@capxul/sdk 4.20.0-beta.5 → 4.20.0-beta.7

package/README.md

@@ -19,51 +19,44 @@ const client = created.value;
 Every public operation resolves a `Promise<CapxulResult<T>>`. Domain failures
 are values, not thrown exceptions.
 
-## Money input and display
+## Asset amount input and display
 
-Use the public money helpers at form and display boundaries. They do not
-convert a money value to a JavaScript number.
+Use the asset helpers at Payment form and display boundaries. They keep the
+exact AssetId and do not convert a value to a JavaScript number.
 
 ```ts
-import { formatMoney, parseMoney } from "@capxul/sdk";
+import { formatAssetAmount, parseAssetAmount, requireAsset, TOKENS } from "@capxul/sdk";
 
-const amount = parseMoney("1,000.25", {
-  currency: account.available.currency,
-  decimals: account.available.decimals,
-});
+const amount = parseAssetAmount("1,000.25", requireAsset(TOKENS.BASE_SEPOLIA.CAPXUL_TEST_USDC));
 
 if ("kind" in amount) {
   console.error(amount.reason); // closed code — the app owns the sentence (ADR-0023)
 } else {
-  console.log(formatMoney(amount)); // $1,000.25
-  console.log(formatMoney(amount, { grammar: "code" })); // 1,000.25 USD
+  console.log(formatAssetAmount(amount)); // 1,000.25 USDC
 }
 ```
 
-`parseMoney` returns validation errors as values. `formatMoney` rejects a
-malformed `Money` record with `INVALID_INPUT`.
+`parseAssetAmount` returns validation errors as values. Payment, request,
+Budget, Payroll, and activity amounts require AssetAmount. Fiat Money remains
+separate valuation data.
 
-## The asset a screen shows
+## Value all asset positions
 
-`holdings.primary` picks the one asset a hero balance or a summary total
-should show. It returns the renderable holding with the largest available
-balance. A chain row that carries no `decimals`, no `symbol`, or a symbol that
-stands for no supported currency is skipped, because it cannot be rendered.
+Use `holdings.current` for raw positions. Use `valueIn` to value exact asset
+quantities in a display currency. A token symbol does not identify an asset.
+Quantities from different assets cannot be compared as a headline balance.
 
 ```ts
-import { formatMoney, type Holding } from "@capxul/sdk";
-
-const result = await client.holdings.primary();
+import { formatMoney, valueIn } from "@capxul/sdk";
 
-if (result.ok && result.value !== null) {
-  const holding: Holding = result.value;
-  console.log(holding.symbol); // "USDX" — the token symbol the chain reported
-  console.log(formatMoney(holding.available, { grammar: "code" })); // e.g. "1,250.50 USD"
+const valuation = valueIn(amounts, displayCurrency, rates);
+if (valuation.total !== null) {
+  console.log(formatMoney(valuation.total));
 }
 ```
 
-`null` means no row is renderable. It is a value, not an error, so give the
-screen its own rule for showing nothing.
+Keep `valuation.unrated` visible beside the known subtotal. A missing rate
+does not mean a zero balance.
 
 ## Observability
 
@@ -105,6 +98,11 @@ The backend remains the authority for reserved names and global uniqueness.
 The method returns only after the client requirement reaches a ready Account.
 The React frontend does not use this journey yet.
 
+A Node host that keeps login outside the browser can pass `openfortSignerFactory`.
+The factory receives only the validated Openfort and auth bootstrap fields. Its
+browser page can use `createOpenfortBrowserSigner` with host-owned access-token
+and encryption-session callbacks. It does not need a second login or private SDK import.
+
 ## Published entry points
 
 The packed npm package exposes only:
@@ -173,3 +171,36 @@ operator secrets and prove only the path named by the command. See
 The browser production path owns its Openfort signer when no signer is supplied.
 Current integration recovery evidence and its published-package boundary are
 tracked in the [#870 receipt](../../docs/receipts/issue-870-openfort-signer-recovery-RECEIPT-2026-07-19.md).
+
+### Node session storage
+
+A Node host can pass `nodeSessionStorage: { load, save }` to
+`createCapxulClient`. Both methods return promises. `load` returns an opaque
+BetterAuth credential or `null`; `save` receives the credential or `null` on
+logout. Store it with owner-only access and isolate it by application and
+environment. Do not print it or use a cached `AuthSession` as backend authority.
+The SDK validates the credential and expiry with BetterAuth on process restart.
+With durable storage, each adapter serializes session reads, OTP verification,
+sign-out, and Convex token reads. A delayed response cannot clear or rotate a
+credential from a later operation on that adapter. Cancellation while queued
+returns immediately and prevents that operation from reaching the provider.
+Hosts that share storage across clients or processes must fence writes, for
+example with an atomic compare-and-set; the adapter cannot order other clients.
+
+For separate OTP request and verification processes, retain the email and
+original request timestamp. After `auth.getSession()` confirms signed-out state,
+call `auth.resumeOtp({ email, requestedAt })`, then `auth.verifyOtp({ email,
+code })`. Resume restores pending input only. It does not send another OTP or
+authenticate the caller. Keep OTP values out of arguments, logs, and stored data.
+
+### Existing financial documents
+
+Use `paymentDocuments.verify({ documentHash, contentHash })` to verify stored
+content. Use `paymentDocuments.render` with the same pair for safe semantic HTML.
+Call `paymentDocuments.get` only for a deliberate download. Its `bytesBase64`
+contains the exact stored bytes. Do not log document results or error payloads.
+Get references from Payment or Movement activity detail. References include
+kind, format, and role. A hash is not permission to read a document.
+Reads check current Payment participants or current Movement actor access.
+Missing and unauthorized pairs return the same refusal. These methods do not
+create documents or add Payment links.

