@capxul/sdk 2.8.2 → 3.0.2

package/dist/{InMemoryAuthCacheAdapter-BrEN-men.mjs → clock-m_aHLaNm.mjs}

@@ -1,4 +1,41 @@
-import { Context, Data, Effect, Layer } from "effect";
+import { concat, encodeAbiParameters, encodeFunctionData, encodePacked, getContractAddress, keccak256, padHex, stringToHex, toBytes, toEventSelector, toFunctionSelector, toFunctionSignature } from "viem";
+import { Context, Data, Effect, Layer, Result } from "effect";
+//#region ../errors/src/secret-material.ts
+const SENSITIVE_MATERIAL_PATTERNS = [
+	/(?:^|[^a-fA-F0-9])(?<!0[xX])[a-fA-F0-9]{64}(?:$|[^a-fA-F0-9])/u,
+	/eyJ[A-Za-z0-9_-]*\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+/u,
+	/(?:(?:sk|pk|rk)_(?:live|test)|(?:phc|phx|ghp|gho|ghu|ghs|ghr|whsec)_|github_pat_|xox[baprs]-|AKIA[0-9A-Z]{16}|AIza)[A-Za-z0-9_-]*/iu,
+	/\bBearer\s+[^\s,;]+/iu,
+	/https?:\/\/[^\s"']+?\/v[0-9]\/[A-Za-z0-9_-]{16,}/iu,
+	/\b(?:api[ _-]?key|access[ _-]?token|token|secret|password|passphrase|private[ _-]?key|authorization|cookie|signature|request[ _-]?body|credential|otp|one[ _-]?time[ _-]?(?:password|code)|verification[ _-]?code)\b\s*[:=]\s*(?:"[^"]*"|'[^']*'|[^\s,;&]+)/iu
+];
+const MASKS = [
+	[/\bBearer\s+[^\s,;]+/giu, "Bearer [REDACTED]"],
+	[/\beyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\b/gu, "[REDACTED]"],
+	[/(^|[^a-fA-F0-9])(?<!0[xX])[a-fA-F0-9]{64}(?=$|[^a-fA-F0-9])/gu, "$1[REDACTED]"],
+	[/(?:(?:sk|pk|rk)_(?:live|test)|(?:phc|phx|ghp|gho|ghu|ghs|ghr|whsec)_|github_pat_|xox[baprs]-|AKIA[0-9A-Z]{16}|AIza)[A-Za-z0-9_-]*/giu, "[REDACTED]"],
+	[/(https?:\/\/[^\s"']+?\/v[0-9]\/)[A-Za-z0-9_-]{16,}/giu, "$1[REDACTED]"],
+	[/\b(api[ _-]?key|access[ _-]?token|token|secret|password|passphrase|private[ _-]?key|authorization|cookie|signature|request[ _-]?body|credential|otp|one[ _-]?time[ _-]?(?:password|code)|verification[ _-]?code)\b\s*[:=]\s*(?:"[^"]*"|'[^']*'|[^\s,;&]+)/giu, "$1=[REDACTED]"]
+];
+/**
+* Reject: does the value carry any known secret material? Best effort — callers
+* drop the whole value on a match; a false negative is a leak, a false positive
+* merely omits an observation field.
+*/
+function containsSensitiveMaterial(value) {
+	return SENSITIVE_MATERIAL_PATTERNS.some((pattern) => pattern.test(value));
+}
+/**
+* Mask: return the value with every known secret rewritten to `[REDACTED]`,
+* preserving surrounding text. Used where a value must still be shown (log
+* lines, provider messages, PostHog rows) but must not carry live credentials.
+*/
+function redactSecrets(value) {
+	let text = value;
+	for (const [pattern, replacement] of MASKS) text = text.replace(pattern, replacement);
+	return text;
+}
+//#endregion
 //#region ../errors/src/chain-cause.ts
 /**
 * Why an operation failed — the one flat vocabulary. The first four are the
@@ -21,6 +58,9 @@ const FAILURE_MODES = [
 	"insufficient-allowance",
 	"rejected",
 	"unauthorized",
+	"forbidden",
+	"bad-request",
+	"method-unsupported",
 	"unknown"
 ];
 function isFailureMode(value) {
@@ -37,6 +77,33 @@ const CHAIN_UPSTREAMS = [
 function isChainUpstream(value) {
 	return typeof value === "string" && CHAIN_UPSTREAMS.includes(value);
 }
+/**
+* The response headers that name a refusal or let provider support find the
+* request. Nothing else crosses: a header can carry a session or a key.
+*/
+const RESPONSE_HEADER_ALLOWLIST = [
+	"retry-after",
+	"www-authenticate",
+	"content-type",
+	"x-request-id",
+	"cf-ray",
+	"x-ratelimit-remaining",
+	"x-ratelimit-reset",
+	"server"
+];
+const RESPONSE_HEADER_VALUE_MAX = 128;
+/**
+* The allow-listed headers of one answer, masked and bounded. `read` is
+* `Headers.get` or a lookup into a decoded record. Empty when none is present.
