@capxul/sdk 2.1.1 → 2.3.0

package/dist/{create-capxul-client-BI-6Za6X.d.mts → observation-Ci8gIQjm.d.mts}

@@ -1,4 +1,4 @@
-import { $ as CapxulErrorDetails, A as CountryCode, B as PermissionAssignmentId, C as AllowedOrigin, D as AuthUserId, E as AuthSession, F as EpochMs, G as SessionToken, H as Profile, I as Money, J as WeiAmount, K as SmartAccount, L as MovementId, M as DocumentHash, N as DurationMs, O as BlockNumber, P as Email, Q as CapxulErrorCode, R as OrgId, S as AllowanceKey, T as AppId, U as PublishableKey, V as PermissionId, W as RoleKey, Z as CapxulError, d as CapxulResult, et as Failure, f as Profile$1, g as AuthCachePort, j as CurrencyCode, k as ChainId, m as SmartAccount$1, n as CapxulSigner, o as AccountProviderSource, p as Session$1, q as TxHash, s as AccountRequirement, tt as FailureMode, v as CachedJwt, w as AnonymousDistinctId, x as Address$1, y as Account$1, z as PaymentCommandId } from "./signer-Bj4F-RwT.mjs";
+import { A as BlockNumber, B as MovementId, C as Address$1, D as AppId, E as AnonymousDistinctId, F as DocumentHash, G as PermissionId, H as PartyId, I as DurationMs, J as RoleKey, K as Profile, L as Email, M as ChainId, N as CountryCode, O as AuthSession, P as CurrencyCode, Q as WeiAmount, R as EpochMs, T as AllowedOrigin, U as PaymentCommandId, V as OrgId, W as PermissionAssignmentId, X as SmartAccount, Y as SessionToken, Z as TxHash, a as SignerStatusStore, b as CachedJwt, c as AccountProviderSource, g as SmartAccount$1, h as Session$1, it as CapxulErrorDetails, j as BudgetId, k as AuthUserId, l as AccountRequirement, m as Profile$1, n as CapxulSigner, nt as CapxulError, ot as Failure, p as CapxulResult, q as PublishableKey, rt as CapxulErrorCode, st as FailureMode, v as AuthCachePort, w as AllowanceKey, x as Account$1, z as Money } from "./signer-BejoR3bA.mjs";
 import { Address, Hex } from "viem";
 import { Context, Effect, Layer, Schema, Scope, Tracer } from "effect";
 import { FunctionReference } from "convex/server";
@@ -127,7 +127,13 @@ type Readiness = {
   readonly failure: Failure;
   readonly retryable: boolean;
 };
-type IdentityState = {
+type IdentityState =
+/** The INITIAL state: a session probe is in flight and the machine knows
+ * nothing yet. Distinct from `signed_out`, which is a settled answer. Without
+ * it every consumer read the restore window as a real sign-out. */
+{
+  readonly phase: "restoring";
+} | {
   readonly phase: "signed_out";
 } | {
   readonly phase: "otp_sending";
@@ -159,7 +165,7 @@ type IdentityState = {
     readonly requestedAt: number;
   } | null;
 };
-declare const STATE_LABELS: readonly ["signed_out", "otp_sending", "otp_pending", "otp_verifying", "authenticated:unknown", "authenticated:deriving", "authenticated:counterfactual", "authenticated:claiming", "authenticated:failed", "authenticated:claimed", "authenticated:claimed:creating", "authenticated:claimed:loading", "authenticated:claimed:settingUp", "authenticated:claimed:ready", "authenticated:claimed:failed", "signing_out", "faulted"];
+declare const STATE_LABELS: readonly ["restoring", "signed_out", "otp_sending", "otp_pending", "otp_verifying", "authenticated:unknown", "authenticated:deriving", "authenticated:counterfactual", "authenticated:claiming", "authenticated:failed", "authenticated:claimed", "authenticated:claimed:creating", "authenticated:claimed:loading", "authenticated:claimed:settingUp", "authenticated:claimed:ready", "authenticated:claimed:failed", "signing_out", "faulted"];
 type StateLabel = (typeof STATE_LABELS)[number];
 type IdentityEvent = {
   readonly _tag: "RequestOtp";
@@ -182,6 +188,12 @@ type IdentityEvent = {
   readonly now: number;
 } | {
   readonly _tag: "Reset";
+} | {
+  readonly _tag: "SessionRestored";
+  readonly session: Session;
+  readonly profileComplete: boolean;
+} | {
+  readonly _tag: "SessionAbsent";
 } | {
   readonly _tag: "EnsureAccount";
 } | {
@@ -223,6 +235,22 @@ type Destination$1 = {
  * there is no org list in the state, only the ONE active lane.
  */
 declare const destination: (state: IdentityState) => Destination$1 | null;
+/**
+ * True while the machine has not settled enough to route or to gate on.
+ *
+ * NEGATIVE classification, deliberately: the SETTLED positions are the ones
+ * enumerated, and everything else waits. A phase or readiness variant added
+ * later therefore defaults to holding, never to redirecting a member who is in
+ * fact signed in. Terminal for the account lane is `claimed | failed`.
+ *
+ * The org lane's own settledness (`ready | failed`) is the route gate's
+ * question, not this one: every org lane sits under a CLAIMED account, and
+ * `destination()` already names a real screen for each of its positions.
