@capxul/sdk 4.20.0-beta.27 → 4.20.0-beta.28

package/dist/{access-BnlgphFT.mjs → access-SP-ur4Ku.mjs}

@@ -1,4 +1,4 @@
-import { Cause, Clock, Context, Data, Deferred, Effect, Exit, Fiber, Layer, Option, Predicate, Queue, Ref, Result, Schema, SchemaGetter, SchemaParser } from "effect";
+import { Cause, Clock, Context, Data, Deferred, Effect, Exit, Fiber, Layer, Option, Predicate, Queue, Ref, Result, Schema, SchemaGetter, SchemaIssue, SchemaParser } from "effect";
 import { makeFunctionReference } from "convex/server";
 import { bytesToHex, concat, decodeErrorResult, encodeAbiParameters, encodeFunctionData, encodePacked, formatUnits, getContractAddress, hashTypedData, isAddress, isHex, keccak256, pad, padHex, parseAbiParameters, recoverAddress, recoverTypedDataAddress, toBytes, toFunctionSignature, toHex } from "viem";
 import { getUserOperationHash } from "viem/account-abstraction";
@@ -858,7 +858,7 @@ const FIELD_RULES = {
 	},
 	anonymousId: {
 		maxLength: 128,
-		pattern: /^anon_[A-Za-z0-9-]+$/u
+		pattern: /^(?:anon_[A-Za-z0-9-]+|[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})$/u
 	},
 	traceparent: {
 		maxLength: 55,
@@ -5525,6 +5525,28 @@ const probes = {
 	})
 };
 //#endregion
+//#region ../protocol/src/evm/role-dsl.ts
+const ORG_BUDGET_ACTIONS = [
+	"send",
+	"sendBatch",
+	"createCommitment"
+];
+/**
+* How a capped Budget's allowance refills (#2298). `monthly` refills the
+* allowance to its cap every 30 days. Roles v2 counts fixed periods from the
+* moment the allowance is set; it has no calendar month. Absent means `none`:
+* the cap is one pot that spending drains for good.
+*/
+const ORG_BUDGET_REFILLS = ["monthly", "none"];
+/** The fixed Roles v2 refill period of a `monthly` Budget: 30 days, in seconds. */
+const MONTHLY_REFILL_PERIOD_SECONDS = 30n * 24n * 60n * 60n;
+/** Derive the Zodiac substrate key for one durable Permission identity. */
+function roleKeyForPermission(permissionId) {
+	const normalized = permissionId.trim();
+	if (normalized.length === 0 || normalized !== permissionId) throw Errors.invalidInput("permissionId", "must be a non-empty canonical Permission ID");
+	return keccak256(toBytes(`permission ${permissionId}`));
+}
+//#endregion
 //#region ../protocol/src/permissions/permission-schema.ts
 /**
 * One stored `setAllowance` call inside a command's expected authority set.
@@ -5563,12 +5585,19 @@ const BudgetScopeSchema = Schema.Struct({
 	})]),
 	actions: Schema.NonEmptyArray(Schema.Literals(["pay", "commitments"]))
 }).pipe(Schema.refine((scope) => new Set(scope.actions).size === scope.actions.length && (scope.recipients.type === "anyone" || scope.recipients.accounts.length >= 1 && scope.recipients.accounts.length <= 32 && new Set(scope.recipients.accounts).size === scope.recipients.accounts.length), { message: "Budget scope requires unique actions and one to 32 unique allowed Accounts" }));
+/**
+* How a capped Budget refills (#2298): `monthly` tops the cap back up every 30
+* days (a fixed Roles v2 period, not a calendar month); `none` never refills.
+* Absent means `none`, and writers store only `monthly`.
+*/
+const BudgetRefillSchema = Schema.Literals(ORG_BUDGET_REFILLS);
 /** The accepted product policy stored with one Permission revision. */
 const CurrentPolicySchema = Schema.Union([Schema.Struct({
 	type: Schema.Literal("budget"),
 	asset: AssetIdSchema,
 	limit: Schema.NullOr(Schema.String),
-	scope: BudgetScopeSchema
+	scope: BudgetScopeSchema,
+	refill: Schema.optional(BudgetRefillSchema)
 }), Schema.Struct({ type: Schema.Literal("managePeople") })]);
 const BudgetIntentSchema = CurrentPolicySchema.pipe(Schema.refine((value) => {
 	if (value.type !== "budget") return false;
@@ -5633,7 +5662,8 @@ const ResolvedPermissionBudgetPolicySchema = Schema.Struct({
 		"send",
 		"sendBatch",
 		"createCommitment"
-	]))
+	])),
+	refill: Schema.optional(BudgetRefillSchema)
 });
 const PermissionRecipientBindingSchema = Schema.Struct({
 	accountId: AccountIdSchema$1,
@@ -5645,16 +5675,22 @@ const StoredPermissionIntentSchema = Schema.Union([Schema.Struct({
 	type: Schema.Literal("budget"),
 	asset: AssetIdSchema,
 	limit: Schema.NullOr(AssetAmountSchema),
-	scope: Schema.optional(BudgetScopeSchema)
+	scope: Schema.optional(BudgetScopeSchema),
+	refill: Schema.optional(BudgetRefillSchema)
 }).pipe(Schema.refine((intent) => intent.limit === null || intent.limit.asset === intent.asset, { message: "Budget limit must use the Budget asset" })), Schema.Struct({ type: Schema.Literal("managePeople") })]);
 /** Writes state every granted right and use a finite positive AssetAmount cap. */
 const PermissionIntentSchema = Schema.Union([Schema.Struct({
 	type: Schema.Literal("budget"),
 	asset: AssetIdSchema,
 	limit: AssetAmountSchema,
-	scope: BudgetScopeSchema
+	scope: BudgetScopeSchema,
+	refill: Schema.optional(BudgetRefillSchema)
 }).pipe(Schema.refine((intent) => intent.limit.asset === intent.asset && /[1-9]/u.test(intent.limit.value), { message: "Budget cap must be positive and use the Budget asset" })), Schema.Struct({ type: Schema.Literal("managePeople") })]);
-/** Decode once and give set-like scope fields one stable command representation. */
+/**
+* Decode once and give set-like scope fields one stable command representation.