+*/
+function boundedResponseHeaders(read) {
+	const headers = {};
+	for (const name of RESPONSE_HEADER_ALLOWLIST) {
+		const value = read(name);
+		if (typeof value === "string" && value.length > 0) headers[name] = boundedEvidence(value, RESPONSE_HEADER_VALUE_MAX);
+	}
+	return headers;
+}
 const PROVIDER_MESSAGE_MAX = 300;
 const METHOD_MAX = 64;
 const REVERT_NAME_MAX = 64;
@@ -44,19 +111,9 @@ const REVERT_ARG_KEY_MAX = 32;
 const REVERT_ARG_VALUE_MAX = 128;
 const REVERT_ARGS_MAX = 8;
 const SELECTOR_RE = /^0x(?:[0-9a-fA-F]{8})?$/u;
-const MASKS = [
-	[/\bBearer\s+[^\s,;]+/giu, "Bearer [REDACTED]"],
-	[/\beyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\b/gu, "[REDACTED]"],
-	[/\b0x[a-fA-F0-9]{40,}\b/gu, "[REDACTED]"],
-	[/(^|[^a-fA-F0-9])[a-fA-F0-9]{64}(?=$|[^a-fA-F0-9])/gu, "$1[REDACTED]"],
-	[/(?:(?:sk|pk|rk)_(?:live|test)|(?:phc|phx|ghp|gho|ghu|ghs|ghr|whsec)_|github_pat_|xox[baprs]-|AKIA[0-9A-Z]{16}|AIza)[A-Za-z0-9_-]*/giu, "[REDACTED]"],
-	[/(https?:\/\/[^\s"']+?\/v[0-9]\/)[A-Za-z0-9_-]{16,}/giu, "$1[REDACTED]"],
-	[/\b(api[ _-]?key|access[ _-]?token|token|secret|password|passphrase|private[ _-]?key|authorization|cookie|signature|credential|otp)\b\s*[:=]\s*(?:"[^"]*"|'[^']*'|[^\s,;&]+)/giu, "$1=[REDACTED]"]
-];
 /** Mask credential-shaped content, then cap the length. Total on any string. */
 function boundedEvidence(value, max) {
-	let text = value;
-	for (const [pattern, replacement] of MASKS) text = text.replace(pattern, replacement);
+	const text = redactSecrets(value);
 	return text.length <= max ? text : text.slice(0, max);
 }
 function isRecord(value) {
@@ -98,8 +155,36 @@ function decodeChainCause(value) {
 	const revert = decodeRevert(value.revert);
 	if (revert !== null) cause.revert = revert;
 	if (typeof value.providerMessage === "string") cause.providerMessage = boundedEvidence(value.providerMessage, PROVIDER_MESSAGE_MAX);
+	const attempts = decodeAttempts(value.attempts);
+	if (attempts !== null) cause.attempts = attempts;
+	if (isRecord(value.responseHeaders)) {
+		const raw = value.responseHeaders;
+		const headers = boundedResponseHeaders((name) => {
+			const header = raw[name];
+			return typeof header === "string" ? header : null;
+		});
+		if (Object.keys(headers).length > 0) cause.responseHeaders = headers;
+	}
 	return cause;
 }
+/** The attempt sequence, bounded. A malformed entry drops the sequence, never the cause. */
+function decodeAttempts(value) {
+	if (!Array.isArray(value)) return null;
+	const attempts = [];
+	for (const entry of value.slice(0, 5)) {
+		if (!isRecord(entry) || !isChainUpstream(entry.upstream) || !isFailureMode(entry.mode)) return null;
+		const duration = entry.durationMs;
+		if (typeof duration !== "number" || !Number.isFinite(duration) || duration < 0) return null;
+		attempts.push({
+			upstream: entry.upstream,
+			mode: entry.mode,
+			...typeof entry.httpStatus === "number" && Number.isInteger(entry.httpStatus) ? { httpStatus: entry.httpStatus } : {},
+			...typeof entry.rpcCode === "number" && Number.isInteger(entry.rpcCode) ? { rpcCode: entry.rpcCode } : {},
+			durationMs: Math.round(duration)
+		});
+	}
+	return attempts.length === 0 ? null : attempts;
+}
 /**
 * The cause as flat PostHog properties. Same keys from every producer, so one
 * filter (`failure_mode = 'rate-limited'`) finds the gateway's, the backend's,
@@ -118,7 +203,15 @@ function chainCauseProperties(chain) {
 			chain_revert_selector: chain.revert.selector,
 			chain_revert_args: chain.revert.args
 		},
-		...chain.providerMessage === void 0 ? {} : { chain_provider_message: chain.providerMessage }
+		...chain.providerMessage === void 0 ? {} : { chain_provider_message: chain.providerMessage },
+		...chain.attempts === void 0 ? {} : { chain_attempts: chain.attempts.map((attempt) => ({
+			upstream: attempt.upstream,
+			failure_mode: attempt.mode,
+			...attempt.httpStatus === void 0 ? {} : { http_status: attempt.httpStatus },
+			...attempt.rpcCode === void 0 ? {} : { rpc_code: attempt.rpcCode },
+			duration_ms: attempt.durationMs
+		})) },
+		...chain.responseHeaders === void 0 ? {} : { chain_response_headers: chain.responseHeaders }
 	};
 }
 /**
@@ -174,6 +267,18 @@ function revertSummaryText(revert) {
 	return `${revert.name}(${args})`;
 }
 /**
+* The evidence behind the one word, for an issue name: ` (HTTP 403)` or
+* ` (JSON-RPC -32000)`. Empty when the cause carries neither. The status
+* names the provider's front door and the code names the node's verdict;
+* `forbidden` alone made an operator open the issue to learn it was a 403.
