@capxul/sdk 2.4.0 → 2.5.1

package/dist/{InMemoryAuthCacheAdapter-qMpBOGb3.mjs → InMemoryAuthCacheAdapter-uOcqpqu8.mjs}

@@ -96,10 +96,12 @@ const Errors = {
 	accountNotFound: (accountId) => new CapxulError("ACCOUNT_NOT_FOUND", accountId ? `Openfort account ${accountId} not found` : "Openfort account not found", accountId === void 0 ? void 0 : { details: { accountId } }),
 	providerError: (provider, operation, cause, opts) => {
 		const details = {
+			...opts?.details,
 			provider,
 			operation
 		};
 		if (opts?.failure_mode) details.failure_mode = opts.failure_mode;
+		if (opts?.httpStatus !== void 0) details.httpStatus = opts.httpStatus;
 		return new CapxulError("PROVIDER_ERROR", `Provider error: ${provider} ${operation}`, {
 			cause,
 			details
@@ -293,6 +295,12 @@ function toPartyId(raw) {
 function toBudgetId(raw) {
 	return toNonEmptyStringBrand(raw, "budgetId");
 }
+function toPayrollRunId(raw) {
+	return toNonEmptyStringBrand(raw, "payrollRunId");
+}
+function toPayrollGroupId(raw) {
+	return toNonEmptyStringBrand(raw, "payrollGroupId");
+}
 function toOrgId(raw) {
 	return toNonEmptyStringBrand(raw, "orgId");
 }
@@ -488,4 +496,4 @@ Layer.effect(AuthCachePortTag, Effect.sync(() => new InMemoryAuthCacheAdapter())
 	cause
 }))));
 //#endregion
-export { toPartyId as A, toDurationMs as C, toJwtToken as D, toEpochSeconds as E, CAPXUL_ERROR_CODES as F, CapxulError as I, EXPECTED_OPERATION_OUTCOMES as L, toRoleKey as M, toSessionToken as N, toKycTier as O, decodeConvexError as P, Errors as R, toCurrencyCode as S, toEpochMs as T, toAppId as _, AuthCacheError as a, toChainId as b, BYTES32_RE as c, WEI_RE as d, ZERO_BYTES32 as f, toAllowedOrigin as g, toAddress as h, parseCachedJwt as i, toPublishableKey as j, toOrgId as k, EVM_ADDRESS_RE as l, toAccountId as m, BrowserAuthCacheAdapter as n, AuthCachePortTag as o, currencySymbolFor as p, parseAuthSession as r, APP_ID_RE as s, InMemoryAuthCacheAdapter as t, SUPPORTED_CURRENCY_CODES as u, toAuthUserId as v, toEmail as w, toCountryCode as x, toBudgetId as y, isCapxulError as z };
+export { toPartyId as A, Errors as B, toDurationMs as C, toJwtToken as D, toEpochSeconds as E, toSessionToken as F, decodeConvexError as I, CAPXUL_ERROR_CODES as L, toPayrollRunId as M, toPublishableKey as N, toKycTier as O, toRoleKey as P, CapxulError as R, toCurrencyCode as S, toEpochMs as T, isCapxulError as V, toAppId as _, AuthCacheError as a, toChainId as b, BYTES32_RE as c, WEI_RE as d, ZERO_BYTES32 as f, toAllowedOrigin as g, toAddress as h, parseCachedJwt as i, toPayrollGroupId as j, toOrgId as k, EVM_ADDRESS_RE as l, toAccountId as m, BrowserAuthCacheAdapter as n, AuthCachePortTag as o, currencySymbolFor as p, parseAuthSession as r, APP_ID_RE as s, InMemoryAuthCacheAdapter as t, SUPPORTED_CURRENCY_CODES as u, toAuthUserId as v, toEmail as w, toCountryCode as x, toBudgetId as y, EXPECTED_OPERATION_OUTCOMES as z };

package/dist/{create-capxul-client-BrE6tLg6.mjs → create-capxul-client-B050H6SY.mjs}

