@capxul/mcp 4.2.0-rc.1 → 4.2.0-rc.11

package/dist/main.mjs

@@ -852,6 +852,7 @@ const COUNTRY_CODE_RE = /^[A-Z]{2}$/;
 const ACCOUNT_ID_RE = /^account_[0-9A-Za-z]+$/;
 const PARTY_ID_RE$1 = /^party_[0-9A-Za-z]+$/;
 const APP_ID_RE = /^app_[0-7][0-9A-HJKMNP-TV-Z]{25}$/;
+const TX_HASH_RE = /^0x[0-9a-f]{64}$/i;
 const WEI_RE = /^[0-9]+$/;
 Math.floor(Number.MAX_SAFE_INTEGER / 1e3);
 function toAddress(raw) {
@@ -903,6 +904,10 @@ function toPublishableKey(raw) {
 	if (typeof raw !== "string" || !PUBLISHABLE_KEY_PATTERN.test(raw)) throw Errors.invalidInput("publishableKey", invalidValueReason("must match cap_pk_(test|live) plus 32 Crockford base32 chars", raw));
 	return raw;
 }
+function toTxHash(raw) {
+	if (typeof raw !== "string" || !TX_HASH_RE.test(raw)) throw Errors.invalidInput("txHash", invalidValueReason("must be 0x + 64 hex chars", raw));
+	return raw.toLowerCase();
+}
 function toEpochMs(raw) {
 	assertSafeNonNegativeInteger(raw, "epochMs");
 	return raw;
@@ -926,6 +931,10 @@ function toChainId(raw) {
 	if (typeof raw !== "number" || !Number.isSafeInteger(raw) || raw <= 0) throw Errors.invalidInput("chainId", invalidValueReason("must be a positive safe integer", raw));
 	return raw;
 }
+function toWeiAmount(raw) {
+	if (typeof raw !== "string" || !WEI_RE.test(raw)) throw Errors.invalidInput("weiAmount", invalidValueReason("must be a non-negative integer string", raw));
+	return raw;
+}
 function toCountryCode(raw) {
 	if (typeof raw !== "string") throw Errors.invalidInput("countryCode", "must be a string");
 	const upper = raw.toUpperCase();
@@ -982,19 +991,118 @@ function invalidValueReason(prefix, raw) {
 //#region ../../packages/config/src/tokens.ts
 /** `TestUSDC` ("USDX") — Base Sepolia, 6 decimals, open `mint`. (Canon §1.) */
 const USDX_ADDRESS_BASE_SEPOLIA = "0xf09fcbb6df9f8f918e58f9c8ab15a76ade862b77";
+const USDX_DEPLOYMENT_START_BLOCK = 39860173;
+/**
+* The ERC-20 `symbol()` the deployed `TestUSDC` contract returns
+* (`packages/contracts/src/TestUSDC.sol:10`). It travels with the address and
+* the decimals so a holdings row can never carry one token's address with
+* another token's display symbol. This is the display symbol, not the
+* currency: see `USDX_CURRENCY` below.
+*/
+const USDX_SYMBOL = "USDX";
+const SYNTHETIC_TEST_ASSET_SOURCE = "synthetic-test-liquidity";
 const USDX_ASSET = {
 	assetId: assetIdFor(84532, USDX_ADDRESS_BASE_SEPOLIA),
 	chainId: toChainId(84532),
-	symbol: "USDX",
+	symbol: USDX_SYMBOL,
 	peg: toCurrencyCode("USD"),
 	tokenAddress: USDX_ADDRESS_BASE_SEPOLIA,
-	deploymentStartBlock: 39860173,
-	decimals: 6
+	deploymentStartBlock: USDX_DEPLOYMENT_START_BLOCK,
+	decimals: 6,
+	source: "settlement"
 };
-[{
+/**
+* The settlement tier: rows the exact-transfer path and the Movement scanner
+* admit, each carrying the legacy `currency` projection those readers expect.
+* Adding an owned test asset here would put candidate liquidity on the
+* money-write path, so M03's rows go to the candidate tier below instead.
+*/
+const CONFIGURED_MONEY_ASSETS = [{
 	...USDX_ASSET,
 	currency: USDX_ASSET.peg
-}].map((asset) => asset.tokenAddress.toLowerCase());
+}];
+/**
+* The candidate tier: five owned test assets, every field read back from Base
+* Sepolia after the deployment that created it (chain 84532, blocks
+* 46,465,978–46,465,982). Real contracts, authored liquidity, no settlement
+* admission — so rollback is removing consumers, never relabelling a
+* deployed address or deleting its history.
+*
+* `symbol` is the display string the owned contract returns. A
+* provider-supported USDC would be a different contract at a different
+* address returning the same symbol, which is why the resolvers below key on
+* `assetId`, or on chain plus address, and never on a symbol.
+*/
+const SYNTHETIC_TEST_ASSETS = [
+	{
+		assetId: assetIdFor(84532, "0xb3d8566fb90f7df939f4bc08a09b19047117f549"),
+		chainId: toChainId(84532),
+		tokenAddress: "0xb3d8566fb90f7df939f4bc08a09b19047117f549",
+		symbol: "USDC",
+		decimals: 6,
+		peg: toCurrencyCode("USD"),
+		deploymentStartBlock: 46465978,
+		deploymentTransaction: "0xa7fb8bb9d1fd1cc5fe2fc42fa4cdccace7742efae8ea99f091a283e5709343de",
+		source: SYNTHETIC_TEST_ASSET_SOURCE
+	},
+	{
+		assetId: assetIdFor(84532, "0x7ddcfb6aaffb9908c4c2db308b784c269eec8a01"),
+		chainId: toChainId(84532),
+		tokenAddress: "0x7ddcfb6aaffb9908c4c2db308b784c269eec8a01",
+		symbol: "USDT",
+		decimals: 6,
+		peg: toCurrencyCode("USD"),
+		deploymentStartBlock: 46465979,
+		deploymentTransaction: "0xa17ad76fe8b24cdf1fbcff245c3eb022444710cf9fa7b5ee59818be654f4ae10",
+		source: SYNTHETIC_TEST_ASSET_SOURCE
+	},
+	{
+		assetId: assetIdFor(84532, "0x1d93d525f73453fe18eebf044e8a3954bfe3721e"),
+		chainId: toChainId(84532),
+		tokenAddress: "0x1d93d525f73453fe18eebf044e8a3954bfe3721e",
+		symbol: "WETH",
+		decimals: 18,
+		peg: null,
+		deploymentStartBlock: 46465980,
+		deploymentTransaction: "0xcb9b2d024686fac93ec1243ccf02d3567fd531da46176115660cba2ba644b09d",
+		source: SYNTHETIC_TEST_ASSET_SOURCE
+	},
+	{
+		assetId: assetIdFor(84532, "0x8fe52c70aa9f7b6d74d8bb26eca33d87413cb624"),
+		chainId: toChainId(84532),
+		tokenAddress: "0x8fe52c70aa9f7b6d74d8bb26eca33d87413cb624",
+		symbol: "WBTC",
+		decimals: 8,
+		peg: null,
+		deploymentStartBlock: 46465981,
+		deploymentTransaction: "0x728ba7b430ffd141f83d0ed5ce429d050049d7b097c936fd11e9c572d1243854",
+		source: SYNTHETIC_TEST_ASSET_SOURCE
+	},
+	{
+		assetId: assetIdFor(84532, "0x5865fe9787ac214feb5facaebaec06969ac0a9a3"),
+		chainId: toChainId(84532),
+		tokenAddress: "0x5865fe9787ac214feb5facaebaec06969ac0a9a3",
+		symbol: "cNGN",
+		decimals: 6,
+		peg: toCurrencyCode("NGN"),
+		deploymentStartBlock: 46465982,
+		deploymentTransaction: "0xcedf254bcef57fc64189261a5ab1161bc4fde370e470933f627c4d8ddb5a2e26",
+		source: SYNTHETIC_TEST_ASSET_SOURCE
+	}
+];
+toChainId(84532);
+/**
+* Every known asset in ONE identity space. The tiers above declare admission;
+* this is the only list an identity resolves against, so an asset is never
+* two different things depending on which list a caller happened to read.
+*/
+const MONEY_ASSET_REGISTRY = [...CONFIGURED_MONEY_ASSETS, ...SYNTHETIC_TEST_ASSETS];
+CONFIGURED_MONEY_ASSETS.map((asset) => asset.tokenAddress.toLowerCase());
+/** The registry row for `assetId` across every tier, or `null`. */
+function configuredMoneyAssetById(assetId) {
+	const canonical = toAssetId(assetId);
+	return MONEY_ASSET_REGISTRY.find((asset) => asset.assetId === canonical) ?? null;
+}
 //#endregion
 //#region ../../node_modules/.pnpm/abitype@1.2.3_typescript@7.0.2_zod@4.4.3/node_modules/abitype/dist/esm/regex.js
 function execTyped(regex, string) {
@@ -3738,6 +3846,12 @@ const USDX_BASE_SEPOLIA_TOKEN = {
 USDX_BASE_SEPOLIA_TOKEN.chainId;
 USDX_BASE_SEPOLIA_TOKEN.chainId;
 10n ** BigInt(6);
+/**
+* The bootstrap manage role. It administers people and roles, cannot spend,
+* and is not a signer of the Organization Safe; "Owner" implied the latter,
+* so the label is Admin (ruled 2026-09-06).
+*/
+const ADMIN_ROLE_LABEL = "Admin";
 function normalizeOrgRoleLabel(label) {
 	const normalized = label.trim().replace(/\s+/g, " ");
 	if (normalized.length === 0) throw Errors.invalidInput("role.label", "must be a non-empty role label");
@@ -6788,6 +6902,8 @@ const CAPXUL_OPERATIONS = {
 		emitAnnotationSaved: "activity.emitAnnotationSaved",
 		get: "activity.get",
 		list: "activity.list",
+		/** The SDK's live Activity read over the indexer's SSE stream. */
+		subscribe: "activity.subscribe",
 		summary: "activity.summary"
 	},
 	addressBook: {
@@ -7271,6 +7387,17 @@ const AuthFailedProps = Schema.Struct({
 	auth_type: OptionalString,
 	reason: OptionalString
 });
+const IdentityRefusedProps = Schema.Struct({
+	...TelemetryEnvelopeProps,
+	/** The refused identity event tag, for example CreateOrganization. */
+	event: OptionalString,
+	/** The machine's refusal code: WRONG_STATE, SUPERSEDED or STALE_EPOCH. */
+	refusal_code: OptionalString,
+	/** The machine slot the request targeted, for example identity:org. */
+	slot: OptionalString,
+	/** The machine state at refusal, for example authenticated:claiming. */
+	state: OptionalString
+});
 const AuthSignedOutProps = Schema.Struct(TelemetryEnvelopeProps);
 const ProvisioningSafeCreatedProps = Schema.Struct({
 	...TelemetryEnvelopeProps,
@@ -7658,10 +7785,44 @@ const DepositSettledProps = Schema.Struct({
 });
 const PermissionMirrorVerificationProps = Schema.Struct({
 	...TelemetryEnvelopeProps,
+	/** The RECEIPT verification outcome. What the mirror then did is separate. */
 	outcome: Schema.String,
 	reason: Schema.String,
 	chain_id: Schema.Number,
-	retry_count: Schema.Number
+	retry_count: Schema.Number,
+	/**
+	* #1960 R02, consumed by R03. A verified receipt is not an applied Permission:
+	* these two optional fields let the producer say what the applying mutation
+	* actually returned, and which command it was, without either fact rewriting
+	* the receipt outcome above. Absent when application has not happened yet.
+	*/
+	application_result: Schema.optional(Schema.Literals([
+		"applied",
+		"replayed",
+		"conflicting_replay",
+		"revision_mismatch"
+	])),
+	command_id: OptionalString,
+	/**
+	* #1961 R03. The authorized stored row names the Permission it changed; the
+	* verified receipt names the chain facts that prove it. Every field is
+	* optional because a pending or provider-failed verification has neither an
+	* application result nor a receipt to report.
