@capxul/sdk 2.1.1 → 2.3.0

package/dist/{create-capxul-client-CPhTPz_9.mjs → create-capxul-client-mArFr_Os.mjs}

@@ -1,5 +1,5 @@
-import { D as toOrgId, F as isCapxulError, M as CapxulError, N as EXPECTED_OPERATION_OUTCOMES, P as Errors, S as toEmail, _ as toAuthUserId, b as toCurrencyCode, c as BYTES32_RE, d as WEI_RE, f as ZERO_BYTES32, k as toRoleKey, l as EVM_ADDRESS_RE$1, m as toAddress, n as BrowserAuthCacheAdapter, p as toAccountId, s as APP_ID_RE, t as InMemoryAuthCacheAdapter, u as SUPPORTED_CURRENCY_CODES, v as toChainId, y as toCountryCode } from "./InMemoryAuthCacheAdapter-Rc8tCtml.mjs";
-import { concat, encodeAbiParameters, encodeFunctionData, encodePacked, formatUnits, getContractAddress, keccak256, padHex, parseUnits, stringToHex, toBytes, toEventSelector, toFunctionSelector, toFunctionSignature } from "viem";
+import { A as toPartyId, I as CapxulError, L as EXPECTED_OPERATION_OUTCOMES, M as toRoleKey, R as Errors, S as toCurrencyCode, b as toChainId, c as BYTES32_RE, d as WEI_RE, f as ZERO_BYTES32, h as toAddress, k as toOrgId, l as EVM_ADDRESS_RE$1, m as toAccountId, n as BrowserAuthCacheAdapter, s as APP_ID_RE, t as InMemoryAuthCacheAdapter, u as SUPPORTED_CURRENCY_CODES, v as toAuthUserId, w as toEmail, x as toCountryCode, y as toBudgetId, z as isCapxulError } from "./InMemoryAuthCacheAdapter-qMpBOGb3.mjs";
+import { concat, encodeAbiParameters, encodeFunctionData, encodePacked, formatUnits, getContractAddress, keccak256, padHex, parseUnits, recoverAddress, stringToHex, toBytes, toEventSelector, toFunctionSelector, toFunctionSignature } from "viem";
 import { Context, Data, Deferred, Effect, Exit, Fiber, Layer, Queue, Ref, Result, Schema, SchemaGetter, Scope } from "effect";
 import { makeFunctionReference } from "convex/server";
 //#region src/domain/identity/model.ts
@@ -14,6 +14,8 @@ const isRetryable = (failure) => {
 	return failure.code === "NETWORK_ERROR" || failure.code === "UNKNOWN";
 };
 const SIGNED_OUT = { phase: "signed_out" };
+/** Where every client starts. `SessionRestored` / `SessionAbsent` settle it. */
+const RESTORING = { phase: "restoring" };
 const label = (state) => {
 	if (state.phase !== "authenticated") return state.phase;
 	if (state.account.at !== "claimed") return `authenticated:${state.account.at}`;
@@ -28,6 +30,8 @@ const EVENT_TAGS = [
 	"RestoreSession",
 	"ResumeOtpEntry",
 	"Reset",
+	"SessionRestored",
+	"SessionAbsent",
 	"EnsureAccount",
 	"ClaimAccount",
 	"RetryAccount",
@@ -62,6 +66,13 @@ const SESSION_EVENTS = [
 	"Reset"
 ];
 const TRANSITION_TABLE = {
+	restoring: [
+		"SessionRestored",
+		"SessionAbsent",
+		"ReadSession",
+		"RequestOtp",
+		"Reset"
+	],
 	signed_out: [
 		"RequestOtp",
 		"ReadSession",
@@ -253,6 +264,8 @@ const transition = (state, event, config = DEFAULT_CONFIG) => {
 				requestedAt: state.resume.requestedAt
 			} };
 		case "Reset": return { next: SIGNED_OUT };
+		case "SessionRestored": return { next: authenticated(event.session, event.profileComplete, { at: "unknown" }) };
+		case "SessionAbsent": return { next: SIGNED_OUT };
 		case "EnsureAccount":
 			if (config.requirement === "none") return WRONG;
 			return state.phase === "authenticated" ? { next: withAccount(state, {
@@ -320,6 +333,7 @@ const isPrivate = (event) => PRIVATE_TAGS.has(event._tag);
 * there is no org list in the state, only the ONE active lane.
 */
 const destination = (state) => {
+	if (state.phase === "restoring") return null;
 	if (state.phase !== "authenticated") return { to: "home" };
 	if (!state.profileComplete) return { to: "selectUserType" };
 	if (state.account.at === "unknown") return null;
@@ -339,6 +353,33 @@ const destination = (state) => {
 		orgId: org.at === "creating" ? null : org.orgId
 	};
 };
+/**
+* True while the machine has not settled enough to route or to gate on.
+*
+* NEGATIVE classification, deliberately: the SETTLED positions are the ones
+* enumerated, and everything else waits. A phase or readiness variant added
+* later therefore defaults to holding, never to redirecting a member who is in
+* fact signed in. Terminal for the account lane is `claimed | failed`.
+*
+* The org lane's own settledness (`ready | failed`) is the route gate's
+* question, not this one: every org lane sits under a CLAIMED account, and
+* `destination()` already names a real screen for each of its positions.
+*/
+const isRestoring = (state) => {
+	switch (state.phase) {
+		case "signed_out":
+		case "otp_sending":
+		case "otp_pending":
+		case "otp_verifying":
+		case "signing_out":
+		case "faulted": return false;
+		case "authenticated": return state.account.at !== "claimed" && state.account.at !== "failed";
+		default: return true;
+	}
+};
+/** The claimed-account gate as one function. The inlined consumers move onto
+* it in #1521; this ticket ships the selector they move onto. */
+const isClaimed = (state) => state.phase === "authenticated" && state.account.at === "claimed";
 //#endregion
 //#region ../config/src/tokens.ts
 /** `TestUSDC` ("USDX") — Base Sepolia, 6 decimals, open `mint`. (Canon §1.) */
@@ -1209,48 +1250,7 @@ const USDX_BASE_SEPOLIA_TOKEN = {
 };
 USDX_BASE_SEPOLIA_TOKEN.chainId;
 USDX_BASE_SEPOLIA_TOKEN.chainId;
-//#endregion
-//#region ../config/src/role-dsl.ts
-const USD_DECIMALS = 6;
-const USD_SCALE = 10n ** BigInt(USD_DECIMALS);
-const USD_DISPLAY_RE = /^\d+(?:\.\d{1,6})?$/;
-const USD_BASE_UNIT_RE = /^\d+$/;
-const EXEC_TRANSACTION_WITH_ROLE = "zodiac.roles.execTransactionWithRole";
-const ASSIGN_ROLES = "zodiac.roles.assignRoles";
-const SCOPE_TARGET = "zodiac.roles.scopeTarget";
-const OWNER_ROLE_LABEL = "Owner";
-const FOUNDER_BUDGET_ROLE_LABEL = "Founder Budget";
-const FOUNDER_BUDGET_LIMIT = {
-	currency: "USD",
-	value: "1000000000000",
-	decimals: 6
-};
-function usd(value) {
-	return {
-		currency: "USD",
-		value: usdDisplayToBaseUnits(value),
-		decimals: USD_DECIMALS
-	};
-}
-function usdDisplayToBaseUnits(value) {
-	if (value.trim() !== value || !USD_DISPLAY_RE.test(value)) throw Errors.invalidInput("role.spend", "USD caps must be unsigned decimal strings with at most 6 fractional digits");
-	const parts = value.split(".");
-	const whole = parts[0] ?? "0";
-	const fraction = parts[1] ?? "";
-	return (BigInt(whole) * USD_SCALE + BigInt(fraction.padEnd(USD_DECIMALS, "0"))).toString();
-}
-function normalizeOrgRoleMoney(money, field) {
-	if (money.currency !== "USD" || money.decimals !== USD_DECIMALS || !USD_BASE_UNIT_RE.test(money.value)) throw Errors.invalidInput(field, `must be USD base units with ${USD_DECIMALS} decimals`);
-	return money;
-}
-function normalizeOrgRoleSpendCap(spend) {
-	if (spend === void 0) return void 0;
-	return {
-		...spend.perTx === void 0 ? {} : { perTx: normalizeOrgRoleMoney(spend.perTx, "roles.spend.perTx") },
-		...spend.perDay === void 0 ? {} : { perDay: normalizeOrgRoleMoney(spend.perDay, "roles.spend.perDay") },
-		...spend.toRecipients === void 0 ? {} : { toRecipients: spend.toRecipients }
-	};
-}
+10n ** BigInt(6);
 function normalizeOrgRoleLabel(label) {
 	const normalized = label.trim().replace(/\s+/g, " ");
 	if (normalized.length === 0) throw Errors.invalidInput("role.label", "must be a non-empty role label");
@@ -1259,84 +1259,6 @@ function normalizeOrgRoleLabel(label) {
 function orgRoleKeyForLabel(label) {
 	return keccak256(toBytes(normalizeOrgRoleLabel(label).toLowerCase()));
 }
-function soloOrgRoleTemplate() {
-	return [{
-		label: "Owner",
-		canManageMembers: true,
-		canManageRoles: true
-	}, {
-		label: FOUNDER_BUDGET_ROLE_LABEL,
-		spend: {
-			perTx: FOUNDER_BUDGET_LIMIT,
-			perDay: FOUNDER_BUDGET_LIMIT,
-			toRecipients: "anyone"
-		}
-	}];
-}
-function startupOrgRoleTemplate() {
-	return [
-		...soloOrgRoleTemplate(),
-		{
-			label: "Finance Manager",
-			spend: {
-				perTx: usd("25000"),
-				perDay: usd("100000"),
-				toRecipients: "anyone"
-			}
-		},
-		{
-			label: "Team Lead",
-			spend: {
-				perTx: usd("5000"),
-				perDay: usd("15000"),
-				toRecipients: "anyone"
-			}
-		}
-	];
-}
-function orgRoleTemplateDefinitions(template, customRoles = []) {
-	switch (template) {
-		case "Solo": return soloOrgRoleTemplate();
-		case "Startup": return startupOrgRoleTemplate();
-		case "Custom": return customRoles.length === 0 ? soloOrgRoleTemplate() : customRoles;
-		default: return template;
-	}
-}
-function compileOrgRoleDefinitions(definitions) {
-	if (definitions.length === 0) throw Errors.invalidInput("roles", "must include at least one role");
-	const seen = /* @__PURE__ */ new Set();
-	const roles = definitions.map((definition) => {
-		const label = normalizeOrgRoleLabel(definition.label);
-		const roleKey = orgRoleKeyForLabel(label);
-		if (seen.has(roleKey)) throw Errors.invalidInput("roles", `duplicate role label: ${label}`);
-		seen.add(roleKey);
-		const spend = normalizeOrgRoleSpendCap(definition.spend);
-		const permissions = [];
-		if (spend !== void 0 || label === OWNER_ROLE_LABEL) permissions.push(EXEC_TRANSACTION_WITH_ROLE);
-		if (definition.canManageMembers === true) permissions.push(ASSIGN_ROLES);
-		if (definition.canManageRoles === true) permissions.push(SCOPE_TARGET);
-		return {
-			label,
-			roleKey,
-			definition: {
-				...definition,
-				label,
-				...spend === void 0 ? {} : { spend }
-			},
-			permissions,
-			allowance: spend ?? null
-		};
-	});
-	const manager = roles.find((role) => role.definition.canManageMembers === true);
-	if (manager === void 0) throw Errors.invalidInput("roles.canManageMembers", "at least one role must compile to the on-chain member-management permission");
-	return {
-		roles,
-		memberManagementRole: {
-			roleKey: manager.roleKey,
-			permission: ASSIGN_ROLES
-		}
-	};
-}
 padHex(stringToHex("FM_DAILY"), {
 	size: 32,
 	dir: "right"
@@ -1369,86 +1291,24 @@ new Map([
 	["setAllowance(bytes32,uint128,uint128,uint128,uint64,uint64)", "SetAllowance(bytes32,uint128,uint128,uint128,uint64,uint64)"]
 ].map(([functionSignature, eventSignature]) => [toFunctionSelector(functionSignature), toEventSelector(eventSignature)]));
 //#endregion
-//#region src/telemetry/stack-frame-parser.ts
-/**
-* Regex for V8/Chrome stack trace frame lines.
