@capxul/mcp 4.20.0-beta.2 → 4.20.0-beta.4

package/dist/main.mjs

@@ -8,8 +8,8 @@ import { createHash } from "node:crypto";
 import { createServer } from "node:http";
 import { localhostHostValidation, localhostOriginValidation, toNodeHandler } from "@modelcontextprotocol/node";
 import { z } from "zod";
-import { Cause, Clock, Context, Data, Deferred, Duration, Effect, Exit, Fiber, FiberSet, Layer, Logger, Option, Queue, Ref, Result, Schedule, Schema, SchemaGetter, SchemaIssue, SchemaParser, Scope, Stream, Tracer } from "effect";
-import { FetchHttpClient, Headers, HttpBody, HttpClient, HttpClientResponse, HttpTraceContext } from "effect/unstable/http";
+import { Cause, Clock, Context, Data, Deferred, Duration, Effect, Exit, Fiber, FiberSet, Layer, Logger, Metric, Option, Queue, Ref, References, Result, Schedule, Schema, SchemaGetter, SchemaIssue, SchemaParser, Scope, Stream, Tracer } from "effect";
+import { FetchHttpClient, Headers, HttpBody, HttpClient, HttpClientError, HttpClientResponse, HttpTraceContext } from "effect/unstable/http";
 import { OtlpExporter, OtlpLogger, OtlpMetrics, OtlpSerialization, OtlpTracer } from "effect/unstable/observability";
 import { resolve } from "path";
 import util from "util";
@@ -99,7 +99,12 @@ const CREDENTIAL_FIELDS = /* @__PURE__ */ new Set([
 	"authcode",
 	"authorizationcode",
 	"oauthcode",
-	"codeverifier"
+	"codeverifier",
+	"devicecode",
+	"usercode",
+	"continuitytoken",
+	"refreshattemptid",
+	"revocationtoken"
 ]);
 /** Match credential fields by meaning, without hiding token addresses or replay IDs. */
 function isCredentialField(name, context) {
@@ -858,6 +863,8 @@ const COUNTRY_CODE_RE = /^[A-Z]{2}$/;
 const ACCOUNT_ID_RE = /^account_[0-9A-Za-z]+$/;
 const PARTY_ID_RE$1 = /^party_[0-9A-Za-z]+$/;
 const APP_ID_RE = /^app_[0-7][0-9A-HJKMNP-TV-Z]{25}$/;
+const CLIENT_REQUEST_ID_RE = /^creq_[0-7][0-9A-HJKMNP-TV-Z]{25}$/;
+const CLIENT_GRANT_ID_RE = /^cgrant_[0-7][0-9A-HJKMNP-TV-Z]{25}$/;
 const TX_HASH_RE = /^0x[0-9a-f]{64}$/i;
 const WEI_RE = /^[0-9]+$/;
 Math.floor(Number.MAX_SAFE_INTEGER / 1e3);
@@ -8180,6 +8187,92 @@ const ContactActionProps = {
 	party_id: OptionalString,
 	reason_code: OptionalReasonCode
 };
+/** One completed online CLI diagnostic. No command input or provider text. */
+const CLI_COMMAND_NAMES = [
+	"capxul",
+	"doctor",
+	"telemetry",
+	"telemetry.status",
+	"telemetry.enable",
+	"telemetry.disable",
+	"unknown"
+];
+const CLI_CAPABILITIES = [
+	"cli",
+	"diagnostics",
+	"collection"
+];
+const CLI_INVOCATION_KINDS = [
+	"command",
+	"help",
+	"version",
+	"completion",
+	"parse_refusal",
+	"collection_control"
+];
+const CliRelease = Schema.String.check(Schema.isPattern(/^[A-Za-z0-9][A-Za-z0-9._+-]{0,127}$/u));
+const CliInvocationProps = {
+	...TelemetryEnvelopeProps,
+	schema_version: Schema.Literal(1),
+	command: Schema.Literals(CLI_COMMAND_NAMES),
+	capability: Schema.Literals(CLI_CAPABILITIES),
+	invocation_kind: Schema.Literals(CLI_INVOCATION_KINDS),
+	invocation_id: Schema.String.check(Schema.isPattern(/^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/u)),
+	cli_identity_kind: Schema.optional(Schema.Literal("anonymous")),
+	anonymous_id: Schema.optional(Schema.String.check(Schema.isPattern(/^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/u))),
+	occurred_at: Schema.Number,
+	cli_version: CliRelease,
+	sdk_version: CliRelease,
+	release: CliRelease,
+	platform: Schema.Literals([
+		"darwin",
+		"linux",
+		"unknown"
+	]),
+	architecture: Schema.Literals([
+		"arm64",
+		"x64",
+		"unknown"
+	]),
+	ci: Schema.Boolean,
+	tty: Schema.Boolean,
+	output_mode: Schema.Literals(["human", "json"])
+};
+Schema.Struct({
+	name: Schema.Literal("cli_first_used"),
+	props: Schema.Struct(CliInvocationProps)
+});
+Schema.Struct({
+	name: Schema.Literal("cli_command_started"),
+	props: Schema.Struct({
+		...CliInvocationProps,
+		invocation_kind: Schema.Literals([
+			"command",
+			"help",
+			"version"
+		])
+	})
+});
+Schema.Struct({
+	name: Schema.Literal("cli_command_completed"),
+	props: Schema.Struct({
+		...CliInvocationProps,
+		outcome: Schema.Literals([
+			"succeeded",
+			"refused",
+			"failed",
+			"cancelled"
+		]),
+		duration_ms: Schema.Number,
+		error_code: Schema.optional(Schema.Literals([
+			...CAPXUL_ERROR_CODES,
+			"CLI_USAGE",
+			"CLI_CONFIG",
+			"CLI_STORAGE",
+			"CLI_DEFECT"
+		]))
+	})
+});
 Schema.Struct({
 	name: Schema.Literal("cli_diagnostic_completed"),
 	props: Schema.Struct({
@@ -9045,6 +9138,30 @@ const PAYMENT_DOCUMENT_KINDS = [
 	"receipt",
 	"withdrawal"
 ];
