@capxul/sdk 4.20.0-beta.6 → 4.20.0-beta.7

package/dist/{production-pLe7MsUo.d.mts → production-UMTDZSTH.d.mts}

@@ -1,4 +1,4 @@
-import { $ as OrgId, A as Address$1, B as BudgetId, C as AuthCachePort, Ct as CapxulErrorDetails, D as Account$1, F as AssetAmount, G as CurrencyCode, H as ClientGrantId, I as AssetId, K as DocumentHash, L as AuthSession, M as AllowedOrigin, N as AnonymousDistinctId, O as AccountId, P as AppId, R as AuthUserId, St as CapxulErrorCode, Tt as Failure, U as ClientRequestId, V as ChainId, W as CountryCode, X as EpochMs, Y as Email, Z as Handle, _ as Session$1, at as PermissionId, b as AuthClientPort, ct as RoleKey, d as AccountRequirement, dt as TesterKind, et as PartyId, ft as TxHash, g as Profile$1, h as CapxulResult, i as CapxulSigner, it as PermissionAssignmentId, j as AllowanceKey, jt as FailureMode, k as AccountPosition, lt as SessionToken, nt as PayrollGroupId, ot as Profile, pt as WeiAmount, q as DurationMs, rt as PayrollRunId, s as SignerStatusStore, st as PublishableKey, tt as PaymentCommandId, u as AccountProviderSource, ut as SmartAccount, v as SmartAccount$1, x as CanSendOtpStatus, xt as CapxulError, y as ClockPort, z as BlockNumber } from "./OAuthBearerAuthClient-B7Nbepmu.mjs";
+import { $ as OrgId, A as Address$1, B as BudgetId, C as AuthCachePort, Ct as CapxulError, D as Account$1, Dt as Failure, F as AssetAmount, G as CurrencyCode, H as ClientGrantId, I as AssetId, K as DocumentHash, L as AuthSession, M as AllowedOrigin, N as AnonymousDistinctId, Nt as FailureMode, O as AccountId, P as AppId, R as AuthUserId, Tt as CapxulErrorDetails, U as ClientRequestId, V as ChainId, W as CountryCode, X as EpochMs, Y as Email, Z as Handle, _ as Session$1, at as PermissionId, b as AuthClientPort, ct as RoleKey, d as AccountRequirement, dt as TesterKind, et as PartyId, ft as TxHash, g as Profile$1, h as CapxulResult, i as CapxulSigner, it as PermissionAssignmentId, j as AllowanceKey, k as AccountPosition, lt as SessionToken, nt as PayrollGroupId, ot as Profile, pt as WeiAmount, q as DurationMs, rt as PayrollRunId, s as SignerStatusStore, st as PublishableKey, tt as PaymentCommandId, u as AccountProviderSource, ut as SmartAccount, v as SmartAccount$1, wt as CapxulErrorCode, x as CanSendOtpStatus, y as ClockPort, z as BlockNumber } from "./OAuthBearerAuthClient-DOPDDSPs.mjs";
 import { Hex } from "viem";
 import { Context, Duration, Effect, Layer, Logger, Metric, References, Schema, Scope, Tracer } from "effect";
 import { FunctionReference } from "convex/server";
@@ -754,6 +754,433 @@ declare const CurrentPolicySchema: Schema.Union<readonly [Schema.Struct<{
   readonly type: Schema.Literal<"managePeople">;
 }>]>;
 type CurrentPolicy = typeof CurrentPolicySchema.Type;
+declare const BudgetIntentSchema: Schema.refine<{
+  readonly type: "budget";
+  readonly asset: AssetId;
+  readonly limit: string | null;
+  readonly scope: {
+    readonly recipients: {
+      readonly type: "anyone";
+    } | {
+      readonly type: "allowlist";
+      readonly accounts: readonly AccountId[];
+    };
+    readonly actions: readonly ["commitments" | "pay", ...("commitments" | "pay")[]];
+  };
+}, Schema.Union<readonly [Schema.Struct<{
+  readonly type: Schema.Literal<"budget">;
+  readonly asset: Schema.refine<AssetId, Schema.String>;
+  readonly limit: Schema.NullOr<Schema.String>;
+  readonly scope: Schema.Struct<{
+    readonly recipients: Schema.Union<readonly [Schema.Struct<{
+      readonly type: Schema.Literal<"anyone">;
+    }>, Schema.Struct<{
+      readonly type: Schema.Literal<"allowlist">;
+      readonly accounts: Schema.$Array<Schema.refine<AccountId, Schema.String>>;
+    }>]>;
+    readonly actions: Schema.NonEmptyArray<Schema.Literals<readonly ["pay", "commitments"]>>;
+  }>;
+}>, Schema.Struct<{
+  readonly type: Schema.Literal<"managePeople">;
+}>]>>;
+type BudgetIntent = typeof BudgetIntentSchema.Type;
+declare const InvitationIdSchema: Schema.NonEmptyString;
+type InvitationId = typeof InvitationIdSchema.Type;
+declare const InvitationTargetSchema: Schema.Struct<{
+  readonly invitationId: Schema.NonEmptyString;
+}>;
+type InvitationTarget = typeof InvitationTargetSchema.Type;
+declare const InvitationAcceptInputSchema: Schema.Struct<{
+  readonly invitationId: Schema.NonEmptyString;
+  readonly expectedOfferDigest: Schema.Codec<string, string, never, never>;
+}>;
+/** The consent input: one invitation and the digest the grantee read for it. */
+type InvitationAcceptInput = typeof InvitationAcceptInputSchema.Type;
+/** The requested grantee of one invitation. */
+declare const GranteeRefSchema: Schema.Union<readonly [Schema.Struct<{
+  readonly type: Schema.Literal<"email">;
+  readonly email: Schema.NonEmptyString;
+}>, Schema.Struct<{
+  readonly type: Schema.Literal<"account">;
+  readonly accountId: Schema.refine<AccountId, Schema.String>;
+}>]>;
+type GranteeRef = typeof GranteeRefSchema.Type;
+declare const InviteInputSchema: Schema.refine<{
+  readonly requestKey: string;
+  readonly to: {
+    readonly type: "email";
+    readonly email: string;
+  } | {
+    readonly type: "account";
+    readonly accountId: AccountId;
+  };
+  readonly grants: readonly ({
+    readonly type: "budget";
+    readonly budgetId: PermissionId;
+  } | {
+    readonly type: "managePeople";
+    readonly permissionId: PermissionId;
+  } | {
+    readonly type: "new_budget";
+    readonly label: string;
+    readonly intent: {
+      readonly type: "budget";
+      readonly asset: AssetId;
+      readonly limit: string | null;
+      readonly scope: {
+        readonly recipients: {
