@capxul/sdk 4.1.3 → 4.2.0-rc.1

package/dist/{create-capxul-client-CipLFLcJ.mjs → production-FgHUndeX.mjs}

@@ -1,7 +1,12 @@
-import { $ as CapxulError, A as toAuthUserId, C as WEI_RE, D as toAddress, E as toAccountId, G as toPayrollRunId, H as toOrgId, I as toEmail, M as toChainId, N as toCountryCode, P as toCurrencyCode, Q as CAPXUL_ERROR_CODES, S as SUPPORTED_CURRENCY_CODES, U as toPartyId, W as toPayrollGroupId, _ as deriveCapxulSafeAddress, at as boundedResponseHeaders, b as BYTES32_RE, ct as decodeChainCause, dt as isFailureMode, et as EXPECTED_OPERATION_OUTCOMES, ft as revertSummaryText, it as FAILURE_MODES$1, j as toBudgetId, lt as failureFingerprint, mt as redactSecrets, n as InMemoryAuthCacheAdapter, nt as isCapxulError, ot as chainCauseProperties, p as orgRoleKeyForLabel, pt as containsSensitiveMaterial, q as toRoleKey, r as BrowserAuthCacheAdapter, rt as CHAIN_UPSTREAMS, st as chainEvidenceLabel, tt as Errors, ut as isChainUpstream, v as validateHandle, w as ZERO_BYTES32, x as EVM_ADDRESS_RE$1, y as APP_ID_RE } from "./clock-C2AUlq1V.mjs";
-import { Cause, Clock, Context, Data, Deferred, Duration, Effect, Exit, Fiber, Layer, Queue, Ref, Result, Schema, SchemaGetter, SchemaParser, Scope } from "effect";
-import { formatUnits, keccak256, parseUnits, recoverAddress, toBytes } from "viem";
-import { makeFunctionReference } from "convex/server";
+import { $ as toTesterKind, A as toAccountId, B as toEmail, C as BYTES32_RE, D as ZERO_BYTES32, E as WEI_RE, F as toBudgetId, G as toKycTier, H as toEpochSeconds, I as toChainId, J as toPayrollGroupId, K as toOrgId, L as toCountryCode, M as toAllowedOrigin, P as toAuthUserId, Q as toSessionToken, R as toCurrencyCode, S as ASSET_ID_RE, T as SUPPORTED_CURRENCY_CODES, U as toHandle, V as toEpochMs, W as toJwtToken, X as toPublishableKey, Y as toPayrollRunId, Z as toRoleKey, _ as BASE_SEPOLIA_CHAIN_ID, _t as revertSummaryText, at as EXPECTED_OPERATION_OUTCOMES, b as ACCOUNT_ID_RE, bt as redactSecrets, c as AuthCachePortTag, ct as CHAIN_UPSTREAMS, d as authClientPortFromPromiseAdapter, dt as chainCauseProperties, et as validateHandle, f as AuthClientError, ft as chainEvidenceLabel, g as normalizeBindingEmail, gt as isFailureMode, ht as isChainUpstream, i as BrowserAuthCacheAdapter, it as CapxulError, j as toAddress, l as SystemClockLayer, lt as FAILURE_MODES$1, m as orgRoleKeyForLabel, mt as failureFingerprint, nt as decodeConvexError, ot as Errors, p as AuthClientPortTag, pt as decodeChainCause, q as toPartyId, r as InMemoryAuthCacheAdapter, rt as CAPXUL_ERROR_CODES, st as isCapxulError, u as ClockPortTag, ut as boundedResponseHeaders, v as deriveCapxulSafeAddress, vt as containsSensitiveMaterial, w as EVM_ADDRESS_RE$1, x as APP_ID_RE, xt as redactUrlSecrets, yt as isCredentialField, z as toDurationMs } from "./OAuthBearerAuthClient-BrbXrndM.mjs";
+import { formatUnits, keccak256, parseUnits, recoverAddress, stringToHex, toBytes } from "viem";
+import { Cause, Clock, Context, Data, Deferred, Duration, Effect, Exit, Fiber, FiberSet, Layer, Option, Queue, Ref, Result, Schedule, Schema, SchemaGetter, SchemaIssue, SchemaParser, Scope, Stream, Tracer } from "effect";
+import { getFunctionName, makeFunctionReference } from "convex/server";
+import { privateKeyToAccount } from "viem/accounts";
+import { FetchHttpClient, Headers, HttpClient } from "effect/unstable/http";
+import { OtlpExporter, OtlpLogger, OtlpSerialization, OtlpTracer } from "effect/unstable/observability";
+import { ConvexClient } from "convex/browser";
+import { AccountTypeEnum, ChainTypeEnum, EmbeddedState, Openfort, RecoveryMethod, ThirdPartyOAuthProvider } from "@openfort/openfort-js";
 //#region src/domain/identity/model.ts
 const WRONG = { refused: "WRONG_STATE" };
 /** org-lifecycle.ts:173-184, lifted verbatim. */
@@ -811,11 +816,11 @@ const PublishableKeyIdSchema = Schema.String.pipe(Schema.refine((value) => value
 const TxHashSchema$1 = Schema.String.pipe(Schema.refine((value) => BYTES32_RE.test(value), { message: "must be 0x + 64 hex chars" }));
 const ACCOUNT_ID_TELEMETRY_RE = /^account_[0-9A-Za-z]+$/;
 const WEI_AMOUNT_TELEMETRY_RE = /^[0-9]+$/;
-const AccountIdSchema = Schema.String.pipe(Schema.refine((value) => ACCOUNT_ID_TELEMETRY_RE.test(value), { message: "must be account_ plus an alphanumeric id" }));
+const AccountIdSchema$1 = Schema.String.pipe(Schema.refine((value) => ACCOUNT_ID_TELEMETRY_RE.test(value), { message: "must be account_ plus an alphanumeric id" }));
 const WeiAmountSchema$1 = Schema.String.pipe(Schema.refine((value) => WEI_AMOUNT_TELEMETRY_RE.test(value), { message: "must be a non-negative integer string" }));
 const CurrencyCodeSchema$1 = Schema.String.pipe(Schema.refine((value) => value.length > 0, { message: "must be a non-empty currency code" }));
 const BalanceBucketSchema = Schema.Literals(["zero", "nonzero"]);
-const OptionalAccountId = Schema.optional(AccountIdSchema);
+const OptionalAccountId = Schema.optional(AccountIdSchema$1);
 const OptionalWeiAmount = Schema.optional(WeiAmountSchema$1);
 const OptionalCurrencyCode = Schema.optional(CurrencyCodeSchema$1);
 const OptionalBalanceBucket = Schema.optional(BalanceBucketSchema);
@@ -1576,6 +1581,7 @@ const ActivityFilterProps = {
 	filter_status: Schema.optional(Schema.Array(Schema.Literals([
 		"pending",
 		"settling",
+		"unresolved",
 		"pending_claim",
 		"scheduled",
 		"streaming",
@@ -1708,7 +1714,7 @@ function redactTelemetryEvent(event, options = {}) {
 }
 function redactTelemetryProps(name, props, options = {}) {
 	if (props === void 0) return void 0;
-	const clone = cloneProps(props);
+	const clone = cloneProps$1(props);
 	if (options.rawMode === true) return clone;
 	for (const key of PII_PROP_KEYS_BY_EVENT[name] ?? []) redactProperty(clone, key);
 	return clone;
@@ -1723,17 +1729,17 @@ function redactProperty(props, key) {
 	const value = props[key];
 	if (typeof value === "string") props[key] = sha256Hex(value).slice(0, 12);
 }
-function cloneProps(props) {
+function cloneProps$1(props) {
 	const cloned = {};
-	for (const [key, value] of Object.entries(props)) cloned[key] = cloneTelemetryValue(value);
+	for (const [key, value] of Object.entries(props)) cloned[key] = cloneTelemetryValue$1(value);
 	return cloned;
 }
-function cloneTelemetryValue(value) {
-	if (Array.isArray(value)) return value.map(cloneTelemetryValue);
+function cloneTelemetryValue$1(value) {
+	if (Array.isArray(value)) return value.map(cloneTelemetryValue$1);
 	if (value === null || typeof value !== "object") return value;
 	if (Object.getPrototypeOf(value) !== Object.prototype) return value;
 	const cloned = {};
-	for (const [key, nested] of Object.entries(value)) cloned[key] = cloneTelemetryValue(nested);
+	for (const [key, nested] of Object.entries(value)) cloned[key] = cloneTelemetryValue$1(nested);
 	return cloned;
 }
 const SHA256_INITIAL_HASH = [
@@ -1898,6 +1904,11 @@ const bytes32BrandSchema = (name) => lowercasedString.pipe(Schema.refine((value)
 /** Lowercase, 0x-prefixed bytes32 evidence without a public brand. */
 const Bytes32Schema = bytes32BrandSchema("value");
 const AddressSchema = addressSchema("address");
+const AccountIdSchema = Schema.String.pipe(Schema.refine((value) => ACCOUNT_ID_RE.test(value), { message: "must be account_ plus an alphanumeric id" }));
+const AssetIdSchema = Schema.String.pipe(Schema.refine((value) => {
+	const match = ASSET_ID_RE.exec(value);
+	return match !== null && match[0] === value && Number.isSafeInteger(Number(match[1])) && Number(match[1]) > 0 && match[2] !== "0x0000000000000000000000000000000000000000";
+}, { message: "must be a canonical ERC-20 AssetId" }));
 const SafeAddressSchema = addressSchema("safe address");
 const ModuleAddressSchema = addressSchema("module address");
 const TxHashSchema = bytes32BrandSchema("transaction hash");
@@ -3538,6 +3549,212 @@ Schema.Struct({
 	decimals: nonNegativeInteger("decimals"),
 	effectiveFrom: nonNegativeInteger("effectiveFrom")
 });
+//#endregion
+//#region ../wire/src/payment-document-v2.ts
+const uint8 = Schema.Number.check(Schema.makeFilter((n) => Number.isInteger(n) && n >= 0 && n <= 255));
+const uint64 = Schema.Number.check(Schema.makeFilter((n) => Number.isSafeInteger(n) && n >= 0));
+const minorUnits$1 = Schema.String.check(Schema.makeFilter((s) => s.length <= 78 && s.trim() === s && /^(0|[1-9][0-9]*)$/.test(s) && BigInt(s) < 2n ** 256n));
+const reference = Schema.String.check(Schema.makeFilter((s) => s.length > 0));
+/** Public asset quantities use decimal major units. Registry validation resolves their scale. */
+const AssetAmountSchema = Schema.Struct({
+	asset: AssetIdSchema,
+	value: Schema.String.check(Schema.makeFilter((s) => s.length <= 512 && s.trim() === s && /^(0|[1-9][0-9]*)(\.[0-9]+)?$/.test(s))),
+	currency: Schema.optional(Schema.Never),
+	decimals: Schema.optional(Schema.Never)
+});
+const requestedMoney = Schema.Struct({
+	...FinancialOpsMoney.fields,
+	asset: Schema.optional(Schema.Never)
+}).check(Schema.makeFilter((amount) => amount.decimals <= 255 && amount.value.length <= 512 && amount.value.trim() === amount.value && (amount.value.split(".")[1]?.length ?? 0) <= amount.decimals, { message: "money must use exact decimal precision" }));
+Schema.Union([Schema.Struct({
+	kind: Schema.Literal("money"),
+	amount: requestedMoney
+}), Schema.Struct({
+	kind: Schema.Literal("asset"),
+	amount: AssetAmountSchema
+})]);
+Schema.Union([Schema.Struct({
+	kind: Schema.Literal("money"),
+	account: AccountIdSchema,
+	currency: CurrencyCodeSchema,
+	asset: Schema.optional(Schema.Never)
+}), Schema.Struct({
+	kind: Schema.Literal("asset"),
+	account: AccountIdSchema,
+	asset: AssetIdSchema,
+	currency: Schema.optional(Schema.Never)
+})]);
+Schema.Union([Schema.Struct({
+	kind: Schema.Literal("money"),
+	account: AccountIdSchema,
+	amount: requestedMoney
+}), Schema.Struct({
+	kind: Schema.Literal("asset"),
+	account: AccountIdSchema,
+	amount: AssetAmountSchema
+})]);
+/** Inactive fields are required and empty. They never carry an alternative denomination. */
+const AmountV2Schema = Schema.Union([Schema.Struct({
+	denomination: Schema.Literal(0),
+	currency: CurrencyCodeSchema,
+	asset: Schema.Literal(""),
+	minorUnits: minorUnits$1,
+	decimals: uint8
+}), Schema.Struct({
+	denomination: Schema.Literal(1),
+	currency: Schema.Literal(""),
+	asset: AssetIdSchema,
+	minorUnits: minorUnits$1,
+	decimals: uint8
+})]);
+const targetFields$1 = {
+	target: reference,
+	targetRevision: uint64
+};
+const payoutFields = {
+	rail: Schema.Literals(["chainrails", "lightspark"]),
+	purposeKind: Schema.Literals([
+		0,
+		1,
+		2,
+		3
+	]),
+	payerRef: reference,
+	fundingAccount: reference,
+	...targetFields$1,
+	requestId: Schema.String,
+	obligationHash: DocumentHashSchema,
+	send: AmountV2Schema,
+	receive: AmountV2Schema,
+	feesHash: NonzeroDocumentHashSchema,
+	releaseHash: NonzeroDocumentHashSchema
+};
+Schema.Struct(payoutFields);
+const InvoiceV2 = Schema.Struct({
+	kind: Schema.Literal(1),
+	invoiceNumber: Schema.String,
+	payerRef: reference,
+	payeeRef: reference,
+	amount: AmountV2Schema,
+	...targetFields$1,
+	issuedAt: uint64,
+	dueAt: uint64,
+	lineItemsHash: DocumentHashSchema
+});
+const PayslipV2 = Schema.Struct({
+	kind: Schema.Literal(2),
+	employerRef: reference,
+	employeeRef: reference,
+	period: Schema.String,
+	gross: AmountV2Schema,
+	net: AmountV2Schema,
+	...targetFields$1,
+	issuedAt: uint64
+}).check(Schema.makeFilter((m) => m.gross.denomination === m.net.denomination && m.gross.currency === m.net.currency && m.gross.asset === m.net.asset && m.gross.decimals === m.net.decimals && BigInt(m.net.minorUnits) <= BigInt(m.gross.minorUnits), { message: "gross and net must use one denomination; net cannot exceed gross" }));
+const ReceiptV2 = Schema.Struct({
+	kind: Schema.Literal(3),
+	reference: Schema.String,
+	amount: AmountV2Schema,
+	...targetFields$1,
+	obligationHash: DocumentHashSchema,
+	dealHash: NonzeroDocumentHashSchema,
+	paidAt: uint64,
+	note: Schema.String
+});
+const PayoutV2 = Schema.Struct({
+	kind: Schema.Literal(4),
+	quoteId: reference,
+	...payoutFields,
+	expiresAt: uint64,
+	issuedAt: uint64
+}).check(Schema.makeFilter((m) => m.issuedAt <= m.expiresAt, { message: "issuance must not follow the acceptance deadline" }));
+const common = {
+	protocol: Schema.Literal("capxul.payment-document"),
+	version: Schema.Literal(2),
+	domain: Schema.Struct({
+		name: Schema.Literal("CapxulPayments"),
+		version: Schema.Literal("2"),
+		chainId: ChainIdSchema,
+		verifyingContract: Schema.Literal(PAYMENT_DOCUMENT_VERIFYING_CONTRACT)
+	})
+};
+Schema.Union([
+	Schema.Struct({
+		...common,
+		primaryType: Schema.Literal("Invoice"),
+		message: InvoiceV2
+	}),
+	Schema.Struct({
+		...common,
+		primaryType: Schema.Literal("Payslip"),
+		message: PayslipV2
+	}),
+	Schema.Struct({
+		...common,
+		primaryType: Schema.Literal("Receipt"),
+		message: ReceiptV2
+	}),
+	Schema.Struct({
+		...common,
+		primaryType: Schema.Literal("Payout"),
+		message: PayoutV2
+	})
+]);
+const targetFields = [{
+	name: "target",
+	type: "string"
+}, {
+	name: "targetRevision",
+	type: "uint64"
+}];
+const termsFields = [
+	{
+		name: "rail",
+		type: "string"
+	},
+	{
+		name: "purposeKind",
+		type: "uint16"
+	},
+	{
+		name: "payerRef",
+		type: "string"
+	},
+	{
+		name: "fundingAccount",
+		type: "string"
+	},
+	...targetFields,
+	{
+		name: "requestId",
+		type: "string"
+	},
+	{
+		name: "obligationHash",
+		type: "bytes32"
+	},
+	{
+		name: "send",
+		type: "AmountV2"
+	},
+	{
+		name: "receive",
+		type: "AmountV2"
+	},
+	{
+		name: "feesHash",
+		type: "bytes32"
+	},
+	{
+		name: "releaseHash",
+		type: "bytes32"
+	}
+];
+[...targetFields], [...targetFields], [...targetFields], [...termsFields];
+Schema.Array(Schema.Struct({
+	code: Schema.Literals(["rail", "capxul"]),
+	amount: AmountV2Schema
+}));
 `
 .capxul-doc{--ink:#1d1d1f;--muted:#6e6e73;--line:#e7e7ea;--accent:#0a7d4b;--bg:#fff;
   font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Inter,system-ui,sans-serif;
@@ -3750,9 +3967,9 @@ function resolveFailureMode(error, contextFailureMode) {
 }
 //#endregion
 //#region src/signer.ts
-const EVM_ADDRESS_HEX = /^0x[0-9a-fA-F]{40}$/;
-const ECDSA_SIGNATURE_HEX = /^0x[0-9a-fA-F]{130}$/;
-const SAFE_OP_DIGEST_HEX = /^0x[0-9a-fA-F]{64}$/;
+const EVM_ADDRESS_HEX$1 = /^0x[0-9a-fA-F]{40}$/;
+const ECDSA_SIGNATURE_HEX$1 = /^0x[0-9a-fA-F]{130}$/;
+const SAFE_OP_DIGEST_HEX$1 = /^0x[0-9a-fA-F]{64}$/;
 /**
 * The readiness store a signer reports when it runs no readiness cycle. It
 * fails CLOSED: a node key signer or an injected wallet never claims `ready`,
@@ -3828,14 +4045,14 @@ function injectedWalletSigner(provider) {
 		const accounts = await provider.request({ method: "eth_requestAccounts" });
 		const first = Array.isArray(accounts) ? accounts[0] : void 0;
 		if (typeof first !== "string") throw new Error("injectedWalletSigner: wallet returned no accounts");
-		if (!EVM_ADDRESS_HEX.test(first)) throw new Error("injectedWalletSigner: wallet returned invalid address format");
+		if (!EVM_ADDRESS_HEX$1.test(first)) throw new Error("injectedWalletSigner: wallet returned invalid address format");
 		return toAddress(first);
 	};
 	return {
 		source: "injected-eip1193",
 		getAddress: resolveAddress,
 		async signUserOpHash(hash) {
-			if (!SAFE_OP_DIGEST_HEX.test(hash)) throw new Error("injectedWalletSigner: SafeOp digest must be a 0x-prefixed 32-byte hex");
+			if (!SAFE_OP_DIGEST_HEX$1.test(hash)) throw new Error("injectedWalletSigner: SafeOp digest must be a 0x-prefixed 32-byte hex");
 			const address = await resolveAddress();
 			let signature;
 			try {
@@ -3848,8 +4065,8 @@ function injectedWalletSigner(provider) {
 				throw new Error(`injectedWalletSigner: eth_sign failed; enable raw-hash signing for deployment (${detail})`, { cause });
 			}
 			if (typeof signature !== "string") throw new Error("injectedWalletSigner: wallet returned a non-string signature");
-			if (!ECDSA_SIGNATURE_HEX.test(signature)) throw new Error("injectedWalletSigner: wallet returned invalid signature format");
-			if ((await recoverRawDigestSigner({
+			if (!ECDSA_SIGNATURE_HEX$1.test(signature)) throw new Error("injectedWalletSigner: wallet returned invalid signature format");
+			if ((await recoverRawDigestSigner$1({
 				hash,
 				signature
 			})).toLowerCase() !== address.toLowerCase()) throw new Error("injectedWalletSigner: wallet signature did not recover the selected account for the raw SafeOp digest; use a raw-hash-capable wallet or @capxul/sdk/node localPrivateKeySigner for deployed flows");
@@ -3857,7 +4074,7 @@ function injectedWalletSigner(provider) {
 		}
 	};
 }
-async function recoverRawDigestSigner(input) {
+async function recoverRawDigestSigner$1(input) {
 	try {
 		return toAddress(await recoverAddress(input));
 	} catch (cause) {
@@ -4358,6 +4575,7 @@ function verifiedOperationFields(attributes) {
 /** Observe a public Effect that already uses the canonical CapxulError channel. */
 async function runCapxulEffect(effect, controls, operation = CAPXUL_OPERATIONS.runtime.port, runPromise = Effect.runPromise) {
 	const invocation = readInvocationObservation(controls);
+	let owningSpan;
 	const correlationId = safeEngineeringIdentifier(invocation?.context?.correlationId ?? controls?.correlation_id);
 	const context = invocation?.active === false ? void 0 : sanitizeObservationContext(invocation?.context);
 	const fields = {
@@ -4384,6 +4602,10 @@ async function runCapxulEffect(effect, controls, operation = CAPXUL_OPERATIONS.r
 		const failure = error instanceof CapxulError ? error : void 0;
 		const outcome = Exit.isSuccess(exit) ? "succeeded" : failure?.code === "CANCELLED" ? "cancelled" : failure !== void 0 && EXPECTED_OPERATION_OUTCOMES.has(failure.code) ? "refused" : "failed";
 		const span = yield* Effect.currentSpan.pipe(Effect.orDie);
+		if (Exit.isFailure(exit) && invocation?.active === true) owningSpan = Object.freeze({
+			traceId: span.traceId,
+			spanId: span.spanId
+		});
 		const completion = {
 			...fields,
 			...verifiedOperationFields(span.attributes),
@@ -4397,7 +4619,10 @@ async function runCapxulEffect(effect, controls, operation = CAPXUL_OPERATIONS.r
 		yield* (outcome === "failed" ? Effect.logError("capxul_sdk_operation") : Effect.logInfo("capxul_sdk_operation")).pipe(Effect.annotateLogs(completion), Effect.catchCause(() => Effect.void));
 		return yield* Exit.isSuccess(exit) ? Effect.succeed(exit.value) : Effect.failCause(exit.cause);
 	}).pipe(Effect.withSpan(operation)), controls));
-	return !result.ok && invocation !== void 0 ? markFailureInvocationSnapshot(result, invocation) : result;
