@capxul/cli 4.20.0-beta.6 → 4.20.0-beta.8

package/dist/main.mjs

@@ -307,7 +307,7 @@ const privateTransition = (state, event) => {
 		}
 	}
 };
-const transition = (state, event, config = DEFAULT_CONFIG) => {
+const transition$1 = (state, event, config = DEFAULT_CONFIG) => {
 	if (isPrivate(event)) return privateTransition(state, event);
 	if (event._tag === "VerifyOtp" && !/^\d{6}$/.test(event.otp)) return { refused: "INVALID_INPUT" };
 	if (event._tag === "CreateOrganization" && event.draft.handle.trim() === "") return { refused: "INVALID_INPUT" };
@@ -2609,7 +2609,8 @@ const SETTLEMENT_ASSETS_BASE_SEPOLIA = Object.freeze({
 	CAPXUL_TEST_WETH: SYNTHETIC_TEST_ASSET_FIXTURES.weth
 });
 const CONFIGURED_MONEY_ASSETS = Object.freeze(Object.values(SETTLEMENT_ASSETS_BASE_SEPOLIA));
-Object.freeze({ BASE_SEPOLIA: Object.freeze({
+/** Public AssetIds for the admitted Base Sepolia test assets. */
+const TOKENS = Object.freeze({ BASE_SEPOLIA: Object.freeze({
 	CAPXUL_TEST_USDC: SETTLEMENT_ASSETS_BASE_SEPOLIA.CAPXUL_TEST_USDC.assetId,
 	CAPXUL_TEST_USDT: SETTLEMENT_ASSETS_BASE_SEPOLIA.CAPXUL_TEST_USDT.assetId,
 	CAPXUL_TEST_WETH: SETTLEMENT_ASSETS_BASE_SEPOLIA.CAPXUL_TEST_WETH.assetId
@@ -4173,11 +4174,11 @@ function encodePacked(types, values) {
 	for (let i = 0; i < types.length; i++) {
 		const type = types[i];
 		const value = values[i];
-		data.push(encode$2(type, value));
+		data.push(encode$3(type, value));
 	}
 	return concatHex(data);
 }
-function encode$2(type, value, isArray = false) {
+function encode$3(type, value, isArray = false) {
 	if (type === "address") {
 		const address = value;
 		if (!isAddress(address)) throw new InvalidAddressError({ address });
@@ -4211,7 +4212,7 @@ function encode$2(type, value, isArray = false) {
 	if (arrayMatch && Array.isArray(value)) {
 		const [_type, childType] = arrayMatch;
 		const data = [];
-		for (let i = 0; i < value.length; i++) data.push(encode$2(childType, value[i], true));
+		for (let i = 0; i < value.length; i++) data.push(encode$3(childType, value[i], true));
 		if (data.length === 0) return "0x";
 		return concatHex(data);
 	}
@@ -4258,6 +4259,28 @@ function getCreate2Address(opts) {
 //#region ../../packages/config/src/org-payments.ts
 /** Zodiac MultiSendCallOnly module on Base Sepolia. */
 const MULTI_SEND_CALL_ONLY = "0x9641d764fc13c8b624c04430c7356c1c7c8102e2";
+/** Supported Organization permission identities, newest first. */
+const ORG_PERMISSION_IDENTITY_PROFILES = [{
+	id: "zodiac-roles-2.1.1",
+	moduleFactoryRuntimeKeccak256: "0x01623cbcf010a1c326230f1b2d5f48a66b440232ee49096102bc84967dc5f21e",
+	mastercopy: "0xf2964ce6161ce0e75964fe7927ce114cb0b283d5",
+	mastercopyRuntimeKeccak256: "0x471d8b3b419f1eb955230c0326c8812176df49bf3c7b414a563fda5a3c6c10b6",
+	proxyRuntimeKeccak256: "0x248f9591f94c24c199ade3e73feb477cf02d387b2bea91f2f931a0deb094f163",
+	multiSendUnwrapper: "0xb4cd4bb764c089f20da18700ce8bc5e49f369efd",
+	multiSendUnwrapperRuntimeKeccak256: "0x1f6e088be5e6ef9d0fbe0547d3fa9a9e40d823433fd8a4449215b5663209a1eb"
+}, {
+	id: "zodiac-roles-2.1.0",
+	moduleFactoryRuntimeKeccak256: "0x01623cbcf010a1c326230f1b2d5f48a66b440232ee49096102bc84967dc5f21e",
+	mastercopy: "0x9646fdad06d3e24444381f44362a3b0eb343d337",
+	mastercopyRuntimeKeccak256: "0x87911cbc6aa0496e6bcb07dab2462b9c76daea130dede6dcc57d0adf307fa7ec",
+	proxyRuntimeKeccak256: "0x9d4059abf46db50e4b48d9b6404b1f200cb5a1efeb3725be2de630a2a9001944",
+	multiSendUnwrapper: "0x93b7fcbc63ed8a3a24b59e1c3e6649d50b7427c0",
+	multiSendUnwrapperRuntimeKeccak256: "0x4d8d8608b70a6e2f40726b9dd74406bbf73e90cac58e23ee953e2b45ad7dc3df"
+}];
+const CURRENT_ORG_PERMISSION_IDENTITY = ORG_PERMISSION_IDENTITY_PROFILES[0];
+ORG_PERMISSION_IDENTITY_PROFILES[1];
+CURRENT_ORG_PERMISSION_IDENTITY.mastercopy;
+CURRENT_ORG_PERMISSION_IDENTITY.multiSendUnwrapper;
 //#endregion
 //#region ../../packages/config/src/safe.ts
 const BASE_SEPOLIA_CHAIN_ID = 84532;
@@ -4480,14 +4503,6 @@ function deriveCapxulSafeAddressForOwner(input) {
 //#endregion
 //#region ../../packages/config/src/role-dsl.ts
 const ADMIN_ROLE_LABEL = "Admin";
-function normalizeOrgRoleLabel(label) {
-	const normalized = label.trim().replace(/\s+/g, " ");
-	if (normalized.length === 0) throw Errors.invalidInput("role.label", "must be a non-empty role label");
-	return normalized;
-}
-function orgRoleKeyForLabel(label) {
-	return keccak256(toBytes(normalizeOrgRoleLabel(label).toLowerCase()));
-}
 //#endregion
 //#region ../../packages/config/src/capxul-payments-v2.ts
 /** The exact compiled CapxulPaymentsV2 ABI. */
@@ -5159,6 +5174,44 @@ const ROLE_AUTHORITY_EVENT_BY_FUNCTION_SELECTOR = new Map([
 toEventSelector("AssignRoles(address,bytes32[],bool[])");
 new Set([...ROLE_AUTHORITY_EVENT_BY_FUNCTION_SELECTOR.values()].map((topic) => topic.toLowerCase()));
 //#endregion
+//#region ../../packages/sdk/src/domain/money/parse-money.ts
+const AMOUNT_PATTERN = /^(?:\d{1,3}(?:,\d{3})+|\d+)(?:\.\d+)?$/;
+const ZERO_PATTERN = /^0+(?:\.0+)?$/;
+/** Shared input grammar. Callers retain their own amount size limits. */
+function parseDecimalInput(input, decimals, maximumLength) {
+	if (!Number.isInteger(decimals) || decimals < 0) throw Errors.invalidInput("asset.decimals", "must be a non-negative integer");
+	const value = input.trim();
+	if (value.length === 0) return {
+		kind: "error",
+		reason: "required"
+	};
+	if (value.length > maximumLength) return {
+		kind: "error",
+		reason: "too-long"
+	};
+	const negative = value.startsWith("-");
+	const unsigned = negative ? value.slice(1) : value;
+	if (!AMOUNT_PATTERN.test(unsigned)) return {
+		kind: "error",
+		reason: "invalid-format"
+	};
+	if (negative) return {
+		kind: "error",
+		reason: "non-positive"
+	};
+	const normalized = unsigned.replaceAll(",", "");
+	const fraction = normalized.split(".")[1];
+	if (fraction !== void 0 && fraction.length > decimals) return {
+		kind: "error",
+		reason: "too-many-decimals"
+	};
+	if (ZERO_PATTERN.test(normalized)) return {
+		kind: "error",
+		reason: "non-positive"
+	};
+	return { value: normalized };
+}
+//#endregion
 //#region ../../packages/sdk/src/domain/money/asset-amount.ts
 /** Convert raw units without rounding or changing asset identity. */
 function assetAmountFromRaw(raw, asset) {
@@ -5174,6 +5227,14 @@ function toRaw(amount, asset) {
 	if (amount.asset !== asset.assetId) throw Errors.invalidInput("amount.asset", "must match the selected asset on its chain");
 	return decimalToRaw(amount.value, asset.decimals);
 }
+function parseAssetAmount(input, asset) {
+	validateMetadata(asset);
+	const parsed = parseDecimalInput(input, asset.decimals, 100);
+	return "kind" in parsed ? parsed : {
+		asset: asset.assetId,
+		value: parsed.value.replace(/^0+(?=\d)/, "")
+	};
+}
 function requireAsset(id) {
 	const asset = configuredMoneyAssetById(id);
 	if (asset === null) throw Errors.invalidInput("amount.asset", "is not a registered asset");
@@ -5564,10 +5625,12 @@ const CAPXUL_OPERATIONS = {
 		prepareOrganizationPaymentExecution: "moneyExecution.prepareOrganizationPaymentExecution",
 		preparePaymentExecution: "moneyExecution.preparePaymentExecution",
 		preparePaymentLifecycleExecution: "moneyExecution.preparePaymentLifecycleExecution",
+		prepareInvitationConfiguration: "moneyExecution.prepareInvitationConfiguration",
 		preparePermissionExecution: "moneyExecution.preparePermissionExecution",
 		recoverSubmissionClaims: "moneyExecution.recoverSubmissionClaims",
 		submit: "moneyExecution.submit",
 		submitPaymentCommandExecution: "moneyExecution.submitPaymentCommandExecution",
+		submitInvitationConfigurationExecution: "moneyExecution.submitInvitationConfigurationExecution",
 		submitPaymentExecution: "moneyExecution.submitPaymentExecution",
 		submitPermissionExecution: "moneyExecution.submitPermissionExecution"
 	},
@@ -5589,20 +5652,52 @@ const CAPXUL_OPERATIONS = {
 		completePerson: "onboarding.completePerson"
 	},
 	org: {
-		acceptInvitations: "org.acceptInvitations",
 		account: { get: "org.account.get" },
-		activateMember: "org.activateMember",
 		auditLog: "org.auditLog",
 		confirmBootstrap: "org.confirmBootstrap",
 		createOrg: "org.createOrg",
 		create: "org.create",
-		detectAndAcceptPendingInvitations: "org.detectAndAcceptPendingInvitations",
+		/**
+		* §11: the consent mutation reports `org_invite_accepted` through its own
+		* scheduled emitter. It is named for the emit, not the acceptance, because
+		* the interactive acceptance itself owns `org.invitations.accept`.
+		*/
+		emitInviteAccepted: "org.emitInviteAccepted",
 		emitInviteProgressed: "org.emitInviteProgressed",
 		expireInvitations: "org.expireInvitations",
 		getLifecycle: "org.getLifecycle",
 		getProofReceipt: "org.getProofReceipt",
 		invite: "org.invite",
-		inviteMember: "org.inviteMember",
+		/** D8 invitation lifecycle: preview, own list, read, and the four transitions. */
+		invitations: {
+			/** The exact grantee's consent commit (§8): one accepted digest, once. */
+			accept: "org.invitations.accept",
+			/**
+			* The authoring write. It is named `authorize`, not `invite`, because the
+			* backend already uses `org.invitations.invite` as a refusal label and
+			* `lint:telemetry-spine` refuses a label that collides with an operation.
+			*/
+			authorize: "org.invitations.authorize",
+			cancel: "org.invitations.cancel",
+			decline: "org.invitations.decline",
+			get: "org.invitations.get",
+			list: "org.invitations.list",
+			/**
+			* The Admin-scoped Organization list. It is named `listScoped`, not
+			* `list`, because the own-offer list already owns `org.invitations.list`.
+			*/
+			listScoped: "org.invitations.listScoped",
+			/**
+			* The authoring write's inner hops: the SDK drives the backend's existing
+			* prepare/submit pair, and these names label the two Convex calls. The
+			* owning `capxul_sdk_operation` record stays `org.invitations.authorize`.
+			*/
+			prepareConfiguration: "org.invitations.prepareConfiguration",
+			preview: "org.invitations.preview",
+			resend: "org.invitations.resend",
+			retry: "org.invitations.retry",
+			submitConfiguration: "org.invitations.submitConfiguration"
+		},
 		list: "org.list",
 		load: "org.load",
 		me: "org.me",
@@ -5661,7 +5756,6 @@ const CAPXUL_OPERATIONS = {
 		},
 		recordFailure: "org.recordFailure",
 		recordProgress: "org.recordProgress",
-		resendInviteToken: "org.resendInviteToken",
 		resumeBootstrapSubmission: "org.resumeBootstrapSubmission",
 		retry: "org.retry",
 		retrySetup: "org.retrySetup",
@@ -5678,7 +5772,6 @@ const CAPXUL_OPERATIONS = {
 		retry: "organizationPayments.retry"
 	},
 	organizationSetup: { getProofReceipt: "organizationSetup.getProofReceipt" },
-	organizations: { detectAndAcceptPendingInvitations: "orgs.detectAndAcceptPendingInvitations" },
 	payments: {
 		cancel: "payments.cancel",
 		claim: "payments.claim",
@@ -5716,6 +5809,7 @@ const CAPXUL_OPERATIONS = {
 		terms: "payroll.terms"
 	},
 	permission: {
+		verifyInvitationConfiguration: "permission.verifyInvitationConfiguration",
 		command: "permission.command",
 		retryVerification: "permission.retryVerification",
 		verify: "permission.verify",
@@ -6273,6 +6367,11 @@ const OrgCreateFailedProps = Schema.Struct({
 const OrgInviteSentProps = Schema.Struct({
 	...TelemetryEnvelopeProps,
 	org_id: OptionalOrgId,
+	invitation_id: OptionalString,
+	generation: OptionalString,
+	command_id: OptionalString,
+	subject_party_id: OptionalString,
+	persisted_at: OptionalEpochMs,
 	email_domain: OptionalString,
 	role: OptionalString,
 	status: OptionalString
@@ -6280,6 +6379,11 @@ const OrgInviteSentProps = Schema.Struct({
 const OrgInviteAcceptedProps = Schema.Struct({
 	...TelemetryEnvelopeProps,
 	org_id: OptionalOrgId,
+	invitation_id: OptionalString,
+	accepted_at: OptionalEpochMs,
+	generation: OptionalString,
+	command_id: OptionalString,
+	subject_party_id: OptionalString,
 	role: OptionalString,
 	status: OptionalString
 });
@@ -6287,6 +6391,7 @@ const OrgInviteExpiredProps = Schema.Struct({
 	...TelemetryEnvelopeProps,
 	org_id: OptionalOrgId,
 	email_domain: OptionalString,
+	invitation_id: OptionalString,
 	reason: OptionalString,
 	role: OptionalString,
 	status: OptionalString
@@ -6439,9 +6544,24 @@ const PermissionMirrorVerificationProps = Schema.Struct({
 		"applied",
 		"replayed",
 		"conflicting_replay",
-		"revision_mismatch"
+		"revision_mismatch",
+		"cleanup_required",
+		"not_applied",
+		"application_failure",
+		"mismatch",
+		"refused"
 	])),
+	command_kind: Schema.optional(Schema.Literals(["invitation_configuration", "invitation_eoa"])),
 	command_id: OptionalString,
+	invitation_id: OptionalString,
+	generation: OptionalString,
+	purpose: Schema.optional(Schema.Literals([
+		"configure",
+		"grant",
+		"disable",
+		"compensate"
+	])),
+	$insert_id: OptionalString,
 	/**
 	* #1961 R03. The authorized stored row names the Permission it changed; the
 	* verified receipt names the chain facts that prove it. Every field is
@@ -6828,6 +6948,13 @@ const CLI_COMMAND_NAMES = [
 	"auth.profile",
 	"auth.status",
 	"auth.logout",
+	"contact",
+	"contact.list",
+	"contact.get",
+	"contact.add",
+	"contact.label",
+	"contact.hide",
+	"contact.unhide",
 	"org",
 	CAPXUL_OPERATIONS.org.list,
 	"org.use",
@@ -6836,6 +6963,24 @@ const CLI_COMMAND_NAMES = [
 	CAPXUL_OPERATIONS.org.members,
 	"org.member",
 	"org.member.get",
+	"org.member.invite",
+	"org.contact",
+	"org.contact.list",
+	"org.contact.get",
+	"org.contact.add",
+	"org.contact.label",
+	"org.contact.hide",
+	"org.contact.unhide",
+	CAPXUL_OPERATIONS.org.invite,
+	"org.invite.list",
+	"org.invite.get",
+	"org.invite.wait",
+	"org.invite.review",
+	"org.invite.accept",
+	"org.invite.decline",
+	"org.invite.cancel",
+	"org.invite.resend",
+	"org.invite.retry",
 	"org.wait",
 	CAPXUL_OPERATIONS.org.create,
 	CAPXUL_OPERATIONS.org.retry,
@@ -6846,7 +6991,8 @@ const CLI_CAPABILITIES = [
 	"diagnostics",
 	"collection",
 	"authentication",
-	"organization"
+	"organization",
+	"contacts"
 ];
 const CLI_INVOCATION_KINDS = [
 	"command",
@@ -7090,6 +7236,7 @@ const TELEMETRY_EVENT_SCHEMAS = {
 			...TelemetryEnvelopeProps,
 			organization_id: OrgIdTelemetrySchema,
 			progress: Schema.Literals([
+				"configuration_authorized",
 				"account_ready",
 				"permission_applied",
 				"membership_activated",
@@ -7097,6 +7244,9 @@ const TELEMETRY_EVENT_SCHEMAS = {
 			]),
 			/** The invited Party. The initiating actor stays on the envelope's identity. */
 			member_party_id: Schema.String,
+			invitation_id: Schema.optional(Schema.String),
+			generation: Schema.optional(Schema.String),
+			command_id: Schema.optional(Schema.String),
 			occurred_at: Schema.Number
 		})
 	}),
@@ -7800,8 +7950,10 @@ const CAPXUL_FUNCTIONS = {
 	"movement/annotations": { overlay: "movement/annotations:overlay" },
 	"moneyExecution/actions": {
 		abandonPaymentExecution: "moneyExecution/actions:abandonPaymentExecution",
+		prepareInvitationConfiguration: "moneyExecution/actions:prepareInvitationConfiguration",
 		preparePermissionExecution: "moneyExecution/actions:preparePermissionExecution",
 		preparePaymentExecution: "moneyExecution/actions:preparePaymentExecution",
+		submitInvitationConfigurationExecution: "moneyExecution/actions:submitInvitationConfigurationExecution",
 		submitPermissionExecution: "moneyExecution/actions:submitPermissionExecution",
 		submitPaymentExecution: "moneyExecution/actions:submitPaymentExecution"
 	},
@@ -7818,8 +7970,6 @@ const CAPXUL_FUNCTIONS = {
 	},
 	"org/actions": {
 		confirmBootstrap: "org/actions:confirmBootstrap",
-		detectAndAcceptPendingInvitations: "org/actions:detectAndAcceptPendingInvitations",
-		inviteMember: "org/actions:inviteMember",
 		prepareBootstrap: "org/actions:prepareBootstrap",
 		prepareFounderAccount: "org/actions:prepareFounderAccount",
 		readTreasury: "org/actions:readTreasury",
@@ -7850,16 +8000,25 @@ const CAPXUL_FUNCTIONS = {
 		startOrResume: "org/lifecycle:startOrResume"
 	},
 	"org/mutations": {
+		accept: "org/mutations:accept",
+		cancel: "org/mutations:cancel",
 		createOrg: "org/mutations:createOrg",
-		resendInviteToken: "org/mutations:resendInviteToken"
+		decline: "org/mutations:decline",
+		invite: "org/mutations:invite",
+		resend: "org/mutations:resend",
+		retry: "org/mutations:retry"
 	},
 	"org/queries": {
+		getInvitation: "org/queries:getInvitation",
 		listAll: "org/queries:listAll",
+		listInvitations: "org/queries:listInvitations",
 		listMembersByOrgId: "org/queries:listMembersByOrgId",
 		listMine: "org/queries:listMine",
+		listMyInvitations: "org/queries:listMyInvitations",
 		listRolesByOrgId: "org/queries:listRolesByOrgId",
 		loadByOrgId: "org/queries:loadByOrgId",
-		me: "org/queries:me"
+		me: "org/queries:me",
+		previewInvite: "org/queries:previewInvite"
 	},
 	"smartAccount/actions": {
 		claim: "smartAccount/actions:claim",
@@ -8819,6 +8978,94 @@ const EventRefSchema = Schema.Struct({
 	topic0: Bytes32Schema,
 	dataHash: Bytes32Schema
 });
+const InvitationEoaReceiptSchema = Schema.Struct({
+	kind: Schema.Literal("invitation_eoa"),
+	chainId: BaseSepoliaChainIdSchema,
+	transactionHash: TxHashSchema,
+	blockNumber: BlockNumberSchema,
+	blockHash: Bytes32Schema,
+	sender: AddressSchema,
+	nonce: Schema.String.pipe(Schema.refine((value) => /^(0|[1-9][0-9]*)$/.test(value)))
+});
+const PermissionReceiptRefSchema = Schema.Union([Schema.Struct({
+	kind: Schema.Literal("user_operation"),
+	...ReceiptRefSchema.fields
+}), InvitationEoaReceiptSchema]);
+const PermissionEventRefSchema = Schema.Struct({
+	receipt: PermissionReceiptRefSchema,
+	emitter: AddressSchema,
+	transactionIndex: LogIndexSchema,
+	logIndex: LogIndexSchema,
+	topic0: Bytes32Schema,
+	dataHash: Bytes32Schema
+});
+Schema.Union([
+	Schema.Struct({
+		status: Schema.Literal("pending"),
+		reason: Schema.Literal("receipt_missing")
+	}),
+	Schema.Struct({
+		status: Schema.Literal("provider_failure"),
+		retryable: Schema.Literal(true)
+	}),
+	Schema.Struct({
+		status: Schema.Literal("mismatch"),
+		code: Schema.Literals([
+			"wrong_chain",
+			"wrong_sender",
+			"wrong_transaction",
+			"failed_transaction",
+			"non_canonical_block",
+			"wrong_contract_identity",
+			"missing_event",
+			"extra_authority_event",
+			"wrong_fact_tuple",
+			"wrong_state",
+			"conflicting_replay"
+		]),
+		attemptTransactionHash: Schema.optional(TxHashSchema),
+		receipt: Schema.optional(InvitationEoaReceiptSchema)
+	}),
+	Schema.Struct({
+		status: Schema.Literal("verified"),
+		commandId: PaymentCommandIdSchema,
+		receipt: InvitationEoaReceiptSchema,
+		events: Schema.Array(PermissionEventRefSchema),
+		factsHash: Bytes32Schema
+	})
+]);
+/**
+* One stored `setAllowance` call inside a command's expected authority set.
+*
+* The pinned Roles module emits `SetAllowance` as *post-state*, not as the call
+* arguments: `maxRefill = 0` becomes `type(uint128).max`, and `timestamp = 0`
+* becomes the receipt block's timestamp. A hash over the call arguments can
+* therefore never match that receipt. `index` names the entry in
+* `expectedAuthorityEvents` the call produced, and `data` is the call's own
+* calldata, so the verifier can rebuild the one hash the module actually emits.
+* The rule is pinned by `test:invitation-conformance`.
+*/
+const AllowanceExpectationSchema = Schema.Struct({
+	index: nonNegativeInteger("index"),
+	data: Schema.String.pipe(Schema.refine((value) => /^0x[0-9a-fA-F]+$/u.test(value), { message: "data must be 0x-prefixed hex" }))
+});
+Schema.Struct({
+	commandId: PaymentCommandIdSchema,
+	userOpHash: Bytes32Schema,
+	generationHash: Bytes32Schema,
+	chainId: BaseSepoliaChainIdSchema,
+	organizationSafe: SafeAddressSchema,
+	rolesModule: ModuleAddressSchema,
+	userOpSenderSafe: SafeAddressSchema,
+	expectedAuthorityEvents: Schema.Array(Bytes32Schema),
+	/**
+	* Absent means "no normalization": every expected hash is compared as stored.
+	* A command whose set contains `setAllowance` then refuses (`wrong_fact_tuple`)
+	* rather than passing on a weakened proof, so an incomplete caller fails
+	* closed.
