@capxul/sdk 1.0.0-alpha.17 → 1.0.0-alpha.19

package/dist/index.mjs

@@ -1,5 +1,5 @@
-import { A as toSessionToken, C as toEpochSeconds, D as toPublishableKey, E as toOrgId, F as isCapxulError, M as decodeConvexError, N as CapxulError, O as toPublishableKeyId, P as Errors, S as toEpochMs, T as toKycTier, _ as toChainId, b as toDurationMs, c as BYTES32_RE, d as toAccountId, f as toAddress, g as toAuthUserId, h as toAppId, j as toSubAccountId, k as toRoleKey, l as EVM_ADDRESS_RE$1, m as toAnonymousDistinctId, n as BrowserAuthCacheAdapter, o as AuthCachePortTag, p as toAllowedOrigin, s as APP_ID_RE, t as InMemoryAuthCacheAdapter, u as SUPPORTED_CURRENCY_CODES, v as toCountryCode, w as toJwtToken, x as toEmail, y as toCurrencyCode } from "./InMemoryAuthCacheAdapter-v5W-XB5M.mjs";
-import { formatUnits, keccak256, padHex, parseUnits, recoverAddress, stringToHex, toBytes } from "viem";
+import { A as toSessionToken, C as toEpochSeconds, D as toPublishableKey, E as toOrgId, F as Errors, I as isCapxulError, M as decodeConvexError, N as CapxulError, O as toPublishableKeyId, P as EXPECTED_OPERATION_OUTCOMES, S as toEpochMs, T as toKycTier, _ as toChainId, b as toDurationMs, c as BYTES32_RE, d as toAccountId, f as toAddress, g as toAuthUserId, h as toAppId, j as toSubAccountId, k as toRoleKey, l as EVM_ADDRESS_RE$1, m as toAnonymousDistinctId, n as BrowserAuthCacheAdapter, o as AuthCachePortTag, p as toAllowedOrigin, s as APP_ID_RE, t as InMemoryAuthCacheAdapter, u as SUPPORTED_CURRENCY_CODES, v as toCountryCode, w as toJwtToken, x as toEmail, y as toCurrencyCode } from "./InMemoryAuthCacheAdapter-BuVZpnSx.mjs";
+import { concat, formatUnits, keccak256, padHex, parseUnits, recoverAddress, stringToHex, toBytes, toEventSelector, toFunctionSelector } from "viem";
 import { Context, Data, Deferred, Duration, Effect, Either, Exit, Layer, Ref, Request, Scope } from "effect";
 import { getFunctionName, makeFunctionReference } from "convex/server";
 import { privateKeyToAccount } from "viem/accounts";
@@ -12,6 +12,10 @@ import { Machine } from "@effect/experimental";
 const USDX_ADDRESS_BASE_SEPOLIA = "0xf09fcbb6df9f8f918e58f9c8ab15a76ade862b77";
 USDX_ADDRESS_BASE_SEPOLIA.toLowerCase();
 //#endregion
+//#region ../config/src/org-payments.ts
+/** Zodiac MultiSendCallOnly module on Base Sepolia. */
+const MULTI_SEND_CALL_ONLY = "0x9641d764fc13c8b624c04430c7356c1c7c8102e2";
+//#endregion
 //#region ../config/src/safe.ts
 const BASE_SEPOLIA_CHAIN_ID = 84532;
 /**
@@ -175,6 +179,20 @@ padHex(stringToHex("FM_DAILY"), {
 	size: 32,
 	dir: "right"
 });
+padHex(concat([MULTI_SEND_CALL_ONLY, "0x8d80ff0a"]), {
+	dir: "right",
+	size: 32
+});
+new Map([
+	["assignRoles(address,bytes32[],bool[])", "AssignRoles(address,bytes32[],bool[])"],
+	["allowTarget(bytes32,address,uint8)", "AllowTarget(bytes32,address,uint8)"],
+	["scopeTarget(bytes32,address)", "ScopeTarget(bytes32,address)"],
+	["revokeTarget(bytes32,address)", "RevokeTarget(bytes32,address)"],
+	["allowFunction(bytes32,address,bytes4,uint8)", "AllowFunction(bytes32,address,bytes4,uint8)"],
+	["scopeFunction(bytes32,address,bytes4,(uint8,uint8,uint8,bytes)[],uint8)", "ScopeFunction(bytes32,address,bytes4,(uint8,uint8,uint8,bytes)[],uint8)"],
+	["revokeFunction(bytes32,address,bytes4)", "RevokeFunction(bytes32,address,bytes4)"],
+	["setAllowance(bytes32,uint128,uint128,uint128,uint64,uint64)", "SetAllowance(bytes32,uint128,uint128,uint128,uint64,uint64)"]
+].map(([functionSignature, eventSignature]) => [toFunctionSelector(functionSignature), toEventSelector(eventSignature)]));
 //#endregion
 //#region src/telemetry/stack-frame-parser.ts
 /**
@@ -1240,10 +1258,10 @@ function makeAccountMethods(deps) {
 			value: await lane.retryProvisioning()
 		};
 	};
-	const reportAndReturn = (error) => {
+	const reportAndReturn = (error, operation = "getLifecycle") => {
 		if (deps.telemetry) captureExceptionSync(deps.telemetry, error, {
 			layer: "account",
-			operation: "getLifecycle"
+			operation
 		});
 		return {
 			ok: false,
@@ -1274,6 +1292,12 @@ function makeAccountMethods(deps) {
 	};
 	const getLifecycle = () => resolveLifecycle();
 	const retrySetup = async () => {
+		const resetSession = deps.signer?.resetSession;
+		if (typeof resetSession === "function") try {
+			resetSession.call(deps.signer);
+		} catch (cause) {
+			return reportAndReturn(cause instanceof CapxulError ? cause : Errors.providerError("openfort", "resetSession", cause, { failure_mode: "unknown" }), "retrySetup");
+		}
 		await lane.retryProvisioning();
 		return resolveLifecycle();
 	};
@@ -1600,7 +1624,7 @@ async function recoverRawDigestSigner(input) {
 }
 //#endregion
 //#region package.json
-var version = "1.0.0-alpha.17";
+var version = "1.0.0-alpha.19";
 //#endregion
 //#region src/ports/auth-client.ts
 var AuthClientError = class extends Data.TaggedError("AuthClientError") {};
@@ -1646,6 +1670,22 @@ function resolveAuthClientUrl(authBaseUrl, path) {
 	return `${base}${path}`;
 }
 //#endregion
+//#region ../wire/src/secret-material.ts
+const SENSITIVE_MATERIAL_PATTERNS = [
+	/0x[a-fA-F0-9]{40,}/u,
+	/(?:^|[^a-fA-F0-9])[a-fA-F0-9]{64}(?:$|[^a-fA-F0-9])/u,
+	/eyJ[A-Za-z0-9_-]*\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+/u,
+	/(?:(?:sk|pk|rk)_(?:live|test)|(?:phc|phx|ghp|gho|ghu|ghs|ghr|whsec)_|github_pat_|xox[baprs]-|AKIA[0-9A-Z]{16}|AIza)[A-Za-z0-9_-]*/iu
+];
+/**
+* Reject: does the value carry any known secret material? Best effort — callers
+* drop the whole value on a match; a false negative is a leak, a false positive
+* merely omits an observation field.