+/** Native browser projection, distinct from the issuer's persisted request state. */
+const CLIENT_AUTHORIZATION_PHASE = {
+	OTP_REQUIRED: "otp_required",
+	REVIEW: "review",
+	PROCESSING: "processing",
+	CONNECTED: "connected",
+	REFUSED: "refused"
+};
+CLIENT_AUTHORIZATION_PHASE.OTP_REQUIRED, CLIENT_AUTHORIZATION_PHASE.REVIEW, CLIENT_AUTHORIZATION_PHASE.PROCESSING, CLIENT_AUTHORIZATION_PHASE.CONNECTED, CLIENT_AUTHORIZATION_PHASE.REFUSED;
+/** Closed native refusals; existing Capxul error codes retain their own meaning. */
+const CLIENT_AUTHORIZATION_REFUSALS = [
+	"signup_required",
+	"setup_required",
+	"already_signed_up",
+	"identity_mismatch",
+	"invalid_request",
+	"request_expired",
+	"request_denied",
+	"cancelled",
+	"grant_revoked",
+	"grant_expired",
+	"refresh_reused",
+	"revoke_unconfirmed"
+];
 //#endregion
 //#region ../../packages/wire/src/financial-ops.ts
 const MINOR_UNIT_STRING_RE = /^[0-9]+$/;
@@ -10746,6 +10863,251 @@ function isSafeField(field, value) {
 	return value.length > 0 && value.length <= rule.maxLength && value === value.trim() && !value.includes("://") && !containsSensitiveMaterial(value) && rule.pattern.test(value);
 }
 //#endregion
+//#region ../../packages/wire/src/client-authorization.ts
+const NATIVE_CLIENT_ID = "capxul-cli";
+const NATIVE_CLIENT_SCOPE = "account:read";
+const NATIVE_CLIENT_LIMITS = {
+	accessMs: 36e5,
+	renewalMs: 2592e6,
+	absoluteMs: 7776e6,
+	requestMs: 6e5,
+	pollSeconds: 5,
+	imageBytes: 5242880
+};
+const strict = { parseOptions: { onExcessProperty: "error" } };
+const text$2 = (max) => Schema.String.check(Schema.isMinLength(1), Schema.isMaxLength(max));
+const nonNegativeInt = Schema.Number.check(Schema.makeFilter((n) => Number.isSafeInteger(n) && n >= 0));
+const normalize = (f) => Schema.String.pipe(Schema.decodeTo(Schema.String, {
+	decode: SchemaGetter.transform(f),
+	encode: SchemaGetter.transform((s) => s)
+}));
+const ClientRequestIdSchema = Schema.String.pipe(Schema.refine((s) => CLIENT_REQUEST_ID_RE.test(s)));
+const ClientGrantIdSchema = Schema.String.pipe(Schema.refine((s) => CLIENT_GRANT_ID_RE.test(s)));
+const authUserId = Schema.String.pipe(Schema.refine((s) => s.length > 0));
+const keyId = Schema.String.pipe(Schema.refine((s) => s.length > 0));
+const email$1 = normalize((s) => s.toLowerCase()).pipe(Schema.refine((s) => EMAIL_RE$1.test(s))).check(Schema.isMaxLength(254));
+const handle$1 = Schema.String.pipe(Schema.refine((s) => HANDLE_RE$1.test(s)));
+const country = normalize((s) => s.toUpperCase()).pipe(Schema.refine((s) => COUNTRY_CODE_RE.test(s)));
+const credential = Schema.RedactedFromValue(Schema.String.check(Schema.isMinLength(32), Schema.isMaxLength(8192), Schema.isPattern(/^[A-Za-z0-9._~-]+$/u)), { label: "native authorization credential" });
+const otp = Schema.RedactedFromValue(Schema.String.check(Schema.isPattern(/^[0-9]{6}$/u)), { label: "OTP" });
+const scopes = Schema.Tuple([Schema.Literal(NATIVE_CLIENT_SCOPE)]);
+/** Exact HTTPS origin, no credentials/path/query and no retired cloud deployment. */
+const NativeHttpsOriginSchema = Schema.String.check(Schema.makeFilter((value) => {
+	try {
+		const url = new URL(value);
+		const host = url.hostname.toLowerCase().replace(/\.$/u, "");
+		return url.protocol === "https:" && value === url.origin && !url.username && !url.password && !url.search && !url.hash && host !== "convex.cloud" && !host.endsWith(".convex.cloud") && host !== "convex.site" && !host.endsWith(".convex.site");
+	} catch {
+		return false;
+	}
+}, { message: "must be a canonical credential-free HTTPS origin outside retired Convex cloud hosts" }));
+const NativeClientConfigurationSchema = Schema.Struct({
+	clientId: Schema.Literal(NATIVE_CLIENT_ID),
+	applicationId: AppIdSchema,
+	keyId,
+	environment: Schema.Literals([
+		"development",
+		"staging",
+		"production"
+	]),
+	keyEnvironment: Schema.Literals(["test", "live"]),
+	issuer: NativeHttpsOriginSchema,
+	verificationOrigin: NativeHttpsOriginSchema
+}).annotate(strict).check(Schema.makeFilter((c) => c.keyEnvironment === (c.environment === "production" ? "live" : "test"), { message: "key environment must match the configured deployment" })).annotate(strict);
+const NativeSignupProfileSchema = Schema.Struct({
+	displayName: normalize((s) => s.trim()).check(Schema.isMinLength(1), Schema.isMaxLength(200)),
+	country,
+	handle: handle$1,
+	payoutAddresses: Schema.optional(Schema.Array(Schema.Struct({
+		chain: Schema.Literals([
+			"evm",
+			"solana",
+			"starknet"
+		]),
+		address: text$2(256)
+	}).annotate(strict)).check(Schema.isMaxLength(10))),
+	image: Schema.optional(Schema.Struct({
