@capxul/sdk 2.3.2 → 2.5.0

package/dist/{create-capxul-client-DgvnboPR.mjs → create-capxul-client-Btl4qyNC.mjs}

@@ -1,4 +1,4 @@
-import { A as toPartyId, I as CapxulError, L as EXPECTED_OPERATION_OUTCOMES, M as toRoleKey, R as Errors, S as toCurrencyCode, b as toChainId, c as BYTES32_RE, d as WEI_RE, f as ZERO_BYTES32, h as toAddress, k as toOrgId, l as EVM_ADDRESS_RE$1, m as toAccountId, n as BrowserAuthCacheAdapter, s as APP_ID_RE, t as InMemoryAuthCacheAdapter, u as SUPPORTED_CURRENCY_CODES, v as toAuthUserId, w as toEmail, x as toCountryCode, y as toBudgetId, z as isCapxulError } from "./InMemoryAuthCacheAdapter-qMpBOGb3.mjs";
+import { A as toPartyId, B as Errors, M as toPayrollRunId, P as toRoleKey, R as CapxulError, S as toCurrencyCode, V as isCapxulError, b as toChainId, c as BYTES32_RE, d as WEI_RE, f as ZERO_BYTES32, h as toAddress, j as toPayrollGroupId, k as toOrgId, l as EVM_ADDRESS_RE$1, m as toAccountId, n as BrowserAuthCacheAdapter, s as APP_ID_RE, t as InMemoryAuthCacheAdapter, u as SUPPORTED_CURRENCY_CODES, v as toAuthUserId, w as toEmail, x as toCountryCode, y as toBudgetId, z as EXPECTED_OPERATION_OUTCOMES } from "./InMemoryAuthCacheAdapter-D5Cv0yz0.mjs";
 import { concat, encodeAbiParameters, encodeFunctionData, encodePacked, formatUnits, getContractAddress, keccak256, padHex, parseUnits, recoverAddress, stringToHex, toBytes, toEventSelector, toFunctionSelector, toFunctionSignature } from "viem";
 import { Context, Data, Deferred, Effect, Exit, Fiber, Layer, Queue, Ref, Result, Schema, SchemaGetter, Scope } from "effect";
 import { makeFunctionReference } from "convex/server";
@@ -1291,1078 +1291,249 @@ new Map([
 	["setAllowance(bytes32,uint128,uint128,uint128,uint64,uint64)", "SetAllowance(bytes32,uint128,uint128,uint128,uint64,uint64)"]
 ].map(([functionSignature, eventSignature]) => [toFunctionSelector(functionSignature), toEventSelector(eventSignature)]));
 //#endregion
-//#region src/surface/_shared/provisioning-telemetry.ts
-async function emitProvisioningTelemetry(telemetry, smartAccount) {
-	if (telemetry === void 0) return;
-	await Effect.runPromise(telemetry.emit({
-		name: "provisioning_safe_created",
-		props: { safe_address: smartAccount.smartAccountAddress }
-	}).pipe(Effect.catch((cause) => Effect.sync(() => reportProvisioningTelemetryFailure("error", smartAccount, cause))), Effect.catchDefect((cause) => Effect.sync(() => reportProvisioningTelemetryFailure("defect", smartAccount, cause)))));
-}
-function reportProvisioningTelemetryFailure(kind, smartAccount, cause) {
-	if (!isProvisioningTelemetryDebugEnabled()) return;
-	globalThis.console?.warn?.("[capxul] provisioning telemetry dropped", {
-		kind,
-		safeAddress: smartAccount.smartAccountAddress,
-		cause
-	});
-}
-function isProvisioningTelemetryDebugEnabled() {
-	return globalThis.process?.env?.CAPXUL_DEBUG_TELEMETRY === "1";
-}
-//#endregion
-//#region src/telemetry/get-failure-mode.ts
+//#region ../wire/src/brands.ts
+const lowercasedString = Schema.String.pipe(Schema.decodeTo(Schema.String, {
+	decode: SchemaGetter.transform((value) => value.toLowerCase()),
+	encode: SchemaGetter.transform((value) => value)
+}));
+const addressSchema = (name) => lowercasedString.pipe(Schema.refine((value) => EVM_ADDRESS_RE$1.test(value), { message: `${name} must be a 0x-prefixed EVM address` }));
+const bytes32BrandSchema = (name) => lowercasedString.pipe(Schema.refine((value) => BYTES32_RE.test(value), { message: `${name} must be a 0x-prefixed bytes32 value` }));
+/** Lowercase, 0x-prefixed bytes32 evidence without a public brand. */
+const Bytes32Schema = bytes32BrandSchema("value");
+const AddressSchema$1 = addressSchema("address");
+const SafeAddressSchema = addressSchema("safe address");
+const ModuleAddressSchema = addressSchema("module address");
+const TxHashSchema$1 = bytes32BrandSchema("transaction hash");
+const RoleKeySchema = bytes32BrandSchema("role key");
+const AllowanceKeySchema = bytes32BrandSchema("allowance key");
+const BlockNumberSchema$1 = Schema.Number.pipe(Schema.refine((value) => Number.isSafeInteger(value) && value >= 0, { message: "must be a non-negative safe integer" }));
+const LogIndexSchema = Schema.Number.pipe(Schema.refine((value) => Number.isSafeInteger(value) && value >= 0, { message: "must be a non-negative safe integer" }));
+const WeiAmountSchema$1 = Schema.String.pipe(Schema.refine((value) => WEI_RE.test(value), { message: "must be a non-negative integer string" }));
+const SettlementIdSchema = bytes32BrandSchema("settlementId").pipe(Schema.refine((value) => value !== ZERO_BYTES32, { message: "settlementId must not be zero" }));
 /**
-* The five canonical {@link FailureMode} members, for runtime membership checks.
-* Single source of truth — tests assert against this exact set so the taxonomy
-* and its guard can never drift apart.
+* `AppId` schema. Mirrors `toAppId` from `@capxul/types`:
+* `app_` + Crockford-base32 ULID (26 chars, first char in `[0-7]`).
 */
-const FAILURE_MODES = new Set([
-	"auth-origin-mismatch",
-	"stale-openfort-cache",
-	"app-env-allowlist",
-	"no-secure-context",
-	"unknown"
-]);
-function isFailureMode(value) {
-	return typeof value === "string" && FAILURE_MODES.has(value);
-}
+const AppIdSchema$1 = Schema.String.pipe(Schema.refine((s) => APP_ID_RE.test(s), { message: "must be app_ plus a ULID" }));
 /**
-* Extract the structured {@link FailureMode} from a CapxulError.
-*
-* Reads `details.failure_mode` and returns it only when it is one of the five
-* canonical members; any other value (a legacy free string, a typo, a
-* non-string) yields `undefined` so downstream telemetry never reports an
-* unrecognised cause.
+* `ChainId` schema. Mirrors `toChainId`: positive safe integer.
 */
-function getFailureMode(error) {
-	if (!isCapxulError(error)) return void 0;
-	const details = error.details;
-	if (details === void 0) return void 0;
-	return isFailureMode(details.failure_mode) ? details.failure_mode : void 0;
-}
+const ChainIdSchema$1 = Schema.Number.pipe(Schema.refine((n) => Number.isSafeInteger(n) && n > 0, { message: "must be a positive safe integer" }));
 /**
-* Resolve the canonical {@link FailureMode} for a `$exception`, guaranteeing a
-* taxonomy member is always returned — never `undefined`, never a free string.
-*
-* Resolution order:
-* 1. the structured mode on the error's `details.failure_mode` (already guarded);
-* 2. a caller-supplied `contextFailureMode`, but ONLY when it passes the same
-*    runtime membership check — the static `FailureMode` type is erased at
-*    runtime, so an operation string (e.g. `"signer-get-address"`) injected via
-*    a JS caller or `as` cast is rejected here rather than leaking to telemetry;
-* 3. `"unknown"` otherwise, so an unclassifiable error is still tagged with a
-*    canonical value instead of being emitted with no `failure_mode` at all.
+* `CurrencyCode` schema. Mirrors `toCurrencyCode`: currently supported
+* consumer-facing ISO-ish currency code set.
 */
-function resolveFailureMode(error, contextFailureMode) {
-	return getFailureMode(error) ?? (isFailureMode(contextFailureMode) ? contextFailureMode : "unknown");
-}
-//#endregion
-//#region src/signer.ts
-const EVM_ADDRESS_HEX = /^0x[0-9a-fA-F]{40}$/;
-const ECDSA_SIGNATURE_HEX = /^0x[0-9a-fA-F]{130}$/;
-const SAFE_OP_DIGEST_HEX = /^0x[0-9a-fA-F]{64}$/;
+const CurrencyCodeSchema$1 = Schema.String.pipe(Schema.refine((s) => SUPPORTED_CURRENCY_CODES.includes(s), { message: "must be a supported currency code" }));
+const DOCUMENT_HASH_HEX_RE = /^[0-9a-fA-F]{64}$/;
 /**
-* The readiness store a signer reports when it runs no readiness cycle. It
-* fails CLOSED: a node key signer or an injected wallet never claims `ready`,
-* so a gate that reads this never opens on a guess.
+* `DocumentHash` schema. Mirrors `toDocumentHash`: bare or 0x-prefixed bytes32,
+* normalized to lowercase 0x-prefixed form.
 */
-const UNOBSERVABLE_SIGNER_STATUS = {
-	status: () => "unknown",
-	subscribe: () => () => void 0
-};
+const DocumentHashSchema = Schema.String.pipe(Schema.decodeTo(Schema.String, {
+	decode: SchemaGetter.transform((s) => {
+		const stripped = s.startsWith("0x") || s.startsWith("0X") ? s.slice(2) : s;
+		return DOCUMENT_HASH_HEX_RE.test(stripped) ? `0x${stripped.toLowerCase()}` : s;
+	}),
+	encode: SchemaGetter.transform((s) => s)
+}), Schema.refine((s) => BYTES32_RE.test(s), { message: "must be 32 bytes of hex" }));
+/** L2 orchestrated money evidence requires a nonzero Document hash. */
+const NonzeroDocumentHashSchema = DocumentHashSchema.pipe(Schema.refine((value) => value !== ZERO_BYTES32, { message: "documentHash must not be zero" }));
 /**
-* Walk an error and its `cause` links once each. A self-referential chain
-* terminates. Both signer predicates read the chain, so they read it here.
+* `SessionToken` schema. Mirrors `toSessionToken`: non-empty string.
+* Issuance source distinguishes SDK-handshake tokens from auth-session
+* tokens; the brand itself is opaque.
 */
-function* causeChain(cause) {
-	const seen = /* @__PURE__ */ new Set();
-	let current = cause;
-	while (typeof current === "object" && current !== null && !seen.has(current)) {
-		seen.add(current);
-		yield current;
-		current = current.cause;
-	}
-}
-/** Fold a signer throw into the public error contract. */
-function signerFailure(source, operation, cause) {
-	let failureMode;
-	for (const link of causeChain(cause)) {
-		if (link instanceof CapxulError && link.code === "SIGNER_REJECTED") return link;
-		failureMode = getFailureMode(link) ?? failureMode;
-		const error = link;
-		if (error.code === 4001 || error.error === "passkey_user_cancelled") return Errors.signerRejected({
-			source,
-			cause
-		});
-	}
-	return Errors.providerError("signer", operation, cause, failureMode === void 0 ? void 0 : { failure_mode: failureMode });
-}
+const SessionTokenSchema = Schema.String.pipe(Schema.refine((s) => s.length > 0, { message: "must be a non-empty string" }));
 /**
-* Browser `CapxulSigner` backed by an injected EIP-1193 wallet (MetaMask, etc.).
-* Signs the SafeOp digest via `eth_sign`, then verifies the returned signature
-* recovers the selected account against that raw digest. Wallets that prefix
-* `eth_sign` payloads are rejected before the backend submits an invalid SafeOp.
-* The node key signer lives in `@capxul/sdk/node` (`localPrivateKeySigner`).
+* `EpochMs` schema. Mirrors `toEpochMs`: non-negative safe integer.
 */
-function injectedWalletSigner(provider) {
-	const resolveAddress = async () => {
-		const accounts = await provider.request({ method: "eth_requestAccounts" });
-		const first = Array.isArray(accounts) ? accounts[0] : void 0;
-		if (typeof first !== "string") throw new Error("injectedWalletSigner: wallet returned no accounts");
-		if (!EVM_ADDRESS_HEX.test(first)) throw new Error("injectedWalletSigner: wallet returned invalid address format");
-		return toAddress(first);
-	};
-	return {
-		source: "injected-eip1193",
-		getAddress: resolveAddress,
-		async signUserOpHash(hash) {
-			if (!SAFE_OP_DIGEST_HEX.test(hash)) throw new Error("injectedWalletSigner: SafeOp digest must be a 0x-prefixed 32-byte hex");
-			const address = await resolveAddress();
-			let signature;
-			try {
-				signature = await provider.request({
-					method: "eth_sign",
-					params: [address, hash]
-				});
-			} catch (cause) {
-				const detail = cause instanceof Error ? cause.message : String(cause);
-				throw new Error(`injectedWalletSigner: eth_sign failed; enable raw-hash signing for deployment (${detail})`, { cause });
-			}
-			if (typeof signature !== "string") throw new Error("injectedWalletSigner: wallet returned a non-string signature");
-			if (!ECDSA_SIGNATURE_HEX.test(signature)) throw new Error("injectedWalletSigner: wallet returned invalid signature format");
-			if ((await recoverRawDigestSigner({
-				hash,
-				signature
-			})).toLowerCase() !== address.toLowerCase()) throw new Error("injectedWalletSigner: wallet signature did not recover the selected account for the raw SafeOp digest; use a raw-hash-capable wallet or @capxul/sdk/node localPrivateKeySigner for deployed flows");
-			return signature;
-		}
-	};
-}
-async function recoverRawDigestSigner(input) {
+const EpochMsSchema$1 = Schema.Number.pipe(Schema.refine((n) => Number.isSafeInteger(n) && n >= 0, { message: "must be a non-negative safe integer" }));
+/**
+* `DurationMs` schema. Mirrors `toDurationMs`: non-negative safe integer.
+*/
+const DurationMsSchema$1 = Schema.Number.pipe(Schema.refine((n) => Number.isSafeInteger(n) && n >= 0, { message: "must be a non-negative safe integer" }));
+//#endregion
+//#region ../wire/src/bootstrap.ts
+const PUBLIC_POSTHOG_PROJECT_TOKEN = /^phc_[A-Za-z0-9_-]{1,191}$/u;
+const PostHogIngestOrigin = Schema.String.pipe(Schema.refine((value) => {
 	try {
-		return toAddress(await recoverAddress(input));
-	} catch (cause) {
-		const detail = cause instanceof Error ? cause.message : String(cause);
-		throw new Error(`injectedWalletSigner: could not verify raw SafeOp digest signature (${detail})`, { cause });
+		const url = new URL(value);
+		return url.protocol === "https:" && url.username.length === 0 && url.password.length === 0 && url.pathname === "/" && url.search.length === 0 && url.hash.length === 0 && (url.hostname === "posthog.com" || url.hostname.endsWith(".posthog.com"));
+	} catch {
+		return false;
 	}
-}
+}, { message: "must be a credential-free PostHog HTTPS ingest origin" }));
+const EngineeringTelemetryBootstrapPolicy = Schema.Struct({
+	host: PostHogIngestOrigin,
+	projectToken: Schema.String.pipe(Schema.refine((value) => PUBLIC_POSTHOG_PROJECT_TOKEN.test(value), { message: "must be a public PostHog project token" })),
+	capxulEnv: Schema.Union([
+		Schema.Literal("development"),
+		Schema.Literal("staging"),
+		Schema.Literal("production"),
+		Schema.Literal("local")
+	])
+});
+/**
+* `BootstrapEnvelope` v1.
+*
+* - `protocol`: discriminator that lets future protocols coexist on the
+*   same endpoint without a wire-shape conflict.
+* - `version`: numeric version inside the protocol. Unknown versions MUST
+*   fail decode with an INVALID_INPUT-class `CapxulError` at the SDK seam.
+* - `state`: the resolved bootstrap payload. Field shape matches the
+*   `BootstrapResolution` port; the SDK consumer can pass `state`
+*   directly (after `normalizeRuntimeUrl` on the two URL fields) into
+*   the port without re-branding.
+*/
+const BootstrapEnvelope = Schema.Struct({
+	protocol: Schema.Literal("capxul.bootstrap"),
+	version: Schema.Literal(1),
+	state: Schema.Struct({
+		applicationId: AppIdSchema$1,
+		chainId: ChainIdSchema$1,
+		sessionToken: SessionTokenSchema,
+		issuedAt: EpochMsSchema$1,
+		expiresIn: DurationMsSchema$1,
+		authBaseUrl: Schema.String,
+		convexUrl: Schema.String,
+		siteBaseUrl: Schema.String,
+		openfortPublishableKey: Schema.String,
+		shieldPublishableKey: Schema.String,
+		engineeringTelemetry: Schema.optional(EngineeringTelemetryBootstrapPolicy)
+	})
+});
 //#endregion
-//#region src/internal/invocation-observation.ts
-const INVOCATION_OBSERVATION = Symbol("capxul.invocation-observation");
-const FAILURE_INVOCATION_SNAPSHOT = Symbol("capxul.failure-invocation-snapshot");
-/** @internal Attach one immutable, non-wire invocation snapshot to an SDK-owned object. */
-function attachInvocationObservation(target, source) {
-	const snapshot = Object.freeze(source.context === void 0 ? { active: source.active } : {
-		active: source.active,
-		context: Object.freeze({ ...source.context })
-	});
-	Object.defineProperty(target, INVOCATION_OBSERVATION, {
-		configurable: false,
-		enumerable: false,
-		value: snapshot,
-		writable: false
-	});
-	return target;
-}
-/** @internal Read the snapshot without exposing its symbol or adding a wire field. */
-function readInvocationObservation(source) {
-	if (typeof source !== "object" || source === null) return void 0;
-	return source[INVOCATION_OBSERVATION];
-}
-/** @internal Carry a snapshot across an SDK adapter projection without resolving again. */
-function copyInvocationObservation(source, target) {
-	const snapshot = readInvocationObservation(source);
-	return snapshot === void 0 ? target : attachInvocationObservation(target, snapshot);
-}
-/** @internal Carry the public call-start delivery decision with its failure envelope. */
-function markFailureInvocationSnapshot(failure, snapshot) {
-	Object.defineProperty(failure, FAILURE_INVOCATION_SNAPSHOT, {
-		configurable: false,
-		enumerable: false,
-		value: Object.freeze(snapshot),
-		writable: false
-	});
-	return failure;
-}
-/** @internal Read the call-start delivery decision; undefined means a direct adapter call. */
-function readFailureInvocationSnapshot(failure) {
-	if (typeof failure !== "object" || failure === null) return void 0;
-	const snapshot = failure[FAILURE_INVOCATION_SNAPSHOT];
-	return typeof snapshot === "object" && snapshot !== null && "active" in snapshot ? snapshot : void 0;
-}
-//#endregion
-//#region src/domain/machine/telemetry.ts
-const definedEntries = (values) => Object.fromEntries(Object.entries(values).filter((entry) => entry[1] !== void 0));
-const SAFE_ENGINEERING_ID = /^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$/u;
-const safeEngineeringIdentifier = (value) => value !== void 0 && SAFE_ENGINEERING_ID.test(value) ? value : void 0;
-const portFailureOutcome = (code) => code === "CANCELLED" ? "cancelled" : "failed";
-function formatTraceparent(span) {
-	const traceId = span.traceId.toLowerCase();
-	const spanId = span.spanId.toLowerCase();
-	if (!/^[0-9a-f]{32}$/u.test(traceId) || !/^[0-9a-f]{16}$/u.test(spanId)) return void 0;
-	if (/^0+$/u.test(traceId) || /^0+$/u.test(spanId)) return void 0;
-	return `00-${traceId}-${spanId}-${span.sampled ? "01" : "00"}`;
-}
-/** Canonical, bounded fields for the one wide engineering log owned by P3. */
-const transitionLogFields = (record) => {
-	const { correlation_id, journey_id, ...canonical } = record;
-	const safeCorrelation = safeEngineeringIdentifier(correlation_id);
-	const safeJourney = safeEngineeringIdentifier(journey_id);
-	return definedEntries({
-		...canonical,
-		...safeCorrelation === void 0 ? {} : { correlation_id: safeCorrelation },
-		...safeJourney === void 0 ? {} : { journey_id: safeJourney }
-	});
-};
-/** The shell span owns transition/refusal classification and no other seam's fields. */
-const transitionSpanFields = (record) => {
-	if (record.outcome === "applied") return {
-		machine: record.machine,
-		from: record.from,
-		event: record.event,
-		to: record.to
-	};
-	return {
-		machine: record.machine,
-		state: record.state,
-		event: record.event,
-		...record.outcome === "refused" ? { refused: record.refusal_code } : {}
-	};
-};
+//#region ../wire/src/functions.ts
 /**
-* Emit engineering telemetry as an isolated side effect. Exporter/logger defects
-* can never change the actor's transition, reply, or P3 observer cardinality.
