@capxul/mcp 4.20.0-beta.6 → 4.20.0-beta.7

package/dist/main.mjs

@@ -2977,6 +2977,28 @@ function getCreate2Address(opts) {
 //#region ../../packages/config/src/org-payments.ts
 /** Zodiac MultiSendCallOnly module on Base Sepolia. */
 const MULTI_SEND_CALL_ONLY = "0x9641d764fc13c8b624c04430c7356c1c7c8102e2";
+/** Supported Organization permission identities, newest first. */
+const ORG_PERMISSION_IDENTITY_PROFILES = [{
+	id: "zodiac-roles-2.1.1",
+	moduleFactoryRuntimeKeccak256: "0x01623cbcf010a1c326230f1b2d5f48a66b440232ee49096102bc84967dc5f21e",
+	mastercopy: "0xf2964ce6161ce0e75964fe7927ce114cb0b283d5",
+	mastercopyRuntimeKeccak256: "0x471d8b3b419f1eb955230c0326c8812176df49bf3c7b414a563fda5a3c6c10b6",
+	proxyRuntimeKeccak256: "0x248f9591f94c24c199ade3e73feb477cf02d387b2bea91f2f931a0deb094f163",
+	multiSendUnwrapper: "0xb4cd4bb764c089f20da18700ce8bc5e49f369efd",
+	multiSendUnwrapperRuntimeKeccak256: "0x1f6e088be5e6ef9d0fbe0547d3fa9a9e40d823433fd8a4449215b5663209a1eb"
+}, {
+	id: "zodiac-roles-2.1.0",
+	moduleFactoryRuntimeKeccak256: "0x01623cbcf010a1c326230f1b2d5f48a66b440232ee49096102bc84967dc5f21e",
+	mastercopy: "0x9646fdad06d3e24444381f44362a3b0eb343d337",
+	mastercopyRuntimeKeccak256: "0x87911cbc6aa0496e6bcb07dab2462b9c76daea130dede6dcc57d0adf307fa7ec",
+	proxyRuntimeKeccak256: "0x9d4059abf46db50e4b48d9b6404b1f200cb5a1efeb3725be2de630a2a9001944",
+	multiSendUnwrapper: "0x93b7fcbc63ed8a3a24b59e1c3e6649d50b7427c0",
+	multiSendUnwrapperRuntimeKeccak256: "0x4d8d8608b70a6e2f40726b9dd74406bbf73e90cac58e23ee953e2b45ad7dc3df"
+}];
+const CURRENT_ORG_PERMISSION_IDENTITY = ORG_PERMISSION_IDENTITY_PROFILES[0];
+ORG_PERMISSION_IDENTITY_PROFILES[1];
+CURRENT_ORG_PERMISSION_IDENTITY.mastercopy;
+CURRENT_ORG_PERMISSION_IDENTITY.multiSendUnwrapper;
 //#endregion
 //#region ../../packages/config/src/safe.ts
 const BASE_SEPOLIA_CHAIN_ID = 84532;
@@ -3207,14 +3229,6 @@ function normalizeBindingEmail(email) {
 //#endregion
 //#region ../../packages/config/src/role-dsl.ts
 const ADMIN_ROLE_LABEL = "Admin";
-function normalizeOrgRoleLabel(label) {
-	const normalized = label.trim().replace(/\s+/g, " ");
-	if (normalized.length === 0) throw Errors.invalidInput("role.label", "must be a non-empty role label");
-	return normalized;
-}
-function orgRoleKeyForLabel(label) {
-	return keccak256$1(toBytes$1(normalizeOrgRoleLabel(label).toLowerCase()));
-}
 //#endregion
 //#region ../../packages/config/src/capxul-payments-v2.ts
 /** The exact compiled CapxulPaymentsV2 ABI. */
@@ -7223,10 +7237,12 @@ const CAPXUL_OPERATIONS = {
 		prepareOrganizationPaymentExecution: "moneyExecution.prepareOrganizationPaymentExecution",
 		preparePaymentExecution: "moneyExecution.preparePaymentExecution",
 		preparePaymentLifecycleExecution: "moneyExecution.preparePaymentLifecycleExecution",
+		prepareInvitationConfiguration: "moneyExecution.prepareInvitationConfiguration",
 		preparePermissionExecution: "moneyExecution.preparePermissionExecution",
 		recoverSubmissionClaims: "moneyExecution.recoverSubmissionClaims",
 		submit: "moneyExecution.submit",
 		submitPaymentCommandExecution: "moneyExecution.submitPaymentCommandExecution",
+		submitInvitationConfigurationExecution: "moneyExecution.submitInvitationConfigurationExecution",
 		submitPaymentExecution: "moneyExecution.submitPaymentExecution",
 		submitPermissionExecution: "moneyExecution.submitPermissionExecution"
 	},
@@ -7248,20 +7264,52 @@ const CAPXUL_OPERATIONS = {
 		completePerson: "onboarding.completePerson"
 	},
 	org: {
-		acceptInvitations: "org.acceptInvitations",
 		account: { get: "org.account.get" },
-		activateMember: "org.activateMember",
 		auditLog: "org.auditLog",
 		confirmBootstrap: "org.confirmBootstrap",
 		createOrg: "org.createOrg",
 		create: "org.create",
-		detectAndAcceptPendingInvitations: "org.detectAndAcceptPendingInvitations",
+		/**
+		* §11: the consent mutation reports `org_invite_accepted` through its own
+		* scheduled emitter. It is named for the emit, not the acceptance, because
+		* the interactive acceptance itself owns `org.invitations.accept`.
+		*/
+		emitInviteAccepted: "org.emitInviteAccepted",
 		emitInviteProgressed: "org.emitInviteProgressed",
 		expireInvitations: "org.expireInvitations",
 		getLifecycle: "org.getLifecycle",
 		getProofReceipt: "org.getProofReceipt",
 		invite: "org.invite",
-		inviteMember: "org.inviteMember",
+		/** D8 invitation lifecycle: preview, own list, read, and the four transitions. */
+		invitations: {
+			/** The exact grantee's consent commit (§8): one accepted digest, once. */
+			accept: "org.invitations.accept",
+			/**
+			* The authoring write. It is named `authorize`, not `invite`, because the
+			* backend already uses `org.invitations.invite` as a refusal label and
+			* `lint:telemetry-spine` refuses a label that collides with an operation.
+			*/
+			authorize: "org.invitations.authorize",
+			cancel: "org.invitations.cancel",
+			decline: "org.invitations.decline",
+			get: "org.invitations.get",
+			list: "org.invitations.list",
+			/**
+			* The Admin-scoped Organization list. It is named `listScoped`, not
+			* `list`, because the own-offer list already owns `org.invitations.list`.
+			*/
+			listScoped: "org.invitations.listScoped",
+			/**
+			* The authoring write's inner hops: the SDK drives the backend's existing
+			* prepare/submit pair, and these names label the two Convex calls. The
+			* owning `capxul_sdk_operation` record stays `org.invitations.authorize`.
