboxApproveInput as Y, IdentityMethods as Yt, InboxMethods as Z, AuthMethods as Zt, MemberView as _, InvocationControls as _n, MeProfile as _t, IdentityRuntimeSendResult as a, TelemetryEvent as an, DepositInstructions as at, OrgPayrollRun as b, OfframpQuoteInput as bt, SystemHealth as c, TelemetryPort as cn, DestinationKind as ct, CurrentUserMethods as d, IdentityState as dn, DestinationRail as dt, WireObservationContext as en, ActivityItem as et, AssignRoleInput as f, OrgLane as fn, DestinationRemoveInput as ft, MemberStatus as g, IdentityTransition as gn, MeMethods as gt, InviteMemberInput as h, destination as hn, HandlesMethods as ht, IdentityRuntime as i, CapxulEnv as in, ActorReference as it, PayrollRunInput as j, PaymentSettlementInput as jt, PayrollRosterAddInput as k, PaymentDocumentsMethods as kt, MediaMethods as l, Destination$1 as ln, DestinationListInput as lt, DetectPendingOrgInvitationsResult as m, StateLabel as mn, FinancialOpsMethods as mt, CreateCapxulClientInput as n, TransferInput as nn, ActivityMethods as nt, SubAccountsMethods as o, TelemetryGroupInput as on, Destination as ot, CreateOrgInput as p, Readiness as pn, DestinationsMethods as pt, AddressBookLabelInput as q, AccountSetupStep as qt, IdentityProfileDetails as r, TransferResult as rn, ActivityPage as rt, SystemMethods as s, TelemetryIdentifyInput as sn, DestinationAddInput as st, CapxulClient as t, TransferEndpoint as tn, ActivityListParams as tt, CurrentUserContext as u, IdentityEvent as un, DestinationPayload as ut, OrgBatchPayrollInput as v, OfframpMethods as vt, OrgView as w, Payment as wt, OrgScopedMethods as x, OfframpStatus as xt, OrgMethods as y, OfframpQuote as yt, ActorProfile as z, RecipientResolution as zt };
-//# sourceMappingURL=create-capxul-client-C7H5b68l.d.mts.map
+export { InboxMethods as $, WireObservationContext as $t, OrganizationPaymentsMethods as A, PaymentDocumentRender as At, AccountMethods as B, RecipientResolutionKind as Bt, ResendInviteTokenInput as C, OfframpQuoteInput as Ct, OrganizationPaymentBatchInput as D, Payment as Dt, RoleView as E, PayeesMethods as Et, PermissionOptions as F, PaymentTiming as Ft, ActorRequestIssueInput as G, AccountLifecycle as Gt, ActorProfileMethods as H, ResolvedTarget as Ht, PermissionReplaceInput as I, PaymentType as It, AddressBookEntry as J, IdentityMethods as Jt, ActorRequestsMethods as K, AccountSetupStep as Kt, PermissionRevokeInput as L, PaymentsMethods as Lt, PermissionChangeInput as M, PaymentDocumentsMethods as Mt, PermissionCreateInput as N, PaymentMoney as Nt, OrganizationPaymentInput as O, PaymentDocumentKind as Ot, PermissionMethods as P, PaymentStatus as Pt, InboxItem as Q, OrgSetupStep as Qt, PermissionReadResult as R, PaymentsPayInput as Rt, OrganizationAuditLogItem as S, OfframpQuote as St, RoleSpendCap as T, Payee as Tt, ActorRelationshipMethods as U, TargetReference as Ut, ActorProfile as V, Ref$1 as Vt, ActorRequest as W, TargetsMethods as Wt, AddressBookMethods as X, AuthMethods as Xt, AddressBookLabelInput as Y, SmartAccountMethods as Yt, InboxApproveInput as Z, OrgLifecycle as Zt, OrgMethods as _, IdentityTransition as _n, FinancialOpsMethods as _t, IdentityRuntimeSendResult as a, TelemetryEvent as an, ActivityPage as at, OrgView as b, MeProfile as bt, SystemHealth as c, TelemetryPort as cn, DepositInstructions as ct, CurrentUserMethods as d, IdentityEvent as dn, DestinationKind as dt, CurrentHoldings as en, ActivityAnnotationInput as et, CreateOrgInput as f, IdentityState as fn, DestinationListInput as ft, MemberView as g, destination as gn, DestinationsMethods as gt, MemberStatus as h, StateLabel as hn, DestinationRemoveInput as ht, IdentityRuntime as i, CapxulEnv as in, ActivityMethods as it, PermissionAssignInput as j, PaymentDocumentVerification as jt, OrganizationPaymentItemInput as k, PaymentDocumentRef as kt, MediaMethods as l, CAPXUL_PAYMENTS_V2_ADDRESS as ln, Destination as lt, InviteMemberInput as m, Readiness as mn, DestinationRail as mt, CreateCapxulClientInput as n, Permission as nn, ActivityItem as nt, HoldingsMethods as o, TelemetryGroupInput as on, ActivityReference as ot, DetectPendingOrgInvitationsResult as p, OrgLane as pn, DestinationPayload as pt, AddressBookAddInput as q, isSettingUpLifecycle as qt, IdentityProfileDetails as r, SubmittedPermissionExecution as rn, ActivityListParams as rt, SystemMethods as s, TelemetryIdentifyInput as sn, ActorReference as st, CapxulClient as t, MovementAnnotation as tn, ActivityDetail as tt, CurrentUserContext as u, Destination$1 as un, DestinationAddInput as ut, OrgScopedMethods as v, InvocationControls as vn, HandlesMethods as vt, RoleDefinition as w, OfframpStatus as wt, OrganizationAccount as x, OfframpMethods as xt, OrgTemplate as y, MeMethods as yt, AccountsMethods as z, RecipientResolution as zt };