@capxul/cli 4.20.0-beta.6 → 4.20.0-beta.7

package/dist/main.mjs

@@ -307,7 +307,7 @@ const privateTransition = (state, event) => {
 		}
 	}
 };
-const transition = (state, event, config = DEFAULT_CONFIG) => {
+const transition$1 = (state, event, config = DEFAULT_CONFIG) => {
 	if (isPrivate(event)) return privateTransition(state, event);
 	if (event._tag === "VerifyOtp" && !/^\d{6}$/.test(event.otp)) return { refused: "INVALID_INPUT" };
 	if (event._tag === "CreateOrganization" && event.draft.handle.trim() === "") return { refused: "INVALID_INPUT" };
@@ -2609,7 +2609,8 @@ const SETTLEMENT_ASSETS_BASE_SEPOLIA = Object.freeze({
 	CAPXUL_TEST_WETH: SYNTHETIC_TEST_ASSET_FIXTURES.weth
 });
 const CONFIGURED_MONEY_ASSETS = Object.freeze(Object.values(SETTLEMENT_ASSETS_BASE_SEPOLIA));
-Object.freeze({ BASE_SEPOLIA: Object.freeze({
+/** Public AssetIds for the admitted Base Sepolia test assets. */
+const TOKENS = Object.freeze({ BASE_SEPOLIA: Object.freeze({
 	CAPXUL_TEST_USDC: SETTLEMENT_ASSETS_BASE_SEPOLIA.CAPXUL_TEST_USDC.assetId,
 	CAPXUL_TEST_USDT: SETTLEMENT_ASSETS_BASE_SEPOLIA.CAPXUL_TEST_USDT.assetId,
 	CAPXUL_TEST_WETH: SETTLEMENT_ASSETS_BASE_SEPOLIA.CAPXUL_TEST_WETH.assetId
@@ -4258,6 +4259,28 @@ function getCreate2Address(opts) {
 //#region ../../packages/config/src/org-payments.ts
 /** Zodiac MultiSendCallOnly module on Base Sepolia. */
 const MULTI_SEND_CALL_ONLY = "0x9641d764fc13c8b624c04430c7356c1c7c8102e2";
+/** Supported Organization permission identities, newest first. */
+const ORG_PERMISSION_IDENTITY_PROFILES = [{
+	id: "zodiac-roles-2.1.1",
+	moduleFactoryRuntimeKeccak256: "0x01623cbcf010a1c326230f1b2d5f48a66b440232ee49096102bc84967dc5f21e",
+	mastercopy: "0xf2964ce6161ce0e75964fe7927ce114cb0b283d5",
+	mastercopyRuntimeKeccak256: "0x471d8b3b419f1eb955230c0326c8812176df49bf3c7b414a563fda5a3c6c10b6",
+	proxyRuntimeKeccak256: "0x248f9591f94c24c199ade3e73feb477cf02d387b2bea91f2f931a0deb094f163",
+	multiSendUnwrapper: "0xb4cd4bb764c089f20da18700ce8bc5e49f369efd",
+	multiSendUnwrapperRuntimeKeccak256: "0x1f6e088be5e6ef9d0fbe0547d3fa9a9e40d823433fd8a4449215b5663209a1eb"
+}, {
+	id: "zodiac-roles-2.1.0",
+	moduleFactoryRuntimeKeccak256: "0x01623cbcf010a1c326230f1b2d5f48a66b440232ee49096102bc84967dc5f21e",
+	mastercopy: "0x9646fdad06d3e24444381f44362a3b0eb343d337",
+	mastercopyRuntimeKeccak256: "0x87911cbc6aa0496e6bcb07dab2462b9c76daea130dede6dcc57d0adf307fa7ec",
+	proxyRuntimeKeccak256: "0x9d4059abf46db50e4b48d9b6404b1f200cb5a1efeb3725be2de630a2a9001944",
+	multiSendUnwrapper: "0x93b7fcbc63ed8a3a24b59e1c3e6649d50b7427c0",
+	multiSendUnwrapperRuntimeKeccak256: "0x4d8d8608b70a6e2f40726b9dd74406bbf73e90cac58e23ee953e2b45ad7dc3df"
+}];
+const CURRENT_ORG_PERMISSION_IDENTITY = ORG_PERMISSION_IDENTITY_PROFILES[0];
+ORG_PERMISSION_IDENTITY_PROFILES[1];
+CURRENT_ORG_PERMISSION_IDENTITY.mastercopy;
+CURRENT_ORG_PERMISSION_IDENTITY.multiSendUnwrapper;
 //#endregion
 //#region ../../packages/config/src/safe.ts
 const BASE_SEPOLIA_CHAIN_ID = 84532;
@@ -4480,14 +4503,6 @@ function deriveCapxulSafeAddressForOwner(input) {
 //#endregion
 //#region ../../packages/config/src/role-dsl.ts
 const ADMIN_ROLE_LABEL = "Admin";
-function normalizeOrgRoleLabel(label) {
-	const normalized = label.trim().replace(/\s+/g, " ");
-	if (normalized.length === 0) throw Errors.invalidInput("role.label", "must be a non-empty role label");
-	return normalized;
-}
-function orgRoleKeyForLabel(label) {
-	return keccak256(toBytes(normalizeOrgRoleLabel(label).toLowerCase()));
-}
 //#endregion
 //#region ../../packages/config/src/capxul-payments-v2.ts
 /** The exact compiled CapxulPaymentsV2 ABI. */
@@ -5159,6 +5174,44 @@ const ROLE_AUTHORITY_EVENT_BY_FUNCTION_SELECTOR = new Map([
 toEventSelector("AssignRoles(address,bytes32[],bool[])");
 new Set([...ROLE_AUTHORITY_EVENT_BY_FUNCTION_SELECTOR.values()].map((topic) => topic.toLowerCase()));
 //#endregion
+//#region ../../packages/sdk/src/domain/money/parse-money.ts
+const AMOUNT_PATTERN = /^(?:\d{1,3}(?:,\d{3})+|\d+)(?:\.\d+)?$/;
+const ZERO_PATTERN = /^0+(?:\.0+)?$/;
+/** Shared input grammar. Callers retain their own amount size limits. */
+function parseDecimalInput(input, decimals, maximumLength) {
+	if (!Number.isInteger(decimals) || decimals < 0) throw Errors.invalidInput("asset.decimals", "must be a non-negative integer");
+	const value = input.trim();
+	if (value.length === 0) return {
+		kind: "error",
+		reason: "required"
+	};
+	if (value.length > maximumLength) return {
+		kind: "error",
+		reason: "too-long"
+	};
+	const negative = value.startsWith("-");
+	const unsigned = negative ? value.slice(1) : value;
+	if (!AMOUNT_PATTERN.test(unsigned)) return {
+		kind: "error",
+		reason: "invalid-format"
+	};
+	if (negative) return {
+		kind: "error",
+		reason: "non-positive"
+	};
+	const normalized = unsigned.replaceAll(",", "");
+	const fraction = normalized.split(".")[1];
+	if (fraction !== void 0 && fraction.length > decimals) return {
+		kind: "error",
+		reason: "too-many-decimals"
+	};
+	if (ZERO_PATTERN.test(normalized)) return {
+		kind: "error",
+		reason: "non-positive"
+	};
+	return { value: normalized };
+}
+//#endregion
 //#region ../../packages/sdk/src/domain/money/asset-amount.ts
 /** Convert raw units without rounding or changing asset identity. */
 function assetAmountFromRaw(raw, asset) {
@@ -5174,6 +5227,14 @@ function toRaw(amount, asset) {
 	if (amount.asset !== asset.assetId) throw Errors.invalidInput("amount.asset", "must match the selected asset on its chain");
 	return decimalToRaw(amount.value, asset.decimals);
 }
+function parseAssetAmount(input, asset) {
+	validateMetadata(asset);
+	const parsed = parseDecimalInput(input, asset.decimals, 100);
+	return "kind" in parsed ? parsed : {
+		asset: asset.assetId,
+		value: parsed.value.replace(/^0+(?=\d)/, "")
+	};
+}
 function requireAsset(id) {
 	const asset = configuredMoneyAssetById(id);
 	if (asset === null) throw Errors.invalidInput("amount.asset", "is not a registered asset");
@@ -5564,10 +5625,12 @@ const CAPXUL_OPERATIONS = {
 		prepareOrganizationPaymentExecution: "moneyExecution.prepareOrganizationPaymentExecution",
 		preparePaymentExecution: "moneyExecution.preparePaymentExecution",
 		preparePaymentLifecycleExecution: "moneyExecution.preparePaymentLifecycleExecution",
+		prepareInvitationConfiguration: "moneyExecution.prepareInvitationConfiguration",
 		preparePermissionExecution: "moneyExecution.preparePermissionExecution",
 		recoverSubmissionClaims: "moneyExecution.recoverSubmissionClaims",
 		submit: "moneyExecution.submit",
 		submitPaymentCommandExecution: "moneyExecution.submitPaymentCommandExecution",
+		submitInvitationConfigurationExecution: "moneyExecution.submitInvitationConfigurationExecution",
 		submitPaymentExecution: "moneyExecution.submitPaymentExecution",
 		submitPermissionExecution: "moneyExecution.submitPermissionExecution"
 	},
@@ -5589,20 +5652,52 @@ const CAPXUL_OPERATIONS = {
 		completePerson: "onboarding.completePerson"
 	},
 	org: {
-		acceptInvitations: "org.acceptInvitations",
 		account: { get: "org.account.get" },
-		activateMember: "org.activateMember",
 		auditLog: "org.auditLog",
 		confirmBootstrap: "org.confirmBootstrap",
 		createOrg: "org.createOrg",
 		create: "org.create",
-		detectAndAcceptPendingInvitations: "org.detectAndAcceptPendingInvitations",
+		/**
+		* §11: the consent mutation reports `org_invite_accepted` through its own
+		* scheduled emitter. It is named for the emit, not the acceptance, because
+		* the interactive acceptance itself owns `org.invitations.accept`.
+		*/
+		emitInviteAccepted: "org.emitInviteAccepted",
 		emitInviteProgressed: "org.emitInviteProgressed",
 		expireInvitations: "org.expireInvitations",
 		getLifecycle: "org.getLifecycle",
 		getProofReceipt: "org.getProofReceipt",
 		invite: "org.invite",
-		inviteMember: "org.inviteMember",
+		/** D8 invitation lifecycle: preview, own list, read, and the four transitions. */
+		invitations: {
+			/** The exact grantee's consent commit (§8): one accepted digest, once. */
+			accept: "org.invitations.accept",
+			/**
+			* The authoring write. It is named `authorize`, not `invite`, because the
+			* backend already uses `org.invitations.invite` as a refusal label and
+			* `lint:telemetry-spine` refuses a label that collides with an operation.
+			*/
+			authorize: "org.invitations.authorize",
+			cancel: "org.invitations.cancel",
+			decline: "org.invitations.decline",
+			get: "org.invitations.get",
+			list: "org.invitations.list",
+			/**
+			* The Admin-scoped Organization list. It is named `listScoped`, not
+			* `list`, because the own-offer list already owns `org.invitations.list`.
+			*/
+			listScoped: "org.invitations.listScoped",
+			/**
+			* The authoring write's inner hops: the SDK drives the backend's existing
+			* prepare/submit pair, and these names label the two Convex calls. The
+			* owning `capxul_sdk_operation` record stays `org.invitations.authorize`.
+			*/
+			prepareConfiguration: "org.invitations.prepareConfiguration",
+			preview: "org.invitations.preview",
+			resend: "org.invitations.resend",
+			retry: "org.invitations.retry",
+			submitConfiguration: "org.invitations.submitConfiguration"
+		},
 		list: "org.list",
 		load: "org.load",
 		me: "org.me",
@@ -5661,7 +5756,6 @@ const CAPXUL_OPERATIONS = {
 		},
 		recordFailure: "org.recordFailure",
 		recordProgress: "org.recordProgress",
-		resendInviteToken: "org.resendInviteToken",
 		resumeBootstrapSubmission: "org.resumeBootstrapSubmission",
 		retry: "org.retry",
 		retrySetup: "org.retrySetup",
@@ -5678,7 +5772,6 @@ const CAPXUL_OPERATIONS = {
 		retry: "organizationPayments.retry"
 	},
 	organizationSetup: { getProofReceipt: "organizationSetup.getProofReceipt" },
-	organizations: { detectAndAcceptPendingInvitations: "orgs.detectAndAcceptPendingInvitations" },
 	payments: {
 		cancel: "payments.cancel",
 		claim: "payments.claim",
@@ -5716,6 +5809,7 @@ const CAPXUL_OPERATIONS = {
 		terms: "payroll.terms"
 	},
 	permission: {
+		verifyInvitationConfiguration: "permission.verifyInvitationConfiguration",
 		command: "permission.command",
 		retryVerification: "permission.retryVerification",
 		verify: "permission.verify",
@@ -6273,6 +6367,11 @@ const OrgCreateFailedProps = Schema.Struct({
 const OrgInviteSentProps = Schema.Struct({
 	...TelemetryEnvelopeProps,
 	org_id: OptionalOrgId,
+	invitation_id: OptionalString,
+	generation: OptionalString,
+	command_id: OptionalString,
+	subject_party_id: OptionalString,
+	persisted_at: OptionalEpochMs,
 	email_domain: OptionalString,
 	role: OptionalString,
 	status: OptionalString
@@ -6280,6 +6379,11 @@ const OrgInviteSentProps = Schema.Struct({
 const OrgInviteAcceptedProps = Schema.Struct({
 	...TelemetryEnvelopeProps,
 	org_id: OptionalOrgId,
+	invitation_id: OptionalString,
+	accepted_at: OptionalEpochMs,
+	generation: OptionalString,
+	command_id: OptionalString,
+	subject_party_id: OptionalString,
 	role: OptionalString,
 	status: OptionalString
 });
@@ -6287,6 +6391,7 @@ const OrgInviteExpiredProps = Schema.Struct({
 	...TelemetryEnvelopeProps,
 	org_id: OptionalOrgId,
 	email_domain: OptionalString,
+	invitation_id: OptionalString,
 	reason: OptionalString,
 	role: OptionalString,
 	status: OptionalString
@@ -6439,9 +6544,24 @@ const PermissionMirrorVerificationProps = Schema.Struct({
 		"applied",
 		"replayed",
 		"conflicting_replay",
-		"revision_mismatch"
+		"revision_mismatch",
+		"cleanup_required",
+		"not_applied",
+		"application_failure",
+		"mismatch",
+		"refused"
 	])),
+	command_kind: Schema.optional(Schema.Literals(["invitation_configuration", "invitation_eoa"])),
 	command_id: OptionalString,
+	invitation_id: OptionalString,
+	generation: OptionalString,
+	purpose: Schema.optional(Schema.Literals([
+		"configure",
+		"grant",
+		"disable",
+		"compensate"
+	])),
+	$insert_id: OptionalString,
 	/**
 	* #1961 R03. The authorized stored row names the Permission it changed; the
 	* verified receipt names the chain facts that prove it. Every field is
@@ -6828,6 +6948,13 @@ const CLI_COMMAND_NAMES = [
 	"auth.profile",
 	"auth.status",
 	"auth.logout",
+	"contact",
+	"contact.list",
+	"contact.get",
+	"contact.add",
+	"contact.label",
+	"contact.hide",
+	"contact.unhide",
 	"org",
 	CAPXUL_OPERATIONS.org.list,
 	"org.use",
@@ -6836,6 +6963,24 @@ const CLI_COMMAND_NAMES = [
 	CAPXUL_OPERATIONS.org.members,
 	"org.member",
 	"org.member.get",
+	"org.member.invite",
+	"org.contact",
+	"org.contact.list",
+	"org.contact.get",
+	"org.contact.add",
+	"org.contact.label",
+	"org.contact.hide",
+	"org.contact.unhide",
+	CAPXUL_OPERATIONS.org.invite,
+	"org.invite.list",
+	"org.invite.get",
+	"org.invite.wait",
+	"org.invite.review",
+	"org.invite.accept",
+	"org.invite.decline",
+	"org.invite.cancel",
+	"org.invite.resend",
+	"org.invite.retry",
 	"org.wait",
 	CAPXUL_OPERATIONS.org.create,
 	CAPXUL_OPERATIONS.org.retry,
@@ -6846,7 +6991,8 @@ const CLI_CAPABILITIES = [
 	"diagnostics",
 	"collection",
 	"authentication",
-	"organization"
+	"organization",
+	"contacts"
 ];
 const CLI_INVOCATION_KINDS = [
 	"command",
@@ -7090,6 +7236,7 @@ const TELEMETRY_EVENT_SCHEMAS = {
 			...TelemetryEnvelopeProps,
 			organization_id: OrgIdTelemetrySchema,
 			progress: Schema.Literals([
+				"configuration_authorized",
 				"account_ready",
 				"permission_applied",
 				"membership_activated",
@@ -7097,6 +7244,9 @@ const TELEMETRY_EVENT_SCHEMAS = {
 			]),
 			/** The invited Party. The initiating actor stays on the envelope's identity. */
 			member_party_id: Schema.String,
+			invitation_id: Schema.optional(Schema.String),
+			generation: Schema.optional(Schema.String),
+			command_id: Schema.optional(Schema.String),
 			occurred_at: Schema.Number
 		})
 	}),
@@ -7800,8 +7950,10 @@ const CAPXUL_FUNCTIONS = {
 	"movement/annotations": { overlay: "movement/annotations:overlay" },
 	"moneyExecution/actions": {
 		abandonPaymentExecution: "moneyExecution/actions:abandonPaymentExecution",
+		prepareInvitationConfiguration: "moneyExecution/actions:prepareInvitationConfiguration",
 		preparePermissionExecution: "moneyExecution/actions:preparePermissionExecution",
 		preparePaymentExecution: "moneyExecution/actions:preparePaymentExecution",
+		submitInvitationConfigurationExecution: "moneyExecution/actions:submitInvitationConfigurationExecution",
 		submitPermissionExecution: "moneyExecution/actions:submitPermissionExecution",
 		submitPaymentExecution: "moneyExecution/actions:submitPaymentExecution"
 	},
@@ -7818,8 +7970,6 @@ const CAPXUL_FUNCTIONS = {
 	},
 	"org/actions": {
 		confirmBootstrap: "org/actions:confirmBootstrap",
-		detectAndAcceptPendingInvitations: "org/actions:detectAndAcceptPendingInvitations",
-		inviteMember: "org/actions:inviteMember",
 		prepareBootstrap: "org/actions:prepareBootstrap",
 		prepareFounderAccount: "org/actions:prepareFounderAccount",
 		readTreasury: "org/actions:readTreasury",
@@ -7850,16 +8000,25 @@ const CAPXUL_FUNCTIONS = {
 		startOrResume: "org/lifecycle:startOrResume"
 	},
 	"org/mutations": {
+		accept: "org/mutations:accept",
+		cancel: "org/mutations:cancel",
 		createOrg: "org/mutations:createOrg",
-		resendInviteToken: "org/mutations:resendInviteToken"
+		decline: "org/mutations:decline",
+		invite: "org/mutations:invite",
+		resend: "org/mutations:resend",
+		retry: "org/mutations:retry"
 	},
 	"org/queries": {
+		getInvitation: "org/queries:getInvitation",
 		listAll: "org/queries:listAll",
+		listInvitations: "org/queries:listInvitations",
 		listMembersByOrgId: "org/queries:listMembersByOrgId",
 		listMine: "org/queries:listMine",
+		listMyInvitations: "org/queries:listMyInvitations",
 		listRolesByOrgId: "org/queries:listRolesByOrgId",
 		loadByOrgId: "org/queries:loadByOrgId",
-		me: "org/queries:me"
+		me: "org/queries:me",
+		previewInvite: "org/queries:previewInvite"
 	},
 	"smartAccount/actions": {
 		claim: "smartAccount/actions:claim",
@@ -8819,6 +8978,94 @@ const EventRefSchema = Schema.Struct({
 	topic0: Bytes32Schema,
 	dataHash: Bytes32Schema
 });
+const InvitationEoaReceiptSchema = Schema.Struct({
+	kind: Schema.Literal("invitation_eoa"),
+	chainId: BaseSepoliaChainIdSchema,
+	transactionHash: TxHashSchema,
+	blockNumber: BlockNumberSchema,
+	blockHash: Bytes32Schema,
+	sender: AddressSchema,
+	nonce: Schema.String.pipe(Schema.refine((value) => /^(0|[1-9][0-9]*)$/.test(value)))
+});
+const PermissionReceiptRefSchema = Schema.Union([Schema.Struct({
+	kind: Schema.Literal("user_operation"),
+	...ReceiptRefSchema.fields
+}), InvitationEoaReceiptSchema]);
+const PermissionEventRefSchema = Schema.Struct({
+	receipt: PermissionReceiptRefSchema,
+	emitter: AddressSchema,
+	transactionIndex: LogIndexSchema,
+	logIndex: LogIndexSchema,
+	topic0: Bytes32Schema,
+	dataHash: Bytes32Schema
+});
+Schema.Union([
+	Schema.Struct({
+		status: Schema.Literal("pending"),
+		reason: Schema.Literal("receipt_missing")
+	}),
+	Schema.Struct({
+		status: Schema.Literal("provider_failure"),
+		retryable: Schema.Literal(true)
+	}),
+	Schema.Struct({
+		status: Schema.Literal("mismatch"),
+		code: Schema.Literals([
+			"wrong_chain",
+			"wrong_sender",
+			"wrong_transaction",
+			"failed_transaction",
+			"non_canonical_block",
+			"wrong_contract_identity",
+			"missing_event",
+			"extra_authority_event",
+			"wrong_fact_tuple",
+			"wrong_state",
+			"conflicting_replay"
+		]),
+		attemptTransactionHash: Schema.optional(TxHashSchema),
+		receipt: Schema.optional(InvitationEoaReceiptSchema)
+	}),
+	Schema.Struct({
+		status: Schema.Literal("verified"),
+		commandId: PaymentCommandIdSchema,
+		receipt: InvitationEoaReceiptSchema,
+		events: Schema.Array(PermissionEventRefSchema),
+		factsHash: Bytes32Schema
+	})
+]);
+/**
+* One stored `setAllowance` call inside a command's expected authority set.
