@capxul/mcp 4.2.0-rc.10 → 4.2.0-rc.11

package/dist/capxul-source.json

@@ -1,11 +1,11 @@
 {
   "source": {
-    "commit": "a7e55e5f1c2af5567a8b285a4ef70b8b5a3289f6",
-    "tree": "91bf1b080c0006fe30131711c13c843afd627158",
+    "commit": "12a590f10914e8b056ce54732e6f484f36e060f3",
+    "tree": "90adc6656be3c1fb0a6e18170877d46081fa2538",
     "branch": "codex/programme-rc",
     "repository": "https://github.com/Xelmar-tech/infrastructure",
     "lockfileSha256": "5870f53b72706d103220c1bcf733cb4fb71196aea32a9cfbdc277d73cc959264"
   },
   "name": "@capxul/mcp",
-  "version": "4.2.0-rc.10"
+  "version": "4.2.0-rc.11"
 }

package/dist/main.mjs

@@ -931,6 +931,10 @@ function toChainId(raw) {
 	if (typeof raw !== "number" || !Number.isSafeInteger(raw) || raw <= 0) throw Errors.invalidInput("chainId", invalidValueReason("must be a positive safe integer", raw));
 	return raw;
 }
+function toWeiAmount(raw) {
+	if (typeof raw !== "string" || !WEI_RE.test(raw)) throw Errors.invalidInput("weiAmount", invalidValueReason("must be a non-negative integer string", raw));
+	return raw;
+}
 function toCountryCode(raw) {
 	if (typeof raw !== "string") throw Errors.invalidInput("countryCode", "must be a string");
 	const upper = raw.toUpperCase();
@@ -1087,8 +1091,18 @@ const SYNTHETIC_TEST_ASSETS = [
 	}
 ];
 toChainId(84532);
-[...CONFIGURED_MONEY_ASSETS, ...SYNTHETIC_TEST_ASSETS];
+/**
+* Every known asset in ONE identity space. The tiers above declare admission;
+* this is the only list an identity resolves against, so an asset is never
+* two different things depending on which list a caller happened to read.
+*/
+const MONEY_ASSET_REGISTRY = [...CONFIGURED_MONEY_ASSETS, ...SYNTHETIC_TEST_ASSETS];
 CONFIGURED_MONEY_ASSETS.map((asset) => asset.tokenAddress.toLowerCase());
+/** The registry row for `assetId` across every tier, or `null`. */
+function configuredMoneyAssetById(assetId) {
+	const canonical = toAssetId(assetId);
+	return MONEY_ASSET_REGISTRY.find((asset) => asset.assetId === canonical) ?? null;
+}
 //#endregion
 //#region ../../node_modules/.pnpm/abitype@1.2.3_typescript@7.0.2_zod@4.4.3/node_modules/abitype/dist/esm/regex.js
 function execTyped(regex, string) {
@@ -7788,7 +7802,27 @@ const PermissionMirrorVerificationProps = Schema.Struct({
 		"conflicting_replay",
 		"revision_mismatch"
 	])),
-	command_id: OptionalString
+	command_id: OptionalString,
+	/**
+	* #1961 R03. The authorized stored row names the Permission it changed; the
+	* verified receipt names the chain facts that prove it. Every field is
+	* optional because a pending or provider-failed verification has neither an
+	* application result nor a receipt to report.
+	*/
+	permission_id: OptionalString,
+	permission_assignment_id: OptionalString,
+	permission_operation: Schema.optional(Schema.Literals([
+		"create",
+		"change",
+		"assign",
+		"revoke",
+		"replace"
+	])),
+	revision: Schema.optional(Schema.Number),
+	user_op_hash: OptionalString,
+	transaction_hash: OptionalString,
+	block_number: Schema.optional(Schema.Number),
+	log_index: Schema.optional(Schema.Number)
 });
 const MovementScanWindowProps = Schema.Struct({
 	...TelemetryEnvelopeProps,
@@ -8713,6 +8747,7 @@ const CAPXUL_FUNCTIONS = {
 		list: "movement/activity:list",
 		summary: "movement/activity:summary"
 	},
+	"movement/annotations": { overlay: "movement/annotations:overlay" },
 	"moneyExecution/actions": {
 		abandonPaymentExecution: "moneyExecution/actions:abandonPaymentExecution",
 		preparePermissionExecution: "moneyExecution/actions:preparePermissionExecution",
@@ -9311,7 +9346,19 @@ const StoredPermissionCommandSchema = Schema.Struct({
 	roleKey: RoleKeySchema,
 	allowanceKey: Schema.NullOr(AllowanceKeySchema),
 	memberSafe: Schema.NullOr(SafeAddressSchema),
-	expectedAuthorityEvents: Schema.Array(Bytes32Schema)
+	expectedAuthorityEvents: Schema.Array(Bytes32Schema),
+	/**
+	* #1961 R03. The authenticated user who created the command, and the browser
+	* linkage captured with it. Delayed verification and bounded retries read
+	* this snapshot instead of the current viewer, so one command keeps one
+	* origin. Both are absent on commands created before this contract.
+	*
+	* The context stays `unknown` on purpose: `sanitizeObservationContext` owns
+	* the field allowlist, and every reader passes the stored value through it
+	* rather than repeating those rules here.
+	*/
+	originatingAuthUserId: Schema.optional(Schema.String),
+	originatingObservationContext: Schema.optional(Schema.Unknown)
 });
 Schema.Struct({
 	command: StoredPermissionCommandSchema,
@@ -12361,6 +12408,7 @@ const financialOpsContract = {
 	activitySummary: makeFunctionReference(CAPXUL_FUNCTIONS["movement/activity"].summary),
 	activityGet: makeFunctionReference(CAPXUL_FUNCTIONS["movement/activity"].get),
 	activityAnnotate: makeFunctionReference(CAPXUL_FUNCTIONS["movement/activity"].annotate),
+	activityOverlay: makeFunctionReference(CAPXUL_FUNCTIONS["movement/annotations"].overlay),
 	verifyPaymentDocument: makeFunctionReference(CAPXUL_FUNCTIONS["financialOps/queries"].verifyPaymentDocument),
 	renderStoredDocument: makeFunctionReference(CAPXUL_FUNCTIONS["financialOps/queries"].renderStoredDocument)
 };
@@ -12377,8 +12425,357 @@ const moneyExecutionContract = {
 	submitPaymentCommandExecution: makeFunctionReference(CAPXUL_FUNCTIONS["moneyExecution/paymentCommandActions"].submitPaymentCommandExecution)
 };
 //#endregion
+//#region ../../packages/sdk/src/ports/indexer-read.ts
+/** The indexer's own page bound. Exceeding it is a caller defect, not a refusal. */
+const INDEXER_MAX_LIMIT = 1e3;
+const LOWER_CASE_ADDRESS = /^0x[0-9a-f]{40}$/;
+/**
+* Refuse a page the indexer would refuse, before any implementation spends a
+* round trip on it. Every implementation calls this, so a consumer test written
+* against the hermetic adapter cannot pass on input production rejects. Throws
+* a `CapxulError`; callers convert it to an `IndexerReadError`.
