@capxul/sdk 4.20.0-beta.6 → 4.20.0-beta.8

package/dist/{production-B4NzzuUb.mjs → production-DI1pfsy1.mjs}

@@ -1,4 +1,4 @@
-import { $ as toJwtToken, A as COUNTRY_CODE_RE, At as revertSummaryText, B as toAllowedOrigin, C as configuredMoneyAssetById, Ct as boundedResponseHeaders, D as BYTES32_RE, Dt as failureFingerprint, E as ASSET_ID_RE, Et as decodeChainCause, F as ZERO_BYTES32, G as toChainId, H as toAssetId, I as assetIdFor, J as toDurationMs, K as toCountryCode, M as EVM_ADDRESS_RE$1, Mt as isCredentialField, N as SUPPORTED_CURRENCY_CODES, Nt as redactSecrets, O as CLIENT_GRANT_ID_RE, Ot as isChainUpstream, P as WEI_RE, Pt as redactUrlSecrets, Q as toHandle, R as toAccountId, St as FAILURE_MODES$1, T as APP_ID_RE, Tt as chainEvidenceLabel, U as toAuthUserId, W as toBudgetId, X as toEpochMs, Y as toEmail, Z as toEpochSeconds, _ as normalizeBindingEmail, _t as CapxulError, at as toPermissionAssignmentId, b as CONFIGURED_MONEY_ASSETS, bt as isCapxulError, c as AuthCachePortTag, ct as toRoleKey, d as authClientPortFromPromiseAdapter, dt as toTxHash, et as toKycTier, f as AuthClientError, ft as toWeiAmount, g as orgRoleKeyForLabel, gt as CAPXUL_ERROR_CODES, h as ADMIN_ROLE_LABEL, ht as decodeConvexError, i as BrowserAuthCacheAdapter, it as toPayrollRunId, j as EMAIL_RE$1, jt as containsSensitiveMaterial, k as CLIENT_REQUEST_ID_RE, kt as isFailureMode, l as SystemClockLayer, lt as toSessionToken, mt as HANDLE_RE$1, nt as toPartyId, ot as toPermissionId, p as AuthClientPortTag, pt as validateHandle, q as toCurrencyCode, r as InMemoryAuthCacheAdapter, rt as toPayrollGroupId, st as toPublishableKey, tt as toOrgId, u as ClockPortTag, ut as toTesterKind, v as BASE_SEPOLIA_CHAIN_ID, vt as EXPECTED_OPERATION_OUTCOMES, w as ACCOUNT_ID_RE, wt as chainCauseProperties, x as SYNTHETIC_TEST_ASSET_FIXTURES, xt as CHAIN_UPSTREAMS, y as deriveCapxulSafeAddress, yt as Errors, z as toAddress } from "./OAuthBearerAuthClient-5ujCTtKE.mjs";
+import { $ as toKycTier, A as EMAIL_RE$1, At as containsSensitiveMaterial, C as ACCOUNT_ID_RE, Ct as chainCauseProperties, D as CLIENT_GRANT_ID_RE, Dt as isChainUpstream, E as BYTES32_RE, Et as failureFingerprint, F as assetIdFor, G as toCountryCode, H as toAuthUserId, J as toEmail, K as toCurrencyCode, L as toAccountId, M as SUPPORTED_CURRENCY_CODES, Mt as redactSecrets, N as WEI_RE, Nt as redactUrlSecrets, O as CLIENT_REQUEST_ID_RE, Ot as isFailureMode, P as ZERO_BYTES32, Q as toJwtToken, R as toAddress, S as configuredMoneyAssetById, St as boundedResponseHeaders, T as ASSET_ID_RE, Tt as decodeChainCause, U as toBudgetId, V as toAssetId, W as toChainId, X as toEpochSeconds, Y as toEpochMs, Z as toHandle, _ as BASE_SEPOLIA_CHAIN_ID, _t as EXPECTED_OPERATION_OUTCOMES, at as toPermissionId, b as SYNTHETIC_TEST_ASSET_FIXTURES, bt as CHAIN_UPSTREAMS, c as AuthCachePortTag, ct as toSessionToken, d as authClientPortFromPromiseAdapter, dt as toWeiAmount, et as toOrgId, f as AuthClientError, ft as validateHandle, g as normalizeBindingEmail, gt as CapxulError, h as ADMIN_ROLE_LABEL, ht as CAPXUL_ERROR_CODES, i as BrowserAuthCacheAdapter, it as toPermissionAssignmentId, j as EVM_ADDRESS_RE$1, jt as isCredentialField, k as COUNTRY_CODE_RE, kt as revertSummaryText, l as SystemClockLayer, lt as toTesterKind, mt as decodeConvexError, nt as toPayrollGroupId, ot as toPublishableKey, p as AuthClientPortTag, pt as HANDLE_RE$1, q as toDurationMs, r as InMemoryAuthCacheAdapter, rt as toPayrollRunId, st as toRoleKey, tt as toPartyId, u as ClockPortTag, ut as toTxHash, v as deriveCapxulSafeAddress, vt as Errors, w as APP_ID_RE, wt as chainEvidenceLabel, xt as FAILURE_MODES$1, y as CONFIGURED_MONEY_ASSETS, yt as isCapxulError, z as toAllowedOrigin } from "./OAuthBearerAuthClient-DdKYPHE0.mjs";
 import { formatUnits, keccak256, recoverAddress, stringToHex, toBytes } from "viem";
 import { Cause, Clock, Context, Data, Deferred, Duration, Effect, Exit, Fiber, FiberSet, Layer, Logger, Metric, Option, Queue, Ref, References, Result, Schedule, Schema, SchemaGetter, SchemaIssue, SchemaParser, Scope, Stream, Tracer } from "effect";
 import { getFunctionName, makeFunctionReference } from "convex/server";
@@ -937,10 +937,12 @@ const CAPXUL_OPERATIONS = {
 		prepareOrganizationPaymentExecution: "moneyExecution.prepareOrganizationPaymentExecution",
 		preparePaymentExecution: "moneyExecution.preparePaymentExecution",
 		preparePaymentLifecycleExecution: "moneyExecution.preparePaymentLifecycleExecution",
+		prepareInvitationConfiguration: "moneyExecution.prepareInvitationConfiguration",
 		preparePermissionExecution: "moneyExecution.preparePermissionExecution",
 		recoverSubmissionClaims: "moneyExecution.recoverSubmissionClaims",
 		submit: "moneyExecution.submit",
 		submitPaymentCommandExecution: "moneyExecution.submitPaymentCommandExecution",
+		submitInvitationConfigurationExecution: "moneyExecution.submitInvitationConfigurationExecution",
 		submitPaymentExecution: "moneyExecution.submitPaymentExecution",
 		submitPermissionExecution: "moneyExecution.submitPermissionExecution"
 	},
@@ -962,20 +964,52 @@ const CAPXUL_OPERATIONS = {
 		completePerson: "onboarding.completePerson"
 	},
 	org: {
-		acceptInvitations: "org.acceptInvitations",
 		account: { get: "org.account.get" },
-		activateMember: "org.activateMember",
 		auditLog: "org.auditLog",
 		confirmBootstrap: "org.confirmBootstrap",
 		createOrg: "org.createOrg",
 		create: "org.create",
-		detectAndAcceptPendingInvitations: "org.detectAndAcceptPendingInvitations",
+		/**
+		* §11: the consent mutation reports `org_invite_accepted` through its own
+		* scheduled emitter. It is named for the emit, not the acceptance, because
+		* the interactive acceptance itself owns `org.invitations.accept`.
+		*/
+		emitInviteAccepted: "org.emitInviteAccepted",
 		emitInviteProgressed: "org.emitInviteProgressed",
 		expireInvitations: "org.expireInvitations",
 		getLifecycle: "org.getLifecycle",
 		getProofReceipt: "org.getProofReceipt",
 		invite: "org.invite",
-		inviteMember: "org.inviteMember",
+		/** D8 invitation lifecycle: preview, own list, read, and the four transitions. */
+		invitations: {
+			/** The exact grantee's consent commit (§8): one accepted digest, once. */
+			accept: "org.invitations.accept",
+			/**
+			* The authoring write. It is named `authorize`, not `invite`, because the
+			* backend already uses `org.invitations.invite` as a refusal label and
+			* `lint:telemetry-spine` refuses a label that collides with an operation.
+			*/
+			authorize: "org.invitations.authorize",
+			cancel: "org.invitations.cancel",
+			decline: "org.invitations.decline",
+			get: "org.invitations.get",
+			list: "org.invitations.list",
+			/**
+			* The Admin-scoped Organization list. It is named `listScoped`, not
+			* `list`, because the own-offer list already owns `org.invitations.list`.
+			*/
+			listScoped: "org.invitations.listScoped",
+			/**
+			* The authoring write's inner hops: the SDK drives the backend's existing
+			* prepare/submit pair, and these names label the two Convex calls. The
+			* owning `capxul_sdk_operation` record stays `org.invitations.authorize`.
