@capxul/observability 4.20.0-beta.1 → 4.20.0-beta.11

package/dist/src-BZJgbf-f.mjs

@@ -0,0 +1,3327 @@
+import { Effect, Schema, SchemaGetter } from "effect";
+//#region ../errors/src/secret-material.ts
+const CREDENTIAL_FIELDS = /* @__PURE__ */ new Set([
+	"password",
+	"passwd",
+	"pwd",
+	"pass",
+	"passphrase",
+	"currentpassword",
+	"newpassword",
+	"confirmpassword",
+	"passwordconfirmation",
+	"passwordhash",
+	"hashedpassword",
+	"pin",
+	"privatekey",
+	"walletprivatekey",
+	"secretkey",
+	"signingkey",
+	"signingsecret",
+	"seed",
+	"seedphrase",
+	"mnemonic",
+	"recoveryphrase",
+	"recovery",
+	"recoverycode",
+	"recoverycodes",
+	"keyshare",
+	"signingmaterial",
+	"recoverymaterial",
+	"privatekeybytes",
+	"signingprivatekey",
+	"encryptionkey",
+	"decryptionkey",
+	"authtoken",
+	"apitoken",
+	"bearertoken",
+	"oauthtoken",
+	"csrftoken",
+	"clientassertion",
+	"token",
+	"accesstoken",
+	"refreshtoken",
+	"idtoken",
+	"sessiontoken",
+	"session",
+	"sessionkey",
+	"sessionsecret",
+	"authsessionid",
+	"sessioncredential",
+	"sessioncredentials",
+	"sessioncookie",
+	"auth",
+	"authentication",
+	"authorization",
+	"proxyauthorization",
+	"cookie",
+	"cookies",
+	"setcookie",
+	"apikey",
+	"xapikey",
+	"xauthtoken",
+	"clientsecret",
+	"secret",
+	"secrets",
+	"credential",
+	"credentials",
+	"signature",
+	"otp",
+	"otpcode",
+	"totpsecret",
+	"onetimecode",
+	"onetimepassword",
+	"verificationcode",
+	"authcode",
+	"authorizationcode",
+	"oauthcode",
+	"codeverifier",
+	"devicecode",
+	"usercode",
+	"continuitytoken",
+	"refreshattemptid",
+	"revocationtoken"
+]);
+/** Match credential fields by meaning, without hiding token addresses or replay IDs. */
+function isCredentialField(name, context) {
+	const normalized = name.toLowerCase().replace(/[^a-z0-9]/gu, "");
+	return CREDENTIAL_FIELDS.has(normalized) || /(?:password(?:hash)?|passwd|passphrase|privatekey|signingkey|apikey|clientsecret|accesstoken|refreshtoken|sessiontoken)$/u.test(normalized) || context === "authentication" && (normalized === "code" || normalized === "sessionid") || context === "header" && /(?:token|secret|apikey|privatekey|signingkey|password|authorization|cookie|session)$/u.test(normalized);
+}
+function decodeUrlComponent(text) {
+	try {
+		return decodeURIComponent(text);
+	} catch {
+		return text;
+	}
+}
+/** Preserve URL diagnostics while removing credentials from their declared components. */
+function redactUrlSecrets(value, source) {
+	try {
+		const absolute = /^[a-z][a-z0-9+.-]*:/iu.test(value);
+		const protocolRelative = value.startsWith("//");
+		const url = new URL(value, "https://redaction.invalid");
+		if (url.protocol !== "https:" && url.protocol !== "http:") return maskText(value);
+		let changed = url.username.length > 0 || url.password.length > 0;
+		const maskParams = (params) => new URLSearchParams(Array.from(params, ([name, entry]) => {
+			const safeName = maskText(name);
+			const safeEntry = isCredentialField(name) || /^(?:code|draft|__posthog)$/iu.test(name) ? "[REDACTED]" : maskText(entry);
+			changed ||= safeName !== name || safeEntry !== entry;
+			return [safeName, safeEntry];
+		})).toString();
+		const provider = source === "alchemy" || source === "infura" || /(?:^|\.)(?:alchemy\.com|alchemyapi\.io|infura\.io)$/iu.test(url.hostname);
+		const rawPath = absolute || protocolRelative ? url.pathname : value.split(/[?#]/u)[0] ?? "";
+		const segments = rawPath.split("/");
+		let path = segments.map((segment, index) => {
+			const decoded = decodeUrlComponent(segment);
+			const masked = provider && /^v[23]$/u.test(decodeUrlComponent(segments[index - 1] ?? "")) && decoded.length > 0 ? "[REDACTED]" : maskText(decoded);
+			changed ||= masked !== decoded;
+			return masked === decoded ? segment : encodeURIComponent(masked);
+		}).join("/");
+		if (source === "gateway" && rawPath.length > 0) {
+			path = `${rawPath.startsWith("/") ? "/" : ""}${encodeURIComponent("[REDACTED]")}`;
+			changed = true;
+		}
+		const query = maskParams(url.searchParams);
+		const fragment = url.hash.slice(1);
+		const decodedFragment = decodeUrlComponent(fragment);
+		const maskedFragment = maskText(decodedFragment);
+		changed ||= maskedFragment !== decodedFragment;
+		const fragmentQuery = fragment.indexOf("?");
+		const fragmentPath = fragment.slice(0, fragmentQuery);
+		const maskedFragmentPath = maskText(decodeUrlComponent(fragmentPath));
+		changed ||= maskedFragmentPath !== decodeUrlComponent(fragmentPath);
+		const hash = fragmentQuery >= 0 ? `${maskedFragmentPath === decodeUrlComponent(fragmentPath) ? fragmentPath : encodeURIComponent(maskedFragmentPath)}?${maskParams(new URLSearchParams(fragment.slice(fragmentQuery + 1)))}` : fragment.includes("=") ? maskParams(new URLSearchParams(fragment)) : maskedFragment === decodedFragment ? fragment : encodeURIComponent(maskedFragment);
+		const origin = absolute ? url.origin : protocolRelative ? `//${url.host}` : "";
+		if (!changed) return value;
+		return `${origin}${path}${query ? `?${query}` : ""}${hash ? `#${hash}` : ""}`;
+	} catch {
+		if (source === "gateway") return "[REDACTED]";
+		return maskText(value.replace(/(https?:\/\/)[^/\s@]+@/giu, "$1[REDACTED]@").replace(/([?&#])([^=&#]+)=([^&#]*)/gu, (whole, separator, name) => isCredentialField(decodeUrlComponent(name)) || /^(?:code|draft|__posthog)$/iu.test(decodeUrlComponent(name)) ? `${separator}${name}=[REDACTED]` : whole));
+	}
+}
+const JSON_FIELD = /("(?:[^"\\]|\\.)*")(\s*:\s*)("(?:[^"\\]|\\.)*"|-?\d+(?:\.\d+)?(?:[eE][+-]?\d+)?|true|false|null)/gu;
+const PROSE_FIELD = /(?=(\b([A-Za-z][A-Za-z0-9_-]*(?:[ \t]+[A-Za-z][A-Za-z0-9_-]*){0,3})\s*[:=]\s*((?:Bearer|Basic)[ \t]+[^\s,;"']+|"(?:[^"\\]|\\.)*"|'(?:[^'\\]|\\.)*'|[^\s,;&"']+)))/gu;
+const EMBEDDED_URL = /(https?:\/\/[^\s"<>]*)/giu;
+function isSecretLabel(name) {
+	return isCredentialField(name) || /^request[ _-]?body$/iu.test(name);
+}
+const JSON_ENCODING_MAX = 8;
+const JSON_NESTING_MAX = 64;
+const JSON_KEY = /("(?:[^"\\]|\\.)*")\s*:/gu;
+const JSON_CONTAINER_START = /(?:\{\s*["}]|\[\s*[[\]{}"0-9tfn-])/uy;
+function hasSecretJsonKey(value) {
+	for (const match of value.matchAll(JSON_KEY)) try {
+		if (match[1] !== void 0 && isSecretLabel(JSON.parse(match[1]))) return true;
+	} catch {}
+	return false;
+}
+/** Project a complete fragment once. Never retry all of its nested substrings. */
+function projectJsonFragment(value, encodingDepth, overDepth) {
+	if (overDepth || encodingDepth >= JSON_ENCODING_MAX) return "[REDACTED]";
+	let parsed;
+	try {
+		parsed = JSON.parse(value);
+	} catch {
+		return hasSecretJsonKey(value) ? "[REDACTED]" : value;
+	}
+	try {
+		let changed = false;
+		const masked = JSON.stringify(parsed, (name, nested) => {
+			if (isSecretLabel(name)) {
+				changed ||= nested !== "[REDACTED]";
+				return "[REDACTED]";
+			}
+			if (typeof nested === "string") {
+				const projected = maskJsonFragments(nested, encodingDepth + 1);
+				changed ||= projected !== nested;
+				return projected;
+			}
+			return nested;
+		});
+		return changed ? masked : value;
+	} catch {
+		return "[REDACTED]";
+	}
+}
+/** Scan balanced object/array fragments once, respecting JSON quotes and escapes. */
+function maskJsonFragments(value, encodingDepth = 0) {
+	if (value.trimStart().startsWith("\"")) try {
+		const decoded = JSON.parse(value);
+		if (typeof decoded === "string") {
+			if (encodingDepth >= JSON_ENCODING_MAX) return "\"[REDACTED]\"";
+			const masked = maskJsonFragments(decoded, encodingDepth + 1);
+			return masked === decoded ? value : JSON.stringify(masked);
+		}
+	} catch {}
+	let output = "";
+	let cursor = 0;
+	let start = -1;
+	let depth = 0;
+	let overDepth = false;
+	let quoted = false;
+	let escaped = false;
+	for (let index = 0; index < value.length; index++) {
+		const character = value[index];
+		if (start < 0) {
+			JSON_CONTAINER_START.lastIndex = index;
+			if (!JSON_CONTAINER_START.test(value)) continue;
+			start = index;
+			depth = 1;
+			overDepth = false;
+			continue;
+		}
+		if (quoted) {
+			if (escaped) escaped = false;
+			else if (character === "\\") escaped = true;
+			else if (character === "\"") quoted = false;
+			continue;
+		}
+		if (character === "\"") quoted = true;
+		else if (character === "{" || character === "[") {
+			depth++;
+			overDepth ||= depth > JSON_NESTING_MAX;
+		} else if (character === "}" || character === "]") {
+			depth--;
+			if (depth !== 0) continue;
+			output += value.slice(cursor, start) + projectJsonFragment(value.slice(start, index + 1), encodingDepth, overDepth);
+			cursor = index + 1;
+			start = -1;
+		}
+	}
+	if (start >= 0) {
+		const fragment = value.slice(start);
+		output += value.slice(cursor, start) + (overDepth || hasSecretJsonKey(fragment) ? "[REDACTED]" : fragment);
+		cursor = value.length;
+	}
+	return output + value.slice(cursor);
+}
+function maskLabelledText(value) {
+	const jsonMasked = maskJsonFragments(value).replace(JSON_FIELD, (whole, quotedName, separator) => {
+		try {
+			return isSecretLabel(JSON.parse(quotedName)) ? `${quotedName}${separator}"[REDACTED]"` : whole;
+		} catch {
+			return whole;
+		}
+	});
+	let output = "";
+	let cursor = 0;
+	for (const match of jsonMasked.matchAll(PROSE_FIELD)) {
+		const [, whole, label, entry] = match;
+		if (whole === void 0 || label === void 0 || entry === void 0 || match.index < cursor || /^Bearer[ \t]+/iu.test(entry)) continue;
+		const words = label.split(/[ \t]+/u);
+		for (let index = 0; index < words.length; index++) {
+			const name = words.slice(index).join(" ");
+			if (isSecretLabel(name)) {
+				const prefix = words.slice(0, index).join(" ");
+				output += jsonMasked.slice(cursor, match.index) + `${prefix ? `${prefix} ` : ""}${name}=[REDACTED]`;
+				cursor = match.index + whole.length;
+				break;
+			}
+		}
+	}
+	return output + jsonMasked.slice(cursor);
+}
+const TOKEN_MASKS = [
+	[/\bBearer\s+(?!(?:realm|error|error_description|scope|authorization_uri|resource|claims)\s*=)[^\s,;"']+/giu, "Bearer [REDACTED]"],
+	[/\beyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\b/gu, "[REDACTED]"],
+	[/(^|[^a-fA-F0-9])(?<!0[xX])[a-fA-F0-9]{64}(?=$|[^a-fA-F0-9])/gu, "$1[REDACTED]"],
+	[/(?:(?:sk|pk|rk)_(?:live|test)|(?:phc|phx|ghp|gho|ghu|ghs|ghr|whsec)_|github_pat_|xox[baprs]-|AKIA[0-9A-Z]{16}|AIza)[A-Za-z0-9_-]*/giu, "[REDACTED]"]
+];
+/** URL components and malformed URLs use this non-recursive masking layer. */
+function maskText(value) {
+	let text = maskLabelledText(value);
+	for (const [pattern, replacement] of TOKEN_MASKS) text = text.replace(pattern, replacement);
+	return text;
+}
+/** Mask credential fields and embedded URLs while preserving surrounding evidence. */
+function redactSecrets(value, source) {
+	return maskLabelledText(value).split(EMBEDDED_URL).map((part, index) => index % 2 === 1 ? redactUrlSecrets(part, source).replaceAll("%5BREDACTED%5D", "[REDACTED]") : maskText(part)).join("");
+}
+//#endregion
+//#region ../errors/src/chain-cause.ts
+/**
+* Why an operation failed — the one flat vocabulary. The first four are the
+* auth/provider diagnoses that predate this file. The rest name the chain
+* path. `FailureMode` is derived from this list so a runtime membership check
+* (the SDK's `$exception` projection, the observability schema) and the type
+* can never drift apart.
