@capxul/sdk 4.1.4 → 4.2.0-rc.10

package/dist/{clock-C2AUlq1V.mjs → OAuthBearerAuthClient-IB2W1Fzj.mjs}

@@ -1,39 +1,275 @@
-import { Context, Data, Effect, Layer, Result } from "effect";
 import { concat, encodeAbiParameters, encodeFunctionData, encodePacked, getContractAddress, keccak256, padHex, stringToHex, toBytes, toEventSelector, toFunctionSelector, toFunctionSignature } from "viem";
+import { Context, Data, Effect, Layer, Result } from "effect";
 //#region ../errors/src/secret-material.ts
-const SENSITIVE_MATERIAL_PATTERNS = [
-	/(?:^|[^a-fA-F0-9])(?<!0[xX])[a-fA-F0-9]{64}(?:$|[^a-fA-F0-9])/u,
-	/eyJ[A-Za-z0-9_-]*\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+/u,
-	/(?:(?:sk|pk|rk)_(?:live|test)|(?:phc|phx|ghp|gho|ghu|ghs|ghr|whsec)_|github_pat_|xox[baprs]-|AKIA[0-9A-Z]{16}|AIza)[A-Za-z0-9_-]*/iu,
-	/\bBearer\s+[^\s,;]+/iu,
-	/https?:\/\/[^\s"']+?\/v[0-9]\/[A-Za-z0-9_-]{16,}/iu,
-	/\b(?:api[ _-]?key|access[ _-]?token|token|secret|password|passphrase|private[ _-]?key|authorization|cookie|signature|request[ _-]?body|credential|otp|one[ _-]?time[ _-]?(?:password|code)|verification[ _-]?code)\b\s*[:=]\s*(?:"[^"]*"|'[^']*'|[^\s,;&]+)/iu
-];
-const MASKS = [
-	[/\bBearer\s+[^\s,;]+/giu, "Bearer [REDACTED]"],
+const CREDENTIAL_FIELDS = /* @__PURE__ */ new Set([
+	"password",
+	"passwd",
+	"pwd",
+	"pass",
+	"passphrase",
+	"currentpassword",
+	"newpassword",
+	"confirmpassword",
+	"passwordconfirmation",
+	"passwordhash",
+	"hashedpassword",
+	"pin",
+	"privatekey",
+	"walletprivatekey",
+	"secretkey",
+	"signingkey",
+	"signingsecret",
+	"seed",
+	"seedphrase",
+	"mnemonic",
+	"recoveryphrase",
+	"recovery",
+	"recoverycode",
+	"recoverycodes",
+	"keyshare",
+	"signingmaterial",
+	"recoverymaterial",
+	"privatekeybytes",
+	"signingprivatekey",
+	"encryptionkey",
+	"decryptionkey",
+	"authtoken",
+	"apitoken",
+	"bearertoken",
+	"oauthtoken",
+	"csrftoken",
+	"clientassertion",
+	"token",
+	"accesstoken",
+	"refreshtoken",
+	"idtoken",
+	"sessiontoken",
+	"session",
+	"sessionkey",
+	"sessionsecret",
+	"authsessionid",
+	"sessioncredential",
+	"sessioncredentials",
+	"sessioncookie",
+	"auth",
+	"authentication",
+	"authorization",
+	"proxyauthorization",
+	"cookie",
+	"cookies",
+	"setcookie",
+	"apikey",
+	"xapikey",
+	"xauthtoken",
+	"clientsecret",
+	"secret",
+	"secrets",
+	"credential",
+	"credentials",
+	"signature",
+	"otp",
+	"otpcode",
+	"totpsecret",
+	"onetimecode",
+	"onetimepassword",
+	"verificationcode",
+	"authcode",
+	"authorizationcode",
+	"oauthcode",
+	"codeverifier"
+]);
+/** Match credential fields by meaning, without hiding token addresses or replay IDs. */
+function isCredentialField(name, context) {
+	const normalized = name.toLowerCase().replace(/[^a-z0-9]/gu, "");
+	return CREDENTIAL_FIELDS.has(normalized) || /(?:password(?:hash)?|passwd|passphrase|privatekey|signingkey|apikey|clientsecret|accesstoken|refreshtoken|sessiontoken)$/u.test(normalized) || context === "authentication" && (normalized === "code" || normalized === "sessionid") || context === "header" && /(?:token|secret|apikey|privatekey|signingkey|password|authorization|cookie|session)$/u.test(normalized);
+}
+function decodeUrlComponent(text) {
+	try {
+		return decodeURIComponent(text);
+	} catch {
+		return text;
+	}
+}
+/** Preserve URL diagnostics while removing credentials from their declared components. */
+function redactUrlSecrets(value, source) {
+	try {
+		const absolute = /^[a-z][a-z0-9+.-]*:/iu.test(value);
+		const protocolRelative = value.startsWith("//");
+		const url = new URL(value, "https://redaction.invalid");
+		if (url.protocol !== "https:" && url.protocol !== "http:") return maskText(value);
+		let changed = url.username.length > 0 || url.password.length > 0;
+		const maskParams = (params) => new URLSearchParams(Array.from(params, ([name, entry]) => {
+			const safeName = maskText(name);
