@capxul/sdk 1.0.0-alpha.16 → 1.0.0-alpha.18

package/dist/index.mjs

@@ -1,5 +1,5 @@
-import { A as toSessionToken, C as toEpochSeconds, D as toPublishableKey, E as toOrgId, F as isCapxulError, M as decodeConvexError, N as CapxulError, O as toPublishableKeyId, P as Errors, S as toEpochMs, T as toKycTier, _ as toChainId, b as toDurationMs, c as BYTES32_RE, d as toAccountId, f as toAddress, g as toAuthUserId, h as toAppId, j as toSubAccountId, k as toRoleKey, l as EVM_ADDRESS_RE$1, m as toAnonymousDistinctId, n as BrowserAuthCacheAdapter, o as AuthCachePortTag, p as toAllowedOrigin, s as APP_ID_RE, t as InMemoryAuthCacheAdapter, u as SUPPORTED_CURRENCY_CODES, v as toCountryCode, w as toJwtToken, x as toEmail, y as toCurrencyCode } from "./InMemoryAuthCacheAdapter-v5W-XB5M.mjs";
-import { formatUnits, keccak256, padHex, parseUnits, recoverAddress, stringToHex, toBytes } from "viem";
+import { A as toSessionToken, C as toEpochSeconds, D as toPublishableKey, E as toOrgId, F as Errors, I as isCapxulError, M as decodeConvexError, N as CapxulError, O as toPublishableKeyId, P as EXPECTED_OPERATION_OUTCOMES, S as toEpochMs, T as toKycTier, _ as toChainId, b as toDurationMs, c as BYTES32_RE, d as toAccountId, f as toAddress, g as toAuthUserId, h as toAppId, j as toSubAccountId, k as toRoleKey, l as EVM_ADDRESS_RE$1, m as toAnonymousDistinctId, n as BrowserAuthCacheAdapter, o as AuthCachePortTag, p as toAllowedOrigin, s as APP_ID_RE, t as InMemoryAuthCacheAdapter, u as SUPPORTED_CURRENCY_CODES, v as toCountryCode, w as toJwtToken, x as toEmail, y as toCurrencyCode } from "./InMemoryAuthCacheAdapter-BuVZpnSx.mjs";
+import { concat, formatUnits, keccak256, padHex, parseUnits, recoverAddress, stringToHex, toBytes, toEventSelector, toFunctionSelector } from "viem";
 import { Context, Data, Deferred, Duration, Effect, Either, Exit, Layer, Ref, Request, Scope } from "effect";
 import { getFunctionName, makeFunctionReference } from "convex/server";
 import { privateKeyToAccount } from "viem/accounts";
@@ -12,6 +12,10 @@ import { Machine } from "@effect/experimental";
 const USDX_ADDRESS_BASE_SEPOLIA = "0xf09fcbb6df9f8f918e58f9c8ab15a76ade862b77";
 USDX_ADDRESS_BASE_SEPOLIA.toLowerCase();
 //#endregion
+//#region ../config/src/org-payments.ts
+/** Zodiac MultiSendCallOnly module on Base Sepolia. */
+const MULTI_SEND_CALL_ONLY = "0x9641d764fc13c8b624c04430c7356c1c7c8102e2";
+//#endregion
 //#region ../config/src/safe.ts
 const BASE_SEPOLIA_CHAIN_ID = 84532;
 /**
@@ -175,6 +179,20 @@ padHex(stringToHex("FM_DAILY"), {
 	size: 32,
 	dir: "right"
 });
+padHex(concat([MULTI_SEND_CALL_ONLY, "0x8d80ff0a"]), {
+	dir: "right",
+	size: 32
+});
+new Map([
+	["assignRoles(address,bytes32[],bool[])", "AssignRoles(address,bytes32[],bool[])"],
+	["allowTarget(bytes32,address,uint8)", "AllowTarget(bytes32,address,uint8)"],
+	["scopeTarget(bytes32,address)", "ScopeTarget(bytes32,address)"],
+	["revokeTarget(bytes32,address)", "RevokeTarget(bytes32,address)"],
+	["allowFunction(bytes32,address,bytes4,uint8)", "AllowFunction(bytes32,address,bytes4,uint8)"],
+	["scopeFunction(bytes32,address,bytes4,(uint8,uint8,uint8,bytes)[],uint8)", "ScopeFunction(bytes32,address,bytes4,(uint8,uint8,uint8,bytes)[],uint8)"],
+	["revokeFunction(bytes32,address,bytes4)", "RevokeFunction(bytes32,address,bytes4)"],
+	["setAllowance(bytes32,uint128,uint128,uint128,uint64,uint64)", "SetAllowance(bytes32,uint128,uint128,uint128,uint64,uint64)"]
+].map(([functionSignature, eventSignature]) => [toFunctionSelector(functionSignature), toEventSelector(eventSignature)]));
 //#endregion
 //#region src/telemetry/stack-frame-parser.ts
 /**
@@ -1600,7 +1618,7 @@ async function recoverRawDigestSigner(input) {
 }
 //#endregion
 //#region package.json
-var version = "1.0.0-alpha.16";
+var version = "1.0.0-alpha.18";
 //#endregion
 //#region src/ports/auth-client.ts
 var AuthClientError = class extends Data.TaggedError("AuthClientError") {};
@@ -1646,6 +1664,94 @@ function resolveAuthClientUrl(authBaseUrl, path) {
 	return `${base}${path}`;
 }
 //#endregion
+//#region ../wire/src/secret-material.ts
+const SENSITIVE_MATERIAL_PATTERNS = [
+	/0x[a-fA-F0-9]{40,}/u,
+	/(?:^|[^a-fA-F0-9])[a-fA-F0-9]{64}(?:$|[^a-fA-F0-9])/u,
+	/eyJ[A-Za-z0-9_-]*\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+/u,
+	/(?:(?:sk|pk|rk)_(?:live|test)|(?:phc|phx|ghp|gho|ghu|ghs|ghr|whsec)_|github_pat_|xox[baprs]-|AKIA[0-9A-Z]{16}|AIza)[A-Za-z0-9_-]*/iu
+];
+/**
+* Reject: does the value carry any known secret material? Best effort — callers
+* drop the whole value on a match; a false negative is a leak, a false positive
+* merely omits an observation field.
+*/
+function containsSensitiveMaterial(value) {
+	return SENSITIVE_MATERIAL_PATTERNS.some((pattern) => pattern.test(value));
+}
+//#endregion
+//#region ../wire/src/observation-context.ts
+/** Single bounded HTTP carrier used before a Convex action envelope exists. */
+const OBSERVATION_CONTEXT_HEADER = "x-capxul-observation-context";
+const FIELD_RULES = {
+	application: {
+		maxLength: 64,
+		pattern: /^[A-Za-z0-9][A-Za-z0-9._-]*$/u
+	},
+	applicationId: {
+		maxLength: 30,
+		pattern: APP_ID_RE
+	},
+	release: {
+		maxLength: 128,
+		pattern: /^[A-Za-z0-9][A-Za-z0-9._+@:/-]*$/u
+	},
+	sessionId: {
+		maxLength: 128,
+		pattern: /^[A-Za-z0-9][A-Za-z0-9._:-]*$/u
+	},
+	organizationId: {
+		maxLength: 128,
+		pattern: /^[A-Za-z0-9][A-Za-z0-9._:-]*$/u
+	},
+	correlationId: {
+		maxLength: 128,
+		pattern: /^[A-Za-z0-9][A-Za-z0-9._:-]*$/u
+	},
+	anonymousId: {
+		maxLength: 128,
+		pattern: /^anon_[A-Za-z0-9-]+$/u
+	}
+};
+/**
+* Copy only the canonical allowlist and silently omit malformed/sensitive
+* values. Observation metadata is best effort and may never reject a domain
+* operation.
