@capxul/sdk 4.20.0-beta.26 → 4.20.0-beta.28

package/dist/{access-BEMUjtyy.mjs → access-SP-ur4Ku.mjs}

@@ -1,4 +1,4 @@
-import { Cause, Clock, Context, Data, Deferred, Effect, Exit, Fiber, Layer, Option, Predicate, Queue, Ref, Result, Schema, SchemaGetter, SchemaParser } from "effect";
+import { Cause, Clock, Context, Data, Deferred, Effect, Exit, Fiber, Layer, Option, Predicate, Queue, Ref, Result, Schema, SchemaGetter, SchemaIssue, SchemaParser } from "effect";
 import { makeFunctionReference } from "convex/server";
 import { bytesToHex, concat, decodeErrorResult, encodeAbiParameters, encodeFunctionData, encodePacked, formatUnits, getContractAddress, hashTypedData, isAddress, isHex, keccak256, pad, padHex, parseAbiParameters, recoverAddress, recoverTypedDataAddress, toBytes, toFunctionSignature, toHex } from "viem";
 import { getUserOperationHash } from "viem/account-abstraction";
@@ -858,7 +858,7 @@ const FIELD_RULES = {
 	},
 	anonymousId: {
 		maxLength: 128,
-		pattern: /^anon_[A-Za-z0-9-]+$/u
+		pattern: /^(?:anon_[A-Za-z0-9-]+|[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})$/u
 	},
 	traceparent: {
 		maxLength: 55,
@@ -4823,10 +4823,19 @@ const ApprovalNetworkSchema = Schema.Struct({
 	name: Schema.String,
 	explorerUrl: Schema.String
 });
+/**
+* Whose money the operation moves: the person's own, or an Organization's,
+* which a reader follows through that Organization's scope.
+*/
+const ApprovalActorSchema = Schema.Union([Schema.Struct({ kind: Schema.Literal("personal") }), Schema.Struct({
+	kind: Schema.Literal("organization"),
+	orgId: Schema.NonEmptyString
+})]);
 /** What the person reads before they sign. */
 const ApprovalSummarySchema = Schema.Struct({
 	title: Schema.String,
 	from: Schema.Struct({
+		kind: Schema.Literals(["personal", "organization"]),
 		label: Schema.String,
 		address: AddressSchema$1
 	}),
@@ -4848,6 +4857,7 @@ const ApprovalSchema = Schema.Struct({
 	url: Schema.String,
 	kind: Schema.Literals(APPROVAL_KINDS),
 	state: Schema.Literals(APPROVAL_STATES),
+	actor: ApprovalActorSchema,
 	summary: ApprovalSummarySchema,
 	operation: ApprovalOperationSchema,
 	/** Who must sign: the owner key of the paying Safe. */
@@ -5515,6 +5525,28 @@ const probes = {
 	})
 };
 //#endregion
+//#region ../protocol/src/evm/role-dsl.ts
+const ORG_BUDGET_ACTIONS = [
+	"send",
+	"sendBatch",
+	"createCommitment"
+];
+/**
+* How a capped Budget's allowance refills (#2298). `monthly` refills the
+* allowance to its cap every 30 days. Roles v2 counts fixed periods from the
+* moment the allowance is set; it has no calendar month. Absent means `none`:
+* the cap is one pot that spending drains for good.
+*/
+const ORG_BUDGET_REFILLS = ["monthly", "none"];
+/** The fixed Roles v2 refill period of a `monthly` Budget: 30 days, in seconds. */
+const MONTHLY_REFILL_PERIOD_SECONDS = 30n * 24n * 60n * 60n;
+/** Derive the Zodiac substrate key for one durable Permission identity. */
+function roleKeyForPermission(permissionId) {
+	const normalized = permissionId.trim();
+	if (normalized.length === 0 || normalized !== permissionId) throw Errors.invalidInput("permissionId", "must be a non-empty canonical Permission ID");
+	return keccak256(toBytes(`permission ${permissionId}`));
+}
+//#endregion
 //#region ../protocol/src/permissions/permission-schema.ts
 /**
 * One stored `setAllowance` call inside a command's expected authority set.
@@ -5553,12 +5585,19 @@ const BudgetScopeSchema = Schema.Struct({
 	})]),
 	actions: Schema.NonEmptyArray(Schema.Literals(["pay", "commitments"]))
 }).pipe(Schema.refine((scope) => new Set(scope.actions).size === scope.actions.length && (scope.recipients.type === "anyone" || scope.recipients.accounts.length >= 1 && scope.recipients.accounts.length <= 32 && new Set(scope.recipients.accounts).size === scope.recipients.accounts.length), { message: "Budget scope requires unique actions and one to 32 unique allowed Accounts" }));
+/**
+* How a capped Budget refills (#2298): `monthly` tops the cap back up every 30
+* days (a fixed Roles v2 period, not a calendar month); `none` never refills.
+* Absent means `none`, and writers store only `monthly`.
+*/
+const BudgetRefillSchema = Schema.Literals(ORG_BUDGET_REFILLS);
 /** The accepted product policy stored with one Permission revision. */
 const CurrentPolicySchema = Schema.Union([Schema.Struct({
 	type: Schema.Literal("budget"),
 	asset: AssetIdSchema,
 	limit: Schema.NullOr(Schema.String),
-	scope: BudgetScopeSchema
+	scope: BudgetScopeSchema,
+	refill: Schema.optional(BudgetRefillSchema)
 }), Schema.Struct({ type: Schema.Literal("managePeople") })]);
 const BudgetIntentSchema = CurrentPolicySchema.pipe(Schema.refine((value) => {
 	if (value.type !== "budget") return false;
@@ -5623,7 +5662,8 @@ const ResolvedPermissionBudgetPolicySchema = Schema.Struct({
 		"send",
 		"sendBatch",
 		"createCommitment"
-	]))
+	])),
+	refill: Schema.optional(BudgetRefillSchema)
 });
 const PermissionRecipientBindingSchema = Schema.Struct({
 	accountId: AccountIdSchema$1,
@@ -5635,16 +5675,22 @@ const StoredPermissionIntentSchema = Schema.Union([Schema.Struct({
 	type: Schema.Literal("budget"),
 	asset: AssetIdSchema,
 	limit: Schema.NullOr(AssetAmountSchema),
-	scope: Schema.optional(BudgetScopeSchema)
+	scope: Schema.optional(BudgetScopeSchema),
+	refill: Schema.optional(BudgetRefillSchema)
 }).pipe(Schema.refine((intent) => intent.limit === null || intent.limit.asset === intent.asset, { message: "Budget limit must use the Budget asset" })), Schema.Struct({ type: Schema.Literal("managePeople") })]);
 /** Writes state every granted right and use a finite positive AssetAmount cap. */
 const PermissionIntentSchema = Schema.Union([Schema.Struct({
 	type: Schema.Literal("budget"),
 	asset: AssetIdSchema,
 	limit: AssetAmountSchema,
-	scope: BudgetScopeSchema
+	scope: BudgetScopeSchema,
+	refill: Schema.optional(BudgetRefillSchema)
 }).pipe(Schema.refine((intent) => intent.limit.asset === intent.asset && /[1-9]/u.test(intent.limit.value), { message: "Budget cap must be positive and use the Budget asset" })), Schema.Struct({ type: Schema.Literal("managePeople") })]);
-/** Decode once and give set-like scope fields one stable command representation. */
+/**
+* Decode once and give set-like scope fields one stable command representation.
+* An explicit `refill: "none"` is kept: on a change it turns a refill off,
+* where a missing `refill` keeps the Budget's current one (`keepRefillOnChange`).
+*/
 function decodePermissionIntent(input) {
 	const intent = Schema.decodeUnknownSync(PermissionIntentSchema, { onExcessProperty: "error" })(input);
 	if (intent.type === "managePeople") return intent;
@@ -5659,6 +5705,19 @@ function decodePermissionIntent(input) {
 		}
 	});
 }
+/**
+* A Budget change that leaves `refill` out keeps the Budget's current refill:
+* a change never turns a refill off by omission. An explicit `"none"` turns it
+* off. The backend plans, the SDK verifies and the CLI confirms the same
+* result. A create has no current refill, so a missing one means `none`.