+	*/
+	allowanceExpectations: Schema.optional(Schema.Array(AllowanceExpectationSchema))
+});
 const PermissionOperationSchema = Schema.Literals([
 	"create",
 	"change",
@@ -8862,7 +9109,9 @@ const StoredPermissionCommandSchema = Schema.Struct({
 });
 Schema.Struct({
 	command: StoredPermissionCommandSchema,
-	userOpHash: Bytes32Schema
+	userOpHash: Bytes32Schema,
+	/** The stored `setAllowance` calls of this command's own expectation. */
+	allowanceExpectations: Schema.optional(Schema.Array(AllowanceExpectationSchema))
 });
 Schema.Union([
 	Schema.Struct({
@@ -9706,6 +9955,27 @@ Schema.Struct({
 	digest: Bytes32Schema,
 	value: PermissionResourceSchema
 });
+Schema.Struct({
+	commandId: PaymentCommandIdSchema,
+	signerAddress: AddressSchema
+});
+Schema.Struct({
+	executionId: MoneyExecutionIdSchema,
+	commandId: PaymentCommandIdSchema,
+	orgId: nonEmpty("orgId"),
+	invitationId: nonEmpty("invitationId"),
+	generationHash: Bytes32Schema,
+	chainId: BaseSepoliaChainIdSchema,
+	signerAddress: AddressSchema,
+	userOpSenderSafe: SafeAddressSchema,
+	digest: Bytes32Schema
+});
+Schema.Struct({
+	status: Schema.Literal("submitted"),
+	executionId: MoneyExecutionIdSchema,
+	commandId: PaymentCommandIdSchema,
+	userOpHash: Bytes32Schema
+});
 Schema.Struct({
 	status: Schema.Literal("submitted"),
 	executionId: MoneyExecutionIdSchema,
@@ -10279,6 +10549,160 @@ const CurrentPolicySchema = Schema.Union([Schema.Struct({
 		actions: Schema.NonEmptyArray(Schema.Literals(["pay", "commitments"]))
 	})
 }), Schema.Struct({ type: Schema.Literal("managePeople") })]);
+const BudgetIntentSchema = CurrentPolicySchema.pipe(Schema.refine((value) => {
+	if (value.type !== "budget") return false;
+	const { actions, recipients } = value.scope;
+	if (new Set(actions).size !== actions.length) return false;
+	return recipients.type === "anyone" || recipients.accounts.length >= 1 && recipients.accounts.length <= 32 && new Set(recipients.accounts).size === recipients.accounts.length;
+}));
+const InvitationIdSchema = Schema.NonEmptyString;
+const InvitationTargetSchema = Schema.Struct({ invitationId: InvitationIdSchema });
+Schema.Struct({
+	...InvitationTargetSchema.fields,
+	expectedOfferDigest: Bytes32Schema
+});
+/** The requested grantee of one invitation. */
+const GranteeRefSchema = Schema.Union([Schema.Struct({
+	type: Schema.Literal("email"),
+	email: Schema.NonEmptyString
+}), Schema.Struct({
+	type: Schema.Literal("account"),
+	accountId: AccountIdSchema
+})]);
+Schema.Struct({
+	requestKey: Schema.String.pipe(Schema.refine((value) => /^[\x20-\x7e]{1,128}$/.test(value))),
+	to: GranteeRefSchema,
+	grants: Schema.Array(Schema.Union([
+		Schema.Struct({
+			type: Schema.Literal("budget"),
+			budgetId: PermissionIdSchema
+		}),
+		Schema.Struct({
+			type: Schema.Literal("managePeople"),
+			permissionId: PermissionIdSchema
+		}),
+		Schema.Struct({
+			type: Schema.Literal("new_budget"),
+			label: Schema.String.pipe(Schema.refine((value) => value.trim().length >= 1 && value.trim().length <= 128)),
+			intent: BudgetIntentSchema
+		})
+	]))
+}).pipe(Schema.refine((value) => {
+	if (value.grants.length < 1 || value.grants.length > 16) return false;
+	const existing = value.grants.flatMap((grant) => grant.type === "new_budget" ? [] : [grant.type === "budget" ? grant.budgetId : grant.permissionId]);
+	return new Set(existing).size === existing.length && value.grants.filter((grant) => grant.type === "new_budget").length <= 4;
+}));
+const InvitationPhaseSchema = Schema.Literals([
+	"authorizing",
+	"pending",
+	"pending_grant",
+	"active",
+	"revoking",
+	"declined",
+	"cancelled",
+	"expired",
+	"revoked"
+]);
+const EndingReasonSchema = Schema.Literals([
+	"declined",
+	"cancelled",
+	"expired",
+	"revoked"
+]);
+const OfferedAuthoritySchema = Schema.Union([Schema.Struct({
+	type: Schema.Literal("budget"),
+	budgetId: Schema.NonEmptyString.pipe(Schema.refine((value) => value.length > 0)),
+	label: Schema.String,
+	policy: BudgetIntentSchema,
+	policyDigest: Bytes32Schema
+}), Schema.Struct({
+	type: Schema.Literal("managePeople"),
+	permissionId: PermissionIdSchema,
+	label: Schema.String
+})]);
+const NewBudgetOfferSchema = Schema.Struct({
+	type: Schema.Literal("new_budget"),
+	label: Schema.String,
+	policy: BudgetIntentSchema,
+	policyDigest: Bytes32Schema
+});
+const PreviewGranteeSchema = Schema.Struct({
+	partyId: Schema.NullOr(PartyIdSchema),
+	accountId: Schema.NullOr(AccountIdSchema),
+	safeAddress: AddressSchema,
+	accountReady: Schema.NullOr(Schema.Boolean)
+});
+Schema.Struct({
+	orgId: Schema.NonEmptyString.pipe(Schema.refine((value) => value.length > 0)),
+	grantee: PreviewGranteeSchema,
+	grants: Schema.Array(Schema.Union([OfferedAuthoritySchema, NewBudgetOfferSchema])),
+	existingAssignments: Schema.Array(PermissionAssignmentIdSchema),
+	includesManagement: Schema.Boolean,
+	observedAt: EpochMsSchema
+});
+Schema.Struct({
+	cursor: Schema.optional(Schema.NonEmptyString),
+	limit: Schema.optional(Schema.Number.pipe(Schema.refine((value) => Number.isSafeInteger(value) && value >= 1 && value <= 100))),
+	phases: Schema.optional(Schema.Array(InvitationPhaseSchema).pipe(Schema.refine((value) => new Set(value).size === value.length)))
+});
+const InvitationRecoverySchema = Schema.Struct({
+	actor: Schema.Literals([
+		"system",
+		"invitee",
+		"admin"
+	]),
+	action: Schema.Literals([
+		"wait",
+		"retry",
+		"review_offer",
+		"reauthorize"
+	]),
+	reason: Schema.Literals([
+		"configuration_pending",
+		"grant_pending",
+		"provider_unavailable",
+		"policy_changed",
+		"cleanup_pending",
+		"signer_unavailable"
+	])
+});
+const InvitationViewSchema = Schema.Struct({
+	id: InvitationIdSchema,
+	orgId: Schema.NonEmptyString.pipe(Schema.refine((value) => value.length > 0)),
+	organizationName: Schema.String,
+	grantee: Schema.Struct({
+		partyId: PartyIdSchema,
+		accountId: Schema.NullOr(AccountIdSchema),
+		safeAddress: AddressSchema,
+		accountReady: Schema.NullOr(Schema.Boolean)
+	}),
+	phase: InvitationPhaseSchema,
+	grants: Schema.Array(Schema.Union([Schema.Struct({
+		type: Schema.Literal("budget"),
+		budgetId: Schema.NonEmptyString.pipe(Schema.refine((value) => value.length > 0))
+	}), Schema.Struct({
+		type: Schema.Literal("managePeople"),
+		permissionId: PermissionIdSchema
+	})])),
+	offers: Schema.Array(OfferedAuthoritySchema),
+	recovery: Schema.NullOr(InvitationRecoverySchema),
+	offerDigest: Bytes32Schema,
+	authorizedAt: Schema.NullOr(EpochMsSchema),
+	acceptedAt: Schema.NullOr(EpochMsSchema),
+	expiresAt: Schema.NullOr(EpochMsSchema),
+	commandId: Schema.NullOr(PaymentCommandIdSchema),
+	endingReason: Schema.NullOr(EndingReasonSchema),
+	delivery: Schema.Literals([
+		"not_confirmed",
+		"sent",
+		"failed"
+	])
+});
+Schema.Struct({
+	items: Schema.Array(InvitationViewSchema),
+	nextCursor: Schema.NullOr(Schema.NonEmptyString),
+	observedAt: EpochMsSchema
+});
 const ActiveBudgetSchema = Schema.Struct({
 	id: PermissionIdSchema,
 	label: Schema.String,
@@ -10577,6 +11001,18 @@ function withInvocationParentSpan(effect, controls) {
 	const parent = controls?.[INVOCATION_PARENT_SPAN];
 	return parent === void 0 ? effect : effect.pipe(Effect.withParentSpan(parent));
 }
+/**
+* The input field a refused request named.
+*
+* The surfaces that call the port directly already carry `details.field` for an
+* `INVALID_INPUT` refusal. The actor keeps that one allowlisted detail instead of
+* dropping it, so a caller sees the same refusal either way.
+*/
+const refusedInputField = (failure) => {
+	if (failure.code !== "INVALID_INPUT") return void 0;
+	const field = failure.error?.details?.field;
+	return typeof field === "string" && field.length > 0 ? { field } : void 0;
+};
 var ActorFailure = class extends Error {
 	reason;
 	machine;
@@ -10742,7 +11178,7 @@ const boot = (spec, options = {}) => Effect.gen(function* () {
 				const event = { _tag: env.origin.event };
 				const failedState = exit.failure === timeoutFailure || exit.failure === cancelledFailure ? yield* recoverFailure(state, env.origin, exit.failure) : state;
 				yield* emit(nonApplied(failedState, event, exit.failure.code, outcome, env, exit.failure));
-				const details = exit.failure === timeoutFailure ? { reason: "timeout" } : void 0;
+				const details = exit.failure === timeoutFailure ? { reason: "timeout" } : refusedInputField(exit.failure);
 				yield* failReply(held.reply, makeFailure(failedState, event, exit.failure.code, details, exit.failure.error ?? exit.failure));
 				return;
 			}
@@ -12214,11 +12650,13 @@ const financialOpsContract = {
 //#region ../../packages/sdk/src/contract/money-execution.ts
 const moneyExecutionContract = {
 	abandonPaymentExecution: makeFunctionReference(CAPXUL_FUNCTIONS["moneyExecution/actions"].abandonPaymentExecution),
+	prepareInvitationConfiguration: makeFunctionReference(CAPXUL_FUNCTIONS["moneyExecution/actions"].prepareInvitationConfiguration),
 	preparePermissionExecution: makeFunctionReference(CAPXUL_FUNCTIONS["moneyExecution/actions"].preparePermissionExecution),
 	preparePaymentExecution: makeFunctionReference(CAPXUL_FUNCTIONS["moneyExecution/actions"].preparePaymentExecution),
 	prepareOrganizationPaymentExecution: makeFunctionReference(CAPXUL_FUNCTIONS["moneyExecution/paymentCommandActions"].prepareOrganizationPaymentExecution),
 	preparePaymentLifecycleExecution: makeFunctionReference(CAPXUL_FUNCTIONS["moneyExecution/paymentCommandActions"].preparePaymentLifecycleExecution),
 	submitPaymentExecution: makeFunctionReference(CAPXUL_FUNCTIONS["moneyExecution/actions"].submitPaymentExecution),
+	submitInvitationConfigurationExecution: makeFunctionReference(CAPXUL_FUNCTIONS["moneyExecution/actions"].submitInvitationConfigurationExecution),
 	submitPermissionExecution: makeFunctionReference(CAPXUL_FUNCTIONS["moneyExecution/actions"].submitPermissionExecution),
 	submitPaymentCommandExecution: makeFunctionReference(CAPXUL_FUNCTIONS["moneyExecution/paymentCommandActions"].submitPaymentCommandExecution)
 };
@@ -12799,7 +13237,7 @@ function subscribeActivity(deps, actor, controls, onChange) {
 }
 //#endregion
 //#region ../../packages/sdk/package.json
-var version$1 = "4.20.0-beta.6";
+var version$1 = "4.20.0-beta.8";
 //#endregion
 //#region ../../packages/sdk/src/telemetry/exception-projection.ts
 /** Fixed fallback for failures that have no safe message. */
@@ -13635,7 +14073,7 @@ function isMoneyTelemetryDebugEnabled() {
 }
 //#endregion
 //#region ../../packages/sdk/src/surface/payment-command-execution.ts
-function isAborted$2(signal) {
+function isAborted$3(signal) {
 	return signal?.aborted === true;
 }
 function canonicalJson(value) {
@@ -13661,7 +14099,7 @@ async function abandonPrepared$1(deps, executionId, closePayment, reason, result
 	return result;
 }
 async function executePrepared(deps, prepare, isExpectedRequest, closePaymentOnExit, onPreparedClosed, signal, controls) {
-	if (isAborted$2(signal)) return {
+	if (isAborted$3(signal)) return {
 		ok: false,
 		error: Errors.cancelled({ operation: "payments" })
 	};
@@ -13690,7 +14128,7 @@ async function executePrepared(deps, prepare, isExpectedRequest, closePaymentOnE
 		ok: false,
 		error: Errors.invalidInput("payment", "prepared authority mismatch")
 	}, onPreparedClosed, controls);
-	if (isAborted$2(signal)) return abandonPrepared$1(deps, prepared.value.executionId, closePaymentOnExit, "cancelled", {
+	if (isAborted$3(signal)) return abandonPrepared$1(deps, prepared.value.executionId, closePaymentOnExit, "cancelled", {
 		ok: false,
 		error: Errors.cancelled({ operation: "payments" })
 	}, onPreparedClosed, controls);
@@ -13716,7 +14154,7 @@ async function executePrepared(deps, prepare, isExpectedRequest, closePaymentOnE
 			error: signerFailure(deps.signer.source, "signUserOpHash", cause)
 		}, onPreparedClosed, controls);
 	}
-	if (isAborted$2(signal)) return abandonPrepared$1(deps, prepared.value.executionId, closePaymentOnExit, "cancelled", {
+	if (isAborted$3(signal)) return abandonPrepared$1(deps, prepared.value.executionId, closePaymentOnExit, "cancelled", {
 		ok: false,
 		error: Errors.cancelled({ operation: "payments" })
 	}, onPreparedClosed, controls);
@@ -13751,7 +14189,7 @@ function cancelled(operation) {
 		error: Errors.cancelled({ operation })
 	};
 }
-function isAborted$1(signal) {
+function isAborted$2(signal) {
 	return signal?.aborted === true;
 }
 async function signerCall(source, operation, run) {
@@ -13777,7 +14215,7 @@ async function abandonPrepared(deps, executionId, reason, result, onPreparedClos
 	return result;
 }
 async function executePersonalPayment(deps, payment, signal, requestKey, onPreparedClosed) {
-	if (isAborted$1(signal)) return cancelled(CAPXUL_OPERATIONS.payments.pay);
+	if (isAborted$2(signal)) return cancelled(CAPXUL_OPERATIONS.payments.pay);
 	if (deps.signer === void 0) return mismatch("signer", "payments.pay requires a configured CapxulSigner");
 	const session = deps.actor.authSession();
 	if (session === null) return {
@@ -13805,10 +14243,10 @@ async function executePersonalPayment(deps, payment, signal, requestKey, onPrepa
 		executionId: prepared.value.executionId,
 		recipient: prepared.value.recipientObservation
 	});
-	if (isAborted$1(signal)) return abandonPrepared(deps, prepared.value.executionId, "cancelled", cancelled(CAPXUL_OPERATIONS.payments.pay), onPreparedClosed);
+	if (isAborted$2(signal)) return abandonPrepared(deps, prepared.value.executionId, "cancelled", cancelled(CAPXUL_OPERATIONS.payments.pay), onPreparedClosed);
 	const signature = await signerCall(deps.signer.source, "signUserOpHash", () => deps.signer.signUserOpHash(prepared.value.digest));
 	if (!signature.ok) return abandonPrepared(deps, prepared.value.executionId, "signer_rejected", signature, onPreparedClosed);
-	if (isAborted$1(signal)) return abandonPrepared(deps, prepared.value.executionId, "cancelled", cancelled(CAPXUL_OPERATIONS.payments.pay), onPreparedClosed);
+	if (isAborted$2(signal)) return abandonPrepared(deps, prepared.value.executionId, "cancelled", cancelled(CAPXUL_OPERATIONS.payments.pay), onPreparedClosed);
 	return runIfActive(void 0, CAPXUL_OPERATIONS.payments.submitExecution, () => deps.convexCall.action(deps.functions.submitPaymentExecution, { input: {
 		executionId: prepared.value.executionId,
 		signature: signature.value
@@ -24661,7 +25099,7 @@ function toFormData$1(obj, formData, options) {
 *
 * @returns {string} The encoded string.
 */
-function encode$1(str) {
+function encode$2(str) {
 	const charMap = {
 		"!": "%21",
 		"'": "%27",
@@ -24692,8 +25130,8 @@ prototype.append = function append(name, value) {
 };
 prototype.toString = function toString(encoder) {
 	const _encode = encoder ? function(value) {
-		return encoder.call(this, value, encode$1);
-	} : encode$1;
+		return encoder.call(this, value, encode$2);
+	} : encode$2;
 	return this._pairs.map(function each(pair) {
 		return _encode(pair[0]) + "=" + _encode(pair[1]);
 	}, "").join("&");
@@ -24708,7 +25146,7 @@ prototype.toString = function toString(encoder) {
 *
 * @returns {string} The encoded value.
 */
-function encode(val) {
+function encode$1(val) {
 	return encodeURIComponent(val).replace(/%3A/gi, ":").replace(/%24/g, "$").replace(/%2C/gi, ",").replace(/%20/g, "+");
 }
 /**
@@ -24722,7 +25160,7 @@ function encode(val) {
 */
 function buildURL(url, params, options) {
 	if (!params) return url;
-	const _encode = options && options.encode || encode;
+	const _encode = options && options.encode || encode$1;
 	const _options = utils_default.isFunction(options) ? { serialize: options } : options;
 	const serializeFn = _options && _options.serialize;
 	let serializedParams;
@@ -40603,6 +41041,7 @@ function mapBetterAuthError(operation, body) {
 		const code = typeof errBody.code === "string" ? errBody.code : "";
 		if (code === "OTP_EXPIRED") return Errors.otpExpired();
 		if (code === "INVALID_OTP") return Errors.invalidInput("otp", errBody.message ?? "invalid OTP");
+		if (code === "TOO_MANY_ATTEMPTS") return Errors.rateLimited({ resource: "better-auth/verifyOtp" });
 		if (code === "VALIDATION_ERROR" || code === "INVALID_EMAIL") return Errors.invalidInput("email", errBody.message ?? "invalid email");
 	}
 	return Errors.providerError("better-auth", operation, new Error(String(body)));
@@ -41220,6 +41659,10 @@ var BetterAuthNodeAdapter = class {
 						ok: false,
 						error: Errors.invalidInput("otp", errBody.message ?? "invalid OTP")
 					};
+					if (errBody.code === "TOO_MANY_ATTEMPTS") return {
+						ok: false,
+						error: Errors.rateLimited({ resource: "better-auth/verifyOtp" })
+					};
 				}
 			}
 			return {
@@ -44732,6 +45175,12 @@ const stderrConvexLogger = {
 	error: writeConvexDiagnostic,
 	logVerbose: () => void 0
 };
+const silentConvexLogger = {
+	log: () => void 0,
+	warn: () => void 0,
+	error: () => void 0,
+	logVerbose: () => void 0
+};
 /** Exact floor-first allowlist; every additional handler must migrate its validator first. */
 const OBSERVED_CONVEX_ACTIONS = /* @__PURE__ */ new Set([
 	"system:healthObserved",
@@ -44803,7 +45252,9 @@ const OBSERVED_CONVEX_MUTATIONS = /* @__PURE__ */ new Set([
 	"smartAccount/mutations:provision",
 	"org/lifecycle:startOrResume",
 	"org/lifecycle:recordFailure",
-	"org/lifecycle:retry"
+	"org/lifecycle:retry",
+	"org/mutations:invite",
+	"org/mutations:accept"
 ]);
 var ConvexCallAdapter = class {
 	#client;
@@ -44818,7 +45269,7 @@ var ConvexCallAdapter = class {
 		const webSocketConstructor = this.#connectionMonitor.observedWebSocketConstructor();
 		this.#client = deps.client ?? new ConvexClient(deps.convexUrl, {
 			...webSocketConstructor === void 0 ? {} : { webSocketConstructor },
-			...deps.logToStderr === true ? { logger: stderrConvexLogger } : {}
+			logger: deps.localDiagnostics === true ? stderrConvexLogger : silentConvexLogger
 		});
 		this.#tokenProvider = deps.tokenProvider;
 		this.#applicationId = deps.applicationId;
@@ -45476,10 +45927,7 @@ const DEFAULT_FUNCTIONS$1 = {
 	listAll: makeFunctionReference(CAPXUL_FUNCTIONS["org/queries"].listAll),
 	listRoles: makeFunctionReference(CAPXUL_FUNCTIONS["org/queries"].listRolesByOrgId),
 	listMembers: makeFunctionReference(CAPXUL_FUNCTIONS["org/queries"].listMembersByOrgId),
-	readTreasury: makeFunctionReference(CAPXUL_FUNCTIONS["org/actions"].readTreasury),
-	inviteMember: makeFunctionReference(CAPXUL_FUNCTIONS["org/actions"].inviteMember),
-	resendInvite: makeFunctionReference(CAPXUL_FUNCTIONS["org/mutations"].resendInviteToken),
-	detectInvitations: makeFunctionReference(CAPXUL_FUNCTIONS["org/actions"].detectAndAcceptPendingInvitations)
+	readTreasury: makeFunctionReference(CAPXUL_FUNCTIONS["org/actions"].readTreasury)
 };
 /**
 * Standard production Organization read adapter. It intentionally has no
@@ -45515,22 +45963,6 @@ var ConvexOrganizationAdapter = class {
 	pendingMembers(input) {
 		return this.listMembers(input).pipe(Effect.map((members) => members.filter((member) => member.status === "pending" || member.status === "pending_safe" || member.status === "pending_grant")));
 	}
-	inviteMember(input) {
-		return this.#convex.action(this.#fns.inviteMember, copyInvocationObservation(input, {
-			orgId: input.orgId,
-			email: input.input.email,
-			role: input.input.role
-		})).pipe(Effect.mapError((error) => orgErrorFromCapxul("inviteMember", error.publicError, error)), Effect.map(brandOrgMember), Effect.catchDefect((cause) => Effect.fail(toOrgError("inviteMember", cause))));
-	}
-	resendInviteToken(input) {
-		return this.#convex.mutation(this.#fns.resendInvite, {
-			orgId: input.orgId,
-			email: input.email
-		}).pipe(Effect.mapError((error) => orgErrorFromCapxul("resendInviteToken", error.publicError, error)), Effect.map(brandOrgMember), Effect.catchDefect((cause) => Effect.fail(toOrgError("resendInviteToken", cause))));
-	}
-	detectAndAcceptPendingInvitations(_input) {
-		return this.#convex.action(this.#fns.detectInvitations, {}).pipe(Effect.mapError((error) => orgErrorFromCapxul("detectAndAcceptPendingInvitations", error.publicError, error)), Effect.map((result) => ({ matched: result.matched.map(toOrgId) })), Effect.catchDefect((cause) => Effect.fail(toOrgError("detectAndAcceptPendingInvitations", cause))));
-	}
 	#readTreasuryWire(input) {
 		const orgId = String(input.orgId);
 		return retryIdempotentRead(this.#convex.action(this.#fns.readTreasury, copyInvocationObservation(input, { orgId })), CAPXUL_OPERATIONS.org.treasury, this.#telemetry, input).pipe(Effect.mapError((error) => orgErrorFromCapxul("readTreasury", error.publicError, error)), Effect.map((wire) => {
@@ -45575,11 +46007,12 @@ var ConvexOrganizationSetupAdapter = class {
 	#fns;
 	constructor(input) {
 		this.#convex = input.convex;
-		this.#signer = input.signer;
+		this.#signer = input.signer ?? null;
 		this.#chainId = input.chainId;
 		this.#fns = input.functions ?? DEFAULT_FUNCTIONS;
 	}
 	async startOrResume(input) {
+		if (this.#signer === null) return fail$2(Errors.capabilityUnavailable("signer", "startOrResume"));
 		const result = await runCall("startOrResume", this.#convex.mutation(this.#fns.startOrResume, copyInvocationObservation(input, {
 			...input,
 			chainId: this.#chainId
@@ -45607,7 +46040,9 @@ var ConvexOrganizationSetupAdapter = class {
 	async authorizeAndSubmitBootstrap(input) {
 		const cancelled = cancellation(input.signal);
 		if (cancelled !== void 0) return cancelled;
-		const signerAddress = await signerResult(this.#signer.source, "getAddress", () => this.#signer.getAddress());
+		const signer = this.#signer;
+		if (signer === null) return fail$2(Errors.capabilityUnavailable("signer", "authorizeAndSubmitBootstrap"));
+		const signerAddress = await signerResult(signer.source, "getAddress", () => signer.getAddress());
 		if (!signerAddress.ok) return signerAddress;
 		const prepared = await runCall("prepareBootstrap", this.#convex.action(this.#fns.prepareBootstrap, copyInvocationObservation(input, {
 			orgId: input.orgId,
@@ -45619,7 +46054,7 @@ var ConvexOrganizationSetupAdapter = class {
 		if (!authority.ok) return authority;
 		const cancelledAfterPrepare = cancellation(input.signal);
 		if (cancelledAfterPrepare !== void 0) return cancelledAfterPrepare;
-		const signature = await signerResult(this.#signer.source, "signUserOpHash", () => this.#signer.signUserOpHash(prepared.value.digest));
+		const signature = await signerResult(signer.source, "signUserOpHash", () => signer.signUserOpHash(prepared.value.digest));
 		if (!signature.ok) return signature;
 		const cancelledAfterSign = cancellation(input.signal);
 		if (cancelledAfterSign !== void 0) return cancelledAfterSign;
@@ -45675,7 +46110,8 @@ var ConvexOrganizationSetupAdapter = class {
 			...input.observationContext === void 0 ? {} : { observationContext: input.observationContext }
 		});
 		if (!current.ok) return current;
-		if (current.value.status === "failed" && current.value.retryable && (current.value.at === "awaitingFounderAuthorization" || current.value.at === "submittingBootstrap")) {
+		if (current.value.status === "failed" && current.value.retryable && current.value.at === "awaitingFounderAuthorization") {
+			if (this.#signer === null) return fail$2(Errors.capabilityUnavailable("signer", "retry"));
 			const reset = resetSignerSession(this.#signer);
 			if (!reset.ok) return reset;
 		}
@@ -46338,7 +46774,7 @@ const identitySpec = (input, sessionStore = { current: null }) => {
 		initial: RESTORING,
 		label,
 		slot: identitySlot,
-		transition: (state, event) => transition(state, event, config),
+		transition: (state, event) => transition$1(state, event, config),
 		recoverFailure: recoverIdentityFailure,
 		invalidates: (event) => event._tag === "Reset" ? [
 			IDENTITY_SLOT.auth,
@@ -47723,6 +48159,271 @@ function makeOrgMeMethod(deps, orgId) {
 	};
 }
 //#endregion
+//#region ../../packages/sdk/src/contract/invitations.ts
+const invitationContract = {
+	preview: makeFunctionReference(CAPXUL_FUNCTIONS["org/queries"].previewInvite),
+	listMine: makeFunctionReference(CAPXUL_FUNCTIONS["org/queries"].listMyInvitations),
+	listScoped: makeFunctionReference(CAPXUL_FUNCTIONS["org/queries"].listInvitations),
+	get: makeFunctionReference(CAPXUL_FUNCTIONS["org/queries"].getInvitation),
+	invite: makeFunctionReference(CAPXUL_FUNCTIONS["org/mutations"].invite),
+	accept: makeFunctionReference(CAPXUL_FUNCTIONS["org/mutations"].accept),
+	decline: makeFunctionReference(CAPXUL_FUNCTIONS["org/mutations"].decline),
+	cancel: makeFunctionReference(CAPXUL_FUNCTIONS["org/mutations"].cancel),
+	resend: makeFunctionReference(CAPXUL_FUNCTIONS["org/mutations"].resend),
+	retry: makeFunctionReference(CAPXUL_FUNCTIONS["org/mutations"].retry)
+};
+//#endregion
+//#region ../../packages/sdk/src/surface/invitations.ts
+/**
+* The one refusal a scoped invitation result that names another Organization
+* receives, whether it was read or returned by the authoring write.
