@capxul/mcp 4.20.0-beta.3 → 4.20.0-beta.5

package/dist/main.mjs

@@ -1022,18 +1022,9 @@ const USDX_ASSET = {
 	tokenAddress: USDX_ADDRESS_BASE_SEPOLIA,
 	deploymentStartBlock: USDX_DEPLOYMENT_START_BLOCK,
 	decimals: 6,
-	source: "settlement"
+	source: "legacy"
 };
-/**
-* The settlement tier: rows the exact-transfer path and the Movement scanner
-* admit, each carrying the legacy `currency` projection those readers expect.
-* Adding an owned test asset here would put candidate liquidity on the
-* money-write path, so M03's rows go to the candidate tier below instead.
-*/
-const CONFIGURED_MONEY_ASSETS = [{
-	...USDX_ASSET,
-	currency: USDX_ASSET.peg
-}];
+({ ...USDX_ASSET }), USDX_ASSET.peg;
 /**
 * The candidate tier: five owned test assets, every field read back from Base
 * Sepolia after the deployment that created it (chain 84532, blocks
@@ -1105,12 +1096,25 @@ const SYNTHETIC_TEST_ASSETS = [
 ];
 toChainId(84532);
 /**
+* The settlement tier: the owned test assets admitted to the exact-transfer
+* path and to the treasury reads. USDC, USDT and WETH are equal assets. There
+* is no default token and no successor to USDX; USDX survives only in
+* `LEGACY_MONEY_ASSETS` and is not a current treasury row.
+*/
+const SETTLEMENT_ASSET_SYMBOLS = [
+	"USDC",
+	"USDT",
+	"WETH"
+];
+const CONFIGURED_MONEY_ASSETS = SYNTHETIC_TEST_ASSETS.filter((asset) => SETTLEMENT_ASSET_SYMBOLS.includes(asset.symbol));
+/**
 * Every known asset in ONE identity space. The tiers above declare admission;
 * this is the only list an identity resolves against, so an asset is never
 * two different things depending on which list a caller happened to read.
 */
-const MONEY_ASSET_REGISTRY = [...CONFIGURED_MONEY_ASSETS, ...SYNTHETIC_TEST_ASSETS];
+const MONEY_ASSET_REGISTRY = [USDX_ASSET, ...SYNTHETIC_TEST_ASSETS];
 CONFIGURED_MONEY_ASSETS.map((asset) => asset.tokenAddress.toLowerCase());
+USDX_ADDRESS_BASE_SEPOLIA.toLowerCase();
 /** The registry row for `assetId` across every tier, or `null`. */
 function configuredMoneyAssetById(assetId) {
 	const canonical = toAssetId(assetId);
@@ -6873,6 +6877,175 @@ function serializeSignature({ r, s, to = "hex", v, yParity }) {
 	return hexToBytes(signature);
 }
 //#endregion
+//#region ../../packages/sdk/src/domain/money/asset-amount.ts
+/** Convert raw units without rounding or changing asset identity. */
+function assetAmountFromRaw(raw, asset) {
+	validateMetadata(asset);
+	return {
+		asset: asset.assetId,
+		value: formatUnits(decimalToRaw(toWeiAmount(raw), 0), asset.decimals)
+	};
+}
+/** Exact scaling. This rejects excess precision instead of rounding it. */
+function toRaw(amount, asset) {
+	validateMetadata(asset);
+	if (amount.asset !== asset.assetId) throw Errors.invalidInput("amount.asset", "must match the selected asset on its chain");
+	return decimalToRaw(amount.value, asset.decimals);
+}
+function requireAsset(id) {
+	const asset = configuredMoneyAssetById(id);
+	if (asset === null) throw Errors.invalidInput("amount.asset", "is not a registered asset");
+	return asset;
+}
+function decimalToRaw(value, decimals) {
+	validatePrecision(decimals);
+	if (!/^\d+(?:\.\d+)?$/.test(value) || value.trim() !== value || value.length > 512) throw Errors.invalidInput("amount.value", "must be a non-negative decimal string of at most 512 characters");
+	const [integer = "0", fraction = ""] = value.split(".");
+	if (fraction.length > decimals) throw Errors.invalidInput("amount.value", "fraction exceeds asset precision");
+	return BigInt(integer) * 10n ** BigInt(decimals) + BigInt(fraction.padEnd(decimals, "0") || "0");
+}
+function validatePrecision(decimals) {
+	if (!Number.isInteger(decimals) || decimals < 0 || decimals > 255) throw Errors.invalidInput("decimals", "must be an integer from 0 to 255");
+}
+function validateMetadata(asset) {
+	validatePrecision(asset.decimals);
+	if (asset.assetId !== assetIdFor(asset.chainId, asset.tokenAddress)) throw Errors.invalidInput("amount.asset", "metadata must match its chain and token");
+}
+//#endregion
+//#region ../../packages/sdk/src/domain/money/valuation.ts
+const PEG_RATES = (source, into) => (typeof source === "string" ? source : source.peg) === into ? {
+	value: "1",
+	decimals: 0
+} : null;
+/**
+* The oracle the money READS price with: the account headline, the org
+* treasury headline, and every later total over the same seam (D6).
+*
+* It is `PEG_RATES` today because no price feed exists yet, and a peg is a
+* relationship, not a market price — so an unpegged asset such as WETH reads
+* as unrated rather than as a fabricated number. This binding is the ONE place
+* a real feed arrives; no call site changes when it does.
