@capxul/sdk 3.0.0 → 3.1.0

package/dist/{OAuthBearerAuthClient-GkHnGqNi.d.mts → OAuthBearerAuthClient-BxTiv8dg.d.mts}

@@ -1,4 +1,4 @@
-import { _ as ClockPort, v as AuthClientPort } from "./signer-HY5Ju8xs.mjs";
+import { _ as ClockPort, v as AuthClientPort } from "./signer-BpjdawiY.mjs";
 //#region src/adapters/auth-client/OAuthBearerAuthClient.d.ts
 interface OAuthBearerAuthClientInput {
   /** The exchange endpoint: `{authBaseUrl}/api/auth/agent/exchange`. */

package/dist/{OAuthBearerAuthClient-BZ6tXt4m.mjs → OAuthBearerAuthClient-DfS4QOg7.mjs}

@@ -1,4 +1,4 @@
-import { F as toEmail, I as toEpochMs, K as toSessionToken, L as toEpochSeconds, R as toJwtToken, Z as Errors, c as ClockError, k as toAuthUserId, l as ClockPortTag, t as readClockNow, u as authClientPortFromPromiseAdapter } from "./clock-0c5NM-TY.mjs";
+import { F as toEmail, I as toEpochMs, K as toSessionToken, L as toEpochSeconds, R as toJwtToken, Z as Errors, c as ClockError, k as toAuthUserId, l as ClockPortTag, t as readClockNow, u as authClientPortFromPromiseAdapter } from "./clock-m_aHLaNm.mjs";
 import { Effect, Layer } from "effect";
 //#region src/adapters/clock/SystemClockAdapter.ts
 var SystemClockAdapter = class {

