@capxul/sdk 4.2.0 → 4.20.0-beta.2

package/dist/{observation-vegBPfXj.d.mts → production-Cn5awmW8.d.mts}

@@ -1,6 +1,6 @@
-import { $ as PublishableKey, A as AppId, D as AllowanceKey, E as Address$1, F as ChainId, G as OrgId, H as EpochMs, I as CountryCode, J as PayrollGroupId, K as PartyId, L as CurrencyCode, M as AuthUserId, N as BlockNumber, O as AllowedOrigin, P as BudgetId, Q as Profile, R as DocumentHash, St as FailureMode, V as Email, W as Money, X as PermissionAssignmentId, Y as PayrollRunId, Z as PermissionId, _ as ClockPort, a as SignerStatusStore, at as WeiAmount, c as AccountProviderSource, et as RoleKey, ft as CapxulError, g as SmartAccount$1, gt as Failure, h as Session$1, it as TxHash, j as AuthSession, k as AnonymousDistinctId, l as AccountRequirement, m as Profile$1, mt as CapxulErrorDetails, n as CapxulSigner, nt as SmartAccount, p as CapxulResult, pt as CapxulErrorCode, q as PaymentCommandId, rt as TesterKind, tt as SessionToken, v as AuthClientPort, w as Account$1, x as AuthCachePort, y as CanSendOtpStatus, z as DurationMs } from "./signer-C0hZ6Kiy.mjs";
-import { Context, Effect, Layer, Schema, Scope, Tracer } from "effect";
+import { $ as PayrollGroupId, A as AllowanceKey, B as ChainId, C as AuthCachePort, D as Account$1, Et as FailureMode, F as AssetId, H as CurrencyCode, I as AuthSession, K as Email, L as AuthUserId, M as AnonymousDistinctId, N as AppId, Q as PaymentCommandId, R as BlockNumber, U as DocumentHash, V as CountryCode, W as DurationMs, X as OrgId, Y as Money, Z as PartyId, _ as Session$1, _t as CapxulErrorCode, at as RoleKey, b as AuthClientPort, bt as Failure, ct as TesterKind, d as AccountRequirement, et as PayrollRunId, g as Profile$1, gt as CapxulError, h as CapxulResult, i as CapxulSigner, it as PublishableKey, j as AllowedOrigin, k as Address$1, lt as TxHash, nt as PermissionId, ot as SessionToken, q as EpochMs, rt as Profile, s as SignerStatusStore, st as SmartAccount, tt as PermissionAssignmentId, u as AccountProviderSource, ut as WeiAmount, v as SmartAccount$1, vt as CapxulErrorDetails, x as CanSendOtpStatus, y as ClockPort, z as BudgetId } from "./OAuthBearerAuthClient-C-ip-z8M.mjs";
 import { Hex } from "viem";
+import { Context, Effect, Layer, Schema, Scope, Tracer } from "effect";
 import { FunctionReference } from "convex/server";
 //#region src/domain/machine/shell.d.ts
 declare const INVOCATION_PARENT_SPAN: unique symbol;
@@ -284,7 +284,7 @@ interface TelemetryPort {
 }
 //#endregion
 //#region ../observability/src/index.d.ts
-declare const TELEMETRY_EVENT_NAMES: readonly ["auth_otp_requested", "auth_otp_delivered", "auth_otp_expired", "auth_verified", "auth_failed", "auth_signed_out", "onboarding_intent_selected", "onboarding_profile_submitted", "onboarding_organization_submitted", "onboarding_dashboard_reached", "provisioning_safe_created", "provisioning_safe_confirmed", "bootstrap_resolved", "bootstrap_failed", "member_activation_started", "member_activation_ready", "member_activation_failed", "organization_creation_started", "organization_creation_ready", "organization_creation_failed", "chain_upstream_fallback", "bundler_error", "receipt_pending", "operation_retried", "account_balance_read", "account_balance_failed", "faucet_requested", "faucet_confirmed", "faucet_failed", "org_create_started", "org_safe_created", "org_safe_confirmed", "org_roles_seeded", "org_created", "org_create_failed", "org_invite_sent", "org_invite_accepted", "org_invite_expired", "payment_initiated", "payment_settled", "payment_failed", "payment_verification_retry", "payment_lifecycle_transition", "quick_pay_external_address_acknowledged", "deposit_initiated", "deposit_settled", "permission_mirror_verification", "movement_scan_window", "movement_scan_checkpoint", "movement_scan_incident", "activity_annotation_saved", "ui_activity_action_completed", "contact_relationship_changed", "ui_contact_action_completed"];
+declare const TELEMETRY_EVENT_NAMES: readonly ["auth_otp_requested", "auth_otp_delivered", "auth_otp_expired", "auth_verified", "auth_failed", "identity_refused", "auth_signed_out", "onboarding_intent_selected", "onboarding_profile_submitted", "onboarding_organization_submitted", "onboarding_dashboard_reached", "provisioning_safe_created", "provisioning_safe_confirmed", "bootstrap_resolved", "bootstrap_failed", "member_activation_started", "member_activation_ready", "member_activation_failed", "organization_creation_started", "organization_creation_ready", "organization_creation_failed", "chain_upstream_fallback", "bundler_error", "receipt_pending", "operation_retried", "account_balance_read", "account_balance_failed", "faucet_requested", "faucet_confirmed", "faucet_failed", "org_create_started", "org_safe_created", "org_safe_confirmed", "org_roles_seeded", "org_created", "org_create_failed", "org_invite_sent", "org_invite_accepted", "org_invite_expired", "payment_initiated", "payment_settled", "payment_failed", "payment_verification_retry", "payment_lifecycle_transition", "quick_pay_external_address_acknowledged", "deposit_initiated", "deposit_settled", "permission_mirror_verification", "movement_scan_window", "movement_scan_checkpoint", "movement_scan_incident", "indexer_drift_corrected", "activity_annotation_saved", "ui_activity_action_completed", "contact_relationship_changed", "ui_contact_action_completed", "access_recovery_completed", "ui_access_step_completed", "org_invite_progressed", "invoice_issued", "invoice_request_transitioned", "ui_invoice_step_completed", "ui_treasury_step_completed", "ui_receive_step_completed", "payroll_group_changed", "payroll_run_transitioned", "ui_payroll_action_completed", "cli_diagnostic_completed"];
