@capxul/sdk-react 4.20.0-beta.4 → 4.20.0-beta.40

package/dist/index.d.mts

@@ -1,8 +1,9 @@
-import { A as entered, C as CreateOrganizationFailure, D as OrganizationDetails, E as InvocationOptions, F as useCapxulTransitions, M as useCapxulDestination, N as useCapxulIdentity, O as ProfileDetails, P as useCapxulSend, S as CapxulSend, T as Destination, _ as ReadyDestination, a as AuthenticationSlots, b as Slot, c as ControllerAction, d as OnboardingControllerProps, f as OrgFailure, g as ProfileSlotProps, h as PendingAuthState, i as AuthenticatedState, j as useCapxulAuth, k as SendResult, l as FaultedState, m as OtpPendingState, n as AccountProgress, o as CapxulAuthenticationController, p as OrgProgress, r as ActionResult, s as CapxulOnboardingController, t as AccountFailure, u as NavigationAction, v as RetryAction, w as CreateOrganizationSubmission, x as CapxulAuth, y as SignedOutState } from "./controllers-BWmKRFy6.mjs";
+import { A as TransitionListener, C as CreateOrganizationFailure, D as OrganizationDetails, E as InvocationOptions, O as ProfileDetails, S as CapxulSend, T as Destination, _ as ReadyDestination, a as ActionResult, b as Slot, c as CapxulAuthenticationController, d as NavigationAction, f as OrgFailure, g as ProfileSlotProps, h as PendingAuthState, i as AccountProgress, k as SendResult, l as ControllerAction, m as OtpPendingState, n as OnboardingControllerProps, o as AuthenticatedState, p as OrgProgress, r as AccountFailure, s as AuthenticationSlots, t as CapxulOnboardingController, u as FaultedState, v as RetryAction, w as CreateOrganizationSubmission, x as CapxulAuth, y as SignedOutState } from "./onboarding-controller-DrJiYWfY.mjs";
+import * as React from "react";
 import { ReactNode, RefCallback } from "react";
 import { QueryClient, UseMutationResult, UseQueryResult } from "@tanstack/react-query";
-import { Account, AccountRequirement, ActivityAnnotation, ActivityAnnotationInput, ActivityDetail, ActivityKind, ActivityListParams, ActivityPage, ActivityPhase, ActivityRange, ActivityReference, ActorReference, AddressBookEntry, BudgetId, CapxulClient, CapxulError, CapxulResult, CapxulSigner, CreateOrgInput, CurrentHoldings, HostObservability, IdentityDestination, IdentityState, InviteMemberInput, MemberView, Money, MoneyParseErrorReason, OrgId, OrgView, OrganizationPaymentBatchInput, OrganizationPaymentInput, PartyId, Payment, PaymentDirection, PaymentDocumentRef, PaymentDocumentRender, PaymentStatus, PaymentTiming, PaymentType, PaymentsPayInput, PayrollGroupId, PayrollGroupInput, PayrollRunId, PayrollRunStatus, Permission, PermissionMethods, PermissionReadResult, Profile, RoleView, SubmittedPermissionExecution, isClaimed, isRestoring } from "@capxul/sdk";
-//#region src/provider.d.ts
+import { Account, AccountRequirement, ActivityAnnotation, ActivityAnnotationInput, ActivityDetail, ActivityItem, ActivityKind, ActivityListParams, ActivityPage, ActivityPhase, ActivityRange, ActivityReference, ActivitySummaryTotal, ActorReference, AddressBookEntry, AssetAmount, AssetId, BudgetId, CapxulClient, CapxulError, CapxulResult, CapxulSigner, CurrentHoldings, HostObservability, IdentityDestination, IdentityState, IdentityTransition, MemberView, Money, MoneyParseErrorReason, OrgId, OrganizationAccess, OrganizationOnboarding, OrganizationOnboardingInput, OrganizationPaymentBatchInput, OrganizationPaymentInput, Page, PartyId, Payment, PaymentDirection, PaymentDocumentDownload, PaymentDocumentReadRef, PaymentDocumentRef, PaymentDocumentRender, PaymentStatus, PaymentType, PaymentsPayInput, PayrollGroupId, PayrollGroupInput, PayrollRunId, PayrollRunStatus, Permission, PermissionMethods, PermissionReadResult, Profile, RoleView, StateLabel, SubmittedPermissionExecution, isClaimed, isRestoring } from "@capxul/sdk";
+//#region src/platform/provider.d.ts
 type CapxulProviderSharedProps = {
   /** Bring your own QueryClient; otherwise the provider creates one. */
   readonly queryClient?: QueryClient;
@@ -28,6 +29,11 @@ type CapxulProviderPublishableKeyProps = CapxulProviderSharedProps & {
    * route cross-origin for the publishable key's allowed origins.
    */
   readonly bootstrapBaseUrl?: string;
+  /**
+   * AUTH A3. Pass `"explicit"` on `/connect` so restore and OTP do not write
+   * Profile, Account, or invitations. Default automatic.
+   */
+  readonly accountSetup?: "automatic" | "explicit";
 };
 /**
  * Node / server / test path — a pre-built client is supplied; lifecycle stays
@@ -43,181 +49,151 @@ type CapxulProviderInjectedClientProps = CapxulProviderSharedProps & {
   readonly bootstrapBaseUrl?: never;
 };
 type CapxulProviderProps = CapxulProviderPublishableKeyProps | CapxulProviderInjectedClientProps;
-declare function CapxulProvider(props: CapxulProviderProps): import("react/jsx-runtime").JSX.Element;
+export declare function CapxulProvider(props: CapxulProviderProps): React.JSX.Element;
 //#endregion
-//#region src/internal/capxul-bootstrap-context.d.ts
+//#region src/platform/bootstrap-context.d.ts
 type CapxulBootstrapStatus = "bootstrapping" | "ready" | "error";
 interface CapxulBootstrapState {
   readonly status: CapxulBootstrapStatus;
   readonly error: CapxulError | null;
   readonly retry: () => void;
 }
-declare function useCapxul(): CapxulBootstrapState;
+export declare function useCapxul(): CapxulBootstrapState;
 //#endregion
-//#region src/internal/capxul-client-context.d.ts
+//#region src/platform/client-context.d.ts
 /**
  * Returns the client, or `null` while `<CapxulProvider>` is still bootstrapping.
  * Data hooks use this so they can sit in `isPending` (disabled query) until the
  * client resolves, rather than throwing during bootstrap.
  */
-declare function useCapxulClientOrNull(): CapxulClient | null;
-//#endregion
-//#region src/hooks/use-capxul-profile.d.ts
-type UseCapxulProfileReturn = UseQueryResult<Profile | null, CapxulError>;
-declare function useCapxulProfile(): UseCapxulProfileReturn;
-//#endregion
-//#region src/hooks/use-capxul-account-balance.d.ts
-type UseCapxulAccountBalanceReturn = UseQueryResult<Account, CapxulError>;
-type UseCapxulAccountBalanceOptions = {
-  /** When false, skips the Convex readBalance action until the account ladder is ready. */
-  readonly enabled?: boolean;
-};
-declare function useCapxulAccountBalance(options?: UseCapxulAccountBalanceOptions): UseCapxulAccountBalanceReturn;
-//#endregion
-//#region src/hooks/use-capxul-account-fund.d.ts
-type UseCapxulAccountFundReturn = UseMutationResult<{
-  readonly txHash: string;
-}, CapxulError, Money>;
-declare function useCapxulAccountFund(): UseCapxulAccountFundReturn;
-//#endregion
-//#region src/hooks/use-capxul-money.d.ts
-type CapxulPayIntent = PaymentsPayInput;
-type UseCapxulPayReturn = UseMutationResult<Payment, CapxulError, CapxulPayIntent>;
-declare function useCapxulPay(): UseCapxulPayReturn;
-type UseCapxulCreateCommitmentReturn = UseMutationResult<Payment, CapxulError, PaymentsPayInput & {
-  readonly timing: Exclude<PaymentTiming, {
-    readonly kind: "instant";
-  }>;
-}>;
-declare function useCapxulCreateCommitment(): UseCapxulCreateCommitmentReturn;
-declare const useCapxulClaimPayment: () => UseMutationResult<Payment, CapxulError, string>;
-declare const useCapxulCancelPayment: () => UseMutationResult<Payment, CapxulError, string>;
-type UseCapxulRedirectPaymentReturn = UseMutationResult<Payment, CapxulError, Parameters<import("@capxul/sdk").PaymentsMethods["redirect"]>[0]>;
-declare function useCapxulRedirectPayment(): UseCapxulRedirectPaymentReturn;
-type UseCapxulPaymentsReturn = UseQueryResult<readonly Payment[], CapxulError>;
-declare function useCapxulPayments(options?: {
-  readonly enabled?: boolean;
-}): UseCapxulPaymentsReturn;
-type UseCapxulPaymentReturn = UseQueryResult<Payment | null, CapxulError>;
-declare function useCapxulPayment(paymentId: string | undefined, options?: {
-  readonly enabled?: boolean;
-}): UseCapxulPaymentReturn;
-//#endregion
-//#region src/hooks/use-capxul-organization-payments.d.ts
-/**
- * `orgId` may be absent because a screen has no branded org id until its org
- * context loads (`OrgView.id` is the branded one). An absent id refuses the
- * mutation the way every other org read refuses one, rather than forcing a
- * `as OrgId` cast at the call site.
