@capxul/sdk 4.20.0-beta.24 → 4.20.0-beta.27

package/dist/{production-B6MQBe5R.mjs → production-D5uC-i8N.mjs}

@@ -1,4 +1,4 @@
-import { $ as moneySafeOpDigest, $i as actorReferenceToBackend, $r as runIfActive, A as logDroppedEvent, Ai as globalLocalStorage, An as configurations, Ar as ChainIdSchema, At as SAFE_SENTINEL_OWNERS, B as makeTargetsMethods, Bn as PayrollRunDetailSchema, Br as absurd, Bt as observeSdkClient, C as retryIdempotentRead, Ci as toAllowedOrigin, Cn as isCapxulOperation, Cr as EpochMsSchema, Ct as deriveCapxulSafeAddress, D as makeApprovalsMethods, Di as AuthClientError, Dn as onboardings, Dr as toPermissionId, Dt as buildSafeMultiSendExecTransactionCall, En as details, Er as toPermissionAssignmentId, Et as safe4337MultiSendUserOpCallData, F as paymentRequestKeyLifecycle, Fn as runs, Ft as failureDetail, Gi as CapxulError, Gn as members, Gr as runIdentityFacade, H as executePrepared, Hi as isNonEmptyString, Hn as PayrollRunItemInputSchema, Hr as makeAuthMethods, Ht as withCapturedAttemptContext, I as makeDestinationsMethods, Ii as toEpochMs, In as terms, Ir as isEvmAddress, It as failureEvidenceProps, Ji as isFailureMode, Jn as treasuries, Jr as observationOnlyControls, Ki as isCapxulError, Kn as roles, Kr as runPortEffect, L as makeActorRelationshipMethods, Ln as AuthorizePayrollRunExecutionInputSchema, Lr as toAddress, M as makeOfframpMethods, Mn as PreparedPermissionExecutionSchema, Mt as asCapxulError, N as makePaymentsMethods, Nn as PermissionCommandViewSchema, Nt as mapPage, O as makeAccountMethods, Oi as AuthClientPortTag, On as authorities, Or as toRoleKey, Ot as BASE_SEPOLIA_CHAIN_ID, P as waitForPaymentSubmission, Pn as groups, Pr as toExactAssetAmount, Pt as toPublicError, Qi as AuthCachePortTag, Qn as ORGANIZATION_SETUP_STATUSES, Qr as defectAsCapxulError, Qt as causeChain, R as makeCheckoutMethods, Ri as toAuthUserId, Rt as postHogFailureObservation, S as convexCallErrorFromCapxul, Si as isCredentialField, Sn as CAPXUL_OPERATIONS, Sr as DurationMsSchema, St as configuredMoneyAssetById, T as registerProductTelemetryInvocation, Ti as toPublishableKey, Tn as OPERATIONS, Tr as toBudgetId, Tt as safe4337ExecuteUserOpCallData, Ui as toNonEmptyStringBrand, Ur as askIdentity, V as subscribeFreshQuery, Vn as PayrollRunIdSchema, Vr as reference, Vt as observationContextProps, Wi as Errors, Wn as invitations, Wr as publicIdentityFailure, Xi as readField, Xn as OrganizationSetupSchema, Xr as withVerifiedOrganizationScope, Yi as isRecord, Yn as workspaces, Yr as runCapxulEffect, Yt as version$1, Z as canonicalJson, Zn as ORGANIZATION_SETUP_REASONS, Zr as awaitCapxulResult, Zt as UNOBSERVABLE_SIGNER_STATUS, _i as copyInvocationObservation, _n as CLI_CAPABILITIES, _r as documents, _t as SEND_SIGNATURE, a as ConvexSmartAccountLayer, ai as ActorFailure, ar as CurrentPolicySchema, at as MODULE_PROXY_FACTORY_ABI, b as TelemetryPortTag, bi as redactSecrets, bt as CONFIGURED_MONEY_ASSETS, c as makeHoldingsMethods, cn as toCountryCode, cr as images, ct as PARAMETER_TYPE, d as ConvexAccountLayer, di as ClockPortTag, dr as isBytes32, dt as ROLES_SET_ALLOWANCE_ABI, ea as sameActor, ei as toCapxulResult, en as isEcdsaSignatureHex, er as decodeChainCause, et as ORG_BUDGET_ACTIONS, f as accountFromAccountPositions, fn as toHandle, fr as toExactHex, ft as ROLES_SET_TRANSACTION_UNWRAPPER_ABI, gi as attachInvocationObservation, gn as redactTelemetryProps, gr as annotations, gt as SEND_BATCH_SIGNATURE, h as MONEY_READ_RATES, hi as observationRequestHeaders, hr as toLowerHex, ht as SAFE_ENABLE_MODULE_ABI, i as makeSmartAccountMethods, in as signerFailure, ir as decodePermissionIntent$1, it as CREATE_COMMITMENT_SIGNATURE, j as makeOrganizationPaymentsMethods, jn as replacements, jt as callOperation, k as emitDepositInitiated, ki as detectAuthCacheAdapter, kn as commands, kr as PaymentDocumentReadRefSchema, kt as MULTI_SEND_CALL_ONLY, l as PonderIndexerAdapter, li as SystemClockLayer, ln as toKycTier, lr as toAccountId, lt as ROLES_ASSIGN_ROLES_ABI, mi as BetterAuthBrowserLayer, mn as validateHandle, mr as toLowerBytes32, mt as ROLE_MANAGEMENT_SIGNATURES, n as bootIdentityFlow, ni as safeEngineeringIdentifier, nn as openfortSignerNotReadyCode, nr as InvitationViewSchema, nt as ZODIAC_MODULE_PROXY_FACTORY, o as SmartAccountPortTag, oi as carryInvocationParentSpan, on as makeCurrentUserMethods, or as diagnostics, ot as MULTI_SEND_SELECTOR, p as accountPositionsFromWire, pi as BetterAuthNodeLayer, pn as toPartyId, pr as toLowerAddress, pt as ROLES_SET_UP_ABI, qi as FAILURE_MODES, qn as setups, qr as sessionFromActor, r as makeMeMethods, ri as CAPXUL_ERROR_CODES, rn as recoverRawDigestSigner, rr as hashPermissionReplacementPreview, rt as resolveOrgPermissionIdentity, si as withInvocationParentSpan, sn as makeClientRequestMethods, sr as AppIdSchema, st as OPERATOR, t as executeIdentityProductObservation, ti as formatTraceparent, tn as isSignerNotReadySignal, tr as toOrgId, tt as roleKeyForPermission, u as makeAccountsMethods, un as toTesterKind, ut as ROLES_EXEC_TRANSACTION_WITH_ROLE_ABI, v as AccountReadPortTag, vi as readInvocationObservation, vn as CLI_COMMAND_NAMES, vr as items, vt as CAPXUL_PAYMENTS_V2_ADDRESS, w as bindProductTelemetryInvocation, wn as normalizeCapxulOperation, wr as ActorRefSchema, wt as normalizeSafeSaltEmail, x as ConvexCallPortTag, xi as redactUrlSecrets, xn as stampTelemetryEnvelope, xr as PAYMENT_STATUSES, yi as sanitizeObservationContext, yn as CLI_INVOCATION_KINDS, yr as overlays, yt as hashAdjustmentsV3, zi as toEmail, zt as observeFailedResult } from "./access-CCRHHGfU.mjs";
+import { $n as InvitationViewSchema, $r as SystemClockLayer, $t as version$1, A as registerProductTelemetryInvocation, An as details, At as safe4337ExecuteUserOpCallData, B as makeOrganizationPaymentsMethods, Bi as AuthCachePortTag, Br as runCapxulEffect, Bt as failureEvidenceProps, C as AccountReadPortTag, Cn as CLI_INVOCATION_KINDS, Ct as SEND_BATCH_SIGNATURE, D as convexCallErrorFromCapxul, Dn as isCapxulOperation, Dr as isEvmAddress, E as ConvexCallPortTag, Ei as toEpochMs, En as CAPXUL_OPERATIONS, Et as CONFIGURED_MONEY_ASSETS, Fi as FAILURE_MODES, Fn as replacements, Fr as publicIdentityFailure, Ft as SAFE_SENTINEL_OWNERS, G as makeActorRelationshipMethods, Gn as treasuries, Gr as toCapxulResult, Gt as observationContextProps, H as makePaymentsMethods, Hn as members, Hr as awaitCapxulResult, Ht as postHogFailureObservation, Ii as isFailureMode, In as PreparedPermissionExecutionSchema, Ir as runIdentityFacade, It as callOperation, J as makeTargetsMethods, Jn as ORGANIZATION_SETUP_REASONS, K as makeCheckoutMethods, Kn as workspaces, Kr as formatTraceparent, Kt as withCapturedAttemptContext, L as makeAccountMethods, Li as isRecord, Ln as PermissionCommandViewSchema, Lr as runPortEffect, Lt as asCapxulError, M as makeApprovalsMethods, Mi as Errors, Mn as authorities, Mr as reference, Mt as buildSafeMultiSendExecTransactionCall, N as makePayrollMethods, Ni as CapxulError, Nn as commands, Nr as makeAuthMethods, Nt as BASE_SEPOLIA_CHAIN_ID, O as retryIdempotentRead, Oi as toAuthUserId, On as normalizeCapxulOperation, Or as toAddress, Ot as deriveCapxulSafeAddress, P as makeUnavailablePayrollMethods, Pi as isCapxulError, Pn as configurations, Pr as askIdentity, Pt as MULTI_SEND_CALL_ONLY, Qn as toOrgId, R as emitDepositInitiated, Ri as readField, Rr as sessionFromActor, Rt as toPublicError, Sn as CLI_COMMAND_NAMES, St as SAFE_ENABLE_MODULE_ABI, T as TelemetryPortTag, Tn as stampTelemetryEnvelope, Tr as toExactAssetAmount, Tt as CAPXUL_PAYMENTS_V2_ADDRESS, U as waitForPaymentSubmission, Un as roles, Ur as defectAsCapxulError, Ut as observeFailedResult, V as makeOfframpMethods, Vn as invitations, Vr as withVerifiedOrganizationScope, W as makeDestinationsMethods, Wn as setups, Wr as runIfActive, Wt as observeSdkClient, Xr as carryInvocationParentSpan, Y as subscribeFreshQuery, Yn as ORGANIZATION_SETUP_STATUSES, Yr as ActorFailure, Zn as decodeChainCause, Zr as