@capxul/sdk 2.1.1 → 2.3.0

package/dist/index.mjs

@@ -1,5 +1,5 @@
-import { A as OBSERVATION_CONTEXT_HEADER, B as captureException, C as bootstrapErrorFromCapxul, D as fingerprintPaymentIntent, E as version, F as EngineeringTelemetryBootstrapPolicy, H as CAPXUL_PAYMENTS_V2_ADDRESS, I as isSettingUpLifecycle, K as destination, L as formatTraceparent, M as sanitizeObservationContext, N as CAPXUL_FUNCTIONS, O as toWei, P as BootstrapEnvelope, R as copyInvocationObservation, S as BootstrapPortTag, T as AuthClientPortTag, U as normalizeBindingEmail, V as captureExceptionSync, W as BASE_SEPOLIA_CHAIN_ID, _ as identityErrorFromCapxul, a as observeFailedResult, b as ClockError, c as PostHogTelemetryLayer, d as SmartAccountPortTag, f as smartAccountErrorFromCapxul, g as IdentityPortTag, h as wireChainId, i as observationContextProps, j as encodeObservationContextHeader, k as fromWei, l as TelemetryPortTag, m as accountReadErrorFromCapxul, n as postHogProductTelemetry, o as postHogFailureObservation, p as AccountReadPortTag, r as CAPXUL_SDK_EXPECTED_OUTCOME_EVENT, s as detectAuthCacheAdapter, t as assembleCapxulClient, v as ConvexCallPortTag, w as authClientPortFromPromiseAdapter, x as ClockPortTag, y as convexCallErrorFromCapxul, z as readInvocationObservation } from "./create-capxul-client-CPhTPz_9.mjs";
-import { A as toSessionToken, C as toEpochMs, D as toOrgId, E as toKycTier, F as isCapxulError, M as CapxulError, O as toPublishableKey, P as Errors, S as toEmail, T as toJwtToken, _ as toAuthUserId, b as toCurrencyCode, h as toAllowedOrigin, j as decodeConvexError, k as toRoleKey, m as toAddress, o as AuthCachePortTag, p as toAccountId, v as toChainId, w as toEpochSeconds, x as toDurationMs, y as toCountryCode } from "./InMemoryAuthCacheAdapter-Rc8tCtml.mjs";
+import { A as fingerprintPaymentIntent, B as formatTraceparent, C as ClockPortTag, D as AuthClientError, E as authClientPortFromPromiseAdapter, F as sanitizeObservationContext, G as signerFailure, H as readInvocationObservation, I as CAPXUL_FUNCTIONS, J as BASE_SEPOLIA_CHAIN_ID, K as CAPXUL_PAYMENTS_V2_ADDRESS, L as BootstrapEnvelope, M as fromWei, N as OBSERVATION_CONTEXT_HEADER, O as AuthClientPortTag, P as encodeObservationContextHeader, Q as isRestoring, R as EngineeringTelemetryBootstrapPolicy, S as ClockError, T as bootstrapErrorFromCapxul, U as causeChain, V as copyInvocationObservation, W as injectedWalletSigner, X as destination, Z as isClaimed, _ as wireChainId, a as observeFailedResult, b as ConvexCallPortTag, c as captureExceptionSync, d as TelemetryPortTag, g as accountReadErrorFromCapxul, h as AccountReadPortTag, i as observationContextProps, j as toWei, k as version, l as detectAuthCacheAdapter, m as smartAccountErrorFromCapxul, n as postHogProductTelemetry, o as postHogFailureObservation, p as SmartAccountPortTag, q as normalizeBindingEmail, r as CAPXUL_SDK_EXPECTED_OUTCOME_EVENT, s as captureException, t as assembleCapxulClient, u as PostHogTelemetryLayer, v as IdentityPortTag, w as BootstrapPortTag, x as convexCallErrorFromCapxul, y as identityErrorFromCapxul, z as isSettingUpLifecycle } from "./create-capxul-client-mArFr_Os.mjs";