+*/
+function scopeRefusal(orgId) {
+	return Errors.invalidInput("orgId", `The invitation result does not belong to Organization ${JSON.stringify(orgId)}.`);
+}
+/**
+* A scoped invitation result belongs to the Organization it was read under.
+*
+* One owner holds the refusal copy and the verified-scope span: a single view
+* reports whether it names the scope, and a page — which names no Organization
+* of its own — reports whether every row does. A result that does not belong is
+* refused here rather than handed to a consumer, so a future route change
+* cannot turn into a silent cross-Organization read on a caller that trusted
+* the scope it passed. A successful scoped read also marks the verifying
+* Organization on the owning span, exactly as `org.me` does — the caller's
+* scope hint is not authority, the completed scoped read is.
+*/
+function verifyScope(orgId, value, belongsToScope) {
+	if (!belongsToScope(value)) return Effect.fail(scopeRefusal(orgId));
+	return Effect.annotateCurrentSpan({
+		verified_organization_id: orgId,
+		scope_kind: "organization"
+	}).pipe(Effect.as(value));
+}
+/** One view names its own Organization. */
+const namesScope = (orgId) => (value) => String(value.orgId) === orgId;
+/** A page names no Organization of its own, so every row must name the scope. */
+const rowsNameScope = (orgId) => (page) => page.items.every((item) => String(item.orgId) === orgId);
+const ops = CAPXUL_OPERATIONS.org.invitations;
+/** Truth for a caller-owned signal, without narrowing its type. */
+function isAborted$1(signal) {
+	return signal?.aborted === true;
+}
+/**
+* One observed operation around one Convex hop, exactly like `org.me`. The
+* call-start invocation snapshot rides the arguments, so the backend continues
+* the attempt this call started rather than resolving a new one.
+*/
+function observed$1(deps, operation, options, args, call, check) {
+	const controls = deps.invocationControls?.(options) ?? options;
+	return runCapxulEffect(call(copyInvocationObservation(controls, args)).pipe(Effect.mapError((failure) => failure.publicError), Effect.flatMap((value) => check === void 0 ? Effect.succeed(value) : check(value))), controls, operation, deps.runPromise);
+}
+/**
+* The Admin's preview stays a read: it reaches the preview query and nothing
+* else. It reads current policies and live assignments, so the operator sees
+* what the offered authority is now, not a frozen copy.
+*/
+function makeOrgInvitationMethods(deps, orgId) {
+	const scopeCheck = (value) => verifyScope(orgId, value, namesScope(orgId));
+	return {
+		preview: (input, options) => observed$1(deps, ops.preview, options, {
+			orgId,
+			request: input
+		}, (args) => deps.convexCall.query(invitationContract.preview, args), scopeCheck),
+		invite: makeInviteMethod(deps, orgId),
+		accept: (input, options) => observed$1(deps, ops.accept, options, {
+			orgId,
+			invitationId: input.invitationId,
+			expectedOfferDigest: input.expectedOfferDigest
+		}, (args) => deps.convexCall.mutation(invitationContract.accept, args), scopeCheck),
+		list: (input, options) => observed$1(deps, ops.listScoped, options, {
+			orgId,
+			...pageArgs(input)
+		}, (args) => deps.convexCall.query(invitationContract.listScoped, args), (page) => verifyScope(orgId, page, rowsNameScope(orgId))),
+		get: (input, options) => observed$1(deps, ops.get, options, {
+			orgId,
+			invitationId: input.invitationId
+		}, (args) => deps.convexCall.query(invitationContract.get, args), scopeCheck),
+		decline: (input, options) => observed$1(deps, ops.decline, options, {
+			orgId,
+			invitationId: input.invitationId
+		}, (args) => deps.convexCall.mutation(invitationContract.decline, args), scopeCheck),
+		cancel: (input, options) => observed$1(deps, ops.cancel, options, {
+			orgId,
+			invitationId: input.invitationId
+		}, (args) => deps.convexCall.mutation(invitationContract.cancel, args), scopeCheck),
+		resend: (input, options) => observed$1(deps, ops.resend, options, {
+			orgId,
+			invitationId: input.invitationId
+		}, (args) => deps.convexCall.mutation(invitationContract.resend, args), scopeCheck),
+		retry: (input, options) => observed$1(deps, ops.retry, options, {
+			orgId,
+			invitationId: input.invitationId
+		}, (args) => deps.convexCall.mutation(invitationContract.retry, args), scopeCheck)
+	};
+}
+/**
+* The authoring write, including its configuration hop.
+*
+* The mutation persists the invitation and its configure command before any
+* signature exists. The write then drives the existing human configuration
+* owner exactly as the Permission and payment surfaces drive theirs: prepare
+* the stored command for this Account's Safe, check the prepared authority
+* against the request, deliver the durable identity to the caller, sign the
+* returned digest, and submit it. The backend keeps the only authorization
+* rule (`prepareInvitationConfigurationIntentInTx` /
+* `submitInvitationConfigurationExecution`); this edge adds no second one.
+*
+* Cancellation owns the whole compound: an abort before the digest is signed
+* stops the write and forwards no signature, and an already-signed submission
+* completes.
+*/
+async function executeInvite(deps, orgId, input, signal, controls, verifiedOrganization, onPrepared) {
+	if (isAborted$1(signal)) return {
+		ok: false,
+		error: Errors.cancelled({ operation: ops.authorize })
+	};
+	if (deps.actor === void 0 || deps.chainId === void 0 || deps.signer === void 0) return {
+		ok: false,
+		error: Errors.notImplemented("invitations", "executionComposition")
+	};
+	const session = deps.actor.authSession();
+	if (session === null) return {
+		ok: false,
+		error: Errors.notAuthenticated()
+	};
+	const authored = await runIfActive(signal, ops.authorize, () => withInvocationParentSpan(Effect.suspend(() => deps.convexCall.mutation(invitationContract.invite, copyInvocationObservation(controls, {
+		orgId,
+		request: input
+	}))), controls), deps.runPromise);
+	if (!authored.ok) return authored;
+	const view = authored.value;
+	if (String(view.orgId) !== orgId) return {
+		ok: false,
+		error: scopeRefusal(orgId)
+	};
+	if (view.phase !== "authorizing") return {
+		ok: true,
+		value: view
+	};
+	if (view.commandId === null) return {
+		ok: false,
+		error: Errors.invalidInput("invitationId", "The invitation does not name its configuration command.")
+	};
+	const commandId = view.commandId;
+	let signerAddress;
+	try {
+		signerAddress = await deps.signer.getAddress();
+	} catch (cause) {
+		return {
+			ok: false,
+			error: signerFailure(deps.signer.source, "getAddress", cause)
+		};
+	}
+	const prepared = await runIfActive(signal, ops.prepareConfiguration, () => withInvocationParentSpan(Effect.suspend(() => deps.convexCall.action(moneyExecutionContract.prepareInvitationConfiguration, copyInvocationObservation(controls, { input: {
+		commandId,
+		signerAddress
+	} }))), controls), deps.runPromise);
+	if (!prepared.ok) return prepared;
+	const expectedSafe = deriveCapxulSafeAddress({ email: session.email });
+	if (!preparedAuthorityMatches({
+		prepared: prepared.value,
+		chainId: deps.chainId,
+		signerAddress,
+		expectedSafe,
+		commandId,
+		invitationId: view.id,
+		orgId
+	})) return {
+		ok: false,
+		error: Errors.invalidInput("invitation", "prepared authority mismatch")
+	};
+	verifiedOrganization(prepared.value.orgId);
+	if (isAborted$1(signal)) return {
+		ok: false,
+		error: Errors.cancelled({ operation: ops.authorize })
+	};
+	if (onPrepared !== void 0) try {
+		await onPrepared({
+			invitationId: prepared.value.invitationId,
+			commandId: prepared.value.commandId
+		});
+	} catch (cause) {
+		return {
+			ok: false,
+			error: cause instanceof CapxulError ? cause : Errors.unknown(cause)
+		};
+	}
+	if (isAborted$1(signal)) return {
+		ok: false,
+		error: Errors.cancelled({ operation: ops.authorize })
+	};
+	let signature;
+	try {
+		signature = await deps.signer.signUserOpHash(prepared.value.digest);
+	} catch (cause) {
+		return {
+			ok: false,
+			error: signerFailure(deps.signer.source, "signUserOpHash", cause)
+		};
+	}
+	if (isAborted$1(signal)) return {
+		ok: false,
+		error: Errors.cancelled({ operation: ops.authorize })
+	};
+	const submitted = await runIfActive(void 0, ops.submitConfiguration, () => withInvocationParentSpan(Effect.suspend(() => deps.convexCall.action(moneyExecutionContract.submitInvitationConfigurationExecution, copyInvocationObservation(controls, { input: {
+		executionId: prepared.value.executionId,
+		signature
+	} }))), controls), deps.runPromise);
+	if (!submitted.ok) return submitted;
+	return {
+		ok: true,
+		value: view
+	};
+}
+/**
+* The prepared authority must be exactly the one this write asked for: the same
+* chain, the caller's signer, this Account's Safe, and the exact command and
+* invitation the authoring view named.
+*/
+function preparedAuthorityMatches(input) {
+	return input.prepared.chainId === input.chainId && input.prepared.signerAddress.toLowerCase() === input.signerAddress.toLowerCase() && input.prepared.userOpSenderSafe.toLowerCase() === input.expectedSafe.toLowerCase() && input.prepared.commandId === input.commandId && input.prepared.invitationId === input.invitationId && input.prepared.orgId === input.orgId;
+}
+function makeInviteMethod(deps, orgId) {
+	return (input, options) => {
+		const { onPrepared, ...supplied } = options ?? {};
+		const controls = deps.invocationControls?.(supplied) ?? supplied;
+		let verifiedOrganizationId;
+		return runCapxulEffect(Effect.gen(function* () {
+			if (controls?.signal?.aborted === true) return yield* Effect.fail(Errors.cancelled({ operation: ops.authorize }));
+			const parent = yield* Effect.currentSpan.pipe(Effect.orDie);
+			const captured = carryInvocationParentSpan(controls, parent);
+			const result = yield* Effect.tryPromise({
+				try: () => executeInvite(deps, orgId, input, controls?.signal, captured, (id) => {
+					verifiedOrganizationId = id;
+				}, onPrepared),
+				catch: (cause) => cause instanceof CapxulError ? cause : Errors.unknown(cause)
+			});
+			return yield* result.ok ? Effect.succeed(result.value) : Effect.fail(result.error);
+		}).pipe(Effect.ensuring(Effect.suspend(() => verifiedOrganizationId === void 0 ? Effect.void : Effect.annotateCurrentSpan({
+			verified_organization_id: verifiedOrganizationId,
+			scope_kind: "organization"
+		})).pipe(Effect.catchCause(() => Effect.void)))), observationOnlyControls(controls), ops.authorize, deps.runPromise);
+	};
+}
+/** Drop the page fields the caller did not supply; a bounded page sends only its bounds. */
+function pageArgs(input) {
+	if (input === void 0) return {};
+	return {
+		...input.cursor === void 0 ? {} : { cursor: input.cursor },
+		...input.limit === void 0 ? {} : { limit: input.limit },
+		...input.phases === void 0 ? {} : { phases: input.phases }
+	};
+}
+function makeOwnInvitationsMethod(deps) {
+	return (input, options) => observed$1(deps, ops.list, options, pageArgs(input), (args) => deps.convexCall.query(invitationContract.listMine, args));
+}
+//#endregion
 //#region ../../packages/sdk/src/contract/permission.ts
 const permissionContract = { read: makeFunctionReference(CAPXUL_FUNCTIONS["permission/queries"].read) };
 //#endregion
@@ -48410,20 +49111,6 @@ function hermeticOrgView(input) {
 		observedAt: 0
 	};
 }
-function hermeticMember(input) {
-	return {
-		orgId: input.orgId,
-		accountId: null,
-		email: toEmail(input.email),
-		name: null,
-		personalSafeAddress: input.personalSafeAddress ?? null,
-		role: input.role,
-		roleKey: toRoleKey(orgRoleKeyForLabel(input.role)),
-		status: input.status,
-		grantTxHash: input.grantTxHash ?? null,
-		revokeTxHash: input.revokeTxHash ?? null
-	};
-}
 function createOrgProgram(input) {
 	return Effect.gen(function* () {
 		const deps = yield* OrgDepsTag;
@@ -48524,35 +49211,6 @@ function listMembersProgram(orgId) {
 		return [];
 	});
 }
-/**
-* R06 (#1964): the SDK no longer emits `org_invite_sent`. The backend action
-* that writes the invitation is its ONE producer, so a hermetic call — which
-* writes nothing — can no longer report an invitation that never happened, and
-* a live call is counted once instead of twice. The captured attempt rides the
-* port input, so the durable event carries the correlation this call ran under.
-*/
-function inviteMemberProgram(orgId, input) {
-	return Effect.gen(function* () {
-		const deps = yield* OrgDepsTag;
-		if (deps.orgPort === void 0) return hermeticMember({
-			orgId,
-			email: input.email,
-			role: input.role,
-			status: "pending"
-		});
-		return yield* deps.orgPort.inviteMember(copyInvocationObservation(deps.invocationSource, {
-			orgId,
-			input
-		})).pipe(Effect.mapError((error) => error.publicError));
-	});
-}
-function detectAndAcceptPendingInvitationsProgram() {
-	return Effect.gen(function* () {
-		const deps = yield* OrgDepsTag;
-		if (deps.orgPort !== void 0) return yield* deps.orgPort.detectAndAcceptPendingInvitations({}).pipe(Effect.mapError((error) => error.publicError));
-		return { matched: [] };
-	});
-}
 function listOrgsProgram() {
 	return Effect.gen(function* () {
 		const deps = yield* OrgDepsTag;
@@ -48658,6 +49316,20 @@ function observedRunnerDeps(deps) {
 		...deps.invocationControls === void 0 ? {} : { invocationControls: deps.invocationControls }
 	};
 }
+/**
+* The invitation edge needs the call seam, the observed-runner pair, and — for
+* the authoring write's configuration hop — the same execution composition the
+* Permission, payment, and payroll bundles receive.
+*/
+function invitationMethodsDeps(deps, convexCall) {
+	return {
+		convexCall,
+		...observedRunnerDeps(deps),
+		...deps.actor === void 0 ? {} : { actor: deps.actor },
+		...deps.chainId === void 0 ? {} : { chainId: Number(deps.chainId) },
+		...deps.signer === void 0 ? {} : { signer: deps.signer }
+	};
+}
 function makeOrgMethods(deps) {
 	const orgDeps = {
 		...deps.orgPort === void 0 ? {} : { orgPort: deps.orgPort },
@@ -48689,13 +49361,10 @@ function makeOrgMethods(deps) {
 			});
 			return toCapxulResult(createOrgProgram(input), layer);
 		},
-		orgs: Object.assign((options) => listOrganizations(deps.invocationControls?.(options) ?? options), { detectAndAcceptPendingInvitations(options) {
-			if (options?.signal?.aborted) return Promise.resolve({
-				ok: false,
-				error: Errors.cancelled({ operation: CAPXUL_OPERATIONS.organizations.detectAndAcceptPendingInvitations })
-			});
-			return toCapxulResult(detectAndAcceptPendingInvitationsProgram(), layer);
-		} }),
+		orgs: Object.assign((options) => listOrganizations(deps.invocationControls?.(options) ?? options), { invitations: deps.convexCall === void 0 ? () => Promise.resolve({
+			ok: false,
+			error: Errors.notImplemented("invitations", "listOwn")
+		}) : makeOwnInvitationsMethod(invitationMethodsDeps(deps, deps.convexCall)) }),
 		org(orgId) {
 			const convexCall = deps.convexCall;
 			return {
@@ -48803,17 +49472,7 @@ function makeOrgMethods(deps) {
 					});
 					return toCapxulResult(listRolesProgram(orgId), layer);
 				},
-				invite(_input, _options) {
-					const controls = deps.invocationControls?.(_options) ?? _options;
-					if (controls?.signal?.aborted) return Promise.resolve({
-						ok: false,
-						error: Errors.cancelled({ operation: CAPXUL_OPERATIONS.org.invite })
-					});
-					return runCapxulEffect(inviteMemberProgram(orgId, _input).pipe(Effect.provide(orgDepsLayer({
-						...orgDeps,
-						...controls === void 0 ? {} : { invocationSource: controls }
-					}))), controls, CAPXUL_OPERATIONS.org.invite, deps.runPromise);
-				},
+				invitations: convexCall === void 0 ? makeNotImplementedInvitationMethods() : makeOrgInvitationMethods(invitationMethodsDeps(deps, convexCall), String(orgId)),
 				auditLog(_options) {
 					if (_options?.signal?.aborted) return Promise.resolve({
 						ok: false,
@@ -48876,6 +49535,28 @@ const orgMeUnavailable = () => Promise.resolve({
 	ok: false,
 	error: Errors.notImplemented("org", "me")
 });
+/**
+* The closed invitation surface for a client with no backend seam. It reports
+* `NOT_IMPLEMENTED` for every method rather than an empty list or a fabricated
+* view: an absent composition root is not an absent invitation.
+*/
+function makeNotImplementedInvitationMethods() {
+	return {
+		preview: invitationExecutionUnavailable,
+		invite: invitationExecutionUnavailable,
+		accept: invitationExecutionUnavailable,
+		list: invitationExecutionUnavailable,
+		get: invitationExecutionUnavailable,
+		decline: invitationExecutionUnavailable,
+		cancel: invitationExecutionUnavailable,
+		resend: invitationExecutionUnavailable,
+		retry: invitationExecutionUnavailable
+	};
+}
+const invitationExecutionUnavailable = () => Promise.resolve({
+	ok: false,
+	error: Errors.notImplemented("invitations", "executionComposition")
+});
 const permissionExecutionUnavailable = () => Promise.resolve({
 	ok: false,
 	error: Errors.notImplemented("permissions", "executionComposition")
@@ -49375,7 +50056,6 @@ function assembleCapxulClient(input) {
 	};
 	if (input.signal !== void 0) input.signal.addEventListener("abort", () => void stopActor(), { once: true });
 	const selectedOrgPort = input.orgPort ?? input.orgDeploymentPort;
-	let detectPendingOrgInvitations;
 	let kickProvisioning;
 	const financialOps = makeFinancialOpsMethods({
 		runPromise: effectRunner.runPromise,
@@ -49424,7 +50104,6 @@ function assembleCapxulClient(input) {
 				if (browserSigner.statusStore?.status() === "unknown" && typeof browserSigner.ensureWalletReady === "function") browserSigner.ensureWalletReady().catch(() => {});
 			}
 			if (accountSetup === "explicit") return;
-			await detectPendingOrgInvitations?.();
 			kickProvisioning?.();
 		}
 	});
@@ -49492,9 +50171,6 @@ function assembleCapxulClient(input) {
 		...input.signer === void 0 ? {} : { signer: input.signer },
 		...input.organizationSetup === void 0 ? {} : { organizationSetup: input.organizationSetup }
 	});
-	if (selectedOrgPort !== void 0) detectPendingOrgInvitations = async () => {
-		await orgMethods.orgs.detectAndAcceptPendingInvitations();
-	};
 	const currentUser = makeCurrentUserMethods({
 		me: financialOps.me,
 		accounts,
@@ -50387,7 +51063,7 @@ function productionAuthCacheLayer(input) {
 function productionConvexCallLayer(input, refreshConvexAuthRef) {
 	return Layer.unwrap(Effect.map(AuthClientPortTag, (authClient) => ConvexCallLayer({
 		convexUrl: input.runtimeUrls.convexUrl,
-		logToStderr: input.runtime === "node",
+		localDiagnostics: input.localDiagnostics,
 		...input.applicationId === void 0 ? {} : { applicationId: input.applicationId },
 		...input.observation === void 0 ? {} : { observation: input.observation },
 		...input.convexClient === void 0 ? {} : { client: input.convexClient },
@@ -50426,6 +51102,7 @@ function resolveProductionObservability(input) {
 	};
 }
 async function createProductionAdapters(input) {
+	const localDiagnostics = productionLocalDiagnostics(input);
 	const { observation, telemetry, invocationObservation, invocationTelemetry } = resolveProductionObservability(input);
 	const resolvedInput = resolveInput(input);
 	if (!resolvedInput.ok) return resolvedInput;
@@ -50496,6 +51173,7 @@ async function createProductionAdapters(input) {
 		const portsLayer = mergeProductionAdapterLayers(makeProductionAdapterLayerEntries({
 			bootstrap,
 			runtime: resolvedInput.value.runtime,
+			localDiagnostics,
 			...resolvedInput.value.origin === void 0 ? {} : { origin: resolvedInput.value.origin },
 			runtimeUrls: runtimeUrls.value,
 			chainId: bootstrapResult.value.chainId,
@@ -50510,7 +51188,7 @@ async function createProductionAdapters(input) {
 			...input.signal === void 0 ? {} : { signal: input.signal },
 			...input.resetSignerSession === void 0 ? {} : { resetSignerSession: input.resetSignerSession }
 		}));
-		const applicationLayer = Layer.merge(portsLayer, optionalEngineeringTelemetryLayer(bootstrapResult.value.engineeringTelemetry, resolvedInput.value.runtime, hostEngineeringPolicy(input.observability))).pipe(Layer.provideMerge(resolvedInput.value.runtime === "node" ? Layer.succeed(Logger.LogToStderr, true) : Layer.empty));
+		const applicationLayer = Layer.merge(portsLayer, optionalEngineeringTelemetryLayer(bootstrapResult.value.engineeringTelemetry, resolvedInput.value.runtime, hostEngineeringPolicy(input.observability))).pipe(Layer.provideMerge(localDiagnosticsLayer(localDiagnostics, resolvedInput.value.runtime)));
 		const context = await Effect.runPromise(Layer.buildWithScope(applicationLayer, scope));
 		const collected = await Effect.runPromise(collectProductionFlowPorts.pipe(Effect.provide(context)));
 		const indexerUrl = input.indexerUrl ?? bootstrapResult.value.indexerUrl;
@@ -50574,6 +51252,13 @@ function optionalEngineeringTelemetryLayer(policy, runtime, hostPolicy) {
 		return Layer.empty;
 	}
 }
+function localDiagnosticsLayer(enabled, runtime) {
+	if (!enabled) return Logger.layer([]);
+	return runtime === "node" ? Layer.succeed(Logger.LogToStderr, true) : Layer.empty;
+}
+function productionLocalDiagnostics(input) {
+	return input.localDiagnostics !== false;
+}
 function refreshConvexAuthOnSession(authClient, refresh) {
 	return {
 		...authClient,
@@ -50638,7 +51323,7 @@ async function createCapxulClientWithSignerControls(input, controls) {
 			runtime,
 			authBaseUrl: resolvedAuthBaseUrl,
 			createBrowserSigner: createOpenfortBrowserSignerFromBootstrap,
-			diagnostic: new EffectLogDiagnosticAdapter(adapters.value.context, new ConsoleDiagnosticAdapter()),
+			diagnostic: new EffectLogDiagnosticAdapter(adapters.value.context, productionLocalDiagnostics(input) ? new ConsoleDiagnosticAdapter() : void 0),
 			signer: input.signer,
 			factory: input.openfortSignerFactory,
 			finalSign: controls.signUserOpHash,
@@ -50667,11 +51352,11 @@ async function createCapxulClientWithSignerControls(input, controls) {
 			accountSetup: input.accountSetup,
 			...signer === void 0 ? {} : { signer },
 			orgPort: Context.get(adapters.value.context, OrgPortTag),
-			...signer === void 0 ? {} : { organizationSetup: new ConvexOrganizationSetupAdapter({
+			organizationSetup: new ConvexOrganizationSetupAdapter({
 				convex: adapters.value.ports.convexCall,
-				signer,
+				...signer === void 0 ? {} : { signer },
 				chainId: adapters.value.bootstrap.chainId
-			}) },
+			}),
 			...input.signal === void 0 ? {} : { signal: input.signal },
 			...input.otpTtlMs === void 0 ? {} : { otpTtlMs: input.otpTtlMs },
 			invokeTimeoutMs: input.invokeTimeoutMs ?? 3e4,
@@ -51010,8 +51695,8 @@ function captureException(telemetry, error, context) {
 }
 //#endregion
 //#region src/version.ts
-const cliVersion = "4.20.0-beta.6";
-const sdkVersion = "4.20.0-beta.6";
+const cliVersion = "4.20.0-beta.8";
+const sdkVersion = "4.20.0-beta.8";
 const ReleaseVersion = Schema.String.check(Schema.isMaxLength(256), Schema.isPattern(/^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)(?:-((?:0|[1-9]\d*|\d*[a-zA-Z-][0-9a-zA-Z-]*)(?:\.(?:0|[1-9]\d*|\d*[a-zA-Z-][0-9a-zA-Z-]*))*))?(?:\+[0-9a-zA-Z-]+(?:\.[0-9a-zA-Z-]+)*)?$/u)).pipe(Schema.brand("CliReleaseVersion"));
 const parts = (version) => {
 	const [core = "", ...prerelease] = version.split("+")[0].split("-");
@@ -51540,7 +52225,7 @@ const finishUpdateCheck = Effect.fn(function* (directory, attempt, target) {
 });
 //#endregion
 //#region src/platform/collection-policy.ts
-const decode$2 = Schema.decodeUnknownOption(Schema.fromJsonString(Settings), { onExcessProperty: "error" });
+const decode$3 = Schema.decodeUnknownOption(Schema.fromJsonString(Settings), { onExcessProperty: "error" });
 const missing = (error) => error instanceof Error && "code" in error && error.code === "ENOENT";
 const resolveProtectedDirectory = (directory, uid) => {
 	const stateDirectory = lstatSync(directory, { throwIfNoEntry: false });
@@ -51584,7 +52269,7 @@ const collectionPolicy = (settingsPath, forcedDisabled) => () => {
 			length += count;
 		}
 		if (length > 65536) return false;
-		const settings = decode$2(bytes.toString("utf8", 0, length));
+		const settings = decode$3(bytes.toString("utf8", 0, length));
 		return Option.isSome(settings) && settings.value.collection.enabled;
 	} catch {
 		return false;
@@ -51605,9 +52290,31 @@ var CliFailure = class extends Data.TaggedError("CliFailure") {};
 */
 const WRONG_STATE_MESSAGE = "The command cannot run from the current state.";
 const ORGANIZATION_WRONG_STATE_MESSAGE = "The Organization cannot run this command from its current state. Resume that exact Organization with capxul org retry --org instead of creating a replacement.";
+const PERSONAL_ACCOUNT_WRONG_STATE_MESSAGE = "The personal Account cannot run this command from its current state. Resume the same Account and Profile with capxul auth signup instead of creating a replacement.";
 const INPUT_MESSAGE = "The input was refused. Check the email and verification code, or request a new code.";
+const PROFILE_INPUT_MESSAGE = "The Profile input was refused. Correct the display name, country, or handle, then run capxul auth signup again.";
+const HANDLE_INPUT_MESSAGE = "That handle is not available. Choose another handle, then run capxul auth signup again.";
 const organizationCommand = (command) => command === "org" || command?.startsWith("org.") === true;
 /**
+* The authentication journey family. A Profile or personal Account refusal is
+* not an email or verification-code problem, so it never reuses OTP copy.