+*/
+function containsSensitiveMaterial(value) {
+	return SENSITIVE_MATERIAL_PATTERNS.some((pattern) => pattern.test(value));
+}
+//#endregion
 //#region ../wire/src/observation-context.ts
 /** Single bounded HTTP carrier used before a Convex action envelope exists. */
 const OBSERVATION_CONTEXT_HEADER = "x-capxul-observation-context";
@@ -1679,10 +1719,6 @@ const FIELD_RULES = {
 		pattern: /^anon_[A-Za-z0-9-]+$/u
 	}
 };
-const EMBEDDED_WALLET_MATERIAL = /0x[a-fA-F0-9]{40,}/u;
-const RAW_PRIVATE_KEY_MATERIAL = /(?:^|[^a-fA-F0-9])[a-fA-F0-9]{64}(?:$|[^a-fA-F0-9])/u;
-const COMPACT_JWT = /eyJ[A-Za-z0-9_-]*\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+/u;
-const KNOWN_CREDENTIAL_PREFIX = /(?:(?:sk|pk|rk)_(?:live|test)|(?:phc|phx|ghp|gho|ghu|ghs|ghr|whsec)_|github_pat_|xox[baprs]-|AKIA[0-9A-Z]{16}|AIza)[A-Za-z0-9_-]*/iu;
 /**
 * Copy only the canonical allowlist and silently omit malformed/sensitive
 * values. Observation metadata is best effort and may never reject a domain
@@ -1709,9 +1745,6 @@ function isSafeField(field, value) {
 	const rule = FIELD_RULES[field];
 	return value.length > 0 && value.length <= rule.maxLength && value === value.trim() && !value.includes("://") && !containsSensitiveMaterial(value) && rule.pattern.test(value);
 }
-function containsSensitiveMaterial(value) {
-	return EMBEDDED_WALLET_MATERIAL.test(value) || RAW_PRIVATE_KEY_MATERIAL.test(value) || COMPACT_JWT.test(value) || KNOWN_CREDENTIAL_PREFIX.test(value);
-}
 //#endregion
 //#region src/internal/observation-http.ts
 /** Resolve one bounded pre-auth snapshot for an outbound SDK HTTP request. */
@@ -2733,7 +2766,7 @@ const PaymentSource = Schema.Union(Schema.Struct({
 * `hashLineItems` (payment-document-hash.ts) into the Invoice `lineItemsHash`,
 * and Σ(quantity × unitMinor) MUST equal the invoice `amount`. The hash binds
 * the documentHash to the exact items; the sum-check makes the items add up to
-* the amount due. See the payment-document spec (canon/mcp/financial-ops.md).
+* the amount due. See the financial-operations contract in `packages/wire/CONTEXT.md`.
 */
 const LineItem = Schema.Struct({
 	description: Schema.String,
@@ -3359,24 +3392,6 @@ const envFields = {
 		"required": false,
 		"example": "development"
 	},
-	AUTH_DEV_OTP: {
-		"runtime": "server",
-		"kind": "nonempty",
-		"required": false,
-		"example": "000000"
-	},
-	SENTRY_DSN: {
-		"runtime": "server",
-		"kind": "url",
-		"required": false,
-		"example": "https://public@example.ingest.sentry.io/1"
-	},
-	POSTHOG_API_KEY: {
-		"runtime": "server",
-		"kind": "nonempty",
-		"required": false,
-		"example": "phx_test"
-	},
 	POSTHOG_PROJECT_TOKEN: {
 		"runtime": "server",
 		"kind": "nonempty",
@@ -3407,24 +3422,12 @@ const envFields = {
 		"required": false,
 		"example": "12345"
 	},
-	POSTHOG_ENV_ID: {
-		"runtime": "server",
-		"kind": "nonempty",
-		"required": false,
-		"example": "12345"
-	},
 	SENDER_EMAIL: {
 		"runtime": "server",
 		"kind": "email",
 		"required": false,
 		"example": "noreply@capxul.test"
 	},
-	SHIELD_API_URL: {
-		"runtime": "server",
-		"kind": "url",
-		"required": false,
-		"example": "https://api.shield.test"
-	},
 	ALCHEMY_API_KEY: {
 		"runtime": "server",
 		"kind": "nonempty",
@@ -3443,24 +3446,6 @@ const envFields = {
 		"required": true,
 		"example": "alchemy_hmac"
 	},
-	ALCHEMY_AUTH_TOKEN: {
-		"runtime": "server",
-		"kind": "nonempty",
-		"required": false,
-		"example": "alchemy_auth"
-	},
-	ALCHEMY_WEBHOOK_ID: {
-		"runtime": "server",
-		"kind": "nonempty",
-		"required": false,
-		"example": "wh_123"
-	},
-	GOLDSKY_WEBHOOK_SECRET: {
-		"runtime": "server",
-		"kind": "nonempty",
-		"required": false,
-		"example": "goldsky_secret"
-	},
 	DEPLOYER_PRIVATE_KEY: {
 		"runtime": "server",
 		"kind": "privateKey",
@@ -3717,7 +3702,7 @@ function fromWei(rawBalance, decimals, currency) {
 }
 //#endregion
 //#region src/adapters/account-read/ConvexAccountAdapter.ts
-const DEFAULT_FUNCTIONS$3 = {
+const DEFAULT_FUNCTIONS$5 = {
 	readBalance: makeFunctionReference("account/actions:readBalance"),
 	faucetMint: makeFunctionReference("account/actions:faucetMint")
 };
@@ -3726,7 +3711,7 @@ var ConvexAccountAdapter = class {
 	#fns;
 	constructor(deps) {
 		this.#convex = deps.convex;
-		this.#fns = deps.functions ?? DEFAULT_FUNCTIONS$3;
+		this.#fns = deps.functions ?? DEFAULT_FUNCTIONS$5;
 	}
 	readBalance(input) {
 		return this.#convex.action(this.#fns.readBalance, { chainId: wireChainId(input.chainId) }).pipe(Effect.mapError((error) => accountReadErrorFromCapxul("readBalance", error.publicError, error)), Effect.flatMap((wire) => brandAccountEffect("readBalance", wire)), Effect.catchAllDefect((cause) => Effect.fail(accountReadErrorFromUnknown("readBalance", cause))));
@@ -3779,7 +3764,7 @@ function subAccountErrorFromCapxul(operation, error, cause = error) {
 var SubAccountPortTag = class extends Context.Tag("@capxul/sdk/ports/SubAccountPort")() {};
 //#endregion
 //#region src/adapters/sub-account/ConvexSubAccountAdapter.ts
-const DEFAULT_FUNCTIONS$2 = {
+const DEFAULT_FUNCTIONS$4 = {
 	create: makeFunctionReference("subAccount/mutations:create"),
 	get: makeFunctionReference("subAccount/queries:get"),
 	list: makeFunctionReference("subAccount/queries:list"),
@@ -3794,7 +3779,7 @@ var ConvexSubAccountAdapter = class {
 	constructor(deps) {
 		this.#convex = deps.convex;
 		this.#chainId = deps.chainId;
-		this.#fns = deps.functions ?? DEFAULT_FUNCTIONS$2;
+		this.#fns = deps.functions ?? DEFAULT_FUNCTIONS$4;
 	}
 	create(input) {
 		return this.#runMutation("create", this.#fns.create, {
@@ -3878,7 +3863,7 @@ function smartAccountErrorFromCapxul(operation, error, cause = error) {
 var SmartAccountPortTag = class extends Context.Tag("@capxul/sdk/ports/SmartAccountPort")() {};
 //#endregion
 //#region src/adapters/smart-account/ConvexSmartAccountAdapter.ts
-const DEFAULT_FUNCTIONS$1 = {
+const DEFAULT_FUNCTIONS$3 = {
 	loadByAuthUserId: makeFunctionReference("smartAccount/queries:loadByAuthUserId"),
 	loadBySmartAccountAddress: makeFunctionReference("smartAccount/queries:loadBySmartAccountAddress"),
 	provision: makeFunctionReference("smartAccount/mutations:provision"),
@@ -3890,7 +3875,7 @@ var ConvexSmartAccountAdapter = class {
 	#fns;
 	constructor(deps) {
 		this.#convex = deps.convex;
-		this.#fns = deps.functions ?? DEFAULT_FUNCTIONS$1;
+		this.#fns = deps.functions ?? DEFAULT_FUNCTIONS$3;
 	}
 	loadByAuthUserId(authUserId) {
 		return this.#convex.query(this.#fns.loadByAuthUserId, { authUserId }).pipe(Effect.mapError((error) => smartAccountErrorFromCapxul("loadByAuthUserId", error.publicError, error)), Effect.flatMap((row) => brandSmartAccountEffect("loadByAuthUserId", row)), Effect.catchAllDefect((cause) => Effect.fail(smartAccountErrorFromUnknown("loadByAuthUserId", cause))));
@@ -3965,6 +3950,456 @@ function smartAccountErrorFromUnknown(operation, cause) {
 toAddress("0xa6b71e26c5e0845f74c812102ca7114b6a896ab2");
 keccak256("0x");
 //#endregion
+//#region src/ports/org.ts
+var OrgError = class extends Data.TaggedError("OrgError") {};
+function orgErrorFromCapxul(operation, error, cause = error) {
+	return new OrgError({
+		operation,
+		publicCode: error.code,
+		publicError: error,
+		cause,
+		...error.details === void 0 ? {} : { details: error.details }
+	});
+}
+Context.Tag("@capxul/sdk/ports/OrgPort")();
+Context.Tag("@capxul/sdk/ports/OrgRolesDeploymentPort")();
+Context.Tag("@capxul/sdk/ports/OrgSpendPort")();
+//#endregion
+//#region src/adapters/org/parse.ts
+/**
+* Map a `WireOrg` + its (separately read) treasury `Account` into the branded
+* `OrgView`. The viewer role is projected by the authenticated backend read;
+* it must never be inferred from Organization ownership. Brands at the read
+* edge: `orgId`, `safeAddress`.