+*/
+const FAILURE_MODES = [
+	"auth-origin-mismatch",
+	"stale-openfort-cache",
+	"app-env-allowlist",
+	"no-secure-context",
+	"signer-not-ready",
+	"rate-limited",
+	"timeout",
+	"upstream-down",
+	"revert",
+	"insufficient-balance",
+	"insufficient-allowance",
+	"rejected",
+	"unauthorized",
+	"forbidden",
+	"bad-request",
+	"method-unsupported",
+	"unknown"
+];
+/** Who answered. `alto` is the bundler; `gateway` is the AA gateway's own logic. */
+const CHAIN_UPSTREAMS = [
+	"alchemy",
+	"infura",
+	"public",
+	"alto",
+	"gateway"
+];
+//#endregion
+//#region ../errors/src/errors.ts
+const CAPXUL_ERROR_CODES = [
+	"NOT_AUTHENTICATED",
+	"EMAIL_DELIVERY_FAILED",
+	"PROFILE_NOT_FOUND",
+	"SMART_ACCOUNT_MISSING",
+	"PLAYER_NOT_FOUND",
+	"ACCOUNT_NOT_FOUND",
+	"ACCOUNT_CLAIMED_BY_OTHER_SIGNER",
+	"PROVIDER_ERROR",
+	"CAPABILITY_UNAVAILABLE",
+	"INVALID_INPUT",
+	"ENV_MISSING",
+	"NOT_IMPLEMENTED",
+	"VERIFICATION_REQUIRED",
+	"INSUFFICIENT_BALANCE",
+	"INVALID_RECIPIENT",
+	"ROLE_PERMISSION_DENIED",
+	"TRANSACTION_FAILED",
+	"RATE_LIMITED",
+	"NETWORK_ERROR",
+	"UNKNOWN",
+	"OTP_EXPIRED",
+	"SIGNER_REJECTED",
+	"CANCELLED",
+	"WRONG_STATE",
+	"STALE_EPOCH",
+	"SUPERSEDED",
+	"WORK_DIED",
+	"ACTOR_STOPPED"
+];
+new Set(CAPXUL_ERROR_CODES);
+//#endregion
+//#region ../types/src/organization-setup.ts
+/** Backend-owned Organization setup states shared by wire and telemetry. */
+const ORGANIZATION_SETUP_STATUSES = [
+	"awaitingAuthorization",
+	"processing",
+	"needsAttention",
+	"ready",
+	"rechecking",
+	"failed"
+];
+/** Closed reasons for a stored Organization setup issue. */
+const ORGANIZATION_SETUP_REASONS = [
+	"submission_unknown",
+	"receipt_unresolved",
+	"provider_unavailable",
+	"receipt_reverted",
+	"deterministic_address_mismatch",
+	"receipt_mismatch",
+	"block_identity_changed",
+	"authority_event_mismatch",
+	"allowance_timestamp_mismatch",
+	"receipt_identity_unavailable",
+	"receipt_identity_mismatch",
+	"contract_code_unavailable",
+	"contract_state_mismatch",
+	"permission_projection_mismatch",
+	"bootstrap_reorg",
+	"dependent_authority_unresolved",
+	"historical_evidence_missing",
+	"worker_failed"
+];
+//#endregion
+//#region ../types/src/index.ts
+const EVM_ADDRESS_RE = /^0x[0-9a-f]{40}$/i;
+const BYTES32_RE = /^0x[0-9a-f]{64}$/i;
+`${"0".repeat(64)}`;
+const SUPPORTED_CURRENCIES = [
+	{
+		code: "USD",
+		symbol: "$",
+		name: "US Dollar"
+	},
+	{
+		code: "NGN",
+		symbol: "NGN",
+		name: "Nigerian Naira"
+	},
+	{
+		code: "GHS",
+		symbol: "GHS",
+		name: "Ghanaian Cedi"
+	},
+	{
+		code: "KES",
+		symbol: "KSh",
+		name: "Kenyan Shilling"
+	},
+	{
+		code: "UGX",
+		symbol: "USh",
+		name: "Ugandan Shilling"
+	}
+];
+SUPPORTED_CURRENCIES.map((currency) => currency.code);
+Object.fromEntries(SUPPORTED_CURRENCIES.map((currency) => [currency.code, currency.symbol]));
+const APP_ID_RE = /^app_[0-7][0-9A-HJKMNP-TV-Z]{25}$/;
+Math.floor(Number.MAX_SAFE_INTEGER / 1e3);
+//#endregion
+//#region src/operations.ts
+const CAPXUL_OPERATIONS = {
+	account: {
+		addressBook: {
+			add: "account.addressBook.add",
+			get: "account.addressBook.get",
+			hide: "account.addressBook.hide",
+			label: "account.addressBook.label",
+			list: "account.addressBook.list",
+			unhide: "account.addressBook.unhide"
+		},
+		balance: "account.balance",
+		faucetMint: "account.faucetMint",
+		getLifecycle: "account.getLifecycle",
+		readBalance: "account.readBalance",
+		retrySetup: "account.retrySetup",
+		status: "account.status",
+		profile: {
+			depositInstructions: "account.profile.depositInstructions",
+			get: "account.profile.get"
+		},
+		inbox: {
+			approve: "account.inbox.approve",
+			decline: "account.inbox.decline",
+			list: "account.inbox.list"
+		},
+		requests: {
+			cancel: "account.requests.cancel",
+			get: "account.requests.get",
+			issue: "account.requests.issue",
+			list: "account.requests.list"
+		}
+	},
+	accounts: {
+		fund: "accounts.fund",
+		read: "accounts.read"
+	},
+	activity: {
+		annotate: "activity.annotate",
+		emitAnnotationSaved: "activity.emitAnnotationSaved",
+		get: "activity.get",
+		list: "activity.list",
+		/** The SDK's live Activity read over the indexer's SSE stream. */
+		subscribe: "activity.subscribe",
+		summary: "activity.summary"
+	},
+	addressBook: {
+		add: "addressBook.add",
+		emitRelationshipChanged: "addressBook.emitRelationshipChanged",
+		get: "addressBook.get",
+		hide: "addressBook.hide",
+		label: "addressBook.label",
+		list: "addressBook.list",
+		unhide: "addressBook.unhide"
+	},
+	applications: { create: "applications.create" },
+	auth: {
+		canSendOtp: "auth.canSendOtp",
+		getSession: "auth.getSession",
+		signIn: "auth.signIn",
+		signOut: "auth.signOut",
+		sendVerificationOtp: "auth.sendVerificationOTP",
+		verifyOtp: "auth.verifyOtp"
+	},
+	client: {
+		createOrg: "createOrg",
+		orgs: "orgs"
+	},
+	/** AUTH A3 (#2073): the SDK facade over the native continuation endpoints. */
+	clientRequests: {
+		decide: "clientRequests.decide",
+		read: "clientRequests.read"
+	},
+	/** AUTH A2 (#2072): the native client authorization issuer and its browser
+	* continuation. One name per durable transition the endpoints can fail on. */
+	clientAuthorization: {
+		acceptRequest: "clientAuthorization.acceptRequest",
+		cancelRequest: "clientAuthorization.cancelRequest",
+		consumeRequest: "clientAuthorization.consumeRequest",
+		denyRequest: "clientAuthorization.denyRequest",
+		invalidateContext: "clientAuthorization.invalidateContext",
+		markConsented: "clientAuthorization.markConsented",
+		readMetadata: "clientAuthorization.readMetadata",
+		revokeGrant: "clientAuthorization.revokeGrant",
+		rotateGrant: "clientAuthorization.rotateGrant",
+		startRequest: "clientAuthorization.startRequest",
+		sweepExpired: "clientAuthorization.sweepExpired"
+	},
+	credentials: {
+		bootstrapClient: "credentials.bootstrapClient",
+		mintQuickstartKey: "credentials.mintQuickstartKey"
+	},
+	currentUser: { get: "currentUser.get" },
+	devIdentity: { seedFinancialOpsOrg: "devIdentity.seedFinancialOpsOrg" },
+	dev: { browserSeed: "dev.browserSeed" },
+	destinations: {
+		add: "destinations.add",
+		list: "destinations.list",
+		remove: "destinations.remove"
+	},
+	faucetSafe: { deploy: "FaucetSafe.deploy" },
+	financialOps: {
+		addDestination: "financialOps.addDestination",
+		approveRequest: "financialOps.approveRequest",
+		cancelRequest: "financialOps.cancelRequest",
+		createPayee: "financialOps.createPayee",
+		declineRequest: "financialOps.declineRequest",
+		emitInvoiceIssued: "financialOps.emitInvoiceIssued",
+		emitInvoiceRequestTransitioned: "financialOps.emitInvoiceRequestTransitioned",
+		emitPaymentWriterTelemetry: "financialOps.emitPaymentWriterTelemetry",
+		issueRequest: "financialOps.issueRequest",
+		migrateEvidenceIdentity: "financialOps.migrateEvidenceIdentity",
+		planEvidenceIdentity: "financialOps.planEvidenceIdentity",
+		recoverSettlementVerification: "financialOps.recoverSettlementVerification",
+		removeDestination: "financialOps.removeDestination",
+		verifySettlement: "financialOps.verifySettlement"
+	},
+	holdings: { current: "holdings.current" },
+	indexer: { reconcile: "indexer.reconcile" },
+	identity: {
+		accountAt: "identity.AccountAt",
+		accountClaimed: "identity.AccountClaimed",
+		accountClaiming: "identity.AccountClaiming",
+		accountDerived: "identity.AccountDerived",
+		accountFailed: "identity.AccountFailed",
+		attachOrganization: "identity.AttachOrganization",
+		claimAccount: "identity.ClaimAccount",
+		completeOnboarding: "identity.completeOnboarding",
+		completeProfile: "identity.completeProfile",
+		create: "identity.create",
+		createOrganization: "identity.CreateOrganization",
+		ensureAccount: "identity.EnsureAccount",
+		leaveOrganization: "identity.LeaveOrganization",
+		loadByAuthUserId: "identity.loadByAuthUserId",
+		loadCurrent: "identity.loadCurrent",
+		orgAt: "identity.OrgAt",
+		orgFailed: "identity.OrgFailed",
+		orgReady: "identity.OrgReady",
+		otpFailed: "identity.OtpFailed",
+		otpSent: "identity.OtpSent",
+		readSession: "identity.ReadSession",
+		requestOtp: "identity.RequestOtp",
+		reset: "identity.Reset",
+		restoreSession: "identity.RestoreSession",
+		resumeOtpEntry: "identity.ResumeOtpEntry",
+		retryAccount: "identity.RetryAccount",
+		retryOrganization: "identity.RetryOrganization",
+		sessionAbsent: "identity.SessionAbsent",
+		sessionRead: "identity.SessionRead",
+		sessionReadFailed: "identity.SessionReadFailed",
+		sessionRestored: "identity.SessionRestored",
+		signedOut: "identity.SignedOut",
+		signOut: "identity.SignOut",
+		signOutFailed: "identity.SignOutFailed",
+		update: "identity.update",
+		handleAvailable: "identity.handleAvailable",
+		verified: "identity.Verified",
+		verifyFailed: "identity.VerifyFailed",
+		verifyOtp: "identity.VerifyOtp"
+	},
+	media: {
+		generateUploadUrl: "media.generateUploadUrl",
+		setOrgLogo: "media.setOrgLogo",
+		setProfileImage: "media.setProfileImage",
+		uploadImage: "media.uploadImage"
+	},
+	me: {
+		depositInstructions: "me.depositInstructions",
+		get: "me.get"
+	},
+	moneyExecution: {
+		abandonPaymentExecution: "moneyExecution.abandonPaymentExecution",
+		prepareOrganizationPaymentExecution: "moneyExecution.prepareOrganizationPaymentExecution",
+		preparePaymentExecution: "moneyExecution.preparePaymentExecution",
+		preparePaymentLifecycleExecution: "moneyExecution.preparePaymentLifecycleExecution",
+		prepareInvitationConfiguration: "moneyExecution.prepareInvitationConfiguration",
+		preparePermissionExecution: "moneyExecution.preparePermissionExecution",
+		recoverSubmissionClaims: "moneyExecution.recoverSubmissionClaims",
+		submit: "moneyExecution.submit",
+		submitPaymentCommandExecution: "moneyExecution.submitPaymentCommandExecution",
+		submitInvitationConfigurationExecution: "moneyExecution.submitInvitationConfigurationExecution",
+		submitPaymentExecution: "moneyExecution.submitPaymentExecution",
+		submitPermissionExecution: "moneyExecution.submitPermissionExecution"
+	},
+	movement: {
+		emitDepositSettled: "movement.emitDepositSettled",
+		scan: "movement.scan"
+	},
+	inbox: {
+		approve: "inbox.approve",
+		decline: "inbox.decline",
+		list: "inbox.list"
+	},
+	offramp: {
+		quote: "offramp.quote",
+		status: "offramp.status"
+	},
+	onboarding: {
+		completeOrganization: "onboarding.completeOrganization",
+		completePerson: "onboarding.completePerson"
+	},
+	org: {
+		account: { get: "org.account.get" },
+		auditLog: "org.auditLog",
+		confirmBootstrap: "org.confirmBootstrap",
+		createOrg: "org.createOrg",
+		create: "org.create",
+		/**
+		* §11: the consent mutation reports `org_invite_accepted` through its own
+		* scheduled emitter. It is named for the emit, not the acceptance, because
+		* the interactive acceptance itself owns `org.invitations.accept`.
+		*/
+		emitInviteAccepted: "org.emitInviteAccepted",
+		emitInviteProgressed: "org.emitInviteProgressed",
+		expireInvitations: "org.expireInvitations",
+		getLifecycle: "org.getLifecycle",
+		getProofReceipt: "org.getProofReceipt",
+		invite: "org.invite",
+		/** D8 invitation lifecycle: preview, own list, read, and the four transitions. */
+		invitations: {
+			/** The exact grantee's consent commit (§8): one accepted digest, once. */
+			accept: "org.invitations.accept",
+			/**
+			* The authoring write. It is named `authorize`, not `invite`, because the
+			* backend already uses `org.invitations.invite` as a refusal label and
+			* `lint:telemetry-spine` refuses a label that collides with an operation.
+			*/
+			authorize: "org.invitations.authorize",
+			cancel: "org.invitations.cancel",
+			decline: "org.invitations.decline",
+			get: "org.invitations.get",
+			list: "org.invitations.list",
+			/**
+			* The Admin-scoped Organization list. It is named `listScoped`, not
+			* `list`, because the own-offer list already owns `org.invitations.list`.
+			*/
+			listScoped: "org.invitations.listScoped",
+			/**
+			* The authoring write's inner hops: the SDK drives the backend's existing
+			* prepare/submit pair, and these names label the two Convex calls. The
+			* owning `capxul_sdk_operation` record stays `org.invitations.authorize`.
+			*/
+			prepareConfiguration: "org.invitations.prepareConfiguration",
+			preview: "org.invitations.preview",
+			resend: "org.invitations.resend",
+			retry: "org.invitations.retry",
+			submitConfiguration: "org.invitations.submitConfiguration"
+		},
+		list: "org.list",
+		load: "org.load",
+		me: "org.me",
+		members: "org.members",
+		orgs: "org.orgs",
+		payment: "org.payment",
+		permissions: {
+			assign: "org.permissions.assign",
+			change: "org.permissions.change",
+			create: "org.permissions.create",
+			get: "org.permissions.get",
+			list: "org.permissions.list",
+			replace: "org.permissions.replace",
+			revoke: "org.permissions.revoke"
+		},
+		payments: {
+			pay: "org.payments.pay",
+			payBatch: "org.payments.payBatch"
+		},
+		payroll: {
+			authorizeRun: "org.payroll.authorizeRun",
+			groups: {
+				list: "org.payroll.groups.list",
+				remove: "org.payroll.groups.remove",
+				save: "org.payroll.groups.save"
+			},
+			runs: "org.payroll.runs",
+			terms: "org.payroll.terms"
+		},
+		addressBook: {
+			add: "org.addressBook.add",
+			get: "org.addressBook.get",
+			hide: "org.addressBook.hide",
+			label: "org.addressBook.label",
+			list: "org.addressBook.list",
+			unhide: "org.addressBook.unhide"
+		},
+		inbox: {
+			approve: "org.inbox.approve",
+			decline: "org.inbox.decline",
+			list: "org.inbox.list"
+		},
+		lifecycle: { startOrResume: "org.lifecycle.startOrResume" },
+		prepareBootstrap: "org.prepareBootstrap",
+		prepareFounderAccount: "org.prepareFounderAccount",
+		profile: {
+			depositInstructions: "org.profile.depositInstructions",
+			get: "org.profile.get"
+		},
+		readTreasury: "org.readTreasury",
+		requests: {
+			cancel: "org.requests.cancel",
+			get: "org.requests.get",
+			issue: "org.requests.issue",
+			list: "org.requests.list"
+		},
+		recordFailure: "org.recordFailure",
+		recordProgress: "org.recordProgress",
+		resumeBootstrapSubmission: "org.resumeBootstrapSubmission",
+		retry: "org.retry",
+		retrySetup: "org.retrySetup",
+		roles: "org.roles",
+		startOrResume: "org.startOrResume",
+		submitBootstrap: "org.submitBootstrap",
+		treasury: "org.treasury"
+	},
+	organization: { setup: "organization.setup" },
+	organizationPayments: {
+		pay: "organizationPayments.pay",
+		payBatch: "organizationPayments.payBatch",
+		prepareExecution: "organizationPayments.prepareExecution",
+		retry: "organizationPayments.retry"
+	},
+	organizationSetup: { getProofReceipt: "organizationSetup.getProofReceipt" },
+	payments: {
+		cancel: "payments.cancel",
+		claim: "payments.claim",
+		createCommitment: "payments.createCommitment",
+		get: "payments.get",
+		ledger: "payments",
+		list: "payments.list",
+		pay: "payments.pay",
+		prepareExecution: "payments.prepareExecution",
+		prepareLifecycleExecution: "payments.prepareLifecycleExecution",
+		redirect: "payments.redirect",
+		retry: "payments.retry",
+		submitCommandExecution: "payments.submitCommandExecution",
+		submitExecution: "payments.submitExecution"
+	},
+	paymentDocuments: {
+		get: "paymentDocuments.get",
+		render: "paymentDocuments.render",
+		verify: "paymentDocuments.verify"
+	},
+	recipient: { resolve: "recipient.resolve" },
+	payroll: {
+		authorizeRun: "payroll.authorizeRun",
+		emitGroupChanged: "payroll.emitGroupChanged",
+		emitRunTransitioned: "payroll.emitRunTransitioned",
+		groups: {
+			access: "payroll.groups",
+			list: "payroll.groups.list",
+			remove: "payroll.groups.remove",
+			save: "payroll.groups.save"
+		},
+		removeGroup: "payroll.removeGroup",
+		runs: "payroll.runs",
+		saveGroup: "payroll.saveGroup",
+		terms: "payroll.terms"
+	},
+	permission: {
+		verifyInvitationConfiguration: "permission.verifyInvitationConfiguration",
+		command: "permission.command",
+		retryVerification: "permission.retryVerification",
+		verify: "permission.verify",
+		verifySubmitted: "permission.verifySubmitted"
+	},
+	permissions: {
+		assign: "permissions.assign",