package/dist/{clock-0c5NM-TY.mjs → clock-m_aHLaNm.mjs}

@@ -1,5 +1,41 @@
 import { concat, encodeAbiParameters, encodeFunctionData, encodePacked, getContractAddress, keccak256, padHex, stringToHex, toBytes, toEventSelector, toFunctionSelector, toFunctionSignature } from "viem";
 import { Context, Data, Effect, Layer, Result } from "effect";
+//#region ../errors/src/secret-material.ts
+const SENSITIVE_MATERIAL_PATTERNS = [
+	/(?:^|[^a-fA-F0-9])(?<!0[xX])[a-fA-F0-9]{64}(?:$|[^a-fA-F0-9])/u,
+	/eyJ[A-Za-z0-9_-]*\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+/u,
+	/(?:(?:sk|pk|rk)_(?:live|test)|(?:phc|phx|ghp|gho|ghu|ghs|ghr|whsec)_|github_pat_|xox[baprs]-|AKIA[0-9A-Z]{16}|AIza)[A-Za-z0-9_-]*/iu,
+	/\bBearer\s+[^\s,;]+/iu,
+	/https?:\/\/[^\s"']+?\/v[0-9]\/[A-Za-z0-9_-]{16,}/iu,
+	/\b(?:api[ _-]?key|access[ _-]?token|token|secret|password|passphrase|private[ _-]?key|authorization|cookie|signature|request[ _-]?body|credential|otp|one[ _-]?time[ _-]?(?:password|code)|verification[ _-]?code)\b\s*[:=]\s*(?:"[^"]*"|'[^']*'|[^\s,;&]+)/iu
+];
+const MASKS = [
+	[/\bBearer\s+[^\s,;]+/giu, "Bearer [REDACTED]"],
+	[/\beyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\b/gu, "[REDACTED]"],
+	[/(^|[^a-fA-F0-9])(?<!0[xX])[a-fA-F0-9]{64}(?=$|[^a-fA-F0-9])/gu, "$1[REDACTED]"],
+	[/(?:(?:sk|pk|rk)_(?:live|test)|(?:phc|phx|ghp|gho|ghu|ghs|ghr|whsec)_|github_pat_|xox[baprs]-|AKIA[0-9A-Z]{16}|AIza)[A-Za-z0-9_-]*/giu, "[REDACTED]"],
+	[/(https?:\/\/[^\s"']+?\/v[0-9]\/)[A-Za-z0-9_-]{16,}/giu, "$1[REDACTED]"],
+	[/\b(api[ _-]?key|access[ _-]?token|token|secret|password|passphrase|private[ _-]?key|authorization|cookie|signature|request[ _-]?body|credential|otp|one[ _-]?time[ _-]?(?:password|code)|verification[ _-]?code)\b\s*[:=]\s*(?:"[^"]*"|'[^']*'|[^\s,;&]+)/giu, "$1=[REDACTED]"]
+];
+/**
+* Reject: does the value carry any known secret material? Best effort — callers
+* drop the whole value on a match; a false negative is a leak, a false positive
+* merely omits an observation field.
+*/
+function containsSensitiveMaterial(value) {
+	return SENSITIVE_MATERIAL_PATTERNS.some((pattern) => pattern.test(value));
+}
+/**
+* Mask: return the value with every known secret rewritten to `[REDACTED]`,
+* preserving surrounding text. Used where a value must still be shown (log
+* lines, provider messages, PostHog rows) but must not carry live credentials.
+*/
+function redactSecrets(value) {
+	let text = value;
+	for (const [pattern, replacement] of MASKS) text = text.replace(pattern, replacement);
+	return text;
+}
+//#endregion
 //#region ../errors/src/chain-cause.ts
 /**
 * Why an operation failed — the one flat vocabulary. The first four are the
@@ -22,6 +58,9 @@ const FAILURE_MODES = [
 	"insufficient-allowance",
 	"rejected",
 	"unauthorized",
+	"forbidden",
+	"bad-request",
+	"method-unsupported",
 	"unknown"
 ];
 function isFailureMode(value) {
@@ -38,6 +77,33 @@ const CHAIN_UPSTREAMS = [
 function isChainUpstream(value) {
 	return typeof value === "string" && CHAIN_UPSTREAMS.includes(value);
 }
+/**
+* The response headers that name a refusal or let provider support find the
+* request. Nothing else crosses: a header can carry a session or a key.
+*/
+const RESPONSE_HEADER_ALLOWLIST = [
+	"retry-after",
+	"www-authenticate",
+	"content-type",
+	"x-request-id",
+	"cf-ray",
+	"x-ratelimit-remaining",
+	"x-ratelimit-reset",
+	"server"
+];
+const RESPONSE_HEADER_VALUE_MAX = 128;
+/**
+* The allow-listed headers of one answer, masked and bounded. `read` is
+* `Headers.get` or a lookup into a decoded record. Empty when none is present.
+*/
+function boundedResponseHeaders(read) {
+	const headers = {};
+	for (const name of RESPONSE_HEADER_ALLOWLIST) {
+		const value = read(name);
+		if (typeof value === "string" && value.length > 0) headers[name] = boundedEvidence(value, RESPONSE_HEADER_VALUE_MAX);
+	}
+	return headers;
+}
 const PROVIDER_MESSAGE_MAX = 300;
 const METHOD_MAX = 64;
 const REVERT_NAME_MAX = 64;
@@ -45,19 +111,9 @@ const REVERT_ARG_KEY_MAX = 32;
 const REVERT_ARG_VALUE_MAX = 128;
 const REVERT_ARGS_MAX = 8;
 const SELECTOR_RE = /^0x(?:[0-9a-fA-F]{8})?$/u;
-const MASKS = [
-	[/\bBearer\s+[^\s,;]+/giu, "Bearer [REDACTED]"],
-	[/\beyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\b/gu, "[REDACTED]"],
-	[/\b0x[a-fA-F0-9]{40,}\b/gu, "[REDACTED]"],
-	[/(^|[^a-fA-F0-9])[a-fA-F0-9]{64}(?=$|[^a-fA-F0-9])/gu, "$1[REDACTED]"],
-	[/(?:(?:sk|pk|rk)_(?:live|test)|(?:phc|phx|ghp|gho|ghu|ghs|ghr|whsec)_|github_pat_|xox[baprs]-|AKIA[0-9A-Z]{16}|AIza)[A-Za-z0-9_-]*/giu, "[REDACTED]"],
-	[/(https?:\/\/[^\s"']+?\/v[0-9]\/)[A-Za-z0-9_-]{16,}/giu, "$1[REDACTED]"],
-	[/\b(api[ _-]?key|access[ _-]?token|token|secret|password|passphrase|private[ _-]?key|authorization|cookie|signature|credential|otp)\b\s*[:=]\s*(?:"[^"]*"|'[^']*'|[^\s,;&]+)/giu, "$1=[REDACTED]"]
-];
 /** Mask credential-shaped content, then cap the length. Total on any string. */
 function boundedEvidence(value, max) {
-	let text = value;
-	for (const [pattern, replacement] of MASKS) text = text.replace(pattern, replacement);
+	const text = redactSecrets(value);
 	return text.length <= max ? text : text.slice(0, max);
 }
 function isRecord(value) {
@@ -99,8 +155,36 @@ function decodeChainCause(value) {
 	const revert = decodeRevert(value.revert);
 	if (revert !== null) cause.revert = revert;
 	if (typeof value.providerMessage === "string") cause.providerMessage = boundedEvidence(value.providerMessage, PROVIDER_MESSAGE_MAX);
+	const attempts = decodeAttempts(value.attempts);
+	if (attempts !== null) cause.attempts = attempts;
+	if (isRecord(value.responseHeaders)) {
+		const raw = value.responseHeaders;
+		const headers = boundedResponseHeaders((name) => {
+			const header = raw[name];
+			return typeof header === "string" ? header : null;