+			*/
+			prepareConfiguration: "org.invitations.prepareConfiguration",
+			preview: "org.invitations.preview",
+			resend: "org.invitations.resend",
+			retry: "org.invitations.retry",
+			submitConfiguration: "org.invitations.submitConfiguration"
+		},
 		list: "org.list",
 		load: "org.load",
 		me: "org.me",
@@ -1034,7 +1068,6 @@ const CAPXUL_OPERATIONS = {
 		},
 		recordFailure: "org.recordFailure",
 		recordProgress: "org.recordProgress",
-		resendInviteToken: "org.resendInviteToken",
 		resumeBootstrapSubmission: "org.resumeBootstrapSubmission",
 		retry: "org.retry",
 		retrySetup: "org.retrySetup",
@@ -1051,7 +1084,6 @@ const CAPXUL_OPERATIONS = {
 		retry: "organizationPayments.retry"
 	},
 	organizationSetup: { getProofReceipt: "organizationSetup.getProofReceipt" },
-	organizations: { detectAndAcceptPendingInvitations: "orgs.detectAndAcceptPendingInvitations" },
 	payments: {
 		cancel: "payments.cancel",
 		claim: "payments.claim",
@@ -1089,6 +1121,7 @@ const CAPXUL_OPERATIONS = {
 		terms: "payroll.terms"
 	},
 	permission: {
+		verifyInvitationConfiguration: "permission.verifyInvitationConfiguration",
 		command: "permission.command",
 		retryVerification: "permission.retryVerification",
 		verify: "permission.verify",
@@ -1646,6 +1679,11 @@ const OrgCreateFailedProps = Schema.Struct({
 const OrgInviteSentProps = Schema.Struct({
 	...TelemetryEnvelopeProps,
 	org_id: OptionalOrgId,
+	invitation_id: OptionalString,
+	generation: OptionalString,
+	command_id: OptionalString,
+	subject_party_id: OptionalString,
+	persisted_at: OptionalEpochMs,
 	email_domain: OptionalString,
 	role: OptionalString,
 	status: OptionalString
@@ -1653,6 +1691,11 @@ const OrgInviteSentProps = Schema.Struct({
 const OrgInviteAcceptedProps = Schema.Struct({
 	...TelemetryEnvelopeProps,
 	org_id: OptionalOrgId,
+	invitation_id: OptionalString,
+	accepted_at: OptionalEpochMs,
+	generation: OptionalString,
+	command_id: OptionalString,
+	subject_party_id: OptionalString,
 	role: OptionalString,
 	status: OptionalString
 });
@@ -1660,6 +1703,7 @@ const OrgInviteExpiredProps = Schema.Struct({
 	...TelemetryEnvelopeProps,
 	org_id: OptionalOrgId,
 	email_domain: OptionalString,
+	invitation_id: OptionalString,
 	reason: OptionalString,
 	role: OptionalString,
 	status: OptionalString
@@ -1812,9 +1856,24 @@ const PermissionMirrorVerificationProps = Schema.Struct({
 		"applied",
 		"replayed",
 		"conflicting_replay",
-		"revision_mismatch"
+		"revision_mismatch",
+		"cleanup_required",
+		"not_applied",
+		"application_failure",
+		"mismatch",
+		"refused"
 	])),
+	command_kind: Schema.optional(Schema.Literals(["invitation_configuration", "invitation_eoa"])),
 	command_id: OptionalString,
+	invitation_id: OptionalString,
+	generation: OptionalString,
+	purpose: Schema.optional(Schema.Literals([
+		"configure",
+		"grant",
+		"disable",
+		"compensate"
+	])),
+	$insert_id: OptionalString,
 	/**
 	* #1961 R03. The authorized stored row names the Permission it changed; the
 	* verified receipt names the chain facts that prove it. Every field is
@@ -2201,6 +2260,13 @@ const CLI_COMMAND_NAMES = [
 	"auth.profile",
 	"auth.status",
 	"auth.logout",
+	"contact",
+	"contact.list",
+	"contact.get",
+	"contact.add",
+	"contact.label",
+	"contact.hide",
+	"contact.unhide",
 	"org",
 	CAPXUL_OPERATIONS.org.list,
 	"org.use",
@@ -2209,6 +2275,24 @@ const CLI_COMMAND_NAMES = [
 	CAPXUL_OPERATIONS.org.members,
 	"org.member",
 	"org.member.get",
+	"org.member.invite",
+	"org.contact",
+	"org.contact.list",
+	"org.contact.get",
+	"org.contact.add",
+	"org.contact.label",
+	"org.contact.hide",
+	"org.contact.unhide",
+	CAPXUL_OPERATIONS.org.invite,
+	"org.invite.list",
+	"org.invite.get",
+	"org.invite.wait",
+	"org.invite.review",
+	"org.invite.accept",
+	"org.invite.decline",
+	"org.invite.cancel",
+	"org.invite.resend",
+	"org.invite.retry",
 	"org.wait",
 	CAPXUL_OPERATIONS.org.create,
 	CAPXUL_OPERATIONS.org.retry,
@@ -2219,7 +2303,8 @@ const CLI_CAPABILITIES = [
 	"diagnostics",
 	"collection",
 	"authentication",
-	"organization"
+	"organization",
+	"contacts"
 ];
 const CLI_INVOCATION_KINDS = [
 	"command",
@@ -2461,6 +2546,7 @@ Schema.Struct({
 		...TelemetryEnvelopeProps,
 		organization_id: OrgIdTelemetrySchema,
 		progress: Schema.Literals([
+			"configuration_authorized",
 			"account_ready",
 			"permission_applied",
 			"membership_activated",
@@ -2468,6 +2554,9 @@ Schema.Struct({
 		]),
 		/** The invited Party. The initiating actor stays on the envelope's identity. */
 		member_party_id: Schema.String,
+		invitation_id: Schema.optional(Schema.String),
+		generation: Schema.optional(Schema.String),
+		command_id: Schema.optional(Schema.String),
 		occurred_at: Schema.Number
 	})
 });
@@ -3027,8 +3116,10 @@ const CAPXUL_FUNCTIONS = {
 	"movement/annotations": { overlay: "movement/annotations:overlay" },
 	"moneyExecution/actions": {
 		abandonPaymentExecution: "moneyExecution/actions:abandonPaymentExecution",
+		prepareInvitationConfiguration: "moneyExecution/actions:prepareInvitationConfiguration",
 		preparePermissionExecution: "moneyExecution/actions:preparePermissionExecution",
 		preparePaymentExecution: "moneyExecution/actions:preparePaymentExecution",
+		submitInvitationConfigurationExecution: "moneyExecution/actions:submitInvitationConfigurationExecution",
 		submitPermissionExecution: "moneyExecution/actions:submitPermissionExecution",
 		submitPaymentExecution: "moneyExecution/actions:submitPaymentExecution"
 	},
@@ -3045,8 +3136,6 @@ const CAPXUL_FUNCTIONS = {
 	},
 	"org/actions": {
 		confirmBootstrap: "org/actions:confirmBootstrap",
-		detectAndAcceptPendingInvitations: "org/actions:detectAndAcceptPendingInvitations",
-		inviteMember: "org/actions:inviteMember",
 		prepareBootstrap: "org/actions:prepareBootstrap",
 		prepareFounderAccount: "org/actions:prepareFounderAccount",
 		readTreasury: "org/actions:readTreasury",
@@ -3077,16 +3166,25 @@ const CAPXUL_FUNCTIONS = {
 		startOrResume: "org/lifecycle:startOrResume"
 	},
 	"org/mutations": {
+		accept: "org/mutations:accept",
+		cancel: "org/mutations:cancel",
 		createOrg: "org/mutations:createOrg",
-		resendInviteToken: "org/mutations:resendInviteToken"
+		decline: "org/mutations:decline",
+		invite: "org/mutations:invite",
+		resend: "org/mutations:resend",
+		retry: "org/mutations:retry"
 	},
 	"org/queries": {
+		getInvitation: "org/queries:getInvitation",
 		listAll: "org/queries:listAll",
+		listInvitations: "org/queries:listInvitations",
 		listMembersByOrgId: "org/queries:listMembersByOrgId",
 		listMine: "org/queries:listMine",
+		listMyInvitations: "org/queries:listMyInvitations",
 		listRolesByOrgId: "org/queries:listRolesByOrgId",
 		loadByOrgId: "org/queries:loadByOrgId",
-		me: "org/queries:me"
+		me: "org/queries:me",
+		previewInvite: "org/queries:previewInvite"
 	},
 	"smartAccount/actions": {
 		claim: "smartAccount/actions:claim",
@@ -4046,6 +4144,94 @@ const EventRefSchema = Schema.Struct({
 	topic0: Bytes32Schema,
 	dataHash: Bytes32Schema
 });
+const InvitationEoaReceiptSchema = Schema.Struct({
+	kind: Schema.Literal("invitation_eoa"),
+	chainId: BaseSepoliaChainIdSchema,
+	transactionHash: TxHashSchema,
+	blockNumber: BlockNumberSchema,
+	blockHash: Bytes32Schema,
+	sender: AddressSchema,
+	nonce: Schema.String.pipe(Schema.refine((value) => /^(0|[1-9][0-9]*)$/.test(value)))
+});
+const PermissionReceiptRefSchema = Schema.Union([Schema.Struct({
+	kind: Schema.Literal("user_operation"),
+	...ReceiptRefSchema.fields
+}), InvitationEoaReceiptSchema]);
+const PermissionEventRefSchema = Schema.Struct({
+	receipt: PermissionReceiptRefSchema,
+	emitter: AddressSchema,
+	transactionIndex: LogIndexSchema,
+	logIndex: LogIndexSchema,
+	topic0: Bytes32Schema,
+	dataHash: Bytes32Schema
+});
+Schema.Union([
+	Schema.Struct({
+		status: Schema.Literal("pending"),
+		reason: Schema.Literal("receipt_missing")
+	}),
+	Schema.Struct({
+		status: Schema.Literal("provider_failure"),
+		retryable: Schema.Literal(true)
+	}),
+	Schema.Struct({
+		status: Schema.Literal("mismatch"),
+		code: Schema.Literals([
+			"wrong_chain",
+			"wrong_sender",
+			"wrong_transaction",
+			"failed_transaction",
+			"non_canonical_block",
+			"wrong_contract_identity",
+			"missing_event",
+			"extra_authority_event",
+			"wrong_fact_tuple",
+			"wrong_state",
+			"conflicting_replay"
+		]),
+		attemptTransactionHash: Schema.optional(TxHashSchema),
+		receipt: Schema.optional(InvitationEoaReceiptSchema)
+	}),
+	Schema.Struct({
+		status: Schema.Literal("verified"),
+		commandId: PaymentCommandIdSchema,
+		receipt: InvitationEoaReceiptSchema,
+		events: Schema.Array(PermissionEventRefSchema),
+		factsHash: Bytes32Schema
+	})
+]);
+/**
+* One stored `setAllowance` call inside a command's expected authority set.
