@capxul/sdk 4.20.0-beta.24 → 4.20.0-beta.27

package/dist/{access-CCRHHGfU.mjs → access-BnlgphFT.mjs}

@@ -1,4 +1,4 @@
-import { Cause, Clock, Context, Data, Deferred, Effect, Exit, Fiber, Layer, Predicate, Queue, Ref, Result, Schema, SchemaGetter, SchemaParser } from "effect";
+import { Cause, Clock, Context, Data, Deferred, Effect, Exit, Fiber, Layer, Option, Predicate, Queue, Ref, Result, Schema, SchemaGetter, SchemaParser } from "effect";
 import { makeFunctionReference } from "convex/server";
 import { bytesToHex, concat, decodeErrorResult, encodeAbiParameters, encodeFunctionData, encodePacked, formatUnits, getContractAddress, hashTypedData, isAddress, isHex, keccak256, pad, padHex, parseAbiParameters, recoverAddress, recoverTypedDataAddress, toBytes, toFunctionSignature, toHex } from "viem";
 import { getUserOperationHash } from "viem/account-abstraction";
@@ -218,12 +218,17 @@ const Errors = {
 	* a PERMISSION denial — explicitly NOT an `INSUFFICIENT_BALANCE` (the treasury
 	* held the funds; the role's authority is what bound). `reason` discriminates
 	* the violated condition (`over_cap` / `daily_cap` / `not_member` /
-	* `disallowed_recipient` / `condition_violation`); leak-safe — no on-chain
-	* identifiers ever enter the details.
+	* `disallowed_recipient` / `condition_violation` / `budget_exhausted`);
+	* no Safe, Roles module or role key enters the details.
+	* `budget_exhausted` carries what the Budget's allowance still holds and
+	* what the spend needs, as asset amounts in major units (#2297); the asset
+	* id names the public token contract.
 	*/
-	rolePermissionDenied: (details) => new CapxulError("ROLE_PERMISSION_DENIED", `Org role denied this spend on-chain (${details.reason}).`, { details: details.operation === void 0 ? { reason: details.reason } : {
+	rolePermissionDenied: (details) => new CapxulError("ROLE_PERMISSION_DENIED", `Org role denied this spend on-chain (${details.reason}).`, { details: {
 		reason: details.reason,
-		operation: details.operation
+		...details.operation === void 0 ? {} : { operation: details.operation },
+		...details.remaining === void 0 ? {} : { remaining: details.remaining },
+		...details.required === void 0 ? {} : { required: details.required }
 	} }),
 	/**
 	* A transaction (or sponsored UserOp) failed. `details.reason` discriminates
@@ -3552,7 +3557,7 @@ const ActivityItemSchema = Schema.Union([Schema.Struct({
 }), Schema.Struct({
 	kind: Schema.Literal("movement"),
 	id: Schema.String,
-	classification: Schema.Literal("movement_only_outflow"),
+	classification: Schema.Literals(["deposit", "movement_only_outflow"]),
 	amount: Amount,
 	direction: Direction,
 	counterpartyLabel: Schema.String,
@@ -4818,10 +4823,19 @@ const ApprovalNetworkSchema = Schema.Struct({
 	name: Schema.String,
 	explorerUrl: Schema.String
 });
+/**
+* Whose money the operation moves: the person's own, or an Organization's,
+* which a reader follows through that Organization's scope.
+*/
+const ApprovalActorSchema = Schema.Union([Schema.Struct({ kind: Schema.Literal("personal") }), Schema.Struct({
+	kind: Schema.Literal("organization"),
+	orgId: Schema.NonEmptyString
+})]);
 /** What the person reads before they sign. */
 const ApprovalSummarySchema = Schema.Struct({
 	title: Schema.String,
 	from: Schema.Struct({
+		kind: Schema.Literals(["personal", "organization"]),
 		label: Schema.String,
 		address: AddressSchema$1
 	}),
@@ -4843,6 +4857,7 @@ const ApprovalSchema = Schema.Struct({
 	url: Schema.String,
 	kind: Schema.Literals(APPROVAL_KINDS),
 	state: Schema.Literals(APPROVAL_STATES),
+	actor: ApprovalActorSchema,
 	summary: ApprovalSummarySchema,
 	operation: ApprovalOperationSchema,
 	/** Who must sign: the owner key of the paying Safe. */
@@ -5075,7 +5090,44 @@ const approvals = {
 		]
 	})
 };
+/**
+* The home screen in one read. A section whose read failed is null, so the
+* caller shows it as unavailable, never as empty.
+*/
+const HomeSchema = Schema.Struct({
+	email: Schema.String,
+	actingAs: Schema.Union([Schema.Struct({ kind: Schema.Literal("personal") }), Schema.Struct({
+		kind: Schema.Literal("organization"),
+		orgId: Schema.String
+	})]),
+	/** The acting Safe's position in each settlement asset of its chain. */
+	balances: Schema.NullOr(Schema.Array(AssetPositionSchema)),
+	/** The ids of what waits on the caller, newest first. */
+	needsYou: Schema.NullOr(Schema.Struct({
+		requestsToPay: Schema.Array(Schema.String),
+		payrollToApprove: Schema.Array(Schema.String),
+		paymentsToRetry: Schema.Array(Schema.String)
+	})),
+	/** The newest rows of the actor's activity. */
+	recentActivity: Schema.NullOr(Schema.Array(ActivityItemSchema))
+});
 const summaries = {
+	/**
+	* Where the caller acts, its balances, what needs it and its newest activity,
+	* for the person or for an Organization they take part in. One round trip.
+	*/
+	home: Operation.action("accounts.summaries.home", {
+		input: Schema.Struct({
+			chainId: ChainIdSchema$1,
+			orgId: Schema.optionalKey(Schema.NonEmptyString)
+		}),
+		output: HomeSchema,
+		errors: [
+			...CALL$10,
+			...DEFECTS,
+			"ROLE_PERMISSION_DENIED"
+		]
+	}),
 	/** The signed-in person: id, verified email and Profile display name. */
 	me: Operation.query("accounts.summaries.me", {
 		input: Schema.Struct({}),
@@ -7167,7 +7219,11 @@ const OrgId$2 = Schema.NonEmptyString;
 const CALL$4 = ["NOT_AUTHENTICATED", "INVALID_INPUT"];
 /** The caller's own Account and Safe, which a Payment is signed from. */
 const ACCOUNT$1 = ["SMART_ACCOUNT_MISSING", "ACCOUNT_NOT_FOUND"];
-/** Not a participant of the Organization, or no Budget in it that may pay for this. */
+/**
+* Not a participant of the Organization, no Budget in it that may pay for
+* this, or a Budget whose on-chain allowance holds less than the batch spends
+* (`budget_exhausted`, naming what is left).
+*/
 const DENIED$1 = ["ROLE_PERMISSION_DENIED"];
 /** The command, its Payment or its execution is not in a state this applies to. */
 const STATE$3 = ["WRONG_STATE"];
@@ -7478,7 +7534,9 @@ const OneOrganization = Schema.Struct({ orgId: OrgId$1 });
 const CALL$3 = ["NOT_AUTHENTICATED", "INVALID_INPUT"];
 /**
 * The caller does not take part in the Organization, or holds no Budget in it
-* that may pay for this. A caller outside the Organization learns nothing more.
+* that may pay for this, or the Budget's on-chain allowance holds less than the
+* run pays (`budget_exhausted`, naming what is left). A caller outside the
+* Organization learns nothing more.
 */
 const DENIED = ["ROLE_PERMISSION_DENIED"];
 /**
@@ -9087,7 +9145,11 @@ const ORGANIZATION_OPERATIONS = {
 			seedNativeReadiness: "operator.fixtures.seedNativeReadiness",
 			seedPrerequisites: "operator.fixtures.seedPrerequisites"
 		},
-		identities: { purgeByEmail: "operator.identities.purgeByEmail" }
+		identities: {
+			purgeByEmail: "operator.identities.purgeByEmail",
+			/** One Account and every row that refers to it, unless it has Payments or an Organization tie. */
+			purgeAccount: "operator.identities.purgeAccount"
+		}
 	},
 	/** Organizations' internal functions; its public rows join from `OPERATIONS`. */
 	organizations: {
@@ -9181,7 +9243,9 @@ emitSaved: "activity.annotations.emitSaved" },
 			linkObservation: "payments.commands.linkObservation",
 			failPrepared: "payments.commands.failPrepared",
 			loadContext: "payments.commands.loadContext",
-			loadExecutionContext: "payments.commands.loadExecutionContext"
+			loadExecutionContext: "payments.commands.loadExecutionContext",
+			/** The capped Budget a prepared Organization command spends from, before its allowance is read on chain. */
+			loadBudgetAllowance: "payments.commands.loadBudgetAllowance"
 		},
 		lifecycles: { prepareIntent: "payments.lifecycles.prepareIntent" },
 		/** The stored UserOperation of every money command: Payment, Permission and configuration. */
@@ -9335,7 +9399,11 @@ const PLATFORM_OPERATIONS = {
 			recordUse: "applications.bootstraps.recordUse",
 			resolve: "applications.bootstraps.resolve"
 		},
-		keys: { issue: "applications.keys.issue" },
+		keys: {
+			issue: "applications.keys.issue",
+			/** Operator-only: revoke one key by its id, whoever owns it. */
+			revokeById: "applications.keys.revokeById"
+		},
 		quickstarts: {
 			claim: "applications.quickstarts.claim",
 			mint: "applications.quickstarts.mint"
@@ -10692,95 +10760,83 @@ Schema.Struct({
 });
 //#endregion
 //#region ../observability/src/catalog/cli.ts
-/** One completed online CLI diagnostic. No command input or provider text. */
+/** Every command path of the `capxul` tree, dot-separated, plus the root and `unknown`. */
 const CLI_COMMAND_NAMES = [
-	"status",
-	"request",
-	"request.list",
-	"request.get",
-	"request.cancel",
-	"offer",
-	"offer.create",
-	"offer.list",
-	"offer.get",
-	"offer.revise",
-	"offer.deactivate",
-	"org.offer",
-	"org.offer.create",
-	"org.offer.list",
-	"org.offer.get",
-	"org.offer.revise",
-	"org.offer.deactivate",
-	"request.issue",
-	"inbox",
-	CAPXUL_OPERATIONS.inbox.list,
-	"inbox.get",
-	"inbox.pay",
-	CAPXUL_OPERATIONS.inbox.decline,
-	"org.request",
-	"org.request.list",
-	"org.request.get",
-	"org.request.cancel",
-	"org.request.issue",
-	"org.inbox",
-	CAPXUL_OPERATIONS.org.inbox.list,
-	"org.inbox.get",
-	"org.inbox.pay",
-	CAPXUL_OPERATIONS.org.inbox.decline,
 	"capxul",
+	"home",
 	"whoami",
 	"use",
 	"use.personal",
 	"use.org",
 	"use.env",
-	"doctor",
-	"telemetry",
-	"telemetry.status",
-	"telemetry.enable",
-	"telemetry.disable",
 	"auth",
 	"auth.login",
-	"auth.signup",
-	"auth.send",
 	"auth.verify",
 	"auth.switch",
-	"auth.profile",
-	"auth.status",
 	"auth.logout",
 	"account",
-	CAPXUL_OPERATIONS.account.status,
-	CAPXUL_OPERATIONS.account.balance,
-	"account.deposit",
+	"account.show",
 	"account.retry",
-	"document",
-	"document.get",
-	"document.verify",
-	"document.render",
-	"document.export",
+	"balance",
+	"address",
 	"payment",
+	"payment.send",
 	"payment.list",
 	"payment.get",
 	"payment.wait",
-	"payment.send",
 	"payment.retry",
-	"activity",
-	"activity.list",
-	"activity.get",
-	"activity.summary",
-	"activity.annotate",
+	"inbox",
+	CAPXUL_OPERATIONS.inbox.list,
+	"inbox.get",
+	"inbox.pay",
+	CAPXUL_OPERATIONS.inbox.decline,
+	"request",
+	"request.issue",
+	"request.list",
+	"request.get",
+	"request.cancel",
+	"offer",
+	"offer.create",
+	"offer.list",
+	"offer.get",
+	"offer.revise",
+	"offer.deactivate",
 	"contact",
+	"contact.add",
 	"contact.list",
 	"contact.get",
-	"contact.add",
 	"contact.label",
 	"contact.hide",
 	"contact.unhide",
+	"document",
+	"document.get",
+	"document.render",
+	"document.export",
+	"document.verify",
+	"activity",
+	"activity.list",
+	"activity.get",
+	"activity.summary",
+	"activity.annotate",
+	"invite",
+	"invite.list",
+	"invite.accept",
+	"invite.decline",
 	"org",
 	CAPXUL_OPERATIONS.org.list,
-	"org.status",
+	CAPXUL_OPERATIONS.org.create,
+	"org.show",
 	CAPXUL_OPERATIONS.org.me,
-	"org.balance",
-	"org.deposit",
+	"org.wait",
+	CAPXUL_OPERATIONS.org.retry,
+	"org.member",
+	"org.member.list",
+	"org.member.get",
+	"org.member.invite",
+	CAPXUL_OPERATIONS.org.invite,
+	"org.invite.list",
+	"org.invite.cancel",
+	"org.invite.resend",
 	"org.permission",
 	"org.permission.list",
 	"org.permission.get",
@@ -10792,46 +10848,32 @@ const CLI_COMMAND_NAMES = [
 	"org.permission.command",
 	"org.permission.command.get",
 	"org.permission.command.wait",
-	CAPXUL_OPERATIONS.org.payment,
-	"org.payment.list",
-	"org.payment.get",
-	"org.payment.wait",
-	"org.payment.retry",
-	"org.payment.send",
 	"org.payroll",
+	"org.payroll.run",
+	"org.payroll.list",
+	"org.payroll.get",
+	"org.payroll.wait",
+	CAPXUL_OPERATIONS.org.payroll.terms,
 	"org.payroll.groups",
 	CAPXUL_OPERATIONS.org.payroll.groups.list,
 	CAPXUL_OPERATIONS.org.payroll.groups.save,
 	CAPXUL_OPERATIONS.org.payroll.groups.remove,
-	CAPXUL_OPERATIONS.org.payroll.terms,
-	"org.payroll.list",
-	"org.payroll.run",
-	"org.payroll.get",
-	"org.payroll.wait",
-	CAPXUL_OPERATIONS.org.members,
-	"org.member",
-	"org.member.get",
-	"org.member.invite",
-	"org.contact",
-	"org.contact.list",
-	"org.contact.get",
-	"org.contact.add",
-	"org.contact.label",
-	"org.contact.hide",
-	"org.contact.unhide",
-	CAPXUL_OPERATIONS.org.invite,
-	"org.invite.list",
+	"config",
+	"config.telemetry",
+	"config.telemetry.on",
+	"config.telemetry.off",
+	"config.telemetry.status",
+	"invite.get",
+	"invite.review",
+	"invite.wait",
 	"org.invite.get",
 	"org.invite.wait",
-	"org.invite.review",
-	"org.invite.accept",
-	"org.invite.decline",
-	"org.invite.cancel",
-	"org.invite.resend",
 	"org.invite.retry",
-	"org.wait",
-	CAPXUL_OPERATIONS.org.create,
-	CAPXUL_OPERATIONS.org.retry,
+	"schema",
+	"doctor",
+	"dev",
+	"dev.key",
+	"dev.fund",
 	"unknown"
 ];
 const CLI_CAPABILITIES = [
@@ -12525,7 +12567,7 @@ function mapAccountLifecycle(input) {
 }
 //#endregion
 //#region package.json
-var version = "4.20.0-beta.24";
+var version = "4.20.0-beta.27";
 //#endregion
 //#region src/observability/telemetry/exception-projection.ts
 /** Fixed fallback for failures that have no safe message. */
@@ -16726,6 +16768,13 @@ function subscribeFreshQuery(deps, args, listener, operation, projection, option
 }
 //#endregion
 //#region src/payments/lifecycle-execution.ts
+/**
+* The prepared command is this lifecycle intent; a retry also names the
+* original birth command of the scope it was asked for.
