@capxul/sdk 4.2.0-rc.10 → 4.2.0-rc.12

package/dist/{OAuthBearerAuthClient-IB2W1Fzj.mjs → OAuthBearerAuthClient-CbU_W9Sp.mjs}

@@ -985,6 +985,10 @@ function toChainId(raw) {
 	if (typeof raw !== "number" || !Number.isSafeInteger(raw) || raw <= 0) throw Errors.invalidInput("chainId", invalidValueReason("must be a positive safe integer", raw));
 	return raw;
 }
+function toWeiAmount(raw) {
+	if (typeof raw !== "string" || !WEI_RE.test(raw)) throw Errors.invalidInput("weiAmount", invalidValueReason("must be a non-negative integer string", raw));
+	return raw;
+}
 function toCountryCode(raw) {
 	if (typeof raw !== "string") throw Errors.invalidInput("countryCode", "must be a string");
 	const upper = raw.toUpperCase();
@@ -2468,4 +2472,4 @@ function readExchange(body) {
 	};
 }
 //#endregion
-export { toRoleKey as $, currencySymbolFor as A, toCurrencyCode as B, ASSET_ID_RE as C, redactSecrets as Ct, WEI_RE as D, SUPPORTED_CURRENCY_CODES as E, toAssetId as F, toHandle as G, toEmail as H, toAuthUserId as I, toOrgId as J, toJwtToken as K, toBudgetId as L, toAddress as M, toAllowedOrigin as N, ZERO_BYTES32 as O, toAppId as P, toPublishableKey as Q, toChainId as R, APP_ID_RE as S, isCredentialField as St, EVM_ADDRESS_RE as T, toEpochMs as U, toDurationMs as V, toEpochSeconds as W, toPayrollGroupId as X, toPartyId as Y, toPayrollRunId as Z, normalizeBindingEmail as _, failureFingerprint as _t, parseAuthSession as a, decodeConvexError as at, configuredMoneyAssetById as b, revertSummaryText as bt, AuthCachePortTag as c, EXPECTED_OPERATION_OUTCOMES as ct, authClientPortFromPromiseAdapter as d, CHAIN_UPSTREAMS as dt, toSessionToken as et, AuthClientError as f, FAILURE_MODES as ft, CAPXUL_PAYMENTS_V2_ADDRESS as g, decodeChainCause as gt, orgRoleKeyForLabel as h, chainEvidenceLabel as ht, BrowserAuthCacheAdapter as i, HANDLE_RE as it, toAccountId as j, assetIdFor as k, SystemClockLayer as l, Errors as lt, ADMIN_ROLE_LABEL as m, chainCauseProperties as mt, readClockNow as n, toTxHash as nt, parseCachedJwt as o, CAPXUL_ERROR_CODES as ot, AuthClientPortTag as p, boundedResponseHeaders as pt, toKycTier as q, InMemoryAuthCacheAdapter as r, validateHandle as rt, AuthCacheError as s, CapxulError as st, oauthBearerAuthClient as t, toTesterKind as tt, ClockPortTag as u, isCapxulError as ut, BASE_SEPOLIA_CHAIN_ID as v, isChainUpstream as vt, BYTES32_RE as w, redactUrlSecrets as wt, ACCOUNT_ID_RE as x, containsSensitiveMaterial as xt, deriveCapxulSafeAddress as y, isFailureMode as yt, toCountryCode as z };
+export { toRoleKey as $, currencySymbolFor as A, toCurrencyCode as B, ASSET_ID_RE as C, isCredentialField as Ct, WEI_RE as D, SUPPORTED_CURRENCY_CODES as E, toAssetId as F, toHandle as G, toEmail as H, toAuthUserId as I, toOrgId as J, toJwtToken as K, toBudgetId as L, toAddress as M, toAllowedOrigin as N, ZERO_BYTES32 as O, toAppId as P, toPublishableKey as Q, toChainId as R, APP_ID_RE as S, containsSensitiveMaterial as St, EVM_ADDRESS_RE as T, redactUrlSecrets as Tt, toEpochMs as U, toDurationMs as V, toEpochSeconds as W, toPayrollGroupId as X, toPartyId as Y, toPayrollRunId as Z, normalizeBindingEmail as _, decodeChainCause as _t, parseAuthSession as a, HANDLE_RE as at, configuredMoneyAssetById as b, isFailureMode as bt, AuthCachePortTag as c, CapxulError as ct, authClientPortFromPromiseAdapter as d, isCapxulError as dt, toSessionToken as et, AuthClientError as f, CHAIN_UPSTREAMS as ft, CAPXUL_PAYMENTS_V2_ADDRESS as g, chainEvidenceLabel as gt, orgRoleKeyForLabel as h, chainCauseProperties as ht, BrowserAuthCacheAdapter as i, validateHandle as it, toAccountId as j, assetIdFor as k, SystemClockLayer as l, EXPECTED_OPERATION_OUTCOMES as lt, ADMIN_ROLE_LABEL as m, boundedResponseHeaders as mt, readClockNow as n, toTxHash as nt, parseCachedJwt as o, decodeConvexError as ot, AuthClientPortTag as p, FAILURE_MODES as pt, toKycTier as q, InMemoryAuthCacheAdapter as r, toWeiAmount as rt, AuthCacheError as s, CAPXUL_ERROR_CODES as st, oauthBearerAuthClient as t, toTesterKind as tt, ClockPortTag as u, Errors as ut, BASE_SEPOLIA_CHAIN_ID as v, failureFingerprint as vt, BYTES32_RE as w, redactSecrets as wt, ACCOUNT_ID_RE as x, revertSummaryText as xt, deriveCapxulSafeAddress as y, isChainUpstream as yt, toCountryCode as z };

package/dist/capxul-source.json

@@ -1,11 +1,11 @@
 {
   "source": {
-    "commit": "a7e55e5f1c2af5567a8b285a4ef70b8b5a3289f6",
-    "tree": "91bf1b080c0006fe30131711c13c843afd627158",
+    "commit": "fd5b4d0f124c75f609e469b8673c61f84253c0dc",
+    "tree": "d61f0f6b0c83dfc2d405ffc6b55eecf2e9d80f2d",
     "branch": "codex/programme-rc",
     "repository": "https://github.com/Xelmar-tech/infrastructure",
     "lockfileSha256": "5870f53b72706d103220c1bcf733cb4fb71196aea32a9cfbdc277d73cc959264"
   },
   "name": "@capxul/sdk",
-  "version": "4.2.0-rc.10"
+  "version": "4.2.0-rc.12"
 }