+*
+* The pinned Roles module emits `SetAllowance` as *post-state*, not as the call
+* arguments: `maxRefill = 0` becomes `type(uint128).max`, and `timestamp = 0`
+* becomes the receipt block's timestamp. A hash over the call arguments can
+* therefore never match that receipt. `index` names the entry in
+* `expectedAuthorityEvents` the call produced, and `data` is the call's own
+* calldata, so the verifier can rebuild the one hash the module actually emits.
+* The rule is pinned by `test:invitation-conformance`.
+*/
+const AllowanceExpectationSchema = Schema.Struct({
+	index: nonNegativeInteger("index"),
+	data: Schema.String.pipe(Schema.refine((value) => /^0x[0-9a-fA-F]+$/u.test(value), { message: "data must be 0x-prefixed hex" }))
+});
+Schema.Struct({
+	commandId: PaymentCommandIdSchema,
+	userOpHash: Bytes32Schema,
+	generationHash: Bytes32Schema,
+	chainId: BaseSepoliaChainIdSchema,
+	organizationSafe: SafeAddressSchema,
+	rolesModule: ModuleAddressSchema,
+	userOpSenderSafe: SafeAddressSchema,
+	expectedAuthorityEvents: Schema.Array(Bytes32Schema),
+	/**
+	* Absent means "no normalization": every expected hash is compared as stored.
+	* A command whose set contains `setAllowance` then refuses (`wrong_fact_tuple`)
+	* rather than passing on a weakened proof, so an incomplete caller fails
+	* closed.
+	*/
+	allowanceExpectations: Schema.optional(Schema.Array(AllowanceExpectationSchema))
+});
 const PermissionOperationSchema = Schema.Literals([
 	"create",
 	"change",
@@ -4089,7 +4275,9 @@ const StoredPermissionCommandSchema = Schema.Struct({
 });
 Schema.Struct({
 	command: StoredPermissionCommandSchema,
-	userOpHash: Bytes32Schema
+	userOpHash: Bytes32Schema,
+	/** The stored `setAllowance` calls of this command's own expectation. */
+	allowanceExpectations: Schema.optional(Schema.Array(AllowanceExpectationSchema))
 });
 Schema.Union([
 	Schema.Struct({
@@ -4933,6 +5121,27 @@ Schema.Struct({
 	digest: Bytes32Schema,
 	value: PermissionResourceSchema
 });
+Schema.Struct({
+	commandId: PaymentCommandIdSchema,
+	signerAddress: AddressSchema
+});
+Schema.Struct({
+	executionId: MoneyExecutionIdSchema,
+	commandId: PaymentCommandIdSchema,
+	orgId: nonEmpty("orgId"),
+	invitationId: nonEmpty("invitationId"),
+	generationHash: Bytes32Schema,
+	chainId: BaseSepoliaChainIdSchema,
+	signerAddress: AddressSchema,
+	userOpSenderSafe: SafeAddressSchema,
+	digest: Bytes32Schema
+});
+Schema.Struct({
+	status: Schema.Literal("submitted"),
+	executionId: MoneyExecutionIdSchema,
+	commandId: PaymentCommandIdSchema,
+	userOpHash: Bytes32Schema
+});
 Schema.Struct({
 	status: Schema.Literal("submitted"),
 	executionId: MoneyExecutionIdSchema,
@@ -5506,6 +5715,160 @@ const CurrentPolicySchema = Schema.Union([Schema.Struct({
 		actions: Schema.NonEmptyArray(Schema.Literals(["pay", "commitments"]))
 	})
 }), Schema.Struct({ type: Schema.Literal("managePeople") })]);
+const BudgetIntentSchema = CurrentPolicySchema.pipe(Schema.refine((value) => {
+	if (value.type !== "budget") return false;
+	const { actions, recipients } = value.scope;
+	if (new Set(actions).size !== actions.length) return false;
+	return recipients.type === "anyone" || recipients.accounts.length >= 1 && recipients.accounts.length <= 32 && new Set(recipients.accounts).size === recipients.accounts.length;
+}));
+const InvitationIdSchema = Schema.NonEmptyString;
+const InvitationTargetSchema = Schema.Struct({ invitationId: InvitationIdSchema });
+Schema.Struct({
+	...InvitationTargetSchema.fields,
+	expectedOfferDigest: Bytes32Schema
+});
+/** The requested grantee of one invitation. */
+const GranteeRefSchema = Schema.Union([Schema.Struct({
+	type: Schema.Literal("email"),
+	email: Schema.NonEmptyString
+}), Schema.Struct({
+	type: Schema.Literal("account"),
+	accountId: AccountIdSchema
+})]);
+Schema.Struct({
+	requestKey: Schema.String.pipe(Schema.refine((value) => /^[\x20-\x7e]{1,128}$/.test(value))),
+	to: GranteeRefSchema,
+	grants: Schema.Array(Schema.Union([
+		Schema.Struct({
+			type: Schema.Literal("budget"),
+			budgetId: PermissionIdSchema
+		}),
+		Schema.Struct({
+			type: Schema.Literal("managePeople"),
+			permissionId: PermissionIdSchema
+		}),
+		Schema.Struct({
+			type: Schema.Literal("new_budget"),
+			label: Schema.String.pipe(Schema.refine((value) => value.trim().length >= 1 && value.trim().length <= 128)),
+			intent: BudgetIntentSchema
+		})
+	]))
+}).pipe(Schema.refine((value) => {
+	if (value.grants.length < 1 || value.grants.length > 16) return false;
+	const existing = value.grants.flatMap((grant) => grant.type === "new_budget" ? [] : [grant.type === "budget" ? grant.budgetId : grant.permissionId]);
+	return new Set(existing).size === existing.length && value.grants.filter((grant) => grant.type === "new_budget").length <= 4;
+}));
+const InvitationPhaseSchema = Schema.Literals([
+	"authorizing",
+	"pending",
+	"pending_grant",
+	"active",
+	"revoking",
+	"declined",
+	"cancelled",
+	"expired",
+	"revoked"
+]);
+const EndingReasonSchema = Schema.Literals([
+	"declined",
+	"cancelled",
+	"expired",
+	"revoked"
+]);
+const OfferedAuthoritySchema = Schema.Union([Schema.Struct({
+	type: Schema.Literal("budget"),
+	budgetId: Schema.NonEmptyString.pipe(Schema.refine((value) => value.length > 0)),
+	label: Schema.String,
+	policy: BudgetIntentSchema,
+	policyDigest: Bytes32Schema
+}), Schema.Struct({
+	type: Schema.Literal("managePeople"),
+	permissionId: PermissionIdSchema,
+	label: Schema.String
+})]);
+const NewBudgetOfferSchema = Schema.Struct({
+	type: Schema.Literal("new_budget"),
+	label: Schema.String,
+	policy: BudgetIntentSchema,
+	policyDigest: Bytes32Schema
+});
+const PreviewGranteeSchema = Schema.Struct({
+	partyId: Schema.NullOr(PartyIdSchema),
+	accountId: Schema.NullOr(AccountIdSchema),
+	safeAddress: AddressSchema,
+	accountReady: Schema.NullOr(Schema.Boolean)
+});
+Schema.Struct({
+	orgId: Schema.NonEmptyString.pipe(Schema.refine((value) => value.length > 0)),
+	grantee: PreviewGranteeSchema,
+	grants: Schema.Array(Schema.Union([OfferedAuthoritySchema, NewBudgetOfferSchema])),
+	existingAssignments: Schema.Array(PermissionAssignmentIdSchema),
+	includesManagement: Schema.Boolean,
+	observedAt: EpochMsSchema
+});
+Schema.Struct({
+	cursor: Schema.optional(Schema.NonEmptyString),
+	limit: Schema.optional(Schema.Number.pipe(Schema.refine((value) => Number.isSafeInteger(value) && value >= 1 && value <= 100))),
+	phases: Schema.optional(Schema.Array(InvitationPhaseSchema).pipe(Schema.refine((value) => new Set(value).size === value.length)))
+});
+const InvitationRecoverySchema = Schema.Struct({
+	actor: Schema.Literals([
+		"system",
+		"invitee",
+		"admin"
+	]),
+	action: Schema.Literals([
+		"wait",
+		"retry",
+		"review_offer",
+		"reauthorize"
+	]),
+	reason: Schema.Literals([
+		"configuration_pending",
+		"grant_pending",
+		"provider_unavailable",
+		"policy_changed",
+		"cleanup_pending",
+		"signer_unavailable"
+	])
+});
+const InvitationViewSchema = Schema.Struct({
+	id: InvitationIdSchema,
+	orgId: Schema.NonEmptyString.pipe(Schema.refine((value) => value.length > 0)),
+	organizationName: Schema.String,
+	grantee: Schema.Struct({
+		partyId: PartyIdSchema,
+		accountId: Schema.NullOr(AccountIdSchema),
+		safeAddress: AddressSchema,
+		accountReady: Schema.NullOr(Schema.Boolean)
+	}),
+	phase: InvitationPhaseSchema,
+	grants: Schema.Array(Schema.Union([Schema.Struct({
+		type: Schema.Literal("budget"),
+		budgetId: Schema.NonEmptyString.pipe(Schema.refine((value) => value.length > 0))
+	}), Schema.Struct({
+		type: Schema.Literal("managePeople"),
+		permissionId: PermissionIdSchema
+	})])),
+	offers: Schema.Array(OfferedAuthoritySchema),