+import { C as toDurationMs, D as toJwtToken, E as toEpochSeconds, F as CAPXUL_ERROR_CODES, I as CapxulError, M as toRoleKey, N as toSessionToken, O as toKycTier, P as decodeConvexError, R as Errors, S as toCurrencyCode, T as toEpochMs, b as toChainId, g as toAllowedOrigin, h as toAddress, j as toPublishableKey, k as toOrgId, m as toAccountId, o as AuthCachePortTag, p as currencySymbolFor, v as toAuthUserId, w as toEmail, x as toCountryCode, z as isCapxulError } from "./InMemoryAuthCacheAdapter-qMpBOGb3.mjs";
 import { keccak256, recoverAddress, stringToHex } from "viem";
 import { Cause, Context, Data, Effect, Exit, Layer, Result, SchemaIssue, SchemaParser, Scope, Tracer } from "effect";
 import { getFunctionName, makeFunctionReference } from "convex/server";
@@ -8,6 +8,89 @@ import { FetchHttpClient, Headers, HttpClient } from "effect/unstable/http";
 import { OtlpExporter, OtlpLogger, OtlpSerialization, OtlpTracer } from "effect/unstable/observability";
 import { ConvexClient } from "convex/browser";
 import { AccountTypeEnum, ChainTypeEnum, EmbeddedState, Openfort, RecoveryMethod, ThirdPartyOAuthProvider } from "@openfort/openfort-js";
+//#region src/domain/money/format-money.ts
+function formatMoney(money, options = {}) {
+	if (!Number.isInteger(money.decimals) || money.decimals < 0) throw Errors.invalidInput("money.decimals", "must be a non-negative integer");
+	const symbol = currencySymbolFor(money.currency);
+	const maximumFractionDigits = options.grammar === "code" ? 4 : 2;
+	const rounded = roundDecimal(money.value, money.decimals, maximumFractionDigits);
+	const grouped = rounded.integer.replace(/\B(?=(\d{3})+(?!\d))/g, ",");
+	const signed = `${rounded.negative ? "-" : ""}${grouped}`;
+	if (options.grammar === "code") {
+		if (!rounded.hadFraction) return `${signed} ${String(money.currency)}`;
+		let displayedFraction = rounded.fraction;
+		while (displayedFraction.length > 2 && displayedFraction.endsWith("0")) displayedFraction = displayedFraction.slice(0, -1);
+		return `${signed}.${displayedFraction} ${String(money.currency)}`;
+	}
+	return `${symbol}${signed}.${rounded.fraction}`;
+}
+function roundDecimal(value, decimals, maximumFractionDigits) {
+	const match = /^(-?)(\d+)(?:\.(\d+))?$/.exec(value);
+	if (match === null) throw Errors.invalidInput("money.value", "must be a base-10 decimal string");
+	const integer = match[2] ?? "0";
+	const sourceFraction = match[3] ?? "";
+	if (sourceFraction.length > decimals) throw Errors.invalidInput("money.value", "fraction exceeds money.decimals");
+	const scale = 10n ** BigInt(maximumFractionDigits);
+	const keptFraction = sourceFraction.slice(0, maximumFractionDigits).padEnd(maximumFractionDigits, "0");
+	let scaled = BigInt(integer) * scale + BigInt(keptFraction || "0");
+	if ((sourceFraction[maximumFractionDigits] ?? "0") >= "5") scaled += 1n;
+	return {
+		negative: match[1] === "-",
+		integer: (scaled / scale).toString(),
+		fraction: (scaled % scale).toString().padStart(maximumFractionDigits, "0"),
+		hadFraction: /[1-9]/.test(sourceFraction)
+	};
+}
+//#endregion
+//#region src/domain/money/parse-money.ts
+/**
+* ADR-0023 R1: the reason is a closed code and the ONLY failure vocabulary —
+* the consuming app maps each code to its own sentence. The SDK ships no
+* English for user-text failure.