+*/
+function keepRefillOnChange(intent, before) {
+	if (intent.type !== "budget" || intent.refill !== void 0 || before?.type !== "budget" || before.refill !== "monthly") return intent;
+	return {
+		...intent,
+		refill: before.refill
+	};
+}
 //#endregion
 //#region ../protocol/src/permissions/replacement-schema.ts
 const InvitationPhaseSchema = Schema.Literals([
@@ -5863,7 +5922,7 @@ const InviteGrantsSchema = Schema.Array(Schema.Union([
 	Schema.Struct({
 		type: Schema.Literal("new_budget"),
 		label: Schema.String.pipe(Schema.refine((value) => value.trim().length >= 1 && value.trim().length <= 128)),
-		intent: BudgetIntentSchema
+		intent: BudgetIntentSchema.pipe(Schema.refine((intent) => intent.refill !== "monthly", { message: "An invitation's new Budget cannot refill; change it once granted" }))
 	})
 ])).pipe(Schema.refine((grants) => {
 	if (grants.length < 1 || grants.length > 16) return false;
@@ -8954,7 +9013,9 @@ const PEOPLE_OPERATIONS = {
 			emitSafeConfirmed: "accounts.safes.emitSafeConfirmed",
 			readSafe: "accounts.safes.readSafe",
 			recordDeployment: "accounts.safes.recordDeployment"
-		}
+		},
+		/** The home's requests to pay and Payments to retry, read in one query. */
+		summaries: { loadNeedsYou: "accounts.summaries.loadNeedsYou" }
 	},
 	/** The host observer's names for `client.approvals.*`. */
 	approvals: {
@@ -9135,7 +9196,11 @@ const ORGANIZATION_OPERATIONS = {
 			seedNativeReadiness: "operator.fixtures.seedNativeReadiness",
 			seedPrerequisites: "operator.fixtures.seedPrerequisites"
 		},
-		identities: { purgeByEmail: "operator.identities.purgeByEmail" }
+		identities: {
+			purgeByEmail: "operator.identities.purgeByEmail",
+			/** One Account and every row that refers to it, unless it has Payments or an Organization tie. */
+			purgeAccount: "operator.identities.purgeAccount"
+		}
 	},
 	/** Organizations' internal functions; its public rows join from `OPERATIONS`. */
 	organizations: {
@@ -9209,7 +9274,9 @@ emitSaved: "activity.annotations.emitSaved" },
 		pay: "organizationPayments.pay",
 		payBatch: "organizationPayments.payBatch",
 		prepareExecution: "organizationPayments.prepareExecution",
-		retry: "organizationPayments.retry"
+		retry: "organizationPayments.retry",
+		cancel: "organizationPayments.cancel",
+		redirect: "organizationPayments.redirect"
 	},
 	/**
 	* Payments' internal functions and the client's own method names; its public
@@ -9231,7 +9298,9 @@ emitSaved: "activity.annotations.emitSaved" },
 			loadContext: "payments.commands.loadContext",
 			loadExecutionContext: "payments.commands.loadExecutionContext",
 			/** The capped Budget a prepared Organization command spends from, before its allowance is read on chain. */
-			loadBudgetAllowance: "payments.commands.loadBudgetAllowance"
+			loadBudgetAllowance: "payments.commands.loadBudgetAllowance",
+			/** What a new Payment command would spend and from which Safe, read before it is born. */
+			loadBirthFunding: "payments.commands.loadBirthFunding"
 		},
 		lifecycles: { prepareIntent: "payments.lifecycles.prepareIntent" },
 		/** The stored UserOperation of every money command: Payment, Permission and configuration. */
@@ -9385,7 +9454,11 @@ const PLATFORM_OPERATIONS = {
 			recordUse: "applications.bootstraps.recordUse",
 			resolve: "applications.bootstraps.resolve"
 		},
-		keys: { issue: "applications.keys.issue" },
+		keys: {
+			issue: "applications.keys.issue",
+			/** Operator-only: revoke one key by its id, whoever owns it. */
+			revokeById: "applications.keys.revokeById"
+		},
 		quickstarts: {
 			claim: "applications.quickstarts.claim",
 			mint: "applications.quickstarts.mint"
@@ -9586,6 +9659,13 @@ const OptionalReasonCode = Schema.optional(Schema.Literals(CAPXUL_ERROR_CODES));
 * no catalog schema validates it.
 */
 const EXCEPTION_EVENT_NAME = "$exception";
+/**
+* The SDK's twin of `capxul_backend_expected_outcome`: an expected outcome the
+* SDK's failure projection captures through the host's PostHog client. Like
+* the backend's, its properties are the error evidence, so no catalog schema
+* validates it.
+*/
+const SDK_EXPECTED_OUTCOME_EVENT_NAME = "capxul_sdk_expected_outcome";
 const PII = Schema.String.pipe(Schema.brand("PII"));
 /**
 * The canonical envelope (ADR-0020 A4): snake_case ONLY. `capxul_env` and
@@ -9685,6 +9765,42 @@ const UiStepProps = {
 	organization_id: OptionalOrgId,
 	reason_code: OptionalReasonCode
 };
+/**
+* A journey's variants (`JOURNEYS`): the way a person came into a journey, or
+* the way they took through it. A variant is a property of the journey's step
+* events, never a journey of its own, so each journey funnel breaks down by
+* it. A step event takes only the variants that a journey contract names on
+* it, picked one by one; the analytics plan test checks both directions.
+* `pay_path` and `funding_source` have no carrier until their Phase 2 events.
+* `payment_*` events already carry `recipient_is_capxul_account`, and
+* `invoice_issued` carries `issuer_scope_kind`; neither is repeated here.
+*/
+const JourneyVariantProps = {
+	/** How a person came to Get started: by themselves, an invite, money that waited, or an invoice. */
+	entry_path: Schema.optional(Schema.Literals([
+		"signup",
+		"invite",
+		"claim",
+		"invoice"
+	])),
+	/** Where the person acted. `agent` is an AI agent driving the CLI. */
+	surface: Schema.optional(Schema.Literals([
+		"web",
+		"cli",
+		"agent"
+	])),
+	/** Who pays: a person from their own account, or an Organization from a Budget. */
+	payer_kind: Schema.optional(Schema.Literals(["person", "organization"])),
+	/** How a request was paid: from the payer's inbox, or by its link at checkout. */
+	pay_path: Schema.optional(Schema.Literals(["inbox", "link"])),
+	/** Where an account's first money came from. `bank` is the planned on-ramp. */
+	funding_source: Schema.optional(Schema.Literals([
+		"deposit",
+		"payment",
+		"claim",
+		"bank"
+	]))
+};
 //#endregion
 //#region ../observability/src/events/money.ts
 /**
@@ -9774,6 +9890,8 @@ const PaymentInitiatedProps = Schema.Struct({
 	execution_id: OptionalString,
 	payment_lifecycle_id: OptionalString,
 	...TelemetryEnvelopeProps,
+	payer_kind: JourneyVariantProps.payer_kind,
+	surface: JourneyVariantProps.surface,
 	...RecipientTelemetryProps,
 	kind: Schema.String,
 	payment_id: Schema.String
@@ -9789,6 +9907,8 @@ const PaymentLifecycleProps = {
 const PaymentSettledL2Props = Schema.Struct({
 	...PaymentLifecycleProps,
 	...TelemetryEnvelopeProps,
+	payer_kind: JourneyVariantProps.payer_kind,
+	surface: JourneyVariantProps.surface,
 	...RecipientTelemetryProps,
 	kind: Schema.String,
 	chain_id: Schema.Finite,
@@ -9996,6 +10116,7 @@ const OrganizationCreationStartedProps = Schema.Struct({
 });
 const OrganizationCreationReadyProps = Schema.Struct({
 	...TelemetryEnvelopeProps,
+	surface: JourneyVariantProps.surface,
 	$insert_id: Schema.String,
 	organization_id: OrgIdTelemetrySchema,
 	attempt_number: AttemptNumberSchema,
@@ -10020,45 +10141,6 @@ const OrganizationCreationFailedProps = Schema.Struct({
 		...ORGANIZATION_SETUP_REASONS
 	]))
 });
-const OrgCreateStartedProps = Schema.Struct({
-	...TelemetryEnvelopeProps,
-	org_id: OptionalOrgId,
-	email_domain: OptionalString,
-	template: OptionalString
-});
-const OrgSafeCreatedProps = Schema.Struct({
-	...TelemetryEnvelopeProps,
-	org_id: OptionalOrgId,
-	chainId: OptionalChainId,
-	safe_address: OptionalAddress
-});
-const OrgSafeConfirmedProps = Schema.Struct({
-	...TelemetryEnvelopeProps,
-	org_id: OptionalOrgId,
-	chainId: OptionalChainId,
-	safe_address: OptionalAddress,
-	durationMs: OptionalDurationMs
-});
-const OrgRolesSeededProps = Schema.Struct({
-	...TelemetryEnvelopeProps,
-	org_id: OptionalOrgId,
-	chainId: OptionalChainId,
-	role: OptionalString,
-	txHash: OptionalTxHash
-});
-const OrgCreatedProps = Schema.Struct({
-	...TelemetryEnvelopeProps,
-	org_id: OptionalOrgId,
-	chainId: OptionalChainId,
-	safe_address: OptionalAddress,
-	durationMs: OptionalDurationMs
-});
-const OrgCreateFailedProps = Schema.Struct({
-	...TelemetryEnvelopeProps,
-	...ChainCauseTelemetryProps,
-	org_id: OptionalOrgId,
-	reason: OptionalString
-});
 const OrgInviteSentProps = Schema.Struct({
 	...TelemetryEnvelopeProps,
 	org_id: OptionalOrgId,
@@ -10103,30 +10185,6 @@ Schema.Struct({
 	name: Schema.Literal("organization_creation_failed"),
 	props: OrganizationCreationFailedProps
 });
-Schema.Struct({
-	name: Schema.Literal("org_create_started"),
-	props: OrgCreateStartedProps
-});
-Schema.Struct({
-	name: Schema.Literal("org_safe_created"),
-	props: OrgSafeCreatedProps
-});
-Schema.Struct({
-	name: Schema.Literal("org_safe_confirmed"),
-	props: OrgSafeConfirmedProps
-});
-Schema.Struct({
-	name: Schema.Literal("org_roles_seeded"),
-	props: OrgRolesSeededProps
-});
-Schema.Struct({
-	name: Schema.Literal("org_created"),
-	props: OrgCreatedProps
-});
-Schema.Struct({
-	name: Schema.Literal("org_create_failed"),
-	props: OrgCreateFailedProps
-});
 Schema.Struct({
 	name: Schema.Literal("org_invite_sent"),
 	props: OrgInviteSentProps
@@ -11000,10 +11058,14 @@ const BootstrapFailedProps = Schema.Struct({
 });
 const MemberActivationStartedProps = Schema.Struct({
 	...TelemetryEnvelopeProps,
+	entry_path: JourneyVariantProps.entry_path,
+	surface: JourneyVariantProps.surface,
 	$insert_id: Schema.String
 });
 const MemberActivationReadyProps = Schema.Struct({
 	...TelemetryEnvelopeProps,
+	entry_path: JourneyVariantProps.entry_path,
+	surface: JourneyVariantProps.surface,
 	$insert_id: Schema.String,
 	duration_ms: DurationMsSchema
 });
@@ -12549,7 +12611,7 @@ function mapAccountLifecycle(input) {
 }
 //#endregion
 //#region package.json
-var version = "4.20.0-beta.26";
+var version = "4.20.0-beta.28";
 //#endregion
 //#region src/observability/telemetry/exception-projection.ts
 /** Fixed fallback for failures that have no safe message. */
@@ -12987,7 +13049,7 @@ const REVERT_SELECTOR_RE = /^0x(?:[0-9a-fA-F]{8})?$/u;
 //#region src/observability/posthog-failure.ts
 /** The expected-outcome codes, read as plain strings so a free-form kind can be looked up. */
 /** Stable PostHog event used for typed failures that are expected product outcomes. */
-const CAPXUL_SDK_EXPECTED_OUTCOME_EVENT = "capxul_sdk_expected_outcome";
+const CAPXUL_SDK_EXPECTED_OUTCOME_EVENT = SDK_EXPECTED_OUTCOME_EVENT_NAME;
 /**
 * Adapt the host's already-initialized PostHog-like client. This function does
 * not import, initialize, configure, or own PostHog.