+*/
+function sanitizeObservationContext(input) {
+	if (typeof input !== "object" || input === null || Array.isArray(input)) return void 0;
+	const source = input;
+	const sanitized = {};
+	for (const field of Object.keys(FIELD_RULES)) {
+		const value = source[field];
+		if (!isSafeField(field, value)) continue;
+		sanitized[field] = value;
+	}
+	return Object.keys(sanitized).length === 0 ? void 0 : sanitized;
+}
+/** Encode only the sanitized allowlist; absence stays absence. */
+function encodeObservationContextHeader(input) {
+	const sanitized = sanitizeObservationContext(input);
+	return sanitized === void 0 ? void 0 : JSON.stringify(sanitized);
+}
+function isSafeField(field, value) {
+	if (typeof value !== "string") return false;
+	const rule = FIELD_RULES[field];
+	return value.length > 0 && value.length <= rule.maxLength && value === value.trim() && !value.includes("://") && !containsSensitiveMaterial(value) && rule.pattern.test(value);
+}
+//#endregion
+//#region src/internal/observation-http.ts
+/** Resolve one bounded pre-auth snapshot for an outbound SDK HTTP request. */
+function observationRequestHeaders(adapter) {
+	if (adapter === void 0) return {};
+	try {
+		const encoded = encodeObservationContextHeader(adapter.resolveContext?.());
+		return encoded === void 0 ? {} : { [OBSERVATION_CONTEXT_HEADER]: encoded };
+	} catch {
+		return {};
+	}
+}
+//#endregion
 //#region src/adapters/auth-client/BetterAuthBrowserAdapter.ts
 function withSignal$1(init, signal) {
 	return signal === void 0 ? init : {
@@ -1703,8 +1809,10 @@ function mapFetchError$1(operation, err, signal) {
 var BetterAuthBrowserAdapter = class {
 	authBaseUrl;
 	fetchImpl;
+	observation;
 	constructor(deps) {
 		this.authBaseUrl = deps.authBaseUrl.replace(/\/$/, "");
+		this.observation = deps.observation;
 		this.fetchImpl = deps.fetch ?? ((input, init) => globalThis.fetch(input, init));
 	}
 	url(path) {
@@ -1731,7 +1839,10 @@ var BetterAuthBrowserAdapter = class {
 		try {
 			const res = await this.fetchImpl(this.url("/api/auth/email-otp/send-verification-otp"), withSignal$1({
 				method: "POST",
-				headers: { "Content-Type": "application/json" },
+				headers: {
+					"Content-Type": "application/json",
+					...observationRequestHeaders(this.observation)
+				},
 				body: JSON.stringify({
 					email: input.email,
 					type: "sign-in"
@@ -2105,12 +2216,14 @@ var BetterAuthNodeAdapter = class {
 	origin;
 	cookieJar;
 	fetchImpl;
+	observation;
 	constructor(deps) {
 		this.authBaseUrl = deps.authBaseUrl.replace(/\/$/, "");
 		this.host = hostFromBaseUrl(this.authBaseUrl);
 		this.origin = deps.origin?.replace(/\/$/, "");
 		this.cookieJar = deps.cookieJar ?? new CookieJar();
 		this.fetchImpl = deps.fetch ?? fetch;
+		this.observation = deps.observation;
 	}
 	url(path) {
 		return resolveAuthClientUrl(this.authBaseUrl, path);
@@ -2145,7 +2258,8 @@ var BetterAuthNodeAdapter = class {
 				method: "POST",
 				headers: {
 					"content-type": "application/json",
-					...this.origin ? { origin: this.origin } : {}
+					...this.origin ? { origin: this.origin } : {},
+					...observationRequestHeaders(this.observation)
 				},
 				body: JSON.stringify({
 					email: input.email,
@@ -2646,7 +2760,7 @@ const PaymentSource = Schema.Union(Schema.Struct({
 * `hashLineItems` (payment-document-hash.ts) into the Invoice `lineItemsHash`,
 * and Σ(quantity × unitMinor) MUST equal the invoice `amount`. The hash binds
 * the documentHash to the exact items; the sum-check makes the items add up to
-* the amount due. See the payment-document spec (canon/mcp/financial-ops.md).
+* the amount due. See the financial-operations contract in `packages/wire/CONTEXT.md`.
 */
 const LineItem = Schema.Struct({
 	description: Schema.String,
@@ -2757,8 +2871,10 @@ async function safeText(res) {
 var HttpBootstrapAdapter = class {
 	bootstrapBaseUrl;
 	fetchImpl;
+	observation;
 	constructor(deps) {
 		this.bootstrapBaseUrl = deps.bootstrapBaseUrl.replace(/\/$/, "");
+		this.observation = deps.observation;
 		this.fetchImpl = deps.fetch ?? ((input, init) => globalThis.fetch(input, init));
 	}
 	resolve(input) {
@@ -2766,7 +2882,8 @@ var HttpBootstrapAdapter = class {
 			try: () => {
 				const headers = {
 					"content-type": "application/json",
-					...input.origin === void 0 ? {} : { origin: input.origin }
+					...input.origin === void 0 ? {} : { origin: input.origin },
+					...observationRequestHeaders(this.observation)
 				};
 				return this.fetchImpl(`${this.bootstrapBaseUrl}/v1/client/bootstrap`, {
 					method: "POST",
@@ -2860,13 +2977,58 @@ function convexCallErrorFromCapxul(operation, error) {
 }
 var ConvexCallPortTag = class extends Context.Tag("@capxul/sdk/ports/ConvexCallPort")() {};
 //#endregion
+//#region src/internal/invocation-observation.ts
+const INVOCATION_OBSERVATION = Symbol("capxul.invocation-observation");
+const FAILURE_INVOCATION_SNAPSHOT = Symbol("capxul.failure-invocation-snapshot");
+/** @internal Attach one immutable, non-wire invocation snapshot to an SDK-owned object. */
+function attachInvocationObservation(target, context) {
+	const snapshot = Object.freeze(context === void 0 ? {} : { context: Object.freeze({ ...context }) });
+	Object.defineProperty(target, INVOCATION_OBSERVATION, {
+		configurable: false,
+		enumerable: false,
+		value: snapshot,
+		writable: false
+	});
+	return target;
+}
+/** @internal Read the snapshot without exposing its symbol or adding a wire field. */
+function readInvocationObservation(source) {
+	if (typeof source !== "object" || source === null) return void 0;
+	return source[INVOCATION_OBSERVATION];
+}
+/** @internal Carry a snapshot across an SDK adapter projection without resolving again. */
+function copyInvocationObservation(source, target) {
+	const snapshot = readInvocationObservation(source);
+	return snapshot === void 0 ? target : attachInvocationObservation(target, snapshot.context);
+}
+/** @internal Mark a failure envelope as already resolved at the public invocation boundary. */
+function markFailureInvocationSnapshot(failure) {
+	Object.defineProperty(failure, FAILURE_INVOCATION_SNAPSHOT, {
+		configurable: false,
+		enumerable: false,
+		value: true,
+		writable: false
+	});
+	return failure;
+}
+/** @internal Distinguish public-boundary failures from direct adapter calls. */
+function hasFailureInvocationSnapshot(failure) {
+	return typeof failure === "object" && failure !== null && failure[FAILURE_INVOCATION_SNAPSHOT] === true;
+}
+//#endregion
 //#region src/adapters/convex-call/ConvexCallAdapter.ts
+/** Exact floor-first allowlist; every additional handler must migrate its validator first. */
+const OBSERVED_CONVEX_ACTIONS = new Set(["subAccount/actions:transfer"]);
 var ConvexCallAdapter = class {
 	#client;
 	#tokenProvider;
+	#applicationId;
+	#observation;
 	constructor(deps) {
 		this.#client = deps.client ?? new ConvexClient(deps.convexUrl);
 		this.#tokenProvider = deps.tokenProvider;
+		this.#applicationId = deps.applicationId;
+		this.#observation = deps.observation;
 		if (this.#tokenProvider) this.#client.setAuth(this.#tokenProvider);
 	}
 	refreshAuth() {
@@ -2885,10 +3047,36 @@ var ConvexCallAdapter = class {
 		});
 	}
 	action(fn, args) {
+		const path = getFunctionName(fn);
 		return Effect.tryPromise({
-			try: () => this.#client.action(fn, args),
-			catch: (cause) => mapToConvexCallError(getFunctionName(fn), cause)
+			try: () => this.#client.action(fn, this.#observedActionArgs(path, args)),
+			catch: (cause) => mapToConvexCallError(path, cause)
+		});
+	}
+	#observedActionArgs(path, args) {
+		if (!OBSERVED_CONVEX_ACTIONS.has(path)) return args;
+		let hostContext;
+		const invocationSnapshot = readInvocationObservation(args);
+		if (invocationSnapshot !== void 0) hostContext = invocationSnapshot.context;
+		else {
+			const resolveContext = this.#observation?.resolveContext;
+			if (resolveContext === void 0) return args;
+			try {
+				hostContext = resolveContext();
+			} catch {
+				return args;
+			}
+		}
+		if (hostContext === void 0) return args;
+		hostContext = sanitizeObservationContext({
+			...hostContext,
+			...this.#applicationId === void 0 ? {} : { applicationId: this.#applicationId }
 		});
+		if (hostContext === void 0) return args;
+		return {
+			...args,
+			observationContext: hostContext
+		};
 	}
 	subscribe(fn, args, callback) {
 		return Effect.try({
@@ -3556,7 +3744,7 @@ function fromWei(rawBalance, decimals, currency) {
 }
 //#endregion
 //#region src/adapters/account-read/ConvexAccountAdapter.ts
-const DEFAULT_FUNCTIONS$3 = {
+const DEFAULT_FUNCTIONS$5 = {
 	readBalance: makeFunctionReference("account/actions:readBalance"),
 	faucetMint: makeFunctionReference("account/actions:faucetMint")
 };
@@ -3565,7 +3753,7 @@ var ConvexAccountAdapter = class {
 	#fns;
 	constructor(deps) {
 		this.#convex = deps.convex;
-		this.#fns = deps.functions ?? DEFAULT_FUNCTIONS$3;