+*/
+function isMoneyParseError(value) {
+	return "kind" in value;
+}
+const AMOUNT_PATTERN = /^(?:\d{1,3}(?:,\d{3})+|\d+)(?:\.\d+)?$/;
+const ZERO_PATTERN = /^0+(?:\.0+)?$/;
+function parseMoney(input, asset) {
+	if (!Number.isInteger(asset.decimals) || asset.decimals < 0) throw Errors.invalidInput("asset.decimals", "must be a non-negative integer");
+	const value = input.trim();
+	if (value.length === 0) return {
+		kind: "error",
+		reason: "required"
+	};
+	if (value.length > 24) return {
+		kind: "error",
+		reason: "too-long"
+	};
+	const negative = value.startsWith("-");
+	const unsigned = negative ? value.slice(1) : value;
+	if (!AMOUNT_PATTERN.test(unsigned)) return {
+		kind: "error",
+		reason: "invalid-format"
+	};
+	if (negative) return {
+		kind: "error",
+		reason: "non-positive"
+	};
+	const normalized = unsigned.replaceAll(",", "");
+	const fraction = normalized.split(".")[1];
+	if (fraction !== void 0 && fraction.length > asset.decimals) return {
+		kind: "error",
+		reason: "too-many-decimals"
+	};
+	if (ZERO_PATTERN.test(normalized)) return {
+		kind: "error",
+		reason: "non-positive"
+	};
+	return {
+		currency: asset.currency,
+		value: normalized,
+		decimals: asset.decimals
+	};
+}
+//#endregion
 //#region src/surface/account-providers.ts
 function localPrivateKeyAccountProvider(input) {
 	const account = privateKeyToAccount(input.privateKey);
@@ -53,7 +136,7 @@ function eip1193AccountProvider(input) {
 			} catch (err) {
 				return {
 					ok: false,
-					error: Errors.providerError("eip1193", "eth_accounts", err)
+					error: signerFailure("injected-eip1193", "eth_accounts", err)
 				};
 			} finally {
 				inFlight = null;
@@ -78,60 +161,6 @@ function firstAccount(value) {
 	return typeof first === "string" ? first : null;
 }
 //#endregion
-//#region src/signer.ts
-const EVM_ADDRESS_HEX$1 = /^0x[0-9a-fA-F]{40}$/;
-const ECDSA_SIGNATURE_HEX$1 = /^0x[0-9a-fA-F]{130}$/;
-const SAFE_OP_DIGEST_HEX$1 = /^0x[0-9a-fA-F]{64}$/;
-/**
-* Browser `CapxulSigner` backed by an injected EIP-1193 wallet (MetaMask, etc.).
-* Signs the SafeOp digest via `eth_sign`, then verifies the returned signature
-* recovers the selected account against that raw digest. Wallets that prefix
-* `eth_sign` payloads are rejected before the backend submits an invalid SafeOp.
-* The node key signer lives in `@capxul/sdk/node` (`localPrivateKeySigner`).
-*/
-function injectedWalletSigner(provider) {
-	const resolveAddress = async () => {
-		const accounts = await provider.request({ method: "eth_requestAccounts" });
-		const first = Array.isArray(accounts) ? accounts[0] : void 0;
-		if (typeof first !== "string") throw new Error("injectedWalletSigner: wallet returned no accounts");
-		if (!EVM_ADDRESS_HEX$1.test(first)) throw new Error("injectedWalletSigner: wallet returned invalid address format");
-		return toAddress(first);
-	};
-	return {
-		source: "injected-eip1193",
-		getAddress: resolveAddress,
-		async signUserOpHash(hash) {
-			if (!SAFE_OP_DIGEST_HEX$1.test(hash)) throw new Error("injectedWalletSigner: SafeOp digest must be a 0x-prefixed 32-byte hex");
-			const address = await resolveAddress();
-			let signature;
-			try {
-				signature = await provider.request({
-					method: "eth_sign",
-					params: [address, hash]
-				});
-			} catch (cause) {
-				const detail = cause instanceof Error ? cause.message : String(cause);
-				throw new Error(`injectedWalletSigner: eth_sign failed; enable raw-hash signing for deployment (${detail})`, { cause });
-			}
-			if (typeof signature !== "string") throw new Error("injectedWalletSigner: wallet returned a non-string signature");
-			if (!ECDSA_SIGNATURE_HEX$1.test(signature)) throw new Error("injectedWalletSigner: wallet returned invalid signature format");
-			if ((await recoverRawDigestSigner$1({
-				hash,
-				signature
-			})).toLowerCase() !== address.toLowerCase()) throw new Error("injectedWalletSigner: wallet signature did not recover the selected account for the raw SafeOp digest; use a raw-hash-capable wallet or @capxul/sdk/node localPrivateKeySigner for deployed flows");
