@capxul/sdk 4.1.4 → 4.2.0

package/dist/{OAuthBearerAuthClient-BHvDR8_0.mjs → OAuthBearerAuthClient-ByPzJZr8.mjs}

@@ -1,4 +1,4 @@
-import { A as toAuthUserId, B as toJwtToken, I as toEmail, J as toSessionToken, L as toEpochMs, R as toEpochSeconds, c as ClockError, l as ClockPortTag, t as readClockNow, tt as Errors, u as authClientPortFromPromiseAdapter } from "./clock-C2AUlq1V.mjs";
+import { A as toAuthUserId, B as toJwtToken, I as toEmail, J as toSessionToken, L as toEpochMs, R as toEpochSeconds, c as ClockError, l as ClockPortTag, t as readClockNow, tt as Errors, u as authClientPortFromPromiseAdapter } from "./clock-DIfTX44d.mjs";
 import { Effect, Layer } from "effect";
 //#region src/adapters/clock/SystemClockAdapter.ts
 var SystemClockAdapter = class {

package/dist/{clock-C2AUlq1V.mjs → clock-DIfTX44d.mjs}

@@ -1,39 +1,275 @@
 import { Context, Data, Effect, Layer, Result } from "effect";
 import { concat, encodeAbiParameters, encodeFunctionData, encodePacked, getContractAddress, keccak256, padHex, stringToHex, toBytes, toEventSelector, toFunctionSelector, toFunctionSignature } from "viem";
 //#region ../errors/src/secret-material.ts
-const SENSITIVE_MATERIAL_PATTERNS = [
-	/(?:^|[^a-fA-F0-9])(?<!0[xX])[a-fA-F0-9]{64}(?:$|[^a-fA-F0-9])/u,
-	/eyJ[A-Za-z0-9_-]*\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+/u,
-	/(?:(?:sk|pk|rk)_(?:live|test)|(?:phc|phx|ghp|gho|ghu|ghs|ghr|whsec)_|github_pat_|xox[baprs]-|AKIA[0-9A-Z]{16}|AIza)[A-Za-z0-9_-]*/iu,
-	/\bBearer\s+[^\s,;]+/iu,
-	/https?:\/\/[^\s"']+?\/v[0-9]\/[A-Za-z0-9_-]{16,}/iu,
-	/\b(?:api[ _-]?key|access[ _-]?token|token|secret|password|passphrase|private[ _-]?key|authorization|cookie|signature|request[ _-]?body|credential|otp|one[ _-]?time[ _-]?(?:password|code)|verification[ _-]?code)\b\s*[:=]\s*(?:"[^"]*"|'[^']*'|[^\s,;&]+)/iu
-];
-const MASKS = [
-	[/\bBearer\s+[^\s,;]+/giu, "Bearer [REDACTED]"],
+const CREDENTIAL_FIELDS = /* @__PURE__ */ new Set([
+	"password",
+	"passwd",
+	"pwd",
+	"pass",
+	"passphrase",
+	"currentpassword",
+	"newpassword",
+	"confirmpassword",
+	"passwordconfirmation",
+	"passwordhash",
+	"hashedpassword",
+	"pin",
+	"privatekey",
+	"walletprivatekey",
+	"secretkey",
+	"signingkey",
+	"signingsecret",
+	"seed",
+	"seedphrase",
+	"mnemonic",
+	"recoveryphrase",
+	"recovery",
+	"recoverycode",
+	"recoverycodes",
+	"keyshare",
+	"signingmaterial",
+	"recoverymaterial",
+	"privatekeybytes",
+	"signingprivatekey",
+	"encryptionkey",
+	"decryptionkey",
+	"authtoken",
+	"apitoken",
+	"bearertoken",
+	"oauthtoken",
+	"csrftoken",
+	"clientassertion",
+	"token",
+	"accesstoken",
+	"refreshtoken",
+	"idtoken",
+	"sessiontoken",
+	"session",
+	"sessionkey",
+	"sessionsecret",
+	"authsessionid",
+	"sessioncredential",
+	"sessioncredentials",
+	"sessioncookie",
+	"auth",
+	"authentication",
+	"authorization",
+	"proxyauthorization",
+	"cookie",
+	"cookies",
+	"setcookie",
+	"apikey",
+	"xapikey",
+	"xauthtoken",
+	"clientsecret",
+	"secret",
+	"secrets",
+	"credential",
+	"credentials",
+	"signature",
+	"otp",
+	"otpcode",
+	"totpsecret",
+	"onetimecode",
+	"onetimepassword",
+	"verificationcode",
+	"authcode",
+	"authorizationcode",
+	"oauthcode",
+	"codeverifier"
+]);
+/** Match credential fields by meaning, without hiding token addresses or replay IDs. */
+function isCredentialField(name, context) {
+	const normalized = name.toLowerCase().replace(/[^a-z0-9]/gu, "");
+	return CREDENTIAL_FIELDS.has(normalized) || /(?:password(?:hash)?|passwd|passphrase|privatekey|signingkey|apikey|clientsecret|accesstoken|refreshtoken|sessiontoken)$/u.test(normalized) || context === "authentication" && (normalized === "code" || normalized === "sessionid") || context === "header" && /(?:token|secret|apikey|privatekey|signingkey|password|authorization|cookie|session)$/u.test(normalized);
+}
+function decodeUrlComponent(text) {
+	try {
+		return decodeURIComponent(text);
+	} catch {
+		return text;
+	}
+}
+/** Preserve URL diagnostics while removing credentials from their declared components. */
+function redactUrlSecrets(value, source) {
+	try {
+		const absolute = /^[a-z][a-z0-9+.-]*:/iu.test(value);
+		const protocolRelative = value.startsWith("//");
+		const url = new URL(value, "https://redaction.invalid");
+		if (url.protocol !== "https:" && url.protocol !== "http:") return maskText(value);
+		let changed = url.username.length > 0 || url.password.length > 0;
+		const maskParams = (params) => new URLSearchParams(Array.from(params, ([name, entry]) => {
+			const safeName = maskText(name);
+			const safeEntry = isCredentialField(name) || /^(?:code|draft|__posthog)$/iu.test(name) ? "[REDACTED]" : maskText(entry);
+			changed ||= safeName !== name || safeEntry !== entry;
+			return [safeName, safeEntry];
+		})).toString();
+		const provider = source !== void 0 || /(?:^|\.)(?:alchemy\.com|alchemyapi\.io|infura\.io)$/iu.test(url.hostname);
+		const segments = (absolute || protocolRelative ? url.pathname : value.split(/[?#]/u)[0] ?? "").split("/");
+		const path = segments.map((segment, index) => {
+			const decoded = decodeUrlComponent(segment);
+			const masked = provider && /^v[23]$/u.test(decodeUrlComponent(segments[index - 1] ?? "")) && decoded.length > 0 ? "[REDACTED]" : maskText(decoded);
+			changed ||= masked !== decoded;
+			return masked === decoded ? segment : encodeURIComponent(masked);
+		}).join("/");
+		const query = maskParams(url.searchParams);
+		const fragment = url.hash.slice(1);
+		const decodedFragment = decodeUrlComponent(fragment);
+		const maskedFragment = maskText(decodedFragment);
+		changed ||= maskedFragment !== decodedFragment;
+		const fragmentQuery = fragment.indexOf("?");
+		const fragmentPath = fragment.slice(0, fragmentQuery);
+		const maskedFragmentPath = maskText(decodeUrlComponent(fragmentPath));
+		changed ||= maskedFragmentPath !== decodeUrlComponent(fragmentPath);
+		const hash = fragmentQuery >= 0 ? `${maskedFragmentPath === decodeUrlComponent(fragmentPath) ? fragmentPath : encodeURIComponent(maskedFragmentPath)}?${maskParams(new URLSearchParams(fragment.slice(fragmentQuery + 1)))}` : fragment.includes("=") ? maskParams(new URLSearchParams(fragment)) : maskedFragment === decodedFragment ? fragment : encodeURIComponent(maskedFragment);
+		const origin = absolute ? url.origin : protocolRelative ? `//${url.host}` : "";
+		if (!changed) return value;
+		return `${origin}${path}${query ? `?${query}` : ""}${hash ? `#${hash}` : ""}`;
+	} catch {
+		return maskText(value.replace(/(https?:\/\/)[^/\s@]+@/giu, "$1[REDACTED]@").replace(/([?&#])([^=&#]+)=([^&#]*)/gu, (whole, separator, name) => isCredentialField(decodeUrlComponent(name)) || /^(?:code|draft|__posthog)$/iu.test(decodeUrlComponent(name)) ? `${separator}${name}=[REDACTED]` : whole));
+	}
+}
+const JSON_FIELD = /("(?:[^"\\]|\\.)*")(\s*:\s*)("(?:[^"\\]|\\.)*"|-?\d+(?:\.\d+)?(?:[eE][+-]?\d+)?|true|false|null)/gu;
+const PROSE_FIELD = /(?=(\b([A-Za-z][A-Za-z0-9_-]*(?:[ \t]+[A-Za-z][A-Za-z0-9_-]*){0,3})\s*[:=]\s*((?:Bearer|Basic)[ \t]+[^\s,;"']+|"(?:[^"\\]|\\.)*"|'(?:[^'\\]|\\.)*'|[^\s,;&"']+)))/gu;
+const EMBEDDED_URL = /(https?:\/\/[^\s"<>]*)/giu;
+function isSecretLabel(name) {
+	return isCredentialField(name) || /^request[ _-]?body$/iu.test(name);
+}
+const JSON_ENCODING_MAX = 8;
+const JSON_NESTING_MAX = 64;
+const JSON_KEY = /("(?:[^"\\]|\\.)*")\s*:/gu;
+const JSON_CONTAINER_START = /(?:\{\s*["}]|\[\s*[[\]{}"0-9tfn-])/uy;
+function hasSecretJsonKey(value) {
+	for (const match of value.matchAll(JSON_KEY)) try {
+		if (match[1] !== void 0 && isSecretLabel(JSON.parse(match[1]))) return true;
+	} catch {}
+	return false;
+}
+/** Project a complete fragment once. Never retry all of its nested substrings. */
+function projectJsonFragment(value, encodingDepth, overDepth) {
+	if (overDepth || encodingDepth >= JSON_ENCODING_MAX) return "[REDACTED]";
+	let parsed;
+	try {
+		parsed = JSON.parse(value);
+	} catch {
+		return hasSecretJsonKey(value) ? "[REDACTED]" : value;
+	}
+	try {
+		let changed = false;
+		const masked = JSON.stringify(parsed, (name, nested) => {
+			if (isSecretLabel(name)) {
+				changed ||= nested !== "[REDACTED]";
+				return "[REDACTED]";
+			}
+			if (typeof nested === "string") {
+				const projected = maskJsonFragments(nested, encodingDepth + 1);
+				changed ||= projected !== nested;
+				return projected;
+			}
+			return nested;
+		});
+		return changed ? masked : value;