+		mediaType: Schema.Literals([
+			"image/jpeg",
+			"image/png",
+			"image/webp"
+		]),
+		byteLength: Schema.Number.check(Schema.isInt(), Schema.isBetween({
+			minimum: 1,
+			maximum: NATIVE_CLIENT_LIMITS.imageBytes
+		})),
+		sha256: Schema.String.check(Schema.isPattern(/^[0-9a-f]{64}$/u))
+	}).annotate(strict))
+}).annotate(strict);
+const ClientAuthorizationIntentSchema = Schema.Union([Schema.Struct({ mode: Schema.Literal("login") }).annotate(strict), Schema.Struct({
+	mode: Schema.Literal("signup"),
+	profile: NativeSignupProfileSchema
+}).annotate(strict)]).annotate(strict);
+Schema.Struct({
+	clientId: Schema.Literal(NATIVE_CLIENT_ID),
+	email: email$1,
+	intent: ClientAuthorizationIntentSchema,
+	waitMs: Schema.Number.check(Schema.isInt(), Schema.isBetween({
+		minimum: 1,
+		maximum: NATIVE_CLIENT_LIMITS.requestMs
+	})),
+	continuityToken: Schema.optional(credential)
+}).annotate(strict);
+const request = {
+	requestId: ClientRequestIdSchema,
+	revision: nonNegativeInt,
+	expiresAt: EpochMsSchema
+};
+const principal = {
+	authUserId,
+	email: email$1
+};
+const profileSummary = {
+	displayName: text$2(200),
+	handle: handle$1,
+	country
+};
+Schema.Union([
+	Schema.Struct({
+		...request,
+		phase: Schema.Literal(CLIENT_AUTHORIZATION_PHASE.OTP_REQUIRED),
+		email: email$1,
+		resendAt: EpochMsSchema
+	}).annotate(strict),
+	Schema.Struct({
+		...request,
+		phase: Schema.Literal(CLIENT_AUTHORIZATION_PHASE.REVIEW),
+		...principal,
+		clientLabel: Schema.Literal("Capxul CLI"),
+		scopes,
+		intent: ClientAuthorizationIntentSchema,
+		setupState: Schema.Literals([
+			"not_required",
+			"new",
+			"resumable"
+		])
+	}).annotate(strict).check(Schema.makeFilter((v) => v.intent.mode === "login" === (v.setupState === "not_required"), { message: "login review cannot permit account setup" })),
+	Schema.Struct({
+		...request,
+		phase: Schema.Literal(CLIENT_AUTHORIZATION_PHASE.PROCESSING),
+		...principal,
+		purpose: Schema.Literals(["login", "signup"]),
+		step: Schema.Literals([
+			"profile",
+			"wallet",
+			"account",
+			"delivery"
+		])
+	}).annotate(strict).check(Schema.makeFilter((v) => v.purpose === "signup" || v.step === "delivery", { message: "login may wait for delivery but cannot enter signup processing" })),
+	Schema.Struct({
+		...request,
+		phase: Schema.Literal(CLIENT_AUTHORIZATION_PHASE.CONNECTED),
+		...principal,
+		...profileSummary,
+		accountId: AccountIdSchema,
+		grantId: ClientGrantIdSchema
+	}).annotate(strict),
+	Schema.Struct({
+		...request,
+		phase: Schema.Literal(CLIENT_AUTHORIZATION_PHASE.REFUSED),
+		reason: Schema.Literals(CLIENT_AUTHORIZATION_REFUSALS),
+		code: Schema.Literals(CAPXUL_ERROR_CODES),
+		field: Schema.optional(Schema.Literals([
+			"email",
+			"displayName",
+			"country",
+			"handle",
+			"image",
+			"payoutAddresses"
+		])),
+		retryable: Schema.Boolean
+	}).annotate(strict)
+]).annotate(strict);
+Schema.Struct({
+	requestId: ClientRequestIdSchema,
+	revision: nonNegativeInt
+}).annotate(strict);
+Schema.Struct({
+	requestId: ClientRequestIdSchema,
+	code: otp
+}).annotate(strict);
+Schema.Struct({
+	client_id: Schema.Literal(NATIVE_CLIENT_ID),
+	grant_type: Schema.Literal("refresh_token"),
+	refresh_token: credential,
+	refreshAttemptId: Schema.RedactedFromValue(Schema.String.check(Schema.isPattern(/^[A-Za-z0-9_-]{32,128}$/u)), { label: "refresh attempt" })
+}).annotate(strict);
+Schema.Struct({
+	client_id: Schema.Literal(NATIVE_CLIENT_ID),
+	applicationId: AppIdSchema,
+	resource: text$2(2048),
+	token_type: Schema.Literal("Bearer"),
+	access_token: credential,
+	refresh_token: credential,
+	scope: Schema.Literal(NATIVE_CLIENT_SCOPE),
+	expires_in: Schema.Number.check(Schema.isInt(), Schema.isBetween({
+		minimum: 1,
+		maximum: NATIVE_CLIENT_LIMITS.accessMs / 1e3
+	})),
+	grantId: ClientGrantIdSchema,
+	...principal,
+	accountId: AccountIdSchema,
+	issuedAt: EpochMsSchema,
+	grantCreatedAt: EpochMsSchema,
+	accessExpiresAt: EpochMsSchema,
+	renewalExpiresAt: EpochMsSchema,
+	absoluteExpiresAt: EpochMsSchema,
+	revision: nonNegativeInt
+}).annotate(strict).check(Schema.makeFilter((t) => t.grantCreatedAt <= t.issuedAt && t.absoluteExpiresAt - t.grantCreatedAt === NATIVE_CLIENT_LIMITS.absoluteMs && t.renewalExpiresAt <= Math.min(t.issuedAt + NATIVE_CLIENT_LIMITS.renewalMs, t.absoluteExpiresAt) && t.accessExpiresAt <= Math.min(t.issuedAt + NATIVE_CLIENT_LIMITS.accessMs, t.renewalExpiresAt) && t.expires_in === Math.floor((t.accessExpiresAt - t.issuedAt) / 1e3), { message: "native credentials must obey the approved access, renewal and absolute deadlines" })).annotate(strict);
