@capxul/sandbox 4.20.0-beta.6 → 4.20.0-beta.7

package/README.md

@@ -15,7 +15,7 @@ npx @capxul/sandbox faucet send
 vp run --filter @capxul/sandbox dev -- --help
 ```
 
-`key create` uses the Railway public staging Site endpoint and
+`key create` uses the Coolify public staging Site endpoint and
 needs no operator secret. `APP_ENV` does not retarget this public command; use
 the returned key only with the staging tuple.
 `faucet send` invokes the canonical Convex deployment and requires operator

package/dist/main.mjs

@@ -2021,6 +2021,28 @@ const toFunctionSelector = (fn) => slice(toSignatureHash(fn), 0, 4);
 //#region ../../packages/config/src/org-payments.ts
 /** Zodiac MultiSendCallOnly module on Base Sepolia. */
 const MULTI_SEND_CALL_ONLY = "0x9641d764fc13c8b624c04430c7356c1c7c8102e2";
+/** Supported Organization permission identities, newest first. */
+const ORG_PERMISSION_IDENTITY_PROFILES = [{
+	id: "zodiac-roles-2.1.1",
+	moduleFactoryRuntimeKeccak256: "0x01623cbcf010a1c326230f1b2d5f48a66b440232ee49096102bc84967dc5f21e",
+	mastercopy: "0xf2964ce6161ce0e75964fe7927ce114cb0b283d5",
+	mastercopyRuntimeKeccak256: "0x471d8b3b419f1eb955230c0326c8812176df49bf3c7b414a563fda5a3c6c10b6",
+	proxyRuntimeKeccak256: "0x248f9591f94c24c199ade3e73feb477cf02d387b2bea91f2f931a0deb094f163",
+	multiSendUnwrapper: "0xb4cd4bb764c089f20da18700ce8bc5e49f369efd",
+	multiSendUnwrapperRuntimeKeccak256: "0x1f6e088be5e6ef9d0fbe0547d3fa9a9e40d823433fd8a4449215b5663209a1eb"
+}, {
+	id: "zodiac-roles-2.1.0",
+	moduleFactoryRuntimeKeccak256: "0x01623cbcf010a1c326230f1b2d5f48a66b440232ee49096102bc84967dc5f21e",
+	mastercopy: "0x9646fdad06d3e24444381f44362a3b0eb343d337",
+	mastercopyRuntimeKeccak256: "0x87911cbc6aa0496e6bcb07dab2462b9c76daea130dede6dcc57d0adf307fa7ec",
+	proxyRuntimeKeccak256: "0x9d4059abf46db50e4b48d9b6404b1f200cb5a1efeb3725be2de630a2a9001944",
+	multiSendUnwrapper: "0x93b7fcbc63ed8a3a24b59e1c3e6649d50b7427c0",
+	multiSendUnwrapperRuntimeKeccak256: "0x4d8d8608b70a6e2f40726b9dd74406bbf73e90cac58e23ee953e2b45ad7dc3df"
+}];
+const CURRENT_ORG_PERMISSION_IDENTITY = ORG_PERMISSION_IDENTITY_PROFILES[0];
+ORG_PERMISSION_IDENTITY_PROFILES[1];
+CURRENT_ORG_PERMISSION_IDENTITY.mastercopy;
+CURRENT_ORG_PERMISSION_IDENTITY.multiSendUnwrapper;
 //#endregion
 //#region ../../packages/config/src/capxul-payments-v2.ts
 /** The exact compiled CapxulPaymentsV2 ABI. */
@@ -14174,10 +14196,12 @@ const CAPXUL_OPERATIONS = {
 		prepareOrganizationPaymentExecution: "moneyExecution.prepareOrganizationPaymentExecution",
 		preparePaymentExecution: "moneyExecution.preparePaymentExecution",
 		preparePaymentLifecycleExecution: "moneyExecution.preparePaymentLifecycleExecution",
+		prepareInvitationConfiguration: "moneyExecution.prepareInvitationConfiguration",
 		preparePermissionExecution: "moneyExecution.preparePermissionExecution",
 		recoverSubmissionClaims: "moneyExecution.recoverSubmissionClaims",
 		submit: "moneyExecution.submit",
 		submitPaymentCommandExecution: "moneyExecution.submitPaymentCommandExecution",
+		submitInvitationConfigurationExecution: "moneyExecution.submitInvitationConfigurationExecution",
 		submitPaymentExecution: "moneyExecution.submitPaymentExecution",
 		submitPermissionExecution: "moneyExecution.submitPermissionExecution"
 	},
@@ -14199,20 +14223,52 @@ const CAPXUL_OPERATIONS = {
 		completePerson: "onboarding.completePerson"
 	},
 	org: {
-		acceptInvitations: "org.acceptInvitations",
 		account: { get: "org.account.get" },
-		activateMember: "org.activateMember",
 		auditLog: "org.auditLog",
 		confirmBootstrap: "org.confirmBootstrap",
 		createOrg: "org.createOrg",
 		create: "org.create",
-		detectAndAcceptPendingInvitations: "org.detectAndAcceptPendingInvitations",
+		/**
+		* §11: the consent mutation reports `org_invite_accepted` through its own
+		* scheduled emitter. It is named for the emit, not the acceptance, because
+		* the interactive acceptance itself owns `org.invitations.accept`.