+	} catch {
+		return "[REDACTED]";
+	}
+}
+/** Scan balanced object/array fragments once, respecting JSON quotes and escapes. */
+function maskJsonFragments(value, encodingDepth = 0) {
+	if (value.trimStart().startsWith("\"")) try {
+		const decoded = JSON.parse(value);
+		if (typeof decoded === "string") {
+			if (encodingDepth >= JSON_ENCODING_MAX) return "\"[REDACTED]\"";
+			const masked = maskJsonFragments(decoded, encodingDepth + 1);
+			return masked === decoded ? value : JSON.stringify(masked);
+		}
+	} catch {}
+	let output = "";
+	let cursor = 0;
+	let start = -1;
+	let depth = 0;
+	let overDepth = false;
+	let quoted = false;
+	let escaped = false;
+	for (let index = 0; index < value.length; index++) {
+		const character = value[index];
+		if (start < 0) {
+			JSON_CONTAINER_START.lastIndex = index;
+			if (!JSON_CONTAINER_START.test(value)) continue;
+			start = index;
+			depth = 1;
+			overDepth = false;
+			continue;
+		}
+		if (quoted) {
+			if (escaped) escaped = false;
+			else if (character === "\\") escaped = true;
+			else if (character === "\"") quoted = false;
+			continue;
+		}
+		if (character === "\"") quoted = true;
+		else if (character === "{" || character === "[") {
+			depth++;
+			overDepth ||= depth > JSON_NESTING_MAX;
+		} else if (character === "}" || character === "]") {
+			depth--;
+			if (depth !== 0) continue;
+			output += value.slice(cursor, start) + projectJsonFragment(value.slice(start, index + 1), encodingDepth, overDepth);
+			cursor = index + 1;
+			start = -1;
+		}
+	}
+	if (start >= 0) {
+		const fragment = value.slice(start);
+		output += value.slice(cursor, start) + (overDepth || hasSecretJsonKey(fragment) ? "[REDACTED]" : fragment);
+		cursor = value.length;
+	}
+	return output + value.slice(cursor);
+}
+function maskLabelledText(value) {
+	const jsonMasked = maskJsonFragments(value).replace(JSON_FIELD, (whole, quotedName, separator) => {
+		try {
+			return isSecretLabel(JSON.parse(quotedName)) ? `${quotedName}${separator}"[REDACTED]"` : whole;
+		} catch {
+			return whole;
+		}
+	});
+	let output = "";
+	let cursor = 0;
+	for (const match of jsonMasked.matchAll(PROSE_FIELD)) {
+		const [, whole, label, entry] = match;
+		if (whole === void 0 || label === void 0 || entry === void 0 || match.index < cursor || /^Bearer[ \t]+/iu.test(entry)) continue;
+		const words = label.split(/[ \t]+/u);
+		for (let index = 0; index < words.length; index++) {
+			const name = words.slice(index).join(" ");
+			if (isSecretLabel(name)) {
+				const prefix = words.slice(0, index).join(" ");
+				output += jsonMasked.slice(cursor, match.index) + `${prefix ? `${prefix} ` : ""}${name}=[REDACTED]`;
+				cursor = match.index + whole.length;
+				break;
+			}
+		}
+	}
+	return output + jsonMasked.slice(cursor);
+}
+const TOKEN_MASKS = [
+	[/\bBearer\s+(?!(?:realm|error|error_description|scope|authorization_uri|resource|claims)\s*=)[^\s,;"']+/giu, "Bearer [REDACTED]"],
 	[/\beyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\b/gu, "[REDACTED]"],
 	[/(^|[^a-fA-F0-9])(?<!0[xX])[a-fA-F0-9]{64}(?=$|[^a-fA-F0-9])/gu, "$1[REDACTED]"],
-	[/(?:(?:sk|pk|rk)_(?:live|test)|(?:phc|phx|ghp|gho|ghu|ghs|ghr|whsec)_|github_pat_|xox[baprs]-|AKIA[0-9A-Z]{16}|AIza)[A-Za-z0-9_-]*/giu, "[REDACTED]"],
-	[/(https?:\/\/[^\s"']+?\/v[0-9]\/)[A-Za-z0-9_-]{16,}/giu, "$1[REDACTED]"],
-	[/\b(api[ _-]?key|access[ _-]?token|token|secret|password|passphrase|private[ _-]?key|authorization|cookie|signature|request[ _-]?body|credential|otp|one[ _-]?time[ _-]?(?:password|code)|verification[ _-]?code)\b\s*[:=]\s*(?:"[^"]*"|'[^']*'|[^\s,;&]+)/giu, "$1=[REDACTED]"]
+	[/(?:(?:sk|pk|rk)_(?:live|test)|(?:phc|phx|ghp|gho|ghu|ghs|ghr|whsec)_|github_pat_|xox[baprs]-|AKIA[0-9A-Z]{16}|AIza)[A-Za-z0-9_-]*/giu, "[REDACTED]"]
 ];
-/**
-* Reject: does the value carry any known secret material? Best effort — callers
-* drop the whole value on a match; a false negative is a leak, a false positive
-* merely omits an observation field.
-*/
+/** URL components and malformed URLs use this non-recursive masking layer. */
+function maskText(value) {
+	let text = maskLabelledText(value);
+	for (const [pattern, replacement] of TOKEN_MASKS) text = text.replace(pattern, replacement);
+	return text;
+}
+/** Reject only when the same semantic sanitizer removes credential material. */
 function containsSensitiveMaterial(value) {
-	return SENSITIVE_MATERIAL_PATTERNS.some((pattern) => pattern.test(value));
+	return redactSecrets(value) !== value;
 }
-/**
-* Mask: return the value with every known secret rewritten to `[REDACTED]`,
-* preserving surrounding text. Used where a value must still be shown (log
-* lines, provider messages, PostHog rows) but must not carry live credentials.
-*/
-function redactSecrets(value) {
-	let text = value;
-	for (const [pattern, replacement] of MASKS) text = text.replace(pattern, replacement);
-	return text;
+/** Mask credential fields and embedded URLs while preserving surrounding evidence. */
+function redactSecrets(value, source) {
+	return maskLabelledText(value).split(EMBEDDED_URL).map((part, index) => index % 2 === 1 ? redactUrlSecrets(part, source).replaceAll("%5BREDACTED%5D", "[REDACTED]") : maskText(part)).join("");
 }
 //#endregion
 //#region ../errors/src/chain-cause.ts
@@ -1890,4 +2126,4 @@ async function readClockNow(clock) {
 	}
 }
 //#endregion
-export { CapxulError as $, toAuthUserId as A, toJwtToken as B, WEI_RE as C, toAddress as D, toAccountId as E, toDurationMs as F, toPayrollRunId as G, toOrgId as H, toEmail as I, toSessionToken as J, toPublishableKey as K, toEpochMs as L, toChainId as M, toCountryCode as N, toAllowedOrigin as O, toCurrencyCode as P, CAPXUL_ERROR_CODES as Q, toEpochSeconds as R, SUPPORTED_CURRENCY_CODES as S, currencySymbolFor as T, toPartyId as U, toKycTier as V, toPayrollGroupId as W, HANDLE_RE as X, toTesterKind as Y, decodeConvexError as Z, deriveCapxulSafeAddress as _, parseCachedJwt as a, boundedResponseHeaders as at, BYTES32_RE as b, ClockError as c, decodeChainCause as ct, AuthClientError as d, isFailureMode as dt, EXPECTED_OPERATION_OUTCOMES as et, AuthClientPortTag as f, revertSummaryText as ft, BASE_SEPOLIA_CHAIN_ID as g, normalizeBindingEmail as h, parseAuthSession as i, FAILURE_MODES as it, toBudgetId as j, toAppId as k, ClockPortTag as l, failureFingerprint as lt, CAPXUL_PAYMENTS_V2_ADDRESS as m, redactSecrets as mt, InMemoryAuthCacheAdapter as n, isCapxulError as nt, AuthCacheError as o, chainCauseProperties as ot, orgRoleKeyForLabel as p, containsSensitiveMaterial as pt, toRoleKey as q, BrowserAuthCacheAdapter as r, CHAIN_UPSTREAMS as rt, AuthCachePortTag as s, chainEvidenceLabel as st, readClockNow as t, Errors as tt, authClientPortFromPromiseAdapter as u, isChainUpstream as ut, validateHandle as v, ZERO_BYTES32 as w, EVM_ADDRESS_RE as x, APP_ID_RE as y, toHandle as z };
+export { CapxulError as $, toAuthUserId as A, toJwtToken as B, WEI_RE as C, toAddress as D, toAccountId as E, toDurationMs as F, toPayrollRunId as G, toOrgId as H, toEmail as I, toSessionToken as J, toPublishableKey as K, toEpochMs as L, toChainId as M, toCountryCode as N, toAllowedOrigin as O, toCurrencyCode as P, CAPXUL_ERROR_CODES as Q, toEpochSeconds as R, SUPPORTED_CURRENCY_CODES as S, currencySymbolFor as T, toPartyId as U, toKycTier as V, toPayrollGroupId as W, HANDLE_RE as X, toTesterKind as Y, decodeConvexError as Z, deriveCapxulSafeAddress as _, parseCachedJwt as a, boundedResponseHeaders as at, BYTES32_RE as b, ClockError as c, decodeChainCause as ct, AuthClientError as d, isFailureMode as dt, EXPECTED_OPERATION_OUTCOMES as et, AuthClientPortTag as f, revertSummaryText as ft, BASE_SEPOLIA_CHAIN_ID as g, redactUrlSecrets as gt, normalizeBindingEmail as h, redactSecrets as ht, parseAuthSession as i, FAILURE_MODES as it, toBudgetId as j, toAppId as k, ClockPortTag as l, failureFingerprint as lt, CAPXUL_PAYMENTS_V2_ADDRESS as m, isCredentialField as mt, InMemoryAuthCacheAdapter as n, isCapxulError as nt, AuthCacheError as o, chainCauseProperties as ot, orgRoleKeyForLabel as p, containsSensitiveMaterial as pt, toRoleKey as q, BrowserAuthCacheAdapter as r, CHAIN_UPSTREAMS as rt, AuthCachePortTag as s, chainEvidenceLabel as st, readClockNow as t, Errors as tt, authClientPortFromPromiseAdapter as u, isChainUpstream as ut, validateHandle as v, ZERO_BYTES32 as w, EVM_ADDRESS_RE as x, APP_ID_RE as y, toHandle as z };