+* Backend function paths, keyed by Convex module path then export name.
+*
+* Invariant (gate-enforced): `CAPXUL_FUNCTIONS[m][e] === \`${m}:${e}\``.
 */
-const logIdentityTransition = (record) => (record.outcome === "applied" ? Effect.logInfo("identity.transition") : record.outcome === "failed" ? Effect.logError("identity.transition") : Effect.logWarning("identity.transition")).pipe(Effect.annotateLogs(transitionLogFields(record)), Effect.andThen(record.outcome === "applied" ? Effect.void : Effect.fail({ code: record.outcome === "refused" ? record.refusal_code : record.error_code })), Effect.withSpan("identity.transition"), Effect.annotateSpans(transitionSpanFields(record)), Effect.catchCause(() => Effect.void));
-//#endregion
-//#region src/domain/machine/shell.ts
-const INVOCATION_PARENT_SPAN = Symbol("@capxul/sdk/identity-invocation-parent-span");
-function carryInvocationParentSpan(controls, parent) {
-	return {
-		...controls,
-		[INVOCATION_PARENT_SPAN]: parent
-	};
-}
-function withInvocationParentSpan(effect, controls) {
-	const parent = controls?.[INVOCATION_PARENT_SPAN];
-	return parent === void 0 ? effect : effect.pipe(Effect.withParentSpan(parent));
-}
-var ActorFailure = class extends Error {
-	reason;
-	machine;
-	state;
-	event;
-	details;
-	_tag = "ActorFailure";
-	constructor(reason, machine, state, event, details) {
-		super(`${machine}:${state}:${event} ${reason}`);
-		this.reason = reason;
-		this.machine = machine;
-		this.state = state;
-		this.event = event;
-		this.details = details;
-		this.name = "ActorFailure";
-	}
-};
-const duration = (startedAt) => Math.max(0, Date.now() - startedAt);
-const failReply = (reply, failure) => reply === null ? Effect.void : Effect.asVoid(Deferred.fail(reply, failure));
-const withCarriage = (controls) => ({
-	...controls.correlation_id === void 0 ? {} : { correlation_id: controls.correlation_id },
-	...controls.journey_id === void 0 ? {} : { journey_id: controls.journey_id }
-});
-const timeoutFailure = {
-	code: "PROVIDER_ERROR",
-	message: "Identity work timed out"
-};
-const cancelledFailure = {
-	code: "CANCELLED",
-	message: "Identity work cancelled"
-};
-const abort = (signal) => signal.aborted ? Effect.fail(cancelledFailure) : Effect.callback((resume) => {
-	const onAbort = () => resume(Effect.fail(cancelledFailure));
-	signal.addEventListener("abort", onAbort, { once: true });
-	return Effect.sync(() => signal.removeEventListener("abort", onAbort));
-});
-const control = (effect, controls) => {
-	let controlled = effect;
-	const deadlineDelay = controls.deadlineMs === void 0 ? void 0 : Math.max(0, controls.deadlineMs - Date.now());
-	const timeoutMs = controls.timeoutMs === void 0 ? deadlineDelay : deadlineDelay === void 0 ? controls.timeoutMs : Math.min(controls.timeoutMs, deadlineDelay);
-	if (timeoutMs !== void 0) controlled = controlled.pipe(Effect.timeoutOrElse({
-		duration: `${timeoutMs} millis`,
-		orElse: () => Effect.fail(timeoutFailure)
-	}));
-	if (controls.signal !== void 0) controlled = Effect.raceFirst(controlled, abort(controls.signal));
-	return controlled;
-};
-const boot = (spec, options = {}) => Effect.gen(function* () {
-	const mailbox = yield* Queue.unbounded();
-	const cell = yield* Ref.make(spec.initial);
-	const slotEpochs = /* @__PURE__ */ new Map();
-	const slots = /* @__PURE__ */ new Map();
-	const stateObservers = /* @__PURE__ */ new Set();
-	const transitionObservers = /* @__PURE__ */ new Set();
-	let bootTransitionObserver = options.onTransition;
-	let stopped = false;
-	const defect = (cause) => {
-		try {
-			options.onDefect?.(cause);
-		} catch {}
-	};
-	const emit = (record) => Effect.sync(() => {
-		if (bootTransitionObserver !== void 0) try {
-			bootTransitionObserver(record);
-		} catch (cause) {
-			bootTransitionObserver = void 0;
-			defect(cause);
-		}
-		for (const observer of transitionObservers) try {
-			observer(record);
-		} catch (cause) {
-			transitionObservers.delete(observer);
-			defect(cause);
-		}
-	}).pipe(Effect.andThen(logIdentityTransition(record)));
-	const notify = (state) => {
-		for (const observer of stateObservers) try {
-			observer(state);
-		} catch (cause) {
-			stateObservers.delete(observer);
-			defect(cause);
-		}
-	};
-	const makeFailure = (state, event, reason, details) => new ActorFailure(reason, spec.machine, spec.label(state), event._tag, details);
-	const nonApplied = (state, event, reason, outcome, env) => {
-		const slot = env.origin?.slot ?? spec.slot(event);
-		return copyInvocationObservation(env.invocation, {
-			machine: spec.machine,
-			state: spec.label(state),
-			event: event._tag,
-			slot,
-			epoch: env.origin?.epoch ?? slotEpochs.get(slot) ?? 0,
-			outcome,
-			duration_ms: duration(env.startedAt),
-			...withCarriage(env.invocation),
-			...outcome === "refused" ? { refusal_code: reason } : { error_code: reason }
-		});
-	};
-	const applied = (from, to, event, slot, epoch, env) => copyInvocationObservation(env.invocation, {
-		machine: spec.machine,
-		from: spec.label(from),
-		event: event._tag,
-		to: spec.label(to),
-		slot,
-		epoch,
-		outcome: "applied",
-		duration_ms: duration(env.startedAt),
-		...withCarriage(env.invocation)
-	});
-	const finish = (cursor, state) => {
-		const held = slots.get(cursor.slot);
-		if (held === void 0 || held.cursor !== cursor) return Effect.void;
-		slots.delete(cursor.slot);
-		return Effect.asVoid(Deferred.succeed(held.reply, state));
-	};
-	const recoverFailure = (state, cursor, failure) => {
-		const event = spec.recoverFailure?.(state, cursor.event, failure);
-		if (event === void 0) return Effect.succeed(state);
-		const outcome = spec.transition(state, event);
-		if ("refused" in outcome) return Effect.succeed(state);
-		return Ref.set(cell, outcome.next).pipe(Effect.tap(() => {
-			return emit(applied(state, outcome.next, event, cursor.slot, cursor.epoch, {
-				invocation: cursor.invocation,
-				startedAt: cursor.startedAt
-			})).pipe(Effect.andThen(Effect.sync(() => {
-				notify(outcome.next);
-			})));
-		}), Effect.as(outcome.next));
-	};
-	const step = (env) => Effect.gen(function* () {
-		const state = yield* Ref.get(cell);
-		if (env.origin !== null && (slotEpochs.get(env.origin.slot) ?? 0) !== env.origin.epoch) {
-			const held = slots.get(env.origin.slot);
-			if (held === void 0 || held.cursor !== env.origin) return;
-			slots.delete(env.origin.slot);
-			const event = { _tag: env.origin.event };
-			yield* emit(nonApplied(state, event, "STALE_EPOCH", "refused", env));
-			yield* failReply(held.reply, makeFailure(state, event, "STALE_EPOCH"));
-			return;
-		}
-		if (env.origin !== null && env.event._tag === "~lane/exit") {
-			const exit = env.event;
-			const held = slots.get(env.origin.slot);
-			if (held === void 0 || held.cursor !== env.origin) return;
-			if (exit.defect !== void 0) {
-				slots.delete(env.origin.slot);
-				defect(exit.defect);
-				const event = { _tag: env.origin.event };
-				const failedState = yield* recoverFailure(state, env.origin, {
-					code: "WORK_DIED",
-					message: "Identity work died"
-				});
-				yield* emit(nonApplied(failedState, event, "WORK_DIED", "failed", env));
-				yield* failReply(held.reply, makeFailure(failedState, event, "WORK_DIED"));
-				return;
-			}
-			if (exit.failure !== void 0) {
-				slots.delete(env.origin.slot);
-				const outcome = exit.failure.code === "CANCELLED" ? "cancelled" : "failed";
-				const event = { _tag: env.origin.event };
-				const failedState = exit.failure === timeoutFailure || exit.failure === cancelledFailure ? yield* recoverFailure(state, env.origin, exit.failure) : state;
-				yield* emit(nonApplied(failedState, event, exit.failure.code, outcome, env));
-				const details = exit.failure === timeoutFailure ? { reason: "timeout" } : void 0;
-				yield* failReply(held.reply, makeFailure(failedState, event, exit.failure.code, details));
-				return;
-			}
-			yield* finish(env.origin, state);
-			return;
-		}
-		const outcome = spec.transition(state, env.event);
-		if ("refused" in outcome) {
-			yield* emit(nonApplied(state, env.event, outcome.refused, "refused", env));
-			yield* failReply(env.reply, makeFailure(state, env.event, outcome.refused));
-			return;
-		}
-		const next = outcome.next;
-		yield* Ref.set(cell, next);
-		const emitApplied = (slot, epoch) => emit(applied(state, next, env.event, slot, epoch, env));
-		if (env.origin !== null) {
-			yield* emitApplied(env.origin.slot, env.origin.epoch);
-			notify(next);
-			return;
-		}
-		for (const slot of spec.invalidates?.(env.event) ?? []) {
-			if (!slots.has(slot)) continue;
-			slotEpochs.set(slot, (slotEpochs.get(slot) ?? 0) + 1);
-		}
-		const work = env.reply === null ? void 0 : spec.work?.({
-			state: next,
-			event: env.event
-		});
-		if (work === void 0 || env.reply === null) {
-			const slot = spec.slot(env.event);
-			yield* emitApplied(slot, slotEpochs.get(slot) ?? 0);
-			notify(next);
-			if (env.reply !== null) yield* Deferred.succeed(env.reply, next).pipe(Effect.asVoid);
-			return;
-		}
-		const previous = slots.get(work.slot);
-		if (previous !== void 0) {
-			slots.delete(work.slot);
-			yield* Fiber.interrupt(previous.fiber);
-			const previousEvent = { _tag: previous.cursor.event };
-			const reason = previous.cursor.epoch === (slotEpochs.get(work.slot) ?? 0) ? "SUPERSEDED" : "STALE_EPOCH";
-			yield* emit(nonApplied(next, previousEvent, reason, "refused", {
-				origin: previous.cursor,
-				invocation: previous.cursor.invocation,
-				startedAt: previous.cursor.startedAt
-			}));
-			yield* failReply(previous.reply, makeFailure(next, previousEvent, reason));
-		}
-		const epoch = (slotEpochs.get(work.slot) ?? 0) + 1;
-		slotEpochs.set(work.slot, epoch);
-		const cursor = {
-			slot: work.slot,
-			epoch,
-			event: env.event._tag,
-			startedAt: env.startedAt,
-			invocation: env.invocation
-		};
-		yield* emitApplied(work.slot, epoch);
-		notify(next);
-		const send = (event) => Queue.offer(mailbox, {
-			event,
-			reply: null,
-			origin: cursor,
-			invocation: env.invocation,
-			startedAt: env.startedAt
-		}).pipe(Effect.asVoid);
-		const complete = (event) => Queue.offer(mailbox, {
-			event,
-			reply: null,
-			origin: cursor,
-			invocation: env.invocation,
-			startedAt: env.startedAt
-		}).pipe(Effect.asVoid);
-		const guarded = Effect.gen(function* () {
-			yield* Effect.annotateCurrentSpan({
-				slot: work.slot,
-				epoch,
-				port: work.port
-			});
-			return yield* control(work.run(send, env.invocation), env.invocation);
-		}).pipe(Effect.withSpan(`identity.work.${work.slot}`)).pipe(Effect.matchEffect({
-			onFailure: (failure) => complete({
-				_tag: "~lane/exit",
-				failure
-			}),
-			onSuccess: () => complete({ _tag: "~lane/exit" })
-		}), Effect.catchDefect((cause) => complete({
-			_tag: "~lane/exit",
-			defect: cause
-		})));
-		const fiber = yield* Effect.forkChild(guarded, { startImmediately: true });
-		slots.set(work.slot, {
-			fiber,
-			reply: env.reply,
-			cursor
-		});
-	});
-	const loop = yield* Effect.forkScoped(Effect.forever(Queue.take(mailbox).pipe(Effect.flatMap((env) => withInvocationParentSpan(step(env), env.invocation)))));
-	yield* Effect.addFinalizer(() => Effect.gen(function* () {
-		stopped = true;
-		yield* Fiber.interrupt(loop);
-		const state = yield* Ref.get(cell);
-		const outstanding = [...slots.values()];
-		slots.clear();
-		for (const held of outstanding) {
-			yield* Fiber.interrupt(held.fiber);
-			const env = {
-				origin: held.cursor,
-				invocation: held.cursor.invocation,
-				startedAt: held.cursor.startedAt
-			};
-			const event = { _tag: held.cursor.event };
-			yield* emit(nonApplied(state, event, "ACTOR_STOPPED", "refused", env));
-			yield* failReply(held.reply, makeFailure(state, event, "ACTOR_STOPPED"));
-		}
-		stateObservers.clear();
-		transitionObservers.clear();
-		yield* Queue.shutdown(mailbox);
-	}));
-	const offer = (event, reply, invocation) => {
-		const state = Ref.getUnsafe(cell);
-		if (stopped) return withInvocationParentSpan(emit(nonApplied(state, event, "ACTOR_STOPPED", "refused", {
-			origin: null,
-			invocation,
-			startedAt: Date.now()
-		})).pipe(Effect.andThen(Effect.fail(makeFailure(state, event, "ACTOR_STOPPED")))), invocation);
-		const startedAt = Date.now();
-		return Queue.offer(mailbox, {
-			event,
-			reply,
-			origin: null,
-			invocation,
-			startedAt
-		}).pipe(Effect.asVoid);
-	};
-	return {
-		ask: (event, invocation = {}) => Effect.gen(function* () {
-			const reply = yield* Deferred.make();
-			yield* offer(event, reply, invocation);
-			return yield* Deferred.await(reply);
-		}),
-		tell: (event, invocation = {}) => offer(event, null, invocation),
-		snapshot: () => Ref.getUnsafe(cell),
-		subscribe: (observer) => {
-			stateObservers.add(observer);
-			return () => {
-				stateObservers.delete(observer);
-			};
-		},
-		subscribeTransitions: (observer) => {
-			transitionObservers.add(observer);
-			return () => {
-				transitionObservers.delete(observer);
-			};
-		}
-	};
-});
-//#endregion
-//#region src/surface/to-capxul-result.ts
-/** The one place an Effect becomes a Promise on the public surface. */
-async function runProgram(program, runPromise = Effect.runPromise) {
-	const result = await runPromise(program.pipe(Effect.catchDefect((defect) => Effect.fail(Errors.unknown(defect))), Effect.result));
-	if (Result.isFailure(result)) return {
-		ok: false,
-		error: result.failure
-	};
-	return {
-		ok: true,
-		value: result.success
-	};
-}
-async function toCapxulResult(program, layer) {
-	return runProgram(program.pipe(Effect.provide(layer)));
-}
-/**
-* Signal-aware bridge for the Convex-backed method bundles. The adapters fail
-* with `{ publicError }` rather than a bare `CapxulError`, so the wrapper is
-* unwrapped here — once — instead of at every call site.
-*/
-async function runIfActive(signal, operation, effect, runPromise = Effect.runPromise) {
-	if (signal?.aborted === true) return {
-		ok: false,
-		error: Errors.cancelled({ operation })
-	};
-	const program = effect().pipe(Effect.mapError((error) => error.publicError));
-	return runProgram(signal === void 0 ? program : Effect.raceFirst(program, Effect.callback((resume) => {
-		if (signal.aborted) {
-			resume(Effect.fail(Errors.cancelled({ operation })));
-			return Effect.void;
-		}
-		const onAbort = () => resume(Effect.fail(Errors.cancelled({ operation })));
-		signal.addEventListener("abort", onAbort, { once: true });
-		return Effect.sync(() => signal.removeEventListener("abort", onAbort));
-	})), runPromise);
-}
-//#endregion
-//#region src/surface/_shared/effect-actor-bridge.ts
-const facadeOutcome = (value) => {
-	if (typeof value !== "object" || value === null || !("ok" in value) || value.ok !== false) return "succeeded";
-	const reason = value.reason;
-	if (reason === "CANCELLED") return "cancelled";
-	return typeof reason === "string" && EXPECTED_OPERATION_OUTCOMES.has(reason) ? "refused" : "failed";
-};
-const rejectedFacadeOutcome = (cause) => {
-	if (cause instanceof CapxulError) return cause.code === "CANCELLED" ? "cancelled" : "failed";
-	if (typeof cause !== "object" || cause === null) return "failed";
-	const candidate = cause;
-	return candidate.code === "CANCELLED" || candidate.reason === "CANCELLED" || candidate.error?.code === "CANCELLED" || candidate.publicError?.code === "CANCELLED" ? "cancelled" : "failed";
-};
-const RESOLVED_FACADE_SPAN_FAILURE = Symbol("resolved facade span failure");
-/** The single facade-span bridge consumed by the renderer-neutral React facade. */
-async function runIdentityFacade(verb, controls, run, runPromise = Effect.runPromise) {
-	const correlationId = safeEngineeringIdentifier(controls?.correlation_id);
-	let resolvedFailure;
-	return runPromise(Effect.gen(function* () {
-		const parent = yield* Effect.currentSpan;
-		return yield* Effect.tryPromise({
-			try: () => run(carryInvocationParentSpan(controls, parent)),
-			catch: (cause) => cause
-		});
-	}).pipe(Effect.tapError((cause) => Effect.annotateCurrentSpan({ outcome: rejectedFacadeOutcome(cause) })), Effect.flatMap((value) => {
-		const outcome = facadeOutcome(value);
-		return Effect.annotateCurrentSpan({ outcome }).pipe(Effect.andThen(outcome === "failed" || outcome === "cancelled" ? Effect.sync(() => {
-			resolvedFailure = value;
-		}).pipe(Effect.andThen(Effect.fail(RESOLVED_FACADE_SPAN_FAILURE))) : Effect.succeed(value)));
-	}), Effect.withSpan(`identity.${verb}`), Effect.annotateSpans({
-		verb,
-		...correlationId === void 0 ? {} : { correlation_id: correlationId }
-	}), Effect.catch((cause) => cause === RESOLVED_FACADE_SPAN_FAILURE ? Effect.succeed(resolvedFailure) : Effect.fail(cause))));
-}
-/**
-* Bridge an Effect whose typed failure carries `{ publicError: CapxulError }`
-* into the `Promise<CapxulResult<T>>` shape the consumer-facing method bundles
-* return. Applies to every port that surfaces a `publicError` (smart-account,
-* identity, auth-cache, account provision/deploy).
