@capxul/cli 4.20.0-beta.3 → 4.20.0-beta.5

package/dist/main.mjs

@@ -2562,18 +2562,9 @@ const USDX_ASSET = {
 	tokenAddress: USDX_ADDRESS_BASE_SEPOLIA,
 	deploymentStartBlock: USDX_DEPLOYMENT_START_BLOCK,
 	decimals: 6,
-	source: "settlement"
+	source: "legacy"
 };
-/**
-* The settlement tier: rows the exact-transfer path and the Movement scanner
-* admit, each carrying the legacy `currency` projection those readers expect.
-* Adding an owned test asset here would put candidate liquidity on the
-* money-write path, so M03's rows go to the candidate tier below instead.
-*/
-const CONFIGURED_MONEY_ASSETS = [{
-	...USDX_ASSET,
-	currency: USDX_ASSET.peg
-}];
+({ ...USDX_ASSET }), USDX_ASSET.peg;
 /**
 * The candidate tier: five owned test assets, every field read back from Base
 * Sepolia after the deployment that created it (chain 84532, blocks
@@ -2645,12 +2636,25 @@ const SYNTHETIC_TEST_ASSETS = [
 ];
 toChainId(84532);
 /**
+* The settlement tier: the owned test assets admitted to the exact-transfer
+* path and to the treasury reads. USDC, USDT and WETH are equal assets. There
+* is no default token and no successor to USDX; USDX survives only in
+* `LEGACY_MONEY_ASSETS` and is not a current treasury row.
+*/
+const SETTLEMENT_ASSET_SYMBOLS = [
+	"USDC",
+	"USDT",
+	"WETH"
+];
+const CONFIGURED_MONEY_ASSETS = SYNTHETIC_TEST_ASSETS.filter((asset) => SETTLEMENT_ASSET_SYMBOLS.includes(asset.symbol));
+/**
 * Every known asset in ONE identity space. The tiers above declare admission;
 * this is the only list an identity resolves against, so an asset is never
 * two different things depending on which list a caller happened to read.
 */
-const MONEY_ASSET_REGISTRY = [...CONFIGURED_MONEY_ASSETS, ...SYNTHETIC_TEST_ASSETS];
+const MONEY_ASSET_REGISTRY = [USDX_ASSET, ...SYNTHETIC_TEST_ASSETS];
 CONFIGURED_MONEY_ASSETS.map((asset) => asset.tokenAddress.toLowerCase());
+USDX_ADDRESS_BASE_SEPOLIA.toLowerCase();
 /** The registry row for `assetId` across every tier, or `null`. */
 function configuredMoneyAssetById(assetId) {
 	const canonical = toAssetId(assetId);
@@ -5208,6 +5212,175 @@ new Map([
 	["setAllowance(bytes32,uint128,uint128,uint128,uint64,uint64)", "SetAllowance(bytes32,uint128,uint128,uint128,uint64,uint64)"]
 ].map(([functionSignature, eventSignature]) => [toFunctionSelector(functionSignature), toEventSelector(eventSignature)]));
 //#endregion
+//#region ../../packages/sdk/src/domain/money/asset-amount.ts
+/** Convert raw units without rounding or changing asset identity. */
+function assetAmountFromRaw(raw, asset) {
+	validateMetadata(asset);
+	return {
+		asset: asset.assetId,
+		value: formatUnits(decimalToRaw(toWeiAmount(raw), 0), asset.decimals)
+	};
+}
+/** Exact scaling. This rejects excess precision instead of rounding it. */
+function toRaw(amount, asset) {
+	validateMetadata(asset);
+	if (amount.asset !== asset.assetId) throw Errors.invalidInput("amount.asset", "must match the selected asset on its chain");
+	return decimalToRaw(amount.value, asset.decimals);
+}
+function requireAsset(id) {
+	const asset = configuredMoneyAssetById(id);
+	if (asset === null) throw Errors.invalidInput("amount.asset", "is not a registered asset");
+	return asset;
+}
+function decimalToRaw(value, decimals) {
+	validatePrecision(decimals);
+	if (!/^\d+(?:\.\d+)?$/.test(value) || value.trim() !== value || value.length > 512) throw Errors.invalidInput("amount.value", "must be a non-negative decimal string of at most 512 characters");
+	const [integer = "0", fraction = ""] = value.split(".");
+	if (fraction.length > decimals) throw Errors.invalidInput("amount.value", "fraction exceeds asset precision");
+	return BigInt(integer) * 10n ** BigInt(decimals) + BigInt(fraction.padEnd(decimals, "0") || "0");
+}
+function validatePrecision(decimals) {
+	if (!Number.isInteger(decimals) || decimals < 0 || decimals > 255) throw Errors.invalidInput("decimals", "must be an integer from 0 to 255");
+}
+function validateMetadata(asset) {
+	validatePrecision(asset.decimals);
+	if (asset.assetId !== assetIdFor(asset.chainId, asset.tokenAddress)) throw Errors.invalidInput("amount.asset", "metadata must match its chain and token");
+}
+//#endregion
+//#region ../../packages/sdk/src/domain/money/valuation.ts
+const PEG_RATES = (source, into) => (typeof source === "string" ? source : source.peg) === into ? {
+	value: "1",
+	decimals: 0
+} : null;
+/**
+* The oracle the money READS price with: the account headline, the org
+* treasury headline, and every later total over the same seam (D6).
+*
+* It is `PEG_RATES` today because no price feed exists yet, and a peg is a
+* relationship, not a market price — so an unpegged asset such as WETH reads
+* as unrated rather than as a fabricated number. This binding is the ONE place
+* a real feed arrives; no call site changes when it does.
+*/
+const MONEY_READ_RATES = PEG_RATES;
+/** Sum exact fixed-point values. Missing rates never contribute zero. */
+function valueIn(amounts, displayCurrency, rates = PEG_RATES) {
+	const currency = toCurrencyCode(displayCurrency);
+	const counted = [];
+	const unrated = [];
+	let sum = 0n;
+	let scale = 0;
+	for (const amount of amounts) {
+		let source;
+		let raw;
+		let decimals;
+		if ("asset" in amount) {
+			source = requireAsset(amount.asset);
+			raw = toRaw(amount, source);
+			decimals = source.decimals;
+		} else {
+			source = toCurrencyCode(amount.currency);
+			raw = decimalToRaw(amount.value, amount.decimals);
+			decimals = amount.decimals;
+		}
+		const rate = rates(source, currency);
+		if (rate === null) {
+			unrated.push(amount);
+			continue;
+		}
+		validatePrecision(rate.decimals);
+		if (!/^\d+$/.test(rate.value) || rate.value.trim() !== rate.value || rate.value.length > 256 || BigInt(rate.value) <= 0n) throw Errors.invalidInput("rate.value", "must be a positive fixed-point integer");
+		const termScale = decimals + rate.decimals;
+		const nextScale = Math.max(scale, termScale);
+		sum = sum * 10n ** BigInt(nextScale - scale) + raw * BigInt(rate.value) * 10n ** BigInt(nextScale - termScale);
+		scale = nextScale;
+		counted.push(amount);
+	}
+	return {
+		total: counted.length === 0 ? null : {
+			currency,
+			value: formatUnits(sum, scale),
+			decimals: scale
+		},
+		counted,
+		unrated
+	};
+}
+//#endregion
+//#region ../../packages/sdk/src/domain/money/account-positions.ts
+/**
+* Lift an Account's raw per-asset positions to the SDK's `AccountPosition`.
+*
+* A position whose `assetId` is not a registered asset refuses. An unregistered
+* token has no identity this SDK can state, so it must never be relabelled as
+* one — the failure is the point, not a row to skip.
+*/
+function accountPositionsFromWire(positions) {
+	return positions.map((position) => {
+		const asset = configuredMoneyAssetById(toAssetId(position.assetId));
+		if (asset === null) throw Errors.invalidInput("assetId", "is not a registered asset");
+		const raw = toWeiAmount(position.rawBalance);
+		const rawAvailable = toWeiAmount(position.rawAvailableBalance ?? position.rawBalance);
+		return {
+			asset: asset.assetId,
+			symbol: asset.symbol,
+			decimals: asset.decimals,
+			balance: assetAmountFromRaw(raw, asset).value,
+			available: assetAmountFromRaw(rawAvailable, asset).value
+		};
+	});
+}
+/**
+* The fiat headline of a set of positions: the sum of the positions the given
+* oracle can rate into the display currency (ADR-0028 R6, D6). It never picks
+* a token and never labels one as fiat.
+*
+* The oracle is a PARAMETER (D6 obligation 4). It defaults to `PEG_RATES`, which
+* only rates an asset whose peg equals the display currency, so an unpegged
+* asset such as WETH stays out of the total and out of `counted`:
+* a WETH-only Account reads a `$0.00` headline under that default. Hand it a
+* real oracle and the same Account prices (WETH at `$2000` under
+* `createMockRates`, a live feed later).
+*
+* Either way the unrated position is never zeroed and never dropped: it stays
+* in `Account.balances`, and `valueIn` reports it in its own `unrated` list so
+* a caller can say how complete the total is.
+*/
+function headlineValuation(balances, displayCurrency, rates = PEG_RATES) {
+	const total = (pick) => valueIn(balances.map((position) => ({
+		asset: position.asset,
+		value: pick(position)
+	})), displayCurrency, rates).total ?? {
+		currency: displayCurrency,
+		value: "0",
+		decimals: 0
+	};
+	return {
+		balance: total((position) => position.balance),
+		available: total((p) => p.available)
+	};
+}
+/**
+* The Account: its per-asset truth plus the fiat headline valuation. The oracle
+* is threaded from the read that built it, never defaulted past this point
+* (D6): the account read passes the configured one.
+*/
+function accountFromPositions(id, positions, displayCurrency = toCurrencyCode("USD"), rates = PEG_RATES) {
+	const balances = accountPositionsFromWire(positions);
+	return {
+		id,
+		balances,
+		...headlineValuation(balances, displayCurrency, rates)
+	};
+}
+/** The same lift for positions a caller already holds as `AccountPosition`. */
+function accountFromAccountPositions(id, balances, displayCurrency = toCurrencyCode("USD"), rates = PEG_RATES) {
+	return {
+		id,
+		balances,
+		...headlineValuation(balances, displayCurrency, rates)
+	};
+}
+//#endregion
 //#region ../../packages/observability/src/operations.ts
 const CAPXUL_OPERATIONS = {
 	account: {
@@ -5276,6 +5449,26 @@ const CAPXUL_OPERATIONS = {
 		createOrg: "createOrg",
 		orgs: "orgs"
 	},
+	/** AUTH A3 (#2073): the SDK facade over the native continuation endpoints. */
+	clientRequests: {
+		decide: "clientRequests.decide",
+		read: "clientRequests.read"
+	},
+	/** AUTH A2 (#2072): the native client authorization issuer and its browser
+	* continuation. One name per durable transition the endpoints can fail on. */
+	clientAuthorization: {
+		acceptRequest: "clientAuthorization.acceptRequest",
+		cancelRequest: "clientAuthorization.cancelRequest",
+		consumeRequest: "clientAuthorization.consumeRequest",
+		denyRequest: "clientAuthorization.denyRequest",
+		invalidateContext: "clientAuthorization.invalidateContext",
+		markConsented: "clientAuthorization.markConsented",
+		readMetadata: "clientAuthorization.readMetadata",
+		revokeGrant: "clientAuthorization.revokeGrant",
+		rotateGrant: "clientAuthorization.rotateGrant",
+		startRequest: "clientAuthorization.startRequest",
+		sweepExpired: "clientAuthorization.sweepExpired"
+	},
 	credentials: {
 		bootstrapClient: "credentials.bootstrapClient",
 		mintQuickstartKey: "credentials.mintQuickstartKey"
@@ -5774,6 +5967,44 @@ const IdentityRefusedProps = Schema.Struct({
 	state: OptionalString
 });
 const AuthSignedOutProps = Schema.Struct(TelemetryEnvelopeProps);
+const NativeAuthorizationMode = Schema.Literals(["login", "signup"]);
+const NativeAuthorizationStartedProps = Schema.Struct({
+	...TelemetryEnvelopeProps,
+	mode: NativeAuthorizationMode
+});
+const NativeAuthorizationReviewedProps = Schema.Struct({
+	...TelemetryEnvelopeProps,
+	mode: NativeAuthorizationMode
+});
+const NativeAuthorizationAcceptedProps = Schema.Struct({
+	...TelemetryEnvelopeProps,
+	mode: NativeAuthorizationMode,
+	/** Whether consent also had to finish account setup first. */
+	setup_state: Schema.optional(Schema.Literals([
+		"not_required",
+		"new",
+		"resumable"
+	]))
+});
+const NativeAuthorizationDeniedProps = Schema.Struct({
+	...TelemetryEnvelopeProps,
+	mode: NativeAuthorizationMode
+});
+const NativeAuthorizationConnectedProps = Schema.Struct({
+	...TelemetryEnvelopeProps,
+	mode: NativeAuthorizationMode
+});
+const NativeAuthorizationFailedProps = Schema.Struct({
+	...TelemetryEnvelopeProps,
+	mode: Schema.optional(NativeAuthorizationMode),
+	/** The refusal word the store returned, for example `identity_mismatch` or
+	* `request_expired`. These are the closed `CLIENT_AUTHORIZATION_REFUSALS` from
+	* `@capxul/wire` plus the store-internal `fresh_session_required` (ruling R3),
+	* which the continuation maps to `identity_mismatch` on the wire but reports
+	* truthfully here. Kept as `OptionalString` rather than an imported literal
+	* set: this package must not depend on the transport contract. */
+	reason: OptionalString
+});
 const ProvisioningSafeCreatedProps = Schema.Struct({
 	...TelemetryEnvelopeProps,
 	safe_address: OptionalAddress
@@ -5816,6 +6047,12 @@ const BootstrapFailedProps = Schema.Struct({
 * Organization row's chain, the configured token address — never from a label.
