@capxul/sdk 2.2.0 → 2.3.1

package/dist/{InMemoryAuthCacheAdapter-PycLJWeW.mjs → InMemoryAuthCacheAdapter-qMpBOGb3.mjs}

@@ -290,6 +290,9 @@ function toPartyId(raw) {
 	if (typeof raw !== "string" || !PARTY_ID_RE.test(raw)) throw Errors.invalidInput("partyId", invalidValueReason("must be party_ plus an alphanumeric id", raw));
 	return raw;
 }
+function toBudgetId(raw) {
+	return toNonEmptyStringBrand(raw, "budgetId");
+}
 function toOrgId(raw) {
 	return toNonEmptyStringBrand(raw, "orgId");
 }
@@ -485,4 +488,4 @@ Layer.effect(AuthCachePortTag, Effect.sync(() => new InMemoryAuthCacheAdapter())
 	cause
 }))));
 //#endregion
-export { toPublishableKey as A, toEmail as C, toKycTier as D, toJwtToken as E, CapxulError as F, EXPECTED_OPERATION_OUTCOMES as I, Errors as L, toSessionToken as M, decodeConvexError as N, toOrgId as O, CAPXUL_ERROR_CODES as P, isCapxulError as R, toDurationMs as S, toEpochSeconds as T, toAppId as _, AuthCacheError as a, toCountryCode as b, BYTES32_RE as c, WEI_RE as d, ZERO_BYTES32 as f, toAllowedOrigin as g, toAddress as h, parseCachedJwt as i, toRoleKey as j, toPartyId as k, EVM_ADDRESS_RE as l, toAccountId as m, BrowserAuthCacheAdapter as n, AuthCachePortTag as o, currencySymbolFor as p, parseAuthSession as r, APP_ID_RE as s, InMemoryAuthCacheAdapter as t, SUPPORTED_CURRENCY_CODES as u, toAuthUserId as v, toEpochMs as w, toCurrencyCode as x, toChainId as y };
+export { toPartyId as A, toDurationMs as C, toJwtToken as D, toEpochSeconds as E, CAPXUL_ERROR_CODES as F, CapxulError as I, EXPECTED_OPERATION_OUTCOMES as L, toRoleKey as M, toSessionToken as N, toKycTier as O, decodeConvexError as P, Errors as R, toCurrencyCode as S, toEpochMs as T, toAppId as _, AuthCacheError as a, toChainId as b, BYTES32_RE as c, WEI_RE as d, ZERO_BYTES32 as f, toAllowedOrigin as g, toAddress as h, parseCachedJwt as i, toPublishableKey as j, toOrgId as k, EVM_ADDRESS_RE as l, toAccountId as m, BrowserAuthCacheAdapter as n, AuthCachePortTag as o, currencySymbolFor as p, parseAuthSession as r, APP_ID_RE as s, InMemoryAuthCacheAdapter as t, SUPPORTED_CURRENCY_CODES as u, toAuthUserId as v, toEmail as w, toCountryCode as x, toBudgetId as y, isCapxulError as z };

package/dist/{create-capxul-client-B8qMV-_e.mjs → create-capxul-client-DTQDSOvO.mjs}

