@capxul/sdk 2.7.0 → 2.8.2

package/dist/{create-capxul-client-DNYuHQGS.mjs → create-capxul-client-BKJHefmA.mjs}

@@ -1,15 +1,32 @@
-import { A as toPartyId, B as Errors, G as failureFingerprint, H as CHAIN_UPSTREAMS, K as isFailureMode, M as toPayrollRunId, P as toRoleKey, R as CapxulError, S as toCurrencyCode, U as FAILURE_MODES$1, V as isCapxulError, W as chainCauseProperties, b as toChainId, c as BYTES32_RE, d as WEI_RE, f as ZERO_BYTES32, h as toAddress, j as toPayrollGroupId, k as toOrgId, l as EVM_ADDRESS_RE$1, m as toAccountId, n as BrowserAuthCacheAdapter, s as APP_ID_RE, t as InMemoryAuthCacheAdapter, u as SUPPORTED_CURRENCY_CODES, v as toAuthUserId, w as toEmail, x as toCountryCode, y as toBudgetId, z as EXPECTED_OPERATION_OUTCOMES } from "./InMemoryAuthCacheAdapter-B6PHyzCN.mjs";
+import { A as toPartyId, B as Errors, G as decodeChainCause, H as CHAIN_UPSTREAMS, J as revertSummaryText, K as failureFingerprint, L as CAPXUL_ERROR_CODES, M as toPayrollRunId, P as toRoleKey, R as CapxulError, S as toCurrencyCode, U as FAILURE_MODES$1, V as isCapxulError, W as chainCauseProperties, b as toChainId, c as BYTES32_RE, d as WEI_RE, f as ZERO_BYTES32, h as toAddress, j as toPayrollGroupId, k as toOrgId, l as EVM_ADDRESS_RE$1, m as toAccountId, n as BrowserAuthCacheAdapter, q as isFailureMode, s as APP_ID_RE, t as InMemoryAuthCacheAdapter, u as SUPPORTED_CURRENCY_CODES, v as toAuthUserId, w as toEmail, x as toCountryCode, y as toBudgetId, z as EXPECTED_OPERATION_OUTCOMES } from "./InMemoryAuthCacheAdapter-BrEN-men.mjs";
 import { concat, encodeAbiParameters, encodeFunctionData, encodePacked, formatUnits, getContractAddress, keccak256, padHex, parseUnits, recoverAddress, stringToHex, toBytes, toEventSelector, toFunctionSelector, toFunctionSignature } from "viem";
 import { Context, Data, Deferred, Duration, Effect, Exit, Fiber, Layer, Queue, Ref, Result, Schema, SchemaGetter, Scope } from "effect";
 import { makeFunctionReference } from "convex/server";
 //#region src/domain/identity/model.ts
 const WRONG = { refused: "WRONG_STATE" };
 /** org-lifecycle.ts:173-184, lifted verbatim. */
+/**
+* Causes that do not change on a retry: the same request reverts, is refused,
+* or fails the same pre-flight again. A retry re-enters the same lane and
+* fails the same way (the GS205 loop of 2026-09-02).
+*/
+const DEFINITIVE_PROVIDER_MODES = /* @__PURE__ */ new Set([
+	"auth-origin-mismatch",
+	"app-env-allowlist",
+	"no-secure-context",
+	"signer-not-ready",
+	"revert",
+	"insufficient-balance",
+	"insufficient-allowance",
+	"rejected",
+	"unauthorized"
+]);
 const isRetryable = (failure) => {
 	if (failure.code === "CANCELLED" || failure.code === "SIGNER_REJECTED") return true;
 	if (failure.code === "PROVIDER_ERROR") {
-		const mode = failure.mode;
-		return mode !== "auth-origin-mismatch" && mode !== "app-env-allowlist" && mode !== "no-secure-context";
+		const chainRetryable = failure.error?.chain?.retryable;
+		if (chainRetryable !== void 0) return chainRetryable;
+		return !DEFINITIVE_PROVIDER_MODES.has(failure.mode);
 	}
 	return failure.code === "NETWORK_ERROR" || failure.code === "UNKNOWN";
 };
@@ -3028,6 +3045,50 @@ function isSafeField(field, value) {
 	return value.length > 0 && value.length <= rule.maxLength && value === value.trim() && !value.includes("://") && !containsSensitiveMaterial(value) && rule.pattern.test(value);
 }
 //#endregion
+//#region src/internal/invocation-observation.ts
+const INVOCATION_OBSERVATION = Symbol("capxul.invocation-observation");
+const FAILURE_INVOCATION_SNAPSHOT = Symbol("capxul.failure-invocation-snapshot");
+/** @internal Attach one immutable, non-wire invocation snapshot to an SDK-owned object. */
+function attachInvocationObservation(target, source) {
+	const snapshot = Object.freeze(source.context === void 0 ? { active: source.active } : {
+		active: source.active,
+		context: Object.freeze({ ...source.context })
+	});
+	Object.defineProperty(target, INVOCATION_OBSERVATION, {
+		configurable: false,
+		enumerable: false,
+		value: snapshot,
+		writable: false
+	});
+	return target;
+}
+/** @internal Read the snapshot without exposing its symbol or adding a wire field. */
+function readInvocationObservation(source) {
+	if (typeof source !== "object" || source === null) return void 0;
+	return source[INVOCATION_OBSERVATION];
+}
+/** @internal Carry a snapshot across an SDK adapter projection without resolving again. */
+function copyInvocationObservation(source, target) {
+	const snapshot = readInvocationObservation(source);
+	return snapshot === void 0 ? target : attachInvocationObservation(target, snapshot);
+}
+/** @internal Carry the public call-start delivery decision with its failure envelope. */
+function markFailureInvocationSnapshot(failure, snapshot) {
+	Object.defineProperty(failure, FAILURE_INVOCATION_SNAPSHOT, {
+		configurable: false,
+		enumerable: false,
+		value: Object.freeze(snapshot),
+		writable: false
+	});
+	return failure;
+}
+/** @internal Read the call-start delivery decision; undefined means a direct adapter call. */
+function readFailureInvocationSnapshot(failure) {
+	if (typeof failure !== "object" || failure === null) return void 0;
+	const snapshot = failure[FAILURE_INVOCATION_SNAPSHOT];
+	return typeof snapshot === "object" && snapshot !== null && "active" in snapshot ? snapshot : void 0;
+}
+//#endregion
 //#region src/surface/_shared/provisioning-telemetry.ts
 async function emitProvisioningTelemetry(telemetry, smartAccount) {
 	if (telemetry === void 0) return;
@@ -3105,9 +3166,29 @@ function* causeChain(cause) {
 		current = current.cause;
 	}
 }
+const SIGNER_NOT_READY_CODES = /* @__PURE__ */ new Set(["MISSING_SIGNER", "NOT_CONFIGURED"]);
+function isOpenfortSignerNotReadyCode(value) {
+	return typeof value === "string" && SIGNER_NOT_READY_CODES.has(value);
+}
+/** Return the exact Openfort code that requires an embedded-signer rebuild. */
+function openfortSignerNotReadyCode(cause) {
+	for (const link of causeChain(cause)) {
+		const error = link;
+		for (const value of [
+			error.error,
+			error.code,
+			error.details?.provider_error_code
+		]) if (isOpenfortSignerNotReadyCode(value)) return value;
+	}
+}
+/** Openfort's typed signal that its embedded signer state must be rebuilt. */
+function isSignerNotReadySignal(cause) {
+	return openfortSignerNotReadyCode(cause) !== void 0;
+}
 /** Fold a signer throw into the public error contract. */
 function signerFailure(source, operation, cause) {
 	let failureMode;
+	const providerErrorCode = source === "openfort-embedded" ? openfortSignerNotReadyCode(cause) : void 0;
 	for (const link of causeChain(cause)) {
 		if (link instanceof CapxulError && link.code === "SIGNER_REJECTED") return link;
 		failureMode = getFailureMode(link) ?? failureMode;
@@ -3116,8 +3197,15 @@ function signerFailure(source, operation, cause) {
 			source,
 			cause
 		});
+		if (providerErrorCode !== void 0) failureMode = "signer-not-ready";
 	}
-	return Errors.providerError("signer", operation, cause, failureMode === void 0 ? void 0 : { failure_mode: failureMode });
+	return Errors.providerError("signer", operation, cause, failureMode === void 0 && providerErrorCode === void 0 ? void 0 : {
+		...failureMode === void 0 ? {} : { failure_mode: failureMode },
+		...providerErrorCode === void 0 ? {} : { details: {
+			provider_error_source: "openfort",
+			provider_error_code: providerErrorCode
+		} }
+	});
 }
 /**
 * Browser `CapxulSigner` backed by an injected EIP-1193 wallet (MetaMask, etc.).