+ */
+declare const isRestoring: (state: IdentityState) => boolean;
+/** The claimed-account gate as one function. The inlined consumers move onto
+ * it in #1521; this ticket ships the selector they move onto. */
+declare const isClaimed: (state: IdentityState) => boolean;
 //#endregion
 //#region ../config/src/capxul-payments-v2.d.ts
 /** Immutable CapxulPaymentsV2 deployment on Base Sepolia. */
@@ -774,7 +802,7 @@ interface IdentityPort {
 type SafeDeploymentConfig = {
   readonly chainId: ChainId;
   readonly rpcUrl: string;
-  readonly gasPolicyId: string;
+  readonly bundlerRpcUrl: string;
   readonly receiptTimeoutMs?: DurationMs;
 };
 /**
@@ -1107,6 +1135,9 @@ type TargetReference = {
 } | {
   readonly kind: "payee";
   readonly id: string;
+} | {
+  readonly kind: "party";
+  readonly partyId: PartyId;
 } | {
   readonly kind: "destination";
   readonly id: string;
@@ -1142,6 +1173,9 @@ type Ref$1 = {
 } | {
   readonly kind: "payeeId";
   readonly payeeId: string;
+} | {
+  readonly kind: "party";
+  readonly partyId: PartyId;
 };
 interface MeProfile {
   readonly authUserId: string;
@@ -1243,7 +1277,7 @@ interface Payment {
     readonly transactionHash: string;
   } | null;
   readonly recipient: {
-    readonly kind: "handle" | "email" | "payee" | "capxulUserId" | "me" | "org" | "external_address";
+    readonly kind: "handle" | "email" | "payee" | "capxulUserId" | "me" | "org" | "party" | "external_address";
     readonly label: string;
     readonly payeeId?: string;
   };
@@ -1589,35 +1623,54 @@ interface ActorProfile {
   readonly email?: string;
   readonly handle?: string;
 }
+/**
+ * How a counterparty entered the book, and what they are to the actor today.
+ *
+ * The first six values are the backend edge provenance VERBATIM (ADR-0022 R2);
+ * `employed` is projected from an open employment edge. The pre-substrate
+ * union published `requested` (a value that collapsed two directions) and
+ * `employee` (a value no backend path ever wrote).
+ */
+type AddressBookRelationship = "paid" | "paidBy" | "invoiced" | "invoicedBy" | "member" | "manual" | "employed";
 interface AddressBookEntry {
-  readonly id: string;
+  /**
+   * The counterparty's `PartyId`. It is stable: the id you read before a
+   * counterparty signs up is the id you read after (ADR-0022 R1). The old id
+   * was a derived string that changed at signup.
+   */
+  readonly id: PartyId;
   readonly ref: Ref$1;
   readonly label: string;
-  readonly relationship: readonly ("paid" | "paidBy" | "requested" | "member" | "employee")[];
+  readonly relationship: readonly AddressBookRelationship[];
   readonly hidden: boolean;
+  /** Epoch milliseconds of the most recent activity with this counterparty. */
+  readonly lastActivityAt: number;
 }
 interface AddressBookAddInput {
   readonly ref: Ref$1;
   readonly label?: string;
 }
 interface AddressBookLabelInput {
-  readonly entryId: string;
+  readonly entryId: PartyId;
   readonly label: string;
 }
+interface AddressBookListInput {
+  readonly includeHidden?: boolean;
+}
 interface AddressBookMethods {
-  list(options?: {
+  list(input?: AddressBookListInput, options?: {
     readonly signal?: AbortSignal;
   }): Promise<CapxulResult<readonly AddressBookEntry[]>>;
-  get(entryId: string, options?: {
+  get(entryId: PartyId, options?: {
     readonly signal?: AbortSignal;
   }): Promise<CapxulResult<AddressBookEntry | null>>;
   add(input: AddressBookAddInput, options?: {
     readonly signal?: AbortSignal;
   }): Promise<CapxulResult<AddressBookEntry>>;
-  hide(entryId: string, options?: {
+  hide(entryId: PartyId, options?: {
     readonly signal?: AbortSignal;
   }): Promise<CapxulResult<AddressBookEntry>>;
-  unhide(entryId: string, options?: {
+  unhide(entryId: PartyId, options?: {
     readonly signal?: AbortSignal;
   }): Promise<CapxulResult<AddressBookEntry>>;
   label(input: AddressBookLabelInput, options?: {
@@ -1846,6 +1899,47 @@ interface OrgPort {
   detectAndAcceptPendingInvitations(input: DetectPendingOrgInvitationsInput): Effect.Effect<DetectPendingOrgInvitationsResult$1, OrgError, never>;
 }
 //#endregion
+//#region src/surface/org-me.d.ts
+/**
+ * One spend authority the Member holds. `limit` is the cap the payment gate
+ * enforces on a single payment — `null` means the Budget carries no cap. The
+ * amount still available under the cap is not part of this read and is not
+ * computable from it.
+ */
+interface Budget {
+  readonly id: BudgetId;
+  /** Display name, taken from the Role the grant was motivated by. */
+  readonly label: string;
+  readonly limit: Money | null;
+}
+/**
+ * The caller's own standing in one Organization.