+		this.#fns = deps.functions ?? DEFAULT_FUNCTIONS$5;
 	}
 	readBalance(input) {
 		return this.#convex.action(this.#fns.readBalance, { chainId: wireChainId(input.chainId) }).pipe(Effect.mapError((error) => accountReadErrorFromCapxul("readBalance", error.publicError, error)), Effect.flatMap((wire) => brandAccountEffect("readBalance", wire)), Effect.catchAllDefect((cause) => Effect.fail(accountReadErrorFromUnknown("readBalance", cause))));
@@ -3618,7 +3806,7 @@ function subAccountErrorFromCapxul(operation, error, cause = error) {
 var SubAccountPortTag = class extends Context.Tag("@capxul/sdk/ports/SubAccountPort")() {};
 //#endregion
 //#region src/adapters/sub-account/ConvexSubAccountAdapter.ts
-const DEFAULT_FUNCTIONS$2 = {
+const DEFAULT_FUNCTIONS$4 = {
 	create: makeFunctionReference("subAccount/mutations:create"),
 	get: makeFunctionReference("subAccount/queries:get"),
 	list: makeFunctionReference("subAccount/queries:list"),
@@ -3633,7 +3821,7 @@ var ConvexSubAccountAdapter = class {
 	constructor(deps) {
 		this.#convex = deps.convex;
 		this.#chainId = deps.chainId;
-		this.#fns = deps.functions ?? DEFAULT_FUNCTIONS$2;
+		this.#fns = deps.functions ?? DEFAULT_FUNCTIONS$4;
 	}
 	create(input) {
 		return this.#runMutation("create", this.#fns.create, {
@@ -3661,12 +3849,12 @@ var ConvexSubAccountAdapter = class {
 		const operation = "transfer";
 		return Effect.suspend(() => {
 			const rawAmount = toWei(input.amount);
-			return this.#convex.action(this.#fns.transfer, {
+			return this.#convex.action(this.#fns.transfer, copyInvocationObservation(input, {
 				chainId: this.#chainId,
 				from: input.from,
 				to: input.to,
 				rawAmount
-			});
+			}));
 		}).pipe(Effect.mapError((error) => subAccountErrorFromCapxul(operation, error.publicError, error)), Effect.map((wire) => brandTransferResult(wire)), Effect.catchAllDefect((cause) => Effect.fail(subAccountErrorFromUnknown(operation, cause))));
 	}
 	#runMutation(operation, ref, args) {
@@ -3717,7 +3905,7 @@ function smartAccountErrorFromCapxul(operation, error, cause = error) {
 var SmartAccountPortTag = class extends Context.Tag("@capxul/sdk/ports/SmartAccountPort")() {};
 //#endregion
 //#region src/adapters/smart-account/ConvexSmartAccountAdapter.ts
-const DEFAULT_FUNCTIONS$1 = {
+const DEFAULT_FUNCTIONS$3 = {
 	loadByAuthUserId: makeFunctionReference("smartAccount/queries:loadByAuthUserId"),
 	loadBySmartAccountAddress: makeFunctionReference("smartAccount/queries:loadBySmartAccountAddress"),
 	provision: makeFunctionReference("smartAccount/mutations:provision"),
@@ -3729,7 +3917,7 @@ var ConvexSmartAccountAdapter = class {
 	#fns;
 	constructor(deps) {
 		this.#convex = deps.convex;
-		this.#fns = deps.functions ?? DEFAULT_FUNCTIONS$1;
+		this.#fns = deps.functions ?? DEFAULT_FUNCTIONS$3;
 	}
 	loadByAuthUserId(authUserId) {
 		return this.#convex.query(this.#fns.loadByAuthUserId, { authUserId }).pipe(Effect.mapError((error) => smartAccountErrorFromCapxul("loadByAuthUserId", error.publicError, error)), Effect.flatMap((row) => brandSmartAccountEffect("loadByAuthUserId", row)), Effect.catchAllDefect((cause) => Effect.fail(smartAccountErrorFromUnknown("loadByAuthUserId", cause))));
@@ -3804,6 +3992,424 @@ function smartAccountErrorFromUnknown(operation, cause) {
 toAddress("0xa6b71e26c5e0845f74c812102ca7114b6a896ab2");
 keccak256("0x");
 //#endregion
+//#region src/ports/org.ts
+var OrgError = class extends Data.TaggedError("OrgError") {};
+function orgErrorFromCapxul(operation, error, cause = error) {
+	return new OrgError({
+		operation,
+		publicCode: error.code,
+		publicError: error,
+		cause,
+		...error.details === void 0 ? {} : { details: error.details }
+	});
+}
+Context.Tag("@capxul/sdk/ports/OrgPort")();
+Context.Tag("@capxul/sdk/ports/OrgRolesDeploymentPort")();
+Context.Tag("@capxul/sdk/ports/OrgSpendPort")();
+//#endregion
+//#region src/adapters/org/parse.ts
+/**
+* Map a `WireOrg` + its (separately read) treasury `Account` into the branded
+* `OrgView`. The viewer role is projected by the authenticated backend read;
+* it must never be inferred from Organization ownership. Brands at the read
+* edge: `orgId`, `safeAddress`.
+*/
+function brandOrgView(wire, treasury, viewerRole) {
+	return {
+		id: toOrgId(wire.orgId),
+		name: wire.name,
+		handle: wire.slug,
+		safeAddress: toAddress(wire.safeAddress.toLowerCase()),
+		role: viewerRole,
+		treasury
+	};
+}
+/**
+* Build the Org treasury `Account` from the raw on-chain `balanceOf` integer
+* (the D3 RPC read). `available === balance` for a treasury with no envelope
+* partition yet (a fresh Org reads back $0).
+*/
+function brandOrgTreasury(input) {
+	return {
+		id: toAccountId(`account_${orgIdBody(input.orgId)}`),
+		balance: input.money,
+		available: input.money
+	};
+}
+function brandOrgRole(wire) {
+	return {
+		orgId: toOrgId(wire.orgId),
+		label: wire.label,
+		roleKey: toRoleKey(wire.roleKey),
+		definition: parseRoleDefinition(wire.definitionJson)
+	};
+}
+function brandOrgMember(wire) {
+	return {
+		orgId: toOrgId(wire.orgId),
+		email: toEmail(wire.email),
+		name: wire.name,
+		personalSafeAddress: wire.personalSafeAddress === null ? null : toAddress(wire.personalSafeAddress),
+		role: wire.role,
+		roleKey: wire.roleKey === null ? null : toRoleKey(wire.roleKey),
+		status: wire.status,
+		grantTxHash: wire.grantTxHash,
+		revokeTxHash: wire.revokeTxHash
+	};
+}
+function parseRoleDefinition(json) {
+	let raw;
+	try {
+		const parsed = JSON.parse(json);
+		if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) throw new Error("expected object");
+		raw = parsed;
+	} catch (err) {
+		throw new Error(`Invalid role definition: malformed JSON - ${err instanceof Error ? err.message : String(err)}`, { cause: err });
+	}
+	if (typeof raw.label !== "string" || raw.label.trim().length === 0) throw new Error("Invalid role definition: missing label");
+	return {
+		label: raw.label,
+		...raw.spend === void 0 ? {} : { spend: {
+			...raw.spend.perTx === void 0 ? {} : { perTx: parseRoleMoney(raw.spend.perTx, "perTx") },
+			...raw.spend.perDay === void 0 ? {} : { perDay: parseRoleMoney(raw.spend.perDay, "perDay") },
+			...raw.spend.toRecipients === void 0 ? {} : { toRecipients: parseRoleRecipients(raw.spend.toRecipients) }
+		} },
+		...raw.subAccounts === void 0 ? {} : { subAccounts: parseRoleSubAccounts(raw.subAccounts) },
+		...typeof raw.canManageMembers === "boolean" ? { canManageMembers: raw.canManageMembers } : {},
+		...typeof raw.canManageRoles === "boolean" ? { canManageRoles: raw.canManageRoles } : {}
+	};
+}
+function parseRoleMoney(raw, field) {
+	if (typeof raw.currency !== "string" || typeof raw.value !== "string" || !/^\d+$/.test(raw.value) || raw.decimals !== 6) throw new Error(`Invalid role money: ${field}`);
+	return {
+		currency: toCurrencyCode(raw.currency),
+		value: raw.value,
+		decimals: raw.decimals
+	};
+}
+function parseRoleRecipients(raw) {
+	if (raw === "anyone") return "anyone";
+	if (!Array.isArray(raw)) throw new Error("Invalid role definition: toRecipients must be \"anyone\" or an array");
+	return raw.map((recipient) => {
+		if (typeof recipient !== "string") throw new Error("Invalid role definition: toRecipients must be \"anyone\" or an array");
+		return toAddress(recipient);
+	});
+}
+function parseRoleSubAccounts(raw) {
+	if (raw.scope === "all") return { scope: "all" };
+	if (!Array.isArray(raw.scope)) throw new Error("Invalid role definition: subAccounts.scope must be \"all\" or an array");
+	return { scope: raw.scope.map((subAccountId) => {
+		if (typeof subAccountId !== "string") throw new Error("Invalid role definition: subAccounts.scope must be \"all\" or an array");
+		return toSubAccountId(subAccountId);
+	}) };
+}
+/** Strip the `org_` prefix + non-alphanumerics so the body re-seeds `account_`. */
+function orgIdBody(orgId) {
+	const underscore = orgId.indexOf("_");
+	const cleaned = (underscore < 0 ? orgId : orgId.slice(underscore + 1)).replace(/[^0-9A-Za-z]/g, "");
+	return cleaned.length > 0 ? cleaned : "0";
+}
+//#endregion
+//#region src/adapters/org/ConvexOrganizationAdapter.ts
+const DEFAULT_FUNCTIONS$2 = {
+	listAll: makeFunctionReference("org/queries:listAll"),
+	listRoles: makeFunctionReference("org/queries:listRolesByOrgId"),
+	listMembers: makeFunctionReference("org/queries:listMembersByOrgId"),
+	readTreasury: makeFunctionReference("org/actions:readTreasury"),
+	inviteMember: makeFunctionReference("org/actions:inviteMember"),
+	resendInvite: makeFunctionReference("org/mutations:resendInviteToken"),
+	detectInvitations: makeFunctionReference("org/actions:detectAndAcceptPendingInvitations")
+};
+/**
+* Standard production Organization read adapter. It intentionally has no
+* deployer/RPC/test configuration: authenticated Convex actions own live chain
+* reads, while the lifecycle adapter owns the single sponsored bootstrap.