+*/
+const lifecycleCommandCheck = (intent, expectedOrganizationId) => async (request, evidence) => await matchesIntent(intent)(request, evidence) && (intent.kind !== "retry" || (expectedOrganizationId === void 0 ? evidence.sourceCommand?.kind === "birth" && evidence.sourceCommand.actor.kind === "account" : evidence.sourceCommand?.kind === "birth" && evidence.sourceCommand.actor.kind === "organization" && evidence.sourceCommand.actor.orgId === expectedOrganizationId));
+/** The prepared command pays exactly the request the payer confirmed. */
+const requestPaymentCheck = (confirmation) => async (request) => "kind" in request && request.kind === "payment_request" && canonicalJson(request.confirmation) === canonicalJson(confirmation);
 function executePaymentLifecycle(deps, intent, signal, controls, expectedOrganizationId, onPrepared) {
 	return executePrepared(deps, (signerAddress) => runIfActive(signal, CAPXUL_OPERATIONS.payments.prepareLifecycleExecution, () => withInvocationParentSpan(Effect.suspend(() => callOperation(deps.convexCall, lifecycles.prepareScoped, copyInvocationObservation(controls, {
 		signerAddress,
@@ -16734,13 +16783,13 @@ function executePaymentLifecycle(deps, intent, signal, controls, expectedOrganiz
 			kind: "organization",
 			orgId: expectedOrganizationId
 		}
-	})).pipe(Effect.mapError((publicError) => ({ publicError })))), controls), deps.runPromise), async (request, evidence) => await matchesIntent(intent)(request, evidence) && (intent.kind !== "retry" || (expectedOrganizationId === void 0 ? evidence.sourceCommand?.kind === "birth" && evidence.sourceCommand.actor.kind === "account" : evidence.sourceCommand?.kind === "birth" && evidence.sourceCommand.actor.kind === "organization" && evidence.sourceCommand.actor.orgId === expectedOrganizationId)), false, void 0, signal, controls, onPrepared);
+	})).pipe(Effect.mapError((publicError) => ({ publicError })))), controls), deps.runPromise), lifecycleCommandCheck(intent, expectedOrganizationId), false, void 0, signal, controls, onPrepared);
 }
 function executeRequestPayment(deps, confirmation, controls, onPrepared) {
 	return executePrepared(deps, (signerAddress) => runIfActive(controls?.signal, commands$1.prepareRequest.name, () => withInvocationParentSpan(Effect.suspend(() => callOperation(deps.convexCall, commands$1.prepareRequest, copyInvocationObservation(controls, {
 		confirmation,
 		signerAddress
-	})).pipe(Effect.mapError((publicError) => ({ publicError })))), controls), deps.runPromise), async (request) => "kind" in request && request.kind === "payment_request" && canonicalJson(request.confirmation) === canonicalJson(confirmation), false, void 0, controls?.signal, controls, onPrepared);
+	})).pipe(Effect.mapError((publicError) => ({ publicError })))), controls), deps.runPromise), requestPaymentCheck(confirmation), false, void 0, controls?.signal, controls, onPrepared);
 }
 function executeOrganizationPayment(deps, input, signal, onPreparedClosed, controls, onPrepared) {
 	return executePrepared(deps, (signerAddress) => runIfActive(signal, CAPXUL_OPERATIONS.organizationPayments.prepareExecution, () => withInvocationParentSpan(Effect.suspend(() => callOperation(deps.convexCall, commands$1.prepareOrganization, copyInvocationObservation(controls, {
@@ -18224,63 +18273,6 @@ function makeOfframpMethods() {
 	};
 }
 //#endregion
-//#region src/payments/organization-payment-reads.ts
-const exactPaymentId = (value) => Schema.decodeEffect(PaymentIdSchema)(value).pipe(Effect.mapError(() => Errors.invalidInput("paymentId", "Provide one exact Payment ID")));
-/** Read the backend-authorized Organization wrapper before projecting any Payment. */
-function makeOrganizationPaymentReadMethods(deps, orgId) {
-	return {
-		previewRetry(paymentId, options) {
-			const controls = deps.invocationControls?.(options) ?? options;
-			return runCapxulEffect(Effect.gen(function* () {
-				const id = yield* exactPaymentId(paymentId);
-				const preview = yield* callOperation(deps.convexCall, lifecycles.previewRetry, copyInvocationObservation(controls, {
-					orgId,
-					paymentId: id
-				}));
-				if (preview.orgId !== orgId || !preview.paymentIds.includes(id) || new Set(preview.paymentIds).size !== preview.paymentIds.length || preview.payments.length !== preview.paymentIds.length || preview.payments.some((payment, index) => payment.id !== preview.paymentIds[index] || payment.direction !== "out")) return yield* Effect.fail(Errors.invalidInput("paymentId", "Invalid Organization retry preview"));
-				return {
-					...preview,
-					paymentIds: [...preview.paymentIds],
-					payments: preview.payments.map((payment) => normalizePaymentTiming(payment))
-				};
-			}), controls, lifecycles.previewRetry.name, deps.runPromise);
-		},
-		list(options) {
-			const controls = deps.invocationControls?.(options) ?? options;
-			return runCapxulEffect(callOperation(deps.convexCall, records.listForOrganization, copyInvocationObservation(controls, { orgId })).pipe(Effect.filterOrFail((result) => result.orgId === orgId, () => Errors.invalidInput("orgId", "Invalid Organization Payment list")), Effect.map((result) => mapPage(result, (payment) => normalizePaymentTiming(payment)))), controls, records.listForOrganization.name, deps.runPromise);
-		},
-		get(paymentId, options) {
-			const controls = deps.invocationControls?.(options) ?? options;
-			return runCapxulEffect(Effect.gen(function* () {
-				const id = yield* exactPaymentId(paymentId);
-				const response = yield* callOperation(deps.convexCall, records.getForOrganization, copyInvocationObservation(controls, {
-					orgId,
-					paymentId: id
-				}));
-				if (response.orgId !== orgId) return yield* Effect.fail(Errors.invalidInput("orgId", "Payment read scope does not match"));
-				const decoded = response.payment;
-				if (decoded === null) return null;
-				if (decoded.id !== id) return yield* Effect.fail(Errors.invalidInput("paymentId", "Invalid Organization Payment response"));
-				return normalizePaymentTiming(decoded);
-			}), controls, records.getForOrganization.name, deps.runPromise);
-		},
-		subscribe(paymentId, listener, options) {
-			const parsed = Schema.decodeResult(PaymentIdSchema)(paymentId);
-			if (parsed._tag === "Failure") return Promise.resolve({
-				ok: false,
-				error: Errors.invalidInput("paymentId", "Provide one exact Payment ID")
-			});
-			return subscribeOrganizationPayment({
-				actor: deps.actor,
-				convexCall: deps.convexCall,
-				getPayment: reference(records.getForOrganization),
-				runPromise: deps.runPromise,
-				invocationControls: deps.invocationControls
-			}, orgId, parsed.success, listener, options);
-		}
-	};
-}
-//#endregion
 //#region src/payments/organization-payment-requests.ts
 const organizationPaymentIntentSchema = Schema.Struct({
 	orgId: PrepareOrganizationPaymentExecutionInputSchema.fields.orgId,
@@ -18341,8 +18333,65 @@ async function organizationPaymentRequest(scope, actor, intent, providedKey) {
 	}
 }
 //#endregion
+//#region src/payments/organization-payment-reads.ts
+const exactPaymentId = (value) => Schema.decodeEffect(PaymentIdSchema)(value).pipe(Effect.mapError(() => Errors.invalidInput("paymentId", "Provide one exact Payment ID")));
+/** Read the backend-authorized Organization wrapper before projecting any Payment. */
+function makeOrganizationPaymentReadMethods(deps, orgId) {
+	return {
+		previewRetry(paymentId, options) {
+			const controls = deps.invocationControls?.(options) ?? options;
+			return runCapxulEffect(Effect.gen(function* () {
+				const id = yield* exactPaymentId(paymentId);
+				const preview = yield* callOperation(deps.convexCall, lifecycles.previewRetry, copyInvocationObservation(controls, {
+					orgId,
+					paymentId: id
+				}));
+				if (preview.orgId !== orgId || !preview.paymentIds.includes(id) || new Set(preview.paymentIds).size !== preview.paymentIds.length || preview.payments.length !== preview.paymentIds.length || preview.payments.some((payment, index) => payment.id !== preview.paymentIds[index] || payment.direction !== "out")) return yield* Effect.fail(Errors.invalidInput("paymentId", "Invalid Organization retry preview"));
+				return {
+					...preview,
+					paymentIds: [...preview.paymentIds],
+					payments: preview.payments.map((payment) => normalizePaymentTiming(payment))
+				};
+			}), controls, lifecycles.previewRetry.name, deps.runPromise);
+		},
+		list(options) {
+			const controls = deps.invocationControls?.(options) ?? options;
+			return runCapxulEffect(callOperation(deps.convexCall, records.listForOrganization, copyInvocationObservation(controls, { orgId })).pipe(Effect.filterOrFail((result) => result.orgId === orgId, () => Errors.invalidInput("orgId", "Invalid Organization Payment list")), Effect.map((result) => mapPage(result, (payment) => normalizePaymentTiming(payment)))), controls, records.listForOrganization.name, deps.runPromise);
+		},
+		get(paymentId, options) {
+			const controls = deps.invocationControls?.(options) ?? options;
+			return runCapxulEffect(Effect.gen(function* () {
+				const id = yield* exactPaymentId(paymentId);
+				const response = yield* callOperation(deps.convexCall, records.getForOrganization, copyInvocationObservation(controls, {
+					orgId,
+					paymentId: id
+				}));
+				if (response.orgId !== orgId) return yield* Effect.fail(Errors.invalidInput("orgId", "Payment read scope does not match"));
+				const decoded = response.payment;
+				if (decoded === null) return null;
+				if (decoded.id !== id) return yield* Effect.fail(Errors.invalidInput("paymentId", "Invalid Organization Payment response"));
+				return normalizePaymentTiming(decoded);
+			}), controls, records.getForOrganization.name, deps.runPromise);
+		},
+		subscribe(paymentId, listener, options) {
+			const parsed = Schema.decodeResult(PaymentIdSchema)(paymentId);
+			if (parsed._tag === "Failure") return Promise.resolve({
+				ok: false,
+				error: Errors.invalidInput("paymentId", "Provide one exact Payment ID")
+			});
+			return subscribeOrganizationPayment({
+				actor: deps.actor,
+				convexCall: deps.convexCall,
+				getPayment: reference(records.getForOrganization),
+				runPromise: deps.runPromise,
+				invocationControls: deps.invocationControls
+			}, orgId, parsed.success, listener, options);
+		}
+	};
+}
+//#endregion
 //#region src/payments/organization-flights.ts
-function executionDependencies(input) {
+function executionDependencies$1(input) {
 	return input.actor === void 0 || input.chainId === void 0 || input.signer === void 0 ? null : {
 		actor: input.actor,
 		chainId: input.chainId,
@@ -18363,7 +18412,7 @@ async function executeOrganizationBatch(scope, input, signal, operation, control
 	};
 	const intent = organizationPaymentIntent(scope.orgId, input);
 	if (!intent.ok) return intent;
-	const execution = executionDependencies(scope.deps);
+	const execution = executionDependencies$1(scope.deps);
 	if (execution === null) return {
 		ok: false,
 		error: Errors.notImplemented("organizationPayments", "executionComposition")
@@ -18487,7 +18536,7 @@ function makeOrganizationPaymentsMethods(deps, orgId) {
 				const parent = yield* Effect.currentSpan.pipe(Effect.orDie);
 				const captured = carryInvocationParentSpan(controls, parent);
 				return yield* awaitCapxulResult(async () => {
-					const execution = executionDependencies(deps);
+					const execution = executionDependencies$1(deps);
 					if (execution === null) return {
 						ok: false,
 						error: Errors.notImplemented("organizationPayments", "executionComposition")
@@ -19251,50 +19300,650 @@ function sleep(ms, signal) {
 	});
 }
 //#endregion
-//#region src/accounts/approvals.ts
-function makeApprovalsMethods(deps) {
-	const call = (name, row, args, signal) => runIfActive(signal, name, () => callOperation(deps.convexCall, row, args, { fresh: true }).pipe(Effect.mapError((publicError) => ({ publicError }))), deps.runPromise);
-	const get = (approvalId) => call(approvals.get.name, approvals.get, { approvalId });
-	const prepare = async (input, options) => {
-		const signal = options?.signal;
-		const intent = paymentExecutionIntent(input);
-		if (!intent.ok) return intent;
-		const { actor, chainId } = deps;
-		if (actor === void 0 || chainId === void 0) return {
-			ok: false,
-			error: Errors.notImplemented("approvals", "prepareComposition")
-		};
-		const session = actor.authSession();
-		if (session === null) return {
-			ok: false,
-			error: Errors.notAuthenticated()
-		};
-		const safe = await call(CAPXUL_OPERATIONS.approvals.prepare, safes.loadByAuthUserId, { authUserId: session.authUserId }, signal);
-		if (!safe.ok) return safe;
-		if (safe.value === null) return {
-			ok: false,
-			error: Errors.smartAccountMissing(session.authUserId)
-		};
-		if (safe.value.signerAddress === null) return {
-			ok: false,
-			error: Errors.wrongState({
+//#region ../protocol/src/payroll/model.ts
+function toPayrollRunId(raw) {
+	return toNonEmptyStringBrand(raw, "payrollRunId", (value) => isNonEmptyString(value));
+}
+function toPayrollGroupId(raw) {
+	return toNonEmptyStringBrand(raw, "payrollGroupId", (value) => isNonEmptyString(value));
+}
+//#endregion
+//#region src/payroll/run-checks.ts
+/** Match the caller's compensation to the committed V3 Payslip. */
+function payslipIdentityMatches(message, item, index, runId, period) {
+	return message.runId === runId && message.itemIndex === index && message.employeeRef === item.partyId && message.periodStart === period.start && message.periodEnd === period.end && message.adjustmentsHash === hashAdjustmentsV3(item.adjustments);
+}
+function payslipAmountMatches(message, item) {
+	const exact = toExactAssetAmount(item.amount, CONFIGURED_MONEY_ASSETS);
+	return message.gross.asset === exact.asset && message.gross.minorUnits === item.gross && message.gross.decimals === exact.decimals && message.net.asset === exact.asset && message.net.minorUnits === item.net && message.net.decimals === exact.decimals;
+}
+function isRunItem(prepared, item, evidence, index, runId, period) {
+	if (prepared === void 0) return false;
+	const bundle = evidence.preparedCommand?.documentBundles?.[index];
+	const preparedItem = evidence.preparedCommand?.items[index];
+	const payslip = bundle?.envelope;
+	if (bundle === void 0 || payslip?.primaryType !== "Payslip") return false;
+	return canonicalJson(prepared.to) === canonicalJson(item.to) && prepared.paymentType === "payroll" && canonicalJson(prepared.amount) === canonicalJson(item.amount) && bundle.adjustments !== void 0 && canonicalJson(bundle.adjustments) === canonicalJson(item.adjustments) && payslipIdentityMatches(payslip.message, item, index, runId, period) && payslipAmountMatches(payslip.message, item) && (preparedItem?.operation === "send" || preparedItem?.operation === "create_commitment") && preparedItem.documentHash === evidence.preparedCommand?.instructionDocuments?.[index]?.documentHash;
+}
+/**
+* The batch the backend derived from a payroll intent must be the batch this
+* caller asked for, checked before the digest is signed.