@@ -3169,50 +3257,6 @@ async function recoverRawDigestSigner(input) {
 	}
 }
 //#endregion
-//#region src/internal/invocation-observation.ts
-const INVOCATION_OBSERVATION = Symbol("capxul.invocation-observation");
-const FAILURE_INVOCATION_SNAPSHOT = Symbol("capxul.failure-invocation-snapshot");
-/** @internal Attach one immutable, non-wire invocation snapshot to an SDK-owned object. */
-function attachInvocationObservation(target, source) {
-	const snapshot = Object.freeze(source.context === void 0 ? { active: source.active } : {
-		active: source.active,
-		context: Object.freeze({ ...source.context })
-	});
-	Object.defineProperty(target, INVOCATION_OBSERVATION, {
-		configurable: false,
-		enumerable: false,
-		value: snapshot,
-		writable: false
-	});
-	return target;
-}
-/** @internal Read the snapshot without exposing its symbol or adding a wire field. */
-function readInvocationObservation(source) {
-	if (typeof source !== "object" || source === null) return void 0;
-	return source[INVOCATION_OBSERVATION];
-}
-/** @internal Carry a snapshot across an SDK adapter projection without resolving again. */
-function copyInvocationObservation(source, target) {
-	const snapshot = readInvocationObservation(source);
-	return snapshot === void 0 ? target : attachInvocationObservation(target, snapshot);
-}
-/** @internal Carry the public call-start delivery decision with its failure envelope. */
-function markFailureInvocationSnapshot(failure, snapshot) {
-	Object.defineProperty(failure, FAILURE_INVOCATION_SNAPSHOT, {
-		configurable: false,
-		enumerable: false,
-		value: Object.freeze(snapshot),
-		writable: false
-	});
-	return failure;
-}
-/** @internal Read the call-start delivery decision; undefined means a direct adapter call. */
-function readFailureInvocationSnapshot(failure) {
-	if (typeof failure !== "object" || failure === null) return void 0;
-	const snapshot = failure[FAILURE_INVOCATION_SNAPSHOT];
-	return typeof snapshot === "object" && snapshot !== null && "active" in snapshot ? snapshot : void 0;
-}
-//#endregion
 //#region src/domain/machine/telemetry.ts
 const definedEntries = (values) => Object.fromEntries(Object.entries(values).filter((entry) => entry[1] !== void 0));
 const SAFE_ENGINEERING_ID = /^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$/u;
@@ -3674,21 +3718,27 @@ async function runIdentityFacade(verb, controls, run, runPromise = Effect.runPro
 async function runPortEffect(effect, controls, operation = "port", runPromise = Effect.runPromise) {
 	const deadlineDelay = controls?.deadlineMs === void 0 ? void 0 : Math.max(0, controls.deadlineMs - Date.now());
 	const timeoutMs = controls?.timeoutMs === void 0 ? deadlineDelay : deadlineDelay === void 0 ? controls.timeoutMs : Math.min(controls.timeoutMs, deadlineDelay);
-	const observed = (timeoutMs === void 0 ? effect : effect.pipe(Effect.timeoutOrElse({
+	return runCapxulEffect((timeoutMs === void 0 ? effect : effect.pipe(Effect.timeoutOrElse({
 		duration: `${timeoutMs} millis`,
 		orElse: () => Effect.fail({ publicError: Errors.providerTimeout("sdk", operation, timeoutMs) })
-	}))).pipe(Effect.tap(() => Effect.annotateCurrentSpan({ outcome: "succeeded" })), Effect.tapError((failure) => {
-		const mode = failure.publicError.details?.failure_mode;
+	}))).pipe(Effect.mapError((failure) => failure.publicError)), controls, operation, runPromise);
+}
+/** Observe a public Effect that already uses the canonical CapxulError channel. */
+async function runCapxulEffect(effect, controls, operation = "port", runPromise = Effect.runPromise) {
+	const invocation = readInvocationObservation(controls);
+	const correlationId = safeEngineeringIdentifier(controls?.correlation_id ?? invocation?.context?.correlationId);
+	const observed = effect.pipe(Effect.tap(() => Effect.annotateCurrentSpan({ outcome: "succeeded" })), Effect.tapError((error) => {
+		const mode = error.mode ?? error.details?.failure_mode;
 		return Effect.annotateCurrentSpan({
-			outcome: portFailureOutcome(failure.publicError.code),
-			failure_code: failure.publicError.code,
+			outcome: portFailureOutcome(error.code),
+			failure_code: error.code,
 			...typeof mode === "string" ? { mode } : {}
 		});
 	}), Effect.tapDefect(() => Effect.annotateCurrentSpan({
 		outcome: "failed",
 		failure_code: "UNKNOWN"
-	})), Effect.withSpan(`identity.port.${operation}`));
-	return runIfActive(controls?.signal, operation, () => withInvocationParentSpan(observed, controls), runPromise);
+	})), Effect.withSpan(`identity.port.${operation}`), Effect.annotateSpans(correlationId === void 0 ? {} : { correlation_id: correlationId }));
+	return runIfActive(controls?.signal, operation, () => withInvocationParentSpan(observed, controls).pipe(Effect.mapError((publicError) => ({ publicError }))), runPromise);
 }
 /** Map machine-internal failure state onto the public SDK error vocabulary. */
 function publicIdentityFailure(failure) {
@@ -4403,7 +4453,7 @@ function makeAccountMethods(deps) {
 			value: provisioningPhase(deps.actor.snapshot())
 		};
 	};
-	const resolveLifecycle = async () => {
+	const resolveLifecycle = async (controls) => {
 		const phase = provisioningPhase(deps.actor.snapshot());
 		const status = await getStatus();
 		if (!status.ok) return accountFailureResult(status.error);
@@ -4411,7 +4461,7 @@ function makeAccountMethods(deps) {
 		if (status.value.status !== "notAuthenticated" && (phase.status === "ready" || isRequirementMet(status.value, requirement))) {
 			const accountReadPort = deps.accountReadPort;
 			if (accountReadPort === void 0) return accountFailureResult(Errors.invalidInput("account", "accountReadPort is required to resolve ready lifecycle"));
-			const account = await runPortEffect(accountReadPort.readBalance({ chainId: toChainId(deps.chainId) }));
+			const account = await runPortEffect(accountReadPort.readBalance(copyInvocationObservation(controls, { chainId: toChainId(deps.chainId) })), controls, "accounts.read", deps.runPromise);
 			if (!account.ok) return accountFailureResult(account.error);
 			accountId = String(account.value.id);
 		}
@@ -4425,8 +4475,9 @@ function makeAccountMethods(deps) {
 			})
 		};
 	};
-	const getLifecycle = () => resolveLifecycle();
+	const getLifecycle = () => resolveLifecycle(deps.invocationControls?.());
 	const retrySetup = async () => {
+		const controls = deps.invocationControls?.();
 		const resetSession = deps.signer?.resetSession;
 		if (typeof resetSession === "function") try {
 			resetSession.call(deps.signer);
@@ -4435,7 +4486,7 @@ function makeAccountMethods(deps) {
 		}
 		const retried = await drive({ _tag: "RetryAccount" });
 		if (!retried.ok) return accountFailureResult(retried.error);
-		return resolveLifecycle();
+		return resolveLifecycle(controls);
 	};
 	return {
 		methods: {
@@ -4495,146 +4546,45 @@ const moneyExecutionContract = {
 };
 //#endregion
 //#region package.json
-var version = "2.7.0";
+var version = "2.8.2";
 //#endregion
-//#region src/telemetry/stack-frame-parser.ts
-/**
-* Regex for V8/Chrome stack trace frame lines.
