@capxul/sdk 1.0.0-alpha.18 → 1.0.0-alpha.20

package/dist/index.mjs

@@ -1,4 +1,4 @@
-import { A as toSessionToken, C as toEpochSeconds, D as toPublishableKey, E as toOrgId, F as Errors, I as isCapxulError, M as decodeConvexError, N as CapxulError, O as toPublishableKeyId, P as EXPECTED_OPERATION_OUTCOMES, S as toEpochMs, T as toKycTier, _ as toChainId, b as toDurationMs, c as BYTES32_RE, d as toAccountId, f as toAddress, g as toAuthUserId, h as toAppId, j as toSubAccountId, k as toRoleKey, l as EVM_ADDRESS_RE$1, m as toAnonymousDistinctId, n as BrowserAuthCacheAdapter, o as AuthCachePortTag, p as toAllowedOrigin, s as APP_ID_RE, t as InMemoryAuthCacheAdapter, u as SUPPORTED_CURRENCY_CODES, v as toCountryCode, w as toJwtToken, x as toEmail, y as toCurrencyCode } from "./InMemoryAuthCacheAdapter-BuVZpnSx.mjs";
+import { A as toSessionToken, C as toEpochSeconds, D as toPublishableKey, E as toOrgId, F as Errors, I as isCapxulError, M as decodeConvexError, N as CapxulError, O as toPublishableKeyId, P as EXPECTED_OPERATION_OUTCOMES, S as toEpochMs, T as toKycTier, _ as toChainId, b as toDurationMs, c as BYTES32_RE, d as toAccountId, f as toAddress, g as toAuthUserId, h as toAppId, j as toSubAccountId, k as toRoleKey, l as EVM_ADDRESS_RE$1, m as toAnonymousDistinctId, n as BrowserAuthCacheAdapter, o as AuthCachePortTag, p as toAllowedOrigin, s as APP_ID_RE, t as InMemoryAuthCacheAdapter, u as SUPPORTED_CURRENCY_CODES, v as toCountryCode, w as toJwtToken, x as toEmail, y as toCurrencyCode } from "./InMemoryAuthCacheAdapter-CHYpYyk5.mjs";
 import { concat, formatUnits, keccak256, padHex, parseUnits, recoverAddress, stringToHex, toBytes, toEventSelector, toFunctionSelector } from "viem";
 import { Context, Data, Deferred, Duration, Effect, Either, Exit, Layer, Ref, Request, Scope } from "effect";
 import { getFunctionName, makeFunctionReference } from "convex/server";
@@ -249,13 +249,31 @@ function parseV8StackFrames(error) {
 	}
 	return frames;
 }
+/** Fixed, leak-safe frame used when the error carries no parseable stack. */
+const SDK_BOUNDARY_FILENAME = "capxul-sdk-observation://boundary";
 /**
-* Build PostHog's `$exception_list` format from a list of frames.
-* Returns `[{ frames: [...] }]` or `undefined` if the frames list is empty.
+* Build PostHog's `$exception_list` (always a single entry). Error Tracking
+* groups on `type`, so it is ALWAYS present (the CapxulError code) — the
+* previous `[{ frames }]` shape omitted it and PostHog dropped the event as
+* "missing field `type`". When the error has no parseable stack, a synthetic
+* boundary frame stands in so the event still ingests as a real Issue (#1031).
 */
-function buildExceptionList(frames) {
-	if (frames.length === 0) return void 0;
-	return [{ frames }];
+function buildExceptionList(input) {
+	const frames = input.frames.length > 0 ? input.frames : [{
+		filename: SDK_BOUNDARY_FILENAME,
+		function: input.operation ?? "unknown",
+		lineno: 1,
+		colno: 1
+	}];
+	return [{
+		type: input.type,
+		value: input.value,
+		mechanism: {
+			handled: true,
+			type: "capxul_sdk_boundary"
+		},
+		stacktrace: { frames }
+	}];
 }
 //#endregion
 //#region src/telemetry/get-failure-mode.ts
@@ -306,6 +324,8 @@ function resolveFailureMode(error, contextFailureMode) {
 }
 //#endregion
 //#region src/telemetry/capture-exception.ts
+/** Fixed, leak-safe message — the raw error message may carry PII and never ships. */
+const EXCEPTION_MESSAGE = "Capxul SDK operation failed";
 /**
 * Capture an error as a `$exception` event through the telemetry port,
 * formatted for PostHog Error Tracking.
