@capxul/cli 4.20.0-beta.6 → 4.20.0-beta.8

package/dist/browser/signer.js

@@ -5421,6 +5421,28 @@
 	//#region ../../packages/config/src/org-payments.ts
 	/** Zodiac MultiSendCallOnly module on Base Sepolia. */
 	const MULTI_SEND_CALL_ONLY = "0x9641d764fc13c8b624c04430c7356c1c7c8102e2";
+	/** Supported Organization permission identities, newest first. */
+	const ORG_PERMISSION_IDENTITY_PROFILES = [{
+		id: "zodiac-roles-2.1.1",
+		moduleFactoryRuntimeKeccak256: "0x01623cbcf010a1c326230f1b2d5f48a66b440232ee49096102bc84967dc5f21e",
+		mastercopy: "0xf2964ce6161ce0e75964fe7927ce114cb0b283d5",
+		mastercopyRuntimeKeccak256: "0x471d8b3b419f1eb955230c0326c8812176df49bf3c7b414a563fda5a3c6c10b6",
+		proxyRuntimeKeccak256: "0x248f9591f94c24c199ade3e73feb477cf02d387b2bea91f2f931a0deb094f163",
+		multiSendUnwrapper: "0xb4cd4bb764c089f20da18700ce8bc5e49f369efd",
+		multiSendUnwrapperRuntimeKeccak256: "0x1f6e088be5e6ef9d0fbe0547d3fa9a9e40d823433fd8a4449215b5663209a1eb"
+	}, {
+		id: "zodiac-roles-2.1.0",
+		moduleFactoryRuntimeKeccak256: "0x01623cbcf010a1c326230f1b2d5f48a66b440232ee49096102bc84967dc5f21e",
+		mastercopy: "0x9646fdad06d3e24444381f44362a3b0eb343d337",
+		mastercopyRuntimeKeccak256: "0x87911cbc6aa0496e6bcb07dab2462b9c76daea130dede6dcc57d0adf307fa7ec",
+		proxyRuntimeKeccak256: "0x9d4059abf46db50e4b48d9b6404b1f200cb5a1efeb3725be2de630a2a9001944",
+		multiSendUnwrapper: "0x93b7fcbc63ed8a3a24b59e1c3e6649d50b7427c0",
+		multiSendUnwrapperRuntimeKeccak256: "0x4d8d8608b70a6e2f40726b9dd74406bbf73e90cac58e23ee953e2b45ad7dc3df"
+	}];
+	const CURRENT_ORG_PERMISSION_IDENTITY = ORG_PERMISSION_IDENTITY_PROFILES[0];
+	ORG_PERMISSION_IDENTITY_PROFILES[1];
+	CURRENT_ORG_PERMISSION_IDENTITY.mastercopy;
+	CURRENT_ORG_PERMISSION_IDENTITY.multiSendUnwrapper;
 	//#endregion
 	//#region ../../packages/config/src/capxul-payments-v2.ts
 	/** The exact compiled CapxulPaymentsV2 ABI. */
@@ -17571,10 +17593,12 @@
 			prepareOrganizationPaymentExecution: "moneyExecution.prepareOrganizationPaymentExecution",
 			preparePaymentExecution: "moneyExecution.preparePaymentExecution",
 			preparePaymentLifecycleExecution: "moneyExecution.preparePaymentLifecycleExecution",
+			prepareInvitationConfiguration: "moneyExecution.prepareInvitationConfiguration",
 			preparePermissionExecution: "moneyExecution.preparePermissionExecution",
 			recoverSubmissionClaims: "moneyExecution.recoverSubmissionClaims",
 			submit: "moneyExecution.submit",
 			submitPaymentCommandExecution: "moneyExecution.submitPaymentCommandExecution",
+			submitInvitationConfigurationExecution: "moneyExecution.submitInvitationConfigurationExecution",
 			submitPaymentExecution: "moneyExecution.submitPaymentExecution",
 			submitPermissionExecution: "moneyExecution.submitPermissionExecution"
 		},
@@ -17596,20 +17620,52 @@
 			completePerson: "onboarding.completePerson"
 		},
 		org: {
-			acceptInvitations: "org.acceptInvitations",
 			account: { get: "org.account.get" },
-			activateMember: "org.activateMember",
 			auditLog: "org.auditLog",
 			confirmBootstrap: "org.confirmBootstrap",
 			createOrg: "org.createOrg",
 			create: "org.create",
-			detectAndAcceptPendingInvitations: "org.detectAndAcceptPendingInvitations",
+			/**
+			* §11: the consent mutation reports `org_invite_accepted` through its own
+			* scheduled emitter. It is named for the emit, not the acceptance, because
+			* the interactive acceptance itself owns `org.invitations.accept`.