@@ -1,4 +1,4 @@
-import { C as toEmail, F as CapxulError, I as EXPECTED_OPERATION_OUTCOMES, L as Errors, O as toOrgId, R as isCapxulError, b as toCountryCode, c as BYTES32_RE, d as WEI_RE, f as ZERO_BYTES32, h as toAddress, j as toRoleKey, k as toPartyId, l as EVM_ADDRESS_RE$1, m as toAccountId, n as BrowserAuthCacheAdapter, s as APP_ID_RE, t as InMemoryAuthCacheAdapter, u as SUPPORTED_CURRENCY_CODES, v as toAuthUserId, x as toCurrencyCode, y as toChainId } from "./InMemoryAuthCacheAdapter-PycLJWeW.mjs";
+import { A as toPartyId, I as CapxulError, L as EXPECTED_OPERATION_OUTCOMES, M as toRoleKey, R as Errors, S as toCurrencyCode, b as toChainId, c as BYTES32_RE, d as WEI_RE, f as ZERO_BYTES32, h as toAddress, k as toOrgId, l as EVM_ADDRESS_RE$1, m as toAccountId, n as BrowserAuthCacheAdapter, s as APP_ID_RE, t as InMemoryAuthCacheAdapter, u as SUPPORTED_CURRENCY_CODES, v as toAuthUserId, w as toEmail, x as toCountryCode, y as toBudgetId, z as isCapxulError } from "./InMemoryAuthCacheAdapter-qMpBOGb3.mjs";
 import { concat, encodeAbiParameters, encodeFunctionData, encodePacked, formatUnits, getContractAddress, keccak256, padHex, parseUnits, recoverAddress, stringToHex, toBytes, toEventSelector, toFunctionSelector, toFunctionSignature } from "viem";
 import { Context, Data, Deferred, Effect, Exit, Fiber, Layer, Queue, Ref, Result, Schema, SchemaGetter, Scope } from "effect";
 import { makeFunctionReference } from "convex/server";
@@ -14,6 +14,8 @@ const isRetryable = (failure) => {
 	return failure.code === "NETWORK_ERROR" || failure.code === "UNKNOWN";
 };
 const SIGNED_OUT = { phase: "signed_out" };
+/** Where every client starts. `SessionRestored` / `SessionAbsent` settle it. */
+const RESTORING = { phase: "restoring" };
 const label = (state) => {
 	if (state.phase !== "authenticated") return state.phase;
 	if (state.account.at !== "claimed") return `authenticated:${state.account.at}`;
@@ -28,6 +30,8 @@ const EVENT_TAGS = [
 	"RestoreSession",
 	"ResumeOtpEntry",
 	"Reset",
+	"SessionRestored",
+	"SessionAbsent",
 	"EnsureAccount",
 	"ClaimAccount",
 	"RetryAccount",
@@ -62,6 +66,13 @@ const SESSION_EVENTS = [
 	"Reset"
 ];
 const TRANSITION_TABLE = {
+	restoring: [
+		"SessionRestored",
+		"SessionAbsent",
+		"ReadSession",
+		"RequestOtp",
+		"Reset"
+	],
 	signed_out: [
 		"RequestOtp",
 		"ReadSession",
@@ -253,6 +264,8 @@ const transition = (state, event, config = DEFAULT_CONFIG) => {
 				requestedAt: state.resume.requestedAt
 			} };
 		case "Reset": return { next: SIGNED_OUT };
+		case "SessionRestored": return { next: authenticated(event.session, event.profileComplete, { at: "unknown" }) };
+		case "SessionAbsent": return { next: SIGNED_OUT };
 		case "EnsureAccount":
 			if (config.requirement === "none") return WRONG;
 			return state.phase === "authenticated" ? { next: withAccount(state, {
@@ -320,6 +333,7 @@ const isPrivate = (event) => PRIVATE_TAGS.has(event._tag);
 * there is no org list in the state, only the ONE active lane.
 */
 const destination = (state) => {
+	if (state.phase === "restoring") return null;
 	if (state.phase !== "authenticated") return { to: "home" };
 	if (!state.profileComplete) return { to: "selectUserType" };
 	if (state.account.at === "unknown") return null;
@@ -339,6 +353,33 @@ const destination = (state) => {
 		orgId: org.at === "creating" ? null : org.orgId
 	};
 };
+/**
+* True while the machine has not settled enough to route or to gate on.
+*
+* NEGATIVE classification, deliberately: the SETTLED positions are the ones
+* enumerated, and everything else waits. A phase or readiness variant added
+* later therefore defaults to holding, never to redirecting a member who is in
+* fact signed in. Terminal for the account lane is `claimed | failed`.
+*
+* The org lane's own settledness (`ready | failed`) is the route gate's
+* question, not this one: every org lane sits under a CLAIMED account, and
+* `destination()` already names a real screen for each of its positions.
+*/
+const isRestoring = (state) => {
+	switch (state.phase) {
+		case "signed_out":
+		case "otp_sending":
+		case "otp_pending":
+		case "otp_verifying":
+		case "signing_out":
+		case "faulted": return false;
+		case "authenticated": return state.account.at !== "claimed" && state.account.at !== "failed";
+		default: return true;
+	}
+};
+/** The claimed-account gate as one function. The inlined consumers move onto
+* it in #1521; this ticket ships the selector they move onto. */
+const isClaimed = (state) => state.phase === "authenticated" && state.account.at === "claimed";
 //#endregion
 //#region ../config/src/tokens.ts
 /** `TestUSDC` ("USDX") — Base Sepolia, 6 decimals, open `mint`. (Canon §1.) */
@@ -1209,48 +1250,7 @@ const USDX_BASE_SEPOLIA_TOKEN = {
 };
 USDX_BASE_SEPOLIA_TOKEN.chainId;
 USDX_BASE_SEPOLIA_TOKEN.chainId;
-//#endregion
-//#region ../config/src/role-dsl.ts
-const USD_DECIMALS = 6;
-const USD_SCALE = 10n ** BigInt(USD_DECIMALS);
-const USD_DISPLAY_RE = /^\d+(?:\.\d{1,6})?$/;
-const USD_BASE_UNIT_RE = /^\d+$/;
-const EXEC_TRANSACTION_WITH_ROLE = "zodiac.roles.execTransactionWithRole";
-const ASSIGN_ROLES = "zodiac.roles.assignRoles";
-const SCOPE_TARGET = "zodiac.roles.scopeTarget";
-const OWNER_ROLE_LABEL = "Owner";
-const FOUNDER_BUDGET_ROLE_LABEL = "Founder Budget";
-const FOUNDER_BUDGET_LIMIT = {
-	currency: "USD",
-	value: "1000000000000",
-	decimals: 6
-};
-function usd(value) {
-	return {
-		currency: "USD",
-		value: usdDisplayToBaseUnits(value),
-		decimals: USD_DECIMALS
-	};
-}
-function usdDisplayToBaseUnits(value) {
-	if (value.trim() !== value || !USD_DISPLAY_RE.test(value)) throw Errors.invalidInput("role.spend", "USD caps must be unsigned decimal strings with at most 6 fractional digits");
-	const parts = value.split(".");
-	const whole = parts[0] ?? "0";
-	const fraction = parts[1] ?? "";
-	return (BigInt(whole) * USD_SCALE + BigInt(fraction.padEnd(USD_DECIMALS, "0"))).toString();
-}
-function normalizeOrgRoleMoney(money, field) {
-	if (money.currency !== "USD" || money.decimals !== USD_DECIMALS || !USD_BASE_UNIT_RE.test(money.value)) throw Errors.invalidInput(field, `must be USD base units with ${USD_DECIMALS} decimals`);
-	return money;
-}
-function normalizeOrgRoleSpendCap(spend) {
-	if (spend === void 0) return void 0;
-	return {
-		...spend.perTx === void 0 ? {} : { perTx: normalizeOrgRoleMoney(spend.perTx, "roles.spend.perTx") },
-		...spend.perDay === void 0 ? {} : { perDay: normalizeOrgRoleMoney(spend.perDay, "roles.spend.perDay") },
-		...spend.toRecipients === void 0 ? {} : { toRecipients: spend.toRecipients }
-	};
-}
+10n ** BigInt(6);
 function normalizeOrgRoleLabel(label) {
 	const normalized = label.trim().replace(/\s+/g, " ");
 	if (normalized.length === 0) throw Errors.invalidInput("role.label", "must be a non-empty role label");
@@ -1259,84 +1259,6 @@ function normalizeOrgRoleLabel(label) {
 function orgRoleKeyForLabel(label) {
 	return keccak256(toBytes(normalizeOrgRoleLabel(label).toLowerCase()));
 }
-function soloOrgRoleTemplate() {
-	return [{
-		label: "Owner",
-		canManageMembers: true,
-		canManageRoles: true
-	}, {
-		label: FOUNDER_BUDGET_ROLE_LABEL,
-		spend: {
-			perTx: FOUNDER_BUDGET_LIMIT,
-			perDay: FOUNDER_BUDGET_LIMIT,
-			toRecipients: "anyone"
-		}
-	}];
-}
-function startupOrgRoleTemplate() {
-	return [
-		...soloOrgRoleTemplate(),
-		{
-			label: "Finance Manager",
-			spend: {
-				perTx: usd("25000"),
-				perDay: usd("100000"),
-				toRecipients: "anyone"
-			}
-		},
-		{
-			label: "Team Lead",
-			spend: {
-				perTx: usd("5000"),
-				perDay: usd("15000"),
-				toRecipients: "anyone"
-			}
-		}
-	];
-}
-function orgRoleTemplateDefinitions(template, customRoles = []) {
-	switch (template) {
-		case "Solo": return soloOrgRoleTemplate();
-		case "Startup": return startupOrgRoleTemplate();
-		case "Custom": return customRoles.length === 0 ? soloOrgRoleTemplate() : customRoles;
-		default: return template;
-	}
-}
-function compileOrgRoleDefinitions(definitions) {
-	if (definitions.length === 0) throw Errors.invalidInput("roles", "must include at least one role");
-	const seen = /* @__PURE__ */ new Set();
-	const roles = definitions.map((definition) => {
-		const label = normalizeOrgRoleLabel(definition.label);
-		const roleKey = orgRoleKeyForLabel(label);
-		if (seen.has(roleKey)) throw Errors.invalidInput("roles", `duplicate role label: ${label}`);
-		seen.add(roleKey);
-		const spend = normalizeOrgRoleSpendCap(definition.spend);
-		const permissions = [];
-		if (spend !== void 0 || label === OWNER_ROLE_LABEL) permissions.push(EXEC_TRANSACTION_WITH_ROLE);
-		if (definition.canManageMembers === true) permissions.push(ASSIGN_ROLES);
-		if (definition.canManageRoles === true) permissions.push(SCOPE_TARGET);
-		return {
-			label,
-			roleKey,
-			definition: {
-				...definition,
-				label,
-				...spend === void 0 ? {} : { spend }
-			},
-			permissions,
-			allowance: spend ?? null
-		};
-	});
-	const manager = roles.find((role) => role.definition.canManageMembers === true);
-	if (manager === void 0) throw Errors.invalidInput("roles.canManageMembers", "at least one role must compile to the on-chain member-management permission");
-	return {
-		roles,
-		memberManagementRole: {
-			roleKey: manager.roleKey,
-			permission: ASSIGN_ROLES
-		}
-	};
-}
 padHex(stringToHex("FM_DAILY"), {
 	size: 32,
 	dir: "right"
@@ -1440,21 +1362,39 @@ function resolveFailureMode(error, contextFailureMode) {
 const EVM_ADDRESS_HEX = /^0x[0-9a-fA-F]{40}$/;
 const ECDSA_SIGNATURE_HEX = /^0x[0-9a-fA-F]{130}$/;
 const SAFE_OP_DIGEST_HEX = /^0x[0-9a-fA-F]{64}$/;
-/** Fold a signer throw into the public error contract. */
-function signerFailure(source, operation, cause) {
+/**
+* The readiness store a signer reports when it runs no readiness cycle. It
+* fails CLOSED: a node key signer or an injected wallet never claims `ready`,
+* so a gate that reads this never opens on a guess.
+*/
+const UNOBSERVABLE_SIGNER_STATUS = {
+	status: () => "unknown",
+	subscribe: () => () => void 0
+};
+/**
+* Walk an error and its `cause` links once each. A self-referential chain
+* terminates. Both signer predicates read the chain, so they read it here.
+*/
+function* causeChain(cause) {
 	const seen = /* @__PURE__ */ new Set();
-	let failureMode;
 	let current = cause;
 	while (typeof current === "object" && current !== null && !seen.has(current)) {
 		seen.add(current);
-		if (current instanceof CapxulError && current.code === "SIGNER_REJECTED") return current;
-		failureMode = getFailureMode(current) ?? failureMode;
-		const error = current;
+		yield current;
+		current = current.cause;
+	}
+}
+/** Fold a signer throw into the public error contract. */
+function signerFailure(source, operation, cause) {
+	let failureMode;
+	for (const link of causeChain(cause)) {
+		if (link instanceof CapxulError && link.code === "SIGNER_REJECTED") return link;
+		failureMode = getFailureMode(link) ?? failureMode;
+		const error = link;
 		if (error.code === 4001 || error.error === "passkey_user_cancelled") return Errors.signerRejected({
 			source,
 			cause
 		});
-		current = error.cause;
 	}
 	return Errors.providerError("signer", operation, cause, failureMode === void 0 ? void 0 : { failure_mode: failureMode });
 }
@@ -2410,7 +2350,8 @@ const CAPXUL_FUNCTIONS = {
 		listMembersByOrgId: "org/queries:listMembersByOrgId",
 		listMine: "org/queries:listMine",
 		listRolesByOrgId: "org/queries:listRolesByOrgId",
-		loadByOrgId: "org/queries:loadByOrgId"
+		loadByOrgId: "org/queries:loadByOrgId",
+		me: "org/queries:me"
 	},
 	"smartAccount/actions": {
 		claim: "smartAccount/actions:claim",
@@ -4708,11 +4649,14 @@ async function executePersonalPayment(deps, payment, signal, requestKey) {
 function isAborted$1(signal) {
 	return signal?.aborted === true;
 }
+function canonicalJson(value) {
+	const canonical = JSON.stringify(value, (_key, item) => item !== null && typeof item === "object" && !Array.isArray(item) ? Object.fromEntries(Object.entries(item).sort(([left], [right]) => left.localeCompare(right))) : item);
+	if (canonical === void 0) throw new TypeError("Payment intent must be JSON data");
+	return canonical;
+}
 /** Return one stable fingerprint for one JSON payment intent. */
