@capxul/sdk 4.20.0-beta.5 → 4.20.0-beta.6

package/dist/{production-DAhaxUik.d.mts → production-pLe7MsUo.d.mts}

@@ -1,4 +1,4 @@
-import { $ as OrgId, A as Address$1, B as BudgetId, C as AuthCachePort, Ct as Failure, D as Account$1, G as CurrencyCode, H as ClientGrantId, I as AssetId, K as DocumentHash, L as AuthSession, M as AllowedOrigin, N as AnonymousDistinctId, O as AccountId, P as AppId, Q as Money, R as AuthUserId, U as ClientRequestId, V as ChainId, W as CountryCode, X as EpochMs, Y as Email, Z as Handle, _ as Session$1, at as PermissionId, b as AuthClientPort, bt as CapxulErrorCode, ct as RoleKey, d as AccountRequirement, dt as TesterKind, et as PartyId, ft as TxHash, g as Profile$1, h as CapxulResult, i as CapxulSigner, it as PermissionAssignmentId, j as AllowanceKey, k as AccountPosition, kt as FailureMode, lt as SessionToken, nt as PayrollGroupId, ot as Profile, pt as WeiAmount, q as DurationMs, rt as PayrollRunId, s as SignerStatusStore, st as PublishableKey, tt as PaymentCommandId, u as AccountProviderSource, ut as SmartAccount, v as SmartAccount$1, x as CanSendOtpStatus, xt as CapxulErrorDetails, y as ClockPort, yt as CapxulError, z as BlockNumber } from "./OAuthBearerAuthClient-BAxoi3SD.mjs";
+import { $ as OrgId, A as Address$1, B as BudgetId, C as AuthCachePort, Ct as CapxulErrorDetails, D as Account$1, F as AssetAmount, G as CurrencyCode, H as ClientGrantId, I as AssetId, K as DocumentHash, L as AuthSession, M as AllowedOrigin, N as AnonymousDistinctId, O as AccountId, P as AppId, R as AuthUserId, St as CapxulErrorCode, Tt as Failure, U as ClientRequestId, V as ChainId, W as CountryCode, X as EpochMs, Y as Email, Z as Handle, _ as Session$1, at as PermissionId, b as AuthClientPort, ct as RoleKey, d as AccountRequirement, dt as TesterKind, et as PartyId, ft as TxHash, g as Profile$1, h as CapxulResult, i as CapxulSigner, it as PermissionAssignmentId, j as AllowanceKey, jt as FailureMode, k as AccountPosition, lt as SessionToken, nt as PayrollGroupId, ot as Profile, pt as WeiAmount, q as DurationMs, rt as PayrollRunId, s as SignerStatusStore, st as PublishableKey, tt as PaymentCommandId, u as AccountProviderSource, ut as SmartAccount, v as SmartAccount$1, x as CanSendOtpStatus, xt as CapxulError, y as ClockPort, z as BlockNumber } from "./OAuthBearerAuthClient-B7Nbepmu.mjs";
 import { Hex } from "viem";
 import { Context, Duration, Effect, Layer, Logger, Metric, References, Schema, Scope, Tracer } from "effect";
 import { FunctionReference } from "convex/server";
@@ -191,6 +191,11 @@ type IdentityEvent = {
   readonly _tag: "RestoreSession";
   readonly session: Session;
   readonly profileComplete: boolean;
+} | {
+  readonly _tag: "RestoreOtpEntry";
+  readonly email: string;
+  readonly requestedAt: number;
+  readonly now: number;
 } | {
   readonly _tag: "ResumeOtpEntry";
   readonly now: number;
@@ -347,9 +352,6 @@ type PaymentDirection$1 = (typeof PAYMENT_DIRECTIONS)[number];
 /** What a payment is FOR. Pairs with `PAYMENT_DOCUMENT_KINDS`. */
 declare const PAYMENT_TYPES: readonly ["unspecified", "invoice", "payroll", "reimbursement"];
 type PaymentType$1 = (typeof PAYMENT_TYPES)[number];
-/** Attachable document kinds; each maps to exactly one `PaymentType`. */
-declare const PAYMENT_DOCUMENT_KINDS: readonly ["memo", "invoice", "payslip", "receipt", "withdrawal"];
-type PaymentDocumentKind$1 = (typeof PAYMENT_DOCUMENT_KINDS)[number];
 /** Lifecycle of a payment REQUEST as its issuer sees it. */
 declare const REQUEST_STATUSES: readonly ["draft", "sent", "viewed", "pending_settlement", "paid", "declined", "cancelled", "expired"];
 type RequestStatus = (typeof REQUEST_STATUSES)[number];
@@ -469,7 +471,9 @@ declare const PermissionSchema: Schema.Struct<{
   readonly state: Schema.Literals<readonly ["pending", "active", "suspended", "revoked", "superseded"]>;
   readonly revision: Schema.refine<number, Schema.Number>;
   readonly roleKey: Schema.Codec<RoleKey, string, never, never>;
+  readonly assetId: Schema.optional<Schema.refine<AssetId, Schema.String>>;
   readonly tokenAddress: Schema.optional<Schema.Codec<Address$1, string, never, never>>;
+  readonly decimals: Schema.optional<Schema.refine<number, Schema.Number>>;
   readonly limitRaw: Schema.optional<Schema.Codec<WeiAmount, string, never, never>>;
   readonly allowanceKey: Schema.optional<Schema.Codec<AllowanceKey, string, never, never>>;
 }>;
@@ -520,14 +524,25 @@ declare const PaymentCommandLineageSchema: Schema.Union<readonly [Schema.Struct<
   readonly requestId: Schema.refine<string, Schema.String>;
 }>]>;
 type PaymentCommandLineage = Schema.Schema.Type<typeof PaymentCommandLineageSchema>;
-declare const PermissionIntentSchema: Schema.Union<readonly [Schema.Struct<{
+declare const PermissionIntentSchema: Schema.Union<readonly [Schema.refine<{
+  readonly type: "budget";
+  readonly asset: AssetId;
+  readonly limit: {
+    readonly asset: AssetId;
+    readonly value: string;
+    readonly currency?: undefined;
+    readonly decimals?: undefined;
+  } | null;