withInvocationParentSpan, _ as accountFromAccountPositions, _i as AuthClientError, _n as toPartyId, _r as toBudgetId, _t as ROLES_EXEC_TRANSACTION_WITH_ROLE_ABI, ai as observationRequestHeaders, an as isSignerNotReadySignal, ar as images, b as MONEY_READ_RATES, bi as globalLocalStorage, bn as redactTelemetryProps, br as toRoleKey, bt as ROLES_SET_UP_ABI, c as makePaymentDocumentsMethods, ci as readInvocationObservation, cn as signerFailure, cr as isBytes32, ct as roleKeyForPermission, d as SmartAccountPortTag, di as redactUrlSecrets, dn as makeClientRequestMethods, dr as toLowerBytes32, dt as CREATE_COMMITMENT_SIGNATURE, er as hashPermissionReplacementPreview, fi as isCredentialField, fn as toCountryCode, fr as toLowerHex, ft as MODULE_PROXY_FACTORY_ABI, g as ConvexAccountLayer, gn as toHandle, gr as EpochMsSchema, gt as ROLES_ASSIGN_ROLES_ABI, h as makeAccountsMethods, hi as toPublishableKey, hr as DurationMsSchema, ht as PARAMETER_TYPE, ii as BetterAuthBrowserLayer, in as isEcdsaSignatureHex, ir as AppIdSchema, it as canonicalJson, jn as onboardings, jr as absurd, jt as safe4337MultiSendUserOpCallData, k as bindProductTelemetryInvocation, ki as toEmail, kn as OPERATIONS, kt as normalizeSafeSaltEmail, l as makeSmartAccountMethods, li as sanitizeObservationContext, lr as toExactHex, lt as ZODIAC_MODULE_PROXY_FACTORY, m as PonderIndexerAdapter, mn as toTesterKind, mt as OPERATOR, n as bootIdentityFlow, nn as causeChain, nr as CurrentPolicySchema, oi as attachInvocationObservation, on as openfortSignerNotReadyCode, or as toAccountId, ot as moneySafeOpDigest, p as makeHoldingsMethods, pi as toAllowedOrigin, pn as toKycTier, pt as MULTI_SEND_SELECTOR, qn as OrganizationSetupSchema, qr as CAPXUL_ERROR_CODES, r as makeMeMethods, ri as BetterAuthNodeLayer, rr as diagnostics, s as makeActivityMethods, si as copyInvocationObservation, sn as recoverRawDigestSigner, st as ORG_BUDGET_ACTIONS, t as executeIdentityProductObservation, ti as ClockPortTag, tn as UNOBSERVABLE_SIGNER_STATUS, tr as decodePermissionIntent$1, u as ConvexSmartAccountLayer, ui as redactSecrets, un as makeCurrentUserMethods, ur as toLowerAddress, ut as resolveOrgPermissionIdentity, v as accountPositionsFromWire, vi as AuthClientPortTag, vn as validateHandle, vr as toPermissionAssignmentId, vt as ROLES_SET_ALLOWANCE_ABI, wt as SEND_SIGNATURE, xn as CLI_CAPABILITIES, xr as ChainIdSchema, xt as ROLE_MANAGEMENT_SIGNATURES, yi as detectAuthCacheAdapter, yr as toPermissionId, yt as ROLES_SET_TRANSACTION_UNWRAPPER_ABI, z as logDroppedEvent, zr as observationOnlyControls, zt as failureDetail } from "./access-BnlgphFT.mjs";
 import { Cause, Clock, Context, Data, Deferred, Duration, Effect, Exit, FiberSet, Layer, Logger, Metric, Option, Predicate, References, Result, Schedule, Schema, SchemaIssue, SchemaParser, Scope, Stream, Tracer } from "effect";
 import { getFunctionName } from "convex/server";
 import { BaseError, decodeFunctionData, encodeAbiParameters, encodeFunctionData, formatUnits, getContractAddress, keccak256, padHex, parseAbiParameters, stringToHex, toBytes, toFunctionSelector, toHex } from "viem";
@@ -76,798 +76,6 @@ function isPostHogUrlProperty(key) {
 	return normalized.includes("url") || normalized.includes("referrer") || normalized.includes("path") || normalized.includes("filename");
 }
 //#endregion
-//#region src/activity/documents.ts
-/** A reply its row does not admit is refused without the document body its decode error would carry. */
-function withoutDocumentBody(error) {
-	return error.details?.step === "decodeOutput" ? Errors.invalidInput("documentHash", "invalid document read") : error;
-}
-/** Schema errors must not retain document bodies. */
-function decodeDocumentRead(schema, input) {
-	return Effect.fromOption(Schema.decodeUnknownOption(schema)(input)).pipe(Effect.mapError(() => ({ publicError: Errors.invalidInput("documentHash", "invalid document read") })));
-}
-function makePaymentDocumentsMethods(deps) {
-	/**
-	* One document read by its row. The pair is decoded before anything is sent,
-	* and a reply the row does not admit is refused without the body it carried.
-	*/
-	const readDocument = (row, ref, options) => {
-		const controls = deps.invocationControls?.(options) ?? options;
-		return runPortEffect(Effect.gen(function* () {
-			const pair = yield* decodeDocumentRead(PaymentDocumentReadRefSchema, ref);
-			return yield* callOperation(deps.convexCall, row, copyInvocationObservation(controls, pair)).pipe(Effect.mapError((error) => ({ publicError: withoutDocumentBody(error) })));
-		}), controls, row.name, deps.runPromise);
-	};
-	return {
-		get: (ref, options) => readDocument(documents.get, ref, options),
-		verify: (ref, options) => readDocument(documents.verify, ref, options),
-		render: (ref, options) => readDocument(documents.render, ref, options)
-	};
-}
-//#endregion
-//#region src/activity/stitching.ts
-/** Epoch milliseconds of the block that carried the row. */
-function blockMillis(row) {
-	return Number(row.timestamp) * 1e3;
-}
-/** `0x1234…abcd` — the counterparty of an unclaimed transfer is an address. */
-function shortAddressLabel(address) {
-	return address.length <= 12 ? address : `${address.slice(0, 6)}…${address.slice(-4)}`;
-}
-function directionFor(safe, transfer) {
-	const from = transfer.from.toLowerCase();
-	const to = transfer.to.toLowerCase();
-	if (from === safe && to === safe) return "self";
-	return to === safe ? "in" : "out";
-}
-function withAnnotation(item, annotation) {
-	return annotation?.counterpartyLabel === void 0 ? item : {
-		...item,
-		counterpartyLabel: annotation.counterpartyLabel
-	};
-}
-/**
-* An indexed settlement confirms the intent. A missing row can be outside
-* this page or still backfilling; only the correction owner can prove rollback.
-*/
-function confirmPayment(intent, chain, expected) {
-	if (chain !== void 0 && matchesPaymentFact(chain, expected)) return {
-		...intent,
-		status: "settled",
-		...intent.execution === void 0 ? {} : { execution: {
-			status: "settled",
-			retryRequired: false
-		} },
-		receipt: {
-			chainId: chain.chainId,
-			transactionHash: chain.txHash
-		},
-		updatedAt: blockMillis(chain)
-	};
-	return intent;
-}
-function matchesPaymentFact(chain, expected) {
-	return chain !== void 0 && expected !== void 0 && chain.chainId === expected.chainId && chain.contract.toLowerCase() === expected.contract.toLowerCase() && chain.sender.toLowerCase() === expected.sender.toLowerCase() && chain.recipient.toLowerCase() === expected.recipient.toLowerCase() && chain.token.toLowerCase() === expected.token.toLowerCase() && chain.amount.toString() === expected.rawAmount && chain.documentHash.toLowerCase() === expected.documentHash.toLowerCase() && chain.kind === expected.kind;
-}
-/**
-* One unclaimed Transfer as an Activity row, or `null` when this SDK cannot
-* denominate its asset. The indexer serves only configured assets, so a row
-* the registry does not know means the SDK and that deployment disagree; it is
-* dropped rather than shown with a guessed currency.
-*/
-function isActivityVisible(item) {
-	return !(item.kind === "payment" && item.direction === "in" && item.execution?.notSent);
-}
-function transferItem(safe, transfer, annotation) {
-	const asset = configuredMoneyAssetById(transfer.assetId);
-	if (asset === null) return null;
-	const direction = directionFor(safe.toLowerCase(), transfer);
-	const counterparty = direction === "in" ? transfer.from : transfer.to;
-	const at = blockMillis(transfer);
-	return withAnnotation({
-		kind: "movement",
-		id: transfer.id,
-		classification: "movement_only_outflow",
-		amount: {
-			asset: asset.assetId,
-			value: formatUnits(transfer.amount, asset.decimals)
-		},
-		direction,
-		counterpartyLabel: shortAddressLabel(counterparty),
-		receipt: {
-			chainId: transfer.chainId,
-			transactionHash: transfer.txHash
-		},
-		createdAt: at,
-		updatedAt: at
-	}, annotation);
-}
-/**
-* Money in, money out and the pending share, one bucket per exact asset.