+*
+* The pinned Roles module emits `SetAllowance` as *post-state*, not as the call
+* arguments: `maxRefill = 0` becomes `type(uint128).max`, and `timestamp = 0`
+* becomes the receipt block's timestamp. A hash over the call arguments can
+* therefore never match that receipt. `index` names the entry in
+* `expectedAuthorityEvents` the call produced, and `data` is the call's own
+* calldata, so the verifier can rebuild the one hash the module actually emits.
+* The rule is pinned by `test:invitation-conformance`.
+*/
+const AllowanceExpectationSchema = Schema.Struct({
+	index: nonNegativeInteger("index"),
+	data: Schema.String.pipe(Schema.refine((value) => /^0x[0-9a-fA-F]+$/u.test(value), { message: "data must be 0x-prefixed hex" }))
+});
+Schema.Struct({
+	commandId: PaymentCommandIdSchema,
+	userOpHash: Bytes32Schema,
+	generationHash: Bytes32Schema,
+	chainId: BaseSepoliaChainIdSchema,
+	organizationSafe: SafeAddressSchema,
+	rolesModule: ModuleAddressSchema,
+	userOpSenderSafe: SafeAddressSchema,
+	expectedAuthorityEvents: Schema.Array(Bytes32Schema),
+	/**
+	* Absent means "no normalization": every expected hash is compared as stored.
+	* A command whose set contains `setAllowance` then refuses (`wrong_fact_tuple`)
+	* rather than passing on a weakened proof, so an incomplete caller fails
+	* closed.
+	*/
+	allowanceExpectations: Schema.optional(Schema.Array(AllowanceExpectationSchema))
+});
 const PermissionOperationSchema = Schema.Literals([
 	"create",
 	"change",
@@ -8862,7 +9109,9 @@ const StoredPermissionCommandSchema = Schema.Struct({
 });
 Schema.Struct({
 	command: StoredPermissionCommandSchema,
-	userOpHash: Bytes32Schema
+	userOpHash: Bytes32Schema,
+	/** The stored `setAllowance` calls of this command's own expectation. */
+	allowanceExpectations: Schema.optional(Schema.Array(AllowanceExpectationSchema))
 });
 Schema.Union([
 	Schema.Struct({
@@ -9706,6 +9955,27 @@ Schema.Struct({
 	digest: Bytes32Schema,
 	value: PermissionResourceSchema
 });
+Schema.Struct({
+	commandId: PaymentCommandIdSchema,
+	signerAddress: AddressSchema
+});
+Schema.Struct({
+	executionId: MoneyExecutionIdSchema,
+	commandId: PaymentCommandIdSchema,
+	orgId: nonEmpty("orgId"),
+	invitationId: nonEmpty("invitationId"),
+	generationHash: Bytes32Schema,
+	chainId: BaseSepoliaChainIdSchema,
+	signerAddress: AddressSchema,
+	userOpSenderSafe: SafeAddressSchema,
+	digest: Bytes32Schema
+});
+Schema.Struct({
+	status: Schema.Literal("submitted"),
+	executionId: MoneyExecutionIdSchema,
+	commandId: PaymentCommandIdSchema,
+	userOpHash: Bytes32Schema
+});
 Schema.Struct({
 	status: Schema.Literal("submitted"),
 	executionId: MoneyExecutionIdSchema,
@@ -10279,6 +10549,160 @@ const CurrentPolicySchema = Schema.Union([Schema.Struct({
 		actions: Schema.NonEmptyArray(Schema.Literals(["pay", "commitments"]))
 	})
 }), Schema.Struct({ type: Schema.Literal("managePeople") })]);
+const BudgetIntentSchema = CurrentPolicySchema.pipe(Schema.refine((value) => {
+	if (value.type !== "budget") return false;
+	const { actions, recipients } = value.scope;
+	if (new Set(actions).size !== actions.length) return false;
+	return recipients.type === "anyone" || recipients.accounts.length >= 1 && recipients.accounts.length <= 32 && new Set(recipients.accounts).size === recipients.accounts.length;
+}));
+const InvitationIdSchema = Schema.NonEmptyString;
+const InvitationTargetSchema = Schema.Struct({ invitationId: InvitationIdSchema });
+Schema.Struct({
+	...InvitationTargetSchema.fields,
+	expectedOfferDigest: Bytes32Schema
+});
+/** The requested grantee of one invitation. */
+const GranteeRefSchema = Schema.Union([Schema.Struct({
+	type: Schema.Literal("email"),
+	email: Schema.NonEmptyString
+}), Schema.Struct({
+	type: Schema.Literal("account"),
+	accountId: AccountIdSchema
+})]);
+Schema.Struct({
+	requestKey: Schema.String.pipe(Schema.refine((value) => /^[\x20-\x7e]{1,128}$/.test(value))),
+	to: GranteeRefSchema,
+	grants: Schema.Array(Schema.Union([
+		Schema.Struct({
+			type: Schema.Literal("budget"),
+			budgetId: PermissionIdSchema
+		}),
+		Schema.Struct({
+			type: Schema.Literal("managePeople"),
+			permissionId: PermissionIdSchema
+		}),
+		Schema.Struct({
+			type: Schema.Literal("new_budget"),
+			label: Schema.String.pipe(Schema.refine((value) => value.trim().length >= 1 && value.trim().length <= 128)),
+			intent: BudgetIntentSchema
+		})
+	]))
+}).pipe(Schema.refine((value) => {
+	if (value.grants.length < 1 || value.grants.length > 16) return false;
+	const existing = value.grants.flatMap((grant) => grant.type === "new_budget" ? [] : [grant.type === "budget" ? grant.budgetId : grant.permissionId]);
+	return new Set(existing).size === existing.length && value.grants.filter((grant) => grant.type === "new_budget").length <= 4;
+}));
+const InvitationPhaseSchema = Schema.Literals([
+	"authorizing",
+	"pending",
+	"pending_grant",
+	"active",
+	"revoking",
+	"declined",
+	"cancelled",
+	"expired",
+	"revoked"
+]);
+const EndingReasonSchema = Schema.Literals([
+	"declined",
+	"cancelled",
+	"expired",
+	"revoked"
+]);
+const OfferedAuthoritySchema = Schema.Union([Schema.Struct({
+	type: Schema.Literal("budget"),
+	budgetId: Schema.NonEmptyString.pipe(Schema.refine((value) => value.length > 0)),
+	label: Schema.String,
+	policy: BudgetIntentSchema,
+	policyDigest: Bytes32Schema
+}), Schema.Struct({
+	type: Schema.Literal("managePeople"),
+	permissionId: PermissionIdSchema,
+	label: Schema.String
+})]);
+const NewBudgetOfferSchema = Schema.Struct({
+	type: Schema.Literal("new_budget"),
+	label: Schema.String,
+	policy: BudgetIntentSchema,
+	policyDigest: Bytes32Schema
+});
+const PreviewGranteeSchema = Schema.Struct({
+	partyId: Schema.NullOr(PartyIdSchema),
+	accountId: Schema.NullOr(AccountIdSchema),
+	safeAddress: AddressSchema,
+	accountReady: Schema.NullOr(Schema.Boolean)
+});
+Schema.Struct({
+	orgId: Schema.NonEmptyString.pipe(Schema.refine((value) => value.length > 0)),
+	grantee: PreviewGranteeSchema,
+	grants: Schema.Array(Schema.Union([OfferedAuthoritySchema, NewBudgetOfferSchema])),
+	existingAssignments: Schema.Array(PermissionAssignmentIdSchema),
+	includesManagement: Schema.Boolean,
+	observedAt: EpochMsSchema
+});
+Schema.Struct({
+	cursor: Schema.optional(Schema.NonEmptyString),
+	limit: Schema.optional(Schema.Number.pipe(Schema.refine((value) => Number.isSafeInteger(value) && value >= 1 && value <= 100))),
+	phases: Schema.optional(Schema.Array(InvitationPhaseSchema).pipe(Schema.refine((value) => new Set(value).size === value.length)))
+});
+const InvitationRecoverySchema = Schema.Struct({
+	actor: Schema.Literals([
+		"system",
+		"invitee",
+		"admin"
+	]),
+	action: Schema.Literals([
+		"wait",
+		"retry",
+		"review_offer",
+		"reauthorize"
+	]),
+	reason: Schema.Literals([
+		"configuration_pending",
+		"grant_pending",
+		"provider_unavailable",
+		"policy_changed",
+		"cleanup_pending",
+		"signer_unavailable"
+	])
+});
+const InvitationViewSchema = Schema.Struct({
+	id: InvitationIdSchema,
+	orgId: Schema.NonEmptyString.pipe(Schema.refine((value) => value.length > 0)),
+	organizationName: Schema.String,
+	grantee: Schema.Struct({
+		partyId: PartyIdSchema,
+		accountId: Schema.NullOr(AccountIdSchema),
+		safeAddress: AddressSchema,
+		accountReady: Schema.NullOr(Schema.Boolean)
+	}),
+	phase: InvitationPhaseSchema,
+	grants: Schema.Array(Schema.Union([Schema.Struct({
+		type: Schema.Literal("budget"),
+		budgetId: Schema.NonEmptyString.pipe(Schema.refine((value) => value.length > 0))
+	}), Schema.Struct({
+		type: Schema.Literal("managePeople"),
+		permissionId: PermissionIdSchema
+	})])),
+	offers: Schema.Array(OfferedAuthoritySchema),
+	recovery: Schema.NullOr(InvitationRecoverySchema),
+	offerDigest: Bytes32Schema,
+	authorizedAt: Schema.NullOr(EpochMsSchema),
+	acceptedAt: Schema.NullOr(EpochMsSchema),
+	expiresAt: Schema.NullOr(EpochMsSchema),
+	commandId: Schema.NullOr(PaymentCommandIdSchema),
+	endingReason: Schema.NullOr(EndingReasonSchema),
+	delivery: Schema.Literals([
+		"not_confirmed",
+		"sent",
+		"failed"
+	])
+});
+Schema.Struct({
+	items: Schema.Array(InvitationViewSchema),
+	nextCursor: Schema.NullOr(Schema.NonEmptyString),
+	observedAt: EpochMsSchema
+});
 const ActiveBudgetSchema = Schema.Struct({
 	id: PermissionIdSchema,
 	label: Schema.String,
@@ -12214,11 +12638,13 @@ const financialOpsContract = {
 //#region ../../packages/sdk/src/contract/money-execution.ts
 const moneyExecutionContract = {
 	abandonPaymentExecution: makeFunctionReference(CAPXUL_FUNCTIONS["moneyExecution/actions"].abandonPaymentExecution),
+	prepareInvitationConfiguration: makeFunctionReference(CAPXUL_FUNCTIONS["moneyExecution/actions"].prepareInvitationConfiguration),
 	preparePermissionExecution: makeFunctionReference(CAPXUL_FUNCTIONS["moneyExecution/actions"].preparePermissionExecution),
 	preparePaymentExecution: makeFunctionReference(CAPXUL_FUNCTIONS["moneyExecution/actions"].preparePaymentExecution),
 	prepareOrganizationPaymentExecution: makeFunctionReference(CAPXUL_FUNCTIONS["moneyExecution/paymentCommandActions"].prepareOrganizationPaymentExecution),
 	preparePaymentLifecycleExecution: makeFunctionReference(CAPXUL_FUNCTIONS["moneyExecution/paymentCommandActions"].preparePaymentLifecycleExecution),
 	submitPaymentExecution: makeFunctionReference(CAPXUL_FUNCTIONS["moneyExecution/actions"].submitPaymentExecution),
+	submitInvitationConfigurationExecution: makeFunctionReference(CAPXUL_FUNCTIONS["moneyExecution/actions"].submitInvitationConfigurationExecution),
 	submitPermissionExecution: makeFunctionReference(CAPXUL_FUNCTIONS["moneyExecution/actions"].submitPermissionExecution),
 	submitPaymentCommandExecution: makeFunctionReference(CAPXUL_FUNCTIONS["moneyExecution/paymentCommandActions"].submitPaymentCommandExecution)
 };
@@ -12799,7 +13225,7 @@ function subscribeActivity(deps, actor, controls, onChange) {
 }
 //#endregion
 //#region ../../packages/sdk/package.json
-var version$1 = "4.20.0-beta.6";
+var version$1 = "4.20.0-beta.7";
 //#endregion
 //#region ../../packages/sdk/src/telemetry/exception-projection.ts
 /** Fixed fallback for failures that have no safe message. */
@@ -13635,7 +14061,7 @@ function isMoneyTelemetryDebugEnabled() {
 }
 //#endregion
 //#region ../../packages/sdk/src/surface/payment-command-execution.ts
-function isAborted$2(signal) {
+function isAborted$3(signal) {
 	return signal?.aborted === true;
 }
 function canonicalJson(value) {
@@ -13661,7 +14087,7 @@ async function abandonPrepared$1(deps, executionId, closePayment, reason, result
 	return result;
 }
 async function executePrepared(deps, prepare, isExpectedRequest, closePaymentOnExit, onPreparedClosed, signal, controls) {
-	if (isAborted$2(signal)) return {
+	if (isAborted$3(signal)) return {
 		ok: false,
 		error: Errors.cancelled({ operation: "payments" })
 	};
@@ -13690,7 +14116,7 @@ async function executePrepared(deps, prepare, isExpectedRequest, closePaymentOnE
 		ok: false,
 		error: Errors.invalidInput("payment", "prepared authority mismatch")
 	}, onPreparedClosed, controls);
-	if (isAborted$2(signal)) return abandonPrepared$1(deps, prepared.value.executionId, closePaymentOnExit, "cancelled", {
+	if (isAborted$3(signal)) return abandonPrepared$1(deps, prepared.value.executionId, closePaymentOnExit, "cancelled", {
 		ok: false,
 		error: Errors.cancelled({ operation: "payments" })
 	}, onPreparedClosed, controls);
@@ -13716,7 +14142,7 @@ async function executePrepared(deps, prepare, isExpectedRequest, closePaymentOnE
 			error: signerFailure(deps.signer.source, "signUserOpHash", cause)
 		}, onPreparedClosed, controls);
 	}
-	if (isAborted$2(signal)) return abandonPrepared$1(deps, prepared.value.executionId, closePaymentOnExit, "cancelled", {
+	if (isAborted$3(signal)) return abandonPrepared$1(deps, prepared.value.executionId, closePaymentOnExit, "cancelled", {
 		ok: false,
 		error: Errors.cancelled({ operation: "payments" })
 	}, onPreparedClosed, controls);
@@ -13751,7 +14177,7 @@ function cancelled(operation) {
 		error: Errors.cancelled({ operation })
 	};
 }
-function isAborted$1(signal) {
+function isAborted$2(signal) {
 	return signal?.aborted === true;
 }
 async function signerCall(source, operation, run) {
@@ -13777,7 +14203,7 @@ async function abandonPrepared(deps, executionId, reason, result, onPreparedClos
 	return result;
 }
 async function executePersonalPayment(deps, payment, signal, requestKey, onPreparedClosed) {
-	if (isAborted$1(signal)) return cancelled(CAPXUL_OPERATIONS.payments.pay);
+	if (isAborted$2(signal)) return cancelled(CAPXUL_OPERATIONS.payments.pay);
 	if (deps.signer === void 0) return mismatch("signer", "payments.pay requires a configured CapxulSigner");
 	const session = deps.actor.authSession();
 	if (session === null) return {
@@ -13805,10 +14231,10 @@ async function executePersonalPayment(deps, payment, signal, requestKey, onPrepa
 		executionId: prepared.value.executionId,
 		recipient: prepared.value.recipientObservation
 	});
-	if (isAborted$1(signal)) return abandonPrepared(deps, prepared.value.executionId, "cancelled", cancelled(CAPXUL_OPERATIONS.payments.pay), onPreparedClosed);
+	if (isAborted$2(signal)) return abandonPrepared(deps, prepared.value.executionId, "cancelled", cancelled(CAPXUL_OPERATIONS.payments.pay), onPreparedClosed);