package/dist/{OAuthBearerAuthClient-BAxoi3SD.d.mts → OAuthBearerAuthClient-DOPDDSPs.d.mts}

@@ -254,6 +254,7 @@ declare const Errors: {
     readonly method: string;
     readonly currentState: string;
     readonly validStates: readonly string[];
+    readonly organizationId?: string;
   }) => CapxulError;
 };
 //#endregion
@@ -311,9 +312,9 @@ type Money = {
 type Account$1 = {
   readonly id: AccountId;
   readonly balances: readonly AccountPosition[];
-  /** Fiat valuation of `balances`. Never a token quantity. */
-  readonly balance: Money;
-  readonly available: Money;
+  /** Fiat valuation of `balances`. `null` means at least one position has no rate. */
+  readonly balance: Money | null;
+  readonly available: Money | null;
 };
 /**
  * One asset position on an Account. `asset` is the identity; `symbol` and
@@ -391,8 +392,12 @@ declare const SUPPORTED_CURRENCIES: readonly [{
 }];
 type SupportedCurrencyCode = (typeof SUPPORTED_CURRENCIES)[number]["code"];
 declare function toAddress(raw: unknown): Address$1;
+declare function toAccountId(raw: unknown): AccountId;
 declare function toPartyId(raw: unknown): PartyId;
 declare function toHandle(raw: unknown): Handle;
+declare function toPermissionId(raw: unknown): PermissionId;
+declare function toBudgetId(raw: unknown): BudgetId;
+declare function toOrgId(raw: unknown): OrgId;
 declare function toCountryCode(raw: unknown): CountryCode;
 //#endregion
 //#region ../config/src/capxul-payments-v2.d.ts
@@ -642,4 +647,4 @@ interface OAuthBearerAuthClientInput {
  */
 declare function oauthBearerAuthClient(input: OAuthBearerAuthClientInput): AuthClientPort;
 //#endregion
-export { OrgId as $, Address$1 as A, RevertSummary as At, BudgetId as B, AuthCachePort as C, Failure as Ct, Account$1 as D, ChainUpstream as Dt, CAPXUL_PAYMENTS_V2_ADDRESS as E, ChainCause as Et, AssetAmount as F, CurrencyCode as G, ClientGrantId as H, AssetId as I, EVM_ADDRESS_RE as J, DocumentHash as K, AuthSession as L, AllowedOrigin as M, AnonymousDistinctId as N, AccountId as O, FAILURE_MODES as Ot, AppId as P, Money as Q, AuthUserId as R, AuthCacheError as S, Errors as St, CachedJwt as T, CHAIN_UPSTREAMS as Tt, ClientRequestId as U, ChainId as V, CountryCode as W, EpochMs as X, Email as Y, Handle as Z, Session as _, toPartyId as _t, Eip1193RequestProvider as a, PermissionId as at, AuthClientPort as b, CapxulErrorCode as bt, injectedWalletSigner as c, RoleKey as ct, AccountRequirement as d, TesterKind as dt, PartyId as et, Eip1193Provider as f, TxHash as ft, Profile as g, toHandle as gt, CapxulResult as h, toCountryCode as ht, CapxulSigner as i, PermissionAssignmentId as it, AllowanceKey as j, AccountPosition as k, FailureMode as kt, AccountProvider as l, SessionToken as lt, localPrivateKeyAccountProvider as m, toAddress as mt, oauthBearerAuthClient as n, PayrollGroupId as nt, SignerStatus as o, Profile$1 as ot, eip1193AccountProvider as p, WeiAmount as pt, DurationMs as q, CapxulDigestSigner as r, PayrollRunId as rt, SignerStatusStore as s, PublishableKey as st, OAuthBearerAuthClientInput as t, PaymentCommandId as tt, AccountProviderSource as u, SmartAccount$1 as ut, SmartAccount as v, CAPXUL_ERROR_CODES as vt, AuthCachePortTag as w, isCapxulError as wt, CanSendOtpStatus as x, CapxulErrorDetails as xt, ClockPort as y, CapxulError as yt, BlockNumber as z };
+export { OrgId as $, Address$1 as A, ChainCause as At, BudgetId as B, AuthCachePort as C, CapxulError as Ct, Account$1 as D, Failure as Dt, CAPXUL_PAYMENTS_V2_ADDRESS as E, Errors as Et, AssetAmount as F, CurrencyCode as G, ClientGrantId as H, AssetId as I, EVM_ADDRESS_RE as J, DocumentHash as K, AuthSession as L, AllowedOrigin as M, FAILURE_MODES as Mt, AnonymousDistinctId as N, FailureMode as Nt, AccountId as O, isCapxulError as Ot, AppId as P, RevertSummary as Pt, Money as Q, AuthUserId as R, AuthCacheError as S, CAPXUL_ERROR_CODES as St, CachedJwt as T, CapxulErrorDetails as Tt, ClientRequestId as U, ChainId as V, CountryCode as W, EpochMs as X, Email as Y, Handle as Z, Session as _, toCountryCode as _t, Eip1193RequestProvider as a, PermissionId as at, AuthClientPort as b, toPartyId as bt, injectedWalletSigner as c, RoleKey as ct, AccountRequirement as d, TesterKind as dt, PartyId as et, Eip1193Provider as f, TxHash as ft, Profile as g, toBudgetId as gt, CapxulResult as h, toAddress as ht, CapxulSigner as i, PermissionAssignmentId as it, AllowanceKey as j, ChainUpstream as jt, AccountPosition as k, CHAIN_UPSTREAMS as kt, AccountProvider as l, SessionToken as lt, localPrivateKeyAccountProvider as m, toAccountId as mt, oauthBearerAuthClient as n, PayrollGroupId as nt, SignerStatus as o, Profile$1 as ot, eip1193AccountProvider as p, WeiAmount as pt, DurationMs as q, CapxulDigestSigner as r, PayrollRunId as rt, SignerStatusStore as s, PublishableKey as st, OAuthBearerAuthClientInput as t, PaymentCommandId as tt, AccountProviderSource as u, SmartAccount$1 as ut, SmartAccount as v, toHandle as vt, AuthCachePortTag as w, CapxulErrorCode as wt, CanSendOtpStatus as x, toPermissionId as xt, ClockPort as y, toOrgId as yt, BlockNumber as z };