+	return !result.ok && invocation !== void 0 ? markFailureInvocationSnapshot(result, {
+		...invocation,
+		...owningSpan === void 0 ? {} : { owningSpan }
+	}) : result;
 }
 /** Map machine-internal failure state onto the public SDK error vocabulary. */
 function publicIdentityFailure(failure) {
@@ -4603,7 +4828,14 @@ function fromWei(rawBalance, decimals, currency) {
 //#region src/surface/contacts.ts
 function makeActorRelationshipMethods(deps) {
 	const domain = deps.actor.kind === "account" ? "account" : "org";
-	const actor = deps.actor;
+	const actor = deps.actor.kind === "account" ? { kind: "account" } : {
+		kind: "org",
+		orgId: deps.actor.orgId
+	};
+	const observeContactScope = Effect.annotateCurrentSpan({
+		scope_kind: actor.kind === "org" ? "organization" : "account",
+		...actor.kind === "org" ? { verified_organization_id: actor.orgId } : {}
+	});
 	const convexCall = deps.convexCall;
 	const profileGetOperation = domain === "account" ? CAPXUL_OPERATIONS.account.profile.get : CAPXUL_OPERATIONS.org.profile.get;
 	const profileDepositInstructionsOperation = domain === "account" ? CAPXUL_OPERATIONS.account.profile.depositInstructions : CAPXUL_OPERATIONS.org.profile.depositInstructions;
@@ -4616,14 +4848,14 @@ function makeActorRelationshipMethods(deps) {
 				return runPortEffect(mapReply(CAPXUL_OPERATIONS.addressBook.list, Effect.suspend(() => convexCall.query(fns.addressBookList, copyInvocationObservation(controls, {
 					actor,
 					...input?.includeHidden === void 0 ? {} : { includeHidden: input.includeHidden }
-				}))), (entries) => entries.map(mapAddressBookEntry)), controls, CAPXUL_OPERATIONS.addressBook.list, deps.runPromise);
+				}))), (entries) => entries.map(mapAddressBookEntry)).pipe(Effect.tap(() => observeContactScope)), controls, CAPXUL_OPERATIONS.addressBook.list, deps.runPromise);
 			},
 			get: (entryId, options) => {
 				const controls = deps.invocationControls?.(options) ?? options;
 				return runPortEffect(mapReply(CAPXUL_OPERATIONS.addressBook.get, Effect.suspend(() => convexCall.query(fns.addressBookGet, copyInvocationObservation(controls, {
 					actor,
 					partyId: entryId
-				}))), (entry) => entry === null ? null : mapAddressBookEntry(entry)), controls, CAPXUL_OPERATIONS.addressBook.get, deps.runPromise);
+				}))), (entry) => entry === null ? null : mapAddressBookEntry(entry)).pipe(Effect.tap(() => observeContactScope)), controls, CAPXUL_OPERATIONS.addressBook.get, deps.runPromise);
 			},
 			add: (input, options) => {
 				const controls = deps.invocationControls?.(options) ?? options;
@@ -4633,21 +4865,21 @@ function makeActorRelationshipMethods(deps) {
 					actor,
 					ref: ref.value,
 					...input.label === void 0 ? {} : { label: input.label }
-				}))), mapAddressBookEntry), controls, CAPXUL_OPERATIONS.addressBook.add, deps.runPromise);
+				}))), mapAddressBookEntry).pipe(Effect.tap(() => observeContactScope)), controls, CAPXUL_OPERATIONS.addressBook.add, deps.runPromise);
 			},
 			hide: (entryId, options) => {
 				const controls = deps.invocationControls?.(options) ?? options;
 				return runPortEffect(mapReply(CAPXUL_OPERATIONS.addressBook.hide, Effect.suspend(() => convexCall.mutation(fns.addressBookHide, copyInvocationObservation(controls, {
 					actor,
 					partyId: entryId
-				}))), mapAddressBookEntry), controls, CAPXUL_OPERATIONS.addressBook.hide, deps.runPromise);
+				}))), mapAddressBookEntry).pipe(Effect.tap(() => observeContactScope)), controls, CAPXUL_OPERATIONS.addressBook.hide, deps.runPromise);
 			},
 			unhide: (entryId, options) => {
 				const controls = deps.invocationControls?.(options) ?? options;
 				return runPortEffect(mapReply(CAPXUL_OPERATIONS.addressBook.unhide, Effect.suspend(() => convexCall.mutation(fns.addressBookUnhide, copyInvocationObservation(controls, {
 					actor,
 					partyId: entryId
-				}))), mapAddressBookEntry), controls, CAPXUL_OPERATIONS.addressBook.unhide, deps.runPromise);
+				}))), mapAddressBookEntry).pipe(Effect.tap(() => observeContactScope)), controls, CAPXUL_OPERATIONS.addressBook.unhide, deps.runPromise);
 			},
 			label: (input, options) => {
 				const controls = deps.invocationControls?.(options) ?? options;
@@ -4655,7 +4887,7 @@ function makeActorRelationshipMethods(deps) {
 					actor,
 					partyId: input.entryId,
 					label: input.label
-				}))), mapAddressBookEntry), controls, CAPXUL_OPERATIONS.addressBook.label, deps.runPromise);
+				}))), mapAddressBookEntry).pipe(Effect.tap(() => observeContactScope)), controls, CAPXUL_OPERATIONS.addressBook.label, deps.runPromise);
 			}
 		},
 		requests: {
@@ -5219,12 +5451,12 @@ const moneyExecutionContract = {
 };
 //#endregion
 //#region package.json
-var version = "4.1.3";
+var version = "4.2.0-rc.1";
 //#endregion
 //#region src/telemetry/exception-projection.ts
 /** Fixed fallback for failures that have no safe message. */
 const EXCEPTION_MESSAGE = "Capxul SDK operation failed";
-const SDK_VERSION = version;
+const SDK_VERSION$1 = version;
 /** The one PostHog Error Tracking projection for every SDK exception emitter. */
 function projectSdkException(input) {
 	const operation = normalizeExceptionOperation(input.operation);
@@ -5277,8 +5509,13 @@ function postHogFailureObservation(policy, fixedSnapshot) {
 		const safeFailure = sanitizeFailureObservation(failure);
 		const directContext = callStartSnapshot?.context ?? directSnapshot?.context;
 		const actorId = callStartSnapshot?.actorId;
+		const span = callStartSnapshot?.owningSpan;
 		return [safeFailure, {
 			...postHogProperties(safeFailure, directContext),
+			...span !== void 0 && /^(?!0+$)[0-9a-f]{32}$/u.test(span.traceId) && /^(?!0+$)[0-9a-f]{16}$/u.test(span.spanId) ? {
+				trace_id: span.traceId,
+				span_id: span.spanId
+			} : {},
 			...actorId !== void 0 && /^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$/u.test(actorId) ? {
 				actor_id: actorId,
 				actor_kind: "authenticated",
@@ -5366,7 +5603,7 @@ function observeSdkClient(client, adapter, snapshot) {
 						report(adapter, "exception", operation, cause, invocation);
 						throw cause;
 					}
-					if (isPromiseLike(output)) return Promise.resolve(output).then((result) => processOutput(result, path, invocation), (cause) => {
+					if (isPromiseLike$1(output)) return Promise.resolve(output).then((result) => processOutput(result, path, invocation), (cause) => {
 						report(adapter, "exception", operation, cause, invocation);
 						throw cause;
 					});
@@ -5440,7 +5677,7 @@ function report(adapter, kind, operation, cause, invocation, origin, authoritati
 	const evidence = failureEvidence(cause);
 	const failure = markFailureInvocationSnapshot({
 		exception: syntheticException(operationName, kindName, evidence.message, evidence.stack),
-		sdkVersion: SDK_VERSION,
+		sdkVersion: SDK_VERSION$1,
 		operation: operationName,
 		errorKind: kindName,
 		...context === void 0 ? {} : { context },
@@ -5449,7 +5686,8 @@ function report(adapter, kind, operation, cause, invocation, origin, authoritati
 	}, {
 		active: invocation.active,
 		...invocation.actorId === void 0 ? {} : { actorId: invocation.actorId },
-		...context === void 0 ? {} : { context }
+		...context === void 0 ? {} : { context },
+		...invocation.owningSpan === void 0 ? {} : { owningSpan: invocation.owningSpan }
 	});
 	try {
 		ignoreDeliveryFailure(kind === "operation" ? adapter.captureOperationFailure(failure) : adapter.captureException(failure));
@@ -5477,7 +5715,7 @@ function resolveAdapterContext(adapter) {
 	}
 }
 function ignoreDeliveryFailure(delivery) {
-	if (!isPromiseLike(delivery)) return;
+	if (!isPromiseLike$1(delivery)) return;
 	try {
 		Promise.resolve(delivery).catch(() => void 0);
 	} catch {}
@@ -5576,8 +5814,6 @@ function evidenceText(value) {
 	if (typeof value !== "string" || value.length === 0) return void 0;
 	return redactSecrets(value).slice(0, MAX_EVIDENCE_TEXT);
 }
-/** A field whose NAME says credential is masked whatever its value looks like. */
-const CREDENTIAL_FIELD_NAME = /(?:otp|pass(?:word|wd|phrase)?|token|secret|credential|api[_-]?key|private[_-]?key|authorization|cookie|session)/iu;
 /** Copy a details object into a JSON-safe shape with every string masked. */
 function evidenceValue(value, depth = 0) {
 	if (typeof value === "string") return evidenceText(value);
@@ -5588,7 +5824,7 @@ function evidenceValue(value, depth = 0) {
 	if (Array.isArray(value)) return value.slice(0, 50).map((item) => evidenceValue(item, depth + 1));
 	const copy = {};
 	for (const [key, nested] of Object.entries(value)) {
-		if (CREDENTIAL_FIELD_NAME.test(key)) {
+		if (isCredentialField(key)) {
 			copy[key] = "[REDACTED]";
 			continue;
 		}
@@ -5858,7 +6094,7 @@ function syntheticException(operation, kind, message = EXCEPTION_MESSAGE, stack)
 	error.stack = `${kind}: ${error.message}\n    at CapxulSdkBoundary.${operation} (capxul-sdk-observation://boundary/${operation}:1:1)` + (stack === void 0 ? "" : `\nCaused by: ${stack}`);
 	return error;
 }
-function isPromiseLike(value) {
+function isPromiseLike$1(value) {
 	return (typeof value === "object" || typeof value === "function") && value !== null && typeof value.then === "function";
 }
 function isPlainObject(value) {
@@ -6220,6 +6456,27 @@ function activityActorField(actor) {
 		} };
 	}
 }
+/** Capture scope now; let the observed result boundary handle a malformed caller value. */
+function captureActivityInput(prepare) {
+	try {
+		return prepare();
+	} catch (cause) {
+		return Effect.die(cause);
+	}
+}
+function observeActivityScope(actor) {
+	const organizationId = actor?.kind === "organization" || actor?.kind === "org" ? safeEngineeringIdentifier(actor.orgId) : void 0;
+	return Effect.annotateCurrentSpan({
+		scope_kind: actor?.kind === "organization" || actor?.kind === "org" ? "organization" : "account",
+		...organizationId === void 0 ? {} : { verified_organization_id: organizationId }
+	});
+}
+function decodeActivityViewer(value) {
+	const viewer = Option.getOrUndefined(Schema.decodeUnknownOption(ActorRefSchema)(value));
+	if (viewer === void 0) return void 0;
+	const id = viewer.kind === "organization" ? viewer.orgId : viewer.accountId;
+	return safeEngineeringIdentifier(id) === void 0 ? void 0 : viewer;
+}
 /** An absent actor and a `personal` actor both name the signed-in Account. */
 function actorScopeKey(actor) {
 	return actor === void 0 || actor.kind === "personal" ? "personal" : `org:${actor.organizationId}`;
@@ -6414,8 +6671,9 @@ async function waitForPaymentSubmission(submission, signal, operation, onCancel
 		});
 	});
 }
-function normalizeActivityDetail(detail) {
-	if (detail === null) return null;
+function normalizeActivityDetail(response) {
+	if (response === null) return null;
+	const { viewer: _viewer, ...detail } = response;
 	if (detail.kind === "payment") {
 		if (detail.evidence === null) return detail;
 		return {
@@ -6692,39 +6950,58 @@ function makeFinancialOpsMethods(deps) {
 		activity: {
 			list: (params, options) => {
 				const controls = deps.invocationControls?.(options) ?? options;
-				return runPortEffect(Effect.suspend(() => deps.convexCall.query(fns.activityList, copyInvocationObservation(controls, { input: {
-					...activityActorField(params?.actor),
+				return runPortEffect(captureActivityInput(() => Effect.succeed(activityActorField(params?.actor).actor)).pipe(Effect.flatMap((actor) => Effect.suspend(() => deps.convexCall.query(fns.activityList, copyInvocationObservation(controls, { input: {
+					...actor === void 0 ? {} : { actor },
 					...params?.cursor === void 0 ? {} : { cursor: params.cursor },
 					...params?.limit === void 0 ? {} : { limit: params.limit },
 					...params?.range === void 0 ? {} : { range: params.range },
 					...params?.filter === void 0 ? {} : { filter: params.filter }
-				} }))), controls, CAPXUL_OPERATIONS.activity.list, deps.runPromise);
+				} }))).pipe(Effect.tap(() => observeActivityScope(actor))))), controls, CAPXUL_OPERATIONS.activity.list, deps.runPromise);
 			},
 			summary: (params, options) => {
 				const controls = deps.invocationControls?.(options) ?? options;
-				return runPortEffect(Effect.suspend(() => deps.convexCall.query(fns.activitySummary, copyInvocationObservation(controls, { input: {
-					...activityActorField(params?.actor),
+				return runPortEffect(captureActivityInput(() => Effect.succeed(activityActorField(params?.actor).actor)).pipe(Effect.flatMap((actor) => Effect.suspend(() => deps.convexCall.query(fns.activitySummary, copyInvocationObservation(controls, { input: {
+					...actor === void 0 ? {} : { actor },
 					...params?.window === void 0 ? {} : { window: params.window }
-				} }))), controls, CAPXUL_OPERATIONS.activity.summary, deps.runPromise);
+				} }))).pipe(Effect.tap(() => observeActivityScope(actor))))), controls, CAPXUL_OPERATIONS.activity.summary, deps.runPromise);
 			},
 			get: (reference, options) => {
 				const controls = deps.invocationControls?.(options) ?? options;
-				const actor = actorReferenceToBackend(options?.actor);
-				return runPortEffect(Effect.suspend(() => deps.convexCall.query(fns.activityGet, copyInvocationObservation(controls, {
+				const requestedActor = actorReferenceToBackend(options?.actor);
+				return runPortEffect(captureActivityInput(() => {
+					const scope = requestedActor === void 0 ? void 0 : requestedActor.kind === "org" ? {
+						kind: "org",
+						orgId: requestedActor.orgId
+					} : { kind: "account" };
+					return Effect.succeed({
+						actor: scope,
+						referenceActor: reference.kind === "payment" ? activityActorField(reference.actor).actor : void 0
+					});
+				}).pipe(Effect.flatMap(({ actor, referenceActor }) => Effect.suspend(() => deps.convexCall.query(fns.activityGet, copyInvocationObservation(controls, {
 					input: {
 						kind: reference.kind,
 						id: reference.id,
-						...reference.kind === "payment" ? activityActorField(reference.actor) : {}
+						...referenceActor === void 0 ? {} : { actor: referenceActor }
 					},
 					...actor === void 0 ? {} : { actor }
-				}))).pipe(Effect.map(normalizeActivityDetail)), controls, CAPXUL_OPERATIONS.activity.get, deps.runPromise);
+				}))).pipe(Effect.flatMap((response) => {
+					const detail = normalizeActivityDetail(response);
+					if (response === null) return Effect.succeed(detail);
+					const viewer = response.viewer === void 0 ? actor ?? referenceActor : decodeActivityViewer(response.viewer);
+					return viewer === void 0 ? Effect.succeed(detail) : observeActivityScope(viewer).pipe(Effect.as(detail));
+				})))), controls, CAPXUL_OPERATIONS.activity.get, deps.runPromise);
 			},
 			annotate: (input, options) => {
 				const controls = deps.invocationControls?.(options) ?? options;
-				if (input.actor !== void 0 && input.reference.kind === "payment" && input.reference.actor !== void 0 && !sameActor(input.actor, input.reference.actor)) return runCapxulEffect(Effect.fail(Errors.invalidInput("reference.actor", "must match the annotation actor")), controls, CAPXUL_OPERATIONS.activity.annotate, deps.runPromise);
-				const referenceActor = input.reference.kind === "payment" ? activityActorField(input.reference.actor).actor : void 0;
-				return runPortEffect(Effect.suspend(() => deps.convexCall.mutation(fns.activityAnnotate, copyInvocationObservation(controls, { input: {
-					...activityActorField(input.actor),
+				return runPortEffect(captureActivityInput(() => {
+					const actor = activityActorField(input.actor).actor;
+					if (input.actor !== void 0 && input.reference.kind === "payment" && input.reference.actor !== void 0 && !sameActor(input.actor, input.reference.actor)) return Effect.fail({ publicError: Errors.invalidInput("reference.actor", "must match the annotation actor") });
+					return Effect.succeed({
+						actor,
+						referenceActor: input.reference.kind === "payment" ? activityActorField(input.reference.actor).actor : void 0
+					});
+				}).pipe(Effect.flatMap(({ actor, referenceActor }) => Effect.suspend(() => deps.convexCall.mutation(fns.activityAnnotate, copyInvocationObservation(controls, { input: {
+					...actor === void 0 ? {} : { actor },
 					reference: input.reference.kind === "payment" && referenceActor !== void 0 ? {
 						kind: "payment",
 						id: input.reference.id,
@@ -6736,7 +7013,10 @@ function makeFinancialOpsMethods(deps) {
 					...input.counterpartyLabel === void 0 ? {} : { counterpartyLabel: input.counterpartyLabel },
 					...input.accountingCategory === void 0 ? {} : { accountingCategory: input.accountingCategory },
 					...input.memo === void 0 ? {} : { memo: input.memo }
-				} }))), controls, CAPXUL_OPERATIONS.activity.annotate, deps.runPromise);
+				} }))).pipe(Effect.tap((annotation) => {
+					const scope = decodeActivityViewer(annotation.actor);
+					return scope === void 0 ? Effect.void : observeActivityScope(scope);
+				})))), controls, CAPXUL_OPERATIONS.activity.annotate, deps.runPromise);
 			}
 		},
 		offramp: {
@@ -7030,148 +7310,2974 @@ function mapOk(result, f) {
 	}
 }
 //#endregion
-//#region src/ports/bootstrap.ts
-var BootstrapError = class extends Data.TaggedError("BootstrapError") {};
-function bootstrapErrorFromCapxul(kind, error) {
-	return new BootstrapError({
-		operation: "resolve",
-		kind,
-		publicCode: error.code,
-		cause: error,
-		...kind === "notAuthenticated" || error.details === void 0 ? {} : { details: error.details }
-	});
-}
-var BootstrapPortTag = class extends Context.Service()("@capxul/sdk/ports/BootstrapPort") {};
-//#endregion
-//#region src/ports/convex-call.ts
-var ConvexCallError = class extends Data.TaggedError("ConvexCallError") {};
-function convexCallErrorFromCapxul(operation, error, transport) {
-	return new ConvexCallError({
-		operation,
-		publicCode: error.code,
-		publicError: error,
-		cause: error,
-		...error.details === void 0 ? {} : { details: error.details },
-		...transport === void 0 ? {} : { transport }
-	});
-}
-var ConvexCallPortTag = class extends Context.Service()("@capxul/sdk/ports/ConvexCallPort") {};
-//#endregion
-//#region src/ports/identity.ts
-var IdentityError = class extends Data.TaggedError("IdentityError") {};
-function identityErrorFromCapxul(operation, error, cause = error) {
-	return new IdentityError({
-		operation,
-		publicCode: error.code,
-		publicError: error,
-		cause,
-		...error.details === void 0 ? {} : { details: error.details }
-	});
-}
-var IdentityPortTag = class extends Context.Service()("@capxul/sdk/ports/IdentityPort") {};
-//#endregion
-//#region src/adapters/_shared/wire.ts
+//#region src/dev-signer.ts
+const SESSION_KEY = "capxul.session";
 /**
-* Documented brand-erasure helpers for the wire boundary.