+*/
+function chainEvidenceLabel(chain) {
+	if (chain === void 0) return "";
+	if (chain.httpStatus !== void 0 && chain.httpStatus !== 200) return ` (HTTP ${String(chain.httpStatus)})`;
+	if (chain.rpcCode !== void 0) return ` (JSON-RPC ${String(chain.rpcCode)})`;
+	return "";
+}
+/**
 * The error-tracking fingerprint for a failure: the code, the one-word cause,
 * and the operation. PostHog groups `$exception` rows by this value, so one
 * issue is one cause at one operation instead of every provider failure in
@@ -652,6 +757,978 @@ function invalidValueReason(prefix, raw) {
 	return `${prefix}: ${String(raw)}`;
 }
 //#endregion
+//#region ../config/src/tokens.ts
+/** `TestUSDC` ("USDX") — Base Sepolia, 6 decimals, open `mint`. (Canon §1.) */
+const USDX_ADDRESS_BASE_SEPOLIA = "0xf09fcbb6df9f8f918e58f9c8ab15a76ade862b77";
+USDX_ADDRESS_BASE_SEPOLIA.toLowerCase();
+//#endregion
+//#region ../config/src/org-payments.ts
+/** Zodiac MultiSendCallOnly module on Base Sepolia. */
+const MULTI_SEND_CALL_ONLY = "0x9641d764fc13c8b624c04430c7356c1c7c8102e2";
+//#endregion
+//#region ../config/src/safe.ts
+const BASE_SEPOLIA_CHAIN_ID = 84532;
+const SAFE_PROXY_FACTORY = "0x4e1DCf7AD4e460CfD30791CCC4F9c8a4f820ec67";
+const SAFE_L2_SINGLETON = "0x29fcB43b46531BcA003ddC8FCB67FFE91900C762";
+const SAFE_MODULE_SETUP = "0x2dd68b007B46fBe91B9A7c3EDa5A7a1063cB5b47";
+const SAFE_4337_MODULE = "0x75cf11467937ce3F2f357CE24ffc3DBF8fD5c226";
+const MULTI_SEND = "0x38869bf66a61cF6bDB996A6aE40D5853Fd43B526";
+/**
+* The Capxul bootstrap owner — the sole `setup()` owner of every unclaimed
+* personal Safe under derivation v2. This address is part of the CREATE2
+* preimage of EVERY personal Safe address: treat it exactly like
+* `SAFE_PROXY_FACTORY` (changing it is a derivation-version event → v3).
+* The private key lives backend-only (`CAPXUL_BOOTSTRAP_OWNER_PRIVATE_KEY`)
+* and signs exactly one kind of operation: the claim userOp that deploys the
+* Safe and swaps this owner out for the user's signer (PRD #462). The earlier
+* ClaimGuard derivation-v3 placeholder (#461) is closed; future mainnet-scale
+* hardening should be filed against the current payments/claim architecture.
+*/
+const CAPXUL_BOOTSTRAP_OWNER = "0x425fca96f4a3e18fb80974e38096b5da460f2704";
+const SAFE_PROXY_CREATION_CODE = "0x608060405234801561001057600080fd5b506040516101e63803806101e68339818101604052602081101561003357600080fd5b8101908080519060200190929190505050600073ffffffffffffffffffffffffffffffffffffffff168173ffffffffffffffffffffffffffffffffffffffff1614156100ca576040517f08c379a00000000000000000000000000000000000000000000000000000000081526004018080602001828103825260228152602001806101c46022913960400191505060405180910390fd5b806000806101000a81548173ffffffffffffffffffffffffffffffffffffffff021916908373ffffffffffffffffffffffffffffffffffffffff1602179055505060ab806101196000396000f3fe608060405273ffffffffffffffffffffffffffffffffffffffff600054167fa619486e0000000000000000000000000000000000000000000000000000000060003514156050578060005260206000f35b3660008037600080366000845af43d6000803e60008114156070573d6000fd5b3d6000f3fea264697066735822122003d1488ee65e08fa41e58e888a9865554c535f2c77126a82cb4c0f917f31441364736f6c63430007060033496e76616c69642073696e676c65746f6e20616464726573732070726f7669646564";
+/**
+* Normalize an email for use as a Capxul Safe salt input.
+*
+* Trims surrounding whitespace and lowercases the address so that
+* `"  User+Demo@Example.COM  "` and `"user+demo@example.com"` derive
+* the same `safeAddress`. This is the canonical normalization rule —
+* any future change here would shift every existing user's Safe
+* address, so the rule is pinned by the fixture matrix in
+* `packages/config/tests/safe-address-conformance.test.ts`.
+*
+* @param email - The raw email address to normalize
+* @returns The trimmed, lowercased email
+*/
+function normalizeSafeSaltEmail(email) {
+	return email.trim().toLowerCase();
+}
+/**
+* Compute the deterministic Safe salt nonce for a `(namespace, email)`
+* pair. The salt nonce is the `bigint` reading of
+* `keccak256(namespace + ":" + normalizeSafeSaltEmail(email))`.
+*
+* Namespace defaults to `CAPXUL_SAFE_SALT_NAMESPACE`
+* (`"capxul:staging:email:v1"`) — the current Capxul scheme. Pass a
+* different namespace only for pinned pre-v2 artifacts
+* (`CAPXUL_SAFE_SALT_NAMESPACE_V1`, faucet Safe) or when bumping the scheme.