 	const signature = await signerCall(deps.signer.source, "signUserOpHash", () => deps.signer.signUserOpHash(prepared.value.digest));
 	if (!signature.ok) return abandonPrepared(deps, prepared.value.executionId, "signer_rejected", signature, onPreparedClosed);
-	if (isAborted$1(signal)) return abandonPrepared(deps, prepared.value.executionId, "cancelled", cancelled(CAPXUL_OPERATIONS.payments.pay), onPreparedClosed);
+	if (isAborted$2(signal)) return abandonPrepared(deps, prepared.value.executionId, "cancelled", cancelled(CAPXUL_OPERATIONS.payments.pay), onPreparedClosed);
 	return runIfActive(void 0, CAPXUL_OPERATIONS.payments.submitExecution, () => deps.convexCall.action(deps.functions.submitPaymentExecution, { input: {
 		executionId: prepared.value.executionId,
 		signature: signature.value
@@ -44803,7 +45229,9 @@ const OBSERVED_CONVEX_MUTATIONS = /* @__PURE__ */ new Set([
 	"smartAccount/mutations:provision",
 	"org/lifecycle:startOrResume",
 	"org/lifecycle:recordFailure",
-	"org/lifecycle:retry"
+	"org/lifecycle:retry",
+	"org/mutations:invite",
+	"org/mutations:accept"
 ]);
 var ConvexCallAdapter = class {
 	#client;
@@ -45476,10 +45904,7 @@ const DEFAULT_FUNCTIONS$1 = {
 	listAll: makeFunctionReference(CAPXUL_FUNCTIONS["org/queries"].listAll),
 	listRoles: makeFunctionReference(CAPXUL_FUNCTIONS["org/queries"].listRolesByOrgId),
 	listMembers: makeFunctionReference(CAPXUL_FUNCTIONS["org/queries"].listMembersByOrgId),
-	readTreasury: makeFunctionReference(CAPXUL_FUNCTIONS["org/actions"].readTreasury),
-	inviteMember: makeFunctionReference(CAPXUL_FUNCTIONS["org/actions"].inviteMember),
-	resendInvite: makeFunctionReference(CAPXUL_FUNCTIONS["org/mutations"].resendInviteToken),
-	detectInvitations: makeFunctionReference(CAPXUL_FUNCTIONS["org/actions"].detectAndAcceptPendingInvitations)
+	readTreasury: makeFunctionReference(CAPXUL_FUNCTIONS["org/actions"].readTreasury)
 };
 /**
 * Standard production Organization read adapter. It intentionally has no
@@ -45515,22 +45940,6 @@ var ConvexOrganizationAdapter = class {
 	pendingMembers(input) {
 		return this.listMembers(input).pipe(Effect.map((members) => members.filter((member) => member.status === "pending" || member.status === "pending_safe" || member.status === "pending_grant")));
 	}
-	inviteMember(input) {
-		return this.#convex.action(this.#fns.inviteMember, copyInvocationObservation(input, {
-			orgId: input.orgId,
-			email: input.input.email,
-			role: input.input.role
-		})).pipe(Effect.mapError((error) => orgErrorFromCapxul("inviteMember", error.publicError, error)), Effect.map(brandOrgMember), Effect.catchDefect((cause) => Effect.fail(toOrgError("inviteMember", cause))));
-	}
-	resendInviteToken(input) {
-		return this.#convex.mutation(this.#fns.resendInvite, {
-			orgId: input.orgId,
-			email: input.email
-		}).pipe(Effect.mapError((error) => orgErrorFromCapxul("resendInviteToken", error.publicError, error)), Effect.map(brandOrgMember), Effect.catchDefect((cause) => Effect.fail(toOrgError("resendInviteToken", cause))));
-	}
-	detectAndAcceptPendingInvitations(_input) {
-		return this.#convex.action(this.#fns.detectInvitations, {}).pipe(Effect.mapError((error) => orgErrorFromCapxul("detectAndAcceptPendingInvitations", error.publicError, error)), Effect.map((result) => ({ matched: result.matched.map(toOrgId) })), Effect.catchDefect((cause) => Effect.fail(toOrgError("detectAndAcceptPendingInvitations", cause))));
-	}
 	#readTreasuryWire(input) {
 		const orgId = String(input.orgId);
 		return retryIdempotentRead(this.#convex.action(this.#fns.readTreasury, copyInvocationObservation(input, { orgId })), CAPXUL_OPERATIONS.org.treasury, this.#telemetry, input).pipe(Effect.mapError((error) => orgErrorFromCapxul("readTreasury", error.publicError, error)), Effect.map((wire) => {
@@ -45575,11 +45984,12 @@ var ConvexOrganizationSetupAdapter = class {
 	#fns;
 	constructor(input) {
 		this.#convex = input.convex;
-		this.#signer = input.signer;
+		this.#signer = input.signer ?? null;
 		this.#chainId = input.chainId;
 		this.#fns = input.functions ?? DEFAULT_FUNCTIONS;
 	}
 	async startOrResume(input) {
+		if (this.#signer === null) return fail$2(Errors.capabilityUnavailable("signer", "startOrResume"));
 		const result = await runCall("startOrResume", this.#convex.mutation(this.#fns.startOrResume, copyInvocationObservation(input, {
 			...input,
 			chainId: this.#chainId
@@ -45607,7 +46017,9 @@ var ConvexOrganizationSetupAdapter = class {
 	async authorizeAndSubmitBootstrap(input) {
 		const cancelled = cancellation(input.signal);
 		if (cancelled !== void 0) return cancelled;
-		const signerAddress = await signerResult(this.#signer.source, "getAddress", () => this.#signer.getAddress());
+		const signer = this.#signer;
+		if (signer === null) return fail$2(Errors.capabilityUnavailable("signer", "authorizeAndSubmitBootstrap"));
+		const signerAddress = await signerResult(signer.source, "getAddress", () => signer.getAddress());
 		if (!signerAddress.ok) return signerAddress;
 		const prepared = await runCall("prepareBootstrap", this.#convex.action(this.#fns.prepareBootstrap, copyInvocationObservation(input, {
 			orgId: input.orgId,
@@ -45619,7 +46031,7 @@ var ConvexOrganizationSetupAdapter = class {
 		if (!authority.ok) return authority;
 		const cancelledAfterPrepare = cancellation(input.signal);
 		if (cancelledAfterPrepare !== void 0) return cancelledAfterPrepare;
-		const signature = await signerResult(this.#signer.source, "signUserOpHash", () => this.#signer.signUserOpHash(prepared.value.digest));
+		const signature = await signerResult(signer.source, "signUserOpHash", () => signer.signUserOpHash(prepared.value.digest));
 		if (!signature.ok) return signature;
 		const cancelledAfterSign = cancellation(input.signal);
 		if (cancelledAfterSign !== void 0) return cancelledAfterSign;
@@ -45675,7 +46087,8 @@ var ConvexOrganizationSetupAdapter = class {
 			...input.observationContext === void 0 ? {} : { observationContext: input.observationContext }
 		});
 		if (!current.ok) return current;
-		if (current.value.status === "failed" && current.value.retryable && (current.value.at === "awaitingFounderAuthorization" || current.value.at === "submittingBootstrap")) {
+		if (current.value.status === "failed" && current.value.retryable && current.value.at === "awaitingFounderAuthorization") {
+			if (this.#signer === null) return fail$2(Errors.capabilityUnavailable("signer", "retry"));
 			const reset = resetSignerSession(this.#signer);
 			if (!reset.ok) return reset;
 		}
@@ -46338,7 +46751,7 @@ const identitySpec = (input, sessionStore = { current: null }) => {
 		initial: RESTORING,
 		label,
 		slot: identitySlot,
-		transition: (state, event) => transition(state, event, config),
+		transition: (state, event) => transition$1(state, event, config),
 		recoverFailure: recoverIdentityFailure,
 		invalidates: (event) => event._tag === "Reset" ? [
 			IDENTITY_SLOT.auth,
@@ -47723,6 +48136,271 @@ function makeOrgMeMethod(deps, orgId) {
 	};
 }
 //#endregion
+//#region ../../packages/sdk/src/contract/invitations.ts
+const invitationContract = {
+	preview: makeFunctionReference(CAPXUL_FUNCTIONS["org/queries"].previewInvite),
+	listMine: makeFunctionReference(CAPXUL_FUNCTIONS["org/queries"].listMyInvitations),
+	listScoped: makeFunctionReference(CAPXUL_FUNCTIONS["org/queries"].listInvitations),
+	get: makeFunctionReference(CAPXUL_FUNCTIONS["org/queries"].getInvitation),
+	invite: makeFunctionReference(CAPXUL_FUNCTIONS["org/mutations"].invite),
+	accept: makeFunctionReference(CAPXUL_FUNCTIONS["org/mutations"].accept),
+	decline: makeFunctionReference(CAPXUL_FUNCTIONS["org/mutations"].decline),
+	cancel: makeFunctionReference(CAPXUL_FUNCTIONS["org/mutations"].cancel),
+	resend: makeFunctionReference(CAPXUL_FUNCTIONS["org/mutations"].resend),
+	retry: makeFunctionReference(CAPXUL_FUNCTIONS["org/mutations"].retry)
+};
+//#endregion
+//#region ../../packages/sdk/src/surface/invitations.ts
+/**
+* The one refusal a scoped invitation result that names another Organization
+* receives, whether it was read or returned by the authoring write.
+*/
+function scopeRefusal(orgId) {
+	return Errors.invalidInput("orgId", `The invitation result does not belong to Organization ${JSON.stringify(orgId)}.`);
+}
+/**
+* A scoped invitation result belongs to the Organization it was read under.
+*
+* One owner holds the refusal copy and the verified-scope span: a single view
+* reports whether it names the scope, and a page — which names no Organization
+* of its own — reports whether every row does. A result that does not belong is
+* refused here rather than handed to a consumer, so a future route change
+* cannot turn into a silent cross-Organization read on a caller that trusted
+* the scope it passed. A successful scoped read also marks the verifying
+* Organization on the owning span, exactly as `org.me` does — the caller's
+* scope hint is not authority, the completed scoped read is.
+*/
+function verifyScope(orgId, value, belongsToScope) {
+	if (!belongsToScope(value)) return Effect.fail(scopeRefusal(orgId));
+	return Effect.annotateCurrentSpan({
+		verified_organization_id: orgId,
+		scope_kind: "organization"
+	}).pipe(Effect.as(value));
+}
+/** One view names its own Organization. */
+const namesScope = (orgId) => (value) => String(value.orgId) === orgId;
+/** A page names no Organization of its own, so every row must name the scope. */
+const rowsNameScope = (orgId) => (page) => page.items.every((item) => String(item.orgId) === orgId);
+const ops = CAPXUL_OPERATIONS.org.invitations;
+/** Truth for a caller-owned signal, without narrowing its type. */
+function isAborted$1(signal) {
+	return signal?.aborted === true;
+}
+/**
+* One observed operation around one Convex hop, exactly like `org.me`. The
+* call-start invocation snapshot rides the arguments, so the backend continues
+* the attempt this call started rather than resolving a new one.
+*/
+function observed$1(deps, operation, options, args, call, check) {
+	const controls = deps.invocationControls?.(options) ?? options;
+	return runCapxulEffect(call(copyInvocationObservation(controls, args)).pipe(Effect.mapError((failure) => failure.publicError), Effect.flatMap((value) => check === void 0 ? Effect.succeed(value) : check(value))), controls, operation, deps.runPromise);
+}
+/**
+* The Admin's preview stays a read: it reaches the preview query and nothing
+* else. It reads current policies and live assignments, so the operator sees
+* what the offered authority is now, not a frozen copy.
+*/
+function makeOrgInvitationMethods(deps, orgId) {
+	const scopeCheck = (value) => verifyScope(orgId, value, namesScope(orgId));
+	return {
+		preview: (input, options) => observed$1(deps, ops.preview, options, {
+			orgId,
+			request: input
+		}, (args) => deps.convexCall.query(invitationContract.preview, args), scopeCheck),
+		invite: makeInviteMethod(deps, orgId),
+		accept: (input, options) => observed$1(deps, ops.accept, options, {
+			orgId,
+			invitationId: input.invitationId,
+			expectedOfferDigest: input.expectedOfferDigest
+		}, (args) => deps.convexCall.mutation(invitationContract.accept, args), scopeCheck),
+		list: (input, options) => observed$1(deps, ops.listScoped, options, {
+			orgId,
+			...pageArgs(input)
+		}, (args) => deps.convexCall.query(invitationContract.listScoped, args), (page) => verifyScope(orgId, page, rowsNameScope(orgId))),
+		get: (input, options) => observed$1(deps, ops.get, options, {
+			orgId,
+			invitationId: input.invitationId
+		}, (args) => deps.convexCall.query(invitationContract.get, args), scopeCheck),
+		decline: (input, options) => observed$1(deps, ops.decline, options, {
+			orgId,
+			invitationId: input.invitationId
+		}, (args) => deps.convexCall.mutation(invitationContract.decline, args), scopeCheck),
+		cancel: (input, options) => observed$1(deps, ops.cancel, options, {
+			orgId,
+			invitationId: input.invitationId
+		}, (args) => deps.convexCall.mutation(invitationContract.cancel, args), scopeCheck),
+		resend: (input, options) => observed$1(deps, ops.resend, options, {
+			orgId,
+			invitationId: input.invitationId
+		}, (args) => deps.convexCall.mutation(invitationContract.resend, args), scopeCheck),
+		retry: (input, options) => observed$1(deps, ops.retry, options, {
+			orgId,
+			invitationId: input.invitationId
+		}, (args) => deps.convexCall.mutation(invitationContract.retry, args), scopeCheck)
+	};
+}
+/**
+* The authoring write, including its configuration hop.
+*
+* The mutation persists the invitation and its configure command before any
+* signature exists. The write then drives the existing human configuration
+* owner exactly as the Permission and payment surfaces drive theirs: prepare
+* the stored command for this Account's Safe, check the prepared authority
+* against the request, deliver the durable identity to the caller, sign the
+* returned digest, and submit it. The backend keeps the only authorization
+* rule (`prepareInvitationConfigurationIntentInTx` /
+* `submitInvitationConfigurationExecution`); this edge adds no second one.
+*
+* Cancellation owns the whole compound: an abort before the digest is signed
+* stops the write and forwards no signature, and an already-signed submission
+* completes.