+* An explicit `refill: "none"` is kept: on a change it turns a refill off,
+* where a missing `refill` keeps the Budget's current one (`keepRefillOnChange`).
+*/
 function decodePermissionIntent(input) {
 	const intent = Schema.decodeUnknownSync(PermissionIntentSchema, { onExcessProperty: "error" })(input);
 	if (intent.type === "managePeople") return intent;
@@ -5669,6 +5705,19 @@ function decodePermissionIntent(input) {
 		}
 	});
 }
+/**
+* A Budget change that leaves `refill` out keeps the Budget's current refill:
+* a change never turns a refill off by omission. An explicit `"none"` turns it
+* off. The backend plans, the SDK verifies and the CLI confirms the same
+* result. A create has no current refill, so a missing one means `none`.
+*/
+function keepRefillOnChange(intent, before) {
+	if (intent.type !== "budget" || intent.refill !== void 0 || before?.type !== "budget" || before.refill !== "monthly") return intent;
+	return {
+		...intent,
+		refill: before.refill
+	};
+}
 //#endregion
 //#region ../protocol/src/permissions/replacement-schema.ts
 const InvitationPhaseSchema = Schema.Literals([
@@ -5873,7 +5922,7 @@ const InviteGrantsSchema = Schema.Array(Schema.Union([
 	Schema.Struct({
 		type: Schema.Literal("new_budget"),
 		label: Schema.String.pipe(Schema.refine((value) => value.trim().length >= 1 && value.trim().length <= 128)),
-		intent: BudgetIntentSchema
+		intent: BudgetIntentSchema.pipe(Schema.refine((intent) => intent.refill !== "monthly", { message: "An invitation's new Budget cannot refill; change it once granted" }))
 	})
 ])).pipe(Schema.refine((grants) => {
 	if (grants.length < 1 || grants.length > 16) return false;
@@ -8964,7 +9013,9 @@ const PEOPLE_OPERATIONS = {
 			emitSafeConfirmed: "accounts.safes.emitSafeConfirmed",
 			readSafe: "accounts.safes.readSafe",
 			recordDeployment: "accounts.safes.recordDeployment"
-		}
+		},
+		/** The home's requests to pay and Payments to retry, read in one query. */
+		summaries: { loadNeedsYou: "accounts.summaries.loadNeedsYou" }
 	},
 	/** The host observer's names for `client.approvals.*`. */
 	approvals: {
@@ -9223,7 +9274,9 @@ emitSaved: "activity.annotations.emitSaved" },
 		pay: "organizationPayments.pay",
 		payBatch: "organizationPayments.payBatch",
 		prepareExecution: "organizationPayments.prepareExecution",
-		retry: "organizationPayments.retry"
+		retry: "organizationPayments.retry",
+		cancel: "organizationPayments.cancel",
+		redirect: "organizationPayments.redirect"
 	},
 	/**
 	* Payments' internal functions and the client's own method names; its public
@@ -9245,7 +9298,9 @@ emitSaved: "activity.annotations.emitSaved" },
 			loadContext: "payments.commands.loadContext",
 			loadExecutionContext: "payments.commands.loadExecutionContext",
 			/** The capped Budget a prepared Organization command spends from, before its allowance is read on chain. */
-			loadBudgetAllowance: "payments.commands.loadBudgetAllowance"
+			loadBudgetAllowance: "payments.commands.loadBudgetAllowance",
+			/** What a new Payment command would spend and from which Safe, read before it is born. */
+			loadBirthFunding: "payments.commands.loadBirthFunding"
 		},
 		lifecycles: { prepareIntent: "payments.lifecycles.prepareIntent" },
 		/** The stored UserOperation of every money command: Payment, Permission and configuration. */
@@ -9604,6 +9659,13 @@ const OptionalReasonCode = Schema.optional(Schema.Literals(CAPXUL_ERROR_CODES));
 * no catalog schema validates it.
 */
 const EXCEPTION_EVENT_NAME = "$exception";
+/**
+* The SDK's twin of `capxul_backend_expected_outcome`: an expected outcome the
+* SDK's failure projection captures through the host's PostHog client. Like
+* the backend's, its properties are the error evidence, so no catalog schema
+* validates it.
+*/
+const SDK_EXPECTED_OUTCOME_EVENT_NAME = "capxul_sdk_expected_outcome";
 const PII = Schema.String.pipe(Schema.brand("PII"));
 /**
 * The canonical envelope (ADR-0020 A4): snake_case ONLY. `capxul_env` and
@@ -9703,6 +9765,42 @@ const UiStepProps = {
 	organization_id: OptionalOrgId,
 	reason_code: OptionalReasonCode
 };
+/**
+* A journey's variants (`JOURNEYS`): the way a person came into a journey, or
+* the way they took through it. A variant is a property of the journey's step
+* events, never a journey of its own, so each journey funnel breaks down by
+* it. A step event takes only the variants that a journey contract names on
+* it, picked one by one; the analytics plan test checks both directions.
+* `pay_path` and `funding_source` have no carrier until their Phase 2 events.
+* `payment_*` events already carry `recipient_is_capxul_account`, and
+* `invoice_issued` carries `issuer_scope_kind`; neither is repeated here.
