@capxul/sdk 4.20.0-beta.36 → 4.20.0-beta.38

package/dist/{organizations-BKiw2PjB.mjs → organizations-oVQI9Tag.mjs}

@@ -1,4 +1,4 @@
-import { $n as InvitationViewSchema, At as buildSafeMultiSendExecTransactionCall, Bi as isCapxulError, Cr as toBudgetId, Ct as SEND_SIGNATURE, En as CAPXUL_OPERATIONS, Er as toRoleKey, Et as deriveCapxulSafeAddress, Fi as toEmail, Fn as replacements, Ft as CONFIGURED_MONEY_ASSETS, Gn as treasuries, Gr as observationOnlyControls, Hn as members, In as PreparedPermissionExecutionSchema, J as subscribeFreshQuery, Jr as awaitCapxulResult, Kn as workspaces, Kr as runCapxulEffect, Kt as withCapturedAttemptContext, Ln as PermissionCommandViewSchema, Lr as absurd, Lt as asCapxulError, Mn as authorities, Mt as MULTI_SEND_CALL_ONLY, N as makePayrollMethods, Nn as commands, Nt as SAFE_SENTINEL_OWNERS, O as retryIdempotentRead, Ot as safe4337ExecuteUserOpCallData, P as makeUnavailablePayrollMethods, Pn as configurations, Pr as toAddress, Pt as callOperation, Qn as toOrgId, R as annotateDepositInstructions, Ri as Errors, Rr as reference, St as SEND_BATCH_SIGNATURE, Tr as toPermissionId, Tt as matchesMoneyExecutionId, U as makeActorRelationshipMethods, Ui as isRecord, Un as roles, V as waitForPaymentSubmission, Vn as invitations, Wn as setups, Xr as runIfActive, Yr as defectAsCapxulError, Zn as decodeChainCause, Zr as toCapxulResult, _ as accountFromAccountPositions, _n as toPartyId, _r as toLowerBytes32, _t as ROLES_SET_ALLOWANCE_ABI, ar as ORG_BUDGET_ACTIONS, b as MONEY_READ_RATES, bt as ROLE_MANAGEMENT_SIGNATURES, cn as signerFailure, ct as resolveOrgPermissionIdentity, dr as deposits, dt as MULTI_SEND_SELECTOR, er as hashPermissionReplacementPreview, fi as attachInvocationObservation, fr as toAccountId, ft as OPERATOR, gr as toLowerAddress, gt as ROLES_EXEC_TRANSACTION_WITH_ROLE_ABI, hr as toExactHex, ht as ROLES_ASSIGN_ROLES_ABI, ir as MONTHLY_REFILL_PERIOD_SECONDS, it as canonicalJson, jr as toExactAssetAmount, jt as BASE_SEPOLIA_CHAIN_ID, kt as safe4337MultiSendUserOpCallData, lt as CREATE_COMMITMENT_SIGNATURE, mi as readInvocationObservation, mt as PARAMETER_TYPE, ni as carryInvocationParentSpan, nr as keepRefillOnChange, or as roleKeyForPermission, ot as moneySafeOpDigest, pi as copyInvocationObservation, pt as OWNER_COMMITMENT_SIGNATURES, qn as OrganizationSetupSchema, qr as withVerifiedOrganizationScope, ri as withInvocationParentSpan, rr as CurrentPolicySchema, st as ZODIAC_MODULE_PROXY_FACTORY, tr as decodePermissionIntent$1, ur as bankDetails, ut as MODULE_PROXY_FACTORY_ABI, v as accountPositionsFromWire, vr as toLowerHex, vt as ROLES_SET_TRANSACTION_UNWRAPPER_ABI, wr as toPermissionAssignmentId, wt as CAPXUL_PAYMENTS_V2_ADDRESS, xt as SAFE_ENABLE_MODULE_ABI, yt as ROLES_SET_UP_ABI, z as makeOrganizationPaymentsMethods, zi as CapxulError } from "./access-D5D77YLI.mjs";
+import { $n as copyInvocationObservation, $r as toAccountId, Ar as treasuries, At as safe4337ExecuteUserOpCallData, B as makeOrganizationPaymentsMethods, Br as InvitationViewSchema, Ci as toAddress, Cn as toPartyId, Ct as SAFE_ENABLE_MODULE_ABI, Di as reference, Dn as noSessionError, Dr as members, Dt as matchesMoneyExecutionId, Ei as absurd, Er as invitations, Et as CAPXUL_PAYMENTS_V2_ADDRESS, F as makeUnavailablePayrollMethods, Fn as awaitCapxulResult, Ft as SAFE_SENTINEL_OWNERS, Gr as MONTHLY_REFILL_PERIOD_SECONDS, H as waitForPaymentSubmission, Hn as withInvocationParentSpan, Hr as