package/dist/index.d.mts

@@ -1,5 +1,5 @@
 import { $ as PayrollGroupId, B as ChainId, Ct as ChainCause, D as Account, Dt as RevertSummary, E as CAPXUL_PAYMENTS_V2_ADDRESS, Et as FailureMode, F as AssetId, G as EVM_ADDRESS_RE, H as CurrencyCode, I as AuthSession, J as Handle, L as AuthUserId, O as AccountId, P as AssetAmount, St as CHAIN_UPSTREAMS, Tt as FAILURE_MODES, V as CountryCode, X as OrgId, Y as Money, Z as PartyId, _ as Session, _t as CapxulErrorCode, a as Eip1193RequestProvider, at as RoleKey, c as injectedWalletSigner, ct as TesterKind, d as AccountRequirement, dt as toAddress, et as PayrollRunId, f as Eip1193Provider, ft as toCountryCode, g as Profile, gt as CapxulError, h as CapxulResult, ht as CAPXUL_ERROR_CODES, i as CapxulSigner, k as Address, l as AccountProvider, m as localPrivateKeyAccountProvider, mt as toPartyId, o as SignerStatus, p as eip1193AccountProvider, pt as toHandle, r as CapxulDigestSigner, s as SignerStatusStore, u as AccountProviderSource, v as SmartAccount, vt as CapxulErrorDetails, wt as ChainUpstream, xt as isCapxulError, yt as Errors, z as BudgetId } from "./OAuthBearerAuthClient-C-ip-z8M.mjs";
-import { $ as OrganizationPaymentBatchInput, $n as RequestStatus, $t as Destination, A as OrgScopedMethods, An as Ref, At as AddressBookAddInput, B as AuthorizeRunOptions, Bn as SmartAccountMethods, Bt as ActivityFilter, C as CurrentUserMethods, Cn as PaymentMoney, Ct as AccountMethods, D as MemberStatus, Dn as PaymentsMethods, Dt as ActorRequest, E as InviteMemberInput, En as PaymentType, Et as ActorRelationshipMethods, F as ResendInviteTokenInput, Fn as AccountLifecycle, Ft as InboxItem, G as PayrollGroupsMethods, Gn as ActorRef, Gt as ActivityPage, H as PayrollGroup, Hn as OrgLifecycle, Ht as ActivityKind, I as RoleDefinition, In as AccountSetupStep, It as InboxMethods, J as PayrollRun, Jn as SubmittedPermissionExecution, Jt as ActivitySummary, K as PayrollMethods, Kn as CurrentHoldings, Kt as ActivityRange, L as RoleSpendCap, Ln as isSettingUpLifecycle, Lt as ActivityAnnotation, M as OrgView, Mn as TargetReference, Mt as AddressBookLabelInput, N as OrganizationAccount, Nn as TargetsMethods, Nt as AddressBookMethods, O as MemberView, On as PaymentsPayInput, Ot as ActorRequestIssueInput, P as OrganizationAuditLogItem, Pn as fingerprintPaymentIntent, Pt as InboxApproveInput, Q as PayrollTermsUnit, Qn as PaymentStatus$1, Qt as DepositInstructions, R as RoleView, Rn as CompleteProfileInput, Rt as ActivityAnnotationInput, S as CurrentUserContext, Sn as PaymentDocumentsMethods, St as ReadyAccountLifecycle, T as DetectPendingOrgInvitationsResult, Tn as PaymentTiming, Tt as ActorProfileMethods, U as PayrollGroupInput, Un as OrgSetupStep, Ut as ActivityListParams, V as PayrollEngagementTerms, Vn as AuthMethods, Vt as ActivityItem, W as PayrollGroupMember, Wn as PayoutAddress, Wt as ActivityMethods, X as PayrollRunStatus, Xn as PAYMENT_DIRECTIONS, Xt as ActivitySummaryTotal, Y as PayrollRunItemInput, Yn as InboxStatus, Yt as ActivitySummaryParams, Z as PayrollRuns, Zn as PAYMENT_STATUSES, Zt as ActorReference, _ as HoldingsMethods, _n as PaymentDirection, _t as OnboardingMethods, a as ObservationContext, an as DestinationRemoveInput, ar as IdentityEvent, at as PermissionCreateInput, b as SystemHealth, bn as PaymentDocumentRender, bt as PersonOnboarding, c as HostObservability, cn as MeMethods, cr as Readiness, ct as PermissionReplaceInput, d as postHogObservability, dn as OfframpMethods, dr as isClaimed, dt as Budget, en as DestinationAddInput, et as OrganizationPaymentInput, f as CapxulClient, fn as OfframpQuote, fr as isRestoring, ft as OrgMe, g as IdentityRuntimeSendResult, gn as PaymentActivityEvidence, gt as CompletedPersonProfile, h as IdentityRuntime, hn as Payment, ht as AccountsMethods, i as ObservationAdapter, in as DestinationRail, ir as Destination$1, it as PermissionChangeInput, j as OrgTemplate, jn as ResolvedTarget, jt as AddressBookEntry, k as OrgMethods, kn as RecipientResolution, kt as ActorRequestsMethods, l as PostHogObservabilityClient, ln as MeProfile, lr as StateLabel, lt as PermissionRevokeInput, m as IdentityProfileDetails, mn as OfframpStatus, mr as InvocationControls, mt as OrgMeOptions, nn as DestinationListInput, nt as OrganizationPaymentsMethods, o as ObservationDelivery, on as DestinationsMethods, or as IdentityState, ot as PermissionMethods, p as CreateCapxulClientInput, pn as OfframpQuoteInput, pr as IdentityTransition, pt as OrgMeMethod, q as PayrollOptions, qn as Permission, qt as ActivityReference, r as CAPXUL_SDK_EXPECTED_OUTCOME_EVENT, rn as DestinationPayload, rr as TelemetryPort, rt as PermissionAssignInput, s as SdkFailureObservation, sn as FinancialOpsMethods, sr as OrgLane, st as PermissionOptions, t as CapxulClientInput, tn as DestinationKind, tt as OrganizationPaymentItemInput, u as PostHogObservabilityOptions, un as MovementActivityEvidence, ur as destination, ut as PermissionReadResult, v as Holding, vn as PaymentDocumentKind, vt as OrganizationOnboarding, w as CreateOrgInput, wn as PaymentStatus, wt as ActorProfile, x as MediaMethods, xn as PaymentDocumentVerification, xt as PersonOnboardingInput, y as SystemMethods, yn as PaymentDocumentRef, yt as OrganizationOnboardingInput, z as AuthorizeRunInput, zn as IdentityMethods, zt as ActivityDetail } from "./production-Du4Vc7YD.mjs";
+import { $ as OrganizationPaymentBatchInput, $n as RequestStatus, $t as Destination, A as OrgScopedMethods, An as Ref, At as AddressBookAddInput, B as AuthorizeRunOptions, Bn as SmartAccountMethods, Bt as ActivityFilter, C as CurrentUserMethods, Cn as PaymentMoney, Ct as AccountMethods, D as MemberStatus, Dn as PaymentsMethods, Dt as ActorRequest, E as InviteMemberInput, En as PaymentType, Et as ActorRelationshipMethods, F as ResendInviteTokenInput, Fn as AccountLifecycle, Ft as InboxItem, G as PayrollGroupsMethods, Gn as ActorRef, Gt as ActivityPage, H as PayrollGroup, Hn as OrgLifecycle, Ht as ActivityKind, I as RoleDefinition, In as AccountSetupStep, It as InboxMethods, J as PayrollRun, Jn as SubmittedPermissionExecution, Jt as ActivitySummary, K as PayrollMethods, Kn as CurrentHoldings, Kt as ActivityRange, L as RoleSpendCap, Ln as isSettingUpLifecycle, Lt as ActivityAnnotation, M as OrgView, Mn as TargetReference, Mt as AddressBookLabelInput, N as OrganizationAccount, Nn as TargetsMethods, Nt as AddressBookMethods, O as MemberView, On as PaymentsPayInput, Ot as ActorRequestIssueInput, P as OrganizationAuditLogItem, Pn as fingerprintPaymentIntent, Pt as InboxApproveInput, Q as PayrollTermsUnit, Qn as PaymentStatus$1, Qt as DepositInstructions, R as RoleView, Rn as CompleteProfileInput, Rt as ActivityAnnotationInput, S as CurrentUserContext, Sn as PaymentDocumentsMethods, St as ReadyAccountLifecycle, T as DetectPendingOrgInvitationsResult, Tn as PaymentTiming, Tt as ActorProfileMethods, U as PayrollGroupInput, Un as OrgSetupStep, Ut as ActivityListParams, V as PayrollEngagementTerms, Vn as AuthMethods, Vt as ActivityItem, W as PayrollGroupMember, Wn as PayoutAddress, Wt as ActivityMethods, X as PayrollRunStatus, Xn as PAYMENT_DIRECTIONS, Xt as ActivitySummaryTotal, Y as PayrollRunItemInput, Yn as InboxStatus, Yt as ActivitySummaryParams, Z as PayrollRuns, Zn as PAYMENT_STATUSES, Zt as ActorReference, _ as HoldingsMethods, _n as PaymentDirection, _t as OnboardingMethods, a as ObservationContext, an as DestinationRemoveInput, ar as IdentityEvent, at as PermissionCreateInput, b as SystemHealth, bn as PaymentDocumentRender, bt as PersonOnboarding, c as HostObservability, cn as MeMethods, cr as Readiness, ct as PermissionReplaceInput, d as postHogObservability, dn as OfframpMethods, dr as isClaimed, dt as Budget, en as DestinationAddInput, et as OrganizationPaymentInput, f as CapxulClient, fn as OfframpQuote, fr as isRestoring, ft as OrgMe, g as IdentityRuntimeSendResult, gn as PaymentActivityEvidence, gt as CompletedPersonProfile, h as IdentityRuntime, hn as Payment, ht as AccountsMethods, i as ObservationAdapter, in as DestinationRail, ir as Destination$1, it as PermissionChangeInput, j as OrgTemplate, jn as ResolvedTarget, jt as AddressBookEntry, k as OrgMethods, kn as RecipientResolution, kt as ActorRequestsMethods, l as PostHogObservabilityClient, ln as MeProfile, lr as StateLabel, lt as PermissionRevokeInput, m as IdentityProfileDetails, mn as OfframpStatus, mr as InvocationControls, mt as OrgMeOptions, nn as DestinationListInput, nt as OrganizationPaymentsMethods, o as ObservationDelivery, on as DestinationsMethods, or as IdentityState, ot as PermissionMethods, p as CreateCapxulClientInput, pn as OfframpQuoteInput, pr as IdentityTransition, pt as OrgMeMethod, q as PayrollOptions, qn as Permission, qt as ActivityReference, r as CAPXUL_SDK_EXPECTED_OUTCOME_EVENT, rn as DestinationPayload, rr as TelemetryPort, rt as PermissionAssignInput, s as SdkFailureObservation, sn as FinancialOpsMethods, sr as OrgLane, st as PermissionOptions, t as CapxulClientInput, tn as DestinationKind, tt as OrganizationPaymentItemInput, u as PostHogObservabilityOptions, un as MovementActivityEvidence, ur as destination, ut as PermissionReadResult, v as Holding, vn as PaymentDocumentKind, vt as OrganizationOnboarding, w as CreateOrgInput, wn as PaymentStatus, wt as ActorProfile, x as MediaMethods, xn as PaymentDocumentVerification, xt as PersonOnboardingInput, y as SystemMethods, yn as PaymentDocumentRef, yt as OrganizationOnboardingInput, z as AuthorizeRunInput, zn as IdentityMethods, zt as ActivityDetail } from "./production-Cpz4hm8p.mjs";
 import { Hex } from "viem";
 import { Effect, Layer } from "effect";
 //#region ../errors/src/index.d.ts
@@ -339,6 +339,8 @@ declare const CAPXUL_OPERATIONS: {
   };
   readonly payroll: {
     readonly authorizeRun: "payroll.authorizeRun";
+    readonly emitGroupChanged: "payroll.emitGroupChanged";
+    readonly emitRunTransitioned: "payroll.emitRunTransitioned";
     readonly groups: {
       readonly access: "payroll.groups";
       readonly list: "payroll.groups.list";

package/dist/index.mjs

@@ -1,5 +1,5 @@
-import { A as signerFailure, B as isRestoring, C as normalizeExceptionErrorKind, E as safeExceptionLabel, F as CAPXUL_OPERATIONS, I as isCapxulOperation, L as normalizeCapxulOperation, M as PAYMENT_DIRECTIONS, N as PAYMENT_STATUSES, O as isSettingUpLifecycle, R as destination, S as SDK_VERSION, T as projectSdkException, _ as fingerprintPaymentIntent, b as failureDetail, d as embeddedSigner, f as openfortEmbeddedSigner, g as devPrivateKeySigner, h as deriveDevPrivateKey, j as resolveFailureMode, k as injectedWalletSigner, m as openfortEmbeddedWalletPort, p as openfortEmbeddedSignerFromWallet, r as postHogObservability, t as createCapxulClient$1, w as normalizeExceptionOperation, x as EXCEPTION_MESSAGE, y as CAPXUL_SDK_EXPECTED_OUTCOME_EVENT, z as isClaimed } from "./production-BndbwuVx.mjs";
-import { A as currencySymbolFor, B as toCurrencyCode, G as toHandle, M as toAddress, T as EVM_ADDRESS_RE, Y as toPartyId, b as configuredMoneyAssetById, dt as CHAIN_UPSTREAMS, ft as FAILURE_MODES, g as CAPXUL_PAYMENTS_V2_ADDRESS, it as HANDLE_RE, k as assetIdFor, lt as Errors, ot as CAPXUL_ERROR_CODES, st as CapxulError, ut as isCapxulError, z as toCountryCode } from "./OAuthBearerAuthClient-IB2W1Fzj.mjs";
+import { A as signerFailure, B as isRestoring, C as normalizeExceptionErrorKind, E as safeExceptionLabel, F as CAPXUL_OPERATIONS, I as isCapxulOperation, L as normalizeCapxulOperation, M as PAYMENT_DIRECTIONS, N as PAYMENT_STATUSES, O as isSettingUpLifecycle, R as destination, S as SDK_VERSION, T as projectSdkException, _ as fingerprintPaymentIntent, b as failureDetail, d as embeddedSigner, f as openfortEmbeddedSigner, g as devPrivateKeySigner, h as deriveDevPrivateKey, j as resolveFailureMode, k as injectedWalletSigner, m as openfortEmbeddedWalletPort, p as openfortEmbeddedSignerFromWallet, r as postHogObservability, t as createCapxulClient$1, w as normalizeExceptionOperation, x as EXCEPTION_MESSAGE, y as CAPXUL_SDK_EXPECTED_OUTCOME_EVENT, z as isClaimed } from "./production-C8FuAYm1.mjs";
+import { A as currencySymbolFor, B as toCurrencyCode, G as toHandle, M as toAddress, T as EVM_ADDRESS_RE, Y as toPartyId, at as HANDLE_RE, b as configuredMoneyAssetById, ct as CapxulError, dt as isCapxulError, ft as CHAIN_UPSTREAMS, g as CAPXUL_PAYMENTS_V2_ADDRESS, k as assetIdFor, pt as FAILURE_MODES, st as CAPXUL_ERROR_CODES, ut as Errors, z as toCountryCode } from "./OAuthBearerAuthClient-CbU_W9Sp.mjs";
 import { formatUnits } from "viem";
 import { Effect } from "effect";
 import { privateKeyToAccount } from "viem/accounts";

