@capxul/sdk 1.2.2 → 2.0.0

package/dist/index.mjs

@@ -1,5 +1,5 @@
-import { A as OBSERVATION_CONTEXT_HEADER, B as normalizeBindingEmail, C as convexCallErrorFromCapxul, D as bootstrapErrorFromCapxul, E as BootstrapPortTag, F as isSettingUpLifecycle, I as formatTraceparent, L as EXCEPTION_MESSAGE, M as sanitizeObservationContext, N as CAPXUL_FUNCTIONS, O as authClientPortFromPromiseAdapter, P as BootstrapEnvelope, R as captureException, S as ConvexCallPortTag, T as ClockPortTag, U as destination, V as BASE_SEPOLIA_CHAIN_ID, _ as identityErrorFromCapxul, a as redactTelemetryProps, b as markFailureInvocationSnapshot, c as smartAccountErrorFromCapxul, d as fromWei, f as AccountReadPortTag, g as IdentityPortTag, h as wireChainId, j as encodeObservationContextHeader, k as AuthClientPortTag, l as SubAccountPortTag, m as toWei, n as detectAuthCacheAdapter, o as stampTelemetryEnvelope, p as accountReadErrorFromCapxul, r as TelemetryPortTag, s as SmartAccountPortTag, t as assembleCapxulClient, u as subAccountErrorFromCapxul, v as copyInvocationObservation, w as ClockError, x as readInvocationObservation, y as hasFailureInvocationSnapshot, z as captureExceptionSync } from "./create-capxul-client-DVzm78RU.mjs";
-import { A as decodeConvexError, C as toJwtToken, D as toRoleKey, E as toPublishableKey, M as EXPECTED_OPERATION_OUTCOMES, N as Errors, O as toSessionToken, P as isCapxulError, S as toEpochSeconds, T as toOrgId, _ as toCountryCode, b as toEmail, d as toAccountId, f as toAddress, g as toChainId, h as toAuthUserId, j as CapxulError, k as toSubAccountId, o as AuthCachePortTag, p as toAllowedOrigin, v as toCurrencyCode, w as toKycTier, x as toEpochMs, y as toDurationMs } from "./InMemoryAuthCacheAdapter-Dr1sEd9y.mjs";
+import { A as encodeObservationContextHeader, B as captureExceptionSync, C as ClockPortTag, D as AuthClientPortTag, E as authClientPortFromPromiseAdapter, F as isSettingUpLifecycle, G as destination, H as normalizeBindingEmail, I as formatTraceparent, L as copyInvocationObservation, M as CAPXUL_FUNCTIONS, N as BootstrapEnvelope, O as version, P as EngineeringTelemetryBootstrapPolicy, R as readInvocationObservation, S as ClockError, T as bootstrapErrorFromCapxul, U as BASE_SEPOLIA_CHAIN_ID, V as CAPXUL_PAYMENTS_V2_ADDRESS, _ as wireChainId, a as observeFailedResult, b as ConvexCallPortTag, c as PostHogTelemetryLayer, d as SmartAccountPortTag, f as smartAccountErrorFromCapxul, g as toWei, h as accountReadErrorFromCapxul, i as observationContextProps, j as sanitizeObservationContext, k as OBSERVATION_CONTEXT_HEADER, l as TelemetryPortTag, m as AccountReadPortTag, n as postHogProductTelemetry, o as postHogFailureObservation, p as fromWei, r as CAPXUL_SDK_EXPECTED_OUTCOME_EVENT, s as detectAuthCacheAdapter, t as assembleCapxulClient, v as IdentityPortTag, w as BootstrapPortTag, x as convexCallErrorFromCapxul, y as identityErrorFromCapxul, z as captureException } from "./create-capxul-client-N36cHqE2.mjs";
+import { A as toSessionToken, C as toEpochMs, D as toOrgId, E as toKycTier, F as isCapxulError, M as CapxulError, O as toPublishableKey, P as Errors, S as toEmail, T as toJwtToken, _ as toAuthUserId, b as toCurrencyCode, h as toAllowedOrigin, j as decodeConvexError, k as toRoleKey, m as toAddress, o as AuthCachePortTag, p as toAccountId, v as toChainId, w as toEpochSeconds, x as toDurationMs, y as toCountryCode } from "./InMemoryAuthCacheAdapter-Rc8tCtml.mjs";
 import { keccak256, recoverAddress, stringToHex } from "viem";
 import { Cause, Context, Data, Effect, Exit, Layer, Result, SchemaIssue, SchemaParser, Scope, Tracer } from "effect";
 import { getFunctionName, makeFunctionReference } from "convex/server";
@@ -304,9 +304,6 @@ async function recoverRawDigestSigner(input) {
 	}
 }
 //#endregion
-//#region package.json
-var version = "1.2.2";
-//#endregion
 //#region ../observability/src/engineering.ts
 const SAFE_TRACED_HEADER_NAMES = [
 	"content-length",
@@ -346,7 +343,7 @@ const validateEngineeringTelemetryConfig = (config) => {
 	} catch {
 		throw new TypeError("engineering telemetry host must be an absolute HTTPS URL");
 	}
-	if (url.protocol !== "https:" || url.username.length > 0 || url.password.length > 0 || url.pathname !== "/" || url.search.length > 0 || url.hash.length > 0) throw new TypeError("engineering telemetry host must be a credential-free HTTPS origin");
+	if (url.protocol !== "https:" || url.username.length > 0 || url.password.length > 0 || url.pathname !== "/" || url.search.length > 0 || url.hash.length > 0 || !(url.hostname === "posthog.com" || url.hostname.endsWith(".posthog.com"))) throw new TypeError("engineering telemetry host must be a credential-free HTTPS origin");
 	if (!ENGINEERING_CAPXUL_ENVS.has(config.capxulEnv)) throw new TypeError("engineering telemetry capxulEnv is not canonical");
 	if (!ENGINEERING_PRODUCERS.has(config.producer)) throw new TypeError("engineering telemetry producer is not canonical");
 	if (!SAFE_RESOURCE_VALUE.test(config.sdkVersion)) throw new TypeError("engineering telemetry sdkVersion must be a bounded safe value");
@@ -420,10 +417,12 @@ function resolveAuthClientUrl(authBaseUrl, path) {
 //#endregion
 //#region src/internal/observation-http.ts
 /** Resolve one bounded pre-auth snapshot for an outbound SDK HTTP request. */