+*/
+var ConvexOrganizationAdapter = class {
+	#convex;
+	#fns;
+	constructor(input) {
+		this.#convex = input.convex;
+		this.#fns = input.functions ?? DEFAULT_FUNCTIONS$2;
+	}
+	createOrg(_input) {
+		return Effect.fail(orgErrorFromCapxul("createOrg", Errors.notImplemented("organizationSetup", "use onboarding.completeOrganization")));
+	}
+	listOrgs(_input) {
+		return this.#convex.query(this.#fns.listAll, {}).pipe(Effect.mapError((error) => orgErrorFromCapxul("listOrgs", error.publicError, error)), Effect.flatMap((wires) => Effect.forEach(wires, (wire) => this.#readTreasuryWire(wire.orgId).pipe(Effect.map((treasury) => {
+			const viewerRole = wire.viewerRole.trim();
+			if (viewerRole.length === 0) throw Errors.wrongState({
+				method: "listOrgs",
+				currentState: "viewerRoleMissing",
+				validStates: ["activeViewerRole"]
+			});
+			return brandOrgView(wire, treasury, viewerRole);
+		})))), Effect.catchAllDefect((cause) => Effect.fail(toOrgError("listOrgs", cause))));
+	}
+	readTreasury(input) {
+		return this.#readTreasuryWire(String(input.orgId)).pipe(Effect.catchAllDefect((cause) => Effect.fail(toOrgError("readTreasury", cause))));
+	}
+	listRoles(input) {
+		return this.#convex.query(this.#fns.listRoles, { orgId: input.orgId }).pipe(Effect.mapError((error) => orgErrorFromCapxul("listRoles", error.publicError, error)), Effect.flatMap((rows) => rows.length === 0 ? Effect.fail(partialOrgTruth("listRoles", "activeRoleMissing")) : Effect.succeed(rows.map(brandOrgRole))), Effect.catchAllDefect((cause) => Effect.fail(toOrgError("listRoles", cause))));
+	}
+	listMembers(input) {
+		return this.#convex.query(this.#fns.listMembers, { orgId: input.orgId }).pipe(Effect.mapError((error) => orgErrorFromCapxul("listMembers", error.publicError, error)), Effect.flatMap((rows) => rows.length === 0 ? Effect.fail(partialOrgTruth("listMembers", "activeMemberMissing")) : Effect.succeed(rows.map(brandOrgMember))), Effect.catchAllDefect((cause) => Effect.fail(toOrgError("listMembers", cause))));
+	}
+	pendingMembers(input) {
+		return this.listMembers(input).pipe(Effect.map((members) => members.filter((member) => member.status === "pending" || member.status === "pending_safe" || member.status === "pending_grant")));
+	}
+	inviteMember(input) {
+		return this.#convex.action(this.#fns.inviteMember, {
+			orgId: input.orgId,
+			email: input.input.email,
+			role: input.input.role
+		}).pipe(Effect.mapError((error) => orgErrorFromCapxul("inviteMember", error.publicError, error)), Effect.map(brandOrgMember), Effect.catchAllDefect((cause) => Effect.fail(toOrgError("inviteMember", cause))));
+	}
+	resendInviteToken(input) {
+		return this.#convex.mutation(this.#fns.resendInvite, {
+			orgId: input.orgId,
+			email: input.email
+		}).pipe(Effect.mapError((error) => orgErrorFromCapxul("resendInviteToken", error.publicError, error)), Effect.map(brandOrgMember), Effect.catchAllDefect((cause) => Effect.fail(toOrgError("resendInviteToken", cause))));
+	}
+	detectAndAcceptPendingInvitations(_input) {
+		return this.#convex.action(this.#fns.detectInvitations, {}).pipe(Effect.mapError((error) => orgErrorFromCapxul("detectAndAcceptPendingInvitations", error.publicError, error)), Effect.map((result) => ({ matched: result.matched.map(toOrgId) })), Effect.catchAllDefect((cause) => Effect.fail(toOrgError("detectAndAcceptPendingInvitations", cause))));
+	}
+	#readTreasuryWire(orgId) {
+		return this.#convex.action(this.#fns.readTreasury, { orgId }).pipe(Effect.mapError((error) => orgErrorFromCapxul("readTreasury", error.publicError, error)), Effect.map((wire) => {
+			if (wire.orgId !== orgId) throw Errors.invalidInput("orgId", "Organization treasury scope does not match");
+			const balance = fromWei(wire.rawBalance, wire.decimals, wire.currency);
+			const available = fromWei(wire.rawAvailableBalance, wire.decimals, wire.currency);
+			return {
+				...brandOrgTreasury({
+					orgId: wire.orgId,
+					money: balance
+				}),
+				available
+			};
+		}));
+	}
+};
+function toOrgError(operation, cause) {
+	if (cause instanceof CapxulError) return orgErrorFromCapxul(operation, cause);
+	return orgErrorFromCapxul(operation, Errors.providerError("convex", operation, cause), cause);
+}
+function partialOrgTruth(operation, currentState) {
+	return orgErrorFromCapxul(operation, Errors.wrongState({
+		method: operation,
+		currentState,
+		validStates: ["completeProductionOrganizationTruth"]
+	}));
+}
+//#endregion
+//#region src/adapters/org/ConvexOrganizationSetupAdapter.ts
+const DEFAULT_FUNCTIONS$1 = {
+	startOrResume: makeFunctionReference("org/lifecycle:startOrResume"),
+	prepareFounderAccount: makeFunctionReference("org/actions:prepareFounderAccount"),
+	prepareBootstrap: makeFunctionReference("org/actions:prepareBootstrap"),
+	submitBootstrap: makeFunctionReference("org/actions:submitBootstrap"),
+	confirmBootstrap: makeFunctionReference("org/actions:confirmBootstrap"),
+	recordFailure: makeFunctionReference("org/lifecycle:recordFailure"),
+	load: makeFunctionReference("org/lifecycle:load"),
+	retry: makeFunctionReference("org/lifecycle:retry")
+};
+/** Durable Organization setup capability composed by the standard client. */
+var ConvexOrganizationSetupAdapter = class {
+	#convex;
+	#signer;
+	#fns;
+	constructor(input) {
+		this.#convex = input.convex;
+		this.#signer = input.signer;
+		this.#fns = input.functions ?? DEFAULT_FUNCTIONS$1;
+	}
+	async startOrResume(input) {
+		const result = await runCall("startOrResume", this.#convex.mutation(this.#fns.startOrResume, input));
+		if (!result.ok) return result;
+		const lifecycle = parseLifecycle("startOrResume", result.value.lifecycle);
+		if (!lifecycle.ok) return lifecycle;
+		const orgId = parseOrgId("startOrResume", result.value.orgId);
+		if (!orgId.ok) return orgId;
+		if (String(orgId.value) !== String(lifecycle.value.orgId)) return fail$2(Errors.invalidInput("orgId", "Organization lifecycle scope does not match"));
+		return {
+			ok: true,
+			value: {
+				orgId: orgId.value,
+				lifecycle: lifecycle.value
+			}
+		};
+	}
+	prepareFounderAccount(input) {
+		return this.#lifecycleAction("prepareFounderAccount", input, () => this.#convex.action(this.#fns.prepareFounderAccount, { orgId: input.orgId }));
+	}
+	async authorizeAndSubmitBootstrap(input) {
+		const cancelled = cancellation(input.signal);
+		if (cancelled !== void 0) return cancelled;
+		const signerAddress = await signerResult("getAddress", () => this.#signer.getAddress());
+		if (!signerAddress.ok) return signerAddress;
+		const prepared = await runCall("prepareBootstrap", this.#convex.action(this.#fns.prepareBootstrap, {
+			orgId: input.orgId,
+			signerAddress: signerAddress.value
+		}));
+		if (!prepared.ok) return prepared;
+		const authority = validatePreparedAuthorities(prepared.value, signerAddress.value);
+		if (!authority.ok) return authority;
+		const cancelledAfterPrepare = cancellation(input.signal);
+		if (cancelledAfterPrepare !== void 0) return cancelledAfterPrepare;
+		const signature = await signerResult("signUserOpHash", () => this.#signer.signUserOpHash(prepared.value.digest));
+		if (!signature.ok) return signature;
+		const cancelledAfterSign = cancellation(input.signal);
+		if (cancelledAfterSign !== void 0) return cancelledAfterSign;
+		const submitted = await runCall("submitBootstrap", this.#convex.action(this.#fns.submitBootstrap, {
+			orgId: input.orgId,
+			signerAddress: signerAddress.value,
+			signature: signature.value,
+			userOp: prepared.value.userOp
+		}));
+		if (!submitted.ok) return submitted;
+		return parseLifecycle("submitBootstrap", submitted.value);
+	}
+	confirmSubmittedBootstrap(input) {
+		return this.#lifecycleAction("confirmBootstrap", input, () => this.#convex.action(this.#fns.confirmBootstrap, { orgId: input.orgId }));
+	}
+	async recordFailure(input) {
+		const result = await runCall("recordFailure", this.#convex.mutation(this.#fns.recordFailure, {
