@capxul/sdk 4.20.0-beta.3 → 4.20.0-beta.30

package/dist/OAuthBearerAuthClient-DWkofxdZ.mjs

@@ -1,2488 +0,0 @@
-import { concat, encodeAbiParameters, encodeFunctionData, encodePacked, getContractAddress, keccak256, padHex, stringToHex, toBytes, toEventSelector, toFunctionSelector, toFunctionSignature } from "viem";
-import { Context, Data, Effect, Layer, Result } from "effect";
-//#region ../errors/src/secret-material.ts
-const CREDENTIAL_FIELDS = /* @__PURE__ */ new Set([
-	"password",
-	"passwd",
-	"pwd",
-	"pass",
-	"passphrase",
-	"currentpassword",
-	"newpassword",
-	"confirmpassword",
-	"passwordconfirmation",
-	"passwordhash",
-	"hashedpassword",
-	"pin",
-	"privatekey",
-	"walletprivatekey",
-	"secretkey",
-	"signingkey",
-	"signingsecret",
-	"seed",
-	"seedphrase",
-	"mnemonic",
-	"recoveryphrase",
-	"recovery",
-	"recoverycode",
-	"recoverycodes",
-	"keyshare",
-	"signingmaterial",
-	"recoverymaterial",
-	"privatekeybytes",
-	"signingprivatekey",
-	"encryptionkey",
-	"decryptionkey",
-	"authtoken",
-	"apitoken",
-	"bearertoken",
-	"oauthtoken",
-	"csrftoken",
-	"clientassertion",
-	"token",
-	"accesstoken",
-	"refreshtoken",
-	"idtoken",
-	"sessiontoken",
-	"session",
-	"sessionkey",
-	"sessionsecret",
-	"authsessionid",
-	"sessioncredential",
-	"sessioncredentials",
-	"sessioncookie",
-	"auth",
-	"authentication",
-	"authorization",
-	"proxyauthorization",
-	"cookie",
-	"cookies",
-	"setcookie",
-	"apikey",
-	"xapikey",
-	"xauthtoken",
-	"clientsecret",
-	"secret",
-	"secrets",
-	"credential",
-	"credentials",
-	"signature",
-	"otp",
-	"otpcode",
-	"totpsecret",
-	"onetimecode",
-	"onetimepassword",
-	"verificationcode",
-	"authcode",
-	"authorizationcode",
-	"oauthcode",
-	"codeverifier",
-	"devicecode",
-	"usercode",
-	"continuitytoken",
-	"refreshattemptid",
-	"revocationtoken"
-]);
-/** Match credential fields by meaning, without hiding token addresses or replay IDs. */
-function isCredentialField(name, context) {
-	const normalized = name.toLowerCase().replace(/[^a-z0-9]/gu, "");
-	return CREDENTIAL_FIELDS.has(normalized) || /(?:password(?:hash)?|passwd|passphrase|privatekey|signingkey|apikey|clientsecret|accesstoken|refreshtoken|sessiontoken)$/u.test(normalized) || context === "authentication" && (normalized === "code" || normalized === "sessionid") || context === "header" && /(?:token|secret|apikey|privatekey|signingkey|password|authorization|cookie|session)$/u.test(normalized);
-}
-function decodeUrlComponent(text) {
-	try {
-		return decodeURIComponent(text);
-	} catch {
-		return text;
-	}
-}
-/** Preserve URL diagnostics while removing credentials from their declared components. */
-function redactUrlSecrets(value, source) {
-	try {
-		const absolute = /^[a-z][a-z0-9+.-]*:/iu.test(value);
-		const protocolRelative = value.startsWith("//");
-		const url = new URL(value, "https://redaction.invalid");
-		if (url.protocol !== "https:" && url.protocol !== "http:") return maskText(value);
-		let changed = url.username.length > 0 || url.password.length > 0;
-		const maskParams = (params) => new URLSearchParams(Array.from(params, ([name, entry]) => {
-			const safeName = maskText(name);
-			const safeEntry = isCredentialField(name) || /^(?:code|draft|__posthog)$/iu.test(name) ? "[REDACTED]" : maskText(entry);
-			changed ||= safeName !== name || safeEntry !== entry;
-			return [safeName, safeEntry];
-		})).toString();
-		const provider = source === "alchemy" || source === "infura" || /(?:^|\.)(?:alchemy\.com|alchemyapi\.io|infura\.io)$/iu.test(url.hostname);
-		const rawPath = absolute || protocolRelative ? url.pathname : value.split(/[?#]/u)[0] ?? "";
-		const segments = rawPath.split("/");
-		let path = segments.map((segment, index) => {
-			const decoded = decodeUrlComponent(segment);
-			const masked = provider && /^v[23]$/u.test(decodeUrlComponent(segments[index - 1] ?? "")) && decoded.length > 0 ? "[REDACTED]" : maskText(decoded);
-			changed ||= masked !== decoded;
-			return masked === decoded ? segment : encodeURIComponent(masked);
-		}).join("/");
-		if (source === "gateway" && rawPath.length > 0) {
-			path = `${rawPath.startsWith("/") ? "/" : ""}${encodeURIComponent("[REDACTED]")}`;
-			changed = true;
-		}
-		const query = maskParams(url.searchParams);
-		const fragment = url.hash.slice(1);
-		const decodedFragment = decodeUrlComponent(fragment);
-		const maskedFragment = maskText(decodedFragment);
-		changed ||= maskedFragment !== decodedFragment;
-		const fragmentQuery = fragment.indexOf("?");
-		const fragmentPath = fragment.slice(0, fragmentQuery);
-		const maskedFragmentPath = maskText(decodeUrlComponent(fragmentPath));
-		changed ||= maskedFragmentPath !== decodeUrlComponent(fragmentPath);
-		const hash = fragmentQuery >= 0 ? `${maskedFragmentPath === decodeUrlComponent(fragmentPath) ? fragmentPath : encodeURIComponent(maskedFragmentPath)}?${maskParams(new URLSearchParams(fragment.slice(fragmentQuery + 1)))}` : fragment.includes("=") ? maskParams(new URLSearchParams(fragment)) : maskedFragment === decodedFragment ? fragment : encodeURIComponent(maskedFragment);
-		const origin = absolute ? url.origin : protocolRelative ? `//${url.host}` : "";
-		if (!changed) return value;
-		return `${origin}${path}${query ? `?${query}` : ""}${hash ? `#${hash}` : ""}`;
-	} catch {
-		if (source === "gateway") return "[REDACTED]";
-		return maskText(value.replace(/(https?:\/\/)[^/\s@]+@/giu, "$1[REDACTED]@").replace(/([?&#])([^=&#]+)=([^&#]*)/gu, (whole, separator, name) => isCredentialField(decodeUrlComponent(name)) || /^(?:code|draft|__posthog)$/iu.test(decodeUrlComponent(name)) ? `${separator}${name}=[REDACTED]` : whole));
-	}
-}
-const JSON_FIELD = /("(?:[^"\\]|\\.)*")(\s*:\s*)("(?:[^"\\]|\\.)*"|-?\d+(?:\.\d+)?(?:[eE][+-]?\d+)?|true|false|null)/gu;
-const PROSE_FIELD = /(?=(\b([A-Za-z][A-Za-z0-9_-]*(?:[ \t]+[A-Za-z][A-Za-z0-9_-]*){0,3})\s*[:=]\s*((?:Bearer|Basic)[ \t]+[^\s,;"']+|"(?:[^"\\]|\\.)*"|'(?:[^'\\]|\\.)*'|[^\s,;&"']+)))/gu;
-const EMBEDDED_URL = /(https?:\/\/[^\s"<>]*)/giu;
-function isSecretLabel(name) {
-	return isCredentialField(name) || /^request[ _-]?body$/iu.test(name);
-}
-const JSON_ENCODING_MAX = 8;
-const JSON_NESTING_MAX = 64;
-const JSON_KEY = /("(?:[^"\\]|\\.)*")\s*:/gu;
-const JSON_CONTAINER_START = /(?:\{\s*["}]|\[\s*[[\]{}"0-9tfn-])/uy;
-function hasSecretJsonKey(value) {
-	for (const match of value.matchAll(JSON_KEY)) try {
-		if (match[1] !== void 0 && isSecretLabel(JSON.parse(match[1]))) return true;
-	} catch {}
-	return false;
-}
-/** Project a complete fragment once. Never retry all of its nested substrings. */
-function projectJsonFragment(value, encodingDepth, overDepth) {
-	if (overDepth || encodingDepth >= JSON_ENCODING_MAX) return "[REDACTED]";
-	let parsed;
-	try {
-		parsed = JSON.parse(value);
-	} catch {
-		return hasSecretJsonKey(value) ? "[REDACTED]" : value;
-	}
-	try {
-		let changed = false;
-		const masked = JSON.stringify(parsed, (name, nested) => {
-			if (isSecretLabel(name)) {
-				changed ||= nested !== "[REDACTED]";
-				return "[REDACTED]";
-			}
-			if (typeof nested === "string") {
-				const projected = maskJsonFragments(nested, encodingDepth + 1);
-				changed ||= projected !== nested;
-				return projected;
-			}
-			return nested;
-		});
-		return changed ? masked : value;
-	} catch {
-		return "[REDACTED]";
-	}
-}
-/** Scan balanced object/array fragments once, respecting JSON quotes and escapes. */
-function maskJsonFragments(value, encodingDepth = 0) {
-	if (value.trimStart().startsWith("\"")) try {
-		const decoded = JSON.parse(value);
-		if (typeof decoded === "string") {
-			if (encodingDepth >= JSON_ENCODING_MAX) return "\"[REDACTED]\"";
-			const masked = maskJsonFragments(decoded, encodingDepth + 1);
-			return masked === decoded ? value : JSON.stringify(masked);
-		}
-	} catch {}
-	let output = "";
-	let cursor = 0;
-	let start = -1;
-	let depth = 0;
-	let overDepth = false;
-	let quoted = false;
-	let escaped = false;
-	for (let index = 0; index < value.length; index++) {
-		const character = value[index];
-		if (start < 0) {
-			JSON_CONTAINER_START.lastIndex = index;
-			if (!JSON_CONTAINER_START.test(value)) continue;
-			start = index;
-			depth = 1;
-			overDepth = false;
-			continue;
-		}
-		if (quoted) {
-			if (escaped) escaped = false;
-			else if (character === "\\") escaped = true;
-			else if (character === "\"") quoted = false;
-			continue;
-		}
-		if (character === "\"") quoted = true;
-		else if (character === "{" || character === "[") {
-			depth++;
-			overDepth ||= depth > JSON_NESTING_MAX;
-		} else if (character === "}" || character === "]") {
-			depth--;
-			if (depth !== 0) continue;
-			output += value.slice(cursor, start) + projectJsonFragment(value.slice(start, index + 1), encodingDepth, overDepth);
-			cursor = index + 1;
-			start = -1;
-		}
-	}
-	if (start >= 0) {
-		const fragment = value.slice(start);
-		output += value.slice(cursor, start) + (overDepth || hasSecretJsonKey(fragment) ? "[REDACTED]" : fragment);
-		cursor = value.length;
-	}
-	return output + value.slice(cursor);
-}
-function maskLabelledText(value) {
-	const jsonMasked = maskJsonFragments(value).replace(JSON_FIELD, (whole, quotedName, separator) => {
-		try {
-			return isSecretLabel(JSON.parse(quotedName)) ? `${quotedName}${separator}"[REDACTED]"` : whole;
-		} catch {
-			return whole;
-		}
-	});
-	let output = "";
-	let cursor = 0;
-	for (const match of jsonMasked.matchAll(PROSE_FIELD)) {
-		const [, whole, label, entry] = match;
-		if (whole === void 0 || label === void 0 || entry === void 0 || match.index < cursor || /^Bearer[ \t]+/iu.test(entry)) continue;
-		const words = label.split(/[ \t]+/u);
-		for (let index = 0; index < words.length; index++) {
-			const name = words.slice(index).join(" ");
-			if (isSecretLabel(name)) {
-				const prefix = words.slice(0, index).join(" ");
-				output += jsonMasked.slice(cursor, match.index) + `${prefix ? `${prefix} ` : ""}${name}=[REDACTED]`;
-				cursor = match.index + whole.length;
-				break;
-			}
-		}
-	}
-	return output + jsonMasked.slice(cursor);
-}
-const TOKEN_MASKS = [
-	[/\bBearer\s+(?!(?:realm|error|error_description|scope|authorization_uri|resource|claims)\s*=)[^\s,;"']+/giu, "Bearer [REDACTED]"],
-	[/\beyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\b/gu, "[REDACTED]"],
-	[/(^|[^a-fA-F0-9])(?<!0[xX])[a-fA-F0-9]{64}(?=$|[^a-fA-F0-9])/gu, "$1[REDACTED]"],
-	[/(?:(?:sk|pk|rk)_(?:live|test)|(?:phc|phx|ghp|gho|ghu|ghs|ghr|whsec)_|github_pat_|xox[baprs]-|AKIA[0-9A-Z]{16}|AIza)[A-Za-z0-9_-]*/giu, "[REDACTED]"]
-];
-/** URL components and malformed URLs use this non-recursive masking layer. */
-function maskText(value) {
-	let text = maskLabelledText(value);
-	for (const [pattern, replacement] of TOKEN_MASKS) text = text.replace(pattern, replacement);
-	return text;
-}
-/** Reject only when the same semantic sanitizer removes credential material. */
-function containsSensitiveMaterial(value) {
-	return redactSecrets(value) !== value;
-}
-/** Mask credential fields and embedded URLs while preserving surrounding evidence. */
-function redactSecrets(value, source) {
-	return maskLabelledText(value).split(EMBEDDED_URL).map((part, index) => index % 2 === 1 ? redactUrlSecrets(part, source).replaceAll("%5BREDACTED%5D", "[REDACTED]") : maskText(part)).join("");
-}
-//#endregion
-//#region ../errors/src/chain-cause.ts
-/**
-* Why an operation failed — the one flat vocabulary. The first four are the
-* auth/provider diagnoses that predate this file. The rest name the chain
-* path. `FailureMode` is derived from this list so a runtime membership check
-* (the SDK's `$exception` projection, the observability schema) and the type
-* can never drift apart.
