@capxul/mcp 4.2.0-rc.9 → 4.20.0-beta.1

package/dist/main.mjs

@@ -8,9 +8,9 @@ import { createHash } from "node:crypto";
 import { createServer } from "node:http";
 import { localhostHostValidation, localhostOriginValidation, toNodeHandler } from "@modelcontextprotocol/node";
 import { z } from "zod";
-import { Cause, Clock, Context, Data, Deferred, Duration, Effect, Exit, Fiber, FiberSet, Layer, Option, Queue, Ref, Result, Schedule, Schema, SchemaGetter, SchemaIssue, SchemaParser, Scope, Stream, Tracer } from "effect";
-import { FetchHttpClient, Headers, HttpClient } from "effect/unstable/http";
-import { OtlpExporter, OtlpLogger, OtlpSerialization, OtlpTracer } from "effect/unstable/observability";
+import { Cause, Clock, Context, Data, Deferred, Duration, Effect, Exit, Fiber, FiberSet, Layer, Logger, Option, Queue, Ref, Result, Schedule, Schema, SchemaGetter, SchemaIssue, SchemaParser, Scope, Stream, Tracer } from "effect";
+import { FetchHttpClient, Headers, HttpBody, HttpClient, HttpClientResponse, HttpTraceContext } from "effect/unstable/http";
+import { OtlpExporter, OtlpLogger, OtlpMetrics, OtlpSerialization, OtlpTracer } from "effect/unstable/observability";
 import { resolve } from "path";
 import util from "util";
 import stream, { Readable } from "stream";
@@ -127,14 +127,19 @@ function redactUrlSecrets(value, source) {
 			changed ||= safeName !== name || safeEntry !== entry;
 			return [safeName, safeEntry];
 		})).toString();
-		const provider = source !== void 0 || /(?:^|\.)(?:alchemy\.com|alchemyapi\.io|infura\.io)$/iu.test(url.hostname);
-		const segments = (absolute || protocolRelative ? url.pathname : value.split(/[?#]/u)[0] ?? "").split("/");
-		const path = segments.map((segment, index) => {
+		const provider = source === "alchemy" || source === "infura" || /(?:^|\.)(?:alchemy\.com|alchemyapi\.io|infura\.io)$/iu.test(url.hostname);
+		const rawPath = absolute || protocolRelative ? url.pathname : value.split(/[?#]/u)[0] ?? "";
+		const segments = rawPath.split("/");
+		let path = segments.map((segment, index) => {
 			const decoded = decodeUrlComponent(segment);
 			const masked = provider && /^v[23]$/u.test(decodeUrlComponent(segments[index - 1] ?? "")) && decoded.length > 0 ? "[REDACTED]" : maskText(decoded);
 			changed ||= masked !== decoded;
 			return masked === decoded ? segment : encodeURIComponent(masked);
 		}).join("/");
+		if (source === "gateway" && rawPath.length > 0) {
+			path = `${rawPath.startsWith("/") ? "/" : ""}${encodeURIComponent("[REDACTED]")}`;
+			changed = true;
+		}
 		const query = maskParams(url.searchParams);
 		const fragment = url.hash.slice(1);
 		const decodedFragment = decodeUrlComponent(fragment);
@@ -149,6 +154,7 @@ function redactUrlSecrets(value, source) {
 		if (!changed) return value;
 		return `${origin}${path}${query ? `?${query}` : ""}${hash ? `#${hash}` : ""}`;
 	} catch {
+		if (source === "gateway") return "[REDACTED]";
 		return maskText(value.replace(/(https?:\/\/)[^/\s@]+@/giu, "$1[REDACTED]@").replace(/([?&#])([^=&#]+)=([^&#]*)/gu, (whole, separator, name) => isCredentialField(decodeUrlComponent(name)) || /^(?:code|draft|__posthog)$/iu.test(decodeUrlComponent(name)) ? `${separator}${name}=[REDACTED]` : whole));
 	}
 }
@@ -931,6 +937,10 @@ function toChainId(raw) {
 	if (typeof raw !== "number" || !Number.isSafeInteger(raw) || raw <= 0) throw Errors.invalidInput("chainId", invalidValueReason("must be a positive safe integer", raw));
 	return raw;
 }
+function toWeiAmount(raw) {
+	if (typeof raw !== "string" || !WEI_RE.test(raw)) throw Errors.invalidInput("weiAmount", invalidValueReason("must be a non-negative integer string", raw));
+	return raw;
+}
 function toCountryCode(raw) {
 	if (typeof raw !== "string") throw Errors.invalidInput("countryCode", "must be a string");
 	const upper = raw.toUpperCase();
@@ -1087,8 +1097,18 @@ const SYNTHETIC_TEST_ASSETS = [
 	}
 ];
 toChainId(84532);
-[...CONFIGURED_MONEY_ASSETS, ...SYNTHETIC_TEST_ASSETS];
+/**
+* Every known asset in ONE identity space. The tiers above declare admission;
+* this is the only list an identity resolves against, so an asset is never
+* two different things depending on which list a caller happened to read.
+*/
+const MONEY_ASSET_REGISTRY = [...CONFIGURED_MONEY_ASSETS, ...SYNTHETIC_TEST_ASSETS];
 CONFIGURED_MONEY_ASSETS.map((asset) => asset.tokenAddress.toLowerCase());
+/** The registry row for `assetId` across every tier, or `null`. */
+function configuredMoneyAssetById(assetId) {
+	const canonical = toAssetId(assetId);
+	return MONEY_ASSET_REGISTRY.find((asset) => asset.assetId === canonical) ?? null;
+}
 //#endregion
 //#region ../../node_modules/.pnpm/abitype@1.2.3_typescript@7.0.2_zod@4.4.3/node_modules/abitype/dist/esm/regex.js
 function execTyped(regex, string) {
@@ -6933,8 +6953,12 @@ const CAPXUL_OPERATIONS = {
 		cancelRequest: "financialOps.cancelRequest",
 		createPayee: "financialOps.createPayee",
 		declineRequest: "financialOps.declineRequest",
+		emitInvoiceIssued: "financialOps.emitInvoiceIssued",
+		emitInvoiceRequestTransitioned: "financialOps.emitInvoiceRequestTransitioned",
 		emitPaymentWriterTelemetry: "financialOps.emitPaymentWriterTelemetry",
 		issueRequest: "financialOps.issueRequest",
+		migrateEvidenceIdentity: "financialOps.migrateEvidenceIdentity",
+		planEvidenceIdentity: "financialOps.planEvidenceIdentity",
 		recoverSettlementVerification: "financialOps.recoverSettlementVerification",
 		removeDestination: "financialOps.removeDestination",
 		verifySettlement: "financialOps.verifySettlement"
@@ -6943,6 +6967,7 @@ const CAPXUL_OPERATIONS = {
 		current: "holdings.current",
 		primary: "holdings.primary"
 	},
+	indexer: { reconcile: "indexer.reconcile" },
 	identity: {
 		accountAt: "identity.AccountAt",
 		accountClaimed: "identity.AccountClaimed",
@@ -7032,6 +7057,7 @@ const CAPXUL_OPERATIONS = {
 		createOrg: "org.createOrg",
 		create: "org.create",
 		detectAndAcceptPendingInvitations: "org.detectAndAcceptPendingInvitations",
+		emitInviteProgressed: "org.emitInviteProgressed",
 		expireInvitations: "org.expireInvitations",
 		getLifecycle: "org.getLifecycle",
 		getProofReceipt: "org.getProofReceipt",
@@ -7135,6 +7161,8 @@ const CAPXUL_OPERATIONS = {
 	recipient: { resolve: "recipient.resolve" },
 	payroll: {
 		authorizeRun: "payroll.authorizeRun",
+		emitGroupChanged: "payroll.emitGroupChanged",
+		emitRunTransitioned: "payroll.emitRunTransitioned",
 		groups: {
 			access: "payroll.groups",
 			list: "payroll.groups.list",
@@ -7266,6 +7294,10 @@ const OptionalAccountId = Schema.optional(AccountIdSchema$1);
 const OptionalWeiAmount = Schema.optional(WeiAmountSchema$1);
 const OptionalCurrencyCode = Schema.optional(CurrencyCodeSchema$1);
 const OptionalBalanceBucket = Schema.optional(BalanceBucketSchema);
+/** Which Safe a money record is about. Declared here so the money-domain
+* props below can name it as well as the UI-step props further down. */
+const AccountKindSchema = Schema.Literals(["personalSafe", "orgTreasury"]);
+const OptionalAccountKind = Schema.optional(AccountKindSchema);
 const OptionalAddress = Schema.optional(AddressSchema$1);
 const OptionalAppId = Schema.optional(AppIdSchema$1);
 const OptionalBlockNumber = Schema.optional(BlockNumberSchema$1);
@@ -7418,9 +7450,22 @@ const BootstrapFailedProps = Schema.Struct({
 	reason: OptionalString,
 	target_host: OptionalString
 });
+/**
+* R08 (#1966): which Safe was read, on which chain, of which token. `currency`
+* is the DISPLAY code the surface shows ("USD"); it never says which ERC-20 the
+* `balanceOf` actually hit, so a reader could not tell a treasury read from a
+* personal one, nor USDX from any other dollar-labelled token. The producer
+* takes each of these from the authority that already decided it — the verified
+* Organization row's chain, the configured token address — never from a label.
+* The verified `organization_id` and its group arrive from the backend
+* attribution, so they are not repeated here.
+*/
 const AccountBalanceReadProps = Schema.Struct({
 	...TelemetryEnvelopeProps,
 	account_id: OptionalAccountId,
+	account_kind: OptionalAccountKind,
+	chain_id: OptionalChainId,
+	token_address: OptionalAddress,
 	currency: OptionalCurrencyCode,
 	balance_bucket: OptionalBalanceBucket,
 	durationMs: OptionalDurationMs
@@ -7788,7 +7833,27 @@ const PermissionMirrorVerificationProps = Schema.Struct({
 		"conflicting_replay",
 		"revision_mismatch"
 	])),
-	command_id: OptionalString
+	command_id: OptionalString,
+	/**
+	* #1961 R03. The authorized stored row names the Permission it changed; the
+	* verified receipt names the chain facts that prove it. Every field is
+	* optional because a pending or provider-failed verification has neither an
+	* application result nor a receipt to report.
+	*/
+	permission_id: OptionalString,
+	permission_assignment_id: OptionalString,
+	permission_operation: Schema.optional(Schema.Literals([
+		"create",
+		"change",
+		"assign",
+		"revoke",
+		"replace"
+	])),
+	revision: Schema.optional(Schema.Number),
+	user_op_hash: OptionalString,
+	transaction_hash: OptionalString,
+	block_number: Schema.optional(Schema.Number),
+	log_index: Schema.optional(Schema.Number)
 });
 const MovementScanWindowProps = Schema.Struct({
 	...TelemetryEnvelopeProps,
@@ -7814,6 +7879,33 @@ const MovementScanIncidentProps = Schema.Struct({
 	incident_kind: Schema.String,
 	anchor_block_number: Schema.Number
 });
+/**
+* One durable row the reconciliation job corrected against Ponder (SPEC D9).
+*
+* Both block fields are optional and for the same reason: a correction INTO
+* drift (a Payment settled in Convex whose Ponder fact a reorg removed) has no
+* current block, and a correction that confirms a later fact has one.
+*
+* `projection_kind` is closed. A later ticket that reconciles a deploy, a
+* bootstrap or a grant outcome adds its kind here in the same change; an
+* unknown kind must not decode.
+*/
+const IndexerDriftCorrectedProps = Schema.Struct({
+	...TelemetryEnvelopeProps,
+	projection_kind: Schema.Literals([
+		"member_authority",
+		"payment_settlement",
+		"permission_assignment"
+	]),
+	previous_state: Schema.String,
+	current_state: Schema.String,
+	previous_block: Schema.optional(Schema.Number),
+	current_block: Schema.optional(Schema.Number),
+	logical_event_id: Schema.optional(Schema.String),
+	scope_kind: Schema.optional(Schema.Literals(["account", "organization"])),
+	account_id: OptionalAccountId,
+	reference_id: OptionalString
+});
 Schema.Struct({
 	name: Schema.Literal("auth_otp_requested"),
 	props: AuthOtpRequestedProps
@@ -8018,9 +8110,12 @@ Schema.Struct({
 	name: Schema.Literal("movement_scan_incident"),
 	props: MovementScanIncidentProps
 });
+Schema.Struct({
+	name: Schema.Literal("indexer_drift_corrected"),
+	props: IndexerDriftCorrectedProps
+});
 /** The one spelling of "whose scope did this happen in" across every surface. */
 const ScopeKindSchema = Schema.Literals(["account", "organization"]);
-const AccountKindSchema = Schema.Literals(["personalSafe", "orgTreasury"]);
 const OptionalReasonCode = Schema.optional(Schema.Literals(CAPXUL_ERROR_CODES));
 const ActivityReferenceProps = {
 	reference_kind: Schema.Literals(["payment", "movement"]),
@@ -8085,6 +8180,20 @@ const ContactActionProps = {
 	party_id: OptionalString,
 	reason_code: OptionalReasonCode
 };
+Schema.Struct({
+	name: Schema.Literal("cli_diagnostic_completed"),
+	props: Schema.Struct({
+		...TelemetryEnvelopeProps,
+		outcome: Schema.Literals([
+			"succeeded",
+			"refused",
+			"failed",
+			"cancelled"
+		]),
+		invocation_id: Schema.String.check(Schema.isPattern(/^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/u)),
+		cli_version: Schema.String.check(Schema.isPattern(/^[A-Za-z0-9][A-Za-z0-9._+-]{0,127}$/u))
+	})
+});
 Schema.Struct({
 	name: Schema.Literal("ui_contact_action_completed"),
 	props: Schema.Union([
@@ -8118,6 +8227,16 @@ Schema.Struct({
 Schema.Struct({
 	name: Schema.Literal("ui_activity_action_completed"),
 	props: Schema.Union([
+		Schema.Struct({
+			...ActivityActionProps,
+			action: Schema.Literal("read"),
+			outcome: Schema.Literals(["partial_displayed", "recovered"]),
+			surface: Schema.Literals([
+				"transactions",
+				"recent",
+				"summary"
+			])
+		}),
 		Schema.Struct({
 			...ActivityActionProps,
 			...ActivityFilterProps,
@@ -8334,6 +8453,12 @@ Schema.Struct({
 			"settled"
 		]),
 		run_id: Schema.String,
+		/**
+		* The `paymentCommands` row at `payrollRuns.batchRef` — the durable owner of
+		* this run's Payment membership. `payment_count` counts THAT command's
+		* `paymentIds`, so an unrelated Payment quoting the run id changes neither.
