@capxul/sdk 1.2.2 → 1.2.3

package/dist/index.mjs

@@ -1,5 +1,5 @@
-import { A as OBSERVATION_CONTEXT_HEADER, B as normalizeBindingEmail, C as convexCallErrorFromCapxul, D as bootstrapErrorFromCapxul, E as BootstrapPortTag, F as isSettingUpLifecycle, I as formatTraceparent, L as EXCEPTION_MESSAGE, M as sanitizeObservationContext, N as CAPXUL_FUNCTIONS, O as authClientPortFromPromiseAdapter, P as BootstrapEnvelope, R as captureException, S as ConvexCallPortTag, T as ClockPortTag, U as destination, V as BASE_SEPOLIA_CHAIN_ID, _ as identityErrorFromCapxul, a as redactTelemetryProps, b as markFailureInvocationSnapshot, c as smartAccountErrorFromCapxul, d as fromWei, f as AccountReadPortTag, g as IdentityPortTag, h as wireChainId, j as encodeObservationContextHeader, k as AuthClientPortTag, l as SubAccountPortTag, m as toWei, n as detectAuthCacheAdapter, o as stampTelemetryEnvelope, p as accountReadErrorFromCapxul, r as TelemetryPortTag, s as SmartAccountPortTag, t as assembleCapxulClient, u as subAccountErrorFromCapxul, v as copyInvocationObservation, w as ClockError, x as readInvocationObservation, y as hasFailureInvocationSnapshot, z as captureExceptionSync } from "./create-capxul-client-DVzm78RU.mjs";
-import { A as decodeConvexError, C as toJwtToken, D as toRoleKey, E as toPublishableKey, M as EXPECTED_OPERATION_OUTCOMES, N as Errors, O as toSessionToken, P as isCapxulError, S as toEpochSeconds, T as toOrgId, _ as toCountryCode, b as toEmail, d as toAccountId, f as toAddress, g as toChainId, h as toAuthUserId, j as CapxulError, k as toSubAccountId, o as AuthCachePortTag, p as toAllowedOrigin, v as toCurrencyCode, w as toKycTier, x as toEpochMs, y as toDurationMs } from "./InMemoryAuthCacheAdapter-Dr1sEd9y.mjs";
+import { A as version, B as readInvocationObservation, C as convexCallErrorFromCapxul, D as bootstrapErrorFromCapxul, E as BootstrapPortTag, F as BootstrapEnvelope, H as captureExceptionSync, I as EngineeringTelemetryBootstrapPolicy, K as destination, L as isSettingUpLifecycle, M as encodeObservationContextHeader, N as sanitizeObservationContext, O as authClientPortFromPromiseAdapter, P as CAPXUL_FUNCTIONS, R as formatTraceparent, S as ConvexCallPortTag, T as ClockPortTag, U as normalizeBindingEmail, V as captureException, W as BASE_SEPOLIA_CHAIN_ID, _ as accountReadErrorFromCapxul, a as observeFailedResult, b as IdentityPortTag, c as PostHogTelemetryLayer, d as SmartAccountPortTag, f as smartAccountErrorFromCapxul, g as AccountReadPortTag, h as fromWei, i as observationContextProps, j as OBSERVATION_CONTEXT_HEADER, k as AuthClientPortTag, l as TelemetryPortTag, m as subAccountErrorFromCapxul, n as postHogProductTelemetry, o as postHogFailureObservation, p as SubAccountPortTag, r as CAPXUL_SDK_EXPECTED_OUTCOME_EVENT, s as detectAuthCacheAdapter, t as assembleCapxulClient, v as toWei, w as ClockError, x as identityErrorFromCapxul, y as wireChainId, z as copyInvocationObservation } from "./create-capxul-client-BTnlLLag.mjs";
+import { A as decodeConvexError, C as toJwtToken, D as toRoleKey, E as toPublishableKey, N as Errors, O as toSessionToken, P as isCapxulError, S as toEpochSeconds, T as toOrgId, _ as toCountryCode, b as toEmail, d as toAccountId, f as toAddress, g as toChainId, h as toAuthUserId, j as CapxulError, k as toSubAccountId, o as AuthCachePortTag, p as toAllowedOrigin, v as toCurrencyCode, w as toKycTier, x as toEpochMs, y as toDurationMs } from "./InMemoryAuthCacheAdapter-Dr1sEd9y.mjs";
 import { keccak256, recoverAddress, stringToHex } from "viem";
 import { Cause, Context, Data, Effect, Exit, Layer, Result, SchemaIssue, SchemaParser, Scope, Tracer } from "effect";
 import { getFunctionName, makeFunctionReference } from "convex/server";
@@ -304,9 +304,6 @@ async function recoverRawDigestSigner(input) {
 	}
 }
 //#endregion
-//#region package.json
-var version = "1.2.2";
-//#endregion
 //#region ../observability/src/engineering.ts
 const SAFE_TRACED_HEADER_NAMES = [
 	"content-length",
@@ -346,7 +343,7 @@ const validateEngineeringTelemetryConfig = (config) => {
 	} catch {
 		throw new TypeError("engineering telemetry host must be an absolute HTTPS URL");
 	}