+}, Schema.Struct<{
   readonly type: Schema.Literal<"budget">;
-  readonly limit: Schema.Struct<{
-    readonly currency: Schema.Codec<CurrencyCode, string, never, never>;
+  readonly asset: Schema.refine<AssetId, Schema.String>;
+  readonly limit: Schema.NullOr<Schema.Struct<{
+    readonly asset: Schema.refine<AssetId, Schema.String>;
     readonly value: Schema.String;
-    readonly decimals: Schema.Number;
-  }>;
-}>, Schema.Struct<{
+    readonly currency: Schema.optional<Schema.Never>;
+    readonly decimals: Schema.optional<Schema.Never>;
+  }>>;
+}>>, Schema.Struct<{
   readonly type: Schema.Literal<"managePeople">;
 }>]>;
 type PermissionIntent = Schema.Schema.Type<typeof PermissionIntentSchema>;
@@ -543,7 +558,9 @@ declare const SubmittedPermissionExecutionSchema: Schema.Struct<{
     readonly state: Schema.Literals<readonly ["pending", "active", "suspended", "revoked", "superseded"]>;
     readonly revision: Schema.refine<number, Schema.Number>;
     readonly roleKey: Schema.Codec<RoleKey, string, never, never>;
+    readonly assetId: Schema.optional<Schema.refine<AssetId, Schema.String>>;
     readonly tokenAddress: Schema.optional<Schema.Codec<Address$1, string, never, never>>;
+    readonly decimals: Schema.optional<Schema.refine<number, Schema.Number>>;
     readonly limitRaw: Schema.optional<Schema.Codec<WeiAmount, string, never, never>>;
     readonly allowanceKey: Schema.optional<Schema.Codec<AllowanceKey, string, never, never>>;
   }>, Schema.Struct<{
@@ -564,7 +581,9 @@ declare const SubmittedPermissionExecutionSchema: Schema.Struct<{
     readonly state: Schema.Literals<readonly ["pending", "active", "suspended", "revoked", "superseded"]>;
     readonly revision: Schema.refine<number, Schema.Number>;
     readonly roleKey: Schema.Codec<RoleKey, string, never, never>;
+    readonly assetId: Schema.optional<Schema.refine<AssetId, Schema.String>>;
     readonly tokenAddress: Schema.optional<Schema.Codec<Address$1, string, never, never>>;
+    readonly decimals: Schema.optional<Schema.refine<number, Schema.Number>>;
     readonly limitRaw: Schema.optional<Schema.Codec<WeiAmount, string, never, never>>;
     readonly allowanceKey: Schema.optional<Schema.Codec<AllowanceKey, string, never, never>>;
   }>>]>;
@@ -575,6 +594,50 @@ type PayrollRunStatus$1 = Schema.Schema.Type<typeof PayrollRunStatusSchema>;
 declare const PayrollTermsUnitSchema: Schema.Literals<readonly ["hour", "week", "month", "year", "paycheck"]>;
 type PayrollTermsUnit$1 = Schema.Schema.Type<typeof PayrollTermsUnitSchema>;
 //#endregion
+//#region ../wire/src/payment-document.d.ts
+declare const DocumentRefV3Schema: Schema.Struct<{
+  readonly documentHash: Schema.String;
+  readonly contentHash: Schema.String;
+  readonly kind: Schema.Literals<readonly ["memo", "invoice", "payslip", "receipt"]>;
+  readonly format: Schema.Literals<readonly ["envelope-v3", "artifact"]>;
+  readonly role: Schema.Literals<readonly ["instruction", "movement", "supporting"]>;
+  readonly issuedAt: Schema.NullOr<Schema.Number>;
+}>;
+type DocumentRefV3 = typeof DocumentRefV3Schema.Type;
+declare const PaymentDocumentReadRefSchema: Schema.Struct<{
+  readonly documentHash: Schema.String;
+  readonly contentHash: Schema.String;
+}>;
+type PaymentDocumentReadRef = typeof PaymentDocumentReadRefSchema.Type;
+declare const PaymentDocumentDownloadSchema: Schema.Struct<{
+  readonly ref: Schema.Struct<{
+    readonly documentHash: Schema.String;
+    readonly contentHash: Schema.String;
+    readonly kind: Schema.Literals<readonly ["memo", "invoice", "payslip", "receipt"]>;
+    readonly format: Schema.Literals<readonly ["envelope-v3", "artifact"]>;
+    readonly issuedAt: Schema.NullOr<Schema.Number>;
+  }>;
+  readonly bytesBase64: Schema.String;
+  readonly mediaType: Schema.Literals<readonly ["application/pdf", "image/png", "image/jpeg", "application/json"]>;
+  readonly signatureStatus: Schema.Literals<readonly ["absent", "verified", "opaque"]>;
+}>;
+type PaymentDocumentDownload = typeof PaymentDocumentDownloadSchema.Type;
+declare const PaymentDocumentVerificationSchema: Schema.Struct<{
+  readonly documentHash: Schema.String;
+  readonly contentHash: Schema.String;
+  readonly ok: Schema.Boolean;
+  readonly signatureStatus: Schema.Literals<readonly ["absent", "verified", "opaque"]>;
+}>;
+type PaymentDocumentVerification = typeof PaymentDocumentVerificationSchema.Type;
+declare const PaymentDocumentRenderSchema: Schema.Struct<{
+  readonly documentHash: Schema.String;
+  readonly contentHash: Schema.String;
+  readonly kind: Schema.Literals<readonly ["memo", "invoice", "payslip", "receipt"]>;
+  readonly ok: Schema.Literal<true>;
+  readonly html: Schema.String;
+}>;
+type PaymentDocumentRender = typeof PaymentDocumentRenderSchema.Type;
+//#endregion
 //#region ../wire/src/observation-context.d.ts
 /**
  * Bounded, non-authoritative observation metadata carried by selected SDK
@@ -664,6 +727,34 @@ declare const ClientRequestViewSchema: Schema.Union<readonly [Schema.Struct<{