-			return signature;
-		}
-	};
-}
-async function recoverRawDigestSigner$1(input) {
-	try {
-		return toAddress(await recoverAddress(input));
-	} catch (cause) {
-		const detail = cause instanceof Error ? cause.message : String(cause);
-		throw new Error(`injectedWalletSigner: could not verify raw SafeOp digest signature (${detail})`, { cause });
-	}
-}
-//#endregion
 //#region src/dev-signer.ts
 const SESSION_KEY = "capxul.session";
 /**
@@ -1399,9 +1428,27 @@ function mapToCapxulError(operation, err) {
 function mapToConvexCallError(operation, err) {
 	return convexCallErrorFromCapxul(operation, mapToCapxulError(operation, err));
 }
+const TRANSPORT_ERROR_CODES = new Set([
+	"EAI_AGAIN",
+	"ECONNREFUSED",
+	"ECONNRESET",
+	"ENOTFOUND",
+	"EPIPE",
+	"ETIMEDOUT",
+	"UND_ERR_CONNECT_TIMEOUT",
+	"UND_ERR_HEADERS_TIMEOUT",
+	"UND_ERR_SOCKET"
+]);
 function isTransportError(err) {
-	const message = err.message.toLowerCase();
-	return message.includes("failed to fetch") || message.includes("network") || message.includes("econnrefused") || message.includes("econnreset") || message.includes("enotfound") || message.includes("etimedout") || message.includes("socket");
+	const seen = /* @__PURE__ */ new Set();
+	let current = err;
+	while (current !== void 0 && !seen.has(current)) {
+		seen.add(current);
+		const code = current.code;
+		if (current.name === "FetchError" || current.name === "NetworkError" || typeof code === "string" && TRANSPORT_ERROR_CODES.has(code)) return true;
+		current = current.cause instanceof Error ? current.cause : void 0;
+	}
+	return false;
 }
 //#endregion
 //#region src/adapters/identity/ConvexIdentityAdapter.ts
@@ -1678,6 +1725,7 @@ function parseRoleDefinition(json) {
 			...raw.spend.perDay === void 0 ? {} : { perDay: parseRoleMoney(raw.spend.perDay, "perDay") },
 			...raw.spend.toRecipients === void 0 ? {} : { toRecipients: parseRoleRecipients(raw.spend.toRecipients) }
 		} },
+		...typeof raw.canSpend === "boolean" ? { canSpend: raw.canSpend } : {},
 		...typeof raw.canManageMembers === "boolean" ? { canManageMembers: raw.canManageMembers } : {},
 		...typeof raw.canManageRoles === "boolean" ? { canManageRoles: raw.canManageRoles } : {}
 	};
@@ -1848,7 +1896,7 @@ var ConvexOrganizationSetupAdapter = class {
 	async authorizeAndSubmitBootstrap(input) {
 		const cancelled = cancellation(input.signal);
 		if (cancelled !== void 0) return cancelled;
-		const signerAddress = await signerResult("getAddress", () => this.#signer.getAddress());
+		const signerAddress = await signerResult(this.#signer.source, "getAddress", () => this.#signer.getAddress());
 		if (!signerAddress.ok) return signerAddress;
 		const prepared = await runCall("prepareBootstrap", this.#convex.action(this.#fns.prepareBootstrap, copyInvocationObservation(input, {
 			orgId: input.orgId,
@@ -1860,7 +1908,7 @@ var ConvexOrganizationSetupAdapter = class {
 		if (!authority.ok) return authority;
 		const cancelledAfterPrepare = cancellation(input.signal);
 		if (cancelledAfterPrepare !== void 0) return cancelledAfterPrepare;
-		const signature = await signerResult("signUserOpHash", () => this.#signer.signUserOpHash(prepared.value.digest));
+		const signature = await signerResult(this.#signer.source, "signUserOpHash", () => this.#signer.signUserOpHash(prepared.value.digest));
 		if (!signature.ok) return signature;
 		const cancelledAfterSign = cancellation(input.signal);
 		if (cancelledAfterSign !== void 0) return cancelledAfterSign;
@@ -1949,7 +1997,7 @@ function resetSignerSession(signer) {
 			value: void 0
 		};
 	} catch (cause) {
-		return fail(cause instanceof CapxulError ? cause : Errors.providerError("openfort", "resetSession", cause, { failure_mode: "unknown" }));
+		return fail(signerFailure(signer.source, "resetSession", cause));
 	}
 }
 async function runCall(operation, effect) {
@@ -1971,14 +2019,14 @@ function publicError(operation, cause) {
 	}
 	return Errors.providerError("convex-organization", operation, cause);
 }
-async function signerResult(operation, run) {