-function observationRequestHeaders(adapter) {
+function observationRequestHeaders(adapter, source) {
 	if (adapter === void 0) return {};
 	try {
-		const encoded = encodeObservationContextHeader(adapter.resolveContext?.());
+		const invocation = readInvocationObservation(source);
+		if (invocation !== void 0 && !invocation.active) return {};
+		const encoded = encodeObservationContextHeader(invocation === void 0 ? adapter.resolveContext?.() : invocation.context);
 		return encoded === void 0 ? {} : { [OBSERVATION_CONTEXT_HEADER]: encoded };
 	} catch {
 		return {};
@@ -519,7 +518,7 @@ var BetterAuthBrowserAdapter = class {
 				method: "POST",
 				headers: {
 					"Content-Type": "application/json",
-					...observationRequestHeaders(this.observation)
+					...observationRequestHeaders(this.observation, input)
 				},
 				body: JSON.stringify({
 					email: input.email,
@@ -937,7 +936,7 @@ var BetterAuthNodeAdapter = class {
 				headers: {
 					"content-type": "application/json",
 					...this.origin ? { origin: this.origin } : {},
-					...observationRequestHeaders(this.observation)
+					...observationRequestHeaders(this.observation, input)
 				},
 				body: JSON.stringify({
 					email: input.email,
@@ -1192,20 +1191,28 @@ var HttpBootstrapAdapter = class {
 		if (res.ok) return Effect.tryPromise({
 			try: async () => {
 				const body = await res.json();
-				const decoded = SchemaParser.decodeUnknownResult(BootstrapEnvelope)(body);
+				const state = typeof body === "object" && body !== null && "state" in body && typeof body.state === "object" && body.state !== null ? body.state : void 0;
+				const rawEngineeringTelemetry = state?.engineeringTelemetry;
+				const baseBody = state === void 0 || rawEngineeringTelemetry === void 0 ? body : {
+					...body,
+					state: Object.fromEntries(Object.entries(state).filter(([key]) => key !== "engineeringTelemetry"))
+				};
+				const decoded = SchemaParser.decodeUnknownResult(BootstrapEnvelope)(baseBody);
 				if (Result.isFailure(decoded)) throw Errors.invalidInput("bootstrapEnvelope", SchemaIssue.makeFormatterDefault()(decoded.failure));
-				const { state } = decoded.success;
+				const { state: decodedState } = decoded.success;
+				const decodedEngineeringTelemetry = rawEngineeringTelemetry === void 0 ? void 0 : SchemaParser.decodeUnknownResult(EngineeringTelemetryBootstrapPolicy)(rawEngineeringTelemetry, { onExcessProperty: "error" });
 				return {
-					applicationId: state.applicationId,
-					chainId: state.chainId,
-					sessionToken: state.sessionToken,
-					issuedAt: state.issuedAt,
-					expiresIn: state.expiresIn,
-					authBaseUrl: normalizeRuntimeUrl("authBaseUrl", state.authBaseUrl),
-					convexUrl: normalizeRuntimeUrl("convexUrl", state.convexUrl),
-					siteBaseUrl: normalizeRuntimeUrl("siteBaseUrl", state.siteBaseUrl),
-					openfortPublishableKey: state.openfortPublishableKey,
-					shieldPublishableKey: state.shieldPublishableKey
+					applicationId: decodedState.applicationId,
+					chainId: decodedState.chainId,
+					sessionToken: decodedState.sessionToken,
+					issuedAt: decodedState.issuedAt,
+					expiresIn: decodedState.expiresIn,
+					authBaseUrl: normalizeRuntimeUrl("authBaseUrl", decodedState.authBaseUrl),
+					convexUrl: normalizeRuntimeUrl("convexUrl", decodedState.convexUrl),
+					siteBaseUrl: normalizeRuntimeUrl("siteBaseUrl", decodedState.siteBaseUrl),
+					openfortPublishableKey: decodedState.openfortPublishableKey,
+					shieldPublishableKey: decodedState.shieldPublishableKey,
+					...decodedEngineeringTelemetry !== void 0 && Result.isSuccess(decodedEngineeringTelemetry) ? { engineeringTelemetry: decodedEngineeringTelemetry.success } : {}
 				};
 			},
 			catch: (cause) => {
@@ -1257,7 +1264,6 @@ function SystemClockLayer() {
 //#region src/adapters/convex-call/ConvexCallAdapter.ts
 /** Exact floor-first allowlist; every additional handler must migrate its validator first. */
 const OBSERVED_CONVEX_ACTIONS = new Set([
-	"subAccount/actions:transfer",
 	"smartAccount/actions:claim",
 	"org/actions:prepareFounderAccount",
 	"org/actions:prepareBootstrap",
@@ -1458,7 +1464,7 @@ function identityErrorFromUnknown(operation, cause) {
 }
 //#endregion
 //#region src/adapters/account-read/ConvexAccountAdapter.ts
-const DEFAULT_FUNCTIONS$4 = {
+const DEFAULT_FUNCTIONS$3 = {
 	readBalance: makeFunctionReference(CAPXUL_FUNCTIONS["account/actions"].readBalance),
 	faucetMint: makeFunctionReference(CAPXUL_FUNCTIONS["account/actions"].faucetMint)
 };
@@ -1467,7 +1473,7 @@ var ConvexAccountAdapter = class {
 	#fns;
 	constructor(deps) {
 		this.#convex = deps.convex;
-		this.#fns = deps.functions ?? DEFAULT_FUNCTIONS$4;
+		this.#fns = deps.functions ?? DEFAULT_FUNCTIONS$3;
 	}
 	readBalance(input) {
 		return this.#convex.action(this.#fns.readBalance, { chainId: wireChainId(input.chainId) }).pipe(Effect.mapError((error) => accountReadErrorFromCapxul("readBalance", error.publicError, error)), Effect.flatMap((wire) => brandAccountEffect("readBalance", wire)), Effect.catchDefect((cause) => Effect.fail(accountReadErrorFromUnknown("readBalance", cause))));
@@ -1506,92 +1512,6 @@ function accountReadErrorFromUnknown(operation, cause) {
 	return accountReadErrorFromCapxul(operation, Errors.providerError("convex", operation, cause), cause);
