@capxul/sdk 4.20.0-beta.27 → 4.20.0-beta.29

package/dist/{access-BnlgphFT.mjs → access-wvksqkgT.mjs}

@@ -1,4 +1,4 @@
-import { Cause, Clock, Context, Data, Deferred, Effect, Exit, Fiber, Layer, Option, Predicate, Queue, Ref, Result, Schema, SchemaGetter, SchemaParser } from "effect";
+import { Cause, Clock, Context, Data, Deferred, Effect, Exit, Fiber, Layer, Option, Predicate, Queue, Ref, Result, Schema, SchemaAST, SchemaGetter, SchemaIssue, SchemaParser } from "effect";
 import { makeFunctionReference } from "convex/server";
 import { bytesToHex, concat, decodeErrorResult, encodeAbiParameters, encodeFunctionData, encodePacked, formatUnits, getContractAddress, hashTypedData, isAddress, isHex, keccak256, pad, padHex, parseAbiParameters, recoverAddress, recoverTypedDataAddress, toBytes, toFunctionSignature, toHex } from "viem";
 import { getUserOperationHash } from "viem/account-abstraction";
@@ -858,7 +858,7 @@ const FIELD_RULES = {
 	},
 	anonymousId: {
 		maxLength: 128,
-		pattern: /^anon_[A-Za-z0-9-]+$/u
+		pattern: /^(?:anon_[A-Za-z0-9-]+|[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})$/u
 	},
 	traceparent: {
 		maxLength: 55,
@@ -936,6 +936,21 @@ function markFailureInvocationSnapshot(failure, snapshot) {
 function readFailureInvocationSnapshot(failure) {
 	return isRecord(failure) ? failureInvocationSnapshots.get(failure) : void 0;
 }
+/**
+* The operation each failure came from, by the error it carries. A public
+* method's path (`approvals.review`) is not always an operation name; the row
+* it called (`accounts.approvals.review`) is. The innermost call marks first
+* and keeps the mark, so the report names the row that actually failed.
+*/
+const failureOperations = /* @__PURE__ */ new WeakMap();
+/** @internal Record which operation a failure came from; the first mark is kept. */
+function markFailureOperation(error, operation) {
+	if (isRecord(error) && !failureOperations.has(error)) failureOperations.set(error, operation);
+}
+/** @internal The operation a failure came from, when a runner marked it. */
+function readFailureOperation(error) {
+	return isRecord(error) ? failureOperations.get(error) : void 0;
+}
 //#endregion
 //#region src/observability/http-headers.ts
 /** Resolve one bounded pre-auth snapshot for an outbound SDK HTTP request. */
@@ -2079,7 +2094,9 @@ async function runIfActive(signal, operation, effect, runPromise, observe) {
 		signal.addEventListener("abort", onAbort, { once: true });
 		return Effect.sync(() => signal.removeEventListener("abort", onAbort));
 	}));
-	return runProgram(observe === void 0 ? controlled : observe(controlled), runPromise);
+	const result = await runProgram(observe === void 0 ? controlled : observe(controlled), runPromise);
+	if (!result.ok) markFailureOperation(result.error, operation);
+	return result;
 }
 //#endregion
 //#region src/platform/capxul-effect.ts
@@ -4688,7 +4705,9 @@ const OrganizationPaymentExecutionItemSchema = Schema.Struct({
 		"invoice",
 		"payroll",
 		"reimbursement"
-	]))
+	])),
+	/** When the recipient gets it: instant (the default), or held until a date or over a period. */
+	timing: Schema.optional(PaymentTiming)
 }).check(Schema.makeFilter((value) => Schema.is(PaymentDocumentOptionsSchema)(value)));
 const PrepareOrganizationPaymentExecutionInputSchema = Schema.Struct({
 	orgId: nonEmpty("orgId"),
@@ -4798,11 +4817,20 @@ const PreparedPaymentCommandExecutionSchema = Schema.Struct({
 //#region ../protocol/src/accounts/approval-schema.ts
 const APPROVAL_ID_RE = /^approval_[0-9A-HJKMNP-TV-Z]{26}$/u;
 const ApprovalIdSchema = Schema.String.pipe(Schema.refine((value) => APPROVAL_ID_RE.test(value), { message: "must be approval_ plus a ULID" }));
-/** What is being approved. */
+/**
+* What is being approved. A `permission_change` creates, changes, assigns,
+* revokes or replaces an Organization's Permissions; an `invitation` sets up
+* the rights an invitation offers. Neither moves money. A `payment_cancel`
+* returns a held Payment to whoever funded it; a `payment_redirect` sends it
+* to someone else.
+*/
 const APPROVAL_KINDS = [
 	"payment",
 	"payroll_run",
+	"payment_cancel",
+	"payment_redirect",
 	"permission_change",
+	"invitation",
 	"bank_payout"
 ];
 /**
@@ -5026,8 +5054,7 @@ const approvals = {
 		errors: [
 			...CALL$10,
 			...DEFECTS,
-			"WRONG_STATE",
-			"NOT_IMPLEMENTED"
+			"WRONG_STATE"
 		]
 	}),
 	/** The approval as the person reads it, with its state judged against its expiry. */
@@ -5525,6 +5552,28 @@ const probes = {
 	})
 };
 //#endregion
+//#region ../protocol/src/evm/role-dsl.ts
+const ORG_BUDGET_ACTIONS = [
+	"send",
+	"sendBatch",
+	"createCommitment"
+];
+/**
+* How a capped Budget's allowance refills (#2298). `monthly` refills the
+* allowance to its cap every 30 days. Roles v2 counts fixed periods from the
+* moment the allowance is set; it has no calendar month. Absent means `none`:
+* the cap is one pot that spending drains for good.
+*/
+const ORG_BUDGET_REFILLS = ["monthly", "none"];
+/** The fixed Roles v2 refill period of a `monthly` Budget: 30 days, in seconds. */
+const MONTHLY_REFILL_PERIOD_SECONDS = 30n * 24n * 60n * 60n;
+/** Derive the Zodiac substrate key for one durable Permission identity. */
+function roleKeyForPermission(permissionId) {
+	const normalized = permissionId.trim();
+	if (normalized.length === 0 || normalized !== permissionId) throw Errors.invalidInput("permissionId", "must be a non-empty canonical Permission ID");
+	return keccak256(toBytes(`permission ${permissionId}`));
+}
+//#endregion
 //#region ../protocol/src/permissions/permission-schema.ts
 /**
 * One stored `setAllowance` call inside a command's expected authority set.
@@ -5563,12 +5612,19 @@ const BudgetScopeSchema = Schema.Struct({
 	})]),
 	actions: Schema.NonEmptyArray(Schema.Literals(["pay", "commitments"]))
 }).pipe(Schema.refine((scope) => new Set(scope.actions).size === scope.actions.length && (scope.recipients.type === "anyone" || scope.recipients.accounts.length >= 1 && scope.recipients.accounts.length <= 32 && new Set(scope.recipients.accounts).size === scope.recipients.accounts.length), { message: "Budget scope requires unique actions and one to 32 unique allowed Accounts" }));
+/**
+* How a capped Budget refills (#2298): `monthly` tops the cap back up every 30
+* days (a fixed Roles v2 period, not a calendar month); `none` never refills.
+* Absent means `none`, and writers store only `monthly`.
+*/
+const BudgetRefillSchema = Schema.Literals(ORG_BUDGET_REFILLS);
 /** The accepted product policy stored with one Permission revision. */
 const CurrentPolicySchema = Schema.Union([Schema.Struct({
 	type: Schema.Literal("budget"),
 	asset: AssetIdSchema,
 	limit: Schema.NullOr(Schema.String),
-	scope: BudgetScopeSchema
+	scope: BudgetScopeSchema,
+	refill: Schema.optional(BudgetRefillSchema)
 }), Schema.Struct({ type: Schema.Literal("managePeople") })]);
 const BudgetIntentSchema = CurrentPolicySchema.pipe(Schema.refine((value) => {
 	if (value.type !== "budget") return false;
@@ -5590,6 +5646,15 @@ const PermissionSchema = Schema.Struct({
 	limitRaw: Schema.optional(WeiAmountSchema$1),
 	allowanceKey: Schema.optional(AllowanceKeySchema)
 });
+/**
+* A refilling Budget's refill (#2439): how much each one adds, every how many
+* days, and when the next one is due.