 * The verified `organization_id` and its group arrive from the backend
 * attribution, so they are not repeated here.
+*
+* D1 (2026-09-10): `asset_id` carries the canonical branded identity the read
+* resolved, `eip155:<chainId>/erc20:<lowercase-address>`, from the registry
+* row. `token_address`/`chain_id` are its parts; `currency` is the peg and a
+* display code. The producer emits the branded id so the live read can be
+* grouped by ASSET, never by symbol or peg.
 */
 const AccountBalanceReadProps = Schema.Struct({
 	...TelemetryEnvelopeProps,
@@ -5823,6 +6060,7 @@ const AccountBalanceReadProps = Schema.Struct({
 	account_kind: OptionalAccountKind,
 	chain_id: OptionalChainId,
 	token_address: OptionalAddress,
+	asset_id: OptionalString,
 	currency: OptionalCurrencyCode,
 	balance_bucket: OptionalBalanceBucket,
 	durationMs: OptionalDurationMs
@@ -6291,6 +6529,30 @@ const AuthSignedOutTelemetryEventSchema = Schema.Struct({
 	name: Schema.Literal("auth_signed_out"),
 	props: AuthSignedOutProps
 });
+const NativeAuthorizationStartedTelemetryEventSchema = Schema.Struct({
+	name: Schema.Literal("native_authorization_started"),
+	props: NativeAuthorizationStartedProps
+});
+const NativeAuthorizationReviewedTelemetryEventSchema = Schema.Struct({
+	name: Schema.Literal("native_authorization_reviewed"),
+	props: NativeAuthorizationReviewedProps
+});
+const NativeAuthorizationAcceptedTelemetryEventSchema = Schema.Struct({
+	name: Schema.Literal("native_authorization_accepted"),
+	props: NativeAuthorizationAcceptedProps
+});
+const NativeAuthorizationDeniedTelemetryEventSchema = Schema.Struct({
+	name: Schema.Literal("native_authorization_denied"),
+	props: NativeAuthorizationDeniedProps
+});
+const NativeAuthorizationConnectedTelemetryEventSchema = Schema.Struct({
+	name: Schema.Literal("native_authorization_connected"),
+	props: NativeAuthorizationConnectedProps
+});
+const NativeAuthorizationFailedTelemetryEventSchema = Schema.Struct({
+	name: Schema.Literal("native_authorization_failed"),
+	props: NativeAuthorizationFailedProps
+});
 const OnboardingIntentSelectedTelemetryEventSchema = Schema.Struct({
 	name: Schema.Literal("onboarding_intent_selected"),
 	props: OnboardingIntentSelectedProps
@@ -6545,12 +6807,18 @@ const CLI_COMMAND_NAMES = [
 	"telemetry.status",
 	"telemetry.enable",
 	"telemetry.disable",
+	"auth",
+	"auth.login",
+	"auth.signup",
+	"auth.status",
+	"auth.logout",
 	"unknown"
 ];
 const CLI_CAPABILITIES = [
 	"cli",
 	"diagnostics",
-	"collection"
+	"collection",
+	"authentication"
 ];
 const CLI_INVOCATION_KINDS = [
 	"command",
@@ -6568,8 +6836,9 @@ const CliInvocationProps = {
 	capability: Schema.Literals(CLI_CAPABILITIES),
 	invocation_kind: Schema.Literals(CLI_INVOCATION_KINDS),
 	invocation_id: Schema.String.check(Schema.isPattern(/^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/u)),
-	cli_identity_kind: Schema.optional(Schema.Literal("anonymous")),
+	cli_identity_kind: Schema.optional(Schema.Literals(["anonymous", "identified"])),
 	anonymous_id: Schema.optional(Schema.String.check(Schema.isPattern(/^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/u))),
+	auth_user_id: Schema.optional(Schema.String.check(Schema.isPattern(/^[^\s]{1,256}$/u))),
 	occurred_at: Schema.Number,
 	cli_version: CliRelease,
 	sdk_version: CliRelease,
@@ -6936,6 +7205,12 @@ const TELEMETRY_EVENT_SCHEMAS = {
 	auth_failed: AuthFailedTelemetryEventSchema,
 	identity_refused: IdentityRefusedTelemetryEventSchema,
 	auth_signed_out: AuthSignedOutTelemetryEventSchema,
+	native_authorization_started: NativeAuthorizationStartedTelemetryEventSchema,
+	native_authorization_reviewed: NativeAuthorizationReviewedTelemetryEventSchema,
+	native_authorization_accepted: NativeAuthorizationAcceptedTelemetryEventSchema,
+	native_authorization_denied: NativeAuthorizationDeniedTelemetryEventSchema,
+	native_authorization_connected: NativeAuthorizationConnectedTelemetryEventSchema,
+	native_authorization_failed: NativeAuthorizationFailedTelemetryEventSchema,
 	onboarding_intent_selected: OnboardingIntentSelectedTelemetryEventSchema,
 	onboarding_profile_submitted: OnboardingProfileSubmittedTelemetryEventSchema,
 	onboarding_organization_submitted: OnboardingOrganizationSubmittedTelemetryEventSchema,
@@ -9361,7 +9636,7 @@ function isSafeField(field, value) {
 }
 //#endregion
 //#region ../../packages/wire/src/client-authorization.ts
-const NATIVE_CLIENT_ID = "capxul-cli";
+const NATIVE_CLIENT_ID$1 = "capxul-cli";
 const NATIVE_CLIENT_SCOPE = "account:read";
 const NATIVE_CLIENT_LIMITS = {
 	accessMs: 36e5,
@@ -9388,8 +9663,7 @@ const country = normalize((s) => s.toUpperCase()).pipe(Schema.refine((s) => COUN
 const credential = Schema.RedactedFromValue(Schema.String.check(Schema.isMinLength(32), Schema.isMaxLength(8192), Schema.isPattern(/^[A-Za-z0-9._~-]+$/u)), { label: "native authorization credential" });
 const otp = Schema.RedactedFromValue(Schema.String.check(Schema.isPattern(/^[0-9]{6}$/u)), { label: "OTP" });
 const scopes = Schema.Tuple([Schema.Literal(NATIVE_CLIENT_SCOPE)]);
-/** Exact HTTPS origin, no credentials/path/query and no retired cloud deployment. */
-const NativeHttpsOriginSchema = Schema.String.check(Schema.makeFilter((value) => {
+const isNativeHttpsOriginValue = (value) => {
 	try {
 		const url = new URL(value);
 		const host = url.hostname.toLowerCase().replace(/\.$/u, "");
@@ -9397,20 +9671,43 @@ const NativeHttpsOriginSchema = Schema.String.check(Schema.makeFilter((value) =>
 	} catch {
 		return false;
 	}
-}, { message: "must be a canonical credential-free HTTPS origin outside retired Convex cloud hosts" }));
+};
+Schema.String.check(Schema.makeFilter(isNativeHttpsOriginValue, { message: "must be a canonical credential-free HTTPS origin outside retired Convex cloud hosts" }));
+const isLoopbackOriginValue = (value) => {
+	try {
+		const url = new URL(value);
+		const host = url.hostname.toLowerCase().replace(/\.$/u, "");
+		return url.protocol === "http:" && value === url.origin && !url.username && !url.password && !url.search && !url.hash && (host === "127.0.0.1" || host === "[::1]" || host === "localhost");
+	} catch {
+		return false;
+	}
+};
+Schema.String.check(Schema.makeFilter(isLoopbackOriginValue, { message: "must be a canonical credential-free loopback HTTP origin" }));
+/**
+* Either a standing-tier HTTPS origin or a devnet loopback origin. A `Union` of
+* the two refined string schemas does not type-check in this Effect version —
+* it widens both fields to `unknown` — so the disjunction lives in one filter
+* and the struct check below is what binds a loopback origin to
+* `environment: "local"`. Loopback is never admissible on a standing tier.
+*/
+const NativeOriginSchema = Schema.String.check(Schema.makeFilter((value) => isNativeHttpsOriginValue(value) || isLoopbackOriginValue(value), { message: "must be a canonical credential-free HTTPS origin outside retired Convex cloud hosts, or a loopback HTTP origin for the local devnet" }));
 const NativeClientConfigurationSchema = Schema.Struct({
-	clientId: Schema.Literal(NATIVE_CLIENT_ID),
+	clientId: Schema.Literal(NATIVE_CLIENT_ID$1),
 	applicationId: AppIdSchema,
 	keyId,
 	environment: Schema.Literals([
+		"local",
 		"development",
 		"staging",
 		"production"
 	]),
 	keyEnvironment: Schema.Literals(["test", "live"]),
-	issuer: NativeHttpsOriginSchema,
-	verificationOrigin: NativeHttpsOriginSchema
-}).annotate(strict).check(Schema.makeFilter((c) => c.keyEnvironment === (c.environment === "production" ? "live" : "test"), { message: "key environment must match the configured deployment" })).annotate(strict);
+	issuer: NativeOriginSchema,
+	verificationOrigin: NativeOriginSchema
+}).annotate(strict).check(Schema.makeFilter((c) => c.keyEnvironment === (c.environment === "production" ? "live" : "test"), { message: "key environment must match the configured deployment" })).check(Schema.makeFilter((c) => {
+	const loopback = isLoopbackOriginValue(c.issuer) || isLoopbackOriginValue(c.verificationOrigin);
+	return c.environment === "local" ? isLoopbackOriginValue(c.issuer) && isLoopbackOriginValue(c.verificationOrigin) : !loopback;
+}, { message: "loopback origins belong to the local devnet environment alone" })).annotate(strict);
 const NativeSignupProfileSchema = Schema.Struct({
 	displayName: normalize((s) => s.trim()).check(Schema.isMinLength(1), Schema.isMaxLength(200)),
 	country,
@@ -9441,7 +9738,7 @@ const ClientAuthorizationIntentSchema = Schema.Union([Schema.Struct({ mode: Sche
 	profile: NativeSignupProfileSchema
 }).annotate(strict)]).annotate(strict);
 Schema.Struct({
-	clientId: Schema.Literal(NATIVE_CLIENT_ID),
+	clientId: Schema.Literal(NATIVE_CLIENT_ID$1),
 	email,
 	intent: ClientAuthorizationIntentSchema,
 	waitMs: Schema.Number.check(Schema.isInt(), Schema.isBetween({
@@ -9464,7 +9761,7 @@ const profileSummary = {
 	handle,
 	country
 };
-Schema.Union([
+const ClientRequestViewSchema = Schema.Union([
 	Schema.Struct({
 		...request,
 		phase: Schema.Literal(CLIENT_AUTHORIZATION_PHASE.OTP_REQUIRED),
@@ -9529,13 +9826,12 @@ Schema.Struct({
 	code: otp
 }).annotate(strict);
 Schema.Struct({
-	client_id: Schema.Literal(NATIVE_CLIENT_ID),
+	client_id: Schema.Literal(NATIVE_CLIENT_ID$1),
 	grant_type: Schema.Literal("refresh_token"),
-	refresh_token: credential,
-	refreshAttemptId: Schema.RedactedFromValue(Schema.String.check(Schema.isPattern(/^[A-Za-z0-9_-]{32,128}$/u)), { label: "refresh attempt" })
+	refresh_token: credential
 }).annotate(strict);
 Schema.Struct({
-	client_id: Schema.Literal(NATIVE_CLIENT_ID),
+	client_id: Schema.Literal(NATIVE_CLIENT_ID$1),
 	applicationId: AppIdSchema,
 	resource: text$2(2048),
 	token_type: Schema.Literal("Bearer"),
@@ -9585,7 +9881,7 @@ Schema.Struct({
 	return m.resource === expected.resource && m.device_authorization_endpoint === expected.device_authorization_endpoint && m.token_endpoint === expected.token_endpoint && m.revocation_endpoint === expected.revocation_endpoint && m.session_endpoint === expected.session_endpoint && m.verification_uri === expected.verification_uri;
 }, { message: "native endpoints must match their configured issuer and verification origin" })).annotate(strict);
 Schema.Struct({
-	client_id: Schema.Literal(NATIVE_CLIENT_ID),
+	client_id: Schema.Literal(NATIVE_CLIENT_ID$1),
 	grant_type: Schema.Literal("urn:ietf:params:oauth:grant-type:device_code"),
 	device_code: credential
 }).annotate(strict);
@@ -9604,6 +9900,33 @@ Schema.Struct({
 		maximum: NATIVE_CLIENT_LIMITS.requestMs / 1e3
 	}))
 }).annotate(strict);
+Schema.Struct({
+	client_id: Schema.Literal(NATIVE_CLIENT_ID$1),
+	token: credential,
+	token_type_hint: Schema.optional(Schema.Literals([
+		"access_token",
+		"refresh_token",
+		"device_code"
+	]))
+}).annotate(strict);
+Schema.Struct({
+	client_id: Schema.Literal(NATIVE_CLIENT_ID$1),
+	token: credential
+}).annotate(strict);
+Schema.Struct({
+	error: Schema.Literals([
+		"authorization_pending",
+		"slow_down",
+		"access_denied",
+		"invalid_grant",
+		"invalid_request",
+		"expired_token",
+		"server_error"
+	]),
+	refusal: Schema.optional(Schema.Literals(CLIENT_AUTHORIZATION_REFUSALS)),
+	retryable: Schema.Boolean,
+	retry_after: Schema.optional(nonNegativeInt)
+}).annotate(strict);
 //#endregion
 //#region ../../packages/sdk/src/internal/invocation-observation.ts
 const INVOCATION_OBSERVATION = Symbol("capxul.invocation-observation");
@@ -12057,7 +12380,7 @@ function subscribeActivity(deps, actor, controls, onChange) {
 }
 //#endregion
 //#region ../../packages/sdk/package.json
-var version$1 = "4.20.0-beta.3";
+var version$1 = "4.20.0-beta.5";
 //#endregion
 //#region ../../packages/sdk/src/telemetry/exception-projection.ts
 /** Fixed fallback for failures that have no safe message. */
@@ -14696,7 +15019,7 @@ const MINIMAL_ENUM_VALUES = /* @__PURE__ */ new Map([
 	["command", CLI_COMMAND_NAMES],
 	["capability", CLI_CAPABILITIES],
 	["invocation_kind", CLI_INVOCATION_KINDS],
-	["cli_identity_kind", ["anonymous"]],
+	["cli_identity_kind", ["anonymous", "identified"]],
 	["output_mode", ["human", "json"]],
 	["unit", [
 		"1",
