@capxul/sdk 1.0.0-alpha.18 → 1.0.0-alpha.19

package/dist/index.mjs

@@ -1258,10 +1258,10 @@ function makeAccountMethods(deps) {
 			value: await lane.retryProvisioning()
 		};
 	};
-	const reportAndReturn = (error) => {
+	const reportAndReturn = (error, operation = "getLifecycle") => {
 		if (deps.telemetry) captureExceptionSync(deps.telemetry, error, {
 			layer: "account",
-			operation: "getLifecycle"
+			operation
 		});
 		return {
 			ok: false,
@@ -1292,6 +1292,12 @@ function makeAccountMethods(deps) {
 	};
 	const getLifecycle = () => resolveLifecycle();
 	const retrySetup = async () => {
+		const resetSession = deps.signer?.resetSession;
+		if (typeof resetSession === "function") try {
+			resetSession.call(deps.signer);
+		} catch (cause) {
+			return reportAndReturn(cause instanceof CapxulError ? cause : Errors.providerError("openfort", "resetSession", cause, { failure_mode: "unknown" }), "retrySetup");
+		}
 		await lane.retryProvisioning();
 		return resolveLifecycle();
 	};
@@ -1618,7 +1624,7 @@ async function recoverRawDigestSigner(input) {
 }
 //#endregion
 //#region package.json
-var version = "1.0.0-alpha.18";
+var version = "1.0.0-alpha.19";
 //#endregion
 //#region src/ports/auth-client.ts
 var AuthClientError = class extends Data.TaggedError("AuthClientError") {};
@@ -3386,24 +3392,6 @@ const envFields = {
 		"required": false,
 		"example": "development"
 	},
-	AUTH_DEV_OTP: {
-		"runtime": "server",
-		"kind": "nonempty",
-		"required": false,
-		"example": "000000"
-	},
-	SENTRY_DSN: {
-		"runtime": "server",
-		"kind": "url",
-		"required": false,
-		"example": "https://public@example.ingest.sentry.io/1"
-	},
-	POSTHOG_API_KEY: {
-		"runtime": "server",
-		"kind": "nonempty",
-		"required": false,
-		"example": "phx_test"
-	},
 	POSTHOG_PROJECT_TOKEN: {
 		"runtime": "server",
 		"kind": "nonempty",
@@ -3434,24 +3422,12 @@ const envFields = {
 		"required": false,
 		"example": "12345"
 	},
-	POSTHOG_ENV_ID: {
-		"runtime": "server",
-		"kind": "nonempty",
-		"required": false,
-		"example": "12345"
-	},
 	SENDER_EMAIL: {
 		"runtime": "server",
 		"kind": "email",
 		"required": false,
 		"example": "noreply@capxul.test"
 	},
-	SHIELD_API_URL: {
-		"runtime": "server",
-		"kind": "url",
-		"required": false,
-		"example": "https://api.shield.test"
-	},
 	ALCHEMY_API_KEY: {
 		"runtime": "server",
 		"kind": "nonempty",
@@ -3470,24 +3446,6 @@ const envFields = {
 		"required": true,
 		"example": "alchemy_hmac"
 	},
-	ALCHEMY_AUTH_TOKEN: {
-		"runtime": "server",
-		"kind": "nonempty",
-		"required": false,
-		"example": "alchemy_auth"
-	},
-	ALCHEMY_WEBHOOK_ID: {
-		"runtime": "server",
-		"kind": "nonempty",
-		"required": false,
-		"example": "wh_123"
-	},
-	GOLDSKY_WEBHOOK_SECRET: {
-		"runtime": "server",
-		"kind": "nonempty",
-		"required": false,
-		"example": "goldsky_secret"
-	},
 	DEPLOYER_PRIVATE_KEY: {
 		"runtime": "server",
 		"kind": "privateKey",
@@ -4207,6 +4165,7 @@ const DEFAULT_FUNCTIONS$1 = {
 	prepareFounderAccount: makeFunctionReference("org/actions:prepareFounderAccount"),
 	prepareBootstrap: makeFunctionReference("org/actions:prepareBootstrap"),
 	submitBootstrap: makeFunctionReference("org/actions:submitBootstrap"),
+	resumeBootstrapSubmission: makeFunctionReference("org/actions:resumeBootstrapSubmission"),
 	confirmBootstrap: makeFunctionReference("org/actions:confirmBootstrap"),
 	recordFailure: makeFunctionReference("org/lifecycle:recordFailure"),
 	load: makeFunctionReference("org/lifecycle:load"),
@@ -4268,14 +4227,22 @@ var ConvexOrganizationSetupAdapter = class {