-*/
-async function runPortEffect(effect, controls, operation = "port", runPromise = Effect.runPromise) {
-	const deadlineDelay = controls?.deadlineMs === void 0 ? void 0 : Math.max(0, controls.deadlineMs - Date.now());
-	const timeoutMs = controls?.timeoutMs === void 0 ? deadlineDelay : deadlineDelay === void 0 ? controls.timeoutMs : Math.min(controls.timeoutMs, deadlineDelay);
-	const observed = (timeoutMs === void 0 ? effect : effect.pipe(Effect.timeoutOrElse({
-		duration: `${timeoutMs} millis`,
-		orElse: () => Effect.fail({ publicError: Errors.providerTimeout("sdk", operation, timeoutMs) })
-	}))).pipe(Effect.tap(() => Effect.annotateCurrentSpan({ outcome: "succeeded" })), Effect.tapError((failure) => {
-		const mode = failure.publicError.details?.failure_mode;
-		return Effect.annotateCurrentSpan({
-			outcome: portFailureOutcome(failure.publicError.code),
-			failure_code: failure.publicError.code,
-			...typeof mode === "string" ? { mode } : {}
-		});
-	}), Effect.tapDefect(() => Effect.annotateCurrentSpan({
-		outcome: "failed",
-		failure_code: "UNKNOWN"
-	})), Effect.withSpan(`identity.port.${operation}`));
-	return runIfActive(controls?.signal, operation, () => withInvocationParentSpan(observed, controls), runPromise);
-}
-/** Map machine-internal failure state onto the public SDK error vocabulary. */
-function publicIdentityFailure(failure) {
-	if (failure.error !== void 0) return failure.error;
-	return new CapxulError(failure.code === "WORK_DIED" ? "UNKNOWN" : failure.code, failure.message, {
-		...failure.mode === void 0 ? {} : { details: { failure_mode: failure.mode } },
-		layer: "identity"
-	});
-}
-/** The session carried by the actor's current snapshot, or `null`. */
-function sessionFromActor(actor) {
-	return actor.authSession();
-}
-//#endregion
-//#region src/surface/account-deps.ts
-/** The single Context tag the account atom + `account.getStatus` resolve. */
-var AccountDepsTag = class extends Context.Service()("@capxul/sdk/AccountDeps") {};
-/** Wrap a bundle as the `Layer<AccountDepsTag>` the React provider consumes. */
-function accountDepsLayer(deps) {
-	return Layer.succeed(AccountDepsTag, deps);
-}
-/**
-* `account.getStatus` as a single Effect requiring ONLY `AccountDepsTag`.
-* Faithful transcription of the current public method body (`account.ts`):
-* resolve the session (actor first, then the resume-path `authCache`), then
-* walk the readiness ladder. The `SmartAccountPort` failure narrows to its
-* `publicError`; a consumer `AccountProvider.getAddress` rejection becomes a
-* `providerError` (defending the public `CapxulResult` contract).
-*/
-const accountStatusProgram = Effect.gen(function* () {
-	const deps = yield* AccountDepsTag;
-	const session = yield* Effect.promise(() => currentSession(deps.actor, deps.authCache));
-	if (session === null) return { status: "notAuthenticated" };
-	const current = yield* deps.smartAccountPort.loadByAuthUserId(session.authUserId).pipe(Effect.mapError((failure) => failure.publicError));
-	if (current !== null) return statusFromAccount(current, deps.requirement);
-	if (deps.requirement === "none") return {
-		status: "accountReady",
-		requirement: deps.requirement,
-		account: null,
-		deployment: { status: "counterfactual" }
-	};
-	const signer = deps.signer;
-	if (signer === void 0) return {
-		status: "accountRequired",
-		requirement: deps.requirement,
-		chainId: deps.chainId
-	};
-	const signerAddress = yield* Effect.tryPromise({
-		try: () => signer.getAddress(),
-		catch: (cause) => signerFailure(signer.source, "getAddress", cause)
-	});
-	return {
-		status: "accountProviderReady",
-		requirement: deps.requirement,
-		chainId: deps.chainId,
-		source: signer.source,
-		signerAddress
-	};
-});
-/**
-* Resume-path session resolution. Consults the actor first; if the actor has
-* no session (e.g. page refresh before any sign-in event), reads
-* `authCache.getSession`. `AuthCacheError` is non-fatal at this read point —
-* treat as "no session" and let the consumer's `auth.signIn` path resolve.
-*/
-async function currentSession(actor, authCache) {
-	const fromActor = sessionFromActor(actor);
-	if (fromActor !== null) return fromActor;
-	if (authCache === void 0) return null;
-	const cached = await Effect.runPromise(Effect.result(authCache.getSession));
-	if (Result.isSuccess(cached)) {
-		if (cached.success !== null && typeof actor.restoreAuthSession === "function") {
-			const restored = await Effect.runPromise(Effect.result(actor.restoreAuthSession(cached.success)));
-			if (Result.isFailure(restored)) return null;
-		}
-		return cached.success;
-	}
-	return null;
-}
-/** Map a backend `SmartAccount` row onto the readiness `AccountStatus`. */
-function statusFromAccount(account, requirement) {
-	if (requirement === "deployed") {
-		if (account.deployedAt === null) return {
-			status: "accountPrepared",
-			requirement,
-			account,
-			deployment: { status: "counterfactual" }
-		};
-		return {
-			status: "accountReady",
-			requirement,
-			account,
-			deployment: {
-				status: "deployed",
-				deployedAt: account.deployedAt
-			}
-		};
-	}
-	return {
-		status: "accountReady",
-		requirement,
-		account,
-		deployment: account.deployedAt === null ? { status: "counterfactual" } : {
-			status: "deployed",
-			deployedAt: account.deployedAt
-		}
-	};
-}
-//#endregion
-//#region src/surface/account-lifecycle.ts
-function isActiveProvisioningPhase(phase) {
-	return phase.status === "wallet" || phase.status === "identity" || phase.status === "provision" || phase.status === "deploy";
-}
-function isRequirementMet(status, requirement) {
-	if (requirement === "none") return status.status !== "notAuthenticated";
-	if (status.status !== "accountReady") return false;
-	return requirement !== "deployed" || status.deployment.status === "deployed";
-}
-function mapProvisioningFailureStep(step) {
-	switch (step) {
-		case "wallet": return "connecting";
-		case "identity": return "registering";
-		case "provision":
-		case "deploy": return "activating";
-	}
-}
-function mapProvisioningPhaseToSetupStep(phase) {
-	switch (phase.status) {
-		case "idle":
-		case "wallet": return "connecting";
-		case "identity": return "registering";
-		case "provision":
-		case "deploy": return "activating";
-		case "ready":
-		case "failed": return "connecting";
-	}
-}
-function isSettingUpLifecycle(lifecycle) {
-	return lifecycle.status === "settingUp";
-}
-function readyLifecycle(status, accountId) {
-	return {
-		status: "ready",
-		accountId,
-		canTransact: status.status === "accountReady" && status.deployment.status === "deployed"
-	};
-}
-function mapAccountLifecycle(input) {
-	const { status, phase, requirement, accountId } = input;
-	if (status.status === "notAuthenticated") return { status: "loading" };
-	if (phase.status === "failed") return {
-		status: "failed",
-		at: mapProvisioningFailureStep(phase.at),
-		error: phase.error
-	};
-	if (isRequirementMet(status, requirement) || phase.status === "ready") {
-		if (accountId === void 0) return { status: "loading" };
-		return readyLifecycle(status, accountId);
-	}
-	if (isActiveProvisioningPhase(phase) || phase.status === "idle") return {
-		status: "settingUp",
-		step: mapProvisioningPhaseToSetupStep(phase)
-	};
-	return { status: "loading" };
-}
-//#endregion
-//#region ../wire/src/brands.ts
-const lowercasedString = Schema.String.pipe(Schema.decodeTo(Schema.String, {
-	decode: SchemaGetter.transform((value) => value.toLowerCase()),
-	encode: SchemaGetter.transform((value) => value)
-}));
-const addressSchema = (name) => lowercasedString.pipe(Schema.refine((value) => EVM_ADDRESS_RE$1.test(value), { message: `${name} must be a 0x-prefixed EVM address` }));
-const bytes32BrandSchema = (name) => lowercasedString.pipe(Schema.refine((value) => BYTES32_RE.test(value), { message: `${name} must be a 0x-prefixed bytes32 value` }));
-/** Lowercase, 0x-prefixed bytes32 evidence without a public brand. */
-const Bytes32Schema = bytes32BrandSchema("value");
-const AddressSchema$1 = addressSchema("address");
-const SafeAddressSchema = addressSchema("safe address");
-const ModuleAddressSchema = addressSchema("module address");
-const TxHashSchema$1 = bytes32BrandSchema("transaction hash");
-const RoleKeySchema = bytes32BrandSchema("role key");
-const AllowanceKeySchema = bytes32BrandSchema("allowance key");
-const BlockNumberSchema$1 = Schema.Number.pipe(Schema.refine((value) => Number.isSafeInteger(value) && value >= 0, { message: "must be a non-negative safe integer" }));
-const LogIndexSchema = Schema.Number.pipe(Schema.refine((value) => Number.isSafeInteger(value) && value >= 0, { message: "must be a non-negative safe integer" }));
-const WeiAmountSchema$1 = Schema.String.pipe(Schema.refine((value) => WEI_RE.test(value), { message: "must be a non-negative integer string" }));
-const SettlementIdSchema = bytes32BrandSchema("settlementId").pipe(Schema.refine((value) => value !== ZERO_BYTES32, { message: "settlementId must not be zero" }));
-/**
-* `AppId` schema. Mirrors `toAppId` from `@capxul/types`:
-* `app_` + Crockford-base32 ULID (26 chars, first char in `[0-7]`).
-*/
-const AppIdSchema$1 = Schema.String.pipe(Schema.refine((s) => APP_ID_RE.test(s), { message: "must be app_ plus a ULID" }));
-/**
-* `ChainId` schema. Mirrors `toChainId`: positive safe integer.
-*/
-const ChainIdSchema$1 = Schema.Number.pipe(Schema.refine((n) => Number.isSafeInteger(n) && n > 0, { message: "must be a positive safe integer" }));
-/**
-* `CurrencyCode` schema. Mirrors `toCurrencyCode`: currently supported
-* consumer-facing ISO-ish currency code set.
-*/
-const CurrencyCodeSchema$1 = Schema.String.pipe(Schema.refine((s) => SUPPORTED_CURRENCY_CODES.includes(s), { message: "must be a supported currency code" }));
-const DOCUMENT_HASH_HEX_RE = /^[0-9a-fA-F]{64}$/;
-/**
-* `DocumentHash` schema. Mirrors `toDocumentHash`: bare or 0x-prefixed bytes32,
-* normalized to lowercase 0x-prefixed form.
-*/
-const DocumentHashSchema = Schema.String.pipe(Schema.decodeTo(Schema.String, {
-	decode: SchemaGetter.transform((s) => {
-		const stripped = s.startsWith("0x") || s.startsWith("0X") ? s.slice(2) : s;
-		return DOCUMENT_HASH_HEX_RE.test(stripped) ? `0x${stripped.toLowerCase()}` : s;
-	}),
-	encode: SchemaGetter.transform((s) => s)
-}), Schema.refine((s) => BYTES32_RE.test(s), { message: "must be 32 bytes of hex" }));
-/** L2 orchestrated money evidence requires a nonzero Document hash. */
-const NonzeroDocumentHashSchema = DocumentHashSchema.pipe(Schema.refine((value) => value !== ZERO_BYTES32, { message: "documentHash must not be zero" }));
-/**
-* `SessionToken` schema. Mirrors `toSessionToken`: non-empty string.
-* Issuance source distinguishes SDK-handshake tokens from auth-session
-* tokens; the brand itself is opaque.
-*/
-const SessionTokenSchema = Schema.String.pipe(Schema.refine((s) => s.length > 0, { message: "must be a non-empty string" }));
-/**
-* `EpochMs` schema. Mirrors `toEpochMs`: non-negative safe integer.
-*/
-const EpochMsSchema$1 = Schema.Number.pipe(Schema.refine((n) => Number.isSafeInteger(n) && n >= 0, { message: "must be a non-negative safe integer" }));
-/**
-* `DurationMs` schema. Mirrors `toDurationMs`: non-negative safe integer.
-*/
-const DurationMsSchema$1 = Schema.Number.pipe(Schema.refine((n) => Number.isSafeInteger(n) && n >= 0, { message: "must be a non-negative safe integer" }));
-//#endregion
-//#region ../wire/src/bootstrap.ts
-const PUBLIC_POSTHOG_PROJECT_TOKEN = /^phc_[A-Za-z0-9_-]{1,191}$/u;
-const PostHogIngestOrigin = Schema.String.pipe(Schema.refine((value) => {
-	try {
-		const url = new URL(value);
-		return url.protocol === "https:" && url.username.length === 0 && url.password.length === 0 && url.pathname === "/" && url.search.length === 0 && url.hash.length === 0 && (url.hostname === "posthog.com" || url.hostname.endsWith(".posthog.com"));
-	} catch {
-		return false;
-	}
-}, { message: "must be a credential-free PostHog HTTPS ingest origin" }));
-const EngineeringTelemetryBootstrapPolicy = Schema.Struct({
-	host: PostHogIngestOrigin,
-	projectToken: Schema.String.pipe(Schema.refine((value) => PUBLIC_POSTHOG_PROJECT_TOKEN.test(value), { message: "must be a public PostHog project token" })),
-	capxulEnv: Schema.Union([
-		Schema.Literal("development"),
-		Schema.Literal("staging"),
-		Schema.Literal("production")
-	])
-});
-/**
-* `BootstrapEnvelope` v1.
-*
-* - `protocol`: discriminator that lets future protocols coexist on the
-*   same endpoint without a wire-shape conflict.
-* - `version`: numeric version inside the protocol. Unknown versions MUST
-*   fail decode with an INVALID_INPUT-class `CapxulError` at the SDK seam.
-* - `state`: the resolved bootstrap payload. Field shape matches the
-*   `BootstrapResolution` port; the SDK consumer can pass `state`
-*   directly (after `normalizeRuntimeUrl` on the two URL fields) into
-*   the port without re-branding.
-*/
-const BootstrapEnvelope = Schema.Struct({
-	protocol: Schema.Literal("capxul.bootstrap"),
-	version: Schema.Literal(1),
-	state: Schema.Struct({
-		applicationId: AppIdSchema$1,
-		chainId: ChainIdSchema$1,
-		sessionToken: SessionTokenSchema,
-		issuedAt: EpochMsSchema$1,
-		expiresIn: DurationMsSchema$1,
-		authBaseUrl: Schema.String,
-		convexUrl: Schema.String,
-		siteBaseUrl: Schema.String,
-		openfortPublishableKey: Schema.String,
-		shieldPublishableKey: Schema.String,
-		engineeringTelemetry: Schema.optional(EngineeringTelemetryBootstrapPolicy)
-	})
-});
-//#endregion
-//#region ../wire/src/functions.ts
-/**
-* Backend function paths, keyed by Convex module path then export name.
-*
-* Invariant (gate-enforced): `CAPXUL_FUNCTIONS[m][e] === \`${m}:${e}\``.