@@ -19613,13 +19936,15 @@ var ConvexAccountAdapter = class {
 	#convex;
 	#fns;
 	#telemetry;
+	#rates;
 	constructor(deps) {
 		this.#convex = deps.convex;
 		this.#fns = deps.functions ?? DEFAULT_FUNCTIONS$3;
 		this.#telemetry = deps.telemetry;
+		this.#rates = deps.rates ?? MONEY_READ_RATES;
 	}
 	readBalance(input) {
-		return retryIdempotentRead(this.#convex.action(this.#fns.readBalance, copyInvocationObservation(input, { chainId: wireChainId(input.chainId) })), CAPXUL_OPERATIONS.accounts.read, this.#telemetry, input).pipe(Effect.mapError((error) => accountReadErrorFromCapxul("readBalance", error.publicError, error)), Effect.flatMap((wire) => brandAccountEffect("readBalance", wire)), Effect.catchDefect((cause) => Effect.fail(accountReadErrorFromUnknown("readBalance", cause))));
+		return retryIdempotentRead(this.#convex.action(this.#fns.readBalance, copyInvocationObservation(input, { chainId: wireChainId(input.chainId) })), CAPXUL_OPERATIONS.accounts.read, this.#telemetry, input).pipe(Effect.mapError((error) => accountReadErrorFromCapxul("readBalance", error.publicError, error)), Effect.flatMap((wire) => brandAccountEffect("readBalance", wire, this.#rates)), Effect.catchDefect((cause) => Effect.fail(accountReadErrorFromUnknown("readBalance", cause))));
 	}
 	fundFromFaucet(input) {
 		const operation = "fundFromFaucet";
@@ -19632,26 +19957,21 @@ var ConvexAccountAdapter = class {
 		}).pipe(Effect.mapError((error) => accountReadErrorFromCapxul(operation, error.publicError, error)), Effect.map((wire) => ({ txHash: wire.txHash })), Effect.catchDefect((cause) => Effect.fail(accountReadErrorFromUnknown(operation, cause))));
 	}
 };
-function ConvexAccountLayer() {
+function ConvexAccountLayer(input = {}) {
 	return Layer.effect(AccountReadPortTag, Effect.all([ConvexCallPortTag, TelemetryPortTag]).pipe(Effect.map(([convex, telemetry]) => new ConvexAccountAdapter({
 		convex,
-		telemetry
+		telemetry,
+		...input
 	}))));
 }
-function brandAccountEffect(operation, wire) {
+function brandAccountEffect(operation, wire, rates) {
 	return Effect.try({
-		try: () => brandAccount(wire),
+		try: () => brandAccount(wire, rates),
 		catch: (cause) => accountReadErrorFromUnknown(operation, cause)
 	});
 }
-function brandAccount(wire) {
-	const balance = fromWei(wire.rawBalance, wire.decimals, wire.currency);
-	const available = fromWei(wire.rawAvailableBalance ?? wire.rawBalance, wire.decimals, wire.currency);
-	return {
-		id: toAccountId(wire.accountId),
-		balance,
-		available
-	};
+function brandAccount(wire, rates) {
+	return accountFromPositions(toAccountId(wire.accountId), wire.positions, void 0, rates);
 }
 function accountReadErrorFromUnknown(operation, cause) {
 	if (cause instanceof CapxulError) return accountReadErrorFromCapxul(operation, cause);
@@ -19790,16 +20110,16 @@ function brandOrgView(wire, treasury, viewerRole) {
 	};
 }
 /**
-* Build the Org treasury `Account` from the raw on-chain `balanceOf` integer
-* (the D3 RPC read). `available === balance` for a treasury with no envelope
-* partition yet (a fresh Org reads back $0).
+* Build the Org treasury `Account` from the raw per-asset `balanceOf` reads
+* (the D3 RPC pull). `available === balance` for a treasury with no envelope
+* partition yet (a fresh Org reads back a zero position per asset).
+*
+* `rates` is the oracle the headline prices with (D6). The live read passes the
+* configured one; it defaults to `PEG_RATES` so an unpegged holding reads as
+* unrated rather than as a number nobody priced.
 */
 function brandOrgTreasury(input) {
-	return {
-		id: toAccountId(`account_${orgIdBody(input.orgId)}`),
-		balance: input.money,
-		available: input.money
-	};
+	return accountFromAccountPositions(toAccountId(`account_${orgIdBody(input.orgId)}`), input.balances, void 0, input.rates);
 }
 function brandOrgRole(wire) {
 	return {
@@ -19886,10 +20206,12 @@ var ConvexOrganizationAdapter = class {
 	#convex;
 	#fns;
 	#telemetry;
+	#rates;
 	constructor(input) {
 		this.#convex = input.convex;
 		this.#fns = input.functions ?? DEFAULT_FUNCTIONS$1;
 		this.#telemetry = input.telemetry;
+		this.#rates = input.rates ?? MONEY_READ_RATES;
 	}
 	createOrg(_input) {
 		return Effect.fail(orgErrorFromCapxul("createOrg", Errors.notImplemented("organizationSetup", "use onboarding.completeOrganization")));
@@ -19937,15 +20259,11 @@ var ConvexOrganizationAdapter = class {
 		const orgId = String(input.orgId);
 		return retryIdempotentRead(this.#convex.action(this.#fns.readTreasury, copyInvocationObservation(input, { orgId })), CAPXUL_OPERATIONS.org.treasury, this.#telemetry, input).pipe(Effect.mapError((error) => orgErrorFromCapxul("readTreasury", error.publicError, error)), Effect.map((wire) => {
 			if (wire.orgId !== orgId) throw Errors.invalidInput("orgId", "Organization treasury scope does not match");
-			const balance = fromWei(wire.rawBalance, wire.decimals, wire.currency);
-			const available = fromWei(wire.rawAvailableBalance, wire.decimals, wire.currency);
-			return {
-				...brandOrgTreasury({
-					orgId: wire.orgId,
-					money: balance
-				}),
-				available
-			};
+			return brandOrgTreasury({
+				orgId: wire.orgId,
+				balances: accountPositionsFromWire(wire.positions),
+				rates: this.#rates
+			});
 		}));
 	}
 };
@@ -45724,6 +46042,157 @@ function makeAuthMethods(deps) {
 	};
 }
 //#endregion
+//#region ../../packages/sdk/src/surface/client-requests.ts
+function decodeView(body) {
+	try {
+		return {
+			ok: true,
+			value: Schema.decodeUnknownSync(ClientRequestViewSchema)(body)
+		};
+	} catch {
+		return {
+			ok: false,
+			error: Errors.invalidInput("clientRequest", "view is not a closed phase")
+		};
+	}
+}
+function httpError$1(status) {
+	if (status === 401) return {
+		ok: false,
+		error: Errors.notAuthenticated()
+	};
+	if (status === 404) return {
+		ok: false,
+		error: Errors.invalidInput("requestId", "is not a live request")
+	};
+	if (status === 429) return {
+		ok: false,
+		error: Errors.rateLimited({ resource: "clientRequest" })
+	};
+	return {
+		ok: false,
+		error: Errors.networkError("clientRequests")
+	};
+}
+function makeClientRequestMethods(deps) {
+	const fetchImpl = deps.fetch ?? fetch;
+	const urlFor = (path, query) => {
+		const resolved = resolveAuthClientUrl(deps.authBaseUrl, path);
+		return query === void 0 ? resolved : `${resolved}?${query}`;
+	};
+	async function readView(requestId, options) {
+		if (options?.signal?.aborted) return {
+			ok: false,
+			error: Errors.cancelled({ operation: CAPXUL_OPERATIONS.clientRequests.read })
+		};
+		try {
+			const response = await fetchImpl(urlFor("/api/auth/native/request", `requestId=${encodeURIComponent(requestId)}`), {
+				method: "GET",
+				credentials: "include",
+				...options?.signal === void 0 ? {} : { signal: options.signal }
+			});
+			const body = await response.json().catch(() => null);
+			if (!response.ok) {
+				const viewed = decodeView(body);
+				return viewed.ok ? viewed : httpError$1(response.status);
+			}
+			return decodeView(body);
+		} catch (cause) {
+			if (options?.signal?.aborted) return {
+				ok: false,
+				error: Errors.cancelled({ operation: CAPXUL_OPERATIONS.clientRequests.read })
+			};
+			if (isCapxulError(cause)) return {
+				ok: false,
+				error: cause
+			};
+			return {
+				ok: false,
+				error: Errors.networkError("native request read failed")
+			};
+		}
+	}
+	async function postDecision(path, input, options) {
+		if (options?.signal?.aborted) return {
+			ok: false,
+			error: Errors.cancelled({ operation: CAPXUL_OPERATIONS.clientRequests.decide })
+		};
+		try {
+			const response = await fetchImpl(urlFor(path), {
+				method: "POST",
+				credentials: "include",
+				headers: { "content-type": "application/json" },
+				body: JSON.stringify({
+					requestId: input.requestId,
+					revision: input.revision
+				}),
+				...options?.signal === void 0 ? {} : { signal: options.signal }
+			});
+			const viewed = decodeView(await response.json().catch(() => null));
+			if (viewed.ok) return viewed;
+			if (!response.ok) return httpError$1(response.status);
+			return viewed;
+		} catch (cause) {
+			if (options?.signal?.aborted) return {
+				ok: false,
+				error: Errors.cancelled({ operation: CAPXUL_OPERATIONS.clientRequests.decide })
+			};
+			if (isCapxulError(cause)) return {
+				ok: false,
+				error: cause
+			};
+			return {
+				ok: false,
+				error: Errors.networkError("native request decision failed")
+			};
+		}
+	}
+	return {
+		read: (input, options) => readView(input.requestId, options),
+		async sendOtp(input, options) {
+			const view = await readView(input.requestId, options);
+			if (!view.ok) return view;
+			if (view.value.phase !== "otp_required" && view.value.phase !== "review") return {
+				ok: false,
+				error: Errors.wrongState({
+					method: "clientRequests.sendOtp",
+					currentState: view.value.phase,
+					validStates: ["otp_required", "review"]
+				})
+			};
+			const sent = await deps.signIn({ email: view.value.email }, options);
+			if (!sent.ok) return sent;
+			return {
+				ok: true,
+				value: void 0
+			};
+		},
+		async verifyOtp(input, options) {
+			const view = await readView(input.requestId, options);
+			if (!view.ok) return view;
+			if (view.value.phase !== "otp_required" && view.value.phase !== "review") return {
+				ok: false,
+				error: Errors.wrongState({
+					method: "clientRequests.verifyOtp",
+					currentState: view.value.phase,
+					validStates: ["otp_required", "review"]
+				})
+			};
+			const verified = await deps.verifyOtp({
+				email: view.value.email,
+				code: input.code
+			}, options);
+			if (!verified.ok) return verified;
+			return {
+				ok: true,
+				value: void 0
+			};
+		},
+		accept: (input, options) => postDecision("/api/auth/native/request/accept", input, options),
+		cancel: (input, options) => postDecision("/api/auth/native/request/deny", input, options)
+	};
+}
+//#endregion
 //#region ../../packages/sdk/src/surface/smart-account-deps.ts
 /** The single Context tag the `smartAccount.*` methods resolve. */
 var SmartAccountDepsTag = class extends Context.Service()("@capxul/sdk/SmartAccountDeps") {};
@@ -47096,18 +47565,15 @@ var OrgDepsTag = class extends Context.Service()("@capxul/sdk/OrgDeps") {};
 function orgDepsLayer(deps) {
 	return Layer.succeed(OrgDepsTag, deps);
 }
-/** Zero `Money` in the USDX-backed display currency (a fresh Org's treasury). */
-function zeroMoney() {
-	return fromWei("0", 6, "USD");
-}
-/** A fresh Org's treasury Account: `$0` balance, `available === balance`. */
+/** A fresh Org's treasury Account: a zero position per settlement asset. */
 function zeroTreasury(orgId) {
-	const balance = zeroMoney();
-	return {
-		id: toAccountId(`account_${stripPrefix(orgId)}`),
-		balance,
-		available: balance
-	};
+	return accountFromAccountPositions(toAccountId(`account_${stripPrefix(orgId)}`), CONFIGURED_MONEY_ASSETS.map((asset) => ({
+		asset: asset.assetId,
+		symbol: asset.symbol,
+		decimals: asset.decimals,
+		balance: "0",
+		available: "0"
+	})), void 0, MONEY_READ_RATES);
 }
 /** Drop a known `<prefix>_` so the remainder is reusable as another brand seed. */
 function stripPrefix(value) {
@@ -47515,8 +47981,7 @@ function makeOrgMethods(deps) {
 						return {
 							id: treasuryResult.value.id,
 							address: org?.safeAddress ?? null,
-							balance: treasuryResult.value.balance,
-							available: treasuryResult.value.available
+							balances: treasuryResult.value.balances
 						};
 					}), observationOnlyControls(controls), CAPXUL_OPERATIONS.org.account.get, deps.runPromise);
 				} },
@@ -47620,23 +48085,27 @@ const organizationPaymentExecutionUnavailable = () => Promise.resolve({
 const holdingsContract = { current: makeFunctionReference(CAPXUL_FUNCTIONS["holdings/actions"].current) };
 //#endregion
 //#region ../../packages/sdk/src/domain/money/primary-holding.ts
-const CURRENCY_BY_TOKEN_SYMBOL = /* @__PURE__ */ new Map([["USDX", toCurrencyCode("USD")]]);
 /**
-* The designated display asset: the payable row holding the most money, or
-* `null` when no row is payable.