 }
 //#endregion
-//#region src/adapters/sub-account/ConvexSubAccountAdapter.ts
-const DEFAULT_FUNCTIONS$3 = {
-	create: makeFunctionReference(CAPXUL_FUNCTIONS["subAccount/mutations"].create),
-	get: makeFunctionReference(CAPXUL_FUNCTIONS["subAccount/queries"].get),
-	list: makeFunctionReference(CAPXUL_FUNCTIONS["subAccount/queries"].list),
-	rename: makeFunctionReference(CAPXUL_FUNCTIONS["subAccount/mutations"].rename),
-	remove: makeFunctionReference(CAPXUL_FUNCTIONS["subAccount/mutations"].remove),
-	transfer: makeFunctionReference(CAPXUL_FUNCTIONS["subAccount/actions"].transfer)
-};
-var ConvexSubAccountAdapter = class {
-	#convex;
-	#fns;
-	#chainId;
-	constructor(deps) {
-		this.#convex = deps.convex;
-		this.#chainId = deps.chainId;
-		this.#fns = deps.functions ?? DEFAULT_FUNCTIONS$3;
-	}
-	create(input) {
-		return this.#runMutation("create", this.#fns.create, {
-			accountId: input.accountId,
-			name: input.name
-		});
-	}
-	get(input) {
-		return this.#runQuery("get", this.#fns.get, { subAccountId: input.subAccountId }, (wire) => wire === null ? null : brandSubAccount(wire));
-	}
-	list(input) {
-		return this.#runQuery("list", this.#fns.list, { accountId: input.accountId }, (wires) => wires.map((wire) => brandSubAccount(wire)));
-	}
-	rename(input) {
-		return this.#runMutation("rename", this.#fns.rename, {
-			subAccountId: input.subAccountId,
-			name: input.name
-		});
-	}
-	delete(input) {
-		const operation = "delete";
-		return this.#convex.mutation(this.#fns.remove, { subAccountId: input.subAccountId }).pipe(Effect.mapError((error) => subAccountErrorFromCapxul(operation, error.publicError, error)), Effect.asVoid, Effect.catchDefect((cause) => Effect.fail(subAccountErrorFromUnknown(operation, cause))));
-	}
-	transfer(input) {
-		const operation = "transfer";
-		return Effect.suspend(() => {
-			const rawAmount = toWei(input.amount);
-			return this.#convex.action(this.#fns.transfer, copyInvocationObservation(input, {
-				chainId: this.#chainId,
-				from: input.from,
-				to: input.to,
-				rawAmount
-			}));
-		}).pipe(Effect.mapError((error) => subAccountErrorFromCapxul(operation, error.publicError, error)), Effect.map((wire) => brandTransferResult(wire)), Effect.catchDefect((cause) => Effect.fail(subAccountErrorFromUnknown(operation, cause))));
-	}
-	#runMutation(operation, ref, args) {
-		return this.#convex.mutation(ref, args).pipe(Effect.mapError((error) => subAccountErrorFromCapxul(operation, error.publicError, error)), Effect.map((wire) => brandSubAccount(wire)), Effect.catchDefect((cause) => Effect.fail(subAccountErrorFromUnknown(operation, cause))));
-	}
-	#runQuery(operation, ref, args, map) {
-		return this.#convex.query(ref, args).pipe(Effect.mapError((error) => subAccountErrorFromCapxul(operation, error.publicError, error)), Effect.map(map), Effect.catchDefect((cause) => Effect.fail(subAccountErrorFromUnknown(operation, cause))));
-	}
-};
-function ConvexSubAccountLayer(chainId) {
-	return Layer.effect(SubAccountPortTag, Effect.map(ConvexCallPortTag, (convex) => new ConvexSubAccountAdapter({
-		convex,
-		chainId
-	})));
-}
-function brandTransferResult(wire) {
-	return {
-		available: fromWei(wire.availableRaw, wire.decimals, wire.currency),
-		from: wire.from === null ? null : brandSubAccount(wire.from),
-		to: wire.to === null ? null : brandSubAccount(wire.to)
-	};
-}
-function brandSubAccount(wire) {
-	return {
-		id: toSubAccountId(wire.subAccountId),
-		accountId: toAccountId(wire.accountId),
-		name: wire.name,
-		balance: fromWei(wire.rawBalance, wire.decimals, wire.currency),
-		createdAt: toEpochMs(wire.createdAt)
-	};
-}
-function subAccountErrorFromUnknown(operation, cause) {
-	if (cause instanceof CapxulError) return subAccountErrorFromCapxul(operation, cause);
-	return subAccountErrorFromCapxul(operation, Errors.providerError("convex", operation, cause), cause);
-}
-//#endregion
 //#region src/adapters/smart-account/ConvexSmartAccountAdapter.ts
 const DEFAULT_FUNCTIONS$2 = {
 	loadByAuthUserId: makeFunctionReference(CAPXUL_FUNCTIONS["smartAccount/queries"].loadByAuthUserId),
@@ -1631,7 +1551,6 @@ var ConvexSmartAccountAdapter = class {
 		return this.#convex.action(this.#fns.confirmDeployment, {
 			chainId: wireChainId(input.chainId),
 			safeAddress: input.safeAddress,
-			...input.telemetryRunId === void 0 ? {} : { telemetryRunId: input.telemetryRunId },
 			evidence
 		}).pipe(Effect.mapError((error) => smartAccountErrorFromCapxul("confirmDeployment", error.publicError, error)), Effect.flatMap((row) => Effect.try({
 			try: () => brandProvisionedSmartAccount(input.authUserId, row),
@@ -1641,8 +1560,7 @@ var ConvexSmartAccountAdapter = class {
 	claim(input) {
 		return this.#convex.action(this.#fns.claim, copyInvocationObservation(input, {
 			chainId: wireChainId(input.chainId),
-			signerAddress: input.signerAddress,
-			...input.telemetryRunId === void 0 ? {} : { telemetryRunId: input.telemetryRunId }
+			signerAddress: input.signerAddress
 		})).pipe(Effect.mapError((error) => smartAccountErrorFromCapxul("claim", error.publicError, error)), Effect.flatMap((row) => Effect.try({
 			try: () => brandProvisionedSmartAccount(input.authUserId, row),
 			catch: (cause) => smartAccountErrorFromUnknown("claim", cause)