-* Matches:
-*   `at functionName (url:line:col)`
-*   `at url:line:col`
-*   `at async functionName (url:line:col)`
-*   `at new ClassName (url:line:col)`
-*/
-const V8_FRAME_RE = /^\s*at\s+(?:(.+?)\s+\()?(?:(.+?)(?::(\d+):(\d+))?|(.+?))\)?\s*$/;
-function isNonUrlName(name) {
-	return name === "<anonymous>" || name.startsWith("eval") || name.startsWith("new ") || name.startsWith("async ");
+//#region src/surface/_shared/provisioning-telemetry.ts
+async function emitProvisioningTelemetry(telemetry, smartAccount) {
+	if (telemetry === void 0) return;
+	await Effect.runPromise(telemetry.emit({
+		name: "provisioning_safe_created",
+		props: { safe_address: smartAccount.smartAccountAddress }
+	}).pipe(Effect.catch((cause) => Effect.sync(() => reportProvisioningTelemetryFailure("error", smartAccount, cause))), Effect.catchDefect((cause) => Effect.sync(() => reportProvisioningTelemetryFailure("defect", smartAccount, cause)))));
 }
-/**
-* Parse a V8/Chrome-style stack trace string into PostHog `ExceptionFrame` objects.
-* Returns an empty array when `error.stack` is absent or empty.
-*
-* Handles:
-* - Standard `at functionName (url:line:col)`
-* - Bare `at url:line:col` (no function name)
-* - `at async functionName (url:line:col)`
-* - `at new ClassName (url:line:col)`
-* - Native frames: `at Array.forEach (<anonymous>)`
-*/
-function parseV8StackFrames(error) {
-	const stack = error.stack;
-	if (stack === void 0 || stack === null || stack === "") return [];
-	const lines = stack.split("\n");
-	const frames = [];
-	for (const line of lines) {
-		const trimmed = line.trim();
-		if (!trimmed.startsWith("at ")) continue;
-		const match = V8_FRAME_RE.exec(trimmed);
-		if (match === null) continue;
-		if (match[1] !== void 0) frames.push({
-			function: match[1],
-			filename: match[2],
-			lineno: match[3] !== void 0 ? Number(match[3]) : null,
-			colno: match[4] !== void 0 ? Number(match[4]) : null
-		});
-		else if (match[2] !== void 0 && !isNonUrlName(match[2])) frames.push({
-			function: "<anonymous>",
-			filename: match[2],
-			lineno: match[3] !== void 0 ? Number(match[3]) : null,
-			colno: match[4] !== void 0 ? Number(match[4]) : null
-		});
-		else frames.push({
-			function: match[1] ?? match[2] ?? match[5] ?? "<anonymous>",
-			filename: match[2] ?? match[5] ?? "<anonymous>",
-			lineno: match[3] !== void 0 ? Number(match[3]) : null,
-			colno: match[4] !== void 0 ? Number(match[4]) : null
-		});
-	}
-	return frames;
+function reportProvisioningTelemetryFailure(kind, smartAccount, cause) {
+	if (!isProvisioningTelemetryDebugEnabled()) return;
+	globalThis.console?.warn?.("[capxul] provisioning telemetry dropped", {
+		kind,
+		safeAddress: smartAccount.smartAccountAddress,
+		cause
+	});
 }
-/** Fixed, leak-safe frame used when the error carries no parseable stack. */
-const SDK_BOUNDARY_FILENAME = "capxul-sdk-observation://boundary";
-/**
-* Build PostHog's `$exception_list` (always a single entry). Error Tracking
-* groups on `type`, so it is ALWAYS present (the CapxulError code) — the
-* previous `[{ frames }]` shape omitted it and PostHog dropped the event as
-* "missing field `type`". When the error has no parseable stack, a synthetic
-* boundary frame stands in so the event still ingests as a real Issue (#1031).
-*/
-function buildExceptionList(input) {
-	const frames = input.frames.length > 0 ? input.frames : [{
-		filename: SDK_BOUNDARY_FILENAME,
-		function: input.operation ?? "unknown",
-		lineno: 1,
-		colno: 1
-	}];
-	return [{
-		type: input.type,
-		value: input.value,
-		mechanism: {
-			handled: true,
-			type: "capxul_sdk_boundary"
-		},
-		stacktrace: { frames }
-	}];
+function isProvisioningTelemetryDebugEnabled() {
+	return globalThis.process?.env?.CAPXUL_DEBUG_TELEMETRY === "1";
 }
 //#endregion
 //#region src/telemetry/get-failure-mode.ts
@@ -1498,77 +1358,94 @@ function resolveFailureMode(error, contextFailureMode) {
 	return getFailureMode(error) ?? (isFailureMode(contextFailureMode) ? contextFailureMode : "unknown");
 }
 //#endregion
-//#region src/telemetry/capture-exception.ts
-/** Fixed, leak-safe message — the raw error message may carry PII and never ships. */
-const EXCEPTION_MESSAGE = "Capxul SDK operation failed";
+//#region src/signer.ts
+const EVM_ADDRESS_HEX = /^0x[0-9a-fA-F]{40}$/;
+const ECDSA_SIGNATURE_HEX = /^0x[0-9a-fA-F]{130}$/;
+const SAFE_OP_DIGEST_HEX = /^0x[0-9a-fA-F]{64}$/;
 /**
-* Capture an error as a `$exception` event through the telemetry port,
-* formatted for PostHog Error Tracking.
-*
-* Parses stack traces into `$exception_list` format, extracts structured
-* metadata from CapxulError objects, and supplements with context props.
-* Fire-and-forget: telemetry defects are silently swallowed.
-* Returns `Effect<void, never>` for use in Effect pipelines; the underlying
-* adapter work is synchronous, so callers outside Effect contexts can
-* use `Effect.runSync`.
+* The readiness store a signer reports when it runs no readiness cycle. It
+* fails CLOSED: a node key signer or an injected wallet never claims `ready`,
+* so a gate that reads this never opens on a guess.
 */
-function captureException(telemetry, error, context) {
-	return Effect.catchDefect(Effect.sync(() => {
-		const frames = error instanceof Error ? parseV8StackFrames(error) : [];
-		const capxulError = isCapxulError(error) ? error : null;
-		const errorCode = capxulError?.code ?? context?.capxul_error_code ?? "UNKNOWN";
-		const props = {
-			capxul_error_code: errorCode,
-			$exception_type: errorCode,
-			$exception_message: EXCEPTION_MESSAGE,
-			$exception_list: buildExceptionList({
-				type: errorCode,
-				value: EXCEPTION_MESSAGE,
-				...context?.operation === void 0 ? {} : { operation: context.operation },
-				frames
-			}),
-			layer: capxulError?.layer ?? context?.layer,
-			operation: context?.operation,
-			provider: context?.provider,
-			failure_mode: resolveFailureMode(error, context?.failure_mode)
-		};
-		if (capxulError?.details !== void 0) props.details = JSON.stringify(capxulError.details);
-		for (const key of Object.keys(props)) if (props[key] === void 0) delete props[key];
-		return telemetry.emit({
-			name: "$exception",
-			props
-		});
-	}).pipe(Effect.flatten), () => Effect.void);
-}
+const UNOBSERVABLE_SIGNER_STATUS = {
+	status: () => "unknown",
+	subscribe: () => () => void 0
+};
 /**
-* Synchronous fire-and-forget capture. Runs the Effect inline with
-* `Effect.runSync` so callers outside an Effect context (e.g. React
-* hooks before throwing) can report errors without awaiting.
+* Walk an error and its `cause` links once each. A self-referential chain
+* terminates. Both signer predicates read the chain, so they read it here.
 */
-function captureExceptionSync(telemetry, error, context) {
-	try {
-		Effect.runSync(captureException(telemetry, error, context));
-	} catch {}
+function* causeChain(cause) {
+	const seen = /* @__PURE__ */ new Set();
+	let current = cause;
+	while (typeof current === "object" && current !== null && !seen.has(current)) {
+		seen.add(current);
+		yield current;
+		current = current.cause;
+	}
 }
-//#endregion
-//#region src/surface/_shared/provisioning-telemetry.ts
-async function emitProvisioningTelemetry(telemetry, smartAccount) {
-	if (telemetry === void 0) return;
-	await Effect.runPromise(telemetry.emit({
-		name: "provisioning_safe_created",
-		props: { safe_address: smartAccount.smartAccountAddress }
-	}).pipe(Effect.catch((cause) => Effect.sync(() => reportProvisioningTelemetryFailure("error", smartAccount, cause))), Effect.catchDefect((cause) => Effect.sync(() => reportProvisioningTelemetryFailure("defect", smartAccount, cause)))));
+/** Fold a signer throw into the public error contract. */
+function signerFailure(source, operation, cause) {
+	let failureMode;
+	for (const link of causeChain(cause)) {
+		if (link instanceof CapxulError && link.code === "SIGNER_REJECTED") return link;
+		failureMode = getFailureMode(link) ?? failureMode;
+		const error = link;
+		if (error.code === 4001 || error.error === "passkey_user_cancelled") return Errors.signerRejected({
+			source,
+			cause
+		});
+	}
+	return Errors.providerError("signer", operation, cause, failureMode === void 0 ? void 0 : { failure_mode: failureMode });
 }
-function reportProvisioningTelemetryFailure(kind, smartAccount, cause) {
-	if (!isProvisioningTelemetryDebugEnabled()) return;
-	globalThis.console?.warn?.("[capxul] provisioning telemetry dropped", {
-		kind,
-		safeAddress: smartAccount.smartAccountAddress,
-		cause
-	});
+/**
+* Browser `CapxulSigner` backed by an injected EIP-1193 wallet (MetaMask, etc.).
+* Signs the SafeOp digest via `eth_sign`, then verifies the returned signature
+* recovers the selected account against that raw digest. Wallets that prefix
+* `eth_sign` payloads are rejected before the backend submits an invalid SafeOp.