package/dist/node/index.mjs

@@ -1,4 +1,4 @@
-import { M as toAddress, a as parseAuthSession, c as AuthCachePortTag, i as BrowserAuthCacheAdapter, o as parseCachedJwt, r as InMemoryAuthCacheAdapter, s as AuthCacheError, t as oauthBearerAuthClient } from "../OAuthBearerAuthClient-IB2W1Fzj.mjs";
+import { M as toAddress, a as parseAuthSession, c as AuthCachePortTag, i as BrowserAuthCacheAdapter, o as parseCachedJwt, r as InMemoryAuthCacheAdapter, s as AuthCacheError, t as oauthBearerAuthClient } from "../OAuthBearerAuthClient-CbU_W9Sp.mjs";
 import { Effect, FileSystem, Layer, Path } from "effect";
 import { privateKeyToAccount } from "viem/accounts";
 import * as os from "node:os";

package/dist/{production-BndbwuVx.mjs → production-C8FuAYm1.mjs}

@@ -1,4 +1,4 @@
-import { $ as toRoleKey, B as toCurrencyCode, C as ASSET_ID_RE, Ct as redactSecrets, D as WEI_RE, E as SUPPORTED_CURRENCY_CODES, F as toAssetId, G as toHandle, H as toEmail, I as toAuthUserId, J as toOrgId, K as toJwtToken, L as toBudgetId, M as toAddress, N as toAllowedOrigin, O as ZERO_BYTES32, Q as toPublishableKey, R as toChainId, S as APP_ID_RE, St as isCredentialField, T as EVM_ADDRESS_RE$1, U as toEpochMs, V as toDurationMs, W as toEpochSeconds, X as toPayrollGroupId, Y as toPartyId, Z as toPayrollRunId, _ as normalizeBindingEmail, _t as failureFingerprint, at as decodeConvexError, bt as revertSummaryText, c as AuthCachePortTag, ct as EXPECTED_OPERATION_OUTCOMES, d as authClientPortFromPromiseAdapter, dt as CHAIN_UPSTREAMS, et as toSessionToken, f as AuthClientError, ft as FAILURE_MODES$1, gt as decodeChainCause, h as orgRoleKeyForLabel, ht as chainEvidenceLabel, i as BrowserAuthCacheAdapter, j as toAccountId, l as SystemClockLayer, lt as Errors, m as ADMIN_ROLE_LABEL, mt as chainCauseProperties, nt as toTxHash, ot as CAPXUL_ERROR_CODES, p as AuthClientPortTag, pt as boundedResponseHeaders, q as toKycTier, r as InMemoryAuthCacheAdapter, rt as validateHandle, st as CapxulError, tt as toTesterKind, u as ClockPortTag, ut as isCapxulError, v as BASE_SEPOLIA_CHAIN_ID, vt as isChainUpstream, w as BYTES32_RE, wt as redactUrlSecrets, x as ACCOUNT_ID_RE, xt as containsSensitiveMaterial, y as deriveCapxulSafeAddress, yt as isFailureMode, z as toCountryCode } from "./OAuthBearerAuthClient-IB2W1Fzj.mjs";
+import { $ as toRoleKey, B as toCurrencyCode, C as ASSET_ID_RE, Ct as isCredentialField, D as WEI_RE, E as SUPPORTED_CURRENCY_CODES, F as toAssetId, G as toHandle, H as toEmail, I as toAuthUserId, J as toOrgId, K as toJwtToken, L as toBudgetId, M as toAddress, N as toAllowedOrigin, O as ZERO_BYTES32, Q as toPublishableKey, R as toChainId, S as APP_ID_RE, St as containsSensitiveMaterial, T as EVM_ADDRESS_RE$1, Tt as redactUrlSecrets, U as toEpochMs, V as toDurationMs, W as toEpochSeconds, X as toPayrollGroupId, Y as toPartyId, Z as toPayrollRunId, _ as normalizeBindingEmail, _t as decodeChainCause, b as configuredMoneyAssetById, bt as isFailureMode, c as AuthCachePortTag, ct as CapxulError, d as authClientPortFromPromiseAdapter, dt as isCapxulError, et as toSessionToken, f as AuthClientError, ft as CHAIN_UPSTREAMS, gt as chainEvidenceLabel, h as orgRoleKeyForLabel, ht as chainCauseProperties, i as BrowserAuthCacheAdapter, it as validateHandle, j as toAccountId, l as SystemClockLayer, lt as EXPECTED_OPERATION_OUTCOMES, m as ADMIN_ROLE_LABEL, mt as boundedResponseHeaders, nt as toTxHash, ot as decodeConvexError, p as AuthClientPortTag, pt as FAILURE_MODES$1, q as toKycTier, r as InMemoryAuthCacheAdapter, rt as toWeiAmount, st as CAPXUL_ERROR_CODES, tt as toTesterKind, u as ClockPortTag, ut as Errors, v as BASE_SEPOLIA_CHAIN_ID, vt as failureFingerprint, w as BYTES32_RE, wt as redactSecrets, x as ACCOUNT_ID_RE, xt as revertSummaryText, y as deriveCapxulSafeAddress, yt as isChainUpstream, z as toCountryCode } from "./OAuthBearerAuthClient-CbU_W9Sp.mjs";
 import { formatUnits, keccak256, parseUnits, recoverAddress, stringToHex, toBytes } from "viem";
 import { Cause, Clock, Context, Data, Deferred, Duration, Effect, Exit, Fiber, FiberSet, Layer, Option, Queue, Ref, Result, Schedule, Schema, SchemaGetter, SchemaIssue, SchemaParser, Scope, Stream, Tracer } from "effect";
 import { getFunctionName, makeFunctionReference } from "convex/server";
@@ -695,6 +695,8 @@ const CAPXUL_OPERATIONS = {
 	recipient: { resolve: "recipient.resolve" },
 	payroll: {
 		authorizeRun: "payroll.authorizeRun",
+		emitGroupChanged: "payroll.emitGroupChanged",
+		emitRunTransitioned: "payroll.emitRunTransitioned",
 		groups: {
 			access: "payroll.groups",
 			list: "payroll.groups.list",
@@ -1363,7 +1365,27 @@ const PermissionMirrorVerificationProps = Schema.Struct({
 		"conflicting_replay",
 		"revision_mismatch"
 	])),
-	command_id: OptionalString
+	command_id: OptionalString,
+	/**
+	* #1961 R03. The authorized stored row names the Permission it changed; the
+	* verified receipt names the chain facts that prove it. Every field is
+	* optional because a pending or provider-failed verification has neither an
+	* application result nor a receipt to report.
+	*/
+	permission_id: OptionalString,
+	permission_assignment_id: OptionalString,
+	permission_operation: Schema.optional(Schema.Literals([
+		"create",
+		"change",
+		"assign",
+		"revoke",
+		"replace"
+	])),
+	revision: Schema.optional(Schema.Number),
+	user_op_hash: OptionalString,
+	transaction_hash: OptionalString,
+	block_number: Schema.optional(Schema.Number),
+	log_index: Schema.optional(Schema.Number)
 });
 const MovementScanWindowProps = Schema.Struct({
 	...TelemetryEnvelopeProps,
@@ -1909,6 +1931,12 @@ Schema.Struct({
 			"settled"
 		]),
 		run_id: Schema.String,
+		/**
+		* The `paymentCommands` row at `payrollRuns.batchRef` — the durable owner of
+		* this run's Payment membership. `payment_count` counts THAT command's
+		* `paymentIds`, so an unrelated Payment quoting the run id changes neither.
+		*/
+		command_id: OptionalString,
 		payment_count: Schema.optional(Schema.Number),
 		occurred_at: Schema.Number
 	})
@@ -2295,6 +2323,7 @@ const CAPXUL_FUNCTIONS = {
 		list: "movement/activity:list",
 		summary: "movement/activity:summary"
 	},
+	"movement/annotations": { overlay: "movement/annotations:overlay" },
 	"moneyExecution/actions": {
 		abandonPaymentExecution: "moneyExecution/actions:abandonPaymentExecution",
 		preparePermissionExecution: "moneyExecution/actions:preparePermissionExecution",
@@ -2893,7 +2922,19 @@ const StoredPermissionCommandSchema = Schema.Struct({
 	roleKey: RoleKeySchema,
 	allowanceKey: Schema.NullOr(AllowanceKeySchema),
 	memberSafe: Schema.NullOr(SafeAddressSchema),
-	expectedAuthorityEvents: Schema.Array(Bytes32Schema)
+	expectedAuthorityEvents: Schema.Array(Bytes32Schema),
+	/**
+	* #1961 R03. The authenticated user who created the command, and the browser
+	* linkage captured with it. Delayed verification and bounded retries read
+	* this snapshot instead of the current viewer, so one command keeps one
+	* origin. Both are absent on commands created before this contract.
+	*
+	* The context stays `unknown` on purpose: `sanitizeObservationContext` owns
+	* the field allowlist, and every reader passes the stored value through it
+	* rather than repeating those rules here.
+	*/
+	originatingAuthUserId: Schema.optional(Schema.String),
+	originatingObservationContext: Schema.optional(Schema.Unknown)
 });
 Schema.Struct({
 	command: StoredPermissionCommandSchema,
@@ -5666,6 +5707,7 @@ const financialOpsContract = {
 	activitySummary: makeFunctionReference(CAPXUL_FUNCTIONS["movement/activity"].summary),
 	activityGet: makeFunctionReference(CAPXUL_FUNCTIONS["movement/activity"].get),
 	activityAnnotate: makeFunctionReference(CAPXUL_FUNCTIONS["movement/activity"].annotate),
+	activityOverlay: makeFunctionReference(CAPXUL_FUNCTIONS["movement/annotations"].overlay),
 	verifyPaymentDocument: makeFunctionReference(CAPXUL_FUNCTIONS["financialOps/queries"].verifyPaymentDocument),
 	renderStoredDocument: makeFunctionReference(CAPXUL_FUNCTIONS["financialOps/queries"].renderStoredDocument)
 };
@@ -5682,8 +5724,357 @@ const moneyExecutionContract = {
 	submitPaymentCommandExecution: makeFunctionReference(CAPXUL_FUNCTIONS["moneyExecution/paymentCommandActions"].submitPaymentCommandExecution)
 };
 //#endregion
+//#region src/ports/indexer-read.ts
+/** The indexer's own page bound. Exceeding it is a caller defect, not a refusal. */
+const INDEXER_MAX_LIMIT = 1e3;
+const LOWER_CASE_ADDRESS = /^0x[0-9a-f]{40}$/;
+/**
+* Refuse a page the indexer would refuse, before any implementation spends a
+* round trip on it. Every implementation calls this, so a consumer test written
+* against the hermetic adapter cannot pass on input production rejects. Throws
+* a `CapxulError`; callers convert it to an `IndexerReadError`.
+*/
+function assertIndexerPage(input) {
+	const safe = String(input.safe).toLowerCase();
+	if (!LOWER_CASE_ADDRESS.test(safe)) throw Errors.invalidInput("safe", "must be a lower-case EVM address");
+	if (!Number.isSafeInteger(input.limit) || input.limit < 1 || input.limit > 1e3) throw Errors.invalidInput("limit", `must be an integer from 1 to ${INDEXER_MAX_LIMIT}`);
+	const offset = input.offset ?? 0;
+	if (!Number.isSafeInteger(offset) || offset < 0) throw Errors.invalidInput("offset", "must be a non-negative integer");
+	return safe;
+}
+var IndexerReadError = class extends Data.TaggedError("IndexerReadError") {};
+function indexerReadErrorFromCapxul(operation, error, cause = error) {
+	return new IndexerReadError({
+		operation,
+		publicCode: error.code,
+		publicError: error,
+		cause,
+		...error.details === void 0 ? {} : { details: error.details }
+	});
+}
+Context.Service()("@capxul/sdk/ports/IndexerReadPort");
+//#endregion
+//#region src/surface/activity-stitch.ts
+/** Epoch milliseconds of the block that carried the row. */
+function blockMillis(row) {
+	return Number(row.timestamp) * 1e3;
+}
+/** `0x1234…abcd` — the counterparty of an unclaimed transfer is an address. */
+function shortAddressLabel(address) {
+	return address.length <= 12 ? address : `${address.slice(0, 6)}…${address.slice(-4)}`;
+}
+function directionFor(safe, transfer) {