-* Matches:
-*   `at functionName (url:line:col)`
-*   `at url:line:col`
-*   `at async functionName (url:line:col)`
-*   `at new ClassName (url:line:col)`
-*/
-const V8_FRAME_RE = /^\s*at\s+(?:(.+?)\s+\()?(?:(.+?)(?::(\d+):(\d+))?|(.+?))\)?\s*$/;
-function isNonUrlName(name) {
-	return name === "<anonymous>" || name.startsWith("eval") || name.startsWith("new ") || name.startsWith("async ");
-}
-/**
-* Parse a V8/Chrome-style stack trace string into PostHog `ExceptionFrame` objects.
-* Returns an empty array when `error.stack` is absent or empty.
-*
-* Handles:
-* - Standard `at functionName (url:line:col)`
-* - Bare `at url:line:col` (no function name)
-* - `at async functionName (url:line:col)`
-* - `at new ClassName (url:line:col)`
-* - Native frames: `at Array.forEach (<anonymous>)`
-*/
-function parseV8StackFrames(error) {
-	const stack = error.stack;
-	if (stack === void 0 || stack === null || stack === "") return [];
-	const lines = stack.split("\n");
-	const frames = [];
-	for (const line of lines) {
-		const trimmed = line.trim();
-		if (!trimmed.startsWith("at ")) continue;
-		const match = V8_FRAME_RE.exec(trimmed);
-		if (match === null) continue;
-		if (match[1] !== void 0) frames.push({
-			function: match[1],
-			filename: match[2],
-			lineno: match[3] !== void 0 ? Number(match[3]) : null,
-			colno: match[4] !== void 0 ? Number(match[4]) : null
-		});
-		else if (match[2] !== void 0 && !isNonUrlName(match[2])) frames.push({
-			function: "<anonymous>",
-			filename: match[2],
-			lineno: match[3] !== void 0 ? Number(match[3]) : null,
-			colno: match[4] !== void 0 ? Number(match[4]) : null
-		});
-		else frames.push({
-			function: match[1] ?? match[2] ?? match[5] ?? "<anonymous>",
-			filename: match[2] ?? match[5] ?? "<anonymous>",
-			lineno: match[3] !== void 0 ? Number(match[3]) : null,
-			colno: match[4] !== void 0 ? Number(match[4]) : null
-		});
-	}
-	return frames;
+//#region src/telemetry/exception-projection.ts
+/** Fixed fallback for failures that have no safe message. */
+const EXCEPTION_MESSAGE = "Capxul SDK operation failed";
+const SDK_VERSION = version;
+/** The one PostHog Error Tracking projection for every SDK exception emitter. */
+function projectSdkException(input) {
+	const operation = normalizeExceptionOperation(input.operation);
+	const errorKind = normalizeExceptionErrorKind(input.errorKind);
+	const mode = isFailureMode(input.failureMode) ? input.failureMode : void 0;
+	const message = input.message ?? "Capxul SDK operation failed";
+	const where = input.chainUpstream === void 0 ? "" : ` on ${input.chainUpstream}${input.chainMethod === void 0 ? "" : ` during ${input.chainMethod}`}`;
+	return {
+		...input.properties,
+		sdk_version: input.sdkVersion,
+		operation,
+		error_kind: errorKind,
+		handled: true,
+		$exception_type: errorKind,
+		$exception_message: message,
+		$exception_level: "error",
+		$exception_fingerprint: failureFingerprint(errorKind, mode, operation),
+		$issue_name: `${errorKind}${mode === void 0 ? "" : `: ${mode}`}${where} (${operation})`,
+		$issue_description: input.issueDescription ?? message,
+		$exception_list: input.exceptionList
+	};
 }
-/** Fixed, leak-safe frame used when the error carries no parseable stack. */
-const SDK_BOUNDARY_FILENAME = "capxul-sdk-observation://boundary";
-/**
-* Build PostHog's `$exception_list` (always a single entry). Error Tracking
-* groups on `type`, so it is ALWAYS present (the CapxulError code) — the
-* previous `[{ frames }]` shape omitted it and PostHog dropped the event as
-* "missing field `type`". When the error has no parseable stack, a synthetic
-* boundary frame stands in so the event still ingests as a real Issue (#1031).
-*/
-function buildExceptionList(input) {
-	const frames = input.frames.length > 0 ? input.frames : [{
-		filename: SDK_BOUNDARY_FILENAME,
-		function: input.operation ?? "unknown",
-		lineno: 1,
-		colno: 1
-	}];
-	return [{
-		type: input.type,
-		value: input.value,
-		mechanism: {
-			handled: true,
-			type: "capxul_sdk_boundary"
-		},
-		stacktrace: { frames }
-	}];
+function normalizeExceptionOperation(value) {
+	return typeof value === "string" && /^[A-Za-z0-9_][A-Za-z0-9_.-]{0,255}$/u.test(value) ? value : "unknown";
 }
-//#endregion
-//#region src/telemetry/capture-exception.ts
-/** Fixed, leak-safe message — the raw error message may carry PII and never ships. */
-const EXCEPTION_MESSAGE = "Capxul SDK operation failed";
-/**
-* Capture an error as a `$exception` event through the telemetry port,
-* formatted for PostHog Error Tracking.
-*
-* Parses stack traces into `$exception_list` format, extracts structured
-* metadata from CapxulError objects, and supplements with context props.
-* Fire-and-forget: telemetry defects are silently swallowed.
-* Returns `Effect<void, never>` for use in Effect pipelines; the underlying
-* adapter work is synchronous, so callers outside Effect contexts can
-* use `Effect.runSync`.
-*/
-function captureException(telemetry, error, context) {
-	return Effect.catchDefect(Effect.sync(() => {
-		const frames = error instanceof Error ? parseV8StackFrames(error) : [];
-		const capxulError = isCapxulError(error) ? error : null;
-		const errorCode = capxulError?.code ?? context?.capxul_error_code ?? "UNKNOWN";
-		const props = {
-			capxul_error_code: errorCode,
-			$exception_type: errorCode,
-			$exception_message: EXCEPTION_MESSAGE,
-			$exception_list: buildExceptionList({
-				type: errorCode,
-				value: EXCEPTION_MESSAGE,
-				...context?.operation === void 0 ? {} : { operation: context.operation },
-				frames
-			}),
-			layer: capxulError?.layer ?? context?.layer,
-			operation: context?.operation,
-			provider: context?.provider,
-			failure_mode: resolveFailureMode(error, context?.failure_mode)
-		};
-		if (capxulError?.details !== void 0) props.details = JSON.stringify(capxulError.details);
-		for (const key of Object.keys(props)) if (props[key] === void 0) delete props[key];
-		return telemetry.emit({
-			name: "$exception",
-			props
-		});
-	}).pipe(Effect.flatten), () => Effect.void);
+function normalizeExceptionErrorKind(value) {
+	return safeExceptionLabel(value) ?? "UNKNOWN";
 }
-/**
-* Synchronous fire-and-forget capture. Runs the Effect inline with
-* `Effect.runSync` so callers outside an Effect context can report errors
-* without awaiting. Core SDK public methods use the assembled observation
-* boundary instead.