 }>]>;
 type ClientRequestView = typeof ClientRequestViewSchema.Type;
 //#endregion
+//#region ../wire/src/org.d.ts
+/** The public authority named by one Organization assignment. */
+type AuthorityRef = {
+  readonly type: "budget";
+  readonly budgetId: BudgetId;
+} | {
+  readonly type: "managePeople";
+  readonly permissionId: PermissionId;
+};
+/** The accepted product policy stored with one Permission revision. */
+declare const CurrentPolicySchema: Schema.Union<readonly [Schema.Struct<{
+  readonly type: Schema.Literal<"budget">;
+  readonly asset: Schema.refine<AssetId, Schema.String>;
+  readonly limit: Schema.NullOr<Schema.String>;
+  readonly scope: Schema.Struct<{
+    readonly recipients: Schema.Union<readonly [Schema.Struct<{
+      readonly type: Schema.Literal<"anyone">;
+    }>, Schema.Struct<{
+      readonly type: Schema.Literal<"allowlist">;
+      readonly accounts: Schema.$Array<Schema.refine<AccountId, Schema.String>>;
+    }>]>;
+    readonly actions: Schema.NonEmptyArray<Schema.Literals<readonly ["pay", "commitments"]>>;
+  }>;
+}>, Schema.Struct<{
+  readonly type: Schema.Literal<"managePeople">;
+}>]>;
+type CurrentPolicy = typeof CurrentPolicySchema.Type;
+//#endregion
 //#region src/ports/bootstrap.d.ts
 type BootstrapInput = {
   readonly publishableKey: PublishableKey;
@@ -963,7 +1054,7 @@ type ReadAccountBalanceInput = {
 };
 type FundFromFaucetInput = {
   readonly chainId: ChainId;
-  readonly amount: Money;
+  readonly amount: AssetAmount;
 };
 type FundFromFaucetResult = {
   readonly txHash: string;
@@ -1257,6 +1348,11 @@ interface ClientRequests {
 type AuthMethodOptions = InvocationControls;
 type SignInOptions = AuthMethodOptions;
 interface AuthMethods {
+  /** Resume pending OTP input after process restart; grants no authentication. */
+  resumeOtp(input: {
+    readonly email: string;
+    readonly requestedAt: number;
+  }, options?: AuthMethodOptions): Promise<CapxulResult<void>>;
   canSendOtp(input: {
     readonly email: string;
   }, options?: AuthMethodOptions): Promise<CapxulResult<CanSendOtpStatus>>;
@@ -1457,22 +1553,12 @@ interface MeMethods {
   /** R08 (#1966): accepts a captured attempt, exactly as the treasury read does. */
   depositInstructions(options?: InvocationControls): Promise<CapxulResult<DepositInstructions>>;
 }
-interface PaymentMoney {
-  readonly currency: string;
-  readonly value: string;
-  readonly decimals: number;
-}
+type PaymentMoney = AssetAmount;
 type PaymentStatus = PaymentStatus$1;
 type PaymentDirection = PaymentDirection$1;
 type PaymentType = PaymentType$1;
-type PaymentDocumentKind = PaymentDocumentKind$1;
-interface PaymentDocumentRef {
-  readonly documentHash: string;
-  readonly kind: PaymentDocumentKind;
-  readonly title?: string;
-  readonly uri?: string;
-  readonly issuedAt?: number;
-}
+type PaymentDocumentKind = DocumentRefV3["kind"];
+type PaymentDocumentRef = DocumentRefV3;
 type PaymentTiming = {
   readonly kind: "instant";
 } | {
@@ -1504,6 +1590,7 @@ interface Payment {
     readonly label: string;
   };
   readonly documents: readonly PaymentDocumentRef[];
+  readonly documentState?: "ready" | "pending" | "unavailable";
   readonly timing: PaymentTiming;
   readonly released: PaymentMoney;
   readonly availableToClaim: PaymentMoney;
@@ -1701,8 +1788,7 @@ interface ActivitySummaryParams {
   readonly window?: ActivityRange;
 }
 interface ActivitySummaryTotal {
-  readonly currency: string;
-  readonly decimals: number;
+  readonly asset: AssetAmount["asset"];
   /** Integer raw-unit strings. `net` is `in - out` and may be negative. */
   readonly in: string;
   readonly out: string;
@@ -1716,7 +1802,7 @@ interface ActivitySummary {
     readonly from: number | null;
     readonly to: number | null;
   };
-  /** One bucket per currency, and EMPTY when the window holds no activity. */
+  /** One bucket per exact asset, and EMPTY when the window holds no activity. */
   readonly totals: readonly ActivitySummaryTotal[];
   /**
    * Every activity row in the window, whatever its direction or status. It
@@ -1791,6 +1877,8 @@ type ActivityDetail = {
 } | {
   readonly kind: "movement";
   readonly movementId: string;
+  readonly documents: readonly PaymentDocumentRef[];
+  readonly documentState: "ready" | "pending" | "unavailable";
   readonly annotation: ActivityAnnotation | null;
   readonly evidence: MovementActivityEvidence;
 };
@@ -1854,24 +1942,6 @@ interface OfframpMethods {
     readonly signal?: AbortSignal;
   }): Promise<CapxulResult<OfframpStatus>>;
 }
-interface PaymentDocumentVerification {
-  readonly documentHash: string;
-  readonly ok: boolean;
-  readonly derivedHash: string;
-  readonly kind: PaymentDocumentKind;
-}
-/**
- * #577 render-on-demand result. `html` is self-contained user-visible document
- * HTML (stylesheet + rendered document). The MCP `paymentDocuments.render` tool
- * exposes only `{documentHash, kind, ok}` to the model and returns `html` in an
- * audience:["user"] content block (#506 redaction matrix).