+          readonly type: "anyone";
+        } | {
+          readonly type: "allowlist";
+          readonly accounts: readonly AccountId[];
+        };
+        readonly actions: readonly ["commitments" | "pay", ...("commitments" | "pay")[]];
+      };
+    };
+  })[];
+}, Schema.Struct<{
+  readonly requestKey: Schema.refine<string, Schema.String>;
+  readonly to: Schema.Union<readonly [Schema.Struct<{
+    readonly type: Schema.Literal<"email">;
+    readonly email: Schema.NonEmptyString;
+  }>, Schema.Struct<{
+    readonly type: Schema.Literal<"account">;
+    readonly accountId: Schema.refine<AccountId, Schema.String>;
+  }>]>;
+  readonly grants: Schema.$Array<Schema.Union<readonly [Schema.Struct<{
+    readonly type: Schema.Literal<"budget">;
+    readonly budgetId: Schema.Codec<PermissionId, string, never, never>;
+  }>, Schema.Struct<{
+    readonly type: Schema.Literal<"managePeople">;
+    readonly permissionId: Schema.Codec<PermissionId, string, never, never>;
+  }>, Schema.Struct<{
+    readonly type: Schema.Literal<"new_budget">;
+    readonly label: Schema.refine<string, Schema.String>;
+    readonly intent: Schema.refine<{
+      readonly type: "budget";
+      readonly asset: AssetId;
+      readonly limit: string | null;
+      readonly scope: {
+        readonly recipients: {
+          readonly type: "anyone";
+        } | {
+          readonly type: "allowlist";
+          readonly accounts: readonly AccountId[];
+        };
+        readonly actions: readonly ["commitments" | "pay", ...("commitments" | "pay")[]];
+      };
+    }, Schema.Union<readonly [Schema.Struct<{
+      readonly type: Schema.Literal<"budget">;
+      readonly asset: Schema.refine<AssetId, Schema.String>;
+      readonly limit: Schema.NullOr<Schema.String>;
+      readonly scope: Schema.Struct<{
+        readonly recipients: Schema.Union<readonly [Schema.Struct<{
+          readonly type: Schema.Literal<"anyone">;
+        }>, Schema.Struct<{
+          readonly type: Schema.Literal<"allowlist">;
+          readonly accounts: Schema.$Array<Schema.refine<AccountId, Schema.String>>;
+        }>]>;
+        readonly actions: Schema.NonEmptyArray<Schema.Literals<readonly ["pay", "commitments"]>>;
+      }>;
+    }>, Schema.Struct<{
+      readonly type: Schema.Literal<"managePeople">;
+    }>]>>;
+  }>]>>;
+}>>;
+type InviteInput = typeof InviteInputSchema.Type;
+/** One offered authority, before the invitation resolves it to a live identity. */
+type InviteGrant = InviteInput["grants"][number];
+/** The recipient and action bounds carried by one Budget intent. */
+type SpendingScope = Extract<BudgetIntent, {
+  readonly type: "budget";
+}>["scope"];
+declare const InvitationPhaseSchema: Schema.Literals<readonly ["authorizing", "pending", "pending_grant", "active", "revoking", "declined", "cancelled", "expired", "revoked"]>;
+type InvitationPhase = typeof InvitationPhaseSchema.Type;
+declare const EndingReasonSchema: Schema.Literals<readonly ["declined", "cancelled", "expired", "revoked"]>;
+type EndingReason = typeof EndingReasonSchema.Type;
+declare const OfferedAuthoritySchema: Schema.Union<readonly [Schema.Struct<{
+  readonly type: Schema.Literal<"budget">;
+  readonly budgetId: Schema.refine<BudgetId, Schema.NonEmptyString>;
+  readonly label: Schema.String;
+  readonly policy: Schema.refine<{
+    readonly type: "budget";
+    readonly asset: AssetId;
+    readonly limit: string | null;
+    readonly scope: {
+      readonly recipients: {
+        readonly type: "anyone";
+      } | {
+        readonly type: "allowlist";
+        readonly accounts: readonly AccountId[];
+      };
+      readonly actions: readonly ["commitments" | "pay", ...("commitments" | "pay")[]];
+    };
+  }, Schema.Union<readonly [Schema.Struct<{
+    readonly type: Schema.Literal<"budget">;
+    readonly asset: Schema.refine<AssetId, Schema.String>;
+    readonly limit: Schema.NullOr<Schema.String>;
+    readonly scope: Schema.Struct<{
+      readonly recipients: Schema.Union<readonly [Schema.Struct<{
+        readonly type: Schema.Literal<"anyone">;
+      }>, Schema.Struct<{
+        readonly type: Schema.Literal<"allowlist">;
+        readonly accounts: Schema.$Array<Schema.refine<AccountId, Schema.String>>;
+      }>]>;
+      readonly actions: Schema.NonEmptyArray<Schema.Literals<readonly ["pay", "commitments"]>>;
+    }>;
+  }>, Schema.Struct<{
+    readonly type: Schema.Literal<"managePeople">;
+  }>]>>;
+  readonly policyDigest: Schema.Codec<string, string, never, never>;
+}>, Schema.Struct<{
+  readonly type: Schema.Literal<"managePeople">;
+  readonly permissionId: Schema.Codec<PermissionId, string, never, never>;
+  readonly label: Schema.String;
+}>]>;
+type OfferedAuthority = typeof OfferedAuthoritySchema.Type;
+declare const InvitePreviewSchema: Schema.Struct<{
+  readonly orgId: Schema.refine<OrgId, Schema.NonEmptyString>;
+  readonly grantee: Schema.Struct<{
+    readonly partyId: Schema.NullOr<Schema.String>;
+    readonly accountId: Schema.NullOr<Schema.refine<AccountId, Schema.String>>;
+    readonly safeAddress: Schema.Codec<Address$1, string, never, never>;
+    readonly accountReady: Schema.NullOr<Schema.Boolean>;
+  }>;
+  readonly grants: Schema.$Array<Schema.Union<readonly [Schema.Union<readonly [Schema.Struct<{
+    readonly type: Schema.Literal<"budget">;
+    readonly budgetId: Schema.refine<BudgetId, Schema.NonEmptyString>;
+    readonly label: Schema.String;
+    readonly policy: Schema.refine<{
+      readonly type: "budget";
+      readonly asset: AssetId;
+      readonly limit: string | null;