+*
+* The payslip envelope on each item is server-built and carries the run row's
+* own `issuedAt`, so the batch cannot be fingerprinted against a local copy
+* (`matchesIntent` is unavailable here). What CAN be verified is every field
+* the caller supplied — the org, the Budget, the request key, and per item the
+* recipient, the amount and the payslip figures — plus the lineage binding the
+* batch to the run just written. A prepared command that pays a different
+* person, a different amount, from a different Budget, or under a different
+* run never reaches the signer.
+*/
+function isRunBatch(input) {
+	return (batch, evidence) => Promise.resolve(!("kind" in batch) && batch.orgId === input.orgId && batch.permissionId === input.permissionId && batch.requestKey === input.requestKey && batch.lineage?.kind === "payroll" && batch.lineage.runId === input.runId && batch.items.length === input.items.length && batch.items.every((item) => item.amount.asset === input.asset) && input.items.every((item, index) => isRunItem(batch.items[index], item, evidence, index, input.runId, input.period)));
+}
+/**
+* The batch is `isRunBatch` for the run the backend just wrote, and that run
+* is the period the caller asked for: the payslip's `period` is a
+* server-formatted label, so the stored run is where the caller's own two
+* numbers are checkable.
+*/
+function isAuthorizedRunBatch(input, run) {
+	return (request, evidence) => run === void 0 || run.periodStart !== input.period.start || run.periodEnd !== input.period.end ? Promise.resolve(false) : isRunBatch({
+		...input,
+		runId: run.id
+	})(request, evidence);
+}
+/** A decoded detail is the run asked for, whole: its scope, membership and quantities agree. */
+function checkPayrollRunDetail(value, orgId, runId) {
+	if (value === null) return {
+		ok: true,
+		value: null
+	};
+	if (value.orgId !== orgId || value.run.id !== runId || value.items.length === 0 || value.items.length !== value.run.recipientCount || new Set(value.items.map((item) => item.payment.id)).size !== value.items.length || value.items.some((item, index) => item.itemIndex !== index || item.amount.asset !== value.run.total.asset || item.payment.amount.asset !== item.amount.asset || item.payment.paymentType !== "payroll")) return {
+		ok: false,
+		error: Errors.invalidInput("run", "Payroll run scope or membership does not match")
+	};
+	try {
+		const total = toExactAssetAmount(value.run.total, CONFIGURED_MONEY_ASSETS);
+		let rawTotal = 0n;
+		for (const item of value.items) {
+			const amount = toExactAssetAmount(item.amount, CONFIGURED_MONEY_ASSETS);
+			const payment = toExactAssetAmount(item.payment.amount, CONFIGURED_MONEY_ASSETS);
+			if (amount.minorUnits !== payment.minorUnits) return {
+				ok: false,
+				error: Errors.invalidInput("run", "Payroll item quantity does not match its Payment")
+			};
+			rawTotal += BigInt(amount.minorUnits);
+		}
+		if (rawTotal !== BigInt(total.minorUnits)) return {
+			ok: false,
+			error: Errors.invalidInput("run", "Payroll run total does not match its items")
+		};
+	} catch {
+		return {
+			ok: false,
+			error: Errors.invalidInput("run", "Payroll run quantities are invalid")
+		};
+	}
+	return {
+		ok: true,
+		value
+	};
+}
+//#endregion
+//#region src/payroll/run-decoding.ts
+function toPayrollRun(wire) {
+	return {
+		id: toPayrollRunId(wire.id),
+		status: wire.status,
+		periodStart: wire.periodStart,
+		periodEnd: wire.periodEnd,
+		total: wire.total,
+		recipientCount: wire.recipientCount
+	};
+}
+function toPayrollRuns(wire) {
+	return {
+		...mapPage(wire, toPayrollRun),
+		settledThisMonth: wire.settledThisMonth
+	};
+}
+function toPayrollGroup(wire) {
+	return {
+		id: toPayrollGroupId(wire.id),
+		name: wire.name,
+		tone: wire.tone,
+		members: wire.members.map((member) => ({
+			partyId: member.partyId,
+			amount: member.amount,
+			currency: member.currency
+		}))
+	};
+}
+function validateRunItems(input) {
+	for (const [index, item] of input.items.entries()) {
+		if (Schema.decodeResult(PayrollRunItemInputSchema, { onExcessProperty: "error" })(item)._tag === "Failure") return Errors.invalidInput(`items.${index}`, "invalid Payroll item");
+		try {
+			const exact = toExactAssetAmount(item.amount, CONFIGURED_MONEY_ASSETS);
+			const net = BigInt(item.net);
+			const gross = BigInt(item.gross);
+			const adjustments = item.adjustments.reduce((sum, row) => sum + BigInt(row.amount), 0n);
+			if (item.amount.asset !== input.asset || item.net !== exact.minorUnits || gross + adjustments !== net) return Errors.invalidInput(`items.${index}`, "invalid Payroll units");
+		} catch {
+			return Errors.invalidInput(`items.${index}`, "invalid Payroll units");
+		}
+	}
+	return null;
+}
+const RunInputSchema = Schema.Struct({
+	permissionId: AuthorizePayrollRunExecutionInputSchema.fields.permissionId,
+	asset: AuthorizePayrollRunExecutionInputSchema.fields.asset,
+	period: AuthorizePayrollRunExecutionInputSchema.fields.period,
+	items: AuthorizePayrollRunExecutionInputSchema.fields.items,
+	requestKey: Schema.optional(AuthorizePayrollRunExecutionInputSchema.fields.requestKey)
+});
+/** Decode caller input before session or signer work. Keep routing outside the input. */
+function decodePayrollRunInput(value) {
+	try {
+		const decoded = Schema.decodeUnknownSync(RunInputSchema, { onExcessProperty: "error" })(value);
+		const input = {
+			permissionId: decoded.permissionId,
+			asset: decoded.asset,
+			period: decoded.period,
+			...decoded.requestKey === void 0 ? {} : { requestKey: decoded.requestKey },
+			items: decoded.items.map((item) => ({
+				amount: item.amount,
+				gross: item.gross,
+				net: item.net,
+				adjustments: item.adjustments,
+				partyId: toPartyId(item.partyId),
+				to: item.to.kind === "party" ? {
+					kind: "party",
+					partyId: toPartyId(item.to.partyId)
+				} : item.to.kind === "address" ? {
+					kind: "address",
+					address: toAddress(item.to.address)
+				} : item.to
+			}))
+		};
+		if (input.items.length === 0 || input.period.start > input.period.end) throw Errors.invalidInput("input", "Payroll requires items and an ordered period");
+		const error = validateRunItems(input);
+		if (error !== null) throw error;
+		return input;
+	} catch (cause) {
+		throw cause instanceof CapxulError ? cause : Errors.invalidInput("input", "Invalid Payroll input");
+	}
+}
+/** Read only the exact backend prepare receipt, never an arbitrary signer failure. */
+function payrollResolution(error, requestKey) {
+	const details = error.details;
+	if (error.code !== "WRONG_STATE" || details?.method !== runs.authorize.name || details.requestKey !== requestKey || typeof details.commandId !== "string" || typeof details.runId !== "string") return void 0;
+	return details.payrollResolution === "failed" || details.payrollResolution === "settled" ? details.payrollResolution : void 0;
+}
+function validatePayrollRunLookup(orgId, runId) {
+	return !Schema.is(PayrollRunIdSchema)(runId) || orgId.length === 0 ? {
+		ok: false,
+		error: Errors.invalidInput("runId", "Organization and run ID must be valid")
+	} : {
+		ok: true,
+		value: void 0
+	};
+}
+/** Strict saved detail decoder shared by the read and fresh stream. */
+function decodePayrollRunDetail(raw, orgId, runId) {
+	const decoded = Schema.decodeUnknownResult(Schema.NullOr(PayrollRunDetailSchema), { onExcessProperty: "error" })(raw);
+	if (decoded._tag === "Failure") return {
+		ok: false,
+		error: Errors.invalidInput("run", "Invalid Payroll run detail")
+	};
+	return checkPayrollRunDetail(decoded.success, orgId, runId);
+}
+//#endregion
+//#region src/payroll/run-subscription.ts
+function detailValue(result) {
+	if (!result.ok) throw result.error;
+	return result.value;
+}
+function subscribePayrollRun(deps, orgId, runId, listener, options) {
+	const operation = CAPXUL_OPERATIONS.org.payroll.subscribeRun;
+	const valid = deps.validate(orgId, runId);
+	if (!valid.ok) return runCapxulEffect(Effect.fail(valid.error), observationOnlyControls(deps.invocationControls?.(options) ?? options), operation, deps.runPromise);
+	const decode = (raw) => detailValue(deps.decode(raw, orgId, runId));
+	return subscribeFreshQuery(deps, {
+		orgId,
+		runId
+	}, listener, operation, {
+		decode,
+		validateCached: (raw) => {
+			decode(raw);
+		},
+		invalidValue: (cause) => isCapxulError(cause) ? cause : Errors.invalidInput("run", "Invalid Payroll run detail"),
+		invalidScope: () => Errors.invalidInput("run", "Payroll run subscription scope does not match"),
+		lostValue: () => Errors.invalidInput("run", "Payroll run is no longer readable"),
+		unavailable: () => Errors.notImplemented("payroll", "subscribeRun")
+	}, options);
+}
+//#endregion
+//#region src/payroll/run-authorization.ts
+/**
+* Authorize one payroll run: a stable request key, the prepared batch checked
+* against the run the caller asked for, the signature, and the submission.