 async function fingerprintPaymentIntent(intent) {
-	const canonical = JSON.stringify(intent, (_key, value) => value !== null && typeof value === "object" && !Array.isArray(value) ? Object.fromEntries(Object.entries(value).sort(([left], [right]) => left.localeCompare(right))) : value);
-	if (canonical === void 0) throw new TypeError("Payment intent must be JSON data");
-	return keccak256(toBytes(canonical));
+	return keccak256(toBytes(canonicalJson(intent)));
 }
 async function executePrepared(deps, prepare, expectedRequest, signal) {
 	if (isAborted$1(signal)) return {
@@ -5574,7 +5518,7 @@ function mapOk(result, f) {
 }
 //#endregion
 //#region package.json
-var version = "2.2.0";
+var version = "2.3.1";
 //#endregion
 //#region src/ports/auth-client.ts
 var AuthClientError = class extends Data.TaggedError("AuthClientError") {};
@@ -6520,6 +6464,8 @@ const IDENTITY_SLOT = {
 const IDENTITY_SLOT_BY_EVENT = {
 	ReadSession: IDENTITY_SLOT.session,
 	RestoreSession: IDENTITY_SLOT.session,
+	SessionRestored: IDENTITY_SLOT.session,
+	SessionAbsent: IDENTITY_SLOT.session,
 	SessionRead: IDENTITY_SLOT.session,
 	SessionReadFailed: IDENTITY_SLOT.session,
 	RequestOtp: IDENTITY_SLOT.auth,
@@ -6831,7 +6777,7 @@ const identitySpec = (input, sessionStore = { current: null }) => {
 	};
 	return {
 		machine: "identity",
-		initial: SIGNED_OUT,
+		initial: RESTORING,
 		label,
 		slot: identitySlot,
 		transition: (state, event) => transition(state, event, config),
@@ -6967,7 +6913,7 @@ const bootIdentityFlow = (input, options = {}) => Effect.gen(function* () {
 			sessionStore.current = null;
 		}) : Effect.void)),
 		restoreAuthSession: (session, controls) => actor.ask({
-			_tag: "RestoreSession",
+			_tag: actor.snapshot().phase === "restoring" ? "SessionRestored" : "RestoreSession",
 			session: modelSession(session),
 			profileComplete: false
 		}, controls).pipe(Effect.tap(() => Effect.sync(() => {
@@ -7005,13 +6951,13 @@ const ask = (actor, event, controls, wrongState) => actor.ask(event, controls).p
 */
 const getSessionProgramWithOptions = (options) => Effect.gen(function* () {
 	const deps = yield* CapxulDepsTag;
-	const cached = yield* deps.authCache.getSession.pipe(Effect.mapError((e) => Errors.providerError("auth-cache", "getSession", e)));
+	const cached = yield* deps.authCache.getSession.pipe(Effect.mapError((e) => Errors.providerError("auth-cache", "getSession", e)), Effect.catch((failure) => deps.actor.snapshot().phase === "restoring" ? Effect.succeed(null) : Effect.fail(failure)));
 	const observed = deps.actor.snapshot();
 	const actorState = observed.phase;
 	if (observed.phase === "faulted") return yield* Effect.fail(publicIdentityFailure(observed.failure));
 	if (cached === null && (actorState === "otp_pending" || actorState === "otp_sending" || actorState === "otp_verifying")) return null;
-	if (cached !== null && actorState !== "signed_out") return cached;
-	if (cached !== null && actorState === "signed_out") {
+	if (cached !== null && !(actorState === "signed_out" || actorState === "restoring")) return cached;
+	if (cached !== null) {
 		yield* deps.actor.restoreAuthSession(cached, depsRequestOptions(deps, options)).pipe(Effect.mapError(actorError));
 		return cached;
 	}
@@ -7114,6 +7060,7 @@ const signInProgram = (input, options) => Effect.gen(function* () {
 	}, depsRequestOptions(deps, options), {
 		method: "signIn",
 		validStates: [
+			"restoring",
 			"signed_out",
 			"otp_pending",
 			"faulted"
@@ -7137,7 +7084,7 @@ const signInProgram = (input, options) => Effect.gen(function* () {
 const signOutProgramWithOptions = (options) => Effect.gen(function* () {
 	const deps = yield* CapxulDepsTag;
 	let phase = deps.actor.snapshot().phase;
-	if (phase === "signed_out") {
+	if (phase === "signed_out" || phase === "restoring") {
 		const cached = yield* deps.authCache.getSession.pipe(Effect.mapError((e) => Errors.providerError("auth-cache", "getSession", e)));
 		if (cached !== null) {
 			yield* deps.actor.restoreAuthSession(cached, depsRequestOptions(deps, options)).pipe(Effect.mapError(actorError));
@@ -7513,6 +7460,32 @@ function makeSystemMethods(deps) {
 	return { health: (nonce, options) => runIfActive(options?.signal, "system.health", () => deps.convexCall.query(healthQuery, { nonce })) };
 }
 //#endregion
+//#region src/contract/org.ts
+const orgReadContract = { me: makeFunctionReference(CAPXUL_FUNCTIONS["org/queries"].me) };
+//#endregion
+//#region src/surface/org-me.ts
+function toBudget(wire) {
+	return {
+		id: toBudgetId(wire.id),
+		label: wire.label,
+		limit: wire.limitRaw === null ? null : fromWei(wire.limitRaw, wire.decimals, wire.currency)
+	};
+}
+function toOrgMe(wire) {
+	return {
+		role: wire.role === null ? null : { label: wire.role.label },
+		capabilities: {
+			canManagePeople: wire.capabilities.canManagePeople,
+			canSpend: wire.capabilities.canSpend
+		},
+		budgets: wire.budgets.map(toBudget),
+		observedAt: wire.observedAt
+	};
+}
+function makeOrgMeMethod(deps, orgId) {
+	return (options) => runIfActive(options?.signal, "org.me", () => Effect.map(deps.convexCall.query(orgReadContract.me, { orgId }), toOrgMe));
+}
+//#endregion
 //#region src/contract/permission.ts
 const permissionContract = { read: makeFunctionReference(CAPXUL_FUNCTIONS["permission/queries"].read) };
 //#endregion
@@ -7551,7 +7524,7 @@ async function execute(deps, orgId, command, signal) {
 	} }));
 	if (!prepared.ok) return prepared;
 	const expectedSafe = deriveCapxulSafeAddress({ email: session.email });
-	if (prepared.value.chainId !== deps.chainId || prepared.value.signerAddress.toLowerCase() !== signerAddress.toLowerCase() || prepared.value.userOpSenderSafe.toLowerCase() !== expectedSafe.toLowerCase() || prepared.value.operation !== command.operation || prepared.value.orgId !== orgId || JSON.stringify(prepared.value.command) !== JSON.stringify(command)) return {
+	if (prepared.value.chainId !== deps.chainId || prepared.value.signerAddress.toLowerCase() !== signerAddress.toLowerCase() || prepared.value.userOpSenderSafe.toLowerCase() !== expectedSafe.toLowerCase() || prepared.value.operation !== command.operation || prepared.value.orgId !== orgId || canonicalJson(prepared.value.command) !== canonicalJson(command)) return {
 		ok: false,
 		error: Errors.invalidInput("permission", "prepared authority mismatch")
 	};
@@ -7870,38 +7843,6 @@ function hermeticOrgView(input) {
 		logoUrl: null
 	};
 }
-function moneyFromConfig(input) {
-	return {
-		currency: toCurrencyCode(input.currency),
-		value: input.value,
-		decimals: input.decimals
-	};
-}
-function recipientsFromConfig(toRecipients) {
-	if (toRecipients === void 0 || toRecipients === "anyone") return toRecipients;
-	return toRecipients.map((recipient) => toAddress(recipient));
-}
-function roleDefinitionFromConfig(definition) {
-	const toRecipients = recipientsFromConfig(definition.spend?.toRecipients);
-	return {
-		label: definition.label,
-		...definition.spend === void 0 ? {} : { spend: {
-			...definition.spend.perTx === void 0 ? {} : { perTx: moneyFromConfig(definition.spend.perTx) },
-			...definition.spend.perDay === void 0 ? {} : { perDay: moneyFromConfig(definition.spend.perDay) },
-			...toRecipients === void 0 ? {} : { toRecipients }
-		} },
-		...definition.canManageMembers === void 0 ? {} : { canManageMembers: definition.canManageMembers },
-		...definition.canManageRoles === void 0 ? {} : { canManageRoles: definition.canManageRoles }
-	};
-}
-function startupRoleViews(orgId) {
-	return compileOrgRoleDefinitions(orgRoleTemplateDefinitions("Startup")).roles.map((role) => ({
-		orgId,
-		label: role.label,
-		roleKey: toRoleKey(role.roleKey),
-		definition: roleDefinitionFromConfig(role.definition)
-	}));
-}
 function hermeticMember(input) {
 	return {
 		orgId: input.orgId,
@@ -8003,7 +7944,7 @@ function listRolesProgram(orgId) {
 	return Effect.gen(function* () {
 		const deps = yield* OrgDepsTag;
 		if (deps.orgPort !== void 0) return yield* deps.orgPort.listRoles({ orgId }).pipe(Effect.mapError((error) => error.publicError));
-		return startupRoleViews(orgId);
+		return [];
 	});
 }
 function listMembersProgram(orgId) {
@@ -8168,6 +8109,7 @@ function makeOrgMethods(deps) {
 					},
 					...convexCall === void 0 ? {} : { convexCall }
 				}),
+				me: convexCall === void 0 ? orgMeUnavailable : makeOrgMeMethod({ convexCall }, String(orgId)),
 				async getLifecycle(options) {
 					if (options?.signal?.aborted) return {
 						ok: false,
@@ -8315,6 +8257,10 @@ function makeNotImplementedOrganizationPaymentsMethods() {
 		payBatch: organizationPaymentExecutionUnavailable
 	};
 }
+const orgMeUnavailable = () => Promise.resolve({
+	ok: false,
+	error: Errors.notImplemented("org", "me")
+});
 const permissionExecutionUnavailable = () => Promise.resolve({
 	ok: false,
 	error: Errors.notImplemented("permissions", "executionComposition")
@@ -8855,6 +8801,8 @@ const APPLIED_ACTION_BY_EVENT = {
 	RestoreSession: "none",
 	ResumeOtpEntry: "none",
 	Reset: "none",
+	SessionRestored: "none",
+	SessionAbsent: "none",
 	EnsureAccount: "none",
 	ClaimAccount: "none",
 	RetryAccount: "none",
@@ -9134,6 +9082,7 @@ function assembleCapxulClient(input) {
 		createOrg: orgMethods.createOrg,
 		orgs: orgMethods.orgs,
 		org: orgMethods.org,
+		signer: input.signer?.statusStore ?? UNOBSERVABLE_SIGNER_STATUS,
 		_internal: {
 			identity: identityRuntime,
 			bootstrap: input.bootstrap,
@@ -9159,4 +9108,4 @@ function withHostObservation(actor, snapshot) {
 	};
 }
 //#endregion
-export { fingerprintPaymentIntent as A, formatTraceparent as B, ClockPortTag as C, AuthClientError as D, authClientPortFromPromiseAdapter as E, sanitizeObservationContext as F, CAPXUL_PAYMENTS_V2_ADDRESS as G, readInvocationObservation as H, CAPXUL_FUNCTIONS as I, deriveCapxulSafeAddress as J, normalizeBindingEmail as K, BootstrapEnvelope as L, fromWei as M, OBSERVATION_CONTEXT_HEADER as N, AuthClientPortTag as O, encodeObservationContextHeader as P, EngineeringTelemetryBootstrapPolicy as R, ClockError as S, bootstrapErrorFromCapxul as T, injectedWalletSigner as U, copyInvocationObservation as V, signerFailure as W, destination as Y, wireChainId as _, observeFailedResult as a, ConvexCallPortTag as b, captureExceptionSync as c, TelemetryPortTag as d, redactTelemetryEvent as f, accountReadErrorFromCapxul as g, AccountReadPortTag as h, observationContextProps as i, toWei as j, version as k, detectAuthCacheAdapter as l, smartAccountErrorFromCapxul as m, postHogProductTelemetry as n, postHogFailureObservation as o, SmartAccountPortTag as p, BASE_SEPOLIA_CHAIN_ID as q, CAPXUL_SDK_EXPECTED_OUTCOME_EVENT as r, captureException as s, assembleCapxulClient as t, PostHogTelemetryLayer as u, IdentityPortTag as v, BootstrapPortTag as w, convexCallErrorFromCapxul as x, identityErrorFromCapxul as y, isSettingUpLifecycle as z };
+export { fingerprintPaymentIntent as A, formatTraceparent as B, ClockPortTag as C, AuthClientError as D, authClientPortFromPromiseAdapter as E, sanitizeObservationContext as F, signerFailure as G, readInvocationObservation as H, CAPXUL_FUNCTIONS as I, BASE_SEPOLIA_CHAIN_ID as J, CAPXUL_PAYMENTS_V2_ADDRESS as K, BootstrapEnvelope as L, fromWei as M, OBSERVATION_CONTEXT_HEADER as N, AuthClientPortTag as O, encodeObservationContextHeader as P, isRestoring as Q, EngineeringTelemetryBootstrapPolicy as R, ClockError as S, bootstrapErrorFromCapxul as T, causeChain as U, copyInvocationObservation as V, injectedWalletSigner as W, destination as X, deriveCapxulSafeAddress as Y, isClaimed as Z, wireChainId as _, observeFailedResult as a, ConvexCallPortTag as b, captureExceptionSync as c, TelemetryPortTag as d, redactTelemetryEvent as f, accountReadErrorFromCapxul as g, AccountReadPortTag as h, observationContextProps as i, toWei as j, version as k, detectAuthCacheAdapter as l, smartAccountErrorFromCapxul as m, postHogProductTelemetry as n, postHogFailureObservation as o, SmartAccountPortTag as p, normalizeBindingEmail as q, CAPXUL_SDK_EXPECTED_OUTCOME_EVENT as r, captureException as s, assembleCapxulClient as t, PostHogTelemetryLayer as u, IdentityPortTag as v, BootstrapPortTag as w, convexCallErrorFromCapxul as x, identityErrorFromCapxul as y, isSettingUpLifecycle as z };