-*/
-const CAPXUL_FUNCTIONS = {
-	"account/actions": {
-		faucetMint: "account/actions:faucetMint",
-		readBalance: "account/actions:readBalance"
-	},
-	"financialOps/addressBook": {
-		add: "financialOps/addressBook:add",
-		get: "financialOps/addressBook:get",
-		hide: "financialOps/addressBook:hide",
-		label: "financialOps/addressBook:label",
-		list: "financialOps/addressBook:list",
-		unhide: "financialOps/addressBook:unhide"
-	},
-	"financialOps/destinations": {
-		add: "financialOps/destinations:add",
-		list: "financialOps/destinations:list",
-		remove: "financialOps/destinations:remove"
-	},
-	"financialOps/mutations": { createPayee: "financialOps/mutations:createPayee" },
-	"financialOps/queries": {
-		depositInstructions: "financialOps/queries:depositInstructions",
-		getPayee: "financialOps/queries:getPayee",
-		getPayment: "financialOps/queries:getPayment",
-		listPayments: "financialOps/queries:listPayments",
-		me: "financialOps/queries:me",
-		renderStoredDocument: "financialOps/queries:renderStoredDocument",
-		resolveHandle: "financialOps/queries:resolveHandle",
-		resolvePayee: "financialOps/queries:resolvePayee",
-		verifyPaymentDocument: "financialOps/queries:verifyPaymentDocument"
-	},
-	"financialOps/requestsInbox": {
-		approve: "financialOps/requestsInbox:approve",
-		cancel: "financialOps/requestsInbox:cancel",
-		decline: "financialOps/requestsInbox:decline",
-		get: "financialOps/requestsInbox:get",
-		inboxList: "financialOps/requestsInbox:inboxList",
-		issue: "financialOps/requestsInbox:issue",
-		list: "financialOps/requestsInbox:list"
-	},
-	"identity/mutations": {
-		completeOnboarding: "identity/mutations:completeOnboarding",
-		create: "identity/mutations:create",
-		update: "identity/mutations:update"
-	},
-	"identity/queries": {
-		loadByAuthUserId: "identity/queries:loadByAuthUserId",
-		usernameAvailable: "identity/queries:usernameAvailable"
-	},
-	"holdings/actions": { current: "holdings/actions:current" },
-	"movement/activity": {
-		annotate: "movement/activity:annotate",
-		get: "movement/activity:get",
-		list: "movement/activity:list"
-	},
-	"moneyExecution/actions": {
-		preparePermissionExecution: "moneyExecution/actions:preparePermissionExecution",
-		preparePaymentExecution: "moneyExecution/actions:preparePaymentExecution",
-		submitPermissionExecution: "moneyExecution/actions:submitPermissionExecution",
-		submitPaymentExecution: "moneyExecution/actions:submitPaymentExecution"
-	},
-	"moneyExecution/paymentCommandActions": {
-		preparePaymentLifecycleExecution: "moneyExecution/paymentCommandActions:preparePaymentLifecycleExecution",
-		prepareOrganizationPaymentExecution: "moneyExecution/paymentCommandActions:prepareOrganizationPaymentExecution",
-		submitPaymentCommandExecution: "moneyExecution/paymentCommandActions:submitPaymentCommandExecution"
-	},
-	media: {
-		generateUploadUrl: "media:generateUploadUrl",
-		setOrgLogo: "media:setOrgLogo",
-		setProfileImage: "media:setProfileImage"
-	},
-	"org/actions": {
-		confirmBootstrap: "org/actions:confirmBootstrap",
-		detectAndAcceptPendingInvitations: "org/actions:detectAndAcceptPendingInvitations",
-		inviteMember: "org/actions:inviteMember",
-		prepareBootstrap: "org/actions:prepareBootstrap",
-		prepareFounderAccount: "org/actions:prepareFounderAccount",
-		readTreasury: "org/actions:readTreasury",
-		resumeBootstrapSubmission: "org/actions:resumeBootstrapSubmission",
-		submitBootstrap: "org/actions:submitBootstrap"
-	},
-	"permission/actions": { verify: "permission/actions:verify" },
-	"permission/mutations": { command: "permission/mutations:command" },
-	"permission/queries": {
-		authorize: "permission/queries:authorize",
-		read: "permission/queries:read"
-	},
-	"org/lifecycle": {
-		getProofReceipt: "org/lifecycle:getProofReceipt",
-		load: "org/lifecycle:load",
-		recordFailure: "org/lifecycle:recordFailure",
-		retry: "org/lifecycle:retry",
-		startOrResume: "org/lifecycle:startOrResume"
-	},
-	"org/mutations": {
-		createOrg: "org/mutations:createOrg",
-		resendInviteToken: "org/mutations:resendInviteToken"
-	},
-	"org/queries": {
-		listAll: "org/queries:listAll",
-		listMembersByOrgId: "org/queries:listMembersByOrgId",
-		listMine: "org/queries:listMine",
-		listRolesByOrgId: "org/queries:listRolesByOrgId",
-		loadByOrgId: "org/queries:loadByOrgId",
-		me: "org/queries:me"
-	},
-	"smartAccount/actions": {
-		claim: "smartAccount/actions:claim",
-		confirmDeployment: "smartAccount/actions:confirmDeployment"
-	},
-	"smartAccount/mutations": { provision: "smartAccount/mutations:provision" },
-	"smartAccount/queries": {
-		loadByAuthUserId: "smartAccount/queries:loadByAuthUserId",
-		loadBySmartAccountAddress: "smartAccount/queries:loadBySmartAccountAddress"
-	},
-	system: { health: "system:health" }
+const CAPXUL_FUNCTIONS = {
+	"account/actions": {
+		faucetMint: "account/actions:faucetMint",
+		readBalance: "account/actions:readBalance"
+	},
+	"financialOps/addressBook": {
+		add: "financialOps/addressBook:add",
+		get: "financialOps/addressBook:get",
+		hide: "financialOps/addressBook:hide",
+		label: "financialOps/addressBook:label",
+		list: "financialOps/addressBook:list",
+		unhide: "financialOps/addressBook:unhide"
+	},
+	"financialOps/destinations": {
+		add: "financialOps/destinations:add",
+		list: "financialOps/destinations:list",
+		remove: "financialOps/destinations:remove"
+	},
+	"financialOps/mutations": { createPayee: "financialOps/mutations:createPayee" },
+	"financialOps/queries": {
+		depositInstructions: "financialOps/queries:depositInstructions",
+		getPayee: "financialOps/queries:getPayee",
+		getPayment: "financialOps/queries:getPayment",
+		listPayments: "financialOps/queries:listPayments",
+		me: "financialOps/queries:me",
+		renderStoredDocument: "financialOps/queries:renderStoredDocument",
+		resolveHandle: "financialOps/queries:resolveHandle",
+		resolvePayee: "financialOps/queries:resolvePayee",
+		verifyPaymentDocument: "financialOps/queries:verifyPaymentDocument"
+	},
+	"financialOps/requestsInbox": {
+		approve: "financialOps/requestsInbox:approve",
+		cancel: "financialOps/requestsInbox:cancel",
+		decline: "financialOps/requestsInbox:decline",
+		get: "financialOps/requestsInbox:get",
+		inboxList: "financialOps/requestsInbox:inboxList",
+		issue: "financialOps/requestsInbox:issue",
+		list: "financialOps/requestsInbox:list"
+	},
+	"identity/mutations": {
+		completeOnboarding: "identity/mutations:completeOnboarding",
+		create: "identity/mutations:create",
+		update: "identity/mutations:update"
+	},
+	"identity/queries": {
+		loadByAuthUserId: "identity/queries:loadByAuthUserId",
+		usernameAvailable: "identity/queries:usernameAvailable"
+	},
+	"holdings/actions": { current: "holdings/actions:current" },
+	"movement/activity": {
+		annotate: "movement/activity:annotate",
+		get: "movement/activity:get",
+		list: "movement/activity:list",
+		summary: "movement/activity:summary"
+	},
+	"moneyExecution/actions": {
+		preparePermissionExecution: "moneyExecution/actions:preparePermissionExecution",
+		preparePaymentExecution: "moneyExecution/actions:preparePaymentExecution",
+		submitPermissionExecution: "moneyExecution/actions:submitPermissionExecution",
+		submitPaymentExecution: "moneyExecution/actions:submitPaymentExecution"
+	},
+	"moneyExecution/paymentCommandActions": {
+		preparePaymentLifecycleExecution: "moneyExecution/paymentCommandActions:preparePaymentLifecycleExecution",
+		prepareOrganizationPaymentExecution: "moneyExecution/paymentCommandActions:prepareOrganizationPaymentExecution",
+		submitPaymentCommandExecution: "moneyExecution/paymentCommandActions:submitPaymentCommandExecution"
+	},
+	media: {
+		generateUploadUrl: "media:generateUploadUrl",
+		setOrgLogo: "media:setOrgLogo",
+		setProfileImage: "media:setProfileImage"
+	},
+	"org/actions": {
+		confirmBootstrap: "org/actions:confirmBootstrap",
+		detectAndAcceptPendingInvitations: "org/actions:detectAndAcceptPendingInvitations",
+		inviteMember: "org/actions:inviteMember",
+		prepareBootstrap: "org/actions:prepareBootstrap",
+		prepareFounderAccount: "org/actions:prepareFounderAccount",
+		readTreasury: "org/actions:readTreasury",
+		resumeBootstrapSubmission: "org/actions:resumeBootstrapSubmission",
+		submitBootstrap: "org/actions:submitBootstrap"
+	},
+	"payroll/actions": { authorizeRun: "payroll/actions:authorizeRun" },
+	"payroll/mutations": {
+		removeGroup: "payroll/mutations:removeGroup",
+		saveGroup: "payroll/mutations:saveGroup"
+	},
+	"payroll/queries": {
+		groups: "payroll/queries:groups",
+		runs: "payroll/queries:runs"
+	},
+	"permission/actions": { verify: "permission/actions:verify" },
+	"permission/mutations": { command: "permission/mutations:command" },
+	"permission/queries": {
+		authorize: "permission/queries:authorize",
+		read: "permission/queries:read"
+	},
+	"org/lifecycle": {
+		getProofReceipt: "org/lifecycle:getProofReceipt",
+		load: "org/lifecycle:load",
+		recordFailure: "org/lifecycle:recordFailure",
+		retry: "org/lifecycle:retry",
+		startOrResume: "org/lifecycle:startOrResume"
+	},
+	"org/mutations": {
+		createOrg: "org/mutations:createOrg",
+		resendInviteToken: "org/mutations:resendInviteToken"
+	},
+	"org/queries": {
+		listAll: "org/queries:listAll",
+		listMembersByOrgId: "org/queries:listMembersByOrgId",
+		listMine: "org/queries:listMine",
+		listRolesByOrgId: "org/queries:listRolesByOrgId",
+		loadByOrgId: "org/queries:loadByOrgId",
+		me: "org/queries:me"
+	},
+	"smartAccount/actions": {
+		claim: "smartAccount/actions:claim",
+		confirmDeployment: "smartAccount/actions:confirmDeployment"
+	},
+	"smartAccount/mutations": { provision: "smartAccount/mutations:provision" },
+	"smartAccount/queries": {
+		loadByAuthUserId: "smartAccount/queries:loadByAuthUserId",
+		loadBySmartAccountAddress: "smartAccount/queries:loadBySmartAccountAddress"
+	},
+	system: { health: "system:health" }
 };
 //#endregion
 //#region ../wire/src/status.ts
@@ -3521,7 +2692,7 @@ Schema.Struct({
 	items: Schema.Array(OrganizationPaymentExecutionItemSchema),
 	lineage: Schema.optional(PaymentCommandLineageSchema)
 });
-Schema.Struct({
+const PreparedPaymentCommandExecutionSchema = Schema.Struct({
 	executionId: MoneyExecutionIdSchema,
 	commandId: PaymentCommandIdSchema,
 	paymentIds: Schema.Array(PaymentIdSchema),
@@ -3594,155 +2765,1058 @@ Schema.Struct({
 	signerAddress: AddressSchema$1,
 	command: PermissionCommandSchema
 });
-Schema.Struct({
-	executionId: MoneyExecutionIdSchema,
-	commandId: PaymentCommandIdSchema,
-	operation: PermissionOperationSchema,
-	orgId: nonEmpty("orgId"),
-	command: PermissionCommandSchema,
-	expectedRevision: nonNegativeInteger("expectedRevision"),
-	chainId: BaseSepoliaChainIdSchema,
-	signerAddress: AddressSchema$1,
-	userOpSenderSafe: SafeAddressSchema,
-	digest: Bytes32Schema,
-	value: PermissionResourceSchema
+Schema.Struct({
+	executionId: MoneyExecutionIdSchema,
+	commandId: PaymentCommandIdSchema,
+	operation: PermissionOperationSchema,
+	orgId: nonEmpty("orgId"),
+	command: PermissionCommandSchema,
+	expectedRevision: nonNegativeInteger("expectedRevision"),
+	chainId: BaseSepoliaChainIdSchema,
+	signerAddress: AddressSchema$1,
+	userOpSenderSafe: SafeAddressSchema,
+	digest: Bytes32Schema,
+	value: PermissionResourceSchema
+});
+Schema.Struct({
+	status: Schema.Literal("submitted"),
+	executionId: MoneyExecutionIdSchema,
+	commandId: PaymentCommandIdSchema,
+	userOpHash: Bytes32Schema,
+	value: PermissionResourceSchema
+});
+const PayrollRunStatusSchema = Schema.Literals([
+	"draft",
+	"authorized",
+	"settled"
+]);
+const PayrollRunIdSchema = Schema.String.pipe(Schema.refine((value) => /^payroll_run_[0-9a-f]{64}$/u.test(value), { message: "payrollRunId must be a payroll_run_ digest identifier" }));
+const SignedMinorUnitSchema = Schema.String.pipe(Schema.refine((value) => /^-?(0|[1-9][0-9]*)$/u.test(value), { message: "must be an integer minor-unit string" }));
+const MinorUnitSchema = Schema.String.pipe(Schema.refine((value) => /^(0|[1-9][0-9]*)$/u.test(value), { message: "must be a non-negative integer minor-unit string" }));
+const PayrollRunItemInputSchema = Schema.Struct({
+	to: PaymentRef,
+	partyId: nonEmpty("partyId"),
+	gross: MinorUnitSchema,
+	net: MinorUnitSchema,
+	adjustments: Schema.Array(Schema.Struct({
+		label: Schema.String,
+		amount: SignedMinorUnitSchema
+	}))
+});
+Schema.Struct({
+	orgId: nonEmpty("orgId"),
+	permissionId: PermissionIdSchema,
+	requestKey: nonEmpty("requestKey"),
+	signerAddress: AddressSchema$1,
+	period: Schema.Struct({
+		start: nonNegativeInteger("period.start"),
+		end: nonNegativeInteger("period.end")
+	}),
+	items: Schema.Array(PayrollRunItemInputSchema)
+});
+const PayrollRunSchema = Schema.Struct({
+	id: PayrollRunIdSchema,
+	status: PayrollRunStatusSchema,
+	periodStart: nonNegativeInteger("periodStart"),
+	periodEnd: nonNegativeInteger("periodEnd"),
+	total: FinancialOpsMoney,
+	recipientCount: nonNegativeInteger("recipientCount")
+});
+Schema.Struct({
+	runs: Schema.Array(PayrollRunSchema),
+	settledThisMonth: FinancialOpsMoney
+});
+Schema.Struct({
+	run: PayrollRunSchema,
+	execution: PreparedPaymentCommandExecutionSchema
+});
+const PayrollGroupIdSchema = Schema.String.pipe(Schema.refine((value) => /^payroll_group_[0-9A-Z]{26}$/u.test(value), { message: "payrollGroupId must be a payroll_group_ ULID identifier" }));
+const PayrollGroupMemberSchema = Schema.Struct({
+	partyId: PartyIdSchema,
+	amount: Schema.String,
+	currency: CurrencyCodeSchema$1
+});
+Schema.Struct({
+	id: PayrollGroupIdSchema,
+	name: nonEmpty("name"),
+	tone: Schema.String,
+	members: Schema.Array(PayrollGroupMemberSchema)
+});
+Schema.Struct({
+	id: Schema.optional(PayrollGroupIdSchema),
+	name: Schema.String,
+	tone: Schema.String,
+	members: Schema.Array(PayrollGroupMemberSchema)
+});
+`
+.capxul-doc{--ink:#1d1d1f;--muted:#6e6e73;--line:#e7e7ea;--accent:#0a7d4b;--bg:#fff;
+  font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Inter,system-ui,sans-serif;
+  color:var(--ink);background:var(--bg);max-width:44rem;margin:0 auto;padding:2.75rem 3rem;
+  border:1px solid var(--line);border-radius:16px;box-shadow:0 1px 2px rgba(0,0,0,.04),0 12px 32px rgba(0,0,0,.06);
+  line-height:1.5;font-size:15px;overflow-wrap:anywhere;word-break:break-word}
+.capxul-doc *{box-sizing:border-box;min-width:0}
+.capxul-doc .doc-header{display:flex;flex-direction:column;gap:1.25rem;padding-bottom:1.5rem;border-bottom:1px solid var(--line);margin-bottom:1.75rem}
+.capxul-doc .doc-brand{display:flex;align-items:center;gap:.5rem;color:var(--accent);font-weight:600}
+.capxul-doc .doc-brand-mark{font-size:1.1rem}
+.capxul-doc .doc-brand-name{letter-spacing:.02em}
+.capxul-doc .doc-headline{display:flex;align-items:baseline;justify-content:space-between;gap:1rem;flex-wrap:wrap}
+.capxul-doc .doc-title{font-size:1.9rem;font-weight:700;letter-spacing:-.02em;margin:0}
+.capxul-doc .doc-badge{font-size:.7rem;font-weight:700;text-transform:uppercase;letter-spacing:.08em;
+  color:var(--accent);background:rgba(10,125,75,.1);padding:.3rem .6rem;border-radius:999px;max-width:100%;text-align:right}
+.capxul-doc .doc-parties{display:grid;grid-template-columns:1fr 1fr;gap:1.25rem;margin-bottom:1.75rem}
+.capxul-doc .doc-party{display:flex;flex-direction:column;gap:.15rem}
+.capxul-doc .doc-party-label{font-size:.72rem;text-transform:uppercase;letter-spacing:.06em;color:var(--muted)}
+.capxul-doc .doc-party-name{font-weight:600}
+.capxul-doc .doc-meta{display:flex;flex-direction:column;gap:.4rem;margin-bottom:1.75rem}
+.capxul-doc .doc-meta-row{display:flex;justify-content:space-between;gap:1rem;font-size:.92rem}
+.capxul-doc .doc-meta-label{color:var(--muted);flex-shrink:0}
+.capxul-doc .doc-meta-value{font-weight:500;text-align:right}
+.capxul-doc time{color:var(--ink);font-variant-numeric:tabular-nums}
+.capxul-doc .doc-line-items{width:100%;border-collapse:collapse;margin:.5rem 0 1.5rem;font-size:.92rem}
+.capxul-doc .doc-line-items th{text-align:left;font-size:.7rem;text-transform:uppercase;letter-spacing:.05em;
+  color:var(--muted);font-weight:600;padding:.5rem .25rem;border-bottom:1px solid var(--line)}
+.capxul-doc .doc-line-items td{padding:.7rem .25rem;border-bottom:1px solid var(--line)}
+.capxul-doc .doc-li-qty,.capxul-doc .doc-li-unit,.capxul-doc .doc-li-total{text-align:right;font-variant-numeric:tabular-nums;white-space:nowrap}
+.capxul-doc .doc-li-desc{width:100%}
+.capxul-doc .doc-totals{display:flex;flex-direction:column;gap:.5rem;margin-top:.5rem}
+.capxul-doc .doc-total-line{display:flex;justify-content:space-between;align-items:baseline;gap:1rem}
+.capxul-doc .doc-total-label{color:var(--muted)}
+.capxul-doc .doc-total-deduction .doc-amount-value{color:var(--muted)}
+.capxul-doc .doc-total-grand{border-top:2px solid var(--ink);margin-top:.5rem;padding-top:.75rem;font-size:1.15rem}
+.capxul-doc .doc-total-grand .doc-amount-value{font-weight:700}
+.capxul-doc .doc-amount-value{font-variant-numeric:tabular-nums;font-weight:600}
+.capxul-doc .doc-hero{text-align:center;padding:1.5rem 0 2rem}
+.capxul-doc .doc-hero-label{font-size:.72rem;text-transform:uppercase;letter-spacing:.06em;color:var(--muted)}
+.capxul-doc .doc-hero-amount{font-size:2.6rem;font-weight:700;letter-spacing:-.02em;margin-top:.35rem}
+.capxul-doc .doc-note{color:var(--ink);background:#f7f7f8;border-radius:10px;padding:.9rem 1.1rem;margin:0}
+.capxul-doc .doc-dest-address{font-family:ui-monospace,SFMono-Regular,Menlo,monospace;font-size:.9rem}
+.capxul-doc .doc-footer{margin-top:1.75rem;padding-top:1.25rem;border-top:1px solid var(--line);color:var(--muted);font-size:.9rem}
+.capxul-doc code{font-family:ui-monospace,SFMono-Regular,Menlo,monospace;font-size:.82rem;color:var(--muted);word-break:break-all}
+@media (max-width:540px){.capxul-doc{padding:1.75rem 1.25rem}.capxul-doc .doc-parties{grid-template-columns:1fr}}
+`.trim();
+//#endregion
+//#region ../wire/src/secret-material.ts
+const SENSITIVE_MATERIAL_PATTERNS = [
+	/0x[a-fA-F0-9]{40,}/u,
+	/(?:^|[^a-fA-F0-9])[a-fA-F0-9]{64}(?:$|[^a-fA-F0-9])/u,
+	/eyJ[A-Za-z0-9_-]*\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+/u,
+	/(?:(?:sk|pk|rk)_(?:live|test)|(?:phc|phx|ghp|gho|ghu|ghs|ghr|whsec)_|github_pat_|xox[baprs]-|AKIA[0-9A-Z]{16}|AIza)[A-Za-z0-9_-]*/iu
+];
+/**
+* Reject: does the value carry any known secret material? Best effort — callers
+* drop the whole value on a match; a false negative is a leak, a false positive
+* merely omits an observation field.