+	*/
+	permission_id: OptionalString,
+	permission_assignment_id: OptionalString,
+	permission_operation: Schema.optional(Schema.Literals([
+		"create",
+		"change",
+		"assign",
+		"revoke",
+		"replace"
+	])),
+	revision: Schema.optional(Schema.Number),
+	user_op_hash: OptionalString,
+	transaction_hash: OptionalString,
+	block_number: Schema.optional(Schema.Number),
+	log_index: Schema.optional(Schema.Number)
 });
 const MovementScanWindowProps = Schema.Struct({
 	...TelemetryEnvelopeProps,
@@ -7707,6 +7868,10 @@ Schema.Struct({
 	name: Schema.Literal("auth_failed"),
 	props: AuthFailedProps
 });
+Schema.Struct({
+	name: Schema.Literal("identity_refused"),
+	props: IdentityRefusedProps
+});
 Schema.Struct({
 	name: Schema.Literal("auth_signed_out"),
 	props: AuthSignedOutProps
@@ -7887,6 +8052,10 @@ Schema.Struct({
 	name: Schema.Literal("movement_scan_incident"),
 	props: MovementScanIncidentProps
 });
+/** The one spelling of "whose scope did this happen in" across every surface. */
+const ScopeKindSchema = Schema.Literals(["account", "organization"]);
+const AccountKindSchema = Schema.Literals(["personalSafe", "orgTreasury"]);
+const OptionalReasonCode = Schema.optional(Schema.Literals(CAPXUL_ERROR_CODES));
 const ActivityReferenceProps = {
 	reference_kind: Schema.Literals(["payment", "movement"]),
 	reference_id: Schema.String
@@ -7917,8 +8086,8 @@ const ActivityFilterProps = {
 };
 const ActivityActionProps = {
 	...TelemetryEnvelopeProps,
-	scope_kind: Schema.Literals(["account", "organization"]),
-	reason_code: Schema.optional(Schema.Literals(CAPXUL_ERROR_CODES))
+	scope_kind: ScopeKindSchema,
+	reason_code: OptionalReasonCode
 };
 Schema.Struct({
 	name: Schema.Literal("contact_relationship_changed"),
@@ -7930,7 +8099,7 @@ Schema.Struct({
 			"hidden",
 			"restored"
 		]),
-		scope_kind: Schema.Literals(["account", "organization"]),
+		scope_kind: ScopeKindSchema,
 		scope_id: Schema.String,
 		owner_party_id: Schema.String,
 		party_id: Schema.String,
@@ -7946,9 +8115,9 @@ Schema.Struct({
 });
 const ContactActionProps = {
 	...TelemetryEnvelopeProps,
-	scope_kind: Schema.Literals(["account", "organization"]),
+	scope_kind: ScopeKindSchema,
 	party_id: OptionalString,
-	reason_code: Schema.optional(Schema.Literals(CAPXUL_ERROR_CODES))
+	reason_code: OptionalReasonCode
 };
 Schema.Struct({
 	name: Schema.Literal("ui_contact_action_completed"),
@@ -7975,7 +8144,7 @@ Schema.Struct({
 	props: Schema.Struct({
 		...TelemetryEnvelopeProps,
 		...ActivityReferenceProps,
-		scope_kind: Schema.Literals(["account", "organization"]),
+		scope_kind: ScopeKindSchema,
 		scope_id: Schema.String,
 		occurred_at: Schema.Number
 	})
@@ -8030,6 +8199,193 @@ Schema.Struct({
 		})
 	])
 });
+/**
+* Reliability closeout (#1960 R02) — the shape every explicit UI observation
+* below shares. `scope_kind` says whose surface the person was looking at,
+* `organization_id` is the verified Organization the producer resolved (absent
+* on a personal action), and `reason_code` is a catalog error code, never copy.
+*/
+const UiStepProps = {
+	...TelemetryEnvelopeProps,
+	scope_kind: ScopeKindSchema,
+	organization_id: OptionalOrgId,
+	reason_code: OptionalReasonCode
+};
+const AccessRecoveryCompletedProps = Schema.Union([Schema.Struct({
+	...TelemetryEnvelopeProps,
+	recovery: Schema.Literal("session_restoration"),
+	outcome: Schema.Literals([
+		"restored",
+		"absent",
+		"failed"
+	]),
+	reason_code: OptionalReasonCode,
+	organization_id: OptionalOrgId
+}), Schema.Struct({
+	...TelemetryEnvelopeProps,
+	recovery: Schema.Literal("signer_readiness"),
+	outcome: Schema.Literals(["ready", "unavailable"]),
+	reason_code: OptionalReasonCode,
+	organization_id: OptionalOrgId
+})]);
+Schema.Struct({
+	name: Schema.Literal("access_recovery_completed"),
+	props: AccessRecoveryCompletedProps
+});
+Schema.Struct({
+	name: Schema.Literal("ui_access_step_completed"),
+	props: Schema.Struct({
+		...UiStepProps,
+		step: Schema.Literals([
+			"dashboard_granted",
+			"redirect_completed",
+			"gate_error_displayed",
+			"retry_selected",
+			"capability_refusal_displayed",
+			"signer_refusal_displayed"
+		]),
+		capability: Schema.optional(Schema.Literals(["spend", "managePeople"])),
+		probe: Schema.optional(Schema.Literals([
+			"session",
+			"membership",
+			"lifecycle"
+		])),
+		reason: Schema.optional(Schema.Literals([
+			"loading",
+			"no-permission",
+			"org-unavailable"
+		]))
+	})
+});
+Schema.Struct({
+	name: Schema.Literal("org_invite_progressed"),
+	props: Schema.Struct({
+		...TelemetryEnvelopeProps,
+		organization_id: OrgIdTelemetrySchema,
+		progress: Schema.Literals([
+			"account_ready",
+			"permission_applied",
+			"membership_activated",
+			"revoked"
+		]),
+		/** The invited Party. The initiating actor stays on the envelope's identity. */
+		member_party_id: Schema.String,
+		occurred_at: Schema.Number
+	})
+});
+Schema.Struct({
+	name: Schema.Literal("invoice_issued"),
+	props: Schema.Struct({
+		...TelemetryEnvelopeProps,
+		request_id: Schema.String,
+		issuer_scope_kind: ScopeKindSchema,
+		issuer_scope_id: Schema.String,
+		payer_party_id: OptionalString,
+		occurred_at: Schema.Number
+	})
+});
+Schema.Struct({
+	name: Schema.Literal("invoice_request_transitioned"),
+	props: Schema.Struct({
+		...TelemetryEnvelopeProps,
+		request_id: Schema.String,
+		transition: Schema.Literals([
+			"approval_prepared",
+			"declined",
+			"cancelled"
+		]),
+		actor_scope_kind: ScopeKindSchema,
+		actor_scope_id: Schema.String,
+		occurred_at: Schema.Number
+	})
+});
+Schema.Struct({
+	name: Schema.Literal("ui_invoice_step_completed"),
+	props: Schema.Struct({
+		...UiStepProps,
+		step: Schema.Literals([
+			"opened",
+			"previewed",
+			"dismissed",
+			"submitted",
+			"result_displayed",
+			"refusal_displayed",
+			"retry_selected"
+		]),
+		request_id: OptionalString
+	})
+});
+Schema.Struct({
+	name: Schema.Literal("ui_treasury_step_completed"),
+	props: Schema.Struct({
+		...UiStepProps,
+		step: Schema.Literals([
+			"balance_displayed",
+			"read_refusal_displayed",
+			"retry_selected",
+			"recovery_completed"
+		]),
+		account_kind: Schema.optional(AccountKindSchema)
+	})
+});
+Schema.Struct({
+	name: Schema.Literal("ui_receive_step_completed"),
+	props: Schema.Struct({
+		...UiStepProps,
+		step: Schema.Literals([
+			"instructions_displayed",
+			"address_copied",
+			"copy_failed",
+			"refusal_displayed",
+			"retry_selected"
+		]),
+		account_kind: Schema.optional(AccountKindSchema)
+	})
+});
+Schema.Struct({
+	name: Schema.Literal("payroll_group_changed"),
+	props: Schema.Struct({
+		...TelemetryEnvelopeProps,
+		organization_id: OrgIdTelemetrySchema,
+		change: Schema.Literals([
+			"created",
+			"updated",
+			"deleted"
+		]),
+		group_id: Schema.String,
+		member_count: Schema.Number,
+		occurred_at: Schema.Number
+	})
+});
+Schema.Struct({
+	name: Schema.Literal("payroll_run_transitioned"),
+	props: Schema.Struct({
+		...TelemetryEnvelopeProps,
+		organization_id: OrgIdTelemetrySchema,
+		transition: Schema.Literals([
+			"prepared",
+			"authorized",
+			"settled"
+		]),
+		run_id: Schema.String,
+		payment_count: Schema.optional(Schema.Number),
+		occurred_at: Schema.Number
+	})
+});
+Schema.Struct({
+	name: Schema.Literal("ui_payroll_action_completed"),
+	props: Schema.Struct({
+		...UiStepProps,
+		action: Schema.Literals([
+			"opened",
+			"refusal_displayed",
+			"recovery_completed",
+			"cancelled",
+			"submitted_displayed"
+		]),
+		run_id: OptionalString
+	})
+});
 function redactTelemetryProps(name, props, options = {}) {
 	if (props === void 0) return void 0;
 	const clone = cloneProps$1(props);
@@ -8325,6 +8681,10 @@ const BootstrapEnvelope = Schema.Struct({
 		siteBaseUrl: Schema.String,
 		openfortPublishableKey: Schema.String,
 		shieldPublishableKey: Schema.String,
+		/** Which Openfort third-party auth provider the signer presents; absent means better-auth. */
+		openfortAuthProvider: Schema.optional(Schema.Literals(["better-auth", "oidc"])),
+		/** Origin of the Ponder indexer the SDK reads directly; absent means no indexer reads. */
+		indexerUrl: Schema.optional(Schema.String),
 		engineeringTelemetry: Schema.optional(EngineeringTelemetryBootstrapPolicy)
 	})
 });
@@ -8387,6 +8747,7 @@ const CAPXUL_FUNCTIONS = {
 		list: "movement/activity:list",
 		summary: "movement/activity:summary"
 	},
+	"movement/annotations": { overlay: "movement/annotations:overlay" },
 	"moneyExecution/actions": {
 		abandonPaymentExecution: "moneyExecution/actions:abandonPaymentExecution",
 		preparePermissionExecution: "moneyExecution/actions:preparePermissionExecution",
@@ -8399,6 +8760,7 @@ const CAPXUL_FUNCTIONS = {
 		prepareOrganizationPaymentExecution: "moneyExecution/paymentCommandActions:prepareOrganizationPaymentExecution",
 		submitPaymentCommandExecution: "moneyExecution/paymentCommandActions:submitPaymentCommandExecution"
 	},
+	"moneyExecution/providerSendWitness": { read: "moneyExecution/providerSendWitness:read" },
 	media: {
 		generateUploadUrl: "media:generateUploadUrl",
 		setOrgLogo: "media:setOrgLogo",
@@ -8458,6 +8820,11 @@ const CAPXUL_FUNCTIONS = {
 		loadByAuthUserId: "smartAccount/queries:loadByAuthUserId",
 		loadBySmartAccountAddress: "smartAccount/queries:loadBySmartAccountAddress"
 	},
+	e2eControls: {
+		holdUserOperationReceipt: "e2eControls:holdUserOperationReceipt",
+		isUserOperationReceiptHeld: "e2eControls:isUserOperationReceiptHeld",
+		releaseUserOperationReceipt: "e2eControls:releaseUserOperationReceipt"
+	},
 	system: { health: "system:health" }
 };
 //#endregion
@@ -8979,7 +9346,19 @@ const StoredPermissionCommandSchema = Schema.Struct({
 	roleKey: RoleKeySchema,
 	allowanceKey: Schema.NullOr(AllowanceKeySchema),
 	memberSafe: Schema.NullOr(SafeAddressSchema),
-	expectedAuthorityEvents: Schema.Array(Bytes32Schema)
+	expectedAuthorityEvents: Schema.Array(Bytes32Schema),
+	/**
+	* #1961 R03. The authenticated user who created the command, and the browser
+	* linkage captured with it. Delayed verification and bounded retries read
+	* this snapshot instead of the current viewer, so one command keeps one
+	* origin. Both are absent on commands created before this contract.
+	*
+	* The context stays `unknown` on purpose: `sanitizeObservationContext` owns
+	* the field allowlist, and every reader passes the stored value through it
+	* rather than repeating those rules here.
+	*/
+	originatingAuthUserId: Schema.optional(Schema.String),
+	originatingObservationContext: Schema.optional(Schema.Unknown)
 });
 Schema.Struct({
 	command: StoredPermissionCommandSchema,
@@ -12029,6 +12408,7 @@ const financialOpsContract = {
 	activitySummary: makeFunctionReference(CAPXUL_FUNCTIONS["movement/activity"].summary),
 	activityGet: makeFunctionReference(CAPXUL_FUNCTIONS["movement/activity"].get),
 	activityAnnotate: makeFunctionReference(CAPXUL_FUNCTIONS["movement/activity"].annotate),
+	activityOverlay: makeFunctionReference(CAPXUL_FUNCTIONS["movement/annotations"].overlay),
 	verifyPaymentDocument: makeFunctionReference(CAPXUL_FUNCTIONS["financialOps/queries"].verifyPaymentDocument),
 	renderStoredDocument: makeFunctionReference(CAPXUL_FUNCTIONS["financialOps/queries"].renderStoredDocument)
 };
@@ -12045,8 +12425,357 @@ const moneyExecutionContract = {
 	submitPaymentCommandExecution: makeFunctionReference(CAPXUL_FUNCTIONS["moneyExecution/paymentCommandActions"].submitPaymentCommandExecution)
 };
 //#endregion
+//#region ../../packages/sdk/src/ports/indexer-read.ts
+/** The indexer's own page bound. Exceeding it is a caller defect, not a refusal. */
+const INDEXER_MAX_LIMIT = 1e3;
+const LOWER_CASE_ADDRESS = /^0x[0-9a-f]{40}$/;
+/**
+* Refuse a page the indexer would refuse, before any implementation spends a
+* round trip on it. Every implementation calls this, so a consumer test written
+* against the hermetic adapter cannot pass on input production rejects. Throws
+* a `CapxulError`; callers convert it to an `IndexerReadError`.