-	if (url.protocol !== "https:" || url.username.length > 0 || url.password.length > 0 || url.pathname !== "/" || url.search.length > 0 || url.hash.length > 0) throw new TypeError("engineering telemetry host must be a credential-free HTTPS origin");
+	if (url.protocol !== "https:" || url.username.length > 0 || url.password.length > 0 || url.pathname !== "/" || url.search.length > 0 || url.hash.length > 0 || !(url.hostname === "posthog.com" || url.hostname.endsWith(".posthog.com"))) throw new TypeError("engineering telemetry host must be a credential-free HTTPS origin");
 	if (!ENGINEERING_CAPXUL_ENVS.has(config.capxulEnv)) throw new TypeError("engineering telemetry capxulEnv is not canonical");
 	if (!ENGINEERING_PRODUCERS.has(config.producer)) throw new TypeError("engineering telemetry producer is not canonical");
 	if (!SAFE_RESOURCE_VALUE.test(config.sdkVersion)) throw new TypeError("engineering telemetry sdkVersion must be a bounded safe value");
@@ -420,10 +417,12 @@ function resolveAuthClientUrl(authBaseUrl, path) {
 //#endregion
 //#region src/internal/observation-http.ts
 /** Resolve one bounded pre-auth snapshot for an outbound SDK HTTP request. */
-function observationRequestHeaders(adapter) {
+function observationRequestHeaders(adapter, source) {
 	if (adapter === void 0) return {};
 	try {
-		const encoded = encodeObservationContextHeader(adapter.resolveContext?.());
+		const invocation = readInvocationObservation(source);
+		if (invocation !== void 0 && !invocation.active) return {};
+		const encoded = encodeObservationContextHeader(invocation === void 0 ? adapter.resolveContext?.() : invocation.context);
 		return encoded === void 0 ? {} : { [OBSERVATION_CONTEXT_HEADER]: encoded };
 	} catch {
 		return {};
@@ -519,7 +518,7 @@ var BetterAuthBrowserAdapter = class {
 				method: "POST",
 				headers: {
 					"Content-Type": "application/json",
-					...observationRequestHeaders(this.observation)
+					...observationRequestHeaders(this.observation, input)
 				},
 				body: JSON.stringify({
 					email: input.email,
@@ -937,7 +936,7 @@ var BetterAuthNodeAdapter = class {
 				headers: {
 					"content-type": "application/json",
 					...this.origin ? { origin: this.origin } : {},
-					...observationRequestHeaders(this.observation)
+					...observationRequestHeaders(this.observation, input)
 				},
 				body: JSON.stringify({
 					email: input.email,
@@ -1192,20 +1191,28 @@ var HttpBootstrapAdapter = class {
 		if (res.ok) return Effect.tryPromise({
 			try: async () => {
 				const body = await res.json();
-				const decoded = SchemaParser.decodeUnknownResult(BootstrapEnvelope)(body);
+				const state = typeof body === "object" && body !== null && "state" in body && typeof body.state === "object" && body.state !== null ? body.state : void 0;
+				const rawEngineeringTelemetry = state?.engineeringTelemetry;
+				const baseBody = state === void 0 || rawEngineeringTelemetry === void 0 ? body : {
+					...body,
+					state: Object.fromEntries(Object.entries(state).filter(([key]) => key !== "engineeringTelemetry"))
+				};
+				const decoded = SchemaParser.decodeUnknownResult(BootstrapEnvelope)(baseBody);
 				if (Result.isFailure(decoded)) throw Errors.invalidInput("bootstrapEnvelope", SchemaIssue.makeFormatterDefault()(decoded.failure));
-				const { state } = decoded.success;
+				const { state: decodedState } = decoded.success;
+				const decodedEngineeringTelemetry = rawEngineeringTelemetry === void 0 ? void 0 : SchemaParser.decodeUnknownResult(EngineeringTelemetryBootstrapPolicy)(rawEngineeringTelemetry, { onExcessProperty: "error" });
 				return {
-					applicationId: state.applicationId,
-					chainId: state.chainId,
-					sessionToken: state.sessionToken,
-					issuedAt: state.issuedAt,
-					expiresIn: state.expiresIn,
-					authBaseUrl: normalizeRuntimeUrl("authBaseUrl", state.authBaseUrl),
-					convexUrl: normalizeRuntimeUrl("convexUrl", state.convexUrl),
-					siteBaseUrl: normalizeRuntimeUrl("siteBaseUrl", state.siteBaseUrl),
-					openfortPublishableKey: state.openfortPublishableKey,
-					shieldPublishableKey: state.shieldPublishableKey
+					applicationId: decodedState.applicationId,
+					chainId: decodedState.chainId,
+					sessionToken: decodedState.sessionToken,
+					issuedAt: decodedState.issuedAt,
+					expiresIn: decodedState.expiresIn,