+*/
+const BudgetNextRefillSchema = Schema.Struct({
+	amount: AssetAmountSchema,
+	everyDays: Schema.Finite,
+	nextAt: EpochMsSchema$1
+});
 const PermissionAssignmentSchema = Schema.Struct({
 	permissionAssignmentId: PermissionAssignmentIdSchema,
 	permissionId: PermissionIdSchema,
@@ -5633,7 +5698,8 @@ const ResolvedPermissionBudgetPolicySchema = Schema.Struct({
 		"send",
 		"sendBatch",
 		"createCommitment"
-	]))
+	])),
+	refill: Schema.optional(BudgetRefillSchema)
 });
 const PermissionRecipientBindingSchema = Schema.Struct({
 	accountId: AccountIdSchema$1,
@@ -5645,16 +5711,22 @@ const StoredPermissionIntentSchema = Schema.Union([Schema.Struct({
 	type: Schema.Literal("budget"),
 	asset: AssetIdSchema,
 	limit: Schema.NullOr(AssetAmountSchema),
-	scope: Schema.optional(BudgetScopeSchema)
+	scope: Schema.optional(BudgetScopeSchema),
+	refill: Schema.optional(BudgetRefillSchema)
 }).pipe(Schema.refine((intent) => intent.limit === null || intent.limit.asset === intent.asset, { message: "Budget limit must use the Budget asset" })), Schema.Struct({ type: Schema.Literal("managePeople") })]);
 /** Writes state every granted right and use a finite positive AssetAmount cap. */
 const PermissionIntentSchema = Schema.Union([Schema.Struct({
 	type: Schema.Literal("budget"),
 	asset: AssetIdSchema,
 	limit: AssetAmountSchema,
-	scope: BudgetScopeSchema
+	scope: BudgetScopeSchema,
+	refill: Schema.optional(BudgetRefillSchema)
 }).pipe(Schema.refine((intent) => intent.limit.asset === intent.asset && /[1-9]/u.test(intent.limit.value), { message: "Budget cap must be positive and use the Budget asset" })), Schema.Struct({ type: Schema.Literal("managePeople") })]);
-/** Decode once and give set-like scope fields one stable command representation. */
+/**
+* Decode once and give set-like scope fields one stable command representation.
+* An explicit `refill: "none"` is kept: on a change it turns a refill off,
+* where a missing `refill` keeps the Budget's current one (`keepRefillOnChange`).
+*/
 function decodePermissionIntent(input) {
 	const intent = Schema.decodeUnknownSync(PermissionIntentSchema, { onExcessProperty: "error" })(input);
 	if (intent.type === "managePeople") return intent;
@@ -5669,6 +5741,19 @@ function decodePermissionIntent(input) {
 		}
 	});
 }
+/**
+* A Budget change that leaves `refill` out keeps the Budget's current refill:
+* a change never turns a refill off by omission. An explicit `"none"` turns it
+* off. The backend plans, the SDK verifies and the CLI confirms the same
+* result. A create has no current refill, so a missing one means `none`.
+*/
+function keepRefillOnChange(intent, before) {
+	if (intent.type !== "budget" || intent.refill !== void 0 || before?.type !== "budget" || before.refill !== "monthly") return intent;
+	return {
+		...intent,
+		refill: before.refill
+	};
+}
 //#endregion
 //#region ../protocol/src/permissions/replacement-schema.ts
 const InvitationPhaseSchema = Schema.Literals([
@@ -5873,7 +5958,7 @@ const InviteGrantsSchema = Schema.Array(Schema.Union([
 	Schema.Struct({
 		type: Schema.Literal("new_budget"),
 		label: Schema.String.pipe(Schema.refine((value) => value.trim().length >= 1 && value.trim().length <= 128)),
-		intent: BudgetIntentSchema
+		intent: BudgetIntentSchema.pipe(Schema.refine((intent) => intent.refill !== "monthly", { message: "An invitation's new Budget cannot refill; change it once granted" }))
 	})
 ])).pipe(Schema.refine((grants) => {
 	if (grants.length < 1 || grants.length > 16) return false;
@@ -8190,6 +8275,30 @@ const authorities = {
 			"ROLE_PERMISSION_DENIED"
 		]
 	}),
+	/**
+	* What one active Budget can still spend now: its Roles allowance, read on
+	* chain at the latest block as the payment gate reads it. `left` is null for
+	* a Budget with no allowance (no cap). `refill` names a refilling Budget's
+	* refill and when the next one is due; null for a one-off or uncapped Budget
+	* (#2439). For a participant of the Organization.
+	*/
+	budgetLeft: Operation.action("permissions.authorities.budgetLeft", {
+		input: Schema.Struct({
+			orgId: OrgId,
+			budgetId: PermissionIdSchema
+		}),
+		output: Schema.Struct({
+			budgetId: PermissionIdSchema,
+			left: Schema.NullOr(AssetAmountSchema),
+			refill: Schema.optionalKey(Schema.NullOr(BudgetNextRefillSchema))
+		}),
+		errors: [
+			...CALL$2,
+			...DEFECTS,
+			...CHAIN$1,
+			"ROLE_PERMISSION_DENIED"
+		]
+	}),
 	/** Whether the caller's Account may spend this amount from this Budget right now. */
 	authorize: Operation.query("permissions.authorities.authorize", {
 		input: MoneyAuthorizationRequestSchema,
@@ -8964,7 +9073,9 @@ const PEOPLE_OPERATIONS = {
 			emitSafeConfirmed: "accounts.safes.emitSafeConfirmed",
 			readSafe: "accounts.safes.readSafe",
 			recordDeployment: "accounts.safes.recordDeployment"
-		}
+		},
+		/** The home's requests to pay and Payments to retry, read in one query. */
+		summaries: { loadNeedsYou: "accounts.summaries.loadNeedsYou" }
 	},
 	/** The host observer's names for `client.approvals.*`. */
 	approvals: {
@@ -9078,6 +9189,7 @@ const ORGANIZATION_OPERATIONS = {
 		payment: "org.payment",
 		permissions: {
 			assign: "org.permissions.assign",
+			budgetLeft: "org.permissions.budgetLeft",
 			change: "org.permissions.change",
 			create: "org.permissions.create",
 			get: "org.permissions.get",
@@ -9223,7 +9335,9 @@ emitSaved: "activity.annotations.emitSaved" },
 		pay: "organizationPayments.pay",
 		payBatch: "organizationPayments.payBatch",
 		prepareExecution: "organizationPayments.prepareExecution",
-		retry: "organizationPayments.retry"
+		retry: "organizationPayments.retry",
+		cancel: "organizationPayments.cancel",
+		redirect: "organizationPayments.redirect"
 	},
 	/**
 	* Payments' internal functions and the client's own method names; its public
@@ -9245,7 +9359,9 @@ emitSaved: "activity.annotations.emitSaved" },
 			loadContext: "payments.commands.loadContext",
 			loadExecutionContext: "payments.commands.loadExecutionContext",
 			/** The capped Budget a prepared Organization command spends from, before its allowance is read on chain. */
-			loadBudgetAllowance: "payments.commands.loadBudgetAllowance"
+			loadBudgetAllowance: "payments.commands.loadBudgetAllowance",
+			/** What a new Payment command would spend and from which Safe, read before it is born. */
+			loadBirthFunding: "payments.commands.loadBirthFunding"
 		},
 		lifecycles: { prepareIntent: "payments.lifecycles.prepareIntent" },
 		/** The stored UserOperation of every money command: Payment, Permission and configuration. */
@@ -9320,6 +9436,9 @@ emitChanged: "payroll.groups.emitChanged" }
 	},
 	/** Permissions' internal functions; its public rows join from `OPERATIONS`. */
 	permissions: {
+		authorities: { 
+		/** The Budget-left read's participant check and the Budget's stored allowance. */
+loadBudgetLeft: "permissions.authorities.loadBudgetLeft" },
 		commands: {
 			/** The prepare action's transaction: authorize, plan and save the command. */
 			prepareIntent: "permissions.commands.prepareIntent",
@@ -9604,6 +9723,13 @@ const OptionalReasonCode = Schema.optional(Schema.Literals(CAPXUL_ERROR_CODES));
 * no catalog schema validates it.
 */
 const EXCEPTION_EVENT_NAME = "$exception";
+/**
+* The SDK's twin of `capxul_backend_expected_outcome`: an expected outcome the
+* SDK's failure projection captures through the host's PostHog client. Like
+* the backend's, its properties are the error evidence, so no catalog schema
+* validates it.