decodePermissionIntent$1, In as defectAsCapxulError, It as callOperation, Ji as toEmail, Jt as withCapturedAttemptContext, Kr as ORG_BUDGET_ACTIONS, Ln as runIfActive, Lt as CONFIGURED_MONEY_ASSETS, Mn as observationOnlyControls, Mr as OrganizationSetupSchema, Mt as buildSafeMultiSendExecTransactionCall, Nn as runCapxulEffect, Nt as BASE_SEPOLIA_CHAIN_ID, Or as roles, Ot as deriveCapxulSafeAddress, P as makePayrollMethods, Pn as withVerifiedOrganizationScope, Pt as MULTI_SEND_CALL_ONLY, Qn as attachInvocationObservation, Qr as deposits, Rn as toCapxulResult, Sr as PermissionCommandViewSchema, St as ROLE_MANAGEMENT_SIGNATURES, Tt as SEND_SIGNATURE, Ur as keepRefillOnChange, Vn as carryInvocationParentSpan, Vr as hashPermissionReplacementPreview, W as makeActorRelationshipMethods, Wr as CurrentPolicySchema, X as subscribeFreshQuery, Zi as Errors, Zr as bankDetails, _ as accountFromAccountPositions, _r as authorities, _t as ROLES_ASSIGN_ROLES_ABI, ai as toLowerHex, b as MONEY_READ_RATES, bi as toExactAssetAmount, br as replacements, bt as ROLES_SET_TRANSACTION_UNWRAPPER_ABI, ct as moneySafeOpDigest, dr as CAPXUL_OPERATIONS, dt as CREATE_COMMITMENT_SIGNATURE, er as markFailureOperation, fi as toBudgetId, ft as MODULE_PROXY_FACTORY_ABI, gt as PARAMETER_TYPE, hi as toRoleKey, ht as OWNER_COMMITMENT_SIGNATURES, ii as toLowerBytes32, jr as workspaces, jt as safe4337MultiSendUserOpCallData, k as retryIdempotentRead, kr as setups, lt as ZODIAC_MODULE_PROXY_FACTORY, mi as toPermissionId, mn as signerFailure, mt as OPERATOR, na as CapxulError, ni as toExactHex, oa as isRecord, ot as canonicalJson, pi as toPermissionAssignmentId, pt as MULTI_SEND_SELECTOR, qr as roleKeyForPermission, ra as isCapxulError, ri as toLowerAddress, rn as deserializeCapxulError, tr as readInvocationObservation, ut as resolveOrgPermissionIdentity, v as accountPositionsFromWire, vr as commands, vt as ROLES_EXEC_TRANSACTION_WITH_ROLE_ABI, wt as SEND_BATCH_SIGNATURE, xr as PreparedPermissionExecutionSchema, xt as ROLES_SET_UP_ABI, yr as configurations, yt as ROLES_SET_ALLOWANCE_ABI, z as annotateDepositInstructions, zr as toOrgId, zt as asCapxulError } from "./access-D6IJnZ7g.mjs";
 import { Context, Data, Effect, Result, Schema } from "effect";
 import { BaseError, decodeFunctionData, encodeAbiParameters, encodeFunctionData, formatUnits, getContractAddress, keccak256, padHex, parseAbiParameters, toBytes, toFunctionSelector, toHex } from "viem";
 var __commonJSMin = (cb, mod) => () => (mod || (cb((mod = { exports: {} }).exports, mod), cb = null), mod.exports);
@@ -102,8 +102,8 @@ const ORG_BUDGET_ALLOWANCE_NAMESPACE = "CAPXUL_ORG_BUDGET_ALLOWANCE_V1";
 function requireBigInt(value, field) {
 	try {
 		return BigInt(value);
-	} catch {
-		throw Errors.invalidInput(field, "must be an integer");
+	} catch (cause) {
+		throw Errors.invalidInput(field, "must be an integer", cause);
 	}
 }
 function requireAssetId(value) {
@@ -10934,7 +10934,7 @@ async function execute(deps, orgId, command, signal, controls, verifiedOrganizat
 	const session = deps.actor.authSession();
 	if (session === null) return {
 		ok: false,
-		error: Errors.notAuthenticated()
+		error: noSessionError(deps.actor)
 	};
 	let signerAddress;
 	try {
@@ -11023,7 +11023,7 @@ function subscribePermissionCommand(deps, orgId, requestKey, listener, options)
 			decode(raw);
 		},
 		invalidValue: (cause) => isCapxulError(cause) ? cause : Errors.invalidInput("command", "invalid Permission command projection"),