package/dist/{OAuthBearerAuthClient-BqQz-bnO.mjs → OAuthBearerAuthClient-DdKYPHE0.mjs}

@@ -1,4 +1,4 @@
-import { concat, encodeAbiParameters, encodeFunctionData, encodePacked, getContractAddress, keccak256, padHex, stringToHex, toBytes, toEventSelector, toFunctionSelector, toFunctionSignature } from "viem";
+import { concat, encodeAbiParameters, encodeFunctionData, encodePacked, getContractAddress, keccak256, padHex, toBytes, toEventSelector, toFunctionSelector, toFunctionSignature } from "viem";
 import { Context, Data, Effect, Layer, Result } from "effect";
 //#region ../errors/src/secret-material.ts
 const CREDENTIAL_FIELDS = /* @__PURE__ */ new Set([
@@ -807,8 +807,10 @@ const Errors = {
 	* enumerates the states the method accepts.
 	*/
 	wrongState: (details) => new CapxulError("WRONG_STATE", `${details.method} called from state '${details.currentState}'; valid states: ${details.validStates.join(", ")}`, { details: {
-		...details,
-		validStates: [...details.validStates]
+		method: details.method,
+		currentState: details.currentState,
+		validStates: [...details.validStates],
+		...details.organizationId === void 0 ? {} : { organizationId: details.organizationId }
 	} })
 };
 //#endregion
@@ -941,6 +943,12 @@ function toHandle(raw) {
 	if (typeof raw !== "string" || !HANDLE_RE.test(raw)) throw Errors.invalidInput("handle", invalidValueReason("must be 3-30 characters of a-z, 0-9, underscore, or hyphen", raw));
 	return raw;
 }
+function toPermissionId(raw) {
+	return toNonEmptyStringBrand(raw, "permissionId");
+}
+function toPermissionAssignmentId(raw) {
+	return toNonEmptyStringBrand(raw, "permissionAssignmentId");
+}
 function toBudgetId(raw) {
 	return toNonEmptyStringBrand(raw, "budgetId");
 }
@@ -1061,33 +1069,11 @@ function invalidValueReason(prefix, raw) {
 }
 //#endregion
 //#region ../config/src/tokens.ts
-/** `TestUSDC` ("USDX") — Base Sepolia, 6 decimals, open `mint`. (Canon §1.) */
-const USDX_ADDRESS_BASE_SEPOLIA = "0xf09fcbb6df9f8f918e58f9c8ab15a76ade862b77";
-const USDX_DEPLOYMENT_START_BLOCK = 39860173;
-/**
-* The ERC-20 `symbol()` the deployed `TestUSDC` contract returns
-* (`packages/contracts/src/TestUSDC.sol:10`). It travels with the address and
-* the decimals so a holdings row can never carry one token's address with
-* another token's display symbol. This is the display symbol, not the
-* currency: see `USDX_CURRENCY` below.
-*/
-const USDX_SYMBOL = "USDX";
 const SYNTHETIC_TEST_ASSET_SOURCE = "synthetic-test-liquidity";
-const USDX_ASSET = {
-	assetId: assetIdFor(84532, USDX_ADDRESS_BASE_SEPOLIA),
-	chainId: toChainId(84532),
-	symbol: USDX_SYMBOL,
-	peg: toCurrencyCode("USD"),
-	tokenAddress: USDX_ADDRESS_BASE_SEPOLIA,
-	deploymentStartBlock: USDX_DEPLOYMENT_START_BLOCK,
-	decimals: 6,
-	source: "legacy"
-};
-({ ...USDX_ASSET }), USDX_ASSET.peg;
 /**
 * The candidate tier: five owned test assets, every field read back from Base
-* Sepolia after the deployment that created it (chain 84532, blocks
-* 46,465,978–46,465,982). Real contracts, authored liquidity, no settlement
+* Sepolia after the deployment that created it (chain 84532, block