+*/
+async function authorizePayrollRun(scope, input, controls, onRequestKey, onResolved) {
+	const { deps, orgId, requestKeyScope } = scope;
+	const signal = controls?.signal;
+	const execution = executionDependencies(deps);
+	if (execution === null) return {
+		ok: false,
+		error: Errors.notImplemented("payroll", "executionComposition")
+	};
+	try {
+		input = decodePayrollRunInput(input);
+	} catch (cause) {
+		return {
+			ok: false,
+			error: asCapxulError(cause)
+		};
+	}
+	const { requestKey: provided, ...canonicalInput } = input;
+	const actorId = onRequestKey === void 0 ? void 0 : execution.actor.authSession()?.authUserId;
+	if (onRequestKey !== void 0 && actorId === void 0) return {
+		ok: false,
+		error: Errors.notAuthenticated()
+	};
+	const requestKey = await paymentRequestKeyLifecycle(`${requestKeyScope}:${AUTHORIZE_RUN}`, onRequestKey === void 0 ? {
+		orgId,
+		input
+	} : {
+		actorId,
+		orgId,
+		input: canonicalInput
+	}, provided, onRequestKey === void 0 ? void 0 : { manageProvidedKey: true });
+	try {
+		await onRequestKey?.(requestKey.key);
+		if (onRequestKey !== void 0 && execution.actor.authSession()?.authUserId !== actorId) {
+			await requestKey.finish(false).catch(() => void 0);
+			return {
+				ok: false,
+				error: Errors.notAuthenticated()
+			};
+		}
+	} catch (cause) {
+		await requestKey.finish(false).catch(() => void 0);
+		return {
+			ok: false,
+			error: asCapxulError(cause)
+		};
+	}
+	let authorized;
+	let acceptedReplay;
+	let preparedClosed = false;
+	let terminalReplay;
+	const submitted = await executePrepared(execution, async (signerAddress) => {
+		const prepared = await runIfActive(signal, AUTHORIZE_RUN, () => withInvocationParentSpan(Effect.suspend(() => callOperation(deps.convexCall, runs.authorize, copyInvocationObservation(controls, {
+			orgId,
+			permissionId: input.permissionId,
+			asset: input.asset,
+			requestKey: requestKey.key,
+			signerAddress,
+			period: input.period,
+			items: input.items
+		}))).pipe(Effect.mapError((publicError) => ({ publicError }))), controls), deps.runPromise);
+		if (!prepared.ok) {
+			terminalReplay = payrollResolution(prepared.error, requestKey.key);
+			return prepared;
+		}
+		authorized = prepared.value.run;
+		acceptedReplay = prepared.value.replay.kind === "accepted" ? prepared.value.replay.submission : void 0;
+		return {
+			ok: true,
+			value: prepared.value.execution
+		};
+	}, (request, evidence) => isAuthorizedRunBatch({
+		orgId,
+		permissionId: input.permissionId,
+		requestKey: requestKey.key,
+		asset: input.asset,
+		period: input.period,
+		items: input.items
+	}, authorized)(request, evidence), true, () => preparedClosed = true, signal, controls, void 0, () => acceptedReplay);
+	const resolution = preparedClosed ? "failed" : terminalReplay;
+	if (resolution !== void 0) try {
+		await onResolved?.(resolution);
+	} catch {}
+	try {
+		await requestKey.finish(submitted.ok || resolution !== void 0);
+	} catch {}
+	if (!submitted.ok) return submitted;
+	return authorized === void 0 ? {
+		ok: false,
+		error: Errors.unknown()
+	} : {
+		ok: true,
+		value: toPayrollRun(authorized)
+	};
+}
+const AUTHORIZE_RUN = runs.authorize.name;
+function executionDependencies(deps) {
+	return deps.actor === void 0 || deps.chainId === void 0 || deps.signer === void 0 ? null : {
+		actor: deps.actor,
+		chainId: deps.chainId,
+		convexCall: deps.convexCall,
+		runPromise: deps.runPromise,
+		signer: deps.signer,
+		...deps.telemetry === void 0 ? {} : { telemetry: deps.telemetry }
+	};
+}
+//#endregion
+//#region src/payroll/runs.ts
+function makePayrollMethods(deps, orgId) {
+	const requestKeyScope = deps.requestKeyScope ?? `client-${crypto.randomUUID()}`;
+	/** One observed call of one payroll row, its reply projected inside the call, under the row's name. */
+	const call = (row, args, options, project) => {
+		const controls = deps.invocationControls?.(options) ?? options;
+		return runPortEffect(callOperation(deps.convexCall, row, copyInvocationObservation(controls, args)).pipe(Effect.map(project), Effect.mapError((publicError) => ({ publicError }))), controls, row.name, deps.runPromise);
+	};
+	return {
+		subscribeRun: (runId, listener, options) => subscribePayrollRun({
+			actor: deps.actor,
+			convexCall: deps.convexCall,
+			query: reference(runs.get),
+			runPromise: deps.runPromise,
+			invocationControls: deps.invocationControls,
+			decode: decodePayrollRunDetail,
+			validate: validatePayrollRunLookup
+		}, orgId, runId, listener, options),
+		getRun: (runId, options) => {
+			const controls = deps.invocationControls?.(options) ?? options;
+			const lifetime = deps.actor?.authLifetime();
+			const operation = runs.get.name;
+			return runCapxulEffect(Effect.gen(function* () {
+				const lookup = validatePayrollRunLookup(orgId, runId);
+				if (!lookup.ok) return yield* Effect.fail(lookup.error);
+				if (lifetime === void 0 || lifetime.authUserId === null || deps.actor === void 0) return yield* Effect.fail(Errors.notAuthenticated());
+				const current = () => deps.actor?.matchesAuthLifetime(lifetime, lifetime.authUserId) === true;
+				if (!current()) return yield* Effect.fail(Errors.notAuthenticated());
+				const parent = yield* Effect.currentSpan.pipe(Effect.orDie);
+				const captured = carryInvocationParentSpan(controls, parent);
+				const run = yield* awaitCapxulResult(() => runIfActive(controls?.signal, operation, () => withInvocationParentSpan(Effect.suspend(() => callOperation(deps.convexCall, runs.get, copyInvocationObservation(captured, {
+					orgId,
+					runId
+				}))).pipe(Effect.mapError((publicError) => ({ publicError }))), captured), deps.runPromise));
+				if (!current()) return yield* Effect.fail(Errors.cancelled({ operation }));
+				const checked = checkPayrollRunDetail(run, orgId, runId);
+				return yield* checked.ok ? Effect.succeed(checked.value) : Effect.fail(checked.error);
+			}), observationOnlyControls(controls), operation, deps.runPromise);
+		},
+		runs: (options) => call(runs.list, { orgId }, options, toPayrollRuns),
+		authorizeRun: (input, options) => {
+			const controls = deps.invocationControls?.(options) ?? options;
+			return runCapxulEffect(Effect.gen(function* () {
+				if (controls?.signal?.aborted === true) return yield* Effect.fail(Errors.cancelled({ operation: AUTHORIZE_RUN }));
+				const parent = yield* Effect.currentSpan.pipe(Effect.orDie);
+				return yield* awaitCapxulResult(() => authorizePayrollRun({
+					deps,
+					orgId,
+					requestKeyScope
+				}, input, carryInvocationParentSpan(controls, parent), options?.onRequestKey, options?.onResolved));
+			}), observationOnlyControls(controls), AUTHORIZE_RUN, deps.runPromise);
+		},
+		terms: (options) => call(terms.list, { orgId }, options, (rates) => rates),
+		groups: {
+			list: (options) => call(groups.list, { orgId }, options, (saved) => mapPage(saved, toPayrollGroup)),
+			save: (input, options) => call(groups.save, {
+				orgId,
+				...input.id === void 0 ? {} : { id: String(input.id) },
+				name: input.name,
+				tone: input.tone,
+				members: input.members
+			}, options, toPayrollGroup),
+			remove: (id, options) => call(groups.remove, {
+				orgId,
+				id
+			}, options, () => void 0)
+		}
+	};
+}
+const payrollUnavailable = () => Promise.resolve({
+	ok: false,
+	error: Errors.notImplemented("payroll", "executionComposition")
+});
+/** The bundle an unconfigured client exposes — every verb refuses, none throws. */
+function makeUnavailablePayrollMethods() {
+	return {
+		getRun: payrollUnavailable,
+		subscribeRun: payrollUnavailable,
+		runs: payrollUnavailable,
+		authorizeRun: payrollUnavailable,
+		terms: payrollUnavailable,
+		groups: {
+			list: payrollUnavailable,
+			save: payrollUnavailable,
+			remove: payrollUnavailable
+		}
+	};
+}
+//#endregion
+//#region src/accounts/command-approvals.ts
+/**
+* Keep a prepared command only when it is the one asked for and its operation
+* is the person's own. A mismatch is closed unsent when `close`, as the signed
+* path closes a new Payment; a retry or a request keeps its Payment open.
+*/
+async function checked(deps, signerAddress, prepared, expected, close) {
+	if (!prepared.ok) return prepared;
+	const session = deps.actor?.authSession() ?? null;
+	if (session === null || deps.chainId === void 0) return {
+		ok: false,
+		error: Errors.notAuthenticated()
+	};
+	const evidence = prepared.value;
+	if (await expected(evidence.request, evidence) && await verifiedPreparedCommand(evidence, session.email, signerAddress, deps.chainId)) return prepared;
+	const refused = {
+		ok: false,
+		error: Errors.invalidInput("execution", "prepared command mismatch")
+	};
+	return close ? abandonPrepared(deps, evidence.executionId, "prepared_mismatch", refused) : refused;
+}
+/** A retry, a request payment or a payroll run, rather than a new Payment. */
+const isCommandApproval = (input) => "retry" in input || "request" in input || "payrollRun" in input;
+/** Prepare a retry, a request payment or a payroll run for `signerAddress`, checked. */
+function prepareVerifiedCommand(deps, input, signerAddress, signal) {
+	if ("retry" in input) return prepareVerifiedRetry(deps, input, signerAddress, signal);
+	if ("request" in input) return prepareVerifiedRequestPayment(deps, input, signerAddress, signal);
+	return prepareVerifiedPayrollRun(deps, input, signerAddress, signal);
+}
+/** The retry of one Payment, prepared in the scope that paid it. */
+async function prepareVerifiedRetry(deps, input, signerAddress, signal) {
+	const intent = {
+		kind: "retry",
+		paymentId: input.retry
+	};
+	return checked(deps, signerAddress, await runIfActive(signal, CAPXUL_OPERATIONS.payments.prepareLifecycleExecution, () => callOperation(deps.convexCall, lifecycles.prepareScoped, {
+		signerAddress,
+		intent,
+		expectedScope: input.organizationId === void 0 ? { kind: "account" } : {
+			kind: "organization",
+			orgId: input.organizationId
+		}
+	}).pipe(Effect.mapError((publicError) => ({ publicError }))), deps.runPromise), lifecycleCommandCheck(intent, input.organizationId), false);
+}
+/** The Payment of one request, exactly as the request froze it. */
+async function prepareVerifiedRequestPayment(deps, input, signerAddress, signal) {
+	const decoded = Schema.decodeResult(RequestPaymentConfirmationSchema, { onExcessProperty: "error" })(input.request);
+	if (decoded._tag === "Failure") return {
+		ok: false,
+		error: Errors.invalidInput("confirmation", "invalid request confirmation")
+	};
+	const confirmation = decoded.success;
+	return checked(deps, signerAddress, await runIfActive(signal, commands$1.prepareRequest.name, () => callOperation(deps.convexCall, commands$1.prepareRequest, {
+		confirmation,
+		signerAddress
+	}).pipe(Effect.mapError((publicError) => ({ publicError }))), deps.runPromise), requestPaymentCheck(confirmation), false);
+}
+/** One payroll run: the run the backend writes and the batch that pays it, checked together. */
+async function prepareVerifiedPayrollRun(deps, input, signerAddress, signal) {
+	let run;
+	try {
+		run = decodePayrollRunInput(input.payrollRun);
+	} catch (cause) {
+		return {
+			ok: false,
+			error: asCapxulError(cause)
+		};
+	}
+	const orgId = input.organizationId;
+	const requestKey = run.requestKey ?? `payroll_${crypto.randomUUID()}`;
+	const { permissionId, asset, period, items } = run;
+	const authorized = await runIfActive(signal, runs.authorize.name, () => callOperation(deps.convexCall, runs.authorize, {
+		orgId,
+		permissionId,
+		asset,
+		requestKey,
+		signerAddress,
+		period,
+		items
+	}).pipe(Effect.mapError((publicError) => ({ publicError }))), deps.runPromise);
+	if (!authorized.ok) return authorized;
+	return checked(deps, signerAddress, {
+		ok: true,
+		value: authorized.value.execution
+	}, isAuthorizedRunBatch({
+		orgId,
+		permissionId,
+		requestKey,
+		asset,
+		period,
+		items
+	}, authorized.value.run), authorized.value.replay.kind !== "accepted");
+}
+//#endregion
+//#region src/accounts/organization-approvals.ts
+/** The Organization Payment prepared for `signerAddress` and checked, before any approval. */
+async function prepareVerifiedOrganizationPayment(deps, input, signerAddress, signal) {
+	const { organizationId, permissionId, requestKey, lineage, ...item } = input;
+	const intent = organizationPaymentIntent(organizationId, {
+		permissionId,
+		items: [item],
+		...lineage === void 0 ? {} : { lineage },
+		...requestKey === void 0 ? {} : { requestKey }
+	});
+	if (!intent.ok) return intent;
+	const session = deps.actor?.authSession() ?? null;
+	if (session === null || deps.chainId === void 0) return {
+		ok: false,
+		error: Errors.notAuthenticated()
+	};
+	const expected = {
+		...intent.value,
+		requestKey: requestKey ?? `pay_${crypto.randomUUID()}`
+	};
+	const prepared = await runIfActive(signal, CAPXUL_OPERATIONS.organizationPayments.prepareExecution, () => callOperation(deps.convexCall, commands$1.prepareOrganization, {
+		...expected,
+		signerAddress
+	}).pipe(Effect.mapError((publicError) => ({ publicError }))), deps.runPromise);
+	if (!prepared.ok) return prepared;
+	const evidence = prepared.value;
+	return await matchesIntent(expected)(evidence.request, evidence) && await verifiedPreparedCommand(evidence, session.email, signerAddress, deps.chainId) ? {
+		ok: true,
+		value: evidence
+	} : abandonPrepared(deps, evidence.executionId, "prepared_mismatch", {
+		ok: false,
+		error: Errors.invalidInput("execution", "prepared Organization Payment mismatch")
+	});
+}
+/** One fresh Payment read: the caller's own, or one in the Organization's scope. */
+const readPayment = (deps, paymentId, organizationId, signal) => organizationId === void 0 ? runIfActive(signal, records.get.name, () => callOperation(deps.convexCall, records.get, { paymentId }, { fresh: true }).pipe(Effect.map((payment) => ({ payment })), Effect.mapError((publicError) => ({ publicError }))), deps.runPromise) : runIfActive(signal, records.getForOrganization.name, () => callOperation(deps.convexCall, records.getForOrganization, {
+	orgId: organizationId,
+	paymentId
+}, { fresh: true }).pipe(Effect.mapError((publicError) => ({ publicError }))), deps.runPromise);
+/**
+* The Payments an approval carries, as they stand. A personal read names only
+* the caller's own Account's Payments, so an Organization's is read with its
+* `organizationId`; one that cannot be read is refused, never taken as ended.
+*/
+async function readApprovalPayments(deps, paymentIds, organizationId, signal) {
+	const reads = await Promise.all(paymentIds.map((paymentId) => readPayment(deps, paymentId, organizationId, signal)));
+	const payments = [];
+	for (const [index, read] of reads.entries()) {
+		if (!read.ok) return read;
+		const { orgId, payment } = read.value;
+		if (payment === null && organizationId === void 0) return {
+			ok: false,
+			error: Errors.invalidInput("organizationId", "this approval pays from an Organization: wait with its organizationId")
+		};
+		if (payment === null || payment.id !== paymentIds[index] || orgId !== organizationId) return {
+			ok: false,
+			error: Errors.invalidInput("paymentId", "the approval's Payments are not this scope's")
+		};
+		payments.push(normalizePaymentTiming(payment));
+	}
+	return {
+		ok: true,
+		value: payments
+	};
+}
+//#endregion
+//#region src/accounts/approvals.ts
+function makeApprovalsMethods(deps) {
+	const call = (name, row, args, signal) => runIfActive(signal, name, () => callOperation(deps.convexCall, row, args, { fresh: true }).pipe(Effect.mapError((publicError) => ({ publicError }))), deps.runPromise);
+	const get = (approvalId) => call(approvals.get.name, approvals.get, { approvalId });
+	/**
+	* Prepare for the signer the backend recorded when the Safe was claimed (the
+	* person's own key signs later, on the approval page) and open the approval.
+	*/
+	const openApproval = async (signal, prepareFor) => {
+		const session = deps.actor?.authSession() ?? null;
+		if (deps.actor === void 0 || deps.chainId === void 0) return {
+			ok: false,
+			error: Errors.notImplemented("approvals", "prepareComposition")
+		};
+		if (session === null) return {
+			ok: false,
+			error: Errors.notAuthenticated()
+		};
+		const safe = await call(CAPXUL_OPERATIONS.approvals.prepare, safes.loadByAuthUserId, { authUserId: session.authUserId }, signal);
+		if (!safe.ok) return safe;
+		if (safe.value === null) return {
+			ok: false,
+			error: Errors.smartAccountMissing(session.authUserId)
+		};
+		if (safe.value.signerAddress === null) return {
+			ok: false,
+			error: Errors.wrongState({
 				method: CAPXUL_OPERATIONS.approvals.prepare,
 				currentState: "unclaimed",
 				validStates: ["claimed"]
 			})
 		};
-		const prepared = await prepareVerifiedPersonalPayment({
-			actor,
-			chainId,
-			convexCall: deps.convexCall,
-			runPromise: deps.runPromise
-		}, intent.value, safe.value.signerAddress, input.requestKey ?? `pay_${crypto.randomUUID()}`, signal);
+		const prepared = await prepareFor(safe.value.signerAddress);
 		if (!prepared.ok) return prepared;
-		await emitPreparedPaymentInitiated(deps, prepared.value);
 		const { executionId } = prepared.value;
 		const opened = await call(approvals.request.name, approvals.request, { executionId });
 		return opened.ok ? opened : abandonPrepared(deps, executionId, "cancelled", opened);
 	};
+	const prepare = async (input, options) => {
+		const signal = options?.signal;
+		if (isCommandApproval(input)) return openApproval(signal, (signerAddress) => prepareVerifiedCommand(deps, input, signerAddress, signal));
+		if ("organizationId" in input) return openApproval(signal, (signerAddress) => prepareVerifiedOrganizationPayment(deps, input, signerAddress, signal));
+		const intent = paymentExecutionIntent(input);
+		if (!intent.ok) return intent;
+		const { actor, chainId } = deps;
+		return openApproval(signal, async (signerAddress) => {
+			if (actor === void 0 || chainId === void 0) return {
+				ok: false,
+				error: Errors.notImplemented("approvals", "prepareComposition")
+			};
+			const prepared = await prepareVerifiedPersonalPayment({
+				actor,
+				chainId,
+				convexCall: deps.convexCall,
+				runPromise: deps.runPromise
+			}, intent.value, signerAddress, input.requestKey ?? `pay_${crypto.randomUUID()}`, signal);
+			if (prepared.ok) await emitPreparedPaymentInitiated(deps, prepared.value);
+			return prepared;
+		});
+	};
 	const approve = async (approvalId) => {
 		const { signer } = deps;
 		if (signer === void 0) return {
@@ -19355,28 +20004,12 @@ function makeApprovalsMethods(deps) {
 			}
 		};
 	};
-	const readPayments = async (approval, signal) => {
-		const reads = await Promise.all(approval.operation.paymentIds.map((paymentId) => call(records.get.name, records.get, { paymentId }, signal)));
-		const payments = [];
-		for (const read of reads) {
-			if (!read.ok) return read;
-			if (read.value === null) return {
-				ok: false,
-				error: Errors.notImplemented("approvals", "wait.organizationPayment")
-			};
-			payments.push(normalizePaymentTiming(read.value));
-		}
-		return {
-			ok: true,
-			value: payments
-		};
-	};
 	/**
 	* One read of the approval: its outcome when it has ended, or null to read
 	* again. The Payments are read before anything is sent, so a send is never
 	* made for Payments this caller cannot follow.