+					authBaseUrl: normalizeRuntimeUrl("authBaseUrl", decodedState.authBaseUrl),
+					convexUrl: normalizeRuntimeUrl("convexUrl", decodedState.convexUrl),
+					siteBaseUrl: normalizeRuntimeUrl("siteBaseUrl", decodedState.siteBaseUrl),
+					openfortPublishableKey: decodedState.openfortPublishableKey,
+					shieldPublishableKey: decodedState.shieldPublishableKey,
+					...decodedEngineeringTelemetry !== void 0 && Result.isSuccess(decodedEngineeringTelemetry) ? { engineeringTelemetry: decodedEngineeringTelemetry.success } : {}
 				};
 			},
 			catch: (cause) => {
@@ -1631,7 +1638,6 @@ var ConvexSmartAccountAdapter = class {
 		return this.#convex.action(this.#fns.confirmDeployment, {
 			chainId: wireChainId(input.chainId),
 			safeAddress: input.safeAddress,
-			...input.telemetryRunId === void 0 ? {} : { telemetryRunId: input.telemetryRunId },
 			evidence
 		}).pipe(Effect.mapError((error) => smartAccountErrorFromCapxul("confirmDeployment", error.publicError, error)), Effect.flatMap((row) => Effect.try({
 			try: () => brandProvisionedSmartAccount(input.authUserId, row),
@@ -1641,8 +1647,7 @@ var ConvexSmartAccountAdapter = class {
 	claim(input) {
 		return this.#convex.action(this.#fns.claim, copyInvocationObservation(input, {
 			chainId: wireChainId(input.chainId),
-			signerAddress: input.signerAddress,
-			...input.telemetryRunId === void 0 ? {} : { telemetryRunId: input.telemetryRunId }
+			signerAddress: input.signerAddress
 		})).pipe(Effect.mapError((error) => smartAccountErrorFromCapxul("claim", error.publicError, error)), Effect.flatMap((row) => Effect.try({
 			try: () => brandProvisionedSmartAccount(input.authUserId, row),
 			catch: (cause) => smartAccountErrorFromUnknown("claim", cause)
@@ -2154,90 +2159,6 @@ function fail(error) {
 	};
 }
 //#endregion
-//#region src/adapters/telemetry/PostHogTelemetryAdapter.ts
-var PostHogTelemetryAdapter = class {
-	#capture;
-	#identify;
-	#group;
-	#reset;
-	constructor(deps) {
-		this.#capture = deps.capture;
-		this.#identify = deps.identify ?? (() => void 0);
-		this.#group = deps.group ?? (() => void 0);
-		this.#reset = deps.reset ?? (() => void 0);
-	}
-	emit(event) {
-		return this.#run(() => this.#capture(event.name, redactTelemetryProps(event.name, cloneProps(event.props))), "emit", event.name);
-	}
-	identify(input) {
-		return this.#run(() => this.#identify(cloneIdentifyInput(input)), "identify");
-	}
-	group(input) {
-		return this.#run(() => this.#group(cloneGroupInput(input)), "group");
-	}
-	reset() {
-		return this.#run(() => this.#reset(), "reset");
-	}
-	#run(operation, operationName, eventName) {
-		const diagnose = Effect.logWarning("product.telemetry.transport.dropped").pipe(Effect.annotateLogs({
-			operation: operationName,
-			...eventName === void 0 ? {} : { product_event: eventName }
-		}), Effect.catchCause(() => Effect.void));
-		return Effect.suspend(() => {
-			let pending;
-			try {
-				pending = operation();
-			} catch {
-				return diagnose;
-			}
-			if (pending === void 0) return Effect.void;
-			const transport = Effect.tryPromise({
-				try: () => pending,
-				catch: () => void 0
-			}).pipe(Effect.catch(() => diagnose));
-			return Effect.forkDetach(transport, { startImmediately: true }).pipe(Effect.asVoid);
-		});
-	}
-};
-function PostHogTelemetryLayer(deps) {
-	return Layer.succeed(TelemetryPortTag, new PostHogTelemetryAdapter(deps));
-}
-function cloneIdentifyInput(input) {
-	const traits = input.traits === void 0 ? void 0 : cloneProps(input.traits);
-	const properties = input.properties === void 0 ? void 0 : cloneProps(input.properties);
-	return {
-		distinctId: input.distinctId,
-		...input.anonDistinctId === void 0 ? {} : { anonDistinctId: input.anonDistinctId },
-		...traits === void 0 ? {} : { traits },
-		...properties === void 0 ? {} : { properties }
-	};
-}
-function cloneGroupInput(input) {
-	const properties = input.properties === void 0 ? void 0 : cloneProps(input.properties);
-	return properties === void 0 ? {
-		groupType: input.groupType,
-		groupKey: input.groupKey
-	} : {
-		groupType: input.groupType,
-		groupKey: input.groupKey,
-		properties
-	};
-}
-function cloneProps(props) {
-	if (props === void 0) return void 0;
-	const cloned = {};