@@ -319,16 +339,24 @@ function resolveFailureMode(error, contextFailureMode) {
 */
 function captureException(telemetry, error, context) {
 	return Effect.catchAllDefect(Effect.sync(() => {
-		const exceptionList = buildExceptionList(error instanceof Error ? parseV8StackFrames(error) : []);
+		const frames = error instanceof Error ? parseV8StackFrames(error) : [];
 		const capxulError = isCapxulError(error) ? error : null;
+		const errorCode = capxulError?.code ?? context?.capxul_error_code ?? "UNKNOWN";
 		const props = {
-			capxul_error_code: capxulError?.code ?? context?.capxul_error_code ?? "UNKNOWN",
+			capxul_error_code: errorCode,
+			$exception_type: errorCode,
+			$exception_message: EXCEPTION_MESSAGE,
+			$exception_list: buildExceptionList({
+				type: errorCode,
+				value: EXCEPTION_MESSAGE,
+				...context?.operation === void 0 ? {} : { operation: context.operation },
+				frames
+			}),
 			layer: capxulError?.layer ?? context?.layer,
 			operation: context?.operation,
 			provider: context?.provider,
 			failure_mode: resolveFailureMode(error, context?.failure_mode)
 		};
-		if (exceptionList !== void 0) props.$exception_list = exceptionList;
 		if (capxulError?.details !== void 0) props.details = JSON.stringify(capxulError.details);
 		for (const key of Object.keys(props)) if (props[key] === void 0) delete props[key];
 		return telemetry.emit({
@@ -1258,10 +1286,10 @@ function makeAccountMethods(deps) {
 			value: await lane.retryProvisioning()
 		};
 	};
-	const reportAndReturn = (error) => {
+	const reportAndReturn = (error, operation = "getLifecycle") => {
 		if (deps.telemetry) captureExceptionSync(deps.telemetry, error, {
 			layer: "account",
-			operation: "getLifecycle"
+			operation
 		});
 		return {
 			ok: false,
@@ -1292,6 +1320,12 @@ function makeAccountMethods(deps) {
 	};
 	const getLifecycle = () => resolveLifecycle();
 	const retrySetup = async () => {
+		const resetSession = deps.signer?.resetSession;
+		if (typeof resetSession === "function") try {
+			resetSession.call(deps.signer);
+		} catch (cause) {
+			return reportAndReturn(cause instanceof CapxulError ? cause : Errors.providerError("openfort", "resetSession", cause, { failure_mode: "unknown" }), "retrySetup");
+		}
 		await lane.retryProvisioning();
 		return resolveLifecycle();
 	};
@@ -1618,7 +1652,7 @@ async function recoverRawDigestSigner(input) {
 }
 //#endregion
 //#region package.json
-var version = "1.0.0-alpha.18";
+var version = "1.0.0-alpha.20";
 //#endregion
 //#region src/ports/auth-client.ts
 var AuthClientError = class extends Data.TaggedError("AuthClientError") {};
@@ -3386,24 +3420,6 @@ const envFields = {
 		"required": false,
 		"example": "development"
 	},
-	AUTH_DEV_OTP: {
-		"runtime": "server",
-		"kind": "nonempty",
-		"required": false,
-		"example": "000000"
-	},
-	SENTRY_DSN: {
-		"runtime": "server",
-		"kind": "url",
-		"required": false,
-		"example": "https://public@example.ingest.sentry.io/1"
-	},
-	POSTHOG_API_KEY: {
-		"runtime": "server",
-		"kind": "nonempty",
-		"required": false,
-		"example": "phx_test"
-	},
 	POSTHOG_PROJECT_TOKEN: {
 		"runtime": "server",
 		"kind": "nonempty",
@@ -3434,24 +3450,12 @@ const envFields = {
 		"required": false,
 		"example": "12345"
 	},
-	POSTHOG_ENV_ID: {
-		"runtime": "server",
-		"kind": "nonempty",
-		"required": false,
-		"example": "12345"
-	},
 	SENDER_EMAIL: {
 		"runtime": "server",
 		"kind": "email",
 		"required": false,
 		"example": "noreply@capxul.test"
 	},
-	SHIELD_API_URL: {
-		"runtime": "server",
-		"kind": "url",
-		"required": false,
-		"example": "https://api.shield.test"
-	},
 	ALCHEMY_API_KEY: {
 		"runtime": "server",
 		"kind": "nonempty",
@@ -3470,24 +3474,6 @@ const envFields = {
 		"required": true,
 		"example": "alchemy_hmac"
 	},
-	ALCHEMY_AUTH_TOKEN: {
-		"runtime": "server",
-		"kind": "nonempty",
-		"required": false,