-		invalidScope: () => Errors.invalidInput("command", "Permission command subscription scope does not match"),
+		invalidScope: (cause) => Errors.invalidInput("command", "Permission command subscription scope does not match", cause),
 		lostValue: () => Errors.invalidInput("command", "Permission command is no longer readable"),
 		unavailable: () => Errors.notImplemented("permissions", "subscribeCommand")
 	}, options);
@@ -11089,7 +11089,7 @@ function makePermissionMethods(deps, orgId) {
 				if (!lookup.ok) return lookup;
 				if (session === null || session === void 0) return {
 					ok: false,
-					error: Errors.notAuthenticated()
+					error: noSessionError(deps.actor)
 				};
 				const sameActor = () => {
 					const current = deps.actor?.authSession();
@@ -11138,7 +11138,7 @@ function makePermissionMethods(deps, orgId) {
 				if (!lookup.ok) return lookup;
 				if (session === null || session === void 0 || lifetime === void 0) return {
 					ok: false,
-					error: Errors.notAuthenticated()
+					error: noSessionError(deps.actor)
 				};
 				const sameActor = () => {
 					const current = deps.actor?.authSession();
@@ -11192,29 +11192,6 @@ function makePermissionMethods(deps, orgId) {
 	};
 }
 //#endregion
-//#region ../protocol/src/errors/serialize.ts
-function deserializeCapxulError(serialized) {
-	const chain = serialized.chain === void 0 ? void 0 : decodeChainCause(serialized.chain) ?? void 0;
-	const cause = serialized.cause === void 0 ? void 0 : causeFromSummary(serialized.cause);
-	const options = {
-		...cause === void 0 ? {} : { cause },
-		...serialized.details === void 0 ? {} : { details: serialized.details },
-		...serialized.correlationId === void 0 ? {} : { correlationId: serialized.correlationId },
-		...serialized.layer === void 0 ? {} : { layer: serialized.layer },
-		...serialized.mode === void 0 ? {} : { mode: serialized.mode },
-		...chain === void 0 ? {} : { chain }
-	};
-	return new CapxulError(serialized.code, serialized.message, options);
-}
-/** Rebuild a summary as an `Error` chain, so every later hop reads `cause` the same way. */
-function causeFromSummary(links) {
-	return links.reduceRight((cause, link) => {
-		const error = cause === void 0 ? new Error(link.message) : new Error(link.message, { cause });
-		error.name = link.name;
-		return error;
-	}, void 0);
-}
-//#endregion
 //#region src/organizations/port.ts
 var OrgError = class extends Data.TaggedError("OrgError") {};
 function orgErrorFromCapxul(operation, error, cause = error) {
@@ -11479,7 +11456,8 @@ function subscribeInvitation(deps, orgId, input, listener, options) {
 		if (actor === void 0) return yield* Effect.fail(Errors.notImplemented("invitations", "subscribe"));
 		const lifetime = actor.authLifetime();
 		const current = () => actor.matchesAuthLifetime(lifetime, lifetime.authUserId);
-		if (lifetime.authUserId === null || !current()) return yield* Effect.fail(Errors.notAuthenticated());
+		if (lifetime.authUserId === null) return yield* Effect.fail(noSessionError(actor));
+		if (!current()) return yield* Effect.fail(Errors.notAuthenticated());
 		let active = true;
 		let connected;
 		let remoteStop;
@@ -11523,8 +11501,8 @@ function subscribeInvitation(deps, orgId, input, listener, options) {
 			let value;
 			try {
 				value = Schema.decodeSync(InvitationViewSchema)(snapshot.value);
-			} catch {