-*
-* Branded primitives (`Address`, `ChainId`) carry compile-time tags that
-* vanish at runtime. When sending values across a wire — Convex function
-* args, viem's template-literal-typed parameters, raw JSON — we have to
-* remove the brand at the type level so the wire-side type system accepts
-* the value.
+* Chains a `local-private-key` signer may sign on. Base Sepolia only, and this
+* list does not grow without an ADR: the keys are deterministic throwaways
+* derived from a shared seed (see `deriveDevPrivateKey`), so anyone holding
+* the seed holds every account. A dev key on a value-bearing chain is a
+* custody incident, not a config mistake.
+*/
+const DEV_KEY_ALLOWED_CHAIN_IDS = [BASE_SEPOLIA_CHAIN_ID];
+/**
+* Testnet fence for the dev-key signing lane (#1149, folds #1065; ADR-0018 P9
+* human/Openfort vs agent/dev-key split). Call it wherever a signer first
+* meets a resolved chain; it refuses before the signer can be used.
 *
-* Using these helpers (rather than ad-hoc `as number` / `as \`0x${string}\``
-* casts) localizes every de-branding site. If we ever need to centralize
-* validation (e.g. "must not de-brand a placeholder address"), the change
-* lands here once instead of grep-and-replace across every adapter.
+* Only `local-private-key` signers are fenced — Openfort-embedded and injected
+* wallets carry their own custody and are the sanctioned human paths.
 */
+function assertDevKeySignerIsTestnetOnly(signer, chainId) {
+	if (signer?.source !== "local-private-key") return {
+		ok: true,
+		value: void 0
+	};
+	if (DEV_KEY_ALLOWED_CHAIN_IDS.includes(chainId)) return {
+		ok: true,
+		value: void 0
+	};
+	return {
+		ok: false,
+		error: Errors.invalidInput("signer", `dev-key signer is testnet-only: chain ${chainId} is not allowed (expected ${DEV_KEY_ALLOWED_CHAIN_IDS.join(", ")})`)
+	};
+}
+/** Deterministic dev private key for an email under a seed. Exported for probes. */
+function deriveDevPrivateKey(seed, email) {
+	return keccak256(stringToHex(seed + normalizeBindingEmail(email)));
+}
+function readSessionEmail(storage) {
+	const resolved = storage ?? globalThis.window?.localStorage;
+	if (resolved === void 0) throw new Error("devPrivateKeySigner: no browser localStorage available and no explicit email supplied");
+	const raw = resolved.getItem(SESSION_KEY);
+	if (raw === null) throw new Error("devPrivateKeySigner: no cached session yet — sign in before the account lane uses the signer");
+	let email;
+	try {
+		email = JSON.parse(raw).email;
+	} catch {
+		throw new Error("devPrivateKeySigner: cached session is not valid JSON");
+	}
+	if (typeof email !== "string" || email.length === 0) throw new Error("devPrivateKeySigner: cached session has no email");
+	return email;
+}
 /**
-* De-brand a `ChainId` for the wire. The runtime representation is already
-* `number` — the cast removes the compile-time brand only.
+* Browser-safe dev signer. Lazy: the email (and so the key) is resolved at
+* each `getAddress()` / `signUserOpHash()` from the cached session, so the
+* same signer instance follows whichever user is signed in.
 */
-function wireChainId(chainId) {
-	return chainId;
+function devPrivateKeySigner(input) {
+	if (input.seed.trim().length === 0) throw new Error("devPrivateKeySigner: seed must be non-empty");
+	const accounts = /* @__PURE__ */ new Map();
+	const resolveAccount = () => {
+		const email = normalizeBindingEmail(input.email ?? readSessionEmail(input.storage));
+		const cached = accounts.get(email);
+		if (cached !== void 0) return cached;
+		const account = privateKeyToAccount(deriveDevPrivateKey(input.seed, email));
+		accounts.set(email, account);
+		return account;
+	};
+	return {
+		source: "local-private-key",
+		async getAddress() {
+			return toAddress(resolveAccount().address);
+		},
+		async signUserOpHash(hash) {
+			return resolveAccount().sign({ hash });
+		}
+	};
 }
 //#endregion
-//#region src/telemetry/invocation.ts
-const PRODUCT_INVOCATION = Symbol("capxul.product-telemetry-invocation");
-function bindProductTelemetryInvocation(telemetry, source) {
-	return telemetry[PRODUCT_INVOCATION]?.(source) ?? telemetry;
+//#region src/ports/embedded-wallet.ts
+function openfortEmbeddedWalletPort(input) {
+	return {
+		async getAddress() {
+			if (input.ensureReady !== void 0) await input.ensureReady();
+			return (await input.embeddedWallet.get()).address;
+		},
+		async signRawDigest(hash) {
+			if (input.ensureReady !== void 0) await input.ensureReady();
+			return await input.embeddedWallet.signMessage(hash, {
+				hashMessage: false,
+				arrayifyMessage: false
+			});
+		}
+	};
 }
 //#endregion
-//#region src/adapters/convex-call/retry-idempotent-read.ts
-const MAX_RETRIES = 2;
-function isConnectionLoss(error) {
-	return error.publicCode === "NETWORK_ERROR" && error.publicError.mode === "upstream-down" && error.publicError.details?.reason === "connection-lost-in-flight";
-}
-function retryIdempotentRead(effect, operation, telemetry, invocationSource) {
-	return Effect.suspend(() => {
-		let attempt = 0;
-		const invocationTelemetry = telemetry === void 0 ? void 0 : bindProductTelemetryInvocation(telemetry, invocationSource);
-		return effect.pipe(Effect.tapError((error) => {
-			if (!isConnectionLoss(error) || attempt >= MAX_RETRIES) return Effect.void;
-			attempt += 1;
-			const eventFields = {
-				operation,
-				failure_mode: "upstream-down",
-				reason: "connection-lost-in-flight",
-				attempt,
-				delay_ms: 0,
-				...error.transport === void 0 ? {} : {
-					connection_id: error.transport.connection_id,
-					connection_count: error.transport.connection_count
-				}
-			};
-			const transport = error.transport;
-			const connection = transport === void 0 ? void 0 : omitTransportKind(transport);
-			const log = Effect.logInfo("capxul.operation.retried").pipe(Effect.annotateLogs(connection === void 0 ? eventFields : {
-				...eventFields,
-				...connection
-			}), Effect.catchCause(() => Effect.void));
-			if (invocationTelemetry === void 0) return log;
-			return log.pipe(Effect.andThen(invocationTelemetry.emit({
-				name: "operation_retried",
-				props: eventFields
-			})), Effect.catchCause(() => Effect.void));
-		}), Effect.retry({
-			times: MAX_RETRIES,
-			while: isConnectionLoss
-		}));
-	});
+//#region src/openfort-embedded-signer.ts
+const EVM_ADDRESS_HEX = /^0x[0-9a-fA-F]{40}$/;
+const ECDSA_SIGNATURE_HEX = /^0x[0-9a-fA-F]{130}$/;
+const SAFE_OP_DIGEST_HEX = /^0x[0-9a-fA-F]{64}$/;
+/** Browser helper: wrap an initialized Openfort `embeddedWallet` API. */
+function openfortEmbeddedSignerFromWallet(input) {
+	return openfortEmbeddedSigner({ wallet: openfortEmbeddedWalletPort({
+		embeddedWallet: input.embeddedWallet,
+		...input.ensureWalletReady === void 0 ? {} : { ensureReady: input.ensureWalletReady }
+	}) });
+}
+function openfortEmbeddedSigner(input) {
+	let cachedAddress = null;
+	let addressInFlight = null;
+	let cacheEpoch = 0;
+	const resetAddressCache = () => {
+		cacheEpoch += 1;
+		cachedAddress = null;
+		addressInFlight = null;
+	};
+	const resolveAddress = async () => {
+		if (cachedAddress !== null) return cachedAddress;
+		if (addressInFlight !== null) return addressInFlight;
+		const epoch = cacheEpoch;
+		addressInFlight = (async () => {
+			try {
+				const raw = await input.wallet.getAddress();
+				if (!EVM_ADDRESS_HEX.test(raw)) throw new Error("openfortEmbeddedSigner: embedded wallet returned invalid address format");
+				const address = toAddress(raw);
+				if (epoch === cacheEpoch) cachedAddress = address;
+				return address;
+			} finally {
+				if (epoch === cacheEpoch) addressInFlight = null;
+			}
+		})();
+		return addressInFlight;
+	};
+	return {
+		source: "openfort-embedded",
+		getAddress: resolveAddress,
+		resetAddressCache,
+		async signUserOpHash(hash) {
+			if (!SAFE_OP_DIGEST_HEX.test(hash)) throw new Error("openfortEmbeddedSigner: SafeOp digest must be a 0x-prefixed 32-byte hex");
+			const address = await resolveAddress();
+			let signature;
+			try {
+				signature = await input.wallet.signRawDigest(hash);
+			} catch (cause) {
+				const detail = cause instanceof Error ? cause.message : String(cause);
+				throw new Error(`openfortEmbeddedSigner: raw digest signing failed; ensure the embedded wallet is configured (${detail})`, { cause });
+			}
+			if (!ECDSA_SIGNATURE_HEX.test(signature)) throw new Error("openfortEmbeddedSigner: embedded wallet returned invalid signature format");
+			if ((await recoverRawDigestSigner({
+				hash,
+				signature
+			})).toLowerCase() !== address.toLowerCase()) throw new Error("openfortEmbeddedSigner: signature did not recover the embedded wallet address for the raw SafeOp digest");
+			return signature;
+		}
+	};
 }
-function omitTransportKind(transport) {
-	const { kind: _kind, ...connection } = transport;
-	return connection;
+/**
+* Canonical name for the embedded-wallet `CapxulSigner` constructor
+* (backend-orchestrated-deploy.md). The embedded-wallet (passkey / Openfort)
+* member of the named constructor trio `localPrivateKeySigner` /
+* `injectedWalletSigner` / `embeddedSigner`. Takes the provider-agnostic
+* `OpenfortEmbeddedWalletPort` (getAddress + signRawDigest); the Openfort-API
+* convenience wrapper is `openfortEmbeddedSignerFromWallet`.
+*/
+const embeddedSigner = openfortEmbeddedSigner;
+async function recoverRawDigestSigner(input) {
+	try {
+		return toAddress(await recoverAddress(input));
+	} catch (cause) {
+		const detail = cause instanceof Error ? cause.message : String(cause);
+		throw new Error(`openfortEmbeddedSigner: could not verify raw SafeOp digest signature (${detail})`, { cause });
+	}
 }
 //#endregion
-//#region src/ports/telemetry.ts
-var TelemetryPortTag = class extends Context.Service()("@capxul/sdk/ports/TelemetryPort") {};
-//#endregion
-//#region src/ports/account-read.ts
-var AccountReadError = class extends Data.TaggedError("AccountReadError") {};
-function accountReadErrorFromCapxul(operation, error, cause = error) {
-	return new AccountReadError({
-		operation,
-		publicCode: error.code,
-		publicError: error,
-		cause,
-		...error.details === void 0 ? {} : { details: error.details }
+//#region ../observability/src/engineering.ts
+const ENGINEERING_CAPXUL_ENVS = [
+	"development",
+	"staging",
+	"production",
+	"local"
+];
+const traceHeaderFilter = (_name) => true;
+const credentialHeaderPattern = Object.assign(/./u, { test: (name) => isCredentialField(name, "header") });
+const postHogOtlpEndpoints = (host) => {
+	const base = host.replace(/\/+$/, "");
+	return {
+		logs: `${base}/i/v1/logs`,
+		traces: `${base}/i/v1/traces`
+	};
+};
+const ENGINEERING_CAPXUL_ENV_SET = new Set(ENGINEERING_CAPXUL_ENVS);
+const ENGINEERING_PRODUCERS = /* @__PURE__ */ new Set(["browser", "server"]);
+const PUBLIC_POSTHOG_AUTHORIZATION = /^Bearer phc_[A-Za-z0-9_-]{1,191}$/u;
+const SAFE_RESOURCE_VALUE = /^[A-Za-z0-9][A-Za-z0-9._+@/-]{0,127}$/u;
+const validateEngineeringTelemetryConfig = (config) => {
+	let url;
+	try {
+		url = new URL(config.host);
+	} catch {
+		throw new TypeError("engineering telemetry host must be an absolute HTTPS URL");
+	}
+	if (url.protocol !== "https:" || url.username.length > 0 || url.password.length > 0 || url.pathname !== "/" || url.search.length > 0 || url.hash.length > 0 || !(url.hostname === "posthog.com" || url.hostname.endsWith(".posthog.com"))) throw new TypeError("engineering telemetry host must be a credential-free HTTPS origin");
+	if (!ENGINEERING_CAPXUL_ENV_SET.has(config.capxulEnv)) throw new TypeError("engineering telemetry capxulEnv is not canonical");
+	if (!ENGINEERING_PRODUCERS.has(config.producer)) throw new TypeError("engineering telemetry producer is not canonical");
+	if (!SAFE_RESOURCE_VALUE.test(config.sdkVersion)) throw new TypeError("engineering telemetry sdkVersion must be a bounded safe value");
+	if (config.serviceName !== void 0 && !SAFE_RESOURCE_VALUE.test(config.serviceName)) throw new TypeError("engineering telemetry serviceName must be a bounded safe value");
+	const headerEntries = Object.entries(config.headers);
+	if (headerEntries.length !== 1 || headerEntries[0]?.[0].toLowerCase() !== "authorization" || !PUBLIC_POSTHOG_AUTHORIZATION.test(headerEntries[0]?.[1] ?? "")) throw new TypeError("engineering telemetry headers must contain exactly one public PostHog authorization token");
+	return {
+		...config,
+		host: url.origin,
+		headers: Object.freeze({ authorization: headerEntries[0][1] })
+	};
+};
+const failureText = (failure, key, limit, source) => {
+	if (failure === null || typeof failure !== "object") return void 0;
+	try {
+		let owner = failure;
+		let descriptor;
+		for (let depth = 0; owner !== null && depth < 4; depth += 1) {
+			descriptor = Object.getOwnPropertyDescriptor(owner, key);
+			if (descriptor !== void 0 || key !== "name") break;
+			owner = Object.getPrototypeOf(owner);
+		}
+		const value = descriptor?.value;
+		return typeof value === "string" || key === "code" && typeof value === "number" ? redactSecrets(String(value), source).slice(0, limit) : void 0;
+	} catch {
+		return;
+	}
+};
+const exportFailure = (failure, source) => {
+	const message = failureText(failure, "message", 2048, source) ?? (typeof failure === "string" ? redactSecrets(failure, source).slice(0, 2048) : "Engineering operation failed");
+	const code = failureText(failure, "code", 128);
+	const error = new Error((code === void 0 ? message : `${message} [code=${code}]`).slice(0, 2048));
+	error.name = failureText(failure, "_tag", 128) ?? failureText(failure, "name", 128) ?? "Error";
+	error.stack = failureText(failure, "stack", 8192, source) ?? `${error.name}: ${error.message}`;
+	return error;
+};
+const exportFailureExit = (cause, source) => Exit.failCause(Cause.fromReasons(cause.reasons.filter((reason) => !Cause.isInterruptReason(reason)).slice(0, 8).map((reason) => Cause.isFailReason(reason) ? Cause.makeFailReason(exportFailure(reason.error, source)) : Cause.makeDieReason(exportFailure(reason.defect, source)))));
+const BROWSER_KEEPALIVE_BYTES = 65536;
+let unfinishedBrowserExportBytes = 0;
+const hasBrowserDocument = () => typeof window !== "undefined" && typeof document !== "undefined";
+const browserExportClient = (client) => HttpClient.transform(client, (response, request) => Effect.acquireUseRelease(Effect.sync(() => {
+	const bytes = "contentLength" in request.body ? request.body.contentLength : void 0;
+	if (request.body._tag === "Stream" || request.body._tag === "FormData" || bytes === void 0 || !Number.isSafeInteger(bytes) || bytes < 0 || unfinishedBrowserExportBytes + bytes > BROWSER_KEEPALIVE_BYTES) return;
+	unfinishedBrowserExportBytes += bytes;
+	return bytes;
+}), (bytes) => response.pipe(Effect.provideService(FetchHttpClient.RequestInit, { keepalive: bytes !== void 0 }), Effect.tap((result) => bytes === void 0 ? Effect.void : Stream.runDrain(result.stream).pipe(Effect.catch((error) => error.reason._tag === "EmptyBodyError" ? Effect.void : Effect.fail(error))))), (bytes) => Effect.sync(() => {
+	if (bytes !== void 0) unfinishedBrowserExportBytes -= bytes;
+})));
+const spanUpstream = (span) => {
+	let current = span;
+	while (current?._tag === "Span") {
+		const upstream = current.attributes.get("chain.upstream");
+		if (upstream === "alchemy" || upstream === "infura") return upstream;
+		current = current.parent._tag === "Some" ? current.parent.value : void 0;
+	}
+};
+/** Preserve domain exits while preventing the OTLP serializer from seeing raw causes. */
+const makeLeakSafeEngineeringTracer = (delegate) => Tracer.make({
+	span(options) {
+		const span = delegate.span(options);
+		const wrapped = Object.create(span);
+		Object.defineProperty(wrapped, "attribute", { value: (name, value) => {
+			const source = spanUpstream(span);
+			const header = /^http\.(?:request|response)\.header\.(.+)$/u.exec(name)?.[1];
+			if (header !== void 0 && isCredentialField(header, "header")) span.attribute(name, "[REDACTED]");
+			else if (typeof value === "string" && name === "url.query") span.attribute(name, redactUrlSecrets(`?${value}`).slice(1, 2049));
+			else if (typeof value === "string" && name === "url.path") {
+				const fullUrl = span.attributes.get("url.full");
+				const path = typeof fullUrl === "string" ? /^https?:\/\/[^/]+([^?#]*)/u.exec(fullUrl)?.[1] ?? value : value;
+				span.attribute(name, redactUrlSecrets(path, source).slice(0, 2048));
+			} else if (typeof value === "string" && (name === "url.full" || header === "location" || header === "referer" || header === "referrer")) span.attribute(name, redactUrlSecrets(value, source).slice(0, 2048));
+			else if (header !== void 0 && typeof value === "string") span.attribute(name, redactSecrets(value, source).slice(0, 2048));
+			else span.attribute(name, value);
+		} });
+		Object.defineProperty(wrapped, "end", {
+			configurable: false,
+			enumerable: false,
+			value: (endTime, exit) => {
+				if (Exit.isFailure(exit) && !Cause.hasInterruptsOnly(exit.cause)) {
+					const first = exit.cause.reasons.find((reason) => !Cause.isInterruptReason(reason));
+					const code = failureText(first === void 0 ? void 0 : Cause.isFailReason(first) ? first.error : first.defect, "code", 128);
+					if (code !== void 0) span.attribute("error.code", code);
+					span.end(endTime, exportFailureExit(exit.cause, spanUpstream(span)));
+				} else span.end(endTime, exit);
+			},
+			writable: false
+		});
+		return wrapped;
+	},
+	...delegate.context === void 0 ? {} : { context: delegate.context.bind(delegate) }
+});
+/** Shared browser/server OTLP layer. OtlpLogger merges with incumbent loggers once. */
+const makeEngineeringTelemetryLayer = (config) => {
+	const validated = validateEngineeringTelemetryConfig(config);
+	const endpoints = postHogOtlpEndpoints(validated.host);
+	const resource = {