+* The designated display asset: the LOWEST `id` among the renderable rows, or
+* `null` when no row is renderable.
 *
-* A `HoldingRow` (`packages/wire/src/money.ts`) is a RAW CHAIN ROW, and three
-* of its shapes cannot become a `Holding`. Each is SKIPPED rather than
-* reported, because a row nobody can render is not a failure of the read:
+* A `HoldingRow` (`packages/wire/src/money.ts`) is a RAW CHAIN ROW. A native
+* row has no ERC-20 identity; a row with no `decimals` cannot be lifted into
+* major units; a row with no `symbol` cannot be named. Each is SKIPPED rather
+* than reported — a row nobody can render is not a failure of the read.
 *
-*   - no `decimals` — the raw balance cannot be lifted into major units;
-*   - no `symbol` — the asset cannot be named;
-*   - a symbol that stands for no supported `CurrencyCode` — the balance
-*     cannot be stated as `Money` without inventing a currency for it.
+* WHICH row is named is decided by ASSET IDENTITY — ascending `id` — never by
+* quantity. Two rows with different assets are not comparable money, so no
+* quantity can order them: 100 USDC is not "more" than 1 WETH without a rate,
+* and ranking major units would show whatever asset happens to have the most
+* decimal places as "primary". An identity order is arbitrary as well, but it
+* is stable and claims nothing about value. ADR-0028 R6 retires
+* `holdings.primary` outright; this export stays only until that retirement
+* lands with its remaining consumers, so no new policy is invented here.
 *
 * This replaces the app's hand pick in `formatCurrentHoldingsBalance`
 * (`dashboard-formatters.ts`): a `.find()` over a hardcoded `["USDX","USDC"]`
-* list falling back to `rows[0]`. Ties keep the earlier row, so the same
+* list falling back to `rows[0]`. Duplicate ids keep the first row, so the same
 * snapshot always yields the same answer.
 */
 function primaryHolding(rows) {
@@ -47644,37 +48113,21 @@ function primaryHolding(rows) {
 	for (const row of rows) {
 		const holding = toHolding(row);
 		if (holding === null) continue;
-		if (primary === null || compareDecimal(holding.available.value, primary.available.value) > 0) primary = holding;
+		if (primary === null || holding.id < primary.id) primary = holding;
 	}
 	return primary;
 }
 function toHolding(row) {
+	if (row.assetKind !== "erc20") return null;
 	if (row.symbol === void 0 || row.decimals === void 0) return null;
-	const currency = currencyForTokenSymbol(row.symbol);
-	if (currency === null) return null;
 	return {
-		id: row.assetKind === "native" ? "native" : row.tokenAddress.toLowerCase(),
+		id: row.tokenAddress.toLowerCase(),
+		assetKind: row.assetKind,
 		symbol: row.symbol,
-		available: fromWei(row.rawBalance, row.decimals, currency)
+		decimals: row.decimals,
+		value: formatUnits(BigInt(row.rawBalance), row.decimals)
 	};
 }
-function currencyForTokenSymbol(symbol) {
-	return CURRENCY_BY_TOKEN_SYMBOL.get(symbol.toUpperCase()) ?? null;
-}
-/**
-* Order two non-negative major-unit decimal strings without converting either
-* to a JavaScript number. Rows carry different `decimals`, so the raw integers
-* are not comparable: 1999999999 at 9 decimals is LESS than 2000000 at 6.
-*/
-function compareDecimal(first, second) {
-	const [firstWhole = "0", firstFraction = ""] = first.split(".");
-	const [secondWhole = "0", secondFraction = ""] = second.split(".");
-	const width = Math.max(firstFraction.length, secondFraction.length);
-	const firstScaled = BigInt(firstWhole + firstFraction.padEnd(width, "0"));
-	const secondScaled = BigInt(secondWhole + secondFraction.padEnd(width, "0"));
-	if (firstScaled === secondScaled) return 0;
-	return firstScaled < secondScaled ? -1 : 1;
-}
 //#endregion
 //#region ../../packages/sdk/src/surface/holdings.ts
 /** SPEC Freshness: past this block age the read is labelled stale. Nothing refuses. */
@@ -48123,6 +48576,7 @@ const closeClientResources = (close) => toCapxulResult(Effect.promise(close), La
 function assembleCapxulClient(input) {
 	const observation = input;
 	const authCache = input.authCache ?? detectAuthCacheAdapter();
+	const accountSetup = input.accountSetup ?? "automatic";
 	const effectRunner = input.effectRunner ?? {
 		runSync: Effect.runSync,
 		runPromise: Effect.runPromise
@@ -48193,7 +48647,7 @@ function assembleCapxulClient(input) {
 	});
 	kickProvisioning = accountBundle.kickProvisioning;
 	const account = accountBundle.methods;
-	const auth = makeAuthMethods({
+	const authCore = makeAuthMethods({
 		actor,
 		authClient: input.ports.authClient,
 		authCache,
@@ -48211,10 +48665,19 @@ function assembleCapxulClient(input) {
 				}
 				if (browserSigner.statusStore?.status() === "unknown" && typeof browserSigner.ensureWalletReady === "function") browserSigner.ensureWalletReady().catch(() => {});
 			}
+			if (accountSetup === "explicit") return;
 			await detectPendingOrgInvitations?.();
 			kickProvisioning?.();
 		}
 	});
+	const auth = {
+		...authCore,
+		clientRequests: makeClientRequestMethods({
+			authBaseUrl: input.bootstrap.authBaseUrl,
+			signIn: authCore.signIn,
+			verifyOtp: authCore.verifyOtp
+		})
+	};
 	const smartAccount = makeSmartAccountMethods({
 		actor,
 		smartAccountPort: input.ports.smartAccount,
@@ -48378,6 +48841,7 @@ function assembleCapxulClient(input) {
 			...input.ports.indexerRead === void 0 ? {} : { indexer: input.ports.indexerRead },
 			organizationSetup: { getProofReceipt: (orgId) => runPortEffect(input.ports.convexCall.query(organizationSetupProofReceiptQuery, { orgId })) },
 			telemetry: input.ports.telemetry,
+			accountSetup,
 			captureExternalAddressAcknowledged: (address, organizationId) => {
 				const telemetry = input.ports.telemetry;
 				if (telemetry === void 0) return;
@@ -49444,6 +49908,7 @@ async function createCapxulClientWithSignerControls(input, controls) {
 			bootstrap: adapters.value.bootstrap,
 			authCache: adapters.value.ports.authCache,
 			requirement: input.requirement ?? "none",
+			accountSetup: input.accountSetup,
 			...signer === void 0 ? {} : { signer },
 			orgPort: Context.get(adapters.value.context, OrgPortTag),
 			...signer === void 0 ? {} : { organizationSetup: new ConvexOrganizationSetupAdapter({
@@ -49803,11 +50268,27 @@ function captureException(telemetry, error, context) {
 	}).pipe(Effect.flatten), () => Effect.void);
 }
 //#endregion
+//#region src/output.ts
+const writeStdout = (text) => Effect.flatMap(Stdio.Stdio, (stdio) => Stream.run(Stream.make(text), stdio.stdout()));
+const writeStderr = (text) => Effect.flatMap(Stdio.Stdio, (stdio) => Stream.run(Stream.make(text), stdio.stderr()));
+function renderResult(mode, envelope, lines = []) {
+	if (mode === "json") return writeStdout(`${JSON.stringify(envelope)}\n`);
+	return envelope.outcome === "succeeded" ? writeStdout(`${lines.join("\n")}\n`) : writeStderr(`${envelope.error.code}: ${envelope.error.message}\n`);
+}
+//#endregion
 //#region src/platform/observation-identity.ts
 const uuid = Schema.String.check(Schema.isPattern(/^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/u));
-const person = Schema.String.check(Schema.isPattern(/^[^\s]{1,256}$/u));
+/**
+* One definition of the person a binding can hold.
+*
+* Exported so every CLI site that accepts or projects a verified person uses the
+* same rule this store enforces. A site that hand-rolls a looser check could
+* admit a person this store then refuses to decode, which would leave protected
+* state un-storable rather than merely wrong.
+*/
+const ObservationPerson = Schema.String.check(Schema.isPattern(/^[^\s]{1,256}$/u));
 const binding = Schema.Struct({
-	authUserId: person,
+	authUserId: ObservationPerson,
 	eventId: uuid
 });
 const epoch = Schema.Struct({
@@ -49827,7 +50308,7 @@ const ObservationIdentityChange = Schema.Union([
 	Schema.Struct({
 		kind: Schema.Literal("bind"),
 		expectedEpoch: uuid,
-		authUserId: person
+		authUserId: ObservationPerson
 	}),
 	Schema.Struct({
 		kind: Schema.Literal("rotate"),
@@ -49958,7 +50439,7 @@ const readFile = (file) => Effect.gen(function* () {
 });
 const storageError = (error) => error._tag === "StateFileError" ? error : fail("Io");
 const decodeSettings = Schema.decodeUnknownEffect(Schema.fromJsonString(Settings), { onExcessProperty: "error" });
-Schema.decodeUnknownEffect(Schema.fromJsonString(PrivateRecord), { onExcessProperty: "error" });
+const decodeRecord = Schema.decodeUnknownEffect(Schema.fromJsonString(PrivateRecord), { onExcessProperty: "error" });
 const readSettings = (file) => Effect.gen(function* () {
 	const location = yield* locate(file, false).pipe(Effect.catchTag("PlatformError", (error) => error.reason._tag === "NotFound" ? Effect.succeed(null) : Effect.fail(error)));
 	if (location === null) return null;
@@ -50054,11 +50535,59 @@ const setCollectionEnabled = (file, enabled) => Effect.gen(function* () {
 	})));
 	return settings;
 }).pipe(Effect.mapError(storageError));
-const changeObservationIdentity = (directory, input) => Effect.gen(function* () {
+const recordLocation = (directory, scope) => Effect.gen(function* () {
+	const path = yield* Path.Path;
+	const crypto = yield* Crypto.Crypto;
+	const valid = yield* Schema.decodeUnknownEffect(PrivateRecordScope, { onExcessProperty: "error" })(scope).pipe(Effect.mapError(() => fail("Corrupt")));
+	const encoded = JSON.stringify([
+		valid.application,
+		valid.issuer,
+		valid.environment,
+		valid.person
+	]);
+	const hash = yield* crypto.digest("SHA-256", new TextEncoder().encode(encoded));
+	return path.join(directory, `${Array.from(hash, (byte) => byte.toString(16).padStart(2, "0")).join("")}.json`);
+});
+const readPrivateRecord = (directory, scope) => Effect.gen(function* () {
+	const file = yield* recordLocation(directory, scope);
+	const location = yield* locate(file, false).pipe(Effect.catchTag("PlatformError", (error) => error.reason._tag === "NotFound" ? Effect.succeed(null) : Effect.fail(error)));
+	if (location === null) return null;
+	const content = yield* readFile(location);
+	if (content === null) return null;
+	const record = yield* decodeRecord(content).pipe(Effect.mapError(() => fail("Corrupt")));
+	if (Object.keys(scope).some((key) => Reflect.get(scope, key) !== Reflect.get(record.scope, key))) return yield* Effect.fail(fail("Corrupt"));
+	return record.value;
+}).pipe(Effect.mapError(storageError));
+const writePrivateRecord = (directory, scope, value) => Effect.gen(function* () {
+	const file = yield* recordLocation(directory, scope);
+	const location = yield* locate(file, true);
+	yield* replace(location, readPrivateRecord(directory, scope).pipe(Effect.as({
+		content: JSON.stringify({
+			version: 1,
+			scope,
+			value
+		}),
+		value: void 0
+	})));
+}).pipe(Effect.mapError(storageError));
+/**
+* `confirm` is evaluated under this record's lock, so it cannot be separated
+* from the write it gates. A guard checked before the lock is only a snapshot:
+* by the time the transition runs, the world it inspected can have changed.