-*/
-function captureExceptionSync(telemetry, error, context) {
-	try {
-		Effect.runSync(captureException(telemetry, error, context));
-	} catch {}
+function safeExceptionLabel(value) {
+	return typeof value === "string" && /^[A-Za-z][A-Za-z0-9_.-]{0,63}$/u.test(value) ? value : void 0;
 }
 //#endregion
 //#region src/observation.ts
-const SDK_VERSION = version;
 /** Stable PostHog event used for typed failures that are expected product outcomes. */
 const CAPXUL_SDK_EXPECTED_OUTCOME_EVENT = "capxul_sdk_expected_outcome";
 /**
@@ -4660,13 +4610,13 @@ function postHogFailureObservation(policy, fixedSnapshot) {
 			}));
 			return;
 		}
-		policy.deliver(() => policy.client.capture("$exception", postHogExceptionProperties(safeFailure, properties)));
+		policy.deliver(() => policy.client.capture("$exception", projectFailureException(safeFailure, properties)));
 	};
 	const captureException = (failure) => {
 		const prepared = prepare(failure);
 		if (prepared === void 0 || policy.client === null || policy.client === void 0) return;
 		const [safeFailure, properties] = prepared;
-		policy.deliver(() => policy.client.capture("$exception", postHogExceptionProperties(safeFailure, properties)));
+		policy.deliver(() => policy.client.capture("$exception", projectFailureException(safeFailure, properties)));
 	};
 	return {
 		resolveContext: () => {
@@ -4877,19 +4827,20 @@ function postHogProperties(failure, context) {
 		...observationContextProps(merged)
 	};
 }
-function postHogExceptionProperties(failure, properties) {
+function projectFailureException(failure, properties) {
 	const filename = `capxul-sdk-observation://boundary/${failure.operation}`;
 	const message = failure.message ?? "Capxul SDK operation failed";
-	const mode = failure.detail?.failure_mode;
-	return {
-		...properties,
-		$exception_type: failure.errorKind,
-		$exception_message: message,
-		$exception_level: "error",
-		$exception_fingerprint: failureFingerprint(failure.errorKind, isFailureMode(mode) ? mode : void 0, failure.operation),
-		$issue_name: issueName(failure, isFailureMode(mode) ? mode : void 0),
-		$issue_description: failure.detail?.chain_provider_message ?? message,
-		$exception_list: [{
+	return projectSdkException({
+		properties,
+		sdkVersion: failure.sdkVersion,
+		operation: failure.operation,
+		errorKind: failure.errorKind,
+		failureMode: failure.detail?.failure_mode,
+		message,
+		issueDescription: issueDescription(failure, message),
+		...failure.detail?.chain_upstream === void 0 ? {} : { chainUpstream: failure.detail.chain_upstream },
+		...failure.detail?.chain_method === void 0 ? {} : { chainMethod: failure.detail.chain_method },
+		exceptionList: [{
 			type: failure.errorKind,
 			value: message,
 			mechanism: {
@@ -4910,14 +4861,23 @@ function postHogExceptionProperties(failure, properties) {
 			},
 			...failure.stack === void 0 ? {} : { stack: failure.stack }
 		}]
-	};
+	});
 }
-function issueName(failure, mode) {
-	const upstream = failure.detail?.chain_upstream;
-	const method = failure.detail?.chain_method;
-	const cause = mode === void 0 ? "" : `: ${mode}`;
-	const where = typeof upstream !== "string" ? "" : ` on ${upstream}${typeof method === "string" ? ` during ${method}` : ""}`;
-	return `${failure.errorKind}${cause}${where} (${failure.operation})`;
+/**
+* The decoded revert leads the description: the provider's own message masks
+* the raw revert data (`reason: [REDACTED]`), and the name plus arguments
+* (`Error(message=GS205)`) is what tells one revert from another.
+*/
+function issueDescription(failure, message) {
+	const detail = failure.detail;
+	const providerMessage = detail?.chain_provider_message;
+	if (detail?.chain_revert_name === void 0) return providerMessage ?? message;
+	const revert = revertSummaryText({
+		name: detail.chain_revert_name === "unknown" ? null : detail.chain_revert_name,
+		selector: detail.chain_revert_selector ?? "0x",
+		args: detail.chain_revert_args ?? {}
+	});
+	return providerMessage === void 0 ? revert : `${revert}; ${providerMessage}`;
 }
 const MAX_EVIDENCE_TEXT = 4e3;
 const MAX_CAUSE_DEPTH = 8;
@@ -5022,18 +4982,45 @@ function sanitizeFailureObservation(failure) {
 * Shared by the failure boundary and the `bootstrap_failed` product event.
 */
 function failureDetail(cause) {
-	if (!isCapxulError(cause)) return void 0;
-	const details = cause.details;
+	const error = observationError(cause);
+	if (error === void 0) return void 0;
+	const details = error.details;
 	const source = typeof details === "object" && details !== null ? details : {};
 	return sanitizeFailureDetail({
 		provider: source.provider,
 		provider_operation: source.operation,
-		failure_mode: cause.mode ?? source.failure_mode,
+		provider_error_source: source.provider_error_source,
+		provider_error_code: source.provider_error_code,
+		target_host: source.target_host,
+		failure_mode: error.mode ?? source.failure_mode,
 		reason: source.reason,
 		http_status: source.httpStatus,
-		...cause.chain === void 0 ? {} : chainCauseProperties(cause.chain)
+		connection_id: source.connection_id,
+		connection_count: source.connection_count,
+		connection_retries: source.connection_retries,
+		close_code: source.close_code,
+		close_was_clean: source.close_was_clean,
+		close_reason_present: source.close_reason_present,
+		document_visibility: source.document_visibility,
+		navigator_online: source.navigator_online,
+		last_browser_event: source.last_browser_event,
+		ms_since_browser_event: source.ms_since_browser_event,
+		...error.chain === void 0 ? {} : chainCauseProperties(error.chain)
 	});
 }
+const CAPXUL_ERROR_CODE_SET = new Set(CAPXUL_ERROR_CODES);
+function observationError(cause) {
+	if (isCapxulError(cause)) return cause;
+	if (typeof cause !== "object" || cause === null) return void 0;
+	const candidate = cause;
+	if (typeof candidate.code !== "string" || !CAPXUL_ERROR_CODE_SET.has(candidate.code) || typeof candidate.message !== "string") return;
+	const chain = decodeChainCause(candidate.chain);
+	return {
+		...candidate.details === void 0 ? {} : { details: candidate.details },
+		...candidate.mode === void 0 ? {} : { mode: candidate.mode },
+		...chain === null ? {} : { chain }
+	};
+}
 /** The chain-cause half of {@link sanitizeFailureDetail}: same bounds, same masking. */
 function sanitizeChainDetail(source, detail) {
 	for (const key of [
@@ -5045,17 +5032,19 @@ function sanitizeChainDetail(source, detail) {
 		const value = source[key];
 		if (typeof value === "string" && ENUMERATED_DETAIL_RE.test(value)) detail[key] = value;
 	}
+	sanitizeProviderErrorDetail(source, detail);
 	const status = source.http_status;
 	if (typeof status === "number" && Number.isInteger(status) && status >= 100 && status <= 599) detail.http_status = status;
 	for (const key of [
 		"chain_upstream",
 		"chain_method",
-		"chain_revert_name",
-		"chain_revert_selector"
+		"chain_revert_name"
 	]) {
 		const value = source[key];
 		if (typeof value === "string" && ENUMERATED_DETAIL_RE.test(value)) detail[key] = value;
 	}
+	const selector = source.chain_revert_selector;
+	if (typeof selector === "string" && REVERT_SELECTOR_RE.test(selector)) detail.chain_revert_selector = selector;
 	if (typeof source.chain_retryable === "boolean") detail.chain_retryable = source.chain_retryable;
 	const chainHttpStatus = source.chain_http_status;
 	if (typeof chainHttpStatus === "number" && Number.isInteger(chainHttpStatus) && chainHttpStatus >= 100 && chainHttpStatus <= 599) detail.chain_http_status = chainHttpStatus;
@@ -5072,15 +5061,53 @@ function sanitizeChainDetail(source, detail) {
 	const providerMessage = evidenceText(source.chain_provider_message);