+*/
+function brandOrgView(wire, treasury, viewerRole) {
+	return {
+		id: toOrgId(wire.orgId),
+		name: wire.name,
+		handle: wire.slug,
+		safeAddress: toAddress(wire.safeAddress.toLowerCase()),
+		role: viewerRole,
+		treasury
+	};
+}
+/**
+* Build the Org treasury `Account` from the raw on-chain `balanceOf` integer
+* (the D3 RPC read). `available === balance` for a treasury with no envelope
+* partition yet (a fresh Org reads back $0).
+*/
+function brandOrgTreasury(input) {
+	return {
+		id: toAccountId(`account_${orgIdBody(input.orgId)}`),
+		balance: input.money,
+		available: input.money
+	};
+}
+function brandOrgRole(wire) {
+	return {
+		orgId: toOrgId(wire.orgId),
+		label: wire.label,
+		roleKey: toRoleKey(wire.roleKey),
+		definition: parseRoleDefinition(wire.definitionJson)
+	};
+}
+function brandOrgMember(wire) {
+	return {
+		orgId: toOrgId(wire.orgId),
+		email: toEmail(wire.email),
+		name: wire.name,
+		personalSafeAddress: wire.personalSafeAddress === null ? null : toAddress(wire.personalSafeAddress),
+		role: wire.role,
+		roleKey: wire.roleKey === null ? null : toRoleKey(wire.roleKey),
+		status: wire.status,
+		grantTxHash: wire.grantTxHash,
+		revokeTxHash: wire.revokeTxHash
+	};
+}
+function parseRoleDefinition(json) {
+	let raw;
+	try {
+		const parsed = JSON.parse(json);
+		if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) throw new Error("expected object");
+		raw = parsed;
+	} catch (err) {
+		throw new Error(`Invalid role definition: malformed JSON - ${err instanceof Error ? err.message : String(err)}`, { cause: err });
+	}
+	if (typeof raw.label !== "string" || raw.label.trim().length === 0) throw new Error("Invalid role definition: missing label");
+	return {
+		label: raw.label,
+		...raw.spend === void 0 ? {} : { spend: {
+			...raw.spend.perTx === void 0 ? {} : { perTx: parseRoleMoney(raw.spend.perTx, "perTx") },
+			...raw.spend.perDay === void 0 ? {} : { perDay: parseRoleMoney(raw.spend.perDay, "perDay") },
+			...raw.spend.toRecipients === void 0 ? {} : { toRecipients: parseRoleRecipients(raw.spend.toRecipients) }
+		} },
+		...raw.subAccounts === void 0 ? {} : { subAccounts: parseRoleSubAccounts(raw.subAccounts) },
+		...typeof raw.canManageMembers === "boolean" ? { canManageMembers: raw.canManageMembers } : {},
+		...typeof raw.canManageRoles === "boolean" ? { canManageRoles: raw.canManageRoles } : {}
+	};
+}
+function parseRoleMoney(raw, field) {
+	if (typeof raw.currency !== "string" || typeof raw.value !== "string" || !/^\d+$/.test(raw.value) || raw.decimals !== 6) throw new Error(`Invalid role money: ${field}`);
+	return {
+		currency: toCurrencyCode(raw.currency),
+		value: raw.value,
+		decimals: raw.decimals
+	};
+}
+function parseRoleRecipients(raw) {
+	if (raw === "anyone") return "anyone";
+	if (!Array.isArray(raw)) throw new Error("Invalid role definition: toRecipients must be \"anyone\" or an array");
+	return raw.map((recipient) => {
+		if (typeof recipient !== "string") throw new Error("Invalid role definition: toRecipients must be \"anyone\" or an array");
+		return toAddress(recipient);
+	});
+}
+function parseRoleSubAccounts(raw) {
+	if (raw.scope === "all") return { scope: "all" };
+	if (!Array.isArray(raw.scope)) throw new Error("Invalid role definition: subAccounts.scope must be \"all\" or an array");
+	return { scope: raw.scope.map((subAccountId) => {
+		if (typeof subAccountId !== "string") throw new Error("Invalid role definition: subAccounts.scope must be \"all\" or an array");
+		return toSubAccountId(subAccountId);
+	}) };
+}
+/** Strip the `org_` prefix + non-alphanumerics so the body re-seeds `account_`. */
+function orgIdBody(orgId) {
+	const underscore = orgId.indexOf("_");
+	const cleaned = (underscore < 0 ? orgId : orgId.slice(underscore + 1)).replace(/[^0-9A-Za-z]/g, "");
+	return cleaned.length > 0 ? cleaned : "0";
+}
+//#endregion
+//#region src/adapters/org/ConvexOrganizationAdapter.ts
+const DEFAULT_FUNCTIONS$2 = {
+	listAll: makeFunctionReference("org/queries:listAll"),
+	listRoles: makeFunctionReference("org/queries:listRolesByOrgId"),
+	listMembers: makeFunctionReference("org/queries:listMembersByOrgId"),
+	readTreasury: makeFunctionReference("org/actions:readTreasury"),
+	inviteMember: makeFunctionReference("org/actions:inviteMember"),
+	resendInvite: makeFunctionReference("org/mutations:resendInviteToken"),
+	detectInvitations: makeFunctionReference("org/actions:detectAndAcceptPendingInvitations")
+};
+/**
+* Standard production Organization read adapter. It intentionally has no
+* deployer/RPC/test configuration: authenticated Convex actions own live chain
+* reads, while the lifecycle adapter owns the single sponsored bootstrap.