+*/
+const SDK_EXPECTED_OUTCOME_EVENT_NAME = "capxul_sdk_expected_outcome";
 const PII = Schema.String.pipe(Schema.brand("PII"));
 /**
 * The canonical envelope (ADR-0020 A4): snake_case ONLY. `capxul_env` and
@@ -9703,6 +9829,42 @@ const UiStepProps = {
 	organization_id: OptionalOrgId,
 	reason_code: OptionalReasonCode
 };
+/**
+* A journey's variants (`JOURNEYS`): the way a person came into a journey, or
+* the way they took through it. A variant is a property of the journey's step
+* events, never a journey of its own, so each journey funnel breaks down by
+* it. A step event takes only the variants that a journey contract names on
+* it, picked one by one; the analytics plan test checks both directions.
+* `pay_path` and `funding_source` have no carrier until their Phase 2 events.
+* `payment_*` events already carry `recipient_is_capxul_account`, and
+* `invoice_issued` carries `issuer_scope_kind`; neither is repeated here.
+*/
+const JourneyVariantProps = {
+	/** How a person came to Get started: by themselves, an invite, money that waited, or an invoice. */
+	entry_path: Schema.optional(Schema.Literals([
+		"signup",
+		"invite",
+		"claim",
+		"invoice"
+	])),
+	/** Where the person acted. `agent` is an AI agent driving the CLI. */
+	surface: Schema.optional(Schema.Literals([
+		"web",
+		"cli",
+		"agent"
+	])),
+	/** Who pays: a person from their own account, or an Organization from a Budget. */
+	payer_kind: Schema.optional(Schema.Literals(["person", "organization"])),
+	/** How a request was paid: from the payer's inbox, or by its link at checkout. */
+	pay_path: Schema.optional(Schema.Literals(["inbox", "link"])),
+	/** Where an account's first money came from. `bank` is the planned on-ramp. */
+	funding_source: Schema.optional(Schema.Literals([
+		"deposit",
+		"payment",
+		"claim",
+		"bank"
+	]))
+};
 //#endregion
 //#region ../observability/src/events/money.ts
 /**
@@ -9792,6 +9954,8 @@ const PaymentInitiatedProps = Schema.Struct({
 	execution_id: OptionalString,
 	payment_lifecycle_id: OptionalString,
 	...TelemetryEnvelopeProps,
+	payer_kind: JourneyVariantProps.payer_kind,
+	surface: JourneyVariantProps.surface,
 	...RecipientTelemetryProps,
 	kind: Schema.String,
 	payment_id: Schema.String
@@ -9807,6 +9971,8 @@ const PaymentLifecycleProps = {
 const PaymentSettledL2Props = Schema.Struct({
 	...PaymentLifecycleProps,
 	...TelemetryEnvelopeProps,
+	payer_kind: JourneyVariantProps.payer_kind,
+	surface: JourneyVariantProps.surface,
 	...RecipientTelemetryProps,
 	kind: Schema.String,
 	chain_id: Schema.Finite,
@@ -10014,6 +10180,7 @@ const OrganizationCreationStartedProps = Schema.Struct({
 });
 const OrganizationCreationReadyProps = Schema.Struct({
 	...TelemetryEnvelopeProps,
+	surface: JourneyVariantProps.surface,
 	$insert_id: Schema.String,
 	organization_id: OrgIdTelemetrySchema,
 	attempt_number: AttemptNumberSchema,
@@ -10038,45 +10205,6 @@ const OrganizationCreationFailedProps = Schema.Struct({
 		...ORGANIZATION_SETUP_REASONS
 	]))
 });
-const OrgCreateStartedProps = Schema.Struct({
-	...TelemetryEnvelopeProps,
-	org_id: OptionalOrgId,
-	email_domain: OptionalString,
-	template: OptionalString
-});
-const OrgSafeCreatedProps = Schema.Struct({
-	...TelemetryEnvelopeProps,
-	org_id: OptionalOrgId,
-	chainId: OptionalChainId,
-	safe_address: OptionalAddress
-});
-const OrgSafeConfirmedProps = Schema.Struct({
-	...TelemetryEnvelopeProps,
-	org_id: OptionalOrgId,
-	chainId: OptionalChainId,
-	safe_address: OptionalAddress,
-	durationMs: OptionalDurationMs
-});
-const OrgRolesSeededProps = Schema.Struct({
-	...TelemetryEnvelopeProps,
-	org_id: OptionalOrgId,
-	chainId: OptionalChainId,
-	role: OptionalString,
-	txHash: OptionalTxHash
-});
-const OrgCreatedProps = Schema.Struct({
-	...TelemetryEnvelopeProps,
-	org_id: OptionalOrgId,
-	chainId: OptionalChainId,
-	safe_address: OptionalAddress,
-	durationMs: OptionalDurationMs
-});
-const OrgCreateFailedProps = Schema.Struct({
-	...TelemetryEnvelopeProps,
-	...ChainCauseTelemetryProps,
-	org_id: OptionalOrgId,
-	reason: OptionalString
-});
 const OrgInviteSentProps = Schema.Struct({
 	...TelemetryEnvelopeProps,
 	org_id: OptionalOrgId,
@@ -10121,30 +10249,6 @@ Schema.Struct({
 	name: Schema.Literal("organization_creation_failed"),
 	props: OrganizationCreationFailedProps
 });
-Schema.Struct({
-	name: Schema.Literal("org_create_started"),
-	props: OrgCreateStartedProps
-});
-Schema.Struct({
-	name: Schema.Literal("org_safe_created"),
-	props: OrgSafeCreatedProps
-});
-Schema.Struct({
-	name: Schema.Literal("org_safe_confirmed"),
-	props: OrgSafeConfirmedProps
-});
-Schema.Struct({
-	name: Schema.Literal("org_roles_seeded"),
-	props: OrgRolesSeededProps
-});
-Schema.Struct({
-	name: Schema.Literal("org_created"),
-	props: OrgCreatedProps
-});
-Schema.Struct({
-	name: Schema.Literal("org_create_failed"),
-	props: OrgCreateFailedProps
-});
 Schema.Struct({
 	name: Schema.Literal("org_invite_sent"),
 	props: OrgInviteSentProps
@@ -10530,6 +10634,14 @@ Schema.Struct({
 		account_kind: Schema.optional(AccountKindSchema)
 	})
 });
+Schema.Struct({
+	name: Schema.Literal("ui_approval_sign_in_required"),
+	props: Schema.Struct({
+		...TelemetryEnvelopeProps,
+		approval_id: Schema.String,
+		reason: Schema.Literals(["signed_out", "wrong_account"])
+	})
+});
 Schema.Struct({
 	name: Schema.Literal("payroll_group_changed"),
 	props: Schema.Struct({
@@ -10785,6 +10897,8 @@ const CLI_COMMAND_NAMES = [
 	"payment.get",
 	"payment.wait",
 	"payment.retry",
+	"payment.cancel",
+	"payment.redirect",
 	"inbox",
 	CAPXUL_OPERATIONS.inbox.list,
 	"inbox.get",
@@ -11018,10 +11132,14 @@ const BootstrapFailedProps = Schema.Struct({
 });
 const MemberActivationStartedProps = Schema.Struct({
 	...TelemetryEnvelopeProps,
+	entry_path: JourneyVariantProps.entry_path,
+	surface: JourneyVariantProps.surface,
 	$insert_id: Schema.String
 });
 const MemberActivationReadyProps = Schema.Struct({
 	...TelemetryEnvelopeProps,
+	entry_path: JourneyVariantProps.entry_path,
+	surface: JourneyVariantProps.surface,
 	$insert_id: Schema.String,
 	duration_ms: DurationMsSchema
 });
@@ -12567,7 +12685,7 @@ function mapAccountLifecycle(input) {
 }
 //#endregion
 //#region package.json
-var version = "4.20.0-beta.27";
+var version = "4.20.0-beta.29";
 //#endregion
 //#region src/observability/telemetry/exception-projection.ts
 /** Fixed fallback for failures that have no safe message. */
@@ -12619,7 +12737,7 @@ function report(adapter, kind, operation, cause, invocation, origin, authoritati
 			link = link.cause;
 		}
 	} else if (reportedByMachine(cause)) return;
-	const operationName = normalizeCapxulOperation(operation);
+	const operationName = isCapxulOperation(operation) ? operation : normalizeCapxulOperation(readFailureOperation(cause) ?? operation);
 	const kindName = normalizeErrorKind(errorKind(cause));
 	const context = sanitizeObservationContext({
 		...invocation.context,
@@ -13005,7 +13123,7 @@ const REVERT_SELECTOR_RE = /^0x(?:[0-9a-fA-F]{8})?$/u;
 //#region src/observability/posthog-failure.ts
 /** The expected-outcome codes, read as plain strings so a free-form kind can be looked up. */
 /** Stable PostHog event used for typed failures that are expected product outcomes. */
-const CAPXUL_SDK_EXPECTED_OUTCOME_EVENT = "capxul_sdk_expected_outcome";
+const CAPXUL_SDK_EXPECTED_OUTCOME_EVENT = SDK_EXPECTED_OUTCOME_EVENT_NAME;
 /**
 * Adapt the host's already-initialized PostHog-like client. This function does
 * not import, initialize, configure, or own PostHog.