+			const safeEntry = isCredentialField(name) || /^(?:code|draft|__posthog)$/iu.test(name) ? "[REDACTED]" : maskText(entry);
+			changed ||= safeName !== name || safeEntry !== entry;
+			return [safeName, safeEntry];
+		})).toString();
+		const provider = source !== void 0 || /(?:^|\.)(?:alchemy\.com|alchemyapi\.io|infura\.io)$/iu.test(url.hostname);
+		const segments = (absolute || protocolRelative ? url.pathname : value.split(/[?#]/u)[0] ?? "").split("/");
+		const path = segments.map((segment, index) => {
+			const decoded = decodeUrlComponent(segment);
+			const masked = provider && /^v[23]$/u.test(decodeUrlComponent(segments[index - 1] ?? "")) && decoded.length > 0 ? "[REDACTED]" : maskText(decoded);
+			changed ||= masked !== decoded;
+			return masked === decoded ? segment : encodeURIComponent(masked);
+		}).join("/");
+		const query = maskParams(url.searchParams);
+		const fragment = url.hash.slice(1);
+		const decodedFragment = decodeUrlComponent(fragment);
+		const maskedFragment = maskText(decodedFragment);
+		changed ||= maskedFragment !== decodedFragment;
+		const fragmentQuery = fragment.indexOf("?");
+		const fragmentPath = fragment.slice(0, fragmentQuery);
+		const maskedFragmentPath = maskText(decodeUrlComponent(fragmentPath));
+		changed ||= maskedFragmentPath !== decodeUrlComponent(fragmentPath);
+		const hash = fragmentQuery >= 0 ? `${maskedFragmentPath === decodeUrlComponent(fragmentPath) ? fragmentPath : encodeURIComponent(maskedFragmentPath)}?${maskParams(new URLSearchParams(fragment.slice(fragmentQuery + 1)))}` : fragment.includes("=") ? maskParams(new URLSearchParams(fragment)) : maskedFragment === decodedFragment ? fragment : encodeURIComponent(maskedFragment);
+		const origin = absolute ? url.origin : protocolRelative ? `//${url.host}` : "";
+		if (!changed) return value;
+		return `${origin}${path}${query ? `?${query}` : ""}${hash ? `#${hash}` : ""}`;
+	} catch {
+		return maskText(value.replace(/(https?:\/\/)[^/\s@]+@/giu, "$1[REDACTED]@").replace(/([?&#])([^=&#]+)=([^&#]*)/gu, (whole, separator, name) => isCredentialField(decodeUrlComponent(name)) || /^(?:code|draft|__posthog)$/iu.test(decodeUrlComponent(name)) ? `${separator}${name}=[REDACTED]` : whole));
+	}
+}
+const JSON_FIELD = /("(?:[^"\\]|\\.)*")(\s*:\s*)("(?:[^"\\]|\\.)*"|-?\d+(?:\.\d+)?(?:[eE][+-]?\d+)?|true|false|null)/gu;
+const PROSE_FIELD = /(?=(\b([A-Za-z][A-Za-z0-9_-]*(?:[ \t]+[A-Za-z][A-Za-z0-9_-]*){0,3})\s*[:=]\s*((?:Bearer|Basic)[ \t]+[^\s,;"']+|"(?:[^"\\]|\\.)*"|'(?:[^'\\]|\\.)*'|[^\s,;&"']+)))/gu;
+const EMBEDDED_URL = /(https?:\/\/[^\s"<>]*)/giu;
+function isSecretLabel(name) {
+	return isCredentialField(name) || /^request[ _-]?body$/iu.test(name);
+}
+const JSON_ENCODING_MAX = 8;
+const JSON_NESTING_MAX = 64;
+const JSON_KEY = /("(?:[^"\\]|\\.)*")\s*:/gu;
+const JSON_CONTAINER_START = /(?:\{\s*["}]|\[\s*[[\]{}"0-9tfn-])/uy;
+function hasSecretJsonKey(value) {
+	for (const match of value.matchAll(JSON_KEY)) try {
+		if (match[1] !== void 0 && isSecretLabel(JSON.parse(match[1]))) return true;
+	} catch {}
+	return false;
+}
+/** Project a complete fragment once. Never retry all of its nested substrings. */
+function projectJsonFragment(value, encodingDepth, overDepth) {
+	if (overDepth || encodingDepth >= JSON_ENCODING_MAX) return "[REDACTED]";
+	let parsed;
+	try {
+		parsed = JSON.parse(value);
+	} catch {
+		return hasSecretJsonKey(value) ? "[REDACTED]" : value;
+	}
+	try {
+		let changed = false;
+		const masked = JSON.stringify(parsed, (name, nested) => {
+			if (isSecretLabel(name)) {
+				changed ||= nested !== "[REDACTED]";
+				return "[REDACTED]";
+			}
+			if (typeof nested === "string") {
+				const projected = maskJsonFragments(nested, encodingDepth + 1);
+				changed ||= projected !== nested;
+				return projected;
+			}
+			return nested;
+		});
+		return changed ? masked : value;
+	} catch {
+		return "[REDACTED]";
+	}
+}