+*/
+var ConvexOrganizationAdapter = class {
+	#convex;
+	#fns;
+	constructor(input) {
+		this.#convex = input.convex;
+		this.#fns = input.functions ?? DEFAULT_FUNCTIONS$2;
+	}
+	createOrg(_input) {
+		return Effect.fail(orgErrorFromCapxul("createOrg", Errors.notImplemented("organizationSetup", "use onboarding.completeOrganization")));
+	}
+	listOrgs(_input) {
+		return this.#convex.query(this.#fns.listAll, {}).pipe(Effect.mapError((error) => orgErrorFromCapxul("listOrgs", error.publicError, error)), Effect.flatMap((wires) => Effect.forEach(wires, (wire) => this.#readTreasuryWire(wire.orgId).pipe(Effect.map((treasury) => {
+			const viewerRole = wire.viewerRole.trim();
+			if (viewerRole.length === 0) throw Errors.wrongState({
+				method: "listOrgs",
+				currentState: "viewerRoleMissing",
+				validStates: ["activeViewerRole"]
+			});
+			return brandOrgView(wire, treasury, viewerRole);
+		})))), Effect.catchAllDefect((cause) => Effect.fail(toOrgError("listOrgs", cause))));
+	}
+	readTreasury(input) {
+		return this.#readTreasuryWire(String(input.orgId)).pipe(Effect.catchAllDefect((cause) => Effect.fail(toOrgError("readTreasury", cause))));
+	}
+	listRoles(input) {
+		return this.#convex.query(this.#fns.listRoles, { orgId: input.orgId }).pipe(Effect.mapError((error) => orgErrorFromCapxul("listRoles", error.publicError, error)), Effect.flatMap((rows) => rows.length === 0 ? Effect.fail(partialOrgTruth("listRoles", "activeRoleMissing")) : Effect.succeed(rows.map(brandOrgRole))), Effect.catchAllDefect((cause) => Effect.fail(toOrgError("listRoles", cause))));
+	}
+	listMembers(input) {
+		return this.#convex.query(this.#fns.listMembers, { orgId: input.orgId }).pipe(Effect.mapError((error) => orgErrorFromCapxul("listMembers", error.publicError, error)), Effect.flatMap((rows) => rows.length === 0 ? Effect.fail(partialOrgTruth("listMembers", "activeMemberMissing")) : Effect.succeed(rows.map(brandOrgMember))), Effect.catchAllDefect((cause) => Effect.fail(toOrgError("listMembers", cause))));
+	}
+	pendingMembers(input) {
+		return this.listMembers(input).pipe(Effect.map((members) => members.filter((member) => member.status === "pending" || member.status === "pending_safe" || member.status === "pending_grant")));
+	}
+	inviteMember(input) {
+		return this.#convex.action(this.#fns.inviteMember, {
+			orgId: input.orgId,
+			email: input.input.email,
+			role: input.input.role
+		}).pipe(Effect.mapError((error) => orgErrorFromCapxul("inviteMember", error.publicError, error)), Effect.map(brandOrgMember), Effect.catchAllDefect((cause) => Effect.fail(toOrgError("inviteMember", cause))));
+	}
+	resendInviteToken(input) {
+		return this.#convex.mutation(this.#fns.resendInvite, {
+			orgId: input.orgId,
+			email: input.email
+		}).pipe(Effect.mapError((error) => orgErrorFromCapxul("resendInviteToken", error.publicError, error)), Effect.map(brandOrgMember), Effect.catchAllDefect((cause) => Effect.fail(toOrgError("resendInviteToken", cause))));
+	}
+	detectAndAcceptPendingInvitations(_input) {
+		return this.#convex.action(this.#fns.detectInvitations, {}).pipe(Effect.mapError((error) => orgErrorFromCapxul("detectAndAcceptPendingInvitations", error.publicError, error)), Effect.map((result) => ({ matched: result.matched.map(toOrgId) })), Effect.catchAllDefect((cause) => Effect.fail(toOrgError("detectAndAcceptPendingInvitations", cause))));
+	}
+	#readTreasuryWire(orgId) {
+		return this.#convex.action(this.#fns.readTreasury, { orgId }).pipe(Effect.mapError((error) => orgErrorFromCapxul("readTreasury", error.publicError, error)), Effect.map((wire) => {
+			if (wire.orgId !== orgId) throw Errors.invalidInput("orgId", "Organization treasury scope does not match");
+			const balance = fromWei(wire.rawBalance, wire.decimals, wire.currency);
+			const available = fromWei(wire.rawAvailableBalance, wire.decimals, wire.currency);
+			return {
+				...brandOrgTreasury({
+					orgId: wire.orgId,
+					money: balance
+				}),
+				available
+			};
+		}));
+	}
+};
+function toOrgError(operation, cause) {
+	if (cause instanceof CapxulError) return orgErrorFromCapxul(operation, cause);
+	return orgErrorFromCapxul(operation, Errors.providerError("convex", operation, cause), cause);
+}
+function partialOrgTruth(operation, currentState) {
+	return orgErrorFromCapxul(operation, Errors.wrongState({
+		method: operation,
+		currentState,
+		validStates: ["completeProductionOrganizationTruth"]
+	}));
+}
+//#endregion
+//#region src/adapters/org/ConvexOrganizationSetupAdapter.ts
+const DEFAULT_FUNCTIONS$1 = {
+	startOrResume: makeFunctionReference("org/lifecycle:startOrResume"),
+	prepareFounderAccount: makeFunctionReference("org/actions:prepareFounderAccount"),
+	prepareBootstrap: makeFunctionReference("org/actions:prepareBootstrap"),
+	submitBootstrap: makeFunctionReference("org/actions:submitBootstrap"),
+	resumeBootstrapSubmission: makeFunctionReference("org/actions:resumeBootstrapSubmission"),
+	confirmBootstrap: makeFunctionReference("org/actions:confirmBootstrap"),
+	recordFailure: makeFunctionReference("org/lifecycle:recordFailure"),
+	load: makeFunctionReference("org/lifecycle:load"),
+	retry: makeFunctionReference("org/lifecycle:retry")
+};
+/** Durable Organization setup capability composed by the standard client. */
+var ConvexOrganizationSetupAdapter = class {
+	#convex;
+	#signer;
+	#fns;
+	constructor(input) {
+		this.#convex = input.convex;
+		this.#signer = input.signer;
+		this.#fns = input.functions ?? DEFAULT_FUNCTIONS$1;
+	}
+	async startOrResume(input) {
+		const result = await runCall("startOrResume", this.#convex.mutation(this.#fns.startOrResume, input));
+		if (!result.ok) return result;
+		const lifecycle = parseLifecycle("startOrResume", result.value.lifecycle);
+		if (!lifecycle.ok) return lifecycle;
+		const orgId = parseOrgId("startOrResume", result.value.orgId);
+		if (!orgId.ok) return orgId;
+		if (String(orgId.value) !== String(lifecycle.value.orgId)) return fail$2(Errors.invalidInput("orgId", "Organization lifecycle scope does not match"));
+		return {
+			ok: true,
+			value: {
+				orgId: orgId.value,
+				lifecycle: lifecycle.value
+			}
+		};
+	}
+	prepareFounderAccount(input) {
+		return this.#lifecycleAction("prepareFounderAccount", input, () => this.#convex.action(this.#fns.prepareFounderAccount, { orgId: input.orgId }));
+	}
+	async authorizeAndSubmitBootstrap(input) {
+		const cancelled = cancellation(input.signal);
+		if (cancelled !== void 0) return cancelled;
+		const signerAddress = await signerResult("getAddress", () => this.#signer.getAddress());
+		if (!signerAddress.ok) return signerAddress;
+		const prepared = await runCall("prepareBootstrap", this.#convex.action(this.#fns.prepareBootstrap, {
+			orgId: input.orgId,
+			signerAddress: signerAddress.value
+		}));
+		if (!prepared.ok) return prepared;
+		const authority = validatePreparedAuthorities(prepared.value, signerAddress.value);
+		if (!authority.ok) return authority;
+		const cancelledAfterPrepare = cancellation(input.signal);
+		if (cancelledAfterPrepare !== void 0) return cancelledAfterPrepare;
+		const signature = await signerResult("signUserOpHash", () => this.#signer.signUserOpHash(prepared.value.digest));
+		if (!signature.ok) return signature;
+		const cancelledAfterSign = cancellation(input.signal);
+		if (cancelledAfterSign !== void 0) return cancelledAfterSign;
+		const submitted = await runCall("submitBootstrap", this.#convex.action(this.#fns.submitBootstrap, {
+			orgId: input.orgId,
+			signerAddress: signerAddress.value,
+			signature: signature.value,
+			userOp: prepared.value.userOp
+		}));
+		if (!submitted.ok) return submitted;
+		return parseLifecycle("submitBootstrap", submitted.value);
+	}
+	resumeSubmittedBootstrap(input) {
+		return this.#lifecycleAction("resumeBootstrapSubmission", input, () => this.#convex.action(this.#fns.resumeBootstrapSubmission, { orgId: input.orgId }));
+	}
+	confirmSubmittedBootstrap(input) {
+		return this.#lifecycleAction("confirmBootstrap", input, () => this.#convex.action(this.#fns.confirmBootstrap, { orgId: input.orgId }));