@@ -1690,8 +1608,6 @@ function orgErrorFromCapxul(operation, error, cause = error) {
 	});
 }
 var OrgPortTag = class extends Context.Service()("@capxul/sdk/ports/OrgPort") {};
-Context.Service()("@capxul/sdk/ports/OrgRolesDeploymentPort");
-Context.Service()("@capxul/sdk/ports/OrgSpendPort");
 //#endregion
 //#region src/adapters/org/parse.ts
 /**
@@ -1763,7 +1679,6 @@ function parseRoleDefinition(json) {
 			...raw.spend.perDay === void 0 ? {} : { perDay: parseRoleMoney(raw.spend.perDay, "perDay") },
 			...raw.spend.toRecipients === void 0 ? {} : { toRecipients: parseRoleRecipients(raw.spend.toRecipients) }
 		} },
-		...raw.subAccounts === void 0 ? {} : { subAccounts: parseRoleSubAccounts(raw.subAccounts) },
 		...typeof raw.canManageMembers === "boolean" ? { canManageMembers: raw.canManageMembers } : {},
 		...typeof raw.canManageRoles === "boolean" ? { canManageRoles: raw.canManageRoles } : {}
 	};
@@ -1784,14 +1699,6 @@ function parseRoleRecipients(raw) {
 		return toAddress(recipient);
 	});
 }
-function parseRoleSubAccounts(raw) {
-	if (raw.scope === "all") return { scope: "all" };
-	if (!Array.isArray(raw.scope)) throw new Error("Invalid role definition: subAccounts.scope must be \"all\" or an array");
-	return { scope: raw.scope.map((subAccountId) => {
-		if (typeof subAccountId !== "string") throw new Error("Invalid role definition: subAccounts.scope must be \"all\" or an array");
-		return toSubAccountId(subAccountId);
-	}) };
-}
 /** Strip the `org_` prefix + non-alphanumerics so the body re-seeds `account_`. */
 function orgIdBody(orgId) {
 	const underscore = orgId.indexOf("_");
@@ -2154,90 +2061,6 @@ function fail(error) {
 	};
 }
 //#endregion
-//#region src/adapters/telemetry/PostHogTelemetryAdapter.ts
-var PostHogTelemetryAdapter = class {
-	#capture;
-	#identify;
-	#group;
-	#reset;
-	constructor(deps) {
-		this.#capture = deps.capture;
-		this.#identify = deps.identify ?? (() => void 0);
-		this.#group = deps.group ?? (() => void 0);
-		this.#reset = deps.reset ?? (() => void 0);
-	}
-	emit(event) {
-		return this.#run(() => this.#capture(event.name, redactTelemetryProps(event.name, cloneProps(event.props))), "emit", event.name);
-	}
-	identify(input) {
-		return this.#run(() => this.#identify(cloneIdentifyInput(input)), "identify");
-	}
-	group(input) {
-		return this.#run(() => this.#group(cloneGroupInput(input)), "group");
-	}
-	reset() {
-		return this.#run(() => this.#reset(), "reset");
-	}
-	#run(operation, operationName, eventName) {
-		const diagnose = Effect.logWarning("product.telemetry.transport.dropped").pipe(Effect.annotateLogs({
-			operation: operationName,
-			...eventName === void 0 ? {} : { product_event: eventName }
-		}), Effect.catchCause(() => Effect.void));
-		return Effect.suspend(() => {
-			let pending;
-			try {
-				pending = operation();
-			} catch {
-				return diagnose;
-			}
-			if (pending === void 0) return Effect.void;
-			const transport = Effect.tryPromise({
-				try: () => pending,
-				catch: () => void 0
-			}).pipe(Effect.catch(() => diagnose));
-			return Effect.forkDetach(transport, { startImmediately: true }).pipe(Effect.asVoid);
-		});
-	}
-};
-function PostHogTelemetryLayer(deps) {
-	return Layer.succeed(TelemetryPortTag, new PostHogTelemetryAdapter(deps));
-}
-function cloneIdentifyInput(input) {
-	const traits = input.traits === void 0 ? void 0 : cloneProps(input.traits);
-	const properties = input.properties === void 0 ? void 0 : cloneProps(input.properties);
-	return {
-		distinctId: input.distinctId,
-		...input.anonDistinctId === void 0 ? {} : { anonDistinctId: input.anonDistinctId },
-		...traits === void 0 ? {} : { traits },
-		...properties === void 0 ? {} : { properties }
-	};
-}
-function cloneGroupInput(input) {
-	const properties = input.properties === void 0 ? void 0 : cloneProps(input.properties);
-	return properties === void 0 ? {
-		groupType: input.groupType,
-		groupKey: input.groupKey
-	} : {
-		groupType: input.groupType,
-		groupKey: input.groupKey,
-		properties
-	};
-}
-function cloneProps(props) {
-	if (props === void 0) return void 0;
-	const cloned = {};
-	for (const [key, value] of Object.entries(props)) cloned[key] = cloneTelemetryValue(value);
-	return cloned;
-}
-function cloneTelemetryValue(value) {
-	if (Array.isArray(value)) return value.map(cloneTelemetryValue);
-	if (value === null || typeof value !== "object") return value;
-	if (Object.getPrototypeOf(value) !== Object.prototype) return value;
-	const cloned = {};
-	for (const [key, nested] of Object.entries(value)) cloned[key] = cloneTelemetryValue(nested);
-	return cloned;
-}
-//#endregion
 //#region src/adapters/diagnostic/ConsoleDiagnosticAdapter.ts
 const DEFAULT_ACCOUNT_SETUP_LOG_PREFIX = "[capxul:account-setup]";
 var ConsoleDiagnosticAdapter = class {
@@ -2497,220 +2320,73 @@ function normalizeBetterAuthBaseUrl(raw) {
 	return trimmed.endsWith("/api/auth") ? trimmed : `${trimmed}/api/auth`;
 }
 //#endregion
-//#region src/observation.ts
-const SDK_VERSION$1 = version;
-/** Stable PostHog event used for typed failures that are expected product outcomes. */
-const CAPXUL_SDK_EXPECTED_OUTCOME_EVENT = "capxul_sdk_expected_outcome";
-/**
-* Adapt the host's already-initialized PostHog-like client. This function does
-* not import, initialize, configure, or own PostHog.