@@ -15670,6 +15732,12 @@ function paymentsV2Signature(name) {
 const SEND_SIGNATURE = paymentsV2Signature("send");
 const SEND_BATCH_SIGNATURE = paymentsV2Signature("sendBatch");
 const CREATE_COMMITMENT_SIGNATURE = paymentsV2Signature("createCommitment");
+/**
+* #2299 ruling C: only an Owner cancels or redirects an Organization-funded
+* commitment, so these two sit in the Owner role's scope, never a Budget's.
+* The contract admits only the commitment's creator, the Organization Safe.
+*/
+const OWNER_COMMITMENT_SIGNATURES = [paymentsV2Signature("cancel"), paymentsV2Signature("redirect")];
 //#endregion
 //#region ../protocol/src/evm/organization-payments.ts
 /** Zodiac ModuleProxyFactory on Base Sepolia. */
@@ -15906,24 +15974,18 @@ function encodePreparedPaymentCallData(command) {
 		}));
 	}
 	const [item] = command.items;
-	if (command.executionRoute.kind !== "direct" || command.items.length !== 1 || item === void 0 || isBirth(item)) throw Errors.invalidInput("items", "Commitment lifecycle requires one direct execution");
-	return safe4337ExecuteUserOpCallData({
+	const route = command.executionRoute;
+	if (command.items.length !== 1 || item === void 0 || isBirth(item) || route.kind !== "direct" && item.operation === "claim_commitment") throw Errors.invalidInput("items", "Commitment lifecycle requires one lone execution");
+	const call = {
 		to: command.contractAddress,
+		value: 0n,
 		data: lifecycleData(item)
-	});
-}
-//#endregion
-//#region ../protocol/src/evm/role-dsl.ts
-const ORG_BUDGET_ACTIONS = [
-	"send",
-	"sendBatch",
-	"createCommitment"
-];
-/** Derive the Zodiac substrate key for one durable Permission identity. */
-function roleKeyForPermission(permissionId) {
-	const normalized = permissionId.trim();
-	if (normalized.length === 0 || normalized !== permissionId) throw Errors.invalidInput("permissionId", "must be a non-empty canonical Permission ID");
-	return keccak256(toBytes(`permission ${permissionId}`));
+	};
+	return route.kind === "direct" ? safe4337ExecuteUserOpCallData(call) : buildOrgRoleSpendPersonalCallData(buildOrgRoleMultiCall({
+		rolesModuleAddress: route.rolesModule,
+		roleKey: route.roleKey,
+		calls: [call]
+	}));
 }
 //#endregion
 //#region src/payments/operation-verification.ts
@@ -15952,6 +16014,16 @@ function moneySafeOpDigest(operation, chainId) {
 		userOp: safe4337UserOperation(operation)
 	});
 }
+/**
+* An Organization-funded cancel or redirect runs through the Owner role
+* (#2299), which no Budget names. Its role key cannot widen what the signer
+* may do: the Roles module admits only a role the signer's Safe holds, and the
+* contract admits only the commitment's creator.
+*/
+function isOwnerLifecycle(command) {
+	const [item] = command.items;
+	return command.items.length === 1 && (item?.operation === "cancel_commitment" || item?.operation === "redirect_commitment");
+}
 /** Verify every actual Money signing target against configured trust anchors. */
 function verifiesMoneyOperation(evidence, expectedSafe, chainId, permissionId) {
 	try {
@@ -15962,7 +16034,7 @@ function verifiesMoneyOperation(evidence, expectedSafe, chainId, permissionId) {
 		const route = command.executionRoute;
 		if (route.kind === "direct") {
 			if (permissionId !== void 0 || command.senderSafe.toLowerCase() !== expectedSafe.toLowerCase()) return false;
-		} else if (permissionId === void 0 || route.roleKey.toLowerCase() !== roleKeyForPermission(permissionId).toLowerCase() || command.senderSafe.toLowerCase() !== route.organizationSafe.toLowerCase()) return false;
+		} else if ((permissionId === void 0 ? !isOwnerLifecycle(command) : route.roleKey.toLowerCase() !== roleKeyForPermission(permissionId).toLowerCase()) || command.senderSafe.toLowerCase() !== route.organizationSafe.toLowerCase()) return false;
 		if (operation.callData.toLowerCase() !== encodePreparedPaymentCallData(command).toLowerCase()) return false;
 		const digest = moneySafeOpDigest(operation, chainId);
 		return evidence.digest.toLowerCase() === digest.toLowerCase() && evidence.executionId === `money_execution_${digest.slice(2).toLowerCase()}`;
@@ -16750,6 +16822,15 @@ function subscribeFreshQuery(deps, args, listener, operation, projection, option
 }
 //#endregion
 //#region src/payments/lifecycle-execution.ts
+/**
+* The prepared command is this lifecycle intent; a retry also names the
+* original birth command of the scope it was asked for. A claim, and an
+* Account's own cancel or redirect, runs directly from the signer's Safe; an
+* Organization's cancel or redirect runs through its Owner role (#2299).
+*/
+const lifecycleCommandCheck = (intent, expectedOrganizationId) => async (request, evidence) => await matchesIntent(intent)(request, evidence) && (intent.kind === "retry" ? expectedOrganizationId === void 0 ? evidence.sourceCommand?.kind === "birth" && evidence.sourceCommand.actor.kind === "account" : evidence.sourceCommand?.kind === "birth" && evidence.sourceCommand.actor.kind === "organization" && evidence.sourceCommand.actor.orgId === expectedOrganizationId : evidence.preparedCommand?.executionRoute.kind === (intent.kind === "claim" || expectedOrganizationId === void 0 ? "direct" : "zodiac_role"));
+/** The prepared command pays exactly the request the payer confirmed. */
+const requestPaymentCheck = (confirmation) => async (request) => "kind" in request && request.kind === "payment_request" && canonicalJson(request.confirmation) === canonicalJson(confirmation);
 function executePaymentLifecycle(deps, intent, signal, controls, expectedOrganizationId, onPrepared) {
 	return executePrepared(deps, (signerAddress) => runIfActive(signal, CAPXUL_OPERATIONS.payments.prepareLifecycleExecution, () => withInvocationParentSpan(Effect.suspend(() => callOperation(deps.convexCall, lifecycles.prepareScoped, copyInvocationObservation(controls, {
 		signerAddress,
@@ -16758,13 +16839,13 @@ function executePaymentLifecycle(deps, intent, signal, controls, expectedOrganiz
 			kind: "organization",
 			orgId: expectedOrganizationId
 		}
-	})).pipe(Effect.mapError((publicError) => ({ publicError })))), controls), deps.runPromise), async (request, evidence) => await matchesIntent(intent)(request, evidence) && (intent.kind !== "retry" || (expectedOrganizationId === void 0 ? evidence.sourceCommand?.kind === "birth" && evidence.sourceCommand.actor.kind === "account" : evidence.sourceCommand?.kind === "birth" && evidence.sourceCommand.actor.kind === "organization" && evidence.sourceCommand.actor.orgId === expectedOrganizationId)), false, void 0, signal, controls, onPrepared);
+	})).pipe(Effect.mapError((publicError) => ({ publicError })))), controls), deps.runPromise), lifecycleCommandCheck(intent, expectedOrganizationId), false, void 0, signal, controls, onPrepared);
 }
 function executeRequestPayment(deps, confirmation, controls, onPrepared) {
 	return executePrepared(deps, (signerAddress) => runIfActive(controls?.signal, commands$1.prepareRequest.name, () => withInvocationParentSpan(Effect.suspend(() => callOperation(deps.convexCall, commands$1.prepareRequest, copyInvocationObservation(controls, {
 		confirmation,
 		signerAddress
-	})).pipe(Effect.mapError((publicError) => ({ publicError })))), controls), deps.runPromise), async (request) => "kind" in request && request.kind === "payment_request" && canonicalJson(request.confirmation) === canonicalJson(confirmation), false, void 0, controls?.signal, controls, onPrepared);
+	})).pipe(Effect.mapError((publicError) => ({ publicError })))), controls), deps.runPromise), requestPaymentCheck(confirmation), false, void 0, controls?.signal, controls, onPrepared);
 }
 function executeOrganizationPayment(deps, input, signal, onPreparedClosed, controls, onPrepared) {
 	return executePrepared(deps, (signerAddress) => runIfActive(signal, CAPXUL_OPERATIONS.organizationPayments.prepareExecution, () => withInvocationParentSpan(Effect.suspend(() => callOperation(deps.convexCall, commands$1.prepareOrganization, copyInvocationObservation(controls, {
@@ -17668,17 +17749,21 @@ function paymentExecutionIntent(input) {
 	const to = normalizeTargetForBackend(input.to, "to");
 	if (!to.ok) return to;
 	try {
-		return {
+		const decoded = Schema.decodeResult(PaymentExecutionIntentSchema, { onExcessProperty: "error" })({
+			to: to.value,
+			amount: input.amount,
+			...input.externalAddressAcknowledged === void 0 ? {} : { externalAddressAcknowledged: input.externalAddressAcknowledged },
+			...input.paymentType === void 0 ? {} : { paymentType: input.paymentType },
+			...input.document === void 0 ? {} : { document: input.document },
+			...input.supportingReceipts === void 0 ? {} : { supportingReceipts: input.supportingReceipts },
+			...input.timing === void 0 ? {} : { timing: input.timing }
+		});
+		return Result.isSuccess(decoded) ? {
 			ok: true,