+*/
+function assertIndexerPage(input) {
+	const safe = String(input.safe).toLowerCase();
+	if (!LOWER_CASE_ADDRESS.test(safe)) throw Errors.invalidInput("safe", "must be a lower-case EVM address");
+	if (!Number.isSafeInteger(input.limit) || input.limit < 1 || input.limit > 1e3) throw Errors.invalidInput("limit", `must be an integer from 1 to ${INDEXER_MAX_LIMIT}`);
+	const offset = input.offset ?? 0;
+	if (!Number.isSafeInteger(offset) || offset < 0) throw Errors.invalidInput("offset", "must be a non-negative integer");
+	return safe;
+}
+var IndexerReadError = class extends Data.TaggedError("IndexerReadError") {};
+function indexerReadErrorFromCapxul(operation, error, cause = error) {
+	return new IndexerReadError({
+		operation,
+		publicCode: error.code,
+		publicError: error,
+		cause,
+		...error.details === void 0 ? {} : { details: error.details }
+	});
+}
+Context.Service()("@capxul/sdk/ports/IndexerReadPort");
+//#endregion
+//#region ../../packages/sdk/src/surface/activity-stitch.ts
+/** Epoch milliseconds of the block that carried the row. */
+function blockMillis(row) {
+	return Number(row.timestamp) * 1e3;
+}
+/** `0x1234…abcd` — the counterparty of an unclaimed transfer is an address. */
+function shortAddressLabel(address) {
+	return address.length <= 12 ? address : `${address.slice(0, 6)}…${address.slice(-4)}`;
+}
+function directionFor(safe, transfer) {
+	const from = transfer.from.toLowerCase();
+	const to = transfer.to.toLowerCase();
+	if (from === safe && to === safe) return "self";
+	return to === safe ? "in" : "out";
+}
+/**
+* The Transfer a protocol Payment moved is the same money as its `payment`
+* row. One actor sees one item for it, so the Transfer is claimed and does not
+* become a second row. Another transfer in the same transaction that this
+* payment did not move stays unclaimed and keeps its own row.
+*/
+function claimedTransferIds(transfers, payments) {
+	const claimed = /* @__PURE__ */ new Set();
+	for (const payment of payments) {
+		const match = transfers.find((transfer) => !claimed.has(transfer.id) && transfer.txHash === payment.txHash && transfer.token.toLowerCase() === payment.token.toLowerCase() && transfer.amount === payment.amount && transfer.to.toLowerCase() === payment.recipient.toLowerCase());
+		if (match !== void 0) claimed.add(match.id);
+	}
+	return claimed;
+}
+function withAnnotation(item, annotation) {
+	return annotation?.counterpartyLabel === void 0 ? item : {
+		...item,
+		counterpartyLabel: annotation.counterpartyLabel
+	};
+}
+/**
+* Confirmation comes from the chain, never from Convex.
+*
+* A Ponder row for this Payment's settlement means settled, and its receipt is
+* the indexed transaction. No Ponder row and a Convex row that still says
+* settled means the block that carried it was dropped: the row goes back to
+* `settling` and its annotation, which keys on the Payment id, is untouched.
+*/
+function confirmPayment(intent, chain, hasSettlement) {
+	if (chain !== void 0) return {
+		...intent,
+		status: "settled",
+		receipt: {
+			chainId: chain.chainId,
+			transactionHash: chain.txHash
+		},
+		updatedAt: blockMillis(chain)
+	};
+	if (hasSettlement && intent.status === "settled") return {
+		...intent,
+		status: "settling",
+		receipt: null
+	};
+	return intent;
+}
+/**
+* One unclaimed Transfer as an Activity row, or `null` when this SDK cannot
+* denominate its asset. The indexer serves only configured assets, so a row
+* the registry does not know means the SDK and that deployment disagree; it is
+* dropped rather than shown with a guessed currency.
+*/
+function transferItem(safe, transfer, annotation) {
+	const asset = configuredMoneyAssetById(transfer.assetId);
+	if (asset === null) return null;
+	const direction = directionFor(safe, transfer);
+	const counterparty = direction === "in" ? transfer.from : transfer.to;
+	const at = blockMillis(transfer);
+	return withAnnotation({
+		kind: "movement",
+		id: transfer.id,
+		classification: "movement_only_outflow",
+		amount: {
+			currency: asset.peg ?? asset.symbol,
+			value: formatUnits(transfer.amount, asset.decimals),
+			decimals: asset.decimals
+		},
+		direction,
+		counterpartyLabel: shortAddressLabel(counterparty),
+		receipt: {
+			chainId: transfer.chainId,
+			transactionHash: transfer.txHash
+		},
+		createdAt: at,
+		updatedAt: at
+	}, annotation);
+}
+/** Newest first. A Payment precedes a Movement at one instant, as the ledger reader orders them. */
+function compareItems(left, right) {
+	if (right.createdAt !== left.createdAt) return right.createdAt - left.createdAt;
+	if (left.kind !== right.kind) return left.kind === "payment" ? -1 : 1;
+	if (left.id === right.id) return 0;
+	return left.id < right.id ? 1 : -1;
+}
+function stitchActivity(input) {
+	const safe = input.safe.toLowerCase();
+	const chainBySettlement = /* @__PURE__ */ new Map();
+	for (const row of input.payments) chainBySettlement.set(row.settlementId.toLowerCase(), row);
+	const chainByPaymentId = /* @__PURE__ */ new Map();
+	const settledPaymentIds = /* @__PURE__ */ new Set();
+	for (const link of input.links) {
+		settledPaymentIds.add(link.paymentId);
+		const row = chainBySettlement.get(link.settlementId.toLowerCase());
+		if (row !== void 0) chainByPaymentId.set(link.paymentId, row);
+	}
+	const annotations = /* @__PURE__ */ new Map();
+	for (const annotation of input.annotations) annotations.set(`${annotation.reference.kind}:${annotation.reference.id}`, annotation);
+	const items = [];
+	const claiming = [];
+	for (const intent of input.intents) {
+		if (intent.kind !== "payment") continue;
+		const chain = chainByPaymentId.get(intent.id);
+		if (chain !== void 0) claiming.push(chain);
+		items.push(withAnnotation(confirmPayment(intent, chain, settledPaymentIds.has(intent.id)), annotations.get(`payment:${intent.id}`)));
+	}
+	const claimed = claimedTransferIds(input.transfers, claiming);
+	for (const transfer of input.transfers) {
+		if (claimed.has(transfer.id)) continue;
+		const item = transferItem(safe, transfer, annotations.get(`movement:${transfer.id}`));
+		if (item !== null) items.push(item);
+	}
+	return items.sort(compareItems);
+}
+/** The reference ids one stitched page needs its Convex overlay for. */
+function overlayReferences(items) {
+	return items.map((item) => ({
+		kind: item.kind,
+		id: item.id
+	}));
+}
+/**
+* Money in, money out and the pending share, one bucket per currency and
+* precision. Two assets that peg to the same currency at different precision
+* stay distinct buckets: their raw units are not interchangeable.
+*/
+function summarizeItems(items) {
+	const buckets = /* @__PURE__ */ new Map();
+	for (const item of items) {
+		const key = `${item.amount.currency}:${String(item.amount.decimals)}`;
+		const bucket = buckets.get(key) ?? {
+			currency: item.amount.currency,
+			decimals: item.amount.decimals,
+			in: 0n,
+			out: 0n,
+			pendingIn: 0n
+		};
+		const raw = rawUnits(item.amount.value, item.amount.decimals);
+		if (item.direction === "in") {
+			bucket.in += raw;
+			if (item.kind === "payment" && item.status !== "settled") bucket.pendingIn += raw;
+		} else if (item.direction === "out") bucket.out += raw;
+		buckets.set(key, bucket);
+	}
+	return [...buckets.values()].map((bucket) => ({
+		currency: bucket.currency,
+		decimals: bucket.decimals,
+		in: bucket.in.toString(),
+		out: bucket.out.toString(),
+		net: (bucket.in - bucket.out).toString(),
+		pendingIn: bucket.pendingIn.toString()
+	}));
+}
+/** The inverse of `formatUnits`, kept exact: `"1.25"` at 6 decimals is `1250000n`. */
+function rawUnits(value, decimals) {
+	const negative = value.startsWith("-");
+	const [whole = "0", fraction = ""] = (negative ? value.slice(1) : value).split(".");
+	const raw = BigInt(`${whole}${fraction.padEnd(decimals, "0").slice(0, decimals)}`);
+	return negative ? -raw : raw;
+}
+//#endregion
+//#region ../../packages/sdk/src/surface/activity-read.ts
+/** How many Convex intent rows one page reads for its labels and pending rows. */
+const INTENT_WINDOW = 100;
+/** The window a summary aggregates over. The indexer's own page bound. */
+const SUMMARY_WINDOW = INDEXER_MAX_LIMIT;
+function parseCursor(value) {
+	if (value === void 0) return 0;
+	try {
+		const parsed = JSON.parse(value);
+		return Number.isSafeInteger(parsed.offset) && parsed.offset >= 0 ? parsed.offset : 0;
+	} catch {
+		return 0;
+	}
+}
+function inRange(item, range) {
+	if (range?.from !== void 0 && item.createdAt < range.from) return false;
+	return range?.to === void 0 || item.createdAt <= range.to;
+}
+/** The caller's filter applied to the merged page. The join owns the order. */
+function matchesFilter(item, filter) {
+	if (filter === void 0) return true;
+	if (filter.kind !== void 0 && item.kind !== filter.kind) return false;
+	if (filter.direction !== void 0 && item.direction !== filter.direction) return false;
+	if (filter.status === void 0) return true;
+	return item.kind === "payment" && filter.status.includes(item.status);
+}
+function overlay(deps, actor, controls, input) {
+	return deps.convexCall.query(deps.functions.activityOverlay, copyInvocationObservation(controls, { input: {
+		...actor === void 0 ? {} : { actor },
+		...input.references === void 0 ? {} : { references: input.references },
+		...input.settlementIds === void 0 ? {} : { settlementIds: input.settlementIds }
+	} }));
+}
+function convexPage(deps, actor, controls, input) {
+	return deps.convexCall.query(deps.functions.activityList, copyInvocationObservation(controls, { input: {
+		...actor === void 0 ? {} : { actor },
+		...input.cursor === void 0 ? {} : { cursor: input.cursor },
+		...input.limit === void 0 ? {} : { limit: input.limit },
+		...input.range === void 0 ? {} : { range: input.range }
+	} }));
+}
+/** Both indexed tables for one Safe, or `null` when the indexer cannot answer. */
+function chainRows(deps, safe, limit) {
+	const page = {
+		safe,
+		limit: Math.min(limit, INDEXER_MAX_LIMIT)
+	};
+	return Effect.all([deps.indexer.read("transfer", page), deps.indexer.read("payment", page)], { concurrency: 2 }).pipe(Effect.map(([transfers, payments]) => ({
+		transfers,
+		payments
+	})), Effect.catch(() => Effect.succeed(null)));
+}
+/** The stitched, filtered rows of one window, newest first. */
+function stitchedWindow(deps, actor, controls, window, params) {
+	return Effect.gen(function* () {
+		const scope = yield* overlay(deps, actor, controls, {});
+		const convex = yield* convexPage(deps, actor, controls, {
+			limit: INTENT_WINDOW,
+			...params.range === void 0 ? {} : { range: params.range }
+		});
+		const rows = scope.safe === null ? null : yield* chainRows(deps, scope.safe, window);
+		if (rows === null || scope.safe === null) return {
+			items: convex.items.filter((item) => matchesFilter(item, params.filter)),
+			stitched: false
+		};
+		const decoration = yield* overlay(deps, actor, controls, {
+			references: [...overlayReferences(convex.items), ...rows.transfers.map((row) => ({
+				kind: "movement",
+				id: row.id
+			}))],
+			settlementIds: rows.payments.map((row) => row.settlementId)
+		});
+		return {
+			items: stitchActivity({
+				safe: scope.safe,
+				transfers: rows.transfers,
+				payments: rows.payments,
+				intents: convex.items,
+				links: decoration.links,
+				annotations: decoration.annotations
+			}).filter((item) => inRange(item, params.range) && matchesFilter(item, params.filter)),
+			stitched: true
+		};
+	});
+}
+function readActivityPage(deps, actor, controls, params) {
+	const limit = params?.limit ?? 25;
+	const offset = parseCursor(params?.cursor);
+	return stitchedWindow(deps, actor, controls, offset + limit + 1, {
+		...params?.range === void 0 ? {} : { range: params.range },
+		...params?.filter === void 0 ? {} : { filter: params.filter }
+	}).pipe(Effect.map(({ items, stitched }) => {
+		const observedAt = Date.now();
+		if (!stitched) return {
+			items: items.slice(0, limit),
+			cursor: null,
+			checkpoint: observedAt,
+			observedAt
+		};
+		return {
+			items: items.slice(offset, offset + limit),
+			cursor: items.length > offset + limit ? JSON.stringify({ offset: offset + limit }) : null,
+			checkpoint: observedAt,
+			observedAt
+		};
+	}));
+}
+function readActivitySummary(deps, actor, controls, params) {
+	return stitchedWindow(deps, actor, controls, SUMMARY_WINDOW, params?.window === void 0 ? {} : { range: params.window }).pipe(Effect.map(({ items }) => ({
+		window: {
+			from: params?.window?.from ?? null,
+			to: params?.window?.to ?? null
+		},
+		totals: summarizeItems(items),
+		count: items.length,
+		observedAt: Date.now()
+	})));
+}
+/**
+* Tell the caller when the indexed page for this Safe changed.
+*
+* The transport is the indexer's one SSE connection, wired in the Ponder
+* adapter under `activity.subscribe`. A reactive snapshot is not a product
+* event, so nothing here emits telemetry: the adapter reports a teardown, and
+* the caller re-reads.
+*/
+function subscribeActivity(deps, actor, controls, onChange) {
+	return Effect.gen(function* () {
+		const scope = yield* overlay(deps, actor, controls, {});
+		if (scope.safe === null) return () => {};
+		const page = {
+			safe: scope.safe,
+			limit: INTENT_WINDOW
+		};
+		let delivered = false;
+		const notify = () => {
+			if (delivered) onChange();
+			delivered = true;
+		};
+		return yield* deps.indexer.subscribe("transfer", page, (snapshot) => {
+			if (snapshot.status === "ok") notify();
+		});
+	});
+}
+//#endregion
 //#region ../../packages/sdk/package.json
-var version$1 = "4.2.0-rc.1";
+var version$1 = "4.2.0-rc.11";
 //#endregion
 //#region ../../packages/sdk/src/telemetry/exception-projection.ts
 /** Fixed fallback for failures that have no safe message. */
@@ -12143,6 +12872,22 @@ function observeFailedResult(result, adapter, operation, origin) {
 	return result;
 }
 /**
+* @internal Reports a failure that can never become a method result.