+		*/
+		emitInviteAccepted: "org.emitInviteAccepted",
 		emitInviteProgressed: "org.emitInviteProgressed",
 		expireInvitations: "org.expireInvitations",
 		getLifecycle: "org.getLifecycle",
 		getProofReceipt: "org.getProofReceipt",
 		invite: "org.invite",
-		inviteMember: "org.inviteMember",
+		/** D8 invitation lifecycle: preview, own list, read, and the four transitions. */
+		invitations: {
+			/** The exact grantee's consent commit (§8): one accepted digest, once. */
+			accept: "org.invitations.accept",
+			/**
+			* The authoring write. It is named `authorize`, not `invite`, because the
+			* backend already uses `org.invitations.invite` as a refusal label and
+			* `lint:telemetry-spine` refuses a label that collides with an operation.
+			*/
+			authorize: "org.invitations.authorize",
+			cancel: "org.invitations.cancel",
+			decline: "org.invitations.decline",
+			get: "org.invitations.get",
+			list: "org.invitations.list",
+			/**
+			* The Admin-scoped Organization list. It is named `listScoped`, not
+			* `list`, because the own-offer list already owns `org.invitations.list`.
+			*/
+			listScoped: "org.invitations.listScoped",
+			/**
+			* The authoring write's inner hops: the SDK drives the backend's existing
+			* prepare/submit pair, and these names label the two Convex calls. The
+			* owning `capxul_sdk_operation` record stays `org.invitations.authorize`.
+			*/
+			prepareConfiguration: "org.invitations.prepareConfiguration",
+			preview: "org.invitations.preview",
+			resend: "org.invitations.resend",
+			retry: "org.invitations.retry",
+			submitConfiguration: "org.invitations.submitConfiguration"
+		},
 		list: "org.list",
 		load: "org.load",
 		me: "org.me",
@@ -14271,7 +14327,6 @@ const CAPXUL_OPERATIONS = {
 		},
 		recordFailure: "org.recordFailure",
 		recordProgress: "org.recordProgress",
-		resendInviteToken: "org.resendInviteToken",
 		resumeBootstrapSubmission: "org.resumeBootstrapSubmission",
 		retry: "org.retry",
 		retrySetup: "org.retrySetup",
@@ -14288,7 +14343,6 @@ const CAPXUL_OPERATIONS = {
 		retry: "organizationPayments.retry"
 	},
 	organizationSetup: { getProofReceipt: "organizationSetup.getProofReceipt" },
-	organizations: { detectAndAcceptPendingInvitations: "orgs.detectAndAcceptPendingInvitations" },
 	payments: {
 		cancel: "payments.cancel",
 		claim: "payments.claim",
@@ -14326,6 +14380,7 @@ const CAPXUL_OPERATIONS = {
 		terms: "payroll.terms"
 	},
 	permission: {
+		verifyInvitationConfiguration: "permission.verifyInvitationConfiguration",
 		command: "permission.command",
 		retryVerification: "permission.retryVerification",
 		verify: "permission.verify",
@@ -14862,6 +14917,11 @@ const OrgCreateFailedProps = Struct({
 const OrgInviteSentProps = Struct({
 	...TelemetryEnvelopeProps,
 	org_id: OptionalOrgId,
+	invitation_id: OptionalString,
+	generation: OptionalString,
+	command_id: OptionalString,
+	subject_party_id: OptionalString,
+	persisted_at: OptionalEpochMs,
 	email_domain: OptionalString,
 	role: OptionalString,
 	status: OptionalString
@@ -14869,6 +14929,11 @@ const OrgInviteSentProps = Struct({
 const OrgInviteAcceptedProps = Struct({
 	...TelemetryEnvelopeProps,
 	org_id: OptionalOrgId,
+	invitation_id: OptionalString,
+	accepted_at: OptionalEpochMs,
+	generation: OptionalString,
+	command_id: OptionalString,
+	subject_party_id: OptionalString,
 	role: OptionalString,
 	status: OptionalString
 });
@@ -14876,6 +14941,7 @@ const OrgInviteExpiredProps = Struct({
 	...TelemetryEnvelopeProps,
 	org_id: OptionalOrgId,
 	email_domain: OptionalString,
+	invitation_id: OptionalString,
 	reason: OptionalString,
 	role: OptionalString,
 	status: OptionalString
@@ -15028,9 +15094,24 @@ const PermissionMirrorVerificationProps = Struct({
 		"applied",
 		"replayed",
 		"conflicting_replay",
-		"revision_mismatch"
+		"revision_mismatch",
+		"cleanup_required",
+		"not_applied",
+		"application_failure",
+		"mismatch",
+		"refused"
 	])),
+	command_kind: optional(Literals(["invitation_configuration", "invitation_eoa"])),
 	command_id: OptionalString,
+	invitation_id: OptionalString,
+	generation: OptionalString,
+	purpose: optional(Literals([
+		"configure",