@@ -1,4 +1,4 @@
-import { A as toPartyId, I as CapxulError, L as EXPECTED_OPERATION_OUTCOMES, M as toRoleKey, R as Errors, S as toCurrencyCode, b as toChainId, c as BYTES32_RE, d as WEI_RE, f as ZERO_BYTES32, h as toAddress, k as toOrgId, l as EVM_ADDRESS_RE$1, m as toAccountId, n as BrowserAuthCacheAdapter, s as APP_ID_RE, t as InMemoryAuthCacheAdapter, u as SUPPORTED_CURRENCY_CODES, v as toAuthUserId, w as toEmail, x as toCountryCode, y as toBudgetId, z as isCapxulError } from "./InMemoryAuthCacheAdapter-qMpBOGb3.mjs";
+import { A as toPartyId, B as Errors, M as toPayrollRunId, P as toRoleKey, R as CapxulError, S as toCurrencyCode, V as isCapxulError, b as toChainId, c as BYTES32_RE, d as WEI_RE, f as ZERO_BYTES32, h as toAddress, j as toPayrollGroupId, k as toOrgId, l as EVM_ADDRESS_RE$1, m as toAccountId, n as BrowserAuthCacheAdapter, s as APP_ID_RE, t as InMemoryAuthCacheAdapter, u as SUPPORTED_CURRENCY_CODES, v as toAuthUserId, w as toEmail, x as toCountryCode, y as toBudgetId, z as EXPECTED_OPERATION_OUTCOMES } from "./InMemoryAuthCacheAdapter-uOcqpqu8.mjs";
 import { concat, encodeAbiParameters, encodeFunctionData, encodePacked, formatUnits, getContractAddress, keccak256, padHex, parseUnits, recoverAddress, stringToHex, toBytes, toEventSelector, toFunctionSelector, toFunctionSignature } from "viem";
 import { Context, Data, Deferred, Effect, Exit, Fiber, Layer, Queue, Ref, Result, Schema, SchemaGetter, Scope } from "effect";
 import { makeFunctionReference } from "convex/server";
@@ -1490,6 +1490,15 @@ const CAPXUL_FUNCTIONS = {
 		resumeBootstrapSubmission: "org/actions:resumeBootstrapSubmission",
 		submitBootstrap: "org/actions:submitBootstrap"
 	},
+	"payroll/actions": { authorizeRun: "payroll/actions:authorizeRun" },
+	"payroll/mutations": {
+		removeGroup: "payroll/mutations:removeGroup",
+		saveGroup: "payroll/mutations:saveGroup"
+	},
+	"payroll/queries": {
+		groups: "payroll/queries:groups",
+		runs: "payroll/queries:runs"
+	},
 	"permission/actions": { verify: "permission/actions:verify" },
 	"permission/mutations": { command: "permission/mutations:command" },
 	"permission/queries": {
@@ -2683,7 +2692,7 @@ Schema.Struct({
 	items: Schema.Array(OrganizationPaymentExecutionItemSchema),
 	lineage: Schema.optional(PaymentCommandLineageSchema)
 });
-Schema.Struct({
+const PreparedPaymentCommandExecutionSchema = Schema.Struct({
 	executionId: MoneyExecutionIdSchema,
 	commandId: PaymentCommandIdSchema,
 	paymentIds: Schema.Array(PaymentIdSchema),
@@ -2776,6 +2785,69 @@ Schema.Struct({
 	userOpHash: Bytes32Schema,
 	value: PermissionResourceSchema
 });
+const PayrollRunStatusSchema = Schema.Literals([
+	"draft",
+	"authorized",
+	"settled"
+]);
+const PayrollRunIdSchema = Schema.String.pipe(Schema.refine((value) => /^payroll_run_[0-9a-f]{64}$/u.test(value), { message: "payrollRunId must be a payroll_run_ digest identifier" }));
+const SignedMinorUnitSchema = Schema.String.pipe(Schema.refine((value) => /^-?(0|[1-9][0-9]*)$/u.test(value), { message: "must be an integer minor-unit string" }));
+const MinorUnitSchema = Schema.String.pipe(Schema.refine((value) => /^(0|[1-9][0-9]*)$/u.test(value), { message: "must be a non-negative integer minor-unit string" }));
+const PayrollRunItemInputSchema = Schema.Struct({
+	to: PaymentRef,
+	partyId: nonEmpty("partyId"),
+	gross: MinorUnitSchema,
+	net: MinorUnitSchema,
+	adjustments: Schema.Array(Schema.Struct({
+		label: Schema.String,
+		amount: SignedMinorUnitSchema
+	}))
+});
+Schema.Struct({
+	orgId: nonEmpty("orgId"),
+	permissionId: PermissionIdSchema,
+	requestKey: nonEmpty("requestKey"),
+	signerAddress: AddressSchema$1,
+	period: Schema.Struct({
+		start: nonNegativeInteger("period.start"),
+		end: nonNegativeInteger("period.end")
+	}),
+	items: Schema.Array(PayrollRunItemInputSchema)
+});
+const PayrollRunSchema = Schema.Struct({
+	id: PayrollRunIdSchema,
+	status: PayrollRunStatusSchema,
+	periodStart: nonNegativeInteger("periodStart"),
+	periodEnd: nonNegativeInteger("periodEnd"),
+	total: FinancialOpsMoney,
+	recipientCount: nonNegativeInteger("recipientCount")
+});
+Schema.Struct({
+	runs: Schema.Array(PayrollRunSchema),
+	settledThisMonth: FinancialOpsMoney
+});
+Schema.Struct({
+	run: PayrollRunSchema,
+	execution: PreparedPaymentCommandExecutionSchema
+});
+const PayrollGroupIdSchema = Schema.String.pipe(Schema.refine((value) => /^payroll_group_[0-9A-Z]{26}$/u.test(value), { message: "payrollGroupId must be a payroll_group_ ULID identifier" }));
+const PayrollGroupMemberSchema = Schema.Struct({
+	partyId: PartyIdSchema,
+	amount: Schema.String,
+	currency: CurrencyCodeSchema$1
+});
+Schema.Struct({
+	id: PayrollGroupIdSchema,
+	name: nonEmpty("name"),
+	tone: Schema.String,
+	members: Schema.Array(PayrollGroupMemberSchema)
+});
+Schema.Struct({
+	id: Schema.optional(PayrollGroupIdSchema),
+	name: Schema.String,
+	tone: Schema.String,
+	members: Schema.Array(PayrollGroupMemberSchema)
+});
 `
 .capxul-doc{--ink:#1d1d1f;--muted:#6e6e73;--line:#e7e7ea;--accent:#0a7d4b;--bg:#fff;
   font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Inter,system-ui,sans-serif;
@@ -2830,6 +2902,9 @@ const SENSITIVE_MATERIAL_PATTERNS = [
 	/eyJ[A-Za-z0-9_-]*\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+/u,
 	/(?:(?:sk|pk|rk)_(?:live|test)|(?:phc|phx|ghp|gho|ghu|ghs|ghr|whsec)_|github_pat_|xox[baprs]-|AKIA[0-9A-Z]{16}|AIza)[A-Za-z0-9_-]*/iu
 ];
+const RAW_PRIVATE_KEY_MASK = /(^|[^a-fA-F0-9])[a-fA-F0-9]{64}(?=$|[^a-fA-F0-9])/gu;
+const KNOWN_CREDENTIAL_MASK = /(?:(?:sk|pk|rk)_(?:live|test)|(?:phc|phx|ghp|gho|ghu|ghs|ghr|whsec)_|github_pat_|xox[baprs]-|AKIA[0-9A-Z]{16}|AIza)[A-Za-z0-9_-]*/giu;
+const LABELLED_SECRET_MASK = /\b(api[ _-]?key|access[ _-]?token|token|secret|password|passphrase|private[ _-]?key|authorization|cookie|signature|request[ _-]?body|credential|otp|one[ _-]?time[ _-]?(?:password|code)|verification[ _-]?code)\b\s*[:=]\s*(?:"[^"]*"|'[^']*'|[^\s,;]+)/giu;
 /**
 * Reject: does the value carry any known secret material? Best effort — callers
 * drop the whole value on a match; a false negative is a leak, a false positive
@@ -2838,6 +2913,14 @@ const SENSITIVE_MATERIAL_PATTERNS = [
 function containsSensitiveMaterial(value) {
 	return SENSITIVE_MATERIAL_PATTERNS.some((pattern) => pattern.test(value));
 }
+/**
+* Mask: return the value with every known secret rewritten to `[REDACTED]`,
+* preserving surrounding text. Used where a value must still be shown (log
+* lines, issue bodies) but must not carry live credentials.
+*/
+function redactSecrets(value) {
+	return value.replace(/\bBearer\s+[^\s,;]+/giu, "Bearer [REDACTED]").replace(/\beyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\b/gu, "[REDACTED]").replace(/\b0x[a-fA-F0-9]{40,}\b/gu, "[REDACTED]").replace(RAW_PRIVATE_KEY_MASK, "$1[REDACTED]").replace(KNOWN_CREDENTIAL_MASK, "[REDACTED]").replace(LABELLED_SECRET_MASK, (_match, label) => `${label}=[REDACTED]`);
+}
 //#endregion
 //#region ../wire/src/observation-context.ts
 /** Single bounded HTTP carrier used before a Convex action envelope exists. */
@@ -3171,8 +3254,8 @@ var ActorFailure = class extends Error {
 	event;
 	details;
 	_tag = "ActorFailure";
-	constructor(reason, machine, state, event, details) {
-		super(`${machine}:${state}:${event} ${reason}`);
+	constructor(reason, machine, state, event, details, cause) {
+		super(`${machine}:${state}:${event} ${reason}`, cause === void 0 ? void 0 : { cause });
 		this.reason = reason;
 		this.machine = machine;
 		this.state = state;
@@ -3247,8 +3330,8 @@ const boot = (spec, options = {}) => Effect.gen(function* () {
 			defect(cause);
 		}
 	};
-	const makeFailure = (state, event, reason, details) => new ActorFailure(reason, spec.machine, spec.label(state), event._tag, details);
-	const nonApplied = (state, event, reason, outcome, env) => {
+	const makeFailure = (state, event, reason, details, cause) => new ActorFailure(reason, spec.machine, spec.label(state), event._tag, details, cause);
+	const nonApplied = (state, event, reason, outcome, env, failure) => {
 		const slot = env.origin?.slot ?? spec.slot(event);
 		return copyInvocationObservation(env.invocation, {
 			machine: spec.machine,
@@ -3259,7 +3342,8 @@ const boot = (spec, options = {}) => Effect.gen(function* () {
 			outcome,
 			duration_ms: duration(env.startedAt),
 			...withCarriage(env.invocation),
-			...outcome === "refused" ? { refusal_code: reason } : { error_code: reason }
+			...outcome === "refused" ? { refusal_code: reason } : { error_code: reason },
+			...failure === void 0 ? {} : { failure }
 		});
 	};
 	const applied = (from, to, event, slot, epoch, env) => copyInvocationObservation(env.invocation, {
@@ -3312,12 +3396,13 @@ const boot = (spec, options = {}) => Effect.gen(function* () {
 				slots.delete(env.origin.slot);
 				defect(exit.defect);
 				const event = { _tag: env.origin.event };
-				const failedState = yield* recoverFailure(state, env.origin, {
+				const died = {
 					code: "WORK_DIED",
-					message: "Identity work died"
-				});
-				yield* emit(nonApplied(failedState, event, "WORK_DIED", "failed", env));
-				yield* failReply(held.reply, makeFailure(failedState, event, "WORK_DIED"));
+					message: exit.defect instanceof Error ? exit.defect.message : "Identity work died"
+				};
+				const failedState = yield* recoverFailure(state, env.origin, died);
+				yield* emit(nonApplied(failedState, event, "WORK_DIED", "failed", env, died));
+				yield* failReply(held.reply, makeFailure(failedState, event, "WORK_DIED", void 0, died));
 				return;
 			}
 			if (exit.failure !== void 0) {
@@ -3325,9 +3410,9 @@ const boot = (spec, options = {}) => Effect.gen(function* () {
 				const outcome = exit.failure.code === "CANCELLED" ? "cancelled" : "failed";
 				const event = { _tag: env.origin.event };
 				const failedState = exit.failure === timeoutFailure || exit.failure === cancelledFailure ? yield* recoverFailure(state, env.origin, exit.failure) : state;
-				yield* emit(nonApplied(failedState, event, exit.failure.code, outcome, env));
+				yield* emit(nonApplied(failedState, event, exit.failure.code, outcome, env, exit.failure));
 				const details = exit.failure === timeoutFailure ? { reason: "timeout" } : void 0;
-				yield* failReply(held.reply, makeFailure(failedState, event, exit.failure.code, details));
+				yield* failReply(held.reply, makeFailure(failedState, event, exit.failure.code, details, exit.failure.error ?? exit.failure));
 				return;
 			}
 			yield* finish(env.origin, state);
@@ -4542,7 +4627,10 @@ function canonicalJson(value) {
 async function fingerprintPaymentIntent(intent) {
 	return keccak256(toBytes(canonicalJson(intent)));
 }
-async function executePrepared(deps, prepare, expectedRequest, signal) {
+function matchesIntent(expected) {
+	return async (request) => await fingerprintPaymentIntent(request) === await fingerprintPaymentIntent(expected);
+}
+async function executePrepared(deps, prepare, isExpectedRequest, signal) {
 	if (isAborted$1(signal)) return {
 		ok: false,
 		error: Errors.cancelled({ operation: "payments" })
@@ -4563,7 +4651,7 @@ async function executePrepared(deps, prepare, expectedRequest, signal) {
 	}
 	const prepared = await prepare(signerAddress);
 	if (!prepared.ok) return prepared;
-	if (await fingerprintPaymentIntent(prepared.value.request) !== await fingerprintPaymentIntent(expectedRequest)) return {
+	if (!await isExpectedRequest(prepared.value.request)) return {
 		ok: false,
 		error: Errors.invalidInput("payment", "prepared command mismatch")
 	};
@@ -4598,13 +4686,13 @@ function executePaymentLifecycle(deps, intent, signal) {
 	return executePrepared(deps, (signerAddress) => runIfActive(signal, "payments.prepareLifecycleExecution", () => deps.convexCall.action(deps.functions.preparePaymentLifecycleExecution, { input: {
 		signerAddress,
 		intent
-	} })), intent, signal);
+	} })), matchesIntent(intent), signal);
 }
 function executeOrganizationPayment(deps, input, signal) {
 	return executePrepared(deps, (signerAddress) => runIfActive(signal, "organizationPayments.prepareExecution", () => deps.convexCall.action(deps.functions.prepareOrganizationPaymentExecution, { input: {
 		...input,
 		signerAddress
-	} })), input, signal);
+	} })), matchesIntent(input), signal);
 }
 //#endregion
 //#region src/surface/money.ts
@@ -5453,7 +5541,7 @@ function mapOk(result, f) {
 }
 //#endregion
 //#region package.json
-var version = "2.4.0";
+var version = "2.5.1";
 //#endregion
 //#region src/ports/auth-client.ts
 var AuthClientError = class extends Data.TaggedError("AuthClientError") {};