- */
-interface PaymentDocumentRender {
-  readonly documentHash: string;
-  readonly ok: boolean;
-  readonly kind: PaymentDocumentKind;
-  readonly html: string;
-}
 /**
  * The public Payments surface uses product-level methods. A settled receipt can
  * include `chainId` and `transactionHash`. Internal custody fields stay private.
@@ -1906,15 +1976,15 @@ interface PaymentsMethods {
   }): Promise<CapxulResult<Payment>>;
 }
 interface PaymentDocumentsMethods {
-  verify(documentHash: string, options?: {
+  /** Return exact original bytes for a deliberate download. */
+  get(ref: PaymentDocumentReadRef, options?: {
+    readonly signal?: AbortSignal;
+  }): Promise<CapxulResult<PaymentDocumentDownload>>;
+  verify(ref: PaymentDocumentReadRef, options?: {
     readonly signal?: AbortSignal;
   }): Promise<CapxulResult<PaymentDocumentVerification>>;
-  /**
-   * #577: render-on-demand. Loads the owner's stored document by `documentHash`,
-   * re-verifies its EIP-712 hash, and renders it to self-contained HTML using the
-   * verified stored line items. Returns `{documentHash, kind, ok, html}`.
-   */
-  render(documentHash: string, options?: {
+  /** Render an authorized document after checking its bytes and preimages. */
+  render(ref: PaymentDocumentReadRef, options?: {
     readonly signal?: AbortSignal;
   }): Promise<CapxulResult<PaymentDocumentRender>>;
 }
@@ -2158,13 +2228,20 @@ interface OrganizationOnboardingInput {
 interface OrganizationOnboarding {
   readonly organizationId: string;
 }
+interface OrganizationOnboardingOptions {
+  readonly signal?: AbortSignal;
+  readonly intent?: "create";
+}
+interface OrganizationOnboardingState {
+  readonly organizationId: OrgId | null;
+  readonly lifecycle: OrgLifecycle | null;
+}
 interface OnboardingMethods {
   completePerson(input: PersonOnboardingInput, options?: {
     readonly signal?: AbortSignal;
   }): Promise<CapxulResult<PersonOnboarding>>;
-  completeOrganization(input: OrganizationOnboardingInput, options?: {
-    readonly signal?: AbortSignal;
-  }): Promise<CapxulResult<OrganizationOnboarding>>;
+  completeOrganization(input: OrganizationOnboardingInput, options?: OrganizationOnboardingOptions): Promise<CapxulResult<OrganizationOnboarding>>;
+  subscribeOrganization(observer: (state: OrganizationOnboardingState) => void): () => void;
 }
 //#endregion
 //#region src/surface/accounts.d.ts
@@ -2179,7 +2256,7 @@ interface AccountsMethods {
  * The reference CLI uses it only in the test environment. Consumers do not see `fund`.
  */
 interface AccountsFaucetMethods {
-  fund(amount: Money, options?: {
+  fund(amount: AssetAmount, options?: {
     readonly signal?: AbortSignal;
   }): Promise<CapxulResult<{
     readonly txHash: string;
@@ -2232,7 +2309,7 @@ declare class OrgError extends OrgError_base<{
 interface OrgPort {
   createOrg(input: CreateOrgPortInput): Effect.Effect<OrgView, OrgError, never>;
   readTreasury(input: ReadOrgTreasuryInput): Effect.Effect<Account$1, OrgError, never>;
-  listOrgs(input: ListOrgsInput): Effect.Effect<readonly OrgView[], OrgError, never>;
+  listOrgs(input: ListOrgsInput): Effect.Effect<readonly OrganizationAccess[], OrgError, never>;
   listRoles(input: ListOrgRolesInput): Effect.Effect<readonly RoleView[], OrgError, never>;
   listMembers(input: ListOrgMembersInput): Effect.Effect<readonly MemberView[], OrgError, never>;
   pendingMembers?(input: ListOrgMembersInput): Effect.Effect<readonly MemberView[], OrgError, never>;
@@ -2252,7 +2329,12 @@ interface Budget {
   readonly id: BudgetId;
   /** Display name, taken from the Role the grant was motivated by. */
   readonly label: string;
-  readonly limit: Money | null;
+  readonly asset: {
+    readonly assetId: AssetId;
+    readonly symbol: string;
+    readonly decimals: number;
+  };
+  readonly limit: AssetAmount | null;
 }
 /**
  * The caller's own standing in one Organization.
@@ -2266,6 +2348,7 @@ interface Budget {
  * spending, so both read `canSpend`.
  */
 interface OrgMe {
+  readonly member: MemberIdentityProjection;
   readonly role: {
     readonly label: string;
   } | null;
@@ -2362,7 +2445,7 @@ interface PayrollRun {
   /** Epoch milliseconds. An instant run has `periodStart === periodEnd`. */
   readonly periodStart: number;
   readonly periodEnd: number;
-  readonly total: Money;
+  readonly total: AssetAmount;
   readonly recipientCount: number;
 }
 /**
@@ -2375,7 +2458,7 @@ interface PayrollRun {
 interface PayrollRuns {
   readonly runs: readonly PayrollRun[];
   /** Σ net of the runs that SETTLED this calendar month — the "Paid This Month" fact. */
-  readonly settledThisMonth: Money;
+  readonly settledThisMonth: readonly AssetAmount[];
 }
 /**
  * One saved recipient on a group. `amount` is the employer's TYPED text, not
@@ -2444,8 +2527,12 @@ interface PayrollRunItemInput {
    * three different people.