- */
-declare function useCapxulOrganizationPay(orgId: OrgId | undefined): UseMutationResult<Payment, CapxulError, OrganizationPaymentInput>;
-declare function useCapxulOrganizationPayBatch(orgId: OrgId): UseMutationResult<readonly Payment[], CapxulError, OrganizationPaymentBatchInput>;
-//#endregion
-//#region src/hooks/use-capxul-permissions.d.ts
-type Operation = "create" | "change" | "assign" | "revoke" | "replace";
-type Input<K extends Operation> = Parameters<PermissionMethods[K]>[0];
-declare const useCapxulPermissionCreate: (orgId: OrgId) => UseMutationResult<SubmittedPermissionExecution, CapxulError, Input<"create">>;
-declare const useCapxulPermissionChange: (orgId: OrgId) => UseMutationResult<SubmittedPermissionExecution, CapxulError, Input<"change">>;
-declare const useCapxulPermissionAssign: (orgId: OrgId) => UseMutationResult<SubmittedPermissionExecution, CapxulError, Input<"assign">>;
-declare const useCapxulPermissionRevoke: (orgId: OrgId) => UseMutationResult<SubmittedPermissionExecution, CapxulError, Input<"revoke">>;
-declare const useCapxulPermissionReplace: (orgId: OrgId) => UseMutationResult<SubmittedPermissionExecution, CapxulError, Input<"replace">>;
-declare function useCapxulPermissions(orgId: OrgId, options?: {
-  readonly enabled?: boolean;
-}): UseQueryResult<PermissionReadResult, CapxulError>;
-declare function useCapxulPermission(orgId: OrgId, permissionId: string | undefined): UseQueryResult<Permission | null, CapxulError>;
+export declare function useCapxulClientOrNull(): CapxulClient | null;
 //#endregion
-//#region src/hooks/use-capxul-activity.d.ts
-declare function useCapxulActivity(params?: ActivityListParams): UseQueryResult<ActivityPage, CapxulError>;
-declare function useCapxulActivityDetail(reference: ActivityReference | undefined, actor?: ActorReference): UseQueryResult<ActivityDetail | null, CapxulError>;
-declare function useCapxulAnnotateMovement(): UseMutationResult<ActivityAnnotation, CapxulError, ActivityAnnotationInput>;
+//#region src/platform/identity.d.ts
+export declare function useCapxulIdentity(): IdentityState;
+export declare function useCapxulSend(): CapxulSend;
+export declare function useCapxulAuth(): CapxulAuth;
+export declare function useCapxulDestination(): Destination | null;
+export declare function useCapxulTransitions(listener: TransitionListener): void;
+export declare const entered: (record: IdentityTransition, target: StateLabel) => boolean;
 //#endregion
-//#region src/hooks/use-capxul-holdings.d.ts
-interface UseCapxulHoldingsParams {
-  /** Omitted = the signed-in person. SDK core already accepts one. */
-  readonly actor?: ActorReference;
+//#region src/access/use-client-connection.d.ts
+interface OtpSlice {
+  readonly email: string;
+  readonly pending: boolean;
+  readonly canResend: boolean;
+  readonly verifyCode: (code: string) => Promise<void>;
+  readonly resend: () => Promise<void>;
+}
+interface ConsentSlice {
+  readonly verifiedEmail: string;
+  readonly clientLabel: string;
+  readonly scopeCodes: readonly string[];
+  readonly purpose: "login" | "signup";
+  readonly setupState: "not_required" | "new" | "resumable";
+  readonly pending: boolean;
+  readonly accept: () => Promise<void>;
+  readonly cancel: () => Promise<void>;
+}
+interface CompleteSlice {
+  readonly outcome: "connected";
+}
+interface FailureSlice {
+  readonly code: string;
+  readonly field?: string;
+  readonly retry: () => Promise<void>;
+  readonly cancel: () => Promise<void>;
 }
-declare function useCapxulHoldings(params?: UseCapxulHoldingsParams): UseQueryResult<CurrentHoldings, CapxulError>;
-//#endregion
-//#region src/hooks/use-capxul-orgs.d.ts
-/**
- * List the Organizations that the current user can access. Binds directly to
- * the locked `capxul.orgs()` SDK method.
- */
-type UseCapxulOrgsReturn = UseQueryResult<readonly OrgView[], CapxulError>;
-type UseCapxulOrgsOptions = {
-  /**
-   * Gate the query on auth readiness. `client.orgs()` is a session-scoped
-   * authenticated read; firing it before the session token settles surfaces a
-   * spurious `NOT_AUTHENTICATED`. Consumers pass `enabled: <auth-ready>`.
-   * Defaults to `true` to preserve the bare `useCapxulOrgs()` call shape.
-   */
-  readonly enabled?: boolean;
-};
-declare function useCapxulOrgs(options?: UseCapxulOrgsOptions): UseCapxulOrgsReturn;
-//#endregion
-//#region src/hooks/use-capxul-org-members.d.ts
-type UseCapxulOrgMembersOptions = {
-  readonly enabled?: boolean;
-};
-/**
- * List the members of one Organization. Binds directly to
- * `capxul.org(orgId).members()`. Gated by
- * `orgId !== undefined`; callers may additionally gate on canonical identity
- * readiness through `options.enabled`.
- */
-type UseCapxulOrgMembersReturn = UseQueryResult<readonly MemberView[], CapxulError>;
-declare function useCapxulOrgMembers(orgId: OrgId | undefined, options?: UseCapxulOrgMembersOptions): UseCapxulOrgMembersReturn;
 //#endregion
-//#region src/hooks/use-capxul-org-roles.d.ts
-type UseCapxulOrgRolesOptions = {
-  readonly enabled?: boolean;
+//#region src/access/client-connection.d.ts
+interface CapxulClientConnectionProps {
+  readonly client: CapxulClient;
+  readonly requestId: string;
+  readonly children: ReactNode;
+}
+declare function Root$7({ client, requestId, children }: CapxulClientConnectionProps): import("react").JSX.Element;
+declare function Checking$1({ children }: {
+  readonly children: ReactNode;
+}): import("react").JSX.Element | null;
+declare function Otp({ children }: {
+  readonly children: (slice: OtpSlice) => ReactNode;
+}): import("react").JSX.Element | null;
+declare function Consent({ children }: {
+  readonly children: (slice: ConsentSlice) => ReactNode;
+}): import("react").JSX.Element | null;
+declare function Complete({ children }: {
+  readonly children: (slice: CompleteSlice) => ReactNode;
+}): import("react").JSX.Element | null;
+declare function Failure({ children }: {
+  readonly children: (slice: FailureSlice) => ReactNode;
+}): import("react").JSX.Element | null;
+export declare const CapxulClientConnection: typeof Root$7 & {
+  Checking: typeof Checking$1;
+  Otp: typeof Otp;
+  Consent: typeof Consent;
+  Complete: typeof Complete;
+  Failure: typeof Failure;
 };
-/**
- * List the roles for one Organization. Binds directly
- * to `capxul.org(orgId).roles()`. Gated by `orgId !== undefined`.
- */
-type UseCapxulOrgRolesReturn = UseQueryResult<readonly RoleView[], CapxulError>;
-declare function useCapxulOrgRoles(orgId: OrgId | undefined, options?: UseCapxulOrgRolesOptions): UseCapxulOrgRolesReturn;
 //#endregion
-//#region src/hooks/use-capxul-org-treasury.d.ts
-type UseCapxulOrgTreasuryOptions = {
-  readonly enabled?: boolean;
+//#region src/access/dashboard-access.d.ts
+type DashboardScope = {
+  readonly kind: "personal";
+} | {
+  readonly kind: "organization";
+  readonly orgId?: string;
 };
+type DashboardAccessPhase = "checking" | "error" | "redirect" | "granted";
 /**
- * Return the Organization treasury Account.
- * NEVER `AccountStatus` (the deploy-readiness ladder, no balance). Binds
- * Binds directly to `capxul.org(orgId).treasury()`. Gated by `orgId !== undefined`.
- */
-type UseCapxulOrgTreasuryReturn = UseQueryResult<Account, CapxulError>;
-declare function useCapxulOrgTreasury(orgId: OrgId | undefined, options?: UseCapxulOrgTreasuryOptions): UseCapxulOrgTreasuryReturn;
-//#endregion
-//#region src/hooks/use-capxul-create-org.d.ts
-/**
- * Create an Organization. Binds directly to the
- * `capxul.createOrg(input)` SDK method. On success, invalidates the org list.
+ * Which probe produced the error the screen is showing. The
+ * error code alone cannot say: a provider failure reads the same whether the
+ * session read, the membership list or the lifecycle read raised it, and a
+ * consumer that reports a displayed gate error has to keep those apart
+ * (#1963 R05-2). It names the SOURCE only; `retry` still re-runs every failed
+ * probe, exactly as before.
  */
-type UseCapxulCreateOrgReturn = UseMutationResult<OrgView, CapxulError, CreateOrgInput>;
-declare function useCapxulCreateOrg(): UseCapxulCreateOrgReturn;
-//#endregion
-//#region src/hooks/use-capxul-invite-member.d.ts
+type DashboardAccessProbe = "session" | "membership" | "lifecycle" | "authority";
+interface DashboardAccessErrorSlice {
+  readonly error: CapxulError;
+  /** The probe the surfaced error came from, in the frozen precedence order. */
+  readonly probe: DashboardAccessProbe;
+  /** Re-runs each failed probe. */
+  readonly retry: () => void;
+}
+interface DashboardAccessRedirectSlice {
+  readonly destination: IdentityDestination;
+}
+interface CapxulDashboardAccessProps {
+  readonly scope: DashboardScope;
+  readonly children: ReactNode;
+}
+declare function Root$6({ scope, children }: CapxulDashboardAccessProps): import("react").JSX.Element;
+/** Hands nothing — today's app renders `null` here, exactly as it does now. */
+declare function Checking({ children }: {
+  readonly children?: ReactNode;
+}): import("react").JSX.Element | null;
+declare function DashboardError({ children }: {
+  readonly children: (slice: DashboardAccessErrorSlice) => ReactNode;
+}): import("react").JSX.Element | null;
 /**
- * R06 (#1964): `options` is the browser attempt the caller captured before the
- * person pressed Send. It reaches the SDK operation unchanged, so the durable
- * `org_invite_sent` and the later `org_invite_progressed` carry that attempt's
- * correlation. Absent, the invitation keeps its own invocation context.
+ * Hands the destination and draws nothing. Reaching this part is a REQUEST to
+ * navigate, never an arrival: the app may cancel or supersede it, so nothing
+ * here — and nothing a consumer hangs off it — may claim a completed redirect
+ * (#1963 R05-1). The destination page's own normalized pageview proves arrival.
  */
-type UseCapxulInviteMemberInput = InviteMemberInput & {
-  readonly options?: InvocationOptions;
+declare function Redirect({ children }: {
+  readonly children: (slice: DashboardAccessRedirectSlice) => ReactNode;
+}): import("react").JSX.Element | null;
+declare function Granted({ children }: {
+  readonly children?: ReactNode;
+}): import("react").JSX.Element | null;
+/** The compound shape the app's own design system already uses (`StatusTabs`). */
+export declare const CapxulDashboardAccess: typeof Root$6 & {
+  Checking: typeof Checking;
+  Error: typeof DashboardError;
+  Redirect: typeof Redirect;
+  Granted: typeof Granted;
 };
-/**
- * Invite a member to an Organization by email. The hook uses the closed-over `orgId`.
- * It binds directly to
- * `capxul.org(orgId).invite(input)`. On success, invalidates the member list.
- */
-type UseCapxulInviteMemberReturn = UseMutationResult<MemberView, CapxulError, UseCapxulInviteMemberInput>;
-declare function useCapxulInviteMember(orgId: OrgId | undefined): UseCapxulInviteMemberReturn;
 //#endregion
-//#region src/headless/journey/journey-state.d.ts
+//#region src/profiles/journey-state.d.ts
 type OnboardingIntent = "personal" | "organization";
 type OnboardingStep = "profile" | "organization" | "provisioning";
 type PayoutDraftChain = "evm" | "solana" | "starknet";
@@ -275,40 +251,40 @@ type OnboardingJourneyPosition = {
   readonly organizationId?: string;
   readonly verification: boolean;
 };
-declare function startOnboardingJourney(input: {
+export declare function startOnboardingJourney(input: {
   readonly intent: OnboardingIntent;
   readonly ownerId: string;
   readonly entryPoint: "signup" | "dashboard";
   readonly origin?: OnboardingOrigin;
   readonly step?: OnboardingStep;
 }): OnboardingJourney;
-declare function loadOnboardingJourney(expectedOwnerId?: string): OnboardingJourney | null;
-declare function saveOnboardingJourney(journey: OnboardingJourney): void;
-declare function currentOnboardingJourneyId(): string | undefined;
+export declare function loadOnboardingJourney(expectedOwnerId?: string): OnboardingJourney | null;
+export declare function saveOnboardingJourney(journey: OnboardingJourney): void;
+export declare function currentOnboardingJourneyId(): string | undefined;
 /** Stop observation attribution while no authenticated owner is established. */
-declare function invalidateOnboardingJourneyObservation(): void;
+export declare function invalidateOnboardingJourneyObservation(): void;
 /** Where the journey stands — the pure position apps map to their routes. */
-declare function onboardingJourneyPosition(journey: OnboardingJourney): OnboardingJourneyPosition;
+export declare function onboardingJourneyPosition(journey: OnboardingJourney): OnboardingJourneyPosition;
 /**
  * The interruption-recovery decision (behavior map §4): a journey that does
  * not match the ready destination the app just rendered must resume; a
  * matching one needs no recovery. Returns the journey to resume, or null.