+		"grant",
+		"disable",
+		"compensate"
+	])),
+	$insert_id: OptionalString,
 	/**
 	* #1961 R03. The authorized stored row names the Permission it changed; the
 	* verified receipt names the chain facts that prove it. Every field is
@@ -15417,6 +15498,13 @@ const CLI_COMMAND_NAMES = [
 	"auth.profile",
 	"auth.status",
 	"auth.logout",
+	"contact",
+	"contact.list",
+	"contact.get",
+	"contact.add",
+	"contact.label",
+	"contact.hide",
+	"contact.unhide",
 	"org",
 	CAPXUL_OPERATIONS.org.list,
 	"org.use",
@@ -15425,6 +15513,24 @@ const CLI_COMMAND_NAMES = [
 	CAPXUL_OPERATIONS.org.members,
 	"org.member",
 	"org.member.get",
+	"org.member.invite",
+	"org.contact",
+	"org.contact.list",
+	"org.contact.get",
+	"org.contact.add",
+	"org.contact.label",
+	"org.contact.hide",
+	"org.contact.unhide",
+	CAPXUL_OPERATIONS.org.invite,
+	"org.invite.list",
+	"org.invite.get",
+	"org.invite.wait",
+	"org.invite.review",
+	"org.invite.accept",
+	"org.invite.decline",
+	"org.invite.cancel",
+	"org.invite.resend",
+	"org.invite.retry",
 	"org.wait",
 	CAPXUL_OPERATIONS.org.create,
 	CAPXUL_OPERATIONS.org.retry,
@@ -15435,7 +15541,8 @@ const CLI_CAPABILITIES = [
 	"diagnostics",
 	"collection",
 	"authentication",
-	"organization"
+	"organization",
+	"contacts"
 ];
 const CLI_INVOCATION_KINDS = [
 	"command",
@@ -15677,6 +15784,7 @@ Struct({
 		...TelemetryEnvelopeProps,
 		organization_id: OrgIdTelemetrySchema,
 		progress: Literals([
+			"configuration_authorized",
 			"account_ready",
 			"permission_applied",
 			"membership_activated",
@@ -15684,6 +15792,9 @@ Struct({
 		]),
 		/** The invited Party. The initiating actor stays on the envelope's identity. */
 		member_party_id: String$1,
+		invitation_id: optional(String$1),
+		generation: optional(String$1),
+		command_id: optional(String$1),
 		occurred_at: Number$1
 	})
 });
@@ -15977,8 +16088,10 @@ const CAPXUL_FUNCTIONS = {
 	"movement/annotations": { overlay: "movement/annotations:overlay" },
 	"moneyExecution/actions": {
 		abandonPaymentExecution: "moneyExecution/actions:abandonPaymentExecution",
+		prepareInvitationConfiguration: "moneyExecution/actions:prepareInvitationConfiguration",
 		preparePermissionExecution: "moneyExecution/actions:preparePermissionExecution",
 		preparePaymentExecution: "moneyExecution/actions:preparePaymentExecution",
+		submitInvitationConfigurationExecution: "moneyExecution/actions:submitInvitationConfigurationExecution",
 		submitPermissionExecution: "moneyExecution/actions:submitPermissionExecution",
 		submitPaymentExecution: "moneyExecution/actions:submitPaymentExecution"
 	},
@@ -15995,8 +16108,6 @@ const CAPXUL_FUNCTIONS = {
 	},
 	"org/actions": {
 		confirmBootstrap: "org/actions:confirmBootstrap",
-		detectAndAcceptPendingInvitations: "org/actions:detectAndAcceptPendingInvitations",
-		inviteMember: "org/actions:inviteMember",
 		prepareBootstrap: "org/actions:prepareBootstrap",
 		prepareFounderAccount: "org/actions:prepareFounderAccount",
 		readTreasury: "org/actions:readTreasury",
@@ -16027,16 +16138,25 @@ const CAPXUL_FUNCTIONS = {
 		startOrResume: "org/lifecycle:startOrResume"
 	},
 	"org/mutations": {
+		accept: "org/mutations:accept",
+		cancel: "org/mutations:cancel",
 		createOrg: "org/mutations:createOrg",
-		resendInviteToken: "org/mutations:resendInviteToken"
+		decline: "org/mutations:decline",
+		invite: "org/mutations:invite",
+		resend: "org/mutations:resend",
+		retry: "org/mutations:retry"
 	},
 	"org/queries": {
+		getInvitation: "org/queries:getInvitation",
 		listAll: "org/queries:listAll",
+		listInvitations: "org/queries:listInvitations",
 		listMembersByOrgId: "org/queries:listMembersByOrgId",
 		listMine: "org/queries:listMine",
+		listMyInvitations: "org/queries:listMyInvitations",
 		listRolesByOrgId: "org/queries:listRolesByOrgId",
 		loadByOrgId: "org/queries:loadByOrgId",
-		me: "org/queries:me"
+		me: "org/queries:me",
+		previewInvite: "org/queries:previewInvite"
 	},
 	"smartAccount/actions": {
 		claim: "smartAccount/actions:claim",
@@ -16972,6 +17092,93 @@ const EventRefSchema = Struct({
 	topic0: Bytes32Schema,
 	dataHash: Bytes32Schema
 });
+const InvitationEoaReceiptSchema = Struct({