+		*/
+		command_id: OptionalString,
 		payment_count: Schema.optional(Schema.Number),
 		occurred_at: Schema.Number
 	})
@@ -8359,6 +8484,71 @@ function redactTelemetryProps(name, props, options = {}) {
 	for (const key of PII_PROP_KEYS_BY_EVENT[name] ?? []) redactProperty(clone, key);
 	return clone;
 }
+/** In unstructured bodies, preserve text around explicitly named credentials. */
+const NETWORK_FIELD = /((?:"?)([A-Za-z_][A-Za-z0-9_.-]*)(?:"?)\s*[:=]\s*)("(?:[^"\\]|\\.)*"|'(?:[^'\\]|\\.)*'|[^\s,;&}]+)/gu;
+function maskNetworkText(text, context) {
+	return redactSecrets(text).replace(NETWORK_FIELD, (whole, prefix, name, value) => {
+		if (!isCredentialField(name, context)) return whole;
+		const quote = value.startsWith("\"") ? "\"" : value.startsWith("'") ? "'" : "";
+		return `${prefix}${quote}[REDACTED]${quote}`;
+	});
+}
+function maskNetworkHeaders(headers) {
+	if (headers === void 0) return void 0;
+	const masked = {};
+	for (const [name, value] of Object.entries(headers)) masked[name] = isCredentialField(name, "header") ? "[REDACTED]" : /^(?:location|content-location|referer)$/iu.test(name) ? redactUrlSecrets(value) : maskNetworkText(value);
+	return masked;
+}
+function maskJsonValue(value, depth = 0, context) {
+	if (typeof value === "function" || typeof value === "symbol") return "[UNREADABLE]";
+	if (typeof value === "string") return maskNetworkText(value, context);
+	if (typeof value !== "object" || value === null) return value;
+	if (depth >= 16) return "[REDACTED]";
+	if (Array.isArray(value)) return value.map((item) => maskJsonValue(item, depth + 1, context));
+	const masked = Object.create(null);
+	for (const [key, descriptor] of Object.entries(Object.getOwnPropertyDescriptors(value))) {
+		if (!descriptor.enumerable) continue;
+		masked[key] = isCredentialField(key, context) ? "[REDACTED]" : !("value" in descriptor) ? "[UNREADABLE]" : typeof descriptor.value === "string" && isPostHogUrlProperty(key) ? redactUrlSecrets(descriptor.value) : maskJsonValue(descriptor.value, depth + 1, context);
+	}
+	return masked;
+}
+function maskNetworkBody(body, context) {
+	try {
+		if (typeof body !== "string") return maskJsonValue(body, 0, context);
+		let parsed;
+		try {
+			parsed = JSON.parse(body);
+		} catch {
+			if (/^[^=&\s]+=[\s\S]*$/u.test(body)) return new URLSearchParams(Array.from(new URLSearchParams(body), ([name, value]) => [name, isCredentialField(name, context) ? "[REDACTED]" : maskNetworkText(value)])).toString();
+			return maskNetworkText(body, context);
+		}
+		return JSON.stringify(maskJsonValue(parsed, 0, context));
+	} catch {
+		return "[UNREADABLE]";
+	}
+}
+/** Keep request evidence while masking credential values at the browser boundary. */
+function maskCapturedNetworkRequest(request) {
+	const requestUrl = request.name ?? request.url ?? "";
+	let context;
+	try {
+		const path = new URL(requestUrl, "https://capxul.invalid").pathname;
+		if (/\/(?:auth|oauth|sign-in|signin|login|verify-otp|verify-email)(?:\/|$)/iu.test(path)) context = "authentication";
+	} catch {}
+	return {
+		...request,
+		...request.name === void 0 ? {} : { name: redactUrlSecrets(request.name) },
+		...request.url === void 0 ? {} : { url: redactUrlSecrets(request.url) },
+		requestHeaders: maskNetworkHeaders(request.requestHeaders),
+		responseHeaders: maskNetworkHeaders(request.responseHeaders),
+		requestBody: maskNetworkBody(request.requestBody, context),
+		responseBody: maskNetworkBody(request.responseBody)
+	};
+}
+function isPostHogUrlProperty(key) {
+	const normalized = key.toLowerCase();
+	return normalized.includes("url") || normalized.includes("referrer") || normalized.includes("path") || normalized.includes("filename");
+}
 const PII_PROP_KEYS_BY_EVENT = {
 	auth_otp_requested: ["email"],
 	auth_otp_delivered: ["email"],
@@ -8713,6 +8903,7 @@ const CAPXUL_FUNCTIONS = {
 		list: "movement/activity:list",
 		summary: "movement/activity:summary"
 	},
+	"movement/annotations": { overlay: "movement/annotations:overlay" },
 	"moneyExecution/actions": {
 		abandonPaymentExecution: "moneyExecution/actions:abandonPaymentExecution",
 		preparePermissionExecution: "moneyExecution/actions:preparePermissionExecution",
@@ -8790,7 +8981,10 @@ const CAPXUL_FUNCTIONS = {
 		isUserOperationReceiptHeld: "e2eControls:isUserOperationReceiptHeld",
 		releaseUserOperationReceipt: "e2eControls:releaseUserOperationReceipt"
 	},
-	system: { health: "system:health" }
+	system: {
+		health: "system:health",
+		healthObserved: "system:healthObserved"
+	}
 };
 //#endregion
 //#region ../../packages/wire/src/status.ts
@@ -9311,7 +9505,19 @@ const StoredPermissionCommandSchema = Schema.Struct({
 	roleKey: RoleKeySchema,
 	allowanceKey: Schema.NullOr(AllowanceKeySchema),
 	memberSafe: Schema.NullOr(SafeAddressSchema),
-	expectedAuthorityEvents: Schema.Array(Bytes32Schema)
+	expectedAuthorityEvents: Schema.Array(Bytes32Schema),
+	/**
+	* #1961 R03. The authenticated user who created the command, and the browser
+	* linkage captured with it. Delayed verification and bounded retries read
+	* this snapshot instead of the current viewer, so one command keeps one
+	* origin. Both are absent on commands created before this contract.
+	*
+	* The context stays `unknown` on purpose: `sanitizeObservationContext` owns
+	* the field allowlist, and every reader passes the stored value through it
+	* rather than repeating those rules here.
+	*/
+	originatingAuthUserId: Schema.optional(Schema.String),
+	originatingObservationContext: Schema.optional(Schema.Unknown)
 });
 Schema.Struct({
 	command: StoredPermissionCommandSchema,
@@ -9471,7 +9677,9 @@ const ExpectedPaymentCommonSchema = Schema.Struct({
 	chainId: BaseSepoliaChainIdSchema,
 	contractAddress: AddressSchema,
 	userOpHash: Bytes32Schema,
-	userOpSenderSafe: SafeAddressSchema
+	userOpSenderSafe: SafeAddressSchema,
+	/** Retained receipt location only; it cannot replace UserOperation or financial proof. */
+	recordedTransactionHash: Schema.optional(Bytes32Schema)
 });
 Schema.Union([
 	Schema.Struct({
@@ -9589,6 +9797,13 @@ Schema.Struct({
 	transfers: Schema.Array(TransferEvidenceSchema),
 	requestCount: nonNegativeInteger("requestCount")
 });
+/**
+* `chainId:txHash:transactionLogOrdinal` — the indexer's own row id. The
+* ordinal is the position in the transaction's receipt logs, never the
+* block-global index that `eventLogIndex` carries.
+*/
+const LOGICAL_EVENT_ID_RE = /^[1-9][0-9]{0,9}:0x[0-9a-f]{64}:(0|[1-9][0-9]{0,5})$/u;
+const LogicalEventIdSchema = Schema.String.pipe(Schema.refine((value) => LOGICAL_EVENT_ID_RE.test(value), { message: "must be chainId:txHash:transactionLogOrdinal" }));
 const VerifiedMoneyEvidenceCommonSchema = Schema.Struct({
 	chainId: BaseSepoliaChainIdSchema,
 	contractAddress: AddressSchema,
@@ -9597,7 +9812,18 @@ const VerifiedMoneyEvidenceCommonSchema = Schema.Struct({
 	blockNumber: BlockNumberSchema,
 	blockHash: Bytes32Schema,
 	blockTimestamp: Uint48Schema,
-	eventLogIndex: LogIndexSchema
+	/**
+	* The block-global log index of the settled event, as
+	* `eth_getTransactionReceipt` reports it. Both readers key on this value, and
+	* the ledger de-duplicates a settlement on `(txHash, eventLogIndex)`.
+	*/
+	eventLogIndex: LogIndexSchema,
+	/**
+	* Stable chain event identity. Ponder supplies its row id; the receipt-backed
+	* direct-send reader derives the same ordinal from the complete transaction
+	* receipt. Legacy and remaining Commitment readers can omit this field.
+	*/
+	logicalEventId: Schema.optional(LogicalEventIdSchema)
 });
 const VerifiedPaymentEvidenceSchema = Schema.Struct({
 	...VerifiedMoneyEvidenceCommonSchema.fields,
@@ -11145,7 +11371,9 @@ function verifiedOperationFields(attributes) {
 	for (const [key, allowed] of [
 		["scope_kind", ["account", "organization"]],
 		["account_kind", ["personalSafe", "orgTreasury"]],
-		["network", ["base-sepolia"]]
+		["network", ["base-sepolia"]],
+		["read_source", ["indexer", "convex"]],
+		["read_warning", ["indexer-unavailable"]]
 	]) {
 		const value = attributes.get(key);
 		if (typeof value === "string" && allowed.some((candidate) => candidate === value)) domain[key] = value;
@@ -11829,31 +12057,31 @@ function makeActorRelationshipMethods(deps) {
 					reference: input.reference,
 					...input.memo === void 0 ? {} : { memo: input.memo },
 					...input.expiresAt === void 0 ? {} : { expiresAt: input.expiresAt }
-				}))), (request) => mapActorRequest(request, input.payer)), controls, CAPXUL_OPERATIONS.requests.issue, deps.runPromise);
+				}))), (request) => mapActorRequest(request, input.payer)).pipe(Effect.tap(() => observeContactScope)), controls, CAPXUL_OPERATIONS.requests.issue, deps.runPromise);
 			},
 			list: (options) => {
 				const controls = deps.invocationControls?.(options) ?? options;
-				return runPortEffect(mapReply(CAPXUL_OPERATIONS.requests.list, Effect.suspend(() => convexCall.query(fns.requestsList, copyInvocationObservation(controls, { actor }))), (requests) => requests.map((request) => mapActorRequest(request))), controls, CAPXUL_OPERATIONS.requests.list, deps.runPromise);
+				return runPortEffect(mapReply(CAPXUL_OPERATIONS.requests.list, Effect.suspend(() => convexCall.query(fns.requestsList, copyInvocationObservation(controls, { actor }))), (requests) => requests.map((request) => mapActorRequest(request))).pipe(Effect.tap(() => observeContactScope)), controls, CAPXUL_OPERATIONS.requests.list, deps.runPromise);
 			},
 			get: (requestId, options) => {
 				const controls = deps.invocationControls?.(options) ?? options;
 				return runPortEffect(mapReply(CAPXUL_OPERATIONS.requests.get, Effect.suspend(() => convexCall.query(fns.requestsGet, copyInvocationObservation(controls, {
 					actor,
 					paymentRequestId: requestId
-				}))), (request) => request === null ? null : mapActorRequest(request)), controls, CAPXUL_OPERATIONS.requests.get, deps.runPromise);
+				}))), (request) => request === null ? null : mapActorRequest(request)).pipe(Effect.tap(() => observeContactScope)), controls, CAPXUL_OPERATIONS.requests.get, deps.runPromise);
 			},
 			cancel: (requestId, options) => {
 				const controls = deps.invocationControls?.(options) ?? options;
 				return runPortEffect(mapReply(CAPXUL_OPERATIONS.requests.cancel, Effect.suspend(() => convexCall.mutation(fns.requestsCancel, copyInvocationObservation(controls, {
 					actor,
 					paymentRequestId: requestId
-				}))), (request) => mapActorRequest(request)), controls, CAPXUL_OPERATIONS.requests.cancel, deps.runPromise);
+				}))), (request) => mapActorRequest(request)).pipe(Effect.tap(() => observeContactScope)), controls, CAPXUL_OPERATIONS.requests.cancel, deps.runPromise);
 			}
 		},
 		inbox: {
 			list: (options) => {
 				const controls = deps.invocationControls?.(options) ?? options;
-				return runPortEffect(mapReply(CAPXUL_OPERATIONS.inbox.list, Effect.suspend(() => convexCall.query(fns.inboxList, copyInvocationObservation(controls, { actor }))), (items) => items.map(mapInboxItem)), controls, CAPXUL_OPERATIONS.inbox.list, deps.runPromise);
+				return runPortEffect(mapReply(CAPXUL_OPERATIONS.inbox.list, Effect.suspend(() => convexCall.query(fns.inboxList, copyInvocationObservation(controls, { actor }))), (items) => items.map(mapInboxItem)).pipe(Effect.tap(() => observeContactScope)), controls, CAPXUL_OPERATIONS.inbox.list, deps.runPromise);
 			},
 			approve: (input, options) => {
 				const controls = deps.invocationControls?.(options) ?? options;
@@ -11865,14 +12093,14 @@ function makeActorRelationshipMethods(deps) {
 				}))).pipe(Effect.flatMap((prepared) => {
 					const result = mapApprovedInboxPayment(prepared, input);
 					return result.ok ? Effect.succeed(result.value) : Effect.fail({ publicError: result.error });
-				})), controls, CAPXUL_OPERATIONS.inbox.approve, deps.runPromise);
+				}), Effect.tap(() => observeContactScope)), controls, CAPXUL_OPERATIONS.inbox.approve, deps.runPromise);
 			},
 			decline: (requestId, options) => {
 				const controls = deps.invocationControls?.(options) ?? options;
 				return runPortEffect(mapReply(CAPXUL_OPERATIONS.inbox.decline, Effect.suspend(() => convexCall.mutation(fns.inboxDecline, copyInvocationObservation(controls, {
 					actor,
 					paymentRequestId: requestId
-				}))), mapInboxItem), controls, CAPXUL_OPERATIONS.inbox.decline, deps.runPromise);
+				}))), mapInboxItem).pipe(Effect.tap(() => observeContactScope)), controls, CAPXUL_OPERATIONS.inbox.decline, deps.runPromise);
 			}
 		},
 		profile: {
@@ -12361,6 +12589,7 @@ const financialOpsContract = {
 	activitySummary: makeFunctionReference(CAPXUL_FUNCTIONS["movement/activity"].summary),
 	activityGet: makeFunctionReference(CAPXUL_FUNCTIONS["movement/activity"].get),
 	activityAnnotate: makeFunctionReference(CAPXUL_FUNCTIONS["movement/activity"].annotate),
+	activityOverlay: makeFunctionReference(CAPXUL_FUNCTIONS["movement/annotations"].overlay),
 	verifyPaymentDocument: makeFunctionReference(CAPXUL_FUNCTIONS["financialOps/queries"].verifyPaymentDocument),
 	renderStoredDocument: makeFunctionReference(CAPXUL_FUNCTIONS["financialOps/queries"].renderStoredDocument)
 };
@@ -12377,8 +12606,383 @@ const moneyExecutionContract = {
 	submitPaymentCommandExecution: makeFunctionReference(CAPXUL_FUNCTIONS["moneyExecution/paymentCommandActions"].submitPaymentCommandExecution)
 };
 //#endregion
+//#region ../../packages/sdk/src/ports/indexer-read.ts
+/** The indexer's own page bound. Exceeding it is a caller defect, not a refusal. */
+const INDEXER_MAX_LIMIT = 1e3;
+const LOWER_CASE_ADDRESS = /^0x[0-9a-f]{40}$/;
+/**
+* Refuse a page the indexer would refuse, before any implementation spends a
+* round trip on it. Every implementation calls this, so a consumer test written
+* against the hermetic adapter cannot pass on input production rejects. Throws
+* a `CapxulError`; callers convert it to an `IndexerReadError`.
+*/
+function assertIndexerPage(input) {
+	const safe = String(input.safe).toLowerCase();
+	if (!LOWER_CASE_ADDRESS.test(safe)) throw Errors.invalidInput("safe", "must be a lower-case EVM address");
+	if (!Number.isSafeInteger(input.limit) || input.limit < 1 || input.limit > 1e3) throw Errors.invalidInput("limit", `must be an integer from 1 to ${INDEXER_MAX_LIMIT}`);
+	const offset = input.offset ?? 0;
+	if (!Number.isSafeInteger(offset) || offset < 0) throw Errors.invalidInput("offset", "must be a non-negative integer");
+	return safe;
+}
+var IndexerReadError = class extends Data.TaggedError("IndexerReadError") {};
+function indexerReadErrorFromCapxul(operation, error, cause = error) {
+	return new IndexerReadError({
+		operation,
+		publicCode: error.code,
+		publicError: error,
+		cause,
+		...error.details === void 0 ? {} : { details: error.details }
+	});
+}
+Context.Service()("@capxul/sdk/ports/IndexerReadPort");
+//#endregion
+//#region ../../packages/sdk/src/surface/activity-stitch.ts
+/** Epoch milliseconds of the block that carried the row. */
+function blockMillis(row) {
+	return Number(row.timestamp) * 1e3;
+}
+/** `0x1234…abcd` — the counterparty of an unclaimed transfer is an address. */
+function shortAddressLabel(address) {
+	return address.length <= 12 ? address : `${address.slice(0, 6)}…${address.slice(-4)}`;
+}
+function directionFor(safe, transfer) {
+	const from = transfer.from.toLowerCase();
+	const to = transfer.to.toLowerCase();
+	if (from === safe && to === safe) return "self";
+	return to === safe ? "in" : "out";
+}
+/**
+* The Transfer a protocol Payment moved is the same money as its `payment`
+* row. One actor sees one item for it, so the Transfer is claimed and does not
+* become a second row. Another transfer in the same transaction that this
+* payment did not move stays unclaimed and keeps its own row.
+*/
+function claimedTransferIds(transfers, payments) {
+	const claimed = /* @__PURE__ */ new Set();
+	for (const payment of payments) {
+		const match = transfers.find((transfer) => !claimed.has(transfer.id) && transfer.txHash === payment.txHash && transfer.token.toLowerCase() === payment.token.toLowerCase() && transfer.amount === payment.amount && transfer.to.toLowerCase() === payment.recipient.toLowerCase());
+		if (match !== void 0) claimed.add(match.id);
+	}
+	return claimed;
+}
+function withAnnotation(item, annotation) {
+	return annotation?.counterpartyLabel === void 0 ? item : {
+		...item,
+		counterpartyLabel: annotation.counterpartyLabel
+	};
+}
+/**
+* An indexed settlement confirms the intent. A missing row can be outside
+* this page or still backfilling; only the correction owner can prove rollback.
+*/
+function confirmPayment(intent, chain) {
+	if (chain !== void 0) return {
+		...intent,
+		status: "settled",
+		receipt: {
+			chainId: chain.chainId,
+			transactionHash: chain.txHash
+		},
+		updatedAt: blockMillis(chain)
+	};
+	return intent;
+}
+/**
+* One unclaimed Transfer as an Activity row, or `null` when this SDK cannot
+* denominate its asset. The indexer serves only configured assets, so a row
+* the registry does not know means the SDK and that deployment disagree; it is
+* dropped rather than shown with a guessed currency.