+*/
+function containsSensitiveMaterial(value) {
+	return SENSITIVE_MATERIAL_PATTERNS.some((pattern) => pattern.test(value));
+}
+//#endregion
+//#region ../wire/src/observation-context.ts
+/** Single bounded HTTP carrier used before a Convex action envelope exists. */
+const OBSERVATION_CONTEXT_HEADER = "x-capxul-observation-context";
+const FIELD_RULES = {
+	application: {
+		maxLength: 64,
+		pattern: /^[A-Za-z0-9][A-Za-z0-9._-]*$/u
+	},
+	applicationId: {
+		maxLength: 30,
+		pattern: APP_ID_RE
+	},
+	release: {
+		maxLength: 128,
+		pattern: /^[A-Za-z0-9][A-Za-z0-9._+@:/-]*$/u
+	},
+	sessionId: {
+		maxLength: 128,
+		pattern: /^[A-Za-z0-9][A-Za-z0-9._:-]*$/u
+	},
+	organizationId: {
+		maxLength: 128,
+		pattern: /^[A-Za-z0-9][A-Za-z0-9._:-]*$/u
+	},
+	journeyId: {
+		maxLength: 128,
+		pattern: /^[A-Za-z0-9][A-Za-z0-9._:-]*$/u
+	},
+	correlationId: {
+		maxLength: 128,
+		pattern: /^[A-Za-z0-9][A-Za-z0-9._:-]*$/u
+	},
+	anonymousId: {
+		maxLength: 128,
+		pattern: /^anon_[A-Za-z0-9-]+$/u
+	},
+	traceparent: {
+		maxLength: 55,
+		pattern: /^00-[0-9a-f]{32}-[0-9a-f]{16}-0[01]$/u
+	}
+};
+/**
+* Copy only the canonical allowlist and silently omit malformed/sensitive
+* values. Observation metadata is best effort and may never reject a domain
+* operation.
+*/
+function sanitizeObservationContext(input) {
+	if (typeof input !== "object" || input === null || Array.isArray(input)) return void 0;
+	const source = input;
+	const sanitized = {};
+	for (const field of Object.keys(FIELD_RULES)) {
+		const value = source[field];
+		if (!isSafeField(field, value)) continue;
+		sanitized[field] = value;
+	}
+	return Object.keys(sanitized).length === 0 ? void 0 : sanitized;
+}
+/** Encode only the sanitized allowlist; absence stays absence. */
+function encodeObservationContextHeader(input) {
+	const sanitized = sanitizeObservationContext(input);
+	return sanitized === void 0 ? void 0 : JSON.stringify(sanitized);
+}
+function isSafeField(field, value) {
+	if (typeof value !== "string") return false;
+	const rule = FIELD_RULES[field];
+	return value.length > 0 && value.length <= rule.maxLength && value === value.trim() && !value.includes("://") && !containsSensitiveMaterial(value) && rule.pattern.test(value);
+}
+//#endregion
+//#region src/surface/_shared/provisioning-telemetry.ts
+async function emitProvisioningTelemetry(telemetry, smartAccount) {
+	if (telemetry === void 0) return;
+	await Effect.runPromise(telemetry.emit({
+		name: "provisioning_safe_created",
+		props: { safe_address: smartAccount.smartAccountAddress }
+	}).pipe(Effect.catch((cause) => Effect.sync(() => reportProvisioningTelemetryFailure("error", smartAccount, cause))), Effect.catchDefect((cause) => Effect.sync(() => reportProvisioningTelemetryFailure("defect", smartAccount, cause)))));
+}
+function reportProvisioningTelemetryFailure(kind, smartAccount, cause) {
+	if (!isProvisioningTelemetryDebugEnabled()) return;
+	globalThis.console?.warn?.("[capxul] provisioning telemetry dropped", {
+		kind,
+		safeAddress: smartAccount.smartAccountAddress,
+		cause
+	});
+}
+function isProvisioningTelemetryDebugEnabled() {
+	return globalThis.process?.env?.CAPXUL_DEBUG_TELEMETRY === "1";
+}
+//#endregion
+//#region src/telemetry/get-failure-mode.ts
+/**
+* The five canonical {@link FailureMode} members, for runtime membership checks.
+* Single source of truth — tests assert against this exact set so the taxonomy
+* and its guard can never drift apart.
+*/
+const FAILURE_MODES = new Set([
+	"auth-origin-mismatch",
+	"stale-openfort-cache",
+	"app-env-allowlist",
+	"no-secure-context",
+	"unknown"
+]);
+function isFailureMode(value) {
+	return typeof value === "string" && FAILURE_MODES.has(value);
+}
+/**
+* Extract the structured {@link FailureMode} from a CapxulError.
+*
+* Reads `details.failure_mode` and returns it only when it is one of the five
+* canonical members; any other value (a legacy free string, a typo, a
+* non-string) yields `undefined` so downstream telemetry never reports an
+* unrecognised cause.
+*/
+function getFailureMode(error) {
+	if (!isCapxulError(error)) return void 0;
+	const details = error.details;
+	if (details === void 0) return void 0;
+	return isFailureMode(details.failure_mode) ? details.failure_mode : void 0;
+}
+/**
+* Resolve the canonical {@link FailureMode} for a `$exception`, guaranteeing a
+* taxonomy member is always returned — never `undefined`, never a free string.
+*
+* Resolution order:
+* 1. the structured mode on the error's `details.failure_mode` (already guarded);
+* 2. a caller-supplied `contextFailureMode`, but ONLY when it passes the same
+*    runtime membership check — the static `FailureMode` type is erased at
+*    runtime, so an operation string (e.g. `"signer-get-address"`) injected via
+*    a JS caller or `as` cast is rejected here rather than leaking to telemetry;
+* 3. `"unknown"` otherwise, so an unclassifiable error is still tagged with a
+*    canonical value instead of being emitted with no `failure_mode` at all.
+*/
+function resolveFailureMode(error, contextFailureMode) {
+	return getFailureMode(error) ?? (isFailureMode(contextFailureMode) ? contextFailureMode : "unknown");
+}
+//#endregion
+//#region src/signer.ts
+const EVM_ADDRESS_HEX = /^0x[0-9a-fA-F]{40}$/;
+const ECDSA_SIGNATURE_HEX = /^0x[0-9a-fA-F]{130}$/;
+const SAFE_OP_DIGEST_HEX = /^0x[0-9a-fA-F]{64}$/;
+/**
+* The readiness store a signer reports when it runs no readiness cycle. It
+* fails CLOSED: a node key signer or an injected wallet never claims `ready`,
+* so a gate that reads this never opens on a guess.
+*/
+const UNOBSERVABLE_SIGNER_STATUS = {
+	status: () => "unknown",
+	subscribe: () => () => void 0
+};
+/**
+* Walk an error and its `cause` links once each. A self-referential chain
+* terminates. Both signer predicates read the chain, so they read it here.
+*/
+function* causeChain(cause) {
+	const seen = /* @__PURE__ */ new Set();
+	let current = cause;
+	while (typeof current === "object" && current !== null && !seen.has(current)) {
+		seen.add(current);
+		yield current;
+		current = current.cause;
+	}
+}
+/** Fold a signer throw into the public error contract. */
+function signerFailure(source, operation, cause) {
+	let failureMode;
+	for (const link of causeChain(cause)) {
+		if (link instanceof CapxulError && link.code === "SIGNER_REJECTED") return link;
+		failureMode = getFailureMode(link) ?? failureMode;
+		const error = link;
+		if (error.code === 4001 || error.error === "passkey_user_cancelled") return Errors.signerRejected({
+			source,
+			cause
+		});
+	}
+	return Errors.providerError("signer", operation, cause, failureMode === void 0 ? void 0 : { failure_mode: failureMode });
+}
+/**
+* Browser `CapxulSigner` backed by an injected EIP-1193 wallet (MetaMask, etc.).
+* Signs the SafeOp digest via `eth_sign`, then verifies the returned signature
+* recovers the selected account against that raw digest. Wallets that prefix
+* `eth_sign` payloads are rejected before the backend submits an invalid SafeOp.
+* The node key signer lives in `@capxul/sdk/node` (`localPrivateKeySigner`).
+*/
+function injectedWalletSigner(provider) {
+	const resolveAddress = async () => {
+		const accounts = await provider.request({ method: "eth_requestAccounts" });
+		const first = Array.isArray(accounts) ? accounts[0] : void 0;
+		if (typeof first !== "string") throw new Error("injectedWalletSigner: wallet returned no accounts");
+		if (!EVM_ADDRESS_HEX.test(first)) throw new Error("injectedWalletSigner: wallet returned invalid address format");
+		return toAddress(first);
+	};
+	return {
+		source: "injected-eip1193",
+		getAddress: resolveAddress,
+		async signUserOpHash(hash) {
+			if (!SAFE_OP_DIGEST_HEX.test(hash)) throw new Error("injectedWalletSigner: SafeOp digest must be a 0x-prefixed 32-byte hex");
+			const address = await resolveAddress();
+			let signature;
+			try {
+				signature = await provider.request({
+					method: "eth_sign",
+					params: [address, hash]
+				});
+			} catch (cause) {
+				const detail = cause instanceof Error ? cause.message : String(cause);
+				throw new Error(`injectedWalletSigner: eth_sign failed; enable raw-hash signing for deployment (${detail})`, { cause });
+			}
+			if (typeof signature !== "string") throw new Error("injectedWalletSigner: wallet returned a non-string signature");
+			if (!ECDSA_SIGNATURE_HEX.test(signature)) throw new Error("injectedWalletSigner: wallet returned invalid signature format");
+			if ((await recoverRawDigestSigner({
+				hash,
+				signature
+			})).toLowerCase() !== address.toLowerCase()) throw new Error("injectedWalletSigner: wallet signature did not recover the selected account for the raw SafeOp digest; use a raw-hash-capable wallet or @capxul/sdk/node localPrivateKeySigner for deployed flows");
+			return signature;
+		}
+	};
+}
+async function recoverRawDigestSigner(input) {
+	try {
+		return toAddress(await recoverAddress(input));
+	} catch (cause) {
+		const detail = cause instanceof Error ? cause.message : String(cause);
+		throw new Error(`injectedWalletSigner: could not verify raw SafeOp digest signature (${detail})`, { cause });
+	}
+}
+//#endregion
+//#region src/internal/invocation-observation.ts
+const INVOCATION_OBSERVATION = Symbol("capxul.invocation-observation");
+const FAILURE_INVOCATION_SNAPSHOT = Symbol("capxul.failure-invocation-snapshot");
+/** @internal Attach one immutable, non-wire invocation snapshot to an SDK-owned object. */
+function attachInvocationObservation(target, source) {
+	const snapshot = Object.freeze(source.context === void 0 ? { active: source.active } : {
+		active: source.active,
+		context: Object.freeze({ ...source.context })
+	});
+	Object.defineProperty(target, INVOCATION_OBSERVATION, {
+		configurable: false,
+		enumerable: false,
+		value: snapshot,
+		writable: false
+	});
+	return target;
+}
+/** @internal Read the snapshot without exposing its symbol or adding a wire field. */
+function readInvocationObservation(source) {
+	if (typeof source !== "object" || source === null) return void 0;
+	return source[INVOCATION_OBSERVATION];
+}
+/** @internal Carry a snapshot across an SDK adapter projection without resolving again. */
+function copyInvocationObservation(source, target) {
+	const snapshot = readInvocationObservation(source);
+	return snapshot === void 0 ? target : attachInvocationObservation(target, snapshot);
+}
+/** @internal Carry the public call-start delivery decision with its failure envelope. */
+function markFailureInvocationSnapshot(failure, snapshot) {
+	Object.defineProperty(failure, FAILURE_INVOCATION_SNAPSHOT, {
+		configurable: false,
+		enumerable: false,
+		value: Object.freeze(snapshot),
+		writable: false
+	});
+	return failure;
+}
+/** @internal Read the call-start delivery decision; undefined means a direct adapter call. */
+function readFailureInvocationSnapshot(failure) {
+	if (typeof failure !== "object" || failure === null) return void 0;
+	const snapshot = failure[FAILURE_INVOCATION_SNAPSHOT];
+	return typeof snapshot === "object" && snapshot !== null && "active" in snapshot ? snapshot : void 0;
+}
+//#endregion
+//#region src/domain/machine/telemetry.ts
+const definedEntries = (values) => Object.fromEntries(Object.entries(values).filter((entry) => entry[1] !== void 0));
+const SAFE_ENGINEERING_ID = /^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$/u;
+const safeEngineeringIdentifier = (value) => value !== void 0 && SAFE_ENGINEERING_ID.test(value) ? value : void 0;
+const portFailureOutcome = (code) => code === "CANCELLED" ? "cancelled" : "failed";
+function formatTraceparent(span) {
+	const traceId = span.traceId.toLowerCase();
+	const spanId = span.spanId.toLowerCase();
+	if (!/^[0-9a-f]{32}$/u.test(traceId) || !/^[0-9a-f]{16}$/u.test(spanId)) return void 0;
+	if (/^0+$/u.test(traceId) || /^0+$/u.test(spanId)) return void 0;
+	return `00-${traceId}-${spanId}-${span.sampled ? "01" : "00"}`;
+}
+/** Canonical, bounded fields for the one wide engineering log owned by P3. */
+const transitionLogFields = (record) => {
+	const { correlation_id, journey_id, ...canonical } = record;
+	const safeCorrelation = safeEngineeringIdentifier(correlation_id);
+	const safeJourney = safeEngineeringIdentifier(journey_id);
+	return definedEntries({
+		...canonical,
+		...safeCorrelation === void 0 ? {} : { correlation_id: safeCorrelation },
+		...safeJourney === void 0 ? {} : { journey_id: safeJourney }
+	});
+};
+/** The shell span owns transition/refusal classification and no other seam's fields. */
+const transitionSpanFields = (record) => {
+	if (record.outcome === "applied") return {
+		machine: record.machine,
+		from: record.from,
+		event: record.event,
+		to: record.to
+	};
+	return {
+		machine: record.machine,
+		state: record.state,
+		event: record.event,
+		...record.outcome === "refused" ? { refused: record.refusal_code } : {}
+	};
+};
+/**
+* Emit engineering telemetry as an isolated side effect. Exporter/logger defects
+* can never change the actor's transition, reply, or P3 observer cardinality.