 type TelemetryEventName = (typeof TELEMETRY_EVENT_NAMES)[number];
 type TelemetryProps = Record<string, unknown>;
 type TelemetryEvent = {
@@ -332,6 +332,13 @@ declare const PAYMENT_STATUSES: readonly ["pending", "settling", "unresolved", "
 type PaymentStatus$1 = (typeof PAYMENT_STATUSES)[number];
 declare const PAYMENT_EXECUTION_STATUSES: readonly ["pending", "included", "dropped", "replaced", "expired", "unresolved", "superseded", "failed", "settled"];
 type PaymentExecutionStatus = (typeof PAYMENT_EXECUTION_STATUSES)[number];
+/** Read-time execution meaning; it does not change the Payment's durable outcome. */
+interface PaymentExecutionView {
+  readonly status: PaymentExecutionStatus;
+  readonly retryRequired: boolean;
+  /** Present only when complete durable execution history supports no broadcast. */
+  readonly notSent?: true;
+}
 /** The payment direction relative to the current actor. */
 declare const PAYMENT_DIRECTIONS: readonly ["in", "out", "self"];
 type PaymentDirection$1 = (typeof PAYMENT_DIRECTIONS)[number];
@@ -611,6 +618,10 @@ type BootstrapResolution = {
   readonly siteBaseUrl: string;
   readonly openfortPublishableKey: string;
   readonly shieldPublishableKey: string;
+  /** Openfort third-party auth provider the signer presents; absent means better-auth. */
+  readonly openfortAuthProvider?: "better-auth" | "oidc";
+  /** Origin of the Ponder indexer the SDK reads directly; absent means no indexer reads. */
+  readonly indexerUrl?: string;
   readonly engineeringTelemetry?: EngineeringTelemetryBootstrapPolicyV1;
 };
 type BootstrapErrorKind = "notAuthenticated" | "network" | "provider" | "malformedBody" | "invalidInput" | "rateLimited";
@@ -904,6 +915,138 @@ interface AccountReadPort {
   fundFromFaucet(input: FundFromFaucetInput): Effect.Effect<FundFromFaucetResult, AccountReadError, never>;
 }
 //#endregion
+//#region src/ports/indexer-read.d.ts
+/**
+ * IndexerReadPort is the SDK's read seam onto the Ponder read model
+ * (`apps/indexer`). Ponder holds what the chain said; Convex holds what the
+ * user meant. Nothing here is copied into Convex, nothing waits for a
+ * finality tag, and no write path may read through this port.
+ *
+ * Every read is scoped to one Safe and one page. The indexer accepts only the
+ * exact compiled statements in `apps/indexer/src/queries.ts`, so the adapter
+ * that implements this port reproduces those statements byte for byte and the
+ * service refuses anything else with 403.
+ */
+/** One page of rows for one Safe. `offset` defaults to 0 (the first page). */
+interface IndexerReadInput {
+  /** The Safe the caller owns. The indexer refuses a Safe outside the session claim. */
+  readonly safe: Address$1;
+  /** 1 to 1000 inclusive — the indexer's own bound. */
+  readonly limit: number;
+  readonly offset?: number;
+  readonly eventId?: string;
+  /** Exact Payment lookup for a bounded set of actor-authorized settlement IDs. */
+  readonly settlements?: readonly string[];
+  /** Transfer occurrence time in epoch seconds; continuation excludes the last row. */
+  readonly timeline?: {
+    readonly from: number;
+    readonly to: number;
+    readonly before?: {
+      readonly timestamp: number;
+      readonly id: string;
+    };
+  };
+}
+/**
+ * The chain evidence every indexed row carries. `id` is the logical event id
+ * `chainId:txHash:transactionLogOrdinal`; it survives a reorg, so it is the
+ * key a Convex intent row stitches against.
+ */
+interface IndexerEventIdentity {
+  readonly id: string;
+  readonly chainId: ChainId;
+  readonly txHash: TxHash;
+  readonly transactionLogOrdinal: number;
+  /**
+   * The block-global log index of the same log, as the transaction receipt
+   * reports it. The ordinal above is the identity; this is the key Convex
+   * settles a Payment on (P12).
+   */
+  readonly logIndex: number;
+  readonly blockNumber: bigint;
+  readonly blockHash: string;
+  /** Block timestamp in epoch seconds. */
+  readonly timestamp: bigint;
+}
+interface IndexerTransferRow extends IndexerEventIdentity {
+  /** Timeline projection only. Null means no protocol event owns this Transfer. */
+  readonly paymentSettlementId?: string | null;
+  readonly assetId: AssetId;
+  readonly token: Address$1;
+  readonly from: Address$1;
+  readonly to: Address$1;
+  /**
+   * Raw token units, exact. This is an evidence boundary, so the row never
+   * carries Money or AssetAmount: the reader owns the asset's decimals.