 	*/
-	const step = async (approvalId, signal) => {
+	const step = async (approvalId, signal, organizationId) => {
 		const read = await call(approvals.get.name, approvals.get, { approvalId }, signal);
 		if (!read.ok) return read;
 		const approval = read.value;
@@ -19384,7 +20017,7 @@ function makeApprovalsMethods(deps) {
 			ok: true,
 			value: null
 		};
-		const payments = await readPayments(approval, signal);
+		const payments = await readApprovalPayments(deps, approval.operation.paymentIds, organizationId ?? (approval.actor.kind === "organization" ? approval.actor.orgId : void 0), signal);
 		if (!payments.ok) return payments;
 		if (unsent(approval, payments.value)) {
 			const sent = await submit(approvalId);
@@ -19405,7 +20038,7 @@ function makeApprovalsMethods(deps) {
 		const signal = options?.signal;
 		const intervalMs = options?.intervalMs ?? 2e3;
 		const poll = async () => {
-			const stepped = await step(approvalId, signal);
+			const stepped = await step(approvalId, signal, options?.organizationId);
 			if (!stepped.ok) return stepped;
 			if (stepped.value !== null) return {
 				ok: true,
@@ -20608,10 +21241,803 @@ function makeSmartAccountMethods(deps) {
 	};
 }
 //#endregion
+//#region src/activity/documents.ts
+/** A reply its row does not admit is refused without the document body its decode error would carry. */
+function withoutDocumentBody(error) {
+	return error.details?.step === "decodeOutput" ? Errors.invalidInput("documentHash", "invalid document read") : error;
+}
+/** Schema errors must not retain document bodies. */
+function decodeDocumentRead(schema, input) {
+	return Effect.fromOption(Schema.decodeUnknownOption(schema)(input)).pipe(Effect.mapError(() => ({ publicError: Errors.invalidInput("documentHash", "invalid document read") })));
+}
+function makePaymentDocumentsMethods(deps) {
+	/**
+	* One document read by its row. The pair is decoded before anything is sent,
+	* and a reply the row does not admit is refused without the body it carried.
+	*/
+	const readDocument = (row, ref, options) => {
+		const controls = deps.invocationControls?.(options) ?? options;
+		return runPortEffect(Effect.gen(function* () {
+			const pair = yield* decodeDocumentRead(PaymentDocumentReadRefSchema, ref);
+			return yield* callOperation(deps.convexCall, row, copyInvocationObservation(controls, pair)).pipe(Effect.mapError((error) => ({ publicError: withoutDocumentBody(error) })));
+		}), controls, row.name, deps.runPromise);
+	};
+	return {
+		get: (ref, options) => readDocument(documents.get, ref, options),
+		verify: (ref, options) => readDocument(documents.verify, ref, options),
+		render: (ref, options) => readDocument(documents.render, ref, options)
+	};
+}
+//#endregion
+//#region src/activity/stitching.ts
+/** Epoch milliseconds of the block that carried the row. */
+function blockMillis(row) {
+	return Number(row.timestamp) * 1e3;
+}
+/** `0x1234…abcd` — the counterparty of an unclaimed transfer is an address. */
+function shortAddressLabel(address) {
+	return address.length <= 12 ? address : `${address.slice(0, 6)}…${address.slice(-4)}`;
+}
+function directionFor(safe, transfer) {
+	const from = transfer.from.toLowerCase();
+	const to = transfer.to.toLowerCase();
+	if (from === safe && to === safe) return "self";
+	return to === safe ? "in" : "out";
+}
+function withAnnotation(item, annotation) {
+	return annotation?.counterpartyLabel === void 0 ? item : {
+		...item,
+		counterpartyLabel: annotation.counterpartyLabel
+	};
+}
+/**
+* An indexed settlement confirms the intent. A missing row can be outside
+* this page or still backfilling; only the correction owner can prove rollback.
+*/
+function confirmPayment(intent, chain, expected) {
+	if (chain !== void 0 && matchesPaymentFact(chain, expected)) return {
+		...intent,
+		status: "settled",
+		...intent.execution === void 0 ? {} : { execution: {
+			status: "settled",
+			retryRequired: false
+		} },
+		receipt: {
+			chainId: chain.chainId,
+			transactionHash: chain.txHash
+		},
+		updatedAt: blockMillis(chain)
+	};
+	return intent;
+}
+function matchesPaymentFact(chain, expected) {
+	return chain !== void 0 && expected !== void 0 && chain.chainId === expected.chainId && chain.contract.toLowerCase() === expected.contract.toLowerCase() && chain.sender.toLowerCase() === expected.sender.toLowerCase() && chain.recipient.toLowerCase() === expected.recipient.toLowerCase() && chain.token.toLowerCase() === expected.token.toLowerCase() && chain.amount.toString() === expected.rawAmount && chain.documentHash.toLowerCase() === expected.documentHash.toLowerCase() && chain.kind === expected.kind;
+}
+/**
+* One unclaimed Transfer as an Activity row, or `null` when this SDK cannot
+* denominate its asset. The indexer serves only configured assets, so a row
+* the registry does not know means the SDK and that deployment disagree; it is
+* dropped rather than shown with a guessed currency.
+*/
+function isActivityVisible(item) {
+	return !(item.kind === "payment" && item.direction === "in" && item.execution?.notSent);
+}
+function transferItem(safe, transfer, annotation) {
+	const asset = configuredMoneyAssetById(transfer.assetId);
+	if (asset === null) return null;
+	const direction = directionFor(safe.toLowerCase(), transfer);
+	const counterparty = direction === "in" ? transfer.from : transfer.to;
+	const at = blockMillis(transfer);
+	return withAnnotation({
+		kind: "movement",
+		id: transfer.id,
+		classification: direction === "in" ? "deposit" : "movement_only_outflow",
+		amount: {
+			asset: asset.assetId,
+			value: formatUnits(transfer.amount, asset.decimals)
+		},
+		direction,
+		counterpartyLabel: shortAddressLabel(counterparty),
+		receipt: {
+			chainId: transfer.chainId,
+			transactionHash: transfer.txHash
+		},
+		createdAt: at,
+		updatedAt: at
+	}, annotation);
+}
+/**
+* Money in, money out and the pending share, one bucket per exact asset.
+*/
+function summarizeItems(items) {
+	const buckets = /* @__PURE__ */ new Map();
+	for (const item of items) {
+		const metadata = configuredMoneyAssetById(item.amount.asset);
+		if (metadata === null) continue;
+		const key = item.amount.asset;
+		const bucket = buckets.get(key) ?? {
+			asset: item.amount.asset,
+			in: 0n,
+			out: 0n,
+			pendingIn: 0n
+		};
+		const raw = rawUnits(item.amount.value, metadata.decimals);
+		if (item.kind === "payment" && item.status !== "settled") {
+			if (item.direction === "in" && item.status !== "cancelled" && item.status !== "failed" && !item.execution?.notSent) bucket.pendingIn += raw;
+		} else if (item.direction === "in") bucket.in += raw;
+		else if (item.direction === "out") bucket.out += raw;
+		buckets.set(key, bucket);
+	}
+	return [...buckets.values()].map((bucket) => ({
+		asset: bucket.asset,
+		in: bucket.in.toString(),
+		out: bucket.out.toString(),
+		net: (bucket.in - bucket.out).toString(),
+		pendingIn: bucket.pendingIn.toString()
+	}));
+}
+/** The inverse of `formatUnits`, kept exact: `"1.25"` at 6 decimals is `1250000n`. */
+function rawUnits(value, decimals) {
+	const negative = value.startsWith("-");
+	const [whole = "0", fraction = ""] = (negative ? value.slice(1) : value).split(".");
+	const raw = BigInt(`${whole}${fraction.padEnd(decimals, "0").slice(0, decimals)}`);
+	return negative ? -raw : raw;
+}
+//#endregion
+//#region src/activity/cursor.ts
+function actorKey(actor) {
+	return actor.kind === "account" ? `account:${actor.accountId}` : `organization:${actor.orgId}`;
+}
+function scopeKey(scope) {
+	return `${scope.principalAccountId}|${actorKey(scope.actor)}|${scope.safe?.toLowerCase() ?? "none"}`;
+}
+function selectionKey(params) {
+	const filter = params?.filter;
+	return JSON.stringify([
+		params?.range?.from ?? null,
+		params?.range?.to ?? null,
+		filter?.kind ?? null,
+		filter?.direction ?? null,
+		filter?.status === void 0 ? null : [...new Set(filter.status)].sort()
+	]);
+}
+function validString(value, max) {
+	return typeof value === "string" && value.length <= max;
+}
+function validPosition(position) {
+	return position === null || typeof position === "object" && "timestamp" in position && typeof position.timestamp === "number" && Number.isSafeInteger(position.timestamp) && position.timestamp >= 0 && "id" in position && typeof position.id === "string" && /^[1-9][0-9]{0,9}:0x[0-9a-f]{64}:[0-9]{1,10}$/.test(position.id);
+}
+function isActivityCursor(cursor, scope, selection) {
+	return typeof cursor === "object" && cursor !== null && cursorScopeMatches(cursor, scope, selection) && cursorProgressIsValid(cursor);
+}
+/** The cursor was issued for this scope and filter selection, at a valid checkpoint. */
+function cursorScopeMatches(cursor, scope, selection) {
+	return "version" in cursor && cursor.version === 1 && "scope" in cursor && cursor.scope === scope && "selection" in cursor && cursor.selection === selection && "checkpoint" in cursor && typeof cursor.checkpoint === "number" && Number.isSafeInteger(cursor.checkpoint) && cursor.checkpoint >= 0 && "source" in cursor && (cursor.source === "indexed" || cursor.source === "fallback");
+}
+/** Each source's progress is well-formed and bounded. */
+function cursorProgressIsValid(cursor) {
+	return "paymentCursor" in cursor && (cursor.paymentCursor === null || validString(cursor.paymentCursor, 2048)) && "paymentDone" in cursor && typeof cursor.paymentDone === "boolean" && "transferDone" in cursor && typeof cursor.transferDone === "boolean" && "degraded" in cursor && typeof cursor.degraded === "boolean" && "paymentPending" in cursor && Array.isArray(cursor.paymentPending) && cursor.paymentPending.length <= 100 && new Set(cursor.paymentPending).size === cursor.paymentPending.length && cursor.paymentPending.every((id) => validString(id, 256)) && "transferBefore" in cursor && validPosition(cursor.transferBefore);
+}
+function parseCursor(value, scope, selection) {
+	if (value === void 0) return null;
+	if (value.length > 4e4) throw Errors.invalidInput("cursor", "invalid Activity cursor");
+	const cursor = JSON.parse(value);
+	if (!isActivityCursor(cursor, scope, selection)) throw Errors.invalidInput("cursor", "Activity scope or filters changed; restart from the first page");
+	return cursor;
+}
+function requireParams(params) {
+	const limit = params?.limit ?? 25;
+	if (!Number.isSafeInteger(limit) || limit < 1 || limit > 100) throw Errors.invalidInput("limit", "must be an integer from 1 to 100");
+	for (const value of [params?.range?.from, params?.range?.to]) if (value !== void 0 && !Number.isSafeInteger(value)) throw Errors.invalidInput("range", "must contain integer epoch milliseconds");
+	const f = params?.filter;
+	if (f?.kind !== void 0 && f.kind !== "payment" && f.kind !== "movement" || f?.direction !== void 0 && ![
+		"in",
+		"out",
+		"self"
+	].includes(f.direction) || f?.status !== void 0 && (!Array.isArray(f.status) || !f.status.every((status) => PAYMENT_STATUSES.includes(status)))) throw Errors.invalidInput("filter", "invalid Activity filter");
+}
+function matchesFilter(item, filter) {
+	return (filter?.kind === void 0 || item.kind === filter.kind) && (filter?.direction === void 0 || item.direction === filter.direction) && (filter?.status === void 0 || item.kind === "payment" && filter.status.includes(item.status));
+}
+//#endregion
+//#region src/activity/indexed-pages.ts
+function chainRead(deps, table, input) {
+	return deps.indexer.read(table, input).pipe(Effect.catch((error) => {
+		if (error.publicError.details?.reason === "scope-refused" || ![
+			"NETWORK_ERROR",
+			"RATE_LIMITED",
+			"PROVIDER_ERROR",
+			"CAPABILITY_UNAVAILABLE",
+			"TIMEOUT"
+		].includes(error.publicCode)) return Effect.fail({ publicError: error.publicError });
+		return Effect.succeed(null);
+	}));
+}
+function boundedRange(range, checkpoint) {
+	return {
+		...range?.from === void 0 ? {} : { from: range.from },
+		to: Math.min(checkpoint, range?.to ?? checkpoint)
+	};
+}
+function unavailablePage(deps, scope, controls, params, state, first) {
+	if (first) return fallbackPage(deps, scope, controls, params, state, true);
+	return Effect.annotateCurrentSpan({
+		read_source: "indexer",
+		read_warning: "indexer-unavailable"
+	}).pipe(Effect.as({
+		items: [],
+		nextCursor: null,
+		checkpoint: state.checkpoint,
+		observedAt: Date.now(),
+		readWarning: "indexer-unavailable"
+	}));
+}
+function readTransfers(deps, safe, range, state, wanted, first) {
+	const from = Math.max(0, Math.ceil((range.from ?? 0) / 1e3));
+	const to = Math.floor(range.to / 1e3);
+	if (state.transferDone || from > to || !wanted && !first) return Effect.succeed([]);
+	return chainRead(deps, "transfer", {
+		safe: toAddress(safe),
+		limit: wanted ? 100 : 1,
+		timeline: {
+			from,
+			to,
+			...state.transferBefore === null ? {} : { before: state.transferBefore }
+		}
+	});
+}
+function readPayments(deps, scope, controls, range, state, wanted) {
+	const done = state.paymentDone || !wanted;
+	if (state.paymentPending.length > 0 || done) return Effect.succeed({
+		items: [],
+		pending: state.paymentPending,
+		cursor: state.paymentCursor,
+		done
+	});
+	return convexPage(deps, scope.actor, controls, {
+		limit: 100,
+		range,
+		filter: { kind: "payment" },
+		...state.paymentCursor === null ? {} : { cursor: state.paymentCursor }
+	}).pipe(Effect.map((page) => ({
+		items: page.items,
+		pending: page.items.map((item) => item.id),
+		cursor: page.nextCursor,
+		done: page.nextCursor === null
+	})));
+}
+function readPaymentFacts(deps, safe, settlements) {
+	const offsets = Array.from({ length: Math.ceil(settlements.length / 50) }, (_, i) => i * 50);