+		serviceName: validated.serviceName ?? "capxul-sdk",
+		serviceVersion: validated.sdkVersion,
+		attributes: {
+			capxul_env: validated.capxulEnv,
+			producer: validated.producer,
+			sdk_version: validated.sdkVersion
+		}
+	};
+	const tracing = Layer.effect(Tracer.Tracer, OtlpTracer.make({
+		url: endpoints.traces,
+		headers: validated.headers,
+		resource
+	}).pipe(Effect.map(makeLeakSafeEngineeringTracer))).pipe(Layer.provideMerge(OtlpExporter.layerFlusher));
+	const logging = OtlpLogger.layer({
+		url: endpoints.logs,
+		headers: validated.headers,
+		resource,
+		mergeWithExisting: true
 	});
+	const headerPolicy = Layer.merge(Layer.succeed(HttpClient.TracerHeaderFilter, traceHeaderFilter), Layer.succeed(Headers.CurrentRedactedNames, [credentialHeaderPattern]));
+	const browserLifecycle = Layer.effectDiscard(Effect.gen(function* () {
+		if (validated.producer !== "browser" || !hasBrowserDocument()) return;
+		const browserWindow = window;
+		const browserDocument = document;
+		const flusher = yield* OtlpExporter.Flusher;
+		const run = yield* FiberSet.makeRuntime();
+		const flush = () => {
+			run(flusher.flush);
+		};
+		const visibilityChanged = () => {
+			if (browserDocument.visibilityState === "hidden") flush();
+		};
+		yield* Effect.acquireRelease(Effect.sync(() => {
+			browserDocument.addEventListener("visibilitychange", visibilityChanged);
+			browserWindow.addEventListener("pagehide", flush);
+		}), () => Effect.sync(() => {
+			browserDocument.removeEventListener("visibilitychange", visibilityChanged);
+			browserWindow.removeEventListener("pagehide", flush);
+		}));
+	}));
+	const transport = Layer.effect(HttpClient.HttpClient, Effect.map(HttpClient.HttpClient, (client) => validated.producer === "browser" && hasBrowserDocument() ? browserExportClient(client) : client)).pipe(Layer.provide(FetchHttpClient.layer));
+	return browserLifecycle.pipe(Layer.provideMerge(Layer.mergeAll(tracing, logging, headerPolicy)), Layer.provide(OtlpSerialization.layerJson), Layer.provide(transport));
+};
+//#endregion
+//#region src/adapters/auth-client/resolve-auth-url.ts
+/** Join bootstrap `authBaseUrl` with a BetterAuth route without duplicating `/api/auth`. */
+function resolveAuthClientUrl(authBaseUrl, path) {
+	const base = authBaseUrl.replace(/\/$/, "");
+	if (base.endsWith("/api/auth") && path.startsWith("/api/auth")) return `${base}${path.slice(9)}`;
+	return `${base}${path}`;
 }
-var AccountReadPortTag = class extends Context.Service()("@capxul/sdk/ports/AccountReadPort") {};
 //#endregion
-//#region src/ports/smart-account.ts
-var SmartAccountError = class extends Data.TaggedError("SmartAccountError") {};
-function smartAccountErrorFromCapxul(operation, error, cause = error) {
-	return new SmartAccountError({
-		operation,
-		publicCode: error.code,
-		publicError: error,
-		cause,
-		...error.details === void 0 ? {} : { details: error.details }
+//#region src/internal/observation-http.ts
+/** Resolve one bounded pre-auth snapshot for an outbound SDK HTTP request. */
+function observationRequestHeaders(adapter, source) {
+	if (adapter === void 0) return {};
+	try {
+		const invocation = readInvocationObservation(source);
+		if (invocation !== void 0 && !invocation.active) return {};
+		const encoded = encodeObservationContextHeader(invocation === void 0 ? adapter.resolveContext?.() : invocation.context);
+		return encoded === void 0 ? {} : { [OBSERVATION_CONTEXT_HEADER]: encoded };
+	} catch {
+		return {};
+	}
+}
+//#endregion
+//#region src/adapters/auth-client/BetterAuthBrowserAdapter.ts
+function withSignal$1(init, signal) {
+	return signal === void 0 ? init : {
+		...init,
+		signal
+	};
+}
+const DEFAULT_JWT_LIFETIME_S$1 = 900;
+function decodeJwtExp$1(jwt) {
+	const parts = jwt.split(".");
+	if (parts.length < 2 || parts[1] === void 0) return Math.floor(Date.now() / 1e3) + DEFAULT_JWT_LIFETIME_S$1;
+	try {
+		const raw = parts[1].replace(/\s+/g, "");
+		const pad = "=".repeat((4 - raw.length % 4) % 4);
+		const decoded = atob(raw.replace(/-/g, "+").replace(/_/g, "/") + pad);
+		const payload = JSON.parse(decoded);
+		if (typeof payload.exp === "number" && Number.isFinite(payload.exp) && payload.exp > 0) return payload.exp;
+	} catch {}
+	return Math.floor(Date.now() / 1e3) + DEFAULT_JWT_LIFETIME_S$1;
+}
+function authSessionFromBetterAuth$1(token, user) {
+	return {
+		authUserId: toAuthUserId(user.id),
+		email: toEmail(user.email),
+		token: toSessionToken(token),
+		expiresAt: toEpochMs(Date.now() + 6048e5)
+	};
+}
+async function safeJson$1(res) {
+	const raw = await res.text();
+	if (raw.length === 0 || raw === "null") return null;
+	try {
+		return JSON.parse(raw);
+	} catch {
+		return null;
+	}
+}
+function mapBetterAuthError(operation, body) {
+	if (typeof body === "object" && body !== null) {
+		const errBody = body;
+		const code = typeof errBody.code === "string" ? errBody.code : "";
+		if (code === "OTP_EXPIRED") return Errors.otpExpired();
+		if (code === "INVALID_OTP") return Errors.invalidInput("otp", errBody.message ?? "invalid OTP");
+		if (code === "VALIDATION_ERROR" || code === "INVALID_EMAIL") return Errors.invalidInput("email", errBody.message ?? "invalid email");
+	}
+	return Errors.providerError("better-auth", operation, new Error(String(body)));
+}
+function isAbortError$1(err, signal) {
+	return signal?.aborted === true || err instanceof Error && err.name === "AbortError" || typeof DOMException !== "undefined" && err instanceof DOMException && err.name === "AbortError";
+}
+function mapFetchError$1(operation, err, signal) {
+	if (isAbortError$1(err, signal)) return Errors.cancelled({ operation });
+	return Errors.networkError(operation, err instanceof Error ? err : new Error(String(err)));
+}
+var BetterAuthBrowserAdapter = class {
+	authBaseUrl;
+	fetchImpl;
+	observation;
+	constructor(deps) {
+		this.authBaseUrl = deps.authBaseUrl.replace(/\/$/, "");
+		this.observation = deps.observation;
+		this.fetchImpl = deps.fetch ?? ((input, init) => globalThis.fetch(input, init));
+	}
+	url(path) {
+		return resolveAuthClientUrl(this.authBaseUrl, path);
+	}
+	async canSendOtp(_input, options) {
+		if (options?.signal?.aborted) return {
+			ok: false,
+			error: Errors.cancelled({ operation: "canSendOtp" })
+		};
+		return {
+			ok: true,
+			value: {
+				allowed: true,
+				cooldownMs: toDurationMs(0)
+			}
+		};
+	}
+	async sendOtp(input, options) {
+		if (options?.signal?.aborted) return {
+			ok: false,
+			error: Errors.cancelled({ operation: "sendOtp" })
+		};
+		try {
+			const res = await this.fetchImpl(this.url("/api/auth/email-otp/send-verification-otp"), withSignal$1({
+				method: "POST",
+				headers: {
+					"Content-Type": "application/json",
+					...observationRequestHeaders(this.observation, input)
+				},
+				body: JSON.stringify({
+					email: input.email,
+					type: "sign-in"
+				}),
+				credentials: "include"
+			}, options?.signal));
+			if (options?.signal?.aborted) return {
+				ok: false,
+				error: Errors.cancelled({ operation: "sendOtp" })
+			};
+			if (res.ok) return {
+				ok: true,
+				value: void 0
+			};
+			if (res.status === 429) return {
+				ok: false,
+				error: Errors.rateLimited({ resource: "better-auth/sendOtp" })
+			};
+			const body = await safeJson$1(res);
+			if (typeof body === "object" && body !== null) {
+				const errBody = body;
+				if (errBody.code === "INVALID_EMAIL" || errBody.code === "VALIDATION_ERROR") return {
+					ok: false,
+					error: Errors.invalidInput("email", errBody.message ?? "invalid email")
+				};
+			}
+			return {
+				ok: false,
+				error: Errors.providerError("better-auth", "sendOtp", /* @__PURE__ */ new Error(`HTTP ${res.status}`))
+			};
+		} catch (err) {
+			return {
+				ok: false,
+				error: mapFetchError$1("sendOtp", err, options?.signal)
+			};
+		}
+	}
+	async verifyOtp(input, options) {
+		if (options?.signal?.aborted) return {
+			ok: false,
+			error: Errors.cancelled({ operation: "verifyOtp" })
+		};
+		try {
+			const res = await this.fetchImpl(this.url("/api/auth/sign-in/email-otp"), withSignal$1({
+				method: "POST",
+				headers: { "Content-Type": "application/json" },
+				body: JSON.stringify({
+					email: input.email,
+					otp: input.otp
+				}),
+				credentials: "include"
+			}, options?.signal));
+			if (options?.signal?.aborted) return {
+				ok: false,
+				error: Errors.cancelled({ operation: "verifyOtp" })
+			};
+			const body = await safeJson$1(res);
+			if (res.ok) {
+				if (typeof body === "object" && body !== null) {
+					const okBody = body;
+					if (typeof okBody.token === "string" && typeof okBody.user === "object" && okBody.user !== null) return {
+						ok: true,
+						value: authSessionFromBetterAuth$1(okBody.token, okBody.user)
+					};
+				}
+				return {
+					ok: false,
+					error: Errors.providerError("better-auth", "verifyOtp", /* @__PURE__ */ new Error("unexpected 200 body"))
+				};
+			}
+			return {
+				ok: false,
+				error: mapBetterAuthError("verifyOtp", body)
+			};
+		} catch (err) {
+			return {
+				ok: false,
+				error: mapFetchError$1("verifyOtp", err, options?.signal)
+			};
+		}
+	}
+	async getSession(options) {
+		if (options?.signal?.aborted) return {
+			ok: false,
+			error: Errors.cancelled({ operation: "getSession" })
+		};
+		try {
+			const res = await this.fetchImpl(this.url("/api/auth/get-session"), withSignal$1({
+				method: "GET",
+				credentials: "include"
+			}, options?.signal));
+			if (options?.signal?.aborted) return {
+				ok: false,
+				error: Errors.cancelled({ operation: "getSession" })
+			};
+			if (!res.ok) return {
+				ok: false,
+				error: Errors.providerError("better-auth", "getSession", /* @__PURE__ */ new Error(`HTTP ${res.status}`))
+			};
+			const body = await safeJson$1(res);
+			if (body === null) return {
+				ok: true,
+				value: null
+			};
+			if (typeof body === "object" && body !== null) {
+				const okBody = body;
+				if (typeof okBody.user === "object" && okBody.user !== null) return {
+					ok: true,
+					value: authSessionFromBetterAuth$1(okBody.session?.token ?? okBody.session?.id ?? "session", okBody.user)
+				};
+			}
+			return {
+				ok: true,
+				value: null
+			};
+		} catch (err) {
+			return {
+				ok: false,
+				error: mapFetchError$1("getSession", err, options?.signal)
+			};
+		}
+	}
+	async signOut(options) {
+		if (options?.signal?.aborted) return {
+			ok: false,
+			error: Errors.cancelled({ operation: "signOut" })
+		};
+		try {
+			const res = await this.fetchImpl(this.url("/api/auth/sign-out"), withSignal$1({
+				method: "POST",
+				headers: { "Content-Type": "application/json" },
+				body: "{}",
+				credentials: "include"
+			}, options?.signal));
+			if (options?.signal?.aborted) return {
+				ok: false,
+				error: Errors.cancelled({ operation: "signOut" })
+			};
+			if (res.ok) return {
+				ok: true,
+				value: void 0
+			};
+			return {
+				ok: false,
+				error: Errors.providerError("better-auth", "signOut", /* @__PURE__ */ new Error(`HTTP ${res.status}`))
+			};
+		} catch (err) {
+			return {
+				ok: false,
+				error: mapFetchError$1("signOut", err, options?.signal)
+			};
+		}
+	}
+	async getConvexJwt(options) {
+		if (options?.signal?.aborted) return {
+			ok: false,
+			error: Errors.cancelled({ operation: "getConvexJwt" })
+		};
+		try {
+			const res = await this.fetchImpl(this.url("/api/auth/convex/token"), withSignal$1({
+				method: "GET",
+				credentials: "include"
+			}, options?.signal));
+			if (options?.signal?.aborted) return {
+				ok: false,
+				error: Errors.cancelled({ operation: "getConvexJwt" })
+			};
+			if (res.status === 401) return {
+				ok: false,
+				error: Errors.notAuthenticated()
+			};
+			if (!res.ok) return {
+				ok: false,
+				error: Errors.providerError("better-auth", "getConvexJwt", /* @__PURE__ */ new Error(`HTTP ${res.status}`))
+			};
+			const body = await safeJson$1(res);
+			if (typeof body === "object" && body !== null) {
+				const okBody = body;
+				if (typeof okBody.token === "string" && okBody.token.length > 0) return {
+					ok: true,
+					value: {
+						token: toJwtToken(okBody.token),
+						expEpochSeconds: toEpochSeconds(decodeJwtExp$1(okBody.token))
+					}
+				};
+			}
+			return {
+				ok: false,
+				error: Errors.providerError("better-auth", "getConvexJwt", /* @__PURE__ */ new Error("unexpected body"))
+			};
+		} catch (err) {
+			return {
+				ok: false,
+				error: mapFetchError$1("getConvexJwt", err, options?.signal)
+			};
+		}
+	}
+};
+function BetterAuthBrowserLayer(deps) {
+	return Layer.succeed(AuthClientPortTag, authClientPortFromPromiseAdapter(new BetterAuthBrowserAdapter(deps)));
+}
+//#endregion
+//#region src/adapters/auth-client/cookie-jar.ts
+function parseSetCookie(raw) {
+	const parts = raw.split(";").map((p) => p.trim());
+	if (parts.length === 0 || parts[0] === void 0) return null;
+	const nameValue = parts[0];
+	const eq = nameValue.indexOf("=");
+	if (eq < 0) return null;
+	const name = nameValue.slice(0, eq).trim();
+	const value = nameValue.slice(eq + 1).trim();
+	if (name.length === 0) return null;
+	let maxAgeSeconds = null;
+	let expiresEpochMs = null;
+	let path = null;
+	let httpOnly = false;
+	let secure = false;
+	let sameSite = null;
+	for (let i = 1; i < parts.length; i++) {
+		const part = parts[i];
+		if (part === void 0) continue;
+		const partEq = part.indexOf("=");
+		const key = (partEq < 0 ? part : part.slice(0, partEq)).trim().toLowerCase();
+		const val = partEq < 0 ? "" : part.slice(partEq + 1).trim();
+		if (key === "max-age") {
+			const n = Number(val);
+			if (Number.isFinite(n)) maxAgeSeconds = n;
+		} else if (key === "expires") {
+			const t = Date.parse(val);
+			if (Number.isFinite(t)) expiresEpochMs = t;
+		} else if (key === "path") path = val;
+		else if (key === "httponly") httpOnly = true;
+		else if (key === "secure") secure = true;
+		else if (key === "samesite") {
+			const lc = val.toLowerCase();
+			if (lc === "strict" || lc === "lax" || lc === "none") sameSite = lc;
+		}
+	}
+	return {
+		name,
+		value,
+		maxAgeSeconds,
+		expiresEpochMs,
+		path,
+		httpOnly,
+		secure,
+		sameSite
+	};
+}
+function isExpired(cookie, nowEpochMs) {
+	if (cookie.maxAgeSeconds !== null) {
+		if (cookie.maxAgeSeconds <= 0) return true;
+		return nowEpochMs >= cookie.storedAtEpochMs + cookie.maxAgeSeconds * 1e3;
+	}
+	if (cookie.expiresEpochMs !== null) return nowEpochMs >= cookie.expiresEpochMs;
+	return false;
+}
+var CookieJar = class {
+	store = /* @__PURE__ */ new Map();
+	set(host, setCookieHeaders) {
+		let perHost = this.store.get(host);
+		const now = Date.now();
+		for (const raw of setCookieHeaders) {
+			const parsed = parseSetCookie(raw);
+			if (parsed === null) continue;
+			if (perHost === void 0) {
+				perHost = /* @__PURE__ */ new Map();
+				this.store.set(host, perHost);
+			}
+			if (parsed.maxAgeSeconds !== null && parsed.maxAgeSeconds <= 0) {
+				perHost.delete(parsed.name);
+				continue;
+			}
+			perHost.set(parsed.name, {
+				...parsed,
+				storedAtEpochMs: now
+			});
+		}
+		if (perHost !== void 0 && perHost.size === 0) this.store.delete(host);
+	}
+	getCookieHeader(host) {
+		const perHost = this.store.get(host);
+		if (perHost === void 0 || perHost.size === 0) return null;
+		const now = Date.now();
+		const live = [];
+		for (const [name, cookie] of perHost.entries()) {
+			if (isExpired(cookie, now)) {
+				perHost.delete(name);
+				continue;
+			}
+			live.push(`${name}=${cookie.value}`);
+		}
+		if (live.length === 0) {
+			this.store.delete(host);
+			return null;
+		}
+		return live.join("; ");
+	}
+};
+//#endregion
+//#region src/adapters/auth-client/BetterAuthNodeAdapter.ts
+function withSignal(init, signal) {
+	return signal === void 0 ? init : {
+		...init,
+		signal
+	};
+}
+const DEFAULT_JWT_LIFETIME_S = 900;
+function decodeJwtExp(jwt) {
+	const parts = jwt.split(".");
+	if (parts.length < 2 || parts[1] === void 0) return Math.floor(Date.now() / 1e3) + DEFAULT_JWT_LIFETIME_S;
+	try {
+		const raw = parts[1].replace(/\s+/g, "");
+		const pad = "=".repeat((4 - raw.length % 4) % 4);
+		const decoded = Buffer.from(raw.replace(/-/g, "+").replace(/_/g, "/") + pad, "base64").toString("utf-8");
+		const payload = JSON.parse(decoded);
+		if (typeof payload.exp === "number" && Number.isFinite(payload.exp) && payload.exp > 0) return payload.exp;
+	} catch {}
+	return Math.floor(Date.now() / 1e3) + DEFAULT_JWT_LIFETIME_S;
+}
+function authSessionFromBetterAuth(token, user) {
+	return {
+		authUserId: toAuthUserId(user.id),
+		email: toEmail(user.email),
+		token: toSessionToken(token),
+		expiresAt: toEpochMs(Date.now() + 6048e5)
+	};
+}
+async function safeJson(res) {
+	const raw = await res.text();
+	if (raw.length === 0 || raw === "null") return null;
+	try {
+		return JSON.parse(raw);
+	} catch {
+		return null;
+	}
+}
+function hostFromBaseUrl(baseUrl) {
+	try {
+		return new URL(baseUrl).host;
+	} catch {
+		return baseUrl;
+	}
+}
+function originFromBaseUrl(baseUrl) {
+	try {
+		return new URL(baseUrl).origin;
+	} catch {
+		return;
+	}
+}
+function setCookiesFromResponse(jar, host, res) {
+	const ext = res.headers;
+	let setCookies = [];
+	if (typeof ext.getSetCookie === "function") setCookies = ext.getSetCookie();
+	else res.headers.forEach((value, key) => {
+		if (key.toLowerCase() === "set-cookie") setCookies.push(value);
 	});
+	if (setCookies.length > 0) jar.set(host, setCookies);
+}
+function isAbortError(err, signal) {
+	return signal?.aborted === true || err instanceof Error && err.name === "AbortError" || typeof DOMException !== "undefined" && err instanceof DOMException && err.name === "AbortError";
+}
+function mapFetchError(operation, err, signal) {
+	if (isAbortError(err, signal)) return Errors.cancelled({ operation });