-			value: Schema.decodeSync(PaymentExecutionIntentSchema, { onExcessProperty: "error" })({
-				to: to.value,
-				amount: input.amount,
-				...input.externalAddressAcknowledged === void 0 ? {} : { externalAddressAcknowledged: input.externalAddressAcknowledged },
-				...input.paymentType === void 0 ? {} : { paymentType: input.paymentType },
-				...input.document === void 0 ? {} : { document: input.document },
-				...input.supportingReceipts === void 0 ? {} : { supportingReceipts: input.supportingReceipts },
-				...input.timing === void 0 ? {} : { timing: input.timing }
-			})
+			value: decoded.success
+		} : {
+			ok: false,
+			error: invalidPaymentField(decoded.failure.issue)
 		};
 	} catch {
 		return {
@@ -17687,6 +17772,13 @@ function paymentExecutionIntent(input) {
 		};
 	}
 }
+const formatIssue = SchemaIssue.makeFormatterStandardSchemaV1();
+/** The first failing field and why, e.g. `amount.value`, as the backend's row decode names it (#2381). */
+function invalidPaymentField(issue) {
+	const first = formatIssue(issue).issues[0];
+	const field = first?.path?.map((segment) => String(typeof segment === "object" ? segment.key : segment)).join(".");
+	return Errors.invalidInput(field === void 0 || field.length === 0 ? "payment" : field, first?.message ?? "invalid personal payment input");
+}
 function normalizePaymentTiming(payment) {
 	const { release: _release, ...rest } = payment;
 	return {
@@ -18366,7 +18458,7 @@ function makeOrganizationPaymentReadMethods(deps, orgId) {
 }
 //#endregion
 //#region src/payments/organization-flights.ts
-function executionDependencies(input) {
+function executionDependencies$1(input) {
 	return input.actor === void 0 || input.chainId === void 0 || input.signer === void 0 ? null : {
 		actor: input.actor,
 		chainId: input.chainId,
@@ -18387,7 +18479,7 @@ async function executeOrganizationBatch(scope, input, signal, operation, control
 	};
 	const intent = organizationPaymentIntent(scope.orgId, input);
 	if (!intent.ok) return intent;
-	const execution = executionDependencies(scope.deps);
+	const execution = executionDependencies$1(scope.deps);
 	if (execution === null) return {
 		ok: false,
 		error: Errors.notImplemented("organizationPayments", "executionComposition")
@@ -18503,6 +18595,27 @@ function makeOrganizationPaymentsMethods(deps, orgId) {
 		flights: /* @__PURE__ */ new Map()
 	};
 	const execute = (input, signal, operation = "organization-pay-batch", controls, onPrepared) => executeOrganizationBatch(scope, input, signal, operation, controls, onPrepared);
+	/** One Owner-signed cancel or redirect, answering the one Payment it acted on (#2299). */
+	const ownerLifecycle = (intent, controls, operation) => runCapxulEffect(Effect.gen(function* () {
+		const captured = carryInvocationParentSpan(controls, yield* Effect.currentSpan.pipe(Effect.orDie));
+		return yield* awaitCapxulResult(async () => {
+			const execution = executionDependencies$1(deps);
+			if (execution === null) return {
+				ok: false,
+				error: Errors.notImplemented("organizationPayments", "executionComposition")
+			};
+			const result = await executePaymentLifecycle(execution, intent, controls?.signal, captured, orgId);
+			if (!result.ok) return result;
+			const [payment, ...rest] = result.value.payments;
+			return payment === void 0 || rest.length !== 0 ? {
+				ok: false,
+				error: Errors.unknown()
+			} : {
+				ok: true,
+				value: normalizePaymentTiming(payment)
+			};
+		});
+	}), observationOnlyControls(controls), operation, deps.runPromise);
 	return {
 		...makeOrganizationPaymentReadMethods(deps, orgId),
 		retry: (paymentId, options) => {
@@ -18511,7 +18624,7 @@ function makeOrganizationPaymentsMethods(deps, orgId) {
 				const parent = yield* Effect.currentSpan.pipe(Effect.orDie);
 				const captured = carryInvocationParentSpan(controls, parent);
 				return yield* awaitCapxulResult(async () => {
-					const execution = executionDependencies(deps);
+					const execution = executionDependencies$1(deps);
 					if (execution === null) return {
 						ok: false,
 						error: Errors.notImplemented("organizationPayments", "executionComposition")
@@ -18561,6 +18674,19 @@ function makeOrganizationPaymentsMethods(deps, orgId) {
 				});
 			}), observationOnlyControls(controls), CAPXUL_OPERATIONS.organizationPayments.pay, deps.runPromise);
 		},
+		cancel: (paymentId, options) => ownerLifecycle({
+			kind: "cancel",
+			paymentId
+		}, deps.invocationControls?.(options) ?? options, CAPXUL_OPERATIONS.organizationPayments.cancel),
+		redirect: (input, options) => {
+			const controls = deps.invocationControls?.(options) ?? options;
+			const recipient = normalizeTargetForBackend(input.to, "to");
+			return recipient.ok ? ownerLifecycle({
+				kind: "redirect",
+				paymentId: input.paymentId,
+				recipient: recipient.value
+			}, controls, CAPXUL_OPERATIONS.organizationPayments.redirect) : runCapxulEffect(Effect.fail(recipient.error), observationOnlyControls(controls), CAPXUL_OPERATIONS.organizationPayments.redirect, deps.runPromise);
+		},
 		payBatch: (input, options) => {
 			const controls = deps.invocationControls?.(options) ?? options;
 			return runCapxulEffect(Effect.gen(function* () {
@@ -19275,6 +19401,524 @@ function sleep(ms, signal) {
 	});
 }
 //#endregion
+//#region ../protocol/src/payroll/model.ts
+function toPayrollRunId(raw) {
+	return toNonEmptyStringBrand(raw, "payrollRunId", (value) => isNonEmptyString(value));
+}
+function toPayrollGroupId(raw) {
+	return toNonEmptyStringBrand(raw, "payrollGroupId", (value) => isNonEmptyString(value));
+}
+//#endregion
+//#region src/payroll/run-checks.ts
+/** Match the caller's compensation to the committed V3 Payslip. */
+function payslipIdentityMatches(message, item, index, runId, period) {
+	return message.runId === runId && message.itemIndex === index && message.employeeRef === item.partyId && message.periodStart === period.start && message.periodEnd === period.end && message.adjustmentsHash === hashAdjustmentsV3(item.adjustments);
+}
+function payslipAmountMatches(message, item) {
+	const exact = toExactAssetAmount(item.amount, CONFIGURED_MONEY_ASSETS);
+	return message.gross.asset === exact.asset && message.gross.minorUnits === item.gross && message.gross.decimals === exact.decimals && message.net.asset === exact.asset && message.net.minorUnits === item.net && message.net.decimals === exact.decimals;
+}
+function isRunItem(prepared, item, evidence, index, runId, period) {
+	if (prepared === void 0) return false;
+	const bundle = evidence.preparedCommand?.documentBundles?.[index];
+	const preparedItem = evidence.preparedCommand?.items[index];
+	const payslip = bundle?.envelope;
+	if (bundle === void 0 || payslip?.primaryType !== "Payslip") return false;
+	return canonicalJson(prepared.to) === canonicalJson(item.to) && prepared.paymentType === "payroll" && canonicalJson(prepared.amount) === canonicalJson(item.amount) && bundle.adjustments !== void 0 && canonicalJson(bundle.adjustments) === canonicalJson(item.adjustments) && payslipIdentityMatches(payslip.message, item, index, runId, period) && payslipAmountMatches(payslip.message, item) && (preparedItem?.operation === "send" || preparedItem?.operation === "create_commitment") && preparedItem.documentHash === evidence.preparedCommand?.instructionDocuments?.[index]?.documentHash;
+}
+/**
+* The batch the backend derived from a payroll intent must be the batch this
+* caller asked for, checked before the digest is signed.
+*
+* The payslip envelope on each item is server-built and carries the run row's
+* own `issuedAt`, so the batch cannot be fingerprinted against a local copy
+* (`matchesIntent` is unavailable here). What CAN be verified is every field
+* the caller supplied — the org, the Budget, the request key, and per item the
+* recipient, the amount and the payslip figures — plus the lineage binding the
+* batch to the run just written. A prepared command that pays a different
+* person, a different amount, from a different Budget, or under a different
+* run never reaches the signer.
+*/
+function isRunBatch(input) {
+	return (batch, evidence) => Promise.resolve(!("kind" in batch) && batch.orgId === input.orgId && batch.permissionId === input.permissionId && batch.requestKey === input.requestKey && batch.lineage?.kind === "payroll" && batch.lineage.runId === input.runId && batch.items.length === input.items.length && batch.items.every((item) => item.amount.asset === input.asset) && input.items.every((item, index) => isRunItem(batch.items[index], item, evidence, index, input.runId, input.period)));
+}
+/**
+* The batch is `isRunBatch` for the run the backend just wrote, and that run
+* is the period the caller asked for: the payslip's `period` is a
+* server-formatted label, so the stored run is where the caller's own two
+* numbers are checkable.