+		});
+		if (Object.keys(headers).length > 0) cause.responseHeaders = headers;
+	}
 	return cause;
 }
+/** The attempt sequence, bounded. A malformed entry drops the sequence, never the cause. */
+function decodeAttempts(value) {
+	if (!Array.isArray(value)) return null;
+	const attempts = [];
+	for (const entry of value.slice(0, 5)) {
+		if (!isRecord(entry) || !isChainUpstream(entry.upstream) || !isFailureMode(entry.mode)) return null;
+		const duration = entry.durationMs;
+		if (typeof duration !== "number" || !Number.isFinite(duration) || duration < 0) return null;
+		attempts.push({
+			upstream: entry.upstream,
+			mode: entry.mode,
+			...typeof entry.httpStatus === "number" && Number.isInteger(entry.httpStatus) ? { httpStatus: entry.httpStatus } : {},
+			...typeof entry.rpcCode === "number" && Number.isInteger(entry.rpcCode) ? { rpcCode: entry.rpcCode } : {},
+			durationMs: Math.round(duration)
+		});
+	}
+	return attempts.length === 0 ? null : attempts;
+}
 /**
 * The cause as flat PostHog properties. Same keys from every producer, so one
 * filter (`failure_mode = 'rate-limited'`) finds the gateway's, the backend's,
@@ -119,7 +203,15 @@ function chainCauseProperties(chain) {
 			chain_revert_selector: chain.revert.selector,
 			chain_revert_args: chain.revert.args
 		},
-		...chain.providerMessage === void 0 ? {} : { chain_provider_message: chain.providerMessage }
+		...chain.providerMessage === void 0 ? {} : { chain_provider_message: chain.providerMessage },
+		...chain.attempts === void 0 ? {} : { chain_attempts: chain.attempts.map((attempt) => ({
+			upstream: attempt.upstream,
+			failure_mode: attempt.mode,
+			...attempt.httpStatus === void 0 ? {} : { http_status: attempt.httpStatus },
+			...attempt.rpcCode === void 0 ? {} : { rpc_code: attempt.rpcCode },
+			duration_ms: attempt.durationMs
+		})) },
+		...chain.responseHeaders === void 0 ? {} : { chain_response_headers: chain.responseHeaders }
 	};
 }
 /**
@@ -175,6 +267,18 @@ function revertSummaryText(revert) {
 	return `${revert.name}(${args})`;
 }
 /**
+* The evidence behind the one word, for an issue name: ` (HTTP 403)` or
+* ` (JSON-RPC -32000)`. Empty when the cause carries neither. The status
+* names the provider's front door and the code names the node's verdict;
+* `forbidden` alone made an operator open the issue to learn it was a 403.
+*/
+function chainEvidenceLabel(chain) {
+	if (chain === void 0) return "";
+	if (chain.httpStatus !== void 0 && chain.httpStatus !== 200) return ` (HTTP ${String(chain.httpStatus)})`;
+	if (chain.rpcCode !== void 0) return ` (JSON-RPC ${String(chain.rpcCode)})`;
+	return "";
+}
+/**
 * The error-tracking fingerprint for a failure: the code, the one-word cause,
 * and the operation. PostHog groups `$exception` rows by this value, so one
 * issue is one cause at one operation instead of every provider failure in
@@ -1753,4 +1857,4 @@ async function readClockNow(clock) {
 	}
 }
 //#endregion
-export { CHAIN_UPSTREAMS as $, toBudgetId as A, toOrgId as B, ZERO_BYTES32 as C, toAllowedOrigin as D, toAddress as E, toEmail as F, toRoleKey as G, toPayrollGroupId as H, toEpochMs as I, CAPXUL_ERROR_CODES as J, toSessionToken as K, toEpochSeconds as L, toCountryCode as M, toCurrencyCode as N, toAppId as O, toDurationMs as P, isCapxulError as Q, toJwtToken as R, WEI_RE as S, toAccountId as T, toPayrollRunId as U, toPartyId as V, toPublishableKey as W, EXPECTED_OPERATION_OUTCOMES as X, CapxulError as Y, Errors as Z, deriveCapxulSafeAddress as _, parseCachedJwt as a, revertSummaryText as at, EVM_ADDRESS_RE as b, ClockError as c, AuthClientError as d, FAILURE_MODES as et, AuthClientPortTag as f, BASE_SEPOLIA_CHAIN_ID as g, normalizeBindingEmail as h, parseAuthSession as i, isFailureMode as it, toChainId as j, toAuthUserId as k, ClockPortTag as l, CAPXUL_PAYMENTS_V2_ADDRESS as m, InMemoryAuthCacheAdapter as n, decodeChainCause as nt, AuthCacheError as o, orgRoleKeyForLabel as p, decodeConvexError as q, BrowserAuthCacheAdapter as r, failureFingerprint as rt, AuthCachePortTag as s, readClockNow as t, chainCauseProperties as tt, authClientPortFromPromiseAdapter as u, APP_ID_RE as v, currencySymbolFor as w, SUPPORTED_CURRENCY_CODES as x, BYTES32_RE as y, toKycTier as z };
+export { CHAIN_UPSTREAMS as $, toBudgetId as A, toOrgId as B, ZERO_BYTES32 as C, toAllowedOrigin as D, toAddress as E, toEmail as F, toRoleKey as G, toPayrollGroupId as H, toEpochMs as I, CAPXUL_ERROR_CODES as J, toSessionToken as K, toEpochSeconds as L, toCountryCode as M, toCurrencyCode as N, toAppId as O, toDurationMs as P, isCapxulError as Q, toJwtToken as R, WEI_RE as S, toAccountId as T, toPayrollRunId as U, toPartyId as V, toPublishableKey as W, EXPECTED_OPERATION_OUTCOMES as X, CapxulError as Y, Errors as Z, deriveCapxulSafeAddress as _, parseCachedJwt as a, failureFingerprint as at, EVM_ADDRESS_RE as b, ClockError as c, revertSummaryText as ct, AuthClientError as d, FAILURE_MODES as et, AuthClientPortTag as f, BASE_SEPOLIA_CHAIN_ID as g, normalizeBindingEmail as h, parseAuthSession as i, decodeChainCause as it, toChainId as j, toAuthUserId as k, ClockPortTag as l, containsSensitiveMaterial as lt, CAPXUL_PAYMENTS_V2_ADDRESS as m, InMemoryAuthCacheAdapter as n, chainCauseProperties as nt, AuthCacheError as o, isChainUpstream as ot, orgRoleKeyForLabel as p, decodeConvexError as q, BrowserAuthCacheAdapter as r, chainEvidenceLabel as rt, AuthCachePortTag as s, isFailureMode as st, readClockNow as t, boundedResponseHeaders as tt, authClientPortFromPromiseAdapter as u, redactSecrets as ut, APP_ID_RE as v, currencySymbolFor as w, SUPPORTED_CURRENCY_CODES as x, BYTES32_RE as y, toKycTier as z };

package/dist/{create-capxul-client-DwINzpXZ.mjs → create-capxul-client-dk67qjlK.mjs}