package/dist/index.d.mts

@@ -1,5 +1,5 @@
-import { $ as CapxulError, A as CountryCode, D as AuthUserId, E as AuthSession, G as RoleKey, I as Money, Q as CAPXUL_ERROR_CODES, R as OrgId, X as toAddress, Z as toCountryCode, a as AccountProvider, at as isCapxulError, b as AccountId, c as Eip1193Provider, d as CapxulResult, et as CapxulErrorCode, f as Profile, i as injectedWalletSigner, it as FailureMode, l as eip1193AccountProvider, m as SmartAccount, n as CapxulSigner, nt as Errors, o as AccountProviderSource, p as Session, r as Eip1193RequestProvider, s as AccountRequirement, t as CapxulDigestSigner, tt as CapxulErrorDetails, u as localPrivateKeyAccountProvider, x as Address, y as Account, z as PartyId } from "./signer-D4roBkcX.mjs";
-import { $ as ActorRequest, $t as TargetReference, A as OrganizationAccount, At as OfframpMethods, B as PermissionAssignInput, Bt as PaymentDocumentRender, C as InviteMemberInput, Cn as Readiness, Ct as DestinationRail, D as OrgScopedMethods, Dn as InvocationControls, Dt as HandlesMethods, E as OrgMethods, En as IdentityTransition, Et as FinancialOpsMethods, F as RoleView, Ft as PayeesMethods, G as PermissionReplaceInput, Gt as PaymentTiming, H as PermissionCreateInput, Ht as PaymentDocumentsMethods, I as OrganizationPaymentBatchInput, It as Payment, J as AccountsMethods, Jt as PaymentsPayInput, K as PermissionRevokeInput, Kt as PaymentType, L as OrganizationPaymentInput, Lt as PaymentDirection, M as ResendInviteTokenInput, Mt as OfframpQuoteInput, N as RoleDefinition, Nt as OfframpStatus, O as OrgTemplate, Ot as MeMethods, P as RoleSpendCap, Pt as Payee, Q as ActorRelationshipMethods, Qt as ResolvedTarget, R as OrganizationPaymentItemInput, Rt as PaymentDocumentKind, S as DetectPendingOrgInvitationsResult, Sn as OrgLane, St as DestinationPayload, T as MemberView, Tn as destination, Tt as DestinationsMethods, U as PermissionMethods, Ut as PaymentMoney, V as PermissionChangeInput, Vt as PaymentDocumentVerification, W as PermissionOptions, Wt as PaymentStatus, X as ActorProfile, Xt as RecipientResolutionKind, Y as AccountMethods, Yt as RecipientResolution, Z as ActorProfileMethods, Zt as Ref, _ as SystemHealth, _n as TelemetryPort, _t as DepositInstructions, a as SdkFailureObservation, an as IdentityMethods, at as AddressBookMethods, b as CurrentUserMethods, bn as IdentityEvent, bt as DestinationKind, c as PostHogObservabilityOptions, cn as OrgLifecycle, ct as InboxMethods, d as CreateCapxulClientInput, dn as MovementAnnotation, dt as ActivityItem, en as TargetsMethods, et as ActorRequestIssueInput, f as IdentityProfileDetails, fn as Permission, ft as ActivityListParams, g as SystemMethods, gt as ActorReference, h as HoldingsMethods, ht as ActivityReference, i as ObservationDelivery, in as isSettingUpLifecycle, it as AddressBookLabelInput, j as OrganizationAuditLogItem, jt as OfframpQuote, k as OrgView, kt as MeProfile, l as postHogObservability, ln as OrgSetupStep, lt as ActivityAnnotationInput, m as IdentityRuntimeSendResult, mt as ActivityPage, n as ObservationAdapter, nn as AccountLifecycle, nt as AddressBookAddInput, o as HostObservability, on as SmartAccountMethods, ot as InboxApproveInput, p as IdentityRuntime, pn as SubmittedPermissionExecution, pt as ActivityMethods, q as PermissionReadResult, qt as PaymentsMethods, r as ObservationContext, rn as AccountSetupStep, rt as AddressBookEntry, s as PostHogObservabilityClient, sn as AuthMethods, st as InboxItem, t as CAPXUL_SDK_EXPECTED_OUTCOME_EVENT, tn as fingerprintPaymentIntent, tt as ActorRequestsMethods, u as CapxulClient, un as CurrentHoldings, ut as ActivityDetail, v as MediaMethods, vn as CAPXUL_PAYMENTS_V2_ADDRESS, vt as Destination, w as MemberStatus, wn as StateLabel, wt as DestinationRemoveInput, x as CreateOrgInput, xn as IdentityState, xt as DestinationListInput, y as CurrentUserContext, yn as Destination$1, yt as DestinationAddInput, z as OrganizationPaymentsMethods, zt as PaymentDocumentRef } from "./observation-BwPo8qeo.mjs";
+import { $ as toAddress, C as Address, H as PartyId, J as RoleKey, N as CountryCode, O as AuthSession, S as AccountId, V as OrgId, a as SignerStatusStore, at as Errors, c as AccountProviderSource, ct as isCapxulError, d as eip1193AccountProvider, et as toCountryCode, f as localPrivateKeyAccountProvider, g as SmartAccount, h as Session, i as SignerStatus, it as CapxulErrorDetails, j as BudgetId, k as AuthUserId, l as AccountRequirement, m as Profile, n as CapxulSigner, nt as CapxulError, o as injectedWalletSigner, p as CapxulResult, r as Eip1193RequestProvider, rt as CapxulErrorCode, s as AccountProvider, st as FailureMode, t as CapxulDigestSigner, tt as CAPXUL_ERROR_CODES, u as Eip1193Provider, x as Account, z as Money } from "./signer-BejoR3bA.mjs";
+import { $ as AccountMethods, $t as RecipientResolution, A as OrganizationAccount, An as isClaimed, At as FinancialOpsMethods, B as PermissionAssignInput, Bt as Payment, C as InviteMemberInput, Cn as Destination$1, Ct as DestinationAddInput, D as OrgScopedMethods, Dn as Readiness, Dt as DestinationRail, E as OrgMethods, En as OrgLane, Et as DestinationPayload, F as RoleView, Ft as OfframpQuote, G as PermissionReplaceInput, Gt as PaymentDocumentVerification, H as PermissionCreateInput, Ht as PaymentDocumentKind, I as OrganizationPaymentBatchInput, It as OfframpQuoteInput, J as Budget, Jt as PaymentStatus, K as PermissionRevokeInput, Kt as PaymentDocumentsMethods, L as OrganizationPaymentInput, Lt as OfframpStatus, M as ResendInviteTokenInput, Mn as IdentityTransition, Mt as MeMethods, N as RoleDefinition, Nn as InvocationControls, Nt as MeProfile, O as OrgTemplate, On as StateLabel, Ot as DestinationRemoveInput, P as RoleSpendCap, Pt as OfframpMethods, Q as AccountsMethods, Qt as PaymentsPayInput, R as OrganizationPaymentItemInput, Rt as Payee, S as DetectPendingOrgInvitationsResult, Sn as CAPXUL_PAYMENTS_V2_ADDRESS, St as Destination, T as MemberView, Tn as IdentityState, Tt as DestinationListInput, U as PermissionMethods, Ut as PaymentDocumentRef, V as PermissionChangeInput, Vt as PaymentDirection, W as PermissionOptions, Wt as PaymentDocumentRender, X as OrgMeMethod, Xt as PaymentType, Y as OrgMe, Yt as PaymentTiming, Z as OrgMeOptions, Zt as PaymentsMethods, _ as SystemHealth, _n as SubmittedPermissionExecution, _t as ActivityMethods, a as SdkFailureObservation, an as fingerprintPaymentIntent, at as ActorRequestsMethods, b as CurrentUserMethods, bt as ActorReference, c as PostHogObservabilityOptions, cn as isSettingUpLifecycle, ct as AddressBookLabelInput, d as CreateCapxulClientInput, dn as AuthMethods, dt as InboxItem, en as RecipientResolutionKind, et as ActorProfile, f as IdentityProfileDetails, fn as OrgLifecycle, ft as InboxMethods, g as SystemMethods, gn as Permission, gt as ActivityListParams, h as HoldingsMethods, hn as MovementAnnotation, ht as ActivityItem, i as ObservationDelivery, in as TargetsMethods, it as ActorRequestIssueInput, j as OrganizationAuditLogItem, jn as isRestoring, jt as HandlesMethods, k as OrgView, kn as destination, kt as DestinationsMethods, l as postHogObservability, ln as IdentityMethods, lt as AddressBookMethods, m as IdentityRuntimeSendResult, mn as CurrentHoldings, mt as ActivityDetail, n as ObservationAdapter, nn as ResolvedTarget, nt as ActorRelationshipMethods, o as HostObservability, on as AccountLifecycle, ot as AddressBookAddInput, p as IdentityRuntime, pn as OrgSetupStep, pt as ActivityAnnotationInput, q as PermissionReadResult, qt as PaymentMoney, r as ObservationContext, rn as TargetReference, rt as ActorRequest, s as PostHogObservabilityClient, sn as AccountSetupStep, st as AddressBookEntry, t as CAPXUL_SDK_EXPECTED_OUTCOME_EVENT, tn as Ref, tt as ActorProfileMethods, u as CapxulClient, un as SmartAccountMethods, ut as InboxApproveInput, v as MediaMethods, vt as ActivityPage, w as MemberStatus, wn as IdentityEvent, wt as DestinationKind, x as CreateOrgInput, xn as TelemetryPort, xt as DepositInstructions, y as CurrentUserContext, yt as ActivityReference, z as OrganizationPaymentsMethods, zt as PayeesMethods } from "./observation-Ci8gIQjm.mjs";
 import { Hex } from "viem";
 import { Context, Effect, Layer } from "effect";
 import { FunctionReference } from "convex/server";
@@ -168,4 +168,4 @@ declare function captureException(telemetry: TelemetryPort, error: unknown, cont
  */
 declare function captureExceptionSync(telemetry: TelemetryPort, error: unknown, context?: HandledErrorReportContext): void;
 //#endregion
-export { type Account, type AccountId, type AccountLifecycle, type AccountMethods, type AccountProvider, type AccountProviderSource, type AccountRequirement, type AccountSetupStep, type AccountsMethods, type ActivityAnnotationInput, type ActivityDetail, type ActivityItem, type ActivityListParams, type ActivityMethods, type ActivityPage, type ActivityReference, type ActorProfile, type ActorProfileMethods, type ActorReference, type ActorRelationshipMethods, type ActorRequest, type ActorRequestIssueInput, type ActorRequestsMethods, type Address, type AddressBookAddInput, type AddressBookEntry, type AddressBookLabelInput, type AddressBookMethods, type AuthMethods, type AuthSession, type AuthUserId, CAPXUL_ERROR_CODES, CAPXUL_PAYMENTS_V2_ADDRESS, CAPXUL_SDK_EXPECTED_OUTCOME_EVENT, type CapxulClient, type CapxulClientInput, type CapxulDigestSigner, CapxulError, type CapxulErrorCode, type CapxulErrorDetails, type CapxulResult, type CapxulSigner, type CountryCode, type CreateCapxulClientInput, type CreateOrgInput, type CurrentHoldings, type CurrentUserContext, type CurrentUserMethods, type DepositInstructions, type Destination, type DestinationAddInput, type DestinationKind, type DestinationListInput, type DestinationPayload, type DestinationRail, type DestinationRemoveInput, type DestinationsMethods, type DetectPendingOrgInvitationsResult, type DevPrivateKeySignerInput, type Eip1193Provider, type Eip1193RequestProvider, Errors, type FinancialOpsMethods, type HandledErrorReportContext, type HandlesMethods, type HoldingsMethods, type HostObservability, type Destination$1 as IdentityDestination, type IdentityEvent, type IdentityMethods, type IdentityProfileDetails, type IdentityRuntime, type IdentityRuntimeSendResult, type IdentityState, type IdentityTransition, type InboxApproveInput, type InboxItem, type InboxMethods, type InviteMemberInput, type InvocationControls, type MeMethods, type MeProfile, type MediaMethods, type MemberStatus, type MemberView, type Money, type MoneyParseError, type MoneyParseErrorReason, type MovementAnnotation, type ObservationAdapter, type ObservationContext, type ObservationDelivery, type OfframpMethods, type OfframpQuote, type OfframpQuoteInput, type OfframpStatus, type OpenfortEmbeddedSignerInput, type OpenfortEmbeddedWalletApi, type OpenfortEmbeddedWalletPort, type OrgId, type OrgLane, type OrgLifecycle, type OrgMethods, type OrgScopedMethods, type OrgSetupStep, type OrgTemplate, type OrgView, type OrganizationAccount, type OrganizationAuditLogItem, type OrganizationPaymentBatchInput, type OrganizationPaymentInput, type OrganizationPaymentItemInput, type OrganizationPaymentsMethods, type PartyId, type Payee, type PayeesMethods, type Payment, type PaymentDirection, type PaymentDocumentKind, type PaymentDocumentRef, type PaymentDocumentRender, type PaymentDocumentVerification, type PaymentDocumentsMethods, type PaymentMoney, type PaymentStatus, type PaymentTiming, type PaymentType, type PaymentsMethods, type PaymentsPayInput, type Permission, type PermissionAssignInput, type PermissionChangeInput, type PermissionCreateInput, type PermissionMethods, type PermissionOptions, type PermissionReadResult, type PermissionReplaceInput, type PermissionRevokeInput, type PostHogObservabilityClient, type PostHogObservabilityOptions, type Profile, type Readiness, type RecipientResolution, type RecipientResolutionKind, type Ref, type ResendInviteTokenInput, type ResolvedTarget, type RoleDefinition, type RoleKey, type RoleSpendCap, type RoleView, type SdkFailureObservation, type Session, type SmartAccount, type SmartAccountMethods, type StateLabel, type SubmittedPermissionExecution, type SystemHealth, type SystemMethods, type TargetReference, type TargetsMethods, type TelemetryPort, captureException, captureExceptionSync, createCapxulClient, deriveDevPrivateKey, devPrivateKeySigner, eip1193AccountProvider, embeddedSigner, fingerprintPaymentIntent, formatMoney, injectedWalletSigner, isCapxulError, isMoneyParseError, isSettingUpLifecycle, localPrivateKeyAccountProvider, openfortEmbeddedSigner, openfortEmbeddedSignerFromWallet, openfortEmbeddedWalletPort, parseMoney, postHogObservability, destination as resolveIdentityDestination, toCountryCode, toAddress as toEvmAddress };
+export { type Account, type AccountId, type AccountLifecycle, type AccountMethods, type AccountProvider, type AccountProviderSource, type AccountRequirement, type AccountSetupStep, type AccountsMethods, type ActivityAnnotationInput, type ActivityDetail, type ActivityItem, type ActivityListParams, type ActivityMethods, type ActivityPage, type ActivityReference, type ActorProfile, type ActorProfileMethods, type ActorReference, type ActorRelationshipMethods, type ActorRequest, type ActorRequestIssueInput, type ActorRequestsMethods, type Address, type AddressBookAddInput, type AddressBookEntry, type AddressBookLabelInput, type AddressBookMethods, type AuthMethods, type AuthSession, type AuthUserId, type Budget, type BudgetId, CAPXUL_ERROR_CODES, CAPXUL_PAYMENTS_V2_ADDRESS, CAPXUL_SDK_EXPECTED_OUTCOME_EVENT, type CapxulClient, type CapxulClientInput, type CapxulDigestSigner, CapxulError, type CapxulErrorCode, type CapxulErrorDetails, type CapxulResult, type CapxulSigner, type CountryCode, type CreateCapxulClientInput, type CreateOrgInput, type CurrentHoldings, type CurrentUserContext, type CurrentUserMethods, type DepositInstructions, type Destination, type DestinationAddInput, type DestinationKind, type DestinationListInput, type DestinationPayload, type DestinationRail, type DestinationRemoveInput, type DestinationsMethods, type DetectPendingOrgInvitationsResult, type DevPrivateKeySignerInput, type Eip1193Provider, type Eip1193RequestProvider, Errors, type FinancialOpsMethods, type HandledErrorReportContext, type HandlesMethods, type HoldingsMethods, type HostObservability, type Destination$1 as IdentityDestination, type IdentityEvent, type IdentityMethods, type IdentityProfileDetails, type IdentityRuntime, type IdentityRuntimeSendResult, type IdentityState, type IdentityTransition, type InboxApproveInput, type InboxItem, type InboxMethods, type InviteMemberInput, type InvocationControls, type MeMethods, type MeProfile, type MediaMethods, type MemberStatus, type MemberView, type Money, type MoneyParseError, type MoneyParseErrorReason, type MovementAnnotation, type ObservationAdapter, type ObservationContext, type ObservationDelivery, type OfframpMethods, type OfframpQuote, type OfframpQuoteInput, type OfframpStatus, type OpenfortEmbeddedSignerInput, type OpenfortEmbeddedWalletApi, type OpenfortEmbeddedWalletPort, type OrgId, type OrgLane, type OrgLifecycle, type OrgMe, type OrgMeMethod, type OrgMeOptions, type OrgMethods, type OrgScopedMethods, type OrgSetupStep, type OrgTemplate, type OrgView, type OrganizationAccount, type OrganizationAuditLogItem, type OrganizationPaymentBatchInput, type OrganizationPaymentInput, type OrganizationPaymentItemInput, type OrganizationPaymentsMethods, type PartyId, type Payee, type PayeesMethods, type Payment, type PaymentDirection, type PaymentDocumentKind, type PaymentDocumentRef, type PaymentDocumentRender, type PaymentDocumentVerification, type PaymentDocumentsMethods, type PaymentMoney, type PaymentStatus, type PaymentTiming, type PaymentType, type PaymentsMethods, type PaymentsPayInput, type Permission, type PermissionAssignInput, type PermissionChangeInput, type PermissionCreateInput, type PermissionMethods, type PermissionOptions, type PermissionReadResult, type PermissionReplaceInput, type PermissionRevokeInput, type PostHogObservabilityClient, type PostHogObservabilityOptions, type Profile, type Readiness, type RecipientResolution, type RecipientResolutionKind, type Ref, type ResendInviteTokenInput, type ResolvedTarget, type RoleDefinition, type RoleKey, type RoleSpendCap, type RoleView, type SdkFailureObservation, type Session, type SignerStatus, type SignerStatusStore, type SmartAccount, type SmartAccountMethods, type StateLabel, type SubmittedPermissionExecution, type SystemHealth, type SystemMethods, type TargetReference, type TargetsMethods, type TelemetryPort, captureException, captureExceptionSync, createCapxulClient, deriveDevPrivateKey, devPrivateKeySigner, eip1193AccountProvider, embeddedSigner, fingerprintPaymentIntent, formatMoney, injectedWalletSigner, isCapxulError, isClaimed, isMoneyParseError, isRestoring, isSettingUpLifecycle, localPrivateKeyAccountProvider, openfortEmbeddedSigner, openfortEmbeddedSignerFromWallet, openfortEmbeddedWalletPort, parseMoney, postHogObservability, destination as resolveIdentityDestination, toCountryCode, toAddress as toEvmAddress };