-*/
-function fromPostHog(client, options = {}) {
-	const prepare = (failure) => {
-		if (!isEnabled(options.enabled)) return;
-		if (client === null || client === void 0) return;
-		const safeFailure = sanitizeFailureObservation(failure);
-		return [safeFailure, postHogProperties(safeFailure, hasFailureInvocationSnapshot(failure) ? void 0 : resolveContext(options.context))];
-	};
-	const captureOperationFailure = (failure) => {
-		const prepared = prepare(failure);
-		if (prepared === void 0 || client === null || client === void 0) return;
-		const [safeFailure, properties] = prepared;
-		if (classifyOperationOutcome(safeFailure.errorKind) === "expected") {
-			if (typeof client.capture !== "function") return;
-			deliver(() => client.capture(CAPXUL_SDK_EXPECTED_OUTCOME_EVENT, {
-				...properties,
-				outcome_class: "expected"
-			}));
-			return;
+//#region src/host-observability.ts
+const HOST_INVOCATION = Symbol("capxul.host-observability-invocation");
+/** Build the SDK's one host module around an already-initialized PostHog client. */
+function postHogObservability(client, options = {}) {
+	const inactive = Object.freeze({
+		active: false,
+		contextProps: Object.freeze({})
+	});
+	const snapshot = () => {
+		if (client === null || client === void 0) return inactive;
+		try {
+			if (!(typeof options.enabled === "function" ? options.enabled() : options.enabled ?? true)) return inactive;
+			const sanitized = sanitizeObservationContext(typeof options.context === "function" ? options.context() : options.context);
+			const context = sanitized === void 0 ? void 0 : Object.freeze({ ...sanitized });
+			return Object.freeze({
+				active: true,
+				...context === void 0 ? {} : { context },
+				contextProps: Object.freeze(observationContextProps(context))
+			});
+		} catch {
+			return inactive;
 		}
-		deliver(() => client.capture("$exception", postHogExceptionProperties(safeFailure, properties)));
-	};
-	const captureException = (failure) => {
-		const prepared = prepare(failure);
-		if (prepared === void 0 || client === null || client === void 0) return;
-		const [safeFailure, properties] = prepared;
-		deliver(() => client.capture("$exception", postHogExceptionProperties(safeFailure, properties)));
 	};
-	return {
-		resolveContext: () => {
-			if (!isEnabled(options.enabled) || client === null || client === void 0) return void 0;
-			return resolveRawContext(options.context) ?? {};
-		},
-		captureOperationFailure,
-		captureException
+	const policy = {
+		client,
+		capxulEnv: options.capxulEnv ?? "unknown",
+		snapshot,
+		deliver: (capture) => {
+			try {
+				const delivery = capture();
+				if (isPromiseLike(delivery)) Promise.resolve(delivery).catch(() => void 0);
+			} catch {}
+		}
 	};
-}
-function classifyOperationOutcome(kind) {
-	return EXPECTED_OPERATION_OUTCOMES.has(kind) ? "expected" : "unexpected";
-}
-function deliver(capture) {
-	try {
-		ignoreDeliveryFailure(capture());
-	} catch {}
-}
-/** @internal Reports a factory-level typed failure without changing its identity. */
-function observeFailedResult(result, adapter, operation) {
-	if (adapter !== void 0 && isFailedResult(result)) report(adapter, "operation", operation, result.error, resolveAdapterContext(adapter));
-	return result;
-}
-function report(adapter, kind, operation, cause, invocationContext) {
-	const operationName = normalizeOperation(operation);
-	const kindName = normalizeErrorKind(errorKind(cause));
-	const context = sanitizeObservationContext({
-		...invocationContext,
-		...isCapxulError(cause) && cause.correlationId !== void 0 ? { correlationId: cause.correlationId } : {}
-	});
-	const failure = markFailureInvocationSnapshot({
-		exception: syntheticException(operationName, kindName),
-		sdkVersion: SDK_VERSION$1,
-		operation: operationName,
-		errorKind: kindName,
-		...context === void 0 ? {} : { context }
-	});
-	try {
-		ignoreDeliveryFailure(kind === "operation" ? adapter.captureOperationFailure(failure) : adapter.captureException(failure));
-	} catch {}
-}
-function resolveAdapterContext(adapter) {
-	try {
-		return adapter.resolveContext?.();
-	} catch {
-		return;
-	}
-}
-function ignoreDeliveryFailure(delivery) {
-	if (!isPromiseLike(delivery)) return;
-	try {
-		Promise.resolve(delivery).catch(() => void 0);
-	} catch {}
-}
-/**
-* Map an ALREADY-sanitized observation context to the snake_case PostHog
-* property keys. Shared by the failure boundary here and the host
-* success-telemetry seam (`telemetry/from-posthog.ts`) so both attach identical
-* correlation fields from one definition.