+* The node key signer lives in `@capxul/sdk/node` (`localPrivateKeySigner`).
+*/
+function injectedWalletSigner(provider) {
+	const resolveAddress = async () => {
+		const accounts = await provider.request({ method: "eth_requestAccounts" });
+		const first = Array.isArray(accounts) ? accounts[0] : void 0;
+		if (typeof first !== "string") throw new Error("injectedWalletSigner: wallet returned no accounts");
+		if (!EVM_ADDRESS_HEX.test(first)) throw new Error("injectedWalletSigner: wallet returned invalid address format");
+		return toAddress(first);
+	};
+	return {
+		source: "injected-eip1193",
+		getAddress: resolveAddress,
+		async signUserOpHash(hash) {
+			if (!SAFE_OP_DIGEST_HEX.test(hash)) throw new Error("injectedWalletSigner: SafeOp digest must be a 0x-prefixed 32-byte hex");
+			const address = await resolveAddress();
+			let signature;
+			try {
+				signature = await provider.request({
+					method: "eth_sign",
+					params: [address, hash]
+				});
+			} catch (cause) {
+				const detail = cause instanceof Error ? cause.message : String(cause);
+				throw new Error(`injectedWalletSigner: eth_sign failed; enable raw-hash signing for deployment (${detail})`, { cause });
+			}
+			if (typeof signature !== "string") throw new Error("injectedWalletSigner: wallet returned a non-string signature");
+			if (!ECDSA_SIGNATURE_HEX.test(signature)) throw new Error("injectedWalletSigner: wallet returned invalid signature format");
+			if ((await recoverRawDigestSigner({
+				hash,
+				signature
+			})).toLowerCase() !== address.toLowerCase()) throw new Error("injectedWalletSigner: wallet signature did not recover the selected account for the raw SafeOp digest; use a raw-hash-capable wallet or @capxul/sdk/node localPrivateKeySigner for deployed flows");
+			return signature;
+		}
+	};
 }
-function isProvisioningTelemetryDebugEnabled() {
-	return globalThis.process?.env?.CAPXUL_DEBUG_TELEMETRY === "1";
+async function recoverRawDigestSigner(input) {
+	try {
+		return toAddress(await recoverAddress(input));
+	} catch (cause) {
+		const detail = cause instanceof Error ? cause.message : String(cause);
+		throw new Error(`injectedWalletSigner: could not verify raw SafeOp digest signature (${detail})`, { cause });
+	}
 }
 //#endregion
 //#region src/internal/invocation-observation.ts
@@ -2137,7 +2014,7 @@ const accountStatusProgram = Effect.gen(function* () {
 	};
 	const signerAddress = yield* Effect.tryPromise({
 		try: () => signer.getAddress(),
-		catch: (cause) => isCapxulError(cause) ? cause : Errors.providerError("signer", "getAddress", cause)
+		catch: (cause) => signerFailure(signer.source, "getAddress", cause)
 	});
 	return {
 		status: "accountProviderReady",
@@ -2473,7 +2350,8 @@ const CAPXUL_FUNCTIONS = {
 		listMembersByOrgId: "org/queries:listMembersByOrgId",
 		listMine: "org/queries:listMine",
 		listRolesByOrgId: "org/queries:listRolesByOrgId",
-		loadByOrgId: "org/queries:loadByOrgId"
+		loadByOrgId: "org/queries:loadByOrgId",
+		me: "org/queries:me"
 	},
 	"smartAccount/actions": {
 		claim: "smartAccount/actions:claim",
@@ -2537,6 +2415,7 @@ const PAYMENT_ID_RE = /^payment_[0-9A-Za-z]+$/;
 const PAYEE_ID_RE = /^payee_[0-9A-Za-z]+$/;
 const ORG_ID_RE = /^org_[0-9A-Za-z]+$/;
 const USER_ID_RE = /^user_[0-9A-Za-z]+$/;
+const PARTY_ID_RE = /^party_[0-9A-Za-z]+$/;
 const HANDLE_RE = /^@?[a-z0-9][a-z0-9-]{2,31}$/;
 const ORG_HANDLE_RE = /^[a-z0-9][a-z0-9-]{2,31}$/;
 const EMAIL_RE = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
@@ -2545,6 +2424,7 @@ const PaymentIdSchema$1 = Schema.String.pipe(Schema.check(Schema.makeFilter((val
 const PayeeIdSchema = Schema.String.pipe(Schema.check(Schema.makeFilter((value) => PAYEE_ID_RE.test(value), { message: "must be payee_ plus an alphanumeric id" })));
 const OrgIdSchema = Schema.String.pipe(Schema.check(Schema.makeFilter((value) => ORG_ID_RE.test(value), { message: "must be org_ plus an alphanumeric id" })));
 const UserIdSchema = Schema.String.pipe(Schema.check(Schema.makeFilter((value) => USER_ID_RE.test(value), { message: "must be user_ plus an alphanumeric id" })));
+const PartyIdSchema = Schema.String.pipe(Schema.check(Schema.makeFilter((value) => PARTY_ID_RE.test(value), { message: "must be party_ plus an alphanumeric id" })));
 const DecimalStringSchema = Schema.String.pipe(Schema.check(Schema.makeFilter((value) => DECIMAL_STRING_RE.test(value), { message: "must be a non-negative decimal string" })));
 const HandleValueSchema = Schema.String.pipe(Schema.check(Schema.makeFilter((value) => !EVM_ADDRESS_RE.test(value) && HANDLE_RE.test(value), { message: "must be a handle; raw addresses are not accepted" })));
 const OrgHandleValueSchema = Schema.String.pipe(Schema.check(Schema.makeFilter((value) => !EVM_ADDRESS_RE.test(value) && ORG_HANDLE_RE.test(value), { message: "must be an org handle; raw addresses are not accepted" })));
@@ -2691,6 +2571,7 @@ const PaymentRecipient = Schema.Struct({
 		"capxulUserId",
 		"me",
 		"org",
+		"party",
 		"external_address"
 	]),
 	label: Schema.String,
@@ -2737,6 +2618,10 @@ const PaymentRef = Schema.Union([
 	Schema.Struct({
 		kind: Schema.Literal("payeeId"),
 		payeeId: PayeeIdSchema
+	}),
+	Schema.Struct({
+		kind: Schema.Literal("party"),
+		partyId: PartyIdSchema
 	})
 ]);
 const Payment = Schema.Struct({
@@ -4013,55 +3898,42 @@ function makeActorRelationshipMethods(deps) {
 	const fns = actorScopeContract;
 	return {
 		addressBook: {
-			list: (options) => mapOk$1(awaitableConvex(options?.signal, "addressBook.list", () => convexCall.query(fns.addressBookList, { actor })), (entries) => entries.map(mapAddressBookEntry)),
-			get: async (entryId, options) => {
-				const ref = refFromEntryId(entryId);
-				if (!ref.ok) return ref;
-				return mapOk$1(await awaitableConvex(options?.signal, "addressBook.get", () => convexCall.query(fns.addressBookGet, {
-					actor,
-					ref: ref.value
-				})), (entry) => entry === null ? null : mapAddressBookEntry(entry));
-			},
+			list: (input, options) => mapOk$1("addressBook.list", awaitableConvex(options?.signal, "addressBook.list", () => convexCall.query(fns.addressBookList, {
+				actor,
+				...input?.includeHidden === void 0 ? {} : { includeHidden: input.includeHidden }
+			})), (entries) => entries.map(mapAddressBookEntry)),
+			get: (entryId, options) => mapOk$1("addressBook.get", awaitableConvex(options?.signal, "addressBook.get", () => convexCall.query(fns.addressBookGet, {
+				actor,
+				partyId: entryId
+			})), (entry) => entry === null ? null : mapAddressBookEntry(entry)),
 			add: async (input, options) => {
 				const ref = normalizeRefForBackend$1(input.ref, "ref");
 				if (!ref.ok) return ref;
-				return mapOk$1(await awaitableConvex(options?.signal, "addressBook.add", () => convexCall.mutation(fns.addressBookAdd, {
+				return mapOk$1("addressBook.add", await awaitableConvex(options?.signal, "addressBook.add", () => convexCall.mutation(fns.addressBookAdd, {
 					actor,
 					ref: ref.value,
 					...input.label === void 0 ? {} : { label: input.label }
 				})), mapAddressBookEntry);
 			},
-			hide: async (entryId, options) => {
-				const ref = refFromEntryId(entryId);
-				if (!ref.ok) return ref;
-				return mapOk$1(await awaitableConvex(options?.signal, "addressBook.hide", () => convexCall.mutation(fns.addressBookHide, {
-					actor,
-					ref: ref.value
-				})), mapAddressBookEntry);
-			},
-			unhide: async (entryId, options) => {
-				const ref = refFromEntryId(entryId);
-				if (!ref.ok) return ref;
-				return mapOk$1(await awaitableConvex(options?.signal, "addressBook.unhide", () => convexCall.mutation(fns.addressBookUnhide, {
-					actor,
-					ref: ref.value
-				})), mapAddressBookEntry);
-			},
-			label: async (input, options) => {
-				const ref = refFromEntryId(input.entryId);
-				if (!ref.ok) return ref;
-				return mapOk$1(await awaitableConvex(options?.signal, "addressBook.label", () => convexCall.mutation(fns.addressBookLabel, {
-					actor,
-					ref: ref.value,
-					label: input.label
-				})), mapAddressBookEntry);
-			}
+			hide: (entryId, options) => mapOk$1("addressBook.hide", awaitableConvex(options?.signal, "addressBook.hide", () => convexCall.mutation(fns.addressBookHide, {
+				actor,
+				partyId: entryId
+			})), mapAddressBookEntry),
+			unhide: (entryId, options) => mapOk$1("addressBook.unhide", awaitableConvex(options?.signal, "addressBook.unhide", () => convexCall.mutation(fns.addressBookUnhide, {
+				actor,
+				partyId: entryId
+			})), mapAddressBookEntry),
+			label: (input, options) => mapOk$1("addressBook.label", awaitableConvex(options?.signal, "addressBook.label", () => convexCall.mutation(fns.addressBookLabel, {
+				actor,
+				partyId: input.entryId,
+				label: input.label
+			})), mapAddressBookEntry)
 		},
 		requests: {
 			issue: async (input, options) => {
 				const payer = normalizeRefForBackend$1(input.payer, "payer");
 				if (!payer.ok) return payer;
-				return mapOk$1(await awaitableConvex(options?.signal, "requests.issue", () => convexCall.mutation(fns.requestsIssue, {
+				return mapOk$1("requests.issue", await awaitableConvex(options?.signal, "requests.issue", () => convexCall.mutation(fns.requestsIssue, {
 					actor,
 					payer: payer.value,
 					amount: input.amount,
@@ -4070,18 +3942,18 @@ function makeActorRelationshipMethods(deps) {
 					...input.expiresAt === void 0 ? {} : { expiresAt: input.expiresAt }
 				})), (request) => mapActorRequest(request, input.payer));
 			},
-			list: (options) => mapOk$1(awaitableConvex(options?.signal, "requests.list", () => convexCall.query(fns.requestsList, { actor })), (requests) => requests.map((request) => mapActorRequest(request))),
-			get: (requestId, options) => mapOk$1(awaitableConvex(options?.signal, "requests.get", () => convexCall.query(fns.requestsGet, {
+			list: (options) => mapOk$1("requests.list", awaitableConvex(options?.signal, "requests.list", () => convexCall.query(fns.requestsList, { actor })), (requests) => requests.map((request) => mapActorRequest(request))),
+			get: (requestId, options) => mapOk$1("requests.get", awaitableConvex(options?.signal, "requests.get", () => convexCall.query(fns.requestsGet, {
 				actor,
 				paymentRequestId: requestId
 			})), (request) => request === null ? null : mapActorRequest(request)),
-			cancel: (requestId, options) => mapOk$1(awaitableConvex(options?.signal, "requests.cancel", () => convexCall.mutation(fns.requestsCancel, {
+			cancel: (requestId, options) => mapOk$1("requests.cancel", awaitableConvex(options?.signal, "requests.cancel", () => convexCall.mutation(fns.requestsCancel, {
 				actor,
 				paymentRequestId: requestId
 			})), (request) => mapActorRequest(request))
 		},
 		inbox: {
-			list: (options) => mapOk$1(awaitableConvex(options?.signal, "inbox.list", () => convexCall.query(fns.inboxList, { actor })), (items) => items.map(mapInboxItem)),
+			list: (options) => mapOk$1("inbox.list", awaitableConvex(options?.signal, "inbox.list", () => convexCall.query(fns.inboxList, { actor })), (items) => items.map(mapInboxItem)),
 			approve: async (input, options) => {
 				const result = await awaitableConvex(options?.signal, "inbox.approve", () => convexCall.mutation(fns.inboxApprove, {
 					actor,
@@ -4092,7 +3964,7 @@ function makeActorRelationshipMethods(deps) {
 				if (!result.ok) return result;
 				return mapApprovedInboxPayment(result.value, input);
 			},
-			decline: (requestId, options) => mapOk$1(awaitableConvex(options?.signal, "inbox.decline", () => convexCall.mutation(fns.inboxDecline, {
+			decline: (requestId, options) => mapOk$1("inbox.decline", awaitableConvex(options?.signal, "inbox.decline", () => convexCall.mutation(fns.inboxDecline, {
 				actor,
 				paymentRequestId: requestId
 			})), mapInboxItem)
@@ -4160,30 +4032,52 @@ function missingConvexCall(operation) {
 		error: Errors.providerError("convex", operation, "ConvexCallPort is required")
 	});
 }
-async function mapOk$1(resultOrPromise, f) {
+/**
+* Project a successful backend reply, WITHOUT leaving the result boundary.