+   */
+  readonly amount: bigint;
+}
+interface IndexerPaymentRow extends IndexerEventIdentity {
+  readonly contract: Address$1;
+  /** The protocol settlement id a Convex Payment command stitches against. */
+  readonly settlementId: string;
+  readonly sender: Address$1;
+  readonly recipient: Address$1;
+  readonly assetId: AssetId;
+  readonly token: Address$1;
+  /** Raw token units, exact. */
+  readonly amount: bigint;
+  readonly kind: number;
+  readonly documentHash: string;
+}
+/** A row of the indexer's signed-transfer `balance` view. */
+interface IndexerBalanceRow {
+  readonly chainId: ChainId;
+  readonly assetId: AssetId;
+  readonly address: Address$1;
+  /** Raw token units, exact. */
+  readonly amount: bigint;
+}
+/** One chain's sync position, from the indexer's native `/status` route. */
+interface IndexerChainStatus {
+  readonly chain: string;
+  readonly chainId: ChainId;
+  readonly blockNumber: bigint;
+  /** Block timestamp in epoch seconds. Its age is the freshness label. */
+  readonly blockTimestamp: bigint;
+}
+/**
+ * The tables this seam reads today. P04 adds the authority rows (`safe`,
+ * `safe_event`, `roles_module`) and P05 adds `commitment`: each is one more
+ * entry here plus its statement and decoder.
+ */
+interface IndexerRowsByTable {
+  readonly transfer: readonly IndexerTransferRow[];
+  readonly payment: readonly IndexerPaymentRow[];
+  readonly balance: readonly IndexerBalanceRow[];
+}
+type IndexerTable = keyof IndexerRowsByTable;
+declare const IndexerReadError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+  readonly _tag: "IndexerReadError";
+} & Readonly<A>;
+declare class IndexerReadError extends IndexerReadError_base<{
+  readonly operation: string;
+  readonly publicCode: CapxulErrorCode;
+  readonly publicError: CapxulError;
+  readonly cause: unknown;
+  readonly details?: CapxulErrorDetails;
+}> {}
+interface IndexerReadPort {
+  /** One page of rows, newest block first. An empty page is a value, not an error. */
+  read<T extends IndexerTable>(table: T, input: IndexerReadInput): Effect.Effect<IndexerRowsByTable[T], IndexerReadError>;
+  /**
+   * The same page over the indexer's live stream. The first snapshot is
+   * `loading`; each later snapshot carries the whole page again. The indexer
+   * closes the stream on token expiry or revoked authority, which arrives as
+   * one `error` snapshot — the caller re-reads with a refreshed token.
+   *
+   * @internal-use — substrate reactive transport, like `ConvexCallPort.subscribe`.
+   */
+  subscribe<T extends IndexerTable>(table: T, input: IndexerReadInput, callback: (snapshot: Snapshot<IndexerRowsByTable[T]>) => void): Effect.Effect<Unsubscribe, IndexerReadError>;
+  /** Sync position per chain. Unauthenticated: a stale index is not a refusal. */
+  readonly status: Effect.Effect<readonly IndexerChainStatus[], IndexerReadError>;
+}
+//#endregion
 //#region src/flows/types.d.ts
 /** The runtime port bundle that `assembleCapxulClient` uses. */
 interface FlowPorts {
@@ -916,6 +1059,11 @@ interface FlowPorts {
   readonly clock: ClockPort;
   readonly telemetry: TelemetryPort;
   readonly convexCall: ConvexCallPort;
+  /**
+   * The Ponder read seam (P02). Optional: it is present only when the client
+   * was given an indexer origin, and every existing flow works without it.
+   */
+  readonly indexerRead?: IndexerReadPort;
 }
 /** Legacy method input retained by the imperative auth surface. */
 interface ExternalSigner {
@@ -1153,10 +1301,17 @@ interface ResolvedTarget {
     readonly canPayout: boolean;
   };
 }
+/**
+ * R09 (#1967): the declared option type is the `InvocationControls` the money
+ * surface already forwards to `deps.invocationControls`, named here exactly as
+ * R02 named it on the address book and R13 on payroll. A caller that captured
+ * one user attempt can hand the same `correlation_id`/`journey_id` to the read
+ * it starts, so the read joins that attempt instead of standing alone.
+ * `{ signal }` callers are unaffected.
+ */
+type PaymentReadOptions = InvocationControls;
 interface TargetsMethods {
-  resolve(reference: TargetReference, options?: {
-    readonly signal?: AbortSignal;
-  }): Promise<CapxulResult<ResolvedTarget>>;
+  resolve(reference: TargetReference, options?: PaymentReadOptions): Promise<CapxulResult<ResolvedTarget>>;
 }
 type Ref$1 = {
   readonly kind: "handle";
@@ -1203,9 +1358,8 @@ interface MeMethods {
   get(options?: {
     readonly signal?: AbortSignal;
   }): Promise<CapxulResult<MeProfile>>;
-  depositInstructions(options?: {
-    readonly signal?: AbortSignal;
-  }): Promise<CapxulResult<DepositInstructions>>;
+  /** R08 (#1966): accepts a captured attempt, exactly as the treasury read does. */
+  depositInstructions(options?: InvocationControls): Promise<CapxulResult<DepositInstructions>>;
 }
 interface PaymentMoney {
   readonly currency: string;
@@ -1257,10 +1411,7 @@ interface Payment {
   readonly timing: PaymentTiming;
   readonly released: PaymentMoney;
   readonly availableToClaim: PaymentMoney;
-  readonly execution?: {
-    readonly status: PaymentExecutionStatus;
-    readonly retryRequired: boolean;
-  };
+  readonly execution?: PaymentExecutionView;
   readonly createdAt: number;
   readonly updatedAt: number;
 }
@@ -1410,6 +1561,7 @@ type ActivityReference = {
 };
 type ActivityItem = {
   readonly kind: "payment";
+  readonly execution?: PaymentExecutionView;
   readonly id: string;
   readonly ledgerKind: "Payment" | "Payout" | "Deposit";
   readonly status: PaymentStatus;
@@ -1440,6 +1592,8 @@ type ActivityItem = {
   readonly updatedAt: number;
 };
 interface ActivityPage {
+  /** Usable fallback data omits indexed movements; never present it as complete. */
+  readonly readWarning?: "indexer-unavailable";
   readonly items: readonly ActivityItem[];
   readonly cursor: string | null;
   readonly checkpoint: number;
@@ -1461,6 +1615,7 @@ interface ActivitySummaryTotal {
   readonly pendingIn: string;
 }
 interface ActivitySummary {
+  readonly readWarning?: ActivityPage["readWarning"];
   readonly window: {
     readonly from: number | null;
     readonly to: number | null;
@@ -1551,20 +1706,30 @@ interface ActivityAnnotationInput {
   readonly accountingCategory?: string;
   readonly memo?: string;
 }
+/**
+ * #1960 R02: the declared option type is the `InvocationControls` these methods
+ * have always forwarded to `deps.invocationControls`, so an Activity action can
+ * carry the correlation its UI observation already used. `{ signal }` callers
+ * are unaffected.