+*/
+function isAuthorizedRunBatch(input, run) {
+	return (request, evidence) => run === void 0 || run.periodStart !== input.period.start || run.periodEnd !== input.period.end ? Promise.resolve(false) : isRunBatch({
+		...input,
+		runId: run.id
+	})(request, evidence);
+}
+/** A decoded detail is the run asked for, whole: its scope, membership and quantities agree. */
+function checkPayrollRunDetail(value, orgId, runId) {
+	if (value === null) return {
+		ok: true,
+		value: null
+	};
+	if (value.orgId !== orgId || value.run.id !== runId || value.items.length === 0 || value.items.length !== value.run.recipientCount || new Set(value.items.map((item) => item.payment.id)).size !== value.items.length || value.items.some((item, index) => item.itemIndex !== index || item.amount.asset !== value.run.total.asset || item.payment.amount.asset !== item.amount.asset || item.payment.paymentType !== "payroll")) return {
+		ok: false,
+		error: Errors.invalidInput("run", "Payroll run scope or membership does not match")
+	};
+	try {
+		const total = toExactAssetAmount(value.run.total, CONFIGURED_MONEY_ASSETS);
+		let rawTotal = 0n;
+		for (const item of value.items) {
+			const amount = toExactAssetAmount(item.amount, CONFIGURED_MONEY_ASSETS);
+			const payment = toExactAssetAmount(item.payment.amount, CONFIGURED_MONEY_ASSETS);
+			if (amount.minorUnits !== payment.minorUnits) return {
+				ok: false,
+				error: Errors.invalidInput("run", "Payroll item quantity does not match its Payment")
+			};
+			rawTotal += BigInt(amount.minorUnits);
+		}
+		if (rawTotal !== BigInt(total.minorUnits)) return {
+			ok: false,
+			error: Errors.invalidInput("run", "Payroll run total does not match its items")
+		};
+	} catch {
+		return {
+			ok: false,
+			error: Errors.invalidInput("run", "Payroll run quantities are invalid")
+		};
+	}
+	return {
+		ok: true,
+		value
+	};
+}
+//#endregion
+//#region src/payroll/run-decoding.ts
+function toPayrollRun(wire) {
+	return {
+		id: toPayrollRunId(wire.id),
+		status: wire.status,
+		periodStart: wire.periodStart,
+		periodEnd: wire.periodEnd,
+		total: wire.total,
+		recipientCount: wire.recipientCount
+	};
+}
+function toPayrollRuns(wire) {
+	return {
+		...mapPage(wire, toPayrollRun),
+		settledThisMonth: wire.settledThisMonth
+	};
+}
+function toPayrollGroup(wire) {
+	return {
+		id: toPayrollGroupId(wire.id),
+		name: wire.name,
+		tone: wire.tone,
+		members: wire.members.map((member) => ({
+			partyId: member.partyId,
+			amount: member.amount,
+			currency: member.currency
+		}))
+	};
+}
+function validateRunItems(input) {
+	for (const [index, item] of input.items.entries()) {
+		if (Schema.decodeResult(PayrollRunItemInputSchema, { onExcessProperty: "error" })(item)._tag === "Failure") return Errors.invalidInput(`items.${index}`, "invalid Payroll item");
+		try {
+			const exact = toExactAssetAmount(item.amount, CONFIGURED_MONEY_ASSETS);
+			const net = BigInt(item.net);
+			const gross = BigInt(item.gross);
+			const adjustments = item.adjustments.reduce((sum, row) => sum + BigInt(row.amount), 0n);
+			if (item.amount.asset !== input.asset || item.net !== exact.minorUnits || gross + adjustments !== net) return Errors.invalidInput(`items.${index}`, "invalid Payroll units");
+		} catch {
+			return Errors.invalidInput(`items.${index}`, "invalid Payroll units");
+		}
+	}
+	return null;
+}
+const RunInputSchema = Schema.Struct({
+	permissionId: AuthorizePayrollRunExecutionInputSchema.fields.permissionId,
+	asset: AuthorizePayrollRunExecutionInputSchema.fields.asset,
+	period: AuthorizePayrollRunExecutionInputSchema.fields.period,
+	items: AuthorizePayrollRunExecutionInputSchema.fields.items,
+	requestKey: Schema.optional(AuthorizePayrollRunExecutionInputSchema.fields.requestKey)
+});
+/** Decode caller input before session or signer work. Keep routing outside the input. */
+function decodePayrollRunInput(value) {
+	try {
+		const decoded = Schema.decodeUnknownSync(RunInputSchema, { onExcessProperty: "error" })(value);
+		const input = {
+			permissionId: decoded.permissionId,
+			asset: decoded.asset,
+			period: decoded.period,
+			...decoded.requestKey === void 0 ? {} : { requestKey: decoded.requestKey },
+			items: decoded.items.map((item) => ({
+				amount: item.amount,
+				gross: item.gross,
+				net: item.net,
+				adjustments: item.adjustments,
+				partyId: toPartyId(item.partyId),
+				to: item.to.kind === "party" ? {
+					kind: "party",
+					partyId: toPartyId(item.to.partyId)
+				} : item.to.kind === "address" ? {
+					kind: "address",
+					address: toAddress(item.to.address)
+				} : item.to
+			}))
+		};
+		if (input.items.length === 0 || input.period.start > input.period.end) throw Errors.invalidInput("input", "Payroll requires items and an ordered period");
+		const error = validateRunItems(input);
+		if (error !== null) throw error;
+		return input;
+	} catch (cause) {
+		throw cause instanceof CapxulError ? cause : Errors.invalidInput("input", "Invalid Payroll input");
+	}
+}
+/** Read only the exact backend prepare receipt, never an arbitrary signer failure. */
+function payrollResolution(error, requestKey) {
+	const details = error.details;
+	if (error.code !== "WRONG_STATE" || details?.method !== runs.authorize.name || details.requestKey !== requestKey || typeof details.commandId !== "string" || typeof details.runId !== "string") return void 0;
+	return details.payrollResolution === "failed" || details.payrollResolution === "settled" ? details.payrollResolution : void 0;
+}
+function validatePayrollRunLookup(orgId, runId) {
+	return !Schema.is(PayrollRunIdSchema)(runId) || orgId.length === 0 ? {
+		ok: false,
+		error: Errors.invalidInput("runId", "Organization and run ID must be valid")
+	} : {
+		ok: true,
+		value: void 0
+	};
+}
+/** Strict saved detail decoder shared by the read and fresh stream. */
+function decodePayrollRunDetail(raw, orgId, runId) {
+	const decoded = Schema.decodeUnknownResult(Schema.NullOr(PayrollRunDetailSchema), { onExcessProperty: "error" })(raw);
+	if (decoded._tag === "Failure") return {
+		ok: false,
+		error: Errors.invalidInput("run", "Invalid Payroll run detail")
+	};
+	return checkPayrollRunDetail(decoded.success, orgId, runId);
+}
+//#endregion
+//#region src/payroll/run-subscription.ts
+function detailValue(result) {
+	if (!result.ok) throw result.error;
+	return result.value;
+}
+function subscribePayrollRun(deps, orgId, runId, listener, options) {
+	const operation = CAPXUL_OPERATIONS.org.payroll.subscribeRun;
+	const valid = deps.validate(orgId, runId);
+	if (!valid.ok) return runCapxulEffect(Effect.fail(valid.error), observationOnlyControls(deps.invocationControls?.(options) ?? options), operation, deps.runPromise);
+	const decode = (raw) => detailValue(deps.decode(raw, orgId, runId));
+	return subscribeFreshQuery(deps, {
+		orgId,
+		runId
+	}, listener, operation, {
+		decode,
+		validateCached: (raw) => {
+			decode(raw);
+		},
+		invalidValue: (cause) => isCapxulError(cause) ? cause : Errors.invalidInput("run", "Invalid Payroll run detail"),
+		invalidScope: () => Errors.invalidInput("run", "Payroll run subscription scope does not match"),
+		lostValue: () => Errors.invalidInput("run", "Payroll run is no longer readable"),
+		unavailable: () => Errors.notImplemented("payroll", "subscribeRun")
+	}, options);
+}
+//#endregion
+//#region src/payroll/run-authorization.ts
+/**
+* Authorize one payroll run: a stable request key, the prepared batch checked
+* against the run the caller asked for, the signature, and the submission.