+			*/
+			emitInviteAccepted: "org.emitInviteAccepted",
 			emitInviteProgressed: "org.emitInviteProgressed",
 			expireInvitations: "org.expireInvitations",
 			getLifecycle: "org.getLifecycle",
 			getProofReceipt: "org.getProofReceipt",
 			invite: "org.invite",
-			inviteMember: "org.inviteMember",
+			/** D8 invitation lifecycle: preview, own list, read, and the four transitions. */
+			invitations: {
+				/** The exact grantee's consent commit (§8): one accepted digest, once. */
+				accept: "org.invitations.accept",
+				/**
+				* The authoring write. It is named `authorize`, not `invite`, because the
+				* backend already uses `org.invitations.invite` as a refusal label and
+				* `lint:telemetry-spine` refuses a label that collides with an operation.
+				*/
+				authorize: "org.invitations.authorize",
+				cancel: "org.invitations.cancel",
+				decline: "org.invitations.decline",
+				get: "org.invitations.get",
+				list: "org.invitations.list",
+				/**
+				* The Admin-scoped Organization list. It is named `listScoped`, not
+				* `list`, because the own-offer list already owns `org.invitations.list`.
+				*/
+				listScoped: "org.invitations.listScoped",
+				/**
+				* The authoring write's inner hops: the SDK drives the backend's existing
+				* prepare/submit pair, and these names label the two Convex calls. The
+				* owning `capxul_sdk_operation` record stays `org.invitations.authorize`.
+				*/
+				prepareConfiguration: "org.invitations.prepareConfiguration",
+				preview: "org.invitations.preview",
+				resend: "org.invitations.resend",
+				retry: "org.invitations.retry",
+				submitConfiguration: "org.invitations.submitConfiguration"
+			},
 			list: "org.list",
 			load: "org.load",
 			me: "org.me",
@@ -17668,7 +17724,6 @@
 			},
 			recordFailure: "org.recordFailure",
 			recordProgress: "org.recordProgress",
-			resendInviteToken: "org.resendInviteToken",
 			resumeBootstrapSubmission: "org.resumeBootstrapSubmission",
 			retry: "org.retry",
 			retrySetup: "org.retrySetup",
@@ -17685,7 +17740,6 @@
 			retry: "organizationPayments.retry"
 		},
 		organizationSetup: { getProofReceipt: "organizationSetup.getProofReceipt" },
-		organizations: { detectAndAcceptPendingInvitations: "orgs.detectAndAcceptPendingInvitations" },
 		payments: {
 			cancel: "payments.cancel",
 			claim: "payments.claim",
@@ -17723,6 +17777,7 @@
 			terms: "payroll.terms"
 		},
 		permission: {
+			verifyInvitationConfiguration: "permission.verifyInvitationConfiguration",
 			command: "permission.command",
 			retryVerification: "permission.retryVerification",
 			verify: "permission.verify",
@@ -18259,6 +18314,11 @@
 	const OrgInviteSentProps = Struct({
 		...TelemetryEnvelopeProps,
 		org_id: OptionalOrgId,
+		invitation_id: OptionalString,
+		generation: OptionalString,
+		command_id: OptionalString,
+		subject_party_id: OptionalString,
+		persisted_at: OptionalEpochMs,
 		email_domain: OptionalString,
 		role: OptionalString,
 		status: OptionalString
@@ -18266,6 +18326,11 @@
 	const OrgInviteAcceptedProps = Struct({
 		...TelemetryEnvelopeProps,
 		org_id: OptionalOrgId,
+		invitation_id: OptionalString,
+		accepted_at: OptionalEpochMs,
+		generation: OptionalString,
+		command_id: OptionalString,
+		subject_party_id: OptionalString,
 		role: OptionalString,
 		status: OptionalString
 	});
@@ -18273,6 +18338,7 @@
 		...TelemetryEnvelopeProps,
 		org_id: OptionalOrgId,
 		email_domain: OptionalString,
+		invitation_id: OptionalString,
 		reason: OptionalString,
 		role: OptionalString,
 		status: OptionalString
@@ -18425,9 +18491,24 @@
 			"applied",
 			"replayed",
 			"conflicting_replay",
-			"revision_mismatch"
+			"revision_mismatch",
+			"cleanup_required",
+			"not_applied",
+			"application_failure",
+			"mismatch",
+			"refused"
 		])),
+		command_kind: optional(Literals(["invitation_configuration", "invitation_eoa"])),
 		command_id: OptionalString,
+		invitation_id: OptionalString,
+		generation: OptionalString,
+		purpose: optional(Literals([
+			"configure",
+			"grant",
+			"disable",
+			"compensate"
+		])),
+		$insert_id: OptionalString,
 		/**
 		* #1961 R03. The authorized stored row names the Permission it changed; the
 		* verified receipt names the chain facts that prove it. Every field is
@@ -18814,6 +18895,13 @@
 		"auth.profile",
 		"auth.status",
 		"auth.logout",
+		"contact",
+		"contact.list",
+		"contact.get",
+		"contact.add",
+		"contact.label",
+		"contact.hide",
+		"contact.unhide",
 		"org",
 		CAPXUL_OPERATIONS.org.list,
 		"org.use",
@@ -18822,6 +18910,24 @@
 		CAPXUL_OPERATIONS.org.members,
 		"org.member",
 		"org.member.get",
+		"org.member.invite",
+		"org.contact",
+		"org.contact.list",
+		"org.contact.get",
+		"org.contact.add",
+		"org.contact.label",
+		"org.contact.hide",
+		"org.contact.unhide",