-*/
-function summarizeItems(items) {
-	const buckets = /* @__PURE__ */ new Map();
-	for (const item of items) {
-		const metadata = configuredMoneyAssetById(item.amount.asset);
-		if (metadata === null) continue;
-		const key = item.amount.asset;
-		const bucket = buckets.get(key) ?? {
-			asset: item.amount.asset,
-			in: 0n,
-			out: 0n,
-			pendingIn: 0n
-		};
-		const raw = rawUnits(item.amount.value, metadata.decimals);
-		if (item.kind === "payment" && item.status !== "settled") {
-			if (item.direction === "in" && item.status !== "cancelled" && item.status !== "failed" && !item.execution?.notSent) bucket.pendingIn += raw;
-		} else if (item.direction === "in") bucket.in += raw;
-		else if (item.direction === "out") bucket.out += raw;
-		buckets.set(key, bucket);
-	}
-	return [...buckets.values()].map((bucket) => ({
-		asset: bucket.asset,
-		in: bucket.in.toString(),
-		out: bucket.out.toString(),
-		net: (bucket.in - bucket.out).toString(),
-		pendingIn: bucket.pendingIn.toString()
-	}));
-}
-/** The inverse of `formatUnits`, kept exact: `"1.25"` at 6 decimals is `1250000n`. */
-function rawUnits(value, decimals) {
-	const negative = value.startsWith("-");
-	const [whole = "0", fraction = ""] = (negative ? value.slice(1) : value).split(".");
-	const raw = BigInt(`${whole}${fraction.padEnd(decimals, "0").slice(0, decimals)}`);
-	return negative ? -raw : raw;
-}
-//#endregion
-//#region src/activity/cursor.ts
-function actorKey(actor) {
-	return actor.kind === "account" ? `account:${actor.accountId}` : `organization:${actor.orgId}`;
-}
-function scopeKey(scope) {
-	return `${scope.principalAccountId}|${actorKey(scope.actor)}|${scope.safe?.toLowerCase() ?? "none"}`;
-}
-function selectionKey(params) {
-	const filter = params?.filter;
-	return JSON.stringify([
-		params?.range?.from ?? null,
-		params?.range?.to ?? null,
-		filter?.kind ?? null,
-		filter?.direction ?? null,
-		filter?.status === void 0 ? null : [...new Set(filter.status)].sort()
-	]);
-}
-function validString(value, max) {
-	return typeof value === "string" && value.length <= max;
-}
-function validPosition(position) {
-	return position === null || typeof position === "object" && "timestamp" in position && typeof position.timestamp === "number" && Number.isSafeInteger(position.timestamp) && position.timestamp >= 0 && "id" in position && typeof position.id === "string" && /^[1-9][0-9]{0,9}:0x[0-9a-f]{64}:[0-9]{1,10}$/.test(position.id);
-}
-function isActivityCursor(cursor, scope, selection) {
-	return typeof cursor === "object" && cursor !== null && cursorScopeMatches(cursor, scope, selection) && cursorProgressIsValid(cursor);
-}
-/** The cursor was issued for this scope and filter selection, at a valid checkpoint. */
-function cursorScopeMatches(cursor, scope, selection) {
-	return "version" in cursor && cursor.version === 1 && "scope" in cursor && cursor.scope === scope && "selection" in cursor && cursor.selection === selection && "checkpoint" in cursor && typeof cursor.checkpoint === "number" && Number.isSafeInteger(cursor.checkpoint) && cursor.checkpoint >= 0 && "source" in cursor && (cursor.source === "indexed" || cursor.source === "fallback");
-}
-/** Each source's progress is well-formed and bounded. */
-function cursorProgressIsValid(cursor) {
-	return "paymentCursor" in cursor && (cursor.paymentCursor === null || validString(cursor.paymentCursor, 2048)) && "paymentDone" in cursor && typeof cursor.paymentDone === "boolean" && "transferDone" in cursor && typeof cursor.transferDone === "boolean" && "degraded" in cursor && typeof cursor.degraded === "boolean" && "paymentPending" in cursor && Array.isArray(cursor.paymentPending) && cursor.paymentPending.length <= 100 && new Set(cursor.paymentPending).size === cursor.paymentPending.length && cursor.paymentPending.every((id) => validString(id, 256)) && "transferBefore" in cursor && validPosition(cursor.transferBefore);
-}
-function parseCursor(value, scope, selection) {
-	if (value === void 0) return null;
-	if (value.length > 4e4) throw Errors.invalidInput("cursor", "invalid Activity cursor");
-	const cursor = JSON.parse(value);
-	if (!isActivityCursor(cursor, scope, selection)) throw Errors.invalidInput("cursor", "Activity scope or filters changed; restart from the first page");
-	return cursor;
-}
-function requireParams(params) {
-	const limit = params?.limit ?? 25;
-	if (!Number.isSafeInteger(limit) || limit < 1 || limit > 100) throw Errors.invalidInput("limit", "must be an integer from 1 to 100");
-	for (const value of [params?.range?.from, params?.range?.to]) if (value !== void 0 && !Number.isSafeInteger(value)) throw Errors.invalidInput("range", "must contain integer epoch milliseconds");
-	const f = params?.filter;
-	if (f?.kind !== void 0 && f.kind !== "payment" && f.kind !== "movement" || f?.direction !== void 0 && ![
-		"in",
-		"out",
-		"self"
-	].includes(f.direction) || f?.status !== void 0 && (!Array.isArray(f.status) || !f.status.every((status) => PAYMENT_STATUSES.includes(status)))) throw Errors.invalidInput("filter", "invalid Activity filter");
-}
-function matchesFilter(item, filter) {
-	return (filter?.kind === void 0 || item.kind === filter.kind) && (filter?.direction === void 0 || item.direction === filter.direction) && (filter?.status === void 0 || item.kind === "payment" && filter.status.includes(item.status));
-}
-//#endregion
-//#region src/activity/indexed-pages.ts
-function chainRead(deps, table, input) {
-	return deps.indexer.read(table, input).pipe(Effect.catch((error) => {
-		if (error.publicError.details?.reason === "scope-refused" || ![
-			"NETWORK_ERROR",
-			"RATE_LIMITED",
-			"PROVIDER_ERROR",
-			"CAPABILITY_UNAVAILABLE",
-			"TIMEOUT"
-		].includes(error.publicCode)) return Effect.fail({ publicError: error.publicError });
-		return Effect.succeed(null);
-	}));
-}
-function boundedRange(range, checkpoint) {
-	return {
-		...range?.from === void 0 ? {} : { from: range.from },
-		to: Math.min(checkpoint, range?.to ?? checkpoint)
-	};
-}
-function unavailablePage(deps, scope, controls, params, state, first) {
-	if (first) return fallbackPage(deps, scope, controls, params, state, true);
-	return Effect.annotateCurrentSpan({
-		read_source: "indexer",
-		read_warning: "indexer-unavailable"
-	}).pipe(Effect.as({
-		items: [],
-		nextCursor: null,
-		checkpoint: state.checkpoint,
-		observedAt: Date.now(),
-		readWarning: "indexer-unavailable"
-	}));
-}
-function readTransfers(deps, safe, range, state, wanted, first) {
-	const from = Math.max(0, Math.ceil((range.from ?? 0) / 1e3));
-	const to = Math.floor(range.to / 1e3);
-	if (state.transferDone || from > to || !wanted && !first) return Effect.succeed([]);
-	return chainRead(deps, "transfer", {
-		safe: toAddress(safe),
-		limit: wanted ? 100 : 1,
-		timeline: {
-			from,
-			to,
-			...state.transferBefore === null ? {} : { before: state.transferBefore }
-		}
-	});
-}
-function readPayments(deps, scope, controls, range, state, wanted) {
-	const done = state.paymentDone || !wanted;
-	if (state.paymentPending.length > 0 || done) return Effect.succeed({
-		items: [],
-		pending: state.paymentPending,
-		cursor: state.paymentCursor,
-		done
-	});
-	return convexPage(deps, scope.actor, controls, {
-		limit: 100,
-		range,
-		filter: { kind: "payment" },
-		...state.paymentCursor === null ? {} : { cursor: state.paymentCursor }
-	}).pipe(Effect.map((page) => ({
-		items: page.items,
-		pending: page.items.map((item) => item.id),
-		cursor: page.nextCursor,
-		done: page.nextCursor === null
-	})));
-}
-function readPaymentFacts(deps, safe, settlements) {
-	const offsets = Array.from({ length: Math.ceil(settlements.length / 50) }, (_, i) => i * 50);
-	return Effect.forEach(offsets, (offset) => chainRead(deps, "payment", {
-		safe: toAddress(safe),
-		limit: 50,
-		settlements: settlements.slice(offset, offset + 50)
-	}), { concurrency: 2 }).pipe(Effect.map((pages) => pages.some((page) => page === null) ? null : pages.flatMap((page) => page ?? [])));
-}
-function indexedPage(deps, scope, controls, params, state, first) {
-	return Effect.gen(function* () {
-		const range = boundedRange(params?.range, state.checkpoint);
-		const wantsTransfers = params?.filter?.kind !== "payment" && params?.filter?.status === void 0;
-		const found = yield* readTransfers(deps, scope.safe, range, state, wantsTransfers, first);
-		if (found === null) return yield* unavailablePage(deps, scope, controls, params, state, first);