+*
+* A reactive stream is torn down after its call already returned, so nothing
+* downstream observes it. `captureException` is the right kind: the caller did
+* not ask for the end, so it is not an expected product outcome.
+*
+* A caller that DID ask for the end — the session it authenticated with
+* expired, and the service closed the stream on purpose — passes
+* `kind: "operation"` instead, so the refusal lands in the expected-outcome
+* stream its code already declares.
+*/
+function observeStreamFailure(adapter, operation, cause, kind = "exception") {
+	if (adapter === void 0) return;
+	report(adapter, kind, operation, cause, resolveAdapterSnapshot(adapter));
+}
+/**
 * One failure, one event. The identity machine reports a failed transition
 * first; when the same `CapxulError` then surfaces as a public method result
 * (directly or down its `cause` chain), the boundary drops that second report.
@@ -12219,6 +12964,34 @@ function ignoreDeliveryFailure(delivery) {
 		Promise.resolve(delivery).catch(() => void 0);
 	} catch {}
 }
+/**
+* Fold a caller-captured attempt identity into the host's resolved context.
+*
+* The host's `resolveContext` runs at the moment an SDK method is entered, so a
+* host that mints a correlation per resolve gives every operation of one user
+* attempt a different identity — and a user or Organization switch between the
+* click and the reply relabels an action that already started. When the caller
+* captured `correlation_id`/`journey_id` BEFORE the action started, that is the
+* attempt, and it replaces what the resolver returned for this one call. The
+* result is what the SDK span/Log, the failure envelope and the backend carrier
+* all read, so the three agree by construction rather than by convention.
+*
+* A caller that captured nothing gets the resolver's context unchanged, so
+* automatic reads keep their own invocation context.
+*/
+function withCapturedAttemptContext(context, controls) {
+	const correlationId = controls?.correlation_id;
+	const journeyId = controls?.journey_id;
+	if (correlationId === void 0 && journeyId === void 0) return context;
+	const captured = sanitizeObservationContext({
+		...correlationId === void 0 ? {} : { correlationId },
+		...journeyId === void 0 ? {} : { journeyId }
+	});
+	return captured === void 0 ? context : {
+		...context,
+		...captured
+	};
+}
 const MAX_EVIDENCE_TEXT = 4e3;
 const MAX_CAUSE_DEPTH = 8;
 function evidenceText(value) {
@@ -13104,6 +13877,11 @@ function paymentExecutionIntent(input) {
 }
 function makeFinancialOpsMethods(deps) {
 	const fns = deps.functions ?? financialOpsContract;
+	const indexerDeps = deps.indexerRead === void 0 ? void 0 : {
+		indexer: deps.indexerRead,
+		convexCall: deps.convexCall,
+		functions: fns
+	};
 	const executionFns = deps.moneyExecutionFunctions ?? moneyExecutionContract;
 	const requestKeyScope = deps.requestKeyScope ?? randomPaymentRequestKey();
 	const inFlightPersonalPayments = /* @__PURE__ */ new Map();
@@ -13334,22 +14112,26 @@ function makeFinancialOpsMethods(deps) {
 			}
 		},
 		activity: {
+			subscribe: (onChange, params, options) => {
+				const controls = deps.invocationControls?.(options) ?? options;
+				return runPortEffect(captureActivityInput(() => Effect.succeed(activityActorField(params?.actor).actor)).pipe(Effect.flatMap((actor) => indexerDeps === void 0 ? Effect.succeed(() => {}) : Effect.suspend(() => subscribeActivity(indexerDeps, actor, controls, onChange)).pipe(Effect.tap(() => observeActivityScope(actor))))), controls, CAPXUL_OPERATIONS.activity.subscribe, deps.runPromise);
+			},
 			list: (params, options) => {
 				const controls = deps.invocationControls?.(options) ?? options;
-				return runPortEffect(captureActivityInput(() => Effect.succeed(activityActorField(params?.actor).actor)).pipe(Effect.flatMap((actor) => Effect.suspend(() => deps.convexCall.query(fns.activityList, copyInvocationObservation(controls, { input: {
+				return runPortEffect(captureActivityInput(() => Effect.succeed(activityActorField(params?.actor).actor)).pipe(Effect.flatMap((actor) => Effect.suspend(() => indexerDeps === void 0 ? deps.convexCall.query(fns.activityList, copyInvocationObservation(controls, { input: {
 					...actor === void 0 ? {} : { actor },
 					...params?.cursor === void 0 ? {} : { cursor: params.cursor },
 					...params?.limit === void 0 ? {} : { limit: params.limit },
 					...params?.range === void 0 ? {} : { range: params.range },
 					...params?.filter === void 0 ? {} : { filter: params.filter }
-				} }))).pipe(Effect.tap(() => observeActivityScope(actor))))), controls, CAPXUL_OPERATIONS.activity.list, deps.runPromise);
+				} })) : readActivityPage(indexerDeps, actor, controls, params)).pipe(Effect.tap(() => observeActivityScope(actor))))), controls, CAPXUL_OPERATIONS.activity.list, deps.runPromise);
 			},
 			summary: (params, options) => {
 				const controls = deps.invocationControls?.(options) ?? options;
-				return runPortEffect(captureActivityInput(() => Effect.succeed(activityActorField(params?.actor).actor)).pipe(Effect.flatMap((actor) => Effect.suspend(() => deps.convexCall.query(fns.activitySummary, copyInvocationObservation(controls, { input: {
+				return runPortEffect(captureActivityInput(() => Effect.succeed(activityActorField(params?.actor).actor)).pipe(Effect.flatMap((actor) => Effect.suspend(() => indexerDeps === void 0 ? deps.convexCall.query(fns.activitySummary, copyInvocationObservation(controls, { input: {
 					...actor === void 0 ? {} : { actor },
 					...params?.window === void 0 ? {} : { window: params.window }
-				} }))).pipe(Effect.tap(() => observeActivityScope(actor))))), controls, CAPXUL_OPERATIONS.activity.summary, deps.runPromise);
+				} })) : readActivitySummary(indexerDeps, actor, controls, params)).pipe(Effect.tap(() => observeActivityScope(actor))))), controls, CAPXUL_OPERATIONS.activity.summary, deps.runPromise);
 			},
 			get: (reference, options) => {
 				const controls = deps.invocationControls?.(options) ?? options;
@@ -14445,7 +15227,8 @@ var BetterAuthBrowserAdapter = class {
 		try {
 			const res = await this.fetchImpl(this.url("/api/auth/get-session"), withSignal$1({
 				method: "GET",
-				credentials: "include"
+				credentials: "include",
+				cache: "no-store"
 			}, options?.signal));
 			if (options?.signal?.aborted) return {
 				ok: false,
@@ -14517,7 +15300,8 @@ var BetterAuthBrowserAdapter = class {
 		try {
 			const res = await this.fetchImpl(this.url("/api/auth/convex/token"), withSignal$1({
 				method: "GET",
-				credentials: "include"
+				credentials: "include",
+				cache: "no-store"
 			}, options?.signal));
 			if (options?.signal?.aborted) return {
 				ok: false,
@@ -15030,7 +15814,7 @@ function isTransientBootstrapFailure(error) {
 	const status = error.details?.httpStatus;
 	return typeof status === "number" && isTransientHttpStatus(status);
 }
-async function safeText(res) {
+async function safeText$1(res) {
 	try {
 		return await res.text();
 	} catch {
@@ -15103,6 +15887,8 @@ var HttpBootstrapAdapter = class {
 					siteBaseUrl: normalizeRuntimeUrl("siteBaseUrl", decodedState.siteBaseUrl),
 					openfortPublishableKey: decodedState.openfortPublishableKey,
 					shieldPublishableKey: decodedState.shieldPublishableKey,
+					...decodedState.openfortAuthProvider === void 0 ? {} : { openfortAuthProvider: decodedState.openfortAuthProvider },
+					...decodedState.indexerUrl === void 0 ? {} : { indexerUrl: decodedState.indexerUrl },
 					...decodedEngineeringTelemetry !== void 0 && Result.isSuccess(decodedEngineeringTelemetry) ? { engineeringTelemetry: decodedEngineeringTelemetry.success } : {}
 				};
 			},
@@ -15111,7 +15897,7 @@ var HttpBootstrapAdapter = class {
 				return bootstrapErrorFromCapxul("malformedBody", Errors.providerError("convex", "bootstrap", cause instanceof Error ? cause : new Error(String(cause))));
 			}
 		});
-		return Effect.promise(() => safeText(res)).pipe(Effect.flatMap((body) => {
+		return Effect.promise(() => safeText$1(res)).pipe(Effect.flatMap((body) => {
 			if (res.status === 401 || body.startsWith("NOT_AUTHENTICATED")) return Effect.fail(bootstrapErrorFromCapxul("notAuthenticated", Errors.notAuthenticated()));
 			if (res.status === 400 || body.startsWith("INVALID_INPUT")) return Effect.fail(bootstrapErrorFromCapxul("invalidInput", Errors.invalidInput("publishableKey", "rejected by bootstrap")));
 			const responseBody = body.slice(0, 300);
@@ -18294,6 +19080,12 @@ function makeConnectionId() {
 }
 //#endregion
 //#region ../../packages/sdk/src/adapters/convex-call/ConvexCallAdapter.ts
+/**
+* A socket that has not emitted `close` within this window is not going to.
+* ponytail: one fixed bound; `closeTimeoutMs` is the knob if a slow runtime
+* ever needs a different one.
+*/
+const DEFAULT_CLOSE_TIMEOUT_MS = 5e3;
 /** Exact floor-first allowlist; every additional handler must migrate its validator first. */
 const OBSERVED_CONVEX_ACTIONS = /* @__PURE__ */ new Set([
 	"payroll/actions:authorizeRun",
@@ -18306,6 +19098,9 @@ const OBSERVED_CONVEX_ACTIONS = /* @__PURE__ */ new Set([
 	"org/actions:resumeBootstrapSubmission",
 	"org/actions:confirmBootstrap",
 	"org/actions:readTreasury",
+	"moneyExecution/actions:preparePermissionExecution",
+	"moneyExecution/actions:submitPermissionExecution",
+	"permission/actions:verify",
 	"moneyExecution/actions:preparePaymentExecution",
 	"moneyExecution/actions:abandonPaymentExecution",
 	"moneyExecution/actions:submitPaymentExecution",
@@ -18330,6 +19125,9 @@ const OBSERVED_CONVEX_QUERIES = /* @__PURE__ */ new Set([
 	"payroll/queries:groups",
 	"payroll/queries:terms",
 	"financialOps/queries:resolveRecipient",
+	"org/queries:me",
+	"permission/queries:read",
+	"permission/queries:authorize",
 	"identity/queries:loadByAuthUserId",
 	"smartAccount/queries:loadByAuthUserId",
 	"org/lifecycle:load"
@@ -18348,6 +19146,7 @@ const OBSERVED_CONVEX_MUTATIONS = /* @__PURE__ */ new Set([
 	"financialOps/requestsInbox:decline",
 	"payroll/mutations:saveGroup",
 	"payroll/mutations:removeGroup",
+	"permission/mutations:command",
 	"identity/mutations:create",
 	"identity/mutations:update",
 	"identity/mutations:completeOnboarding",
@@ -18362,7 +19161,9 @@ var ConvexCallAdapter = class {
 	#applicationId;
 	#observation;
 	#connectionMonitor;
+	#closeTimeoutMs;
 	constructor(deps) {
+		this.#closeTimeoutMs = deps.closeTimeoutMs ?? DEFAULT_CLOSE_TIMEOUT_MS;
 		this.#connectionMonitor = new ConvexConnectionMonitor();
 		const webSocketConstructor = this.#connectionMonitor.observedWebSocketConstructor();
 		this.#client = deps.client ?? new ConvexClient(deps.convexUrl, webSocketConstructor === void 0 ? {} : { webSocketConstructor });
@@ -18461,11 +19262,33 @@ var ConvexCallAdapter = class {
 			callback({ status: "loading" });
 		})));
 	}
+	/**
+	* Teardown always completes. `ConvexClient.close()` resolves only when the
+	* socket emits `close`, and `WebSocketManager.close()` in the `connecting`
+	* state arms `ws.onopen = () => ws.close()` without ever closing the socket
+	* itself — so a handshake that stalls right after a server-initiated close
+	* (code 1012, which is what a Convex deploy sends) leaves that promise
+	* pending for as long as the page lives. Convex marks the client closed and
+	* terminates the socket manager synchronously before returning it, so
+	* abandoning it drops nothing. A rejection is dropped for the same reason —
+	* the layer release turns it into a defect that fails the whole scope close,
+	* and teardown has no caller who can act on it.
+	*/
 	async close() {
 		this.#connectionMonitor.close();
-		await this.#client.close();
+		await settledWithin(this.#client.close(), this.#closeTimeoutMs);
 	}
 };
+function settledWithin(promise, timeoutMs) {
+	return new Promise((resolve) => {
+		const timer = setTimeout(resolve, timeoutMs);
+		const finish = () => {
+			clearTimeout(timer);
+			resolve();
+		};
+		promise.then(finish, finish);
+	});
+}
 function ConvexCallLayer(deps) {
 	return Layer.effect(ConvexCallPortTag, Effect.acquireRelease(Effect.sync(() => new ConvexCallAdapter(deps)), (adapter) => Effect.promise(() => adapter.close()).pipe(Effect.orDie)));
 }
@@ -19418,6 +20241,32 @@ var ConsoleDiagnosticAdapter = class {
 	}
 };
 //#endregion
+//#region ../../packages/sdk/src/adapters/diagnostic/EffectLogDiagnosticAdapter.ts
+/**
+* Diagnostic breadcrumbs as SDK log records. The signer's readiness cycle
+* traces (`openfort.*`) used to reach only the browser console; through this
+* adapter they run in the client's own Effect context, so the engineering
+* telemetry layer ships them to PostHog Logs beside `identity.transition`.