+*
+* The projection can refuse: `mapAddressBookEntry` proves the entry id is a
+* `PartyId` rather than trusting the wire, and `toPartyId` throws on a
+* malformed one. Every verb on this surface returns `CapxulResult`, so that
+* throw has to become a value here — otherwise a malformed reply rejects the
+* promise and the caller's `if (!result.ok)` never runs (ADR-0023: errors are
+* values, and a code crosses the seam).
+*/
+async function mapOk$1(operation, resultOrPromise, f) {
 	const result = await resultOrPromise;
 	if (!result.ok) return result;
-	return {
-		ok: true,
-		value: f(result.value)
-	};
+	try {
+		return {
+			ok: true,
+			value: f(result.value)
+		};
+	} catch (cause) {
+		return {
+			ok: false,
+			error: cause instanceof CapxulError ? cause : Errors.providerError("convex", operation, cause)
+		};
+	}
 }
 const awaitableConvex = runIfActive;
+const ADDRESS_BOOK_RELATIONSHIPS = [
+	"paid",
+	"paidBy",
+	"invoiced",
+	"invoicedBy",
+	"member",
+	"manual",
+	"employed"
+];
+function isAddressBookRelationship(value) {
+	return ADDRESS_BOOK_RELATIONSHIPS.includes(value);
+}
 function mapAddressBookEntry(entry) {
-	const relationship = /* @__PURE__ */ new Set();
-	for (const edge of entry.edges) {
-		if (edge === "paid") relationship.add("paid");
-		if (edge === "paidBy") relationship.add("paidBy");
-		if (edge === "requested" || edge === "requestedBy") relationship.add("requested");
-		if (edge === "member") relationship.add("member");
-		if (edge === "employee") relationship.add("employee");
-	}
 	return {
-		id: entry.id,
+		id: toPartyId(entry.id),
 		ref: entry.ref,
-		label: entry.label ?? entry.identity?.label ?? refLabel(entry.ref),
-		relationship: [...relationship],
-		hidden: entry.hidden
+		label: entry.label,
+		relationship: entry.relationship.filter(isAddressBookRelationship),
+		hidden: entry.hidden,
+		lastActivityAt: entry.lastActivityAt
 	};
 }
 function mapActorRequest(request, payer) {
@@ -4277,8 +4171,14 @@ function mapInboxStatus(status) {
 }
 function normalizeRefForBackend$1(ref, field) {
 	try {
-		if (typeof ref === "string") throw Errors.invalidInput(field, "recipient must be a typed Ref variant");
-		if (typeof ref !== "object" || ref === null || !("kind" in ref)) throw Errors.invalidInput(field, "recipient must be a typed Ref variant");
+		if (typeof ref === "string") return {
+			ok: false,
+			error: Errors.invalidInput(field, "recipient must be a typed Ref variant")
+		};
+		if (typeof ref !== "object" || ref === null || !("kind" in ref)) return {
+			ok: false,
+			error: Errors.invalidInput(field, "recipient must be a typed Ref variant")
+		};
 		switch (ref.kind) {
 			case "handle": return {
 				ok: true,
@@ -4315,55 +4215,22 @@ function normalizeRefForBackend$1(ref, field) {
 					payeeId: nonEmptyRefValue$1(ref.payeeId, "payeeId")
 				}
 			};
-			default: throw Errors.invalidInput(field, "recipient must be a known Ref variant");
+			case "party": return {
+				ok: true,
+				value: {
+					kind: "party",
+					partyId: toPartyId(ref.partyId)
+				}
+			};
+			default: return {
+				ok: false,
+				error: Errors.invalidInput(field, "recipient must be a known Ref variant")
+			};
 		}
 	} catch (cause) {
-		if (cause instanceof Error && "code" in cause) return {
-			ok: false,
-			error: cause
-		};
 		return {
 			ok: false,
-			error: Errors.invalidInput(field, "recipient must be a typed Ref variant")
-		};
-	}
-}
-function refFromEntryId(entryId) {
-	try {
-		const parsed = JSON.parse(entryId);
-		if (typeof parsed === "object" && parsed !== null && "kind" in parsed) return normalizeRefForBackend$1(parsed, "entryId");
-	} catch {}
-	const separator = entryId.indexOf(":");
-	if (separator === -1) return {
-		ok: false,
-		error: Errors.invalidInput("entryId", "must be an address-book entry id")
-	};
-	const prefix = entryId.slice(0, separator);
-	const value = entryId.slice(separator + 1);
-	switch (prefix) {
-		case "email": return normalizeRefForBackend$1({
-			kind: "email",
-			email: value
-		}, "entryId");
-		case "user": return normalizeRefForBackend$1({
-			kind: "capxulUserId",
-			capxulUserId: value
-		}, "entryId");
-		case "org": return normalizeRefForBackend$1({
-			kind: "orgHandle",
-			orgHandle: value
-		}, "entryId");
-		case "payee": return normalizeRefForBackend$1({
-			kind: "payeeId",
-			payeeId: value
-		}, "entryId");
-		case "handle": return normalizeRefForBackend$1({
-			kind: "handle",
-			handle: value
-		}, "entryId");
-		default: return {
-			ok: false,
-			error: Errors.invalidInput("entryId", "must be an address-book entry id")
+			error: cause instanceof CapxulError ? cause : Errors.invalidInput(field, "recipient must be a typed Ref variant")
 		};
 	}
 }
@@ -4377,15 +4244,6 @@ function handleRefValue$1(value, field) {
 	const trimmed = nonEmptyRefValue$1(value, field);
 	return trimmed.startsWith("@") ? trimmed.slice(1) : trimmed;
 }
-function refLabel(ref) {
-	switch (ref.kind) {
-		case "handle": return ref.handle;
-		case "email": return ref.email;
-		case "orgHandle": return ref.orgHandle;
-		case "capxulUserId": return ref.capxulUserId;
-		case "payeeId": return ref.payeeId;
-	}
-}
 //#endregion
 //#region src/surface/account.ts
 const provisioningPhase = (state) => {
@@ -4408,6 +4266,10 @@ const actorFailure = (failure) => new CapxulError(failure.reason === "WORK_DIED"
 	...failure.details === void 0 ? {} : { details: failure.details },
 	layer: "identity"
 });
+const accountFailureResult = (error) => ({
+	ok: false,
+	error
+});
 function makeAccountMethods(deps) {
 	toChainId(deps.chainId);
 	const requirement = deps.requirement;
@@ -4550,26 +4412,16 @@ function makeAccountMethods(deps) {
 			value: provisioningPhase(deps.actor.snapshot())
 		};
 	};
-	const reportAndReturn = (error, operation = "getLifecycle") => {
-		if (deps.telemetry) captureExceptionSync(deps.telemetry, error, {
-			layer: "account",
-			operation
-		});
-		return {
-			ok: false,
-			error
-		};
-	};
 	const resolveLifecycle = async () => {
 		const phase = provisioningPhase(deps.actor.snapshot());
 		const status = await getStatus();
-		if (!status.ok) return reportAndReturn(status.error);
+		if (!status.ok) return accountFailureResult(status.error);
 		let accountId;
 		if (status.value.status !== "notAuthenticated" && (phase.status === "ready" || isRequirementMet(status.value, requirement))) {
 			const accountReadPort = deps.accountReadPort;
-			if (accountReadPort === void 0) return reportAndReturn(Errors.invalidInput("account", "accountReadPort is required to resolve ready lifecycle"));
+			if (accountReadPort === void 0) return accountFailureResult(Errors.invalidInput("account", "accountReadPort is required to resolve ready lifecycle"));
 			const account = await runPortEffect(accountReadPort.readBalance({ chainId: toChainId(deps.chainId) }));
-			if (!account.ok) return reportAndReturn(account.error);
+			if (!account.ok) return accountFailureResult(account.error);
 			accountId = String(account.value.id);
 		}
 		return {
@@ -4588,10 +4440,10 @@ function makeAccountMethods(deps) {
 		if (typeof resetSession === "function") try {
 			resetSession.call(deps.signer);
 		} catch (cause) {
-			return reportAndReturn(cause instanceof CapxulError ? cause : Errors.providerError("openfort", "resetSession", cause, { failure_mode: "unknown" }), "retrySetup");
+			return accountFailureResult(signerFailure(deps.signer.source, "resetSession", cause));
 		}
 		const retried = await drive({ _tag: "RetryAccount" });
-		if (!retried.ok) return reportAndReturn(retried.error, "retrySetup");
+		if (!retried.ok) return accountFailureResult(retried.error);
 		return resolveLifecycle();
 	};
 	return {
@@ -4744,7 +4596,7 @@ function cancelled(operation) {
 function isAborted$2(signal) {
 	return signal?.aborted === true;
 }
-async function signerCall(operation, run) {
+async function signerCall(source, operation, run) {
 	try {
 		return {
 			ok: true,
@@ -4753,7 +4605,7 @@ async function signerCall(operation, run) {
 	} catch (cause) {
 		return {
 			ok: false,
-			error: cause instanceof CapxulError ? cause : Errors.providerError("wallet-signer", operation, cause)
+			error: signerFailure(source, operation, cause)
 		};
 	}
 }
@@ -4765,7 +4617,7 @@ async function executePersonalPayment(deps, payment, signal, requestKey) {
 		ok: false,
 		error: Errors.notAuthenticated()
 	};
-	const signerAddress = await signerCall("getAddress", () => deps.signer.getAddress());
+	const signerAddress = await signerCall(deps.signer.source, "getAddress", () => deps.signer.getAddress());
 	if (!signerAddress.ok) return signerAddress;
 	const expectedSafe = deriveCapxulSafeAddress({ email: session.email });
 	const resolvedRequestKey = requestKey ?? `pay_${crypto.randomUUID()}`;
@@ -4784,7 +4636,7 @@ async function executePersonalPayment(deps, payment, signal, requestKey) {
 		paymentId: prepared.value.paymentId
 	});
 	if (isAborted$2(signal)) return cancelled("payments.pay");