+		change: "permissions.change",
+		create: "permissions.create",
+		get: "permissions.get",
+		list: "permissions.list",
+		prepareExecution: "permissions.prepareExecution",
+		replace: "permissions.replace",
+		revoke: "permissions.revoke",
+		submitExecution: "permissions.submitExecution"
+	},
+	publishableKeys: {
+		mint: "publishableKeys.mint",
+		revoke: "publishableKeys.revoke",
+		rotate: "publishableKeys.rotate"
+	},
+	requests: {
+		cancel: "requests.cancel",
+		get: "requests.get",
+		issue: "requests.issue",
+		list: "requests.list"
+	},
+	runtime: {
+		assign: "assign",
+		canSendOtp: "canSendOtp",
+		cancelCommitment: "cancel_commitment",
+		change: "change",
+		claimCommitment: "claim_commitment",
+		create: "create",
+		createCapxulClient: "createCapxulClient",
+		createCapxulClientWithOrgDeploymentSeams: "createCapxulClientWithOrgDeploymentSeams",
+		createCommitment: "create_commitment",
+		getConvexJwt: "getConvexJwt",
+		getSession: "getSession",
+		initialize: "initialize",
+		mutation: "mutation",
+		now: "now",
+		port: "port",
+		query: "query",
+		redirectCommitment: "redirect_commitment",
+		replace: "replace",
+		resolve: "resolve",
+		revoke: "revoke",
+		send: "send",
+		sendOtp: "sendOtp",
+		signIn: "signIn",
+		signOut: "signOut",
+		sleep: "sleep",
+		verifyOtp: "verifyOtp",
+		wallet: "wallet"
+	},
+	smartAccount: {
+		claim: "smartAccount.claim",
+		confirmDeployment: "smartAccount.confirmDeployment",
+		loadByAuthUserId: "smartAccount.loadByAuthUserId",
+		loadCurrent: "smartAccount.loadCurrent",
+		provision: "smartAccount.provision"
+	},
+	system: {
+		health: "system.health",
+		ping: "system.ping",
+		runtimeChain: "system.runtimeChain"
+	},
+	testUsdc: { mint: "TestUSDC.mint" },
+	_internal: {
+		accounts: { fund: "_internal.accounts.fund" },
+		close: "_internal.close",
+		identity: {
+			completeProfile: "_internal.identity.completeProfile",
+			runFacade: "_internal.identity.runFacade",
+			send: "_internal.identity.send"
+		},
+		organizationSetup: { getProofReceipt: "_internal.organizationSetup.getProofReceipt" }
+	},
+	tenancy: {
+		revokeBackendTenancyConsent: "tenancy.revokeBackendTenancyConsent",
+		seedBackendTenancy: "tenancy.seedBackendTenancy"
+	}
+};
+function collectOperations(tree) {
+	return Object.values(tree).flatMap((value) => typeof value === "string" ? [value] : collectOperations(value));
+}
+const operations = new Set(collectOperations(CAPXUL_OPERATIONS));
+function isCapxulOperation(value) {
+	return typeof value === "string" && operations.has(value);
+}
+function normalizeCapxulOperation(value) {
+	return isCapxulOperation(value) ? value : "unknown";
+}
+//#endregion
+//#region src/index.ts
+const TELEMETRY_EVENT_NAMES = [
+	"auth_otp_requested",
+	"auth_otp_delivered",
+	"auth_otp_expired",
+	"auth_verified",
+	"auth_failed",
+	"identity_refused",
+	"auth_signed_out",
+	"native_authorization_started",
+	"native_authorization_reviewed",
+	"native_authorization_accepted",
+	"native_authorization_denied",
+	"native_authorization_connected",
+	"native_authorization_failed",
+	"onboarding_intent_selected",
+	"onboarding_profile_submitted",
+	"onboarding_organization_submitted",
+	"onboarding_dashboard_reached",
+	"provisioning_safe_created",
+	"provisioning_safe_confirmed",
+	"bootstrap_resolved",
+	"bootstrap_failed",
+	"member_activation_started",
+	"member_activation_ready",
+	"member_activation_failed",
+	"organization_creation_started",
+	"organization_creation_ready",
+	"organization_creation_failed",
+	"chain_upstream_fallback",
+	"bundler_error",
+	"receipt_pending",
+	"operation_retried",
+	"account_balance_read",
+	"account_balance_failed",
+	"faucet_requested",
+	"faucet_confirmed",
+	"faucet_failed",
+	"org_create_started",
+	"org_safe_created",
+	"org_safe_confirmed",
+	"org_roles_seeded",
+	"org_created",
+	"org_create_failed",
+	"org_invite_sent",
+	"org_invite_accepted",
+	"org_invite_expired",
+	"payment_initiated",
+	"payment_settled",
+	"payment_failed",
+	"payment_verification_retry",
+	"payment_lifecycle_transition",
+	"quick_pay_external_address_acknowledged",
+	"deposit_initiated",
+	"deposit_settled",
+	"permission_mirror_verification",
+	"movement_scan_window",
+	"movement_scan_checkpoint",
+	"movement_scan_incident",
+	"indexer_drift_corrected",
+	"activity_annotation_saved",
+	"ui_activity_action_completed",
+	"contact_relationship_changed",
+	"ui_contact_action_completed",
+	"access_recovery_completed",
+	"ui_access_step_completed",
+	"org_invite_progressed",
+	"invoice_issued",
+	"invoice_request_transitioned",
+	"ui_invoice_step_completed",
+	"ui_treasury_step_completed",
+	"ui_receive_step_completed",
+	"payroll_group_changed",
+	"payroll_run_transitioned",
+	"ui_payroll_action_completed",
+	"cli_diagnostic_completed",
+	"cli_first_used",
+	"cli_command_started",
+	"cli_command_completed"
+];
+const TELEMETRY_JOURNEYS = {
+	returning_user_login: {
+		type: "funnel",
+		steps: [
+			"auth_otp_requested",
+			"auth_otp_delivered",
+			"auth_verified"
+		],
+		drops_on: ["auth_otp_expired", "auth_failed"]
+	},
+	new_user_first_signin: {
+		type: "funnel",
+		steps: [
+			"auth_otp_requested",
+			"auth_otp_delivered",
+			"auth_verified",
+			"provisioning_safe_created",
+			"provisioning_safe_confirmed"
+		],
+		drops_on: ["auth_otp_expired", "auth_failed"]
+	},
+	sign_out_session_close: {
+		type: "point_event",
+		point_event: "auth_signed_out"
+	},
+	member_activation: {
+		type: "funnel",
+		steps: ["member_activation_started", "member_activation_ready"],
+		drops_on: ["member_activation_failed"]
+	},
+	organization_creation_lifecycle: {
+		type: "funnel",
+		steps: ["organization_creation_started", "organization_creation_ready"],
+		drops_on: ["organization_creation_failed"]
+	},
+	new_member_personal_dashboard: {
+		type: "funnel",
+		steps: [
+			"auth_verified",
+			"onboarding_intent_selected",
+			"onboarding_profile_submitted",
+			"member_activation_ready",
+			"onboarding_dashboard_reached"
+		],
+		step_filters: {
+			onboarding_intent_selected: [{
+				key: "intent",
+				value: ["personal"],
+				operator: "exact",
+				type: "event"
+			}, {
+				key: "entry_point",
+				value: ["signup"],
+				operator: "exact",
+				type: "event"
+			}],
+			onboarding_profile_submitted: [{
+				key: "intent",
+				value: ["personal"],
+				operator: "exact",
+				type: "event"
+			}],
+			onboarding_dashboard_reached: [{
+				key: "intent",
+				value: ["personal"],
+				operator: "exact",
+				type: "event"
+			}]
+		}
+	},
+	new_member_organization_dashboard: {
+		type: "funnel",
+		steps: [
+			"auth_verified",
+			"onboarding_intent_selected",
+			"onboarding_profile_submitted",
+			"onboarding_organization_submitted",
+			"member_activation_started",
+			"member_activation_ready",
+			"organization_creation_started",
+			"organization_creation_ready",
+			"onboarding_dashboard_reached"
+		],
+		step_filters: {
+			onboarding_intent_selected: [{
+				key: "intent",
+				value: ["organization"],
+				operator: "exact",
+				type: "event"
+			}, {
+				key: "entry_point",
+				value: ["signup"],
+				operator: "exact",
+				type: "event"
+			}],
+			onboarding_profile_submitted: [{
+				key: "intent",
+				value: ["organization"],
+				operator: "exact",
+				type: "event"
+			}],
+			onboarding_dashboard_reached: [{
+				key: "intent",
+				value: ["organization"],
+				operator: "exact",
+				type: "event"
+			}]
+		}
+	},
+	existing_member_organization_dashboard: {
+		type: "funnel",
+		steps: [
+			"onboarding_intent_selected",
+			"onboarding_organization_submitted",
+			"organization_creation_started",
+			"organization_creation_ready",
+			"onboarding_dashboard_reached"
+		],
+		step_filters: {
+			onboarding_intent_selected: [{
+				key: "intent",
+				value: ["organization"],
+				operator: "exact",
+				type: "event"
+			}, {
+				key: "entry_point",
+				value: ["dashboard"],
+				operator: "exact",
+				type: "event"
+			}],
+			onboarding_dashboard_reached: [{
+				key: "intent",
+				value: ["organization"],
+				operator: "exact",
+				type: "event"
+			}]
+		}
+	},
+	money_on_screen: {
+		type: "point_event",
+		point_event: "account_balance_read"
+	},
+	fund_account: {
+		type: "funnel",
+		steps: ["faucet_requested", "faucet_confirmed"],
+		drops_on: ["faucet_failed"]
+	},
+	org_creation: {
+		type: "funnel",
+		steps: [
+			"org_create_started",
+			"org_safe_created",
+			"org_safe_confirmed",
+			"org_roles_seeded",
+			"org_created"
+		],
+		drops_on: ["org_create_failed"]
+	},
+	org_member_onboarding: {
+		type: "funnel",
+		steps: ["org_invite_sent", "org_invite_accepted"],
+		drops_on: ["org_invite_expired"]
+	},
+	direct_payment: {
+		type: "funnel",
+		steps: ["payment_initiated", "payment_settled"],
+		drops_on: ["payment_failed"]
+	},
+	deposit: {
+		type: "funnel",
+		steps: ["deposit_initiated", "deposit_settled"]
+	}
+};
+const PII = Schema.String.pipe(Schema.brand("PII"));
+const OptionalString = Schema.optional(Schema.String);
+const AddressSchema = Schema.String.pipe(Schema.decodeTo(Schema.String, {
+	decode: SchemaGetter.transform((value) => value.toLowerCase()),
+	encode: SchemaGetter.transform((value) => value)
+}), Schema.refine((value) => EVM_ADDRESS_RE.test(value), { message: "must be 0x + 40 hex chars" }));
+const AppIdSchema = Schema.String.pipe(Schema.refine((value) => APP_ID_RE.test(value), { message: "must be app_ plus a ULID" }));
+const BlockNumberSchema = Schema.Number.pipe(Schema.refine((value) => Number.isSafeInteger(value) && value >= 0, { message: "must be a non-negative safe integer" }));
+const ChainIdSchema = Schema.Number.pipe(Schema.refine((value) => Number.isSafeInteger(value) && value > 0, { message: "must be a positive safe integer" }));
+const DurationMsSchema = Schema.Number.pipe(Schema.refine((value) => Number.isSafeInteger(value) && value >= 0, { message: "must be a non-negative safe integer" }));
+const EpochMsSchema = Schema.Number.pipe(Schema.refine((value) => Number.isSafeInteger(value) && value >= 0, { message: "must be a non-negative safe integer" }));
+const PublishableKeyIdSchema = Schema.String.pipe(Schema.refine((value) => value.length > 0, { message: "must be a non-empty string" }));
+const TxHashSchema = Schema.String.pipe(Schema.refine((value) => BYTES32_RE.test(value), { message: "must be 0x + 64 hex chars" }));
+const ACCOUNT_ID_TELEMETRY_RE = /^account_[0-9A-Za-z]+$/;
+const WEI_AMOUNT_TELEMETRY_RE = /^[0-9]+$/;
+const AccountIdSchema = Schema.String.pipe(Schema.refine((value) => ACCOUNT_ID_TELEMETRY_RE.test(value), { message: "must be account_ plus an alphanumeric id" }));
+const WeiAmountSchema = Schema.String.pipe(Schema.refine((value) => WEI_AMOUNT_TELEMETRY_RE.test(value), { message: "must be a non-negative integer string" }));
+const CurrencyCodeSchema = Schema.String.pipe(Schema.refine((value) => value.length > 0, { message: "must be a non-empty currency code" }));
+const BalanceBucketSchema = Schema.Literals(["zero", "nonzero"]);
+const OptionalAccountId = Schema.optional(AccountIdSchema);
+const OptionalWeiAmount = Schema.optional(WeiAmountSchema);
+const OptionalCurrencyCode = Schema.optional(CurrencyCodeSchema);
+const OptionalBalanceBucket = Schema.optional(BalanceBucketSchema);
+/** Which Safe a money record is about. Declared here so the money-domain
+* props below can name it as well as the UI-step props further down. */
+const AccountKindSchema = Schema.Literals(["personalSafe", "orgTreasury"]);
+const OptionalAccountKind = Schema.optional(AccountKindSchema);
+const OptionalAddress = Schema.optional(AddressSchema);
+const OptionalAppId = Schema.optional(AppIdSchema);
+const OptionalBlockNumber = Schema.optional(BlockNumberSchema);
+const OptionalChainId = Schema.optional(ChainIdSchema);
+const OptionalDurationMs = Schema.optional(DurationMsSchema);
+const OptionalEpochMs = Schema.optional(EpochMsSchema);
+const OptionalPublishableKeyId = Schema.optional(PublishableKeyIdSchema);
+const OptionalTxHash = Schema.optional(TxHashSchema);
+/**
+* Environment discriminator (ADR-0020 A1 amendment, 2026-08-07). PostHog
+* project 368736 is the SINGLE sink for every environment, so `capxul_env` —
+* not project isolation — is what keeps a production surface from reading dev
+* traffic. It is REQUIRED on every catalog event and every synced artifact
+* filters on it.
+*
+* `unknown` is a defect marker, not an environment: it means a producer
+* reached the transport without declaring where it runs. It is in the union so
+* the property is never ABSENT (an absent property is invisible to a filter,
+* a present `unknown` is loud), and sync v2 never synthesizes an artifact for
+* it.
+*/
+const CAPXUL_ENVS = [
+	"development",
+	"staging",
+	"production",
+	"unknown",
+	"local"
+];
+/**
+* Environments a synced product surface may be built for. `unknown` and
+* `local` cannot. This list is deliberately narrower than `CAPXUL_ENVS`.
+*/
+const SYNCABLE_CAPXUL_ENVS = [
+	"development",
+	"staging",
+	"production"
+];
+/**
+* Which half of the system emitted the event. REQUIRED alongside `capxul_env`
+* so a name that two halves can produce (settlement, auth) stays attributable.
+*/
+const TELEMETRY_PRODUCERS = [
+	"server",
+	"browser",
+	"sdk",
+	"mcp",
+	"e2e"
+];
+/**
+* The canonical envelope (ADR-0020 A4): snake_case ONLY. `capxul_env` and
+* `producer` are REQUIRED — a boundary that forgets to stamp them fails schema
+* decode instead of silently shipping an unattributable event. Call sites do
+* not pass them: `stampTelemetryEnvelope` injects them at the emit boundary,
+* which is the only place that knows where the process runs.
+*/
+const TelemetryEnvelopeProps = {
+	capxul_env: Schema.Literals(CAPXUL_ENVS),
+	producer: Schema.Literals(TELEMETRY_PRODUCERS),
+	journey_id: OptionalString,
+	correlation_id: OptionalString,
+	sdk_version: OptionalString
+};
+/**
+* The cause of a failure, flat (ADR-0023 R7–R8). `failure_mode` is the one
+* word from `@capxul/errors`; the `chain_*` keys are the `ChainCause` when the
+* failure came from the chain path. Spread into every failure event and posted
+* on `$exception`, so one PostHog filter finds a cause wherever it was seen.
+*/
+const FailureModeSchema = Schema.Literals(FAILURE_MODES);
+const ChainUpstreamSchema = Schema.Literals(CHAIN_UPSTREAMS);
+/**
+* The refusing upstream's response headers (#1818): exactly the names in
+* `RESPONSE_HEADER_ALLOWLIST`, each optional, so the catalog itself refuses a
+* `set-cookie` or `authorization` that a producer let through.
+*/
+const ResponseHeadersSchema = Schema.Struct({
+	"retry-after": OptionalString,
+	"www-authenticate": OptionalString,
+	"content-type": OptionalString,
+	"x-request-id": OptionalString,
+	"cf-ray": OptionalString,
+	"x-ratelimit-remaining": OptionalString,
+	"x-ratelimit-reset": OptionalString,
+	server: OptionalString
+});
+/** One upstream tried, flat (#1818): the `chain_attempts` entry on every producer's row. */
+const ChainAttemptSchema = Schema.Struct({
+	upstream: ChainUpstreamSchema,
+	failure_mode: FailureModeSchema,
+	http_status: Schema.optional(Schema.Number),
+	rpc_code: Schema.optional(Schema.Number),
+	duration_ms: Schema.Number
+});
+const ChainCauseTelemetryProps = {
+	failure_mode: Schema.optional(FailureModeSchema),
+	chain_upstream: Schema.optional(ChainUpstreamSchema),
+	chain_method: OptionalString,
+	chain_retryable: Schema.optional(Schema.Boolean),
+	chain_http_status: Schema.optional(Schema.Number),
+	chain_rpc_code: Schema.optional(Schema.Number),
+	chain_revert_name: OptionalString,
+	chain_revert_selector: OptionalString,
+	chain_revert_args: Schema.optional(Schema.Record(Schema.String, Schema.String)),
+	chain_provider_message: OptionalString,
+	chain_attempts: Schema.optional(Schema.Array(ChainAttemptSchema)),
+	chain_response_headers: Schema.optional(ResponseHeadersSchema)
+};
+/**
+* Stamp the required envelope onto an event at its emit boundary. Call-site
+* props win on conflict: a relay that already knows the true producer (the
+* browser-failure relay stamps `browser` while running on the server) must not
+* be overwritten by the transport's own default.