+*/
+const logIdentityTransition = (record) => (record.outcome === "applied" ? Effect.logInfo("identity.transition") : record.outcome === "failed" ? Effect.logError("identity.transition") : Effect.logWarning("identity.transition")).pipe(Effect.annotateLogs(transitionLogFields(record)), Effect.andThen(record.outcome === "applied" ? Effect.void : Effect.fail({ code: record.outcome === "refused" ? record.refusal_code : record.error_code })), Effect.withSpan("identity.transition"), Effect.annotateSpans(transitionSpanFields(record)), Effect.catchCause(() => Effect.void));
+//#endregion
+//#region src/domain/machine/shell.ts
+const INVOCATION_PARENT_SPAN = Symbol("@capxul/sdk/identity-invocation-parent-span");
+function carryInvocationParentSpan(controls, parent) {
+	return {
+		...controls,
+		[INVOCATION_PARENT_SPAN]: parent
+	};
+}
+function withInvocationParentSpan(effect, controls) {
+	const parent = controls?.[INVOCATION_PARENT_SPAN];
+	return parent === void 0 ? effect : effect.pipe(Effect.withParentSpan(parent));
+}
+var ActorFailure = class extends Error {
+	reason;
+	machine;
+	state;
+	event;
+	details;
+	_tag = "ActorFailure";
+	constructor(reason, machine, state, event, details) {
+		super(`${machine}:${state}:${event} ${reason}`);
+		this.reason = reason;
+		this.machine = machine;
+		this.state = state;
+		this.event = event;
+		this.details = details;
+		this.name = "ActorFailure";
+	}
+};
+const duration = (startedAt) => Math.max(0, Date.now() - startedAt);
+const failReply = (reply, failure) => reply === null ? Effect.void : Effect.asVoid(Deferred.fail(reply, failure));
+const withCarriage = (controls) => ({
+	...controls.correlation_id === void 0 ? {} : { correlation_id: controls.correlation_id },
+	...controls.journey_id === void 0 ? {} : { journey_id: controls.journey_id }
+});
+const timeoutFailure = {
+	code: "PROVIDER_ERROR",
+	message: "Identity work timed out"
+};
+const cancelledFailure = {
+	code: "CANCELLED",
+	message: "Identity work cancelled"
+};
+const abort = (signal) => signal.aborted ? Effect.fail(cancelledFailure) : Effect.callback((resume) => {
+	const onAbort = () => resume(Effect.fail(cancelledFailure));
+	signal.addEventListener("abort", onAbort, { once: true });
+	return Effect.sync(() => signal.removeEventListener("abort", onAbort));
 });
-Schema.Struct({
-	status: Schema.Literal("submitted"),
-	executionId: MoneyExecutionIdSchema,
-	commandId: PaymentCommandIdSchema,
-	userOpHash: Bytes32Schema,
-	value: PermissionResourceSchema
+const control = (effect, controls) => {
+	let controlled = effect;
+	const deadlineDelay = controls.deadlineMs === void 0 ? void 0 : Math.max(0, controls.deadlineMs - Date.now());
+	const timeoutMs = controls.timeoutMs === void 0 ? deadlineDelay : deadlineDelay === void 0 ? controls.timeoutMs : Math.min(controls.timeoutMs, deadlineDelay);
+	if (timeoutMs !== void 0) controlled = controlled.pipe(Effect.timeoutOrElse({
+		duration: `${timeoutMs} millis`,
+		orElse: () => Effect.fail(timeoutFailure)
+	}));
+	if (controls.signal !== void 0) controlled = Effect.raceFirst(controlled, abort(controls.signal));
+	return controlled;
+};
+const boot = (spec, options = {}) => Effect.gen(function* () {
+	const mailbox = yield* Queue.unbounded();
+	const cell = yield* Ref.make(spec.initial);
+	const slotEpochs = /* @__PURE__ */ new Map();
+	const slots = /* @__PURE__ */ new Map();
+	const stateObservers = /* @__PURE__ */ new Set();
+	const transitionObservers = /* @__PURE__ */ new Set();
+	let bootTransitionObserver = options.onTransition;
+	let stopped = false;
+	const defect = (cause) => {
+		try {
+			options.onDefect?.(cause);
+		} catch {}
+	};
+	const emit = (record) => Effect.sync(() => {
+		if (bootTransitionObserver !== void 0) try {
+			bootTransitionObserver(record);
+		} catch (cause) {
+			bootTransitionObserver = void 0;
+			defect(cause);
+		}
+		for (const observer of transitionObservers) try {
+			observer(record);
+		} catch (cause) {
+			transitionObservers.delete(observer);
+			defect(cause);
+		}
+	}).pipe(Effect.andThen(logIdentityTransition(record)));
+	const notify = (state) => {
+		for (const observer of stateObservers) try {
+			observer(state);
+		} catch (cause) {
+			stateObservers.delete(observer);
+			defect(cause);
+		}
+	};
+	const makeFailure = (state, event, reason, details) => new ActorFailure(reason, spec.machine, spec.label(state), event._tag, details);
+	const nonApplied = (state, event, reason, outcome, env) => {
+		const slot = env.origin?.slot ?? spec.slot(event);
+		return copyInvocationObservation(env.invocation, {
+			machine: spec.machine,
+			state: spec.label(state),
+			event: event._tag,
+			slot,
+			epoch: env.origin?.epoch ?? slotEpochs.get(slot) ?? 0,
+			outcome,
+			duration_ms: duration(env.startedAt),
+			...withCarriage(env.invocation),
+			...outcome === "refused" ? { refusal_code: reason } : { error_code: reason }
+		});
+	};
+	const applied = (from, to, event, slot, epoch, env) => copyInvocationObservation(env.invocation, {
+		machine: spec.machine,
+		from: spec.label(from),
+		event: event._tag,
+		to: spec.label(to),
+		slot,
+		epoch,
+		outcome: "applied",
+		duration_ms: duration(env.startedAt),
+		...withCarriage(env.invocation)
+	});
+	const finish = (cursor, state) => {
+		const held = slots.get(cursor.slot);
+		if (held === void 0 || held.cursor !== cursor) return Effect.void;
+		slots.delete(cursor.slot);
+		return Effect.asVoid(Deferred.succeed(held.reply, state));
+	};
+	const recoverFailure = (state, cursor, failure) => {
+		const event = spec.recoverFailure?.(state, cursor.event, failure);
+		if (event === void 0) return Effect.succeed(state);
+		const outcome = spec.transition(state, event);
+		if ("refused" in outcome) return Effect.succeed(state);
+		return Ref.set(cell, outcome.next).pipe(Effect.tap(() => {
+			return emit(applied(state, outcome.next, event, cursor.slot, cursor.epoch, {
+				invocation: cursor.invocation,
+				startedAt: cursor.startedAt
+			})).pipe(Effect.andThen(Effect.sync(() => {
+				notify(outcome.next);
+			})));
+		}), Effect.as(outcome.next));
+	};
+	const step = (env) => Effect.gen(function* () {
+		const state = yield* Ref.get(cell);
+		if (env.origin !== null && (slotEpochs.get(env.origin.slot) ?? 0) !== env.origin.epoch) {
+			const held = slots.get(env.origin.slot);
+			if (held === void 0 || held.cursor !== env.origin) return;
+			slots.delete(env.origin.slot);
+			const event = { _tag: env.origin.event };
+			yield* emit(nonApplied(state, event, "STALE_EPOCH", "refused", env));
+			yield* failReply(held.reply, makeFailure(state, event, "STALE_EPOCH"));
+			return;
+		}
+		if (env.origin !== null && env.event._tag === "~lane/exit") {
+			const exit = env.event;
+			const held = slots.get(env.origin.slot);
+			if (held === void 0 || held.cursor !== env.origin) return;
+			if (exit.defect !== void 0) {
+				slots.delete(env.origin.slot);
+				defect(exit.defect);
+				const event = { _tag: env.origin.event };
+				const failedState = yield* recoverFailure(state, env.origin, {
+					code: "WORK_DIED",
+					message: "Identity work died"
+				});
+				yield* emit(nonApplied(failedState, event, "WORK_DIED", "failed", env));
+				yield* failReply(held.reply, makeFailure(failedState, event, "WORK_DIED"));
+				return;
+			}
+			if (exit.failure !== void 0) {
+				slots.delete(env.origin.slot);
+				const outcome = exit.failure.code === "CANCELLED" ? "cancelled" : "failed";
+				const event = { _tag: env.origin.event };
+				const failedState = exit.failure === timeoutFailure || exit.failure === cancelledFailure ? yield* recoverFailure(state, env.origin, exit.failure) : state;
+				yield* emit(nonApplied(failedState, event, exit.failure.code, outcome, env));
+				const details = exit.failure === timeoutFailure ? { reason: "timeout" } : void 0;
+				yield* failReply(held.reply, makeFailure(failedState, event, exit.failure.code, details));
+				return;
+			}
+			yield* finish(env.origin, state);
+			return;
+		}
+		const outcome = spec.transition(state, env.event);
+		if ("refused" in outcome) {
+			yield* emit(nonApplied(state, env.event, outcome.refused, "refused", env));
+			yield* failReply(env.reply, makeFailure(state, env.event, outcome.refused));
+			return;
+		}
+		const next = outcome.next;
+		yield* Ref.set(cell, next);
+		const emitApplied = (slot, epoch) => emit(applied(state, next, env.event, slot, epoch, env));
+		if (env.origin !== null) {
+			yield* emitApplied(env.origin.slot, env.origin.epoch);
+			notify(next);
+			return;
+		}
+		for (const slot of spec.invalidates?.(env.event) ?? []) {
+			if (!slots.has(slot)) continue;
+			slotEpochs.set(slot, (slotEpochs.get(slot) ?? 0) + 1);
+		}
+		const work = env.reply === null ? void 0 : spec.work?.({
+			state: next,
+			event: env.event
+		});
+		if (work === void 0 || env.reply === null) {
+			const slot = spec.slot(env.event);
+			yield* emitApplied(slot, slotEpochs.get(slot) ?? 0);
+			notify(next);
+			if (env.reply !== null) yield* Deferred.succeed(env.reply, next).pipe(Effect.asVoid);
+			return;
+		}
+		const previous = slots.get(work.slot);
+		if (previous !== void 0) {
+			slots.delete(work.slot);
+			yield* Fiber.interrupt(previous.fiber);
+			const previousEvent = { _tag: previous.cursor.event };
+			const reason = previous.cursor.epoch === (slotEpochs.get(work.slot) ?? 0) ? "SUPERSEDED" : "STALE_EPOCH";
+			yield* emit(nonApplied(next, previousEvent, reason, "refused", {
+				origin: previous.cursor,
+				invocation: previous.cursor.invocation,
+				startedAt: previous.cursor.startedAt
+			}));
+			yield* failReply(previous.reply, makeFailure(next, previousEvent, reason));
+		}
+		const epoch = (slotEpochs.get(work.slot) ?? 0) + 1;
+		slotEpochs.set(work.slot, epoch);
+		const cursor = {
+			slot: work.slot,
+			epoch,
+			event: env.event._tag,
+			startedAt: env.startedAt,
+			invocation: env.invocation
+		};
+		yield* emitApplied(work.slot, epoch);
+		notify(next);
+		const send = (event) => Queue.offer(mailbox, {
+			event,
+			reply: null,
+			origin: cursor,
+			invocation: env.invocation,
+			startedAt: env.startedAt
+		}).pipe(Effect.asVoid);
+		const complete = (event) => Queue.offer(mailbox, {
+			event,
+			reply: null,
+			origin: cursor,
+			invocation: env.invocation,
+			startedAt: env.startedAt
+		}).pipe(Effect.asVoid);
+		const guarded = Effect.gen(function* () {
+			yield* Effect.annotateCurrentSpan({
+				slot: work.slot,
+				epoch,
+				port: work.port
+			});
+			return yield* control(work.run(send, env.invocation), env.invocation);
+		}).pipe(Effect.withSpan(`identity.work.${work.slot}`)).pipe(Effect.matchEffect({
+			onFailure: (failure) => complete({
+				_tag: "~lane/exit",
+				failure
+			}),
+			onSuccess: () => complete({ _tag: "~lane/exit" })
+		}), Effect.catchDefect((cause) => complete({
+			_tag: "~lane/exit",
+			defect: cause
+		})));
+		const fiber = yield* Effect.forkChild(guarded, { startImmediately: true });
+		slots.set(work.slot, {
+			fiber,
+			reply: env.reply,
+			cursor
+		});
+	});
+	const loop = yield* Effect.forkScoped(Effect.forever(Queue.take(mailbox).pipe(Effect.flatMap((env) => withInvocationParentSpan(step(env), env.invocation)))));
+	yield* Effect.addFinalizer(() => Effect.gen(function* () {
+		stopped = true;
+		yield* Fiber.interrupt(loop);
+		const state = yield* Ref.get(cell);
+		const outstanding = [...slots.values()];
+		slots.clear();
+		for (const held of outstanding) {
+			yield* Fiber.interrupt(held.fiber);
+			const env = {
+				origin: held.cursor,
+				invocation: held.cursor.invocation,
+				startedAt: held.cursor.startedAt
+			};
+			const event = { _tag: held.cursor.event };
+			yield* emit(nonApplied(state, event, "ACTOR_STOPPED", "refused", env));
+			yield* failReply(held.reply, makeFailure(state, event, "ACTOR_STOPPED"));
+		}
+		stateObservers.clear();
+		transitionObservers.clear();
+		yield* Queue.shutdown(mailbox);
+	}));
+	const offer = (event, reply, invocation) => {
+		const state = Ref.getUnsafe(cell);
+		if (stopped) return withInvocationParentSpan(emit(nonApplied(state, event, "ACTOR_STOPPED", "refused", {
+			origin: null,
+			invocation,
+			startedAt: Date.now()
+		})).pipe(Effect.andThen(Effect.fail(makeFailure(state, event, "ACTOR_STOPPED")))), invocation);
+		const startedAt = Date.now();
+		return Queue.offer(mailbox, {
+			event,
+			reply,
+			origin: null,
+			invocation,
+			startedAt
+		}).pipe(Effect.asVoid);
+	};
+	return {
+		ask: (event, invocation = {}) => Effect.gen(function* () {
+			const reply = yield* Deferred.make();
+			yield* offer(event, reply, invocation);
+			return yield* Deferred.await(reply);
+		}),
+		tell: (event, invocation = {}) => offer(event, null, invocation),
+		snapshot: () => Ref.getUnsafe(cell),
+		subscribe: (observer) => {
+			stateObservers.add(observer);
+			return () => {
+				stateObservers.delete(observer);
+			};
+		},
+		subscribeTransitions: (observer) => {
+			transitionObservers.add(observer);
+			return () => {
+				transitionObservers.delete(observer);
+			};
+		}
+	};
 });
-`
-.capxul-doc{--ink:#1d1d1f;--muted:#6e6e73;--line:#e7e7ea;--accent:#0a7d4b;--bg:#fff;
-  font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Inter,system-ui,sans-serif;
-  color:var(--ink);background:var(--bg);max-width:44rem;margin:0 auto;padding:2.75rem 3rem;
-  border:1px solid var(--line);border-radius:16px;box-shadow:0 1px 2px rgba(0,0,0,.04),0 12px 32px rgba(0,0,0,.06);
-  line-height:1.5;font-size:15px;overflow-wrap:anywhere;word-break:break-word}
-.capxul-doc *{box-sizing:border-box;min-width:0}
-.capxul-doc .doc-header{display:flex;flex-direction:column;gap:1.25rem;padding-bottom:1.5rem;border-bottom:1px solid var(--line);margin-bottom:1.75rem}
-.capxul-doc .doc-brand{display:flex;align-items:center;gap:.5rem;color:var(--accent);font-weight:600}
-.capxul-doc .doc-brand-mark{font-size:1.1rem}
-.capxul-doc .doc-brand-name{letter-spacing:.02em}
-.capxul-doc .doc-headline{display:flex;align-items:baseline;justify-content:space-between;gap:1rem;flex-wrap:wrap}
-.capxul-doc .doc-title{font-size:1.9rem;font-weight:700;letter-spacing:-.02em;margin:0}
-.capxul-doc .doc-badge{font-size:.7rem;font-weight:700;text-transform:uppercase;letter-spacing:.08em;
-  color:var(--accent);background:rgba(10,125,75,.1);padding:.3rem .6rem;border-radius:999px;max-width:100%;text-align:right}
-.capxul-doc .doc-parties{display:grid;grid-template-columns:1fr 1fr;gap:1.25rem;margin-bottom:1.75rem}
-.capxul-doc .doc-party{display:flex;flex-direction:column;gap:.15rem}
-.capxul-doc .doc-party-label{font-size:.72rem;text-transform:uppercase;letter-spacing:.06em;color:var(--muted)}
-.capxul-doc .doc-party-name{font-weight:600}
-.capxul-doc .doc-meta{display:flex;flex-direction:column;gap:.4rem;margin-bottom:1.75rem}
-.capxul-doc .doc-meta-row{display:flex;justify-content:space-between;gap:1rem;font-size:.92rem}
-.capxul-doc .doc-meta-label{color:var(--muted);flex-shrink:0}
-.capxul-doc .doc-meta-value{font-weight:500;text-align:right}
-.capxul-doc time{color:var(--ink);font-variant-numeric:tabular-nums}
-.capxul-doc .doc-line-items{width:100%;border-collapse:collapse;margin:.5rem 0 1.5rem;font-size:.92rem}
-.capxul-doc .doc-line-items th{text-align:left;font-size:.7rem;text-transform:uppercase;letter-spacing:.05em;
-  color:var(--muted);font-weight:600;padding:.5rem .25rem;border-bottom:1px solid var(--line)}
-.capxul-doc .doc-line-items td{padding:.7rem .25rem;border-bottom:1px solid var(--line)}
-.capxul-doc .doc-li-qty,.capxul-doc .doc-li-unit,.capxul-doc .doc-li-total{text-align:right;font-variant-numeric:tabular-nums;white-space:nowrap}
-.capxul-doc .doc-li-desc{width:100%}
-.capxul-doc .doc-totals{display:flex;flex-direction:column;gap:.5rem;margin-top:.5rem}
-.capxul-doc .doc-total-line{display:flex;justify-content:space-between;align-items:baseline;gap:1rem}
-.capxul-doc .doc-total-label{color:var(--muted)}
-.capxul-doc .doc-total-deduction .doc-amount-value{color:var(--muted)}
-.capxul-doc .doc-total-grand{border-top:2px solid var(--ink);margin-top:.5rem;padding-top:.75rem;font-size:1.15rem}
-.capxul-doc .doc-total-grand .doc-amount-value{font-weight:700}
-.capxul-doc .doc-amount-value{font-variant-numeric:tabular-nums;font-weight:600}
-.capxul-doc .doc-hero{text-align:center;padding:1.5rem 0 2rem}
-.capxul-doc .doc-hero-label{font-size:.72rem;text-transform:uppercase;letter-spacing:.06em;color:var(--muted)}
-.capxul-doc .doc-hero-amount{font-size:2.6rem;font-weight:700;letter-spacing:-.02em;margin-top:.35rem}
-.capxul-doc .doc-note{color:var(--ink);background:#f7f7f8;border-radius:10px;padding:.9rem 1.1rem;margin:0}
-.capxul-doc .doc-dest-address{font-family:ui-monospace,SFMono-Regular,Menlo,monospace;font-size:.9rem}
-.capxul-doc .doc-footer{margin-top:1.75rem;padding-top:1.25rem;border-top:1px solid var(--line);color:var(--muted);font-size:.9rem}
-.capxul-doc code{font-family:ui-monospace,SFMono-Regular,Menlo,monospace;font-size:.82rem;color:var(--muted);word-break:break-all}
-@media (max-width:540px){.capxul-doc{padding:1.75rem 1.25rem}.capxul-doc .doc-parties{grid-template-columns:1fr}}
-`.trim();
 //#endregion
-//#region ../wire/src/secret-material.ts
-const SENSITIVE_MATERIAL_PATTERNS = [
-	/0x[a-fA-F0-9]{40,}/u,
-	/(?:^|[^a-fA-F0-9])[a-fA-F0-9]{64}(?:$|[^a-fA-F0-9])/u,
-	/eyJ[A-Za-z0-9_-]*\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+/u,
-	/(?:(?:sk|pk|rk)_(?:live|test)|(?:phc|phx|ghp|gho|ghu|ghs|ghr|whsec)_|github_pat_|xox[baprs]-|AKIA[0-9A-Z]{16}|AIza)[A-Za-z0-9_-]*/iu
-];
+//#region src/surface/to-capxul-result.ts
+/** The one place an Effect becomes a Promise on the public surface. */
+async function runProgram(program, runPromise = Effect.runPromise) {
+	const result = await runPromise(program.pipe(Effect.catchDefect((defect) => Effect.fail(Errors.unknown(defect))), Effect.result));
+	if (Result.isFailure(result)) return {
+		ok: false,
+		error: result.failure
+	};
+	return {
+		ok: true,
+		value: result.success
+	};
+}
+async function toCapxulResult(program, layer) {
+	return runProgram(program.pipe(Effect.provide(layer)));
+}
 /**
-* Reject: does the value carry any known secret material? Best effort — callers
-* drop the whole value on a match; a false negative is a leak, a false positive
-* merely omits an observation field.
+* Signal-aware bridge for the Convex-backed method bundles. The adapters fail
+* with `{ publicError }` rather than a bare `CapxulError`, so the wrapper is
+* unwrapped here — once — instead of at every call site.
 */
-function containsSensitiveMaterial(value) {
-	return SENSITIVE_MATERIAL_PATTERNS.some((pattern) => pattern.test(value));
+async function runIfActive(signal, operation, effect, runPromise = Effect.runPromise) {
+	if (signal?.aborted === true) return {
+		ok: false,
+		error: Errors.cancelled({ operation })
+	};
+	const program = effect().pipe(Effect.mapError((error) => error.publicError));
+	return runProgram(signal === void 0 ? program : Effect.raceFirst(program, Effect.callback((resume) => {
+		if (signal.aborted) {
+			resume(Effect.fail(Errors.cancelled({ operation })));
+			return Effect.void;
+		}
+		const onAbort = () => resume(Effect.fail(Errors.cancelled({ operation })));
+		signal.addEventListener("abort", onAbort, { once: true });
+		return Effect.sync(() => signal.removeEventListener("abort", onAbort));
+	})), runPromise);
+}
+//#endregion
+//#region src/surface/_shared/effect-actor-bridge.ts
+const facadeOutcome = (value) => {
+	if (typeof value !== "object" || value === null || !("ok" in value) || value.ok !== false) return "succeeded";
+	const reason = value.reason;
+	if (reason === "CANCELLED") return "cancelled";
+	return typeof reason === "string" && EXPECTED_OPERATION_OUTCOMES.has(reason) ? "refused" : "failed";
+};
+const rejectedFacadeOutcome = (cause) => {
+	if (cause instanceof CapxulError) return cause.code === "CANCELLED" ? "cancelled" : "failed";
+	if (typeof cause !== "object" || cause === null) return "failed";
+	const candidate = cause;
+	return candidate.code === "CANCELLED" || candidate.reason === "CANCELLED" || candidate.error?.code === "CANCELLED" || candidate.publicError?.code === "CANCELLED" ? "cancelled" : "failed";
+};
+const RESOLVED_FACADE_SPAN_FAILURE = Symbol("resolved facade span failure");
+/** The single facade-span bridge consumed by the renderer-neutral React facade. */
+async function runIdentityFacade(verb, controls, run, runPromise = Effect.runPromise) {
+	const correlationId = safeEngineeringIdentifier(controls?.correlation_id);
+	let resolvedFailure;
+	return runPromise(Effect.gen(function* () {
+		const parent = yield* Effect.currentSpan;
+		return yield* Effect.tryPromise({
+			try: () => run(carryInvocationParentSpan(controls, parent)),
+			catch: (cause) => cause
+		});
+	}).pipe(Effect.tapError((cause) => Effect.annotateCurrentSpan({ outcome: rejectedFacadeOutcome(cause) })), Effect.flatMap((value) => {
+		const outcome = facadeOutcome(value);
+		return Effect.annotateCurrentSpan({ outcome }).pipe(Effect.andThen(outcome === "failed" || outcome === "cancelled" ? Effect.sync(() => {
+			resolvedFailure = value;
+		}).pipe(Effect.andThen(Effect.fail(RESOLVED_FACADE_SPAN_FAILURE))) : Effect.succeed(value)));
+	}), Effect.withSpan(`identity.${verb}`), Effect.annotateSpans({
+		verb,
+		...correlationId === void 0 ? {} : { correlation_id: correlationId }
+	}), Effect.catch((cause) => cause === RESOLVED_FACADE_SPAN_FAILURE ? Effect.succeed(resolvedFailure) : Effect.fail(cause))));
+}
+/**
+* Bridge an Effect whose typed failure carries `{ publicError: CapxulError }`
+* into the `Promise<CapxulResult<T>>` shape the consumer-facing method bundles
+* return. Applies to every port that surfaces a `publicError` (smart-account,
+* identity, auth-cache, account provision/deploy).