+/** One endpoint mapping; consumers cannot substitute callback or resource URLs. */
+function nativeClientEndpoints(config) {
+	const resource = `${config.issuer}/api/auth/native`;
+	return {
+		resource,
+		device_authorization_endpoint: `${resource}/device/code`,
+		token_endpoint: `${resource}/token`,
+		revocation_endpoint: `${resource}/revoke`,
+		session_endpoint: `${resource}/session`,
+		verification_uri: `${config.verificationOrigin}/connect`
+	};
+}
+Schema.Struct({
+	protocol: Schema.Literal("capxul.client-authorization"),
+	version: Schema.Literal(1),
+	configuration: NativeClientConfigurationSchema,
+	scopes_supported: scopes,
+	grant_types_supported: Schema.Tuple([Schema.Literal("urn:ietf:params:oauth:grant-type:device_code"), Schema.Literal("refresh_token")]),
+	resource: text$2(2048),
+	device_authorization_endpoint: text$2(2048),
+	token_endpoint: text$2(2048),
+	revocation_endpoint: text$2(2048),
+	session_endpoint: text$2(2048),
+	verification_uri: text$2(2048)
+}).annotate(strict).check(Schema.makeFilter((m) => {
+	const expected = nativeClientEndpoints(m.configuration);
+	return m.resource === expected.resource && m.device_authorization_endpoint === expected.device_authorization_endpoint && m.token_endpoint === expected.token_endpoint && m.revocation_endpoint === expected.revocation_endpoint && m.session_endpoint === expected.session_endpoint && m.verification_uri === expected.verification_uri;
+}, { message: "native endpoints must match their configured issuer and verification origin" })).annotate(strict);
+Schema.Struct({
+	client_id: Schema.Literal(NATIVE_CLIENT_ID),
+	grant_type: Schema.Literal("urn:ietf:params:oauth:grant-type:device_code"),
+	device_code: credential
+}).annotate(strict);
+Schema.Struct({
+	requestId: ClientRequestIdSchema,
+	device_code: credential,
+	user_code: Schema.RedactedFromValue(Schema.String.check(Schema.isPattern(/^[A-Z0-9]{4}-[A-Z0-9]{4}$/u)), { label: "device user code" }),
+	continuityToken: credential,
+	verification_uri: text$2(2048),
+	expires_in: Schema.Number.check(Schema.isInt(), Schema.isBetween({
+		minimum: 1,
+		maximum: NATIVE_CLIENT_LIMITS.requestMs / 1e3
+	})),
+	interval: Schema.Number.check(Schema.isInt(), Schema.isBetween({
+		minimum: NATIVE_CLIENT_LIMITS.pollSeconds,
+		maximum: NATIVE_CLIENT_LIMITS.requestMs / 1e3
+	}))
+}).annotate(strict);
+//#endregion
 //#region ../../packages/sdk/src/internal/invocation-observation.ts
 const INVOCATION_OBSERVATION = Symbol("capxul.invocation-observation");
 const FAILURE_INVOCATION_SNAPSHOT = Symbol("capxul.failure-invocation-snapshot");
@@ -13182,7 +13544,7 @@ function subscribeActivity(deps, actor, controls, onChange) {
 }
 //#endregion
 //#region ../../packages/sdk/package.json
-var version$1 = "4.20.0-beta.2";
+var version$1 = "4.20.0-beta.4";
 //#endregion
 //#region ../../packages/sdk/src/telemetry/exception-projection.ts
 /** Fixed fallback for failures that have no safe message. */
@@ -15258,6 +15620,277 @@ async function recoverRawDigestSigner(input) {
 	}
 }
 //#endregion
+//#region ../../packages/observability/src/engineering-delivery.ts
+/** Fixed admission limits for one CLI invocation and its SDK client. */
+const CLI_ENGINEERING_LIMITS = Object.freeze({
+	records: 80,
+	ordinaryRecords: 64,
+	recordBytes: 16384,
+	requests: 5,
+	ordinaryRequests: 2,
+	requestBytes: 1572864,
+	metricSeries: 16,
+	requestTimeoutMs: 1e3
+});
+const text$1 = (value) => typeof value === "string" ? value.slice(0, 128) : "capxul.engineering";
+const attributes = (input, limit = 32) => {
+	const out = {};
+	let count = 0;
+	let bytes = 0;
+	try {
+		for (const key in input) {
+			if (count++ >= limit) break;
+			if (key.length > 64) continue;
+			const value = Object.getOwnPropertyDescriptor(input, key)?.value;
+			const scalar = typeof value === "string" ? value.slice(0, 128) : typeof value === "boolean" || typeof value === "number" && Number.isFinite(value) ? value : void 0;
+			if (scalar === void 0) continue;
+			bytes += new TextEncoder().encode(JSON.stringify([key, scalar])).length;
+			if (bytes > (limit >= 24 ? 2e3 : 300)) break;
+			out[key] = scalar;
+		}
+	} catch {}
+	return out;
+};
+const terminalName = (name) => name === "cli.command.completed" || CLI_COMMAND_NAMES.some((command) => name === `cli.command.${command}`);
+/** Native exporters retain their serialization and scheduling; this owns admission only. */
+function cliEngineeringDelivery(budget, ownsMetrics) {
+	const closed = Deferred.makeUnsafe();
+	let isClosed = false;