+*/
+async function executeInvite(deps, orgId, input, signal, controls, verifiedOrganization, onPrepared) {
+	if (isAborted$1(signal)) return {
+		ok: false,
+		error: Errors.cancelled({ operation: ops.authorize })
+	};
+	if (deps.actor === void 0 || deps.chainId === void 0 || deps.signer === void 0) return {
+		ok: false,
+		error: Errors.notImplemented("invitations", "executionComposition")
+	};
+	const session = deps.actor.authSession();
+	if (session === null) return {
+		ok: false,
+		error: Errors.notAuthenticated()
+	};
+	const authored = await runIfActive(signal, ops.authorize, () => withInvocationParentSpan(Effect.suspend(() => deps.convexCall.mutation(invitationContract.invite, copyInvocationObservation(controls, {
+		orgId,
+		request: input
+	}))), controls), deps.runPromise);
+	if (!authored.ok) return authored;
+	const view = authored.value;
+	if (String(view.orgId) !== orgId) return {
+		ok: false,
+		error: scopeRefusal(orgId)
+	};
+	if (view.phase !== "authorizing") return {
+		ok: true,
+		value: view
+	};
+	if (view.commandId === null) return {
+		ok: false,
+		error: Errors.invalidInput("invitationId", "The invitation does not name its configuration command.")
+	};
+	const commandId = view.commandId;
+	let signerAddress;
+	try {
+		signerAddress = await deps.signer.getAddress();
+	} catch (cause) {
+		return {
+			ok: false,
+			error: signerFailure(deps.signer.source, "getAddress", cause)
+		};
+	}
+	const prepared = await runIfActive(signal, ops.prepareConfiguration, () => withInvocationParentSpan(Effect.suspend(() => deps.convexCall.action(moneyExecutionContract.prepareInvitationConfiguration, copyInvocationObservation(controls, { input: {
+		commandId,
+		signerAddress
+	} }))), controls), deps.runPromise);
+	if (!prepared.ok) return prepared;
+	const expectedSafe = deriveCapxulSafeAddress({ email: session.email });
+	if (!preparedAuthorityMatches({
+		prepared: prepared.value,
+		chainId: deps.chainId,
+		signerAddress,
+		expectedSafe,
+		commandId,
+		invitationId: view.id,
+		orgId
+	})) return {
+		ok: false,
+		error: Errors.invalidInput("invitation", "prepared authority mismatch")
+	};
+	verifiedOrganization(prepared.value.orgId);
+	if (isAborted$1(signal)) return {
+		ok: false,
+		error: Errors.cancelled({ operation: ops.authorize })
+	};
+	if (onPrepared !== void 0) try {
+		await onPrepared({
+			invitationId: prepared.value.invitationId,
+			commandId: prepared.value.commandId
+		});
+	} catch (cause) {
+		return {
+			ok: false,
+			error: cause instanceof CapxulError ? cause : Errors.unknown(cause)
+		};
+	}
+	if (isAborted$1(signal)) return {
+		ok: false,
+		error: Errors.cancelled({ operation: ops.authorize })
+	};
+	let signature;
+	try {
+		signature = await deps.signer.signUserOpHash(prepared.value.digest);
+	} catch (cause) {
+		return {
+			ok: false,
+			error: signerFailure(deps.signer.source, "signUserOpHash", cause)
+		};
+	}
+	if (isAborted$1(signal)) return {
+		ok: false,
+		error: Errors.cancelled({ operation: ops.authorize })
+	};
+	const submitted = await runIfActive(void 0, ops.submitConfiguration, () => withInvocationParentSpan(Effect.suspend(() => deps.convexCall.action(moneyExecutionContract.submitInvitationConfigurationExecution, copyInvocationObservation(controls, { input: {
+		executionId: prepared.value.executionId,
+		signature
+	} }))), controls), deps.runPromise);
+	if (!submitted.ok) return submitted;
+	return {
+		ok: true,
+		value: view
+	};
+}
+/**
+* The prepared authority must be exactly the one this write asked for: the same
+* chain, the caller's signer, this Account's Safe, and the exact command and
+* invitation the authoring view named.
+*/
+function preparedAuthorityMatches(input) {
+	return input.prepared.chainId === input.chainId && input.prepared.signerAddress.toLowerCase() === input.signerAddress.toLowerCase() && input.prepared.userOpSenderSafe.toLowerCase() === input.expectedSafe.toLowerCase() && input.prepared.commandId === input.commandId && input.prepared.invitationId === input.invitationId && input.prepared.orgId === input.orgId;
+}
+function makeInviteMethod(deps, orgId) {
+	return (input, options) => {
+		const { onPrepared, ...supplied } = options ?? {};
+		const controls = deps.invocationControls?.(supplied) ?? supplied;
+		let verifiedOrganizationId;
+		return runCapxulEffect(Effect.gen(function* () {
+			if (controls?.signal?.aborted === true) return yield* Effect.fail(Errors.cancelled({ operation: ops.authorize }));
+			const parent = yield* Effect.currentSpan.pipe(Effect.orDie);
+			const captured = carryInvocationParentSpan(controls, parent);
+			const result = yield* Effect.tryPromise({
+				try: () => executeInvite(deps, orgId, input, controls?.signal, captured, (id) => {
+					verifiedOrganizationId = id;
+				}, onPrepared),
+				catch: (cause) => cause instanceof CapxulError ? cause : Errors.unknown(cause)
+			});
+			return yield* result.ok ? Effect.succeed(result.value) : Effect.fail(result.error);
+		}).pipe(Effect.ensuring(Effect.suspend(() => verifiedOrganizationId === void 0 ? Effect.void : Effect.annotateCurrentSpan({
+			verified_organization_id: verifiedOrganizationId,
+			scope_kind: "organization"
+		})).pipe(Effect.catchCause(() => Effect.void)))), observationOnlyControls(controls), ops.authorize, deps.runPromise);
+	};
+}
+/** Drop the page fields the caller did not supply; a bounded page sends only its bounds. */
+function pageArgs(input) {
+	if (input === void 0) return {};
+	return {
+		...input.cursor === void 0 ? {} : { cursor: input.cursor },
+		...input.limit === void 0 ? {} : { limit: input.limit },
+		...input.phases === void 0 ? {} : { phases: input.phases }
+	};
+}
+function makeOwnInvitationsMethod(deps) {
+	return (input, options) => observed$1(deps, ops.list, options, pageArgs(input), (args) => deps.convexCall.query(invitationContract.listMine, args));
+}
+//#endregion
 //#region ../../packages/sdk/src/contract/permission.ts
 const permissionContract = { read: makeFunctionReference(CAPXUL_FUNCTIONS["permission/queries"].read) };
 //#endregion
@@ -48410,20 +49088,6 @@ function hermeticOrgView(input) {
 		observedAt: 0
 	};
 }
-function hermeticMember(input) {
-	return {
-		orgId: input.orgId,
-		accountId: null,
-		email: toEmail(input.email),
-		name: null,
-		personalSafeAddress: input.personalSafeAddress ?? null,
-		role: input.role,
-		roleKey: toRoleKey(orgRoleKeyForLabel(input.role)),
-		status: input.status,
-		grantTxHash: input.grantTxHash ?? null,
-		revokeTxHash: input.revokeTxHash ?? null
-	};
-}
 function createOrgProgram(input) {
 	return Effect.gen(function* () {
 		const deps = yield* OrgDepsTag;
@@ -48524,35 +49188,6 @@ function listMembersProgram(orgId) {
 		return [];
 	});
 }
-/**
-* R06 (#1964): the SDK no longer emits `org_invite_sent`. The backend action
-* that writes the invitation is its ONE producer, so a hermetic call — which
-* writes nothing — can no longer report an invitation that never happened, and
-* a live call is counted once instead of twice. The captured attempt rides the
-* port input, so the durable event carries the correlation this call ran under.
-*/
-function inviteMemberProgram(orgId, input) {
-	return Effect.gen(function* () {
-		const deps = yield* OrgDepsTag;
-		if (deps.orgPort === void 0) return hermeticMember({
-			orgId,
-			email: input.email,
-			role: input.role,
-			status: "pending"
-		});
-		return yield* deps.orgPort.inviteMember(copyInvocationObservation(deps.invocationSource, {
-			orgId,
-			input
-		})).pipe(Effect.mapError((error) => error.publicError));
-	});
-}
-function detectAndAcceptPendingInvitationsProgram() {
-	return Effect.gen(function* () {
-		const deps = yield* OrgDepsTag;
-		if (deps.orgPort !== void 0) return yield* deps.orgPort.detectAndAcceptPendingInvitations({}).pipe(Effect.mapError((error) => error.publicError));
-		return { matched: [] };
-	});
-}
 function listOrgsProgram() {
 	return Effect.gen(function* () {
 		const deps = yield* OrgDepsTag;
@@ -48658,6 +49293,20 @@ function observedRunnerDeps(deps) {
 		...deps.invocationControls === void 0 ? {} : { invocationControls: deps.invocationControls }
 	};
 }
+/**
+* The invitation edge needs the call seam, the observed-runner pair, and — for
+* the authoring write's configuration hop — the same execution composition the
+* Permission, payment, and payroll bundles receive.
+*/
+function invitationMethodsDeps(deps, convexCall) {
+	return {
+		convexCall,
+		...observedRunnerDeps(deps),
+		...deps.actor === void 0 ? {} : { actor: deps.actor },
+		...deps.chainId === void 0 ? {} : { chainId: Number(deps.chainId) },
+		...deps.signer === void 0 ? {} : { signer: deps.signer }
+	};
+}
 function makeOrgMethods(deps) {
 	const orgDeps = {
 		...deps.orgPort === void 0 ? {} : { orgPort: deps.orgPort },
@@ -48689,13 +49338,10 @@ function makeOrgMethods(deps) {
 			});
 			return toCapxulResult(createOrgProgram(input), layer);
 		},
-		orgs: Object.assign((options) => listOrganizations(deps.invocationControls?.(options) ?? options), { detectAndAcceptPendingInvitations(options) {
-			if (options?.signal?.aborted) return Promise.resolve({
-				ok: false,
-				error: Errors.cancelled({ operation: CAPXUL_OPERATIONS.organizations.detectAndAcceptPendingInvitations })
-			});
-			return toCapxulResult(detectAndAcceptPendingInvitationsProgram(), layer);
-		} }),
+		orgs: Object.assign((options) => listOrganizations(deps.invocationControls?.(options) ?? options), { invitations: deps.convexCall === void 0 ? () => Promise.resolve({
+			ok: false,
+			error: Errors.notImplemented("invitations", "listOwn")
+		}) : makeOwnInvitationsMethod(invitationMethodsDeps(deps, deps.convexCall)) }),
 		org(orgId) {
 			const convexCall = deps.convexCall;
 			return {
@@ -48803,17 +49449,7 @@ function makeOrgMethods(deps) {
 					});
 					return toCapxulResult(listRolesProgram(orgId), layer);
 				},
-				invite(_input, _options) {
-					const controls = deps.invocationControls?.(_options) ?? _options;
-					if (controls?.signal?.aborted) return Promise.resolve({
-						ok: false,
-						error: Errors.cancelled({ operation: CAPXUL_OPERATIONS.org.invite })
-					});
-					return runCapxulEffect(inviteMemberProgram(orgId, _input).pipe(Effect.provide(orgDepsLayer({
-						...orgDeps,
-						...controls === void 0 ? {} : { invocationSource: controls }
-					}))), controls, CAPXUL_OPERATIONS.org.invite, deps.runPromise);
-				},
+				invitations: convexCall === void 0 ? makeNotImplementedInvitationMethods() : makeOrgInvitationMethods(invitationMethodsDeps(deps, convexCall), String(orgId)),
 				auditLog(_options) {
 					if (_options?.signal?.aborted) return Promise.resolve({
 						ok: false,
@@ -48876,6 +49512,28 @@ const orgMeUnavailable = () => Promise.resolve({
 	ok: false,
 	error: Errors.notImplemented("org", "me")
 });
+/**
+* The closed invitation surface for a client with no backend seam. It reports
+* `NOT_IMPLEMENTED` for every method rather than an empty list or a fabricated
+* view: an absent composition root is not an absent invitation.
+*/
+function makeNotImplementedInvitationMethods() {
+	return {
+		preview: invitationExecutionUnavailable,
+		invite: invitationExecutionUnavailable,
+		accept: invitationExecutionUnavailable,
+		list: invitationExecutionUnavailable,
+		get: invitationExecutionUnavailable,
+		decline: invitationExecutionUnavailable,
+		cancel: invitationExecutionUnavailable,
+		resend: invitationExecutionUnavailable,
+		retry: invitationExecutionUnavailable
+	};
+}
+const invitationExecutionUnavailable = () => Promise.resolve({
+	ok: false,
+	error: Errors.notImplemented("invitations", "executionComposition")
+});
 const permissionExecutionUnavailable = () => Promise.resolve({
 	ok: false,
 	error: Errors.notImplemented("permissions", "executionComposition")
@@ -49375,7 +50033,6 @@ function assembleCapxulClient(input) {
 	};
 	if (input.signal !== void 0) input.signal.addEventListener("abort", () => void stopActor(), { once: true });
 	const selectedOrgPort = input.orgPort ?? input.orgDeploymentPort;
-	let detectPendingOrgInvitations;
 	let kickProvisioning;
 	const financialOps = makeFinancialOpsMethods({
 		runPromise: effectRunner.runPromise,
@@ -49424,7 +50081,6 @@ function assembleCapxulClient(input) {
 				if (browserSigner.statusStore?.status() === "unknown" && typeof browserSigner.ensureWalletReady === "function") browserSigner.ensureWalletReady().catch(() => {});
 			}
 			if (accountSetup === "explicit") return;
-			await detectPendingOrgInvitations?.();
 			kickProvisioning?.();
 		}
 	});
@@ -49492,9 +50148,6 @@ function assembleCapxulClient(input) {
 		...input.signer === void 0 ? {} : { signer: input.signer },
 		...input.organizationSetup === void 0 ? {} : { organizationSetup: input.organizationSetup }
 	});
-	if (selectedOrgPort !== void 0) detectPendingOrgInvitations = async () => {
-		await orgMethods.orgs.detectAndAcceptPendingInvitations();
-	};
 	const currentUser = makeCurrentUserMethods({
 		me: financialOps.me,
 		accounts,
@@ -50667,11 +51320,11 @@ async function createCapxulClientWithSignerControls(input, controls) {
 			accountSetup: input.accountSetup,
 			...signer === void 0 ? {} : { signer },
 			orgPort: Context.get(adapters.value.context, OrgPortTag),
-			...signer === void 0 ? {} : { organizationSetup: new ConvexOrganizationSetupAdapter({
+			organizationSetup: new ConvexOrganizationSetupAdapter({
 				convex: adapters.value.ports.convexCall,
-				signer,
+				...signer === void 0 ? {} : { signer },
 				chainId: adapters.value.bootstrap.chainId
-			}) },
+			}),
 			...input.signal === void 0 ? {} : { signal: input.signal },
 			...input.otpTtlMs === void 0 ? {} : { otpTtlMs: input.otpTtlMs },
 			invokeTimeoutMs: input.invokeTimeoutMs ?? 3e4,
@@ -51010,8 +51663,8 @@ function captureException(telemetry, error, context) {
 }
 //#endregion
 //#region src/version.ts
-const cliVersion = "4.20.0-beta.6";
-const sdkVersion = "4.20.0-beta.6";
+const cliVersion = "4.20.0-beta.7";
+const sdkVersion = "4.20.0-beta.7";
 const ReleaseVersion = Schema.String.check(Schema.isMaxLength(256), Schema.isPattern(/^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)(?:-((?:0|[1-9]\d*|\d*[a-zA-Z-][0-9a-zA-Z-]*)(?:\.(?:0|[1-9]\d*|\d*[a-zA-Z-][0-9a-zA-Z-]*))*))?(?:\+[0-9a-zA-Z-]+(?:\.[0-9a-zA-Z-]+)*)?$/u)).pipe(Schema.brand("CliReleaseVersion"));
 const parts = (version) => {
 	const [core = "", ...prerelease] = version.split("+")[0].split("-");
@@ -51677,7 +52330,7 @@ function parsedCommand(cause) {
 //#endregion
 //#region src/runtime/config.ts
 const bundledKey = Redacted.make("cap_pk_test_DXF9C0HPKB9GPQX5C6RDP6NXKZG1B0D7");
-const bundledOrigin = "https://api.staging.capxul.com";
+const bundledOrigin = "https://site.preview.abuusama.dev";
 const defaultHost = "https://us.i.posthog.com";
 const defaultProjectToken = Redacted.make("phc_BZuAVofrkNXzwpJkuDG7Rdfurir45fj2dudQvJZk847e");
 const optionalText$1 = (name) => Config.option(Config.string(name));
@@ -52238,9 +52891,17 @@ const boundedLine = (value) => typeof value === "number" && Number.isSafeInteger
 const writeStdout = (text) => Effect.flatMap(Stdio.Stdio, (stdio) => Stream.run(Stream.make(text), stdio.stdout()));
 const writeStderr = (text) => Effect.flatMap(Stdio.Stdio, (stdio) => Stream.run(Stream.make(text), stdio.stderr()));
 function renderResult(mode, envelope, lines = []) {
-	if (mode === "json") return writeStdout(`${JSON.stringify(envelope)}\n`);
-	return envelope.outcome === "succeeded" ? writeStdout(`${lines.join("\n")}\n`) : writeStderr(`${envelope.error.code}: ${envelope.error.message}\n`);
+	const pretty = process.stdout.isTTY === true;