+*
+* @param input.email - The email to derive the salt nonce from
+* @param input.namespace - Optional namespace override (defaults to `CAPXUL_SAFE_SALT_NAMESPACE`)
+* @returns The Capxul-namespaced salt nonce as a `bigint`
+*/
+function computeCapxulSafeSaltNonce(input) {
+	const namespace = input.namespace ?? "capxul:staging:email:v1";
+	const normalizedEmail = normalizeSafeSaltEmail(input.email);
+	return BigInt(keccak256(toBytes(`${namespace}:${normalizedEmail}`)));
+}
+const ZERO_ADDRESS = "0x0000000000000000000000000000000000000000";
+const safeSetupAbi = [{
+	type: "function",
+	name: "setup",
+	stateMutability: "nonpayable",
+	inputs: [
+		{
+			name: "_owners",
+			type: "address[]"
+		},
+		{
+			name: "_threshold",
+			type: "uint256"
+		},
+		{
+			name: "to",
+			type: "address"
+		},
+		{
+			name: "data",
+			type: "bytes"
+		},
+		{
+			name: "fallbackHandler",
+			type: "address"
+		},
+		{
+			name: "paymentToken",
+			type: "address"
+		},
+		{
+			name: "payment",
+			type: "uint256"
+		},
+		{
+			name: "paymentReceiver",
+			type: "address"
+		}
+	],
+	outputs: []
+}];
+const enableModulesAbi = [{
+	type: "function",
+	name: "enableModules",
+	stateMutability: "nonpayable",
+	inputs: [{
+		name: "modules",
+		type: "address[]"
+	}],
+	outputs: []
+}];
+const multiSendAbi = [{
+	type: "function",
+	name: "multiSend",
+	stateMutability: "payable",
+	inputs: [{
+		name: "transactions",
+		type: "bytes"
+	}],
+	outputs: []
+}];
+function buildCapxulSafeInitializer(owner) {
+	const enableModulesCall = encodeFunctionData({
+		abi: enableModulesAbi,
+		functionName: "enableModules",
+		args: [[SAFE_4337_MODULE]]
+	});
+	const enableModulesByteLen = BigInt((enableModulesCall.length - 2) / 2);
+	const multiSendPayload = encodePacked([
+		"uint8",
+		"address",
+		"uint256",
+		"uint256",
+		"bytes"
+	], [
+		1,
+		SAFE_MODULE_SETUP,
+		0n,
+		enableModulesByteLen,
+		enableModulesCall
+	]);
+	const setupData = encodeFunctionData({
+		abi: multiSendAbi,
+		functionName: "multiSend",
+		args: [multiSendPayload]
+	});
+	return encodeFunctionData({
+		abi: safeSetupAbi,
+		functionName: "setup",
+		args: [
+			[owner],
+			1n,
+			MULTI_SEND,
+			setupData,
+			SAFE_4337_MODULE,
+			ZERO_ADDRESS,
+			0n,
+			ZERO_ADDRESS
+		]
+	});
+}
+const ADDRESS_REGEX = /^0x[0-9a-fA-F]{40}$/;
+function validateAndNormalizeAddress(field, value) {
+	const address = value.toLowerCase();
+	if (!ADDRESS_REGEX.test(address)) throw Errors.invalidInput(field, `must be 0x + 40 hex chars, got ${value}`);
+	return address;
+}
+/**
+* Pure derivation of the Capxul personal Safe address — **v2: email only**
+* (PRD #462). The Safe v1.4.1 (SafeL2) + 4337-module initializer's sole owner
+* is the fixed `CAPXUL_BOOTSTRAP_OWNER`, so the address is a pure function of
+* the (normalized) email and exists before any user signer does. The user's
+* signer is installed at claim time via `swapOwner` — signer rotation can
+* never move the address (org-domain rule D7, now system-wide).
+*
+* Returns the lowercased `0x` + 40 hex string (raw — no brand applied so this
+* function is callable from both `@capxul/config` consumers that don't have
+* `@capxul/types` available, and from packages that re-brand at their own
+* boundary).
+*
+* Algorithm: exactly mirrors `permissionless.toSafeSmartAccount({ version:
+* "1.4.1", safeSingletonAddress: SAFE_L2_SINGLETON, owners: [BOOTSTRAP] })`
+* + the Capxul-canonical module setup (delegatecall into
+* `SafeModuleSetup.enableModules([SAFE_4337_MODULE])` via the MultiSend lane
+* during proxy setup). The proxy creation code is pinned at
+* `SAFE_PROXY_CREATION_CODE`; the salt is Capxul-namespaced (v2) via
+* `computeCapxulSafeSaltNonce({ email })`.
+*
+* Canonical: SDK deployment adapters and
+* `packages/backend/convex/smartAccount/mutations.ts:provision` import this
+* function; the conformance test at
+* `packages/config/tests/safe-address-conformance.test.ts` pins the matrix.
+*/
+function deriveCapxulSafeAddress(input) {
+	return deriveCapxulSafeAddressForOwner({
+		ownerAddress: CAPXUL_BOOTSTRAP_OWNER,
+		email: input.email
+	});
+}
+/**
+* Owner-parametrized derivation core. Two callers only:
+* 1. `deriveCapxulSafeAddress` (canonical v2: owner = bootstrap, namespace v2);
+* 2. the backend faucet Safe (`testUsdcMint.ts`: owner = deployer EOA,
+*    namespace pinned to `CAPXUL_SAFE_SALT_NAMESPACE_V1` so its deployed
+*    address never moves).
+* Do NOT introduce new owner-parametrized lanes — per-user owners in the
+* derivation is exactly the v1 mistake v2 removes.
+*/
+function deriveCapxulSafeAddressForOwner(input) {
+	const initializer = buildCapxulSafeInitializer(validateAndNormalizeAddress("ownerAddress", input.ownerAddress));
+	const saltNonce = computeCapxulSafeSaltNonce(input.namespace === void 0 ? { email: input.email } : {
+		email: input.email,
+		namespace: input.namespace
+	});
+	const salt = keccak256(encodePacked(["bytes32", "uint256"], [keccak256(initializer), saltNonce]));
+	const deploymentCode = concat([SAFE_PROXY_CREATION_CODE, encodeAbiParameters([{ type: "uint256" }], [BigInt(SAFE_L2_SINGLETON)])]);
+	return getContractAddress({
+		opcode: "CREATE2",
+		from: SAFE_PROXY_FACTORY,
+		salt,
+		bytecodeHash: keccak256(deploymentCode)
+	}).toLowerCase();
+}
+/**
+* Normalize a raw email for binding id + Safe salt derivation.
+* Delegates to {@link normalizeSafeSaltEmail} so binding resolution and
+* `deriveCapxulSafeAddress` never drift apart.