  */
-declare function activeOnboardingRecovery(ownerId: string, renderedReadyDestination?: {
+export declare function activeOnboardingRecovery(ownerId: string, renderedReadyDestination?: {
   readonly kind: "personal";
 } | {
   readonly kind: "organization";
   readonly organizationId: string;
 }): OnboardingJourney | null;
-declare function acknowledgeOnboardingDestination(destination: {
+export declare function acknowledgeOnboardingDestination(destination: {
   readonly kind: "personal";
 } | {
   readonly kind: "organization";
   readonly organizationId: string;
 }, ownerId: string): boolean;
-declare function clearOnboardingJourney(): void;
+export declare function clearOnboardingJourney(): void;
 //#endregion
-//#region src/headless/onboarding/use-capxul-handle-availability.d.ts
+//#region src/profiles/use-capxul-handle-availability.d.ts
 type HandleAvailability = {
   readonly available: boolean;
   readonly normalized: string;
@@ -321,159 +297,191 @@ type UseCapxulHandleAvailabilityReturn = UseQueryResult<HandleAvailability, Capx
  * boundary's message), not as `available: false` — only a handle someone
  * else owns is "taken".
  */
-declare function useCapxulHandleAvailability(handle: string, options?: {
+export declare function useCapxulHandleAvailability(handle: string, options?: {
   readonly enabled?: boolean;
   readonly debounceMs?: number;
 }): UseCapxulHandleAvailabilityReturn;
 //#endregion
-//#region src/headless/media/use-capxul-image-upload.d.ts
-type ImageUploadTarget = {
-  readonly kind: "profile";
-} | {
-  readonly kind: "orgLogo";
-  readonly orgId: string;
-};
-type ImageUploadInput = {
-  readonly blob: Blob;
-  readonly target: ImageUploadTarget;
+//#region src/profiles/use-capxul-profile.d.ts
+type UseCapxulProfileReturn = UseQueryResult<Profile | null, CapxulError>;
+export declare function useCapxulProfile(): UseCapxulProfileReturn;
+//#endregion
+//#region src/accounts/use-capxul-account-balance.d.ts
+type UseCapxulAccountBalanceReturn = UseQueryResult<Account, CapxulError>;
+type UseCapxulAccountBalanceOptions = {
+  /** When false, skips the Convex readBalance action until the account ladder is ready. */
+  readonly enabled?: boolean;
 };
-type UseCapxulImageUploadReturn = UseMutationResult<{
-  readonly url: string | null;
-}, CapxulError, ImageUploadInput>;
-/**
- * #1061 / ADR-0014: the whole upload→record sequence as one mutation —
- * upload the blob, then bind the returned storage id to the profile image or
- * the org logo. The url is the resolved serving URL (re-read from queries,
- * never persisted by consumers).
- */
-declare function useCapxulImageUpload(): UseCapxulImageUploadReturn;
+export declare function useCapxulAccountBalance(options?: UseCapxulAccountBalanceOptions): UseCapxulAccountBalanceReturn;
 //#endregion
-//#region src/headless/media/use-capxul-upload-image.d.ts
-type UseCapxulUploadImageReturn = UseMutationResult<{
-  readonly storageId: string;
-}, CapxulError, Blob>;
-/**
- * #1955: upload only. Hands back the storage id for a CREATE call to carry
- * (`ProfileDetails.imageStorageId`, `OrganizationDetails.logoStorageId`).
- *
- * `useCapxulImageUpload` is upload+bind and stays as it is for the settings
- * pages. It cannot serve onboarding: the row it binds to does not exist yet.
- * Nothing is bound here, so nothing is invalidated either — the create call
- * that carries the id owns the cache change.
- */
-declare function useCapxulUploadImage(): UseCapxulUploadImageReturn;
+//#region src/accounts/use-capxul-account-fund.d.ts
+type UseCapxulAccountFundReturn = UseMutationResult<{
+  readonly txHash: string;
+}, CapxulError, AssetAmount>;
+export declare function useCapxulAccountFund(): UseCapxulAccountFundReturn;
 //#endregion
-//#region src/headless/contacts/use-contacts.d.ts
-type ContactsActor = {
+//#region src/accounts/use-capxul-holdings.d.ts
+interface UseCapxulHoldingsParams {
+  /** Omitted = the signed-in person. SDK core already accepts one. */
+  readonly actor?: ActorReference;
+}
+export declare function useCapxulHoldings(params?: UseCapxulHoldingsParams): UseQueryResult<CurrentHoldings, CapxulError>;
+//#endregion
+//#region src/payments/use-recipient-resolution.d.ts
+type SendMoneyRecipientStatus = "empty" | "invalid" | "checking" | "known-party" | "new-email" | "external-warning" | "external-ready" | "not-found" | "failed";
+interface SendMoneyRecipientSlice {
+  readonly value: string;
+  readonly change: (text: string) => void;
+  readonly status: SendMoneyRecipientStatus;
+  readonly label: string | null;
+  readonly kind: "person" | "organization" | "external_address" | "unresolved" | null;
+  readonly isCapxulAccount: boolean | null;
+  readonly publicValue: string | null;
+  readonly requiresAcknowledgement: boolean;
+  readonly acknowledgeExternalAddress: () => void;
+}
+//#endregion
+//#region src/payments/send-money-slices.d.ts
+type SendActor = {
   readonly kind: "personal";
 } | {
   readonly kind: "organization";
   readonly orgId: OrgId | undefined;
 };
+type SentPayment = {
+  /** The backend payment row. */
+  readonly payment: Payment;
+  /** What we parsed and sent — `.value` is the comma-stripped major-unit string. */
+  readonly amount: AssetAmount;
+  /** The trimmed text the person typed — the app's success toast interpolates it. */
+  readonly recipient: string;
+};
 /**
- * How a contact entered the book. Taken from the shipped surface rather than
- * re-declared, so the component can never advertise a provenance the wire
- * cannot carry (ADR-0022 R2; #1532 owns the definition site).
- */
-type ContactRelationship = AddressBookEntry["relationship"][number];
-interface Contact {
-  /**
-   * The counterparty's `PartyId` — created once and claimed at signup, never
-   * re-keyed (ADR-0022 R1/R3). No email, no prefix, nothing to parse.
-   */
-  readonly id: PartyId;
-  /** The saved label when there is one, else the party's display name. */
-  readonly name: string;
-  readonly relationship: readonly ContactRelationship[];
-  readonly hidden: boolean;
-  /** Epoch milliseconds. The seam never formats a date; the app writes the words. */
-  readonly lastActivityAt: number;
-}
-interface ContactRow extends Contact {
-  /** Ours: one initials rule, not one copy per screen. */
-  readonly initials: string;
-  readonly rename: (name: string, options?: InvocationOptions) => void;
-  readonly hide: (options?: InvocationOptions) => void;
-  readonly unhide: (options?: InvocationOptions) => void;
-}
-/** ADR-0023 R1: refusal CODES, never sentences — the app owns the words. */
-type ContactsRefusal = "loading" | "org-unavailable" | "unavailable";
-/**
- * The blocked facts, in the fixed order `.Add.blockedReason` names them.
- * `"no-permission"` is absent by ruling, not by omission: the org screen places
- * `CapxulOrgMember.Can do="managePeople"` around its own Add control.
+ * Refusal CODES, never sentences (#1447 ruling 8). The app maps each code to
+ * the words it already prints; no English refusal string ships from here.
  */
-type ContactsAddBlockedReason = "org-unavailable" | "empty";
+type CapxulSendMoneyBlockedReason = "signer-not-ready" | "amount-invalid" | "recipient-unresolved" | "no-source" | "no-asset";
 /**
- * Why an add did not land, as a code. ADR-0023 R1 supersedes the contract's
- * field-message carve-out: `"unresolved"` is the backend refusing to resolve
- * what was typed (`INVALID_INPUT`), and every other code — offline, signed
- * out, refused — is `"failed"`. A person can fix only one of them.
+ * One Budget the member can spend from — the id the payment carries, and
+ * nothing else.
+ *
+ * THE CONTRACT (amended 3) reverses amendment 7: the From row keeps the app's
+ * frozen `"<Org> Treasury"` string, and no budget label and no limit display
+ * cross this seam until the budgets build ships a remaining figure that is
+ * actually computable (ADR-0024 R3). The app already holds the org name and
+ * already builds that sentence today, so the option carries only what the app
+ * cannot know — which Budget the send is drawn from.
  */
-type ContactsAddError = "unresolved" | "failed";
-interface ContactsSummarySlice {
-  readonly total: number | null;
-  readonly activeCount: number | null;
-  readonly isLoading: boolean;
-  readonly reason: ContactsRefusal | null;
-}
-interface ContactsListSlice {
-  readonly rows: readonly ContactRow[];
-  readonly isLoading: boolean;
-  readonly reason: ContactsRefusal | null;
+interface SendMoneySourceOption {
+  readonly id: BudgetId;
 }
-interface ContactsListOptions {
-  readonly limit?: number | undefined;
-  /** `"all"` forwards `includeHidden` to the backend, which already accepts it. */
-  readonly show?: "visible" | "all" | undefined;
+/** ADR-0023 R1: a code, never a sentence — the app owns the words. */
+type SendMoneySourceError = "read-failed";
+interface SendMoneySourceSlice {
+  readonly options: ReadonlyArray<SendMoneySourceOption>;
+  readonly selected: SendMoneySourceOption | null;
+  readonly select: (id: string) => void;
+  readonly error: SendMoneySourceError | null;
+  readonly isPending: boolean;
 }
-interface ContactsAddSlice {
+interface SendMoneyAssetOption {
+  readonly id: AssetId;
+  readonly symbol: string;
+  readonly availableDisplay: string;
+}
+/** ADR-0023 R1: a code, never a sentence — the app owns the words. */
+type SendMoneyAssetError = "read-failed";
+interface SendMoneyAssetSlice {
+  readonly options: ReadonlyArray<SendMoneyAssetOption>;
+  readonly selected: SendMoneyAssetOption | null;
+  readonly select: (id: string) => void;
+  readonly error: SendMoneyAssetError | null;
+  readonly isPending: boolean;
+}
+interface SendMoneyAmountSlice {
   readonly value: string;
   readonly change: (text: string) => void;
-  /**
-   * #1960 R02: hand it the options the screen captured BEFORE the click. The
-   * same snapshot reaches the SDK add call and comes back on `onAdded`/
-   * `onFailed`, so the UI observation and the operation share one identity even
-   * when the reply lands after an account switch. Omitted stays omitted.