+* 46,690,061). Real contracts, authored liquidity, no settlement
 * admission — so rollback is removing consumers, never relabelling a
 * deployed address or deleting its history.
 *
@@ -1096,84 +1082,95 @@ const USDX_ASSET = {
 * address returning the same symbol, which is why the resolvers below key on
 * `assetId`, or on chain plus address, and never on a symbol.
 */
-const SYNTHETIC_TEST_ASSETS = [
-	{
-		assetId: assetIdFor(84532, "0xb3d8566fb90f7df939f4bc08a09b19047117f549"),
+const SYNTHETIC_TEST_ASSET_FIXTURES = {
+	usdc: {
+		assetId: assetIdFor(84532, "0x06ba8b863ca77490b0e7008427562bdbfcff730e"),
 		chainId: toChainId(84532),
-		tokenAddress: "0xb3d8566fb90f7df939f4bc08a09b19047117f549",
+		tokenAddress: "0x06ba8b863ca77490b0e7008427562bdbfcff730e",
 		symbol: "USDC",
 		decimals: 6,
 		peg: toCurrencyCode("USD"),
-		deploymentStartBlock: 46465978,
-		deploymentTransaction: "0xa7fb8bb9d1fd1cc5fe2fc42fa4cdccace7742efae8ea99f091a283e5709343de",
+		deploymentStartBlock: 46690061,
+		deploymentTransaction: "0x2661b7af5f62b9e31c707a59746cda65b90ba4448852317ac1968162fb94ff52",
 		source: SYNTHETIC_TEST_ASSET_SOURCE
 	},
-	{
-		assetId: assetIdFor(84532, "0x7ddcfb6aaffb9908c4c2db308b784c269eec8a01"),
+	usdt: {
+		assetId: assetIdFor(84532, "0xcb5f361ae070e75d573941b8cd54995fa3876d75"),
 		chainId: toChainId(84532),
-		tokenAddress: "0x7ddcfb6aaffb9908c4c2db308b784c269eec8a01",
+		tokenAddress: "0xcb5f361ae070e75d573941b8cd54995fa3876d75",
 		symbol: "USDT",
 		decimals: 6,
 		peg: toCurrencyCode("USD"),
-		deploymentStartBlock: 46465979,
-		deploymentTransaction: "0xa17ad76fe8b24cdf1fbcff245c3eb022444710cf9fa7b5ee59818be654f4ae10",
+		deploymentStartBlock: 46690061,
+		deploymentTransaction: "0x98e5303f97974a31eddb61ad030072d900ce7283ce8080bfe0b9e5ea6f297749",
 		source: SYNTHETIC_TEST_ASSET_SOURCE
 	},
-	{
-		assetId: assetIdFor(84532, "0x1d93d525f73453fe18eebf044e8a3954bfe3721e"),
+	weth: {
+		assetId: assetIdFor(84532, "0x85b7bd39ce3df9a85135e1e307225dd435f67e47"),
 		chainId: toChainId(84532),
-		tokenAddress: "0x1d93d525f73453fe18eebf044e8a3954bfe3721e",
+		tokenAddress: "0x85b7bd39ce3df9a85135e1e307225dd435f67e47",
 		symbol: "WETH",
 		decimals: 18,
 		peg: null,
-		deploymentStartBlock: 46465980,
-		deploymentTransaction: "0xcb9b2d024686fac93ec1243ccf02d3567fd531da46176115660cba2ba644b09d",
+		deploymentStartBlock: 46690061,
+		deploymentTransaction: "0x48dfacc01c15adc34f6c629aec5c9ff7bb84176d448017da0d0d4fdaf8b5a68a",
 		source: SYNTHETIC_TEST_ASSET_SOURCE
 	},
-	{
-		assetId: assetIdFor(84532, "0x8fe52c70aa9f7b6d74d8bb26eca33d87413cb624"),
+	wbtc: {
+		assetId: assetIdFor(84532, "0xcf433a81f507dcc88c2c404650ffafb40750b451"),
 		chainId: toChainId(84532),
-		tokenAddress: "0x8fe52c70aa9f7b6d74d8bb26eca33d87413cb624",
+		tokenAddress: "0xcf433a81f507dcc88c2c404650ffafb40750b451",
 		symbol: "WBTC",
 		decimals: 8,
 		peg: null,
-		deploymentStartBlock: 46465981,
-		deploymentTransaction: "0x728ba7b430ffd141f83d0ed5ce429d050049d7b097c936fd11e9c572d1243854",
+		deploymentStartBlock: 46690061,