-		"example": "alchemy_auth"
-	},
-	ALCHEMY_WEBHOOK_ID: {
-		"runtime": "server",
-		"kind": "nonempty",
-		"required": false,
-		"example": "wh_123"
-	},
-	GOLDSKY_WEBHOOK_SECRET: {
-		"runtime": "server",
-		"kind": "nonempty",
-		"required": false,
-		"example": "goldsky_secret"
-	},
 	DEPLOYER_PRIVATE_KEY: {
 		"runtime": "server",
 		"kind": "privateKey",
@@ -4207,6 +4193,7 @@ const DEFAULT_FUNCTIONS$1 = {
 	prepareFounderAccount: makeFunctionReference("org/actions:prepareFounderAccount"),
 	prepareBootstrap: makeFunctionReference("org/actions:prepareBootstrap"),
 	submitBootstrap: makeFunctionReference("org/actions:submitBootstrap"),
+	resumeBootstrapSubmission: makeFunctionReference("org/actions:resumeBootstrapSubmission"),
 	confirmBootstrap: makeFunctionReference("org/actions:confirmBootstrap"),
 	recordFailure: makeFunctionReference("org/lifecycle:recordFailure"),
 	load: makeFunctionReference("org/lifecycle:load"),
@@ -4268,14 +4255,22 @@ var ConvexOrganizationSetupAdapter = class {
 		if (!submitted.ok) return submitted;
 		return parseLifecycle("submitBootstrap", submitted.value);
 	}
+	resumeSubmittedBootstrap(input) {
+		return this.#lifecycleAction("resumeBootstrapSubmission", input, () => this.#convex.action(this.#fns.resumeBootstrapSubmission, { orgId: input.orgId }));
+	}
 	confirmSubmittedBootstrap(input) {
 		return this.#lifecycleAction("confirmBootstrap", input, () => this.#convex.action(this.#fns.confirmBootstrap, { orgId: input.orgId }));
 	}
 	async recordFailure(input) {
+		const errorProvider = input.error.details?.provider;
+		const errorOperation = input.error.details?.operation;
 		const result = await runCall("recordFailure", this.#convex.mutation(this.#fns.recordFailure, {
 			orgId: input.orgId,
-			at: input.at,
 			errorCode: input.error.code,
+			...typeof errorProvider === "string" && typeof errorOperation === "string" ? {
+				errorProvider,
+				errorOperation
+			} : {},
 			retryable: input.retryable
 		}));
 		return result.ok ? parseLifecycle("recordFailure", result.value) : result;
@@ -4289,8 +4284,15 @@ var ConvexOrganizationSetupAdapter = class {
 	async retry(input) {
 		const cancelled = cancellation(input.signal);
 		if (cancelled !== void 0) return cancelled;
+		const current = await this.loadLifecycle({ orgId: input.orgId });
+		if (!current.ok) return current;
+		if (current.value.status === "failed" && current.value.retryable && (current.value.at === "awaitingFounderAuthorization" || current.value.at === "submittingBootstrap")) {
+			const reset = resetSignerSession(this.#signer);
+			if (!reset.ok) return reset;
+		}
 		const result = await runCall("retry", this.#convex.mutation(this.#fns.retry, { orgId: input.orgId }));
-		return result.ok ? parseLifecycle("retry", result.value) : result;
+		if (!result.ok) return result;
+		return parseLifecycle("retry", result.value);
 	}
 	async #lifecycleAction(operation, input, call) {
 		const cancelled = cancellation(input.signal);
@@ -4302,6 +4304,22 @@ var ConvexOrganizationSetupAdapter = class {
 		return parseLifecycle(operation, result.value);
 	}
 };
+function resetSignerSession(signer) {
+	const resetSession = signer.resetSession;
+	if (typeof resetSession !== "function") return {
+		ok: true,
+		value: void 0
+	};
+	try {
+		resetSession.call(signer);
+		return {
+			ok: true,
+			value: void 0
+		};
+	} catch (cause) {
+		return fail$2(cause instanceof CapxulError ? cause : Errors.providerError("openfort", "resetSession", cause, { failure_mode: "unknown" }));
+	}
+}
 async function runCall(operation, effect) {
 	try {
 		const result = await Effect.runPromise(Effect.either(effect));
@@ -4328,7 +4346,7 @@ async function signerResult(operation, run) {
 			value: await run()
 		};
 	} catch (cause) {
-		return fail$2(Errors.providerError("organization-signer", operation, cause));