+	const from = transfer.from.toLowerCase();
+	const to = transfer.to.toLowerCase();
+	if (from === safe && to === safe) return "self";
+	return to === safe ? "in" : "out";
+}
+/**
+* The Transfer a protocol Payment moved is the same money as its `payment`
+* row. One actor sees one item for it, so the Transfer is claimed and does not
+* become a second row. Another transfer in the same transaction that this
+* payment did not move stays unclaimed and keeps its own row.
+*/
+function claimedTransferIds(transfers, payments) {
+	const claimed = /* @__PURE__ */ new Set();
+	for (const payment of payments) {
+		const match = transfers.find((transfer) => !claimed.has(transfer.id) && transfer.txHash === payment.txHash && transfer.token.toLowerCase() === payment.token.toLowerCase() && transfer.amount === payment.amount && transfer.to.toLowerCase() === payment.recipient.toLowerCase());
+		if (match !== void 0) claimed.add(match.id);
+	}
+	return claimed;
+}
+function withAnnotation(item, annotation) {
+	return annotation?.counterpartyLabel === void 0 ? item : {
+		...item,
+		counterpartyLabel: annotation.counterpartyLabel
+	};
+}
+/**
+* Confirmation comes from the chain, never from Convex.
+*
+* A Ponder row for this Payment's settlement means settled, and its receipt is
+* the indexed transaction. No Ponder row and a Convex row that still says
+* settled means the block that carried it was dropped: the row goes back to
+* `settling` and its annotation, which keys on the Payment id, is untouched.
+*/
+function confirmPayment(intent, chain, hasSettlement) {
+	if (chain !== void 0) return {
+		...intent,
+		status: "settled",
+		receipt: {
+			chainId: chain.chainId,
+			transactionHash: chain.txHash
+		},
+		updatedAt: blockMillis(chain)
+	};
+	if (hasSettlement && intent.status === "settled") return {
+		...intent,
+		status: "settling",
+		receipt: null
+	};
+	return intent;
+}
+/**
+* One unclaimed Transfer as an Activity row, or `null` when this SDK cannot
+* denominate its asset. The indexer serves only configured assets, so a row
+* the registry does not know means the SDK and that deployment disagree; it is
+* dropped rather than shown with a guessed currency.
+*/
+function transferItem(safe, transfer, annotation) {
+	const asset = configuredMoneyAssetById(transfer.assetId);
+	if (asset === null) return null;
+	const direction = directionFor(safe, transfer);
+	const counterparty = direction === "in" ? transfer.from : transfer.to;
+	const at = blockMillis(transfer);
+	return withAnnotation({
+		kind: "movement",
+		id: transfer.id,
+		classification: "movement_only_outflow",
+		amount: {
+			currency: asset.peg ?? asset.symbol,
+			value: formatUnits(transfer.amount, asset.decimals),
+			decimals: asset.decimals
+		},
+		direction,
+		counterpartyLabel: shortAddressLabel(counterparty),
+		receipt: {
+			chainId: transfer.chainId,
+			transactionHash: transfer.txHash
+		},
+		createdAt: at,
+		updatedAt: at
+	}, annotation);
+}
+/** Newest first. A Payment precedes a Movement at one instant, as the ledger reader orders them. */
+function compareItems(left, right) {
+	if (right.createdAt !== left.createdAt) return right.createdAt - left.createdAt;
+	if (left.kind !== right.kind) return left.kind === "payment" ? -1 : 1;
+	if (left.id === right.id) return 0;
+	return left.id < right.id ? 1 : -1;
+}
+function stitchActivity(input) {
+	const safe = input.safe.toLowerCase();
+	const chainBySettlement = /* @__PURE__ */ new Map();
+	for (const row of input.payments) chainBySettlement.set(row.settlementId.toLowerCase(), row);
+	const chainByPaymentId = /* @__PURE__ */ new Map();
+	const settledPaymentIds = /* @__PURE__ */ new Set();
+	for (const link of input.links) {
+		settledPaymentIds.add(link.paymentId);
+		const row = chainBySettlement.get(link.settlementId.toLowerCase());
+		if (row !== void 0) chainByPaymentId.set(link.paymentId, row);
+	}
+	const annotations = /* @__PURE__ */ new Map();
+	for (const annotation of input.annotations) annotations.set(`${annotation.reference.kind}:${annotation.reference.id}`, annotation);
+	const items = [];
+	const claiming = [];
+	for (const intent of input.intents) {
+		if (intent.kind !== "payment") continue;
+		const chain = chainByPaymentId.get(intent.id);
+		if (chain !== void 0) claiming.push(chain);
+		items.push(withAnnotation(confirmPayment(intent, chain, settledPaymentIds.has(intent.id)), annotations.get(`payment:${intent.id}`)));
+	}
+	const claimed = claimedTransferIds(input.transfers, claiming);
+	for (const transfer of input.transfers) {
+		if (claimed.has(transfer.id)) continue;
+		const item = transferItem(safe, transfer, annotations.get(`movement:${transfer.id}`));
+		if (item !== null) items.push(item);
+	}
+	return items.sort(compareItems);
+}
+/** The reference ids one stitched page needs its Convex overlay for. */
+function overlayReferences(items) {
+	return items.map((item) => ({
+		kind: item.kind,
+		id: item.id
+	}));
+}
+/**
+* Money in, money out and the pending share, one bucket per currency and
+* precision. Two assets that peg to the same currency at different precision
+* stay distinct buckets: their raw units are not interchangeable.
+*/
+function summarizeItems(items) {
+	const buckets = /* @__PURE__ */ new Map();
+	for (const item of items) {
+		const key = `${item.amount.currency}:${String(item.amount.decimals)}`;
+		const bucket = buckets.get(key) ?? {
+			currency: item.amount.currency,
+			decimals: item.amount.decimals,
+			in: 0n,
+			out: 0n,
+			pendingIn: 0n
+		};
+		const raw = rawUnits(item.amount.value, item.amount.decimals);
+		if (item.direction === "in") {
+			bucket.in += raw;
+			if (item.kind === "payment" && item.status !== "settled") bucket.pendingIn += raw;
+		} else if (item.direction === "out") bucket.out += raw;
+		buckets.set(key, bucket);
+	}
+	return [...buckets.values()].map((bucket) => ({
+		currency: bucket.currency,
+		decimals: bucket.decimals,
+		in: bucket.in.toString(),
+		out: bucket.out.toString(),
+		net: (bucket.in - bucket.out).toString(),
+		pendingIn: bucket.pendingIn.toString()
+	}));
+}
+/** The inverse of `formatUnits`, kept exact: `"1.25"` at 6 decimals is `1250000n`. */
+function rawUnits(value, decimals) {
+	const negative = value.startsWith("-");
+	const [whole = "0", fraction = ""] = (negative ? value.slice(1) : value).split(".");
+	const raw = BigInt(`${whole}${fraction.padEnd(decimals, "0").slice(0, decimals)}`);
+	return negative ? -raw : raw;
+}
+//#endregion
+//#region src/surface/activity-read.ts
+/** How many Convex intent rows one page reads for its labels and pending rows. */
+const INTENT_WINDOW = 100;
+/** The window a summary aggregates over. The indexer's own page bound. */
+const SUMMARY_WINDOW = INDEXER_MAX_LIMIT;
+function parseCursor(value) {
+	if (value === void 0) return 0;
+	try {
+		const parsed = JSON.parse(value);
+		return Number.isSafeInteger(parsed.offset) && parsed.offset >= 0 ? parsed.offset : 0;
+	} catch {
+		return 0;
+	}
+}
+function inRange(item, range) {
+	if (range?.from !== void 0 && item.createdAt < range.from) return false;
+	return range?.to === void 0 || item.createdAt <= range.to;
+}
+/** The caller's filter applied to the merged page. The join owns the order. */
+function matchesFilter(item, filter) {
+	if (filter === void 0) return true;
+	if (filter.kind !== void 0 && item.kind !== filter.kind) return false;
+	if (filter.direction !== void 0 && item.direction !== filter.direction) return false;
+	if (filter.status === void 0) return true;
+	return item.kind === "payment" && filter.status.includes(item.status);
+}
+function overlay(deps, actor, controls, input) {
+	return deps.convexCall.query(deps.functions.activityOverlay, copyInvocationObservation(controls, { input: {
+		...actor === void 0 ? {} : { actor },
+		...input.references === void 0 ? {} : { references: input.references },
+		...input.settlementIds === void 0 ? {} : { settlementIds: input.settlementIds }
+	} }));
+}
+function convexPage(deps, actor, controls, input) {
+	return deps.convexCall.query(deps.functions.activityList, copyInvocationObservation(controls, { input: {
+		...actor === void 0 ? {} : { actor },
+		...input.cursor === void 0 ? {} : { cursor: input.cursor },
+		...input.limit === void 0 ? {} : { limit: input.limit },
+		...input.range === void 0 ? {} : { range: input.range }
+	} }));
+}
+/** Both indexed tables for one Safe, or `null` when the indexer cannot answer. */
+function chainRows(deps, safe, limit) {
+	const page = {
+		safe,
+		limit: Math.min(limit, INDEXER_MAX_LIMIT)
+	};
+	return Effect.all([deps.indexer.read("transfer", page), deps.indexer.read("payment", page)], { concurrency: 2 }).pipe(Effect.map(([transfers, payments]) => ({
+		transfers,
+		payments
+	})), Effect.catch(() => Effect.succeed(null)));
+}
+/** The stitched, filtered rows of one window, newest first. */
+function stitchedWindow(deps, actor, controls, window, params) {
+	return Effect.gen(function* () {
+		const scope = yield* overlay(deps, actor, controls, {});
+		const convex = yield* convexPage(deps, actor, controls, {
+			limit: INTENT_WINDOW,
+			...params.range === void 0 ? {} : { range: params.range }
+		});
+		const rows = scope.safe === null ? null : yield* chainRows(deps, scope.safe, window);
+		if (rows === null || scope.safe === null) return {
+			items: convex.items.filter((item) => matchesFilter(item, params.filter)),
+			stitched: false
+		};
+		const decoration = yield* overlay(deps, actor, controls, {
+			references: [...overlayReferences(convex.items), ...rows.transfers.map((row) => ({
+				kind: "movement",
+				id: row.id
+			}))],
+			settlementIds: rows.payments.map((row) => row.settlementId)
+		});
+		return {
+			items: stitchActivity({
+				safe: scope.safe,
+				transfers: rows.transfers,
+				payments: rows.payments,
+				intents: convex.items,
+				links: decoration.links,
+				annotations: decoration.annotations
+			}).filter((item) => inRange(item, params.range) && matchesFilter(item, params.filter)),
+			stitched: true
+		};
+	});
+}
+function readActivityPage(deps, actor, controls, params) {