+*/
+const JourneyVariantProps = {
+	/** How a person came to Get started: by themselves, an invite, money that waited, or an invoice. */
+	entry_path: Schema.optional(Schema.Literals([
+		"signup",
+		"invite",
+		"claim",
+		"invoice"
+	])),
+	/** Where the person acted. `agent` is an AI agent driving the CLI. */
+	surface: Schema.optional(Schema.Literals([
+		"web",
+		"cli",
+		"agent"
+	])),
+	/** Who pays: a person from their own account, or an Organization from a Budget. */
+	payer_kind: Schema.optional(Schema.Literals(["person", "organization"])),
+	/** How a request was paid: from the payer's inbox, or by its link at checkout. */
+	pay_path: Schema.optional(Schema.Literals(["inbox", "link"])),
+	/** Where an account's first money came from. `bank` is the planned on-ramp. */
+	funding_source: Schema.optional(Schema.Literals([
+		"deposit",
+		"payment",
+		"claim",
+		"bank"
+	]))
+};
 //#endregion
 //#region ../observability/src/events/money.ts
 /**
@@ -9792,6 +9890,8 @@ const PaymentInitiatedProps = Schema.Struct({
 	execution_id: OptionalString,
 	payment_lifecycle_id: OptionalString,
 	...TelemetryEnvelopeProps,
+	payer_kind: JourneyVariantProps.payer_kind,
+	surface: JourneyVariantProps.surface,
 	...RecipientTelemetryProps,
 	kind: Schema.String,
 	payment_id: Schema.String
@@ -9807,6 +9907,8 @@ const PaymentLifecycleProps = {
 const PaymentSettledL2Props = Schema.Struct({
 	...PaymentLifecycleProps,
 	...TelemetryEnvelopeProps,
+	payer_kind: JourneyVariantProps.payer_kind,
+	surface: JourneyVariantProps.surface,
 	...RecipientTelemetryProps,
 	kind: Schema.String,
 	chain_id: Schema.Finite,
@@ -10014,6 +10116,7 @@ const OrganizationCreationStartedProps = Schema.Struct({
 });
 const OrganizationCreationReadyProps = Schema.Struct({
 	...TelemetryEnvelopeProps,
+	surface: JourneyVariantProps.surface,
 	$insert_id: Schema.String,
 	organization_id: OrgIdTelemetrySchema,
 	attempt_number: AttemptNumberSchema,
@@ -10038,45 +10141,6 @@ const OrganizationCreationFailedProps = Schema.Struct({
 		...ORGANIZATION_SETUP_REASONS
 	]))
 });
-const OrgCreateStartedProps = Schema.Struct({
-	...TelemetryEnvelopeProps,
-	org_id: OptionalOrgId,
-	email_domain: OptionalString,
-	template: OptionalString
-});
-const OrgSafeCreatedProps = Schema.Struct({
-	...TelemetryEnvelopeProps,
-	org_id: OptionalOrgId,
-	chainId: OptionalChainId,
-	safe_address: OptionalAddress
-});
-const OrgSafeConfirmedProps = Schema.Struct({
-	...TelemetryEnvelopeProps,
-	org_id: OptionalOrgId,
-	chainId: OptionalChainId,
-	safe_address: OptionalAddress,
-	durationMs: OptionalDurationMs
-});
-const OrgRolesSeededProps = Schema.Struct({
-	...TelemetryEnvelopeProps,
-	org_id: OptionalOrgId,
-	chainId: OptionalChainId,
-	role: OptionalString,
-	txHash: OptionalTxHash
-});
-const OrgCreatedProps = Schema.Struct({
-	...TelemetryEnvelopeProps,
-	org_id: OptionalOrgId,
-	chainId: OptionalChainId,
-	safe_address: OptionalAddress,
-	durationMs: OptionalDurationMs
-});
-const OrgCreateFailedProps = Schema.Struct({
-	...TelemetryEnvelopeProps,
-	...ChainCauseTelemetryProps,
-	org_id: OptionalOrgId,
-	reason: OptionalString
-});
 const OrgInviteSentProps = Schema.Struct({
 	...TelemetryEnvelopeProps,
 	org_id: OptionalOrgId,
@@ -10121,30 +10185,6 @@ Schema.Struct({
 	name: Schema.Literal("organization_creation_failed"),
 	props: OrganizationCreationFailedProps
 });
-Schema.Struct({
-	name: Schema.Literal("org_create_started"),
-	props: OrgCreateStartedProps
-});
-Schema.Struct({
-	name: Schema.Literal("org_safe_created"),
-	props: OrgSafeCreatedProps
-});
-Schema.Struct({
-	name: Schema.Literal("org_safe_confirmed"),
-	props: OrgSafeConfirmedProps
-});
-Schema.Struct({
-	name: Schema.Literal("org_roles_seeded"),
-	props: OrgRolesSeededProps
-});
-Schema.Struct({
-	name: Schema.Literal("org_created"),
-	props: OrgCreatedProps
-});
-Schema.Struct({
-	name: Schema.Literal("org_create_failed"),
-	props: OrgCreateFailedProps
-});
 Schema.Struct({
 	name: Schema.Literal("org_invite_sent"),
 	props: OrgInviteSentProps
@@ -11018,10 +11058,14 @@ const BootstrapFailedProps = Schema.Struct({
 });
 const MemberActivationStartedProps = Schema.Struct({
 	...TelemetryEnvelopeProps,
+	entry_path: JourneyVariantProps.entry_path,
+	surface: JourneyVariantProps.surface,
 	$insert_id: Schema.String
 });
 const MemberActivationReadyProps = Schema.Struct({
 	...TelemetryEnvelopeProps,
+	entry_path: JourneyVariantProps.entry_path,
+	surface: JourneyVariantProps.surface,
 	$insert_id: Schema.String,
 	duration_ms: DurationMsSchema
 });
@@ -12567,7 +12611,7 @@ function mapAccountLifecycle(input) {
 }
 //#endregion
 //#region package.json
-var version = "4.20.0-beta.27";
+var version = "4.20.0-beta.28";
 //#endregion
 //#region src/observability/telemetry/exception-projection.ts
 /** Fixed fallback for failures that have no safe message. */
@@ -13005,7 +13049,7 @@ const REVERT_SELECTOR_RE = /^0x(?:[0-9a-fA-F]{8})?$/u;
 //#region src/observability/posthog-failure.ts
 /** The expected-outcome codes, read as plain strings so a free-form kind can be looked up. */
 /** Stable PostHog event used for typed failures that are expected product outcomes. */
-const CAPXUL_SDK_EXPECTED_OUTCOME_EVENT = "capxul_sdk_expected_outcome";
+const CAPXUL_SDK_EXPECTED_OUTCOME_EVENT = SDK_EXPECTED_OUTCOME_EVENT_NAME;
 /**
 * Adapt the host's already-initialized PostHog-like client. This function does
 * not import, initialize, configure, or own PostHog.