-*/
-const FAILURE_MODES = [
-	"auth-origin-mismatch",
-	"stale-openfort-cache",
-	"app-env-allowlist",
-	"no-secure-context",
-	"signer-not-ready",
-	"rate-limited",
-	"timeout",
-	"upstream-down",
-	"revert",
-	"insufficient-balance",
-	"insufficient-allowance",
-	"rejected",
-	"unauthorized",
-	"forbidden",
-	"bad-request",
-	"method-unsupported",
-	"unknown"
-];
-function isFailureMode(value) {
-	return typeof value === "string" && FAILURE_MODES.includes(value);
-}
-/** Who answered. `alto` is the bundler; `gateway` is the AA gateway's own logic. */
-const CHAIN_UPSTREAMS = [
-	"alchemy",
-	"infura",
-	"public",
-	"alto",
-	"gateway"
-];
-function isChainUpstream(value) {
-	return typeof value === "string" && CHAIN_UPSTREAMS.includes(value);
-}
-/**
-* The response headers that name a refusal or let provider support find the
-* request. Nothing else crosses: a header can carry a session or a key.
-*/
-const RESPONSE_HEADER_ALLOWLIST = [
-	"retry-after",
-	"www-authenticate",
-	"content-type",
-	"x-request-id",
-	"cf-ray",
-	"x-ratelimit-remaining",
-	"x-ratelimit-reset",
-	"server"
-];
-const RESPONSE_HEADER_VALUE_MAX = 128;
-/**
-* The allow-listed headers of one answer, masked and bounded. `read` is
-* `Headers.get` or a lookup into a decoded record. Empty when none is present.
-*/
-function boundedResponseHeaders(read) {
-	const headers = {};
-	for (const name of RESPONSE_HEADER_ALLOWLIST) {
-		const value = read(name);
-		if (typeof value === "string" && value.length > 0) headers[name] = boundedEvidence(value, RESPONSE_HEADER_VALUE_MAX);
-	}
-	return headers;
-}
-const PROVIDER_MESSAGE_MAX = 300;
-const METHOD_MAX = 64;
-const REVERT_NAME_MAX = 64;
-const REVERT_ARG_KEY_MAX = 32;
-const REVERT_ARG_VALUE_MAX = 128;
-const REVERT_ARGS_MAX = 8;
-const SELECTOR_RE = /^0x(?:[0-9a-fA-F]{8})?$/u;
-/** Mask credential-shaped content, then cap the length. Total on any string. */
-function boundedEvidence(value, max) {
-	const text = redactSecrets(value);
-	return text.length <= max ? text : text.slice(0, max);
-}
-function isRecord(value) {
-	return typeof value === "object" && value !== null && !Array.isArray(value);
-}
-function decodeRevert(value) {
-	if (!isRecord(value)) return null;
-	if (value.name !== null && typeof value.name !== "string") return null;
-	if (typeof value.selector !== "string" || !SELECTOR_RE.test(value.selector)) return null;
-	if (!isRecord(value.args)) return null;
-	const args = {};
-	for (const [key, arg] of Object.entries(value.args).slice(0, REVERT_ARGS_MAX)) {
-		if (typeof arg !== "string") return null;
-		args[boundedEvidence(key, REVERT_ARG_KEY_MAX)] = boundedEvidence(arg, REVERT_ARG_VALUE_MAX);
-	}
-	return {
-		name: value.name === null ? null : boundedEvidence(value.name, REVERT_NAME_MAX),
-		selector: value.selector,
-		args
-	};
-}
-/**
-* Decode a `ChainCause` from untrusted wire data (gateway JSON-RPC `error.data`,
-* a Convex error payload). Every string is masked and bounded; an unrecognized
-* shape yields null, because a consumer must never invent a cause.
-*/
-function decodeChainCause(value) {
-	if (!isRecord(value)) return null;
-	if (!isFailureMode(value.mode) || !isChainUpstream(value.upstream)) return null;
-	if (typeof value.method !== "string" || typeof value.retryable !== "boolean") return null;
-	const cause = {
-		mode: value.mode,
-		upstream: value.upstream,
-		method: boundedEvidence(value.method, METHOD_MAX),
-		retryable: value.retryable
-	};
-	if (typeof value.httpStatus === "number" && Number.isInteger(value.httpStatus)) cause.httpStatus = value.httpStatus;
-	if (typeof value.rpcCode === "number" && Number.isInteger(value.rpcCode)) cause.rpcCode = value.rpcCode;
-	const revert = decodeRevert(value.revert);
-	if (revert !== null) cause.revert = revert;
-	if (typeof value.providerMessage === "string") cause.providerMessage = boundedEvidence(value.providerMessage, PROVIDER_MESSAGE_MAX);
-	const attempts = decodeAttempts(value.attempts);
-	if (attempts !== null) cause.attempts = attempts;
-	if (isRecord(value.responseHeaders)) {
-		const raw = value.responseHeaders;
-		const headers = boundedResponseHeaders((name) => {
-			const header = raw[name];
-			return typeof header === "string" ? header : null;
-		});
-		if (Object.keys(headers).length > 0) cause.responseHeaders = headers;
-	}
-	return cause;
-}
-/** The attempt sequence, bounded. A malformed entry drops the sequence, never the cause. */
-function decodeAttempts(value) {
-	if (!Array.isArray(value)) return null;
-	const attempts = [];
-	for (const entry of value.slice(0, 5)) {
-		if (!isRecord(entry) || !isChainUpstream(entry.upstream) || !isFailureMode(entry.mode)) return null;
-		const duration = entry.durationMs;
-		if (typeof duration !== "number" || !Number.isFinite(duration) || duration < 0) return null;
-		attempts.push({
-			upstream: entry.upstream,
-			mode: entry.mode,
-			...typeof entry.httpStatus === "number" && Number.isInteger(entry.httpStatus) ? { httpStatus: entry.httpStatus } : {},
-			...typeof entry.rpcCode === "number" && Number.isInteger(entry.rpcCode) ? { rpcCode: entry.rpcCode } : {},
-			durationMs: Math.round(duration)
-		});
-	}
-	return attempts.length === 0 ? null : attempts;
-}
-/**
-* The cause as flat PostHog properties. Same keys from every producer, so one
-* filter (`failure_mode = 'rate-limited'`) finds the gateway's, the backend's,
-* and the SDK's rows alike.
-*/
-function chainCauseProperties(chain) {
-	return {
-		failure_mode: chain.mode,
-		chain_upstream: chain.upstream,
-		chain_method: chain.method,
-		chain_retryable: chain.retryable,
-		...chain.httpStatus === void 0 ? {} : { chain_http_status: chain.httpStatus },
-		...chain.rpcCode === void 0 ? {} : { chain_rpc_code: chain.rpcCode },
-		...chain.revert === void 0 ? {} : {
-			chain_revert_name: chain.revert.name ?? "unknown",
-			chain_revert_selector: chain.revert.selector,
-			chain_revert_args: chain.revert.args
-		},
-		...chain.providerMessage === void 0 ? {} : { chain_provider_message: chain.providerMessage },
-		...chain.attempts === void 0 ? {} : { chain_attempts: chain.attempts.map((attempt) => ({
-			upstream: attempt.upstream,
-			failure_mode: attempt.mode,
-			...attempt.httpStatus === void 0 ? {} : { http_status: attempt.httpStatus },
-			...attempt.rpcCode === void 0 ? {} : { rpc_code: attempt.rpcCode },
-			duration_ms: attempt.durationMs
-		})) },
-		...chain.responseHeaders === void 0 ? {} : { chain_response_headers: chain.responseHeaders }
-	};
-}
-/**
-* Safe (safe-contracts v1.4.1) revert codes. The contracts revert with these
-* short strings to save gas; the sentence lives in the Safe docs
-* (`docs/error_codes.md`). Every Safe on the Capxul rail is this version.
-*/
-const SAFE_REVERT_REASONS = {
-	GS000: "could not finish initialization",
-	GS001: "threshold needs to be defined",
-	GS010: "not enough gas to execute Safe transaction",
-	GS011: "could not pay gas costs with ether",
-	GS012: "could not pay gas costs with token",
-	GS013: "Safe transaction failed when gasPrice and safeTxGas were 0",
-	GS020: "signatures data too short",
-	GS021: "invalid contract signature location: inside static part",
-	GS022: "invalid contract signature location: length not present",
-	GS023: "invalid contract signature location: data not complete",
-	GS024: "invalid contract signature provided",
-	GS025: "hash has not been approved",
-	GS026: "invalid owner provided",
-	GS030: "only owners can approve a hash",
-	GS031: "method can only be called from this contract",
-	GS100: "modules have already been initialized",
-	GS101: "invalid module address provided",
-	GS102: "module has already been added",
-	GS103: "invalid prevModule, module pair provided",
-	GS104: "method can only be called from an enabled module",
-	GS105: "invalid starting point for fetching paginated modules",
-	GS106: "invalid page size for fetching paginated modules",
-	GS200: "owners have already been set up",
-	GS201: "threshold cannot exceed owner count",
-	GS202: "threshold needs to be greater than 0",
-	GS203: "invalid owner address provided",
-	GS204: "address is already an owner",
-	GS205: "invalid prevOwner, owner pair provided",
-	GS300: "guard does not implement IERC165",
-	GS400: "fallback handler cannot be set to self"
-};
-/**
-* `Error(GS205: invalid prevOwner, owner pair provided)`, or the bare selector
-* when the name is unknown. Safe codes travel only as the `message` of an
-* `Error(string)` revert, so only that argument is expanded from
-* {@link SAFE_REVERT_REASONS}; every other argument reads `name=value`, even
-* when a custom error's field happens to hold a `GS` string.
-*/
-function revertSummaryText(revert) {
-	if (revert.name === null) return revert.selector === "0x" ? "empty revert" : `unknown selector ${revert.selector}`;
-	const args = Object.entries(revert.args).map(([name, value]) => {
-		const reason = revert.name === "Error" && name === "message" ? SAFE_REVERT_REASONS[value] : void 0;
-		return reason === void 0 ? `${name}=${value}` : `${value}: ${reason}`;
-	}).join(", ");
-	return `${revert.name}(${args})`;
-}
-/**
-* The evidence behind the one word, for an issue name: ` (HTTP 403)` or
-* ` (JSON-RPC -32000)`. Empty when the cause carries neither. The status
-* names the provider's front door and the code names the node's verdict;
-* `forbidden` alone made an operator open the issue to learn it was a 403.
-*/
-function chainEvidenceLabel(chain) {
-	if (chain === void 0) return "";
-	if (chain.httpStatus !== void 0 && chain.httpStatus !== 200) return ` (HTTP ${String(chain.httpStatus)})`;
-	if (chain.rpcCode !== void 0) return ` (JSON-RPC ${String(chain.rpcCode)})`;
-	return "";
-}
-/**
-* The error-tracking fingerprint for a failure: the code, the one-word cause,
-* and the operation. PostHog groups `$exception` rows by this value, so one
-* issue is one cause at one operation instead of every provider failure in
-* one bucket (money-path audit 2026-09-02, row P1).
