@capxul/sdk 4.20.0-beta.26 → 4.20.0-beta.28

package/dist/{production-D3saI6ME.mjs → production-CoxgepCr.mjs}

@@ -1,4 +1,4 @@
-import { $n as workspaces, $r as formatTraceparent, $t as version$1, A as registerProductTelemetryInvocation, An as details, At as safe4337MultiSendUserOpCallData, B as paymentRequestKeyLifecycle, Bi as toNonEmptyStringBrand, Bn as terms, Br as makeAuthMethods, Bt as failureEvidenceProps, C as AccountReadPortTag, Cn as CLI_INVOCATION_KINDS, Cr as EpochMsSchema, Ct as CAPXUL_PAYMENTS_V2_ADDRESS, D as convexCallErrorFromCapxul, Di as globalLocalStorage, Dn as isCapxulOperation, Dr as toRoleKey, Dt as deriveCapxulSafeAddress, E as ConvexCallPortTag, Ei as detectAuthCacheAdapter, En as CAPXUL_OPERATIONS, Er as toPermissionId, F as logDroppedEvent, Fi as toAuthUserId, Fn as replacements, Fr as toAddress, Ft as callOperation, G as makeTargetsMethods, Gi as isFailureMode, Gn as PayrollRunIdSchema, Gr as sessionFromActor, Gt as observationContextProps, H as makeActorRelationshipMethods, Hi as CapxulError, Hr as publicIdentityFailure, Ht as postHogFailureObservation, I as makeOrganizationPaymentsMethods, Ii as toEmail, In as PreparedPermissionExecutionSchema, It as asCapxulError, Jn as invitations, Jr as withVerifiedOrganizationScope, K as subscribeFreshQuery, Ki as isRecord, Kn as PayrollRunItemInputSchema, Kr as observationOnlyControls, Kt as withCapturedAttemptContext, L as makeOfframpMethods, Ln as PermissionCommandViewSchema, Lt as mapPage, M as makeApprovalsMethods, Mn as authorities, Mr as toExactAssetAmount, Mt as BASE_SEPOLIA_CHAIN_ID, N as makeAccountMethods, Ni as toEpochMs, Nn as commands, Nt as MULTI_SEND_CALL_ONLY, O as retryIdempotentRead, On as normalizeCapxulOperation, Or as ChainIdSchema, Ot as normalizeSafeSaltEmail, P as emitDepositInitiated, Pn as configurations, Pr as isEvmAddress, Pt as SAFE_SENTINEL_OWNERS, Qn as treasuries, Qr as toCapxulResult, R as makePaymentsMethods, Rn as groups, Rr as absurd, Rt as toPublicError, Si as toPublishableKey, Sn as CLI_COMMAND_NAMES, Sr as DurationMsSchema, St as SEND_SIGNATURE, T as TelemetryPortTag, Ti as AuthClientPortTag, Tn as stampTelemetryEnvelope, Tr as toPermissionAssignmentId, Tt as CONFIGURED_MONEY_ASSETS, U as makeCheckoutMethods, Ui as isCapxulError, Ur as runIdentityFacade, Ut as observeFailedResult, V as makeDestinationsMethods, Vi as Errors, Vn as AuthorizePayrollRunExecutionInputSchema, Vr as askIdentity, Wi as FAILURE_MODES, Wn as PayrollRunDetailSchema, Wr as runPortEffect, Wt as observeSdkClient, Xn as roles, Xr as defectAsCapxulError, Yi as AuthCachePortTag, Yn as members, Yr as awaitCapxulResult, Zn as setups, Zr as runIfActive, _ as accountFromAccountPositions, _i as redactSecrets, _n as toPartyId, _r as toLowerAddress, _t as ROLES_SET_TRANSACTION_UNWRAPPER_ABI, an as isSignerNotReadySignal, ar as toOrgId, at as ORG_BUDGET_ACTIONS, b as MONEY_READ_RATES, bi as toAllowedOrigin, bn as redactTelemetryProps, bt as SAFE_ENABLE_MODULE_ABI, c as makePaymentDocumentsMethods, ci as ClockPortTag, cn as signerFailure, cr as decodePermissionIntent$1, ct as resolveOrgPermissionIdentity, d as SmartAccountPortTag, di as BetterAuthBrowserLayer, dn as makeClientRequestMethods, dr as AppIdSchema, dt as MULTI_SEND_SELECTOR, ei as CAPXUL_ERROR_CODES, er as OrganizationSetupSchema, fi as observationRequestHeaders, fn as toCountryCode, fr as images, ft as OPERATOR, g as ConvexAccountLayer, gi as sanitizeObservationContext, gn as toHandle, gr as toExactHex, gt as ROLES_SET_ALLOWANCE_ABI, h as makeAccountsMethods, hi as readInvocationObservation, hr as isBytes32, ht as ROLES_EXEC_TRANSACTION_WITH_ROLE_ABI, ii as withInvocationParentSpan, in as isEcdsaSignatureHex, ir as decodeChainCause, it as moneySafeOpDigest, jn as onboardings, jt as buildSafeMultiSendExecTransactionCall, k as bindProductTelemetryInvocation, kn as OPERATIONS, kt as safe4337ExecuteUserOpCallData, l as makeSmartAccountMethods, lr as CurrentPolicySchema, lt as CREATE_COMMITMENT_SIGNATURE, m as PonderIndexerAdapter, mi as copyInvocationObservation, mn as toTesterKind, mt as ROLES_ASSIGN_ROLES_ABI, n as bootIdentityFlow, ni as ActorFailure, nn as causeChain, nr as ORGANIZATION_SETUP_STATUSES, nt as canonicalJson, oi as SystemClockLayer, on as openfortSignerNotReadyCode, or as InvitationViewSchema, ot as roleKeyForPermission, p as makeHoldingsMethods, pi as attachInvocationObservation, pn as toKycTier, pr as toAccountId, pt as PARAMETER_TYPE, q as executePrepared, qi as readField, qr as runCapxulEffect, r as makeMeMethods, ri as carryInvocationParentSpan, s as makeActivityMethods, sn as recoverRawDigestSigner, sr as hashPermissionReplacementPreview, st as ZODIAC_MODULE_PROXY_FACTORY, t as executeIdentityProductObservation, tn as UNOBSERVABLE_SIGNER_STATUS, tr as ORGANIZATION_SETUP_REASONS, u as ConvexSmartAccountLayer, ui as BetterAuthNodeLayer, un as makeCurrentUserMethods, ur as diagnostics, ut as MODULE_PROXY_FACTORY_ABI, v as accountPositionsFromWire, vi as redactUrlSecrets, vn as validateHandle, vr as toLowerBytes32, vt as ROLES_SET_UP_ABI, wi as AuthClientError, wr as toBudgetId, wt as hashAdjustmentsV3, xn as CLI_CAPABILITIES, xt as SEND_BATCH_SIGNATURE, yi as isCredentialField, yr as toLowerHex, yt as ROLE_MANAGEMENT_SIGNATURES, z as waitForPaymentSubmission, zi as isNonEmptyString, zn as runs, zr as reference, zt as failureDetail } from "./access-BEMUjtyy.mjs";