@@ -15688,6 +15806,12 @@ function paymentsV2Signature(name) {
 const SEND_SIGNATURE = paymentsV2Signature("send");
 const SEND_BATCH_SIGNATURE = paymentsV2Signature("sendBatch");
 const CREATE_COMMITMENT_SIGNATURE = paymentsV2Signature("createCommitment");
+/**
+* #2299 ruling C: only an Owner cancels or redirects an Organization-funded
+* commitment, so these two sit in the Owner role's scope, never a Budget's.
+* The contract admits only the commitment's creator, the Organization Safe.
+*/
+const OWNER_COMMITMENT_SIGNATURES = [paymentsV2Signature("cancel"), paymentsV2Signature("redirect")];
 //#endregion
 //#region ../protocol/src/evm/organization-payments.ts
 /** Zodiac ModuleProxyFactory on Base Sepolia. */
@@ -15924,24 +16048,18 @@ function encodePreparedPaymentCallData(command) {
 		}));
 	}
 	const [item] = command.items;
-	if (command.executionRoute.kind !== "direct" || command.items.length !== 1 || item === void 0 || isBirth(item)) throw Errors.invalidInput("items", "Commitment lifecycle requires one direct execution");
-	return safe4337ExecuteUserOpCallData({
+	const route = command.executionRoute;
+	if (command.items.length !== 1 || item === void 0 || isBirth(item) || route.kind !== "direct" && item.operation === "claim_commitment") throw Errors.invalidInput("items", "Commitment lifecycle requires one lone execution");
+	const call = {
 		to: command.contractAddress,
+		value: 0n,
 		data: lifecycleData(item)
-	});
-}
-//#endregion
-//#region ../protocol/src/evm/role-dsl.ts
-const ORG_BUDGET_ACTIONS = [
-	"send",
-	"sendBatch",
-	"createCommitment"
-];
-/** Derive the Zodiac substrate key for one durable Permission identity. */
-function roleKeyForPermission(permissionId) {
-	const normalized = permissionId.trim();
-	if (normalized.length === 0 || normalized !== permissionId) throw Errors.invalidInput("permissionId", "must be a non-empty canonical Permission ID");
-	return keccak256(toBytes(`permission ${permissionId}`));
+	};
+	return route.kind === "direct" ? safe4337ExecuteUserOpCallData(call) : buildOrgRoleSpendPersonalCallData(buildOrgRoleMultiCall({
+		rolesModuleAddress: route.rolesModule,
+		roleKey: route.roleKey,
+		calls: [call]
+	}));
 }
 //#endregion
 //#region src/payments/operation-verification.ts
@@ -15970,6 +16088,16 @@ function moneySafeOpDigest(operation, chainId) {
 		userOp: safe4337UserOperation(operation)
 	});
 }
+/**
+* An Organization-funded cancel or redirect runs through the Owner role
+* (#2299), which no Budget names. Its role key cannot widen what the signer
+* may do: the Roles module admits only a role the signer's Safe holds, and the
+* contract admits only the commitment's creator.
+*/
+function isOwnerLifecycle(command) {
+	const [item] = command.items;
+	return command.items.length === 1 && (item?.operation === "cancel_commitment" || item?.operation === "redirect_commitment");
+}
 /** Verify every actual Money signing target against configured trust anchors. */
 function verifiesMoneyOperation(evidence, expectedSafe, chainId, permissionId) {
 	try {
@@ -15980,7 +16108,7 @@ function verifiesMoneyOperation(evidence, expectedSafe, chainId, permissionId) {
 		const route = command.executionRoute;
 		if (route.kind === "direct") {
 			if (permissionId !== void 0 || command.senderSafe.toLowerCase() !== expectedSafe.toLowerCase()) return false;
-		} else if (permissionId === void 0 || route.roleKey.toLowerCase() !== roleKeyForPermission(permissionId).toLowerCase() || command.senderSafe.toLowerCase() !== route.organizationSafe.toLowerCase()) return false;
+		} else if ((permissionId === void 0 ? !isOwnerLifecycle(command) : route.roleKey.toLowerCase() !== roleKeyForPermission(permissionId).toLowerCase()) || command.senderSafe.toLowerCase() !== route.organizationSafe.toLowerCase()) return false;
 		if (operation.callData.toLowerCase() !== encodePreparedPaymentCallData(command).toLowerCase()) return false;
 		const digest = moneySafeOpDigest(operation, chainId);
 		return evidence.digest.toLowerCase() === digest.toLowerCase() && evidence.executionId === `money_execution_${digest.slice(2).toLowerCase()}`;
@@ -16770,9 +16898,11 @@ function subscribeFreshQuery(deps, args, listener, operation, projection, option
 //#region src/payments/lifecycle-execution.ts
 /**
 * The prepared command is this lifecycle intent; a retry also names the
-* original birth command of the scope it was asked for.
+* original birth command of the scope it was asked for. A claim, and an
+* Account's own cancel or redirect, runs directly from the signer's Safe; an
+* Organization's cancel or redirect runs through its Owner role (#2299).
 */
-const lifecycleCommandCheck = (intent, expectedOrganizationId) => async (request, evidence) => await matchesIntent(intent)(request, evidence) && (intent.kind !== "retry" || (expectedOrganizationId === void 0 ? evidence.sourceCommand?.kind === "birth" && evidence.sourceCommand.actor.kind === "account" : evidence.sourceCommand?.kind === "birth" && evidence.sourceCommand.actor.kind === "organization" && evidence.sourceCommand.actor.orgId === expectedOrganizationId));
+const lifecycleCommandCheck = (intent, expectedOrganizationId) => async (request, evidence) => await matchesIntent(intent)(request, evidence) && (intent.kind === "retry" ? expectedOrganizationId === void 0 ? evidence.sourceCommand?.kind === "birth" && evidence.sourceCommand.actor.kind === "account" : evidence.sourceCommand?.kind === "birth" && evidence.sourceCommand.actor.kind === "organization" && evidence.sourceCommand.actor.orgId === expectedOrganizationId : evidence.preparedCommand?.executionRoute.kind === (intent.kind === "claim" || expectedOrganizationId === void 0 ? "direct" : "zodiac_role"));
 /** The prepared command pays exactly the request the payer confirmed. */
 const requestPaymentCheck = (confirmation) => async (request) => "kind" in request && request.kind === "payment_request" && canonicalJson(request.confirmation) === canonicalJson(confirmation);
 function executePaymentLifecycle(deps, intent, signal, controls, expectedOrganizationId, onPrepared) {
@@ -17693,17 +17823,21 @@ function paymentExecutionIntent(input) {
 	const to = normalizeTargetForBackend(input.to, "to");
 	if (!to.ok) return to;
 	try {
-		return {
+		const decoded = Schema.decodeResult(PaymentExecutionIntentSchema, { onExcessProperty: "error" })({
+			to: to.value,
+			amount: input.amount,
+			...input.externalAddressAcknowledged === void 0 ? {} : { externalAddressAcknowledged: input.externalAddressAcknowledged },
+			...input.paymentType === void 0 ? {} : { paymentType: input.paymentType },
+			...input.document === void 0 ? {} : { document: input.document },
+			...input.supportingReceipts === void 0 ? {} : { supportingReceipts: input.supportingReceipts },
+			...input.timing === void 0 ? {} : { timing: input.timing }
+		});
+		return Result.isSuccess(decoded) ? {
 			ok: true,
-			value: Schema.decodeSync(PaymentExecutionIntentSchema, { onExcessProperty: "error" })({
-				to: to.value,
-				amount: input.amount,
-				...input.externalAddressAcknowledged === void 0 ? {} : { externalAddressAcknowledged: input.externalAddressAcknowledged },
-				...input.paymentType === void 0 ? {} : { paymentType: input.paymentType },
-				...input.document === void 0 ? {} : { document: input.document },
-				...input.supportingReceipts === void 0 ? {} : { supportingReceipts: input.supportingReceipts },
-				...input.timing === void 0 ? {} : { timing: input.timing }
-			})
+			value: decoded.success
+		} : {
+			ok: false,
+			error: invalidPaymentField(decoded.failure.issue, "invalid personal payment input")
 		};
 	} catch {
 		return {
@@ -17712,6 +17846,30 @@ function paymentExecutionIntent(input) {
 		};
 	}
 }
+const formatIssue = SchemaIssue.makeFormatterStandardSchemaV1();
+/** A key the schema allows only as absent (`currency?: never`). Effect reports it as an empty `AnyOf`. */
+const forbiddenKey = (ast) => SchemaAST.isUnion(ast) && ast.types.every((type) => SchemaAST.isNever(type) || SchemaAST.isUndefined(type));
+/** Whether the issue that the formatter reports first is a key the caller must not pass. */
+function unknownKey(issue) {
+	switch (issue._tag) {
+		case "Encoding":
+		case "Filter":
+		case "Pointer": return unknownKey(issue.issue);
+		case "Composite": return unknownKey(issue.issues[0]);
+		case "AnyOf": return issue.issues[0] === void 0 ? forbiddenKey(issue.ast) : unknownKey(issue.issues[0]);
+		default: return issue._tag === "UnexpectedKey";
+	}
+}
+/**
+* The first failing field and why, e.g. `amount.value`, as the backend's row decode names it (#2381).