package/dist/{create-capxul-client-B3ET402J.mjs → create-capxul-client-B6PUjdld.mjs}

@@ -1,4 +1,4 @@
-import { $ as CapxulError, A as toAuthUserId, C as WEI_RE, D as toAddress, E as toAccountId, G as toPayrollRunId, H as toOrgId, I as toEmail, M as toChainId, N as toCountryCode, P as toCurrencyCode, Q as CAPXUL_ERROR_CODES, S as SUPPORTED_CURRENCY_CODES, U as toPartyId, W as toPayrollGroupId, _ as deriveCapxulSafeAddress, at as boundedResponseHeaders, b as BYTES32_RE, ct as decodeChainCause, dt as isFailureMode, et as EXPECTED_OPERATION_OUTCOMES, ft as revertSummaryText, it as FAILURE_MODES$1, j as toBudgetId, lt as failureFingerprint, mt as redactSecrets, n as InMemoryAuthCacheAdapter, nt as isCapxulError, ot as chainCauseProperties, p as orgRoleKeyForLabel, pt as containsSensitiveMaterial, q as toRoleKey, r as BrowserAuthCacheAdapter, rt as CHAIN_UPSTREAMS, st as chainEvidenceLabel, tt as Errors, ut as isChainUpstream, v as validateHandle, w as ZERO_BYTES32, x as EVM_ADDRESS_RE$1, y as APP_ID_RE } from "./clock-C2AUlq1V.mjs";
+import { $ as CapxulError, A as toAuthUserId, C as WEI_RE, D as toAddress, E as toAccountId, G as toPayrollRunId, H as toOrgId, I as toEmail, M as toChainId, N as toCountryCode, P as toCurrencyCode, Q as CAPXUL_ERROR_CODES, S as SUPPORTED_CURRENCY_CODES, U as toPartyId, W as toPayrollGroupId, _ as deriveCapxulSafeAddress, at as boundedResponseHeaders, b as BYTES32_RE, ct as decodeChainCause, dt as isFailureMode, et as EXPECTED_OPERATION_OUTCOMES, ft as revertSummaryText, ht as redactSecrets, it as FAILURE_MODES$1, j as toBudgetId, lt as failureFingerprint, mt as isCredentialField, n as InMemoryAuthCacheAdapter, nt as isCapxulError, ot as chainCauseProperties, p as orgRoleKeyForLabel, pt as containsSensitiveMaterial, q as toRoleKey, r as BrowserAuthCacheAdapter, rt as CHAIN_UPSTREAMS, st as chainEvidenceLabel, tt as Errors, ut as isChainUpstream, v as validateHandle, w as ZERO_BYTES32, x as EVM_ADDRESS_RE$1, y as APP_ID_RE } from "./clock-DIfTX44d.mjs";
 import { Cause, Clock, Context, Data, Deferred, Duration, Effect, Exit, Fiber, Layer, Queue, Ref, Result, Schema, SchemaGetter, SchemaParser, Scope } from "effect";
 import { formatUnits, keccak256, parseUnits, recoverAddress, toBytes } from "viem";
 import { makeFunctionReference } from "convex/server";
@@ -5228,7 +5228,7 @@ const moneyExecutionContract = {
 };
 //#endregion
 //#region package.json
-var version = "4.1.4";
+var version = "4.2.0";
 //#endregion
 //#region src/telemetry/exception-projection.ts
 /** Fixed fallback for failures that have no safe message. */
@@ -5591,8 +5591,6 @@ function evidenceText(value) {
 	if (typeof value !== "string" || value.length === 0) return void 0;
 	return redactSecrets(value).slice(0, MAX_EVIDENCE_TEXT);
 }
-/** A field whose NAME says credential is masked whatever its value looks like. */
-const CREDENTIAL_FIELD_NAME = /(?:otp|pass(?:word|wd|phrase)?|token|secret|credential|api[_-]?key|private[_-]?key|authorization|cookie|session)/iu;
 /** Copy a details object into a JSON-safe shape with every string masked. */
 function evidenceValue(value, depth = 0) {
 	if (typeof value === "string") return evidenceText(value);
@@ -5603,7 +5601,7 @@ function evidenceValue(value, depth = 0) {
 	if (Array.isArray(value)) return value.slice(0, 50).map((item) => evidenceValue(item, depth + 1));
 	const copy = {};
 	for (const [key, nested] of Object.entries(value)) {
-		if (CREDENTIAL_FIELD_NAME.test(key)) {
+		if (isCredentialField(key)) {
 			copy[key] = "[REDACTED]";
 			continue;
 		}
@@ -7073,6 +7071,12 @@ function convexCallErrorFromCapxul(operation, error, transport) {
 var ConvexCallPortTag = class extends Context.Service()("@capxul/sdk/ports/ConvexCallPort") {};
 //#endregion
 //#region src/ports/identity.ts
+/** The chain families a payout address may name (#1955). */
+const PAYOUT_CHAINS = [
+	"evm",
+	"solana",
+	"starknet"
+];
 var IdentityError = class extends Data.TaggedError("IdentityError") {};
 function identityErrorFromCapxul(operation, error, cause = error) {
 	return new IdentityError({
@@ -8075,8 +8079,52 @@ const loadIdentityProgram = Effect.gen(function* () {
 	if (authUserId === void 0) return null;
 	return yield* deps.identityPort.loadByAuthUserId(authUserId).pipe(Effect.catchDefect((cause) => Effect.fail(identityErrorFromCapxul("loadByAuthUserId", cause instanceof CapxulError ? cause : Errors.unknown(cause), cause))), Effect.mapError((failure) => failure.publicError));
 });
-//#endregion
-//#region src/surface/identity.ts
+/**
+* THE ONE boundary grammar for those optional fields. Both `completeProfile`
+* entry points — the method bundle here and the identity runtime in
+* `create-capxul-client.ts` — run it, so a malformed value is refused the same
+* way at each and never reaches the port.
+*/
+function checkProfileCarriage(profile) {
+	const carriage = {};
+	if (profile.imageStorageId !== void 0) {
+		if (typeof profile.imageStorageId !== "string" || profile.imageStorageId.trim().length === 0) return {
+			ok: false,
+			field: "imageStorageId",
+			message: "must be a non-empty storage id"
+		};
+		carriage.imageStorageId = profile.imageStorageId.trim();
+	}
+	if (profile.payoutAddresses !== void 0) {
+		if (!Array.isArray(profile.payoutAddresses)) return {
+			ok: false,
+			field: "payoutAddresses",
+			message: "must be an array"
+		};
+		if (profile.payoutAddresses.length > 10) return {
+			ok: false,
+			field: "payoutAddresses",
+			message: `must carry at most 10 addresses`
+		};
+		const entries = [];
+		for (const entry of profile.payoutAddresses) {
+			if (typeof entry !== "object" || entry === null || !PAYOUT_CHAINS.some((chain) => chain === entry.chain) || typeof entry.address !== "string" || entry.address.trim().length === 0) return {
+				ok: false,
+				field: "payoutAddresses",
+				message: `each entry needs a chain of ${PAYOUT_CHAINS.join(", ")} and an address`
+			};
+			entries.push({
+				chain: entry.chain,
+				address: entry.address.trim()
+			});
+		}
+		carriage.payoutAddresses = entries;
+	}
+	return {
+		ok: true,
+		carriage
+	};
+}
 function makeIdentityMethods(deps) {
 	const convexCall = deps.convexCall;
 	return {
@@ -8115,6 +8163,11 @@ function makeIdentityMethods(deps) {
 					error: Errors.invalidInput("country", "unsupported country")
 				};
 			}
+			const carried = checkProfileCarriage(profile);
+			if (!carried.ok) return {
+				ok: false,
+				error: Errors.invalidInput(carried.field, carried.message)
+			};
 			const session = deps.actor?.authSession();
 			if (session === void 0 || session === null) return {
 				ok: false,
@@ -8125,7 +8178,8 @@ function makeIdentityMethods(deps) {
 				email: session.email,
 				displayName,
 				country,
-				handle
+				handle,
+				...carried.carriage
 			}), options, CAPXUL_OPERATIONS.identity.completeProfile);
 		},
 		async handleAvailable(handle, options) {
@@ -10111,6 +10165,11 @@ function assembleCapxulClient(input) {
 				ok: false,
 				reason: "INVALID_INPUT"
 			};
+			const carried = checkProfileCarriage(profile);
+			if (!carried.ok) return {
+				ok: false,
+				reason: "INVALID_INPUT"
+			};
 			const session = actor.authSession();
 			if (session === null) return {
 				ok: false,
@@ -10121,7 +10180,8 @@ function assembleCapxulClient(input) {
 				email: session.email,
 				displayName,
 				country,
-				handle
+				handle,
+				...carried.carriage
 			}), controls, CAPXUL_OPERATIONS.identity.completeProfile, effectRunner.runPromise);
 			return result.ok ? { ok: true } : {
 				ok: false,