+*/
+async function authorizePayrollRun(scope, input, controls, onRequestKey, onResolved) {
+	const { deps, orgId, requestKeyScope } = scope;
+	const signal = controls?.signal;
+	const execution = executionDependencies(deps);
+	if (execution === null) return {
+		ok: false,
+		error: Errors.notImplemented("payroll", "executionComposition")
+	};
+	try {
+		input = decodePayrollRunInput(input);
+	} catch (cause) {
+		return {
+			ok: false,
+			error: asCapxulError(cause)
+		};
+	}
+	const { requestKey: provided, ...canonicalInput } = input;
+	const actorId = onRequestKey === void 0 ? void 0 : execution.actor.authSession()?.authUserId;
+	if (onRequestKey !== void 0 && actorId === void 0) return {
+		ok: false,
+		error: Errors.notAuthenticated()
+	};
+	const requestKey = await paymentRequestKeyLifecycle(`${requestKeyScope}:${AUTHORIZE_RUN}`, onRequestKey === void 0 ? {
+		orgId,
+		input
+	} : {
+		actorId,
+		orgId,
+		input: canonicalInput
+	}, provided, onRequestKey === void 0 ? void 0 : { manageProvidedKey: true });
+	try {
+		await onRequestKey?.(requestKey.key);
+		if (onRequestKey !== void 0 && execution.actor.authSession()?.authUserId !== actorId) {
+			await requestKey.finish(false).catch(() => void 0);
+			return {
+				ok: false,
+				error: Errors.notAuthenticated()
+			};
+		}
+	} catch (cause) {
+		await requestKey.finish(false).catch(() => void 0);
+		return {
+			ok: false,
+			error: asCapxulError(cause)
+		};
+	}
+	let authorized;
+	let acceptedReplay;
+	let preparedClosed = false;
+	let terminalReplay;
+	const submitted = await executePrepared(execution, async (signerAddress) => {
+		const prepared = await runIfActive(signal, AUTHORIZE_RUN, () => withInvocationParentSpan(Effect.suspend(() => callOperation(deps.convexCall, runs.authorize, copyInvocationObservation(controls, {
+			orgId,
+			permissionId: input.permissionId,
+			asset: input.asset,
+			requestKey: requestKey.key,
+			signerAddress,
+			period: input.period,
+			items: input.items
+		}))).pipe(Effect.mapError((publicError) => ({ publicError }))), controls), deps.runPromise);
+		if (!prepared.ok) {
+			terminalReplay = payrollResolution(prepared.error, requestKey.key);
+			return prepared;
+		}
+		authorized = prepared.value.run;
+		acceptedReplay = prepared.value.replay.kind === "accepted" ? prepared.value.replay.submission : void 0;
+		return {
+			ok: true,
+			value: prepared.value.execution
+		};
+	}, (request, evidence) => isAuthorizedRunBatch({
+		orgId,
+		permissionId: input.permissionId,
+		requestKey: requestKey.key,
+		asset: input.asset,
+		period: input.period,
+		items: input.items
+	}, authorized)(request, evidence), true, () => preparedClosed = true, signal, controls, void 0, () => acceptedReplay);
+	const resolution = preparedClosed ? "failed" : terminalReplay;
+	if (resolution !== void 0) try {
+		await onResolved?.(resolution);
+	} catch {}
+	try {
+		await requestKey.finish(submitted.ok || resolution !== void 0);
+	} catch {}
+	if (!submitted.ok) return submitted;
+	return authorized === void 0 ? {
+		ok: false,
+		error: Errors.unknown()
+	} : {
+		ok: true,
+		value: toPayrollRun(authorized)
+	};
+}
+const AUTHORIZE_RUN = runs.authorize.name;
+function executionDependencies(deps) {
+	return deps.actor === void 0 || deps.chainId === void 0 || deps.signer === void 0 ? null : {
+		actor: deps.actor,
+		chainId: deps.chainId,
+		convexCall: deps.convexCall,
+		runPromise: deps.runPromise,
+		signer: deps.signer,
+		...deps.telemetry === void 0 ? {} : { telemetry: deps.telemetry }
+	};
+}
+//#endregion
+//#region src/payroll/runs.ts
+function makePayrollMethods(deps, orgId) {
+	const requestKeyScope = deps.requestKeyScope ?? `client-${crypto.randomUUID()}`;
+	/** One observed call of one payroll row, its reply projected inside the call, under the row's name. */
+	const call = (row, args, options, project) => {
+		const controls = deps.invocationControls?.(options) ?? options;
+		return runPortEffect(callOperation(deps.convexCall, row, copyInvocationObservation(controls, args)).pipe(Effect.map(project), Effect.mapError((publicError) => ({ publicError }))), controls, row.name, deps.runPromise);
+	};
+	return {
+		subscribeRun: (runId, listener, options) => subscribePayrollRun({
+			actor: deps.actor,
+			convexCall: deps.convexCall,
+			query: reference(runs.get),
+			runPromise: deps.runPromise,
+			invocationControls: deps.invocationControls,
+			decode: decodePayrollRunDetail,
+			validate: validatePayrollRunLookup
+		}, orgId, runId, listener, options),
+		getRun: (runId, options) => {
+			const controls = deps.invocationControls?.(options) ?? options;
+			const lifetime = deps.actor?.authLifetime();
+			const operation = runs.get.name;
+			return runCapxulEffect(Effect.gen(function* () {
+				const lookup = validatePayrollRunLookup(orgId, runId);
+				if (!lookup.ok) return yield* Effect.fail(lookup.error);
+				if (lifetime === void 0 || lifetime.authUserId === null || deps.actor === void 0) return yield* Effect.fail(Errors.notAuthenticated());
+				const current = () => deps.actor?.matchesAuthLifetime(lifetime, lifetime.authUserId) === true;
+				if (!current()) return yield* Effect.fail(Errors.notAuthenticated());
+				const parent = yield* Effect.currentSpan.pipe(Effect.orDie);
+				const captured = carryInvocationParentSpan(controls, parent);
+				const run = yield* awaitCapxulResult(() => runIfActive(controls?.signal, operation, () => withInvocationParentSpan(Effect.suspend(() => callOperation(deps.convexCall, runs.get, copyInvocationObservation(captured, {
+					orgId,
+					runId
+				}))).pipe(Effect.mapError((publicError) => ({ publicError }))), captured), deps.runPromise));
+				if (!current()) return yield* Effect.fail(Errors.cancelled({ operation }));
+				const checked = checkPayrollRunDetail(run, orgId, runId);
+				return yield* checked.ok ? Effect.succeed(checked.value) : Effect.fail(checked.error);
+			}), observationOnlyControls(controls), operation, deps.runPromise);
+		},
+		runs: (options) => call(runs.list, { orgId }, options, toPayrollRuns),
+		authorizeRun: (input, options) => {
+			const controls = deps.invocationControls?.(options) ?? options;
+			return runCapxulEffect(Effect.gen(function* () {
+				if (controls?.signal?.aborted === true) return yield* Effect.fail(Errors.cancelled({ operation: AUTHORIZE_RUN }));
+				const parent = yield* Effect.currentSpan.pipe(Effect.orDie);
+				return yield* awaitCapxulResult(() => authorizePayrollRun({
+					deps,
+					orgId,
+					requestKeyScope
+				}, input, carryInvocationParentSpan(controls, parent), options?.onRequestKey, options?.onResolved));
+			}), observationOnlyControls(controls), AUTHORIZE_RUN, deps.runPromise);
+		},
+		terms: (options) => call(terms.list, { orgId }, options, (rates) => rates),
+		groups: {
+			list: (options) => call(groups.list, { orgId }, options, (saved) => mapPage(saved, toPayrollGroup)),
+			save: (input, options) => call(groups.save, {
+				orgId,
+				...input.id === void 0 ? {} : { id: String(input.id) },
+				name: input.name,
+				tone: input.tone,
+				members: input.members
+			}, options, toPayrollGroup),
+			remove: (id, options) => call(groups.remove, {
+				orgId,
+				id
+			}, options, () => void 0)
+		}
+	};
+}
+const payrollUnavailable = () => Promise.resolve({
+	ok: false,
+	error: Errors.notImplemented("payroll", "executionComposition")
+});
+/** The bundle an unconfigured client exposes — every verb refuses, none throws. */
+function makeUnavailablePayrollMethods() {
+	return {
+		getRun: payrollUnavailable,
+		subscribeRun: payrollUnavailable,
+		runs: payrollUnavailable,
+		authorizeRun: payrollUnavailable,
+		terms: payrollUnavailable,
+		groups: {
+			list: payrollUnavailable,
+			save: payrollUnavailable,
+			remove: payrollUnavailable
+		}
+	};
+}
+//#endregion
+//#region src/accounts/command-approvals.ts
+/**
+* Keep a prepared command only when it is the one asked for and its operation
+* is the person's own. A mismatch is closed unsent when `close`, as the signed
+* path closes a new Payment; a retry or a request keeps its Payment open.
+*/
+async function checked(deps, signerAddress, prepared, expected, close) {
+	if (!prepared.ok) return prepared;
+	const session = deps.actor?.authSession() ?? null;
+	if (session === null || deps.chainId === void 0) return {
+		ok: false,
+		error: Errors.notAuthenticated()
+	};
+	const evidence = prepared.value;
+	if (await expected(evidence.request, evidence) && await verifiedPreparedCommand(evidence, session.email, signerAddress, deps.chainId)) return prepared;
+	const refused = {
+		ok: false,
+		error: Errors.invalidInput("execution", "prepared command mismatch")
+	};
+	return close ? abandonPrepared(deps, evidence.executionId, "prepared_mismatch", refused) : refused;
+}
+/** A retry, a request payment or a payroll run, rather than a new Payment. */
+const isCommandApproval = (input) => "retry" in input || "request" in input || "payrollRun" in input;