+*/
+const authCommand = (command) => command === "auth" || command?.startsWith("auth.") === true;
+/** The Profile fields a personal signup states. */
+const PROFILE_FIELDS = /* @__PURE__ */ new Set([
+	"profile",
+	"displayName",
+	"country",
+	"countryCode",
+	"handle"
+]);
+const authInputMessage = (error) => {
+	const field = typeof error.details?.field === "string" ? error.details.field : "";
+	if (field === "handle") return HANDLE_INPUT_MESSAGE;
+	if (PROFILE_FIELDS.has(field)) return PROFILE_INPUT_MESSAGE;
+	return INPUT_MESSAGE;
+};
+/**
 * The one allowlist. Only a WRONG_STATE whose SDK details carry an Organization
 * ID the public constructor accepts emits that ID, and it never enters message
 * text or valid states. No other error detail reaches terminal output, and a
@@ -51657,7 +52364,7 @@ function classifyFailure(cause, command) {
 		const details = allowlistedDetails(error);
 		return {
 			code: error.code,
-			message: auth ? "Authentication is required." : denied ? "This action is not permitted." : wrongState ? organizationCommand(command) ? ORGANIZATION_WRONG_STATE_MESSAGE : WRONG_STATE_MESSAGE : input ? INPUT_MESSAGE : "The Capxul request failed.",
+			message: auth ? "Authentication is required." : denied ? "This action is not permitted." : wrongState ? organizationCommand(command) ? ORGANIZATION_WRONG_STATE_MESSAGE : authCommand(command) ? PERSONAL_ACCOUNT_WRONG_STATE_MESSAGE : WRONG_STATE_MESSAGE : input ? authCommand(command) ? authInputMessage(error) : INPUT_MESSAGE : "The Capxul request failed.",
 			exitCode: auth ? 3 : denied ? 4 : input || wrongState ? 2 : 5,
 			outcome: auth || denied || input || wrongState ? "refused" : "failed",
 			...details === void 0 ? {} : { details }
@@ -52238,9 +52945,17 @@ const boundedLine = (value) => typeof value === "number" && Number.isSafeInteger
 const writeStdout = (text) => Effect.flatMap(Stdio.Stdio, (stdio) => Stream.run(Stream.make(text), stdio.stdout()));
 const writeStderr = (text) => Effect.flatMap(Stdio.Stdio, (stdio) => Stream.run(Stream.make(text), stdio.stderr()));
 function renderResult(mode, envelope, lines = []) {
-	if (mode === "json") return writeStdout(`${JSON.stringify(envelope)}\n`);
-	return envelope.outcome === "succeeded" ? writeStdout(`${lines.join("\n")}\n`) : writeStderr(`${envelope.error.code}: ${envelope.error.message}\n`);
+	const pretty = process.stdout.isTTY === true;
+	if (mode === "json") return writeStdout(`${JSON.stringify(envelope, null, pretty ? 2 : void 0)}\n`);
+	return envelope.outcome === "succeeded" ? writeStdout(`${(pretty ? lines.map(readableLine) : lines).join("\n")}\n`) : writeStderr(`${envelope.error.code}: ${envelope.error.message}\n`);
 }
+const readableLine = (line) => {
+	try {
+		return JSON.stringify(JSON.parse(line), null, 2);
+	} catch {
+		return line;
+	}
+};
 //#endregion
 //#region src/runtime/command-metadata.ts
 var CliCommandMetadata = class extends Context.Service()("capxul-cli/CommandMetadata") {};
@@ -52344,9 +53059,14 @@ const runCommand = (options, work) => Effect.gen(function* () {
 //#endregion
 //#region src/platform/capxul.ts
 const resultValue = (result) => result.ok ? Effect.succeed(result.value) : Effect.fail(result.error);
+const localDiagnosticsEnabled = (args) => args.some((arg, index) => arg === "--log-level=debug" || arg === "--logLevel=debug" || (arg === "--log-level" || arg === "--logLevel") && args[index + 1] === "debug");
 const acquireClient = (input, onFinalize) => Effect.uninterruptibleMask((restore) => Effect.gen(function* () {
+	const runtime = yield* CliRuntime;
 	const created = yield* restore(Effect.promise(async (signal) => {
-		const result = await createCapxulClient(input);
+		const result = await createCapxulClient({
+			...input,
+			localDiagnostics: localDiagnosticsEnabled(runtime.args ?? [])
+		});
 		if (signal.aborted && result.ok) await result.value.close();
 		return result;
 	}));
@@ -52380,7 +53100,7 @@ const checkDoctor = (config, options) => Effect.gen(function* () {
 	};
 	if (!options.online) return report;
 	const key = config.publishableKey;
-	if (key === void 0 || Redacted.value(key).length === 0) return yield* Effect.fail(configurationFailure("Set CAPXUL_PUBLISHABLE_KEY for the Railway application before an online check."));
+	if (key === void 0 || Redacted.value(key).length === 0) return yield* Effect.fail(configurationFailure("Set CAPXUL_PUBLISHABLE_KEY for the staging application before an online check."));
 	const result = yield* Effect.gen(function* () {
 		const started = yield* Clock.currentTimeMillis;
 		const client = yield* acquireClient({
@@ -52505,11 +53225,11 @@ const CurrentSession = Schema.Struct({
 		authUserId: Schema.NonEmptyString
 	}))
 });
-const decode$1 = (value) => Schema.decodeUnknownEffect(Schema.fromJsonString(CurrentSession), { onExcessProperty: "error" })(value).pipe(Effect.mapError(() => new StateFileError({ reason: "Corrupt" })));
+const decode$2 = (value) => Schema.decodeUnknownEffect(Schema.fromJsonString(CurrentSession), { onExcessProperty: "error" })(value).pipe(Effect.mapError(() => new StateFileError({ reason: "Corrupt" })));
 const readCurrentSession = (config) => Effect.gen(function* () {
 	const { directory, scope } = yield* privateRecordScope(config, "current-session", "current");
 	const value = yield* readPrivateRecord(directory, scope);
-	return value === null ? null : (yield* decode$1(value)).current;
+	return value === null ? null : (yield* decode$2(value)).current;
 });
 const rememberCurrentSession = (config, session, stillAuthenticated) => Effect.gen(function* () {
 	const { directory, scope } = yield* privateRecordScope(config, "current-session", "current");
@@ -52522,7 +53242,7 @@ const rememberCurrentSession = (config, session, stillAuthenticated) => Effect.g
 	};
 	for (let attempt = 0; attempt < 2; attempt += 1) {
 		const expected = yield* readPrivateRecord(directory, scope);
-		if (expected !== null) yield* decode$1(expected);
+		if (expected !== null) yield* decode$2(expected);
 		if (yield* compareAndSetPrivateRecord(directory, scope, expected, JSON.stringify(next), stillAuthenticated)) return;
 		if (!(yield* stillAuthenticated)) break;
 	}
@@ -52532,7 +53252,7 @@ const forgetCurrentSession = (config, email, stillCleared) => Effect.gen(functio
 	const { directory, scope } = yield* privateRecordScope(config, "current-session", "current");
 	const expected = yield* readPrivateRecordSnapshot(directory, scope);
 	if (expected === null) return false;
-	if ((yield* decode$1(expected)).current?.email !== email.toLowerCase()) return false;
+	if ((yield* decode$2(expected)).current?.email !== email.toLowerCase()) return false;
 	return yield* compareAndSetPrivateRecord(directory, scope, expected, JSON.stringify({
 		version: 1,
 		current: null
@@ -52549,48 +53269,118 @@ const inputRequired = (message) => new CliFailure({
 const readEmail = (email) => Effect.gen(function* () {
 	const runtime = yield* CliRuntime;
 	if (email === void 0) {
-		if (!runtime.tty || runtime.ci || runtime.mode === "json") return yield* Effect.fail(inputRequired("Provide --email. Use auth send, then auth verify --otp-stdin for non-interactive login."));
+		if (!runtime.tty || runtime.ci || runtime.mode === "json") return yield* Effect.fail(inputRequired("Provide --email."));
 		email = yield* Prompt.text({ message: "Email" });
 	}
 	const normalized = email.trim().toLowerCase();
 	if (!/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(normalized)) return yield* Effect.fail(inputRequired("Provide a valid email."));
 	return normalized;
 });
+const OTP_INPUT_ERROR = "OTP input must contain six digits only.";
+const OTP_BOUNDARY_MARKS = /^[\s\p{Cf}]+|[\s\p{Cf}]+$/gu;
+const normalizeOtpInput = (input) => {
+	if (new TextEncoder().encode(input).byteLength > 64) return null;
+	const normalized = input.replace(OTP_BOUNDARY_MARKS, "");
+	return /^[0-9]{6}$/.test(normalized) ? normalized : null;
+};
 const readOtp = (stdin) => Effect.gen(function* () {
 	const runtime = yield* CliRuntime;
 	if (!stdin) {
 		if (!runtime.tty || runtime.ci || runtime.mode === "json") return yield* Effect.fail(inputRequired("Provide the OTP on stdin with --otp-stdin; OTP arguments are not accepted."));
-		return Redacted.value(yield* Prompt.hidden({ message: "Email verification code" }));
+		return Redacted.value(yield* Prompt.password({
+			message: "Email OTP",
+			validate: (input) => {
+				const normalized = normalizeOtpInput(input);
+				return normalized === null ? Effect.fail(OTP_INPUT_ERROR) : Effect.succeed(normalized);
+			}
+		}));
 	}
 	const stdio = yield* Stdio.Stdio;
 	let length = 0;
 	const chunks = yield* stdio.stdin.pipe(Stream.mapEffect((chunk) => {
 		length += chunk.byteLength;
-		return length > 64 ? Effect.fail(inputRequired("OTP input must contain six digits only.")) : Effect.succeed(chunk);
+		return length > 64 ? Effect.fail(inputRequired(OTP_INPUT_ERROR)) : Effect.succeed(chunk);
 	}), Stream.decodeText(), Stream.runCollect);
-	const code = Array.from(chunks).join("").trim();
-	if (!/^\d{6}$/.test(code)) return yield* Effect.fail(inputRequired("OTP input must contain six digits only."));
+	const code = normalizeOtpInput(Array.from(chunks).join(""));
+	if (code === null) return yield* Effect.fail(inputRequired(OTP_INPUT_ERROR));
 	return code;
 });
-const readRequired = (label, flag, supplied) => Effect.gen(function* () {
-	const runtime = yield* CliRuntime;
-	let value = supplied;
-	if (value === void 0) {
-		if (!runtime.tty || runtime.ci || runtime.mode === "json") return yield* Effect.fail(inputRequired(`Provide --${flag}.`));
-		value = yield* Prompt.text({ message: label });
+const PROFILE_FLAGS = {
+	displayName: "--display-name",
+	country: "--country",
+	handle: "--handle"
+};
+const PROFILE_REFUSALS = {
+	displayName: "Provide --display-name with at least one visible character.",
+	country: "Provide --country as a two-letter ISO country code, for example GH.",
+	handle: "Provide --handle as 3 to 30 characters of a-z, 0-9, underscore, or hyphen."
+};
+/**
+* Accept one Profile value, or return the refusal that names its field.
+*
+* Country and handle use the public SDK constructors, so the CLI accepts
+* exactly the values the backend stores. A handle loses its leading `@` and
+* its case before the check, which is the canon spelling the owner persists.
+*/
+const acceptPersonField = (field, raw) => {
+	const trimmed = raw.trim();
+	if (trimmed.length === 0) return { refusal: inputRequired(PROFILE_REFUSALS[field]) };
+	try {
+		if (field === "country") return { value: toCountryCode(trimmed) };
+		if (field === "handle") return { value: toHandle(trimmed.replace(/^@/u, "").toLowerCase()) };
+		return { value: trimmed };
+	} catch {
+		return { refusal: inputRequired(PROFILE_REFUSALS[field]) };
+	}
+};
+/**
+* Validate the Profile values a caller supplied, before any client work.
+*
+* `auth signup` runs this first, so a malformed value refuses locally and
+* consumes no one-time code. An absent field stays with `readPersonInput`,
+* which prompts on a terminal and refuses headlessly.
+*/
+const checkPersonFlags = (flags) => Effect.gen(function* () {
+	for (const field of [
+		"displayName",
+		"country",
+		"handle"
+	]) {
+		const supplied = flags[field];
+		if (supplied === void 0) continue;
+		const accepted = acceptPersonField(field, supplied);
+		if ("refusal" in accepted) return yield* Effect.fail(accepted.refusal);
 	}
-	const trimmed = value.trim();
-	if (trimmed.length === 0) return yield* Effect.fail(inputRequired(`Provide --${flag}.`));
-	return trimmed;
+});
+/**
+* One required Profile field.
+*
+* A non-interactive run accepts only the explicit flag, so headless signup is
+* deterministic and never prompts. An interactive run prompts, and offers the
+* existing Profile value as the default so a continuation keeps it.
+*/
+const readRequired = (label, field, supplied, existing) => Effect.gen(function* () {
+	const runtime = yield* CliRuntime;
+	if (!runtime.tty || runtime.ci || runtime.mode === "json") {
+		if (supplied === void 0) return yield* Effect.fail(inputRequired(`Provide ${PROFILE_FLAGS[field]}.`));
+		const accepted = acceptPersonField(field, supplied);
+		if ("refusal" in accepted) return yield* Effect.fail(accepted.refusal);
+		return accepted.value;
+	}
+	const fallback = supplied ?? existing;
+	const value = yield* Prompt.text({
+		message: label,
+		...fallback === void 0 || fallback.trim().length === 0 ? {} : { default: fallback }
+	});
+	const accepted = acceptPersonField(field, value);
+	if ("refusal" in accepted) return yield* Effect.fail(accepted.refusal);
+	return accepted.value;
 });
 const readPersonInput = (flags, profile) => Effect.gen(function* () {
-	const displayName = yield* readRequired("Display name", "display-name", flags.displayName ?? profile?.displayName ?? void 0);
-	const country = yield* readRequired("Country code", "country", flags.country ?? profile?.country ?? void 0);
-	const handle = yield* readRequired("Handle", "handle", flags.handle ?? profile?.handle ?? void 0);
 	return {
-		displayName,
-		country: country.toUpperCase(),
-		handle
+		displayName: yield* readRequired("Display name", "displayName", flags.displayName, profile?.displayName ?? void 0),
+		country: yield* readRequired("Country code", "country", flags.country, profile?.country ?? void 0),
+		handle: yield* readRequired("Handle", "handle", flags.handle, profile?.handle ?? void 0)
 	};
 });
 //#endregion
@@ -52767,13 +53557,19 @@ main{display:flex;min-height:100dvh;flex-direction:column;align-items:center;jus
 .logo{width:48px;height:48px;flex:none;animation:capxul-pulse 2s ease-in-out infinite}
 [data-state=ready] .logo,[data-state=failed] .logo{animation:none}
 h1{max-width:448px;margin:0;font-size:18px;font-weight:500;line-height:28px;text-wrap:balance}
+[data-state=working] h1{animation:capxul-breathe 2.4s ease-in-out infinite}
+@keyframes capxul-breathe{50%{opacity:.5}}
 .message{max-width:448px;margin:0;color:#525252;font-size:14px;line-height:20px;text-wrap:pretty}
+.action{margin:0;padding:10px 18px;border:1px solid currentColor;border-radius:9999px;background:transparent;color:inherit;font:inherit;cursor:pointer}
+.action:hover{opacity:.75}
+.action:focus-visible{outline:2px solid #F97316;outline-offset:2px}
+[hidden]{display:none!important}
 .sr-only{position:absolute;width:1px;height:1px;padding:0;margin:-1px;overflow:hidden;clip:rect(0,0,0,0);white-space:nowrap;border:0}
 @media(prefers-color-scheme:dark){.message{color:#D4D4D4}}
-@media(prefers-reduced-motion:reduce){.logo{animation:none}}
+@media(prefers-reduced-motion:reduce){.logo,h1{animation:none}}
 @keyframes capxul-pulse{50%{opacity:.45}}
 </style>
-</head><body><main data-state="working" aria-busy="true"><svg class="logo" role="img" aria-label="Capxul" viewBox="0 0 36 36" fill="none" xmlns="http://www.w3.org/2000/svg"><path d="M0 10C0 4.47715 4.47715 0 10 0H26C31.5228 0 36 4.47715 36 10V26C36 31.5228 31.5228 36 26 36H10C4.47715 36 0 31.5228 0 26V10Z" fill="#F97316"/><path d="M26.642 12.0117H25.2845C24.9618 12.012 24.6495 11.8993 24.4036 11.6936C24.1576 11.4879 23.994 11.2028 23.9421 10.8892C23.9303 10.8185 23.9244 10.747 23.9245 10.6754V9.3377C23.9245 8.98325 23.7816 8.6433 23.5273 8.39248C23.2729 8.14167 22.9279 8.00051 22.5679 8H14.5592C14.1991 8.00088 13.854 8.14175 13.5988 8.39197L8.39806 13.5136C8.27192 13.6376 8.17184 13.785 8.10354 13.9472C8.03524 14.1094 8.00006 14.2832 8 14.4588V22.6511C8.00065 23.0055 8.14405 23.3452 8.39873 23.5956C8.65341 23.8461 8.99858 23.9868 9.3585 23.9869H10.716C11.0762 23.987 11.4217 24.128 11.6763 24.3789C11.931 24.6297 12.074 24.9699 12.074 25.3246V26.6613C12.0742 27.016 12.2174 27.3562 12.4721 27.6069C12.7269 27.8577 13.0723 27.9986 13.4325 27.9986H21.4408C21.6192 27.9989 21.7959 27.9644 21.9608 27.8971C22.1256 27.8298 22.2753 27.7311 22.4012 27.6066L24.324 25.7142L27.6005 22.4879C27.7273 22.3639 27.8279 22.2164 27.8967 22.0539C27.9654 21.8914 28.0008 21.7172 28.001 21.5412V13.3494C28.001 13.1736 27.9658 12.9997 27.8975 12.8373C27.8292 12.675 27.7291 12.5275 27.6029 12.4033C27.4767 12.2791 27.3269 12.1805 27.162 12.1133C26.9971 12.0461 26.8204 12.0116 26.642 12.0117Z" fill="white"/><path d="M25.2012 18.4218V20.3672L22.2138 23.3089H15.9015V20.3672H22.2138V18.4218H25.2012ZM15.9015 11.0154L12.9141 13.9571V20.3672H15.9015V13.9571H22.2138V11.0154H15.9015ZM22.2138 13.9571V15.8707H25.2012V13.9571H22.2138Z" fill="#F97316"/></svg><h1 id="title">Connecting to Capxul CLI</h1><p class="message" id="status" role="status" aria-live="polite">Keep this tab open. Continue in your terminal when the wallet is ready.</p><p class="sr-only" id="lead">Keep this tab open. Continue in your terminal when the wallet is ready.</p><p class="sr-only">Account <span id="account">Personal account</span>. Environment <span id="environment">Loading</span>.</p></main><script src="/signer.js" defer><\/script></body></html>`;
+</head><body><main data-state="working" aria-busy="true"><svg class="logo" role="img" aria-label="Capxul" viewBox="0 0 36 36" fill="none" xmlns="http://www.w3.org/2000/svg"><path d="M0 10C0 4.47715 4.47715 0 10 0H26C31.5228 0 36 4.47715 36 10V26C36 31.5228 31.5228 36 26 36H10C4.47715 36 0 31.5228 0 26V10Z" fill="#F97316"/><path d="M26.642 12.0117H25.2845C24.9618 12.012 24.6495 11.8993 24.4036 11.6936C24.1576 11.4879 23.994 11.2028 23.9421 10.8892C23.9303 10.8185 23.9244 10.747 23.9245 10.6754V9.3377C23.9245 8.98325 23.7816 8.6433 23.5273 8.39248C23.2729 8.14167 22.9279 8.00051 22.5679 8H14.5592C14.1991 8.00088 13.854 8.14175 13.5988 8.39197L8.39806 13.5136C8.27192 13.6376 8.17184 13.785 8.10354 13.9472C8.03524 14.1094 8.00006 14.2832 8 14.4588V22.6511C8.00065 23.0055 8.14405 23.3452 8.39873 23.5956C8.65341 23.8461 8.99858 23.9868 9.3585 23.9869H10.716C11.0762 23.987 11.4217 24.128 11.6763 24.3789C11.931 24.6297 12.074 24.9699 12.074 25.3246V26.6613C12.0742 27.016 12.2174 27.3562 12.4721 27.6069C12.7269 27.8577 13.0723 27.9986 13.4325 27.9986H21.4408C21.6192 27.9989 21.7959 27.9644 21.9608 27.8971C22.1256 27.8298 22.2753 27.7311 22.4012 27.6066L24.324 25.7142L27.6005 22.4879C27.7273 22.3639 27.8279 22.2164 27.8967 22.0539C27.9654 21.8914 28.0008 21.7172 28.001 21.5412V13.3494C28.001 13.1736 27.9658 12.9997 27.8975 12.8373C27.8292 12.675 27.7291 12.5275 27.6029 12.4033C27.4767 12.2791 27.3269 12.1805 27.162 12.1133C26.9971 12.0461 26.8204 12.0116 26.642 12.0117Z" fill="white"/><path d="M25.2012 18.4218V20.3672L22.2138 23.3089H15.9015V20.3672H22.2138V18.4218H25.2012ZM15.9015 11.0154L12.9141 13.9571V20.3672H15.9015V13.9571H22.2138V11.0154H15.9015ZM22.2138 13.9571V15.8707H25.2012V13.9571H22.2138Z" fill="#F97316"/></svg><h1 id="title" role="status" aria-live="polite">Connecting to Capxul CLI</h1><p class="message" id="status"></p><button class="action" id="dismiss" type="button" hidden>Close this page</button><p class="sr-only">Account <span id="account">Personal account</span>. Environment <span id="environment">Loading</span>.</p></main><script src="/signer.js" defer><\/script></body></html>`;
 const json = (response, status, body) => {
 	response.writeHead(status, {
 		"cache-control": "no-store",
@@ -53261,6 +54057,17 @@ const verifiedSession = (client, email) => Effect.gen(function* () {
 	if (session === null || session.email.toLowerCase() !== email) return yield* Effect.fail(Errors.notAuthenticated());
 	return session;
 });
+const submitOtp = (otpStdin, verify) => Effect.gen(function* () {
+	const submissionLimit = otpStdin ? 1 : 3;
+	for (let submission = 1; submission <= submissionLimit; submission += 1) {
+		const code = yield* readOtp(otpStdin);
+		const result = yield* Effect.result(verify(code));
+		if (Result.isSuccess(result)) return;
+		const error = result.failure;
+		if (!(error.code === "INVALID_INPUT" && error.details?.field === "otp") || submission === submissionLimit) return yield* Effect.fail(error);
+		yield* writeStderr("Invalid OTP. Try again.\n");
+	}
+});
 /**
 * Local authentication checks only: the current-session pointer, the explicit
 * email, and a stored credential. No bootstrap, client, or network work. A
@@ -53338,6 +54145,60 @@ const flushWalletDiagnostics = (bridge, invocationId) => Effect.suspend(() => br
 	invocation_id: invocationId,
 	journey_id: invocationId
 }), { discard: true }));
+const SIGNUP_OTP_INPUT_REQUIRED = "Use --otp-stdin for non-interactive signup. OTP arguments are not accepted.";
+/**
+* One account-setup continuation: profile input, then wallet and Account work.