package/dist/index.d.mts

@@ -1,5 +1,5 @@
 import { B as EVM_ADDRESS_RE, Ct as RevertSummary, E as Address, G as OrgId, I as CountryCode, J as PayrollGroupId, K as PartyId, M as AuthUserId, P as BudgetId, St as FailureMode, T as AccountId, U as Handle, W as Money, Y as PayrollRunId, _t as isCapxulError, a as SignerStatusStore, bt as ChainUpstream, c as AccountProviderSource, ct as toHandle, d as eip1193AccountProvider, dt as CAPXUL_ERROR_CODES, et as RoleKey, f as localPrivateKeyAccountProvider, ft as CapxulError, g as SmartAccount, h as Session, ht as Errors, i as SignerStatus, j as AuthSession, l as AccountRequirement, lt as toPartyId, m as Profile, mt as CapxulErrorDetails, n as CapxulSigner, o as injectedWalletSigner, ot as toAddress, p as CapxulResult, pt as CapxulErrorCode, r as Eip1193RequestProvider, rt as TesterKind, s as AccountProvider, st as toCountryCode, t as CapxulDigestSigner, u as Eip1193Provider, ut as CAPXUL_PAYMENTS_V2_ADDRESS, vt as CHAIN_UPSTREAMS, w as Account, xt as FAILURE_MODES, yt as ChainCause } from "./signer-C0hZ6Kiy.mjs";
-import { $ as OrganizationPaymentItemInput, $t as DestinationKind, A as OrgView, An as TargetReference, At as AddressBookLabelInput, B as PayrollGroup, Bn as OrgLifecycle, Bt as ActivityKind, C as DetectPendingOrgInvitationsResult, Cn as PaymentTiming, Ct as ActorProfileMethods, D as OrgMethods, Dn as RecipientResolution, Dt as ActorRequestsMethods, E as MemberView, En as PaymentsPayInput, Et as ActorRequestIssueInput, F as RoleSpendCap, Fn as isSettingUpLifecycle, Ft as ActivityAnnotation, G as PayrollOptions, Gn as SubmittedPermissionExecution, Gt as ActivityReference, H as PayrollGroupMember, Hn as ActorRef, Ht as ActivityMethods, I as RoleView, In as CompleteProfileInput, It as ActivityAnnotationInput, J as PayrollRunStatus, Jn as PAYMENT_STATUSES, Jt as ActivitySummaryTotal, K as PayrollRun, Kn as InboxStatus, Kt as ActivitySummary, L as AuthorizeRunInput, Ln as IdentityMethods, Lt as ActivityDetail, M as OrganizationAuditLogItem, Mn as fingerprintPaymentIntent, Mt as InboxApproveInput, N as ResendInviteTokenInput, Nn as AccountLifecycle, Nt as InboxItem, O as OrgScopedMethods, On as Ref, Ot as AddressBookAddInput, P as RoleDefinition, Pn as AccountSetupStep, Pt as InboxMethods, Q as OrganizationPaymentInput, Qt as DestinationAddInput, R as AuthorizeRunOptions, Rn as SmartAccountMethods, Rt as ActivityFilter, S as CreateOrgInput, Sn as PaymentStatus, St as ActorProfile, T as MemberStatus, Tn as PaymentsMethods, Tt as ActorRequest, U as PayrollGroupsMethods, Un as CurrentHoldings, Ut as ActivityPage, V as PayrollGroupInput, Vn as OrgSetupStep, Vt as ActivityListParams, W as PayrollMethods, Wn as Permission, Wt as ActivityRange, X as PayrollTermsUnit, Xn as RequestStatus, Xt as DepositInstructions, Y as PayrollRuns, Yn as PaymentStatus$1, Yt as ActorReference, Z as OrganizationPaymentBatchInput, Zt as Destination, _ as SystemMethods, _n as PaymentDocumentRef, _t as OrganizationOnboardingInput, a as SdkFailureObservation, an as FinancialOpsMethods, ar as Readiness, at as PermissionOptions, b as CurrentUserContext, bn as PaymentDocumentsMethods, bt as ReadyAccountLifecycle, c as PostHogObservabilityOptions, cn as MovementActivityEvidence, cr as isClaimed, ct as PermissionReadResult, d as CreateCapxulClientInput, dn as OfframpQuoteInput, dr as InvocationControls, dt as OrgMeMethod, en as DestinationListInput, er as TelemetryPort, et as OrganizationPaymentsMethods, f as IdentityProfileDetails, fn as OfframpStatus, ft as OrgMeOptions, g as Holding, gn as PaymentDocumentKind, gt as OrganizationOnboarding, h as HoldingsMethods, hn as PaymentDirection, ht as OnboardingMethods, i as ObservationDelivery, in as DestinationsMethods, ir as OrgLane, it as PermissionMethods, j as OrganizationAccount, jn as TargetsMethods, jt as AddressBookMethods, k as OrgTemplate, kn as ResolvedTarget, kt as AddressBookEntry, l as postHogObservability, ln as OfframpMethods, lr as isRestoring, lt as Budget, m as IdentityRuntimeSendResult, mn as PaymentActivityEvidence, mt as CompletedPersonProfile, n as ObservationAdapter, nn as DestinationRail, nr as IdentityEvent, nt as PermissionChangeInput, o as HostObservability, on as MeMethods, or as StateLabel, ot as PermissionReplaceInput, p as IdentityRuntime, pn as Payment, pt as AccountsMethods, q as PayrollRunItemInput, qn as PAYMENT_DIRECTIONS, qt as ActivitySummaryParams, r as ObservationContext, rn as DestinationRemoveInput, rr as IdentityState, rt as PermissionCreateInput, s as PostHogObservabilityClient, sn as MeProfile, sr as destination, st as PermissionRevokeInput, t as CAPXUL_SDK_EXPECTED_OUTCOME_EVENT, tn as DestinationPayload, tr as Destination$1, tt as PermissionAssignInput, u as CapxulClient, un as OfframpQuote, ur as IdentityTransition, ut as OrgMe, v as SystemHealth, vn as PaymentDocumentRender, vt as PersonOnboarding, w as InviteMemberInput, wn as PaymentType, wt as ActorRelationshipMethods, x as CurrentUserMethods, xn as PaymentMoney, xt as AccountMethods, y as MediaMethods, yn as PaymentDocumentVerification, yt as PersonOnboardingInput, z as PayrollEngagementTerms, zn as AuthMethods, zt as ActivityItem } from "./observation-Bhdq9-l6.mjs";
+import { $ as OrganizationPaymentItemInput, $t as DestinationKind, A as OrgView, An as TargetReference, At as AddressBookLabelInput, B as PayrollGroup, Bn as OrgLifecycle, Bt as ActivityKind, C as DetectPendingOrgInvitationsResult, Cn as PaymentTiming, Ct as ActorProfileMethods, D as OrgMethods, Dn as RecipientResolution, Dt as ActorRequestsMethods, E as MemberView, En as PaymentsPayInput, Et as ActorRequestIssueInput, F as RoleSpendCap, Fn as isSettingUpLifecycle, Ft as ActivityAnnotation, G as PayrollOptions, Gn as Permission, Gt as ActivityReference, H as PayrollGroupMember, Hn as PayoutAddress, Ht as ActivityMethods, I as RoleView, In as CompleteProfileInput, It as ActivityAnnotationInput, J as PayrollRunStatus, Jn as PAYMENT_DIRECTIONS, Jt as ActivitySummaryTotal, K as PayrollRun, Kn as SubmittedPermissionExecution, Kt as ActivitySummary, L as AuthorizeRunInput, Ln as IdentityMethods, Lt as ActivityDetail, M as OrganizationAuditLogItem, Mn as fingerprintPaymentIntent, Mt as InboxApproveInput, N as ResendInviteTokenInput, Nn as AccountLifecycle, Nt as InboxItem, O as OrgScopedMethods, On as Ref, Ot as AddressBookAddInput, P as RoleDefinition, Pn as AccountSetupStep, Pt as InboxMethods, Q as OrganizationPaymentInput, Qt as DestinationAddInput, R as AuthorizeRunOptions, Rn as SmartAccountMethods, Rt as ActivityFilter, S as CreateOrgInput, Sn as PaymentStatus, St as ActorProfile, T as MemberStatus, Tn as PaymentsMethods, Tt as ActorRequest, U as PayrollGroupsMethods, Un as ActorRef, Ut as ActivityPage, V as PayrollGroupInput, Vn as OrgSetupStep, Vt as ActivityListParams, W as PayrollMethods, Wn as CurrentHoldings, Wt as ActivityRange, X as PayrollTermsUnit, Xn as PaymentStatus$1, Xt as DepositInstructions, Y as PayrollRuns, Yn as PAYMENT_STATUSES, Yt as ActorReference, Z as OrganizationPaymentBatchInput, Zn as RequestStatus, Zt as Destination, _ as SystemMethods, _n as PaymentDocumentRef, _t as OrganizationOnboardingInput, a as SdkFailureObservation, an as FinancialOpsMethods, ar as OrgLane, at as PermissionOptions, b as CurrentUserContext, bn as PaymentDocumentsMethods, bt as ReadyAccountLifecycle, c as PostHogObservabilityOptions, cn as MovementActivityEvidence, cr as destination, ct as PermissionReadResult, d as CreateCapxulClientInput, dn as OfframpQuoteInput, dr as IdentityTransition, dt as OrgMeMethod, en as DestinationListInput, et as OrganizationPaymentsMethods, f as IdentityProfileDetails, fn as OfframpStatus, fr as InvocationControls, ft as OrgMeOptions, g as Holding, gn as PaymentDocumentKind, gt as OrganizationOnboarding, h as HoldingsMethods, hn as PaymentDirection, ht as OnboardingMethods, i as ObservationDelivery, in as DestinationsMethods, ir as IdentityState, it as PermissionMethods, j as OrganizationAccount, jn as TargetsMethods, jt as AddressBookMethods, k as OrgTemplate, kn as ResolvedTarget, kt as AddressBookEntry, l as postHogObservability, ln as OfframpMethods, lr as isClaimed, lt as Budget, m as IdentityRuntimeSendResult, mn as PaymentActivityEvidence, mt as CompletedPersonProfile, n as ObservationAdapter, nn as DestinationRail, nr as Destination$1, nt as PermissionChangeInput, o as HostObservability, on as MeMethods, or as Readiness, ot as PermissionReplaceInput, p as IdentityRuntime, pn as Payment, pt as AccountsMethods, q as PayrollRunItemInput, qn as InboxStatus, qt as ActivitySummaryParams, r as ObservationContext, rn as DestinationRemoveInput, rr as IdentityEvent, rt as PermissionCreateInput, s as PostHogObservabilityClient, sn as MeProfile, sr as StateLabel, st as PermissionRevokeInput, t as CAPXUL_SDK_EXPECTED_OUTCOME_EVENT, tn as DestinationPayload, tr as TelemetryPort, tt as PermissionAssignInput, u as CapxulClient, un as OfframpQuote, ur as isRestoring, ut as OrgMe, v as SystemHealth, vn as PaymentDocumentRender, vt as PersonOnboarding, w as InviteMemberInput, wn as PaymentType, wt as ActorRelationshipMethods, x as CurrentUserMethods, xn as PaymentMoney, xt as AccountMethods, y as MediaMethods, yn as PaymentDocumentVerification, yt as PersonOnboardingInput, z as PayrollEngagementTerms, zn as AuthMethods, zt as ActivityItem } from "./observation-vegBPfXj.mjs";
 import "./OAuthBearerAuthClient-D-DLYlKj.mjs";
 import { Context, Effect, Layer } from "effect";
 import { Hex } from "viem";
@@ -626,4 +626,4 @@ declare function captureException(telemetry: TelemetryPort, error: unknown, cont
  */
 declare function captureExceptionSync(telemetry: TelemetryPort, error: unknown, context?: HandledErrorReportContext): void;
 //#endregion