+		CAPXUL_OPERATIONS.org.invite,
+		"org.invite.list",
+		"org.invite.get",
+		"org.invite.wait",
+		"org.invite.review",
+		"org.invite.accept",
+		"org.invite.decline",
+		"org.invite.cancel",
+		"org.invite.resend",
+		"org.invite.retry",
 		"org.wait",
 		CAPXUL_OPERATIONS.org.create,
 		CAPXUL_OPERATIONS.org.retry,
@@ -18832,7 +18938,8 @@
 		"diagnostics",
 		"collection",
 		"authentication",
-		"organization"
+		"organization",
+		"contacts"
 	];
 	const CLI_INVOCATION_KINDS = [
 		"command",
@@ -19074,6 +19181,7 @@
 			...TelemetryEnvelopeProps,
 			organization_id: OrgIdTelemetrySchema,
 			progress: Literals([
+				"configuration_authorized",
 				"account_ready",
 				"permission_applied",
 				"membership_activated",
@@ -19081,6 +19189,9 @@
 			]),
 			/** The invited Party. The initiating actor stays on the envelope's identity. */
 			member_party_id: String$1,
+			invitation_id: optional(String$1),
+			generation: optional(String$1),
+			command_id: optional(String$1),
 			occurred_at: Number$1
 		})
 	});
@@ -19374,8 +19485,10 @@
 		"movement/annotations": { overlay: "movement/annotations:overlay" },
 		"moneyExecution/actions": {
 			abandonPaymentExecution: "moneyExecution/actions:abandonPaymentExecution",
+			prepareInvitationConfiguration: "moneyExecution/actions:prepareInvitationConfiguration",
 			preparePermissionExecution: "moneyExecution/actions:preparePermissionExecution",
 			preparePaymentExecution: "moneyExecution/actions:preparePaymentExecution",
+			submitInvitationConfigurationExecution: "moneyExecution/actions:submitInvitationConfigurationExecution",
 			submitPermissionExecution: "moneyExecution/actions:submitPermissionExecution",
 			submitPaymentExecution: "moneyExecution/actions:submitPaymentExecution"
 		},
@@ -19392,8 +19505,6 @@
 		},
 		"org/actions": {
 			confirmBootstrap: "org/actions:confirmBootstrap",
-			detectAndAcceptPendingInvitations: "org/actions:detectAndAcceptPendingInvitations",
-			inviteMember: "org/actions:inviteMember",
 			prepareBootstrap: "org/actions:prepareBootstrap",
 			prepareFounderAccount: "org/actions:prepareFounderAccount",
 			readTreasury: "org/actions:readTreasury",
@@ -19424,16 +19535,25 @@
 			startOrResume: "org/lifecycle:startOrResume"
 		},
 		"org/mutations": {
+			accept: "org/mutations:accept",
+			cancel: "org/mutations:cancel",
 			createOrg: "org/mutations:createOrg",
-			resendInviteToken: "org/mutations:resendInviteToken"
+			decline: "org/mutations:decline",
+			invite: "org/mutations:invite",
+			resend: "org/mutations:resend",
+			retry: "org/mutations:retry"
 		},
 		"org/queries": {
+			getInvitation: "org/queries:getInvitation",
 			listAll: "org/queries:listAll",
+			listInvitations: "org/queries:listInvitations",
 			listMembersByOrgId: "org/queries:listMembersByOrgId",
 			listMine: "org/queries:listMine",
+			listMyInvitations: "org/queries:listMyInvitations",
 			listRolesByOrgId: "org/queries:listRolesByOrgId",
 			loadByOrgId: "org/queries:loadByOrgId",
-			me: "org/queries:me"
+			me: "org/queries:me",
+			previewInvite: "org/queries:previewInvite"
 		},
 		"smartAccount/actions": {
 			claim: "smartAccount/actions:claim",
@@ -20369,6 +20489,93 @@
 		topic0: Bytes32Schema,
 		dataHash: Bytes32Schema
 	});
+	const InvitationEoaReceiptSchema = Struct({
+		kind: Literal("invitation_eoa"),
+		chainId: BaseSepoliaChainIdSchema,
+		transactionHash: TxHashSchema,
+		blockNumber: BlockNumberSchema,
+		blockHash: Bytes32Schema,
+		sender: AddressSchema,
+		nonce: String$1.pipe(refine((value) => /^(0|[1-9][0-9]*)$/.test(value)))
+	});
+	const PermissionEventRefSchema = Struct({
+		receipt: Union([Struct({
+			kind: Literal("user_operation"),
+			...ReceiptRefSchema.fields
+		}), InvitationEoaReceiptSchema]),
+		emitter: AddressSchema,
+		transactionIndex: LogIndexSchema,
+		logIndex: LogIndexSchema,
+		topic0: Bytes32Schema,
+		dataHash: Bytes32Schema
+	});
+	Union([
+		Struct({
+			status: Literal("pending"),
+			reason: Literal("receipt_missing")
+		}),
+		Struct({
+			status: Literal("provider_failure"),
+			retryable: Literal(true)
+		}),
+		Struct({
+			status: Literal("mismatch"),
+			code: Literals([
+				"wrong_chain",
+				"wrong_sender",
+				"wrong_transaction",
+				"failed_transaction",
+				"non_canonical_block",
+				"wrong_contract_identity",
+				"missing_event",
+				"extra_authority_event",
+				"wrong_fact_tuple",
+				"wrong_state",
+				"conflicting_replay"
+			]),
+			attemptTransactionHash: optional(TxHashSchema),
+			receipt: optional(InvitationEoaReceiptSchema)
+		}),
+		Struct({
+			status: Literal("verified"),
+			commandId: PaymentCommandIdSchema,
+			receipt: InvitationEoaReceiptSchema,
+			events: ArraySchema(PermissionEventRefSchema),
+			factsHash: Bytes32Schema
+		})
+	]);
+	/**
+	* One stored `setAllowance` call inside a command's expected authority set.