+	recovery: Schema.NullOr(InvitationRecoverySchema),
+	offerDigest: Bytes32Schema,
+	authorizedAt: Schema.NullOr(EpochMsSchema),
+	acceptedAt: Schema.NullOr(EpochMsSchema),
+	expiresAt: Schema.NullOr(EpochMsSchema),
+	commandId: Schema.NullOr(PaymentCommandIdSchema),
+	endingReason: Schema.NullOr(EndingReasonSchema),
+	delivery: Schema.Literals([
+		"not_confirmed",
+		"sent",
+		"failed"
+	])
+});
+Schema.Struct({
+	items: Schema.Array(InvitationViewSchema),
+	nextCursor: Schema.NullOr(Schema.NonEmptyString),
+	observedAt: EpochMsSchema
+});
 const ActiveBudgetSchema = Schema.Struct({
 	id: PermissionIdSchema,
 	label: Schema.String,
@@ -5856,6 +6219,18 @@ function withInvocationParentSpan(effect, controls) {
 	const parent = controls?.[INVOCATION_PARENT_SPAN];
 	return parent === void 0 ? effect : effect.pipe(Effect.withParentSpan(parent));
 }
+/**
+* The input field a refused request named.
+*
+* The surfaces that call the port directly already carry `details.field` for an
+* `INVALID_INPUT` refusal. The actor keeps that one allowlisted detail instead of
+* dropping it, so a caller sees the same refusal either way.
+*/
+const refusedInputField = (failure) => {
+	if (failure.code !== "INVALID_INPUT") return void 0;
+	const field = failure.error?.details?.field;
+	return typeof field === "string" && field.length > 0 ? { field } : void 0;
+};
 var ActorFailure = class extends Error {
 	reason;
 	machine;
@@ -6021,7 +6396,7 @@ const boot = (spec, options = {}) => Effect.gen(function* () {
 				const event = { _tag: env.origin.event };
 				const failedState = exit.failure === timeoutFailure || exit.failure === cancelledFailure ? yield* recoverFailure(state, env.origin, exit.failure) : state;
 				yield* emit(nonApplied(failedState, event, exit.failure.code, outcome, env, exit.failure));
-				const details = exit.failure === timeoutFailure ? { reason: "timeout" } : void 0;
+				const details = exit.failure === timeoutFailure ? { reason: "timeout" } : refusedInputField(exit.failure);
 				yield* failReply(held.reply, makeFailure(failedState, event, exit.failure.code, details, exit.failure.error ?? exit.failure));
 				return;
 			}
@@ -7148,11 +7523,13 @@ const financialOpsContract = {
 //#region src/contract/money-execution.ts
 const moneyExecutionContract = {
 	abandonPaymentExecution: makeFunctionReference(CAPXUL_FUNCTIONS["moneyExecution/actions"].abandonPaymentExecution),
+	prepareInvitationConfiguration: makeFunctionReference(CAPXUL_FUNCTIONS["moneyExecution/actions"].prepareInvitationConfiguration),
 	preparePermissionExecution: makeFunctionReference(CAPXUL_FUNCTIONS["moneyExecution/actions"].preparePermissionExecution),
 	preparePaymentExecution: makeFunctionReference(CAPXUL_FUNCTIONS["moneyExecution/actions"].preparePaymentExecution),
 	prepareOrganizationPaymentExecution: makeFunctionReference(CAPXUL_FUNCTIONS["moneyExecution/paymentCommandActions"].prepareOrganizationPaymentExecution),
 	preparePaymentLifecycleExecution: makeFunctionReference(CAPXUL_FUNCTIONS["moneyExecution/paymentCommandActions"].preparePaymentLifecycleExecution),
 	submitPaymentExecution: makeFunctionReference(CAPXUL_FUNCTIONS["moneyExecution/actions"].submitPaymentExecution),
+	submitInvitationConfigurationExecution: makeFunctionReference(CAPXUL_FUNCTIONS["moneyExecution/actions"].submitInvitationConfigurationExecution),
 	submitPermissionExecution: makeFunctionReference(CAPXUL_FUNCTIONS["moneyExecution/actions"].submitPermissionExecution),
 	submitPaymentCommandExecution: makeFunctionReference(CAPXUL_FUNCTIONS["moneyExecution/paymentCommandActions"].submitPaymentCommandExecution)
 };
@@ -7733,7 +8110,7 @@ function subscribeActivity(deps, actor, controls, onChange) {
 }
 //#endregion
 //#region package.json
-var version = "4.20.0-beta.6";
+var version = "4.20.0-beta.8";
 //#endregion
 //#region src/telemetry/exception-projection.ts
 /** Fixed fallback for failures that have no safe message. */
@@ -8569,7 +8946,7 @@ function isMoneyTelemetryDebugEnabled() {
 }
 //#endregion
 //#region src/surface/payment-command-execution.ts
-function isAborted$2(signal) {
+function isAborted$3(signal) {
 	return signal?.aborted === true;
 }
 function canonicalJson(value) {
@@ -8595,7 +8972,7 @@ async function abandonPrepared$1(deps, executionId, closePayment, reason, result
 	return result;
 }
 async function executePrepared(deps, prepare, isExpectedRequest, closePaymentOnExit, onPreparedClosed, signal, controls) {
-	if (isAborted$2(signal)) return {
+	if (isAborted$3(signal)) return {
 		ok: false,
 		error: Errors.cancelled({ operation: "payments" })
 	};
@@ -8624,7 +9001,7 @@ async function executePrepared(deps, prepare, isExpectedRequest, closePaymentOnE
 		ok: false,
 		error: Errors.invalidInput("payment", "prepared authority mismatch")
 	}, onPreparedClosed, controls);
-	if (isAborted$2(signal)) return abandonPrepared$1(deps, prepared.value.executionId, closePaymentOnExit, "cancelled", {
+	if (isAborted$3(signal)) return abandonPrepared$1(deps, prepared.value.executionId, closePaymentOnExit, "cancelled", {
 		ok: false,
 		error: Errors.cancelled({ operation: "payments" })
 	}, onPreparedClosed, controls);
@@ -8650,7 +9027,7 @@ async function executePrepared(deps, prepare, isExpectedRequest, closePaymentOnE
 			error: signerFailure(deps.signer.source, "signUserOpHash", cause)
 		}, onPreparedClosed, controls);
 	}
-	if (isAborted$2(signal)) return abandonPrepared$1(deps, prepared.value.executionId, closePaymentOnExit, "cancelled", {
+	if (isAborted$3(signal)) return abandonPrepared$1(deps, prepared.value.executionId, closePaymentOnExit, "cancelled", {
 		ok: false,
 		error: Errors.cancelled({ operation: "payments" })
 	}, onPreparedClosed, controls);
@@ -8685,7 +9062,7 @@ function cancelled(operation) {
 		error: Errors.cancelled({ operation })
 	};
 }
-function isAborted$1(signal) {
+function isAborted$2(signal) {
 	return signal?.aborted === true;
 }
 async function signerCall(source, operation, run) {
@@ -8711,7 +9088,7 @@ async function abandonPrepared(deps, executionId, reason, result, onPreparedClos
 	return result;
 }
 async function executePersonalPayment(deps, payment, signal, requestKey, onPreparedClosed) {
-	if (isAborted$1(signal)) return cancelled(CAPXUL_OPERATIONS.payments.pay);
+	if (isAborted$2(signal)) return cancelled(CAPXUL_OPERATIONS.payments.pay);
 	if (deps.signer === void 0) return mismatch("signer", "payments.pay requires a configured CapxulSigner");
 	const session = deps.actor.authSession();
 	if (session === null) return {
@@ -8739,10 +9116,10 @@ async function executePersonalPayment(deps, payment, signal, requestKey, onPrepa
 		executionId: prepared.value.executionId,
 		recipient: prepared.value.recipientObservation
 	});
-	if (isAborted$1(signal)) return abandonPrepared(deps, prepared.value.executionId, "cancelled", cancelled(CAPXUL_OPERATIONS.payments.pay), onPreparedClosed);
+	if (isAborted$2(signal)) return abandonPrepared(deps, prepared.value.executionId, "cancelled", cancelled(CAPXUL_OPERATIONS.payments.pay), onPreparedClosed);
 	const signature = await signerCall(deps.signer.source, "signUserOpHash", () => deps.signer.signUserOpHash(prepared.value.digest));
 	if (!signature.ok) return abandonPrepared(deps, prepared.value.executionId, "signer_rejected", signature, onPreparedClosed);
-	if (isAborted$1(signal)) return abandonPrepared(deps, prepared.value.executionId, "cancelled", cancelled(CAPXUL_OPERATIONS.payments.pay), onPreparedClosed);
+	if (isAborted$2(signal)) return abandonPrepared(deps, prepared.value.executionId, "cancelled", cancelled(CAPXUL_OPERATIONS.payments.pay), onPreparedClosed);