+*/
+function normalizeBindingEmail(email) {
+	return normalizeSafeSaltEmail(email);
+}
+//#endregion
+//#region ../config/src/capxul-payments-v2.ts
+/** The exact compiled CapxulPaymentsV2 ABI. */
+const CAPXUL_PAYMENTS_V2_ABI = [
+	{
+		type: "function",
+		name: "cancel",
+		inputs: [{
+			name: "commitmentId",
+			type: "uint256",
+			internalType: "uint256"
+		}, {
+			name: "documentHash",
+			type: "bytes32",
+			internalType: "bytes32"
+		}],
+		outputs: [],
+		stateMutability: "nonpayable"
+	},
+	{
+		type: "function",
+		name: "claim",
+		inputs: [{
+			name: "commitmentId",
+			type: "uint256",
+			internalType: "uint256"
+		}],
+		outputs: [],
+		stateMutability: "nonpayable"
+	},
+	{
+		type: "function",
+		name: "claimableAmount",
+		inputs: [{
+			name: "commitmentId",
+			type: "uint256",
+			internalType: "uint256"
+		}],
+		outputs: [{
+			name: "",
+			type: "uint256",
+			internalType: "uint256"
+		}],
+		stateMutability: "view"
+	},
+	{
+		type: "function",
+		name: "commitments",
+		inputs: [{
+			name: "",
+			type: "uint256",
+			internalType: "uint256"
+		}],
+		outputs: [
+			{
+				name: "settlementId",
+				type: "bytes32",
+				internalType: "bytes32"
+			},
+			{
+				name: "creator",
+				type: "address",
+				internalType: "address"
+			},
+			{
+				name: "recipient",
+				type: "address",
+				internalType: "address"
+			},
+			{
+				name: "token",
+				type: "address",
+				internalType: "address"
+			},
+			{
+				name: "totalAmount",
+				type: "uint256",
+				internalType: "uint256"
+			},
+			{
+				name: "claimed",
+				type: "uint256",
+				internalType: "uint256"
+			},
+			{
+				name: "startTime",
+				type: "uint48",
+				internalType: "uint48"
+			},
+			{
+				name: "cliffTime",
+				type: "uint48",
+				internalType: "uint48"
+			},
+			{
+				name: "endTime",
+				type: "uint48",
+				internalType: "uint48"
+			},
+			{
+				name: "kind",
+				type: "uint16",
+				internalType: "uint16"
+			},
+			{
+				name: "documentHash",
+				type: "bytes32",
+				internalType: "bytes32"
+			},
+			{
+				name: "cancelled",
+				type: "bool",
+				internalType: "bool"
+			}
+		],
+		stateMutability: "view"
+	},
+	{
+		type: "function",
+		name: "createCommitment",
+		inputs: [{
+			name: "input",
+			type: "tuple",
+			internalType: "struct CapxulPaymentsV2.CommitmentInput",
+			components: [
+				{
+					name: "settlementId",
+					type: "bytes32",
+					internalType: "bytes32"
+				},
+				{
+					name: "recipient",
+					type: "address",
+					internalType: "address"
+				},
+				{
+					name: "token",
+					type: "address",
+					internalType: "address"
+				},
+				{
+					name: "totalAmount",
+					type: "uint256",
+					internalType: "uint256"
+				},
+				{
+					name: "startTime",
+					type: "uint48",
+					internalType: "uint48"
+				},
+				{
+					name: "cliffTime",
+					type: "uint48",
+					internalType: "uint48"
+				},
+				{
+					name: "endTime",
+					type: "uint48",
+					internalType: "uint48"
+				},
+				{
+					name: "kind",
+					type: "uint16",
+					internalType: "uint16"
+				},
+				{
+					name: "documentHash",
+					type: "bytes32",
+					internalType: "bytes32"
+				}
+			]
+		}],
+		outputs: [{
+			name: "commitmentId",
+			type: "uint256",
+			internalType: "uint256"
+		}],
+		stateMutability: "nonpayable"
+	},
+	{
+		type: "function",
+		name: "nextCommitmentId",
+		inputs: [],
+		outputs: [{
+			name: "",
+			type: "uint256",
+			internalType: "uint256"
+		}],
+		stateMutability: "view"
+	},
+	{
+		type: "function",
+		name: "redirect",
+		inputs: [
+			{
+				name: "commitmentId",
+				type: "uint256",
+				internalType: "uint256"
+			},
+			{
+				name: "recipient",
+				type: "address",
+				internalType: "address"
+			},
+			{
+				name: "documentHash",
+				type: "bytes32",
+				internalType: "bytes32"
+			}
+		],
+		outputs: [],
+		stateMutability: "nonpayable"
+	},
+	{
+		type: "function",
+		name: "send",
+		inputs: [{
+			name: "item",
+			type: "tuple",
+			internalType: "struct CapxulPaymentsV2.PaymentItem",
+			components: [
+				{
+					name: "settlementId",
+					type: "bytes32",
+					internalType: "bytes32"
+				},
+				{
+					name: "recipient",
+					type: "address",
+					internalType: "address"
+				},
+				{
+					name: "token",
+					type: "address",
+					internalType: "address"
+				},
+				{
+					name: "amount",
+					type: "uint256",
+					internalType: "uint256"
+				},
+				{
+					name: "kind",
+					type: "uint16",
+					internalType: "uint16"
+				},
+				{
+					name: "documentHash",
+					type: "bytes32",
+					internalType: "bytes32"
+				}
+			]
+		}],
+		outputs: [],