+	kind: Literal("invitation_eoa"),
+	chainId: BaseSepoliaChainIdSchema,
+	transactionHash: TxHashSchema,
+	blockNumber: BlockNumberSchema,
+	blockHash: Bytes32Schema,
+	sender: AddressSchema,
+	nonce: String$1.pipe(refine((value) => /^(0|[1-9][0-9]*)$/.test(value)))
+});
+const PermissionEventRefSchema = Struct({
+	receipt: Union([Struct({
+		kind: Literal("user_operation"),
+		...ReceiptRefSchema.fields
+	}), InvitationEoaReceiptSchema]),
+	emitter: AddressSchema,
+	transactionIndex: LogIndexSchema,
+	logIndex: LogIndexSchema,
+	topic0: Bytes32Schema,
+	dataHash: Bytes32Schema
+});
+Union([
+	Struct({
+		status: Literal("pending"),
+		reason: Literal("receipt_missing")
+	}),
+	Struct({
+		status: Literal("provider_failure"),
+		retryable: Literal(true)
+	}),
+	Struct({
+		status: Literal("mismatch"),
+		code: Literals([
+			"wrong_chain",
+			"wrong_sender",
+			"wrong_transaction",
+			"failed_transaction",
+			"non_canonical_block",
+			"wrong_contract_identity",
+			"missing_event",
+			"extra_authority_event",
+			"wrong_fact_tuple",
+			"wrong_state",
+			"conflicting_replay"
+		]),
+		attemptTransactionHash: optional(TxHashSchema),
+		receipt: optional(InvitationEoaReceiptSchema)
+	}),
+	Struct({
+		status: Literal("verified"),
+		commandId: PaymentCommandIdSchema,
+		receipt: InvitationEoaReceiptSchema,
+		events: ArraySchema(PermissionEventRefSchema),
+		factsHash: Bytes32Schema
+	})
+]);
+/**
+* One stored `setAllowance` call inside a command's expected authority set.
+*
+* The pinned Roles module emits `SetAllowance` as *post-state*, not as the call
+* arguments: `maxRefill = 0` becomes `type(uint128).max`, and `timestamp = 0`
+* becomes the receipt block's timestamp. A hash over the call arguments can
+* therefore never match that receipt. `index` names the entry in
+* `expectedAuthorityEvents` the call produced, and `data` is the call's own
+* calldata, so the verifier can rebuild the one hash the module actually emits.
+* The rule is pinned by `test:invitation-conformance`.
+*/
+const AllowanceExpectationSchema = Struct({
+	index: nonNegativeInteger("index"),
+	data: String$1.pipe(refine((value) => /^0x[0-9a-fA-F]+$/u.test(value), { message: "data must be 0x-prefixed hex" }))
+});
+Struct({
+	commandId: PaymentCommandIdSchema,
+	userOpHash: Bytes32Schema,
+	generationHash: Bytes32Schema,
+	chainId: BaseSepoliaChainIdSchema,
+	organizationSafe: SafeAddressSchema,
+	rolesModule: ModuleAddressSchema,
+	userOpSenderSafe: SafeAddressSchema,
+	expectedAuthorityEvents: ArraySchema(Bytes32Schema),
+	/**
+	* Absent means "no normalization": every expected hash is compared as stored.
+	* A command whose set contains `setAllowance` then refuses (`wrong_fact_tuple`)
+	* rather than passing on a weakened proof, so an incomplete caller fails
+	* closed.
+	*/
+	allowanceExpectations: optional(ArraySchema(AllowanceExpectationSchema))
+});
 const PermissionOperationSchema = Literals([
 	"create",
 	"change",
@@ -17014,7 +17221,9 @@ Struct({
 		originatingAuthUserId: optional(String$1),
 		originatingObservationContext: optional(Unknown)
 	}),
-	userOpHash: Bytes32Schema
+	userOpHash: Bytes32Schema,
+	/** The stored `setAllowance` calls of this command's own expectation. */
+	allowanceExpectations: optional(ArraySchema(AllowanceExpectationSchema))
 });
 Union([
 	Struct({
@@ -17850,6 +18059,27 @@ Struct({
 	digest: Bytes32Schema,
 	value: PermissionResourceSchema
 });
+Struct({
+	commandId: PaymentCommandIdSchema,
+	signerAddress: AddressSchema
+});
+Struct({
+	executionId: MoneyExecutionIdSchema,
+	commandId: PaymentCommandIdSchema,
+	orgId: nonEmpty("orgId"),
+	invitationId: nonEmpty("invitationId"),
+	generationHash: Bytes32Schema,
+	chainId: BaseSepoliaChainIdSchema,
+	signerAddress: AddressSchema,
+	userOpSenderSafe: SafeAddressSchema,
+	digest: Bytes32Schema
+});
+Struct({
+	status: Literal("submitted"),
+	executionId: MoneyExecutionIdSchema,
+	commandId: PaymentCommandIdSchema,
+	userOpHash: Bytes32Schema
+});
 Struct({
 	status: Literal("submitted"),
 	executionId: MoneyExecutionIdSchema,
@@ -18354,6 +18584,158 @@ const CurrentPolicySchema = Union([Struct({
 		actions: NonEmptyArray(Literals(["pay", "commitments"]))