+		return fail$2(cause instanceof CapxulError ? cause : Errors.providerError("organization-signer", operation, cause));
 	}
 }
 function validatePreparedAuthorities(prepared, signerAddress) {
@@ -5249,7 +5267,22 @@ function transportErrorFromThrown(operation, request, cause) {
 	return transportErrorFromCapxul(operation, request, cause instanceof Error ? Errors.providerError("transport", request.name, cause) : Errors.providerError("transport", request.name, new Error(String(cause))), cause);
 }
 //#endregion
+//#region src/adapters/diagnostic/ConsoleDiagnosticAdapter.ts
+const DEFAULT_ACCOUNT_SETUP_LOG_PREFIX = "[capxul:account-setup]";
+var ConsoleDiagnosticAdapter = class {
+	prefix;
+	constructor(prefix = DEFAULT_ACCOUNT_SETUP_LOG_PREFIX) {
+		this.prefix = prefix;
+	}
+	trace(scope, detail) {
+		globalThis.console?.debug?.(`${this.prefix} ${scope}`, detail);
+	}
+};
+//#endregion
 //#region src/openfort/create-openfort-browser-signer.ts
+function openfortProviderError(operation, cause) {
+	return cause instanceof CapxulError ? cause : Errors.providerError("openfort", operation, cause, { failure_mode: "unknown" });
+}
 /**
 * True when the browser cannot perform Web Crypto — sandboxed iframes, headless
 * agent browsers, or non-HTTPS origins. OpenFort's embedded-wallet `configure`
@@ -5318,21 +5351,39 @@ function createOpenfortBrowserSignerFromBootstrap(bootstrap, options = {}) {
 		return `${authBaseUrl}/encryption-session`;
 	}
 	async function fetchBetterAuthAccessToken() {
-		const response = await fetch(betterAuthSessionUrl(), { credentials: "include" });
-		if (!response.ok) {
+		try {
+			const response = await fetch(betterAuthSessionUrl(), { credentials: "include" });
+			if (!response.ok) {
+				diagnostic?.trace("openfort.token", {
+					ok: false,
+					tokenPresent: false,
+					httpStatus: response.status,
+					failure_mode: "unknown"
+				});
+				return null;
+			}
+			const token = (await response.json()).session?.token?.trim();
+			if (token === void 0 || token.length === 0) {
+				diagnostic?.trace("openfort.token", {
+					ok: false,
+					tokenPresent: false,
+					failure_mode: "unknown"
+				});
+				return null;
+			}
 			diagnostic?.trace("openfort.token", {
+				ok: true,
+				tokenPresent: true
+			});
+			return token;
+		} catch (cause) {
+			diagnostic?.trace("openfort.token", {
+				ok: false,
 				tokenPresent: false,
-				httpStatus: response.status
+				failure_mode: "unknown"
 			});
-			return null;
-		}
-		const token = (await response.json()).session?.token?.trim();
-		if (token === void 0 || token.length === 0) {
-			diagnostic?.trace("openfort.token", { tokenPresent: false });
-			return null;
+			throw openfortProviderError("token", cause);
 		}
-		diagnostic?.trace("openfort.token", { tokenPresent: true });
-		return token;
 	}
 	const openfort = new Openfort({
 		baseConfiguration: { publishableKey: bootstrap.openfortPublishableKey },
@@ -5348,25 +5399,60 @@ function createOpenfortBrowserSignerFromBootstrap(bootstrap, options = {}) {
 			if (isInsecureBrowserContext()) failNoSecureContext();
 			await openfort.waitForInitialization();
 			const accessToken = await fetchBetterAuthAccessToken();
-			if (accessToken === null) throw Errors.notAuthenticated();
-			const encryptionResponse = await fetch(encryptionSessionUrl(), {
-				method: "POST",
-				credentials: "include",
-				headers: {
-					Authorization: `Bearer ${accessToken}`,
-					"Content-Type": "application/json"
-				},
-				body: JSON.stringify({})
-			});
-			diagnostic?.trace("openfort.encryptionSession", { httpStatus: encryptionResponse.status });
+			if (accessToken === null) throw openfortProviderError("token", /* @__PURE__ */ new Error("Better Auth access token unavailable for Openfort"));
+			let encryptionResponse;
+			try {
+				encryptionResponse = await fetch(encryptionSessionUrl(), {
+					method: "POST",
+					credentials: "include",