-	for (const [key, value] of Object.entries(props)) cloned[key] = cloneTelemetryValue(value);
-	return cloned;
-}
-function cloneTelemetryValue(value) {
-	if (Array.isArray(value)) return value.map(cloneTelemetryValue);
-	if (value === null || typeof value !== "object") return value;
-	if (Object.getPrototypeOf(value) !== Object.prototype) return value;
-	const cloned = {};
-	for (const [key, nested] of Object.entries(value)) cloned[key] = cloneTelemetryValue(nested);
-	return cloned;
-}
-//#endregion
 //#region src/adapters/diagnostic/ConsoleDiagnosticAdapter.ts
 const DEFAULT_ACCOUNT_SETUP_LOG_PREFIX = "[capxul:account-setup]";
 var ConsoleDiagnosticAdapter = class {
@@ -2497,220 +2418,73 @@ function normalizeBetterAuthBaseUrl(raw) {
 	return trimmed.endsWith("/api/auth") ? trimmed : `${trimmed}/api/auth`;
 }
 //#endregion
-//#region src/observation.ts
-const SDK_VERSION$1 = version;
-/** Stable PostHog event used for typed failures that are expected product outcomes. */
-const CAPXUL_SDK_EXPECTED_OUTCOME_EVENT = "capxul_sdk_expected_outcome";
-/**
-* Adapt the host's already-initialized PostHog-like client. This function does
-* not import, initialize, configure, or own PostHog.
-*/
-function fromPostHog(client, options = {}) {
-	const prepare = (failure) => {
-		if (!isEnabled(options.enabled)) return;
-		if (client === null || client === void 0) return;
-		const safeFailure = sanitizeFailureObservation(failure);
-		return [safeFailure, postHogProperties(safeFailure, hasFailureInvocationSnapshot(failure) ? void 0 : resolveContext(options.context))];
-	};
-	const captureOperationFailure = (failure) => {
-		const prepared = prepare(failure);
-		if (prepared === void 0 || client === null || client === void 0) return;
-		const [safeFailure, properties] = prepared;
-		if (classifyOperationOutcome(safeFailure.errorKind) === "expected") {
-			if (typeof client.capture !== "function") return;
-			deliver(() => client.capture(CAPXUL_SDK_EXPECTED_OUTCOME_EVENT, {
-				...properties,
-				outcome_class: "expected"
-			}));
-			return;
+//#region src/host-observability.ts
+const HOST_INVOCATION = Symbol("capxul.host-observability-invocation");
+/** Build the SDK's one host module around an already-initialized PostHog client. */
+function postHogObservability(client, options = {}) {
+	const inactive = Object.freeze({
+		active: false,
+		contextProps: Object.freeze({})
+	});
+	const snapshot = () => {
+		if (client === null || client === void 0) return inactive;
+		try {
+			if (!(typeof options.enabled === "function" ? options.enabled() : options.enabled ?? true)) return inactive;
+			const sanitized = sanitizeObservationContext(typeof options.context === "function" ? options.context() : options.context);
+			const context = sanitized === void 0 ? void 0 : Object.freeze({ ...sanitized });
+			return Object.freeze({
+				active: true,
+				...context === void 0 ? {} : { context },
+				contextProps: Object.freeze(observationContextProps(context))
+			});
+		} catch {
+			return inactive;
 		}
-		deliver(() => client.capture("$exception", postHogExceptionProperties(safeFailure, properties)));
-	};
-	const captureException = (failure) => {
-		const prepared = prepare(failure);
-		if (prepared === void 0 || client === null || client === void 0) return;
-		const [safeFailure, properties] = prepared;
-		deliver(() => client.capture("$exception", postHogExceptionProperties(safeFailure, properties)));
 	};
-	return {
-		resolveContext: () => {
-			if (!isEnabled(options.enabled) || client === null || client === void 0) return void 0;
-			return resolveRawContext(options.context) ?? {};
-		},
-		captureOperationFailure,
-		captureException
+	const policy = {
+		client,
+		capxulEnv: options.capxulEnv ?? "unknown",
+		snapshot,
+		deliver: (capture) => {
+			try {
+				const delivery = capture();
+				if (isPromiseLike(delivery)) Promise.resolve(delivery).catch(() => void 0);
+			} catch {}
+		}
 	};
-}
-function classifyOperationOutcome(kind) {
-	return EXPECTED_OPERATION_OUTCOMES.has(kind) ? "expected" : "unexpected";
-}
-function deliver(capture) {
-	try {
-		ignoreDeliveryFailure(capture());
-	} catch {}
-}
-/** @internal Reports a factory-level typed failure without changing its identity. */
-function observeFailedResult(result, adapter, operation) {