 	return runIfActive(void 0, CAPXUL_OPERATIONS.payments.submitExecution, () => deps.convexCall.action(deps.functions.submitPaymentExecution, { input: {
 		executionId: prepared.value.executionId,
 		signature: signature.value
@@ -11314,6 +11691,7 @@ function mapBetterAuthError(operation, body) {
 		const code = typeof errBody.code === "string" ? errBody.code : "";
 		if (code === "OTP_EXPIRED") return Errors.otpExpired();
 		if (code === "INVALID_OTP") return Errors.invalidInput("otp", errBody.message ?? "invalid OTP");
+		if (code === "TOO_MANY_ATTEMPTS") return Errors.rateLimited({ resource: "better-auth/verifyOtp" });
 		if (code === "VALIDATION_ERROR" || code === "INVALID_EMAIL") return Errors.invalidInput("email", errBody.message ?? "invalid email");
 	}
 	return Errors.providerError("better-auth", operation, new Error(String(body)));
@@ -11931,6 +12309,10 @@ var BetterAuthNodeAdapter = class {
 						ok: false,
 						error: Errors.invalidInput("otp", errBody.message ?? "invalid OTP")
 					};
+					if (errBody.code === "TOO_MANY_ATTEMPTS") return {
+						ok: false,
+						error: Errors.rateLimited({ resource: "better-auth/verifyOtp" })
+					};
 				}
 			}
 			return {
@@ -12490,6 +12872,12 @@ const stderrConvexLogger = {
 	error: writeConvexDiagnostic,
 	logVerbose: () => void 0
 };
+const silentConvexLogger = {
+	log: () => void 0,
+	warn: () => void 0,
+	error: () => void 0,
+	logVerbose: () => void 0
+};
 /** Exact floor-first allowlist; every additional handler must migrate its validator first. */
 const OBSERVED_CONVEX_ACTIONS = /* @__PURE__ */ new Set([
 	"system:healthObserved",
@@ -12561,7 +12949,9 @@ const OBSERVED_CONVEX_MUTATIONS = /* @__PURE__ */ new Set([
 	"smartAccount/mutations:provision",
 	"org/lifecycle:startOrResume",
 	"org/lifecycle:recordFailure",
-	"org/lifecycle:retry"
+	"org/lifecycle:retry",
+	"org/mutations:invite",
+	"org/mutations:accept"
 ]);
 var ConvexCallAdapter = class {
 	#client;
@@ -12576,7 +12966,7 @@ var ConvexCallAdapter = class {
 		const webSocketConstructor = this.#connectionMonitor.observedWebSocketConstructor();
 		this.#client = deps.client ?? new ConvexClient(deps.convexUrl, {
 			...webSocketConstructor === void 0 ? {} : { webSocketConstructor },
-			...deps.logToStderr === true ? { logger: stderrConvexLogger } : {}
+			logger: deps.localDiagnostics === true ? stderrConvexLogger : silentConvexLogger
 		});
 		this.#tokenProvider = deps.tokenProvider;
 		this.#applicationId = deps.applicationId;
@@ -13234,10 +13624,7 @@ const DEFAULT_FUNCTIONS$1 = {
 	listAll: makeFunctionReference(CAPXUL_FUNCTIONS["org/queries"].listAll),
 	listRoles: makeFunctionReference(CAPXUL_FUNCTIONS["org/queries"].listRolesByOrgId),
 	listMembers: makeFunctionReference(CAPXUL_FUNCTIONS["org/queries"].listMembersByOrgId),
-	readTreasury: makeFunctionReference(CAPXUL_FUNCTIONS["org/actions"].readTreasury),
-	inviteMember: makeFunctionReference(CAPXUL_FUNCTIONS["org/actions"].inviteMember),
-	resendInvite: makeFunctionReference(CAPXUL_FUNCTIONS["org/mutations"].resendInviteToken),
-	detectInvitations: makeFunctionReference(CAPXUL_FUNCTIONS["org/actions"].detectAndAcceptPendingInvitations)
+	readTreasury: makeFunctionReference(CAPXUL_FUNCTIONS["org/actions"].readTreasury)
 };
 /**
 * Standard production Organization read adapter. It intentionally has no
@@ -13273,22 +13660,6 @@ var ConvexOrganizationAdapter = class {
 	pendingMembers(input) {
 		return this.listMembers(input).pipe(Effect.map((members) => members.filter((member) => member.status === "pending" || member.status === "pending_safe" || member.status === "pending_grant")));
 	}
-	inviteMember(input) {
-		return this.#convex.action(this.#fns.inviteMember, copyInvocationObservation(input, {
-			orgId: input.orgId,
-			email: input.input.email,
-			role: input.input.role
-		})).pipe(Effect.mapError((error) => orgErrorFromCapxul("inviteMember", error.publicError, error)), Effect.map(brandOrgMember), Effect.catchDefect((cause) => Effect.fail(toOrgError("inviteMember", cause))));
-	}
-	resendInviteToken(input) {
-		return this.#convex.mutation(this.#fns.resendInvite, {
-			orgId: input.orgId,
-			email: input.email
-		}).pipe(Effect.mapError((error) => orgErrorFromCapxul("resendInviteToken", error.publicError, error)), Effect.map(brandOrgMember), Effect.catchDefect((cause) => Effect.fail(toOrgError("resendInviteToken", cause))));
-	}
-	detectAndAcceptPendingInvitations(_input) {
-		return this.#convex.action(this.#fns.detectInvitations, {}).pipe(Effect.mapError((error) => orgErrorFromCapxul("detectAndAcceptPendingInvitations", error.publicError, error)), Effect.map((result) => ({ matched: result.matched.map(toOrgId) })), Effect.catchDefect((cause) => Effect.fail(toOrgError("detectAndAcceptPendingInvitations", cause))));
-	}
 	#readTreasuryWire(input) {
 		const orgId = String(input.orgId);
 		return retryIdempotentRead(this.#convex.action(this.#fns.readTreasury, copyInvocationObservation(input, { orgId })), CAPXUL_OPERATIONS.org.treasury, this.#telemetry, input).pipe(Effect.mapError((error) => orgErrorFromCapxul("readTreasury", error.publicError, error)), Effect.map((wire) => {
@@ -13333,11 +13704,12 @@ var ConvexOrganizationSetupAdapter = class {
 	#fns;
 	constructor(input) {
 		this.#convex = input.convex;
-		this.#signer = input.signer;
+		this.#signer = input.signer ?? null;
 		this.#chainId = input.chainId;
 		this.#fns = input.functions ?? DEFAULT_FUNCTIONS;
 	}
 	async startOrResume(input) {
+		if (this.#signer === null) return fail$1(Errors.capabilityUnavailable("signer", "startOrResume"));
 		const result = await runCall("startOrResume", this.#convex.mutation(this.#fns.startOrResume, copyInvocationObservation(input, {
 			...input,
 			chainId: this.#chainId
@@ -13365,7 +13737,9 @@ var ConvexOrganizationSetupAdapter = class {
 	async authorizeAndSubmitBootstrap(input) {
 		const cancelled = cancellation(input.signal);
 		if (cancelled !== void 0) return cancelled;
-		const signerAddress = await signerResult(this.#signer.source, "getAddress", () => this.#signer.getAddress());
+		const signer = this.#signer;
+		if (signer === null) return fail$1(Errors.capabilityUnavailable("signer", "authorizeAndSubmitBootstrap"));
+		const signerAddress = await signerResult(signer.source, "getAddress", () => signer.getAddress());
 		if (!signerAddress.ok) return signerAddress;
 		const prepared = await runCall("prepareBootstrap", this.#convex.action(this.#fns.prepareBootstrap, copyInvocationObservation(input, {
 			orgId: input.orgId,
@@ -13377,7 +13751,7 @@ var ConvexOrganizationSetupAdapter = class {
 		if (!authority.ok) return authority;
 		const cancelledAfterPrepare = cancellation(input.signal);
 		if (cancelledAfterPrepare !== void 0) return cancelledAfterPrepare;
-		const signature = await signerResult(this.#signer.source, "signUserOpHash", () => this.#signer.signUserOpHash(prepared.value.digest));
+		const signature = await signerResult(signer.source, "signUserOpHash", () => signer.signUserOpHash(prepared.value.digest));
 		if (!signature.ok) return signature;
 		const cancelledAfterSign = cancellation(input.signal);
 		if (cancelledAfterSign !== void 0) return cancelledAfterSign;
@@ -13433,7 +13807,8 @@ var ConvexOrganizationSetupAdapter = class {
 			...input.observationContext === void 0 ? {} : { observationContext: input.observationContext }
 		});
 		if (!current.ok) return current;
-		if (current.value.status === "failed" && current.value.retryable && (current.value.at === "awaitingFounderAuthorization" || current.value.at === "submittingBootstrap")) {
+		if (current.value.status === "failed" && current.value.retryable && current.value.at === "awaitingFounderAuthorization") {