+	return Effect.forEach(offsets, (offset) => chainRead(deps, "payment", {
+		safe: toAddress(safe),
+		limit: 50,
+		settlements: settlements.slice(offset, offset + 50)
+	}), { concurrency: 2 }).pipe(Effect.map((pages) => pages.some((page) => page === null) ? null : pages.flatMap((page) => page ?? [])));
+}
+function indexedPage(deps, scope, controls, params, state, first) {
+	return Effect.gen(function* () {
+		const range = boundedRange(params?.range, state.checkpoint);
+		const wantsTransfers = params?.filter?.kind !== "payment" && params?.filter?.status === void 0;
+		const found = yield* readTransfers(deps, scope.safe, range, state, wantsTransfers, first);
+		if (found === null) return yield* unavailablePage(deps, scope, controls, params, state, first);
+		const transfers = wantsTransfers ? found : [];
+		const page = yield* readPayments(deps, scope, controls, range, state, params?.filter?.kind !== "movement");
+		const decoration = yield* decoratePage(deps, scope, controls, transfers, page, range);
+		if (decoration === null) return yield* unavailablePage(deps, scope, controls, params, state, first);
+		const { items, next } = mergePage(scope.safe, params?.filter, params?.limit ?? 25, state, page, decoration, transfers, wantsTransfers);
+		const cursor = next.paymentDone && next.paymentPending.length === 0 && next.transferDone ? null : JSON.stringify(next);
+		if (cursor !== null && cursor === params?.cursor) return yield* Effect.fail({ publicError: Errors.invalidInput("cursor", "Activity source did not advance") });
+		yield* Effect.annotateCurrentSpan({ read_source: "indexer" });
+		return {
+			items,
+			nextCursor: cursor,
+			checkpoint: state.checkpoint,
+			observedAt: Date.now()
+		};
+	});
+}
+//#endregion
+//#region src/activity/page-overlay.ts
+const MAX_OVERLAY_IDS = 200;
+function overlay(deps, actor, controls, input) {
+	const count = Math.max(input.references?.length ?? 0, input.settlementIds?.length ?? 0);
+	const offsets = Array.from({ length: Math.max(1, Math.ceil(count / MAX_OVERLAY_IDS)) }, (_, i) => i * MAX_OVERLAY_IDS);
+	return Effect.forEach(offsets, (offset) => callOperation(deps.convexCall, overlays.get, copyInvocationObservation(controls, {
+		...actor === void 0 ? {} : { actor },
+		...input.references === void 0 ? {} : { references: input.references.slice(offset, offset + MAX_OVERLAY_IDS) },
+		...input.settlementIds === void 0 ? {} : { settlementIds: input.settlementIds.slice(offset, offset + MAX_OVERLAY_IDS) }
+	})).pipe(Effect.mapError((publicError) => ({ publicError }))), { concurrency: 2 }).pipe(Effect.flatMap((pages) => {
+		const first = pages[0];
+		if (pages.some((page) => scopeKey(page) !== scopeKey(first))) return Effect.fail({ publicError: Errors.invalidInput("actor", "Activity scope changed during the read") });
+		return Effect.succeed({
+			...first,
+			links: pages.flatMap((page) => page.links),
+			annotations: pages.flatMap((page) => page.annotations),
+			payments: pages.flatMap((page) => page.payments)
+		});
+	}));
+}
+function decoratePage(deps, scope, controls, transfers, page, range) {
+	return Effect.gen(function* () {
+		const decoration = yield* overlay(deps, scope.actor, controls, {
+			references: [...page.pending.map((id) => ({
+				kind: "payment",
+				id
+			})), ...transfers.map((row) => ({
+				kind: "movement",
+				id: row.id
+			}))],
+			settlementIds: [...new Set(transfers.flatMap((row) => row.paymentSettlementId ? [row.paymentSettlementId] : []))]
+		});
+		if (scopeKey(decoration) !== scopeKey(scope)) return yield* Effect.fail({ publicError: Errors.invalidInput("actor", "Activity scope changed during the read") });
+		const byId = new Map([...page.items, ...decoration.payments].map((item) => [item.id, item]));
+		const settlements = [...new Set(decoration.links.map((link) => link.settlementId))];
+		const facts = yield* readPaymentFacts(deps, scope.safe, settlements);
+		if (facts === null) return null;
+		const bySettlement = new Map(facts.map((row) => [row.settlementId, row]));
+		const byPayment = new Map(decoration.links.map((link) => [link.paymentId, {
+			fact: bySettlement.get(link.settlementId),
+			expected: link.expected
+		}]));
+		const annotations = new Map(decoration.annotations.map((annotation) => [`${annotation.reference.kind}:${annotation.reference.id}`, annotation]));
+		return {
+			payments: page.pending.flatMap((id) => {
+				const item = byId.get(id);
+				if (item === void 0 || item.kind !== "payment" || item.createdAt > range.to || range.from !== void 0 && item.createdAt < range.from) return [];
+				const confirmed = withAnnotation(confirmPayment(item, byPayment.get(id)?.fact, byPayment.get(id)?.expected), annotations.get(`payment:${id}`));
+				return isActivityVisible(confirmed) ? [confirmed] : [];
+			}),
+			annotations,
+			linked: new Set(decoration.links.filter((link) => matchesPaymentFact(bySettlement.get(link.settlementId), link.expected)).map((link) => link.settlementId))
+		};
+	});
+}
+function mergePage(safe, filter, limit, state, page, decoration, transfers, wantsTransfers) {
+	const { payments, annotations, linked } = decoration;
+	let pi = 0;
+	let ti = 0;
+	const items = [];
+	const transferEnd = !wantsTransfers || transfers.length < 100;
+	let transferBefore = state.transferBefore;
+	while (items.length < limit) {
+		if (pi === payments.length && !page.done || ti === transfers.length && !transferEnd) break;
+		const payment = payments[pi];
+		const row = transfers[ti];
+		if (payment === void 0 && row === void 0) break;
+		if (payment !== void 0 && (row === void 0 || payment.createdAt >= Number(row.timestamp) * 1e3)) {
+			pi += 1;
+			if (matchesFilter(payment, filter)) items.push(payment);
+		} else if (row !== void 0) {
+			ti += 1;
+			transferBefore = {
+				timestamp: Number(row.timestamp),
+				id: row.id
+			};
+			if (row.paymentSettlementId && linked.has(row.paymentSettlementId)) continue;
+			const item = transferItem(safe, row, annotations.get(`movement:${row.id}`));
+			if (item !== null && matchesFilter(item, filter)) items.push(item);
+		}
+	}
+	return {
+		items,
+		next: {
+			...state,
+			paymentCursor: page.cursor,
+			paymentDone: page.done,
+			paymentPending: payments.slice(pi).map((item) => item.id),
+			transferBefore,
+			transferDone: ti === transfers.length && transferEnd
+		}
+	};
+}
+function convexPage(deps, actor, controls, input) {
+	return callOperation(deps.convexCall, items.list, copyInvocationObservation(controls, {
+		...input,
+		actor
+	})).pipe(Effect.mapError((publicError) => ({ publicError })));
+}
+function fallbackPage(deps, scope, controls, params, state, degraded) {
+	return Effect.gen(function* () {
+		const page = yield* convexPage(deps, scope.actor, controls, {
+			limit: params?.limit ?? 25,
+			...state.paymentCursor === null ? {} : { cursor: state.paymentCursor },
+			range: {
+				...params?.range?.from === void 0 ? {} : { from: params.range.from },
+				to: Math.min(state.checkpoint, params?.range?.to ?? state.checkpoint)
+			},
+			...params?.filter === void 0 ? {} : { filter: params.filter }
+		});
+		const decoration = yield* overlay(deps, scope.actor, controls, { references: page.items.map((item) => ({
+			kind: item.kind,
+			id: item.id
+		})) });
+		if (scopeKey(decoration) !== scopeKey(scope)) return yield* Effect.fail({ publicError: Errors.invalidInput("actor", "Activity scope changed during fallback") });
+		const annotations = new Map(decoration.annotations.map((annotation) => [`${annotation.reference.kind}:${annotation.reference.id}`, annotation]));
+		yield* Effect.annotateCurrentSpan({
+			read_source: "convex",
+			...degraded ? { read_warning: "indexer-unavailable" } : {}
+		});
+		return {
+			...page,
+			items: page.items.filter(isActivityVisible).map((item) => withAnnotation(item, annotations.get(`${item.kind}:${item.id}`))),
+			checkpoint: state.checkpoint,
+			nextCursor: page.nextCursor === null ? null : JSON.stringify({
+				...state,
+				source: "fallback",
+				paymentCursor: page.nextCursor,
+				degraded
+			}),
+			...degraded ? { readWarning: "indexer-unavailable" } : {}
+		};
+	});
+}
+function readActivityPage(deps, actor, controls, params) {
+	return Effect.gen(function* () {
+		yield* Effect.try({
+			try: () => requireParams(params),
+			catch: (cause) => ({ publicError: asCapxulError(cause) })
+		});
+		const scope = yield* overlay(deps, actor, controls, {});
+		const selection = selectionKey(params);
+		const cursor = yield* Effect.try({
+			try: () => parseCursor(params?.cursor, scopeKey(scope), selection),
+			catch: () => ({ publicError: Errors.invalidInput("cursor", "invalid or obsolete Activity cursor; restart the read") })
+		});
+		const state = cursor ?? {
+			version: 1,
+			scope: scopeKey(scope),
+			selection,
+			checkpoint: Date.now(),
+			source: "indexed",
+			paymentCursor: null,
+			paymentDone: false,
+			paymentPending: [],
+			transferBefore: null,
+			transferDone: false,
+			degraded: false
+		};
+		const range = boundedRange(params?.range, state.checkpoint);
+		if (range.from !== void 0 && range.from > range.to) return {
+			items: [],
+			nextCursor: null,
+			checkpoint: state.checkpoint,
+			observedAt: Date.now()
+		};
+		if (state.source === "fallback" || scope.safe === null) return yield* fallbackPage(deps, scope, controls, params, state, state.degraded);
+		return yield* indexedPage(deps, scope, controls, params, state, cursor === null);
+	});
+}
+function readActivitySummary(deps, actor, controls, params) {
+	return Effect.gen(function* () {
+		const totals = /* @__PURE__ */ new Map();
+		let cursor;
+		let count = 0;
+		let readWarning;
+		do {
+			const page = yield* readActivityPage(deps, actor, controls, {
+				limit: 100,
+				...cursor === void 0 ? {} : { cursor },
+				...params?.window === void 0 ? {} : { range: params.window }
+			});
+			count += page.items.length;
+			readWarning ??= page.readWarning;
+			for (const total of summarizeItems(page.items)) {
+				const key = total.asset;
+				const old = totals.get(key);
+				totals.set(key, old === void 0 ? total : {
+					...total,
+					in: String(BigInt(old.in) + BigInt(total.in)),
+					out: String(BigInt(old.out) + BigInt(total.out)),
+					net: String(BigInt(old.net) + BigInt(total.net)),
+					pendingIn: String(BigInt(old.pendingIn) + BigInt(total.pendingIn))
+				});
+			}
+			cursor = page.nextCursor ?? void 0;
+		} while (cursor !== void 0);
+		return {
+			window: {
+				from: params?.window?.from ?? null,
+				to: params?.window?.to ?? null
+			},
+			totals: [...totals.values()],
+			count,
+			observedAt: Date.now(),
+			...readWarning === void 0 ? {} : { readWarning }
+		};
+	});
+}
+function subscribeActivity(deps, actor, controls, onChange) {
+	return Effect.gen(function* () {
+		const scope = yield* overlay(deps, actor, controls, {});
+		if (scope.safe === null) return () => {};
+		let delivered = false;
+		return yield* deps.indexer.subscribe("transfer", {
+			safe: toAddress(scope.safe),
+			limit: 100
+		}, (snapshot) => {
+			if (snapshot.status === "ok") {
+				if (delivered) onChange();
+				delivered = true;
+			}
+			if (snapshot.status === "error") {
+				delivered = true;
+				onChange();
+			}
+		});
+	});
+}
+//#endregion
+//#region src/activity/movement-detail.ts
+/** An indexed Movement has no Convex materialization. Read its exact native row. */
+function readIndexedMovement(deps, actor, controls, eventId) {
+	return Effect.gen(function* () {
+		const scope = yield* overlay(deps, actor, controls, { references: [{
+			kind: "movement",
+			id: eventId
+		}] });
+		if (scope.safe === null) return null;
+		const safe = scope.safe.toLowerCase();
+		const row = (yield* deps.indexer.read("transfer", {
+			safe: toAddress(safe),
+			limit: 1,
+			eventId
+		}).pipe(Effect.mapError((error) => ({ publicError: error.publicError }))))[0];
+		if (row === void 0) return null;
+		const blockNumber = Number(row.blockNumber);
+		if (row.id !== eventId || row.from.toLowerCase() !== safe && row.to.toLowerCase() !== safe || !Number.isSafeInteger(blockNumber) || blockNumber < 0 || !Number.isSafeInteger(row.logIndex) || row.logIndex < 0) return yield* Effect.fail({ publicError: Errors.invalidInput("activity", "indexed Movement does not match the requested scope or evidence") });
+		yield* Effect.annotateCurrentSpan({ read_source: "indexer" });
+		const documentSet = scope.movementDocuments.find((set) => set.movementId === row.id);
+		return {
+			kind: "movement",
+			movementId: row.id,
+			documents: documentSet?.documents ?? [],
+			documentState: documentSet?.state ?? "pending",
+			viewer: scope.actor,
+			annotation: scope.annotations.find((annotation) => annotation.reference.kind === "movement" && annotation.reference.id === row.id) ?? null,
+			evidence: {
+				chainId: row.chainId,
+				contractAddress: row.token,
+				tokenAddress: row.token,
+				transactionHash: row.txHash,
+				blockNumber,
+				blockHash: row.blockHash,
+				inclusion: "included",
+				verification: "verified",
+				canonicalState: "finalized",
+				transferLogIndex: row.logIndex,
+				source: row.from,
+				destination: row.to,
+				rawAmount: row.amount.toString(),
+				link: {
+					movementId: row.id,
+					depositPaymentId: null
+				}
+			}
+		};
+	});
+}
+//#endregion
+//#region src/activity/scope.ts
+/**
+* The activity backend gives its actor a different name than the other
+* financialOps functions: `{kind: "organization", orgId}`, and not
+* `{kind: "org", orgId}`. Thus it does not use `actorReferenceToBackend`.