+/** Scan balanced object/array fragments once, respecting JSON quotes and escapes. */
+function maskJsonFragments(value, encodingDepth = 0) {
+	if (value.trimStart().startsWith("\"")) try {
+		const decoded = JSON.parse(value);
+		if (typeof decoded === "string") {
+			if (encodingDepth >= JSON_ENCODING_MAX) return "\"[REDACTED]\"";
+			const masked = maskJsonFragments(decoded, encodingDepth + 1);
+			return masked === decoded ? value : JSON.stringify(masked);
+		}
+	} catch {}
+	let output = "";
+	let cursor = 0;
+	let start = -1;
+	let depth = 0;
+	let overDepth = false;
+	let quoted = false;
+	let escaped = false;
+	for (let index = 0; index < value.length; index++) {
+		const character = value[index];
+		if (start < 0) {
+			JSON_CONTAINER_START.lastIndex = index;
+			if (!JSON_CONTAINER_START.test(value)) continue;
+			start = index;
+			depth = 1;
+			overDepth = false;
+			continue;
+		}
+		if (quoted) {
+			if (escaped) escaped = false;
+			else if (character === "\\") escaped = true;
+			else if (character === "\"") quoted = false;
+			continue;
+		}
+		if (character === "\"") quoted = true;
+		else if (character === "{" || character === "[") {
+			depth++;
+			overDepth ||= depth > JSON_NESTING_MAX;
+		} else if (character === "}" || character === "]") {
+			depth--;
+			if (depth !== 0) continue;
+			output += value.slice(cursor, start) + projectJsonFragment(value.slice(start, index + 1), encodingDepth, overDepth);
+			cursor = index + 1;
+			start = -1;
+		}
+	}
+	if (start >= 0) {
+		const fragment = value.slice(start);
+		output += value.slice(cursor, start) + (overDepth || hasSecretJsonKey(fragment) ? "[REDACTED]" : fragment);
+		cursor = value.length;
+	}
+	return output + value.slice(cursor);
+}
+function maskLabelledText(value) {
+	const jsonMasked = maskJsonFragments(value).replace(JSON_FIELD, (whole, quotedName, separator) => {
+		try {
+			return isSecretLabel(JSON.parse(quotedName)) ? `${quotedName}${separator}"[REDACTED]"` : whole;
+		} catch {
+			return whole;
+		}
+	});
+	let output = "";
+	let cursor = 0;
+	for (const match of jsonMasked.matchAll(PROSE_FIELD)) {
+		const [, whole, label, entry] = match;
+		if (whole === void 0 || label === void 0 || entry === void 0 || match.index < cursor || /^Bearer[ \t]+/iu.test(entry)) continue;
+		const words = label.split(/[ \t]+/u);
+		for (let index = 0; index < words.length; index++) {
+			const name = words.slice(index).join(" ");
+			if (isSecretLabel(name)) {
+				const prefix = words.slice(0, index).join(" ");
+				output += jsonMasked.slice(cursor, match.index) + `${prefix ? `${prefix} ` : ""}${name}=[REDACTED]`;
+				cursor = match.index + whole.length;
+				break;
+			}
+		}
+	}
+	return output + jsonMasked.slice(cursor);
+}
+const TOKEN_MASKS = [
+	[/\bBearer\s+(?!(?:realm|error|error_description|scope|authorization_uri|resource|claims)\s*=)[^\s,;"']+/giu, "Bearer [REDACTED]"],
 	[/\beyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\b/gu, "[REDACTED]"],
 	[/(^|[^a-fA-F0-9])(?<!0[xX])[a-fA-F0-9]{64}(?=$|[^a-fA-F0-9])/gu, "$1[REDACTED]"],
-	[/(?:(?:sk|pk|rk)_(?:live|test)|(?:phc|phx|ghp|gho|ghu|ghs|ghr|whsec)_|github_pat_|xox[baprs]-|AKIA[0-9A-Z]{16}|AIza)[A-Za-z0-9_-]*/giu, "[REDACTED]"],
-	[/(https?:\/\/[^\s"']+?\/v[0-9]\/)[A-Za-z0-9_-]{16,}/giu, "$1[REDACTED]"],
-	[/\b(api[ _-]?key|access[ _-]?token|token|secret|password|passphrase|private[ _-]?key|authorization|cookie|signature|request[ _-]?body|credential|otp|one[ _-]?time[ _-]?(?:password|code)|verification[ _-]?code)\b\s*[:=]\s*(?:"[^"]*"|'[^']*'|[^\s,;&]+)/giu, "$1=[REDACTED]"]
+	[/(?:(?:sk|pk|rk)_(?:live|test)|(?:phc|phx|ghp|gho|ghu|ghs|ghr|whsec)_|github_pat_|xox[baprs]-|AKIA[0-9A-Z]{16}|AIza)[A-Za-z0-9_-]*/giu, "[REDACTED]"]
 ];
-/**
-* Reject: does the value carry any known secret material? Best effort — callers
-* drop the whole value on a match; a false negative is a leak, a false positive
-* merely omits an observation field.