-export { type Account, type AccountId, type AccountLifecycle, type AccountMethods, type AccountProvider, type AccountProviderSource, type AccountRequirement, type AccountSetupStep, type AccountsMethods, type ActivityAnnotation, type ActivityAnnotationInput, type ActivityDetail, type ActivityFilter, type ActivityItem, type ActivityKind, type ActivityListParams, type ActivityMethods, type ActivityPage, type ActivityPhase, type ActivityRange, type ActivityReference, type ActivitySummary, type ActivitySummaryParams, type ActivitySummaryTotal, type ActorProfile, type ActorProfileMethods, type ActorRef, type ActorReference, type ActorRelationshipMethods, type ActorRequest, type ActorRequestIssueInput, type ActorRequestsMethods, type Address, type AddressBookAddInput, type AddressBookEntry, type AddressBookLabelInput, type AddressBookMethods, type AuthMethods, type AuthSession, type AuthUserId, type AuthorizeRunInput, type AuthorizeRunOptions, type Budget, type BudgetId, CAPXUL_ERROR_CODES, CAPXUL_OPERATIONS, CAPXUL_PAYMENTS_V2_ADDRESS, CAPXUL_SDK_EXPECTED_OUTCOME_EVENT, CHAIN_UPSTREAMS, type CapxulClient, type CapxulClientInput, type CapxulDigestSigner, CapxulError, type CapxulErrorCode, type CapxulErrorDetails, type CapxulOperation, type CapxulResult, type CapxulSigner, type ChainCause, type ChainUpstream, type CompleteProfileInput, type CompletedPersonProfile, type CountryCode, type CreateCapxulClientInput, type CreateOrgInput, type CurrentHoldings, type CurrentUserContext, type CurrentUserMethods, type DepositInstructions, type Destination, type DestinationAddInput, type DestinationKind, type DestinationListInput, type DestinationPayload, type DestinationRail, type DestinationRemoveInput, type DestinationsMethods, type DetectPendingOrgInvitationsResult, type DevPrivateKeySignerInput, EVM_ADDRESS_RE, type Eip1193Provider, type Eip1193RequestProvider, Errors, FAILURE_MODES, type FailureMode, type FinancialOpsMethods, HANDLE_RE, type Handle, type HandledErrorReportContext, type Holding, type HoldingsMethods, type HostObservability, type Destination$1 as IdentityDestination, type IdentityEvent, type IdentityMethods, type IdentityProfileDetails, type IdentityRuntime, type IdentityRuntimeSendResult, type IdentityState, type IdentityTransition, type InboxApproveInput, type InboxItem, type InboxMethods, type InviteMemberInput, type InvocationControls, type MeMethods, type MeProfile, type MediaMethods, type MemberStatus, type MemberView, type Money, type MoneyParseError, type MoneyParseErrorReason, type MovementActivityEvidence, type NormalizedCapxulOperation, type ObservationAdapter, type ObservationContext, type ObservationDelivery, type OfframpMethods, type OfframpQuote, type OfframpQuoteInput, type OfframpStatus, type OnboardingMethods, type OpenfortEmbeddedSignerInput, type OpenfortEmbeddedWalletApi, type OpenfortEmbeddedWalletPort, type OrgId, type OrgLane, type OrgLifecycle, type OrgMe, type OrgMeMethod, type OrgMeOptions, type OrgMethods, type OrgScopedMethods, type OrgSetupStep, type OrgTemplate, type OrgView, type OrganizationAccount, type OrganizationAuditLogItem, type OrganizationOnboarding, type OrganizationOnboardingInput, type OrganizationPaymentBatchInput, type OrganizationPaymentInput, type OrganizationPaymentItemInput, type OrganizationPaymentsMethods, PAYMENT_DIRECTIONS, PAYMENT_STATUSES, type PartyId, type Payment, type PaymentActivityEvidence, type PaymentDirection, type PaymentDocumentKind, type PaymentDocumentRef, type PaymentDocumentRender, type PaymentDocumentVerification, type PaymentDocumentsMethods, type PaymentMoney, type PaymentStatus, type PaymentTiming, type PaymentType, type PaymentsMethods, type PaymentsPayInput, type PayrollEngagementTerms, type PayrollGroup, type PayrollGroupId, type PayrollGroupInput, type PayrollGroupMember, type PayrollGroupsMethods, type PayrollMethods, type PayrollOptions, type PayrollRun, type PayrollRunId, type PayrollRunItemInput, type PayrollRunStatus, type PayrollRuns, type PayrollTermsUnit, type Permission, type PermissionAssignInput, type PermissionChangeInput, type PermissionCreateInput, type PermissionMethods, type PermissionOptions, type PermissionReadResult, type PermissionReplaceInput, type PermissionRevokeInput, type PersonOnboarding, type PersonOnboardingInput, type PostHogObservabilityClient, type PostHogObservabilityOptions, type Profile, type Readiness, type ReadyAccountLifecycle, type RecipientResolution, type Ref, type ResendInviteTokenInput, type ResolvedTarget, type RevertSummary, type RoleDefinition, type RoleKey, type RoleSpendCap, type RoleView, type SdkFailureObservation, type Session, type SignerStatus, type SignerStatusStore, type SmartAccount, type SmartAccountMethods, type StateLabel, type SubmittedPermissionExecution, type SystemHealth, type SystemMethods, type TargetReference, type TargetsMethods, type TelemetryPort, type TesterKind, captureException, captureExceptionSync, createCapxulClient, deriveDevPrivateKey, devPrivateKeySigner, eip1193AccountProvider, embeddedSigner, fingerprintPaymentIntent, formatMoney, inboxPhase, injectedWalletSigner, isCapxulError, isCapxulOperation, isClaimed, isMoneyParseError, isRestoring, isSettingUpLifecycle, localPrivateKeyAccountProvider, normalizeCapxulOperation, openfortEmbeddedSigner, openfortEmbeddedSignerFromWallet, openfortEmbeddedWalletPort, parseMoney, paymentPhase, postHogObservability, requestPhase, destination as resolveIdentityDestination, toCountryCode, toAddress as toEvmAddress, toHandle, toPartyId };
+export { type Account, type AccountId, type AccountLifecycle, type AccountMethods, type AccountProvider, type AccountProviderSource, type AccountRequirement, type AccountSetupStep, type AccountsMethods, type ActivityAnnotation, type ActivityAnnotationInput, type ActivityDetail, type ActivityFilter, type ActivityItem, type ActivityKind, type ActivityListParams, type ActivityMethods, type ActivityPage, type ActivityPhase, type ActivityRange, type ActivityReference, type ActivitySummary, type ActivitySummaryParams, type ActivitySummaryTotal, type ActorProfile, type ActorProfileMethods, type ActorRef, type ActorReference, type ActorRelationshipMethods, type ActorRequest, type ActorRequestIssueInput, type ActorRequestsMethods, type Address, type AddressBookAddInput, type AddressBookEntry, type AddressBookLabelInput, type AddressBookMethods, type AuthMethods, type AuthSession, type AuthUserId, type AuthorizeRunInput, type AuthorizeRunOptions, type Budget, type BudgetId, CAPXUL_ERROR_CODES, CAPXUL_OPERATIONS, CAPXUL_PAYMENTS_V2_ADDRESS, CAPXUL_SDK_EXPECTED_OUTCOME_EVENT, CHAIN_UPSTREAMS, type CapxulClient, type CapxulClientInput, type CapxulDigestSigner, CapxulError, type CapxulErrorCode, type CapxulErrorDetails, type CapxulOperation, type CapxulResult, type CapxulSigner, type ChainCause, type ChainUpstream, type CompleteProfileInput, type CompletedPersonProfile, type CountryCode, type CreateCapxulClientInput, type CreateOrgInput, type CurrentHoldings, type CurrentUserContext, type CurrentUserMethods, type DepositInstructions, type Destination, type DestinationAddInput, type DestinationKind, type DestinationListInput, type DestinationPayload, type DestinationRail, type DestinationRemoveInput, type DestinationsMethods, type DetectPendingOrgInvitationsResult, type DevPrivateKeySignerInput, EVM_ADDRESS_RE, type Eip1193Provider, type Eip1193RequestProvider, Errors, FAILURE_MODES, type FailureMode, type FinancialOpsMethods, HANDLE_RE, type Handle, type HandledErrorReportContext, type Holding, type HoldingsMethods, type HostObservability, type Destination$1 as IdentityDestination, type IdentityEvent, type IdentityMethods, type IdentityProfileDetails, type IdentityRuntime, type IdentityRuntimeSendResult, type IdentityState, type IdentityTransition, type InboxApproveInput, type InboxItem, type InboxMethods, type InviteMemberInput, type InvocationControls, type MeMethods, type MeProfile, type MediaMethods, type MemberStatus, type MemberView, type Money, type MoneyParseError, type MoneyParseErrorReason, type MovementActivityEvidence, type NormalizedCapxulOperation, type ObservationAdapter, type ObservationContext, type ObservationDelivery, type OfframpMethods, type OfframpQuote, type OfframpQuoteInput, type OfframpStatus, type OnboardingMethods, type OpenfortEmbeddedSignerInput, type OpenfortEmbeddedWalletApi, type OpenfortEmbeddedWalletPort, type OrgId, type OrgLane, type OrgLifecycle, type OrgMe, type OrgMeMethod, type OrgMeOptions, type OrgMethods, type OrgScopedMethods, type OrgSetupStep, type OrgTemplate, type OrgView, type OrganizationAccount, type OrganizationAuditLogItem, type OrganizationOnboarding, type OrganizationOnboardingInput, type OrganizationPaymentBatchInput, type OrganizationPaymentInput, type OrganizationPaymentItemInput, type OrganizationPaymentsMethods, PAYMENT_DIRECTIONS, PAYMENT_STATUSES, type PartyId, type Payment, type PaymentActivityEvidence, type PaymentDirection, type PaymentDocumentKind, type PaymentDocumentRef, type PaymentDocumentRender, type PaymentDocumentVerification, type PaymentDocumentsMethods, type PaymentMoney, type PaymentStatus, type PaymentTiming, type PaymentType, type PaymentsMethods, type PaymentsPayInput, type PayoutAddress, type PayrollEngagementTerms, type PayrollGroup, type PayrollGroupId, type PayrollGroupInput, type PayrollGroupMember, type PayrollGroupsMethods, type PayrollMethods, type PayrollOptions, type PayrollRun, type PayrollRunId, type PayrollRunItemInput, type PayrollRunStatus, type PayrollRuns, type PayrollTermsUnit, type Permission, type PermissionAssignInput, type PermissionChangeInput, type PermissionCreateInput, type PermissionMethods, type PermissionOptions, type PermissionReadResult, type PermissionReplaceInput, type PermissionRevokeInput, type PersonOnboarding, type PersonOnboardingInput, type PostHogObservabilityClient, type PostHogObservabilityOptions, type Profile, type Readiness, type ReadyAccountLifecycle, type RecipientResolution, type Ref, type ResendInviteTokenInput, type ResolvedTarget, type RevertSummary, type RoleDefinition, type RoleKey, type RoleSpendCap, type RoleView, type SdkFailureObservation, type Session, type SignerStatus, type SignerStatusStore, type SmartAccount, type SmartAccountMethods, type StateLabel, type SubmittedPermissionExecution, type SystemHealth, type SystemMethods, type TargetReference, type TargetsMethods, type TelemetryPort, type TesterKind, captureException, captureExceptionSync, createCapxulClient, deriveDevPrivateKey, devPrivateKeySigner, eip1193AccountProvider, embeddedSigner, fingerprintPaymentIntent, formatMoney, inboxPhase, injectedWalletSigner, isCapxulError, isCapxulOperation, isClaimed, isMoneyParseError, isRestoring, isSettingUpLifecycle, localPrivateKeyAccountProvider, normalizeCapxulOperation, openfortEmbeddedSigner, openfortEmbeddedSignerFromWallet, openfortEmbeddedWalletPort, parseMoney, paymentPhase, postHogObservability, requestPhase, destination as resolveIdentityDestination, toCountryCode, toAddress as toEvmAddress, toHandle, toPartyId };