+			*/
+			prepareConfiguration: "org.invitations.prepareConfiguration",
+			preview: "org.invitations.preview",
+			resend: "org.invitations.resend",
+			retry: "org.invitations.retry",
+			submitConfiguration: "org.invitations.submitConfiguration"
+		},
 		list: "org.list",
 		load: "org.load",
 		me: "org.me",
@@ -7320,7 +7368,6 @@ const CAPXUL_OPERATIONS = {
 		},
 		recordFailure: "org.recordFailure",
 		recordProgress: "org.recordProgress",
-		resendInviteToken: "org.resendInviteToken",
 		resumeBootstrapSubmission: "org.resumeBootstrapSubmission",
 		retry: "org.retry",
 		retrySetup: "org.retrySetup",
@@ -7337,7 +7384,6 @@ const CAPXUL_OPERATIONS = {
 		retry: "organizationPayments.retry"
 	},
 	organizationSetup: { getProofReceipt: "organizationSetup.getProofReceipt" },
-	organizations: { detectAndAcceptPendingInvitations: "orgs.detectAndAcceptPendingInvitations" },
 	payments: {
 		cancel: "payments.cancel",
 		claim: "payments.claim",
@@ -7375,6 +7421,7 @@ const CAPXUL_OPERATIONS = {
 		terms: "payroll.terms"
 	},
 	permission: {
+		verifyInvitationConfiguration: "permission.verifyInvitationConfiguration",
 		command: "permission.command",
 		retryVerification: "permission.retryVerification",
 		verify: "permission.verify",
@@ -7917,6 +7964,11 @@ const OrgCreateFailedProps = Schema.Struct({
 const OrgInviteSentProps = Schema.Struct({
 	...TelemetryEnvelopeProps,
 	org_id: OptionalOrgId,
+	invitation_id: OptionalString,
+	generation: OptionalString,
+	command_id: OptionalString,
+	subject_party_id: OptionalString,
+	persisted_at: OptionalEpochMs,
 	email_domain: OptionalString,
 	role: OptionalString,
 	status: OptionalString
@@ -7924,6 +7976,11 @@ const OrgInviteSentProps = Schema.Struct({
 const OrgInviteAcceptedProps = Schema.Struct({
 	...TelemetryEnvelopeProps,
 	org_id: OptionalOrgId,
+	invitation_id: OptionalString,
+	accepted_at: OptionalEpochMs,
+	generation: OptionalString,
+	command_id: OptionalString,
+	subject_party_id: OptionalString,
 	role: OptionalString,
 	status: OptionalString
 });
@@ -7931,6 +7988,7 @@ const OrgInviteExpiredProps = Schema.Struct({
 	...TelemetryEnvelopeProps,
 	org_id: OptionalOrgId,
 	email_domain: OptionalString,
+	invitation_id: OptionalString,
 	reason: OptionalString,
 	role: OptionalString,
 	status: OptionalString
@@ -8083,9 +8141,24 @@ const PermissionMirrorVerificationProps = Schema.Struct({
 		"applied",
 		"replayed",
 		"conflicting_replay",
-		"revision_mismatch"
+		"revision_mismatch",
+		"cleanup_required",
+		"not_applied",
+		"application_failure",
+		"mismatch",
+		"refused"
 	])),
+	command_kind: Schema.optional(Schema.Literals(["invitation_configuration", "invitation_eoa"])),
 	command_id: OptionalString,
+	invitation_id: OptionalString,
+	generation: OptionalString,
+	purpose: Schema.optional(Schema.Literals([
+		"configure",
+		"grant",
+		"disable",
+		"compensate"
+	])),
+	$insert_id: OptionalString,
 	/**
 	* #1961 R03. The authorized stored row names the Permission it changed; the
 	* verified receipt names the chain facts that prove it. Every field is
@@ -8472,6 +8545,13 @@ const CLI_COMMAND_NAMES = [
 	"auth.profile",
 	"auth.status",
 	"auth.logout",
+	"contact",
+	"contact.list",
+	"contact.get",
+	"contact.add",
+	"contact.label",
+	"contact.hide",
+	"contact.unhide",
 	"org",
 	CAPXUL_OPERATIONS.org.list,
 	"org.use",
@@ -8480,6 +8560,24 @@ const CLI_COMMAND_NAMES = [
 	CAPXUL_OPERATIONS.org.members,
 	"org.member",
 	"org.member.get",
+	"org.member.invite",
+	"org.contact",
+	"org.contact.list",
+	"org.contact.get",
+	"org.contact.add",
+	"org.contact.label",
+	"org.contact.hide",
+	"org.contact.unhide",
+	CAPXUL_OPERATIONS.org.invite,
+	"org.invite.list",
+	"org.invite.get",
+	"org.invite.wait",
+	"org.invite.review",
+	"org.invite.accept",
+	"org.invite.decline",
+	"org.invite.cancel",
+	"org.invite.resend",
+	"org.invite.retry",
 	"org.wait",
 	CAPXUL_OPERATIONS.org.create,
 	CAPXUL_OPERATIONS.org.retry,
@@ -8490,7 +8588,8 @@ const CLI_CAPABILITIES = [
 	"diagnostics",
 	"collection",
 	"authentication",
-	"organization"
+	"organization",
+	"contacts"
 ];
 const CLI_INVOCATION_KINDS = [
 	"command",
@@ -8732,6 +8831,7 @@ Schema.Struct({
 		...TelemetryEnvelopeProps,
 		organization_id: OrgIdTelemetrySchema,
 		progress: Schema.Literals([
+			"configuration_authorized",
 			"account_ready",
 			"permission_applied",
 			"membership_activated",
@@ -8739,6 +8839,9 @@ Schema.Struct({
 		]),
 		/** The invited Party. The initiating actor stays on the envelope's identity. */
 		member_party_id: Schema.String,
+		invitation_id: Schema.optional(Schema.String),
+		generation: Schema.optional(Schema.String),
+		command_id: Schema.optional(Schema.String),
 		occurred_at: Schema.Number
 	})
 });
@@ -9291,8 +9394,10 @@ const CAPXUL_FUNCTIONS = {
 	"movement/annotations": { overlay: "movement/annotations:overlay" },
 	"moneyExecution/actions": {
 		abandonPaymentExecution: "moneyExecution/actions:abandonPaymentExecution",
+		prepareInvitationConfiguration: "moneyExecution/actions:prepareInvitationConfiguration",
 		preparePermissionExecution: "moneyExecution/actions:preparePermissionExecution",
 		preparePaymentExecution: "moneyExecution/actions:preparePaymentExecution",
+		submitInvitationConfigurationExecution: "moneyExecution/actions:submitInvitationConfigurationExecution",
 		submitPermissionExecution: "moneyExecution/actions:submitPermissionExecution",
 		submitPaymentExecution: "moneyExecution/actions:submitPaymentExecution"
 	},
@@ -9309,8 +9414,6 @@ const CAPXUL_FUNCTIONS = {
 	},
 	"org/actions": {
 		confirmBootstrap: "org/actions:confirmBootstrap",
-		detectAndAcceptPendingInvitations: "org/actions:detectAndAcceptPendingInvitations",
-		inviteMember: "org/actions:inviteMember",
 		prepareBootstrap: "org/actions:prepareBootstrap",
 		prepareFounderAccount: "org/actions:prepareFounderAccount",
 		readTreasury: "org/actions:readTreasury",
@@ -9341,16 +9444,25 @@ const CAPXUL_FUNCTIONS = {
 		startOrResume: "org/lifecycle:startOrResume"
 	},
 	"org/mutations": {
+		accept: "org/mutations:accept",
+		cancel: "org/mutations:cancel",
 		createOrg: "org/mutations:createOrg",
-		resendInviteToken: "org/mutations:resendInviteToken"
+		decline: "org/mutations:decline",
+		invite: "org/mutations:invite",
+		resend: "org/mutations:resend",
+		retry: "org/mutations:retry"
 	},
 	"org/queries": {
+		getInvitation: "org/queries:getInvitation",
 		listAll: "org/queries:listAll",
+		listInvitations: "org/queries:listInvitations",
 		listMembersByOrgId: "org/queries:listMembersByOrgId",
 		listMine: "org/queries:listMine",
+		listMyInvitations: "org/queries:listMyInvitations",
 		listRolesByOrgId: "org/queries:listRolesByOrgId",
 		loadByOrgId: "org/queries:loadByOrgId",
-		me: "org/queries:me"
+		me: "org/queries:me",
+		previewInvite: "org/queries:previewInvite"
 	},
 	"smartAccount/actions": {
 		claim: "smartAccount/actions:claim",
@@ -10310,6 +10422,94 @@ const EventRefSchema = Schema.Struct({
 	topic0: Bytes32Schema,
 	dataHash: Bytes32Schema
 });
+const InvitationEoaReceiptSchema = Schema.Struct({
+	kind: Schema.Literal("invitation_eoa"),
+	chainId: BaseSepoliaChainIdSchema,
+	transactionHash: TxHashSchema,
+	blockNumber: BlockNumberSchema,
+	blockHash: Bytes32Schema,
+	sender: AddressSchema,
+	nonce: Schema.String.pipe(Schema.refine((value) => /^(0|[1-9][0-9]*)$/.test(value)))
+});
+const PermissionReceiptRefSchema = Schema.Union([Schema.Struct({
+	kind: Schema.Literal("user_operation"),
+	...ReceiptRefSchema.fields
+}), InvitationEoaReceiptSchema]);
+const PermissionEventRefSchema = Schema.Struct({
+	receipt: PermissionReceiptRefSchema,
+	emitter: AddressSchema,
+	transactionIndex: LogIndexSchema,
+	logIndex: LogIndexSchema,
+	topic0: Bytes32Schema,
+	dataHash: Bytes32Schema
+});
+Schema.Union([
+	Schema.Struct({
+		status: Schema.Literal("pending"),
+		reason: Schema.Literal("receipt_missing")
+	}),
+	Schema.Struct({
+		status: Schema.Literal("provider_failure"),
+		retryable: Schema.Literal(true)
+	}),
+	Schema.Struct({
+		status: Schema.Literal("mismatch"),
+		code: Schema.Literals([
+			"wrong_chain",
+			"wrong_sender",
+			"wrong_transaction",
+			"failed_transaction",
+			"non_canonical_block",
+			"wrong_contract_identity",
+			"missing_event",
+			"extra_authority_event",
+			"wrong_fact_tuple",
+			"wrong_state",
+			"conflicting_replay"
+		]),
+		attemptTransactionHash: Schema.optional(TxHashSchema),
+		receipt: Schema.optional(InvitationEoaReceiptSchema)
+	}),
+	Schema.Struct({
+		status: Schema.Literal("verified"),
+		commandId: PaymentCommandIdSchema,
+		receipt: InvitationEoaReceiptSchema,
+		events: Schema.Array(PermissionEventRefSchema),
+		factsHash: Bytes32Schema
+	})
+]);
+/**
+* One stored `setAllowance` call inside a command's expected authority set.