-*/
+/** URL components and malformed URLs use this non-recursive masking layer. */
+function maskText(value) {
+	let text = maskLabelledText(value);
+	for (const [pattern, replacement] of TOKEN_MASKS) text = text.replace(pattern, replacement);
+	return text;
+}
+/** Reject only when the same semantic sanitizer removes credential material. */
 function containsSensitiveMaterial(value) {
-	return SENSITIVE_MATERIAL_PATTERNS.some((pattern) => pattern.test(value));
+	return redactSecrets(value) !== value;
 }
-/**
-* Mask: return the value with every known secret rewritten to `[REDACTED]`,
-* preserving surrounding text. Used where a value must still be shown (log
-* lines, provider messages, PostHog rows) but must not carry live credentials.
-*/
-function redactSecrets(value) {
-	let text = value;
-	for (const [pattern, replacement] of MASKS) text = text.replace(pattern, replacement);
-	return text;
+/** Mask credential fields and embedded URLs while preserving surrounding evidence. */
+function redactSecrets(value, source) {
+	return maskLabelledText(value).split(EMBEDDED_URL).map((part, index) => index % 2 === 1 ? redactUrlSecrets(part, source).replaceAll("%5BREDACTED%5D", "[REDACTED]") : maskText(part)).join("");
 }
 //#endregion
 //#region ../errors/src/chain-cause.ts
@@ -605,7 +841,29 @@ function decodeConvexError(err) {
 /** Canonical handle syntax shared by validation and branded constructors. */
 const HANDLE_RE = /^[a-z0-9_-]{3,30}$/;
 //#endregion
+//#region ../config/src/handle.ts
+const RESERVED_HANDLES = /* @__PURE__ */ new Set([
+	"admin",
+	"api",
+	"capxul",
+	"help",
+	"root",
+	"support",
+	"system",
+	"www"
+]);
+function normalizeHandle(raw) {
+	return raw.trim().toLowerCase().replace(/^@/, "");
+}
+function validateHandle(raw) {
+	const handle = normalizeHandle(raw);
+	if (!HANDLE_RE.test(handle)) throw Errors.invalidInput("handle", "must be 3-30 characters of a-z, 0-9, underscore, or hyphen");
+	if (RESERVED_HANDLES.has(handle)) throw Errors.invalidInput("handle", "handle is reserved");
+	return handle;
+}
+//#endregion
 //#region ../types/src/index.ts
+const ASSET_ID_RE = /^eip155:([1-9][0-9]*)\/erc20:(0x[0-9a-f]{40})$/;
 const EVM_ADDRESS_RE = /^0x[0-9a-f]{40}$/i;
 const BYTES32_RE = /^0x[0-9a-f]{64}$/i;
 const ZERO_BYTES32 = `0x${"0".repeat(64)}`;
@@ -644,6 +902,7 @@ const COUNTRY_CODE_RE = /^[A-Z]{2}$/;
 const ACCOUNT_ID_RE = /^account_[0-9A-Za-z]+$/;
 const PARTY_ID_RE = /^party_[0-9A-Za-z]+$/;
 const APP_ID_RE = /^app_[0-7][0-9A-HJKMNP-TV-Z]{25}$/;
+const TX_HASH_RE = /^0x[0-9a-f]{64}$/i;
 const WEI_RE = /^[0-9]+$/;
 Math.floor(Number.MAX_SAFE_INTEGER / 1e3);
 function toAddress(raw) {
@@ -699,6 +958,10 @@ function toPublishableKey(raw) {
 	if (typeof raw !== "string" || !PUBLISHABLE_KEY_PATTERN.test(raw)) throw Errors.invalidInput("publishableKey", invalidValueReason("must match cap_pk_(test|live) plus 32 Crockford base32 chars", raw));
 	return raw;
 }
+function toTxHash(raw) {
+	if (typeof raw !== "string" || !TX_HASH_RE.test(raw)) throw Errors.invalidInput("txHash", invalidValueReason("must be 0x + 64 hex chars", raw));
+	return raw.toLowerCase();
+}
 function toEpochMs(raw) {
 	assertSafeNonNegativeInteger(raw, "epochMs");
 	return raw;
@@ -707,6 +970,17 @@ function toEpochSeconds(raw) {
 	assertSafeNonNegativeInteger(raw, "epochSeconds");
 	return raw;
 }
+/** Validate an already canonical identity without changing signed input. */
+function toAssetId(raw) {
+	const match = typeof raw === "string" ? ASSET_ID_RE.exec(raw) : null;
+	if (match === null || match[0] !== raw || !Number.isSafeInteger(Number(match[1]))) throw Errors.invalidInput("assetId", "must be a canonical ERC-20 CAIP-19 identifier");
+	if (match[2] === "0x0000000000000000000000000000000000000000") throw Errors.invalidInput("assetId", "must identify a nonzero token contract");
+	return raw;
+}
+/** Build an identity from verified chain facts. Normalize the token address. */
+function assetIdFor(chainId, tokenAddress) {
+	return toAssetId(`eip155:${toChainId(chainId)}/erc20:${toAddress(tokenAddress)}`);
+}
 function toChainId(raw) {
 	if (typeof raw !== "number" || !Number.isSafeInteger(raw) || raw <= 0) throw Errors.invalidInput("chainId", invalidValueReason("must be a positive safe integer", raw));
 	return raw;
@@ -769,31 +1043,121 @@ function invalidValueReason(prefix, raw) {
 	return `${prefix}: ${String(raw)}`;
 }
 //#endregion
-//#region ../config/src/handle.ts
-const RESERVED_HANDLES = /* @__PURE__ */ new Set([