+*/
+function assertIndexerPage(input) {
+	const safe = String(input.safe).toLowerCase();
+	if (!LOWER_CASE_ADDRESS.test(safe)) throw Errors.invalidInput("safe", "must be a lower-case EVM address");
+	if (!Number.isSafeInteger(input.limit) || input.limit < 1 || input.limit > 1e3) throw Errors.invalidInput("limit", `must be an integer from 1 to ${INDEXER_MAX_LIMIT}`);
+	const offset = input.offset ?? 0;
+	if (!Number.isSafeInteger(offset) || offset < 0) throw Errors.invalidInput("offset", "must be a non-negative integer");
+	return safe;
+}
+var IndexerReadError = class extends Data.TaggedError("IndexerReadError") {};
+function indexerReadErrorFromCapxul(operation, error, cause = error) {
+	return new IndexerReadError({
+		operation,
+		publicCode: error.code,
+		publicError: error,
+		cause,
+		...error.details === void 0 ? {} : { details: error.details }
+	});
+}
+Context.Service()("@capxul/sdk/ports/IndexerReadPort");
+//#endregion
+//#region ../../packages/sdk/src/surface/activity-stitch.ts
+/** Epoch milliseconds of the block that carried the row. */
+function blockMillis(row) {
+	return Number(row.timestamp) * 1e3;
+}
+/** `0x1234…abcd` — the counterparty of an unclaimed transfer is an address. */
+function shortAddressLabel(address) {
+	return address.length <= 12 ? address : `${address.slice(0, 6)}…${address.slice(-4)}`;
+}
+function directionFor(safe, transfer) {
+	const from = transfer.from.toLowerCase();
+	const to = transfer.to.toLowerCase();
+	if (from === safe && to === safe) return "self";
+	return to === safe ? "in" : "out";
+}
+/**
+* The Transfer a protocol Payment moved is the same money as its `payment`
+* row. One actor sees one item for it, so the Transfer is claimed and does not
+* become a second row. Another transfer in the same transaction that this
+* payment did not move stays unclaimed and keeps its own row.
+*/
+function claimedTransferIds(transfers, payments) {
+	const claimed = /* @__PURE__ */ new Set();
+	for (const payment of payments) {
+		const match = transfers.find((transfer) => !claimed.has(transfer.id) && transfer.txHash === payment.txHash && transfer.token.toLowerCase() === payment.token.toLowerCase() && transfer.amount === payment.amount && transfer.to.toLowerCase() === payment.recipient.toLowerCase());
+		if (match !== void 0) claimed.add(match.id);
+	}
+	return claimed;
+}
+function withAnnotation(item, annotation) {
+	return annotation?.counterpartyLabel === void 0 ? item : {
+		...item,
+		counterpartyLabel: annotation.counterpartyLabel
+	};
+}
+/**
+* Confirmation comes from the chain, never from Convex.
+*
+* A Ponder row for this Payment's settlement means settled, and its receipt is
+* the indexed transaction. No Ponder row and a Convex row that still says
+* settled means the block that carried it was dropped: the row goes back to
+* `settling` and its annotation, which keys on the Payment id, is untouched.
+*/
+function confirmPayment(intent, chain, hasSettlement) {
+	if (chain !== void 0) return {
+		...intent,
+		status: "settled",
+		receipt: {
+			chainId: chain.chainId,
+			transactionHash: chain.txHash
+		},
+		updatedAt: blockMillis(chain)
+	};
+	if (hasSettlement && intent.status === "settled") return {
+		...intent,
+		status: "settling",
+		receipt: null
+	};
+	return intent;
+}
+/**
+* One unclaimed Transfer as an Activity row, or `null` when this SDK cannot
+* denominate its asset. The indexer serves only configured assets, so a row
+* the registry does not know means the SDK and that deployment disagree; it is
+* dropped rather than shown with a guessed currency.
+*/
+function transferItem(safe, transfer, annotation) {
+	const asset = configuredMoneyAssetById(transfer.assetId);
+	if (asset === null) return null;
+	const direction = directionFor(safe, transfer);
+	const counterparty = direction === "in" ? transfer.from : transfer.to;
+	const at = blockMillis(transfer);
+	return withAnnotation({
+		kind: "movement",
+		id: transfer.id,
+		classification: "movement_only_outflow",
+		amount: {
+			currency: asset.peg ?? asset.symbol,
+			value: formatUnits(transfer.amount, asset.decimals),
+			decimals: asset.decimals
+		},
+		direction,
+		counterpartyLabel: shortAddressLabel(counterparty),
+		receipt: {
+			chainId: transfer.chainId,
+			transactionHash: transfer.txHash
+		},
+		createdAt: at,
+		updatedAt: at
+	}, annotation);
+}
+/** Newest first. A Payment precedes a Movement at one instant, as the ledger reader orders them. */
+function compareItems(left, right) {
+	if (right.createdAt !== left.createdAt) return right.createdAt - left.createdAt;
+	if (left.kind !== right.kind) return left.kind === "payment" ? -1 : 1;
+	if (left.id === right.id) return 0;
+	return left.id < right.id ? 1 : -1;
+}
+function stitchActivity(input) {
+	const safe = input.safe.toLowerCase();
+	const chainBySettlement = /* @__PURE__ */ new Map();
+	for (const row of input.payments) chainBySettlement.set(row.settlementId.toLowerCase(), row);
+	const chainByPaymentId = /* @__PURE__ */ new Map();
+	const settledPaymentIds = /* @__PURE__ */ new Set();
+	for (const link of input.links) {
+		settledPaymentIds.add(link.paymentId);
+		const row = chainBySettlement.get(link.settlementId.toLowerCase());
+		if (row !== void 0) chainByPaymentId.set(link.paymentId, row);
+	}
+	const annotations = /* @__PURE__ */ new Map();
+	for (const annotation of input.annotations) annotations.set(`${annotation.reference.kind}:${annotation.reference.id}`, annotation);
+	const items = [];
+	const claiming = [];
+	for (const intent of input.intents) {
+		if (intent.kind !== "payment") continue;
+		const chain = chainByPaymentId.get(intent.id);
+		if (chain !== void 0) claiming.push(chain);
+		items.push(withAnnotation(confirmPayment(intent, chain, settledPaymentIds.has(intent.id)), annotations.get(`payment:${intent.id}`)));
+	}
+	const claimed = claimedTransferIds(input.transfers, claiming);
+	for (const transfer of input.transfers) {
+		if (claimed.has(transfer.id)) continue;
+		const item = transferItem(safe, transfer, annotations.get(`movement:${transfer.id}`));
+		if (item !== null) items.push(item);
+	}
+	return items.sort(compareItems);
+}
+/** The reference ids one stitched page needs its Convex overlay for. */
+function overlayReferences(items) {
+	return items.map((item) => ({
+		kind: item.kind,
+		id: item.id
+	}));
+}
+/**
+* Money in, money out and the pending share, one bucket per currency and
+* precision. Two assets that peg to the same currency at different precision
+* stay distinct buckets: their raw units are not interchangeable.