+*/
+const MONEY_READ_RATES = PEG_RATES;
+/** Sum exact fixed-point values. Missing rates never contribute zero. */
+function valueIn(amounts, displayCurrency, rates = PEG_RATES) {
+	const currency = toCurrencyCode(displayCurrency);
+	const counted = [];
+	const unrated = [];
+	let sum = 0n;
+	let scale = 0;
+	for (const amount of amounts) {
+		let source;
+		let raw;
+		let decimals;
+		if ("asset" in amount) {
+			source = requireAsset(amount.asset);
+			raw = toRaw(amount, source);
+			decimals = source.decimals;
+		} else {
+			source = toCurrencyCode(amount.currency);
+			raw = decimalToRaw(amount.value, amount.decimals);
+			decimals = amount.decimals;
+		}
+		const rate = rates(source, currency);
+		if (rate === null) {
+			unrated.push(amount);
+			continue;
+		}
+		validatePrecision(rate.decimals);
+		if (!/^\d+$/.test(rate.value) || rate.value.trim() !== rate.value || rate.value.length > 256 || BigInt(rate.value) <= 0n) throw Errors.invalidInput("rate.value", "must be a positive fixed-point integer");
+		const termScale = decimals + rate.decimals;
+		const nextScale = Math.max(scale, termScale);
+		sum = sum * 10n ** BigInt(nextScale - scale) + raw * BigInt(rate.value) * 10n ** BigInt(nextScale - termScale);
+		scale = nextScale;
+		counted.push(amount);
+	}
+	return {
+		total: counted.length === 0 ? null : {
+			currency,
+			value: formatUnits(sum, scale),
+			decimals: scale
+		},
+		counted,
+		unrated
+	};
+}
+//#endregion
+//#region ../../packages/sdk/src/domain/money/account-positions.ts
+/**
+* Lift an Account's raw per-asset positions to the SDK's `AccountPosition`.
+*
+* A position whose `assetId` is not a registered asset refuses. An unregistered
+* token has no identity this SDK can state, so it must never be relabelled as
+* one — the failure is the point, not a row to skip.
+*/
+function accountPositionsFromWire(positions) {
+	return positions.map((position) => {
+		const asset = configuredMoneyAssetById(toAssetId(position.assetId));
+		if (asset === null) throw Errors.invalidInput("assetId", "is not a registered asset");
+		const raw = toWeiAmount(position.rawBalance);
+		const rawAvailable = toWeiAmount(position.rawAvailableBalance ?? position.rawBalance);
+		return {
+			asset: asset.assetId,
+			symbol: asset.symbol,
+			decimals: asset.decimals,
+			balance: assetAmountFromRaw(raw, asset).value,
+			available: assetAmountFromRaw(rawAvailable, asset).value
+		};
+	});
+}
+/**
+* The fiat headline of a set of positions: the sum of the positions the given
+* oracle can rate into the display currency (ADR-0028 R6, D6). It never picks
+* a token and never labels one as fiat.
+*
+* The oracle is a PARAMETER (D6 obligation 4). It defaults to `PEG_RATES`, which
+* only rates an asset whose peg equals the display currency, so an unpegged
+* asset such as WETH stays out of the total and out of `counted`:
+* a WETH-only Account reads a `$0.00` headline under that default. Hand it a
+* real oracle and the same Account prices (WETH at `$2000` under
+* `createMockRates`, a live feed later).
+*
+* Either way the unrated position is never zeroed and never dropped: it stays
+* in `Account.balances`, and `valueIn` reports it in its own `unrated` list so
+* a caller can say how complete the total is.
+*/
+function headlineValuation(balances, displayCurrency, rates = PEG_RATES) {
+	const total = (pick) => valueIn(balances.map((position) => ({
+		asset: position.asset,
+		value: pick(position)
+	})), displayCurrency, rates).total ?? {
+		currency: displayCurrency,
+		value: "0",
+		decimals: 0
+	};
+	return {
+		balance: total((position) => position.balance),
+		available: total((p) => p.available)
+	};
+}
+/**
+* The Account: its per-asset truth plus the fiat headline valuation. The oracle
+* is threaded from the read that built it, never defaulted past this point
+* (D6): the account read passes the configured one.
+*/
+function accountFromPositions(id, positions, displayCurrency = toCurrencyCode("USD"), rates = PEG_RATES) {
+	const balances = accountPositionsFromWire(positions);
+	return {
+		id,
+		balances,
+		...headlineValuation(balances, displayCurrency, rates)
+	};
+}
+/** The same lift for positions a caller already holds as `AccountPosition`. */
+function accountFromAccountPositions(id, balances, displayCurrency = toCurrencyCode("USD"), rates = PEG_RATES) {
+	return {
+		id,
+		balances,
+		...headlineValuation(balances, displayCurrency, rates)
+	};
+}
+//#endregion
 //#region ../../packages/observability/src/operations.ts
 const CAPXUL_OPERATIONS = {
 	account: {
@@ -6941,6 +7114,26 @@ const CAPXUL_OPERATIONS = {
 		createOrg: "createOrg",
 		orgs: "orgs"
 	},
+	/** AUTH A3 (#2073): the SDK facade over the native continuation endpoints. */
+	clientRequests: {
+		decide: "clientRequests.decide",
+		read: "clientRequests.read"
+	},
+	/** AUTH A2 (#2072): the native client authorization issuer and its browser
+	* continuation. One name per durable transition the endpoints can fail on. */
+	clientAuthorization: {
+		acceptRequest: "clientAuthorization.acceptRequest",