+	const limit = params?.limit ?? 25;
+	const offset = parseCursor(params?.cursor);
+	return stitchedWindow(deps, actor, controls, offset + limit + 1, {
+		...params?.range === void 0 ? {} : { range: params.range },
+		...params?.filter === void 0 ? {} : { filter: params.filter }
+	}).pipe(Effect.map(({ items, stitched }) => {
+		const observedAt = Date.now();
+		if (!stitched) return {
+			items: items.slice(0, limit),
+			cursor: null,
+			checkpoint: observedAt,
+			observedAt
+		};
+		return {
+			items: items.slice(offset, offset + limit),
+			cursor: items.length > offset + limit ? JSON.stringify({ offset: offset + limit }) : null,
+			checkpoint: observedAt,
+			observedAt
+		};
+	}));
+}
+function readActivitySummary(deps, actor, controls, params) {
+	return stitchedWindow(deps, actor, controls, SUMMARY_WINDOW, params?.window === void 0 ? {} : { range: params.window }).pipe(Effect.map(({ items }) => ({
+		window: {
+			from: params?.window?.from ?? null,
+			to: params?.window?.to ?? null
+		},
+		totals: summarizeItems(items),
+		count: items.length,
+		observedAt: Date.now()
+	})));
+}
+/**
+* Tell the caller when the indexed page for this Safe changed.
+*
+* The transport is the indexer's one SSE connection, wired in the Ponder
+* adapter under `activity.subscribe`. A reactive snapshot is not a product
+* event, so nothing here emits telemetry: the adapter reports a teardown, and
+* the caller re-reads.
+*/
+function subscribeActivity(deps, actor, controls, onChange) {
+	return Effect.gen(function* () {
+		const scope = yield* overlay(deps, actor, controls, {});
+		if (scope.safe === null) return () => {};
+		const page = {
+			safe: scope.safe,
+			limit: INTENT_WINDOW
+		};
+		let delivered = false;
+		const notify = () => {
+			if (delivered) onChange();
+			delivered = true;
+		};
+		return yield* deps.indexer.subscribe("transfer", page, (snapshot) => {
+			if (snapshot.status === "ok") notify();
+		});
+	});
+}
+//#endregion
 //#region package.json
-var version = "4.2.0-rc.10";
+var version = "4.2.0-rc.12";
 //#endregion
 //#region src/telemetry/exception-projection.ts
 /** Fixed fallback for failures that have no safe message. */
@@ -5881,10 +6272,15 @@ function observeFailedResult(result, adapter, operation, origin) {
 * A reactive stream is torn down after its call already returned, so nothing
 * downstream observes it. `captureException` is the right kind: the caller did
 * not ask for the end, so it is not an expected product outcome.
+*
+* A caller that DID ask for the end — the session it authenticated with
+* expired, and the service closed the stream on purpose — passes
+* `kind: "operation"` instead, so the refusal lands in the expected-outcome
+* stream its code already declares.
 */
-function observeStreamFailure(adapter, operation, cause) {
+function observeStreamFailure(adapter, operation, cause, kind = "exception") {
 	if (adapter === void 0) return;
-	report(adapter, "exception", operation, cause, resolveAdapterSnapshot(adapter));
+	report(adapter, kind, operation, cause, resolveAdapterSnapshot(adapter));
 }
 /**
 * One failure, one event. The identity machine reports a failed transition
@@ -6989,6 +7385,11 @@ function paymentExecutionIntent(input) {
 }
 function makeFinancialOpsMethods(deps) {
 	const fns = deps.functions ?? financialOpsContract;
+	const indexerDeps = deps.indexerRead === void 0 ? void 0 : {
+		indexer: deps.indexerRead,
+		convexCall: deps.convexCall,
+		functions: fns
+	};
 	const executionFns = deps.moneyExecutionFunctions ?? moneyExecutionContract;
 	const requestKeyScope = deps.requestKeyScope ?? randomPaymentRequestKey();
 	const inFlightPersonalPayments = /* @__PURE__ */ new Map();
@@ -7219,22 +7620,26 @@ function makeFinancialOpsMethods(deps) {
 			}
 		},
 		activity: {
+			subscribe: (onChange, params, options) => {
+				const controls = deps.invocationControls?.(options) ?? options;
+				return runPortEffect(captureActivityInput(() => Effect.succeed(activityActorField(params?.actor).actor)).pipe(Effect.flatMap((actor) => indexerDeps === void 0 ? Effect.succeed(() => {}) : Effect.suspend(() => subscribeActivity(indexerDeps, actor, controls, onChange)).pipe(Effect.tap(() => observeActivityScope(actor))))), controls, CAPXUL_OPERATIONS.activity.subscribe, deps.runPromise);
+			},
 			list: (params, options) => {
 				const controls = deps.invocationControls?.(options) ?? options;
-				return runPortEffect(captureActivityInput(() => Effect.succeed(activityActorField(params?.actor).actor)).pipe(Effect.flatMap((actor) => Effect.suspend(() => deps.convexCall.query(fns.activityList, copyInvocationObservation(controls, { input: {
+				return runPortEffect(captureActivityInput(() => Effect.succeed(activityActorField(params?.actor).actor)).pipe(Effect.flatMap((actor) => Effect.suspend(() => indexerDeps === void 0 ? deps.convexCall.query(fns.activityList, copyInvocationObservation(controls, { input: {
 					...actor === void 0 ? {} : { actor },
 					...params?.cursor === void 0 ? {} : { cursor: params.cursor },
 					...params?.limit === void 0 ? {} : { limit: params.limit },
 					...params?.range === void 0 ? {} : { range: params.range },
 					...params?.filter === void 0 ? {} : { filter: params.filter }
-				} }))).pipe(Effect.tap(() => observeActivityScope(actor))))), controls, CAPXUL_OPERATIONS.activity.list, deps.runPromise);
+				} })) : readActivityPage(indexerDeps, actor, controls, params)).pipe(Effect.tap(() => observeActivityScope(actor))))), controls, CAPXUL_OPERATIONS.activity.list, deps.runPromise);
 			},
 			summary: (params, options) => {
 				const controls = deps.invocationControls?.(options) ?? options;
-				return runPortEffect(captureActivityInput(() => Effect.succeed(activityActorField(params?.actor).actor)).pipe(Effect.flatMap((actor) => Effect.suspend(() => deps.convexCall.query(fns.activitySummary, copyInvocationObservation(controls, { input: {
+				return runPortEffect(captureActivityInput(() => Effect.succeed(activityActorField(params?.actor).actor)).pipe(Effect.flatMap((actor) => Effect.suspend(() => indexerDeps === void 0 ? deps.convexCall.query(fns.activitySummary, copyInvocationObservation(controls, { input: {
 					...actor === void 0 ? {} : { actor },
 					...params?.window === void 0 ? {} : { window: params.window }
-				} }))).pipe(Effect.tap(() => observeActivityScope(actor))))), controls, CAPXUL_OPERATIONS.activity.summary, deps.runPromise);
+				} })) : readActivitySummary(indexerDeps, actor, controls, params)).pipe(Effect.tap(() => observeActivityScope(actor))))), controls, CAPXUL_OPERATIONS.activity.summary, deps.runPromise);
 			},
 			get: (reference, options) => {
 				const controls = deps.invocationControls?.(options) ?? options;
@@ -9041,6 +9446,9 @@ const OBSERVED_CONVEX_ACTIONS = /* @__PURE__ */ new Set([
 	"org/actions:resumeBootstrapSubmission",
 	"org/actions:confirmBootstrap",
 	"org/actions:readTreasury",
+	"moneyExecution/actions:preparePermissionExecution",
+	"moneyExecution/actions:submitPermissionExecution",
+	"permission/actions:verify",
 	"moneyExecution/actions:preparePaymentExecution",
 	"moneyExecution/actions:abandonPaymentExecution",
 	"moneyExecution/actions:submitPaymentExecution",
@@ -9065,6 +9473,9 @@ const OBSERVED_CONVEX_QUERIES = /* @__PURE__ */ new Set([
 	"payroll/queries:groups",
 	"payroll/queries:terms",
 	"financialOps/queries:resolveRecipient",
+	"org/queries:me",
+	"permission/queries:read",
+	"permission/queries:authorize",
 	"identity/queries:loadByAuthUserId",
 	"smartAccount/queries:loadByAuthUserId",
 	"org/lifecycle:load"
@@ -9083,6 +9494,7 @@ const OBSERVED_CONVEX_MUTATIONS = /* @__PURE__ */ new Set([
 	"financialOps/requestsInbox:decline",
 	"payroll/mutations:saveGroup",
 	"payroll/mutations:removeGroup",
+	"permission/mutations:command",
 	"identity/mutations:create",
 	"identity/mutations:update",
 	"identity/mutations:completeOnboarding",
@@ -12139,8 +12551,33 @@ function toOrgMe(wire) {
 		observedAt: wire.observedAt
 	};
 }
+/**
+* The read runs through the canonical observed runner, so `org.me` owns one
+* `capxul_sdk_operation` record and one span like every other public method.
+*
+* The call-start invocation snapshot travels on the query arguments: the
+* Convex adapter reads it there and sends the browser linkage with the call,
+* so an account switch mid-flight cannot re-resolve the actor. A successful
+* read proves participation in this Organization, so the owning span carries
+* the verified Organization and the two authority booleans the backend
+* actually enforces. Labels and Budget caps stay off the record.
+*/
 function makeOrgMeMethod(deps, orgId) {
-	return (options) => runIfActive(options?.signal, CAPXUL_OPERATIONS.org.me, () => Effect.map(deps.convexCall.query(orgReadContract.me, { orgId }), toOrgMe));
+	return (options) => {
+		const controls = deps.invocationControls?.(options) ?? options;
+		return runCapxulEffect(Effect.gen(function* () {
+			const wire = yield* deps.convexCall.query(orgReadContract.me, copyInvocationObservation(controls, { orgId })).pipe(Effect.mapError((failure) => failure.publicError));
+			yield* Effect.annotateCurrentSpan({
+				verified_organization_id: orgId,
+				scope_kind: "organization",
+				can_manage_people: wire.capabilities.canManagePeople,
+				can_spend: wire.capabilities.canSpend,
+				budget_count: wire.budgets.length,
+				observed_at: wire.observedAt
+			}).pipe(Effect.catchCause(() => Effect.void));
+			return toOrgMe(wire);
+		}), controls, CAPXUL_OPERATIONS.org.me, deps.runPromise);
+	};
 }
 //#endregion
 //#region src/contract/permission.ts
@@ -12160,16 +12597,24 @@ function isAborted(signal) {
 */
 function observed(deps, operation, options, run) {
 	const controls = deps.invocationControls?.(options) ?? options;
+	let verifiedOrganizationId;
 	return runCapxulEffect(Effect.gen(function* () {
 		if (controls?.signal?.aborted === true) return yield* Effect.fail(Errors.cancelled({ operation }));
+		const parent = yield* Effect.currentSpan.pipe(Effect.orDie);
+		const captured = carryInvocationParentSpan(controls, parent);
 		const result = yield* Effect.tryPromise({