+		stateMutability: "nonpayable"
+	},
+	{
+		type: "function",
+		name: "sendBatch",
+		inputs: [{
+			name: "items",
+			type: "tuple[]",
+			internalType: "struct CapxulPaymentsV2.PaymentItem[]",
+			components: [
+				{
+					name: "settlementId",
+					type: "bytes32",
+					internalType: "bytes32"
+				},
+				{
+					name: "recipient",
+					type: "address",
+					internalType: "address"
+				},
+				{
+					name: "token",
+					type: "address",
+					internalType: "address"
+				},
+				{
+					name: "amount",
+					type: "uint256",
+					internalType: "uint256"
+				},
+				{
+					name: "kind",
+					type: "uint16",
+					internalType: "uint16"
+				},
+				{
+					name: "documentHash",
+					type: "bytes32",
+					internalType: "bytes32"
+				}
+			]
+		}],
+		outputs: [],
+		stateMutability: "nonpayable"
+	},
+	{
+		type: "function",
+		name: "vestedAmount",
+		inputs: [{
+			name: "commitmentId",
+			type: "uint256",
+			internalType: "uint256"
+		}],
+		outputs: [{
+			name: "",
+			type: "uint256",
+			internalType: "uint256"
+		}],
+		stateMutability: "view"
+	},
+	{
+		type: "event",
+		name: "CommitmentCancelled",
+		inputs: [
+			{
+				name: "commitmentId",
+				type: "uint256",
+				indexed: true,
+				internalType: "uint256"
+			},
+			{
+				name: "settlementId",
+				type: "bytes32",
+				indexed: true,
+				internalType: "bytes32"
+			},
+			{
+				name: "creator",
+				type: "address",
+				indexed: true,
+				internalType: "address"
+			},
+			{
+				name: "vestedUnclaimed",
+				type: "uint256",
+				indexed: false,
+				internalType: "uint256"
+			},
+			{
+				name: "unvestedReturned",
+				type: "uint256",
+				indexed: false,
+				internalType: "uint256"
+			},
+			{
+				name: "documentHash",
+				type: "bytes32",
+				indexed: false,
+				internalType: "bytes32"
+			}
+		],
+		anonymous: false
+	},
+	{
+		type: "event",
+		name: "CommitmentCreated",
+		inputs: [
+			{
+				name: "commitmentId",
+				type: "uint256",
+				indexed: true,
+				internalType: "uint256"
+			},
+			{
+				name: "settlementId",
+				type: "bytes32",
+				indexed: true,
+				internalType: "bytes32"
+			},
+			{
+				name: "creator",
+				type: "address",
+				indexed: true,
+				internalType: "address"
+			},
+			{
+				name: "recipient",
+				type: "address",
+				indexed: false,
+				internalType: "address"
+			},
+			{
+				name: "token",
+				type: "address",
+				indexed: false,
+				internalType: "address"
+			},
+			{
+				name: "totalAmount",
+				type: "uint256",
+				indexed: false,
+				internalType: "uint256"
+			},
+			{
+				name: "startTime",
+				type: "uint48",
+				indexed: false,
+				internalType: "uint48"
+			},
+			{
+				name: "cliffTime",
+				type: "uint48",
+				indexed: false,
+				internalType: "uint48"
+			},
+			{
+				name: "endTime",
+				type: "uint48",
+				indexed: false,
+				internalType: "uint48"
+			},
+			{
+				name: "kind",
+				type: "uint16",
+				indexed: false,
+				internalType: "uint16"
+			},
+			{
+				name: "documentHash",
+				type: "bytes32",
+				indexed: false,
+				internalType: "bytes32"
+			}
+		],
+		anonymous: false
+	},
+	{
+		type: "event",
+		name: "CommitmentRedirected",
+		inputs: [
+			{
+				name: "commitmentId",
+				type: "uint256",
+				indexed: true,
+				internalType: "uint256"
+			},
+			{
+				name: "settlementId",
+				type: "bytes32",
+				indexed: true,
+				internalType: "bytes32"
+			},
+			{
+				name: "oldRecipient",
+				type: "address",
+				indexed: true,
+				internalType: "address"
+			},
+			{
+				name: "newRecipient",
+				type: "address",
+				indexed: false,
+				internalType: "address"
+			},
+			{
+				name: "documentHash",
+				type: "bytes32",
+				indexed: false,
+				internalType: "bytes32"
+			}
+		],
+		anonymous: false
+	},
+	{
+		type: "event",
+		name: "FundsClaimed",
+		inputs: [
+			{
+				name: "commitmentId",
+				type: "uint256",
+				indexed: true,
+				internalType: "uint256"
+			},
+			{
+				name: "settlementId",
+				type: "bytes32",
+				indexed: true,
+				internalType: "bytes32"
+			},
+			{
+				name: "recipient",
+				type: "address",
+				indexed: true,
+				internalType: "address"
+			},
+			{
+				name: "amount",
+				type: "uint256",
+				indexed: false,
+				internalType: "uint256"
+			},
+			{
+				name: "documentHash",
+				type: "bytes32",
+				indexed: false,
+				internalType: "bytes32"
+			}
+		],
+		anonymous: false
+	},
+	{
+		type: "event",
+		name: "PaymentSent",
+		inputs: [
+			{
+				name: "settlementId",
+				type: "bytes32",
+				indexed: true,
+				internalType: "bytes32"
+			},
+			{
+				name: "sender",
+				type: "address",
+				indexed: true,