+			orgId: input.orgId,
+			at: input.at,
+			errorCode: input.error.code,
+			retryable: input.retryable
+		}));
+		return result.ok ? parseLifecycle("recordFailure", result.value) : result;
+	}
+	async loadLifecycle(input) {
+		const result = await runCall("loadLifecycle", this.#convex.query(this.#fns.load, input));
+		if (!result.ok) return result;
+		if (result.value === null) return fail$2(Errors.invalidInput("orgId", "Organization lifecycle was not found"));
+		return parseLifecycle("loadLifecycle", result.value);
+	}
+	async retry(input) {
+		const cancelled = cancellation(input.signal);
+		if (cancelled !== void 0) return cancelled;
+		const result = await runCall("retry", this.#convex.mutation(this.#fns.retry, { orgId: input.orgId }));
+		return result.ok ? parseLifecycle("retry", result.value) : result;
+	}
+	async #lifecycleAction(operation, input, call) {
+		const cancelled = cancellation(input.signal);
+		if (cancelled !== void 0) return cancelled;
+		const result = await runCall(operation, call());
+		if (!result.ok) return result;
+		const cancelledAfter = cancellation(input.signal);
+		if (cancelledAfter !== void 0) return cancelledAfter;
+		return parseLifecycle(operation, result.value);
+	}
+};
+async function runCall(operation, effect) {
+	try {
+		const result = await Effect.runPromise(Effect.either(effect));
+		return Either.isRight(result) ? {
+			ok: true,
+			value: result.right
+		} : fail$2(publicError(operation, result.left));
+	} catch (cause) {
+		return fail$2(publicError(operation, cause));
+	}
+}
+function publicError(operation, cause) {
+	if (cause instanceof CapxulError) return cause;
+	if (typeof cause === "object" && cause !== null) {
+		const carried = cause.publicError;
+		if (carried instanceof CapxulError) return carried;
+	}
+	return Errors.providerError("convex-organization", operation, cause);
+}
+async function signerResult(operation, run) {
+	try {
+		return {
+			ok: true,
+			value: await run()
+		};
+	} catch (cause) {
+		return fail$2(Errors.providerError("organization-signer", operation, cause));
+	}
+}
+function validatePreparedAuthorities(prepared, signerAddress) {
+	const signer = signerAddress.toLowerCase();
+	const preparedSigner = prepared.signerAddress.toLowerCase();
+	const founder = prepared.founderPersonalAccount.toLowerCase();
+	const organization = prepared.organizationAccountAddress.toLowerCase();
+	const sender = prepared.userOp.sender.toLowerCase();
+	if (preparedSigner !== signer) return fail$2(Errors.invalidInput("signerAddress", "Prepared signer does not match configured signer"));
+	if (founder === signer || organization === signer || organization === founder) return fail$2(Errors.invalidInput("organizationAuthority", "Signer EOA, founder Account, and Organization Account must be distinct"));
+	if (sender !== founder) return fail$2(Errors.invalidInput("userOp.sender", "Bootstrap sender must be the founder Account"));
+	if (!/^0x[0-9a-fA-F]{64}$/u.test(prepared.digest)) return fail$2(Errors.invalidInput("digest", "Prepared bootstrap digest must be 32-byte hex"));
+	return {
+		ok: true,
+		value: void 0
+	};
+}
+function parseLifecycle(operation, wire) {
+	const orgId = parseOrgId(operation, wire.orgId);
+	if (!orgId.ok) return orgId;
+	if (wire.status === "loading") return {
+		ok: true,
+		value: {
+			status: "loading",
+			orgId: orgId.value
+		}
+	};
+	if (wire.status === "ready") return {
+		ok: true,
+		value: {
+			status: "ready",
+			orgId: orgId.value,
+			canTransact: true
+		}
+	};
+	if (wire.status === "failed") {
+		if (!isSetupStep(wire.at)) return fail$2(Errors.invalidInput("lifecycle.at", "Unknown setup step"));
+		return {
+			ok: true,
+			value: {
+				status: "failed",
+				orgId: orgId.value,
+				at: wire.at,
+				error: new CapxulError(wire.error.code, wire.error.message),
+				retryable: wire.retryable
+			}
+		};
+	}
+	if (!isSetupStep(wire.step)) return fail$2(Errors.invalidInput("lifecycle.step", `Unknown setup step from ${operation}`));
+	return {
+		ok: true,
+		value: {
+			status: "settingUp",
+			orgId: orgId.value,
+			step: wire.step
+		}
+	};
+}
+function parseOrgId(operation, value) {
+	try {
+		return {
+			ok: true,
+			value: toOrgId(value)
+		};
+	} catch (cause) {
+		return fail$2(Errors.providerError("convex-organization", operation, cause));
+	}
+}
+function isSetupStep(value) {
+	return value === "preparingFounderAccount" || value === "awaitingFounderAuthorization" || value === "submittingBootstrap" || value === "confirmingBootstrap";
+}
+function cancellation(signal) {
+	return signal?.aborted ? fail$2(Errors.cancelled({ operation: "organization.setup" })) : void 0;
+}
+function fail$2(error) {
+	return {
+		ok: false,
+		error
+	};
+}
+//#endregion
 //#region ../observability/src/index.ts
 const PII = Schema.String.pipe(Schema.brand("PII"));
 const OptionalString = Schema.optional(Schema.String);
@@ -3963,6 +4569,10 @@ const TransferRequestedProps = Schema.Struct({
 	amount: OptionalWeiAmount,
 	direction: OptionalTransferDirection
 });
+const TransferBackendReceivedProps = Schema.Struct({
+	...TelemetryEnvelopeProps,
+	direction: OptionalTransferDirection
+});
 const TransferConfirmedProps = Schema.Struct({
 	...TelemetryEnvelopeProps,
 	amount: OptionalWeiAmount,
@@ -4179,6 +4789,10 @@ Schema.Struct({
 	name: Schema.Literal("transfer_requested"),
 	props: Schema.optional(TransferRequestedProps)
 });
+Schema.Struct({
+	name: Schema.Literal("transfer_backend_received"),
+	props: Schema.optional(TransferBackendReceivedProps)
+});
 Schema.Struct({
 	name: Schema.Literal("transfer_confirmed"),
 	props: Schema.optional(TransferConfirmedProps)
@@ -7282,6 +7896,76 @@ function listOrgsProgram() {
 	});
 }
 //#endregion
+//#region src/client/org-lifecycle.ts
+function fail$1(error) {
+	return {
+		ok: false,
+		error
+	};
+}
+function validateOrganizationLifecycleScope(orgId, lifecycle) {
+	if (String(lifecycle.orgId) !== String(orgId)) return fail$1(Errors.invalidInput("orgId", "Organization lifecycle scope does not match"));
+	return {
+		ok: true,
+		value: lifecycle
+	};
+}
+/** Advance only the steps still required by one durable Organization lane. */
+async function advanceOrganizationSetup(setup, orgId, initial, signal) {
+	const scopedInitial = validateOrganizationLifecycleScope(orgId, initial);
+	if (!scopedInitial.ok) return scopedInitial;
+	let lifecycle = scopedInitial.value;
+	for (let transition = 0; transition < 3; transition += 1) {
+		if (lifecycle.status !== "settingUp") return {
+			ok: true,
+			value: lifecycle
+		};
+		const currentStep = lifecycle.step;
+		if (signal?.aborted) {
+			const cancelled = Errors.cancelled({ operation: "organization.setup" });
+			return recordRetryableCancellation(setup, orgId, lifecycle.step, cancelled);
+		}
+		const stepInput = {
+			orgId,
+			...signal === void 0 ? {} : { signal }
+		};
+		const next = lifecycle.step === "preparingFounderAccount" ? await setup.prepareFounderAccount(stepInput) : lifecycle.step === "awaitingFounderAuthorization" || lifecycle.step === "submittingBootstrap" ? await setup.authorizeAndSubmitBootstrap(stepInput) : await setup.confirmSubmittedBootstrap(stepInput);
+		if (!next.ok) return next.error.code === "CANCELLED" ? recordRetryableCancellation(setup, orgId, lifecycle.step, next.error) : next;
+		const scopedNext = validateOrganizationLifecycleScope(orgId, next.value);
+		if (!scopedNext.ok) return scopedNext;
+		lifecycle = scopedNext.value;
+		if (currentStep === "confirmingBootstrap") return {
+			ok: true,
+			value: lifecycle
+		};
+	}
+	if (lifecycle.status !== "settingUp" || lifecycle.step === "confirmingBootstrap") return {
+		ok: true,
+		value: lifecycle
+	};
+	return fail$1(Errors.wrongState({
+		method: "organization.setup",
+		currentState: lifecycle.step,
+		validStates: [
+			"confirmingBootstrap",
+			"ready",
+			"failed"
+		]
+	}));
+}