-*/
-function failureFingerprint(code, mode, operation) {
-	return `${code}:${mode ?? "none"}:${operation}`;
-}
-//#endregion
-//#region ../errors/src/errors.ts
-const CAPXUL_ERROR_CODES = [
-	"NOT_AUTHENTICATED",
-	"EMAIL_DELIVERY_FAILED",
-	"PROFILE_NOT_FOUND",
-	"SMART_ACCOUNT_MISSING",
-	"PLAYER_NOT_FOUND",
-	"ACCOUNT_NOT_FOUND",
-	"ACCOUNT_CLAIMED_BY_OTHER_SIGNER",
-	"PROVIDER_ERROR",
-	"CAPABILITY_UNAVAILABLE",
-	"INVALID_INPUT",
-	"ENV_MISSING",
-	"NOT_IMPLEMENTED",
-	"VERIFICATION_REQUIRED",
-	"INSUFFICIENT_BALANCE",
-	"INVALID_RECIPIENT",
-	"ROLE_PERMISSION_DENIED",
-	"TRANSACTION_FAILED",
-	"RATE_LIMITED",
-	"NETWORK_ERROR",
-	"UNKNOWN",
-	"OTP_EXPIRED",
-	"SIGNER_REJECTED",
-	"CANCELLED",
-	"WRONG_STATE",
-	"STALE_EPOCH",
-	"SUPERSEDED",
-	"WORK_DIED",
-	"ACTOR_STOPPED"
-];
-/**
-* The error codes that represent an expected product outcome rather than a
-* defect. The SDK and backend observation boundaries both classify failures
-* against this set to route expected outcomes to their own PostHog event
-* stream; keeping the single copy here (adjacent to `CAPXUL_ERROR_CODES`, so a
-* code rename forces this set to move with it) stops the two sides of the wire
-* from drifting and silently splitting one outcome across two streams.
-*/
-const EXPECTED_OPERATION_OUTCOMES = /* @__PURE__ */ new Set([
-	"INVALID_INPUT",
-	"NOT_AUTHENTICATED",
-	"SMART_ACCOUNT_MISSING",
-	"ACCOUNT_CLAIMED_BY_OTHER_SIGNER",
-	"CANCELLED",
-	"SIGNER_REJECTED",
-	"VERIFICATION_REQUIRED",
-	"INSUFFICIENT_BALANCE",
-	"INVALID_RECIPIENT",
-	"ROLE_PERMISSION_DENIED",
-	"CAPABILITY_UNAVAILABLE",
-	"RATE_LIMITED",
-	"OTP_EXPIRED",
-	"WRONG_STATE",
-	"STALE_EPOCH",
-	"SUPERSEDED",
-	"ACTOR_STOPPED"
-]);
-var CapxulError = class extends Error {
-	code;
-	details;
-	correlationId;
-	layer;
-	/** The one-word cause (`FailureMode`). `chain.mode` when a chain cause is set. */
-	mode;
-	/** The structured chain-path cause. Never rewritten by a later layer. */
-	chain;
-	constructor(code, message, options = {}) {
-		super(message, "cause" in options ? { cause: options.cause } : void 0);
-		this.name = "CapxulError";
-		this.code = code;
-		if (options.details !== void 0) this.details = options.details;
-		if (options.correlationId !== void 0) this.correlationId = options.correlationId;
-		if (options.layer !== void 0) this.layer = options.layer;
-		const legacy = options.details?.failure_mode;
-		const mode = options.chain?.mode ?? (isFailureMode(options.mode) ? options.mode : void 0) ?? (isFailureMode(legacy) ? legacy : void 0);
-		if (mode !== void 0) this.mode = mode;
-		if (options.chain !== void 0) this.chain = options.chain;
-	}
-};
-function isCapxulError(value) {
-	return value instanceof CapxulError;
-}
-function deserializeCapxulError(serialized) {
-	return new CapxulError(serialized.code, serialized.message, compactErrorOptions({
-		details: serialized.details,
-		correlationId: serialized.correlationId,
-		layer: serialized.layer,
-		mode: serialized.mode,
-		chain: serialized.chain === void 0 ? void 0 : decodeChainCause(serialized.chain) ?? void 0
-	}));
-}
-function compactErrorOptions(options) {
-	const result = {};
-	if ("cause" in options) result.cause = options.cause;
-	if (options.details !== void 0) result.details = options.details;
-	if (options.correlationId !== void 0) result.correlationId = options.correlationId;
-	if (options.layer !== void 0) result.layer = options.layer;
-	if (options.mode !== void 0) result.mode = options.mode;
-	if (options.chain !== void 0) result.chain = options.chain;
-	return result;
-}
-const NETWORK_DETAIL_LABEL_RE = /^[A-Za-z][A-Za-z0-9_.-]{0,63}$/u;
-const NETWORK_TARGET_HOST_RE = /^[A-Za-z0-9.[\]:-]{1,253}$/u;
-const DOCUMENT_VISIBILITY = /* @__PURE__ */ new Set(["hidden", "visible"]);
-const BROWSER_LIFECYCLE_EVENTS = /* @__PURE__ */ new Set([
-	"visibility-visible",
-	"visibility-hidden",
-	"pagehide",
-	"pageshow",
-	"online",
-	"offline"
-]);
-function networkErrorDetails(operation, options) {
-	const details = { operation };
-	if (options === void 0) return details;
-	if (typeof options.provider === "string" && NETWORK_DETAIL_LABEL_RE.test(options.provider)) details.provider = options.provider;
-	if (typeof options.target_host === "string" && NETWORK_TARGET_HOST_RE.test(options.target_host)) details.target_host = options.target_host;
-	if (isFailureMode(options.failure_mode)) details.failure_mode = options.failure_mode;
-	if (options.reason === "connection-lost-in-flight") details.reason = options.reason;
-	if (typeof options.connection_id === "string" && NETWORK_DETAIL_LABEL_RE.test(options.connection_id)) details.connection_id = options.connection_id;
-	for (const key of [
-		"connection_count",
-		"connection_retries",
-		"close_code",
-		"ms_since_browser_event"
-	]) {
-		const value = options[key];
-		if (typeof value === "number" && Number.isSafeInteger(value) && value >= 0 && (key !== "close_code" || value <= 4999)) details[key] = value;
-	}
-	for (const key of [
-		"close_was_clean",
-		"close_reason_present",
-		"navigator_online"
-	]) {
-		const value = options[key];
-		if (typeof value === "boolean") details[key] = value;
-	}
-	if (DOCUMENT_VISIBILITY.has(options.document_visibility ?? "")) details.document_visibility = options.document_visibility;
-	if (BROWSER_LIFECYCLE_EVENTS.has(options.last_browser_event ?? "")) details.last_browser_event = options.last_browser_event;
-	return details;
-}
-const Errors = {
-	notAuthenticated: (message, opts) => new CapxulError("NOT_AUTHENTICATED", message ?? "Not authenticated", opts?.failure_mode ? { details: { failure_mode: opts.failure_mode } } : void 0),
-	emailDeliveryFailed: (detail) => new CapxulError("EMAIL_DELIVERY_FAILED", "Failed to send email", { details: { detail } }),
-	profileNotFound: (authUserId) => new CapxulError("PROFILE_NOT_FOUND", `Profile not found for user ${authUserId}`, { details: { authUserId } }),
-	smartAccountMissing: (authUserId) => new CapxulError("SMART_ACCOUNT_MISSING", "Smart account not provisioned", { details: { authUserId } }),
-	playerNotFound: (playerId) => new CapxulError("PLAYER_NOT_FOUND", playerId ? `Openfort player ${playerId} not found` : "Openfort player not found", playerId === void 0 ? void 0 : { details: { playerId } }),
-	accountNotFound: (accountId) => new CapxulError("ACCOUNT_NOT_FOUND", accountId ? `Openfort account ${accountId} not found` : "Openfort account not found", accountId === void 0 ? void 0 : { details: { accountId } }),
-	/**
-	* The Safe at this email's address is deployed and its owner is neither the
-	* Capxul bootstrap owner nor the caller's signer. The claim
-	* `swapOwner(bootstrap → signer)` cannot succeed: only the on-chain owner
-	* can hand the account over. Read from `getOwners()` before any
-	* UserOperation is built (2026-09-02), so no simulation and no retry.
-	*/
-	accountClaimedByOtherSigner: (details) => new CapxulError("ACCOUNT_CLAIMED_BY_OTHER_SIGNER", "This account is already owned by a different signer.", { details }),
-	providerError: (provider, operation, cause, opts) => {
-		const details = {
-			...opts?.details,
-			provider,
-			operation
-		};
-		const mode = opts?.chain?.mode ?? opts?.failure_mode;
-		if (mode !== void 0) details.failure_mode = mode;
-		if (opts?.httpStatus !== void 0) details.httpStatus = opts.httpStatus;
-		return new CapxulError("PROVIDER_ERROR", `Provider error: ${provider} ${operation}`, {
-			cause,
-			details,
-			...mode === void 0 ? {} : { mode },
-			...opts?.chain === void 0 ? {} : { chain: opts.chain }
-		});
-	},
-	capabilityUnavailable: (provider, operation) => new CapxulError("CAPABILITY_UNAVAILABLE", "Provider capability is unavailable", { details: {
-		provider,
-		operation
-	} }),
-	invalidInput: (field, reason) => new CapxulError("INVALID_INPUT", `Invalid ${field}: ${reason}`, { details: {
-		field,
-		reason
-	} }),
-	envMissing: (name) => new CapxulError("ENV_MISSING", `Environment variable ${name} not configured`, { details: { name } }),
-	notImplemented: (domain, method) => new CapxulError("NOT_IMPLEMENTED", `${domain}.${method} is not yet implemented. This feature is planned for a future release.`, { details: {
-		domain,
-		method
-	} }),
-	/**
-	* Sibling factory to {@link Errors.providerError} for the per-state timeout
-	* path in flows. Same `PROVIDER_ERROR` code as
-	* `providerError`, plus a `details.reason: "timeout"` discriminator so
-	* downstream observers can distinguish failure modes without parsing the
-	* message string. The redacted message names the timeout budget; the
-	* native `cause` carries the same information for `reportError` fidelity.
-	*/
-	providerTimeout: (provider, operation, timeoutMs) => new CapxulError("PROVIDER_ERROR", `Provider error: ${provider} ${operation} (timeout exceeded ${timeoutMs}ms)`, {
-		details: {
-			provider,
-			operation,
-			reason: "timeout"
-		},
-		cause: /* @__PURE__ */ new Error(`timeout: ${operation} exceeded ${timeoutMs}ms`)
-	}),
-	verificationRequired: (details) => {
-		return new CapxulError("VERIFICATION_REQUIRED", "rail" in details ? `Verification is required before ${details.rail} can use ${details.currentKind}.` : `Verification tier ${details.requiredTier} is required.`, { details });
-	},
-	insufficientBalance: (asset, available, required) => new CapxulError("INSUFFICIENT_BALANCE", `Insufficient ${asset} balance`, { details: {
-		asset,
-		available,
-		required
-	} }),
-	invalidRecipient: (reason) => new CapxulError("INVALID_RECIPIENT", `Invalid recipient: ${reason}`, { details: { reason } }),
-	/**
-	* The org Zodiac Roles modifier REFUSED the spend on-chain (G4 · #547): the
-	* member's role condition (per-tx cap, per-day allowance, allowed recipient,
-	* or membership) was violated, so `execTransactionWithRole` reverted. This is
-	* a PERMISSION denial — explicitly NOT an `INSUFFICIENT_BALANCE` (the treasury
-	* held the funds; the role's authority is what bound). `reason` discriminates
-	* the violated condition (`over_cap` / `daily_cap` / `not_member` /
-	* `disallowed_recipient` / `condition_violation`); leak-safe — no on-chain
-	* identifiers ever enter the details.
-	*/
-	rolePermissionDenied: (details) => new CapxulError("ROLE_PERMISSION_DENIED", `Org role denied this spend on-chain (${details.reason}).`, { details: details.operation === void 0 ? { reason: details.reason } : {
-		reason: details.reason,
-		operation: details.operation
-	} }),
-	/**
-	* A transaction (or sponsored UserOp) failed. `details.reason` discriminates
-	* the failure mode for callers that must distinguish a CONFIRMED on-chain
-	* revert (`"onchain_revert"` — the op executed and reverted, e.g. a Zodiac
-	* Roles condition violation) from an inconclusive infra failure. A confirmed
-	* revert is the ONLY mode the org spend port may map to a roles denial.