-	"admin",
-	"api",
-	"capxul",
-	"help",
-	"root",
-	"support",
-	"system",
-	"www"
-]);
-function normalizeHandle(raw) {
-	return raw.trim().toLowerCase().replace(/^@/, "");
-}
-function validateHandle(raw) {
-	const handle = normalizeHandle(raw);
-	if (!HANDLE_RE.test(handle)) throw Errors.invalidInput("handle", "must be 3-30 characters of a-z, 0-9, underscore, or hyphen");
-	if (RESERVED_HANDLES.has(handle)) throw Errors.invalidInput("handle", "handle is reserved");
-	return handle;
-}
-//#endregion
 //#region ../config/src/tokens.ts
 /** `TestUSDC` ("USDX") — Base Sepolia, 6 decimals, open `mint`. (Canon §1.) */
 const USDX_ADDRESS_BASE_SEPOLIA = "0xf09fcbb6df9f8f918e58f9c8ab15a76ade862b77";
-USDX_ADDRESS_BASE_SEPOLIA.toLowerCase();
+const USDX_DEPLOYMENT_START_BLOCK = 39860173;
+/**
+* The ERC-20 `symbol()` the deployed `TestUSDC` contract returns
+* (`packages/contracts/src/TestUSDC.sol:10`). It travels with the address and
+* the decimals so a holdings row can never carry one token's address with
+* another token's display symbol. This is the display symbol, not the
+* currency: see `USDX_CURRENCY` below.
+*/
+const USDX_SYMBOL = "USDX";
+const SYNTHETIC_TEST_ASSET_SOURCE = "synthetic-test-liquidity";
+const USDX_ASSET = {
+	assetId: assetIdFor(84532, USDX_ADDRESS_BASE_SEPOLIA),
+	chainId: toChainId(84532),
+	symbol: USDX_SYMBOL,
+	peg: toCurrencyCode("USD"),
+	tokenAddress: USDX_ADDRESS_BASE_SEPOLIA,
+	deploymentStartBlock: USDX_DEPLOYMENT_START_BLOCK,
+	decimals: 6,
+	source: "settlement"
+};
+/**
+* The settlement tier: rows the exact-transfer path and the Movement scanner
+* admit, each carrying the legacy `currency` projection those readers expect.
+* Adding an owned test asset here would put candidate liquidity on the
+* money-write path, so M03's rows go to the candidate tier below instead.
+*/
+const CONFIGURED_MONEY_ASSETS = [{
+	...USDX_ASSET,
+	currency: USDX_ASSET.peg
+}];
+/**
+* The candidate tier: five owned test assets, every field read back from Base
+* Sepolia after the deployment that created it (chain 84532, blocks
+* 46,465,978–46,465,982). Real contracts, authored liquidity, no settlement
+* admission — so rollback is removing consumers, never relabelling a
+* deployed address or deleting its history.
+*
+* `symbol` is the display string the owned contract returns. A
+* provider-supported USDC would be a different contract at a different
+* address returning the same symbol, which is why the resolvers below key on
+* `assetId`, or on chain plus address, and never on a symbol.
+*/
+const SYNTHETIC_TEST_ASSETS = [
+	{
+		assetId: assetIdFor(84532, "0xb3d8566fb90f7df939f4bc08a09b19047117f549"),
+		chainId: toChainId(84532),
+		tokenAddress: "0xb3d8566fb90f7df939f4bc08a09b19047117f549",
+		symbol: "USDC",
+		decimals: 6,
+		peg: toCurrencyCode("USD"),
+		deploymentStartBlock: 46465978,
+		deploymentTransaction: "0xa7fb8bb9d1fd1cc5fe2fc42fa4cdccace7742efae8ea99f091a283e5709343de",
+		source: SYNTHETIC_TEST_ASSET_SOURCE
+	},
+	{
+		assetId: assetIdFor(84532, "0x7ddcfb6aaffb9908c4c2db308b784c269eec8a01"),
+		chainId: toChainId(84532),
+		tokenAddress: "0x7ddcfb6aaffb9908c4c2db308b784c269eec8a01",
+		symbol: "USDT",
+		decimals: 6,
+		peg: toCurrencyCode("USD"),
+		deploymentStartBlock: 46465979,
+		deploymentTransaction: "0xa17ad76fe8b24cdf1fbcff245c3eb022444710cf9fa7b5ee59818be654f4ae10",
+		source: SYNTHETIC_TEST_ASSET_SOURCE
+	},
+	{
+		assetId: assetIdFor(84532, "0x1d93d525f73453fe18eebf044e8a3954bfe3721e"),
+		chainId: toChainId(84532),
+		tokenAddress: "0x1d93d525f73453fe18eebf044e8a3954bfe3721e",
+		symbol: "WETH",
+		decimals: 18,
+		peg: null,
+		deploymentStartBlock: 46465980,
+		deploymentTransaction: "0xcb9b2d024686fac93ec1243ccf02d3567fd531da46176115660cba2ba644b09d",
+		source: SYNTHETIC_TEST_ASSET_SOURCE
+	},
+	{
+		assetId: assetIdFor(84532, "0x8fe52c70aa9f7b6d74d8bb26eca33d87413cb624"),
+		chainId: toChainId(84532),
+		tokenAddress: "0x8fe52c70aa9f7b6d74d8bb26eca33d87413cb624",
+		symbol: "WBTC",
+		decimals: 8,
+		peg: null,
+		deploymentStartBlock: 46465981,
+		deploymentTransaction: "0x728ba7b430ffd141f83d0ed5ce429d050049d7b097c936fd11e9c572d1243854",
+		source: SYNTHETIC_TEST_ASSET_SOURCE
+	},
+	{
+		assetId: assetIdFor(84532, "0x5865fe9787ac214feb5facaebaec06969ac0a9a3"),
+		chainId: toChainId(84532),
+		tokenAddress: "0x5865fe9787ac214feb5facaebaec06969ac0a9a3",
+		symbol: "cNGN",
+		decimals: 6,
+		peg: toCurrencyCode("NGN"),