-			try: () => run(controls?.signal),
+			try: () => run(controls?.signal, captured, (orgId) => {
+				verifiedOrganizationId = orgId;
+			}),
 			catch: (cause) => cause instanceof CapxulError ? cause : Errors.unknown(cause)
 		});
 		return yield* result.ok ? Effect.succeed(result.value) : Effect.fail(result.error);
-	}), observationOnlyControls(controls), operation, deps.runPromise);
+	}).pipe(Effect.ensuring(Effect.suspend(() => verifiedOrganizationId === void 0 ? Effect.void : Effect.annotateCurrentSpan({
+		verified_organization_id: verifiedOrganizationId,
+		scope_kind: "organization"
+	})).pipe(Effect.catchCause(() => Effect.void)))), observationOnlyControls(controls), operation, deps.runPromise);
 }
-async function execute(deps, orgId, command, signal) {
+async function execute(deps, orgId, command, signal, controls, verifiedOrganization) {
 	if (isAborted(signal)) return {
 		ok: false,
 		error: Errors.cancelled({ operation: "permissions" })
@@ -12193,17 +12638,18 @@ async function execute(deps, orgId, command, signal) {
 		};
 	}
 	const executionFns = deps.executionFunctions ?? moneyExecutionContract;
-	const prepared = await runIfActive(signal, CAPXUL_OPERATIONS.permissions.prepareExecution, () => deps.convexCall.action(executionFns.preparePermissionExecution, { input: {
+	const prepared = await runIfActive(signal, CAPXUL_OPERATIONS.permissions.prepareExecution, () => withInvocationParentSpan(Effect.suspend(() => deps.convexCall.action(executionFns.preparePermissionExecution, copyInvocationObservation(controls, { input: {
 		orgId,
 		signerAddress,
 		command
-	} }));
+	} }))), controls), deps.runPromise);
 	if (!prepared.ok) return prepared;
 	const expectedSafe = deriveCapxulSafeAddress({ email: session.email });
 	if (prepared.value.chainId !== deps.chainId || prepared.value.signerAddress.toLowerCase() !== signerAddress.toLowerCase() || prepared.value.userOpSenderSafe.toLowerCase() !== expectedSafe.toLowerCase() || prepared.value.operation !== command.operation || prepared.value.orgId !== orgId || canonicalJson(prepared.value.command) !== canonicalJson(command)) return {
 		ok: false,
 		error: Errors.invalidInput("permission", "prepared authority mismatch")
 	};
+	verifiedOrganization(prepared.value.orgId);
 	if (isAborted(signal)) return {
 		ok: false,
 		error: Errors.cancelled({ operation: "permissions" })
@@ -12221,38 +12667,40 @@ async function execute(deps, orgId, command, signal) {
 		ok: false,
 		error: Errors.cancelled({ operation: "permissions" })
 	};
-	return runIfActive(void 0, CAPXUL_OPERATIONS.permissions.submitExecution, () => deps.convexCall.action(executionFns.submitPermissionExecution, { input: {
+	return runIfActive(void 0, CAPXUL_OPERATIONS.permissions.submitExecution, () => withInvocationParentSpan(Effect.suspend(() => deps.convexCall.action(executionFns.submitPermissionExecution, copyInvocationObservation(controls, { input: {
 		executionId: prepared.value.executionId,
 		signature
-	} }));
+	} }))), controls), deps.runPromise);
 }
 function makePermissionMethods(deps, orgId) {
 	const reads = deps.permissionFunctions ?? permissionContract;
 	const ops = CAPXUL_OPERATIONS.org.permissions;
+	const read = (signal, operation, controls) => runIfActive(signal, operation, () => withInvocationParentSpan(Effect.suspend(() => deps.convexCall.query(reads.read, copyInvocationObservation(controls, { orgId }))), controls), deps.runPromise);
+	const command = (operation, build, options) => observed(deps, operation, options, (signal, captured, verifiedOrganization) => execute(deps, orgId, build(), signal, captured, verifiedOrganization));
 	return {
-		create: (input, options) => observed(deps, ops.create, options, (signal) => execute(deps, orgId, {
+		create: (input, options) => command(ops.create, () => ({
 			operation: "create",
 			...input
-		}, signal)),
-		change: (input, options) => observed(deps, ops.change, options, (signal) => execute(deps, orgId, {
+		}), options),
+		change: (input, options) => command(ops.change, () => ({
 			operation: "change",
 			...input
-		}, signal)),
-		assign: (input, options) => observed(deps, ops.assign, options, (signal) => execute(deps, orgId, {
+		}), options),
+		assign: (input, options) => command(ops.assign, () => ({
 			operation: "assign",
 			...input
-		}, signal)),
-		revoke: (input, options) => observed(deps, ops.revoke, options, (signal) => execute(deps, orgId, {
+		}), options),
+		revoke: (input, options) => command(ops.revoke, () => ({
 			operation: "revoke",
 			...input
-		}, signal)),
-		replace: (input, options) => observed(deps, ops.replace, options, (signal) => execute(deps, orgId, {
+		}), options),
+		replace: (input, options) => command(ops.replace, () => ({
 			operation: "replace",
 			...input
-		}, signal)),
-		list: (options) => observed(deps, ops.list, options, (signal) => runIfActive(signal, CAPXUL_OPERATIONS.permissions.list, () => deps.convexCall.query(reads.read, { orgId }))),
-		get: (permissionId, options) => observed(deps, ops.get, options, async (signal) => {
-			const listed = await runIfActive(signal, CAPXUL_OPERATIONS.permissions.get, () => deps.convexCall.query(reads.read, { orgId }));
+		}), options),
+		list: (options) => observed(deps, ops.list, options, (signal, captured) => read(signal, CAPXUL_OPERATIONS.permissions.list, captured)),
+		get: (permissionId, options) => observed(deps, ops.get, options, async (signal, captured) => {
+			const listed = await read(signal, CAPXUL_OPERATIONS.permissions.get, captured);
 			if (!listed.ok) return listed;
 			return {
 				ok: true,
@@ -13123,7 +13571,10 @@ function makeOrgMethods(deps) {
 					},
 					...convexCall === void 0 ? {} : { convexCall }
 				}),
-				me: convexCall === void 0 ? orgMeUnavailable : makeOrgMeMethod({ convexCall }, String(orgId)),
+				me: convexCall === void 0 ? orgMeUnavailable : makeOrgMeMethod({
+					convexCall,
+					...observedRunnerDeps(deps)
+				}, String(orgId)),
 				async getLifecycle(options) {
 					if (options?.signal?.aborted) return {
 						ok: false,
@@ -13360,14 +13811,65 @@ function compareDecimal(first, second) {
 }
 //#endregion
 //#region src/surface/holdings.ts
+/** SPEC Freshness: past this block age the read is labelled stale. Nothing refuses. */
+const FRESHNESS_LIMIT_SECONDS = 60;
+/**
+* The Ponder balance view for one Safe as `CurrentHoldings`.
+*
+* The view is the signed sum of every indexed transfer, so the balance IS what
+* the chain said — there is no snapshot to go stale behind it. `observedAt` is
+* the indexed block's own timestamp, which is what the last-good label reads,
+* and `stale` is that block's age. A stopped indexer therefore shows an old
+* "as of" and the stale flag; it never turns the read into a refusal.
+*/
+function indexerHoldings(indexer, convexCall, overlay, actor, controls) {
+	return Effect.gen(function* () {
+		const scope = yield* convexCall.query(overlay, copyInvocationObservation(controls, actor?.kind === "organization" ? { input: { actor: {
+			kind: "organization",
+			orgId: actor.organizationId
+		} } } : { input: {} }));
+		if (scope.safe === null) return null;
+		const balances = yield* indexer.read("balance", {
+			safe: toAddress(scope.safe),
+			limit: INDEXER_MAX_LIMIT
+		});
+		const status = yield* indexer.status.pipe(Effect.catch(() => Effect.succeed([])));
+		const rows = [];
+		for (const balance of balances) {
+			const asset = configuredMoneyAssetById(balance.assetId);
+			if (asset === null || balance.amount < 0n) continue;
+			rows.push({
+				assetKind: "erc20",
+				tokenAddress: toAddress(asset.tokenAddress),
+				symbol: asset.symbol,
+				decimals: asset.decimals,
+				rawBalance: toWeiAmount(balance.amount.toString())
+			});
+		}
+		const chainId = balances[0]?.chainId ?? status[0]?.chainId;
+		if (chainId === void 0) return null;
+		const head = status.find((entry) => entry.chainId === chainId);
+		const nowSeconds = Math.floor(Date.now() / 1e3);
+		const headSeconds = head === void 0 ? void 0 : Number(head.blockTimestamp);
+		return {
+			actor: scope.actor,
+			chainId: toChainId(chainId),
+			observedAt: headSeconds === void 0 ? Date.now() : headSeconds * 1e3,
+			stale: headSeconds === void 0 || nowSeconds - headSeconds > FRESHNESS_LIMIT_SECONDS,
+			rows
+		};
+	}).pipe(Effect.catch(() => Effect.succeed(null)));
+}
 function makeHoldingsMethods(deps) {
 	const functions = deps.functions ?? holdingsContract;
+	const overlay = (deps.financialOpsFunctions ?? financialOpsContract).activityOverlay;
 	const read = (operation, actor, options, pick) => {
 		const controls = deps.invocationControls?.(options) ?? options;
-		return runCapxulEffect(retryIdempotentRead(deps.convexCall.action(functions.current, copyInvocationObservation(controls, actor?.kind === "organization" ? { actor: {
+		const convexSnapshot = retryIdempotentRead(deps.convexCall.action(functions.current, copyInvocationObservation(controls, actor?.kind === "organization" ? { actor: {
 			kind: "organization",
 			orgId: actor.organizationId
-		} } : {})), operation, deps.telemetry, controls).pipe(Effect.map(pick), Effect.mapError((error) => error.publicError)), controls, operation, deps.runPromise);
+		} } : {})), operation, deps.telemetry, controls).pipe(Effect.mapError((error) => error.publicError));
+		return runCapxulEffect((deps.indexerRead === void 0 ? convexSnapshot : indexerHoldings(deps.indexerRead, deps.convexCall, overlay, actor, controls).pipe(Effect.flatMap((current) => current === null ? convexSnapshot : Effect.succeed(current)))).pipe(Effect.map(pick)), controls, operation, deps.runPromise);
 	};
 	return {
 		current: (input, options) => read(CAPXUL_OPERATIONS.holdings.current, input?.actor, options, (snapshot) => snapshot),
@@ -13393,8 +13895,8 @@ const APPLIED_ACTION_BY_EVENT = {
 	RestoreSession: "none",
 	ResumeOtpEntry: "none",
 	Reset: "none",
-	SessionRestored: "none",
-	SessionAbsent: "none",
+	SessionRestored: "restoration",
+	SessionAbsent: "restoration",
 	EnsureAccount: "none",
 	ClaimAccount: "none",
 	RetryAccount: "none",
@@ -13406,8 +13908,8 @@ const APPLIED_ACTION_BY_EVENT = {