-	const signature = await signerCall("signUserOpHash", () => deps.signer.signUserOpHash(prepared.value.digest));
+	const signature = await signerCall(deps.signer.source, "signUserOpHash", () => deps.signer.signUserOpHash(prepared.value.digest));
 	if (!signature.ok) return signature;
 	if (isAborted$2(signal)) return cancelled("payments.pay");
 	return runIfActive(void 0, "payments.submitExecution", () => deps.convexCall.action(deps.functions.submitPaymentExecution, { input: {
@@ -4797,12 +4649,6 @@ async function executePersonalPayment(deps, payment, signal, requestKey) {
 function isAborted$1(signal) {
 	return signal?.aborted === true;
 }
-function signerFailure(operation, cause) {
-	return {
-		ok: false,
-		error: cause instanceof CapxulError ? cause : Errors.providerError("wallet-signer", operation, cause)
-	};
-}
 /** Return one stable fingerprint for one JSON payment intent. */
 async function fingerprintPaymentIntent(intent) {
 	const canonical = JSON.stringify(intent, (_key, value) => value !== null && typeof value === "object" && !Array.isArray(value) ? Object.fromEntries(Object.entries(value).sort(([left], [right]) => left.localeCompare(right))) : value);
@@ -4823,7 +4669,10 @@ async function executePrepared(deps, prepare, expectedRequest, signal) {
 	try {
 		signerAddress = await deps.signer.getAddress();
 	} catch (cause) {
-		return signerFailure("getAddress", cause);
+		return {
+			ok: false,
+			error: signerFailure(deps.signer.source, "getAddress", cause)
+		};
 	}
 	const prepared = await prepare(signerAddress);
 	if (!prepared.ok) return prepared;
@@ -4844,7 +4693,10 @@ async function executePrepared(deps, prepare, expectedRequest, signal) {
 	try {
 		signature = await deps.signer.signUserOpHash(prepared.value.digest);
 	} catch (cause) {
-		return signerFailure("signUserOpHash", cause);
+		return {
+			ok: false,
+			error: signerFailure(deps.signer.source, "signUserOpHash", cause)
+		};
 	}
 	if (isAborted$1(signal)) return {
 		ok: false,
@@ -4943,36 +4795,36 @@ async function paymentRequestKeyLifecycle(operation, intent, provided) {
 		key: provided,
 		finish: async () => void 0
 	};
-	const slot = `capxul.payment.request-key.v3:${await fingerprintPaymentIntent({
-		operation,
-		intent
-	})}`;
-	if (typeof window === "undefined") {
-		const attemptId = randomPaymentRequestKey();
-		const state = memoryPaymentRequestKeys.get(slot) ?? {
-			key: randomPaymentRequestKey(),
-			active: [],
-			resolved: false
-		};
-		state.active.push(attemptId);
-		memoryPaymentRequestKeys.set(slot, state);
-		let finished = false;
-		return {
-			key: state.key,
-			finish: async (succeeded) => {
-				if (finished) return;
-				finished = true;
-				const attemptIndex = state.active.indexOf(attemptId);
-				if (attemptIndex < 0) return;
-				state.active.splice(attemptIndex, 1);
-				state.resolved = succeeded;
-				if (state.active.length === 0 && state.resolved) memoryPaymentRequestKeys.delete(slot);
-			}
-		};
-	}
 	let releaseAttemptLock;
 	let forgetPagehideRelease;
 	try {
+		const slot = `capxul.payment.request-key.v3:${await fingerprintPaymentIntent({
+			operation,
+			intent
+		})}`;
+		if (typeof window === "undefined") {
+			const attemptId = randomPaymentRequestKey();
+			const state = memoryPaymentRequestKeys.get(slot) ?? {
+				key: randomPaymentRequestKey(),
+				active: [],
+				resolved: false
+			};
+			state.active.push(attemptId);
+			memoryPaymentRequestKeys.set(slot, state);
+			let finished = false;
+			return {
+				key: state.key,
+				finish: async (succeeded) => {
+					if (finished) return;
+					finished = true;
+					const attemptIndex = state.active.indexOf(attemptId);
+					if (attemptIndex < 0) return;
+					state.active.splice(attemptIndex, 1);
+					state.resolved = succeeded;
+					if (state.active.length === 0 && state.resolved) memoryPaymentRequestKeys.delete(slot);
+				}
+			};
+		}
 		const attemptId = randomPaymentRequestKey();
 		releaseAttemptLock = await holdPaymentAttemptLock(paymentAttemptLockName(slot, attemptId));
 		forgetPagehideRelease = releasePaymentAttemptOnPagehide(releaseAttemptLock);
@@ -5027,13 +4879,20 @@ async function paymentRequestKeyLifecycle(operation, intent, provided) {
 		throw Errors.providerError("sdk", "paymentRequestKey", cause);
 	}
 }
+function paymentSubmissionFailure(cause) {
+	return {
+		ok: false,
+		error: cause instanceof CapxulError ? cause : Errors.unknown(cause)
+	};
+}
 async function waitForPaymentSubmission(submission, signal, operation, onCancel = () => false) {
-	if (signal === void 0) return submission;
-	if (signal.aborted) return onCancel() ? submission : {
+	const foldedSubmission = submission.catch((cause) => paymentSubmissionFailure(cause));
+	if (signal === void 0) return foldedSubmission;
+	if (signal.aborted) return onCancel() ? foldedSubmission : {
 		ok: false,
 		error: Errors.cancelled({ operation })
 	};
-	return new Promise((resolve, reject) => {
+	return new Promise((resolve) => {
 		const onAbort = () => {
 			signal.removeEventListener("abort", onAbort);
 			if (!onCancel()) resolve({
@@ -5042,12 +4901,9 @@ async function waitForPaymentSubmission(submission, signal, operation, onCancel
 			});
 		};
 		signal.addEventListener("abort", onAbort, { once: true });
-		submission.then((result) => {
+		foldedSubmission.then((result) => {
 			signal.removeEventListener("abort", onAbort);
 			resolve(result);
-		}, (cause) => {
-			signal.removeEventListener("abort", onAbort);
-			reject(cause instanceof Error ? cause : new Error(String(cause)));
 		});
 	});
 }
@@ -5092,7 +4948,7 @@ function makeFinancialOpsMethods(deps) {
 		} catch (cause) {
 			return {
 				ok: false,
-				error: cause instanceof CapxulError ? cause : Errors.providerError("sdk", "paymentRequestKey", cause)
+				error: cause instanceof CapxulError ? cause : Errors.unknown(cause)
 			};
 		}
 		const sharedKey = `${requestKeyScope}:${requestKey.key}`;
@@ -5140,7 +4996,10 @@ function makeFinancialOpsMethods(deps) {
 			try {
 				await requestKey.finish(false);
 			} catch {}
-			throw cause;
+			return {
+				ok: false,
+				error: cause instanceof CapxulError ? cause : Errors.unknown(cause)
+			};
 		}
 		release(false);
 		try {
@@ -5164,11 +5023,25 @@ function makeFinancialOpsMethods(deps) {
 	const runLifecycle = async (intent, signal) => {
 		const execution = lifecycleDependencies();
 		if (!execution.ok) return execution;
-		return mapOk(await executePaymentLifecycle(execution.value, intent, signal), (submitted) => {
-			const payment = submitted.payments[0];
-			if (payment === void 0 || submitted.payments.length !== 1) throw Errors.unknown();
-			return normalizePaymentTiming(payment);
-		});
+		try {
+			const submitted = await executePaymentLifecycle(execution.value, intent, signal);
+			if (!submitted.ok) return submitted;
+			const payments = submitted.value.payments;
+			const payment = payments[0];
+			if (payment === void 0 || payments.length !== 1) return {
+				ok: false,
+				error: Errors.unknown()
+			};
+			return {
+				ok: true,
+				value: normalizePaymentTiming(payment)
+			};
+		} catch (cause) {
+			return {
+				ok: false,
+				error: cause instanceof CapxulError ? cause : Errors.unknown(cause)
+			};
+		}
 	};
 	return {
 		me: {
@@ -5219,9 +5092,10 @@ function makeFinancialOpsMethods(deps) {
 						value: resolvedTargetFromPayee(reference, payee.value)
 					};
 				}
+				case "party":
 				case "destination": return Promise.resolve({
 					ok: false,
-					error: Errors.notImplemented("targets", "resolve.destination")
+					error: Errors.notImplemented("targets", `resolve.${reference.kind}`)
 				});
 			}
 		} },
@@ -5355,8 +5229,14 @@ function handleRefValue(value, field) {
 }
 function refFromTargetReference(reference, field) {
 	try {
-		if (typeof reference === "string") throw Errors.invalidInput(field, "target must be a typed TargetReference variant");
-		if (typeof reference !== "object" || reference === null || !("kind" in reference)) throw Errors.invalidInput(field, "target must be a typed TargetReference variant");
+		if (typeof reference === "string") return {
+			ok: false,
+			error: Errors.invalidInput(field, "target must be a typed TargetReference variant")
+		};
+		if (typeof reference !== "object" || reference === null || !("kind" in reference)) return {
+			ok: false,
+			error: Errors.invalidInput(field, "target must be a typed TargetReference variant")
+		};
 		switch (reference.kind) {
 			case "handle": return {
 				ok: true,
@@ -5386,20 +5266,26 @@ function refFromTargetReference(reference, field) {
 					payeeId: reference.id
 				}
 			};
+			case "party": return {
+				ok: true,
+				value: {
+					kind: "party",
+					partyId: reference.partyId
+				}
+			};
 			case "destination": return {
 				ok: false,
 				error: Errors.notImplemented("targets", "reference.destination")
 			};
-			default: throw Errors.invalidInput(field, "target must be a known TargetReference variant");
+			default: return {
+				ok: false,