+* `callerPath` maps the decoded path to the path the caller passed (#2400).
+*/
+function invalidPaymentField(issue, fallbackReason, callerPath = (path) => path) {
+	const first = formatIssue(issue).issues[0];
+	const path = callerPath(first?.path?.map((segment) => String(typeof segment === "object" ? segment.key : segment)) ?? []);
+	const reason = path.length > 0 && unknownKey(issue) ? `unknown field \`${path.at(-1)}\`` : first?.message;
+	return Errors.invalidInput(path.length === 0 ? "payment" : path.join("."), reason ?? fallbackReason);
+}
 function normalizePaymentTiming(payment) {
 	const { release: _release, ...rest } = payment;
 	return {
@@ -18280,7 +18438,13 @@ const organizationPaymentIntentSchema = Schema.Struct({
 	items: PrepareOrganizationPaymentExecutionInputSchema.fields.items,
 	lineage: PrepareOrganizationPaymentExecutionInputSchema.fields.lineage
 });
-function organizationPaymentIntent(orgId, input) {
+/** One Payment's decoded `items.0.amount.value` is the caller's `amount.value`. */
+const singleItemPath = (path) => path[0] === "items" && path[1] === "0" ? path.slice(2) : path;
+/**
+* Decode a batch. `single` says the caller passed one Payment that its call
+* site wrapped as `items: [item]`, so a refusal names the caller's own field.
+*/
+function organizationPaymentIntent(orgId, input, single = false) {
 	if (input.requestKey !== void 0) {
 		if (Schema.decodeResult(PrepareOrganizationPaymentExecutionInputSchema.fields.requestKey)(input.requestKey)._tag === "Failure") return {
 			ok: false,
@@ -18293,13 +18457,14 @@ function organizationPaymentIntent(orgId, input) {
 		items: input.items,
 		...input.lineage === void 0 ? {} : { lineage: input.lineage }
 	});
-	return decoded._tag === "Failure" ? {
-		ok: false,
-		error: Errors.invalidInput("payment", "invalid Organization Payment input")
-	} : {
+	if (decoded._tag === "Success") return {
 		ok: true,
 		value: decoded.success
 	};
+	return {
+		ok: false,
+		error: invalidPaymentField(decoded.failure.issue, "invalid Organization Payment input", single ? singleItemPath : void 0)
+	};
 }
 async function organizationPaymentRequest(scope, actor, intent, providedKey) {
 	let requestKey;
@@ -18405,12 +18570,12 @@ function executionDependencies$1(input) {
 * Submit one Organization payment batch. Callers that repeat a request key join
 * the flight already in progress instead of preparing a second execution.
 */
-async function executeOrganizationBatch(scope, input, signal, operation, controls, onPrepared) {
+async function executeOrganizationBatch(scope, input, signal, operation, controls, onPrepared, single = false) {
 	if (signal?.aborted === true) return {
 		ok: false,
 		error: Errors.cancelled({ operation })
 	};
-	const intent = organizationPaymentIntent(scope.orgId, input);
+	const intent = organizationPaymentIntent(scope.orgId, input, single);
 	if (!intent.ok) return intent;
 	const execution = executionDependencies$1(scope.deps);
 	if (execution === null) return {
@@ -18527,7 +18692,28 @@ function makeOrganizationPaymentsMethods(deps, orgId) {
 		requestKeyScope: deps.requestKeyScope ?? `client-${crypto.randomUUID()}`,
 		flights: /* @__PURE__ */ new Map()
 	};
-	const execute = (input, signal, operation = "organization-pay-batch", controls, onPrepared) => executeOrganizationBatch(scope, input, signal, operation, controls, onPrepared);
+	const execute = (input, signal, operation = "organization-pay-batch", controls, onPrepared, single = false) => executeOrganizationBatch(scope, input, signal, operation, controls, onPrepared, single);
+	/** One Owner-signed cancel or redirect, answering the one Payment it acted on (#2299). */
+	const ownerLifecycle = (intent, controls, operation) => runCapxulEffect(Effect.gen(function* () {
+		const captured = carryInvocationParentSpan(controls, yield* Effect.currentSpan.pipe(Effect.orDie));
+		return yield* awaitCapxulResult(async () => {
+			const execution = executionDependencies$1(deps);
+			if (execution === null) return {
+				ok: false,
+				error: Errors.notImplemented("organizationPayments", "executionComposition")
+			};
+			const result = await executePaymentLifecycle(execution, intent, controls?.signal, captured, orgId);
+			if (!result.ok) return result;
+			const [payment, ...rest] = result.value.payments;
+			return payment === void 0 || rest.length !== 0 ? {
+				ok: false,
+				error: Errors.unknown()
+			} : {
+				ok: true,
+				value: normalizePaymentTiming(payment)
+			};
+		});
+	}), observationOnlyControls(controls), operation, deps.runPromise);
 	return {
 		...makeOrganizationPaymentReadMethods(deps, orgId),
 		retry: (paymentId, options) => {
@@ -18573,7 +18759,7 @@ function makeOrganizationPaymentsMethods(deps, orgId) {
 						...providedRequestKey === void 0 ? {} : { requestKey: providedRequestKey },
 						items: [item],
 						...lineage === void 0 ? {} : { lineage }
-					}, controls?.signal, "organization-pay", captured, options?.onPrepared);
+					}, controls?.signal, "organization-pay", captured, options?.onPrepared, true);
 					if (!result.ok) return result;
 					const payment = result.value[0];
 					return payment === void 0 ? {
@@ -18586,6 +18772,19 @@ function makeOrganizationPaymentsMethods(deps, orgId) {
 				});
 			}), observationOnlyControls(controls), CAPXUL_OPERATIONS.organizationPayments.pay, deps.runPromise);
 		},
+		cancel: (paymentId, options) => ownerLifecycle({
+			kind: "cancel",
+			paymentId
+		}, deps.invocationControls?.(options) ?? options, CAPXUL_OPERATIONS.organizationPayments.cancel),
+		redirect: (input, options) => {
+			const controls = deps.invocationControls?.(options) ?? options;
+			const recipient = normalizeTargetForBackend(input.to, "to");
+			return recipient.ok ? ownerLifecycle({
+				kind: "redirect",
+				paymentId: input.paymentId,
+				recipient: recipient.value
+			}, controls, CAPXUL_OPERATIONS.organizationPayments.redirect) : runCapxulEffect(Effect.fail(recipient.error), observationOnlyControls(controls), CAPXUL_OPERATIONS.organizationPayments.redirect, deps.runPromise);
+		},
 		payBatch: (input, options) => {
 			const controls = deps.invocationControls?.(options) ?? options;
 			return runCapxulEffect(Effect.gen(function* () {
@@ -19745,20 +19944,45 @@ async function checked(deps, signerAddress, prepared, expected, close) {
 	};
 	return close ? abandonPrepared(deps, evidence.executionId, "prepared_mismatch", refused) : refused;
 }
-/** A retry, a request payment or a payroll run, rather than a new Payment. */
-const isCommandApproval = (input) => "retry" in input || "request" in input || "payrollRun" in input;