-   */
-  readonly submit: (options?: InvocationOptions) => void;
+  /** ADR-0023 R1: the parse verdict as a closed code; the app maps it to copy. */
+  readonly error: MoneyParseErrorReason | null;
+  readonly availableDisplay: string | null;
+}
+interface SendMoneyActionsSlice {
+  readonly submit: () => void;
   readonly isSubmitting: boolean;
   readonly blocked: boolean;
-  readonly blockedReason: ContactsAddBlockedReason | null;
-  readonly error: ContactsAddError | null;
+  readonly blockedReason: CapxulSendMoneyBlockedReason | null;
 }
 //#endregion
-//#region src/headless/contacts/contacts.d.ts
-interface CapxulContactsProps {
-  readonly actor: ContactsActor;
-  /**
-   * `options` is exactly what the caller handed `.Add.submit` or a row verb, so
-   * the screen's own observation of the finished action can reuse the attempt
-   * identity the SDK operation ran under (#1960 R02).
-   */
-  readonly onAdded: (contact: Contact, options?: InvocationOptions) => void;
+//#region src/payments/send-money.d.ts
+interface CapxulSendMoneyProps {
+  readonly actor: SendActor;
+  readonly onSent: (sent: SentPayment) => void;
   /** ADR-0023 R1: the app maps `error.code` to its own copy; no SDK sentence. */
-  readonly onFailed: (error: CapxulError, options?: InvocationOptions) => void;
+  readonly onFailed: (error: CapxulError) => void;
   readonly children: ReactNode;
 }
-declare function Root$6({ actor, onAdded, onFailed, children }: CapxulContactsProps): import("react/jsx-runtime").JSX.Element;
-declare function Summary$3({ children }: {
-  readonly children: (slice: ContactsSummarySlice) => ReactNode;
-}): import("react/jsx-runtime").JSX.Element;
-declare function List({ limit, show, children }: ContactsListOptions & {
-  readonly children: (slice: ContactsListSlice) => ReactNode;
-}): import("react/jsx-runtime").JSX.Element;
-declare function Add({ children }: {
-  readonly children: (slice: ContactsAddSlice) => ReactNode;
-}): import("react/jsx-runtime").JSX.Element;
+declare function Root$5({ actor, onSent, onFailed, children }: CapxulSendMoneyProps): import("react").JSX.Element;
+declare function Source({ children }: {
+  readonly children: (slice: SendMoneySourceSlice) => ReactNode;
+}): import("react").JSX.Element;
+declare function Asset$1({ children }: {
+  readonly children: (slice: SendMoneyAssetSlice) => ReactNode;
+}): import("react").JSX.Element;
+declare function Amount({ children }: {
+  readonly children: (slice: SendMoneyAmountSlice) => ReactNode;
+}): import("react").JSX.Element;
+declare function Recipient({ children }: {
+  readonly children: (slice: SendMoneyRecipientSlice) => ReactNode;
+}): import("react").JSX.Element;
+declare function Actions$1({ children }: {
+  readonly children: (slice: SendMoneyActionsSlice) => ReactNode;
+}): import("react").JSX.Element;
 /** The compound shape the app's own design system already uses (`StatusTabs`). */
-declare const CapxulContacts: typeof Root$6 & {
-  Summary: typeof Summary$3;
-  List: typeof List;
-  Add: typeof Add;
+export declare const CapxulSendMoney: typeof Root$5 & {
+  Source: typeof Source;
+  Asset: typeof Asset$1;
+  Amount: typeof Amount;
+  Recipient: typeof Recipient;
+  Actions: typeof Actions$1;
 };
 //#endregion
-//#region src/headless/activity/types.d.ts
+//#region src/payments/use-capxul-money.d.ts
+type CapxulPayIntent = PaymentsPayInput;
+type UseCapxulPayReturn = UseMutationResult<Payment, CapxulError, CapxulPayIntent>;
+export declare function useCapxulPay(): UseCapxulPayReturn;
+type UseCapxulPaymentsReturn = UseQueryResult<Page<Payment>, CapxulError>;
+export declare function useCapxulPayments(options?: {
+  readonly enabled?: boolean;
+}): UseCapxulPaymentsReturn;
+type UseCapxulPaymentReturn = UseQueryResult<Payment | null, CapxulError>;
+export declare function useCapxulPayment(paymentId: string | undefined, options?: {
+  readonly enabled?: boolean;
+}): UseCapxulPaymentReturn;
+//#endregion
+//#region src/payments/use-capxul-organization-payments.d.ts
+/**
+ * `orgId` may be absent because a screen has no branded org id until its org
+ * context loads (`OrgView.id` is the branded one). An absent id refuses the
+ * mutation the way every other org read refuses one, rather than forcing a
+ * `as OrgId` cast at the call site.
+ */
+export declare function useCapxulOrganizationPay(orgId: OrgId | undefined): UseMutationResult<Payment, CapxulError, OrganizationPaymentInput>;
+export declare function useCapxulOrganizationPayBatch(orgId: OrgId): UseMutationResult<readonly Payment[], CapxulError, OrganizationPaymentBatchInput>;
+//#endregion
+//#region src/permissions/use-capxul-permissions.d.ts
+type Operation = "create" | "change" | "assign" | "revoke" | "replace";
+type Input<K extends Operation> = Parameters<PermissionMethods[K]>[0];
+export declare const useCapxulPermissionCreate: (orgId: OrgId) => UseMutationResult<SubmittedPermissionExecution, CapxulError, Input<"create">>;
+export declare const useCapxulPermissionChange: (orgId: OrgId) => UseMutationResult<SubmittedPermissionExecution, CapxulError, Input<"change">>;
+export declare const useCapxulPermissionAssign: (orgId: OrgId) => UseMutationResult<SubmittedPermissionExecution, CapxulError, Input<"assign">>;
+export declare const useCapxulPermissionRevoke: (orgId: OrgId) => UseMutationResult<SubmittedPermissionExecution, CapxulError, Input<"revoke">>;
+export declare const useCapxulPermissionReplace: (orgId: OrgId) => UseMutationResult<SubmittedPermissionExecution, CapxulError, Input<"replace">>;
+export declare function useCapxulPermissions(orgId: OrgId, options?: {
+  readonly enabled?: boolean;
+}): UseQueryResult<PermissionReadResult, CapxulError>;
+export declare function useCapxulPermission(orgId: OrgId, permissionId: string | undefined): UseQueryResult<Permission | null, CapxulError>;
+//#endregion
+//#region src/activity/activity-slices.d.ts
 /** The settled transfer a row was built from. The app builds the explorer URL. */
 interface ActivityReceipt {
   readonly chainId: number;
@@ -509,7 +517,9 @@ type ActivityRow = {
   readonly signedAmountDisplay: string;
   readonly currency: string;
   readonly createdAt: number;
-  readonly classification: "movement_only_outflow";
+  readonly classification: Extract<ActivityItem, {
+    readonly kind: "movement";
+  }>["classification"];
   readonly phase: ActivityPhase;
   readonly receipt: ActivityReceipt;
 };
@@ -520,8 +530,8 @@ type ActivityRow = {
  */
 type SummaryWindow = "all" | "last30days" | ActivityRange;
 /**
- * Finished money strings for ONE currency bucket, so no consumer indexes an
- * array of per-currency totals. All four strings are `null` and `count` is `0`
+ * Finished valuation strings in the display currency. Unrated assets remain
+ * separate. All four strings are `null` and `count` is `0`
  * when the window holds no activity — we say there is nothing, the app says it
  * in its own words.
  */
@@ -532,6 +542,7 @@ interface ActivitySummarySlice {
   readonly moneyOut: string | null;
   readonly net: string | null;
   readonly pending: string | null;
+  readonly unrated: readonly ActivitySummaryTotal[];
   /** A count is not money, so it is not formatted. */
   readonly count: number;
   readonly isLoading: boolean;
@@ -595,9 +606,12 @@ interface ActivityLoadMoreSlice {
 interface ActivityDetailSlice {
   /** Current Payment state from the existing detail read; absent for Movements. */
   readonly payment?: Pick<Payment, "status" | "execution">;
-  /** ONE finished document, never the array, so no consumer writes `documents[0]`. */
-  readonly receiptDocument: PaymentDocumentRef | null;
-  readonly openReceiptDocument: () => Promise<PaymentDocumentRender>;
+  readonly documents: readonly PaymentDocumentRef[];
+  readonly selectedDocument: PaymentDocumentRef | null;
+  readonly selectDocument: (ref: PaymentDocumentReadRef) => void;
+  readonly renderDocument: () => Promise<PaymentDocumentRender>;
+  /** Return exact bytes on a deliberate action. The host owns the download URL. */
+  readonly downloadDocument: () => Promise<PaymentDocumentDownload>;
   readonly isOpeningDocument: boolean;
   readonly memo: string;
   readonly setMemo: (text: string) => void;
@@ -625,7 +639,7 @@ interface ActivityExportSlice {
   readonly isExporting: boolean;
 }
 //#endregion
-//#region src/headless/activity/activity.d.ts
+//#region src/activity/activity.d.ts
 interface CapxulActivityProps {
   /** Omitted = the signed-in person. */
   readonly actor?: ActorReference;
@@ -637,39 +651,39 @@ interface CapxulActivityProps {
   readonly pageSize?: number;
   readonly children: ReactNode;
 }
-declare function Root$5({ actor, pageSize, children }: CapxulActivityProps): import("react/jsx-runtime").JSX.Element;
+declare function Root$4({ actor, pageSize, children }: CapxulActivityProps): import("react").JSX.Element;
 /**
  * The one part that holds a query rather than reading the engine's: it takes a
  * `window` prop, and two placements can ask for different windows, so a single
  * pre-fetched result cannot serve both. It still holds no logic and draws
  * nothing.