-		const transfers = wantsTransfers ? found : [];
-		const page = yield* readPayments(deps, scope, controls, range, state, params?.filter?.kind !== "movement");
-		const decoration = yield* decoratePage(deps, scope, controls, transfers, page, range);
-		if (decoration === null) return yield* unavailablePage(deps, scope, controls, params, state, first);
-		const { items, next } = mergePage(scope.safe, params?.filter, params?.limit ?? 25, state, page, decoration, transfers, wantsTransfers);
-		const cursor = next.paymentDone && next.paymentPending.length === 0 && next.transferDone ? null : JSON.stringify(next);
-		if (cursor !== null && cursor === params?.cursor) return yield* Effect.fail({ publicError: Errors.invalidInput("cursor", "Activity source did not advance") });
-		yield* Effect.annotateCurrentSpan({ read_source: "indexer" });
-		return {
-			items,
-			nextCursor: cursor,
-			checkpoint: state.checkpoint,
-			observedAt: Date.now()
-		};
-	});
-}
-//#endregion
-//#region src/activity/page-overlay.ts
-const MAX_OVERLAY_IDS = 200;
-function overlay(deps, actor, controls, input) {
-	const count = Math.max(input.references?.length ?? 0, input.settlementIds?.length ?? 0);
-	const offsets = Array.from({ length: Math.max(1, Math.ceil(count / MAX_OVERLAY_IDS)) }, (_, i) => i * MAX_OVERLAY_IDS);
-	return Effect.forEach(offsets, (offset) => callOperation(deps.convexCall, overlays.get, copyInvocationObservation(controls, {
-		...actor === void 0 ? {} : { actor },
-		...input.references === void 0 ? {} : { references: input.references.slice(offset, offset + MAX_OVERLAY_IDS) },
-		...input.settlementIds === void 0 ? {} : { settlementIds: input.settlementIds.slice(offset, offset + MAX_OVERLAY_IDS) }
-	})).pipe(Effect.mapError((publicError) => ({ publicError }))), { concurrency: 2 }).pipe(Effect.flatMap((pages) => {
-		const first = pages[0];
-		if (pages.some((page) => scopeKey(page) !== scopeKey(first))) return Effect.fail({ publicError: Errors.invalidInput("actor", "Activity scope changed during the read") });
-		return Effect.succeed({
-			...first,
-			links: pages.flatMap((page) => page.links),
-			annotations: pages.flatMap((page) => page.annotations),
-			payments: pages.flatMap((page) => page.payments)
-		});
-	}));
-}
-function decoratePage(deps, scope, controls, transfers, page, range) {
-	return Effect.gen(function* () {
-		const decoration = yield* overlay(deps, scope.actor, controls, {
-			references: [...page.pending.map((id) => ({
-				kind: "payment",
-				id
-			})), ...transfers.map((row) => ({
-				kind: "movement",
-				id: row.id
-			}))],
-			settlementIds: [...new Set(transfers.flatMap((row) => row.paymentSettlementId ? [row.paymentSettlementId] : []))]
-		});
-		if (scopeKey(decoration) !== scopeKey(scope)) return yield* Effect.fail({ publicError: Errors.invalidInput("actor", "Activity scope changed during the read") });
-		const byId = new Map([...page.items, ...decoration.payments].map((item) => [item.id, item]));
-		const settlements = [...new Set(decoration.links.map((link) => link.settlementId))];
-		const facts = yield* readPaymentFacts(deps, scope.safe, settlements);
-		if (facts === null) return null;
-		const bySettlement = new Map(facts.map((row) => [row.settlementId, row]));
-		const byPayment = new Map(decoration.links.map((link) => [link.paymentId, {
-			fact: bySettlement.get(link.settlementId),
-			expected: link.expected
-		}]));
-		const annotations = new Map(decoration.annotations.map((annotation) => [`${annotation.reference.kind}:${annotation.reference.id}`, annotation]));
-		return {
-			payments: page.pending.flatMap((id) => {
-				const item = byId.get(id);
-				if (item === void 0 || item.kind !== "payment" || item.createdAt > range.to || range.from !== void 0 && item.createdAt < range.from) return [];
-				const confirmed = withAnnotation(confirmPayment(item, byPayment.get(id)?.fact, byPayment.get(id)?.expected), annotations.get(`payment:${id}`));
-				return isActivityVisible(confirmed) ? [confirmed] : [];
-			}),
-			annotations,
-			linked: new Set(decoration.links.filter((link) => matchesPaymentFact(bySettlement.get(link.settlementId), link.expected)).map((link) => link.settlementId))
-		};
-	});
-}
-function mergePage(safe, filter, limit, state, page, decoration, transfers, wantsTransfers) {
-	const { payments, annotations, linked } = decoration;
-	let pi = 0;
-	let ti = 0;
-	const items = [];
-	const transferEnd = !wantsTransfers || transfers.length < 100;
-	let transferBefore = state.transferBefore;
-	while (items.length < limit) {
-		if (pi === payments.length && !page.done || ti === transfers.length && !transferEnd) break;
-		const payment = payments[pi];
-		const row = transfers[ti];
-		if (payment === void 0 && row === void 0) break;
-		if (payment !== void 0 && (row === void 0 || payment.createdAt >= Number(row.timestamp) * 1e3)) {
-			pi += 1;
-			if (matchesFilter(payment, filter)) items.push(payment);
-		} else if (row !== void 0) {
-			ti += 1;
-			transferBefore = {
-				timestamp: Number(row.timestamp),
-				id: row.id
-			};
-			if (row.paymentSettlementId && linked.has(row.paymentSettlementId)) continue;
-			const item = transferItem(safe, row, annotations.get(`movement:${row.id}`));
-			if (item !== null && matchesFilter(item, filter)) items.push(item);
-		}
-	}
-	return {
-		items,
-		next: {
-			...state,
-			paymentCursor: page.cursor,
-			paymentDone: page.done,
-			paymentPending: payments.slice(pi).map((item) => item.id),
-			transferBefore,
-			transferDone: ti === transfers.length && transferEnd
-		}
-	};
-}
-function convexPage(deps, actor, controls, input) {
-	return callOperation(deps.convexCall, items.list, copyInvocationObservation(controls, {
-		...input,
-		actor
-	})).pipe(Effect.mapError((publicError) => ({ publicError })));
-}
-function fallbackPage(deps, scope, controls, params, state, degraded) {
-	return Effect.gen(function* () {
-		const page = yield* convexPage(deps, scope.actor, controls, {
-			limit: params?.limit ?? 25,
-			...state.paymentCursor === null ? {} : { cursor: state.paymentCursor },
-			range: {
-				...params?.range?.from === void 0 ? {} : { from: params.range.from },
-				to: Math.min(state.checkpoint, params?.range?.to ?? state.checkpoint)
-			},
-			...params?.filter === void 0 ? {} : { filter: params.filter }
-		});
-		const decoration = yield* overlay(deps, scope.actor, controls, { references: page.items.map((item) => ({
-			kind: item.kind,
-			id: item.id
-		})) });
-		if (scopeKey(decoration) !== scopeKey(scope)) return yield* Effect.fail({ publicError: Errors.invalidInput("actor", "Activity scope changed during fallback") });
-		const annotations = new Map(decoration.annotations.map((annotation) => [`${annotation.reference.kind}:${annotation.reference.id}`, annotation]));
-		yield* Effect.annotateCurrentSpan({
-			read_source: "convex",
-			...degraded ? { read_warning: "indexer-unavailable" } : {}
-		});
-		return {
-			...page,
-			items: page.items.filter(isActivityVisible).map((item) => withAnnotation(item, annotations.get(`${item.kind}:${item.id}`))),
-			checkpoint: state.checkpoint,
-			nextCursor: page.nextCursor === null ? null : JSON.stringify({
-				...state,
-				source: "fallback",
-				paymentCursor: page.nextCursor,
-				degraded
-			}),
-			...degraded ? { readWarning: "indexer-unavailable" } : {}
-		};
-	});
-}
-function readActivityPage(deps, actor, controls, params) {
-	return Effect.gen(function* () {
-		yield* Effect.try({
-			try: () => requireParams(params),
-			catch: (cause) => ({ publicError: asCapxulError(cause) })
-		});
-		const scope = yield* overlay(deps, actor, controls, {});
-		const selection = selectionKey(params);
-		const cursor = yield* Effect.try({
-			try: () => parseCursor(params?.cursor, scopeKey(scope), selection),
-			catch: () => ({ publicError: Errors.invalidInput("cursor", "invalid or obsolete Activity cursor; restart the read") })
-		});
-		const state = cursor ?? {
-			version: 1,
-			scope: scopeKey(scope),
-			selection,
-			checkpoint: Date.now(),
-			source: "indexed",
-			paymentCursor: null,
-			paymentDone: false,
-			paymentPending: [],
-			transferBefore: null,
-			transferDone: false,
-			degraded: false
-		};
-		const range = boundedRange(params?.range, state.checkpoint);
-		if (range.from !== void 0 && range.from > range.to) return {
-			items: [],
-			nextCursor: null,
-			checkpoint: state.checkpoint,
-			observedAt: Date.now()
-		};