+			if (this.#signer === null) return fail$1(Errors.capabilityUnavailable("signer", "retry"));
 			const reset = resetSignerSession(this.#signer);
 			if (!reset.ok) return reset;
 		}
@@ -15481,6 +15856,271 @@ function makeOrgMeMethod(deps, orgId) {
 	};
 }
 //#endregion
+//#region src/contract/invitations.ts
+const invitationContract = {
+	preview: makeFunctionReference(CAPXUL_FUNCTIONS["org/queries"].previewInvite),
+	listMine: makeFunctionReference(CAPXUL_FUNCTIONS["org/queries"].listMyInvitations),
+	listScoped: makeFunctionReference(CAPXUL_FUNCTIONS["org/queries"].listInvitations),
+	get: makeFunctionReference(CAPXUL_FUNCTIONS["org/queries"].getInvitation),
+	invite: makeFunctionReference(CAPXUL_FUNCTIONS["org/mutations"].invite),
+	accept: makeFunctionReference(CAPXUL_FUNCTIONS["org/mutations"].accept),
+	decline: makeFunctionReference(CAPXUL_FUNCTIONS["org/mutations"].decline),
+	cancel: makeFunctionReference(CAPXUL_FUNCTIONS["org/mutations"].cancel),
+	resend: makeFunctionReference(CAPXUL_FUNCTIONS["org/mutations"].resend),
+	retry: makeFunctionReference(CAPXUL_FUNCTIONS["org/mutations"].retry)
+};
+//#endregion
+//#region src/surface/invitations.ts
+/**
+* The one refusal a scoped invitation result that names another Organization
+* receives, whether it was read or returned by the authoring write.
+*/
+function scopeRefusal(orgId) {
+	return Errors.invalidInput("orgId", `The invitation result does not belong to Organization ${JSON.stringify(orgId)}.`);
+}
+/**
+* A scoped invitation result belongs to the Organization it was read under.
+*
+* One owner holds the refusal copy and the verified-scope span: a single view
+* reports whether it names the scope, and a page — which names no Organization
+* of its own — reports whether every row does. A result that does not belong is
+* refused here rather than handed to a consumer, so a future route change
+* cannot turn into a silent cross-Organization read on a caller that trusted
+* the scope it passed. A successful scoped read also marks the verifying
+* Organization on the owning span, exactly as `org.me` does — the caller's
+* scope hint is not authority, the completed scoped read is.
+*/
+function verifyScope(orgId, value, belongsToScope) {
+	if (!belongsToScope(value)) return Effect.fail(scopeRefusal(orgId));
+	return Effect.annotateCurrentSpan({
+		verified_organization_id: orgId,
+		scope_kind: "organization"
+	}).pipe(Effect.as(value));
+}
+/** One view names its own Organization. */
+const namesScope = (orgId) => (value) => String(value.orgId) === orgId;
+/** A page names no Organization of its own, so every row must name the scope. */
+const rowsNameScope = (orgId) => (page) => page.items.every((item) => String(item.orgId) === orgId);
+const ops = CAPXUL_OPERATIONS.org.invitations;
+/** Truth for a caller-owned signal, without narrowing its type. */
+function isAborted$1(signal) {
+	return signal?.aborted === true;
+}
+/**
+* One observed operation around one Convex hop, exactly like `org.me`. The
+* call-start invocation snapshot rides the arguments, so the backend continues
+* the attempt this call started rather than resolving a new one.
+*/
+function observed$1(deps, operation, options, args, call, check) {
+	const controls = deps.invocationControls?.(options) ?? options;
+	return runCapxulEffect(call(copyInvocationObservation(controls, args)).pipe(Effect.mapError((failure) => failure.publicError), Effect.flatMap((value) => check === void 0 ? Effect.succeed(value) : check(value))), controls, operation, deps.runPromise);
+}
+/**
+* The Admin's preview stays a read: it reaches the preview query and nothing
+* else. It reads current policies and live assignments, so the operator sees
+* what the offered authority is now, not a frozen copy.
+*/
+function makeOrgInvitationMethods(deps, orgId) {
+	const scopeCheck = (value) => verifyScope(orgId, value, namesScope(orgId));
+	return {
+		preview: (input, options) => observed$1(deps, ops.preview, options, {
+			orgId,
+			request: input
+		}, (args) => deps.convexCall.query(invitationContract.preview, args), scopeCheck),
+		invite: makeInviteMethod(deps, orgId),
+		accept: (input, options) => observed$1(deps, ops.accept, options, {
+			orgId,
+			invitationId: input.invitationId,
+			expectedOfferDigest: input.expectedOfferDigest
+		}, (args) => deps.convexCall.mutation(invitationContract.accept, args), scopeCheck),
+		list: (input, options) => observed$1(deps, ops.listScoped, options, {
+			orgId,
+			...pageArgs(input)
+		}, (args) => deps.convexCall.query(invitationContract.listScoped, args), (page) => verifyScope(orgId, page, rowsNameScope(orgId))),
+		get: (input, options) => observed$1(deps, ops.get, options, {
+			orgId,
+			invitationId: input.invitationId
+		}, (args) => deps.convexCall.query(invitationContract.get, args), scopeCheck),
+		decline: (input, options) => observed$1(deps, ops.decline, options, {
+			orgId,
+			invitationId: input.invitationId
+		}, (args) => deps.convexCall.mutation(invitationContract.decline, args), scopeCheck),
+		cancel: (input, options) => observed$1(deps, ops.cancel, options, {
+			orgId,
+			invitationId: input.invitationId
+		}, (args) => deps.convexCall.mutation(invitationContract.cancel, args), scopeCheck),
+		resend: (input, options) => observed$1(deps, ops.resend, options, {
+			orgId,
+			invitationId: input.invitationId
+		}, (args) => deps.convexCall.mutation(invitationContract.resend, args), scopeCheck),
+		retry: (input, options) => observed$1(deps, ops.retry, options, {
+			orgId,
+			invitationId: input.invitationId
+		}, (args) => deps.convexCall.mutation(invitationContract.retry, args), scopeCheck)
+	};
+}
+/**
+* The authoring write, including its configuration hop.
+*
+* The mutation persists the invitation and its configure command before any
+* signature exists. The write then drives the existing human configuration
+* owner exactly as the Permission and payment surfaces drive theirs: prepare
+* the stored command for this Account's Safe, check the prepared authority
+* against the request, deliver the durable identity to the caller, sign the
+* returned digest, and submit it. The backend keeps the only authorization
+* rule (`prepareInvitationConfigurationIntentInTx` /
+* `submitInvitationConfigurationExecution`); this edge adds no second one.
+*
+* Cancellation owns the whole compound: an abort before the digest is signed
+* stops the write and forwards no signature, and an already-signed submission
+* completes.
+*/
+async function executeInvite(deps, orgId, input, signal, controls, verifiedOrganization, onPrepared) {
+	if (isAborted$1(signal)) return {
+		ok: false,
+		error: Errors.cancelled({ operation: ops.authorize })
+	};
+	if (deps.actor === void 0 || deps.chainId === void 0 || deps.signer === void 0) return {
+		ok: false,
+		error: Errors.notImplemented("invitations", "executionComposition")
+	};
+	const session = deps.actor.authSession();
+	if (session === null) return {
+		ok: false,
+		error: Errors.notAuthenticated()
+	};
+	const authored = await runIfActive(signal, ops.authorize, () => withInvocationParentSpan(Effect.suspend(() => deps.convexCall.mutation(invitationContract.invite, copyInvocationObservation(controls, {
+		orgId,
+		request: input
+	}))), controls), deps.runPromise);
+	if (!authored.ok) return authored;
+	const view = authored.value;
+	if (String(view.orgId) !== orgId) return {
+		ok: false,
+		error: scopeRefusal(orgId)
+	};
+	if (view.phase !== "authorizing") return {
+		ok: true,
+		value: view
+	};
+	if (view.commandId === null) return {
+		ok: false,
+		error: Errors.invalidInput("invitationId", "The invitation does not name its configuration command.")