+				error: Errors.invalidInput(field, "target must be a known TargetReference variant")
+			};
 		}
 	} catch (cause) {
-		if (cause instanceof Error && "code" in cause) return {
-			ok: false,
-			error: cause
-		};
 		return {
 			ok: false,
-			error: Errors.invalidInput(field, "target must be a typed TargetReference variant")
+			error: cause instanceof CapxulError ? cause : Errors.invalidInput(field, "target must be a typed TargetReference variant")
 		};
 	}
 }
@@ -5453,6 +5339,10 @@ function targetReferenceFromBackendRef(ref) {
 			kind: "payee",
 			id: ref.payeeId
 		};
+		case "party": return {
+			kind: "party",
+			partyId: ref.partyId
+		};
 		case "capxulUserId": throw Errors.notImplemented("targets", "reference.capxulUserId");
 	}
 }
@@ -5539,8 +5429,14 @@ function normalizeDestinationRefForBackend(ref, field) {
 }
 function normalizeRefForBackend(ref, field) {
 	try {
-		if (typeof ref === "string") throw Errors.invalidInput(field, "recipient must be a typed Ref variant");
-		if (typeof ref !== "object" || ref === null || !("kind" in ref)) throw Errors.invalidInput(field, "recipient must be a typed Ref variant");
+		if (typeof ref === "string") return {
+			ok: false,
+			error: Errors.invalidInput(field, "recipient must be a typed Ref variant")
+		};
+		if (typeof ref !== "object" || ref === null || !("kind" in ref)) return {
+			ok: false,
+			error: Errors.invalidInput(field, "recipient must be a typed Ref variant")
+		};
 		switch (ref.kind) {
 			case "handle": return {
 				ok: true,
@@ -5577,16 +5473,22 @@ function normalizeRefForBackend(ref, field) {
 					payeeId: nonEmptyRefValue(ref.payeeId, "payeeId")
 				}
 			};
-			default: throw Errors.invalidInput(field, "recipient must be a known Ref variant");
+			case "party": return {
+				ok: true,
+				value: {
+					kind: "party",
+					partyId: toPartyId(ref.partyId)
+				}
+			};
+			default: return {
+				ok: false,
+				error: Errors.invalidInput(field, "recipient must be a known Ref variant")
+			};
 		}
 	} catch (cause) {
-		if (cause instanceof Error && "code" in cause) return {
-			ok: false,
-			error: cause
-		};
 		return {
 			ok: false,
-			error: Errors.invalidInput(field, "recipient must be a typed Ref variant")
+			error: cause instanceof CapxulError ? cause : Errors.invalidInput(field, "recipient must be a typed Ref variant")
 		};
 	}
 }
@@ -5605,16 +5507,15 @@ function mapOk(result, f) {
 			value: f(result.value)
 		};
 	} catch (cause) {
-		if (cause instanceof Error && "code" in cause) return {
+		return {
 			ok: false,
-			error: cause
+			error: cause instanceof CapxulError ? cause : Errors.unknown(cause)
 		};
-		throw cause;
 	}
 }
 //#endregion
 //#region package.json
-var version = "2.1.1";
+var version = "2.3.0";
 //#endregion
 //#region src/ports/auth-client.ts
 var AuthClientError = class extends Data.TaggedError("AuthClientError") {};
@@ -6560,6 +6461,8 @@ const IDENTITY_SLOT = {
 const IDENTITY_SLOT_BY_EVENT = {
 	ReadSession: IDENTITY_SLOT.session,
 	RestoreSession: IDENTITY_SLOT.session,
+	SessionRestored: IDENTITY_SLOT.session,
+	SessionAbsent: IDENTITY_SLOT.session,
 	SessionRead: IDENTITY_SLOT.session,
 	SessionReadFailed: IDENTITY_SLOT.session,
 	RequestOtp: IDENTITY_SLOT.auth,
@@ -6625,7 +6528,7 @@ const modelSession = (session) => ({
 });
 const claimAccount = (input, authUserId, signer) => call("smart-account.claim", Effect.tryPromise({
 	try: () => signer.getAddress(),
-	catch: (cause) => cause instanceof CapxulError ? cause : Errors.providerError("openfort", "getAddress", cause, { failure_mode: "unknown" })
+	catch: (cause) => signerFailure(signer.source, "getAddress", cause)
 }).pipe(Effect.flatMap((signerAddress) => input.ports.smartAccount.claim({
 	authUserId: toAuthUserId(authUserId),
 	chainId: toChainId(input.chainId),
@@ -6871,7 +6774,7 @@ const identitySpec = (input, sessionStore = { current: null }) => {
 	};
 	return {
 		machine: "identity",
-		initial: SIGNED_OUT,
+		initial: RESTORING,
 		label,
 		slot: identitySlot,
 		transition: (state, event) => transition(state, event, config),
@@ -7007,7 +6910,7 @@ const bootIdentityFlow = (input, options = {}) => Effect.gen(function* () {
 			sessionStore.current = null;
 		}) : Effect.void)),
 		restoreAuthSession: (session, controls) => actor.ask({
-			_tag: "RestoreSession",
+			_tag: actor.snapshot().phase === "restoring" ? "SessionRestored" : "RestoreSession",
 			session: modelSession(session),
 			profileComplete: false
 		}, controls).pipe(Effect.tap(() => Effect.sync(() => {
@@ -7045,13 +6948,13 @@ const ask = (actor, event, controls, wrongState) => actor.ask(event, controls).p
 */
 const getSessionProgramWithOptions = (options) => Effect.gen(function* () {
 	const deps = yield* CapxulDepsTag;
-	const cached = yield* deps.authCache.getSession.pipe(Effect.mapError((e) => Errors.providerError("auth-cache", "getSession", e)));
+	const cached = yield* deps.authCache.getSession.pipe(Effect.mapError((e) => Errors.providerError("auth-cache", "getSession", e)), Effect.catch((failure) => deps.actor.snapshot().phase === "restoring" ? Effect.succeed(null) : Effect.fail(failure)));
 	const observed = deps.actor.snapshot();
 	const actorState = observed.phase;
 	if (observed.phase === "faulted") return yield* Effect.fail(publicIdentityFailure(observed.failure));
 	if (cached === null && (actorState === "otp_pending" || actorState === "otp_sending" || actorState === "otp_verifying")) return null;
-	if (cached !== null && actorState !== "signed_out") return cached;
-	if (cached !== null && actorState === "signed_out") {
+	if (cached !== null && !(actorState === "signed_out" || actorState === "restoring")) return cached;
+	if (cached !== null) {
 		yield* deps.actor.restoreAuthSession(cached, depsRequestOptions(deps, options)).pipe(Effect.mapError(actorError));
 		return cached;
 	}
@@ -7154,6 +7057,7 @@ const signInProgram = (input, options) => Effect.gen(function* () {
 	}, depsRequestOptions(deps, options), {
 		method: "signIn",
 		validStates: [
+			"restoring",
 			"signed_out",
 			"otp_pending",
 			"faulted"
@@ -7177,7 +7081,7 @@ const signInProgram = (input, options) => Effect.gen(function* () {
 const signOutProgramWithOptions = (options) => Effect.gen(function* () {
 	const deps = yield* CapxulDepsTag;
 	let phase = deps.actor.snapshot().phase;
-	if (phase === "signed_out") {
+	if (phase === "signed_out" || phase === "restoring") {
 		const cached = yield* deps.authCache.getSession.pipe(Effect.mapError((e) => Errors.providerError("auth-cache", "getSession", e)));
 		if (cached !== null) {
 			yield* deps.actor.restoreAuthSession(cached, depsRequestOptions(deps, options)).pipe(Effect.mapError(actorError));
@@ -7553,6 +7457,32 @@ function makeSystemMethods(deps) {
 	return { health: (nonce, options) => runIfActive(options?.signal, "system.health", () => deps.convexCall.query(healthQuery, { nonce })) };
 }
 //#endregion
+//#region src/contract/org.ts
+const orgReadContract = { me: makeFunctionReference(CAPXUL_FUNCTIONS["org/queries"].me) };
+//#endregion
+//#region src/surface/org-me.ts
+function toBudget(wire) {
+	return {
+		id: toBudgetId(wire.id),
+		label: wire.label,
+		limit: wire.limitRaw === null ? null : fromWei(wire.limitRaw, wire.decimals, wire.currency)
+	};
+}
+function toOrgMe(wire) {
+	return {
+		role: wire.role === null ? null : { label: wire.role.label },
+		capabilities: {
+			canManagePeople: wire.capabilities.canManagePeople,
+			canSpend: wire.capabilities.canSpend
+		},
+		budgets: wire.budgets.map(toBudget),
+		observedAt: wire.observedAt
+	};
+}
+function makeOrgMeMethod(deps, orgId) {
+	return (options) => runIfActive(options?.signal, "org.me", () => Effect.map(deps.convexCall.query(orgReadContract.me, { orgId }), toOrgMe));
+}
+//#endregion
 //#region src/contract/permission.ts
 const permissionContract = { read: makeFunctionReference(CAPXUL_FUNCTIONS["permission/queries"].read) };
 //#endregion
@@ -7560,12 +7490,6 @@ const permissionContract = { read: makeFunctionReference(CAPXUL_FUNCTIONS["permi
 function isAborted(signal) {
 	return signal?.aborted === true;
 }
-function fail$1(cause, operation) {
-	return {
-		ok: false,
-		error: cause instanceof CapxulError ? cause : Errors.providerError("wallet-signer", operation, cause)
-	};
-}
 async function execute(deps, orgId, command, signal) {
 	if (isAborted(signal)) return {
 		ok: false,
@@ -7584,7 +7508,10 @@ async function execute(deps, orgId, command, signal) {
 	try {
 		signerAddress = await deps.signer.getAddress();
 	} catch (cause) {
-		return fail$1(cause, "getAddress");
+		return {
+			ok: false,
+			error: signerFailure(deps.signer.source, "getAddress", cause)
+		};
 	}
 	const executionFns = deps.executionFunctions ?? moneyExecutionContract;
 	const prepared = await runIfActive(signal, "permissions.prepareExecution", () => deps.convexCall.action(executionFns.preparePermissionExecution, { input: {
@@ -7606,7 +7533,10 @@ async function execute(deps, orgId, command, signal) {
 	try {