-		if (state.source === "fallback" || scope.safe === null) return yield* fallbackPage(deps, scope, controls, params, state, state.degraded);
-		return yield* indexedPage(deps, scope, controls, params, state, cursor === null);
-	});
-}
-function readActivitySummary(deps, actor, controls, params) {
-	return Effect.gen(function* () {
-		const totals = /* @__PURE__ */ new Map();
-		let cursor;
-		let count = 0;
-		let readWarning;
-		do {
-			const page = yield* readActivityPage(deps, actor, controls, {
-				limit: 100,
-				...cursor === void 0 ? {} : { cursor },
-				...params?.window === void 0 ? {} : { range: params.window }
-			});
-			count += page.items.length;
-			readWarning ??= page.readWarning;
-			for (const total of summarizeItems(page.items)) {
-				const key = total.asset;
-				const old = totals.get(key);
-				totals.set(key, old === void 0 ? total : {
-					...total,
-					in: String(BigInt(old.in) + BigInt(total.in)),
-					out: String(BigInt(old.out) + BigInt(total.out)),
-					net: String(BigInt(old.net) + BigInt(total.net)),
-					pendingIn: String(BigInt(old.pendingIn) + BigInt(total.pendingIn))
-				});
-			}
-			cursor = page.nextCursor ?? void 0;
-		} while (cursor !== void 0);
-		return {
-			window: {
-				from: params?.window?.from ?? null,
-				to: params?.window?.to ?? null
-			},
-			totals: [...totals.values()],
-			count,
-			observedAt: Date.now(),
-			...readWarning === void 0 ? {} : { readWarning }
-		};
-	});
-}
-function subscribeActivity(deps, actor, controls, onChange) {
-	return Effect.gen(function* () {
-		const scope = yield* overlay(deps, actor, controls, {});
-		if (scope.safe === null) return () => {};
-		let delivered = false;
-		return yield* deps.indexer.subscribe("transfer", {
-			safe: toAddress(scope.safe),
-			limit: 100
-		}, (snapshot) => {
-			if (snapshot.status === "ok") {
-				if (delivered) onChange();
-				delivered = true;
-			}
-			if (snapshot.status === "error") {
-				delivered = true;
-				onChange();
-			}
-		});
-	});
-}
-//#endregion
-//#region src/activity/movement-detail.ts
-/** An indexed Movement has no Convex materialization. Read its exact native row. */
-function readIndexedMovement(deps, actor, controls, eventId) {
-	return Effect.gen(function* () {
-		const scope = yield* overlay(deps, actor, controls, { references: [{
-			kind: "movement",
-			id: eventId
-		}] });
-		if (scope.safe === null) return null;
-		const safe = scope.safe.toLowerCase();
-		const row = (yield* deps.indexer.read("transfer", {
-			safe: toAddress(safe),
-			limit: 1,
-			eventId
-		}).pipe(Effect.mapError((error) => ({ publicError: error.publicError }))))[0];
-		if (row === void 0) return null;
-		const blockNumber = Number(row.blockNumber);
-		if (row.id !== eventId || row.from.toLowerCase() !== safe && row.to.toLowerCase() !== safe || !Number.isSafeInteger(blockNumber) || blockNumber < 0 || !Number.isSafeInteger(row.logIndex) || row.logIndex < 0) return yield* Effect.fail({ publicError: Errors.invalidInput("activity", "indexed Movement does not match the requested scope or evidence") });
-		yield* Effect.annotateCurrentSpan({ read_source: "indexer" });
-		const documentSet = scope.movementDocuments.find((set) => set.movementId === row.id);
-		return {
-			kind: "movement",
-			movementId: row.id,
-			documents: documentSet?.documents ?? [],
-			documentState: documentSet?.state ?? "pending",
-			viewer: scope.actor,
-			annotation: scope.annotations.find((annotation) => annotation.reference.kind === "movement" && annotation.reference.id === row.id) ?? null,
-			evidence: {
-				chainId: row.chainId,
-				contractAddress: row.token,
-				tokenAddress: row.token,
-				transactionHash: row.txHash,
-				blockNumber,
-				blockHash: row.blockHash,
-				inclusion: "included",
-				verification: "verified",
-				canonicalState: "finalized",
-				transferLogIndex: row.logIndex,
-				source: row.from,
-				destination: row.to,
-				rawAmount: row.amount.toString(),
-				link: {
-					movementId: row.id,
-					depositPaymentId: null
-				}
-			}
-		};
-	});
-}
-//#endregion
-//#region src/activity/scope.ts
-/**
-* The activity backend gives its actor a different name than the other
-* financialOps functions: `{kind: "organization", orgId}`, and not
-* `{kind: "org", orgId}`. Thus it does not use `actorReferenceToBackend`.
-*
-* The `personal` case sends NO actor. This is correct, and it does not lose
-* data. `requireActivityActor` uses the signed-in Account when the actor is
-* absent, and `canReadActor` refuses all other account identifiers
-* (`packages/backend/convex/movement/activityAuth.ts`). Thus "personal" and
-* "absent" both name the one Account that an SDK caller can read. The SDK does
-* not hold an account identifier to send.
-*
-* The `switch` is exhaustive. A new `ActorReference` variant is a compile error
-* here. The conditional expression that this function replaced removed each
-* value that was not an organization.
-*/
-function activityActorField(actor) {
-	if (actor === void 0 || actor.kind === "personal") return {};
-	return { actor: {
-		kind: "organization",
-		orgId: actor.organizationId
-	} };
-}
-/** Capture scope now; let the observed result boundary handle a malformed caller value. */
-function captureActivityInput(prepare) {
-	try {
-		return prepare();
-	} catch (cause) {
-		return Effect.die(cause);
-	}
-}
-function observeActivityScope(actor) {
-	const organizationId = actor?.kind === "organization" || actor?.kind === "org" ? safeEngineeringIdentifier(actor.orgId) : void 0;
-	return Effect.annotateCurrentSpan({
-		scope_kind: actor?.kind === "organization" || actor?.kind === "org" ? "organization" : "account",
-		...organizationId === void 0 ? {} : { verified_organization_id: organizationId }
-	});
-}
-function decodeActivityViewer(value) {
-	const viewer = Option.getOrUndefined(Schema.decodeUnknownOption(ActorRefSchema)(value));
-	if (viewer === void 0) return void 0;
-	const id = viewer.kind === "organization" ? viewer.orgId : viewer.accountId;
-	return safeEngineeringIdentifier(id) === void 0 ? void 0 : viewer;
-}
-/** The detail without the scope it was read for, which the SDK reports as telemetry instead. */
-function normalizeActivityDetail(response) {
-	if (response === null) return null;
-	const { viewer: _viewer, ...detail } = response;
-	return detail;
-}
-//#endregion
-//#region src/activity/methods.ts
-function makeActivityMethods(deps) {
-	const indexerDeps = deps.indexerRead === void 0 ? void 0 : {
-		indexer: deps.indexerRead,
-		convexCall: deps.convexCall
-	};
-	/** One public call for the caller's chosen actor, read once at call start. */
-	const forActor = (actorRef, options, operation, program) => {
-		const controls = deps.invocationControls?.(options) ?? options;
-		return runPortEffect(captureActivityInput(() => Effect.succeed(activityActorField(actorRef).actor)).pipe(Effect.flatMap((actor) => program(actor, controls))), controls, operation, deps.runPromise);
-	};
-	return {
-		subscribe: (onChange, params, options) => forActor(params?.actor, options, CAPXUL_OPERATIONS.activity.subscribe, (actor, controls) => indexerDeps === void 0 ? Effect.succeed(() => {}) : Effect.suspend(() => subscribeActivity(indexerDeps, actor, controls, onChange)).pipe(Effect.tap(() => observeActivityScope(actor)))),
-		list: (params, options) => forActor(params?.actor, options, items.list.name, (actor, controls) => Effect.suspend(() => indexerDeps === void 0 ? callOperation(deps.convexCall, items.list, copyInvocationObservation(controls, {
-			...actor === void 0 ? {} : { actor },
-			...params?.cursor === void 0 ? {} : { cursor: params.cursor },
-			...params?.limit === void 0 ? {} : { limit: params.limit },
-			...params?.range === void 0 ? {} : { range: params.range },
-			...params?.filter === void 0 ? {} : { filter: params.filter }
-		})).pipe(Effect.mapError((publicError) => ({ publicError }))) : readActivityPage(indexerDeps, actor, controls, params)).pipe(Effect.map((page) => ({
-			...page,
-			items: page.items.filter(isActivityVisible)
-		})), Effect.tap(() => observeActivityScope(actor)))),
-		summary: (params, options) => forActor(params?.actor, options, items.summary.name, (actor, controls) => Effect.suspend(() => indexerDeps === void 0 ? callOperation(deps.convexCall, items.summary, copyInvocationObservation(controls, {
-			...actor === void 0 ? {} : { actor },
-			...params?.window === void 0 ? {} : { window: params.window }