+*
+* The pinned Roles module emits `SetAllowance` as *post-state*, not as the call
+* arguments: `maxRefill = 0` becomes `type(uint128).max`, and `timestamp = 0`
+* becomes the receipt block's timestamp. A hash over the call arguments can
+* therefore never match that receipt. `index` names the entry in
+* `expectedAuthorityEvents` the call produced, and `data` is the call's own
+* calldata, so the verifier can rebuild the one hash the module actually emits.
+* The rule is pinned by `test:invitation-conformance`.
+*/
+const AllowanceExpectationSchema = Schema.Struct({
+	index: nonNegativeInteger("index"),
+	data: Schema.String.pipe(Schema.refine((value) => /^0x[0-9a-fA-F]+$/u.test(value), { message: "data must be 0x-prefixed hex" }))
+});
+Schema.Struct({
+	commandId: PaymentCommandIdSchema,
+	userOpHash: Bytes32Schema,
+	generationHash: Bytes32Schema,
+	chainId: BaseSepoliaChainIdSchema,
+	organizationSafe: SafeAddressSchema,
+	rolesModule: ModuleAddressSchema,
+	userOpSenderSafe: SafeAddressSchema,
+	expectedAuthorityEvents: Schema.Array(Bytes32Schema),
+	/**
+	* Absent means "no normalization": every expected hash is compared as stored.
+	* A command whose set contains `setAllowance` then refuses (`wrong_fact_tuple`)
+	* rather than passing on a weakened proof, so an incomplete caller fails
+	* closed.
+	*/
+	allowanceExpectations: Schema.optional(Schema.Array(AllowanceExpectationSchema))
+});
 const PermissionOperationSchema = Schema.Literals([
 	"create",
 	"change",
@@ -10353,7 +10553,9 @@ const StoredPermissionCommandSchema = Schema.Struct({
 });
 Schema.Struct({
 	command: StoredPermissionCommandSchema,
-	userOpHash: Bytes32Schema
+	userOpHash: Bytes32Schema,
+	/** The stored `setAllowance` calls of this command's own expectation. */
+	allowanceExpectations: Schema.optional(Schema.Array(AllowanceExpectationSchema))
 });
 Schema.Union([
 	Schema.Struct({
@@ -11197,6 +11399,27 @@ Schema.Struct({
 	digest: Bytes32Schema,
 	value: PermissionResourceSchema
 });
+Schema.Struct({
+	commandId: PaymentCommandIdSchema,
+	signerAddress: AddressSchema
+});
+Schema.Struct({
+	executionId: MoneyExecutionIdSchema,
+	commandId: PaymentCommandIdSchema,
+	orgId: nonEmpty("orgId"),
+	invitationId: nonEmpty("invitationId"),
+	generationHash: Bytes32Schema,
+	chainId: BaseSepoliaChainIdSchema,
+	signerAddress: AddressSchema,
+	userOpSenderSafe: SafeAddressSchema,
+	digest: Bytes32Schema
+});
+Schema.Struct({
+	status: Schema.Literal("submitted"),
+	executionId: MoneyExecutionIdSchema,
+	commandId: PaymentCommandIdSchema,
+	userOpHash: Bytes32Schema
+});
 Schema.Struct({
 	status: Schema.Literal("submitted"),
 	executionId: MoneyExecutionIdSchema,
@@ -11770,6 +11993,160 @@ const CurrentPolicySchema = Schema.Union([Schema.Struct({
 		actions: Schema.NonEmptyArray(Schema.Literals(["pay", "commitments"]))
 	})
 }), Schema.Struct({ type: Schema.Literal("managePeople") })]);
+const BudgetIntentSchema = CurrentPolicySchema.pipe(Schema.refine((value) => {
+	if (value.type !== "budget") return false;
+	const { actions, recipients } = value.scope;
+	if (new Set(actions).size !== actions.length) return false;
+	return recipients.type === "anyone" || recipients.accounts.length >= 1 && recipients.accounts.length <= 32 && new Set(recipients.accounts).size === recipients.accounts.length;
+}));
+const InvitationIdSchema = Schema.NonEmptyString;
+const InvitationTargetSchema = Schema.Struct({ invitationId: InvitationIdSchema });
+Schema.Struct({
+	...InvitationTargetSchema.fields,
+	expectedOfferDigest: Bytes32Schema
+});
+/** The requested grantee of one invitation. */
+const GranteeRefSchema = Schema.Union([Schema.Struct({
+	type: Schema.Literal("email"),
+	email: Schema.NonEmptyString
+}), Schema.Struct({
+	type: Schema.Literal("account"),
+	accountId: AccountIdSchema
+})]);
+Schema.Struct({
+	requestKey: Schema.String.pipe(Schema.refine((value) => /^[\x20-\x7e]{1,128}$/.test(value))),
+	to: GranteeRefSchema,
+	grants: Schema.Array(Schema.Union([
+		Schema.Struct({
+			type: Schema.Literal("budget"),
+			budgetId: PermissionIdSchema
+		}),
+		Schema.Struct({
+			type: Schema.Literal("managePeople"),
+			permissionId: PermissionIdSchema
+		}),
+		Schema.Struct({
+			type: Schema.Literal("new_budget"),
+			label: Schema.String.pipe(Schema.refine((value) => value.trim().length >= 1 && value.trim().length <= 128)),
+			intent: BudgetIntentSchema
+		})
+	]))
+}).pipe(Schema.refine((value) => {
+	if (value.grants.length < 1 || value.grants.length > 16) return false;
+	const existing = value.grants.flatMap((grant) => grant.type === "new_budget" ? [] : [grant.type === "budget" ? grant.budgetId : grant.permissionId]);
+	return new Set(existing).size === existing.length && value.grants.filter((grant) => grant.type === "new_budget").length <= 4;
+}));
+const InvitationPhaseSchema = Schema.Literals([
+	"authorizing",
+	"pending",
+	"pending_grant",
+	"active",
+	"revoking",
+	"declined",
+	"cancelled",
+	"expired",
+	"revoked"
+]);
+const EndingReasonSchema = Schema.Literals([
+	"declined",
+	"cancelled",
+	"expired",
+	"revoked"
+]);
+const OfferedAuthoritySchema = Schema.Union([Schema.Struct({
+	type: Schema.Literal("budget"),
+	budgetId: Schema.NonEmptyString.pipe(Schema.refine((value) => value.length > 0)),
+	label: Schema.String,
+	policy: BudgetIntentSchema,
+	policyDigest: Bytes32Schema
+}), Schema.Struct({
+	type: Schema.Literal("managePeople"),
+	permissionId: PermissionIdSchema,
+	label: Schema.String
+})]);
+const NewBudgetOfferSchema = Schema.Struct({
+	type: Schema.Literal("new_budget"),
+	label: Schema.String,
+	policy: BudgetIntentSchema,
+	policyDigest: Bytes32Schema
+});
+const PreviewGranteeSchema = Schema.Struct({
+	partyId: Schema.NullOr(PartyIdSchema),
+	accountId: Schema.NullOr(AccountIdSchema),
+	safeAddress: AddressSchema,
+	accountReady: Schema.NullOr(Schema.Boolean)
+});
+Schema.Struct({
+	orgId: Schema.NonEmptyString.pipe(Schema.refine((value) => value.length > 0)),
+	grantee: PreviewGranteeSchema,
+	grants: Schema.Array(Schema.Union([OfferedAuthoritySchema, NewBudgetOfferSchema])),
+	existingAssignments: Schema.Array(PermissionAssignmentIdSchema),
+	includesManagement: Schema.Boolean,
+	observedAt: EpochMsSchema
+});
+Schema.Struct({
+	cursor: Schema.optional(Schema.NonEmptyString),
+	limit: Schema.optional(Schema.Number.pipe(Schema.refine((value) => Number.isSafeInteger(value) && value >= 1 && value <= 100))),
+	phases: Schema.optional(Schema.Array(InvitationPhaseSchema).pipe(Schema.refine((value) => new Set(value).size === value.length)))
+});
+const InvitationRecoverySchema = Schema.Struct({
+	actor: Schema.Literals([
+		"system",
+		"invitee",
+		"admin"
+	]),
+	action: Schema.Literals([
+		"wait",
+		"retry",
+		"review_offer",
+		"reauthorize"
+	]),
+	reason: Schema.Literals([
+		"configuration_pending",
+		"grant_pending",
+		"provider_unavailable",
+		"policy_changed",
+		"cleanup_pending",
+		"signer_unavailable"
+	])
+});
+const InvitationViewSchema = Schema.Struct({
+	id: InvitationIdSchema,
+	orgId: Schema.NonEmptyString.pipe(Schema.refine((value) => value.length > 0)),
+	organizationName: Schema.String,
+	grantee: Schema.Struct({
+		partyId: PartyIdSchema,
+		accountId: Schema.NullOr(AccountIdSchema),
+		safeAddress: AddressSchema,
+		accountReady: Schema.NullOr(Schema.Boolean)
+	}),
+	phase: InvitationPhaseSchema,
+	grants: Schema.Array(Schema.Union([Schema.Struct({
+		type: Schema.Literal("budget"),
+		budgetId: Schema.NonEmptyString.pipe(Schema.refine((value) => value.length > 0))
+	}), Schema.Struct({
+		type: Schema.Literal("managePeople"),
+		permissionId: PermissionIdSchema