+*
+* Its error channel is `never` on purpose. A guard that cannot answer must mean
+* "refuse the change", never "fail the operation" — and refusing returns `stale`,
+* the answer an epoch CAS already returns, so callers handle both alike.
+*/
+const changeObservationIdentity = (directory, input, confirm = Effect.succeed(true)) => Effect.gen(function* () {
 	const change = yield* Schema.decodeUnknownEffect(ObservationIdentityChange, { onExcessProperty: "error" })(input).pipe(Effect.mapError(() => fail("Corrupt")));
 	const path = yield* Path.Path;
 	const location = yield* locate(path.join(directory, "observation.json"), true);
 	return yield* replace(location, Effect.gen(function* () {
+		if (!(yield* confirm)) return {
+			content: null,
+			value: { status: "stale" }
+		};
 		const content = yield* readFile(location);
 		const previous = content === null ? null : yield* Schema.decodeUnknownEffect(Schema.fromJsonString(ObservationIdentity), { onExcessProperty: "error" })(content).pipe(Effect.mapError(() => fail("Corrupt")));
 		const crypto = yield* Crypto.Crypto;
@@ -50073,64 +50602,104 @@ const changeObservationIdentity = (directory, input) => Effect.gen(function* ()
 		};
 	}));
 }).pipe(Effect.mapError(storageError));
-/** Call only for eligible collection. This never infers AUTH identity from stored state. */
-const acquireObservationIdentity = (directory) => changeObservationIdentity(directory, { kind: "acquire" });
-//#endregion
-//#region src/platform/collection-policy.ts
-const decode = Schema.decodeUnknownOption(Schema.fromJsonString(Settings), { onExcessProperty: "error" });
-const missing = (error) => error instanceof Error && "code" in error && error.code === "ENOENT";
-const resolveProtectedDirectory = (directory, uid) => {
-	const stateDirectory = lstatSync(directory, { throwIfNoEntry: false });
-	if (stateDirectory && (!stateDirectory.isDirectory() || stateDirectory.uid !== uid || (stateDirectory.mode & 511) !== 448)) return null;
-	let ancestor = directory;
-	while (!lstatSync(ancestor, { throwIfNoEntry: false })) ancestor = dirname(ancestor);
-	ancestor = realpathSync(ancestor);
-	const canonicalDirectory = ancestor;
-	while (true) {
-		const info = statSync(ancestor);
-		if (!info.isDirectory() || info.uid !== 0 && info.uid !== uid || (info.mode & 18) !== 0 && (info.mode & 512) === 0) return null;
-		const parent = dirname(ancestor);
-		if (parent === ancestor) break;
-		ancestor = parent;
-	}
-	return stateDirectory ? canonicalDirectory : void 0;
-};
-const collectionPolicy = (settingsPath, forcedDisabled) => () => {
-	if (forcedDisabled) return false;
-	let descriptor;
-	try {
-		const uid = process$1.getuid?.();
-		if (uid === void 0) return false;
-		const file = resolve$1(settingsPath);
-		const directory = dirname(file);
-		const canonicalDirectory = resolveProtectedDirectory(directory, uid);
-		if (canonicalDirectory === null) return false;
-		if (canonicalDirectory === void 0) return true;
-		try {
-			descriptor = openSync(join(canonicalDirectory, basename(file)), constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK);
-		} catch (error) {
-			return missing(error);
-		}
-		const info = fstatSync(descriptor);
-		if (!info.isFile() || info.uid !== uid || (info.mode & 511) !== 384 || info.nlink !== 1 || info.size > 65536) return false;
-		const bytes = Buffer.alloc(65537);
-		let length = 0;
-		while (length < bytes.length) {
-			const count = readSync(descriptor, bytes, length, bytes.length - length, null);
-			if (count === 0) break;
-			length += count;
-		}
-		if (length > 65536) return false;
-		const settings = decode(bytes.toString("utf8", 0, length));
-		return Option.isSome(settings) && settings.value.collection.enabled;
-	} catch {
-		return false;
-	} finally {
-		if (descriptor !== void 0) try {
-			closeSync(descriptor);
-		} catch {}
-	}
-};
+/**
+* The invocation-start snapshot: one locked read that acquires an epoch only when
+* none is bound.
+*
+* `acquire` rotates a bound epoch by design, because an anonymous caller must
+* never inherit a person's ID. An ordinary invocation from an already signed-in
+* person is not that transition, so it must not rotate — otherwise every command
+* run after login would unbind them. Deciding between the two needs the lock:
+* a pre-lock snapshot must never decide an identity binding.
+*
+* This reads the stored binding for observation bookkeeping only. It does not
+* make the person authenticated and never re-verifies a grant.
+*/
+const snapshotInvocationIdentity = (directory) => Effect.gen(function* () {
+	const path = yield* Path.Path;
+	const location = yield* locate(path.join(directory, "observation.json"), true);
+	return yield* replace(location, Effect.gen(function* () {
+		const content = yield* readFile(location);
+		const previous = content === null ? null : yield* Schema.decodeUnknownEffect(Schema.fromJsonString(ObservationIdentity), { onExcessProperty: "error" })(content).pipe(Effect.mapError(() => fail("Corrupt")));
+		if (previous !== null && previous.epoch.binding !== null) return {
+			content: null,
+			value: {
+				status: "ready",
+				firstUse: previous.firstUse,
+				firstUseClaimed: false,
+				epoch: previous.epoch
+			}
+		};
+		const crypto = yield* Crypto.Crypto;
+		const next = transitionObservationIdentity(previous, { kind: "acquire" }, {
+			epochId: yield* crypto.randomUUIDv4,
+			eventId: yield* crypto.randomUUIDv4,
+			observedAt: yield* Clock.currentTimeMillis
+		});
+		return {
+			content: next.state === previous ? null : JSON.stringify(next.state),
+			value: next.result
+		};
+	}));
+}).pipe(Effect.mapError(storageError));
+/**
+* The supplied person is verified by AUTH, not by this observation store.
+*
+* `confirm` lets AUTH re-check its own facts under this record's lock, which is
+* the only place a sign-in and a sign-out are guaranteed to serialize. The epoch
+* CAS alone cannot close that race: a sign-out that finds the epoch still
+* anonymous leaves it byte-identical rather than rotating it, so an epoch
+* snapshotted before a network call is still the expected one afterwards.
+*/
+const bindObservationIdentity = (directory, expectedEpoch, authUserId, confirm = Effect.succeed(true)) => changeObservationIdentity(directory, {
+	kind: "bind",
+	expectedEpoch,
+	authUserId
+}, confirm);
+/**
+* Drop the person binding at sign-out. Reports whether anything was cleared.
+*
+* A rotate has to name the epoch it expects to replace. Reading that epoch and
+* rotating it in a second locked step leaves a gap: a concurrent sign-in can bind
+* a person in between, and the rotate then refuses the changed epoch, so the
+* sign-out quietly leaves a person bound. Reading and rotating under one lock
+* closes the gap, which is why this is not `rotateObservationIdentity` plus a
+* snapshot.
+*
+* Unlike every acquire path here, this never creates observation state. A user
+* who declined collection has no observation file, and signing out must not hand
+* them one — or a directory to put it in.
+*/
+const clearObservationBinding = (directory) => Effect.gen(function* () {
+	const path = yield* Path.Path;
+	const location = yield* locate(path.join(directory, "observation.json"), false).pipe(Effect.catchTag("PlatformError", (error) => error.reason._tag === "NotFound" ? Effect.succeed(null) : Effect.fail(error)));
+	if (location === null) return false;
+	return yield* replace(location, Effect.gen(function* () {
+		const content = yield* readFile(location);
+		if (content === null) return {
+			content: null,
+			value: false
+		};
+		const previous = yield* Schema.decodeUnknownEffect(Schema.fromJsonString(ObservationIdentity), { onExcessProperty: "error" })(content).pipe(Effect.mapError(() => fail("Corrupt")));
+		if (previous.epoch.binding === null) return {
+			content: null,
+			value: false
+		};
+		const crypto = yield* Crypto.Crypto;
+		const next = transitionObservationIdentity(previous, {
+			kind: "rotate",
+			expectedEpoch: previous.epoch.id
+		}, {
+			epochId: yield* crypto.randomUUIDv4,
+			eventId: yield* crypto.randomUUIDv4,
+			observedAt: yield* Clock.currentTimeMillis
+		});
+		return {
+			content: next.state === previous ? null : JSON.stringify(next.state),
+			value: next.result.status === "ready"
+		};
+	}));
+}).pipe(Effect.mapError(storageError));
 //#endregion
 //#region src/runtime/errors.ts
 var CliFailure = class extends Data.TaggedError("CliFailure") {};
@@ -50183,74 +50752,396 @@ function parsedCommand(cause) {
 	return CliError.isCliError(error) && error._tag === "ShowHelp" ? error.commandPath.slice(1).join(".") || "capxul" : "capxul";
 }
 //#endregion
-//#region src/runtime/config.ts
-const defaultHost = "https://us.i.posthog.com";
-const defaultProjectToken = Redacted.make("phc_BZuAVofrkNXzwpJkuDG7Rdfurir45fj2dudQvJZk847e");
-const optionalText = (name) => Config.option(Config.string(name));
-function httpOrigin(value, field) {
-	return Effect.try({
-		try: () => {
-			const url = new URL(value);
-			const local = url.hostname === "localhost" || url.hostname === "127.0.0.1" || url.hostname === "[::1]";
-			if (!local && url.protocol !== "https:" || local && !["http:", "https:"].includes(url.protocol) || url.username || url.password || url.search || url.hash || url.pathname !== "/") throw new Error();
-			if (field === "bootstrap" && /\.convex\.(cloud|site)$/.test(url.hostname)) throw new Error();
-			return url.origin;
-		},
-		catch: () => configurationFailure(`The ${field} URL must be a valid approved origin.`)
-	});
-}
-const loadObservationConfig = Effect.gen(function* () {
-	const path = yield* Path.Path;
-	const values = yield* Config.all({
-		cliHome: optionalText("CAPXUL_CLI_HOME"),
-		home: optionalText("HOME"),
-		xdg: optionalText("XDG_CONFIG_HOME"),
-		host: optionalText("CAPXUL_POSTHOG_HOST"),
-		token: Config.option(Config.redacted("CAPXUL_POSTHOG_PROJECT_TOKEN")),
-		disabled: Config.boolean("CAPXUL_TELEMETRY_DISABLED").pipe(Config.withDefault(false))
-	}).pipe(Effect.mapError(() => configurationFailure("CLI environment configuration is invalid.")));
-	let directory = Option.getOrUndefined(values.cliHome);
-	if (directory === void 0) {
-		const configHome = Option.getOrUndefined(values.xdg);
-		const home = Option.getOrUndefined(values.home);
-		if (configHome !== void 0) directory = path.join(configHome, "capxul", "cli");
-		else if (home !== void 0) directory = path.join(home, ".config", "capxul", "cli");
-		else return yield* Effect.fail(configurationFailure("Set HOME or CAPXUL_CLI_HOME."));
-	}
-	const settingsPath = path.join(path.resolve(directory), "settings.json");
-	const host = Option.getOrUndefined(values.host) ?? defaultHost;
+//#region src/auth/native-http.ts
+const NATIVE_CLIENT_ID = "capxul-cli";
+var NativeHttpError = class extends Data.TaggedError("NativeHttpError") {};
+const DEVICE_GRANT = "urn:ietf:params:oauth:grant-type:device_code";
+function originPath(origin, path) {
+	return `${origin.replace(/\/$/, "")}/api/auth/native${path}`;
+}
+async function readJson(response) {
+	return response.json().catch(() => null);
+}
+function asNonEmptyString(value) {
+	return typeof value === "string" && value.length > 0 ? value : null;
+}
+function asFiniteNumber(value) {
+	return typeof value === "number" && Number.isFinite(value) ? value : null;
+}
+function decodeStarted(body) {
+	const requestId = asNonEmptyString(body.requestId);
+	const deviceCode = asNonEmptyString(body.device_code);
+	const verificationUri = asNonEmptyString(body.verification_uri);
+	const expiresIn = asFiniteNumber(body.expires_in);
+	const interval = asFiniteNumber(body.interval);