+      readonly scope: {
+        readonly recipients: {
+          readonly type: "anyone";
+        } | {
+          readonly type: "allowlist";
+          readonly accounts: readonly AccountId[];
+        };
+        readonly actions: readonly ["commitments" | "pay", ...("commitments" | "pay")[]];
+      };
+    }, Schema.Union<readonly [Schema.Struct<{
+      readonly type: Schema.Literal<"budget">;
+      readonly asset: Schema.refine<AssetId, Schema.String>;
+      readonly limit: Schema.NullOr<Schema.String>;
+      readonly scope: Schema.Struct<{
+        readonly recipients: Schema.Union<readonly [Schema.Struct<{
+          readonly type: Schema.Literal<"anyone">;
+        }>, Schema.Struct<{
+          readonly type: Schema.Literal<"allowlist">;
+          readonly accounts: Schema.$Array<Schema.refine<AccountId, Schema.String>>;
+        }>]>;
+        readonly actions: Schema.NonEmptyArray<Schema.Literals<readonly ["pay", "commitments"]>>;
+      }>;
+    }>, Schema.Struct<{
+      readonly type: Schema.Literal<"managePeople">;
+    }>]>>;
+    readonly policyDigest: Schema.Codec<string, string, never, never>;
+  }>, Schema.Struct<{
+    readonly type: Schema.Literal<"managePeople">;
+    readonly permissionId: Schema.Codec<PermissionId, string, never, never>;
+    readonly label: Schema.String;
+  }>]>, Schema.Struct<{
+    readonly type: Schema.Literal<"new_budget">;
+    readonly label: Schema.String;
+    readonly policy: Schema.refine<{
+      readonly type: "budget";
+      readonly asset: AssetId;
+      readonly limit: string | null;
+      readonly scope: {
+        readonly recipients: {
+          readonly type: "anyone";
+        } | {
+          readonly type: "allowlist";
+          readonly accounts: readonly AccountId[];
+        };
+        readonly actions: readonly ["commitments" | "pay", ...("commitments" | "pay")[]];
+      };
+    }, Schema.Union<readonly [Schema.Struct<{
+      readonly type: Schema.Literal<"budget">;
+      readonly asset: Schema.refine<AssetId, Schema.String>;
+      readonly limit: Schema.NullOr<Schema.String>;
+      readonly scope: Schema.Struct<{
+        readonly recipients: Schema.Union<readonly [Schema.Struct<{
+          readonly type: Schema.Literal<"anyone">;
+        }>, Schema.Struct<{
+          readonly type: Schema.Literal<"allowlist">;
+          readonly accounts: Schema.$Array<Schema.refine<AccountId, Schema.String>>;
+        }>]>;
+        readonly actions: Schema.NonEmptyArray<Schema.Literals<readonly ["pay", "commitments"]>>;
+      }>;
+    }>, Schema.Struct<{
+      readonly type: Schema.Literal<"managePeople">;
+    }>]>>;
+    readonly policyDigest: Schema.Codec<string, string, never, never>;
+  }>]>>;
+  readonly existingAssignments: Schema.$Array<Schema.Codec<PermissionAssignmentId, string, never, never>>;
+  readonly includesManagement: Schema.Boolean;
+  readonly observedAt: Schema.Codec<EpochMs, number, never, never>;
+}>;
+type InvitePreview = typeof InvitePreviewSchema.Type;
+declare const InvitationPageInputSchema: Schema.Struct<{
+  readonly cursor: Schema.optional<Schema.NonEmptyString>;
+  readonly limit: Schema.optional<Schema.refine<number, Schema.Number>>;
+  readonly phases: Schema.optional<Schema.refine<readonly ("active" | "authorizing" | "cancelled" | "declined" | "expired" | "pending" | "pending_grant" | "revoked" | "revoking")[], Schema.$Array<Schema.Literals<readonly ["authorizing", "pending", "pending_grant", "active", "revoking", "declined", "cancelled", "expired", "revoked"]>>>>;
+}>;
+type InvitationPageInput = typeof InvitationPageInputSchema.Type;
+declare const InvitationRecoverySchema: Schema.Struct<{
+  readonly actor: Schema.Literals<readonly ["system", "invitee", "admin"]>;
+  readonly action: Schema.Literals<readonly ["wait", "retry", "review_offer", "reauthorize"]>;
+  readonly reason: Schema.Literals<readonly ["configuration_pending", "grant_pending", "provider_unavailable", "policy_changed", "cleanup_pending", "signer_unavailable"]>;
+}>;
+type InvitationRecovery = typeof InvitationRecoverySchema.Type;
+declare const InvitationViewSchema: Schema.Struct<{
+  readonly id: Schema.NonEmptyString;
+  readonly orgId: Schema.refine<OrgId, Schema.NonEmptyString>;
+  readonly organizationName: Schema.String;
+  readonly grantee: Schema.Struct<{
+    readonly partyId: Schema.String;
+    readonly accountId: Schema.NullOr<Schema.refine<AccountId, Schema.String>>;
+    readonly safeAddress: Schema.Codec<Address$1, string, never, never>;
+    readonly accountReady: Schema.NullOr<Schema.Boolean>;
+  }>;
+  readonly phase: Schema.Literals<readonly ["authorizing", "pending", "pending_grant", "active", "revoking", "declined", "cancelled", "expired", "revoked"]>;
+  readonly grants: Schema.$Array<Schema.Union<readonly [Schema.Struct<{
+    readonly type: Schema.Literal<"budget">;
+    readonly budgetId: Schema.refine<BudgetId, Schema.NonEmptyString>;
+  }>, Schema.Struct<{
+    readonly type: Schema.Literal<"managePeople">;
+    readonly permissionId: Schema.Codec<PermissionId, string, never, never>;
+  }>]>>;
+  readonly offers: Schema.$Array<Schema.Union<readonly [Schema.Struct<{
+    readonly type: Schema.Literal<"budget">;
+    readonly budgetId: Schema.refine<BudgetId, Schema.NonEmptyString>;
+    readonly label: Schema.String;
+    readonly policy: Schema.refine<{
+      readonly type: "budget";
+      readonly asset: AssetId;
+      readonly limit: string | null;
+      readonly scope: {
+        readonly recipients: {
+          readonly type: "anyone";
+        } | {
+          readonly type: "allowlist";