+	};
+	const commandId = view.commandId;
+	let signerAddress;
+	try {
+		signerAddress = await deps.signer.getAddress();
+	} catch (cause) {
+		return {
+			ok: false,
+			error: signerFailure(deps.signer.source, "getAddress", cause)
+		};
+	}
+	const prepared = await runIfActive(signal, ops.prepareConfiguration, () => withInvocationParentSpan(Effect.suspend(() => deps.convexCall.action(moneyExecutionContract.prepareInvitationConfiguration, copyInvocationObservation(controls, { input: {
+		commandId,
+		signerAddress
+	} }))), controls), deps.runPromise);
+	if (!prepared.ok) return prepared;
+	const expectedSafe = deriveCapxulSafeAddress({ email: session.email });
+	if (!preparedAuthorityMatches({
+		prepared: prepared.value,
+		chainId: deps.chainId,
+		signerAddress,
+		expectedSafe,
+		commandId,
+		invitationId: view.id,
+		orgId
+	})) return {
+		ok: false,
+		error: Errors.invalidInput("invitation", "prepared authority mismatch")
+	};
+	verifiedOrganization(prepared.value.orgId);
+	if (isAborted$1(signal)) return {
+		ok: false,
+		error: Errors.cancelled({ operation: ops.authorize })
+	};
+	if (onPrepared !== void 0) try {
+		await onPrepared({
+			invitationId: prepared.value.invitationId,
+			commandId: prepared.value.commandId
+		});
+	} catch (cause) {
+		return {
+			ok: false,
+			error: cause instanceof CapxulError ? cause : Errors.unknown(cause)
+		};
+	}
+	if (isAborted$1(signal)) return {
+		ok: false,
+		error: Errors.cancelled({ operation: ops.authorize })
+	};
+	let signature;
+	try {
+		signature = await deps.signer.signUserOpHash(prepared.value.digest);
+	} catch (cause) {
+		return {
+			ok: false,
+			error: signerFailure(deps.signer.source, "signUserOpHash", cause)
+		};
+	}
+	if (isAborted$1(signal)) return {
+		ok: false,
+		error: Errors.cancelled({ operation: ops.authorize })
+	};
+	const submitted = await runIfActive(void 0, ops.submitConfiguration, () => withInvocationParentSpan(Effect.suspend(() => deps.convexCall.action(moneyExecutionContract.submitInvitationConfigurationExecution, copyInvocationObservation(controls, { input: {
+		executionId: prepared.value.executionId,
+		signature
+	} }))), controls), deps.runPromise);
+	if (!submitted.ok) return submitted;
+	return {
+		ok: true,
+		value: view
+	};
+}
+/**
+* The prepared authority must be exactly the one this write asked for: the same
+* chain, the caller's signer, this Account's Safe, and the exact command and
+* invitation the authoring view named.
+*/
+function preparedAuthorityMatches(input) {
+	return input.prepared.chainId === input.chainId && input.prepared.signerAddress.toLowerCase() === input.signerAddress.toLowerCase() && input.prepared.userOpSenderSafe.toLowerCase() === input.expectedSafe.toLowerCase() && input.prepared.commandId === input.commandId && input.prepared.invitationId === input.invitationId && input.prepared.orgId === input.orgId;
+}
+function makeInviteMethod(deps, orgId) {
+	return (input, options) => {
+		const { onPrepared, ...supplied } = options ?? {};
+		const controls = deps.invocationControls?.(supplied) ?? supplied;
+		let verifiedOrganizationId;
+		return runCapxulEffect(Effect.gen(function* () {
+			if (controls?.signal?.aborted === true) return yield* Effect.fail(Errors.cancelled({ operation: ops.authorize }));
+			const parent = yield* Effect.currentSpan.pipe(Effect.orDie);
+			const captured = carryInvocationParentSpan(controls, parent);
+			const result = yield* Effect.tryPromise({
+				try: () => executeInvite(deps, orgId, input, controls?.signal, captured, (id) => {
+					verifiedOrganizationId = id;
+				}, onPrepared),
+				catch: (cause) => cause instanceof CapxulError ? cause : Errors.unknown(cause)
+			});
+			return yield* result.ok ? Effect.succeed(result.value) : Effect.fail(result.error);
+		}).pipe(Effect.ensuring(Effect.suspend(() => verifiedOrganizationId === void 0 ? Effect.void : Effect.annotateCurrentSpan({
+			verified_organization_id: verifiedOrganizationId,
+			scope_kind: "organization"
+		})).pipe(Effect.catchCause(() => Effect.void)))), observationOnlyControls(controls), ops.authorize, deps.runPromise);
+	};
+}
+/** Drop the page fields the caller did not supply; a bounded page sends only its bounds. */
+function pageArgs(input) {
+	if (input === void 0) return {};
+	return {
+		...input.cursor === void 0 ? {} : { cursor: input.cursor },
+		...input.limit === void 0 ? {} : { limit: input.limit },
+		...input.phases === void 0 ? {} : { phases: input.phases }
+	};
+}
+function makeOwnInvitationsMethod(deps) {
+	return (input, options) => observed$1(deps, ops.list, options, pageArgs(input), (args) => deps.convexCall.query(invitationContract.listMine, args));
+}
+//#endregion
 //#region src/contract/permission.ts
 const permissionContract = { read: makeFunctionReference(CAPXUL_FUNCTIONS["permission/queries"].read) };
 //#endregion
@@ -16168,20 +16808,6 @@ function hermeticOrgView(input) {
 		observedAt: 0
 	};
 }
-function hermeticMember(input) {
-	return {
-		orgId: input.orgId,
-		accountId: null,
-		email: toEmail(input.email),
-		name: null,
-		personalSafeAddress: input.personalSafeAddress ?? null,
-		role: input.role,
-		roleKey: toRoleKey(orgRoleKeyForLabel(input.role)),
-		status: input.status,
-		grantTxHash: input.grantTxHash ?? null,
-		revokeTxHash: input.revokeTxHash ?? null
-	};
-}
 function createOrgProgram(input) {
 	return Effect.gen(function* () {
 		const deps = yield* OrgDepsTag;
@@ -16282,35 +16908,6 @@ function listMembersProgram(orgId) {
 		return [];
 	});
 }
-/**
-* R06 (#1964): the SDK no longer emits `org_invite_sent`. The backend action
-* that writes the invitation is its ONE producer, so a hermetic call — which
-* writes nothing — can no longer report an invitation that never happened, and
-* a live call is counted once instead of twice. The captured attempt rides the
-* port input, so the durable event carries the correlation this call ran under.
-*/
-function inviteMemberProgram(orgId, input) {
-	return Effect.gen(function* () {
-		const deps = yield* OrgDepsTag;
-		if (deps.orgPort === void 0) return hermeticMember({
-			orgId,
-			email: input.email,
-			role: input.role,
-			status: "pending"
-		});
-		return yield* deps.orgPort.inviteMember(copyInvocationObservation(deps.invocationSource, {
-			orgId,
-			input
-		})).pipe(Effect.mapError((error) => error.publicError));
-	});
-}
-function detectAndAcceptPendingInvitationsProgram() {
-	return Effect.gen(function* () {
-		const deps = yield* OrgDepsTag;
-		if (deps.orgPort !== void 0) return yield* deps.orgPort.detectAndAcceptPendingInvitations({}).pipe(Effect.mapError((error) => error.publicError));
-		return { matched: [] };
-	});
-}
 function listOrgsProgram() {
 	return Effect.gen(function* () {
 		const deps = yield* OrgDepsTag;
@@ -16416,6 +17013,20 @@ function observedRunnerDeps(deps) {
 		...deps.invocationControls === void 0 ? {} : { invocationControls: deps.invocationControls }
 	};
 }
+/**
+* The invitation edge needs the call seam, the observed-runner pair, and — for
+* the authoring write's configuration hop — the same execution composition the
+* Permission, payment, and payroll bundles receive.