+import { $n as hashPermissionReplacementPreview, $r as carryInvocationParentSpan, A as registerProductTelemetryInvocation, An as onboardings, Ar as isEvmAddress, At as safe4337MultiSendUserOpCallData, B as makeOrganizationPaymentsMethods, Bi as isRecord, Bn as invitations, Br as runPortEffect, C as AccountReadPortTag, Ci as globalLocalStorage, Cr as toRoleKey, Ct as SEND_SIGNATURE, D as convexCallErrorFromCapxul, Dn as normalizeCapxulOperation, Dt as deriveCapxulSafeAddress, E as ConvexCallPortTag, En as isCapxulOperation, Fi as Errors, Fn as PreparedPermissionExecutionSchema, Fr as reference, Ft as callOperation, G as makeActorRelationshipMethods, Gn as workspaces, Gr as awaitCapxulResult, Gt as withCapturedAttemptContext, H as makePaymentsMethods, Hn as roles, Hr as observationOnlyControls, Ht as observeFailedResult, Ii as CapxulError, In as PermissionCommandViewSchema, Ir as makeAuthMethods, It as asCapxulError, J as makeTargetsMethods, Jn as ORGANIZATION_SETUP_STATUSES, Jr as toCapxulResult, K as makeCheckoutMethods, Kn as OrganizationSetupSchema, Kr as defectAsCapxulError, L as makeAccountMethods, Li as isCapxulError, Lr as askIdentity, Lt as toPublicError, M as makeApprovalsMethods, Mi as toEmail, Mn as commands, Mt as BASE_SEPOLIA_CHAIN_ID, N as makePayrollMethods, Nn as configurations, Nt as MULTI_SEND_CALL_ONLY, O as retryIdempotentRead, On as OPERATIONS, Or as toExactAssetAmount, Ot as normalizeSafeSaltEmail, P as makeUnavailablePayrollMethods, Pn as replacements, Pr as absurd, Pt as SAFE_SENTINEL_OWNERS, Qn as InvitationViewSchema, Qr as ActorFailure, Qt as version$1, R as emitDepositInitiated, Ri as FAILURE_MODES, Rr as publicIdentityFailure, Rt as failureDetail, Si as detectAuthCacheAdapter, Sn as CLI_INVOCATION_KINDS, Sr as toPermissionId, St as SEND_BATCH_SIGNATURE, T as TelemetryPortTag, Tn as CAPXUL_OPERATIONS, Tt as CONFIGURED_MONEY_ASSETS, U as waitForPaymentSubmission, Ui as AuthCachePortTag, Un as setups, Ur as runCapxulEffect, Ut as observeSdkClient, V as makeOfframpMethods, Vi as readField, Vn as members, Vr as sessionFromActor, Vt as postHogFailureObservation, W as makeDestinationsMethods, Wn as treasuries, Wr as withVerifiedOrganizationScope, Wt as observationContextProps, Xn as decodeChainCause, Xr as CAPXUL_ERROR_CODES, Y as subscribeFreshQuery, Yr as formatTraceparent, Zn as toOrgId, _ as accountFromAccountPositions, _n as validateHandle, _t as ROLES_SET_ALLOWANCE_ABI, an as openfortSignerNotReadyCode, ar as roleKeyForPermission, b as MONEY_READ_RATES, bi as AuthClientError, bn as CLI_CAPABILITIES, br as toBudgetId, bt as ROLE_MANAGEMENT_SIGNATURES, c as makePaymentDocumentsMethods, ci as observationRequestHeaders, cr as images, ct as resolveOrgPermissionIdentity, d as SmartAccountPortTag, di as readInvocationObservation, dn as toCountryCode, dr as isBytes32, dt as MULTI_SEND_SELECTOR, ei as withInvocationParentSpan, en as UNOBSERVABLE_SIGNER_STATUS, er as decodePermissionIntent$1, fi as sanitizeObservationContext, fn as toKycTier, fr as toExactHex, ft as OPERATOR, g as ConvexAccountLayer, gi as toAllowedOrigin, gn as toPartyId, gt as ROLES_EXEC_TRANSACTION_WITH_ROLE_ABI, h as makeAccountsMethods, hi as isCredentialField, hn as toHandle, hr as toLowerHex, ht as ROLES_ASSIGN_ROLES_ABI, ii as ClockPortTag, in as isSignerNotReadySignal, ir as ORG_BUDGET_ACTIONS, it as canonicalJson, ji as toAuthUserId, jn as authorities, jr as toAddress, jt as buildSafeMultiSendExecTransactionCall, k as bindProductTelemetryInvocation, ki as toEpochMs, kn as details, kt as safe4337ExecuteUserOpCallData, l as makeSmartAccountMethods, li as attachInvocationObservation, ln as makeCurrentUserMethods, lr as toAccountId, lt as CREATE_COMMITMENT_SIGNATURE, m as PonderIndexerAdapter, mi as redactUrlSecrets, mr as toLowerBytes32, mt as PARAMETER_TYPE, n as bootIdentityFlow, ni as SystemClockLayer, nr as CurrentPolicySchema, oi as BetterAuthNodeLayer, on as recoverRawDigestSigner, or as diagnostics, ot as moneySafeOpDigest, p as makeHoldingsMethods, pi as redactSecrets, pn as toTesterKind, pr as toLowerAddress, pt as OWNER_COMMITMENT_SIGNATURES, qn as ORGANIZATION_SETUP_REASONS, qr as runIfActive, r as makeMeMethods, rn as isEcdsaSignatureHex, rr as MONTHLY_REFILL_PERIOD_SECONDS, s as makeActivityMethods, si as