+* Logging never throws back into the cycle that emitted it.
+*/
+var EffectLogDiagnosticAdapter = class {
+	#runPromise;
+	#console;
+	constructor(context, consoleFallback) {
+		this.#runPromise = Effect.runPromiseWith(context);
+		this.#console = consoleFallback;
+	}
+	trace(scope, detail) {
+		this.#console?.trace(scope, detail);
+		try {
+			this.#runPromise(Effect.logInfo(scope).pipe(Effect.annotateLogs({
+				...detail,
+				diagnostic_scope: scope
+			}), Effect.catchCause(() => Effect.void))).catch(() => void 0);
+		} catch {}
+	}
+};
+//#endregion
 //#region ../../node_modules/.pnpm/axios@1.17.0/node_modules/axios/lib/helpers/bind.js
 /**
 * Create a bound version of a function with a specified `this` context
@@ -42496,15 +43345,35 @@ function createOpenfortBrowserSignerFromBootstrap(bootstrap, options = {}) {
 		});
 		throw failOpenfort("configure", "no-secure-context", /* @__PURE__ */ new Error("Web Crypto unavailable: browser is not a secure context"));
 	}
-	function betterAuthSessionUrl() {
-		return `${authBaseUrl}/get-session`;
+	const authProvider = bootstrap.openfortAuthProvider ?? "better-auth";
+	function accessTokenUrl() {
+		return authProvider === "oidc" ? `${authBaseUrl}/convex/token` : `${authBaseUrl}/get-session`;
 	}
 	function encryptionSessionUrl() {
 		return `${authBaseUrl}/encryption-session`;
 	}
+	let cycleStartedAt = null;
+	let stepStartedAt = 0;
+	let tokenCalls = 0;
+	const sinceCycleStart = () => cycleStartedAt === null ? void 0 : Date.now() - cycleStartedAt;
+	const step = (name, extra = {}) => {
+		const now = Date.now();
+		diagnostic?.trace("openfort.step", {
+			step: name,
+			duration_ms: now - stepStartedAt,
+			elapsed_ms: sinceCycleStart(),
+			...extra
+		});
+		stepStartedAt = now;
+	};
 	async function fetchBetterAuthAccessToken() {
+		tokenCalls += 1;
+		const tokenStartedAt = Date.now();
 		try {
-			const response = await fetch(betterAuthSessionUrl(), { credentials: "include" });
+			const response = await fetch(accessTokenUrl(), {
+				credentials: "include",
+				cache: "no-store"
+			});
 			if (!response.ok) {
 				diagnostic?.trace("openfort.token", {
 					ok: false,
@@ -42514,7 +43383,8 @@ function createOpenfortBrowserSignerFromBootstrap(bootstrap, options = {}) {
 				});
 				return null;
 			}
-			const token = (await response.json()).session?.token?.trim();
+			const body = await response.json();
+			const token = (authProvider === "oidc" ? body.token : body.session?.token)?.trim();
 			if (token === void 0 || token.length === 0) {
 				diagnostic?.trace("openfort.token", {
 					ok: false,
@@ -42525,7 +43395,11 @@ function createOpenfortBrowserSignerFromBootstrap(bootstrap, options = {}) {
 			}
 			diagnostic?.trace("openfort.token", {
 				ok: true,
-				tokenPresent: true
+				tokenPresent: true,
+				provider: authProvider,
+				call: tokenCalls,
+				duration_ms: Date.now() - tokenStartedAt,
+				elapsed_ms: sinceCycleStart()
 			});
 			return token;
 		} catch (cause) {
@@ -42541,7 +43415,7 @@ function createOpenfortBrowserSignerFromBootstrap(bootstrap, options = {}) {
 		baseConfiguration: { publishableKey: bootstrap.openfortPublishableKey },
 		shieldConfiguration: { shieldPublishableKey: bootstrap.shieldPublishableKey },
 		thirdPartyAuth: {
-			provider: o$13.BETTER_AUTH,
+			provider: authProvider === "oidc" ? o$13.OIDC : o$13.BETTER_AUTH,
 			getAccessToken: fetchBetterAuthAccessToken
 		}
 	});
@@ -42581,10 +43455,16 @@ function createOpenfortBrowserSignerFromBootstrap(bootstrap, options = {}) {
 	let walletReadyPromise = null;
 	function startWalletReady() {
 		return (async () => {
+			const startedAt = Date.now();
+			cycleStartedAt = startedAt;
+			stepStartedAt = startedAt;
+			tokenCalls = 0;
 			if (isInsecureBrowserContext()) failNoSecureContext();
 			await openfort.waitForInitialization();
+			step("initialize");
 			const accessToken = await fetchBetterAuthAccessToken();
 			if (accessToken === null) throw openfortProviderError("token", /* @__PURE__ */ new Error("Better Auth access token unavailable for Openfort"));
+			step("token");
 			let encryptionResponse;
 			try {
 				encryptionResponse = await fetch(encryptionSessionUrl(), {
@@ -42627,10 +43507,12 @@ function createOpenfortBrowserSignerFromBootstrap(bootstrap, options = {}) {
 				ok: true,
 				httpStatus: encryptionResponse.status
 			});
+			step("encryptionSession", { httpStatus: encryptionResponse.status });
 			let embeddedState;
 			try {
 				embeddedState = await openfort.embeddedWallet.getEmbeddedState();
 				diagnostic?.trace("openfort.embeddedState", { state: embeddedState });
+				step("embeddedState", { state: embeddedState });
 			} catch (cause) {
 				diagnostic?.trace("openfort.embeddedState", {
 					ok: false,
@@ -42644,6 +43526,7 @@ function createOpenfortBrowserSignerFromBootstrap(bootstrap, options = {}) {
 				try {
 					await configureEmbeddedWallet(encryptionBody.sessionId);
 					diagnostic?.trace("openfort.configure", { ok: true });
+					step("configure");
 				} catch (cause) {
 					const error = openfortProviderError("configure", cause);
 					diagnostic?.trace("openfort.configure", {
@@ -42656,6 +43539,7 @@ function createOpenfortBrowserSignerFromBootstrap(bootstrap, options = {}) {
 			try {
 				await openfort.embeddedWallet.get();
 				diagnostic?.trace("openfort.get", { ok: true });
+				step("get");
 			} catch (cause) {
 				if (!isStaleUserSignal(cause)) {
 					diagnostic?.trace("openfort.get", {
@@ -42669,7 +43553,13 @@ function createOpenfortBrowserSignerFromBootstrap(bootstrap, options = {}) {
 					failure_mode: "stale-openfort-cache"
 				});
 				await healStaleOpenfortCache(encryptionBody.sessionId);
+				step("healStaleCache");
 			}
+			step("walletReady", {
+				ok: true,
+				total_ms: Date.now() - startedAt,
+				token_calls: tokenCalls
+			});
 		})();
 	}
 	async function ensureOpenfortWalletReady() {
@@ -42752,9 +43642,13 @@ function createOpenfortBrowserSignerFromBootstrap(bootstrap, options = {}) {
 		statusStore,
 		ensureWalletReady: ensureOpenfortWalletReady,
 		getAddress: async () => {
+			const addressStartedAt = Date.now();
 			try {
 				const address = await signer.getAddress();
-				diagnostic?.trace("openfort.address", { ok: true });
+				diagnostic?.trace("openfort.address", {
+					ok: true,
+					duration_ms: Date.now() - addressStartedAt
+				});
 				return address;
 			} catch (cause) {
 				diagnostic?.trace("openfort.address", {
@@ -43856,14 +44750,66 @@ function organizationWrongState(currentState, validStates) {
 function requestCancelled(options) {
 	return options?.signal?.aborted === true;
 }
+function accountInFlight(state) {
+	return state.phase === "authenticated" && (state.account.at === "deriving" || state.account.at === "claiming");
+}
+function settledAccount(deps, options) {
+	return new Promise((resolve) => {
+		let done = false;
+		let unsubscribe = null;
+		const onAbort = () => finish({
+			ok: false,
+			error: Errors.cancelled({ operation: CAPXUL_OPERATIONS.onboarding.completeOrganization })
+		});
+		const finish = (result) => {
+			if (done) return;
+			done = true;
+			unsubscribe?.();
+			options?.signal?.removeEventListener("abort", onAbort);
+			resolve(result);
+		};
+		if (options?.signal?.aborted) {
+			onAbort();
+			return;
+		}
+		options?.signal?.addEventListener("abort", onAbort, { once: true });
+		const stop = deps.subscribeIdentity((state) => {
+			if (!accountInFlight(state)) finish({
+				ok: true,
+				value: state
+			});
+		});
+		if (done) {
+			stop();
+			return;
+		}
+		unsubscribe = stop;
+		const current = deps.snapshotIdentity();
+		if (!accountInFlight(current)) finish({
+			ok: true,
+			value: current
+		});
+	});
+}
 async function reachClaimedAccount(deps, options) {
 	let state = deps.snapshotIdentity();
+	if (accountInFlight(state)) {
+		const settled = await settledAccount(deps, options);
+		if (!settled.ok) return settled;
+		state = settled.value;
+	}
 	if (state.phase !== "authenticated" || state.account.at === "unknown") {
 		const ensured = await deps.sendIdentity({ _tag: "EnsureAccount" }, options);
 		if (!ensured.ok) return ensured;
 		state = ensured.value;
 	}
 	if (state.phase !== "authenticated") return organizationWrongState(state.phase, ["authenticated:claimed"]);
+	if (accountInFlight(state)) {
+		const settled = await settledAccount(deps, options);
+		if (!settled.ok) return settled;
+		state = settled.value;
+		if (state.phase !== "authenticated") return organizationWrongState(state.phase, ["authenticated:claimed"]);
+	}
 	if (state.account.at !== "claimed") {
 		const event = state.account.at === "failed" ? { _tag: "RetryAccount" } : state.account.at === "counterfactual" ? { _tag: "ClaimAccount" } : { _tag: "EnsureAccount" };
 		const claimed = await deps.sendIdentity(event, options);
@@ -44204,8 +45150,33 @@ function toOrgMe(wire) {
 		observedAt: wire.observedAt
 	};
 }
+/**
+* The read runs through the canonical observed runner, so `org.me` owns one
+* `capxul_sdk_operation` record and one span like every other public method.
+*
+* The call-start invocation snapshot travels on the query arguments: the
+* Convex adapter reads it there and sends the browser linkage with the call,
+* so an account switch mid-flight cannot re-resolve the actor. A successful
+* read proves participation in this Organization, so the owning span carries
+* the verified Organization and the two authority booleans the backend
+* actually enforces. Labels and Budget caps stay off the record.
+*/
 function makeOrgMeMethod(deps, orgId) {
-	return (options) => runIfActive(options?.signal, CAPXUL_OPERATIONS.org.me, () => Effect.map(deps.convexCall.query(orgReadContract.me, { orgId }), toOrgMe));
+	return (options) => {
+		const controls = deps.invocationControls?.(options) ?? options;
+		return runCapxulEffect(Effect.gen(function* () {
+			const wire = yield* deps.convexCall.query(orgReadContract.me, copyInvocationObservation(controls, { orgId })).pipe(Effect.mapError((failure) => failure.publicError));
+			yield* Effect.annotateCurrentSpan({
+				verified_organization_id: orgId,
+				scope_kind: "organization",
+				can_manage_people: wire.capabilities.canManagePeople,
+				can_spend: wire.capabilities.canSpend,
+				budget_count: wire.budgets.length,
+				observed_at: wire.observedAt
+			}).pipe(Effect.catchCause(() => Effect.void));
+			return toOrgMe(wire);
+		}), controls, CAPXUL_OPERATIONS.org.me, deps.runPromise);
+	};
 }
 //#endregion
 //#region ../../packages/sdk/src/contract/permission.ts
@@ -44215,7 +45186,34 @@ const permissionContract = { read: makeFunctionReference(CAPXUL_FUNCTIONS["permi
 function isAborted(signal) {
 	return signal?.aborted === true;
 }
-async function execute(deps, orgId, command, signal) {
+/**
+* One owning operation per public Permission method. The compound command
+* (prepare, equality checks, sign, submit) keeps owning its own cancellation;
+* the observed runner around it is what gives the attempt its
+* `capxul_sdk_operation` record, its span and its failure capture, so a signer
+* refusal or an unexpected provider error joins to the operation like every
+* other public surface.