+ */
 interface ActivityMethods {
-  list(params?: ActivityListParams, options?: {
-    readonly signal?: AbortSignal;
-  }): Promise<CapxulResult<ActivityPage>>;
-  summary(params?: ActivitySummaryParams, options?: {
-    readonly signal?: AbortSignal;
-  }): Promise<CapxulResult<ActivitySummary>>;
-  get(reference: ActivityReference, options?: {
-    readonly signal?: AbortSignal;
+  /**
+   * Tell the caller when the indexed page for this actor's Safe changed, over
+   * the indexer's one live connection. The callback carries no rows: it is the
+   * signal to re-read `list` or `summary`. Without an indexer this resolves a
+   * no-op teardown, so a caller needs no branch.
+   *
+   * @internal-use — substrate reactive transport, like `ConvexCallPort.subscribe`.
+   */
+  subscribe(onChange: () => void, params?: {
+    readonly actor?: ActorReference;
+  }, options?: InvocationControls): Promise<CapxulResult<() => void>>;
+  list(params?: ActivityListParams, options?: InvocationControls): Promise<CapxulResult<ActivityPage>>;
+  summary(params?: ActivitySummaryParams, options?: InvocationControls): Promise<CapxulResult<ActivitySummary>>;
+  get(reference: ActivityReference, options?: InvocationControls & {
     readonly actor?: ActorReference;
   }): Promise<CapxulResult<ActivityDetail | null>>;
-  annotate(input: ActivityAnnotationInput, options?: {
-    readonly signal?: AbortSignal;
-  }): Promise<CapxulResult<ActivityAnnotation>>;
+  annotate(input: ActivityAnnotationInput, options?: InvocationControls): Promise<CapxulResult<ActivityAnnotation>>;
 }
 interface OfframpQuoteInput {
   readonly actor?: ActorReference;
@@ -1632,12 +1797,8 @@ interface PaymentsMethods {
   claim(paymentId: string, options?: {
     readonly signal?: AbortSignal;
   }): Promise<CapxulResult<Payment>>;
-  list(options?: {
-    readonly signal?: AbortSignal;
-  }): Promise<CapxulResult<readonly Payment[]>>;
-  get(paymentId: string, options?: {
-    readonly signal?: AbortSignal;
-  }): Promise<CapxulResult<Payment | null>>;
+  list(options?: PaymentReadOptions): Promise<CapxulResult<readonly Payment[]>>;
+  get(paymentId: string, options?: PaymentReadOptions): Promise<CapxulResult<Payment | null>>;
   cancel(paymentId: string, options?: {
     readonly signal?: AbortSignal;
   }): Promise<CapxulResult<Payment>>;
@@ -1718,25 +1879,19 @@ interface AddressBookLabelInput {
 interface AddressBookListInput {
   readonly includeHidden?: boolean;
 }
+/**
+ * #1960 R02: the declared option type is the `InvocationControls` these methods
+ * have always forwarded to `deps.invocationControls`. Naming it lets a caller
+ * that captured one user attempt hand the same `correlation_id`/`journey_id` to
+ * the operation the attempt starts. `{ signal }` callers are unaffected.
+ */
 interface AddressBookMethods {
-  list(input?: AddressBookListInput, options?: {
-    readonly signal?: AbortSignal;
-  }): Promise<CapxulResult<readonly AddressBookEntry[]>>;
-  get(entryId: PartyId, options?: {
-    readonly signal?: AbortSignal;
-  }): Promise<CapxulResult<AddressBookEntry | null>>;
-  add(input: AddressBookAddInput, options?: {
-    readonly signal?: AbortSignal;
-  }): Promise<CapxulResult<AddressBookEntry>>;
-  hide(entryId: PartyId, options?: {
-    readonly signal?: AbortSignal;
-  }): Promise<CapxulResult<AddressBookEntry>>;
-  unhide(entryId: PartyId, options?: {
-    readonly signal?: AbortSignal;
-  }): Promise<CapxulResult<AddressBookEntry>>;
-  label(input: AddressBookLabelInput, options?: {
-    readonly signal?: AbortSignal;
-  }): Promise<CapxulResult<AddressBookEntry>>;
+  list(input?: AddressBookListInput, options?: InvocationControls): Promise<CapxulResult<readonly AddressBookEntry[]>>;
+  get(entryId: PartyId, options?: InvocationControls): Promise<CapxulResult<AddressBookEntry | null>>;
+  add(input: AddressBookAddInput, options?: InvocationControls): Promise<CapxulResult<AddressBookEntry>>;
+  hide(entryId: PartyId, options?: InvocationControls): Promise<CapxulResult<AddressBookEntry>>;
+  unhide(entryId: PartyId, options?: InvocationControls): Promise<CapxulResult<AddressBookEntry>>;
+  label(input: AddressBookLabelInput, options?: InvocationControls): Promise<CapxulResult<AddressBookEntry>>;
 }
 interface ActorRequest {
   readonly id: string;
@@ -1753,19 +1908,17 @@ interface ActorRequestIssueInput {
   readonly memo?: string;
   readonly expiresAt?: number;
 }
+/**
+ * The issuer's own requests. The options are the address book's
+ * `InvocationControls` (R07 #1965), so a caller that captured one browser
+ * attempt hands it to the operation that attempt started; `{ signal }` callers
+ * are unaffected.