+		cancelRequest: "clientAuthorization.cancelRequest",
+		consumeRequest: "clientAuthorization.consumeRequest",
+		denyRequest: "clientAuthorization.denyRequest",
+		invalidateContext: "clientAuthorization.invalidateContext",
+		markConsented: "clientAuthorization.markConsented",
+		readMetadata: "clientAuthorization.readMetadata",
+		revokeGrant: "clientAuthorization.revokeGrant",
+		rotateGrant: "clientAuthorization.rotateGrant",
+		startRequest: "clientAuthorization.startRequest",
+		sweepExpired: "clientAuthorization.sweepExpired"
+	},
 	credentials: {
 		bootstrapClient: "credentials.bootstrapClient",
 		mintQuickstartKey: "credentials.mintQuickstartKey"
@@ -7424,6 +7617,44 @@ const IdentityRefusedProps = Schema.Struct({
 	state: OptionalString
 });
 const AuthSignedOutProps = Schema.Struct(TelemetryEnvelopeProps);
+const NativeAuthorizationMode = Schema.Literals(["login", "signup"]);
+const NativeAuthorizationStartedProps = Schema.Struct({
+	...TelemetryEnvelopeProps,
+	mode: NativeAuthorizationMode
+});
+const NativeAuthorizationReviewedProps = Schema.Struct({
+	...TelemetryEnvelopeProps,
+	mode: NativeAuthorizationMode
+});
+const NativeAuthorizationAcceptedProps = Schema.Struct({
+	...TelemetryEnvelopeProps,
+	mode: NativeAuthorizationMode,
+	/** Whether consent also had to finish account setup first. */
+	setup_state: Schema.optional(Schema.Literals([
+		"not_required",
+		"new",
+		"resumable"
+	]))
+});
+const NativeAuthorizationDeniedProps = Schema.Struct({
+	...TelemetryEnvelopeProps,
+	mode: NativeAuthorizationMode
+});
+const NativeAuthorizationConnectedProps = Schema.Struct({
+	...TelemetryEnvelopeProps,
+	mode: NativeAuthorizationMode
+});
+const NativeAuthorizationFailedProps = Schema.Struct({
+	...TelemetryEnvelopeProps,
+	mode: Schema.optional(NativeAuthorizationMode),
+	/** The refusal word the store returned, for example `identity_mismatch` or
+	* `request_expired`. These are the closed `CLIENT_AUTHORIZATION_REFUSALS` from
+	* `@capxul/wire` plus the store-internal `fresh_session_required` (ruling R3),
+	* which the continuation maps to `identity_mismatch` on the wire but reports
+	* truthfully here. Kept as `OptionalString` rather than an imported literal
+	* set: this package must not depend on the transport contract. */
+	reason: OptionalString
+});
 const ProvisioningSafeCreatedProps = Schema.Struct({
 	...TelemetryEnvelopeProps,
 	safe_address: OptionalAddress
@@ -7466,6 +7697,12 @@ const BootstrapFailedProps = Schema.Struct({
 * Organization row's chain, the configured token address — never from a label.
 * The verified `organization_id` and its group arrive from the backend
 * attribution, so they are not repeated here.
+*
+* D1 (2026-09-10): `asset_id` carries the canonical branded identity the read
+* resolved, `eip155:<chainId>/erc20:<lowercase-address>`, from the registry
+* row. `token_address`/`chain_id` are its parts; `currency` is the peg and a
+* display code. The producer emits the branded id so the live read can be
+* grouped by ASSET, never by symbol or peg.
 */
 const AccountBalanceReadProps = Schema.Struct({
 	...TelemetryEnvelopeProps,
@@ -7473,6 +7710,7 @@ const AccountBalanceReadProps = Schema.Struct({
 	account_kind: OptionalAccountKind,
 	chain_id: OptionalChainId,
 	token_address: OptionalAddress,
+	asset_id: OptionalString,
 	currency: OptionalCurrencyCode,
 	balance_bucket: OptionalBalanceBucket,
 	durationMs: OptionalDurationMs
@@ -7941,6 +8179,30 @@ Schema.Struct({
 	name: Schema.Literal("auth_signed_out"),
 	props: AuthSignedOutProps
 });
+Schema.Struct({
+	name: Schema.Literal("native_authorization_started"),
+	props: NativeAuthorizationStartedProps
+});
+Schema.Struct({
+	name: Schema.Literal("native_authorization_reviewed"),
+	props: NativeAuthorizationReviewedProps
+});
+Schema.Struct({
+	name: Schema.Literal("native_authorization_accepted"),
+	props: NativeAuthorizationAcceptedProps
+});
+Schema.Struct({
+	name: Schema.Literal("native_authorization_denied"),
+	props: NativeAuthorizationDeniedProps
+});
+Schema.Struct({
+	name: Schema.Literal("native_authorization_connected"),
+	props: NativeAuthorizationConnectedProps
+});
+Schema.Struct({
+	name: Schema.Literal("native_authorization_failed"),
+	props: NativeAuthorizationFailedProps
+});
 Schema.Struct({
 	name: Schema.Literal("onboarding_intent_selected"),
 	props: OnboardingIntentSelectedProps
@@ -8195,12 +8457,18 @@ const CLI_COMMAND_NAMES = [
 	"telemetry.status",
 	"telemetry.enable",
 	"telemetry.disable",
+	"auth",
+	"auth.login",
+	"auth.signup",
+	"auth.status",
+	"auth.logout",
 	"unknown"
 ];
 const CLI_CAPABILITIES = [
 	"cli",
 	"diagnostics",
-	"collection"
+	"collection",
+	"authentication"
 ];
 const CLI_INVOCATION_KINDS = [
 	"command",
@@ -8218,8 +8486,9 @@ const CliInvocationProps = {
 	capability: Schema.Literals(CLI_CAPABILITIES),
 	invocation_kind: Schema.Literals(CLI_INVOCATION_KINDS),
 	invocation_id: Schema.String.check(Schema.isPattern(/^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/u)),
