@capxul/mcp 4.2.0-rc.6 → 4.2.0-rc.8

package/dist/capxul-source.json

@@ -1,11 +1,11 @@
 {
   "source": {
-    "commit": "8e8ae6c3c56c5d5260c469cf8e4e7bbe172a098f",
-    "tree": "6fcb3062a577d0af2b426b2e50ef92c0d9027701",
+    "commit": "29f8bbef5a60b623572ba982e895a10b47aaba27",
+    "tree": "9d831c3273591ecc4767094f887088781e786531",
     "branch": "codex/programme-rc",
     "repository": "https://github.com/Xelmar-tech/infrastructure",
     "lockfileSha256": "5870f53b72706d103220c1bcf733cb4fb71196aea32a9cfbdc277d73cc959264"
   },
   "name": "@capxul/mcp",
-  "version": "4.2.0-rc.6"
+  "version": "4.2.0-rc.8"
 }

package/dist/main.mjs

@@ -8536,6 +8536,8 @@ const BootstrapEnvelope = Schema.Struct({
 		siteBaseUrl: Schema.String,
 		openfortPublishableKey: Schema.String,
 		shieldPublishableKey: Schema.String,
+		/** Which Openfort third-party auth provider the signer presents; absent means better-auth. */
+		openfortAuthProvider: Schema.optional(Schema.Literals(["better-auth", "oidc"])),
 		engineeringTelemetry: Schema.optional(EngineeringTelemetryBootstrapPolicy)
 	})
 });
@@ -8658,8 +8660,7 @@ const CAPXUL_FUNCTIONS = {
 		listMine: "org/queries:listMine",
 		listRolesByOrgId: "org/queries:listRolesByOrgId",
 		loadByOrgId: "org/queries:loadByOrgId",
-		me: "org/queries:me",
-		pendingSetup: "org/queries:pendingSetup"
+		me: "org/queries:me"
 	},
 	"smartAccount/actions": {
 		claim: "smartAccount/actions:claim",
@@ -12258,7 +12259,7 @@ const moneyExecutionContract = {
 };
 //#endregion
 //#region ../../packages/sdk/package.json
-var version$1 = "4.2.0-rc.6";
+var version$1 = "4.2.0-rc.8";
 //#endregion
 //#region ../../packages/sdk/src/telemetry/exception-projection.ts
 /** Fixed fallback for failures that have no safe message. */
@@ -15345,6 +15346,7 @@ var HttpBootstrapAdapter = class {
 					siteBaseUrl: normalizeRuntimeUrl("siteBaseUrl", decodedState.siteBaseUrl),
 					openfortPublishableKey: decodedState.openfortPublishableKey,
 					shieldPublishableKey: decodedState.shieldPublishableKey,
+					...decodedState.openfortAuthProvider === void 0 ? {} : { openfortAuthProvider: decodedState.openfortAuthProvider },
 					...decodedEngineeringTelemetry !== void 0 && Result.isSuccess(decodedEngineeringTelemetry) ? { engineeringTelemetry: decodedEngineeringTelemetry.success } : {}
 				};
 			},
@@ -19208,7 +19210,6 @@ function orgIdBody(orgId) {
 //#region ../../packages/sdk/src/adapters/org/ConvexOrganizationAdapter.ts
 const DEFAULT_FUNCTIONS$1 = {
 	listAll: makeFunctionReference(CAPXUL_FUNCTIONS["org/queries"].listAll),
-	pendingSetup: makeFunctionReference(CAPXUL_FUNCTIONS["org/queries"].pendingSetup),
 	listRoles: makeFunctionReference(CAPXUL_FUNCTIONS["org/queries"].listRolesByOrgId),
 	listMembers: makeFunctionReference(CAPXUL_FUNCTIONS["org/queries"].listMembersByOrgId),
 	readTreasury: makeFunctionReference(CAPXUL_FUNCTIONS["org/actions"].readTreasury),
@@ -19244,9 +19245,6 @@ var ConvexOrganizationAdapter = class {
 			return brandOrgView(wire, treasury, viewerRole);