+	}
+	async recordFailure(input) {
+		const errorProvider = input.error.details?.provider;
+		const errorOperation = input.error.details?.operation;
+		const result = await runCall("recordFailure", this.#convex.mutation(this.#fns.recordFailure, {
+			orgId: input.orgId,
+			errorCode: input.error.code,
+			...typeof errorProvider === "string" && typeof errorOperation === "string" ? {
+				errorProvider,
+				errorOperation
+			} : {},
+			retryable: input.retryable
+		}));
+		return result.ok ? parseLifecycle("recordFailure", result.value) : result;
+	}
+	async loadLifecycle(input) {
+		const result = await runCall("loadLifecycle", this.#convex.query(this.#fns.load, input));
+		if (!result.ok) return result;
+		if (result.value === null) return fail$2(Errors.invalidInput("orgId", "Organization lifecycle was not found"));
+		return parseLifecycle("loadLifecycle", result.value);
+	}
+	async retry(input) {
+		const cancelled = cancellation(input.signal);
+		if (cancelled !== void 0) return cancelled;
+		const current = await this.loadLifecycle({ orgId: input.orgId });
+		if (!current.ok) return current;
+		if (current.value.status === "failed" && current.value.retryable && (current.value.at === "awaitingFounderAuthorization" || current.value.at === "submittingBootstrap")) {
+			const reset = resetSignerSession(this.#signer);
+			if (!reset.ok) return reset;
+		}
+		const result = await runCall("retry", this.#convex.mutation(this.#fns.retry, { orgId: input.orgId }));
+		if (!result.ok) return result;
+		return parseLifecycle("retry", result.value);
+	}
+	async #lifecycleAction(operation, input, call) {
+		const cancelled = cancellation(input.signal);
+		if (cancelled !== void 0) return cancelled;
+		const result = await runCall(operation, call());
+		if (!result.ok) return result;
+		const cancelledAfter = cancellation(input.signal);
+		if (cancelledAfter !== void 0) return cancelledAfter;
+		return parseLifecycle(operation, result.value);
+	}
+};
+function resetSignerSession(signer) {
+	const resetSession = signer.resetSession;
+	if (typeof resetSession !== "function") return {
+		ok: true,
+		value: void 0
+	};
+	try {
+		resetSession.call(signer);
+		return {
+			ok: true,
+			value: void 0
+		};
+	} catch (cause) {
+		return fail$2(cause instanceof CapxulError ? cause : Errors.providerError("openfort", "resetSession", cause, { failure_mode: "unknown" }));
+	}
+}
+async function runCall(operation, effect) {
+	try {
+		const result = await Effect.runPromise(Effect.either(effect));
+		return Either.isRight(result) ? {
+			ok: true,
+			value: result.right
+		} : fail$2(publicError(operation, result.left));
+	} catch (cause) {
+		return fail$2(publicError(operation, cause));
+	}
+}
+function publicError(operation, cause) {
+	if (cause instanceof CapxulError) return cause;
+	if (typeof cause === "object" && cause !== null) {
+		const carried = cause.publicError;
+		if (carried instanceof CapxulError) return carried;
+	}
+	return Errors.providerError("convex-organization", operation, cause);
+}
+async function signerResult(operation, run) {
+	try {
+		return {
+			ok: true,
+			value: await run()
+		};
+	} catch (cause) {
+		return fail$2(cause instanceof CapxulError ? cause : Errors.providerError("organization-signer", operation, cause));
+	}
+}
+function validatePreparedAuthorities(prepared, signerAddress) {
+	const signer = signerAddress.toLowerCase();
+	const preparedSigner = prepared.signerAddress.toLowerCase();
+	const founder = prepared.founderPersonalAccount.toLowerCase();
+	const organization = prepared.organizationAccountAddress.toLowerCase();
+	const sender = prepared.userOp.sender.toLowerCase();
+	if (preparedSigner !== signer) return fail$2(Errors.invalidInput("signerAddress", "Prepared signer does not match configured signer"));
+	if (founder === signer || organization === signer || organization === founder) return fail$2(Errors.invalidInput("organizationAuthority", "Signer EOA, founder Account, and Organization Account must be distinct"));
+	if (sender !== founder) return fail$2(Errors.invalidInput("userOp.sender", "Bootstrap sender must be the founder Account"));
+	if (!/^0x[0-9a-fA-F]{64}$/u.test(prepared.digest)) return fail$2(Errors.invalidInput("digest", "Prepared bootstrap digest must be 32-byte hex"));
+	return {
+		ok: true,
+		value: void 0
+	};
+}
+function parseLifecycle(operation, wire) {
+	const orgId = parseOrgId(operation, wire.orgId);
+	if (!orgId.ok) return orgId;
+	if (wire.status === "loading") return {
+		ok: true,
+		value: {
+			status: "loading",
+			orgId: orgId.value
+		}
+	};
+	if (wire.status === "ready") return {
+		ok: true,
+		value: {
+			status: "ready",
+			orgId: orgId.value,
+			canTransact: true
+		}
+	};
+	if (wire.status === "failed") {
+		if (!isSetupStep(wire.at)) return fail$2(Errors.invalidInput("lifecycle.at", "Unknown setup step"));
+		return {
+			ok: true,
+			value: {
+				status: "failed",
+				orgId: orgId.value,
+				at: wire.at,
+				error: new CapxulError(wire.error.code, wire.error.message),
+				retryable: wire.retryable
+			}
+		};
+	}
+	if (!isSetupStep(wire.step)) return fail$2(Errors.invalidInput("lifecycle.step", `Unknown setup step from ${operation}`));
+	return {
+		ok: true,
+		value: {
+			status: "settingUp",
+			orgId: orgId.value,
+			step: wire.step
+		}
+	};
+}
+function parseOrgId(operation, value) {
+	try {
+		return {
+			ok: true,
+			value: toOrgId(value)
+		};
+	} catch (cause) {
+		return fail$2(Errors.providerError("convex-organization", operation, cause));
+	}
+}
+function isSetupStep(value) {
+	return value === "preparingFounderAccount" || value === "awaitingFounderAuthorization" || value === "submittingBootstrap" || value === "confirmingBootstrap";
+}
+function cancellation(signal) {
+	return signal?.aborted ? fail$2(Errors.cancelled({ operation: "organization.setup" })) : void 0;
+}
+function fail$2(error) {
+	return {
+		ok: false,
+		error
+	};
+}
+//#endregion
 //#region ../observability/src/index.ts
 const PII = Schema.String.pipe(Schema.brand("PII"));
 const OptionalString = Schema.optional(Schema.String);
@@ -4805,6 +5240,9 @@ function transportErrorFromThrown(operation, request, cause) {
 }
 //#endregion
 //#region src/openfort/create-openfort-browser-signer.ts
+function openfortProviderError(operation, cause) {
+	return cause instanceof CapxulError ? cause : Errors.providerError("openfort", operation, cause, { failure_mode: "unknown" });
+}
 /**
 * True when the browser cannot perform Web Crypto — sandboxed iframes, headless
 * agent browsers, or non-HTTPS origins. OpenFort's embedded-wallet `configure`
@@ -4873,21 +5311,39 @@ function createOpenfortBrowserSignerFromBootstrap(bootstrap, options = {}) {
 		return `${authBaseUrl}/encryption-session`;
 	}
 	async function fetchBetterAuthAccessToken() {
-		const response = await fetch(betterAuthSessionUrl(), { credentials: "include" });
-		if (!response.ok) {
+		try {
+			const response = await fetch(betterAuthSessionUrl(), { credentials: "include" });
+			if (!response.ok) {
+				diagnostic?.trace("openfort.token", {
+					ok: false,
+					tokenPresent: false,
+					httpStatus: response.status,
+					failure_mode: "unknown"
+				});
+				return null;
+			}
+			const token = (await response.json()).session?.token?.trim();
+			if (token === void 0 || token.length === 0) {
+				diagnostic?.trace("openfort.token", {
+					ok: false,
+					tokenPresent: false,
+					failure_mode: "unknown"
+				});
+				return null;
+			}
+			diagnostic?.trace("openfort.token", {
+				ok: true,
+				tokenPresent: true
+			});
+			return token;
+		} catch (cause) {
 			diagnostic?.trace("openfort.token", {
+				ok: false,
 				tokenPresent: false,
-				httpStatus: response.status
+				failure_mode: "unknown"
 			});
-			return null;
+			throw openfortProviderError("token", cause);
 		}
-		const token = (await response.json()).session?.token?.trim();
-		if (token === void 0 || token.length === 0) {