package/dist/index.mjs

@@ -1,7 +1,7 @@
-import { $ as stampTelemetryEnvelope, A as safeExceptionLabel, B as resolveFailureMode, C as observeFailedResult, D as normalizeExceptionErrorKind, E as SDK_VERSION$1, F as causeChain, G as sanitizeObservationContext, H as readInvocationObservation, I as injectedWalletSigner, J as CAPXUL_FUNCTIONS, K as PAYMENT_DIRECTIONS, L as isSignerNotReadySignal, M as fromWei, N as isSettingUpLifecycle, O as normalizeExceptionOperation, P as formatTraceparent, Q as redactTelemetryProps, R as openfortSignerNotReadyCode, S as observationContextProps, T as EXCEPTION_MESSAGE, U as OBSERVATION_CONTEXT_HEADER, V as copyInvocationObservation, W as encodeObservationContextHeader, X as EngineeringTelemetryBootstrapPolicy, Y as BootstrapEnvelope, _ as fingerprintPaymentIntent, a as AccountReadPortTag, at as isRestoring, b as failureDetail, c as retryIdempotentRead, d as IdentityPortTag, et as CAPXUL_OPERATIONS, f as identityErrorFromCapxul, g as bootstrapErrorFromCapxul, h as BootstrapPortTag, i as smartAccountErrorFromCapxul, it as isClaimed, j as version, k as projectSdkException, l as PRODUCT_INVOCATION, m as convexCallErrorFromCapxul, n as detectAuthCacheAdapter, nt as normalizeCapxulOperation, o as accountReadErrorFromCapxul, p as ConvexCallPortTag, q as PAYMENT_STATUSES, r as SmartAccountPortTag, rt as destination, s as TelemetryPortTag, t as assembleCapxulClient, tt as isCapxulOperation, u as wireChainId, v as toWei, w as postHogFailureObservation, x as failureEvidenceProps, y as CAPXUL_SDK_EXPECTED_OUTCOME_EVENT, z as signerFailure } from "./create-capxul-client-B3ET402J.mjs";
-import { $ as CapxulError, A as toAuthUserId, B as toJwtToken, D as toAddress, E as toAccountId, F as toDurationMs, H as toOrgId, I as toEmail, J as toSessionToken, K as toPublishableKey, L as toEpochMs, M as toChainId, N as toCountryCode, O as toAllowedOrigin, P as toCurrencyCode, Q as CAPXUL_ERROR_CODES, R as toEpochSeconds, T as currencySymbolFor, U as toPartyId, V as toKycTier, X as HANDLE_RE, Y as toTesterKind, Z as decodeConvexError, d as AuthClientError, f as AuthClientPortTag, g as BASE_SEPOLIA_CHAIN_ID, h as normalizeBindingEmail, it as FAILURE_MODES, l as ClockPortTag, m as CAPXUL_PAYMENTS_V2_ADDRESS, nt as isCapxulError, q as toRoleKey, rt as CHAIN_UPSTREAMS, s as AuthCachePortTag, tt as Errors, u as authClientPortFromPromiseAdapter, x as EVM_ADDRESS_RE, z as toHandle } from "./clock-C2AUlq1V.mjs";
-import { n as SystemClockLayer } from "./OAuthBearerAuthClient-BHvDR8_0.mjs";
-import { Cause, Context, Data, Duration, Effect, Exit, Layer, Result, Schedule, SchemaIssue, SchemaParser, Scope, Tracer } from "effect";
+import { $ as stampTelemetryEnvelope, A as safeExceptionLabel, B as resolveFailureMode, C as observeFailedResult, D as normalizeExceptionErrorKind, E as SDK_VERSION$1, F as causeChain, G as sanitizeObservationContext, H as readInvocationObservation, I as injectedWalletSigner, J as CAPXUL_FUNCTIONS, K as PAYMENT_DIRECTIONS, L as isSignerNotReadySignal, M as fromWei, N as isSettingUpLifecycle, O as normalizeExceptionOperation, P as formatTraceparent, Q as redactTelemetryProps, R as openfortSignerNotReadyCode, S as observationContextProps, T as EXCEPTION_MESSAGE, U as OBSERVATION_CONTEXT_HEADER, V as copyInvocationObservation, W as encodeObservationContextHeader, X as EngineeringTelemetryBootstrapPolicy, Y as BootstrapEnvelope, _ as fingerprintPaymentIntent, a as AccountReadPortTag, at as isRestoring, b as failureDetail, c as retryIdempotentRead, d as IdentityPortTag, et as CAPXUL_OPERATIONS, f as identityErrorFromCapxul, g as bootstrapErrorFromCapxul, h as BootstrapPortTag, i as smartAccountErrorFromCapxul, it as isClaimed, j as version, k as projectSdkException, l as PRODUCT_INVOCATION, m as convexCallErrorFromCapxul, n as detectAuthCacheAdapter, nt as normalizeCapxulOperation, o as accountReadErrorFromCapxul, p as ConvexCallPortTag, q as PAYMENT_STATUSES, r as SmartAccountPortTag, rt as destination, s as TelemetryPortTag, t as assembleCapxulClient, tt as isCapxulOperation, u as wireChainId, v as toWei, w as postHogFailureObservation, x as failureEvidenceProps, y as CAPXUL_SDK_EXPECTED_OUTCOME_EVENT, z as signerFailure } from "./create-capxul-client-B6PUjdld.mjs";
+import { $ as CapxulError, A as toAuthUserId, B as toJwtToken, D as toAddress, E as toAccountId, F as toDurationMs, H as toOrgId, I as toEmail, J as toSessionToken, K as toPublishableKey, L as toEpochMs, M as toChainId, N as toCountryCode, O as toAllowedOrigin, P as toCurrencyCode, Q as CAPXUL_ERROR_CODES, R as toEpochSeconds, T as currencySymbolFor, U as toPartyId, V as toKycTier, X as HANDLE_RE, Y as toTesterKind, Z as decodeConvexError, d as AuthClientError, f as AuthClientPortTag, g as BASE_SEPOLIA_CHAIN_ID, gt as redactUrlSecrets, h as normalizeBindingEmail, ht as redactSecrets, it as FAILURE_MODES, l as ClockPortTag, m as CAPXUL_PAYMENTS_V2_ADDRESS, mt as isCredentialField, nt as isCapxulError, q as toRoleKey, rt as CHAIN_UPSTREAMS, s as AuthCachePortTag, tt as Errors, u as authClientPortFromPromiseAdapter, x as EVM_ADDRESS_RE, z as toHandle } from "./clock-DIfTX44d.mjs";
+import { n as SystemClockLayer } from "./OAuthBearerAuthClient-ByPzJZr8.mjs";
+import { Cause, Context, Data, Duration, Effect, Exit, FiberSet, Layer, Result, Schedule, SchemaIssue, SchemaParser, Scope, Stream, Tracer } from "effect";
 import { keccak256, recoverAddress, stringToHex } from "viem";
 import { getFunctionName, makeFunctionReference } from "convex/server";
 import { privateKeyToAccount } from "viem/accounts";
@@ -424,21 +424,8 @@ const ENGINEERING_CAPXUL_ENVS = [
 	"production",
 	"local"
 ];
-const SAFE_TRACED_HEADER_NAMES = [
-	"content-length",
-	"content-type",
-	"traceparent",
-	"tracestate",
-	"x-request-id"
-];
-const ENGINEERING_REDACTED_HEADER_NAMES = Object.freeze([
-	"authorization",
-	"cookie",
-	"set-cookie",
-	"x-api-key",
-	/auth|email|key|otp|secret|session|token|wallet/i
-]);
-const traceHeaderFilter = (name) => SAFE_TRACED_HEADER_NAMES.includes(name.toLowerCase());
+const traceHeaderFilter = (_name) => true;
+const credentialHeaderPattern = Object.assign(/./u, { test: (name) => isCredentialField(name, "header") });
 const postHogOtlpEndpoints = (host) => {
 	const base = host.replace(/\/+$/, "");
 	return {
@@ -470,23 +457,79 @@ const validateEngineeringTelemetryConfig = (config) => {
 		headers: Object.freeze({ authorization: headerEntries[0][1] })
 	};
 };
-var RedactedEngineeringSpanFailure = class extends Error {
-	constructor() {
-		super("Engineering operation failed");
-		this.name = "RedactedEngineeringSpanFailure";
-		delete this.stack;
+const failureText = (failure, key, limit, source) => {
+	if (failure === null || typeof failure !== "object") return void 0;
+	try {
+		let owner = failure;
+		let descriptor;
+		for (let depth = 0; owner !== null && depth < 4; depth += 1) {
+			descriptor = Object.getOwnPropertyDescriptor(owner, key);
+			if (descriptor !== void 0 || key !== "name") break;
+			owner = Object.getPrototypeOf(owner);
+		}
+		const value = descriptor?.value;
+		return typeof value === "string" || key === "code" && typeof value === "number" ? redactSecrets(String(value), source).slice(0, limit) : void 0;
+	} catch {
+		return;
+	}
+};
+const exportFailure = (failure, source) => {
+	const message = failureText(failure, "message", 2048, source) ?? (typeof failure === "string" ? redactSecrets(failure, source).slice(0, 2048) : "Engineering operation failed");
+	const code = failureText(failure, "code", 128);
+	const error = new Error((code === void 0 ? message : `${message} [code=${code}]`).slice(0, 2048));
+	error.name = failureText(failure, "_tag", 128) ?? failureText(failure, "name", 128) ?? "Error";
+	error.stack = failureText(failure, "stack", 8192, source) ?? `${error.name}: ${error.message}`;
+	return error;
+};
+const exportFailureExit = (cause, source) => Exit.failCause(Cause.fromReasons(cause.reasons.filter((reason) => !Cause.isInterruptReason(reason)).slice(0, 8).map((reason) => Cause.isFailReason(reason) ? Cause.makeFailReason(exportFailure(reason.error, source)) : Cause.makeDieReason(exportFailure(reason.defect, source)))));
+const BROWSER_KEEPALIVE_BYTES = 65536;
+let unfinishedBrowserExportBytes = 0;
+const hasBrowserDocument = () => typeof window !== "undefined" && typeof document !== "undefined";
+const browserExportClient = (client) => HttpClient.transform(client, (response, request) => Effect.acquireUseRelease(Effect.sync(() => {
+	const bytes = "contentLength" in request.body ? request.body.contentLength : void 0;
+	if (request.body._tag === "Stream" || request.body._tag === "FormData" || bytes === void 0 || !Number.isSafeInteger(bytes) || bytes < 0 || unfinishedBrowserExportBytes + bytes > BROWSER_KEEPALIVE_BYTES) return;
+	unfinishedBrowserExportBytes += bytes;
+	return bytes;
+}), (bytes) => response.pipe(Effect.provideService(FetchHttpClient.RequestInit, { keepalive: bytes !== void 0 }), Effect.tap((result) => bytes === void 0 ? Effect.void : Stream.runDrain(result.stream).pipe(Effect.catch((error) => error.reason._tag === "EmptyBodyError" ? Effect.void : Effect.fail(error))))), (bytes) => Effect.sync(() => {
+	if (bytes !== void 0) unfinishedBrowserExportBytes -= bytes;
+})));
+const spanUpstream = (span) => {
+	let current = span;
+	while (current?._tag === "Span") {
+		const upstream = current.attributes.get("chain.upstream");
+		if (upstream === "alchemy" || upstream === "infura") return upstream;
+		current = current.parent._tag === "Some" ? current.parent.value : void 0;
 	}
 };
-const REDACTED_SPAN_FAILURE = Exit.fail(new RedactedEngineeringSpanFailure());
 /** Preserve domain exits while preventing the OTLP serializer from seeing raw causes. */
 const makeLeakSafeEngineeringTracer = (delegate) => Tracer.make({
 	span(options) {
 		const span = delegate.span(options);
 		const wrapped = Object.create(span);
+		Object.defineProperty(wrapped, "attribute", { value: (name, value) => {
+			const source = spanUpstream(span);
+			const header = /^http\.(?:request|response)\.header\.(.+)$/u.exec(name)?.[1];
+			if (header !== void 0 && isCredentialField(header, "header")) span.attribute(name, "[REDACTED]");
+			else if (typeof value === "string" && name === "url.query") span.attribute(name, redactUrlSecrets(`?${value}`).slice(1, 2049));
+			else if (typeof value === "string" && name === "url.path") {
+				const fullUrl = span.attributes.get("url.full");
+				const path = typeof fullUrl === "string" ? /^https?:\/\/[^/]+([^?#]*)/u.exec(fullUrl)?.[1] ?? value : value;
+				span.attribute(name, redactUrlSecrets(path, source).slice(0, 2048));
+			} else if (typeof value === "string" && (name === "url.full" || header === "location" || header === "referer" || header === "referrer")) span.attribute(name, redactUrlSecrets(value, source).slice(0, 2048));
+			else if (header !== void 0 && typeof value === "string") span.attribute(name, redactSecrets(value, source).slice(0, 2048));
+			else span.attribute(name, value);
+		} });
 		Object.defineProperty(wrapped, "end", {
 			configurable: false,
 			enumerable: false,
-			value: (endTime, exit) => span.end(endTime, Exit.isFailure(exit) && !Cause.hasInterruptsOnly(exit.cause) ? REDACTED_SPAN_FAILURE : exit),
+			value: (endTime, exit) => {
+				if (Exit.isFailure(exit) && !Cause.hasInterruptsOnly(exit.cause)) {
+					const first = exit.cause.reasons.find((reason) => !Cause.isInterruptReason(reason));
+					const code = failureText(first === void 0 ? void 0 : Cause.isFailReason(first) ? first.error : first.defect, "code", 128);
+					if (code !== void 0) span.attribute("error.code", code);
+					span.end(endTime, exportFailureExit(exit.cause, spanUpstream(span)));
+				} else span.end(endTime, exit);
+			},
 			writable: false
 		});
 		return wrapped;
@@ -517,8 +560,29 @@ const makeEngineeringTelemetryLayer = (config) => {
 		resource,
 		mergeWithExisting: true
 	});
-	const headerPolicy = Layer.merge(Layer.succeed(HttpClient.TracerHeaderFilter, traceHeaderFilter), Layer.succeed(Headers.CurrentRedactedNames, ENGINEERING_REDACTED_HEADER_NAMES));
-	return Layer.mergeAll(tracing, logging, headerPolicy).pipe(Layer.provide(OtlpSerialization.layerJson), Layer.provide(FetchHttpClient.layer));
+	const headerPolicy = Layer.merge(Layer.succeed(HttpClient.TracerHeaderFilter, traceHeaderFilter), Layer.succeed(Headers.CurrentRedactedNames, [credentialHeaderPattern]));
+	const browserLifecycle = Layer.effectDiscard(Effect.gen(function* () {
+		if (validated.producer !== "browser" || !hasBrowserDocument()) return;
+		const browserWindow = window;
+		const browserDocument = document;
+		const flusher = yield* OtlpExporter.Flusher;
+		const run = yield* FiberSet.makeRuntime();
+		const flush = () => {
+			run(flusher.flush);
+		};
+		const visibilityChanged = () => {
+			if (browserDocument.visibilityState === "hidden") flush();
+		};
+		yield* Effect.acquireRelease(Effect.sync(() => {
+			browserDocument.addEventListener("visibilitychange", visibilityChanged);
+			browserWindow.addEventListener("pagehide", flush);
+		}), () => Effect.sync(() => {
+			browserDocument.removeEventListener("visibilitychange", visibilityChanged);
+			browserWindow.removeEventListener("pagehide", flush);
+		}));
+	}));
+	const transport = Layer.effect(HttpClient.HttpClient, Effect.map(HttpClient.HttpClient, (client) => validated.producer === "browser" && hasBrowserDocument() ? browserExportClient(client) : client)).pipe(Layer.provide(FetchHttpClient.layer));
+	return browserLifecycle.pipe(Layer.provideMerge(Layer.mergeAll(tracing, logging, headerPolicy)), Layer.provide(OtlpSerialization.layerJson), Layer.provide(transport));
 };
 //#endregion
 //#region src/adapters/auth-client/resolve-auth-url.ts