+*/
+function transferItem(safe, transfer, annotation) {
+	const asset = configuredMoneyAssetById(transfer.assetId);
+	if (asset === null) return null;
+	const direction = directionFor(safe, transfer);
+	const counterparty = direction === "in" ? transfer.from : transfer.to;
+	const at = blockMillis(transfer);
+	return withAnnotation({
+		kind: "movement",
+		id: transfer.id,
+		classification: "movement_only_outflow",
+		amount: {
+			currency: asset.peg ?? asset.symbol,
+			value: formatUnits(transfer.amount, asset.decimals),
+			decimals: asset.decimals
+		},
+		direction,
+		counterpartyLabel: shortAddressLabel(counterparty),
+		receipt: {
+			chainId: transfer.chainId,
+			transactionHash: transfer.txHash
+		},
+		createdAt: at,
+		updatedAt: at
+	}, annotation);
+}
+/** Newest first. A Payment precedes a Movement at one instant, as the ledger reader orders them. */
+function compareItems(left, right) {
+	if (right.createdAt !== left.createdAt) return right.createdAt - left.createdAt;
+	if (left.kind !== right.kind) return left.kind === "payment" ? -1 : 1;
+	if (left.id === right.id) return 0;
+	return left.id < right.id ? 1 : -1;
+}
+function stitchActivity(input) {
+	const safe = input.safe.toLowerCase();
+	const chainBySettlement = /* @__PURE__ */ new Map();
+	for (const row of input.payments) chainBySettlement.set(row.settlementId.toLowerCase(), row);
+	const chainByPaymentId = /* @__PURE__ */ new Map();
+	for (const link of input.links) {
+		const row = chainBySettlement.get(link.settlementId.toLowerCase());
+		if (row !== void 0) chainByPaymentId.set(link.paymentId, row);
+	}
+	const annotations = /* @__PURE__ */ new Map();
+	for (const annotation of input.annotations) annotations.set(`${annotation.reference.kind}:${annotation.reference.id}`, annotation);
+	const items = [];
+	const claiming = [];
+	for (const intent of input.intents) {
+		if (intent.kind !== "payment") continue;
+		const chain = chainByPaymentId.get(intent.id);
+		if (chain !== void 0) claiming.push(chain);
+		items.push(withAnnotation(confirmPayment(intent, chain), annotations.get(`payment:${intent.id}`)));
+	}
+	const claimed = claimedTransferIds(input.transfers, claiming);
+	for (const transfer of input.transfers) {
+		if (claimed.has(transfer.id)) continue;
+		const item = transferItem(safe, transfer, annotations.get(`movement:${transfer.id}`));
+		if (item !== null) items.push(item);
+	}
+	return items.sort(compareItems);
+}
+/** The reference ids one stitched page needs its Convex overlay for. */
+function overlayReferences(items) {
+	return items.map((item) => ({
+		kind: item.kind,
+		id: item.id
+	}));
+}
+/**
+* Money in, money out and the pending share, one bucket per currency and
+* precision. Two assets that peg to the same currency at different precision
+* stay distinct buckets: their raw units are not interchangeable.
+*/
+function summarizeItems(items) {
+	const buckets = /* @__PURE__ */ new Map();
+	for (const item of items) {
+		const key = `${item.amount.currency}:${String(item.amount.decimals)}`;
+		const bucket = buckets.get(key) ?? {
+			currency: item.amount.currency,
+			decimals: item.amount.decimals,
+			in: 0n,
+			out: 0n,
+			pendingIn: 0n
+		};
+		const raw = rawUnits(item.amount.value, item.amount.decimals);
+		if (item.kind === "payment" && item.status !== "settled") {
+			if (item.direction === "in" && item.status !== "cancelled" && item.status !== "failed") bucket.pendingIn += raw;
+		} else if (item.direction === "in") bucket.in += raw;
+		else if (item.direction === "out") bucket.out += raw;
+		buckets.set(key, bucket);
+	}
+	return [...buckets.values()].map((bucket) => ({
+		currency: bucket.currency,
+		decimals: bucket.decimals,
+		in: bucket.in.toString(),
+		out: bucket.out.toString(),
+		net: (bucket.in - bucket.out).toString(),
+		pendingIn: bucket.pendingIn.toString()
+	}));
+}
+/** The inverse of `formatUnits`, kept exact: `"1.25"` at 6 decimals is `1250000n`. */
+function rawUnits(value, decimals) {
+	const negative = value.startsWith("-");
+	const [whole = "0", fraction = ""] = (negative ? value.slice(1) : value).split(".");
+	const raw = BigInt(`${whole}${fraction.padEnd(decimals, "0").slice(0, decimals)}`);
+	return negative ? -raw : raw;
+}
+//#endregion
+//#region ../../packages/sdk/src/surface/activity-read.ts
+/** How many Convex intent rows one page reads for its labels and pending rows. */
+const INTENT_WINDOW = 100;
+/** movement/annotations:overlay bounds each identifier array to 200. */
+const MAX_OVERLAY_IDS = 200;
+/** The window a summary aggregates over. The indexer's own page bound. */
+const SUMMARY_WINDOW = INDEXER_MAX_LIMIT;
+function parseCursor(value) {
+	if (value === void 0) return 0;
+	try {
+		const parsed = JSON.parse(value);
+		return Number.isSafeInteger(parsed.offset) && parsed.offset >= 0 ? parsed.offset : 0;
+	} catch {
+		return 0;
+	}
+}
+function inRange(item, range) {
+	if (range?.from !== void 0 && item.createdAt < range.from) return false;
+	return range?.to === void 0 || item.createdAt <= range.to;
+}
+/** The caller's filter applied to the merged page. The join owns the order. */
+function matchesFilter(item, filter) {
+	if (filter === void 0) return true;
+	if (filter.kind !== void 0 && item.kind !== filter.kind) return false;
+	if (filter.direction !== void 0 && item.direction !== filter.direction) return false;
+	if (filter.status === void 0) return true;
+	return item.kind === "payment" && filter.status.includes(item.status);
+}
+function overlay(deps, actor, controls, input) {
+	const count = Math.max(input.references?.length ?? 0, input.settlementIds?.length ?? 0);
+	const offsets = Array.from({ length: Math.max(1, Math.ceil(count / MAX_OVERLAY_IDS)) }, (_, index) => index * MAX_OVERLAY_IDS);
+	return Effect.forEach(offsets, (offset) => deps.convexCall.query(deps.functions.activityOverlay, copyInvocationObservation(controls, { input: {
+		...actor === void 0 ? {} : { actor },
+		...input.references === void 0 ? {} : { references: input.references.slice(offset, offset + MAX_OVERLAY_IDS) },
+		...input.settlementIds === void 0 ? {} : { settlementIds: input.settlementIds.slice(offset, offset + MAX_OVERLAY_IDS) }
+	} })), { concurrency: 2 }).pipe(Effect.map((pages) => ({
+		...pages[0],
+		links: pages.flatMap((page) => page.links),
+		annotations: pages.flatMap((page) => page.annotations)
+	})));
+}
+function convexPage(deps, actor, controls, input) {
+	return deps.convexCall.query(deps.functions.activityList, copyInvocationObservation(controls, { input: {
+		...actor === void 0 ? {} : { actor },
+		...input.cursor === void 0 ? {} : { cursor: input.cursor },
+		...input.limit === void 0 ? {} : { limit: input.limit },
+		...input.range === void 0 ? {} : { range: input.range }
+	} }));
+}
+/** Both indexed tables for one Safe, or `null` when the indexer cannot answer. */
+function chainRows(deps, safe, limit) {
+	const page = {
+		safe,
+		limit: Math.min(limit, INDEXER_MAX_LIMIT)
+	};
+	return Effect.all([deps.indexer.read("transfer", page), deps.indexer.read("payment", page)], { concurrency: 2 }).pipe(Effect.map(([transfers, payments]) => ({
+		transfers,
+		payments
+	})), Effect.catch(() => Effect.succeed(null)));
+}
+/** The stitched, filtered rows of one window, newest first. */
+function stitchedWindow(deps, actor, controls, window, params) {
+	return Effect.gen(function* () {
+		const scope = yield* overlay(deps, actor, controls, {});
+		const convex = yield* convexPage(deps, actor, controls, {
+			limit: INTENT_WINDOW,
+			...params.range === void 0 ? {} : { range: params.range }
+		});
+		const rows = scope.safe === null ? null : yield* chainRows(deps, scope.safe, window);
+		if (rows === null || scope.safe === null) {
+			if (scope.safe !== null) yield* Effect.annotateCurrentSpan({
+				read_source: "convex",
+				read_warning: "indexer-unavailable"
+			});
+			return {
+				items: convex.items.filter((item) => matchesFilter(item, params.filter)),
+				stitched: false,
+				...scope.safe === null ? {} : { readWarning: "indexer-unavailable" }
+			};
+		}
+		yield* Effect.annotateCurrentSpan({ read_source: "indexer" });
+		const decoration = yield* overlay(deps, actor, controls, {
+			references: [...overlayReferences(convex.items), ...rows.transfers.map((row) => ({
+				kind: "movement",
+				id: row.id
+			}))],
+			settlementIds: rows.payments.map((row) => row.settlementId)
+		});
+		const intents = [...convex.items];
+		const missing = new Set(decoration.links.map((link) => link.paymentId));
+		for (const item of intents) if (item.kind === "payment") missing.delete(item.id);
+		let cursor = convex.cursor;
+		while (missing.size > 0 && cursor !== null) {
+			const page = yield* convexPage(deps, actor, controls, {
+				limit: INTENT_WINDOW,
+				cursor,
+				...params.range === void 0 ? {} : { range: params.range }
+			});
+			for (const item of page.items) if (item.kind === "payment" && missing.delete(item.id)) intents.push(item);
+			cursor = page.cursor;
+		}
+		const older = intents.slice(convex.items.length);
+		const olderDecoration = older.length === 0 ? [] : (yield* overlay(deps, actor, controls, { references: overlayReferences(older) })).annotations;
+		return {
+			items: stitchActivity({
+				safe: scope.safe,
+				transfers: rows.transfers,
+				payments: rows.payments,
+				intents,
+				links: decoration.links,
+				annotations: [...decoration.annotations, ...olderDecoration]
+			}).filter((item) => inRange(item, params.range) && matchesFilter(item, params.filter)),
+			stitched: true
+		};
+	});
+}
+function readActivityPage(deps, actor, controls, params) {
+	const limit = params?.limit ?? 25;
+	const offset = parseCursor(params?.cursor);
+	return stitchedWindow(deps, actor, controls, offset + limit + 1, {
+		...params?.range === void 0 ? {} : { range: params.range },
+		...params?.filter === void 0 ? {} : { filter: params.filter }
+	}).pipe(Effect.map(({ items, stitched, readWarning }) => {
+		const observedAt = Date.now();
+		if (!stitched) return {
+			items: items.slice(0, limit),
+			cursor: null,
+			checkpoint: observedAt,
+			observedAt,
+			...readWarning === void 0 ? {} : { readWarning }
+		};
+		return {
+			items: items.slice(offset, offset + limit),
+			cursor: items.length > offset + limit ? JSON.stringify({ offset: offset + limit }) : null,
+			checkpoint: observedAt,
+			observedAt
+		};
+	}));
+}
+function readActivitySummary(deps, actor, controls, params) {
+	return stitchedWindow(deps, actor, controls, SUMMARY_WINDOW, params?.window === void 0 ? {} : { range: params.window }).pipe(Effect.map(({ items, readWarning }) => ({
+		window: {
+			from: params?.window?.from ?? null,
+			to: params?.window?.to ?? null
+		},
+		totals: summarizeItems(items),
+		count: items.length,
+		observedAt: Date.now(),
+		...readWarning === void 0 ? {} : { readWarning }
+	})));
+}
+/**
+* Tell the caller when the indexed page for this Safe changed.
+*
+* The transport is the indexer's one SSE connection, wired in the Ponder
+* adapter under `activity.subscribe`. A reactive snapshot is not a product
+* event, so nothing here emits telemetry: the adapter reports a teardown, and
+* the caller re-reads.
+*/
+function subscribeActivity(deps, actor, controls, onChange) {
+	return Effect.gen(function* () {
+		const scope = yield* overlay(deps, actor, controls, {});
+		if (scope.safe === null) return () => {};
+		const page = {
+			safe: scope.safe,
+			limit: INTENT_WINDOW
+		};
+		let delivered = false;
+		const notify = () => {
+			if (delivered) onChange();
+			delivered = true;
+		};
+		return yield* deps.indexer.subscribe("transfer", page, (snapshot) => {
+			if (snapshot.status === "ok") notify();
+			if (snapshot.status === "error") {
+				delivered = true;
+				onChange();
+			}
+		});
+	});
+}
+//#endregion
 //#region ../../packages/sdk/package.json
-var version$1 = "4.2.0-rc.9";
+var version$1 = "4.20.0-beta.1";
 //#endregion
 //#region ../../packages/sdk/src/telemetry/exception-projection.ts
 /** Fixed fallback for failures that have no safe message. */
@@ -12480,10 +13084,15 @@ function observeFailedResult(result, adapter, operation, origin) {
 * A reactive stream is torn down after its call already returned, so nothing
 * downstream observes it. `captureException` is the right kind: the caller did
 * not ask for the end, so it is not an expected product outcome.
+*
+* A caller that DID ask for the end — the session it authenticated with
+* expired, and the service closed the stream on purpose — passes
+* `kind: "operation"` instead, so the refusal lands in the expected-outcome
+* stream its code already declares.
 */
-function observeStreamFailure(adapter, operation, cause) {
+function observeStreamFailure(adapter, operation, cause, kind = "exception") {
 	if (adapter === void 0) return;
-	report(adapter, "exception", operation, cause, resolveAdapterSnapshot(adapter));
+	report(adapter, kind, operation, cause, resolveAdapterSnapshot(adapter));
 }
 /**
 * One failure, one event. The identity machine reports a failed transition
@@ -13475,6 +14084,11 @@ function paymentExecutionIntent(input) {
 }
 function makeFinancialOpsMethods(deps) {
 	const fns = deps.functions ?? financialOpsContract;
+	const indexerDeps = deps.indexerRead === void 0 ? void 0 : {
+		indexer: deps.indexerRead,
+		convexCall: deps.convexCall,
+		functions: fns
+	};
 	const executionFns = deps.moneyExecutionFunctions ?? moneyExecutionContract;
 	const requestKeyScope = deps.requestKeyScope ?? randomPaymentRequestKey();
 	const inFlightPersonalPayments = /* @__PURE__ */ new Map();
@@ -13621,10 +14235,12 @@ function makeFinancialOpsMethods(deps) {
 				return runPortEffect(Effect.suspend(() => deps.convexCall.query(fns.depositInstructions, copyInvocationObservation(controls, {}))).pipe(Effect.tap((instructions) => emitDepositInitiated(deps.telemetry, instructions, controls))), controls, CAPXUL_OPERATIONS.me.depositInstructions, deps.runPromise);
 			}
 		},
-		targets: { resolve: async (reference, options) => {
-			const recipient = normalizeTargetForBackend(reference, "reference");
-			if (!recipient.ok) return recipient;
-			return mapOk(await runIfActive(options?.signal, CAPXUL_OPERATIONS.recipient.resolve, () => deps.convexCall.query(fns.resolveRecipient, { recipient: recipient.value })), resolvedTargetFromResolution);
+		targets: { resolve: (reference, options) => {
+			const controls = deps.invocationControls?.(options) ?? options;
+			return runPortEffect(projectReply(Effect.suspend(() => {
+				const recipient = normalizeTargetForBackend(reference, "reference");
+				return recipient.ok ? deps.convexCall.query(fns.resolveRecipient, copyInvocationObservation(controls, { recipient: recipient.value })) : Effect.fail({ publicError: recipient.error });
+			}), resolvedTargetFromResolution), controls, CAPXUL_OPERATIONS.recipient.resolve, deps.runPromise);
 		} },
 		destinations: {
 			add: (input, options) => {
@@ -13687,8 +14303,14 @@ function makeFinancialOpsMethods(deps) {
 				kind: "claim",
 				paymentId
 			}, deps.invocationControls?.(options) ?? options, CAPXUL_OPERATIONS.payments.claim),
-			list: async (options) => mapOk(await runIfActive(options?.signal, CAPXUL_OPERATIONS.payments.list, () => deps.convexCall.query(fns.listPayments, {})), (payments) => payments.map(normalizePaymentTiming)),
-			get: async (paymentId, options) => mapOk(await runIfActive(options?.signal, CAPXUL_OPERATIONS.payments.get, () => deps.convexCall.query(fns.getPayment, { paymentId })), (payment) => payment === null ? null : normalizePaymentTiming(payment)),
+			list: (options) => {
+				const controls = deps.invocationControls?.(options) ?? options;
+				return runPortEffect(projectReply(Effect.suspend(() => deps.convexCall.query(fns.listPayments, copyInvocationObservation(controls, {}))), (payments) => payments.map(normalizePaymentTiming)), controls, CAPXUL_OPERATIONS.payments.list, deps.runPromise);
+			},
+			get: (paymentId, options) => {
+				const controls = deps.invocationControls?.(options) ?? options;
+				return runPortEffect(projectReply(Effect.suspend(() => deps.convexCall.query(fns.getPayment, copyInvocationObservation(controls, { paymentId }))), (payment) => payment === null ? null : normalizePaymentTiming(payment)), controls, CAPXUL_OPERATIONS.payments.get, deps.runPromise);
+			},
 			cancel: (paymentId, options) => runLifecycle({
 				kind: "cancel",
 				paymentId
@@ -13705,22 +14327,26 @@ function makeFinancialOpsMethods(deps) {
 			}
 		},
 		activity: {
+			subscribe: (onChange, params, options) => {
+				const controls = deps.invocationControls?.(options) ?? options;
+				return runPortEffect(captureActivityInput(() => Effect.succeed(activityActorField(params?.actor).actor)).pipe(Effect.flatMap((actor) => indexerDeps === void 0 ? Effect.succeed(() => {}) : Effect.suspend(() => subscribeActivity(indexerDeps, actor, controls, onChange)).pipe(Effect.tap(() => observeActivityScope(actor))))), controls, CAPXUL_OPERATIONS.activity.subscribe, deps.runPromise);
+			},
 			list: (params, options) => {
 				const controls = deps.invocationControls?.(options) ?? options;
-				return runPortEffect(captureActivityInput(() => Effect.succeed(activityActorField(params?.actor).actor)).pipe(Effect.flatMap((actor) => Effect.suspend(() => deps.convexCall.query(fns.activityList, copyInvocationObservation(controls, { input: {
+				return runPortEffect(captureActivityInput(() => Effect.succeed(activityActorField(params?.actor).actor)).pipe(Effect.flatMap((actor) => Effect.suspend(() => indexerDeps === void 0 ? deps.convexCall.query(fns.activityList, copyInvocationObservation(controls, { input: {
 					...actor === void 0 ? {} : { actor },
 					...params?.cursor === void 0 ? {} : { cursor: params.cursor },
 					...params?.limit === void 0 ? {} : { limit: params.limit },
 					...params?.range === void 0 ? {} : { range: params.range },
 					...params?.filter === void 0 ? {} : { filter: params.filter }
-				} }))).pipe(Effect.tap(() => observeActivityScope(actor))))), controls, CAPXUL_OPERATIONS.activity.list, deps.runPromise);
+				} })) : readActivityPage(indexerDeps, actor, controls, params)).pipe(Effect.tap(() => observeActivityScope(actor))))), controls, CAPXUL_OPERATIONS.activity.list, deps.runPromise);
 			},
 			summary: (params, options) => {
 				const controls = deps.invocationControls?.(options) ?? options;
-				return runPortEffect(captureActivityInput(() => Effect.succeed(activityActorField(params?.actor).actor)).pipe(Effect.flatMap((actor) => Effect.suspend(() => deps.convexCall.query(fns.activitySummary, copyInvocationObservation(controls, { input: {
+				return runPortEffect(captureActivityInput(() => Effect.succeed(activityActorField(params?.actor).actor)).pipe(Effect.flatMap((actor) => Effect.suspend(() => indexerDeps === void 0 ? deps.convexCall.query(fns.activitySummary, copyInvocationObservation(controls, { input: {
 					...actor === void 0 ? {} : { actor },
 					...params?.window === void 0 ? {} : { window: params.window }
-				} }))).pipe(Effect.tap(() => observeActivityScope(actor))))), controls, CAPXUL_OPERATIONS.activity.summary, deps.runPromise);
+				} })) : readActivitySummary(indexerDeps, actor, controls, params)).pipe(Effect.tap(() => observeActivityScope(actor))))), controls, CAPXUL_OPERATIONS.activity.summary, deps.runPromise);
 			},
 			get: (reference, options) => {
 				const controls = deps.invocationControls?.(options) ?? options;
@@ -14052,6 +14678,22 @@ function normalizePaymentTiming(payment) {
 		timing: payment.timing ?? payment.release ?? { kind: "instant" }
 	};
 }
+/**
+* `mapOk`, moved inside the observed Effect (R09 #1967).