+*/
+function summarizeItems(items) {
+	const buckets = /* @__PURE__ */ new Map();
+	for (const item of items) {
+		const key = `${item.amount.currency}:${String(item.amount.decimals)}`;
+		const bucket = buckets.get(key) ?? {
+			currency: item.amount.currency,
+			decimals: item.amount.decimals,
+			in: 0n,
+			out: 0n,
+			pendingIn: 0n
+		};
+		const raw = rawUnits(item.amount.value, item.amount.decimals);
+		if (item.direction === "in") {
+			bucket.in += raw;
+			if (item.kind === "payment" && item.status !== "settled") bucket.pendingIn += raw;
+		} else if (item.direction === "out") bucket.out += raw;
+		buckets.set(key, bucket);
+	}
+	return [...buckets.values()].map((bucket) => ({
+		currency: bucket.currency,
+		decimals: bucket.decimals,
+		in: bucket.in.toString(),
+		out: bucket.out.toString(),
+		net: (bucket.in - bucket.out).toString(),
+		pendingIn: bucket.pendingIn.toString()
+	}));
+}
+/** The inverse of `formatUnits`, kept exact: `"1.25"` at 6 decimals is `1250000n`. */
+function rawUnits(value, decimals) {
+	const negative = value.startsWith("-");
+	const [whole = "0", fraction = ""] = (negative ? value.slice(1) : value).split(".");
+	const raw = BigInt(`${whole}${fraction.padEnd(decimals, "0").slice(0, decimals)}`);
+	return negative ? -raw : raw;
+}
+//#endregion
+//#region ../../packages/sdk/src/surface/activity-read.ts
+/** How many Convex intent rows one page reads for its labels and pending rows. */
+const INTENT_WINDOW = 100;
+/** The window a summary aggregates over. The indexer's own page bound. */
+const SUMMARY_WINDOW = INDEXER_MAX_LIMIT;
+function parseCursor(value) {
+	if (value === void 0) return 0;
+	try {
+		const parsed = JSON.parse(value);
+		return Number.isSafeInteger(parsed.offset) && parsed.offset >= 0 ? parsed.offset : 0;
+	} catch {
+		return 0;
+	}
+}
+function inRange(item, range) {
+	if (range?.from !== void 0 && item.createdAt < range.from) return false;
+	return range?.to === void 0 || item.createdAt <= range.to;
+}
+/** The caller's filter applied to the merged page. The join owns the order. */
+function matchesFilter(item, filter) {
+	if (filter === void 0) return true;
+	if (filter.kind !== void 0 && item.kind !== filter.kind) return false;
+	if (filter.direction !== void 0 && item.direction !== filter.direction) return false;
+	if (filter.status === void 0) return true;
+	return item.kind === "payment" && filter.status.includes(item.status);
+}
+function overlay(deps, actor, controls, input) {
+	return deps.convexCall.query(deps.functions.activityOverlay, copyInvocationObservation(controls, { input: {
+		...actor === void 0 ? {} : { actor },
+		...input.references === void 0 ? {} : { references: input.references },
+		...input.settlementIds === void 0 ? {} : { settlementIds: input.settlementIds }
+	} }));
+}
+function convexPage(deps, actor, controls, input) {
+	return deps.convexCall.query(deps.functions.activityList, copyInvocationObservation(controls, { input: {
+		...actor === void 0 ? {} : { actor },
+		...input.cursor === void 0 ? {} : { cursor: input.cursor },
+		...input.limit === void 0 ? {} : { limit: input.limit },
+		...input.range === void 0 ? {} : { range: input.range }
+	} }));
+}
+/** Both indexed tables for one Safe, or `null` when the indexer cannot answer. */
+function chainRows(deps, safe, limit) {
+	const page = {
+		safe,
+		limit: Math.min(limit, INDEXER_MAX_LIMIT)
+	};
+	return Effect.all([deps.indexer.read("transfer", page), deps.indexer.read("payment", page)], { concurrency: 2 }).pipe(Effect.map(([transfers, payments]) => ({
+		transfers,
+		payments
+	})), Effect.catch(() => Effect.succeed(null)));
+}
+/** The stitched, filtered rows of one window, newest first. */
+function stitchedWindow(deps, actor, controls, window, params) {
+	return Effect.gen(function* () {
+		const scope = yield* overlay(deps, actor, controls, {});
+		const convex = yield* convexPage(deps, actor, controls, {
+			limit: INTENT_WINDOW,
+			...params.range === void 0 ? {} : { range: params.range }
+		});
+		const rows = scope.safe === null ? null : yield* chainRows(deps, scope.safe, window);
+		if (rows === null || scope.safe === null) return {
+			items: convex.items.filter((item) => matchesFilter(item, params.filter)),
+			stitched: false
+		};
+		const decoration = yield* overlay(deps, actor, controls, {
+			references: [...overlayReferences(convex.items), ...rows.transfers.map((row) => ({
+				kind: "movement",
+				id: row.id
+			}))],
+			settlementIds: rows.payments.map((row) => row.settlementId)
+		});
+		return {
+			items: stitchActivity({
+				safe: scope.safe,
+				transfers: rows.transfers,
+				payments: rows.payments,
+				intents: convex.items,
+				links: decoration.links,
+				annotations: decoration.annotations
+			}).filter((item) => inRange(item, params.range) && matchesFilter(item, params.filter)),
+			stitched: true
+		};
+	});
+}
+function readActivityPage(deps, actor, controls, params) {
+	const limit = params?.limit ?? 25;
+	const offset = parseCursor(params?.cursor);
+	return stitchedWindow(deps, actor, controls, offset + limit + 1, {
+		...params?.range === void 0 ? {} : { range: params.range },
+		...params?.filter === void 0 ? {} : { filter: params.filter }
+	}).pipe(Effect.map(({ items, stitched }) => {
+		const observedAt = Date.now();
+		if (!stitched) return {
+			items: items.slice(0, limit),
+			cursor: null,
+			checkpoint: observedAt,
+			observedAt
+		};
+		return {
+			items: items.slice(offset, offset + limit),
+			cursor: items.length > offset + limit ? JSON.stringify({ offset: offset + limit }) : null,
+			checkpoint: observedAt,
+			observedAt
+		};
+	}));
+}
+function readActivitySummary(deps, actor, controls, params) {
+	return stitchedWindow(deps, actor, controls, SUMMARY_WINDOW, params?.window === void 0 ? {} : { range: params.window }).pipe(Effect.map(({ items }) => ({
+		window: {
+			from: params?.window?.from ?? null,
+			to: params?.window?.to ?? null
+		},
+		totals: summarizeItems(items),
+		count: items.length,
+		observedAt: Date.now()
+	})));
+}
+/**
+* Tell the caller when the indexed page for this Safe changed.