@@ -1,4 +1,4 @@
-import { $ as CHAIN_UPSTREAMS, A as toBudgetId, B as toOrgId, C as ZERO_BYTES32, E as toAddress, F as toEmail, G as toRoleKey, H as toPayrollGroupId, J as CAPXUL_ERROR_CODES, M as toCountryCode, N as toCurrencyCode, Q as isCapxulError, S as WEI_RE, T as toAccountId, U as toPayrollRunId, V as toPartyId, X as EXPECTED_OPERATION_OUTCOMES, Y as CapxulError, Z as Errors, _ as deriveCapxulSafeAddress, at as revertSummaryText, b as EVM_ADDRESS_RE$1, et as FAILURE_MODES$1, it as isFailureMode, j as toChainId, k as toAuthUserId, n as InMemoryAuthCacheAdapter, nt as decodeChainCause, p as orgRoleKeyForLabel, r as BrowserAuthCacheAdapter, rt as failureFingerprint, tt as chainCauseProperties, v as APP_ID_RE, x as SUPPORTED_CURRENCY_CODES, y as BYTES32_RE } from "./clock-0c5NM-TY.mjs";
+import { $ as CHAIN_UPSTREAMS, A as toBudgetId, B as toOrgId, C as ZERO_BYTES32, E as toAddress, F as toEmail, G as toRoleKey, H as toPayrollGroupId, J as CAPXUL_ERROR_CODES, M as toCountryCode, N as toCurrencyCode, Q as isCapxulError, S as WEI_RE, T as toAccountId, U as toPayrollRunId, V as toPartyId, X as EXPECTED_OPERATION_OUTCOMES, Y as CapxulError, Z as Errors, _ as deriveCapxulSafeAddress, at as failureFingerprint, b as EVM_ADDRESS_RE$1, ct as revertSummaryText, et as FAILURE_MODES$1, it as decodeChainCause, j as toChainId, k as toAuthUserId, lt as containsSensitiveMaterial, n as InMemoryAuthCacheAdapter, nt as chainCauseProperties, ot as isChainUpstream, p as orgRoleKeyForLabel, r as BrowserAuthCacheAdapter, rt as chainEvidenceLabel, st as isFailureMode, tt as boundedResponseHeaders, ut as redactSecrets, v as APP_ID_RE, x as SUPPORTED_CURRENCY_CODES, y as BYTES32_RE } from "./clock-m_aHLaNm.mjs";
 import { formatUnits, keccak256, parseUnits, recoverAddress, toBytes } from "viem";
 import { Context, Data, Deferred, Duration, Effect, Exit, Fiber, Layer, Queue, Ref, Result, Schema, SchemaGetter, Scope } from "effect";
 import { makeFunctionReference } from "convex/server";
@@ -19,7 +19,10 @@ const DEFINITIVE_PROVIDER_MODES = /* @__PURE__ */ new Set([
 	"insufficient-balance",
 	"insufficient-allowance",
 	"rejected",
-	"unauthorized"
+	"unauthorized",
+	"forbidden",
+	"bad-request",
+	"method-unsupported"
 ]);
 const isRetryable = (failure) => {
 	if (failure.code === "CANCELLED" || failure.code === "SIGNER_REJECTED") return true;
@@ -2018,33 +2021,6 @@ Schema.Struct({
 @media (max-width:540px){.capxul-doc{padding:1.75rem 1.25rem}.capxul-doc .doc-parties{grid-template-columns:1fr}}
 `.trim();
 //#endregion
-//#region ../wire/src/secret-material.ts
-const SENSITIVE_MATERIAL_PATTERNS = [
-	/0x[a-fA-F0-9]{40,}/u,
-	/(?:^|[^a-fA-F0-9])[a-fA-F0-9]{64}(?:$|[^a-fA-F0-9])/u,
-	/eyJ[A-Za-z0-9_-]*\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+/u,
-	/(?:(?:sk|pk|rk)_(?:live|test)|(?:phc|phx|ghp|gho|ghu|ghs|ghr|whsec)_|github_pat_|xox[baprs]-|AKIA[0-9A-Z]{16}|AIza)[A-Za-z0-9_-]*/iu
-];
-const RAW_PRIVATE_KEY_MASK = /(^|[^a-fA-F0-9])[a-fA-F0-9]{64}(?=$|[^a-fA-F0-9])/gu;
-const KNOWN_CREDENTIAL_MASK = /(?:(?:sk|pk|rk)_(?:live|test)|(?:phc|phx|ghp|gho|ghu|ghs|ghr|whsec)_|github_pat_|xox[baprs]-|AKIA[0-9A-Z]{16}|AIza)[A-Za-z0-9_-]*/giu;
-const LABELLED_SECRET_MASK = /\b(api[ _-]?key|access[ _-]?token|token|secret|password|passphrase|private[ _-]?key|authorization|cookie|signature|request[ _-]?body|credential|otp|one[ _-]?time[ _-]?(?:password|code)|verification[ _-]?code)\b\s*[:=]\s*(?:"[^"]*"|'[^']*'|[^\s,;]+)/giu;
-/**
-* Reject: does the value carry any known secret material? Best effort — callers
-* drop the whole value on a match; a false negative is a leak, a false positive
-* merely omits an observation field.
-*/
-function containsSensitiveMaterial(value) {
-	return SENSITIVE_MATERIAL_PATTERNS.some((pattern) => pattern.test(value));
-}
-/**
-* Mask: return the value with every known secret rewritten to `[REDACTED]`,
-* preserving surrounding text. Used where a value must still be shown (log
-* lines, issue bodies) but must not carry live credentials.
-*/
-function redactSecrets(value) {
-	return value.replace(/\bBearer\s+[^\s,;]+/giu, "Bearer [REDACTED]").replace(/\beyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\b/gu, "[REDACTED]").replace(/\b0x[a-fA-F0-9]{40,}\b/gu, "[REDACTED]").replace(RAW_PRIVATE_KEY_MASK, "$1[REDACTED]").replace(KNOWN_CREDENTIAL_MASK, "[REDACTED]").replace(LABELLED_SECRET_MASK, (_match, label) => `${label}=[REDACTED]`);
-}
-//#endregion
 //#region ../wire/src/observation-context.ts
 /** Single bounded HTTP carrier used before a Convex action envelope exists. */
 const OBSERVATION_CONTEXT_HEADER = "x-capxul-observation-context";
@@ -3614,7 +3590,7 @@ const moneyExecutionContract = {
 };
 //#endregion
 //#region package.json
-var version = "3.0.0";
+var version = "3.1.0";
 //#endregion
 //#region src/telemetry/exception-projection.ts
 /** Fixed fallback for failures that have no safe message. */
@@ -3626,6 +3602,10 @@ function projectSdkException(input) {
 	const errorKind = normalizeExceptionErrorKind(input.errorKind);
 	const mode = isFailureMode(input.failureMode) ? input.failureMode : void 0;
 	const message = input.message ?? "Capxul SDK operation failed";
+	const evidence = mode === void 0 ? "" : chainEvidenceLabel({
+		httpStatus: input.chainHttpStatus,
+		rpcCode: input.chainRpcCode
+	});
 	const where = input.chainUpstream === void 0 ? "" : ` on ${input.chainUpstream}${input.chainMethod === void 0 ? "" : ` during ${input.chainMethod}`}`;
 	return {
 		...input.properties,
@@ -3637,13 +3617,19 @@ function projectSdkException(input) {
 		$exception_message: message,
 		$exception_level: "error",
 		$exception_fingerprint: failureFingerprint(errorKind, mode, operation),
-		$issue_name: `${errorKind}${mode === void 0 ? "" : `: ${mode}`}${where} (${operation})`,
+		$issue_name: `${errorKind}${mode === void 0 ? "" : `: ${mode}`}${evidence}${where} (${operation})`,
 		$issue_description: input.issueDescription ?? message,
 		$exception_list: input.exceptionList
 	};
 }
+/**
+* `:` and `/` are allowed because this also accepts a `provider_operation`
+* fallback, and a Convex function names itself `dir/file:function`. Kept byte-
+* equal to the backend's own `normalizeOperation`: when the two disagree, one
+* side silently rewrites the operation to `unknown` and the issue loses its name.
+*/
 function normalizeExceptionOperation(value) {
-	return typeof value === "string" && /^[A-Za-z0-9_][A-Za-z0-9_.-]{0,255}$/u.test(value) ? value : "unknown";
+	return typeof value === "string" && /^[A-Za-z0-9_][A-Za-z0-9_.:/-]{0,255}$/u.test(value) ? value : "unknown";
 }
 function normalizeExceptionErrorKind(value) {
 	return safeExceptionLabel(value) ?? "UNKNOWN";
@@ -3908,6 +3894,8 @@ function projectFailureException(failure, properties) {
 		issueDescription: issueDescription(failure, message),
 		...failure.detail?.chain_upstream === void 0 ? {} : { chainUpstream: failure.detail.chain_upstream },
 		...failure.detail?.chain_method === void 0 ? {} : { chainMethod: failure.detail.chain_method },
+		...failure.detail?.chain_http_status === void 0 ? {} : { chainHttpStatus: failure.detail.chain_http_status },
+		...failure.detail?.chain_rpc_code === void 0 ? {} : { chainRpcCode: failure.detail.chain_rpc_code },
 		exceptionList: [{
 			type: failure.errorKind,
 			value: message,
@@ -3932,8 +3920,8 @@ function projectFailureException(failure, properties) {
 	});
 }
 /**
-* The decoded revert leads the description: the provider's own message masks
-* the raw revert data (`reason: [REDACTED]`), and the name plus arguments
+* The decoded revert leads the description: the provider's own message carries
+* the raw revert data (`reason: 0x…`), and the name plus arguments
 * (`Error(message=GS205)`) is what tells one revert from another.
 */