@@ -15688,6 +15732,12 @@ function paymentsV2Signature(name) {
 const SEND_SIGNATURE = paymentsV2Signature("send");
 const SEND_BATCH_SIGNATURE = paymentsV2Signature("sendBatch");
 const CREATE_COMMITMENT_SIGNATURE = paymentsV2Signature("createCommitment");
+/**
+* #2299 ruling C: only an Owner cancels or redirects an Organization-funded
+* commitment, so these two sit in the Owner role's scope, never a Budget's.
+* The contract admits only the commitment's creator, the Organization Safe.
+*/
+const OWNER_COMMITMENT_SIGNATURES = [paymentsV2Signature("cancel"), paymentsV2Signature("redirect")];
 //#endregion
 //#region ../protocol/src/evm/organization-payments.ts
 /** Zodiac ModuleProxyFactory on Base Sepolia. */
@@ -15924,24 +15974,18 @@ function encodePreparedPaymentCallData(command) {
 		}));
 	}
 	const [item] = command.items;
-	if (command.executionRoute.kind !== "direct" || command.items.length !== 1 || item === void 0 || isBirth(item)) throw Errors.invalidInput("items", "Commitment lifecycle requires one direct execution");
-	return safe4337ExecuteUserOpCallData({
+	const route = command.executionRoute;
+	if (command.items.length !== 1 || item === void 0 || isBirth(item) || route.kind !== "direct" && item.operation === "claim_commitment") throw Errors.invalidInput("items", "Commitment lifecycle requires one lone execution");
+	const call = {
 		to: command.contractAddress,
+		value: 0n,
 		data: lifecycleData(item)
-	});
-}
-//#endregion
-//#region ../protocol/src/evm/role-dsl.ts
-const ORG_BUDGET_ACTIONS = [
-	"send",
-	"sendBatch",
-	"createCommitment"
-];
-/** Derive the Zodiac substrate key for one durable Permission identity. */
-function roleKeyForPermission(permissionId) {
-	const normalized = permissionId.trim();
-	if (normalized.length === 0 || normalized !== permissionId) throw Errors.invalidInput("permissionId", "must be a non-empty canonical Permission ID");
-	return keccak256(toBytes(`permission ${permissionId}`));
+	};
+	return route.kind === "direct" ? safe4337ExecuteUserOpCallData(call) : buildOrgRoleSpendPersonalCallData(buildOrgRoleMultiCall({
+		rolesModuleAddress: route.rolesModule,
+		roleKey: route.roleKey,
+		calls: [call]
+	}));
 }
 //#endregion
 //#region src/payments/operation-verification.ts
@@ -15970,6 +16014,16 @@ function moneySafeOpDigest(operation, chainId) {
 		userOp: safe4337UserOperation(operation)
 	});
 }
+/**
+* An Organization-funded cancel or redirect runs through the Owner role
+* (#2299), which no Budget names. Its role key cannot widen what the signer
+* may do: the Roles module admits only a role the signer's Safe holds, and the
+* contract admits only the commitment's creator.
+*/
+function isOwnerLifecycle(command) {
+	const [item] = command.items;
+	return command.items.length === 1 && (item?.operation === "cancel_commitment" || item?.operation === "redirect_commitment");
+}
 /** Verify every actual Money signing target against configured trust anchors. */
 function verifiesMoneyOperation(evidence, expectedSafe, chainId, permissionId) {
 	try {
@@ -15980,7 +16034,7 @@ function verifiesMoneyOperation(evidence, expectedSafe, chainId, permissionId) {
 		const route = command.executionRoute;
 		if (route.kind === "direct") {
 			if (permissionId !== void 0 || command.senderSafe.toLowerCase() !== expectedSafe.toLowerCase()) return false;
-		} else if (permissionId === void 0 || route.roleKey.toLowerCase() !== roleKeyForPermission(permissionId).toLowerCase() || command.senderSafe.toLowerCase() !== route.organizationSafe.toLowerCase()) return false;
+		} else if ((permissionId === void 0 ? !isOwnerLifecycle(command) : route.roleKey.toLowerCase() !== roleKeyForPermission(permissionId).toLowerCase()) || command.senderSafe.toLowerCase() !== route.organizationSafe.toLowerCase()) return false;
 		if (operation.callData.toLowerCase() !== encodePreparedPaymentCallData(command).toLowerCase()) return false;
 		const digest = moneySafeOpDigest(operation, chainId);
 		return evidence.digest.toLowerCase() === digest.toLowerCase() && evidence.executionId === `money_execution_${digest.slice(2).toLowerCase()}`;
@@ -16770,9 +16824,11 @@ function subscribeFreshQuery(deps, args, listener, operation, projection, option
 //#region src/payments/lifecycle-execution.ts
 /**
 * The prepared command is this lifecycle intent; a retry also names the
-* original birth command of the scope it was asked for.
+* original birth command of the scope it was asked for. A claim, and an
+* Account's own cancel or redirect, runs directly from the signer's Safe; an
+* Organization's cancel or redirect runs through its Owner role (#2299).