+*
+* The transport is the indexer's one SSE connection, wired in the Ponder
+* adapter under `activity.subscribe`. A reactive snapshot is not a product
+* event, so nothing here emits telemetry: the adapter reports a teardown, and
+* the caller re-reads.
+*/
+function subscribeActivity(deps, actor, controls, onChange) {
+	return Effect.gen(function* () {
+		const scope = yield* overlay(deps, actor, controls, {});
+		if (scope.safe === null) return () => {};
+		const page = {
+			safe: scope.safe,
+			limit: INTENT_WINDOW
+		};
+		let delivered = false;
+		const notify = () => {
+			if (delivered) onChange();
+			delivered = true;
+		};
+		return yield* deps.indexer.subscribe("transfer", page, (snapshot) => {
+			if (snapshot.status === "ok") notify();
+		});
+	});
+}
+//#endregion
 //#region ../../packages/sdk/package.json
-var version$1 = "4.2.0-rc.10";
+var version$1 = "4.2.0-rc.11";
 //#endregion
 //#region ../../packages/sdk/src/telemetry/exception-projection.ts
 /** Fixed fallback for failures that have no safe message. */
@@ -12480,10 +12877,15 @@ function observeFailedResult(result, adapter, operation, origin) {
 * A reactive stream is torn down after its call already returned, so nothing
 * downstream observes it. `captureException` is the right kind: the caller did
 * not ask for the end, so it is not an expected product outcome.
+*
+* A caller that DID ask for the end — the session it authenticated with
+* expired, and the service closed the stream on purpose — passes
+* `kind: "operation"` instead, so the refusal lands in the expected-outcome
+* stream its code already declares.
 */
-function observeStreamFailure(adapter, operation, cause) {
+function observeStreamFailure(adapter, operation, cause, kind = "exception") {
 	if (adapter === void 0) return;
-	report(adapter, "exception", operation, cause, resolveAdapterSnapshot(adapter));
+	report(adapter, kind, operation, cause, resolveAdapterSnapshot(adapter));
 }
 /**
 * One failure, one event. The identity machine reports a failed transition
@@ -13475,6 +13877,11 @@ function paymentExecutionIntent(input) {
 }
 function makeFinancialOpsMethods(deps) {
 	const fns = deps.functions ?? financialOpsContract;
+	const indexerDeps = deps.indexerRead === void 0 ? void 0 : {
+		indexer: deps.indexerRead,
+		convexCall: deps.convexCall,
+		functions: fns
+	};
 	const executionFns = deps.moneyExecutionFunctions ?? moneyExecutionContract;
 	const requestKeyScope = deps.requestKeyScope ?? randomPaymentRequestKey();
 	const inFlightPersonalPayments = /* @__PURE__ */ new Map();
@@ -13705,22 +14112,26 @@ function makeFinancialOpsMethods(deps) {
 			}
 		},
 		activity: {
+			subscribe: (onChange, params, options) => {
+				const controls = deps.invocationControls?.(options) ?? options;
+				return runPortEffect(captureActivityInput(() => Effect.succeed(activityActorField(params?.actor).actor)).pipe(Effect.flatMap((actor) => indexerDeps === void 0 ? Effect.succeed(() => {}) : Effect.suspend(() => subscribeActivity(indexerDeps, actor, controls, onChange)).pipe(Effect.tap(() => observeActivityScope(actor))))), controls, CAPXUL_OPERATIONS.activity.subscribe, deps.runPromise);
+			},
 			list: (params, options) => {
 				const controls = deps.invocationControls?.(options) ?? options;
-				return runPortEffect(captureActivityInput(() => Effect.succeed(activityActorField(params?.actor).actor)).pipe(Effect.flatMap((actor) => Effect.suspend(() => deps.convexCall.query(fns.activityList, copyInvocationObservation(controls, { input: {
+				return runPortEffect(captureActivityInput(() => Effect.succeed(activityActorField(params?.actor).actor)).pipe(Effect.flatMap((actor) => Effect.suspend(() => indexerDeps === void 0 ? deps.convexCall.query(fns.activityList, copyInvocationObservation(controls, { input: {
 					...actor === void 0 ? {} : { actor },
 					...params?.cursor === void 0 ? {} : { cursor: params.cursor },
 					...params?.limit === void 0 ? {} : { limit: params.limit },
 					...params?.range === void 0 ? {} : { range: params.range },
 					...params?.filter === void 0 ? {} : { filter: params.filter }
-				} }))).pipe(Effect.tap(() => observeActivityScope(actor))))), controls, CAPXUL_OPERATIONS.activity.list, deps.runPromise);
+				} })) : readActivityPage(indexerDeps, actor, controls, params)).pipe(Effect.tap(() => observeActivityScope(actor))))), controls, CAPXUL_OPERATIONS.activity.list, deps.runPromise);
 			},
 			summary: (params, options) => {
 				const controls = deps.invocationControls?.(options) ?? options;
-				return runPortEffect(captureActivityInput(() => Effect.succeed(activityActorField(params?.actor).actor)).pipe(Effect.flatMap((actor) => Effect.suspend(() => deps.convexCall.query(fns.activitySummary, copyInvocationObservation(controls, { input: {
+				return runPortEffect(captureActivityInput(() => Effect.succeed(activityActorField(params?.actor).actor)).pipe(Effect.flatMap((actor) => Effect.suspend(() => indexerDeps === void 0 ? deps.convexCall.query(fns.activitySummary, copyInvocationObservation(controls, { input: {
 					...actor === void 0 ? {} : { actor },
 					...params?.window === void 0 ? {} : { window: params.window }
-				} }))).pipe(Effect.tap(() => observeActivityScope(actor))))), controls, CAPXUL_OPERATIONS.activity.summary, deps.runPromise);
+				} })) : readActivitySummary(indexerDeps, actor, controls, params)).pipe(Effect.tap(() => observeActivityScope(actor))))), controls, CAPXUL_OPERATIONS.activity.summary, deps.runPromise);
 			},
 			get: (reference, options) => {
 				const controls = deps.invocationControls?.(options) ?? options;
@@ -18687,6 +19098,9 @@ const OBSERVED_CONVEX_ACTIONS = /* @__PURE__ */ new Set([
 	"org/actions:resumeBootstrapSubmission",
 	"org/actions:confirmBootstrap",
 	"org/actions:readTreasury",
+	"moneyExecution/actions:preparePermissionExecution",
+	"moneyExecution/actions:submitPermissionExecution",
+	"permission/actions:verify",
 	"moneyExecution/actions:preparePaymentExecution",
 	"moneyExecution/actions:abandonPaymentExecution",
 	"moneyExecution/actions:submitPaymentExecution",
@@ -18711,6 +19125,9 @@ const OBSERVED_CONVEX_QUERIES = /* @__PURE__ */ new Set([
 	"payroll/queries:groups",
 	"payroll/queries:terms",
 	"financialOps/queries:resolveRecipient",
+	"org/queries:me",
+	"permission/queries:read",
+	"permission/queries:authorize",
 	"identity/queries:loadByAuthUserId",
 	"smartAccount/queries:loadByAuthUserId",
 	"org/lifecycle:load"
@@ -18729,6 +19146,7 @@ const OBSERVED_CONVEX_MUTATIONS = /* @__PURE__ */ new Set([
 	"financialOps/requestsInbox:decline",
 	"payroll/mutations:saveGroup",
 	"payroll/mutations:removeGroup",
+	"permission/mutations:command",
 	"identity/mutations:create",
 	"identity/mutations:update",
 	"identity/mutations:completeOnboarding",
@@ -44732,8 +45150,33 @@ function toOrgMe(wire) {
 		observedAt: wire.observedAt
 	};
 }
+/**
+* The read runs through the canonical observed runner, so `org.me` owns one
+* `capxul_sdk_operation` record and one span like every other public method.