+					headers: {
+						Authorization: `Bearer ${accessToken}`,
+						"Content-Type": "application/json"
+					},
+					body: JSON.stringify({})
+				});
+			} catch (cause) {
+				diagnostic?.trace("openfort.encryptionSession", {
+					ok: false,
+					failure_mode: "unknown"
+				});
+				throw openfortProviderError("encryptionSession", cause);
+			}
 			if (!encryptionResponse.ok) {
-				const detail = await encryptionResponse.text();
-				throw Errors.providerError("openfort", "encryptionSession", /* @__PURE__ */ new Error(`Openfort encryption session failed (${encryptionResponse.status}): ${detail.slice(0, 200)}`));
+				diagnostic?.trace("openfort.encryptionSession", {
+					ok: false,
+					httpStatus: encryptionResponse.status,
+					failure_mode: "unknown"
+				});
+				throw Errors.providerError("openfort", "encryptionSession", /* @__PURE__ */ new Error(`Openfort encryption session failed (${encryptionResponse.status})`), { failure_mode: "unknown" });
+			}
+			let encryptionBody;
+			try {
+				encryptionBody = await encryptionResponse.json();
+				if (typeof encryptionBody.sessionId !== "string" || encryptionBody.sessionId.length === 0) throw new Error("Openfort encryption session response missing sessionId");
+			} catch (cause) {
+				diagnostic?.trace("openfort.encryptionSession", {
+					ok: false,
+					httpStatus: encryptionResponse.status,
+					failure_mode: "unknown"
+				});
+				throw openfortProviderError("encryptionSession", cause);
+			}
+			diagnostic?.trace("openfort.encryptionSession", {
+				ok: true,
+				httpStatus: encryptionResponse.status
+			});
+			let embeddedState;
+			try {
+				embeddedState = await openfort.embeddedWallet.getEmbeddedState();
+				diagnostic?.trace("openfort.embeddedState", { state: embeddedState });
+			} catch (cause) {
+				diagnostic?.trace("openfort.embeddedState", {
+					ok: false,
+					failure_mode: "unknown"
+				});
+				throw openfortProviderError("embeddedState", cause);
 			}
-			const encryptionBody = await encryptionResponse.json();
-			if (typeof encryptionBody.sessionId !== "string" || encryptionBody.sessionId.length === 0) throw Errors.providerError("openfort", "encryptionSession", /* @__PURE__ */ new Error("Openfort encryption session response missing sessionId"));
-			const embeddedState = await openfort.embeddedWallet.getEmbeddedState();
-			diagnostic?.trace("openfort.embeddedState", { state: embeddedState });
 			if (embeddedState !== EmbeddedState.READY) {
 				clearStaleOpenfortBrowserStorage(bootstrap.openfortPublishableKey);
 				diagnostic?.trace("openfort.storageCleared", { beforeConfigure: true });
@@ -5383,9 +5469,9 @@ function createOpenfortBrowserSignerFromBootstrap(bootstrap, options = {}) {
 				} catch (cause) {
 					diagnostic?.trace("openfort.configure", {
 						ok: false,
-						message: cause instanceof Error ? cause.message : String(cause)
+						failure_mode: "unknown"
 					});
-					throw cause;
+					throw openfortProviderError("configure", cause);
 				}
 			}
 			try {
@@ -5394,9 +5480,9 @@ function createOpenfortBrowserSignerFromBootstrap(bootstrap, options = {}) {
 			} catch (cause) {
 				diagnostic?.trace("openfort.get", {
 					ok: false,
-					message: cause instanceof Error ? cause.message : String(cause)
+					failure_mode: "unknown"
 				});
-				throw cause;
+				throw openfortProviderError("get", cause);
 			}
 		})();
 	}
@@ -5415,6 +5501,19 @@ function createOpenfortBrowserSignerFromBootstrap(bootstrap, options = {}) {
 	});
 	return {
 		...signer,
+		getAddress: async () => {
+			try {
+				const address = await signer.getAddress();
+				diagnostic?.trace("openfort.address", { ok: true });
+				return address;
+			} catch (cause) {
+				diagnostic?.trace("openfort.address", {
+					ok: false,
+					failure_mode: "unknown"
+				});
+				throw openfortProviderError("getAddress", cause);
+			}
+		},