-	*/
-	transactionFailed: (operation, cause, extra) => new CapxulError("TRANSACTION_FAILED", `Transaction failed: ${operation}`, {
-		cause,
-		details: extra?.reason === void 0 ? { operation } : {
-			operation,
-			reason: extra.reason
-		}
-	}),
-	rateLimited: (details) => new CapxulError("RATE_LIMITED", "Rate limit exceeded", details === void 0 ? void 0 : { details: { ...details } }),
-	networkError: (operation, cause, opts) => {
-		const mode = isFailureMode(opts?.failure_mode) ? opts.failure_mode : void 0;
-		return new CapxulError("NETWORK_ERROR", `Network error during ${operation}`, {
-			cause,
-			details: networkErrorDetails(operation, opts),
-			...mode === void 0 ? {} : { mode }
-		});
-	},
-	unknown: (cause) => new CapxulError("UNKNOWN", "Unknown error", { cause }),
-	otpExpired: (details) => new CapxulError("OTP_EXPIRED", "Verification code has expired. Request a new one.", details === void 0 ? void 0 : { details: { ...details } }),
-	signerRejected: (details) => new CapxulError("SIGNER_REJECTED", "Signer rejected the request.", {
-		cause: details.cause,
-		details: details.reason === void 0 ? { source: details.source } : {
-			source: details.source,
-			reason: details.reason
-		}
-	}),
-	superseded: (details) => new CapxulError("SUPERSEDED", "Operation was superseded.", { details: {
-		operation: details.operation,
-		reason: details.reason,
-		...details.executionId === void 0 ? {} : { executionId: details.executionId }
-	} }),
-	cancelled: (details) => new CapxulError("CANCELLED", "Operation was cancelled.", details === void 0 ? void 0 : { details: { ...details } }),
-	/**
-	* Method called from a flow state where its precondition fails (TA16). The
-	* SDK's method API short-circuits with this error before driving the
-	* internal state machine. `currentState` is the Effect-machine snapshot
-	* tag (stringified from the SDK's actor-shell snapshot; see
-	* `packages/errors/CONTEXT.md`); `validStates`
-	* enumerates the states the method accepts.
-	*/
-	wrongState: (details) => new CapxulError("WRONG_STATE", `${details.method} called from state '${details.currentState}'; valid states: ${details.validStates.join(", ")}`, { details: {
-		...details,
-		validStates: [...details.validStates]
-	} })
-};
-//#endregion
-//#region ../errors/src/convex-error-decoding.ts
-const KNOWN_CODES = new Set(CAPXUL_ERROR_CODES);
-function isCapxulCode(value) {
-	return typeof value === "string" && KNOWN_CODES.has(value);
-}
-function reconstruct(serialized) {
-	if (!isCapxulCode(serialized.code)) return null;
-	const payload = {
-		code: serialized.code,
-		message: typeof serialized.message === "string" ? serialized.message : String(serialized.code),
-		...typeof serialized.details === "object" && serialized.details !== null && !Array.isArray(serialized.details) ? { details: serialized.details } : {},
-		...typeof serialized.correlationId === "string" ? { correlationId: serialized.correlationId } : {},
-		...typeof serialized.layer === "string" ? { layer: serialized.layer } : {},
-		...isFailureMode(serialized.mode) ? { mode: serialized.mode } : {}
-	};
-	const chain = decodeChainCause(serialized.chain);
-	return deserializeCapxulError(chain === null ? payload : {
-		...payload,
-		chain
-	});
-}
-function decodeConvexError(err) {
-	if (err === null || err === void 0) return null;
-	if (err instanceof CapxulError) return err;
-	if (typeof err !== "object") return null;
-	const record = err;
-	if (!("data" in record)) return null;
-	const data = record.data;
-	if (typeof data === "object" && data !== null) return reconstruct(data);
-	if (typeof data === "string") try {
-		const parsed = JSON.parse(data);
-		if (typeof parsed === "object" && parsed !== null) return reconstruct(parsed);
-	} catch {}
-	return null;
-}
-//#endregion
-//#region ../errors/src/index.ts
-/** Canonical handle syntax shared by validation and branded constructors. */
-const HANDLE_RE = /^[a-z0-9_-]{3,30}$/;
-//#endregion
-//#region ../config/src/handle.ts
-const RESERVED_HANDLES = /* @__PURE__ */ new Set([
-	"admin",
-	"api",
-	"capxul",
-	"help",
-	"root",
-	"support",
-	"system",
-	"www"
-]);
-function normalizeHandle(raw) {
-	return raw.trim().toLowerCase().replace(/^@/, "");
-}
-function validateHandle(raw) {
-	const handle = normalizeHandle(raw);
-	if (!HANDLE_RE.test(handle)) throw Errors.invalidInput("handle", "must be 3-30 characters of a-z, 0-9, underscore, or hyphen");
-	if (RESERVED_HANDLES.has(handle)) throw Errors.invalidInput("handle", "handle is reserved");
-	return handle;
-}
-//#endregion
-//#region ../types/src/index.ts
-const ASSET_ID_RE = /^eip155:([1-9][0-9]*)\/erc20:(0x[0-9a-f]{40})$/;
-const EVM_ADDRESS_RE = /^0x[0-9a-f]{40}$/i;
-const BYTES32_RE = /^0x[0-9a-f]{64}$/i;
-const ZERO_BYTES32 = `0x${"0".repeat(64)}`;
-const PUBLISHABLE_KEY_PATTERN = /^cap_pk_(test|live)_[0-9A-HJKMNP-TV-Z]{32}$/;
-const SUPPORTED_CURRENCIES = [
-	{
-		code: "USD",
-		symbol: "$",
-		name: "US Dollar"
-	},
-	{
-		code: "NGN",
-		symbol: "NGN",
-		name: "Nigerian Naira"
-	},
-	{
-		code: "GHS",
-		symbol: "GHS",
-		name: "Ghanaian Cedi"
-	},
-	{
-		code: "KES",
-		symbol: "KSh",
-		name: "Kenyan Shilling"
-	},
-	{
-		code: "UGX",
-		symbol: "USh",
-		name: "Ugandan Shilling"
-	}
-];
-const SUPPORTED_CURRENCY_CODES = SUPPORTED_CURRENCIES.map((currency) => currency.code);
-const CURRENCY_SYMBOLS = Object.fromEntries(SUPPORTED_CURRENCIES.map((currency) => [currency.code, currency.symbol]));
-const EMAIL_RE = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
-const COUNTRY_CODE_RE = /^[A-Z]{2}$/;
-const ACCOUNT_ID_RE = /^account_[0-9A-Za-z]+$/;
-const PARTY_ID_RE = /^party_[0-9A-Za-z]+$/;
-const APP_ID_RE = /^app_[0-7][0-9A-HJKMNP-TV-Z]{25}$/;
-const CLIENT_REQUEST_ID_RE = /^creq_[0-7][0-9A-HJKMNP-TV-Z]{25}$/;
-const CLIENT_GRANT_ID_RE = /^cgrant_[0-7][0-9A-HJKMNP-TV-Z]{25}$/;
-const TX_HASH_RE = /^0x[0-9a-f]{64}$/i;
-const WEI_RE = /^[0-9]+$/;
-Math.floor(Number.MAX_SAFE_INTEGER / 1e3);
-function toAddress(raw) {
-	if (typeof raw !== "string" || !EVM_ADDRESS_RE.test(raw)) throw Errors.invalidInput("address", invalidValueReason("invalid EVM address format", raw));
-	return raw.toLowerCase();
-}
-function toEmail(raw) {
-	if (typeof raw !== "string" || !EMAIL_RE.test(raw)) throw Errors.invalidInput("email", invalidValueReason("must look like an email address", raw));
-	return raw.toLowerCase();
-}
-function toAuthUserId(raw) {
-	return toNonEmptyStringBrand(raw, "authUserId");
-}
-function toAccountId(raw) {
-	if (typeof raw !== "string" || !ACCOUNT_ID_RE.test(raw)) throw Errors.invalidInput("accountId", invalidValueReason("must be account_ plus an alphanumeric id", raw));
-	return raw;
-}
-function toPartyId(raw) {
-	if (typeof raw !== "string" || !PARTY_ID_RE.test(raw)) throw Errors.invalidInput("partyId", invalidValueReason("must be party_ plus an alphanumeric id", raw));
-	return raw;
-}
-function toHandle(raw) {
-	if (typeof raw !== "string" || !HANDLE_RE.test(raw)) throw Errors.invalidInput("handle", invalidValueReason("must be 3-30 characters of a-z, 0-9, underscore, or hyphen", raw));
-	return raw;
-}
-function toBudgetId(raw) {
-	return toNonEmptyStringBrand(raw, "budgetId");
-}
-function toPayrollRunId(raw) {
-	return toNonEmptyStringBrand(raw, "payrollRunId");
-}
-function toPayrollGroupId(raw) {
-	return toNonEmptyStringBrand(raw, "payrollGroupId");
-}
-function toOrgId(raw) {
-	return toNonEmptyStringBrand(raw, "orgId");
-}
-function toAppId(raw) {
-	if (typeof raw !== "string" || !APP_ID_RE.test(raw)) throw Errors.invalidInput("appId", invalidValueReason("must be app_ plus a ULID", raw));
-	return raw;
-}
-function toAllowedOrigin(raw) {
-	if (typeof raw !== "string") throw Errors.invalidInput("allowedOrigin", "must be an http or https origin string");
-	const normalized = normalizeAllowedOrigin(raw);
-	if (normalized === null) throw Errors.invalidInput("allowedOrigin", invalidValueReason("must be an http or https origin", raw));
-	return normalized;
-}
-function toDurationMs(raw) {
-	if (typeof raw !== "number" || !Number.isSafeInteger(raw) || raw < 0) throw Errors.invalidInput("duration", invalidValueReason("must be a non-negative safe integer", raw));
-	return raw;
-}
-function toPublishableKey(raw) {
-	if (typeof raw !== "string" || !PUBLISHABLE_KEY_PATTERN.test(raw)) throw Errors.invalidInput("publishableKey", invalidValueReason("must match cap_pk_(test|live) plus 32 Crockford base32 chars", raw));
-	return raw;
-}
-function toTxHash(raw) {
-	if (typeof raw !== "string" || !TX_HASH_RE.test(raw)) throw Errors.invalidInput("txHash", invalidValueReason("must be 0x + 64 hex chars", raw));
-	return raw.toLowerCase();
-}
-function toEpochMs(raw) {
-	assertSafeNonNegativeInteger(raw, "epochMs");
-	return raw;
-}
-function toEpochSeconds(raw) {
-	assertSafeNonNegativeInteger(raw, "epochSeconds");
-	return raw;
-}
-/** Validate an already canonical identity without changing signed input. */
-function toAssetId(raw) {
-	const match = typeof raw === "string" ? ASSET_ID_RE.exec(raw) : null;
-	if (match === null || match[0] !== raw || !Number.isSafeInteger(Number(match[1]))) throw Errors.invalidInput("assetId", "must be a canonical ERC-20 CAIP-19 identifier");
-	if (match[2] === "0x0000000000000000000000000000000000000000") throw Errors.invalidInput("assetId", "must identify a nonzero token contract");
-	return raw;
-}
-/** Build an identity from verified chain facts. Normalize the token address. */
-function assetIdFor(chainId, tokenAddress) {
-	return toAssetId(`eip155:${toChainId(chainId)}/erc20:${toAddress(tokenAddress)}`);
-}
-function toChainId(raw) {
-	if (typeof raw !== "number" || !Number.isSafeInteger(raw) || raw <= 0) throw Errors.invalidInput("chainId", invalidValueReason("must be a positive safe integer", raw));
-	return raw;
-}
-function toWeiAmount(raw) {
-	if (typeof raw !== "string" || !WEI_RE.test(raw)) throw Errors.invalidInput("weiAmount", invalidValueReason("must be a non-negative integer string", raw));
-	return raw;
-}
-function toCountryCode(raw) {
-	if (typeof raw !== "string") throw Errors.invalidInput("countryCode", "must be a string");
-	const upper = raw.toUpperCase();
-	if (!COUNTRY_CODE_RE.test(upper)) throw Errors.invalidInput("countryCode", invalidValueReason("must be a 2-letter ISO 3166-1 alpha-2 code", raw));
-	return upper;
-}
-function toCurrencyCode(raw) {
-	if (typeof raw !== "string" || !SUPPORTED_CURRENCY_CODES.includes(raw)) throw Errors.invalidInput("currencyCode", invalidValueReason("unsupported currency", raw));
-	return raw;
-}
-function currencySymbolFor(code) {
-	const symbol = CURRENCY_SYMBOLS[code];
-	if (symbol === void 0) throw Errors.invalidInput("currencyCode", `no symbol registered for "${String(code)}"`);
-	return symbol;
-}
-function toTesterKind(raw) {
-	if (raw !== "human" && raw !== "e2e" && raw !== "agent") throw Errors.invalidInput("testerKind", "must be human, e2e, or agent");
-	return raw;
-}
-function toKycTier(raw) {
-	if (typeof raw !== "number" || !Number.isInteger(raw) || raw < 0 || raw > 3) throw Errors.invalidInput("kycTier", invalidValueReason("must be an integer in [0, 3]", raw));
-	return raw;
-}
-function toRoleKey(raw) {
-	if (typeof raw !== "string" || !BYTES32_RE.test(raw)) throw Errors.invalidInput("roleKey", invalidValueReason("must be 0x + 64 hex chars", raw));
-	return raw.toLowerCase();
-}
-function toSessionToken(raw) {
-	if (typeof raw !== "string" || raw.length === 0) throw Errors.invalidInput("token", "must be a non-empty string");
-	return raw;
-}
-function toJwtToken(raw) {
-	if (typeof raw !== "string" || raw.length === 0) throw Errors.invalidInput("jwtToken", "must be a non-empty string");
-	return raw;
-}
-function toNonEmptyStringBrand(raw, field) {
-	if (typeof raw !== "string" || raw.length === 0) throw Errors.invalidInput(field, "must be a non-empty string");
-	return raw;
-}
-function assertSafeNonNegativeInteger(raw, field) {
-	if (typeof raw !== "number" || !Number.isSafeInteger(raw) || raw < 0) throw Errors.invalidInput(field, invalidValueReason("must be a non-negative safe integer", raw));
-}
-function normalizeAllowedOrigin(raw) {
-	let parsed;
-	try {
-		parsed = new URL(raw);
-	} catch {
-		return null;
-	}
-	if (parsed.protocol !== "http:" && parsed.protocol !== "https:") return null;
-	if (parsed.hostname.includes("*")) return null;
-	return parsed.origin;
-}
-function invalidValueReason(prefix, raw) {
-	if (typeof raw === "string") return `${prefix}: ${raw.slice(0, 40)}`;
-	return `${prefix}: ${String(raw)}`;
-}
-//#endregion
-//#region ../config/src/tokens.ts
-/** `TestUSDC` ("USDX") — Base Sepolia, 6 decimals, open `mint`. (Canon §1.) */
-const USDX_ADDRESS_BASE_SEPOLIA = "0xf09fcbb6df9f8f918e58f9c8ab15a76ade862b77";
-const USDX_DEPLOYMENT_START_BLOCK = 39860173;
-/**
-* The ERC-20 `symbol()` the deployed `TestUSDC` contract returns
-* (`packages/contracts/src/TestUSDC.sol:10`). It travels with the address and
-* the decimals so a holdings row can never carry one token's address with
-* another token's display symbol. This is the display symbol, not the
-* currency: see `USDX_CURRENCY` below.