-		})).pipe(Effect.mapError((publicError) => ({ publicError }))) : readActivitySummary(indexerDeps, actor, controls, params)).pipe(Effect.tap(() => observeActivityScope(actor)))),
-		get: (reference, options) => {
-			const controls = deps.invocationControls?.(options) ?? options;
-			const requestedActor = actorReferenceToBackend(options?.actor);
-			const capturedScope = captureActivityInput(() => {
-				const scope = requestedActor === void 0 ? void 0 : requestedActor.kind === "org" ? {
-					kind: "org",
-					orgId: requestedActor.orgId
-				} : { kind: "account" };
-				return Effect.succeed({
-					actor: scope,
-					referenceActor: reference.kind === "payment" ? activityActorField(reference.actor).actor : void 0
-				});
-			});
-			return runPortEffect(capturedScope.pipe(Effect.flatMap(({ actor, referenceActor }) => Effect.suspend(() => indexerDeps !== void 0 && reference.kind === "movement" && /^[1-9][0-9]{0,9}:0x[0-9a-f]{64}:[0-9]{1,10}$/.test(reference.id) ? readIndexedMovement(indexerDeps, actor?.kind === "org" ? {
-				kind: "organization",
-				orgId: actor.orgId
-			} : void 0, controls, reference.id) : callOperation(deps.convexCall, items.get, copyInvocationObservation(controls, {
-				reference: {
-					kind: reference.kind,
-					id: reference.id,
-					...referenceActor === void 0 ? {} : { actor: referenceActor }
-				},
-				...actor === void 0 ? {} : { actor }
-			})).pipe(Effect.mapError((publicError) => ({ publicError })))).pipe(Effect.flatMap((response) => {
-				const detail = normalizeActivityDetail(response);
-				if (response === null) return Effect.succeed(detail);
-				const viewer = response.viewer === void 0 ? actor ?? referenceActor : decodeActivityViewer(response.viewer);
-				return viewer === void 0 ? Effect.succeed(detail) : observeActivityScope(viewer).pipe(Effect.as(detail));
-			})))), controls, items.get.name, deps.runPromise);
-		},
-		annotate: (input, options) => {
-			const controls = deps.invocationControls?.(options) ?? options;
-			const capturedScope = captureActivityInput(() => {
-				const actor = activityActorField(input.actor).actor;
-				if (input.actor !== void 0 && input.reference.kind === "payment" && input.reference.actor !== void 0 && !sameActor(input.actor, input.reference.actor)) return Effect.fail({ publicError: Errors.invalidInput("reference.actor", "must match the annotation actor") });
-				return Effect.succeed({
-					actor,
-					referenceActor: input.reference.kind === "payment" ? activityActorField(input.reference.actor).actor : void 0
-				});
-			});
-			return runPortEffect(capturedScope.pipe(Effect.flatMap(({ actor, referenceActor }) => Effect.suspend(() => callOperation(deps.convexCall, annotations.save, copyInvocationObservation(controls, {
-				...actor === void 0 ? {} : { actor },
-				reference: input.reference.kind === "payment" && referenceActor !== void 0 ? {
-					kind: "payment",
-					id: input.reference.id,
-					actor: referenceActor
-				} : {
-					kind: input.reference.kind,
-					id: input.reference.id
-				},
-				...input.counterpartyLabel === void 0 ? {} : { counterpartyLabel: input.counterpartyLabel },
-				...input.accountingCategory === void 0 ? {} : { accountingCategory: input.accountingCategory },
-				...input.memo === void 0 ? {} : { memo: input.memo }
-			})).pipe(Effect.mapError((publicError) => ({ publicError })))).pipe(Effect.tap((annotation) => {
-				const scope = decodeActivityViewer(annotation.actor);
-				return scope === void 0 ? Effect.void : observeActivityScope(scope);
-			})))), controls, annotations.save.name, deps.runPromise);
-		}
-	};
-}
-//#endregion
-//#region src/activity/phases.ts
-const PENDING = Object.freeze({
-	terminal: false,
-	outcome: null,
-	needsAction: false
-});
-const AWAITING_ACTOR = Object.freeze({
-	terminal: false,
-	outcome: null,
-	needsAction: true
-});
-const COMPLETED = Object.freeze({
-	terminal: true,
-	outcome: "good",
-	needsAction: false
-});
-const FAILED = Object.freeze({
-	terminal: true,
-	outcome: "bad",
-	needsAction: false
-});
-const WITHDRAWN = Object.freeze({
-	terminal: true,
-	outcome: "neutral",
-	needsAction: false
-});
-/** Interpret a Payment status. `pending_claim` waits for the actor who reads it. */
-function paymentPhase(status) {
-	switch (status) {
-		case "pending":
-		case "settling":
-		case "scheduled":
-		case "streaming": return PENDING;
-		case "pending_claim": return AWAITING_ACTOR;
-		case "settled": return COMPLETED;
-		case "cancelled": return WITHDRAWN;
-		case "failed":
-		case "unresolved": return FAILED;
-		default: return absurd(status);
-	}
-}
-/** Interpret a payment Request as its ISSUER sees it. An issuer does not wait for itself. */
-function requestPhase(status) {
-	switch (status) {
-		case "draft":
-		case "sent":
-		case "viewed":
-		case "pending_settlement": return PENDING;
-		case "paid": return COMPLETED;
-		case "declined":
-		case "expired": return FAILED;
-		case "cancelled": return WITHDRAWN;
-		default: return absurd(status);
-	}
-}
-/** Interpret the same request as its RECIPIENT sees it. `open` waits for the recipient. */
-function inboxPhase(status) {
-	switch (status) {
-		case "open": return AWAITING_ACTOR;
-		case "approved": return PENDING;
-		case "paid": return COMPLETED;
-		case "declined":
-		case "expired": return FAILED;
-		case "cancelled": return WITHDRAWN;
-		default: return absurd(status);
-	}
-}
-//#endregion
-//#region ../protocol/src/payroll/model.ts
-function toPayrollRunId(raw) {
-	return toNonEmptyStringBrand(raw, "payrollRunId", (value) => isNonEmptyString(value));
-}
-function toPayrollGroupId(raw) {
-	return toNonEmptyStringBrand(raw, "payrollGroupId", (value) => isNonEmptyString(value));
-}
-//#endregion
 //#region src/permissions/command-decoding.ts
 /** The caller's input as a command: ids branded and the intent decoded, or invalid input thrown. */
 const buildCommand = {
@@ -12016,411 +11224,6 @@ function makePermissionMethods(deps, orgId) {
 	};
 }
 //#endregion
-//#region src/payroll/run-checks.ts
-/** Match the caller's compensation to the committed V3 Payslip. */
-function payslipIdentityMatches(message, item, index, runId, period) {
-	return message.runId === runId && message.itemIndex === index && message.employeeRef === item.partyId && message.periodStart === period.start && message.periodEnd === period.end && message.adjustmentsHash === hashAdjustmentsV3(item.adjustments);
-}
-function payslipAmountMatches(message, item) {
-	const exact = toExactAssetAmount(item.amount, CONFIGURED_MONEY_ASSETS);
-	return message.gross.asset === exact.asset && message.gross.minorUnits === item.gross && message.gross.decimals === exact.decimals && message.net.asset === exact.asset && message.net.minorUnits === item.net && message.net.decimals === exact.decimals;
-}
-function isRunItem(prepared, item, evidence, index, runId, period) {
-	if (prepared === void 0) return false;
-	const bundle = evidence.preparedCommand?.documentBundles?.[index];
-	const preparedItem = evidence.preparedCommand?.items[index];
-	const payslip = bundle?.envelope;
-	if (bundle === void 0 || payslip?.primaryType !== "Payslip") return false;
-	return canonicalJson(prepared.to) === canonicalJson(item.to) && prepared.paymentType === "payroll" && canonicalJson(prepared.amount) === canonicalJson(item.amount) && bundle.adjustments !== void 0 && canonicalJson(bundle.adjustments) === canonicalJson(item.adjustments) && payslipIdentityMatches(payslip.message, item, index, runId, period) && payslipAmountMatches(payslip.message, item) && (preparedItem?.operation === "send" || preparedItem?.operation === "create_commitment") && preparedItem.documentHash === evidence.preparedCommand?.instructionDocuments?.[index]?.documentHash;
-}
-/**
-* The batch the backend derived from a payroll intent must be the batch this
-* caller asked for, checked before the digest is signed.
-*
-* The payslip envelope on each item is server-built and carries the run row's
-* own `issuedAt`, so the batch cannot be fingerprinted against a local copy
-* (`matchesIntent` is unavailable here). What CAN be verified is every field
-* the caller supplied — the org, the Budget, the request key, and per item the
-* recipient, the amount and the payslip figures — plus the lineage binding the
-* batch to the run just written. A prepared command that pays a different
-* person, a different amount, from a different Budget, or under a different
-* run never reaches the signer.