+	*
+	* The pinned Roles module emits `SetAllowance` as *post-state*, not as the call
+	* arguments: `maxRefill = 0` becomes `type(uint128).max`, and `timestamp = 0`
+	* becomes the receipt block's timestamp. A hash over the call arguments can
+	* therefore never match that receipt. `index` names the entry in
+	* `expectedAuthorityEvents` the call produced, and `data` is the call's own
+	* calldata, so the verifier can rebuild the one hash the module actually emits.
+	* The rule is pinned by `test:invitation-conformance`.
+	*/
+	const AllowanceExpectationSchema = Struct({
+		index: nonNegativeInteger("index"),
+		data: String$1.pipe(refine((value) => /^0x[0-9a-fA-F]+$/u.test(value), { message: "data must be 0x-prefixed hex" }))
+	});
+	Struct({
+		commandId: PaymentCommandIdSchema,
+		userOpHash: Bytes32Schema,
+		generationHash: Bytes32Schema,
+		chainId: BaseSepoliaChainIdSchema,
+		organizationSafe: SafeAddressSchema,
+		rolesModule: ModuleAddressSchema,
+		userOpSenderSafe: SafeAddressSchema,
+		expectedAuthorityEvents: ArraySchema(Bytes32Schema),
+		/**
+		* Absent means "no normalization": every expected hash is compared as stored.
+		* A command whose set contains `setAllowance` then refuses (`wrong_fact_tuple`)
+		* rather than passing on a weakened proof, so an incomplete caller fails
+		* closed.
+		*/
+		allowanceExpectations: optional(ArraySchema(AllowanceExpectationSchema))
+	});
 	const PermissionOperationSchema = Literals([
 		"create",
 		"change",
@@ -20411,7 +20618,9 @@
 			originatingAuthUserId: optional(String$1),
 			originatingObservationContext: optional(Unknown)
 		}),
-		userOpHash: Bytes32Schema
+		userOpHash: Bytes32Schema,
+		/** The stored `setAllowance` calls of this command's own expectation. */
+		allowanceExpectations: optional(ArraySchema(AllowanceExpectationSchema))
 	});
 	Union([
 		Struct({
@@ -21247,6 +21456,27 @@
 		digest: Bytes32Schema,
 		value: PermissionResourceSchema
 	});
+	Struct({
+		commandId: PaymentCommandIdSchema,
+		signerAddress: AddressSchema
+	});
+	Struct({
+		executionId: MoneyExecutionIdSchema,
+		commandId: PaymentCommandIdSchema,
+		orgId: nonEmpty("orgId"),
+		invitationId: nonEmpty("invitationId"),
+		generationHash: Bytes32Schema,
+		chainId: BaseSepoliaChainIdSchema,
+		signerAddress: AddressSchema,
+		userOpSenderSafe: SafeAddressSchema,
+		digest: Bytes32Schema
+	});
+	Struct({
+		status: Literal("submitted"),
+		executionId: MoneyExecutionIdSchema,
+		commandId: PaymentCommandIdSchema,
+		userOpHash: Bytes32Schema
+	});
 	Struct({
 		status: Literal("submitted"),
 		executionId: MoneyExecutionIdSchema,
@@ -21751,6 +21981,158 @@
 			actions: NonEmptyArray(Literals(["pay", "commitments"]))
 		})
 	}), Struct({ type: Literal("managePeople") })]);
+	const BudgetIntentSchema = CurrentPolicySchema.pipe(refine((value) => {
+		if (value.type !== "budget") return false;
+		const { actions, recipients } = value.scope;
+		if (new Set(actions).size !== actions.length) return false;
+		return recipients.type === "anyone" || recipients.accounts.length >= 1 && recipients.accounts.length <= 32 && new Set(recipients.accounts).size === recipients.accounts.length;
+	}));
+	const InvitationIdSchema = NonEmptyString;
+	Struct({
+		...Struct({ invitationId: InvitationIdSchema }).fields,
+		expectedOfferDigest: Bytes32Schema
+	});
+	/** The requested grantee of one invitation. */
+	const GranteeRefSchema = Union([Struct({
+		type: Literal("email"),
+		email: NonEmptyString
+	}), Struct({
+		type: Literal("account"),
+		accountId: AccountIdSchema
+	})]);
+	Struct({
+		requestKey: String$1.pipe(refine((value) => /^[\x20-\x7e]{1,128}$/.test(value))),
+		to: GranteeRefSchema,
+		grants: ArraySchema(Union([
+			Struct({
+				type: Literal("budget"),
+				budgetId: PermissionIdSchema
+			}),
+			Struct({