-/** Prepare a retry, a request payment or a payroll run for `signerAddress`, checked. */
+/** A retry, cancel or redirect, a request payment or a payroll run, rather than a new Payment. */
+const isCommandApproval = (input) => "retry" in input || "cancel" in input || "redirect" in input || "request" in input || "payrollRun" in input;
+/** The next step of an existing Payment the input names; a recipient that cannot be one is refused. */
+function lifecycleIntent(input) {
+	if ("retry" in input) return {
+		ok: true,
+		value: {
+			kind: "retry",
+			paymentId: input.retry
+		}
+	};
+	if ("cancel" in input) return {
+		ok: true,
+		value: {
+			kind: "cancel",
+			paymentId: input.cancel
+		}
+	};
+	const recipient = normalizeTargetForBackend(input.to, "to");
+	return recipient.ok ? {
+		ok: true,
+		value: {
+			kind: "redirect",
+			paymentId: input.redirect,
+			recipient: recipient.value
+		}
+	} : recipient;
+}
+/** Prepare a retry, cancel, redirect, request payment or payroll run for `signerAddress`, checked. */
 function prepareVerifiedCommand(deps, input, signerAddress, signal) {
-	if ("retry" in input) return prepareVerifiedRetry(deps, input, signerAddress, signal);
 	if ("request" in input) return prepareVerifiedRequestPayment(deps, input, signerAddress, signal);
-	return prepareVerifiedPayrollRun(deps, input, signerAddress, signal);
-}
-/** The retry of one Payment, prepared in the scope that paid it. */
-async function prepareVerifiedRetry(deps, input, signerAddress, signal) {
-	const intent = {
-		kind: "retry",
-		paymentId: input.retry
-	};
+	if ("payrollRun" in input) return prepareVerifiedPayrollRun(deps, input, signerAddress, signal);
+	return prepareVerifiedLifecycle(deps, input, signerAddress, signal);
+}
+/** The next step of one Payment, prepared in the scope that paid it. */
+async function prepareVerifiedLifecycle(deps, input, signerAddress, signal) {
+	const named = lifecycleIntent(input);
+	if (!named.ok) return named;
+	const intent = named.value;
 	return checked(deps, signerAddress, await runIfActive(signal, CAPXUL_OPERATIONS.payments.prepareLifecycleExecution, () => callOperation(deps.convexCall, lifecycles.prepareScoped, {
 		signerAddress,
 		intent,
@@ -19827,7 +20051,7 @@ async function prepareVerifiedOrganizationPayment(deps, input, signerAddress, si
 		items: [item],
 		...lineage === void 0 ? {} : { lineage },
 		...requestKey === void 0 ? {} : { requestKey }
-	});
+	}, true);
 	if (!intent.ok) return intent;
 	const session = deps.actor?.authSession() ?? null;
 	if (session === null || deps.chainId === void 0) return {
@@ -19885,6 +20109,16 @@ async function readApprovalPayments(deps, paymentIds, organizationId, signal) {
 }
 //#endregion
 //#region src/accounts/approvals.ts
+/** A Permission write or an invitation, rather than a Payment. */
+const isPermissionChange = (input) => "permission" in input || "invite" in input;
+/** Only a Permission change or an invitation moves no money: its own owner sends it. */
+const movesMoney = (approval) => approval.kind !== "permission_change" && approval.kind !== "invitation";
+/**
+* A wait ends once it is sent: a Permission change or an invitation, and a
+* cancel or redirect of a held Payment, whose Payment was sent long before
+* and so cannot say whether this step was (#2439).
+*/
+const endsOnceSent = (approval) => !movesMoney(approval) || approval.kind === "payment_cancel" || approval.kind === "payment_redirect";
 function makeApprovalsMethods(deps) {
 	const call = (name, row, args, signal) => runIfActive(signal, name, () => callOperation(deps.convexCall, row, args, { fresh: true }).pipe(Effect.mapError((publicError) => ({ publicError }))), deps.runPromise);
 	const get = (approvalId) => call(approvals.get.name, approvals.get, { approvalId });
@@ -19925,6 +20159,10 @@ function makeApprovalsMethods(deps) {
 	const prepare = async (input, options) => {
 		const signal = options?.signal;
 		if (isCommandApproval(input)) return openApproval(signal, (signerAddress) => prepareVerifiedCommand(deps, input, signerAddress, signal));
+		if (isPermissionChange(input)) return openApproval(signal, async (signerAddress) => {
+			const { prepareVerifiedPermissionChange } = await import("./permission-approvals-B4iv9bXz.mjs");
+			return prepareVerifiedPermissionChange(deps, input, signerAddress, signal);
+		});
 		if ("organizationId" in input) return openApproval(signal, (signerAddress) => prepareVerifiedOrganizationPayment(deps, input, signerAddress, signal));
 		const intent = paymentExecutionIntent(input);
 		if (!intent.ok) return intent;
@@ -19991,10 +20229,23 @@ function makeApprovalsMethods(deps) {
 	const submit = async (approvalId) => {
 		const consumed = await call(approvals.consume.name, approvals.consume, { approvalId });
 		if (!consumed.ok) return consumed;
-		const sent = await call(executions.submitCommand.name, executions.submitCommand, {
-			executionId: consumed.value.approval.operation.executionId,
-			signature: consumed.value.signature
-		});
+		const { approval, signature } = consumed.value;
+		const signed = {
+			executionId: approval.operation.executionId,
+			signature
+		};
+		if (!movesMoney(approval)) {
+			const row = approval.kind === "invitation" ? configurations : commands;
+			const sent = await call(row.submitExecution.name, row.submitExecution, signed);
+			return sent.ok ? {
+				ok: true,
+				value: {
+					approval,
+					payments: []
+				}
+			} : sent;
+		}
+		const sent = await call(executions.submitCommand.name, executions.submitCommand, signed);
 		if (!sent.ok) return sent;
 		return {
 			ok: true,
@@ -20017,6 +20268,20 @@ function makeApprovalsMethods(deps) {
 			ok: true,
 			value: null
 		};
+		if (endsOnceSent(approval)) {
+			if (approval.state !== "approved" && approval.state !== "consumed") return {
+				ok: true,
+				value: {
+					approval,
+					payments: []
+				}
+			};
+			const sent = await submit(approvalId);
+			return sent.ok || !anotherSendInFlight(sent.error) ? sent : {
+				ok: true,
+				value: null
+			};
+		}
 		const payments = await readApprovalPayments(deps, approval.operation.paymentIds, organizationId ?? (approval.actor.kind === "organization" ? approval.actor.orgId : void 0), signal);
 		if (!payments.ok) return payments;
 		if (unsent(approval, payments.value)) {
@@ -22946,4 +23211,4 @@ function executeIdentityProductObservation(telemetry, record, state) {
 	return ignoreTransportFailure(() => invocationTelemetry.emit(mapped), "emit", mapped.name).pipe(Effect.andThen(ignoreTransportFailure(after, mapped.name === "auth_signed_out" ? "reset" : "identify", mapped.name)));