    */
   readonly partyId: string;
+  /** The exact settlement quantity. Fiat compensation remains in gross and net. */
+  readonly amount: AssetAmount;
   readonly gross: string;
   readonly net: string;
+  readonly currency: CurrencyCode;
+  readonly decimals: number;
   readonly adjustments: readonly {
     readonly label: string;
     readonly amount: string;
@@ -2454,6 +2541,8 @@ interface PayrollRunItemInput {
 interface AuthorizeRunInput {
   /** The Budget the run spends from. The caller selects it; nothing is picked for them. */
   readonly permissionId: string;
+  /** The one asset used by every payment in this run. */
+  readonly asset: AssetAmount["asset"];
   /** Epoch milliseconds. An instant run passes `start === end` — the payslip renders the date. */
   readonly period: {
     readonly start: number;
@@ -2498,23 +2587,64 @@ interface PayrollMethods {
 //#region src/surface/org.d.ts
 /** The membership state for one Organization member. */
 type MemberStatus = "pending" | "pending_safe" | "pending_grant" | "active" | "revoked" | "expired";
-/** One Organization that the current user can access. */
-type OrgView = {
+/** The current state and policy of one exact authority assignment. */
+type AssignmentProjection = {
+  readonly id: PermissionAssignmentId;
+  readonly authority: AuthorityRef;
+  readonly state: "pending" | "active" | "suspended" | "revoked";
+  readonly policy: CurrentPolicy;
+  readonly revision: number;
+  readonly observedAt: number;
+};
+/** The current user's identity and authority inside one Organization. */
+type MemberIdentityProjection = {
+  readonly orgId: OrgId;
+  readonly partyId: PartyId;
+  readonly accountId: AccountId | null;
+  readonly safeAddress: Address$1;
+  readonly accountReady: boolean | null;
+  readonly assignments: readonly AssignmentProjection[];
+};
+/** The legacy creation result. List reads return OrganizationAccess. */
+type OrgView = OrganizationAccess & {
   readonly creationSource?: TesterKind;
-  readonly id: OrgId;
-  readonly name: string;
-  readonly handle: string;
   readonly safeAddress: Address$1;
   /** The viewing member's own role label within this org. */
-  readonly role: string;
-  /** The Organization treasury Account. */
-  readonly treasury: Account$1;
+  readonly role: string | null;
+  /**
+   * The Organization treasury Account when this view came from an authorized
+   * treasury read. The own-access list returns `null` because list inclusion
+   * does not grant a protected treasury read.
+   */
+  readonly treasury: Account$1 | null;
   /** #1064: onboarding-collected description + size bucket; null when unset. */
   readonly bio: string | null;
   readonly size: string | null;
   /** #1061 / ADR-0014: logo serving URL resolved at read time; null when unset. */
   readonly logoUrl: string | null;
 };
+/** One Organization that the current user can access. */
+type OrganizationAccess = {
+  readonly id: OrgId;
+  readonly name: string;
+  readonly handle: string;
+  /** Canonical Organization account identity. */
+  readonly account: {
+    readonly id: AccountId | null;
+    readonly address: Address$1;
+    readonly ready: boolean | null;
+  };
+  readonly setup: OrgLifecycle;
+  readonly member: MemberIdentityProjection | null;
+  readonly capabilities: {
+    readonly canManagePeople: boolean;
+    readonly canSpend: boolean;
+  };
+  readonly custody: {
+    readonly status: "unknown";
+  };
+  readonly observedAt: number;
+};
 interface OrganizationAccount {
   readonly id: string;
   readonly address: string | null;
@@ -2531,15 +2661,15 @@ interface OrganizationAuditLogItem {
   readonly metadata?: Record<string, unknown>;
 }
 /**
- * One Organization member. `personalSafeAddress` is the member identity key. It
- * is `null` while the member is still `pending` (emailed into existence but not
- * yet provisioned a personal Safe). `email` is the universal entry point.
+ * One Organization member. `accountId` identifies the attached Account.
+ * It is `null` before Account attachment. A Safe address is not an AccountId.
  */
 type MemberView = {
   readonly orgId: OrgId;
+  readonly accountId: AccountId | null;
   readonly email: Email;
   readonly name: string | null;
-  /** Member identity key. `null` until the invitee provisions a Safe. */
+  /** Custody Safe. `null` until the invitee provisions a Safe. */
   readonly personalSafeAddress: Address$1 | null;
   /** The member role label maps to the on-chain `roleKey`. */
   readonly role: string;
@@ -2548,16 +2678,9 @@ type MemberView = {
   readonly grantTxHash: string | null;
   readonly revokeTxHash: string | null;
 };
-/** A role spend cap that Zodiac Roles and Allowance enforce on-chain. */
-type RoleSpendCap = {
-  readonly perTx?: Money;
-  readonly perDay?: Money;
-  readonly toRecipients?: "anyone" | readonly Address$1[];
-};
 /** A Capxul Role definition. */
 type RoleDefinition = {
   readonly label: string;
-  readonly spend?: RoleSpendCap;
   readonly canSpend?: boolean;
   readonly canManageMembers?: boolean;
   readonly canManageRoles?: boolean;
@@ -2671,7 +2794,7 @@ interface OrgScopedMethods extends ActorRelationshipMethods {
 type OrgsMethod = {
   (options?: {
     readonly signal?: AbortSignal;
-  }): Promise<CapxulResult<readonly OrgView[]>>;
+  }): Promise<CapxulResult<readonly OrganizationAccess[]>>;
   detectAndAcceptPendingInvitations(options?: {
     readonly signal?: AbortSignal;
   }): Promise<CapxulResult<DetectPendingOrgInvitationsResult>>;
@@ -2705,16 +2828,7 @@ interface CurrentUserContext {
     readonly id: string;
     readonly address: string | null;
   } | null;
-  readonly organizations: readonly {
-    readonly id: string;
-    readonly name: string;
-    readonly handle: string;
-    readonly role: string;
-    readonly account: {
-      readonly id: string;
-      readonly address: string | null;
-    } | null;
-  }[];
+  readonly organizations: readonly OrganizationAccess[];
 }
 interface CurrentUserMethods {
   get(options?: {
@@ -2764,22 +2878,6 @@ interface SystemMethods {
   }): Promise<CapxulResult<SystemHealth>>;
 }
 //#endregion
-//#region src/domain/money/primary-holding.d.ts
-/**
- * The one asset a screen shows when it can show only one. `symbol` is the
- * TOKEN symbol the chain reported (`"USDC"`, `"WETH"`); `value` is the quantity
- * in that asset's own grammar. There is no `currency` field: a token is not
- * USD, and its peg is metadata, never identity (ADR-0028 R3, R5).