+          readonly accounts: readonly AccountId[];
+        };
+        readonly actions: readonly ["commitments" | "pay", ...("commitments" | "pay")[]];
+      };
+    }, Schema.Union<readonly [Schema.Struct<{
+      readonly type: Schema.Literal<"budget">;
+      readonly asset: Schema.refine<AssetId, Schema.String>;
+      readonly limit: Schema.NullOr<Schema.String>;
+      readonly scope: Schema.Struct<{
+        readonly recipients: Schema.Union<readonly [Schema.Struct<{
+          readonly type: Schema.Literal<"anyone">;
+        }>, Schema.Struct<{
+          readonly type: Schema.Literal<"allowlist">;
+          readonly accounts: Schema.$Array<Schema.refine<AccountId, Schema.String>>;
+        }>]>;
+        readonly actions: Schema.NonEmptyArray<Schema.Literals<readonly ["pay", "commitments"]>>;
+      }>;
+    }>, Schema.Struct<{
+      readonly type: Schema.Literal<"managePeople">;
+    }>]>>;
+    readonly policyDigest: Schema.Codec<string, string, never, never>;
+  }>, Schema.Struct<{
+    readonly type: Schema.Literal<"managePeople">;
+    readonly permissionId: Schema.Codec<PermissionId, string, never, never>;
+    readonly label: Schema.String;
+  }>]>>;
+  readonly recovery: Schema.NullOr<Schema.Struct<{
+    readonly actor: Schema.Literals<readonly ["system", "invitee", "admin"]>;
+    readonly action: Schema.Literals<readonly ["wait", "retry", "review_offer", "reauthorize"]>;
+    readonly reason: Schema.Literals<readonly ["configuration_pending", "grant_pending", "provider_unavailable", "policy_changed", "cleanup_pending", "signer_unavailable"]>;
+  }>>;
+  readonly offerDigest: Schema.Codec<string, string, never, never>;
+  readonly authorizedAt: Schema.NullOr<Schema.Codec<EpochMs, number, never, never>>;
+  readonly acceptedAt: Schema.NullOr<Schema.Codec<EpochMs, number, never, never>>;
+  readonly expiresAt: Schema.NullOr<Schema.Codec<EpochMs, number, never, never>>;
+  readonly commandId: Schema.NullOr<Schema.Codec<PaymentCommandId, string, never, never>>;
+  readonly endingReason: Schema.NullOr<Schema.Literals<readonly ["declined", "cancelled", "expired", "revoked"]>>;
+  readonly delivery: Schema.Literals<readonly ["not_confirmed", "sent", "failed"]>;
+}>;
+type InvitationView = typeof InvitationViewSchema.Type;
+declare const InvitationPageSchema: Schema.Struct<{
+  readonly items: Schema.$Array<Schema.Struct<{
+    readonly id: Schema.NonEmptyString;
+    readonly orgId: Schema.refine<OrgId, Schema.NonEmptyString>;
+    readonly organizationName: Schema.String;
+    readonly grantee: Schema.Struct<{
+      readonly partyId: Schema.String;
+      readonly accountId: Schema.NullOr<Schema.refine<AccountId, Schema.String>>;
+      readonly safeAddress: Schema.Codec<Address$1, string, never, never>;
+      readonly accountReady: Schema.NullOr<Schema.Boolean>;
+    }>;
+    readonly phase: Schema.Literals<readonly ["authorizing", "pending", "pending_grant", "active", "revoking", "declined", "cancelled", "expired", "revoked"]>;
+    readonly grants: Schema.$Array<Schema.Union<readonly [Schema.Struct<{
+      readonly type: Schema.Literal<"budget">;
+      readonly budgetId: Schema.refine<BudgetId, Schema.NonEmptyString>;
+    }>, Schema.Struct<{
+      readonly type: Schema.Literal<"managePeople">;
+      readonly permissionId: Schema.Codec<PermissionId, string, never, never>;
+    }>]>>;
+    readonly offers: Schema.$Array<Schema.Union<readonly [Schema.Struct<{
+      readonly type: Schema.Literal<"budget">;
+      readonly budgetId: Schema.refine<BudgetId, Schema.NonEmptyString>;
+      readonly label: Schema.String;
+      readonly policy: Schema.refine<{
+        readonly type: "budget";
+        readonly asset: AssetId;
+        readonly limit: string | null;
+        readonly scope: {
+          readonly recipients: {
+            readonly type: "anyone";
+          } | {
+            readonly type: "allowlist";
+            readonly accounts: readonly AccountId[];
+          };
+          readonly actions: readonly ["commitments" | "pay", ...("commitments" | "pay")[]];
+        };
+      }, Schema.Union<readonly [Schema.Struct<{
+        readonly type: Schema.Literal<"budget">;
+        readonly asset: Schema.refine<AssetId, Schema.String>;
+        readonly limit: Schema.NullOr<Schema.String>;
+        readonly scope: Schema.Struct<{
+          readonly recipients: Schema.Union<readonly [Schema.Struct<{
+            readonly type: Schema.Literal<"anyone">;
+          }>, Schema.Struct<{
+            readonly type: Schema.Literal<"allowlist">;
+            readonly accounts: Schema.$Array<Schema.refine<AccountId, Schema.String>>;
+          }>]>;
+          readonly actions: Schema.NonEmptyArray<Schema.Literals<readonly ["pay", "commitments"]>>;
+        }>;
+      }>, Schema.Struct<{
+        readonly type: Schema.Literal<"managePeople">;
+      }>]>>;
+      readonly policyDigest: Schema.Codec<string, string, never, never>;
+    }>, Schema.Struct<{
+      readonly type: Schema.Literal<"managePeople">;
+      readonly permissionId: Schema.Codec<PermissionId, string, never, never>;
+      readonly label: Schema.String;
+    }>]>>;
+    readonly recovery: Schema.NullOr<Schema.Struct<{
+      readonly actor: Schema.Literals<readonly ["system", "invitee", "admin"]>;
+      readonly action: Schema.Literals<readonly ["wait", "retry", "review_offer", "reauthorize"]>;
+      readonly reason: Schema.Literals<readonly ["configuration_pending", "grant_pending", "provider_unavailable", "policy_changed", "cleanup_pending", "signer_unavailable"]>;
+    }>>;