 	OtpFailed: "failed",
 	Verified: "verified",
 	VerifyFailed: "failed",
-	SessionRead: "none",
-	SessionReadFailed: "none",
+	SessionRead: "restoration",
+	SessionReadFailed: "restoration",
 	SignedOut: "signed-out",
 	SignOutFailed: "failed",
 	AccountAt: "none",
@@ -13433,6 +13935,49 @@ const authFailure = (record, reason, mode) => ({
 		...linkage(record)
 	}
 });
+/**
+* The label of the restore window every client boots into. A settled session
+* fact that left this label is the restoration result (#1962 R04); the same
+* facts from a signed-out or authenticated state are the routine session probe
+* that `getSession()` runs, and a probe is not a restoration attempt.
+*/
+const RESTORE_WINDOW = "restoring";
+/**
+* Which result the window settled on. `SessionRestored` and `SessionAbsent` are
+* the cache door and say it themselves. `ReadSession` is also valid inside the
+* window — `getSession()` drives it on a cache miss and its `SessionRead`
+* completion settles the window — so that one event reports both halves and the
+* state it produced is what separates them.
+*/
+const restorationOutcome = (event, state) => {
+	switch (event) {
+		case "SessionRestored": return "restored";
+		case "SessionAbsent": return "absent";
+		case "SessionReadFailed": return "failed";
+		case "SessionRead":
+			if (state.phase === "authenticated") return "restored";
+			return state.phase === "signed_out" ? "absent" : void 0;
+		default: return;
+	}
+};
+/**
+* The restore window's one result, or nothing when this settled session fact
+* belongs to a probe rather than to the window.
+*/
+const restorationObservation = (record, state) => {
+	if (record.slot !== "identity:session" || record.from !== RESTORE_WINDOW) return NONE;
+	const outcome = restorationOutcome(record.event, state);
+	if (outcome === void 0) return NONE;
+	return {
+		name: "access_recovery_completed",
+		props: {
+			recovery: "session_restoration",
+			outcome,
+			...outcome === "failed" && state.phase === "faulted" ? { reason_code: state.failure.code } : {},
+			...linkage(record)
+		}
+	};
+};
 const REFUSAL_EVENTS = /* @__PURE__ */ new Set([
 	"ClaimAccount",
 	"RetryAccount",
@@ -13477,6 +14022,7 @@ function mapIdentityProductObservation(record, state) {
 			name: "auth_signed_out",
 			props: linkage(record)
 		};
+		case "restoration": return restorationObservation(record, state);
 	}
 }
 const ignoreTransportFailure = (operation, operationName, eventName) => Effect.suspend(operation).pipe(Effect.catchCause(() => Effect.logWarning("identity.product.telemetry.dropped").pipe(Effect.annotateLogs({
@@ -13488,7 +14034,7 @@ function executeIdentityProductObservation(telemetry, record, state) {
 	if (mapped === null) return Effect.void;
 	copyInvocationObservation(record, mapped);
 	const invocationTelemetry = bindProductTelemetryInvocation(telemetry, mapped);
-	const after = () => mapped.name === "auth_verified" && state.phase === "authenticated" ? invocationTelemetry.identify({
+	const after = () => state.phase === "authenticated" && (mapped.name === "auth_verified" || mapped.name === "access_recovery_completed") ? invocationTelemetry.identify({
 		distinctId: state.session.authUserId,
 		traits: { email_domain: emailDomain(state.session.email) }
 	}) : mapped.name === "auth_signed_out" ? invocationTelemetry.reset() : Effect.void;
@@ -13533,6 +14079,51 @@ function startSignerReadinessOnClaim(actor, signer) {
 		browserSigner.ensureWalletReady?.().catch(() => {});
 	});
 }
+/**
+* Report the result of each signer readiness cycle (#1962 R04).
+*
+* The readiness store already carries the cycle boundary this needs, so no
+* public signer hook, second identity subscriber, or render counter is added.
+* `ensureOpenfortWalletReady` writes `recovering` synchronously when it starts
+* a cycle, and only the cycle that is still the current one writes `ready` or
+* `unavailable` (`create-openfort-browser-signer.ts:501-521`). Callers that
+* join a live cycle share that single write, and a `resetSession` writes
+* `unknown` first, so a cycle that a reset or an account replacement outran
+* reports nothing.
+*
+* The host context is bound when the cycle starts, so a person who signs out
+* and back in while a cycle runs cannot relabel the result that began under
+* the previous person. A signer with no readiness cycle — a node or dev key,
+* and a headless client whose requirement never opens the account lane —
+* writes no status and reports nothing.
+*/
+function observeSignerReadinessCycles(signer, telemetry, hostObservationSnapshot, runPromise) {
+	const statusStore = signer?.statusStore;
+	if (statusStore === void 0 || telemetry === void 0) return () => {};
+	let running = false;
+	let startContext;
+	return statusStore.subscribe((status) => {
+		if (status === "recovering") {
+			running = true;
+			startContext = hostObservationSnapshot?.();
+			return;
+		}
+		const cycleContext = startContext;
+		const completesCycle = running;
+		running = false;
+		startContext = void 0;
+		if (!completesCycle || status !== "ready" && status !== "unavailable") return;
+		const event = {
+			name: "access_recovery_completed",
+			props: {
+				recovery: "signer_readiness",
+				outcome: status
+			}
+		};
+		if (cycleContext !== void 0) attachInvocationObservation(event, cycleContext);
+		runPromise(Effect.suspend(() => bindProductTelemetryInvocation(telemetry, event).emit(event)).pipe(Effect.catchCause(() => Effect.void))).catch(() => {});
+	});
+}
 function assembleCapxulClient(input) {
 	const observation = input;
 	const authCache = input.authCache ?? detectAuthCacheAdapter();
@@ -13562,12 +14153,14 @@ function assembleCapxulClient(input) {
 		}, failureObservation, normalizeCapxulOperation(`identity.${record.event}`), "machine");
 	});
 	const unsubscribeSignerReadiness = startSignerReadinessOnClaim(actor, input.signer);
+	const unsubscribeReadinessObservation = observeSignerReadinessCycles(input.signer, input.ports.telemetry, observation.hostObservationSnapshot, effectRunner.runPromise);
 	let stopPromise = null;
 	const stopActor = () => {
 		if (stopPromise === null) {
 			unsubscribeProductTelemetry();
 			unsubscribeFailureObservation();
 			unsubscribeSignerReadiness();
+			unsubscribeReadinessObservation();
 			stopPromise = effectRunner.runPromise(Scope.close(scope, Exit.void));
 		}
 		return stopPromise;
@@ -13584,7 +14177,8 @@ function assembleCapxulClient(input) {
 		convexCall: input.ports.convexCall,
 		...input.signer === void 0 ? {} : { signer: input.signer },
 		telemetry: input.ports.telemetry,
-		requestKeyScope: `${input.bootstrap.convexUrl}:${String(input.bootstrap.chainId)}`
+		requestKeyScope: `${input.bootstrap.convexUrl}:${String(input.bootstrap.chainId)}`,
+		...input.ports.indexerRead === void 0 ? {} : { indexerRead: input.ports.indexerRead }
 	});
 	const accountBundle = makeAccountMethods({
 		actor,
@@ -13655,7 +14249,8 @@ function assembleCapxulClient(input) {
 		convexCall: input.ports.convexCall,
 		telemetry: input.ports.telemetry,
 		runPromise: effectRunner.runPromise,
-		invocationControls: (controls) => withHostObservationControls(observation.hostObservationSnapshot, controls, actor.authSession()?.authUserId)
+		invocationControls: (controls) => withHostObservationControls(observation.hostObservationSnapshot, controls, actor.authSession()?.authUserId),
+		...input.ports.indexerRead === void 0 ? {} : { indexerRead: input.ports.indexerRead }
 	});
 	const accounts = makeAccountsMethods({
 		accountReadPort: input.ports.accountRead,
@@ -13983,36 +14578,6 @@ function isPromiseLike(value) {
 	return (typeof value === "object" && value !== null || typeof value === "function") && "then" in value;
 }
 //#endregion
-//#region src/ports/indexer-read.ts
-/** The indexer's own page bound. Exceeding it is a caller defect, not a refusal. */
-const INDEXER_MAX_LIMIT = 1e3;
-const LOWER_CASE_ADDRESS = /^0x[0-9a-f]{40}$/;
-/**
-* Refuse a page the indexer would refuse, before any implementation spends a
-* round trip on it. Every implementation calls this, so a consumer test written
-* against the hermetic adapter cannot pass on input production rejects. Throws
-* a `CapxulError`; callers convert it to an `IndexerReadError`.
-*/
-function assertIndexerPage(input) {
-	const safe = String(input.safe).toLowerCase();
-	if (!LOWER_CASE_ADDRESS.test(safe)) throw Errors.invalidInput("safe", "must be a lower-case EVM address");
-	if (!Number.isSafeInteger(input.limit) || input.limit < 1 || input.limit > 1e3) throw Errors.invalidInput("limit", `must be an integer from 1 to ${INDEXER_MAX_LIMIT}`);
-	const offset = input.offset ?? 0;
-	if (!Number.isSafeInteger(offset) || offset < 0) throw Errors.invalidInput("offset", "must be a non-negative integer");
-	return safe;
-}
-var IndexerReadError = class extends Data.TaggedError("IndexerReadError") {};
-function indexerReadErrorFromCapxul(operation, error, cause = error) {
-	return new IndexerReadError({
-		operation,
-		publicCode: error.code,
-		publicError: error,
-		cause,
-		...error.details === void 0 ? {} : { details: error.details }
-	});
-}
-Context.Service()("@capxul/sdk/ports/IndexerReadPort");
-//#endregion
 //#region src/adapters/ponder/decode.ts
 /**
 * Decode the indexer's rows at the trust boundary.
@@ -14318,7 +14883,7 @@ var PonderIndexerAdapter = class {
 		}
 		if (stopped()) return;
 		const error = failure ?? Errors.capabilityUnavailable("indexer", operation);
-		observeStreamFailure(this.#observation, CAPXUL_OPERATIONS.activity.subscribe, error);
+		observeStreamFailure(this.#observation, CAPXUL_OPERATIONS.activity.subscribe, error, error.code === "NOT_AUTHENTICATED" ? "operation" : "exception");
 		callback({
 			status: "error",
 			error
@@ -14955,6 +15520,7 @@ function idempotentClose(close) {
 * and Convex see one session with one scope.
 */
 function productionIndexerReadPort(input, ports, observation) {
+	if (input.activityReadSource === "convex") return void 0;
 	if (input.indexerUrl === void 0 || input.indexerUrl === "") return void 0;
 	return new PonderIndexerAdapter({
 		baseUrl: normalizeHttpUrl("indexerUrl", input.indexerUrl),