+	if (mode === "json") return writeStdout(`${JSON.stringify(envelope, null, pretty ? 2 : void 0)}\n`);
+	return envelope.outcome === "succeeded" ? writeStdout(`${(pretty ? lines.map(readableLine) : lines).join("\n")}\n`) : writeStderr(`${envelope.error.code}: ${envelope.error.message}\n`);
 }
+const readableLine = (line) => {
+	try {
+		return JSON.stringify(JSON.parse(line), null, 2);
+	} catch {
+		return line;
+	}
+};
 //#endregion
 //#region src/runtime/command-metadata.ts
 var CliCommandMetadata = class extends Context.Service()("capxul-cli/CommandMetadata") {};
@@ -52380,7 +53041,7 @@ const checkDoctor = (config, options) => Effect.gen(function* () {
 	};
 	if (!options.online) return report;
 	const key = config.publishableKey;
-	if (key === void 0 || Redacted.value(key).length === 0) return yield* Effect.fail(configurationFailure("Set CAPXUL_PUBLISHABLE_KEY for the Railway application before an online check."));
+	if (key === void 0 || Redacted.value(key).length === 0) return yield* Effect.fail(configurationFailure("Set CAPXUL_PUBLISHABLE_KEY for the staging application before an online check."));
 	const result = yield* Effect.gen(function* () {
 		const started = yield* Clock.currentTimeMillis;
 		const client = yield* acquireClient({
@@ -52767,13 +53428,19 @@ main{display:flex;min-height:100dvh;flex-direction:column;align-items:center;jus
 .logo{width:48px;height:48px;flex:none;animation:capxul-pulse 2s ease-in-out infinite}
 [data-state=ready] .logo,[data-state=failed] .logo{animation:none}
 h1{max-width:448px;margin:0;font-size:18px;font-weight:500;line-height:28px;text-wrap:balance}
+[data-state=working] h1{animation:capxul-breathe 2.4s ease-in-out infinite}
+@keyframes capxul-breathe{50%{opacity:.5}}
 .message{max-width:448px;margin:0;color:#525252;font-size:14px;line-height:20px;text-wrap:pretty}
+.action{margin:0;padding:10px 18px;border:1px solid currentColor;border-radius:9999px;background:transparent;color:inherit;font:inherit;cursor:pointer}
+.action:hover{opacity:.75}
+.action:focus-visible{outline:2px solid #F97316;outline-offset:2px}
+[hidden]{display:none!important}
 .sr-only{position:absolute;width:1px;height:1px;padding:0;margin:-1px;overflow:hidden;clip:rect(0,0,0,0);white-space:nowrap;border:0}
 @media(prefers-color-scheme:dark){.message{color:#D4D4D4}}
-@media(prefers-reduced-motion:reduce){.logo{animation:none}}
+@media(prefers-reduced-motion:reduce){.logo,h1{animation:none}}
 @keyframes capxul-pulse{50%{opacity:.45}}
 </style>
-</head><body><main data-state="working" aria-busy="true"><svg class="logo" role="img" aria-label="Capxul" viewBox="0 0 36 36" fill="none" xmlns="http://www.w3.org/2000/svg"><path d="M0 10C0 4.47715 4.47715 0 10 0H26C31.5228 0 36 4.47715 36 10V26C36 31.5228 31.5228 36 26 36H10C4.47715 36 0 31.5228 0 26V10Z" fill="#F97316"/><path d="M26.642 12.0117H25.2845C24.9618 12.012 24.6495 11.8993 24.4036 11.6936C24.1576 11.4879 23.994 11.2028 23.9421 10.8892C23.9303 10.8185 23.9244 10.747 23.9245 10.6754V9.3377C23.9245 8.98325 23.7816 8.6433 23.5273 8.39248C23.2729 8.14167 22.9279 8.00051 22.5679 8H14.5592C14.1991 8.00088 13.854 8.14175 13.5988 8.39197L8.39806 13.5136C8.27192 13.6376 8.17184 13.785 8.10354 13.9472C8.03524 14.1094 8.00006 14.2832 8 14.4588V22.6511C8.00065 23.0055 8.14405 23.3452 8.39873 23.5956C8.65341 23.8461 8.99858 23.9868 9.3585 23.9869H10.716C11.0762 23.987 11.4217 24.128 11.6763 24.3789C11.931 24.6297 12.074 24.9699 12.074 25.3246V26.6613C12.0742 27.016 12.2174 27.3562 12.4721 27.6069C12.7269 27.8577 13.0723 27.9986 13.4325 27.9986H21.4408C21.6192 27.9989 21.7959 27.9644 21.9608 27.8971C22.1256 27.8298 22.2753 27.7311 22.4012 27.6066L24.324 25.7142L27.6005 22.4879C27.7273 22.3639 27.8279 22.2164 27.8967 22.0539C27.9654 21.8914 28.0008 21.7172 28.001 21.5412V13.3494C28.001 13.1736 27.9658 12.9997 27.8975 12.8373C27.8292 12.675 27.7291 12.5275 27.6029 12.4033C27.4767 12.2791 27.3269 12.1805 27.162 12.1133C26.9971 12.0461 26.8204 12.0116 26.642 12.0117Z" fill="white"/><path d="M25.2012 18.4218V20.3672L22.2138 23.3089H15.9015V20.3672H22.2138V18.4218H25.2012ZM15.9015 11.0154L12.9141 13.9571V20.3672H15.9015V13.9571H22.2138V11.0154H15.9015ZM22.2138 13.9571V15.8707H25.2012V13.9571H22.2138Z" fill="#F97316"/></svg><h1 id="title">Connecting to Capxul CLI</h1><p class="message" id="status" role="status" aria-live="polite">Keep this tab open. Continue in your terminal when the wallet is ready.</p><p class="sr-only" id="lead">Keep this tab open. Continue in your terminal when the wallet is ready.</p><p class="sr-only">Account <span id="account">Personal account</span>. Environment <span id="environment">Loading</span>.</p></main><script src="/signer.js" defer><\/script></body></html>`;
+</head><body><main data-state="working" aria-busy="true"><svg class="logo" role="img" aria-label="Capxul" viewBox="0 0 36 36" fill="none" xmlns="http://www.w3.org/2000/svg"><path d="M0 10C0 4.47715 4.47715 0 10 0H26C31.5228 0 36 4.47715 36 10V26C36 31.5228 31.5228 36 26 36H10C4.47715 36 0 31.5228 0 26V10Z" fill="#F97316"/><path d="M26.642 12.0117H25.2845C24.9618 12.012 24.6495 11.8993 24.4036 11.6936C24.1576 11.4879 23.994 11.2028 23.9421 10.8892C23.9303 10.8185 23.9244 10.747 23.9245 10.6754V9.3377C23.9245 8.98325 23.7816 8.6433 23.5273 8.39248C23.2729 8.14167 22.9279 8.00051 22.5679 8H14.5592C14.1991 8.00088 13.854 8.14175 13.5988 8.39197L8.39806 13.5136C8.27192 13.6376 8.17184 13.785 8.10354 13.9472C8.03524 14.1094 8.00006 14.2832 8 14.4588V22.6511C8.00065 23.0055 8.14405 23.3452 8.39873 23.5956C8.65341 23.8461 8.99858 23.9868 9.3585 23.9869H10.716C11.0762 23.987 11.4217 24.128 11.6763 24.3789C11.931 24.6297 12.074 24.9699 12.074 25.3246V26.6613C12.0742 27.016 12.2174 27.3562 12.4721 27.6069C12.7269 27.8577 13.0723 27.9986 13.4325 27.9986H21.4408C21.6192 27.9989 21.7959 27.9644 21.9608 27.8971C22.1256 27.8298 22.2753 27.7311 22.4012 27.6066L24.324 25.7142L27.6005 22.4879C27.7273 22.3639 27.8279 22.2164 27.8967 22.0539C27.9654 21.8914 28.0008 21.7172 28.001 21.5412V13.3494C28.001 13.1736 27.9658 12.9997 27.8975 12.8373C27.8292 12.675 27.7291 12.5275 27.6029 12.4033C27.4767 12.2791 27.3269 12.1805 27.162 12.1133C26.9971 12.0461 26.8204 12.0116 26.642 12.0117Z" fill="white"/><path d="M25.2012 18.4218V20.3672L22.2138 23.3089H15.9015V20.3672H22.2138V18.4218H25.2012ZM15.9015 11.0154L12.9141 13.9571V20.3672H15.9015V13.9571H22.2138V11.0154H15.9015ZM22.2138 13.9571V15.8707H25.2012V13.9571H22.2138Z" fill="#F97316"/></svg><h1 id="title" role="status" aria-live="polite">Connecting to Capxul CLI</h1><p class="message" id="status"></p><button class="action" id="dismiss" type="button" hidden>Close this page</button><p class="sr-only">Account <span id="account">Personal account</span>. Environment <span id="environment">Loading</span>.</p></main><script src="/signer.js" defer><\/script></body></html>`;
 const json = (response, status, body) => {
 	response.writeHead(status, {
 		"cache-control": "no-store",
@@ -53540,61 +54207,61 @@ const logout = (config, suppliedEmail) => Effect.gen(function* () {
 });
 //#endregion
 //#region src/commands/auth.ts
-const emailFlag$1 = Flag.string("email").pipe(Flag.withDescription("Account email"), Flag.optional);
+const emailFlag$3 = Flag.string("email").pipe(Flag.withDescription("Account email"), Flag.optional);
 const otpStdinFlag = Flag.boolean("otp-stdin").pipe(Flag.withDefault(false), Flag.withDescription("Read the six-digit OTP from stdin; never pass it as an argument"));
 const displayNameFlag = Flag.string("display-name").pipe(Flag.withDescription("Profile display name"), Flag.optional);
 const countryFlag = Flag.string("country").pipe(Flag.withDescription("Two-letter ISO country code"), Flag.optional);
 const handleFlag = Flag.string("handle").pipe(Flag.withDescription("Globally unique Capxul handle"), Flag.optional);
-const metadata$2 = (name) => ({
+const metadata$4 = (name) => ({
 	name,
 	capability: "authentication",
 	observation: "command"
 });
 const loginCommand = Command.make("login", {
-	email: emailFlag$1,
+	email: emailFlag$3,
 	otpStdin: otpStdinFlag
 }, ({ email, otpStdin }) => runCommand({
-	...metadata$2("auth.login"),
+	...metadata$4("auth.login"),
 	network: true
-}, (config) => login(config, Option.getOrUndefined(email), otpStdin))).pipe(Command.annotate(CliCommandMetadata, metadata$2("auth.login")), Command.withDescription("Establish a first-party session with terminal-owned email OTP"));
+}, (config) => login(config, Option.getOrUndefined(email), otpStdin))).pipe(Command.annotate(CliCommandMetadata, metadata$4("auth.login")), Command.withDescription("Establish a first-party session with terminal-owned email OTP"));
 const signupCommand = Command.make("signup", {
-	email: emailFlag$1,
+	email: emailFlag$3,
 	otpStdin: otpStdinFlag,
 	displayName: displayNameFlag,
 	country: countryFlag,
 	handle: handleFlag
 }, ({ email, otpStdin, displayName, country, handle }) => runCommand({
-	...metadata$2("auth.signup"),
+	...metadata$4("auth.signup"),
 	network: true
 }, (config) => signup(config, Option.getOrUndefined(email), otpStdin, {
 	displayName: Option.getOrUndefined(displayName),
 	country: Option.getOrUndefined(country),
 	handle: Option.getOrUndefined(handle)
-}))).pipe(Command.annotate(CliCommandMetadata, metadata$2("auth.signup")), Command.withDescription("Verify email and complete Profile, Openfort wallet, and Account setup"));
-const sendCommand = Command.make("send", { email: emailFlag$1 }, ({ email }) => runCommand({
-	...metadata$2("auth.send"),
+}))).pipe(Command.annotate(CliCommandMetadata, metadata$4("auth.signup")), Command.withDescription("Verify email and complete Profile, Openfort wallet, and Account setup"));
+const sendCommand = Command.make("send", { email: emailFlag$3 }, ({ email }) => runCommand({
+	...metadata$4("auth.send"),
 	network: true
-}, (config) => sendOtp(config, Option.getOrUndefined(email)))).pipe(Command.annotate(CliCommandMetadata, metadata$2("auth.send")), Command.withDescription("Send an OTP and save non-secret continuation context"));
+}, (config) => sendOtp(config, Option.getOrUndefined(email)))).pipe(Command.annotate(CliCommandMetadata, metadata$4("auth.send")), Command.withDescription("Send an OTP and save non-secret continuation context"));
 const verifyCommand = Command.make("verify", {
-	email: emailFlag$1,
+	email: emailFlag$3,
 	otpStdin: otpStdinFlag
 }, ({ email, otpStdin }) => runCommand({
-	...metadata$2("auth.verify"),
+	...metadata$4("auth.verify"),
 	network: true
-}, (config) => verifyOtp(config, Option.getOrUndefined(email), otpStdin))).pipe(Command.annotate(CliCommandMetadata, metadata$2("auth.verify")), Command.withDescription("Verify a delivered OTP and persist the first-party session"));
-const profileCommand = Command.make("profile", { email: emailFlag$1 }, ({ email }) => runCommand({
-	...metadata$2("auth.profile"),
+}, (config) => verifyOtp(config, Option.getOrUndefined(email), otpStdin))).pipe(Command.annotate(CliCommandMetadata, metadata$4("auth.verify")), Command.withDescription("Verify a delivered OTP and persist the first-party session"));
+const profileCommand = Command.make("profile", { email: emailFlag$3 }, ({ email }) => runCommand({
+	...metadata$4("auth.profile"),
 	network: true
-}, (config) => readProfile(config, Option.getOrUndefined(email)))).pipe(Command.annotate(CliCommandMetadata, metadata$2("auth.profile")), Command.withDescription("Restore the session and read the backend profile and account lifecycle"));
-const statusCommand = Command.make("status", { email: emailFlag$1 }, ({ email }) => runCommand({
-	...metadata$2("auth.status"),
+}, (config) => readProfile(config, Option.getOrUndefined(email)))).pipe(Command.annotate(CliCommandMetadata, metadata$4("auth.profile")), Command.withDescription("Restore the session and read the backend profile and account lifecycle"));
+const statusCommand = Command.make("status", { email: emailFlag$3 }, ({ email }) => runCommand({
+	...metadata$4("auth.status"),
 	network: true
-}, (config) => status$2(config, Option.getOrUndefined(email)))).pipe(Command.annotate(CliCommandMetadata, metadata$2("auth.status")), Command.withDescription("Validate a first-party session or show a tagged legacy grant"));
-const logoutCommand = Command.make("logout", { email: emailFlag$1 }, ({ email }) => runCommand({
-	...metadata$2("auth.logout"),
+}, (config) => status$2(config, Option.getOrUndefined(email)))).pipe(Command.annotate(CliCommandMetadata, metadata$4("auth.status")), Command.withDescription("Validate a first-party session or show a tagged legacy grant"));
+const logoutCommand = Command.make("logout", { email: emailFlag$3 }, ({ email }) => runCommand({
+	...metadata$4("auth.logout"),
 	network: true
-}, (config) => logout(config, Option.getOrUndefined(email)))).pipe(Command.annotate(CliCommandMetadata, metadata$2("auth.logout")), Command.withDescription("Forget local credentials and revoke their remote session or grant"));
-const auth = Command.make("auth").pipe(Command.annotate(CliCommandMetadata, metadata$2("auth")), Command.withDescription("First-party email sessions (broader authority than legacy account:read grants)"), Command.withSubcommands([
+}, (config) => logout(config, Option.getOrUndefined(email)))).pipe(Command.annotate(CliCommandMetadata, metadata$4("auth.logout")), Command.withDescription("Forget local credentials and revoke their remote session or grant"));
+const auth = Command.make("auth").pipe(Command.annotate(CliCommandMetadata, metadata$4("auth")), Command.withDescription("First-party email sessions (broader authority than legacy account:read grants)"), Command.withSubcommands([
 	loginCommand,
 	signupCommand,
 	sendCommand,
@@ -53605,7 +54272,7 @@ const auth = Command.make("auth").pipe(Command.annotate(CliCommandMetadata, meta
 ]));
 //#endregion
 //#region src/commands/doctor.ts
-const metadata$1 = {
+const metadata$3 = {
 	name: "doctor",
 	capability: "diagnostics",
 	observation: "command"
@@ -53614,14 +54281,14 @@ const doctor = Command.make("doctor", {
 	online: Flag.boolean("online").pipe(Flag.withDefault(false), Flag.withDescription("Also check the backend through the public SDK")),
 	timeoutMs: Flag.integer("timeout-ms").pipe(Flag.filter((value) => value >= 1 && value <= 3e5, () => "Use --timeout-ms between 1 and 300000."), Flag.withDefault(3e4), Flag.withDescription("Online check deadline in milliseconds (1 to 300000)"))
 }, ({ online, timeoutMs }) => runCommand({
-	...metadata$1,
+	...metadata$3,
 	network: online
 }, (config, observation, onFinalize) => checkDoctor(config, {
 	online,
 	timeoutMs,
 	...observation === void 0 ? {} : { observation },
 	...onFinalize === void 0 ? {} : { onFinalize }
-}))).pipe(Command.annotate(CliCommandMetadata, metadata$1), Command.withDescription("Check local configuration; --online also checks the backend"));
+}))).pipe(Command.annotate(CliCommandMetadata, metadata$3), Command.withDescription("Check local configuration; --online also checks the backend"));
 //#endregion
 //#region src/commands/telemetry.ts
 const statusMetadata = {
@@ -53932,7 +54599,7 @@ const makeOrganizationProgress = (mode, run) => {
 * resolved, and it always asks, even when `--confirm` was supplied. A prompt that
 * cannot be answered is a refusal.
 */
-const confirmOrganizationWrite = (preview) => Effect.gen(function* () {
+const confirmWrite = (preview) => Effect.gen(function* () {
 	yield* writeStderr(`${preview.lines.join("\n")}\n`);
 	if (!(yield* Prompt.confirm({ message: preview.question }).pipe(Effect.catch(() => Effect.succeed(false))))) return yield* Effect.fail(inputRequired("The write was not confirmed."));
 });
@@ -53980,10 +54647,11 @@ const organizationWaitTimeout = () => new CliFailure({
 * the label keeps the existing fallback.