+	return Errors.networkError(operation, err instanceof Error ? err : new Error(String(err)));
+}
+var BetterAuthNodeAdapter = class {
+	authBaseUrl;
+	host;
+	origin;
+	cookieJar;
+	fetchImpl;
+	observation;
+	constructor(deps) {
+		this.authBaseUrl = deps.authBaseUrl.replace(/\/$/, "");
+		this.host = hostFromBaseUrl(this.authBaseUrl);
+		this.origin = deps.origin?.replace(/\/$/, "");
+		this.cookieJar = deps.cookieJar ?? new CookieJar();
+		this.fetchImpl = deps.fetch ?? fetch;
+		this.observation = deps.observation;
+	}
+	url(path) {
+		return resolveAuthClientUrl(this.authBaseUrl, path);
+	}
+	headersWithCookie(extra = {}) {
+		const cookie = this.cookieJar.getCookieHeader(this.host);
+		return cookie !== null ? {
+			...extra,
+			cookie
+		} : { ...extra };
+	}
+	async canSendOtp(_input, options) {
+		if (options?.signal?.aborted) return {
+			ok: false,
+			error: Errors.cancelled({ operation: "canSendOtp" })
+		};
+		return {
+			ok: true,
+			value: {
+				allowed: true,
+				cooldownMs: toDurationMs(0)
+			}
+		};
+	}
+	async sendOtp(input, options) {
+		if (options?.signal?.aborted) return {
+			ok: false,
+			error: Errors.cancelled({ operation: "sendOtp" })
+		};
+		try {
+			const res = await this.fetchImpl(this.url("/api/auth/email-otp/send-verification-otp"), withSignal({
+				method: "POST",
+				headers: {
+					"content-type": "application/json",
+					...this.origin ? { origin: this.origin } : {},
+					...observationRequestHeaders(this.observation, input)
+				},
+				body: JSON.stringify({
+					email: input.email,
+					type: "sign-in"
+				})
+			}, options?.signal));
+			if (options?.signal?.aborted) return {
+				ok: false,
+				error: Errors.cancelled({ operation: "sendOtp" })
+			};
+			if (res.ok) return {
+				ok: true,
+				value: void 0
+			};
+			if (res.status === 429) return {
+				ok: false,
+				error: Errors.rateLimited({ resource: "better-auth/sendOtp" })
+			};
+			const body = await safeJson(res);
+			if (typeof body === "object" && body !== null) {
+				const errBody = body;
+				if (errBody.code === "INVALID_EMAIL" || errBody.code === "VALIDATION_ERROR") return {
+					ok: false,
+					error: Errors.invalidInput("email", errBody.message ?? "invalid email")
+				};
+			}
+			return {
+				ok: false,
+				error: Errors.providerError("better-auth", "sendOtp", /* @__PURE__ */ new Error(`HTTP ${res.status}`))
+			};
+		} catch (err) {
+			return {
+				ok: false,
+				error: mapFetchError("sendOtp", err, options?.signal)
+			};
+		}
+	}
+	async verifyOtp(input, options) {
+		if (options?.signal?.aborted) return {
+			ok: false,
+			error: Errors.cancelled({ operation: "verifyOtp" })
+		};
+		try {
+			const res = await this.fetchImpl(this.url("/api/auth/sign-in/email-otp"), withSignal({
+				method: "POST",
+				headers: {
+					"content-type": "application/json",
+					...this.origin ? { origin: this.origin } : {}
+				},
+				body: JSON.stringify({
+					email: input.email,
+					otp: input.otp
+				})
+			}, options?.signal));
+			if (options?.signal?.aborted) return {
+				ok: false,
+				error: Errors.cancelled({ operation: "verifyOtp" })
+			};
+			setCookiesFromResponse(this.cookieJar, this.host, res);
+			const body = await safeJson(res);
+			if (res.ok && typeof body === "object" && body !== null) {
+				const okBody = body;
+				if (typeof okBody.token === "string" && typeof okBody.user === "object" && okBody.user !== null) return {
+					ok: true,
+					value: authSessionFromBetterAuth(okBody.token, okBody.user)
+				};
+			}
+			if (!res.ok) {
+				if (typeof body === "object" && body !== null) {
+					const errBody = body;
+					if (errBody.code === "OTP_EXPIRED") return {
+						ok: false,
+						error: Errors.otpExpired()
+					};
+					if (errBody.code === "INVALID_OTP") return {
+						ok: false,
+						error: Errors.invalidInput("otp", errBody.message ?? "invalid OTP")
+					};
+				}
+			}
+			return {
+				ok: false,
+				error: Errors.providerError("better-auth", "verifyOtp", /* @__PURE__ */ new Error(`HTTP ${res.status}`))
+			};
+		} catch (err) {
+			return {
+				ok: false,
+				error: mapFetchError("verifyOtp", err, options?.signal)
+			};
+		}
+	}
+	async getSession(options) {
+		if (options?.signal?.aborted) return {
+			ok: false,
+			error: Errors.cancelled({ operation: "getSession" })
+		};
+		try {
+			const res = await this.fetchImpl(this.url("/api/auth/get-session"), withSignal({
+				method: "GET",
+				headers: this.headersWithCookie()
+			}, options?.signal));
+			if (options?.signal?.aborted) return {
+				ok: false,
+				error: Errors.cancelled({ operation: "getSession" })
+			};
+			if (!res.ok) return {
+				ok: false,
+				error: Errors.providerError("better-auth", "getSession", /* @__PURE__ */ new Error(`HTTP ${res.status}`))
+			};
+			const body = await safeJson(res);
+			if (body === null) return {
+				ok: true,
+				value: null
+			};
+			if (typeof body === "object" && body !== null) {
+				const okBody = body;
+				if (typeof okBody.user === "object" && okBody.user !== null) return {
+					ok: true,
+					value: authSessionFromBetterAuth(okBody.session?.token ?? okBody.session?.id ?? "session", okBody.user)
+				};
+			}
+			return {
+				ok: true,
+				value: null
+			};
+		} catch (err) {
+			return {
+				ok: false,
+				error: mapFetchError("getSession", err, options?.signal)
+			};
+		}
+	}
+	async signOut(options) {
+		if (options?.signal?.aborted) return {
+			ok: false,
+			error: Errors.cancelled({ operation: "signOut" })
+		};
+		try {
+			const signOutOrigin = originFromBaseUrl(this.authBaseUrl) ?? this.origin;
+			const res = await this.fetchImpl(this.url("/api/auth/sign-out"), withSignal({
+				method: "POST",
+				headers: this.headersWithCookie({
+					"content-type": "application/json",
+					...signOutOrigin ? { origin: signOutOrigin } : {}
+				}),
+				body: "{}"
+			}, options?.signal));
+			if (options?.signal?.aborted) return {
+				ok: false,
+				error: Errors.cancelled({ operation: "signOut" })
+			};
+			setCookiesFromResponse(this.cookieJar, this.host, res);
+			if (res.ok) return {
+				ok: true,
+				value: void 0
+			};
+			return {
+				ok: false,
+				error: Errors.providerError("better-auth", "signOut", /* @__PURE__ */ new Error(`HTTP ${res.status}`))
+			};
+		} catch (err) {
+			return {
+				ok: false,
+				error: mapFetchError("signOut", err, options?.signal)
+			};
+		}
+	}
+	async getConvexJwt(options) {
+		if (options?.signal?.aborted) return {
+			ok: false,
+			error: Errors.cancelled({ operation: "getConvexJwt" })
+		};
+		try {
+			const res = await this.fetchImpl(this.url("/api/auth/convex/token"), withSignal({
+				method: "GET",
+				headers: this.headersWithCookie()
+			}, options?.signal));
+			if (options?.signal?.aborted) return {
+				ok: false,
+				error: Errors.cancelled({ operation: "getConvexJwt" })
+			};
+			if (res.status === 401) return {
+				ok: false,
+				error: Errors.notAuthenticated()
+			};
+			if (!res.ok) return {
+				ok: false,
+				error: Errors.providerError("better-auth", "getConvexJwt", /* @__PURE__ */ new Error(`HTTP ${res.status}`))
+			};
+			const body = await safeJson(res);
+			if (typeof body === "object" && body !== null) {
+				const okBody = body;
+				if (typeof okBody.token === "string" && okBody.token.length > 0) return {
+					ok: true,
+					value: {
+						token: toJwtToken(okBody.token),
+						expEpochSeconds: toEpochSeconds(decodeJwtExp(okBody.token))
+					}
+				};
+			}
+			return {
+				ok: false,
+				error: Errors.providerError("better-auth", "getConvexJwt", /* @__PURE__ */ new Error("unexpected body"))
+			};
+		} catch (err) {
+			return {
+				ok: false,
+				error: mapFetchError("getConvexJwt", err, options?.signal)
+			};
+		}
+	}
+};
+function BetterAuthNodeLayer(deps) {
+	return Layer.succeed(AuthClientPortTag, authClientPortFromPromiseAdapter(new BetterAuthNodeAdapter(deps)));
+}
+//#endregion
+//#region src/ports/bootstrap.ts
+var BootstrapError = class extends Data.TaggedError("BootstrapError") {};
+function bootstrapErrorFromCapxul(kind, error) {
+	return new BootstrapError({
+		operation: "resolve",
+		kind,
+		publicCode: error.code,
+		cause: error,
+		...kind === "notAuthenticated" || error.details === void 0 ? {} : { details: error.details }
+	});
+}
+var BootstrapPortTag = class extends Context.Service()("@capxul/sdk/ports/BootstrapPort") {};
+//#endregion
+//#region src/adapters/bootstrap/HttpBootstrapAdapter.ts
+const DEFAULT_RETRY = {
+	attempts: 2,
+	baseDelayMs: 400
+};
+/** Request-side statuses a proxy or backend returns while momentarily unable to serve. */
+const TRANSIENT_HTTP_STATUSES = /* @__PURE__ */ new Set([
+	408,
+	425,
+	429
+]);
+/** Every 5xx is a server-side condition worth one more try; the client sent nothing wrong. */
+function isTransientHttpStatus(status) {
+	return status >= 500 || TRANSIENT_HTTP_STATUSES.has(status);
+}
+/**
+* A transient HTTP status is worth one more try. The bootstrap call crosses
+* the host's own proxy before it reaches Convex, and every observed failure
+* of that hop cleared on a retry seconds later. A network rejection (offline,
+* DNS, CORS) is not retried: it does not clear in a second, and the caller
+* surfaces it as `NETWORK_ERROR` at once. Auth and input rejections are
+* deterministic and never retried.
+*/
+function isTransientBootstrapFailure(error) {
+	if (error.kind !== "provider") return false;
+	const status = error.details?.httpStatus;
+	return typeof status === "number" && isTransientHttpStatus(status);
+}
+async function safeText(res) {
+	try {
+		return await res.text();
+	} catch {
+		return "";
+	}
+}
+var HttpBootstrapAdapter = class {
+	bootstrapBaseUrl;
+	bootstrapHost;
+	fetchImpl;
+	observation;
+	retry;
+	constructor(deps) {
+		this.bootstrapBaseUrl = deps.bootstrapBaseUrl.replace(/\/$/, "");
+		this.bootstrapHost = hostOf(this.bootstrapBaseUrl);
+		this.observation = deps.observation;
+		this.retry = deps.retry ?? DEFAULT_RETRY;
+		this.fetchImpl = deps.fetch ?? ((input, init) => globalThis.fetch(input, init));
+	}
+	resolve(input) {
+		return this.attempt(input).pipe(Effect.retry({
+			times: this.retry.attempts,
+			while: isTransientBootstrapFailure,
+			schedule: Schedule.exponential(Duration.millis(this.retry.baseDelayMs))
+		}));
+	}
+	attempt(input) {
+		return Effect.tryPromise({
+			try: () => {
+				const headers = {
+					"content-type": "application/json",
+					...input.origin === void 0 ? {} : { origin: input.origin },
+					...observationRequestHeaders(this.observation)
+				};
+				return this.fetchImpl(`${this.bootstrapBaseUrl}/v1/client/bootstrap`, {
+					method: "POST",
+					headers,
+					body: JSON.stringify({ publishableKey: input.publishableKey })
+				});
+			},
+			catch: (cause) => bootstrapErrorFromCapxul("network", Errors.networkError("bootstrap", cause, {
+				provider: "bootstrap",
+				failure_mode: "upstream-down",
+				...this.bootstrapHost === void 0 ? {} : { target_host: this.bootstrapHost }
+			}))
+		}).pipe(Effect.flatMap((res) => this.mapResponse(res)));
+	}
+	mapResponse(res) {
+		if (res.ok) return Effect.tryPromise({
+			try: async () => {
+				const body = await res.json();
+				const state = typeof body === "object" && body !== null && "state" in body && typeof body.state === "object" && body.state !== null ? body.state : void 0;
+				const rawEngineeringTelemetry = state?.engineeringTelemetry;
+				const baseBody = state === void 0 || rawEngineeringTelemetry === void 0 ? body : {
+					...body,
+					state: Object.fromEntries(Object.entries(state).filter(([key]) => key !== "engineeringTelemetry"))
+				};
+				const decoded = SchemaParser.decodeUnknownResult(BootstrapEnvelope)(baseBody);
+				if (Result.isFailure(decoded)) throw Errors.invalidInput("bootstrapEnvelope", SchemaIssue.makeFormatterDefault()(decoded.failure));
+				const { state: decodedState } = decoded.success;
+				const decodedEngineeringTelemetry = rawEngineeringTelemetry === void 0 ? void 0 : SchemaParser.decodeUnknownResult(EngineeringTelemetryBootstrapPolicy)(rawEngineeringTelemetry, { onExcessProperty: "error" });
+				return {
+					applicationId: decodedState.applicationId,
+					chainId: decodedState.chainId,
+					sessionToken: decodedState.sessionToken,
+					issuedAt: decodedState.issuedAt,
+					expiresIn: decodedState.expiresIn,
+					authBaseUrl: normalizeRuntimeUrl("authBaseUrl", decodedState.authBaseUrl),
+					convexUrl: normalizeRuntimeUrl("convexUrl", decodedState.convexUrl),
+					siteBaseUrl: normalizeRuntimeUrl("siteBaseUrl", decodedState.siteBaseUrl),
+					openfortPublishableKey: decodedState.openfortPublishableKey,
+					shieldPublishableKey: decodedState.shieldPublishableKey,
+					...decodedEngineeringTelemetry !== void 0 && Result.isSuccess(decodedEngineeringTelemetry) ? { engineeringTelemetry: decodedEngineeringTelemetry.success } : {}
+				};
+			},
+			catch: (cause) => {
+				if (cause instanceof CapxulError && cause.code === "INVALID_INPUT") return bootstrapErrorFromCapxul("invalidInput", cause);
+				return bootstrapErrorFromCapxul("malformedBody", Errors.providerError("convex", "bootstrap", cause instanceof Error ? cause : new Error(String(cause))));
+			}
+		});
+		return Effect.promise(() => safeText(res)).pipe(Effect.flatMap((body) => {
+			if (res.status === 401 || body.startsWith("NOT_AUTHENTICATED")) return Effect.fail(bootstrapErrorFromCapxul("notAuthenticated", Errors.notAuthenticated()));
+			if (res.status === 400 || body.startsWith("INVALID_INPUT")) return Effect.fail(bootstrapErrorFromCapxul("invalidInput", Errors.invalidInput("publishableKey", "rejected by bootstrap")));
+			const responseBody = body.slice(0, 300);
+			const edgeError = res.headers?.get?.("x-vercel-error") ?? void 0;
+			const edgeRequestId = res.headers?.get?.("x-vercel-id") ?? void 0;
+			return Effect.fail(bootstrapErrorFromCapxul("provider", Errors.providerError("convex", "bootstrap", /* @__PURE__ */ new Error(`HTTP ${res.status}${edgeError === void 0 ? "" : ` ${edgeError}`}`), {
+				httpStatus: res.status,
+				details: {
+					...responseBody.length === 0 ? {} : { responseBody },
+					...edgeError === void 0 ? {} : { edgeError },
+					...edgeRequestId === void 0 ? {} : { edgeRequestId }
+				}
+			})));
+		}));
+	}
+};
+function HttpBootstrapLayer(deps) {
+	return Layer.succeed(BootstrapPortTag, new HttpBootstrapAdapter(deps));
+}
+function hostOf(url) {
+	try {
+		return new URL(url).hostname;
+	} catch {
+		return;
+	}
+}
+function normalizeRuntimeUrl(field, raw) {
+	let parsed;
+	try {
+		parsed = new URL(raw);
+	} catch {
+		throw Errors.invalidInput(field, "must be an http or https URL");
+	}
+	if (parsed.protocol !== "http:" && parsed.protocol !== "https:") throw Errors.invalidInput(field, "must be an http or https URL");
+	return parsed.toString().replace(/\/$/, "");
+}
+//#endregion
+//#region src/ports/convex-call.ts
+var ConvexCallError = class extends Data.TaggedError("ConvexCallError") {};
+function convexCallErrorFromCapxul(operation, error, transport) {
+	return new ConvexCallError({
+		operation,
+		publicCode: error.code,
+		publicError: error,
+		cause: error,
+		...error.details === void 0 ? {} : { details: error.details },
+		...transport === void 0 ? {} : { transport }
+	});
+}
+var ConvexCallPortTag = class extends Context.Service()("@capxul/sdk/ports/ConvexCallPort") {};
+//#endregion
+//#region src/adapters/convex-call/convex-connection-monitor.ts
+var ConvexConnectionMonitor = class {
+	#connectionId = makeConnectionId();
+	#browser = new BrowserLifecycleMonitor();
+	#lastClose;
+	observedWebSocketConstructor() {
+		const NativeWebSocket = globalThis.WebSocket;
+		if (typeof globalThis.window === "undefined" || NativeWebSocket === void 0) return void 0;
+		return new Proxy(NativeWebSocket, { construct: (Target, args) => {
+			const socket = Reflect.construct(Target, args);
+			socket.addEventListener("close", (event) => {
+				this.#lastClose = this.#browser.socketClose(event);
+			});
+			return socket;
+		} });
+	}
+	close() {
+		this.#browser.close();
+	}
+	observe(client, observer) {
+		const subscribe = client.subscribeToConnectionState?.bind(client);
+		if (subscribe === void 0) return () => this.#browser.close();
+		let previous;
+		const unsubscribe = subscribe((next) => {
+			const diagnostics = this.#diagnostics(previous, next);
+			previous = next;
+			for (const diagnostic of diagnostics) emitDiagnostic(observer, diagnostic);
+		});
+		if (previous === void 0) {
+			const current = safeConnectionState(client);
+			if (current !== void 0) {
+				previous = current;
+				for (const diagnostic of this.#diagnostics(void 0, current)) emitDiagnostic(observer, diagnostic);
+			}
+		}
+		let closed = false;
+		return () => {
+			if (closed) return;
+			closed = true;
+			try {
+				unsubscribe();
+			} finally {
+				this.#browser.close();
+			}
+		};
+	}
+	reconnectEvidence(start, end) {
+		if (!connectionRestarted(start, end)) return void 0;
+		return {
+			kind: "connection-lost-in-flight",
+			connection_id: this.#connectionId,
+			start_connection_count: start.connectionCount,
+			connection_count: end.connectionCount,
+			...end.connectionRetries === void 0 ? {} : { connection_retries: end.connectionRetries },
+			...closeFields(this.#lastClose)
+		};
+	}
+	#diagnostics(previous, next) {
+		const transitions = connectionTransitions(previous, next);
+		if (transitions.length === 0) return [];
+		const oldest = next.timeOfOldestInflightRequest;
+		const oldestInflightMs = oldest instanceof Date && Number.isFinite(oldest.getTime()) ? Math.max(0, Date.now() - oldest.getTime()) : void 0;
+		return transitions.map((transition) => ({
+			connection_id: this.#connectionId,
+			transition,
+			previous_connected: previous?.isWebSocketConnected ?? false,