+*
+* The projection can refuse — `toAddress` and `toPartyId` throw on a malformed
+* reply — and every verb on this surface returns a `CapxulResult`, so that
+* throw stays a value here (ADR-0023). The error identity is `mapOk`'s: a
+* `CapxulError` passes through, anything else becomes `Errors.unknown(cause)`.
+* Running it inside the runner is what puts the decode failure on the same
+* operation record as the read that produced the reply.
+*/
+function projectReply(program, project) {
+	return program.pipe(Effect.flatMap((value) => Effect.try({
+		try: () => project(value),
+		catch: (cause) => ({ publicError: cause instanceof CapxulError ? cause : Errors.unknown(cause) })
+	})));
+}
 function mapOk(result, f) {
 	if (!result.ok) return result;
 	try {
@@ -14423,13 +15065,18 @@ const postHogOtlpEndpoints = (host) => {
 	const base = host.replace(/\/+$/, "");
 	return {
 		logs: `${base}/i/v1/logs`,
-		traces: `${base}/i/v1/traces`
+		traces: `${base}/i/v1/traces`,
+		metrics: `${base}/i/v1/metrics`
 	};
 };
 const ENGINEERING_CAPXUL_ENV_SET = new Set(ENGINEERING_CAPXUL_ENVS);
 const ENGINEERING_PRODUCERS = /* @__PURE__ */ new Set(["browser", "server"]);
 const PUBLIC_POSTHOG_AUTHORIZATION = /^Bearer phc_[A-Za-z0-9_-]{1,191}$/u;
 const SAFE_RESOURCE_VALUE = /^[A-Za-z0-9][A-Za-z0-9._+@/-]{0,127}$/u;
+function validateEngineeringPrivacy(config) {
+	if (config.privacy !== void 0 && config.privacy !== "minimal") throw new TypeError("engineering telemetry privacy must be minimal when specified");
+	if (config.privacy === "minimal" && (!/^[A-Za-z0-9][A-Za-z0-9._+@-]{0,127}$/u.test(config.sdkVersion) || config.serviceName !== void 0 && !/^[A-Za-z0-9][A-Za-z0-9._+@-]{0,127}$/u.test(config.serviceName))) throw new TypeError("minimal engineering resource values must not contain paths");
+}
 const validateEngineeringTelemetryConfig = (config) => {
 	let url;
 	try {
@@ -14440,6 +15087,8 @@ const validateEngineeringTelemetryConfig = (config) => {
 	if (url.protocol !== "https:" || url.username.length > 0 || url.password.length > 0 || url.pathname !== "/" || url.search.length > 0 || url.hash.length > 0 || !(url.hostname === "posthog.com" || url.hostname.endsWith(".posthog.com"))) throw new TypeError("engineering telemetry host must be a credential-free HTTPS origin");
 	if (!ENGINEERING_CAPXUL_ENV_SET.has(config.capxulEnv)) throw new TypeError("engineering telemetry capxulEnv is not canonical");
 	if (!ENGINEERING_PRODUCERS.has(config.producer)) throw new TypeError("engineering telemetry producer is not canonical");
+	if (config.enabled !== void 0 && typeof config.enabled !== "boolean" && typeof config.enabled !== "function") throw new TypeError("engineering telemetry enabled must be a boolean or callback");
+	validateEngineeringPrivacy(config);
 	if (!SAFE_RESOURCE_VALUE.test(config.sdkVersion)) throw new TypeError("engineering telemetry sdkVersion must be a bounded safe value");
 	if (config.serviceName !== void 0 && !SAFE_RESOURCE_VALUE.test(config.serviceName)) throw new TypeError("engineering telemetry serviceName must be a bounded safe value");
 	const headerEntries = Object.entries(config.headers);
@@ -14490,25 +15139,34 @@ const spanUpstream = (span) => {
 	let current = span;
 	while (current?._tag === "Span") {
 		const upstream = current.attributes.get("chain.upstream");
-		if (upstream === "alchemy" || upstream === "infura") return upstream;
+		if (upstream === "alchemy" || upstream === "infura" || upstream === "gateway") return upstream;
 		current = current.parent._tag === "Some" ? current.parent.value : void 0;
 	}
 };
+function redactHttpPath(path, fullUrl, source) {
+	let origin = "https://redaction.invalid";
+	try {
+		const url = new URL(String(fullUrl));
+		if (url.protocol === "https:" || url.protocol === "http:") origin = url.origin;
+	} catch {}
+	const prefix = path.startsWith("/") ? origin : "";
+	return redactUrlSecrets(`${prefix}${path}`, source).slice(prefix.length, prefix.length + 2048);
+}
 /** Preserve domain exits while preventing the OTLP serializer from seeing raw causes. */
-const makeLeakSafeEngineeringTracer = (delegate) => Tracer.make({
+const makeLeakSafeEngineeringTracer = (delegate, enabled = () => true) => Tracer.make({
 	span(options) {
-		const span = delegate.span(options);
+		const span = enabled() ? delegate.span(options) : new Tracer.NativeSpan(options);
 		const wrapped = Object.create(span);
 		Object.defineProperty(wrapped, "attribute", { value: (name, value) => {
 			const source = spanUpstream(span);
 			const header = /^http\.(?:request|response)\.header\.(.+)$/u.exec(name)?.[1];
 			if (header !== void 0 && isCredentialField(header, "header")) span.attribute(name, "[REDACTED]");
 			else if (typeof value === "string" && name === "url.query") span.attribute(name, redactUrlSecrets(`?${value}`).slice(1, 2049));
-			else if (typeof value === "string" && name === "url.path") {
-				const fullUrl = span.attributes.get("url.full");
-				const path = typeof fullUrl === "string" ? /^https?:\/\/[^/]+([^?#]*)/u.exec(fullUrl)?.[1] ?? value : value;
-				span.attribute(name, redactUrlSecrets(path, source).slice(0, 2048));
-			} else if (typeof value === "string" && (name === "url.full" || header === "location" || header === "referer" || header === "referrer")) span.attribute(name, redactUrlSecrets(value, source).slice(0, 2048));
+			else if (typeof value === "string" && (name === "url.path" || name === "http.target")) {
+				const fullUrl = span.attributes.get("url.full") ?? span.attributes.get("http.url");
+				const path = name === "url.path" && typeof fullUrl === "string" ? /^https?:\/\/[^/]+([^?#]*)/u.exec(fullUrl)?.[1] ?? value : value;
+				span.attribute(name, redactHttpPath(path, fullUrl, source));
+			} else if (typeof value === "string" && (name === "url.full" || name === "http.url" || header === "location" || header === "referer" || header === "referrer")) span.attribute(name, redactUrlSecrets(value, source).slice(0, 2048));
 			else if (header !== void 0 && typeof value === "string") span.attribute(name, redactSecrets(value, source).slice(0, 2048));
 			else span.attribute(name, value);
 		} });
@@ -14516,6 +15174,15 @@ const makeLeakSafeEngineeringTracer = (delegate) => Tracer.make({
 			configurable: false,
 			enumerable: false,
 			value: (endTime, exit) => {
+				if (!enabled()) {
+					Object.defineProperty(wrapped, "status", { value: {
+						_tag: "Ended",
+						startTime: span.status.startTime,
+						endTime,
+						exit
+					} });
+					return;
+				}
 				if (Exit.isFailure(exit) && !Cause.hasInterruptsOnly(exit.cause)) {
 					const first = exit.cause.reasons.find((reason) => !Cause.isInterruptReason(reason));
 					const code = failureText(first === void 0 ? void 0 : Cause.isFailReason(first) ? first.error : first.defect, "code", 128);
@@ -14529,53 +15196,360 @@ const makeLeakSafeEngineeringTracer = (delegate) => Tracer.make({
 	},
 	...delegate.context === void 0 ? {} : { context: delegate.context.bind(delegate) }
 });
+const MINIMAL_LOG_NAMES = /* @__PURE__ */ new Set([
+	"capxul_sdk_operation",
+	"identity.transition",
+	"convex.connection.changed",
+	"convex.action.connection_lost",
+	"cli.command.completed",
+	"cli.sdk.operation.failed"
+]);
+const MINIMAL_ERROR_CODES = /* @__PURE__ */ new Set([
+	...CAPXUL_ERROR_CODES,
+	"CLI_USAGE",
+	"CLI_CONFIG",
+	"CLI_STORAGE",
+	"CLI_DEFECT"
+]);
+const MINIMAL_NUMBERS = /* @__PURE__ */ new Set([
+	"schema_version",
+	"duration_ms",
+	"wait_duration_ms",
+	"retry_count",
+	"http.status_code",
+	"http.response.status_code",
+	"http_status",
+	"rpc.code",
+	"connection_count",
+	"connection_retries"
+]);
+const MINIMAL_CORRELATIONS = /* @__PURE__ */ new Set([
+	"correlation_id",
+	"journey_id",
+	"invocation_id"
+]);
+const MINIMAL_METRIC_LABELS = /* @__PURE__ */ new Set([
+	"command",
+	"outcome",
+	"capxul_env",
+	"unit"
+]);
+const MINIMAL_METRIC_NAMES = /* @__PURE__ */ new Set(["capxul.cli.command.count", "capxul.cli.command.duration"]);
+const traceId = (value) => typeof value === "string" && /^(?!0+$)[0-9a-f]{32}$/u.test(value);
+const spanId = (value) => typeof value === "string" && /^(?!0+$)[0-9a-f]{16}$/u.test(value);
+const minimalName = (value) => typeof value === "string" && (MINIMAL_LOG_NAMES.has(value) || isCapxulOperation(value)) ? value : "capxul.engineering";
+const MINIMAL_ENUM_VALUES = /* @__PURE__ */ new Map([
+	["outcome", [
+		"succeeded",
+		"refused",
+		"failed",
+		"cancelled",
+		"applied"
+	]],
+	["mode", FAILURE_MODES$1],
+	["failure_mode", FAILURE_MODES$1],
+	["capxul_env", ENGINEERING_CAPXUL_ENVS],
+	["producer", ["browser", "server"]],
+	["command", ["doctor"]],
+	["output_mode", ["human", "json"]],
+	["unit", [
+		"1",
+		"s",
+		"ms"
+	]]
+]);
+const MINIMAL_CODE_KEYS = /* @__PURE__ */ new Set([
+	"error.code",
+	"error_code",
+	"failure_code",
+	"refusal_code",
+	"capxul_error_code"
+]);
+const MINIMAL_VERSION_KEYS = /* @__PURE__ */ new Set([
+	"sdk_version",
+	"cli_version",
+	"release"
+]);
+function minimalStringValue(key, text) {
+	if (key === "operation") return isCapxulOperation(text);
+	if (MINIMAL_CODE_KEYS.has(key)) return MINIMAL_ERROR_CODES.has(text);
+	if (MINIMAL_VERSION_KEYS.has(key)) return /^[A-Za-z0-9][A-Za-z0-9._+@-]{0,127}$/u.test(text);
+	if (key === "trace_id") return traceId(text);
+	if (key === "span_id" || key === "parent_span_id") return spanId(text);
+	const values = MINIMAL_ENUM_VALUES.get(key);
+	if (values !== void 0) return values.includes(text);
+	return MINIMAL_CORRELATIONS.has(key) && /^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$/u.test(text) && !/^0x[0-9a-f]+$/iu.test(text) && redactSecrets(text) === text;
+}
+/** A named privacy projection, separate from the default credential-only redaction policy. */
+function minimalAttributes(attributes, metric = false) {
+	return attributes.flatMap(({ key, value }) => {
+		if (metric && !MINIMAL_METRIC_LABELS.has(key)) return [];
+		const text = value.stringValue;
+		const number = value.doubleValue ?? value.intValue;
+		if (MINIMAL_NUMBERS.has(key) && typeof number === "number" && Number.isFinite(number)) return [{
+			key,
+			value: { doubleValue: number }
+		}];
+		if (typeof text !== "string") return [];
+		return minimalStringValue(key, text) ? [{
+			key,
+			value: { stringValue: text }
+		}] : [];
+	});
+}
+const finiteProtocolNumber = (value) => typeof value === "number" && Number.isFinite(value) ? value : void 0;
+const protocolCount = (value, maximum = Number.MAX_SAFE_INTEGER) => typeof value === "number" && Number.isSafeInteger(value) && value >= 0 && value <= maximum ? value : void 0;
+const protocolFlags = (value) => protocolCount(Object.getOwnPropertyDescriptor(value, "flags")?.value, 4294967295);
+function protocolTime(value) {
+	if (typeof value === "string" && /^\d{1,20}$/u.test(value) && BigInt(value) <= 18446744073709551615n) return value;
+	const number = protocolCount(value);
+	if (number !== void 0) return String(number);
+	if (value === null || typeof value !== "object") return void 0;
+	const low = protocolCount(Object.getOwnPropertyDescriptor(value, "low")?.value, 4294967295);
+	const high = protocolCount(Object.getOwnPropertyDescriptor(value, "high")?.value, 4294967295);
+	return low === void 0 || high === void 0 ? void 0 : (BigInt(high) << 32n | BigInt(low)).toString();
+}
+function minimalNumberPoints(points) {
+	return points.flatMap((point) => {
+		const attributes = minimalAttributes(point.attributes, true);
+		const asDouble = finiteProtocolNumber(point.asDouble);
+		const asInt = typeof point.asInt === "number" && Number.isSafeInteger(point.asInt) ? point.asInt : void 0;
+		if (attributes.length !== point.attributes.length || asDouble === void 0 && asInt === void 0) return [];
+		return [{
+			attributes,
+			timeUnixNano: protocolTime(point.timeUnixNano),
+			startTimeUnixNano: protocolTime(point.startTimeUnixNano),
+			asDouble,
+			asInt: asDouble === void 0 ? asInt : void 0,
+			flags: protocolFlags(point)
+		}];
+	});
+}
+function minimalHistogramPoints(points) {
+	return points.flatMap((point) => {
+		const attributes = minimalAttributes(point.attributes ?? [], true);
+		const count = protocolCount(point.count);
+		const bucketCounts = point.bucketCounts;
+		const explicitBounds = point.explicitBounds;
+		if (attributes.length !== (point.attributes?.length ?? 0) || count === void 0 || !Array.isArray(bucketCounts) || !bucketCounts.every((value) => protocolCount(value) !== void 0) || !Array.isArray(explicitBounds) || !explicitBounds.every((value) => finiteProtocolNumber(value) !== void 0) || bucketCounts.length !== explicitBounds.length + 1) return [];
+		return [{
+			attributes,
+			timeUnixNano: protocolTime(point.timeUnixNano),
+			startTimeUnixNano: protocolTime(point.startTimeUnixNano),
+			count,
+			sum: finiteProtocolNumber(point.sum),
+			min: finiteProtocolNumber(point.min),
+			max: finiteProtocolNumber(point.max),