+*
+* `signup` calls this after authentication. An interactive `login` calls it
+* only after the person accepts the setup offer. A headless `login` never calls
+* it, so sign-in cannot become signup.
+*
+* The step returns a ready report only. When the personal Account is not ready,
+* it returns a typed recoverable report: `setupState` names the state, the
+* lifecycle carries the failure code, and the copy names the exact resume
+* action. The step never starts wallet work for a ready Account, so a retry
+* reuses the one Profile, wallet, Smart Account, and Account.
+*/
+const completeAccountSetup = (config, store, client, session, suppliedProfile) => Effect.gen(function* () {
+	const current = yield* call((signal) => client.identity.loadCurrent({ signal }));
+	const before = yield* profileReport(client, session);
+	if (before.data.setupState === "ready") return before;
+	const profile = yield* readPersonInput(suppliedProfile, current);
+	const runtime = yield* CliRuntime;
+	const run = Effect.runPromiseWith(yield* Effect.context());
+	let bridge;
+	const invocation = yield* Ref.get(runtime.current);
+	const openfortSignerFactory = (bootstrap) => {
+		const created = createBrowserSignerBridge({
+			bootstrap,
+			environment: config.environment,
+			handle: () => profile.handle,
+			trustedAuthOrigin: new URL(config.bootstrapBaseUrl).origin,
+			sessionToken: () => run(store.tokenIfCurrent())
+		});
+		bridge = created;
+		invocation?.onFinalize?.(Effect.promise(() => created.close()).pipe(Effect.asVoid, Effect.catchCause(() => Effect.void)));
+		return created.signer;
+	};
+	const walletClient = yield* clientFor(config, store, {
+		restore: true,
+		requirement: "deployed",
+		openfortSignerFactory
+	});
+	const verified = yield* verifiedSession(walletClient, session.email);
+	yield* writeStderr("Preparing your wallet in the browser. Keep that tab open.\n");
+	const report = yield* Effect.gen(function* () {
+		yield* call((signal) => walletClient.onboarding.completePerson(profile, { signal }));
+		return yield* profileReport(walletClient, verified);
+	}).pipe(Effect.ensuring(Effect.suspend(() => flushWalletDiagnostics(bridge, runtime.invocationId))));
+	return {
+		data: {
+			...report.data,
+			signerStatus: walletClient.signer.status()
+		},
+		lines: report.lines
+	};
+});
 const sendOtp = (config, suppliedEmail) => Effect.gen(function* () {
 	const email = yield* readEmail(suppliedEmail);
 	const store = yield* openSessionRecord(config, email);
@@ -53362,7 +54223,6 @@ const verifyOtp = (config, suppliedEmail, otpStdin) => Effect.gen(function* () {
 	const store = yield* openSessionRecord(config, email);
 	const flow = store.current().flow;
 	if (flow === null || flow.email !== email) return yield* Effect.fail(inputRequired("No pending OTP. Run auth send --email <email> first."));
-	const code = yield* readOtp(otpStdin);
 	const client = yield* clientFor(config, store, { restore: false });
 	yield* call((signal) => client.auth.getSession({ signal }));
 	yield* call((signal) => client.auth.resumeOtp({
@@ -53372,13 +54232,13 @@ const verifyOtp = (config, suppliedEmail, otpStdin) => Effect.gen(function* () {
 		signal,
 		journey_id: flow.journeyId
 	}));
-	yield* call((signal) => client.auth.verifyOtp({
+	yield* submitOtp(otpStdin, (code) => call((signal) => client.auth.verifyOtp({
 		email,
 		code
 	}, {
 		signal,
 		journey_id: flow.journeyId
-	}));
+	})));
 	const session = yield* verifiedSession(client, email);
 	yield* bindPerson(config, store, session);
 	const report = yield* profileReport(client, session);
@@ -53393,95 +54253,64 @@ const verifyOtp = (config, suppliedEmail, otpStdin) => Effect.gen(function* () {
 const login = (config, suppliedEmail, otpStdin) => Effect.gen(function* () {
 	const email = yield* readEmail(suppliedEmail);
 	const runtime = yield* CliRuntime;
-	if (!otpStdin && (!runtime.tty || runtime.ci || runtime.mode === "json")) return yield* Effect.fail(inputRequired("Use auth send, then auth verify --otp-stdin. Interactive login reads the OTP without echo."));
+	if (!otpStdin && (!runtime.tty || runtime.ci || runtime.mode === "json")) return yield* Effect.fail(inputRequired("Provide the OTP on stdin with --otp-stdin. Use capxul auth send, then capxul auth verify, to split sign-in across two commands."));
 	const store = yield* openSessionRecord(config, email);
 	const client = yield* clientFor(config, store, { restore: false });
 	yield* call((signal) => client.auth.getSession({ signal }));
 	yield* store.begin(yield* Clock.currentTimeMillis, runtime.invocationId);
 	yield* call((signal) => client.auth.signIn({ email }, { signal }));
 	yield* writeStderr("Verification email sent. Enter the code to continue.\n");
-	const code = yield* readOtp(otpStdin);
-	yield* call((signal) => client.auth.verifyOtp({
+	yield* submitOtp(otpStdin, (code) => call((signal) => client.auth.verifyOtp({
 		email,
 		code
 	}, {
 		signal,
 		journey_id: runtime.invocationId
-	}));
+	})));
 	const session = yield* verifiedSession(client, email);
 	yield* bindPerson(config, store, session);
-	return yield* profileReport(client, session);
+	const report = yield* profileReport(client, session);
+	if (report.data.setupState === "ready") return report;
+	if (!runtime.tty || runtime.ci || runtime.mode === "json") return report;
+	if (!(yield* Prompt.confirm({
+		message: "Your Capxul account is not set up yet. Continue setup now?",
+		initial: false
+	}))) return report;
+	return yield* completeAccountSetup(config, store, client, session, {});
 });
 const signup = (config, suppliedEmail, otpStdin, suppliedProfile) => Effect.gen(function* () {
 	const email = yield* readEmail(suppliedEmail);
 	const runtime = yield* CliRuntime;
+	yield* checkPersonFlags(suppliedProfile);
 	const store = yield* openSessionRecord(config, email);
-	const run = Effect.runPromiseWith(yield* Effect.context());
 	const restore = store.current().token !== null;
-	let handle = suppliedProfile.handle ?? "personal";
-	let bridge;
+	if (!restore && !otpStdin && (!runtime.tty || runtime.ci || runtime.mode === "json")) return yield* Effect.fail(inputRequired(SIGNUP_OTP_INPUT_REQUIRED));
 	let client = yield* clientFor(config, store, { restore });
 	let session = restore ? yield* verifiedSession(client, email).pipe(Effect.catch((error) => error.code === "NOT_AUTHENTICATED" ? store.clear.pipe(Effect.as(null)) : Effect.fail(error))) : null;
 	if (session === null) {
 		if (restore) client = yield* clientFor(config, store, { restore: false });
-		if (!otpStdin && (!runtime.tty || runtime.ci || runtime.mode === "json")) return yield* Effect.fail(inputRequired("Use --otp-stdin for non-interactive signup. OTP arguments are not accepted."));
+		if (!otpStdin && (!runtime.tty || runtime.ci || runtime.mode === "json")) return yield* Effect.fail(inputRequired(SIGNUP_OTP_INPUT_REQUIRED));
 		yield* call((signal) => client.auth.getSession({ signal }));
 		yield* store.begin(yield* Clock.currentTimeMillis, runtime.invocationId);
 		yield* call((signal) => client.auth.signIn({ email }, { signal }));
 		yield* writeStderr("Verification email sent. Enter the code to continue.\n");
-		const code = yield* readOtp(otpStdin);
-		yield* call((signal) => client.auth.verifyOtp({
+		yield* submitOtp(otpStdin, (code) => call((signal) => client.auth.verifyOtp({
 			email,
 			code
 		}, {
 			signal,
 			journey_id: runtime.invocationId
-		}));
+		})));
 		session = yield* verifiedSession(client, email);
 	}
 	yield* bindPerson(config, store, session);
-	const current = yield* call((signal) => client.identity.loadCurrent({ signal }));
-	const before = yield* profileReport(client, session);
-	if (before.data.setupState === "ready") return before;
-	const profile = yield* readPersonInput(suppliedProfile, current);
-	handle = profile.handle;
-	const invocation = yield* Ref.get(runtime.current);
-	const openfortSignerFactory = (bootstrap) => {
-		const created = createBrowserSignerBridge({
-			bootstrap,
-			environment: config.environment,
-			handle: () => handle,
-			trustedAuthOrigin: new URL(config.bootstrapBaseUrl).origin,
-			sessionToken: () => run(store.tokenIfCurrent())
-		});
-		bridge = created;
-		invocation?.onFinalize?.(Effect.promise(() => created.close()).pipe(Effect.asVoid, Effect.catchCause(() => Effect.void)));
-		return created.signer;
-	};
-	const walletClient = yield* clientFor(config, store, {
-		restore: true,
-		requirement: "deployed",
-		openfortSignerFactory
-	});
-	session = yield* verifiedSession(walletClient, email);
-	yield* writeStderr("Preparing your wallet in the browser. Keep that tab open.\n");
-	const report = yield* Effect.gen(function* () {
-		yield* call((signal) => walletClient.onboarding.completePerson(profile, { signal }));
-		return yield* profileReport(walletClient, session);
-	}).pipe(Effect.ensuring(Effect.suspend(() => flushWalletDiagnostics(bridge, runtime.invocationId))));
-	return {
-		data: {
-			...report.data,
-			signerStatus: walletClient.signer.status()
-		},
-		lines: report.lines
-	};
+	return yield* completeAccountSetup(config, store, client, session, suppliedProfile);
 });
 const readProfile = (config, suppliedEmail) => Effect.gen(function* () {
 	const email = yield* readEmail(suppliedEmail);
 	const store = yield* openSessionRecord(config, email);
 	if (store.current().token === null) {
-		if (usableGrant(yield* loadGrant(config, email))) return yield* Effect.fail(inputRequired("A legacy account:read grant is stored. Run auth login or auth send/verify to explicitly establish a broader first-party session."));
+		if (usableGrant(yield* loadGrant(config, email))) return yield* Effect.fail(inputRequired("Sign in again with capxul auth login to use this command."));
 		return yield* Effect.fail(Errors.notAuthenticated());
 	}
 	const client = yield* clientFor(config, store, { restore: true });
@@ -53540,61 +54369,61 @@ const logout = (config, suppliedEmail) => Effect.gen(function* () {
 });
 //#endregion
 //#region src/commands/auth.ts
-const emailFlag$1 = Flag.string("email").pipe(Flag.withDescription("Account email"), Flag.optional);
-const otpStdinFlag = Flag.boolean("otp-stdin").pipe(Flag.withDefault(false), Flag.withDescription("Read the six-digit OTP from stdin; never pass it as an argument"));
-const displayNameFlag = Flag.string("display-name").pipe(Flag.withDescription("Profile display name"), Flag.optional);
-const countryFlag = Flag.string("country").pipe(Flag.withDescription("Two-letter ISO country code"), Flag.optional);
-const handleFlag = Flag.string("handle").pipe(Flag.withDescription("Globally unique Capxul handle"), Flag.optional);
-const metadata$2 = (name) => ({
+const emailFlag$3 = Flag.string("email").pipe(Flag.withDescription("Email address"), Flag.optional);
+const otpStdinFlag = Flag.boolean("otp-stdin").pipe(Flag.withDefault(false), Flag.withDescription("Read the six-digit OTP from standard input; never pass it as an argument"));
+const displayNameFlag = Flag.string("display-name").pipe(Flag.withDescription("Your display name"), Flag.optional);
+const countryFlag = Flag.string("country").pipe(Flag.withDescription("Two-letter country code"), Flag.optional);
+const handleFlag = Flag.string("handle").pipe(Flag.withDescription("Your unique Capxul handle"), Flag.optional);
+const metadata$4 = (name) => ({
 	name,
 	capability: "authentication",
 	observation: "command"
 });
 const loginCommand = Command.make("login", {
-	email: emailFlag$1,
+	email: emailFlag$3,
 	otpStdin: otpStdinFlag
 }, ({ email, otpStdin }) => runCommand({
-	...metadata$2("auth.login"),
+	...metadata$4("auth.login"),
 	network: true
-}, (config) => login(config, Option.getOrUndefined(email), otpStdin))).pipe(Command.annotate(CliCommandMetadata, metadata$2("auth.login")), Command.withDescription("Establish a first-party session with terminal-owned email OTP"));
+}, (config) => login(config, Option.getOrUndefined(email), otpStdin))).pipe(Command.annotate(CliCommandMetadata, metadata$4("auth.login")), Command.withDescription("Sign in with your email and a one-time code"));
 const signupCommand = Command.make("signup", {
-	email: emailFlag$1,
+	email: emailFlag$3,
 	otpStdin: otpStdinFlag,
 	displayName: displayNameFlag,
 	country: countryFlag,
 	handle: handleFlag
 }, ({ email, otpStdin, displayName, country, handle }) => runCommand({
-	...metadata$2("auth.signup"),
+	...metadata$4("auth.signup"),
 	network: true
 }, (config) => signup(config, Option.getOrUndefined(email), otpStdin, {
 	displayName: Option.getOrUndefined(displayName),
 	country: Option.getOrUndefined(country),
 	handle: Option.getOrUndefined(handle)
-}))).pipe(Command.annotate(CliCommandMetadata, metadata$2("auth.signup")), Command.withDescription("Verify email and complete Profile, Openfort wallet, and Account setup"));
-const sendCommand = Command.make("send", { email: emailFlag$1 }, ({ email }) => runCommand({
-	...metadata$2("auth.send"),
+}))).pipe(Command.annotate(CliCommandMetadata, metadata$4("auth.signup")), Command.withDescription("Create your Capxul account and wallet"));
+const sendCommand = Command.make("send", { email: emailFlag$3 }, ({ email }) => runCommand({
+	...metadata$4("auth.send"),
 	network: true
-}, (config) => sendOtp(config, Option.getOrUndefined(email)))).pipe(Command.annotate(CliCommandMetadata, metadata$2("auth.send")), Command.withDescription("Send an OTP and save non-secret continuation context"));
+}, (config) => sendOtp(config, Option.getOrUndefined(email)))).pipe(Command.annotate(CliCommandMetadata, metadata$4("auth.send")), Command.withDescription("Send a sign-in code to your email"));
 const verifyCommand = Command.make("verify", {
-	email: emailFlag$1,
+	email: emailFlag$3,
 	otpStdin: otpStdinFlag
 }, ({ email, otpStdin }) => runCommand({
-	...metadata$2("auth.verify"),
+	...metadata$4("auth.verify"),
 	network: true
-}, (config) => verifyOtp(config, Option.getOrUndefined(email), otpStdin))).pipe(Command.annotate(CliCommandMetadata, metadata$2("auth.verify")), Command.withDescription("Verify a delivered OTP and persist the first-party session"));
-const profileCommand = Command.make("profile", { email: emailFlag$1 }, ({ email }) => runCommand({
-	...metadata$2("auth.profile"),
+}, (config) => verifyOtp(config, Option.getOrUndefined(email), otpStdin))).pipe(Command.annotate(CliCommandMetadata, metadata$4("auth.verify")), Command.withDescription("Finish signing in with the code from your email"));
+const profileCommand = Command.make("profile", { email: emailFlag$3 }, ({ email }) => runCommand({
+	...metadata$4("auth.profile"),
 	network: true
-}, (config) => readProfile(config, Option.getOrUndefined(email)))).pipe(Command.annotate(CliCommandMetadata, metadata$2("auth.profile")), Command.withDescription("Restore the session and read the backend profile and account lifecycle"));
-const statusCommand = Command.make("status", { email: emailFlag$1 }, ({ email }) => runCommand({
-	...metadata$2("auth.status"),
+}, (config) => readProfile(config, Option.getOrUndefined(email)))).pipe(Command.annotate(CliCommandMetadata, metadata$4("auth.profile")), Command.withDescription("Show your profile and account readiness"));
+const statusCommand = Command.make("status", { email: emailFlag$3 }, ({ email }) => runCommand({
+	...metadata$4("auth.status"),
 	network: true
-}, (config) => status$2(config, Option.getOrUndefined(email)))).pipe(Command.annotate(CliCommandMetadata, metadata$2("auth.status")), Command.withDescription("Validate a first-party session or show a tagged legacy grant"));
-const logoutCommand = Command.make("logout", { email: emailFlag$1 }, ({ email }) => runCommand({
-	...metadata$2("auth.logout"),
+}, (config) => status$2(config, Option.getOrUndefined(email)))).pipe(Command.annotate(CliCommandMetadata, metadata$4("auth.status")), Command.withDescription("Show whether you are signed in"));
+const logoutCommand = Command.make("logout", { email: emailFlag$3 }, ({ email }) => runCommand({
+	...metadata$4("auth.logout"),
 	network: true
-}, (config) => logout(config, Option.getOrUndefined(email)))).pipe(Command.annotate(CliCommandMetadata, metadata$2("auth.logout")), Command.withDescription("Forget local credentials and revoke their remote session or grant"));
-const auth = Command.make("auth").pipe(Command.annotate(CliCommandMetadata, metadata$2("auth")), Command.withDescription("First-party email sessions (broader authority than legacy account:read grants)"), Command.withSubcommands([
+}, (config) => logout(config, Option.getOrUndefined(email)))).pipe(Command.annotate(CliCommandMetadata, metadata$4("auth.logout")), Command.withDescription("Sign out on this device"));
+const auth = Command.make("auth").pipe(Command.annotate(CliCommandMetadata, metadata$4("auth")), Command.withDescription("Sign in, create your account, and manage your session"), Command.withSubcommands([
 	loginCommand,
 	signupCommand,
 	sendCommand,
@@ -53605,7 +54434,7 @@ const auth = Command.make("auth").pipe(Command.annotate(CliCommandMetadata, meta
 ]));
 //#endregion
 //#region src/commands/doctor.ts
-const metadata$1 = {
+const metadata$3 = {
 	name: "doctor",
 	capability: "diagnostics",
 	observation: "command"
@@ -53614,14 +54443,14 @@ const doctor = Command.make("doctor", {
 	online: Flag.boolean("online").pipe(Flag.withDefault(false), Flag.withDescription("Also check the backend through the public SDK")),
 	timeoutMs: Flag.integer("timeout-ms").pipe(Flag.filter((value) => value >= 1 && value <= 3e5, () => "Use --timeout-ms between 1 and 300000."), Flag.withDefault(3e4), Flag.withDescription("Online check deadline in milliseconds (1 to 300000)"))
 }, ({ online, timeoutMs }) => runCommand({
-	...metadata$1,
+	...metadata$3,
 	network: online
 }, (config, observation, onFinalize) => checkDoctor(config, {
 	online,
 	timeoutMs,
 	...observation === void 0 ? {} : { observation },
 	...onFinalize === void 0 ? {} : { onFinalize }
-}))).pipe(Command.annotate(CliCommandMetadata, metadata$1), Command.withDescription("Check local configuration; --online also checks the backend"));
+}))).pipe(Command.annotate(CliCommandMetadata, metadata$3), Command.withDescription("Check local configuration; --online also checks the backend"));
 //#endregion
 //#region src/commands/telemetry.ts
 const statusMetadata = {
@@ -53667,6 +54496,73 @@ const telemetry = Command.make("telemetry").pipe(Command.annotate(CliCommandMeta
 	disable
 ]));
 //#endregion
+//#region src/org-recovery.ts
+/**
+* The one safe recovery handle for a person's Organization journey.
+*
+* `handle` is the exact business handle the create prepared. It is the only
+* identity the CLI knows while the first durable Organization write is in
+* flight, and the backend resumes the same Organization for that handle.
+* `organizationId` is added from the first committed Organization. After that
+* the ID is the recovery target.
+*
+* A record with no handle releases the journey: the backend refused that exact
+* handle before it wrote any Organization row, so no Organization waits to be
+* resumed. The record stores no draft, submission, credential, or token.
+*/
+const Recovery = Schema.Struct({
+	version: Schema.Literal(1),
+	handle: Schema.optional(Schema.NonEmptyString),
+	organizationId: Schema.optional(Schema.NonEmptyString)
+});
+const decode$1 = (value) => Schema.decodeUnknownEffect(Schema.fromJsonString(Recovery), { onExcessProperty: "error" })(value).pipe(Effect.flatMap((record) => {
+	const organizationId = record.organizationId ?? null;
+	if (record.handle === void 0) return organizationId === null ? Effect.succeed(null) : Effect.fail(new StateFileError({ reason: "Corrupt" }));
+	const handle = record.handle;
+	return Effect.try(() => ({
+		handle: String(toHandle(handle)),
+		organizationId: organizationId === null ? null : toOrgId(organizationId)
+	}));
+}), Effect.mapError(() => new StateFileError({ reason: "Corrupt" })));
+const encode = (recovery) => JSON.stringify({
+	version: 1,
+	handle: recovery.handle,
+	...recovery.organizationId === null ? {} : { organizationId: String(recovery.organizationId) }
+});
+/** The released shape: no handle waits to be resumed. */
+const RELEASED = JSON.stringify({ version: 1 });
+/** Read the safe recovery handle without writing. A corrupt record refuses the command. */
+const readOrganizationRecovery = (config, authUserId) => Effect.gen(function* () {
+	const { directory, scope } = yield* privateRecordScope(config, "organization-recovery", authUserId);
+	const value = yield* readPrivateRecord(directory, scope);
+	return value === null ? null : yield* decode$1(value);
+});
+/**
+* Open the recovery handle for one command.
+*
+* `save` and `release` replace only the exact record this command read, so two
+* commands cannot overwrite each other's Organization journey, and a delayed
+* write cannot follow a newer one. A record this command did not read refuses
+* the write.
+*/
+const openOrganizationRecovery = (config, authUserId, stillAuthenticated) => Effect.gen(function* () {
+	const { directory, scope } = yield* privateRecordScope(config, "organization-recovery", authUserId);
+	let encoded = yield* readPrivateRecord(directory, scope);
+	let record = encoded === null ? null : yield* decode$1(encoded);
+	const write = (next) => Effect.gen(function* () {
+		const value = next === null ? RELEASED : encode(next);
+		if (value === encoded) return;
+		if (!(yield* compareAndSetPrivateRecord(directory, scope, encoded, value, stillAuthenticated))) return yield* Effect.fail(Errors.notAuthenticated("The local Organization recovery state changed. Retry the command."));
+		encoded = value;
+		record = next;
+	});
+	return {
+		current: () => record,
+		save: (next) => write(next),
+		release: () => write(null)
+	};
+});
+//#endregion
 //#region src/org-selection.ts
 const Selection = Schema.Struct({
 	version: Schema.Literal(1),
@@ -53689,6 +54585,37 @@ const saveOrganizationSelection = (config, authUserId, organizationId, stillAuth
 });
 //#endregion
 //#region src/org.ts
+/**
+* The exact Organization a read uses when the caller named no ID: the saved read
+* default first, then the recorded recovery handle for this person's
+* Organization journey. `recoverable` marks the handle source, whose Organization
+* may still run its setup lane and be absent from the own-access list.
+*/
+const readResolvedOrganization = (config, authUserId, organizationId) => Effect.gen(function* () {
+	if (organizationId !== null) return {
+		organizationId,
+		recoverable: false
+	};
+	const selected = yield* readOrganizationSelection(config, authUserId);
+	if (selected !== null) return {
+		organizationId: selected,
+		recoverable: false
+	};
+	const recovery = yield* readOrganizationRecovery(config, authUserId);
+	return {
+		organizationId: recovery?.organizationId ?? null,
+		recoverable: recovery?.organizationId !== null && recovery?.organizationId !== void 0
+	};
+});
+/**
+* A ready Organization this command reports must satisfy current access.