-	cli_identity_kind: Schema.optional(Schema.Literal("anonymous")),
+	cli_identity_kind: Schema.optional(Schema.Literals(["anonymous", "identified"])),
 	anonymous_id: Schema.optional(Schema.String.check(Schema.isPattern(/^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/u))),
+	auth_user_id: Schema.optional(Schema.String.check(Schema.isPattern(/^[^\s]{1,256}$/u))),
 	occurred_at: Schema.Number,
 	cli_version: CliRelease,
 	sdk_version: CliRelease,
@@ -10891,8 +11160,7 @@ const country = normalize((s) => s.toUpperCase()).pipe(Schema.refine((s) => COUN
 const credential = Schema.RedactedFromValue(Schema.String.check(Schema.isMinLength(32), Schema.isMaxLength(8192), Schema.isPattern(/^[A-Za-z0-9._~-]+$/u)), { label: "native authorization credential" });
 const otp = Schema.RedactedFromValue(Schema.String.check(Schema.isPattern(/^[0-9]{6}$/u)), { label: "OTP" });
 const scopes = Schema.Tuple([Schema.Literal(NATIVE_CLIENT_SCOPE)]);
-/** Exact HTTPS origin, no credentials/path/query and no retired cloud deployment. */
-const NativeHttpsOriginSchema = Schema.String.check(Schema.makeFilter((value) => {
+const isNativeHttpsOriginValue = (value) => {
 	try {
 		const url = new URL(value);
 		const host = url.hostname.toLowerCase().replace(/\.$/u, "");
@@ -10900,20 +11168,43 @@ const NativeHttpsOriginSchema = Schema.String.check(Schema.makeFilter((value) =>
 	} catch {
 		return false;
 	}
-}, { message: "must be a canonical credential-free HTTPS origin outside retired Convex cloud hosts" }));
+};
+Schema.String.check(Schema.makeFilter(isNativeHttpsOriginValue, { message: "must be a canonical credential-free HTTPS origin outside retired Convex cloud hosts" }));
+const isLoopbackOriginValue = (value) => {
+	try {
+		const url = new URL(value);
+		const host = url.hostname.toLowerCase().replace(/\.$/u, "");
+		return url.protocol === "http:" && value === url.origin && !url.username && !url.password && !url.search && !url.hash && (host === "127.0.0.1" || host === "[::1]" || host === "localhost");
+	} catch {
+		return false;
+	}
+};
+Schema.String.check(Schema.makeFilter(isLoopbackOriginValue, { message: "must be a canonical credential-free loopback HTTP origin" }));
+/**
+* Either a standing-tier HTTPS origin or a devnet loopback origin. A `Union` of
+* the two refined string schemas does not type-check in this Effect version —
+* it widens both fields to `unknown` — so the disjunction lives in one filter
+* and the struct check below is what binds a loopback origin to
+* `environment: "local"`. Loopback is never admissible on a standing tier.
+*/
+const NativeOriginSchema = Schema.String.check(Schema.makeFilter((value) => isNativeHttpsOriginValue(value) || isLoopbackOriginValue(value), { message: "must be a canonical credential-free HTTPS origin outside retired Convex cloud hosts, or a loopback HTTP origin for the local devnet" }));
 const NativeClientConfigurationSchema = Schema.Struct({
 	clientId: Schema.Literal(NATIVE_CLIENT_ID),
 	applicationId: AppIdSchema,
 	keyId,
 	environment: Schema.Literals([
+		"local",
 		"development",
 		"staging",
 		"production"
 	]),
 	keyEnvironment: Schema.Literals(["test", "live"]),
-	issuer: NativeHttpsOriginSchema,
-	verificationOrigin: NativeHttpsOriginSchema
-}).annotate(strict).check(Schema.makeFilter((c) => c.keyEnvironment === (c.environment === "production" ? "live" : "test"), { message: "key environment must match the configured deployment" })).annotate(strict);
+	issuer: NativeOriginSchema,
+	verificationOrigin: NativeOriginSchema
+}).annotate(strict).check(Schema.makeFilter((c) => c.keyEnvironment === (c.environment === "production" ? "live" : "test"), { message: "key environment must match the configured deployment" })).check(Schema.makeFilter((c) => {
+	const loopback = isLoopbackOriginValue(c.issuer) || isLoopbackOriginValue(c.verificationOrigin);
+	return c.environment === "local" ? isLoopbackOriginValue(c.issuer) && isLoopbackOriginValue(c.verificationOrigin) : !loopback;
+}, { message: "loopback origins belong to the local devnet environment alone" })).annotate(strict);
 const NativeSignupProfileSchema = Schema.Struct({
 	displayName: normalize((s) => s.trim()).check(Schema.isMinLength(1), Schema.isMaxLength(200)),
 	country,
@@ -10967,7 +11258,7 @@ const profileSummary = {
 	handle: handle$1,
 	country
 };
-Schema.Union([
+const ClientRequestViewSchema = Schema.Union([
 	Schema.Struct({
 		...request,
 		phase: Schema.Literal(CLIENT_AUTHORIZATION_PHASE.OTP_REQUIRED),
@@ -11034,8 +11325,7 @@ Schema.Struct({
 Schema.Struct({
 	client_id: Schema.Literal(NATIVE_CLIENT_ID),
 	grant_type: Schema.Literal("refresh_token"),
-	refresh_token: credential,
-	refreshAttemptId: Schema.RedactedFromValue(Schema.String.check(Schema.isPattern(/^[A-Za-z0-9_-]{32,128}$/u)), { label: "refresh attempt" })
+	refresh_token: credential
 }).annotate(strict);
 Schema.Struct({
 	client_id: Schema.Literal(NATIVE_CLIENT_ID),
@@ -11107,6 +11397,33 @@ Schema.Struct({
 		maximum: NATIVE_CLIENT_LIMITS.requestMs / 1e3
 	}))
 }).annotate(strict);
+Schema.Struct({