 function issueDescription(failure, message) {
@@ -4093,13 +4081,13 @@ function observationError(cause) {
 function sanitizeChainDetail(source, detail) {
 	for (const key of [
 		"provider",
-		"provider_operation",
 		"failure_mode",
 		"reason"
 	]) {
 		const value = source[key];
 		if (typeof value === "string" && ENUMERATED_DETAIL_RE.test(value)) detail[key] = value;
 	}
+	sanitizeProviderOperation(source, detail);
 	sanitizeProviderErrorDetail(source, detail);
 	const status = source.http_status;
 	if (typeof status === "number" && Number.isInteger(status) && status >= 100 && status <= 599) detail.http_status = status;
@@ -4128,6 +4116,43 @@ function sanitizeChainDetail(source, detail) {
 	}
 	const providerMessage = evidenceText(source.chain_provider_message);
 	if (providerMessage !== void 0) detail.chain_provider_message = providerMessage;
+	sanitizeChainAttempts(source, detail);
+}
+/** One flat attempt entry, or undefined when a field is not what the vocabulary allows. */
+function sanitizeChainAttempt(entry) {
+	if (!isPlainObject(entry)) return void 0;
+	const duration = entry.duration_ms;
+	if (!isChainUpstream(entry.upstream) || !isFailureMode(entry.failure_mode) || typeof duration !== "number" || !Number.isFinite(duration) || duration < 0) return;
+	return {
+		upstream: entry.upstream,
+		failure_mode: entry.failure_mode,
+		...typeof entry.http_status === "number" && Number.isInteger(entry.http_status) ? { http_status: entry.http_status } : {},
+		...typeof entry.rpc_code === "number" && Number.isInteger(entry.rpc_code) ? { rpc_code: entry.rpc_code } : {},
+		duration_ms: Math.round(duration)
+	};
+}
+/**
+* The attempt sequence and the refusing upstream's headers (#1818), same
+* bounds as the backend; a malformed entry is dropped, never invented.
+*/
+function sanitizeChainAttempts(source, detail) {
+	if (Array.isArray(source.chain_attempts)) {
+		const attempts = source.chain_attempts.slice(0, 5).map(sanitizeChainAttempt);
+		if (attempts.length > 0 && attempts.every((attempt) => attempt !== void 0)) detail.chain_attempts = attempts;
+	}
+	if (isPlainObject(source.chain_response_headers)) {
+		const raw = source.chain_response_headers;
+		const headers = boundedResponseHeaders((name) => {
+			const value = raw[name];
+			return typeof value === "string" ? value : null;
+		});
+		if (Object.keys(headers).length > 0) detail.chain_response_headers = headers;
+	}
+}
+/** Its own check because a provider operation carries that provider's separators. */
+function sanitizeProviderOperation(source, detail) {
+	const value = source.provider_operation;
+	if (typeof value === "string" && PROVIDER_OPERATION_RE.test(value)) detail.provider_operation = value;
 }
 function sanitizeProviderErrorDetail(source, detail) {
 	if (source.provider_error_source !== "openfort") return;
@@ -4173,14 +4198,25 @@ function sanitizeFailureDetail(input) {
 }
 /** Enumerated codes only (`convex`, `no-secure-context`, `bootstrap-encode`); free text fails. */
 const ENUMERATED_DETAIL_RE = /^[A-Za-z][A-Za-z0-9_.-]{0,63}$/u;
+/**
+* A provider operation NAMES A FUNCTION on the provider, so it carries that
+* provider's separators. Convex writes its own as `dir/file:function`
+* (`media:setProfileImage`), and the enumerated shape above rejects both `:`
+* and `/` — so the operation was dropped and the PostHog issue lost the name of
+* what actually failed (staging, 2026-09-03). This widens the separators, not
+* the class: no spaces, same bound, and it matches the backend's own
+* `normalizeOperation`, which has always accepted them.
+*/
+const PROVIDER_OPERATION_RE = /^[A-Za-z][A-Za-z0-9_.:/-]{0,63}$/u;
 const TARGET_HOST_RE = /^[A-Za-z0-9.[\]:-]{1,253}$/u;
 /** A four-byte revert selector, or the bare `0x` of an empty revert. */
 const REVERT_SELECTOR_RE = /^0x(?:[0-9a-fA-F]{8})?$/u;
 function normalizeSdkVersion(value) {
 	return typeof value === "string" && /^[A-Za-z0-9][A-Za-z0-9.+_-]{0,127}$/u.test(value) ? value : "unknown";
 }
+/** Same shape as the backend's `normalizeOperation`: a Convex path (`dir/file:fn`) survives. */
 function normalizeOperation(value) {
-	return typeof value === "string" && /^[A-Za-z0-9_][A-Za-z0-9_.-]{0,255}$/u.test(value) ? value : "unknown";
+	return typeof value === "string" && /^[A-Za-z0-9_][A-Za-z0-9_.:/-]{0,255}$/u.test(value) ? value : "unknown";
 }
 function normalizeErrorKind(value) {
 	return typeof value === "string" && /^[A-Za-z][A-Za-z0-9_.-]{0,63}$/u.test(value) ? value : "Error";
@@ -5462,6 +5498,29 @@ const TelemetryEnvelopeProps = {
 */
 const FailureModeSchema = Schema.Literals(FAILURE_MODES$1);
 const ChainUpstreamSchema = Schema.Literals(CHAIN_UPSTREAMS);
+/**
+* The refusing upstream's response headers (#1818): exactly the names in
+* `RESPONSE_HEADER_ALLOWLIST`, each optional, so the catalog itself refuses a
+* `set-cookie` or `authorization` that a producer let through.
+*/
+const ResponseHeadersSchema = Schema.Struct({
+	"retry-after": OptionalString,
+	"www-authenticate": OptionalString,
+	"content-type": OptionalString,
+	"x-request-id": OptionalString,
+	"cf-ray": OptionalString,
+	"x-ratelimit-remaining": OptionalString,
+	"x-ratelimit-reset": OptionalString,
+	server: OptionalString
+});
+/** One upstream tried, flat (#1818): the `chain_attempts` entry on every producer's row. */
+const ChainAttemptSchema = Schema.Struct({
+	upstream: ChainUpstreamSchema,
+	failure_mode: FailureModeSchema,
+	http_status: Schema.optional(Schema.Number),
+	rpc_code: Schema.optional(Schema.Number),
+	duration_ms: Schema.Number
+});
 const ChainCauseTelemetryProps = {
 	failure_mode: Schema.optional(FailureModeSchema),
 	chain_upstream: Schema.optional(ChainUpstreamSchema),
@@ -5472,7 +5531,9 @@ const ChainCauseTelemetryProps = {
 	chain_revert_name: OptionalString,
 	chain_revert_selector: OptionalString,
 	chain_revert_args: Schema.optional(Schema.Record(Schema.String, Schema.String)),
-	chain_provider_message: OptionalString
+	chain_provider_message: OptionalString,
+	chain_attempts: Schema.optional(Schema.Array(ChainAttemptSchema)),
+	chain_response_headers: Schema.optional(ResponseHeadersSchema)
 };
 /**
 * Stamp the required envelope onto an event at its emit boundary. Call-site
@@ -5590,7 +5651,8 @@ const ChainUpstreamFallbackProps = Schema.Struct({
 	failure_mode: FailureModeSchema,
 	exhausted: Schema.Boolean,
 	http_status: Schema.optional(Schema.Number),
-	rpc_code: Schema.optional(Schema.Number)
+	rpc_code: Schema.optional(Schema.Number),
+	response_headers: Schema.optional(ResponseHeadersSchema)
 });
 const BundlerErrorProps = Schema.Struct({
 	...TelemetryEnvelopeProps,
@@ -8117,10 +8179,18 @@ async function recordSetupFailure(setup, orgId, error, retryable, observationSou
 	if (!scopedRecorded.ok) return scopedRecorded;
 	return scopedRecorded;
 }
+/**
+* ADR-0023 R7: the layer that saw the chain failure says whether the same
+* request can succeed later; its word wins over the mode table. The table is
+* the one `identity/model.ts` uses, so the two gates read one list
+* (`org.account.get` retried a `transient: false` 403 in 1.5 s, 2026-09-03).
+*/
 function isRetryableProviderFailure(error) {
-	const mode = error.details?.failure_mode;
-	return mode !== "auth-origin-mismatch" && mode !== "app-env-allowlist" && mode !== "no-secure-context";
+	if (error.chain !== void 0) return error.chain.retryable;
+	const mode = error.mode ?? error.details?.failure_mode;
+	return !DEFINITIVE_PROVIDER_MODES.has(isFailureMode(mode) ? mode : void 0);
 }
+/** @internal Exported for the retry-gate test; the surface calls it from the setup loop. */
 function isRetryableOrganizationSetupFailure(error) {
 	if (error.code === "CANCELLED" || error.code === "SIGNER_REJECTED") return true;
 	if (error.code === "PROVIDER_ERROR") return isRetryableProviderFailure(error);