+    readonly offerDigest: Schema.Codec<string, string, never, never>;
+    readonly authorizedAt: Schema.NullOr<Schema.Codec<EpochMs, number, never, never>>;
+    readonly acceptedAt: Schema.NullOr<Schema.Codec<EpochMs, number, never, never>>;
+    readonly expiresAt: Schema.NullOr<Schema.Codec<EpochMs, number, never, never>>;
+    readonly commandId: Schema.NullOr<Schema.Codec<PaymentCommandId, string, never, never>>;
+    readonly endingReason: Schema.NullOr<Schema.Literals<readonly ["declined", "cancelled", "expired", "revoked"]>>;
+    readonly delivery: Schema.Literals<readonly ["not_confirmed", "sent", "failed"]>;
+  }>>;
+  readonly nextCursor: Schema.NullOr<Schema.NonEmptyString>;
+  readonly observedAt: Schema.Codec<EpochMs, number, never, never>;
+}>;
+type InvitationPage = typeof InvitationPageSchema.Type;
 //#endregion
 //#region src/ports/bootstrap.d.ts
 type BootstrapInput = {
@@ -2277,24 +2704,6 @@ type ListOrgRolesInput = {
 type ListOrgMembersInput = {
   readonly orgId: OrgId;
 };
-/**
- * R06 (#1964): the program attaches the caller's captured attempt to this
- * record through `copyInvocationObservation`, so the adapter forwards one
- * observation context to the backend action that owns `org_invite_sent`. The
- * carrier is a non-enumerable symbol and never becomes a wire field.
- */
-type InviteOrgMemberInput = {
-  readonly orgId: OrgId;
-  readonly input: InviteMemberInput;
-};
-type ResendOrgInviteTokenInput = {
-  readonly orgId: OrgId;
-  readonly email: string;
-};
-type DetectPendingOrgInvitationsInput = Record<never, never>;
-type DetectPendingOrgInvitationsResult$1 = {
-  readonly matched: readonly OrgId[];
-};
 declare const OrgError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
   readonly _tag: "OrgError";
 } & Readonly<A>;
@@ -2313,9 +2722,6 @@ interface OrgPort {
   listRoles(input: ListOrgRolesInput): Effect.Effect<readonly RoleView[], OrgError, never>;
   listMembers(input: ListOrgMembersInput): Effect.Effect<readonly MemberView[], OrgError, never>;
   pendingMembers?(input: ListOrgMembersInput): Effect.Effect<readonly MemberView[], OrgError, never>;
-  inviteMember(input: InviteOrgMemberInput): Effect.Effect<MemberView, OrgError, never>;
-  resendInviteToken?(input: ResendOrgInviteTokenInput): Effect.Effect<MemberView, OrgError, never>;
-  detectAndAcceptPendingInvitations(input: DetectPendingOrgInvitationsInput): Effect.Effect<DetectPendingOrgInvitationsResult$1, OrgError, never>;
 }
 //#endregion
 //#region src/surface/org-me.d.ts
@@ -2365,6 +2771,117 @@ type OrgMeOptions = {
 };
 type OrgMeMethod = (options?: OrgMeOptions) => Promise<CapxulResult<OrgMe>>;
 //#endregion
+//#region src/surface/invitations.d.ts
+/** The preview request: the bounded invitation request without its write key. */
+type InvitePreviewInput = Omit<InviteInput, "requestKey">;
+/** The durable identity the authoring write delivers before it signs (§9). */
+type InvitePrepared = {
+  readonly invitationId: string;
+  readonly commandId: string;
+};
+/**
+ * The authoring write's options. `onPrepared` is the D9 §6 authoring callback:
+ * it receives the exact `{invitationId, commandId}` pair after the backend
+ * prepared the configuration execution and before any digest is signed. The
+ * write awaits it, and a failure stops the write before a signature exists.
+ */
+type InviteOptions = InvocationControls & {
+  readonly onPrepared?: (value: InvitePrepared) => void | Promise<void>;
+};
+/**
+ * The invitation methods of one Organization. Every method is scoped to the
+ * Organization the bundle was resolved for; the caller never supplies the scope
+ * again, and a result naming another Organization is refused.
+ */
+interface OrgInvitations {
+  /** The Admin's read-only preview. It performs no write and invents no Budget. */
+  preview(input: InvitePreviewInput, options?: InvocationControls): Promise<CapxulResult<InvitePreview>>;
+  /**
+   * The authoring write: authorize one exact offer to one exact grantee, and
+   * execute its configuration hop. It persists the invitation and its
+   * configuration command before any signature exists, so the same `requestKey`
+   * replays the same invitation and reuses the same stored execution. It then
+   * drives the existing human configuration owner: prepare the exact configure
+   * command for this Account's Safe, deliver `{invitationId, commandId}` to
+   * `onPrepared`, sign the returned digest, and submit it. This is not
+   * acceptance: an authorized offer is still pending until its grantee consents.
+   *
+   * A client composed without an execution-capable signer refuses before the
+   * write. Data creation success therefore means the offer's configuration
+   * execution was submitted, never a half-authored offer that can never leave
+   * `authorizing` (§8's next action is the human configuration
+   * signing/submission).
+   *
+   * On a fresh request the view it returns is the AUTHORIZATION-TIME view:
+   * `authorizing`, with its `commandId` and its `configuration_pending`
+   * recovery. The offer reaches `pending` with `authorizedAt` and `expiresAt`
+   * only when the configuration verification lands
+   * (`recordInvitationConfigurationVerification`), which happens after this call
+   * returns — so a re-read here would return the same `authorizing` view. Read
+   * the settled state through `get` or `wait`. A settled replay is the
+   * exception: a request key whose invitation has already left `authorizing`
+   * returns that durable current view unchanged, not an authorization-time one,
+   * and composes no signer.