+*/
+function observed(deps, operation, options, run) {
+	const controls = deps.invocationControls?.(options) ?? options;
+	let verifiedOrganizationId;
+	return runCapxulEffect(Effect.gen(function* () {
+		if (controls?.signal?.aborted === true) return yield* Effect.fail(Errors.cancelled({ operation }));
+		const parent = yield* Effect.currentSpan.pipe(Effect.orDie);
+		const captured = carryInvocationParentSpan(controls, parent);
+		const result = yield* Effect.tryPromise({
+			try: () => run(controls?.signal, captured, (orgId) => {
+				verifiedOrganizationId = orgId;
+			}),
+			catch: (cause) => cause instanceof CapxulError ? cause : Errors.unknown(cause)
+		});
+		return yield* result.ok ? Effect.succeed(result.value) : Effect.fail(result.error);
+	}).pipe(Effect.ensuring(Effect.suspend(() => verifiedOrganizationId === void 0 ? Effect.void : Effect.annotateCurrentSpan({
+		verified_organization_id: verifiedOrganizationId,
+		scope_kind: "organization"
+	})).pipe(Effect.catchCause(() => Effect.void)))), observationOnlyControls(controls), operation, deps.runPromise);
+}
+async function execute(deps, orgId, command, signal, controls, verifiedOrganization) {
 	if (isAborted(signal)) return {
 		ok: false,
 		error: Errors.cancelled({ operation: "permissions" })
@@ -44239,17 +45237,18 @@ async function execute(deps, orgId, command, signal) {
 		};
 	}
 	const executionFns = deps.executionFunctions ?? moneyExecutionContract;
-	const prepared = await runIfActive(signal, CAPXUL_OPERATIONS.permissions.prepareExecution, () => deps.convexCall.action(executionFns.preparePermissionExecution, { input: {
+	const prepared = await runIfActive(signal, CAPXUL_OPERATIONS.permissions.prepareExecution, () => withInvocationParentSpan(Effect.suspend(() => deps.convexCall.action(executionFns.preparePermissionExecution, copyInvocationObservation(controls, { input: {
 		orgId,
 		signerAddress,
 		command
-	} }));
+	} }))), controls), deps.runPromise);
 	if (!prepared.ok) return prepared;
 	const expectedSafe = deriveCapxulSafeAddress({ email: session.email });
 	if (prepared.value.chainId !== deps.chainId || prepared.value.signerAddress.toLowerCase() !== signerAddress.toLowerCase() || prepared.value.userOpSenderSafe.toLowerCase() !== expectedSafe.toLowerCase() || prepared.value.operation !== command.operation || prepared.value.orgId !== orgId || canonicalJson(prepared.value.command) !== canonicalJson(command)) return {
 		ok: false,
 		error: Errors.invalidInput("permission", "prepared authority mismatch")
 	};
+	verifiedOrganization(prepared.value.orgId);
 	if (isAborted(signal)) return {
 		ok: false,
 		error: Errors.cancelled({ operation: "permissions" })
@@ -44267,43 +45266,46 @@ async function execute(deps, orgId, command, signal) {
 		ok: false,
 		error: Errors.cancelled({ operation: "permissions" })
 	};
-	return runIfActive(void 0, CAPXUL_OPERATIONS.permissions.submitExecution, () => deps.convexCall.action(executionFns.submitPermissionExecution, { input: {
+	return runIfActive(void 0, CAPXUL_OPERATIONS.permissions.submitExecution, () => withInvocationParentSpan(Effect.suspend(() => deps.convexCall.action(executionFns.submitPermissionExecution, copyInvocationObservation(controls, { input: {
 		executionId: prepared.value.executionId,
 		signature
-	} }));
+	} }))), controls), deps.runPromise);
 }
 function makePermissionMethods(deps, orgId) {
 	const reads = deps.permissionFunctions ?? permissionContract;
+	const ops = CAPXUL_OPERATIONS.org.permissions;
+	const read = (signal, operation, controls) => runIfActive(signal, operation, () => withInvocationParentSpan(Effect.suspend(() => deps.convexCall.query(reads.read, copyInvocationObservation(controls, { orgId }))), controls), deps.runPromise);
+	const command = (operation, build, options) => observed(deps, operation, options, (signal, captured, verifiedOrganization) => execute(deps, orgId, build(), signal, captured, verifiedOrganization));
 	return {
-		create: (input, options) => execute(deps, orgId, {
+		create: (input, options) => command(ops.create, () => ({
 			operation: "create",
 			...input
-		}, options?.signal),
-		change: (input, options) => execute(deps, orgId, {
+		}), options),
+		change: (input, options) => command(ops.change, () => ({
 			operation: "change",
 			...input
-		}, options?.signal),
-		assign: (input, options) => execute(deps, orgId, {
+		}), options),
+		assign: (input, options) => command(ops.assign, () => ({
 			operation: "assign",
 			...input
-		}, options?.signal),
-		revoke: (input, options) => execute(deps, orgId, {
+		}), options),
+		revoke: (input, options) => command(ops.revoke, () => ({
 			operation: "revoke",
 			...input
-		}, options?.signal),
-		replace: (input, options) => execute(deps, orgId, {
+		}), options),
+		replace: (input, options) => command(ops.replace, () => ({
 			operation: "replace",
 			...input
-		}, options?.signal),
-		list: (options) => runIfActive(options?.signal, CAPXUL_OPERATIONS.permissions.list, () => deps.convexCall.query(reads.read, { orgId })),
-		get: async (permissionId, options) => {
-			const listed = await runIfActive(options?.signal, CAPXUL_OPERATIONS.permissions.get, () => deps.convexCall.query(reads.read, { orgId }));
+		}), options),
+		list: (options) => observed(deps, ops.list, options, (signal, captured) => read(signal, CAPXUL_OPERATIONS.permissions.list, captured)),
+		get: (permissionId, options) => observed(deps, ops.get, options, async (signal, captured) => {
+			const listed = await read(signal, CAPXUL_OPERATIONS.permissions.get, captured);
 			if (!listed.ok) return listed;
 			return {
 				ok: true,
 				value: listed.value.permissions.find((row) => row.permissionId === permissionId) ?? null
 			};
-		}
+		})
 	};
 }
 //#endregion
@@ -44865,7 +45867,7 @@ function hermeticOrgView(input) {
 		name: input.name,
 		handle: input.handle,
 		safeAddress: toAddress(placeholder),
-		role: "Owner",
+		role: ADMIN_ROLE_LABEL,
 		treasury: zeroTreasury(orgId),
 		bio: null,
 		size: null,
@@ -45111,6 +46113,13 @@ function isRetryableOrganizationSetupFailure(error) {
 * constructed for each `org(orgId)` call. It has no shared mutable active-Org
 * state. The closed-over `orgId` is its only entity reference.
 */
+/** The observed-runner pair a method bundle needs to own its operation records. */
+function observedRunnerDeps(deps) {
+	return {
+		...deps.runPromise === void 0 ? {} : { runPromise: deps.runPromise },
+		...deps.invocationControls === void 0 ? {} : { invocationControls: deps.invocationControls }
+	};
+}
 function makeOrgMethods(deps) {
 	const orgDeps = {
 		...deps.orgPort === void 0 ? {} : { orgPort: deps.orgPort },
@@ -45161,7 +46170,10 @@ function makeOrgMethods(deps) {
 					},
 					...convexCall === void 0 ? {} : { convexCall }
 				}),
-				me: convexCall === void 0 ? orgMeUnavailable : makeOrgMeMethod({ convexCall }, String(orgId)),
+				me: convexCall === void 0 ? orgMeUnavailable : makeOrgMeMethod({
+					convexCall,
+					...observedRunnerDeps(deps)
+				}, String(orgId)),
 				async getLifecycle(options) {
 					if (options?.signal?.aborted) return {
 						ok: false,
@@ -45278,6 +46290,7 @@ function makeOrgMethods(deps) {
 				},
 				permissions: convexCall === void 0 ? makeNotImplementedPermissionMethods() : makePermissionMethods({
 					convexCall,
+					...observedRunnerDeps(deps),
 					...deps.actor === void 0 ? {} : { actor: deps.actor },
 					...deps.chainId === void 0 ? {} : { chainId: Number(deps.chainId) },
 					...deps.signer === void 0 ? {} : { signer: deps.signer }
@@ -45397,14 +46410,65 @@ function compareDecimal(first, second) {
 }
 //#endregion
 //#region ../../packages/sdk/src/surface/holdings.ts
+/** SPEC Freshness: past this block age the read is labelled stale. Nothing refuses. */
+const FRESHNESS_LIMIT_SECONDS = 60;
+/**
+* The Ponder balance view for one Safe as `CurrentHoldings`.
+*
+* The view is the signed sum of every indexed transfer, so the balance IS what
+* the chain said — there is no snapshot to go stale behind it. `observedAt` is
+* the indexed block's own timestamp, which is what the last-good label reads,
+* and `stale` is that block's age. A stopped indexer therefore shows an old
+* "as of" and the stale flag; it never turns the read into a refusal.
+*/
+function indexerHoldings(indexer, convexCall, overlay, actor, controls) {
+	return Effect.gen(function* () {
+		const scope = yield* convexCall.query(overlay, copyInvocationObservation(controls, actor?.kind === "organization" ? { input: { actor: {
+			kind: "organization",
+			orgId: actor.organizationId
+		} } } : { input: {} }));
+		if (scope.safe === null) return null;
+		const balances = yield* indexer.read("balance", {
+			safe: toAddress(scope.safe),
+			limit: INDEXER_MAX_LIMIT
+		});
+		const status = yield* indexer.status.pipe(Effect.catch(() => Effect.succeed([])));
+		const rows = [];
+		for (const balance of balances) {
+			const asset = configuredMoneyAssetById(balance.assetId);
+			if (asset === null || balance.amount < 0n) continue;
+			rows.push({
+				assetKind: "erc20",
+				tokenAddress: toAddress(asset.tokenAddress),
+				symbol: asset.symbol,
+				decimals: asset.decimals,
+				rawBalance: toWeiAmount(balance.amount.toString())
+			});
+		}
+		const chainId = balances[0]?.chainId ?? status[0]?.chainId;
+		if (chainId === void 0) return null;
+		const head = status.find((entry) => entry.chainId === chainId);
+		const nowSeconds = Math.floor(Date.now() / 1e3);
+		const headSeconds = head === void 0 ? void 0 : Number(head.blockTimestamp);
+		return {
+			actor: scope.actor,
+			chainId: toChainId(chainId),
+			observedAt: headSeconds === void 0 ? Date.now() : headSeconds * 1e3,
+			stale: headSeconds === void 0 || nowSeconds - headSeconds > FRESHNESS_LIMIT_SECONDS,
+			rows
+		};
+	}).pipe(Effect.catch(() => Effect.succeed(null)));
+}
 function makeHoldingsMethods(deps) {
 	const functions = deps.functions ?? holdingsContract;
+	const overlay = (deps.financialOpsFunctions ?? financialOpsContract).activityOverlay;
 	const read = (operation, actor, options, pick) => {
 		const controls = deps.invocationControls?.(options) ?? options;
-		return runCapxulEffect(retryIdempotentRead(deps.convexCall.action(functions.current, copyInvocationObservation(controls, actor?.kind === "organization" ? { actor: {
+		const convexSnapshot = retryIdempotentRead(deps.convexCall.action(functions.current, copyInvocationObservation(controls, actor?.kind === "organization" ? { actor: {
 			kind: "organization",
 			orgId: actor.organizationId
-		} } : {})), operation, deps.telemetry, controls).pipe(Effect.map(pick), Effect.mapError((error) => error.publicError)), controls, operation, deps.runPromise);
+		} } : {})), operation, deps.telemetry, controls).pipe(Effect.mapError((error) => error.publicError));
+		return runCapxulEffect((deps.indexerRead === void 0 ? convexSnapshot : indexerHoldings(deps.indexerRead, deps.convexCall, overlay, actor, controls).pipe(Effect.flatMap((current) => current === null ? convexSnapshot : Effect.succeed(current)))).pipe(Effect.map(pick)), controls, operation, deps.runPromise);
 	};
 	return {
 		current: (input, options) => read(CAPXUL_OPERATIONS.holdings.current, input?.actor, options, (snapshot) => snapshot),
@@ -45538,8 +46602,8 @@ const APPLIED_ACTION_BY_EVENT = {
 	RestoreSession: "none",
 	ResumeOtpEntry: "none",
 	Reset: "none",
-	SessionRestored: "none",
-	SessionAbsent: "none",
+	SessionRestored: "restoration",
+	SessionAbsent: "restoration",
 	EnsureAccount: "none",
 	ClaimAccount: "none",
 	RetryAccount: "none",
@@ -45551,8 +46615,8 @@ const APPLIED_ACTION_BY_EVENT = {
 	OtpFailed: "failed",
 	Verified: "verified",
 	VerifyFailed: "failed",
-	SessionRead: "none",
-	SessionReadFailed: "none",
+	SessionRead: "restoration",
+	SessionReadFailed: "restoration",
 	SignedOut: "signed-out",
 	SignOutFailed: "failed",
 	AccountAt: "none",
@@ -45578,11 +46642,71 @@ const authFailure = (record, reason, mode) => ({
 		...linkage(record)
 	}
 });
+/**
+* The label of the restore window every client boots into. A settled session
+* fact that left this label is the restoration result (#1962 R04); the same
+* facts from a signed-out or authenticated state are the routine session probe
+* that `getSession()` runs, and a probe is not a restoration attempt.
+*/
+const RESTORE_WINDOW = "restoring";
+/**
+* Which result the window settled on. `SessionRestored` and `SessionAbsent` are
+* the cache door and say it themselves. `ReadSession` is also valid inside the
+* window — `getSession()` drives it on a cache miss and its `SessionRead`
+* completion settles the window — so that one event reports both halves and the
+* state it produced is what separates them.
+*/
+const restorationOutcome = (event, state) => {
+	switch (event) {
+		case "SessionRestored": return "restored";
+		case "SessionAbsent": return "absent";
+		case "SessionReadFailed": return "failed";
+		case "SessionRead":
+			if (state.phase === "authenticated") return "restored";
+			return state.phase === "signed_out" ? "absent" : void 0;
+		default: return;
+	}
+};
+/**
+* The restore window's one result, or nothing when this settled session fact
+* belongs to a probe rather than to the window.