+		deploymentTransaction: "0xa975fcda0a67509742243bbfc386032d2e0d6ca78404c255fae2e4ffae1c7f4d",
 		source: SYNTHETIC_TEST_ASSET_SOURCE
 	},
-	{
-		assetId: assetIdFor(84532, "0x5865fe9787ac214feb5facaebaec06969ac0a9a3"),
+	cngn: {
+		assetId: assetIdFor(84532, "0xda515a7267e190710f0003f951c62bcfd70d6b2a"),
 		chainId: toChainId(84532),
-		tokenAddress: "0x5865fe9787ac214feb5facaebaec06969ac0a9a3",
+		tokenAddress: "0xda515a7267e190710f0003f951c62bcfd70d6b2a",
 		symbol: "cNGN",
 		decimals: 6,
 		peg: toCurrencyCode("NGN"),
-		deploymentStartBlock: 46465982,
-		deploymentTransaction: "0xcedf254bcef57fc64189261a5ab1161bc4fde370e470933f627c4d8ddb5a2e26",
+		deploymentStartBlock: 46690061,
+		deploymentTransaction: "0x6f6b0302448c7cd7db5c118a8250e548c6e72821df373e5a27550e5cdfa635a1",
 		source: SYNTHETIC_TEST_ASSET_SOURCE
 	}
+};
+const SYNTHETIC_TEST_ASSETS = [
+	SYNTHETIC_TEST_ASSET_FIXTURES.usdc,
+	SYNTHETIC_TEST_ASSET_FIXTURES.usdt,
+	SYNTHETIC_TEST_ASSET_FIXTURES.weth,
+	SYNTHETIC_TEST_ASSET_FIXTURES.wbtc,
+	SYNTHETIC_TEST_ASSET_FIXTURES.cngn
 ];
 toChainId(84532);
 /**
 * The settlement tier: the owned test assets admitted to the exact-transfer
-* path and to the treasury reads. USDC, USDT and WETH are equal assets. There
-* is no default token and no successor to USDX; USDX survives only in
-* `LEGACY_MONEY_ASSETS` and is not a current treasury row.
+* path and to the treasury reads. USDC, USDT and WETH are equal assets.
+* There is no default token.
 */
-const SETTLEMENT_ASSET_SYMBOLS = [
-	"USDC",
-	"USDT",
-	"WETH"
-];
-const CONFIGURED_MONEY_ASSETS = SYNTHETIC_TEST_ASSETS.filter((asset) => SETTLEMENT_ASSET_SYMBOLS.includes(asset.symbol));
+const SETTLEMENT_ASSETS_BASE_SEPOLIA = Object.freeze({
+	CAPXUL_TEST_USDC: SYNTHETIC_TEST_ASSET_FIXTURES.usdc,
+	CAPXUL_TEST_USDT: SYNTHETIC_TEST_ASSET_FIXTURES.usdt,
+	CAPXUL_TEST_WETH: SYNTHETIC_TEST_ASSET_FIXTURES.weth
+});
+const CONFIGURED_MONEY_ASSETS = Object.freeze(Object.values(SETTLEMENT_ASSETS_BASE_SEPOLIA));
+/** Public AssetIds for the admitted Base Sepolia test assets. */
+const TOKENS = Object.freeze({ BASE_SEPOLIA: Object.freeze({
+	CAPXUL_TEST_USDC: SETTLEMENT_ASSETS_BASE_SEPOLIA.CAPXUL_TEST_USDC.assetId,
+	CAPXUL_TEST_USDT: SETTLEMENT_ASSETS_BASE_SEPOLIA.CAPXUL_TEST_USDT.assetId,
+	CAPXUL_TEST_WETH: SETTLEMENT_ASSETS_BASE_SEPOLIA.CAPXUL_TEST_WETH.assetId
+}) });
 /**
 * Every known asset in ONE identity space. The tiers above declare admission;
 * this is the only list an identity resolves against, so an asset is never
 * two different things depending on which list a caller happened to read.
 */
-const MONEY_ASSET_REGISTRY = [USDX_ASSET, ...SYNTHETIC_TEST_ASSETS];
+const MONEY_ASSET_REGISTRY = [...SYNTHETIC_TEST_ASSETS];
 CONFIGURED_MONEY_ASSETS.map((asset) => asset.tokenAddress.toLowerCase());
-USDX_ADDRESS_BASE_SEPOLIA.toLowerCase();
 /** The registry row for `assetId` across every tier, or `null`. */
 function configuredMoneyAssetById(assetId) {
 	const canonical = toAssetId(assetId);
@@ -1183,6 +1180,28 @@ function configuredMoneyAssetById(assetId) {
 //#region ../config/src/org-payments.ts
 /** Zodiac MultiSendCallOnly module on Base Sepolia. */