- */
-interface Holding {
-  readonly id: string;
-  readonly assetKind: "native" | "erc20";
-  readonly symbol: string;
-  readonly decimals: number;
-  /** Major-unit quantity at `decimals`. */
-  readonly value: string;
-}
-//#endregion
 //#region src/surface/holdings.d.ts
 interface HoldingsMethods {
   current(input?: {
@@ -2787,18 +2885,6 @@ interface HoldingsMethods {
   }, options?: {
     readonly signal?: AbortSignal;
   }): Promise<CapxulResult<CurrentHoldings>>;
-  /**
-   * The designated display asset — the renderable row with the lowest asset
-   * id, or `null` when the snapshot carries no renderable row. Reads the same
-   * snapshot as `current` and picks from it; an empty answer is a value, not
-   * an error. The pick is by identity, never by quantity: two assets are not
-   * comparable money without a rate. ADR-0028 R6 retires this export.
-   */
-  primary(input?: {
-    readonly actor?: ActorReference;
-  }, options?: {
-    readonly signal?: AbortSignal;
-  }): Promise<CapxulResult<Holding | null>>;
 }
 //#endregion
 //#region src/surface/_shared/effect-actor-bridge.d.ts
@@ -3039,6 +3125,47 @@ interface CreateCapxulClientInput {
   };
 }
 //#endregion
+//#region src/ports/diagnostic.d.ts
+type DiagnosticDetail = Readonly<Record<string, unknown>>;
+interface DiagnosticPort {
+  readonly trace: (scope: string, detail: DiagnosticDetail) => void;
+}
+//#endregion
+//#region src/openfort/create-openfort-browser-signer.d.ts
+interface OpenfortBrowserSigner extends CapxulSigner {
+  readonly resetSession: () => void;
+  /** Required here — this signer is the one that runs a readiness cycle. */
+  readonly statusStore: SignerStatusStore;
+  /**
+   * Start the readiness cycle, or join the one already running, without
+   * signing anything (#1667). The embedded-wallet port calls the same routine
+   * lazily from `getAddress` / `signRawDigest`; the client assembly calls it
+   * once the identity is claimed, so the status converges on `ready` or
+   * `unavailable` without a signature. Idempotent: a second call inside a live
+   * cycle joins that cycle.
+   */
+  readonly ensureWalletReady: () => Promise<void>;
+}
+/** Public Openfort values a host-owned browser signer needs after SDK bootstrap. */
+type OpenfortBrowserSignerBootstrap = Pick<BootstrapResolution, "authBaseUrl" | "openfortPublishableKey" | "shieldPublishableKey" | "openfortAuthProvider">;
+/** Authenticated callbacks for a browser that must not own the person's login flow. */
+interface OpenfortBrowserAuth {
+  readonly getAccessToken: () => Promise<string | null>;
+  readonly createEncryptionSession: (accessToken: string) => Promise<string>;
+}
+interface OpenfortBrowserSignerOptions {
+  readonly diagnostic?: DiagnosticPort;
+  readonly auth?: OpenfortBrowserAuth;
+  /** Testing seam below the existing one-retry recovery owner. */
+  readonly signUserOpHash?: ((hash: Parameters<CapxulSigner["signUserOpHash"]>[0], delegate: CapxulSigner["signUserOpHash"]) => ReturnType<CapxulSigner["signUserOpHash"]>) | undefined;
+}
+/** Build the existing browser signer around host-owned authenticated callbacks. */
+declare function createOpenfortBrowserSigner(input: {
+  readonly bootstrap: OpenfortBrowserSignerBootstrap;
+  readonly auth: OpenfortBrowserAuth;
+  readonly diagnostic?: DiagnosticPort;
+}): OpenfortBrowserSigner;
+//#endregion
 //#region ../observability/src/engineering-delivery.d.ts
 type MetricEntry = Metric.Metric.Metadata<unknown, unknown>;
 interface CliEngineeringStats {
@@ -3191,17 +3318,11 @@ interface ObservationAdapter {
 /** Stable PostHog event used for typed failures that are expected product outcomes. */
 declare const CAPXUL_SDK_EXPECTED_OUTCOME_EVENT = "capxul_sdk_expected_outcome";
 //#endregion
-//#region src/ports/diagnostic.d.ts
-type DiagnosticDetail = Readonly<Record<string, unknown>>;
-interface DiagnosticPort {
-  readonly trace: (scope: string, detail: DiagnosticDetail) => void;
-}
-//#endregion
-//#region src/openfort/create-openfort-browser-signer.d.ts
-interface OpenfortBrowserSignerOptions {
-  readonly diagnostic?: DiagnosticPort;
-  /** Testing seam below the existing one-retry recovery owner. */
-  readonly signUserOpHash?: ((hash: Parameters<CapxulSigner["signUserOpHash"]>[0], delegate: CapxulSigner["signUserOpHash"]) => ReturnType<CapxulSigner["signUserOpHash"]>) | undefined;
+//#region src/adapters/auth-client/BetterAuthNodeAdapter.d.ts
+/** Host-owned protected storage for an opaque BetterAuth bearer credential. */
+interface NodeSessionStorage {
+  load(): Promise<string | null>;
+  save(token: string | null): Promise<void>;
 }
 //#endregion
 //#region src/production.d.ts
@@ -3211,6 +3332,8 @@ interface OpenfortBrowserSignerOptions {
  * runtime detection, and auth-cache selection are SDK-owned defaults.
  */
 interface CapxulClientInput {
+  /** Optional Node-only durable BetterAuth credential storage; sessions are verified by the backend. */
+  readonly nodeSessionStorage?: NodeSessionStorage;
   readonly publishableKey: string;
   /** Public Capxul bootstrap origin; defaults remain unchanged when omitted. */
   readonly bootstrapBaseUrl?: string;
@@ -3240,6 +3363,8 @@ interface CapxulClientInput {
    * holds an RPC URL, a gas-sponsorship policy, or a bundler.