+	client_id: Schema.Literal(NATIVE_CLIENT_ID),
+	token: credential,
+	token_type_hint: Schema.optional(Schema.Literals([
+		"access_token",
+		"refresh_token",
+		"device_code"
+	]))
+}).annotate(strict);
+Schema.Struct({
+	client_id: Schema.Literal(NATIVE_CLIENT_ID),
+	token: credential
+}).annotate(strict);
+Schema.Struct({
+	error: Schema.Literals([
+		"authorization_pending",
+		"slow_down",
+		"access_denied",
+		"invalid_grant",
+		"invalid_request",
+		"expired_token",
+		"server_error"
+	]),
+	refusal: Schema.optional(Schema.Literals(CLIENT_AUTHORIZATION_REFUSALS)),
+	retryable: Schema.Boolean,
+	retry_after: Schema.optional(nonNegativeInt)
+}).annotate(strict);
 //#endregion
 //#region ../../packages/sdk/src/internal/invocation-observation.ts
 const INVOCATION_OBSERVATION = Symbol("capxul.invocation-observation");
@@ -13544,7 +13861,7 @@ function subscribeActivity(deps, actor, controls, onChange) {
 }
 //#endregion
 //#region ../../packages/sdk/package.json
-var version$1 = "4.20.0-beta.3";
+var version$1 = "4.20.0-beta.5";
 //#endregion
 //#region ../../packages/sdk/src/telemetry/exception-projection.ts
 /** Fixed fallback for failures that have no safe message. */
@@ -16095,7 +16412,7 @@ const MINIMAL_ENUM_VALUES = /* @__PURE__ */ new Map([
 	["command", CLI_COMMAND_NAMES],
 	["capability", CLI_CAPABILITIES],
 	["invocation_kind", CLI_INVOCATION_KINDS],
-	["cli_identity_kind", ["anonymous"]],
+	["cli_identity_kind", ["anonymous", "identified"]],
 	["output_mode", ["human", "json"]],
 	["unit", [
 		"1",
@@ -21006,13 +21323,15 @@ var ConvexAccountAdapter = class {
 	#convex;
 	#fns;
 	#telemetry;
+	#rates;
 	constructor(deps) {
 		this.#convex = deps.convex;
 		this.#fns = deps.functions ?? DEFAULT_FUNCTIONS$3;
 		this.#telemetry = deps.telemetry;
+		this.#rates = deps.rates ?? MONEY_READ_RATES;
 	}
 	readBalance(input) {
-		return retryIdempotentRead(this.#convex.action(this.#fns.readBalance, copyInvocationObservation(input, { chainId: wireChainId(input.chainId) })), CAPXUL_OPERATIONS.accounts.read, this.#telemetry, input).pipe(Effect.mapError((error) => accountReadErrorFromCapxul("readBalance", error.publicError, error)), Effect.flatMap((wire) => brandAccountEffect("readBalance", wire)), Effect.catchDefect((cause) => Effect.fail(accountReadErrorFromUnknown("readBalance", cause))));
+		return retryIdempotentRead(this.#convex.action(this.#fns.readBalance, copyInvocationObservation(input, { chainId: wireChainId(input.chainId) })), CAPXUL_OPERATIONS.accounts.read, this.#telemetry, input).pipe(Effect.mapError((error) => accountReadErrorFromCapxul("readBalance", error.publicError, error)), Effect.flatMap((wire) => brandAccountEffect("readBalance", wire, this.#rates)), Effect.catchDefect((cause) => Effect.fail(accountReadErrorFromUnknown("readBalance", cause))));
 	}
 	fundFromFaucet(input) {
 		const operation = "fundFromFaucet";
@@ -21025,26 +21344,21 @@ var ConvexAccountAdapter = class {
 		}).pipe(Effect.mapError((error) => accountReadErrorFromCapxul(operation, error.publicError, error)), Effect.map((wire) => ({ txHash: wire.txHash })), Effect.catchDefect((cause) => Effect.fail(accountReadErrorFromUnknown(operation, cause))));
 	}
 };
-function ConvexAccountLayer() {
+function ConvexAccountLayer(input = {}) {
 	return Layer.effect(AccountReadPortTag, Effect.all([ConvexCallPortTag, TelemetryPortTag]).pipe(Effect.map(([convex, telemetry]) => new ConvexAccountAdapter({
 		convex,
-		telemetry
+		telemetry,
+		...input
 	}))));
 }
-function brandAccountEffect(operation, wire) {
+function brandAccountEffect(operation, wire, rates) {
 	return Effect.try({
-		try: () => brandAccount(wire),
+		try: () => brandAccount(wire, rates),
 		catch: (cause) => accountReadErrorFromUnknown(operation, cause)
 	});
 }
-function brandAccount(wire) {
-	const balance = fromWei(wire.rawBalance, wire.decimals, wire.currency);
-	const available = fromWei(wire.rawAvailableBalance ?? wire.rawBalance, wire.decimals, wire.currency);
-	return {
-		id: toAccountId(wire.accountId),
-		balance,
-		available
-	};
+function brandAccount(wire, rates) {
+	return accountFromPositions(toAccountId(wire.accountId), wire.positions, void 0, rates);
 }
 function accountReadErrorFromUnknown(operation, cause) {
 	if (cause instanceof CapxulError) return accountReadErrorFromCapxul(operation, cause);
@@ -21183,16 +21497,16 @@ function brandOrgView(wire, treasury, viewerRole) {
 	};
 }
 /**
-* Build the Org treasury `Account` from the raw on-chain `balanceOf` integer
-* (the D3 RPC read). `available === balance` for a treasury with no envelope
-* partition yet (a fresh Org reads back $0).
+* Build the Org treasury `Account` from the raw per-asset `balanceOf` reads
+* (the D3 RPC pull). `available === balance` for a treasury with no envelope
+* partition yet (a fresh Org reads back a zero position per asset).
+*
+* `rates` is the oracle the headline prices with (D6). The live read passes the
+* configured one; it defaults to `PEG_RATES` so an unpegged holding reads as
+* unrated rather than as a number nobody priced.