+*/
+const restorationObservation = (record, state) => {
+	if (record.slot !== "identity:session" || record.from !== RESTORE_WINDOW) return NONE;
+	const outcome = restorationOutcome(record.event, state);
+	if (outcome === void 0) return NONE;
+	return {
+		name: "access_recovery_completed",
+		props: {
+			recovery: "session_restoration",
+			outcome,
+			...outcome === "failed" && state.phase === "faulted" ? { reason_code: state.failure.code } : {},
+			...linkage(record)
+		}
+	};
+};
+const REFUSAL_EVENTS = /* @__PURE__ */ new Set([
+	"ClaimAccount",
+	"RetryAccount",
+	"CreateOrganization",
+	"AttachOrganization",
+	"RetryOrganization"
+]);
 function mapIdentityProductObservation(record, state) {
 	if (record.machine !== "identity" || !IDENTITY_EVENT_TAG_SET.has(record.event)) return NONE;
 	if (record.outcome === "cancelled") return NONE;
 	if (record.slot === "identity:auth" && record.outcome === "refused") return authFailure(record, record.refusal_code, void 0);
 	if (record.slot === "identity:auth" && record.outcome === "failed") return authFailure(record, record.error_code, record.failure?.mode);
+	if (record.outcome === "refused" && REFUSAL_EVENTS.has(record.event)) return {
+		name: "identity_refused",
+		props: {
+			event: record.event,
+			refusal_code: record.refusal_code,
+			slot: record.slot,
+			state: record.state,
+			...linkage(record)
+		}
+	};
 	if (record.outcome !== "applied") return NONE;
 	switch (APPLIED_ACTION_BY_EVENT[record.event]) {
 		case "none": return NONE;
@@ -45605,6 +46729,7 @@ function mapIdentityProductObservation(record, state) {
 			name: "auth_signed_out",
 			props: linkage(record)
 		};
+		case "restoration": return restorationObservation(record, state);
 	}
 }
 const ignoreTransportFailure = (operation, operationName, eventName) => Effect.suspend(operation).pipe(Effect.catchCause(() => Effect.logWarning("identity.product.telemetry.dropped").pipe(Effect.annotateLogs({
@@ -45616,7 +46741,7 @@ function executeIdentityProductObservation(telemetry, record, state) {
 	if (mapped === null) return Effect.void;
 	copyInvocationObservation(record, mapped);
 	const invocationTelemetry = bindProductTelemetryInvocation(telemetry, mapped);
-	const after = () => mapped.name === "auth_verified" && state.phase === "authenticated" ? invocationTelemetry.identify({
+	const after = () => state.phase === "authenticated" && (mapped.name === "auth_verified" || mapped.name === "access_recovery_completed") ? invocationTelemetry.identify({
 		distinctId: state.session.authUserId,
 		traits: { email_domain: emailDomain(state.session.email) }
 	}) : mapped.name === "auth_signed_out" ? invocationTelemetry.reset() : Effect.void;
@@ -45661,6 +46786,51 @@ function startSignerReadinessOnClaim(actor, signer) {
 		browserSigner.ensureWalletReady?.().catch(() => {});
 	});
 }
+/**
+* Report the result of each signer readiness cycle (#1962 R04).
+*
+* The readiness store already carries the cycle boundary this needs, so no
+* public signer hook, second identity subscriber, or render counter is added.
+* `ensureOpenfortWalletReady` writes `recovering` synchronously when it starts
+* a cycle, and only the cycle that is still the current one writes `ready` or
+* `unavailable` (`create-openfort-browser-signer.ts:501-521`). Callers that
+* join a live cycle share that single write, and a `resetSession` writes
+* `unknown` first, so a cycle that a reset or an account replacement outran
+* reports nothing.
+*
+* The host context is bound when the cycle starts, so a person who signs out
+* and back in while a cycle runs cannot relabel the result that began under
+* the previous person. A signer with no readiness cycle — a node or dev key,
+* and a headless client whose requirement never opens the account lane —
+* writes no status and reports nothing.
+*/
+function observeSignerReadinessCycles(signer, telemetry, hostObservationSnapshot, runPromise) {
+	const statusStore = signer?.statusStore;
+	if (statusStore === void 0 || telemetry === void 0) return () => {};
+	let running = false;
+	let startContext;
+	return statusStore.subscribe((status) => {
+		if (status === "recovering") {
+			running = true;
+			startContext = hostObservationSnapshot?.();
+			return;
+		}
+		const cycleContext = startContext;
+		const completesCycle = running;
+		running = false;
+		startContext = void 0;
+		if (!completesCycle || status !== "ready" && status !== "unavailable") return;
+		const event = {
+			name: "access_recovery_completed",
+			props: {
+				recovery: "signer_readiness",
+				outcome: status
+			}
+		};
+		if (cycleContext !== void 0) attachInvocationObservation(event, cycleContext);
+		runPromise(Effect.suspend(() => bindProductTelemetryInvocation(telemetry, event).emit(event)).pipe(Effect.catchCause(() => Effect.void))).catch(() => {});
+	});
+}
 function assembleCapxulClient(input) {
 	const observation = input;
 	const authCache = input.authCache ?? detectAuthCacheAdapter();
@@ -45690,12 +46860,14 @@ function assembleCapxulClient(input) {
 		}, failureObservation, normalizeCapxulOperation(`identity.${record.event}`), "machine");
 	});
 	const unsubscribeSignerReadiness = startSignerReadinessOnClaim(actor, input.signer);
+	const unsubscribeReadinessObservation = observeSignerReadinessCycles(input.signer, input.ports.telemetry, observation.hostObservationSnapshot, effectRunner.runPromise);
 	let stopPromise = null;
 	const stopActor = () => {
 		if (stopPromise === null) {
 			unsubscribeProductTelemetry();
 			unsubscribeFailureObservation();
 			unsubscribeSignerReadiness();
+			unsubscribeReadinessObservation();
 			stopPromise = effectRunner.runPromise(Scope.close(scope, Exit.void));
 		}
 		return stopPromise;
@@ -45712,7 +46884,8 @@ function assembleCapxulClient(input) {
 		convexCall: input.ports.convexCall,
 		...input.signer === void 0 ? {} : { signer: input.signer },
 		telemetry: input.ports.telemetry,
-		requestKeyScope: `${input.bootstrap.convexUrl}:${String(input.bootstrap.chainId)}`
+		requestKeyScope: `${input.bootstrap.convexUrl}:${String(input.bootstrap.chainId)}`,
+		...input.ports.indexerRead === void 0 ? {} : { indexerRead: input.ports.indexerRead }
 	});
 	const accountBundle = makeAccountMethods({
 		actor,
@@ -45741,10 +46914,13 @@ function assembleCapxulClient(input) {
 		...input.invokeTimeoutMs === void 0 ? {} : { invokeTimeoutMs: input.invokeTimeoutMs },
 		afterVerifyOtp: async () => {
 			const browserSigner = input.signer;
-			if (browserSigner !== void 0 && "resetSession" in browserSigner && typeof browserSigner.resetSession === "function") try {
-				browserSigner.resetSession();
-			} catch (cause) {
-				throw signerFailure(browserSigner.source, "resetSession", cause);
+			if (browserSigner !== void 0 && "resetSession" in browserSigner && typeof browserSigner.resetSession === "function") {
+				try {
+					browserSigner.resetSession();
+				} catch (cause) {
+					throw signerFailure(browserSigner.source, "resetSession", cause);
+				}
+				if (browserSigner.statusStore?.status() === "unknown" && typeof browserSigner.ensureWalletReady === "function") browserSigner.ensureWalletReady().catch(() => {});
 			}
 			await detectPendingOrgInvitations?.();
 			kickProvisioning?.();
@@ -45771,6 +46947,7 @@ function assembleCapxulClient(input) {
 		ensureAccount: account._internal.ensureReady,
 		getLifecycle: account.getLifecycle,
 		snapshotIdentity: actor.snapshot,
+		subscribeIdentity: actor.subscribe,
 		sendIdentity: (event, options) => runCapxulEffect(askIdentity(actor, event, options), options, CAPXUL_OPERATIONS._internal.identity.send, effectRunner.runPromise)
 	});
 	const system = makeSystemMethods({ convexCall: input.ports.convexCall });
@@ -45779,7 +46956,8 @@ function assembleCapxulClient(input) {
 		convexCall: input.ports.convexCall,
 		telemetry: input.ports.telemetry,
 		runPromise: effectRunner.runPromise,
-		invocationControls: (controls) => withHostObservationControls(observation.hostObservationSnapshot, controls, actor.authSession()?.authUserId)
+		invocationControls: (controls) => withHostObservationControls(observation.hostObservationSnapshot, controls, actor.authSession()?.authUserId),
+		...input.ports.indexerRead === void 0 ? {} : { indexerRead: input.ports.indexerRead }
 	});
 	const accounts = makeAccountsMethods({
 		accountReadPort: input.ports.accountRead,
@@ -45904,6 +47082,7 @@ function assembleCapxulClient(input) {
 			identity: identityRuntime,
 			bootstrap: input.bootstrap,
 			accounts: { fund: accounts.fund },
+			...input.ports.indexerRead === void 0 ? {} : { indexer: input.ports.indexerRead },
 			organizationSetup: { getProofReceipt: (orgId) => runPortEffect(input.ports.convexCall.query(organizationSetupProofReceiptQuery, { orgId })) },
 			telemetry: input.ports.telemetry,
 			captureExternalAddressAcknowledged: (address, organizationId) => {
@@ -45962,8 +47141,10 @@ function withHostObservationControls(snapshot, input, actorId) {
 	const previous = readInvocationObservation(input);
 	if (previous !== void 0) return attachInvocationObservation({ ...input }, previous);
 	const captured = snapshot?.() ?? { active: true };
+	const context = captured.active ? withCapturedAttemptContext(captured.context, input) : captured.context;
 	return attachInvocationObservation({ ...input }, {
 		...captured,
+		...context === void 0 ? {} : { context },
 		...actorId === void 0 ? {} : { actorId }
 	});
 }
@@ -45983,6 +47164,352 @@ function snapshotHostObservability(observability) {
 	};
 }
 //#endregion
+//#region ../../packages/sdk/src/adapters/ponder/decode.ts
+/**
+* Decode the indexer's rows at the trust boundary.
+*
+* Ponder returns the raw PostgreSQL result: `integer` arrives as a number,
+* `numeric(78)` and `text` arrive as strings. Amounts, block numbers and
+* timestamps are `numeric(78)`, so they become `bigint` here and never pass
+* through `Number`. Every decoder throws a `CapxulError`; the adapter turns
+* that into a typed `IndexerReadError`.
+*/
+const HEX = /^0x[0-9a-fA-F]+$/;
+function field(row, key) {
+	if (!(key in row)) throw Errors.invalidInput(key, "missing from the indexer row");
+	return row[key];
+}
+function text(row, key) {
+	const value = field(row, key);
+	if (typeof value !== "string") throw Errors.invalidInput(key, "must be a string");
+	return value;
+}
+function hex(row, key) {
+	const value = text(row, key);
+	if (!HEX.test(value)) throw Errors.invalidInput(key, "must be a hex string");
+	return value.toLowerCase();
+}
+function integer(row, key) {
+	const value = field(row, key);
+	const parsed = typeof value === "string" ? Number(value) : value;
+	if (typeof parsed !== "number" || !Number.isSafeInteger(parsed)) throw Errors.invalidInput(key, "must be an integer");
+	return parsed;
+}
+/** `numeric(78)` crosses the wire as a decimal string; keep every digit. */
+function big(row, key) {
+	const value = field(row, key);
+	if (typeof value === "bigint") return value;
+	const raw = typeof value === "number" ? String(value) : value;
+	if (typeof raw !== "string" || !/^-?[0-9]+$/.test(raw)) throw Errors.invalidInput(key, "must be an exact integer amount");
+	return BigInt(raw);
+}
+function asRow(value) {
+	if (typeof value !== "object" || value === null || Array.isArray(value)) throw Errors.invalidInput("row", "must be an object");
+	return value;
+}
+function identity(row) {
+	return {
+		id: text(row, "id"),
+		chainId: toChainId(integer(row, "chain_id")),
+		txHash: toTxHash(hex(row, "tx_hash")),
+		transactionLogOrdinal: integer(row, "transaction_log_ordinal"),
+		blockNumber: big(row, "block_number"),
+		blockHash: hex(row, "block_hash"),
+		timestamp: big(row, "timestamp")
+	};
+}
+function decodeTransfer(value) {
+	const row = asRow(value);
+	return {
+		...identity(row),
+		assetId: toAssetId(text(row, "asset_id")),
+		token: toAddress(hex(row, "token")),
+		from: toAddress(hex(row, "from")),
+		to: toAddress(hex(row, "to")),
+		amount: big(row, "amount")
+	};
+}
+function decodePayment(value) {
+	const row = asRow(value);
+	return {
+		...identity(row),
+		contract: toAddress(hex(row, "contract")),
+		settlementId: hex(row, "settlement_id"),
+		sender: toAddress(hex(row, "sender")),
+		recipient: toAddress(hex(row, "recipient")),
+		assetId: toAssetId(text(row, "asset_id")),
+		token: toAddress(hex(row, "token")),
+		amount: big(row, "amount"),
+		kind: integer(row, "kind"),
+		documentHash: hex(row, "document_hash")
+	};
+}
+/** The `balance` view exposes the signed sum under the underlying column name `to`. */
+function decodeBalance(value) {
+	const row = asRow(value);
+	return {
+		chainId: toChainId(integer(row, "chain_id")),
+		assetId: toAssetId(text(row, "asset_id")),
+		address: toAddress(hex(row, "to")),
+		amount: big(row, "amount")
+	};
+}
+const DECODERS = {
+	transfer: decodeTransfer,
+	payment: decodePayment,
+	balance: decodeBalance
+};
+/** Decode one `/sql/db` or `/sql/live` payload. Ponder returns `{ rows: [...] }`. */
+function decodeRows(table, body) {
+	const rows = asRow(body).rows;
+	if (!Array.isArray(rows)) throw Errors.invalidInput("rows", "must be an array");
+	const decode = DECODERS[table];
+	return rows.map(decode);
+}
+/** Decode Ponder's native `/status`: `{ [chainName]: { id, block: { number, timestamp } } }`. */
+function decodeStatus(body) {
+	const chains = asRow(body);
+	return Object.entries(chains).map(([chain, value]) => {
+		const entry = asRow(value);
+		const block = asRow(field(entry, "block"));
+		return {
+			chain,
+			chainId: toChainId(integer(entry, "id")),
+			blockNumber: big(block, "number"),
+			blockTimestamp: big(block, "timestamp")
+		};
+	});
+}
+//#endregion
+//#region ../../packages/sdk/src/adapters/ponder/statements.ts
+/**
+* The exact statements the indexer accepts.