+*/
+function stampTelemetryEnvelope(event, defaults) {
+	return {
+		name: event.name,
+		props: {
+			...defaults,
+			...event.props
+		}
+	};
+}
+const AuthOtpRequestedProps = Schema.Struct({
+	...TelemetryEnvelopeProps,
+	email: Schema.optional(PII),
+	email_domain: OptionalString
+});
+const AuthOtpDeliveredProps = Schema.Struct({
+	...TelemetryEnvelopeProps,
+	durationMs: OptionalDurationMs,
+	email: Schema.optional(PII),
+	email_domain: OptionalString,
+	resendMessageId: OptionalString
+});
+const AuthOtpExpiredProps = Schema.Struct({
+	...TelemetryEnvelopeProps,
+	email: Schema.optional(PII),
+	email_domain: OptionalString
+});
+const AuthVerifiedProps = Schema.Struct({
+	...TelemetryEnvelopeProps,
+	auth_type: OptionalString
+});
+const AuthFailedProps = Schema.Struct({
+	...TelemetryEnvelopeProps,
+	...ChainCauseTelemetryProps,
+	email: Schema.optional(PII),
+	auth_type: OptionalString,
+	reason: OptionalString
+});
+const IdentityRefusedProps = Schema.Struct({
+	...TelemetryEnvelopeProps,
+	/** The refused identity event tag, for example CreateOrganization. */
+	event: OptionalString,
+	/** The machine's refusal code: WRONG_STATE, SUPERSEDED or STALE_EPOCH. */
+	refusal_code: OptionalString,
+	/** The machine slot the request targeted, for example identity:org. */
+	slot: OptionalString,
+	/** The machine state at refusal, for example authenticated:claiming. */
+	state: OptionalString
+});
+const AuthSignedOutProps = Schema.Struct(TelemetryEnvelopeProps);
+const NativeAuthorizationMode = Schema.Literals(["login", "signup"]);
+const NativeAuthorizationStartedProps = Schema.Struct({
+	...TelemetryEnvelopeProps,
+	mode: NativeAuthorizationMode
+});
+const NativeAuthorizationReviewedProps = Schema.Struct({
+	...TelemetryEnvelopeProps,
+	mode: NativeAuthorizationMode
+});
+const NativeAuthorizationAcceptedProps = Schema.Struct({
+	...TelemetryEnvelopeProps,
+	mode: NativeAuthorizationMode,
+	/** Whether consent also had to finish account setup first. */
+	setup_state: Schema.optional(Schema.Literals([
+		"not_required",
+		"new",
+		"resumable"
+	]))
+});
+const NativeAuthorizationDeniedProps = Schema.Struct({
+	...TelemetryEnvelopeProps,
+	mode: NativeAuthorizationMode
+});
+const NativeAuthorizationConnectedProps = Schema.Struct({
+	...TelemetryEnvelopeProps,
+	mode: NativeAuthorizationMode
+});
+const NativeAuthorizationFailedProps = Schema.Struct({
+	...TelemetryEnvelopeProps,
+	mode: Schema.optional(NativeAuthorizationMode),
+	/** The refusal word the store returned, for example `identity_mismatch` or
+	* `request_expired`. These are the closed `CLIENT_AUTHORIZATION_REFUSALS` from
+	* `@capxul/wire` plus the store-internal `fresh_session_required` (ruling R3),
+	* which the continuation maps to `identity_mismatch` on the wire but reports
+	* truthfully here. Kept as `OptionalString` rather than an imported literal
+	* set: this package must not depend on the transport contract. */
+	reason: OptionalString
+});
+const ProvisioningSafeCreatedProps = Schema.Struct({
+	...TelemetryEnvelopeProps,
+	safe_address: OptionalAddress
+});
+const ProvisioningSafeConfirmedProps = Schema.Struct({
+	...TelemetryEnvelopeProps,
+	chainId: OptionalChainId,
+	deployedAt: OptionalEpochMs,
+	deployedAtBlock: OptionalBlockNumber,
+	deployTxHash: OptionalTxHash,
+	durationMs: OptionalDurationMs,
+	safe_address: OptionalAddress,
+	userOpHash: OptionalTxHash
+});
+const BootstrapResolvedProps = Schema.Struct({
+	...TelemetryEnvelopeProps,
+	applicationId: OptionalAppId,
+	durationMs: OptionalDurationMs,
+	env: OptionalString,
+	keyId: OptionalPublishableKeyId,
+	origin: OptionalString
+});
+const BootstrapFailedProps = Schema.Struct({
+	...TelemetryEnvelopeProps,
+	...ChainCauseTelemetryProps,
+	applicationId: OptionalAppId,
+	durationMs: OptionalDurationMs,
+	origin: OptionalString,
+	provider: OptionalString,
+	provider_operation: OptionalString,
+	reason: OptionalString,
+	target_host: OptionalString
+});
+/**
+* R08 (#1966): which Safe was read, on which chain, of which token. `currency`
+* is the DISPLAY code the surface shows ("USD"); it never says which ERC-20 the
+* `balanceOf` actually hit, so a reader could not tell a treasury read from a
+* personal one, nor one token from another with the same fiat peg. The producer
+* takes each of these from the authority that already decided it — the verified
+* Organization row's chain, the configured token address — never from a label.
+* The verified `organization_id` and its group arrive from the backend
+* attribution, so they are not repeated here.
+*
+* D1 (2026-09-10): `asset_id` carries the canonical branded identity the read
+* resolved, `eip155:<chainId>/erc20:<lowercase-address>`, from the registry
+* row. `token_address`/`chain_id` are its parts; `currency` is the peg and a
+* display code. The producer emits the branded id so the live read can be
+* grouped by ASSET, never by symbol or peg.
+*/
+const AccountBalanceReadProps = Schema.Struct({
+	...TelemetryEnvelopeProps,
+	account_id: OptionalAccountId,
+	account_kind: OptionalAccountKind,
+	chain_id: OptionalChainId,
+	token_address: OptionalAddress,
+	asset_id: OptionalString,
+	currency: OptionalCurrencyCode,
+	balance_bucket: OptionalBalanceBucket,
+	durationMs: OptionalDurationMs
+});
+const AccountBalanceFailedProps = Schema.Struct({
+	...TelemetryEnvelopeProps,
+	...ChainCauseTelemetryProps,
+	reason: OptionalString
+});
+const FaucetRequestedProps = Schema.Struct({
+	...TelemetryEnvelopeProps,
+	amount: OptionalWeiAmount,
+	chainId: OptionalChainId,
+	asset_id: OptionalString
+});
+const FaucetConfirmedProps = Schema.Struct({
+	...TelemetryEnvelopeProps,
+	amount: OptionalWeiAmount,
+	chainId: OptionalChainId,
+	txHash: OptionalTxHash,
+	asset_id: OptionalString,
+	token_address: OptionalAddress,
+	durationMs: OptionalDurationMs
+});
+const FaucetFailedProps = Schema.Struct({
+	...TelemetryEnvelopeProps,
+	...ChainCauseTelemetryProps,
+	reason: OptionalString,
+	amount: OptionalWeiAmount,
+	chainId: OptionalChainId,
+	asset_id: OptionalString,
+	token_address: OptionalAddress
+});
+const ChainServiceSchema = Schema.Literals(["aa-gateway", "backend"]);
+const ChainUpstreamFallbackProps = Schema.Struct({
+	...TelemetryEnvelopeProps,
+	service: ChainServiceSchema,
+	method: Schema.String,
+	from_upstream: ChainUpstreamSchema,
+	to_upstream: Schema.optional(ChainUpstreamSchema),
+	failure_mode: FailureModeSchema,
+	exhausted: Schema.Boolean,
+	http_status: Schema.optional(Schema.Number),
+	rpc_code: Schema.optional(Schema.Number),
+	response_headers: Schema.optional(ResponseHeadersSchema)
+});
+const BundlerErrorProps = Schema.Struct({
+	...TelemetryEnvelopeProps,
+	method: Schema.String,
+	failure_mode: FailureModeSchema,
+	chain_upstream: ChainUpstreamSchema,
+	chain_retryable: Schema.Boolean,
+	http_status: Schema.optional(Schema.Number),
+	rpc_code: Schema.optional(Schema.Number),
+	chain_revert_name: OptionalString,
+	chain_provider_message: OptionalString
+});
+const ReceiptPendingProps = Schema.Struct({
+	...TelemetryEnvelopeProps,
+	service: ChainServiceSchema,
+	method: Schema.String,
+	chain_upstream: ChainUpstreamSchema,
+	reason: Schema.Literals(["zero_block_hash", "no_receipt"])
+});
+const OperationRetriedProps = Schema.Struct({
+	...TelemetryEnvelopeProps,
+	operation: Schema.String,
+	failure_mode: FailureModeSchema,
+	reason: Schema.optional(Schema.Literal("connection-lost-in-flight")),
+	connection_id: OptionalString,
+	connection_count: Schema.optional(Schema.Number),
+	attempt: Schema.Number,
+	delay_ms: DurationMsSchema
+});
+const ORG_ID_TELEMETRY_RE = /^org_[0-9A-Za-z]+$/;
+const OrgIdTelemetrySchema = Schema.String.pipe(Schema.refine((value) => ORG_ID_TELEMETRY_RE.test(value), { message: "must be org_ plus an alphanumeric id" }));
+const OptionalOrgId = Schema.optional(OrgIdTelemetrySchema);
+const AttemptNumberSchema = Schema.Number.pipe(Schema.refine((value) => Number.isSafeInteger(value) && value > 0, { message: "must be a positive safe integer" }));
+const OnboardingStageSchema = Schema.Literals([
+	"profile",
+	"accountProvisioning",
+	"accountClaim",
+	"preparingFounderAccount",
+	"awaitingFounderAuthorization",
+	"submittingBootstrap",
+	"confirmingBootstrap"
+]);
+const MemberActivationStartedProps = Schema.Struct({
+	...TelemetryEnvelopeProps,
+	$insert_id: Schema.String
+});
+const MemberActivationReadyProps = Schema.Struct({
+	...TelemetryEnvelopeProps,
+	$insert_id: Schema.String,
+	duration_ms: DurationMsSchema
+});
+const MemberActivationFailedProps = Schema.Struct({
+	...TelemetryEnvelopeProps,
+	...ChainCauseTelemetryProps,
+	$insert_id: Schema.String,
+	stage: OnboardingStageSchema,
+	error_code: Schema.String,
+	retryable: Schema.Boolean
+});
+const OrganizationCreationStartedProps = Schema.Struct({
+	...TelemetryEnvelopeProps,
+	$insert_id: Schema.String,
+	organization_id: OrgIdTelemetrySchema,
+	attempt_number: AttemptNumberSchema,
+	release: Schema.optional(Schema.String.check(Schema.isPattern(/^[0-9a-f]{40}$/u)))
+});
+const OrganizationCreationReadyProps = Schema.Struct({
+	...TelemetryEnvelopeProps,
+	$insert_id: Schema.String,
+	organization_id: OrgIdTelemetrySchema,
+	attempt_number: AttemptNumberSchema,
+	duration_ms: DurationMsSchema,
+	release: Schema.optional(Schema.String.check(Schema.isPattern(/^[0-9a-f]{40}$/u)))
+});
+const OrganizationCreationFailedProps = Schema.Struct({
+	...TelemetryEnvelopeProps,
+	...ChainCauseTelemetryProps,
+	$insert_id: Schema.String,
+	organization_id: OrgIdTelemetrySchema,
+	attempt_number: AttemptNumberSchema,
+	stage: OnboardingStageSchema,
+	error_code: Schema.String,
+	retryable: Schema.Boolean,
+	release: Schema.optional(Schema.String.check(Schema.isPattern(/^[0-9a-f]{40}$/u))),
+	/** #1655: the SDK's backoff before this attempt. Absent on the first attempt. */
+	backoff_ms: Schema.optional(DurationMsSchema),
+	failure_reason: Schema.optional(Schema.Literals([
+		"receipt_provider_unavailable",
+		"block_provider_unavailable",
+		...ORGANIZATION_SETUP_REASONS
+	]))
+});
+const OnboardingIntentSchema = Schema.Literals(["personal", "organization"]);
+const OnboardingIntentSelectedProps = Schema.Struct({
+	...TelemetryEnvelopeProps,
+	journey_id: Schema.String,
+	intent: OnboardingIntentSchema,
+	entry_point: Schema.String
+});
+const OnboardingProfileSubmittedProps = Schema.Struct({
+	...TelemetryEnvelopeProps,
+	journey_id: Schema.String,
+	intent: OnboardingIntentSchema
+});
+const OnboardingOrganizationSubmittedProps = Schema.Struct({
+	...TelemetryEnvelopeProps,
+	journey_id: Schema.String
+});
+const OnboardingDashboardReachedProps = Schema.Struct({
+	...TelemetryEnvelopeProps,
+	journey_id: Schema.String,
+	intent: OnboardingIntentSchema,
+	organization_id: Schema.optional(OrgIdTelemetrySchema)
+});
+const OrgCreateStartedProps = Schema.Struct({
+	...TelemetryEnvelopeProps,
+	org_id: OptionalOrgId,
+	email_domain: OptionalString,
+	template: OptionalString
+});
+const OrgSafeCreatedProps = Schema.Struct({
+	...TelemetryEnvelopeProps,
+	org_id: OptionalOrgId,
+	chainId: OptionalChainId,
+	safe_address: OptionalAddress
+});
+const OrgSafeConfirmedProps = Schema.Struct({
+	...TelemetryEnvelopeProps,
+	org_id: OptionalOrgId,
+	chainId: OptionalChainId,
+	safe_address: OptionalAddress,
+	durationMs: OptionalDurationMs
+});
+const OrgRolesSeededProps = Schema.Struct({
+	...TelemetryEnvelopeProps,
+	org_id: OptionalOrgId,
+	chainId: OptionalChainId,
+	role: OptionalString,
+	txHash: OptionalTxHash
+});
+const OrgCreatedProps = Schema.Struct({
+	...TelemetryEnvelopeProps,
+	org_id: OptionalOrgId,
+	chainId: OptionalChainId,
+	safe_address: OptionalAddress,
+	durationMs: OptionalDurationMs
+});
+const OrgCreateFailedProps = Schema.Struct({
+	...TelemetryEnvelopeProps,
+	...ChainCauseTelemetryProps,
+	org_id: OptionalOrgId,
+	reason: OptionalString
+});
+const OrgInviteSentProps = Schema.Struct({
+	...TelemetryEnvelopeProps,
+	org_id: OptionalOrgId,
+	invitation_id: OptionalString,
+	generation: OptionalString,
+	command_id: OptionalString,
+	subject_party_id: OptionalString,
+	persisted_at: OptionalEpochMs,
+	email_domain: OptionalString,
+	role: OptionalString,
+	status: OptionalString
+});
+const OrgInviteAcceptedProps = Schema.Struct({
+	...TelemetryEnvelopeProps,
+	org_id: OptionalOrgId,
+	invitation_id: OptionalString,
+	accepted_at: OptionalEpochMs,
+	generation: OptionalString,
+	command_id: OptionalString,
+	subject_party_id: OptionalString,
+	role: OptionalString,
+	status: OptionalString
+});
+const OrgInviteExpiredProps = Schema.Struct({
+	...TelemetryEnvelopeProps,
+	org_id: OptionalOrgId,
+	email_domain: OptionalString,
+	invitation_id: OptionalString,
+	reason: OptionalString,
+	role: OptionalString,
+	status: OptionalString
+});
+const RecipientLocatorKindSchema = Schema.Literals([
+	"handle",
+	"email",
+	"address",
+	"party"
+]);
+const RecipientResolutionStatusSchema = Schema.Literals([
+	"known_party",
+	"new_email",
+	"external_address"
+]);
+const RecipientPartyKindSchema = Schema.Literals([
+	"person",
+	"organization",
+	"unresolved"
+]);
+const RecipientTelemetryProps = {
+	recipient_locator_kind: Schema.optional(RecipientLocatorKindSchema),
+	recipient_resolution_status: Schema.optional(RecipientResolutionStatusSchema),
+	recipient_party_id: OptionalString,
+	recipient_party_kind: Schema.optional(RecipientPartyKindSchema),
+	recipient_is_capxul_account: Schema.optional(Schema.Boolean),
+	recipient_handle: OptionalString,
+	recipient_address: OptionalAddress,
+	external_address_acknowledged: Schema.optional(Schema.Boolean)
+};
+const PaymentInitiatedProps = Schema.Struct({
+	command_id: OptionalString,
+	execution_id: OptionalString,
+	payment_lifecycle_id: OptionalString,
+	...TelemetryEnvelopeProps,
+	...RecipientTelemetryProps,
+	kind: Schema.String,
+	payment_id: Schema.String
+});
+const PaymentLifecycleProps = {
+	payment_state: OptionalString,
+	execution_state: OptionalString,
+	occurred_at: Schema.optional(Schema.Number),
+	causal_sequence: Schema.optional(Schema.Number),
+	sponsorship_valid_until: Schema.optional(Schema.Number),
+	terminal_event_id: OptionalString
+};
+const PaymentSettledL2Props = Schema.Struct({
+	...PaymentLifecycleProps,
+	...TelemetryEnvelopeProps,
+	...RecipientTelemetryProps,
+	kind: Schema.String,
+	chain_id: Schema.Number,
+	settlement_id: Schema.String,
+	payment_id: OptionalString,
+	payment_ids: OptionalString,
+	command_id: OptionalString,
+	payment_lifecycle_id: OptionalString,
+	execution_id: OptionalString,
+	user_op_hash: OptionalString,
+	transaction_hash: OptionalString
+});
+const PaymentFailedL2Props = Schema.Struct({
+	...PaymentLifecycleProps,
+	...TelemetryEnvelopeProps,
+	...ChainCauseTelemetryProps,
+	...RecipientTelemetryProps,
+	kind: Schema.String,
+	payment_id: Schema.String,
+	payment_ids: OptionalString,
+	reason_code: Schema.String,
+	command_id: OptionalString,
+	payment_lifecycle_id: OptionalString,
+	execution_id: OptionalString,
+	user_op_hash: OptionalString
+});
+const PaymentVerificationRetryProps = Schema.Struct({
+	...PaymentLifecycleProps,
+	...TelemetryEnvelopeProps,
+	...RecipientTelemetryProps,
+	command_id: Schema.String,
+	payment_lifecycle_id: Schema.String,
+	attempt: Schema.Number,
+	reason_code: Schema.String,
+	chain_id: Schema.Number,
+	delay_ms: DurationMsSchema,
+	outcome: Schema.Literals(["scheduled", "unresolved"]),
+	payment_id: OptionalString,
+	payment_ids: OptionalString,
+	execution_id: OptionalString,
+	user_op_hash: OptionalString
+});
+const PaymentLifecycleTransitionProps = Schema.Struct({
+	...TelemetryEnvelopeProps,
+	...RecipientTelemetryProps,
+	payment_id: Schema.String,
+	payment_lifecycle_id: Schema.String,
+	command_id: Schema.String,
+	payment_state: Schema.String,
+	occurred_at: Schema.Number,
+	causal_sequence: Schema.Number,
+	execution_id: OptionalString,
+	execution_state: OptionalString,
+	user_op_hash: OptionalString,
+	sponsorship_valid_until: Schema.optional(Schema.Number),
+	reason_code: OptionalString
+});
+const QuickPayExternalAddressAcknowledgedProps = Schema.Struct({
+	...TelemetryEnvelopeProps,
+	recipient_locator_kind: Schema.Literal("address"),
+	recipient_resolution_status: Schema.Literal("external_address"),
+	recipient_address: AddressSchema,
+	external_address_acknowledged: Schema.Literal(true),
+	organization_id: OptionalOrgId
+});
+const DepositInitiatedProps = Schema.Struct({
+	...TelemetryEnvelopeProps,
+	scope_kind: Schema.optional(Schema.Literals(["account", "organization"])),
+	account_kind: Schema.optional(Schema.Literals(["personalSafe", "orgTreasury"])),
+	chain_id: Schema.optional(Schema.Number),
+	network: Schema.optional(Schema.Literal("base-sepolia")),
+	organization_id: OptionalOrgId,
+	$groups: Schema.optional(Schema.Struct({ organization: OptionalOrgId })),
+	actor_id: OptionalString,
+	actor_kind: Schema.optional(Schema.Literal("authenticated")),
+	distinct_id: OptionalString,
+	trace_id: OptionalString,
+	span_id: OptionalString
+});
+const DepositSettledProps = Schema.Struct({
+	...TelemetryEnvelopeProps,
+	chain_id: Schema.Number,
+	tx_hash: Schema.String,
+	log_index: Schema.Number
+});
+const PermissionMirrorVerificationProps = Schema.Struct({
+	...TelemetryEnvelopeProps,
+	/** The RECEIPT verification outcome. What the mirror then did is separate. */
+	outcome: Schema.String,
+	reason: Schema.String,
+	chain_id: Schema.Number,
+	retry_count: Schema.Number,
+	/**
+	* #1960 R02, consumed by R03. A verified receipt is not an applied Permission:
+	* these two optional fields let the producer say what the applying mutation
+	* actually returned, and which command it was, without either fact rewriting
+	* the receipt outcome above. Absent when application has not happened yet.