-			diagnostic?.trace("openfort.token", { tokenPresent: false });
-			return null;
-		}
-		diagnostic?.trace("openfort.token", { tokenPresent: true });
-		return token;
 	}
 	const openfort = new Openfort({
 		baseConfiguration: { publishableKey: bootstrap.openfortPublishableKey },
@@ -4903,25 +5359,60 @@ function createOpenfortBrowserSignerFromBootstrap(bootstrap, options = {}) {
 			if (isInsecureBrowserContext()) failNoSecureContext();
 			await openfort.waitForInitialization();
 			const accessToken = await fetchBetterAuthAccessToken();
-			if (accessToken === null) throw Errors.notAuthenticated();
-			const encryptionResponse = await fetch(encryptionSessionUrl(), {
-				method: "POST",
-				credentials: "include",
-				headers: {
-					Authorization: `Bearer ${accessToken}`,
-					"Content-Type": "application/json"
-				},
-				body: JSON.stringify({})
-			});
-			diagnostic?.trace("openfort.encryptionSession", { httpStatus: encryptionResponse.status });
+			if (accessToken === null) throw openfortProviderError("token", /* @__PURE__ */ new Error("Better Auth access token unavailable for Openfort"));
+			let encryptionResponse;
+			try {
+				encryptionResponse = await fetch(encryptionSessionUrl(), {
+					method: "POST",
+					credentials: "include",
+					headers: {
+						Authorization: `Bearer ${accessToken}`,
+						"Content-Type": "application/json"
+					},
+					body: JSON.stringify({})
+				});
+			} catch (cause) {
+				diagnostic?.trace("openfort.encryptionSession", {
+					ok: false,
+					failure_mode: "unknown"
+				});
+				throw openfortProviderError("encryptionSession", cause);
+			}
 			if (!encryptionResponse.ok) {
-				const detail = await encryptionResponse.text();
-				throw Errors.providerError("openfort", "encryptionSession", /* @__PURE__ */ new Error(`Openfort encryption session failed (${encryptionResponse.status}): ${detail.slice(0, 200)}`));
+				diagnostic?.trace("openfort.encryptionSession", {
+					ok: false,
+					httpStatus: encryptionResponse.status,
+					failure_mode: "unknown"
+				});
+				throw Errors.providerError("openfort", "encryptionSession", /* @__PURE__ */ new Error(`Openfort encryption session failed (${encryptionResponse.status})`), { failure_mode: "unknown" });
+			}
+			let encryptionBody;
+			try {
+				encryptionBody = await encryptionResponse.json();
+				if (typeof encryptionBody.sessionId !== "string" || encryptionBody.sessionId.length === 0) throw new Error("Openfort encryption session response missing sessionId");
+			} catch (cause) {
+				diagnostic?.trace("openfort.encryptionSession", {
+					ok: false,
+					httpStatus: encryptionResponse.status,
+					failure_mode: "unknown"
+				});
+				throw openfortProviderError("encryptionSession", cause);
+			}
+			diagnostic?.trace("openfort.encryptionSession", {
+				ok: true,
+				httpStatus: encryptionResponse.status
+			});
+			let embeddedState;
+			try {
+				embeddedState = await openfort.embeddedWallet.getEmbeddedState();
+				diagnostic?.trace("openfort.embeddedState", { state: embeddedState });
+			} catch (cause) {
+				diagnostic?.trace("openfort.embeddedState", {
+					ok: false,
+					failure_mode: "unknown"
+				});
+				throw openfortProviderError("embeddedState", cause);
 			}
-			const encryptionBody = await encryptionResponse.json();
-			if (typeof encryptionBody.sessionId !== "string" || encryptionBody.sessionId.length === 0) throw Errors.providerError("openfort", "encryptionSession", /* @__PURE__ */ new Error("Openfort encryption session response missing sessionId"));
-			const embeddedState = await openfort.embeddedWallet.getEmbeddedState();
-			diagnostic?.trace("openfort.embeddedState", { state: embeddedState });
 			if (embeddedState !== EmbeddedState.READY) {
 				clearStaleOpenfortBrowserStorage(bootstrap.openfortPublishableKey);
 				diagnostic?.trace("openfort.storageCleared", { beforeConfigure: true });
@@ -4938,9 +5429,9 @@ function createOpenfortBrowserSignerFromBootstrap(bootstrap, options = {}) {
 				} catch (cause) {
 					diagnostic?.trace("openfort.configure", {
 						ok: false,
-						message: cause instanceof Error ? cause.message : String(cause)
+						failure_mode: "unknown"
 					});
-					throw cause;
+					throw openfortProviderError("configure", cause);
 				}
 			}
 			try {
@@ -4949,9 +5440,9 @@ function createOpenfortBrowserSignerFromBootstrap(bootstrap, options = {}) {
 			} catch (cause) {
 				diagnostic?.trace("openfort.get", {
 					ok: false,
-					message: cause instanceof Error ? cause.message : String(cause)
+					failure_mode: "unknown"
 				});
-				throw cause;
+				throw openfortProviderError("get", cause);
 			}
 		})();
 	}
@@ -4970,6 +5461,19 @@ function createOpenfortBrowserSignerFromBootstrap(bootstrap, options = {}) {
 	});
 	return {
 		...signer,
+		getAddress: async () => {
+			try {
+				const address = await signer.getAddress();
+				diagnostic?.trace("openfort.address", { ok: true });
+				return address;
+			} catch (cause) {
+				diagnostic?.trace("openfort.address", {
+					ok: false,
+					failure_mode: "unknown"
+				});
+				throw openfortProviderError("getAddress", cause);
+			}
+		},
 		resetSession: () => {
 			walletReadyPromise = null;
 			clearStaleOpenfortBrowserStorage(bootstrap.openfortPublishableKey);
@@ -7451,6 +7955,80 @@ function listOrgsProgram() {
 	});
 }
 //#endregion
+//#region src/client/org-lifecycle.ts
+function fail$1(error) {
+	return {
+		ok: false,
+		error
+	};
+}
+function validateOrganizationLifecycleScope(orgId, lifecycle) {
+	if (String(lifecycle.orgId) !== String(orgId)) return fail$1(Errors.invalidInput("orgId", "Organization lifecycle scope does not match"));
+	return {
+		ok: true,
+		value: lifecycle
+	};
+}
+/** Advance only the steps still required by one durable Organization lane. */
+async function advanceOrganizationSetup(setup, orgId, initial, signal) {
+	const scopedInitial = validateOrganizationLifecycleScope(orgId, initial);
+	if (!scopedInitial.ok) return scopedInitial;
+	let lifecycle = scopedInitial.value;
+	for (let transition = 0; transition < 3; transition += 1) {
+		if (lifecycle.status !== "settingUp") return {
+			ok: true,
+			value: lifecycle
+		};
+		const currentStep = lifecycle.step;
+		if (signal?.aborted) return recordSetupFailure(setup, orgId, Errors.cancelled({ operation: "organization.setup" }), true);
+		const stepInput = {
+			orgId,
+			...signal === void 0 ? {} : { signal }
+		};
+		const next = lifecycle.step === "preparingFounderAccount" ? await setup.prepareFounderAccount(stepInput) : lifecycle.step === "awaitingFounderAuthorization" ? await setup.authorizeAndSubmitBootstrap(stepInput) : lifecycle.step === "submittingBootstrap" ? await setup.resumeSubmittedBootstrap(stepInput) : await setup.confirmSubmittedBootstrap(stepInput);
+		if (!next.ok) {
+			if (next.error.code === "CANCELLED") return recordSetupFailure(setup, orgId, next.error, true);
+			if (next.error.code === "PROVIDER_ERROR") return recordSetupFailure(setup, orgId, next.error, isRetryableProviderFailure(next.error));
+			return next;
+		}
+		const scopedNext = validateOrganizationLifecycleScope(orgId, next.value);
+		if (!scopedNext.ok) return scopedNext;
+		lifecycle = scopedNext.value;
+		if (currentStep === "confirmingBootstrap") return {
+			ok: true,
+			value: lifecycle
+		};
+	}
+	if (lifecycle.status !== "settingUp" || lifecycle.step === "confirmingBootstrap") return {
+		ok: true,
+		value: lifecycle
+	};
+	return fail$1(Errors.wrongState({
+		method: "organization.setup",
+		currentState: lifecycle.step,
+		validStates: [
+			"confirmingBootstrap",
+			"ready",
+			"failed"
+		]
+	}));
+}
+async function recordSetupFailure(setup, orgId, error, retryable) {
+	const recorded = await setup.recordFailure({
+		orgId,
+		error,
+		retryable
+	});
+	if (!recorded.ok) return recorded;
+	const scopedRecorded = validateOrganizationLifecycleScope(orgId, recorded.value);
+	if (!scopedRecorded.ok) return scopedRecorded;
+	return fail$1(error);
+}
+function isRetryableProviderFailure(error) {