+			connected: next.isWebSocketConnected,
+			...next.hasEverConnected === void 0 ? {} : { has_ever_connected: next.hasEverConnected },
+			connection_count: next.connectionCount,
+			...next.connectionRetries === void 0 ? {} : { connection_retries: next.connectionRetries },
+			...next.hasInflightRequests === void 0 ? {} : { has_inflight_requests: next.hasInflightRequests },
+			...next.inflightActions === void 0 ? {} : { inflight_actions: next.inflightActions },
+			...next.inflightMutations === void 0 ? {} : { inflight_mutations: next.inflightMutations },
+			...oldestInflightMs === void 0 ? {} : { oldest_inflight_ms: oldestInflightMs },
+			...closeFields(this.#lastClose)
+		}));
+	}
+};
+function connectionRestarted(start, end) {
+	if (start === void 0 || end === void 0) return false;
+	const opensBeforeCancellation = start.isWebSocketConnected ? 1 : 2;
+	return end.connectionCount >= start.connectionCount + opensBeforeCancellation;
+}
+function connectionTransitions(previous, next) {
+	if (previous === void 0) {
+		if (next.isWebSocketConnected) return (next.connectionRetries ?? 0) > 0 ? ["retrying", "connected"] : ["connected"];
+		return (next.connectionRetries ?? 0) > 0 ? ["disconnected", "retrying"] : [];
+	}
+	const transitions = [];
+	if (previous.isWebSocketConnected !== next.isWebSocketConnected) transitions.push(next.isWebSocketConnected ? "connected" : "disconnected");
+	if ((next.connectionRetries ?? 0) > (previous.connectionRetries ?? 0)) transitions.push("retrying");
+	return transitions;
+}
+function emitDiagnostic(observer, diagnostic) {
+	try {
+		observer(diagnostic);
+	} catch {}
+}
+function safeConnectionState(client) {
+	try {
+		return client.connectionState?.();
+	} catch {
+		return;
+	}
+}
+function closeFields(close) {
+	if (close === void 0) return {};
+	return {
+		close_code: close.code,
+		close_was_clean: close.wasClean,
+		close_reason_present: close.reasonPresent,
+		...close.documentVisibility === void 0 ? {} : { document_visibility: close.documentVisibility },
+		...close.navigatorOnline === void 0 ? {} : { navigator_online: close.navigatorOnline },
+		...close.browserEvent === void 0 ? {} : { last_browser_event: close.browserEvent },
+		...close.msSinceBrowserEvent === void 0 ? {} : { ms_since_browser_event: close.msSinceBrowserEvent }
+	};
+}
+var BrowserLifecycleMonitor = class {
+	#listeners = [];
+	#last = {};
+	constructor() {
+		const windowTarget = eventTarget(globalThis.window);
+		const documentTarget = eventTarget(globalThis.document);
+		if (windowTarget === void 0 || documentTarget === void 0) return;
+		this.#listen(documentTarget, "visibilitychange", () => {
+			this.#record(globalThis.document?.visibilityState === "hidden" ? "visibility-hidden" : "visibility-visible");
+		});
+		this.#listen(windowTarget, "pagehide", () => this.#record("pagehide"));
+		this.#listen(windowTarget, "pageshow", () => this.#record("pageshow"));
+		this.#listen(windowTarget, "online", () => this.#record("online"));
+		this.#listen(windowTarget, "offline", () => this.#record("offline"));
+	}
+	socketClose(event) {
+		const now = Date.now();
+		return {
+			code: event.code,
+			wasClean: event.wasClean,
+			reasonPresent: event.reason.length > 0,
+			...this.#last.event === void 0 ? {} : { browserEvent: this.#last.event },
+			...this.#last.at === void 0 ? {} : { msSinceBrowserEvent: Math.max(0, now - this.#last.at) },
+			...globalThis.document?.visibilityState === void 0 ? {} : { documentVisibility: globalThis.document.visibilityState },
+			...globalThis.navigator?.onLine === void 0 ? {} : { navigatorOnline: globalThis.navigator.onLine }
+		};
+	}
+	close() {
+		for (const [target, name, listener] of this.#listeners) target.removeEventListener(name, listener);
+		this.#listeners.length = 0;
+	}
+	#listen(target, name, listener) {
+		target.addEventListener(name, listener);
+		this.#listeners.push([
+			target,
+			name,
+			listener
+		]);
+	}
+	#record(event) {
+		this.#last = {
+			event,
+			at: Date.now()
+		};
+	}
+};
+function eventTarget(value) {
+	if (typeof value !== "object" || value === null || !("addEventListener" in value) || typeof value.addEventListener !== "function" || !("removeEventListener" in value) || typeof value.removeEventListener !== "function") return;
+	return value;
+}
+let fallbackConnectionId = 0;
+function makeConnectionId() {
+	try {
+		return `convex_${globalThis.crypto.randomUUID()}`;
+	} catch {
+		fallbackConnectionId += 1;
+		return `convex_${Date.now().toString(36)}_${fallbackConnectionId.toString(36)}`;
+	}
+}
+//#endregion
+//#region src/adapters/convex-call/ConvexCallAdapter.ts
+/** Exact floor-first allowlist; every additional handler must migrate its validator first. */
+const OBSERVED_CONVEX_ACTIONS = /* @__PURE__ */ new Set([
+	"payroll/actions:authorizeRun",
+	"account/actions:readBalance",
+	"holdings/actions:current",
+	"smartAccount/actions:claim",
+	"org/actions:prepareFounderAccount",
+	"org/actions:prepareBootstrap",
+	"org/actions:submitBootstrap",
+	"org/actions:resumeBootstrapSubmission",
+	"org/actions:confirmBootstrap",
+	"org/actions:readTreasury",
+	"moneyExecution/actions:preparePaymentExecution",
+	"moneyExecution/actions:abandonPaymentExecution",
+	"moneyExecution/actions:submitPaymentExecution",
+	"moneyExecution/paymentCommandActions:preparePaymentLifecycleExecution",
+	"moneyExecution/paymentCommandActions:prepareOrganizationPaymentExecution",
+	"moneyExecution/paymentCommandActions:submitPaymentCommandExecution"
+]);
+const OBSERVED_CONVEX_QUERIES = /* @__PURE__ */ new Set([
+	"movement/activity:list",
+	"movement/activity:summary",
+	"movement/activity:get",
+	"financialOps/queries:depositInstructions",
+	"financialOps/destinations:list",
+	"financialOps/queries:verifyPaymentDocument",
+	"financialOps/queries:renderStoredDocument",
+	"financialOps/addressBook:list",
+	"financialOps/addressBook:get",
+	"financialOps/requestsInbox:list",
+	"financialOps/requestsInbox:get",
+	"financialOps/requestsInbox:inboxList",
+	"payroll/queries:runs",
+	"payroll/queries:groups",
+	"payroll/queries:terms",
+	"financialOps/queries:resolveRecipient",
+	"identity/queries:loadByAuthUserId",
+	"smartAccount/queries:loadByAuthUserId",
+	"org/lifecycle:load"
+]);
+const OBSERVED_CONVEX_MUTATIONS = /* @__PURE__ */ new Set([
+	"movement/activity:annotate",
+	"financialOps/destinations:add",
+	"financialOps/destinations:remove",
+	"financialOps/addressBook:add",
+	"financialOps/addressBook:hide",
+	"financialOps/addressBook:unhide",
+	"financialOps/addressBook:label",
+	"financialOps/requestsInbox:issue",
+	"financialOps/requestsInbox:cancel",
+	"financialOps/requestsInbox:approve",
+	"financialOps/requestsInbox:decline",
+	"payroll/mutations:saveGroup",
+	"payroll/mutations:removeGroup",
+	"identity/mutations:create",
+	"identity/mutations:update",
+	"identity/mutations:completeOnboarding",
+	"smartAccount/mutations:provision",
+	"org/lifecycle:startOrResume",
+	"org/lifecycle:recordFailure",
+	"org/lifecycle:retry"
+]);
+var ConvexCallAdapter = class {
+	#client;
+	#tokenProvider;
+	#applicationId;
+	#observation;
+	#connectionMonitor;
+	constructor(deps) {
+		this.#connectionMonitor = new ConvexConnectionMonitor();
+		const webSocketConstructor = this.#connectionMonitor.observedWebSocketConstructor();
+		this.#client = deps.client ?? new ConvexClient(deps.convexUrl, webSocketConstructor === void 0 ? {} : { webSocketConstructor });
+		this.#tokenProvider = deps.tokenProvider;
+		this.#applicationId = deps.applicationId;
+		this.#observation = deps.observation;
+		if (this.#tokenProvider) this.#client.setAuth(this.#tokenProvider);
+	}
+	refreshAuth() {
+		if (this.#tokenProvider) this.#client.setAuth(this.#tokenProvider);
+	}
+	observeConnection(observer) {
+		return this.#connectionMonitor.observe(this.#client, observer);
+	}
+	query(fn, args) {
+		const path = getFunctionName(fn);
+		return Effect.serviceOption(Tracer.ParentSpan).pipe(Effect.flatMap((parent) => {
+			const traceparent = parent._tag === "Some" ? formatTraceparent(parent.value) : void 0;
+			return Effect.tryPromise({
+				try: () => this.#client.query(fn, this.#observedArgs(OBSERVED_CONVEX_QUERIES, path, args, traceparent)),
+				catch: (cause) => mapToConvexCallError(path, cause)
+			});
+		}));
+	}
+	mutation(fn, args) {
+		const path = getFunctionName(fn);
+		return Effect.serviceOption(Tracer.ParentSpan).pipe(Effect.flatMap((parent) => {
+			const traceparent = parent._tag === "Some" ? formatTraceparent(parent.value) : void 0;
+			return Effect.tryPromise({
+				try: () => this.#client.mutation(fn, this.#observedArgs(OBSERVED_CONVEX_MUTATIONS, path, args, traceparent)),
+				catch: (cause) => mapToConvexCallError(path, cause)
+			});
+		}));
+	}
+	action(fn, args) {
+		const path = getFunctionName(fn);
+		return Effect.serviceOption(Tracer.ParentSpan).pipe(Effect.flatMap((parent) => {
+			const traceparent = parent._tag === "Some" ? formatTraceparent(parent.value) : void 0;
+			const connectionAtStart = connectionState(this.#client);
+			return Effect.tryPromise({
+				try: () => this.#client.action(fn, this.#observedArgs(OBSERVED_CONVEX_ACTIONS, path, args, traceparent)),
+				catch: (cause) => {
+					const transport = this.#connectionMonitor.reconnectEvidence(connectionAtStart, connectionState(this.#client));
+					return mapToConvexCallError(path, cause, transport);
+				}
+			}).pipe(Effect.tapError((error) => logActionTransportFailure(path, error)));
+		}));
+	}
+	#observedArgs(allowlist, path, args, traceparent) {
+		if (!allowlist.has(path)) return args;
+		const carriedContext = sanitizeObservationContext(args.observationContext);
+		let hostContext;
+		const invocationSnapshot = readInvocationObservation(args);
+		if (invocationSnapshot !== void 0) hostContext = invocationSnapshot.active ? invocationSnapshot.context : void 0;
+		else {
+			const resolveContext = this.#observation?.resolveContext;
+			if (resolveContext !== void 0) try {
+				hostContext = resolveContext();
+			} catch {
+				hostContext = void 0;
+			}
+		}
+		if (hostContext === void 0 && carriedContext === void 0 && traceparent === void 0) return args;
+		hostContext = sanitizeObservationContext({
+			...hostContext,
+			...carriedContext,
+			...this.#applicationId === void 0 ? {} : { applicationId: this.#applicationId },
+			...traceparent === void 0 ? {} : { traceparent }
+		});
+		if (hostContext === void 0) return args;
+		return {
+			...args,
+			observationContext: hostContext
+		};
+	}
+	subscribe(fn, args, callback) {
+		return Effect.try({
+			try: () => {
+				const path = getFunctionName(fn);
+				const unsubscribe = this.#client.onUpdate(fn, args, (value) => callback({
+					status: "ok",
+					value
+				}), (err) => callback({
+					status: "error",
+					error: mapToCapxulError(path, err)
+				}));
+				let active = true;
+				return () => {
+					if (!active) return;
+					active = false;
+					unsubscribe();
+				};
+			},
+			catch: (cause) => mapToConvexCallError(getFunctionName(fn), cause)
+		}).pipe(Effect.tap(() => Effect.sync(() => {
+			callback({ status: "loading" });
+		})));
+	}
+	async close() {
+		this.#connectionMonitor.close();
+		await this.#client.close();
+	}
+};
+function ConvexCallLayer(deps) {
+	return Layer.effect(ConvexCallPortTag, Effect.acquireRelease(Effect.sync(() => new ConvexCallAdapter(deps)), (adapter) => Effect.promise(() => adapter.close()).pipe(Effect.orDie)));
+}
+function mapToCapxulError(operation, err, transport) {
+	const decoded = decodeConvexError(err);
+	if (decoded !== null) return decoded;
+	if (err instanceof CapxulError) return err;
+	if (transport !== void 0) {
+		const { kind: _kind, start_connection_count: _start, ...connection } = transport;
+		return Errors.networkError(operation, err, {
+			provider: "convex",
+			failure_mode: "upstream-down",
+			reason: "connection-lost-in-flight",
+			...connection
+		});
+	}
+	if (err instanceof Error) {
+		if (isTransportError(err)) return Errors.networkError(operation, err, { provider: "convex" });
+		return Errors.providerError("convex", operation, err);
+	}
+	return Errors.providerError("convex", operation, new Error(String(err)));
+}
+function mapToConvexCallError(operation, err, transport) {
+	return convexCallErrorFromCapxul(operation, mapToCapxulError(operation, err, transport), transport);
+}
+function connectionState(client) {
+	try {
+		const state = client.connectionState?.();
+		return typeof state?.connectionCount === "number" ? state : void 0;
+	} catch {
+		return;
+	}
+}
+function logActionTransportFailure(operation, error) {
+	if (error.transport === void 0) return Effect.void;
+	const { kind, ...connection } = error.transport;
+	return Effect.logWarning("convex.action.connection_lost").pipe(Effect.annotateLogs({
+		operation,
+		failure_mode: "upstream-down",
+		reason: kind,
+		...connection
+	}), Effect.catchCause(() => Effect.void));
+}
+const TRANSPORT_ERROR_CODES = /* @__PURE__ */ new Set([
+	"EAI_AGAIN",
+	"ECONNREFUSED",
+	"ECONNRESET",
+	"ENOTFOUND",
+	"EPIPE",
+	"ETIMEDOUT",
+	"UND_ERR_CONNECT_TIMEOUT",
+	"UND_ERR_HEADERS_TIMEOUT",
+	"UND_ERR_SOCKET"
+]);
+function isTransportError(err) {
+	const seen = /* @__PURE__ */ new Set();
+	let current = err;
+	while (current !== void 0 && !seen.has(current)) {
+		seen.add(current);
+		const code = current.code;
+		if (current.name === "FetchError" || current.name === "NetworkError" || typeof code === "string" && TRANSPORT_ERROR_CODES.has(code)) return true;
+		current = current.cause instanceof Error ? current.cause : void 0;
+	}
+	return false;
+}
+//#endregion
+//#region src/ports/identity.ts
+/** The chain families a payout address may name (#1955). */
+const PAYOUT_CHAINS = [
+	"evm",
+	"solana",
+	"starknet"
+];
+var IdentityError = class extends Data.TaggedError("IdentityError") {};
+function identityErrorFromCapxul(operation, error, cause = error) {
+	return new IdentityError({
+		operation,
+		publicCode: error.code,
+		publicError: error,
+		cause,
+		...error.details === void 0 ? {} : { details: error.details }
+	});
+}
+var IdentityPortTag = class extends Context.Service()("@capxul/sdk/ports/IdentityPort") {};
+//#endregion
+//#region src/adapters/identity/ConvexIdentityAdapter.ts
+const identityLoadByAuthUserIdQuery = makeFunctionReference(CAPXUL_FUNCTIONS["identity/queries"].loadByAuthUserId);
+const identityCreateMutation = makeFunctionReference(CAPXUL_FUNCTIONS["identity/mutations"].create);
+const identityUpdateMutation = makeFunctionReference(CAPXUL_FUNCTIONS["identity/mutations"].update);
+const identityCompleteOnboardingMutation = makeFunctionReference(CAPXUL_FUNCTIONS["identity/mutations"].completeOnboarding);
+var ConvexIdentityAdapter = class {
+	#convex;
+	constructor(deps) {
+		this.#convex = deps.convex;
+	}
+	loadByAuthUserId(authUserId) {
+		return this.#convex.query(identityLoadByAuthUserIdQuery, { authUserId }).pipe(Effect.mapError((error) => identityErrorFromCapxul("loadByAuthUserId", error.publicError, error)), Effect.flatMap((row) => Effect.try({
+			try: () => row === null ? null : brandProfile(row),
+			catch: (cause) => identityErrorFromUnknown("loadByAuthUserId", cause)
+		})), Effect.catchDefect((cause) => Effect.fail(identityErrorFromUnknown("loadByAuthUserId", cause))));
+	}
+	create(input) {
+		return this.#convex.mutation(identityCreateMutation, input).pipe(Effect.mapError((error) => identityErrorFromCapxul("create", error.publicError, error)), Effect.flatMap((row) => Effect.try({
+			try: () => brandProfile(row),
+			catch: (cause) => identityErrorFromUnknown("create", cause)
+		})), Effect.catchDefect((cause) => Effect.fail(identityErrorFromUnknown("create", cause))));
+	}
+	update(input) {
+		return this.#convex.mutation(identityUpdateMutation, input).pipe(Effect.mapError((error) => identityErrorFromCapxul("update", error.publicError, error)), Effect.flatMap((row) => Effect.try({
+			try: () => brandProfile(row),
+			catch: (cause) => identityErrorFromUnknown("update", cause)
+		})), Effect.catchDefect((cause) => Effect.fail(identityErrorFromUnknown("update", cause))));
+	}
+	completeOnboarding(input) {
+		return this.#convex.mutation(identityCompleteOnboardingMutation, input).pipe(Effect.mapError((error) => identityErrorFromCapxul("completeOnboarding", error.publicError, error)), Effect.flatMap((row) => Effect.try({
+			try: () => brandProfile(row),
+			catch: (cause) => identityErrorFromUnknown("completeOnboarding", cause)
+		})), Effect.catchDefect((cause) => Effect.fail(identityErrorFromUnknown("completeOnboarding", cause))));
+	}
+};
+function ConvexIdentityLayer() {
+	return Layer.effect(IdentityPortTag, Effect.map(ConvexCallPortTag, (convex) => new ConvexIdentityAdapter({ convex })));
+}
+function brandProfile(raw) {
+	return {
+		authUserId: toAuthUserId(raw.authUserId),
+		...raw.testerKind === void 0 ? {} : { testerKind: toTesterKind(raw.testerKind) },
+		email: toEmail(raw.email),
+		displayName: raw.displayName,
+		country: raw.country === null ? null : toCountryCode(raw.country),
+		onboarded: raw.onboarded ?? false,
+		withdrawalAddress: raw.withdrawalAddress === null || raw.withdrawalAddress === void 0 ? null : toAddress(raw.withdrawalAddress),
+		handle: raw.handle === null || raw.handle === void 0 ? null : toHandle(raw.handle),
+		imageUrl: raw.imageUrl ?? null,
+		kycTier: toKycTier(raw.kycTier),
+		createdAt: toEpochMs(raw.createdAt),
+		updatedAt: toEpochMs(raw.updatedAt)
+	};
+}
+function identityErrorFromUnknown(operation, cause) {
+	if (cause instanceof CapxulError) return identityErrorFromCapxul(operation, cause);
+	return identityErrorFromCapxul(operation, Errors.providerError("convex", operation, cause), cause);
+}
+//#endregion
+//#region src/adapters/_shared/wire.ts
+/**
+* Documented brand-erasure helpers for the wire boundary.