+		deploymentStartBlock: 46465982,
+		deploymentTransaction: "0xcedf254bcef57fc64189261a5ab1161bc4fde370e470933f627c4d8ddb5a2e26",
+		source: SYNTHETIC_TEST_ASSET_SOURCE
+	}
+];
+toChainId(84532);
+/**
+* Every known asset in ONE identity space. The tiers above declare admission;
+* this is the only list an identity resolves against, so an asset is never
+* two different things depending on which list a caller happened to read.
+*/
+const MONEY_ASSET_REGISTRY = [...CONFIGURED_MONEY_ASSETS, ...SYNTHETIC_TEST_ASSETS];
+CONFIGURED_MONEY_ASSETS.map((asset) => asset.tokenAddress.toLowerCase());
+/** The registry row for `assetId` across every tier, or `null`. */
+function configuredMoneyAssetById(assetId) {
+	const canonical = toAssetId(assetId);
+	return MONEY_ASSET_REGISTRY.find((asset) => asset.assetId === canonical) ?? null;
+}
 //#endregion
 //#region ../config/src/org-payments.ts
 /** Zodiac MultiSendCallOnly module on Base Sepolia. */
@@ -1682,6 +2046,12 @@ const USDX_BASE_SEPOLIA_TOKEN = {
 USDX_BASE_SEPOLIA_TOKEN.chainId;
 USDX_BASE_SEPOLIA_TOKEN.chainId;
 10n ** BigInt(6);
+/**
+* The bootstrap manage role. It administers people and roles, cannot spend,
+* and is not a signer of the Organization Safe; "Owner" implied the latter,
+* so the label is Admin (ruled 2026-09-06).
+*/
+const ADMIN_ROLE_LABEL = "Admin";
 function normalizeOrgRoleLabel(label) {
 	const normalized = label.trim().replace(/\s+/g, " ");
 	if (normalized.length === 0) throw Errors.invalidInput("role.label", "must be a non-empty role label");
@@ -1762,6 +2132,26 @@ function errorKind(error) {
 var ClockError = class extends Data.TaggedError("ClockError") {};
 var ClockPortTag = class extends Context.Service()("@capxul/sdk/ports/ClockPort") {};
 //#endregion
+//#region src/adapters/clock/SystemClockAdapter.ts
+var SystemClockAdapter = class {
+	now = Effect.try({
+		try: () => toEpochMs(Date.now()),
+		catch: (cause) => new ClockError({
+			operation: "now",
+			cause
+		})
+	});
+	sleep(duration) {
+		return Effect.callback((resume) => {
+			const timeout = setTimeout(() => resume(Effect.void), duration);
+			return Effect.sync(() => clearTimeout(timeout));
+		});
+	}
+};
+function SystemClockLayer() {
+	return Layer.succeed(ClockPortTag, new SystemClockAdapter());
+}
+//#endregion
 //#region src/ports/auth-cache.ts
 var AuthCacheError = class extends Data.TaggedError("AuthCacheError") {};
 var AuthCachePortTag = class extends Context.Service()("@capxul/sdk/ports/AuthCachePort") {};
@@ -1890,4 +2280,192 @@ async function readClockNow(clock) {
 	}
 }
 //#endregion
-export { CapxulError as $, toAuthUserId as A, toJwtToken as B, WEI_RE as C, toAddress as D, toAccountId as E, toDurationMs as F, toPayrollRunId as G, toOrgId as H, toEmail as I, toSessionToken as J, toPublishableKey as K, toEpochMs as L, toChainId as M, toCountryCode as N, toAllowedOrigin as O, toCurrencyCode as P, CAPXUL_ERROR_CODES as Q, toEpochSeconds as R, SUPPORTED_CURRENCY_CODES as S, currencySymbolFor as T, toPartyId as U, toKycTier as V, toPayrollGroupId as W, HANDLE_RE as X, toTesterKind as Y, decodeConvexError as Z, deriveCapxulSafeAddress as _, parseCachedJwt as a, boundedResponseHeaders as at, BYTES32_RE as b, ClockError as c, decodeChainCause as ct, AuthClientError as d, isFailureMode as dt, EXPECTED_OPERATION_OUTCOMES as et, AuthClientPortTag as f, revertSummaryText as ft, BASE_SEPOLIA_CHAIN_ID as g, normalizeBindingEmail as h, parseAuthSession as i, FAILURE_MODES as it, toBudgetId as j, toAppId as k, ClockPortTag as l, failureFingerprint as lt, CAPXUL_PAYMENTS_V2_ADDRESS as m, redactSecrets as mt, InMemoryAuthCacheAdapter as n, isCapxulError as nt, AuthCacheError as o, chainCauseProperties as ot, orgRoleKeyForLabel as p, containsSensitiveMaterial as pt, toRoleKey as q, BrowserAuthCacheAdapter as r, CHAIN_UPSTREAMS as rt, AuthCachePortTag as s, chainEvidenceLabel as st, readClockNow as t, Errors as tt, authClientPortFromPromiseAdapter as u, isChainUpstream as ut, validateHandle as v, ZERO_BYTES32 as w, EVM_ADDRESS_RE as x, APP_ID_RE as y, toHandle as z };
+//#region src/adapters/auth-client/OAuthBearerAuthClient.ts
+const PROVIDER = "agent-exchange";
+/** Re-exchange this far ahead of expiry, matching the JWT cache eviction margin. */
+const REFRESH_MARGIN_MS = 3e4;
+/**
+* `AuthSession.token` is a Better Auth session handle. This flow has none, and
+* the access token must never be copied into it, so the slot holds a placeholder.