 */
-const lifecycleCommandCheck = (intent, expectedOrganizationId) => async (request, evidence) => await matchesIntent(intent)(request, evidence) && (intent.kind !== "retry" || (expectedOrganizationId === void 0 ? evidence.sourceCommand?.kind === "birth" && evidence.sourceCommand.actor.kind === "account" : evidence.sourceCommand?.kind === "birth" && evidence.sourceCommand.actor.kind === "organization" && evidence.sourceCommand.actor.orgId === expectedOrganizationId));
+const lifecycleCommandCheck = (intent, expectedOrganizationId) => async (request, evidence) => await matchesIntent(intent)(request, evidence) && (intent.kind === "retry" ? expectedOrganizationId === void 0 ? evidence.sourceCommand?.kind === "birth" && evidence.sourceCommand.actor.kind === "account" : evidence.sourceCommand?.kind === "birth" && evidence.sourceCommand.actor.kind === "organization" && evidence.sourceCommand.actor.orgId === expectedOrganizationId : evidence.preparedCommand?.executionRoute.kind === (intent.kind === "claim" || expectedOrganizationId === void 0 ? "direct" : "zodiac_role"));
 /** The prepared command pays exactly the request the payer confirmed. */
 const requestPaymentCheck = (confirmation) => async (request) => "kind" in request && request.kind === "payment_request" && canonicalJson(request.confirmation) === canonicalJson(confirmation);
 function executePaymentLifecycle(deps, intent, signal, controls, expectedOrganizationId, onPrepared) {
@@ -17693,17 +17749,21 @@ function paymentExecutionIntent(input) {
 	const to = normalizeTargetForBackend(input.to, "to");
 	if (!to.ok) return to;
 	try {
-		return {
+		const decoded = Schema.decodeResult(PaymentExecutionIntentSchema, { onExcessProperty: "error" })({
+			to: to.value,
+			amount: input.amount,
+			...input.externalAddressAcknowledged === void 0 ? {} : { externalAddressAcknowledged: input.externalAddressAcknowledged },
+			...input.paymentType === void 0 ? {} : { paymentType: input.paymentType },
+			...input.document === void 0 ? {} : { document: input.document },
+			...input.supportingReceipts === void 0 ? {} : { supportingReceipts: input.supportingReceipts },
+			...input.timing === void 0 ? {} : { timing: input.timing }
+		});
+		return Result.isSuccess(decoded) ? {
 			ok: true,
-			value: Schema.decodeSync(PaymentExecutionIntentSchema, { onExcessProperty: "error" })({
-				to: to.value,
-				amount: input.amount,
-				...input.externalAddressAcknowledged === void 0 ? {} : { externalAddressAcknowledged: input.externalAddressAcknowledged },
-				...input.paymentType === void 0 ? {} : { paymentType: input.paymentType },
-				...input.document === void 0 ? {} : { document: input.document },
-				...input.supportingReceipts === void 0 ? {} : { supportingReceipts: input.supportingReceipts },
-				...input.timing === void 0 ? {} : { timing: input.timing }
-			})
+			value: decoded.success
+		} : {
+			ok: false,
+			error: invalidPaymentField(decoded.failure.issue)
 		};
 	} catch {
 		return {
@@ -17712,6 +17772,13 @@ function paymentExecutionIntent(input) {
 		};
 	}
 }
+const formatIssue = SchemaIssue.makeFormatterStandardSchemaV1();
+/** The first failing field and why, e.g. `amount.value`, as the backend's row decode names it (#2381). */
+function invalidPaymentField(issue) {
+	const first = formatIssue(issue).issues[0];
+	const field = first?.path?.map((segment) => String(typeof segment === "object" ? segment.key : segment)).join(".");
+	return Errors.invalidInput(field === void 0 || field.length === 0 ? "payment" : field, first?.message ?? "invalid personal payment input");
+}
 function normalizePaymentTiming(payment) {
 	const { release: _release, ...rest } = payment;
 	return {
@@ -18528,6 +18595,27 @@ function makeOrganizationPaymentsMethods(deps, orgId) {
 		flights: /* @__PURE__ */ new Map()
 	};
 	const execute = (input, signal, operation = "organization-pay-batch", controls, onPrepared) => executeOrganizationBatch(scope, input, signal, operation, controls, onPrepared);
+	/** One Owner-signed cancel or redirect, answering the one Payment it acted on (#2299). */
+	const ownerLifecycle = (intent, controls, operation) => runCapxulEffect(Effect.gen(function* () {
+		const captured = carryInvocationParentSpan(controls, yield* Effect.currentSpan.pipe(Effect.orDie));
+		return yield* awaitCapxulResult(async () => {
+			const execution = executionDependencies$1(deps);
+			if (execution === null) return {
+				ok: false,
+				error: Errors.notImplemented("organizationPayments", "executionComposition")
+			};
+			const result = await executePaymentLifecycle(execution, intent, controls?.signal, captured, orgId);
+			if (!result.ok) return result;
+			const [payment, ...rest] = result.value.payments;
+			return payment === void 0 || rest.length !== 0 ? {
+				ok: false,
+				error: Errors.unknown()
+			} : {
+				ok: true,
+				value: normalizePaymentTiming(payment)
+			};
+		});