+	*/
+	application_result: Schema.optional(Schema.Literals([
+		"applied",
+		"replayed",
+		"conflicting_replay",
+		"revision_mismatch",
+		"cleanup_required",
+		"not_applied",
+		"application_failure",
+		"mismatch",
+		"refused"
+	])),
+	command_kind: Schema.optional(Schema.Literals(["invitation_configuration", "invitation_eoa"])),
+	command_id: OptionalString,
+	invitation_id: OptionalString,
+	generation: OptionalString,
+	purpose: Schema.optional(Schema.Literals([
+		"configure",
+		"grant",
+		"disable",
+		"compensate"
+	])),
+	$insert_id: OptionalString,
+	/**
+	* #1961 R03. The authorized stored row names the Permission it changed; the
+	* verified receipt names the chain facts that prove it. Every field is
+	* optional because a pending or provider-failed verification has neither an
+	* application result nor a receipt to report.
+	*/
+	permission_id: OptionalString,
+	permission_assignment_id: OptionalString,
+	permission_operation: Schema.optional(Schema.Literals([
+		"create",
+		"change",
+		"assign",
+		"revoke",
+		"replace"
+	])),
+	revision: Schema.optional(Schema.Number),
+	user_op_hash: OptionalString,
+	transaction_hash: OptionalString,
+	block_number: Schema.optional(Schema.Number),
+	log_index: Schema.optional(Schema.Number)
+});
+const MovementScanWindowProps = Schema.Struct({
+	...TelemetryEnvelopeProps,
+	chain_id: Schema.Number,
+	token_address: Schema.String,
+	from_block: Schema.Number,
+	to_block: Schema.Number,
+	log_count: Schema.Number,
+	request_count: Schema.Number,
+	outcome: Schema.String
+});
+const MovementScanCheckpointProps = Schema.Struct({
+	...TelemetryEnvelopeProps,
+	chain_id: Schema.Number,
+	token_address: Schema.String,
+	next_block: Schema.Number,
+	anchor_block_number: Schema.Number
+});
+const MovementScanIncidentProps = Schema.Struct({
+	...TelemetryEnvelopeProps,
+	chain_id: Schema.Number,
+	token_address: Schema.String,
+	incident_kind: Schema.String,
+	anchor_block_number: Schema.Number
+});
+/**
+* One durable row the reconciliation job corrected against Ponder (SPEC D9).
+*
+* Both block fields are optional and for the same reason: a correction INTO
+* drift (a Payment settled in Convex whose Ponder fact a reorg removed) has no
+* current block, and a correction that confirms a later fact has one.
+*
+* `projection_kind` is closed. A later ticket that reconciles a deploy, a
+* bootstrap or a grant outcome adds its kind here in the same change; an
+* unknown kind must not decode.
+*/
+const IndexerDriftCorrectedProps = Schema.Struct({
+	...TelemetryEnvelopeProps,
+	projection_kind: Schema.Literals([
+		"member_authority",
+		"payment_settlement",
+		"permission_assignment"
+	]),
+	previous_state: Schema.String,
+	current_state: Schema.String,
+	previous_block: Schema.optional(Schema.Number),
+	current_block: Schema.optional(Schema.Number),
+	logical_event_id: Schema.optional(Schema.String),
+	scope_kind: Schema.optional(Schema.Literals(["account", "organization"])),
+	account_id: OptionalAccountId,
+	reference_id: OptionalString
+});
+const AuthOtpRequestedTelemetryEventSchema = Schema.Struct({
+	name: Schema.Literal("auth_otp_requested"),
+	props: AuthOtpRequestedProps
+});
+const AuthOtpDeliveredTelemetryEventSchema = Schema.Struct({
+	name: Schema.Literal("auth_otp_delivered"),
+	props: AuthOtpDeliveredProps
+});
+const AuthOtpExpiredTelemetryEventSchema = Schema.Struct({
+	name: Schema.Literal("auth_otp_expired"),
+	props: AuthOtpExpiredProps
+});
+const AuthVerifiedTelemetryEventSchema = Schema.Struct({
+	name: Schema.Literal("auth_verified"),
+	props: AuthVerifiedProps
+});
+const AuthFailedTelemetryEventSchema = Schema.Struct({
+	name: Schema.Literal("auth_failed"),
+	props: AuthFailedProps
+});
+const IdentityRefusedTelemetryEventSchema = Schema.Struct({
+	name: Schema.Literal("identity_refused"),
+	props: IdentityRefusedProps
+});
+const AuthSignedOutTelemetryEventSchema = Schema.Struct({
+	name: Schema.Literal("auth_signed_out"),
+	props: AuthSignedOutProps
+});
+const NativeAuthorizationStartedTelemetryEventSchema = Schema.Struct({
+	name: Schema.Literal("native_authorization_started"),
+	props: NativeAuthorizationStartedProps
+});
+const NativeAuthorizationReviewedTelemetryEventSchema = Schema.Struct({
+	name: Schema.Literal("native_authorization_reviewed"),
+	props: NativeAuthorizationReviewedProps
+});
+const NativeAuthorizationAcceptedTelemetryEventSchema = Schema.Struct({
+	name: Schema.Literal("native_authorization_accepted"),
+	props: NativeAuthorizationAcceptedProps
+});
+const NativeAuthorizationDeniedTelemetryEventSchema = Schema.Struct({
+	name: Schema.Literal("native_authorization_denied"),
+	props: NativeAuthorizationDeniedProps
+});
+const NativeAuthorizationConnectedTelemetryEventSchema = Schema.Struct({
+	name: Schema.Literal("native_authorization_connected"),
+	props: NativeAuthorizationConnectedProps
+});
+const NativeAuthorizationFailedTelemetryEventSchema = Schema.Struct({
+	name: Schema.Literal("native_authorization_failed"),
+	props: NativeAuthorizationFailedProps
+});
+const OnboardingIntentSelectedTelemetryEventSchema = Schema.Struct({
+	name: Schema.Literal("onboarding_intent_selected"),
+	props: OnboardingIntentSelectedProps
+});
+const OnboardingProfileSubmittedTelemetryEventSchema = Schema.Struct({
+	name: Schema.Literal("onboarding_profile_submitted"),
+	props: OnboardingProfileSubmittedProps
+});
+const OnboardingOrganizationSubmittedTelemetryEventSchema = Schema.Struct({
+	name: Schema.Literal("onboarding_organization_submitted"),
+	props: OnboardingOrganizationSubmittedProps
+});
+const OnboardingDashboardReachedTelemetryEventSchema = Schema.Struct({
+	name: Schema.Literal("onboarding_dashboard_reached"),
+	props: OnboardingDashboardReachedProps
+});
+const ProvisioningSafeCreatedTelemetryEventSchema = Schema.Struct({
+	name: Schema.Literal("provisioning_safe_created"),
+	props: ProvisioningSafeCreatedProps
+});
+const ProvisioningSafeConfirmedTelemetryEventSchema = Schema.Struct({
+	name: Schema.Literal("provisioning_safe_confirmed"),
+	props: ProvisioningSafeConfirmedProps
+});
+const BootstrapResolvedTelemetryEventSchema = Schema.Struct({
+	name: Schema.Literal("bootstrap_resolved"),
+	props: BootstrapResolvedProps
+});
+const BootstrapFailedTelemetryEventSchema = Schema.Struct({
+	name: Schema.Literal("bootstrap_failed"),
+	props: BootstrapFailedProps
+});
+const MemberActivationStartedTelemetryEventSchema = Schema.Struct({
+	name: Schema.Literal("member_activation_started"),
+	props: MemberActivationStartedProps
+});
+const MemberActivationReadyTelemetryEventSchema = Schema.Struct({
+	name: Schema.Literal("member_activation_ready"),
+	props: MemberActivationReadyProps
+});
+const MemberActivationFailedTelemetryEventSchema = Schema.Struct({
+	name: Schema.Literal("member_activation_failed"),
+	props: MemberActivationFailedProps
+});
+const OrganizationCreationStartedTelemetryEventSchema = Schema.Struct({
+	name: Schema.Literal("organization_creation_started"),
+	props: OrganizationCreationStartedProps
+});
+const OrganizationCreationReadyTelemetryEventSchema = Schema.Struct({
+	name: Schema.Literal("organization_creation_ready"),
+	props: OrganizationCreationReadyProps
+});
+const OrganizationCreationFailedTelemetryEventSchema = Schema.Struct({
+	name: Schema.Literal("organization_creation_failed"),
+	props: OrganizationCreationFailedProps
+});
+const AccountBalanceReadTelemetryEventSchema = Schema.Struct({
+	name: Schema.Literal("account_balance_read"),
+	props: AccountBalanceReadProps
+});
+const AccountBalanceFailedTelemetryEventSchema = Schema.Struct({
+	name: Schema.Literal("account_balance_failed"),
+	props: AccountBalanceFailedProps
+});
+const FaucetRequestedTelemetryEventSchema = Schema.Struct({
+	name: Schema.Literal("faucet_requested"),
+	props: FaucetRequestedProps
+});
+const FaucetConfirmedTelemetryEventSchema = Schema.Struct({
+	name: Schema.Literal("faucet_confirmed"),
+	props: FaucetConfirmedProps
+});
+const FaucetFailedTelemetryEventSchema = Schema.Struct({
+	name: Schema.Literal("faucet_failed"),
+	props: FaucetFailedProps
+});
+const ChainUpstreamFallbackTelemetryEventSchema = Schema.Struct({
+	name: Schema.Literal("chain_upstream_fallback"),
+	props: ChainUpstreamFallbackProps
+});
+const BundlerErrorTelemetryEventSchema = Schema.Struct({
+	name: Schema.Literal("bundler_error"),
+	props: BundlerErrorProps
+});
+const ReceiptPendingTelemetryEventSchema = Schema.Struct({
+	name: Schema.Literal("receipt_pending"),
+	props: ReceiptPendingProps
+});
+const OperationRetriedTelemetryEventSchema = Schema.Struct({
+	name: Schema.Literal("operation_retried"),
+	props: OperationRetriedProps
+});
+const OrgCreateStartedTelemetryEventSchema = Schema.Struct({
+	name: Schema.Literal("org_create_started"),
+	props: OrgCreateStartedProps
+});
+const OrgSafeCreatedTelemetryEventSchema = Schema.Struct({
+	name: Schema.Literal("org_safe_created"),
+	props: OrgSafeCreatedProps
+});
+const OrgSafeConfirmedTelemetryEventSchema = Schema.Struct({
+	name: Schema.Literal("org_safe_confirmed"),
+	props: OrgSafeConfirmedProps
+});
+const OrgRolesSeededTelemetryEventSchema = Schema.Struct({
+	name: Schema.Literal("org_roles_seeded"),
+	props: OrgRolesSeededProps
+});
+const OrgCreatedTelemetryEventSchema = Schema.Struct({
+	name: Schema.Literal("org_created"),
+	props: OrgCreatedProps
+});
+const OrgCreateFailedTelemetryEventSchema = Schema.Struct({
+	name: Schema.Literal("org_create_failed"),
+	props: OrgCreateFailedProps
+});
+const OrgInviteSentTelemetryEventSchema = Schema.Struct({
+	name: Schema.Literal("org_invite_sent"),
+	props: OrgInviteSentProps
+});
+const OrgInviteAcceptedTelemetryEventSchema = Schema.Struct({
+	name: Schema.Literal("org_invite_accepted"),
+	props: OrgInviteAcceptedProps
+});
+const OrgInviteExpiredTelemetryEventSchema = Schema.Struct({
+	name: Schema.Literal("org_invite_expired"),
+	props: OrgInviteExpiredProps
+});
+const PaymentInitiatedTelemetryEventSchema = Schema.Struct({
+	name: Schema.Literal("payment_initiated"),
+	props: PaymentInitiatedProps
+});
+const PaymentSettledTelemetryEventSchema = Schema.Struct({
+	name: Schema.Literal("payment_settled"),
+	props: PaymentSettledL2Props
+});
+const PaymentFailedTelemetryEventSchema = Schema.Struct({
+	name: Schema.Literal("payment_failed"),
+	props: PaymentFailedL2Props
+});
+const PaymentVerificationRetryTelemetryEventSchema = Schema.Struct({
+	name: Schema.Literal("payment_verification_retry"),
+	props: PaymentVerificationRetryProps
+});
+const PaymentLifecycleTransitionTelemetryEventSchema = Schema.Struct({
+	name: Schema.Literal("payment_lifecycle_transition"),
+	props: PaymentLifecycleTransitionProps
+});
+const QuickPayExternalAddressAcknowledgedTelemetryEventSchema = Schema.Struct({
+	name: Schema.Literal("quick_pay_external_address_acknowledged"),
+	props: QuickPayExternalAddressAcknowledgedProps
+});
+const DepositInitiatedTelemetryEventSchema = Schema.Struct({
+	name: Schema.Literal("deposit_initiated"),
+	props: DepositInitiatedProps
+});
+const DepositSettledTelemetryEventSchema = Schema.Struct({
+	name: Schema.Literal("deposit_settled"),
+	props: DepositSettledProps
+});
+const PermissionMirrorVerificationTelemetryEventSchema = Schema.Struct({
+	name: Schema.Literal("permission_mirror_verification"),
+	props: PermissionMirrorVerificationProps
+});
+const MovementScanWindowTelemetryEventSchema = Schema.Struct({
+	name: Schema.Literal("movement_scan_window"),
+	props: MovementScanWindowProps
+});
+const MovementScanCheckpointTelemetryEventSchema = Schema.Struct({
+	name: Schema.Literal("movement_scan_checkpoint"),
+	props: MovementScanCheckpointProps
+});
+const MovementScanIncidentTelemetryEventSchema = Schema.Struct({
+	name: Schema.Literal("movement_scan_incident"),
+	props: MovementScanIncidentProps
+});
+const IndexerDriftCorrectedTelemetryEventSchema = Schema.Struct({
+	name: Schema.Literal("indexer_drift_corrected"),
+	props: IndexerDriftCorrectedProps
+});
+/** The one spelling of "whose scope did this happen in" across every surface. */
+const ScopeKindSchema = Schema.Literals(["account", "organization"]);
+const OptionalReasonCode = Schema.optional(Schema.Literals(CAPXUL_ERROR_CODES));
+const ActivityReferenceProps = {
+	reference_kind: Schema.Literals(["payment", "movement"]),
+	reference_id: Schema.String
+};
+const ActivityFilterProps = {
+	filter_kind: Schema.optional(Schema.Literals([
+		"all",
+		"payment",
+		"movement"
+	])),
+	filter_direction: Schema.optional(Schema.Literals([
+		"all",
+		"in",
+		"out",
+		"self"
+	])),
+	filter_status: Schema.optional(Schema.Array(Schema.Literals([
+		"pending",
+		"settling",
+		"unresolved",
+		"pending_claim",
+		"scheduled",
+		"streaming",
+		"settled",
+		"cancelled",
+		"failed"
+	])))
+};
+const ActivityActionProps = {
+	...TelemetryEnvelopeProps,
+	scope_kind: ScopeKindSchema,
+	reason_code: OptionalReasonCode
+};
+const ContactRelationshipChangedTelemetryEventSchema = Schema.Struct({
+	name: Schema.Literal("contact_relationship_changed"),
+	props: Schema.Struct({
+		...TelemetryEnvelopeProps,
+		change: Schema.Literals([
+			"added",
+			"renamed",
+			"hidden",
+			"restored"
+		]),
+		scope_kind: ScopeKindSchema,
+		scope_id: Schema.String,
+		owner_party_id: Schema.String,
+		party_id: Schema.String,
+		hidden: Schema.Boolean,
+		occurred_at: Schema.Number,
+		operation: Schema.Literals([
+			CAPXUL_OPERATIONS.addressBook.add,
+			CAPXUL_OPERATIONS.addressBook.label,
+			CAPXUL_OPERATIONS.addressBook.hide,
+			CAPXUL_OPERATIONS.addressBook.unhide