BetterAuthBrowserLayer, sn as signerFailure, sr as AppIdSchema, st as ZODIAC_MODULE_PROXY_FACTORY, t as executeIdentityProductObservation, tn as causeChain, tr as keepRefillOnChange, u as ConvexSmartAccountLayer, ui as copyInvocationObservation, un as makeClientRequestMethods, ut as MODULE_PROXY_FACTORY_ABI, v as accountPositionsFromWire, vi as toPublishableKey, vr as DurationMsSchema, vt as ROLES_SET_TRANSACTION_UNWRAPPER_ABI, wn as stampTelemetryEnvelope, wr as ChainIdSchema, wt as CAPXUL_PAYMENTS_V2_ADDRESS, xi as AuthClientPortTag, xn as CLI_COMMAND_NAMES, xr as toPermissionAssignmentId, xt as SAFE_ENABLE_MODULE_ABI, yn as redactTelemetryProps, yr as EpochMsSchema, yt as ROLES_SET_UP_ABI, z as logDroppedEvent, zi as isFailureMode, zr as runIdentityFacade, zt as failureEvidenceProps } from "./access-SP-ur4Ku.mjs";
 import { Cause, Clock, Context, Data, Deferred, Duration, Effect, Exit, FiberSet, Layer, Logger, Metric, Option, Predicate, References, Result, Schedule, Schema, SchemaIssue, SchemaParser, Scope, Stream, Tracer } from "effect";
 import { getFunctionName } from "convex/server";
 import { BaseError, decodeFunctionData, encodeAbiParameters, encodeFunctionData, formatUnits, getContractAddress, keccak256, padHex, parseAbiParameters, stringToHex, toBytes, toFunctionSelector, toHex } from "viem";
@@ -76,14 +76,6 @@ function isPostHogUrlProperty(key) {
 	return normalized.includes("url") || normalized.includes("referrer") || normalized.includes("path") || normalized.includes("filename");
 }
 //#endregion
-//#region ../protocol/src/payroll/model.ts
-function toPayrollRunId(raw) {
-	return toNonEmptyStringBrand(raw, "payrollRunId", (value) => isNonEmptyString(value));
-}
-function toPayrollGroupId(raw) {
-	return toNonEmptyStringBrand(raw, "payrollGroupId", (value) => isNonEmptyString(value));
-}
-//#endregion
 //#region src/permissions/command-decoding.ts
 /** The caller's input as a command: ids branded and the intent decoded, or invalid input thrown. */
 const buildCommand = {
@@ -9748,13 +9740,15 @@ function normalizeOrgBudgetPolicy(policy) {
 		if (actionSet.has(action)) throw Errors.invalidInput("policy.actions", `duplicate Budget action: ${action}`);
 		actionSet.add(action);
 	}
+	if (policy.refill === "monthly" && limit.kind === "unlimited") throw Errors.invalidInput("policy.refill", "only a capped Budget can refill");
 	return {
 		assetId,
 		tokenAddress,
 		decimals: policy.asset.decimals,
 		limit,
 		recipients,
-		actions: ORG_BUDGET_ACTIONS.filter((action) => actionSet.has(action))
+		actions: ORG_BUDGET_ACTIONS.filter((action) => actionSet.has(action)),
+		refillPeriod: policy.refill === "monthly" ? MONTHLY_REFILL_PERIOD_SECONDS : 0n
 	};
 }
 function resolvedBudgetApprovalPermission(tokenAddress) {
@@ -9829,8 +9823,8 @@ function buildOrgBudgetCallsWithEncoder(input, encodeRoles) {
 				allowanceKey,
 				BigInt(policy.limit.rawUnits),
 				BigInt(policy.limit.rawUnits),
-				0n,
-				0n,
+				policy.refillPeriod === 0n ? 0n : BigInt(policy.limit.rawUnits),
+				policy.refillPeriod,
 				0n
 			]
 		}),
@@ -10024,13 +10018,20 @@ function buildExplicitBootstrapRoleCalls(input, encodeRoles) {
 		roles: [{
 			key: managementRoleKey,
 			members: [input.ownerAddress],
-			permissions: [{
-				targetAddress: input.rolesModuleAddress,
-				signature: "assignRoles(address,bytes32[],bool[])"
-			}, ...ROLE_MANAGEMENT_SIGNATURES.map((signature) => ({
-				targetAddress: input.rolesModuleAddress,
-				signature
-			}))]
+			permissions: [
+				{
+					targetAddress: input.rolesModuleAddress,
+					signature: "assignRoles(address,bytes32[],bool[])"
+				},
+				...ROLE_MANAGEMENT_SIGNATURES.map((signature) => ({
+					targetAddress: input.rolesModuleAddress,
+					signature
+				})),
+				...OWNER_COMMITMENT_SIGNATURES.map((signature) => ({
+					targetAddress: CAPXUL_PAYMENTS_V2_ADDRESS,
+					signature
+				}))
+			]
 		}]
 	}).map((call) => ({
 		to: toLowerHex(call.to, "setUpRoles.call.to"),
@@ -10498,7 +10499,7 @@ function matchesCurrentPolicy(intent, policy) {
 		asset: policy.asset,
 		value: policy.limit
 	}, CONFIGURED_MONEY_ASSETS).minorUnits;
-	return policy.asset === intent.asset && raw === recorded && (intent.scope === void 0 || canonicalJson(intent.scope) === canonicalJson(policy.scope));
+	return policy.asset === intent.asset && raw === recorded && intent.refill === "monthly" === (policy.refill === "monthly") && (intent.scope === void 0 || canonicalJson(intent.scope) === canonicalJson(policy.scope));
 }
 function previousPolicyForChange(effect, command) {
 	if (effect.previousIntent.type === "budget" && (effect.previousIntent.scope === void 0 || effect.previousRecipientBindings === void 0)) throw new EvidenceMismatch("Prior complete Budget proof is unavailable");
@@ -10516,8 +10517,9 @@ function policyCalls(evidence, context, command) {