+*/
+async function runPortEffect(effect, controls, operation = "port", runPromise = Effect.runPromise) {
+	const deadlineDelay = controls?.deadlineMs === void 0 ? void 0 : Math.max(0, controls.deadlineMs - Date.now());
+	const timeoutMs = controls?.timeoutMs === void 0 ? deadlineDelay : deadlineDelay === void 0 ? controls.timeoutMs : Math.min(controls.timeoutMs, deadlineDelay);
+	const observed = (timeoutMs === void 0 ? effect : effect.pipe(Effect.timeoutOrElse({
+		duration: `${timeoutMs} millis`,
+		orElse: () => Effect.fail({ publicError: Errors.providerTimeout("sdk", operation, timeoutMs) })
+	}))).pipe(Effect.tap(() => Effect.annotateCurrentSpan({ outcome: "succeeded" })), Effect.tapError((failure) => {
+		const mode = failure.publicError.details?.failure_mode;
+		return Effect.annotateCurrentSpan({
+			outcome: portFailureOutcome(failure.publicError.code),
+			failure_code: failure.publicError.code,
+			...typeof mode === "string" ? { mode } : {}
+		});
+	}), Effect.tapDefect(() => Effect.annotateCurrentSpan({
+		outcome: "failed",
+		failure_code: "UNKNOWN"
+	})), Effect.withSpan(`identity.port.${operation}`));
+	return runIfActive(controls?.signal, operation, () => withInvocationParentSpan(observed, controls), runPromise);
+}
+/** Map machine-internal failure state onto the public SDK error vocabulary. */
+function publicIdentityFailure(failure) {
+	if (failure.error !== void 0) return failure.error;
+	return new CapxulError(failure.code === "WORK_DIED" ? "UNKNOWN" : failure.code, failure.message, {
+		...failure.mode === void 0 ? {} : { details: { failure_mode: failure.mode } },
+		layer: "identity"
+	});
+}
+/** The session carried by the actor's current snapshot, or `null`. */
+function sessionFromActor(actor) {
+	return actor.authSession();
+}
+//#endregion
+//#region src/surface/account-deps.ts
+/** The single Context tag the account atom + `account.getStatus` resolve. */
+var AccountDepsTag = class extends Context.Service()("@capxul/sdk/AccountDeps") {};
+/** Wrap a bundle as the `Layer<AccountDepsTag>` the React provider consumes. */
+function accountDepsLayer(deps) {
+	return Layer.succeed(AccountDepsTag, deps);
+}
+/**
+* `account.getStatus` as a single Effect requiring ONLY `AccountDepsTag`.
+* Faithful transcription of the current public method body (`account.ts`):
+* resolve the session (actor first, then the resume-path `authCache`), then
+* walk the readiness ladder. The `SmartAccountPort` failure narrows to its
+* `publicError`; a consumer `AccountProvider.getAddress` rejection becomes a
+* `providerError` (defending the public `CapxulResult` contract).
+*/
+const accountStatusProgram = Effect.gen(function* () {
+	const deps = yield* AccountDepsTag;
+	const session = yield* Effect.promise(() => currentSession(deps.actor, deps.authCache));
+	if (session === null) return { status: "notAuthenticated" };
+	const current = yield* deps.smartAccountPort.loadByAuthUserId(session.authUserId).pipe(Effect.mapError((failure) => failure.publicError));
+	if (current !== null) return statusFromAccount(current, deps.requirement);
+	if (deps.requirement === "none") return {
+		status: "accountReady",
+		requirement: deps.requirement,
+		account: null,
+		deployment: { status: "counterfactual" }
+	};
+	const signer = deps.signer;
+	if (signer === void 0) return {
+		status: "accountRequired",
+		requirement: deps.requirement,
+		chainId: deps.chainId
+	};
+	const signerAddress = yield* Effect.tryPromise({
+		try: () => signer.getAddress(),
+		catch: (cause) => signerFailure(signer.source, "getAddress", cause)
+	});
+	return {
+		status: "accountProviderReady",
+		requirement: deps.requirement,
+		chainId: deps.chainId,
+		source: signer.source,
+		signerAddress
+	};
+});
+/**
+* Resume-path session resolution. Consults the actor first; if the actor has
+* no session (e.g. page refresh before any sign-in event), reads
+* `authCache.getSession`. `AuthCacheError` is non-fatal at this read point —
+* treat as "no session" and let the consumer's `auth.signIn` path resolve.
+*/
+async function currentSession(actor, authCache) {
+	const fromActor = sessionFromActor(actor);
+	if (fromActor !== null) return fromActor;
+	if (authCache === void 0) return null;
+	const cached = await Effect.runPromise(Effect.result(authCache.getSession));
+	if (Result.isSuccess(cached)) {
+		if (cached.success !== null && typeof actor.restoreAuthSession === "function") {
+			const restored = await Effect.runPromise(Effect.result(actor.restoreAuthSession(cached.success)));
+			if (Result.isFailure(restored)) return null;
+		}
+		return cached.success;
+	}
+	return null;
+}
+/** Map a backend `SmartAccount` row onto the readiness `AccountStatus`. */
+function statusFromAccount(account, requirement) {
+	if (requirement === "deployed") {
+		if (account.deployedAt === null) return {
+			status: "accountPrepared",
+			requirement,
+			account,
+			deployment: { status: "counterfactual" }
+		};
+		return {
+			status: "accountReady",
+			requirement,
+			account,
+			deployment: {
+				status: "deployed",
+				deployedAt: account.deployedAt
+			}
+		};
+	}
+	return {
+		status: "accountReady",
+		requirement,
+		account,
+		deployment: account.deployedAt === null ? { status: "counterfactual" } : {
+			status: "deployed",
+			deployedAt: account.deployedAt
+		}
+	};
 }
 //#endregion
-//#region ../wire/src/observation-context.ts
-/** Single bounded HTTP carrier used before a Convex action envelope exists. */
-const OBSERVATION_CONTEXT_HEADER = "x-capxul-observation-context";
-const FIELD_RULES = {
-	application: {
-		maxLength: 64,
-		pattern: /^[A-Za-z0-9][A-Za-z0-9._-]*$/u
-	},
-	applicationId: {
-		maxLength: 30,
-		pattern: APP_ID_RE
-	},
-	release: {
-		maxLength: 128,
-		pattern: /^[A-Za-z0-9][A-Za-z0-9._+@:/-]*$/u
-	},
-	sessionId: {
-		maxLength: 128,
-		pattern: /^[A-Za-z0-9][A-Za-z0-9._:-]*$/u
-	},
-	organizationId: {
-		maxLength: 128,
-		pattern: /^[A-Za-z0-9][A-Za-z0-9._:-]*$/u
-	},
-	journeyId: {
-		maxLength: 128,
-		pattern: /^[A-Za-z0-9][A-Za-z0-9._:-]*$/u
-	},
-	correlationId: {
-		maxLength: 128,
-		pattern: /^[A-Za-z0-9][A-Za-z0-9._:-]*$/u
-	},
-	anonymousId: {
-		maxLength: 128,
-		pattern: /^anon_[A-Za-z0-9-]+$/u
-	},
-	traceparent: {
-		maxLength: 55,
-		pattern: /^00-[0-9a-f]{32}-[0-9a-f]{16}-0[01]$/u
+//#region src/surface/account-lifecycle.ts
+function isActiveProvisioningPhase(phase) {
+	return phase.status === "wallet" || phase.status === "identity" || phase.status === "provision" || phase.status === "deploy";
+}
+function isRequirementMet(status, requirement) {
+	if (requirement === "none") return status.status !== "notAuthenticated";
+	if (status.status !== "accountReady") return false;
+	return requirement !== "deployed" || status.deployment.status === "deployed";
+}
+function mapProvisioningFailureStep(step) {
+	switch (step) {
+		case "wallet": return "connecting";
+		case "identity": return "registering";
+		case "provision":
+		case "deploy": return "activating";
 	}
-};
-/**
-* Copy only the canonical allowlist and silently omit malformed/sensitive
-* values. Observation metadata is best effort and may never reject a domain
-* operation.
-*/
-function sanitizeObservationContext(input) {
-	if (typeof input !== "object" || input === null || Array.isArray(input)) return void 0;
-	const source = input;
-	const sanitized = {};
-	for (const field of Object.keys(FIELD_RULES)) {
-		const value = source[field];
-		if (!isSafeField(field, value)) continue;
-		sanitized[field] = value;
+}
+function mapProvisioningPhaseToSetupStep(phase) {
+	switch (phase.status) {
+		case "idle":
+		case "wallet": return "connecting";
+		case "identity": return "registering";
+		case "provision":
+		case "deploy": return "activating";
+		case "ready":
+		case "failed": return "connecting";
 	}
-	return Object.keys(sanitized).length === 0 ? void 0 : sanitized;
 }
-/** Encode only the sanitized allowlist; absence stays absence. */
-function encodeObservationContextHeader(input) {
-	const sanitized = sanitizeObservationContext(input);
-	return sanitized === void 0 ? void 0 : JSON.stringify(sanitized);
+function isSettingUpLifecycle(lifecycle) {
+	return lifecycle.status === "settingUp";
 }
-function isSafeField(field, value) {
-	if (typeof value !== "string") return false;
-	const rule = FIELD_RULES[field];
-	return value.length > 0 && value.length <= rule.maxLength && value === value.trim() && !value.includes("://") && !containsSensitiveMaterial(value) && rule.pattern.test(value);
+function readyLifecycle(status, accountId) {
+	return {
+		status: "ready",
+		accountId,
+		canTransact: status.status === "accountReady" && status.deployment.status === "deployed"
+	};
+}
+function mapAccountLifecycle(input) {
+	const { status, phase, requirement, accountId } = input;
+	if (status.status === "notAuthenticated") return { status: "loading" };
+	if (phase.status === "failed") return {
+		status: "failed",
+		at: mapProvisioningFailureStep(phase.at),
+		error: phase.error
+	};
+	if (isRequirementMet(status, requirement) || phase.status === "ready") {
+		if (accountId === void 0) return { status: "loading" };
+		return readyLifecycle(status, accountId);
+	}
+	if (isActiveProvisioningPhase(phase) || phase.status === "idle") return {
+		status: "settingUp",
+		step: mapProvisioningPhaseToSetupStep(phase)
+	};
+	return { status: "loading" };
 }
 //#endregion
 //#region src/contract/actor-scope.ts
@@ -3979,7 +4053,7 @@ function mapActorRequest(request, payer) {
 		...resolvedPayer === void 0 ? {} : { payer: resolvedPayer },
 		amount: request.amount,
 		reference: request.reference,
-		status: mapActorRequestStatus(request.status),
+		status: request.status,
 		expiresAt: request.expiresAt ?? null
 	};
 }
@@ -4037,28 +4111,17 @@ function mapApprovedInboxPayment(command, input) {
 		};
 	}
 }
-function mapActorRequestStatus(status) {
+function mapInboxStatus(status) {
 	switch (status) {
 		case "draft":
 		case "sent":
-		case "viewed":
+		case "viewed": return "open";
+		case "pending_settlement": return "approved";
 		case "paid":
-		case "pending_settlement":
-		case "declined":
-		case "cancelled":
-		case "expired": return status;
-		default: return "sent";
-	}
-}
-function mapInboxStatus(status) {
-	switch (status) {
-		case "approved":
 		case "declined":
-		case "paid":
 		case "cancelled":
 		case "expired": return status;
-		case "pending_settlement": return "approved";
-		default: return "open";
+		default: throw Errors.invalidInput("status", "unknown request status");
 	}
 }
 function normalizeRefForBackend$1(ref, field) {
@@ -4377,6 +4440,7 @@ const financialOpsContract = {
 	listPayments: makeFunctionReference(CAPXUL_FUNCTIONS["financialOps/queries"].listPayments),
 	getPayment: makeFunctionReference(CAPXUL_FUNCTIONS["financialOps/queries"].getPayment),
 	activityList: makeFunctionReference(CAPXUL_FUNCTIONS["movement/activity"].list),
+	activitySummary: makeFunctionReference(CAPXUL_FUNCTIONS["movement/activity"].summary),
 	activityGet: makeFunctionReference(CAPXUL_FUNCTIONS["movement/activity"].get),
 	activityAnnotate: makeFunctionReference(CAPXUL_FUNCTIONS["movement/activity"].annotate),
 	verifyPaymentDocument: makeFunctionReference(CAPXUL_FUNCTIONS["financialOps/queries"].verifyPaymentDocument),
@@ -4550,7 +4614,10 @@ function canonicalJson(value) {
 async function fingerprintPaymentIntent(intent) {
 	return keccak256(toBytes(canonicalJson(intent)));
 }
-async function executePrepared(deps, prepare, expectedRequest, signal) {
+function matchesIntent(expected) {
+	return async (request) => await fingerprintPaymentIntent(request) === await fingerprintPaymentIntent(expected);
+}
+async function executePrepared(deps, prepare, isExpectedRequest, signal) {
 	if (isAborted$1(signal)) return {
 		ok: false,
 		error: Errors.cancelled({ operation: "payments" })
@@ -4571,7 +4638,7 @@ async function executePrepared(deps, prepare, expectedRequest, signal) {
 	}
 	const prepared = await prepare(signerAddress);
 	if (!prepared.ok) return prepared;
-	if (await fingerprintPaymentIntent(prepared.value.request) !== await fingerprintPaymentIntent(expectedRequest)) return {
+	if (!await isExpectedRequest(prepared.value.request)) return {
 		ok: false,
 		error: Errors.invalidInput("payment", "prepared command mismatch")
 	};
@@ -4606,13 +4673,13 @@ function executePaymentLifecycle(deps, intent, signal) {
 	return executePrepared(deps, (signerAddress) => runIfActive(signal, "payments.prepareLifecycleExecution", () => deps.convexCall.action(deps.functions.preparePaymentLifecycleExecution, { input: {
 		signerAddress,
 		intent
-	} })), intent, signal);
+	} })), matchesIntent(intent), signal);
 }
 function executeOrganizationPayment(deps, input, signal) {
 	return executePrepared(deps, (signerAddress) => runIfActive(signal, "organizationPayments.prepareExecution", () => deps.convexCall.action(deps.functions.prepareOrganizationPaymentExecution, { input: {
 		...input,
 		signerAddress
-	} })), input, signal);
+	} })), matchesIntent(input), signal);
 }
 //#endregion
 //#region src/surface/money.ts
@@ -4628,6 +4695,40 @@ function actorReferenceToBackend(actor) {
 		case "org": return actor;
 	}
 }
+/**
+* The activity backend gives its actor a different name than the other
+* financialOps functions: `{kind: "organization", orgId}`, and not
+* `{kind: "org", orgId}`. Thus it does not use `actorReferenceToBackend`.
+*
+* The `personal` case sends NO actor. This is correct, and it does not lose
+* data. `requireActivityActor` uses the signed-in Account when the actor is
+* absent, and `canReadActor` refuses all other account identifiers
+* (`packages/backend/convex/movement/activityAuth.ts`). Thus "personal" and
+* "absent" both name the one Account that an SDK caller can read. The SDK does
+* not hold an account identifier to send.
+*
+* The `switch` is exhaustive. A new `ActorReference` variant is a compile error
+* here. The conditional expression that this function replaced removed each
+* value that was not an organization.