-*/
-function observationContextProps(context) {
-	const props = {};
-	if (context?.application !== void 0) props.application = context.application;
-	if (context?.release !== void 0) props.release = context.release;
-	if (context?.sessionId !== void 0) props.session_id = context.sessionId;
-	if (context?.organizationId !== void 0) props.organization_id = context.organizationId;
-	if (context?.journeyId !== void 0) props.journey_id = context.journeyId;
-	if (context?.correlationId !== void 0) props.correlation_id = context.correlationId;
-	if (context?.anonymousId !== void 0) props.anonymous_id = context.anonymousId;
-	return props;
-}
-function postHogProperties(failure, context) {
-	const merged = sanitizeObservationContext({
-		...context,
-		...failure.context
-	});
-	return {
-		sdk_version: failure.sdkVersion,
-		operation: failure.operation,
-		error_kind: failure.errorKind,
-		handled: true,
-		...observationContextProps(merged)
+	const module = {
+		failures: postHogFailureObservation(policy),
+		product: postHogProductTelemetry(policy)
 	};
-}
-function postHogExceptionProperties(failure, properties) {
-	const filename = `capxul-sdk-observation://boundary/${failure.operation}`;
-	return {
-		...properties,
-		$exception_type: failure.errorKind,
-		$exception_message: EXCEPTION_MESSAGE,
-		$exception_level: "error",
-		$exception_list: [{
-			type: failure.errorKind,
-			value: EXCEPTION_MESSAGE,
-			mechanism: {
-				type: "capxul_sdk_boundary",
-				handled: true,
-				synthetic: true
+	Object.defineProperty(module, HOST_INVOCATION, {
+		enumerable: false,
+		value: {
+			bind: () => {
+				const invocation = snapshot();
+				return {
+					failures: postHogFailureObservation(policy, invocation),
+					product: postHogProductTelemetry(policy, invocation)
+				};
 			},
-			stacktrace: {
-				type: "raw",
-				frames: [{
-					platform: "javascript",
-					filename,
-					function: `CapxulSdkBoundary.${failure.operation}`,
-					lineno: 1,
-					colno: 1,
-					in_app: true
-				}]
-			}
-		}]
-	};
-}
-function resolveContext(context) {
-	return sanitizeObservationContext(resolveRawContext(context));
-}
-/** Resolve the host context closure without sanitizing — the call-start snapshot. */
-function resolveRawContext(context) {
-	try {
-		return typeof context === "function" ? context() : context;
-	} catch {
-		return;
-	}
-}
-function isEnabled(enabled) {
-	try {
-		return typeof enabled === "function" ? enabled() : enabled ?? true;
-	} catch {
-		return false;
-	}
-}
-function errorKind(cause) {
-	try {
-		if (isCapxulError(cause)) return normalizeErrorKind(cause.code);
-		if (cause instanceof Error) return normalizeErrorKind(cause.name);
-		return "UnknownFailure";
-	} catch {
-		return "Error";
-	}
-}
-function sanitizeFailureObservation(failure) {
-	const operation = normalizeOperation(failure.operation);
-	const kind = normalizeErrorKind(failure.errorKind);
-	const context = sanitizeObservationContext(failure.context);
-	return {
-		exception: syntheticException(operation, kind),
-		sdkVersion: normalizeSdkVersion(failure.sdkVersion),
-		operation,
-		errorKind: kind,
-		...context === void 0 ? {} : { context }
+			snapshot
+		}
+	});
+	return module;
+}
+/** @internal Bind both projections to one call-start decision/context snapshot. */
+function bindHostObservabilityInvocation(observability) {
+	return observability?.[HOST_INVOCATION]?.bind() ?? observability;
+}
+/** @internal Read one call-start snapshot for actor/transition carriage. */
+function snapshotHostObservability(observability) {
+	const snapshot = observability?.[HOST_INVOCATION]?.snapshot();
+	return snapshot === void 0 ? void 0 : {
+		active: snapshot.active,
+		...snapshot.context === void 0 ? {} : { context: snapshot.context }
 	};
 }
-function normalizeSdkVersion(value) {
-	return typeof value === "string" && /^[A-Za-z0-9][A-Za-z0-9.+_-]{0,127}$/u.test(value) ? value : "unknown";
-}
-function normalizeOperation(value) {
-	return typeof value === "string" && /^[A-Za-z0-9_][A-Za-z0-9_.-]{0,255}$/u.test(value) ? value : "unknown";
-}
-function normalizeErrorKind(value) {
-	return typeof value === "string" && /^[A-Za-z][A-Za-z0-9_.-]{0,63}$/u.test(value) ? value : "Error";
-}
-function syntheticException(operation, kind) {
-	const error = new Error(EXCEPTION_MESSAGE);
-	error.name = kind;
-	error.stack = `${kind}: ${error.message}\n    at CapxulSdkBoundary.${operation} (capxul-sdk-observation://boundary/${operation}:1:1)`;
-	return error;
-}
 function isPromiseLike(value) {
-	return (typeof value === "object" || typeof value === "function") && value !== null && typeof value.then === "function";
-}
-function isPlainObject(value) {
-	if (typeof value !== "object" || value === null) return false;
-	const prototype = Object.getPrototypeOf(value);
-	return prototype === Object.prototype || prototype === null;
-}
-function isCapxulResult(value) {
-	return isPlainObject(value) && typeof value.ok === "boolean";
-}
-function isFailedResult(value) {
-	return isCapxulResult(value) && value.ok === false && "error" in value;
+	return (typeof value === "object" && value !== null || typeof value === "function") && "then" in value;
 }
 const SDK_VERSION = version;
 /**
@@ -2731,7 +2407,6 @@ const collectProductionFlowPorts = Effect.gen(function* () {
 		identity: yield* IdentityPortTag,
 		smartAccount: yield* SmartAccountPortTag,
 		accountRead: yield* AccountReadPortTag,
-		subAccount: yield* SubAccountPortTag,
 		bootstrap,
 		clock,
 		telemetry: yield* TelemetryPortTag,