 	const roleKey = effect.operation === "change" ? effect.roleKey : roleKeyForPermission(permissionId);
 	const revision = effect.operation === "change" ? effect.revision : 0;
 	if (effect.operation !== command.operation || effect.operation === "change" && effect.permissionId !== permissionId || evidence.expectedRevision !== revision) throw new EvidenceMismatch("Permission policy binding mismatch");
+	const intent = effect.operation === "change" ? keepRefillOnChange(command.intent, effect.previousCurrentPolicy) : command.intent;
 	const value = evidence.value;
-	if (Array.isArray(value) || !("type" in value) || !matchesCurrentPolicy(command.intent, value.currentPolicy) || !permissionMatches(value, context.orgId, permissionId, command.operation === "create" ? 0 : revision + 1, command.intent, roleKey)) throw new EvidenceMismatch("Permission value mismatch");
+	if (Array.isArray(value) || !("type" in value) || !matchesCurrentPolicy(intent, value.currentPolicy) || !permissionMatches(value, context.orgId, permissionId, command.operation === "create" ? 0 : revision + 1, intent, roleKey)) throw new EvidenceMismatch("Permission value mismatch");
 	const planned = compilePermissionPolicyCallsWithEncoder({
 		permissionId,
 		roleKey,
@@ -10525,7 +10527,7 @@ function policyCalls(evidence, context, command) {
 		actorSafe: evidence.userOpSenderSafe,
 		rolesModule: context.rolesModule,
 		managerRoleKey: context.managerRoleKey,
-		nextIntent: encodingIntent(command.intent, effect.recipientBindings),
+		nextIntent: encodingIntent(intent, effect.recipientBindings),
 		...previous === void 0 ? {} : { previousIntent: previous },
 		...effect.operation !== "change" || effect.previousAllowanceKey === null ? {} : { previousAllowanceKey: effect.previousAllowanceKey }
 	}, encodeRoles);
@@ -10577,7 +10579,8 @@ function encodingIntent(intent, bindings) {
 				"send",
 				"sendBatch",
 				"createCommitment"
-			].filter((action) => action === "createCommitment" ? intent.scope.actions.includes("commitments") : intent.scope.actions.includes("pay"))
+			].filter((action) => action === "createCommitment" ? intent.scope.actions.includes("commitments") : intent.scope.actions.includes("pay")),
+			...intent.refill === "monthly" ? { refill: intent.refill } : {}
 		}
 	};
 }
@@ -11232,411 +11235,6 @@ function makePermissionMethods(deps, orgId) {
 	};
 }
 //#endregion
-//#region src/payroll/run-checks.ts
-/** Match the caller's compensation to the committed V3 Payslip. */
-function payslipIdentityMatches(message, item, index, runId, period) {
-	return message.runId === runId && message.itemIndex === index && message.employeeRef === item.partyId && message.periodStart === period.start && message.periodEnd === period.end && message.adjustmentsHash === hashAdjustmentsV3(item.adjustments);
-}
-function payslipAmountMatches(message, item) {
-	const exact = toExactAssetAmount(item.amount, CONFIGURED_MONEY_ASSETS);
-	return message.gross.asset === exact.asset && message.gross.minorUnits === item.gross && message.gross.decimals === exact.decimals && message.net.asset === exact.asset && message.net.minorUnits === item.net && message.net.decimals === exact.decimals;
-}
-function isRunItem(prepared, item, evidence, index, runId, period) {
-	if (prepared === void 0) return false;
-	const bundle = evidence.preparedCommand?.documentBundles?.[index];
-	const preparedItem = evidence.preparedCommand?.items[index];
-	const payslip = bundle?.envelope;
-	if (bundle === void 0 || payslip?.primaryType !== "Payslip") return false;
-	return canonicalJson(prepared.to) === canonicalJson(item.to) && prepared.paymentType === "payroll" && canonicalJson(prepared.amount) === canonicalJson(item.amount) && bundle.adjustments !== void 0 && canonicalJson(bundle.adjustments) === canonicalJson(item.adjustments) && payslipIdentityMatches(payslip.message, item, index, runId, period) && payslipAmountMatches(payslip.message, item) && (preparedItem?.operation === "send" || preparedItem?.operation === "create_commitment") && preparedItem.documentHash === evidence.preparedCommand?.instructionDocuments?.[index]?.documentHash;
-}
-/**
-* The batch the backend derived from a payroll intent must be the batch this
-* caller asked for, checked before the digest is signed.
-*
-* The payslip envelope on each item is server-built and carries the run row's
-* own `issuedAt`, so the batch cannot be fingerprinted against a local copy
-* (`matchesIntent` is unavailable here). What CAN be verified is every field
-* the caller supplied — the org, the Budget, the request key, and per item the
-* recipient, the amount and the payslip figures — plus the lineage binding the
-* batch to the run just written. A prepared command that pays a different
-* person, a different amount, from a different Budget, or under a different
-* run never reaches the signer.