+	if (requestId === null || deviceCode === null || verificationUri === null || expiresIn === null || expiresIn < 0 || interval === null || interval < 0) return null;
 	return {
-		settingsPath,
-		environment: "staging",
-		posthogHost: host === void 0 ? void 0 : yield* httpOrigin(host, "PostHog"),
-		projectToken: Option.getOrUndefined(values.token) ?? defaultProjectToken,
-		forcedDisabled: values.disabled,
-		collectionEnabled: collectionPolicy(settingsPath, values.disabled)
+		requestId,
+		deviceCode,
+		verificationUri,
+		expiresIn,
+		interval
+	};
+}
+function decodeGrant(body) {
+	const grantId = asNonEmptyString(body.grantId);
+	const email = asNonEmptyString(body.email);
+	const accessToken = asNonEmptyString(body.access_token);
+	const refreshToken = asNonEmptyString(body.refresh_token);
+	const revision = asFiniteNumber(body.revision);
+	const accessExpiresAt = asFiniteNumber(body.accessExpiresAt);
+	const renewalExpiresAt = asFiniteNumber(body.renewalExpiresAt);
+	const absoluteExpiresAt = asFiniteNumber(body.absoluteExpiresAt);
+	if (grantId === null || email === null || accessToken === null || refreshToken === null || revision === null || accessExpiresAt === null || renewalExpiresAt === null || absoluteExpiresAt === null) return null;
+	return {
+		grantId,
+		revision,
+		email,
+		accessToken,
+		refreshToken,
+		accessExpiresAt,
+		renewalExpiresAt,
+		absoluteExpiresAt
 	};
+}
+const startNativeRequest = (input) => Effect.tryPromise({
+	try: async () => {
+		const response = await fetch(originPath(input.origin, "/device/code"), {
+			method: "POST",
+			headers: { "content-type": "application/json" },
+			body: JSON.stringify({
+				clientId: NATIVE_CLIENT_ID,
+				email: input.email,
+				intent: input.intent,
+				waitMs: input.waitMs
+			}),
+			...input.signal === void 0 ? {} : { signal: input.signal }
+		});
+		const body = await readJson(response);
+		const started = body === null ? null : decodeStarted(body);
+		if (!response.ok || started === null) throw new NativeHttpError({
+			reason: (typeof body?.error === "string" ? body.error : "invalid_request") === "slow_down" ? "slow_down" : "invalid_request",
+			...typeof body?.retry_after === "number" ? { retryAfterMs: body.retry_after * 1e3 } : {}
+		});
+		return started;
+	},
+	catch: (cause) => cause instanceof NativeHttpError ? cause : new NativeHttpError({ reason: "network" })
 });
-const loadConfig = Effect.gen(function* () {
-	const observation = yield* loadObservationConfig;
-	const values = yield* Config.all({
-		key: Config.option(Config.redacted("CAPXUL_PUBLISHABLE_KEY")),
-		bootstrap: Config.string("CAPXUL_BOOTSTRAP_URL").pipe(Config.withDefault("https://api.staging.capxul.com"))
-	}).pipe(Effect.mapError(() => configurationFailure("CLI environment configuration is invalid.")));
-	const bootstrapBaseUrl = yield* httpOrigin(values.bootstrap, "bootstrap");
-	return {
-		...observation,
-		bootstrapBaseUrl,
-		publishableKey: Option.getOrUndefined(values.key)
+const pollNativeToken = (input) => Effect.tryPromise({
+	try: async () => {
+		const response = await fetch(originPath(input.origin, "/token"), {
+			method: "POST",
+			headers: { "content-type": "application/json" },
+			body: JSON.stringify({
+				client_id: NATIVE_CLIENT_ID,
+				grant_type: DEVICE_GRANT,
+				device_code: input.deviceCode
+			}),
+			...input.signal === void 0 ? {} : { signal: input.signal }
+		});
+		const body = await readJson(response);
+		if (response.status === 400 && body?.error === "authorization_pending") throw new NativeHttpError({ reason: "authorization_pending" });
+		if (response.status === 429 || body?.error === "slow_down") throw new NativeHttpError({
+			reason: "slow_down",
+			retryAfterMs: typeof body?.retry_after === "number" ? body.retry_after * 1e3 : 5e3
+		});
+		const grant = body === null ? null : decodeGrant(body);
+		if (!response.ok || grant === null) {
+			const error = typeof body?.error === "string" ? body.error : "invalid_request";
+			throw new NativeHttpError({ reason: error === "access_denied" || error === "expired_token" ? error : "invalid_request" });
+		}
+		return grant;
+	},
+	catch: (cause) => cause instanceof NativeHttpError ? cause : new NativeHttpError({ reason: "network" })
+});
+/**
+* The protected store's own rule, so anything accepted here can also be stored.
+* Returns the validated person rather than a boolean, so the caller cannot
+* forward a value that only passed a shape check.
+*/
+const verifiedPerson = (value) => Schema.decodeUnknownOption(ObservationPerson)(value);
+/**
+* Ask the issuer which verified person a stored access token belongs to.
+*
+* Observation never decodes a token to invent authority and never uses an email
+* as a person. `authUserId` therefore comes from the issuer alone: it re-verifies
+* the JWT and reads the grant row. The active response also carries the email,
+* account, application, resource and scope — this decode keeps the subject and
+* drops all of it.
+*
+* An inactive grant is a valid answer rather than a transport failure, so callers
+* can treat `{active: false}` as "stay anonymous" without error handling.
+*/
+const resolveNativeSession = (input) => Effect.tryPromise({
+	try: async () => {
+		const response = await fetch(originPath(input.origin, "/session"), {
+			method: "POST",
+			headers: { "content-type": "application/json" },
+			body: JSON.stringify({
+				client_id: NATIVE_CLIENT_ID,
+				token: input.accessToken
+			}),
+			...input.signal === void 0 ? {} : { signal: input.signal }
+		});
+		const body = await readJson(response);
+		if (response.status === 503) throw new NativeHttpError({ reason: "network" });
+		if (!response.ok || body === null) {
+			const error = typeof body?.error === "string" ? body.error : "invalid_request";
+			throw new NativeHttpError({ reason: error === "access_denied" || error === "expired_token" ? error : "invalid_request" });
+		}
+		if (body.active === false) return { active: false };
+		if (body.active !== true) throw new NativeHttpError({ reason: "invalid_request" });
+		const authUserId = verifiedPerson(body.authUserId);
+		if (Option.isNone(authUserId)) throw new NativeHttpError({ reason: "invalid_request" });
+		return {
+			active: true,
+			authUserId: authUserId.value
+		};
+	},
+	catch: (cause) => cause instanceof NativeHttpError ? cause : new NativeHttpError({ reason: "network" })
+});
+const revokeNativeGrant = (input) => Effect.tryPromise({
+	try: async () => {
+		if (!(await fetch(originPath(input.origin, "/revoke"), {
+			method: "POST",
+			headers: { "content-type": "application/json" },
+			body: JSON.stringify({
+				client_id: NATIVE_CLIENT_ID,
+				token: input.token,
+				token_type_hint: input.hint
+			}),
+			...input.signal === void 0 ? {} : { signal: input.signal }
+		})).ok) throw new NativeHttpError({ reason: "network" });
+	},
+	catch: (cause) => cause instanceof NativeHttpError ? cause : new NativeHttpError({ reason: "network" })
+});
+//#endregion
+//#region src/auth/session.ts
+const StoredGrant = Schema.Struct({
+	version: Schema.Literal(1),
+	tombstone: Schema.optional(Schema.Boolean),
+	grantId: Schema.optional(Schema.String),
+	revision: Schema.optional(Schema.Number),
+	email: Schema.optional(Schema.String),
+	accessToken: Schema.optional(Schema.String),
+	refreshToken: Schema.optional(Schema.String),
+	accessExpiresAt: Schema.optional(Schema.Number),
+	renewalExpiresAt: Schema.optional(Schema.Number),
+	absoluteExpiresAt: Schema.optional(Schema.Number)
+});
+const scopeFor = (config, person) => ({
+	application: "capxul-cli",
+	issuer: config.bootstrapBaseUrl,
+	environment: config.environment,
+	person
+});
+const recordsDir = (config) => Effect.map(Path.Path, (path) => path.join(path.dirname(config.settingsPath), "private"));
+const loadGrant = (config, email) => Effect.gen(function* () {
+	const directory = yield* recordsDir(config);
+	const value = yield* readPrivateRecord(directory, scopeFor(config, email.toLowerCase()));
+	if (value === null) return null;
+	return yield* Schema.decodeUnknownEffect(StoredGrant, { onExcessProperty: "error" })(JSON.parse(value));
+});
+const saveGrant = (config, grant) => Effect.gen(function* () {
+	const directory = yield* recordsDir(config);
+	const stored = {
+		version: 1,
+		grantId: grant.grantId,
+		revision: grant.revision,
+		email: grant.email,
+		accessToken: grant.accessToken,
+		refreshToken: grant.refreshToken,
+		accessExpiresAt: grant.accessExpiresAt,
+		renewalExpiresAt: grant.renewalExpiresAt,
+		absoluteExpiresAt: grant.absoluteExpiresAt
+	};
+	yield* writePrivateRecord(directory, scopeFor(config, grant.email.toLowerCase()), JSON.stringify(stored));
+});
+const tombstoneGrant = (config, email) => Effect.gen(function* () {
+	const directory = yield* recordsDir(config);
+	const previous = yield* loadGrant(config, email);
+	const stored = {
+		version: 1,
+		tombstone: true,
+		email: email.toLowerCase(),
+		grantId: previous?.grantId
 	};
+	yield* writePrivateRecord(directory, scopeFor(config, email.toLowerCase()), JSON.stringify(stored));
+	return previous;
 });
-const collectionStatus = (config) => Effect.gen(function* () {
-	const stored = (yield* readSettings(config.settingsPath))?.collection.enabled ?? null;
-	const enabled = config.collectionEnabled();
-	const configured = config.posthogHost !== void 0 && config.projectToken !== void 0;
+const storedGrantSecrets = (stored) => stored !== null && stored.tombstone !== true && typeof stored.grantId === "string" && stored.grantId.length > 0 && typeof stored.revision === "number" && Number.isFinite(stored.revision) && typeof stored.email === "string" && stored.email.length > 0 && typeof stored.accessToken === "string" && stored.accessToken.length > 0 && typeof stored.refreshToken === "string" && stored.refreshToken.length > 0 && typeof stored.accessExpiresAt === "number" && Number.isFinite(stored.accessExpiresAt) && typeof stored.renewalExpiresAt === "number" && Number.isFinite(stored.renewalExpiresAt) && typeof stored.absoluteExpiresAt === "number" && Number.isFinite(stored.absoluteExpiresAt);
+const usableGrant = (stored, now = Date.now()) => storedGrantSecrets(stored) && now < stored.renewalExpiresAt && now < stored.absoluteExpiresAt;
+//#endregion
+//#region src/auth/workflow.ts
+const missingEmail = new CliFailure({
+	code: "CLI_USAGE",
+	message: "Provide --email. Non-interactive runs cannot prompt.",
+	exitCode: 2,
+	outcome: "refused"
+});
+const toFailure = (error) => new CliFailure({
+	code: error.reason === "access_denied" || error.reason === "expired_token" ? "NOT_AUTHENTICATED" : error.reason === "network" ? "NETWORK_ERROR" : "CLI_USAGE",
+	message: error.reason === "access_denied" ? "The request was denied." : error.reason === "expired_token" ? "The request expired before it was approved." : error.reason === "network" ? "The Capxul issuer could not be reached." : "The native authorization request was refused.",
+	exitCode: error.reason === "network" ? 5 : 3,
+	outcome: "refused"
+});
+const pollUntilGranted = (origin, deviceCode, intervalSeconds) => pollNativeToken({
+	origin,
+	deviceCode
+}).pipe(Effect.catchTag("NativeHttpError", (error) => {
+	if (error.reason === "authorization_pending" || error.reason === "slow_down") return pollUntilGranted(origin, deviceCode, intervalSeconds).pipe(Effect.delay(Duration.millis(error.retryAfterMs ?? Math.max(intervalSeconds * 1e3, 1))));
+	return Effect.fail(toFailure(error));
+}));
+/** The same eligibility gate invocation-start observation uses. */
+const observationEligible = (config) => config.posthogHost !== void 0 && config.projectToken !== void 0 && config.collectionEnabled();
+/**
+* The deadline for asking the issuer who a grant belongs to.