+ *
+ * `role` is `null` when the Role catalog cannot name the Member's Role — a
+ * label-less owner is tolerated (ADR-0017), so consumers must render an
+ * absent Role rather than invent one.
+ *
+ * `capabilities` are the two facts the backend actually enforces, and nothing
+ * else: managing people, and spending. Payroll and invoice approval are both
+ * spending, so both read `canSpend`.
+ */
+interface OrgMe {
+  readonly role: {
+    readonly label: string;
+  } | null;
+  readonly capabilities: {
+    readonly canManagePeople: boolean;
+    readonly canSpend: boolean;
+  };
+  /** Named Budgets this Member can spend from. `canSpend` is the authority fact. */
+  readonly budgets: readonly Budget[];
+  readonly observedAt: number;
+}
+type OrgMeOptions = {
+  readonly signal?: AbortSignal;
+};
+type OrgMeMethod = (options?: OrgMeOptions) => Promise<CapxulResult<OrgMe>>;
+//#endregion
 //#region src/contract/permission.d.ts
 interface PermissionReadResult {
   readonly permissions: readonly Permission[];
@@ -1966,11 +2060,14 @@ type RoleSpendCap = {
 type RoleDefinition = {
   readonly label: string;
   readonly spend?: RoleSpendCap;
+  readonly canSpend?: boolean;
   readonly canManageMembers?: boolean;
   readonly canManageRoles?: boolean;
 };
 /**
- * One role seeded on an Organization.
+ * One role a member can be invited into on an Organization — a role that
+ * carries member-management authority. A Budget is granted, never offered as a
+ * job title (ADR-0024 R5), so it never appears here.
  * `roleKey` is the on-chain bytes32 role key derived from the label. `definition`
  * is the full Role DSL entry.
  */
@@ -1980,21 +2077,22 @@ type RoleView = {
   readonly roleKey: RoleKey;
   readonly definition: RoleDefinition;
 };
-/** Built-in role templates for a new Organization. */
-type OrgTemplate = "Solo" | "Startup" | "Custom";
+/**
+ * The role template a new Organization is created from. Creation supports
+ * exactly one shape — a single founding owner (ADR-0024 R8). Any other value
+ * is REFUSED with `WRONG_STATE`.
+ */
+type OrgTemplate = "Solo";
 /**
  * Input to `capxul.createOrg`. `name` is the display name.
  * `handle` is the globally unique normalized handle (`^[a-z0-9-]{3,32}$`).
  * `template` seeds the initial role set. `country` is stored without validation.
- * For `template: "Custom"`, `roles` carries the authored
- * `RoleDefinition[]`.
  */
 type CreateOrgInput = {
   readonly name: string;
   readonly handle: string;
   readonly template: OrgTemplate;
   readonly country?: string;
-  readonly roles?: readonly RoleDefinition[];
 };
 /**
  * Input to `org(orgId).invite`. Email is the universal entry point.
@@ -2015,6 +2113,12 @@ type DetectPendingOrgInvitationsResult = {
 };
 /** Organization methods for one `orgId`. */
 interface OrgScopedMethods extends ActorRelationshipMethods {
+  /**
+   * The caller's own standing in this Organization — Role, the two enforced
+   * capabilities, and the Budgets they can spend from. A caller who is not an
+   * active Member is refused, not reported as a Member without capabilities.
+   */
+  readonly me: OrgMeMethod;
   /** Observe the durable, leak-safe lifecycle for this Organization only. */
   getLifecycle(options?: {
     readonly signal?: AbortSignal;
@@ -2263,6 +2367,16 @@ interface CapxulClient {
   readonly createOrg: OrgMethods["createOrg"];
   readonly orgs: OrgMethods["orgs"];
   readonly org: OrgMethods["org"];
+  /**
+   * Observable signer readiness (ACCESS #1520 · C12). `status()` reads the
+   * current `SignerStatus`. `subscribe` fires on every change and returns its
+   * own unsubscribe. Only the Openfort browser signer runs a readiness cycle.
+   * Every other signer reports `"unknown"`, so a gate that reads this fails
+   * closed. This is an observation surface, not a domain method: it performs no
+   * work and cannot fail, so it returns a value rather than a `CapxulResult`.
+   * It is not a public React surface — the action part that needs it reads this.
+   */
+  readonly signer: SignerStatusStore;
   /**
    * Internal identity integration runtime. It is consumed by
    * `@capxul/sdk-react`, not exported as the actor substrate itself.
@@ -2281,7 +2395,7 @@ interface CapxulClient {
      * NOT on the public `client.accounts` surface.