+*
+* The call-start invocation snapshot travels on the query arguments: the
+* Convex adapter reads it there and sends the browser linkage with the call,
+* so an account switch mid-flight cannot re-resolve the actor. A successful
+* read proves participation in this Organization, so the owning span carries
+* the verified Organization and the two authority booleans the backend
+* actually enforces. Labels and Budget caps stay off the record.
+*/
 function makeOrgMeMethod(deps, orgId) {
-	return (options) => runIfActive(options?.signal, CAPXUL_OPERATIONS.org.me, () => Effect.map(deps.convexCall.query(orgReadContract.me, { orgId }), toOrgMe));
+	return (options) => {
+		const controls = deps.invocationControls?.(options) ?? options;
+		return runCapxulEffect(Effect.gen(function* () {
+			const wire = yield* deps.convexCall.query(orgReadContract.me, copyInvocationObservation(controls, { orgId })).pipe(Effect.mapError((failure) => failure.publicError));
+			yield* Effect.annotateCurrentSpan({
+				verified_organization_id: orgId,
+				scope_kind: "organization",
+				can_manage_people: wire.capabilities.canManagePeople,
+				can_spend: wire.capabilities.canSpend,
+				budget_count: wire.budgets.length,
+				observed_at: wire.observedAt
+			}).pipe(Effect.catchCause(() => Effect.void));
+			return toOrgMe(wire);
+		}), controls, CAPXUL_OPERATIONS.org.me, deps.runPromise);
+	};
 }
 //#endregion
 //#region ../../packages/sdk/src/contract/permission.ts
@@ -44753,16 +45196,24 @@ function isAborted(signal) {
 */
 function observed(deps, operation, options, run) {
 	const controls = deps.invocationControls?.(options) ?? options;
+	let verifiedOrganizationId;
 	return runCapxulEffect(Effect.gen(function* () {
 		if (controls?.signal?.aborted === true) return yield* Effect.fail(Errors.cancelled({ operation }));
+		const parent = yield* Effect.currentSpan.pipe(Effect.orDie);
+		const captured = carryInvocationParentSpan(controls, parent);
 		const result = yield* Effect.tryPromise({
-			try: () => run(controls?.signal),
+			try: () => run(controls?.signal, captured, (orgId) => {
+				verifiedOrganizationId = orgId;
+			}),
 			catch: (cause) => cause instanceof CapxulError ? cause : Errors.unknown(cause)
 		});
 		return yield* result.ok ? Effect.succeed(result.value) : Effect.fail(result.error);
-	}), observationOnlyControls(controls), operation, deps.runPromise);
+	}).pipe(Effect.ensuring(Effect.suspend(() => verifiedOrganizationId === void 0 ? Effect.void : Effect.annotateCurrentSpan({
+		verified_organization_id: verifiedOrganizationId,
+		scope_kind: "organization"
+	})).pipe(Effect.catchCause(() => Effect.void)))), observationOnlyControls(controls), operation, deps.runPromise);
 }
-async function execute(deps, orgId, command, signal) {
+async function execute(deps, orgId, command, signal, controls, verifiedOrganization) {
 	if (isAborted(signal)) return {
 		ok: false,
 		error: Errors.cancelled({ operation: "permissions" })
@@ -44786,17 +45237,18 @@ async function execute(deps, orgId, command, signal) {
 		};
 	}
 	const executionFns = deps.executionFunctions ?? moneyExecutionContract;
-	const prepared = await runIfActive(signal, CAPXUL_OPERATIONS.permissions.prepareExecution, () => deps.convexCall.action(executionFns.preparePermissionExecution, { input: {
+	const prepared = await runIfActive(signal, CAPXUL_OPERATIONS.permissions.prepareExecution, () => withInvocationParentSpan(Effect.suspend(() => deps.convexCall.action(executionFns.preparePermissionExecution, copyInvocationObservation(controls, { input: {
 		orgId,
 		signerAddress,
 		command
-	} }));
+	} }))), controls), deps.runPromise);
 	if (!prepared.ok) return prepared;
 	const expectedSafe = deriveCapxulSafeAddress({ email: session.email });
 	if (prepared.value.chainId !== deps.chainId || prepared.value.signerAddress.toLowerCase() !== signerAddress.toLowerCase() || prepared.value.userOpSenderSafe.toLowerCase() !== expectedSafe.toLowerCase() || prepared.value.operation !== command.operation || prepared.value.orgId !== orgId || canonicalJson(prepared.value.command) !== canonicalJson(command)) return {
 		ok: false,
 		error: Errors.invalidInput("permission", "prepared authority mismatch")
 	};
+	verifiedOrganization(prepared.value.orgId);
 	if (isAborted(signal)) return {
 		ok: false,
 		error: Errors.cancelled({ operation: "permissions" })
@@ -44814,38 +45266,40 @@ async function execute(deps, orgId, command, signal) {
 		ok: false,
 		error: Errors.cancelled({ operation: "permissions" })
 	};
-	return runIfActive(void 0, CAPXUL_OPERATIONS.permissions.submitExecution, () => deps.convexCall.action(executionFns.submitPermissionExecution, { input: {
+	return runIfActive(void 0, CAPXUL_OPERATIONS.permissions.submitExecution, () => withInvocationParentSpan(Effect.suspend(() => deps.convexCall.action(executionFns.submitPermissionExecution, copyInvocationObservation(controls, { input: {
 		executionId: prepared.value.executionId,
 		signature
-	} }));
+	} }))), controls), deps.runPromise);
 }
 function makePermissionMethods(deps, orgId) {
 	const reads = deps.permissionFunctions ?? permissionContract;
 	const ops = CAPXUL_OPERATIONS.org.permissions;
+	const read = (signal, operation, controls) => runIfActive(signal, operation, () => withInvocationParentSpan(Effect.suspend(() => deps.convexCall.query(reads.read, copyInvocationObservation(controls, { orgId }))), controls), deps.runPromise);
+	const command = (operation, build, options) => observed(deps, operation, options, (signal, captured, verifiedOrganization) => execute(deps, orgId, build(), signal, captured, verifiedOrganization));