+*
+* `apps/indexer/src/queries.ts` compiles its allowlist with `@ponder/client`
+* and compares `sql`, `params` and `typings` byte for byte against the caller's
+* statement. Anything else gets 403. The SDK therefore reproduces the compiled
+* text here rather than pulling Ponder and Drizzle into a published browser
+* bundle to regenerate three fixed statements.
+*
+* `statements.test.ts` pins the text. When the indexer schema or a query in
+* that allowlist changes, this file changes with it or every read fails 403.
+*/
+const HEADS = {
+	transfer: "select \"id\", \"chain_id\", \"tx_hash\", \"transaction_log_ordinal\", \"block_number\", \"block_hash\", \"timestamp\", \"asset_id\", \"token\", \"from\", \"to\", \"amount\" from \"transfer\" where (\"transfer\".\"from\" = $1 or \"transfer\".\"to\" = $2) order by \"transfer\".\"block_number\" desc, \"transfer\".\"id\" desc",
+	payment: "select \"id\", \"chain_id\", \"tx_hash\", \"transaction_log_ordinal\", \"block_number\", \"block_hash\", \"timestamp\", \"contract\", \"settlement_id\", \"sender\", \"recipient\", \"asset_id\", \"token\", \"amount\", \"kind\", \"document_hash\" from \"payment\" where (\"payment\".\"sender\" = $1 or \"payment\".\"recipient\" = $2) order by \"payment\".\"block_number\" desc, \"payment\".\"id\" desc",
+	balance: "select \"chain_id\", \"asset_id\", \"to\", \"amount\" from \"balance\" where \"balance\".\"to\" = $1"
+};
+/** How many times the statement binds the Safe address. */
+const ACTOR_PARAMS = {
+	transfer: 2,
+	payment: 2,
+	balance: 1
+};
+/**
+* Build the compiled query for one table and page. Throws a `CapxulError` for
+* a page or address the indexer would refuse, so the caller never spends a
+* round trip to learn it built the request wrong.
+*/
+function ponderQuery(table, input) {
+	const safe = assertIndexerPage(input);
+	const offset = input.offset ?? 0;
+	const actors = ACTOR_PARAMS[table];
+	const params = [];
+	for (let i = 0; i < actors; i++) params.push(safe);
+	params.push(input.limit);
+	let sql = `${HEADS[table]} limit $${actors + 1}`;
+	if (offset > 0) {
+		params.push(offset);
+		sql = `${sql} offset $${actors + 2}`;
+	}
+	return {
+		sql,
+		params,
+		typings: params.map(() => "none")
+	};
+}
+/**
+* The `?sql=` value. `@ponder/client` sends `superjson.stringify(query)`; for a
+* payload of strings and numbers superjson emits no `meta`, so the wire form is
+* exactly this envelope.
+*/
+function ponderQueryParam(query) {
+	return JSON.stringify({ json: query });
+}
+//#endregion
+//#region ../../packages/sdk/src/adapters/ponder/sse.ts
+/**
+* The smallest SSE reader that can carry an `Authorization` header.
+*
+* `@ponder/client` opens its live query with `EventSource`, which accepts no
+* headers, so it cannot reach the guarded indexer at all. The indexer's CORS
+* policy allows exactly one request header (`Authorization`), so this reader
+* sends nothing else. Ponder writes one `data:` line per frame.
+*/
+async function readEventStream(body, onData, stopped) {
+	const reader = body.getReader();
+	const decoder = new TextDecoder();
+	let buffer = "";
+	try {
+		for (;;) {
+			const { done, value } = await reader.read();
+			if (done || stopped()) return;
+			buffer += decoder.decode(value, { stream: true });
+			let split = buffer.indexOf("\n\n");
+			while (split !== -1) {
+				const frame = buffer.slice(0, split);
+				buffer = buffer.slice(split + 2);
+				const data = frameData(frame);
+				if (data !== void 0) onData(data);
+				if (stopped()) return;
+				split = buffer.indexOf("\n\n");
+			}
+		}
+	} finally {
+		await reader.cancel().catch(() => void 0);
+	}
+}
+function frameData(frame) {
+	const lines = [];
+	for (const line of frame.split("\n")) {
+		if (!line.startsWith("data:")) continue;
+		lines.push(line.slice(line.startsWith("data: ") ? 6 : 5));
+	}
+	return lines.length === 0 ? void 0 : lines.join("\n");
+}
+//#endregion
+//#region ../../packages/sdk/src/adapters/ponder/PonderIndexerAdapter.ts
+var PonderIndexerAdapter = class {
+	#baseUrl;
+	#token;
+	#fetch;
+	#observation;
+	constructor(deps) {
+		this.#baseUrl = deps.baseUrl.replace(/\/$/, "");
+		this.#token = deps.token;
+		this.#observation = deps.observation;
+		this.#fetch = deps.fetch ?? ((input, init) => globalThis.fetch(input, init));
+	}
+	read(table, input) {
+		const operation = `indexer.read.${table}`;
+		return Effect.tryPromise({
+			try: async () => {
+				return decodeRows(table, await (await this.#request("db", table, input, operation)).json());
+			},
+			catch: (cause) => toIndexerReadError(operation, cause)
+		});
+	}
+	subscribe(table, input, callback) {
+		const operation = CAPXUL_OPERATIONS.activity.subscribe;
+		return Effect.sync(() => {
+			let stopped = false;
+			const unsubscribe = () => {
+				stopped = true;
+			};
+			callback({ status: "loading" });
+			this.#stream(table, input, operation, callback, () => stopped).catch(() => void 0);
+			return unsubscribe;
+		});
+	}
+	status = Effect.tryPromise({
+		try: async () => {
+			const response = await this.#fetch(`${this.#baseUrl}/status`, { method: "GET" });
+			if (!response.ok) throw httpError("indexer.status", response.status, await safeText(response));
+			return decodeStatus(await response.json());
+		},
+		catch: (cause) => toIndexerReadError("indexer.status", cause)
+	});
+	/** One authenticated `/sql/:method` call. Throws a `CapxulError` on refusal. */
+	async #request(method, table, input, operation) {
+		const query = ponderQuery(table, input);
+		const token = await this.#token({ forceRefreshToken: false });
+		if (token === null || token === "") throw Errors.notAuthenticated();
+		const url = `${this.#baseUrl}/sql/${method}?sql=${encodeURIComponent(ponderQueryParam(query))}`;
+		const headers = { authorization: `Bearer ${token}` };
+		if (method === "live") headers.accept = "text/event-stream";
+		let response;
+		try {
+			response = await this.#fetch(url, {
+				method: "GET",
+				headers
+			});
+		} catch (cause) {
+			throw Errors.networkError(operation, cause, {
+				provider: "indexer",
+				failure_mode: "upstream-down"
+			});
+		}
+		if (!response.ok) throw httpError(operation, response.status, await safeText(response));
+		return response;
+	}
+	/**
+	* Follow the live stream until the caller unsubscribes or the indexer closes
+	* it. The indexer closes the stream on token expiry or revoked authority
+	* with no frame, so any end the caller did not ask for is a teardown: it
+	* reaches `captureException` under `activity.subscribe` and the caller sees
+	* one `error` snapshot.
+	*/
+	async #stream(table, input, operation, callback, stopped) {
+		let failure;
+		try {
+			const response = await this.#request("live", table, input, operation);
+			if (response.body === null) throw Errors.providerError("indexer", operation, "empty stream");
+			await readEventStream(response.body, (data) => {
+				try {
+					callback({
+						status: "ok",
+						value: decodeRows(table, JSON.parse(data))
+					});
+				} catch (cause) {
+					failure = toPublicError$1(operation, cause);
+				}
+			}, () => stopped() || failure !== void 0);
+		} catch (cause) {
+			failure = toPublicError$1(operation, cause);
+		}
+		if (stopped()) return;
+		const error = failure ?? Errors.capabilityUnavailable("indexer", operation);
+		observeStreamFailure(this.#observation, CAPXUL_OPERATIONS.activity.subscribe, error, error.code === "NOT_AUTHENTICATED" ? "operation" : "exception");
+		callback({
+			status: "error",
+			error
+		});
+	}
+};
+/**
+* Map an indexer refusal into the shared error vocabulary.
+*
+* 401 is the expected outcome of an expired or revoked session. 403 is not:
+* the indexer accepts only its own compiled statements for a Safe in the
+* claim, so a refusal means this SDK and that deployment disagree, or the
+* session gained a Safe and still holds the older token. Both must be loud.
+*/
+function httpError(operation, status, body) {
+	if (status === 401) return Errors.notAuthenticated();
+	if (status === 429) return Errors.rateLimited({ resource: "indexer" });
+	if (status === 503) return Errors.capabilityUnavailable("indexer", operation);
+	return Errors.providerError("indexer", operation, body, {
+		httpStatus: status,
+		...status >= 500 ? { failure_mode: "upstream-down" } : {},
+		details: { reason: status === 403 ? "scope-refused" : "http-status" }
+	});
+}
+function toPublicError$1(operation, cause) {
+	if (cause instanceof CapxulError) return cause;
+	return Errors.providerError("indexer", operation, cause);
+}
+function toIndexerReadError(operation, cause) {
+	if (cause instanceof IndexerReadError) return cause;
+	return indexerReadErrorFromCapxul(operation, toPublicError$1(operation, cause), cause);
+}
+async function safeText(response) {
+	try {
+		return await response.text();
+	} catch {
+		return "";
+	}
+}
+//#endregion
 //#region ../../packages/sdk/src/adapters/_shared/clock.ts
 async function readClockNow(clock) {
 	try {
@@ -46439,7 +47966,16 @@ async function createProductionAdapters(input) {
 		}));
 		const applicationLayer = Layer.merge(portsLayer, optionalEngineeringTelemetryLayer(bootstrapResult.value.engineeringTelemetry, resolvedInput.value.runtime));
 		const context = await Effect.runPromise(Layer.buildWithScope(applicationLayer, scope));
-		const ports = await Effect.runPromise(collectProductionFlowPorts.pipe(Effect.provide(context)));
+		const collected = await Effect.runPromise(collectProductionFlowPorts.pipe(Effect.provide(context)));
+		const indexerUrl = input.indexerUrl ?? bootstrapResult.value.indexerUrl;
+		const indexerRead = productionIndexerReadPort(indexerUrl === void 0 ? input : {
+			...input,
+			indexerUrl
+		}, collected, observation);
+		const ports = indexerRead === void 0 ? collected : {
+			...collected,
+			indexerRead
+		};
 		const stopConnectionObservation = observeProductionConvexConnection(ports.convexCall, context);
 		const close = idempotentClose(async () => {
 			try {
@@ -46566,7 +48102,7 @@ async function createCapxulClientWithSignerControls(input, controls) {
 			...adapters.value.bootstrap,
 			authBaseUrl: resolvedAuthBaseUrl
 		}, {
-			diagnostic: new ConsoleDiagnosticAdapter(),
+			diagnostic: new EffectLogDiagnosticAdapter(adapters.value.context, new ConsoleDiagnosticAdapter()),
 			signUserOpHash: controls.signEmbeddedUserOpHash
 		});
 		signer = withSignerControl(signer, controls.signUserOpHash);
@@ -46771,6 +48307,29 @@ function idempotentClose(close) {
 		await close();
 	};
 }
+/**
+* Build the Ponder read port for this client, or `undefined` when no indexer
+* origin was supplied. The token provider is the same
+* `AuthClientPort.getConvexJwt` closure `ConvexCallPort` uses, so the indexer
+* and Convex see one session with one scope.
+*/
+function productionIndexerReadPort(input, ports, observation) {
+	if (input.activityReadSource === "convex") return void 0;
+	if (input.indexerUrl === void 0 || input.indexerUrl === "") return void 0;
+	return new PonderIndexerAdapter({
+		baseUrl: normalizeHttpUrl("indexerUrl", input.indexerUrl),
+		token: async ({ forceRefreshToken }) => {
+			const token = await Effect.runPromise(Effect.result(ports.authClient.getConvexJwt({
+				forceRefresh: forceRefreshToken,
+				...input.signal === void 0 ? {} : { signal: input.signal }
+			})));
+			if (Result.isFailure(token)) return null;
+			return String(token.success.token);
+		},
+		...input.fetch === void 0 ? {} : { fetch: input.fetch },
+		...observation === void 0 ? {} : { observation }
+	});
+}
 //#endregion
 //#region src/tools/account.ts
 const READ = "account:read";
@@ -47382,7 +48941,7 @@ function stdioIdentity(env = process.env, options = {}) {
 }
 //#endregion
 //#region package.json
-var version = "4.2.0-rc.1";
+var version = "4.2.0-rc.11";
 //#endregion
 //#region src/deps.ts
 const NO_IDENTITY = async () => void 0;