-				return fail(Errors.invalidInput("invitation", "Invalid invitation subscription value"));
+			} catch (cause) {
+				return fail(Errors.invalidInput("invitation", "Invalid invitation subscription value", cause));
 			}
 			if (value.orgId !== orgId || value.id !== invitationId) return fail(Errors.invalidInput("invitationId", "Invitation subscription scope does not match"));
 			notify({
@@ -11537,7 +11515,7 @@ function subscribeInvitation(deps, orgId, input, listener, options) {
 			const previous = connected;
 			connected = next;
 			if (next || previous !== true) return;
-			const error = Errors.networkError(operation, "connection unavailable", { provider: "convex" });
+			const error = Errors.networkError(operation, void 0, { provider: "convex" });
 			fail(error);
 		} }).pipe(Effect.mapError((error) => error.publicError), Effect.onError(() => Effect.sync(stop)));
 		if (!active) {
@@ -11780,7 +11758,7 @@ async function executeInvite(deps, orgId, input, signal, controls, verifiedOrgan
 	const session = deps.actor.authSession();
 	if (session === null) return {
 		ok: false,
-		error: Errors.notAuthenticated()
+		error: noSessionError(deps.actor)
 	};
 	const authored = await authorInvitation(deps, orgId, input, signal, controls);
 	if (!authored.ok) return authored;
@@ -12028,6 +12006,103 @@ const listOrgsProgram = Effect.gen(function* () {
 	};
 });
 //#endregion
+//#region src/organizations/setup-checks.ts
+/**
+* Check the prepare row's reply against the Organization and the signer. The
+* reply is what fails the check, so a failure names that row.
+*/
+function validatePrepared(prepared, orgId, signerAddress) {
+	const checked = checkPrepared(prepared, orgId, signerAddress);
+	if (!checked.ok) markFailureOperation(checked.error, setups.prepareAuthorization.name);
+	return checked;
+}
+function checkPrepared(prepared, orgId, signerAddress) {
+	const signer = signerAddress.toLowerCase();
+	if (prepared.orgId !== orgId || prepared.expectedSigner.toLowerCase() !== signer) return fail(Errors.invalidInput("authorization", "Prepared signer or Organization does not match"));
+	const founder = prepared.founderPersonalAccount.toLowerCase();
+	const organization = prepared.organizationAccountAddress.toLowerCase();
+	if (founder === signer || organization === signer || organization === founder || prepared.userOp.sender.toLowerCase() !== founder) return fail(Errors.invalidInput("organizationAuthority", "Prepared authorities do not match"));
+	if (!/^0x[0-9a-fA-F]{64}$/u.test(prepared.digest)) return fail(Errors.invalidInput("digest", "Prepared digest must be 32-byte hex"));
+	return {
+		ok: true,
+		value: void 0
+	};
+}
+async function signerResult(signer, operation, run) {
+	try {
+		return {
+			ok: true,
+			value: await run()
+		};
+	} catch (cause) {
+		return fail(signerFailure(signer.source, operation, cause));
+	}
+}
+function cancelled() {
+	return fail(Errors.cancelled({ operation: CAPXUL_OPERATIONS.organization.setup }));
+}
+async function abortable(pending, signal) {
+	if (signal === void 0) return pending;
+	if (signal.aborted) return cancelled();
+	let onAbort;
+	const interrupted = new Promise((resolve) => {
+		onAbort = () => resolve(cancelled());
+		signal.addEventListener("abort", onAbort, { once: true });
+		if (signal.aborted) onAbort();
+	});
+	try {
+		return await Promise.race([pending, interrupted]);
+	} finally {
+		signal.removeEventListener("abort", onAbort);
+	}
+}
+function fail(error) {