+				internalType: "address"
+			},
+			{
+				name: "recipient",
+				type: "address",
+				indexed: true,
+				internalType: "address"
+			},
+			{
+				name: "token",
+				type: "address",
+				indexed: false,
+				internalType: "address"
+			},
+			{
+				name: "amount",
+				type: "uint256",
+				indexed: false,
+				internalType: "uint256"
+			},
+			{
+				name: "kind",
+				type: "uint16",
+				indexed: false,
+				internalType: "uint16"
+			},
+			{
+				name: "documentHash",
+				type: "bytes32",
+				indexed: false,
+				internalType: "bytes32"
+			}
+		],
+		anonymous: false
+	},
+	{
+		type: "error",
+		name: "AlreadyCancelled",
+		inputs: []
+	},
+	{
+		type: "error",
+		name: "AlreadyClaimed",
+		inputs: []
+	},
+	{
+		type: "error",
+		name: "DocumentHashMismatch",
+		inputs: [{
+			name: "expected",
+			type: "bytes32",
+			internalType: "bytes32"
+		}, {
+			name: "supplied",
+			type: "bytes32",
+			internalType: "bytes32"
+		}]
+	},
+	{
+		type: "error",
+		name: "InvalidTimeParams",
+		inputs: []
+	},
+	{
+		type: "error",
+		name: "NotCreator",
+		inputs: []
+	},
+	{
+		type: "error",
+		name: "NotRecipient",
+		inputs: []
+	},
+	{
+		type: "error",
+		name: "NothingToClaim",
+		inputs: []
+	},
+	{
+		type: "error",
+		name: "SettlementIdConsumed",
+		inputs: [{
+			name: "settlementId",
+			type: "bytes32",
+			internalType: "bytes32"
+		}]
+	},
+	{
+		type: "error",
+		name: "TokenCallReturnedFalse",
+		inputs: [{
+			name: "token",
+			type: "address",
+			internalType: "address"
+		}]
+	},
+	{
+		type: "error",
+		name: "TokenHasNoCode",
+		inputs: [{
+			name: "token",
+			type: "address",
+			internalType: "address"
+		}]
+	},
+	{
+		type: "error",
+		name: "ZeroAddress",
+		inputs: []
+	},
+	{
+		type: "error",
+		name: "ZeroAmount",
+		inputs: []
+	},
+	{
+		type: "error",
+		name: "ZeroDocumentHash",
+		inputs: []
+	},
+	{
+		type: "error",
+		name: "ZeroSettlementId",
+		inputs: []
+	}
+];
+/** Immutable CapxulPaymentsV2 deployment on Base Sepolia. */
+const CAPXUL_PAYMENTS_V2_ADDRESS = "0x7a5c25aB7ce91d7a475B71cd1ec33E230291f8a4";
+//#endregion
+//#region ../config/src/route.ts
+/** USDX on Base Sepolia — the only settlement token in v1. */
+const USDX_BASE_SEPOLIA_TOKEN = {
+	chainId: BASE_SEPOLIA_CHAIN_ID,
+	address: USDX_ADDRESS_BASE_SEPOLIA,
+	decimals: 6
+};
+USDX_BASE_SEPOLIA_TOKEN.chainId;
+USDX_BASE_SEPOLIA_TOKEN.chainId;
+10n ** BigInt(6);
+function normalizeOrgRoleLabel(label) {
+	const normalized = label.trim().replace(/\s+/g, " ");
+	if (normalized.length === 0) throw Errors.invalidInput("role.label", "must be a non-empty role label");
+	return normalized;
+}
+function orgRoleKeyForLabel(label) {
+	return keccak256(toBytes(normalizeOrgRoleLabel(label).toLowerCase()));
+}
+padHex(stringToHex("FM_DAILY"), {
+	size: 32,
+	dir: "right"
+}), padHex(stringToHex("TL_DAILY"), {
+	size: 32,
+	dir: "right"
+});
+padHex(concat([MULTI_SEND_CALL_ONLY, "0x8d80ff0a"]), {
+	dir: "right",
+	size: 32
+});
+function paymentsV2Signature(name) {
+	const item = CAPXUL_PAYMENTS_V2_ABI.find((candidate) => candidate.type === "function" && candidate.name === name);
+	if (item === void 0) throw new Error(`CapxulPaymentsV2 ABI has no ${name} function`);
+	return toFunctionSignature(item);
+}
+paymentsV2Signature("send");
+paymentsV2Signature("sendBatch");
+paymentsV2Signature("createCommitment");
+paymentsV2Signature("cancel");
+paymentsV2Signature("redirect");
+new Map([
+	["assignRoles(address,bytes32[],bool[])", "AssignRoles(address,bytes32[],bool[])"],
+	["allowTarget(bytes32,address,uint8)", "AllowTarget(bytes32,address,uint8)"],
+	["scopeTarget(bytes32,address)", "ScopeTarget(bytes32,address)"],
+	["revokeTarget(bytes32,address)", "RevokeTarget(bytes32,address)"],
+	["allowFunction(bytes32,address,bytes4,uint8)", "AllowFunction(bytes32,address,bytes4,uint8)"],
+	["scopeFunction(bytes32,address,bytes4,(uint8,uint8,uint8,bytes)[],uint8)", "ScopeFunction(bytes32,address,bytes4,(uint8,uint8,uint8,bytes)[],uint8)"],
+	["revokeFunction(bytes32,address,bytes4)", "RevokeFunction(bytes32,address,bytes4)"],
+	["setAllowance(bytes32,uint128,uint128,uint128,uint64,uint64)", "SetAllowance(bytes32,uint128,uint128,uint128,uint64,uint64)"]
+].map(([functionSignature, eventSignature]) => [toFunctionSelector(functionSignature), toEventSelector(eventSignature)]));
+//#endregion
+//#region src/ports/auth-client.ts
+var AuthClientError = class extends Data.TaggedError("AuthClientError") {};
+var AuthClientPortTag = class extends Context.Service()("@capxul/sdk/ports/AuthClientPort") {};
+//#endregion
+//#region src/adapters/auth-client/effect-port.ts