+ */
 interface ActorRequestsMethods {
-  issue(input: ActorRequestIssueInput, options?: {
-    readonly signal?: AbortSignal;
-  }): Promise<CapxulResult<ActorRequest>>;
-  list(options?: {
-    readonly signal?: AbortSignal;
-  }): Promise<CapxulResult<readonly ActorRequest[]>>;
-  get(requestId: string, options?: {
-    readonly signal?: AbortSignal;
-  }): Promise<CapxulResult<ActorRequest | null>>;
-  cancel(requestId: string, options?: {
-    readonly signal?: AbortSignal;
-  }): Promise<CapxulResult<ActorRequest>>;
+  issue(input: ActorRequestIssueInput, options?: InvocationControls): Promise<CapxulResult<ActorRequest>>;
+  list(options?: InvocationControls): Promise<CapxulResult<readonly ActorRequest[]>>;
+  get(requestId: string, options?: InvocationControls): Promise<CapxulResult<ActorRequest | null>>;
+  cancel(requestId: string, options?: InvocationControls): Promise<CapxulResult<ActorRequest>>;
 }
 interface InboxItem {
   readonly id: string;
@@ -1779,24 +1932,18 @@ interface InboxApproveInput {
   readonly timing?: PaymentTiming;
   readonly permissionId?: string;
 }
+/** The payer's own inbox. Its scope is the payer's, never the issuer's. */
 interface InboxMethods {
-  list(options?: {
-    readonly signal?: AbortSignal;
-  }): Promise<CapxulResult<readonly InboxItem[]>>;
-  approve(input: InboxApproveInput, options?: {
-    readonly signal?: AbortSignal;
-  }): Promise<CapxulResult<Payment>>;
-  decline(requestId: string, options?: {
-    readonly signal?: AbortSignal;
-  }): Promise<CapxulResult<InboxItem>>;
+  list(options?: InvocationControls): Promise<CapxulResult<readonly InboxItem[]>>;
+  approve(input: InboxApproveInput, options?: InvocationControls): Promise<CapxulResult<Payment>>;
+  decline(requestId: string, options?: InvocationControls): Promise<CapxulResult<InboxItem>>;
 }
 interface ActorProfileMethods {
   get(options?: {
     readonly signal?: AbortSignal;
   }): Promise<CapxulResult<ActorProfile>>;
-  depositInstructions(options?: {
-    readonly signal?: AbortSignal;
-  }): Promise<CapxulResult<DepositInstructions>>;
+  /** R08 (#1966): accepts a captured attempt, exactly as the treasury read does. */
+  depositInstructions(options?: InvocationControls): Promise<CapxulResult<DepositInstructions>>;
 }
 interface ActorRelationshipMethods {
   readonly addressBook: AddressBookMethods;
@@ -1957,6 +2104,12 @@ type ListOrgRolesInput = {
 type ListOrgMembersInput = {
   readonly orgId: OrgId;
 };
+/**
+ * R06 (#1964): the program attaches the caller's captured attempt to this
+ * record through `copyInvocationObservation`, so the adapter forwards one
+ * observation context to the backend action that owns `org_invite_sent`. The
+ * carrier is a non-enumerable symbol and never becomes a wire field.
+ */
 type InviteOrgMemberInput = {
   readonly orgId: OrgId;
   readonly input: InviteMemberInput;
@@ -2218,9 +2371,15 @@ interface AuthorizeRunInput {
    */
   readonly requestKey?: string;
 }
-type PayrollOptions = {
-  readonly signal?: AbortSignal;
-};
+/**
+ * R13 (#1968): the declared option type is the `InvocationControls` these
+ * methods have always forwarded to `deps.invocationControls` — the same naming
+ * R02 gave the address book. It lets a caller that captured one browser attempt
+ * hand that attempt's `correlation_id`/`journey_id` to the payroll operation it
+ * starts, so `ui_payroll_action_completed` and the durable group and run events
+ * share a correlation. `{ signal }` callers are unaffected.
+ */
+type PayrollOptions = InvocationControls;
 type AuthorizeRunOptions = PayrollOptions & {
   /** Persist this SDK-allocated key before the first backend write. Reject to prevent execution. */
   readonly onRequestKey?: (key: string) => void | Promise<void>;
@@ -2370,14 +2529,15 @@ interface OrgScopedMethods extends ActorRelationshipMethods {
   retrySetup(options?: {
     readonly signal?: AbortSignal;
   }): Promise<CapxulResult<OrgLifecycle>>;
-  /** The Organization treasury Account. */
-  treasury(options?: {
-    readonly signal?: AbortSignal;
-  }): Promise<CapxulResult<Account$1>>;
+  /**
+   * The Organization treasury Account. R08 (#1966): the declared option type is
+   * the `InvocationControls` this surface already forwards, so a screen that
+   * captured one user attempt can hand the same `correlation_id`/`journey_id`
+   * to the read it starts. `{ signal }` callers are unaffected.