-*/
-function isRunBatch(input) {
-	return (batch, evidence) => Promise.resolve(!("kind" in batch) && batch.orgId === input.orgId && batch.permissionId === input.permissionId && batch.requestKey === input.requestKey && batch.lineage?.kind === "payroll" && batch.lineage.runId === input.runId && batch.items.length === input.items.length && batch.items.every((item) => item.amount.asset === input.asset) && input.items.every((item, index) => isRunItem(batch.items[index], item, evidence, index, input.runId, input.period)));
-}
-/** A decoded detail is the run asked for, whole: its scope, membership and quantities agree. */
-function checkPayrollRunDetail(value, orgId, runId) {
-	if (value === null) return {
-		ok: true,
-		value: null
-	};
-	if (value.orgId !== orgId || value.run.id !== runId || value.items.length === 0 || value.items.length !== value.run.recipientCount || new Set(value.items.map((item) => item.payment.id)).size !== value.items.length || value.items.some((item, index) => item.itemIndex !== index || item.amount.asset !== value.run.total.asset || item.payment.amount.asset !== item.amount.asset || item.payment.paymentType !== "payroll")) return {
-		ok: false,
-		error: Errors.invalidInput("run", "Payroll run scope or membership does not match")
-	};
-	try {
-		const total = toExactAssetAmount(value.run.total, CONFIGURED_MONEY_ASSETS);
-		let rawTotal = 0n;
-		for (const item of value.items) {
-			const amount = toExactAssetAmount(item.amount, CONFIGURED_MONEY_ASSETS);
-			const payment = toExactAssetAmount(item.payment.amount, CONFIGURED_MONEY_ASSETS);
-			if (amount.minorUnits !== payment.minorUnits) return {
-				ok: false,
-				error: Errors.invalidInput("run", "Payroll item quantity does not match its Payment")
-			};
-			rawTotal += BigInt(amount.minorUnits);
-		}
-		if (rawTotal !== BigInt(total.minorUnits)) return {
-			ok: false,
-			error: Errors.invalidInput("run", "Payroll run total does not match its items")
-		};
-	} catch {
-		return {
-			ok: false,
-			error: Errors.invalidInput("run", "Payroll run quantities are invalid")
-		};
-	}
-	return {
-		ok: true,
-		value
-	};
-}
-//#endregion
-//#region src/payroll/run-decoding.ts
-function toPayrollRun(wire) {
-	return {
-		id: toPayrollRunId(wire.id),
-		status: wire.status,
-		periodStart: wire.periodStart,
-		periodEnd: wire.periodEnd,
-		total: wire.total,
-		recipientCount: wire.recipientCount
-	};
-}
-function toPayrollRuns(wire) {
-	return {
-		...mapPage(wire, toPayrollRun),
-		settledThisMonth: wire.settledThisMonth
-	};
-}
-function toPayrollGroup(wire) {
-	return {
-		id: toPayrollGroupId(wire.id),
-		name: wire.name,
-		tone: wire.tone,
-		members: wire.members.map((member) => ({
-			partyId: member.partyId,
-			amount: member.amount,
-			currency: member.currency
-		}))
-	};
-}
-function validateRunItems(input) {
-	for (const [index, item] of input.items.entries()) {
-		if (Schema.decodeResult(PayrollRunItemInputSchema, { onExcessProperty: "error" })(item)._tag === "Failure") return Errors.invalidInput(`items.${index}`, "invalid Payroll item");
-		try {
-			const exact = toExactAssetAmount(item.amount, CONFIGURED_MONEY_ASSETS);
-			const net = BigInt(item.net);
-			const gross = BigInt(item.gross);
-			const adjustments = item.adjustments.reduce((sum, row) => sum + BigInt(row.amount), 0n);
-			if (item.amount.asset !== input.asset || item.net !== exact.minorUnits || gross + adjustments !== net) return Errors.invalidInput(`items.${index}`, "invalid Payroll units");
-		} catch {
-			return Errors.invalidInput(`items.${index}`, "invalid Payroll units");
-		}
-	}
-	return null;
-}
-const RunInputSchema = Schema.Struct({
-	permissionId: AuthorizePayrollRunExecutionInputSchema.fields.permissionId,
-	asset: AuthorizePayrollRunExecutionInputSchema.fields.asset,
-	period: AuthorizePayrollRunExecutionInputSchema.fields.period,
-	items: AuthorizePayrollRunExecutionInputSchema.fields.items,
-	requestKey: Schema.optional(AuthorizePayrollRunExecutionInputSchema.fields.requestKey)
-});
-/** Decode caller input before session or signer work. Keep routing outside the input. */
-function decodePayrollRunInput(value) {
-	try {
-		const decoded = Schema.decodeUnknownSync(RunInputSchema, { onExcessProperty: "error" })(value);
-		const input = {
-			permissionId: decoded.permissionId,
-			asset: decoded.asset,
-			period: decoded.period,
-			...decoded.requestKey === void 0 ? {} : { requestKey: decoded.requestKey },
-			items: decoded.items.map((item) => ({
-				amount: item.amount,
-				gross: item.gross,
-				net: item.net,
-				adjustments: item.adjustments,
-				partyId: toPartyId(item.partyId),
-				to: item.to.kind === "party" ? {
-					kind: "party",
-					partyId: toPartyId(item.to.partyId)
-				} : item.to.kind === "address" ? {
-					kind: "address",
-					address: toAddress(item.to.address)
-				} : item.to
-			}))
-		};
-		if (input.items.length === 0 || input.period.start > input.period.end) throw Errors.invalidInput("input", "Payroll requires items and an ordered period");
-		const error = validateRunItems(input);
-		if (error !== null) throw error;
-		return input;
-	} catch (cause) {
-		throw cause instanceof CapxulError ? cause : Errors.invalidInput("input", "Invalid Payroll input");
-	}
-}
-/** Read only the exact backend prepare receipt, never an arbitrary signer failure. */
-function payrollResolution(error, requestKey) {
-	const details = error.details;
-	if (error.code !== "WRONG_STATE" || details?.method !== runs.authorize.name || details.requestKey !== requestKey || typeof details.commandId !== "string" || typeof details.runId !== "string") return void 0;
-	return details.payrollResolution === "failed" || details.payrollResolution === "settled" ? details.payrollResolution : void 0;
-}
-function validatePayrollRunLookup(orgId, runId) {
-	return !Schema.is(PayrollRunIdSchema)(runId) || orgId.length === 0 ? {
-		ok: false,
-		error: Errors.invalidInput("runId", "Organization and run ID must be valid")
-	} : {
-		ok: true,
-		value: void 0
-	};
-}
-/** Strict saved detail decoder shared by the read and fresh stream. */
-function decodePayrollRunDetail(raw, orgId, runId) {
-	const decoded = Schema.decodeUnknownResult(Schema.NullOr(PayrollRunDetailSchema), { onExcessProperty: "error" })(raw);
-	if (decoded._tag === "Failure") return {
-		ok: false,
-		error: Errors.invalidInput("run", "Invalid Payroll run detail")
-	};
-	return checkPayrollRunDetail(decoded.success, orgId, runId);
-}
-//#endregion
-//#region src/payroll/run-subscription.ts
-function detailValue(result) {
-	if (!result.ok) throw result.error;
-	return result.value;
-}
-function subscribePayrollRun(deps, orgId, runId, listener, options) {
-	const operation = CAPXUL_OPERATIONS.org.payroll.subscribeRun;
-	const valid = deps.validate(orgId, runId);
-	if (!valid.ok) return runCapxulEffect(Effect.fail(valid.error), observationOnlyControls(deps.invocationControls?.(options) ?? options), operation, deps.runPromise);
-	const decode = (raw) => detailValue(deps.decode(raw, orgId, runId));
-	return subscribeFreshQuery(deps, {
-		orgId,
-		runId
-	}, listener, operation, {
-		decode,
-		validateCached: (raw) => {
-			decode(raw);
-		},
-		invalidValue: (cause) => isCapxulError(cause) ? cause : Errors.invalidInput("run", "Invalid Payroll run detail"),
-		invalidScope: () => Errors.invalidInput("run", "Payroll run subscription scope does not match"),
-		lostValue: () => Errors.invalidInput("run", "Payroll run is no longer readable"),
-		unavailable: () => Errors.notImplemented("payroll", "subscribeRun")
-	}, options);
-}
-//#endregion
-//#region src/payroll/run-authorization.ts
-/**
-* Authorize one payroll run: a stable request key, the prepared batch checked
-* against the run the caller asked for, the signature, and the submission.
-*/
-async function authorizePayrollRun(scope, input, controls, onRequestKey, onResolved) {
-	const { deps, orgId, requestKeyScope } = scope;
-	const signal = controls?.signal;
-	const execution = executionDependencies(deps);
-	if (execution === null) return {
-		ok: false,
-		error: Errors.notImplemented("payroll", "executionComposition")
-	};
-	try {
-		input = decodePayrollRunInput(input);
-	} catch (cause) {
-		return {
-			ok: false,
-			error: asCapxulError(cause)
-		};
-	}
-	const { requestKey: provided, ...canonicalInput } = input;
-	const actorId = onRequestKey === void 0 ? void 0 : execution.actor.authSession()?.authUserId;
-	if (onRequestKey !== void 0 && actorId === void 0) return {
-		ok: false,
-		error: Errors.notAuthenticated()
-	};
-	const requestKey = await paymentRequestKeyLifecycle(`${requestKeyScope}:${AUTHORIZE_RUN}`, onRequestKey === void 0 ? {
-		orgId,
-		input
-	} : {
-		actorId,
-		orgId,
-		input: canonicalInput
-	}, provided, onRequestKey === void 0 ? void 0 : { manageProvidedKey: true });
-	try {
-		await onRequestKey?.(requestKey.key);
-		if (onRequestKey !== void 0 && execution.actor.authSession()?.authUserId !== actorId) {
-			await requestKey.finish(false).catch(() => void 0);
-			return {
-				ok: false,
-				error: Errors.notAuthenticated()
-			};
-		}
-	} catch (cause) {
-		await requestKey.finish(false).catch(() => void 0);
-		return {
-			ok: false,
-			error: asCapxulError(cause)
-		};
-	}
-	let authorized;
-	let acceptedReplay;
-	let preparedClosed = false;
-	let terminalReplay;
-	const submitted = await executePrepared(execution, async (signerAddress) => {
-		const prepared = await runIfActive(signal, AUTHORIZE_RUN, () => withInvocationParentSpan(Effect.suspend(() => callOperation(deps.convexCall, runs.authorize, copyInvocationObservation(controls, {