 	})
 }), Struct({ type: Literal("managePeople") })]);
+const BudgetIntentSchema = CurrentPolicySchema.pipe(refine((value) => {
+	if (value.type !== "budget") return false;
+	const { actions, recipients } = value.scope;
+	if (new Set(actions).size !== actions.length) return false;
+	return recipients.type === "anyone" || recipients.accounts.length >= 1 && recipients.accounts.length <= 32 && new Set(recipients.accounts).size === recipients.accounts.length;
+}));
+const InvitationIdSchema = NonEmptyString;
+Struct({
+	...Struct({ invitationId: InvitationIdSchema }).fields,
+	expectedOfferDigest: Bytes32Schema
+});
+/** The requested grantee of one invitation. */
+const GranteeRefSchema = Union([Struct({
+	type: Literal("email"),
+	email: NonEmptyString
+}), Struct({
+	type: Literal("account"),
+	accountId: AccountIdSchema
+})]);
+Struct({
+	requestKey: String$1.pipe(refine((value) => /^[\x20-\x7e]{1,128}$/.test(value))),
+	to: GranteeRefSchema,
+	grants: ArraySchema(Union([
+		Struct({
+			type: Literal("budget"),
+			budgetId: PermissionIdSchema
+		}),
+		Struct({
+			type: Literal("managePeople"),
+			permissionId: PermissionIdSchema
+		}),
+		Struct({
+			type: Literal("new_budget"),
+			label: String$1.pipe(refine((value) => value.trim().length >= 1 && value.trim().length <= 128)),
+			intent: BudgetIntentSchema
+		})
+	]))
+}).pipe(refine((value) => {
+	if (value.grants.length < 1 || value.grants.length > 16) return false;
+	const existing = value.grants.flatMap((grant) => grant.type === "new_budget" ? [] : [grant.type === "budget" ? grant.budgetId : grant.permissionId]);
+	return new Set(existing).size === existing.length && value.grants.filter((grant) => grant.type === "new_budget").length <= 4;
+}));
+const InvitationPhaseSchema = Literals([
+	"authorizing",
+	"pending",
+	"pending_grant",
+	"active",
+	"revoking",
+	"declined",
+	"cancelled",
+	"expired",
+	"revoked"
+]);
+const EndingReasonSchema = Literals([
+	"declined",
+	"cancelled",
+	"expired",
+	"revoked"
+]);
+const OfferedAuthoritySchema = Union([Struct({
+	type: Literal("budget"),
+	budgetId: NonEmptyString.pipe(refine((value) => value.length > 0)),
+	label: String$1,
+	policy: BudgetIntentSchema,
+	policyDigest: Bytes32Schema
+}), Struct({
+	type: Literal("managePeople"),
+	permissionId: PermissionIdSchema,
+	label: String$1
+})]);
+const NewBudgetOfferSchema = Struct({
+	type: Literal("new_budget"),
+	label: String$1,
+	policy: BudgetIntentSchema,
+	policyDigest: Bytes32Schema
+});
+const PreviewGranteeSchema = Struct({
+	partyId: NullOr(PartyIdSchema),
+	accountId: NullOr(AccountIdSchema),
+	safeAddress: AddressSchema,
+	accountReady: NullOr(Boolean)
+});
+Struct({
+	orgId: NonEmptyString.pipe(refine((value) => value.length > 0)),
+	grantee: PreviewGranteeSchema,
+	grants: ArraySchema(Union([OfferedAuthoritySchema, NewBudgetOfferSchema])),
+	existingAssignments: ArraySchema(PermissionAssignmentIdSchema),
+	includesManagement: Boolean,
+	observedAt: EpochMsSchema
+});
+Struct({
+	cursor: optional(NonEmptyString),
+	limit: optional(Number$1.pipe(refine((value) => Number.isSafeInteger(value) && value >= 1 && value <= 100))),
+	phases: optional(ArraySchema(InvitationPhaseSchema).pipe(refine((value) => new Set(value).size === value.length)))
+});
+const InvitationRecoverySchema = Struct({
+	actor: Literals([
+		"system",
+		"invitee",
+		"admin"
+	]),
+	action: Literals([
+		"wait",
+		"retry",
+		"review_offer",
+		"reauthorize"
+	]),
+	reason: Literals([
+		"configuration_pending",
+		"grant_pending",
+		"provider_unavailable",
+		"policy_changed",
+		"cleanup_pending",
+		"signer_unavailable"
+	])
+});
+Struct({
+	items: ArraySchema(Struct({
+		id: InvitationIdSchema,
+		orgId: NonEmptyString.pipe(refine((value) => value.length > 0)),
+		organizationName: String$1,
+		grantee: Struct({
+			partyId: PartyIdSchema,
+			accountId: NullOr(AccountIdSchema),
+			safeAddress: AddressSchema,
+			accountReady: NullOr(Boolean)
+		}),
+		phase: InvitationPhaseSchema,
+		grants: ArraySchema(Union([Struct({
+			type: Literal("budget"),
+			budgetId: NonEmptyString.pipe(refine((value) => value.length > 0))
+		}), Struct({
+			type: Literal("managePeople"),