 	return {
-		create: (input, options) => observed(deps, ops.create, options, (signal) => execute(deps, orgId, {
+		create: (input, options) => command(ops.create, () => ({
 			operation: "create",
 			...input
-		}, signal)),
-		change: (input, options) => observed(deps, ops.change, options, (signal) => execute(deps, orgId, {
+		}), options),
+		change: (input, options) => command(ops.change, () => ({
 			operation: "change",
 			...input
-		}, signal)),
-		assign: (input, options) => observed(deps, ops.assign, options, (signal) => execute(deps, orgId, {
+		}), options),
+		assign: (input, options) => command(ops.assign, () => ({
 			operation: "assign",
 			...input
-		}, signal)),
-		revoke: (input, options) => observed(deps, ops.revoke, options, (signal) => execute(deps, orgId, {
+		}), options),
+		revoke: (input, options) => command(ops.revoke, () => ({
 			operation: "revoke",
 			...input
-		}, signal)),
-		replace: (input, options) => observed(deps, ops.replace, options, (signal) => execute(deps, orgId, {
+		}), options),
+		replace: (input, options) => command(ops.replace, () => ({
 			operation: "replace",
 			...input
-		}, signal)),
-		list: (options) => observed(deps, ops.list, options, (signal) => runIfActive(signal, CAPXUL_OPERATIONS.permissions.list, () => deps.convexCall.query(reads.read, { orgId }))),
-		get: (permissionId, options) => observed(deps, ops.get, options, async (signal) => {
-			const listed = await runIfActive(signal, CAPXUL_OPERATIONS.permissions.get, () => deps.convexCall.query(reads.read, { orgId }));
+		}), options),
+		list: (options) => observed(deps, ops.list, options, (signal, captured) => read(signal, CAPXUL_OPERATIONS.permissions.list, captured)),
+		get: (permissionId, options) => observed(deps, ops.get, options, async (signal, captured) => {
+			const listed = await read(signal, CAPXUL_OPERATIONS.permissions.get, captured);
 			if (!listed.ok) return listed;
 			return {
 				ok: true,
@@ -45716,7 +46170,10 @@ function makeOrgMethods(deps) {
 					},
 					...convexCall === void 0 ? {} : { convexCall }
 				}),
-				me: convexCall === void 0 ? orgMeUnavailable : makeOrgMeMethod({ convexCall }, String(orgId)),
+				me: convexCall === void 0 ? orgMeUnavailable : makeOrgMeMethod({
+					convexCall,
+					...observedRunnerDeps(deps)
+				}, String(orgId)),
 				async getLifecycle(options) {
 					if (options?.signal?.aborted) return {
 						ok: false,
@@ -45953,14 +46410,65 @@ function compareDecimal(first, second) {
 }
 //#endregion
 //#region ../../packages/sdk/src/surface/holdings.ts
+/** SPEC Freshness: past this block age the read is labelled stale. Nothing refuses. */
+const FRESHNESS_LIMIT_SECONDS = 60;
+/**
+* The Ponder balance view for one Safe as `CurrentHoldings`.
+*
+* The view is the signed sum of every indexed transfer, so the balance IS what
+* the chain said — there is no snapshot to go stale behind it. `observedAt` is
+* the indexed block's own timestamp, which is what the last-good label reads,
+* and `stale` is that block's age. A stopped indexer therefore shows an old
+* "as of" and the stale flag; it never turns the read into a refusal.
+*/
+function indexerHoldings(indexer, convexCall, overlay, actor, controls) {
+	return Effect.gen(function* () {
+		const scope = yield* convexCall.query(overlay, copyInvocationObservation(controls, actor?.kind === "organization" ? { input: { actor: {
+			kind: "organization",
+			orgId: actor.organizationId
+		} } } : { input: {} }));
+		if (scope.safe === null) return null;
+		const balances = yield* indexer.read("balance", {
+			safe: toAddress(scope.safe),
+			limit: INDEXER_MAX_LIMIT
+		});
+		const status = yield* indexer.status.pipe(Effect.catch(() => Effect.succeed([])));
+		const rows = [];
+		for (const balance of balances) {
+			const asset = configuredMoneyAssetById(balance.assetId);
+			if (asset === null || balance.amount < 0n) continue;
+			rows.push({
+				assetKind: "erc20",
+				tokenAddress: toAddress(asset.tokenAddress),
+				symbol: asset.symbol,
+				decimals: asset.decimals,
+				rawBalance: toWeiAmount(balance.amount.toString())
+			});
+		}
+		const chainId = balances[0]?.chainId ?? status[0]?.chainId;
+		if (chainId === void 0) return null;
+		const head = status.find((entry) => entry.chainId === chainId);
+		const nowSeconds = Math.floor(Date.now() / 1e3);
+		const headSeconds = head === void 0 ? void 0 : Number(head.blockTimestamp);
+		return {
+			actor: scope.actor,
+			chainId: toChainId(chainId),
+			observedAt: headSeconds === void 0 ? Date.now() : headSeconds * 1e3,
+			stale: headSeconds === void 0 || nowSeconds - headSeconds > FRESHNESS_LIMIT_SECONDS,
+			rows
+		};
+	}).pipe(Effect.catch(() => Effect.succeed(null)));
+}
 function makeHoldingsMethods(deps) {
 	const functions = deps.functions ?? holdingsContract;
+	const overlay = (deps.financialOpsFunctions ?? financialOpsContract).activityOverlay;
 	const read = (operation, actor, options, pick) => {
 		const controls = deps.invocationControls?.(options) ?? options;
-		return runCapxulEffect(retryIdempotentRead(deps.convexCall.action(functions.current, copyInvocationObservation(controls, actor?.kind === "organization" ? { actor: {
+		const convexSnapshot = retryIdempotentRead(deps.convexCall.action(functions.current, copyInvocationObservation(controls, actor?.kind === "organization" ? { actor: {
 			kind: "organization",
 			orgId: actor.organizationId