-*/
-function isRunBatch(input) {
-	return (batch, evidence) => Promise.resolve(!("kind" in batch) && batch.orgId === input.orgId && batch.permissionId === input.permissionId && batch.requestKey === input.requestKey && batch.lineage?.kind === "payroll" && batch.lineage.runId === input.runId && batch.items.length === input.items.length && batch.items.every((item) => item.amount.asset === input.asset) && input.items.every((item, index) => isRunItem(batch.items[index], item, evidence, index, input.runId, input.period)));
-}
-/** A decoded detail is the run asked for, whole: its scope, membership and quantities agree. */
-function checkPayrollRunDetail(value, orgId, runId) {
-	if (value === null) return {
-		ok: true,
-		value: null
-	};
-	if (value.orgId !== orgId || value.run.id !== runId || value.items.length === 0 || value.items.length !== value.run.recipientCount || new Set(value.items.map((item) => item.payment.id)).size !== value.items.length || value.items.some((item, index) => item.itemIndex !== index || item.amount.asset !== value.run.total.asset || item.payment.amount.asset !== item.amount.asset || item.payment.paymentType !== "payroll")) return {
-		ok: false,
-		error: Errors.invalidInput("run", "Payroll run scope or membership does not match")
-	};
-	try {
-		const total = toExactAssetAmount(value.run.total, CONFIGURED_MONEY_ASSETS);
-		let rawTotal = 0n;
-		for (const item of value.items) {
-			const amount = toExactAssetAmount(item.amount, CONFIGURED_MONEY_ASSETS);
-			const payment = toExactAssetAmount(item.payment.amount, CONFIGURED_MONEY_ASSETS);
-			if (amount.minorUnits !== payment.minorUnits) return {
-				ok: false,
-				error: Errors.invalidInput("run", "Payroll item quantity does not match its Payment")
-			};
-			rawTotal += BigInt(amount.minorUnits);
-		}
-		if (rawTotal !== BigInt(total.minorUnits)) return {
-			ok: false,
-			error: Errors.invalidInput("run", "Payroll run total does not match its items")
-		};
-	} catch {
-		return {
-			ok: false,
-			error: Errors.invalidInput("run", "Payroll run quantities are invalid")
-		};
-	}
-	return {
-		ok: true,
-		value
-	};
-}
-//#endregion
-//#region src/payroll/run-decoding.ts
-function toPayrollRun(wire) {
-	return {
-		id: toPayrollRunId(wire.id),
-		status: wire.status,
-		periodStart: wire.periodStart,
-		periodEnd: wire.periodEnd,
-		total: wire.total,
-		recipientCount: wire.recipientCount
-	};
-}
-function toPayrollRuns(wire) {
-	return {
-		...mapPage(wire, toPayrollRun),
-		settledThisMonth: wire.settledThisMonth
-	};
-}
-function toPayrollGroup(wire) {
-	return {
-		id: toPayrollGroupId(wire.id),
-		name: wire.name,
-		tone: wire.tone,
-		members: wire.members.map((member) => ({
-			partyId: member.partyId,
-			amount: member.amount,
-			currency: member.currency
-		}))
-	};
-}
-function validateRunItems(input) {
-	for (const [index, item] of input.items.entries()) {
-		if (Schema.decodeResult(PayrollRunItemInputSchema, { onExcessProperty: "error" })(item)._tag === "Failure") return Errors.invalidInput(`items.${index}`, "invalid Payroll item");
-		try {
-			const exact = toExactAssetAmount(item.amount, CONFIGURED_MONEY_ASSETS);
-			const net = BigInt(item.net);
-			const gross = BigInt(item.gross);
-			const adjustments = item.adjustments.reduce((sum, row) => sum + BigInt(row.amount), 0n);
-			if (item.amount.asset !== input.asset || item.net !== exact.minorUnits || gross + adjustments !== net) return Errors.invalidInput(`items.${index}`, "invalid Payroll units");
-		} catch {
-			return Errors.invalidInput(`items.${index}`, "invalid Payroll units");
-		}
-	}
-	return null;
-}
-const RunInputSchema = Schema.Struct({
-	permissionId: AuthorizePayrollRunExecutionInputSchema.fields.permissionId,
-	asset: AuthorizePayrollRunExecutionInputSchema.fields.asset,
-	period: AuthorizePayrollRunExecutionInputSchema.fields.period,
-	items: AuthorizePayrollRunExecutionInputSchema.fields.items,
-	requestKey: Schema.optional(AuthorizePayrollRunExecutionInputSchema.fields.requestKey)
-});
-/** Decode caller input before session or signer work. Keep routing outside the input. */
-function decodePayrollRunInput(value) {
-	try {
-		const decoded = Schema.decodeUnknownSync(RunInputSchema, { onExcessProperty: "error" })(value);
-		const input = {
-			permissionId: decoded.permissionId,
-			asset: decoded.asset,
-			period: decoded.period,
-			...decoded.requestKey === void 0 ? {} : { requestKey: decoded.requestKey },
-			items: decoded.items.map((item) => ({
-				amount: item.amount,
-				gross: item.gross,
-				net: item.net,
-				adjustments: item.adjustments,
-				partyId: toPartyId(item.partyId),
-				to: item.to.kind === "party" ? {
-					kind: "party",
-					partyId: toPartyId(item.to.partyId)
-				} : item.to.kind === "address" ? {
-					kind: "address",
-					address: toAddress(item.to.address)
-				} : item.to
-			}))
-		};
-		if (input.items.length === 0 || input.period.start > input.period.end) throw Errors.invalidInput("input", "Payroll requires items and an ordered period");
-		const error = validateRunItems(input);
-		if (error !== null) throw error;
-		return input;
-	} catch (cause) {
-		throw cause instanceof CapxulError ? cause : Errors.invalidInput("input", "Invalid Payroll input");
-	}
-}
-/** Read only the exact backend prepare receipt, never an arbitrary signer failure. */
-function payrollResolution(error, requestKey) {
-	const details = error.details;
-	if (error.code !== "WRONG_STATE" || details?.method !== runs.authorize.name || details.requestKey !== requestKey || typeof details.commandId !== "string" || typeof details.runId !== "string") return void 0;
-	return details.payrollResolution === "failed" || details.payrollResolution === "settled" ? details.payrollResolution : void 0;
-}
-function validatePayrollRunLookup(orgId, runId) {
-	return !Schema.is(PayrollRunIdSchema)(runId) || orgId.length === 0 ? {
-		ok: false,
-		error: Errors.invalidInput("runId", "Organization and run ID must be valid")
-	} : {
-		ok: true,
-		value: void 0
-	};
-}
-/** Strict saved detail decoder shared by the read and fresh stream. */
-function decodePayrollRunDetail(raw, orgId, runId) {
-	const decoded = Schema.decodeUnknownResult(Schema.NullOr(PayrollRunDetailSchema), { onExcessProperty: "error" })(raw);
-	if (decoded._tag === "Failure") return {
-		ok: false,
-		error: Errors.invalidInput("run", "Invalid Payroll run detail")
-	};
-	return checkPayrollRunDetail(decoded.success, orgId, runId);
-}
-//#endregion
-//#region src/payroll/run-subscription.ts
-function detailValue(result) {
-	if (!result.ok) throw result.error;
-	return result.value;
-}
-function subscribePayrollRun(deps, orgId, runId, listener, options) {
-	const operation = CAPXUL_OPERATIONS.org.payroll.subscribeRun;
-	const valid = deps.validate(orgId, runId);
-	if (!valid.ok) return runCapxulEffect(Effect.fail(valid.error), observationOnlyControls(deps.invocationControls?.(options) ?? options), operation, deps.runPromise);
-	const decode = (raw) => detailValue(deps.decode(raw, orgId, runId));
-	return subscribeFreshQuery(deps, {
-		orgId,
-		runId
-	}, listener, operation, {
-		decode,
-		validateCached: (raw) => {
-			decode(raw);
-		},
-		invalidValue: (cause) => isCapxulError(cause) ? cause : Errors.invalidInput("run", "Invalid Payroll run detail"),
-		invalidScope: () => Errors.invalidInput("run", "Payroll run subscription scope does not match"),
-		lostValue: () => Errors.invalidInput("run", "Payroll run is no longer readable"),
-		unavailable: () => Errors.notImplemented("payroll", "subscribeRun")
-	}, options);
-}
-//#endregion
-//#region src/payroll/run-authorization.ts
-/**
-* Authorize one payroll run: a stable request key, the prepared batch checked
-* against the run the caller asked for, the signature, and the submission.