 		resetSession: () => {
 			walletReadyPromise = null;
 			clearStaleOpenfortBrowserStorage(bootstrap.openfortPublishableKey);
@@ -6540,10 +6639,6 @@ function makeCurrentUserMethods(deps) {
 			deps.smartAccount.loadCurrent(options),
 			deps.orgs(options)
 		]);
-		if (!account.ok) return {
-			ok: false,
-			error: account.error
-		};
 		if (!smartAccount.ok) return {
 			ok: false,
 			error: smartAccount.error
@@ -6552,6 +6647,10 @@ function makeCurrentUserMethods(deps) {
 			ok: false,
 			error: organizations.error
 		};
+		if (!account.ok && account.error.code !== "SMART_ACCOUNT_MISSING") return {
+			ok: false,
+			error: account.error
+		};
 		return {
 			ok: true,
 			value: {
@@ -6562,10 +6661,10 @@ function makeCurrentUserMethods(deps) {
 					handle: null,
 					paymentLink: null
 				},
-				personalAccount: {
+				personalAccount: account.ok ? {
 					id: account.value.id,
 					address: smartAccount.value?.smartAccountAddress ?? null
-				},
+				} : null,
 				organizations: organizations.value.map((organization) => ({
 					id: organization.id,
 					name: organization.name,
@@ -7921,16 +8020,17 @@ async function advanceOrganizationSetup(setup, orgId, initial, signal) {
 			value: lifecycle
 		};
 		const currentStep = lifecycle.step;
-		if (signal?.aborted) {
-			const cancelled = Errors.cancelled({ operation: "organization.setup" });
-			return recordRetryableCancellation(setup, orgId, lifecycle.step, cancelled);
-		}
+		if (signal?.aborted) return recordSetupFailure(setup, orgId, Errors.cancelled({ operation: "organization.setup" }), true);
 		const stepInput = {
 			orgId,
 			...signal === void 0 ? {} : { signal }
 		};
-		const next = lifecycle.step === "preparingFounderAccount" ? await setup.prepareFounderAccount(stepInput) : lifecycle.step === "awaitingFounderAuthorization" || lifecycle.step === "submittingBootstrap" ? await setup.authorizeAndSubmitBootstrap(stepInput) : await setup.confirmSubmittedBootstrap(stepInput);
-		if (!next.ok) return next.error.code === "CANCELLED" ? recordRetryableCancellation(setup, orgId, lifecycle.step, next.error) : next;
+		const next = lifecycle.step === "preparingFounderAccount" ? await setup.prepareFounderAccount(stepInput) : lifecycle.step === "awaitingFounderAuthorization" ? await setup.authorizeAndSubmitBootstrap(stepInput) : lifecycle.step === "submittingBootstrap" ? await setup.resumeSubmittedBootstrap(stepInput) : await setup.confirmSubmittedBootstrap(stepInput);
+		if (!next.ok) {
+			if (next.error.code === "CANCELLED") return recordSetupFailure(setup, orgId, next.error, true);
+			if (next.error.code === "PROVIDER_ERROR") return recordSetupFailure(setup, orgId, next.error, isRetryableProviderFailure(next.error));
+			return next;
+		}
 		const scopedNext = validateOrganizationLifecycleScope(orgId, next.value);
 		if (!scopedNext.ok) return scopedNext;
 		lifecycle = scopedNext.value;
@@ -7953,17 +8053,20 @@ async function advanceOrganizationSetup(setup, orgId, initial, signal) {
 		]
 	}));
 }
-async function recordRetryableCancellation(setup, orgId, at, cancelled) {
+async function recordSetupFailure(setup, orgId, error, retryable) {
 	const recorded = await setup.recordFailure({
 		orgId,
-		at,
-		error: cancelled,
-		retryable: true
+		error,
+		retryable
 	});
 	if (!recorded.ok) return recorded;
 	const scopedRecorded = validateOrganizationLifecycleScope(orgId, recorded.value);
 	if (!scopedRecorded.ok) return scopedRecorded;
-	return fail$1(cancelled);
+	return fail$1(error);
+}
+function isRetryableProviderFailure(error) {
+	const mode = error.details?.failure_mode;
+	return mode !== "auth-origin-mismatch" && mode !== "app-env-allowlist" && mode !== "no-secure-context";
 }
 //#endregion
 //#region src/client/org.ts
@@ -8314,7 +8417,18 @@ async function runCompleteOrganizationOnboarding(ops, input, options) {
 	});
 	if (!started.ok) return fail(started.error);