 }
 //#endregion
-export { parseAssetAmount as $, InvitationViewSchema as $n, SystemClockLayer as $r, version as $t, registerProductTelemetryInvocation as A, toJwtToken as Ai, details as An, toWeiAmount as Ar, safe4337ExecuteUserOpCallData as At, makeOrganizationPaymentsMethods as B, AuthCachePortTag as Bi, FixedOfferDraftSchema as Bn, runCapxulEffect as Br, failureEvidenceProps as Bt, AccountReadPortTag as C, parseAuthSession as Ci, CLI_INVOCATION_KINDS as Cn, toAssetId as Cr, SEND_BATCH_SIGNATURE as Ct, convexCallErrorFromCapxul as D, toEpochSeconds as Di, isCapxulOperation as Dn, isEvmAddress as Dr, TOKENS as Dt, ConvexCallPortTag as E, toEpochMs as Ei, CAPXUL_OPERATIONS as En, EVM_ADDRESS_RE$1 as Er, CONFIGURED_MONEY_ASSETS as Et, decodePayrollRunInput as F, FAILURE_MODES$1 as Fi, replacements as Fn, publicIdentityFailure as Fr, SAFE_SENTINEL_OWNERS as Ft, makeActorRelationshipMethods as G, treasuries as Gn, toCapxulResult as Gr, observationContextProps as Gt, makePaymentsMethods as H, members as Hn, awaitCapxulResult as Hr, postHogFailureObservation as Ht, toPayrollGroupId as I, isFailureMode as Ii, PreparedPermissionExecutionSchema as In, runIdentityFacade as Ir, callOperation as It, makeTargetsMethods as J, ORGANIZATION_SETUP_REASONS as Jn, EXPECTED_OPERATION_OUTCOMES as Jr, SDK_VERSION as Jt, makeCheckoutMethods as K, workspaces as Kn, formatTraceparent as Kr, withCapturedAttemptContext as Kt, makeAccountMethods as L, isRecord as Li, PermissionCommandViewSchema as Ln, runPortEffect as Lr, asCapxulError as Lt, makeApprovalsMethods as M, Errors as Mi, authorities as Mn, reference as Mr, buildSafeMultiSendExecTransactionCall as Mt, makePayrollMethods as N, CapxulError as Ni, commands as Nn, makeAuthMethods as Nr, BASE_SEPOLIA_CHAIN_ID as Nt, retryIdempotentRead as O, toAuthUserId as Oi, normalizeCapxulOperation as On, toAddress as Or, deriveCapxulSafeAddress as Ot, makeUnavailablePayrollMethods as P, isCapxulError as Pi, configurations as Pn, askIdentity as Pr, MULTI_SEND_CALL_ONLY as Pt, formatAssetAmount as Q, toOrgId as Qn, oauthBearerAuthClient as Qr, safeExceptionLabel as Qt, emitDepositInitiated as R, readField as Ri, PayrollGroupIdSchema as Rn, sessionFromActor as Rr, toPublicError$1 as Rt, valueIn as S, BrowserAuthCacheAdapter as Si, CLI_COMMAND_NAMES as Sn, currencySymbolFor as Sr, SAFE_ENABLE_MODULE_ABI as St, TelemetryPortTag as T, toDurationMs as Ti, stampTelemetryEnvelope as Tn, toExactAssetAmount as Tr, CAPXUL_PAYMENTS_V2_ADDRESS as Tt, waitForPaymentSubmission as U, roles as Un, defectAsCapxulError as Ur, observeFailedResult as Ut, makeOfframpMethods as V, invitations as Vn, withVerifiedOrganizationScope as Vr, CAPXUL_SDK_EXPECTED_OUTCOME_EVENT as Vt, makeDestinationsMethods as W, setups as Wn, runIfActive as Wr, observeSdkClient as Wt, assetAmountFromRaw as X, CHAIN_UPSTREAMS as Xn, carryInvocationParentSpan as Xr, normalizeExceptionOperation as Xt, subscribeFreshQuery as Y, ORGANIZATION_SETUP_STATUSES as Yn, ActorFailure as Yr, normalizeExceptionErrorKind as Yt, assetSymbolFor as Z, decodeChainCause as Zn, withInvocationParentSpan as Zr, projectSdkException as Zt, accountFromAccountPositions as _, AuthClientError as _i, toPartyId as _n, toBudgetId as _r, ROLES_EXEC_TRANSACTION_WITH_ROLE_ABI as _t, paymentPhase as a, observationRequestHeaders as ai, isSignerNotReadySignal as an, images as ar, fingerprintPaymentIntent as at, MONEY_READ_RATES as b, globalLocalStorage as bi, redactTelemetryProps as bn, toRoleKey as br, ROLES_SET_UP_ABI as bt, makePaymentDocumentsMethods as c, readInvocationObservation as ci, signerFailure as cn, isBytes32 as cr, roleKeyForPermission as ct, SmartAccountPortTag as d, redactUrlSecrets as di, makeClientRequestMethods as dn, toLowerBytes32 as dr, CREATE_COMMITMENT_SIGNATURE as dt, ClockError as ei, isSettingUpLifecycle as en, hashPermissionReplacementPreview as er, requireAsset as et, smartAccountErrorFromCapxul as f, isCredentialField as fi, toCountryCode as fn, toLowerHex as fr, MODULE_PROXY_FACTORY_ABI as ft, ConvexAccountLayer as g, authClientPortFromPromiseAdapter as gi, toHandle as gn, EpochMsSchema$1 as gr, ROLES_ASSIGN_ROLES_ABI as gt, makeAccountsMethods as h, toPublishableKey as hi, HANDLE_RE as hn, DurationMsSchema$1 as hr, PARAMETER_TYPE as ht, inboxPhase as i, BetterAuthBrowserLayer as ii, isEcdsaSignatureHex as in, AppIdSchema$1 as ir, canonicalJson as it, wireChainId as j, toSessionToken as ji, onboardings as jn, absurd as jr, safe4337MultiSendUserOpCallData as jt, bindProductTelemetryInvocation as k, toEmail as ki, OPERATIONS as kn, toChainId as kr, normalizeSafeSaltEmail as kt, makeSmartAccountMethods as l, sanitizeObservationContext as li, resolveFailureMode as ln, toExactHex as lr, ZODIAC_MODULE_PROXY_FACTORY as lt, PonderIndexerAdapter as m, toAppId as mi, toTesterKind as mn, PAYMENT_STATUSES as mr, OPERATOR as mt, bootIdentityFlow as n, readClockNow as ni, causeChain as nn, CurrentPolicySchema as nr, isMoneyParseError as nt, requestPhase as o, attachInvocationObservation as oi, openfortSignerNotReadyCode as on, toAccountId as or, moneySafeOpDigest as ot, makeHoldingsMethods as p, toAllowedOrigin as pi, toKycTier as pn, PAYMENT_DIRECTIONS as pr, MULTI_SEND_SELECTOR as pt, isCheckoutSettlementConsumed as q, OrganizationSetupSchema as qn, CAPXUL_ERROR_CODES as qr, EXCEPTION_MESSAGE as qt, makeMeMethods as r, BetterAuthNodeLayer as ri, injectedWalletSigner as rn, diagnostics as rr, parseMoney as rt, makeActivityMethods as s, copyInvocationObservation as si, recoverRawDigestSigner as sn, PaymentDocumentOptionsSchema as sr, ORG_BUDGET_ACTIONS as st, executeIdentityProductObservation as t, ClockPortTag as ti, UNOBSERVABLE_SIGNER_STATUS as tn, decodePermissionIntent as tr, toRaw as tt, ConvexSmartAccountLayer as u, redactSecrets as ui, makeCurrentUserMethods as un, toLowerAddress as ur, resolveOrgPermissionIdentity as ut, accountPositionsFromWire as v, AuthClientPortTag as vi, validateHandle as vn, toPermissionAssignmentId as vr, ROLES_SET_ALLOWANCE_ABI as vt, accountReadErrorFromCapxul as w, parseCachedJwt as wi, EXCEPTION_EVENT_NAME as wn, toCurrencyCode as wr, SEND_SIGNATURE as wt, valueActivitySummary as x, InMemoryAuthCacheAdapter as xi, CLI_CAPABILITIES as xn, ChainIdSchema$1 as xr, ROLE_MANAGEMENT_SIGNATURES as xt, positionPeg as y, detectAuthCacheAdapter as yi, redactTelemetryEvent as yn, toPermissionId as yr, ROLES_SET_TRANSACTION_UNWRAPPER_ABI as yt, logDroppedEvent as z, AuthCacheError as zi, PayrollGroupInputSchema as zn, observationOnlyControls as zr, failureDetail as zt };