-	if (adapter !== void 0 && isFailedResult(result)) report(adapter, "operation", operation, result.error, resolveAdapterContext(adapter));
-	return result;
-}
-function report(adapter, kind, operation, cause, invocationContext) {
-	const operationName = normalizeOperation(operation);
-	const kindName = normalizeErrorKind(errorKind(cause));
-	const context = sanitizeObservationContext({
-		...invocationContext,
-		...isCapxulError(cause) && cause.correlationId !== void 0 ? { correlationId: cause.correlationId } : {}
-	});
-	const failure = markFailureInvocationSnapshot({
-		exception: syntheticException(operationName, kindName),
-		sdkVersion: SDK_VERSION$1,
-		operation: operationName,
-		errorKind: kindName,
-		...context === void 0 ? {} : { context }
-	});
-	try {
-		ignoreDeliveryFailure(kind === "operation" ? adapter.captureOperationFailure(failure) : adapter.captureException(failure));
-	} catch {}
-}
-function resolveAdapterContext(adapter) {
-	try {
-		return adapter.resolveContext?.();
-	} catch {
-		return;
-	}
-}
-function ignoreDeliveryFailure(delivery) {
-	if (!isPromiseLike(delivery)) return;
-	try {
-		Promise.resolve(delivery).catch(() => void 0);
-	} catch {}
-}
-/**
-* Map an ALREADY-sanitized observation context to the snake_case PostHog
-* property keys. Shared by the failure boundary here and the host
-* success-telemetry seam (`telemetry/from-posthog.ts`) so both attach identical
-* correlation fields from one definition.
-*/
-function observationContextProps(context) {
-	const props = {};
-	if (context?.application !== void 0) props.application = context.application;
-	if (context?.release !== void 0) props.release = context.release;
-	if (context?.sessionId !== void 0) props.session_id = context.sessionId;
-	if (context?.organizationId !== void 0) props.organization_id = context.organizationId;
-	if (context?.journeyId !== void 0) props.journey_id = context.journeyId;
-	if (context?.correlationId !== void 0) props.correlation_id = context.correlationId;
-	if (context?.anonymousId !== void 0) props.anonymous_id = context.anonymousId;
-	return props;
-}
-function postHogProperties(failure, context) {
-	const merged = sanitizeObservationContext({
-		...context,
-		...failure.context
-	});
-	return {
-		sdk_version: failure.sdkVersion,
-		operation: failure.operation,
-		error_kind: failure.errorKind,
-		handled: true,
-		...observationContextProps(merged)
+	const module = {
+		failures: postHogFailureObservation(policy),
+		product: postHogProductTelemetry(policy)
 	};
-}
-function postHogExceptionProperties(failure, properties) {
-	const filename = `capxul-sdk-observation://boundary/${failure.operation}`;
-	return {
-		...properties,
-		$exception_type: failure.errorKind,
-		$exception_message: EXCEPTION_MESSAGE,
-		$exception_level: "error",
-		$exception_list: [{
-			type: failure.errorKind,
-			value: EXCEPTION_MESSAGE,
-			mechanism: {
-				type: "capxul_sdk_boundary",
-				handled: true,
-				synthetic: true
+	Object.defineProperty(module, HOST_INVOCATION, {
+		enumerable: false,
+		value: {
+			bind: () => {
+				const invocation = snapshot();
+				return {
+					failures: postHogFailureObservation(policy, invocation),
+					product: postHogProductTelemetry(policy, invocation)
+				};
 			},
-			stacktrace: {
-				type: "raw",
-				frames: [{
-					platform: "javascript",
-					filename,
-					function: `CapxulSdkBoundary.${failure.operation}`,
-					lineno: 1,
-					colno: 1,
-					in_app: true
-				}]
-			}
-		}]
-	};
-}
-function resolveContext(context) {
-	return sanitizeObservationContext(resolveRawContext(context));
-}
-/** Resolve the host context closure without sanitizing — the call-start snapshot. */
-function resolveRawContext(context) {
-	try {
-		return typeof context === "function" ? context() : context;
-	} catch {
-		return;
-	}
-}
-function isEnabled(enabled) {
-	try {
-		return typeof enabled === "function" ? enabled() : enabled ?? true;
-	} catch {
-		return false;
-	}
-}
-function errorKind(cause) {
-	try {
-		if (isCapxulError(cause)) return normalizeErrorKind(cause.code);
-		if (cause instanceof Error) return normalizeErrorKind(cause.name);
-		return "UnknownFailure";
-	} catch {
-		return "Error";
-	}
-}