+	const mode = error.details?.failure_mode;
+	return mode !== "auth-origin-mismatch" && mode !== "app-env-allowlist" && mode !== "no-secure-context";
+}
+//#endregion
 //#region src/client/org.ts
 /**
 * Org method surface (canon §C2/§C3, D13). S1 (#274) wires `createOrg` /
@@ -7499,6 +8077,36 @@ function makeOrgMethods(deps) {
 					},
 					...convexCall === void 0 ? {} : { convexCall }
 				}),
+				async getLifecycle(options) {
+					if (options?.signal?.aborted) return {
+						ok: false,
+						error: Errors.cancelled({ operation: "org.getLifecycle" })
+					};
+					if (deps.organizationSetup === void 0) return {
+						ok: false,
+						error: Errors.notImplemented("organizationSetup", "getLifecycle")
+					};
+					const loaded = await deps.organizationSetup.loadLifecycle({ orgId });
+					if (!loaded.ok) return loaded;
+					return validateOrganizationLifecycleScope(orgId, loaded.value);
+				},
+				async retrySetup(options) {
+					if (options?.signal?.aborted) return {
+						ok: false,
+						error: Errors.cancelled({ operation: "org.retrySetup" })
+					};
+					const setup = deps.organizationSetup;
+					if (setup === void 0) return {
+						ok: false,
+						error: Errors.notImplemented("organizationSetup", "retrySetup")
+					};
+					const retried = await setup.retry({
+						orgId,
+						...options?.signal === void 0 ? {} : { signal: options.signal }
+					});
+					if (!retried.ok) return retried;
+					return advanceOrganizationSetup(setup, orgId, retried.value, options?.signal);
+				},
 				profile: {
 					get(_options) {
 						if (_options?.signal?.aborted) return Promise.resolve({
@@ -7532,12 +8140,12 @@ function makeOrgMethods(deps) {
 						ok: false,
 						error: treasury.error
 					};
-					const orgs = await toCapxulResult(listOrgsProgram(), layer);
-					if (!orgs.ok) return {
+					const orgList = await toCapxulResult(listOrgsProgram(), layer);
+					if (!orgList.ok) return {
 						ok: false,
-						error: orgs.error
+						error: orgList.error
 					};
-					const org = orgs.value.find((candidate) => candidate.id === orgId);
+					const org = orgList.value.find((candidate) => candidate.id === orgId);
 					return {
 						ok: true,
 						value: {
@@ -7725,7 +8333,6 @@ function normalizePaymentTiming(payment) {
 }
 //#endregion
 //#region src/flows/onboarding.ts
-const DEFAULT_ORG_TEMPLATE = "Startup";
 async function runCompletePersonalOnboarding(ops, input) {
 	const validated = validatePersonalInput(input);
 	if (!validated.ok) return validated;
@@ -7749,11 +8356,13 @@ async function runCompletePersonalOnboarding(ops, input) {
 		value: { lifecycle: lifecycle.value }
 	};
 }
-async function runCompleteOrganizationOnboarding(ops, input) {
+async function runCompleteOrganizationOnboarding(ops, input, options) {
 	const validated = validateOrganizationInput(input);
 	if (!validated.ok) return validated;
 	const session = await ops.currentSession();
 	if (session === null) return fail(Errors.notAuthenticated());
+	const setup = ops.organizationSetup;
+	if (setup === void 0) return fail(Errors.notImplemented("organizationSetup", "completeOrganization"));
 	const written = await ops.completeIdentityOnboarding({
 		authUserId: session.authUserId,
 		email: session.email,
@@ -7761,22 +8370,29 @@ async function runCompleteOrganizationOnboarding(ops, input) {
 		country: validated.value.country
 	});
 	if (!written.ok) return fail(written.error);
-	const provisioned = await ops.triggerProvisioning();
-	if (!provisioned.ok) return fail(provisioned.error);
-	const org = await ops.createOrg({
+	const started = await setup.startOrResume({
 		name: validated.value.organizationName,
 		handle: validated.value.handle,
-		template: DEFAULT_ORG_TEMPLATE,
 		country: validated.value.country
 	});
-	if (!org.ok) return fail(org.error);
-	ops.kickProvisioning();
-	const lifecycle = await ops.readLifecycle();
-	if (!lifecycle.ok) return fail(lifecycle.error);
+	if (!started.ok) return fail(started.error);
+	const lifecycle = await advanceOrganizationSetup(setup, started.value.orgId, started.value.lifecycle, options?.signal);
+	if (!lifecycle.ok) {
+		const error = lifecycle.error;
+		return fail(new CapxulError(error.code, error.message, {
+			cause: error.cause,
+			details: {
+				...error.details,
+				orgId: started.value.orgId
+			},
+			...error.correlationId === void 0 ? {} : { correlationId: error.correlationId },
+			...error.layer === void 0 ? {} : { layer: error.layer }
+		}));
+	}
 	return {
 		ok: true,
 		value: {
-			org: org.value,
+			orgId: started.value.orgId,
 			lifecycle: lifecycle.value
 		}
 	};
@@ -7867,8 +8483,7 @@ function fail(error) {
 * Onboarding method surface. The thin namespace over the `flows/onboarding.ts`
 * choreography: it adds the `signal`-abort pre-check and delegates to the run
 * functions. The `OnboardingOps` seam is supplied by `assembleCapxulClient`
-* (real ops over the account lane + createOrg + IdentityPort) or by tests
-* (in-memory double).
+* (real identity/Account ops plus Organization setup capability) or by tests.
 */
 function makeOnboardingMethods(ops) {
 	return {
@@ -7884,7 +8499,7 @@ function makeOnboardingMethods(ops) {
 				ok: false,
 				error: Errors.cancelled({ operation: "onboarding.completeOrganization" })
 			});
-			return runCompleteOrganizationOnboarding(ops, input);
+			return runCompleteOrganizationOnboarding(ops, input, options);
 		}
 	};
 }
@@ -7897,6 +8512,7 @@ function detectAuthCacheAdapter() {
 }
 //#endregion
 //#region src/client/create-capxul-client.ts
+const GET_ORGANIZATION_SETUP_PROOF_RECEIPT = makeFunctionReference("org/lifecycle:getProofReceipt");
 function assembleCapxulClient(input) {
 	const authCache = input.authCache ?? detectAuthCacheAdapter();
 	const layer = Layer.mergeAll(Layer.succeed(AuthClientPortTag, input.ports.authClient), Layer.succeed(ClockPortTag, input.ports.clock), Layer.succeed(TelemetryPortTag, input.ports.telemetry));
@@ -7963,7 +8579,8 @@ function assembleCapxulClient(input) {
 		...selectedOrgPort === void 0 ? {} : { orgPort: selectedOrgPort },
 		...input.orgRolesDeploymentPort === void 0 ? {} : { orgRolesDeploymentPort: input.orgRolesDeploymentPort },
 		...input.orgSpendPort === void 0 ? {} : { orgSpendPort: input.orgSpendPort },
-		convexCall: input.ports.convexCall
+		convexCall: input.ports.convexCall,
+		...input.organizationSetup === void 0 ? {} : { organizationSetup: input.organizationSetup }
 	});
 	if (selectedOrgPort !== void 0) detectPendingOrgInvitations = async () => {
 		await orgMethods.orgs.detectAndAcceptPendingInvitations();
@@ -7986,7 +8603,7 @@ function assembleCapxulClient(input) {
 		triggerProvisioning: () => account._internal.provision(),
 		kickProvisioning: () => kickProvisioning?.(),
 		readLifecycle: () => account.getLifecycle(),
-		createOrg: (createOrgInput) => orgMethods.createOrg(createOrgInput)
+		...input.organizationSetup === void 0 ? {} : { organizationSetup: input.organizationSetup }
 	});
 	return {
 		auth,
@@ -8019,6 +8636,7 @@ function assembleCapxulClient(input) {
 			},
 			bootstrap: input.bootstrap,
 			accounts: { fund: accounts.fund },
+			organizationSetup: { getProofReceipt: (orgId) => runPortEffect(input.ports.convexCall.query(GET_ORGANIZATION_SETUP_PROOF_RECEIPT, { orgId })) },
 			telemetry: input.ports.telemetry
 		}
 	};
@@ -8028,19 +8646,6 @@ function assembleCapxulClient(input) {
 const SDK_VERSION$1 = version;
 /** Stable PostHog event used for typed failures that are expected product outcomes. */
 const CAPXUL_SDK_EXPECTED_OUTCOME_EVENT = "capxul_sdk_expected_outcome";
-const EXPECTED_OPERATION_OUTCOMES = new Set([
-	"INVALID_INPUT",
-	"NOT_AUTHENTICATED",
-	"CANCELLED",
-	"SIGNER_REJECTED",
-	"VERIFICATION_REQUIRED",
-	"INSUFFICIENT_BALANCE",
-	"INVALID_RECIPIENT",
-	"ROLE_PERMISSION_DENIED",
-	"RATE_LIMITED",
-	"OTP_EXPIRED",
-	"WRONG_STATE"
-]);
 /**
 * Adapt the host's already-initialized PostHog-like client. This function does
 * not import, initialize, configure, or own PostHog.