+				type: Literal("managePeople"),
+				permissionId: PermissionIdSchema
+			}),
+			Struct({
+				type: Literal("new_budget"),
+				label: String$1.pipe(refine((value) => value.trim().length >= 1 && value.trim().length <= 128)),
+				intent: BudgetIntentSchema
+			})
+		]))
+	}).pipe(refine((value) => {
+		if (value.grants.length < 1 || value.grants.length > 16) return false;
+		const existing = value.grants.flatMap((grant) => grant.type === "new_budget" ? [] : [grant.type === "budget" ? grant.budgetId : grant.permissionId]);
+		return new Set(existing).size === existing.length && value.grants.filter((grant) => grant.type === "new_budget").length <= 4;
+	}));
+	const InvitationPhaseSchema = Literals([
+		"authorizing",
+		"pending",
+		"pending_grant",
+		"active",
+		"revoking",
+		"declined",
+		"cancelled",
+		"expired",
+		"revoked"
+	]);
+	const EndingReasonSchema = Literals([
+		"declined",
+		"cancelled",
+		"expired",
+		"revoked"
+	]);
+	const OfferedAuthoritySchema = Union([Struct({
+		type: Literal("budget"),
+		budgetId: NonEmptyString.pipe(refine((value) => value.length > 0)),
+		label: String$1,
+		policy: BudgetIntentSchema,
+		policyDigest: Bytes32Schema
+	}), Struct({
+		type: Literal("managePeople"),
+		permissionId: PermissionIdSchema,
+		label: String$1
+	})]);
+	const NewBudgetOfferSchema = Struct({
+		type: Literal("new_budget"),
+		label: String$1,
+		policy: BudgetIntentSchema,
+		policyDigest: Bytes32Schema
+	});
+	const PreviewGranteeSchema = Struct({
+		partyId: NullOr(PartyIdSchema),
+		accountId: NullOr(AccountIdSchema),
+		safeAddress: AddressSchema,
+		accountReady: NullOr(Boolean$1)
+	});
+	Struct({
+		orgId: NonEmptyString.pipe(refine((value) => value.length > 0)),
+		grantee: PreviewGranteeSchema,
+		grants: ArraySchema(Union([OfferedAuthoritySchema, NewBudgetOfferSchema])),
+		existingAssignments: ArraySchema(PermissionAssignmentIdSchema),
+		includesManagement: Boolean$1,
+		observedAt: EpochMsSchema
+	});
+	Struct({
+		cursor: optional(NonEmptyString),
+		limit: optional(Number$1.pipe(refine((value) => Number.isSafeInteger(value) && value >= 1 && value <= 100))),
+		phases: optional(ArraySchema(InvitationPhaseSchema).pipe(refine((value) => new Set(value).size === value.length)))
+	});
+	const InvitationRecoverySchema = Struct({
+		actor: Literals([
+			"system",
+			"invitee",
+			"admin"
+		]),
+		action: Literals([
+			"wait",
+			"retry",
+			"review_offer",
+			"reauthorize"
+		]),
+		reason: Literals([
+			"configuration_pending",
+			"grant_pending",
+			"provider_unavailable",
+			"policy_changed",
+			"cleanup_pending",
+			"signer_unavailable"
+		])
+	});
+	Struct({
+		items: ArraySchema(Struct({
+			id: InvitationIdSchema,
+			orgId: NonEmptyString.pipe(refine((value) => value.length > 0)),
+			organizationName: String$1,
+			grantee: Struct({
+				partyId: PartyIdSchema,
+				accountId: NullOr(AccountIdSchema),
+				safeAddress: AddressSchema,
+				accountReady: NullOr(Boolean$1)
+			}),
+			phase: InvitationPhaseSchema,
+			grants: ArraySchema(Union([Struct({
+				type: Literal("budget"),
+				budgetId: NonEmptyString.pipe(refine((value) => value.length > 0))
+			}), Struct({
+				type: Literal("managePeople"),
+				permissionId: PermissionIdSchema
+			})])),
+			offers: ArraySchema(OfferedAuthoritySchema),
+			recovery: NullOr(InvitationRecoverySchema),
+			offerDigest: Bytes32Schema,
+			authorizedAt: NullOr(EpochMsSchema),
+			acceptedAt: NullOr(EpochMsSchema),
+			expiresAt: NullOr(EpochMsSchema),
+			commandId: NullOr(PaymentCommandIdSchema),
+			endingReason: NullOr(EndingReasonSchema),
+			delivery: Literals([
+				"not_confirmed",
+				"sent",
+				"failed"
+			])
+		})),
+		nextCursor: NullOr(NonEmptyString),
+		observedAt: EpochMsSchema
+	});
 	const ActiveBudgetSchema = Struct({