@@ -7520,7 +7608,7 @@ function makePermissionMethods(deps, orgId) {
 }
 //#endregion
 //#region src/surface/organization-payments.ts
-function executionDependencies(input) {
+function executionDependencies$1(input) {
 	return input.actor === void 0 || input.chainId === void 0 || input.signer === void 0 ? null : {
 		actor: input.actor,
 		chainId: input.chainId,
@@ -7537,7 +7625,7 @@ function makeOrganizationPaymentsMethods(deps, orgId) {
 			ok: false,
 			error: Errors.cancelled({ operation })
 		};
-		const execution = executionDependencies(deps);
+		const execution = executionDependencies$1(deps);
 		if (execution === null) return {
 			ok: false,
 			error: Errors.notImplemented("organizationPayments", "executionComposition")
@@ -7632,6 +7720,197 @@ function makeOrganizationPaymentsMethods(deps, orgId) {
 	};
 }
 //#endregion
+//#region src/contract/payroll.ts
+const payrollContract = {
+	authorizeRun: makeFunctionReference(CAPXUL_FUNCTIONS["payroll/actions"].authorizeRun),
+	runs: makeFunctionReference(CAPXUL_FUNCTIONS["payroll/queries"].runs),
+	groups: makeFunctionReference(CAPXUL_FUNCTIONS["payroll/queries"].groups),
+	saveGroup: makeFunctionReference(CAPXUL_FUNCTIONS["payroll/mutations"].saveGroup),
+	removeGroup: makeFunctionReference(CAPXUL_FUNCTIONS["payroll/mutations"].removeGroup)
+};
+//#endregion
+//#region src/surface/payroll.ts
+const AUTHORIZE_RUN = "payroll.authorizeRun";
+function toPayrollRun(wire) {
+	return {
+		id: toPayrollRunId(wire.id),
+		status: wire.status,
+		periodStart: wire.periodStart,
+		periodEnd: wire.periodEnd,
+		total: wire.total,
+		recipientCount: wire.recipientCount
+	};
+}
+function toPayrollRuns(wire) {
+	return {
+		runs: wire.runs.map(toPayrollRun),
+		settledThisMonth: wire.settledThisMonth
+	};
+}
+function toPayrollGroup(wire) {
+	return {
+		id: toPayrollGroupId(wire.id),
+		name: wire.name,
+		tone: wire.tone,
+		members: wire.members.map((member) => ({
+			partyId: member.partyId,
+			amount: member.amount,
+			currency: member.currency
+		}))
+	};
+}
+const MINOR_UNIT_INTEGER = /^-?\d+$/u;
+/**
+* One prepared `Money` counted in the minor units `net` is written in, or
+* `null` when the value is not a decimal number. `amount.value` is a DECIMAL
+* string (`"200"` at 6 decimals is 200000000 minor units), so comparing it to
+* `net` directly would compare two different units and pass nothing.
+*/
+function minorUnits(amount) {
+	const [whole = "", fraction = ""] = amount.value.split(".");
+	if (!/^\d+$/u.test(whole) || !/^\d*$/u.test(fraction) || fraction.length > amount.decimals) return null;
+	return BigInt(whole + fraction.padEnd(amount.decimals, "0"));
+}
+/**
+* One prepared item must pay the person this caller named, the amount this
+* caller set, under a payslip that attests to the same figures.
+*
+* `issuedAt` and `employerRef` are server facts the caller cannot contradict,
+* so they are not compared. Everything the caller DID supply is: the recipient
+* `Ref`, the transfer amount against `net`, and the payslip's employee, gross
+* and net. Adjustments are not in the signed command at all — the backend
+* enforces `gross + Σ adjustments === net` (ADR-0022 R8), and gross and net
+* being right is what the signer can prove here.
+*/
+function isRunItem(prepared, item) {
+	if (prepared === void 0) return false;
+	const payslip = prepared.document;
+	return canonicalJson(prepared.to) === canonicalJson(item.to) && prepared.paymentType === "payroll" && MINOR_UNIT_INTEGER.test(item.net) && minorUnits(prepared.amount) === BigInt(item.net) && payslip?.primaryType === "Payslip" && payslip.message.employeeRef === item.partyId && payslip.message.gross === item.gross && payslip.message.net === item.net;
+}
+/**
+* The batch the backend derived from a payroll intent must be the batch this
+* caller asked for, checked before the digest is signed.
+*
+* The payslip envelope on each item is server-built and carries the run row's
+* own `issuedAt`, so the batch cannot be fingerprinted against a local copy
+* (`matchesIntent` is unavailable here). What CAN be verified is every field
+* the caller supplied — the org, the Budget, the request key, and per item the
+* recipient, the amount and the payslip figures — plus the lineage binding the
+* batch to the run just written. A prepared command that pays a different
+* person, a different amount, from a different Budget, or under a different
+* run never reaches the signer.
+*/
+function isRunBatch(input) {
+	return (request) => {
+		const batch = request;
+		return Promise.resolve(batch.orgId === input.orgId && batch.permissionId === input.permissionId && batch.requestKey === input.requestKey && batch.lineage?.kind === "payroll" && batch.lineage.runId === input.runId && batch.items?.length === input.items.length && input.items.every((item, index) => isRunItem(batch.items?.[index], item)));
+	};
+}
+function executionDependencies(deps) {
+	return deps.actor === void 0 || deps.chainId === void 0 || deps.signer === void 0 ? null : {
+		actor: deps.actor,
+		chainId: deps.chainId,
+		convexCall: deps.convexCall,
+		functions: moneyExecutionContract,
+		signer: deps.signer
+	};
+}
+function makePayrollMethods(deps, orgId) {
+	const requestKeyScope = deps.requestKeyScope ?? `client-${crypto.randomUUID()}`;
+	async function authorize(input, signal) {
+		const execution = executionDependencies(deps);
+		if (execution === null) return {
+			ok: false,
+			error: Errors.notImplemented("payroll", "executionComposition")
+		};
+		const requestKey = await paymentRequestKeyLifecycle(`${requestKeyScope}:${AUTHORIZE_RUN}`, {
+			orgId,
+			input
+		}, input.requestKey);
+		let authorized;
+		const submitted = await executePrepared(execution, async (signerAddress) => {
+			const prepared = await runIfActive(signal, AUTHORIZE_RUN, () => deps.convexCall.action(payrollContract.authorizeRun, { input: {
+				orgId,
+				permissionId: input.permissionId,
+				requestKey: requestKey.key,
+				signerAddress,
+				period: input.period,
+				items: input.items
+			} }));
+			if (!prepared.ok) return prepared;
+			authorized = prepared.value.run;
+			return {
+				ok: true,
+				value: prepared.value.execution
+			};
+		}, (request) => authorized === void 0 || authorized.periodStart !== input.period.start || authorized.periodEnd !== input.period.end ? Promise.resolve(false) : isRunBatch({
+			orgId,
+			permissionId: input.permissionId,
+			requestKey: requestKey.key,
+			runId: authorized.id,
+			items: input.items
+		})(request), signal);
+		try {
+			await requestKey.finish(submitted.ok);
+		} catch {}
+		if (!submitted.ok) return submitted;
+		return authorized === void 0 ? {
+			ok: false,
+			error: Errors.unknown()
+		} : {
+			ok: true,
+			value: toPayrollRun(authorized)
+		};
+	}
+	return {
+		runs: (options) => runIfActive(options?.signal, "payroll.runs", () => Effect.map(deps.convexCall.query(payrollContract.runs, { orgId }), toPayrollRuns)),
+		authorizeRun: async (input, options) => {
+			if (options?.signal?.aborted === true) return {
+				ok: false,
+				error: Errors.cancelled({ operation: AUTHORIZE_RUN })
+			};
+			try {
+				return await authorize(input, options?.signal);
+			} catch (cause) {
+				return {
+					ok: false,
+					error: cause instanceof CapxulError ? cause : Errors.unknown(cause)
+				};
+			}
+		},
+		groups: {
+			list: (options) => runIfActive(options?.signal, "payroll.groups.list", () => Effect.map(deps.convexCall.query(payrollContract.groups, { orgId }), (groups) => groups.map(toPayrollGroup))),
+			save: (input, options) => runIfActive(options?.signal, "payroll.groups.save", () => Effect.map(deps.convexCall.mutation(payrollContract.saveGroup, {
+				orgId,
+				...input.id === void 0 ? {} : { id: String(input.id) },
+				name: input.name,
+				tone: input.tone,
+				members: input.members
+			}), toPayrollGroup)),
+			remove: (id, options) => runIfActive(options?.signal, "payroll.groups.remove", () => Effect.map(deps.convexCall.mutation(payrollContract.removeGroup, {
+				orgId,
+				id
+			}), () => void 0))
+		}
+	};
+}
+const payrollUnavailable = () => Promise.resolve({
+	ok: false,
+	error: Errors.notImplemented("payroll", "executionComposition")
+});
+/** The bundle an unconfigured client exposes — every verb refuses, none throws. */
+function makeUnavailablePayrollMethods() {
+	return {
+		runs: payrollUnavailable,
+		authorizeRun: payrollUnavailable,
+		groups: {
+			list: payrollUnavailable,
+			save: payrollUnavailable,
+			remove: payrollUnavailable
+		}
+	};
+}
+//#endregion
 //#region src/surface/_shared/org-telemetry.ts
 /** Extract the domain from an email for telemetry (never the local part / PII). */
 function emailDomain$1(email) {
@@ -8169,6 +8448,13 @@ function makeOrgMethods(deps) {
 					...deps.actor === void 0 ? {} : { actor: deps.actor },
 					...deps.chainId === void 0 ? {} : { chainId: Number(deps.chainId) },
 					...deps.signer === void 0 ? {} : { signer: deps.signer }
+				}, String(orgId)),
+				payroll: convexCall === void 0 ? makeUnavailablePayrollMethods() : makePayrollMethods({
+					convexCall,
+					...deps.requestKeyScope === void 0 ? {} : { requestKeyScope: deps.requestKeyScope },
+					...deps.actor === void 0 ? {} : { actor: deps.actor },
+					...deps.chainId === void 0 ? {} : { chainId: Number(deps.chainId) },
+					...deps.signer === void 0 ? {} : { signer: deps.signer }
 				}, String(orgId))
 			};
 		}
@@ -8551,23 +8837,50 @@ function observeSdkClient(client, adapter, snapshot) {
 	}
 }
 /** @internal Reports a factory-level typed failure without changing its identity. */
-function observeFailedResult(result, adapter, operation) {
-	if (adapter !== void 0 && isFailedResult(result)) report(adapter, "operation", operation, result.error, resolveAdapterSnapshot(adapter));
+function observeFailedResult(result, adapter, operation, origin) {
+	if (adapter !== void 0 && isFailedResult(result)) report(adapter, "operation", operation, result.error, resolveAdapterSnapshot(adapter), origin);
 	return result;
 }
-function report(adapter, kind, operation, cause, invocation) {
+/**
+* One failure, one event. The identity machine reports a failed transition
+* first; when the same `CapxulError` then surfaces as a public method result
+* (directly or down its `cause` chain), the boundary drops that second report.
+* Only machine-reported errors are remembered, so a caller that reuses one
+* error object across unrelated public methods still sees every report.
+*/
+const machineReportedCauses = /* @__PURE__ */ new WeakSet();
+function reportedByMachine(cause) {
+	let link = cause;
+	for (let depth = 0; depth < 8 && typeof link === "object" && link !== null; depth++) {
+		if (machineReportedCauses.has(link)) return true;
+		link = link.cause;
+	}
+	return false;
+}
+function report(adapter, kind, operation, cause, invocation, origin) {
+	if (origin === "machine") {
+		let link = cause;
+		for (let depth = 0; depth < 8 && typeof link === "object" && link !== null; depth++) {
+			machineReportedCauses.add(link);
+			link = link.cause;
+		}
+	} else if (reportedByMachine(cause)) return;
 	const operationName = normalizeOperation(operation);
 	const kindName = normalizeErrorKind(errorKind(cause));
 	const context = sanitizeObservationContext({
 		...invocation.context,
 		...isCapxulError(cause) && cause.correlationId !== void 0 ? { correlationId: cause.correlationId } : {}
 	});
+	const detail = failureDetail(cause);
+	const evidence = failureEvidence(cause);
 	const failure = markFailureInvocationSnapshot({
-		exception: syntheticException(operationName, kindName),
+		exception: syntheticException(operationName, kindName, evidence.message, evidence.stack),
 		sdkVersion: SDK_VERSION,
 		operation: operationName,
 		errorKind: kindName,
-		...context === void 0 ? {} : { context }
+		...context === void 0 ? {} : { context },
+		...detail === void 0 ? {} : { detail },
+		...evidence
 	}, {
 		active: invocation.active,
 		...context === void 0 ? {} : { context }
@@ -8630,19 +8943,24 @@ function postHogProperties(failure, context) {
 		operation: failure.operation,
 		error_kind: failure.errorKind,
 		handled: true,
+		...failure.detail,
+		...failure.message === void 0 ? {} : { error_message: failure.message },
+		...failure.details === void 0 ? {} : { error_details: failure.details },
+		...failure.causeChain === void 0 ? {} : { error_cause: failure.causeChain.join(" <- ") },
 		...observationContextProps(merged)
 	};
 }
 function postHogExceptionProperties(failure, properties) {