@@ -2768,10 +2443,6 @@ function makeProductionAdapterLayerEntries(input) {
 			name: "accountRead",
 			layer: ConvexAccountLayer()
 		},
-		{
-			name: "subAccount",
-			layer: ConvexSubAccountLayer(input.chainId)
-		},
 		{
 			name: "clock",
 			layer: SystemClockLayer()
@@ -2804,7 +2475,7 @@ function mergeProductionAdapterLayers(entries) {
 	}).reduce((current, layer) => Layer.merge(current, layer), Layer.empty);
 }
 function isConvexDependentLayer(name) {
-	return name === "identity" || name === "smartAccount" || name === "accountRead" || name === "subAccount" || name === "org";
+	return name === "identity" || name === "smartAccount" || name === "accountRead" || name === "org";
 }
 function productionBootstrapPortLayer(bootstrap) {
 	return Layer.succeed(BootstrapPortTag, bootstrap);
@@ -2863,7 +2534,19 @@ function productionConvexCallLayer(input, refreshConvexAuthRef) {
 function isRefreshableConvexCallPort(convexCall) {
 	return "refreshAuth" in convexCall && typeof convexCall.refreshAuth === "function";
 }
+function resolveProductionObservability(input) {
+	const observation = input.observability?.failures ?? input.observation;
+	const telemetry = input.observability?.product ?? input.telemetry;
+	const invocationObservability = input.invocationObservability;
+	return {
+		observation,
+		telemetry,
+		invocationObservation: invocationObservability?.failures ?? observation,
+		invocationTelemetry: invocationObservability?.product ?? telemetry
+	};
+}
 async function createProductionAdapters(input) {
+	const { observation, telemetry, invocationObservation, invocationTelemetry } = resolveProductionObservability(input);
 	const resolvedInput = resolveInput(input);
 	if (!resolvedInput.ok) return resolvedInput;
 	const scope = await Effect.runPromise(Scope.make());
@@ -2871,7 +2554,7 @@ async function createProductionAdapters(input) {
 	const bootstrapLayer = HttpBootstrapLayer({
 		bootstrapBaseUrl: resolvedInput.value.bootstrapBaseUrl,
 		...input.fetch === void 0 ? {} : { fetch: input.fetch },
-		...input.observation === void 0 ? {} : { observation: input.observation }
+		...invocationObservation === void 0 ? {} : { observation: invocationObservation }
 	});
 	try {
 		const bootstrapContext = await Effect.runPromise(Layer.buildWithScope(bootstrapLayer, scope));
@@ -2881,7 +2564,7 @@ async function createProductionAdapters(input) {
 			...resolvedInput.value.origin === void 0 ? {} : { origin: resolvedInput.value.origin }
 		}));
 		if (!bootstrapResult.ok) {
-			await emitBootstrapTelemetry(input.telemetry, {
+			await emitBootstrapTelemetry(invocationTelemetry, {
 				name: "bootstrap_failed",
 				props: {
 					...bootstrapTelemetryEnvelope(input, resolvedInput.value),
@@ -2898,7 +2581,7 @@ async function createProductionAdapters(input) {
 		}
 		const runtimeUrlsResult = resolveRuntimeUrls(bootstrapResult.value, resolvedInput.value.runtime, input.authBaseUrl);
 		if (!runtimeUrlsResult.ok) {
-			await emitBootstrapTelemetry(input.telemetry, {
+			await emitBootstrapTelemetry(invocationTelemetry, {
 				name: "bootstrap_failed",
 				props: {
 					...bootstrapTelemetryEnvelope(input, resolvedInput.value),
@@ -2910,7 +2593,7 @@ async function createProductionAdapters(input) {
 			return runtimeUrlsResult;
 		}
 		const runtimeUrls = runtimeUrlsResult;
-		await emitBootstrapTelemetry(input.telemetry, {
+		await emitBootstrapTelemetry(invocationTelemetry, {
 			name: "bootstrap_resolved",
 			props: {
 				...bootstrapTelemetryEnvelope(input, resolvedInput.value),
@@ -2935,19 +2618,15 @@ async function createProductionAdapters(input) {
 			runtimeUrls: runtimeUrls.value,
 			chainId: bootstrapResult.value.chainId,
 			applicationId: bootstrapResult.value.applicationId,
-			...input.observation === void 0 ? {} : { observation: input.observation },
+			...observation === void 0 ? {} : { observation },
 			...input.authCache === void 0 ? {} : { authCache: input.authCache },
-			...input.telemetry === void 0 ? {} : { telemetry: input.telemetry },
+			...telemetry === void 0 ? {} : { telemetry },
 			...injectedClient === void 0 ? {} : { convexClient: injectedClient },
 			...input.fetch === void 0 ? {} : { fetch: input.fetch },
 			...input.signal === void 0 ? {} : { signal: input.signal },
 			...input.resetSignerSession === void 0 ? {} : { resetSignerSession: input.resetSignerSession }
 		}));
-		const applicationLayer = input.engineeringTelemetry === void 0 ? portsLayer : Layer.merge(portsLayer, makeEngineeringTelemetryLayer({
-			...input.engineeringTelemetry,
-			producer: resolvedInput.value.runtime === "browser" ? "browser" : "server",
-			sdkVersion: SDK_VERSION
-		}));
+		const applicationLayer = Layer.merge(portsLayer, optionalEngineeringTelemetryLayer(bootstrapResult.value.engineeringTelemetry, resolvedInput.value.runtime));
 		const context = await Effect.runPromise(Layer.buildWithScope(applicationLayer, scope));
 		return {
 			ok: true,
@@ -2966,6 +2645,20 @@ async function createProductionAdapters(input) {
 		};
 	}
 }
+function optionalEngineeringTelemetryLayer(policy, runtime) {
+	if (policy === void 0) return Layer.empty;
+	try {
+		return makeEngineeringTelemetryLayer({
+			host: policy.host,
+			headers: { authorization: `Bearer ${policy.projectToken}` },
+			capxulEnv: policy.capxulEnv,
+			producer: runtime === "browser" ? "browser" : "server",
+			sdkVersion: SDK_VERSION
+		});
+	} catch {
+		return Layer.empty;
+	}
+}
 function refreshConvexAuthOnSession(authClient, refresh) {
 	return {
 		...authClient,
@@ -2995,14 +2688,17 @@ function resetSignerSessionOnSignOut(authClient, resetRef) {