package/dist/node/index.mjs

@@ -1,5 +1,5 @@
-import { D as toAddress, a as parseCachedJwt, i as parseAuthSession, n as InMemoryAuthCacheAdapter, o as AuthCacheError, r as BrowserAuthCacheAdapter, s as AuthCachePortTag } from "../clock-C2AUlq1V.mjs";
-import { t as oauthBearerAuthClient } from "../OAuthBearerAuthClient-BHvDR8_0.mjs";
+import { D as toAddress, a as parseCachedJwt, i as parseAuthSession, n as InMemoryAuthCacheAdapter, o as AuthCacheError, r as BrowserAuthCacheAdapter, s as AuthCachePortTag } from "../clock-DIfTX44d.mjs";
+import { t as oauthBearerAuthClient } from "../OAuthBearerAuthClient-ByPzJZr8.mjs";
 import { Effect, FileSystem, Layer, Path } from "effect";
 import { privateKeyToAccount } from "viem/accounts";
 import * as os from "node:os";

package/dist/{observation-Bhdq9-l6.d.mts → observation-vegBPfXj.d.mts}

@@ -78,6 +78,11 @@ interface OrgDraft {
 interface OrgSubmissionDraft extends OrgDraft {
   readonly bio?: string;
   readonly size?: string;
+  /**
+   * #1955: the logo uploaded on file pick. The org lane spreads this draft
+   * straight into `startOrResume`, which records it on the `orgs` insert.
+   */
+  readonly logoStorageId?: string;
 }
 /** The org lane, keyed by the active orgId — which does not exist yet while the
  * FIRST DURABLE ORG WRITE is in flight, hence `creating` carrying only a draft. */
@@ -710,6 +715,16 @@ type UpdateIdentityInput = {
   readonly displayName?: string;
   readonly country?: CountryCode;
 };
+/** The chain families a payout address may name (#1955). */
+declare const PAYOUT_CHAINS: readonly ["evm", "solana", "starknet"];
+/**
+ * One payout address, named BY CHAIN FAMILY. The network is the deployment's
+ * and the backend derives it (#1955) — a caller never sends one.
+ */
+type PayoutAddress = {
+  readonly chain: (typeof PAYOUT_CHAINS)[number];
+  readonly address: string;
+};
 /**
  * D-ONBOARD (#669) — the onboarding-complete identity write. Composes the
  * existing create/update write into one idempotent upsert that ALSO sets the
@@ -717,6 +732,10 @@ type UpdateIdentityInput = {
  * allowed raw-0x class). `displayName` + `country` are required at onboarding
  * time. The returned `Profile` is the existing branded shape — the onboarding
  * flags live on the wire row and are not projected onto the read surface.
+ *
+ * #1955: it also carries the photo the signup form uploaded and the payout
+ * addresses it collected, so the backend writes all three in one transaction
+ * instead of the app binding them with two more calls afterwards.
  */
 type CompleteOnboardingIdentityInput = {
   readonly authUserId: AuthUserId;
@@ -726,6 +745,9 @@ type CompleteOnboardingIdentityInput = {
   readonly withdrawalAddress?: Address$1;
   /** One globally unique Party handle. */
   readonly handle: string;
+  /** Storage id from `media.uploadImage`; bound on the identity write itself. */
+  readonly imageStorageId?: string;
+  readonly payoutAddresses?: readonly PayoutAddress[];
 };
 declare const IdentityError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
   readonly _tag: "IdentityError";
@@ -929,6 +951,8 @@ type StartOrResumeOrganizationInput = {
   /** #1064: optional onboarding-collected description + size bucket. */
   readonly bio?: string;
   readonly size?: string;
+  /** #1955: storage id from `media.uploadImage`, recorded on the org insert. */
+  readonly logoStorageId?: string;
   /** @internal Safe trace/correlation carriage owned by the identity flow. */
   readonly observationContext?: WireObservationContext;
 };
@@ -1019,7 +1043,16 @@ interface SmartAccountMethods {
 }
 //#endregion
 //#region src/surface/identity.d.ts
-interface CompleteProfileInput {
+/**
+ * #1955: what a create call may carry besides the three required fields — the
+ * photo already uploaded and the payout addresses the form collected.
+ */
+interface ProfileCarriage {
+  /** Storage id from `media.uploadImage`. */
+  readonly imageStorageId?: string;
+  readonly payoutAddresses?: readonly PayoutAddress[];
+}
+interface CompleteProfileInput extends ProfileCarriage {
   readonly displayName: string;
   readonly country: string;
   readonly handle: string;
@@ -2545,6 +2578,13 @@ type IdentityProfileDetails = {
   readonly displayName: string;
   readonly country: string;
   readonly handle: string;
+  /**
+   * #1955: the storage id `useCapxulUploadImage` handed back on file pick, and
+   * the payout addresses the form collected. The create call carries them, so
+   * the backend binds the photo and writes the rails in the same durable step.
+   */
+  readonly imageStorageId?: string;
+  readonly payoutAddresses?: readonly PayoutAddress[];
 };
 interface IdentityRuntime {
   readonly snapshot: () => IdentityState;
@@ -2835,4 +2875,4 @@ interface ObservationAdapter {
 /** Stable PostHog event used for typed failures that are expected product outcomes. */
 declare const CAPXUL_SDK_EXPECTED_OUTCOME_EVENT = "capxul_sdk_expected_outcome";
 //#endregion
-export { OrganizationPaymentItemInput as $, TelemetryIdentifyInput as $n, DestinationKind as $t, OrgView as A, TargetReference as An, AddressBookLabelInput as At, PayrollGroup as B, OrgLifecycle as Bn, ActivityKind as Bt, DetectPendingOrgInvitationsResult as C, PaymentTiming as Cn, ActorProfileMethods as Ct, OrgMethods as D, RecipientResolution as Dn, ActorRequestsMethods as Dt, MemberView as E, PaymentsPayInput as En, ActorRequestIssueInput as Et, RoleSpendCap as F, isSettingUpLifecycle as Fn, ActivityAnnotation as Ft, PayrollOptions as G, SubmittedPermissionExecution as Gn, ActivityReference as Gt, PayrollGroupMember as H, ActorRef as Hn, ActivityMethods as Ht, RoleView as I, CompleteProfileInput as In, ActivityAnnotationInput as It, PayrollRunStatus as J, PAYMENT_STATUSES as Jn, ActivitySummaryTotal as Jt, PayrollRun as K, InboxStatus as Kn, ActivitySummary as Kt, AuthorizeRunInput as L, IdentityMethods as Ln, ActivityDetail as Lt, OrganizationAuditLogItem as M, fingerprintPaymentIntent as Mn, InboxApproveInput as Mt, ResendInviteTokenInput as N, AccountLifecycle as Nn, InboxItem as Nt, OrgScopedMethods as O, Ref$1 as On, AddressBookAddInput as Ot, RoleDefinition as P, AccountSetupStep as Pn, InboxMethods as Pt, OrganizationPaymentInput as Q, TelemetryGroupInput as Qn, DestinationAddInput as Qt, AuthorizeRunOptions as R, SmartAccountMethods as Rn, ActivityFilter as Rt, CreateOrgInput as S, PaymentStatus as Sn, ActorProfile as St, MemberStatus as T, PaymentsMethods as Tn, ActorRequest as Tt, PayrollGroupsMethods as U, CurrentHoldings as Un, ActivityPage as Ut, PayrollGroupInput as V, OrgSetupStep as Vn, ActivityListParams as Vt, PayrollMethods as W, Permission as Wn, ActivityRange as Wt, PayrollTermsUnit as X, RequestStatus as Xn, DepositInstructions as Xt, PayrollRuns as Y, PaymentStatus$1 as Yn, ActorReference as Yt, OrganizationPaymentBatchInput as Z, TelemetryEvent as Zn, Destination as Zt, SystemMethods as _, PaymentDocumentRef as _n, OrganizationOnboardingInput as _t, SdkFailureObservation as a, FinancialOpsMethods as an, Readiness as ar, PermissionOptions as at, CurrentUserContext as b, PaymentDocumentsMethods as bn, ReadyAccountLifecycle as bt, PostHogObservabilityOptions as c, MovementActivityEvidence as cn, isClaimed as cr, PermissionReadResult as ct, CreateCapxulClientInput as d, OfframpQuoteInput as dn, InvocationControls as dr, OrgMeMethod as dt, DestinationListInput as en, TelemetryPort as er, OrganizationPaymentsMethods as et, IdentityProfileDetails as f, OfframpStatus as fn, OrgMeOptions as ft, Holding as g, PaymentDocumentKind as gn, OrganizationOnboarding as gt, HoldingsMethods as h, PaymentDirection as hn, OnboardingMethods as ht, ObservationDelivery as i, DestinationsMethods as in, OrgLane as ir, PermissionMethods as it, OrganizationAccount as j, TargetsMethods as jn, AddressBookMethods as jt, OrgTemplate as k, ResolvedTarget as kn, AddressBookEntry as kt, postHogObservability as l, OfframpMethods as ln, isRestoring as lr, Budget as lt, IdentityRuntimeSendResult as m, PaymentActivityEvidence as mn, CompletedPersonProfile as mt, ObservationAdapter as n, DestinationRail as nn, IdentityEvent as nr, PermissionChangeInput as nt, HostObservability as o, MeMethods as on, StateLabel as or, PermissionReplaceInput as ot, IdentityRuntime as p, Payment as pn, AccountsMethods as pt, PayrollRunItemInput as q, PAYMENT_DIRECTIONS as qn, ActivitySummaryParams as qt, ObservationContext as r, DestinationRemoveInput as rn, IdentityState as rr, PermissionCreateInput as rt, PostHogObservabilityClient as s, MeProfile as sn, destination as sr, PermissionRevokeInput as st, CAPXUL_SDK_EXPECTED_OUTCOME_EVENT as t, DestinationPayload as tn, Destination$1 as tr, PermissionAssignInput as tt, CapxulClient as u, OfframpQuote as un, IdentityTransition as ur, OrgMe as ut, SystemHealth as v, PaymentDocumentRender as vn, PersonOnboarding as vt, InviteMemberInput as w, PaymentType as wn, ActorRelationshipMethods as wt, CurrentUserMethods as x, PaymentMoney as xn, AccountMethods as xt, MediaMethods as y, PaymentDocumentVerification as yn, PersonOnboardingInput as yt, PayrollEngagementTerms as z, AuthMethods as zn, ActivityItem as zt };
+export { OrganizationPaymentItemInput as $, TelemetryGroupInput as $n, DestinationKind as $t, OrgView as A, TargetReference as An, AddressBookLabelInput as At, PayrollGroup as B, OrgLifecycle as Bn, ActivityKind as Bt, DetectPendingOrgInvitationsResult as C, PaymentTiming as Cn, ActorProfileMethods as Ct, OrgMethods as D, RecipientResolution as Dn, ActorRequestsMethods as Dt, MemberView as E, PaymentsPayInput as En, ActorRequestIssueInput as Et, RoleSpendCap as F, isSettingUpLifecycle as Fn, ActivityAnnotation as Ft, PayrollOptions as G, Permission as Gn, ActivityReference as Gt, PayrollGroupMember as H, PayoutAddress as Hn, ActivityMethods as Ht, RoleView as I, CompleteProfileInput as In, ActivityAnnotationInput as It, PayrollRunStatus as J, PAYMENT_DIRECTIONS as Jn, ActivitySummaryTotal as Jt, PayrollRun as K, SubmittedPermissionExecution as Kn, ActivitySummary as Kt, AuthorizeRunInput as L, IdentityMethods as Ln, ActivityDetail as Lt, OrganizationAuditLogItem as M, fingerprintPaymentIntent as Mn, InboxApproveInput as Mt, ResendInviteTokenInput as N, AccountLifecycle as Nn, InboxItem as Nt, OrgScopedMethods as O, Ref$1 as On, AddressBookAddInput as Ot, RoleDefinition as P, AccountSetupStep as Pn, InboxMethods as Pt, OrganizationPaymentInput as Q, TelemetryEvent as Qn, DestinationAddInput as Qt, AuthorizeRunOptions as R, SmartAccountMethods as Rn, ActivityFilter as Rt, CreateOrgInput as S, PaymentStatus as Sn, ActorProfile as St, MemberStatus as T, PaymentsMethods as Tn, ActorRequest as Tt, PayrollGroupsMethods as U, ActorRef as Un, ActivityPage as Ut, PayrollGroupInput as V, OrgSetupStep as Vn, ActivityListParams as Vt, PayrollMethods as W, CurrentHoldings as Wn, ActivityRange as Wt, PayrollTermsUnit as X, PaymentStatus$1 as Xn, DepositInstructions as Xt, PayrollRuns as Y, PAYMENT_STATUSES as Yn, ActorReference as Yt, OrganizationPaymentBatchInput as Z, RequestStatus as Zn, Destination as Zt, SystemMethods as _, PaymentDocumentRef as _n, OrganizationOnboardingInput as _t, SdkFailureObservation as a, FinancialOpsMethods as an, OrgLane as ar, PermissionOptions as at, CurrentUserContext as b, PaymentDocumentsMethods as bn, ReadyAccountLifecycle as bt, PostHogObservabilityOptions as c, MovementActivityEvidence as cn, destination as cr, PermissionReadResult as ct, CreateCapxulClientInput as d, OfframpQuoteInput as dn, IdentityTransition as dr, OrgMeMethod as dt, DestinationListInput as en, TelemetryIdentifyInput as er, OrganizationPaymentsMethods as et, IdentityProfileDetails as f, OfframpStatus as fn, InvocationControls as fr, OrgMeOptions as ft, Holding as g, PaymentDocumentKind as gn, OrganizationOnboarding as gt, HoldingsMethods as h, PaymentDirection as hn, OnboardingMethods as ht, ObservationDelivery as i, DestinationsMethods as in, IdentityState as ir, PermissionMethods as it, OrganizationAccount as j, TargetsMethods as jn, AddressBookMethods as jt, OrgTemplate as k, ResolvedTarget as kn, AddressBookEntry as kt, postHogObservability as l, OfframpMethods as ln, isClaimed as lr, Budget as lt, IdentityRuntimeSendResult as m, PaymentActivityEvidence as mn, CompletedPersonProfile as mt, ObservationAdapter as n, DestinationRail as nn, Destination$1 as nr, PermissionChangeInput as nt, HostObservability as o, MeMethods as on, Readiness as or, PermissionReplaceInput as ot, IdentityRuntime as p, Payment as pn, AccountsMethods as pt, PayrollRunItemInput as q, InboxStatus as qn, ActivitySummaryParams as qt, ObservationContext as r, DestinationRemoveInput as rn, IdentityEvent as rr, PermissionCreateInput as rt, PostHogObservabilityClient as s, MeProfile as sn, StateLabel as sr, PermissionRevokeInput as st, CAPXUL_SDK_EXPECTED_OUTCOME_EVENT as t, DestinationPayload as tn, TelemetryPort as tr, PermissionAssignInput as tt, CapxulClient as u, OfframpQuote as un, isRestoring as ur, OrgMe as ut, SystemHealth as v, PaymentDocumentRender as vn, PersonOnboarding as vt, InviteMemberInput as w, PaymentType as wn, ActorRelationshipMethods as wt, CurrentUserMethods as x, PaymentMoney as xn, AccountMethods as xt, MediaMethods as y, PaymentDocumentVerification as yn, PersonOnboardingInput as yt, PayrollEngagementTerms as z, AuthMethods as zn, ActivityItem as zt };