 		signature = await deps.signer.signUserOpHash(prepared.value.digest);
 	} catch (cause) {
-		return fail$1(cause, "signUserOpHash");
+		return {
+			ok: false,
+			error: signerFailure(deps.signer.source, "signUserOpHash", cause)
+		};
 	}
 	if (isAborted(signal)) return {
 		ok: false,
@@ -7684,7 +7614,7 @@ function makeOrganizationPaymentsMethods(deps, orgId) {
 		} catch (cause) {
 			return {
 				ok: false,
-				error: cause instanceof CapxulError ? cause : Errors.providerError("sdk", "paymentRequestKey", cause)
+				error: cause instanceof CapxulError ? cause : Errors.unknown(cause)
 			};
 		}
 		const flightKey = `${requestKeyScope}:${operation}:${requestKey.key}`;
@@ -7731,16 +7661,16 @@ function makeOrganizationPaymentsMethods(deps, orgId) {
 			try {
 				await requestKey.finish(false);
 			} catch {}
-			throw cause;
+			return {
+				ok: false,
+				error: cause instanceof CapxulError ? cause : Errors.unknown(cause)
+			};
 		}
 		release(false);
 		try {
 			await requestKey.finish(result.ok);
 		} catch {}
-		return result.ok ? {
-			ok: true,
-			value: result.value.payments.map((payment) => normalizePaymentTiming(payment))
-		} : result;
+		return mapOk(result, (value) => value.payments.map((payment) => normalizePaymentTiming(payment)));
 	};
 	return {
 		pay: async (input, options) => {
@@ -7910,38 +7840,6 @@ function hermeticOrgView(input) {
 		logoUrl: null
 	};
 }
-function moneyFromConfig(input) {
-	return {
-		currency: toCurrencyCode(input.currency),
-		value: input.value,
-		decimals: input.decimals
-	};
-}
-function recipientsFromConfig(toRecipients) {
-	if (toRecipients === void 0 || toRecipients === "anyone") return toRecipients;
-	return toRecipients.map((recipient) => toAddress(recipient));
-}
-function roleDefinitionFromConfig(definition) {
-	const toRecipients = recipientsFromConfig(definition.spend?.toRecipients);
-	return {
-		label: definition.label,
-		...definition.spend === void 0 ? {} : { spend: {
-			...definition.spend.perTx === void 0 ? {} : { perTx: moneyFromConfig(definition.spend.perTx) },
-			...definition.spend.perDay === void 0 ? {} : { perDay: moneyFromConfig(definition.spend.perDay) },
-			...toRecipients === void 0 ? {} : { toRecipients }
-		} },
-		...definition.canManageMembers === void 0 ? {} : { canManageMembers: definition.canManageMembers },
-		...definition.canManageRoles === void 0 ? {} : { canManageRoles: definition.canManageRoles }
-	};
-}
-function startupRoleViews(orgId) {
-	return compileOrgRoleDefinitions(orgRoleTemplateDefinitions("Startup")).roles.map((role) => ({
-		orgId,
-		label: role.label,
-		roleKey: toRoleKey(role.roleKey),
-		definition: roleDefinitionFromConfig(role.definition)
-	}));
-}
 function hermeticMember(input) {
 	return {
 		orgId: input.orgId,
@@ -8043,7 +7941,7 @@ function listRolesProgram(orgId) {
 	return Effect.gen(function* () {
 		const deps = yield* OrgDepsTag;
 		if (deps.orgPort !== void 0) return yield* deps.orgPort.listRoles({ orgId }).pipe(Effect.mapError((error) => error.publicError));
-		return startupRoleViews(orgId);
+		return [];
 	});
 }
 function listMembersProgram(orgId) {
@@ -8208,6 +8106,7 @@ function makeOrgMethods(deps) {
 					},
 					...convexCall === void 0 ? {} : { convexCall }
 				}),
+				me: convexCall === void 0 ? orgMeUnavailable : makeOrgMeMethod({ convexCall }, String(orgId)),
 				async getLifecycle(options) {
 					if (options?.signal?.aborted) return {
 						ok: false,
@@ -8355,6 +8254,10 @@ function makeNotImplementedOrganizationPaymentsMethods() {
 		payBatch: organizationPaymentExecutionUnavailable
 	};
 }
+const orgMeUnavailable = () => Promise.resolve({
+	ok: false,
+	error: Errors.notImplemented("org", "me")
+});
 const permissionExecutionUnavailable = () => Promise.resolve({
 	ok: false,
 	error: Errors.notImplemented("permissions", "executionComposition")
@@ -8383,6 +8286,142 @@ function detectAuthCacheAdapter() {
 	return new InMemoryAuthCacheAdapter();
 }
 //#endregion
+//#region src/telemetry/stack-frame-parser.ts
+/**
+* Regex for V8/Chrome stack trace frame lines.
+* Matches:
+*   `at functionName (url:line:col)`
+*   `at url:line:col`
+*   `at async functionName (url:line:col)`
+*   `at new ClassName (url:line:col)`
+*/
+const V8_FRAME_RE = /^\s*at\s+(?:(.+?)\s+\()?(?:(.+?)(?::(\d+):(\d+))?|(.+?))\)?\s*$/;
+function isNonUrlName(name) {
+	return name === "<anonymous>" || name.startsWith("eval") || name.startsWith("new ") || name.startsWith("async ");
+}
+/**
+* Parse a V8/Chrome-style stack trace string into PostHog `ExceptionFrame` objects.
+* Returns an empty array when `error.stack` is absent or empty.
+*
+* Handles:
+* - Standard `at functionName (url:line:col)`
+* - Bare `at url:line:col` (no function name)
+* - `at async functionName (url:line:col)`
+* - `at new ClassName (url:line:col)`
+* - Native frames: `at Array.forEach (<anonymous>)`
+*/
+function parseV8StackFrames(error) {
+	const stack = error.stack;
+	if (stack === void 0 || stack === null || stack === "") return [];
+	const lines = stack.split("\n");
+	const frames = [];
+	for (const line of lines) {
+		const trimmed = line.trim();
+		if (!trimmed.startsWith("at ")) continue;
+		const match = V8_FRAME_RE.exec(trimmed);
+		if (match === null) continue;
+		if (match[1] !== void 0) frames.push({
+			function: match[1],
+			filename: match[2],
+			lineno: match[3] !== void 0 ? Number(match[3]) : null,
+			colno: match[4] !== void 0 ? Number(match[4]) : null
+		});
+		else if (match[2] !== void 0 && !isNonUrlName(match[2])) frames.push({
+			function: "<anonymous>",
+			filename: match[2],
+			lineno: match[3] !== void 0 ? Number(match[3]) : null,
+			colno: match[4] !== void 0 ? Number(match[4]) : null
+		});
+		else frames.push({
+			function: match[1] ?? match[2] ?? match[5] ?? "<anonymous>",
+			filename: match[2] ?? match[5] ?? "<anonymous>",
+			lineno: match[3] !== void 0 ? Number(match[3]) : null,
+			colno: match[4] !== void 0 ? Number(match[4]) : null
+		});
+	}
+	return frames;
+}
+/** Fixed, leak-safe frame used when the error carries no parseable stack. */
+const SDK_BOUNDARY_FILENAME = "capxul-sdk-observation://boundary";
+/**
+* Build PostHog's `$exception_list` (always a single entry). Error Tracking
+* groups on `type`, so it is ALWAYS present (the CapxulError code) — the
+* previous `[{ frames }]` shape omitted it and PostHog dropped the event as
+* "missing field `type`". When the error has no parseable stack, a synthetic
+* boundary frame stands in so the event still ingests as a real Issue (#1031).
+*/
+function buildExceptionList(input) {
+	const frames = input.frames.length > 0 ? input.frames : [{
+		filename: SDK_BOUNDARY_FILENAME,
+		function: input.operation ?? "unknown",
+		lineno: 1,
+		colno: 1
+	}];
+	return [{
+		type: input.type,
+		value: input.value,
+		mechanism: {
+			handled: true,
+			type: "capxul_sdk_boundary"
+		},
+		stacktrace: { frames }
+	}];
+}
+//#endregion
+//#region src/telemetry/capture-exception.ts
+/** Fixed, leak-safe message — the raw error message may carry PII and never ships. */
+const EXCEPTION_MESSAGE = "Capxul SDK operation failed";
+/**
+* Capture an error as a `$exception` event through the telemetry port,
+* formatted for PostHog Error Tracking.
+*
+* Parses stack traces into `$exception_list` format, extracts structured
+* metadata from CapxulError objects, and supplements with context props.
+* Fire-and-forget: telemetry defects are silently swallowed.
+* Returns `Effect<void, never>` for use in Effect pipelines; the underlying
+* adapter work is synchronous, so callers outside Effect contexts can
+* use `Effect.runSync`.
+*/
+function captureException(telemetry, error, context) {
+	return Effect.catchDefect(Effect.sync(() => {
+		const frames = error instanceof Error ? parseV8StackFrames(error) : [];
+		const capxulError = isCapxulError(error) ? error : null;
+		const errorCode = capxulError?.code ?? context?.capxul_error_code ?? "UNKNOWN";
+		const props = {
+			capxul_error_code: errorCode,
+			$exception_type: errorCode,
+			$exception_message: EXCEPTION_MESSAGE,
+			$exception_list: buildExceptionList({
+				type: errorCode,
+				value: EXCEPTION_MESSAGE,
+				...context?.operation === void 0 ? {} : { operation: context.operation },
+				frames
+			}),
+			layer: capxulError?.layer ?? context?.layer,
+			operation: context?.operation,
+			provider: context?.provider,
+			failure_mode: resolveFailureMode(error, context?.failure_mode)
+		};
+		if (capxulError?.details !== void 0) props.details = JSON.stringify(capxulError.details);
+		for (const key of Object.keys(props)) if (props[key] === void 0) delete props[key];
+		return telemetry.emit({
+			name: "$exception",
+			props
+		});
+	}).pipe(Effect.flatten), () => Effect.void);
+}
+/**
+* Synchronous fire-and-forget capture. Runs the Effect inline with
+* `Effect.runSync` so callers outside an Effect context can report errors
+* without awaiting. Core SDK public methods use the assembled observation
+* boundary instead.