+	})])),
+	offers: Schema.Array(OfferedAuthoritySchema),
+	recovery: Schema.NullOr(InvitationRecoverySchema),
+	offerDigest: Bytes32Schema,
+	authorizedAt: Schema.NullOr(EpochMsSchema),
+	acceptedAt: Schema.NullOr(EpochMsSchema),
+	expiresAt: Schema.NullOr(EpochMsSchema),
+	commandId: Schema.NullOr(PaymentCommandIdSchema),
+	endingReason: Schema.NullOr(EndingReasonSchema),
+	delivery: Schema.Literals([
+		"not_confirmed",
+		"sent",
+		"failed"
+	])
+});
+Schema.Struct({
+	items: Schema.Array(InvitationViewSchema),
+	nextCursor: Schema.NullOr(Schema.NonEmptyString),
+	observedAt: EpochMsSchema
+});
 const ActiveBudgetSchema = Schema.Struct({
 	id: PermissionIdSchema,
 	label: Schema.String,
@@ -13689,11 +14066,13 @@ const financialOpsContract = {
 //#region ../../packages/sdk/src/contract/money-execution.ts
 const moneyExecutionContract = {
 	abandonPaymentExecution: makeFunctionReference(CAPXUL_FUNCTIONS["moneyExecution/actions"].abandonPaymentExecution),
+	prepareInvitationConfiguration: makeFunctionReference(CAPXUL_FUNCTIONS["moneyExecution/actions"].prepareInvitationConfiguration),
 	preparePermissionExecution: makeFunctionReference(CAPXUL_FUNCTIONS["moneyExecution/actions"].preparePermissionExecution),
 	preparePaymentExecution: makeFunctionReference(CAPXUL_FUNCTIONS["moneyExecution/actions"].preparePaymentExecution),
 	prepareOrganizationPaymentExecution: makeFunctionReference(CAPXUL_FUNCTIONS["moneyExecution/paymentCommandActions"].prepareOrganizationPaymentExecution),
 	preparePaymentLifecycleExecution: makeFunctionReference(CAPXUL_FUNCTIONS["moneyExecution/paymentCommandActions"].preparePaymentLifecycleExecution),
 	submitPaymentExecution: makeFunctionReference(CAPXUL_FUNCTIONS["moneyExecution/actions"].submitPaymentExecution),
+	submitInvitationConfigurationExecution: makeFunctionReference(CAPXUL_FUNCTIONS["moneyExecution/actions"].submitInvitationConfigurationExecution),
 	submitPermissionExecution: makeFunctionReference(CAPXUL_FUNCTIONS["moneyExecution/actions"].submitPermissionExecution),
 	submitPaymentCommandExecution: makeFunctionReference(CAPXUL_FUNCTIONS["moneyExecution/paymentCommandActions"].submitPaymentCommandExecution)
 };
@@ -14274,7 +14653,7 @@ function subscribeActivity(deps, actor, controls, onChange) {
 }
 //#endregion
 //#region ../../packages/sdk/package.json
-var version$1 = "4.20.0-beta.6";
+var version$1 = "4.20.0-beta.7";
 //#endregion
 //#region ../../packages/sdk/src/telemetry/exception-projection.ts
 /** Fixed fallback for failures that have no safe message. */
@@ -14901,7 +15280,7 @@ function isMoneyTelemetryDebugEnabled() {
 }
 //#endregion
 //#region ../../packages/sdk/src/surface/payment-command-execution.ts
-function isAborted$2(signal) {
+function isAborted$3(signal) {
 	return signal?.aborted === true;
 }
 function canonicalJson(value) {
@@ -14927,7 +15306,7 @@ async function abandonPrepared$1(deps, executionId, closePayment, reason, result
 	return result;
 }
 async function executePrepared(deps, prepare, isExpectedRequest, closePaymentOnExit, onPreparedClosed, signal, controls) {
-	if (isAborted$2(signal)) return {
+	if (isAborted$3(signal)) return {
 		ok: false,
 		error: Errors.cancelled({ operation: "payments" })
 	};
@@ -14956,7 +15335,7 @@ async function executePrepared(deps, prepare, isExpectedRequest, closePaymentOnE
 		ok: false,
 		error: Errors.invalidInput("payment", "prepared authority mismatch")
 	}, onPreparedClosed, controls);
-	if (isAborted$2(signal)) return abandonPrepared$1(deps, prepared.value.executionId, closePaymentOnExit, "cancelled", {
+	if (isAborted$3(signal)) return abandonPrepared$1(deps, prepared.value.executionId, closePaymentOnExit, "cancelled", {
 		ok: false,
 		error: Errors.cancelled({ operation: "payments" })
 	}, onPreparedClosed, controls);
@@ -14982,7 +15361,7 @@ async function executePrepared(deps, prepare, isExpectedRequest, closePaymentOnE
 			error: signerFailure(deps.signer.source, "signUserOpHash", cause)
 		}, onPreparedClosed, controls);
 	}
-	if (isAborted$2(signal)) return abandonPrepared$1(deps, prepared.value.executionId, closePaymentOnExit, "cancelled", {
+	if (isAborted$3(signal)) return abandonPrepared$1(deps, prepared.value.executionId, closePaymentOnExit, "cancelled", {
 		ok: false,
 		error: Errors.cancelled({ operation: "payments" })
 	}, onPreparedClosed, controls);
@@ -15017,7 +15396,7 @@ function cancelled(operation) {
 		error: Errors.cancelled({ operation })
 	};
 }
-function isAborted$1(signal) {
+function isAborted$2(signal) {
 	return signal?.aborted === true;
 }
 async function signerCall(source, operation, run) {
@@ -15043,7 +15422,7 @@ async function abandonPrepared(deps, executionId, reason, result, onPreparedClos
 	return result;
 }
 async function executePersonalPayment(deps, payment, signal, requestKey, onPreparedClosed) {
-	if (isAborted$1(signal)) return cancelled(CAPXUL_OPERATIONS.payments.pay);
+	if (isAborted$2(signal)) return cancelled(CAPXUL_OPERATIONS.payments.pay);
 	if (deps.signer === void 0) return mismatch("signer", "payments.pay requires a configured CapxulSigner");
 	const session = deps.actor.authSession();
 	if (session === null) return {
@@ -15071,10 +15450,10 @@ async function executePersonalPayment(deps, payment, signal, requestKey, onPrepa
 		executionId: prepared.value.executionId,
 		recipient: prepared.value.recipientObservation
 	});
-	if (isAborted$1(signal)) return abandonPrepared(deps, prepared.value.executionId, "cancelled", cancelled(CAPXUL_OPERATIONS.payments.pay), onPreparedClosed);
+	if (isAborted$2(signal)) return abandonPrepared(deps, prepared.value.executionId, "cancelled", cancelled(CAPXUL_OPERATIONS.payments.pay), onPreparedClosed);
 	const signature = await signerCall(deps.signer.source, "signUserOpHash", () => deps.signer.signUserOpHash(prepared.value.digest));
 	if (!signature.ok) return abandonPrepared(deps, prepared.value.executionId, "signer_rejected", signature, onPreparedClosed);
-	if (isAborted$1(signal)) return abandonPrepared(deps, prepared.value.executionId, "cancelled", cancelled(CAPXUL_OPERATIONS.payments.pay), onPreparedClosed);
+	if (isAborted$2(signal)) return abandonPrepared(deps, prepared.value.executionId, "cancelled", cancelled(CAPXUL_OPERATIONS.payments.pay), onPreparedClosed);
 	return runIfActive(void 0, CAPXUL_OPERATIONS.payments.submitExecution, () => deps.convexCall.action(deps.functions.submitPaymentExecution, { input: {
 		executionId: prepared.value.executionId,
 		signature: signature.value
@@ -44993,7 +45372,9 @@ const OBSERVED_CONVEX_MUTATIONS = /* @__PURE__ */ new Set([
 	"smartAccount/mutations:provision",
 	"org/lifecycle:startOrResume",
 	"org/lifecycle:recordFailure",
-	"org/lifecycle:retry"
+	"org/lifecycle:retry",
+	"org/mutations:invite",
+	"org/mutations:accept"
 ]);
 var ConvexCallAdapter = class {
 	#client;
@@ -45666,10 +46047,7 @@ const DEFAULT_FUNCTIONS$1 = {
 	listAll: makeFunctionReference(CAPXUL_FUNCTIONS["org/queries"].listAll),
 	listRoles: makeFunctionReference(CAPXUL_FUNCTIONS["org/queries"].listRolesByOrgId),
 	listMembers: makeFunctionReference(CAPXUL_FUNCTIONS["org/queries"].listMembersByOrgId),
-	readTreasury: makeFunctionReference(CAPXUL_FUNCTIONS["org/actions"].readTreasury),
-	inviteMember: makeFunctionReference(CAPXUL_FUNCTIONS["org/actions"].inviteMember),
-	resendInvite: makeFunctionReference(CAPXUL_FUNCTIONS["org/mutations"].resendInviteToken),
-	detectInvitations: makeFunctionReference(CAPXUL_FUNCTIONS["org/actions"].detectAndAcceptPendingInvitations)
+	readTreasury: makeFunctionReference(CAPXUL_FUNCTIONS["org/actions"].readTreasury)
 };
 /**