-			orgId,
-			permissionId: input.permissionId,
-			asset: input.asset,
-			requestKey: requestKey.key,
-			signerAddress,
-			period: input.period,
-			items: input.items
-		}))).pipe(Effect.mapError((publicError) => ({ publicError }))), controls), deps.runPromise);
-		if (!prepared.ok) {
-			terminalReplay = payrollResolution(prepared.error, requestKey.key);
-			return prepared;
-		}
-		authorized = prepared.value.run;
-		acceptedReplay = prepared.value.replay.kind === "accepted" ? prepared.value.replay.submission : void 0;
-		return {
-			ok: true,
-			value: prepared.value.execution
-		};
-	}, (request, evidence) => authorized === void 0 || authorized.periodStart !== input.period.start || authorized.periodEnd !== input.period.end ? Promise.resolve(false) : isRunBatch({
-		orgId,
-		permissionId: input.permissionId,
-		requestKey: requestKey.key,
-		runId: authorized.id,
-		asset: input.asset,
-		period: input.period,
-		items: input.items
-	})(request, evidence), true, () => preparedClosed = true, signal, controls, void 0, () => acceptedReplay);
-	const resolution = preparedClosed ? "failed" : terminalReplay;
-	if (resolution !== void 0) try {
-		await onResolved?.(resolution);
-	} catch {}
-	try {
-		await requestKey.finish(submitted.ok || resolution !== void 0);
-	} catch {}
-	if (!submitted.ok) return submitted;
-	return authorized === void 0 ? {
-		ok: false,
-		error: Errors.unknown()
-	} : {
-		ok: true,
-		value: toPayrollRun(authorized)
-	};
-}
-const AUTHORIZE_RUN = runs.authorize.name;
-function executionDependencies(deps) {
-	return deps.actor === void 0 || deps.chainId === void 0 || deps.signer === void 0 ? null : {
-		actor: deps.actor,
-		chainId: deps.chainId,
-		convexCall: deps.convexCall,
-		runPromise: deps.runPromise,
-		signer: deps.signer,
-		...deps.telemetry === void 0 ? {} : { telemetry: deps.telemetry }
-	};
-}
-//#endregion
-//#region src/payroll/runs.ts
-function makePayrollMethods(deps, orgId) {
-	const requestKeyScope = deps.requestKeyScope ?? `client-${crypto.randomUUID()}`;
-	/** One observed call of one payroll row, its reply projected inside the call, under the row's name. */
-	const call = (row, args, options, project) => {
-		const controls = deps.invocationControls?.(options) ?? options;
-		return runPortEffect(callOperation(deps.convexCall, row, copyInvocationObservation(controls, args)).pipe(Effect.map(project), Effect.mapError((publicError) => ({ publicError }))), controls, row.name, deps.runPromise);
-	};
-	return {
-		subscribeRun: (runId, listener, options) => subscribePayrollRun({
-			actor: deps.actor,
-			convexCall: deps.convexCall,
-			query: reference(runs.get),
-			runPromise: deps.runPromise,
-			invocationControls: deps.invocationControls,
-			decode: decodePayrollRunDetail,
-			validate: validatePayrollRunLookup
-		}, orgId, runId, listener, options),
-		getRun: (runId, options) => {
-			const controls = deps.invocationControls?.(options) ?? options;
-			const lifetime = deps.actor?.authLifetime();
-			const operation = runs.get.name;
-			return runCapxulEffect(Effect.gen(function* () {
-				const lookup = validatePayrollRunLookup(orgId, runId);
-				if (!lookup.ok) return yield* Effect.fail(lookup.error);
-				if (lifetime === void 0 || lifetime.authUserId === null || deps.actor === void 0) return yield* Effect.fail(Errors.notAuthenticated());
-				const current = () => deps.actor?.matchesAuthLifetime(lifetime, lifetime.authUserId) === true;
-				if (!current()) return yield* Effect.fail(Errors.notAuthenticated());
-				const parent = yield* Effect.currentSpan.pipe(Effect.orDie);
-				const captured = carryInvocationParentSpan(controls, parent);
-				const run = yield* awaitCapxulResult(() => runIfActive(controls?.signal, operation, () => withInvocationParentSpan(Effect.suspend(() => callOperation(deps.convexCall, runs.get, copyInvocationObservation(captured, {
-					orgId,
-					runId
-				}))).pipe(Effect.mapError((publicError) => ({ publicError }))), captured), deps.runPromise));
-				if (!current()) return yield* Effect.fail(Errors.cancelled({ operation }));
-				const checked = checkPayrollRunDetail(run, orgId, runId);
-				return yield* checked.ok ? Effect.succeed(checked.value) : Effect.fail(checked.error);
-			}), observationOnlyControls(controls), operation, deps.runPromise);
-		},
-		runs: (options) => call(runs.list, { orgId }, options, toPayrollRuns),
-		authorizeRun: (input, options) => {
-			const controls = deps.invocationControls?.(options) ?? options;
-			return runCapxulEffect(Effect.gen(function* () {
-				if (controls?.signal?.aborted === true) return yield* Effect.fail(Errors.cancelled({ operation: AUTHORIZE_RUN }));
-				const parent = yield* Effect.currentSpan.pipe(Effect.orDie);
-				return yield* awaitCapxulResult(() => authorizePayrollRun({
-					deps,
-					orgId,
-					requestKeyScope
-				}, input, carryInvocationParentSpan(controls, parent), options?.onRequestKey, options?.onResolved));
-			}), observationOnlyControls(controls), AUTHORIZE_RUN, deps.runPromise);
-		},
-		terms: (options) => call(terms.list, { orgId }, options, (rates) => rates),
-		groups: {
-			list: (options) => call(groups.list, { orgId }, options, (saved) => mapPage(saved, toPayrollGroup)),
-			save: (input, options) => call(groups.save, {
-				orgId,
-				...input.id === void 0 ? {} : { id: String(input.id) },
-				name: input.name,
-				tone: input.tone,
-				members: input.members
-			}, options, toPayrollGroup),
-			remove: (id, options) => call(groups.remove, {
-				orgId,
-				id
-			}, options, () => void 0)
-		}
-	};
-}
-const payrollUnavailable = () => Promise.resolve({
-	ok: false,
-	error: Errors.notImplemented("payroll", "executionComposition")
-});
-/** The bundle an unconfigured client exposes — every verb refuses, none throws. */
-function makeUnavailablePayrollMethods() {
-	return {
-		getRun: payrollUnavailable,
-		subscribeRun: payrollUnavailable,
-		runs: payrollUnavailable,
-		authorizeRun: payrollUnavailable,
-		terms: payrollUnavailable,
-		groups: {
-			list: payrollUnavailable,
-			save: payrollUnavailable,
-			remove: payrollUnavailable
-		}
-	};
-}
-//#endregion
 //#region src/signing/embedded-wallet.ts
 function openfortEmbeddedWalletPort(input) {
 	return {
@@ -15789,6 +14592,11 @@ const OBSERVED_CONVEX_QUERIES = new Set(OPERATIONS.filter((row) => row.kind ===
 const OBSERVED_CONVEX_MUTATIONS = new Set(OPERATIONS.filter((row) => row.kind === "mutation").map((row) => row.path));
 //#endregion
 //#region src/platform/transport/convex-errors.ts
+/**
+* All a redacting backend says about an error it raised itself: its request
+* id. The WebSocket client wraps it as `[CONVEX Q(path)] … Called by client`.
+*/
+const REDACTED_ERROR = /^(?:\[CONVEX [QMA?]\([^)]*\)\] )?\[Request ID: ([^\]\s]+)\] Server Error(?:\s+Called by client)?$/u;
 function mapToCapxulError(operation, err, transport) {
 	const decoded = decodeConvexError(err);
 	if (decoded !== null) return decoded;
@@ -15813,9 +14621,26 @@ function mapToCapxulError(operation, err, transport) {
 * anything else (an uncaught "Server Error") is a backend defect. None is a
 * provider outage. The Convex request id rides in details, so the backend's
 * log line can be found.
+*
+* A deployed backend redacts these errors (`REDACT_LOGS_TO_CLIENT`, #2304):
+* the message is only the request id, and no structured cause exists, so the
+* message shape is the only discriminator. Neither case can be told apart, and
+* the reply says where to look instead. The text matches stay for a backend
+* that does not redact (development, local).
 */
 function backendFailure(operation, err) {
 	const text = err instanceof Error ? err.message : String(err);
+	const redacted = REDACTED_ERROR.exec(text.trim())?.[1];
+	if (redacted !== void 0) return new CapxulError("UNKNOWN", `The backend refused ${operation} and gave no detail. Find Convex request ${redacted} in the backend logs. If the backend can be newer than this client, update the CLI or SDK.`, {
+		cause: err,
+		layer: "convex",
+		details: {
+			operation,
+			provider: "convex",
+			requestId: redacted,
+			reason: "backend-error-redacted"
+		}
+	});
 	const requestId = /\[Request ID: ([^\]\s]+)\]/u.exec(text)?.[1];
 	const where = {
 		operation,
@@ -18461,4 +17286,4 @@ async function createCapxulClient(input) {
 	return createCapxulClientWithSignerControls(input, {});
 }
 //#endregion
-export { decodePermissionIntent as _, cloneTelemetryEvent as a, paymentPhase as b, identityErrorFromCapxul as c, devPrivateKeySigner as d, createOpenfortBrowserSigner as f, decodePayrollRunInput as g, openfortEmbeddedWalletPort as h, postHogObservability as i, bootstrapErrorFromCapxul as l, openfortEmbeddedSignerFromWallet as m, createCapxulClientWithSignerControls as n, cloneTelemetryProps as o, embeddedSigner as p, assembleCapxulClient as r, IdentityPortTag as s, createCapxulClient as t, deriveDevPrivateKey as u, toPayrollGroupId as v, requestPhase as x, inboxPhase as y };
+export { cloneTelemetryEvent as a, identityErrorFromCapxul as c, devPrivateKeySigner as d, createOpenfortBrowserSigner as f, decodePermissionIntent as g, openfortEmbeddedWalletPort as h, postHogObservability as i, bootstrapErrorFromCapxul as l, openfortEmbeddedSignerFromWallet as m, createCapxulClientWithSignerControls as n, cloneTelemetryProps as o, embeddedSigner as p, assembleCapxulClient as r, IdentityPortTag as s, createCapxulClient as t, deriveDevPrivateKey as u };