 	const filename = `capxul-sdk-observation://boundary/${failure.operation}`;
+	const message = failure.message ?? "Capxul SDK operation failed";
 	return {
 		...properties,
 		$exception_type: failure.errorKind,
-		$exception_message: EXCEPTION_MESSAGE,
+		$exception_message: message,
 		$exception_level: "error",
 		$exception_list: [{
 			type: failure.errorKind,
-			value: EXCEPTION_MESSAGE,
+			value: message,
 			mechanism: {
 				type: "capxul_sdk_boundary",
 				handled: true,
@@ -8658,10 +8976,77 @@ function postHogExceptionProperties(failure, properties) {
 					colno: 1,
 					in_app: true
 				}]
-			}
+			},
+			...failure.stack === void 0 ? {} : { stack: failure.stack }
 		}]
 	};
 }
+const MAX_EVIDENCE_TEXT = 4e3;
+const MAX_CAUSE_DEPTH = 8;
+function evidenceText(value) {
+	if (typeof value !== "string" || value.length === 0) return void 0;
+	return redactSecrets(value).slice(0, MAX_EVIDENCE_TEXT);
+}
+/** A field whose NAME says credential is masked whatever its value looks like. */
+const CREDENTIAL_FIELD_NAME = /(?:otp|pass(?:word|wd|phrase)?|token|secret|credential|api[_-]?key|private[_-]?key|authorization|cookie|session)/iu;
+/** Copy a details object into a JSON-safe shape with every string masked. */
+function evidenceValue(value, depth = 0) {
+	if (typeof value === "string") return evidenceText(value);
+	if (typeof value === "number" || typeof value === "boolean" || value === null) return value;
+	if (typeof value === "bigint") return value.toString();
+	if (value instanceof Error) return evidenceText(value.message);
+	if (depth >= 4 || typeof value !== "object") return void 0;
+	if (Array.isArray(value)) return value.slice(0, 50).map((item) => evidenceValue(item, depth + 1));
+	const copy = {};
+	for (const [key, nested] of Object.entries(value)) {
+		if (CREDENTIAL_FIELD_NAME.test(key)) {
+			copy[key] = "[REDACTED]";
+			continue;
+		}
+		const safe = evidenceValue(nested, depth + 1);
+		if (safe !== void 0) copy[key] = safe;
+	}
+	return copy;
+}
+/**
+* @internal The evidence in PostHog property shape, for product events that
+* name a failure (`bootstrap_failed`). Same keys as the `$exception` event.
+*/
+function failureEvidenceProps(cause) {
+	const evidence = failureEvidence(cause);
+	return {
+		...evidence.message === void 0 ? {} : { error_message: evidence.message },
+		...evidence.details === void 0 ? {} : { error_details: evidence.details },
+		...evidence.causeChain === void 0 ? {} : { error_cause: evidence.causeChain.join(" <- ") }
+	};
+}
+/** The real failure, masked for secrets only. Never throws. */
+function failureEvidence(cause) {
+	try {
+		const message = cause instanceof Error ? evidenceText(cause.message) : evidenceText(cause);
+		const stack = cause instanceof Error ? evidenceText(cause.stack) : void 0;
+		const details = isCapxulError(cause) && typeof cause.details === "object" && cause.details !== null ? evidenceValue(cause.details) : void 0;
+		const causeChain = [];
+		let previous = message;
+		let link = cause instanceof Error ? cause.cause : void 0;
+		for (let depth = 0; depth < MAX_CAUSE_DEPTH && link !== void 0 && link !== null; depth++) {
+			const text = link instanceof Error ? evidenceText(link.message) : evidenceText(link);
+			if (text !== void 0 && text !== previous) {
+				causeChain.push(text);
+				previous = text;
+			}
+			link = link instanceof Error ? link.cause : void 0;
+		}
+		return {
+			...message === void 0 ? {} : { message },
+			...details === void 0 || Object.keys(details).length === 0 ? {} : { details },
+			...causeChain.length === 0 ? {} : { causeChain },
+			...stack === void 0 ? {} : { stack }
+		};
+	} catch {
+		return {};
+	}
+}
 function errorKind(cause) {
 	try {
 		if (isCapxulError(cause)) return normalizeErrorKind(cause.code);
@@ -8675,14 +9060,61 @@ function sanitizeFailureObservation(failure) {
 	const operation = normalizeOperation(failure.operation);
 	const kind = normalizeErrorKind(failure.errorKind);
 	const context = sanitizeObservationContext(failure.context);
+	const detail = sanitizeFailureDetail(failure.detail);
+	const message = evidenceText(failure.message);
+	const stack = evidenceText(failure.stack);
+	const details = typeof failure.details === "object" && failure.details !== null ? evidenceValue(failure.details) : void 0;
+	const causeChain = Array.isArray(failure.causeChain) ? failure.causeChain.map(evidenceText).filter((text) => text !== void 0) : void 0;
 	return {
-		exception: syntheticException(operation, kind),
+		exception: syntheticException(operation, kind, message, stack),
 		sdkVersion: normalizeSdkVersion(failure.sdkVersion),
 		operation,
 		errorKind: kind,
-		...context === void 0 ? {} : { context }
+		...context === void 0 ? {} : { context },
+		...detail === void 0 ? {} : { detail },
+		...message === void 0 ? {} : { message },
+		...details === void 0 || Object.keys(details).length === 0 ? {} : { details },
+		...causeChain === void 0 || causeChain.length === 0 ? {} : { causeChain },
+		...stack === void 0 ? {} : { stack }
 	};
 }
+/**
+* @internal Lift the enumerated discriminators off a `CapxulError` so a
+* boundary event says WHICH provider failed and HOW, not just `PROVIDER_ERROR`.
+* Shared by the failure boundary and the `bootstrap_failed` product event.
+*/
+function failureDetail(cause) {
+	if (!isCapxulError(cause)) return void 0;
+	const details = cause.details;
+	if (typeof details !== "object" || details === null) return void 0;
+	const source = details;
+	return sanitizeFailureDetail({
+		provider: source.provider,
+		provider_operation: source.operation,
+		failure_mode: source.failure_mode,
+		reason: source.reason,
+		http_status: source.httpStatus
+	});
+}
+function sanitizeFailureDetail(input) {
+	if (typeof input !== "object" || input === null) return void 0;
+	const source = input;
+	const detail = {};
+	for (const key of [
+		"provider",
+		"provider_operation",
+		"failure_mode",
+		"reason"
+	]) {
+		const value = source[key];
+		if (typeof value === "string" && ENUMERATED_DETAIL_RE.test(value)) detail[key] = value;
+	}
+	const status = source.http_status;
+	if (typeof status === "number" && Number.isInteger(status) && status >= 100 && status <= 599) detail.http_status = status;
+	return Object.keys(detail).length === 0 ? void 0 : detail;
+}
+/** Enumerated codes only (`convex`, `no-secure-context`, `bootstrap-encode`); free text fails. */
+const ENUMERATED_DETAIL_RE = /^[A-Za-z][A-Za-z0-9_.-]{0,63}$/u;
 function normalizeSdkVersion(value) {
 	return typeof value === "string" && /^[A-Za-z0-9][A-Za-z0-9.+_-]{0,127}$/u.test(value) ? value : "unknown";
 }
@@ -8692,10 +9124,10 @@ function normalizeOperation(value) {
 function normalizeErrorKind(value) {
 	return typeof value === "string" && /^[A-Za-z][A-Za-z0-9_.-]{0,63}$/u.test(value) ? value : "Error";
 }
-function syntheticException(operation, kind) {
-	const error = /* @__PURE__ */ new Error(EXCEPTION_MESSAGE);
+function syntheticException(operation, kind, message = EXCEPTION_MESSAGE, stack) {
+	const error = new Error(message);
 	error.name = kind;
-	error.stack = `${kind}: ${error.message}\n    at CapxulSdkBoundary.${operation} (capxul-sdk-observation://boundary/${operation}:1:1)`;
+	error.stack = `${kind}: ${error.message}\n    at CapxulSdkBoundary.${operation} (capxul-sdk-observation://boundary/${operation}:1:1)` + (stack === void 0 ? "" : `\nCaused by: ${stack}`);
 	return error;
 }
 function isPromiseLike(value) {
@@ -8900,10 +9332,19 @@ function assembleCapxulClient(input) {
 	const unsubscribeProductTelemetry = actor.subscribeTransitions((record) => {
 		effectRunner.runPromise(executeIdentityProductObservation(input.ports.telemetry, record, actor.snapshot())).catch(() => {});
 	});
+	const failureObservation = observation.failureObservation;
+	const unsubscribeFailureObservation = failureObservation === void 0 ? () => {} : actor.subscribeTransitions((record) => {
+		if (record.outcome !== "failed") return;
+		observeFailedResult({
+			ok: false,
+			error: transitionError(record)
+		}, failureObservation, `identity.${record.event}`, "machine");
+	});
 	let stopPromise = null;
 	const stopActor = () => {
 		if (stopPromise === null) {
 			unsubscribeProductTelemetry();
+			unsubscribeFailureObservation();
 			stopPromise = effectRunner.runPromise(Scope.close(scope, Exit.void));
 		}
 		return stopPromise;
@@ -9088,6 +9529,30 @@ function assembleCapxulClient(input) {
 		}
 	}, observation.failureObservation, observation.hostObservationSnapshot);
 }
+function transitionError(record) {
+	const failure = record.failure;
+	if (failure?.error !== void 0) {
+		const error = failure.error;
+		if (record.correlation_id === void 0 || error.correlationId !== void 0) return error;
+		return new CapxulError(error.code, error.message, {
+			cause: error,
+			correlationId: record.correlation_id,
+			...error.details === void 0 ? {} : { details: error.details },
+			...error.layer === void 0 ? {} : { layer: error.layer }
+		});
+	}
+	return new CapxulError(record.error_code, failure?.message ?? "Identity work failed", {
+		...failure === void 0 ? {} : { cause: failure },
+		details: {
+			machine: record.machine,
+			state: record.state,
+			event: record.event,
+			slot: record.slot,
+			...failure?.mode === void 0 ? {} : { failure_mode: failure.mode }
+		},
+		...record.correlation_id === void 0 ? {} : { correlationId: record.correlation_id }
+	});
+}
 function withHostObservation(actor, snapshot) {
 	if (snapshot === void 0) return actor;
 	const controls = (input) => {
@@ -9103,4 +9568,4 @@ function withHostObservation(actor, snapshot) {
 	};
 }
 //#endregion
-export { isClaimed as $, fingerprintPaymentIntent as A, OBSERVATION_CONTEXT_HEADER as B, ClockPortTag as C, AuthClientError as D, authClientPortFromPromiseAdapter as E, copyInvocationObservation as F, CAPXUL_FUNCTIONS as G, sanitizeObservationContext as H, readInvocationObservation as I, CAPXUL_PAYMENTS_V2_ADDRESS as J, BootstrapEnvelope as K, causeChain as L, fromWei as M, isSettingUpLifecycle as N, AuthClientPortTag as O, formatTraceparent as P, destination as Q, injectedWalletSigner as R, ClockError as S, bootstrapErrorFromCapxul as T, PAYMENT_DIRECTIONS as U, encodeObservationContextHeader as V, PAYMENT_STATUSES as W, BASE_SEPOLIA_CHAIN_ID as X, normalizeBindingEmail as Y, deriveCapxulSafeAddress as Z, wireChainId as _, observeFailedResult as a, ConvexCallPortTag as b, captureExceptionSync as c, TelemetryPortTag as d, isRestoring as et, redactTelemetryEvent as f, accountReadErrorFromCapxul as g, AccountReadPortTag as h, observationContextProps as i, toWei as j, version as k, detectAuthCacheAdapter as l, smartAccountErrorFromCapxul as m, postHogProductTelemetry as n, postHogFailureObservation as o, SmartAccountPortTag as p, EngineeringTelemetryBootstrapPolicy as q, CAPXUL_SDK_EXPECTED_OUTCOME_EVENT as r, captureException as s, assembleCapxulClient as t, PostHogTelemetryLayer as u, IdentityPortTag as v, BootstrapPortTag as w, convexCallErrorFromCapxul as x, identityErrorFromCapxul as y, signerFailure as z };
+export { deriveCapxulSafeAddress as $, AuthClientPortTag as A, injectedWalletSigner as B, convexCallErrorFromCapxul as C, bootstrapErrorFromCapxul as D, BootstrapPortTag as E, isSettingUpLifecycle as F, PAYMENT_DIRECTIONS as G, OBSERVATION_CONTEXT_HEADER as H, formatTraceparent as I, BootstrapEnvelope as J, PAYMENT_STATUSES as K, copyInvocationObservation as L, fingerprintPaymentIntent as M, toWei as N, authClientPortFromPromiseAdapter as O, fromWei as P, BASE_SEPOLIA_CHAIN_ID as Q, readInvocationObservation as R, ConvexCallPortTag as S, ClockPortTag as T, encodeObservationContextHeader as U, signerFailure as V, sanitizeObservationContext as W, CAPXUL_PAYMENTS_V2_ADDRESS as X, EngineeringTelemetryBootstrapPolicy as Y, normalizeBindingEmail as Z, AccountReadPortTag as _, failureEvidenceProps as a, IdentityPortTag as b, postHogFailureObservation as c, detectAuthCacheAdapter as d, destination as et, PostHogTelemetryLayer as f, smartAccountErrorFromCapxul as g, SmartAccountPortTag as h, failureDetail as i, version as j, AuthClientError as k, captureException as l, redactTelemetryEvent as m, postHogProductTelemetry as n, isRestoring as nt, observationContextProps as o, TelemetryPortTag as p, CAPXUL_FUNCTIONS as q, CAPXUL_SDK_EXPECTED_OUTCOME_EVENT as r, observeFailedResult as s, assembleCapxulClient as t, isClaimed as tt, captureExceptionSync as u, accountReadErrorFromCapxul as v, ClockError as w, identityErrorFromCapxul as x, wireChainId as y, causeChain as z };