+function authClientPortFromPromiseAdapter(adapter) {
+	return {
+		canSendOtp: (input, options) => fromResult("canSendOtp", () => adapter.canSendOtp(input, options)),
+		sendOtp: (input, options) => fromResult("sendOtp", () => adapter.sendOtp(input, options)),
+		verifyOtp: (input, options) => fromResult("verifyOtp", () => adapter.verifyOtp(input, options)),
+		getSession: (options) => fromResult("getSession", () => adapter.getSession(options)),
+		signOut: (options) => fromResult("signOut", () => adapter.signOut(options)),
+		getConvexJwt: (options) => fromResult("getConvexJwt", () => adapter.getConvexJwt(options))
+	};
+}
+function fromResult(operation, run) {
+	return Effect.tryPromise({
+		try: run,
+		catch: (cause) => new AuthClientError({
+			operation,
+			kind: "thrown",
+			cause
+		})
+	}).pipe(Effect.flatMap((result) => result.ok ? Effect.succeed(result.value) : Effect.fail(new AuthClientError({
+		operation,
+		kind: errorKind(result.error),
+		cause: result.error
+	}))));
+}
+function errorKind(error) {
+	if (error.code === "CANCELLED") return "cancelled";
+	if (error.code === "NETWORK_ERROR") return "network";
+	if (error.code === "INVALID_INPUT" || error.code === "OTP_EXPIRED") return "validation";
+	return "provider";
+}
+//#endregion
+//#region src/ports/clock.ts
+var ClockError = class extends Data.TaggedError("ClockError") {};
+var ClockPortTag = class extends Context.Service()("@capxul/sdk/ports/ClockPort") {};
+//#endregion
 //#region src/ports/auth-cache.ts
 var AuthCacheError = class extends Data.TaggedError("AuthCacheError") {};
 var AuthCachePortTag = class extends Context.Service()("@capxul/sdk/ports/AuthCachePort") {};
@@ -760,4 +1837,24 @@ Layer.effect(AuthCachePortTag, Effect.sync(() => new InMemoryAuthCacheAdapter())
 	cause
 }))));
 //#endregion
-export { toPartyId as A, Errors as B, toDurationMs as C, toJwtToken as D, toEpochSeconds as E, toSessionToken as F, decodeChainCause as G, CHAIN_UPSTREAMS as H, decodeConvexError as I, revertSummaryText as J, failureFingerprint as K, CAPXUL_ERROR_CODES as L, toPayrollRunId as M, toPublishableKey as N, toKycTier as O, toRoleKey as P, CapxulError as R, toCurrencyCode as S, toEpochMs as T, FAILURE_MODES as U, isCapxulError as V, chainCauseProperties as W, toAppId as _, AuthCacheError as a, toChainId as b, BYTES32_RE as c, WEI_RE as d, ZERO_BYTES32 as f, toAllowedOrigin as g, toAddress as h, parseCachedJwt as i, toPayrollGroupId as j, toOrgId as k, EVM_ADDRESS_RE as l, toAccountId as m, BrowserAuthCacheAdapter as n, AuthCachePortTag as o, currencySymbolFor as p, isFailureMode as q, parseAuthSession as r, APP_ID_RE as s, InMemoryAuthCacheAdapter as t, SUPPORTED_CURRENCY_CODES as u, toAuthUserId as v, toEmail as w, toCountryCode as x, toBudgetId as y, EXPECTED_OPERATION_OUTCOMES as z };
+//#region src/adapters/_shared/clock.ts
+async function readClockNow(clock) {
+	try {
+		const result = await Effect.runPromise(Effect.result(clock.now));
+		if (Result.isFailure(result)) return {
+			ok: false,
+			error: Errors.providerError("clock", "now", result.failure)
+		};
+		return {
+			ok: true,
+			value: result.success
+		};
+	} catch (cause) {
+		return {
+			ok: false,
+			error: Errors.providerError("clock", "now", cause)
+		};
+	}
+}
+//#endregion
+export { CHAIN_UPSTREAMS as $, toBudgetId as A, toOrgId as B, ZERO_BYTES32 as C, toAllowedOrigin as D, toAddress as E, toEmail as F, toRoleKey as G, toPayrollGroupId as H, toEpochMs as I, CAPXUL_ERROR_CODES as J, toSessionToken as K, toEpochSeconds as L, toCountryCode as M, toCurrencyCode as N, toAppId as O, toDurationMs as P, isCapxulError as Q, toJwtToken as R, WEI_RE as S, toAccountId as T, toPayrollRunId as U, toPartyId as V, toPublishableKey as W, EXPECTED_OPERATION_OUTCOMES as X, CapxulError as Y, Errors as Z, deriveCapxulSafeAddress as _, parseCachedJwt as a, failureFingerprint as at, EVM_ADDRESS_RE as b, ClockError as c, revertSummaryText as ct, AuthClientError as d, FAILURE_MODES as et, AuthClientPortTag as f, BASE_SEPOLIA_CHAIN_ID as g, normalizeBindingEmail as h, parseAuthSession as i, decodeChainCause as it, toChainId as j, toAuthUserId as k, ClockPortTag as l, containsSensitiveMaterial as lt, CAPXUL_PAYMENTS_V2_ADDRESS as m, InMemoryAuthCacheAdapter as n, chainCauseProperties as nt, AuthCacheError as o, isChainUpstream as ot, orgRoleKeyForLabel as p, decodeConvexError as q, BrowserAuthCacheAdapter as r, chainEvidenceLabel as rt, AuthCachePortTag as s, isFailureMode as st, readClockNow as t, boundedResponseHeaders as tt, authClientPortFromPromiseAdapter as u, redactSecrets as ut, APP_ID_RE as v, currencySymbolFor as w, SUPPORTED_CURRENCY_CODES as x, BYTES32_RE as y, toKycTier as z };