+/** Prepare a retry, a request payment or a payroll run for `signerAddress`, checked. */
+function prepareVerifiedCommand(deps, input, signerAddress, signal) {
+	if ("retry" in input) return prepareVerifiedRetry(deps, input, signerAddress, signal);
+	if ("request" in input) return prepareVerifiedRequestPayment(deps, input, signerAddress, signal);
+	return prepareVerifiedPayrollRun(deps, input, signerAddress, signal);
+}
+/** The retry of one Payment, prepared in the scope that paid it. */
+async function prepareVerifiedRetry(deps, input, signerAddress, signal) {
+	const intent = {
+		kind: "retry",
+		paymentId: input.retry
+	};
+	return checked(deps, signerAddress, await runIfActive(signal, CAPXUL_OPERATIONS.payments.prepareLifecycleExecution, () => callOperation(deps.convexCall, lifecycles.prepareScoped, {
+		signerAddress,
+		intent,
+		expectedScope: input.organizationId === void 0 ? { kind: "account" } : {
+			kind: "organization",
+			orgId: input.organizationId
+		}
+	}).pipe(Effect.mapError((publicError) => ({ publicError }))), deps.runPromise), lifecycleCommandCheck(intent, input.organizationId), false);
+}
+/** The Payment of one request, exactly as the request froze it. */
+async function prepareVerifiedRequestPayment(deps, input, signerAddress, signal) {
+	const decoded = Schema.decodeResult(RequestPaymentConfirmationSchema, { onExcessProperty: "error" })(input.request);
+	if (decoded._tag === "Failure") return {
+		ok: false,
+		error: Errors.invalidInput("confirmation", "invalid request confirmation")
+	};
+	const confirmation = decoded.success;
+	return checked(deps, signerAddress, await runIfActive(signal, commands$1.prepareRequest.name, () => callOperation(deps.convexCall, commands$1.prepareRequest, {
+		confirmation,
+		signerAddress
+	}).pipe(Effect.mapError((publicError) => ({ publicError }))), deps.runPromise), requestPaymentCheck(confirmation), false);
+}
+/** One payroll run: the run the backend writes and the batch that pays it, checked together. */
+async function prepareVerifiedPayrollRun(deps, input, signerAddress, signal) {
+	let run;
+	try {
+		run = decodePayrollRunInput(input.payrollRun);
+	} catch (cause) {
+		return {
+			ok: false,
+			error: asCapxulError(cause)
+		};
+	}
+	const orgId = input.organizationId;
+	const requestKey = run.requestKey ?? `payroll_${crypto.randomUUID()}`;
+	const { permissionId, asset, period, items } = run;
+	const authorized = await runIfActive(signal, runs.authorize.name, () => callOperation(deps.convexCall, runs.authorize, {
+		orgId,
+		permissionId,
+		asset,
+		requestKey,
+		signerAddress,
+		period,
+		items
+	}).pipe(Effect.mapError((publicError) => ({ publicError }))), deps.runPromise);
+	if (!authorized.ok) return authorized;
+	return checked(deps, signerAddress, {
+		ok: true,
+		value: authorized.value.execution
+	}, isAuthorizedRunBatch({
+		orgId,
+		permissionId,
+		requestKey,
+		asset,
+		period,
+		items
+	}, authorized.value.run), authorized.value.replay.kind !== "accepted");
+}
+//#endregion
 //#region src/accounts/organization-approvals.ts
 /** The Organization Payment prepared for `signerAddress` and checked, before any approval. */
 async function prepareVerifiedOrganizationPayment(deps, input, signerAddress, signal) {
@@ -19381,6 +20025,7 @@ function makeApprovalsMethods(deps) {
 	};
 	const prepare = async (input, options) => {
 		const signal = options?.signal;
+		if (isCommandApproval(input)) return openApproval(signal, (signerAddress) => prepareVerifiedCommand(deps, input, signerAddress, signal));
 		if ("organizationId" in input) return openApproval(signal, (signerAddress) => prepareVerifiedOrganizationPayment(deps, input, signerAddress, signal));
 		const intent = paymentExecutionIntent(input);
 		if (!intent.ok) return intent;
@@ -19473,7 +20118,7 @@ function makeApprovalsMethods(deps) {
 			ok: true,
 			value: null
 		};
-		const payments = await readApprovalPayments(deps, approval.operation.paymentIds, organizationId, signal);
+		const payments = await readApprovalPayments(deps, approval.operation.paymentIds, organizationId ?? (approval.actor.kind === "organization" ? approval.actor.orgId : void 0), signal);
 		if (!payments.ok) return payments;
 		if (unsent(approval, payments.value)) {
 			const sent = await submit(approvalId);
@@ -22402,4 +23047,4 @@ function executeIdentityProductObservation(telemetry, record, state) {
 	return ignoreTransportFailure(() => invocationTelemetry.emit(mapped), "emit", mapped.name).pipe(Effect.andThen(ignoreTransportFailure(after, mapped.name === "auth_signed_out" ? "reset" : "identify", mapped.name)));
 }
 //#endregion
-export { toRaw as $, workspaces as $n, formatTraceparent as $r, version as $t, registerProductTelemetryInvocation as A, parseAuthSession as Ai, details as An, toAssetId as Ar, safe4337MultiSendUserOpCallData as At, paymentRequestKeyLifecycle as B, toNonEmptyStringBrand as Bi, terms as Bn, makeAuthMethods as Br, failureEvidenceProps as Bt, AccountReadPortTag as C, authClientPortFromPromiseAdapter as Ci, CLI_INVOCATION_KINDS as Cn, EpochMsSchema$1 as Cr, CAPXUL_PAYMENTS_V2_ADDRESS as Ct, convexCallErrorFromCapxul as D, globalLocalStorage as Di, isCapxulOperation as Dn, toRoleKey as Dr, deriveCapxulSafeAddress as Dt, ConvexCallPortTag as E, detectAuthCacheAdapter as Ei, CAPXUL_OPERATIONS as En, toPermissionId as Er, TOKENS as Et, logDroppedEvent as F, toAuthUserId as Fi, replacements as Fn, toAddress as Fr, callOperation as Ft, makeTargetsMethods as G, isFailureMode as Gi, PayrollRunIdSchema as Gn, sessionFromActor as Gr, observationContextProps as Gt, makeActorRelationshipMethods as H, CapxulError as Hi, PayrollGroupIdSchema as Hn, publicIdentityFailure as Hr, postHogFailureObservation as Ht, makeOrganizationPaymentsMethods as I, toEmail as Ii, PreparedPermissionExecutionSchema as In, toChainId as Ir, asCapxulError as It, assetAmountFromRaw as J, AuthCacheError as Ji, invitations as Jn, withVerifiedOrganizationScope as Jr, SDK_VERSION as Jt, subscribeFreshQuery as K, isRecord as Ki, PayrollRunItemInputSchema as Kn, observationOnlyControls as Kr, withCapturedAttemptContext as Kt, makeOfframpMethods as L, toJwtToken as Li, PermissionCommandViewSchema as Ln, toWeiAmount as Lr, mapPage as Lt, makeApprovalsMethods as M, toDurationMs as Mi, authorities as Mn, toExactAssetAmount as Mr, BASE_SEPOLIA_CHAIN_ID as Mt, makeAccountMethods as N, toEpochMs as Ni, commands as Nn, EVM_ADDRESS_RE$1 as Nr, MULTI_SEND_CALL_ONLY as Nt, retryIdempotentRead as O, InMemoryAuthCacheAdapter as Oi, normalizeCapxulOperation as On, ChainIdSchema$1 as Or, normalizeSafeSaltEmail as Ot, emitDepositInitiated as P, toEpochSeconds as Pi, configurations as Pn, isEvmAddress as Pr, SAFE_SENTINEL_OWNERS as Pt, requireAsset as Q, treasuries as Qn, toCapxulResult as Qr, safeExceptionLabel as Qt, makePaymentsMethods as R, toSessionToken as Ri, groups as Rn, absurd as Rr, toPublicError$1 as Rt, valueIn as S, toPublishableKey as Si, CLI_COMMAND_NAMES as Sn, DurationMsSchema$1 as Sr, SEND_SIGNATURE as St, TelemetryPortTag as T, AuthClientPortTag as Ti, stampTelemetryEnvelope as Tn, toPermissionAssignmentId as Tr, CONFIGURED_MONEY_ASSETS as Tt, makeCheckoutMethods as U, isCapxulError as Ui, PayrollGroupInputSchema as Un, runIdentityFacade as Ur, observeFailedResult as Ut, makeDestinationsMethods as V, Errors as Vi, AuthorizePayrollRunExecutionInputSchema as Vn, askIdentity as Vr, CAPXUL_SDK_EXPECTED_OUTCOME_EVENT as Vt, isCheckoutSettlementConsumed as W, FAILURE_MODES$1 as Wi, PayrollRunDetailSchema as Wn, runPortEffect as Wr, observeSdkClient as Wt, formatAssetAmount as X, roles as Xn, defectAsCapxulError as Xr, normalizeExceptionOperation as Xt, assetSymbolFor as Y, AuthCachePortTag as Yi, members as Yn, awaitCapxulResult as Yr, normalizeExceptionErrorKind as Yt, parseAssetAmount as Z, setups as Zn, runIfActive as Zr, projectSdkException as Zt, accountFromAccountPositions as _, redactSecrets as _i, toPartyId as _n, toLowerAddress as _r, ROLES_SET_TRANSACTION_UNWRAPPER_ABI as _t, paymentPhase as a, oauthBearerAuthClient as ai, isSignerNotReadySignal as an, toOrgId as ar, ORG_BUDGET_ACTIONS as at, MONEY_READ_RATES as b, toAllowedOrigin as bi, redactTelemetryProps as bn, PAYMENT_DIRECTIONS as br, SAFE_ENABLE_MODULE_ABI as bt, makePaymentDocumentsMethods as c, ClockPortTag as ci, signerFailure as cn, decodePermissionIntent as cr, resolveOrgPermissionIdentity as ct, SmartAccountPortTag as d, BetterAuthBrowserLayer as di, makeClientRequestMethods as dn, AppIdSchema$1 as dr, MULTI_SEND_SELECTOR as dt, CAPXUL_ERROR_CODES as ei, isSettingUpLifecycle as en, OrganizationSetupSchema as er, isMoneyParseError as et, smartAccountErrorFromCapxul as f, observationRequestHeaders as fi, toCountryCode as fn, images as fr, OPERATOR as ft, ConvexAccountLayer as g, sanitizeObservationContext as gi, toHandle as gn, toExactHex as gr, ROLES_SET_ALLOWANCE_ABI as gt, makeAccountsMethods as h, readInvocationObservation as hi, HANDLE_RE as hn, isBytes32 as hr, ROLES_EXEC_TRANSACTION_WITH_ROLE_ABI