-function sanitizeFailureObservation(failure) {
-	const operation = normalizeOperation(failure.operation);
-	const kind = normalizeErrorKind(failure.errorKind);
-	const context = sanitizeObservationContext(failure.context);
-	return {
-		exception: syntheticException(operation, kind),
-		sdkVersion: normalizeSdkVersion(failure.sdkVersion),
-		operation,
-		errorKind: kind,
-		...context === void 0 ? {} : { context }
+			snapshot
+		}
+	});
+	return module;
+}
+/** @internal Bind both projections to one call-start decision/context snapshot. */
+function bindHostObservabilityInvocation(observability) {
+	return observability?.[HOST_INVOCATION]?.bind() ?? observability;
+}
+/** @internal Read one call-start snapshot for actor/transition carriage. */
+function snapshotHostObservability(observability) {
+	const snapshot = observability?.[HOST_INVOCATION]?.snapshot();
+	return snapshot === void 0 ? void 0 : {
+		active: snapshot.active,
+		...snapshot.context === void 0 ? {} : { context: snapshot.context }
 	};
 }
-function normalizeSdkVersion(value) {
-	return typeof value === "string" && /^[A-Za-z0-9][A-Za-z0-9.+_-]{0,127}$/u.test(value) ? value : "unknown";
-}
-function normalizeOperation(value) {
-	return typeof value === "string" && /^[A-Za-z0-9_][A-Za-z0-9_.-]{0,255}$/u.test(value) ? value : "unknown";
-}
-function normalizeErrorKind(value) {
-	return typeof value === "string" && /^[A-Za-z][A-Za-z0-9_.-]{0,63}$/u.test(value) ? value : "Error";
-}
-function syntheticException(operation, kind) {
-	const error = new Error(EXCEPTION_MESSAGE);
-	error.name = kind;
-	error.stack = `${kind}: ${error.message}\n    at CapxulSdkBoundary.${operation} (capxul-sdk-observation://boundary/${operation}:1:1)`;
-	return error;
-}
 function isPromiseLike(value) {
-	return (typeof value === "object" || typeof value === "function") && value !== null && typeof value.then === "function";
-}
-function isPlainObject(value) {
-	if (typeof value !== "object" || value === null) return false;
-	const prototype = Object.getPrototypeOf(value);
-	return prototype === Object.prototype || prototype === null;
-}
-function isCapxulResult(value) {
-	return isPlainObject(value) && typeof value.ok === "boolean";
-}
-function isFailedResult(value) {
-	return isCapxulResult(value) && value.ok === false && "error" in value;
+	return (typeof value === "object" && value !== null || typeof value === "function") && "then" in value;
 }
 const SDK_VERSION = version;
 /**
@@ -2863,7 +2637,19 @@ function productionConvexCallLayer(input, refreshConvexAuthRef) {
 function isRefreshableConvexCallPort(convexCall) {
 	return "refreshAuth" in convexCall && typeof convexCall.refreshAuth === "function";
 }
+function resolveProductionObservability(input) {
+	const observation = input.observability?.failures ?? input.observation;
+	const telemetry = input.observability?.product ?? input.telemetry;
+	const invocationObservability = input.invocationObservability;
+	return {
+		observation,
+		telemetry,
+		invocationObservation: invocationObservability?.failures ?? observation,
+		invocationTelemetry: invocationObservability?.product ?? telemetry
+	};
+}
 async function createProductionAdapters(input) {
+	const { observation, telemetry, invocationObservation, invocationTelemetry } = resolveProductionObservability(input);
 	const resolvedInput = resolveInput(input);
 	if (!resolvedInput.ok) return resolvedInput;
 	const scope = await Effect.runPromise(Scope.make());
@@ -2871,7 +2657,7 @@ async function createProductionAdapters(input) {
 	const bootstrapLayer = HttpBootstrapLayer({
 		bootstrapBaseUrl: resolvedInput.value.bootstrapBaseUrl,
 		...input.fetch === void 0 ? {} : { fetch: input.fetch },
-		...input.observation === void 0 ? {} : { observation: input.observation }
+		...invocationObservation === void 0 ? {} : { observation: invocationObservation }
 	});
 	try {
 		const bootstrapContext = await Effect.runPromise(Layer.buildWithScope(bootstrapLayer, scope));
@@ -2881,7 +2667,7 @@ async function createProductionAdapters(input) {
 			...resolvedInput.value.origin === void 0 ? {} : { origin: resolvedInput.value.origin }
 		}));
 		if (!bootstrapResult.ok) {
-			await emitBootstrapTelemetry(input.telemetry, {
+			await emitBootstrapTelemetry(invocationTelemetry, {