 *
 * `resetSession` is part of the contract the SDK's Organization setup owner
-* calls before it resumes a lane that failed at founder authorization or
-* bootstrap submission. The bridge's own reset stops its loopback server, so a
-* reset here clears the stale readiness, closes that bridge, and lets the next
-* address or digest request open one for the same command.
+* calls before it resumes a lane that failed at founder authorization; a lane
+* that resumes a recorded bootstrap submission does not touch the signer. The
+* bridge's own reset stops its loopback server, so a reset here clears the
+* stale readiness, closes that bridge, and lets the next address or digest
+* request open one for the same command.
 */
 const organizationWriteSigner = (config, opened, run, beforeSignature) => Effect.gen(function* () {
 	const runtime = yield* CliRuntime;
@@ -54080,7 +54748,7 @@ const createOrganization = (config, input) => Effect.gen(function* () {
 	if (interactivelyConfirm) {
 		const preview = yield* restoreVerifiedClient(config, opened, { requirement: "none" });
 		const resolved = yield* organizationPreviewLines(preview.client, null);
-		yield* confirmOrganizationWrite({
+		yield* confirmWrite({
 			lines: [
 				`Create Organization ${JSON.stringify(draft.name)} (@${draft.handle}, ${draft.country})`,
 				...draft.bio === void 0 ? [] : [`Bio: ${JSON.stringify(draft.bio)}`],
@@ -54168,7 +54836,7 @@ const retryOrganization = (config, input) => Effect.gen(function* () {
 	if (interactivelyConfirm) {
 		const preview = yield* restoreVerifiedClient(config, opened, { requirement: "none" });
 		const resolved = yield* organizationPreviewLines(preview.client, organizationId);
-		yield* confirmOrganizationWrite({
+		yield* confirmWrite({
 			lines: [`Resume setup for Organization ${JSON.stringify(String(organizationId))}`, ...resolved],
 			question: "Resume this Organization's setup?"
 		});
@@ -54204,6 +54872,979 @@ const retryOrganization = (config, input) => Effect.gen(function* () {
 	};
 });
 //#endregion
+//#region src/invitation.ts
+const INVITATION_PHASES = [
+	"authorizing",
+	"pending",
+	"pending_grant",
+	"active",
+	"revoking",
+	"declined",
+	"cancelled",
+	"expired",
+	"revoked"
+];
+/** Phases at which a wait has nothing left to watch. */
+const SETTLED_PHASES = /* @__PURE__ */ new Set([
+	"pending",
+	"active",
+	"declined",
+	"cancelled",
+	"expired",
+	"revoked"
+]);
+/** The own-offer projection the CLI reads to resolve one invitation's scope. */
+const OWN_OFFER_PAGE_LIMIT = 100;
+/** The Base Sepolia assets this CLI accepts, by exact key or exact AssetId. */
+const ACCEPTED_ASSETS = TOKENS.BASE_SEPOLIA;
+/** The timeout a read command may omit; the write grammar always carries one. */
+const readOptionalTimeout = (value) => readWriteTimeout(value ?? 120);
+/** One exact Organization scope. Reads may omit it; writes may not. */
+const readExactOrg = (orgs, requirement) => Effect.gen(function* () {
+	const ids = [...new Set(orgs)];
+	if (ids.length > 1) return yield* Effect.fail(inputRequired("Provide one exact Organization ID."));
+	const raw = ids[0];
+	if (raw === void 0) {
+		if (requirement === "required") return yield* Effect.fail(inputRequired("Provide --org."));
+		return null;
+	}
+	return yield* Effect.try({
+		try: () => toOrgId(raw),
+		catch: () => inputRequired("Provide a valid Organization ID.")
+	});
+});
+const readInvitationId = (value) => Effect.gen(function* () {
+	if (value === void 0) return yield* Effect.fail(inputRequired("Provide --invitation-id."));
+	const trimmed = value.trim();
+	if (trimmed.length === 0 || trimmed.length > 256 || /[^\x21-\x7e]/.test(trimmed)) return yield* Effect.fail(inputRequired("Provide a valid --invitation-id."));
+	return trimmed;
+});
+/** One bounded page request. Unknown or duplicate phases refuse before any read. */
+const readPageBounds = (input) => Effect.gen(function* () {
+	const limit = input.limit;
+	if (limit !== void 0 && (!Number.isSafeInteger(limit) || limit < 1 || limit > 100)) return yield* Effect.fail(inputRequired("Provide --limit as an integer from 1 to 100."));
+	const cursor = input.cursor?.trim();
+	if (input.cursor !== void 0 && (cursor === void 0 || cursor.length === 0)) return yield* Effect.fail(inputRequired("Provide a nonempty --cursor."));
+	const requested = input.phases ?? [];
+	if (requested.find((phase) => !INVITATION_PHASES.some((known) => known === phase)) !== void 0) return yield* Effect.fail(inputRequired("Provide --phase from the invitation phases."));
+	if (new Set(requested).size !== requested.length) return yield* Effect.fail(inputRequired("Provide each --phase at most once."));
+	return {
+		...cursor === void 0 ? {} : { cursor },
+		...limit === void 0 ? {} : { limit },
+		...requested.length === 0 ? {} : { phases: requested }
+	};
+});
+/**
+* The Organization of one invitation the caller can already see.
+*
+* The grantee's bounded own-offer projection is what resolves an absent
+* `--org`, for `get` and `wait` alike: a caller who holds no Admin authority
+* still reads their own offer, and a saved read default is never consulted. The
+* row carries its own OrgId, and a row the caller cannot see is refused rather
+* than probed in another scope.
+*
+* The walk follows the versioned cursor until the row is found or the pages
+* end. One 100-row page is not the projection: an invitation the caller can see
+* would otherwise refuse only because it is not the newest.
+*/
+const resolveOwningOrganization = (client, invitationId) => Effect.gen(function* () {
+	let cursor;
+	for (;;) {
+		const page = yield* Effect.promise((signal) => client.orgs.invitations(cursor === void 0 ? { limit: OWN_OFFER_PAGE_LIMIT } : {
+			limit: OWN_OFFER_PAGE_LIMIT,
+			cursor
+		}, { signal })).pipe(Effect.flatMap(resultValue));
+		const match = page.items.find((invitation) => invitation.id === invitationId);
+		if (match !== void 0) return match.orgId;
+		if (page.nextCursor === null) return yield* Effect.fail(Errors.invalidInput("invitationId", "The invitation is not in your available offers. Provide --org to read it directly."));
+		cursor = page.nextCursor;
+	}
+});
+/** The exact scoped bundle a read, transition, or write is about to use. */
+const scopedInvitations = (client, organizationId) => client.org(organizationId).invitations;
+const scopedRead = (client, organizationId, invitationId) => Effect.promise((signal) => scopedInvitations(client, organizationId).get({ invitationId }, { signal })).pipe(Effect.flatMap(resultValue));
+const settled = (invitation) => SETTLED_PHASES.has(invitation.phase) || invitation.recovery !== null && invitation.recovery.action !== "wait";
+const invitationLines = (invitation) => [JSON.stringify({ invitation })];
+const waitTimeout = () => new CliFailure({
+	code: "NETWORK_ERROR",
+	message: "The invitation did not settle within the command deadline.",
+	exitCode: 5,
+	outcome: "failed"
+});
+/** The same dependency failure, named for the phase it happened in. */
+const resolutionTimeout = () => new CliFailure({
+	code: "NETWORK_ERROR",
+	message: "The invitation's Organization could not be resolved within the command deadline.",
+	exitCode: 5,
+	outcome: "failed"
+});
+const deadlineFailure = (message) => new CliFailure({
+	code: "NETWORK_ERROR",
+	message,
+	exitCode: 5,
+	outcome: "failed"
+});
+/** Bound one scoped operation by the command's own deadline; the backend keeps its state. */
+const withinDeadline = (effect, timeoutSeconds, message) => Effect.gen(function* () {
+	const settledResult = yield* effect.pipe(Effect.timeoutOption(timeoutSeconds * 1e3));
+	if (Option.isNone(settledResult)) return yield* Effect.fail(deadlineFailure(message));
+	return settledResult.value;
+});
+/**
+* `capxul org invite list|get|wait|review`.
+*
+* `list` is the authenticated grantee's own offers. With `--org` it is the
+* Admin's view of that Organization's invitations instead: one explicit scope,
+* never a saved read default, and never a silent change of what plain `list`
+* returns. `--mine` stays the own-offer projection's declared no-op; combined
+* with `--org` it refuses, because the scoped route has no invitee filter and
+* ignoring the flag would return a wider view than the operator asked for.
+*
+* `get` and `wait` read one invitation in the Organization named by `--org`,
+* or resolved from the offer's own row when `--org` is absent. A wait only
+* reads: it never retries, resends, or accepts.
+*/
+const readInvitation = (config, action, input) => {
+	const timeout = readOptionalTimeout(input.timeoutSeconds);
+	return Effect.gen(function* () {
+		const bounds = yield* readPageBounds(input);
+		const invitationId = action === "list" ? null : yield* readInvitationId(input.invitationId);
+		const explicitOrg = yield* readExactOrg(input.orgs ?? [], "optional");
+		if (action === "review" && explicitOrg === null) return yield* Effect.fail(inputRequired("Provide --org to review this invitation."));
+		if (action === "list" && input.mine === true && explicitOrg !== null) return yield* Effect.fail(inputRequired("Provide either --mine or --org; the Organization list is not filtered to you."));
+		const timeoutSeconds = yield* timeout;
+		const { client } = yield* restoreAuthenticatedClient(config, input.email);
+		if (action === "list") return listResult(yield* Effect.promise((signal) => explicitOrg === null ? client.orgs.invitations(bounds, { signal }) : client.org(explicitOrg).invitations.list(bounds, { signal })).pipe(Effect.flatMap(resultValue)));
+		if (invitationId === null) return yield* Effect.fail(inputRequired("Provide --invitation-id."));
+		const resolveOrganizationId = () => explicitOrg === null ? resolveOwningOrganization(client, invitationId) : Effect.succeed(explicitOrg);
+		if (action === "get" || action === "review") {
+			const invitation = yield* withinDeadline(Effect.gen(function* () {
+				const resolved = action === "review" ? explicitOrg : yield* resolveOrganizationId();
+				if (resolved === null) return yield* Effect.fail(inputRequired("Provide --org."));
+				return yield* scopedRead(client, resolved, invitationId);
+			}), timeoutSeconds, "The invitation read did not settle within the command deadline.");
+			return {
+				data: action === "review" ? invitation : { invitation },
+				lines: invitationLines(invitation)
+			};
+		}
+		let resolving = true;
+		const observed = yield* Effect.gen(function* () {
+			const resolved = yield* resolveOrganizationId();
+			resolving = false;
+			let invitation = yield* scopedRead(client, resolved, invitationId);
+			while (!settled(invitation)) {
+				yield* Effect.sleep(1e3);
+				invitation = yield* scopedRead(client, resolved, invitationId);
+			}
+			return invitation;
+		}).pipe(Effect.timeoutOption(timeoutSeconds * 1e3));
+		if (Option.isNone(observed)) return yield* Effect.fail(resolving ? resolutionTimeout() : waitTimeout());
+		return {
+			data: { invitation: observed.value },
+			lines: invitationLines(observed.value)
+		};
+	});
+};
+function listResult(page) {
+	return {
+		data: {
+			invitations: page.items,
+			nextCursor: page.nextCursor,
+			observedAt: page.observedAt
+		},
+		lines: [...page.items.map((invitation) => JSON.stringify(invitation)), ...page.nextCursor === null ? [] : [`Next cursor: ${JSON.stringify(page.nextCursor)}`]]
+	};
+}
+/**
+* `capxul org invite decline|cancel|resend|retry`.
+*
+* Every transition needs the exact Organization in both modes: an invitation
+* write never consults the read default. A terminal writes `--confirm`; a
+* terminal run always sees the resolved current offer and answers a default-no
+* prompt. The command forwards no acceptance consent: these four transitions
+* end or retry work that already exists.
+*/
+const transitionInvitation = (config, action, input) => Effect.gen(function* () {
+	const invitationId = yield* readInvitationId(input.invitationId);
+	const organizationId = yield* readExactOrg(input.orgs, "required");
+	if (organizationId === null) return yield* Effect.fail(inputRequired("Provide --org."));
+	const timeoutSeconds = yield* readWriteTimeout(input.timeoutSeconds);
+	const interactivelyConfirm = yield* requireWriteConfirmation(input.confirm);
+	const { client } = yield* restoreAuthenticatedClient(config, input.email);
+	if (interactivelyConfirm) {
+		const current = yield* scopedRead(client, organizationId, invitationId);
+		yield* confirmWrite({
+			lines: [`${action} invitation ${JSON.stringify(invitationId)} in Organization ${JSON.stringify(String(organizationId))}`, `Current phase: ${current.phase}; delivery: ${current.delivery}`],
+			question: `${action === "resend" ? "Resend" : action.charAt(0).toUpperCase() + action.slice(1)} this invitation?`
+		});
+	}
+	const invitation = yield* withinDeadline(Effect.promise((signal) => scopedInvitations(client, organizationId)[action]({ invitationId }, { signal })).pipe(Effect.flatMap(resultValue)), timeoutSeconds, "The invitation transition did not settle within the command deadline.");
+	return {
+		data: { invitation },
+		lines: invitationLines(invitation)
+	};
+});
+/** The wire's bytes32 form, lowercased: the digest an acceptance states. */
+const readOfferDigest = (value, flag) => Effect.gen(function* () {
+	const trimmed = value?.trim() ?? "";
+	if (!/^0x[0-9a-fA-F]{64}$/.test(trimmed)) return yield* Effect.fail(inputRequired(`Provide ${flag} as a 0x-prefixed 32-byte digest.`));
+	return trimmed.toLowerCase();
+});
+/**
+* `capxul org invite accept --invitation-id I --offer-digest D`.
+*
+* Acceptance is the grantee's explicit consent, so the digest is the whole
+* write: the command forwards the digest the operator states and never invents
+* one. A noninteractive run must state it (`--offer-digest`, with `--confirm`);
+* an interactive run may leave it out, and then the command reads the offer and
+* fills D from the exact digest it displayed, behind the same preview/confirm
+* prompt the other writes use. A stated digest is never replaced by the
+* displayed one — a mismatch is the backend's typed refusal, not a silent
+* rewrite of what the operator consented to.
+*
+* The command signs nothing: the grant is executed by the deployment's
+* technical granter after the consent commits. Only the exact grantee can
+* accept; Admin access to the offer does not grant consent authority.
+*/
+const acceptInvitation = (config, input) => Effect.gen(function* () {
+	const invitationId = yield* readInvitationId(input.invitationId);
+	const organizationId = yield* readExactOrg(input.orgs, "required");
+	if (organizationId === null) return yield* Effect.fail(inputRequired("Provide --org."));
+	const timeoutSeconds = yield* readWriteTimeout(input.timeoutSeconds);
+	const runtime = yield* CliRuntime;
+	const interactive = runtime.tty && !runtime.ci && runtime.mode !== "json";
+	const canonical = input.offerDigest === void 0 ? null : yield* readOfferDigest(input.offerDigest, "--offer-digest");
+	const compatibility = input.expectedOfferDigest === void 0 ? null : yield* readOfferDigest(input.expectedOfferDigest, "--expected-offer");
+	if (canonical !== null && compatibility !== null && canonical !== compatibility) return yield* Effect.fail(inputRequired("Provide matching --offer-digest and --expected-offer values."));
+	const stated = canonical ?? compatibility;
+	if (stated === null && !interactive) return yield* Effect.fail(inputRequired("Provide --offer-digest to accept this invitation."));
+	const interactivelyConfirm = yield* requireWriteConfirmation(input.confirm);
+	const { client } = yield* restoreAuthenticatedClient(config, input.email);
+	let expectedOfferDigest = stated;
+	if (interactivelyConfirm) {
+		const current = yield* scopedRead(client, organizationId, invitationId);
+		yield* confirmWrite({
+			lines: [
+				`Accept invitation ${JSON.stringify(invitationId)} in Organization ${JSON.stringify(String(organizationId))}`,
+				`Current offer digest: ${current.offerDigest}`,
+				`Current phase: ${current.phase}; expires at: ${String(current.expiresAt)}`
+			],
+			question: "Accept this offer?"
+		});
+		expectedOfferDigest ??= current.offerDigest;
+	}
+	if (expectedOfferDigest === null) return yield* Effect.fail(inputRequired("Provide --offer-digest to accept."));
+	const invitation = yield* withinDeadline(Effect.promise((signal) => scopedInvitations(client, organizationId).accept({
+		invitationId,
+		expectedOfferDigest
+	}, { signal })).pipe(Effect.flatMap(resultValue)), timeoutSeconds, "The invitation acceptance did not settle within the command deadline.");
+	return {
+		data: invitation,
+		lines: invitationLines(invitation)
+	};
+});
+/**
+* An exact zero, in the helper's own zero form (`parse-money.ts` tests the same
+* shape, with commas already stripped). It discriminates a zero from a negative
+* value, which the helper reports under the same `non-positive` reason.
+*/
+const ZERO_CAP = /^0+(?:\.0+)?$/;
+/**
+* One finite Budget cap.
+*
+* The value goes through the shared amount helper first, so the owner keeps its
+* grammar, its 100-character guard, its precision, and its sign rule. Exactly
+* one of the helper's verdicts does not apply to a Budget cap: `non-positive`
+* for an exact zero, which `d9.md` §3 set B permits. That verdict, and only
+* that one, becomes the legal zero cap.
+*/
+const readFiniteLimit = (raw, metadata) => Effect.gen(function* () {
+	const parsed = yield* Effect.try({
+		try: () => parseAssetAmount(raw, metadata),
+		catch: () => inputRequired("Provide --limit as an exact decimal quantity.")