 * Standard production Organization read adapter. It intentionally has no
@@ -45705,22 +46083,6 @@ var ConvexOrganizationAdapter = class {
 	pendingMembers(input) {
 		return this.listMembers(input).pipe(Effect.map((members) => members.filter((member) => member.status === "pending" || member.status === "pending_safe" || member.status === "pending_grant")));
 	}
-	inviteMember(input) {
-		return this.#convex.action(this.#fns.inviteMember, copyInvocationObservation(input, {
-			orgId: input.orgId,
-			email: input.input.email,
-			role: input.input.role
-		})).pipe(Effect.mapError((error) => orgErrorFromCapxul("inviteMember", error.publicError, error)), Effect.map(brandOrgMember), Effect.catchDefect((cause) => Effect.fail(toOrgError("inviteMember", cause))));
-	}
-	resendInviteToken(input) {
-		return this.#convex.mutation(this.#fns.resendInvite, {
-			orgId: input.orgId,
-			email: input.email
-		}).pipe(Effect.mapError((error) => orgErrorFromCapxul("resendInviteToken", error.publicError, error)), Effect.map(brandOrgMember), Effect.catchDefect((cause) => Effect.fail(toOrgError("resendInviteToken", cause))));
-	}
-	detectAndAcceptPendingInvitations(_input) {
-		return this.#convex.action(this.#fns.detectInvitations, {}).pipe(Effect.mapError((error) => orgErrorFromCapxul("detectAndAcceptPendingInvitations", error.publicError, error)), Effect.map((result) => ({ matched: result.matched.map(toOrgId) })), Effect.catchDefect((cause) => Effect.fail(toOrgError("detectAndAcceptPendingInvitations", cause))));
-	}
 	#readTreasuryWire(input) {
 		const orgId = String(input.orgId);
 		return retryIdempotentRead(this.#convex.action(this.#fns.readTreasury, copyInvocationObservation(input, { orgId })), CAPXUL_OPERATIONS.org.treasury, this.#telemetry, input).pipe(Effect.mapError((error) => orgErrorFromCapxul("readTreasury", error.publicError, error)), Effect.map((wire) => {
@@ -45765,11 +46127,12 @@ var ConvexOrganizationSetupAdapter = class {
 	#fns;
 	constructor(input) {
 		this.#convex = input.convex;
-		this.#signer = input.signer;
+		this.#signer = input.signer ?? null;
 		this.#chainId = input.chainId;
 		this.#fns = input.functions ?? DEFAULT_FUNCTIONS;
 	}
 	async startOrResume(input) {
+		if (this.#signer === null) return fail$1(Errors.capabilityUnavailable("signer", "startOrResume"));
 		const result = await runCall("startOrResume", this.#convex.mutation(this.#fns.startOrResume, copyInvocationObservation(input, {
 			...input,
 			chainId: this.#chainId
@@ -45797,7 +46160,9 @@ var ConvexOrganizationSetupAdapter = class {
 	async authorizeAndSubmitBootstrap(input) {
 		const cancelled = cancellation(input.signal);
 		if (cancelled !== void 0) return cancelled;
-		const signerAddress = await signerResult(this.#signer.source, "getAddress", () => this.#signer.getAddress());
+		const signer = this.#signer;
+		if (signer === null) return fail$1(Errors.capabilityUnavailable("signer", "authorizeAndSubmitBootstrap"));
+		const signerAddress = await signerResult(signer.source, "getAddress", () => signer.getAddress());
 		if (!signerAddress.ok) return signerAddress;
 		const prepared = await runCall("prepareBootstrap", this.#convex.action(this.#fns.prepareBootstrap, copyInvocationObservation(input, {
 			orgId: input.orgId,
@@ -45809,7 +46174,7 @@ var ConvexOrganizationSetupAdapter = class {
 		if (!authority.ok) return authority;
 		const cancelledAfterPrepare = cancellation(input.signal);
 		if (cancelledAfterPrepare !== void 0) return cancelledAfterPrepare;
-		const signature = await signerResult(this.#signer.source, "signUserOpHash", () => this.#signer.signUserOpHash(prepared.value.digest));
+		const signature = await signerResult(signer.source, "signUserOpHash", () => signer.signUserOpHash(prepared.value.digest));
 		if (!signature.ok) return signature;
 		const cancelledAfterSign = cancellation(input.signal);
 		if (cancelledAfterSign !== void 0) return cancelledAfterSign;
@@ -45865,7 +46230,8 @@ var ConvexOrganizationSetupAdapter = class {
 			...input.observationContext === void 0 ? {} : { observationContext: input.observationContext }
 		});
 		if (!current.ok) return current;
-		if (current.value.status === "failed" && current.value.retryable && (current.value.at === "awaitingFounderAuthorization" || current.value.at === "submittingBootstrap")) {
+		if (current.value.status === "failed" && current.value.retryable && current.value.at === "awaitingFounderAuthorization") {
+			if (this.#signer === null) return fail$1(Errors.capabilityUnavailable("signer", "retry"));
 			const reset = resetSignerSession(this.#signer);
 			if (!reset.ok) return reset;
 		}
@@ -47913,6 +48279,271 @@ function makeOrgMeMethod(deps, orgId) {
 	};
 }
 //#endregion
+//#region ../../packages/sdk/src/contract/invitations.ts
+const invitationContract = {
+	preview: makeFunctionReference(CAPXUL_FUNCTIONS["org/queries"].previewInvite),
+	listMine: makeFunctionReference(CAPXUL_FUNCTIONS["org/queries"].listMyInvitations),
+	listScoped: makeFunctionReference(CAPXUL_FUNCTIONS["org/queries"].listInvitations),
+	get: makeFunctionReference(CAPXUL_FUNCTIONS["org/queries"].getInvitation),
+	invite: makeFunctionReference(CAPXUL_FUNCTIONS["org/mutations"].invite),
+	accept: makeFunctionReference(CAPXUL_FUNCTIONS["org/mutations"].accept),
+	decline: makeFunctionReference(CAPXUL_FUNCTIONS["org/mutations"].decline),
+	cancel: makeFunctionReference(CAPXUL_FUNCTIONS["org/mutations"].cancel),
+	resend: makeFunctionReference(CAPXUL_FUNCTIONS["org/mutations"].resend),
+	retry: makeFunctionReference(CAPXUL_FUNCTIONS["org/mutations"].retry)
+};
+//#endregion
+//#region ../../packages/sdk/src/surface/invitations.ts
+/**
+* The one refusal a scoped invitation result that names another Organization
+* receives, whether it was read or returned by the authoring write.
+*/
+function scopeRefusal(orgId) {
+	return Errors.invalidInput("orgId", `The invitation result does not belong to Organization ${JSON.stringify(orgId)}.`);
+}
+/**
+* A scoped invitation result belongs to the Organization it was read under.
+*
+* One owner holds the refusal copy and the verified-scope span: a single view
+* reports whether it names the scope, and a page — which names no Organization
+* of its own — reports whether every row does. A result that does not belong is
+* refused here rather than handed to a consumer, so a future route change
+* cannot turn into a silent cross-Organization read on a caller that trusted
+* the scope it passed. A successful scoped read also marks the verifying
+* Organization on the owning span, exactly as `org.me` does — the caller's
+* scope hint is not authority, the completed scoped read is.
+*/
+function verifyScope(orgId, value, belongsToScope) {
+	if (!belongsToScope(value)) return Effect.fail(scopeRefusal(orgId));
+	return Effect.annotateCurrentSpan({
+		verified_organization_id: orgId,
+		scope_kind: "organization"
+	}).pipe(Effect.as(value));
+}
+/** One view names its own Organization. */
+const namesScope = (orgId) => (value) => String(value.orgId) === orgId;
+/** A page names no Organization of its own, so every row must name the scope. */
+const rowsNameScope = (orgId) => (page) => page.items.every((item) => String(item.orgId) === orgId);
+const ops = CAPXUL_OPERATIONS.org.invitations;
+/** Truth for a caller-owned signal, without narrowing its type. */
+function isAborted$1(signal) {
+	return signal?.aborted === true;
+}
+/**
+* One observed operation around one Convex hop, exactly like `org.me`. The
+* call-start invocation snapshot rides the arguments, so the backend continues
+* the attempt this call started rather than resolving a new one.