+   */
+  treasury(options?: InvocationControls): Promise<CapxulResult<Account$1>>;
   readonly account: {
-    get(options?: {
-      readonly signal?: AbortSignal;
-    }): Promise<CapxulResult<OrganizationAccount>>;
+    get(options?: InvocationControls): Promise<CapxulResult<OrganizationAccount>>;
   };
   members(options?: {
     readonly signal?: AbortSignal;
@@ -2385,9 +2545,14 @@ interface OrgScopedMethods extends ActorRelationshipMethods {
   roles(options?: {
     readonly signal?: AbortSignal;
   }): Promise<CapxulResult<readonly RoleView[]>>;
-  invite(input: InviteMemberInput, options?: {
-    readonly signal?: AbortSignal;
-  }): Promise<CapxulResult<MemberView>>;
+  /**
+   * Invite a member by email. `options` is the browser attempt the caller
+   * captured before the person pressed the button (R06 #1964); it reaches the
+   * backend action unchanged, so the durable `org_invite_sent` and the later
+   * `org_invite_progressed` share the attempt's correlation. `{ signal }`
+   * callers are unaffected.
+   */
+  invite(input: InviteMemberInput, options?: InvocationControls): Promise<CapxulResult<MemberView>>;
   /**
    * Leak-safe Organization payment: execute through the payments engine with
    * the selected receipt-verified Budget Permission
@@ -2486,11 +2651,11 @@ interface MediaMethods {
 }
 //#endregion
 //#region src/contract/system.d.ts
-/** What `system:health` answers. */
+/** What `system:healthObserved` answers. */
 interface SystemHealth {
   /** The nonce the caller sent, as the backend saw it. */
   readonly nonce: string;
-  /** Deployment that answered, e.g. `little-sandpiper-974`. */
+  /** Deployment that answered, e.g. `api` for the Railway staging host. */
   readonly deployment: string;
   /** Backend clock at execution (epoch ms). */
   readonly at: number;
@@ -2602,6 +2767,8 @@ interface IdentityRuntime {
   readonly runFacade?: <T>(verb: IdentityFacadeVerb, controls: InvocationControls | undefined, run: (controls: InvocationControls) => Promise<T>) => Promise<T>;
 }
 interface CapxulClient {
+  /** Stop this client's resources. Repeated calls share the same cleanup. */
+  close(): Promise<CapxulResult<void>>;
   readonly auth: AuthMethods;
   readonly smartAccount: SmartAccountMethods;
   readonly identity: IdentityMethods;
@@ -2676,6 +2843,13 @@ interface CapxulClient {
      * NOT on the public `client.accounts` surface.
      */
     readonly accounts: AccountsFaucetMethods;
+    /**
+     * Ponder read seam (P02). Present only when the client was built with an
+     * indexer origin, so every reader treats it as optional. Ponder holds what
+     * the chain said; Convex holds what the user meant. Reads here never run
+     * inside a write path and never wait for a finality tag.
+     */
+    readonly indexer?: IndexerReadPort;
     /** Quarantined Reference-harness evidence; never a product Organization method. */
     readonly organizationSetup: OrganizationSetupProofMethods;
     /** Product telemetry projection for internal composition and test harnesses. */
@@ -2771,6 +2945,10 @@ interface PostHogObservabilityClient {
 interface PostHogObservabilityOptions {
   /** Consent / kill-switch seam. Defaults to enabled. */
   readonly enabled?: boolean | (() => boolean);
+  /** Omission preserves bootstrap engineering. False/throw closes the acquired runtime's collection. */
+  readonly engineeringEnabled?: boolean | (() => boolean);
+  /** Opt in to code/timing/correlation-only engineering exports. Omission preserves full safe diagnostics. */
+  readonly engineeringPrivacy?: "minimal";
   /** Host environment stamped on every SDK-owned product event. */
   readonly capxulEnv?: CapxulEnv;
   /** Host-owned correlation context shared by product and failure delivery. */
@@ -2875,4 +3053,59 @@ interface ObservationAdapter {
 /** Stable PostHog event used for typed failures that are expected product outcomes. */
 declare const CAPXUL_SDK_EXPECTED_OUTCOME_EVENT = "capxul_sdk_expected_outcome";
 //#endregion
-export { OrganizationPaymentItemInput as $, TelemetryGroupInput as $n, DestinationKind as $t, OrgView as A, TargetReference as An, AddressBookLabelInput as At, PayrollGroup as B, OrgLifecycle as Bn, ActivityKind as Bt, DetectPendingOrgInvitationsResult as C, PaymentTiming as Cn, ActorProfileMethods as Ct, OrgMethods as D, RecipientResolution as Dn, ActorRequestsMethods as Dt, MemberView as E, PaymentsPayInput as En, ActorRequestIssueInput as Et, RoleSpendCap as F, isSettingUpLifecycle as Fn, ActivityAnnotation as Ft, PayrollOptions as G, Permission as Gn, ActivityReference as Gt, PayrollGroupMember as H, PayoutAddress as Hn, ActivityMethods as Ht, RoleView as I, CompleteProfileInput as In, ActivityAnnotationInput as It, PayrollRunStatus as J, PAYMENT_DIRECTIONS as Jn, ActivitySummaryTotal as Jt, PayrollRun as K, SubmittedPermissionExecution as Kn, ActivitySummary as Kt, AuthorizeRunInput as L, IdentityMethods as Ln, ActivityDetail as Lt, OrganizationAuditLogItem as M, fingerprintPaymentIntent as Mn, InboxApproveInput as Mt, ResendInviteTokenInput as N, AccountLifecycle as Nn, InboxItem as Nt, OrgScopedMethods as O, Ref$1 