+			bucketCounts: bucketCounts.map((value) => value),
+			explicitBounds: explicitBounds.map((value) => value),
+			flags: protocolFlags(point)
+		}];
+	});
+}
+function minimalSerialization(config) {
+	const service = config.serviceName ?? "capxul-sdk";
+	const resource = { attributes: Object.entries({
+		"service.name": service,
+		"service.version": config.sdkVersion,
+		sdk_version: config.sdkVersion,
+		capxul_env: config.capxulEnv,
+		producer: config.producer
+	}).map(([key, value]) => ({
+		key,
+		value: { stringValue: value }
+	})) };
+	return {
+		logs: (data) => HttpBody.jsonUnsafe({ resourceLogs: data.resourceLogs.map((entry) => ({
+			resource,
+			scopeLogs: entry.scopeLogs.map((scope) => ({
+				scope: { name: service },
+				logRecords: (scope.logRecords ?? []).map((record) => ({
+					timeUnixNano: protocolTime(record.timeUnixNano),
+					observedTimeUnixNano: protocolTime(record.observedTimeUnixNano),
+					severityNumber: protocolCount(record.severityNumber, 24),
+					severityText: [
+						"All",
+						"Trace",
+						"Debug",
+						"Info",
+						"Warn",
+						"Error",
+						"Fatal",
+						"None"
+					].includes(record.severityText ?? "") ? record.severityText : void 0,
+					body: { stringValue: minimalName(record.body?.stringValue) },
+					attributes: minimalAttributes(record.attributes),
+					droppedAttributesCount: protocolCount(record.droppedAttributesCount) ?? 0,
+					traceId: traceId(record.traceId) ? record.traceId : void 0,
+					spanId: spanId(record.spanId) ? record.spanId : void 0,
+					flags: protocolFlags(record)
+				}))
+			}))
+		})) }),
+		traces: (data) => HttpBody.jsonUnsafe({ resourceSpans: data.resourceSpans.map((entry) => ({
+			resource,
+			scopeSpans: entry.scopeSpans.map((scope) => ({
+				scope: { name: service },
+				spans: scope.spans.filter((span) => traceId(span.traceId) && spanId(span.spanId)).map((span) => {
+					const attributes = minimalAttributes(span.attributes);
+					const code = attributes.find((attribute) => attribute.key === "error.code");
+					return {
+						traceId: span.traceId,
+						spanId: span.spanId,
+						name: minimalName(span.name),
+						kind: protocolCount(span.kind, 5) ?? 0,
+						startTimeUnixNano: protocolTime(span.startTimeUnixNano),
+						endTimeUnixNano: protocolTime(span.endTimeUnixNano),
+						attributes,
+						droppedAttributesCount: protocolCount(span.droppedAttributesCount) ?? 0,
+						parentSpanId: spanId(span.parentSpanId) ? span.parentSpanId : void 0,
+						flags: protocolFlags(span),
+						status: { code: protocolCount(span.status.code, 2) ?? 0 },
+						events: span.events.slice(0, 8).map((event) => ({
+							timeUnixNano: protocolTime(event.timeUnixNano),
+							droppedAttributesCount: protocolCount(event.droppedAttributesCount) ?? 0,
+							name: event.name === "exception" ? "exception" : minimalName(event.name),
+							attributes: event.name === "exception" ? [{
+								key: "exception.type",
+								value: code?.value ?? { stringValue: "Error" }
+							}] : minimalAttributes(event.attributes)
+						})),
+						droppedEventsCount: protocolCount(span.droppedEventsCount) ?? 0,
+						links: span.links.filter((link) => traceId(link.traceId) && spanId(link.spanId)).slice(0, 8).map((link) => ({
+							traceId: link.traceId,
+							spanId: link.spanId,
+							flags: protocolFlags(link),
+							attributes: minimalAttributes(link.attributes),
+							droppedAttributesCount: protocolCount(link.droppedAttributesCount) ?? 0
+						})),
+						droppedLinksCount: protocolCount(span.droppedLinksCount) ?? 0
+					};
+				})
+			}))
+		})) }),
+		metrics: (data) => {
+			const resourceMetrics = data.resourceMetrics.map((entry) => ({
+				resource,
+				scopeMetrics: entry.scopeMetrics.map((scope) => ({
+					scope: { name: service },
+					metrics: scope.metrics.filter((metric) => MINIMAL_METRIC_NAMES.has(metric.name)).flatMap((metric) => {
+						const gauge = metric.gauge === void 0 ? void 0 : { dataPoints: minimalNumberPoints(metric.gauge.dataPoints) };
+						const sum = metric.sum === void 0 ? void 0 : {
+							aggregationTemporality: protocolCount(metric.sum.aggregationTemporality, 2) ?? 0,
+							isMonotonic: metric.sum.isMonotonic === true,
+							dataPoints: minimalNumberPoints(metric.sum.dataPoints)
+						};
+						const histogram = metric.histogram === void 0 ? void 0 : {
+							aggregationTemporality: protocolCount(metric.histogram.aggregationTemporality, 2) ?? 0,
+							dataPoints: minimalHistogramPoints(metric.histogram.dataPoints)
+						};
+						if (![
+							gauge,
+							sum,
+							histogram
+						].some((series) => (series?.dataPoints.length ?? 0) > 0)) return [];
+						return [{
+							name: metric.name,
+							unit: [
+								"1",
+								"s",
+								"ms"
+							].includes(metric.unit ?? "") ? metric.unit : "1",
+							...gauge === void 0 ? {} : { gauge },
+							...sum === void 0 ? {} : { sum },
+							...histogram === void 0 ? {} : { histogram }
+						}];
+					})
+				}))
+			}));
+			return resourceMetrics.some((entry) => entry.scopeMetrics.some((scope) => scope.metrics.length > 0)) ? HttpBody.jsonUnsafe({ resourceMetrics }) : HttpBody.empty;
+		}
+	};
+}
+Effect.flatMap(OtlpExporter.Flusher, (flusher) => flusher.flush);
 /** Shared browser/server OTLP layer. OtlpLogger merges with incumbent loggers once. */
 const makeEngineeringTelemetryLayer = (config) => {
 	const validated = validateEngineeringTelemetryConfig(config);
-	const endpoints = postHogOtlpEndpoints(validated.host);
-	const resource = {
-		serviceName: validated.serviceName ?? "capxul-sdk",
-		serviceVersion: validated.sdkVersion,
-		attributes: {
-			capxul_env: validated.capxulEnv,
-			producer: validated.producer,
-			sdk_version: validated.sdkVersion
-		}
-	};
-	const tracing = Layer.effect(Tracer.Tracer, OtlpTracer.make({
-		url: endpoints.traces,
-		headers: validated.headers,
-		resource
-	}).pipe(Effect.map(makeLeakSafeEngineeringTracer))).pipe(Layer.provideMerge(OtlpExporter.layerFlusher));
-	const logging = OtlpLogger.layer({
-		url: endpoints.logs,
-		headers: validated.headers,
-		resource,
-		mergeWithExisting: true
-	});
-	const headerPolicy = Layer.merge(Layer.succeed(HttpClient.TracerHeaderFilter, traceHeaderFilter), Layer.succeed(Headers.CurrentRedactedNames, [credentialHeaderPattern]));
-	const browserLifecycle = Layer.effectDiscard(Effect.gen(function* () {
-		if (validated.producer !== "browser" || !hasBrowserDocument()) return;
-		const browserWindow = window;
-		const browserDocument = document;
-		const flusher = yield* OtlpExporter.Flusher;
-		const run = yield* FiberSet.makeRuntime();
-		const flush = () => {
-			run(flusher.flush);
-		};
-		const visibilityChanged = () => {
-			if (browserDocument.visibilityState === "hidden") flush();
-		};
-		yield* Effect.acquireRelease(Effect.sync(() => {
-			browserDocument.addEventListener("visibilitychange", visibilityChanged);
-			browserWindow.addEventListener("pagehide", flush);
-		}), () => Effect.sync(() => {
-			browserDocument.removeEventListener("visibilitychange", visibilityChanged);
-			browserWindow.removeEventListener("pagehide", flush);
+	return Layer.suspend(() => {
+		const endpoints = postHogOtlpEndpoints(validated.host);
+		let disabled = false;
+		const enabled = () => {
+			if (disabled) return false;
+			try {
+				disabled = (typeof validated.enabled === "function" ? validated.enabled() : validated.enabled ?? true) !== true;
+			} catch {
+				disabled = true;
+			}
+			return !disabled;
+		};
+		const delivery = {
+			...validated.shutdownTimeout === void 0 ? {} : { shutdownTimeout: validated.shutdownTimeout },
+			...validated.exportInterval === void 0 ? {} : { exportInterval: validated.exportInterval }
+		};
+		const resource = {
+			serviceName: validated.serviceName ?? "capxul-sdk",
+			serviceVersion: validated.sdkVersion,
+			attributes: {
+				capxul_env: validated.capxulEnv,
+				producer: validated.producer,
+				sdk_version: validated.sdkVersion
+			}
+		};
+		const tracing = Layer.effect(Tracer.Tracer, OtlpTracer.make({
+			url: endpoints.traces,
+			headers: validated.headers,
+			resource,
+			...delivery
+		}).pipe(Effect.map((tracer) => makeLeakSafeEngineeringTracer(tracer, enabled)))).pipe(Layer.provideMerge(OtlpExporter.layerFlusher));
+		const logging = Logger.layer([OtlpLogger.make({
+			url: endpoints.logs,
+			headers: validated.headers,
+			resource,
+			...delivery
+		}).pipe(Effect.map((logger) => Logger.make((options) => {
+			if (enabled()) logger.log(options);
+		})))], { mergeWithExisting: true }).pipe(Layer.provideMerge(OtlpExporter.layerFlusher));
+		const metrics = OtlpMetrics.layer({
+			url: endpoints.metrics,
+			headers: validated.headers,
+			resource,
+			temporality: "delta",
+			...delivery
+		});
+		const headerPolicy = Layer.merge(Layer.succeed(HttpClient.TracerHeaderFilter, traceHeaderFilter), Layer.succeed(Headers.CurrentRedactedNames, [credentialHeaderPattern]));
+		const browserLifecycle = Layer.effectDiscard(Effect.gen(function* () {
+			if (validated.producer !== "browser" || !hasBrowserDocument()) return;
+			const browserWindow = window;
+			const browserDocument = document;
+			const flusher = yield* OtlpExporter.Flusher;
+			const run = yield* FiberSet.makeRuntime();
+			const flush = () => {
+				run(flusher.flush);
+			};
+			const visibilityChanged = () => {
+				if (browserDocument.visibilityState === "hidden") flush();
+			};
+			yield* Effect.acquireRelease(Effect.sync(() => {
+				browserDocument.addEventListener("visibilitychange", visibilityChanged);
+				browserWindow.addEventListener("pagehide", flush);
+			}), () => Effect.sync(() => {
+				browserDocument.removeEventListener("visibilitychange", visibilityChanged);
+				browserWindow.removeEventListener("pagehide", flush);
+			}));
 		}));
-	}));
-	const transport = Layer.effect(HttpClient.HttpClient, Effect.map(HttpClient.HttpClient, (client) => validated.producer === "browser" && hasBrowserDocument() ? browserExportClient(client) : client)).pipe(Layer.provide(FetchHttpClient.layer));
-	return browserLifecycle.pipe(Layer.provideMerge(Layer.mergeAll(tracing, logging, headerPolicy)), Layer.provide(OtlpSerialization.layerJson), Layer.provide(transport));
+		const transport = Layer.effect(HttpClient.HttpClient, Effect.map(HttpClient.HttpClient, (client) => {
+			const selectedTransport = validated.producer === "browser" && hasBrowserDocument() ? browserExportClient(client) : client;
+			return HttpClient.transform(selectedTransport, (response, request) => Effect.suspend(() => enabled() && request.body._tag !== "Empty" ? response : Effect.succeed(HttpClientResponse.fromWeb(request, new Response(null, { status: 200 })))));
+		})).pipe(Layer.provide(FetchHttpClient.layer));
+		const serialization = Layer.effect(OtlpSerialization.OtlpSerialization, Effect.map(OtlpSerialization.OtlpSerialization, (json) => {
+			const projected = minimalSerialization(validated);
+			return validated.privacy === "minimal" ? projected : {
+				...json,
+				metrics: projected.metrics
+			};
+		})).pipe(Layer.provide(OtlpSerialization.layerJson));
+		return browserLifecycle.pipe(Layer.provideMerge(Layer.mergeAll(tracing, logging, metrics, headerPolicy)), Layer.provide(serialization), Layer.provide(transport));
+	});
 };
 //#endregion
 //#region ../../packages/sdk/src/ports/auth-client.ts
@@ -14900,9 +15874,16 @@ var BetterAuthBrowserAdapter = class {
 				ok: false,
 				error: Errors.notAuthenticated()
 			};
+			if (res.status === 429) return {
+				ok: false,
+				error: Errors.rateLimited({ resource: "auth.token" })
+			};
 			if (!res.ok) return {
 				ok: false,
-				error: Errors.providerError("better-auth", "getConvexJwt", /* @__PURE__ */ new Error(`HTTP ${res.status}`))
+				error: Errors.providerError("better-auth", "getConvexJwt", /* @__PURE__ */ new Error(`HTTP ${res.status}`), {
+					httpStatus: res.status,
+					...res.status >= 500 ? { failure_mode: "upstream-down" } : {}
+				})
 			};
 			const body = await safeJson$1(res);
 			if (typeof body === "object" && body !== null) {
@@ -15331,9 +16312,16 @@ var BetterAuthNodeAdapter = class {
 				ok: false,
 				error: Errors.notAuthenticated()
 			};
+			if (res.status === 429) return {
+				ok: false,
+				error: Errors.rateLimited({ resource: "auth.token" })
+			};
 			if (!res.ok) return {
 				ok: false,
-				error: Errors.providerError("better-auth", "getConvexJwt", /* @__PURE__ */ new Error(`HTTP ${res.status}`))
+				error: Errors.providerError("better-auth", "getConvexJwt", /* @__PURE__ */ new Error(`HTTP ${res.status}`), {
+					httpStatus: res.status,
+					...res.status >= 500 ? { failure_mode: "upstream-down" } : {}
+				})
 			};
 			const body = await safeJson(res);
 			if (typeof body === "object" && body !== null) {
@@ -18675,8 +19663,20 @@ function makeConnectionId() {
 * ever needs a different one.