 		})))), Effect.catchDefect((cause) => Effect.fail(toOrgError("listOrgs", cause))));
 	}
-	pendingSetup(input) {
-		return this.#convex.query(this.#fns.pendingSetup, copyInvocationObservation(input, {})).pipe(Effect.mapError((error) => orgErrorFromCapxul("pendingSetup", error.publicError, error)), Effect.map((wire) => wire === null ? null : { orgId: toOrgId(wire.orgId) }), Effect.catchDefect((cause) => Effect.fail(toOrgError("pendingSetup", cause))));
-	}
 	readTreasury(input) {
 		return this.#readTreasuryWire(input).pipe(Effect.catchDefect((cause) => Effect.fail(toOrgError("readTreasury", cause))));
 	}
@@ -42768,8 +42766,9 @@ function createOpenfortBrowserSignerFromBootstrap(bootstrap, options = {}) {
 		});
 		throw failOpenfort("configure", "no-secure-context", /* @__PURE__ */ new Error("Web Crypto unavailable: browser is not a secure context"));
 	}
-	function betterAuthSessionUrl() {
-		return `${authBaseUrl}/get-session`;
+	const authProvider = bootstrap.openfortAuthProvider ?? "better-auth";
+	function accessTokenUrl() {
+		return authProvider === "oidc" ? `${authBaseUrl}/convex/token` : `${authBaseUrl}/get-session`;
 	}
 	function encryptionSessionUrl() {
 		return `${authBaseUrl}/encryption-session`;
@@ -42792,7 +42791,7 @@ function createOpenfortBrowserSignerFromBootstrap(bootstrap, options = {}) {
 		tokenCalls += 1;
 		const tokenStartedAt = Date.now();
 		try {
-			const response = await fetch(betterAuthSessionUrl(), {
+			const response = await fetch(accessTokenUrl(), {
 				credentials: "include",
 				cache: "no-store"
 			});
@@ -42805,7 +42804,8 @@ function createOpenfortBrowserSignerFromBootstrap(bootstrap, options = {}) {
 				});
 				return null;
 			}
-			const token = (await response.json()).session?.token?.trim();
+			const body = await response.json();
+			const token = (authProvider === "oidc" ? body.token : body.session?.token)?.trim();
 			if (token === void 0 || token.length === 0) {
 				diagnostic?.trace("openfort.token", {
 					ok: false,
@@ -42817,6 +42817,7 @@ function createOpenfortBrowserSignerFromBootstrap(bootstrap, options = {}) {
 			diagnostic?.trace("openfort.token", {
 				ok: true,
 				tokenPresent: true,
+				provider: authProvider,
 				call: tokenCalls,
 				duration_ms: Date.now() - tokenStartedAt,
 				elapsed_ms: sinceCycleStart()
@@ -42835,7 +42836,7 @@ function createOpenfortBrowserSignerFromBootstrap(bootstrap, options = {}) {
 		baseConfiguration: { publishableKey: bootstrap.openfortPublishableKey },
 		shieldConfiguration: { shieldPublishableKey: bootstrap.shieldPublishableKey },
 		thirdPartyAuth: {
-			provider: o$13.BETTER_AUTH,
+			provider: authProvider === "oidc" ? o$13.OIDC : o$13.BETTER_AUTH,
 			getAccessToken: fetchBetterAuthAccessToken
 		}
 	});
@@ -46027,43 +46028,6 @@ function startSignerReadinessOnClaim(actor, signer) {
 		browserSigner.ensureWalletReady?.().catch(() => {});
 	});
 }
-/**
-* Attach a pending Organization when the identity becomes claimed.