+	});
+	if (!("kind" in parsed)) return parsed.value;
+	if (parsed.reason === "non-positive" && ZERO_CAP.test(raw.trim().replaceAll(",", ""))) return "0";
+	return yield* Effect.fail(inputRequired("Provide --limit as an exact decimal quantity."));
+});
+/** One exact asset: a catalog key or the exact AssetId those keys name. */
+function resolveAssetId(raw) {
+	const candidate = raw.trim();
+	const named = Object.entries(ACCEPTED_ASSETS).find(([key]) => key === candidate);
+	if (named !== void 0) return named[1];
+	return Object.values(ACCEPTED_ASSETS).find((assetId) => assetId === candidate) ?? null;
+}
+/** The complete `B` policy flag set for exactly one new Budget. */
+const readNewBudgetGrant = (flags) => Effect.gen(function* () {
+	const label = flags.label.trim();
+	if (label.length === 0 || label.length > 128) return yield* Effect.fail(inputRequired("Provide --new-budget-name with 1 to 128 characters."));
+	const rawAsset = flags.asset?.trim() ?? "";
+	if (rawAsset.length === 0) return yield* Effect.fail(inputRequired("Provide --asset for --new-budget-name."));
+	const assetId = resolveAssetId(rawAsset);
+	if (assetId === null) return yield* Effect.fail(inputRequired("Provide --asset as CAPXUL_TEST_USDC, CAPXUL_TEST_USDT, CAPXUL_TEST_WETH, or one exact AssetId."));
+	const metadata = yield* Effect.try({
+		try: () => requireAsset(assetId),
+		catch: () => inputRequired("Provide an admitted --asset.")
+	});
+	if (flags.unlimited === (flags.limit !== void 0)) return yield* Effect.fail(inputRequired("Provide exactly one of --limit or --unlimited."));
+	let limit = null;
+	if (!flags.unlimited) limit = yield* readFiniteLimit(String(flags.limit), metadata);
+	const recipients = yield* readRecipients(flags);
+	const actions = yield* readActions(flags.actions);
+	return {
+		type: "new_budget",
+		label,
+		intent: {
+			type: "budget",
+			asset: assetId,
+			limit,
+			scope: {
+				recipients,
+				actions
+			}
+		}
+	};
+});
+/** 1–32 distinct recipient Accounts, or the explicit anyone scope. */
+function readRecipients(flags) {
+	return Effect.gen(function* () {
+		if (flags.anyRecipient === flags.recipientAccounts.length > 0) return yield* Effect.fail(inputRequired("Provide exactly one of --any-recipient or --recipient-account."));
+		if (flags.anyRecipient) return { type: "anyone" };
+		const accounts = [...new Set(flags.recipientAccounts)];
+		if (accounts.length > 32) return yield* Effect.fail(inputRequired("Provide at most 32 --recipient-account values."));
+		return {
+			type: "allowlist",
+			accounts: yield* Effect.forEach(accounts, (accountId) => Effect.try({
+				try: () => toAccountId(accountId),
+				catch: () => inputRequired("Provide each --recipient-account as an Account ID.")
+			}))
+		};
+	});
+}
+/** One or both distinct action codes, in the canonical pay-then-commitments order. */
+function readActions(raw) {
+	return Effect.gen(function* () {
+		const requested = raw.flatMap((value) => value.split(",")).map((value) => value.trim());
+		if (requested.find((value) => value !== "pay" && value !== "commitments") !== void 0 || requested.some((value) => value.length === 0)) return yield* Effect.fail(inputRequired("Provide --actions as pay, commitments, or both."));
+		const [first, ...rest] = ["pay", "commitments"].filter((action) => requested.some((value) => value === action));
+		if (first === void 0) return yield* Effect.fail(inputRequired("Provide --actions as pay, commitments, or both."));
+		return [first, ...rest];
+	});
+}
+/**
+* The new-Budget policy flags that were supplied. None of them means anything
+* without `--new-budget-name`: a request that silently ignored them would
+* authorize an offer the operator never stated.
+*/
+function orphanedNewBudgetFlags(input) {
+	if (input.newBudgetName !== void 0) return [];
+	return [
+		...input.asset === void 0 ? [] : ["--asset"],
+		...input.limit === void 0 ? [] : ["--limit"],
+		...input.unlimited ? ["--unlimited"] : [],
+		...input.recipientAccounts.length === 0 ? [] : ["--recipient-account"],
+		...input.anyRecipient ? ["--any-recipient"] : [],
+		...input.actions.length === 0 ? [] : ["--actions"]
+	];
+}
+/** The bounded request one invite submits, with every grant in canonical order. */
+const buildInviteRequest = (input) => Effect.gen(function* () {
+	const orphaned = orphanedNewBudgetFlags(input);
+	if (orphaned.length > 0) return yield* Effect.fail(inputRequired(`Provide --new-budget-name with ${orphaned.join(", ")}.`));
+	const toEmail = input.toEmail?.trim() ?? "";
+	const accountId = input.accountId?.trim() ?? "";
+	if (toEmail.length === 0 === (accountId.length === 0)) return yield* Effect.fail(inputRequired("Provide exactly one of --to-email or --account-id."));
+	const grants = [];
+	for (const budgetId of new Set(input.budgetIds)) {
+		if (budgetId.trim().length === 0) return yield* Effect.fail(inputRequired("Provide each --budget-id as a nonempty ID."));
+		grants.push({
+			type: "budget",
+			budgetId: toPermissionId(budgetId.trim())
+		});
+	}
+	for (const permissionId of new Set(input.permissionIds)) {
+		if (permissionId.trim().length === 0) return yield* Effect.fail(inputRequired("Provide each --permission-id as a nonempty ID."));
+		grants.push({
+			type: "managePeople",
+			permissionId: toPermissionId(permissionId.trim())
+		});
+	}
+	if (input.newBudgetName !== void 0) grants.push(yield* readNewBudgetGrant({
+		label: input.newBudgetName,
+		asset: input.asset,
+		limit: input.limit,
+		unlimited: input.unlimited,
+		recipientAccounts: input.recipientAccounts,
+		anyRecipient: input.anyRecipient,
+		actions: input.actions
+	}));
+	if (grants.length === 0) return yield* Effect.fail(inputRequired("Provide at least one of --budget-id, --permission-id, or --new-budget-name."));
+	if (grants.length > 16) return yield* Effect.fail(inputRequired("Provide at most 16 grants."));
+	return {
+		to: toEmail.length > 0 ? {
+			type: "email",
+			email: toEmail
+		} : {
+			type: "account",
+			accountId: yield* Effect.try({
+				try: () => toAccountId(accountId),
+				catch: () => inputRequired("Provide a valid --account-id.")
+			})
+		},
+		grants
+	};
+});
+const readRequestKey = (value) => Effect.gen(function* () {
+	const trimmed = value?.trim() ?? "";
+	if (trimmed.length === 0 || trimmed.length > 128 || !/^[A-Za-z0-9_.-]+$/.test(trimmed)) return yield* Effect.fail(inputRequired("Provide --request-key as 1 to 128 letters, digits, underscore, hyphen, or dot."));
+	return trimmed;
+});
+/**
+* The D9 §6 authoring progress line: the durable `{invitationId, commandId}`
+* pair, written before the configuration digest exists so a lost response is
+* recoverable by the same identity.
+*/
+const preparedLine = (mode, prepared) => mode === "json" ? `${JSON.stringify({
+	type: "invitation.prepared",
+	...prepared
+})}\n` : `Invitation prepared: invitationId=${prepared.invitationId} commandId=${prepared.commandId}\n`;
+/**
+* `capxul org member invite`.
+*
+* `--preview` is a read: it shows the exact resolved offer, creates nothing, and
+* opens no browser. The write needs `--org` in both modes, `--confirm` and
+* `--request-key` non-interactively, and it prints the key it used before it
+* submits, so a lost response is replayed with the same identity instead of
+* authoring a second offer.
+*
+* The write also executes the offer's configuration hop: the Admin's personal
+* embedded wallet signs the stored configure UserOperation through the same
+* command-scoped browser bridge the other Organization writes use. The bridge
+* is composed only after confirmation, and the durable identity reaches stderr
+* before any digest is forwarded.
+*/
+const inviteInvitationMember = (config, input) => Effect.gen(function* () {
+	const request = yield* buildInviteRequest(input);
+	const organizationId = yield* readExactOrg(input.orgs, "required");
+	if (organizationId === null) return yield* Effect.fail(inputRequired("Provide --org."));
+	const timeoutSeconds = yield* readWriteTimeout(input.timeoutSeconds);
+	const runtime = yield* CliRuntime;
+	const interactive = runtime.tty && !runtime.ci && runtime.mode !== "json";
+	if (!input.preview && !interactive) {
+		yield* readRequestKey(input.requestKey);
+		yield* requireWriteConfirmation(input.confirm);
+	}
+	const opened = yield* openAuthenticatedSession(config, input.email);
+	if (input.preview) {
+		const { client } = yield* restoreVerifiedClient(config, opened);
+		const preview = yield* withinDeadline(Effect.promise((signal) => scopedInvitations(client, organizationId).preview(request, { signal })).pipe(Effect.flatMap(resultValue)), timeoutSeconds, "The invitation preview did not settle within the command deadline.");
+		return previewResult(preview);
+	}
+	const requestKey = input.requestKey === void 0 ? (yield* generateRequestKey()).trim() : yield* readRequestKey(input.requestKey);
+	if (interactive) {
+		yield* writeStderr(`${JSON.stringify({
+			type: "invitation.requestKey",
+			requestKey
+		})}\n`);
+		const { client } = yield* restoreVerifiedClient(config, opened);
+		const preview = yield* withinDeadline(Effect.promise((signal) => scopedInvitations(client, organizationId).preview(request, { signal })).pipe(Effect.flatMap(resultValue)), timeoutSeconds, "The invitation preview did not settle within the command deadline.");
+		yield* confirmWrite({
+			lines: [`Invite ${JSON.stringify(request.to)} to Organization ${JSON.stringify(String(organizationId))}`, ...previewLines(preview)],
+			question: "Authorize this invitation?"
+		});
+	}
+	const context = yield* Effect.context();
+	const run = Effect.runPromiseWith(context);
+	const deadline = new AbortController();
+	const openfortSignerFactory = yield* organizationWriteSigner(config, opened, run, async () => {
+		const cancelled = cancelledWrite(CAPXUL_OPERATIONS.org.invitations.authorize, deadline.signal);
+		if (cancelled !== null) throw cancelled;
+	});
+	const { client } = yield* restoreVerifiedClient(config, opened, {
+		requirement: "deployed",
+		openfortSignerFactory
+	});
+	const invitations = scopedInvitations(client, organizationId);
+	const invitation = yield* withinDeadline(Effect.promise((signal) => {
+		const forwardAbort = () => deadline.abort();
+		if (signal.aborted) forwardAbort();
+		else signal.addEventListener("abort", forwardAbort, { once: true });
+		return invitations.invite({
+			requestKey,
+			...request
+		}, {
+			signal,
+			onPrepared: async (prepared) => {
+				await run(writeStderr(preparedLine(runtime.mode, prepared)));
+			}
+		}).finally(() => signal.removeEventListener("abort", forwardAbort));
+	}).pipe(Effect.flatMap(resultValue)), timeoutSeconds, "The invitation did not settle within the command deadline.");
+	return {
+		data: { invitation },
+		lines: invitationLines(invitation)
+	};
+});
+const generateRequestKey = () => Effect.gen(function* () {
+	return yield* (yield* Crypto.Crypto).randomUUIDv4;
+});
+const previewResult = (preview) => ({
+	data: { preview },
+	lines: previewLines(preview)
+});
+const previewLines = (preview) => [
+	`Grantee: ${JSON.stringify({
+		safeAddress: preview.grantee.safeAddress,
+		partyId: preview.grantee.partyId,
+		accountReady: preview.grantee.accountReady
+	})}`,
+	...preview.grants.map((grant) => `Offer: ${JSON.stringify(grant)}`),
+	`Existing assignments: ${String(preview.existingAssignments.length)}`,
+	`Includes management: ${String(preview.includesManagement)}`
+];
+//#endregion
+//#region src/commands/org-invite.ts
+const emailFlag$2 = Flag.string("email").pipe(Flag.optional);
+const orgFlag$2 = Flag.string("org").pipe(Flag.withAlias("org-id"), Flag.atLeast(0));
+const invitationIdFlag = Flag.string("invitation-id").pipe(Flag.optional);
+const timeoutFlag$1 = Flag.integer("timeout-seconds").pipe(Flag.withDefault(120));
+const confirmFlag$2 = Flag.boolean("confirm").pipe(Flag.withDefault(false));
+const metadata$2 = (name) => ({
+	name,
+	capability: "organization",
+	observation: "command"
+});
+/** Reads and transitions carry the exact invitation ID; only list does not. */
+const target = {
+	email: emailFlag$2,
+	orgs: orgFlag$2,
+	invitationId: invitationIdFlag
+};
+const executeRead = (action, input) => runCommand({
+	...metadata$2(`org.invite.${action}`),
+	network: true
+}, (config) => readInvitation(config, action, input));
+const executeTransition = (action, input) => runCommand({
+	...metadata$2(`org.invite.${action}`),
+	network: true
+}, (config) => transitionInvitation(config, action, input));
+const list$1 = Command.make("list", {
+	email: emailFlag$2,
+	orgs: orgFlag$2,
+	limit: Flag.integer("limit").pipe(Flag.optional),
+	cursor: Flag.string("cursor").pipe(Flag.optional),
+	phases: Flag.string("phase").pipe(Flag.atLeast(0)),
+	mine: Flag.boolean("mine").pipe(Flag.withDescription("Your own offers; accepted as a no-op on the plain list"), Flag.withDefault(false))
+}, ({ email, orgs, limit, cursor, phases, mine }) => executeRead("list", {
+	email: Option.getOrUndefined(email),
+	orgs,
+	limit: Option.getOrUndefined(limit),
+	cursor: Option.getOrUndefined(cursor),
+	phases: phases.length === 0 ? void 0 : phases,
+	mine
+})).pipe(Command.annotate(CliCommandMetadata, metadata$2("org.invite.list")), Command.withDescription("List your own invitation offers, or an Organization's with --org; the result carries invitations, nextCursor, and observedAt"));
+const get = Command.make("get", {
+	...target,
+	timeoutSeconds: timeoutFlag$1
+}, ({ email, orgs, invitationId, timeoutSeconds }) => executeRead("get", {
+	email: Option.getOrUndefined(email),
+	orgs,
+	invitationId: Option.getOrUndefined(invitationId),
+	timeoutSeconds
+})).pipe(Command.annotate(CliCommandMetadata, metadata$2("org.invite.get")), Command.withDescription("Read one invitation, in --org or its own resolved Organization"));
+const wait$1 = Command.make("wait", {
+	...target,
+	timeoutSeconds: timeoutFlag$1
+}, ({ email, orgs, invitationId, timeoutSeconds }) => executeRead("wait", {
+	email: Option.getOrUndefined(email),
+	orgs,
+	invitationId: Option.getOrUndefined(invitationId),
+	timeoutSeconds
+})).pipe(Command.annotate(CliCommandMetadata, metadata$2("org.invite.wait")), Command.withDescription("Poll one invitation read until it settles; never writes"));
+const review = Command.make("review", {
+	...target,
+	timeoutSeconds: timeoutFlag$1
+}, ({ email, orgs, invitationId, timeoutSeconds }) => executeRead("review", {
+	email: Option.getOrUndefined(email),
+	orgs,
+	invitationId: Option.getOrUndefined(invitationId),
+	timeoutSeconds
+})).pipe(Command.annotate(CliCommandMetadata, metadata$2("org.invite.review")), Command.withDescription("Review one exact current offer without writing or signing"));
+const transition = (name) => Command.make(name, {
+	...target,
+	confirm: confirmFlag$2,
+	timeoutSeconds: timeoutFlag$1
+}, ({ email, orgs, invitationId, confirm, timeoutSeconds }) => executeTransition(name, {
+	email: Option.getOrUndefined(email),
+	orgs,
+	invitationId: Option.getOrUndefined(invitationId),
+	confirm,
+	timeoutSeconds
+})).pipe(Command.annotate(CliCommandMetadata, metadata$2(`org.invite.${name}`)), Command.withDescription(name === "decline" ? "Decline your own pending offer; starts its cleanup" : name === "cancel" ? "Cancel a pending offer you administer; starts its cleanup" : name === "resend" ? "Retry delivery of a verified pending offer; never extends expiry" : "Resume the current offer state; creates no new consent or grant"));
+/**
+* The one consent command. `--offer-digest` is canonical; `--expected-offer`
+* remains a compatibility spelling and conflicting values refuse.