+*
+* The `personal` case sends NO actor. This is correct, and it does not lose
+* data. `requireActivityActor` uses the signed-in Account when the actor is
+* absent, and `canReadActor` refuses all other account identifiers
+* (`packages/backend/convex/movement/activityAuth.ts`). Thus "personal" and
+* "absent" both name the one Account that an SDK caller can read. The SDK does
+* not hold an account identifier to send.
+*
+* The `switch` is exhaustive. A new `ActorReference` variant is a compile error
+* here. The conditional expression that this function replaced removed each
+* value that was not an organization.
+*/
+function activityActorField(actor) {
+	if (actor === void 0 || actor.kind === "personal") return {};
+	return { actor: {
+		kind: "organization",
+		orgId: actor.organizationId
+	} };
+}
+/** Capture scope now; let the observed result boundary handle a malformed caller value. */
+function captureActivityInput(prepare) {
+	try {
+		return prepare();
+	} catch (cause) {
+		return Effect.die(cause);
+	}
+}
+function observeActivityScope(actor) {
+	const organizationId = actor?.kind === "organization" || actor?.kind === "org" ? safeEngineeringIdentifier(actor.orgId) : void 0;
+	return Effect.annotateCurrentSpan({
+		scope_kind: actor?.kind === "organization" || actor?.kind === "org" ? "organization" : "account",
+		...organizationId === void 0 ? {} : { verified_organization_id: organizationId }
+	});
+}
+function decodeActivityViewer(value) {
+	const viewer = Option.getOrUndefined(Schema.decodeUnknownOption(ActorRefSchema)(value));
+	if (viewer === void 0) return void 0;
+	const id = viewer.kind === "organization" ? viewer.orgId : viewer.accountId;
+	return safeEngineeringIdentifier(id) === void 0 ? void 0 : viewer;
+}
+/** The detail without the scope it was read for, which the SDK reports as telemetry instead. */
+function normalizeActivityDetail(response) {
+	if (response === null) return null;
+	const { viewer: _viewer, ...detail } = response;
+	return detail;
+}
+//#endregion
+//#region src/activity/methods.ts
+function makeActivityMethods(deps) {
+	const indexerDeps = deps.indexerRead === void 0 ? void 0 : {
+		indexer: deps.indexerRead,
+		convexCall: deps.convexCall
+	};
+	/** One public call for the caller's chosen actor, read once at call start. */
+	const forActor = (actorRef, options, operation, program) => {
+		const controls = deps.invocationControls?.(options) ?? options;
+		return runPortEffect(captureActivityInput(() => Effect.succeed(activityActorField(actorRef).actor)).pipe(Effect.flatMap((actor) => program(actor, controls))), controls, operation, deps.runPromise);
+	};
+	return {
+		subscribe: (onChange, params, options) => forActor(params?.actor, options, CAPXUL_OPERATIONS.activity.subscribe, (actor, controls) => indexerDeps === void 0 ? Effect.succeed(() => {}) : Effect.suspend(() => subscribeActivity(indexerDeps, actor, controls, onChange)).pipe(Effect.tap(() => observeActivityScope(actor)))),
+		list: (params, options) => forActor(params?.actor, options, items.list.name, (actor, controls) => Effect.suspend(() => indexerDeps === void 0 ? callOperation(deps.convexCall, items.list, copyInvocationObservation(controls, {
+			...actor === void 0 ? {} : { actor },
+			...params?.cursor === void 0 ? {} : { cursor: params.cursor },
+			...params?.limit === void 0 ? {} : { limit: params.limit },
+			...params?.range === void 0 ? {} : { range: params.range },
+			...params?.filter === void 0 ? {} : { filter: params.filter }
+		})).pipe(Effect.mapError((publicError) => ({ publicError }))) : readActivityPage(indexerDeps, actor, controls, params)).pipe(Effect.map((page) => ({
+			...page,
+			items: page.items.filter(isActivityVisible)
+		})), Effect.tap(() => observeActivityScope(actor)))),
+		summary: (params, options) => forActor(params?.actor, options, items.summary.name, (actor, controls) => Effect.suspend(() => indexerDeps === void 0 ? callOperation(deps.convexCall, items.summary, copyInvocationObservation(controls, {
+			...actor === void 0 ? {} : { actor },
+			...params?.window === void 0 ? {} : { window: params.window }
+		})).pipe(Effect.mapError((publicError) => ({ publicError }))) : readActivitySummary(indexerDeps, actor, controls, params)).pipe(Effect.tap(() => observeActivityScope(actor)))),
+		get: (reference, options) => {
+			const controls = deps.invocationControls?.(options) ?? options;
+			const requestedActor = actorReferenceToBackend(options?.actor);
+			return runPortEffect(captureActivityInput(() => {
+				const scope = requestedActor === void 0 ? void 0 : requestedActor.kind === "org" ? {
+					kind: "org",
+					orgId: requestedActor.orgId
+				} : { kind: "account" };
+				return Effect.succeed({
+					actor: scope,
+					referenceActor: reference.kind === "payment" ? activityActorField(reference.actor).actor : void 0
+				});
+			}).pipe(Effect.flatMap(({ actor, referenceActor }) => Effect.suspend(() => indexerDeps !== void 0 && reference.kind === "movement" && /^[1-9][0-9]{0,9}:0x[0-9a-f]{64}:[0-9]{1,10}$/.test(reference.id) ? readIndexedMovement(indexerDeps, actor?.kind === "org" ? {
+				kind: "organization",
+				orgId: actor.orgId
+			} : void 0, controls, reference.id) : callOperation(deps.convexCall, items.get, copyInvocationObservation(controls, {
+				reference: {
+					kind: reference.kind,
+					id: reference.id,
+					...referenceActor === void 0 ? {} : { actor: referenceActor }
+				},
+				...actor === void 0 ? {} : { actor }
+			})).pipe(Effect.mapError((publicError) => ({ publicError })))).pipe(Effect.flatMap((response) => {
+				const detail = normalizeActivityDetail(response);
+				if (response === null) return Effect.succeed(detail);
+				const viewer = response.viewer === void 0 ? actor ?? referenceActor : decodeActivityViewer(response.viewer);
+				return viewer === void 0 ? Effect.succeed(detail) : observeActivityScope(viewer).pipe(Effect.as(detail));
+			})))), controls, items.get.name, deps.runPromise);
+		},
+		annotate: (input, options) => {
+			const controls = deps.invocationControls?.(options) ?? options;
+			return runPortEffect(captureActivityInput(() => {
+				const actor = activityActorField(input.actor).actor;
+				if (input.actor !== void 0 && input.reference.kind === "payment" && input.reference.actor !== void 0 && !sameActor(input.actor, input.reference.actor)) return Effect.fail({ publicError: Errors.invalidInput("reference.actor", "must match the annotation actor") });
+				return Effect.succeed({
+					actor,
+					referenceActor: input.reference.kind === "payment" ? activityActorField(input.reference.actor).actor : void 0
+				});
+			}).pipe(Effect.flatMap(({ actor, referenceActor }) => Effect.suspend(() => callOperation(deps.convexCall, annotations.save, copyInvocationObservation(controls, {
+				...actor === void 0 ? {} : { actor },
+				reference: input.reference.kind === "payment" && referenceActor !== void 0 ? {
+					kind: "payment",
+					id: input.reference.id,
+					actor: referenceActor
+				} : {
+					kind: input.reference.kind,
+					id: input.reference.id
+				},
+				...input.counterpartyLabel === void 0 ? {} : { counterpartyLabel: input.counterpartyLabel },
+				...input.accountingCategory === void 0 ? {} : { accountingCategory: input.accountingCategory },
+				...input.memo === void 0 ? {} : { memo: input.memo }
+			})).pipe(Effect.mapError((publicError) => ({ publicError })))).pipe(Effect.tap((annotation) => {
+				const scope = decodeActivityViewer(annotation.actor);
+				return scope === void 0 ? Effect.void : observeActivityScope(scope);
+			})))), controls, annotations.save.name, deps.runPromise);
+		}
+	};
+}
+//#endregion
+//#region src/activity/phases.ts
+const PENDING = Object.freeze({
+	terminal: false,
+	outcome: null,
+	needsAction: false
+});
+const AWAITING_ACTOR = Object.freeze({
+	terminal: false,
+	outcome: null,
+	needsAction: true
+});
+const COMPLETED = Object.freeze({
+	terminal: true,
+	outcome: "good",
+	needsAction: false
+});
+const FAILED = Object.freeze({
+	terminal: true,
+	outcome: "bad",
+	needsAction: false
+});
+const WITHDRAWN = Object.freeze({
+	terminal: true,
+	outcome: "neutral",
+	needsAction: false
+});
+/** Interpret a Payment status. `pending_claim` waits for the actor who reads it. */
+function paymentPhase(status) {
+	switch (status) {
+		case "pending":
+		case "settling":
+		case "scheduled":
+		case "streaming": return PENDING;
+		case "pending_claim": return AWAITING_ACTOR;
+		case "settled": return COMPLETED;
+		case "cancelled": return WITHDRAWN;
+		case "failed":
+		case "unresolved": return FAILED;
+		default: return absurd(status);
+	}
+}
+/** Interpret a payment Request as its ISSUER sees it. An issuer does not wait for itself. */
+function requestPhase(status) {
+	switch (status) {
+		case "draft":
+		case "sent":
+		case "viewed":
+		case "pending_settlement": return PENDING;
+		case "paid": return COMPLETED;
+		case "declined":
+		case "expired": return FAILED;
+		case "cancelled": return WITHDRAWN;
+		default: return absurd(status);
+	}
+}
+/** Interpret the same request as its RECIPIENT sees it. `open` waits for the recipient. */
+function inboxPhase(status) {
+	switch (status) {
+		case "open": return AWAITING_ACTOR;
+		case "approved": return PENDING;
+		case "paid": return COMPLETED;
+		case "declined":
+		case "expired": return FAILED;
+		case "cancelled": return WITHDRAWN;
+		default: return absurd(status);
+	}
+}
+//#endregion
 //#region src/accounts/summaries.ts
 function makeMeMethods(deps) {
 	return {
 		get: (options) => runIfActive(options?.signal, summaries.me.name, () => callOperation(deps.convexCall, summaries.me, {}).pipe(Effect.mapError((publicError) => ({ publicError }))), deps.runPromise),
+		home: (options) => runIfActive(options?.signal, summaries.home.name, () => (deps.chainId === void 0 ? Effect.fail(Errors.notImplemented("accounts", "me.home")) : callOperation(deps.convexCall, summaries.home, {
+			chainId: deps.chainId,
+			...options?.orgId === void 0 ? {} : { orgId: options.orgId }
+		})).pipe(Effect.flatMap((wire) => Effect.try({
+			try: () => ({
+				...wire,
+				balances: wire.balances === null ? null : accountPositionsFromWire(wire.balances),
+				recentActivity: wire.recentActivity?.filter(isActivityVisible) ?? null
+			}),
+			catch: asCapxulError
+		})), Effect.mapError((publicError) => ({ publicError }))), deps.runPromise),
 		depositInstructions: (options) => {
 			const controls = deps.invocationControls?.(options) ?? options;
 			return runPortEffect(callOperation(deps.convexCall, summaries.depositInstructions, copyInvocationObservation(controls, {})).pipe(Effect.mapError((publicError) => ({ publicError })), Effect.tap((instructions) => emitDepositInitiated(deps.telemetry, instructions, controls))), controls, summaries.depositInstructions.name, deps.runPromise);
@@ -21520,4 +22946,4 @@ function executeIdentityProductObservation(telemetry, record, state) {
 	return ignoreTransportFailure(() => invocationTelemetry.emit(mapped), "emit", mapped.name).pipe(Effect.andThen(ignoreTransportFailure(after, mapped.name === "auth_signed_out" ? "reset" : "identify", mapped.name)));
 }
 //#endregion