+		])
+	})
+});
+const ContactActionProps = {
+	...TelemetryEnvelopeProps,
+	scope_kind: ScopeKindSchema,
+	party_id: OptionalString,
+	reason_code: OptionalReasonCode
+};
+/** One completed online CLI diagnostic. No command input or provider text. */
+const CLI_COMMAND_NAMES = [
+	"capxul",
+	"doctor",
+	"telemetry",
+	"telemetry.status",
+	"telemetry.enable",
+	"telemetry.disable",
+	"auth",
+	"auth.login",
+	"auth.signup",
+	"auth.send",
+	"auth.verify",
+	"auth.profile",
+	"auth.status",
+	"auth.logout",
+	"contact",
+	"contact.list",
+	"contact.get",
+	"contact.add",
+	"contact.label",
+	"contact.hide",
+	"contact.unhide",
+	"org",
+	CAPXUL_OPERATIONS.org.list,
+	"org.use",
+	"org.status",
+	CAPXUL_OPERATIONS.org.me,
+	CAPXUL_OPERATIONS.org.members,
+	"org.member",
+	"org.member.get",
+	"org.member.invite",
+	"org.contact",
+	"org.contact.list",
+	"org.contact.get",
+	"org.contact.add",
+	"org.contact.label",
+	"org.contact.hide",
+	"org.contact.unhide",
+	CAPXUL_OPERATIONS.org.invite,
+	"org.invite.list",
+	"org.invite.get",
+	"org.invite.wait",
+	"org.invite.review",
+	"org.invite.accept",
+	"org.invite.decline",
+	"org.invite.cancel",
+	"org.invite.resend",
+	"org.invite.retry",
+	"org.wait",
+	CAPXUL_OPERATIONS.org.create,
+	CAPXUL_OPERATIONS.org.retry,
+	"unknown"
+];
+const CLI_CAPABILITIES = [
+	"cli",
+	"diagnostics",
+	"collection",
+	"authentication",
+	"organization",
+	"contacts"
+];
+const CLI_INVOCATION_KINDS = [
+	"command",
+	"help",
+	"version",
+	"completion",
+	"parse_refusal",
+	"collection_control"
+];
+const CliRelease = Schema.String.check(Schema.isPattern(/^[A-Za-z0-9][A-Za-z0-9._+-]{0,127}$/u));
+const CliInvocationProps = {
+	...TelemetryEnvelopeProps,
+	schema_version: Schema.Literal(1),
+	command: Schema.Literals(CLI_COMMAND_NAMES),
+	capability: Schema.Literals(CLI_CAPABILITIES),
+	invocation_kind: Schema.Literals(CLI_INVOCATION_KINDS),
+	invocation_id: Schema.String.check(Schema.isPattern(/^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/u)),
+	cli_identity_kind: Schema.optional(Schema.Literals(["anonymous", "identified"])),
+	anonymous_id: Schema.optional(Schema.String.check(Schema.isPattern(/^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/u))),
+	auth_user_id: Schema.optional(Schema.String.check(Schema.isPattern(/^[^\s]{1,256}$/u))),
+	occurred_at: Schema.Number,
+	cli_version: CliRelease,
+	sdk_version: CliRelease,
+	release: CliRelease,
+	platform: Schema.Literals([
+		"darwin",
+		"linux",
+		"unknown"
+	]),
+	architecture: Schema.Literals([
+		"arm64",
+		"x64",
+		"unknown"
+	]),
+	ci: Schema.Boolean,
+	tty: Schema.Boolean,
+	output_mode: Schema.Literals(["human", "json"])
+};
+const CliFirstUsedTelemetryEventSchema = Schema.Struct({
+	name: Schema.Literal("cli_first_used"),
+	props: Schema.Struct(CliInvocationProps)
+});
+const CliCommandStartedTelemetryEventSchema = Schema.Struct({
+	name: Schema.Literal("cli_command_started"),
+	props: Schema.Struct({
+		...CliInvocationProps,
+		invocation_kind: Schema.Literals([
+			"command",
+			"help",
+			"version"
+		])
+	})
+});
+const CliCommandCompletedTelemetryEventSchema = Schema.Struct({
+	name: Schema.Literal("cli_command_completed"),
+	props: Schema.Struct({
+		...CliInvocationProps,
+		outcome: Schema.Literals([
+			"succeeded",
+			"refused",
+			"failed",
+			"cancelled"
+		]),
+		duration_ms: Schema.Number,
+		organization_id: Schema.optional(OrgIdTelemetrySchema),
+		setup_status: Schema.optional(Schema.Literals(ORGANIZATION_SETUP_STATUSES)),
+		setup_reason: Schema.optional(Schema.Literals(ORGANIZATION_SETUP_REASONS)),
+		$groups: Schema.optional(Schema.Struct({ organization: OrgIdTelemetrySchema })),
+		error_code: Schema.optional(Schema.Literals([
+			...CAPXUL_ERROR_CODES,
+			"CLI_USAGE",
+			"CLI_CONFIG",
+			"CLI_STORAGE",
+			"CLI_DEFECT",
+			"CLI_DEADLINE"
+		]))
+	})
+});
+const CliDiagnosticCompletedTelemetryEventSchema = Schema.Struct({
+	name: Schema.Literal("cli_diagnostic_completed"),
+	props: Schema.Struct({
+		...TelemetryEnvelopeProps,
+		outcome: Schema.Literals([
+			"succeeded",
+			"refused",
+			"failed",
+			"cancelled"
+		]),
+		invocation_id: Schema.String.check(Schema.isPattern(/^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/u)),
+		cli_version: Schema.String.check(Schema.isPattern(/^[A-Za-z0-9][A-Za-z0-9._+-]{0,127}$/u))
+	})
+});
+const UiContactActionCompletedTelemetryEventSchema = Schema.Struct({
+	name: Schema.Literal("ui_contact_action_completed"),
+	props: Schema.Union([
+		Schema.Struct({
+			...ContactActionProps,
+			action: Schema.Literal("add"),
+			outcome: Schema.Literals(["opened", "cancelled"])
+		}),
+		Schema.Struct({
+			...ContactActionProps,
+			action: Schema.Literal("refusal"),
+			outcome: Schema.Literal("displayed")
+		}),
+		Schema.Struct({
+			...ContactActionProps,
+			action: Schema.Literal("retry"),
+			outcome: Schema.Literal("requested")
+		})
+	])
+});
+const ActivityAnnotationSavedTelemetryEventSchema = Schema.Struct({
+	name: Schema.Literal("activity_annotation_saved"),
+	props: Schema.Struct({
+		...TelemetryEnvelopeProps,
+		...ActivityReferenceProps,
+		scope_kind: ScopeKindSchema,
+		scope_id: Schema.String,
+		occurred_at: Schema.Number
+	})
+});
+const UiActivityActionCompletedTelemetryEventSchema = Schema.Struct({
+	name: Schema.Literal("ui_activity_action_completed"),
+	props: Schema.Union([
+		Schema.Struct({
+			...ActivityActionProps,
+			action: Schema.Literal("read"),
+			outcome: Schema.Literals(["partial_displayed", "recovered"]),
+			surface: Schema.Literals([
+				"transactions",
+				"recent",
+				"summary"
+			])
+		}),
+		Schema.Struct({
+			...ActivityActionProps,
+			...ActivityFilterProps,
+			action: Schema.Literal("filter"),
+			outcome: Schema.Literal("committed")
+		}),
+		Schema.Struct({
+			...ActivityActionProps,
+			action: Schema.Literal("refusal"),
+			outcome: Schema.Literal("displayed")
+		}),
+		Schema.Struct({
+			...ActivityActionProps,
+			action: Schema.Literal("retry"),
+			outcome: Schema.Literal("requested")
+		}),
+		Schema.Struct({
+			...ActivityActionProps,
+			...ActivityReferenceProps,
+			action: Schema.Literal("detail"),
+			outcome: Schema.Literals(["opened", "failed"])
+		}),
+		Schema.Struct({
+			...ActivityActionProps,
+			...ActivityReferenceProps,
+			action: Schema.Literal("receipt"),
+			outcome: Schema.Literals([
+				"document_rendered",
+				"explorer_opened",
+				"popup_blocked",
+				"failed"
+			])
+		}),
+		Schema.Struct({
+			...ActivityActionProps,
+			...ActivityFilterProps,
+			action: Schema.Literal("export"),
+			outcome: Schema.Literals([
+				"completed",
+				"partial",
+				"failed"
+			]),
+			row_count: Schema.optional(Schema.Number),
+			truncated: Schema.optional(Schema.Boolean)
+		})
+	])
+});
+/**
+* Reliability closeout (#1960 R02) — the shape every explicit UI observation
+* below shares. `scope_kind` says whose surface the person was looking at,
+* `organization_id` is the verified Organization the producer resolved (absent
+* on a personal action), and `reason_code` is a catalog error code, never copy.
+*/
+const UiStepProps = {
+	...TelemetryEnvelopeProps,
+	scope_kind: ScopeKindSchema,
+	organization_id: OptionalOrgId,
+	reason_code: OptionalReasonCode
+};
+const AccessRecoveryCompletedProps = Schema.Union([Schema.Struct({
+	...TelemetryEnvelopeProps,
+	recovery: Schema.Literal("session_restoration"),
+	outcome: Schema.Literals([
+		"restored",
+		"absent",
+		"failed"
+	]),
+	reason_code: OptionalReasonCode,
+	organization_id: OptionalOrgId
+}), Schema.Struct({
+	...TelemetryEnvelopeProps,
+	recovery: Schema.Literal("signer_readiness"),
+	outcome: Schema.Literals(["ready", "unavailable"]),
+	reason_code: OptionalReasonCode,
+	organization_id: OptionalOrgId
+})]);
+const AccessRecoveryCompletedTelemetryEventSchema = Schema.Struct({
+	name: Schema.Literal("access_recovery_completed"),
+	props: AccessRecoveryCompletedProps
+});
+/**
+* R05 (#1963) wired three of these steps at the app's dashboard Access
+* boundary: `dashboard_granted` on the commit of the granted content,
+* `gate_error_displayed` on the mounted error surface, and `retry_selected` on
+* the actual selection. `redirect_completed` stays RESERVED and unproduced —
+* asking for a navigation is not arriving, and the destination page's own
+* normalized pageview already carries the arrival on the same journey, so a
+* second event would add no fact. `capability_refusal_displayed` and
+* `signer_refusal_displayed` belong to the screens that draw those refusals
+* (Recipients, Invoice, Payroll, Quick Pay); Access publishes the contract and
+* the `CanReason` those owners report, and produces neither itself.
+*/
+const UiAccessStepCompletedTelemetryEventSchema = Schema.Struct({
+	name: Schema.Literal("ui_access_step_completed"),
+	props: Schema.Struct({
+		...UiStepProps,
+		step: Schema.Literals([
+			"dashboard_granted",
+			"redirect_completed",
+			"gate_error_displayed",
+			"retry_selected",
+			"capability_refusal_displayed",
+			"signer_refusal_displayed"
+		]),
+		capability: Schema.optional(Schema.Literals(["spend", "managePeople"])),
+		probe: Schema.optional(Schema.Literals([
+			"session",
+			"membership",
+			"lifecycle"
+		])),
+		reason: Schema.optional(Schema.Literals([
+			"loading",
+			"no-permission",
+			"org-unavailable"
+		]))
+	})
+});
+/**
+* R06 (#1964) wired three of the four progress words to the durable writer that
+* commits each one. `account_ready` comes from `org/memberLifecycle.ts`, for
+* every membership row a claimed personal Account actually advanced.
+* `permission_applied` and `membership_activated` come from
+* `permission/mirror.ts`: the first only when the mirror wrote a NEW Permission
+* state, the second only when that call flipped a `pending_grant` row to
+* `active`. A replay of an applied command writes neither, so it reports
+* neither. `revoked` stays RESERVED and unproduced — no writer revokes a
+* membership yet, and #1459 owns that ceremony.
+*/
+const OrgInviteProgressedTelemetryEventSchema = Schema.Struct({
+	name: Schema.Literal("org_invite_progressed"),
+	props: Schema.Struct({
+		...TelemetryEnvelopeProps,
+		organization_id: OrgIdTelemetrySchema,
+		progress: Schema.Literals([
+			"configuration_authorized",
+			"account_ready",
+			"permission_applied",
+			"membership_activated",
+			"revoked"
+		]),
+		/** The invited Party. The initiating actor stays on the envelope's identity. */
+		member_party_id: Schema.String,
+		invitation_id: Schema.optional(Schema.String),
+		generation: Schema.optional(Schema.String),
+		command_id: Schema.optional(Schema.String),
+		occurred_at: Schema.Number
+	})
+});
+const InvoiceIssuedTelemetryEventSchema = Schema.Struct({
+	name: Schema.Literal("invoice_issued"),
+	props: Schema.Struct({
+		...TelemetryEnvelopeProps,
+		request_id: Schema.String,
+		issuer_scope_kind: ScopeKindSchema,
+		issuer_scope_id: Schema.String,
+		payer_party_id: OptionalString,
+		occurred_at: Schema.Number
+	})
+});
+const InvoiceRequestTransitionedTelemetryEventSchema = Schema.Struct({
+	name: Schema.Literal("invoice_request_transitioned"),
+	props: Schema.Struct({
+		...TelemetryEnvelopeProps,
+		request_id: Schema.String,
+		transition: Schema.Literals([
+			"approval_prepared",
+			"declined",
+			"cancelled"
+		]),
+		actor_scope_kind: ScopeKindSchema,
+		actor_scope_id: Schema.String,
+		occurred_at: Schema.Number
+	})
+});
+const UiInvoiceStepCompletedTelemetryEventSchema = Schema.Struct({
+	name: Schema.Literal("ui_invoice_step_completed"),
+	props: Schema.Struct({
+		...UiStepProps,
+		step: Schema.Literals([
+			"opened",
+			"previewed",
+			"dismissed",
+			"submitted",
+			"result_displayed",
+			"refusal_displayed",
+			"retry_selected"
+		]),
+		request_id: OptionalString
+	})
+});
+const UiTreasuryStepCompletedTelemetryEventSchema = Schema.Struct({
+	name: Schema.Literal("ui_treasury_step_completed"),
+	props: Schema.Struct({
+		...UiStepProps,
+		step: Schema.Literals([
+			"balance_displayed",
+			"read_refusal_displayed",
+			"retry_selected",
+			"recovery_completed"
+		]),
+		account_kind: Schema.optional(AccountKindSchema)
+	})
+});
+const UiReceiveStepCompletedTelemetryEventSchema = Schema.Struct({
+	name: Schema.Literal("ui_receive_step_completed"),
+	props: Schema.Struct({
+		...UiStepProps,
+		step: Schema.Literals([
+			"instructions_displayed",
+			"address_copied",
+			"copy_failed",
+			"refusal_displayed",
+			"retry_selected"
+		]),
+		account_kind: Schema.optional(AccountKindSchema)
+	})
+});
+const PayrollGroupChangedTelemetryEventSchema = Schema.Struct({
+	name: Schema.Literal("payroll_group_changed"),
+	props: Schema.Struct({
+		...TelemetryEnvelopeProps,
+		organization_id: OrgIdTelemetrySchema,
+		change: Schema.Literals([
+			"created",
+			"updated",
+			"deleted"
+		]),
+		group_id: Schema.String,
+		member_count: Schema.Number,
+		occurred_at: Schema.Number
+	})
+});
+const PayrollRunTransitionedTelemetryEventSchema = Schema.Struct({
+	name: Schema.Literal("payroll_run_transitioned"),
+	props: Schema.Struct({
+		...TelemetryEnvelopeProps,
+		organization_id: OrgIdTelemetrySchema,
+		transition: Schema.Literals([
+			"prepared",
+			"authorized",
+			"settled"
+		]),
+		run_id: Schema.String,
+		/**
+		* The `paymentCommands` row at `payrollRuns.batchRef` — the durable owner of
+		* this run's Payment membership. `payment_count` counts THAT command's
+		* `paymentIds`, so an unrelated Payment quoting the run id changes neither.