+*
+* The own-access list carries a founder's unfinished Organizations through the
+* backend's founder fallback, and the backend lifecycle read admits the founder
+* for the durable lane. A confirmed result therefore reads the list again: an
+* Organization the person cannot reach refuses instead of reporting its state.
+*/
+const requireCurrentAccess = (client, organizationId, lifecycle) => lifecycle.status !== "ready" ? Effect.void : Effect.promise((signal) => client.orgs({ signal })).pipe(Effect.flatMap(resultValue), Effect.flatMap((organizations) => organizations.some((organization) => organization.id === organizationId) ? Effect.void : Effect.fail(Errors.invalidInput("org", "The Organization is not accessible."))));
 const readOrganization = (config, command, input) => Effect.gen(function* () {
 	const timeout = yield* Schema.decodeUnknownEffect(Schema.Int.check(Schema.isBetween({
 		minimum: 1,
@@ -53715,7 +54642,8 @@ const readOrganization = (config, command, input) => Effect.gen(function* () {
 			address: org.account.address
 		}))
 	};
-	organizationId ??= yield* readOrganizationSelection(config, session.authUserId);
+	const resolved = yield* readResolvedOrganization(config, session.authUserId, organizationId);
+	organizationId = resolved.organizationId;
 	if (organizationId === null) {
 		const runtime = yield* CliRuntime;
 		if (!runtime.tty || runtime.ci || runtime.mode === "json" || organizations.length === 0) return yield* Effect.fail(inputRequired("Provide --org or select a read default with org use."));
@@ -53730,7 +54658,7 @@ const readOrganization = (config, command, input) => Effect.gen(function* () {
 			}))
 		});
 	}
-	if (!organizations.some((org) => org.id === organizationId)) return yield* Effect.fail(Errors.invalidInput("org", "The Organization is not accessible."));
+	if (!organizations.some((org) => org.id === organizationId) && !resolved.recoverable) return yield* Effect.fail(Errors.invalidInput("org", "The Organization is not accessible."));
 	if (command === "use") {
 		yield* saveOrganizationSelection(config, session.authUserId, organizationId, stillAuthenticated);
 		return {
@@ -53783,11 +54711,13 @@ const readOrganization = (config, command, input) => Effect.gen(function* () {
 	const read = Effect.promise((signal) => scoped.getLifecycle({ signal })).pipe(Effect.flatMap(resultValue));
 	const observed = yield* Effect.gen(function* () {
 		let lifecycle = yield* read;
+		if (resolved.recoverable) yield* requireCurrentAccess(client, organizationId, lifecycle);
 		if (command !== "wait") return lifecycle;
 		while (lifecycle.status !== "ready" && lifecycle.status !== "failed") {
 			yield* Effect.sleep(1e3);
 			lifecycle = yield* read;
 		}
+		if (resolved.recoverable) yield* requireCurrentAccess(client, organizationId, lifecycle);
 		return lifecycle;
 	}).pipe(Effect.timeoutOption(timeout * 1e3));
 	if (Option.isNone(observed)) return yield* Effect.fail(new CliFailure({
@@ -53871,45 +54801,89 @@ const requireWriteConfirmation = (supplied) => Effect.gen(function* () {
 *
 * The committed Organization ID is retained from the first state that carries
 * one and never replaced, so a later failed lane keeps reporting the ID it was
-* committed to. `flush` never resolves a signature on an unwritten line: the
-* command-scoped signer awaits it before forwarding a digest, and a failed or
-* cancelled write throws here instead.
+* committed to. `flush` writes the queued lines first, then makes the ID durable
+* as this person's safe recovery handle, and only then resolves: the
+* command-scoped signer awaits it before forwarding a digest, so a failed or
+* cancelled write saves no handle and forwards no signature.
 */
-const makeOrganizationProgress = (mode, run) => {
+const makeOrganizationProgress = (mode, run, persist) => {
 	const queued = [];
+	const held = [];
+	const heldSet = /* @__PURE__ */ new Set();
 	const written = /* @__PURE__ */ new Set();
 	let committed = null;
+	let persisted = null;
+	let readyAllowed = false;
 	let failure = null;
+	/** One command owns one committed Organization. A second ID is a defect. */
+	const retain = (observed) => {
+		if (committed === null) {
+			committed = observed;
+			return true;
+		}
+		if (committed === observed) return true;
+		failure ??= new CliFailure({
+			code: "CLI_DEFECT",
+			message: "The onboarding stream reported a different Organization.",
+			exitCode: 1,
+			outcome: "failed"
+		});
+		return false;
+	};
+	/**
+	* A ready line waits until the command confirms current access. Every other
+	* line is progress evidence and goes out with the committed ID.
+	*/
+	const enqueue = (text, ready) => {
+		if (written.has(text) || heldSet.has(text)) return;
+		if (ready && !readyAllowed) {
+			heldSet.add(text);
+			held.push(text);
+			return;
+		}
+		written.add(text);
+		queued.push(text);
+	};
 	const render = (state) => {
 		const organizationId = state.organizationId;
 		if (organizationId === null) return null;
-		const observed = String(organizationId);
-		if (committed === null) committed = observed;
-		else if (committed !== observed) {
-			failure ??= new CliFailure({
-				code: "CLI_DEFECT",
-				message: "The onboarding stream reported a different Organization.",
-				exitCode: 1,
-				outcome: "failed"
-			});
-			return null;
-		}
+		if (!retain(String(organizationId))) return null;
 		const status = state.lifecycle?.status;
 		if (status === void 0) return null;
-		return `${mode === "json" ? JSON.stringify({
-			type: "organization.lifecycle",
-			organizationId: committed,
-			status
-		}) : `Organization ${JSON.stringify(committed)}: ${status}`}\n`;
+		return {
+			text: `${mode === "json" ? JSON.stringify({
+				type: "organization.lifecycle",
+				organizationId: committed,
+				status
+			}) : `Organization ${JSON.stringify(committed)}: ${status}`}\n`,
+			ready: status === "ready"
+		};
 	};
 	return {
 		/** Synchronous by contract: the SDK publishes state from its own fiber. */
 		observe: (state) => {
-			const text = render(state);
-			if (text === null || written.has(text)) return;
-			written.add(text);
-			queued.push(text);
-		},
+			const line = render(state);
+			if (line !== null) enqueue(line.text, line.ready);
+		},
+		/** One safe recovery line the command writes before it resumes a lane. */
+		notice: (text) => enqueue(text, false),
+		/** The final result ID joins the same one-Organization rule. */
+		commit: (organizationId) => {
+			retain(organizationId);
+		},
+		/** Release the ready lines once current access is confirmed. */
+		allowReady: () => {
+			readyAllowed = true;
+			while (held.length > 0) {
+				const text = held.shift();
+				heldSet.delete(text);
+				if (written.has(text)) continue;
+				written.add(text);
+				queued.push(text);
+			}
+		},
+		/** The committed ID this command observed, or null when it observed none. */
+		committed: () => committed,
 		failure: () => failure,
 		flush: async () => {
 			while (queued.length > 0) {
@@ -53922,6 +54896,13 @@ const makeOrganizationProgress = (mode, run) => {
 				}
 				queued.shift();
 			}
+			if (committed !== null && persisted !== committed) try {
+				await persist(committed);
+				persisted = committed;
+			} catch (cause) {
+				failure = cause;
+				throw cause;
+			}
 			if (failure !== null) throw failure;
 		}
 	};
@@ -53932,19 +54913,67 @@ const makeOrganizationProgress = (mode, run) => {
 * resolved, and it always asks, even when `--confirm` was supplied. A prompt that
 * cannot be answered is a refusal.
 */
-const confirmOrganizationWrite = (preview) => Effect.gen(function* () {
+const confirmWrite = (preview) => Effect.gen(function* () {
 	yield* writeStderr(`${preview.lines.join("\n")}\n`);
 	if (!(yield* Prompt.confirm({ message: preview.question }).pipe(Effect.catch(() => Effect.succeed(false))))) return yield* Effect.fail(inputRequired("The write was not confirmed."));
 });
-/** The Organization reads a terminal preview shows before it asks. */
-const organizationPreviewLines = (client, organizationId) => organizationId === null ? Effect.gen(function* () {
+/**
+* The Organization reads a terminal preview shows before it asks.
+*
+* A create preview also names the recovery handle this machine already holds, so
+* a person who confirms knows whether the command creates one more Organization
+* or continues the exact one their interrupted journey reached. The preview
+* reads that recorded Organization's lifecycle only when the requested handle
+* continues it; a different handle is a new creation, and the recorded
+* Organization must not block it.
+*/
+const organizationPreview = (client, organizationId, recovery, requestedHandle) => organizationId === null ? Effect.gen(function* () {
 	const organizations = yield* Effect.promise((signal) => client.orgs({ signal })).pipe(Effect.flatMap(resultValue));
-	if (organizations.length === 0) return ["Existing Organizations: none"];
-	return [`Existing Organizations: ${organizations.length}`, ...organizations.map((organization) => `  ${JSON.stringify(String(organization.id))} ${JSON.stringify(organization.name)}`)];
+	const lines = organizations.length === 0 ? ["Existing Organizations: none"] : [`Existing Organizations: ${organizations.length}`, ...organizations.map((organization) => `  ${JSON.stringify(String(organization.id))} ${JSON.stringify(organization.name)}`)];
+	if (recovery === null) return {
+		lines,
+		recovery,
+		recoveryLifecycle: null
+	};
+	const exact = recovery.organizationId;
+	if (exact === null) return {
+		lines: [...lines, `Recovery: a create for handle @${recovery.handle} is prepared on this machine.`],
+		recovery,
+		recoveryLifecycle: null
+	};
+	if (requestedHandle !== recovery.handle) return {
+		lines: [...lines, `Recovery: Organization ${JSON.stringify(String(exact))} (@${recovery.handle}) is recorded on this machine.`],
+		recovery,
+		recoveryLifecycle: null
+	};
+	const lifecycle = yield* Effect.promise((signal) => client.org(exact).getLifecycle({ signal })).pipe(Effect.flatMap(resultValue));
+	yield* requireCurrentAccess(client, exact, lifecycle);
+	return {
+		lines: [
+			...lines,
+			`Recovery: Organization ${JSON.stringify(String(exact))} (@${recovery.handle})`,
+			`Current lifecycle: ${lifecycle.status}`
+		],
+		recovery,
+		recoveryLifecycle: lifecycle
+	};
 }) : Effect.gen(function* () {
-	return [`Current lifecycle: ${(yield* Effect.promise((signal) => client.org(organizationId).getLifecycle({ signal })).pipe(Effect.flatMap(resultValue))).status}`];
+	return {
+		lines: [`Current lifecycle: ${(yield* Effect.promise((signal) => client.org(organizationId).getLifecycle({ signal })).pipe(Effect.flatMap(resultValue))).status}`],
+		recovery,
+		recoveryLifecycle: null
+	};
 });
 /**
+* The confirmation question for a create. A matching recovery handle means the
+* command continues one exact Organization instead of creating another one.
+*/
+const createOrganizationQuestion = (handle, preview) => {
+	if (preview.recovery === null || preview.recovery.organizationId === null) return "Create this Organization?";
+	if (preview.recovery.handle !== handle) return "Create this Organization?";
+	return preview.recoveryLifecycle?.status === "ready" ? "Return this ready Organization?" : "Resume this Organization's setup?";
+};
+/**
 * Settle one exact Organization lifecycle read: poll every second with no
 * overlapping read until the lane is ready or failed. The command's own deadline
 * bounds this loop together with the write that preceded it.
@@ -53958,6 +54987,81 @@ const settleOrganizationLifecycle = (read) => Effect.gen(function* () {
 	return lifecycle;
 });
 /**
+* Resume the exact durable Organization lane through the SDK recovery owner, then
+* settle that exact lifecycle. It never creates an Organization and never
+* resubmits a recorded bootstrap submission.
+*/
+const resumeOrganizationSetup = (operation, scoped, deadline) => Effect.gen(function* () {
+	yield* Effect.promise(() => scoped.retrySetup({ signal: deadline.signal })).pipe(Effect.flatMap(resultValue));
+	const lifecycle = yield* settleOrganizationLifecycle(() => scoped.getLifecycle({ signal: deadline.signal }));
+	yield* requireReadyLifecycle(operation, lifecycle);
+	return lifecycle;
+});
+/**
+* A prepared handle owns the next durable Organization for that handle, so a
+* different handle would create a second Organization and leave the prepared lane
+* abandoned. The refusal names the exact handle to continue.
+*/
+const preparedJourneyRefusal = (handle) => new CliFailure({
+	code: "WRONG_STATE",
+	message: `An Organization creation is already prepared for handle @${handle}. Run capxul org create with the same handle to continue that exact Organization.`,
+	exitCode: 2,
+	outcome: "refused"
+});
+/**
+* Read how this create continues the person's Organization journey.
+*
+* The recovery handle is the only source of the exact identity, so a matching
+* handle resumes the Organization its lane reached and never creates another
+* one. A different handle creates one Organization only after the recorded
+* Organization reaches ready.
+*/
+const readCreateRoute = (client, recovery, handle, signal) => Effect.gen(function* () {
+	if (recovery === null) return {
+		kind: "create",
+		continuesRecorded: false
+	};
+	if (recovery.organizationId === null) {
+		if (recovery.handle === handle) return {
+			kind: "create",
+			continuesRecorded: true
+		};
+		return yield* Effect.fail(preparedJourneyRefusal(recovery.handle));
+	}
+	const lifecycle = yield* Effect.promise(() => client.org(recovery.organizationId).getLifecycle({ signal })).pipe(Effect.flatMap(resultValue));
+	if (recovery.handle === handle) return {
+		kind: "recover",
+		organizationId: recovery.organizationId,
+		handle: recovery.handle,
+		lifecycle
+	};
+	if (lifecycle.status === "ready") return {
+		kind: "create",
+		continuesRecorded: false
+	};
+	return yield* Effect.fail(Errors.wrongState({
+		method: CAPXUL_OPERATIONS.onboarding.completeOrganization,
+		currentState: lifecycle.status,
+		validStates: ["ready"],
+		organizationId: String(recovery.organizationId)
+	}));
+});
+/** One safe recovery line, in the same newline-delimited shape as the lifecycle. */
+const recoveryNotice = (mode, recovery) => mode === "json" ? `${JSON.stringify({
+	type: "organization.recovery",
+	organizationId: String(recovery.organizationId),
+	handle: recovery.handle
+})}\n` : `Recovering Organization ${JSON.stringify(String(recovery.organizationId))} (@${recovery.handle}).\n`;
+/** A taken handle is refused before the backend writes any Organization row. */
+const refusedOrganizationHandle = (error) => isCapxulError(error) && error.code === "INVALID_INPUT" && error.details?.field === "handle";
+/** A write forwards no signature before its recovery handle exists; absence is a defect. */
+const organizationWriteDefect = () => new CliFailure({
+	code: "CLI_DEFECT",
+	message: "The Organization write lost its recovery handle.",
+	exitCode: 1,
+	outcome: "failed"
+});
+/**
 * The one deadline for a write: it aborts the active SDK signal, so the waiting
 * command stops and the signer forwards nothing further, while the durable
 * backend lane keeps running and stays resumable by `org retry`.
@@ -53980,10 +55084,11 @@ const organizationWaitTimeout = () => new CliFailure({
 * the label keeps the existing fallback.
 *
 * `resetSession` is part of the contract the SDK's Organization setup owner
-* calls before it resumes a lane that failed at founder authorization or
-* bootstrap submission. The bridge's own reset stops its loopback server, so a
-* reset here clears the stale readiness, closes that bridge, and lets the next
-* address or digest request open one for the same command.
+* calls before it resumes a lane that failed at founder authorization; a lane
+* that resumes a recorded bootstrap submission does not touch the signer. The
+* bridge's own reset stops its loopback server, so a reset here clears the
+* stale readiness, closes that bridge, and lets the next address or digest
+* request open one for the same command.
 */
 const organizationWriteSigner = (config, opened, run, beforeSignature) => Effect.gen(function* () {
 	const runtime = yield* CliRuntime;
@@ -54066,10 +55171,15 @@ const requireReadyLifecycle = (operation, lifecycle) => lifecycle.status === "re
 * explicit create intent, then settle the exact Organization lifecycle. This
 * never saves a read default and never returns an unrelated ready Organization.
 *
+* A create that meets this person's prepared Organization journey continues that
+* exact Organization: the same handle resumes the lane its ID reached, and a
+* different handle refuses while that lane is unsettled. Neither path creates a
+* replacement Organization or treasury.
+*
 * One deadline covers the write and its settlement. At the deadline the active
 * SDK signal is aborted: the command stops waiting, forwards no further
 * signature, and returns the typed wait failure, while the durable backend lane
-* keeps running and stays resumable by `org retry`.
+* keeps running and stays resumable by the same create or by `org retry`.
 */
 const createOrganization = (config, input) => Effect.gen(function* () {
 	const operation = CAPXUL_OPERATIONS.org.create;
@@ -54079,50 +55189,99 @@ const createOrganization = (config, input) => Effect.gen(function* () {
 	const opened = yield* openAuthenticatedSession(config, input.email);
 	if (interactivelyConfirm) {
 		const preview = yield* restoreVerifiedClient(config, opened, { requirement: "none" });
-		const resolved = yield* organizationPreviewLines(preview.client, null);
-		yield* confirmOrganizationWrite({
+		const recovery = yield* readOrganizationRecovery(config, preview.session.authUserId);
+		const resolved = yield* organizationPreview(preview.client, null, recovery, draft.handle);
+		yield* confirmWrite({
 			lines: [
 				`Create Organization ${JSON.stringify(draft.name)} (@${draft.handle}, ${draft.country})`,
 				...draft.bio === void 0 ? [] : [`Bio: ${JSON.stringify(draft.bio)}`],
 				...draft.size === void 0 ? [] : [`Size: ${JSON.stringify(draft.size)}`],
-				...resolved
+				...resolved.lines
 			],
-			question: "Create this Organization?"
+			question: createOrganizationQuestion(draft.handle, resolved)
 		});
 	}
 	const context = yield* Effect.context();
 	const run = Effect.runPromiseWith(context);
 	const runtime = yield* CliRuntime;
-	const progress = makeOrganizationProgress(runtime.mode, run);
+	const progressRef = yield* Ref.make(null);
 	const deadline = new AbortController();
 	const openfortSignerFactory = yield* organizationWriteSigner(config, opened, run, async () => {
 		const cancelled = cancelledWrite(operation, deadline.signal);
 		if (cancelled !== null) throw cancelled;
-		await progress.flush();
+		const live = await run(Ref.get(progressRef));
+		if (live === null) throw organizationWriteDefect();
+		await live.flush();
 		const stopped = cancelledWrite(operation, deadline.signal);
 		if (stopped !== null) throw stopped;
 	});
-	const { client } = yield* restoreVerifiedClient(config, opened, {
+	const { client, session, stillAuthenticated } = yield* restoreVerifiedClient(config, opened, {
 		requirement: "deployed",
 		openfortSignerFactory
 	});
-	const unsubscribe = client.onboarding.subscribeOrganization(progress.observe);
-	const settled = yield* Effect.gen(function* () {
-		const completed = yield* Effect.promise(() => client.onboarding.completeOrganization(draft, {
-			intent: "create",
-			signal: deadline.signal
-		})).pipe(Effect.ensuring(Effect.sync(unsubscribe)));
+	const recovery = yield* openOrganizationRecovery(config, session.authUserId, stillAuthenticated);
+	const persistRecovery = (organizationId) => Effect.gen(function* () {
+		const committed = yield* onboardingOrganizationId(organizationId);
+		yield* recovery.save({
+			handle: draft.handle,
+			organizationId: committed
+		});
+	});
+	const progress = makeOrganizationProgress(runtime.mode, run, (organizationId) => run(persistRecovery(organizationId)));
+	yield* Ref.set(progressRef, progress);
+	const flushProgress = Effect.gen(function* () {
 		yield* Effect.tryPromise({
 			try: progress.flush,
 			catch: (cause) => cause
 		}).pipe(Effect.catch(() => Effect.void));
 		const localFailure = progress.failure();
 		if (localFailure !== null && localFailure !== void 0) return yield* Effect.fail(localFailure);
-		const onboarding = yield* resultValue(completed);
+	});
+	const settled = yield* Effect.gen(function* () {
+		const route = yield* readCreateRoute(client, recovery.current(), draft.handle, deadline.signal);
+		if (route.kind === "recover") {
+			if (route.lifecycle.status === "ready") {
+				yield* requireCurrentAccess(client, route.organizationId, route.lifecycle);
+				progress.allowReady();
+				return {
+					organizationId: route.organizationId,
+					lifecycle: route.lifecycle
+				};
+			}
+			progress.notice(recoveryNotice(runtime.mode, route));
+			yield* flushProgress;
+			const lifecycle = yield* resumeOrganizationSetup(operation, client.org(route.organizationId), deadline);
+			yield* requireCurrentAccess(client, route.organizationId, lifecycle);
+			progress.allowReady();
+			return {
+				organizationId: route.organizationId,
+				lifecycle
+			};
+		}
+		yield* recovery.save({
+			handle: draft.handle,
+			organizationId: null
+		});
+		const unsubscribe = client.onboarding.subscribeOrganization(progress.observe);
+		const completed = yield* Effect.promise(() => client.onboarding.completeOrganization(draft, {
+			intent: "create",
+			signal: deadline.signal
+		})).pipe(Effect.ensuring(Effect.sync(unsubscribe)));
+		if (!completed.ok) {
+			yield* flushProgress;
+			if (refusedOrganizationHandle(completed.error) && progress.committed() === null) yield* recovery.release();
+			return yield* Effect.fail(completed.error);
+		}
+		const onboarding = completed.value;
 		const organizationId = yield* onboardingOrganizationId(onboarding.organizationId);
+		progress.commit(String(organizationId));
+		yield* flushProgress;
 		const scoped = client.org(organizationId);
 		const lifecycle = yield* settleOrganizationLifecycle(() => scoped.getLifecycle({ signal: deadline.signal }));
 		yield* requireReadyLifecycle(operation, lifecycle);
+		if (route.continuesRecorded) yield* requireCurrentAccess(client, organizationId, lifecycle);
+		progress.allowReady();
+		yield* flushProgress;
 		return {
 			organizationId,
 			lifecycle
@@ -54167,9 +55326,9 @@ const retryOrganization = (config, input) => Effect.gen(function* () {
 	const opened = yield* openAuthenticatedSession(config, input.email);
 	if (interactivelyConfirm) {
 		const preview = yield* restoreVerifiedClient(config, opened, { requirement: "none" });
-		const resolved = yield* organizationPreviewLines(preview.client, organizationId);
-		yield* confirmOrganizationWrite({
-			lines: [`Resume setup for Organization ${JSON.stringify(String(organizationId))}`, ...resolved],
+		const resolved = yield* organizationPreview(preview.client, organizationId, null);
+		yield* confirmWrite({
+			lines: [`Resume setup for Organization ${JSON.stringify(String(organizationId))}`, ...resolved.lines],
 			question: "Resume this Organization's setup?"
 		});
 	}
@@ -54185,12 +55344,7 @@ const retryOrganization = (config, input) => Effect.gen(function* () {
 		openfortSignerFactory
 	});
 	const scoped = client.org(organizationId);
-	const settled = yield* Effect.gen(function* () {
-		yield* Effect.promise(() => scoped.retrySetup({ signal: deadline.signal })).pipe(Effect.flatMap(resultValue));
-		const lifecycle = yield* settleOrganizationLifecycle(() => scoped.getLifecycle({ signal: deadline.signal }));
-		yield* requireReadyLifecycle(operation, lifecycle);
-		return lifecycle;
-	}).pipe(Effect.onInterrupt(() => Effect.sync(() => deadline.abort()))).pipe(Effect.timeoutOption(timeout * 1e3));
+	const settled = yield* resumeOrganizationSetup(operation, scoped, deadline).pipe(Effect.onInterrupt(() => Effect.sync(() => deadline.abort()))).pipe(Effect.timeoutOption(timeout * 1e3));
 	if (Option.isNone(settled)) return yield* Effect.fail(organizationWaitTimeout());
 	return {
 		data: {
@@ -54204,6 +55358,979 @@ const retryOrganization = (config, input) => Effect.gen(function* () {
 	};
 });
 //#endregion
+//#region src/invitation.ts
+const INVITATION_PHASES = [
+	"authorizing",
+	"pending",
+	"pending_grant",
+	"active",
+	"revoking",
+	"declined",
+	"cancelled",
+	"expired",
+	"revoked"
+];
+/** Phases at which a wait has nothing left to watch. */
+const SETTLED_PHASES = /* @__PURE__ */ new Set([
+	"pending",
+	"active",
+	"declined",
+	"cancelled",
+	"expired",
+	"revoked"
+]);
+/** The own-offer projection the CLI reads to resolve one invitation's scope. */
+const OWN_OFFER_PAGE_LIMIT = 100;
+/** The Base Sepolia assets this CLI accepts, by exact key or exact AssetId. */
+const ACCEPTED_ASSETS = TOKENS.BASE_SEPOLIA;
+/** The timeout a read command may omit; the write grammar always carries one. */
+const readOptionalTimeout = (value) => readWriteTimeout(value ?? 120);
+/** One exact Organization scope. Reads may omit it; writes may not. */
+const readExactOrg = (orgs, requirement) => Effect.gen(function* () {
+	const ids = [...new Set(orgs)];
+	if (ids.length > 1) return yield* Effect.fail(inputRequired("Provide one exact Organization ID."));
+	const raw = ids[0];
+	if (raw === void 0) {
+		if (requirement === "required") return yield* Effect.fail(inputRequired("Provide --org."));
+		return null;
+	}
+	return yield* Effect.try({
+		try: () => toOrgId(raw),
+		catch: () => inputRequired("Provide a valid Organization ID.")