+*/
+const OAUTH_SESSION_TOKEN = toSessionToken("oauth-bearer");
+var OAuthBearerAuthClient = class {
+	#exchangeUrl;
+	#exchangeSecret;
+	#accessToken;
+	#fetchImpl;
+	#clock;
+	#cached = null;
+	constructor(input) {
+		this.#exchangeUrl = input.exchangeUrl;
+		this.#exchangeSecret = input.exchangeSecret;
+		this.#accessToken = input.accessToken;
+		this.#fetchImpl = input.fetch ?? fetch;
+		this.#clock = input.clock ?? new SystemClockAdapter();
+	}
+	async canSendOtp() {
+		return refuse("canSendOtp");
+	}
+	async sendOtp() {
+		return refuse("sendOtp");
+	}
+	async verifyOtp() {
+		return refuse("verifyOtp");
+	}
+	/**
+	* The authorization server owns the token's lifetime, so revoking it there is
+	* the sign-out. Reporting success here would claim a token was dropped.
+	*/
+	async signOut() {
+		return refuse("signOut");
+	}
+	/**
+	* The exchanged identity. Unlike the Better Auth adapters this never answers
+	* `null`: the consumer holds a usable access token or a refused one, and a
+	* refused one is a NOT_AUTHENTICATED failure, not the absence of a session.
+	*/
+	async getSession(options) {
+		const exchange = await this.#exchange("getSession", options);
+		if (!exchange.ok) return exchange;
+		return {
+			ok: true,
+			value: {
+				authUserId: toAuthUserId(exchange.value.authUserId),
+				email: toEmail(exchange.value.email),
+				token: OAUTH_SESSION_TOKEN,
+				expiresAt: toEpochMs(exchange.value.expiresAt)
+			}
+		};
+	}
+	async getConvexJwt(options) {
+		const exchange = await this.#exchange("getConvexJwt", options);
+		if (!exchange.ok) return exchange;
+		return {
+			ok: true,
+			value: {
+				token: toJwtToken(exchange.value.token),
+				expEpochSeconds: toEpochSeconds(Math.floor(exchange.value.expiresAt / 1e3))
+			}
+		};
+	}
+	/**
+	* The cached exchange while it is fresh, otherwise a new one. A failed
+	* exchange never replaces the cache, so a stale token is never served.
+	*
+	* lazy: no in-flight de-duplication — two concurrent reads past the margin
+	* each mint a JWT. Minting is idempotent, so the cost is one extra request.
+	*/
+	async #exchange(operation, options) {
+		if (options?.signal?.aborted) return {
+			ok: false,
+			error: Errors.cancelled({ operation })
+		};
+		const cached = this.#cached;
+		if (cached !== null && options?.forceRefresh !== true) {
+			const now = await readClockNow(this.#clock);
+			if (!now.ok) return now;
+			if (now.value < cached.expiresAt - REFRESH_MARGIN_MS) return {
+				ok: true,
+				value: cached
+			};
+		}
+		return this.#postExchange(operation, options?.signal);
+	}
+	async #postExchange(operation, signal) {
+		let res;
+		try {
+			res = await this.#fetchImpl(this.#exchangeUrl, {
+				method: "POST",
+				headers: {
+					"content-type": "application/json",
+					authorization: `Bearer ${this.#exchangeSecret}`
+				},
+				body: JSON.stringify({ accessToken: this.#accessToken }),
+				...signal === void 0 ? {} : { signal }
+			});
+		} catch (cause) {
+			return {
+				ok: false,
+				error: signal?.aborted === true || isAbortError(cause) ? Errors.cancelled({ operation }) : Errors.networkError(operation, cause)
+			};
+		}
+		if (signal?.aborted === true) return {
+			ok: false,
+			error: Errors.cancelled({ operation })
+		};
+		const body = await res.json().catch(() => null);
+		if (!res.ok) return {
+			ok: false,
+			error: exchangeRefused(operation, res.status, readErrorCode(body))
+		};
+		const exchange = readExchange(body);
+		if (exchange === null) return {
+			ok: false,
+			error: Errors.providerError(PROVIDER, operation, /* @__PURE__ */ new Error("unexpected body"), { httpStatus: res.status })
+		};
+		this.#cached = exchange;
+		return {
+			ok: true,
+			value: exchange
+		};
+	}
+};
+/**
+* `AuthClientPort` over the backend agent-token exchange. Build one per OAuth
+* access token and hand it to `createCapxulClient({ authClient })`.