 */
 const DEFAULT_CLOSE_TIMEOUT_MS = 5e3;
+const writeConvexDiagnostic = (...args) => {
+	try {
+		console.error(...maskCapturedNetworkRequest({ requestBody: args }).requestBody);
+	} catch {}
+};
+const stderrConvexLogger = {
+	log: writeConvexDiagnostic,
+	warn: writeConvexDiagnostic,
+	error: writeConvexDiagnostic,
+	logVerbose: () => void 0
+};
 /** Exact floor-first allowlist; every additional handler must migrate its validator first. */
 const OBSERVED_CONVEX_ACTIONS = /* @__PURE__ */ new Set([
+	"system:healthObserved",
 	"payroll/actions:authorizeRun",
 	"account/actions:readBalance",
 	"holdings/actions:current",
@@ -18687,6 +19687,9 @@ const OBSERVED_CONVEX_ACTIONS = /* @__PURE__ */ new Set([
 	"org/actions:resumeBootstrapSubmission",
 	"org/actions:confirmBootstrap",
 	"org/actions:readTreasury",
+	"moneyExecution/actions:preparePermissionExecution",
+	"moneyExecution/actions:submitPermissionExecution",
+	"permission/actions:verify",
 	"moneyExecution/actions:preparePaymentExecution",
 	"moneyExecution/actions:abandonPaymentExecution",
 	"moneyExecution/actions:submitPaymentExecution",
@@ -18699,6 +19702,8 @@ const OBSERVED_CONVEX_QUERIES = /* @__PURE__ */ new Set([
 	"movement/activity:summary",
 	"movement/activity:get",
 	"financialOps/queries:depositInstructions",
+	"financialOps/queries:listPayments",
+	"financialOps/queries:getPayment",
 	"financialOps/destinations:list",
 	"financialOps/queries:verifyPaymentDocument",
 	"financialOps/queries:renderStoredDocument",
@@ -18711,6 +19716,9 @@ const OBSERVED_CONVEX_QUERIES = /* @__PURE__ */ new Set([
 	"payroll/queries:groups",
 	"payroll/queries:terms",
 	"financialOps/queries:resolveRecipient",
+	"org/queries:me",
+	"permission/queries:read",
+	"permission/queries:authorize",
 	"identity/queries:loadByAuthUserId",
 	"smartAccount/queries:loadByAuthUserId",
 	"org/lifecycle:load"
@@ -18729,6 +19737,7 @@ const OBSERVED_CONVEX_MUTATIONS = /* @__PURE__ */ new Set([
 	"financialOps/requestsInbox:decline",
 	"payroll/mutations:saveGroup",
 	"payroll/mutations:removeGroup",
+	"permission/mutations:command",
 	"identity/mutations:create",
 	"identity/mutations:update",
 	"identity/mutations:completeOnboarding",
@@ -18748,7 +19757,10 @@ var ConvexCallAdapter = class {
 		this.#closeTimeoutMs = deps.closeTimeoutMs ?? DEFAULT_CLOSE_TIMEOUT_MS;
 		this.#connectionMonitor = new ConvexConnectionMonitor();
 		const webSocketConstructor = this.#connectionMonitor.observedWebSocketConstructor();
-		this.#client = deps.client ?? new ConvexClient(deps.convexUrl, webSocketConstructor === void 0 ? {} : { webSocketConstructor });
+		this.#client = deps.client ?? new ConvexClient(deps.convexUrl, {
+			...webSocketConstructor === void 0 ? {} : { webSocketConstructor },
+			...deps.logToStderr === true ? { logger: stderrConvexLogger } : {}
+		});
 		this.#tokenProvider = deps.tokenProvider;
 		this.#applicationId = deps.applicationId;
 		this.#observation = deps.observation;
@@ -18796,9 +19808,13 @@ var ConvexCallAdapter = class {
 	}
 	#observedArgs(allowlist, path, args, traceparent) {
 		if (!allowlist.has(path)) return args;
+		const invocationSnapshot = readInvocationObservation(args);
+		if (path === "system:healthObserved" && invocationSnapshot?.active === false) {
+			const { observationContext: _context, ...unobservedArgs } = args;
+			return unobservedArgs;
+		}
 		const carriedContext = sanitizeObservationContext(args.observationContext);
 		let hostContext;
-		const invocationSnapshot = readInvocationObservation(args);
 		if (invocationSnapshot !== void 0) hostContext = invocationSnapshot.active ? invocationSnapshot.context : void 0;
 		else {
 			const resolveContext = this.#observation?.resolveContext;
@@ -19419,11 +20435,11 @@ var ConvexOrganizationAdapter = class {
 		return this.listMembers(input).pipe(Effect.map((members) => members.filter((member) => member.status === "pending" || member.status === "pending_safe" || member.status === "pending_grant")));
 	}
 	inviteMember(input) {
-		return this.#convex.action(this.#fns.inviteMember, {
+		return this.#convex.action(this.#fns.inviteMember, copyInvocationObservation(input, {
 			orgId: input.orgId,
 			email: input.input.email,
 			role: input.input.role
-		}).pipe(Effect.mapError((error) => orgErrorFromCapxul("inviteMember", error.publicError, error)), Effect.map(brandOrgMember), Effect.catchDefect((cause) => Effect.fail(toOrgError("inviteMember", cause))));
+		})).pipe(Effect.mapError((error) => orgErrorFromCapxul("inviteMember", error.publicError, error)), Effect.map(brandOrgMember), Effect.catchDefect((cause) => Effect.fail(toOrgError("inviteMember", cause))));
 	}
 	resendInviteToken(input) {
 		return this.#convex.mutation(this.#fns.resendInvite, {
@@ -44703,11 +45719,18 @@ function makeMediaMethods(deps) {
 }
 //#endregion
 //#region ../../packages/sdk/src/contract/system.ts
-const healthQuery = makeFunctionReference(CAPXUL_FUNCTIONS.system.health);
+const healthAction = makeFunctionReference(CAPXUL_FUNCTIONS.system.healthObserved);
 //#endregion
 //#region ../../packages/sdk/src/surface/system.ts
 function makeSystemMethods(deps) {
-	return { health: (nonce, options) => runIfActive(options?.signal, CAPXUL_OPERATIONS.system.health, () => deps.convexCall.query(healthQuery, { nonce })) };
+	return { health: (nonce, options) => {
+		let controls = deps.invocationControls?.(options) ?? options;
+		const invocation = readInvocationObservation(controls);
+		const traceparent = invocation?.active === false ? void 0 : sanitizeObservationContext(invocation?.context)?.traceparent;
+		const parent = traceparent === void 0 ? void 0 : Option.getOrUndefined(HttpTraceContext.fromHeaders(Headers.fromRecordUnsafe({ traceparent })));
+		if (parent !== void 0) controls = carryInvocationParentSpan(controls, parent);
+		return runCapxulEffect(Effect.suspend(() => deps.convexCall.action(healthAction, copyInvocationObservation(controls, { nonce }))).pipe(Effect.mapError((error) => error.publicError)), controls, CAPXUL_OPERATIONS.system.health, deps.runPromise);
+	} };
 }
 //#endregion
 //#region ../../packages/sdk/src/contract/org.ts
@@ -44732,8 +45755,33 @@ function toOrgMe(wire) {
 		observedAt: wire.observedAt
 	};
 }
+/**
+* The read runs through the canonical observed runner, so `org.me` owns one
+* `capxul_sdk_operation` record and one span like every other public method.
+*
+* The call-start invocation snapshot travels on the query arguments: the
+* Convex adapter reads it there and sends the browser linkage with the call,
+* so an account switch mid-flight cannot re-resolve the actor. A successful
+* read proves participation in this Organization, so the owning span carries
+* the verified Organization and the two authority booleans the backend
+* actually enforces. Labels and Budget caps stay off the record.
+*/
 function makeOrgMeMethod(deps, orgId) {
-	return (options) => runIfActive(options?.signal, CAPXUL_OPERATIONS.org.me, () => Effect.map(deps.convexCall.query(orgReadContract.me, { orgId }), toOrgMe));
+	return (options) => {
+		const controls = deps.invocationControls?.(options) ?? options;
+		return runCapxulEffect(Effect.gen(function* () {
+			const wire = yield* deps.convexCall.query(orgReadContract.me, copyInvocationObservation(controls, { orgId })).pipe(Effect.mapError((failure) => failure.publicError));
+			yield* Effect.annotateCurrentSpan({
+				verified_organization_id: orgId,
+				scope_kind: "organization",
+				can_manage_people: wire.capabilities.canManagePeople,
+				can_spend: wire.capabilities.canSpend,
+				budget_count: wire.budgets.length,
+				observed_at: wire.observedAt
+			}).pipe(Effect.catchCause(() => Effect.void));
+			return toOrgMe(wire);
+		}), controls, CAPXUL_OPERATIONS.org.me, deps.runPromise);
+	};
 }
 //#endregion
 //#region ../../packages/sdk/src/contract/permission.ts
@@ -44743,7 +45791,34 @@ const permissionContract = { read: makeFunctionReference(CAPXUL_FUNCTIONS["permi
 function isAborted(signal) {
 	return signal?.aborted === true;
 }
-async function execute(deps, orgId, command, signal) {
+/**
+* One owning operation per public Permission method. The compound command
+* (prepare, equality checks, sign, submit) keeps owning its own cancellation;
+* the observed runner around it is what gives the attempt its
+* `capxul_sdk_operation` record, its span and its failure capture, so a signer
+* refusal or an unexpected provider error joins to the operation like every
+* other public surface.
+*/
+function observed(deps, operation, options, run) {
+	const controls = deps.invocationControls?.(options) ?? options;
+	let verifiedOrganizationId;
+	return runCapxulEffect(Effect.gen(function* () {
+		if (controls?.signal?.aborted === true) return yield* Effect.fail(Errors.cancelled({ operation }));
+		const parent = yield* Effect.currentSpan.pipe(Effect.orDie);
+		const captured = carryInvocationParentSpan(controls, parent);
+		const result = yield* Effect.tryPromise({
+			try: () => run(controls?.signal, captured, (orgId) => {
+				verifiedOrganizationId = orgId;
+			}),
+			catch: (cause) => cause instanceof CapxulError ? cause : Errors.unknown(cause)
+		});
+		return yield* result.ok ? Effect.succeed(result.value) : Effect.fail(result.error);
+	}).pipe(Effect.ensuring(Effect.suspend(() => verifiedOrganizationId === void 0 ? Effect.void : Effect.annotateCurrentSpan({
+		verified_organization_id: verifiedOrganizationId,
+		scope_kind: "organization"
+	})).pipe(Effect.catchCause(() => Effect.void)))), observationOnlyControls(controls), operation, deps.runPromise);
+}
+async function execute(deps, orgId, command, signal, controls, verifiedOrganization) {
 	if (isAborted(signal)) return {
 		ok: false,
 		error: Errors.cancelled({ operation: "permissions" })
@@ -44767,17 +45842,18 @@ async function execute(deps, orgId, command, signal) {
 		};
 	}
 	const executionFns = deps.executionFunctions ?? moneyExecutionContract;
-	const prepared = await runIfActive(signal, CAPXUL_OPERATIONS.permissions.prepareExecution, () => deps.convexCall.action(executionFns.preparePermissionExecution, { input: {
+	const prepared = await runIfActive(signal, CAPXUL_OPERATIONS.permissions.prepareExecution, () => withInvocationParentSpan(Effect.suspend(() => deps.convexCall.action(executionFns.preparePermissionExecution, copyInvocationObservation(controls, { input: {
 		orgId,
 		signerAddress,
 		command
-	} }));
+	} }))), controls), deps.runPromise);
 	if (!prepared.ok) return prepared;
 	const expectedSafe = deriveCapxulSafeAddress({ email: session.email });
 	if (prepared.value.chainId !== deps.chainId || prepared.value.signerAddress.toLowerCase() !== signerAddress.toLowerCase() || prepared.value.userOpSenderSafe.toLowerCase() !== expectedSafe.toLowerCase() || prepared.value.operation !== command.operation || prepared.value.orgId !== orgId || canonicalJson(prepared.value.command) !== canonicalJson(command)) return {
 		ok: false,
 		error: Errors.invalidInput("permission", "prepared authority mismatch")
 	};
+	verifiedOrganization(prepared.value.orgId);
 	if (isAborted(signal)) return {
 		ok: false,
 		error: Errors.cancelled({ operation: "permissions" })
@@ -44795,43 +45871,46 @@ async function execute(deps, orgId, command, signal) {
 		ok: false,
 		error: Errors.cancelled({ operation: "permissions" })
 	};
-	return runIfActive(void 0, CAPXUL_OPERATIONS.permissions.submitExecution, () => deps.convexCall.action(executionFns.submitPermissionExecution, { input: {
+	return runIfActive(void 0, CAPXUL_OPERATIONS.permissions.submitExecution, () => withInvocationParentSpan(Effect.suspend(() => deps.convexCall.action(executionFns.submitPermissionExecution, copyInvocationObservation(controls, { input: {
 		executionId: prepared.value.executionId,
 		signature
-	} }));
+	} }))), controls), deps.runPromise);
 }
 function makePermissionMethods(deps, orgId) {
 	const reads = deps.permissionFunctions ?? permissionContract;
+	const ops = CAPXUL_OPERATIONS.org.permissions;
+	const read = (signal, operation, controls) => runIfActive(signal, operation, () => withInvocationParentSpan(Effect.suspend(() => deps.convexCall.query(reads.read, copyInvocationObservation(controls, { orgId }))), controls), deps.runPromise);
+	const command = (operation, build, options) => observed(deps, operation, options, (signal, captured, verifiedOrganization) => execute(deps, orgId, build(), signal, captured, verifiedOrganization));
 	return {
-		create: (input, options) => execute(deps, orgId, {
+		create: (input, options) => command(ops.create, () => ({
 			operation: "create",
 			...input
-		}, options?.signal),
-		change: (input, options) => execute(deps, orgId, {
+		}), options),
+		change: (input, options) => command(ops.change, () => ({
 			operation: "change",
 			...input
-		}, options?.signal),
-		assign: (input, options) => execute(deps, orgId, {
+		}), options),
+		assign: (input, options) => command(ops.assign, () => ({
 			operation: "assign",
 			...input
-		}, options?.signal),
-		revoke: (input, options) => execute(deps, orgId, {
+		}), options),
+		revoke: (input, options) => command(ops.revoke, () => ({
 			operation: "revoke",
 			...input
-		}, options?.signal),
-		replace: (input, options) => execute(deps, orgId, {
+		}), options),
+		replace: (input, options) => command(ops.replace, () => ({
 			operation: "replace",
 			...input
-		}, options?.signal),
-		list: (options) => runIfActive(options?.signal, CAPXUL_OPERATIONS.permissions.list, () => deps.convexCall.query(reads.read, { orgId })),
-		get: async (permissionId, options) => {
-			const listed = await runIfActive(options?.signal, CAPXUL_OPERATIONS.permissions.get, () => deps.convexCall.query(reads.read, { orgId }));
+		}), options),
+		list: (options) => observed(deps, ops.list, options, (signal, captured) => read(signal, CAPXUL_OPERATIONS.permissions.list, captured)),
+		get: (permissionId, options) => observed(deps, ops.get, options, async (signal, captured) => {
+			const listed = await read(signal, CAPXUL_OPERATIONS.permissions.get, captured);
 			if (!listed.ok) return listed;
 			return {
 				ok: true,
 				value: listed.value.permissions.find((row) => row.permissionId === permissionId) ?? null
 			};
-		}
+		})
 	};
 }
 //#endregion
@@ -45326,18 +46405,6 @@ function emitOrgCreateFailed(telemetry, error) {
 		}
 	});
 }
-function emitOrgInviteSent(telemetry, input) {
-	const domain = emailDomain$1(input.email);
-	return emitOrgTelemetry(telemetry, {
-		name: "org_invite_sent",
-		props: {
-			org_id: input.orgId,
-			...domain === void 0 ? {} : { email_domain: domain },
-			role: input.role,
-			status: input.status
-		}
-	});
-}
 function reportOrgTelemetryFailure(kind, name, cause) {
 	if (!isOrgTelemetryDebugEnabled()) return;
 	globalThis.console?.warn?.("[capxul] org telemetry dropped", {
@@ -45513,25 +46580,26 @@ function listMembersProgram(orgId) {
 		return [];
 	});
 }
+/**
+* R06 (#1964): the SDK no longer emits `org_invite_sent`. The backend action
+* that writes the invitation is its ONE producer, so a hermetic call — which
+* writes nothing — can no longer report an invitation that never happened, and
+* a live call is counted once instead of twice. The captured attempt rides the
+* port input, so the durable event carries the correlation this call ran under.
+*/
 function inviteMemberProgram(orgId, input) {
 	return Effect.gen(function* () {
 		const deps = yield* OrgDepsTag;
-		const member = deps.orgPort !== void 0 ? yield* deps.orgPort.inviteMember({
-			orgId,
-			input
-		}).pipe(Effect.mapError((error) => error.publicError)) : hermeticMember({
+		if (deps.orgPort === void 0) return hermeticMember({
 			orgId,
 			email: input.email,
 			role: input.role,
 			status: "pending"
 		});
-		yield* Effect.promise(() => emitOrgInviteSent(deps.telemetry, {
+		return yield* deps.orgPort.inviteMember(copyInvocationObservation(deps.invocationSource, {
 			orgId,
-			email: input.email,
-			role: member.role,
-			status: member.status
-		}));
-		return member;
+			input
+		})).pipe(Effect.mapError((error) => error.publicError));
 	});
 }
 function detectAndAcceptPendingInvitationsProgram() {
@@ -45639,6 +46707,13 @@ function isRetryableOrganizationSetupFailure(error) {
 * constructed for each `org(orgId)` call. It has no shared mutable active-Org
 * state. The closed-over `orgId` is its only entity reference.