+	return {
+		ok: false,
+		error
+	};
+}
+/**
+* Run one `org(orgId).setup` method. Apart from `subscribe`, which the host
+* observer names `org.setup.subscribe`, its path is not an operation. A failure
+* that a row gave keeps the name of that row. Any other failure (a cancel, the
+* signer, a missing adapter, a thrown error) did not come from a row, so it
+* names `organization.setup`, the client side of the setup.
+*/
+async function invokeSetup(setup, method, call) {
+	let result;
+	try {
+		result = setup === void 0 ? fail(Errors.notImplemented("organizationSetup", method)) : await call();
+	} catch (cause) {
+		result = fail(Errors.unknown(cause));
+	}
+	if (!result.ok) markFailureOperation(result.error, CAPXUL_OPERATIONS.organization.setup);
+	return result;
+}
+/** The setup in the reply of one row, scoped to its Organization. A failure names that row. */
+function setupFromReply(row, orgId, value) {
+	const parsed = value === null ? fail(Errors.invalidInput("orgId", "Organization setup was not found")) : parseOrganizationSetup(value);
+	const scoped = parsed.ok ? validateOrganizationSetupScope(orgId, parsed.value) : parsed;
+	if (!scoped.ok) markFailureOperation(scoped.error, row.name);
+	return scoped;
+}
+/** One live setup value, parsed and scoped to the Organization it was read for. */
+function setupSnapshotFromValue(orgId, value) {
+	const scoped = setupFromReply(setups.get, orgId, value);
+	return scoped.ok ? {
+		status: "value",
+		value: scoped.value
+	} : {
+		status: "error",
+		error: scoped.error
+	};
+}
+/** The snapshot a live setup read reports when its connection drops after it connected. */
+const SETUP_CONNECTION_LOST = {
+	status: "error",
+	error: Errors.networkError(CAPXUL_OPERATIONS.organization.setup, void 0, { provider: "convex" })
+};
+//#endregion
 //#region src/organizations/scope-reads.ts
 /** `client.org(id)` reads: profile, treasury, account, members, roles and the audit log. */
 function makeOrgReadMethods(deps, orgId, shared) {
@@ -12363,20 +12438,6 @@ function relationshipExecutionDeps(deps) {
 		...deps.telemetry === void 0 ? {} : { telemetry: deps.telemetry }
 	};
 }
-async function invokeSetup(setup, method, call) {
-	if (setup === void 0) return {
-		ok: false,
-		error: Errors.notImplemented("organizationSetup", method)
-	};
-	try {
-		return await call();
-	} catch (cause) {
-		return {
-			ok: false,
-			error: Errors.unknown(cause)
-		};
-	}
-}
 function makeOrgMethods(deps) {
 	const orgDeps = {
 		runPromise: deps.runPromise,
@@ -12467,71 +12528,6 @@ function makeOrgMethods(deps) {
 	};
 }
 //#endregion
-//#region src/organizations/setup-checks.ts
-function validatePrepared(prepared, orgId, signerAddress) {
-	const signer = signerAddress.toLowerCase();
-	if (prepared.orgId !== orgId || prepared.expectedSigner.toLowerCase() !== signer) return fail(Errors.invalidInput("authorization", "Prepared signer or Organization does not match"));
-	const founder = prepared.founderPersonalAccount.toLowerCase();
-	const organization = prepared.organizationAccountAddress.toLowerCase();
-	if (founder === signer || organization === signer || organization === founder || prepared.userOp.sender.toLowerCase() !== founder) return fail(Errors.invalidInput("organizationAuthority", "Prepared authorities do not match"));
-	if (!/^0x[0-9a-fA-F]{64}$/u.test(prepared.digest)) return fail(Errors.invalidInput("digest", "Prepared digest must be 32-byte hex"));