+*/
+function observed$1(deps, operation, options, args, call, check) {
+	const controls = deps.invocationControls?.(options) ?? options;
+	return runCapxulEffect(call(copyInvocationObservation(controls, args)).pipe(Effect.mapError((failure) => failure.publicError), Effect.flatMap((value) => check === void 0 ? Effect.succeed(value) : check(value))), controls, operation, deps.runPromise);
+}
+/**
+* The Admin's preview stays a read: it reaches the preview query and nothing
+* else. It reads current policies and live assignments, so the operator sees
+* what the offered authority is now, not a frozen copy.
+*/
+function makeOrgInvitationMethods(deps, orgId) {
+	const scopeCheck = (value) => verifyScope(orgId, value, namesScope(orgId));
+	return {
+		preview: (input, options) => observed$1(deps, ops.preview, options, {
+			orgId,
+			request: input
+		}, (args) => deps.convexCall.query(invitationContract.preview, args), scopeCheck),
+		invite: makeInviteMethod(deps, orgId),
+		accept: (input, options) => observed$1(deps, ops.accept, options, {
+			orgId,
+			invitationId: input.invitationId,
+			expectedOfferDigest: input.expectedOfferDigest
+		}, (args) => deps.convexCall.mutation(invitationContract.accept, args), scopeCheck),
+		list: (input, options) => observed$1(deps, ops.listScoped, options, {
+			orgId,
+			...pageArgs(input)
+		}, (args) => deps.convexCall.query(invitationContract.listScoped, args), (page) => verifyScope(orgId, page, rowsNameScope(orgId))),
+		get: (input, options) => observed$1(deps, ops.get, options, {
+			orgId,
+			invitationId: input.invitationId
+		}, (args) => deps.convexCall.query(invitationContract.get, args), scopeCheck),
+		decline: (input, options) => observed$1(deps, ops.decline, options, {
+			orgId,
+			invitationId: input.invitationId
+		}, (args) => deps.convexCall.mutation(invitationContract.decline, args), scopeCheck),
+		cancel: (input, options) => observed$1(deps, ops.cancel, options, {
+			orgId,
+			invitationId: input.invitationId
+		}, (args) => deps.convexCall.mutation(invitationContract.cancel, args), scopeCheck),
+		resend: (input, options) => observed$1(deps, ops.resend, options, {
+			orgId,
+			invitationId: input.invitationId
+		}, (args) => deps.convexCall.mutation(invitationContract.resend, args), scopeCheck),
+		retry: (input, options) => observed$1(deps, ops.retry, options, {
+			orgId,
+			invitationId: input.invitationId
+		}, (args) => deps.convexCall.mutation(invitationContract.retry, args), scopeCheck)
+	};
+}
+/**
+* The authoring write, including its configuration hop.
+*
+* The mutation persists the invitation and its configure command before any
+* signature exists. The write then drives the existing human configuration
+* owner exactly as the Permission and payment surfaces drive theirs: prepare
+* the stored command for this Account's Safe, check the prepared authority
+* against the request, deliver the durable identity to the caller, sign the
+* returned digest, and submit it. The backend keeps the only authorization
+* rule (`prepareInvitationConfigurationIntentInTx` /
+* `submitInvitationConfigurationExecution`); this edge adds no second one.
+*
+* Cancellation owns the whole compound: an abort before the digest is signed
+* stops the write and forwards no signature, and an already-signed submission
+* completes.
+*/
+async function executeInvite(deps, orgId, input, signal, controls, verifiedOrganization, onPrepared) {
+	if (isAborted$1(signal)) return {
+		ok: false,
+		error: Errors.cancelled({ operation: ops.authorize })
+	};
+	if (deps.actor === void 0 || deps.chainId === void 0 || deps.signer === void 0) return {
+		ok: false,
+		error: Errors.notImplemented("invitations", "executionComposition")
+	};
+	const session = deps.actor.authSession();
+	if (session === null) return {
+		ok: false,
+		error: Errors.notAuthenticated()
+	};
+	const authored = await runIfActive(signal, ops.authorize, () => withInvocationParentSpan(Effect.suspend(() => deps.convexCall.mutation(invitationContract.invite, copyInvocationObservation(controls, {
+		orgId,
+		request: input
+	}))), controls), deps.runPromise);
+	if (!authored.ok) return authored;
+	const view = authored.value;
+	if (String(view.orgId) !== orgId) return {
+		ok: false,
+		error: scopeRefusal(orgId)
+	};
+	if (view.phase !== "authorizing") return {
+		ok: true,
+		value: view
+	};
+	if (view.commandId === null) return {
+		ok: false,
+		error: Errors.invalidInput("invitationId", "The invitation does not name its configuration command.")
+	};
+	const commandId = view.commandId;
+	let signerAddress;
+	try {
+		signerAddress = await deps.signer.getAddress();
+	} catch (cause) {
+		return {
+			ok: false,
+			error: signerFailure(deps.signer.source, "getAddress", cause)
+		};
+	}
+	const prepared = await runIfActive(signal, ops.prepareConfiguration, () => withInvocationParentSpan(Effect.suspend(() => deps.convexCall.action(moneyExecutionContract.prepareInvitationConfiguration, copyInvocationObservation(controls, { input: {
+		commandId,
+		signerAddress
+	} }))), controls), deps.runPromise);
+	if (!prepared.ok) return prepared;
+	const expectedSafe = deriveCapxulSafeAddress({ email: session.email });
+	if (!preparedAuthorityMatches({
+		prepared: prepared.value,
+		chainId: deps.chainId,
+		signerAddress,
+		expectedSafe,
+		commandId,
+		invitationId: view.id,
+		orgId
+	})) return {
+		ok: false,
+		error: Errors.invalidInput("invitation", "prepared authority mismatch")
+	};
+	verifiedOrganization(prepared.value.orgId);
+	if (isAborted$1(signal)) return {
+		ok: false,
+		error: Errors.cancelled({ operation: ops.authorize })
+	};
+	if (onPrepared !== void 0) try {
+		await onPrepared({
+			invitationId: prepared.value.invitationId,
+			commandId: prepared.value.commandId
+		});
+	} catch (cause) {
+		return {
+			ok: false,
+			error: cause instanceof CapxulError ? cause : Errors.unknown(cause)
+		};
+	}
+	if (isAborted$1(signal)) return {
+		ok: false,
+		error: Errors.cancelled({ operation: ops.authorize })
+	};
+	let signature;
+	try {
+		signature = await deps.signer.signUserOpHash(prepared.value.digest);
+	} catch (cause) {
+		return {
+			ok: false,
+			error: signerFailure(deps.signer.source, "signUserOpHash", cause)
+		};
+	}
+	if (isAborted$1(signal)) return {
+		ok: false,
+		error: Errors.cancelled({ operation: ops.authorize })
+	};
+	const submitted = await runIfActive(void 0, ops.submitConfiguration, () => withInvocationParentSpan(Effect.suspend(() => deps.convexCall.action(moneyExecutionContract.submitInvitationConfigurationExecution, copyInvocationObservation(controls, { input: {
+		executionId: prepared.value.executionId,
+		signature
+	} }))), controls), deps.runPromise);
+	if (!submitted.ok) return submitted;
+	return {
+		ok: true,
+		value: view
+	};
+}
+/**
+* The prepared authority must be exactly the one this write asked for: the same
+* chain, the caller's signer, this Account's Safe, and the exact command and
+* invitation the authoring view named.