 		id: PermissionIdSchema,
 		label: String$1,
@@ -22048,7 +22430,7 @@
 	createApi();
 	CAPXUL_FUNCTIONS["financialOps/addressBook"].list, CAPXUL_FUNCTIONS["financialOps/addressBook"].get, CAPXUL_FUNCTIONS["financialOps/addressBook"].add, CAPXUL_FUNCTIONS["financialOps/addressBook"].hide, CAPXUL_FUNCTIONS["financialOps/addressBook"].unhide, CAPXUL_FUNCTIONS["financialOps/addressBook"].label, CAPXUL_FUNCTIONS["financialOps/requestsInbox"].issue, CAPXUL_FUNCTIONS["financialOps/requestsInbox"].list, CAPXUL_FUNCTIONS["financialOps/requestsInbox"].get, CAPXUL_FUNCTIONS["financialOps/requestsInbox"].cancel, CAPXUL_FUNCTIONS["financialOps/requestsInbox"].inboxList, CAPXUL_FUNCTIONS["financialOps/requestsInbox"].approve, CAPXUL_FUNCTIONS["financialOps/requestsInbox"].decline;
 	CAPXUL_FUNCTIONS["financialOps/queries"].me, CAPXUL_FUNCTIONS["financialOps/queries"].depositInstructions, CAPXUL_FUNCTIONS["financialOps/queries"].resolveRecipient, CAPXUL_FUNCTIONS["financialOps/destinations"].add, CAPXUL_FUNCTIONS["financialOps/destinations"].list, CAPXUL_FUNCTIONS["financialOps/destinations"].remove, CAPXUL_FUNCTIONS["financialOps/queries"].listPayments, CAPXUL_FUNCTIONS["financialOps/queries"].getPayment, CAPXUL_FUNCTIONS["movement/activity"].list, CAPXUL_FUNCTIONS["movement/activity"].summary, CAPXUL_FUNCTIONS["movement/activity"].get, CAPXUL_FUNCTIONS["movement/activity"].annotate, CAPXUL_FUNCTIONS["movement/annotations"].overlay, CAPXUL_FUNCTIONS["financialOps/queries"].getPaymentDocument, CAPXUL_FUNCTIONS["financialOps/queries"].verifyPaymentDocument, CAPXUL_FUNCTIONS["financialOps/queries"].renderStoredDocument;
-	CAPXUL_FUNCTIONS["moneyExecution/actions"].abandonPaymentExecution, CAPXUL_FUNCTIONS["moneyExecution/actions"].preparePermissionExecution, CAPXUL_FUNCTIONS["moneyExecution/actions"].preparePaymentExecution, CAPXUL_FUNCTIONS["moneyExecution/paymentCommandActions"].prepareOrganizationPaymentExecution, CAPXUL_FUNCTIONS["moneyExecution/paymentCommandActions"].preparePaymentLifecycleExecution, CAPXUL_FUNCTIONS["moneyExecution/actions"].submitPaymentExecution, CAPXUL_FUNCTIONS["moneyExecution/actions"].submitPermissionExecution, CAPXUL_FUNCTIONS["moneyExecution/paymentCommandActions"].submitPaymentCommandExecution;
+	CAPXUL_FUNCTIONS["moneyExecution/actions"].abandonPaymentExecution, CAPXUL_FUNCTIONS["moneyExecution/actions"].prepareInvitationConfiguration, CAPXUL_FUNCTIONS["moneyExecution/actions"].preparePermissionExecution, CAPXUL_FUNCTIONS["moneyExecution/actions"].preparePaymentExecution, CAPXUL_FUNCTIONS["moneyExecution/paymentCommandActions"].prepareOrganizationPaymentExecution, CAPXUL_FUNCTIONS["moneyExecution/paymentCommandActions"].preparePaymentLifecycleExecution, CAPXUL_FUNCTIONS["moneyExecution/actions"].submitPaymentExecution, CAPXUL_FUNCTIONS["moneyExecution/actions"].submitInvitationConfigurationExecution, CAPXUL_FUNCTIONS["moneyExecution/actions"].submitPermissionExecution, CAPXUL_FUNCTIONS["moneyExecution/paymentCommandActions"].submitPaymentCommandExecution;
 	TaggedError("IndexerReadError");
 	Service()("@capxul/sdk/ports/IndexerReadPort");
 	//#endregion
@@ -74028,7 +74410,7 @@ ${SUCCESS}
 	CAPXUL_FUNCTIONS["smartAccount/queries"].loadByAuthUserId, CAPXUL_FUNCTIONS["smartAccount/queries"].loadBySmartAccountAddress, CAPXUL_FUNCTIONS["smartAccount/mutations"].provision, CAPXUL_FUNCTIONS["smartAccount/actions"].confirmDeployment, CAPXUL_FUNCTIONS["smartAccount/actions"].claim;
 	TaggedError("OrgError");
 	Service()("@capxul/sdk/ports/OrgPort");
-	CAPXUL_FUNCTIONS["org/queries"].listAll, CAPXUL_FUNCTIONS["org/queries"].listRolesByOrgId, CAPXUL_FUNCTIONS["org/queries"].listMembersByOrgId, CAPXUL_FUNCTIONS["org/actions"].readTreasury, CAPXUL_FUNCTIONS["org/actions"].inviteMember, CAPXUL_FUNCTIONS["org/mutations"].resendInviteToken, CAPXUL_FUNCTIONS["org/actions"].detectAndAcceptPendingInvitations;