      */
     readonly accounts: AccountsFaucetMethods; /** Quarantined Reference-harness evidence; never a product Organization method. */
-    readonly organizationSetup: OrganizationSetupProofMethods; /** Telemetry port for error reporting. Used by React hooks to report errors before throwing. */
+    readonly organizationSetup: OrganizationSetupProofMethods; /** Product telemetry projection for internal composition and test harnesses. */
     readonly telemetry?: TelemetryPort;
     readonly close?: () => Promise<void>;
   };
@@ -2357,4 +2471,63 @@ interface CreateCapxulClientInput {
   };
 }
 //#endregion
-export { InboxMethods as $, OrgLifecycle as $t, OrganizationPaymentsMethods as A, PaymentDocumentRef as At, AccountMethods as B, RecipientResolution as Bt, ResendInviteTokenInput as C, OfframpQuoteInput as Ct, OrganizationPaymentBatchInput as D, Payment as Dt, RoleView as E, PayeesMethods as Et, PermissionOptions as F, PaymentStatus as Ft, ActorRequestIssueInput as G, TargetsMethods as Gt, ActorProfileMethods as H, Ref$1 as Ht, PermissionReplaceInput as I, PaymentTiming as It, AddressBookEntry as J, AccountSetupStep as Jt, ActorRequestsMethods as K, fingerprintPaymentIntent as Kt, PermissionRevokeInput as L, PaymentType as Lt, PermissionChangeInput as M, PaymentDocumentVerification as Mt, PermissionCreateInput as N, PaymentDocumentsMethods as Nt, OrganizationPaymentInput as O, PaymentDirection as Ot, PermissionMethods as P, PaymentMoney as Pt, InboxItem as Q, AuthMethods as Qt, PermissionReadResult as R, PaymentsMethods as Rt, OrganizationAuditLogItem as S, OfframpQuote as St, RoleSpendCap as T, Payee as Tt, ActorRelationshipMethods as U, ResolvedTarget as Ut, ActorProfile as V, RecipientResolutionKind as Vt, ActorRequest as W, TargetReference as Wt, AddressBookMethods as X, IdentityMethods as Xt, AddressBookLabelInput as Y, isSettingUpLifecycle as Yt, InboxApproveInput as Z, SmartAccountMethods as Zt, OrgMethods as _, StateLabel as _n, FinancialOpsMethods as _t, IdentityRuntimeSendResult as a, SubmittedPermissionExecution as an, ActivityPage as at, OrgView as b, InvocationControls as bn, MeProfile as bt, SystemHealth as c, TelemetryGroupInput as cn, DepositInstructions as ct, CurrentUserMethods as d, CAPXUL_PAYMENTS_V2_ADDRESS as dn, DestinationKind as dt, OrgSetupStep as en, ActivityAnnotationInput as et, CreateOrgInput as f, Destination$1 as fn, DestinationListInput as ft, MemberView as g, Readiness as gn, DestinationsMethods as gt, MemberStatus as h, OrgLane as hn, DestinationRemoveInput as ht, IdentityRuntime as i, Permission as in, ActivityMethods as it, PermissionAssignInput as j, PaymentDocumentRender as jt, OrganizationPaymentItemInput as k, PaymentDocumentKind as kt, MediaMethods as l, TelemetryIdentifyInput as ln, Destination as lt, InviteMemberInput as m, IdentityState as mn, DestinationRail as mt, CreateCapxulClientInput as n, CurrentHoldings as nn, ActivityItem as nt, HoldingsMethods as o, CapxulEnv as on, ActivityReference as ot, DetectPendingOrgInvitationsResult as p, IdentityEvent as pn, DestinationPayload as pt, AddressBookAddInput as q, AccountLifecycle as qt, IdentityProfileDetails as r, MovementAnnotation as rn, ActivityListParams as rt, SystemMethods as s, TelemetryEvent as sn, ActorReference as st, CapxulClient as t, WireObservationContext as tn, ActivityDetail as tt, CurrentUserContext as u, TelemetryPort as un, DestinationAddInput as ut, OrgScopedMethods as v, destination as vn, HandlesMethods as vt, RoleDefinition as w, OfframpStatus as wt, OrganizationAccount as x, OfframpMethods as xt, OrgTemplate as y, IdentityTransition as yn, MeMethods as yt, AccountsMethods as z, PaymentsPayInput as zt };
+//#region src/host-observability.d.ts
+/** One host-owned observability module at the SDK consumer boundary. */
+interface HostObservability {
+  readonly failures: ObservationAdapter;
+  readonly product: TelemetryPort;
+}
+interface PostHogObservabilityClient {
+  capture(event: string, properties?: Readonly<Record<string, unknown>>): unknown;
+  captureException?(exception: Error, properties?: Readonly<Record<string, unknown>>): unknown;
+  identify?(distinctId: string, properties?: Readonly<Record<string, unknown>>): unknown;
+  group?(groupType: string, groupKey: string, properties?: Readonly<Record<string, unknown>>): unknown;
+  reset?(): unknown;
+}
+interface PostHogObservabilityOptions {
+  /** Consent / kill-switch seam. Defaults to enabled. */
+  readonly enabled?: boolean | (() => boolean);
+  /** Host environment stamped on every SDK-owned product event. */
+  readonly capxulEnv?: CapxulEnv;
+  /** Host-owned correlation context shared by product and failure delivery. */
+  readonly context?: ObservationContext | (() => ObservationContext | undefined);
+}
+/** Build the SDK's one host module around an already-initialized PostHog client. */
+declare function postHogObservability(client: PostHogObservabilityClient | null | undefined, options?: PostHogObservabilityOptions): HostObservability;
+//#endregion
+//#region src/observation.d.ts
+/** Host-owned correlation fields that are safe to attach to an SDK failure. */
+interface ObservationContext extends Omit<WireObservationContext, "applicationId"> {}
+/**
+ * The small, SDK-owned failure envelope delivered to observation adapters.