package/dist/testing/index.d.mts

@@ -1,4 +1,4 @@
-import { $n as TelemetryIdentifyInput, Qn as TelemetryGroupInput, Zn as TelemetryEvent, n as ObservationAdapter, u as CapxulClient, ur as IdentityTransition } from "../observation-Bhdq9-l6.mjs";
+import { $n as TelemetryGroupInput, Qn as TelemetryEvent, dr as IdentityTransition, er as TelemetryIdentifyInput, n as ObservationAdapter, u as CapxulClient } from "../observation-vegBPfXj.mjs";
 import { Effect, Layer } from "effect";
 //#region src/testing/telemetry/RecordingTelemetryAdapter.d.ts
 type RecordingTelemetryOperation = {

package/dist/testing/index.mjs

@@ -1,5 +1,5 @@
-import { M as fromWei, Z as redactTelemetryEvent, f as identityErrorFromCapxul, g as bootstrapErrorFromCapxul, i as smartAccountErrorFromCapxul, m as convexCallErrorFromCapxul, o as accountReadErrorFromCapxul, t as assembleCapxulClient, u as wireChainId, v as toWei } from "../create-capxul-client-B3ET402J.mjs";
-import { $ as CapxulError, A as toAuthUserId, B as toJwtToken, D as toAddress, E as toAccountId, F as toDurationMs, I as toEmail, J as toSessionToken, K as toPublishableKey, L as toEpochMs, M as toChainId, N as toCountryCode, O as toAllowedOrigin, R as toEpochSeconds, V as toKycTier, _ as deriveCapxulSafeAddress, k as toAppId, n as InMemoryAuthCacheAdapter, t as readClockNow, tt as Errors, u as authClientPortFromPromiseAdapter, v as validateHandle, z as toHandle } from "../clock-C2AUlq1V.mjs";
+import { M as fromWei, Z as redactTelemetryEvent, f as identityErrorFromCapxul, g as bootstrapErrorFromCapxul, i as smartAccountErrorFromCapxul, m as convexCallErrorFromCapxul, o as accountReadErrorFromCapxul, t as assembleCapxulClient, u as wireChainId, v as toWei } from "../create-capxul-client-B6PUjdld.mjs";
+import { $ as CapxulError, A as toAuthUserId, B as toJwtToken, D as toAddress, E as toAccountId, F as toDurationMs, I as toEmail, J as toSessionToken, K as toPublishableKey, L as toEpochMs, M as toChainId, N as toCountryCode, O as toAllowedOrigin, R as toEpochSeconds, V as toKycTier, _ as deriveCapxulSafeAddress, k as toAppId, n as InMemoryAuthCacheAdapter, t as readClockNow, tt as Errors, u as authClientPortFromPromiseAdapter, v as validateHandle, z as toHandle } from "../clock-DIfTX44d.mjs";
 import { Effect, Result, Semaphore } from "effect";
 import { keccak256 } from "viem";
 import { getFunctionName } from "convex/server";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@capxul/sdk",
-  "version": "4.1.4",
+  "version": "4.2.0",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/Xelmar-tech/infrastructure.git",
@@ -47,12 +47,12 @@
     "vite": "npm:@voidzero-dev/vite-plus-core@0.3.0",
     "vite-plus": "0.3.0",
     "vitest": "4.1.11",
-    "@capxul/errors": "0.3.0",
-    "@capxul/observability": "4.1.4",
-    "@capxul/types": "0.3.0",
     "@capxul/config": "0.3.0",
+    "@capxul/errors": "0.3.0",
     "@capxul/typescript-config": "0.0.0",
-    "@capxul/wire": "0.7.0"
+    "@capxul/types": "0.3.0",
+    "@capxul/wire": "0.7.0",
+    "@capxul/observability": "4.2.0"
   },
   "_permissionlessPinReason": "permissionless.toSafeSmartAccount is pinned to 0.3.4 for live Safe deployment E2E. Counterfactual address fixtures captured 2026-05-17 in packages/backend/convex/_shared/__tests__/counterfactual.test.ts and packages/config/tests/safe.test.ts must be re-verified before upgrading.",
   "scripts": {