+	}), observationOnlyControls(controls), operation, deps.runPromise);
 	return {
 		...makeOrganizationPaymentReadMethods(deps, orgId),
 		retry: (paymentId, options) => {
@@ -18586,6 +18674,19 @@ function makeOrganizationPaymentsMethods(deps, orgId) {
 				});
 			}), observationOnlyControls(controls), CAPXUL_OPERATIONS.organizationPayments.pay, deps.runPromise);
 		},
+		cancel: (paymentId, options) => ownerLifecycle({
+			kind: "cancel",
+			paymentId
+		}, deps.invocationControls?.(options) ?? options, CAPXUL_OPERATIONS.organizationPayments.cancel),
+		redirect: (input, options) => {
+			const controls = deps.invocationControls?.(options) ?? options;
+			const recipient = normalizeTargetForBackend(input.to, "to");
+			return recipient.ok ? ownerLifecycle({
+				kind: "redirect",
+				paymentId: input.paymentId,
+				recipient: recipient.value
+			}, controls, CAPXUL_OPERATIONS.organizationPayments.redirect) : runCapxulEffect(Effect.fail(recipient.error), observationOnlyControls(controls), CAPXUL_OPERATIONS.organizationPayments.redirect, deps.runPromise);
+		},
 		payBatch: (input, options) => {
 			const controls = deps.invocationControls?.(options) ?? options;
 			return runCapxulEffect(Effect.gen(function* () {
@@ -22946,4 +23047,4 @@ function executeIdentityProductObservation(telemetry, record, state) {
 	return ignoreTransportFailure(() => invocationTelemetry.emit(mapped), "emit", mapped.name).pipe(Effect.andThen(ignoreTransportFailure(after, mapped.name === "auth_signed_out" ? "reset" : "identify", mapped.name)));
 }
 //#endregion
-export { parseAssetAmount as $, InvitationViewSchema as $n, SystemClockLayer as $r, version as $t, registerProductTelemetryInvocation as A, toJwtToken as Ai, details as An, toWeiAmount as Ar, safe4337ExecuteUserOpCallData as At, makeOrganizationPaymentsMethods as B, AuthCachePortTag as Bi, FixedOfferDraftSchema as Bn, runCapxulEffect as Br, failureEvidenceProps as Bt, AccountReadPortTag as C, parseAuthSession as Ci, CLI_INVOCATION_KINDS as Cn, toAssetId as Cr, SEND_BATCH_SIGNATURE as Ct, convexCallErrorFromCapxul as D, toEpochSeconds as Di, isCapxulOperation as Dn, isEvmAddress as Dr, TOKENS as Dt, ConvexCallPortTag as E, toEpochMs as Ei, CAPXUL_OPERATIONS as En, EVM_ADDRESS_RE$1 as Er, CONFIGURED_MONEY_ASSETS as Et, decodePayrollRunInput as F, FAILURE_MODES$1 as Fi, replacements as Fn, publicIdentityFailure as Fr, SAFE_SENTINEL_OWNERS as Ft, makeActorRelationshipMethods as G, treasuries as Gn, toCapxulResult as Gr, observationContextProps as Gt, makePaymentsMethods as H, members as Hn, awaitCapxulResult as Hr, postHogFailureObservation as Ht, toPayrollGroupId as I, isFailureMode as Ii, PreparedPermissionExecutionSchema as In, runIdentityFacade as Ir, callOperation as It, makeTargetsMethods as J, ORGANIZATION_SETUP_REASONS as Jn, EXPECTED_OPERATION_OUTCOMES as Jr, SDK_VERSION as Jt, makeCheckoutMethods as K, workspaces as Kn, formatTraceparent as Kr, withCapturedAttemptContext as Kt, makeAccountMethods as L, isRecord as Li, PermissionCommandViewSchema as Ln, runPortEffect as Lr, asCapxulError as Lt, makeApprovalsMethods as M, Errors as Mi, authorities as Mn, reference as Mr, buildSafeMultiSendExecTransactionCall as Mt, makePayrollMethods as N, CapxulError as Ni, commands as Nn, makeAuthMethods as Nr, BASE_SEPOLIA_CHAIN_ID as Nt, retryIdempotentRead as O, toAuthUserId as Oi, normalizeCapxulOperation as On, toAddress as Or, deriveCapxulSafeAddress as Ot, makeUnavailablePayrollMethods as P, isCapxulError as Pi, configurations as Pn, askIdentity as Pr, MULTI_SEND_CALL_ONLY as Pt, formatAssetAmount as Q, toOrgId as Qn, oauthBearerAuthClient as Qr, safeExceptionLabel as Qt, emitDepositInitiated as R, readField as Ri, PayrollGroupIdSchema as Rn, sessionFromActor as Rr, toPublicError$1 as Rt, valueIn as S, BrowserAuthCacheAdapter as Si, CLI_COMMAND_NAMES as Sn, currencySymbolFor as Sr, SAFE_ENABLE_MODULE_ABI as St, TelemetryPortTag as T, toDurationMs as Ti, stampTelemetryEnvelope as Tn, toExactAssetAmount as Tr, CAPXUL_PAYMENTS_V2_ADDRESS as Tt, waitForPaymentSubmission as U, roles as Un, defectAsCapxulError as Ur, observeFailedResult as Ut, makeOfframpMethods as V, invitations as Vn, withVerifiedOrganizationScope as Vr, CAPXUL_SDK_EXPECTED_OUTCOME_EVENT as Vt, makeDestinationsMethods as W, setups as Wn, runIfActive as Wr, observeSdkClient as Wt, assetAmountFromRaw as X, CHAIN_UPSTREAMS as Xn, carryInvocationParentSpan as Xr, normalizeExceptionOperation as Xt, subscribeFreshQuery as Y, ORGANIZATION_SETUP_STATUSES as Yn, ActorFailure as Yr, normalizeExceptionErrorKind as Yt, assetSymbolFor as Z, decodeChainCause as Zn, withInvocationParentSpan as Zr, projectSdkException as Zt, accountFromAccountPositions as _, AuthClientError as _i, toPartyId as _n, toBudgetId as _r, ROLES_EXEC_TRANSACTION_WITH_ROLE_ABI as _t, paymentPhase as a, observationRequestHeaders as ai, isSignerNotReadySignal as an, images as