 				name: "bootstrap_failed",
 				props: {
 					...bootstrapTelemetryEnvelope(input, resolvedInput.value),
@@ -2898,7 +2684,7 @@ async function createProductionAdapters(input) {
 		}
 		const runtimeUrlsResult = resolveRuntimeUrls(bootstrapResult.value, resolvedInput.value.runtime, input.authBaseUrl);
 		if (!runtimeUrlsResult.ok) {
-			await emitBootstrapTelemetry(input.telemetry, {
+			await emitBootstrapTelemetry(invocationTelemetry, {
 				name: "bootstrap_failed",
 				props: {
 					...bootstrapTelemetryEnvelope(input, resolvedInput.value),
@@ -2910,7 +2696,7 @@ async function createProductionAdapters(input) {
 			return runtimeUrlsResult;
 		}
 		const runtimeUrls = runtimeUrlsResult;
-		await emitBootstrapTelemetry(input.telemetry, {
+		await emitBootstrapTelemetry(invocationTelemetry, {
 			name: "bootstrap_resolved",
 			props: {
 				...bootstrapTelemetryEnvelope(input, resolvedInput.value),
@@ -2935,19 +2721,15 @@ async function createProductionAdapters(input) {
 			runtimeUrls: runtimeUrls.value,
 			chainId: bootstrapResult.value.chainId,
 			applicationId: bootstrapResult.value.applicationId,
-			...input.observation === void 0 ? {} : { observation: input.observation },
+			...observation === void 0 ? {} : { observation },
 			...input.authCache === void 0 ? {} : { authCache: input.authCache },
-			...input.telemetry === void 0 ? {} : { telemetry: input.telemetry },
+			...telemetry === void 0 ? {} : { telemetry },
 			...injectedClient === void 0 ? {} : { convexClient: injectedClient },
 			...input.fetch === void 0 ? {} : { fetch: input.fetch },
 			...input.signal === void 0 ? {} : { signal: input.signal },
 			...input.resetSignerSession === void 0 ? {} : { resetSignerSession: input.resetSignerSession }
 		}));
-		const applicationLayer = input.engineeringTelemetry === void 0 ? portsLayer : Layer.merge(portsLayer, makeEngineeringTelemetryLayer({
-			...input.engineeringTelemetry,
-			producer: resolvedInput.value.runtime === "browser" ? "browser" : "server",
-			sdkVersion: SDK_VERSION
-		}));
+		const applicationLayer = Layer.merge(portsLayer, optionalEngineeringTelemetryLayer(bootstrapResult.value.engineeringTelemetry, resolvedInput.value.runtime));
 		const context = await Effect.runPromise(Layer.buildWithScope(applicationLayer, scope));
 		return {
 			ok: true,
@@ -2966,6 +2748,20 @@ async function createProductionAdapters(input) {
 		};
 	}
 }
+function optionalEngineeringTelemetryLayer(policy, runtime) {
+	if (policy === void 0) return Layer.empty;
+	try {
+		return makeEngineeringTelemetryLayer({
+			host: policy.host,
+			headers: { authorization: `Bearer ${policy.projectToken}` },
+			capxulEnv: policy.capxulEnv,
+			producer: runtime === "browser" ? "browser" : "server",
+			sdkVersion: SDK_VERSION
+		});
+	} catch {
+		return Layer.empty;
+	}
+}
 function refreshConvexAuthOnSession(authClient, refresh) {
 	return {
 		...authClient,
@@ -2995,14 +2791,17 @@ function resetSignerSessionOnSignOut(authClient, resetRef) {
 	};
 }
 async function createCapxulClient$1(input) {
+	const invocationObservability = bindHostObservabilityInvocation(input.observability);
+	const observation = invocationObservability?.failures ?? input.observation;
 	const validation = validateCreateCapxulClientInput(input);
-	if (!validation.ok) return observeFailedResult(validation, input.observation, "createCapxulClient");
+	if (!validation.ok) return observeFailedResult(validation, observation, "createCapxulClient");
 	const resetSignerSession = { current: null };
 	const adapters = await createProductionAdapters({
 		...input,
-		resetSignerSession
+		resetSignerSession,
+		...invocationObservability === void 0 ? {} : { invocationObservability }
 	});
-	if (!adapters.ok) return observeFailedResult(adapters, input.observation, "createCapxulClient");
+	if (!adapters.ok) return observeFailedResult(adapters, observation, "createCapxulClient");
 	try {
 		const runtime = input.runtime ?? detectRuntime();
 		const resolvedAuthBaseUrl = resolveBrowserAuthBaseUrl({
@@ -3039,6 +2838,7 @@ async function createCapxulClient$1(input) {
 			...input.signal === void 0 ? {} : { signal: input.signal },
 			...input.otpTtlMs === void 0 ? {} : { otpTtlMs: input.otpTtlMs },
 			invokeTimeoutMs: input.invokeTimeoutMs ?? 3e4,