-		} } : {})), operation, deps.telemetry, controls).pipe(Effect.map(pick), Effect.mapError((error) => error.publicError)), controls, operation, deps.runPromise);
+		} } : {})), operation, deps.telemetry, controls).pipe(Effect.mapError((error) => error.publicError));
+		return runCapxulEffect((deps.indexerRead === void 0 ? convexSnapshot : indexerHoldings(deps.indexerRead, deps.convexCall, overlay, actor, controls).pipe(Effect.flatMap((current) => current === null ? convexSnapshot : Effect.succeed(current)))).pipe(Effect.map(pick)), controls, operation, deps.runPromise);
 	};
 	return {
 		current: (input, options) => read(CAPXUL_OPERATIONS.holdings.current, input?.actor, options, (snapshot) => snapshot),
@@ -46094,8 +46602,8 @@ const APPLIED_ACTION_BY_EVENT = {
 	RestoreSession: "none",
 	ResumeOtpEntry: "none",
 	Reset: "none",
-	SessionRestored: "none",
-	SessionAbsent: "none",
+	SessionRestored: "restoration",
+	SessionAbsent: "restoration",
 	EnsureAccount: "none",
 	ClaimAccount: "none",
 	RetryAccount: "none",
@@ -46107,8 +46615,8 @@ const APPLIED_ACTION_BY_EVENT = {
 	OtpFailed: "failed",
 	Verified: "verified",
 	VerifyFailed: "failed",
-	SessionRead: "none",
-	SessionReadFailed: "none",
+	SessionRead: "restoration",
+	SessionReadFailed: "restoration",
 	SignedOut: "signed-out",
 	SignOutFailed: "failed",
 	AccountAt: "none",
@@ -46134,6 +46642,49 @@ const authFailure = (record, reason, mode) => ({
 		...linkage(record)
 	}
 });
+/**
+* The label of the restore window every client boots into. A settled session
+* fact that left this label is the restoration result (#1962 R04); the same
+* facts from a signed-out or authenticated state are the routine session probe
+* that `getSession()` runs, and a probe is not a restoration attempt.
+*/
+const RESTORE_WINDOW = "restoring";
+/**
+* Which result the window settled on. `SessionRestored` and `SessionAbsent` are
+* the cache door and say it themselves. `ReadSession` is also valid inside the
+* window — `getSession()` drives it on a cache miss and its `SessionRead`
+* completion settles the window — so that one event reports both halves and the
+* state it produced is what separates them.
+*/
+const restorationOutcome = (event, state) => {
+	switch (event) {
+		case "SessionRestored": return "restored";
+		case "SessionAbsent": return "absent";
+		case "SessionReadFailed": return "failed";
+		case "SessionRead":
+			if (state.phase === "authenticated") return "restored";
+			return state.phase === "signed_out" ? "absent" : void 0;
+		default: return;
+	}
+};
+/**
+* The restore window's one result, or nothing when this settled session fact
+* belongs to a probe rather than to the window.
+*/
+const restorationObservation = (record, state) => {
+	if (record.slot !== "identity:session" || record.from !== RESTORE_WINDOW) return NONE;
+	const outcome = restorationOutcome(record.event, state);
+	if (outcome === void 0) return NONE;
+	return {
+		name: "access_recovery_completed",
+		props: {
+			recovery: "session_restoration",
+			outcome,
+			...outcome === "failed" && state.phase === "faulted" ? { reason_code: state.failure.code } : {},
+			...linkage(record)
+		}
+	};
+};
 const REFUSAL_EVENTS = /* @__PURE__ */ new Set([
 	"ClaimAccount",
 	"RetryAccount",
@@ -46178,6 +46729,7 @@ function mapIdentityProductObservation(record, state) {
 			name: "auth_signed_out",
 			props: linkage(record)
 		};
+		case "restoration": return restorationObservation(record, state);
 	}
 }
 const ignoreTransportFailure = (operation, operationName, eventName) => Effect.suspend(operation).pipe(Effect.catchCause(() => Effect.logWarning("identity.product.telemetry.dropped").pipe(Effect.annotateLogs({
@@ -46189,7 +46741,7 @@ function executeIdentityProductObservation(telemetry, record, state) {
 	if (mapped === null) return Effect.void;
 	copyInvocationObservation(record, mapped);
 	const invocationTelemetry = bindProductTelemetryInvocation(telemetry, mapped);
-	const after = () => mapped.name === "auth_verified" && state.phase === "authenticated" ? invocationTelemetry.identify({
+	const after = () => state.phase === "authenticated" && (mapped.name === "auth_verified" || mapped.name === "access_recovery_completed") ? invocationTelemetry.identify({
 		distinctId: state.session.authUserId,
 		traits: { email_domain: emailDomain(state.session.email) }
 	}) : mapped.name === "auth_signed_out" ? invocationTelemetry.reset() : Effect.void;
@@ -46234,6 +46786,51 @@ function startSignerReadinessOnClaim(actor, signer) {
 		browserSigner.ensureWalletReady?.().catch(() => {});
 	});
 }
+/**
+* Report the result of each signer readiness cycle (#1962 R04).
+*
+* The readiness store already carries the cycle boundary this needs, so no
+* public signer hook, second identity subscriber, or render counter is added.
+* `ensureOpenfortWalletReady` writes `recovering` synchronously when it starts
+* a cycle, and only the cycle that is still the current one writes `ready` or
+* `unavailable` (`create-openfort-browser-signer.ts:501-521`). Callers that
+* join a live cycle share that single write, and a `resetSession` writes
+* `unknown` first, so a cycle that a reset or an account replacement outran
+* reports nothing.
+*
+* The host context is bound when the cycle starts, so a person who signs out
+* and back in while a cycle runs cannot relabel the result that began under
+* the previous person. A signer with no readiness cycle — a node or dev key,
+* and a headless client whose requirement never opens the account lane —
+* writes no status and reports nothing.