+ * Method arguments, response bodies, wallet payloads, and arbitrary error
+ * details are deliberately absent.
+ */
+interface SdkFailureObservation {
+  readonly exception: Error;
+  readonly sdkVersion: string;
+  readonly operation: string;
+  readonly errorKind: string;
+  /** Invocation snapshot; failure correlation wins over later host state. */
+  readonly context?: ObservationContext;
+}
+type ObservationDelivery = void | PromiseLike<void>;
+/**
+ * High-level host observation boundary. The SDK owns when each method is
+ * called; the host owns the destination client, consent, and delivery policy.
+ */
+interface ObservationAdapter {
+  /**
+   * Optional read-only invocation context. Transport adapters snapshot it once
+   * at call start; implementations must not mutate global SDK state.
+   */
+  readonly resolveContext?: () => ObservationContext | undefined;
+  /** A method returned the SDK's typed `{ ok: false, error }` result. */
+  captureOperationFailure(failure: SdkFailureObservation): ObservationDelivery;
+  /** A method unexpectedly threw or rejected instead of returning a typed result. */
+  captureException(exception: SdkFailureObservation): ObservationDelivery;
+}
+/** Stable PostHog event used for typed failures that are expected product outcomes. */
+declare const CAPXUL_SDK_EXPECTED_OUTCOME_EVENT = "capxul_sdk_expected_outcome";
+//#endregion
+export { AccountMethods as $, RecipientResolution as $t, OrganizationAccount as A, isClaimed as An, FinancialOpsMethods as At, PermissionAssignInput as B, Payment as Bt, InviteMemberInput as C, Destination$1 as Cn, DestinationAddInput as Ct, OrgScopedMethods as D, Readiness as Dn, DestinationRail as Dt, OrgMethods as E, OrgLane as En, DestinationPayload as Et, RoleView as F, OfframpQuote as Ft, PermissionReplaceInput as G, PaymentDocumentVerification as Gt, PermissionCreateInput as H, PaymentDocumentKind as Ht, OrganizationPaymentBatchInput as I, OfframpQuoteInput as It, Budget as J, PaymentStatus as Jt, PermissionRevokeInput as K, PaymentDocumentsMethods as Kt, OrganizationPaymentInput as L, OfframpStatus as Lt, ResendInviteTokenInput as M, IdentityTransition as Mn, MeMethods as Mt, RoleDefinition as N, InvocationControls as Nn, MeProfile as Nt, OrgTemplate as O, StateLabel as On, DestinationRemoveInput as Ot, RoleSpendCap as P, OfframpMethods as Pt, AccountsMethods as Q, PaymentsPayInput as Qt, OrganizationPaymentItemInput as R, Payee as Rt, DetectPendingOrgInvitationsResult as S, CAPXUL_PAYMENTS_V2_ADDRESS as Sn, Destination as St, MemberView as T, IdentityState as Tn, DestinationListInput as Tt, PermissionMethods as U, PaymentDocumentRef as Ut, PermissionChangeInput as V, PaymentDirection as Vt, PermissionOptions as W, PaymentDocumentRender as Wt, OrgMeMethod as X, PaymentType as Xt, OrgMe as Y, PaymentTiming as Yt, OrgMeOptions as Z, PaymentsMethods as Zt, SystemHealth as _, SubmittedPermissionExecution as _n, ActivityMethods as _t, SdkFailureObservation as a, fingerprintPaymentIntent as an, ActorRequestsMethods as at, CurrentUserMethods as b, TelemetryIdentifyInput as bn, ActorReference as bt, PostHogObservabilityOptions as c, isSettingUpLifecycle as cn, AddressBookLabelInput as ct, CreateCapxulClientInput as d, AuthMethods as dn, InboxItem as dt, RecipientResolutionKind as en, ActorProfile as et, IdentityProfileDetails as f, OrgLifecycle as fn, InboxMethods as ft, SystemMethods as g, Permission as gn, ActivityListParams as gt, HoldingsMethods as h, MovementAnnotation as hn, ActivityItem as ht, ObservationDelivery as i, TargetsMethods as in, ActorRequestIssueInput as it, OrganizationAuditLogItem as j, isRestoring as jn, HandlesMethods as jt, OrgView as k, destination as kn, DestinationsMethods as kt, postHogObservability as l, IdentityMethods as ln, AddressBookMethods as lt, IdentityRuntimeSendResult as m, CurrentHoldings as mn, ActivityDetail as mt, ObservationAdapter as n, ResolvedTarget as nn, ActorRelationshipMethods as nt, HostObservability as o, AccountLifecycle as on, AddressBookAddInput as ot, IdentityRuntime as p, OrgSetupStep as pn, ActivityAnnotationInput as pt, PermissionReadResult as q, PaymentMoney as qt, ObservationContext as r, TargetReference as rn, ActorRequest as rt, PostHogObservabilityClient as s, AccountSetupStep as sn, AddressBookEntry as st, CAPXUL_SDK_EXPECTED_OUTCOME_EVENT as t, Ref$1 as tn, ActorProfileMethods as tt, CapxulClient as u, SmartAccountMethods as un, InboxApproveInput as ut, MediaMethods as v, TelemetryEvent as vn, ActivityPage as vt, MemberStatus as w, IdentityEvent as wn, DestinationKind as wt, CreateOrgInput as x, TelemetryPort as xn, DepositInstructions as xt, CurrentUserContext as y, TelemetryGroupInput as yn, ActivityReference as yt, OrganizationPaymentsMethods as z, PayeesMethods as zt };

package/dist/{signer-Bj4F-RwT.d.mts → signer-BejoR3bA.d.mts}