package/dist/index.d.mts

@@ -1,6 +1,6 @@
-import { $ as RoleKey, D as Address, E as AccountId, F as BudgetId, G as PartyId, J as PayrollRunId, L as CountryCode, M as AuthSession, N as AuthUserId, T as Account, U as Money, W as OrgId, _t as FailureMode, a as SignerStatusStore, at as toCountryCode, c as AccountProviderSource, ct as CapxulErrorCode, d as eip1193AccountProvider, f as localPrivateKeyAccountProvider, ft as isCapxulError, g as SmartAccount, gt as FAILURE_MODES, h as Session, ht as ChainUpstream, i as SignerStatus, it as toAddress, l as AccountRequirement, lt as CapxulErrorDetails, m as Profile, mt as ChainCause, n as CapxulSigner, o as injectedWalletSigner, ot as CAPXUL_ERROR_CODES, p as CapxulResult, pt as CHAIN_UPSTREAMS, q as PayrollGroupId, r as Eip1193RequestProvider, s as AccountProvider, st as CapxulError, t as CapxulDigestSigner, u as Eip1193Provider, ut as Errors, vt as RevertSummary, w as CAPXUL_PAYMENTS_V2_ADDRESS } from "./signer-HY5Ju8xs.mjs";
-import { $ as OrganizationPaymentsMethods, $n as OrgLane, $t as MeMethods, A as OrgView, An as AccountSetupStep, At as ActivityFilter, B as PayrollGroupInput, Bn as SubmittedPermissionExecution, Bt as ActivitySummaryTotal, C as DetectPendingOrgInvitationsResult, Cn as RecipientResolutionKind, Ct as AddressBookMethods, D as OrgMethods, Dn as TargetsMethods, Dt as ActivityAnnotation, E as MemberView, En as TargetReference, Et as InboxMethods, F as RoleSpendCap, Fn as OrgLifecycle, Ft as ActivityPage, G as PayrollRun, Gn as RequestStatus, Gt as DestinationKind, H as PayrollGroupsMethods, Hn as PAYMENT_DIRECTIONS, Ht as DepositInstructions, I as RoleView, In as OrgSetupStep, It as ActivityRange, J as PayrollRuns, Jt as DestinationRail, K as PayrollRunItemInput, Kt as DestinationListInput, L as AuthorizeRunInput, Ln as ActorRef, Lt as ActivityReference, M as OrganizationAuditLogItem, Mn as IdentityMethods, Mt as ActivityKind, N as ResendInviteTokenInput, Nn as SmartAccountMethods, Nt as ActivityListParams, O as OrgScopedMethods, On as fingerprintPaymentIntent, Ot as ActivityAnnotationInput, P as RoleDefinition, Pn as AuthMethods, Pt as ActivityMethods, Q as OrganizationPaymentItemInput, Qn as IdentityState, Qt as HandlesMethods, R as PayrollEngagementTerms, Rn as CurrentHoldings, Rt as ActivitySummary, S as CreateOrgInput, Sn as RecipientResolution, St as AddressBookLabelInput, T as MemberStatus, Tn as ResolvedTarget, Tt as InboxItem, U as PayrollMethods, Un as PAYMENT_STATUSES, Ut as Destination, V as PayrollGroupMember, Vn as InboxStatus, Vt as ActorReference, W as PayrollOptions, Wn as PaymentStatus$1, Wt as DestinationAddInput, X as OrganizationPaymentBatchInput, Xn as Destination$1, Xt as DestinationsMethods, Y as PayrollTermsUnit, Yn as TelemetryPort, Yt as DestinationRemoveInput, Z as OrganizationPaymentInput, Zn as IdentityEvent, Zt as FinancialOpsMethods, _ as SystemMethods, _n as PaymentStatus, _t as ActorRequest, a as SdkFailureObservation, an as OfframpStatus, ar as IdentityTransition, at as PermissionReplaceInput, b as CurrentUserContext, bn as PaymentsMethods, bt as AddressBookAddInput, c as PostHogObservabilityOptions, cn as Payment, ct as Budget, d as CreateCapxulClientInput, dn as PaymentDocumentKind, dt as OrgMeOptions, en as MeProfile, er as Readiness, et as PermissionAssignInput, f as IdentityProfileDetails, fn as PaymentDocumentRef, ft as AccountsMethods, g as Holding, gn as PaymentMoney, gt as ActorRelationshipMethods, h as HoldingsMethods, hn as PaymentDocumentsMethods, ht as ActorProfileMethods, i as ObservationDelivery, in as OfframpQuoteInput, ir as isRestoring, it as PermissionOptions, j as OrganizationAccount, jn as isSettingUpLifecycle, jt as ActivityItem, k as OrgTemplate, kn as AccountLifecycle, kt as ActivityDetail, l as postHogObservability, ln as PaymentActivityEvidence, lt as OrgMe, m as IdentityRuntimeSendResult, mn as PaymentDocumentVerification, mt as ActorProfile, n as ObservationAdapter, nn as OfframpMethods, nr as destination, nt as PermissionCreateInput, o as HostObservability, on as Payee, or as InvocationControls, ot as PermissionRevokeInput, p as IdentityRuntime, pn as PaymentDocumentRender, pt as AccountMethods, q as PayrollRunStatus, qt as DestinationPayload, r as ObservationContext, rn as OfframpQuote, rr as isClaimed, rt as PermissionMethods, s as PostHogObservabilityClient, sn as PayeesMethods, st as PermissionReadResult, t as CAPXUL_SDK_EXPECTED_OUTCOME_EVENT, tn as MovementActivityEvidence, tr as StateLabel, tt as PermissionChangeInput, u as CapxulClient, un as PaymentDirection, ut as OrgMeMethod, v as SystemHealth, vn as PaymentTiming, vt as ActorRequestIssueInput, w as InviteMemberInput, wn as Ref, wt as InboxApproveInput, x as CurrentUserMethods, xn as PaymentsPayInput, xt as AddressBookEntry, y as MediaMethods, yn as PaymentType, yt as ActorRequestsMethods, z as PayrollGroup, zn as Permission, zt as ActivitySummaryParams } from "./observation-CR3_haBB.mjs";
-import "./OAuthBearerAuthClient-GkHnGqNi.mjs";
+import { $ as RoleKey, D as Address, E as AccountId, F as BudgetId, G as PartyId, J as PayrollRunId, L as CountryCode, M as AuthSession, N as AuthUserId, T as Account, U as Money, W as OrgId, _t as FailureMode, a as SignerStatusStore, at as toCountryCode, c as AccountProviderSource, ct as CapxulErrorCode, d as eip1193AccountProvider, f as localPrivateKeyAccountProvider, ft as isCapxulError, g as SmartAccount, gt as FAILURE_MODES, h as Session, ht as ChainUpstream, i as SignerStatus, it as toAddress, l as AccountRequirement, lt as CapxulErrorDetails, m as Profile, mt as ChainCause, n as CapxulSigner, o as injectedWalletSigner, ot as CAPXUL_ERROR_CODES, p as CapxulResult, pt as CHAIN_UPSTREAMS, q as PayrollGroupId, r as Eip1193RequestProvider, s as AccountProvider, st as CapxulError, t as CapxulDigestSigner, u as Eip1193Provider, ut as Errors, vt as RevertSummary, w as CAPXUL_PAYMENTS_V2_ADDRESS } from "./signer-BpjdawiY.mjs";
+import { $ as OrganizationPaymentsMethods, $n as OrgLane, $t as MeMethods, A as OrgView, An as AccountSetupStep, At as ActivityFilter, B as PayrollGroupInput, Bn as SubmittedPermissionExecution, Bt as ActivitySummaryTotal, C as DetectPendingOrgInvitationsResult, Cn as RecipientResolutionKind, Ct as AddressBookMethods, D as OrgMethods, Dn as TargetsMethods, Dt as ActivityAnnotation, E as MemberView, En as TargetReference, Et as InboxMethods, F as RoleSpendCap, Fn as OrgLifecycle, Ft as ActivityPage, G as PayrollRun, Gn as RequestStatus, Gt as DestinationKind, H as PayrollGroupsMethods, Hn as PAYMENT_DIRECTIONS, Ht as DepositInstructions, I as RoleView, In as OrgSetupStep, It as ActivityRange, J as PayrollRuns, Jt as DestinationRail, K as PayrollRunItemInput, Kt as DestinationListInput, L as AuthorizeRunInput, Ln as ActorRef, Lt as ActivityReference, M as OrganizationAuditLogItem, Mn as IdentityMethods, Mt as ActivityKind, N as ResendInviteTokenInput, Nn as SmartAccountMethods, Nt as ActivityListParams, O as OrgScopedMethods, On as fingerprintPaymentIntent, Ot as ActivityAnnotationInput, P as RoleDefinition, Pn as AuthMethods, Pt as ActivityMethods, Q as OrganizationPaymentItemInput, Qn as IdentityState, Qt as HandlesMethods, R as PayrollEngagementTerms, Rn as CurrentHoldings, Rt as ActivitySummary, S as CreateOrgInput, Sn as RecipientResolution, St as AddressBookLabelInput, T as MemberStatus, Tn as ResolvedTarget, Tt as InboxItem, U as PayrollMethods, Un as PAYMENT_STATUSES, Ut as Destination, V as PayrollGroupMember, Vn as InboxStatus, Vt as ActorReference, W as PayrollOptions, Wn as PaymentStatus$1, Wt as DestinationAddInput, X as OrganizationPaymentBatchInput, Xn as Destination$1, Xt as DestinationsMethods, Y as PayrollTermsUnit, Yn as TelemetryPort, Yt as DestinationRemoveInput, Z as OrganizationPaymentInput, Zn as IdentityEvent, Zt as FinancialOpsMethods, _ as SystemMethods, _n as PaymentStatus, _t as ActorRequest, a as SdkFailureObservation, an as OfframpStatus, ar as IdentityTransition, at as PermissionReplaceInput, b as CurrentUserContext, bn as PaymentsMethods, bt as AddressBookAddInput, c as PostHogObservabilityOptions, cn as Payment, ct as Budget, d as CreateCapxulClientInput, dn as PaymentDocumentKind, dt as OrgMeOptions, en as MeProfile, er as Readiness, et as PermissionAssignInput, f as IdentityProfileDetails, fn as PaymentDocumentRef, ft as AccountsMethods, g as Holding, gn as PaymentMoney, gt as ActorRelationshipMethods, h as HoldingsMethods, hn as PaymentDocumentsMethods, ht as ActorProfileMethods, i as ObservationDelivery, in as OfframpQuoteInput, ir as isRestoring, it as PermissionOptions, j as OrganizationAccount, jn as isSettingUpLifecycle, jt as ActivityItem, k as OrgTemplate, kn as AccountLifecycle, kt as ActivityDetail, l as postHogObservability, ln as PaymentActivityEvidence, lt as OrgMe, m as IdentityRuntimeSendResult, mn as PaymentDocumentVerification, mt as ActorProfile, n as ObservationAdapter, nn as OfframpMethods, nr as destination, nt as PermissionCreateInput, o as HostObservability, on as Payee, or as InvocationControls, ot as PermissionRevokeInput, p as IdentityRuntime, pn as PaymentDocumentRender, pt as AccountMethods, q as PayrollRunStatus, qt as DestinationPayload, r as ObservationContext, rn as OfframpQuote, rr as isClaimed, rt as PermissionMethods, s as PostHogObservabilityClient, sn as PayeesMethods, st as PermissionReadResult, t as CAPXUL_SDK_EXPECTED_OUTCOME_EVENT, tn as MovementActivityEvidence, tr as StateLabel, tt as PermissionChangeInput, u as CapxulClient, un as PaymentDirection, ut as OrgMeMethod, v as SystemHealth, vn as PaymentTiming, vt as ActorRequestIssueInput, w as InviteMemberInput, wn as Ref, wt as InboxApproveInput, x as CurrentUserMethods, xn as PaymentsPayInput, xt as AddressBookEntry, y as MediaMethods, yn as PaymentType, yt as ActorRequestsMethods, z as PayrollGroup, zn as Permission, zt as ActivitySummaryParams } from "./observation-B3PCugGC.mjs";
+import "./OAuthBearerAuthClient-BxTiv8dg.mjs";
 import { Hex } from "viem";
 import { Context, Effect, Layer } from "effect";
 import { FunctionReference } from "convex/server";