 */
+/** The observed-runner pair a method bundle needs to own its operation records. */
+function observedRunnerDeps(deps) {
+	return {
+		...deps.runPromise === void 0 ? {} : { runPromise: deps.runPromise },
+		...deps.invocationControls === void 0 ? {} : { invocationControls: deps.invocationControls }
+	};
+}
 function makeOrgMethods(deps) {
 	const orgDeps = {
 		...deps.orgPort === void 0 ? {} : { orgPort: deps.orgPort },
@@ -45689,7 +46764,10 @@ function makeOrgMethods(deps) {
 					},
 					...convexCall === void 0 ? {} : { convexCall }
 				}),
-				me: convexCall === void 0 ? orgMeUnavailable : makeOrgMeMethod({ convexCall }, String(orgId)),
+				me: convexCall === void 0 ? orgMeUnavailable : makeOrgMeMethod({
+					convexCall,
+					...observedRunnerDeps(deps)
+				}, String(orgId)),
 				async getLifecycle(options) {
 					if (options?.signal?.aborted) return {
 						ok: false,
@@ -45746,32 +46824,27 @@ function makeOrgMethods(deps) {
 					});
 					return treasury(orgId, deps.invocationControls?.(options) ?? options);
 				},
-				account: { async get(options) {
-					if (options?.signal?.aborted) return {
-						ok: false,
-						error: Errors.cancelled({ operation: CAPXUL_OPERATIONS.org.account.get })
-					};
+				account: { get(options) {
 					const controls = deps.invocationControls?.(options) ?? options;
-					const treasuryResult = await treasury(orgId, controls);
-					if (!treasuryResult.ok) return {
-						ok: false,
-						error: treasuryResult.error
-					};
-					const orgList = await listOrganizations(controls);
-					if (!orgList.ok) return {
+					if (controls?.signal?.aborted) return Promise.resolve({
 						ok: false,
-						error: orgList.error
-					};
-					const org = orgList.value.find((candidate) => candidate.id === orgId);
-					return {
-						ok: true,
-						value: {
+						error: Errors.cancelled({ operation: CAPXUL_OPERATIONS.org.account.get })
+					});
+					return runCapxulEffect(Effect.gen(function* () {
+						const parent = yield* Effect.currentSpan.pipe(Effect.orDie);
+						const captured = carryInvocationParentSpan(controls, parent);
+						const treasuryResult = yield* Effect.promise(() => treasury(orgId, captured));
+						if (!treasuryResult.ok) return yield* Effect.fail(treasuryResult.error);
+						const orgList = yield* Effect.promise(() => listOrganizations(captured));
+						if (!orgList.ok) return yield* Effect.fail(orgList.error);
+						const org = orgList.value.find((candidate) => candidate.id === orgId);
+						return {
 							id: treasuryResult.value.id,
 							address: org?.safeAddress ?? null,
 							balance: treasuryResult.value.balance,
 							available: treasuryResult.value.available
-						}
-					};
+						};
+					}), observationOnlyControls(controls), CAPXUL_OPERATIONS.org.account.get, deps.runPromise);
 				} },
 				members(_options) {
 					if (_options?.signal?.aborted) return Promise.resolve({
@@ -45788,11 +46861,15 @@ function makeOrgMethods(deps) {
 					return toCapxulResult(listRolesProgram(orgId), layer);
 				},
 				invite(_input, _options) {
-					if (_options?.signal?.aborted) return Promise.resolve({
+					const controls = deps.invocationControls?.(_options) ?? _options;
+					if (controls?.signal?.aborted) return Promise.resolve({
 						ok: false,
 						error: Errors.cancelled({ operation: CAPXUL_OPERATIONS.org.invite })
 					});
-					return toCapxulResult(inviteMemberProgram(orgId, _input), layer);
+					return runCapxulEffect(inviteMemberProgram(orgId, _input).pipe(Effect.provide(orgDepsLayer({
+						...orgDeps,
+						...controls === void 0 ? {} : { invocationSource: controls }
+					}))), controls, CAPXUL_OPERATIONS.org.invite, deps.runPromise);
 				},
 				auditLog(_options) {
 					if (_options?.signal?.aborted) return Promise.resolve({
@@ -45806,6 +46883,7 @@ function makeOrgMethods(deps) {
 				},
 				permissions: convexCall === void 0 ? makeNotImplementedPermissionMethods() : makePermissionMethods({
 					convexCall,
+					...observedRunnerDeps(deps),
 					...deps.actor === void 0 ? {} : { actor: deps.actor },
 					...deps.chainId === void 0 ? {} : { chainId: Number(deps.chainId) },
 					...deps.signer === void 0 ? {} : { signer: deps.signer }
@@ -45925,14 +47003,65 @@ function compareDecimal(first, second) {
 }
 //#endregion
 //#region ../../packages/sdk/src/surface/holdings.ts
+/** SPEC Freshness: past this block age the read is labelled stale. Nothing refuses. */
+const FRESHNESS_LIMIT_SECONDS = 60;
+/**
+* The Ponder balance view for one Safe as `CurrentHoldings`.
+*
+* The view is the signed sum of every indexed transfer, so the balance IS what
+* the chain said — there is no snapshot to go stale behind it. `observedAt` is
+* the indexed block's own timestamp, which is what the last-good label reads,
+* and `stale` is that block's age. A stopped indexer therefore shows an old
+* "as of" and the stale flag; it never turns the read into a refusal.
+*/
+function indexerHoldings(indexer, convexCall, overlay, actor, controls) {
+	return Effect.gen(function* () {
+		const scope = yield* convexCall.query(overlay, copyInvocationObservation(controls, actor?.kind === "organization" ? { input: { actor: {
+			kind: "organization",
+			orgId: actor.organizationId
+		} } } : { input: {} }));
+		if (scope.safe === null) return null;
+		const balances = yield* indexer.read("balance", {
+			safe: toAddress(scope.safe),
+			limit: INDEXER_MAX_LIMIT
+		});
+		const status = yield* indexer.status.pipe(Effect.catch(() => Effect.succeed([])));
+		const rows = [];
+		for (const balance of balances) {
+			const asset = configuredMoneyAssetById(balance.assetId);
+			if (asset === null || balance.amount < 0n) continue;
+			rows.push({
+				assetKind: "erc20",
+				tokenAddress: toAddress(asset.tokenAddress),
+				symbol: asset.symbol,
+				decimals: asset.decimals,
+				rawBalance: toWeiAmount(balance.amount.toString())
+			});
+		}
+		const chainId = balances[0]?.chainId ?? status[0]?.chainId;
+		if (chainId === void 0) return null;
+		const head = status.find((entry) => entry.chainId === chainId);
+		const nowSeconds = Math.floor(Date.now() / 1e3);
+		const headSeconds = head === void 0 ? void 0 : Number(head.blockTimestamp);
+		return {
+			actor: scope.actor,
+			chainId: toChainId(chainId),
+			observedAt: headSeconds === void 0 ? Date.now() : headSeconds * 1e3,
+			stale: headSeconds === void 0 || nowSeconds - headSeconds > FRESHNESS_LIMIT_SECONDS,
+			rows
+		};
+	}).pipe(Effect.catch(() => Effect.succeed(null)));
+}
 function makeHoldingsMethods(deps) {
 	const functions = deps.functions ?? holdingsContract;
+	const overlay = (deps.financialOpsFunctions ?? financialOpsContract).activityOverlay;
 	const read = (operation, actor, options, pick) => {
 		const controls = deps.invocationControls?.(options) ?? options;
-		return runCapxulEffect(retryIdempotentRead(deps.convexCall.action(functions.current, copyInvocationObservation(controls, actor?.kind === "organization" ? { actor: {
+		const convexSnapshot = retryIdempotentRead(deps.convexCall.action(functions.current, copyInvocationObservation(controls, actor?.kind === "organization" ? { actor: {
 			kind: "organization",
 			orgId: actor.organizationId
-		} } : {})), operation, deps.telemetry, controls).pipe(Effect.map(pick), Effect.mapError((error) => error.publicError)), controls, operation, deps.runPromise);
+		} } : {})), operation, deps.telemetry, controls).pipe(Effect.mapError((error) => error.publicError));
+		return runCapxulEffect((deps.indexerRead === void 0 ? convexSnapshot : indexerHoldings(deps.indexerRead, deps.convexCall, overlay, actor, controls).pipe(Effect.flatMap((current) => current === null ? convexSnapshot : Effect.succeed(current)))).pipe(Effect.map(pick)), controls, operation, deps.runPromise);
 	};
 	return {
 		current: (input, options) => read(CAPXUL_OPERATIONS.holdings.current, input?.actor, options, (snapshot) => snapshot),
@@ -46066,8 +47195,8 @@ const APPLIED_ACTION_BY_EVENT = {
 	RestoreSession: "none",
 	ResumeOtpEntry: "none",
 	Reset: "none",
-	SessionRestored: "none",
-	SessionAbsent: "none",
+	SessionRestored: "restoration",
+	SessionAbsent: "restoration",
 	EnsureAccount: "none",
 	ClaimAccount: "none",
 	RetryAccount: "none",
@@ -46079,8 +47208,8 @@ const APPLIED_ACTION_BY_EVENT = {
 	OtpFailed: "failed",
 	Verified: "verified",
 	VerifyFailed: "failed",
-	SessionRead: "none",
-	SessionReadFailed: "none",
+	SessionRead: "restoration",
+	SessionReadFailed: "restoration",
 	SignedOut: "signed-out",
 	SignOutFailed: "failed",
 	AccountAt: "none",
@@ -46106,6 +47235,49 @@ const authFailure = (record, reason, mode) => ({
 		...linkage(record)
 	}
 });
+/**
+* The label of the restore window every client boots into. A settled session
+* fact that left this label is the restoration result (#1962 R04); the same
+* facts from a signed-out or authenticated state are the routine session probe
+* that `getSession()` runs, and a probe is not a restoration attempt.
+*/
+const RESTORE_WINDOW = "restoring";
+/**
+* Which result the window settled on. `SessionRestored` and `SessionAbsent` are
+* the cache door and say it themselves. `ReadSession` is also valid inside the
+* window — `getSession()` drives it on a cache miss and its `SessionRead`
+* completion settles the window — so that one event reports both halves and the
+* state it produced is what separates them.
+*/
+const restorationOutcome = (event, state) => {
+	switch (event) {
+		case "SessionRestored": return "restored";
+		case "SessionAbsent": return "absent";
+		case "SessionReadFailed": return "failed";
+		case "SessionRead":
+			if (state.phase === "authenticated") return "restored";
+			return state.phase === "signed_out" ? "absent" : void 0;
+		default: return;
+	}
+};
+/**
+* The restore window's one result, or nothing when this settled session fact
+* belongs to a probe rather than to the window.
+*/
+const restorationObservation = (record, state) => {
+	if (record.slot !== "identity:session" || record.from !== RESTORE_WINDOW) return NONE;
+	const outcome = restorationOutcome(record.event, state);
+	if (outcome === void 0) return NONE;
+	return {
+		name: "access_recovery_completed",
+		props: {
+			recovery: "session_restoration",
+			outcome,
+			...outcome === "failed" && state.phase === "faulted" ? { reason_code: state.failure.code } : {},
+			...linkage(record)
+		}
+	};
+};
 const REFUSAL_EVENTS = /* @__PURE__ */ new Set([
 	"ClaimAccount",
 	"RetryAccount",
@@ -46150,6 +47322,7 @@ function mapIdentityProductObservation(record, state) {
 			name: "auth_signed_out",
 			props: linkage(record)
 		};
+		case "restoration": return restorationObservation(record, state);
 	}
 }
 const ignoreTransportFailure = (operation, operationName, eventName) => Effect.suspend(operation).pipe(Effect.catchCause(() => Effect.logWarning("identity.product.telemetry.dropped").pipe(Effect.annotateLogs({
@@ -46161,7 +47334,7 @@ function executeIdentityProductObservation(telemetry, record, state) {
 	if (mapped === null) return Effect.void;
 	copyInvocationObservation(record, mapped);
 	const invocationTelemetry = bindProductTelemetryInvocation(telemetry, mapped);
-	const after = () => mapped.name === "auth_verified" && state.phase === "authenticated" ? invocationTelemetry.identify({
+	const after = () => state.phase === "authenticated" && (mapped.name === "auth_verified" || mapped.name === "access_recovery_completed") ? invocationTelemetry.identify({
 		distinctId: state.session.authUserId,
 		traits: { email_domain: emailDomain(state.session.email) }
 	}) : mapped.name === "auth_signed_out" ? invocationTelemetry.reset() : Effect.void;
@@ -46206,6 +47379,73 @@ function startSignerReadinessOnClaim(actor, signer) {
 		browserSigner.ensureWalletReady?.().catch(() => {});
 	});
 }
+/**
+* Report the result of each signer readiness cycle (#1962 R04).
+*
+* The readiness store already carries the cycle boundary this needs, so no
+* public signer hook, second identity subscriber, or render counter is added.
+* `ensureOpenfortWalletReady` writes `recovering` synchronously when it starts
+* a cycle, and only the cycle that is still the current one writes `ready` or
+* `unavailable` (`create-openfort-browser-signer.ts:501-521`). Callers that
+* join a live cycle share that single write, and a `resetSession` writes
+* `unknown` first, so a cycle that a reset or an account replacement outran
+* reports nothing.
+*
+* The host context is bound when the cycle starts, so a person who signs out
+* and back in while a cycle runs cannot relabel the result that began under
+* the previous person. A signer with no readiness cycle — a node or dev key,
+* and a headless client whose requirement never opens the account lane —
+* writes no status and reports nothing.
+*/
+function observeSignerReadinessCycles(signer, telemetry, hostObservationSnapshot, runPromise) {
+	const statusStore = signer?.statusStore;
+	if (statusStore === void 0 || telemetry === void 0) return () => {};
+	let running = false;
+	let startContext;
+	return statusStore.subscribe((status) => {
+		if (status === "recovering") {
+			running = true;
+			startContext = hostObservationSnapshot?.();
+			return;
+		}
+		const cycleContext = startContext;
+		const completesCycle = running;
+		running = false;
+		startContext = void 0;
+		if (!completesCycle || status !== "ready" && status !== "unavailable") return;
+		const event = {
+			name: "access_recovery_completed",
+			props: {
+				recovery: "signer_readiness",
+				outcome: status
+			}
+		};
+		if (cycleContext !== void 0) attachInvocationObservation(event, cycleContext);
+		runPromise(Effect.suspend(() => bindProductTelemetryInvocation(telemetry, event).emit(event)).pipe(Effect.catchCause(() => Effect.void))).catch(() => {});
+	});
+}
+/** Join the assembled actor lifetime to the adapter lifetime for internal client factories. */
+function withAdapterClose(client, closeAdapter) {
+	const closeActor = client._internal.close;
+	let closePromise;
+	const close = () => {
+		closePromise ??= Promise.allSettled([Promise.resolve().then(() => closeActor?.()), Promise.resolve().then(closeAdapter)]).then((results) => {
+			const failure = results.find((result) => result.status === "rejected");
+			if (failure?.status === "rejected") throw failure.reason;
+		});
+		return closePromise;
+	};
+	return {
+		...client,
+		close: () => closeClientResources(close),
+		_internal: {
+			...client._internal,
+			close
+		}
+	};
+}
+/** Keep lifecycle failures on the same public result boundary as domain work. */
+const closeClientResources = (close) => toCapxulResult(Effect.promise(close), Layer.empty);
 function assembleCapxulClient(input) {
 	const observation = input;
 	const authCache = input.authCache ?? detectAuthCacheAdapter();
@@ -46235,12 +47475,14 @@ function assembleCapxulClient(input) {
 		}, failureObservation, normalizeCapxulOperation(`identity.${record.event}`), "machine");
 	});
 	const unsubscribeSignerReadiness = startSignerReadinessOnClaim(actor, input.signer);
+	const unsubscribeReadinessObservation = observeSignerReadinessCycles(input.signer, input.ports.telemetry, observation.hostObservationSnapshot, effectRunner.runPromise);
 	let stopPromise = null;
 	const stopActor = () => {
 		if (stopPromise === null) {
 			unsubscribeProductTelemetry();
 			unsubscribeFailureObservation();
 			unsubscribeSignerReadiness();
+			unsubscribeReadinessObservation();
 			stopPromise = effectRunner.runPromise(Scope.close(scope, Exit.void));
 		}
 		return stopPromise;
@@ -46257,7 +47499,8 @@ function assembleCapxulClient(input) {
 		convexCall: input.ports.convexCall,
 		...input.signer === void 0 ? {} : { signer: input.signer },
 		telemetry: input.ports.telemetry,
-		requestKeyScope: `${input.bootstrap.convexUrl}:${String(input.bootstrap.chainId)}`
+		requestKeyScope: `${input.bootstrap.convexUrl}:${String(input.bootstrap.chainId)}`,
+		...input.ports.indexerRead === void 0 ? {} : { indexerRead: input.ports.indexerRead }
 	});
 	const accountBundle = makeAccountMethods({
 		actor,
@@ -46322,13 +47565,18 @@ function assembleCapxulClient(input) {
 		subscribeIdentity: actor.subscribe,
 		sendIdentity: (event, options) => runCapxulEffect(askIdentity(actor, event, options), options, CAPXUL_OPERATIONS._internal.identity.send, effectRunner.runPromise)
 	});
-	const system = makeSystemMethods({ convexCall: input.ports.convexCall });
+	const system = makeSystemMethods({
+		convexCall: input.ports.convexCall,
+		runPromise: effectRunner.runPromise,
+		invocationControls: (controls) => withHostObservationControls(observation.hostObservationSnapshot, controls)
+	});
 	const media = makeMediaMethods({ convexCall: input.ports.convexCall });
 	const holdings = makeHoldingsMethods({
 		convexCall: input.ports.convexCall,
 		telemetry: input.ports.telemetry,
 		runPromise: effectRunner.runPromise,
-		invocationControls: (controls) => withHostObservationControls(observation.hostObservationSnapshot, controls, actor.authSession()?.authUserId)
+		invocationControls: (controls) => withHostObservationControls(observation.hostObservationSnapshot, controls, actor.authSession()?.authUserId),
+		...input.ports.indexerRead === void 0 ? {} : { indexerRead: input.ports.indexerRead }
 	});
 	const accounts = makeAccountsMethods({
 		accountReadPort: input.ports.accountRead,
@@ -46471,7 +47719,8 @@ function assembleCapxulClient(input) {
 				})).pipe(Effect.catchCause(() => Effect.void)));
 			},
 			close: stopActor
-		}
+		},
+		close: () => closeClientResources(stopActor)
 	}, observation.failureObservation, observation.hostObservationSnapshot);
 }
 function transitionError(record) {
@@ -46521,6 +47770,7 @@ function withHostObservationControls(snapshot, input, actorId) {
 }
 //#endregion
 //#region ../../packages/sdk/src/host-observability.ts
+const HOST_ENGINEERING_POLICY = Symbol("capxul.host-engineering-policy");
 const HOST_INVOCATION = Symbol("capxul.host-observability-invocation");
 /** @internal Bind both projections to one call-start decision/context snapshot. */
 function bindHostObservabilityInvocation(observability) {
@@ -46534,36 +47784,14 @@ function snapshotHostObservability(observability) {
 		...snapshot.context === void 0 ? {} : { context: snapshot.context }
 	};
 }
-//#endregion
-//#region ../../packages/sdk/src/ports/indexer-read.ts
-/** The indexer's own page bound. Exceeding it is a caller defect, not a refusal. */
-const INDEXER_MAX_LIMIT = 1e3;
-const LOWER_CASE_ADDRESS = /^0x[0-9a-f]{40}$/;
-/**
-* Refuse a page the indexer would refuse, before any implementation spends a
-* round trip on it. Every implementation calls this, so a consumer test written
-* against the hermetic adapter cannot pass on input production rejects. Throws
-* a `CapxulError`; callers convert it to an `IndexerReadError`.