ar, fingerprintPaymentIntent as at, MONEY_READ_RATES as b, globalLocalStorage as bi, redactTelemetryProps as bn, toRoleKey as br, ROLES_SET_UP_ABI as bt, makePaymentDocumentsMethods as c, readInvocationObservation as ci, signerFailure as cn, isBytes32 as cr, roleKeyForPermission as ct, SmartAccountPortTag as d, redactUrlSecrets as di, makeClientRequestMethods as dn, toLowerBytes32 as dr, CREATE_COMMITMENT_SIGNATURE as dt, ClockError as ei, isSettingUpLifecycle as en, hashPermissionReplacementPreview as er, requireAsset as et, smartAccountErrorFromCapxul as f, isCredentialField as fi, toCountryCode as fn, toLowerHex as fr, MODULE_PROXY_FACTORY_ABI as ft, ConvexAccountLayer as g, authClientPortFromPromiseAdapter as gi, toHandle as gn, EpochMsSchema$1 as gr, ROLES_ASSIGN_ROLES_ABI as gt, makeAccountsMethods as h, toPublishableKey as hi, HANDLE_RE as hn, DurationMsSchema$1 as hr, PARAMETER_TYPE as ht, inboxPhase as i, BetterAuthBrowserLayer as ii, isEcdsaSignatureHex as in, AppIdSchema$1 as ir, canonicalJson as it, wireChainId as j, toSessionToken as ji, onboardings as jn, absurd as jr, safe4337MultiSendUserOpCallData as jt, bindProductTelemetryInvocation as k, toEmail as ki, OPERATIONS as kn, toChainId as kr, normalizeSafeSaltEmail as kt, makeSmartAccountMethods as l, sanitizeObservationContext as li, resolveFailureMode as ln, toExactHex as lr, ZODIAC_MODULE_PROXY_FACTORY as lt, PonderIndexerAdapter as m, toAppId as mi, toTesterKind as mn, PAYMENT_STATUSES as mr, OPERATOR as mt, bootIdentityFlow as n, readClockNow as ni, causeChain as nn, CurrentPolicySchema as nr, isMoneyParseError as nt, requestPhase as o, attachInvocationObservation as oi, openfortSignerNotReadyCode as on, toAccountId as or, moneySafeOpDigest as ot, makeHoldingsMethods as p, toAllowedOrigin as pi, toKycTier as pn, PAYMENT_DIRECTIONS as pr, MULTI_SEND_SELECTOR as pt, isCheckoutSettlementConsumed as q, OrganizationSetupSchema as qn, CAPXUL_ERROR_CODES as qr, EXCEPTION_MESSAGE as qt, makeMeMethods as r, BetterAuthNodeLayer as ri, injectedWalletSigner as rn, diagnostics as rr, parseMoney as rt, makeActivityMethods as s, copyInvocationObservation as si, recoverRawDigestSigner as sn, PaymentDocumentOptionsSchema as sr, ORG_BUDGET_ACTIONS as st, executeIdentityProductObservation as t, ClockPortTag as ti, UNOBSERVABLE_SIGNER_STATUS as tn, decodePermissionIntent as tr, toRaw as tt, ConvexSmartAccountLayer as u, redactSecrets as ui, makeCurrentUserMethods as un, toLowerAddress as ur, resolveOrgPermissionIdentity as ut, accountPositionsFromWire as v, AuthClientPortTag as vi, validateHandle as vn, toPermissionAssignmentId as vr, ROLES_SET_ALLOWANCE_ABI as vt, accountReadErrorFromCapxul as w, parseCachedJwt as wi, EXCEPTION_EVENT_NAME as wn, toCurrencyCode as wr, SEND_SIGNATURE as wt, valueActivitySummary as x, InMemoryAuthCacheAdapter as xi, CLI_CAPABILITIES as xn, ChainIdSchema$1 as xr, ROLE_MANAGEMENT_SIGNATURES as xt, positionPeg as y, detectAuthCacheAdapter as yi, redactTelemetryEvent as yn, toPermissionId as yr, ROLES_SET_TRANSACTION_UNWRAPPER_ABI as yt, logDroppedEvent as z, AuthCacheError as zi, PayrollGroupInputSchema as zn, observationOnlyControls as zr, failureDetail as zt };
+export { parseAssetAmount as $, hashPermissionReplacementPreview as $n, carryInvocationParentSpan as $r, isSettingUpLifecycle as $t, registerProductTelemetryInvocation as A, toEpochSeconds as Ai, onboardings as An, isEvmAddress as Ar, safe4337MultiSendUserOpCallData as At, makeOrganizationPaymentsMethods as B, isRecord as Bi, invitations as Bn, runPortEffect as Br, CAPXUL_SDK_EXPECTED_OUTCOME_EVENT as Bt, AccountReadPortTag as C, globalLocalStorage as Ci, EXCEPTION_EVENT_NAME as Cn, toRoleKey as Cr, SEND_SIGNATURE as Ct, convexCallErrorFromCapxul as D, parseCachedJwt as Di, normalizeCapxulOperation as Dn, toCurrencyCode as Dr, deriveCapxulSafeAddress as Dt, ConvexCallPortTag as E, parseAuthSession as Ei, isCapxulOperation as En, toAssetId as Er, TOKENS as Et, decodePayrollRunInput as F, Errors as Fi, PreparedPermissionExecutionSchema as Fn, reference as Fr, callOperation as Ft, makeActorRelationshipMethods as G, workspaces as Gn, awaitCapxulResult as Gr, withCapturedAttemptContext as Gt, makePaymentsMethods as H, AuthCacheError as Hi, roles as Hn, observationOnlyControls as Hr, observeFailedResult as Ht, toPayrollGroupId as I, CapxulError as Ii, PermissionCommandViewSchema as In, makeAuthMethods as Ir, asCapxulError as It, makeTargetsMethods as J, ORGANIZATION_SETUP_STATUSES as Jn, toCapxulResult as Jr, normalizeExceptionErrorKind as Jt, makeCheckoutMethods as K, OrganizationSetupSchema as Kn, defectAsCapxulError as Kr, EXCEPTION_MESSAGE as Kt, makeAccountMethods as L, isCapxulError as Li, PayrollGroupIdSchema as Ln, askIdentity as Lr, toPublicError$1 as Lt, makeApprovalsMethods as M, toEmail as Mi, commands as Mn, toChainId as Mr, BASE_SEPOLIA_CHAIN_ID as Mt, makePayrollMethods as N, toJwtToken as