package/dist/{production-Du4Vc7YD.d.mts → production-Cpz4hm8p.d.mts}

@@ -1679,6 +1679,17 @@ interface ActivityAnnotationInput {
  * are unaffected.
  */
 interface ActivityMethods {
+  /**
+   * Tell the caller when the indexed page for this actor's Safe changed, over
+   * the indexer's one live connection. The callback carries no rows: it is the
+   * signal to re-read `list` or `summary`. Without an indexer this resolves a
+   * no-op teardown, so a caller needs no branch.
+   *
+   * @internal-use — substrate reactive transport, like `ConvexCallPort.subscribe`.
+   */
+  subscribe(onChange: () => void, params?: {
+    readonly actor?: ActorReference;
+  }, options?: InvocationControls): Promise<CapxulResult<() => void>>;
   list(params?: ActivityListParams, options?: InvocationControls): Promise<CapxulResult<ActivityPage>>;
   summary(params?: ActivitySummaryParams, options?: InvocationControls): Promise<CapxulResult<ActivitySummary>>;
   get(reference: ActivityReference, options?: InvocationControls & {
@@ -2332,9 +2343,15 @@ interface AuthorizeRunInput {
    */
   readonly requestKey?: string;
 }
-type PayrollOptions = {
-  readonly signal?: AbortSignal;
-};
+/**
+ * R13 (#1968): the declared option type is the `InvocationControls` these
+ * methods have always forwarded to `deps.invocationControls` — the same naming
+ * R02 gave the address book. It lets a caller that captured one browser attempt
+ * hand that attempt's `correlation_id`/`journey_id` to the payroll operation it
+ * starts, so `ui_payroll_action_completed` and the durable group and run events
+ * share a correlation. `{ signal }` callers are unaffected.
+ */
+type PayrollOptions = InvocationControls;
 type AuthorizeRunOptions = PayrollOptions & {
   /** Persist this SDK-allocated key before the first backend write. Reject to prevent execution. */
   readonly onRequestKey?: (key: string) => void | Promise<void>;

package/dist/testing/index.d.mts

@@ -1,5 +1,5 @@
 import { h as CapxulResult } from "../OAuthBearerAuthClient-C-ip-z8M.mjs";
-import { er as TelemetryEvent, f as CapxulClient, i as ObservationAdapter, n as ProductionSignerControls, nr as TelemetryIdentifyInput, pr as IdentityTransition, t as CapxulClientInput, tr as TelemetryGroupInput } from "../production-Du4Vc7YD.mjs";
+import { er as TelemetryEvent, f as CapxulClient, i as ObservationAdapter, n as ProductionSignerControls, nr as TelemetryIdentifyInput, pr as IdentityTransition, t as CapxulClientInput, tr as TelemetryGroupInput } from "../production-Cpz4hm8p.mjs";
 import { Effect, Layer } from "effect";
 //#region src/testing/production-client.d.ts
 /** Create the one production client with per-client controls at its signing boundaries. */

package/dist/testing/index.mjs

@@ -1,5 +1,5 @@
-import { D as fromWei, P as redactTelemetryEvent, a as smartAccountErrorFromCapxul, c as identityErrorFromCapxul, i as assembleCapxulClient, l as convexCallErrorFromCapxul, n as createCapxulClientWithSignerControls, o as accountReadErrorFromCapxul, s as wireChainId, u as bootstrapErrorFromCapxul, v as toWei } from "../production-BndbwuVx.mjs";
-import { G as toHandle, H as toEmail, I as toAuthUserId, K as toJwtToken, M as toAddress, N as toAllowedOrigin, P as toAppId, Q as toPublishableKey, R as toChainId, U as toEpochMs, V as toDurationMs, W as toEpochSeconds, d as authClientPortFromPromiseAdapter, et as toSessionToken, j as toAccountId, lt as Errors, n as readClockNow, q as toKycTier, r as InMemoryAuthCacheAdapter, rt as validateHandle, st as CapxulError, y as deriveCapxulSafeAddress, z as toCountryCode } from "../OAuthBearerAuthClient-IB2W1Fzj.mjs";
+import { D as fromWei, P as redactTelemetryEvent, a as smartAccountErrorFromCapxul, c as identityErrorFromCapxul, i as assembleCapxulClient, l as convexCallErrorFromCapxul, n as createCapxulClientWithSignerControls, o as accountReadErrorFromCapxul, s as wireChainId, u as bootstrapErrorFromCapxul, v as toWei } from "../production-C8FuAYm1.mjs";
+import { G as toHandle, H as toEmail, I as toAuthUserId, K as toJwtToken, M as toAddress, N as toAllowedOrigin, P as toAppId, Q as toPublishableKey, R as toChainId, U as toEpochMs, V as toDurationMs, W as toEpochSeconds, ct as CapxulError, d as authClientPortFromPromiseAdapter, et as toSessionToken, it as validateHandle, j as toAccountId, n as readClockNow, q as toKycTier, r as InMemoryAuthCacheAdapter, ut as Errors, y as deriveCapxulSafeAddress, z as toCountryCode } from "../OAuthBearerAuthClient-CbU_W9Sp.mjs";
 import { keccak256 } from "viem";
 import { Effect, Result, Semaphore } from "effect";
 import { getFunctionName } from "convex/server";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@capxul/sdk",
-  "version": "4.2.0-rc.10",
+  "version": "4.2.0-rc.12",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/Xelmar-tech/infrastructure.git",
@@ -47,12 +47,12 @@
     "vite": "npm:@voidzero-dev/vite-plus-core@0.3.0",
     "vite-plus": "0.3.0",
     "vitest": "4.1.11",
-    "@capxul/errors": "0.3.0",
+    "@capxul/config": "0.3.0",
+    "@capxul/observability": "4.2.0-rc.12",
     "@capxul/typescript-config": "0.0.0",
-    "@capxul/observability": "4.2.0-rc.10",
-    "@capxul/wire": "0.7.0",
     "@capxul/types": "0.3.0",
-    "@capxul/config": "0.3.0"
+    "@capxul/errors": "0.3.0",
+    "@capxul/wire": "0.7.0"
   },
   "_permissionlessPinReason": "permissionless.toSafeSmartAccount is pinned to 0.3.4 for live Safe deployment E2E. Counterfactual address fixtures captured 2026-05-17 in packages/backend/convex/_shared/__tests__/counterfactual.test.ts and packages/config/tests/safe.test.ts must be re-verified before upgrading.",
   "scripts": {