+	});
+});
+const readInvitationId = (value) => Effect.gen(function* () {
+	if (value === void 0) return yield* Effect.fail(inputRequired("Provide --invitation-id."));
+	const trimmed = value.trim();
+	if (trimmed.length === 0 || trimmed.length > 256 || /[^\x21-\x7e]/.test(trimmed)) return yield* Effect.fail(inputRequired("Provide a valid --invitation-id."));
+	return trimmed;
+});
+/** One bounded page request. Unknown or duplicate phases refuse before any read. */
+const readPageBounds = (input) => Effect.gen(function* () {
+	const limit = input.limit;
+	if (limit !== void 0 && (!Number.isSafeInteger(limit) || limit < 1 || limit > 100)) return yield* Effect.fail(inputRequired("Provide --limit as an integer from 1 to 100."));
+	const cursor = input.cursor?.trim();
+	if (input.cursor !== void 0 && (cursor === void 0 || cursor.length === 0)) return yield* Effect.fail(inputRequired("Provide a nonempty --cursor."));
+	const requested = input.phases ?? [];
+	if (requested.find((phase) => !INVITATION_PHASES.some((known) => known === phase)) !== void 0) return yield* Effect.fail(inputRequired("Provide --phase from the invitation phases."));
+	if (new Set(requested).size !== requested.length) return yield* Effect.fail(inputRequired("Provide each --phase at most once."));
+	return {
+		...cursor === void 0 ? {} : { cursor },
+		...limit === void 0 ? {} : { limit },
+		...requested.length === 0 ? {} : { phases: requested }
+	};
+});
+/**
+* The Organization of one invitation the caller can already see.
+*
+* The grantee's bounded own-offer projection is what resolves an absent
+* `--org`, for `get` and `wait` alike: a caller who holds no Admin authority
+* still reads their own offer, and a saved read default is never consulted. The
+* row carries its own OrgId, and a row the caller cannot see is refused rather
+* than probed in another scope.
+*
+* The walk follows the versioned cursor until the row is found or the pages
+* end. One 100-row page is not the projection: an invitation the caller can see
+* would otherwise refuse only because it is not the newest.
+*/
+const resolveOwningOrganization = (client, invitationId) => Effect.gen(function* () {
+	let cursor;
+	for (;;) {
+		const page = yield* Effect.promise((signal) => client.orgs.invitations(cursor === void 0 ? { limit: OWN_OFFER_PAGE_LIMIT } : {
+			limit: OWN_OFFER_PAGE_LIMIT,
+			cursor
+		}, { signal })).pipe(Effect.flatMap(resultValue));
+		const match = page.items.find((invitation) => invitation.id === invitationId);
+		if (match !== void 0) return match.orgId;
+		if (page.nextCursor === null) return yield* Effect.fail(Errors.invalidInput("invitationId", "The invitation is not in your available offers. Provide --org to read it directly."));
+		cursor = page.nextCursor;
+	}
+});
+/** The exact scoped bundle a read, transition, or write is about to use. */
+const scopedInvitations = (client, organizationId) => client.org(organizationId).invitations;
+const scopedRead = (client, organizationId, invitationId) => Effect.promise((signal) => scopedInvitations(client, organizationId).get({ invitationId }, { signal })).pipe(Effect.flatMap(resultValue));
+const settled = (invitation) => SETTLED_PHASES.has(invitation.phase) || invitation.recovery !== null && invitation.recovery.action !== "wait";
+const invitationLines = (invitation) => [JSON.stringify({ invitation })];
+const waitTimeout = () => new CliFailure({
+	code: "NETWORK_ERROR",
+	message: "The invitation did not settle within the command deadline.",
+	exitCode: 5,
+	outcome: "failed"
+});
+/** The same dependency failure, named for the phase it happened in. */
+const resolutionTimeout = () => new CliFailure({
+	code: "NETWORK_ERROR",
+	message: "The invitation's Organization could not be resolved within the command deadline.",
+	exitCode: 5,
+	outcome: "failed"
+});
+const deadlineFailure = (message) => new CliFailure({
+	code: "NETWORK_ERROR",
+	message,
+	exitCode: 5,
+	outcome: "failed"
+});
+/** Bound one scoped operation by the command's own deadline; the backend keeps its state. */
+const withinDeadline = (effect, timeoutSeconds, message) => Effect.gen(function* () {
+	const settledResult = yield* effect.pipe(Effect.timeoutOption(timeoutSeconds * 1e3));
+	if (Option.isNone(settledResult)) return yield* Effect.fail(deadlineFailure(message));
+	return settledResult.value;
+});
+/**
+* `capxul org invite list|get|wait|review`.
+*
+* `list` is the authenticated grantee's own offers. With `--org` it is the
+* Admin's view of that Organization's invitations instead: one explicit scope,
+* never a saved read default, and never a silent change of what plain `list`
+* returns. `--mine` stays the own-offer projection's declared no-op; combined
+* with `--org` it refuses, because the scoped route has no invitee filter and
+* ignoring the flag would return a wider view than the operator asked for.
+*
+* `get` and `wait` read one invitation in the Organization named by `--org`,
+* or resolved from the offer's own row when `--org` is absent. A wait only
+* reads: it never retries, resends, or accepts.
+*/
+const readInvitation = (config, action, input) => {
+	const timeout = readOptionalTimeout(input.timeoutSeconds);
+	return Effect.gen(function* () {
+		const bounds = yield* readPageBounds(input);
+		const invitationId = action === "list" ? null : yield* readInvitationId(input.invitationId);
+		const explicitOrg = yield* readExactOrg(input.orgs ?? [], "optional");
+		if (action === "review" && explicitOrg === null) return yield* Effect.fail(inputRequired("Provide --org to review this invitation."));
+		if (action === "list" && input.mine === true && explicitOrg !== null) return yield* Effect.fail(inputRequired("Provide either --mine or --org; the Organization list is not filtered to you."));
+		const timeoutSeconds = yield* timeout;
+		const { client } = yield* restoreAuthenticatedClient(config, input.email);
+		if (action === "list") return listResult(yield* Effect.promise((signal) => explicitOrg === null ? client.orgs.invitations(bounds, { signal }) : client.org(explicitOrg).invitations.list(bounds, { signal })).pipe(Effect.flatMap(resultValue)));
+		if (invitationId === null) return yield* Effect.fail(inputRequired("Provide --invitation-id."));
+		const resolveOrganizationId = () => explicitOrg === null ? resolveOwningOrganization(client, invitationId) : Effect.succeed(explicitOrg);
+		if (action === "get" || action === "review") {
+			const invitation = yield* withinDeadline(Effect.gen(function* () {
+				const resolved = action === "review" ? explicitOrg : yield* resolveOrganizationId();
+				if (resolved === null) return yield* Effect.fail(inputRequired("Provide --org."));
+				return yield* scopedRead(client, resolved, invitationId);
+			}), timeoutSeconds, "The invitation read did not settle within the command deadline.");
+			return {
+				data: action === "review" ? invitation : { invitation },
+				lines: invitationLines(invitation)
+			};
+		}
+		let resolving = true;
+		const observed = yield* Effect.gen(function* () {
+			const resolved = yield* resolveOrganizationId();
+			resolving = false;
+			let invitation = yield* scopedRead(client, resolved, invitationId);
+			while (!settled(invitation)) {
+				yield* Effect.sleep(1e3);
+				invitation = yield* scopedRead(client, resolved, invitationId);
+			}
+			return invitation;
+		}).pipe(Effect.timeoutOption(timeoutSeconds * 1e3));
+		if (Option.isNone(observed)) return yield* Effect.fail(resolving ? resolutionTimeout() : waitTimeout());
+		return {
+			data: { invitation: observed.value },
+			lines: invitationLines(observed.value)
+		};
+	});
+};
+function listResult(page) {
+	return {
+		data: {
+			invitations: page.items,
+			nextCursor: page.nextCursor,
+			observedAt: page.observedAt
+		},
+		lines: [...page.items.map((invitation) => JSON.stringify(invitation)), ...page.nextCursor === null ? [] : [`Next cursor: ${JSON.stringify(page.nextCursor)}`]]
+	};
+}
+/**
+* `capxul org invite decline|cancel|resend|retry`.
+*
+* Every transition needs the exact Organization in both modes: an invitation
+* write never consults the read default. A terminal writes `--confirm`; a
+* terminal run always sees the resolved current offer and answers a default-no
+* prompt. The command forwards no acceptance consent: these four transitions
+* end or retry work that already exists.
+*/
+const transitionInvitation = (config, action, input) => Effect.gen(function* () {
+	const invitationId = yield* readInvitationId(input.invitationId);
+	const organizationId = yield* readExactOrg(input.orgs, "required");
+	if (organizationId === null) return yield* Effect.fail(inputRequired("Provide --org."));
+	const timeoutSeconds = yield* readWriteTimeout(input.timeoutSeconds);
+	const interactivelyConfirm = yield* requireWriteConfirmation(input.confirm);
+	const { client } = yield* restoreAuthenticatedClient(config, input.email);
+	if (interactivelyConfirm) {
+		const current = yield* scopedRead(client, organizationId, invitationId);
+		yield* confirmWrite({
+			lines: [`${action} invitation ${JSON.stringify(invitationId)} in Organization ${JSON.stringify(String(organizationId))}`, `Current phase: ${current.phase}; delivery: ${current.delivery}`],
+			question: `${action === "resend" ? "Resend" : action.charAt(0).toUpperCase() + action.slice(1)} this invitation?`
+		});
+	}
+	const invitation = yield* withinDeadline(Effect.promise((signal) => scopedInvitations(client, organizationId)[action]({ invitationId }, { signal })).pipe(Effect.flatMap(resultValue)), timeoutSeconds, "The invitation transition did not settle within the command deadline.");
+	return {
+		data: { invitation },
+		lines: invitationLines(invitation)
+	};
+});
+/** The wire's bytes32 form, lowercased: the digest an acceptance states. */
+const readOfferDigest = (value, flag) => Effect.gen(function* () {
+	const trimmed = value?.trim() ?? "";
+	if (!/^0x[0-9a-fA-F]{64}$/.test(trimmed)) return yield* Effect.fail(inputRequired(`Provide ${flag} as a 0x-prefixed 32-byte digest.`));
+	return trimmed.toLowerCase();
+});
+/**
+* `capxul org invite accept --invitation-id I --offer-digest D`.
+*
+* Acceptance is the grantee's explicit consent, so the digest is the whole
+* write: the command forwards the digest the operator states and never invents
+* one. A noninteractive run must state it (`--offer-digest`, with `--confirm`);
+* an interactive run may leave it out, and then the command reads the offer and
+* fills D from the exact digest it displayed, behind the same preview/confirm
+* prompt the other writes use. A stated digest is never replaced by the
+* displayed one — a mismatch is the backend's typed refusal, not a silent
+* rewrite of what the operator consented to.
+*
+* The command signs nothing: the grant is executed by the deployment's
+* technical granter after the consent commits. Only the exact grantee can
+* accept; Admin access to the offer does not grant consent authority.
+*/
+const acceptInvitation = (config, input) => Effect.gen(function* () {
+	const invitationId = yield* readInvitationId(input.invitationId);
+	const organizationId = yield* readExactOrg(input.orgs, "required");
+	if (organizationId === null) return yield* Effect.fail(inputRequired("Provide --org."));
+	const timeoutSeconds = yield* readWriteTimeout(input.timeoutSeconds);
+	const runtime = yield* CliRuntime;
+	const interactive = runtime.tty && !runtime.ci && runtime.mode !== "json";
+	const canonical = input.offerDigest === void 0 ? null : yield* readOfferDigest(input.offerDigest, "--offer-digest");
+	const compatibility = input.expectedOfferDigest === void 0 ? null : yield* readOfferDigest(input.expectedOfferDigest, "--expected-offer");
+	if (canonical !== null && compatibility !== null && canonical !== compatibility) return yield* Effect.fail(inputRequired("Provide matching --offer-digest and --expected-offer values."));
+	const stated = canonical ?? compatibility;
+	if (stated === null && !interactive) return yield* Effect.fail(inputRequired("Provide --offer-digest to accept this invitation."));
+	const interactivelyConfirm = yield* requireWriteConfirmation(input.confirm);
+	const { client } = yield* restoreAuthenticatedClient(config, input.email);
+	let expectedOfferDigest = stated;
+	if (interactivelyConfirm) {
+		const current = yield* scopedRead(client, organizationId, invitationId);
+		yield* confirmWrite({
+			lines: [
+				`Accept invitation ${JSON.stringify(invitationId)} in Organization ${JSON.stringify(String(organizationId))}`,
+				`Current offer digest: ${current.offerDigest}`,
+				`Current phase: ${current.phase}; expires at: ${String(current.expiresAt)}`
+			],
+			question: "Accept this offer?"
+		});
+		expectedOfferDigest ??= current.offerDigest;
+	}
+	if (expectedOfferDigest === null) return yield* Effect.fail(inputRequired("Provide --offer-digest to accept."));
+	const invitation = yield* withinDeadline(Effect.promise((signal) => scopedInvitations(client, organizationId).accept({
+		invitationId,
+		expectedOfferDigest
+	}, { signal })).pipe(Effect.flatMap(resultValue)), timeoutSeconds, "The invitation acceptance did not settle within the command deadline.");
+	return {
+		data: invitation,
+		lines: invitationLines(invitation)
+	};
+});
+/**
+* An exact zero, in the helper's own zero form (`parse-money.ts` tests the same
+* shape, with commas already stripped). It discriminates a zero from a negative
+* value, which the helper reports under the same `non-positive` reason.
+*/
+const ZERO_CAP = /^0+(?:\.0+)?$/;
+/**
+* One finite Budget cap.
+*
+* The value goes through the shared amount helper first, so the owner keeps its
+* grammar, its 100-character guard, its precision, and its sign rule. Exactly
+* one of the helper's verdicts does not apply to a Budget cap: `non-positive`
+* for an exact zero, which `d9.md` §3 set B permits. That verdict, and only
+* that one, becomes the legal zero cap.
+*/
+const readFiniteLimit = (raw, metadata) => Effect.gen(function* () {
+	const parsed = yield* Effect.try({
+		try: () => parseAssetAmount(raw, metadata),
+		catch: () => inputRequired("Provide --limit as an exact decimal quantity.")
+	});
+	if (!("kind" in parsed)) return parsed.value;
+	if (parsed.reason === "non-positive" && ZERO_CAP.test(raw.trim().replaceAll(",", ""))) return "0";
+	return yield* Effect.fail(inputRequired("Provide --limit as an exact decimal quantity."));
+});
+/** One exact asset: a catalog key or the exact AssetId those keys name. */
+function resolveAssetId(raw) {
+	const candidate = raw.trim();
+	const named = Object.entries(ACCEPTED_ASSETS).find(([key]) => key === candidate);
+	if (named !== void 0) return named[1];
+	return Object.values(ACCEPTED_ASSETS).find((assetId) => assetId === candidate) ?? null;
+}
+/** The complete `B` policy flag set for exactly one new Budget. */
+const readNewBudgetGrant = (flags) => Effect.gen(function* () {
+	const label = flags.label.trim();
+	if (label.length === 0 || label.length > 128) return yield* Effect.fail(inputRequired("Provide --new-budget-name with 1 to 128 characters."));
+	const rawAsset = flags.asset?.trim() ?? "";
+	if (rawAsset.length === 0) return yield* Effect.fail(inputRequired("Provide --asset for --new-budget-name."));
+	const assetId = resolveAssetId(rawAsset);
+	if (assetId === null) return yield* Effect.fail(inputRequired("Provide --asset as CAPXUL_TEST_USDC, CAPXUL_TEST_USDT, CAPXUL_TEST_WETH, or one exact AssetId."));
+	const metadata = yield* Effect.try({
+		try: () => requireAsset(assetId),
+		catch: () => inputRequired("Provide an admitted --asset.")
+	});
+	if (flags.unlimited === (flags.limit !== void 0)) return yield* Effect.fail(inputRequired("Provide exactly one of --limit or --unlimited."));
+	let limit = null;
+	if (!flags.unlimited) limit = yield* readFiniteLimit(String(flags.limit), metadata);
+	const recipients = yield* readRecipients(flags);
+	const actions = yield* readActions(flags.actions);
+	return {
+		type: "new_budget",
+		label,
+		intent: {
+			type: "budget",
+			asset: assetId,
+			limit,
+			scope: {
+				recipients,
+				actions
+			}
+		}
+	};
+});
+/** 1–32 distinct recipient Accounts, or the explicit anyone scope. */
+function readRecipients(flags) {
+	return Effect.gen(function* () {
+		if (flags.anyRecipient === flags.recipientAccounts.length > 0) return yield* Effect.fail(inputRequired("Provide exactly one of --any-recipient or --recipient-account."));
+		if (flags.anyRecipient) return { type: "anyone" };
+		const accounts = [...new Set(flags.recipientAccounts)];
+		if (accounts.length > 32) return yield* Effect.fail(inputRequired("Provide at most 32 --recipient-account values."));
+		return {
+			type: "allowlist",
+			accounts: yield* Effect.forEach(accounts, (accountId) => Effect.try({
+				try: () => toAccountId(accountId),
+				catch: () => inputRequired("Provide each --recipient-account as an Account ID.")
+			}))
+		};
+	});
+}
+/** One or both distinct action codes, in the canonical pay-then-commitments order. */
+function readActions(raw) {
+	return Effect.gen(function* () {
+		const requested = raw.flatMap((value) => value.split(",")).map((value) => value.trim());
+		if (requested.find((value) => value !== "pay" && value !== "commitments") !== void 0 || requested.some((value) => value.length === 0)) return yield* Effect.fail(inputRequired("Provide --actions as pay, commitments, or both."));
+		const [first, ...rest] = ["pay", "commitments"].filter((action) => requested.some((value) => value === action));
+		if (first === void 0) return yield* Effect.fail(inputRequired("Provide --actions as pay, commitments, or both."));
+		return [first, ...rest];
+	});
+}
+/**
+* The new-Budget policy flags that were supplied. None of them means anything
+* without `--new-budget-name`: a request that silently ignored them would
+* authorize an offer the operator never stated.
+*/
+function orphanedNewBudgetFlags(input) {
+	if (input.newBudgetName !== void 0) return [];
+	return [
+		...input.asset === void 0 ? [] : ["--asset"],
+		...input.limit === void 0 ? [] : ["--limit"],
+		...input.unlimited ? ["--unlimited"] : [],
+		...input.recipientAccounts.length === 0 ? [] : ["--recipient-account"],
+		...input.anyRecipient ? ["--any-recipient"] : [],
+		...input.actions.length === 0 ? [] : ["--actions"]
+	];
+}
+/** The bounded request one invite submits, with every grant in canonical order. */
+const buildInviteRequest = (input) => Effect.gen(function* () {
+	const orphaned = orphanedNewBudgetFlags(input);
+	if (orphaned.length > 0) return yield* Effect.fail(inputRequired(`Provide --new-budget-name with ${orphaned.join(", ")}.`));
+	const toEmail = input.toEmail?.trim() ?? "";
+	const accountId = input.accountId?.trim() ?? "";
+	if (toEmail.length === 0 === (accountId.length === 0)) return yield* Effect.fail(inputRequired("Provide exactly one of --to-email or --account-id."));
+	const grants = [];
+	for (const budgetId of new Set(input.budgetIds)) {
+		if (budgetId.trim().length === 0) return yield* Effect.fail(inputRequired("Provide each --budget-id as a nonempty ID."));
+		grants.push({
+			type: "budget",
+			budgetId: toPermissionId(budgetId.trim())
+		});
+	}
+	for (const permissionId of new Set(input.permissionIds)) {
+		if (permissionId.trim().length === 0) return yield* Effect.fail(inputRequired("Provide each --permission-id as a nonempty ID."));
+		grants.push({
+			type: "managePeople",
+			permissionId: toPermissionId(permissionId.trim())
+		});
+	}
+	if (input.newBudgetName !== void 0) grants.push(yield* readNewBudgetGrant({
+		label: input.newBudgetName,
+		asset: input.asset,
+		limit: input.limit,
+		unlimited: input.unlimited,
+		recipientAccounts: input.recipientAccounts,
+		anyRecipient: input.anyRecipient,
+		actions: input.actions
+	}));
+	if (grants.length === 0) return yield* Effect.fail(inputRequired("Provide at least one of --budget-id, --permission-id, or --new-budget-name."));
+	if (grants.length > 16) return yield* Effect.fail(inputRequired("Provide at most 16 grants."));
+	return {
+		to: toEmail.length > 0 ? {
+			type: "email",
+			email: toEmail
+		} : {
+			type: "account",
+			accountId: yield* Effect.try({
+				try: () => toAccountId(accountId),
+				catch: () => inputRequired("Provide a valid --account-id.")
+			})
+		},
+		grants
+	};
+});
+const readRequestKey = (value) => Effect.gen(function* () {
+	const trimmed = value?.trim() ?? "";
+	if (trimmed.length === 0 || trimmed.length > 128 || !/^[A-Za-z0-9_.-]+$/.test(trimmed)) return yield* Effect.fail(inputRequired("Provide --request-key as 1 to 128 letters, digits, underscore, hyphen, or dot."));
+	return trimmed;
+});
+/**
+* The D9 §6 authoring progress line: the durable `{invitationId, commandId}`
+* pair, written before the configuration digest exists so a lost response is
+* recoverable by the same identity.
+*/
+const preparedLine = (mode, prepared) => mode === "json" ? `${JSON.stringify({
+	type: "invitation.prepared",
+	...prepared
+})}\n` : `Invitation prepared: invitationId=${prepared.invitationId} commandId=${prepared.commandId}\n`;
+/**
+* `capxul org member invite`.
+*
+* `--preview` is a read: it shows the exact resolved offer, creates nothing, and
+* opens no browser. The write needs `--org` in both modes, `--confirm` and
+* `--request-key` non-interactively, and it prints the key it used before it
+* submits, so a lost response is replayed with the same identity instead of
+* authoring a second offer.
+*
+* The write also executes the offer's configuration hop: the Admin's personal
+* embedded wallet signs the stored configure UserOperation through the same
+* command-scoped browser bridge the other Organization writes use. The bridge
+* is composed only after confirmation, and the durable identity reaches stderr
+* before any digest is forwarded.
+*/
+const inviteInvitationMember = (config, input) => Effect.gen(function* () {
+	const request = yield* buildInviteRequest(input);
+	const organizationId = yield* readExactOrg(input.orgs, "required");
+	if (organizationId === null) return yield* Effect.fail(inputRequired("Provide --org."));
+	const timeoutSeconds = yield* readWriteTimeout(input.timeoutSeconds);
+	const runtime = yield* CliRuntime;
+	const interactive = runtime.tty && !runtime.ci && runtime.mode !== "json";
+	if (!input.preview && !interactive) {
+		yield* readRequestKey(input.requestKey);
+		yield* requireWriteConfirmation(input.confirm);
+	}
+	const opened = yield* openAuthenticatedSession(config, input.email);
+	if (input.preview) {
+		const { client } = yield* restoreVerifiedClient(config, opened);
+		const preview = yield* withinDeadline(Effect.promise((signal) => scopedInvitations(client, organizationId).preview(request, { signal })).pipe(Effect.flatMap(resultValue)), timeoutSeconds, "The invitation preview did not settle within the command deadline.");
+		return previewResult(preview);
+	}
+	const requestKey = input.requestKey === void 0 ? (yield* generateRequestKey()).trim() : yield* readRequestKey(input.requestKey);
+	if (interactive) {
+		yield* writeStderr(`${JSON.stringify({
+			type: "invitation.requestKey",
+			requestKey
+		})}\n`);
+		const { client } = yield* restoreVerifiedClient(config, opened);
+		const preview = yield* withinDeadline(Effect.promise((signal) => scopedInvitations(client, organizationId).preview(request, { signal })).pipe(Effect.flatMap(resultValue)), timeoutSeconds, "The invitation preview did not settle within the command deadline.");
+		yield* confirmWrite({
+			lines: [`Invite ${JSON.stringify(request.to)} to Organization ${JSON.stringify(String(organizationId))}`, ...previewLines(preview)],
+			question: "Authorize this invitation?"