-	return {
-		ok: true,
-		value: void 0
-	};
-}
-async function signerResult(signer, operation, run) {
-	try {
-		return {
-			ok: true,
-			value: await run()
-		};
-	} catch (cause) {
-		return fail(signerFailure(signer.source, operation, cause));
-	}
-}
-function cancelled() {
-	return fail(Errors.cancelled({ operation: CAPXUL_OPERATIONS.organization.setup }));
-}
-async function abortable(pending, signal) {
-	if (signal === void 0) return pending;
-	if (signal.aborted) return cancelled();
-	let onAbort;
-	const interrupted = new Promise((resolve) => {
-		onAbort = () => resolve(cancelled());
-		signal.addEventListener("abort", onAbort, { once: true });
-		if (signal.aborted) onAbort();
-	});
-	try {
-		return await Promise.race([pending, interrupted]);
-	} finally {
-		signal.removeEventListener("abort", onAbort);
-	}
-}
-function fail(error) {
-	return {
-		ok: false,
-		error
-	};
-}
-/** One live setup value, parsed and scoped to the Organization it was read for. */
-function setupSnapshotFromValue(orgId, value) {
-	const parsed = value === null ? fail(Errors.invalidInput("orgId", "Organization setup was not found")) : parseOrganizationSetup(value);
-	const scoped = parsed.ok ? validateOrganizationSetupScope(orgId, parsed.value) : parsed;
-	return scoped.ok ? {
-		status: "value",
-		value: scoped.value
-	} : {
-		status: "error",
-		error: scoped.error
-	};
-}
-/** The snapshot a live setup read reports when its connection drops after it connected. */
-const SETUP_CONNECTION_LOST = {
-	status: "error",
-	error: Errors.networkError(CAPXUL_OPERATIONS.organization.setup, "connection unavailable", { provider: "convex" })
-};
-//#endregion
 //#region src/organizations/setup-adapter.ts
 /** Convex transport for one backend-owned Organization setup. */
 var ConvexOrganizationSetupAdapter = class {
@@ -12548,7 +12544,7 @@ var ConvexOrganizationSetupAdapter = class {
 		this.#runPromise = input.runPromise ?? Effect.runPromise;
 	}
 	async begin(input) {
-		const result = await this.#call("begin", callOperation(this.#convex, setups.begin, copyInvocationObservation(input, {
+		const result = await this.#call(setups.begin, callOperation(this.#convex, setups.begin, copyInvocationObservation(input, {
 			...input,
 			chainId: this.#chainId
 		})));
@@ -12571,17 +12567,14 @@ var ConvexOrganizationSetupAdapter = class {
 	}
 	async get(orgId, options) {
 		if (options?.signal?.aborted) return cancelled();
-		const result = await this.#call("get", callOperation(this.#convex, setups.get, { orgId }));
-		if (!result.ok) return result;
-		if (result.value === null) return fail(Errors.invalidInput("orgId", "Organization setup was not found"));
-		const parsed = parseOrganizationSetup(result.value);
-		return parsed.ok ? validateOrganizationSetupScope(orgId, parsed.value) : parsed;
+		const result = await this.#call(setups.get, callOperation(this.#convex, setups.get, { orgId }));
+		return result.ok ? setupFromReply(setups.get, orgId, result.value) : result;
 	}
 	async listMine(input = {}, options) {
 		if (options?.signal?.aborted) return cancelled();
 		if (input.cursor !== void 0 && typeof input.cursor !== "string" || input.limit !== void 0 && (!Number.isSafeInteger(input.limit) || input.limit < 1 || input.limit > 50)) return fail(Errors.invalidInput("organizationSetupPage", "Invalid cursor or limit"));
 		const generation = this.#generation;