  */
-declare function Summary$2({ window, children }: {
+declare function Summary$3({ window, children }: {
   readonly window?: SummaryWindow;
   readonly children: (slice: ActivitySummarySlice) => ReactNode;
-}): import("react/jsx-runtime").JSX.Element;
+}): import("react").JSX.Element;
 declare function Filters({ children }: {
   readonly children: (slice: ActivityFiltersSlice) => ReactNode;
-}): import("react/jsx-runtime").JSX.Element;
+}): import("react").JSX.Element;
 declare function Search({ children }: {
   readonly children: (slice: ActivitySearchSlice) => ReactNode;
-}): import("react/jsx-runtime").JSX.Element;
+}): import("react").JSX.Element;
 declare function Rows({ children }: {
   readonly children: (slice: ActivityRowsSlice) => ReactNode;
-}): import("react/jsx-runtime").JSX.Element;
+}): import("react").JSX.Element;
 declare function LoadMore({ children }: {
   readonly children: (slice: ActivityLoadMoreSlice) => ReactNode;
-}): import("react/jsx-runtime").JSX.Element;
+}): import("react").JSX.Element;
 declare function Detail({ reference, children }: {
   readonly reference?: ActivityReference;
   readonly children: (slice: ActivityDetailSlice) => ReactNode;
-}): import("react/jsx-runtime").JSX.Element;
+}): import("react").JSX.Element;
 declare function Export({ children }: {
   readonly children: (slice: ActivityExportSlice) => ReactNode;
-}): import("react/jsx-runtime").JSX.Element;
+}): import("react").JSX.Element;
 /** The compound shape the app's own design system already uses (`StatusTabs`). */
-declare const CapxulActivity: typeof Root$5 & {
-  Summary: typeof Summary$2;
+export declare const CapxulActivity: typeof Root$4 & {
+  Summary: typeof Summary$3;
   Filters: typeof Filters;
   Search: typeof Search;
   Rows: typeof Rows;
@@ -678,125 +692,12 @@ declare const CapxulActivity: typeof Root$5 & {
   Export: typeof Export;
 };
 //#endregion
-//#region src/headless/send-money/use-recipient-resolution.d.ts
-type SendMoneyRecipientStatus = "empty" | "invalid" | "checking" | "known-party" | "new-email" | "external-warning" | "external-ready" | "not-found" | "failed";
-interface SendMoneyRecipientSlice {
-  readonly value: string;
-  readonly change: (text: string) => void;
-  readonly status: SendMoneyRecipientStatus;
-  readonly label: string | null;
-  readonly kind: "person" | "organization" | "external_address" | "unresolved" | null;
-  readonly isCapxulAccount: boolean | null;
-  readonly publicValue: string | null;
-  readonly requiresAcknowledgement: boolean;
-  readonly acknowledgeExternalAddress: () => void;
-}
-//#endregion
-//#region src/headless/send-money/use-send-money.d.ts
-type SendActor = {
-  readonly kind: "personal";
-} | {
-  readonly kind: "organization";
-  readonly orgId: OrgId | undefined;
-};
-type SentPayment = {
-  /** The backend payment row. */
-  readonly payment: Payment;
-  /** What we parsed and sent — `.value` is the comma-stripped major-unit string. */
-  readonly amount: Money;
-  /** The trimmed text the person typed — the app's success toast interpolates it. */
-  readonly recipient: string;
-};
-/**
- * Refusal CODES, never sentences (#1447 ruling 8). The app maps each code to
- * the words it already prints; no English refusal string ships from here.
- */
-type CapxulSendMoneyBlockedReason = "signer-not-ready" | "amount-invalid" | "recipient-unresolved" | "no-source" | "no-asset";
-/**
- * One Budget the member can spend from — the id the payment carries, and
- * nothing else.
- *
- * THE CONTRACT (amended 3) reverses amendment 7: the From row keeps the app's
- * frozen `"<Org> Treasury"` string, and no budget label and no limit display
- * cross this seam until the budgets build ships a remaining figure that is
- * actually computable (ADR-0024 R3). The app already holds the org name and
- * already builds that sentence today, so the option carries only what the app
- * cannot know — which Budget the send is drawn from.
- */
-interface SendMoneySourceOption {
-  readonly id: BudgetId;
-}
-/** ADR-0023 R1: a code, never a sentence — the app owns the words. */
-type SendMoneySourceError = "read-failed";
-interface SendMoneySourceSlice {
-  readonly options: ReadonlyArray<SendMoneySourceOption>;
-  readonly selected: SendMoneySourceOption | null;
-  readonly select: (id: string) => void;
-  readonly error: SendMoneySourceError | null;
-  readonly isPending: boolean;
-}
-interface SendMoneyAssetOption {
-  readonly id: string;
-  readonly symbol: string;
-  readonly availableDisplay: string;
-}
-/** ADR-0023 R1: a code, never a sentence — the app owns the words. */
-type SendMoneyAssetError = "read-failed";
-interface SendMoneyAssetSlice {
-  readonly options: ReadonlyArray<SendMoneyAssetOption>;
-  readonly selected: SendMoneyAssetOption | null;
-  readonly select: (id: string) => void;
-  readonly error: SendMoneyAssetError | null;
-  readonly isPending: boolean;
-}
-interface SendMoneyAmountSlice {
-  readonly value: string;
-  readonly change: (text: string) => void;
-  /** ADR-0023 R1: the parse verdict as a closed code; the app maps it to copy. */
-  readonly error: MoneyParseErrorReason | null;
-  readonly availableDisplay: string | null;
-}
-interface SendMoneyActionsSlice {
-  readonly submit: () => void;
-  readonly isSubmitting: boolean;
-  readonly blocked: boolean;
-  readonly blockedReason: CapxulSendMoneyBlockedReason | null;
-}
-//#endregion
-//#region src/headless/send-money/send-money.d.ts
-interface CapxulSendMoneyProps {
-  readonly actor: SendActor;
-  readonly onSent: (sent: SentPayment) => void;
-  /** ADR-0023 R1: the app maps `error.code` to its own copy; no SDK sentence. */
-  readonly onFailed: (error: CapxulError) => void;
-  readonly children: ReactNode;
-}
-declare function Root$4({ actor, onSent, onFailed, children }: CapxulSendMoneyProps): import("react/jsx-runtime").JSX.Element;
-declare function Source({ children }: {
-  readonly children: (slice: SendMoneySourceSlice) => ReactNode;
-}): import("react/jsx-runtime").JSX.Element;
-declare function Asset$1({ children }: {
-  readonly children: (slice: SendMoneyAssetSlice) => ReactNode;
-}): import("react/jsx-runtime").JSX.Element;
-declare function Amount({ children }: {
-  readonly children: (slice: SendMoneyAmountSlice) => ReactNode;
-}): import("react/jsx-runtime").JSX.Element;
-declare function Recipient({ children }: {
-  readonly children: (slice: SendMoneyRecipientSlice) => ReactNode;
-}): import("react/jsx-runtime").JSX.Element;
-declare function Actions$1({ children }: {
-  readonly children: (slice: SendMoneyActionsSlice) => ReactNode;
-}): import("react/jsx-runtime").JSX.Element;
-/** The compound shape the app's own design system already uses (`StatusTabs`). */
-declare const CapxulSendMoney: typeof Root$4 & {
-  Source: typeof Source;
-  Asset: typeof Asset$1;
-  Amount: typeof Amount;
-  Recipient: typeof Recipient;
-  Actions: typeof Actions$1;
-};
+//#region src/activity/use-capxul-activity.d.ts
+export declare function useCapxulActivity(params?: ActivityListParams): UseQueryResult<ActivityPage, CapxulError>;
+export declare function useCapxulActivityDetail(reference: ActivityReference | undefined, actor?: ActorReference): UseQueryResult<ActivityDetail | null, CapxulError>;
+export declare function useCapxulAnnotateMovement(): UseMutationResult<ActivityAnnotation, CapxulError, ActivityAnnotationInput>;
 //#endregion
-//#region src/headless/access/org-member.d.ts
+//#region src/organizations/org-member.d.ts
 /** The two enforcement facts, named the way a screen asks for them. */
 type OrgMemberAction = "spend" | "managePeople";
 /**
@@ -820,7 +721,7 @@ interface CapxulOrgMemberProps {
   readonly orgId: OrgId | string | undefined;
   readonly children: ReactNode;
 }
-declare function Root$3({ orgId, children }: CapxulOrgMemberProps): import("react/jsx-runtime").JSX.Element;
+declare function Root$3({ orgId, children }: CapxulOrgMemberProps): import("react").JSX.Element;
 /**
  * One part serves all four denial idioms the app already uses: disabled with no
  * explanation, disabled plus a native `title`, a whole-surface swap, and
@@ -830,135 +731,255 @@ declare function Root$3({ orgId, children }: CapxulOrgMemberProps): import("reac
 declare function Can({ do: action, children }: {
   readonly do: OrgMemberAction;
   readonly children: (slice: OrgMemberCanSlice) => ReactNode;
-}): import("react/jsx-runtime").JSX.Element;
+}): import("react").JSX.Element;
 declare function Standing({ children }: {
   readonly children: (slice: OrgMemberStandingSlice) => ReactNode;
-}): import("react/jsx-runtime").JSX.Element;
+}): import("react").JSX.Element;
 /** The compound shape the app's own design system already uses (`StatusTabs`). */
-declare const CapxulOrgMember: typeof Root$3 & {
+export declare const CapxulOrgMember: typeof Root$3 & {
   Can: typeof Can;
   Standing: typeof Standing;
 };
 //#endregion
-//#region src/headless/access/dashboard-access.d.ts
-type DashboardScope = {
-  readonly kind: "personal";
-} | {
-  readonly kind: "organization";
-  readonly orgId?: string;
-};
-type DashboardAccessPhase = "checking" | "error" | "redirect" | "granted";
+//#region src/organizations/use-capxul-create-org.d.ts
 /**
- * Which of the three probes produced the error the screen is showing. The
- * error code alone cannot say: a provider failure reads the same whether the
- * session read, the membership list or the lifecycle read raised it, and a
- * consumer that reports a displayed gate error has to keep those apart
- * (#1963 R05-2). It names the SOURCE only; `retry` still re-runs every failed
- * probe, exactly as before.
+ * Create an Organization. Binds directly to the
+ * `onboarding.completeOrganization(input)` SDK method. On success, invalidates the org list.
  */
-type DashboardAccessProbe = "session" | "membership" | "lifecycle";
-interface DashboardAccessErrorSlice {
-  readonly error: CapxulError;
-  /** The probe the surfaced error came from, in the frozen precedence order. */
-  readonly probe: DashboardAccessProbe;
-  /** Re-runs each failed probe. */
-  readonly retry: () => void;
-}
-interface DashboardAccessRedirectSlice {
-  readonly destination: IdentityDestination;
-}
-interface CapxulDashboardAccessProps {
-  readonly scope: DashboardScope;
-  readonly children: ReactNode;
-}
-declare function Root$2({ scope, children }: CapxulDashboardAccessProps): import("react/jsx-runtime").JSX.Element;
-/** Hands nothing — today's app renders `null` here, exactly as it does now. */
-declare function Checking({ children }: {
-  readonly children?: ReactNode;
-}): import("react/jsx-runtime").JSX.Element | null;
-declare function DashboardError({ children }: {
-  readonly children: (slice: DashboardAccessErrorSlice) => ReactNode;
-}): import("react/jsx-runtime").JSX.Element | null;
+type UseCapxulCreateOrgReturn = UseMutationResult<OrganizationOnboarding, CapxulError, OrganizationOnboardingInput>;
+export declare function useCapxulCreateOrg(): UseCapxulCreateOrgReturn;
+//#endregion
+//#region src/organizations/use-capxul-org-members.d.ts
+type UseCapxulOrgMembersOptions = {
+  readonly enabled?: boolean;
+};
 /**
- * Hands the destination and draws nothing. Reaching this part is a REQUEST to
- * navigate, never an arrival: the app may cancel or supersede it, so nothing
- * here — and nothing a consumer hangs off it — may claim a completed redirect
- * (#1963 R05-1). The destination page's own normalized pageview proves arrival.
+ * List the members of one Organization. Binds directly to
+ * `capxul.org(orgId).members()`. Gated by
+ * `orgId !== undefined`; callers may additionally gate on canonical identity
+ * readiness through `options.enabled`.