package/dist/index.d.mts

@@ -1,5 +1,5 @@
-import { $ as toCountryCode, B as OrgId, C as Address, N as CountryCode, O as AuthSession, Q as toAddress, S as AccountId, V as PartyId, a as SignerStatusStore, c as AccountProviderSource, d as eip1193AccountProvider, et as CAPXUL_ERROR_CODES, f as localPrivateKeyAccountProvider, g as SmartAccount, h as Session, i as SignerStatus, it as Errors, j as BudgetId, k as AuthUserId, l as AccountRequirement, m as Profile, n as CapxulSigner, nt as CapxulErrorCode, o as injectedWalletSigner, ot as FailureMode, p as CapxulResult, q as RoleKey, r as Eip1193RequestProvider, rt as CapxulErrorDetails, s as AccountProvider, st as isCapxulError, t as CapxulDigestSigner, tt as CapxulError, u as Eip1193Provider, x as Account, z as Money } from "./signer-BGTaqZqg.mjs";
-import { $ as AccountsMethods, $t as PaymentDocumentRef, A as OrgView, An as PAYMENT_STATUSES, At as Destination, B as OrganizationPaymentsMethods, Bn as IdentityState, Bt as MeMethods, C as DetectPendingOrgInvitationsResult, Cn as OrgSetupStep, Ct as ActivityRange, D as OrgMethods, Dn as SubmittedPermissionExecution, Dt as ActivitySummaryTotal, E as MemberView, En as Permission, Et as ActivitySummaryParams, F as RoleSpendCap, Ft as DestinationRail, G as PermissionOptions, Gn as isClaimed, Gt as OfframpQuoteInput, H as PermissionChangeInput, Hn as Readiness, Ht as MovementActivityEvidence, I as RoleView, In as TelemetryPort, It as DestinationRemoveInput, J as PermissionReadResult, Jn as InvocationControls, Jt as PayeesMethods, K as PermissionReplaceInput, Kn as isRestoring, Kt as OfframpStatus, L as OrganizationPaymentBatchInput, Ln as CAPXUL_PAYMENTS_V2_ADDRESS, Lt as DestinationsMethods, M as OrganizationAuditLogItem, Mn as RequestStatus, Mt as DestinationKind, N as ResendInviteTokenInput, Nt as DestinationListInput, O as OrgScopedMethods, On as InboxStatus, Ot as ActorReference, P as RoleDefinition, Pt as DestinationPayload, Q as OrgMeOptions, Qt as PaymentDocumentKind, R as OrganizationPaymentInput, Rn as Destination$1, Rt as FinancialOpsMethods, S as CreateOrgInput, Sn as OrgLifecycle, St as ActivityPage, T as MemberStatus, Tn as CurrentHoldings, Tt as ActivitySummary, U as PermissionCreateInput, Un as StateLabel, Ut as OfframpMethods, V as PermissionAssignInput, Vn as OrgLane, Vt as MeProfile, W as PermissionMethods, Wn as destination, Wt as OfframpQuote, X as OrgMe, Xt as PaymentActivityEvidence, Y as Budget, Yt as Payment, Z as OrgMeMethod, Zt as PaymentDirection, _ as SystemMethods, _n as AccountSetupStep, _t as ActivityFilter, a as SdkFailureObservation, an as PaymentTiming, at as ActorRequestIssueInput, b as CurrentUserContext, bn as SmartAccountMethods, bt as ActivityListParams, c as PostHogObservabilityOptions, cn as PaymentsPayInput, ct as AddressBookEntry, d as CreateCapxulClientInput, dn as Ref, dt as InboxApproveInput, en as PaymentDocumentRender, et as AccountMethods, f as IdentityProfileDetails, fn as ResolvedTarget, ft as InboxItem, g as Holding, gn as AccountLifecycle, gt as ActivityDetail, h as HoldingsMethods, hn as fingerprintPaymentIntent, ht as ActivityAnnotationInput, i as ObservationDelivery, in as PaymentStatus, it as ActorRequest, j as OrganizationAccount, jn as PaymentStatus$1, jt as DestinationAddInput, k as OrgTemplate, kn as PAYMENT_DIRECTIONS, kt as DepositInstructions, l as postHogObservability, ln as RecipientResolution, lt as AddressBookLabelInput, m as IdentityRuntimeSendResult, mn as TargetsMethods, mt as ActivityAnnotation, n as ObservationAdapter, nn as PaymentDocumentsMethods, nt as ActorProfileMethods, o as HostObservability, on as PaymentType, ot as ActorRequestsMethods, p as IdentityRuntime, pn as TargetReference, pt as InboxMethods, q as PermissionRevokeInput, qn as IdentityTransition, qt as Payee, r as ObservationContext, rn as PaymentMoney, rt as ActorRelationshipMethods, s as PostHogObservabilityClient, sn as PaymentsMethods, st as AddressBookAddInput, t as CAPXUL_SDK_EXPECTED_OUTCOME_EVENT, tn as PaymentDocumentVerification, tt as ActorProfile, u as CapxulClient, un as RecipientResolutionKind, ut as AddressBookMethods, v as SystemHealth, vn as isSettingUpLifecycle, vt as ActivityItem, w as InviteMemberInput, wn as ActorRef, wt as ActivityReference, x as CurrentUserMethods, xn as AuthMethods, xt as ActivityMethods, y as MediaMethods, yn as IdentityMethods, yt as ActivityKind, z as OrganizationPaymentItemInput, zn as IdentityEvent, zt as HandlesMethods } from "./observation-BfCkJY5z.mjs";
+import { B as OrgId, C as Address, N as CountryCode, O as AuthSession, S as AccountId, U as PayrollGroupId, V as PartyId, W as PayrollRunId, Y as RoleKey, a as SignerStatusStore, at as CapxulErrorDetails, c as AccountProviderSource, ct as FailureMode, d as eip1193AccountProvider, et as toAddress, f as localPrivateKeyAccountProvider, g as SmartAccount, h as Session, i as SignerStatus, it as CapxulErrorCode, j as BudgetId, k as AuthUserId, l as AccountRequirement, lt as isCapxulError, m as Profile, n as CapxulSigner, nt as CAPXUL_ERROR_CODES, o as injectedWalletSigner, ot as Errors, p as CapxulResult, r as Eip1193RequestProvider, rt as CapxulError, s as AccountProvider, t as CapxulDigestSigner, tt as toCountryCode, u as Eip1193Provider, x as Account, z as Money } from "./signer-BSEG9xgN.mjs";
+import { $ as PermissionChangeInput, $n as Readiness, $t as MovementActivityEvidence, A as OrgView, An as IdentityMethods, At as ActivityKind, B as PayrollGroupMember, Bn as PAYMENT_DIRECTIONS, Bt as DepositInstructions, C as DetectPendingOrgInvitationsResult, Cn as ResolvedTarget, Ct as InboxItem, D as OrgMethods, Dn as AccountLifecycle, Dt as ActivityDetail, E as MemberView, En as fingerprintPaymentIntent, Et as ActivityAnnotationInput, F as RoleSpendCap, Fn as ActorRef, Ft as ActivityReference, G as PayrollRunItemInput, Gt as DestinationPayload, H as PayrollMethods, Hn as PaymentStatus$1, Ht as DestinationAddInput, I as RoleView, In as CurrentHoldings, It as ActivitySummary, J as OrganizationPaymentBatchInput, Jn as CAPXUL_PAYMENTS_V2_ADDRESS, Jt as DestinationsMethods, K as PayrollRunStatus, Kt as DestinationRail, L as AuthorizeRunInput, Ln as Permission, Lt as ActivitySummaryParams, M as OrganizationAuditLogItem, Mn as AuthMethods, Mt as ActivityMethods, N as ResendInviteTokenInput, Nn as OrgLifecycle, Nt as ActivityPage, O as OrgScopedMethods, On as AccountSetupStep, Ot as ActivityFilter, P as RoleDefinition, Pn as OrgSetupStep, Pt as ActivityRange, Q as PermissionAssignInput, Qn as OrgLane, Qt as MeProfile, R as PayrollGroup, Rn as SubmittedPermissionExecution, Rt as ActivitySummaryTotal, S as CreateOrgInput, Sn as Ref, St as InboxApproveInput, T as MemberStatus, Tn as TargetsMethods, Tt as ActivityAnnotation, U as PayrollOptions, Un as RequestStatus, Ut as DestinationKind, V as PayrollGroupsMethods, Vn as PAYMENT_STATUSES, Vt as Destination, W as PayrollRun, Wt as DestinationListInput, X as OrganizationPaymentItemInput, Xn as IdentityEvent, Xt as HandlesMethods, Y as OrganizationPaymentInput, Yn as Destination$1, Yt as FinancialOpsMethods, Z as OrganizationPaymentsMethods, Zn as IdentityState, Zt as MeMethods, _ as SystemMethods, _n as PaymentType, _t as ActorRequestsMethods, a as SdkFailureObservation, an as PayeesMethods, ar as InvocationControls, at as PermissionReadResult, b as CurrentUserContext, bn as RecipientResolution, bt as AddressBookLabelInput, c as PostHogObservabilityOptions, cn as PaymentDirection, ct as OrgMeMethod, d as CreateCapxulClientInput, dn as PaymentDocumentRender, dt as AccountMethods, en as OfframpMethods, er as StateLabel, et as PermissionCreateInput, f as IdentityProfileDetails, fn as PaymentDocumentVerification, ft as ActorProfile, g as Holding, gn as PaymentTiming, gt as ActorRequestIssueInput, h as HoldingsMethods, hn as PaymentStatus, ht as ActorRequest, i as ObservationDelivery, in as Payee, ir as IdentityTransition, it as PermissionRevokeInput, j as OrganizationAccount, jn as SmartAccountMethods, jt as ActivityListParams, k as OrgTemplate, kn as isSettingUpLifecycle, kt as ActivityItem, l as postHogObservability, ln as PaymentDocumentKind, lt as OrgMeOptions, m as IdentityRuntimeSendResult, mn as PaymentMoney, mt as ActorRelationshipMethods, n as ObservationAdapter, nn as OfframpQuoteInput, nr as isClaimed, nt as PermissionOptions, o as HostObservability, on as Payment, ot as Budget, p as IdentityRuntime, pn as PaymentDocumentsMethods, pt as ActorProfileMethods, q as PayrollRuns, qn as TelemetryPort, qt as DestinationRemoveInput, r as ObservationContext, rn as OfframpStatus, rr as isRestoring, rt as PermissionReplaceInput, s as PostHogObservabilityClient, sn as PaymentActivityEvidence, st as OrgMe, t as CAPXUL_SDK_EXPECTED_OUTCOME_EVENT, tn as OfframpQuote, tr as destination, tt as PermissionMethods, u as CapxulClient, un as PaymentDocumentRef, ut as AccountsMethods, v as SystemHealth, vn as PaymentsMethods, vt as AddressBookAddInput, w as InviteMemberInput, wn as TargetReference, wt as InboxMethods, x as CurrentUserMethods, xn as RecipientResolutionKind, xt as AddressBookMethods, y as MediaMethods, yn as PaymentsPayInput, yt as AddressBookEntry, z as PayrollGroupInput, zn as InboxStatus, zt as ActorReference } from "./observation-BQ2VKWH5.mjs";
 import { Hex } from "viem";
 import { Context, Effect, Layer } from "effect";
 import { FunctionReference } from "convex/server";
@@ -203,4 +203,4 @@ declare function captureException(telemetry: TelemetryPort, error: unknown, cont
  */
 declare function captureExceptionSync(telemetry: TelemetryPort, error: unknown, context?: HandledErrorReportContext): void;
 //#endregion
-export { type Account, type AccountId, type AccountLifecycle, type AccountMethods, type AccountProvider, type AccountProviderSource, type AccountRequirement, type AccountSetupStep, type AccountsMethods, type ActivityAnnotation, type ActivityAnnotationInput, type ActivityDetail, type ActivityFilter, type ActivityItem, type ActivityKind, type ActivityListParams, type ActivityMethods, type ActivityPage, type ActivityPhase, type ActivityRange, type ActivityReference, type ActivitySummary, type ActivitySummaryParams, type ActivitySummaryTotal, type ActorProfile, type ActorProfileMethods, type ActorRef, type ActorReference, type ActorRelationshipMethods, type ActorRequest, type ActorRequestIssueInput, type ActorRequestsMethods, type Address, type AddressBookAddInput, type AddressBookEntry, type AddressBookLabelInput, type AddressBookMethods, type AuthMethods, type AuthSession, type AuthUserId, type Budget, type BudgetId, CAPXUL_ERROR_CODES, CAPXUL_PAYMENTS_V2_ADDRESS, CAPXUL_SDK_EXPECTED_OUTCOME_EVENT, type CapxulClient, type CapxulClientInput, type CapxulDigestSigner, CapxulError, type CapxulErrorCode, type CapxulErrorDetails, type CapxulResult, type CapxulSigner, type CountryCode, type CreateCapxulClientInput, type CreateOrgInput, type CurrentHoldings, type CurrentUserContext, type CurrentUserMethods, type DepositInstructions, type Destination, type DestinationAddInput, type DestinationKind, type DestinationListInput, type DestinationPayload, type DestinationRail, type DestinationRemoveInput, type DestinationsMethods, type DetectPendingOrgInvitationsResult, type DevPrivateKeySignerInput, type Eip1193Provider, type Eip1193RequestProvider, Errors, type FinancialOpsMethods, type HandledErrorReportContext, type HandlesMethods, type Holding, type HoldingsMethods, type HostObservability, type Destination$1 as IdentityDestination, type IdentityEvent, type IdentityMethods, type IdentityProfileDetails, type IdentityRuntime, type IdentityRuntimeSendResult, type IdentityState, type IdentityTransition, type InboxApproveInput, type InboxItem, type InboxMethods, type InviteMemberInput, type InvocationControls, type MeMethods, type MeProfile, type MediaMethods, type MemberStatus, type MemberView, type Money, type MoneyParseError, type MoneyParseErrorReason, type MovementActivityEvidence, type ObservationAdapter, type ObservationContext, type ObservationDelivery, type OfframpMethods, type OfframpQuote, type OfframpQuoteInput, type OfframpStatus, type OpenfortEmbeddedSignerInput, type OpenfortEmbeddedWalletApi, type OpenfortEmbeddedWalletPort, type OrgId, type OrgLane, type OrgLifecycle, type OrgMe, type OrgMeMethod, type OrgMeOptions, type OrgMethods, type OrgScopedMethods, type OrgSetupStep, type OrgTemplate, type OrgView, type OrganizationAccount, type OrganizationAuditLogItem, type OrganizationPaymentBatchInput, type OrganizationPaymentInput, type OrganizationPaymentItemInput, type OrganizationPaymentsMethods, PAYMENT_DIRECTIONS, PAYMENT_STATUSES, type PartyId, type Payee, type PayeesMethods, type Payment, type PaymentActivityEvidence, type PaymentDirection, type PaymentDocumentKind, type PaymentDocumentRef, type PaymentDocumentRender, type PaymentDocumentVerification, type PaymentDocumentsMethods, type PaymentMoney, type PaymentStatus, type PaymentTiming, type PaymentType, type PaymentsMethods, type PaymentsPayInput, type Permission, type PermissionAssignInput, type PermissionChangeInput, type PermissionCreateInput, type PermissionMethods, type PermissionOptions, type PermissionReadResult, type PermissionReplaceInput, type PermissionRevokeInput, type PostHogObservabilityClient, type PostHogObservabilityOptions, type Profile, type Readiness, type RecipientResolution, type RecipientResolutionKind, type Ref, type ResendInviteTokenInput, type ResolvedTarget, type RoleDefinition, type RoleKey, type RoleSpendCap, type RoleView, type SdkFailureObservation, type Session, type SignerStatus, type SignerStatusStore, type SmartAccount, type SmartAccountMethods, type StateLabel, type SubmittedPermissionExecution, type SystemHealth, type SystemMethods, type TargetReference, type TargetsMethods, type TelemetryPort, captureException, captureExceptionSync, createCapxulClient, deriveDevPrivateKey, devPrivateKeySigner, eip1193AccountProvider, embeddedSigner, fingerprintPaymentIntent, formatMoney, inboxPhase, injectedWalletSigner, isCapxulError, isClaimed, isMoneyParseError, isRestoring, isSettingUpLifecycle, localPrivateKeyAccountProvider, openfortEmbeddedSigner, openfortEmbeddedSignerFromWallet, openfortEmbeddedWalletPort, parseMoney, paymentPhase, postHogObservability, requestPhase, destination as resolveIdentityDestination, toCountryCode, toAddress as toEvmAddress };
+export { type Account, type AccountId, type AccountLifecycle, type AccountMethods, type AccountProvider, type AccountProviderSource, type AccountRequirement, type AccountSetupStep, type AccountsMethods, type ActivityAnnotation, type ActivityAnnotationInput, type ActivityDetail, type ActivityFilter, type ActivityItem, type ActivityKind, type ActivityListParams, type ActivityMethods, type ActivityPage, type ActivityPhase, type ActivityRange, type ActivityReference, type ActivitySummary, type ActivitySummaryParams, type ActivitySummaryTotal, type ActorProfile, type ActorProfileMethods, type ActorRef, type ActorReference, type ActorRelationshipMethods, type ActorRequest, type ActorRequestIssueInput, type ActorRequestsMethods, type Address, type AddressBookAddInput, type AddressBookEntry, type AddressBookLabelInput, type AddressBookMethods, type AuthMethods, type AuthSession, type AuthUserId, type AuthorizeRunInput, type Budget, type BudgetId, CAPXUL_ERROR_CODES, CAPXUL_PAYMENTS_V2_ADDRESS, CAPXUL_SDK_EXPECTED_OUTCOME_EVENT, type CapxulClient, type CapxulClientInput, type CapxulDigestSigner, CapxulError, type CapxulErrorCode, type CapxulErrorDetails, type CapxulResult, type CapxulSigner, type CountryCode, type CreateCapxulClientInput, type CreateOrgInput, type CurrentHoldings, type CurrentUserContext, type CurrentUserMethods, type DepositInstructions, type Destination, type DestinationAddInput, type DestinationKind, type DestinationListInput, type DestinationPayload, type DestinationRail, type DestinationRemoveInput, type DestinationsMethods, type DetectPendingOrgInvitationsResult, type DevPrivateKeySignerInput, type Eip1193Provider, type Eip1193RequestProvider, Errors, type FinancialOpsMethods, type HandledErrorReportContext, type HandlesMethods, type Holding, type HoldingsMethods, type HostObservability, type Destination$1 as IdentityDestination, type IdentityEvent, type IdentityMethods, type IdentityProfileDetails, type IdentityRuntime, type IdentityRuntimeSendResult, type IdentityState, type IdentityTransition, type InboxApproveInput, type InboxItem, type InboxMethods, type InviteMemberInput, type InvocationControls, type MeMethods, type MeProfile, type MediaMethods, type MemberStatus, type MemberView, type Money, type MoneyParseError, type MoneyParseErrorReason, type MovementActivityEvidence, type ObservationAdapter, type ObservationContext, type ObservationDelivery, type OfframpMethods, type OfframpQuote, type OfframpQuoteInput, type OfframpStatus, type OpenfortEmbeddedSignerInput, type OpenfortEmbeddedWalletApi, type OpenfortEmbeddedWalletPort, type OrgId, type OrgLane, type OrgLifecycle, type OrgMe, type OrgMeMethod, type OrgMeOptions, type OrgMethods, type OrgScopedMethods, type OrgSetupStep, type OrgTemplate, type OrgView, type OrganizationAccount, type OrganizationAuditLogItem, type OrganizationPaymentBatchInput, type OrganizationPaymentInput, type OrganizationPaymentItemInput, type OrganizationPaymentsMethods, PAYMENT_DIRECTIONS, PAYMENT_STATUSES, type PartyId, type Payee, type PayeesMethods, type Payment, type PaymentActivityEvidence, type PaymentDirection, type PaymentDocumentKind, type PaymentDocumentRef, type PaymentDocumentRender, type PaymentDocumentVerification, type PaymentDocumentsMethods, type PaymentMoney, type PaymentStatus, type PaymentTiming, type PaymentType, type PaymentsMethods, type PaymentsPayInput, type PayrollGroup, type PayrollGroupId, type PayrollGroupInput, type PayrollGroupMember, type PayrollGroupsMethods, type PayrollMethods, type PayrollOptions, type PayrollRun, type PayrollRunId, type PayrollRunItemInput, type PayrollRunStatus, type PayrollRuns, type Permission, type PermissionAssignInput, type PermissionChangeInput, type PermissionCreateInput, type PermissionMethods, type PermissionOptions, type PermissionReadResult, type PermissionReplaceInput, type PermissionRevokeInput, type PostHogObservabilityClient, type PostHogObservabilityOptions, type Profile, type Readiness, type RecipientResolution, type RecipientResolutionKind, type Ref, type ResendInviteTokenInput, type ResolvedTarget, type RoleDefinition, type RoleKey, type RoleSpendCap, type RoleView, type SdkFailureObservation, type Session, type SignerStatus, type SignerStatusStore, type SmartAccount, type SmartAccountMethods, type StateLabel, type SubmittedPermissionExecution, type SystemHealth, type SystemMethods, type TargetReference, type TargetsMethods, type TelemetryPort, captureException, captureExceptionSync, createCapxulClient, deriveDevPrivateKey, devPrivateKeySigner, eip1193AccountProvider, embeddedSigner, fingerprintPaymentIntent, formatMoney, inboxPhase, injectedWalletSigner, isCapxulError, isClaimed, isMoneyParseError, isRestoring, isSettingUpLifecycle, localPrivateKeyAccountProvider, openfortEmbeddedSigner, openfortEmbeddedSignerFromWallet, openfortEmbeddedWalletPort, parseMoney, paymentPhase, postHogObservability, requestPhase, destination as resolveIdentityDestination, toCountryCode, toAddress as toEvmAddress };