+			permissionId: PermissionIdSchema
+		})])),
+		offers: ArraySchema(OfferedAuthoritySchema),
+		recovery: NullOr(InvitationRecoverySchema),
+		offerDigest: Bytes32Schema,
+		authorizedAt: NullOr(EpochMsSchema),
+		acceptedAt: NullOr(EpochMsSchema),
+		expiresAt: NullOr(EpochMsSchema),
+		commandId: NullOr(PaymentCommandIdSchema),
+		endingReason: NullOr(EndingReasonSchema),
+		delivery: Literals([
+			"not_confirmed",
+			"sent",
+			"failed"
+		])
+	})),
+	nextCursor: NullOr(NonEmptyString),
+	observedAt: EpochMsSchema
+});
 const ActiveBudgetSchema = Struct({
 	id: PermissionIdSchema,
 	label: String$1,
@@ -18627,7 +19009,7 @@ function statusFromAccount(account, requirement) {
 }
 makeFunctionReference(CAPXUL_FUNCTIONS["financialOps/addressBook"].list), makeFunctionReference(CAPXUL_FUNCTIONS["financialOps/addressBook"].get), makeFunctionReference(CAPXUL_FUNCTIONS["financialOps/addressBook"].add), makeFunctionReference(CAPXUL_FUNCTIONS["financialOps/addressBook"].hide), makeFunctionReference(CAPXUL_FUNCTIONS["financialOps/addressBook"].unhide), makeFunctionReference(CAPXUL_FUNCTIONS["financialOps/addressBook"].label), makeFunctionReference(CAPXUL_FUNCTIONS["financialOps/requestsInbox"].issue), makeFunctionReference(CAPXUL_FUNCTIONS["financialOps/requestsInbox"].list), makeFunctionReference(CAPXUL_FUNCTIONS["financialOps/requestsInbox"].get), makeFunctionReference(CAPXUL_FUNCTIONS["financialOps/requestsInbox"].cancel), makeFunctionReference(CAPXUL_FUNCTIONS["financialOps/requestsInbox"].inboxList), makeFunctionReference(CAPXUL_FUNCTIONS["financialOps/requestsInbox"].approve), makeFunctionReference(CAPXUL_FUNCTIONS["financialOps/requestsInbox"].decline);
 makeFunctionReference(CAPXUL_FUNCTIONS["financialOps/queries"].me), makeFunctionReference(CAPXUL_FUNCTIONS["financialOps/queries"].depositInstructions), makeFunctionReference(CAPXUL_FUNCTIONS["financialOps/queries"].resolveRecipient), makeFunctionReference(CAPXUL_FUNCTIONS["financialOps/destinations"].add), makeFunctionReference(CAPXUL_FUNCTIONS["financialOps/destinations"].list), makeFunctionReference(CAPXUL_FUNCTIONS["financialOps/destinations"].remove), makeFunctionReference(CAPXUL_FUNCTIONS["financialOps/queries"].listPayments), makeFunctionReference(CAPXUL_FUNCTIONS["financialOps/queries"].getPayment), makeFunctionReference(CAPXUL_FUNCTIONS["movement/activity"].list), makeFunctionReference(CAPXUL_FUNCTIONS["movement/activity"].summary), makeFunctionReference(CAPXUL_FUNCTIONS["movement/activity"].get), makeFunctionReference(CAPXUL_FUNCTIONS["movement/activity"].annotate), makeFunctionReference(CAPXUL_FUNCTIONS["movement/annotations"].overlay), makeFunctionReference(CAPXUL_FUNCTIONS["financialOps/queries"].getPaymentDocument), makeFunctionReference(CAPXUL_FUNCTIONS["financialOps/queries"].verifyPaymentDocument), makeFunctionReference(CAPXUL_FUNCTIONS["financialOps/queries"].renderStoredDocument);
-makeFunctionReference(CAPXUL_FUNCTIONS["moneyExecution/actions"].abandonPaymentExecution), makeFunctionReference(CAPXUL_FUNCTIONS["moneyExecution/actions"].preparePermissionExecution), makeFunctionReference(CAPXUL_FUNCTIONS["moneyExecution/actions"].preparePaymentExecution), makeFunctionReference(CAPXUL_FUNCTIONS["moneyExecution/paymentCommandActions"].prepareOrganizationPaymentExecution), makeFunctionReference(CAPXUL_FUNCTIONS["moneyExecution/paymentCommandActions"].preparePaymentLifecycleExecution), makeFunctionReference(CAPXUL_FUNCTIONS["moneyExecution/actions"].submitPaymentExecution), makeFunctionReference(CAPXUL_FUNCTIONS["moneyExecution/actions"].submitPermissionExecution), makeFunctionReference(CAPXUL_FUNCTIONS["moneyExecution/paymentCommandActions"].submitPaymentCommandExecution);