+*/
+function preparedAuthorityMatches(input) {
+	return input.prepared.chainId === input.chainId && input.prepared.signerAddress.toLowerCase() === input.signerAddress.toLowerCase() && input.prepared.userOpSenderSafe.toLowerCase() === input.expectedSafe.toLowerCase() && input.prepared.commandId === input.commandId && input.prepared.invitationId === input.invitationId && input.prepared.orgId === input.orgId;
+}
+function makeInviteMethod(deps, orgId) {
+	return (input, options) => {
+		const { onPrepared, ...supplied } = options ?? {};
+		const controls = deps.invocationControls?.(supplied) ?? supplied;
+		let verifiedOrganizationId;
+		return runCapxulEffect(Effect.gen(function* () {
+			if (controls?.signal?.aborted === true) return yield* Effect.fail(Errors.cancelled({ operation: ops.authorize }));
+			const parent = yield* Effect.currentSpan.pipe(Effect.orDie);
+			const captured = carryInvocationParentSpan(controls, parent);
+			const result = yield* Effect.tryPromise({
+				try: () => executeInvite(deps, orgId, input, controls?.signal, captured, (id) => {
+					verifiedOrganizationId = id;
+				}, onPrepared),
+				catch: (cause) => cause instanceof CapxulError ? cause : Errors.unknown(cause)
+			});
+			return yield* result.ok ? Effect.succeed(result.value) : Effect.fail(result.error);
+		}).pipe(Effect.ensuring(Effect.suspend(() => verifiedOrganizationId === void 0 ? Effect.void : Effect.annotateCurrentSpan({
+			verified_organization_id: verifiedOrganizationId,
+			scope_kind: "organization"
+		})).pipe(Effect.catchCause(() => Effect.void)))), observationOnlyControls(controls), ops.authorize, deps.runPromise);
+	};
+}
+/** Drop the page fields the caller did not supply; a bounded page sends only its bounds. */
+function pageArgs(input) {
+	if (input === void 0) return {};
+	return {
+		...input.cursor === void 0 ? {} : { cursor: input.cursor },
+		...input.limit === void 0 ? {} : { limit: input.limit },
+		...input.phases === void 0 ? {} : { phases: input.phases }
+	};
+}
+function makeOwnInvitationsMethod(deps) {
+	return (input, options) => observed$1(deps, ops.list, options, pageArgs(input), (args) => deps.convexCall.query(invitationContract.listMine, args));
+}
+//#endregion
 //#region ../../packages/sdk/src/contract/permission.ts
 const permissionContract = { read: makeFunctionReference(CAPXUL_FUNCTIONS["permission/queries"].read) };
 //#endregion
@@ -48600,20 +49231,6 @@ function hermeticOrgView(input) {
 		observedAt: 0
 	};
 }
-function hermeticMember(input) {
-	return {
-		orgId: input.orgId,
-		accountId: null,
-		email: toEmail(input.email),
-		name: null,
-		personalSafeAddress: input.personalSafeAddress ?? null,
-		role: input.role,
-		roleKey: toRoleKey(orgRoleKeyForLabel(input.role)),
-		status: input.status,
-		grantTxHash: input.grantTxHash ?? null,
-		revokeTxHash: input.revokeTxHash ?? null
-	};
-}
 function createOrgProgram(input) {
 	return Effect.gen(function* () {
 		const deps = yield* OrgDepsTag;
@@ -48714,35 +49331,6 @@ function listMembersProgram(orgId) {
 		return [];
 	});
 }
-/**
-* R06 (#1964): the SDK no longer emits `org_invite_sent`. The backend action
-* that writes the invitation is its ONE producer, so a hermetic call — which
-* writes nothing — can no longer report an invitation that never happened, and
-* a live call is counted once instead of twice. The captured attempt rides the
-* port input, so the durable event carries the correlation this call ran under.
-*/
-function inviteMemberProgram(orgId, input) {
-	return Effect.gen(function* () {
-		const deps = yield* OrgDepsTag;
-		if (deps.orgPort === void 0) return hermeticMember({
-			orgId,
-			email: input.email,
-			role: input.role,
-			status: "pending"
-		});
-		return yield* deps.orgPort.inviteMember(copyInvocationObservation(deps.invocationSource, {
-			orgId,
-			input
-		})).pipe(Effect.mapError((error) => error.publicError));
-	});
-}
-function detectAndAcceptPendingInvitationsProgram() {
-	return Effect.gen(function* () {
-		const deps = yield* OrgDepsTag;
-		if (deps.orgPort !== void 0) return yield* deps.orgPort.detectAndAcceptPendingInvitations({}).pipe(Effect.mapError((error) => error.publicError));
-		return { matched: [] };
-	});
-}
 function listOrgsProgram() {
 	return Effect.gen(function* () {
 		const deps = yield* OrgDepsTag;
@@ -48848,6 +49436,20 @@ function observedRunnerDeps(deps) {
 		...deps.invocationControls === void 0 ? {} : { invocationControls: deps.invocationControls }
 	};
 }
+/**
+* The invitation edge needs the call seam, the observed-runner pair, and — for
+* the authoring write's configuration hop — the same execution composition the
+* Permission, payment, and payroll bundles receive.
+*/
+function invitationMethodsDeps(deps, convexCall) {
+	return {
+		convexCall,
+		...observedRunnerDeps(deps),
+		...deps.actor === void 0 ? {} : { actor: deps.actor },
+		...deps.chainId === void 0 ? {} : { chainId: Number(deps.chainId) },
+		...deps.signer === void 0 ? {} : { signer: deps.signer }
+	};
+}
 function makeOrgMethods(deps) {
 	const orgDeps = {
 		...deps.orgPort === void 0 ? {} : { orgPort: deps.orgPort },
@@ -48879,13 +49481,10 @@ function makeOrgMethods(deps) {
 			});
 			return toCapxulResult(createOrgProgram(input), layer);
 		},
-		orgs: Object.assign((options) => listOrganizations(deps.invocationControls?.(options) ?? options), { detectAndAcceptPendingInvitations(options) {
-			if (options?.signal?.aborted) return Promise.resolve({
-				ok: false,
-				error: Errors.cancelled({ operation: CAPXUL_OPERATIONS.organizations.detectAndAcceptPendingInvitations })
-			});
-			return toCapxulResult(detectAndAcceptPendingInvitationsProgram(), layer);
-		} }),
+		orgs: Object.assign((options) => listOrganizations(deps.invocationControls?.(options) ?? options), { invitations: deps.convexCall === void 0 ? () => Promise.resolve({
+			ok: false,
+			error: Errors.notImplemented("invitations", "listOwn")
+		}) : makeOwnInvitationsMethod(invitationMethodsDeps(deps, deps.convexCall)) }),
 		org(orgId) {
 			const convexCall = deps.convexCall;
 			return {
@@ -48993,17 +49592,7 @@ function makeOrgMethods(deps) {
 					});
 					return toCapxulResult(listRolesProgram(orgId), layer);
 				},
-				invite(_input, _options) {
-					const controls = deps.invocationControls?.(_options) ?? _options;
-					if (controls?.signal?.aborted) return Promise.resolve({
-						ok: false,
-						error: Errors.cancelled({ operation: CAPXUL_OPERATIONS.org.invite })
-					});
-					return runCapxulEffect(inviteMemberProgram(orgId, _input).pipe(Effect.provide(orgDepsLayer({
-						...orgDeps,
-						...controls === void 0 ? {} : { invocationSource: controls }
-					}))), controls, CAPXUL_OPERATIONS.org.invite, deps.runPromise);
-				},
+				invitations: convexCall === void 0 ? makeNotImplementedInvitationMethods() : makeOrgInvitationMethods(invitationMethodsDeps(deps, convexCall), String(orgId)),
 				auditLog(_options) {
 					if (_options?.signal?.aborted) return Promise.resolve({
 						ok: false,
@@ -49066,6 +49655,28 @@ const orgMeUnavailable = () => Promise.resolve({
 	ok: false,
 	error: Errors.notImplemented("org", "me")
 });
+/**
+* The closed invitation surface for a client with no backend seam. It reports
+* `NOT_IMPLEMENTED` for every method rather than an empty list or a fabricated
+* view: an absent composition root is not an absent invitation.