-*/
-const USDX_SYMBOL = "USDX";
-const SYNTHETIC_TEST_ASSET_SOURCE = "synthetic-test-liquidity";
-const USDX_ASSET = {
-	assetId: assetIdFor(84532, USDX_ADDRESS_BASE_SEPOLIA),
-	chainId: toChainId(84532),
-	symbol: USDX_SYMBOL,
-	peg: toCurrencyCode("USD"),
-	tokenAddress: USDX_ADDRESS_BASE_SEPOLIA,
-	deploymentStartBlock: USDX_DEPLOYMENT_START_BLOCK,
-	decimals: 6,
-	source: "settlement"
-};
-/**
-* The settlement tier: rows the exact-transfer path and the Movement scanner
-* admit, each carrying the legacy `currency` projection those readers expect.
-* Adding an owned test asset here would put candidate liquidity on the
-* money-write path, so M03's rows go to the candidate tier below instead.
-*/
-const CONFIGURED_MONEY_ASSETS = [{
-	...USDX_ASSET,
-	currency: USDX_ASSET.peg
-}];
-/**
-* The candidate tier: five owned test assets, every field read back from Base
-* Sepolia after the deployment that created it (chain 84532, blocks
-* 46,465,978–46,465,982). Real contracts, authored liquidity, no settlement
-* admission — so rollback is removing consumers, never relabelling a
-* deployed address or deleting its history.
-*
-* `symbol` is the display string the owned contract returns. A
-* provider-supported USDC would be a different contract at a different
-* address returning the same symbol, which is why the resolvers below key on
-* `assetId`, or on chain plus address, and never on a symbol.
-*/
-const SYNTHETIC_TEST_ASSETS = [
-	{
-		assetId: assetIdFor(84532, "0xb3d8566fb90f7df939f4bc08a09b19047117f549"),
-		chainId: toChainId(84532),
-		tokenAddress: "0xb3d8566fb90f7df939f4bc08a09b19047117f549",
-		symbol: "USDC",
-		decimals: 6,
-		peg: toCurrencyCode("USD"),
-		deploymentStartBlock: 46465978,
-		deploymentTransaction: "0xa7fb8bb9d1fd1cc5fe2fc42fa4cdccace7742efae8ea99f091a283e5709343de",
-		source: SYNTHETIC_TEST_ASSET_SOURCE
-	},
-	{
-		assetId: assetIdFor(84532, "0x7ddcfb6aaffb9908c4c2db308b784c269eec8a01"),
-		chainId: toChainId(84532),
-		tokenAddress: "0x7ddcfb6aaffb9908c4c2db308b784c269eec8a01",
-		symbol: "USDT",
-		decimals: 6,
-		peg: toCurrencyCode("USD"),
-		deploymentStartBlock: 46465979,
-		deploymentTransaction: "0xa17ad76fe8b24cdf1fbcff245c3eb022444710cf9fa7b5ee59818be654f4ae10",
-		source: SYNTHETIC_TEST_ASSET_SOURCE
-	},
-	{
-		assetId: assetIdFor(84532, "0x1d93d525f73453fe18eebf044e8a3954bfe3721e"),
-		chainId: toChainId(84532),
-		tokenAddress: "0x1d93d525f73453fe18eebf044e8a3954bfe3721e",
-		symbol: "WETH",
-		decimals: 18,
-		peg: null,
-		deploymentStartBlock: 46465980,
-		deploymentTransaction: "0xcb9b2d024686fac93ec1243ccf02d3567fd531da46176115660cba2ba644b09d",
-		source: SYNTHETIC_TEST_ASSET_SOURCE
-	},
-	{
-		assetId: assetIdFor(84532, "0x8fe52c70aa9f7b6d74d8bb26eca33d87413cb624"),
-		chainId: toChainId(84532),
-		tokenAddress: "0x8fe52c70aa9f7b6d74d8bb26eca33d87413cb624",
-		symbol: "WBTC",
-		decimals: 8,
-		peg: null,
-		deploymentStartBlock: 46465981,
-		deploymentTransaction: "0x728ba7b430ffd141f83d0ed5ce429d050049d7b097c936fd11e9c572d1243854",
-		source: SYNTHETIC_TEST_ASSET_SOURCE
-	},
-	{
-		assetId: assetIdFor(84532, "0x5865fe9787ac214feb5facaebaec06969ac0a9a3"),
-		chainId: toChainId(84532),
-		tokenAddress: "0x5865fe9787ac214feb5facaebaec06969ac0a9a3",
-		symbol: "cNGN",
-		decimals: 6,
-		peg: toCurrencyCode("NGN"),
-		deploymentStartBlock: 46465982,
-		deploymentTransaction: "0xcedf254bcef57fc64189261a5ab1161bc4fde370e470933f627c4d8ddb5a2e26",
-		source: SYNTHETIC_TEST_ASSET_SOURCE
-	}
-];
-toChainId(84532);
-/**
-* Every known asset in ONE identity space. The tiers above declare admission;
-* this is the only list an identity resolves against, so an asset is never
-* two different things depending on which list a caller happened to read.
-*/
-const MONEY_ASSET_REGISTRY = [...CONFIGURED_MONEY_ASSETS, ...SYNTHETIC_TEST_ASSETS];
-CONFIGURED_MONEY_ASSETS.map((asset) => asset.tokenAddress.toLowerCase());
-/** The registry row for `assetId` across every tier, or `null`. */
-function configuredMoneyAssetById(assetId) {
-	const canonical = toAssetId(assetId);
-	return MONEY_ASSET_REGISTRY.find((asset) => asset.assetId === canonical) ?? null;
-}
-//#endregion
-//#region ../config/src/org-payments.ts
-/** Zodiac MultiSendCallOnly module on Base Sepolia. */
-const MULTI_SEND_CALL_ONLY = "0x9641d764fc13c8b624c04430c7356c1c7c8102e2";
-//#endregion
-//#region ../config/src/safe.ts
-const BASE_SEPOLIA_CHAIN_ID = 84532;
-const SAFE_PROXY_FACTORY = "0x4e1DCf7AD4e460CfD30791CCC4F9c8a4f820ec67";
-const SAFE_L2_SINGLETON = "0x29fcB43b46531BcA003ddC8FCB67FFE91900C762";
-const SAFE_MODULE_SETUP = "0x2dd68b007B46fBe91B9A7c3EDa5A7a1063cB5b47";
-const SAFE_4337_MODULE = "0x75cf11467937ce3F2f357CE24ffc3DBF8fD5c226";
-const MULTI_SEND = "0x38869bf66a61cF6bDB996A6aE40D5853Fd43B526";
-/**
-* The Capxul bootstrap owner — the sole `setup()` owner of every unclaimed
-* personal Safe under derivation v2. This address is part of the CREATE2
-* preimage of EVERY personal Safe address: treat it exactly like
-* `SAFE_PROXY_FACTORY` (changing it is a derivation-version event → v3).
-* The private key lives backend-only (`CAPXUL_BOOTSTRAP_OWNER_PRIVATE_KEY`)
-* and signs exactly one kind of operation: the claim userOp that deploys the
-* Safe and swaps this owner out for the user's signer (PRD #462). The earlier
-* ClaimGuard derivation-v3 placeholder (#461) is closed; future mainnet-scale
-* hardening should be filed against the current payments/claim architecture.
-*/
-const CAPXUL_BOOTSTRAP_OWNER = "0x425fca96f4a3e18fb80974e38096b5da460f2704";
-const SAFE_PROXY_CREATION_CODE = "0x608060405234801561001057600080fd5b506040516101e63803806101e68339818101604052602081101561003357600080fd5b8101908080519060200190929190505050600073ffffffffffffffffffffffffffffffffffffffff168173ffffffffffffffffffffffffffffffffffffffff1614156100ca576040517f08c379a00000000000000000000000000000000000000000000000000000000081526004018080602001828103825260228152602001806101c46022913960400191505060405180910390fd5b806000806101000a81548173ffffffffffffffffffffffffffffffffffffffff021916908373ffffffffffffffffffffffffffffffffffffffff1602179055505060ab806101196000396000f3fe608060405273ffffffffffffffffffffffffffffffffffffffff600054167fa619486e0000000000000000000000000000000000000000000000000000000060003514156050578060005260206000f35b3660008037600080366000845af43d6000803e60008114156070573d6000fd5b3d6000f3fea264697066735822122003d1488ee65e08fa41e58e888a9865554c535f2c77126a82cb4c0f917f31441364736f6c63430007060033496e76616c69642073696e676c65746f6e20616464726573732070726f7669646564";
-/**
-* Normalize an email for use as a Capxul Safe salt input.
-*
-* Trims surrounding whitespace and lowercases the address so that
-* `"  User+Demo@Example.COM  "` and `"user+demo@example.com"` derive
-* the same `safeAddress`. This is the canonical normalization rule —
-* any future change here would shift every existing user's Safe
-* address, so the rule is pinned by the fixture matrix in
-* `packages/config/tests/safe-address-conformance.test.ts`.
-*
-* @param email - The raw email address to normalize
-* @returns The trimmed, lowercased email
-*/
-function normalizeSafeSaltEmail(email) {
-	return email.trim().toLowerCase();
-}
-/**
-* Compute the deterministic Safe salt nonce for a `(namespace, email)`
-* pair. The salt nonce is the `bigint` reading of
-* `keccak256(namespace + ":" + normalizeSafeSaltEmail(email))`.
-*
-* Namespace defaults to `CAPXUL_SAFE_SALT_NAMESPACE`
-* (`"capxul:staging:email:v1"`) — the current Capxul scheme. Pass a
-* different namespace only for pinned pre-v2 artifacts
-* (`CAPXUL_SAFE_SALT_NAMESPACE_V1`, faucet Safe) or when bumping the scheme.