 	if (providerMessage !== void 0) detail.chain_provider_message = providerMessage;
 }
+function sanitizeProviderErrorDetail(source, detail) {
+	if (source.provider_error_source !== "openfort") return;
+	detail.provider_error_source = "openfort";
+	if (isOpenfortSignerNotReadyCode(source.provider_error_code)) detail.provider_error_code = source.provider_error_code;
+}
+function sanitizeConnectionDetail(source, detail) {
+	const targetHost = source.target_host;
+	if (typeof targetHost === "string" && TARGET_HOST_RE.test(targetHost)) detail.target_host = targetHost;
+	for (const key of [
+		"connection_id",
+		"document_visibility",
+		"last_browser_event"
+	]) {
+		const value = source[key];
+		if (typeof value === "string" && ENUMERATED_DETAIL_RE.test(value)) detail[key] = value;
+	}
+	for (const key of [
+		"connection_count",
+		"connection_retries",
+		"close_code",
+		"ms_since_browser_event"
+	]) {
+		const value = source[key];
+		if (typeof value === "number" && Number.isSafeInteger(value) && value >= 0 && (key !== "close_code" || value <= 4999)) detail[key] = value;
+	}
+	for (const key of [
+		"close_was_clean",
+		"close_reason_present",
+		"navigator_online"
+	]) {
+		const value = source[key];
+		if (typeof value === "boolean") detail[key] = value;
+	}
+}
 function sanitizeFailureDetail(input) {
 	if (typeof input !== "object" || input === null) return void 0;
 	const source = input;
 	const detail = {};
+	sanitizeConnectionDetail(source, detail);
 	sanitizeChainDetail(source, detail);
 	return Object.keys(detail).length === 0 ? void 0 : detail;
 }
 /** Enumerated codes only (`convex`, `no-secure-context`, `bootstrap-encode`); free text fails. */
 const ENUMERATED_DETAIL_RE = /^[A-Za-z][A-Za-z0-9_.-]{0,63}$/u;
+const TARGET_HOST_RE = /^[A-Za-z0-9.[\]:-]{1,253}$/u;
+/** A four-byte revert selector, or the bare `0x` of an empty revert. */
+const REVERT_SELECTOR_RE = /^0x(?:[0-9a-fA-F]{8})?$/u;
 function normalizeSdkVersion(value) {
 	return typeof value === "string" && /^[A-Za-z0-9][A-Za-z0-9.+_-]{0,127}$/u.test(value) ? value : "unknown";
 }
@@ -6242,13 +6269,14 @@ var ClockPortTag = class extends Context.Service()("@capxul/sdk/ports/ClockPort"
 //#endregion
 //#region src/ports/convex-call.ts
 var ConvexCallError = class extends Data.TaggedError("ConvexCallError") {};
-function convexCallErrorFromCapxul(operation, error) {
+function convexCallErrorFromCapxul(operation, error, transport) {
 	return new ConvexCallError({
 		operation,
 		publicCode: error.code,
 		publicError: error,
 		cause: error,
-		...error.details === void 0 ? {} : { details: error.details }
+		...error.details === void 0 ? {} : { details: error.details },
+		...transport === void 0 ? {} : { transport }
 	});
 }
 var ConvexCallPortTag = class extends Context.Service()("@capxul/sdk/ports/ConvexCallPort") {};
@@ -6289,31 +6317,56 @@ function wireChainId(chainId) {
 	return chainId;
 }
 //#endregion
-//#region src/ports/account-read.ts
-var AccountReadError = class extends Data.TaggedError("AccountReadError") {};
-function accountReadErrorFromCapxul(operation, error, cause = error) {
-	return new AccountReadError({
-		operation,
-		publicCode: error.code,
-		publicError: error,
-		cause,
-		...error.details === void 0 ? {} : { details: error.details }
-	});
+//#region src/telemetry/invocation.ts
+const PRODUCT_INVOCATION = Symbol("capxul.product-telemetry-invocation");
+function bindProductTelemetryInvocation(telemetry, source) {
+	return telemetry[PRODUCT_INVOCATION]?.(source) ?? telemetry;
 }
-var AccountReadPortTag = class extends Context.Service()("@capxul/sdk/ports/AccountReadPort") {};
 //#endregion
-//#region src/ports/smart-account.ts
-var SmartAccountError = class extends Data.TaggedError("SmartAccountError") {};
-function smartAccountErrorFromCapxul(operation, error, cause = error) {
-	return new SmartAccountError({
-		operation,
-		publicCode: error.code,
-		publicError: error,
-		cause,
-		...error.details === void 0 ? {} : { details: error.details }
+//#region src/adapters/convex-call/retry-idempotent-read.ts
+const MAX_RETRIES = 2;
+function isConnectionLoss(error) {
+	return error.publicCode === "NETWORK_ERROR" && error.publicError.mode === "upstream-down" && error.publicError.details?.reason === "connection-lost-in-flight";
+}
+function retryIdempotentRead(effect, operation, telemetry, invocationSource) {
+	return Effect.suspend(() => {
+		let attempt = 0;
+		const invocationTelemetry = telemetry === void 0 ? void 0 : bindProductTelemetryInvocation(telemetry, invocationSource);
+		return effect.pipe(Effect.tapError((error) => {
+			if (!isConnectionLoss(error) || attempt >= MAX_RETRIES) return Effect.void;
+			attempt += 1;
+			const eventFields = {
+				operation,
+				failure_mode: "upstream-down",
+				reason: "connection-lost-in-flight",
+				attempt,
+				delay_ms: 0,
+				...error.transport === void 0 ? {} : {
+					connection_id: error.transport.connection_id,
+					connection_count: error.transport.connection_count
+				}
+			};
+			const transport = error.transport;
+			const connection = transport === void 0 ? void 0 : omitTransportKind(transport);
+			const log = Effect.logInfo("capxul.operation.retried").pipe(Effect.annotateLogs(connection === void 0 ? eventFields : {
+				...eventFields,
+				...connection
+			}), Effect.catchCause(() => Effect.void));
+			if (invocationTelemetry === void 0) return log;
+			return log.pipe(Effect.andThen(invocationTelemetry.emit({
+				name: "operation_retried",
+				props: eventFields
+			})), Effect.catchCause(() => Effect.void));
+		}), Effect.retry({
+			times: MAX_RETRIES,
+			while: isConnectionLoss
+		}));
 	});
 }
-var SmartAccountPortTag = class extends Context.Service()("@capxul/sdk/ports/SmartAccountPort") {};
+function omitTransportKind(transport) {
+	const { kind: _kind, ...connection } = transport;
+	return connection;
+}
 //#endregion
 //#region ../observability/src/index.ts
 const PII = Schema.String.pipe(Schema.brand("PII"));
@@ -6465,7 +6518,10 @@ const BootstrapFailedProps = Schema.Struct({
 	applicationId: OptionalAppId,
 	durationMs: OptionalDurationMs,
 	origin: OptionalString,
-	reason: OptionalString
+	provider: OptionalString,
+	provider_operation: OptionalString,
+	reason: OptionalString,
+	target_host: OptionalString
 });
 const AccountBalanceReadProps = Schema.Struct({
 	...TelemetryEnvelopeProps,
@@ -6530,6 +6586,9 @@ const OperationRetriedProps = Schema.Struct({
 	...TelemetryEnvelopeProps,
 	operation: Schema.String,
 	failure_mode: FailureModeSchema,
+	reason: Schema.optional(Schema.Literal("connection-lost-in-flight")),
+	connection_id: OptionalString,
+	connection_count: Schema.optional(Schema.Number),
 	attempt: Schema.Number,
 	delay_ms: DurationMsSchema
 });
@@ -6706,7 +6765,9 @@ const PaymentVerificationRetryProps = Schema.Struct({
 	command_id: Schema.String,
 	attempt: Schema.Number,
 	reason_code: Schema.String,
-	chain_id: Schema.Number
+	chain_id: Schema.Number,
+	delay_ms: DurationMsSchema,
+	outcome: Schema.Literals(["scheduled", "unresolved"])
 });
 const DepositInitiatedProps = Schema.Struct({ ...TelemetryEnvelopeProps });
 const DepositSettledProps = Schema.Struct({
@@ -6947,7 +7008,7 @@ function redactTelemetryEvent(event, options = {}) {
 }
 function redactTelemetryProps(name, props, options = {}) {
 	if (props === void 0) return void 0;
-	const clone = cloneProps$1(props);
+	const clone = cloneProps(props);
 	if (options.rawMode === true) return clone;
 	for (const key of PII_PROP_KEYS_BY_EVENT[name] ?? []) redactProperty(clone, key);
 	return clone;
@@ -6962,17 +7023,17 @@ function redactProperty(props, key) {
 	const value = props[key];