  */
-declare function Redirect({ children }: {
-  readonly children: (slice: DashboardAccessRedirectSlice) => ReactNode;
-}): import("react/jsx-runtime").JSX.Element | null;
-declare function Granted({ children }: {
-  readonly children?: ReactNode;
-}): import("react/jsx-runtime").JSX.Element | null;
-/** The compound shape the app's own design system already uses (`StatusTabs`). */
-declare const CapxulDashboardAccess: typeof Root$2 & {
-  Checking: typeof Checking;
-  Error: typeof DashboardError;
-  Redirect: typeof Redirect;
-  Granted: typeof Granted;
+type UseCapxulOrgMembersReturn = UseQueryResult<Page<MemberView>, CapxulError>;
+export declare function useCapxulOrgMembers(orgId: OrgId | undefined, options?: UseCapxulOrgMembersOptions): UseCapxulOrgMembersReturn;
+//#endregion
+//#region src/organizations/use-capxul-org-roles.d.ts
+type UseCapxulOrgRolesOptions = {
+  readonly enabled?: boolean;
 };
+/**
+ * List the roles for one Organization. Binds directly
+ * to `capxul.org(orgId).roles()`. Gated by `orgId !== undefined`.
+ */
+type UseCapxulOrgRolesReturn = UseQueryResult<Page<RoleView>, CapxulError>;
+export declare function useCapxulOrgRoles(orgId: OrgId | undefined, options?: UseCapxulOrgRolesOptions): UseCapxulOrgRolesReturn;
 //#endregion
-//#region src/headless/payroll/use-payroll.d.ts
-interface PayrollGroupRow {
-  readonly id: PayrollGroupId;
+//#region src/organizations/use-capxul-org-treasury.d.ts
+type UseCapxulOrgTreasuryOptions = {
+  readonly enabled?: boolean;
+};
+/**
+ * Return the Organization treasury Account.
+ * NEVER `AccountStatus` (the deploy-readiness ladder, no balance). Binds
+ * Binds directly to `capxul.org(orgId).treasury()`. Gated by `orgId !== undefined`.
+ */
+type UseCapxulOrgTreasuryReturn = UseQueryResult<Account, CapxulError>;
+export declare function useCapxulOrgTreasury(orgId: OrgId | undefined, options?: UseCapxulOrgTreasuryOptions): UseCapxulOrgTreasuryReturn;
+//#endregion
+//#region src/organizations/use-capxul-orgs.d.ts
+/**
+ * List the Organizations that the current user can access. Binds directly to
+ * the locked `capxul.orgs()` SDK method.
+ */
+type UseCapxulOrgsReturn = UseQueryResult<Page<OrganizationAccess>, CapxulError>;
+type UseCapxulOrgsOptions = {
+  /**
+   * Gate the query on auth readiness. `client.orgs()` is a session-scoped
+   * authenticated read; firing it before the session token settles surfaces a
+   * spurious `NOT_AUTHENTICATED`. Consumers pass `enabled: <auth-ready>`.
+   * Defaults to `true` to preserve the bare `useCapxulOrgs()` call shape.
+   */
+  readonly enabled?: boolean;
+};
+export declare function useCapxulOrgs(options?: UseCapxulOrgsOptions): UseCapxulOrgsReturn;
+//#endregion
+//#region src/media/use-capxul-image-upload.d.ts
+type ImageUploadTarget = {
+  readonly kind: "profile";
+} | {
+  readonly kind: "orgLogo";
+  readonly orgId: string;
+};
+type ImageUploadInput = {
+  readonly blob: Blob;
+  readonly target: ImageUploadTarget;
+};
+type UseCapxulImageUploadReturn = UseMutationResult<{
+  readonly url: string | null;
+}, CapxulError, ImageUploadInput>;
+/**
+ * #1061 / ADR-0014: the whole upload→record sequence as one mutation —
+ * upload the blob, then bind the returned storage id to the profile image or
+ * the org logo. The url is the resolved serving URL (re-read from queries,
+ * never persisted by consumers).
+ */
+export declare function useCapxulImageUpload(): UseCapxulImageUploadReturn;
+//#endregion
+//#region src/media/use-capxul-upload-image.d.ts
+type UseCapxulUploadImageReturn = UseMutationResult<{
+  readonly storageId: string;
+}, CapxulError, Blob>;
+/**
+ * #1955: upload only. Hands back the storage id for a CREATE call to carry
+ * (`ProfileDetails.imageStorageId`, `OrganizationDetails.logoStorageId`).
+ *
+ * `useCapxulImageUpload` is upload+bind and stays as it is for the settings
+ * pages. It cannot serve onboarding: the row it binds to does not exist yet.
+ * Nothing is bound here, so nothing is invalidated either — the create call
+ * that carries the id owns the cache change.
+ */
+export declare function useCapxulUploadImage(): UseCapxulUploadImageReturn;
+//#endregion
+//#region src/parties/contact-slices.d.ts
+type ContactsActor = {
+  readonly kind: "personal";
+} | {
+  readonly kind: "organization";
+  readonly orgId: OrgId | undefined;
+};
+/**
+ * How a contact entered the book. Taken from the shipped surface rather than
+ * re-declared, so the component can never advertise a provenance the wire
+ * cannot carry (ADR-0022 R2; #1532 owns the definition site).
+ */
+type ContactRelationship = AddressBookEntry["relationship"][number];
+interface Contact {
+  /**
+   * The counterparty's `PartyId` — created once and claimed at signup, never
+   * re-keyed (ADR-0022 R1/R3). No email, no prefix, nothing to parse.
+   */
+  readonly id: PartyId;
+  /** The saved label when there is one, else the party's display name. */
   readonly name: string;
-  /** A stored display preference; the app narrows it to its own DS union. */
-  readonly tone: string;
-  readonly memberCount: number;
-  /** `formatMoney` over the amounts the employer typed on this group. */
-  readonly totalDisplay: string;
-  readonly members: readonly {
-    /** The `partyId` — the stable id (ruling Q1), never an email. */
-    readonly recipientId: string;
-    readonly amount: string;
-    readonly currency: Money["currency"];
-  }[];
+  readonly relationship: readonly ContactRelationship[];
+  readonly hidden: boolean;
+  /** Epoch milliseconds. The seam never formats a date; the app writes the words. */
+  readonly lastActivityAt: number;
 }
-interface PayrollSummarySlice {
-  readonly walletBalanceDisplay: string | null;
-  readonly paidThisMonthDisplay: string | null;
+interface ContactRow extends Contact {
+  /** Ours: one initials rule, not one copy per screen. */
+  readonly initials: string;
+  readonly rename: (name: string, options?: InvocationOptions) => void;
+  readonly hide: (options?: InvocationOptions) => void;
+  readonly unhide: (options?: InvocationOptions) => void;
+}
+/** ADR-0023 R1: refusal CODES, never sentences — the app owns the words. */
+type ContactsRefusal = "loading" | "org-unavailable" | "unavailable";
+/**
+ * The blocked facts, in the fixed order `.Add.blockedReason` names them.
+ * `"no-permission"` is absent by ruling, not by omission: the org screen places
+ * `CapxulOrgMember.Can do="managePeople"` around its own Add control.
+ */
+type ContactsAddBlockedReason = "org-unavailable" | "empty";
+/**
+ * Why an add did not land, as a code. ADR-0023 R1 supersedes the contract's
+ * field-message carve-out: `"unresolved"` is the backend refusing to resolve
+ * what was typed (`INVALID_INPUT`), and every other code — offline, signed
+ * out, refused — is `"failed"`. A person can fix only one of them.
+ */
+type ContactsAddError = "unresolved" | "failed";
+interface ContactsSummarySlice {
+  readonly total: number | null;
+  readonly activeCount: number | null;
   readonly isLoading: boolean;
-  readonly error: CapxulError | null;
+  readonly reason: ContactsRefusal | null;
 }
-interface PayrollGroupsSlice {
-  readonly groups: readonly PayrollGroupRow[];
+interface ContactsListSlice {
+  readonly rows: readonly ContactRow[];
+  readonly isLoading: boolean;
+  readonly reason: ContactsRefusal | null;
+}
+interface ContactsListOptions {
+  readonly limit?: number | undefined;
+  /** `"all"` forwards `includeHidden` to the backend, which already accepts it. */
+  readonly show?: "visible" | "all" | undefined;
+}
+interface ContactsAddSlice {
+  readonly value: string;
+  readonly change: (text: string) => void;
   /**
-   * R13 (#1968): `options` is the browser attempt the caller captured before the
-   * employer pressed the button. It reaches the SDK operation unchanged, so the
-   * group's `ui_payroll_action_completed` and the durable `payroll_group_changed`
-   * share one correlation. Absent, the write keeps its own invocation context.
+   * #1960 R02: hand it the options the screen captured BEFORE the click. The
+   * same snapshot reaches the SDK add call and comes back on `onAdded`/
+   * `onFailed`, so the UI observation and the operation share one identity even
+   * when the reply lands after an account switch. Omitted stays omitted.
    */
-  readonly save: (input: PayrollGroupInput, options?: InvocationOptions) => Promise<CapxulResult<PayrollGroupRow>>;
-  readonly remove: (id: PayrollGroupId, options?: InvocationOptions) => Promise<CapxulResult<void>>;
-  readonly isSaving: boolean;
-  readonly isLoading: boolean;
-  readonly error: CapxulError | null;
+  readonly submit: (options?: InvocationOptions) => void;
+  readonly isSubmitting: boolean;
+  readonly blocked: boolean;
+  readonly blockedReason: ContactsAddBlockedReason | null;
+  readonly error: ContactsAddError | null;
 }
 //#endregion
-//#region src/headless/payroll/payroll.d.ts
-interface CapxulPayrollProps {
-  readonly orgId: OrgId | undefined;
+//#region src/parties/contacts.d.ts
+interface CapxulContactsProps {
+  readonly actor: ContactsActor;
+  /**
+   * `options` is exactly what the caller handed `.Add.submit` or a row verb, so
+   * the screen's own observation of the finished action can reuse the attempt
+   * identity the SDK operation ran under (#1960 R02).
+   */
+  readonly onAdded: (contact: Contact, options?: InvocationOptions) => void;
+  /** ADR-0023 R1: the app maps `error.code` to its own copy; no SDK sentence. */
+  readonly onFailed: (error: CapxulError, options?: InvocationOptions) => void;
   readonly children: ReactNode;
 }
-declare function Root$1({ orgId, children }: CapxulPayrollProps): import("react/jsx-runtime").JSX.Element;
-declare function Summary$1({ children }: {
-  readonly children: (slice: PayrollSummarySlice) => ReactNode;
-}): import("react/jsx-runtime").JSX.Element;
-declare function Groups({ children }: {
-  readonly children: (slice: PayrollGroupsSlice) => ReactNode;
-}): import("react/jsx-runtime").JSX.Element;
-/**
- * The compound shape the app's own design system already uses (`StatusTabs`).
- * There is NO `.Runs` part (ruling Q6): no shipped region has the right shape
- * for a run list, and a part without a production caller may not ship.