+*
+* Short by design: this runs after the grant is stored, so a person is signed in
+* whether or not it answers. It bounds observation bookkeeping, not an operation
+* the user is waiting on, so it is deliberately far below the online diagnostic
+* deadline. A missed deadline costs one anonymous epoch, nothing else.
+*/
+const OBSERVATION_BIND_TIMEOUT_MS = 5e3;
+/**
+* Whether the grant this bind was resolved for is still the signed-in one.
+*
+* Evaluated by the observation store under its own record lock, which is the
+* only place a sign-in and a sign-out serialize. The epoch CAS cannot substitute
+* for this: signing out of an epoch that is still anonymous leaves it
+* byte-identical rather than rotating it, so an epoch snapshotted before the
+* person lookup is still the expected one after a sign-out completed during it —
+* and the bind would persist a person who is no longer signed in.
+*
+* The comparison is the one `refreshIfDue` already makes before trusting a
+* rotated grant. An unreadable record answers `false`: a guard that cannot
+* confirm must refuse the bind, never fail the sign-in.
+*/
+const grantStillCurrent = (config, grant) => loadGrant(config, grant.email).pipe(Effect.map((stored) => storedGrantSecrets(stored) && stored.grantId === grant.grantId && stored.revision === grant.revision && stored.refreshToken === grant.refreshToken), Effect.catch(() => Effect.succeed(false)));
+/**
+* Connect this device's eligible anonymous epoch to the person AUTH verified.
+*
+* The person comes from the issuer's session endpoint, never from the stored
+* grant: observation does not decode a token to invent authority and does not
+* use an email as a person. The grant supplies only the credential to present.
+*
+* Best effort in both directions. An unreachable issuer, an inactive grant or a
+* lost binding race leaves the person signed in and the epoch anonymous, so
+* observation can never fail or delay an AUTH transition.
+*/
+const bindObservationToPerson = (config, grant) => Effect.gen(function* () {
+	if (!observationEligible(config)) return;
+	const directory = (yield* Path.Path).dirname(config.settingsPath);
+	const snapshot = yield* snapshotInvocationIdentity(directory);
+	if (snapshot.status !== "ready") return;
+	const session = yield* resolveNativeSession({
+		origin: config.bootstrapBaseUrl,
+		accessToken: grant.accessToken,
+		signal: AbortSignal.timeout(OBSERVATION_BIND_TIMEOUT_MS)
+	}).pipe(Effect.timeoutOption(Duration.millis(OBSERVATION_BIND_TIMEOUT_MS)));
+	if (Option.isNone(session)) return;
+	if (!session.value.active || session.value.authUserId === void 0) return;
+	yield* bindObservationIdentity(directory, snapshot.epoch.id, session.value.authUserId, grantStillCurrent(config, grant));
+}).pipe(Effect.ignore);
+/**
+* Disconnect observation at the approved sign-out transition.
+*
+* Rotating replaces the bound epoch with a fresh anonymous one, so later
+* invocations project as anonymous again. It never touches the collection
+* setting: AUTH sign-out does not re-enable collection.
+*
+* Not gated on collection eligibility, unlike binding. A person can sign in while
+* collection is on, turn collection off, then sign out — and a gate here would
+* leave their verified identity persisted. Re-enable collection later and every
+* signed-out command projects as that person. Sign-out must drop the binding
+* whatever the current configuration says, and must do so without creating
+* observation state for a user who never had any.
+*/
+const unbindObservation = (config) => Effect.gen(function* () {
+	const path = yield* Path.Path;
+	yield* clearObservationBinding(path.dirname(config.settingsPath));
+}).pipe(Effect.ignore);
+const reportGrant = (grant, waiting) => ({
+	data: {
+		email: grant.email,
+		grantId: grant.grantId,
+		revision: grant.revision,
+		accessExpiresAt: grant.accessExpiresAt
+	},
+	lines: [waiting, `Signed in as ${grant.email}.`]
+});
+const login = (config, email) => Effect.gen(function* () {
+	if (email === void 0 || email.trim().length === 0) return yield* Effect.fail(missingEmail);
+	const started = yield* startNativeRequest({
+		origin: config.bootstrapBaseUrl,
+		email,
+		intent: { mode: "login" },
+		waitMs: 6e5
+	}).pipe(Effect.mapError((error) => toFailure(error)));
+	yield* writeStderr(`Open ${started.verificationUri}?requestId=${started.requestId} to continue.\n`).pipe(Effect.catchCause(() => Effect.void));
+	const grant = yield* pollUntilGranted(config.bootstrapBaseUrl, started.deviceCode, started.interval);
+	yield* saveGrant(config, grant);
+	yield* bindObservationToPerson(config, grant);
+	return reportGrant(grant, `Open ${started.verificationUri} to continue.`);
+});
+const signup = (config, input) => Effect.gen(function* () {
+	if (input.email === void 0 || input.displayName === void 0 || input.handle === void 0 || input.country === void 0) return yield* Effect.fail(missingEmail);
+	const started = yield* startNativeRequest({
+		origin: config.bootstrapBaseUrl,
+		email: input.email,
+		intent: {
+			mode: "signup",
+			profile: {
+				displayName: input.displayName,
+				handle: input.handle,
+				country: input.country
+			}
+		},
+		waitMs: 6e5
+	}).pipe(Effect.mapError((error) => toFailure(error)));
+	yield* writeStderr(`Open ${started.verificationUri}?requestId=${started.requestId} to continue.\n`).pipe(Effect.catchCause(() => Effect.void));
+	const grant = yield* pollUntilGranted(config.bootstrapBaseUrl, started.deviceCode, started.interval);
+	yield* saveGrant(config, grant);
+	yield* bindObservationToPerson(config, grant);
+	return reportGrant(grant, `Open ${started.verificationUri} to continue.`);
+});
+const status$1 = (config, email) => Effect.gen(function* () {
+	if (email === void 0) return yield* Effect.fail(missingEmail);
+	const stored = yield* loadGrant(config, email);
+	if (!usableGrant(stored)) return {
+		data: {
+			authenticated: false,
+			email: email.toLowerCase()
+		},
+		lines: ["Not signed in."]
+	};
 	return {
-		stored,
-		enabled,
-		configured,
-		effective: enabled && configured,
-		reason: config.forcedDisabled ? "environment" : !enabled ? "disabled" : !configured ? "not_configured" : "enabled"
+		data: {
+			authenticated: true,
+			email: stored.email,
+			grantId: stored.grantId,
+			revision: stored.revision,
+			accessExpiresAt: stored.accessExpiresAt
+		},
+		lines: [`Signed in as ${stored.email}.`]
+	};
+});
+const logout = (config, email) => Effect.gen(function* () {
+	if (email === void 0) return yield* Effect.fail(missingEmail);
+	const previous = yield* tombstoneGrant(config, email);
+	if (storedGrantSecrets(previous)) yield* unbindObservation(config);
+	let remote = "confirmed";
+	if (previous !== null && storedGrantSecrets(previous)) remote = yield* revokeNativeGrant({
+		origin: config.bootstrapBaseUrl,
+		token: previous.refreshToken,
+		hint: "refresh_token"
+	}).pipe(Effect.as("confirmed"), Effect.catch(() => Effect.succeed("unconfirmed")));
+	return {
+		data: {
+			email: email.toLowerCase(),
+			remote
+		},
+		lines: remote === "confirmed" ? ["Signed out."] : ["Signed out locally. Remote revoke was not confirmed."]
 	};
 });
 //#endregion
@@ -50315,6 +51206,11 @@ function observeInvocation(input, work) {
 		if (input.kind === "completion" || input.kind === "collection_control" || input.host === void 0 || input.projectToken === void 0 || !enabled()) return inactiveWork;
 		const host = input.host;
 		const token = Redacted.value(input.projectToken);
+		const binding = input.identifiedPerson;
+		const identifiedPerson = binding === void 0 || input.anonymousIdentity === void 0 ? void 0 : Schema.decodeUnknownOption(ObservationPerson)(binding.authUserId).pipe(Option.map((authUserId) => ({
+			authUserId,
+			eventId: binding.eventId
+		})), Option.getOrUndefined);
 		let engineering;
 		try {
 			Schema.decodeUnknownSync(identifier)(input.invocationId);
@@ -50346,7 +51242,14 @@ function observeInvocation(input, work) {
 				const started = clock.currentTimeMillisUnsafe();
 				let dropped = 0;
 				let pendingCaptures = 0;
-				const envelope = {
+				const identityProps = input.anonymousIdentity === void 0 ? {} : identifiedPerson === void 0 ? {
+					anonymous_id: input.anonymousIdentity.id,
+					cli_identity_kind: "anonymous"
+				} : {
+					anonymous_id: input.anonymousIdentity.id,
+					cli_identity_kind: "identified"
+				};
+				const engineeringEnvelope = {
 					capxul_env: input.environment,
 					producer: "server",
 					cli_version: input.cliVersion,
@@ -50361,14 +51264,15 @@ function observeInvocation(input, work) {
 					ci: input.ci ?? false,
 					tty: input.tty ?? false,
 					output_mode: input.outputMode ?? "human",
-					...input.anonymousIdentity === void 0 ? {} : {
-						anonymous_id: input.anonymousIdentity.id,
-						cli_identity_kind: "anonymous"
-					},
+					...identityProps,
 					invocation_id: input.invocationId,
 					correlation_id: input.invocationId,
 					journey_id: input.invocationId
 				};
+				const envelope = {
+					...engineeringEnvelope,
+					...identifiedPerson === void 0 ? {} : { auth_user_id: identifiedPerson.authUserId }
+				};
 				const capture = (event, properties, identity) => {
 					if (!enabled()) {
 						dropped += 1;
@@ -50397,6 +51301,40 @@ function observeInvocation(input, work) {
 					});
 					if (textEncoder.encode(body).byteLength > CAPTURE_BYTES || !Queue.offerUnsafe(queue, body)) dropped += 1;
 				};
+				/**
+				* Join this epoch's anonymous history to the person AUTH verified.
+				*
+				* This is a PostHog lifecycle event, not a catalog event: it carries
+				* the person as `distinct_id` and the epoch as `$anon_distinct_id`,
+				* and deliberately omits `$process_person_profile` so the merge is
+				* processed — every catalog event here sets it false, which is what
+				* keeps those events off the person until this record exists.
+				*
+				* The binding's own stored `eventId` is the record UUID, so PostHog
+				* deduplicates a replayed merge. The same idiom `cli_first_used` uses.
+				*
+				* No `$set` traits: identify traits bypass the per-event redactor, and
+				* this module has no pre-minimized person fact to send. The merge is
+				* the whole payload.