+async function recordRetryableCancellation(setup, orgId, at, cancelled) {
+	const recorded = await setup.recordFailure({
+		orgId,
+		at,
+		error: cancelled,
+		retryable: true
+	});
+	if (!recorded.ok) return recorded;
+	const scopedRecorded = validateOrganizationLifecycleScope(orgId, recorded.value);
+	if (!scopedRecorded.ok) return scopedRecorded;
+	return fail$1(cancelled);
+}
+//#endregion
 //#region src/client/org.ts
 /**
 * Org method surface (canon §C2/§C3, D13). S1 (#274) wires `createOrg` /
@@ -7330,6 +8014,36 @@ function makeOrgMethods(deps) {
 					},
 					...convexCall === void 0 ? {} : { convexCall }
 				}),
+				async getLifecycle(options) {
+					if (options?.signal?.aborted) return {
+						ok: false,
+						error: Errors.cancelled({ operation: "org.getLifecycle" })
+					};
+					if (deps.organizationSetup === void 0) return {
+						ok: false,
+						error: Errors.notImplemented("organizationSetup", "getLifecycle")
+					};
+					const loaded = await deps.organizationSetup.loadLifecycle({ orgId });
+					if (!loaded.ok) return loaded;
+					return validateOrganizationLifecycleScope(orgId, loaded.value);
+				},
+				async retrySetup(options) {
+					if (options?.signal?.aborted) return {
+						ok: false,
+						error: Errors.cancelled({ operation: "org.retrySetup" })
+					};
+					const setup = deps.organizationSetup;
+					if (setup === void 0) return {
+						ok: false,
+						error: Errors.notImplemented("organizationSetup", "retrySetup")
+					};
+					const retried = await setup.retry({
+						orgId,
+						...options?.signal === void 0 ? {} : { signal: options.signal }
+					});
+					if (!retried.ok) return retried;
+					return advanceOrganizationSetup(setup, orgId, retried.value, options?.signal);
+				},
 				profile: {
 					get(_options) {
 						if (_options?.signal?.aborted) return Promise.resolve({
@@ -7363,12 +8077,12 @@ function makeOrgMethods(deps) {
 						ok: false,
 						error: treasury.error
 					};
-					const orgs = await toCapxulResult(listOrgsProgram(), layer);
-					if (!orgs.ok) return {
+					const orgList = await toCapxulResult(listOrgsProgram(), layer);
+					if (!orgList.ok) return {
 						ok: false,
-						error: orgs.error
+						error: orgList.error
 					};
-					const org = orgs.value.find((candidate) => candidate.id === orgId);
+					const org = orgList.value.find((candidate) => candidate.id === orgId);
 					return {
 						ok: true,
 						value: {
@@ -7556,7 +8270,6 @@ function normalizePaymentTiming(payment) {
 }
 //#endregion
 //#region src/flows/onboarding.ts
-const DEFAULT_ORG_TEMPLATE = "Startup";
 async function runCompletePersonalOnboarding(ops, input) {
 	const validated = validatePersonalInput(input);
 	if (!validated.ok) return validated;
@@ -7580,11 +8293,13 @@ async function runCompletePersonalOnboarding(ops, input) {
 		value: { lifecycle: lifecycle.value }
 	};
 }
-async function runCompleteOrganizationOnboarding(ops, input) {
+async function runCompleteOrganizationOnboarding(ops, input, options) {
 	const validated = validateOrganizationInput(input);
 	if (!validated.ok) return validated;
 	const session = await ops.currentSession();
 	if (session === null) return fail(Errors.notAuthenticated());
+	const setup = ops.organizationSetup;
+	if (setup === void 0) return fail(Errors.notImplemented("organizationSetup", "completeOrganization"));
 	const written = await ops.completeIdentityOnboarding({
 		authUserId: session.authUserId,
 		email: session.email,
@@ -7592,22 +8307,18 @@ async function runCompleteOrganizationOnboarding(ops, input) {
 		country: validated.value.country
 	});
 	if (!written.ok) return fail(written.error);
-	const provisioned = await ops.triggerProvisioning();
-	if (!provisioned.ok) return fail(provisioned.error);
-	const org = await ops.createOrg({
+	const started = await setup.startOrResume({
 		name: validated.value.organizationName,
 		handle: validated.value.handle,
-		template: DEFAULT_ORG_TEMPLATE,
 		country: validated.value.country
 	});
-	if (!org.ok) return fail(org.error);
-	ops.kickProvisioning();
-	const lifecycle = await ops.readLifecycle();
-	if (!lifecycle.ok) return fail(lifecycle.error);
+	if (!started.ok) return fail(started.error);
+	const lifecycle = await advanceOrganizationSetup(setup, started.value.orgId, started.value.lifecycle, options?.signal);
+	if (!lifecycle.ok) return lifecycle;
 	return {
 		ok: true,
 		value: {
-			org: org.value,
+			orgId: started.value.orgId,
 			lifecycle: lifecycle.value
 		}
 	};
@@ -7698,8 +8409,7 @@ function fail(error) {
 * Onboarding method surface. The thin namespace over the `flows/onboarding.ts`
 * choreography: it adds the `signal`-abort pre-check and delegates to the run
 * functions. The `OnboardingOps` seam is supplied by `assembleCapxulClient`
-* (real ops over the account lane + createOrg + IdentityPort) or by tests
-* (in-memory double).
+* (real identity/Account ops plus Organization setup capability) or by tests.
 */
 function makeOnboardingMethods(ops) {
 	return {
@@ -7715,7 +8425,7 @@ function makeOnboardingMethods(ops) {
 				ok: false,
 				error: Errors.cancelled({ operation: "onboarding.completeOrganization" })
 			});
-			return runCompleteOrganizationOnboarding(ops, input);
+			return runCompleteOrganizationOnboarding(ops, input, options);
 		}
 	};
 }
@@ -7794,7 +8504,8 @@ function assembleCapxulClient(input) {
 		...selectedOrgPort === void 0 ? {} : { orgPort: selectedOrgPort },
 		...input.orgRolesDeploymentPort === void 0 ? {} : { orgRolesDeploymentPort: input.orgRolesDeploymentPort },
 		...input.orgSpendPort === void 0 ? {} : { orgSpendPort: input.orgSpendPort },
-		convexCall: input.ports.convexCall
+		convexCall: input.ports.convexCall,
+		...input.organizationSetup === void 0 ? {} : { organizationSetup: input.organizationSetup }
 	});
 	if (selectedOrgPort !== void 0) detectPendingOrgInvitations = async () => {
 		await orgMethods.orgs.detectAndAcceptPendingInvitations();
@@ -7817,7 +8528,7 @@ function assembleCapxulClient(input) {
 		triggerProvisioning: () => account._internal.provision(),
 		kickProvisioning: () => kickProvisioning?.(),
 		readLifecycle: () => account.getLifecycle(),
-		createOrg: (createOrgInput) => orgMethods.createOrg(createOrgInput)
+		...input.organizationSetup === void 0 ? {} : { organizationSetup: input.organizationSetup }
 	});
 	return {
 		auth,
@@ -7859,45 +8570,6 @@ function assembleCapxulClient(input) {
 const SDK_VERSION$1 = version;
 /** Stable PostHog event used for typed failures that are expected product outcomes. */
 const CAPXUL_SDK_EXPECTED_OUTCOME_EVENT = "capxul_sdk_expected_outcome";
-const EXPECTED_OPERATION_OUTCOMES = new Set([
-	"INVALID_INPUT",
-	"NOT_AUTHENTICATED",
-	"CANCELLED",
-	"SIGNER_REJECTED",
-	"VERIFICATION_REQUIRED",
-	"INSUFFICIENT_BALANCE",
-	"INVALID_RECIPIENT",
-	"ROLE_PERMISSION_DENIED",
-	"RATE_LIMITED",
-	"OTP_EXPIRED",
-	"WRONG_STATE"
-]);
-const CONTEXT_PROPERTY_RULES = {
-	application: {
-		maxLength: 64,
-		pattern: /^[A-Za-z0-9][A-Za-z0-9._-]*$/u
-	},
-	release: {
-		maxLength: 128,
-		pattern: /^[A-Za-z0-9][A-Za-z0-9._+@:/-]*$/u
-	},
-	session_id: {
-		maxLength: 128,
-		pattern: /^[A-Za-z0-9][A-Za-z0-9._:-]*$/u
-	},
-	organization_id: {
-		maxLength: 128,
-		pattern: /^[A-Za-z0-9][A-Za-z0-9._:-]*$/u
-	},
-	correlation_id: {
-		maxLength: 128,
-		pattern: /^[A-Za-z0-9][A-Za-z0-9._:-]*$/u
-	}
-};
-const EMBEDDED_WALLET_MATERIAL = /0x[a-fA-F0-9]{40,}/u;
-const RAW_PRIVATE_KEY_MATERIAL = /(?:^|[^a-fA-F0-9])[a-fA-F0-9]{64}(?:$|[^a-fA-F0-9])/u;
-const COMPACT_JWT = /eyJ[A-Za-z0-9_-]*\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+/u;
-const KNOWN_CREDENTIAL_PREFIX = /(?:(?:sk|pk|rk)_(?:live|test)|(?:phc|phx|ghp|gho|ghu|ghs|ghr|whsec)_|github_pat_|xox[baprs]-|AKIA[0-9A-Z]{16}|AIza)[A-Za-z0-9_-]*/iu;
 /**
 * Adapt the host's already-initialized PostHog-like client. This function does
 * not import, initialize, configure, or own PostHog.