+async function signerResult(source, operation, run) {
 	try {
 		return {
 			ok: true,
 			value: await run()
 		};
 	} catch (cause) {
-		return fail(cause instanceof CapxulError ? cause : Errors.providerError("organization-signer", operation, cause));
+		return fail(signerFailure(source, operation, cause));
 	}
 }
 function validatePreparedAuthorities(prepared, signerAddress) {
@@ -2076,6 +2124,10 @@ var ConsoleDiagnosticAdapter = class {
 function openfortProviderError(operation, cause) {
 	return cause instanceof CapxulError ? cause : Errors.providerError("openfort", operation, cause, { failure_mode: "unknown" });
 }
+/** Build a named PROVIDER_ERROR. The assembled Core SDK boundary reports it. */
+function failOpenfort(operation, failure_mode, cause) {
+	return Errors.providerError("openfort", operation, cause, { failure_mode });
+}
 /**
 * True when the browser cannot perform Web Crypto — sandboxed iframes, headless
 * agent browsers, or non-HTTPS origins. OpenFort's embedded-wallet `configure`
@@ -2112,30 +2164,77 @@ function clearStaleOpenfortBrowserStorage(publishableKey) {
 	if (scope === void 0) return;
 	for (const key of OPENFORT_BROWSER_STORAGE_KEYS) localStorage.removeItem(`${scope}.${key}`);
 }
+/**
+* The Openfort error code that names the stale-user class (#1435).
+* `getThirdPartyAuthToken` skips `authenticateThirdParty` while a `userId` sits
+* in scoped storage. A purged `userId` therefore pins every later call to a 401
+* that `extractApiError` reports as `USER_NOT_FOUND`.
+*
+* The set holds one member on purpose. Session-expiry codes (`SESSION_EXPIRED`,
+* `NOT_LOGGED_IN`, `INVALID_TOKEN`, `REFRESH_TOKEN_ERROR`) are a different
+* cause, and a bare 401 is a different cause again: `app-env-allowlist` is a
+* 401 by definition (`packages/errors/src/errors.ts:80-81`). Healing those and
+* tagging them `stale-openfort-cache` would delete the triage signal the tag
+* exists to carry.
+*/
+const STALE_USER_ERROR_CODES = new Set(["USER_NOT_FOUND"]);
+/**
+* The one predicate that opens the heal. It reads the Openfort error code and
+* never the message text (ADR-0023 R4). It walks the cause chain the way
+* `isTransportError` walks it in the Convex transport adapter.
+*
+* Known ceiling (#1435): a 401 that carries no recognized code is NOT healed.
+* `extractApiError` keeps the status only on `AuthenticationError`, so such a
+* payload is reachable. Add the code a live payload shows; do not add a message
+* match, because that trades one bug class for an ADR-0023 R4 violation.
+*/
+function isStaleUserSignal(cause) {
+	for (const link of causeChain(cause)) {
+		const error = link;
+		if (typeof error.error === "string" && STALE_USER_ERROR_CODES.has(error.error) || typeof error.code === "string" && STALE_USER_ERROR_CODES.has(error.code)) return true;
+	}
+	return false;
+}
 function createOpenfortBrowserSignerFromBootstrap(bootstrap, options = {}) {
 	const diagnostic = options.diagnostic;
-	const telemetry = options.telemetry;
 	const authBaseUrl = normalizeBetterAuthBaseUrl(bootstrap.authBaseUrl);
+	let currentStatus = "unknown";
+	const statusListeners = /* @__PURE__ */ new Set();
+	function setStatus(next) {
+		if (currentStatus === next) return;
+		currentStatus = next;
+		for (const listener of statusListeners) try {
+			listener(next);
+		} catch {
+			statusListeners.delete(listener);
+			diagnostic?.trace("openfort.signerStatusListener", {
+				ok: false,
+				failure_mode: "unknown"
+			});
+		}
+	}
+	const statusStore = {
+		status: () => currentStatus,
+		subscribe: (listener) => {
+			statusListeners.add(listener);
+			return () => {
+				statusListeners.delete(listener);
+			};
+		}
+	};
 	/**
 	* Closes the black hole: when the browser has no Web Crypto, OpenFort's
 	* `configure` would resolve to no address and the failure would be reported
-	* as `unknown`. Detect it before any network/wallet work, tag it
-	* `no-secure-context` on a PROVIDER_ERROR scoped to `configure`, breadcrumb
-	* it via DiagnosticPort, and self-report via TelemetryPort.