package/dist/index.mjs

@@ -1,5 +1,5 @@
-import { A as fingerprintPaymentIntent, B as formatTraceparent, C as ClockPortTag, D as AuthClientError, E as authClientPortFromPromiseAdapter, F as sanitizeObservationContext, G as CAPXUL_PAYMENTS_V2_ADDRESS, H as readInvocationObservation, I as CAPXUL_FUNCTIONS, K as normalizeBindingEmail, L as BootstrapEnvelope, M as fromWei, N as OBSERVATION_CONTEXT_HEADER, O as AuthClientPortTag, P as encodeObservationContextHeader, R as EngineeringTelemetryBootstrapPolicy, S as ClockError, T as bootstrapErrorFromCapxul, U as injectedWalletSigner, V as copyInvocationObservation, W as signerFailure, Y as destination, _ as wireChainId, a as observeFailedResult, b as ConvexCallPortTag, c as captureExceptionSync, d as TelemetryPortTag, g as accountReadErrorFromCapxul, h as AccountReadPortTag, i as observationContextProps, j as toWei, k as version, l as detectAuthCacheAdapter, m as smartAccountErrorFromCapxul, n as postHogProductTelemetry, o as postHogFailureObservation, p as SmartAccountPortTag, q as BASE_SEPOLIA_CHAIN_ID, r as CAPXUL_SDK_EXPECTED_OUTCOME_EVENT, s as captureException, t as assembleCapxulClient, u as PostHogTelemetryLayer, v as IdentityPortTag, w as BootstrapPortTag, x as convexCallErrorFromCapxul, y as identityErrorFromCapxul, z as isSettingUpLifecycle } from "./create-capxul-client-B8qMV-_e.mjs";
-import { A as toPublishableKey, C as toEmail, D as toKycTier, E as toJwtToken, F as CapxulError, L as Errors, M as toSessionToken, N as decodeConvexError, O as toOrgId, P as CAPXUL_ERROR_CODES, R as isCapxulError, S as toDurationMs, T as toEpochSeconds, b as toCountryCode, g as toAllowedOrigin, h as toAddress, j as toRoleKey, m as toAccountId, o as AuthCachePortTag, p as currencySymbolFor, v as toAuthUserId, w as toEpochMs, x as toCurrencyCode, y as toChainId } from "./InMemoryAuthCacheAdapter-PycLJWeW.mjs";
+import { A as fingerprintPaymentIntent, B as formatTraceparent, C as ClockPortTag, D as AuthClientError, E as authClientPortFromPromiseAdapter, F as sanitizeObservationContext, G as signerFailure, H as readInvocationObservation, I as CAPXUL_FUNCTIONS, J as BASE_SEPOLIA_CHAIN_ID, K as CAPXUL_PAYMENTS_V2_ADDRESS, L as BootstrapEnvelope, M as fromWei, N as OBSERVATION_CONTEXT_HEADER, O as AuthClientPortTag, P as encodeObservationContextHeader, Q as isRestoring, R as EngineeringTelemetryBootstrapPolicy, S as ClockError, T as bootstrapErrorFromCapxul, U as causeChain, V as copyInvocationObservation, W as injectedWalletSigner, X as destination, Z as isClaimed, _ as wireChainId, a as observeFailedResult, b as ConvexCallPortTag, c as captureExceptionSync, d as TelemetryPortTag, g as accountReadErrorFromCapxul, h as AccountReadPortTag, i as observationContextProps, j as toWei, k as version, l as detectAuthCacheAdapter, m as smartAccountErrorFromCapxul, n as postHogProductTelemetry, o as postHogFailureObservation, p as SmartAccountPortTag, q as normalizeBindingEmail, r as CAPXUL_SDK_EXPECTED_OUTCOME_EVENT, s as captureException, t as assembleCapxulClient, u as PostHogTelemetryLayer, v as IdentityPortTag, w as BootstrapPortTag, x as convexCallErrorFromCapxul, y as identityErrorFromCapxul, z as isSettingUpLifecycle } from "./create-capxul-client-DTQDSOvO.mjs";
+import { C as toDurationMs, D as toJwtToken, E as toEpochSeconds, F as CAPXUL_ERROR_CODES, I as CapxulError, M as toRoleKey, N as toSessionToken, O as toKycTier, P as decodeConvexError, R as Errors, S as toCurrencyCode, T as toEpochMs, b as toChainId, g as toAllowedOrigin, h as toAddress, j as toPublishableKey, k as toOrgId, m as toAccountId, o as AuthCachePortTag, p as currencySymbolFor, v as toAuthUserId, w as toEmail, x as toCountryCode, z as isCapxulError } from "./InMemoryAuthCacheAdapter-qMpBOGb3.mjs";
 import { keccak256, recoverAddress, stringToHex } from "viem";
 import { Cause, Context, Data, Effect, Exit, Layer, Result, SchemaIssue, SchemaParser, Scope, Tracer } from "effect";
 import { getFunctionName, makeFunctionReference } from "convex/server";
@@ -1725,6 +1725,7 @@ function parseRoleDefinition(json) {
 			...raw.spend.perDay === void 0 ? {} : { perDay: parseRoleMoney(raw.spend.perDay, "perDay") },
 			...raw.spend.toRecipients === void 0 ? {} : { toRecipients: parseRoleRecipients(raw.spend.toRecipients) }
 		} },
+		...typeof raw.canSpend === "boolean" ? { canSpend: raw.canSpend } : {},
 		...typeof raw.canManageMembers === "boolean" ? { canManageMembers: raw.canManageMembers } : {},
 		...typeof raw.canManageRoles === "boolean" ? { canManageRoles: raw.canManageRoles } : {}
 	};
@@ -2123,6 +2124,10 @@ var ConsoleDiagnosticAdapter = class {
 function openfortProviderError(operation, cause) {
 	return cause instanceof CapxulError ? cause : Errors.providerError("openfort", operation, cause, { failure_mode: "unknown" });
 }
+/** Build a named PROVIDER_ERROR. The assembled Core SDK boundary reports it. */
+function failOpenfort(operation, failure_mode, cause) {
+	return Errors.providerError("openfort", operation, cause, { failure_mode });
+}
 /**
 * True when the browser cannot perform Web Crypto — sandboxed iframes, headless
 * agent browsers, or non-HTTPS origins. OpenFort's embedded-wallet `configure`
@@ -2159,22 +2164,77 @@ function clearStaleOpenfortBrowserStorage(publishableKey) {
 	if (scope === void 0) return;
 	for (const key of OPENFORT_BROWSER_STORAGE_KEYS) localStorage.removeItem(`${scope}.${key}`);
 }
+/**
+* The Openfort error code that names the stale-user class (#1435).
+* `getThirdPartyAuthToken` skips `authenticateThirdParty` while a `userId` sits
+* in scoped storage. A purged `userId` therefore pins every later call to a 401
+* that `extractApiError` reports as `USER_NOT_FOUND`.
+*
+* The set holds one member on purpose. Session-expiry codes (`SESSION_EXPIRED`,
+* `NOT_LOGGED_IN`, `INVALID_TOKEN`, `REFRESH_TOKEN_ERROR`) are a different
+* cause, and a bare 401 is a different cause again: `app-env-allowlist` is a
+* 401 by definition (`packages/errors/src/errors.ts:80-81`). Healing those and
+* tagging them `stale-openfort-cache` would delete the triage signal the tag
+* exists to carry.
+*/
+const STALE_USER_ERROR_CODES = new Set(["USER_NOT_FOUND"]);
+/**
+* The one predicate that opens the heal. It reads the Openfort error code and
+* never the message text (ADR-0023 R4). It walks the cause chain the way
+* `isTransportError` walks it in the Convex transport adapter.
+*
+* Known ceiling (#1435): a 401 that carries no recognized code is NOT healed.
+* `extractApiError` keeps the status only on `AuthenticationError`, so such a
+* payload is reachable. Add the code a live payload shows; do not add a message
+* match, because that trades one bug class for an ADR-0023 R4 violation.
+*/
+function isStaleUserSignal(cause) {
+	for (const link of causeChain(cause)) {
+		const error = link;
+		if (typeof error.error === "string" && STALE_USER_ERROR_CODES.has(error.error) || typeof error.code === "string" && STALE_USER_ERROR_CODES.has(error.code)) return true;
+	}
+	return false;
+}
 function createOpenfortBrowserSignerFromBootstrap(bootstrap, options = {}) {
 	const diagnostic = options.diagnostic;
 	const authBaseUrl = normalizeBetterAuthBaseUrl(bootstrap.authBaseUrl);
+	let currentStatus = "unknown";
+	const statusListeners = /* @__PURE__ */ new Set();
+	function setStatus(next) {
+		if (currentStatus === next) return;
+		currentStatus = next;
+		for (const listener of statusListeners) try {
+			listener(next);
+		} catch {
+			statusListeners.delete(listener);
+			diagnostic?.trace("openfort.signerStatusListener", {
+				ok: false,
+				failure_mode: "unknown"
+			});
+		}
+	}
+	const statusStore = {
+		status: () => currentStatus,
+		subscribe: (listener) => {
+			statusListeners.add(listener);
+			return () => {
+				statusListeners.delete(listener);
+			};
+		}
+	};
 	/**
 	* Closes the black hole: when the browser has no Web Crypto, OpenFort's
 	* `configure` would resolve to no address and the failure would be reported
-	* as `unknown`. Detect it before any network/wallet work, tag it
-	* `no-secure-context` on a PROVIDER_ERROR scoped to `configure`, breadcrumb
-	* it via DiagnosticPort. The assembled Core SDK boundary reports the error.
+	* as `unknown`. Detect it before any network or wallet work. Tag it
+	* `no-secure-context` on a PROVIDER_ERROR scoped to `configure`. Add a
+	* DiagnosticPort breadcrumb. The assembled Core SDK boundary reports it.
 	*/
 	function failNoSecureContext() {
 		diagnostic?.trace("openfort.configure", {
 			ok: false,
 			failure_mode: "no-secure-context"
 		});
-		throw Errors.providerError("openfort", "configure", /* @__PURE__ */ new Error("Web Crypto unavailable: browser is not a secure context"), { failure_mode: "no-secure-context" });
+		throw failOpenfort("configure", "no-secure-context", /* @__PURE__ */ new Error("Web Crypto unavailable: browser is not a secure context"));
 	}
 	function betterAuthSessionUrl() {
 		return `${authBaseUrl}/get-session`;
@@ -2225,6 +2285,39 @@ function createOpenfortBrowserSignerFromBootstrap(bootstrap, options = {}) {
 			getAccessToken: fetchBetterAuthAccessToken
 		}
 	});
+	async function configureEmbeddedWallet(encryptionSession) {
+		await openfort.embeddedWallet.configure({
+			accountType: AccountTypeEnum.EOA,
+			chainType: ChainTypeEnum.EVM,
+			recoveryParams: {
+				recoveryMethod: RecoveryMethod.AUTOMATIC,
+				encryptionSession
+			}
+		});
+	}
+	/**
+	* ONE heal cycle on the stale-user rejection (#1435). Clear the scoped
+	* storage that pins the dead `userId`, run the existing configure path — it
+	* re-runs third-party auth against the live Better Auth session now that no
+	* `userId` is cached — and retry the read once. Exactly one cycle: a second
+	* rejection is terminal and carries `failure_mode: "stale-openfort-cache"`.
+	* The caller stays in `recovering` throughout; only the outcome moves it.
+	*/
+	async function healStaleOpenfortCache(encryptionSession) {
+		try {
+			clearStaleOpenfortBrowserStorage(bootstrap.openfortPublishableKey);
+			diagnostic?.trace("openfort.storageCleared", { beforeConfigure: false });
+			await configureEmbeddedWallet(encryptionSession);
+			await openfort.embeddedWallet.get();
+		} catch (cause) {
+			diagnostic?.trace("openfort.staleCacheHeal", {
+				ok: false,
+				failure_mode: "stale-openfort-cache"
+			});
+			throw failOpenfort("get", "stale-openfort-cache", cause);
+		}
+		diagnostic?.trace("openfort.staleCacheHeal", { ok: true });
+	}
 	let walletReadyPromise = null;
 	function startWalletReady() {
 		return (async () => {
@@ -2289,14 +2382,7 @@ function createOpenfortBrowserSignerFromBootstrap(bootstrap, options = {}) {
 				clearStaleOpenfortBrowserStorage(bootstrap.openfortPublishableKey);
 				diagnostic?.trace("openfort.storageCleared", { beforeConfigure: true });
 				try {
-					await openfort.embeddedWallet.configure({
-						accountType: AccountTypeEnum.EOA,
-						chainType: ChainTypeEnum.EVM,
-						recoveryParams: {
-							recoveryMethod: RecoveryMethod.AUTOMATIC,
-							encryptionSession: encryptionBody.sessionId
-						}
-					});
+					await configureEmbeddedWallet(encryptionBody.sessionId);
 					diagnostic?.trace("openfort.configure", { ok: true });
 				} catch (cause) {
 					diagnostic?.trace("openfort.configure", {
@@ -2310,20 +2396,36 @@ function createOpenfortBrowserSignerFromBootstrap(bootstrap, options = {}) {
 				await openfort.embeddedWallet.get();
 				diagnostic?.trace("openfort.get", { ok: true });
 			} catch (cause) {
+				if (!isStaleUserSignal(cause)) {
+					diagnostic?.trace("openfort.get", {
+						ok: false,
+						failure_mode: "unknown"
+					});
+					throw openfortProviderError("get", cause);
+				}
 				diagnostic?.trace("openfort.get", {
 					ok: false,
-					failure_mode: "unknown"
+					failure_mode: "stale-openfort-cache"
 				});
-				throw openfortProviderError("get", cause);
+				await healStaleOpenfortCache(encryptionBody.sessionId);
 			}
 		})();
 	}
 	async function ensureOpenfortWalletReady() {
-		walletReadyPromise ??= startWalletReady();
+		let joined = walletReadyPromise;
+		if (joined === null) {
+			joined = startWalletReady();
+			walletReadyPromise = joined;
+			setStatus("recovering");
+		}
 		try {
-			await walletReadyPromise;
+			await joined;
+			if (walletReadyPromise === joined) setStatus("ready");
 		} catch (cause) {
-			walletReadyPromise = null;
+			if (walletReadyPromise === joined) {
+				walletReadyPromise = null;
+				setStatus("unavailable");
+			}
 			throw cause;
 		}
 	}
@@ -2333,6 +2435,7 @@ function createOpenfortBrowserSignerFromBootstrap(bootstrap, options = {}) {
 	});
 	return {
 		...signer,
+		statusStore,
 		getAddress: async () => {
 			try {
 				const address = await signer.getAddress();
@@ -2350,6 +2453,7 @@ function createOpenfortBrowserSignerFromBootstrap(bootstrap, options = {}) {
 			walletReadyPromise = null;
 			clearStaleOpenfortBrowserStorage(bootstrap.openfortPublishableKey);
 			signer.resetAddressCache();
+			setStatus("unknown");
 		}
 	};
 }
@@ -2965,4 +3069,4 @@ async function createCapxulClient(input) {
 	return createCapxulClient$1(input);
 }
 //#endregion
-export { CAPXUL_ERROR_CODES, CAPXUL_PAYMENTS_V2_ADDRESS, CAPXUL_SDK_EXPECTED_OUTCOME_EVENT, CapxulError, Errors, captureException, captureExceptionSync, createCapxulClient, deriveDevPrivateKey, devPrivateKeySigner, eip1193AccountProvider, embeddedSigner, fingerprintPaymentIntent, formatMoney, injectedWalletSigner, isCapxulError, isMoneyParseError, isSettingUpLifecycle, localPrivateKeyAccountProvider, openfortEmbeddedSigner, openfortEmbeddedSignerFromWallet, openfortEmbeddedWalletPort, parseMoney, postHogObservability, destination as resolveIdentityDestination, toCountryCode, toAddress as toEvmAddress };
+export { CAPXUL_ERROR_CODES, CAPXUL_PAYMENTS_V2_ADDRESS, CAPXUL_SDK_EXPECTED_OUTCOME_EVENT, CapxulError, Errors, captureException, captureExceptionSync, createCapxulClient, deriveDevPrivateKey, devPrivateKeySigner, eip1193AccountProvider, embeddedSigner, fingerprintPaymentIntent, formatMoney, injectedWalletSigner, isCapxulError, isClaimed, isMoneyParseError, isRestoring, isSettingUpLifecycle, localPrivateKeyAccountProvider, openfortEmbeddedSigner, openfortEmbeddedSignerFromWallet, openfortEmbeddedWalletPort, parseMoney, postHogObservability, destination as resolveIdentityDestination, toCountryCode, toAddress as toEvmAddress };