+   *
+   * This bundle is the canonical D8 authoring surface shared with the CLI.
+   * MCP exposes no invitation-authoring tool.
+   */
+  invite(input: InviteInput, options?: InviteOptions): Promise<CapxulResult<InvitationView>>;
+  /**
+   * The exact grantee's consent commit (D8 §8): accept the current offer digest
+   * and start the offer's automatic grant.
+   *
+   * `expectedOfferDigest` is the digest the caller read for this invitation —
+   * `get` or the own-offer list show it, and nothing else may be substituted.
+   * Consent is recorded once: a repeat with the stored digest returns the same
+   * accepted result and writes nothing, and a different digest receives the
+   * backend's closed `WRONG_STATE` `invitation-offer-changed` refusal instead of
+   * overwriting the stored consent. The wrong authenticated grantee, an
+   * unconfigured offer, an expired offer, and an ended offer all refuse before
+   * any consent is written.
+   *
+   * The returned view is the AUTHORIZATION-TIME view of the consent commit:
+   * `pending_grant`, with `acceptedAt`. The stored accepted digest remains a
+   * durable backend consent fact rather than a public `InvitationView` field. The
+   * offer reaches `active` only after the grant receipt verifies on chain, which
+   * happens in the lane this commit starts — so read the settled state through
+   * `get`/`wait`. A repeat on an already-settled offer returns the durable view
+   * unchanged.
+   */
+  accept(input: InvitationAcceptInput, options?: InvocationControls): Promise<CapxulResult<InvitationView>>;
+  /**
+   * The Organization's invitations for a current Admin (D8 §3: the scoped list
+   * is Admin-only). A member without management authority and a caller outside
+   * the Organization receive the backend's existing typed refusal, never a
+   * page.
+   *
+   * Every row is checked against the Organization this bundle was resolved for;
+   * a page that names another Organization is refused rather than handed to a
+   * caller that trusted its scope.
+   */
+  list(input?: InvitationPageInput, options?: InvocationControls): Promise<CapxulResult<InvitationPage>>;
+  get(input: InvitationTarget, options?: InvocationControls): Promise<CapxulResult<InvitationView>>;
+  /** The exact grantee ends the offer; the Admin may not decline on their behalf. */
+  decline(input: InvitationTarget, options?: InvocationControls): Promise<CapxulResult<InvitationView>>;
+  /** The current Admin ends the offer and starts its cleanup. */
+  cancel(input: InvitationTarget, options?: InvocationControls): Promise<CapxulResult<InvitationView>>;
+  /** The current Admin retries delivery of a verified pending offer only. */
+  resend(input: InvitationTarget, options?: InvocationControls): Promise<CapxulResult<InvitationView>>;
+  /** The exact grantee or the current Admin resumes the current offer state. */
+  retry(input: InvitationTarget, options?: InvocationControls): Promise<CapxulResult<InvitationView>>;
+}
+/**
+ * The authenticated grantee's own offers, paged with the versioned cursor.
+ *
+ * The page names the authenticated principal and the exact phase filter on the
+ * server; the cursor carries no trusted resource value. A caller's Organization
+ * is never consulted: D8 §3 makes the own-offer list grantee-scoped by the
+ * session, and a saved read default is not an access decision.
+ */
+type OwnInvitationsMethod = (input?: InvitationPageInput, options?: InvocationControls) => Promise<CapxulResult<InvitationPage>>;
+/** The authoring write: one bounded request authorizes one exact offer. */
+type InviteMethod = (input: InviteInput, options?: InviteOptions) => Promise<CapxulResult<InvitationView>>;
+//#endregion
 //#region src/contract/permission.d.ts
 interface PermissionReadResult {
   readonly permissions: readonly Permission[];
@@ -2715,23 +3232,6 @@ type CreateOrgInput = {
   readonly template: OrgTemplate;
   readonly country?: string;
 };
-/**
- * Input to `org(orgId).invite`. Email is the universal entry point.
- * An address that is not yet a Capxul user creates a `pending`
- * membership that resolves on sign-in. `role` is invitation metadata. It does
- * not grant an on-chain Permission.
- */
-type InviteMemberInput = {
-  readonly email: string;
-  readonly role: string;
-};
-type ResendInviteTokenInput = {
-  readonly email: string;
-};
-/** Organization ids whose pending invitations match the current Account. */
-type DetectPendingOrgInvitationsResult = {
-  readonly matched: readonly OrgId[];
-};
 /** Organization methods for one `orgId`. */
 interface OrgScopedMethods extends ActorRelationshipMethods {
   /**
@@ -2765,13 +3265,11 @@ interface OrgScopedMethods extends ActorRelationshipMethods {
     readonly signal?: AbortSignal;
   }): Promise<CapxulResult<readonly RoleView[]>>;
   /**
-   * Invite a member by email. `options` is the browser attempt the caller
-   * captured before the person pressed the button (R06 #1964); it reaches the
-   * backend action unchanged, so the durable `org_invite_sent` and the later
-   * `org_invite_progressed` share the attempt's correlation. `{ signal }`
-   * callers are unaffected.
+   * The D8 invitation surface of this Organization: the Admin's preview, the
+   * authoring write, explicit digest-bound acceptance, the scoped read, and the
+   * four consent-free transitions.
    */
-  invite(input: InviteMemberInput, options?: InvocationControls): Promise<CapxulResult<MemberView>>;
+  readonly invitations: OrgInvitations;
   /**
    * Leak-safe Organization payment: execute through the payments engine with
    * the selected receipt-verified Budget Permission
@@ -2795,9 +3293,13 @@ type OrgsMethod = {
   (options?: {
     readonly signal?: AbortSignal;
   }): Promise<CapxulResult<readonly OrganizationAccess[]>>;
-  detectAndAcceptPendingInvitations(options?: {
-    readonly signal?: AbortSignal;
-  }): Promise<CapxulResult<DetectPendingOrgInvitationsResult>>;
+  /**
+   * The authenticated grantee's own offers, paged with the versioned cursor.
+   * The Admin-scoped Organization list is the scoped
+   * `org(orgId).invitations.list`; this method never consults a saved
+   * Organization.