+*
+* Branded primitives (`Address`, `ChainId`) carry compile-time tags that
+* vanish at runtime. When sending values across a wire — Convex function
+* args, viem's template-literal-typed parameters, raw JSON — we have to
+* remove the brand at the type level so the wire-side type system accepts
+* the value.
+*
+* Using these helpers (rather than ad-hoc `as number` / `as \`0x${string}\``
+* casts) localizes every de-branding site. If we ever need to centralize
+* validation (e.g. "must not de-brand a placeholder address"), the change
+* lands here once instead of grep-and-replace across every adapter.
+*/
+/**
+* De-brand a `ChainId` for the wire. The runtime representation is already
+* `number` — the cast removes the compile-time brand only.
+*/
+function wireChainId(chainId) {
+	return chainId;
+}
+//#endregion
+//#region src/telemetry/invocation.ts
+const PRODUCT_INVOCATION = Symbol("capxul.product-telemetry-invocation");
+function bindProductTelemetryInvocation(telemetry, source) {
+	return telemetry[PRODUCT_INVOCATION]?.(source) ?? telemetry;
+}
+//#endregion
+//#region src/adapters/convex-call/retry-idempotent-read.ts
+const MAX_RETRIES = 2;
+function isConnectionLoss(error) {
+	return error.publicCode === "NETWORK_ERROR" && error.publicError.mode === "upstream-down" && error.publicError.details?.reason === "connection-lost-in-flight";
+}
+function retryIdempotentRead(effect, operation, telemetry, invocationSource) {
+	return Effect.suspend(() => {
+		let attempt = 0;
+		const invocationTelemetry = telemetry === void 0 ? void 0 : bindProductTelemetryInvocation(telemetry, invocationSource);
+		return effect.pipe(Effect.tapError((error) => {
+			if (!isConnectionLoss(error) || attempt >= MAX_RETRIES) return Effect.void;
+			attempt += 1;
+			const eventFields = {
+				operation,
+				failure_mode: "upstream-down",
+				reason: "connection-lost-in-flight",
+				attempt,
+				delay_ms: 0,
+				...error.transport === void 0 ? {} : {
+					connection_id: error.transport.connection_id,
+					connection_count: error.transport.connection_count
+				}
+			};
+			const transport = error.transport;
+			const connection = transport === void 0 ? void 0 : omitTransportKind(transport);
+			const log = Effect.logInfo("capxul.operation.retried").pipe(Effect.annotateLogs(connection === void 0 ? eventFields : {
+				...eventFields,
+				...connection
+			}), Effect.catchCause(() => Effect.void));
+			if (invocationTelemetry === void 0) return log;
+			return log.pipe(Effect.andThen(invocationTelemetry.emit({
+				name: "operation_retried",
+				props: eventFields
+			})), Effect.catchCause(() => Effect.void));
+		}), Effect.retry({
+			times: MAX_RETRIES,
+			while: isConnectionLoss
+		}));
+	});
+}
+function omitTransportKind(transport) {
+	const { kind: _kind, ...connection } = transport;
+	return connection;
+}
+//#endregion
+//#region src/ports/telemetry.ts
+var TelemetryPortTag = class extends Context.Service()("@capxul/sdk/ports/TelemetryPort") {};
+//#endregion
+//#region src/ports/account-read.ts
+var AccountReadError = class extends Data.TaggedError("AccountReadError") {};
+function accountReadErrorFromCapxul(operation, error, cause = error) {
+	return new AccountReadError({
+		operation,
+		publicCode: error.code,
+		publicError: error,
+		cause,
+		...error.details === void 0 ? {} : { details: error.details }
+	});
+}
+var AccountReadPortTag = class extends Context.Service()("@capxul/sdk/ports/AccountReadPort") {};
+//#endregion
+//#region src/adapters/account-read/ConvexAccountAdapter.ts
+const DEFAULT_FUNCTIONS$3 = {
+	readBalance: makeFunctionReference(CAPXUL_FUNCTIONS["account/actions"].readBalance),
+	faucetMint: makeFunctionReference(CAPXUL_FUNCTIONS["account/actions"].faucetMint)
+};
+var ConvexAccountAdapter = class {
+	#convex;
+	#fns;
+	#telemetry;
+	constructor(deps) {
+		this.#convex = deps.convex;
+		this.#fns = deps.functions ?? DEFAULT_FUNCTIONS$3;
+		this.#telemetry = deps.telemetry;
+	}
+	readBalance(input) {
+		return retryIdempotentRead(this.#convex.action(this.#fns.readBalance, copyInvocationObservation(input, { chainId: wireChainId(input.chainId) })), CAPXUL_OPERATIONS.accounts.read, this.#telemetry, input).pipe(Effect.mapError((error) => accountReadErrorFromCapxul("readBalance", error.publicError, error)), Effect.flatMap((wire) => brandAccountEffect("readBalance", wire)), Effect.catchDefect((cause) => Effect.fail(accountReadErrorFromUnknown("readBalance", cause))));
+	}
+	fundFromFaucet(input) {
+		const operation = "fundFromFaucet";
+		return Effect.suspend(() => {
+			const rawAmount = toWei(input.amount);
+			return this.#convex.action(this.#fns.faucetMint, {
+				chainId: wireChainId(input.chainId),
+				rawAmount
+			});
+		}).pipe(Effect.mapError((error) => accountReadErrorFromCapxul(operation, error.publicError, error)), Effect.map((wire) => ({ txHash: wire.txHash })), Effect.catchDefect((cause) => Effect.fail(accountReadErrorFromUnknown(operation, cause))));
+	}
+};
+function ConvexAccountLayer() {
+	return Layer.effect(AccountReadPortTag, Effect.all([ConvexCallPortTag, TelemetryPortTag]).pipe(Effect.map(([convex, telemetry]) => new ConvexAccountAdapter({
+		convex,
+		telemetry
+	}))));
+}
+function brandAccountEffect(operation, wire) {
+	return Effect.try({
+		try: () => brandAccount(wire),
+		catch: (cause) => accountReadErrorFromUnknown(operation, cause)
+	});
+}
+function brandAccount(wire) {
+	const balance = fromWei(wire.rawBalance, wire.decimals, wire.currency);
+	const available = fromWei(wire.rawAvailableBalance ?? wire.rawBalance, wire.decimals, wire.currency);
+	return {
+		id: toAccountId(wire.accountId),
+		balance,
+		available
+	};
+}
+function accountReadErrorFromUnknown(operation, cause) {
+	if (cause instanceof CapxulError) return accountReadErrorFromCapxul(operation, cause);
+	return accountReadErrorFromCapxul(operation, Errors.providerError("convex", operation, cause), cause);
+}
+//#endregion
+//#region src/ports/smart-account.ts
+var SmartAccountError = class extends Data.TaggedError("SmartAccountError") {};
+function smartAccountErrorFromCapxul(operation, error, cause = error) {
+	return new SmartAccountError({
+		operation,
+		publicCode: error.code,
+		publicError: error,
+		cause,
+		...error.details === void 0 ? {} : { details: error.details }
+	});
+}
+var SmartAccountPortTag = class extends Context.Service()("@capxul/sdk/ports/SmartAccountPort") {};
+//#endregion
+//#region src/adapters/smart-account/ConvexSmartAccountAdapter.ts
+const DEFAULT_FUNCTIONS$2 = {
+	loadByAuthUserId: makeFunctionReference(CAPXUL_FUNCTIONS["smartAccount/queries"].loadByAuthUserId),
+	loadBySmartAccountAddress: makeFunctionReference(CAPXUL_FUNCTIONS["smartAccount/queries"].loadBySmartAccountAddress),
+	provision: makeFunctionReference(CAPXUL_FUNCTIONS["smartAccount/mutations"].provision),
+	confirmDeployment: makeFunctionReference(CAPXUL_FUNCTIONS["smartAccount/actions"].confirmDeployment),
+	claim: makeFunctionReference(CAPXUL_FUNCTIONS["smartAccount/actions"].claim)
+};
+var ConvexSmartAccountAdapter = class {
+	#convex;
+	#fns;
+	constructor(deps) {
+		this.#convex = deps.convex;
+		this.#fns = deps.functions ?? DEFAULT_FUNCTIONS$2;
+	}
+	loadByAuthUserId(authUserId) {
+		return this.#convex.query(this.#fns.loadByAuthUserId, { authUserId }).pipe(Effect.mapError((error) => smartAccountErrorFromCapxul("loadByAuthUserId", error.publicError, error)), Effect.flatMap((row) => brandSmartAccountEffect("loadByAuthUserId", row)), Effect.catchDefect((cause) => Effect.fail(smartAccountErrorFromUnknown("loadByAuthUserId", cause))));
+	}
+	loadBySmartAccountAddress(address) {
+		return this.#convex.query(this.#fns.loadBySmartAccountAddress, { address }).pipe(Effect.mapError((error) => smartAccountErrorFromCapxul("loadBySmartAccountAddress", error.publicError, error)), Effect.flatMap((row) => brandSmartAccountEffect("loadBySmartAccountAddress", row)), Effect.catchDefect((cause) => Effect.fail(smartAccountErrorFromUnknown("loadBySmartAccountAddress", cause))));
+	}
+	provision(input) {
+		return this.#convex.mutation(this.#fns.provision, { chainId: wireChainId(input.chainId) }).pipe(Effect.mapError((error) => smartAccountErrorFromCapxul("provision", error.publicError, error)), Effect.flatMap((row) => Effect.try({
+			try: () => brandProvisionedSmartAccount(input.authUserId, row),
+			catch: (cause) => smartAccountErrorFromUnknown("provision", cause)
+		})), Effect.catchDefect((cause) => Effect.fail(smartAccountErrorFromUnknown("provision", cause))));
+	}
+	confirmDeployment(input) {
+		const evidence = {
+			chainId: wireChainId(input.evidence.chainId),
+			signerAddress: input.evidence.signerAddress,
+			safeAddress: input.evidence.safeAddress,
+			...input.evidence.userOpHash === void 0 ? {} : { userOpHash: input.evidence.userOpHash },
+			...input.evidence.txHash === void 0 ? {} : { txHash: input.evidence.txHash },
+			...input.evidence.blockNumber === void 0 ? {} : { blockNumber: input.evidence.blockNumber }
+		};
+		return this.#convex.action(this.#fns.confirmDeployment, {
+			chainId: wireChainId(input.chainId),
+			safeAddress: input.safeAddress,
+			evidence
+		}).pipe(Effect.mapError((error) => smartAccountErrorFromCapxul("confirmDeployment", error.publicError, error)), Effect.flatMap((row) => Effect.try({
+			try: () => brandProvisionedSmartAccount(input.authUserId, row),
+			catch: (cause) => smartAccountErrorFromUnknown("confirmDeployment", cause)
+		})), Effect.catchDefect((cause) => Effect.fail(smartAccountErrorFromUnknown("confirmDeployment", cause))));
+	}
+	claim(input) {
+		return this.#convex.action(this.#fns.claim, copyInvocationObservation(input, {
+			chainId: wireChainId(input.chainId),
+			signerAddress: input.signerAddress
+		})).pipe(Effect.mapError((error) => smartAccountErrorFromCapxul("claim", error.publicError, error)), Effect.flatMap((row) => Effect.try({
+			try: () => brandProvisionedSmartAccount(input.authUserId, row),
+			catch: (cause) => smartAccountErrorFromUnknown("claim", cause)
+		})), Effect.catchDefect((cause) => Effect.fail(smartAccountErrorFromUnknown("claim", cause))));
+	}
+};
+function ConvexSmartAccountLayer() {
+	return Layer.effect(SmartAccountPortTag, Effect.map(ConvexCallPortTag, (convex) => new ConvexSmartAccountAdapter({ convex })));
+}
+function brandSmartAccountEffect(operation, wire) {
+	return Effect.try({
+		try: () => wire === null ? null : brandNonNullSmartAccount(wire),
+		catch: (cause) => smartAccountErrorFromUnknown(operation, cause)
+	});
+}
+function brandNonNullSmartAccount(wire) {
+	return {
+		authUserId: toAuthUserId(wire.authUserId),
+		signerAddress: wire.signerAddress === null ? null : toAddress(wire.signerAddress),
+		smartAccountAddress: toAddress(wire.smartAccountAddress),
+		chainId: toChainId(wire.chainId),
+		deployedAt: wire.deployedAt === null ? null : toEpochMs(wire.deployedAt),
+		claimedAt: wire.claimedAt === null ? null : toEpochMs(wire.claimedAt),
+		createdAt: toEpochMs(wire.createdAt)
+	};
+}
+function brandProvisionedSmartAccount(requestedAuthUserId, wire) {
+	if (wire.authUserId !== String(requestedAuthUserId)) throw Errors.notAuthenticated();
+	return brandNonNullSmartAccount(wire);
+}
+function smartAccountErrorFromUnknown(operation, cause) {
+	if (cause instanceof CapxulError) return smartAccountErrorFromCapxul(operation, cause);
+	return smartAccountErrorFromCapxul(operation, Errors.providerError("convex", operation, cause), cause);
+}
+//#endregion
+//#region src/ports/org.ts
+var OrgError = class extends Data.TaggedError("OrgError") {};
+function orgErrorFromCapxul(operation, error, cause = error) {
+	return new OrgError({
+		operation,
+		publicCode: error.code,
+		publicError: error,
+		cause,
+		...error.details === void 0 ? {} : { details: error.details }
+	});
+}
+var OrgPortTag = class extends Context.Service()("@capxul/sdk/ports/OrgPort") {};
+//#endregion
+//#region src/adapters/org/parse.ts
+/**
+* Map a `WireOrg` + its (separately read) treasury `Account` into the branded
+* `OrgView`. The viewer role is projected by the authenticated backend read;
+* it must never be inferred from Organization ownership. Brands at the read
+* edge: `orgId`, `safeAddress`.
+*/
+function brandOrgView(wire, treasury, viewerRole) {
+	return {
+		id: toOrgId(wire.orgId),
+		...wire.creationSource === void 0 ? {} : { creationSource: toTesterKind(wire.creationSource) },
+		name: wire.name,
+		handle: wire.handle,
+		safeAddress: toAddress(wire.safeAddress.toLowerCase()),
+		role: viewerRole,
+		treasury,
+		bio: wire.bio ?? null,
+		size: wire.size ?? null,
+		logoUrl: wire.logoUrl ?? null
+	};
+}
+/**
+* Build the Org treasury `Account` from the raw on-chain `balanceOf` integer
+* (the D3 RPC read). `available === balance` for a treasury with no envelope
+* partition yet (a fresh Org reads back $0).
+*/
+function brandOrgTreasury(input) {
+	return {
+		id: toAccountId(`account_${orgIdBody(input.orgId)}`),
+		balance: input.money,
+		available: input.money
+	};
+}
+function brandOrgRole(wire) {
+	return {
+		orgId: toOrgId(wire.orgId),
+		label: wire.label,
+		roleKey: toRoleKey(wire.roleKey),
+		definition: parseRoleDefinition(wire.definitionJson)
+	};
+}
+function brandOrgMember(wire) {
+	return {
+		orgId: toOrgId(wire.orgId),
+		email: toEmail(wire.email),
+		name: wire.name,
+		personalSafeAddress: wire.personalSafeAddress === null ? null : toAddress(wire.personalSafeAddress),
+		role: wire.role,
+		roleKey: wire.roleKey === null ? null : toRoleKey(wire.roleKey),
+		status: wire.status,
+		grantTxHash: wire.grantTxHash,
+		revokeTxHash: wire.revokeTxHash
+	};
+}
+function parseRoleDefinition(json) {
+	let raw;
+	try {
+		const parsed = JSON.parse(json);
+		if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) throw new Error("expected object");
+		raw = parsed;
+	} catch (err) {
+		throw new Error(`Invalid role definition: malformed JSON - ${err instanceof Error ? err.message : String(err)}`, { cause: err });
+	}
+	if (typeof raw.label !== "string" || raw.label.trim().length === 0) throw new Error("Invalid role definition: missing label");
+	return {
+		label: raw.label,
+		...raw.spend === void 0 ? {} : { spend: {
+			...raw.spend.perTx === void 0 ? {} : { perTx: parseRoleMoney(raw.spend.perTx, "perTx") },
+			...raw.spend.perDay === void 0 ? {} : { perDay: parseRoleMoney(raw.spend.perDay, "perDay") },
+			...raw.spend.toRecipients === void 0 ? {} : { toRecipients: parseRoleRecipients(raw.spend.toRecipients) }
+		} },
+		...typeof raw.canSpend === "boolean" ? { canSpend: raw.canSpend } : {},
+		...typeof raw.canManageMembers === "boolean" ? { canManageMembers: raw.canManageMembers } : {},
+		...typeof raw.canManageRoles === "boolean" ? { canManageRoles: raw.canManageRoles } : {}
+	};
+}
+function parseRoleMoney(raw, field) {
+	if (typeof raw.currency !== "string" || typeof raw.value !== "string" || !/^\d+$/.test(raw.value) || raw.decimals !== 6) throw new Error(`Invalid role money: ${field}`);
+	return {
+		currency: toCurrencyCode(raw.currency),
+		value: raw.value,
+		decimals: raw.decimals
+	};
+}
+function parseRoleRecipients(raw) {
+	if (raw === "anyone") return "anyone";
+	if (!Array.isArray(raw)) throw new Error("Invalid role definition: toRecipients must be \"anyone\" or an array");
+	return raw.map((recipient) => {
+		if (typeof recipient !== "string") throw new Error("Invalid role definition: toRecipients must be \"anyone\" or an array");
+		return toAddress(recipient);
+	});
+}
+/** Strip the `org_` prefix + non-alphanumerics so the body re-seeds `account_`. */
+function orgIdBody(orgId) {
+	const underscore = orgId.indexOf("_");
+	const cleaned = (underscore < 0 ? orgId : orgId.slice(underscore + 1)).replace(/[^0-9A-Za-z]/g, "");
+	return cleaned.length > 0 ? cleaned : "0";
+}
+//#endregion
+//#region src/adapters/org/ConvexOrganizationAdapter.ts
+const DEFAULT_FUNCTIONS$1 = {
+	listAll: makeFunctionReference(CAPXUL_FUNCTIONS["org/queries"].listAll),
+	listRoles: makeFunctionReference(CAPXUL_FUNCTIONS["org/queries"].listRolesByOrgId),
+	listMembers: makeFunctionReference(CAPXUL_FUNCTIONS["org/queries"].listMembersByOrgId),
+	readTreasury: makeFunctionReference(CAPXUL_FUNCTIONS["org/actions"].readTreasury),
+	inviteMember: makeFunctionReference(CAPXUL_FUNCTIONS["org/actions"].inviteMember),
+	resendInvite: makeFunctionReference(CAPXUL_FUNCTIONS["org/mutations"].resendInviteToken),
+	detectInvitations: makeFunctionReference(CAPXUL_FUNCTIONS["org/actions"].detectAndAcceptPendingInvitations)
+};
+/**
+* Standard production Organization read adapter. It intentionally has no
+* deployer/RPC/test configuration: authenticated Convex actions own live chain
+* reads, while the lifecycle adapter owns the single sponsored bootstrap.