 */
 function brandOrgTreasury(input) {
-	return {
-		id: toAccountId(`account_${orgIdBody(input.orgId)}`),
-		balance: input.money,
-		available: input.money
-	};
+	return accountFromAccountPositions(toAccountId(`account_${orgIdBody(input.orgId)}`), input.balances, void 0, input.rates);
 }
 function brandOrgRole(wire) {
 	return {
@@ -21279,10 +21593,12 @@ var ConvexOrganizationAdapter = class {
 	#convex;
 	#fns;
 	#telemetry;
+	#rates;
 	constructor(input) {
 		this.#convex = input.convex;
 		this.#fns = input.functions ?? DEFAULT_FUNCTIONS$1;
 		this.#telemetry = input.telemetry;
+		this.#rates = input.rates ?? MONEY_READ_RATES;
 	}
 	createOrg(_input) {
 		return Effect.fail(orgErrorFromCapxul("createOrg", Errors.notImplemented("organizationSetup", "use onboarding.completeOrganization")));
@@ -21330,15 +21646,11 @@ var ConvexOrganizationAdapter = class {
 		const orgId = String(input.orgId);
 		return retryIdempotentRead(this.#convex.action(this.#fns.readTreasury, copyInvocationObservation(input, { orgId })), CAPXUL_OPERATIONS.org.treasury, this.#telemetry, input).pipe(Effect.mapError((error) => orgErrorFromCapxul("readTreasury", error.publicError, error)), Effect.map((wire) => {
 			if (wire.orgId !== orgId) throw Errors.invalidInput("orgId", "Organization treasury scope does not match");
-			const balance = fromWei(wire.rawBalance, wire.decimals, wire.currency);
-			const available = fromWei(wire.rawAvailableBalance, wire.decimals, wire.currency);
-			return {
-				...brandOrgTreasury({
-					orgId: wire.orgId,
-					money: balance
-				}),
-				available
-			};
+			return brandOrgTreasury({
+				orgId: wire.orgId,
+				balances: accountPositionsFromWire(wire.positions),
+				rates: this.#rates
+			});
 		}));
 	}
 };
@@ -45926,6 +46238,157 @@ function makeAuthMethods(deps) {
 	};
 }
 //#endregion
+//#region ../../packages/sdk/src/surface/client-requests.ts
+function decodeView(body) {
+	try {
+		return {
+			ok: true,
+			value: Schema.decodeUnknownSync(ClientRequestViewSchema)(body)
+		};
+	} catch {
+		return {
+			ok: false,
+			error: Errors.invalidInput("clientRequest", "view is not a closed phase")
+		};
+	}
+}
+function httpError$1(status) {
+	if (status === 401) return {
+		ok: false,
+		error: Errors.notAuthenticated()
+	};
+	if (status === 404) return {
+		ok: false,
+		error: Errors.invalidInput("requestId", "is not a live request")
+	};
+	if (status === 429) return {
+		ok: false,
+		error: Errors.rateLimited({ resource: "clientRequest" })
+	};
+	return {
+		ok: false,
+		error: Errors.networkError("clientRequests")
+	};
+}
+function makeClientRequestMethods(deps) {
+	const fetchImpl = deps.fetch ?? fetch;
+	const urlFor = (path, query) => {
+		const resolved = resolveAuthClientUrl(deps.authBaseUrl, path);
+		return query === void 0 ? resolved : `${resolved}?${query}`;
+	};
+	async function readView(requestId, options) {
+		if (options?.signal?.aborted) return {
+			ok: false,
+			error: Errors.cancelled({ operation: CAPXUL_OPERATIONS.clientRequests.read })
+		};
+		try {
+			const response = await fetchImpl(urlFor("/api/auth/native/request", `requestId=${encodeURIComponent(requestId)}`), {
+				method: "GET",
+				credentials: "include",
+				...options?.signal === void 0 ? {} : { signal: options.signal }
+			});
+			const body = await response.json().catch(() => null);
+			if (!response.ok) {
+				const viewed = decodeView(body);
+				return viewed.ok ? viewed : httpError$1(response.status);
+			}
+			return decodeView(body);
+		} catch (cause) {
+			if (options?.signal?.aborted) return {
+				ok: false,
+				error: Errors.cancelled({ operation: CAPXUL_OPERATIONS.clientRequests.read })
+			};
+			if (isCapxulError(cause)) return {
+				ok: false,
+				error: cause
+			};
+			return {
+				ok: false,
+				error: Errors.networkError("native request read failed")
+			};
+		}
+	}
+	async function postDecision(path, input, options) {
+		if (options?.signal?.aborted) return {
+			ok: false,
+			error: Errors.cancelled({ operation: CAPXUL_OPERATIONS.clientRequests.decide })
+		};
+		try {
+			const response = await fetchImpl(urlFor(path), {
+				method: "POST",
+				credentials: "include",
+				headers: { "content-type": "application/json" },
+				body: JSON.stringify({
+					requestId: input.requestId,
+					revision: input.revision
+				}),
+				...options?.signal === void 0 ? {} : { signal: options.signal }
+			});
+			const viewed = decodeView(await response.json().catch(() => null));
+			if (viewed.ok) return viewed;
+			if (!response.ok) return httpError$1(response.status);
+			return viewed;
+		} catch (cause) {
+			if (options?.signal?.aborted) return {
+				ok: false,
+				error: Errors.cancelled({ operation: CAPXUL_OPERATIONS.clientRequests.decide })
+			};
+			if (isCapxulError(cause)) return {
+				ok: false,
+				error: cause
+			};
+			return {
+				ok: false,
+				error: Errors.networkError("native request decision failed")
+			};
+		}
+	}
+	return {
+		read: (input, options) => readView(input.requestId, options),
+		async sendOtp(input, options) {
+			const view = await readView(input.requestId, options);
+			if (!view.ok) return view;
+			if (view.value.phase !== "otp_required" && view.value.phase !== "review") return {