    */
   readonly signer?: CapxulSigner;
+  /** Build a host-owned Openfort signer from the SDK's validated bootstrap. */
+  readonly openfortSignerFactory?: (bootstrap: OpenfortBrowserSignerBootstrap) => CapxulSigner;
 }
 /** Per-client signing controls; only the testing entry exposes these to consumers. */
 interface ProductionSignerControls {
@@ -3251,4 +3376,4 @@ interface ProductionSignerControls {
   readonly signEmbeddedUserOpHash?: OpenfortBrowserSignerOptions["signUserOpHash"];
 }
 //#endregion
-export { OrganizationPaymentBatchInput as $, PAYMENT_DIRECTIONS as $n, Destination as $t, OrgScopedMethods as A, Ref$1 as An, AddressBookAddInput as At, AuthorizeRunOptions as B, SmartAccountMethods as Bn, ActivityFilter as Bt, CurrentUserMethods as C, PaymentMoney as Cn, AccountMethods as Ct, MemberStatus as D, PaymentsMethods as Dn, ActorRequest as Dt, InviteMemberInput as E, PaymentType as En, ActorRelationshipMethods as Et, ResendInviteTokenInput as F, AccountLifecycle as Fn, InboxItem as Ft, PayrollGroupsMethods as G, OrgSetupStep as Gn, ActivityPage as Gt, PayrollGroup as H, AccountSetupPolicy as Hn, ActivityKind as Ht, RoleDefinition as I, AccountSetupStep as In, InboxMethods as It, PayrollRun as J, ActorRef as Jn, ActivitySummary as Jt, PayrollMethods as K, PayoutAddress as Kn, ActivityRange as Kt, RoleSpendCap as L, isSettingUpLifecycle as Ln, ActivityAnnotation as Lt, OrgView as M, TargetReference as Mn, AddressBookLabelInput as Mt, OrganizationAccount as N, TargetsMethods as Nn, AddressBookMethods as Nt, MemberView as O, PaymentsPayInput as On, ActorRequestIssueInput as Ot, OrganizationAuditLogItem as P, fingerprintPaymentIntent as Pn, InboxApproveInput as Pt, PayrollTermsUnit as Q, InboxStatus as Qn, DepositInstructions as Qt, RoleView as R, CompleteProfileInput as Rn, ActivityAnnotationInput as Rt, CurrentUserContext as S, PaymentDocumentsMethods as Sn, ReadyAccountLifecycle as St, DetectPendingOrgInvitationsResult as T, PaymentTiming as Tn, ActorProfileMethods as Tt, PayrollGroupInput as U, ClientRequests as Un, ActivityListParams as Ut, PayrollEngagementTerms as V, AuthMethods as Vn, ActivityItem as Vt, PayrollGroupMember as W, OrgLifecycle as Wn, ActivityMethods as Wt, PayrollRunStatus as X, Permission as Xn, ActivitySummaryTotal as Xt, PayrollRunItemInput as Y, CurrentHoldings as Yn, ActivitySummaryParams as Yt, PayrollRuns as Z, SubmittedPermissionExecution as Zn, ActorReference as Zt, HoldingsMethods as _, PaymentDirection as _n, InvocationControls as _r, OnboardingMethods as _t, ObservationContext as a, DestinationRemoveInput as an, TelemetryIdentifyInput as ar, PermissionCreateInput as at, SystemHealth as b, PaymentDocumentRender as bn, PersonOnboarding as bt, HostObservability as c, MeMethods as cn, IdentityEvent as cr, PermissionReplaceInput as ct, postHogObservability as d, OfframpMethods as dn, Readiness as dr, Budget as dt, DestinationAddInput as en, PAYMENT_STATUSES as er, OrganizationPaymentInput as et, CapxulClient as f, OfframpQuote as fn, StateLabel as fr, OrgMe as ft, IdentityRuntimeSendResult as g, PaymentActivityEvidence as gn, IdentityTransition as gr, CompletedPersonProfile as gt, IdentityRuntime as h, Payment as hn, isRestoring as hr, AccountsMethods as ht, ObservationAdapter as i, DestinationRail as in, TelemetryGroupInput as ir, PermissionChangeInput as it, OrgTemplate as j, ResolvedTarget as jn, AddressBookEntry as jt, OrgMethods as k, RecipientResolution as kn, ActorRequestsMethods as kt, PostHogObservabilityClient as l, MeProfile as ln, IdentityState as lr, PermissionRevokeInput as lt, IdentityProfileDetails as m, OfframpStatus as mn, isClaimed as mr, OrgMeOptions as mt, ProductionSignerControls as n, DestinationListInput as nn, RequestStatus as nr, OrganizationPaymentsMethods as nt, ObservationDelivery as o, DestinationsMethods as on, TelemetryPort as or, PermissionMethods as ot, CreateCapxulClientInput as p, OfframpQuoteInput as pn, destination as pr, OrgMeMethod as pt, PayrollOptions as q, ClientRequestView as qn, ActivityReference as qt, CAPXUL_SDK_EXPECTED_OUTCOME_EVENT as r, DestinationPayload as rn, TelemetryEvent as rr, PermissionAssignInput as rt, SdkFailureObservation as s, FinancialOpsMethods as sn, Destination$1 as sr, PermissionOptions as st, CapxulClientInput as t, DestinationKind as tn, PaymentStatus$1 as tr, OrganizationPaymentItemInput as tt, PostHogObservabilityOptions as u, MovementActivityEvidence as un, OrgLane as ur, PermissionReadResult as ut, Holding as v, PaymentDocumentKind as vn, OrganizationOnboarding as vt, CreateOrgInput as w, PaymentStatus as wn, ActorProfile as wt, MediaMethods as x, PaymentDocumentVerification as xn, PersonOnboardingInput as xt, SystemMethods as y, PaymentDocumentRef as yn, OrganizationOnboardingInput as yt, AuthorizeRunInput as z, IdentityMethods as zn, ActivityDetail as zt };