as On, AddressBookAddInput as Ot, RoleDefinition as P, AccountSetupStep as Pn, InboxMethods as Pt, OrganizationPaymentInput as Q, TelemetryEvent as Qn, DestinationAddInput as Qt, AuthorizeRunOptions as R, SmartAccountMethods as Rn, ActivityFilter as Rt, CreateOrgInput as S, PaymentStatus as Sn, ActorProfile as St, MemberStatus as T, PaymentsMethods as Tn, ActorRequest as Tt, PayrollGroupsMethods as U, ActorRef as Un, ActivityPage as Ut, PayrollGroupInput as V, OrgSetupStep as Vn, ActivityListParams as Vt, PayrollMethods as W, CurrentHoldings as Wn, ActivityRange as Wt, PayrollTermsUnit as X, PaymentStatus$1 as Xn, DepositInstructions as Xt, PayrollRuns as Y, PAYMENT_STATUSES as Yn, ActorReference as Yt, OrganizationPaymentBatchInput as Z, RequestStatus as Zn, Destination as Zt, SystemMethods as _, PaymentDocumentRef as _n, OrganizationOnboardingInput as _t, SdkFailureObservation as a, FinancialOpsMethods as an, OrgLane as ar, PermissionOptions as at, CurrentUserContext as b, PaymentDocumentsMethods as bn, ReadyAccountLifecycle as bt, PostHogObservabilityOptions as c, MovementActivityEvidence as cn, destination as cr, PermissionReadResult as ct, CreateCapxulClientInput as d, OfframpQuoteInput as dn, IdentityTransition as dr, OrgMeMethod as dt, DestinationListInput as en, TelemetryIdentifyInput as er, OrganizationPaymentsMethods as et, IdentityProfileDetails as f, OfframpStatus as fn, InvocationControls as fr, OrgMeOptions as ft, Holding as g, PaymentDocumentKind as gn, OrganizationOnboarding as gt, HoldingsMethods as h, PaymentDirection as hn, OnboardingMethods as ht, ObservationDelivery as i, DestinationsMethods as in, IdentityState as ir, PermissionMethods as it, OrganizationAccount as j, TargetsMethods as jn, AddressBookMethods as jt, OrgTemplate as k, ResolvedTarget as kn, AddressBookEntry as kt, postHogObservability as l, OfframpMethods as ln, isClaimed as lr, Budget as lt, IdentityRuntimeSendResult as m, PaymentActivityEvidence as mn, CompletedPersonProfile as mt, ObservationAdapter as n, DestinationRail as nn, Destination$1 as nr, PermissionChangeInput as nt, HostObservability as o, MeMethods as on, Readiness as or, PermissionReplaceInput as ot, IdentityRuntime as p, Payment as pn, AccountsMethods as pt, PayrollRunItemInput as q, InboxStatus as qn, ActivitySummaryParams as qt, ObservationContext as r, DestinationRemoveInput as rn, IdentityEvent as rr, PermissionCreateInput as rt, PostHogObservabilityClient as s, MeProfile as sn, StateLabel as sr, PermissionRevokeInput as st, CAPXUL_SDK_EXPECTED_OUTCOME_EVENT as t, DestinationPayload as tn, TelemetryPort as tr, PermissionAssignInput as tt, CapxulClient as u, OfframpQuote as un, isRestoring as ur, OrgMe as ut, SystemHealth as v, PaymentDocumentRender as vn, PersonOnboarding as vt, InviteMemberInput as w, PaymentType as wn, ActorRelationshipMethods as wt, CurrentUserMethods as x, PaymentMoney as xn, AccountMethods as xt, MediaMethods as y, PaymentDocumentVerification as yn, PersonOnboardingInput as yt, PayrollEngagementTerms as z, AuthMethods as zn, ActivityItem as zt };
+//#region src/ports/diagnostic.d.ts
+type DiagnosticDetail = Readonly<Record<string, unknown>>;
+interface DiagnosticPort {
+  readonly trace: (scope: string, detail: DiagnosticDetail) => void;
+}
+//#endregion
+//#region src/openfort/create-openfort-browser-signer.d.ts
+interface OpenfortBrowserSignerOptions {
+  readonly diagnostic?: DiagnosticPort;
+  /** Testing seam below the existing one-retry recovery owner. */
+  readonly signUserOpHash?: ((hash: Parameters<CapxulSigner["signUserOpHash"]>[0], delegate: CapxulSigner["signUserOpHash"]) => ReturnType<CapxulSigner["signUserOpHash"]>) | undefined;
+}
+//#endregion
+//#region src/production.d.ts
+/**
+ * Consumer-facing `createCapxulClient` input (SDK DX public surface · #326).
+ * The publishable key is the primary input; bootstrap host, invoke timeout,
+ * runtime detection, and auth-cache selection are SDK-owned defaults.
+ */
+interface CapxulClientInput {
+  readonly publishableKey: string;
+  /** Public Capxul bootstrap origin; defaults remain unchanged when omitted. */
+  readonly bootstrapBaseUrl?: string;
+  /**
+   * One host-owned product/failure observability module around the host's
+   * existing analytics client. Omit for zero host observation work.
+   */
+  readonly observability?: HostObservability;
+  /**
+   * Init-time account readiness target (issue #159 · AC4). Threaded into
+   * `assembleCapxulClient` so `client.account.{getStatus,ensureReady}` reflect
+   * the consumer's chosen requirement. Optional — defaults to `"none"` (SDK
+   * publish readiness · I3) so `createCapxulClient({ publishableKey })` works
+   * with no account lane.
+   */
+  readonly requirement?: AccountRequirement;
+  /**
+   * Consumer-held signer (backend-orchestrated-deploy.md). Required for
+   * `requirement: "deployed"` flows: `provision` reads `getAddress()` and the
+   * deploy path signs the backend's SafeOp digest via `signUserOpHash()`. The
+   * backend orchestrates build + gas + paymaster + submit — the client never
+   * holds an RPC URL, a gas-sponsorship policy, or a bundler.