package/dist/node/index.d.mts

@@ -1,4 +1,4 @@
-import { E as AuthSession, _ as AuthCachePortTag, g as AuthCachePort, h as AuthCacheError, n as CapxulSigner, v as CachedJwt } from "../signer-D4roBkcX.mjs";
+import { O as AuthSession, _ as AuthCacheError, b as CachedJwt, n as CapxulSigner, v as AuthCachePort, y as AuthCachePortTag } from "../signer-BejoR3bA.mjs";
 import { Hex } from "viem";
 import { Effect, FileSystem, Layer, Path } from "effect";
 

package/dist/node/index.mjs

@@ -1,4 +1,4 @@
-import { a as AuthCacheError, h as toAddress, i as parseCachedJwt, n as BrowserAuthCacheAdapter, o as AuthCachePortTag, r as parseAuthSession, t as InMemoryAuthCacheAdapter } from "../InMemoryAuthCacheAdapter-PycLJWeW.mjs";
+import { a as AuthCacheError, h as toAddress, i as parseCachedJwt, n as BrowserAuthCacheAdapter, o as AuthCachePortTag, r as parseAuthSession, t as InMemoryAuthCacheAdapter } from "../InMemoryAuthCacheAdapter-qMpBOGb3.mjs";
 import { Effect, FileSystem, Layer, Path } from "effect";
 import { privateKeyToAccount } from "viem/accounts";
 import * as os from "node:os";