+	let metricsRunning = false;
+	const logs = [];
+	const spans = /* @__PURE__ */ new Map();
+	const terminalBodies = /* @__PURE__ */ new WeakSet();
+	const bodyLeases = /* @__PURE__ */ new WeakMap();
+	const pendingBodies = /* @__PURE__ */ new Set();
+	const holdBody = (body, releases) => {
+		if (releases.length === 0) return;
+		const lease = {
+			started: false,
+			release: () => {
+				if (!pendingBodies.delete(lease)) return;
+				bodyLeases.delete(body);
+				for (const release of releases) release();
+			}
+		};
+		bodyLeases.set(body, lease);
+		pendingBodies.add(lease);
+	};
+	const discardBody = (body) => bodyLeases.get(body)?.release();
+	const drainLogs = () => {
+		for (const release of logs.splice(0)) release();
+	};
+	const close = () => {
+		isClosed = true;
+		Deferred.doneUnsafe(closed, Effect.void);
+		for (const lease of pendingBodies) if (!lease.started) lease.release();
+		drainLogs();
+		for (const release of spans.values()) release();
+		spans.clear();
+		if (ownsMetrics) budget.metricRegistry.clear();
+	};
+	return {
+		close,
+		discardBody,
+		metrics(run) {
+			return Effect.suspend(() => {
+				if (isClosed || metricsRunning) return Effect.void;
+				metricsRunning = true;
+				return run.pipe(Effect.ensuring(Effect.sync(() => {
+					metricsRunning = false;
+				})));
+			});
+		},
+		logger(delegate) {
+			return Logger.make((options) => {
+				if (isClosed) return;
+				let release;
+				try {
+					const message = text$1(Array.isArray(options.message) ? Object.getOwnPropertyDescriptor(options.message, "0")?.value : options.message);
+					release = budget.admitRecord(terminalName(message));
+					if (release === void 0) return;
+					const context = Context.add(options.fiber.context, References.CurrentLogAnnotations, attributes(options.fiber.getRef(References.CurrentLogAnnotations)));
+					const fiber = Object.create(options.fiber);
+					Object.defineProperty(fiber, "getRef", { value: (ref) => Context.get(context, ref) });
+					logs.push(release);
+					delegate.log({
+						...options,
+						message,
+						cause: Cause.empty,
+						fiber
+					});
+				} catch {
+					if (release !== void 0) {
+						const index = logs.indexOf(release);
+						if (index !== -1) logs.splice(index, 1);
+						release();
+					}
+					budget.drop();
+				}
+			});
+		},
+		tracer(delegate) {
+			return Tracer.make({
+				span(options) {
+					const name = text$1(options.name);
+					const release = isClosed ? void 0 : budget.admitRecord(terminalName(name));
+					const spanOptions = {
+						...options,
+						name,
+						annotations: Context.empty(),
+						links: []
+					};
+					const span = release === void 0 ? new Tracer.NativeSpan({
+						...spanOptions,
+						sampled: false
+					}) : delegate.span(spanOptions);
+					if (release !== void 0) spans.set(span.spanId, release);
+					const wrapped = Object.create(span);
+					let fields = 0, events = 0, links = 0, attributeBytes = 0;
+					let ended = false;
+					Object.defineProperties(wrapped, {
+						attribute: { value: (key, value) => {
+							if (fields >= 32 && !span.attributes.has(key)) {
+								budget.drop();
+								return;
+							}
+							const safe = attributes({ [key]: value }, 1);
+							if (!Object.hasOwn(safe, key)) return;
+							const previous = span.attributes.has(key) ? new TextEncoder().encode(JSON.stringify([key, span.attributes.get(key)])).length : 0;
+							const next = new TextEncoder().encode(JSON.stringify([key, safe[key]])).length;
+							if (attributeBytes - previous + next > 2e3) {
+								budget.drop();
+								return;
+							}
+							attributeBytes += next - previous;
+							if (!span.attributes.has(key)) fields += 1;
+							span.attribute(key, safe[key]);
+						} },
+						event: { value: (eventName, time, attrs) => {
+							if (events++ >= 2) {
+								budget.drop();
+								return;
+							}
+							span.event(text$1(eventName), time, attributes(attrs ?? {}, 4));
+						} },
+						addLinks: { value: (items) => {
+							for (const item of items.slice(0, Math.max(0, 2 - links))) {
+								if (!/^[a-f0-9]{32}$/u.test(item.span.traceId) || !/^[a-f0-9]{16}$/u.test(item.span.spanId)) {
+									budget.drop();
+									continue;
+								}
+								span.addLinks([{
+									span: Tracer.externalSpan({
+										traceId: item.span.traceId,
+										spanId: item.span.spanId,
+										sampled: item.span.sampled
+									}),
+									attributes: attributes(item.attributes, 4)
+								}]);
+								links += 1;
+							}
+						} },
+						end: { value: (time, exit) => {