+   */
+  invitations: OwnInvitationsMethod;
 };
 /**
  * Top-level Org method bundle, exposed at `client.org` / `client.orgs` /
@@ -3376,4 +3878,4 @@ interface ProductionSignerControls {
   readonly signEmbeddedUserOpHash?: OpenfortBrowserSignerOptions["signUserOpHash"];
 }
 //#endregion
-export { PayrollRun as $, CurrentPolicy as $n, ActivityRange as $t, InviteMemberInput as A, PaymentTiming as An, AccountMethods as At, OrganizationAuditLogItem as B, AccountLifecycle as Bn, AddressBookMethods as Bt, SystemHealth as C, PaymentActivityEvidence as Cn, StateLabel as Cr, OrganizationOnboarding as Ct, AssignmentProjection as D, PaymentDocumentsMethods as Dn, IdentityTransition as Dr, PersonOnboarding as Dt, CurrentUserMethods as E, PaymentDocumentRef as En, isRestoring as Er, OrganizationOnboardingState as Et, OrgScopedMethods as F, Ref$1 as Fn, ActorRequestIssueInput as Ft, AuthorizeRunOptions as G, SmartAccountMethods as Gn, ActivityAnnotationInput as Gt, RoleDefinition as H, isSettingUpLifecycle as Hn, InboxItem as Ht, OrgTemplate as I, ResolvedTarget as In, ActorRequestsMethods as It, PayrollGroupInput as J, ClientRequests as Jn, ActivityItem as Jt, PayrollEngagementTerms as K, AuthMethods as Kn, ActivityDetail as Kt, OrgView as L, TargetReference as Ln, AddressBookAddInput as Lt, MemberStatus as M, PaymentsMethods as Mn, ActorProfileMethods as Mt, MemberView as N, PaymentsPayInput as Nn, ActorRelationshipMethods as Nt, CreateOrgInput as O, PaymentMoney as On, InvocationControls as Or, PersonOnboardingInput as Ot, OrgMethods as P, RecipientResolution as Pn, ActorRequest as Pt, PayrollOptions as Q, AuthorityRef as Qn, ActivityPage as Qt, OrganizationAccess as R, TargetsMethods as Rn, AddressBookEntry as Rt, SystemMethods as S, Payment as Sn, Readiness as Sr, OnboardingMethods as St, CurrentUserContext as T, PaymentDocumentKind as Tn, isClaimed as Tr, OrganizationOnboardingOptions as Tt, RoleView as U, CompleteProfileInput as Un, InboxMethods as Ut, ResendInviteTokenInput as V, AccountSetupStep as Vn, InboxApproveInput as Vt, AuthorizeRunInput as W, IdentityMethods as Wn, ActivityAnnotation as Wt, PayrollGroupsMethods as X, OrgSetupStep as Xn, ActivityListParams as Xt, PayrollGroupMember as Y, OrgLifecycle as Yn, ActivityKind as Yt, PayrollMethods as Z, PayoutAddress as Zn, ActivityMethods as Zt, CreateCapxulClientInput as _, MovementActivityEvidence as _n, TelemetryPort as _r, OrgMe as _t, ObservationContext as a, DepositInstructions as an, ActorRef as ar, OrganizationPaymentInput as at, IdentityRuntimeSendResult as b, OfframpQuoteInput as bn, IdentityState as br, AccountsMethods as bt, HostObservability as c, DestinationKind as cn, SubmittedPermissionExecution as cr, PermissionAssignInput as ct, postHogObservability as d, DestinationRail as dn, PAYMENT_STATUSES as dr, PermissionMethods as dt, ActivityReference as en, ClientRequestView as er, PayrollRunItemInput as et, OpenfortBrowserAuth as f, DestinationRemoveInput as fn, PaymentStatus$1 as fr, PermissionOptions as ft, CapxulClient as g, MeProfile as gn, TelemetryIdentifyInput as gr, Budget as gt, createOpenfortBrowserSigner as h, MeMethods as hn, TelemetryGroupInput as hr, PermissionReadResult as ht, ObservationAdapter as i, ActorReference as in, PaymentDocumentVerification as ir, OrganizationPaymentBatchInput as it, MemberIdentityProjection as j, PaymentType as jn, ActorProfile as jt, DetectPendingOrgInvitationsResult as k, PaymentStatus as kn, ReadyAccountLifecycle as kt, PostHogObservabilityClient as l, DestinationListInput as ln, InboxStatus as lr, PermissionChangeInput as lt, OpenfortBrowserSignerBootstrap as m, FinancialOpsMethods as mn, TelemetryEvent as mr, PermissionRevokeInput as mt, ProductionSignerControls as n, ActivitySummaryParams as nn, PaymentDocumentReadRef as nr, PayrollRuns as nt, ObservationDelivery as o, Destination as on, CurrentHoldings as or, OrganizationPaymentItemInput as ot, OpenfortBrowserSigner as p, DestinationsMethods as pn, RequestStatus as pr, PermissionReplaceInput as pt, PayrollGroup as q, AccountSetupPolicy as qn, ActivityFilter as qt, CAPXUL_SDK_EXPECTED_OUTCOME_EVENT as r, ActivitySummaryTotal as rn, PaymentDocumentRender as rr, PayrollTermsUnit as rt, SdkFailureObservation as s, DestinationAddInput as sn, Permission as sr, OrganizationPaymentsMethods as st, CapxulClientInput as t, ActivitySummary as tn, PaymentDocumentDownload as tr, PayrollRunStatus as tt, PostHogObservabilityOptions as u, DestinationPayload as un, PAYMENT_DIRECTIONS as ur, PermissionCreateInput as ut, IdentityProfileDetails as v, OfframpMethods as vn, Destination$1 as vr, OrgMeMethod as vt, MediaMethods as w, PaymentDirection as wn, destination as wr, OrganizationOnboardingInput as wt, HoldingsMethods as x, OfframpStatus as xn, OrgLane as xr, CompletedPersonProfile as xt, IdentityRuntime as y, OfframpQuote as yn, IdentityEvent as yr, OrgMeOptions as yt, OrganizationAccount as z, fingerprintPaymentIntent as zn, AddressBookLabelInput as zt };