 const MULTI_SEND_CALL_ONLY = "0x9641d764fc13c8b624c04430c7356c1c7c8102e2";
+/** Supported Organization permission identities, newest first. */
+const ORG_PERMISSION_IDENTITY_PROFILES = [{
+	id: "zodiac-roles-2.1.1",
+	moduleFactoryRuntimeKeccak256: "0x01623cbcf010a1c326230f1b2d5f48a66b440232ee49096102bc84967dc5f21e",
+	mastercopy: "0xf2964ce6161ce0e75964fe7927ce114cb0b283d5",
+	mastercopyRuntimeKeccak256: "0x471d8b3b419f1eb955230c0326c8812176df49bf3c7b414a563fda5a3c6c10b6",
+	proxyRuntimeKeccak256: "0x248f9591f94c24c199ade3e73feb477cf02d387b2bea91f2f931a0deb094f163",
+	multiSendUnwrapper: "0xb4cd4bb764c089f20da18700ce8bc5e49f369efd",
+	multiSendUnwrapperRuntimeKeccak256: "0x1f6e088be5e6ef9d0fbe0547d3fa9a9e40d823433fd8a4449215b5663209a1eb"
+}, {
+	id: "zodiac-roles-2.1.0",
+	moduleFactoryRuntimeKeccak256: "0x01623cbcf010a1c326230f1b2d5f48a66b440232ee49096102bc84967dc5f21e",
+	mastercopy: "0x9646fdad06d3e24444381f44362a3b0eb343d337",
+	mastercopyRuntimeKeccak256: "0x87911cbc6aa0496e6bcb07dab2462b9c76daea130dede6dcc57d0adf307fa7ec",
+	proxyRuntimeKeccak256: "0x9d4059abf46db50e4b48d9b6404b1f200cb5a1efeb3725be2de630a2a9001944",
+	multiSendUnwrapper: "0x93b7fcbc63ed8a3a24b59e1c3e6649d50b7427c0",
+	multiSendUnwrapperRuntimeKeccak256: "0x4d8d8608b70a6e2f40726b9dd74406bbf73e90cac58e23ee953e2b45ad7dc3df"
+}];
+const CURRENT_ORG_PERMISSION_IDENTITY = ORG_PERMISSION_IDENTITY_PROFILES[0];
+ORG_PERMISSION_IDENTITY_PROFILES[1];
+CURRENT_ORG_PERMISSION_IDENTITY.mastercopy;
+CURRENT_ORG_PERMISSION_IDENTITY.multiSendUnwrapper;
 //#endregion
 //#region ../config/src/safe.ts
 const BASE_SEPOLIA_CHAIN_ID = 84532;
@@ -1226,7 +1245,7 @@ function normalizeSafeSaltEmail(email) {
 * `keccak256(namespace + ":" + normalizeSafeSaltEmail(email))`.
 *
 * Namespace defaults to `CAPXUL_SAFE_SALT_NAMESPACE`
-* (`"capxul:staging:email:v1"`) — the current Capxul scheme. Pass a
+* (`"capxul:staging:email:v2"`) — the current Capxul scheme. Pass a
 * different namespace only for pinned pre-v2 artifacts
 * (`CAPXUL_SAFE_SALT_NAMESPACE_V1`, faucet Safe) or when bumping the scheme.
 *
@@ -1235,7 +1254,7 @@ function normalizeSafeSaltEmail(email) {
 * @returns The Capxul-namespaced salt nonce as a `bigint`
 */
 function computeCapxulSafeSaltNonce(input) {
-	const namespace = input.namespace ?? "capxul:staging:email:v1";
+	const namespace = input.namespace ?? "capxul:staging:email:v2";
 	const normalizedEmail = normalizeSafeSaltEmail(input.email);
 	return BigInt(keccak256(toBytes(`${namespace}:${normalizedEmail}`)));
 }
@@ -1411,6 +1430,9 @@ function normalizeBindingEmail(email) {
 	return normalizeSafeSaltEmail(email);
 }
 //#endregion
+//#region ../config/src/role-dsl.ts
+const ADMIN_ROLE_LABEL = "Admin";
+//#endregion
 //#region ../config/src/capxul-payments-v2.ts
 /** The exact compiled CapxulPaymentsV2 ABI. */
 const CAPXUL_PAYMENTS_V2_ABI = [
@@ -2056,38 +2078,6 @@ const CAPXUL_PAYMENTS_V2_ABI = [
 ];
 /** Immutable CapxulPaymentsV2 deployment on Base Sepolia. */
 const CAPXUL_PAYMENTS_V2_ADDRESS = "0x7a5c25aB7ce91d7a475B71cd1ec33E230291f8a4";
-//#endregion
-//#region ../config/src/route.ts