-*
-* @param input.email - The email to derive the salt nonce from
-* @param input.namespace - Optional namespace override (defaults to `CAPXUL_SAFE_SALT_NAMESPACE`)
-* @returns The Capxul-namespaced salt nonce as a `bigint`
-*/
-function computeCapxulSafeSaltNonce(input) {
-	const namespace = input.namespace ?? "capxul:staging:email:v1";
-	const normalizedEmail = normalizeSafeSaltEmail(input.email);
-	return BigInt(keccak256(toBytes(`${namespace}:${normalizedEmail}`)));
-}
-const ZERO_ADDRESS = "0x0000000000000000000000000000000000000000";
-const safeSetupAbi = [{
-	type: "function",
-	name: "setup",
-	stateMutability: "nonpayable",
-	inputs: [
-		{
-			name: "_owners",
-			type: "address[]"
-		},
-		{
-			name: "_threshold",
-			type: "uint256"
-		},
-		{
-			name: "to",
-			type: "address"
-		},
-		{
-			name: "data",
-			type: "bytes"
-		},
-		{
-			name: "fallbackHandler",
-			type: "address"
-		},
-		{
-			name: "paymentToken",
-			type: "address"
-		},
-		{
-			name: "payment",
-			type: "uint256"
-		},
-		{
-			name: "paymentReceiver",
-			type: "address"
-		}
-	],
-	outputs: []
-}];
-const enableModulesAbi = [{
-	type: "function",
-	name: "enableModules",
-	stateMutability: "nonpayable",
-	inputs: [{
-		name: "modules",
-		type: "address[]"
-	}],
-	outputs: []
-}];
-const multiSendAbi = [{
-	type: "function",
-	name: "multiSend",
-	stateMutability: "payable",
-	inputs: [{
-		name: "transactions",
-		type: "bytes"
-	}],
-	outputs: []
-}];
-function buildCapxulSafeInitializer(owner) {
-	const enableModulesCall = encodeFunctionData({
-		abi: enableModulesAbi,
-		functionName: "enableModules",
-		args: [[SAFE_4337_MODULE]]
-	});
-	const enableModulesByteLen = BigInt((enableModulesCall.length - 2) / 2);
-	const multiSendPayload = encodePacked([
-		"uint8",
-		"address",
-		"uint256",
-		"uint256",
-		"bytes"
-	], [
-		1,
-		SAFE_MODULE_SETUP,
-		0n,
-		enableModulesByteLen,
-		enableModulesCall
-	]);
-	const setupData = encodeFunctionData({
-		abi: multiSendAbi,
-		functionName: "multiSend",
-		args: [multiSendPayload]
-	});
-	return encodeFunctionData({
-		abi: safeSetupAbi,
-		functionName: "setup",
-		args: [
-			[owner],
-			1n,
-			MULTI_SEND,
-			setupData,
-			SAFE_4337_MODULE,
-			ZERO_ADDRESS,
-			0n,
-			ZERO_ADDRESS
-		]
-	});
-}
-const ADDRESS_REGEX = /^0x[0-9a-fA-F]{40}$/;
-function validateAndNormalizeAddress(field, value) {
-	const address = value.toLowerCase();
-	if (!ADDRESS_REGEX.test(address)) throw Errors.invalidInput(field, `must be 0x + 40 hex chars, got ${value}`);
-	return address;
-}
-/**
-* Pure derivation of the Capxul personal Safe address — **v2: email only**
-* (PRD #462). The Safe v1.4.1 (SafeL2) + 4337-module initializer's sole owner
-* is the fixed `CAPXUL_BOOTSTRAP_OWNER`, so the address is a pure function of
-* the (normalized) email and exists before any user signer does. The user's
-* signer is installed at claim time via `swapOwner` — signer rotation can
-* never move the address (org-domain rule D7, now system-wide).
-*
-* Returns the lowercased `0x` + 40 hex string (raw — no brand applied so this
-* function is callable from both `@capxul/config` consumers that don't have
-* `@capxul/types` available, and from packages that re-brand at their own
-* boundary).
-*
-* Algorithm: exactly mirrors `permissionless.toSafeSmartAccount({ version:
-* "1.4.1", safeSingletonAddress: SAFE_L2_SINGLETON, owners: [BOOTSTRAP] })`
-* + the Capxul-canonical module setup (delegatecall into
-* `SafeModuleSetup.enableModules([SAFE_4337_MODULE])` via the MultiSend lane
-* during proxy setup). The proxy creation code is pinned at
-* `SAFE_PROXY_CREATION_CODE`; the salt is Capxul-namespaced (v2) via
-* `computeCapxulSafeSaltNonce({ email })`.
-*
-* Canonical: SDK deployment adapters and
-* `packages/backend/convex/smartAccount/mutations.ts:provision` import this
-* function; the conformance test at
-* `packages/config/tests/safe-address-conformance.test.ts` pins the matrix.
-*/
-function deriveCapxulSafeAddress(input) {
-	return deriveCapxulSafeAddressForOwner({
-		ownerAddress: CAPXUL_BOOTSTRAP_OWNER,
-		email: input.email
-	});
-}
-/**
-* Owner-parametrized derivation core. Two callers only:
-* 1. `deriveCapxulSafeAddress` (canonical v2: owner = bootstrap, namespace v2);
-* 2. the backend faucet Safe (`testUsdcMint.ts`: owner = deployer EOA,
-*    namespace pinned to `CAPXUL_SAFE_SALT_NAMESPACE_V1` so its deployed
-*    address never moves).
-* Do NOT introduce new owner-parametrized lanes — per-user owners in the
-* derivation is exactly the v1 mistake v2 removes.
-*/
-function deriveCapxulSafeAddressForOwner(input) {
-	const initializer = buildCapxulSafeInitializer(validateAndNormalizeAddress("ownerAddress", input.ownerAddress));
-	const saltNonce = computeCapxulSafeSaltNonce(input.namespace === void 0 ? { email: input.email } : {
-		email: input.email,
-		namespace: input.namespace
-	});
-	const salt = keccak256(encodePacked(["bytes32", "uint256"], [keccak256(initializer), saltNonce]));
-	const deploymentCode = concat([SAFE_PROXY_CREATION_CODE, encodeAbiParameters([{ type: "uint256" }], [BigInt(SAFE_L2_SINGLETON)])]);
-	return getContractAddress({
-		opcode: "CREATE2",
-		from: SAFE_PROXY_FACTORY,
-		salt,
-		bytecodeHash: keccak256(deploymentCode)
-	}).toLowerCase();
-}
-/**
-* Normalize a raw email for binding id + Safe salt derivation.
-* Delegates to {@link normalizeSafeSaltEmail} so binding resolution and
-* `deriveCapxulSafeAddress` never drift apart.
-*/
-function normalizeBindingEmail(email) {
-	return normalizeSafeSaltEmail(email);
-}
-//#endregion
-//#region ../config/src/capxul-payments-v2.ts
-/** The exact compiled CapxulPaymentsV2 ABI. */
-const CAPXUL_PAYMENTS_V2_ABI = [
-	{
-		type: "function",
-		name: "cancel",
-		inputs: [{
-			name: "commitmentId",
-			type: "uint256",
-			internalType: "uint256"
-		}, {
-			name: "documentHash",
-			type: "bytes32",
-			internalType: "bytes32"
-		}],
-		outputs: [],
-		stateMutability: "nonpayable"
-	},
-	{
-		type: "function",
-		name: "claim",
-		inputs: [{
-			name: "commitmentId",
-			type: "uint256",
-			internalType: "uint256"
-		}],
-		outputs: [],
-		stateMutability: "nonpayable"
-	},
-	{
-		type: "function",
-		name: "claimableAmount",
-		inputs: [{
-			name: "commitmentId",
-			type: "uint256",
-			internalType: "uint256"
-		}],
-		outputs: [{
-			name: "",
-			type: "uint256",
-			internalType: "uint256"
-		}],
-		stateMutability: "view"
-	},
-	{
-		type: "function",
-		name: "commitments",
-		inputs: [{
-			name: "",
-			type: "uint256",
-			internalType: "uint256"
-		}],
-		outputs: [
-			{
-				name: "settlementId",
-				type: "bytes32",
-				internalType: "bytes32"
-			},
-			{
-				name: "creator",
-				type: "address",
-				internalType: "address"
-			},
-			{
-				name: "recipient",
-				type: "address",
-				internalType: "address"
-			},
-			{
-				name: "token",
-				type: "address",
-				internalType: "address"
-			},
-			{
-				name: "totalAmount",
-				type: "uint256",
-				internalType: "uint256"
-			},
-			{
-				name: "claimed",
-				type: "uint256",
-				internalType: "uint256"
-			},
-			{
-				name: "startTime",
-				type: "uint48",
-				internalType: "uint48"
-			},
-			{
-				name: "cliffTime",
-				type: "uint48",
-				internalType: "uint48"
-			},
-			{
-				name: "endTime",
-				type: "uint48",
-				internalType: "uint48"
-			},
-			{
-				name: "kind",
-				type: "uint16",
-				internalType: "uint16"
-			},
-			{
-				name: "documentHash",
-				type: "bytes32",
-				internalType: "bytes32"
-			},
-			{
-				name: "cancelled",
-				type: "bool",
-				internalType: "bool"
-			}
-		],
-		stateMutability: "view"
-	},
-	{
-		type: "function",
-		name: "createCommitment",
-		inputs: [{
-			name: "input",
-			type: "tuple",
-			internalType: "struct CapxulPaymentsV2.CommitmentInput",
-			components: [
-				{
-					name: "settlementId",
-					type: "bytes32",
-					internalType: "bytes32"
-				},
-				{
-					name: "recipient",
-					type: "address",
-					internalType: "address"
-				},
-				{
-					name: "token",
-					type: "address",
-					internalType: "address"
-				},
-				{
-					name: "totalAmount",
-					type: "uint256",
-					internalType: "uint256"
-				},
-				{
-					name: "startTime",
-					type: "uint48",
-					internalType: "uint48"
-				},
-				{
-					name: "cliffTime",
-					type: "uint48",
-					internalType: "uint48"
-				},
-				{
-					name: "endTime",
-					type: "uint48",
-					internalType: "uint48"
-				},
-				{
-					name: "kind",
-					type: "uint16",
-					internalType: "uint16"
-				},
-				{
-					name: "documentHash",
-					type: "bytes32",
-					internalType: "bytes32"
-				}
-			]
-		}],
-		outputs: [{
-			name: "commitmentId",
-			type: "uint256",
-			internalType: "uint256"
-		}],
-		stateMutability: "nonpayable"
-	},
-	{
-		type: "function",
-		name: "nextCommitmentId",
-		inputs: [],
-		outputs: [{
-			name: "",
-			type: "uint256",
-			internalType: "uint256"
-		}],
-		stateMutability: "view"
-	},
-	{
-		type: "function",
-		name: "redirect",
-		inputs: [
-			{
-				name: "commitmentId",
-				type: "uint256",
-				internalType: "uint256"
-			},
-			{
-				name: "recipient",
-				type: "address",
-				internalType: "address"
-			},
-			{
-				name: "documentHash",
-				type: "bytes32",
-				internalType: "bytes32"
-			}
-		],
-		outputs: [],
-		stateMutability: "nonpayable"
-	},
-	{
-		type: "function",
-		name: "send",
-		inputs: [{
-			name: "item",
-			type: "tuple",
-			internalType: "struct CapxulPaymentsV2.PaymentItem",
-			components: [
-				{
-					name: "settlementId",
-					type: "bytes32",
-					internalType: "bytes32"
-				},
-				{
-					name: "recipient",
-					type: "address",
-					internalType: "address"
-				},
-				{
-					name: "token",
-					type: "address",
-					internalType: "address"
-				},
-				{
-					name: "amount",
-					type: "uint256",
-					internalType: "uint256"
-				},
-				{
-					name: "kind",
-					type: "uint16",
-					internalType: "uint16"
-				},
-				{
-					name: "documentHash",
-					type: "bytes32",
-					internalType: "bytes32"
-				}
-			]
-		}],
-		outputs: [],
-		stateMutability: "nonpayable"
-	},
-	{
-		type: "function",
-		name: "sendBatch",
-		inputs: [{
-			name: "items",
-			type: "tuple[]",
-			internalType: "struct CapxulPaymentsV2.PaymentItem[]",
-			components: [
-				{
-					name: "settlementId",
-					type: "bytes32",
-					internalType: "bytes32"
-				},
-				{
-					name: "recipient",
-					type: "address",
-					internalType: "address"
-				},
-				{
-					name: "token",
-					type: "address",
-					internalType: "address"
-				},
-				{
-					name: "amount",
-					type: "uint256",
-					internalType: "uint256"
-				},
-				{
-					name: "kind",
-					type: "uint16",
-					internalType: "uint16"
-				},
-				{
-					name: "documentHash",
-					type: "bytes32",
-					internalType: "bytes32"
-				}
-			]
-		}],
-		outputs: [],
-		stateMutability: "nonpayable"
-	},
-	{
-		type: "function",
-		name: "vestedAmount",
-		inputs: [{
-			name: "commitmentId",
-			type: "uint256",