-		const result = await abortable(this.#call("listMine", callOperation(this.#convex, setups.listMine, input)), options?.signal);
+		const result = await abortable(this.#call(setups.listMine, callOperation(this.#convex, setups.listMine, input)), options?.signal);
 		if (generation !== this.#generation || options?.signal?.aborted) return cancelled();
 		if (!result.ok) return result;
 		const items = [];
@@ -12600,10 +12593,8 @@ var ConvexOrganizationSetupAdapter = class {
 	}
 	async resume(orgId, options) {
 		if (options?.signal?.aborted) return cancelled();
-		const result = await this.#call("resume", callOperation(this.#convex, setups.resume, { orgId }));
-		if (!result.ok) return result;
-		const parsed = parseOrganizationSetup(result.value);
-		return parsed.ok ? validateOrganizationSetupScope(orgId, parsed.value) : parsed;
+		const result = await this.#call(setups.resume, callOperation(this.#convex, setups.resume, { orgId }));
+		return result.ok ? setupFromReply(setups.resume, orgId, result.value) : result;
 	}
 	async authorize(orgId, options) {
 		if (options?.signal?.aborted) return cancelled();
@@ -12614,7 +12605,7 @@ var ConvexOrganizationSetupAdapter = class {
 		if (signer === null) return fail(Errors.capabilityUnavailable("signer", "authorize"));
 		const address = await signerResult(signer, "getAddress", () => signer.getAddress());
 		if (!address.ok) return address;
-		const prepared = await this.#call("prepareAuthorization", callOperation(this.#convex, setups.prepareAuthorization, { orgId }));
+		const prepared = await this.#call(setups.prepareAuthorization, callOperation(this.#convex, setups.prepareAuthorization, { orgId }));
 		if (!prepared.ok) return prepared;
 		const authority = validatePrepared(prepared.value, orgId, address.value);
 		if (!authority.ok) return authority;
@@ -12623,7 +12614,7 @@ var ConvexOrganizationSetupAdapter = class {
 		const signature = await signerResult(signer, "signUserOpHash", () => signer.signUserOpHash(digest));
 		if (!signature.ok) return signature;
 		if (options?.signal?.aborted) return cancelled();
-		const submitted = await this.#call("submitAuthorization", callOperation(this.#convex, setups.submitAuthorization, {
+		const submitted = await this.#call(setups.submitAuthorization, callOperation(this.#convex, setups.submitAuthorization, {
 			orgId,
 			preparationId: prepared.value.preparationId,
 			userOp: prepared.value.userOp,
@@ -12633,8 +12624,7 @@ var ConvexOrganizationSetupAdapter = class {
 			const acceptedSetup = await this.get(orgId);
 			return acceptedSetup.ok && acceptedSetup.value.status !== "awaitingAuthorization" ? acceptedSetup : submitted;
 		}
-		const parsed = parseOrganizationSetup(submitted.value);
-		return parsed.ok ? validateOrganizationSetupScope(orgId, parsed.value) : parsed;
+		return setupFromReply(setups.submitAuthorization, orgId, submitted.value);
 	}
 	async subscribe(orgId, listener, options) {
 		if (options?.signal?.aborted) return cancelled();
@@ -12655,7 +12645,7 @@ var ConvexOrganizationSetupAdapter = class {
 		};
 		options?.signal?.addEventListener("abort", stop, { once: true });
 		this.#subscriptions.add(stop);
-		const result = await this.#call("subscribe", this.#convex.subscribe(reference(setups.get), { orgId }, (snapshot) => {
+		const result = await this.#call(setups.get, this.#convex.subscribe(reference(setups.get), { orgId }, (snapshot) => {
 			if (!active) return;
 			if (snapshot.status === "error") return notify({