Ni, configurations as Nn, toWeiAmount as Nr, MULTI_SEND_CALL_ONLY as Nt, retryIdempotentRead as O, toDurationMs as Oi, OPERATIONS as On, toExactAssetAmount as Or, normalizeSafeSaltEmail as Ot, makeUnavailablePayrollMethods as P, toSessionToken as Pi, replacements as Pn, absurd as Pr, SAFE_SENTINEL_OWNERS as Pt, formatAssetAmount as Q, InvitationViewSchema as Qn, ActorFailure as Qr, version as Qt, emitDepositInitiated as R, FAILURE_MODES$1 as Ri, PayrollGroupInputSchema as Rn, publicIdentityFailure as Rr, failureDetail as Rt, valueIn as S, detectAuthCacheAdapter as Si, CLI_INVOCATION_KINDS as Sn, toPermissionId as Sr, SEND_BATCH_SIGNATURE as St, TelemetryPortTag as T, BrowserAuthCacheAdapter as Ti, CAPXUL_OPERATIONS as Tn, currencySymbolFor as Tr, CONFIGURED_MONEY_ASSETS as Tt, waitForPaymentSubmission as U, AuthCachePortTag as Ui, setups as Un, runCapxulEffect as Ur, observeSdkClient as Ut, makeOfframpMethods as V, readField as Vi, members as Vn, sessionFromActor as Vr, postHogFailureObservation as Vt, makeDestinationsMethods as W, treasuries as Wn, withVerifiedOrganizationScope as Wr, observationContextProps as Wt, assetAmountFromRaw as X, decodeChainCause as Xn, CAPXUL_ERROR_CODES as Xr, projectSdkException as Xt, subscribeFreshQuery as Y, CHAIN_UPSTREAMS as Yn, formatTraceparent as Yr, normalizeExceptionOperation as Yt, assetSymbolFor as Z, toOrgId as Zn, EXPECTED_OPERATION_OUTCOMES as Zr, safeExceptionLabel as Zt, accountFromAccountPositions as _, toAppId as _i, validateHandle as _n, PAYMENT_STATUSES as _r, ROLES_SET_ALLOWANCE_ABI as _t, paymentPhase as a, readClockNow as ai, openfortSignerNotReadyCode as an, roleKeyForPermission as ar, fingerprintPaymentIntent as at, MONEY_READ_RATES as b, AuthClientError as bi, CLI_CAPABILITIES as bn, toBudgetId as br, ROLE_MANAGEMENT_SIGNATURES as bt, makePaymentDocumentsMethods as c, observationRequestHeaders as ci, resolveFailureMode as cn, images as cr, resolveOrgPermissionIdentity as ct, SmartAccountPortTag as d, readInvocationObservation as di, toCountryCode as dn, isBytes32 as dr, MULTI_SEND_SELECTOR as dt, withInvocationParentSpan as ei, UNOBSERVABLE_SIGNER_STATUS as en, decodePermissionIntent as er, requireAsset as et, smartAccountErrorFromCapxul as f, sanitizeObservationContext as fi, toKycTier as fn, toExactHex as fr, OPERATOR as ft, ConvexAccountLayer as g, toAllowedOrigin as gi, toPartyId as gn, PAYMENT_DIRECTIONS as gr, ROLES_EXEC_TRANSACTION_WITH_ROLE_ABI as gt, makeAccountsMethods as h, isCredentialField as hi, toHandle as hn, toLowerHex as hr, ROLES_ASSIGN_ROLES_ABI as ht, inboxPhase as i, ClockPortTag as ii, isSignerNotReadySignal as in, ORG_BUDGET_ACTIONS as ir, canonicalJson as it, wireChainId as j, toAuthUserId as ji, authorities as jn, toAddress as jr, buildSafeMultiSendExecTransactionCall as jt, bindProductTelemetryInvocation as k, toEpochMs as ki, details as kn, EVM_ADDRESS_RE$1 as kr, safe4337ExecuteUserOpCallData as kt, makeSmartAccountMethods as l, attachInvocationObservation as li, makeCurrentUserMethods as ln, toAccountId as lr, CREATE_COMMITMENT_SIGNATURE as lt, PonderIndexerAdapter as m, redactUrlSecrets as mi, HANDLE_RE as mn, toLowerBytes32 as mr, PARAMETER_TYPE as mt, bootIdentityFlow as n, SystemClockLayer as ni, injectedWalletSigner as nn, CurrentPolicySchema as nr, isMoneyParseError as nt, requestPhase as o, BetterAuthNodeLayer as oi, recoverRawDigestSigner as on, diagnostics as or, moneySafeOpDigest as ot, makeHoldingsMethods as p, redactSecrets as pi, toTesterKind as pn, toLowerAddress as pr, OWNER_COMMITMENT_SIGNATURES as pt, isCheckoutSettlementConsumed as q, ORGANIZATION_SETUP_REASONS as qn, runIfActive as qr, SDK_VERSION as qt, makeMeMethods as r, ClockError as ri, isEcdsaSignatureHex as rn, MONTHLY_REFILL_PERIOD_SECONDS as rr, parseMoney as rt, makeActivityMethods as s, BetterAuthBrowserLayer as si, signerFailure as sn, AppIdSchema$1 as sr, ZODIAC_MODULE_PROXY_FACTORY as st, executeIdentityProductObservation as t, oauthBearerAuthClient as ti, causeChain as tn, keepRefillOnChange as tr, toRaw as tt, ConvexSmartAccountLayer as u, copyInvocationObservation as ui, makeClientRequestMethods as un, PaymentDocumentOptionsSchema as ur, MODULE_PROXY_FACTORY_ABI as ut, accountPositionsFromWire as v, toPublishableKey as vi, redactTelemetryEvent as vn, DurationMsSchema$1 as vr, ROLES_SET_TRANSACTION_UNWRAPPER_ABI as vt, accountReadErrorFromCapxul as w, InMemoryAuthCacheAdapter as wi, stampTelemetryEnvelope as wn, ChainIdSchema$1 as wr, CAPXUL_PAYMENTS_V2_ADDRESS as wt, valueActivitySummary as x, AuthClientPortTag as xi, CLI_COMMAND_NAMES as xn, toPermissionAssignmentId as xr, SAFE_ENABLE_MODULE_ABI as xt, positionPeg as y, authClientPortFromPromiseAdapter as yi, redactTelemetryProps as yn, EpochMsSchema$1 as yr, ROLES_SET_UP_ABI as yt, logDroppedEvent as z, isFailureMode as zi, FixedOfferDraftSchema as zn, runIdentityFacade as zr, failureEvidenceProps as zt };