+	* as `unknown`. Detect it before any network or wallet work. Tag it
+	* `no-secure-context` on a PROVIDER_ERROR scoped to `configure`. Add a
+	* DiagnosticPort breadcrumb. The assembled Core SDK boundary reports it.
 	*/
 	function failNoSecureContext() {
 		diagnostic?.trace("openfort.configure", {
 			ok: false,
 			failure_mode: "no-secure-context"
 		});
-		const error = Errors.providerError("openfort", "configure", /* @__PURE__ */ new Error("Web Crypto unavailable: browser is not a secure context"), { failure_mode: "no-secure-context" });
-		if (telemetry) captureExceptionSync(telemetry, error, {
-			layer: "openfort",
-			operation: "configure",
-			provider: "openfort",
-			failure_mode: "no-secure-context"
-		});
-		throw error;
+		throw failOpenfort("configure", "no-secure-context", /* @__PURE__ */ new Error("Web Crypto unavailable: browser is not a secure context"));
 	}
 	function betterAuthSessionUrl() {
 		return `${authBaseUrl}/get-session`;
@@ -2186,6 +2285,39 @@ function createOpenfortBrowserSignerFromBootstrap(bootstrap, options = {}) {
 			getAccessToken: fetchBetterAuthAccessToken
 		}
 	});
+	async function configureEmbeddedWallet(encryptionSession) {
+		await openfort.embeddedWallet.configure({
+			accountType: AccountTypeEnum.EOA,
+			chainType: ChainTypeEnum.EVM,
+			recoveryParams: {
+				recoveryMethod: RecoveryMethod.AUTOMATIC,
+				encryptionSession
+			}
+		});
+	}
+	/**
+	* ONE heal cycle on the stale-user rejection (#1435). Clear the scoped
+	* storage that pins the dead `userId`, run the existing configure path — it
+	* re-runs third-party auth against the live Better Auth session now that no
+	* `userId` is cached — and retry the read once. Exactly one cycle: a second
+	* rejection is terminal and carries `failure_mode: "stale-openfort-cache"`.
+	* The caller stays in `recovering` throughout; only the outcome moves it.
+	*/
+	async function healStaleOpenfortCache(encryptionSession) {
+		try {
+			clearStaleOpenfortBrowserStorage(bootstrap.openfortPublishableKey);
+			diagnostic?.trace("openfort.storageCleared", { beforeConfigure: false });
+			await configureEmbeddedWallet(encryptionSession);
+			await openfort.embeddedWallet.get();
+		} catch (cause) {
+			diagnostic?.trace("openfort.staleCacheHeal", {
+				ok: false,
+				failure_mode: "stale-openfort-cache"
+			});
+			throw failOpenfort("get", "stale-openfort-cache", cause);
+		}
+		diagnostic?.trace("openfort.staleCacheHeal", { ok: true });
+	}
 	let walletReadyPromise = null;
 	function startWalletReady() {
 		return (async () => {
@@ -2250,14 +2382,7 @@ function createOpenfortBrowserSignerFromBootstrap(bootstrap, options = {}) {
 				clearStaleOpenfortBrowserStorage(bootstrap.openfortPublishableKey);
 				diagnostic?.trace("openfort.storageCleared", { beforeConfigure: true });
 				try {
-					await openfort.embeddedWallet.configure({
-						accountType: AccountTypeEnum.EOA,
-						chainType: ChainTypeEnum.EVM,
-						recoveryParams: {
-							recoveryMethod: RecoveryMethod.AUTOMATIC,
-							encryptionSession: encryptionBody.sessionId
-						}
-					});
+					await configureEmbeddedWallet(encryptionBody.sessionId);
 					diagnostic?.trace("openfort.configure", { ok: true });
 				} catch (cause) {
 					diagnostic?.trace("openfort.configure", {
@@ -2271,20 +2396,36 @@ function createOpenfortBrowserSignerFromBootstrap(bootstrap, options = {}) {
 				await openfort.embeddedWallet.get();
 				diagnostic?.trace("openfort.get", { ok: true });
 			} catch (cause) {