+		*/
+		command_id: OptionalString,
+		payment_count: Schema.optional(Schema.Number),
+		occurred_at: Schema.Number
+	})
+});
+const UiPayrollActionCompletedTelemetryEventSchema = Schema.Struct({
+	name: Schema.Literal("ui_payroll_action_completed"),
+	props: Schema.Struct({
+		...UiStepProps,
+		action: Schema.Literals([
+			"opened",
+			"refusal_displayed",
+			"recovery_completed",
+			"cancelled",
+			"submitted_displayed"
+		]),
+		run_id: OptionalString
+	})
+});
+const TELEMETRY_EVENT_SCHEMAS = {
+	contact_relationship_changed: ContactRelationshipChangedTelemetryEventSchema,
+	access_recovery_completed: AccessRecoveryCompletedTelemetryEventSchema,
+	ui_access_step_completed: UiAccessStepCompletedTelemetryEventSchema,
+	org_invite_progressed: OrgInviteProgressedTelemetryEventSchema,
+	invoice_issued: InvoiceIssuedTelemetryEventSchema,
+	invoice_request_transitioned: InvoiceRequestTransitionedTelemetryEventSchema,
+	ui_invoice_step_completed: UiInvoiceStepCompletedTelemetryEventSchema,
+	ui_treasury_step_completed: UiTreasuryStepCompletedTelemetryEventSchema,
+	ui_receive_step_completed: UiReceiveStepCompletedTelemetryEventSchema,
+	payroll_group_changed: PayrollGroupChangedTelemetryEventSchema,
+	payroll_run_transitioned: PayrollRunTransitionedTelemetryEventSchema,
+	ui_payroll_action_completed: UiPayrollActionCompletedTelemetryEventSchema,
+	ui_contact_action_completed: UiContactActionCompletedTelemetryEventSchema,
+	cli_diagnostic_completed: CliDiagnosticCompletedTelemetryEventSchema,
+	cli_first_used: CliFirstUsedTelemetryEventSchema,
+	cli_command_started: CliCommandStartedTelemetryEventSchema,
+	cli_command_completed: CliCommandCompletedTelemetryEventSchema,
+	activity_annotation_saved: ActivityAnnotationSavedTelemetryEventSchema,
+	ui_activity_action_completed: UiActivityActionCompletedTelemetryEventSchema,
+	auth_otp_requested: AuthOtpRequestedTelemetryEventSchema,
+	auth_otp_delivered: AuthOtpDeliveredTelemetryEventSchema,
+	auth_otp_expired: AuthOtpExpiredTelemetryEventSchema,
+	auth_verified: AuthVerifiedTelemetryEventSchema,
+	auth_failed: AuthFailedTelemetryEventSchema,
+	identity_refused: IdentityRefusedTelemetryEventSchema,
+	auth_signed_out: AuthSignedOutTelemetryEventSchema,
+	native_authorization_started: NativeAuthorizationStartedTelemetryEventSchema,
+	native_authorization_reviewed: NativeAuthorizationReviewedTelemetryEventSchema,
+	native_authorization_accepted: NativeAuthorizationAcceptedTelemetryEventSchema,
+	native_authorization_denied: NativeAuthorizationDeniedTelemetryEventSchema,
+	native_authorization_connected: NativeAuthorizationConnectedTelemetryEventSchema,
+	native_authorization_failed: NativeAuthorizationFailedTelemetryEventSchema,
+	onboarding_intent_selected: OnboardingIntentSelectedTelemetryEventSchema,
+	onboarding_profile_submitted: OnboardingProfileSubmittedTelemetryEventSchema,
+	onboarding_organization_submitted: OnboardingOrganizationSubmittedTelemetryEventSchema,
+	onboarding_dashboard_reached: OnboardingDashboardReachedTelemetryEventSchema,
+	provisioning_safe_created: ProvisioningSafeCreatedTelemetryEventSchema,
+	provisioning_safe_confirmed: ProvisioningSafeConfirmedTelemetryEventSchema,
+	bootstrap_resolved: BootstrapResolvedTelemetryEventSchema,
+	bootstrap_failed: BootstrapFailedTelemetryEventSchema,
+	member_activation_started: MemberActivationStartedTelemetryEventSchema,
+	member_activation_ready: MemberActivationReadyTelemetryEventSchema,
+	member_activation_failed: MemberActivationFailedTelemetryEventSchema,
+	organization_creation_started: OrganizationCreationStartedTelemetryEventSchema,
+	organization_creation_ready: OrganizationCreationReadyTelemetryEventSchema,
+	organization_creation_failed: OrganizationCreationFailedTelemetryEventSchema,
+	account_balance_read: AccountBalanceReadTelemetryEventSchema,
+	account_balance_failed: AccountBalanceFailedTelemetryEventSchema,
+	faucet_requested: FaucetRequestedTelemetryEventSchema,
+	faucet_confirmed: FaucetConfirmedTelemetryEventSchema,
+	faucet_failed: FaucetFailedTelemetryEventSchema,
+	chain_upstream_fallback: ChainUpstreamFallbackTelemetryEventSchema,
+	bundler_error: BundlerErrorTelemetryEventSchema,
+	receipt_pending: ReceiptPendingTelemetryEventSchema,
+	operation_retried: OperationRetriedTelemetryEventSchema,
+	org_create_started: OrgCreateStartedTelemetryEventSchema,
+	org_safe_created: OrgSafeCreatedTelemetryEventSchema,
+	org_safe_confirmed: OrgSafeConfirmedTelemetryEventSchema,
+	org_roles_seeded: OrgRolesSeededTelemetryEventSchema,
+	org_created: OrgCreatedTelemetryEventSchema,
+	org_create_failed: OrgCreateFailedTelemetryEventSchema,
+	org_invite_sent: OrgInviteSentTelemetryEventSchema,
+	org_invite_accepted: OrgInviteAcceptedTelemetryEventSchema,
+	org_invite_expired: OrgInviteExpiredTelemetryEventSchema,
+	payment_initiated: PaymentInitiatedTelemetryEventSchema,
+	payment_settled: PaymentSettledTelemetryEventSchema,
+	payment_failed: PaymentFailedTelemetryEventSchema,
+	payment_verification_retry: PaymentVerificationRetryTelemetryEventSchema,
+	payment_lifecycle_transition: PaymentLifecycleTransitionTelemetryEventSchema,
+	quick_pay_external_address_acknowledged: QuickPayExternalAddressAcknowledgedTelemetryEventSchema,
+	deposit_initiated: DepositInitiatedTelemetryEventSchema,
+	deposit_settled: DepositSettledTelemetryEventSchema,
+	permission_mirror_verification: PermissionMirrorVerificationTelemetryEventSchema,
+	movement_scan_window: MovementScanWindowTelemetryEventSchema,
+	movement_scan_checkpoint: MovementScanCheckpointTelemetryEventSchema,
+	movement_scan_incident: MovementScanIncidentTelemetryEventSchema,
+	indexer_drift_corrected: IndexerDriftCorrectedTelemetryEventSchema
+};
+const FINANCIAL_OPS_TARGET_TELEMETRY_PRODUCERS = [];
+/**
+* Contract-first events whose producer is owned by a later domain node.
+*
+* A domain node removes its entry when it adds the producer. The telemetry
+* gate rejects an entry that has a producer.
+*/
+const CONTRACT_FIRST_TELEMETRY_EVENTS = [];
+/**
+* Catalog events whose product mapper remains gated on the #1150 frontend
+* adoption. L1 S1 removes their retired SDK-flow producers without inventing
+* replacements inside the identity actor. The telemetry-spine gate enforces
+* planned-XOR-wired: a name must leave this list in the same change that adds
+* its real product-boundary producer.
+*/
+const PRODUCT_MAPPER_GATED_TELEMETRY_EVENTS = ["auth_otp_expired"];
+/** Catalogued browser observations whose producers remain owned by app adoption. */
+const BROWSER_GATED_TELEMETRY_EVENTS = [
+	"onboarding_intent_selected",
+	"onboarding_profile_submitted",
+	"onboarding_organization_submitted",
+	"onboarding_dashboard_reached",
+	"ui_activity_action_completed",
+	"ui_contact_action_completed",
+	"ui_access_step_completed",
+	"ui_invoice_step_completed",
+	"ui_treasury_step_completed",
+	"ui_receive_step_completed",
+	"ui_payroll_action_completed"
+];
+let trackHandler = () => {};
+function setTrackHandler(handler) {
+	const previous = trackHandler;
+	trackHandler = handler;
+	return previous;
+}
+function getTrackHandler() {
+	return trackHandler;
+}
+function track(name, props) {
+	trackHandler(name, props);
+}
+function redactTelemetryEvent(event, options = {}) {
+	const props = redactTelemetryProps(event.name, event.props, options);
+	return props === void 0 ? { name: event.name } : {
+		name: event.name,
+		props
+	};
+}
+function redactTelemetryProps(name, props, options = {}) {
+	if (props === void 0) return void 0;
+	const clone = cloneProps(props);
+	if (options.rawMode === true) return clone;
+	for (const key of PII_PROP_KEYS_BY_EVENT[name] ?? []) redactProperty(clone, key);
+	return clone;
+}
+/**
+* Remove query strings and fragments from every PostHog URL/referrer/path
+* property before transport. Browser applications may carry emails, draft ids,
+* or other capabilities in the URL; those values must never leave the origin.
+*
+* The callback replaces the event's data with a sanitized copy. Nested values
+* can refer to live clients or configuration; observation must never mutate them.
+*/
+function sanitizePostHogBrowserEvent(event, urlPolicy = "path-only") {
+	if (event === null) return event;
+	const transportToken = event.properties.token;
+	const seen = /* @__PURE__ */ new WeakMap();
+	event.properties = sanitizePostHogBrowserValue(event.properties, seen, urlPolicy);
+	if (transportToken !== void 0) event.properties.token = transportToken;
+	if (event.$set !== void 0) event.$set = sanitizePostHogBrowserValue(event.$set, seen, urlPolicy);
+	if (event.$set_once !== void 0) event.$set_once = sanitizePostHogBrowserValue(event.$set_once, seen, urlPolicy);
+	return event;
+}
+/**
+* Drop local events before transport. Sanitize and stamp every other browser
+* event with `capxul_env` and `producer: "browser"`.
+*/
+function createCapxulBeforeSend(capxulEnv, urlPolicy = "path-only") {
+	return (event) => {
+		if (capxulEnv === "local") return null;
+		const sanitized = sanitizePostHogBrowserEvent(event, urlPolicy);
+		if (sanitized === null) return sanitized;
+		sanitized.properties.capxul_env = capxulEnv;
+		sanitized.properties.producer ??= "browser";
+		return sanitized;
+	};
+}
+function utilityAppAnalytics(input) {
+	return {
+		api_host: input.host,
+		defaults: "2026-01-30",
+		autocapture: false,
+		capture_pageview: false,
+		capture_pageleave: true,
+		disable_session_recording: true,
+		disable_persistence: true,
+		capture_heatmaps: false,
+		capture_exceptions: false,
+		capture_performance: false,
+		disable_surveys: true,
+		disable_web_experiments: true,
+		disable_product_tours: true,
+		disable_conversations: true,
+		disable_external_dependency_loading: true,
+		person_profiles: "identified_only",
+		advanced_disable_flags: true,
+		save_campaign_params: false,
+		save_referrer: false,
+		before_send: createCapxulBeforeSend(input.capxulEnv)
+	};
+}
+/** In unstructured bodies, preserve text around explicitly named credentials. */
+const NETWORK_FIELD = /((?:"?)([A-Za-z_][A-Za-z0-9_.-]*)(?:"?)\s*[:=]\s*)("(?:[^"\\]|\\.)*"|'(?:[^'\\]|\\.)*'|[^\s,;&}]+)/gu;
+function maskNetworkText(text, context) {
+	return redactSecrets(text).replace(NETWORK_FIELD, (whole, prefix, name, value) => {
+		if (!isCredentialField(name, context)) return whole;
+		const quote = value.startsWith("\"") ? "\"" : value.startsWith("'") ? "'" : "";
+		return `${prefix}${quote}[REDACTED]${quote}`;
+	});
+}
+function maskNetworkHeaders(headers) {
+	if (headers === void 0) return void 0;
+	const masked = {};
+	for (const [name, value] of Object.entries(headers)) masked[name] = isCredentialField(name, "header") ? "[REDACTED]" : /^(?:location|content-location|referer)$/iu.test(name) ? redactUrlSecrets(value) : maskNetworkText(value);
+	return masked;
+}
+function maskJsonValue(value, depth = 0, context) {
+	if (typeof value === "function" || typeof value === "symbol") return "[UNREADABLE]";
+	if (typeof value === "string") return maskNetworkText(value, context);
+	if (typeof value !== "object" || value === null) return value;
+	if (depth >= 16) return "[REDACTED]";
+	if (Array.isArray(value)) return value.map((item) => maskJsonValue(item, depth + 1, context));
+	const masked = Object.create(null);
+	for (const [key, descriptor] of Object.entries(Object.getOwnPropertyDescriptors(value))) {
+		if (!descriptor.enumerable) continue;
+		masked[key] = isCredentialField(key, context) ? "[REDACTED]" : !("value" in descriptor) ? "[UNREADABLE]" : typeof descriptor.value === "string" && isPostHogUrlProperty(key) ? redactUrlSecrets(descriptor.value) : maskJsonValue(descriptor.value, depth + 1, context);
+	}
+	return masked;
+}
+function maskNetworkBody(body, context) {
+	try {
+		if (typeof body !== "string") return maskJsonValue(body, 0, context);
+		let parsed;
+		try {
+			parsed = JSON.parse(body);
+		} catch {
+			if (/^[^=&\s]+=[\s\S]*$/u.test(body)) return new URLSearchParams(Array.from(new URLSearchParams(body), ([name, value]) => [name, isCredentialField(name, context) ? "[REDACTED]" : maskNetworkText(value)])).toString();
+			return maskNetworkText(body, context);
+		}
+		return JSON.stringify(maskJsonValue(parsed, 0, context));
+	} catch {
+		return "[UNREADABLE]";
+	}
+}
+/** Keep request evidence while masking credential values at the browser boundary. */
+function maskCapturedNetworkRequest(request) {
+	const requestUrl = request.name ?? request.url ?? "";
+	let context;
+	try {
+		const path = new URL(requestUrl, "https://capxul.invalid").pathname;
+		if (/\/(?:auth|oauth|sign-in|signin|login|verify-otp|verify-email)(?:\/|$)/iu.test(path)) context = "authentication";
+	} catch {}
+	return {
+		...request,
+		...request.name === void 0 ? {} : { name: redactUrlSecrets(request.name) },
+		...request.url === void 0 ? {} : { url: redactUrlSecrets(request.url) },
+		requestHeaders: maskNetworkHeaders(request.requestHeaders),
+		responseHeaders: maskNetworkHeaders(request.responseHeaders),
+		requestBody: maskNetworkBody(request.requestBody, context),
+		responseBody: maskNetworkBody(request.responseBody)
+	};
+}
+function productAppAnalytics(input) {
+	return {
+		api_host: input.host,
+		defaults: "2026-01-30",
+		autocapture: false,
+		capture_pageview: false,
+		capture_pageleave: true,
+		disable_session_recording: false,
+		disable_persistence: false,
+		capture_heatmaps: false,
+		capture_exceptions: true,
+		capture_performance: {
+			network_timing: true,
+			web_vitals: false
+		},
+		disable_surveys: true,
+		disable_web_experiments: true,
+		disable_product_tours: true,
+		disable_conversations: true,
+		disable_external_dependency_loading: false,
+		person_profiles: "identified_only",
+		advanced_disable_flags: false,
+		save_campaign_params: false,
+		save_referrer: false,
+		session_recording: {
+			maskAllInputs: true,
+			maskInputFn: (text, element) => {
+				const autocomplete = element?.getAttribute("autocomplete")?.toLowerCase().split(/\s+/u) ?? [];
+				return element?.getAttribute("type")?.toLowerCase() === "password" || autocomplete.some((value) => [
+					"one-time-code",
+					"current-password",
+					"new-password"
+				].includes(value)) || isCredentialField(element?.getAttribute("name") ?? "") || isCredentialField(element?.getAttribute("id") ?? "") ? "*".repeat(text.length) : maskNetworkText(text);
+			},
+			captureCanvas: { recordCanvas: false },
+			recordHeaders: true,
+			recordBody: true,
+			maskCapturedNetworkRequestFn: maskCapturedNetworkRequest
+		},
+		before_send: createCapxulBeforeSend(input.capxulEnv, "diagnostic")
+	};
+}
+/**
+* Apply a named privacy profile before an application-owned PostHog client
+* initializes. Hosts still own the vendor client and lifecycle; this helper
+* centralizes the security-relevant options and the missing-key opt-out (no
+* key ⇒ no client ⇒ no network call).
+*/
+function initializeCapxulBrowserAnalytics(profile, input, initialize) {
+	const key = input.key?.trim();
+	if (key === void 0 || key.length === 0) return void 0;
+	try {
+		const options = profile(input);
+		const client = initialize(key, options);
+		warnWhenReplayHasNoRecorder(options, client);
+		return client;
+	} catch {
+		return;
+	}
+}
+let replayRecorderWarned = false;
+/**
+* #1709: `posthog-js/dist/module.slim` never registers the session recording
+* manager, so a profile that enables replay records nothing with it. The
+* client exposes the manager as `sessionRecording` once `init` ran on the
+* standard build. Warn once per page so the missing build is visible.
+*/
+function warnWhenReplayHasNoRecorder(options, client) {
+	if (replayRecorderWarned) return;
+	const replayEnabled = typeof options === "object" && options !== null && options.disable_session_recording === false;
+	const recorderMissing = typeof client === "object" && client !== null && client.sessionRecording === void 0;
+	if (!replayEnabled || !recorderMissing) return;
+	replayRecorderWarned = true;
+	console.warn("@capxul/observability: session replay is enabled but the PostHog client has no session recording manager. Import the standard `posthog-js` build; `posthog-js/dist/module.slim` records nothing.");
+}
+/** The utility profile, pre-bound — the shape ADR-0016's consumers already use. */
+function initializePostHogBrowserAnalytics(input, initialize) {
+	return initializeCapxulBrowserAnalytics(utilityAppAnalytics, input, initialize);
+}
+/**
+* Build an explicit SPA pageview sink for toolbar-free PostHog clients. The
+* pathname-only input avoids query capabilities, repeated pathnames are
+* deduplicated, and vendor failures remain best-effort.