@@ -8077,7 +8682,7 @@ function fromPostHog(client, options = {}) {
 	return {
 		resolveContext: () => {
 			if (!isEnabled(options.enabled) || client === null || client === void 0) return void 0;
-			return resolveContext(options.context) ?? {};
+			return resolveRawContext(options.context) ?? {};
 		},
 		captureOperationFailure,
 		captureException
@@ -8091,6 +8696,34 @@ function deliver(capture) {
 		ignoreDeliveryFailure(capture());
 	} catch {}
 }
+/**
+* Fan one SDK failure out to several adapters (issue #877). The SDK's own
+* first-party relay and an optional host-provided adapter both observe the same
+* failure. Order matters for `resolveContext`: the FIRST adapter that returns a
+* context wins, so pass the host adapter first to keep its call-start snapshot.
+* Each capture is isolated — a throwing adapter never blocks its peers or the
+* SDK. Returns `undefined` when no adapters are present (zero observation work).
+*/
+function composeObservationAdapters(...adapters) {
+	const present = adapters.filter((adapter) => adapter !== void 0);
+	if (present.length === 0) return void 0;
+	if (present.length === 1) return present[0];
+	const fanOut = (select) => {
+		for (const adapter of present) try {
+			ignoreDeliveryFailure(select(adapter));
+		} catch {}
+	};
+	return {
+		resolveContext: () => {
+			for (const adapter of present) try {
+				const context = adapter.resolveContext?.();
+				if (context !== void 0) return context;
+			} catch {}
+		},
+		captureOperationFailure: (failure) => fanOut((adapter) => adapter.captureOperationFailure(failure)),
+		captureException: (failure) => fanOut((adapter) => adapter.captureException(failure))
+	};
+}
 /** @internal Decorates public client method bundles at the owning SDK boundary. */
 function observeSdkClient(client, adapter) {
 	if (adapter === void 0) return client;
@@ -8194,7 +8827,7 @@ function report(adapter, kind, operation, cause, invocationContext) {
 }
 function resolveAdapterContext(adapter) {
 	try {
-		return sanitizeObservationContext(adapter.resolveContext?.());
+		return adapter.resolveContext?.();
 	} catch {
 		return;
 	}
@@ -8225,8 +8858,12 @@ function postHogProperties(failure, context) {
 	return properties;
 }
 function resolveContext(context) {
+	return sanitizeObservationContext(resolveRawContext(context));
+}
+/** Resolve the host context closure without sanitizing — the call-start snapshot. */
+function resolveRawContext(context) {
 	try {
-		return sanitizeObservationContext(typeof context === "function" ? context() : context);
+		return typeof context === "function" ? context() : context;
 	} catch {
 		return;
 	}
@@ -8288,6 +8925,43 @@ function isCapxulResult(value) {
 function isFailedResult(value) {
 	return isCapxulResult(value) && value.ok === false && "error" in value;
 }
+//#endregion
+//#region src/observation-relay.ts
+/**
+* Build the SDK-owned first-party relay adapter. Both capture entry points send
+* the same redacted envelope fire-and-forget; delivery is fully isolated from
+* the SDK's `CapxulResult` and can never throw into the caller.
+*/
+function createCapxulFirstPartyRelay(options) {
+	const fetchImpl = options.fetch ?? resolveGlobalFetch();
+	const send = (failure) => {
+		if (fetchImpl === void 0) return;
+		try {
+			const headers = { "content-type": "application/json" };
+			const encodedContext = encodeObservationContextHeader(failure.context);
+			if (encodedContext !== void 0) headers[OBSERVATION_CONTEXT_HEADER] = encodedContext;
+			const body = JSON.stringify({
+				operation: failure.operation,
+				error_kind: failure.errorKind,
+				sdk_version: failure.sdkVersion
+			});
+			Promise.resolve(fetchImpl(options.ingestUrl, {
+				method: "POST",
+				headers,
+				body,
+				keepalive: true
+			})).catch(() => void 0);
+		} catch {}
+	};
+	return {
+		captureOperationFailure: send,
+		captureException: send
+	};
+}
+function resolveGlobalFetch() {
+	const candidate = globalThis.fetch;
+	return typeof candidate === "function" ? candidate : void 0;
+}
 const SDK_VERSION = version;
 const collectProductionFlowPorts = Effect.gen(function* () {
 	const authClient = yield* AuthClientPortTag;
@@ -8575,7 +9249,7 @@ async function createCapxulClient$1(input) {
 			...input.authBaseUrl === void 0 ? {} : { override: input.authBaseUrl }
 		});
 		let signer = input.signer;
-		if (signer === void 0 && (input.requirement ?? "none") === "deployed" && runtime === "browser") signer = createOpenfortBrowserSignerFromBootstrap({
+		if (signer === void 0 && runtime === "browser") signer = createOpenfortBrowserSignerFromBootstrap({
 			...adapters.value.bootstrap,
 			authBaseUrl: resolvedAuthBaseUrl
 		});
@@ -8585,23 +9259,33 @@ async function createCapxulClient$1(input) {
 			authCache: adapters.value.ports.authCache,
 			requirement: input.requirement ?? "none",
 			...signer === void 0 ? {} : { signer },
+			orgPort: new ConvexOrganizationAdapter({ convex: adapters.value.ports.convexCall }),
+			...signer === void 0 ? {} : { organizationSetup: new ConvexOrganizationSetupAdapter({
+				convex: adapters.value.ports.convexCall,
+				signer
+			}) },
 			...input.signal === void 0 ? {} : { signal: input.signal },
 			...input.otpTtlMs === void 0 ? {} : { otpTtlMs: input.otpTtlMs },
 			invokeTimeoutMs: input.invokeTimeoutMs ?? 3e4
 		}), signer);
 		const upstreamClose = adapters.value.close;
+		const value = {
+			...client,
+			_internal: {
+				...client._internal,
+				close: async () => {
+					if ("resetSession" in (signer ?? {})) signer.resetSession();
+					await upstreamClose();
+				}
+			}
+		};
+		const relay = runtime === "browser" ? createCapxulFirstPartyRelay({
+			ingestUrl: deriveObserveIngestUrl(adapters.value.bootstrap),
+			...input.fetch === void 0 ? {} : { fetch: input.fetch }
+		}) : void 0;
 		return {
 			ok: true,
-			value: observeSdkClient({
-				...client,
-				_internal: {
-					...client._internal,
-					close: async () => {
-						if ("resetSession" in (signer ?? {})) signer.resetSession();
-						await upstreamClose();
-					}
-				}
-			}, input.observation)
+			value: observeSdkClient(value, composeObservationAdapters(input.observation, relay))
 		};
 	} catch (cause) {
 		await adapters.value.close().catch(() => void 0);
@@ -8643,6 +9327,38 @@ function resolveInput(input) {
 		};
 	}
 }
+/**
+* Address of the Capxul client-relay ingest endpoint (Pipe 1, issue #877). The
+* HTTP router that serves `/v1/client/observe` lives on the deployment's
+* `.convex.site` host, while the bootstrap-resolved `convexUrl` is the sibling
+* `.convex.cloud` (WebSocket/query) host — the same deterministic pairing
+* `mintQuickstartKey` inverts. For any standard Convex deployment (including
+* production) rewriting the suffix targets the router directly with no host
+* proxy, so it is the primary rule.
+*
+* `siteBaseUrl` is deliberately NOT the primary source: it is an app-configured
+* field that defaults to a placeholder (`https://capxul.local`, see
+* `credentials/applications.ts`) for registered applications, so trusting it
+* outright would POST to a dead host for the common case. It is only consulted
+* as a fallback for a custom-domain `convexUrl` (no deterministic `.convex.site`
+* sibling) when it carries a real, non-placeholder origin.
+*/
+function deriveObserveIngestUrl(bootstrap) {
+	const convexUrl = bootstrap.convexUrl.replace(/\/+$/, "");
+	if (convexUrl.endsWith(".convex.cloud")) return `${convexUrl.replace(/\.convex\.cloud$/, ".convex.site")}/v1/client/observe`;
+	return `${(usableSiteOrigin(bootstrap.siteBaseUrl) ?? convexUrl).replace(/\/+$/, "")}/v1/client/observe`;
+}
+/** A configured `siteBaseUrl` usable as a router host, or `undefined` if it is the placeholder. */
+function usableSiteOrigin(siteBaseUrl) {
+	try {
+		const url = new URL(siteBaseUrl);
+		if (url.protocol !== "http:" && url.protocol !== "https:") return void 0;
+		if (url.hostname === "capxul.local") return void 0;
+		return url.origin;
+	} catch {
+		return;
+	}
+}
 function detectRuntime() {
 	const globalAny = globalThis;
 	return globalAny.window !== void 0 || globalAny.document !== void 0 ? "browser" : "node";