+			...input.observability === void 0 ? {} : { hostObservationSnapshot: () => snapshotHostObservability(input.observability) },
 			effectRunner: {
 				runSync: Effect.runSyncWith(adapters.value.context),
 				runPromise: Effect.runPromiseWith(adapters.value.context)
@@ -3067,7 +2867,7 @@ async function createCapxulClient$1(input) {
 		return observeFailedResult({
 			ok: false,
 			error: toPublicError(cause, "createCapxulClient")
-		}, input.observation, "createCapxulClient");
+		}, observation, "createCapxulClient");
 	}
 }
 function validateCreateCapxulClientInput(input) {
@@ -3216,80 +3016,6 @@ async function createCapxulClient(input) {
 	return createCapxulClient$1(input);
 }
 //#endregion
-//#region src/telemetry/from-posthog.ts
-/**
-* Drop props that must never cross to a host-owned external sink. Today that is
-* the `$exception` `details` blob: `captureException` serializes
-* `CapxulError.details` (e.g. `{ asset, available, required }`, `{ name }`,
-* `{ accountId }` — errors.ts) into it, and the shared redactor has no
-* `$exception` rule, so it is stripped here at the boundary (infra#1037). The
-* safe fields (error code, operation, failure_mode, the fixed leak-safe message,
-* stack frames) are preserved.
-*/
-function stripHostUnsafeProps(props) {
-	if (props === void 0) return void 0;
-	const { details: _details, ...safe } = props;
-	return safe;
-}
-/**
-* Adapt the host's already-initialized posthog-like client into a
-* `TelemetryPort` for the `telemetry` prop / input. This port SUPPLANTS the
-* SDK's no-op default telemetry sink (`production.ts` binds it via
-* `Layer.succeed`, not `compose` — there is no client-side success relay to
-* compose with); it is additive to Capxul's backend first-party record and
-* never owns the client.
-*/
-function telemetryFromPostHog(client, options = {}) {
-	const active = () => {
-		if (client === null || client === void 0) return false;
-		try {
-			return typeof options.enabled === "function" ? options.enabled() : options.enabled ?? true;
-		} catch {
-			return false;
-		}
-	};
-	const contextProps = () => {
-		let raw;
-		try {
-			raw = typeof options.context === "function" ? options.context() : options.context;
-		} catch {
-			return {};
-		}
-		return observationContextProps(sanitizeObservationContext(raw));
-	};
-	return new PostHogTelemetryAdapter({
-		capture: (name, props) => {
-			if (!active() || client === null || client === void 0) return;
-			const event = stampTelemetryEnvelope({
-				name,
-				props
-			}, {
-				capxul_env: options.capxulEnv ?? "unknown",
-				producer: "sdk"
-			});
-			client.capture(name, {
-				...stripHostUnsafeProps(event.props),
-				...contextProps()
-			});
-		},
-		identify: (input) => {
-			if (!active() || client?.identify === void 0) return;
-			client.identify(input.distinctId, {
-				...input.traits,
-				...input.properties
-			});
-		},
-		group: (input) => {
-			if (!active() || client?.group === void 0) return;
-			client.group(input.groupType, input.groupKey, input.properties === void 0 ? void 0 : { ...input.properties });
-		},
-		reset: () => {
-			if (!active() || client?.reset === void 0) return;
-			client.reset();
-		}
-	});
-}
-//#endregion
-export { CAPXUL_SDK_EXPECTED_OUTCOME_EVENT, CapxulError, captureException, captureExceptionSync, createCapxulClient, deriveDevPrivateKey, devPrivateKeySigner, eip1193AccountProvider, embeddedSigner, fromPostHog, injectedWalletSigner, isCapxulError, isSettingUpLifecycle, localPrivateKeyAccountProvider, openfortEmbeddedSigner, openfortEmbeddedSignerFromWallet, openfortEmbeddedWalletPort, destination as resolveIdentityDestination, telemetryFromPostHog, toCountryCode, toAddress as toEvmAddress };
+export { CAPXUL_SDK_EXPECTED_OUTCOME_EVENT, CapxulError, captureException, captureExceptionSync, createCapxulClient, deriveDevPrivateKey, devPrivateKeySigner, eip1193AccountProvider, embeddedSigner, injectedWalletSigner, isCapxulError, isSettingUpLifecycle, localPrivateKeyAccountProvider, openfortEmbeddedSigner, openfortEmbeddedSignerFromWallet, openfortEmbeddedWalletPort, postHogObservability, destination as resolveIdentityDestination, toCountryCode, toAddress as toEvmAddress };
 
 //# sourceMappingURL=index.mjs.map