-/** USDX on Base Sepolia — the only settlement token in v1. */
-const USDX_BASE_SEPOLIA_TOKEN = {
-	chainId: BASE_SEPOLIA_CHAIN_ID,
-	address: USDX_ADDRESS_BASE_SEPOLIA,
-	decimals: 6
-};
-USDX_BASE_SEPOLIA_TOKEN.chainId;
-USDX_BASE_SEPOLIA_TOKEN.chainId;
-10n ** BigInt(6);
-/**
-* The bootstrap manage role. It administers people and roles, cannot spend,
-* and is not a signer of the Organization Safe; "Owner" implied the latter,
-* so the label is Admin (ruled 2026-09-06).
-*/
-const ADMIN_ROLE_LABEL = "Admin";
-function normalizeOrgRoleLabel(label) {
-	const normalized = label.trim().replace(/\s+/g, " ");
-	if (normalized.length === 0) throw Errors.invalidInput("role.label", "must be a non-empty role label");
-	return normalized;
-}
-function orgRoleKeyForLabel(label) {
-	return keccak256(toBytes(normalizeOrgRoleLabel(label).toLowerCase()));
-}
-padHex(stringToHex("FM_DAILY"), {
-	size: 32,
-	dir: "right"
-}), padHex(stringToHex("TL_DAILY"), {
-	size: 32,
-	dir: "right"
-});
 padHex(concat([MULTI_SEND_CALL_ONLY, "0x8d80ff0a"]), {
 	dir: "right",
 	size: 32
@@ -2100,9 +2090,9 @@ function paymentsV2Signature(name) {
 paymentsV2Signature("send");
 paymentsV2Signature("sendBatch");
 paymentsV2Signature("createCommitment");
-paymentsV2Signature("cancel");
-paymentsV2Signature("redirect");
-new Map([
+//#endregion
+//#region ../config/src/org-bootstrap.ts
+const ROLE_AUTHORITY_EVENT_BY_FUNCTION_SELECTOR = new Map([
 	["assignRoles(address,bytes32[],bool[])", "AssignRoles(address,bytes32[],bool[])"],
 	["allowTarget(bytes32,address,uint8)", "AllowTarget(bytes32,address,uint8)"],
 	["scopeTarget(bytes32,address)", "ScopeTarget(bytes32,address)"],
@@ -2112,6 +2102,8 @@ new Map([
 	["revokeFunction(bytes32,address,bytes4)", "RevokeFunction(bytes32,address,bytes4)"],
 	["setAllowance(bytes32,uint128,uint128,uint128,uint64,uint64)", "SetAllowance(bytes32,uint128,uint128,uint128,uint64,uint64)"]
 ].map(([functionSignature, eventSignature]) => [toFunctionSelector(functionSignature), toEventSelector(eventSignature)]));
+toEventSelector("AssignRoles(address,bytes32[],bool[])");
+new Set([...ROLE_AUTHORITY_EVENT_BY_FUNCTION_SELECTOR.values()].map((topic) => topic.toLowerCase()));
 //#endregion
 //#region src/ports/auth-client.ts
 var AuthClientError = class extends Data.TaggedError("AuthClientError") {};
@@ -2489,4 +2481,4 @@ function readExchange(body) {
 	};
 }
 //#endregion
-export { toOrgId as $, EVM_ADDRESS_RE as A, redactUrlSecrets as At, toAssetId as B, APP_ID_RE as C, failureFingerprint as Ct, CLIENT_REQUEST_ID_RE as D, containsSensitiveMaterial as Dt, CLIENT_GRANT_ID_RE as E, revertSummaryText as Et, currencySymbolFor as F, toCurrencyCode as G, toBudgetId as H, toAccountId as I, toEpochMs as J, toDurationMs as K, toAddress as L, WEI_RE as M, ZERO_BYTES32 as N, COUNTRY_CODE_RE as O, isCredentialField as Ot, assetIdFor as P, toKycTier as Q, toAllowedOrigin as R, ACCOUNT_ID_RE as S, decodeChainCause as St, BYTES32_RE as T, isFailureMode as Tt, toChainId as U, toAuthUserId as V, toCountryCode as W, toHandle as X, toEpochSeconds as Y, toJwtToken as