+		});
+	}
+	const context = yield* Effect.context();
+	const run = Effect.runPromiseWith(context);
+	const deadline = new AbortController();
+	const openfortSignerFactory = yield* organizationWriteSigner(config, opened, run, async () => {
+		const cancelled = cancelledWrite(CAPXUL_OPERATIONS.org.invitations.authorize, deadline.signal);
+		if (cancelled !== null) throw cancelled;
+	});
+	const { client } = yield* restoreVerifiedClient(config, opened, {
+		requirement: "deployed",
+		openfortSignerFactory
+	});
+	const invitations = scopedInvitations(client, organizationId);
+	const invitation = yield* withinDeadline(Effect.promise((signal) => {
+		const forwardAbort = () => deadline.abort();
+		if (signal.aborted) forwardAbort();
+		else signal.addEventListener("abort", forwardAbort, { once: true });
+		return invitations.invite({
+			requestKey,
+			...request
+		}, {
+			signal,
+			onPrepared: async (prepared) => {
+				await run(writeStderr(preparedLine(runtime.mode, prepared)));
+			}
+		}).finally(() => signal.removeEventListener("abort", forwardAbort));
+	}).pipe(Effect.flatMap(resultValue)), timeoutSeconds, "The invitation did not settle within the command deadline.");
+	return {
+		data: { invitation },
+		lines: invitationLines(invitation)
+	};
+});
+const generateRequestKey = () => Effect.gen(function* () {
+	return yield* (yield* Crypto.Crypto).randomUUIDv4;
+});
+const previewResult = (preview) => ({
+	data: { preview },
+	lines: previewLines(preview)
+});
+const previewLines = (preview) => [
+	`Grantee: ${JSON.stringify({
+		safeAddress: preview.grantee.safeAddress,
+		partyId: preview.grantee.partyId,
+		accountReady: preview.grantee.accountReady
+	})}`,
+	...preview.grants.map((grant) => `Offer: ${JSON.stringify(grant)}`),
+	`Existing assignments: ${String(preview.existingAssignments.length)}`,
+	`Includes management: ${String(preview.includesManagement)}`
+];
+//#endregion
+//#region src/commands/org-invite.ts
+const emailFlag$2 = Flag.string("email").pipe(Flag.optional);
+const orgFlag$2 = Flag.string("org").pipe(Flag.withAlias("org-id"), Flag.atLeast(0));
+const invitationIdFlag = Flag.string("invitation-id").pipe(Flag.optional);
+const timeoutFlag$1 = Flag.integer("timeout-seconds").pipe(Flag.withDefault(120));
+const confirmFlag$2 = Flag.boolean("confirm").pipe(Flag.withDefault(false));
+const metadata$2 = (name) => ({
+	name,
+	capability: "organization",
+	observation: "command"
+});
+/** Reads and transitions carry the exact invitation ID; only list does not. */
+const target = {
+	email: emailFlag$2,
+	orgs: orgFlag$2,
+	invitationId: invitationIdFlag
+};
+const executeRead = (action, input) => runCommand({
+	...metadata$2(`org.invite.${action}`),
+	network: true
+}, (config) => readInvitation(config, action, input));
+const executeTransition = (action, input) => runCommand({
+	...metadata$2(`org.invite.${action}`),
+	network: true
+}, (config) => transitionInvitation(config, action, input));
+const list$1 = Command.make("list", {
+	email: emailFlag$2,
+	orgs: orgFlag$2,
+	limit: Flag.integer("limit").pipe(Flag.optional),
+	cursor: Flag.string("cursor").pipe(Flag.optional),
+	phases: Flag.string("phase").pipe(Flag.atLeast(0)),
+	mine: Flag.boolean("mine").pipe(Flag.withDescription("Your own offers; accepted as a no-op on the plain list"), Flag.withDefault(false))
+}, ({ email, orgs, limit, cursor, phases, mine }) => executeRead("list", {
+	email: Option.getOrUndefined(email),
+	orgs,
+	limit: Option.getOrUndefined(limit),
+	cursor: Option.getOrUndefined(cursor),
+	phases: phases.length === 0 ? void 0 : phases,
+	mine
+})).pipe(Command.annotate(CliCommandMetadata, metadata$2("org.invite.list")), Command.withDescription("List your own invitation offers, or an Organization's with --org; the result carries invitations, nextCursor, and observedAt"));
+const get = Command.make("get", {
+	...target,
+	timeoutSeconds: timeoutFlag$1
+}, ({ email, orgs, invitationId, timeoutSeconds }) => executeRead("get", {
+	email: Option.getOrUndefined(email),
+	orgs,
+	invitationId: Option.getOrUndefined(invitationId),
+	timeoutSeconds
+})).pipe(Command.annotate(CliCommandMetadata, metadata$2("org.invite.get")), Command.withDescription("Read one invitation, in --org or its own resolved Organization"));
+const wait$1 = Command.make("wait", {
+	...target,
+	timeoutSeconds: timeoutFlag$1
+}, ({ email, orgs, invitationId, timeoutSeconds }) => executeRead("wait", {
+	email: Option.getOrUndefined(email),
+	orgs,
+	invitationId: Option.getOrUndefined(invitationId),
+	timeoutSeconds
+})).pipe(Command.annotate(CliCommandMetadata, metadata$2("org.invite.wait")), Command.withDescription("Poll one invitation read until it settles; never writes"));
+const review = Command.make("review", {
+	...target,
+	timeoutSeconds: timeoutFlag$1
+}, ({ email, orgs, invitationId, timeoutSeconds }) => executeRead("review", {
+	email: Option.getOrUndefined(email),
+	orgs,
+	invitationId: Option.getOrUndefined(invitationId),
+	timeoutSeconds
+})).pipe(Command.annotate(CliCommandMetadata, metadata$2("org.invite.review")), Command.withDescription("Review one exact current offer without writing or signing"));
+const transition = (name) => Command.make(name, {
+	...target,
+	confirm: confirmFlag$2,
+	timeoutSeconds: timeoutFlag$1
+}, ({ email, orgs, invitationId, confirm, timeoutSeconds }) => executeTransition(name, {
+	email: Option.getOrUndefined(email),
+	orgs,
+	invitationId: Option.getOrUndefined(invitationId),
+	confirm,
+	timeoutSeconds
+})).pipe(Command.annotate(CliCommandMetadata, metadata$2(`org.invite.${name}`)), Command.withDescription(name === "decline" ? "Decline your own pending offer; starts its cleanup" : name === "cancel" ? "Cancel a pending offer you administer; starts its cleanup" : name === "resend" ? "Retry delivery of a verified pending offer; never extends expiry" : "Resume the current offer state; creates no new consent or grant"));
+/**
+* The one consent command. `--offer-digest` is canonical; `--expected-offer`
+* remains a compatibility spelling and conflicting values refuse.
+*/
+const accept = Command.make("accept", {
+	...target,
+	offerDigest: Flag.string("offer-digest").pipe(Flag.optional),
+	expectedOffer: Flag.string("expected-offer").pipe(Flag.optional),
+	confirm: confirmFlag$2,
+	timeoutSeconds: timeoutFlag$1
+}, ({ email, orgs, invitationId, offerDigest, expectedOffer, confirm, timeoutSeconds }) => runCommand({
+	...metadata$2("org.invite.accept"),
+	network: true
+}, (config) => acceptInvitation(config, {
+	email: Option.getOrUndefined(email),
+	orgs,
+	invitationId: Option.getOrUndefined(invitationId),
+	offerDigest: Option.getOrUndefined(offerDigest),
+	expectedOfferDigest: Option.getOrUndefined(expectedOffer),
+	confirm,
+	timeoutSeconds
+}))).pipe(Command.annotate(CliCommandMetadata, metadata$2("org.invite.accept")), Command.withDescription("Accept one exact offer by its current digest and start its grant; noninteractive runs must supply --offer-digest"));
+const invite = Command.make("invite").pipe(Command.annotate(CliCommandMetadata, metadata$2(CAPXUL_OPERATIONS.org.invite)), Command.withDescription("Invitation reads, the consent commit, and the transitions"), Command.withSubcommands([
+	list$1,
+	get,
+	wait$1,
+	review,
+	accept,
+	transition("decline"),
+	transition("cancel"),
+	transition("resend"),
+	transition("retry")
+]));
+const newBudgetFlags = {
+	newBudgetName: Flag.string("new-budget-name").pipe(Flag.optional),
+	asset: Flag.string("asset").pipe(Flag.optional),
+	limit: Flag.string("limit").pipe(Flag.optional),
+	unlimited: Flag.boolean("unlimited").pipe(Flag.withDefault(false)),
+	recipientAccounts: Flag.string("recipient-account").pipe(Flag.atLeast(0)),
+	anyRecipient: Flag.boolean("any-recipient").pipe(Flag.withDefault(false)),
+	actions: Flag.string("actions").pipe(Flag.atLeast(0))
+};
+const memberInvite = Command.make("invite", {
+	email: emailFlag$2,
+	orgs: orgFlag$2,
+	toEmail: Flag.string("to-email").pipe(Flag.optional),
+	accountId: Flag.string("account-id").pipe(Flag.optional),
+	budgetIds: Flag.string("budget-id").pipe(Flag.atLeast(0)),
+	permissionIds: Flag.string("permission-id").pipe(Flag.atLeast(0)),
+	...newBudgetFlags,
+	requestKey: Flag.string("request-key").pipe(Flag.optional),
+	preview: Flag.boolean("preview").pipe(Flag.withDefault(false)),
+	confirm: confirmFlag$2,
+	timeoutSeconds: timeoutFlag$1
+}, ({ email, orgs, toEmail, accountId, budgetIds, permissionIds, newBudgetName, asset, limit, unlimited, recipientAccounts, anyRecipient, actions, requestKey, preview, confirm, timeoutSeconds }) => {
+	return runCommand({
+		...metadata$2("org.member.invite"),
+		network: true
+	}, (config) => inviteInvitationMember(config, {
+		email: Option.getOrUndefined(email),
+		orgs,
+		toEmail: Option.getOrUndefined(toEmail),
+		accountId: Option.getOrUndefined(accountId),
+		budgetIds,
+		permissionIds,
+		newBudgetName: Option.getOrUndefined(newBudgetName),
+		asset: Option.getOrUndefined(asset),
+		limit: Option.getOrUndefined(limit),
+		unlimited,
+		recipientAccounts,
+		anyRecipient,
+		actions,
+		requestKey: Option.getOrUndefined(requestKey),
+		preview,
+		confirm,
+		timeoutSeconds
+	}));
+}).pipe(Command.annotate(CliCommandMetadata, metadata$2("org.member.invite")), Command.withDescription("Authorize one exact invitation offer; --preview writes nothing"));
+//#endregion
+//#region src/platform/bounded-text.ts
+var UpdateUnavailable = class extends Data.TaggedError("UpdateUnavailable") {};
+const boundedText = (stream, limit) => Effect.suspend(() => {
+	let size = 0;
+	return stream.pipe(Stream.mapEffect((chunk) => {
+		size += chunk.byteLength;
+		return size > limit ? Effect.fail(new UpdateUnavailable()) : Effect.succeed(chunk);
+	}), Stream.decodeText(), Stream.runFold(() => "", (text, chunk) => text + chunk));
+});
+//#endregion
+//#region src/contact.ts
+const AddInputJson = Schema.Struct({
+	ref: Schema.Union([
+		Schema.Struct({
+			kind: Schema.Literal("handle"),
+			handle: Schema.NonEmptyString
+		}),
+		Schema.Struct({
+			kind: Schema.Literal("email"),
+			email: Schema.NonEmptyString
+		}),
+		Schema.Struct({
+			kind: Schema.Literal("address"),
+			address: Schema.NonEmptyString
+		}),
+		Schema.Struct({
+			kind: Schema.Literal("party"),
+			partyId: Schema.NonEmptyString
+		})
+	]),
+	label: Schema.optional(Schema.String)
+});
+const parseAddInput = (text) => Schema.decodeUnknownEffect(Schema.fromJsonString(AddInputJson), { onExcessProperty: "error" })(text).pipe(Effect.flatMap((value) => {
+	try {
+		const ref = value.ref.kind === "address" ? {
+			kind: "address",
+			address: toAddress(value.ref.address)
+		} : value.ref.kind === "party" ? {
+			kind: "party",
+			partyId: toPartyId(value.ref.partyId)
+		} : value.ref;
+		return Effect.succeed({
+			ref,
+			...value.label === void 0 ? {} : { label: value.label }
+		});
+	} catch (cause) {
+		return Effect.fail(cause);
+	}
+}), Effect.mapError(() => inputRequired("Provide --input with one valid AddressBookAddInput JSON object.")));
+const readAddInput = (source) => Effect.gen(function* () {
+	if (source === void 0) {
+		const runtime = yield* CliRuntime;
+		if (!runtime.tty || runtime.ci || runtime.mode === "json") return yield* Effect.fail(inputRequired("Provide --input FILE|- with one AddressBookAddInput JSON object."));
+		const kind = yield* Prompt.select({
+			message: "Reference kind",
+			choices: [
+				"handle",
+				"email",
+				"address",
+				"party"
+			].map((value) => ({
+				title: value,
+				value
+			}))
+		});
+		const value = (yield* Prompt.text({ message: "Reference value" })).trim();
+		const label = (yield* Prompt.text({ message: "Label (optional)" })).trim();
+		return yield* parseAddInput(JSON.stringify({
+			ref: kind === "handle" ? {
+				kind,
+				handle: value
+			} : kind === "email" ? {
+				kind,
+				email: value
+			} : kind === "address" ? {
+				kind,
+				address: value
+			} : {
+				kind,
+				partyId: value
+			},
+			...label === "" ? {} : { label }
+		}));
+	}
+	const text = source === "-" ? yield* boundedText((yield* Stdio.Stdio).stdin, 65536) : yield* Effect.gen(function* () {
+		const fs = yield* FileSystem.FileSystem;
+		return yield* boundedText(fs.stream(source, { bytesToRead: 65537 }), 65536);
+	});
+	return yield* parseAddInput(text);
+}).pipe(Effect.mapError((error) => error instanceof CliFailure ? error : inputRequired("The contact input file could not be read or was too large.")));
+const partyId = (value) => Effect.try({
+	try: () => toPartyId(value),
+	catch: () => inputRequired("Provide a valid --entry-id.")
+});
+const selectedBook = (client, actor, orgs) => Effect.gen(function* () {
+	const ids = [...new Set(orgs)];
+	if (ids.length > 1) return yield* Effect.fail(inputRequired("Provide one exact Organization ID."));
+	if (actor === "personal") {
+		if (ids.length > 0) return yield* Effect.fail(inputRequired("Personal contacts do not accept --org."));
+		return client.account.addressBook;
+	}
+	if (ids.length === 0) return yield* Effect.fail(inputRequired("Provide --org."));
+	const organizationId = yield* Effect.try({
+		try: () => toOrgId(ids[0]),
+		catch: () => inputRequired("Provide a valid --org.")
+	});
+	return client.org(organizationId).addressBook;
+});
+const result = (value, lines) => ({
+	data: value,
+	lines
+});
+const requiredLabel = (value) => {
+	const label = value?.trim() ?? "";
+	return label.length === 0 ? Effect.fail(inputRequired("Provide --label.")) : Effect.succeed(label);
+};
+const actorLine = (orgs) => orgs[0] === void 0 ? "Actor: personal" : `Actor: Organization ${JSON.stringify(orgs[0])}`;
+const runContact = (config, action, input) => Effect.gen(function* () {
+	const addInput = action === "add" ? yield* readAddInput(input.input) : void 0;
+	const entryId = action === "get" || action === "label" || action === "hide" || action === "unhide" ? yield* partyId(input.entryId) : void 0;
+	const label = action === "label" ? yield* requiredLabel(input.label) : void 0;
+	const interactiveWrite = action === "add" || action === "label" || action === "hide" || action === "unhide" ? yield* requireWriteConfirmation(input.confirm) : false;
+	const { client } = yield* restoreAuthenticatedClient(config, input.email);
+	const book = yield* selectedBook(client, input.actor, input.orgs);
+	if (action === "add") {
+		if (interactiveWrite) yield* confirmWrite({
+			lines: [actorLine(input.orgs), `Reference: ${JSON.stringify(addInput.ref)}`],
+			question: "Add this contact?"
+		});
+		const entry = yield* Effect.promise((signal) => book.add(addInput, { signal })).pipe(Effect.flatMap(resultValue));
+		return result(entry, [JSON.stringify(entry)]);
+	}
+	if (action === "get") {
+		const entry = yield* Effect.promise((signal) => book.get(entryId, { signal })).pipe(Effect.flatMap(resultValue));
+		return result(entry, [entry === null ? "No contact found" : JSON.stringify(entry)]);
+	}
+	if (action === "list") {
+		const entries = yield* Effect.promise((signal) => book.list(input.includeHidden === true ? { includeHidden: true } : void 0, { signal })).pipe(Effect.flatMap(resultValue));
+		return result(entries, entries.map((entry) => JSON.stringify(entry)));
+	}
+	if (interactiveWrite) {
+		const current = yield* Effect.promise((signal) => book.get(entryId, { signal })).pipe(Effect.flatMap(resultValue));
+		if (current === null) return yield* Effect.fail(inputRequired("No contact has that --entry-id."));
+		yield* confirmWrite({
+			lines: [
+				actorLine(input.orgs),
+				`PartyId: ${current.id}`,
+				`Current: ${JSON.stringify({
+					label: current.label,
+					hidden: current.hidden
+				})}`,
+				`Result: ${JSON.stringify(action === "label" ? {
+					label,
+					hidden: current.hidden
+				} : {
+					label: current.label,
+					hidden: action === "hide"
+				})}`
+			],
+			question: `${action === "label" ? "Label" : action === "hide" ? "Hide" : "Unhide"} this contact?`
+		});
+	}
+	const entry = yield* Effect.promise((signal) => action === "label" ? book.label({
+		entryId,
+		label
+	}, { signal }) : action === "hide" ? book.hide(entryId, { signal }) : book.unhide(entryId, { signal })).pipe(Effect.flatMap(resultValue));
+	return result(entry, [JSON.stringify(entry)]);
+});
+//#endregion
+//#region src/commands/contact.ts
+const emailFlag$1 = Flag.string("email").pipe(Flag.optional);
+const orgFlag$1 = Flag.string("org").pipe(Flag.withAlias("org-id"), Flag.atLeast(1));
+const includeHiddenFlag = Flag.boolean("include-hidden").pipe(Flag.withDefault(false));
+const entryIdFlag = Flag.string("entry-id");
+const labelFlag = Flag.string("label");
+const inputFlag = Flag.string("input").pipe(Flag.optional);
+const confirmFlag$1 = Flag.boolean("confirm").pipe(Flag.withDefault(false));
+const names = {
+	personal: {
+		root: "contact",
+		list: "contact.list",
+		get: "contact.get",
+		add: "contact.add",
+		label: "contact.label",
+		hide: "contact.hide",
+		unhide: "contact.unhide"
+	},
+	organization: {
+		root: "org.contact",
+		list: "org.contact.list",
+		get: "org.contact.get",
+		add: "org.contact.add",
+		label: "org.contact.label",
+		hide: "org.contact.hide",
+		unhide: "org.contact.unhide"
+	}
+};
+const metadata$1 = (name) => ({
+	name,
+	capability: "contacts",
+	observation: "command"
+});
+const makeContactCommand = (actor) => {
+	const selectedNames = names[actor];
+	const scope = actor === "organization" ? { orgs: orgFlag$1 } : {};
+	const execute = (action, input) => runCommand({
+		...metadata$1(selectedNames[action]),
+		network: true
+	}, (config) => runContact(config, action, {
+		actor,
+		orgs: input.orgs ?? [],
+		email: input.email,
+		includeHidden: input.includeHidden,
+		entryId: input.entryId,
+		label: input.label,
+		input: input.input,
+		confirm: input.confirm
+	}));
+	const list = Command.make("list", {
+		email: emailFlag$1,
+		...scope,
+		includeHidden: includeHiddenFlag
+	}, ({ email, includeHidden, ...scoped }) => execute("list", {
+		email: Option.getOrUndefined(email),
+		orgs: "orgs" in scoped ? scoped.orgs : [],
+		includeHidden,
+		confirm: false
+	})).pipe(Command.annotate(CliCommandMetadata, metadata$1(selectedNames.list)), Command.withDescription("List contacts in the selected actor's address book"));
+	const get = Command.make("get", {
+		email: emailFlag$1,
+		...scope,
+		entryId: entryIdFlag
+	}, ({ email, entryId, ...scoped }) => execute("get", {
+		email: Option.getOrUndefined(email),
+		orgs: "orgs" in scoped ? scoped.orgs : [],
+		entryId,
+		confirm: false
+	})).pipe(Command.annotate(CliCommandMetadata, metadata$1(selectedNames.get)), Command.withDescription("Read one contact by stable PartyId"));
+	const add = Command.make("add", {
+		email: emailFlag$1,
+		...scope,
+		input: inputFlag,
+		confirm: confirmFlag$1
+	}, ({ email, input, confirm, ...scoped }) => execute("add", {
+		email: Option.getOrUndefined(email),
+		orgs: "orgs" in scoped ? scoped.orgs : [],
+		input: Option.getOrUndefined(input),
+		confirm
+	})).pipe(Command.annotate(CliCommandMetadata, metadata$1(selectedNames.add)), Command.withDescription("Add one contact from AddressBookAddInput JSON"));
+	const labelContact = Command.make("label", {
+		email: emailFlag$1,
+		...scope,
+		entryId: entryIdFlag,
+		label: labelFlag,
+		confirm: confirmFlag$1
+	}, ({ email, entryId, label, confirm, ...scoped }) => execute("label", {
+		email: Option.getOrUndefined(email),
+		orgs: "orgs" in scoped ? scoped.orgs : [],
+		entryId,
+		label,
+		confirm
+	})).pipe(Command.annotate(CliCommandMetadata, metadata$1(selectedNames.label)), Command.withDescription("Change one contact label by stable PartyId"));
+	const visibility = (action) => Command.make(action, {
+		email: emailFlag$1,
+		...scope,
+		entryId: entryIdFlag,
+		confirm: confirmFlag$1
+	}, ({ email, entryId, confirm, ...scoped }) => execute(action, {
+		email: Option.getOrUndefined(email),
+		orgs: "orgs" in scoped ? scoped.orgs : [],
+		entryId,
+		confirm
+	})).pipe(Command.annotate(CliCommandMetadata, metadata$1(selectedNames[action])), Command.withDescription(`${action === "hide" ? "Hide" : "Restore"} one contact`));
+	return Command.make("contact").pipe(Command.annotate(CliCommandMetadata, metadata$1(selectedNames.root)), Command.withDescription("Manage the selected actor's contacts"), Command.withSubcommands([
+		list,
+		get,
+		add,
+		labelContact,
+		visibility("hide"),
+		visibility("unhide")
+	]));
+};
+const contact = makeContactCommand("personal");
+const organizationContact = makeContactCommand("organization");
+//#endregion
 //#region src/commands/org.ts
 const emailFlag = Flag.string("email").pipe(Flag.optional);
 const orgFlag = Flag.string("org").pipe(Flag.withAlias("org-id"), Flag.atLeast(0));
@@ -54251,7 +56378,11 @@ const memberGet = Command.make("get", {
 	orgs,
 	accountId
 })).pipe(Command.annotate(CliCommandMetadata, metadata("org.member.get")), Command.withDescription("Read one member by exact Account ID"));
-const member = Command.make("member").pipe(Command.annotate(CliCommandMetadata, metadata("org.member")), Command.withSubcommands([members("list"), memberGet]));
+const member = Command.make("member").pipe(Command.annotate(CliCommandMetadata, metadata("org.member")), Command.withSubcommands([
+	members("list"),
+	memberGet,
+	memberInvite
+]));
 const wait = Command.make("wait", {
 	...scoped,
 	timeoutSeconds: Flag.integer("timeout-seconds").pipe(Flag.withDefault(120))
@@ -54281,7 +56412,7 @@ const create = Command.make("create", {
 	size: Option.getOrUndefined(size),
 	confirm,
 	timeoutSeconds
-}))).pipe(Command.annotate(CliCommandMetadata, metadata(CAPXUL_OPERATIONS.org.create)), Command.withDescription("Create one Organization; never saves a read default"));
+}))).pipe(Command.annotate(CliCommandMetadata, metadata(CAPXUL_OPERATIONS.org.create)), Command.withDescription("Create one Organization, or resume the exact one this machine recorded"));
 const retry = Command.make("retry", {
 	...orgScope,
 	email: emailFlag,
@@ -54296,13 +56427,15 @@ const retry = Command.make("retry", {
 	confirm,
 	timeoutSeconds
 }))).pipe(Command.annotate(CliCommandMetadata, metadata(CAPXUL_OPERATIONS.org.retry)), Command.withDescription("Resume this exact Organization setup lane; never creates one"));
-const org = Command.make("org").pipe(Command.annotate(CliCommandMetadata, metadata("org")), Command.withDescription("Organization reads, writes, and local read defaults"), Command.withSubcommands([
+const org = Command.make("org").pipe(Command.annotate(CliCommandMetadata, metadata("org")), Command.withDescription("Organization reads, writes, recovery, and local read defaults"), Command.withSubcommands([
 	list,
 	use,
 	status,
 	me,
 	members("members"),
 	member,
+	organizationContact,
+	invite,
 	wait,
 	create,
 	retry
@@ -54340,19 +56473,10 @@ const command = Command.make("capxul").pipe(Command.annotate(CliCommandMetadata,
 	auth,
 	doctor,
 	telemetry,
+	contact,
 	org
 ]), Command.withGlobalFlags([JsonOutput]));
 //#endregion
-//#region src/platform/bounded-text.ts
-var UpdateUnavailable = class extends Data.TaggedError("UpdateUnavailable") {};
-const boundedText = (stream, limit) => Effect.suspend(() => {
-	let size = 0;
-	return stream.pipe(Stream.mapEffect((chunk) => {
-		size += chunk.byteLength;
-		return size > limit ? Effect.fail(new UpdateUnavailable()) : Effect.succeed(chunk);
-	}), Stream.decodeText(), Stream.runFold(() => "", (text, chunk) => text + chunk));
-});
-//#endregion
 //#region src/platform/install-provenance.ts
 const Manifest = Schema.Struct({
 	name: Schema.Literal("@capxul/cli"),
@@ -54465,6 +56589,7 @@ const runCli = (platform) => Effect.uninterruptibleMask((restore) => Effect.gen(
 	const ci = yield* Config.string("CI").pipe(Config.withDefault("false"), Effect.map((value) => value !== "" && value !== "false" && value !== "0"), Effect.catch(() => Effect.succeed(false)));
 	const runtime = {
 		mode,
+		args,
 		current,
 		invocationId,
 		observation,