+makeFunctionReference(CAPXUL_FUNCTIONS["moneyExecution/actions"].abandonPaymentExecution), makeFunctionReference(CAPXUL_FUNCTIONS["moneyExecution/actions"].prepareInvitationConfiguration), makeFunctionReference(CAPXUL_FUNCTIONS["moneyExecution/actions"].preparePermissionExecution), makeFunctionReference(CAPXUL_FUNCTIONS["moneyExecution/actions"].preparePaymentExecution), makeFunctionReference(CAPXUL_FUNCTIONS["moneyExecution/paymentCommandActions"].prepareOrganizationPaymentExecution), makeFunctionReference(CAPXUL_FUNCTIONS["moneyExecution/paymentCommandActions"].preparePaymentLifecycleExecution), makeFunctionReference(CAPXUL_FUNCTIONS["moneyExecution/actions"].submitPaymentExecution), makeFunctionReference(CAPXUL_FUNCTIONS["moneyExecution/actions"].submitInvitationConfigurationExecution), makeFunctionReference(CAPXUL_FUNCTIONS["moneyExecution/actions"].submitPermissionExecution), makeFunctionReference(CAPXUL_FUNCTIONS["moneyExecution/paymentCommandActions"].submitPaymentCommandExecution);
 TaggedError("IndexerReadError");
 Service()("@capxul/sdk/ports/IndexerReadPort");
 //#endregion
@@ -18925,7 +19307,7 @@ var SmartAccountPortTag = class extends Service()("@capxul/sdk/ports/SmartAccoun
 makeFunctionReference(CAPXUL_FUNCTIONS["smartAccount/queries"].loadByAuthUserId), makeFunctionReference(CAPXUL_FUNCTIONS["smartAccount/queries"].loadBySmartAccountAddress), makeFunctionReference(CAPXUL_FUNCTIONS["smartAccount/mutations"].provision), makeFunctionReference(CAPXUL_FUNCTIONS["smartAccount/actions"].confirmDeployment), makeFunctionReference(CAPXUL_FUNCTIONS["smartAccount/actions"].claim);
 TaggedError("OrgError");
 Service()("@capxul/sdk/ports/OrgPort");
-makeFunctionReference(CAPXUL_FUNCTIONS["org/queries"].listAll), makeFunctionReference(CAPXUL_FUNCTIONS["org/queries"].listRolesByOrgId), makeFunctionReference(CAPXUL_FUNCTIONS["org/queries"].listMembersByOrgId), makeFunctionReference(CAPXUL_FUNCTIONS["org/actions"].readTreasury), makeFunctionReference(CAPXUL_FUNCTIONS["org/actions"].inviteMember), makeFunctionReference(CAPXUL_FUNCTIONS["org/mutations"].resendInviteToken), makeFunctionReference(CAPXUL_FUNCTIONS["org/actions"].detectAndAcceptPendingInvitations);
+makeFunctionReference(CAPXUL_FUNCTIONS["org/queries"].listAll), makeFunctionReference(CAPXUL_FUNCTIONS["org/queries"].listRolesByOrgId), makeFunctionReference(CAPXUL_FUNCTIONS["org/queries"].listMembersByOrgId), makeFunctionReference(CAPXUL_FUNCTIONS["org/actions"].readTreasury);
 makeFunctionReference(CAPXUL_FUNCTIONS["org/lifecycle"].startOrResume), makeFunctionReference(CAPXUL_FUNCTIONS["org/actions"].prepareFounderAccount), makeFunctionReference(CAPXUL_FUNCTIONS["org/actions"].prepareBootstrap), makeFunctionReference(CAPXUL_FUNCTIONS["org/actions"].submitBootstrap), makeFunctionReference(CAPXUL_FUNCTIONS["org/actions"].resumeBootstrapSubmission), makeFunctionReference(CAPXUL_FUNCTIONS["org/actions"].confirmBootstrap), makeFunctionReference(CAPXUL_FUNCTIONS["org/lifecycle"].recordFailure), makeFunctionReference(CAPXUL_FUNCTIONS["org/lifecycle"].load), makeFunctionReference(CAPXUL_FUNCTIONS["org/lifecycle"].retry);
 //#endregion
 //#region ../../packages/sdk/src/flows/identity.ts
@@ -19078,6 +19460,8 @@ gen(function* () {
 makeFunctionReference(CAPXUL_FUNCTIONS.media.generateUploadUrl), makeFunctionReference(CAPXUL_FUNCTIONS.media.setProfileImage), makeFunctionReference(CAPXUL_FUNCTIONS.media.setOrgLogo);
 makeFunctionReference(CAPXUL_FUNCTIONS.system.healthObserved);
 makeFunctionReference(CAPXUL_FUNCTIONS["org/queries"].me);
+makeFunctionReference(CAPXUL_FUNCTIONS["org/queries"].previewInvite), makeFunctionReference(CAPXUL_FUNCTIONS["org/queries"].listMyInvitations), makeFunctionReference(CAPXUL_FUNCTIONS["org/queries"].listInvitations), makeFunctionReference(CAPXUL_FUNCTIONS["org/queries"].getInvitation), makeFunctionReference(CAPXUL_FUNCTIONS["org/mutations"].invite), makeFunctionReference(CAPXUL_FUNCTIONS["org/mutations"].accept), makeFunctionReference(CAPXUL_FUNCTIONS["org/mutations"].decline), makeFunctionReference(CAPXUL_FUNCTIONS["org/mutations"].cancel), makeFunctionReference(CAPXUL_FUNCTIONS["org/mutations"].resend), makeFunctionReference(CAPXUL_FUNCTIONS["org/mutations"].retry);
+CAPXUL_OPERATIONS.org.invitations;
 makeFunctionReference(CAPXUL_FUNCTIONS["permission/queries"].read);
 makeFunctionReference(CAPXUL_FUNCTIONS["payroll/actions"].authorizeRun), makeFunctionReference(CAPXUL_FUNCTIONS["payroll/queries"].runs), makeFunctionReference(CAPXUL_FUNCTIONS["payroll/queries"].groups), makeFunctionReference(CAPXUL_FUNCTIONS["payroll/queries"].terms), makeFunctionReference(CAPXUL_FUNCTIONS["payroll/mutations"].saveGroup), makeFunctionReference(CAPXUL_FUNCTIONS["payroll/mutations"].removeGroup);