package/dist/index.mjs

@@ -1,7 +1,7 @@
-import { $ as isClaimed, A as fingerprintPaymentIntent, B as OBSERVATION_CONTEXT_HEADER, C as ClockPortTag, D as AuthClientError, E as authClientPortFromPromiseAdapter, F as copyInvocationObservation, G as CAPXUL_FUNCTIONS, H as sanitizeObservationContext, I as readInvocationObservation, J as CAPXUL_PAYMENTS_V2_ADDRESS, K as BootstrapEnvelope, L as causeChain, M as fromWei, N as isSettingUpLifecycle, O as AuthClientPortTag, P as formatTraceparent, Q as destination, R as injectedWalletSigner, S as ClockError, T as bootstrapErrorFromCapxul, U as PAYMENT_DIRECTIONS, V as encodeObservationContextHeader, W as PAYMENT_STATUSES, X as BASE_SEPOLIA_CHAIN_ID, Y as normalizeBindingEmail, _ as wireChainId, a as observeFailedResult, b as ConvexCallPortTag, c as captureExceptionSync, d as TelemetryPortTag, et as isRestoring, g as accountReadErrorFromCapxul, h as AccountReadPortTag, i as observationContextProps, j as toWei, k as version, l as detectAuthCacheAdapter, m as smartAccountErrorFromCapxul, n as postHogProductTelemetry, o as postHogFailureObservation, p as SmartAccountPortTag, q as EngineeringTelemetryBootstrapPolicy, r as CAPXUL_SDK_EXPECTED_OUTCOME_EVENT, s as captureException, t as assembleCapxulClient, u as PostHogTelemetryLayer, v as IdentityPortTag, w as BootstrapPortTag, x as convexCallErrorFromCapxul, y as identityErrorFromCapxul, z as signerFailure } from "./create-capxul-client-BrE6tLg6.mjs";
-import { C as toDurationMs, D as toJwtToken, E as toEpochSeconds, F as CAPXUL_ERROR_CODES, I as CapxulError, M as toRoleKey, N as toSessionToken, O as toKycTier, P as decodeConvexError, R as Errors, S as toCurrencyCode, T as toEpochMs, b as toChainId, g as toAllowedOrigin, h as toAddress, j as toPublishableKey, k as toOrgId, m as toAccountId, o as AuthCachePortTag, p as currencySymbolFor, v as toAuthUserId, w as toEmail, x as toCountryCode, z as isCapxulError } from "./InMemoryAuthCacheAdapter-qMpBOGb3.mjs";
+import { A as AuthClientPortTag, B as injectedWalletSigner, C as convexCallErrorFromCapxul, D as bootstrapErrorFromCapxul, E as BootstrapPortTag, F as isSettingUpLifecycle, G as PAYMENT_DIRECTIONS, H as OBSERVATION_CONTEXT_HEADER, I as formatTraceparent, J as BootstrapEnvelope, K as PAYMENT_STATUSES, L as copyInvocationObservation, M as fingerprintPaymentIntent, N as toWei, O as authClientPortFromPromiseAdapter, P as fromWei, Q as BASE_SEPOLIA_CHAIN_ID, R as readInvocationObservation, S as ConvexCallPortTag, T as ClockPortTag, U as encodeObservationContextHeader, V as signerFailure, W as sanitizeObservationContext, X as CAPXUL_PAYMENTS_V2_ADDRESS, Y as EngineeringTelemetryBootstrapPolicy, Z as normalizeBindingEmail, _ as AccountReadPortTag, a as failureEvidenceProps, b as IdentityPortTag, c as postHogFailureObservation, d as detectAuthCacheAdapter, et as destination, f as PostHogTelemetryLayer, g as smartAccountErrorFromCapxul, h as SmartAccountPortTag, i as failureDetail, j as version, k as AuthClientError, l as captureException, n as postHogProductTelemetry, nt as isRestoring, o as observationContextProps, p as TelemetryPortTag, q as CAPXUL_FUNCTIONS, r as CAPXUL_SDK_EXPECTED_OUTCOME_EVENT, s as observeFailedResult, t as assembleCapxulClient, tt as isClaimed, u as captureExceptionSync, v as accountReadErrorFromCapxul, w as ClockError, x as identityErrorFromCapxul, y as wireChainId, z as causeChain } from "./create-capxul-client-B050H6SY.mjs";
+import { B as Errors, C as toDurationMs, D as toJwtToken, E as toEpochSeconds, F as toSessionToken, I as decodeConvexError, L as CAPXUL_ERROR_CODES, N as toPublishableKey, O as toKycTier, P as toRoleKey, R as CapxulError, S as toCurrencyCode, T as toEpochMs, V as isCapxulError, b as toChainId, g as toAllowedOrigin, h as toAddress, k as toOrgId, m as toAccountId, o as AuthCachePortTag, p as currencySymbolFor, v as toAuthUserId, w as toEmail, x as toCountryCode } from "./InMemoryAuthCacheAdapter-uOcqpqu8.mjs";
 import { keccak256, recoverAddress, stringToHex } from "viem";
-import { Cause, Context, Data, Effect, Exit, Layer, Result, SchemaIssue, SchemaParser, Scope, Tracer } from "effect";
+import { Cause, Context, Data, Duration, Effect, Exit, Layer, Result, Schedule, SchemaIssue, SchemaParser, Scope, Tracer } from "effect";
 import { getFunctionName, makeFunctionReference } from "convex/server";
 import { privateKeyToAccount } from "viem/accounts";
 import { FetchHttpClient, Headers, HttpClient } from "effect/unstable/http";
@@ -1266,6 +1266,33 @@ function BetterAuthNodeLayer(deps) {
 }
 //#endregion
 //#region src/adapters/bootstrap/HttpBootstrapAdapter.ts
+const DEFAULT_RETRY = {
+	attempts: 2,
+	baseDelayMs: 400
+};
+/** Request-side statuses a proxy or backend returns while momentarily unable to serve. */
+const TRANSIENT_HTTP_STATUSES = new Set([
+	408,
+	425,
+	429
+]);
+/** Every 5xx is a server-side condition worth one more try; the client sent nothing wrong. */
+function isTransientHttpStatus(status) {
+	return status >= 500 || TRANSIENT_HTTP_STATUSES.has(status);
+}
+/**
+* A transient HTTP status is worth one more try. The bootstrap call crosses
+* the host's own proxy before it reaches Convex, and every observed failure
+* of that hop cleared on a retry seconds later. A network rejection (offline,
+* DNS, CORS) is not retried: it does not clear in a second, and the caller
+* surfaces it as `NETWORK_ERROR` at once. Auth and input rejections are
+* deterministic and never retried.
+*/
+function isTransientBootstrapFailure(error) {
+	if (error.kind !== "provider") return false;
+	const status = error.details?.httpStatus;
+	return typeof status === "number" && isTransientHttpStatus(status);
+}
 async function safeText(res) {
 	try {
 		return await res.text();
@@ -1277,12 +1304,21 @@ var HttpBootstrapAdapter = class {
 	bootstrapBaseUrl;
 	fetchImpl;
 	observation;
+	retry;
 	constructor(deps) {
 		this.bootstrapBaseUrl = deps.bootstrapBaseUrl.replace(/\/$/, "");
 		this.observation = deps.observation;
+		this.retry = deps.retry ?? DEFAULT_RETRY;
 		this.fetchImpl = deps.fetch ?? ((input, init) => globalThis.fetch(input, init));
 	}
 	resolve(input) {
+		return this.attempt(input).pipe(Effect.retry({
+			times: this.retry.attempts,
+			while: isTransientBootstrapFailure,
+			schedule: Schedule.exponential(Duration.millis(this.retry.baseDelayMs))
+		}));
+	}
+	attempt(input) {
 		return Effect.tryPromise({
 			try: () => {
 				const headers = {
@@ -1335,7 +1371,17 @@ var HttpBootstrapAdapter = class {
 		return Effect.promise(() => safeText(res)).pipe(Effect.flatMap((body) => {
 			if (res.status === 401 || body.startsWith("NOT_AUTHENTICATED")) return Effect.fail(bootstrapErrorFromCapxul("notAuthenticated", Errors.notAuthenticated()));
 			if (res.status === 400 || body.startsWith("INVALID_INPUT")) return Effect.fail(bootstrapErrorFromCapxul("invalidInput", Errors.invalidInput("publishableKey", "rejected by bootstrap")));
-			return Effect.fail(bootstrapErrorFromCapxul("provider", Errors.providerError("convex", "bootstrap", /* @__PURE__ */ new Error(`HTTP ${res.status}`))));
+			const responseBody = body.slice(0, 300);
+			const edgeError = res.headers?.get?.("x-vercel-error") ?? void 0;
+			const edgeRequestId = res.headers?.get?.("x-vercel-id") ?? void 0;
+			return Effect.fail(bootstrapErrorFromCapxul("provider", Errors.providerError("convex", "bootstrap", /* @__PURE__ */ new Error(`HTTP ${res.status}${edgeError === void 0 ? "" : ` ${edgeError}`}`), {
+				httpStatus: res.status,
+				details: {
+					...responseBody.length === 0 ? {} : { responseBody },
+					...edgeError === void 0 ? {} : { edgeError },
+					...edgeRequestId === void 0 ? {} : { edgeRequestId }
+				}
+			})));
 		}));
 	}
 };
@@ -2794,7 +2840,9 @@ async function createProductionAdapters(input) {
 				name: "bootstrap_failed",
 				props: {
 					...bootstrapTelemetryEnvelope(input, resolvedInput.value),
-					reason: bootstrapResult.error.code
+					reason: bootstrapResult.error.code,
+					...failureDetail(bootstrapResult.error),
+					...failureEvidenceProps(bootstrapResult.error)
 				}
 			});
 			await closeScope().catch(() => void 0);

package/dist/node/index.d.mts

@@ -1,4 +1,4 @@
-import { O as AuthSession, _ as AuthCacheError, b as CachedJwt, n as CapxulSigner, v as AuthCachePort, y as AuthCachePortTag } from "../signer-BGTaqZqg.mjs";
+import { O as AuthSession, _ as AuthCacheError, b as CachedJwt, n as CapxulSigner, v as AuthCachePort, y as AuthCachePortTag } from "../signer-BSEG9xgN.mjs";
 import { Hex } from "viem";
 import { Effect, FileSystem, Layer, Path } from "effect";
 

package/dist/node/index.mjs

@@ -1,4 +1,4 @@
-import { a as AuthCacheError, h as toAddress, i as parseCachedJwt, n as BrowserAuthCacheAdapter, o as AuthCachePortTag, r as parseAuthSession, t as InMemoryAuthCacheAdapter } from "../InMemoryAuthCacheAdapter-qMpBOGb3.mjs";
+import { a as AuthCacheError, h as toAddress, i as parseCachedJwt, n as BrowserAuthCacheAdapter, o as AuthCachePortTag, r as parseAuthSession, t as InMemoryAuthCacheAdapter } from "../InMemoryAuthCacheAdapter-uOcqpqu8.mjs";
 import { Effect, FileSystem, Layer, Path } from "effect";
 import { privateKeyToAccount } from "viem/accounts";
 import * as os from "node:os";