+*/
+function activityActorField(actor) {
+	if (actor === void 0) return {};
+	switch (actor.kind) {
+		case "personal": return {};
+		case "organization": return { actor: {
+			kind: "organization",
+			orgId: actor.organizationId
+		} };
+	}
+}
+/** An absent actor and a `personal` actor both name the signed-in Account. */
+function actorScopeKey(actor) {
+	return actor === void 0 || actor.kind === "personal" ? "personal" : `org:${actor.organizationId}`;
+}
+/** Two actor references name the same scope. */
+function sameActor(left, right) {
+	return actorScopeKey(left) === actorScopeKey(right);
+}
 const memoryPaymentRequestKeys = /* @__PURE__ */ new Map();
 const paymentAttemptReleases = /* @__PURE__ */ new Set();
 let paymentAttemptPagehideInstalled = false;
@@ -5058,31 +5159,48 @@ function makeFinancialOpsMethods(deps) {
 		},
 		activity: {
 			list: (params, options) => runIfActive(options?.signal, "activity.list", () => deps.convexCall.query(fns.activityList, { input: {
-				...params?.actor?.kind === "organization" ? { actor: {
-					kind: "organization",
-					orgId: params.actor.organizationId
-				} } : {},
+				...activityActorField(params?.actor),
 				...params?.cursor === void 0 ? {} : { cursor: params.cursor },
-				...params?.limit === void 0 ? {} : { limit: params.limit }
+				...params?.limit === void 0 ? {} : { limit: params.limit },
+				...params?.range === void 0 ? {} : { range: params.range },
+				...params?.filter === void 0 ? {} : { filter: params.filter }
 			} })),
-			get: (reference, options) => runIfActive(options?.signal, "activity.get", () => deps.convexCall.query(fns.activityGet, { input: {
-				kind: reference.kind,
-				id: reference.id,
-				...reference.kind === "payment" && reference.actor?.kind === "organization" ? { actor: {
-					kind: "organization",
-					orgId: reference.actor.organizationId
-				} } : {}
+			summary: (params, options) => runIfActive(options?.signal, "activity.summary", () => deps.convexCall.query(fns.activitySummary, { input: {
+				...activityActorField(params?.actor),
+				...params?.window === void 0 ? {} : { window: params.window }
 			} })),
-			annotate: (input, options) => runIfActive(options?.signal, "activity.annotate", () => deps.convexCall.mutation(fns.activityAnnotate, { input: {
-				...input.actor?.kind === "organization" ? { actor: {
-					kind: "organization",
-					orgId: input.actor.organizationId
-				} } : {},
-				movementId: input.movementId,
-				...input.counterpartyLabel === void 0 ? {} : { counterpartyLabel: input.counterpartyLabel },
-				...input.accountingCategory === void 0 ? {} : { accountingCategory: input.accountingCategory },
-				...input.memo === void 0 ? {} : { memo: input.memo }
-			} }))
+			get: (reference, options) => {
+				const actor = actorReferenceToBackend(options?.actor);
+				return runIfActive(options?.signal, "activity.get", () => deps.convexCall.query(fns.activityGet, {
+					input: {
+						kind: reference.kind,
+						id: reference.id,
+						...reference.kind === "payment" ? activityActorField(reference.actor) : {}
+					},
+					...actor === void 0 ? {} : { actor }
+				}));
+			},
+			annotate: (input, options) => {
+				if (input.actor !== void 0 && input.reference.kind === "payment" && input.reference.actor !== void 0 && !sameActor(input.actor, input.reference.actor)) return Promise.resolve({
+					ok: false,
+					error: Errors.invalidInput("reference.actor", "must match the annotation actor")
+				});
+				const referenceActor = input.reference.kind === "payment" ? activityActorField(input.reference.actor).actor : void 0;
+				return runIfActive(options?.signal, "activity.annotate", () => deps.convexCall.mutation(fns.activityAnnotate, { input: {
+					...activityActorField(input.actor),
+					reference: input.reference.kind === "payment" && referenceActor !== void 0 ? {
+						kind: "payment",
+						id: input.reference.id,
+						actor: referenceActor
+					} : {
+						kind: input.reference.kind,
+						id: input.reference.id
+					},
+					...input.counterpartyLabel === void 0 ? {} : { counterpartyLabel: input.counterpartyLabel },
+					...input.accountingCategory === void 0 ? {} : { accountingCategory: input.accountingCategory },
+					...input.memo === void 0 ? {} : { memo: input.memo }
+				} }));
+			}
 		},
 		offramp: {
 			quote: (input, options) => {
@@ -5410,7 +5528,7 @@ function mapOk(result, f) {
 }
 //#endregion
 //#region package.json
-var version = "2.3.2";
+var version = "2.5.0";
 //#endregion
 //#region src/ports/auth-client.ts
 var AuthClientError = class extends Data.TaggedError("AuthClientError") {};
@@ -5584,7 +5702,8 @@ const TelemetryEnvelopeProps = {
 		"development",
 		"staging",
 		"production",
-		"unknown"
+		"unknown",
+		"local"
 	]),
 	producer: Schema.Literals([
 		"server",
@@ -7476,7 +7595,7 @@ function makePermissionMethods(deps, orgId) {
 }
 //#endregion
 //#region src/surface/organization-payments.ts
-function executionDependencies(input) {
+function executionDependencies$1(input) {
 	return input.actor === void 0 || input.chainId === void 0 || input.signer === void 0 ? null : {
 		actor: input.actor,
 		chainId: input.chainId,
@@ -7493,7 +7612,7 @@ function makeOrganizationPaymentsMethods(deps, orgId) {
 			ok: false,
 			error: Errors.cancelled({ operation })
 		};
-		const execution = executionDependencies(deps);
+		const execution = executionDependencies$1(deps);
 		if (execution === null) return {
 			ok: false,
 			error: Errors.notImplemented("organizationPayments", "executionComposition")
@@ -7588,6 +7707,197 @@ function makeOrganizationPaymentsMethods(deps, orgId) {
 	};
 }
 //#endregion
+//#region src/contract/payroll.ts
+const payrollContract = {
+	authorizeRun: makeFunctionReference(CAPXUL_FUNCTIONS["payroll/actions"].authorizeRun),
+	runs: makeFunctionReference(CAPXUL_FUNCTIONS["payroll/queries"].runs),
+	groups: makeFunctionReference(CAPXUL_FUNCTIONS["payroll/queries"].groups),
+	saveGroup: makeFunctionReference(CAPXUL_FUNCTIONS["payroll/mutations"].saveGroup),
+	removeGroup: makeFunctionReference(CAPXUL_FUNCTIONS["payroll/mutations"].removeGroup)
+};
+//#endregion
+//#region src/surface/payroll.ts
+const AUTHORIZE_RUN = "payroll.authorizeRun";
+function toPayrollRun(wire) {
+	return {
+		id: toPayrollRunId(wire.id),
+		status: wire.status,
+		periodStart: wire.periodStart,
+		periodEnd: wire.periodEnd,
+		total: wire.total,
+		recipientCount: wire.recipientCount
+	};
+}
+function toPayrollRuns(wire) {
+	return {
+		runs: wire.runs.map(toPayrollRun),
+		settledThisMonth: wire.settledThisMonth
+	};
+}
+function toPayrollGroup(wire) {
+	return {
+		id: toPayrollGroupId(wire.id),
+		name: wire.name,
+		tone: wire.tone,
+		members: wire.members.map((member) => ({
+			partyId: member.partyId,
+			amount: member.amount,
+			currency: member.currency
+		}))
+	};
+}
+const MINOR_UNIT_INTEGER = /^-?\d+$/u;
+/**
+* One prepared `Money` counted in the minor units `net` is written in, or
+* `null` when the value is not a decimal number. `amount.value` is a DECIMAL
+* string (`"200"` at 6 decimals is 200000000 minor units), so comparing it to
+* `net` directly would compare two different units and pass nothing.
+*/
+function minorUnits(amount) {
+	const [whole = "", fraction = ""] = amount.value.split(".");
+	if (!/^\d+$/u.test(whole) || !/^\d*$/u.test(fraction) || fraction.length > amount.decimals) return null;
+	return BigInt(whole + fraction.padEnd(amount.decimals, "0"));
+}
+/**
+* One prepared item must pay the person this caller named, the amount this
+* caller set, under a payslip that attests to the same figures.
+*
+* `issuedAt` and `employerRef` are server facts the caller cannot contradict,
+* so they are not compared. Everything the caller DID supply is: the recipient
+* `Ref`, the transfer amount against `net`, and the payslip's employee, gross
+* and net. Adjustments are not in the signed command at all — the backend
+* enforces `gross + Σ adjustments === net` (ADR-0022 R8), and gross and net
+* being right is what the signer can prove here.
+*/
+function isRunItem(prepared, item) {
+	if (prepared === void 0) return false;
+	const payslip = prepared.document;
+	return canonicalJson(prepared.to) === canonicalJson(item.to) && prepared.paymentType === "payroll" && MINOR_UNIT_INTEGER.test(item.net) && minorUnits(prepared.amount) === BigInt(item.net) && payslip?.primaryType === "Payslip" && payslip.message.employeeRef === item.partyId && payslip.message.gross === item.gross && payslip.message.net === item.net;
+}
+/**
+* The batch the backend derived from a payroll intent must be the batch this
+* caller asked for, checked before the digest is signed.
+*
+* The payslip envelope on each item is server-built and carries the run row's
+* own `issuedAt`, so the batch cannot be fingerprinted against a local copy
+* (`matchesIntent` is unavailable here). What CAN be verified is every field
+* the caller supplied — the org, the Budget, the request key, and per item the
+* recipient, the amount and the payslip figures — plus the lineage binding the
+* batch to the run just written. A prepared command that pays a different
+* person, a different amount, from a different Budget, or under a different
+* run never reaches the signer.
+*/
+function isRunBatch(input) {
+	return (request) => {
+		const batch = request;
+		return Promise.resolve(batch.orgId === input.orgId && batch.permissionId === input.permissionId && batch.requestKey === input.requestKey && batch.lineage?.kind === "payroll" && batch.lineage.runId === input.runId && batch.items?.length === input.items.length && input.items.every((item, index) => isRunItem(batch.items?.[index], item)));
+	};
+}
+function executionDependencies(deps) {
+	return deps.actor === void 0 || deps.chainId === void 0 || deps.signer === void 0 ? null : {
+		actor: deps.actor,
+		chainId: deps.chainId,
+		convexCall: deps.convexCall,
+		functions: moneyExecutionContract,
+		signer: deps.signer
+	};
+}
+function makePayrollMethods(deps, orgId) {
+	const requestKeyScope = deps.requestKeyScope ?? `client-${crypto.randomUUID()}`;
+	async function authorize(input, signal) {
+		const execution = executionDependencies(deps);
+		if (execution === null) return {
+			ok: false,
+			error: Errors.notImplemented("payroll", "executionComposition")
+		};
+		const requestKey = await paymentRequestKeyLifecycle(`${requestKeyScope}:${AUTHORIZE_RUN}`, {
+			orgId,
+			input
+		}, input.requestKey);
+		let authorized;
+		const submitted = await executePrepared(execution, async (signerAddress) => {
+			const prepared = await runIfActive(signal, AUTHORIZE_RUN, () => deps.convexCall.action(payrollContract.authorizeRun, { input: {
+				orgId,
+				permissionId: input.permissionId,
+				requestKey: requestKey.key,
+				signerAddress,
+				period: input.period,
+				items: input.items
+			} }));
+			if (!prepared.ok) return prepared;
+			authorized = prepared.value.run;
+			return {
+				ok: true,
+				value: prepared.value.execution
+			};
+		}, (request) => authorized === void 0 || authorized.periodStart !== input.period.start || authorized.periodEnd !== input.period.end ? Promise.resolve(false) : isRunBatch({
+			orgId,
+			permissionId: input.permissionId,
+			requestKey: requestKey.key,
+			runId: authorized.id,
+			items: input.items
+		})(request), signal);
+		try {
+			await requestKey.finish(submitted.ok);
+		} catch {}
+		if (!submitted.ok) return submitted;
+		return authorized === void 0 ? {
+			ok: false,
+			error: Errors.unknown()
+		} : {
+			ok: true,
+			value: toPayrollRun(authorized)
+		};
+	}
+	return {
+		runs: (options) => runIfActive(options?.signal, "payroll.runs", () => Effect.map(deps.convexCall.query(payrollContract.runs, { orgId }), toPayrollRuns)),
+		authorizeRun: async (input, options) => {
+			if (options?.signal?.aborted === true) return {
+				ok: false,
+				error: Errors.cancelled({ operation: AUTHORIZE_RUN })
+			};
+			try {
+				return await authorize(input, options?.signal);
+			} catch (cause) {
+				return {
+					ok: false,
+					error: cause instanceof CapxulError ? cause : Errors.unknown(cause)
+				};
+			}
+		},
+		groups: {
+			list: (options) => runIfActive(options?.signal, "payroll.groups.list", () => Effect.map(deps.convexCall.query(payrollContract.groups, { orgId }), (groups) => groups.map(toPayrollGroup))),
+			save: (input, options) => runIfActive(options?.signal, "payroll.groups.save", () => Effect.map(deps.convexCall.mutation(payrollContract.saveGroup, {
+				orgId,
+				...input.id === void 0 ? {} : { id: String(input.id) },
+				name: input.name,
+				tone: input.tone,
+				members: input.members
+			}), toPayrollGroup)),
+			remove: (id, options) => runIfActive(options?.signal, "payroll.groups.remove", () => Effect.map(deps.convexCall.mutation(payrollContract.removeGroup, {
+				orgId,
+				id
+			}), () => void 0))
+		}
+	};
+}
+const payrollUnavailable = () => Promise.resolve({
+	ok: false,
+	error: Errors.notImplemented("payroll", "executionComposition")
+});
+/** The bundle an unconfigured client exposes — every verb refuses, none throws. */
+function makeUnavailablePayrollMethods() {
+	return {
+		runs: payrollUnavailable,
+		authorizeRun: payrollUnavailable,
+		groups: {
+			list: payrollUnavailable,
+			save: payrollUnavailable,
+			remove: payrollUnavailable
+		}
+	};
+}
+//#endregion
 //#region src/surface/_shared/org-telemetry.ts
 /** Extract the domain from an email for telemetry (never the local part / PII). */
 function emailDomain$1(email) {
@@ -8125,6 +8435,13 @@ function makeOrgMethods(deps) {
 					...deps.actor === void 0 ? {} : { actor: deps.actor },
 					...deps.chainId === void 0 ? {} : { chainId: Number(deps.chainId) },
 					...deps.signer === void 0 ? {} : { signer: deps.signer }
+				}, String(orgId)),
+				payroll: convexCall === void 0 ? makeUnavailablePayrollMethods() : makePayrollMethods({
+					convexCall,
+					...deps.requestKeyScope === void 0 ? {} : { requestKeyScope: deps.requestKeyScope },
+					...deps.actor === void 0 ? {} : { actor: deps.actor },
+					...deps.chainId === void 0 ? {} : { chainId: Number(deps.chainId) },
+					...deps.signer === void 0 ? {} : { signer: deps.signer }
 				}, String(orgId))
 			};
 		}
@@ -8163,13 +8480,74 @@ const organizationPaymentExecutionUnavailable = () => Promise.resolve({
 //#region src/contract/holdings.ts
 const holdingsContract = { current: makeFunctionReference(CAPXUL_FUNCTIONS["holdings/actions"].current) };
 //#endregion
+//#region src/domain/money/primary-holding.ts
+const CURRENCY_BY_TOKEN_SYMBOL = new Map([["USDX", toCurrencyCode("USD")]]);
+/**
+* The designated display asset: the payable row holding the most money, or
+* `null` when no row is payable.
+*
+* A `HoldingRow` (`packages/wire/src/money.ts`) is a RAW CHAIN ROW, and three
+* of its shapes cannot become a `Holding`. Each is SKIPPED rather than
+* reported, because a row nobody can render is not a failure of the read:
+*
+*   - no `decimals` — the raw balance cannot be lifted into major units;
+*   - no `symbol` — the asset cannot be named;
+*   - a symbol that stands for no supported `CurrencyCode` — the balance
+*     cannot be stated as `Money` without inventing a currency for it.
+*
+* This replaces the app's hand pick in `formatCurrentHoldingsBalance`
+* (`dashboard-formatters.ts`): a `.find()` over a hardcoded `["USDX","USDC"]`
+* list falling back to `rows[0]`. Ties keep the earlier row, so the same
+* snapshot always yields the same answer.
+*/
+function primaryHolding(rows) {
+	let primary = null;
+	for (const row of rows) {
+		const holding = toHolding(row);
+		if (holding === null) continue;
+		if (primary === null || compareDecimal(holding.available.value, primary.available.value) > 0) primary = holding;
+	}
+	return primary;
+}
+function toHolding(row) {
+	if (row.symbol === void 0 || row.decimals === void 0) return null;
+	const currency = currencyForTokenSymbol(row.symbol);
+	if (currency === null) return null;
+	return {
+		id: row.assetKind === "native" ? "native" : row.tokenAddress.toLowerCase(),
+		symbol: row.symbol,
+		available: fromWei(row.rawBalance, row.decimals, currency)
+	};
+}
+function currencyForTokenSymbol(symbol) {
+	return CURRENCY_BY_TOKEN_SYMBOL.get(symbol.toUpperCase()) ?? null;
+}
+/**
+* Order two non-negative major-unit decimal strings without converting either
+* to a JavaScript number. Rows carry different `decimals`, so the raw integers
+* are not comparable: 1999999999 at 9 decimals is LESS than 2000000 at 6.
+*/
+function compareDecimal(first, second) {
+	const [firstWhole = "0", firstFraction = ""] = first.split(".");
+	const [secondWhole = "0", secondFraction = ""] = second.split(".");
+	const width = Math.max(firstFraction.length, secondFraction.length);
+	const firstScaled = BigInt(firstWhole + firstFraction.padEnd(width, "0"));
+	const secondScaled = BigInt(secondWhole + secondFraction.padEnd(width, "0"));
+	if (firstScaled === secondScaled) return 0;
+	return firstScaled < secondScaled ? -1 : 1;
+}
+//#endregion
 //#region src/surface/holdings.ts
 function makeHoldingsMethods(deps) {
 	const functions = deps.functions ?? holdingsContract;
-	return { current: (input, options) => runIfActive(options?.signal, "holdings.current", () => deps.convexCall.action(functions.current, input?.actor?.kind === "organization" ? { actor: {
+	const read = (operation, actor, signal, pick) => runIfActive(signal, operation, () => deps.convexCall.action(functions.current, actor?.kind === "organization" ? { actor: {
 		kind: "organization",
-		orgId: input.actor.organizationId
-	} } : {})) };
+		orgId: actor.organizationId
+	} } : {}).pipe(Effect.map(pick)));
+	return {
+		current: (input, options) => read("holdings.current", input?.actor, options?.signal, (snapshot) => snapshot),
+		primary: (input, options) => read("holdings.primary", input?.actor, options?.signal, (snapshot) => primaryHolding(snapshot.rows))
+	};
 }
 //#endregion
 //#region src/surface/factory.ts
@@ -8998,4 +9376,4 @@ function withHostObservation(actor, snapshot) {
 	};
 }
 //#endregion
-export { fingerprintPaymentIntent as A, formatTraceparent as B, ClockPortTag as C, AuthClientError as D, authClientPortFromPromiseAdapter as E, sanitizeObservationContext as F, signerFailure as G, readInvocationObservation as H, CAPXUL_FUNCTIONS as I, BASE_SEPOLIA_CHAIN_ID as J, CAPXUL_PAYMENTS_V2_ADDRESS as K, BootstrapEnvelope as L, fromWei as M, OBSERVATION_CONTEXT_HEADER as N, AuthClientPortTag as O, encodeObservationContextHeader as P, isRestoring as Q, EngineeringTelemetryBootstrapPolicy as R, ClockError as S, bootstrapErrorFromCapxul as T, causeChain as U, copyInvocationObservation as V, injectedWalletSigner as W, destination as X, deriveCapxulSafeAddress as Y, isClaimed as Z, wireChainId as _, observeFailedResult as a, ConvexCallPortTag as b, captureExceptionSync as c, TelemetryPortTag as d, redactTelemetryEvent as f, accountReadErrorFromCapxul as g, AccountReadPortTag as h, observationContextProps as i, toWei as j, version as k, detectAuthCacheAdapter as l, smartAccountErrorFromCapxul as m, postHogProductTelemetry as n, postHogFailureObservation as o, SmartAccountPortTag as p, normalizeBindingEmail as q, CAPXUL_SDK_EXPECTED_OUTCOME_EVENT as r, captureException as s, assembleCapxulClient as t, PostHogTelemetryLayer as u, IdentityPortTag as v, BootstrapPortTag as w, convexCallErrorFromCapxul as x, identityErrorFromCapxul as y, isSettingUpLifecycle as z };
+export { isClaimed as $, fingerprintPaymentIntent as A, OBSERVATION_CONTEXT_HEADER as B, ClockPortTag as C, AuthClientError as D, authClientPortFromPromiseAdapter as E, copyInvocationObservation as F, CAPXUL_FUNCTIONS as G, sanitizeObservationContext as H, readInvocationObservation as I, CAPXUL_PAYMENTS_V2_ADDRESS as J, BootstrapEnvelope as K, causeChain as L, fromWei as M, isSettingUpLifecycle as N, AuthClientPortTag as O, formatTraceparent as P, destination as Q, injectedWalletSigner as R, ClockError as S, bootstrapErrorFromCapxul as T, PAYMENT_DIRECTIONS as U, encodeObservationContextHeader as V, PAYMENT_STATUSES as W, BASE_SEPOLIA_CHAIN_ID as X, normalizeBindingEmail as Y, deriveCapxulSafeAddress as Z, wireChainId as _, observeFailedResult as a, ConvexCallPortTag as b, captureExceptionSync as c, TelemetryPortTag as d, isRestoring as et, redactTelemetryEvent as f, accountReadErrorFromCapxul as g, AccountReadPortTag as h, observationContextProps as i, toWei as j, version as k, detectAuthCacheAdapter as l, smartAccountErrorFromCapxul as m, postHogProductTelemetry as n, postHogFailureObservation as o, SmartAccountPortTag as p, EngineeringTelemetryBootstrapPolicy as q, CAPXUL_SDK_EXPECTED_OUTCOME_EVENT as r, captureException as s, assembleCapxulClient as t, PostHogTelemetryLayer as u, IdentityPortTag as v, BootstrapPortTag as w, convexCallErrorFromCapxul as x, identityErrorFromCapxul as y, signerFailure as z };