@@ -7907,7 +8579,7 @@ function fromPostHog(client, options = {}) {
 		if (!isEnabled(options.enabled)) return;
 		if (client === null || client === void 0) return;
 		const safeFailure = sanitizeFailureObservation(failure);
-		return [safeFailure, postHogProperties(safeFailure, resolveContext(options.context))];
+		return [safeFailure, postHogProperties(safeFailure, hasFailureInvocationSnapshot(failure) ? void 0 : resolveContext(options.context))];
 	};
 	const captureOperationFailure = (failure) => {
 		const prepared = prepare(failure);
@@ -7932,6 +8604,10 @@ function fromPostHog(client, options = {}) {
 		deliver(() => client.captureException(safeFailure.exception, properties));
 	};
 	return {
+		resolveContext: () => {
+			if (!isEnabled(options.enabled) || client === null || client === void 0) return void 0;
+			return resolveRawContext(options.context) ?? {};
+		},
 		captureOperationFailure,
 		captureException
 	};
@@ -7944,6 +8620,34 @@ function deliver(capture) {
 		ignoreDeliveryFailure(capture());
 	} catch {}
 }
+/**
+* Fan one SDK failure out to several adapters (issue #877). The SDK's own
+* first-party relay and an optional host-provided adapter both observe the same
+* failure. Order matters for `resolveContext`: the FIRST adapter that returns a
+* context wins, so pass the host adapter first to keep its call-start snapshot.
+* Each capture is isolated — a throwing adapter never blocks its peers or the
+* SDK. Returns `undefined` when no adapters are present (zero observation work).
+*/
+function composeObservationAdapters(...adapters) {
+	const present = adapters.filter((adapter) => adapter !== void 0);
+	if (present.length === 0) return void 0;
+	if (present.length === 1) return present[0];
+	const fanOut = (select) => {
+		for (const adapter of present) try {
+			ignoreDeliveryFailure(select(adapter));
+		} catch {}
+	};
+	return {
+		resolveContext: () => {
+			for (const adapter of present) try {
+				const context = adapter.resolveContext?.();
+				if (context !== void 0) return context;
+			} catch {}
+		},
+		captureOperationFailure: (failure) => fanOut((adapter) => adapter.captureOperationFailure(failure)),
+		captureException: (failure) => fanOut((adapter) => adapter.captureException(failure))
+	};
+}
 /** @internal Decorates public client method bundles at the owning SDK boundary. */
 function observeSdkClient(client, adapter) {
 	if (adapter === void 0) return client;
@@ -7982,18 +8686,20 @@ function observeSdkClient(client, adapter) {
 			if (cached !== void 0) return cached;
 			const wrapped = new Proxy(callable, {
 				apply(currentTarget, _thisArg, args) {
+					const invocationContext = resolveAdapterContext(adapter);
+					const invocationArgs = carryInvocationContext(operation, args, invocationContext);
 					let output;
 					try {
-						output = Reflect.apply(currentTarget, owner, args);
+						output = Reflect.apply(currentTarget, owner, invocationArgs);
 					} catch (cause) {
-						report(adapter, "exception", operation, cause);
+						report(adapter, "exception", operation, cause, invocationContext);
 						throw cause;
 					}
-					if (isPromiseLike(output)) return Promise.resolve(output).then((result) => processOutput(result, path), (cause) => {
-						report(adapter, "exception", operation, cause);
+					if (isPromiseLike(output)) return Promise.resolve(output).then((result) => processOutput(result, path, invocationContext), (cause) => {
+						report(adapter, "exception", operation, cause, invocationContext);
 						throw cause;
 					});
-					return processOutput(output, path);
+					return processOutput(output, path, invocationContext);
 				},
 				get(currentTarget, property) {
 					const attached = Reflect.get(currentTarget, property, currentTarget);
@@ -8006,9 +8712,9 @@ function observeSdkClient(client, adapter) {
 		}
 		return isPlainObject(value) ? wrapObject(value, path) : value;
 	};
-	const processOutput = (output, path) => {
+	const processOutput = (output, path, invocationContext) => {
 		if (isFailedResult(output)) {
-			report(adapter, "operation", path.join("."), output.error);
+			report(adapter, "operation", path.join("."), output.error, invocationContext);
 			return output;
 		}
 		if (isCapxulResult(output)) return output;
@@ -8016,24 +8722,40 @@ function observeSdkClient(client, adapter) {
 	};
 	return wrapObject(client, []);
 }
+function carryInvocationContext(operation, args, context) {
+	if (operation !== "subAccounts.transfer" || !isPlainObject(args[0])) return args;
+	return [attachInvocationObservation({ ...args[0] }, context), ...args.slice(1)];
+}
 /** @internal Reports a factory-level typed failure without changing its identity. */
 function observeFailedResult(result, adapter, operation) {
-	if (adapter !== void 0 && isFailedResult(result)) report(adapter, "operation", operation, result.error);
+	if (adapter !== void 0 && isFailedResult(result)) report(adapter, "operation", operation, result.error, resolveAdapterContext(adapter));
 	return result;
 }
-function report(adapter, kind, operation, cause) {
+function report(adapter, kind, operation, cause, invocationContext) {
 	const operationName = normalizeOperation(operation);
 	const kindName = normalizeErrorKind(errorKind(cause));
-	const failure = {
+	const context = sanitizeObservationContext({
+		...invocationContext,
+		...isCapxulError(cause) && cause.correlationId !== void 0 ? { correlationId: cause.correlationId } : {}
+	});
+	const failure = markFailureInvocationSnapshot({
 		exception: syntheticException(operationName, kindName),
 		sdkVersion: SDK_VERSION$1,
 		operation: operationName,
-		errorKind: kindName
-	};
+		errorKind: kindName,
+		...context === void 0 ? {} : { context }
+	});
 	try {
 		ignoreDeliveryFailure(kind === "operation" ? adapter.captureOperationFailure(failure) : adapter.captureException(failure));
 	} catch {}
 }
+function resolveAdapterContext(adapter) {
+	try {
+		return adapter.resolveContext?.();
+	} catch {
+		return;
+	}
+}
 function ignoreDeliveryFailure(delivery) {
 	if (!isPromiseLike(delivery)) return;
 	try {
@@ -8047,23 +8769,23 @@ function postHogProperties(failure, context) {
 		error_kind: failure.errorKind,
 		handled: true
 	};
-	assignSafeContext(properties, "application", context?.application);
-	assignSafeContext(properties, "release", context?.release);
-	assignSafeContext(properties, "session_id", context?.sessionId);
-	assignSafeContext(properties, "organization_id", context?.organizationId);
-	assignSafeContext(properties, "correlation_id", context?.correlationId);
+	const merged = sanitizeObservationContext({
+		...context,
+		...failure.context
+	});
+	if (merged?.application !== void 0) properties.application = merged.application;
+	if (merged?.release !== void 0) properties.release = merged.release;
+	if (merged?.sessionId !== void 0) properties.session_id = merged.sessionId;
+	if (merged?.organizationId !== void 0) properties.organization_id = merged.organizationId;
+	if (merged?.correlationId !== void 0) properties.correlation_id = merged.correlationId;
+	if (merged?.anonymousId !== void 0) properties.anonymous_id = merged.anonymousId;
 	return properties;
 }
-function assignSafeContext(properties, key, value) {
-	if (typeof value !== "string") return;
-	const rule = CONTEXT_PROPERTY_RULES[key];
-	if (value.length === 0 || value.length > rule.maxLength || value !== value.trim() || value.includes("://") || containsSensitiveContext(value) || !rule.pattern.test(value)) return;
-	properties[key] = value;
-}
-function containsSensitiveContext(value) {
-	return EMBEDDED_WALLET_MATERIAL.test(value) || RAW_PRIVATE_KEY_MATERIAL.test(value) || COMPACT_JWT.test(value) || KNOWN_CREDENTIAL_PREFIX.test(value);
-}
 function resolveContext(context) {
+	return sanitizeObservationContext(resolveRawContext(context));
+}
+/** Resolve the host context closure without sanitizing — the call-start snapshot. */
+function resolveRawContext(context) {
 	try {
 		return typeof context === "function" ? context() : context;
 	} catch {
@@ -8089,11 +8811,13 @@ function errorKind(cause) {
 function sanitizeFailureObservation(failure) {
 	const operation = normalizeOperation(failure.operation);
 	const kind = normalizeErrorKind(failure.errorKind);
+	const context = sanitizeObservationContext(failure.context);
 	return {
 		exception: syntheticException(operation, kind),
 		sdkVersion: normalizeSdkVersion(failure.sdkVersion),
 		operation,
-		errorKind: kind
+		errorKind: kind,
+		...context === void 0 ? {} : { context }
 	};
 }
 function normalizeSdkVersion(value) {
@@ -8125,6 +8849,43 @@ function isCapxulResult(value) {
 function isFailedResult(value) {
 	return isCapxulResult(value) && value.ok === false && "error" in value;
 }
+//#endregion
+//#region src/observation-relay.ts
+/**
+* Build the SDK-owned first-party relay adapter. Both capture entry points send
+* the same redacted envelope fire-and-forget; delivery is fully isolated from
+* the SDK's `CapxulResult` and can never throw into the caller.