 		if (!submitted.ok) return submitted;
 		return parseLifecycle("submitBootstrap", submitted.value);
 	}
+	resumeSubmittedBootstrap(input) {
+		return this.#lifecycleAction("resumeBootstrapSubmission", input, () => this.#convex.action(this.#fns.resumeBootstrapSubmission, { orgId: input.orgId }));
+	}
 	confirmSubmittedBootstrap(input) {
 		return this.#lifecycleAction("confirmBootstrap", input, () => this.#convex.action(this.#fns.confirmBootstrap, { orgId: input.orgId }));
 	}
 	async recordFailure(input) {
+		const errorProvider = input.error.details?.provider;
+		const errorOperation = input.error.details?.operation;
 		const result = await runCall("recordFailure", this.#convex.mutation(this.#fns.recordFailure, {
 			orgId: input.orgId,
-			at: input.at,
 			errorCode: input.error.code,
+			...typeof errorProvider === "string" && typeof errorOperation === "string" ? {
+				errorProvider,
+				errorOperation
+			} : {},
 			retryable: input.retryable
 		}));
 		return result.ok ? parseLifecycle("recordFailure", result.value) : result;
@@ -4289,8 +4256,15 @@ var ConvexOrganizationSetupAdapter = class {
 	async retry(input) {
 		const cancelled = cancellation(input.signal);
 		if (cancelled !== void 0) return cancelled;
+		const current = await this.loadLifecycle({ orgId: input.orgId });
+		if (!current.ok) return current;
+		if (current.value.status === "failed" && current.value.retryable && (current.value.at === "awaitingFounderAuthorization" || current.value.at === "submittingBootstrap")) {
+			const reset = resetSignerSession(this.#signer);
+			if (!reset.ok) return reset;
+		}
 		const result = await runCall("retry", this.#convex.mutation(this.#fns.retry, { orgId: input.orgId }));
-		return result.ok ? parseLifecycle("retry", result.value) : result;
+		if (!result.ok) return result;
+		return parseLifecycle("retry", result.value);
 	}
 	async #lifecycleAction(operation, input, call) {
 		const cancelled = cancellation(input.signal);
@@ -4302,6 +4276,22 @@ var ConvexOrganizationSetupAdapter = class {
 		return parseLifecycle(operation, result.value);
 	}
 };
+function resetSignerSession(signer) {
+	const resetSession = signer.resetSession;
+	if (typeof resetSession !== "function") return {
+		ok: true,
+		value: void 0
+	};
+	try {
+		resetSession.call(signer);
+		return {
+			ok: true,
+			value: void 0
+		};
+	} catch (cause) {
+		return fail$2(cause instanceof CapxulError ? cause : Errors.providerError("openfort", "resetSession", cause, { failure_mode: "unknown" }));
+	}
+}
 async function runCall(operation, effect) {
 	try {
 		const result = await Effect.runPromise(Effect.either(effect));
@@ -4328,7 +4318,7 @@ async function signerResult(operation, run) {
 			value: await run()
 		};
 	} catch (cause) {
-		return fail$2(Errors.providerError("organization-signer", operation, cause));
+		return fail$2(cause instanceof CapxulError ? cause : Errors.providerError("organization-signer", operation, cause));
 	}
 }
 function validatePreparedAuthorities(prepared, signerAddress) {
@@ -5250,6 +5240,9 @@ function transportErrorFromThrown(operation, request, cause) {
 }
 //#endregion
 //#region src/openfort/create-openfort-browser-signer.ts
+function openfortProviderError(operation, cause) {
+	return cause instanceof CapxulError ? cause : Errors.providerError("openfort", operation, cause, { failure_mode: "unknown" });
+}
 /**
 * True when the browser cannot perform Web Crypto — sandboxed iframes, headless
 * agent browsers, or non-HTTPS origins. OpenFort's embedded-wallet `configure`
@@ -5318,21 +5311,39 @@ function createOpenfortBrowserSignerFromBootstrap(bootstrap, options = {}) {