+							if (ended) return;
+							ended = true;
+							span.end(time, Exit.isFailure(exit) ? Exit.fail("CLI operation failed") : Exit.void);
+						} }
+					});
+					wrapped.addLinks(options.links ?? []);
+					return wrapped;
+				},
+				...delegate.context === void 0 ? {} : { context: delegate.context.bind(delegate) }
+			});
+		},
+		serialization(delegate) {
+			return {
+				logs(data) {
+					const releases = logs.splice(0);
+					try {
+						const body = delegate.logs(data);
+						if (data.resourceLogs.some((r) => r.scopeLogs.some((s) => s.logRecords?.some((l) => l.body?.stringValue === "cli.command.completed")))) terminalBodies.add(body);
+						holdBody(body, releases);
+						return body;
+					} catch (error) {
+						for (const release of releases) release();
+						throw error;
+					}
+				},
+				traces(data) {
+					const releases = [];
+					for (const resource of data.resourceSpans) for (const scope of resource.scopeSpans) for (const span of scope.spans) {
+						const release = spans.get(span.spanId);
+						if (release !== void 0) releases.push(release);
+						spans.delete(span.spanId);
+					}
+					try {
+						const body = delegate.traces(data);
+						if (data.resourceSpans.some((r) => r.scopeSpans.some((s) => s.spans.some((span) => terminalName(span.name))))) terminalBodies.add(body);
+						holdBody(body, releases);
+						return body;
+					} catch (error) {
+						for (const release of releases) release();
+						throw error;
+					}
+				},
+				metrics(data) {
+					const body = delegate.metrics(data);
+					terminalBodies.add(body);
+					return body;
+				}
+			};
+		},
+		transport(client, enabled = () => true) {
+			const retrying = HttpClient.transform(client, (response, request) => Effect.suspend(() => {
+				if (enabled()) return response;
+				budget.drop();
+				return Effect.succeed(HttpClientResponse.fromWeb(request, new Response(null)));
+			})).pipe(HttpClient.transformResponse((response) => Effect.tap(response, (result) => {
+				let received = 0;
+				return Stream.runForEach(result.stream, (chunk) => Effect.sync(() => {
+					received += chunk.byteLength;
+					if (received > 65536) throw new Error("Engineering response limit exceeded");
+				})).pipe(Effect.catchTag("HttpClientError", (error) => error.reason._tag === "EmptyBodyError" ? Effect.void : Effect.fail(error)));
+			}))).pipe(HttpClient.filterStatusOk, HttpClient.retryTransient({
+				times: 1,
+				schedule: Schedule.spaced("100 millis").pipe(Schedule.addDelay(({ input }) => Effect.map(Clock.currentTimeMillis, (now) => {
+					if (!HttpClientError.isHttpClientError(input) || input.reason._tag !== "StatusCodeError" || input.reason.response.status !== 429) return Duration.zero;
+					const header = input.reason.response.headers["retry-after"];
+					const numeric = Number(header);
+					const delay = header === void 0 ? 2e3 : Number.isFinite(numeric) ? numeric * 1e3 : Date.parse(header) - now;
+					return Duration.millis(Number.isFinite(delay) ? Math.min(2e3, Math.max(0, delay)) : 2e3);
+				})))
+			}));
+			return HttpClient.transform(retrying, (response, request) => Effect.suspend(() => {
+				if (isClosed) {
+					discardBody(request.body);
+					return Effect.succeed(HttpClientResponse.fromWeb(request, new Response(null)));
+				}
+				const droppedResponse = () => HttpClientResponse.fromWeb(request, new Response(null, { status: 200 }));
+				if (request.body._tag === "Empty") {
+					discardBody(request.body);
+					return Effect.succeed(droppedResponse());
+				}
+				const bytes = request.body.contentLength;
+				const release = budget.admitRequest(bytes ?? Number.POSITIVE_INFINITY, terminalBodies.has(request.body));
+				if (release === void 0) {
+					discardBody(request.body);
+					return Effect.succeed(droppedResponse());
+				}
+				const lease = bodyLeases.get(request.body);
+				if (lease !== void 0) lease.started = true;
+				return response.pipe(Effect.asVoid, Effect.timeoutOption(CLI_ENGINEERING_LIMITS.requestTimeoutMs), Effect.raceFirst(Deferred.await(closed).pipe(Effect.andThen(Effect.interrupt))), Effect.tap((result) => Effect.sync(() => {
+					if (Option.isNone(result)) budget.drop();
+				})), Effect.catchCause(() => Effect.sync(() => {
+					budget.drop();
+				})), Effect.as(droppedResponse()), Effect.ensuring(Effect.sync(() => {
+					release();
+					discardBody(request.body);
+				})));
+			}));
+		}
+	};
+}
+//#endregion
 //#region ../../packages/observability/src/engineering.ts
 const ENGINEERING_CAPXUL_ENVS = [
 	"development",
@@ -15432,10 +16065,13 @@ const MINIMAL_NUMBERS = /* @__PURE__ */ new Set([