package/dist/{observation-BwPo8qeo.d.mts → observation-Ci8gIQjm.d.mts}

@@ -1,4 +1,4 @@
-import { $ as CapxulError, A as CountryCode, B as PaymentCommandId, C as AllowedOrigin, D as AuthUserId, E as AuthSession, F as EpochMs, G as RoleKey, H as PermissionId, I as Money, J as TxHash, K as SessionToken, L as MovementId, M as DocumentHash, N as DurationMs, O as BlockNumber, P as Email, R as OrgId, S as AllowanceKey, T as AppId, U as Profile, V as PermissionAssignmentId, W as PublishableKey, Y as WeiAmount, d as CapxulResult, et as CapxulErrorCode, f as Profile$1, g as AuthCachePort, it as FailureMode, j as CurrencyCode, k as ChainId, m as SmartAccount$1, n as CapxulSigner, o as AccountProviderSource, p as Session$1, q as SmartAccount, rt as Failure, s as AccountRequirement, tt as CapxulErrorDetails, v as CachedJwt, w as AnonymousDistinctId, x as Address$1, y as Account$1, z as PartyId } from "./signer-D4roBkcX.mjs";
+import { A as BlockNumber, B as MovementId, C as Address$1, D as AppId, E as AnonymousDistinctId, F as DocumentHash, G as PermissionId, H as PartyId, I as DurationMs, J as RoleKey, K as Profile, L as Email, M as ChainId, N as CountryCode, O as AuthSession, P as CurrencyCode, Q as WeiAmount, R as EpochMs, T as AllowedOrigin, U as PaymentCommandId, V as OrgId, W as PermissionAssignmentId, X as SmartAccount, Y as SessionToken, Z as TxHash, a as SignerStatusStore, b as CachedJwt, c as AccountProviderSource, g as SmartAccount$1, h as Session$1, it as CapxulErrorDetails, j as BudgetId, k as AuthUserId, l as AccountRequirement, m as Profile$1, n as CapxulSigner, nt as CapxulError, ot as Failure, p as CapxulResult, q as PublishableKey, rt as CapxulErrorCode, st as FailureMode, v as AuthCachePort, w as AllowanceKey, x as Account$1, z as Money } from "./signer-BejoR3bA.mjs";
 import { Address, Hex } from "viem";
 import { Context, Effect, Layer, Schema, Scope, Tracer } from "effect";
 import { FunctionReference } from "convex/server";
@@ -127,7 +127,13 @@ type Readiness = {
   readonly failure: Failure;
   readonly retryable: boolean;
 };
-type IdentityState = {
+type IdentityState =
+/** The INITIAL state: a session probe is in flight and the machine knows
+ * nothing yet. Distinct from `signed_out`, which is a settled answer. Without
+ * it every consumer read the restore window as a real sign-out. */
+{
+  readonly phase: "restoring";
+} | {
   readonly phase: "signed_out";
 } | {
   readonly phase: "otp_sending";
@@ -159,7 +165,7 @@ type IdentityState = {
     readonly requestedAt: number;
   } | null;
 };
-declare const STATE_LABELS: readonly ["signed_out", "otp_sending", "otp_pending", "otp_verifying", "authenticated:unknown", "authenticated:deriving", "authenticated:counterfactual", "authenticated:claiming", "authenticated:failed", "authenticated:claimed", "authenticated:claimed:creating", "authenticated:claimed:loading", "authenticated:claimed:settingUp", "authenticated:claimed:ready", "authenticated:claimed:failed", "signing_out", "faulted"];
+declare const STATE_LABELS: readonly ["restoring", "signed_out", "otp_sending", "otp_pending", "otp_verifying", "authenticated:unknown", "authenticated:deriving", "authenticated:counterfactual", "authenticated:claiming", "authenticated:failed", "authenticated:claimed", "authenticated:claimed:creating", "authenticated:claimed:loading", "authenticated:claimed:settingUp", "authenticated:claimed:ready", "authenticated:claimed:failed", "signing_out", "faulted"];
 type StateLabel = (typeof STATE_LABELS)[number];
 type IdentityEvent = {
   readonly _tag: "RequestOtp";
@@ -182,6 +188,12 @@ type IdentityEvent = {
   readonly now: number;
 } | {
   readonly _tag: "Reset";
+} | {
+  readonly _tag: "SessionRestored";
+  readonly session: Session;
+  readonly profileComplete: boolean;
+} | {
+  readonly _tag: "SessionAbsent";
 } | {
   readonly _tag: "EnsureAccount";
 } | {
@@ -223,6 +235,22 @@ type Destination$1 = {
  * there is no org list in the state, only the ONE active lane.
  */
 declare const destination: (state: IdentityState) => Destination$1 | null;
+/**
+ * True while the machine has not settled enough to route or to gate on.
+ *
+ * NEGATIVE classification, deliberately: the SETTLED positions are the ones
+ * enumerated, and everything else waits. A phase or readiness variant added
+ * later therefore defaults to holding, never to redirecting a member who is in
+ * fact signed in. Terminal for the account lane is `claimed | failed`.
+ *
+ * The org lane's own settledness (`ready | failed`) is the route gate's
+ * question, not this one: every org lane sits under a CLAIMED account, and
+ * `destination()` already names a real screen for each of its positions.
+ */
+declare const isRestoring: (state: IdentityState) => boolean;
+/** The claimed-account gate as one function. The inlined consumers move onto
+ * it in #1521; this ticket ships the selector they move onto. */
+declare const isClaimed: (state: IdentityState) => boolean;
 //#endregion
 //#region ../config/src/capxul-payments-v2.d.ts
 /** Immutable CapxulPaymentsV2 deployment on Base Sepolia. */
@@ -774,7 +802,7 @@ interface IdentityPort {
 type SafeDeploymentConfig = {
   readonly chainId: ChainId;
   readonly rpcUrl: string;
-  readonly gasPolicyId: string;
+  readonly bundlerRpcUrl: string;
   readonly receiptTimeoutMs?: DurationMs;
 };
 /**
@@ -1871,6 +1899,47 @@ interface OrgPort {
   detectAndAcceptPendingInvitations(input: DetectPendingOrgInvitationsInput): Effect.Effect<DetectPendingOrgInvitationsResult$1, OrgError, never>;
 }
 //#endregion
+//#region src/surface/org-me.d.ts
+/**
+ * One spend authority the Member holds. `limit` is the cap the payment gate
+ * enforces on a single payment — `null` means the Budget carries no cap. The
+ * amount still available under the cap is not part of this read and is not
+ * computable from it.
+ */
+interface Budget {
+  readonly id: BudgetId;
+  /** Display name, taken from the Role the grant was motivated by. */
+  readonly label: string;
+  readonly limit: Money | null;
+}
+/**
+ * The caller's own standing in one Organization.
+ *
+ * `role` is `null` when the Role catalog cannot name the Member's Role — a
+ * label-less owner is tolerated (ADR-0017), so consumers must render an
+ * absent Role rather than invent one.
+ *
+ * `capabilities` are the two facts the backend actually enforces, and nothing
+ * else: managing people, and spending. Payroll and invoice approval are both
+ * spending, so both read `canSpend`.
+ */
+interface OrgMe {
+  readonly role: {
+    readonly label: string;
+  } | null;
+  readonly capabilities: {
+    readonly canManagePeople: boolean;
+    readonly canSpend: boolean;
+  };
+  /** Named Budgets this Member can spend from. `canSpend` is the authority fact. */
+  readonly budgets: readonly Budget[];
+  readonly observedAt: number;
+}
+type OrgMeOptions = {
+  readonly signal?: AbortSignal;
+};
+type OrgMeMethod = (options?: OrgMeOptions) => Promise<CapxulResult<OrgMe>>;
+//#endregion
 //#region src/contract/permission.d.ts
 interface PermissionReadResult {
   readonly permissions: readonly Permission[];
@@ -1991,11 +2060,14 @@ type RoleSpendCap = {
 type RoleDefinition = {
   readonly label: string;
   readonly spend?: RoleSpendCap;
+  readonly canSpend?: boolean;
   readonly canManageMembers?: boolean;
   readonly canManageRoles?: boolean;
 };
 /**
- * One role seeded on an Organization.
+ * One role a member can be invited into on an Organization — a role that
+ * carries member-management authority. A Budget is granted, never offered as a
+ * job title (ADR-0024 R5), so it never appears here.
  * `roleKey` is the on-chain bytes32 role key derived from the label. `definition`
  * is the full Role DSL entry.
  */
@@ -2005,21 +2077,22 @@ type RoleView = {
   readonly roleKey: RoleKey;
   readonly definition: RoleDefinition;
 };
-/** Built-in role templates for a new Organization. */
-type OrgTemplate = "Solo" | "Startup" | "Custom";
+/**
+ * The role template a new Organization is created from. Creation supports
+ * exactly one shape — a single founding owner (ADR-0024 R8). Any other value
+ * is REFUSED with `WRONG_STATE`.
+ */
+type OrgTemplate = "Solo";
 /**
  * Input to `capxul.createOrg`. `name` is the display name.
  * `handle` is the globally unique normalized handle (`^[a-z0-9-]{3,32}$`).
  * `template` seeds the initial role set. `country` is stored without validation.
- * For `template: "Custom"`, `roles` carries the authored
- * `RoleDefinition[]`.
  */
 type CreateOrgInput = {
   readonly name: string;
   readonly handle: string;
   readonly template: OrgTemplate;
   readonly country?: string;
-  readonly roles?: readonly RoleDefinition[];
 };
 /**
  * Input to `org(orgId).invite`. Email is the universal entry point.
@@ -2040,6 +2113,12 @@ type DetectPendingOrgInvitationsResult = {
 };
 /** Organization methods for one `orgId`. */
 interface OrgScopedMethods extends ActorRelationshipMethods {
+  /**
+   * The caller's own standing in this Organization — Role, the two enforced
+   * capabilities, and the Budgets they can spend from. A caller who is not an
+   * active Member is refused, not reported as a Member without capabilities.
+   */
+  readonly me: OrgMeMethod;
   /** Observe the durable, leak-safe lifecycle for this Organization only. */
   getLifecycle(options?: {
     readonly signal?: AbortSignal;
@@ -2288,6 +2367,16 @@ interface CapxulClient {
   readonly createOrg: OrgMethods["createOrg"];
   readonly orgs: OrgMethods["orgs"];
   readonly org: OrgMethods["org"];
+  /**
+   * Observable signer readiness (ACCESS #1520 · C12). `status()` reads the
+   * current `SignerStatus`. `subscribe` fires on every change and returns its
+   * own unsubscribe. Only the Openfort browser signer runs a readiness cycle.
+   * Every other signer reports `"unknown"`, so a gate that reads this fails
+   * closed. This is an observation surface, not a domain method: it performs no
+   * work and cannot fail, so it returns a value rather than a `CapxulResult`.
+   * It is not a public React surface — the action part that needs it reads this.
+   */
+  readonly signer: SignerStatusStore;
   /**
    * Internal identity integration runtime. It is consumed by
    * `@capxul/sdk-react`, not exported as the actor substrate itself.
@@ -2441,4 +2530,4 @@ interface ObservationAdapter {
 /** Stable PostHog event used for typed failures that are expected product outcomes. */
 declare const CAPXUL_SDK_EXPECTED_OUTCOME_EVENT = "capxul_sdk_expected_outcome";
 //#endregion
-export { ActorRequest as $, TargetReference as $t, OrganizationAccount as A, OfframpMethods as At, PermissionAssignInput as B, PaymentDocumentRender as Bt, InviteMemberInput as C, Readiness as Cn, DestinationRail as Ct, OrgScopedMethods as D, InvocationControls as Dn, HandlesMethods as Dt, OrgMethods as E, IdentityTransition as En, FinancialOpsMethods as Et, RoleView as F, PayeesMethods as Ft, PermissionReplaceInput as G, PaymentTiming as Gt, PermissionCreateInput as H, PaymentDocumentsMethods as Ht, OrganizationPaymentBatchInput as I, Payment as It, AccountsMethods as J, PaymentsPayInput as Jt, PermissionRevokeInput as K, PaymentType as Kt, OrganizationPaymentInput as L, PaymentDirection as Lt, ResendInviteTokenInput as M, OfframpQuoteInput as Mt, RoleDefinition as N, OfframpStatus as Nt, OrgTemplate as O, MeMethods as Ot, RoleSpendCap as P, Payee as Pt, ActorRelationshipMethods as Q, ResolvedTarget as Qt, OrganizationPaymentItemInput as R, PaymentDocumentKind as Rt, DetectPendingOrgInvitationsResult as S, OrgLane as Sn, DestinationPayload as St, MemberView as T, destination as Tn, DestinationsMethods as Tt, PermissionMethods as U, PaymentMoney as Ut, PermissionChangeInput as V, PaymentDocumentVerification as Vt, PermissionOptions as W, PaymentStatus as Wt, ActorProfile as X, RecipientResolutionKind as Xt, AccountMethods as Y, RecipientResolution as Yt, ActorProfileMethods as Z, Ref$1 as Zt, SystemHealth as _, TelemetryPort as _n, DepositInstructions as _t, SdkFailureObservation as a, IdentityMethods as an, AddressBookMethods as at, CurrentUserMethods as b, IdentityEvent as bn, DestinationKind as bt, PostHogObservabilityOptions as c, OrgLifecycle as cn, InboxMethods as ct, CreateCapxulClientInput as d, MovementAnnotation as dn, ActivityItem as dt, TargetsMethods as en, ActorRequestIssueInput as et, IdentityProfileDetails as f, Permission as fn, ActivityListParams as ft, SystemMethods as g, TelemetryIdentifyInput as gn, ActorReference as gt, HoldingsMethods as h, TelemetryGroupInput as hn, ActivityReference as ht, ObservationDelivery as i, isSettingUpLifecycle as in, AddressBookLabelInput as it, OrganizationAuditLogItem as j, OfframpQuote as jt, OrgView as k, MeProfile as kt, postHogObservability as l, OrgSetupStep as ln, ActivityAnnotationInput as lt, IdentityRuntimeSendResult as m, TelemetryEvent as mn, ActivityPage as mt, ObservationAdapter as n, AccountLifecycle as nn, AddressBookAddInput as nt, HostObservability as o, SmartAccountMethods as on, InboxApproveInput as ot, IdentityRuntime as p, SubmittedPermissionExecution as pn, ActivityMethods as pt, PermissionReadResult as q, PaymentsMethods as qt, ObservationContext as r, AccountSetupStep as rn, AddressBookEntry as rt, PostHogObservabilityClient as s, AuthMethods as sn, InboxItem as st, CAPXUL_SDK_EXPECTED_OUTCOME_EVENT as t, fingerprintPaymentIntent as tn, ActorRequestsMethods as tt, CapxulClient as u, CurrentHoldings as un, ActivityDetail as ut, MediaMethods as v, CAPXUL_PAYMENTS_V2_ADDRESS as vn, Destination as vt, MemberStatus as w, StateLabel as wn, DestinationRemoveInput as wt, CreateOrgInput as x, IdentityState as xn, DestinationListInput as xt, CurrentUserContext as y, Destination$1 as yn, DestinationAddInput as yt, OrganizationPaymentsMethods as z, PaymentDocumentRef as zt };
+export { AccountMethods as $, RecipientResolution as $t, OrganizationAccount as A, isClaimed as An, FinancialOpsMethods as At, PermissionAssignInput as B, Payment as Bt, InviteMemberInput as C, Destination$1 as Cn, DestinationAddInput as Ct, OrgScopedMethods as D, Readiness as Dn, DestinationRail as Dt, OrgMethods as E, OrgLane as En, DestinationPayload as Et, RoleView as F, OfframpQuote as Ft, PermissionReplaceInput as G, PaymentDocumentVerification as Gt, PermissionCreateInput as H, PaymentDocumentKind as Ht, OrganizationPaymentBatchInput as I, OfframpQuoteInput as It, Budget as J, PaymentStatus as Jt, PermissionRevokeInput as K, PaymentDocumentsMethods as Kt, OrganizationPaymentInput as L, OfframpStatus as Lt, ResendInviteTokenInput as M, IdentityTransition as Mn, MeMethods as Mt, RoleDefinition as N, InvocationControls as Nn, MeProfile as Nt, OrgTemplate as O, StateLabel as On, DestinationRemoveInput as Ot, RoleSpendCap as P, OfframpMethods as Pt, AccountsMethods as Q, PaymentsPayInput as Qt, OrganizationPaymentItemInput as R, Payee as Rt, DetectPendingOrgInvitationsResult as S, CAPXUL_PAYMENTS_V2_ADDRESS as Sn, Destination as St, MemberView as T, IdentityState as Tn, DestinationListInput as Tt, PermissionMethods as U, PaymentDocumentRef as Ut, PermissionChangeInput as V, PaymentDirection as Vt, PermissionOptions as W, PaymentDocumentRender as Wt, OrgMeMethod as X, PaymentType as Xt, OrgMe as Y, PaymentTiming as Yt, OrgMeOptions as Z, PaymentsMethods as Zt, SystemHealth as _, SubmittedPermissionExecution as _n, ActivityMethods as _t, SdkFailureObservation as a, fingerprintPaymentIntent as an, ActorRequestsMethods as at, CurrentUserMethods as b, TelemetryIdentifyInput as bn, ActorReference as bt, PostHogObservabilityOptions as c, isSettingUpLifecycle as cn, AddressBookLabelInput as ct, CreateCapxulClientInput as d, AuthMethods as dn, InboxItem as dt, RecipientResolutionKind as en, ActorProfile as et, IdentityProfileDetails as f, OrgLifecycle as fn, InboxMethods as ft, SystemMethods as g, Permission as gn, ActivityListParams as gt, HoldingsMethods as h, MovementAnnotation as hn, ActivityItem as ht, ObservationDelivery as i, TargetsMethods as in, ActorRequestIssueInput as it, OrganizationAuditLogItem as j, isRestoring as jn, HandlesMethods as jt, OrgView as k, destination as kn, DestinationsMethods as kt, postHogObservability as l, IdentityMethods as ln, AddressBookMethods as lt, IdentityRuntimeSendResult as m, CurrentHoldings as mn, ActivityDetail as mt, ObservationAdapter as n, ResolvedTarget as nn, ActorRelationshipMethods as nt, HostObservability as o, AccountLifecycle as on, AddressBookAddInput as ot, IdentityRuntime as p, OrgSetupStep as pn, ActivityAnnotationInput as pt, PermissionReadResult as q, PaymentMoney as qt, ObservationContext as r, TargetReference as rn, ActorRequest as rt, PostHogObservabilityClient as s, AccountSetupStep as sn, AddressBookEntry as st, CAPXUL_SDK_EXPECTED_OUTCOME_EVENT as t, Ref$1 as tn, ActorProfileMethods as tt, CapxulClient as u, SmartAccountMethods as un, InboxApproveInput as ut, MediaMethods as v, TelemetryEvent as vn, ActivityPage as vt, MemberStatus as w, IdentityEvent as wn, DestinationKind as wt, CreateOrgInput as x, TelemetryPort as xn, DepositInstructions as xt, CurrentUserContext as y, TelemetryGroupInput as yn, ActivityReference as yt, OrganizationPaymentsMethods as z, PayeesMethods as zt };