+				*/
+				const captureIdentify = (authUserId, anonymousId, eventId, occurredAt) => {
+					if (!enabled()) {
+						dropped += 1;
+						return;
+					}
+					const body = JSON.stringify({
+						api_key: token,
+						event: "$identify",
+						uuid: eventId,
+						timestamp: new Date(occurredAt).toISOString(),
+						properties: {
+							capxul_env: input.environment,
+							distinct_id: authUserId,
+							$anon_distinct_id: anonymousId
+						}
+					});
+					if (textEncoder.encode(body).byteLength > CAPTURE_BYTES || !Queue.offerUnsafe(queue, body)) dropped += 1;
+				};
 				const sdkDiagnostics = [];
 				const client = { capture: (event, properties) => {
 					if (!enabled()) return;
@@ -50492,6 +51430,7 @@ function observeInvocation(input, work) {
 						});
 						capture("cli_first_used", { ...first.props }, firstUse);
 					}
+					if (identifiedPerson !== void 0 && input.anonymousIdentity !== void 0) captureIdentify(identifiedPerson.authUserId, input.anonymousIdentity.id, identifiedPerson.eventId, clock.currentTimeMillisUnsafe());
 					if (input.kind !== "parse_refusal") {
 						const start = Schema.decodeUnknownSync(CliCommandStartedTelemetryEventSchema)({
 							name: "cli_command_started",
@@ -50514,7 +51453,7 @@ function observeInvocation(input, work) {
 						const outcome = failure?.outcome ?? "succeeded";
 						const duration = Math.max(0, clock.currentTimeMillisUnsafe() - started);
 						const completion = Schema.decodeUnknownSync(completionSchema)({
-							...envelope,
+							...engineeringEnvelope,
 							...input.anonymousIdentity === void 0 ? {} : { posthogDistinctId: input.anonymousIdentity.id },
 							occurred_at: clock.currentTimeMillisUnsafe(),
 							schema_version: 1,
@@ -50531,7 +51470,7 @@ function observeInvocation(input, work) {
 						yield* Effect.annotateCurrentSpan(completion);
 						yield* logEngineeringInfo("cli.command.completed", completion);
 						for (const diagnostic of sdkDiagnostics) yield* Effect.logInfo("cli.sdk.operation.failed").pipe(Effect.annotateLogs({
-							...envelope,
+							...engineeringEnvelope,
 							...diagnostic
 						}));
 						const metricAttributes = {
@@ -50689,17 +51628,136 @@ function projectException(properties, command) {
 }
 const boundedLine = (value) => typeof value === "number" && Number.isSafeInteger(value) && value > 0 && value <= 1e7 ? value : null;
 //#endregion
-//#region src/output.ts
-const writeStdout = (text) => Effect.flatMap(Stdio.Stdio, (stdio) => Stream.run(Stream.make(text), stdio.stdout()));
-const writeStderr = (text) => Effect.flatMap(Stdio.Stdio, (stdio) => Stream.run(Stream.make(text), stdio.stderr()));
-function renderResult(mode, envelope, lines = []) {
-	if (mode === "json") return writeStdout(`${JSON.stringify(envelope)}\n`);
-	return envelope.outcome === "succeeded" ? writeStdout(`${lines.join("\n")}\n`) : writeStderr(`${envelope.error.code}: ${envelope.error.message}\n`);
-}
-//#endregion
 //#region src/version.ts
-const cliVersion = "4.20.0-beta.3";
-const sdkVersion = "4.20.0-beta.3";
+const cliVersion = "4.20.0-beta.5";
+const sdkVersion = "4.20.0-beta.5";
+//#endregion
+//#region src/platform/collection-policy.ts
+const decode = Schema.decodeUnknownOption(Schema.fromJsonString(Settings), { onExcessProperty: "error" });
+const missing = (error) => error instanceof Error && "code" in error && error.code === "ENOENT";
+const resolveProtectedDirectory = (directory, uid) => {
+	const stateDirectory = lstatSync(directory, { throwIfNoEntry: false });
+	if (stateDirectory && (!stateDirectory.isDirectory() || stateDirectory.uid !== uid || (stateDirectory.mode & 511) !== 448)) return null;
+	let ancestor = directory;
+	while (!lstatSync(ancestor, { throwIfNoEntry: false })) ancestor = dirname(ancestor);
+	ancestor = realpathSync(ancestor);
+	const canonicalDirectory = ancestor;
+	while (true) {
+		const info = statSync(ancestor);
+		if (!info.isDirectory() || info.uid !== 0 && info.uid !== uid || (info.mode & 18) !== 0 && (info.mode & 512) === 0) return null;
+		const parent = dirname(ancestor);
+		if (parent === ancestor) break;
+		ancestor = parent;
+	}
+	return stateDirectory ? canonicalDirectory : void 0;
+};
+const collectionPolicy = (settingsPath, forcedDisabled) => () => {
+	if (forcedDisabled) return false;
+	let descriptor;
+	try {
+		const uid = process$1.getuid?.();
+		if (uid === void 0) return false;
+		const file = resolve$1(settingsPath);
+		const directory = dirname(file);
+		const canonicalDirectory = resolveProtectedDirectory(directory, uid);
+		if (canonicalDirectory === null) return false;
+		if (canonicalDirectory === void 0) return true;
+		try {
+			descriptor = openSync(join(canonicalDirectory, basename(file)), constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK);
+		} catch (error) {
+			return missing(error);
+		}
+		const info = fstatSync(descriptor);
+		if (!info.isFile() || info.uid !== uid || (info.mode & 511) !== 384 || info.nlink !== 1 || info.size > 65536) return false;
+		const bytes = Buffer.alloc(65537);
+		let length = 0;
+		while (length < bytes.length) {
+			const count = readSync(descriptor, bytes, length, bytes.length - length, null);
+			if (count === 0) break;
+			length += count;
+		}
+		if (length > 65536) return false;
+		const settings = decode(bytes.toString("utf8", 0, length));
+		return Option.isSome(settings) && settings.value.collection.enabled;
+	} catch {
+		return false;
+	} finally {
+		if (descriptor !== void 0) try {
+			closeSync(descriptor);
+		} catch {}
+	}
+};
+//#endregion
+//#region src/runtime/config.ts
+const defaultHost = "https://us.i.posthog.com";
+const defaultProjectToken = Redacted.make("phc_BZuAVofrkNXzwpJkuDG7Rdfurir45fj2dudQvJZk847e");
+const optionalText = (name) => Config.option(Config.string(name));
+function httpOrigin(value, field) {
+	return Effect.try({
+		try: () => {
+			const url = new URL(value);
+			const local = url.hostname === "localhost" || url.hostname === "127.0.0.1" || url.hostname === "[::1]";
+			if (!local && url.protocol !== "https:" || local && !["http:", "https:"].includes(url.protocol) || url.username || url.password || url.search || url.hash || url.pathname !== "/") throw new Error();
+			if (field === "bootstrap" && /\.convex\.(cloud|site)$/.test(url.hostname)) throw new Error();
+			return url.origin;
+		},
+		catch: () => configurationFailure(`The ${field} URL must be a valid approved origin.`)
+	});
+}
+const loadObservationConfig = Effect.gen(function* () {
+	const path = yield* Path.Path;
+	const values = yield* Config.all({
+		cliHome: optionalText("CAPXUL_CLI_HOME"),
+		home: optionalText("HOME"),
+		xdg: optionalText("XDG_CONFIG_HOME"),
+		host: optionalText("CAPXUL_POSTHOG_HOST"),
+		token: Config.option(Config.redacted("CAPXUL_POSTHOG_PROJECT_TOKEN")),
+		disabled: Config.boolean("CAPXUL_TELEMETRY_DISABLED").pipe(Config.withDefault(false))
+	}).pipe(Effect.mapError(() => configurationFailure("CLI environment configuration is invalid.")));
+	let directory = Option.getOrUndefined(values.cliHome);
+	if (directory === void 0) {
+		const configHome = Option.getOrUndefined(values.xdg);
+		const home = Option.getOrUndefined(values.home);
+		if (configHome !== void 0) directory = path.join(configHome, "capxul", "cli");
+		else if (home !== void 0) directory = path.join(home, ".config", "capxul", "cli");
+		else return yield* Effect.fail(configurationFailure("Set HOME or CAPXUL_CLI_HOME."));
+	}
+	const settingsPath = path.join(path.resolve(directory), "settings.json");
+	const host = Option.getOrUndefined(values.host) ?? defaultHost;
+	return {
+		settingsPath,
+		environment: "staging",
+		posthogHost: host === void 0 ? void 0 : yield* httpOrigin(host, "PostHog"),
+		projectToken: Option.getOrUndefined(values.token) ?? defaultProjectToken,
+		forcedDisabled: values.disabled,
+		collectionEnabled: collectionPolicy(settingsPath, values.disabled)
+	};
+});
+const loadConfig = Effect.gen(function* () {
+	const observation = yield* loadObservationConfig;
+	const values = yield* Config.all({
+		key: Config.option(Config.redacted("CAPXUL_PUBLISHABLE_KEY")),
+		bootstrap: Config.string("CAPXUL_BOOTSTRAP_URL").pipe(Config.withDefault("https://api.staging.capxul.com"))
+	}).pipe(Effect.mapError(() => configurationFailure("CLI environment configuration is invalid.")));
+	const bootstrapBaseUrl = yield* httpOrigin(values.bootstrap, "bootstrap");
+	return {
+		...observation,
+		bootstrapBaseUrl,
+		publishableKey: Option.getOrUndefined(values.key)
+	};
+});
+const collectionStatus = (config) => Effect.gen(function* () {
+	const stored = (yield* readSettings(config.settingsPath))?.collection.enabled ?? null;
+	const enabled = config.collectionEnabled();
+	const configured = config.posthogHost !== void 0 && config.projectToken !== void 0;
+	return {
+		stored,
+		enabled,
+		configured,
+		effective: enabled && configured,
+		reason: config.forcedDisabled ? "environment" : !enabled ? "disabled" : !configured ? "not_configured" : "enabled"
+	};
+});
 //#endregion
 //#region src/runtime/command-metadata.ts
 var CliCommandMetadata = class extends Context.Service()("capxul-cli/CommandMetadata") {};
@@ -50724,7 +51782,7 @@ var CliRuntime = class extends Context.Service()("capxul-cli/Runtime") {};
 const acquireInvocationIdentity = (config, eligible) => Effect.gen(function* () {
 	if (!eligible || config?.posthogHost === void 0 || config.projectToken === void 0 || !config.collectionEnabled()) return void 0;
 	const path = yield* Path.Path;
-	const acquired = yield* acquireObservationIdentity(path.dirname(config.settingsPath));
+	const acquired = yield* snapshotInvocationIdentity(path.dirname(config.settingsPath));
 	return acquired.status === "ready" ? acquired : void 0;
 }).pipe(Effect.catchCause(() => Effect.succeed(void 0)));
 const runInvocation = (runtime, metadata, kind, work, network = false) => Effect.gen(function* () {
@@ -50748,10 +51806,16 @@ const runInvocation = (runtime, metadata, kind, work, network = false) => Effect
 		kind: invocationKind,
 		network,
 		invocationId: runtime.invocationId,
-		...identity === void 0 ? {} : { anonymousIdentity: {
-			id: identity.epoch.id,
-			...identity.firstUseClaimed ? { firstUse: identity.firstUse } : {}
-		} },
+		...identity === void 0 ? {} : {
+			anonymousIdentity: {
+				id: identity.epoch.id,
+				...identity.firstUseClaimed ? { firstUse: identity.firstUse } : {}
+			},
+			...identity.epoch.binding === null ? {} : { identifiedPerson: {
+				authUserId: identity.epoch.binding.authUserId,
+				eventId: identity.epoch.binding.eventId
+			} }
+		},
 		cliVersion,
 		sdkVersion,
 		environment: config?.environment ?? "staging",
@@ -50795,6 +51859,61 @@ const runCommand = (options, work) => Effect.gen(function* () {
 	}), options.network);
 });
 //#endregion
+//#region src/commands/auth.ts
+const emailFlag = Flag.string("email").pipe(Flag.withDescription("Account email"), Flag.optional);
+const loginMetadata = {
+	name: "auth.login",
+	capability: "authentication",
+	observation: "command"
+};
+const signupMetadata = {
+	...loginMetadata,
+	name: "auth.signup"
+};
+const statusMetadata$1 = {
+	...loginMetadata,
+	name: "auth.status"
+};
+const logoutMetadata = {
+	...loginMetadata,
+	name: "auth.logout"
+};
+const loginCommand = Command.make("login", { email: emailFlag }, ({ email }) => runCommand({
+	...loginMetadata,
+	network: true
+}, (config) => login(config, Option.getOrUndefined(email)))).pipe(Command.annotate(CliCommandMetadata, loginMetadata), Command.withDescription("Sign in through the browser and resume this process"));
+const signupCommand = Command.make("signup", {
+	email: emailFlag,
+	displayName: Flag.string("display-name").pipe(Flag.optional),
+	handle: Flag.string("handle").pipe(Flag.optional),
+	country: Flag.string("country").pipe(Flag.optional)
+}, ({ email, displayName, handle, country }) => runCommand({
+	...signupMetadata,
+	network: true
+}, (config) => signup(config, {
+	email: Option.getOrUndefined(email),
+	displayName: Option.getOrUndefined(displayName),
+	handle: Option.getOrUndefined(handle),
+	country: Option.getOrUndefined(country)
+}))).pipe(Command.annotate(CliCommandMetadata, signupMetadata), Command.withDescription("Create an account through the browser and resume this process"));
+const statusCommand = Command.make("status", { email: emailFlag }, ({ email }) => runCommand({
+	...statusMetadata$1,
+	network: false
+}, (config) => status$1(config, Option.getOrUndefined(email)))).pipe(Command.annotate(CliCommandMetadata, statusMetadata$1), Command.withDescription("Show whether this CLI holds a native grant"));
+const logoutCommand = Command.make("logout", { email: emailFlag }, ({ email }) => runCommand({
+	...logoutMetadata,
+	network: true
+}, (config) => logout(config, Option.getOrUndefined(email)))).pipe(Command.annotate(CliCommandMetadata, logoutMetadata), Command.withDescription("Revoke the native grant and forget local credentials"));
+const auth = Command.make("auth").pipe(Command.annotate(CliCommandMetadata, {
+	...loginMetadata,
+	name: "auth"
+}), Command.withDescription("Sign in, inspect, or sign out of this CLI"), Command.withSubcommands([
+	loginCommand,
+	signupCommand,
+	statusCommand,
+	logoutCommand
+]));
+//#endregion
 //#region src/platform/capxul.ts
 const resultValue = (result) => result.ok ? Effect.succeed(result.value) : Effect.fail(result.error);
 const acquireClient = (input, onFinalize) => Effect.uninterruptibleMask((restore) => Effect.gen(function* () {
@@ -50966,7 +52085,11 @@ const command = Command.make("capxul").pipe(Command.annotate(CliCommandMetadata,
 	name: "capxul",
 	capability: "cli",
 	observation: "command"
-}), Command.withDescription("Capxul diagnostics and configuration"), Command.withSubcommands([doctor, telemetry]), Command.withGlobalFlags([JsonOutput]));
+}), Command.withDescription("Capxul diagnostics and configuration"), Command.withSubcommands([
+	auth,
+	doctor,
+	telemetry
+]), Command.withGlobalFlags([JsonOutput]));
 //#endregion
 //#region src/runtime/entry.ts
 const completionFailure = (error) => {