+export { PayrollRun as $, CurrentPolicy as $n, ActivityRange as $t, InviteMemberInput as A, PaymentTiming as An, AccountMethods as At, OrganizationAuditLogItem as B, AccountLifecycle as Bn, AddressBookMethods as Bt, SystemHealth as C, PaymentActivityEvidence as Cn, StateLabel as Cr, OrganizationOnboarding as Ct, AssignmentProjection as D, PaymentDocumentsMethods as Dn, IdentityTransition as Dr, PersonOnboarding as Dt, CurrentUserMethods as E, PaymentDocumentRef as En, isRestoring as Er, OrganizationOnboardingState as Et, OrgScopedMethods as F, Ref$1 as Fn, ActorRequestIssueInput as Ft, AuthorizeRunOptions as G, SmartAccountMethods as Gn, ActivityAnnotationInput as Gt, RoleDefinition as H, isSettingUpLifecycle as Hn, InboxItem as Ht, OrgTemplate as I, ResolvedTarget as In, ActorRequestsMethods as It, PayrollGroupInput as J, ClientRequests as Jn, ActivityItem as Jt, PayrollEngagementTerms as K, AuthMethods as Kn, ActivityDetail as Kt, OrgView as L, TargetReference as Ln, AddressBookAddInput as Lt, MemberStatus as M, PaymentsMethods as Mn, ActorProfileMethods as Mt, MemberView as N, PaymentsPayInput as Nn, ActorRelationshipMethods as Nt, CreateOrgInput as O, PaymentMoney as On, InvocationControls as Or, PersonOnboardingInput as Ot, OrgMethods as P, RecipientResolution as Pn, ActorRequest as Pt, PayrollOptions as Q, AuthorityRef as Qn, ActivityPage as Qt, OrganizationAccess as R, TargetsMethods as Rn, AddressBookEntry as Rt, SystemMethods as S, Payment as Sn, Readiness as Sr, OnboardingMethods as St, CurrentUserContext as T, PaymentDocumentKind as Tn, isClaimed as Tr, OrganizationOnboardingOptions as Tt, RoleView as U, CompleteProfileInput as Un, InboxMethods as Ut, ResendInviteTokenInput as V, AccountSetupStep as Vn, InboxApproveInput as Vt, AuthorizeRunInput as W, IdentityMethods as Wn, ActivityAnnotation as Wt, PayrollGroupsMethods as X, OrgSetupStep as Xn, ActivityListParams as Xt, PayrollGroupMember as Y, OrgLifecycle as Yn, ActivityKind as Yt, PayrollMethods as Z, PayoutAddress as Zn, ActivityMethods as Zt, CreateCapxulClientInput as _, MovementActivityEvidence as _n, TelemetryPort as _r, OrgMe as _t, ObservationContext as a, DepositInstructions as an, ActorRef as ar, OrganizationPaymentInput as at, IdentityRuntimeSendResult as b, OfframpQuoteInput as bn, IdentityState as br, AccountsMethods as bt, HostObservability as c, DestinationKind as cn, SubmittedPermissionExecution as cr, PermissionAssignInput as ct, postHogObservability as d, DestinationRail as dn, PAYMENT_STATUSES as dr, PermissionMethods as dt, ActivityReference as en, ClientRequestView as er, PayrollRunItemInput as et, OpenfortBrowserAuth as f, DestinationRemoveInput as fn, PaymentStatus$1 as fr, PermissionOptions as ft, CapxulClient as g, MeProfile as gn, TelemetryIdentifyInput as gr, Budget as gt, createOpenfortBrowserSigner as h, MeMethods as hn, TelemetryGroupInput as hr, PermissionReadResult as ht, ObservationAdapter as i, ActorReference as in, PaymentDocumentVerification as ir, OrganizationPaymentBatchInput as it, MemberIdentityProjection as j, PaymentType as jn, ActorProfile as jt, DetectPendingOrgInvitationsResult as k, PaymentStatus as kn, ReadyAccountLifecycle as kt, PostHogObservabilityClient as l, DestinationListInput as ln, InboxStatus as lr, PermissionChangeInput as lt, OpenfortBrowserSignerBootstrap as m, FinancialOpsMethods as mn, TelemetryEvent as mr, PermissionRevokeInput as mt, ProductionSignerControls as n, ActivitySummaryParams as nn, PaymentDocumentReadRef as nr, PayrollRuns as nt, ObservationDelivery as o, Destination as on, CurrentHoldings as or, OrganizationPaymentItemInput as ot, OpenfortBrowserSigner as p, DestinationsMethods as pn, RequestStatus as pr, PermissionReplaceInput as pt, PayrollGroup as q, AccountSetupPolicy as qn, ActivityFilter as qt, CAPXUL_SDK_EXPECTED_OUTCOME_EVENT as r, ActivitySummaryTotal as rn, PaymentDocumentRender as rr, PayrollTermsUnit as rt, SdkFailureObservation as s, DestinationAddInput as sn, Permission as sr, OrganizationPaymentsMethods as st, CapxulClientInput as t, ActivitySummary as tn, PaymentDocumentDownload as tr, PayrollRunStatus as tt, PostHogObservabilityOptions as u, DestinationPayload as un, PAYMENT_DIRECTIONS as ur, PermissionCreateInput as ut, IdentityProfileDetails as v, OfframpMethods as vn, Destination$1 as vr, OrgMeMethod as vt, MediaMethods as w, PaymentDirection as wn, destination as wr, OrganizationOnboardingInput as wt, HoldingsMethods as x, OfframpStatus as xn, OrgLane as xr, CompletedPersonProfile as xt, IdentityRuntime as y, OfframpQuote as yn, IdentityEvent as yr, OrgMeOptions as yt, OrganizationAccount as z, fingerprintPaymentIntent as zn, AddressBookLabelInput as zt };