 	const lifecycle = await advanceOrganizationSetup(setup, started.value.orgId, started.value.lifecycle, options?.signal);
-	if (!lifecycle.ok) return lifecycle;
+	if (!lifecycle.ok) {
+		const error = lifecycle.error;
+		return fail(new CapxulError(error.code, error.message, {
+			cause: error.cause,
+			details: {
+				...error.details,
+				orgId: started.value.orgId
+			},
+			...error.correlationId === void 0 ? {} : { correlationId: error.correlationId },
+			...error.layer === void 0 ? {} : { layer: error.layer }
+		}));
+	}
 	return {
 		ok: true,
 		value: {
@@ -8438,6 +8552,7 @@ function detectAuthCacheAdapter() {
 }
 //#endregion
 //#region src/client/create-capxul-client.ts
+const GET_ORGANIZATION_SETUP_PROOF_RECEIPT = makeFunctionReference("org/lifecycle:getProofReceipt");
 function assembleCapxulClient(input) {
 	const authCache = input.authCache ?? detectAuthCacheAdapter();
 	const layer = Layer.mergeAll(Layer.succeed(AuthClientPortTag, input.ports.authClient), Layer.succeed(ClockPortTag, input.ports.clock), Layer.succeed(TelemetryPortTag, input.ports.telemetry));
@@ -8561,6 +8676,7 @@ function assembleCapxulClient(input) {
 			},
 			bootstrap: input.bootstrap,
 			accounts: { fund: accounts.fund },
+			organizationSetup: { getProofReceipt: (orgId) => runPortEffect(input.ports.convexCall.query(GET_ORGANIZATION_SETUP_PROOF_RECEIPT, { orgId })) },
 			telemetry: input.ports.telemetry
 		}
 	};
@@ -8762,24 +8878,34 @@ function ignoreDeliveryFailure(delivery) {
 		Promise.resolve(delivery).catch(() => void 0);
 	} catch {}
 }
+/**
+* Map an ALREADY-sanitized observation context to the snake_case PostHog
+* property keys. Shared by the failure boundary here and the host
+* success-telemetry seam (`telemetry/from-posthog.ts`) so both attach identical
+* correlation fields from one definition.
+*/
+function observationContextProps(context) {
+	const props = {};
+	if (context?.application !== void 0) props.application = context.application;
+	if (context?.release !== void 0) props.release = context.release;
+	if (context?.sessionId !== void 0) props.session_id = context.sessionId;
+	if (context?.organizationId !== void 0) props.organization_id = context.organizationId;
+	if (context?.correlationId !== void 0) props.correlation_id = context.correlationId;
+	if (context?.anonymousId !== void 0) props.anonymous_id = context.anonymousId;
+	return props;
+}
 function postHogProperties(failure, context) {
-	const properties = {
-		sdk_version: failure.sdkVersion,
-		operation: failure.operation,
-		error_kind: failure.errorKind,
-		handled: true
-	};
 	const merged = sanitizeObservationContext({
 		...context,
 		...failure.context
 	});
-	if (merged?.application !== void 0) properties.application = merged.application;
-	if (merged?.release !== void 0) properties.release = merged.release;
-	if (merged?.sessionId !== void 0) properties.session_id = merged.sessionId;
-	if (merged?.organizationId !== void 0) properties.organization_id = merged.organizationId;
-	if (merged?.correlationId !== void 0) properties.correlation_id = merged.correlationId;
-	if (merged?.anonymousId !== void 0) properties.anonymous_id = merged.anonymousId;
-	return properties;
+	return {
+		sdk_version: failure.sdkVersion,
+		operation: failure.operation,
+		error_kind: failure.errorKind,
+		handled: true,
+		...observationContextProps(merged)
+	};
 }
 function resolveContext(context) {
 	return sanitizeObservationContext(resolveRawContext(context));
@@ -8830,7 +8956,7 @@ function normalizeErrorKind(value) {
 	return typeof value === "string" && /^[A-Za-z][A-Za-z0-9_.-]{0,63}$/u.test(value) ? value : "Error";
 }
 function syntheticException(operation, kind) {
-	const error = /* @__PURE__ */ new Error("Capxul SDK operation failed");
+	const error = /* @__PURE__ */ new Error(EXCEPTION_MESSAGE);
 	error.name = kind;