package/dist/{signer-D4roBkcX.d.mts → signer-BejoR3bA.d.mts}

@@ -195,6 +195,7 @@ type PartyId = Brand<string, "PartyId">;
 type MovementId = Brand<string, "MovementId">;
 type PermissionId = Brand<string, "PermissionId">;
 type PermissionAssignmentId = Brand<string, "PermissionAssignmentId">;
+type BudgetId = Brand<string, "BudgetId">;
 type PaymentCommandId = Brand<string, "PaymentCommandId">;
 type OrgId = Brand<string, "OrgId">;
 type AppId = Brand<string, "AppId">;
@@ -368,6 +369,27 @@ interface CapxulSigner extends CapxulDigestSigner {
   readonly source: AccountProviderSource;
   /** Owner EOA address — the Safe's single owner. */
   getAddress(): Promise<Address$1>;
+  /**
+   * Readiness this signer reports, when it runs a readiness cycle at all. Only
+   * the Openfort browser signer does. `assembleCapxulClient` reads it onto
+   * `client.signer`, and substitutes `UNOBSERVABLE_SIGNER_STATUS` when absent.
+   */
+  readonly statusStore?: SignerStatusStore;
+}
+/**
+ * Observable signer readiness (ACCESS #1520 · C12). `unknown` means the
+ * wallet-ready cycle did not start. `recovering` means it is running; the
+ * stale-cache heal runs inside that phase. `ready` means the signer can sign.
+ * `unavailable` means the cycle failed. A failure is distinguishable from a
+ * cycle that never started. That is why there are four states.
+ */
+type SignerStatus = "unknown" | "recovering" | "ready" | "unavailable";
+/** Subscribable readiness surface. Assembled onto `client.signer`. */
+interface SignerStatusStore {
+  /** The current status. */
+  status(): SignerStatus;
+  /** Fires on every change. Returns its own unsubscribe. */
+  subscribe(listener: (status: SignerStatus) => void): () => void;
 }
 /** Minimal EIP-1193 surface an injected browser wallet exposes. */
 interface Eip1193RequestProvider {
@@ -385,4 +407,4 @@ interface Eip1193RequestProvider {
  */
 declare function injectedWalletSigner(provider: Eip1193RequestProvider): CapxulSigner;
 //#endregion
-export { CapxulError as $, CountryCode as A, PaymentCommandId as B, AllowedOrigin as C, AuthUserId as D, AuthSession as E, EpochMs as F, RoleKey as G, PermissionId as H, Money as I, TxHash as J, SessionToken as K, MovementId as L, DocumentHash as M, DurationMs as N, BlockNumber as O, Email as P, CAPXUL_ERROR_CODES as Q, OrgId as R, AllowanceKey as S, AppId as T, Profile$1 as U, PermissionAssignmentId as V, PublishableKey as W, toAddress as X, WeiAmount as Y, toCountryCode as Z, AuthCachePortTag as _, AccountProvider as a, isCapxulError as at, AccountId as b, Eip1193Provider as c, CapxulResult as d, CapxulErrorCode as et, Profile as f, AuthCachePort as g, AuthCacheError as h, injectedWalletSigner as i, FailureMode as it, CurrencyCode as j, ChainId as k, eip1193AccountProvider as l, SmartAccount as m, CapxulSigner as n, Errors as nt, AccountProviderSource as o, Session as p, SmartAccount$1 as q, Eip1193RequestProvider as r, Failure as rt, AccountRequirement as s, CapxulDigestSigner as t, CapxulErrorDetails as tt, localPrivateKeyAccountProvider as u, CachedJwt as v, AnonymousDistinctId as w, Address$1 as x, Account$1 as y, PartyId as z };
+export { toAddress as $, BlockNumber as A, MovementId as B, Address$1 as C, AppId as D, AnonymousDistinctId as E, DocumentHash as F, PermissionId as G, PartyId as H, DurationMs as I, RoleKey as J, Profile$1 as K, Email as L, ChainId as M, CountryCode as N, AuthSession as O, CurrencyCode as P, WeiAmount as Q, EpochMs as R, AccountId as S, AllowedOrigin as T, PaymentCommandId as U, OrgId as V, PermissionAssignmentId as W, SmartAccount$1 as X, SessionToken as Y, TxHash as Z, AuthCacheError as _, SignerStatusStore as a, Errors as at, CachedJwt as b, AccountProviderSource as c, isCapxulError as ct, eip1193AccountProvider as d, toCountryCode as et, localPrivateKeyAccountProvider as f, SmartAccount as g, Session as h, SignerStatus as i, CapxulErrorDetails as it, BudgetId as j, AuthUserId as k, AccountRequirement as l, Profile as m, CapxulSigner as n, CapxulError as nt, injectedWalletSigner as o, Failure as ot, CapxulResult as p, PublishableKey as q, Eip1193RequestProvider as r, CapxulErrorCode as rt, AccountProvider as s, FailureMode as st, CapxulDigestSigner as t, CAPXUL_ERROR_CODES as tt, Eip1193Provider as u, AuthCachePort as v, AllowanceKey as w, Account$1 as x, AuthCachePortTag as y, Money as z };

package/dist/testing/index.d.mts

@@ -1,4 +1,4 @@
-import { En as IdentityTransition, gn as TelemetryIdentifyInput, hn as TelemetryGroupInput, mn as TelemetryEvent, n as ObservationAdapter, u as CapxulClient } from "../observation-BwPo8qeo.mjs";
+import { Mn as IdentityTransition, bn as TelemetryIdentifyInput, n as ObservationAdapter, u as CapxulClient, vn as TelemetryEvent, yn as TelemetryGroupInput } from "../observation-Ci8gIQjm.mjs";
 import { Effect, Layer } from "effect";
 
 //#region src/testing/telemetry/RecordingTelemetryAdapter.d.ts

package/dist/testing/index.mjs

@@ -1,5 +1,5 @@
-import { E as authClientPortFromPromiseAdapter, J as deriveCapxulSafeAddress, M as fromWei, T as bootstrapErrorFromCapxul, _ as wireChainId, f as redactTelemetryEvent, g as accountReadErrorFromCapxul, j as toWei, m as smartAccountErrorFromCapxul, t as assembleCapxulClient, x as convexCallErrorFromCapxul, y as identityErrorFromCapxul } from "../create-capxul-client-B8qMV-_e.mjs";
-import { A as toPublishableKey, C as toEmail, D as toKycTier, E as toJwtToken, F as CapxulError, L as Errors, M as toSessionToken, S as toDurationMs, T as toEpochSeconds, _ as toAppId, b as toCountryCode, g as toAllowedOrigin, h as toAddress, m as toAccountId, t as InMemoryAuthCacheAdapter, v as toAuthUserId, w as toEpochMs, y as toChainId } from "../InMemoryAuthCacheAdapter-PycLJWeW.mjs";
+import { E as authClientPortFromPromiseAdapter, M as fromWei, T as bootstrapErrorFromCapxul, Y as deriveCapxulSafeAddress, _ as wireChainId, f as redactTelemetryEvent, g as accountReadErrorFromCapxul, j as toWei, m as smartAccountErrorFromCapxul, t as assembleCapxulClient, x as convexCallErrorFromCapxul, y as identityErrorFromCapxul } from "../create-capxul-client-DTQDSOvO.mjs";
+import { C as toDurationMs, D as toJwtToken, E as toEpochSeconds, I as CapxulError, N as toSessionToken, O as toKycTier, R as Errors, T as toEpochMs, _ as toAppId, b as toChainId, g as toAllowedOrigin, h as toAddress, j as toPublishableKey, m as toAccountId, t as InMemoryAuthCacheAdapter, v as toAuthUserId, w as toEmail, x as toCountryCode } from "../InMemoryAuthCacheAdapter-qMpBOGb3.mjs";
 import { keccak256 } from "viem";
 import { Effect, Result, Semaphore } from "effect";
 import { getFunctionName } from "convex/server";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@capxul/sdk",
-  "version": "2.2.0",
+  "version": "2.3.1",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/Xelmar-tech/infrastructure.git",
@@ -48,9 +48,9 @@
     "vitest": "npm:@voidzero-dev/vite-plus-test@0.1.23",
     "@capxul/config": "0.2.0",
     "@capxul/errors": "0.0.1",
-    "@capxul/types": "0.1.0",
-    "@capxul/wire": "0.3.0",
-    "@capxul/observability": "2.2.0",
+    "@capxul/types": "0.2.0",
+    "@capxul/wire": "0.4.0",
+    "@capxul/observability": "2.3.1",
     "@capxul/typescript-config": "0.0.0"
   },
   "_permissionlessPinReason": "permissionless.toSafeSmartAccount is pinned to 0.3.4 for live Safe deployment E2E. Counterfactual address fixtures captured 2026-05-17 in packages/backend/convex/_shared/__tests__/counterfactual.test.ts and packages/config/tests/safe.test.ts must be re-verified before upgrading.",