Z, normalizeBindingEmail as _, CHAIN_UPSTREAMS as _t, parseAuthSession as a, toSessionToken as at, CONFIGURED_MONEY_ASSETS as b, chainCauseProperties as bt, AuthCachePortTag as c, toWeiAmount as ct, authClientPortFromPromiseAdapter as d, decodeConvexError as dt, toPartyId as et, AuthClientError as f, CAPXUL_ERROR_CODES as ft, CAPXUL_PAYMENTS_V2_ADDRESS as g, isCapxulError as gt, orgRoleKeyForLabel as h, Errors as ht, BrowserAuthCacheAdapter as i, toRoleKey as it, SUPPORTED_CURRENCY_CODES as j, EMAIL_RE as k, redactSecrets as kt, SystemClockLayer as l, validateHandle as lt, ADMIN_ROLE_LABEL as m, EXPECTED_OPERATION_OUTCOMES as mt, readClockNow as n, toPayrollRunId as nt, parseCachedJwt as o, toTesterKind as ot, AuthClientPortTag as p, CapxulError as pt, toEmail as q, InMemoryAuthCacheAdapter as r, toPublishableKey as rt, AuthCacheError as s, toTxHash as st, oauthBearerAuthClient as t, toPayrollGroupId as tt, ClockPortTag as u, HANDLE_RE as ut, BASE_SEPOLIA_CHAIN_ID as v, FAILURE_MODES as vt, ASSET_ID_RE as w, isChainUpstream as wt, configuredMoneyAssetById as x, chainEvidenceLabel as xt, deriveCapxulSafeAddress as y, boundedResponseHeaders as yt, toAppId as z };
+export { toKycTier as $, EMAIL_RE as A, containsSensitiveMaterial as At, toAppId as B, ACCOUNT_ID_RE as C, chainCauseProperties as Ct, CLIENT_GRANT_ID_RE as D, isChainUpstream as Dt, BYTES32_RE as E, failureFingerprint as Et, assetIdFor as F, toCountryCode as G, toAuthUserId as H, currencySymbolFor as I, toEmail as J, toCurrencyCode as K, toAccountId as L, SUPPORTED_CURRENCY_CODES as M, redactSecrets as Mt, WEI_RE as N, redactUrlSecrets as Nt, CLIENT_REQUEST_ID_RE as O, isFailureMode as Ot, ZERO_BYTES32 as P, toJwtToken as Q, toAddress as R, configuredMoneyAssetById as S, boundedResponseHeaders as St, ASSET_ID_RE as T, decodeChainCause as Tt, toBudgetId as U, toAssetId as V, toChainId as W, toEpochSeconds as X, toEpochMs as Y, toHandle as Z, BASE_SEPOLIA_CHAIN_ID as _, EXPECTED_OPERATION_OUTCOMES as _t, parseAuthSession as a, toPermissionId as at, SYNTHETIC_TEST_ASSET_FIXTURES as b, CHAIN_UPSTREAMS as bt, AuthCachePortTag as c, toSessionToken as ct, authClientPortFromPromiseAdapter as d, toWeiAmount as dt, toOrgId as et, AuthClientError as f, validateHandle as ft, normalizeBindingEmail as g, CapxulError as gt, ADMIN_ROLE_LABEL as h, CAPXUL_ERROR_CODES as ht, BrowserAuthCacheAdapter as i, toPermissionAssignmentId as it, EVM_ADDRESS_RE as j, isCredentialField as jt, COUNTRY_CODE_RE as k, revertSummaryText as kt, SystemClockLayer as l, toTesterKind as lt, CAPXUL_PAYMENTS_V2_ADDRESS as m, decodeConvexError as mt, readClockNow as n, toPayrollGroupId as nt, parseCachedJwt as o, toPublishableKey as ot, AuthClientPortTag as p, HANDLE_RE as pt, toDurationMs as q, InMemoryAuthCacheAdapter as r, toPayrollRunId as rt, AuthCacheError as s, toRoleKey as st, oauthBearerAuthClient as t, toPartyId as tt, ClockPortTag as u, toTxHash as ut, deriveCapxulSafeAddress as v, Errors as vt, APP_ID_RE as w, chainEvidenceLabel as wt, TOKENS as x, FAILURE_MODES as xt, CONFIGURED_MONEY_ASSETS as y, isCapxulError as yt, toAllowedOrigin as z };