-*/
-async function authorizePayrollRun(scope, input, controls, onRequestKey, onResolved) {
-	const { deps, orgId, requestKeyScope } = scope;
-	const signal = controls?.signal;
-	const execution = executionDependencies(deps);
-	if (execution === null) return {
-		ok: false,
-		error: Errors.notImplemented("payroll", "executionComposition")
-	};
-	try {
-		input = decodePayrollRunInput(input);
-	} catch (cause) {
-		return {
-			ok: false,
-			error: asCapxulError(cause)
-		};
-	}
-	const { requestKey: provided, ...canonicalInput } = input;
-	const actorId = onRequestKey === void 0 ? void 0 : execution.actor.authSession()?.authUserId;
-	if (onRequestKey !== void 0 && actorId === void 0) return {
-		ok: false,
-		error: Errors.notAuthenticated()
-	};
-	const requestKey = await paymentRequestKeyLifecycle(`${requestKeyScope}:${AUTHORIZE_RUN}`, onRequestKey === void 0 ? {
-		orgId,
-		input
-	} : {
-		actorId,
-		orgId,
-		input: canonicalInput
-	}, provided, onRequestKey === void 0 ? void 0 : { manageProvidedKey: true });
-	try {
-		await onRequestKey?.(requestKey.key);
-		if (onRequestKey !== void 0 && execution.actor.authSession()?.authUserId !== actorId) {
-			await requestKey.finish(false).catch(() => void 0);
-			return {
-				ok: false,
-				error: Errors.notAuthenticated()
-			};
-		}
-	} catch (cause) {
-		await requestKey.finish(false).catch(() => void 0);
-		return {
-			ok: false,
-			error: asCapxulError(cause)
-		};
-	}
-	let authorized;
-	let acceptedReplay;
-	let preparedClosed = false;
-	let terminalReplay;
-	const submitted = await executePrepared(execution, async (signerAddress) => {
-		const prepared = await runIfActive(signal, AUTHORIZE_RUN, () => withInvocationParentSpan(Effect.suspend(() => callOperation(deps.convexCall, runs.authorize, copyInvocationObservation(controls, {
-			orgId,
-			permissionId: input.permissionId,
-			asset: input.asset,
-			requestKey: requestKey.key,
-			signerAddress,
-			period: input.period,
-			items: input.items
-		}))).pipe(Effect.mapError((publicError) => ({ publicError }))), controls), deps.runPromise);
-		if (!prepared.ok) {
-			terminalReplay = payrollResolution(prepared.error, requestKey.key);
-			return prepared;
-		}
-		authorized = prepared.value.run;
-		acceptedReplay = prepared.value.replay.kind === "accepted" ? prepared.value.replay.submission : void 0;
-		return {
-			ok: true,
-			value: prepared.value.execution
-		};
-	}, (request, evidence) => authorized === void 0 || authorized.periodStart !== input.period.start || authorized.periodEnd !== input.period.end ? Promise.resolve(false) : isRunBatch({
-		orgId,
-		permissionId: input.permissionId,
-		requestKey: requestKey.key,
-		runId: authorized.id,
-		asset: input.asset,
-		period: input.period,
-		items: input.items
-	})(request, evidence), true, () => preparedClosed = true, signal, controls, void 0, () => acceptedReplay);
-	const resolution = preparedClosed ? "failed" : terminalReplay;
-	if (resolution !== void 0) try {
-		await onResolved?.(resolution);
-	} catch {}
-	try {
-		await requestKey.finish(submitted.ok || resolution !== void 0);
-	} catch {}
-	if (!submitted.ok) return submitted;
-	return authorized === void 0 ? {
-		ok: false,
-		error: Errors.unknown()
-	} : {
-		ok: true,
-		value: toPayrollRun(authorized)
-	};
-}
-const AUTHORIZE_RUN = runs.authorize.name;
-function executionDependencies(deps) {
-	return deps.actor === void 0 || deps.chainId === void 0 || deps.signer === void 0 ? null : {
-		actor: deps.actor,
-		chainId: deps.chainId,
-		convexCall: deps.convexCall,
-		runPromise: deps.runPromise,
-		signer: deps.signer,
-		...deps.telemetry === void 0 ? {} : { telemetry: deps.telemetry }
-	};
-}
-//#endregion
-//#region src/payroll/runs.ts
-function makePayrollMethods(deps, orgId) {
-	const requestKeyScope = deps.requestKeyScope ?? `client-${crypto.randomUUID()}`;
-	/** One observed call of one payroll row, its reply projected inside the call, under the row's name. */
-	const call = (row, args, options, project) => {
-		const controls = deps.invocationControls?.(options) ?? options;
-		return runPortEffect(callOperation(deps.convexCall, row, copyInvocationObservation(controls, args)).pipe(Effect.map(project), Effect.mapError((publicError) => ({ publicError }))), controls, row.name, deps.runPromise);