+				ok: false,
+				error: Errors.wrongState({
+					method: "clientRequests.sendOtp",
+					currentState: view.value.phase,
+					validStates: ["otp_required", "review"]
+				})
+			};
+			const sent = await deps.signIn({ email: view.value.email }, options);
+			if (!sent.ok) return sent;
+			return {
+				ok: true,
+				value: void 0
+			};
+		},
+		async verifyOtp(input, options) {
+			const view = await readView(input.requestId, options);
+			if (!view.ok) return view;
+			if (view.value.phase !== "otp_required" && view.value.phase !== "review") return {
+				ok: false,
+				error: Errors.wrongState({
+					method: "clientRequests.verifyOtp",
+					currentState: view.value.phase,
+					validStates: ["otp_required", "review"]
+				})
+			};
+			const verified = await deps.verifyOtp({
+				email: view.value.email,
+				code: input.code
+			}, options);
+			if (!verified.ok) return verified;
+			return {
+				ok: true,
+				value: void 0
+			};
+		},
+		accept: (input, options) => postDecision("/api/auth/native/request/accept", input, options),
+		cancel: (input, options) => postDecision("/api/auth/native/request/deny", input, options)
+	};
+}
+//#endregion
 //#region ../../packages/sdk/src/surface/smart-account-deps.ts
 /** The single Context tag the `smartAccount.*` methods resolve. */
 var SmartAccountDepsTag = class extends Context.Service()("@capxul/sdk/SmartAccountDeps") {};
@@ -47298,18 +47761,15 @@ var OrgDepsTag = class extends Context.Service()("@capxul/sdk/OrgDeps") {};
 function orgDepsLayer(deps) {
 	return Layer.succeed(OrgDepsTag, deps);
 }
-/** Zero `Money` in the USDX-backed display currency (a fresh Org's treasury). */
-function zeroMoney() {
-	return fromWei("0", 6, "USD");
-}
-/** A fresh Org's treasury Account: `$0` balance, `available === balance`. */
+/** A fresh Org's treasury Account: a zero position per settlement asset. */
 function zeroTreasury(orgId) {
-	const balance = zeroMoney();
-	return {
-		id: toAccountId(`account_${stripPrefix(orgId)}`),
-		balance,
-		available: balance
-	};
+	return accountFromAccountPositions(toAccountId(`account_${stripPrefix(orgId)}`), CONFIGURED_MONEY_ASSETS.map((asset) => ({
+		asset: asset.assetId,
+		symbol: asset.symbol,
+		decimals: asset.decimals,
+		balance: "0",
+		available: "0"
+	})), void 0, MONEY_READ_RATES);
 }
 /** Drop a known `<prefix>_` so the remainder is reusable as another brand seed. */
 function stripPrefix(value) {
@@ -47717,8 +48177,7 @@ function makeOrgMethods(deps) {
 						return {
 							id: treasuryResult.value.id,
 							address: org?.safeAddress ?? null,
-							balance: treasuryResult.value.balance,
-							available: treasuryResult.value.available
+							balances: treasuryResult.value.balances
 						};
 					}), observationOnlyControls(controls), CAPXUL_OPERATIONS.org.account.get, deps.runPromise);
 				} },
@@ -47822,23 +48281,27 @@ const organizationPaymentExecutionUnavailable = () => Promise.resolve({
 const holdingsContract = { current: makeFunctionReference(CAPXUL_FUNCTIONS["holdings/actions"].current) };
 //#endregion
 //#region ../../packages/sdk/src/domain/money/primary-holding.ts
-const CURRENCY_BY_TOKEN_SYMBOL = /* @__PURE__ */ new Map([["USDX", toCurrencyCode("USD")]]);
 /**
-* The designated display asset: the payable row holding the most money, or
-* `null` when no row is payable.
+* The designated display asset: the LOWEST `id` among the renderable rows, or
+* `null` when no row is renderable.
 *
-* A `HoldingRow` (`packages/wire/src/money.ts`) is a RAW CHAIN ROW, and three
-* of its shapes cannot become a `Holding`. Each is SKIPPED rather than
-* reported, because a row nobody can render is not a failure of the read:
+* A `HoldingRow` (`packages/wire/src/money.ts`) is a RAW CHAIN ROW. A native
+* row has no ERC-20 identity; a row with no `decimals` cannot be lifted into
+* major units; a row with no `symbol` cannot be named. Each is SKIPPED rather
+* than reported — a row nobody can render is not a failure of the read.
 *
-*   - no `decimals` — the raw balance cannot be lifted into major units;
-*   - no `symbol` — the asset cannot be named;
-*   - a symbol that stands for no supported `CurrencyCode` — the balance
-*     cannot be stated as `Money` without inventing a currency for it.
+* WHICH row is named is decided by ASSET IDENTITY — ascending `id` — never by
+* quantity. Two rows with different assets are not comparable money, so no
+* quantity can order them: 100 USDC is not "more" than 1 WETH without a rate,
+* and ranking major units would show whatever asset happens to have the most
+* decimal places as "primary". An identity order is arbitrary as well, but it
+* is stable and claims nothing about value. ADR-0028 R6 retires
+* `holdings.primary` outright; this export stays only until that retirement
+* lands with its remaining consumers, so no new policy is invented here.
 *
 * This replaces the app's hand pick in `formatCurrentHoldingsBalance`
 * (`dashboard-formatters.ts`): a `.find()` over a hardcoded `["USDX","USDC"]`
-* list falling back to `rows[0]`. Ties keep the earlier row, so the same
+* list falling back to `rows[0]`. Duplicate ids keep the first row, so the same
 * snapshot always yields the same answer.