 	if (typeof value === "string") props[key] = sha256Hex(value).slice(0, 12);
 }
-function cloneProps$1(props) {
+function cloneProps(props) {
 	const cloned = {};
-	for (const [key, value] of Object.entries(props)) cloned[key] = cloneTelemetryValue$1(value);
+	for (const [key, value] of Object.entries(props)) cloned[key] = cloneTelemetryValue(value);
 	return cloned;
 }
-function cloneTelemetryValue$1(value) {
-	if (Array.isArray(value)) return value.map(cloneTelemetryValue$1);
+function cloneTelemetryValue(value) {
+	if (Array.isArray(value)) return value.map(cloneTelemetryValue);
 	if (value === null || typeof value !== "object") return value;
 	if (Object.getPrototypeOf(value) !== Object.prototype) return value;
 	const cloned = {};
-	for (const [key, nested] of Object.entries(value)) cloned[key] = cloneTelemetryValue$1(nested);
+	for (const [key, nested] of Object.entries(value)) cloned[key] = cloneTelemetryValue(nested);
 	return cloned;
 }
 const SHA256_INITIAL_HASH = [
@@ -7130,89 +7191,31 @@ function rotr(value, bits) {
 //#region src/ports/telemetry.ts
 var TelemetryPortTag = class extends Context.Service()("@capxul/sdk/ports/TelemetryPort") {};
 //#endregion
-//#region src/adapters/telemetry/PostHogTelemetryAdapter.ts
-var PostHogTelemetryAdapter = class {
-	#capture;
-	#identify;
-	#group;
-	#reset;
-	constructor(deps) {
-		this.#capture = deps.capture;
-		this.#identify = deps.identify ?? (() => void 0);
-		this.#group = deps.group ?? (() => void 0);
-		this.#reset = deps.reset ?? (() => void 0);
-	}
-	emit(event) {
-		return this.#run(() => this.#capture(event.name, redactTelemetryProps(event.name, cloneProps(event.props)), event), "emit", event.name);
-	}
-	identify(input) {
-		return this.#run(() => this.#identify(cloneIdentifyInput(input)), "identify");
-	}
-	group(input) {
-		return this.#run(() => this.#group(cloneGroupInput(input)), "group");
-	}
-	reset() {
-		return this.#run(() => this.#reset(), "reset");
-	}
-	#run(operation, operationName, eventName) {
-		const diagnose = Effect.logWarning("product.telemetry.transport.dropped").pipe(Effect.annotateLogs({
-			operation: operationName,
-			...eventName === void 0 ? {} : { product_event: eventName }
-		}), Effect.catchCause(() => Effect.void));
-		return Effect.suspend(() => {
-			let pending;
-			try {
-				pending = operation();
-			} catch {
-				return diagnose;
-			}
-			if (pending === void 0) return Effect.void;
-			const transport = Effect.tryPromise({
-				try: () => pending,
-				catch: () => void 0
-			}).pipe(Effect.catch(() => diagnose));
-			return Effect.forkDetach(transport, { startImmediately: true }).pipe(Effect.asVoid);
-		});
-	}
-};
-function PostHogTelemetryLayer(deps) {
-	return Layer.succeed(TelemetryPortTag, new PostHogTelemetryAdapter(deps));
-}
-function cloneIdentifyInput(input) {
-	const traits = input.traits === void 0 ? void 0 : cloneProps(input.traits);
-	const properties = input.properties === void 0 ? void 0 : cloneProps(input.properties);
-	return {
-		distinctId: input.distinctId,
-		...input.anonDistinctId === void 0 ? {} : { anonDistinctId: input.anonDistinctId },
-		...traits === void 0 ? {} : { traits },
-		...properties === void 0 ? {} : { properties }
-	};
-}
-function cloneGroupInput(input) {
-	const properties = input.properties === void 0 ? void 0 : cloneProps(input.properties);
-	return properties === void 0 ? {
-		groupType: input.groupType,
-		groupKey: input.groupKey
-	} : {
-		groupType: input.groupType,
-		groupKey: input.groupKey,
-		properties
-	};
-}
-function cloneProps(props) {
-	if (props === void 0) return void 0;
-	const cloned = {};
-	for (const [key, value] of Object.entries(props)) cloned[key] = cloneTelemetryValue(value);
-	return cloned;
+//#region src/ports/account-read.ts
+var AccountReadError = class extends Data.TaggedError("AccountReadError") {};
+function accountReadErrorFromCapxul(operation, error, cause = error) {
+	return new AccountReadError({
+		operation,
+		publicCode: error.code,
+		publicError: error,
+		cause,
+		...error.details === void 0 ? {} : { details: error.details }
+	});
 }
-function cloneTelemetryValue(value) {
-	if (Array.isArray(value)) return value.map(cloneTelemetryValue);
-	if (value === null || typeof value !== "object") return value;
-	if (Object.getPrototypeOf(value) !== Object.prototype) return value;
-	const cloned = {};
-	for (const [key, nested] of Object.entries(value)) cloned[key] = cloneTelemetryValue(nested);
-	return cloned;
+var AccountReadPortTag = class extends Context.Service()("@capxul/sdk/ports/AccountReadPort") {};
+//#endregion
+//#region src/ports/smart-account.ts
+var SmartAccountError = class extends Data.TaggedError("SmartAccountError") {};
+function smartAccountErrorFromCapxul(operation, error, cause = error) {
+	return new SmartAccountError({
+		operation,
+		publicCode: error.code,
+		publicError: error,
+		cause,
+		...error.details === void 0 ? {} : { details: error.details }
+	});
 }
+var SmartAccountPortTag = class extends Context.Service()("@capxul/sdk/ports/SmartAccountPort") {};
 //#endregion
 //#region src/flows/identity.ts
 const IDENTITY_SLOT = {
@@ -8132,7 +8135,7 @@ function accountsDepsLayer(deps) {
 }
 const readAccountProgram = Effect.gen(function* () {
 	const deps = yield* AccountsDepsTag;
-	return yield* deps.accountReadPort.readBalance({ chainId: deps.chainId }).pipe(Effect.tapError((error) => Effect.promise(() => emitAccountBalanceFailed(deps.telemetry, error.publicError))), Effect.mapError((error) => error.publicError));
+	return yield* deps.accountReadPort.readBalance(copyInvocationObservation(deps.invocationSource, { chainId: deps.chainId })).pipe(Effect.tapError((error) => Effect.promise(() => emitAccountBalanceFailed(deps.telemetry, error.publicError))), Effect.mapError((error) => error.publicError));
 });
 function fundFromFaucetProgram(amount) {
 	return Effect.gen(function* () {
@@ -8162,7 +8165,11 @@ function makeAccountsMethods(deps) {
 				ok: false,
 				error: Errors.cancelled({ operation: "accounts.read" })
 			};
-			return toCapxulResult(readAccountProgram, accountsDepsLayer(deps));
+			const controls = deps.invocationControls?.(options) ?? options;
+			return runCapxulEffect(readAccountProgram.pipe(Effect.provide(accountsDepsLayer({
+				...deps,
+				...controls === void 0 ? {} : { invocationSource: controls }
+			}))), controls, "accounts.read", deps.runPromise);
 		},
 		async fund(amount, options) {
 			if (options?.signal?.aborted) return {
@@ -8927,7 +8934,7 @@ function emitCreationFunnelTail(telemetry, org, chainId) {
 function readTreasuryProgram(orgId) {
 	return Effect.gen(function* () {
 		const deps = yield* OrgDepsTag;
-		if (deps.orgPort !== void 0) return yield* deps.orgPort.readTreasury({ orgId }).pipe(Effect.mapError((error) => error.publicError));
+		if (deps.orgPort !== void 0) return yield* deps.orgPort.readTreasury(copyInvocationObservation(deps.invocationSource, { orgId })).pipe(Effect.mapError((error) => error.publicError));
 		return zeroTreasury(orgId);
 	});
 }
@@ -9011,7 +9018,7 @@ function detectAndAcceptPendingInvitationsProgram() {
 function listOrgsProgram() {
 	return Effect.gen(function* () {
 		const deps = yield* OrgDepsTag;
-		if (deps.orgPort !== void 0) return yield* deps.orgPort.listOrgs({}).pipe(Effect.mapError((error) => error.publicError));
+		if (deps.orgPort !== void 0) return yield* deps.orgPort.listOrgs(copyInvocationObservation(deps.invocationSource, {})).pipe(Effect.mapError((error) => error.publicError));
 		return [];
 	});
 }
@@ -9099,11 +9106,28 @@ function isRetryableOrganizationSetupFailure(error) {
 * state. The closed-over `orgId` is its only entity reference.