+*/
+function invitationMethodsDeps(deps, convexCall) {
+	return {
+		convexCall,
+		...observedRunnerDeps(deps),
+		...deps.actor === void 0 ? {} : { actor: deps.actor },
+		...deps.chainId === void 0 ? {} : { chainId: Number(deps.chainId) },
+		...deps.signer === void 0 ? {} : { signer: deps.signer }
+	};
+}
 function makeOrgMethods(deps) {
 	const orgDeps = {
 		...deps.orgPort === void 0 ? {} : { orgPort: deps.orgPort },
@@ -16447,13 +17058,10 @@ function makeOrgMethods(deps) {
 			});
 			return toCapxulResult(createOrgProgram(input), layer);
 		},
-		orgs: Object.assign((options) => listOrganizations(deps.invocationControls?.(options) ?? options), { detectAndAcceptPendingInvitations(options) {
-			if (options?.signal?.aborted) return Promise.resolve({
-				ok: false,
-				error: Errors.cancelled({ operation: CAPXUL_OPERATIONS.organizations.detectAndAcceptPendingInvitations })
-			});
-			return toCapxulResult(detectAndAcceptPendingInvitationsProgram(), layer);
-		} }),
+		orgs: Object.assign((options) => listOrganizations(deps.invocationControls?.(options) ?? options), { invitations: deps.convexCall === void 0 ? () => Promise.resolve({
+			ok: false,
+			error: Errors.notImplemented("invitations", "listOwn")
+		}) : makeOwnInvitationsMethod(invitationMethodsDeps(deps, deps.convexCall)) }),
 		org(orgId) {
 			const convexCall = deps.convexCall;
 			return {
@@ -16561,17 +17169,7 @@ function makeOrgMethods(deps) {
 					});
 					return toCapxulResult(listRolesProgram(orgId), layer);
 				},
-				invite(_input, _options) {
-					const controls = deps.invocationControls?.(_options) ?? _options;
-					if (controls?.signal?.aborted) return Promise.resolve({
-						ok: false,
-						error: Errors.cancelled({ operation: CAPXUL_OPERATIONS.org.invite })
-					});
-					return runCapxulEffect(inviteMemberProgram(orgId, _input).pipe(Effect.provide(orgDepsLayer({
-						...orgDeps,
-						...controls === void 0 ? {} : { invocationSource: controls }
-					}))), controls, CAPXUL_OPERATIONS.org.invite, deps.runPromise);
-				},
+				invitations: convexCall === void 0 ? makeNotImplementedInvitationMethods() : makeOrgInvitationMethods(invitationMethodsDeps(deps, convexCall), String(orgId)),
 				auditLog(_options) {
 					if (_options?.signal?.aborted) return Promise.resolve({
 						ok: false,
@@ -16634,6 +17232,28 @@ const orgMeUnavailable = () => Promise.resolve({
 	ok: false,
 	error: Errors.notImplemented("org", "me")
 });
+/**
+* The closed invitation surface for a client with no backend seam. It reports
+* `NOT_IMPLEMENTED` for every method rather than an empty list or a fabricated
+* view: an absent composition root is not an absent invitation.
+*/
+function makeNotImplementedInvitationMethods() {
+	return {
+		preview: invitationExecutionUnavailable,
+		invite: invitationExecutionUnavailable,
+		accept: invitationExecutionUnavailable,
+		list: invitationExecutionUnavailable,
+		get: invitationExecutionUnavailable,
+		decline: invitationExecutionUnavailable,
+		cancel: invitationExecutionUnavailable,
+		resend: invitationExecutionUnavailable,
+		retry: invitationExecutionUnavailable
+	};
+}
+const invitationExecutionUnavailable = () => Promise.resolve({
+	ok: false,
+	error: Errors.notImplemented("invitations", "executionComposition")
+});
 const permissionExecutionUnavailable = () => Promise.resolve({
 	ok: false,
 	error: Errors.notImplemented("permissions", "executionComposition")
@@ -17025,7 +17645,6 @@ function assembleCapxulClient(input) {
 	};
 	if (input.signal !== void 0) input.signal.addEventListener("abort", () => void stopActor(), { once: true });
 	const selectedOrgPort = input.orgPort ?? input.orgDeploymentPort;
-	let detectPendingOrgInvitations;
 	let kickProvisioning;
 	const financialOps = makeFinancialOpsMethods({
 		runPromise: effectRunner.runPromise,
@@ -17074,7 +17693,6 @@ function assembleCapxulClient(input) {
 				if (browserSigner.statusStore?.status() === "unknown" && typeof browserSigner.ensureWalletReady === "function") browserSigner.ensureWalletReady().catch(() => {});
 			}
 			if (accountSetup === "explicit") return;
-			await detectPendingOrgInvitations?.();
 			kickProvisioning?.();
 		}
 	});
@@ -17142,9 +17760,6 @@ function assembleCapxulClient(input) {
 		...input.signer === void 0 ? {} : { signer: input.signer },
 		...input.organizationSetup === void 0 ? {} : { organizationSetup: input.organizationSetup }
 	});
-	if (selectedOrgPort !== void 0) detectPendingOrgInvitations = async () => {
-		await orgMethods.orgs.detectAndAcceptPendingInvitations();
-	};
 	const currentUser = makeCurrentUserMethods({
 		me: financialOps.me,
 		accounts,
@@ -18036,7 +18651,7 @@ function productionAuthCacheLayer(input) {
 function productionConvexCallLayer(input, refreshConvexAuthRef) {
 	return Layer.unwrap(Effect.map(AuthClientPortTag, (authClient) => ConvexCallLayer({
 		convexUrl: input.runtimeUrls.convexUrl,
-		logToStderr: input.runtime === "node",
+		localDiagnostics: input.localDiagnostics,
 		...input.applicationId === void 0 ? {} : { applicationId: input.applicationId },
 		...input.observation === void 0 ? {} : { observation: input.observation },
 		...input.convexClient === void 0 ? {} : { client: input.convexClient },
@@ -18075,6 +18690,7 @@ function resolveProductionObservability(input) {
 	};
 }
 async function createProductionAdapters(input) {
+	const localDiagnostics = productionLocalDiagnostics(input);
 	const { observation, telemetry, invocationObservation, invocationTelemetry } = resolveProductionObservability(input);
 	const resolvedInput = resolveInput(input);
 	if (!resolvedInput.ok) return resolvedInput;
@@ -18145,6 +18761,7 @@ async function createProductionAdapters(input) {
 		const portsLayer = mergeProductionAdapterLayers(makeProductionAdapterLayerEntries({
 			bootstrap,
 			runtime: resolvedInput.value.runtime,
+			localDiagnostics,
 			...resolvedInput.value.origin === void 0 ? {} : { origin: resolvedInput.value.origin },
 			runtimeUrls: runtimeUrls.value,
 			chainId: bootstrapResult.value.chainId,
@@ -18159,7 +18776,7 @@ async function createProductionAdapters(input) {
 			...input.signal === void 0 ? {} : { signal: input.signal },
 			...input.resetSignerSession === void 0 ? {} : { resetSignerSession: input.resetSignerSession }
 		}));
-		const applicationLayer = Layer.merge(portsLayer, optionalEngineeringTelemetryLayer(bootstrapResult.value.engineeringTelemetry, resolvedInput.value.runtime, hostEngineeringPolicy(input.observability))).pipe(Layer.provideMerge(resolvedInput.value.runtime === "node" ? Layer.succeed(Logger.LogToStderr, true) : Layer.empty));
+		const applicationLayer = Layer.merge(portsLayer, optionalEngineeringTelemetryLayer(bootstrapResult.value.engineeringTelemetry, resolvedInput.value.runtime, hostEngineeringPolicy(input.observability))).pipe(Layer.provideMerge(localDiagnosticsLayer(localDiagnostics, resolvedInput.value.runtime)));
 		const context = await Effect.runPromise(Layer.buildWithScope(applicationLayer, scope));
 		const collected = await Effect.runPromise(collectProductionFlowPorts.pipe(Effect.provide(context)));
 		const indexerUrl = input.indexerUrl ?? bootstrapResult.value.indexerUrl;
@@ -18223,6 +18840,13 @@ function optionalEngineeringTelemetryLayer(policy, runtime, hostPolicy) {
 		return Layer.empty;
 	}
 }
+function localDiagnosticsLayer(enabled, runtime) {
+	if (!enabled) return Logger.layer([]);
+	return runtime === "node" ? Layer.succeed(Logger.LogToStderr, true) : Layer.empty;
+}
+function productionLocalDiagnostics(input) {
+	return input.localDiagnostics !== false;
+}
 function refreshConvexAuthOnSession(authClient, refresh) {
 	return {
 		...authClient,
@@ -18287,7 +18911,7 @@ async function createCapxulClientWithSignerControls(input, controls) {
 			runtime,
 			authBaseUrl: resolvedAuthBaseUrl,
 			createBrowserSigner: createOpenfortBrowserSignerFromBootstrap,
-			diagnostic: new EffectLogDiagnosticAdapter(adapters.value.context, new ConsoleDiagnosticAdapter()),
+			diagnostic: new EffectLogDiagnosticAdapter(adapters.value.context, productionLocalDiagnostics(input) ? new ConsoleDiagnosticAdapter() : void 0),
 			signer: input.signer,
 			factory: input.openfortSignerFactory,
 			finalSign: controls.signUserOpHash,
@@ -18316,11 +18940,11 @@ async function createCapxulClientWithSignerControls(input, controls) {
 			accountSetup: input.accountSetup,
 			...signer === void 0 ? {} : { signer },
 			orgPort: Context.get(adapters.value.context, OrgPortTag),
-			...signer === void 0 ? {} : { organizationSetup: new ConvexOrganizationSetupAdapter({
+			organizationSetup: new ConvexOrganizationSetupAdapter({
 				convex: adapters.value.ports.convexCall,
-				signer,
+				...signer === void 0 ? {} : { signer },
 				chainId: adapters.value.bootstrap.chainId
-			}) },
+			}),
 			...input.signal === void 0 ? {} : { signal: input.signal },
 			...input.otpTtlMs === void 0 ? {} : { otpTtlMs: input.otpTtlMs },
 			invokeTimeoutMs: input.invokeTimeoutMs ?? 3e4,