+*/
+function observeSignerReadinessCycles(signer, telemetry, hostObservationSnapshot, runPromise) {
+	const statusStore = signer?.statusStore;
+	if (statusStore === void 0 || telemetry === void 0) return () => {};
+	let running = false;
+	let startContext;
+	return statusStore.subscribe((status) => {
+		if (status === "recovering") {
+			running = true;
+			startContext = hostObservationSnapshot?.();
+			return;
+		}
+		const cycleContext = startContext;
+		const completesCycle = running;
+		running = false;
+		startContext = void 0;
+		if (!completesCycle || status !== "ready" && status !== "unavailable") return;
+		const event = {
+			name: "access_recovery_completed",
+			props: {
+				recovery: "signer_readiness",
+				outcome: status
+			}
+		};
+		if (cycleContext !== void 0) attachInvocationObservation(event, cycleContext);
+		runPromise(Effect.suspend(() => bindProductTelemetryInvocation(telemetry, event).emit(event)).pipe(Effect.catchCause(() => Effect.void))).catch(() => {});
+	});
+}
 function assembleCapxulClient(input) {
 	const observation = input;
 	const authCache = input.authCache ?? detectAuthCacheAdapter();
@@ -46263,12 +46860,14 @@ function assembleCapxulClient(input) {
 		}, failureObservation, normalizeCapxulOperation(`identity.${record.event}`), "machine");
 	});
 	const unsubscribeSignerReadiness = startSignerReadinessOnClaim(actor, input.signer);
+	const unsubscribeReadinessObservation = observeSignerReadinessCycles(input.signer, input.ports.telemetry, observation.hostObservationSnapshot, effectRunner.runPromise);
 	let stopPromise = null;
 	const stopActor = () => {
 		if (stopPromise === null) {
 			unsubscribeProductTelemetry();
 			unsubscribeFailureObservation();
 			unsubscribeSignerReadiness();
+			unsubscribeReadinessObservation();
 			stopPromise = effectRunner.runPromise(Scope.close(scope, Exit.void));
 		}
 		return stopPromise;
@@ -46285,7 +46884,8 @@ function assembleCapxulClient(input) {
 		convexCall: input.ports.convexCall,
 		...input.signer === void 0 ? {} : { signer: input.signer },
 		telemetry: input.ports.telemetry,
-		requestKeyScope: `${input.bootstrap.convexUrl}:${String(input.bootstrap.chainId)}`
+		requestKeyScope: `${input.bootstrap.convexUrl}:${String(input.bootstrap.chainId)}`,
+		...input.ports.indexerRead === void 0 ? {} : { indexerRead: input.ports.indexerRead }
 	});
 	const accountBundle = makeAccountMethods({
 		actor,
@@ -46356,7 +46956,8 @@ function assembleCapxulClient(input) {
 		convexCall: input.ports.convexCall,
 		telemetry: input.ports.telemetry,
 		runPromise: effectRunner.runPromise,
-		invocationControls: (controls) => withHostObservationControls(observation.hostObservationSnapshot, controls, actor.authSession()?.authUserId)
+		invocationControls: (controls) => withHostObservationControls(observation.hostObservationSnapshot, controls, actor.authSession()?.authUserId),
+		...input.ports.indexerRead === void 0 ? {} : { indexerRead: input.ports.indexerRead }
 	});
 	const accounts = makeAccountsMethods({
 		accountReadPort: input.ports.accountRead,
@@ -46563,36 +47164,6 @@ function snapshotHostObservability(observability) {
 	};
 }
 //#endregion
-//#region ../../packages/sdk/src/ports/indexer-read.ts
-/** The indexer's own page bound. Exceeding it is a caller defect, not a refusal. */
-const INDEXER_MAX_LIMIT = 1e3;
-const LOWER_CASE_ADDRESS = /^0x[0-9a-f]{40}$/;
-/**
-* Refuse a page the indexer would refuse, before any implementation spends a
-* round trip on it. Every implementation calls this, so a consumer test written
-* against the hermetic adapter cannot pass on input production rejects. Throws
-* a `CapxulError`; callers convert it to an `IndexerReadError`.
-*/
-function assertIndexerPage(input) {
-	const safe = String(input.safe).toLowerCase();
-	if (!LOWER_CASE_ADDRESS.test(safe)) throw Errors.invalidInput("safe", "must be a lower-case EVM address");
-	if (!Number.isSafeInteger(input.limit) || input.limit < 1 || input.limit > 1e3) throw Errors.invalidInput("limit", `must be an integer from 1 to ${INDEXER_MAX_LIMIT}`);
-	const offset = input.offset ?? 0;
-	if (!Number.isSafeInteger(offset) || offset < 0) throw Errors.invalidInput("offset", "must be a non-negative integer");
-	return safe;
-}
-var IndexerReadError = class extends Data.TaggedError("IndexerReadError") {};
-function indexerReadErrorFromCapxul(operation, error, cause = error) {
-	return new IndexerReadError({
-		operation,
-		publicCode: error.code,
-		publicError: error,
-		cause,
-		...error.details === void 0 ? {} : { details: error.details }
-	});
-}
-Context.Service()("@capxul/sdk/ports/IndexerReadPort");
-//#endregion
 //#region ../../packages/sdk/src/adapters/ponder/decode.ts
 /**
 * Decode the indexer's rows at the trust boundary.
@@ -46898,7 +47469,7 @@ var PonderIndexerAdapter = class {
 		}
 		if (stopped()) return;
 		const error = failure ?? Errors.capabilityUnavailable("indexer", operation);
-		observeStreamFailure(this.#observation, CAPXUL_OPERATIONS.activity.subscribe, error);
+		observeStreamFailure(this.#observation, CAPXUL_OPERATIONS.activity.subscribe, error, error.code === "NOT_AUTHENTICATED" ? "operation" : "exception");
 		callback({
 			status: "error",
 			error
@@ -47743,6 +48314,7 @@ function idempotentClose(close) {
 * and Convex see one session with one scope.
 */
 function productionIndexerReadPort(input, ports, observation) {
+	if (input.activityReadSource === "convex") return void 0;
 	if (input.indexerUrl === void 0 || input.indexerUrl === "") return void 0;
 	return new PonderIndexerAdapter({
 		baseUrl: normalizeHttpUrl("indexerUrl", input.indexerUrl),
@@ -48369,7 +48941,7 @@ function stdioIdentity(env = process.env, options = {}) {
 }
 //#endregion
 //#region package.json
-var version = "4.2.0-rc.10";
+var version = "4.2.0-rc.11";
 //#endregion
 //#region src/deps.ts
 const NO_IDENTITY = async () => void 0;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@capxul/mcp",
-  "version": "4.2.0-rc.10",
+  "version": "4.2.0-rc.11",
   "private": false,
   "description": "Capxul MCP server for auth, Account readiness, identity, Organizations, relationships, requests, destinations, and testnet funding over Streamable HTTP.",
   "keywords": [
@@ -51,8 +51,8 @@
     "vite": "npm:@voidzero-dev/vite-plus-core@0.3.0",
     "vite-plus": "0.3.0",
     "@capxul/config": "0.3.0",
-    "@capxul/sdk": "4.2.0-rc.10",
-    "@capxul/typescript-config": "0.0.0"
+    "@capxul/typescript-config": "0.0.0",
+    "@capxul/sdk": "4.2.0-rc.11"
   },
   "scripts": {
     "dev": "vp exec tsx src/main.ts serve",