@@ -34,6 +34,13 @@ interface Failure {
   readonly error?: CapxulError;
 }
 type CapxulErrorDetails = Record<string, unknown>;
+type SignerSource = "openfort-embedded" | "injected-eip1193" | "local-private-key";
+type VerificationRequiredDetails = {
+  readonly requiredTier: number;
+} | {
+  readonly rail: string;
+  readonly currentKind: string;
+};
 type CapxulErrorOptions = {
   readonly cause?: unknown;
   readonly details?: CapxulErrorDetails;
@@ -48,6 +55,91 @@ declare class CapxulError extends Error {
   constructor(code: CapxulErrorCode, message: string, options?: CapxulErrorOptions);
 }
 declare function isCapxulError(value: unknown): value is CapxulError;
+declare const Errors: {
+  readonly notAuthenticated: (message?: string, opts?: {
+    readonly failure_mode?: FailureMode;
+  }) => CapxulError;
+  readonly emailDeliveryFailed: (detail: string) => CapxulError;
+  readonly profileNotFound: (authUserId: string) => CapxulError;
+  readonly smartAccountMissing: (authUserId: string) => CapxulError;
+  readonly playerNotFound: (playerId?: string) => CapxulError;
+  readonly accountNotFound: (accountId?: string) => CapxulError;
+  readonly providerError: (provider: string, operation: string, cause: unknown, opts?: {
+    readonly failure_mode?: FailureMode;
+  }) => CapxulError;
+  readonly capabilityUnavailable: (provider: string, operation: string) => CapxulError;
+  readonly invalidInput: (field: string, reason: string) => CapxulError;
+  readonly envMissing: (name: string) => CapxulError;
+  readonly notImplemented: (domain: string, method: string) => CapxulError;
+  /**
+   * Sibling factory to {@link Errors.providerError} for the per-state timeout
+   * path in flows. Same `PROVIDER_ERROR` code as
+   * `providerError`, plus a `details.reason: "timeout"` discriminator so
+   * downstream observers can distinguish failure modes without parsing the
+   * message string. The redacted message names the timeout budget; the
+   * native `cause` carries the same information for `reportError` fidelity.
+   */
+  readonly providerTimeout: (provider: string, operation: string, timeoutMs: number) => CapxulError;
+  readonly verificationRequired: (details: VerificationRequiredDetails) => CapxulError;
+  readonly insufficientBalance: (asset: string, available: string, required: string) => CapxulError;
+  readonly invalidRecipient: (reason: string) => CapxulError;
+  /**
+   * The org Zodiac Roles modifier REFUSED the spend on-chain (G4 · #547): the
+   * member's role condition (per-tx cap, per-day allowance, allowed recipient,
+   * or membership) was violated, so `execTransactionWithRole` reverted. This is
+   * a PERMISSION denial — explicitly NOT an `INSUFFICIENT_BALANCE` (the treasury
+   * held the funds; the role's authority is what bound). `reason` discriminates
+   * the violated condition (`over_cap` / `daily_cap` / `not_member` /
+   * `disallowed_recipient` / `condition_violation`); leak-safe — no on-chain
+   * identifiers ever enter the details.
+   */
+  readonly rolePermissionDenied: (details: {
+    readonly reason: "over_cap" | "daily_cap" | "not_member" | "disallowed_recipient" | "condition_violation";
+    readonly operation?: string;
+  }) => CapxulError;
+  /**
+   * A transaction (or sponsored UserOp) failed. `details.reason` discriminates
+   * the failure mode for callers that must distinguish a CONFIRMED on-chain
+   * revert (`"onchain_revert"` — the op executed and reverted, e.g. a Zodiac
+   * Roles condition violation) from an inconclusive infra failure. A confirmed
+   * revert is the ONLY mode the org spend port may map to a roles denial.
+   */
+  readonly transactionFailed: (operation: string, cause?: unknown, extra?: {
+    readonly reason?: string;
+  }) => CapxulError;
+  readonly rateLimited: (details?: {
+    readonly retryAfterMs?: number;
+    readonly resource?: string;
+  }) => CapxulError;
+  readonly networkError: (operation: string, cause?: unknown) => CapxulError;
+  readonly unknown: (cause?: unknown) => CapxulError;
+  readonly otpExpired: (details?: {
+    readonly email?: string;
+    readonly expiredAt?: number;
+  }) => CapxulError;
+  readonly signerRejected: (details: {
+    readonly source: SignerSource;
+    readonly reason?: string;
+    readonly cause?: unknown;
+  }) => CapxulError;
+  readonly cancelled: (details?: {
+    readonly operation?: string;
+    readonly reason?: string;
+  }) => CapxulError;
+  /**
+   * Method called from a flow state where its precondition fails (TA16). The
+   * SDK's method API short-circuits with this error before driving the
+   * internal state machine. `currentState` is the Effect-machine snapshot
+   * tag (stringified from the SDK's actor-shell snapshot; see
+   * `packages/errors/CONTEXT.md`); `validStates`
+   * enumerates the states the method accepts.