 				status: "error",
@@ -12690,8 +12680,9 @@ var ConvexOrganizationSetupAdapter = class {
 		this.#generation += 1;
 		for (const stop of this.#subscriptions) stop();
 	}
-	async #call(_operation, effect) {
+	async #call(row, effect) {
 		const result = await this.#runPromise(Effect.result(effect.pipe(Effect.mapError((error) => "publicError" in error ? error.publicError : error), Effect.catchDefect((defect) => Effect.fail(defectAsCapxulError(defect))))));
+		if (Result.isFailure(result)) markFailureOperation(result.failure, row.name);
 		return Result.isSuccess(result) ? {
 			ok: true,
 			value: result.success
@@ -12699,4 +12690,4 @@ var ConvexOrganizationSetupAdapter = class {
 	}
 };
 //#endregion
-export { prepareConfiguration as a, OrgPortTag as c, preparedIdentity as d, verifiedPreparation as f, validateReplacementInput as h, authorInvitation as i, deserializeCapxulError as l, decodePermissionIntent as m, makeOrgMethods as n, verifiedConfiguration as o, buildCommand as p, makeBankingMethods as r, ConvexOrganizationAdapter as s, ConvexOrganizationSetupAdapter as t, preparePermission as u };
+export { prepareConfiguration as a, OrgPortTag as c, verifiedPreparation as d, buildCommand as f, authorInvitation as i, preparePermission as l, validateReplacementInput as m, makeOrgMethods as n, verifiedConfiguration as o, decodePermissionIntent as p, makeBankingMethods as r, ConvexOrganizationAdapter as s, ConvexOrganizationSetupAdapter as t, preparedIdentity as u };

package/dist/{permission-approvals-B2LrXyRx.mjs → permission-approvals-BgLgturM.mjs}

@@ -1,5 +1,5 @@
-import { a as prepareConfiguration, d as preparedIdentity, f as verifiedPreparation, h as validateReplacementInput, i as authorInvitation, o as verifiedConfiguration, p as buildCommand, u as preparePermission } from "./organizations-BKiw2PjB.mjs";
-import { En as CAPXUL_OPERATIONS, Lr as absurd, Lt as asCapxulError, Ri as Errors, Y as abandonPrepared, zi as CapxulError } from "./access-D5D77YLI.mjs";
+import { a as prepareConfiguration, d as verifiedPreparation, f as buildCommand, i as authorInvitation, l as preparePermission, m as validateReplacementInput, o as verifiedConfiguration, u as preparedIdentity } from "./organizations-oVQI9Tag.mjs";
+import { Dn as noSessionError, Ei as absurd, Z as abandonPrepared, dr as CAPXUL_OPERATIONS, na as CapxulError, zt as asCapxulError } from "./access-D6IJnZ7g.mjs";
 //#region src/accounts/permission-approvals.ts
 /** Prepare a Permission write or an invitation's configuration for `signerAddress`, checked. */
 function prepareVerifiedPermissionChange(deps, input, signerAddress, signal) {
@@ -66,7 +66,7 @@ async function prepareVerifiedPermissionWrite(deps, input, signerAddress, signal
 	const session = deps.actor?.authSession() ?? null;
 	if (session === null || deps.chainId === void 0) return {
 		ok: false,
-		error: Errors.notAuthenticated()
+		error: noSessionError(deps.actor)
 	};
 	const built = command(input.permission);
 	if (!built.ok) return built;
@@ -97,7 +97,7 @@ async function prepareVerifiedInvitation(deps, input, signerAddress, signal) {
 	const session = deps.actor?.authSession() ?? null;
 	if (session === null || deps.chainId === void 0) return {
 		ok: false,
-		error: Errors.notAuthenticated()
+		error: noSessionError(deps.actor)
 	};
 	const orgId = input.organizationId;
 	const authored = await authorInvitation(deps, orgId, input.invite, signal, void 0);