+*/
+function oauthBearerAuthClient(input) {
+	return authClientPortFromPromiseAdapter(new OAuthBearerAuthClient(input));
+}
+/** The OTP verbs belong to the email flow; `validStates` names it for the caller. */
+function refuse(method) {
+	return {
+		ok: false,
+		error: Errors.wrongState({
+			method,
+			currentState: "oauth-bearer",
+			validStates: ["email-otp"]
+		})
+	};
+}
+/**
+* The error catalog has no FORBIDDEN code, so 403 (`insufficient_scope`) and
+* 503 (`exchange_unconfigured`) both land on PROVIDER_ERROR. `httpStatus` and
+* `details.reason` carry which one the backend reported. Only 401 becomes
+* NOT_AUTHENTICATED, because only 401 is answered by a new access token.
+*/
+function exchangeRefused(operation, status, reason) {
+	if (status === 401) return Errors.notAuthenticated("The exchange refused this OAuth access token");
+	return Errors.providerError(PROVIDER, operation, /* @__PURE__ */ new Error(`HTTP ${status}`), {
+		httpStatus: status,
+		...reason === void 0 ? {} : { details: { reason } }
+	});
+}
+/** An abort raised by something other than the caller's own signal. */
+function isAbortError(cause) {
+	return readField(cause, "name") === "AbortError";
+}
+function readErrorCode(body) {
+	const error = readField(body, "error");
+	return typeof error === "string" ? error : void 0;
+}
+function readField(value, key) {
+	if (typeof value !== "object" || value === null) return void 0;
+	return value[key];
+}
+function readExchange(body) {
+	if (typeof body !== "object" || body === null) return null;
+	const { token, expiresAt, authUserId, email } = body;
+	if (typeof token !== "string" || token.length === 0) return null;
+	if (typeof expiresAt !== "number" || !Number.isFinite(expiresAt)) return null;
+	if (typeof authUserId !== "string" || authUserId.length === 0) return null;
+	if (typeof email !== "string" || email.length === 0) return null;
+	return {
+		token,
+		expiresAt,
+		authUserId,
+		email
+	};
+}
+//#endregion
+export { toRoleKey as $, currencySymbolFor as A, toCurrencyCode as B, ASSET_ID_RE as C, redactSecrets as Ct, WEI_RE as D, SUPPORTED_CURRENCY_CODES as E, toAssetId as F, toHandle as G, toEmail as H, toAuthUserId as I, toOrgId as J, toJwtToken as K, toBudgetId as L, toAddress as M, toAllowedOrigin as N, ZERO_BYTES32 as O, toAppId as P, toPublishableKey as Q, toChainId as R, APP_ID_RE as S, isCredentialField as St, EVM_ADDRESS_RE as T, toEpochMs as U, toDurationMs as V, toEpochSeconds as W, toPayrollGroupId as X, toPartyId as Y, toPayrollRunId as Z, normalizeBindingEmail as _, failureFingerprint as _t, parseAuthSession as a, decodeConvexError as at, configuredMoneyAssetById as b, revertSummaryText as bt, AuthCachePortTag as c, EXPECTED_OPERATION_OUTCOMES as ct, authClientPortFromPromiseAdapter as d, CHAIN_UPSTREAMS as dt, toSessionToken as et, AuthClientError as f, FAILURE_MODES as ft, CAPXUL_PAYMENTS_V2_ADDRESS as g, decodeChainCause as gt, orgRoleKeyForLabel as h, chainEvidenceLabel as ht, BrowserAuthCacheAdapter as i, HANDLE_RE as it, toAccountId as j, assetIdFor as k, SystemClockLayer as l, Errors as lt, ADMIN_ROLE_LABEL as m, chainCauseProperties as mt, readClockNow as n, toTxHash as nt, parseCachedJwt as o, CAPXUL_ERROR_CODES as ot, AuthClientPortTag as p, boundedResponseHeaders as pt, toKycTier as q, InMemoryAuthCacheAdapter as r, validateHandle as rt, AuthCacheError as s, CapxulError as st, oauthBearerAuthClient as t, toTesterKind as tt, ClockPortTag as u, isCapxulError as ut, BASE_SEPOLIA_CHAIN_ID as v, isChainUpstream as vt, BYTES32_RE as w, redactUrlSecrets as wt, ACCOUNT_ID_RE as x, containsSensitiveMaterial as xt, deriveCapxulSafeAddress as y, isFailureMode as yt, toCountryCode as z };