-	};
-	return {
-		subscribeRun: (runId, listener, options) => subscribePayrollRun({
-			actor: deps.actor,
-			convexCall: deps.convexCall,
-			query: reference(runs.get),
-			runPromise: deps.runPromise,
-			invocationControls: deps.invocationControls,
-			decode: decodePayrollRunDetail,
-			validate: validatePayrollRunLookup
-		}, orgId, runId, listener, options),
-		getRun: (runId, options) => {
-			const controls = deps.invocationControls?.(options) ?? options;
-			const lifetime = deps.actor?.authLifetime();
-			const operation = runs.get.name;
-			return runCapxulEffect(Effect.gen(function* () {
-				const lookup = validatePayrollRunLookup(orgId, runId);
-				if (!lookup.ok) return yield* Effect.fail(lookup.error);
-				if (lifetime === void 0 || lifetime.authUserId === null || deps.actor === void 0) return yield* Effect.fail(Errors.notAuthenticated());
-				const current = () => deps.actor?.matchesAuthLifetime(lifetime, lifetime.authUserId) === true;
-				if (!current()) return yield* Effect.fail(Errors.notAuthenticated());
-				const parent = yield* Effect.currentSpan.pipe(Effect.orDie);
-				const captured = carryInvocationParentSpan(controls, parent);
-				const run = yield* awaitCapxulResult(() => runIfActive(controls?.signal, operation, () => withInvocationParentSpan(Effect.suspend(() => callOperation(deps.convexCall, runs.get, copyInvocationObservation(captured, {
-					orgId,
-					runId
-				}))).pipe(Effect.mapError((publicError) => ({ publicError }))), captured), deps.runPromise));
-				if (!current()) return yield* Effect.fail(Errors.cancelled({ operation }));
-				const checked = checkPayrollRunDetail(run, orgId, runId);
-				return yield* checked.ok ? Effect.succeed(checked.value) : Effect.fail(checked.error);
-			}), observationOnlyControls(controls), operation, deps.runPromise);
-		},
-		runs: (options) => call(runs.list, { orgId }, options, toPayrollRuns),
-		authorizeRun: (input, options) => {
-			const controls = deps.invocationControls?.(options) ?? options;
-			return runCapxulEffect(Effect.gen(function* () {
-				if (controls?.signal?.aborted === true) return yield* Effect.fail(Errors.cancelled({ operation: AUTHORIZE_RUN }));
-				const parent = yield* Effect.currentSpan.pipe(Effect.orDie);
-				return yield* awaitCapxulResult(() => authorizePayrollRun({
-					deps,
-					orgId,
-					requestKeyScope
-				}, input, carryInvocationParentSpan(controls, parent), options?.onRequestKey, options?.onResolved));
-			}), observationOnlyControls(controls), AUTHORIZE_RUN, deps.runPromise);
-		},
-		terms: (options) => call(terms.list, { orgId }, options, (rates) => rates),
-		groups: {
-			list: (options) => call(groups.list, { orgId }, options, (saved) => mapPage(saved, toPayrollGroup)),
-			save: (input, options) => call(groups.save, {
-				orgId,
-				...input.id === void 0 ? {} : { id: String(input.id) },
-				name: input.name,
-				tone: input.tone,
-				members: input.members
-			}, options, toPayrollGroup),
-			remove: (id, options) => call(groups.remove, {
-				orgId,
-				id
-			}, options, () => void 0)
-		}
-	};
-}
-const payrollUnavailable = () => Promise.resolve({
-	ok: false,
-	error: Errors.notImplemented("payroll", "executionComposition")
-});
-/** The bundle an unconfigured client exposes — every verb refuses, none throws. */
-function makeUnavailablePayrollMethods() {
-	return {
-		getRun: payrollUnavailable,
-		subscribeRun: payrollUnavailable,
-		runs: payrollUnavailable,
-		authorizeRun: payrollUnavailable,
-		terms: payrollUnavailable,
-		groups: {
-			list: payrollUnavailable,
-			save: payrollUnavailable,
-			remove: payrollUnavailable
-		}
-	};
-}
-//#endregion
 //#region src/signing/embedded-wallet.ts
 function openfortEmbeddedWalletPort(input) {
 	return {
@@ -12574,6 +12172,22 @@ function normalizeRuntimeUrl(field, raw) {
 }
 //#endregion
 //#region src/applications/bootstrap-adapter.ts
+/** A cached envelope this close to its expiry is fetched again, so it cannot lapse mid-command. */
+const CACHE_EXPIRY_MARGIN_MS = 3e4;
+/**
+* The cached envelope, when it is still inside its own lifetime. It is decoded
+* as a fresh body is; anything that does not decode, or a store that fails,
+* is a miss.