+*/
+function makeNotImplementedInvitationMethods() {
+	return {
+		preview: invitationExecutionUnavailable,
+		invite: invitationExecutionUnavailable,
+		accept: invitationExecutionUnavailable,
+		list: invitationExecutionUnavailable,
+		get: invitationExecutionUnavailable,
+		decline: invitationExecutionUnavailable,
+		cancel: invitationExecutionUnavailable,
+		resend: invitationExecutionUnavailable,
+		retry: invitationExecutionUnavailable
+	};
+}
+const invitationExecutionUnavailable = () => Promise.resolve({
+	ok: false,
+	error: Errors.notImplemented("invitations", "executionComposition")
+});
 const permissionExecutionUnavailable = () => Promise.resolve({
 	ok: false,
 	error: Errors.notImplemented("permissions", "executionComposition")
@@ -49565,7 +50176,6 @@ function assembleCapxulClient(input) {
 	};
 	if (input.signal !== void 0) input.signal.addEventListener("abort", () => void stopActor(), { once: true });
 	const selectedOrgPort = input.orgPort ?? input.orgDeploymentPort;
-	let detectPendingOrgInvitations;
 	let kickProvisioning;
 	const financialOps = makeFinancialOpsMethods({
 		runPromise: effectRunner.runPromise,
@@ -49614,7 +50224,6 @@ function assembleCapxulClient(input) {
 				if (browserSigner.statusStore?.status() === "unknown" && typeof browserSigner.ensureWalletReady === "function") browserSigner.ensureWalletReady().catch(() => {});
 			}
 			if (accountSetup === "explicit") return;
-			await detectPendingOrgInvitations?.();
 			kickProvisioning?.();
 		}
 	});
@@ -49682,9 +50291,6 @@ function assembleCapxulClient(input) {
 		...input.signer === void 0 ? {} : { signer: input.signer },
 		...input.organizationSetup === void 0 ? {} : { organizationSetup: input.organizationSetup }
 	});
-	if (selectedOrgPort !== void 0) detectPendingOrgInvitations = async () => {
-		await orgMethods.orgs.detectAndAcceptPendingInvitations();
-	};
 	const currentUser = makeCurrentUserMethods({
 		me: financialOps.me,
 		accounts,
@@ -50938,11 +51544,11 @@ async function createCapxulClientWithSignerControls(input, controls) {
 			accountSetup: input.accountSetup,
 			...signer === void 0 ? {} : { signer },
 			orgPort: Context.get(adapters.value.context, OrgPortTag),
-			...signer === void 0 ? {} : { organizationSetup: new ConvexOrganizationSetupAdapter({
+			organizationSetup: new ConvexOrganizationSetupAdapter({
 				convex: adapters.value.ports.convexCall,
-				signer,
+				...signer === void 0 ? {} : { signer },
 				chainId: adapters.value.bootstrap.chainId
-			}) },
+			}),
 			...input.signal === void 0 ? {} : { signal: input.signal },
 			...input.otpTtlMs === void 0 ? {} : { otpTtlMs: input.otpTtlMs },
 			invokeTimeoutMs: input.invokeTimeoutMs ?? 3e4,
@@ -51336,7 +51942,7 @@ const staffTools = [
 		scope: MANAGE,
 		register: (server, scope) => server.registerTool(CAPXUL_OPERATIONS.org.roles, {
 			title: "List Organization roles",
-			description: "List the active role labels that an Organization invitation can use.",
+			description: "List active Organization role labels.",
 			inputSchema: z.object(orgInput),
 			outputSchema: z.object({ roles: z.array(z.object({ label: z.string() })) })
 		}, ({ organizationId }) => withClient(scope, CAPXUL_OPERATIONS.org.roles, MANAGE, async (client) => {
@@ -51349,7 +51955,7 @@ const staffTools = [
 		scope: MANAGE,
 		register: (server, scope) => server.registerTool(CAPXUL_OPERATIONS.org.members, {
 			title: "List Organization members",
-			description: "List Organization member lifecycle states. Poll after activation until the member is active.",
+			description: "List current Organization member lifecycle states.",
 			inputSchema: z.object(orgInput),
 			outputSchema: z.object({ members: z.array(z.object({
 				accountId: z.string().nullable(),
@@ -51362,66 +51968,6 @@ const staffTools = [
 			const result = await client.listOrganizationMembers(organizationId);
 			return result.ok ? okResult({ members: [...result.value] }) : errorResult(result.error);
 		}))
-	},
-	{
-		name: CAPXUL_OPERATIONS.org.invite,
-		scope: MANAGE,
-		register: (server, scope) => server.registerTool(CAPXUL_OPERATIONS.org.invite, {
-			title: "Invite Organization member",
-			description: "Invite one Person by email into an Organization. Use a role label returned by org.roles.",
-			inputSchema: z.object({
-				...orgInput,
-				email,
-				role: z.string().trim().min(1)
-			}),
-			outputSchema: z.object({
-				email,
-				role: z.string(),
-				status: memberStatus
-			})
-		}, ({ organizationId, email: invitee, role }) => withClient(scope, CAPXUL_OPERATIONS.org.invite, MANAGE, async (client) => {
-			const result = await client.inviteOrganizationMember(organizationId, {
-				email: invitee,
-				role
-			});
-			return result.ok ? okResult({ ...result.value }) : errorResult(result.error);
-		}))
-	},
-	{
-		name: CAPXUL_OPERATIONS.org.acceptInvitations,
-		scope: MANAGE,
-		register: (server, scope) => server.registerTool(CAPXUL_OPERATIONS.org.acceptInvitations, {
-			title: "Accept Organization invitations",
-			description: "Accept every pending Organization invitation for the signed-in Person's verified email.",
-			inputSchema: z.object({}),
-			outputSchema: z.object({ organizationIds: z.array(z.string()) })
-		}, () => withClient(scope, CAPXUL_OPERATIONS.org.acceptInvitations, MANAGE, async (client) => {
-			const result = await client.acceptOrganizationInvitations();
-			return result.ok ? okResult({ ...result.value }) : errorResult(result.error);
-		}))
-	},
-	{
-		name: CAPXUL_OPERATIONS.org.activateMember,
-		scope: MANAGE,
-		register: (server, scope) => server.registerTool(CAPXUL_OPERATIONS.org.activateMember, {
-			title: "Activate Organization member",
-			description: "Grant the invited role to a pending member's ready Account. The Organization founder signs this operation.",
-			inputSchema: z.object({
-				...orgInput,
-				email,
-				accountId: z.string().trim().min(1)
-			}),
-			outputSchema: z.object({
-				email,
-				status: z.enum(["active", "submitted"])
-			})
-		}, ({ organizationId, email: invitee, accountId }) => withClient(scope, CAPXUL_OPERATIONS.org.activateMember, MANAGE, async (client) => {
-			const result = await client.activateOrganizationMember(organizationId, {
-				email: invitee,
-				accountId
-			});
-			return result.ok ? okResult({ ...result.value }) : errorResult(result.error);
-		}))
 	}
 ];
 //#endregion
@@ -51748,7 +52294,7 @@ function stdioIdentity(env = process.env, options = {}) {
 }
 //#endregion
 //#region package.json
-var version = "4.20.0-beta.6";
+var version = "4.20.0-beta.7";
 //#endregion
 //#region src/deps.ts
 const NO_IDENTITY = async () => void 0;
@@ -51833,9 +52379,6 @@ const SAFE_TOOL_INTENTS = {
 	[CAPXUL_OPERATIONS.system.health]: "Verify MCP backend health.",
 	[CAPXUL_OPERATIONS.onboarding.completePerson]: "Complete Person onboarding.",
 	[CAPXUL_OPERATIONS.onboarding.completeOrganization]: "Complete Organization onboarding.",
-	[CAPXUL_OPERATIONS.org.acceptInvitations]: "Accept Organization invitations.",
-	[CAPXUL_OPERATIONS.org.activateMember]: "Activate an Organization member.",
-	[CAPXUL_OPERATIONS.org.invite]: "Invite an Organization member.",
 	[CAPXUL_OPERATIONS.org.list]: "List Organizations.",
 	[CAPXUL_OPERATIONS.org.members]: "List Organization members.",
 	[CAPXUL_OPERATIONS.org.roles]: "List Organization roles.",
@@ -52254,85 +52797,6 @@ async function createSdkClient(input, createClient = createCapxulClient) {
 					}))
 				};
 			},
-			inviteOrganizationMember: async (orgId, invitation) => {
-				const result = await client.org(orgId).invite(invitation);
-				if (!result.ok) return result;
-				return {
-					ok: true,
-					value: {
-						email: String(result.value.email),
-						role: result.value.role,
-						status: result.value.status
-					}
-				};
-			},
-			acceptOrganizationInvitations: async () => {
-				const result = await client.orgs.detectAndAcceptPendingInvitations();
-				if (!result.ok) return result;
-				return {
-					ok: true,
-					value: { organizationIds: result.value.matched.map(String) }
-				};
-			},
-			activateOrganizationMember: async (orgId, activation) => {
-				const memberEmail = activation.email.trim().toLowerCase();
-				const scoped = client.org(orgId);
-				const members = await scoped.members();
-				if (!members.ok) return members;
-				const matches = members.value.filter((member) => String(member.email) === memberEmail);
-				const member = matches.length === 1 ? matches[0] : void 0;
-				if (member === void 0) return {
-					ok: false,
-					error: Errors.invalidInput("email", "member was not found")
-				};
-				if (member.status === "active") return {
-					ok: true,
-					value: {
-						email: memberEmail,
-						status: "active"
-					}
-				};
-				if (member.status !== "pending_grant" || member.roleKey === null) return {
-					ok: false,
-					error: Errors.wrongState({
-						method: CAPXUL_OPERATIONS.org.activateMember,
-						currentState: member.status,
-						validStates: ["pending_grant", "active"]
-					})
-				};
-				const permissions = await scoped.permissions.list();
-				if (!permissions.ok) return permissions;
-				const matchingPermissions = permissions.value.permissions.filter((permission) => permission.type === "managePeople" && permission.state === "active" && String(permission.roleKey).toLowerCase() === String(member.roleKey).toLowerCase());
-				const permission = matchingPermissions.length === 1 ? matchingPermissions[0] : void 0;
-				if (permission === void 0) return {
-					ok: false,
-					error: Errors.wrongState({
-						method: CAPXUL_OPERATIONS.org.activateMember,
-						currentState: "matching-permission-missing",
-						validStates: ["one-active-role-permission"]
-					})
-				};
-				const requestKey = `mcp-staff-${createHash("sha256").update(JSON.stringify({
-					orgId,
-					email: memberEmail,
-					accountId: activation.accountId,
-					permissionId: permission.permissionId
-				})).digest("hex")}`;
-				const assigned = await scoped.permissions.assign({
-					requestKey,
-					permissionId: String(permission.permissionId),
-					accountId: activation.accountId,
-					expectedMemberEmail: memberEmail
-				});
-				if (!assigned.ok) return assigned;
-				return {
-					ok: true,
-					value: {
-						email: memberEmail,
-						status: "submitted"
-					}
-				};
-			},
 			getLifecycle: async () => {
 				const result = await client.account.getLifecycle();
 				if (!result.ok) return result;