 const MINIMAL_CORRELATIONS = /* @__PURE__ */ new Set([
 	"correlation_id",
 	"journey_id",
-	"invocation_id"
+	"invocation_id",
+	"posthogDistinctId"
 ]);
 const MINIMAL_METRIC_LABELS = /* @__PURE__ */ new Set([
 	"command",
+	"capability",
+	"invocation_kind",
 	"outcome",
 	"capxul_env",
 	"unit"
@@ -15443,7 +16079,7 @@ const MINIMAL_METRIC_LABELS = /* @__PURE__ */ new Set([
 const MINIMAL_METRIC_NAMES = /* @__PURE__ */ new Set(["capxul.cli.command.count", "capxul.cli.command.duration"]);
 const traceId = (value) => typeof value === "string" && /^(?!0+$)[0-9a-f]{32}$/u.test(value);
 const spanId = (value) => typeof value === "string" && /^(?!0+$)[0-9a-f]{16}$/u.test(value);
-const minimalName = (value) => typeof value === "string" && (MINIMAL_LOG_NAMES.has(value) || isCapxulOperation(value)) ? value : "capxul.engineering";
+const minimalName = (value) => typeof value === "string" && (MINIMAL_LOG_NAMES.has(value) || isCapxulOperation(value) || CLI_COMMAND_NAMES.some((command) => value === `cli.command.${command}`)) ? value : "capxul.engineering";
 const MINIMAL_ENUM_VALUES = /* @__PURE__ */ new Map([
 	["outcome", [
 		"succeeded",
@@ -15456,7 +16092,10 @@ const MINIMAL_ENUM_VALUES = /* @__PURE__ */ new Map([
 	["failure_mode", FAILURE_MODES$1],
 	["capxul_env", ENGINEERING_CAPXUL_ENVS],
 	["producer", ["browser", "server"]],
-	["command", ["doctor"]],
+	["command", CLI_COMMAND_NAMES],
+	["capability", CLI_CAPABILITIES],
+	["invocation_kind", CLI_INVOCATION_KINDS],
+	["cli_identity_kind", ["anonymous"]],
 	["output_mode", ["human", "json"]],
 	["unit", [
 		"1",
@@ -15673,10 +16312,12 @@ function minimalSerialization(config) {
 	};
 }
 Effect.flatMap(OtlpExporter.Flusher, (flusher) => flusher.flush);
+var EngineeringLog = class extends Context.Service()("capxul/EngineeringLog") {};
 /** Shared browser/server OTLP layer. OtlpLogger merges with incumbent loggers once. */
 const makeEngineeringTelemetryLayer = (config) => {
 	const validated = validateEngineeringTelemetryConfig(config);
 	return Layer.suspend(() => {
+		const bounded = validated.deliveryBudget === void 0 ? void 0 : cliEngineeringDelivery(validated.deliveryBudget, validated.serviceName === "capxul-cli");
 		const endpoints = postHogOtlpEndpoints(validated.host);
 		let disabled = false;
 		const enabled = () => {
@@ -15690,7 +16331,12 @@ const makeEngineeringTelemetryLayer = (config) => {
 		};
 		const delivery = {
 			...validated.shutdownTimeout === void 0 ? {} : { shutdownTimeout: validated.shutdownTimeout },
-			...validated.exportInterval === void 0 ? {} : { exportInterval: validated.exportInterval }
+			...validated.exportInterval === void 0 ? {} : { exportInterval: validated.exportInterval },
+			...bounded === void 0 ? {} : {
+				maxBatchSize: Number.MAX_SAFE_INTEGER,
+				exportInterval: 1e3,
+				shutdownTimeout: validated.serviceName === "capxul-cli" ? 0 : 500
+			}
 		};
 		const resource = {
 			serviceName: validated.serviceName ?? "capxul-sdk",
@@ -15706,22 +16352,38 @@ const makeEngineeringTelemetryLayer = (config) => {
 			headers: validated.headers,
 			resource,
 			...delivery
-		}).pipe(Effect.map((tracer) => makeLeakSafeEngineeringTracer(tracer, enabled)))).pipe(Layer.provideMerge(OtlpExporter.layerFlusher));
-		const logging = Logger.layer([OtlpLogger.make({
+		}).pipe(Effect.map((tracer) => makeLeakSafeEngineeringTracer(bounded?.tracer(tracer) ?? tracer, enabled)))).pipe(Layer.provideMerge(OtlpExporter.layerFlusher));
+		const ownedLogging = Layer.effect(EngineeringLog, OtlpLogger.make({
 			url: endpoints.logs,
 			headers: validated.headers,
 			resource,
-			...delivery
-		}).pipe(Effect.map((logger) => Logger.make((options) => {
-			if (enabled()) logger.log(options);
-		})))], { mergeWithExisting: true }).pipe(Layer.provideMerge(OtlpExporter.layerFlusher));
-		const metrics = OtlpMetrics.layer({
+			...delivery,
+			...bounded === void 0 ? {} : { excludeLogSpans: true }
+		}).pipe(Effect.map((nativeLogger) => {
+			const logger = bounded?.logger(nativeLogger) ?? nativeLogger;
+			return Logger.make((options) => {
+				if (enabled()) logger.log(options);
+			});
+		}))).pipe(Layer.provideMerge(OtlpExporter.layerFlusher));
+		const logging = Logger.layer([EngineeringLog], { mergeWithExisting: true }).pipe(Layer.provideMerge(ownedLogging));
+		const metricConfig = {
 			url: endpoints.metrics,
 			headers: validated.headers,
 			resource,
 			temporality: "delta",
 			...delivery
-		});
+		};
+		const metrics = bounded === void 0 ? OtlpMetrics.layer(metricConfig) : validated.serviceName !== "capxul-cli" ? Layer.empty : Layer.effectDiscard(Effect.gen(function* () {