-*
-* A reload during Organization setup used to leave the app re-submitting the
-* stored draft, and that second submission raced the controller's resume on
-* `ReadSession` — the loser was refused with `SUPERSEDED`. The backend already
-* knows the truth: `pendingSetup()` reports the owner's Organization whose
-* setup has not finished. The SDK asks once per authenticated user and sends
-* `AttachOrganization`, which the identity flow runs as `orgLane(…, attach)`.
-* The app then re-submits nothing.
-*
-* The read is fire-and-forget, as the signer readiness cycle is: a failure is
-* swallowed and the ask is released, so the next state change retries. The ask
-* is held to ONE per authUserId, so the claimed transitions that follow (the
-* org lane's own) start no second read, and a new session asks again.
-*/
-function attachPendingOrganizationOnClaim(actor, organizationPort) {
-	const pendingSetup = organizationPort?.pendingSetup?.bind(organizationPort);
-	if (pendingSetup === void 0) return () => {};
-	let askedFor = null;
-	return actor.subscribe((state) => {
-		if (state.phase !== "authenticated" || state.account.at !== "claimed") return;
-		if (state.account.org !== null) return;
-		const authUserId = state.session.authUserId;
-		if (askedFor === authUserId) return;
-		askedFor = authUserId;
-		Effect.runPromise(pendingSetup({})).then((pending) => {
-			if (pending === null) return;
-			return Effect.runPromise(actor.ask({
-				_tag: "AttachOrganization",
-				orgId: String(pending.orgId)
-			}));
-		}).catch(() => {
-			askedFor = null;
-		});
-	});
-}
 function assembleCapxulClient(input) {
 	const observation = input;
 	const authCache = input.authCache ?? detectAuthCacheAdapter();
@@ -46093,20 +46057,18 @@ function assembleCapxulClient(input) {
 		}, failureObservation, normalizeCapxulOperation(`identity.${record.event}`), "machine");
 	});
 	const unsubscribeSignerReadiness = startSignerReadinessOnClaim(actor, input.signer);
-	const selectedOrgPort = input.orgPort ?? input.orgDeploymentPort;
-	const unsubscribePendingOrganization = attachPendingOrganizationOnClaim(actor, selectedOrgPort);
 	let stopPromise = null;
 	const stopActor = () => {
 		if (stopPromise === null) {
 			unsubscribeProductTelemetry();
 			unsubscribeFailureObservation();
 			unsubscribeSignerReadiness();
-			unsubscribePendingOrganization();
 			stopPromise = effectRunner.runPromise(Scope.close(scope, Exit.void));
 		}
 		return stopPromise;
 	};
 	if (input.signal !== void 0) input.signal.addEventListener("abort", () => void stopActor(), { once: true });
+	const selectedOrgPort = input.orgPort ?? input.orgDeploymentPort;
 	let detectPendingOrgInvitations;
 	let kickProvisioning;
 	const financialOps = makeFinancialOpsMethods({
@@ -47793,7 +47755,7 @@ function stdioIdentity(env = process.env, options = {}) {
 }
 //#endregion
 //#region package.json
-var version = "4.2.0-rc.6";
+var version = "4.2.0-rc.8";
 //#endregion
 //#region src/deps.ts
 const NO_IDENTITY = async () => void 0;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@capxul/mcp",
-  "version": "4.2.0-rc.6",
+  "version": "4.2.0-rc.8",
   "private": false,
   "description": "Capxul MCP server for auth, Account readiness, identity, Organizations, relationships, requests, destinations, and testnet funding over Streamable HTTP.",
   "keywords": [
@@ -51,8 +51,8 @@
     "vite": "npm:@voidzero-dev/vite-plus-core@0.3.0",
     "vite-plus": "0.3.0",
     "@capxul/config": "0.3.0",
-    "@capxul/sdk": "4.2.0-rc.6",
-    "@capxul/typescript-config": "0.0.0"
+    "@capxul/typescript-config": "0.0.0",
+    "@capxul/sdk": "4.2.0-rc.8"
   },
   "scripts": {
     "dev": "vp exec tsx src/main.ts serve",