+export { formatAssetAmount as $, InvitationViewSchema as $n, ActorFailure as $r, version as $t, registerProductTelemetryInvocation as A, toEpochMs as Ai, details as An, EVM_ADDRESS_RE$1 as Ar, safe4337ExecuteUserOpCallData as At, makeOrganizationPaymentsMethods as B, isFailureMode as Bi, FixedOfferDraftSchema as Bn, runIdentityFacade as Br, failureEvidenceProps as Bt, AccountReadPortTag as C, detectAuthCacheAdapter as Ci, CLI_INVOCATION_KINDS as Cn, toPermissionId as Cr, SEND_BATCH_SIGNATURE as Ct, convexCallErrorFromCapxul as D, parseAuthSession as Di, isCapxulOperation as Dn, toAssetId as Dr, TOKENS as Dt, ConvexCallPortTag as E, BrowserAuthCacheAdapter as Ei, CAPXUL_OPERATIONS as En, currencySymbolFor as Er, CONFIGURED_MONEY_ASSETS as Et, decodePayrollRunInput as F, toSessionToken as Fi, replacements as Fn, absurd as Fr, SAFE_SENTINEL_OWNERS as Ft, makeActorRelationshipMethods as G, treasuries as Gn, withVerifiedOrganizationScope as Gr, observationContextProps as Gt, makePaymentsMethods as H, readField as Hi, members as Hn, sessionFromActor as Hr, postHogFailureObservation as Ht, toPayrollGroupId as I, Errors as Ii, PreparedPermissionExecutionSchema as In, reference as Ir, callOperation as It, makeTargetsMethods as J, ORGANIZATION_SETUP_REASONS as Jn, runIfActive as Jr, SDK_VERSION as Jt, makeCheckoutMethods as K, workspaces as Kn, awaitCapxulResult as Kr, withCapturedAttemptContext as Kt, makeAccountMethods as L, CapxulError as Li, PermissionCommandViewSchema as Ln, makeAuthMethods as Lr, asCapxulError as Lt, makeApprovalsMethods as M, toAuthUserId as Mi, authorities as Mn, toAddress as Mr, buildSafeMultiSendExecTransactionCall as Mt, makePayrollMethods as N, toEmail as Ni, commands as Nn, toChainId as Nr, BASE_SEPOLIA_CHAIN_ID as Nt, retryIdempotentRead as O, parseCachedJwt as Oi, normalizeCapxulOperation as On, toCurrencyCode as Or, deriveCapxulSafeAddress as Ot, makeUnavailablePayrollMethods as P, toJwtToken as Pi, configurations as Pn, toWeiAmount as Pr, MULTI_SEND_CALL_ONLY as Pt, assetSymbolFor as Q, toOrgId as Qn, EXPECTED_OPERATION_OUTCOMES as Qr, safeExceptionLabel as Qt, emitDepositInitiated as R, isCapxulError as Ri, PayrollGroupIdSchema as Rn, askIdentity as Rr, toPublicError$1 as Rt, valueIn as S, AuthClientPortTag as Si, CLI_COMMAND_NAMES as Sn, toPermissionAssignmentId as Sr, SAFE_ENABLE_MODULE_ABI as St, TelemetryPortTag as T, InMemoryAuthCacheAdapter as Ti, stampTelemetryEnvelope as Tn, ChainIdSchema$1 as Tr, CAPXUL_PAYMENTS_V2_ADDRESS as Tt, waitForPaymentSubmission as U, AuthCacheError as Ui, roles as Un, observationOnlyControls as Ur, observeFailedResult as Ut, makeOfframpMethods as V, isRecord as Vi, invitations as Vn, runPortEffect as Vr, CAPXUL_SDK_EXPECTED_OUTCOME_EVENT as Vt, makeDestinationsMethods as W, AuthCachePortTag as Wi, setups as Wn, runCapxulEffect as Wr, observeSdkClient as Wt, abandonPrepared as X, CHAIN_UPSTREAMS as Xn, formatTraceparent as Xr, normalizeExceptionOperation as Xt, subscribeFreshQuery as Y, ORGANIZATION_SETUP_STATUSES as Yn, toCapxulResult as Yr, normalizeExceptionErrorKind as Yt, assetAmountFromRaw as Z, decodeChainCause as Zn, CAPXUL_ERROR_CODES as Zr, projectSdkException as Zt, accountFromAccountPositions as _, toAllowedOrigin as _i, toPartyId as _n, PAYMENT_DIRECTIONS as _r, ROLES_EXEC_TRANSACTION_WITH_ROLE_ABI as _t, paymentPhase as a, ClockPortTag as ai, isSignerNotReadySignal as an, ORG_BUDGET_ACTIONS as ar, canonicalJson as at, MONEY_READ_RATES as b, authClientPortFromPromiseAdapter as bi, redactTelemetryProps as bn, EpochMsSchema$1 as br, ROLES_SET_UP_ABI as bt, makePaymentDocumentsMethods as c, BetterAuthBrowserLayer as ci, signerFailure as cn, AppIdSchema$1 as cr, ZODIAC_MODULE_PROXY_FACTORY as ct, SmartAccountPortTag as d, copyInvocationObservation as di, makeClientRequestMethods as dn, PaymentDocumentOptionsSchema as dr, MODULE_PROXY_FACTORY_ABI as dt, carryInvocationParentSpan as ei, isSettingUpLifecycle as en, hashPermissionReplacementPreview as er, parseAssetAmount as et, smartAccountErrorFromCapxul as f, readInvocationObservation as fi, toCountryCode as fn, isBytes32 as fr, MULTI_SEND_SELECTOR as ft, ConvexAccountLayer as g, isCredentialField as gi, toHandle as gn, toLowerHex as gr, ROLES_ASSIGN_ROLES_ABI as gt, makeAccountsMethods as h, redactUrlSecrets as hi, HANDLE_RE as hn, toLowerBytes32 as hr, PARAMETER_TYPE as ht, inboxPhase as i, ClockError as ii, isEcdsaSignatureHex as in, MONTHLY_REFILL_PERIOD_SECONDS as ir, parseMoney as it, wireChainId as j, toEpochSeconds as ji, onboardings as jn, isEvmAddress as jr, safe4337MultiSendUserOpCallData as jt, bindProductTelemetryInvocation as k, toDurationMs as ki, OPERATIONS as kn, toExactAssetAmount as kr, normalizeSafeSaltEmail as kt, makeSmartAccountMethods as l, observationRequestHeaders as li, resolveFailureMode as ln, images as lr, resolveOrgPermissionIdentity as lt, PonderIndexerAdapter as m, redactSecrets as mi, toTesterKind as mn, toLowerAddress as mr, OWNER_COMMITMENT_SIGNATURES as mt, bootIdentityFlow as n, oauthBearerAuthClient as ni, causeChain as nn, keepRefillOnChange as nr, toRaw as nt, requestPhase as o, readClockNow as oi, openfortSignerNotReadyCode as on, roleKeyForPermission as or, fingerprintPaymentIntent as ot, makeHoldingsMethods as p, sanitizeObservationContext as pi, toKycTier as pn, toExactHex as pr, OPERATOR as pt, isCheckoutSettlementConsumed as q, OrganizationSetupSchema as qn, defectAsCapxulError as qr, EXCEPTION_MESSAGE as qt, makeMeMethods as r, SystemClockLayer as ri, injectedWalletSigner as rn, CurrentPolicySchema as rr, isMoneyParseError as rt, makeActivityMethods as s, BetterAuthNodeLayer as si, recoverRawDigestSigner as sn, diagnostics as sr, moneySafeOpDigest as st, executeIdentityProductObservation as t, withInvocationParentSpan as ti, UNOBSERVABLE_SIGNER_STATUS as tn, decodePermissionIntent as tr, requireAsset as tt, ConvexSmartAccountLayer as u, attachInvocationObservation as ui, makeCurrentUserMethods as un, toAccountId as ur, CREATE_COMMITMENT_SIGNATURE as ut, accountPositionsFromWire as v, toAppId as vi, validateHandle as vn, PAYMENT_STATUSES as vr, ROLES_SET_ALLOWANCE_ABI as vt, accountReadErrorFromCapxul as w, globalLocalStorage as wi, EXCEPTION_EVENT_NAME as wn, toRoleKey as wr, SEND_SIGNATURE as wt, valueActivitySummary as x, AuthClientError as xi, CLI_CAPABILITIES as xn, toBudgetId as xr, ROLE_MANAGEMENT_SIGNATURES as xt, positionPeg as y, toPublishableKey as yi, redactTelemetryEvent as yn, DurationMsSchema$1 as yr, ROLES_SET_TRANSACTION_UNWRAPPER_ABI as yt, logDroppedEvent as z, FAILURE_MODES$1 as zi, PayrollGroupInputSchema as zn, publicIdentityFailure as zr, failureDetail as zt };