-export { moneySafeOpDigest as $, actorReferenceToBackend as $i, CHAIN_UPSTREAMS as $n, runIfActive as $r, injectedWalletSigner as $t, logDroppedEvent as A, globalLocalStorage as Ai, configurations as An, ChainIdSchema$1 as Ar, SAFE_SENTINEL_OWNERS as At, makeTargetsMethods as B, toJwtToken as Bi, PayrollRunDetailSchema as Bn, absurd as Br, observeSdkClient as Bt, retryIdempotentRead as C, toAllowedOrigin as Ci, isCapxulOperation as Cn, EpochMsSchema$1 as Cr, deriveCapxulSafeAddress as Ct, makeApprovalsMethods as D, AuthClientError as Di, onboardings as Dn, toPermissionId as Dr, buildSafeMultiSendExecTransactionCall as Dt, wireChainId as E, authClientPortFromPromiseAdapter as Ei, details as En, toPermissionAssignmentId as Er, safe4337MultiSendUserOpCallData as Et, paymentRequestKeyLifecycle as F, toDurationMs as Fi, runs as Fn, EVM_ADDRESS_RE$1 as Fr, failureDetail as Ft, formatAssetAmount as G, CapxulError as Gi, members as Gn, runIdentityFacade as Gr, normalizeExceptionErrorKind as Gt, executePrepared as H, isNonEmptyString as Hi, PayrollRunItemInputSchema as Hn, makeAuthMethods as Hr, withCapturedAttemptContext as Ht, makeDestinationsMethods as I, toEpochMs as Ii, terms as In, isEvmAddress as Ir, failureEvidenceProps as It, toRaw as J, isFailureMode as Ji, treasuries as Jn, observationOnlyControls as Jr, safeExceptionLabel as Jt, parseAssetAmount as K, isCapxulError as Ki, roles as Kn, runPortEffect as Kr, normalizeExceptionOperation as Kt, makeActorRelationshipMethods as L, toEpochSeconds as Li, AuthorizePayrollRunExecutionInputSchema as Ln, toAddress as Lr, CAPXUL_SDK_EXPECTED_OUTCOME_EVENT as Lt, makeOfframpMethods as M, BrowserAuthCacheAdapter as Mi, PreparedPermissionExecutionSchema as Mn, toAssetId as Mr, asCapxulError as Mt, makePaymentsMethods as N, parseAuthSession as Ni, PermissionCommandViewSchema as Nn, toCurrencyCode as Nr, mapPage as Nt, makeAccountMethods as O, AuthClientPortTag as Oi, authorities as On, toRoleKey as Or, BASE_SEPOLIA_CHAIN_ID as Ot, waitForPaymentSubmission as P, parseCachedJwt as Pi, groups as Pn, toExactAssetAmount as Pr, toPublicError$1 as Pt, fingerprintPaymentIntent as Q, AuthCachePortTag as Qi, ORGANIZATION_SETUP_STATUSES as Qn, defectAsCapxulError as Qr, causeChain as Qt, makeCheckoutMethods as R, toAuthUserId as Ri, PayrollGroupIdSchema as Rn, toChainId as Rr, postHogFailureObservation as Rt, convexCallErrorFromCapxul as S, isCredentialField as Si, CAPXUL_OPERATIONS as Sn, DurationMsSchema$1 as Sr, configuredMoneyAssetById as St, registerProductTelemetryInvocation as T, toPublishableKey as Ti, OPERATIONS as Tn, toBudgetId as Tr, safe4337ExecuteUserOpCallData as Tt, assetAmountFromRaw as U, toNonEmptyStringBrand as Ui, FixedOfferDraftSchema as Un, askIdentity as Ur, EXCEPTION_MESSAGE as Ut, subscribeFreshQuery as V, toSessionToken as Vi, PayrollRunIdSchema as Vn, reference as Vr, observationContextProps as Vt, assetSymbolFor as W, Errors as Wi, invitations as Wn, publicIdentityFailure as Wr, SDK_VERSION as Wt, parseMoney as X, readField as Xi, OrganizationSetupSchema as Xn, withVerifiedOrganizationScope as Xr, isSettingUpLifecycle as Xt, isMoneyParseError as Y, isRecord as Yi, workspaces as Yn, runCapxulEffect as Yr, version as Yt, canonicalJson as Z, AuthCacheError as Zi, ORGANIZATION_SETUP_REASONS as Zn, awaitCapxulResult as Zr, UNOBSERVABLE_SIGNER_STATUS as Zt, valueIn as _, copyInvocationObservation as _i, CLI_CAPABILITIES as _n, documents as _r, SEND_SIGNATURE as _t, ConvexSmartAccountLayer as a, ActorFailure as ai, resolveFailureMode as an, CurrentPolicySchema as ar, MODULE_PROXY_FACTORY_ABI as at, TelemetryPortTag as b, redactSecrets as bi, EXCEPTION_EVENT_NAME as bn, PAYMENT_DIRECTIONS as br, CONFIGURED_MONEY_ASSETS as bt, makeHoldingsMethods as c, oauthBearerAuthClient as ci, toCountryCode as cn, images as cr, PARAMETER_TYPE as ct, ConvexAccountLayer as d, ClockPortTag as di, HANDLE_RE as dn, isBytes32 as dr, ROLES_SET_ALLOWANCE_ABI as dt, sameActor as ea, toCapxulResult as ei, isEcdsaSignatureHex as en, decodeChainCause as er, ORG_BUDGET_ACTIONS as et, accountFromAccountPositions as f, readClockNow as fi, toHandle as fn, toExactHex as fr, ROLES_SET_TRANSACTION_UNWRAPPER_ABI as ft, valueActivitySummary as g, attachInvocationObservation as gi, redactTelemetryProps as gn, annotations as gr, SEND_BATCH_SIGNATURE as gt, MONEY_READ_RATES as h, observationRequestHeaders as hi, redactTelemetryEvent as hn, toLowerHex as hr, SAFE_ENABLE_MODULE_ABI as ht, makeSmartAccountMethods as i, EXPECTED_OPERATION_OUTCOMES as ii, signerFailure as in, decodePermissionIntent as ir, CREATE_COMMITMENT_SIGNATURE as it, makeOrganizationPaymentsMethods as j, InMemoryAuthCacheAdapter as ji, replacements as jn, currencySymbolFor as jr, callOperation as jt, emitDepositInitiated as k, detectAuthCacheAdapter as ki, commands as kn, PaymentDocumentReadRefSchema as kr, MULTI_SEND_CALL_ONLY as kt, PonderIndexerAdapter as l, SystemClockLayer as li, toKycTier as ln, toAccountId as lr, ROLES_ASSIGN_ROLES_ABI as lt, positionPeg as m, BetterAuthBrowserLayer as mi, validateHandle as mn, toLowerBytes32 as mr, ROLE_MANAGEMENT_SIGNATURES as mt, bootIdentityFlow as n, safeEngineeringIdentifier as ni, openfortSignerNotReadyCode as nn, InvitationViewSchema as nr, ZODIAC_MODULE_PROXY_FACTORY as nt, SmartAccountPortTag as o, carryInvocationParentSpan as oi, makeCurrentUserMethods as on, diagnostics as or, MULTI_SEND_SELECTOR as ot, accountPositionsFromWire as p, BetterAuthNodeLayer as pi, toPartyId as pn, toLowerAddress as pr, ROLES_SET_UP_ABI as pt, requireAsset as q, FAILURE_MODES$1 as qi, setups as qn, sessionFromActor as qr, projectSdkException as qt, makeMeMethods as r, CAPXUL_ERROR_CODES as ri, recoverRawDigestSigner as rn, hashPermissionReplacementPreview as rr, resolveOrgPermissionIdentity as rt, smartAccountErrorFromCapxul as s, withInvocationParentSpan as si, makeClientRequestMethods as sn, AppIdSchema$1 as sr, OPERATOR as st, executeIdentityProductObservation as t, formatTraceparent as ti, isSignerNotReadySignal as tn, toOrgId as tr, roleKeyForPermission as tt, makeAccountsMethods as u, ClockError as ui, toTesterKind as un, PaymentDocumentOptionsSchema as ur, ROLES_EXEC_TRANSACTION_WITH_ROLE_ABI as ut, AccountReadPortTag as v, readInvocationObservation as vi, CLI_COMMAND_NAMES as vn, items as vr, CAPXUL_PAYMENTS_V2_ADDRESS as vt, bindProductTelemetryInvocation as w, toAppId as wi, normalizeCapxulOperation as wn, ActorRefSchema as wr, normalizeSafeSaltEmail as wt, ConvexCallPortTag as x, redactUrlSecrets as xi, stampTelemetryEnvelope as xn, PAYMENT_STATUSES as xr, TOKENS as xt, accountReadErrorFromCapxul as y, sanitizeObservationContext as yi, CLI_INVOCATION_KINDS as yn, overlays as yr, hashAdjustmentsV3 as yt, isCheckoutSettlementConsumed as z, toEmail as zi, PayrollGroupInputSchema as zn, toWeiAmount as zr, observeFailedResult as zt };
+export { parseAssetAmount as $, InvitationViewSchema as $n, SystemClockLayer as $r, version as $t, registerProductTelemetryInvocation as A, toJwtToken as Ai, details as An, toWeiAmount as Ar, safe4337ExecuteUserOpCallData as At, makeOrganizationPaymentsMethods as B, AuthCachePortTag as Bi, FixedOfferDraftSchema as Bn, runCapxulEffect as Br, failureEvidenceProps as Bt, AccountReadPortTag as C, parseAuthSession as Ci, CLI_INVOCATION_KINDS as Cn, toAssetId as Cr, SEND_BATCH_SIGNATURE as Ct, convexCallErrorFromCapxul as D, toEpochSeconds as Di, isCapxulOperation as Dn, isEvmAddress as Dr, TOKENS as Dt, ConvexCallPortTag as E, toEpochMs as Ei, CAPXUL_OPERATIONS as En, EVM_ADDRESS_RE$1 as Er, CONFIGURED_MONEY_ASSETS as Et, decodePayrollRunInput as F, FAILURE_MODES$1 as Fi, replacements as Fn, publicIdentityFailure as Fr, SAFE_SENTINEL_OWNERS as Ft, makeActorRelationshipMethods as G, treasuries as Gn, toCapxulResult as Gr, observationContextProps as Gt, makePaymentsMethods as H, members as Hn, awaitCapxulResult as Hr, postHogFailureObservation as Ht, toPayrollGroupId as I, isFailureMode as Ii, PreparedPermissionExecutionSchema as In, runIdentityFacade as Ir, callOperation as It, makeTargetsMethods as J, ORGANIZATION_SETUP_REASONS as Jn, EXPECTED_OPERATION_OUTCOMES as Jr, SDK_VERSION as Jt, makeCheckoutMethods as K, workspaces as Kn, formatTraceparent as Kr, withCapturedAttemptContext as Kt, makeAccountMethods as L, isRecord as Li, PermissionCommandViewSchema as Ln, runPortEffect as Lr, asCapxulError as Lt, makeApprovalsMethods as M, Errors as Mi, authorities as Mn, reference as Mr, buildSafeMultiSendExecTransactionCall as Mt, makePayrollMethods as N, CapxulError as Ni, commands as Nn, makeAuthMethods as Nr, BASE_SEPOLIA_CHAIN_ID as Nt, retryIdempotentRead as O, toAuthUserId as Oi, normalizeCapxulOperation as On, toAddress as Or, deriveCapxulSafeAddress as Ot, makeUnavailablePayrollMethods as P, isCapxulError as Pi, configurations as Pn, askIdentity as Pr, MULTI_SEND_CALL_ONLY as Pt, formatAssetAmount as Q, toOrgId as Qn, oauthBearerAuthClient as Qr, safeExceptionLabel as Qt, emitDepositInitiated as R, readField as Ri, PayrollGroupIdSchema as Rn, sessionFromActor as Rr, toPublicError$1 as Rt, valueIn as S, BrowserAuthCacheAdapter as Si, CLI_COMMAND_NAMES as Sn, currencySymbolFor as Sr, SAFE_ENABLE_MODULE_ABI as St, TelemetryPortTag as T, toDurationMs as Ti, stampTelemetryEnvelope as Tn, toExactAssetAmount as Tr, CAPXUL_PAYMENTS_V2_ADDRESS as Tt, waitForPaymentSubmission as U, roles as Un, defectAsCapxulError as Ur, observeFailedResult as Ut, makeOfframpMethods as V, invitations as Vn, withVerifiedOrganizationScope as Vr, CAPXUL_SDK_EXPECTED_OUTCOME_EVENT as Vt, makeDestinationsMethods as W, setups as Wn, runIfActive as Wr, observeSdkClient as Wt, assetAmountFromRaw as X, CHAIN_UPSTREAMS as Xn, carryInvocationParentSpan as Xr, normalizeExceptionOperation as Xt, subscribeFreshQuery as Y, ORGANIZATION_SETUP_STATUSES as Yn, ActorFailure as Yr, normalizeExceptionErrorKind as Yt, assetSymbolFor as Z, decodeChainCause as Zn, withInvocationParentSpan as Zr, projectSdkException as Zt, accountFromAccountPositions as _, AuthClientError as _i, toPartyId as _n, toBudgetId as _r, ROLES_EXEC_TRANSACTION_WITH_ROLE_ABI as _t, paymentPhase as a, observationRequestHeaders as ai, isSignerNotReadySignal as an, images as ar, fingerprintPaymentIntent as at, MONEY_READ_RATES as b, globalLocalStorage as bi, redactTelemetryProps as bn, toRoleKey as br, ROLES_SET_UP_ABI as bt, makePaymentDocumentsMethods as c, readInvocationObservation as ci, signerFailure as cn, isBytes32 as cr, roleKeyForPermission as ct, SmartAccountPortTag as d, redactUrlSecrets as di, makeClientRequestMethods as dn, toLowerBytes32 as dr, CREATE_COMMITMENT_SIGNATURE as dt, ClockError as ei, isSettingUpLifecycle as en, hashPermissionReplacementPreview as er, requireAsset as et, smartAccountErrorFromCapxul as f, isCredentialField as fi, toCountryCode as fn, toLowerHex as fr, MODULE_PROXY_FACTORY_ABI as ft, ConvexAccountLayer as g, authClientPortFromPromiseAdapter as gi, toHandle as gn, EpochMsSchema$1 as gr, ROLES_ASSIGN_ROLES_ABI as gt, makeAccountsMethods as h, toPublishableKey as hi, HANDLE_RE as hn, DurationMsSchema$1 as hr, PARAMETER_TYPE as ht, inboxPhase as i, BetterAuthBrowserLayer as ii, isEcdsaSignatureHex as in, AppIdSchema$1 as ir, canonicalJson as it, wireChainId as j, toSessionToken as ji, onboardings as jn, absurd as jr, safe4337MultiSendUserOpCallData as jt, bindProductTelemetryInvocation as k, toEmail as ki, OPERATIONS as kn, toChainId as kr, normalizeSafeSaltEmail as kt, makeSmartAccountMethods as l, sanitizeObservationContext as li, resolveFailureMode as ln, toExactHex as lr, ZODIAC_MODULE_PROXY_FACTORY as lt, PonderIndexerAdapter as m, toAppId as mi, toTesterKind as mn, PAYMENT_STATUSES as mr, OPERATOR as mt, bootIdentityFlow as n, readClockNow as ni, causeChain as nn, CurrentPolicySchema as nr, isMoneyParseError as nt, requestPhase as o, attachInvocationObservation as oi, openfortSignerNotReadyCode as on, toAccountId as or, moneySafeOpDigest as ot, makeHoldingsMethods as p, toAllowedOrigin as pi, toKycTier as pn, PAYMENT_DIRECTIONS as pr, MULTI_SEND_SELECTOR as pt, isCheckoutSettlementConsumed as q, OrganizationSetupSchema as qn, CAPXUL_ERROR_CODES as qr, EXCEPTION_MESSAGE as qt, makeMeMethods as r, BetterAuthNodeLayer as ri, injectedWalletSigner as rn, diagnostics as rr, parseMoney as rt, makeActivityMethods as s, copyInvocationObservation as si, recoverRawDigestSigner as sn, PaymentDocumentOptionsSchema as sr, ORG_BUDGET_ACTIONS as st, executeIdentityProductObservation as t, ClockPortTag as ti, UNOBSERVABLE_SIGNER_STATUS as tn, decodePermissionIntent as tr, toRaw as tt, ConvexSmartAccountLayer as u, redactSecrets as ui, makeCurrentUserMethods as un, toLowerAddress as ur, resolveOrgPermissionIdentity as ut, accountPositionsFromWire as v, AuthClientPortTag as vi, validateHandle as vn, toPermissionAssignmentId as vr, ROLES_SET_ALLOWANCE_ABI as vt, accountReadErrorFromCapxul as w, parseCachedJwt as wi, EXCEPTION_EVENT_NAME as wn, toCurrencyCode as wr, SEND_SIGNATURE as wt, valueActivitySummary as x, InMemoryAuthCacheAdapter as xi, CLI_CAPABILITIES as xn, ChainIdSchema$1 as xr, ROLE_MANAGEMENT_SIGNATURES as xt, positionPeg as y, detectAuthCacheAdapter as yi, redactTelemetryEvent as yn, toPermissionId as yr, ROLES_SET_TRANSACTION_UNWRAPPER_ABI as yt, logDroppedEvent as z, AuthCacheError as zi, PayrollGroupInputSchema as zn, observationOnlyControls as zr, failureDetail as zt };