- */
-declare const CapxulPayroll: typeof Root$1 & {
-  Summary: typeof Summary$1;
-  Groups: typeof Groups;
+declare function Root$2({ actor, onAdded, onFailed, children }: CapxulContactsProps): import("react").JSX.Element;
+declare function Summary$2({ children }: {
+  readonly children: (slice: ContactsSummarySlice) => ReactNode;
+}): import("react").JSX.Element;
+declare function List({ limit, show, children }: ContactsListOptions & {
+  readonly children: (slice: ContactsListSlice) => ReactNode;
+}): import("react").JSX.Element;
+declare function Add({ children }: {
+  readonly children: (slice: ContactsAddSlice) => ReactNode;
+}): import("react").JSX.Element;
+/** The compound shape the app's own design system already uses (`StatusTabs`). */
+export declare const CapxulContacts: typeof Root$2 & {
+  Summary: typeof Summary$2;
+  List: typeof List;
+  Add: typeof Add;
+};
+//#endregion
+//#region src/platform/query-keys.d.ts
+export declare const capxulKeys: {
+  root: readonly ["capxul"];
+  profile: readonly ["capxul", "profile"];
+  handleAvailability: (handle: string) => readonly ["capxul", "profile", "handle-availability", string];
+  account: readonly ["capxul", "account"];
+  provisioning: readonly ["capxul", "provisioning"];
+  binding: readonly ["capxul", "binding"];
+  accountBalance: readonly ["capxul", "accountBalance"];
+  orgs: readonly ["capxul", "orgs"];
+  org: (orgId: OrgId | undefined) => readonly ["capxul", "org", "pending" | OrgId];
+  orgMembers: (orgId: OrgId | undefined) => readonly ["capxul", "org", "pending" | OrgId, "members"];
+  orgRoles: (orgId: OrgId | undefined) => readonly ["capxul", "org", "pending" | OrgId, "roles"];
+  orgTreasury: (orgId: OrgId | undefined) => readonly ["capxul", "org", "pending" | OrgId, "treasury"];
+  orgPermissions: (orgId: OrgId | undefined) => readonly ["capxul", "org", "pending" | OrgId, "permissions"];
+  orgMe: (orgId: OrgId | undefined, account: string | undefined) => readonly ["capxul", "org", "pending" | OrgId, "me", string];
+  orgLifecycle: (orgId: OrgId | undefined) => readonly ["capxul", "org", "pending" | OrgId, "lifecycle"];
+  contacts: (scope: string) => readonly ["capxul", "contacts", string];
+  contactsList: (scope: string, includeHidden: boolean) => readonly ["capxul", "contacts", string, "all" | "visible"];
+  payrollRuns: (orgId: OrgId | undefined) => readonly ["capxul", "org", "pending" | OrgId, "payroll", "runs"];
+  payrollGroups: (orgId: OrgId | undefined) => readonly ["capxul", "org", "pending" | OrgId, "payroll", "groups"];
+  payrollTerms: (orgId: OrgId | undefined) => readonly ["capxul", "org", "pending" | OrgId, "payroll", "terms"];
+  activity: readonly ["capxul", "activity"];
+  activityDetail: (reference: ActivityReference | undefined, actor?: ActorReference) => readonly ["capxul", "activity", "self" | ActorReference, "pending" | ActivityReference];
+  activitySummary: (actor?: ActorReference, window?: ActivityRange) => readonly ["capxul", "activity", "summary", "self" | ActorReference, "all" | ActivityRange];
+  holdings: (actor?: ActorReference) => readonly ["capxul", "holdings", "self" | ActorReference];
+  payments: readonly ["capxul", "payments"];
+  payment: (paymentId: string | undefined) => readonly ["capxul", "payments", string];
 };
 //#endregion
-//#region src/headless/payroll/reads.d.ts
+//#region src/payroll/reads.d.ts
 /**
  * One payable person, as the run composer and the group sheet see them.
  *
@@ -972,11 +993,11 @@ interface PayrollRecipientOption {
   readonly email: string | null;
 }
 //#endregion
-//#region src/headless/payroll/use-payroll-run.d.ts
+//#region src/payroll/payroll-run-slices.d.ts
 /**
  * Refusal CODES, never sentences (ADR-0023 R1). `blockedReason` names the FIRST
- * false fact in the fixed order of the contract's seven-row table, so the same
- * composer state always yields the same code.
+ * false fact in the fixed order below, so the same composer state always
+ * yields the same code.
  */
 type CapxulPayrollRunBlockedReason = "signer-not-ready" | "no-source" | "ambiguous-source" | "no-asset" | "no-recipients" | "amount-invalid" | "insufficient-funds";
 interface PayrollRunGroupOption {
@@ -1005,7 +1026,7 @@ interface PayrollRunAmountEntry {
   /** True while the value is one we seeded and the employer has not edited. */
   readonly prefilled: boolean;
   /** The treasury asset's currency. Rows stay absent until this value exists. */
-  readonly currency: Money["currency"];
+  readonly currency: string;
 }
 interface PayrollRunAmountsSlice {
   readonly entries: readonly PayrollRunAmountEntry[];
@@ -1048,7 +1069,7 @@ interface SentPayrollRun {
   readonly recipientCount: number;
 }
 //#endregion
-//#region src/headless/payroll/payroll-run.d.ts
+//#region src/payroll/payroll-run.d.ts
 interface CapxulPayrollRunProps {
   readonly orgId: OrgId | undefined;
   /** How a group card opens pay-now pre-filled — today's group-context merge. */
@@ -1058,59 +1079,89 @@ interface CapxulPayrollRunProps {
   readonly onFailed: (error: CapxulError) => void;
   readonly children: ReactNode;
 }
-declare function Root({ orgId, prefill, onRun, onFailed, children }: CapxulPayrollRunProps): import("react/jsx-runtime").JSX.Element;
+declare function Root$1({ orgId, prefill, onRun, onFailed, children }: CapxulPayrollRunProps): import("react").JSX.Element;
 declare function Recipients({ children }: {
   readonly children: (slice: PayrollRunRecipientsSlice) => ReactNode;
-}): import("react/jsx-runtime").JSX.Element;
+}): import("react").JSX.Element;
 declare function Amounts({ children }: {
   readonly children: (slice: PayrollRunAmountsSlice) => ReactNode;
-}): import("react/jsx-runtime").JSX.Element;
+}): import("react").JSX.Element;
 declare function Asset({ children }: {
   readonly children: (slice: PayrollRunAssetSlice) => ReactNode;
-}): import("react/jsx-runtime").JSX.Element;
-declare function Summary({ children }: {
+}): import("react").JSX.Element;
+declare function Summary$1({ children }: {
   readonly children: (slice: PayrollRunSummarySlice) => ReactNode;
-}): import("react/jsx-runtime").JSX.Element;
+}): import("react").JSX.Element;
 declare function Actions({ children }: {
   readonly children: (slice: PayrollRunActionsSlice) => ReactNode;
-}): import("react/jsx-runtime").JSX.Element;
+}): import("react").JSX.Element;
 /** The compound shape the app's own design system already uses (`StatusTabs`). */
-declare const CapxulPayrollRun: typeof Root & {
+export declare const CapxulPayrollRun: typeof Root$1 & {
   Recipients: typeof Recipients;
   Amounts: typeof Amounts;
   Asset: typeof Asset;
-  Summary: typeof Summary;
+  Summary: typeof Summary$1;
   Actions: typeof Actions;
 };
 //#endregion
-//#region src/internal/reactivity-keys.d.ts
-declare const capxulKeys: {
-  root: readonly ["capxul"];
-  profile: readonly ["capxul", "profile"];
-  handleAvailability: (handle: string) => readonly ["capxul", "profile", "handle-availability", string];
-  account: readonly ["capxul", "account"];
-  provisioning: readonly ["capxul", "provisioning"];
-  binding: readonly ["capxul", "binding"];
-  accountBalance: readonly ["capxul", "accountBalance"];
-  orgs: readonly ["capxul", "orgs"];
-  org: (orgId: OrgId | undefined) => readonly ["capxul", "org", "pending" | OrgId];
-  orgMembers: (orgId: OrgId | undefined) => readonly ["capxul", "org", "pending" | OrgId, "members"];
-  orgRoles: (orgId: OrgId | undefined) => readonly ["capxul", "org", "pending" | OrgId, "roles"];
-  orgTreasury: (orgId: OrgId | undefined) => readonly ["capxul", "org", "pending" | OrgId, "treasury"];
-  orgPermissions: (orgId: OrgId | undefined) => readonly ["capxul", "org", "pending" | OrgId, "permissions"];
-  orgMe: (orgId: OrgId | undefined, account: string | undefined) => readonly ["capxul", "org", "pending" | OrgId, "me", string];
-  orgLifecycle: (orgId: OrgId | undefined) => readonly ["capxul", "org", "pending" | OrgId, "lifecycle"];
-  contacts: (scope: string) => readonly ["capxul", "contacts", string];
-  contactsList: (scope: string, includeHidden: boolean) => readonly ["capxul", "contacts", string, "all" | "visible"];
-  payrollRuns: (orgId: OrgId | undefined) => readonly ["capxul", "org", "pending" | OrgId, "payroll", "runs"];
-  payrollGroups: (orgId: OrgId | undefined) => readonly ["capxul", "org", "pending" | OrgId, "payroll", "groups"];
-  payrollTerms: (orgId: OrgId | undefined) => readonly ["capxul", "org", "pending" | OrgId, "payroll", "terms"];
-  activity: readonly ["capxul", "activity"];
-  activityDetail: (reference: ActivityReference | undefined, actor?: ActorReference | undefined) => readonly ["capxul", "activity", "self" | ActorReference, "pending" | ActivityReference];
-  activitySummary: (actor?: ActorReference, window?: ActivityRange) => readonly ["capxul", "activity", "summary", "self" | ActorReference, "all" | ActivityRange];
-  holdings: (actor?: ActorReference) => readonly ["capxul", "holdings", "self" | ActorReference];
-  payments: readonly ["capxul", "payments"];
-  payment: (paymentId: string | undefined) => readonly ["capxul", "payments", string];
+//#region src/payroll/use-payroll.d.ts
+/** ADR-0022 R9: where a run stands on the shipped command lifecycle. */
+interface PayrollGroupRow {
+  readonly id: PayrollGroupId;
+  readonly name: string;
+  /** A stored display preference; the app narrows it to its own DS union. */
+  readonly tone: string;
+  readonly memberCount: number;
+  /** `formatMoney` over the amounts the employer typed on this group. */
+  readonly totalDisplay: string;
+  readonly members: readonly {
+    /** The `partyId` — the stable id (ruling Q1), never an email. */
+    readonly recipientId: string;
+    readonly amount: string;
+    readonly currency: Money["currency"];
+  }[];
+}
+interface PayrollSummarySlice {
+  readonly walletBalanceDisplay: string | null;
+  readonly paidThisMonthDisplay: string | null;
+  readonly isLoading: boolean;
+  readonly error: CapxulError | null;
+}
+interface PayrollGroupsSlice {
+  readonly groups: readonly PayrollGroupRow[];
+  /**
+   * R13 (#1968): `options` is the browser attempt the caller captured before the
+   * employer pressed the button. It reaches the SDK operation unchanged, so the
+   * group's `ui_payroll_action_completed` and the durable `payroll_group_changed`
+   * share one correlation. Absent, the write keeps its own invocation context.