 		return `${authBaseUrl}/encryption-session`;
 	}
 	async function fetchBetterAuthAccessToken() {
-		const response = await fetch(betterAuthSessionUrl(), { credentials: "include" });
-		if (!response.ok) {
+		try {
+			const response = await fetch(betterAuthSessionUrl(), { credentials: "include" });
+			if (!response.ok) {
+				diagnostic?.trace("openfort.token", {
+					ok: false,
+					tokenPresent: false,
+					httpStatus: response.status,
+					failure_mode: "unknown"
+				});
+				return null;
+			}
+			const token = (await response.json()).session?.token?.trim();
+			if (token === void 0 || token.length === 0) {
+				diagnostic?.trace("openfort.token", {
+					ok: false,
+					tokenPresent: false,
+					failure_mode: "unknown"
+				});
+				return null;
+			}
 			diagnostic?.trace("openfort.token", {
+				ok: true,
+				tokenPresent: true
+			});
+			return token;
+		} catch (cause) {
+			diagnostic?.trace("openfort.token", {
+				ok: false,
 				tokenPresent: false,
-				httpStatus: response.status
+				failure_mode: "unknown"
 			});
-			return null;
-		}
-		const token = (await response.json()).session?.token?.trim();
-		if (token === void 0 || token.length === 0) {
-			diagnostic?.trace("openfort.token", { tokenPresent: false });
-			return null;
+			throw openfortProviderError("token", cause);
 		}
-		diagnostic?.trace("openfort.token", { tokenPresent: true });
-		return token;
 	}
 	const openfort = new Openfort({
 		baseConfiguration: { publishableKey: bootstrap.openfortPublishableKey },
@@ -5348,25 +5359,60 @@ function createOpenfortBrowserSignerFromBootstrap(bootstrap, options = {}) {
 			if (isInsecureBrowserContext()) failNoSecureContext();
 			await openfort.waitForInitialization();
 			const accessToken = await fetchBetterAuthAccessToken();
-			if (accessToken === null) throw Errors.notAuthenticated();
-			const encryptionResponse = await fetch(encryptionSessionUrl(), {
-				method: "POST",
-				credentials: "include",
-				headers: {
-					Authorization: `Bearer ${accessToken}`,
-					"Content-Type": "application/json"
-				},
-				body: JSON.stringify({})
-			});
-			diagnostic?.trace("openfort.encryptionSession", { httpStatus: encryptionResponse.status });
+			if (accessToken === null) throw openfortProviderError("token", /* @__PURE__ */ new Error("Better Auth access token unavailable for Openfort"));
+			let encryptionResponse;
+			try {
+				encryptionResponse = await fetch(encryptionSessionUrl(), {
+					method: "POST",
+					credentials: "include",
+					headers: {
+						Authorization: `Bearer ${accessToken}`,
+						"Content-Type": "application/json"
+					},
+					body: JSON.stringify({})
+				});
+			} catch (cause) {
+				diagnostic?.trace("openfort.encryptionSession", {
+					ok: false,
+					failure_mode: "unknown"
+				});
+				throw openfortProviderError("encryptionSession", cause);
+			}
 			if (!encryptionResponse.ok) {
-				const detail = await encryptionResponse.text();
-				throw Errors.providerError("openfort", "encryptionSession", /* @__PURE__ */ new Error(`Openfort encryption session failed (${encryptionResponse.status}): ${detail.slice(0, 200)}`));
+				diagnostic?.trace("openfort.encryptionSession", {
+					ok: false,
+					httpStatus: encryptionResponse.status,
+					failure_mode: "unknown"
+				});
+				throw Errors.providerError("openfort", "encryptionSession", /* @__PURE__ */ new Error(`Openfort encryption session failed (${encryptionResponse.status})`), { failure_mode: "unknown" });
+			}
+			let encryptionBody;
+			try {
+				encryptionBody = await encryptionResponse.json();