+   */
+  readonly wrongState: (details: {
+    readonly method: string;
+    readonly currentState: string;
+    readonly validStates: readonly string[];
+  }) => CapxulError;
+};
 //#endregion
 //#region ../types/src/brand.d.ts
 /**
@@ -99,9 +191,11 @@ type Account$1 = {
 type AuthUserId = Brand<string, "AuthUserId">;
 type AnonymousDistinctId = Brand<string, "AnonymousDistinctId">;
 type AccountId = Brand<string, "AccountId">;
+type PartyId = Brand<string, "PartyId">;
 type MovementId = Brand<string, "MovementId">;
 type PermissionId = Brand<string, "PermissionId">;
 type PermissionAssignmentId = Brand<string, "PermissionAssignmentId">;
+type BudgetId = Brand<string, "BudgetId">;
 type PaymentCommandId = Brand<string, "PaymentCommandId">;
 type OrgId = Brand<string, "OrgId">;
 type AppId = Brand<string, "AppId">;
@@ -275,6 +369,27 @@ interface CapxulSigner extends CapxulDigestSigner {
   readonly source: AccountProviderSource;
   /** Owner EOA address — the Safe's single owner. */
   getAddress(): Promise<Address$1>;
+  /**
+   * Readiness this signer reports, when it runs a readiness cycle at all. Only
+   * the Openfort browser signer does. `assembleCapxulClient` reads it onto
+   * `client.signer`, and substitutes `UNOBSERVABLE_SIGNER_STATUS` when absent.
+   */
+  readonly statusStore?: SignerStatusStore;
+}
+/**
+ * Observable signer readiness (ACCESS #1520 · C12). `unknown` means the
+ * wallet-ready cycle did not start. `recovering` means it is running; the
+ * stale-cache heal runs inside that phase. `ready` means the signer can sign.
+ * `unavailable` means the cycle failed. A failure is distinguishable from a
+ * cycle that never started. That is why there are four states.
+ */
+type SignerStatus = "unknown" | "recovering" | "ready" | "unavailable";
+/** Subscribable readiness surface. Assembled onto `client.signer`. */
+interface SignerStatusStore {
+  /** The current status. */
+  status(): SignerStatus;
+  /** Fires on every change. Returns its own unsubscribe. */
+  subscribe(listener: (status: SignerStatus) => void): () => void;
 }
 /** Minimal EIP-1193 surface an injected browser wallet exposes. */
 interface Eip1193RequestProvider {
@@ -292,4 +407,4 @@ interface Eip1193RequestProvider {
  */
 declare function injectedWalletSigner(provider: Eip1193RequestProvider): CapxulSigner;
 //#endregion
-export { CapxulErrorDetails as $, CountryCode as A, PermissionAssignmentId as B, AllowedOrigin as C, AuthUserId as D, AuthSession as E, EpochMs as F, SessionToken as G, Profile$1 as H, Money as I, WeiAmount as J, SmartAccount$1 as K, MovementId as L, DocumentHash as M, DurationMs as N, BlockNumber as O, Email as P, CapxulErrorCode as Q, OrgId as R, AllowanceKey as S, AppId as T, PublishableKey as U, PermissionId as V, RoleKey as W, toCountryCode as X, toAddress as Y, CapxulError as Z, AuthCachePortTag as _, AccountProvider as a, AccountId as b, Eip1193Provider as c, CapxulResult as d, Failure as et, Profile as f, AuthCachePort as g, AuthCacheError as h, injectedWalletSigner as i, CurrencyCode as j, ChainId as k, eip1193AccountProvider as l, SmartAccount as m, CapxulSigner as n, isCapxulError as nt, AccountProviderSource as o, Session as p, TxHash as q, Eip1193RequestProvider as r, AccountRequirement as s, CapxulDigestSigner as t, FailureMode as tt, localPrivateKeyAccountProvider as u, CachedJwt as v, AnonymousDistinctId as w, Address$1 as x, Account$1 as y, PaymentCommandId as z };
+export { toAddress as $, BlockNumber as A, MovementId as B, Address$1 as C, AppId as D, AnonymousDistinctId as E, DocumentHash as F, PermissionId as G, PartyId as H, DurationMs as I, RoleKey as J, Profile$1 as K, Email as L, ChainId as M, CountryCode as N, AuthSession as O, CurrencyCode as P, WeiAmount as Q, EpochMs as R, AccountId as S, AllowedOrigin as T, PaymentCommandId as U, OrgId as V, PermissionAssignmentId as W, SmartAccount$1 as X, SessionToken as Y, TxHash as Z, AuthCacheError as _, SignerStatusStore as a, Errors as at, CachedJwt as b, AccountProviderSource as c, isCapxulError as ct, eip1193AccountProvider as d, toCountryCode as et, localPrivateKeyAccountProvider as f, SmartAccount as g, Session as h, SignerStatus as i, CapxulErrorDetails as it, BudgetId as j, AuthUserId as k, AccountRequirement as l, Profile as m, CapxulSigner as n, CapxulError as nt, injectedWalletSigner as o, Failure as ot, CapxulResult as p, PublishableKey as q, Eip1193RequestProvider as r, CapxulErrorCode as rt, AccountProvider as s, FailureMode as st, CapxulDigestSigner as t, CAPXUL_ERROR_CODES as tt, Eip1193Provider as u, AuthCachePort as v, AllowanceKey as w, Account$1 as x, AuthCachePortTag as y, Money as z };