+				if (!isStaleUserSignal(cause)) {
+					diagnostic?.trace("openfort.get", {
+						ok: false,
+						failure_mode: "unknown"
+					});
+					throw openfortProviderError("get", cause);
+				}
 				diagnostic?.trace("openfort.get", {
 					ok: false,
-					failure_mode: "unknown"
+					failure_mode: "stale-openfort-cache"
 				});
-				throw openfortProviderError("get", cause);
+				await healStaleOpenfortCache(encryptionBody.sessionId);
 			}
 		})();
 	}
 	async function ensureOpenfortWalletReady() {
-		walletReadyPromise ??= startWalletReady();
+		let joined = walletReadyPromise;
+		if (joined === null) {
+			joined = startWalletReady();
+			walletReadyPromise = joined;
+			setStatus("recovering");
+		}
 		try {
-			await walletReadyPromise;
+			await joined;
+			if (walletReadyPromise === joined) setStatus("ready");
 		} catch (cause) {
-			walletReadyPromise = null;
+			if (walletReadyPromise === joined) {
+				walletReadyPromise = null;
+				setStatus("unavailable");
+			}
 			throw cause;
 		}
 	}
@@ -2294,6 +2435,7 @@ function createOpenfortBrowserSignerFromBootstrap(bootstrap, options = {}) {
 	});
 	return {
 		...signer,
+		statusStore,
 		getAddress: async () => {
 			try {
 				const address = await signer.getAddress();
@@ -2311,6 +2453,7 @@ function createOpenfortBrowserSignerFromBootstrap(bootstrap, options = {}) {
 			walletReadyPromise = null;
 			clearStaleOpenfortBrowserStorage(bootstrap.openfortPublishableKey);
 			signer.resetAddressCache();
+			setStatus("unknown");
 		}
 	};
 }
@@ -2674,16 +2817,24 @@ function refreshConvexAuthOnSession(authClient, refresh) {
 * particular object rather than on the auth seam itself. Here it wraps
 * `AuthClientPort.signOut`, so it holds for every route to a sign-out.
 *
-* `Effect.ensuring` (not `Effect.tap`) is deliberate: the old wrapper used
-* `try/finally`, so the session was reset even when sign-out failed. Dropping
-* to `tap` would silently strand an Openfort session on the error path.
+* Capture the sign-out exit before reset. This preserves the old `try/finally`
+* order and keeps a reset failure in the typed error channel.
 */
 function resetSignerSessionOnSignOut(authClient, resetRef) {
 	return {
 		...authClient,
-		signOut: (options) => authClient.signOut(options).pipe(Effect.ensuring(Effect.sync(() => {
-			resetRef.current?.();
-		})))
+		signOut: (options) => Effect.gen(function* () {
+			const exit = yield* Effect.exit(authClient.signOut(options));
+			yield* Effect.try({
+				try: () => resetRef.current?.(),
+				catch: (cause) => new AuthClientError({
+					operation: "signOut",
+					kind: "signer",
+					cause
+				})
+			});
+			return yield* exit;
+		})
 	};
 }
 async function createCapxulClient$1(input) {
@@ -2709,14 +2860,15 @@ async function createCapxulClient$1(input) {
 		if (signer === void 0 && runtime === "browser") signer = createOpenfortBrowserSignerFromBootstrap({
 			...adapters.value.bootstrap,
 			authBaseUrl: resolvedAuthBaseUrl
-		}, {
-			diagnostic: new ConsoleDiagnosticAdapter(),
-			telemetry: adapters.value.ports.telemetry
-		});
+		}, { diagnostic: new ConsoleDiagnosticAdapter() });
 		if (signer !== void 0 && "resetSession" in signer) {
-			const { resetSession } = signer;
+			const { resetSession, source } = signer;
 			resetSignerSession.current = () => {
-				resetSession();
+				try {
+					resetSession();
+				} catch (cause) {
+					throw signerFailure(source, "resetSession", cause);
+				}
 			};
 		}
 		const client = assembleCapxulClient({