+				if (typeof encryptionBody.sessionId !== "string" || encryptionBody.sessionId.length === 0) throw new Error("Openfort encryption session response missing sessionId");
+			} catch (cause) {
+				diagnostic?.trace("openfort.encryptionSession", {
+					ok: false,
+					httpStatus: encryptionResponse.status,
+					failure_mode: "unknown"
+				});
+				throw openfortProviderError("encryptionSession", cause);
+			}
+			diagnostic?.trace("openfort.encryptionSession", {
+				ok: true,
+				httpStatus: encryptionResponse.status
+			});
+			let embeddedState;
+			try {
+				embeddedState = await openfort.embeddedWallet.getEmbeddedState();
+				diagnostic?.trace("openfort.embeddedState", { state: embeddedState });
+			} catch (cause) {
+				diagnostic?.trace("openfort.embeddedState", {
+					ok: false,
+					failure_mode: "unknown"
+				});
+				throw openfortProviderError("embeddedState", cause);
 			}
-			const encryptionBody = await encryptionResponse.json();
-			if (typeof encryptionBody.sessionId !== "string" || encryptionBody.sessionId.length === 0) throw Errors.providerError("openfort", "encryptionSession", /* @__PURE__ */ new Error("Openfort encryption session response missing sessionId"));
-			const embeddedState = await openfort.embeddedWallet.getEmbeddedState();
-			diagnostic?.trace("openfort.embeddedState", { state: embeddedState });
 			if (embeddedState !== EmbeddedState.READY) {
 				clearStaleOpenfortBrowserStorage(bootstrap.openfortPublishableKey);
 				diagnostic?.trace("openfort.storageCleared", { beforeConfigure: true });
@@ -5383,9 +5429,9 @@ function createOpenfortBrowserSignerFromBootstrap(bootstrap, options = {}) {
 				} catch (cause) {
 					diagnostic?.trace("openfort.configure", {
 						ok: false,
-						message: cause instanceof Error ? cause.message : String(cause)
+						failure_mode: "unknown"
 					});
-					throw cause;
+					throw openfortProviderError("configure", cause);
 				}
 			}
 			try {
@@ -5394,9 +5440,9 @@ function createOpenfortBrowserSignerFromBootstrap(bootstrap, options = {}) {
 			} catch (cause) {
 				diagnostic?.trace("openfort.get", {
 					ok: false,
-					message: cause instanceof Error ? cause.message : String(cause)
+					failure_mode: "unknown"
 				});
-				throw cause;
+				throw openfortProviderError("get", cause);
 			}
 		})();
 	}
@@ -5415,6 +5461,19 @@ function createOpenfortBrowserSignerFromBootstrap(bootstrap, options = {}) {
 	});
 	return {
 		...signer,
+		getAddress: async () => {
+			try {
+				const address = await signer.getAddress();
+				diagnostic?.trace("openfort.address", { ok: true });
+				return address;
+			} catch (cause) {
+				diagnostic?.trace("openfort.address", {
+					ok: false,
+					failure_mode: "unknown"
+				});
+				throw openfortProviderError("getAddress", cause);
+			}
+		},
 		resetSession: () => {
 			walletReadyPromise = null;
 			clearStaleOpenfortBrowserStorage(bootstrap.openfortPublishableKey);
@@ -7921,16 +7980,17 @@ async function advanceOrganizationSetup(setup, orgId, initial, signal) {
 			value: lifecycle
 		};
 		const currentStep = lifecycle.step;
-		if (signal?.aborted) {
-			const cancelled = Errors.cancelled({ operation: "organization.setup" });
-			return recordRetryableCancellation(setup, orgId, lifecycle.step, cancelled);
-		}
+		if (signal?.aborted) return recordSetupFailure(setup, orgId, Errors.cancelled({ operation: "organization.setup" }), true);
 		const stepInput = {
 			orgId,
 			...signal === void 0 ? {} : { signal }
 		};