package/dist/index.mjs

@@ -1,6 +1,6 @@
-import { $ as EngineeringTelemetryBootstrapPolicy, A as normalizeExceptionErrorKind, B as isSignerNotReadySignal, C as failureDetail, D as postHogFailureObservation, E as observeFailedResult, F as fromWei, G as readInvocationObservation, H as signerFailure, I as isSettingUpLifecycle, J as sanitizeObservationContext, K as OBSERVATION_CONTEXT_HEADER, L as formatTraceparent, M as projectSdkException, N as safeExceptionLabel, O as EXCEPTION_MESSAGE, P as version, Q as BootstrapEnvelope, R as causeChain, S as CAPXUL_SDK_EXPECTED_OUTCOME_EVENT, T as observationContextProps, U as resolveFailureMode, V as openfortSignerNotReadyCode, W as copyInvocationObservation, X as PAYMENT_STATUSES, Y as PAYMENT_DIRECTIONS, Z as CAPXUL_FUNCTIONS, _ as convexCallErrorFromCapxul, a as AccountReadPortTag, b as fingerprintPaymentIntent, d as retryIdempotentRead, et as destination, f as PRODUCT_INVOCATION, g as ConvexCallPortTag, h as identityErrorFromCapxul, i as smartAccountErrorFromCapxul, j as normalizeExceptionOperation, k as SDK_VERSION$1, l as redactTelemetryProps, m as IdentityPortTag, n as detectAuthCacheAdapter, nt as isRestoring, o as accountReadErrorFromCapxul, p as wireChainId, q as encodeObservationContextHeader, r as SmartAccountPortTag, s as TelemetryPortTag, t as assembleCapxulClient, tt as isClaimed, u as stampTelemetryEnvelope, v as BootstrapPortTag, w as failureEvidenceProps, x as toWei, y as bootstrapErrorFromCapxul, z as injectedWalletSigner } from "./create-capxul-client-DwINzpXZ.mjs";
-import { $ as CHAIN_UPSTREAMS, B as toOrgId, D as toAllowedOrigin, E as toAddress, F as toEmail, G as toRoleKey, I as toEpochMs, J as CAPXUL_ERROR_CODES, K as toSessionToken, L as toEpochSeconds, M as toCountryCode, N as toCurrencyCode, P as toDurationMs, Q as isCapxulError, R as toJwtToken, T as toAccountId, W as toPublishableKey, Y as CapxulError, Z as Errors, d as AuthClientError, et as FAILURE_MODES, f as AuthClientPortTag, g as BASE_SEPOLIA_CHAIN_ID, h as normalizeBindingEmail, j as toChainId, k as toAuthUserId, l as ClockPortTag, m as CAPXUL_PAYMENTS_V2_ADDRESS, q as decodeConvexError, s as AuthCachePortTag, u as authClientPortFromPromiseAdapter, w as currencySymbolFor, z as toKycTier } from "./clock-0c5NM-TY.mjs";
-import { n as SystemClockLayer } from "./OAuthBearerAuthClient-BZ6tXt4m.mjs";
+import { $ as EngineeringTelemetryBootstrapPolicy, A as normalizeExceptionErrorKind, B as isSignerNotReadySignal, C as failureDetail, D as postHogFailureObservation, E as observeFailedResult, F as fromWei, G as readInvocationObservation, H as signerFailure, I as isSettingUpLifecycle, J as sanitizeObservationContext, K as OBSERVATION_CONTEXT_HEADER, L as formatTraceparent, M as projectSdkException, N as safeExceptionLabel, O as EXCEPTION_MESSAGE, P as version, Q as BootstrapEnvelope, R as causeChain, S as CAPXUL_SDK_EXPECTED_OUTCOME_EVENT, T as observationContextProps, U as resolveFailureMode, V as openfortSignerNotReadyCode, W as copyInvocationObservation, X as PAYMENT_STATUSES, Y as PAYMENT_DIRECTIONS, Z as CAPXUL_FUNCTIONS, _ as convexCallErrorFromCapxul, a as AccountReadPortTag, b as fingerprintPaymentIntent, d as retryIdempotentRead, et as destination, f as PRODUCT_INVOCATION, g as ConvexCallPortTag, h as identityErrorFromCapxul, i as smartAccountErrorFromCapxul, j as normalizeExceptionOperation, k as SDK_VERSION$1, l as redactTelemetryProps, m as IdentityPortTag, n as detectAuthCacheAdapter, nt as isRestoring, o as accountReadErrorFromCapxul, p as wireChainId, q as encodeObservationContextHeader, r as SmartAccountPortTag, s as TelemetryPortTag, t as assembleCapxulClient, tt as isClaimed, u as stampTelemetryEnvelope, v as BootstrapPortTag, w as failureEvidenceProps, x as toWei, y as bootstrapErrorFromCapxul, z as injectedWalletSigner } from "./create-capxul-client-dk67qjlK.mjs";
+import { $ as CHAIN_UPSTREAMS, B as toOrgId, D as toAllowedOrigin, E as toAddress, F as toEmail, G as toRoleKey, I as toEpochMs, J as CAPXUL_ERROR_CODES, K as toSessionToken, L as toEpochSeconds, M as toCountryCode, N as toCurrencyCode, P as toDurationMs, Q as isCapxulError, R as toJwtToken, T as toAccountId, W as toPublishableKey, Y as CapxulError, Z as Errors, d as AuthClientError, et as FAILURE_MODES, f as AuthClientPortTag, g as BASE_SEPOLIA_CHAIN_ID, h as normalizeBindingEmail, j as toChainId, k as toAuthUserId, l as ClockPortTag, m as CAPXUL_PAYMENTS_V2_ADDRESS, q as decodeConvexError, s as AuthCachePortTag, u as authClientPortFromPromiseAdapter, w as currencySymbolFor, z as toKycTier } from "./clock-m_aHLaNm.mjs";
+import { n as SystemClockLayer } from "./OAuthBearerAuthClient-DfS4QOg7.mjs";
 import { keccak256, recoverAddress, stringToHex } from "viem";
 import { Cause, Context, Data, Duration, Effect, Exit, Layer, Result, Schedule, SchemaIssue, SchemaParser, Scope, Tracer } from "effect";
 import { getFunctionName, makeFunctionReference } from "convex/server";
@@ -3775,6 +3775,8 @@ function captureException(telemetry, error, context) {
 			issueDescription: detail.reason ?? failureMode,
 			...detail.chain_upstream === void 0 ? {} : { chainUpstream: detail.chain_upstream },
 			...detail.chain_method === void 0 ? {} : { chainMethod: detail.chain_method },
+			...detail.chain_http_status === void 0 ? {} : { chainHttpStatus: detail.chain_http_status },
+			...detail.chain_rpc_code === void 0 ? {} : { chainRpcCode: detail.chain_rpc_code },
 			exceptionList: buildExceptionList({
 				type: errorCode,
 				value: EXCEPTION_MESSAGE,

package/dist/node/index.d.mts

@@ -1,5 +1,5 @@
-import { C as CachedJwt, M as AuthSession, S as AuthCachePortTag, b as AuthCacheError, n as CapxulSigner, x as AuthCachePort } from "../signer-HY5Ju8xs.mjs";
-import { n as oauthBearerAuthClient, t as OAuthBearerAuthClientInput } from "../OAuthBearerAuthClient-GkHnGqNi.mjs";
+import { C as CachedJwt, M as AuthSession, S as AuthCachePortTag, b as AuthCacheError, n as CapxulSigner, x as AuthCachePort } from "../signer-BpjdawiY.mjs";
+import { n as oauthBearerAuthClient, t as OAuthBearerAuthClientInput } from "../OAuthBearerAuthClient-BxTiv8dg.mjs";
 import { Hex } from "viem";
 import { Effect, FileSystem, Layer, Path } from "effect";
 //#region src/adapters/auth-cache/FileSystemAuthCacheAdapter.d.ts

package/dist/node/index.mjs

@@ -1,5 +1,5 @@
-import { E as toAddress, a as parseCachedJwt, i as parseAuthSession, n as InMemoryAuthCacheAdapter, o as AuthCacheError, r as BrowserAuthCacheAdapter, s as AuthCachePortTag } from "../clock-0c5NM-TY.mjs";
-import { t as oauthBearerAuthClient } from "../OAuthBearerAuthClient-BZ6tXt4m.mjs";
+import { E as toAddress, a as parseCachedJwt, i as parseAuthSession, n as InMemoryAuthCacheAdapter, o as AuthCacheError, r as BrowserAuthCacheAdapter, s as AuthCachePortTag } from "../clock-m_aHLaNm.mjs";
+import { t as oauthBearerAuthClient } from "../OAuthBearerAuthClient-DfS4QOg7.mjs";
 import { Effect, FileSystem, Layer, Path } from "effect";
 import { privateKeyToAccount } from "viem/accounts";
 import * as os from "node:os";