 */
 function primaryHolding(rows) {
@@ -47846,37 +48309,21 @@ function primaryHolding(rows) {
 	for (const row of rows) {
 		const holding = toHolding(row);
 		if (holding === null) continue;
-		if (primary === null || compareDecimal(holding.available.value, primary.available.value) > 0) primary = holding;
+		if (primary === null || holding.id < primary.id) primary = holding;
 	}
 	return primary;
 }
 function toHolding(row) {
+	if (row.assetKind !== "erc20") return null;
 	if (row.symbol === void 0 || row.decimals === void 0) return null;
-	const currency = currencyForTokenSymbol(row.symbol);
-	if (currency === null) return null;
 	return {
-		id: row.assetKind === "native" ? "native" : row.tokenAddress.toLowerCase(),
+		id: row.tokenAddress.toLowerCase(),
+		assetKind: row.assetKind,
 		symbol: row.symbol,
-		available: fromWei(row.rawBalance, row.decimals, currency)
+		decimals: row.decimals,
+		value: formatUnits(BigInt(row.rawBalance), row.decimals)
 	};
 }
-function currencyForTokenSymbol(symbol) {
-	return CURRENCY_BY_TOKEN_SYMBOL.get(symbol.toUpperCase()) ?? null;
-}
-/**
-* Order two non-negative major-unit decimal strings without converting either
-* to a JavaScript number. Rows carry different `decimals`, so the raw integers
-* are not comparable: 1999999999 at 9 decimals is LESS than 2000000 at 6.
-*/
-function compareDecimal(first, second) {
-	const [firstWhole = "0", firstFraction = ""] = first.split(".");
-	const [secondWhole = "0", secondFraction = ""] = second.split(".");
-	const width = Math.max(firstFraction.length, secondFraction.length);
-	const firstScaled = BigInt(firstWhole + firstFraction.padEnd(width, "0"));
-	const secondScaled = BigInt(secondWhole + secondFraction.padEnd(width, "0"));
-	if (firstScaled === secondScaled) return 0;
-	return firstScaled < secondScaled ? -1 : 1;
-}
 //#endregion
 //#region ../../packages/sdk/src/surface/holdings.ts
 /** SPEC Freshness: past this block age the read is labelled stale. Nothing refuses. */
@@ -48325,6 +48772,7 @@ const closeClientResources = (close) => toCapxulResult(Effect.promise(close), La
 function assembleCapxulClient(input) {
 	const observation = input;
 	const authCache = input.authCache ?? detectAuthCacheAdapter();
+	const accountSetup = input.accountSetup ?? "automatic";
 	const effectRunner = input.effectRunner ?? {
 		runSync: Effect.runSync,
 		runPromise: Effect.runPromise
@@ -48395,7 +48843,7 @@ function assembleCapxulClient(input) {
 	});
 	kickProvisioning = accountBundle.kickProvisioning;
 	const account = accountBundle.methods;
-	const auth = makeAuthMethods({
+	const authCore = makeAuthMethods({
 		actor,
 		authClient: input.ports.authClient,
 		authCache,
@@ -48413,10 +48861,19 @@ function assembleCapxulClient(input) {
 				}
 				if (browserSigner.statusStore?.status() === "unknown" && typeof browserSigner.ensureWalletReady === "function") browserSigner.ensureWalletReady().catch(() => {});
 			}
+			if (accountSetup === "explicit") return;
 			await detectPendingOrgInvitations?.();
 			kickProvisioning?.();
 		}
 	});
+	const auth = {
+		...authCore,
+		clientRequests: makeClientRequestMethods({
+			authBaseUrl: input.bootstrap.authBaseUrl,
+			signIn: authCore.signIn,
+			verifyOtp: authCore.verifyOtp
+		})
+	};
 	const smartAccount = makeSmartAccountMethods({
 		actor,
 		smartAccountPort: input.ports.smartAccount,
@@ -48580,6 +49037,7 @@ function assembleCapxulClient(input) {
 			...input.ports.indexerRead === void 0 ? {} : { indexer: input.ports.indexerRead },
 			organizationSetup: { getProofReceipt: (orgId) => runPortEffect(input.ports.convexCall.query(organizationSetupProofReceiptQuery, { orgId })) },
 			telemetry: input.ports.telemetry,
+			accountSetup,
 			captureExternalAddressAcknowledged: (address, organizationId) => {
 				const telemetry = input.ports.telemetry;
 				if (telemetry === void 0) return;
@@ -49727,6 +50185,7 @@ async function createCapxulClientWithSignerControls(input, controls) {
 			bootstrap: adapters.value.bootstrap,
 			authCache: adapters.value.ports.authCache,
 			requirement: input.requirement ?? "none",
+			accountSetup: input.accountSetup,
 			...signer === void 0 ? {} : { signer },
 			orgPort: Context.get(adapters.value.context, OrgPortTag),
 			...signer === void 0 ? {} : { organizationSetup: new ConvexOrganizationSetupAdapter({
@@ -50548,7 +51007,7 @@ function stdioIdentity(env = process.env, options = {}) {
 }
 //#endregion
 //#region package.json
-var version = "4.20.0-beta.3";
+var version = "4.20.0-beta.5";
 //#endregion
 //#region src/deps.ts
 const NO_IDENTITY = async () => void 0;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@capxul/mcp",
-  "version": "4.20.0-beta.3",
+  "version": "4.20.0-beta.5",
   "private": false,
   "description": "Capxul MCP server for auth, Account readiness, identity, Organizations, relationships, requests, destinations, and testnet funding over Streamable HTTP.",
   "keywords": [
@@ -51,8 +51,8 @@
     "vite": "npm:@voidzero-dev/vite-plus-core@0.3.0",
     "vite-plus": "0.3.0",
     "@capxul/config": "0.3.0",
-    "@capxul/typescript-config": "0.0.0",
-    "@capxul/sdk": "4.20.0-beta.3"
+    "@capxul/sdk": "4.20.0-beta.5",
+    "@capxul/typescript-config": "0.0.0"
   },
   "scripts": {
     "dev": "vp exec tsx src/main.ts serve",