-		const next = lifecycle.step === "preparingFounderAccount" ? await setup.prepareFounderAccount(stepInput) : lifecycle.step === "awaitingFounderAuthorization" || lifecycle.step === "submittingBootstrap" ? await setup.authorizeAndSubmitBootstrap(stepInput) : await setup.confirmSubmittedBootstrap(stepInput);
-		if (!next.ok) return next.error.code === "CANCELLED" ? recordRetryableCancellation(setup, orgId, lifecycle.step, next.error) : next;
+		const next = lifecycle.step === "preparingFounderAccount" ? await setup.prepareFounderAccount(stepInput) : lifecycle.step === "awaitingFounderAuthorization" ? await setup.authorizeAndSubmitBootstrap(stepInput) : lifecycle.step === "submittingBootstrap" ? await setup.resumeSubmittedBootstrap(stepInput) : await setup.confirmSubmittedBootstrap(stepInput);
+		if (!next.ok) {
+			if (next.error.code === "CANCELLED") return recordSetupFailure(setup, orgId, next.error, true);
+			if (next.error.code === "PROVIDER_ERROR") return recordSetupFailure(setup, orgId, next.error, isRetryableProviderFailure(next.error));
+			return next;
+		}
 		const scopedNext = validateOrganizationLifecycleScope(orgId, next.value);
 		if (!scopedNext.ok) return scopedNext;
 		lifecycle = scopedNext.value;
@@ -7953,17 +8013,20 @@ async function advanceOrganizationSetup(setup, orgId, initial, signal) {
 		]
 	}));
 }
-async function recordRetryableCancellation(setup, orgId, at, cancelled) {
+async function recordSetupFailure(setup, orgId, error, retryable) {
 	const recorded = await setup.recordFailure({
 		orgId,
-		at,
-		error: cancelled,
-		retryable: true
+		error,
+		retryable
 	});
 	if (!recorded.ok) return recorded;
 	const scopedRecorded = validateOrganizationLifecycleScope(orgId, recorded.value);
 	if (!scopedRecorded.ok) return scopedRecorded;
-	return fail$1(cancelled);
+	return fail$1(error);
+}
+function isRetryableProviderFailure(error) {
+	const mode = error.details?.failure_mode;
+	return mode !== "auth-origin-mismatch" && mode !== "app-env-allowlist" && mode !== "no-secure-context";
 }
 //#endregion
 //#region src/client/org.ts
@@ -8314,7 +8377,18 @@ async function runCompleteOrganizationOnboarding(ops, input, options) {
 	});
 	if (!started.ok) return fail(started.error);
 	const lifecycle = await advanceOrganizationSetup(setup, started.value.orgId, started.value.lifecycle, options?.signal);
-	if (!lifecycle.ok) return lifecycle;
+	if (!lifecycle.ok) {
+		const error = lifecycle.error;
+		return fail(new CapxulError(error.code, error.message, {
+			cause: error.cause,
+			details: {
+				...error.details,
+				orgId: started.value.orgId
+			},
+			...error.correlationId === void 0 ? {} : { correlationId: error.correlationId },
+			...error.layer === void 0 ? {} : { layer: error.layer }
+		}));
+	}
 	return {
 		ok: true,
 		value: {
@@ -8438,6 +8512,7 @@ function detectAuthCacheAdapter() {
 }
 //#endregion
 //#region src/client/create-capxul-client.ts
+const GET_ORGANIZATION_SETUP_PROOF_RECEIPT = makeFunctionReference("org/lifecycle:getProofReceipt");
 function assembleCapxulClient(input) {
 	const authCache = input.authCache ?? detectAuthCacheAdapter();
 	const layer = Layer.mergeAll(Layer.succeed(AuthClientPortTag, input.ports.authClient), Layer.succeed(ClockPortTag, input.ports.clock), Layer.succeed(TelemetryPortTag, input.ports.telemetry));
@@ -8561,6 +8636,7 @@ function assembleCapxulClient(input) {
 			},
 			bootstrap: input.bootstrap,
 			accounts: { fund: accounts.fund },
+			organizationSetup: { getProofReceipt: (orgId) => runPortEffect(input.ports.convexCall.query(GET_ORGANIZATION_SETUP_PROOF_RECEIPT, { orgId })) },
 			telemetry: input.ports.telemetry
 		}
 	};