 */
 function makeOrgMethods(deps) {
-	const layer = orgDepsLayer({
+	const orgDeps = {
 		...deps.orgPort === void 0 ? {} : { orgPort: deps.orgPort },
 		...deps.chainId === void 0 ? {} : { chainId: deps.chainId },
 		...deps.telemetry === void 0 ? {} : { telemetry: deps.telemetry }
-	});
+	};
+	const layer = orgDepsLayer(orgDeps);
+	const treasury = (orgId, controls) => {
+		return runCapxulEffect(readTreasuryProgram(orgId).pipe(Effect.provide(orgDepsLayer({
+			...orgDeps,
+			...controls === void 0 ? {} : { invocationSource: controls }
+		}))), controls, "org.treasury", deps.runPromise);
+	};
+	const listOrganizations = (controls) => {
+		if (controls?.signal?.aborted) return Promise.resolve({
+			ok: false,
+			error: Errors.cancelled({ operation: "org.orgs" })
+		});
+		return runCapxulEffect(listOrgsProgram().pipe(Effect.provide(orgDepsLayer({
+			...orgDeps,
+			...controls === void 0 ? {} : { invocationSource: controls }
+		}))), controls, "org.orgs", deps.runPromise);
+	};
 	return {
 		createOrg(input, options) {
 			if (options?.signal?.aborted) return Promise.resolve({
@@ -9112,13 +9136,7 @@ function makeOrgMethods(deps) {
 			});
 			return toCapxulResult(createOrgProgram(input), layer);
 		},
-		orgs: Object.assign((options) => {
-			if (options?.signal?.aborted) return Promise.resolve({
-				ok: false,
-				error: Errors.cancelled({ operation: "org.orgs" })
-			});
-			return toCapxulResult(listOrgsProgram(), layer);
-		}, { detectAndAcceptPendingInvitations(options) {
+		orgs: Object.assign((options) => listOrganizations(deps.invocationControls?.(options) ?? options), { detectAndAcceptPendingInvitations(options) {
 			if (options?.signal?.aborted) return Promise.resolve({
 				ok: false,
 				error: Errors.cancelled({ operation: "orgs.detectAndAcceptPendingInvitations" })
@@ -9190,19 +9208,20 @@ function makeOrgMethods(deps) {
 						ok: false,
 						error: Errors.cancelled({ operation: "org.treasury" })
 					});
-					return toCapxulResult(readTreasuryProgram(orgId), layer);
+					return treasury(orgId, deps.invocationControls?.(options) ?? options);
 				},
 				account: { async get(options) {
 					if (options?.signal?.aborted) return {
 						ok: false,
 						error: Errors.cancelled({ operation: "org.account.get" })
 					};
-					const treasury = await toCapxulResult(readTreasuryProgram(orgId), layer);
-					if (!treasury.ok) return {
+					const controls = deps.invocationControls?.(options) ?? options;
+					const treasuryResult = await treasury(orgId, controls);
+					if (!treasuryResult.ok) return {
 						ok: false,
-						error: treasury.error
+						error: treasuryResult.error
 					};
-					const orgList = await toCapxulResult(listOrgsProgram(), layer);
+					const orgList = await listOrganizations(controls);
 					if (!orgList.ok) return {
 						ok: false,
 						error: orgList.error
@@ -9211,10 +9230,10 @@ function makeOrgMethods(deps) {
 					return {
 						ok: true,
 						value: {
-							id: treasury.value.id,
+							id: treasuryResult.value.id,
 							address: org?.safeAddress ?? null,
-							balance: treasury.value.balance,
-							available: treasury.value.available
+							balance: treasuryResult.value.balance,
+							available: treasuryResult.value.available
 						}
 					};
 				} },
@@ -9366,13 +9385,16 @@ function compareDecimal(first, second) {
 //#region src/surface/holdings.ts
 function makeHoldingsMethods(deps) {
 	const functions = deps.functions ?? holdingsContract;
-	const read = (operation, actor, signal, pick) => runIfActive(signal, operation, () => deps.convexCall.action(functions.current, actor?.kind === "organization" ? { actor: {
-		kind: "organization",
-		orgId: actor.organizationId
-	} } : {}).pipe(Effect.map(pick)));
+	const read = (operation, actor, options, pick) => {
+		const controls = deps.invocationControls?.(options) ?? options;
+		return runCapxulEffect(retryIdempotentRead(deps.convexCall.action(functions.current, copyInvocationObservation(controls, actor?.kind === "organization" ? { actor: {
+			kind: "organization",
+			orgId: actor.organizationId
+		} } : {})), operation, deps.telemetry, controls).pipe(Effect.map(pick), Effect.mapError((error) => error.publicError)), controls, operation, deps.runPromise);
+	};
 	return {
-		current: (input, options) => read("holdings.current", input?.actor, options?.signal, (snapshot) => snapshot),
-		primary: (input, options) => read("holdings.primary", input?.actor, options?.signal, (snapshot) => primaryHolding(snapshot.rows))
+		current: (input, options) => read("holdings.current", input?.actor, options, (snapshot) => snapshot),
+		primary: (input, options) => read("holdings.primary", input?.actor, options, (snapshot) => primaryHolding(snapshot.rows))
 	};
 }
 //#endregion
@@ -9383,78 +9405,6 @@ function detectAuthCacheAdapter() {
 	return new InMemoryAuthCacheAdapter();
 }
 //#endregion
-//#region src/telemetry/from-posthog.ts
-const PRODUCT_INVOCATION = Symbol("capxul.product-telemetry-invocation");
-/** @internal Bind paired emit/identify/reset work to one call-start snapshot. */
-function bindProductTelemetryInvocation(telemetry, source) {
-	return telemetry[PRODUCT_INVOCATION]?.(source) ?? telemetry;
-}
-/**
-* Drop props that must never cross to a host-owned external sink. Today that is
-* the `$exception` `details` blob: `captureException` serializes
-* `CapxulError.details` (e.g. `{ asset, available, required }`, `{ name }`,
-* `{ accountId }` — errors.ts) into it, and the shared redactor has no
-* `$exception` rule, so it is stripped here at the boundary (infra#1037). The
-* safe fields (error code, operation, failure_mode, the fixed leak-safe message,
-* stack frames) are preserved.
-*/
-function stripHostUnsafeProps(props) {
-	if (props === void 0) return void 0;
-	const { details: _details, ...safe } = props;
-	return safe;
-}
-/**
-* The subset of a posthog-js client the seam calls. `identify` / `group` /
-* `reset` are optional — a host that only wants event capture can omit them.
-*/
-/**
-* Adapt the host's already-initialized posthog-like client into a
-* `TelemetryPort` for the `telemetry` prop / input. This port SUPPLANTS the
-* SDK's no-op default telemetry sink (`production.ts` binds it via
-* `Layer.succeed`, not `compose` — there is no client-side success relay to
-* compose with); it is additive to Capxul's backend first-party record and
-* never owns the client.