+*/
+function createCapxulFirstPartyRelay(options) {
+	const fetchImpl = options.fetch ?? resolveGlobalFetch();
+	const send = (failure) => {
+		if (fetchImpl === void 0) return;
+		try {
+			const headers = { "content-type": "application/json" };
+			const encodedContext = encodeObservationContextHeader(failure.context);
+			if (encodedContext !== void 0) headers[OBSERVATION_CONTEXT_HEADER] = encodedContext;
+			const body = JSON.stringify({
+				operation: failure.operation,
+				error_kind: failure.errorKind,
+				sdk_version: failure.sdkVersion
+			});
+			Promise.resolve(fetchImpl(options.ingestUrl, {
+				method: "POST",
+				headers,
+				body,
+				keepalive: true
+			})).catch(() => void 0);
+		} catch {}
+	};
+	return {
+		captureOperationFailure: send,
+		captureException: send
+	};
+}
+function resolveGlobalFetch() {
+	const candidate = globalThis.fetch;
+	return typeof candidate === "function" ? candidate : void 0;
+}
 const SDK_VERSION = version;
 const collectProductionFlowPorts = Effect.gen(function* () {
 	const authClient = yield* AuthClientPortTag;
@@ -8232,11 +8993,13 @@ function productionBootstrapPortLayer(bootstrap) {
 function productionAuthClientLayer(input, refreshConvexAuthRef) {
 	return (input.runtime === "browser" ? BetterAuthBrowserLayer({
 		authBaseUrl: input.runtimeUrls.authBaseUrl,
-		...input.fetch === void 0 ? {} : { fetch: input.fetch }
+		...input.fetch === void 0 ? {} : { fetch: input.fetch },
+		...input.observation === void 0 ? {} : { observation: input.observation }
 	}) : BetterAuthNodeLayer({
 		authBaseUrl: input.runtimeUrls.authBaseUrl,
 		...input.origin === void 0 ? {} : { origin: input.origin },
-		...input.fetch === void 0 ? {} : { fetch: input.fetch }
+		...input.fetch === void 0 ? {} : { fetch: input.fetch },
+		...input.observation === void 0 ? {} : { observation: input.observation }
 	})).pipe(Layer.map((context) => {
 		const authClient = Context.get(context, AuthClientPortTag);
 		return Context.make(AuthClientPortTag, refreshConvexAuthOnSession(authClient, () => {
@@ -8255,6 +9018,8 @@ function productionAuthCacheLayer(input) {
 function productionConvexCallLayer(input, refreshConvexAuthRef) {
 	return Layer.unwrapEffect(Effect.map(AuthClientPortTag, (authClient) => ConvexCallLayer({
 		convexUrl: input.runtimeUrls.convexUrl,
+		...input.applicationId === void 0 ? {} : { applicationId: input.applicationId },
+		...input.observation === void 0 ? {} : { observation: input.observation },
 		...input.convexClient === void 0 ? {} : { client: input.convexClient },
 		tokenProvider: async ({ forceRefreshToken }) => {
 			const tokenResult = await Effect.runPromise(Effect.either(authClient.getConvexJwt({
@@ -8286,7 +9051,8 @@ async function createProductionAdapters(input) {
 	const closeScope = idempotentClose(() => Effect.runPromise(Scope.close(scope, Exit.void)));
 	const bootstrapLayer = HttpBootstrapLayer({
 		bootstrapBaseUrl: resolvedInput.value.bootstrapBaseUrl,
-		...input.fetch === void 0 ? {} : { fetch: input.fetch }
+		...input.fetch === void 0 ? {} : { fetch: input.fetch },
+		...input.observation === void 0 ? {} : { observation: input.observation }
 	});
 	try {
 		const bootstrapContext = await Effect.runPromise(Layer.buildWithScope(bootstrapLayer, scope));
@@ -8344,6 +9110,8 @@ async function createProductionAdapters(input) {
 			...resolvedInput.value.origin === void 0 ? {} : { origin: resolvedInput.value.origin },
 			runtimeUrls: runtimeUrls.value,
 			chainId: bootstrapResult.value.chainId,
+			applicationId: bootstrapResult.value.applicationId,
+			...input.observation === void 0 ? {} : { observation: input.observation },
 			...input.authCache === void 0 ? {} : { authCache: input.authCache },
 			...input.telemetry === void 0 ? {} : { telemetry: input.telemetry },
 			...injectedClient === void 0 ? {} : { convexClient: injectedClient },
@@ -8405,7 +9173,7 @@ async function createCapxulClient$1(input) {
 			...input.authBaseUrl === void 0 ? {} : { override: input.authBaseUrl }
 		});
 		let signer = input.signer;
-		if (signer === void 0 && (input.requirement ?? "none") === "deployed" && runtime === "browser") signer = createOpenfortBrowserSignerFromBootstrap({
+		if (signer === void 0 && runtime === "browser") signer = createOpenfortBrowserSignerFromBootstrap({
 			...adapters.value.bootstrap,
 			authBaseUrl: resolvedAuthBaseUrl
 		});
@@ -8415,23 +9183,33 @@ async function createCapxulClient$1(input) {
 			authCache: adapters.value.ports.authCache,
 			requirement: input.requirement ?? "none",
 			...signer === void 0 ? {} : { signer },
+			orgPort: new ConvexOrganizationAdapter({ convex: adapters.value.ports.convexCall }),
+			...signer === void 0 ? {} : { organizationSetup: new ConvexOrganizationSetupAdapter({
+				convex: adapters.value.ports.convexCall,
+				signer
+			}) },
 			...input.signal === void 0 ? {} : { signal: input.signal },
 			...input.otpTtlMs === void 0 ? {} : { otpTtlMs: input.otpTtlMs },
 			invokeTimeoutMs: input.invokeTimeoutMs ?? 3e4
 		}), signer);
 		const upstreamClose = adapters.value.close;
+		const value = {
+			...client,
+			_internal: {
+				...client._internal,
+				close: async () => {
+					if ("resetSession" in (signer ?? {})) signer.resetSession();
+					await upstreamClose();
+				}
+			}
+		};
+		const relay = runtime === "browser" ? createCapxulFirstPartyRelay({
+			ingestUrl: deriveObserveIngestUrl(adapters.value.bootstrap),
+			...input.fetch === void 0 ? {} : { fetch: input.fetch }
+		}) : void 0;
 		return {
 			ok: true,
-			value: observeSdkClient({
-				...client,
-				_internal: {
-					...client._internal,
-					close: async () => {
-						if ("resetSession" in (signer ?? {})) signer.resetSession();
-						await upstreamClose();
-					}
-				}
-			}, input.observation)
+			value: observeSdkClient(value, composeObservationAdapters(input.observation, relay))
 		};
 	} catch (cause) {
 		await adapters.value.close().catch(() => void 0);
@@ -8473,6 +9251,38 @@ function resolveInput(input) {
 		};
 	}
 }
+/**
+* Address of the Capxul client-relay ingest endpoint (Pipe 1, issue #877). The
+* HTTP router that serves `/v1/client/observe` lives on the deployment's
+* `.convex.site` host, while the bootstrap-resolved `convexUrl` is the sibling
+* `.convex.cloud` (WebSocket/query) host — the same deterministic pairing
+* `mintQuickstartKey` inverts. For any standard Convex deployment (including
+* production) rewriting the suffix targets the router directly with no host
+* proxy, so it is the primary rule.
+*
+* `siteBaseUrl` is deliberately NOT the primary source: it is an app-configured
+* field that defaults to a placeholder (`https://capxul.local`, see
+* `credentials/applications.ts`) for registered applications, so trusting it
+* outright would POST to a dead host for the common case. It is only consulted
+* as a fallback for a custom-domain `convexUrl` (no deterministic `.convex.site`
+* sibling) when it carries a real, non-placeholder origin.
+*/
+function deriveObserveIngestUrl(bootstrap) {
+	const convexUrl = bootstrap.convexUrl.replace(/\/+$/, "");
+	if (convexUrl.endsWith(".convex.cloud")) return `${convexUrl.replace(/\.convex\.cloud$/, ".convex.site")}/v1/client/observe`;
+	return `${(usableSiteOrigin(bootstrap.siteBaseUrl) ?? convexUrl).replace(/\/+$/, "")}/v1/client/observe`;
+}
+/** A configured `siteBaseUrl` usable as a router host, or `undefined` if it is the placeholder. */
+function usableSiteOrigin(siteBaseUrl) {
+	try {
+		const url = new URL(siteBaseUrl);
+		if (url.protocol !== "http:" && url.protocol !== "https:") return void 0;
+		if (url.hostname === "capxul.local") return void 0;
+		return url.origin;
+	} catch {
+		return;
+	}
+}
 function detectRuntime() {
 	const globalAny = globalThis;
 	return globalAny.window !== void 0 || globalAny.document !== void 0 ? "browser" : "node";