@@ -2734,6 +2886,7 @@ async function createCapxulClient$1(input) {
 			...input.signal === void 0 ? {} : { signal: input.signal },
 			...input.otpTtlMs === void 0 ? {} : { otpTtlMs: input.otpTtlMs },
 			invokeTimeoutMs: input.invokeTimeoutMs ?? 3e4,
+			...input.observability?.failures === void 0 && input.observation === void 0 ? {} : { failureObservation: input.observability?.failures ?? input.observation },
 			...input.observability === void 0 ? {} : { hostObservationSnapshot: () => snapshotHostObservability(input.observability) },
 			effectRunner: {
 				runSync: Effect.runSyncWith(adapters.value.context),
@@ -2743,7 +2896,11 @@ async function createCapxulClient$1(input) {
 		const upstreamClose = adapters.value.close;
 		const close = idempotentClose(async () => {
 			try {
-				if ("resetSession" in (signer ?? {})) signer.resetSession();
+				if (signer !== void 0 && "resetSession" in signer) try {
+					signer.resetSession();
+				} catch (cause) {
+					throw signerFailure(signer.source, "resetSession", cause);
+				}
 			} finally {
 				await Promise.all([client._internal.close?.(), upstreamClose()]);
 			}
@@ -2912,4 +3069,4 @@ async function createCapxulClient(input) {
 	return createCapxulClient$1(input);
 }
 //#endregion
-export { CAPXUL_PAYMENTS_V2_ADDRESS, CAPXUL_SDK_EXPECTED_OUTCOME_EVENT, CapxulError, captureException, captureExceptionSync, createCapxulClient, deriveDevPrivateKey, devPrivateKeySigner, eip1193AccountProvider, embeddedSigner, fingerprintPaymentIntent, injectedWalletSigner, isCapxulError, isSettingUpLifecycle, localPrivateKeyAccountProvider, openfortEmbeddedSigner, openfortEmbeddedSignerFromWallet, openfortEmbeddedWalletPort, postHogObservability, destination as resolveIdentityDestination, toCountryCode, toAddress as toEvmAddress };
+export { CAPXUL_ERROR_CODES, CAPXUL_PAYMENTS_V2_ADDRESS, CAPXUL_SDK_EXPECTED_OUTCOME_EVENT, CapxulError, Errors, captureException, captureExceptionSync, createCapxulClient, deriveDevPrivateKey, devPrivateKeySigner, eip1193AccountProvider, embeddedSigner, fingerprintPaymentIntent, formatMoney, injectedWalletSigner, isCapxulError, isClaimed, isMoneyParseError, isRestoring, isSettingUpLifecycle, localPrivateKeyAccountProvider, openfortEmbeddedSigner, openfortEmbeddedSignerFromWallet, openfortEmbeddedWalletPort, parseMoney, postHogObservability, destination as resolveIdentityDestination, toCountryCode, toAddress as toEvmAddress };

package/dist/node/index.d.mts

@@ -1,4 +1,4 @@
-import { E as AuthSession, _ as AuthCachePortTag, g as AuthCachePort, h as AuthCacheError, n as CapxulSigner, v as CachedJwt } from "../signer-Bj4F-RwT.mjs";
+import { O as AuthSession, _ as AuthCacheError, b as CachedJwt, n as CapxulSigner, v as AuthCachePort, y as AuthCachePortTag } from "../signer-BejoR3bA.mjs";
 import { Hex } from "viem";
 import { Effect, FileSystem, Layer, Path } from "effect";
 

package/dist/node/index.mjs

@@ -1,4 +1,4 @@
-import { a as AuthCacheError, i as parseCachedJwt, m as toAddress, n as BrowserAuthCacheAdapter, o as AuthCachePortTag, r as parseAuthSession, t as InMemoryAuthCacheAdapter } from "../InMemoryAuthCacheAdapter-Rc8tCtml.mjs";
+import { a as AuthCacheError, h as toAddress, i as parseCachedJwt, n as BrowserAuthCacheAdapter, o as AuthCachePortTag, r as parseAuthSession, t as InMemoryAuthCacheAdapter } from "../InMemoryAuthCacheAdapter-qMpBOGb3.mjs";
 import { Effect, FileSystem, Layer, Path } from "effect";
 import { privateKeyToAccount } from "viem/accounts";
 import * as os from "node:os";