as ht, inboxPhase as i, withInvocationParentSpan as ii, isEcdsaSignatureHex as in, decodeChainCause as ir, moneySafeOpDigest as it, wireChainId as j, parseCachedJwt as ji, onboardings as jn, toCurrencyCode as jr, buildSafeMultiSendExecTransactionCall as jt, bindProductTelemetryInvocation as k, BrowserAuthCacheAdapter as ki, OPERATIONS as kn, currencySymbolFor as kr, safe4337ExecuteUserOpCallData as kt, makeSmartAccountMethods as l, readClockNow as li, resolveFailureMode as ln, CurrentPolicySchema as lr, CREATE_COMMITMENT_SIGNATURE as lt, PonderIndexerAdapter as m, copyInvocationObservation as mi, toTesterKind as mn, PaymentDocumentOptionsSchema as mr, ROLES_ASSIGN_ROLES_ABI as mt, bootIdentityFlow as n, ActorFailure as ni, causeChain as nn, ORGANIZATION_SETUP_STATUSES as nr, canonicalJson as nt, requestPhase as o, SystemClockLayer as oi, openfortSignerNotReadyCode as on, InvitationViewSchema as or, roleKeyForPermission as ot, makeHoldingsMethods as p, attachInvocationObservation as pi, toKycTier as pn, toAccountId as pr, PARAMETER_TYPE as pt, executePrepared as q, readField as qi, FixedOfferDraftSchema as qn, runCapxulEffect as qr, EXCEPTION_MESSAGE as qt, makeMeMethods as r, carryInvocationParentSpan as ri, injectedWalletSigner as rn, CHAIN_UPSTREAMS as rr, fingerprintPaymentIntent as rt, makeActivityMethods as s, ClockError as si, recoverRawDigestSigner as sn, hashPermissionReplacementPreview as sr, ZODIAC_MODULE_PROXY_FACTORY as st, executeIdentityProductObservation as t, EXPECTED_OPERATION_OUTCOMES as ti, UNOBSERVABLE_SIGNER_STATUS as tn, ORGANIZATION_SETUP_REASONS as tr, parseMoney as tt, ConvexSmartAccountLayer as u, BetterAuthNodeLayer as ui, makeCurrentUserMethods as un, diagnostics as ur, MODULE_PROXY_FACTORY_ABI as ut, accountPositionsFromWire as v, redactUrlSecrets as vi, validateHandle as vn, toLowerBytes32 as vr, ROLES_SET_UP_ABI as vt, accountReadErrorFromCapxul as w, AuthClientError as wi, EXCEPTION_EVENT_NAME as wn, toBudgetId as wr, hashAdjustmentsV3 as wt, valueActivitySummary as x, toAppId as xi, CLI_CAPABILITIES as xn, PAYMENT_STATUSES as xr, SEND_BATCH_SIGNATURE as xt, positionPeg as y, isCredentialField as yi, redactTelemetryEvent as yn, toLowerHex as yr, ROLE_MANAGEMENT_SIGNATURES as yt, waitForPaymentSubmission as z, isNonEmptyString as zi, runs as zn, reference as zr, failureDetail as zt };
+export { parseAssetAmount as $, hashPermissionReplacementPreview as $n, carryInvocationParentSpan as $r, isSettingUpLifecycle as $t, registerProductTelemetryInvocation as A, toEpochSeconds as Ai, onboardings as An, isEvmAddress as Ar, safe4337MultiSendUserOpCallData as At, makeOrganizationPaymentsMethods as B, isRecord as Bi, invitations as Bn, runPortEffect as Br, CAPXUL_SDK_EXPECTED_OUTCOME_EVENT as Bt, AccountReadPortTag as C, globalLocalStorage as Ci, EXCEPTION_EVENT_NAME as Cn, toRoleKey as Cr, SEND_SIGNATURE as Ct, convexCallErrorFromCapxul as D, parseCachedJwt as Di, normalizeCapxulOperation as Dn, toCurrencyCode as Dr, deriveCapxulSafeAddress as Dt, ConvexCallPortTag as E, parseAuthSession as Ei, isCapxulOperation as En, toAssetId as Er, TOKENS as Et, decodePayrollRunInput as F, Errors as Fi, PreparedPermissionExecutionSchema as Fn, reference as Fr, callOperation as Ft, makeActorRelationshipMethods as G, workspaces as Gn, awaitCapxulResult as Gr, withCapturedAttemptContext as Gt, makePaymentsMethods as H, AuthCacheError as Hi, roles as Hn, observationOnlyControls as Hr, observeFailedResult as Ht, toPayrollGroupId as I, CapxulError as Ii, PermissionCommandViewSchema as In, makeAuthMethods as Ir, asCapxulError as It, makeTargetsMethods as J, ORGANIZATION_SETUP_STATUSES as Jn, toCapxulResult as Jr, normalizeExceptionErrorKind as Jt, makeCheckoutMethods as K, OrganizationSetupSchema as Kn, defectAsCapxulError as Kr, EXCEPTION_MESSAGE as Kt, makeAccountMethods as L, isCapxulError as Li, PayrollGroupIdSchema as Ln, askIdentity as Lr, toPublicError$1 as Lt, makeApprovalsMethods as M, toEmail as Mi, commands as Mn, toChainId as Mr, BASE_SEPOLIA_CHAIN_ID as Mt, makePayrollMethods as N, toJwtToken as Ni, configurations as Nn, toWeiAmount as Nr, MULTI_SEND_CALL_ONLY as Nt, retryIdempotentRead as O, toDurationMs as Oi, OPERATIONS as On, toExactAssetAmount as Or, normalizeSafeSaltEmail as Ot, makeUnavailablePayrollMethods as P, toSessionToken as Pi, replacements as Pn, absurd as Pr, SAFE_SENTINEL_OWNERS as Pt, formatAssetAmount as Q, InvitationViewSchema as Qn, ActorFailure as Qr, version as Qt, emitDepositInitiated as R, FAILURE_MODES$1 as Ri, PayrollGroupInputSchema as Rn, publicIdentityFailure as Rr, failureDetail as Rt, valueIn as S, detectAuthCacheAdapter as Si, CLI_INVOCATION_KINDS as Sn, toPermissionId as Sr, SEND_BATCH_SIGNATURE as St, TelemetryPortTag as T, BrowserAuthCacheAdapter as Ti, CAPXUL_OPERATIONS as Tn, currencySymbolFor as Tr, CONFIGURED_MONEY_ASSETS as Tt, waitForPaymentSubmission as U, AuthCachePortTag as Ui, setups as Un, runCapxulEffect as Ur, observeSdkClient as Ut, makeOfframpMethods as V, readField as Vi, members as Vn, sessionFromActor as Vr, postHogFailureObservation as Vt, makeDestinationsMethods as W, treasuries as Wn, withVerifiedOrganizationScope as Wr, observationContextProps as Wt, assetAmountFromRaw as X, decodeChainCause as Xn, CAPXUL_ERROR_CODES as Xr, projectSdkException as Xt, subscribeFreshQuery as Y, CHAIN_UPSTREAMS as Yn, formatTraceparent as Yr, normalizeExceptionOperation as Yt, assetSymbolFor as Z, toOrgId as Zn, EXPECTED_OPERATION_OUTCOMES as Zr, safeExceptionLabel as Zt, accountFromAccountPositions as _, toAppId as _i, validateHandle as _n, PAYMENT_STATUSES as _r, ROLES_SET_ALLOWANCE_ABI as _t, paymentPhase as a, readClockNow as ai, openfortSignerNotReadyCode as an, roleKeyForPermission as ar, fingerprintPaymentIntent as at, MONEY_READ_RATES as b, AuthClientError as bi, CLI_CAPABILITIES as bn, toBudgetId as br, ROLE_MANAGEMENT_SIGNATURES as bt, makePaymentDocumentsMethods as c, observationRequestHeaders as ci, resolveFailureMode as cn, images as cr, resolveOrgPermissionIdentity as ct, SmartAccountPortTag as d, readInvocationObservation as di, toCountryCode as dn, isBytes32 as dr, MULTI_SEND_SELECTOR as dt, withInvocationParentSpan as ei, UNOBSERVABLE_SIGNER_STATUS as en, decodePermissionIntent as er, requireAsset as et, smartAccountErrorFromCapxul as f, sanitizeObservationContext as fi, toKycTier as fn, toExactHex as fr, OPERATOR as ft, ConvexAccountLayer as g, toAllowedOrigin as gi, toPartyId as gn, PAYMENT_DIRECTIONS as gr, ROLES_EXEC_TRANSACTION_WITH_ROLE_ABI as gt, makeAccountsMethods as h, isCredentialField as hi, toHandle as hn, toLowerHex as hr, ROLES_ASSIGN_ROLES_ABI as ht, inboxPhase as i, ClockPortTag as ii, isSignerNotReadySignal as in, ORG_BUDGET_ACTIONS as ir, canonicalJson as it, wireChainId as j, toAuthUserId as ji, authorities as jn, toAddress as jr, buildSafeMultiSendExecTransactionCall as jt, bindProductTelemetryInvocation as k, toEpochMs as ki, details as kn, EVM_ADDRESS_RE$1 as kr, safe4337ExecuteUserOpCallData as kt, makeSmartAccountMethods as l, attachInvocationObservation as li, makeCurrentUserMethods as ln, toAccountId as lr, CREATE_COMMITMENT_SIGNATURE as lt, PonderIndexerAdapter as m, redactUrlSecrets as mi, HANDLE_RE as mn, toLowerBytes32 as mr, PARAMETER_TYPE as mt, bootIdentityFlow as n, SystemClockLayer as ni, injectedWalletSigner as nn, CurrentPolicySchema as nr, isMoneyParseError as nt, requestPhase as o, BetterAuthNodeLayer as oi, recoverRawDigestSigner as on, diagnostics as or, moneySafeOpDigest as ot, makeHoldingsMethods as p, redactSecrets as pi, toTesterKind as pn, toLowerAddress as pr, OWNER_COMMITMENT_SIGNATURES as pt, isCheckoutSettlementConsumed as q, ORGANIZATION_SETUP_REASONS as qn, runIfActive as qr, SDK_VERSION as qt, makeMeMethods as r, ClockError as ri, isEcdsaSignatureHex as rn, MONTHLY_REFILL_PERIOD_SECONDS as rr, parseMoney as rt, makeActivityMethods as s, BetterAuthBrowserLayer as si, signerFailure as sn, AppIdSchema$1 as sr, ZODIAC_MODULE_PROXY_FACTORY as st, executeIdentityProductObservation as t, oauthBearerAuthClient as ti, causeChain as tn, keepRefillOnChange as tr, toRaw as tt, ConvexSmartAccountLayer as u, copyInvocationObservation as ui, makeClientRequestMethods as un, PaymentDocumentOptionsSchema as ur, MODULE_PROXY_FACTORY_ABI as ut, accountPositionsFromWire as v, toPublishableKey as vi, redactTelemetryEvent as vn, DurationMsSchema$1 as vr, ROLES_SET_TRANSACTION_UNWRAPPER_ABI as vt, accountReadErrorFromCapxul as w, InMemoryAuthCacheAdapter as wi, stampTelemetryEnvelope as wn, ChainIdSchema$1 as wr, CAPXUL_PAYMENTS_V2_ADDRESS as wt, valueActivitySummary as x, AuthClientPortTag as xi, CLI_COMMAND_NAMES as xn, toPermissionAssignmentId as xr, SAFE_ENABLE_MODULE_ABI as xt, positionPeg as y, authClientPortFromPromiseAdapter as yi, redactTelemetryProps as yn, EpochMsSchema$1 as yr, ROLES_SET_UP_ABI as yt, logDroppedEvent as z, isFailureMode as zi, FixedOfferDraftSchema as zn, runIdentityFacade as zr, failureEvidenceProps as zt };