-*/
-function assertIndexerPage(input) {
-	const safe = String(input.safe).toLowerCase();
-	if (!LOWER_CASE_ADDRESS.test(safe)) throw Errors.invalidInput("safe", "must be a lower-case EVM address");
-	if (!Number.isSafeInteger(input.limit) || input.limit < 1 || input.limit > 1e3) throw Errors.invalidInput("limit", `must be an integer from 1 to ${INDEXER_MAX_LIMIT}`);
-	const offset = input.offset ?? 0;
-	if (!Number.isSafeInteger(offset) || offset < 0) throw Errors.invalidInput("offset", "must be a non-negative integer");
-	return safe;
-}
-var IndexerReadError = class extends Data.TaggedError("IndexerReadError") {};
-function indexerReadErrorFromCapxul(operation, error, cause = error) {
-	return new IndexerReadError({
-		operation,
-		publicCode: error.code,
-		publicError: error,
-		cause,
-		...error.details === void 0 ? {} : { details: error.details }
-	});
+/** @internal Carry the explicit host engineering policy into production composition. */
+function hostEngineeringPolicy(observability) {
+	const policy = observability?.[HOST_ENGINEERING_POLICY];
+	return {
+		...policy?.engineeringEnabled === void 0 ? {} : { enabled: policy.engineeringEnabled },
+		...policy?.engineeringPrivacy === void 0 ? {} : { privacy: policy.engineeringPrivacy }
+	};
 }
-Context.Service()("@capxul/sdk/ports/IndexerReadPort");
 //#endregion
 //#region ../../packages/sdk/src/adapters/ponder/decode.ts
 /**
@@ -46614,6 +47842,7 @@ function identity(row) {
 		chainId: toChainId(integer(row, "chain_id")),
 		txHash: toTxHash(hex(row, "tx_hash")),
 		transactionLogOrdinal: integer(row, "transaction_log_ordinal"),
+		logIndex: integer(row, "log_index"),
 		blockNumber: big(row, "block_number"),
 		blockHash: hex(row, "block_hash"),
 		timestamp: big(row, "timestamp")
@@ -46696,8 +47925,8 @@ function decodeStatus(body) {
 * that allowlist changes, this file changes with it or every read fails 403.
 */
 const HEADS = {
-	transfer: "select \"id\", \"chain_id\", \"tx_hash\", \"transaction_log_ordinal\", \"block_number\", \"block_hash\", \"timestamp\", \"asset_id\", \"token\", \"from\", \"to\", \"amount\" from \"transfer\" where (\"transfer\".\"from\" = $1 or \"transfer\".\"to\" = $2) order by \"transfer\".\"block_number\" desc, \"transfer\".\"id\" desc",
-	payment: "select \"id\", \"chain_id\", \"tx_hash\", \"transaction_log_ordinal\", \"block_number\", \"block_hash\", \"timestamp\", \"contract\", \"settlement_id\", \"sender\", \"recipient\", \"asset_id\", \"token\", \"amount\", \"kind\", \"document_hash\" from \"payment\" where (\"payment\".\"sender\" = $1 or \"payment\".\"recipient\" = $2) order by \"payment\".\"block_number\" desc, \"payment\".\"id\" desc",
+	transfer: "select \"id\", \"chain_id\", \"tx_hash\", \"transaction_log_ordinal\", \"log_index\", \"block_number\", \"block_hash\", \"timestamp\", \"asset_id\", \"token\", \"from\", \"to\", \"amount\" from \"transfer\" where (\"transfer\".\"from\" = $1 or \"transfer\".\"to\" = $2) order by \"transfer\".\"block_number\" desc, \"transfer\".\"id\" desc",
+	payment: "select \"id\", \"chain_id\", \"tx_hash\", \"transaction_log_ordinal\", \"log_index\", \"block_number\", \"block_hash\", \"timestamp\", \"contract\", \"settlement_id\", \"sender\", \"recipient\", \"asset_id\", \"token\", \"amount\", \"kind\", \"document_hash\" from \"payment\" where (\"payment\".\"sender\" = $1 or \"payment\".\"recipient\" = $2) order by \"payment\".\"block_number\" desc, \"payment\".\"id\" desc",
 	balance: "select \"chain_id\", \"asset_id\", \"to\", \"amount\" from \"balance\" where \"balance\".\"to\" = $1"
 };
 /** How many times the statement binds the Safe address. */
@@ -46747,11 +47976,16 @@ function ponderQueryParam(query) {
 * policy allows exactly one request header (`Authorization`), so this reader
 * sends nothing else. Ponder writes one `data:` line per frame.
 */
-async function readEventStream(body, onData, stopped) {
+async function readEventStream(body, onData, stopped, signal) {
 	const reader = body.getReader();
 	const decoder = new TextDecoder();
 	let buffer = "";
+	const cancel = () => {
+		reader.cancel().catch(() => void 0);
+	};
+	signal?.addEventListener("abort", cancel, { once: true });
 	try {
+		if (signal?.aborted) return;
 		for (;;) {
 			const { done, value } = await reader.read();
 			if (done || stopped()) return;
@@ -46767,6 +48001,7 @@ async function readEventStream(body, onData, stopped) {
 			}
 		}
 	} finally {
+		signal?.removeEventListener("abort", cancel);
 		await reader.cancel().catch(() => void 0);
 	}
 }
@@ -46803,12 +48038,10 @@ var PonderIndexerAdapter = class {
 	subscribe(table, input, callback) {
 		const operation = CAPXUL_OPERATIONS.activity.subscribe;
 		return Effect.sync(() => {
-			let stopped = false;
-			const unsubscribe = () => {
-				stopped = true;
-			};
+			const controller = new AbortController();
+			const unsubscribe = () => controller.abort();
 			callback({ status: "loading" });
-			this.#stream(table, input, operation, callback, () => stopped).catch(() => void 0);
+			this.#stream(table, input, operation, callback, controller.signal).catch(() => void 0);
 			return unsubscribe;
 		});
 	}
@@ -46821,9 +48054,13 @@ var PonderIndexerAdapter = class {
 		catch: (cause) => toIndexerReadError("indexer.status", cause)
 	});
 	/** One authenticated `/sql/:method` call. Throws a `CapxulError` on refusal. */
-	async #request(method, table, input, operation) {
+	async #request(method, table, input, operation, signal, forceRefreshToken = false) {
 		const query = ponderQuery(table, input);
-		const token = await this.#token({ forceRefreshToken: false });
+		const token = await this.#token({
+			forceRefreshToken,
+			...signal === void 0 ? {} : { signal }
+		});
+		if (signal?.aborted) throw Errors.cancelled({ operation });
 		if (token === null || token === "") throw Errors.notAuthenticated();
 		const url = `${this.#baseUrl}/sql/${method}?sql=${encodeURIComponent(ponderQueryParam(query))}`;
 		const headers = { authorization: `Bearer ${token}` };
@@ -46832,7 +48069,8 @@ var PonderIndexerAdapter = class {
 		try {
 			response = await this.#fetch(url, {
 				method: "GET",
-				headers
+				headers,
+				...signal === void 0 ? {} : { signal }
 			});
 		} catch (cause) {
 			throw Errors.networkError(operation, cause, {
@@ -46844,39 +48082,72 @@ var PonderIndexerAdapter = class {
 		return response;
 	}
 	/**
-	* Follow the live stream until the caller unsubscribes or the indexer closes
-	* it. The indexer closes the stream on token expiry or revoked authority
-	* with no frame, so any end the caller did not ask for is a teardown: it
-	* reaches `captureException` under `activity.subscribe` and the caller sees
-	* one `error` snapshot.
+	* Keep the subscription alive across transport loss. Every new connection
+	* rechecks authority. A refusal or invalid payload is terminal. Unsubscribe
+	* aborts both the current request and any reconnect delay.
 	*/
-	async #stream(table, input, operation, callback, stopped) {
-		let failure;
-		try {
-			const response = await this.#request("live", table, input, operation);
-			if (response.body === null) throw Errors.providerError("indexer", operation, "empty stream");
-			await readEventStream(response.body, (data) => {
-				try {
-					callback({
-						status: "ok",
-						value: decodeRows(table, JSON.parse(data))
-					});
-				} catch (cause) {
-					failure = toPublicError$1(operation, cause);
-				}
-			}, () => stopped() || failure !== void 0);
-		} catch (cause) {
-			failure = toPublicError$1(operation, cause);
+	async #stream(table, input, operation, callback, signal) {
+		let refreshToken = false;
+		let delay = 1e3;
+		let reported = false;
+		while (!signal.aborted) {
+			let failure;
+			let invalidFrame = false;
+			let reading = false;
+			const startedAt = Date.now();
+			try {
+				const response = await this.#request("live", table, input, operation, signal, refreshToken);
+				if (response.body === null) throw Errors.providerError("indexer", operation, "empty stream");
+				reading = true;
+				await readEventStream(response.body, (data) => {
+					try {
+						callback({
+							status: "ok",
+							value: decodeRows(table, JSON.parse(data))
+						});
+						reported = false;
+					} catch (cause) {
+						invalidFrame = true;
+						failure = toPublicError$1(operation, cause);
+					}
+				}, () => signal.aborted || failure !== void 0, signal);
+			} catch (cause) {
+				failure = reading && !(cause instanceof CapxulError) ? Errors.networkError(operation, cause, {
+					provider: "indexer",
+					failure_mode: "upstream-down"
+				}) : toPublicError$1(operation, cause);
+			}
+			if (signal.aborted || failure?.code === "CANCELLED") return;
+			const error = failure ?? Errors.capabilityUnavailable("indexer", operation);
+			const retryable = !invalidFrame && (error.code === "NETWORK_ERROR" || error.code === "CAPABILITY_UNAVAILABLE" || error.code === "RATE_LIMITED" || error.mode === "upstream-down");
+			if (!reported || !retryable) {
+				observeStreamFailure(this.#observation, operation, error, error.code === "NOT_AUTHENTICATED" ? "operation" : "exception");
+				callback({
+					status: "error",
+					error
+				});
+				reported = true;
+			}
+			if (!retryable) return;
+			if (Date.now() - startedAt >= 3e4) delay = 1e3;
+			await reconnectDelay(delay, signal);
+			delay = Math.min(delay * 2, 3e4);
+			refreshToken = true;
 		}
-		if (stopped()) return;
-		const error = failure ?? Errors.capabilityUnavailable("indexer", operation);
-		observeStreamFailure(this.#observation, CAPXUL_OPERATIONS.activity.subscribe, error);
-		callback({
-			status: "error",
-			error
-		});
 	}
 };
+function reconnectDelay(milliseconds, signal) {
+	return new Promise((resolve) => {
+		const finish = () => {
+			clearTimeout(timer);
+			signal.removeEventListener("abort", finish);
+			resolve();
+		};
+		const timer = setTimeout(finish, milliseconds);
+		signal.addEventListener("abort", finish, { once: true });
+		if (signal.aborted) finish();
+	});
+}
 /**
 * Map an indexer refusal into the shared error vocabulary.
 *
@@ -47244,6 +48515,7 @@ function productionAuthCacheLayer(input) {
 function productionConvexCallLayer(input, refreshConvexAuthRef) {
 	return Layer.unwrap(Effect.map(AuthClientPortTag, (authClient) => ConvexCallLayer({
 		convexUrl: input.runtimeUrls.convexUrl,
+		logToStderr: input.runtime === "node",
 		...input.applicationId === void 0 ? {} : { applicationId: input.applicationId },
 		...input.observation === void 0 ? {} : { observation: input.observation },
 		...input.convexClient === void 0 ? {} : { client: input.convexClient },
@@ -47365,7 +48637,7 @@ async function createProductionAdapters(input) {
 			...input.signal === void 0 ? {} : { signal: input.signal },
 			...input.resetSignerSession === void 0 ? {} : { resetSignerSession: input.resetSignerSession }
 		}));
-		const applicationLayer = Layer.merge(portsLayer, optionalEngineeringTelemetryLayer(bootstrapResult.value.engineeringTelemetry, resolvedInput.value.runtime));
+		const applicationLayer = Layer.merge(portsLayer, optionalEngineeringTelemetryLayer(bootstrapResult.value.engineeringTelemetry, resolvedInput.value.runtime, hostEngineeringPolicy(input.observability))).pipe(Layer.provideMerge(resolvedInput.value.runtime === "node" ? Layer.succeed(Logger.LogToStderr, true) : Layer.empty));
 		const context = await Effect.runPromise(Layer.buildWithScope(applicationLayer, scope));
 		const collected = await Effect.runPromise(collectProductionFlowPorts.pipe(Effect.provide(context)));
 		const indexerUrl = input.indexerUrl ?? bootstrapResult.value.indexerUrl;
@@ -47414,7 +48686,7 @@ function observeProductionConvexConnection(convexCall, context) {
 		return () => {};
 	}
 }
-function optionalEngineeringTelemetryLayer(policy, runtime) {
+function optionalEngineeringTelemetryLayer(policy, runtime, hostPolicy) {
 	if (policy === void 0) return Layer.empty;
 	try {
 		return makeEngineeringTelemetryLayer({
@@ -47422,7 +48694,8 @@ function optionalEngineeringTelemetryLayer(policy, runtime) {
 			headers: { authorization: `Bearer ${policy.projectToken}` },
 			capxulEnv: policy.capxulEnv,
 			producer: runtime === "browser" ? "browser" : "server",
-			sdkVersion: SDK_VERSION
+			sdkVersion: SDK_VERSION,
+			...hostPolicy
 		});
 	} catch {
 		return Layer.empty;
@@ -47517,7 +48790,7 @@ async function createCapxulClientWithSignerControls(input, controls) {
 				}
 			};
 		}
-		const client = assembleCapxulClient({
+		const ownedClient = withAdapterClose(assembleCapxulClient({
 			ports: adapters.value.ports,
 			bootstrap: adapters.value.bootstrap,
 			authCache: adapters.value.ports.authCache,
@@ -47538,8 +48811,7 @@ async function createCapxulClientWithSignerControls(input, controls) {
 				runSync: Effect.runSyncWith(adapters.value.context),
 				runPromise: Effect.runPromiseWith(adapters.value.context)
 			}
-		});
-		const upstreamClose = adapters.value.close;
+		}), adapters.value.close);
 		const close = idempotentClose(async () => {
 			try {
 				if (signer !== void 0 && "resetSession" in signer) try {
@@ -47548,15 +48820,16 @@ async function createCapxulClientWithSignerControls(input, controls) {
 					throw signerFailure(signer.source, "resetSession", cause);
 				}
 			} finally {
-				await Promise.all([client._internal.close?.(), upstreamClose()]);
+				await ownedClient._internal.close?.();
 			}
 		});
 		return {
 			ok: true,
 			value: {
-				...client,
+				...ownedClient,
+				close: () => closeClientResources(close),
 				_internal: {
-					...client._internal,
+					...ownedClient._internal,
 					close
 				}
 			}
@@ -47715,15 +48988,17 @@ function idempotentClose(close) {
 * and Convex see one session with one scope.
 */
 function productionIndexerReadPort(input, ports, observation) {
+	if (input.activityReadSource === "convex") return void 0;
 	if (input.indexerUrl === void 0 || input.indexerUrl === "") return void 0;
 	return new PonderIndexerAdapter({
 		baseUrl: normalizeHttpUrl("indexerUrl", input.indexerUrl),
-		token: async ({ forceRefreshToken }) => {
+		token: async ({ forceRefreshToken, signal }) => {
+			const tokenSignal = input.signal === void 0 ? signal : signal === void 0 ? input.signal : AbortSignal.any([input.signal, signal]);
 			const token = await Effect.runPromise(Effect.result(ports.authClient.getConvexJwt({
 				forceRefresh: forceRefreshToken,
-				...input.signal === void 0 ? {} : { signal: input.signal }
+				...tokenSignal === void 0 ? {} : { signal: tokenSignal }
 			})));
-			if (Result.isFailure(token)) return null;
+			if (Result.isFailure(token)) throw toPublicError(token.failure, "getConvexJwt");
 			return String(token.success.token);
 		},
 		...input.fetch === void 0 ? {} : { fetch: input.fetch },
@@ -48341,7 +49616,7 @@ function stdioIdentity(env = process.env, options = {}) {
 }
 //#endregion
 //#region package.json
-var version = "4.2.0-rc.9";
+var version = "4.20.0-beta.1";
 //#endregion
 //#region src/deps.ts
 const NO_IDENTITY = async () => void 0;