package/dist/testing/index.d.mts

@@ -1,4 +1,4 @@
-import { cn as TelemetryGroupInput, ln as TelemetryIdentifyInput, sn as TelemetryEvent, t as CapxulClient, yn as IdentityTransition } from "../create-capxul-client-BI-6Za6X.mjs";
+import { Mn as IdentityTransition, bn as TelemetryIdentifyInput, n as ObservationAdapter, u as CapxulClient, vn as TelemetryEvent, yn as TelemetryGroupInput } from "../observation-Ci8gIQjm.mjs";
 import { Effect, Layer } from "effect";
 
 //#region src/testing/telemetry/RecordingTelemetryAdapter.d.ts
@@ -18,6 +18,8 @@ type RecordingTelemetryOperation = {
 //#region src/testing/index.d.ts
 interface CreateCapxulTestClientOptions {
   readonly requirement?: "none" | "counterfactual" | "deployed";
+  /** Optional Core SDK failure adapter for packed consumer proofs. */
+  readonly failureObservation?: ObservationAdapter;
 }
 interface SeedTestIdentityInput {
   readonly authUserId: string;

package/dist/testing/index.mjs

@@ -1,5 +1,5 @@
-import { C as bootstrapErrorFromCapxul, G as deriveCapxulSafeAddress, O as toWei, _ as identityErrorFromCapxul, f as smartAccountErrorFromCapxul, h as wireChainId, k as fromWei, m as accountReadErrorFromCapxul, t as assembleCapxulClient, u as redactTelemetryEvent, w as authClientPortFromPromiseAdapter, y as convexCallErrorFromCapxul } from "../create-capxul-client-CPhTPz_9.mjs";
-import { A as toSessionToken, C as toEpochMs, E as toKycTier, M as CapxulError, O as toPublishableKey, P as Errors, S as toEmail, T as toJwtToken, _ as toAuthUserId, g as toAppId, h as toAllowedOrigin, m as toAddress, p as toAccountId, t as InMemoryAuthCacheAdapter, v as toChainId, w as toEpochSeconds, x as toDurationMs, y as toCountryCode } from "../InMemoryAuthCacheAdapter-Rc8tCtml.mjs";
+import { E as authClientPortFromPromiseAdapter, M as fromWei, T as bootstrapErrorFromCapxul, Y as deriveCapxulSafeAddress, _ as wireChainId, f as redactTelemetryEvent, g as accountReadErrorFromCapxul, j as toWei, m as smartAccountErrorFromCapxul, t as assembleCapxulClient, x as convexCallErrorFromCapxul, y as identityErrorFromCapxul } from "../create-capxul-client-mArFr_Os.mjs";
+import { C as toDurationMs, D as toJwtToken, E as toEpochSeconds, I as CapxulError, N as toSessionToken, O as toKycTier, R as Errors, T as toEpochMs, _ as toAppId, b as toChainId, g as toAllowedOrigin, h as toAddress, j as toPublishableKey, m as toAccountId, t as InMemoryAuthCacheAdapter, v as toAuthUserId, w as toEmail, x as toCountryCode } from "../InMemoryAuthCacheAdapter-qMpBOGb3.mjs";
 import { keccak256 } from "viem";
 import { Effect, Result, Semaphore } from "effect";
 import { getFunctionName } from "convex/server";
@@ -884,7 +884,8 @@ function createCapxulTestClient(options = {}) {
 		},
 		bootstrap: TEST_BOOTSTRAP,
 		authCache,
-		requirement: options.requirement ?? "none"
+		requirement: options.requirement ?? "none",
+		...options.failureObservation === void 0 ? {} : { failureObservation: options.failureObservation }
 	});
 	const transitions = [];
 	const unsubscribe = client._internal.identity.subscribeTransitions((record) => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@capxul/sdk",
-  "version": "2.1.1",
+  "version": "2.3.0",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/Xelmar-tech/infrastructure.git",
@@ -47,11 +47,11 @@
     "vite-plus": "0.1.23",
     "vitest": "npm:@voidzero-dev/vite-plus-test@0.1.23",
     "@capxul/config": "0.2.0",
-    "@capxul/errors": "0.0.1",
-    "@capxul/observability": "2.1.1",
+    "@capxul/observability": "2.3.0",
     "@capxul/typescript-config": "0.0.0",
-    "@capxul/types": "0.1.0",
-    "@capxul/wire": "0.3.0"
+    "@capxul/errors": "0.0.1",
+    "@capxul/wire": "0.4.0",
+    "@capxul/types": "0.2.0"
   },
   "_permissionlessPinReason": "permissionless.toSafeSmartAccount is pinned to 0.3.4 for live Safe deployment E2E. Counterfactual address fixtures captured 2026-05-17 in packages/backend/convex/_shared/__tests__/counterfactual.test.ts and packages/config/tests/safe.test.ts must be re-verified before upgrading.",
   "scripts": {