package/dist/{observation-BfCkJY5z.d.mts → observation-BQ2VKWH5.d.mts}

@@ -1,4 +1,4 @@
-import { A as BlockNumber, B as OrgId, C as Address$1, D as AppId, E as AnonymousDistinctId, F as DocumentHash, G as Profile, H as PaymentCommandId, I as DurationMs, J as SessionToken, K as PublishableKey, L as Email, M as ChainId, N as CountryCode, O as AuthSession, P as CurrencyCode, R as EpochMs, T as AllowedOrigin, U as PermissionAssignmentId, V as PartyId, W as PermissionId, X as TxHash, Y as SmartAccount, Z as WeiAmount, a as SignerStatusStore, at as Failure, b as CachedJwt, c as AccountProviderSource, g as SmartAccount$1, h as Session$1, j as BudgetId, k as AuthUserId, l as AccountRequirement, m as Profile$1, n as CapxulSigner, nt as CapxulErrorCode, ot as FailureMode, p as CapxulResult, q as RoleKey, rt as CapxulErrorDetails, tt as CapxulError, v as AuthCachePort, w as AllowanceKey, x as Account$1, z as Money } from "./signer-BGTaqZqg.mjs";
+import { $ as WeiAmount, A as BlockNumber, B as OrgId, C as Address$1, D as AppId, E as AnonymousDistinctId, F as DocumentHash, G as PermissionAssignmentId, H as PaymentCommandId, I as DurationMs, J as PublishableKey, K as PermissionId, L as Email, M as ChainId, N as CountryCode, O as AuthSession, P as CurrencyCode, Q as TxHash, R as EpochMs, T as AllowedOrigin, U as PayrollGroupId, V as PartyId, W as PayrollRunId, X as SessionToken, Y as RoleKey, Z as SmartAccount, a as SignerStatusStore, at as CapxulErrorDetails, b as CachedJwt, c as AccountProviderSource, ct as FailureMode, g as SmartAccount$1, h as Session$1, it as CapxulErrorCode, j as BudgetId, k as AuthUserId, l as AccountRequirement, m as Profile$1, n as CapxulSigner, p as CapxulResult, q as Profile, rt as CapxulError, st as Failure, v as AuthCachePort, w as AllowanceKey, x as Account$1, z as Money } from "./signer-BSEG9xgN.mjs";
 import { Address, Hex } from "viem";
 import { Context, Effect, Layer, Schema, Scope, Tracer } from "effect";
 import { FunctionReference } from "convex/server";
@@ -38,7 +38,8 @@ type IdentityTransition = (RecordBase & {
   readonly outcome: "failed" | "cancelled";
   readonly state: string;
   readonly error_code: CapxulErrorCode;
-  readonly refusal_code?: never;
+  readonly refusal_code?: never; /** The typed failure behind `error_code`, with its `CapxulError` when the port gave one. */
+  readonly failure?: Failure;
 });
 declare class ActorFailure<Reason extends CapxulErrorCode> extends Error {
   readonly reason: Reason;
@@ -47,7 +48,7 @@ declare class ActorFailure<Reason extends CapxulErrorCode> extends Error {
   readonly event: string;
   readonly details?: Readonly<Record<string, unknown>> | undefined;
   readonly _tag = "ActorFailure";
-  constructor(reason: Reason, machine: string, state: string, event: string, details?: Readonly<Record<string, unknown>> | undefined);
+  constructor(reason: Reason, machine: string, state: string, event: string, details?: Readonly<Record<string, unknown>> | undefined, cause?: unknown);
 }
 interface Actor<S, Pub, Reason extends CapxulErrorCode> {
   readonly ask: (event: Pub, controls?: InvocationControls) => Effect.Effect<S, ActorFailure<Reason | CapxulErrorCode>>;
@@ -614,6 +615,8 @@ declare const SubmittedPermissionExecutionSchema: Schema.Struct<{
   }>>]>;
 }>;
 type SubmittedPermissionExecution = Schema.Schema.Type<typeof SubmittedPermissionExecutionSchema>;
+declare const PayrollRunStatusSchema: Schema.Literals<readonly ["draft", "authorized", "settled"]>;
+type PayrollRunStatus$1 = Schema.Schema.Type<typeof PayrollRunStatusSchema>;
 //#endregion
 //#region ../wire/src/observation-context.d.ts
 /**
@@ -2065,6 +2068,114 @@ interface OrganizationPaymentsMethods {
   }): Promise<CapxulResult<readonly Payment[]>>;
 }
 //#endregion
+//#region src/surface/payroll.d.ts
+/** ADR-0022 R9: where the run stands on the shipped command lifecycle. */
+type PayrollRunStatus = PayrollRunStatus$1;
+/** One authorized payroll run. `total` is the sum of its items' nets. */
+interface PayrollRun {
+  readonly id: PayrollRunId;
+  readonly status: PayrollRunStatus;
+  /** Epoch milliseconds. An instant run has `periodStart === periodEnd`. */
+  readonly periodStart: number;
+  readonly periodEnd: number;
+  readonly total: Money;
+  readonly recipientCount: number;
+}
+/**
+ * An organization's runs, newest first, with the month total beside them.
+ *
+ * The aggregate travels WITH the list because the backend computes it over
+ * every settled run in the calendar month while the list is one page. A
+ * consumer that summed `runs` would under-report an employer past the page.
+ */
+interface PayrollRuns {
+  readonly runs: readonly PayrollRun[];
+  /** Σ net of the runs that SETTLED this calendar month — the "Paid This Month" fact. */
+  readonly settledThisMonth: Money;
+}
+/**
+ * One saved recipient on a group. `amount` is the employer's TYPED text, not
+ * minor units: a group is a draft the run composer prefills, and the run
+ * engine is the one place that parses an amount into money.
+ */
+interface PayrollGroupMember {
+  /** The recipient's `PartyId` — the stable id (ADR-0022 R1), never an email. */
+  readonly partyId: string;
+  readonly amount: string;
+  readonly currency: CurrencyCode;
+}
+/** A saved roster the employer pays again. Server-held, so every member sees it. */
+interface PayrollGroup {
+  readonly id: PayrollGroupId;
+  readonly name: string;
+  /** A stored display preference; the consumer narrows it to its own union. */
+  readonly tone: string;
+  readonly members: readonly PayrollGroupMember[];
+}
+/** `id` absent creates a group; `id` present replaces that group in place. */
+interface PayrollGroupInput {
+  readonly id?: PayrollGroupId;
+  readonly name: string;
+  readonly tone: string;
+  readonly members: readonly PayrollGroupMember[];
+}
+/**
+ * One person on one run. `net` is what they are paid; `gross` plus every
+ * adjustment must equal it (ADR-0022 R8) and the backend refuses a run where
+ * it does not. Both are minor-unit strings; an adjustment is signed.
+ */
+interface PayrollRunItemInput {
+  /**
+   * The recipient. An email `Ref` or a party `Ref` in v1 — the backend refuses
+   * any other kind, because the recipient is what the party is DERIVED from.
+   */
+  readonly to: Ref$1;
+  /**
+   * The caller's ASSERTION of the party `to` resolves to, never the authority
+   * for it. The backend resolves `to` — an email through the invite path's
+   * person-party ensure, a party `Ref` through the same recipient resolution
+   * the batch runs — and refuses the run when this id is not that party, so
+   * the money, the `employed` edge and the payslip's employee can never name
+   * three different people.
+   */
+  readonly partyId: string;
+  readonly gross: string;
+  readonly net: string;
+  readonly adjustments: readonly {
+    readonly label: string;
+    readonly amount: string;
+  }[];
+}
+interface AuthorizeRunInput {
+  /** The Budget the run spends from. The caller selects it; nothing is picked for them. */
+  readonly permissionId: string;
+  /** Epoch milliseconds. An instant run passes `start === end` — the payslip renders the date. */
+  readonly period: {
+    readonly start: number;
+    readonly end: number;
+  };
+  readonly items: readonly PayrollRunItemInput[];
+  /**
+   * Supply one to reuse a key minted elsewhere. Left absent, the shipped
+   * fingerprint lifecycle derives it from this intent, so a retry of the same
+   * run replays the SAME command instead of paying twice.
+   */
+  readonly requestKey?: string;
+}
+type PayrollOptions = {
+  readonly signal?: AbortSignal;
+};
+interface PayrollGroupsMethods {
+  list(options?: PayrollOptions): Promise<CapxulResult<readonly PayrollGroup[]>>;
+  save(input: PayrollGroupInput, options?: PayrollOptions): Promise<CapxulResult<PayrollGroup>>;
+  remove(id: PayrollGroupId, options?: PayrollOptions): Promise<CapxulResult<void>>;
+}
+interface PayrollMethods {
+  runs(options?: PayrollOptions): Promise<CapxulResult<PayrollRuns>>;
+  authorizeRun(input: AuthorizeRunInput, options?: PayrollOptions): Promise<CapxulResult<PayrollRun>>;
+  readonly groups: PayrollGroupsMethods;
+}
+//#endregion
 //#region src/surface/org.d.ts
 /** The membership state for one Organization member. */
 type MemberStatus = "pending" | "pending_safe" | "pending_grant" | "active" | "revoked" | "expired";
@@ -2214,6 +2325,13 @@ interface OrgScopedMethods extends ActorRelationshipMethods {
    */
   readonly permissions: PermissionMethods;
   readonly payments: OrganizationPaymentsMethods;
+  /**
+   * Pay the team: the runs this Organization has authorized, the verb that
+   * authorizes one, and the saved groups a run is composed from (#1452).
+   * `authorizeRun` is a payment command like any other — same Budget gate,
+   * same signature, same request-key idempotency.
+   */
+  readonly payroll: PayrollMethods;
   auditLog(options?: {
     readonly signal?: AbortSignal;
   }): Promise<CapxulResult<readonly OrganizationAuditLogItem[]>>;
@@ -2584,9 +2702,11 @@ declare function postHogObservability(client: PostHogObservabilityClient | null
 /** Host-owned correlation fields that are safe to attach to an SDK failure. */
 interface ObservationContext extends Omit<WireObservationContext, "applicationId"> {}
 /**
- * The small, SDK-owned failure envelope delivered to observation adapters.
- * Method arguments, response bodies, wallet payloads, and arbitrary error
- * details are deliberately absent.
+ * The SDK-owned failure envelope delivered to observation adapters. It carries
+ * the real error message, the `CapxulError.details` object, the cause chain,
+ * and the stack. Secret material (keys, tokens, bearer headers) is masked;
+ * nothing else is withheld. Ruling 2026-09-01: an operator reading an issue
+ * needs the actual failure, not a placeholder.
  */
 interface SdkFailureObservation {
   readonly exception: Error;
@@ -2595,6 +2715,30 @@ interface SdkFailureObservation {
   readonly errorKind: string;
   /** Invocation snapshot; failure correlation wins over later host state. */
   readonly context?: ObservationContext;
+  /** Enumerated discriminators from `CapxulError.details`, in property shape. */
+  readonly detail?: SdkFailureDetail;
+  /** The error's own message, secrets masked. */
+  readonly message?: string;
+  /** The full `CapxulError.details` object, secrets masked, JSON-safe. */
+  readonly details?: Readonly<Record<string, unknown>>;
+  /** Messages down the `cause` chain, outermost first, secrets masked. */
+  readonly causeChain?: readonly string[];
+  /** The original stack when the error had one, secrets masked. */
+  readonly stack?: string;
+}
+/**
+ * The PII-safe subset of `CapxulError.details`, already in PostHog property
+ * shape. `provider` + `provider_operation` name the failing dependency
+ * (`convex bootstrap`, `openfort configure`), `failure_mode` / `reason` are
+ * enumerated codes, `http_status` is the upstream status. Anything else on
+ * `details` (ids, field names, free text) is dropped at the boundary.
+ */
+interface SdkFailureDetail {
+  readonly provider?: string;
+  readonly provider_operation?: string;
+  readonly failure_mode?: string;
+  readonly reason?: string;
+  readonly http_status?: number;
 }
 type ObservationDelivery = void | PromiseLike<void>;
 /**
@@ -2615,4 +2759,4 @@ interface ObservationAdapter {
 /** Stable PostHog event used for typed failures that are expected product outcomes. */
 declare const CAPXUL_SDK_EXPECTED_OUTCOME_EVENT = "capxul_sdk_expected_outcome";
 //#endregion
-export { AccountsMethods as $, PaymentDocumentRef as $t, OrgView as A, PAYMENT_STATUSES as An, Destination as At, OrganizationPaymentsMethods as B, IdentityState as Bn, MeMethods as Bt, DetectPendingOrgInvitationsResult as C, OrgSetupStep as Cn, ActivityRange as Ct, OrgMethods as D, SubmittedPermissionExecution as Dn, ActivitySummaryTotal as Dt, MemberView as E, Permission as En, ActivitySummaryParams as Et, RoleSpendCap as F, TelemetryIdentifyInput as Fn, DestinationRail as Ft, PermissionOptions as G, isClaimed as Gn, OfframpQuoteInput as Gt, PermissionChangeInput as H, Readiness as Hn, MovementActivityEvidence as Ht, RoleView as I, TelemetryPort as In, DestinationRemoveInput as It, PermissionReadResult as J, InvocationControls as Jn, PayeesMethods as Jt, PermissionReplaceInput as K, isRestoring as Kn, OfframpStatus as Kt, OrganizationPaymentBatchInput as L, CAPXUL_PAYMENTS_V2_ADDRESS as Ln, DestinationsMethods as Lt, OrganizationAuditLogItem as M, RequestStatus as Mn, DestinationKind as Mt, ResendInviteTokenInput as N, TelemetryEvent as Nn, DestinationListInput as Nt, OrgScopedMethods as O, InboxStatus as On, ActorReference as Ot, RoleDefinition as P, TelemetryGroupInput as Pn, DestinationPayload as Pt, OrgMeOptions as Q, PaymentDocumentKind as Qt, OrganizationPaymentInput as R, Destination$1 as Rn, FinancialOpsMethods as Rt, CreateOrgInput as S, OrgLifecycle as Sn, ActivityPage as St, MemberStatus as T, CurrentHoldings as Tn, ActivitySummary as Tt, PermissionCreateInput as U, StateLabel as Un, OfframpMethods as Ut, PermissionAssignInput as V, OrgLane as Vn, MeProfile as Vt, PermissionMethods as W, destination as Wn, OfframpQuote as Wt, OrgMe as X, PaymentActivityEvidence as Xt, Budget as Y, Payment as Yt, OrgMeMethod as Z, PaymentDirection as Zt, SystemMethods as _, AccountSetupStep as _n, ActivityFilter as _t, SdkFailureObservation as a, PaymentTiming as an, ActorRequestIssueInput as at, CurrentUserContext as b, SmartAccountMethods as bn, ActivityListParams as bt, PostHogObservabilityOptions as c, PaymentsPayInput as cn, AddressBookEntry as ct, CreateCapxulClientInput as d, Ref$1 as dn, InboxApproveInput as dt, PaymentDocumentRender as en, AccountMethods as et, IdentityProfileDetails as f, ResolvedTarget as fn, InboxItem as ft, Holding as g, AccountLifecycle as gn, ActivityDetail as gt, HoldingsMethods as h, fingerprintPaymentIntent as hn, ActivityAnnotationInput as ht, ObservationDelivery as i, PaymentStatus as in, ActorRequest as it, OrganizationAccount as j, PaymentStatus$1 as jn, DestinationAddInput as jt, OrgTemplate as k, PAYMENT_DIRECTIONS as kn, DepositInstructions as kt, postHogObservability as l, RecipientResolution as ln, AddressBookLabelInput as lt, IdentityRuntimeSendResult as m, TargetsMethods as mn, ActivityAnnotation as mt, ObservationAdapter as n, PaymentDocumentsMethods as nn, ActorProfileMethods as nt, HostObservability as o, PaymentType as on, ActorRequestsMethods as ot, IdentityRuntime as p, TargetReference as pn, InboxMethods as pt, PermissionRevokeInput as q, IdentityTransition as qn, Payee as qt, ObservationContext as r, PaymentMoney as rn, ActorRelationshipMethods as rt, PostHogObservabilityClient as s, PaymentsMethods as sn, AddressBookAddInput as st, CAPXUL_SDK_EXPECTED_OUTCOME_EVENT as t, PaymentDocumentVerification as tn, ActorProfile as tt, CapxulClient as u, RecipientResolutionKind as un, AddressBookMethods as ut, SystemHealth as v, isSettingUpLifecycle as vn, ActivityItem as vt, InviteMemberInput as w, ActorRef as wn, ActivityReference as wt, CurrentUserMethods as x, AuthMethods as xn, ActivityMethods as xt, MediaMethods as y, IdentityMethods as yn, ActivityKind as yt, OrganizationPaymentItemInput as z, IdentityEvent as zn, HandlesMethods as zt };
+export { PermissionChangeInput as $, Readiness as $n, MovementActivityEvidence as $t, OrgView as A, IdentityMethods as An, ActivityKind as At, PayrollGroupMember as B, PAYMENT_DIRECTIONS as Bn, DepositInstructions as Bt, DetectPendingOrgInvitationsResult as C, ResolvedTarget as Cn, InboxItem as Ct, OrgMethods as D, AccountLifecycle as Dn, ActivityDetail as Dt, MemberView as E, fingerprintPaymentIntent as En, ActivityAnnotationInput as Et, RoleSpendCap as F, ActorRef as Fn, ActivityReference as Ft, PayrollRunItemInput as G, TelemetryGroupInput as Gn, DestinationPayload as Gt, PayrollMethods as H, PaymentStatus$1 as Hn, DestinationAddInput as Ht, RoleView as I, CurrentHoldings as In, ActivitySummary as It, OrganizationPaymentBatchInput as J, CAPXUL_PAYMENTS_V2_ADDRESS as Jn, DestinationsMethods as Jt, PayrollRunStatus as K, TelemetryIdentifyInput as Kn, DestinationRail as Kt, AuthorizeRunInput as L, Permission as Ln, ActivitySummaryParams as Lt, OrganizationAuditLogItem as M, AuthMethods as Mn, ActivityMethods as Mt, ResendInviteTokenInput as N, OrgLifecycle as Nn, ActivityPage as Nt, OrgScopedMethods as O, AccountSetupStep as On, ActivityFilter as Ot, RoleDefinition as P, OrgSetupStep as Pn, ActivityRange as Pt, PermissionAssignInput as Q, OrgLane as Qn, MeProfile as Qt, PayrollGroup as R, SubmittedPermissionExecution as Rn, ActivitySummaryTotal as Rt, CreateOrgInput as S, Ref$1 as Sn, InboxApproveInput as St, MemberStatus as T, TargetsMethods as Tn, ActivityAnnotation as Tt, PayrollOptions as U, RequestStatus as Un, DestinationKind as Ut, PayrollGroupsMethods as V, PAYMENT_STATUSES as Vn, Destination as Vt, PayrollRun as W, TelemetryEvent as Wn, DestinationListInput as Wt, OrganizationPaymentItemInput as X, IdentityEvent as Xn, HandlesMethods as Xt, OrganizationPaymentInput as Y, Destination$1 as Yn, FinancialOpsMethods as Yt, OrganizationPaymentsMethods as Z, IdentityState as Zn, MeMethods as Zt, SystemMethods as _, PaymentType as _n, ActorRequestsMethods as _t, SdkFailureObservation as a, PayeesMethods as an, InvocationControls as ar, PermissionReadResult as at, CurrentUserContext as b, RecipientResolution as bn, AddressBookLabelInput as bt, PostHogObservabilityOptions as c, PaymentDirection as cn, OrgMeMethod as ct, CreateCapxulClientInput as d, PaymentDocumentRender as dn, AccountMethods as dt, OfframpMethods as en, StateLabel as er, PermissionCreateInput as et, IdentityProfileDetails as f, PaymentDocumentVerification as fn, ActorProfile as ft, Holding as g, PaymentTiming as gn, ActorRequestIssueInput as gt, HoldingsMethods as h, PaymentStatus as hn, ActorRequest as ht, ObservationDelivery as i, Payee as in, IdentityTransition as ir, PermissionRevokeInput as it, OrganizationAccount as j, SmartAccountMethods as jn, ActivityListParams as jt, OrgTemplate as k, isSettingUpLifecycle as kn, ActivityItem as kt, postHogObservability as l, PaymentDocumentKind as ln, OrgMeOptions as lt, IdentityRuntimeSendResult as m, PaymentMoney as mn, ActorRelationshipMethods as mt, ObservationAdapter as n, OfframpQuoteInput as nn, isClaimed as nr, PermissionOptions as nt, HostObservability as o, Payment as on, Budget as ot, IdentityRuntime as p, PaymentDocumentsMethods as pn, ActorProfileMethods as pt, PayrollRuns as q, TelemetryPort as qn, DestinationRemoveInput as qt, ObservationContext as r, OfframpStatus as rn, isRestoring as rr, PermissionReplaceInput as rt, PostHogObservabilityClient as s, PaymentActivityEvidence as sn, OrgMe as st, CAPXUL_SDK_EXPECTED_OUTCOME_EVENT as t, OfframpQuote as tn, destination as tr, PermissionMethods as tt, CapxulClient as u, PaymentDocumentRef as un, AccountsMethods as ut, SystemHealth as v, PaymentsMethods as vn, AddressBookAddInput as vt, InviteMemberInput as w, TargetReference as wn, InboxMethods as wt, CurrentUserMethods as x, RecipientResolutionKind as xn, AddressBookMethods as xt, MediaMethods as y, PaymentsPayInput as yn, AddressBookEntry as yt, PayrollGroupInput as z, InboxStatus as zn, ActorReference as zt };