+			const flusher = yield* OtlpExporter.Flusher;
+			yield* OtlpMetrics.make({
+				...metricConfig,
+				exportInterval: Number.POSITIVE_INFINITY,
+				shutdownTimeout: 0
+			}).pipe(Effect.provideService(OtlpExporter.Flusher, {
+				...flusher,
+				register: (run) => flusher.register(bounded.metrics(run))
+			}));
+		})).pipe(Layer.provideMerge(OtlpExporter.layerFlusher));
 		const headerPolicy = Layer.merge(Layer.succeed(HttpClient.TracerHeaderFilter, traceHeaderFilter), Layer.succeed(Headers.CurrentRedactedNames, [credentialHeaderPattern]));
 		const browserLifecycle = Layer.effectDiscard(Effect.gen(function* () {
 			if (validated.producer !== "browser" || !hasBrowserDocument()) return;
@@ -15744,17 +16406,25 @@ const makeEngineeringTelemetryLayer = (config) => {
 			}));
 		}));
 		const transport = Layer.effect(HttpClient.HttpClient, Effect.map(HttpClient.HttpClient, (client) => {
-			const selectedTransport = validated.producer === "browser" && hasBrowserDocument() ? browserExportClient(client) : client;
-			return HttpClient.transform(selectedTransport, (response, request) => Effect.suspend(() => enabled() && request.body._tag !== "Empty" ? response : Effect.succeed(HttpClientResponse.fromWeb(request, new Response(null, { status: 200 })))));
+			const originalTransport = validated.producer === "browser" && hasBrowserDocument() ? browserExportClient(client) : client;
+			const selectedTransport = bounded?.transport(originalTransport, enabled) ?? originalTransport;
+			return HttpClient.transform(selectedTransport, (response, request) => Effect.suspend(() => {
+				if (enabled() && request.body._tag !== "Empty") return response;
+				bounded?.discardBody(request.body);
+				return Effect.succeed(HttpClientResponse.fromWeb(request, new Response(null, { status: 200 })));
+			}));
 		})).pipe(Layer.provide(FetchHttpClient.layer));
 		const serialization = Layer.effect(OtlpSerialization.OtlpSerialization, Effect.map(OtlpSerialization.OtlpSerialization, (json) => {
 			const projected = minimalSerialization(validated);
-			return validated.privacy === "minimal" ? projected : {
+			const selected = validated.privacy === "minimal" ? projected : {
 				...json,
 				metrics: projected.metrics
 			};
+			return bounded?.serialization(selected) ?? selected;
 		})).pipe(Layer.provide(OtlpSerialization.layerJson));
-		return browserLifecycle.pipe(Layer.provideMerge(Layer.mergeAll(tracing, logging, metrics, headerPolicy)), Layer.provide(serialization), Layer.provide(transport));
+		const combined = browserLifecycle.pipe(Layer.provideMerge(Layer.mergeAll(tracing, logging, metrics, headerPolicy)), Layer.provide(serialization), Layer.provide(transport));
+		const scoped = bounded === void 0 ? combined : combined.pipe(Layer.provideMerge(Layer.effectDiscard(Effect.addFinalizer(() => Effect.sync(bounded.close)))));
+		return validated.deliveryBudget === void 0 ? scoped : scoped.pipe(Layer.provideMerge(Layer.succeed(Metric.MetricRegistry, validated.serviceName === "capxul-cli" ? validated.deliveryBudget.metricRegistry : validated.deliveryBudget.emptyMetricRegistry())));
 	});
 };
 //#endregion
@@ -47994,6 +48664,7 @@ function snapshotHostObservability(observability) {
 function hostEngineeringPolicy(observability) {
 	const policy = observability?.[HOST_ENGINEERING_POLICY];
 	return {
+		...policy?.engineeringDeliveryBudget === void 0 ? {} : { deliveryBudget: policy.engineeringDeliveryBudget },
 		...policy?.engineeringEnabled === void 0 ? {} : { enabled: policy.engineeringEnabled },
 		...policy?.engineeringPrivacy === void 0 ? {} : { privacy: policy.engineeringPrivacy }
 	};
@@ -49877,7 +50548,7 @@ function stdioIdentity(env = process.env, options = {}) {
 }
 //#endregion
 //#region package.json
-var version = "4.20.0-beta.2";
+var version = "4.20.0-beta.4";
 //#endregion
 //#region src/deps.ts
 const NO_IDENTITY = async () => void 0;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@capxul/mcp",
-  "version": "4.20.0-beta.2",
+  "version": "4.20.0-beta.4",
   "private": false,
   "description": "Capxul MCP server for auth, Account readiness, identity, Organizations, relationships, requests, destinations, and testnet funding over Streamable HTTP.",
   "keywords": [
@@ -51,7 +51,7 @@
     "vite": "npm:@voidzero-dev/vite-plus-core@0.3.0",
     "vite-plus": "0.3.0",
     "@capxul/config": "0.3.0",
-    "@capxul/sdk": "4.20.0-beta.2",
+    "@capxul/sdk": "4.20.0-beta.4",
     "@capxul/typescript-config": "0.0.0"
   },
   "scripts": {