+export { PayrollRuns as $, OrgSetupStep as $n, ActivityListParams as $t, MemberStatus as A, PaymentDocumentsMethods as An, PAYMENT_STATUSES as Ar, PersonOnboarding as At, RoleView as B, TargetReference as Bn, OrgLane as Br, AddressBookAddInput as Bt, SystemHealth as C, OfframpQuoteInput as Cn, PaymentDocumentVerification as Cr, AccountsMethods as Ct, AssignmentProjection as D, PaymentDirection as Dn, SubmittedPermissionExecution as Dr, OrganizationOnboardingInput as Dt, CurrentUserMethods as E, PaymentActivityEvidence as En, Permission as Er, OrganizationOnboarding as Et, OrgView as F, PaymentsMethods as Fn, TelemetryIdentifyInput as Fr, ActorProfileMethods as Ft, PayrollGroupInput as G, isSettingUpLifecycle as Gn, isRestoring as Gr, InboxItem as Gt, AuthorizeRunOptions as H, fingerprintPaymentIntent as Hn, StateLabel as Hr, AddressBookLabelInput as Ht, OrganizationAccess as I, PaymentsPayInput as In, TelemetryPort as Ir, ActorRelationshipMethods as It, PayrollMethods as J, SmartAccountMethods as Jn, ActivityAnnotationInput as Jt, PayrollGroupMember as K, CompleteProfileInput as Kn, IdentityTransition as Kr, InboxMethods as Kt, OrganizationAccount as L, RecipientResolution as Ln, Destination$1 as Lr, ActorRequest as Lt, OrgMethods as M, PaymentStatus as Mn, RequestStatus as Mr, ReadyAccountLifecycle as Mt, OrgScopedMethods as N, PaymentTiming as Nn, TelemetryEvent as Nr, AccountMethods as Nt, CreateOrgInput as O, PaymentDocumentKind as On, InboxStatus as Or, OrganizationOnboardingOptions as Ot, OrgTemplate as P, PaymentType as Pn, TelemetryGroupInput as Pr, ActorProfile as Pt, PayrollRunStatus as Q, OrgLifecycle as Qn, ActivityKind as Qt, OrganizationAuditLogItem as R, Ref$1 as Rn, IdentityEvent as Rr, ActorRequestIssueInput as Rt, SystemMethods as S, OfframpQuote as Sn, PaymentDocumentRender as Sr, OrgMeOptions as St, CurrentUserContext as T, Payment as Tn, CurrentHoldings as Tr, OnboardingMethods as Tt, PayrollEngagementTerms as U, AccountLifecycle as Un, destination as Ur, AddressBookMethods as Ut, AuthorizeRunInput as V, TargetsMethods as Vn, Readiness as Vr, AddressBookEntry as Vt, PayrollGroup as W, AccountSetupStep as Wn, isClaimed as Wr, InboxApproveInput as Wt, PayrollRun as X, AccountSetupPolicy as Xn, ActivityFilter as Xt, PayrollOptions as Y, AuthMethods as Yn, ActivityDetail as Yt, PayrollRunItemInput as Z, ClientRequests as Zn, ActivityItem as Zt, CreateCapxulClientInput as _, FinancialOpsMethods as _n, OfferedAuthority as _r, OrgInvitations as _t, ObservationContext as a, ActivitySummaryParams as an, GranteeRef as ar, PermissionAssignInput as at, IdentityRuntimeSendResult as b, MovementActivityEvidence as bn, PaymentDocumentDownload as br, OrgMe as bt, HostObservability as c, DepositInstructions as cn, InvitationPage as cr, PermissionMethods as ct, postHogObservability as d, DestinationKind as dn, InvitationRecovery as dr, PermissionRevokeInput as dt, ActivityMethods as en, PayoutAddress as er, PayrollTermsUnit as et, OpenfortBrowserAuth as f, DestinationListInput as fn, InvitationTarget as fr, PermissionReadResult as ft, CapxulClient as g, DestinationsMethods as gn, InvitePreview as gr, InvitePreviewInput as gt, createOpenfortBrowserSigner as h, DestinationRemoveInput as hn, InviteInput as hr, InvitePrepared as ht, ObservationAdapter as i, ActivitySummary as in, EndingReason as ir, OrganizationPaymentsMethods as it, MemberView as j, PaymentMoney as jn, PaymentStatus$1 as jr, PersonOnboardingInput as jt, MemberIdentityProjection as k, PaymentDocumentRef as kn, PAYMENT_DIRECTIONS as kr, OrganizationOnboardingState as kt, PostHogObservabilityClient as l, Destination as ln, InvitationPageInput as lr, PermissionOptions as lt, OpenfortBrowserSignerBootstrap as m, DestinationRail as mn, InviteGrant as mr, InviteOptions as mt, ProductionSignerControls as n, ActivityRange as nn, BudgetIntent as nr, OrganizationPaymentInput as nt, ObservationDelivery as o, ActivitySummaryTotal as on, InvitationAcceptInput as or, PermissionChangeInput as ot, OpenfortBrowserSigner as p, DestinationPayload as pn, InvitationView as pr, InviteMethod as pt, PayrollGroupsMethods as q, IdentityMethods as qn, InvocationControls as qr, ActivityAnnotation as qt, CAPXUL_SDK_EXPECTED_OUTCOME_EVENT as r, ActivityReference as rn, CurrentPolicy as rr, OrganizationPaymentItemInput as rt, SdkFailureObservation as s, ActorReference as sn, InvitationId as sr, PermissionCreateInput as st, CapxulClientInput as t, ActivityPage as tn, AuthorityRef as tr, OrganizationPaymentBatchInput as tt, PostHogObservabilityOptions as u, DestinationAddInput as un, InvitationPhase as ur, PermissionReplaceInput as ut, IdentityProfileDetails as v, MeMethods as vn, SpendingScope as vr, OwnInvitationsMethod as vt, MediaMethods as w, OfframpStatus as wn, ActorRef as wr, CompletedPersonProfile as wt, HoldingsMethods as x, OfframpMethods as xn, PaymentDocumentReadRef as xr, OrgMeMethod as xt, IdentityRuntime as y, MeProfile as yn, ClientRequestView as yr, Budget as yt, RoleDefinition as z, ResolvedTarget as zn, IdentityState as zr, ActorRequestsMethods as zt };