 	};
 }
 async function createCapxulClient$1(input) {
+	const invocationObservability = bindHostObservabilityInvocation(input.observability);
+	const observation = invocationObservability?.failures ?? input.observation;
 	const validation = validateCreateCapxulClientInput(input);
-	if (!validation.ok) return observeFailedResult(validation, input.observation, "createCapxulClient");
+	if (!validation.ok) return observeFailedResult(validation, observation, "createCapxulClient");
 	const resetSignerSession = { current: null };
 	const adapters = await createProductionAdapters({
 		...input,
-		resetSignerSession
+		resetSignerSession,
+		...invocationObservability === void 0 ? {} : { invocationObservability }
 	});
-	if (!adapters.ok) return observeFailedResult(adapters, input.observation, "createCapxulClient");
+	if (!adapters.ok) return observeFailedResult(adapters, observation, "createCapxulClient");
 	try {
 		const runtime = input.runtime ?? detectRuntime();
 		const resolvedAuthBaseUrl = resolveBrowserAuthBaseUrl({
@@ -3039,6 +2735,7 @@ async function createCapxulClient$1(input) {
 			...input.signal === void 0 ? {} : { signal: input.signal },
 			...input.otpTtlMs === void 0 ? {} : { otpTtlMs: input.otpTtlMs },
 			invokeTimeoutMs: input.invokeTimeoutMs ?? 3e4,
+			...input.observability === void 0 ? {} : { hostObservationSnapshot: () => snapshotHostObservability(input.observability) },
 			effectRunner: {
 				runSync: Effect.runSyncWith(adapters.value.context),
 				runPromise: Effect.runPromiseWith(adapters.value.context)
@@ -3067,7 +2764,7 @@ async function createCapxulClient$1(input) {
 		return observeFailedResult({
 			ok: false,
 			error: toPublicError(cause, "createCapxulClient")
-		}, input.observation, "createCapxulClient");
+		}, observation, "createCapxulClient");
 	}
 }
 function validateCreateCapxulClientInput(input) {
@@ -3216,80 +2913,4 @@ async function createCapxulClient(input) {
 	return createCapxulClient$1(input);
 }
 //#endregion
-//#region src/telemetry/from-posthog.ts
-/**
-* Drop props that must never cross to a host-owned external sink. Today that is
-* the `$exception` `details` blob: `captureException` serializes
-* `CapxulError.details` (e.g. `{ asset, available, required }`, `{ name }`,
-* `{ accountId }` — errors.ts) into it, and the shared redactor has no
-* `$exception` rule, so it is stripped here at the boundary (infra#1037). The
-* safe fields (error code, operation, failure_mode, the fixed leak-safe message,
-* stack frames) are preserved.
-*/
-function stripHostUnsafeProps(props) {
-	if (props === void 0) return void 0;
-	const { details: _details, ...safe } = props;
-	return safe;
-}
-/**
-* Adapt the host's already-initialized posthog-like client into a
-* `TelemetryPort` for the `telemetry` prop / input. This port SUPPLANTS the
-* SDK's no-op default telemetry sink (`production.ts` binds it via
-* `Layer.succeed`, not `compose` — there is no client-side success relay to
-* compose with); it is additive to Capxul's backend first-party record and
-* never owns the client.
-*/
-function telemetryFromPostHog(client, options = {}) {
-	const active = () => {
-		if (client === null || client === void 0) return false;
-		try {
-			return typeof options.enabled === "function" ? options.enabled() : options.enabled ?? true;
-		} catch {
-			return false;
-		}
-	};
-	const contextProps = () => {
-		let raw;
-		try {
-			raw = typeof options.context === "function" ? options.context() : options.context;
-		} catch {
-			return {};
-		}
-		return observationContextProps(sanitizeObservationContext(raw));
-	};
-	return new PostHogTelemetryAdapter({
-		capture: (name, props) => {
-			if (!active() || client === null || client === void 0) return;
-			const event = stampTelemetryEnvelope({
-				name,
-				props
-			}, {
-				capxul_env: options.capxulEnv ?? "unknown",
-				producer: "sdk"
-			});
-			client.capture(name, {
-				...stripHostUnsafeProps(event.props),
-				...contextProps()
-			});
-		},
-		identify: (input) => {
-			if (!active() || client?.identify === void 0) return;
-			client.identify(input.distinctId, {
-				...input.traits,
-				...input.properties
-			});
-		},
-		group: (input) => {
-			if (!active() || client?.group === void 0) return;
-			client.group(input.groupType, input.groupKey, input.properties === void 0 ? void 0 : { ...input.properties });
-		},
-		reset: () => {
-			if (!active() || client?.reset === void 0) return;
-			client.reset();
-		}
-	});
-}
-//#endregion
-export { CAPXUL_SDK_EXPECTED_OUTCOME_EVENT, CapxulError, captureException, captureExceptionSync, createCapxulClient, deriveDevPrivateKey, devPrivateKeySigner, eip1193AccountProvider, embeddedSigner, fromPostHog, injectedWalletSigner, isCapxulError, isSettingUpLifecycle, localPrivateKeyAccountProvider, openfortEmbeddedSigner, openfortEmbeddedSignerFromWallet, openfortEmbeddedWalletPort, destination as resolveIdentityDestination, telemetryFromPostHog, toCountryCode, toAddress as toEvmAddress };
-
-//# sourceMappingURL=index.mjs.map
+export { CAPXUL_PAYMENTS_V2_ADDRESS, CAPXUL_SDK_EXPECTED_OUTCOME_EVENT, CapxulError, captureException, captureExceptionSync, createCapxulClient, deriveDevPrivateKey, devPrivateKeySigner, eip1193AccountProvider, embeddedSigner, injectedWalletSigner, isCapxulError, isSettingUpLifecycle, localPrivateKeyAccountProvider, openfortEmbeddedSigner, openfortEmbeddedSignerFromWallet, openfortEmbeddedWalletPort, postHogObservability, destination as resolveIdentityDestination, toCountryCode, toAddress as toEvmAddress };