package/dist/{observation-CR3_haBB.d.mts → observation-B3PCugGC.d.mts}

@@ -1,4 +1,4 @@
-import { $ as RoleKey, A as AnonymousDistinctId, B as DurationMs, D as Address$1, F as BudgetId, G as PartyId, H as EpochMs, I as ChainId, J as PayrollRunId, K as PaymentCommandId, L as CountryCode, M as AuthSession, N as AuthUserId, O as AllowanceKey, P as BlockNumber, Q as PublishableKey, R as CurrencyCode, T as Account$1, U as Money, V as Email, W as OrgId, X as PermissionId, Y as PermissionAssignmentId, Z as Profile, _ as ClockPort, _t as FailureMode, a as SignerStatusStore, c as AccountProviderSource, ct as CapxulErrorCode, dt as Failure, et as SessionToken, g as SmartAccount$1, h as Session$1, j as AppId, k as AllowedOrigin, l as AccountRequirement, lt as CapxulErrorDetails, m as Profile$1, n as CapxulSigner, nt as TxHash, p as CapxulResult, q as PayrollGroupId, rt as WeiAmount, st as CapxulError, tt as SmartAccount, v as AuthClientPort, x as AuthCachePort, y as CanSendOtpStatus, z as DocumentHash } from "./signer-HY5Ju8xs.mjs";
+import { $ as RoleKey, A as AnonymousDistinctId, B as DurationMs, D as Address$1, F as BudgetId, G as PartyId, H as EpochMs, I as ChainId, J as PayrollRunId, K as PaymentCommandId, L as CountryCode, M as AuthSession, N as AuthUserId, O as AllowanceKey, P as BlockNumber, Q as PublishableKey, R as CurrencyCode, T as Account$1, U as Money, V as Email, W as OrgId, X as PermissionId, Y as PermissionAssignmentId, Z as Profile, _ as ClockPort, _t as FailureMode, a as SignerStatusStore, c as AccountProviderSource, ct as CapxulErrorCode, dt as Failure, et as SessionToken, g as SmartAccount$1, h as Session$1, j as AppId, k as AllowedOrigin, l as AccountRequirement, lt as CapxulErrorDetails, m as Profile$1, n as CapxulSigner, nt as TxHash, p as CapxulResult, q as PayrollGroupId, rt as WeiAmount, st as CapxulError, tt as SmartAccount, v as AuthClientPort, x as AuthCachePort, y as CanSendOtpStatus, z as DocumentHash } from "./signer-BpjdawiY.mjs";
 import { Hex } from "viem";
 import { Context, Effect, Layer, Schema, Scope, Tracer } from "effect";
 import { FunctionReference } from "convex/server";
@@ -2763,6 +2763,17 @@ interface SdkFailureDetail {
   readonly chain_revert_selector?: string;
   readonly chain_revert_args?: Readonly<Record<string, string>>;
   readonly chain_provider_message?: string;
+  /** #1818: the attempt sequence and the refusing upstream's headers, same bounds as the backend. */
+  readonly chain_attempts?: readonly SdkChainAttempt[];
+  readonly chain_response_headers?: Readonly<Record<string, string>>;
+}
+/** One upstream tried, flat: the `chain_attempts` entry shape on every producer's row. */
+interface SdkChainAttempt {
+  readonly upstream: string;
+  readonly failure_mode: string;
+  readonly http_status?: number;
+  readonly rpc_code?: number;
+  readonly duration_ms: number;
 }
 type ObservationDelivery = void | PromiseLike<void>;
 /**

package/dist/{signer-HY5Ju8xs.d.mts → signer-BpjdawiY.d.mts}

@@ -33,8 +33,14 @@ declare const FAILURE_MODES: readonly [
 "insufficient-allowance",
 /** The bundler's validation refused the operation (AA2x/AA3x); its text is carried. */
 "rejected",
-/** The gateway refused the token. */
+/** The upstream refused the credential (HTTP 401): the gateway token or a hosted node key. */
 "unauthorized",
+/** The upstream refused the key, origin, or method (HTTP 403). The next upstream's key may be fine. */
+"forbidden",
+/** The upstream refused the request shape (HTTP 400-family; JSON-RPC -32600, -32602, -32700). */
+"bad-request",
+/** The node does not serve the method (JSON-RPC -32601). The next upstream may. */
+"method-unsupported",
 /** No cause could be determined. */
 "unknown"];
 type FailureMode = (typeof FAILURE_MODES)[number];
@@ -62,6 +68,22 @@ type ChainCause = {
   readonly rpcCode?: number;
   readonly revert?: RevertSummary;
   readonly providerMessage?: string;
+  /**
+   * Every upstream tried for this read, in order, ending with the one whose
+   * answer this cause is (#1818). One `$exception` row then tells the whole
+   * story of an exhausted chain; the recovered case stays an event.
+   */
+  readonly attempts?: readonly ChainAttempt[];
+  /** The refusing upstream's allow-listed response headers, masked and bounded. */
+  readonly responseHeaders?: Readonly<Record<string, string>>;
+};
+/** One upstream tried and the word for how it failed (#1818). */
+type ChainAttempt = {
+  readonly upstream: ChainUpstream;
+  readonly mode: FailureMode;
+  readonly httpStatus?: number;
+  readonly rpcCode?: number;
+  readonly durationMs: number;
 };
 //#endregion
 //#region ../errors/src/errors.d.ts

package/dist/testing/index.d.mts

@@ -1,4 +1,4 @@
-import { Jn as TelemetryIdentifyInput, Kn as TelemetryEvent, ar as IdentityTransition, n as ObservationAdapter, qn as TelemetryGroupInput, u as CapxulClient } from "../observation-CR3_haBB.mjs";
+import { Jn as TelemetryIdentifyInput, Kn as TelemetryEvent, ar as IdentityTransition, n as ObservationAdapter, qn as TelemetryGroupInput, u as CapxulClient } from "../observation-B3PCugGC.mjs";
 import { Effect, Layer } from "effect";
 //#region src/testing/telemetry/RecordingTelemetryAdapter.d.ts
 type RecordingTelemetryOperation = {

package/dist/testing/index.mjs

@@ -1,5 +1,5 @@
-import { F as fromWei, _ as convexCallErrorFromCapxul, c as redactTelemetryEvent, h as identityErrorFromCapxul, i as smartAccountErrorFromCapxul, o as accountReadErrorFromCapxul, p as wireChainId, t as assembleCapxulClient, x as toWei, y as bootstrapErrorFromCapxul } from "../create-capxul-client-DwINzpXZ.mjs";
-import { D as toAllowedOrigin, E as toAddress, F as toEmail, I as toEpochMs, K as toSessionToken, L as toEpochSeconds, M as toCountryCode, O as toAppId, P as toDurationMs, R as toJwtToken, T as toAccountId, W as toPublishableKey, Y as CapxulError, Z as Errors, _ as deriveCapxulSafeAddress, j as toChainId, k as toAuthUserId, n as InMemoryAuthCacheAdapter, t as readClockNow, u as authClientPortFromPromiseAdapter, z as toKycTier } from "../clock-0c5NM-TY.mjs";
+import { F as fromWei, _ as convexCallErrorFromCapxul, c as redactTelemetryEvent, h as identityErrorFromCapxul, i as smartAccountErrorFromCapxul, o as accountReadErrorFromCapxul, p as wireChainId, t as assembleCapxulClient, x as toWei, y as bootstrapErrorFromCapxul } from "../create-capxul-client-dk67qjlK.mjs";
+import { D as toAllowedOrigin, E as toAddress, F as toEmail, I as toEpochMs, K as toSessionToken, L as toEpochSeconds, M as toCountryCode, O as toAppId, P as toDurationMs, R as toJwtToken, T as toAccountId, W as toPublishableKey, Y as CapxulError, Z as Errors, _ as deriveCapxulSafeAddress, j as toChainId, k as toAuthUserId, n as InMemoryAuthCacheAdapter, t as readClockNow, u as authClientPortFromPromiseAdapter, z as toKycTier } from "../clock-m_aHLaNm.mjs";
 import { keccak256 } from "viem";
 import { Effect, Result, Semaphore } from "effect";
 import { getFunctionName } from "convex/server";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@capxul/sdk",
-  "version": "3.0.0",
+  "version": "3.1.0",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/Xelmar-tech/infrastructure.git",
@@ -47,12 +47,12 @@
     "vite": "npm:@voidzero-dev/vite-plus-core@0.3.0",
     "vite-plus": "0.3.0",
     "vitest": "4.1.11",
-    "@capxul/errors": "0.0.2",
-    "@capxul/types": "0.2.1",
+    "@capxul/config": "0.2.3",
+    "@capxul/errors": "0.2.0",
+    "@capxul/types": "0.2.3",
     "@capxul/typescript-config": "0.0.0",
-    "@capxul/wire": "0.5.1",
-    "@capxul/config": "0.2.1",
-    "@capxul/observability": "3.0.0"
+    "@capxul/wire": "0.6.0",
+    "@capxul/observability": "3.1.0"
   },
   "_permissionlessPinReason": "permissionless.toSafeSmartAccount is pinned to 0.3.4 for live Safe deployment E2E. Counterfactual address fixtures captured 2026-05-17 in packages/backend/convex/_shared/__tests__/counterfactual.test.ts and packages/config/tests/safe.test.ts must be re-verified before upgrading.",
   "scripts": {