-			internalType: "uint256"
-		}],
-		outputs: [{
-			name: "",
-			type: "uint256",
-			internalType: "uint256"
-		}],
-		stateMutability: "view"
-	},
-	{
-		type: "event",
-		name: "CommitmentCancelled",
-		inputs: [
-			{
-				name: "commitmentId",
-				type: "uint256",
-				indexed: true,
-				internalType: "uint256"
-			},
-			{
-				name: "settlementId",
-				type: "bytes32",
-				indexed: true,
-				internalType: "bytes32"
-			},
-			{
-				name: "creator",
-				type: "address",
-				indexed: true,
-				internalType: "address"
-			},
-			{
-				name: "vestedUnclaimed",
-				type: "uint256",
-				indexed: false,
-				internalType: "uint256"
-			},
-			{
-				name: "unvestedReturned",
-				type: "uint256",
-				indexed: false,
-				internalType: "uint256"
-			},
-			{
-				name: "documentHash",
-				type: "bytes32",
-				indexed: false,
-				internalType: "bytes32"
-			}
-		],
-		anonymous: false
-	},
-	{
-		type: "event",
-		name: "CommitmentCreated",
-		inputs: [
-			{
-				name: "commitmentId",
-				type: "uint256",
-				indexed: true,
-				internalType: "uint256"
-			},
-			{
-				name: "settlementId",
-				type: "bytes32",
-				indexed: true,
-				internalType: "bytes32"
-			},
-			{
-				name: "creator",
-				type: "address",
-				indexed: true,
-				internalType: "address"
-			},
-			{
-				name: "recipient",
-				type: "address",
-				indexed: false,
-				internalType: "address"
-			},
-			{
-				name: "token",
-				type: "address",
-				indexed: false,
-				internalType: "address"
-			},
-			{
-				name: "totalAmount",
-				type: "uint256",
-				indexed: false,
-				internalType: "uint256"
-			},
-			{
-				name: "startTime",
-				type: "uint48",
-				indexed: false,
-				internalType: "uint48"
-			},
-			{
-				name: "cliffTime",
-				type: "uint48",
-				indexed: false,
-				internalType: "uint48"
-			},
-			{
-				name: "endTime",
-				type: "uint48",
-				indexed: false,
-				internalType: "uint48"
-			},
-			{
-				name: "kind",
-				type: "uint16",
-				indexed: false,
-				internalType: "uint16"
-			},
-			{
-				name: "documentHash",
-				type: "bytes32",
-				indexed: false,
-				internalType: "bytes32"
-			}
-		],
-		anonymous: false
-	},
-	{
-		type: "event",
-		name: "CommitmentRedirected",
-		inputs: [
-			{
-				name: "commitmentId",
-				type: "uint256",
-				indexed: true,
-				internalType: "uint256"
-			},
-			{
-				name: "settlementId",
-				type: "bytes32",
-				indexed: true,
-				internalType: "bytes32"
-			},
-			{
-				name: "oldRecipient",
-				type: "address",
-				indexed: true,
-				internalType: "address"
-			},
-			{
-				name: "newRecipient",
-				type: "address",
-				indexed: false,
-				internalType: "address"
-			},
-			{
-				name: "documentHash",
-				type: "bytes32",
-				indexed: false,
-				internalType: "bytes32"
-			}
-		],
-		anonymous: false
-	},
-	{
-		type: "event",
-		name: "FundsClaimed",
-		inputs: [
-			{
-				name: "commitmentId",
-				type: "uint256",
-				indexed: true,
-				internalType: "uint256"
-			},
-			{
-				name: "settlementId",
-				type: "bytes32",
-				indexed: true,
-				internalType: "bytes32"
-			},
-			{
-				name: "recipient",
-				type: "address",
-				indexed: true,
-				internalType: "address"
-			},
-			{
-				name: "amount",
-				type: "uint256",
-				indexed: false,
-				internalType: "uint256"
-			},
-			{
-				name: "documentHash",
-				type: "bytes32",
-				indexed: false,
-				internalType: "bytes32"
-			}
-		],
-		anonymous: false
-	},
-	{
-		type: "event",
-		name: "PaymentSent",
-		inputs: [
-			{
-				name: "settlementId",
-				type: "bytes32",
-				indexed: true,
-				internalType: "bytes32"
-			},
-			{
-				name: "sender",
-				type: "address",
-				indexed: true,
-				internalType: "address"
-			},
-			{
-				name: "recipient",
-				type: "address",
-				indexed: true,
-				internalType: "address"
-			},
-			{
-				name: "token",
-				type: "address",
-				indexed: false,
-				internalType: "address"
-			},
-			{
-				name: "amount",
-				type: "uint256",
-				indexed: false,
-				internalType: "uint256"
-			},
-			{
-				name: "kind",
-				type: "uint16",
-				indexed: false,
-				internalType: "uint16"
-			},
-			{
-				name: "documentHash",
-				type: "bytes32",
-				indexed: false,
-				internalType: "bytes32"
-			}
-		],
-		anonymous: false
-	},
-	{
-		type: "error",
-		name: "AlreadyCancelled",
-		inputs: []
-	},
-	{
-		type: "error",
-		name: "AlreadyClaimed",
-		inputs: []
-	},
-	{
-		type: "error",
-		name: "DocumentHashMismatch",
-		inputs: [{
-			name: "expected",
-			type: "bytes32",
-			internalType: "bytes32"
-		}, {
-			name: "supplied",
-			type: "bytes32",
-			internalType: "bytes32"
-		}]
-	},
-	{
-		type: "error",
-		name: "InvalidTimeParams",
-		inputs: []
-	},
-	{
-		type: "error",
-		name: "NotCreator",
-		inputs: []
-	},
-	{
-		type: "error",
-		name: "NotRecipient",
-		inputs: []
-	},
-	{
-		type: "error",
-		name: "NothingToClaim",
-		inputs: []
-	},
-	{
-		type: "error",
-		name: "SettlementIdConsumed",
-		inputs: [{
-			name: "settlementId",
-			type: "bytes32",
-			internalType: "bytes32"
-		}]
-	},
-	{
-		type: "error",
-		name: "TokenCallReturnedFalse",
-		inputs: [{
-			name: "token",
-			type: "address",
-			internalType: "address"
-		}]
-	},
-	{
-		type: "error",
-		name: "TokenHasNoCode",
-		inputs: [{
-			name: "token",
-			type: "address",
-			internalType: "address"
-		}]
-	},
-	{
-		type: "error",
-		name: "ZeroAddress",
-		inputs: []
-	},
-	{
-		type: "error",
-		name: "ZeroAmount",
-		inputs: []
-	},
-	{
-		type: "error",
-		name: "ZeroDocumentHash",
-		inputs: []
-	},
-	{
-		type: "error",
-		name: "ZeroSettlementId",
-		inputs: []
-	}
-];
-/** Immutable CapxulPaymentsV2 deployment on Base Sepolia. */
-const CAPXUL_PAYMENTS_V2_ADDRESS = "0x7a5c25aB7ce91d7a475B71cd1ec33E230291f8a4";
-//#endregion
-//#region ../config/src/route.ts
-/** USDX on Base Sepolia — the only settlement token in v1. */
-const USDX_BASE_SEPOLIA_TOKEN = {
-	chainId: BASE_SEPOLIA_CHAIN_ID,
-	address: USDX_ADDRESS_BASE_SEPOLIA,
-	decimals: 6
-};
-USDX_BASE_SEPOLIA_TOKEN.chainId;
-USDX_BASE_SEPOLIA_TOKEN.chainId;
-10n ** BigInt(6);
-/**
-* The bootstrap manage role. It administers people and roles, cannot spend,
-* and is not a signer of the Organization Safe; "Owner" implied the latter,
-* so the label is Admin (ruled 2026-09-06).
-*/
-const ADMIN_ROLE_LABEL = "Admin";
-function normalizeOrgRoleLabel(label) {
-	const normalized = label.trim().replace(/\s+/g, " ");
-	if (normalized.length === 0) throw Errors.invalidInput("role.label", "must be a non-empty role label");
-	return normalized;
-}
-function orgRoleKeyForLabel(label) {
-	return keccak256(toBytes(normalizeOrgRoleLabel(label).toLowerCase()));
-}
-padHex(stringToHex("FM_DAILY"), {
-	size: 32,
-	dir: "right"
-}), padHex(stringToHex("TL_DAILY"), {
-	size: 32,
-	dir: "right"
-});
-padHex(concat([MULTI_SEND_CALL_ONLY, "0x8d80ff0a"]), {
-	dir: "right",
-	size: 32
-});
-function paymentsV2Signature(name) {
-	const item = CAPXUL_PAYMENTS_V2_ABI.find((candidate) => candidate.type === "function" && candidate.name === name);
-	if (item === void 0) throw new Error(`CapxulPaymentsV2 ABI has no ${name} function`);
-	return toFunctionSignature(item);
-}
-paymentsV2Signature("send");
-paymentsV2Signature("sendBatch");
-paymentsV2Signature("createCommitment");
-paymentsV2Signature("cancel");
-paymentsV2Signature("redirect");
-new Map([
-	["assignRoles(address,bytes32[],bool[])", "AssignRoles(address,bytes32[],bool[])"],
-	["allowTarget(bytes32,address,uint8)", "AllowTarget(bytes32,address,uint8)"],
-	["scopeTarget(bytes32,address)", "ScopeTarget(bytes32,address)"],
-	["revokeTarget(bytes32,address)", "RevokeTarget(bytes32,address)"],
-	["allowFunction(bytes32,address,bytes4,uint8)", "AllowFunction(bytes32,address,bytes4,uint8)"],
-	["scopeFunction(bytes32,address,bytes4,(uint8,uint8,uint8,bytes)[],uint8)", "ScopeFunction(bytes32,address,bytes4,(uint8,uint8,uint8,bytes)[],uint8)"],
-	["revokeFunction(bytes32,address,bytes4)", "RevokeFunction(bytes32,address,bytes4)"],
-	["setAllowance(bytes32,uint128,uint128,uint128,uint64,uint64)", "SetAllowance(bytes32,uint128,uint128,uint128,uint64,uint64)"]
-].map(([functionSignature, eventSignature]) => [toFunctionSelector(functionSignature), toEventSelector(eventSignature)]));
-//#endregion
-//#region src/ports/auth-client.ts
-var AuthClientError = class extends Data.TaggedError("AuthClientError") {};
-var AuthClientPortTag = class extends Context.Service()("@capxul/sdk/ports/AuthClientPort") {};
-//#endregion
-//#region src/adapters/auth-client/effect-port.ts
-function authClientPortFromPromiseAdapter(adapter) {
-	return {
-		canSendOtp: (input, options) => fromResult("canSendOtp", () => adapter.canSendOtp(input, options)),
-		sendOtp: (input, options) => fromResult("sendOtp", () => adapter.sendOtp(input, options)),
-		verifyOtp: (input, options) => fromResult("verifyOtp", () => adapter.verifyOtp(input, options)),
-		getSession: (options) => fromResult("getSession", () => adapter.getSession(options)),
-		signOut: (options) => fromResult("signOut", () => adapter.signOut(options)),
-		getConvexJwt: (options) => fromResult("getConvexJwt", () => adapter.getConvexJwt(options))
-	};
-}
-function fromResult(operation, run) {
-	return Effect.tryPromise({
-		try: run,
-		catch: (cause) => new AuthClientError({
-			operation,
-			kind: "thrown",
-			cause
-		})
-	}).pipe(Effect.flatMap((result) => result.ok ? Effect.succeed(result.value) : Effect.fail(new AuthClientError({
-		operation,
-		kind: errorKind(result.error),
-		cause: result.error
-	}))));
-}
-function errorKind(error) {
-	if (error.code === "CANCELLED") return "cancelled";
-	if (error.code === "NETWORK_ERROR") return "network";
-	if (error.code === "INVALID_INPUT" || error.code === "OTP_EXPIRED") return "validation";
-	return "provider";
-}
-//#endregion
-//#region src/ports/clock.ts
-var ClockError = class extends Data.TaggedError("ClockError") {};
-var ClockPortTag = class extends Context.Service()("@capxul/sdk/ports/ClockPort") {};
-//#endregion
-//#region src/adapters/clock/SystemClockAdapter.ts
-var SystemClockAdapter = class {
-	now = Effect.try({
-		try: () => toEpochMs(Date.now()),
-		catch: (cause) => new ClockError({
-			operation: "now",
-			cause
-		})
-	});
-	sleep(duration) {
-		return Effect.callback((resume) => {
-			const timeout = setTimeout(() => resume(Effect.void), duration);
-			return Effect.sync(() => clearTimeout(timeout));
-		});
-	}
-};
-function SystemClockLayer() {
-	return Layer.succeed(ClockPortTag, new SystemClockAdapter());
-}
-//#endregion
-//#region src/ports/auth-cache.ts
-var AuthCacheError = class extends Data.TaggedError("AuthCacheError") {};
-var AuthCachePortTag = class extends Context.Service()("@capxul/sdk/ports/AuthCachePort") {};
-//#endregion
-//#region src/adapters/auth-cache/serialization.ts
-function parseAuthSession(raw) {
-	if (typeof raw !== "object" || raw === null) return null;
-	const candidate = raw;
-	try {
-		return {
-			authUserId: toAuthUserId(candidate.authUserId),