+*/
+function captureExceptionSync(telemetry, error, context) {
+	try {
+		Effect.runSync(captureException(telemetry, error, context));
+	} catch {}
+}
+//#endregion
 //#region src/observation.ts
 const SDK_VERSION = version;
 /** Stable PostHog event used for typed failures that are expected product outcomes. */
@@ -8431,16 +8470,98 @@ function postHogFailureObservation(policy, fixedSnapshot) {
 function classifyOperationOutcome(kind) {
 	return EXPECTED_OPERATION_OUTCOMES.has(kind) ? "expected" : "unexpected";
 }
+/** @internal Observe public result methods at the assembled Core SDK boundary. */
+function observeSdkClient(client, adapter, snapshot) {
+	if (adapter === void 0) return client;
+	const objectProxies = /* @__PURE__ */ new WeakMap();
+	const proxyTargets = /* @__PURE__ */ new WeakMap();
+	const functionWrappers = /* @__PURE__ */ new WeakMap();
+	const wrapObject = (target, path, internal = false) => {
+		const cacheKey = `${internal ? "internal" : "public"}:${path.join(".")}`;
+		let targetProxies = objectProxies.get(target);
+		const cached = targetProxies?.get(cacheKey);
+		if (cached !== void 0) return cached;
+		const proxy = new Proxy(target, { get(currentTarget, property, receiver) {
+			const value = Reflect.get(currentTarget, property, receiver);
+			if (typeof property !== "string") return value;
+			if (path.length === 0 && property === "_internal" && isPlainObject(value)) return wrapObject(value, ["_internal"], true);
+			if (internal && property !== "accounts") return value;
+			return wrapValue(value, [...path, property], currentTarget);
+		} });
+		proxyTargets.set(proxy, target);
+		if (targetProxies === void 0) {
+			targetProxies = /* @__PURE__ */ new Map();
+			objectProxies.set(target, targetProxies);
+		}
+		targetProxies.set(cacheKey, proxy);
+		return proxy;
+	};
+	const wrapValue = (value, path, owner) => {
+		if (typeof value === "function") {
+			const callable = value;
+			const operation = path.join(".");
+			let ownerWrappers = functionWrappers.get(owner);
+			if (ownerWrappers === void 0) {
+				ownerWrappers = /* @__PURE__ */ new Map();
+				functionWrappers.set(owner, ownerWrappers);
+			}
+			const cached = ownerWrappers.get(operation);
+			if (cached !== void 0) return cached;
+			let wrapped;
+			wrapped = new Proxy(callable, {
+				apply(currentTarget, thisArg, args) {
+					const invocation = resolveInvocationSnapshot(adapter, snapshot);
+					let output;
+					try {
+						output = Reflect.apply(currentTarget, unwrapReceiver(thisArg), args);
+					} catch (cause) {
+						report(adapter, "exception", operation, cause, invocation);
+						throw cause;
+					}
+					if (isPromiseLike(output)) return Promise.resolve(output).then((result) => processOutput(result, path, invocation), (cause) => {
+						report(adapter, "exception", operation, cause, invocation);
+						throw cause;
+					});
+					return processOutput(output, path, invocation);
+				},
+				get(currentTarget, property) {
+					if (property === "bind") return Function.prototype.bind.bind(wrapped);
+					if (property === "call") return Function.prototype.call.bind(wrapped);
+					if (property === "apply") return Function.prototype.apply.bind(wrapped);
+					const attached = Reflect.get(currentTarget, property, currentTarget);
+					if (typeof property !== "string") return attached;
+					return wrapValue(attached, [...path, property], currentTarget);
+				}
+			});
+			proxyTargets.set(wrapped, callable);
+			ownerWrappers.set(operation, wrapped);
+			return wrapped;
+		}
+		return isPlainObject(value) ? wrapObject(value, path) : value;
+	};
+	const processOutput = (output, path, invocation) => {
+		if (isFailedResult(output)) {
+			report(adapter, "operation", path.join("."), output.error, invocation);
+			return output;
+		}
+		if (isCapxulResult(output)) return output;
+		return isPlainObject(output) ? wrapObject(output, path) : output;
+	};
+	return wrapObject(client, []);
+	function unwrapReceiver(receiver) {
+		return (typeof receiver === "object" || typeof receiver === "function") && receiver !== null ? proxyTargets.get(receiver) ?? receiver : receiver;
+	}
+}
 /** @internal Reports a factory-level typed failure without changing its identity. */
 function observeFailedResult(result, adapter, operation) {
-	if (adapter !== void 0 && isFailedResult(result)) report(adapter, "operation", operation, result.error, resolveAdapterContext(adapter));
+	if (adapter !== void 0 && isFailedResult(result)) report(adapter, "operation", operation, result.error, resolveAdapterSnapshot(adapter));
 	return result;
 }
-function report(adapter, kind, operation, cause, invocationContext) {
+function report(adapter, kind, operation, cause, invocation) {
 	const operationName = normalizeOperation(operation);
 	const kindName = normalizeErrorKind(errorKind(cause));
 	const context = sanitizeObservationContext({
-		...invocationContext,
+		...invocation.context,
 		...isCapxulError(cause) && cause.correlationId !== void 0 ? { correlationId: cause.correlationId } : {}
 	});
 	const failure = markFailureInvocationSnapshot({
@@ -8450,13 +8571,27 @@ function report(adapter, kind, operation, cause, invocationContext) {
 		errorKind: kindName,
 		...context === void 0 ? {} : { context }
 	}, {
-		active: invocationContext !== void 0,
+		active: invocation.active,
 		...context === void 0 ? {} : { context }
 	});
 	try {
 		ignoreDeliveryFailure(kind === "operation" ? adapter.captureOperationFailure(failure) : adapter.captureException(failure));
 	} catch {}
 }
+function resolveInvocationSnapshot(adapter, snapshot) {
+	if (snapshot !== void 0) try {
+		const captured = snapshot();
+		if (captured !== void 0) return captured;
+	} catch {}
+	return resolveAdapterSnapshot(adapter);
+}
+function resolveAdapterSnapshot(adapter) {
+	const context = resolveAdapterContext(adapter);
+	return context === void 0 ? { active: false } : {
+		active: true,
+		context
+	};
+}
 function resolveAdapterContext(adapter) {
 	try {
 		return adapter.resolveContext?.();
@@ -8663,6 +8798,8 @@ const APPLIED_ACTION_BY_EVENT = {
 	RestoreSession: "none",
 	ResumeOtpEntry: "none",
 	Reset: "none",
+	SessionRestored: "none",
+	SessionAbsent: "none",
 	EnsureAccount: "none",
 	ClaimAccount: "none",
 	RetryAccount: "none",
@@ -8747,6 +8884,7 @@ function executeIdentityProductObservation(telemetry, record, state) {
 //#endregion
 //#region src/surface/create-capxul-client.ts
 function assembleCapxulClient(input) {
+	const observation = input;
 	const authCache = input.authCache ?? detectAuthCacheAdapter();
 	const effectRunner = input.effectRunner ?? {
 		runSync: Effect.runSync,
@@ -8760,7 +8898,7 @@ function assembleCapxulClient(input) {
 		...input.signer === void 0 ? {} : { signer: input.signer },
 		...input.organizationSetup === void 0 ? {} : { organizationSetup: input.organizationSetup },
 		...input.otpTtlMs === void 0 ? {} : { otpTtlMs: input.otpTtlMs }
-	}), scope)), input.hostObservationSnapshot);
+	}), scope)), observation.hostObservationSnapshot);
 	const unsubscribeProductTelemetry = actor.subscribeTransitions((record) => {
 		effectRunner.runPromise(executeIdentityProductObservation(input.ports.telemetry, record, actor.snapshot())).catch(() => {});
 	});
@@ -8809,7 +8947,11 @@ function assembleCapxulClient(input) {
 		...input.invokeTimeoutMs === void 0 ? {} : { invokeTimeoutMs: input.invokeTimeoutMs },
 		afterVerifyOtp: async () => {
 			const browserSigner = input.signer;
-			if (browserSigner !== void 0 && "resetSession" in browserSigner && typeof browserSigner.resetSession === "function") browserSigner.resetSession();
+			if (browserSigner !== void 0 && "resetSession" in browserSigner && typeof browserSigner.resetSession === "function") try {
+				browserSigner.resetSession();
+			} catch (cause) {
+				throw signerFailure(browserSigner.source, "resetSession", cause);
+			}
 			await detectPendingOrgInvitations?.();
 			kickProvisioning?.();
 		}
@@ -8915,7 +9057,7 @@ function assembleCapxulClient(input) {
 			};
 		}
 	};
-	return {
+	return observeSdkClient({
 		auth,
 		smartAccount,
 		identity,
@@ -8937,6 +9079,7 @@ function assembleCapxulClient(input) {
 		createOrg: orgMethods.createOrg,
 		orgs: orgMethods.orgs,
 		org: orgMethods.org,
+		signer: input.signer?.statusStore ?? UNOBSERVABLE_SIGNER_STATUS,
 		_internal: {
 			identity: identityRuntime,
 			bootstrap: input.bootstrap,
@@ -8945,7 +9088,7 @@ function assembleCapxulClient(input) {
 			telemetry: input.ports.telemetry,
 			close: stopActor
 		}
-	};
+	}, observation.failureObservation, observation.hostObservationSnapshot);
 }
 function withHostObservation(actor, snapshot) {
 	if (snapshot === void 0) return actor;
@@ -8962,4 +9105,4 @@ function withHostObservation(actor, snapshot) {
 	};
 }
 //#endregion
-export { OBSERVATION_CONTEXT_HEADER as A, captureException as B, bootstrapErrorFromCapxul as C, fingerprintPaymentIntent as D, version as E, EngineeringTelemetryBootstrapPolicy as F, deriveCapxulSafeAddress as G, CAPXUL_PAYMENTS_V2_ADDRESS as H, isSettingUpLifecycle as I, destination as K, formatTraceparent as L, sanitizeObservationContext as M, CAPXUL_FUNCTIONS as N, toWei as O, BootstrapEnvelope as P, copyInvocationObservation as R, BootstrapPortTag as S, AuthClientPortTag as T, normalizeBindingEmail as U, captureExceptionSync as V, BASE_SEPOLIA_CHAIN_ID as W, identityErrorFromCapxul as _, observeFailedResult as a, ClockError as b, PostHogTelemetryLayer as c, SmartAccountPortTag as d, smartAccountErrorFromCapxul as f, IdentityPortTag as g, wireChainId as h, observationContextProps as i, encodeObservationContextHeader as j, fromWei as k, TelemetryPortTag as l, accountReadErrorFromCapxul as m, postHogProductTelemetry as n, postHogFailureObservation as o, AccountReadPortTag as p, CAPXUL_SDK_EXPECTED_OUTCOME_EVENT as r, detectAuthCacheAdapter as s, assembleCapxulClient as t, redactTelemetryEvent as u, ConvexCallPortTag as v, authClientPortFromPromiseAdapter as w, ClockPortTag as x, convexCallErrorFromCapxul as y, readInvocationObservation as z };
+export { fingerprintPaymentIntent as A, formatTraceparent as B, ClockPortTag as C, AuthClientError as D, authClientPortFromPromiseAdapter as E, sanitizeObservationContext as F, signerFailure as G, readInvocationObservation as H, CAPXUL_FUNCTIONS as I, BASE_SEPOLIA_CHAIN_ID as J, CAPXUL_PAYMENTS_V2_ADDRESS as K, BootstrapEnvelope as L, fromWei as M, OBSERVATION_CONTEXT_HEADER as N, AuthClientPortTag as O, encodeObservationContextHeader as P, isRestoring as Q, EngineeringTelemetryBootstrapPolicy as R, ClockError as S, bootstrapErrorFromCapxul as T, causeChain as U, copyInvocationObservation as V, injectedWalletSigner as W, destination as X, deriveCapxulSafeAddress as Y, isClaimed as Z, wireChainId as _, observeFailedResult as a, ConvexCallPortTag as b, captureExceptionSync as c, TelemetryPortTag as d, redactTelemetryEvent as f, accountReadErrorFromCapxul as g, AccountReadPortTag as h, observationContextProps as i, toWei as j, version as k, detectAuthCacheAdapter as l, smartAccountErrorFromCapxul as m, postHogProductTelemetry as n, postHogFailureObservation as o, SmartAccountPortTag as p, normalizeBindingEmail as q, CAPXUL_SDK_EXPECTED_OUTCOME_EVENT as r, captureException as s, assembleCapxulClient as t, PostHogTelemetryLayer as u, IdentityPortTag as v, BootstrapPortTag as w, convexCallErrorFromCapxul as x, identityErrorFromCapxul as y, isSettingUpLifecycle as z };