+	CAPXUL_FUNCTIONS["org/queries"].listAll, CAPXUL_FUNCTIONS["org/queries"].listRolesByOrgId, CAPXUL_FUNCTIONS["org/queries"].listMembersByOrgId, CAPXUL_FUNCTIONS["org/actions"].readTreasury;
 	CAPXUL_FUNCTIONS["org/lifecycle"].startOrResume, CAPXUL_FUNCTIONS["org/actions"].prepareFounderAccount, CAPXUL_FUNCTIONS["org/actions"].prepareBootstrap, CAPXUL_FUNCTIONS["org/actions"].submitBootstrap, CAPXUL_FUNCTIONS["org/actions"].resumeBootstrapSubmission, CAPXUL_FUNCTIONS["org/actions"].confirmBootstrap, CAPXUL_FUNCTIONS["org/lifecycle"].recordFailure, CAPXUL_FUNCTIONS["org/lifecycle"].load, CAPXUL_FUNCTIONS["org/lifecycle"].retry;
 	//#endregion
 	//#region ../../packages/sdk/src/flows/identity.ts
@@ -74181,6 +74563,8 @@ ${SUCCESS}
 	CAPXUL_FUNCTIONS.media.generateUploadUrl, CAPXUL_FUNCTIONS.media.setProfileImage, CAPXUL_FUNCTIONS.media.setOrgLogo;
 	CAPXUL_FUNCTIONS.system.healthObserved;
 	CAPXUL_FUNCTIONS["org/queries"].me;
+	CAPXUL_FUNCTIONS["org/queries"].previewInvite, CAPXUL_FUNCTIONS["org/queries"].listMyInvitations, CAPXUL_FUNCTIONS["org/queries"].listInvitations, CAPXUL_FUNCTIONS["org/queries"].getInvitation, CAPXUL_FUNCTIONS["org/mutations"].invite, CAPXUL_FUNCTIONS["org/mutations"].accept, CAPXUL_FUNCTIONS["org/mutations"].decline, CAPXUL_FUNCTIONS["org/mutations"].cancel, CAPXUL_FUNCTIONS["org/mutations"].resend, CAPXUL_FUNCTIONS["org/mutations"].retry;
+	CAPXUL_OPERATIONS.org.invitations;
 	CAPXUL_FUNCTIONS["permission/queries"].read;
 	CAPXUL_FUNCTIONS["payroll/actions"].authorizeRun, CAPXUL_FUNCTIONS["payroll/queries"].runs, CAPXUL_FUNCTIONS["payroll/queries"].groups, CAPXUL_FUNCTIONS["payroll/queries"].terms, CAPXUL_FUNCTIONS["payroll/mutations"].saveGroup, CAPXUL_FUNCTIONS["payroll/mutations"].removeGroup;
 	CAPXUL_OPERATIONS.payroll.authorizeRun;
@@ -74241,16 +74625,28 @@ ${SUCCESS}
 	//#region browser/main.ts
 	const main = document.querySelector("main");
 	const title = document.querySelector("#title");
-	const lead = document.querySelector("#lead");
 	const account = document.querySelector("#account");
 	const environment = document.querySelector("#environment");
 	const status = document.querySelector("#status");
-	const show = (state, heading, message) => {
+	const dismiss = document.querySelector("#dismiss");
+	let shownMessage = "";
+	let failedStepShown = false;
+	const show = (state, heading, message = "", options) => {
 		main.setAttribute("data-state", state);
 		main.setAttribute("aria-busy", String(state === "working"));
 		title.textContent = heading;
 		status.textContent = message;
+		shownMessage = message;
+		dismiss.hidden = options?.dismiss !== true;
+		dismiss.textContent = "Close this page";
 	};
+	dismiss.addEventListener("click", () => {
+		window.close();
+		setTimeout(() => {
+			dismiss.textContent = "Close this tab manually";
+			status.textContent = `${shownMessage} This browser blocks scripted closing, so close the tab yourself.`;
+		}, 400);
+	});
 	const post = async (path, body, token) => {
 		const response = await fetch(path, {
 			method: "POST",
@@ -74279,6 +74675,7 @@ ${SUCCESS}
 		};
 	};
 	(async () => {
+		show("working", "Connecting to Capxul CLI");
 		const capability = new URLSearchParams(location.hash.slice(1)).get("cap");
 		history.replaceState(null, "", location.pathname);
 		if (capability === null) throw new Error("missing capability");
@@ -74324,33 +74721,47 @@ ${SUCCESS}
 			} }
 		});
 		try {
+			let idling = false;
+			let failed = false;
+			let produced = "none";
+			let terminalDelivered = false;
 			for (;;) {
 				const next = await message({ kind: "poll" });
 				if (next.action === "idle") {
+					if (!idling && !failed && !terminalDelivered) {
+						idling = true;
+						show("working", "Waiting for your terminal");