-			email: toEmail(candidate.email),
-			token: toSessionToken(candidate.token),
-			expiresAt: toEpochMs(candidate.expiresAt)
-		};
-	} catch {
-		return null;
-	}
-}
-function parseCachedJwt(raw) {
-	if (typeof raw !== "object" || raw === null) return null;
-	const candidate = raw;
-	try {
-		return {
-			token: toJwtToken(candidate.token),
-			expEpochSeconds: toEpochSeconds(candidate.expEpochSeconds)
-		};
-	} catch {
-		return null;
-	}
-}
-//#endregion
-//#region src/adapters/auth-cache/BrowserAuthCacheAdapter.ts
-const SESSION_KEY = "capxul.session";
-const JWT_KEY = "capxul.jwt";
-var BrowserAuthCacheAdapter = class {
-	storage;
-	constructor(storage) {
-		this.storage = storage;
-	}
-	getSession = authCacheTry("getSession", () => {
-		const raw = this.storage.getItem(SESSION_KEY);
-		if (raw === null) return null;
-		try {
-			return parseAuthSession(JSON.parse(raw));
-		} catch {
-			return null;
-		}
-	});
-	setSession = (session) => authCacheTry("setSession", () => {
-		this.storage.setItem(SESSION_KEY, JSON.stringify(session));
-	});
-	clearSession = authCacheTry("clearSession", () => {
-		this.storage.removeItem(SESSION_KEY);
-	});
-	getJwt = authCacheTry("getJwt", () => {
-		const raw = this.storage.getItem(JWT_KEY);
-		if (raw === null) return null;
-		try {
-			return parseCachedJwt(JSON.parse(raw));
-		} catch {
-			return null;
-		}
-	});
-	setJwt = (jwt) => authCacheTry("setJwt", () => {
-		this.storage.setItem(JWT_KEY, JSON.stringify(jwt));
-	});
-	clearJwt = authCacheTry("clearJwt", () => {
-		this.storage.removeItem(JWT_KEY);
-	});
-};
-function toAuthCacheError(operation, cause) {
-	return new AuthCacheError({
-		operation,
-		cause
-	});
-}
-function authCacheTry(operation, run) {
-	return Effect.try({
-		try: run,
-		catch: (cause) => toAuthCacheError(operation, cause)
-	});
-}
-//#endregion
-//#region src/adapters/auth-cache/InMemoryAuthCacheAdapter.ts
-var InMemoryAuthCacheAdapter = class {
-	session = null;
-	jwt = null;
-	getSession = Effect.sync(() => this.session);
-	setSession = (session) => Effect.sync(() => {
-		this.session = session;
-	});
-	clearSession = Effect.sync(() => {
-		this.session = null;
-	});
-	getJwt = Effect.sync(() => this.jwt);
-	setJwt = (jwt) => Effect.sync(() => {
-		this.jwt = jwt;
-	});
-	clearJwt = Effect.sync(() => {
-		this.jwt = null;
-	});
-};
-Layer.effect(AuthCachePortTag, Effect.sync(() => new InMemoryAuthCacheAdapter()).pipe(Effect.mapError((cause) => new AuthCacheError({
-	operation: "initialize",
-	cause
-}))));
-//#endregion
-//#region src/adapters/_shared/clock.ts
-async function readClockNow(clock) {
-	try {
-		const result = await Effect.runPromise(Effect.result(clock.now));
-		if (Result.isFailure(result)) return {
-			ok: false,
-			error: Errors.providerError("clock", "now", result.failure)
-		};
-		return {
-			ok: true,
-			value: result.success
-		};
-	} catch (cause) {
-		return {
-			ok: false,
-			error: Errors.providerError("clock", "now", cause)
-		};
-	}
-}
-//#endregion
-//#region src/adapters/auth-client/OAuthBearerAuthClient.ts
-const PROVIDER = "agent-exchange";
-/** Re-exchange this far ahead of expiry, matching the JWT cache eviction margin. */
-const REFRESH_MARGIN_MS = 3e4;
-/**
-* `AuthSession.token` is a Better Auth session handle. This flow has none, and
-* the access token must never be copied into it, so the slot holds a placeholder.
-*/
-const OAUTH_SESSION_TOKEN = toSessionToken("oauth-bearer");
-var OAuthBearerAuthClient = class {
-	#exchangeUrl;
-	#exchangeSecret;
-	#accessToken;
-	#fetchImpl;
-	#clock;
-	#cached = null;
-	constructor(input) {
-		this.#exchangeUrl = input.exchangeUrl;
-		this.#exchangeSecret = input.exchangeSecret;
-		this.#accessToken = input.accessToken;
-		this.#fetchImpl = input.fetch ?? fetch;
-		this.#clock = input.clock ?? new SystemClockAdapter();
-	}
-	async canSendOtp() {
-		return refuse("canSendOtp");
-	}
-	async sendOtp() {
-		return refuse("sendOtp");
-	}
-	async verifyOtp() {
-		return refuse("verifyOtp");
-	}
-	/**
-	* The authorization server owns the token's lifetime, so revoking it there is
-	* the sign-out. Reporting success here would claim a token was dropped.
-	*/
-	async signOut() {
-		return refuse("signOut");
-	}
-	/**
-	* The exchanged identity. Unlike the Better Auth adapters this never answers
-	* `null`: the consumer holds a usable access token or a refused one, and a
-	* refused one is a NOT_AUTHENTICATED failure, not the absence of a session.
-	*/
-	async getSession(options) {
-		const exchange = await this.#exchange("getSession", options);
-		if (!exchange.ok) return exchange;
-		return {
-			ok: true,
-			value: {
-				authUserId: toAuthUserId(exchange.value.authUserId),
-				email: toEmail(exchange.value.email),
-				token: OAUTH_SESSION_TOKEN,
-				expiresAt: toEpochMs(exchange.value.expiresAt)
-			}
-		};
-	}
-	async getConvexJwt(options) {
-		const exchange = await this.#exchange("getConvexJwt", options);
-		if (!exchange.ok) return exchange;
-		return {
-			ok: true,
-			value: {
-				token: toJwtToken(exchange.value.token),
-				expEpochSeconds: toEpochSeconds(Math.floor(exchange.value.expiresAt / 1e3))
-			}
-		};
-	}
-	/**
-	* The cached exchange while it is fresh, otherwise a new one. A failed
-	* exchange never replaces the cache, so a stale token is never served.
-	*
-	* lazy: no in-flight de-duplication — two concurrent reads past the margin
-	* each mint a JWT. Minting is idempotent, so the cost is one extra request.
-	*/
-	async #exchange(operation, options) {
-		if (options?.signal?.aborted) return {
-			ok: false,
-			error: Errors.cancelled({ operation })
-		};
-		const cached = this.#cached;
-		if (cached !== null && options?.forceRefresh !== true) {
-			const now = await readClockNow(this.#clock);
-			if (!now.ok) return now;
-			if (now.value < cached.expiresAt - REFRESH_MARGIN_MS) return {
-				ok: true,
-				value: cached
-			};
-		}
-		return this.#postExchange(operation, options?.signal);
-	}
-	async #postExchange(operation, signal) {
-		let res;
-		try {
-			res = await this.#fetchImpl(this.#exchangeUrl, {
-				method: "POST",
-				headers: {
-					"content-type": "application/json",
-					authorization: `Bearer ${this.#exchangeSecret}`
-				},
-				body: JSON.stringify({ accessToken: this.#accessToken }),
-				...signal === void 0 ? {} : { signal }
-			});
-		} catch (cause) {
-			return {
-				ok: false,
-				error: signal?.aborted === true || isAbortError(cause) ? Errors.cancelled({ operation }) : Errors.networkError(operation, cause)
-			};
-		}
-		if (signal?.aborted === true) return {
-			ok: false,
-			error: Errors.cancelled({ operation })
-		};
-		const body = await res.json().catch(() => null);
-		if (!res.ok) return {
-			ok: false,
-			error: exchangeRefused(operation, res.status, readErrorCode(body))
-		};
-		const exchange = readExchange(body);
-		if (exchange === null) return {
-			ok: false,
-			error: Errors.providerError(PROVIDER, operation, /* @__PURE__ */ new Error("unexpected body"), { httpStatus: res.status })
-		};
-		this.#cached = exchange;
-		return {
-			ok: true,
-			value: exchange
-		};
-	}
-};
-/**
-* `AuthClientPort` over the backend agent-token exchange. Build one per OAuth
-* access token and hand it to `createCapxulClient({ authClient })`.
-*/
-function oauthBearerAuthClient(input) {
-	return authClientPortFromPromiseAdapter(new OAuthBearerAuthClient(input));
-}
-/** The OTP verbs belong to the email flow; `validStates` names it for the caller. */
-function refuse(method) {
-	return {
-		ok: false,
-		error: Errors.wrongState({
-			method,
-			currentState: "oauth-bearer",
-			validStates: ["email-otp"]
-		})
-	};
-}
-/**
-* The error catalog has no FORBIDDEN code, so 403 (`insufficient_scope`) and
-* 503 (`exchange_unconfigured`) both land on PROVIDER_ERROR. `httpStatus` and
-* `details.reason` carry which one the backend reported. Only 401 becomes
-* NOT_AUTHENTICATED, because only 401 is answered by a new access token.
-*/
-function exchangeRefused(operation, status, reason) {
-	if (status === 401) return Errors.notAuthenticated("The exchange refused this OAuth access token");
-	return Errors.providerError(PROVIDER, operation, /* @__PURE__ */ new Error(`HTTP ${status}`), {
-		httpStatus: status,
-		...reason === void 0 ? {} : { details: { reason } }
-	});
-}
-/** An abort raised by something other than the caller's own signal. */
-function isAbortError(cause) {
-	return readField(cause, "name") === "AbortError";
-}
-function readErrorCode(body) {
-	const error = readField(body, "error");
-	return typeof error === "string" ? error : void 0;
-}
-function readField(value, key) {
-	if (typeof value !== "object" || value === null) return void 0;
-	return value[key];
-}
-function readExchange(body) {
-	if (typeof body !== "object" || body === null) return null;
-	const { token, expiresAt, authUserId, email } = body;
-	if (typeof token !== "string" || token.length === 0) return null;
-	if (typeof expiresAt !== "number" || !Number.isFinite(expiresAt)) return null;
-	if (typeof authUserId !== "string" || authUserId.length === 0) return null;
-	if (typeof email !== "string" || email.length === 0) return null;
-	return {
-		token,
-		expiresAt,
-		authUserId,
-		email
-	};
-}
-//#endregion
-export { toPartyId as $, SUPPORTED_CURRENCY_CODES as A, toAuthUserId as B, ASSET_ID_RE as C, isChainUpstream as Ct, COUNTRY_CODE_RE as D, isCredentialField as Dt, CLIENT_REQUEST_ID_RE as E, containsSensitiveMaterial as Et, toAccountId as F, toDurationMs as G, toChainId as H, toAddress as I, toEpochSeconds as J, toEmail as K, toAllowedOrigin as L, ZERO_BYTES32 as M, assetIdFor as N, EMAIL_RE as O, redactSecrets as Ot, currencySymbolFor as P, toOrgId as Q, toAppId as R, APP_ID_RE as S, failureFingerprint as St, CLIENT_GRANT_ID_RE as T, revertSummaryText as Tt, toCountryCode as U, toBudgetId as V, toCurrencyCode as W, toJwtToken as X, toHandle as Y, toKycTier as Z, normalizeBindingEmail as _, FAILURE_MODES as _t, parseAuthSession as a, toTesterKind as at, configuredMoneyAssetById as b, chainEvidenceLabel as bt, AuthCachePortTag as c, validateHandle as ct, authClientPortFromPromiseAdapter as d, CAPXUL_ERROR_CODES as dt, toPayrollGroupId as et, AuthClientError as f, CapxulError as ft, CAPXUL_PAYMENTS_V2_ADDRESS as g, CHAIN_UPSTREAMS as gt, orgRoleKeyForLabel as h, isCapxulError as ht, BrowserAuthCacheAdapter as i, toSessionToken as it, WEI_RE as j, EVM_ADDRESS_RE as k, redactUrlSecrets as kt, SystemClockLayer as l, HANDLE_RE as lt, ADMIN_ROLE_LABEL as m, Errors as mt, readClockNow as n, toPublishableKey as nt, parseCachedJwt as o, toTxHash as ot, AuthClientPortTag as p, EXPECTED_OPERATION_OUTCOMES as pt, toEpochMs as q, InMemoryAuthCacheAdapter as r, toRoleKey as rt, AuthCacheError as s, toWeiAmount as st, oauthBearerAuthClient as t, toPayrollRunId as tt, ClockPortTag as u, decodeConvexError as ut, BASE_SEPOLIA_CHAIN_ID as v, boundedResponseHeaders as vt, BYTES32_RE as w, isFailureMode as wt, ACCOUNT_ID_RE as x, decodeChainCause as xt, deriveCapxulSafeAddress as y, chainCauseProperties as yt, toAssetId as z };