package/dist/{signer-BGTaqZqg.d.mts → signer-BSEG9xgN.d.mts}

@@ -66,6 +66,8 @@ declare const Errors: {
   readonly accountNotFound: (accountId?: string) => CapxulError;
   readonly providerError: (provider: string, operation: string, cause: unknown, opts?: {
     readonly failure_mode?: FailureMode;
+    readonly httpStatus?: number; /** Extra evidence for the operator (response body, edge error code). */
+    readonly details?: Readonly<Record<string, unknown>>;
   }) => CapxulError;
   readonly capabilityUnavailable: (provider: string, operation: string) => CapxulError;
   readonly invalidInput: (field: string, reason: string) => CapxulError;
@@ -196,6 +198,8 @@ type PermissionId = Brand<string, "PermissionId">;
 type PermissionAssignmentId = Brand<string, "PermissionAssignmentId">;
 type BudgetId = Brand<string, "BudgetId">;
 type PaymentCommandId = Brand<string, "PaymentCommandId">;
+type PayrollRunId = Brand<string, "PayrollRunId">;
+type PayrollGroupId = Brand<string, "PayrollGroupId">;
 type OrgId = Brand<string, "OrgId">;
 type AppId = Brand<string, "AppId">;
 type AllowedOrigin = Brand<string, "AllowedOrigin">;
@@ -406,4 +410,4 @@ interface Eip1193RequestProvider {
  */
 declare function injectedWalletSigner(provider: Eip1193RequestProvider): CapxulSigner;
 //#endregion
-export { toCountryCode as $, BlockNumber as A, OrgId as B, Address$1 as C, AppId as D, AnonymousDistinctId as E, DocumentHash as F, Profile$1 as G, PaymentCommandId as H, DurationMs as I, SessionToken as J, PublishableKey as K, Email as L, ChainId as M, CountryCode as N, AuthSession as O, CurrencyCode as P, toAddress as Q, EpochMs as R, AccountId as S, AllowedOrigin as T, PermissionAssignmentId as U, PartyId as V, PermissionId as W, TxHash as X, SmartAccount$1 as Y, WeiAmount as Z, AuthCacheError as _, SignerStatusStore as a, Failure as at, CachedJwt as b, AccountProviderSource as c, eip1193AccountProvider as d, CAPXUL_ERROR_CODES as et, localPrivateKeyAccountProvider as f, SmartAccount as g, Session as h, SignerStatus as i, Errors as it, BudgetId as j, AuthUserId as k, AccountRequirement as l, Profile as m, CapxulSigner as n, CapxulErrorCode as nt, injectedWalletSigner as o, FailureMode as ot, CapxulResult as p, RoleKey as q, Eip1193RequestProvider as r, CapxulErrorDetails as rt, AccountProvider as s, isCapxulError as st, CapxulDigestSigner as t, CapxulError as tt, Eip1193Provider as u, AuthCachePort as v, AllowanceKey as w, Account$1 as x, AuthCachePortTag as y, Money as z };
+export { WeiAmount as $, BlockNumber as A, OrgId as B, Address$1 as C, AppId as D, AnonymousDistinctId as E, DocumentHash as F, PermissionAssignmentId as G, PaymentCommandId as H, DurationMs as I, PublishableKey as J, PermissionId as K, Email as L, ChainId as M, CountryCode as N, AuthSession as O, CurrencyCode as P, TxHash as Q, EpochMs as R, AccountId as S, AllowedOrigin as T, PayrollGroupId as U, PartyId as V, PayrollRunId as W, SessionToken as X, RoleKey as Y, SmartAccount$1 as Z, AuthCacheError as _, SignerStatusStore as a, CapxulErrorDetails as at, CachedJwt as b, AccountProviderSource as c, FailureMode as ct, eip1193AccountProvider as d, toAddress as et, localPrivateKeyAccountProvider as f, SmartAccount as g, Session as h, SignerStatus as i, CapxulErrorCode as it, BudgetId as j, AuthUserId as k, AccountRequirement as l, isCapxulError as lt, Profile as m, CapxulSigner as n, CAPXUL_ERROR_CODES as nt, injectedWalletSigner as o, Errors as ot, CapxulResult as p, Profile$1 as q, Eip1193RequestProvider as r, CapxulError as rt, AccountProvider as s, Failure as st, CapxulDigestSigner as t, toCountryCode as tt, Eip1193Provider as u, AuthCachePort as v, AllowanceKey as w, Account$1 as x, AuthCachePortTag as y, Money as z };

package/dist/testing/index.d.mts

@@ -1,4 +1,4 @@
-import { Fn as TelemetryIdentifyInput, Nn as TelemetryEvent, Pn as TelemetryGroupInput, n as ObservationAdapter, qn as IdentityTransition, u as CapxulClient } from "../observation-BfCkJY5z.mjs";
+import { Gn as TelemetryGroupInput, Kn as TelemetryIdentifyInput, Wn as TelemetryEvent, ir as IdentityTransition, n as ObservationAdapter, u as CapxulClient } from "../observation-BQ2VKWH5.mjs";
 import { Effect, Layer } from "effect";
 
 //#region src/testing/telemetry/RecordingTelemetryAdapter.d.ts

package/dist/testing/index.mjs

@@ -1,5 +1,5 @@
-import { E as authClientPortFromPromiseAdapter, M as fromWei, T as bootstrapErrorFromCapxul, Z as deriveCapxulSafeAddress, _ as wireChainId, f as redactTelemetryEvent, g as accountReadErrorFromCapxul, j as toWei, m as smartAccountErrorFromCapxul, t as assembleCapxulClient, x as convexCallErrorFromCapxul, y as identityErrorFromCapxul } from "../create-capxul-client-BrE6tLg6.mjs";
-import { C as toDurationMs, D as toJwtToken, E as toEpochSeconds, I as CapxulError, N as toSessionToken, O as toKycTier, R as Errors, T as toEpochMs, _ as toAppId, b as toChainId, g as toAllowedOrigin, h as toAddress, j as toPublishableKey, m as toAccountId, t as InMemoryAuthCacheAdapter, v as toAuthUserId, w as toEmail, x as toCountryCode } from "../InMemoryAuthCacheAdapter-qMpBOGb3.mjs";
+import { $ as deriveCapxulSafeAddress, C as convexCallErrorFromCapxul, D as bootstrapErrorFromCapxul, N as toWei, O as authClientPortFromPromiseAdapter, P as fromWei, g as smartAccountErrorFromCapxul, m as redactTelemetryEvent, t as assembleCapxulClient, v as accountReadErrorFromCapxul, x as identityErrorFromCapxul, y as wireChainId } from "../create-capxul-client-B050H6SY.mjs";
+import { B as Errors, C as toDurationMs, D as toJwtToken, E as toEpochSeconds, F as toSessionToken, N as toPublishableKey, O as toKycTier, R as CapxulError, T as toEpochMs, _ as toAppId, b as toChainId, g as toAllowedOrigin, h as toAddress, m as toAccountId, t as InMemoryAuthCacheAdapter, v as toAuthUserId, w as toEmail, x as toCountryCode } from "../InMemoryAuthCacheAdapter-uOcqpqu8.mjs";
 import { keccak256 } from "viem";
 import { Effect, Result, Semaphore } from "effect";
 import { getFunctionName } from "convex/server";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@capxul/sdk",
-  "version": "2.4.0",
+  "version": "2.5.1",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/Xelmar-tech/infrastructure.git",
@@ -46,12 +46,12 @@
     "typescript": "npm:@typescript/typescript6@6.0.2",
     "vite-plus": "0.1.23",
     "vitest": "npm:@voidzero-dev/vite-plus-test@0.1.23",
-    "@capxul/config": "0.2.0",
-    "@capxul/errors": "0.0.1",
+    "@capxul/config": "0.2.1",
+    "@capxul/errors": "0.0.2",
     "@capxul/typescript-config": "0.0.0",
-    "@capxul/wire": "0.5.0",
-    "@capxul/observability": "2.4.0",
-    "@capxul/types": "0.2.0"
+    "@capxul/types": "0.2.1",
+    "@capxul/wire": "0.5.1",
+    "@capxul/observability": "2.5.1"
   },
   "_permissionlessPinReason": "permissionless.toSafeSmartAccount is pinned to 0.3.4 for live Safe deployment E2E. Counterfactual address fixtures captured 2026-05-17 in packages/backend/convex/_shared/__tests__/counterfactual.test.ts and packages/config/tests/safe.test.ts must be re-verified before upgrading.",
   "scripts": {