+*/
+const accept = Command.make("accept", {
+	...target,
+	offerDigest: Flag.string("offer-digest").pipe(Flag.optional),
+	expectedOffer: Flag.string("expected-offer").pipe(Flag.optional),
+	confirm: confirmFlag$2,
+	timeoutSeconds: timeoutFlag$1
+}, ({ email, orgs, invitationId, offerDigest, expectedOffer, confirm, timeoutSeconds }) => runCommand({
+	...metadata$2("org.invite.accept"),
+	network: true
+}, (config) => acceptInvitation(config, {
+	email: Option.getOrUndefined(email),
+	orgs,
+	invitationId: Option.getOrUndefined(invitationId),
+	offerDigest: Option.getOrUndefined(offerDigest),
+	expectedOfferDigest: Option.getOrUndefined(expectedOffer),
+	confirm,
+	timeoutSeconds
+}))).pipe(Command.annotate(CliCommandMetadata, metadata$2("org.invite.accept")), Command.withDescription("Accept one exact offer by its current digest and start its grant; noninteractive runs must supply --offer-digest"));
+const invite = Command.make("invite").pipe(Command.annotate(CliCommandMetadata, metadata$2(CAPXUL_OPERATIONS.org.invite)), Command.withDescription("Invitation reads, the consent commit, and the transitions"), Command.withSubcommands([
+	list$1,
+	get,
+	wait$1,
+	review,
+	accept,
+	transition("decline"),
+	transition("cancel"),
+	transition("resend"),
+	transition("retry")
+]));
+const newBudgetFlags = {
+	newBudgetName: Flag.string("new-budget-name").pipe(Flag.optional),
+	asset: Flag.string("asset").pipe(Flag.optional),
+	limit: Flag.string("limit").pipe(Flag.optional),
+	unlimited: Flag.boolean("unlimited").pipe(Flag.withDefault(false)),
+	recipientAccounts: Flag.string("recipient-account").pipe(Flag.atLeast(0)),
+	anyRecipient: Flag.boolean("any-recipient").pipe(Flag.withDefault(false)),
+	actions: Flag.string("actions").pipe(Flag.atLeast(0))
+};
+const memberInvite = Command.make("invite", {
+	email: emailFlag$2,
+	orgs: orgFlag$2,
+	toEmail: Flag.string("to-email").pipe(Flag.optional),
+	accountId: Flag.string("account-id").pipe(Flag.optional),
+	budgetIds: Flag.string("budget-id").pipe(Flag.atLeast(0)),
+	permissionIds: Flag.string("permission-id").pipe(Flag.atLeast(0)),
+	...newBudgetFlags,
+	requestKey: Flag.string("request-key").pipe(Flag.optional),
+	preview: Flag.boolean("preview").pipe(Flag.withDefault(false)),
+	confirm: confirmFlag$2,
+	timeoutSeconds: timeoutFlag$1
+}, ({ email, orgs, toEmail, accountId, budgetIds, permissionIds, newBudgetName, asset, limit, unlimited, recipientAccounts, anyRecipient, actions, requestKey, preview, confirm, timeoutSeconds }) => {
+	return runCommand({
+		...metadata$2("org.member.invite"),
+		network: true
+	}, (config) => inviteInvitationMember(config, {
+		email: Option.getOrUndefined(email),
+		orgs,
+		toEmail: Option.getOrUndefined(toEmail),
+		accountId: Option.getOrUndefined(accountId),
+		budgetIds,
+		permissionIds,
+		newBudgetName: Option.getOrUndefined(newBudgetName),
+		asset: Option.getOrUndefined(asset),
+		limit: Option.getOrUndefined(limit),
+		unlimited,
+		recipientAccounts,
+		anyRecipient,
+		actions,
+		requestKey: Option.getOrUndefined(requestKey),
+		preview,
+		confirm,
+		timeoutSeconds
+	}));
+}).pipe(Command.annotate(CliCommandMetadata, metadata$2("org.member.invite")), Command.withDescription("Authorize one exact invitation offer; --preview writes nothing"));
+//#endregion
+//#region src/platform/bounded-text.ts
+var UpdateUnavailable = class extends Data.TaggedError("UpdateUnavailable") {};
+const boundedText = (stream, limit) => Effect.suspend(() => {
+	let size = 0;
+	return stream.pipe(Stream.mapEffect((chunk) => {
+		size += chunk.byteLength;
+		return size > limit ? Effect.fail(new UpdateUnavailable()) : Effect.succeed(chunk);
+	}), Stream.decodeText(), Stream.runFold(() => "", (text, chunk) => text + chunk));
+});
+//#endregion
+//#region src/contact.ts
+const AddInputJson = Schema.Struct({
+	ref: Schema.Union([
+		Schema.Struct({
+			kind: Schema.Literal("handle"),
+			handle: Schema.NonEmptyString
+		}),
+		Schema.Struct({
+			kind: Schema.Literal("email"),
+			email: Schema.NonEmptyString
+		}),
+		Schema.Struct({
+			kind: Schema.Literal("address"),
+			address: Schema.NonEmptyString
+		}),
+		Schema.Struct({
+			kind: Schema.Literal("party"),
+			partyId: Schema.NonEmptyString
+		})
+	]),
+	label: Schema.optional(Schema.String)
+});
+const parseAddInput = (text) => Schema.decodeUnknownEffect(Schema.fromJsonString(AddInputJson), { onExcessProperty: "error" })(text).pipe(Effect.flatMap((value) => {
+	try {
+		const ref = value.ref.kind === "address" ? {
+			kind: "address",
+			address: toAddress(value.ref.address)
+		} : value.ref.kind === "party" ? {
+			kind: "party",
+			partyId: toPartyId(value.ref.partyId)
+		} : value.ref;
+		return Effect.succeed({
+			ref,
+			...value.label === void 0 ? {} : { label: value.label }
+		});
+	} catch (cause) {
+		return Effect.fail(cause);
+	}
+}), Effect.mapError(() => inputRequired("Provide --input with one valid AddressBookAddInput JSON object.")));
+const readAddInput = (source) => Effect.gen(function* () {
+	if (source === void 0) {
+		const runtime = yield* CliRuntime;
+		if (!runtime.tty || runtime.ci || runtime.mode === "json") return yield* Effect.fail(inputRequired("Provide --input FILE|- with one AddressBookAddInput JSON object."));
+		const kind = yield* Prompt.select({
+			message: "Reference kind",
+			choices: [
+				"handle",
+				"email",
+				"address",
+				"party"
+			].map((value) => ({
+				title: value,
+				value
+			}))
+		});
+		const value = (yield* Prompt.text({ message: "Reference value" })).trim();
+		const label = (yield* Prompt.text({ message: "Label (optional)" })).trim();
+		return yield* parseAddInput(JSON.stringify({
+			ref: kind === "handle" ? {
+				kind,
+				handle: value
+			} : kind === "email" ? {
+				kind,
+				email: value
+			} : kind === "address" ? {
+				kind,
+				address: value
+			} : {
+				kind,
+				partyId: value
+			},
+			...label === "" ? {} : { label }
+		}));
+	}
+	const text = source === "-" ? yield* boundedText((yield* Stdio.Stdio).stdin, 65536) : yield* Effect.gen(function* () {
+		const fs = yield* FileSystem.FileSystem;
+		return yield* boundedText(fs.stream(source, { bytesToRead: 65537 }), 65536);
+	});
+	return yield* parseAddInput(text);
+}).pipe(Effect.mapError((error) => error instanceof CliFailure ? error : inputRequired("The contact input file could not be read or was too large.")));
+const partyId = (value) => Effect.try({
+	try: () => toPartyId(value),
+	catch: () => inputRequired("Provide a valid --entry-id.")
+});
+const selectedBook = (client, actor, orgs) => Effect.gen(function* () {
+	const ids = [...new Set(orgs)];
+	if (ids.length > 1) return yield* Effect.fail(inputRequired("Provide one exact Organization ID."));
+	if (actor === "personal") {
+		if (ids.length > 0) return yield* Effect.fail(inputRequired("Personal contacts do not accept --org."));
+		return client.account.addressBook;
+	}
+	if (ids.length === 0) return yield* Effect.fail(inputRequired("Provide --org."));
+	const organizationId = yield* Effect.try({
+		try: () => toOrgId(ids[0]),
+		catch: () => inputRequired("Provide a valid --org.")
+	});
+	return client.org(organizationId).addressBook;
+});
+const result = (value, lines) => ({
+	data: value,
+	lines
+});
+const requiredLabel = (value) => {
+	const label = value?.trim() ?? "";
+	return label.length === 0 ? Effect.fail(inputRequired("Provide --label.")) : Effect.succeed(label);
+};
+const actorLine = (orgs) => orgs[0] === void 0 ? "Actor: personal" : `Actor: Organization ${JSON.stringify(orgs[0])}`;
+const runContact = (config, action, input) => Effect.gen(function* () {
+	const addInput = action === "add" ? yield* readAddInput(input.input) : void 0;
+	const entryId = action === "get" || action === "label" || action === "hide" || action === "unhide" ? yield* partyId(input.entryId) : void 0;
+	const label = action === "label" ? yield* requiredLabel(input.label) : void 0;
+	const interactiveWrite = action === "add" || action === "label" || action === "hide" || action === "unhide" ? yield* requireWriteConfirmation(input.confirm) : false;
+	const { client } = yield* restoreAuthenticatedClient(config, input.email);
+	const book = yield* selectedBook(client, input.actor, input.orgs);
+	if (action === "add") {
+		if (interactiveWrite) yield* confirmWrite({
+			lines: [actorLine(input.orgs), `Reference: ${JSON.stringify(addInput.ref)}`],
+			question: "Add this contact?"
+		});
+		const entry = yield* Effect.promise((signal) => book.add(addInput, { signal })).pipe(Effect.flatMap(resultValue));
+		return result(entry, [JSON.stringify(entry)]);
+	}
+	if (action === "get") {
+		const entry = yield* Effect.promise((signal) => book.get(entryId, { signal })).pipe(Effect.flatMap(resultValue));
+		return result(entry, [entry === null ? "No contact found" : JSON.stringify(entry)]);
+	}
+	if (action === "list") {
+		const entries = yield* Effect.promise((signal) => book.list(input.includeHidden === true ? { includeHidden: true } : void 0, { signal })).pipe(Effect.flatMap(resultValue));
+		return result(entries, entries.map((entry) => JSON.stringify(entry)));
+	}
+	if (interactiveWrite) {
+		const current = yield* Effect.promise((signal) => book.get(entryId, { signal })).pipe(Effect.flatMap(resultValue));
+		if (current === null) return yield* Effect.fail(inputRequired("No contact has that --entry-id."));
+		yield* confirmWrite({
+			lines: [
+				actorLine(input.orgs),
+				`PartyId: ${current.id}`,
+				`Current: ${JSON.stringify({
+					label: current.label,
+					hidden: current.hidden
+				})}`,
+				`Result: ${JSON.stringify(action === "label" ? {
+					label,
+					hidden: current.hidden
+				} : {
+					label: current.label,
+					hidden: action === "hide"
+				})}`
+			],
+			question: `${action === "label" ? "Label" : action === "hide" ? "Hide" : "Unhide"} this contact?`
+		});
+	}
+	const entry = yield* Effect.promise((signal) => action === "label" ? book.label({
+		entryId,
+		label
+	}, { signal }) : action === "hide" ? book.hide(entryId, { signal }) : book.unhide(entryId, { signal })).pipe(Effect.flatMap(resultValue));
+	return result(entry, [JSON.stringify(entry)]);
+});
+//#endregion
+//#region src/commands/contact.ts
+const emailFlag$1 = Flag.string("email").pipe(Flag.optional);
+const orgFlag$1 = Flag.string("org").pipe(Flag.withAlias("org-id"), Flag.atLeast(1));
+const includeHiddenFlag = Flag.boolean("include-hidden").pipe(Flag.withDefault(false));
+const entryIdFlag = Flag.string("entry-id");
+const labelFlag = Flag.string("label");
+const inputFlag = Flag.string("input").pipe(Flag.optional);
+const confirmFlag$1 = Flag.boolean("confirm").pipe(Flag.withDefault(false));
+const names = {
+	personal: {
+		root: "contact",
+		list: "contact.list",
+		get: "contact.get",
+		add: "contact.add",
+		label: "contact.label",
+		hide: "contact.hide",
+		unhide: "contact.unhide"
+	},
+	organization: {
+		root: "org.contact",
+		list: "org.contact.list",
+		get: "org.contact.get",
+		add: "org.contact.add",
+		label: "org.contact.label",
+		hide: "org.contact.hide",
+		unhide: "org.contact.unhide"
+	}
+};
+const metadata$1 = (name) => ({
+	name,
+	capability: "contacts",
+	observation: "command"
+});
+const makeContactCommand = (actor) => {
+	const selectedNames = names[actor];
+	const scope = actor === "organization" ? { orgs: orgFlag$1 } : {};
+	const execute = (action, input) => runCommand({
+		...metadata$1(selectedNames[action]),
+		network: true
+	}, (config) => runContact(config, action, {
+		actor,
+		orgs: input.orgs ?? [],
+		email: input.email,
+		includeHidden: input.includeHidden,
+		entryId: input.entryId,
+		label: input.label,
+		input: input.input,
+		confirm: input.confirm
+	}));
+	const list = Command.make("list", {
+		email: emailFlag$1,
+		...scope,
+		includeHidden: includeHiddenFlag
+	}, ({ email, includeHidden, ...scoped }) => execute("list", {
+		email: Option.getOrUndefined(email),
+		orgs: "orgs" in scoped ? scoped.orgs : [],
+		includeHidden,
+		confirm: false
+	})).pipe(Command.annotate(CliCommandMetadata, metadata$1(selectedNames.list)), Command.withDescription("List contacts in the selected actor's address book"));
+	const get = Command.make("get", {
+		email: emailFlag$1,
+		...scope,
+		entryId: entryIdFlag
+	}, ({ email, entryId, ...scoped }) => execute("get", {
+		email: Option.getOrUndefined(email),
+		orgs: "orgs" in scoped ? scoped.orgs : [],
+		entryId,
+		confirm: false
+	})).pipe(Command.annotate(CliCommandMetadata, metadata$1(selectedNames.get)), Command.withDescription("Read one contact by stable PartyId"));
+	const add = Command.make("add", {
+		email: emailFlag$1,
+		...scope,
+		input: inputFlag,
+		confirm: confirmFlag$1
+	}, ({ email, input, confirm, ...scoped }) => execute("add", {
+		email: Option.getOrUndefined(email),
+		orgs: "orgs" in scoped ? scoped.orgs : [],
+		input: Option.getOrUndefined(input),
+		confirm
+	})).pipe(Command.annotate(CliCommandMetadata, metadata$1(selectedNames.add)), Command.withDescription("Add one contact from AddressBookAddInput JSON"));
+	const labelContact = Command.make("label", {
+		email: emailFlag$1,
+		...scope,
+		entryId: entryIdFlag,
+		label: labelFlag,
+		confirm: confirmFlag$1
+	}, ({ email, entryId, label, confirm, ...scoped }) => execute("label", {
+		email: Option.getOrUndefined(email),
+		orgs: "orgs" in scoped ? scoped.orgs : [],
+		entryId,
+		label,
+		confirm
+	})).pipe(Command.annotate(CliCommandMetadata, metadata$1(selectedNames.label)), Command.withDescription("Change one contact label by stable PartyId"));
+	const visibility = (action) => Command.make(action, {
+		email: emailFlag$1,
+		...scope,
+		entryId: entryIdFlag,
+		confirm: confirmFlag$1
+	}, ({ email, entryId, confirm, ...scoped }) => execute(action, {
+		email: Option.getOrUndefined(email),
+		orgs: "orgs" in scoped ? scoped.orgs : [],
+		entryId,
+		confirm
+	})).pipe(Command.annotate(CliCommandMetadata, metadata$1(selectedNames[action])), Command.withDescription(`${action === "hide" ? "Hide" : "Restore"} one contact`));
+	return Command.make("contact").pipe(Command.annotate(CliCommandMetadata, metadata$1(selectedNames.root)), Command.withDescription("Manage the selected actor's contacts"), Command.withSubcommands([
+		list,
+		get,
+		add,
+		labelContact,
+		visibility("hide"),
+		visibility("unhide")
+	]));
+};
+const contact = makeContactCommand("personal");
+const organizationContact = makeContactCommand("organization");
+//#endregion
 //#region src/commands/org.ts
 const emailFlag = Flag.string("email").pipe(Flag.optional);
 const orgFlag = Flag.string("org").pipe(Flag.withAlias("org-id"), Flag.atLeast(0));
@@ -54251,7 +55892,11 @@ const memberGet = Command.make("get", {
 	orgs,
 	accountId
 })).pipe(Command.annotate(CliCommandMetadata, metadata("org.member.get")), Command.withDescription("Read one member by exact Account ID"));
-const member = Command.make("member").pipe(Command.annotate(CliCommandMetadata, metadata("org.member")), Command.withSubcommands([members("list"), memberGet]));
+const member = Command.make("member").pipe(Command.annotate(CliCommandMetadata, metadata("org.member")), Command.withSubcommands([
+	members("list"),
+	memberGet,
+	memberInvite
+]));
 const wait = Command.make("wait", {
 	...scoped,
 	timeoutSeconds: Flag.integer("timeout-seconds").pipe(Flag.withDefault(120))
@@ -54303,6 +55948,8 @@ const org = Command.make("org").pipe(Command.annotate(CliCommandMetadata, metada
 	me,
 	members("members"),
 	member,
+	organizationContact,
+	invite,
 	wait,
 	create,
 	retry
@@ -54340,19 +55987,10 @@ const command = Command.make("capxul").pipe(Command.annotate(CliCommandMetadata,
 	auth,
 	doctor,
 	telemetry,
+	contact,
 	org
 ]), Command.withGlobalFlags([JsonOutput]));
 //#endregion
-//#region src/platform/bounded-text.ts
-var UpdateUnavailable = class extends Data.TaggedError("UpdateUnavailable") {};
-const boundedText = (stream, limit) => Effect.suspend(() => {
-	let size = 0;
-	return stream.pipe(Stream.mapEffect((chunk) => {
-		size += chunk.byteLength;
-		return size > limit ? Effect.fail(new UpdateUnavailable()) : Effect.succeed(chunk);
-	}), Stream.decodeText(), Stream.runFold(() => "", (text, chunk) => text + chunk));
-});
-//#endregion
 //#region src/platform/install-provenance.ts
 const Manifest = Schema.Struct({
 	name: Schema.Literal("@capxul/cli"),