-*/
-function postHogProductTelemetry(policy, fixedSnapshot) {
-	const telemetry = new PostHogTelemetryAdapter({
-		capture: (name, props, source) => {
-			const snapshot = readInvocationObservation(source) ?? fixedSnapshot ?? policy.snapshot();
-			if (!snapshot.active || policy.client === null || policy.client === void 0) return;
-			const event = stampTelemetryEnvelope({
-				name,
-				props
-			}, {
-				capxul_env: policy.capxulEnv,
-				producer: "sdk"
-			});
-			policy.deliver(() => policy.client.capture(name, {
-				...stripHostUnsafeProps(event.props),
-				...observationContextProps(snapshot.context)
-			}));
-		},
-		identify: (input) => {
-			if (!(fixedSnapshot ?? policy.snapshot()).active || policy.client?.identify === void 0) return;
-			policy.deliver(() => policy.client.identify(input.distinctId, {
-				...input.traits,
-				...input.properties
-			}));
-		},
-		group: (input) => {
-			if (!(fixedSnapshot ?? policy.snapshot()).active || policy.client?.group === void 0) return;
-			policy.deliver(() => policy.client.group(input.groupType, input.groupKey, input.properties === void 0 ? void 0 : { ...input.properties }));
-		},
-		reset: () => {
-			if (!(fixedSnapshot ?? policy.snapshot()).active || policy.client?.reset === void 0) return;
-			policy.deliver(() => policy.client.reset());
-		}
-	});
-	Object.defineProperty(telemetry, PRODUCT_INVOCATION, {
-		enumerable: false,
-		value: (source) => postHogProductTelemetry(policy, readInvocationObservation(source) ?? fixedSnapshot ?? policy.snapshot())
-	});
-	return telemetry;
-}
-//#endregion
 //#region src/telemetry/identity-product.ts
 const NONE = null;
 const IDENTITY_EVENT_TAG_SET = new Set(IDENTITY_EVENT_TAGS);
@@ -9651,6 +9601,8 @@ function assembleCapxulClient(input) {
 		accountReadPort: input.ports.accountRead,
 		profileMethods: financialOps.me,
 		convexCall: input.ports.convexCall,
+		runPromise: effectRunner.runPromise,
+		invocationControls: (controls) => withHostObservationControls(observation.hostObservationSnapshot, controls),
 		...input.signer === void 0 ? {} : { signer: input.signer }
 	});
 	kickProvisioning = accountBundle.kickProvisioning;
@@ -9688,16 +9640,25 @@ function assembleCapxulClient(input) {
 	});
 	const system = makeSystemMethods({ convexCall: input.ports.convexCall });
 	const media = makeMediaMethods({ convexCall: input.ports.convexCall });
-	const holdings = makeHoldingsMethods({ convexCall: input.ports.convexCall });
+	const holdings = makeHoldingsMethods({
+		convexCall: input.ports.convexCall,
+		telemetry: input.ports.telemetry,
+		runPromise: effectRunner.runPromise,
+		invocationControls: (controls) => withHostObservationControls(observation.hostObservationSnapshot, controls)
+	});
 	const accounts = makeAccountsMethods({
 		accountReadPort: input.ports.accountRead,
 		chainId: input.bootstrap.chainId,
-		telemetry: input.ports.telemetry
+		telemetry: input.ports.telemetry,
+		runPromise: effectRunner.runPromise,
+		invocationControls: (controls) => withHostObservationControls(observation.hostObservationSnapshot, controls)
 	});
 	const orgMethods = makeOrgMethods({
 		actor,
 		chainId: input.bootstrap.chainId,
 		telemetry: input.ports.telemetry,
+		runPromise: effectRunner.runPromise,
+		invocationControls: (controls) => withHostObservationControls(observation.hostObservationSnapshot, controls),
 		requestKeyScope: `${input.bootstrap.convexUrl}:${String(input.bootstrap.chainId)}`,
 		...selectedOrgPort === void 0 ? {} : { orgPort: selectedOrgPort },
 		convexCall: input.ports.convexCall,
@@ -9834,11 +9795,7 @@ function transitionError(record) {
 }
 function withHostObservation(actor, snapshot) {
 	if (snapshot === void 0) return actor;
-	const controls = (input) => {
-		const captured = snapshot();
-		const copied = { ...input };
-		return captured === void 0 ? copied : attachInvocationObservation(copied, captured);
-	};
+	const controls = (input) => withHostObservationControls(snapshot, input);
 	return {
 		...actor,
 		ask: (event, input) => actor.ask(event, controls(input)),
@@ -9846,5 +9803,10 @@ function withHostObservation(actor, snapshot) {
 		restoreAuthSession: (session, input) => actor.restoreAuthSession(session, controls(input))
 	};
 }
+function withHostObservationControls(snapshot, input) {
+	const copied = { ...input };
+	const captured = snapshot?.();
+	return captured === void 0 ? copied : attachInvocationObservation(copied, captured);
+}
 //#endregion
-export { deriveCapxulSafeAddress as $, postHogFailureObservation as A, injectedWalletSigner as B, fingerprintPaymentIntent as C, failureEvidenceProps as D, failureDetail as E, isSettingUpLifecycle as F, PAYMENT_DIRECTIONS as G, OBSERVATION_CONTEXT_HEADER as H, formatTraceparent as I, BootstrapEnvelope as J, PAYMENT_STATUSES as K, copyInvocationObservation as L, captureExceptionSync as M, version as N, observationContextProps as O, fromWei as P, BASE_SEPOLIA_CHAIN_ID as Q, readInvocationObservation as R, AuthClientPortTag as S, CAPXUL_SDK_EXPECTED_OUTCOME_EVENT as T, encodeObservationContextHeader as U, signerFailure as V, sanitizeObservationContext as W, CAPXUL_PAYMENTS_V2_ADDRESS as X, EngineeringTelemetryBootstrapPolicy as Y, normalizeBindingEmail as Z, ClockPortTag as _, TelemetryPortTag as a, authClientPortFromPromiseAdapter as b, smartAccountErrorFromCapxul as c, wireChainId as d, destination as et, IdentityPortTag as f, ClockError as g, convexCallErrorFromCapxul as h, PostHogTelemetryLayer as i, captureException as j, observeFailedResult as k, AccountReadPortTag as l, ConvexCallPortTag as m, postHogProductTelemetry as n, isRestoring as nt, redactTelemetryEvent as o, identityErrorFromCapxul as p, CAPXUL_FUNCTIONS as q, detectAuthCacheAdapter as r, SmartAccountPortTag as s, assembleCapxulClient as t, isClaimed as tt, accountReadErrorFromCapxul as u, BootstrapPortTag as v, toWei as w, AuthClientError as x, bootstrapErrorFromCapxul as y, causeChain as z };
+export { sanitizeObservationContext as $, observationContextProps as A, fromWei as B, AuthClientError as C, CAPXUL_SDK_EXPECTED_OUTCOME_EVENT as D, toWei as E, normalizeExceptionErrorKind as F, isSignerNotReadySignal as G, formatTraceparent as H, normalizeExceptionOperation as I, resolveFailureMode as J, openfortSignerNotReadyCode as K, projectSdkException as L, postHogFailureObservation as M, EXCEPTION_MESSAGE as N, failureDetail as O, SDK_VERSION as P, encodeObservationContextHeader as Q, safeExceptionLabel as R, authClientPortFromPromiseAdapter as S, fingerprintPaymentIntent as T, causeChain as U, isSettingUpLifecycle as V, injectedWalletSigner as W, readInvocationObservation as X, copyInvocationObservation as Y, OBSERVATION_CONTEXT_HEADER as Z, convexCallErrorFromCapxul as _, AccountReadPortTag as a, CAPXUL_PAYMENTS_V2_ADDRESS as at, BootstrapPortTag as b, redactTelemetryEvent as c, deriveCapxulSafeAddress as ct, retryIdempotentRead as d, isRestoring as dt, PAYMENT_DIRECTIONS as et, PRODUCT_INVOCATION as f, ConvexCallPortTag as g, identityErrorFromCapxul as h, smartAccountErrorFromCapxul as i, EngineeringTelemetryBootstrapPolicy as it, observeFailedResult as j, failureEvidenceProps as k, redactTelemetryProps as l, destination as lt, IdentityPortTag as m, detectAuthCacheAdapter as n, CAPXUL_FUNCTIONS as nt, accountReadErrorFromCapxul as o, normalizeBindingEmail as ot, wireChainId as p, signerFailure as q, SmartAccountPortTag as r, BootstrapEnvelope as rt, TelemetryPortTag as s, BASE_SEPOLIA_CHAIN_ID as st, assembleCapxulClient as t, PAYMENT_STATUSES as tt, stampTelemetryEnvelope as u, isClaimed as ut, ClockError as v, AuthClientPortTag as w, bootstrapErrorFromCapxul as x, ClockPortTag as y, version as z };