+*/
+async function cachedEnvelope(cache, now) {
+	try {
+		const cached = decodeBootstrapBody(await cache.load());
+		const expiresAt = cached.issuedAt + cached.expiresIn - CACHE_EXPIRY_MARGIN_MS;
+		return cached.issuedAt <= now && now < expiresAt ? cached : null;
+	} catch {
+		return null;
+	}
+}
 const DEFAULT_RETRY = {
 	attempts: 2,
 	baseDelayMs: 400
@@ -12614,19 +12228,24 @@ var HttpBootstrapAdapter = class {
 	fetchImpl;
 	observation;
 	retry;
+	cache;
 	constructor(deps) {
 		this.bootstrapBaseUrl = deps.bootstrapBaseUrl.replace(/\/$/, "");
 		this.bootstrapHost = hostOf(this.bootstrapBaseUrl);
 		this.observation = deps.observation;
 		this.retry = deps.retry ?? DEFAULT_RETRY;
+		this.cache = deps.cache;
 		this.fetchImpl = deps.fetch ?? ((input, init) => globalThis.fetch(input, init));
 	}
 	resolve(input) {
-		return this.attempt(input).pipe(Effect.retry({
+		const fetched = this.attempt(input).pipe(Effect.retry({
 			times: this.retry.attempts,
 			while: isTransientBootstrapFailure,
 			schedule: Schedule.exponential(Duration.millis(this.retry.baseDelayMs))
 		}));
+		const cache = this.cache;
+		if (cache === void 0) return fetched;
+		return Effect.promise(() => cachedEnvelope(cache, Date.now())).pipe(Effect.filterOrElse((cached) => cached !== null, () => fetched));
 	}
 	attempt(input) {
 		return Effect.tryPromise({
@@ -12651,7 +12270,13 @@ var HttpBootstrapAdapter = class {
 	}
 	mapResponse(res, input) {
 		if (res.ok) return Effect.tryPromise({
-			try: async () => decodeBootstrapBody(await res.json()),
+			try: async () => {
+				const body = await res.json();
+				const resolution = decodeBootstrapBody(body);
+				const cache = this.cache;
+				if (cache !== void 0) await Promise.resolve().then(() => cache.save(body)).catch(() => void 0);
+				return resolution;
+			},
 			catch: (cause) => {
 				if (cause instanceof CapxulError && cause.code === "INVALID_INPUT") return bootstrapErrorFromCapxul("invalidInput", cause);
 				return bootstrapErrorFromCapxul("malformedBody", Errors.providerError("convex", "bootstrap", cause instanceof Error ? cause : new Error(String(cause))));
@@ -14320,7 +13945,9 @@ function makeNotImplementedOrganizationPaymentsMethods() {
 		subscribe: organizationPaymentExecutionUnavailable,
 		pay: organizationPaymentExecutionUnavailable,
 		payBatch: organizationPaymentExecutionUnavailable,
-		retry: organizationPaymentExecutionUnavailable
+		retry: organizationPaymentExecutionUnavailable,
+		cancel: organizationPaymentExecutionUnavailable,
+		redirect: organizationPaymentExecutionUnavailable
 	};
 }
 const orgMeUnavailable = () => Promise.resolve({
@@ -15223,6 +14850,23 @@ function subscribeConvexQuery(client, fn, args, callback, options) {
 * ever needs a different one.
 */
 const DEFAULT_CLOSE_TIMEOUT_MS = 5e3;
+/**
+* The fetcher the Convex client's auth handshake gets. Convex first asks for
+* "a possibly cached token" (`forceRefreshToken: false`) and, as soon as the
+* server accepts it, for a fresh one (`true`): the token whose `exp` it
+* schedules the next refresh from. The Better Auth clients keep no token: each
+* ask mints one over the network, so the cached ask was a second token fetch
+* and a second server verification (a JWKS read) on every session restore. It
+* answers "none" instead, and Convex makes its one fetch forced, as a fresh
+* token. Every forced ask still reaches the auth client: that first fetch, the
+* refresh before `exp`, and the retry after the server rejects a token.
+* ponytail: the OAuth bearer client can hold a cached exchange; it now pays one
+* exchange for the first authentication instead of reusing it (never more
+* fetches than before). Pass the cache through if that start ever matters.
+*/
+function freshTokenHandshake(fetchToken) {
+	return async (args) => args.forceRefreshToken ? fetchToken(args) : null;
+}
 /** Run a Convex call under the current trace parent, when there is one. */
 const withTraceparent = (run) => Effect.flatMap(Effect.serviceOption(Tracer.ParentSpan), (parent) => run(parent._tag === "Some" ? formatTraceparent(parent.value) : void 0));
 var ConvexCallAdapter = class {
@@ -15247,10 +14891,10 @@ var ConvexCallAdapter = class {
 		this.#tokenProvider = deps.tokenProvider;
 		this.#applicationId = deps.applicationId;
 		this.#observation = deps.observation;
-		if (this.#tokenProvider) this.#client.setAuth(this.#tokenProvider);
+		this.refreshAuth();
 	}
 	refreshAuth() {
-		if (this.#tokenProvider) this.#client.setAuth(this.#tokenProvider);
+		if (this.#tokenProvider) this.#client.setAuth(freshTokenHandshake(this.#tokenProvider));
 	}
 	observeConnection(observer) {
 		return this.#connectionMonitor.observe(this.#client, observer);
@@ -16807,7 +16451,8 @@ async function createProductionAdapters(input) {
 	const bootstrapLayer = HttpBootstrapLayer({
 		bootstrapBaseUrl: resolvedInput.value.bootstrapBaseUrl,
 		...input.fetch === void 0 ? {} : { fetch: input.fetch },
-		...invocationObservation === void 0 ? {} : { observation: invocationObservation }
+		...invocationObservation === void 0 ? {} : { observation: invocationObservation },
+		...input.bootstrapCache === void 0 ? {} : { cache: input.bootstrapCache }
 	});
 	try {
 		const bootstrapContext = await Effect.runPromise(Layer.buildWithScope(bootstrapLayer, scope));
@@ -17699,4 +17344,4 @@ async function createCapxulClient(input) {
 	return createCapxulClientWithSignerControls(input, {});
 }
 //#endregion
-export { decodePermissionIntent as _, cloneTelemetryEvent as a, identityErrorFromCapxul as c, devPrivateKeySigner as d, createOpenfortBrowserSigner as f, decodePayrollRunInput as g, openfortEmbeddedWalletPort as h, postHogObservability as i, bootstrapErrorFromCapxul as l, openfortEmbeddedSignerFromWallet as m, createCapxulClientWithSignerControls as n, cloneTelemetryProps as o, embeddedSigner as p, assembleCapxulClient as r, IdentityPortTag as s, createCapxulClient as t, deriveDevPrivateKey as u, toPayrollGroupId as v };
+export { cloneTelemetryEvent as a, identityErrorFromCapxul as c, devPrivateKeySigner as d, createOpenfortBrowserSigner as f, decodePermissionIntent as g, openfortEmbeddedWalletPort as h, postHogObservability as i, bootstrapErrorFromCapxul as l, openfortEmbeddedSignerFromWallet as m, createCapxulClientWithSignerControls as n, cloneTelemetryProps as o, embeddedSigner as p, assembleCapxulClient as r, IdentityPortTag as s, createCapxulClient as t, deriveDevPrivateKey as u };