+   */
+  readonly save: (input: PayrollGroupInput, options?: InvocationOptions) => Promise<CapxulResult<PayrollGroupRow>>;
+  readonly remove: (id: PayrollGroupId, options?: InvocationOptions) => Promise<CapxulResult<void>>;
+  readonly isSaving: boolean;
+  readonly isLoading: boolean;
+  readonly error: CapxulError | null;
+}
+//#endregion
+//#region src/payroll/payroll.d.ts
+interface CapxulPayrollProps {
+  readonly orgId: OrgId | undefined;
+  readonly children: ReactNode;
+}
+declare function Root({ orgId, children }: CapxulPayrollProps): import("react").JSX.Element;
+declare function Summary({ children }: {
+  readonly children: (slice: PayrollSummarySlice) => ReactNode;
+}): import("react").JSX.Element;
+declare function Groups({ children }: {
+  readonly children: (slice: PayrollGroupsSlice) => ReactNode;
+}): import("react").JSX.Element;
+/**
+ * The compound shape the app's own design system already uses (`StatusTabs`).
+ * There is NO `.Runs` part (ruling Q6): no shipped region has the right shape
+ * for a run list, and a part without a production caller may not ship.
+ */
+export declare const CapxulPayroll: typeof Root & {
+  Summary: typeof Summary;
+  Groups: typeof Groups;
 };
 //#endregion
-export { type AccountFailure, type AccountProgress, type ActionResult, type ActivityDetailSlice, type ActivityExportSlice, type ActivityFilterValues, type ActivityFiltersSlice, type ActivityLoadMoreSlice, type ActivityReceipt, type ActivityRow, type ActivityRowsSlice, type ActivitySearchSlice, type ActivitySummarySlice, type AuthenticatedState, type AuthenticationSlots, type CanReason, CapxulActivity, type CapxulActivityProps, type CapxulAuth, CapxulAuthenticationController, type CapxulBootstrapState, type CapxulBootstrapStatus, CapxulContacts, type CapxulContactsProps, CapxulDashboardAccess, type CapxulDashboardAccessProps, CapxulOnboardingController, CapxulOrgMember, type CapxulOrgMemberProps, CapxulPayroll, type CapxulPayrollProps, CapxulPayrollRun, type CapxulPayrollRunBlockedReason, type CapxulPayrollRunProps, CapxulProvider, type CapxulProviderProps, type CapxulSend, CapxulSendMoney, type CapxulSendMoneyBlockedReason, type CapxulSendMoneyProps, type Contact, type ContactRelationship, type ContactRow, type ContactsActor, type ContactsAddBlockedReason, type ContactsAddError, type ContactsAddSlice, type ContactsListOptions, type ContactsListSlice, type ContactsRefusal, type ContactsSummarySlice, type ControllerAction, type CreateOrganizationFailure, type CreateOrganizationSubmission, type CsvExport, type DashboardAccessErrorSlice, type DashboardAccessPhase, type DashboardAccessProbe, type DashboardAccessRedirectSlice, type DashboardScope, type Destination, type FaultedState, type HandleAvailability, type ImageUploadInput, type ImageUploadTarget, type InvocationOptions, type NavigationAction, type OnboardingControllerProps, type OnboardingIntent, type OnboardingJourney, type OnboardingJourneyPosition, type OnboardingOrigin, type OnboardingStep, type OrgFailure, type OrgMemberAction, type OrgMemberCanSlice, type OrgMemberStanding, type OrgMemberStandingSlice, type OrgProgress, type OrganizationDetails, type OrganizationDraft, type OtpPendingState, type PayoutDraftChain, type PayoutDraftEntry, type PayrollGroupRow, type PayrollGroupsSlice, type PayrollRecipientOption, type PayrollRunActionsSlice, type PayrollRunAmountEntry, type PayrollRunAmountsSlice, type PayrollRunAssetSlice, type PayrollRunGroupOption, type PayrollRunPrefill, type PayrollRunRecipientsSlice, type PayrollRunStatus, type PayrollRunSummarySlice, type PayrollSummarySlice, type PendingAuthState, type ProfileDetails, type ProfileDraft, type ProfileSlotProps, type ReadyDestination, type RetryAction, type SendActor, type SendMoneyActionsSlice, type SendMoneyAmountSlice, type SendMoneyAssetError, type SendMoneyAssetOption, type SendMoneyAssetSlice, type SendMoneyRecipientSlice, type SendMoneyRecipientStatus, type SendMoneySourceError, type SendMoneySourceOption, type SendMoneySourceSlice, type SendResult, type SentPayment, type SentPayrollRun, type SignedOutState, type Slot, type SummaryWindow, type UseCapxulAccountBalanceOptions, type UseCapxulAccountBalanceReturn, type UseCapxulAccountFundReturn, type UseCapxulCreateCommitmentReturn, type UseCapxulCreateOrgReturn, type UseCapxulHandleAvailabilityReturn, type UseCapxulImageUploadReturn, type UseCapxulInviteMemberInput, type UseCapxulInviteMemberReturn, type UseCapxulOrgMembersOptions, type UseCapxulOrgMembersReturn, type UseCapxulOrgRolesOptions, type UseCapxulOrgRolesReturn, type UseCapxulOrgTreasuryOptions, type UseCapxulOrgTreasuryReturn, type UseCapxulOrgsReturn, type UseCapxulPayReturn, type UseCapxulPaymentReturn, type UseCapxulPaymentsReturn, type UseCapxulProfileReturn, type UseCapxulRedirectPaymentReturn, type UseCapxulUploadImageReturn, acknowledgeOnboardingDestination, activeOnboardingRecovery, capxulKeys, clearOnboardingJourney, currentOnboardingJourneyId, entered, invalidateOnboardingJourneyObservation, isClaimed, isRestoring, loadOnboardingJourney, onboardingJourneyPosition, saveOnboardingJourney, startOnboardingJourney, useCapxul, useCapxulAccountBalance, useCapxulAccountFund, useCapxulActivity, useCapxulActivityDetail, useCapxulAnnotateMovement, useCapxulAuth, useCapxulCancelPayment, useCapxulClaimPayment, useCapxulClientOrNull, useCapxulCreateCommitment, useCapxulCreateOrg, useCapxulDestination, useCapxulHandleAvailability, useCapxulHoldings, useCapxulIdentity, useCapxulImageUpload, useCapxulInviteMember, useCapxulOrgMembers, useCapxulOrgRoles, useCapxulOrgTreasury, useCapxulOrganizationPay, useCapxulOrganizationPayBatch, useCapxulOrgs, useCapxulPay, useCapxulPayment, useCapxulPayments, useCapxulPermission, useCapxulPermissionAssign, useCapxulPermissionChange, useCapxulPermissionCreate, useCapxulPermissionReplace, useCapxulPermissionRevoke, useCapxulPermissions, useCapxulProfile, useCapxulRedirectPayment, useCapxulSend, useCapxulTransitions, useCapxulUploadImage };
+export { type AccountFailure, type AccountProgress, type ActionResult, type ActivityDetailSlice, type ActivityExportSlice, type ActivityFilterValues, type ActivityFiltersSlice, type ActivityLoadMoreSlice, type ActivityReceipt, type ActivityRow, type ActivityRowsSlice, type ActivitySearchSlice, type ActivitySummarySlice, type AuthenticatedState, type AuthenticationSlots, type CanReason, type CapxulActivityProps, type CapxulAuth, CapxulAuthenticationController, type CapxulBootstrapState, type CapxulBootstrapStatus, type CapxulClientConnectionProps, type CapxulContactsProps, type CapxulDashboardAccessProps, CapxulOnboardingController, type CapxulOrgMemberProps, type CapxulPayrollProps, type CapxulPayrollRunBlockedReason, type CapxulPayrollRunProps, type CapxulProviderProps, type CapxulSend, type CapxulSendMoneyBlockedReason, type CapxulSendMoneyProps, type CompleteSlice as ClientConnectionCompleteSlice, type ConsentSlice as ClientConnectionConsentSlice, type FailureSlice as ClientConnectionFailureSlice, type OtpSlice as ClientConnectionOtpSlice, type Contact, type ContactRelationship, type ContactRow, type ContactsActor, type ContactsAddBlockedReason, type ContactsAddError, type ContactsAddSlice, type ContactsListOptions, type ContactsListSlice, type ContactsRefusal, type ContactsSummarySlice, type ControllerAction, type CreateOrganizationFailure, type CreateOrganizationSubmission, type CsvExport, type DashboardAccessErrorSlice, type DashboardAccessPhase, type DashboardAccessProbe, type DashboardAccessRedirectSlice, type DashboardScope, type Destination, type FaultedState, type HandleAvailability, type ImageUploadInput, type ImageUploadTarget, type InvocationOptions, type NavigationAction, type OnboardingControllerProps, type OnboardingIntent, type OnboardingJourney, type OnboardingJourneyPosition, type OnboardingOrigin, type OnboardingStep, type OrgFailure, type OrgMemberAction, type OrgMemberCanSlice, type OrgMemberStanding, type OrgMemberStandingSlice, type OrgProgress, type OrganizationDetails, type OrganizationDraft, type OtpPendingState, type PayoutDraftChain, type PayoutDraftEntry, type PayrollGroupRow, type PayrollGroupsSlice, type PayrollRecipientOption, type PayrollRunActionsSlice, type PayrollRunAmountEntry, type PayrollRunAmountsSlice, type PayrollRunAssetSlice, type PayrollRunGroupOption, type PayrollRunPrefill, type PayrollRunRecipientsSlice, type PayrollRunStatus, type PayrollRunSummarySlice, type PayrollSummarySlice, type PendingAuthState, type ProfileDetails, type ProfileDraft, type ProfileSlotProps, type ReadyDestination, type RetryAction, type SendActor, type SendMoneyActionsSlice, type SendMoneyAmountSlice, type SendMoneyAssetError, type SendMoneyAssetOption, type SendMoneyAssetSlice, type SendMoneyRecipientSlice, type SendMoneyRecipientStatus, type SendMoneySourceError, type SendMoneySourceOption, type SendMoneySourceSlice, type SendResult, type SentPayment, type SentPayrollRun, type SignedOutState, type Slot, type SummaryWindow, type UseCapxulAccountBalanceOptions, type UseCapxulAccountBalanceReturn, type UseCapxulAccountFundReturn, type UseCapxulCreateOrgReturn, type UseCapxulHandleAvailabilityReturn, type UseCapxulImageUploadReturn, type UseCapxulOrgMembersOptions, type UseCapxulOrgMembersReturn, type UseCapxulOrgRolesOptions, type UseCapxulOrgRolesReturn, type UseCapxulOrgTreasuryOptions, type UseCapxulOrgTreasuryReturn, type UseCapxulOrgsReturn, type UseCapxulPayReturn, type UseCapxulPaymentReturn, type UseCapxulPaymentsReturn, type UseCapxulProfileReturn, type UseCapxulUploadImageReturn, isClaimed, isRestoring };