+					}
 					await wait(250);
 					continue;
 				}
+				idling = false;
 				if (next.action === "finish") {
-					show("ready", "Wallet session finished", "You can close this tab");
-					lead.textContent = "Your terminal has the result. This page is now inactive.";
 					await message({ kind: "finished" }).catch(() => void 0);
 					clearInterval(heartbeat);
 					removeEventListener("pagehide", disconnect);
+					if (failedStepShown) return;
+					show("ready", "Wallet session finished", "", { dismiss: true });
 					window.close();
 					return;
 				}
 				const requestId = next.requestId;
 				const requestEpoch = next.epoch;
 				if (typeof requestId !== "string" || typeof requestEpoch !== "string") throw new Error("invalid wallet request");
+				failed = false;
+				failedStepShown = false;
+				produced = "none";
+				terminalDelivered = false;
 				try {
 					if (next.action === "address") {
-						show("working", "Preparing your wallet", "Recovering the same Openfort signer");
+						show("working", "Preparing your wallet");
 						await message({
 							kind: "status",
 							stage: "recovering"
 						});
 						await signer.ensureWalletReady();
 						const address = await signer.getAddress();
+						produced = "address";
 						await settleDiagnostics(diagnosticWork);
 						await message({
 							kind: "address",
@@ -74358,7 +74769,8 @@ ${SUCCESS}
 							epoch: requestEpoch,
 							address
 						});
-						show("ready", "Wallet connected", "Continue in your terminal");
+						terminalDelivered = true;
+						show("ready", "Wallet connected");
 						await message({
 							kind: "status",
 							stage: "ready"
@@ -74366,12 +74778,13 @@ ${SUCCESS}
 						continue;
 					}
 					if (next.action === "sign" && typeof next.hash === "string") {
-						show("working", "Signing with your wallet", "Signing the validated Capxul operation");
+						show("working", "Signing with your wallet");
 						await message({
 							kind: "status",
 							stage: "signing"
 						});
 						const signature = await signer.signUserOpHash(next.hash);
+						produced = "signature";
 						await settleDiagnostics(diagnosticWork);
 						await message({
 							kind: "signature",
@@ -74379,7 +74792,8 @@ ${SUCCESS}
 							epoch: requestEpoch,
 							signature
 						});
-						show("ready", "Signature returned", "Continue in your terminal");
+						terminalDelivered = true;
+						show("ready", "Signature returned");
 						await message({
 							kind: "status",
 							stage: "returned"
@@ -74389,20 +74803,26 @@ ${SUCCESS}
 					throw new Error("unknown wallet action");
 				} catch {
 					await settleDiagnostics(diagnosticWork);
+					if (terminalDelivered) continue;
 					await message({
 						kind: "failure",
 						requestId,
 						epoch: requestEpoch
 					}).catch(() => void 0);
-					throw new Error("wallet operation failed");
+					failed = true;
+					failedStepShown = true;
+					if (produced === "signature") show("failed", "The signature did not reach the terminal", "Retry from your terminal.", { dismiss: true });
+					else if (produced === "address") show("failed", "The wallet step stopped before signing", "No signature was created. Retry from your terminal.", { dismiss: true });
+					else show("failed", "That wallet step did not finish", "Nothing was signed. Retry from your terminal.", { dismiss: true });
+					continue;
 				}
 			}
 		} finally {
 			clearInterval(heartbeat);
 		}
 	})().catch(() => {
-		show("failed", "Wallet connection ended", "Return to your terminal");
-		lead.textContent = "The terminal can retry this wallet step safely.";
+		if (failedStepShown) return;
+		show("failed", "Wallet connection ended", "Return to your terminal.", { dismiss: true });
 	});
 	//#endregion
 })();