+*/
+function createPostHogBrowserPageviewTracker(client) {
+	let previousPathname;
+	return (pathname) => {
+		if (client === null || client === void 0) return;
+		const safePathname = stripUrlQueryAndFragment(pathname);
+		if (safePathname === previousPathname) return;
+		try {
+			Promise.resolve(client.capture("$pageview", { $pathname: safePathname })).catch(() => {});
+			previousPathname = safePathname;
+		} catch {}
+	};
+}
+function sanitizePostHogBrowserValue(value, seen, urlPolicy) {
+	if (typeof value !== "object" || value === null || value instanceof Date) return value;
+	if (seen.has(value)) return seen.get(value);
+	if (Array.isArray(value)) {
+		const copy = [];
+		seen.set(value, copy);
+		for (let index = 0; index < value.length; index++) {
+			const item = value[index];
+			copy[index] = typeof item === "string" ? maskNetworkText(item) : sanitizePostHogBrowserValue(item, seen, urlPolicy);
+		}
+		return copy;
+	}
+	const properties = Object.create(null);
+	seen.set(value, properties);
+	for (const [key, nestedValue] of Object.entries(value)) {
+		if (isPostHogQueryDerivedProperty(key)) continue;
+		if (isCredentialField(key)) {
+			properties[key] = "[REDACTED]";
+			continue;
+		}
+		if (typeof nestedValue === "string") {
+			properties[key] = isPostHogUrlProperty(key) ? urlPolicy === "path-only" ? stripUrlQueryAndFragment(nestedValue) : redactUrlSecrets(nestedValue) : maskNetworkText(nestedValue);
+			continue;
+		}
+		properties[key] = sanitizePostHogBrowserValue(nestedValue, seen, urlPolicy);
+	}
+	return properties;
+}
+const POSTHOG_QUERY_DERIVED_PROPERTY_NAMES = [
+	"utm_source",
+	"utm_medium",
+	"utm_campaign",
+	"utm_content",
+	"utm_term",
+	"gad_source",
+	"mc_cid",
+	"gclid",
+	"gclsrc",
+	"dclid",
+	"gbraid",
+	"wbraid",
+	"fbclid",
+	"msclkid",
+	"twclid",
+	"li_fat_id",
+	"igshid",
+	"ttclid",
+	"rdt_cid",
+	"epik",
+	"qclid",
+	"sccid",
+	"irclid",
+	"_kx",
+	"ph_keyword"
+];
+function isPostHogQueryDerivedProperty(key) {
+	const normalized = key.toLowerCase();
+	return POSTHOG_QUERY_DERIVED_PROPERTY_NAMES.some((propertyName) => normalized === propertyName || normalized.endsWith(`_${propertyName}`) || normalized.endsWith(`$${propertyName}`));
+}
+function isPostHogUrlProperty(key) {
+	const normalized = key.toLowerCase();
+	return normalized.includes("url") || normalized.includes("referrer") || normalized.includes("path") || normalized.includes("filename");
+}
+function stripUrlQueryAndFragment(value) {
+	const queryIndex = value.indexOf("?");
+	const fragmentIndex = value.indexOf("#");
+	if (queryIndex === -1 && fragmentIndex === -1) return value;
+	if (queryIndex === -1) return value.slice(0, fragmentIndex);
+	if (fragmentIndex === -1) return value.slice(0, queryIndex);
+	return value.slice(0, Math.min(queryIndex, fragmentIndex));
+}
+var RecordingTelemetryAdapter = class {
+	#events = [];
+	#rawMode;
+	constructor(options = {}) {
+		this.#rawMode = options.rawMode === true;
+	}
+	get events() {
+		return this.#events.map((event) => cloneEvent(event));
+	}
+	emit(event) {
+		return Effect.sync(() => {
+			this.#events.push(redactTelemetryEvent(event, { rawMode: this.#rawMode }));
+		});
+	}
+	identify(_input) {
+		return Effect.void;
+	}
+	group(_input) {
+		return Effect.void;
+	}
+	reset() {
+		return Effect.void;
+	}
+	reportHandledError(_error, _context) {
+		return Effect.void;
+	}
+	clear() {
+		this.#events.length = 0;
+	}
+};
+var PostHogTelemetryAdapter = class {
+	#capture;
+	constructor(deps) {
+		this.#capture = deps.capture;
+	}
+	emit(event) {
+		return Effect.sync(() => {
+			try {
+				Promise.resolve(this.#capture(event.name, redactTelemetryProps(event.name, event.props))).catch(() => {});
+			} catch {}
+		});
+	}
+	identify(_input) {
+		return Effect.void;
+	}
+	group(_input) {
+		return Effect.void;
+	}
+	reset() {
+		return Effect.void;
+	}
+	reportHandledError(_error, _context) {
+		return Effect.void;
+	}
+};
+var InMemoryTelemetryBusAdapter = class {
+	#subscribers = /* @__PURE__ */ new Set();
+	#rawMode;
+	constructor(options = {}) {
+		this.#rawMode = options.rawMode === true;
+	}
+	subscribe(handler) {
+		this.#subscribers.add(handler);
+		return () => {
+			this.#subscribers.delete(handler);
+		};
+	}
+	emit(event) {
+		return Effect.sync(() => {
+			const delivered = redactTelemetryEvent(event, { rawMode: this.#rawMode });
+			for (const handler of this.#subscribers) try {
+				handler(cloneEvent(delivered));
+			} catch {}
+		});
+	}
+	identify(_input) {
+		return Effect.void;
+	}
+	group(_input) {
+		return Effect.void;
+	}
+	reset() {
+		return Effect.void;
+	}
+	reportHandledError(_error, _context) {
+		return Effect.void;
+	}
+};
+const PII_PROP_KEYS_BY_EVENT = {
+	auth_otp_requested: ["email"],
+	auth_otp_delivered: ["email"],
+	auth_otp_expired: ["email"],
+	auth_failed: ["email"]
+};
+function redactProperty(props, key) {
+	const value = props[key];
+	if (typeof value === "string") props[key] = sha256Hex(value).slice(0, 12);
+}
+function cloneEvent(event) {
+	if (event.props === void 0) return { name: event.name };
+	return {
+		name: event.name,
+		props: cloneProps(event.props)
+	};
+}
+function cloneProps(props) {
+	const cloned = {};
+	for (const [key, value] of Object.entries(props)) cloned[key] = cloneTelemetryValue(value);
+	return cloned;
+}
+function cloneTelemetryValue(value) {
+	if (Array.isArray(value)) return value.map(cloneTelemetryValue);
+	if (value === null || typeof value !== "object") return value;
+	if (Object.getPrototypeOf(value) !== Object.prototype) return value;
+	const cloned = {};
+	for (const [key, nested] of Object.entries(value)) cloned[key] = cloneTelemetryValue(nested);
+	return cloned;
+}
+const SHA256_INITIAL_HASH = [
+	1779033703,
+	3144134277,
+	1013904242,
+	2773480762,
+	1359893119,
+	2600822924,
+	528734635,
+	1541459225
+];
+const SHA256_K = [
+	1116352408,
+	1899447441,
+	3049323471,
+	3921009573,
+	961987163,
+	1508970993,
+	2453635748,
+	2870763221,
+	3624381080,
+	310598401,
+	607225278,
+	1426881987,
+	1925078388,
+	2162078206,
+	2614888103,
+	3248222580,
+	3835390401,
+	4022224774,
+	264347078,
+	604807628,
+	770255983,
+	1249150122,
+	1555081692,
+	1996064986,
+	2554220882,
+	2821834349,
+	2952996808,
+	3210313671,
+	3336571891,
+	3584528711,
+	113926993,
+	338241895,
+	666307205,
+	773529912,
+	1294757372,
+	1396182291,
+	1695183700,
+	1986661051,
+	2177026350,
+	2456956037,
+	2730485921,
+	2820302411,
+	3259730800,
+	3345764771,
+	3516065817,
+	3600352804,
+	4094571909,
+	275423344,
+	430227734,
+	506948616,
+	659060556,
+	883997877,
+	958139571,
+	1322822218,
+	1537002063,
+	1747873779,
+	1955562222,
+	2024104815,
+	2227730452,
+	2361852424,
+	2428436474,
+	2756734187,
+	3204031479,
+	3329325298
+];
+function sha256Hex(input) {
+	const padded = padSha256Message(new TextEncoder().encode(input));
+	const view = new DataView(padded.buffer, padded.byteOffset, padded.byteLength);
+	const words = /* @__PURE__ */ new Uint32Array(64);
+	let h0 = SHA256_INITIAL_HASH[0];
+	let h1 = SHA256_INITIAL_HASH[1];
+	let h2 = SHA256_INITIAL_HASH[2];
+	let h3 = SHA256_INITIAL_HASH[3];
+	let h4 = SHA256_INITIAL_HASH[4];
+	let h5 = SHA256_INITIAL_HASH[5];
+	let h6 = SHA256_INITIAL_HASH[6];
+	let h7 = SHA256_INITIAL_HASH[7];
+	for (let offset = 0; offset < padded.byteLength; offset += 64) {
+		for (let i = 0; i < 16; i++) words[i] = view.getUint32(offset + i * 4);
+		for (let i = 16; i < 64; i++) {
+			const s0 = rotr(words[i - 15], 7) ^ rotr(words[i - 15], 18) ^ words[i - 15] >>> 3;
+			const s1 = rotr(words[i - 2], 17) ^ rotr(words[i - 2], 19) ^ words[i - 2] >>> 10;
+			words[i] = words[i - 16] + s0 + words[i - 7] + s1 >>> 0;
+		}
+		let a = h0;
+		let b = h1;
+		let c = h2;
+		let d = h3;
+		let e = h4;
+		let f = h5;
+		let g = h6;
+		let h = h7;
+		for (let i = 0; i < 64; i++) {
+			const s1 = rotr(e, 6) ^ rotr(e, 11) ^ rotr(e, 25);
+			const ch = e & f ^ ~e & g;
+			const temp1 = h + s1 + ch + SHA256_K[i] + words[i] >>> 0;
+			const temp2 = (rotr(a, 2) ^ rotr(a, 13) ^ rotr(a, 22)) + (a & b ^ a & c ^ b & c) >>> 0;
+			h = g;
+			g = f;
+			f = e;
+			e = d + temp1 >>> 0;
+			d = c;
+			c = b;
+			b = a;
+			a = temp1 + temp2 >>> 0;
+		}
+		h0 = h0 + a >>> 0;
+		h1 = h1 + b >>> 0;
+		h2 = h2 + c >>> 0;
+		h3 = h3 + d >>> 0;
+		h4 = h4 + e >>> 0;
+		h5 = h5 + f >>> 0;
+		h6 = h6 + g >>> 0;
+		h7 = h7 + h >>> 0;
+	}
+	return [
+		h0,
+		h1,
+		h2,
+		h3,
+		h4,
+		h5,
+		h6,
+		h7
+	].map((word) => word.toString(16).padStart(8, "0")).join("");
+}
+function padSha256Message(bytes) {
+	const bitLength = bytes.byteLength * 8;
+	const zeroPadLength = (64 - (bytes.byteLength + 1 + 8) % 64) % 64;
+	const output = new Uint8Array(bytes.byteLength + 1 + zeroPadLength + 8);
+	output.set(bytes);
+	output[bytes.byteLength] = 128;
+	const view = new DataView(output.buffer);
+	view.setUint32(output.byteLength - 8, Math.floor(bitLength / 4294967296));
+	view.setUint32(output.byteLength - 4, bitLength >>> 0);
+	return output;
+}
+function rotr(value, bits) {
+	return value >>> bits | value << 32 - bits;
+}
+//#endregion
+export { OnboardingIntentSelectedTelemetryEventSchema as $, redactTelemetryProps as $t, FINANCIAL_OPS_TARGET_TELEMETRY_PRODUCERS as A, ReceiptPendingTelemetryEventSchema as At, MemberActivationFailedTelemetryEventSchema as B, UiContactActionCompletedTelemetryEventSchema as Bt, CliCommandCompletedTelemetryEventSchema as C, PayrollGroupChangedTelemetryEventSchema as Ct, ContactRelationshipChangedTelemetryEventSchema as D, ProvisioningSafeConfirmedTelemetryEventSchema as Dt, CliFirstUsedTelemetryEventSchema as E, PostHogTelemetryAdapter as Et, IdentityRefusedTelemetryEventSchema as F, TELEMETRY_EVENT_SCHEMAS as Ft, MovementScanWindowTelemetryEventSchema as G, createCapxulBeforeSend as Gt, MemberActivationStartedTelemetryEventSchema as H, UiPayrollActionCompletedTelemetryEventSchema as Ht, InMemoryTelemetryBusAdapter as I, TELEMETRY_JOURNEYS as It, NativeAuthorizationDeniedTelemetryEventSchema as J, initializeCapxulBrowserAnalytics as Jt, NativeAuthorizationAcceptedTelemetryEventSchema as K, createPostHogBrowserPageviewTracker as Kt, IndexerDriftCorrectedTelemetryEventSchema as L, TELEMETRY_PRODUCERS as Lt, FaucetConfirmedTelemetryEventSchema as M, ResponseHeadersSchema as Mt, FaucetFailedTelemetryEventSchema as N, SYNCABLE_CAPXUL_ENVS as Nt, DepositInitiatedTelemetryEventSchema as O, ProvisioningSafeCreatedTelemetryEventSchema as Ot, FaucetRequestedTelemetryEventSchema as P, TELEMETRY_EVENT_NAMES as Pt, OnboardingDashboardReachedTelemetryEventSchema as Q, redactTelemetryEvent as Qt, InvoiceIssuedTelemetryEventSchema as R, UiAccessStepCompletedTelemetryEventSchema as Rt, ChainUpstreamSchema as S, PaymentVerificationRetryTelemetryEventSchema as St, CliDiagnosticCompletedTelemetryEventSchema as T, PermissionMirrorVerificationTelemetryEventSchema as Tt, MovementScanCheckpointTelemetryEventSchema as U, UiReceiveStepCompletedTelemetryEventSchema as Ut, MemberActivationReadyTelemetryEventSchema as V, UiInvoiceStepCompletedTelemetryEventSchema as Vt, MovementScanIncidentTelemetryEventSchema as W, UiTreasuryStepCompletedTelemetryEventSchema as Wt, NativeAuthorizationReviewedTelemetryEventSchema as X, maskCapturedNetworkRequest as Xt, NativeAuthorizationFailedTelemetryEventSchema as Y, initializePostHogBrowserAnalytics as Yt, NativeAuthorizationStartedTelemetryEventSchema as Z, productAppAnalytics as Zt, CLI_COMMAND_NAMES as _, PRODUCT_MAPPER_GATED_TELEMETRY_EVENTS as _t, AuthFailedTelemetryEventSchema as a, CAPXUL_OPERATIONS as an, OrgCreatedTelemetryEventSchema as at, ChainAttemptSchema as b, PaymentLifecycleTransitionTelemetryEventSchema as bt, AuthOtpRequestedTelemetryEventSchema as c, ORGANIZATION_SETUP_REASONS as cn, OrgInviteProgressedTelemetryEventSchema as ct, BROWSER_GATED_TELEMETRY_EVENTS as d, FAILURE_MODES as dn, OrgSafeConfirmedTelemetryEventSchema as dt, sanitizePostHogBrowserEvent as en, OnboardingOrganizationSubmittedTelemetryEventSchema as et, BootstrapFailedTelemetryEventSchema as f, isCredentialField as fn, OrgSafeCreatedTelemetryEventSchema as ft, CLI_CAPABILITIES as g, PII as gt, CAPXUL_ENVS as h, OrganizationCreationStartedTelemetryEventSchema as ht, ActivityAnnotationSavedTelemetryEventSchema as i, utilityAppAnalytics as in, OrgCreateStartedTelemetryEventSchema as it, FailureModeSchema as j, RecordingTelemetryAdapter as jt, DepositSettledTelemetryEventSchema as k, QuickPayExternalAddressAcknowledgedTelemetryEventSchema as kt, AuthSignedOutTelemetryEventSchema as l, ORGANIZATION_SETUP_STATUSES as ln, OrgInviteSentTelemetryEventSchema as lt, BundlerErrorTelemetryEventSchema as m, redactUrlSecrets as mn, OrganizationCreationReadyTelemetryEventSchema as mt, AccountBalanceFailedTelemetryEventSchema as n, stampTelemetryEnvelope as nn, OperationRetriedTelemetryEventSchema as nt, AuthOtpDeliveredTelemetryEventSchema as o, isCapxulOperation as on, OrgInviteAcceptedTelemetryEventSchema as ot, BootstrapResolvedTelemetryEventSchema as p, redactSecrets as pn, OrganizationCreationFailedTelemetryEventSchema as pt, NativeAuthorizationConnectedTelemetryEventSchema as q, getTrackHandler as qt, AccountBalanceReadTelemetryEventSchema as r, track as rn, OrgCreateFailedTelemetryEventSchema as rt, AuthOtpExpiredTelemetryEventSchema as s, normalizeCapxulOperation as sn, OrgInviteExpiredTelemetryEventSchema as st, AccessRecoveryCompletedTelemetryEventSchema as t, setTrackHandler as tn, OnboardingProfileSubmittedTelemetryEventSchema as tt, AuthVerifiedTelemetryEventSchema as u, CAPXUL_ERROR_CODES as un, OrgRolesSeededTelemetryEventSchema as ut, CLI_INVOCATION_KINDS as v, PaymentFailedTelemetryEventSchema as vt, CliCommandStartedTelemetryEventSchema as w, PayrollRunTransitionedTelemetryEventSchema as wt, ChainUpstreamFallbackTelemetryEventSchema as x, PaymentSettledTelemetryEventSchema as xt, CONTRACT_FIRST_TELEMETRY_EVENTS as y, PaymentInitiatedTelemetryEventSchema as yt, InvoiceRequestTransitionedTelemetryEventSchema as z, UiActivityActionCompletedTelemetryEventSchema as zt };