 CAPXUL_OPERATIONS.payroll.authorizeRun;
@@ -19160,15 +19544,15 @@ var deployment_topology_default = {
 		"staging": {
 			"appEnv": "staging",
 			"productRole": "staging",
-			"substrate": "self-hosted-railway",
-			"convexProject": "adorable-illumination",
-			"deployment": "self-hosted:railway",
+			"substrate": "self-hosted-coolify",
+			"convexProject": "capxul-staging",
+			"deployment": "self-hosted:coolify",
 			"deploymentReference": "production",
-			"name": "convex-backend-production-f220",
+			"name": "capxul-staging",
 			"convexType": "self-hosted",
-			"convexUrl": "https://convex-backend-production-f220.up.railway.app",
-			"convexSiteUrl": "https://api.staging.capxul.com",
-			"authProviderJwksUrl": "https://convex-site-production-29eb.up.railway.app/api/auth/convex/jwks",
+			"convexUrl": "https://convex.preview.abuusama.dev",
+			"convexSiteUrl": "https://site.preview.abuusama.dev",
+			"authProviderJwksUrl": "https://site.preview.abuusama.dev/api/auth/convex/jwks",
 			"chainId": 84532,
 			"expectedFingerprints": {
 				"applicationId": "8a99496340f792f4",
@@ -19197,7 +19581,7 @@ function resolveDeploymentTier(appEnv) {
 }
 function assertDeploymentTuple(appEnv, values) {
 	const tier = resolveDeploymentTier(appEnv);
-	const selfHosted = tier.substrate === "self-hosted-railway";
+	const selfHosted = tier.convexType === "self-hosted";
 	const expected = {
 		CONVEX_URL: tier.convexUrl,
 		CONVEX_SITE_URL: tier.convexSiteUrl,
@@ -19303,7 +19687,7 @@ const PLATFORM_ENV_NAMES = [
 	"windir"
 ];
 function convexArgsForTarget(args, target, hasDeployKey) {
-	if (target.substrate === "self-hosted-railway") return [...args];
+	if (target.substrate !== "convex-cloud") return [...args];
 	if (hasDeployKey) return [...args];
 	if (args[0] === "run") return [
 		"run",
@@ -19324,7 +19708,7 @@ function convexChildEnv(target, sourceEnv) {
 		PATH: process.env.PATH ?? "",
 		TMPDIR: process.env.TMPDIR ?? tmpdir()
 	};
-	if (target.substrate === "self-hosted-railway") {
+	if (target.substrate !== "convex-cloud") {
 		env.CONVEX_SELF_HOSTED_URL = target.convexUrl;
 		const adminKey = sourceEnv.CONVEX_SELF_HOSTED_ADMIN_KEY?.trim();
 		if (adminKey !== void 0 && adminKey.length > 0) env.CONVEX_SELF_HOSTED_ADMIN_KEY = adminKey;
@@ -19498,7 +19882,7 @@ async function runFaucetSend() {
 		return 0;
 	} catch (error) {
 		s.stop("Faucet send failed");
-		const hint = process.env.CONVEX_SELF_HOSTED_ADMIN_KEY === void 0 ? "\nHint: CONVEX_SELF_HOSTED_ADMIN_KEY is not set — the faucet needs operator access to Railway staging. Supply it directly or, inside the infrastructure repo, run `APP_ENV=staging vp exec bash scripts/capxul-env.sh npx @capxul/sandbox faucet send`." : "";
+		const hint = process.env.CONVEX_SELF_HOSTED_ADMIN_KEY === void 0 ? "\nHint: CONVEX_SELF_HOSTED_ADMIN_KEY is not set — the faucet needs operator access to Coolify staging. Supply it directly or, inside the infrastructure repo, run `APP_ENV=staging vp exec bash scripts/capxul-env.sh npx @capxul/sandbox faucet send`." : "";
 		cancel(errorMessage(error) + hint);
 		return 1;
 	}
@@ -19632,7 +20016,7 @@ async function runKeyCreate() {
 		return 0;
 	}
 	const origin = normalizeHttpOrigin(originPrompt);
-	const baseUrl = process.env.CAPXUL_QUICKSTART_URL ?? "https://api.staging.capxul.com";
+	const baseUrl = process.env.CAPXUL_QUICKSTART_URL ?? "https://site.preview.abuusama.dev";
 	const envPath = resolve(process.cwd(), ".env.local");
 	const s = spinner();
 	s.start("Requesting a sandbox publishable key");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@capxul/sandbox",
-  "version": "4.20.0-beta.6",
+  "version": "4.20.0-beta.7",
   "private": false,
   "description": "Capxul sandbox CLI for canonical quickstart keys and testnet faucet funds.",
   "keywords": [
@@ -42,7 +42,7 @@
     "typescript": "npm:@typescript/typescript6@6.0.2",
     "vite": "npm:@voidzero-dev/vite-plus-core@0.3.0",
     "vite-plus": "0.3.0",
-    "@capxul/sdk": "4.20.0-beta.6",
+    "@capxul/sdk": "4.20.0-beta.7",
     "@capxul/typescript-config": "0.0.0"
   },
   "scripts": {