 	error.stack = `${kind}: ${error.message}\n    at CapxulSdkBoundary.${operation} (capxul-sdk-observation://boundary/${operation}:1:1)`;
 	return error;
@@ -9176,6 +9302,9 @@ async function createCapxulClient$1(input) {
 		if (signer === void 0 && runtime === "browser") signer = createOpenfortBrowserSignerFromBootstrap({
 			...adapters.value.bootstrap,
 			authBaseUrl: resolvedAuthBaseUrl
+		}, {
+			diagnostic: new ConsoleDiagnosticAdapter(),
+			telemetry: adapters.value.ports.telemetry
 		});
 		const client = wireOpenfortSignerLifecycle(assembleCapxulClient({
 			ports: adapters.value.ports,
@@ -9390,6 +9519,73 @@ async function createCapxulClient(input) {
 	return createCapxulClient$1(input);
 }
 //#endregion
-export { CAPXUL_SDK_EXPECTED_OUTCOME_EVENT, CapxulError, captureException, captureExceptionSync, createCapxulClient, deriveDevPrivateKey, devPrivateKeySigner, eip1193AccountProvider, embeddedSigner, fromPostHog, injectedWalletSigner, isCapxulError, isSettingUpLifecycle, localPrivateKeyAccountProvider, openfortEmbeddedSigner, openfortEmbeddedSignerFromWallet, openfortEmbeddedWalletPort };
+//#region src/telemetry/from-posthog.ts
+/**
+* Drop props that must never cross to a host-owned external sink. Today that is
+* the `$exception` `details` blob: `captureException` serializes
+* `CapxulError.details` (e.g. `{ asset, available, required }`, `{ name }`,
+* `{ accountId }` — errors.ts) into it, and the shared redactor has no
+* `$exception` rule, so it is stripped here at the boundary (infra#1037). The
+* safe fields (error code, operation, failure_mode, the fixed leak-safe message,
+* stack frames) are preserved.
+*/
+function stripHostUnsafeProps(props) {
+	if (props === void 0) return void 0;
+	const { details: _details, ...safe } = props;
+	return safe;
+}
+/**
+* Adapt the host's already-initialized posthog-like client into a
+* `TelemetryPort` for the `telemetry` prop / input. This port SUPPLANTS the
+* SDK's no-op default telemetry sink (`production.ts` binds it via
+* `Layer.succeed`, not `compose` — there is no client-side success relay to
+* compose with); it is additive to Capxul's backend first-party record and
+* never owns the client.
+*/
+function telemetryFromPostHog(client, options = {}) {
+	const active = () => {
+		if (client === null || client === void 0) return false;
+		try {
+			return typeof options.enabled === "function" ? options.enabled() : options.enabled ?? true;
+		} catch {
+			return false;
+		}
+	};
+	const contextProps = () => {
+		let raw;
+		try {
+			raw = typeof options.context === "function" ? options.context() : options.context;
+		} catch {
+			return {};
+		}
+		return observationContextProps(sanitizeObservationContext(raw));
+	};
+	return new PostHogTelemetryAdapter({
+		capture: (name, props) => {
+			if (!active() || client === null || client === void 0) return;
+			client.capture(name, {
+				...stripHostUnsafeProps(props),
+				...contextProps()
+			});
+		},
+		identify: (input) => {
+			if (!active() || client?.identify === void 0) return;
+			client.identify(input.distinctId, {
+				...input.traits,
+				...input.properties
+			});
+		},
+		group: (input) => {
+			if (!active() || client?.group === void 0) return;
+			client.group(input.groupType, input.groupKey, input.properties === void 0 ? void 0 : { ...input.properties });
+		},
+		reset: () => {
+			if (!active() || client?.reset === void 0) return;
+			client.reset();
+		}
+	});
+}
+//#endregion
+export { CAPXUL_SDK_EXPECTED_OUTCOME_EVENT, CapxulError, captureException, captureExceptionSync, createCapxulClient, deriveDevPrivateKey, devPrivateKeySigner, eip1193AccountProvider, embeddedSigner, fromPostHog, injectedWalletSigner, isCapxulError, isSettingUpLifecycle, localPrivateKeyAccountProvider, openfortEmbeddedSigner, openfortEmbeddedSignerFromWallet, openfortEmbeddedWalletPort, telemetryFromPostHog };
 
 //# sourceMappingURL=index.mjs.map