+   */
+  readonly signer?: CapxulSigner;
+}
+/** Per-client signing controls; only the testing entry exposes these to consumers. */
+interface ProductionSignerControls {
+  /** Final signing call. Address, readiness and session lifecycle retain their real owner. */
+  readonly signUserOpHash?: (hash: Parameters<CapxulSigner["signUserOpHash"]>[0], signer: CapxulSigner & {
+    readonly resetSession?: () => void;
+  }) => ReturnType<CapxulSigner["signUserOpHash"]>;
+  /** Embedded signing calls, including the existing recovery owner's single retry. */
+  readonly signEmbeddedUserOpHash?: OpenfortBrowserSignerOptions["signUserOpHash"];
+}
+//#endregion
+export { OrganizationPaymentBatchInput as $, RequestStatus as $n, Destination as $t, OrgScopedMethods as A, Ref$1 as An, AddressBookAddInput as At, AuthorizeRunOptions as B, SmartAccountMethods as Bn, ActivityFilter as Bt, CurrentUserMethods as C, PaymentMoney as Cn, AccountMethods as Ct, MemberStatus as D, PaymentsMethods as Dn, ActorRequest as Dt, InviteMemberInput as E, PaymentType as En, ActorRelationshipMethods as Et, ResendInviteTokenInput as F, AccountLifecycle as Fn, InboxItem as Ft, PayrollGroupsMethods as G, ActorRef as Gn, ActivityPage as Gt, PayrollGroup as H, OrgLifecycle as Hn, ActivityKind as Ht, RoleDefinition as I, AccountSetupStep as In, InboxMethods as It, PayrollRun as J, SubmittedPermissionExecution as Jn, ActivitySummary as Jt, PayrollMethods as K, CurrentHoldings as Kn, ActivityRange as Kt, RoleSpendCap as L, isSettingUpLifecycle as Ln, ActivityAnnotation as Lt, OrgView as M, TargetReference as Mn, AddressBookLabelInput as Mt, OrganizationAccount as N, TargetsMethods as Nn, AddressBookMethods as Nt, MemberView as O, PaymentsPayInput as On, ActorRequestIssueInput as Ot, OrganizationAuditLogItem as P, fingerprintPaymentIntent as Pn, InboxApproveInput as Pt, PayrollTermsUnit as Q, PaymentStatus$1 as Qn, DepositInstructions as Qt, RoleView as R, CompleteProfileInput as Rn, ActivityAnnotationInput as Rt, CurrentUserContext as S, PaymentDocumentsMethods as Sn, ReadyAccountLifecycle as St, DetectPendingOrgInvitationsResult as T, PaymentTiming as Tn, ActorProfileMethods as Tt, PayrollGroupInput as U, OrgSetupStep as Un, ActivityListParams as Ut, PayrollEngagementTerms as V, AuthMethods as Vn, ActivityItem as Vt, PayrollGroupMember as W, PayoutAddress as Wn, ActivityMethods as Wt, PayrollRunStatus as X, PAYMENT_DIRECTIONS as Xn, ActivitySummaryTotal as Xt, PayrollRunItemInput as Y, InboxStatus as Yn, ActivitySummaryParams as Yt, PayrollRuns as Z, PAYMENT_STATUSES as Zn, ActorReference as Zt, HoldingsMethods as _, PaymentDirection as _n, OnboardingMethods as _t, ObservationContext as a, DestinationRemoveInput as an, IdentityEvent as ar, PermissionCreateInput as at, SystemHealth as b, PaymentDocumentRender as bn, PersonOnboarding as bt, HostObservability as c, MeMethods as cn, Readiness as cr, PermissionReplaceInput as ct, postHogObservability as d, OfframpMethods as dn, isClaimed as dr, Budget as dt, DestinationAddInput as en, TelemetryEvent as er, OrganizationPaymentInput as et, CapxulClient as f, OfframpQuote as fn, isRestoring as fr, OrgMe as ft, IdentityRuntimeSendResult as g, PaymentActivityEvidence as gn, CompletedPersonProfile as gt, IdentityRuntime as h, Payment as hn, AccountsMethods as ht, ObservationAdapter as i, DestinationRail as in, Destination$1 as ir, PermissionChangeInput as it, OrgTemplate as j, ResolvedTarget as jn, AddressBookEntry as jt, OrgMethods as k, RecipientResolution as kn, ActorRequestsMethods as kt, PostHogObservabilityClient as l, MeProfile as ln, StateLabel as lr, PermissionRevokeInput as lt, IdentityProfileDetails as m, OfframpStatus as mn, InvocationControls as mr, OrgMeOptions as mt, ProductionSignerControls as n, DestinationListInput as nn, TelemetryIdentifyInput as nr, OrganizationPaymentsMethods as nt, ObservationDelivery as o, DestinationsMethods as on, IdentityState as or, PermissionMethods as ot, CreateCapxulClientInput as p, OfframpQuoteInput as pn, IdentityTransition as pr, OrgMeMethod as pt, PayrollOptions as q, Permission as qn, ActivityReference as qt, CAPXUL_SDK_EXPECTED_OUTCOME_EVENT as r, DestinationPayload as rn, TelemetryPort as rr, PermissionAssignInput as rt, SdkFailureObservation as s, FinancialOpsMethods as sn, OrgLane as sr, PermissionOptions as st, CapxulClientInput as t, DestinationKind as tn, TelemetryGroupInput as tr, OrganizationPaymentItemInput as tt, PostHogObservabilityOptions as u, MovementActivityEvidence as un, destination as ur, PermissionReadResult as ut, Holding as v, PaymentDocumentKind as vn, OrganizationOnboarding as vt, CreateOrgInput as w, PaymentStatus as wn, ActorProfile as wt, MediaMethods as x, PaymentDocumentVerification as xn, PersonOnboardingInput as xt, SystemMethods as y, PaymentDocumentRef as yn, OrganizationOnboardingInput as yt, AuthorizeRunInput as z, IdentityMethods as zn, ActivityDetail as zt };