+*/
+var ConvexOrganizationAdapter = class {
+	#convex;
+	#fns;
+	#telemetry;
+	constructor(input) {
+		this.#convex = input.convex;
+		this.#fns = input.functions ?? DEFAULT_FUNCTIONS$1;
+		this.#telemetry = input.telemetry;
+	}
+	createOrg(_input) {
+		return Effect.fail(orgErrorFromCapxul("createOrg", Errors.notImplemented("organizationSetup", "use onboarding.completeOrganization")));
+	}
+	listOrgs(input) {
+		return this.#convex.query(this.#fns.listAll, copyInvocationObservation(input, {})).pipe(Effect.mapError((error) => orgErrorFromCapxul("listOrgs", error.publicError, error)), Effect.flatMap((wires) => Effect.forEach(wires, (wire) => this.#readTreasuryWire(copyInvocationObservation(input, { orgId: toOrgId(wire.orgId) })).pipe(Effect.map((treasury) => {
+			const viewerRole = wire.viewerRole.trim();
+			if (viewerRole.length === 0) throw Errors.wrongState({
+				method: "listOrgs",
+				currentState: "viewerRoleMissing",
+				validStates: ["activeViewerRole"]
+			});
+			return brandOrgView(wire, treasury, viewerRole);
+		})))), Effect.catchDefect((cause) => Effect.fail(toOrgError("listOrgs", cause))));
+	}
+	readTreasury(input) {
+		return this.#readTreasuryWire(input).pipe(Effect.catchDefect((cause) => Effect.fail(toOrgError("readTreasury", cause))));
+	}
+	listRoles(input) {
+		return this.#convex.query(this.#fns.listRoles, { orgId: input.orgId }).pipe(Effect.mapError((error) => orgErrorFromCapxul("listRoles", error.publicError, error)), Effect.flatMap((rows) => rows.length === 0 ? Effect.fail(partialOrgTruth("listRoles", "activeRoleMissing")) : Effect.succeed(rows.map(brandOrgRole))), Effect.catchDefect((cause) => Effect.fail(toOrgError("listRoles", cause))));
+	}
+	listMembers(input) {
+		return this.#convex.query(this.#fns.listMembers, { orgId: input.orgId }).pipe(Effect.mapError((error) => orgErrorFromCapxul("listMembers", error.publicError, error)), Effect.flatMap((rows) => rows.length === 0 ? Effect.fail(partialOrgTruth("listMembers", "activeMemberMissing")) : Effect.succeed(rows.map(brandOrgMember))), Effect.catchDefect((cause) => Effect.fail(toOrgError("listMembers", cause))));
+	}
+	pendingMembers(input) {
+		return this.listMembers(input).pipe(Effect.map((members) => members.filter((member) => member.status === "pending" || member.status === "pending_safe" || member.status === "pending_grant")));
+	}
+	inviteMember(input) {
+		return this.#convex.action(this.#fns.inviteMember, {
+			orgId: input.orgId,
+			email: input.input.email,
+			role: input.input.role
+		}).pipe(Effect.mapError((error) => orgErrorFromCapxul("inviteMember", error.publicError, error)), Effect.map(brandOrgMember), Effect.catchDefect((cause) => Effect.fail(toOrgError("inviteMember", cause))));
+	}
+	resendInviteToken(input) {
+		return this.#convex.mutation(this.#fns.resendInvite, {
+			orgId: input.orgId,
+			email: input.email
+		}).pipe(Effect.mapError((error) => orgErrorFromCapxul("resendInviteToken", error.publicError, error)), Effect.map(brandOrgMember), Effect.catchDefect((cause) => Effect.fail(toOrgError("resendInviteToken", cause))));
+	}
+	detectAndAcceptPendingInvitations(_input) {
+		return this.#convex.action(this.#fns.detectInvitations, {}).pipe(Effect.mapError((error) => orgErrorFromCapxul("detectAndAcceptPendingInvitations", error.publicError, error)), Effect.map((result) => ({ matched: result.matched.map(toOrgId) })), Effect.catchDefect((cause) => Effect.fail(toOrgError("detectAndAcceptPendingInvitations", cause))));
+	}
+	#readTreasuryWire(input) {
+		const orgId = String(input.orgId);
+		return retryIdempotentRead(this.#convex.action(this.#fns.readTreasury, copyInvocationObservation(input, { orgId })), CAPXUL_OPERATIONS.org.treasury, this.#telemetry, input).pipe(Effect.mapError((error) => orgErrorFromCapxul("readTreasury", error.publicError, error)), Effect.map((wire) => {
+			if (wire.orgId !== orgId) throw Errors.invalidInput("orgId", "Organization treasury scope does not match");
+			const balance = fromWei(wire.rawBalance, wire.decimals, wire.currency);
+			const available = fromWei(wire.rawAvailableBalance, wire.decimals, wire.currency);
+			return {
+				...brandOrgTreasury({
+					orgId: wire.orgId,
+					money: balance
+				}),
+				available
+			};
+		}));
+	}
+};
+function toOrgError(operation, cause) {
+	if (cause instanceof CapxulError) return orgErrorFromCapxul(operation, cause);
+	return orgErrorFromCapxul(operation, Errors.providerError("convex", operation, cause), cause);
+}
+function partialOrgTruth(operation, currentState) {
+	return orgErrorFromCapxul(operation, Errors.wrongState({
+		method: operation,
+		currentState,
+		validStates: ["completeProductionOrganizationTruth"]
+	}));
+}
+//#endregion
+//#region src/adapters/org/ConvexOrganizationSetupAdapter.ts
+const DEFAULT_FUNCTIONS = {
+	startOrResume: makeFunctionReference(CAPXUL_FUNCTIONS["org/lifecycle"].startOrResume),
+	prepareFounderAccount: makeFunctionReference(CAPXUL_FUNCTIONS["org/actions"].prepareFounderAccount),
+	prepareBootstrap: makeFunctionReference(CAPXUL_FUNCTIONS["org/actions"].prepareBootstrap),
+	submitBootstrap: makeFunctionReference(CAPXUL_FUNCTIONS["org/actions"].submitBootstrap),
+	resumeBootstrapSubmission: makeFunctionReference(CAPXUL_FUNCTIONS["org/actions"].resumeBootstrapSubmission),
+	confirmBootstrap: makeFunctionReference(CAPXUL_FUNCTIONS["org/actions"].confirmBootstrap),
+	recordFailure: makeFunctionReference(CAPXUL_FUNCTIONS["org/lifecycle"].recordFailure),
+	load: makeFunctionReference(CAPXUL_FUNCTIONS["org/lifecycle"].load),
+	retry: makeFunctionReference(CAPXUL_FUNCTIONS["org/lifecycle"].retry)
+};
+/** Durable Organization setup capability composed by the standard client. */
+var ConvexOrganizationSetupAdapter = class {
+	#convex;
+	#signer;
+	#chainId;
+	#fns;
+	constructor(input) {
+		this.#convex = input.convex;
+		this.#signer = input.signer;
+		this.#chainId = input.chainId;
+		this.#fns = input.functions ?? DEFAULT_FUNCTIONS;
+	}
+	async startOrResume(input) {
+		const result = await runCall("startOrResume", this.#convex.mutation(this.#fns.startOrResume, copyInvocationObservation(input, {
+			...input,
+			chainId: this.#chainId
+		})));
+		if (!result.ok) return result;
+		const lifecycle = parseLifecycle("startOrResume", result.value.lifecycle);
+		if (!lifecycle.ok) return lifecycle;
+		const orgId = parseOrgId("startOrResume", result.value.orgId);
+		if (!orgId.ok) return orgId;
+		if (String(orgId.value) !== String(lifecycle.value.orgId)) return fail$1(Errors.invalidInput("orgId", "Organization lifecycle scope does not match"));
+		return {
+			ok: true,
+			value: {
+				orgId: orgId.value,
+				lifecycle: lifecycle.value
+			}
+		};
+	}
+	prepareFounderAccount(input) {
+		return this.#lifecycleAction("prepareFounderAccount", input, () => this.#convex.action(this.#fns.prepareFounderAccount, copyInvocationObservation(input, {
+			orgId: input.orgId,
+			...input.observationContext === void 0 ? {} : { observationContext: input.observationContext }
+		})));
+	}
+	async authorizeAndSubmitBootstrap(input) {
+		const cancelled = cancellation(input.signal);
+		if (cancelled !== void 0) return cancelled;
+		const signerAddress = await signerResult(this.#signer.source, "getAddress", () => this.#signer.getAddress());
+		if (!signerAddress.ok) return signerAddress;
+		const prepared = await runCall("prepareBootstrap", this.#convex.action(this.#fns.prepareBootstrap, copyInvocationObservation(input, {
+			orgId: input.orgId,
+			signerAddress: signerAddress.value,
+			...input.observationContext === void 0 ? {} : { observationContext: input.observationContext }
+		})));
+		if (!prepared.ok) return prepared;
+		const authority = validatePreparedAuthorities(prepared.value, signerAddress.value);
+		if (!authority.ok) return authority;
+		const cancelledAfterPrepare = cancellation(input.signal);
+		if (cancelledAfterPrepare !== void 0) return cancelledAfterPrepare;
+		const signature = await signerResult(this.#signer.source, "signUserOpHash", () => this.#signer.signUserOpHash(prepared.value.digest));
+		if (!signature.ok) return signature;
+		const cancelledAfterSign = cancellation(input.signal);
+		if (cancelledAfterSign !== void 0) return cancelledAfterSign;
+		const submitted = await runCall("submitBootstrap", this.#convex.action(this.#fns.submitBootstrap, copyInvocationObservation(input, {
+			orgId: input.orgId,
+			signerAddress: signerAddress.value,
+			signature: signature.value,
+			userOp: prepared.value.userOp,
+			...input.observationContext === void 0 ? {} : { observationContext: input.observationContext }
+		})));
+		if (!submitted.ok) return submitted;
+		return parseLifecycle("submitBootstrap", submitted.value);
+	}
+	resumeSubmittedBootstrap(input) {
+		return this.#lifecycleAction("resumeBootstrapSubmission", input, () => this.#convex.action(this.#fns.resumeBootstrapSubmission, copyInvocationObservation(input, {
+			orgId: input.orgId,
+			...input.observationContext === void 0 ? {} : { observationContext: input.observationContext }
+		})));
+	}
+	confirmSubmittedBootstrap(input) {
+		return this.#lifecycleAction("confirmBootstrap", input, () => this.#convex.action(this.#fns.confirmBootstrap, copyInvocationObservation(input, {
+			orgId: input.orgId,
+			...input.observationContext === void 0 ? {} : { observationContext: input.observationContext },
+			...input.retryDelayMs === void 0 ? {} : { retryDelayMs: input.retryDelayMs }
+		})));
+	}
+	async recordFailure(input) {
+		const errorProvider = input.error.details?.provider;
+		const errorOperation = input.error.details?.operation;
+		const result = await runCall("recordFailure", this.#convex.mutation(this.#fns.recordFailure, copyInvocationObservation(input, {
+			orgId: input.orgId,
+			errorCode: input.error.code,
+			...typeof errorProvider === "string" && typeof errorOperation === "string" ? {
+				errorProvider,
+				errorOperation
+			} : {},
+			retryable: input.retryable,
+			...input.observationContext === void 0 ? {} : { observationContext: input.observationContext }
+		})));
+		return result.ok ? parseLifecycle("recordFailure", result.value) : result;
+	}
+	async loadLifecycle(input) {
+		const result = await runCall("loadLifecycle", this.#convex.query(this.#fns.load, input));
+		if (!result.ok) return result;
+		if (result.value === null) return fail$1(Errors.invalidInput("orgId", "Organization lifecycle was not found"));
+		return parseLifecycle("loadLifecycle", result.value);
+	}
+	async retry(input) {
+		const cancelled = cancellation(input.signal);
+		if (cancelled !== void 0) return cancelled;
+		const current = await this.loadLifecycle({
+			orgId: input.orgId,
+			...input.observationContext === void 0 ? {} : { observationContext: input.observationContext }
+		});
+		if (!current.ok) return current;
+		if (current.value.status === "failed" && current.value.retryable && (current.value.at === "awaitingFounderAuthorization" || current.value.at === "submittingBootstrap")) {
+			const reset = resetSignerSession(this.#signer);
+			if (!reset.ok) return reset;
+		}
+		const result = await runCall("retry", this.#convex.mutation(this.#fns.retry, copyInvocationObservation(input, {
+			orgId: input.orgId,
+			...input.observationContext === void 0 ? {} : { observationContext: input.observationContext }
+		})));
+		if (!result.ok) return result;
+		return parseLifecycle("retry", result.value);
+	}
+	async #lifecycleAction(operation, input, call) {
+		const cancelled = cancellation(input.signal);
+		if (cancelled !== void 0) return cancelled;
+		const result = await runCall(operation, call());
+		if (!result.ok) return result;
+		const cancelledAfter = cancellation(input.signal);
+		if (cancelledAfter !== void 0) return cancelledAfter;
+		return parseLifecycle(operation, result.value);
+	}
+};
+function resetSignerSession(signer) {
+	const resetSession = signer.resetSession;
+	if (typeof resetSession !== "function") return {
+		ok: true,
+		value: void 0
+	};
+	try {
+		resetSession.call(signer);
+		return {
+			ok: true,
+			value: void 0
+		};
+	} catch (cause) {
+		return fail$1(signerFailure(signer.source, "resetSession", cause));
+	}
+}
+async function runCall(operation, effect) {
+	try {
+		const result = await Effect.runPromise(Effect.result(effect));
+		return Result.isSuccess(result) ? {
+			ok: true,
+			value: result.success
+		} : fail$1(publicError(operation, result.failure));
+	} catch (cause) {
+		return fail$1(publicError(operation, cause));
+	}
+}
+function publicError(operation, cause) {
+	if (cause instanceof CapxulError) return cause;
+	if (typeof cause === "object" && cause !== null) {
+		const carried = cause.publicError;
+		if (carried instanceof CapxulError) return carried;
+	}
+	return Errors.providerError("convex-organization", operation, cause);
+}
+async function signerResult(source, operation, run) {
+	try {
+		return {
+			ok: true,
+			value: await run()
+		};
+	} catch (cause) {
+		return fail$1(signerFailure(source, operation, cause));
+	}
+}
+function validatePreparedAuthorities(prepared, signerAddress) {
+	const signer = signerAddress.toLowerCase();
+	const preparedSigner = prepared.signerAddress.toLowerCase();
+	const founder = prepared.founderPersonalAccount.toLowerCase();
+	const organization = prepared.organizationAccountAddress.toLowerCase();
+	const sender = prepared.userOp.sender.toLowerCase();
+	if (preparedSigner !== signer) return fail$1(Errors.invalidInput("signerAddress", "Prepared signer does not match configured signer"));
+	if (founder === signer || organization === signer || organization === founder) return fail$1(Errors.invalidInput("organizationAuthority", "Signer EOA, founder Account, and Organization Account must be distinct"));
+	if (sender !== founder) return fail$1(Errors.invalidInput("userOp.sender", "Bootstrap sender must be the founder Account"));
+	if (!/^0x[0-9a-fA-F]{64}$/u.test(prepared.digest)) return fail$1(Errors.invalidInput("digest", "Prepared bootstrap digest must be 32-byte hex"));
+	return {
+		ok: true,
+		value: void 0
+	};
+}
+function parseLifecycle(operation, wire) {
+	const orgId = parseOrgId(operation, wire.orgId);
+	if (!orgId.ok) return orgId;
+	if (wire.status === "loading") return {
+		ok: true,
+		value: {
+			status: "loading",
+			orgId: orgId.value
+		}
+	};
+	if (wire.status === "ready") return {
+		ok: true,
+		value: {
+			status: "ready",
+			orgId: orgId.value,
+			canTransact: true
+		}
+	};
+	if (wire.status === "failed") {
+		if (!isSetupStep(wire.at)) return fail$1(Errors.invalidInput("lifecycle.at", "Unknown setup step"));
+		return {
+			ok: true,
+			value: {
+				status: "failed",
+				orgId: orgId.value,
+				at: wire.at,
+				error: new CapxulError(wire.error.code, wire.error.message),
+				retryable: wire.retryable
+			}
+		};
+	}
+	if (!isSetupStep(wire.step)) return fail$1(Errors.invalidInput("lifecycle.step", `Unknown setup step from ${operation}`));
+	return {
+		ok: true,
+		value: {
+			status: "settingUp",
+			orgId: orgId.value,
+			step: wire.step
+		}
+	};
+}
+function parseOrgId(operation, value) {
+	try {
+		return {
+			ok: true,
+			value: toOrgId(value)
+		};
+	} catch (cause) {
+		return fail$1(Errors.providerError("convex-organization", operation, cause));
+	}
+}
+function isSetupStep(value) {
+	return value === "preparingFounderAccount" || value === "awaitingFounderAuthorization" || value === "submittingBootstrap" || value === "confirmingBootstrap";
+}
+function cancellation(signal) {
+	return signal?.aborted ? fail$1(Errors.cancelled({ operation: CAPXUL_OPERATIONS.organization.setup })) : void 0;
+}
+function fail$1(error) {
+	return {
+		ok: false,
+		error
+	};
+}
+//#endregion
+//#region src/adapters/telemetry/PostHogTelemetryAdapter.ts
+var PostHogTelemetryAdapter = class {
+	#capture;
+	#identify;
+	#group;
+	#reset;
+	constructor(deps) {
+		this.#capture = deps.capture;
+		this.#identify = deps.identify ?? (() => void 0);
+		this.#group = deps.group ?? (() => void 0);
+		this.#reset = deps.reset ?? (() => void 0);
+	}
+	emit(event) {
+		return this.#run(() => this.#capture(event.name, redactTelemetryProps(event.name, cloneProps(event.props)), event), "emit", event.name);
+	}
+	identify(input) {
+		return this.#run(() => this.#identify(cloneIdentifyInput(input)), "identify");
+	}
+	group(input) {
+		return this.#run(() => this.#group(cloneGroupInput(input)), "group");
+	}
+	reset() {
+		return this.#run(() => this.#reset(), "reset");
+	}
+	#run(operation, operationName, eventName) {
+		const diagnose = Effect.logWarning("product.telemetry.transport.dropped").pipe(Effect.annotateLogs({
+			operation: operationName,
+			...eventName === void 0 ? {} : { product_event: eventName }
+		}), Effect.catchCause(() => Effect.void));
+		return Effect.suspend(() => {
+			let pending;
+			try {
+				pending = operation();
+			} catch {
+				return diagnose;
+			}
+			if (pending === void 0) return Effect.void;
+			const transport = Effect.tryPromise({
+				try: () => pending,
+				catch: () => void 0
+			}).pipe(Effect.catch(() => diagnose));
+			return Effect.forkDetach(transport, { startImmediately: true }).pipe(Effect.asVoid);
+		});
+	}
+};
+function PostHogTelemetryLayer(deps) {
+	return Layer.succeed(TelemetryPortTag, new PostHogTelemetryAdapter(deps));
+}
+function cloneIdentifyInput(input) {
+	const traits = input.traits === void 0 ? void 0 : cloneProps(input.traits);
+	const properties = input.properties === void 0 ? void 0 : cloneProps(input.properties);
+	return {
+		distinctId: input.distinctId,
+		...input.anonDistinctId === void 0 ? {} : { anonDistinctId: input.anonDistinctId },
+		...traits === void 0 ? {} : { traits },
+		...properties === void 0 ? {} : { properties }
+	};
+}
+function cloneGroupInput(input) {
+	const properties = input.properties === void 0 ? void 0 : cloneProps(input.properties);
+	return properties === void 0 ? {
+		groupType: input.groupType,
+		groupKey: input.groupKey
+	} : {
+		groupType: input.groupType,
+		groupKey: input.groupKey,
+		properties
+	};
+}
+function cloneProps(props) {
+	if (props === void 0) return void 0;
+	const cloned = {};
+	for (const [key, value] of Object.entries(props)) cloned[key] = cloneTelemetryValue(value);
+	return cloned;
+}
+function cloneTelemetryValue(value) {
+	if (Array.isArray(value)) return value.map(cloneTelemetryValue);
+	if (value === null || typeof value !== "object") return value;
+	if (Object.getPrototypeOf(value) !== Object.prototype) return value;
+	const cloned = {};
+	for (const [key, nested] of Object.entries(value)) cloned[key] = cloneTelemetryValue(nested);
+	return cloned;
+}
+//#endregion
+//#region src/adapters/diagnostic/ConsoleDiagnosticAdapter.ts
+const DEFAULT_ACCOUNT_SETUP_LOG_PREFIX = "[capxul:account-setup]";
+var ConsoleDiagnosticAdapter = class {
+	prefix;
+	constructor(prefix = DEFAULT_ACCOUNT_SETUP_LOG_PREFIX) {
+		this.prefix = prefix;
+	}
+	trace(scope, detail) {
+		globalThis.console?.debug?.(`${this.prefix} ${scope}`, detail);
+	}
+};
+//#endregion
+//#region src/openfort/create-openfort-browser-signer.ts
+function httpStatusOf(link) {
+	const carrier = link;
+	if (typeof carrier.response?.status === "number") return carrier.response.status;
+	if (typeof carrier.statusCode === "number") return carrier.statusCode;
+	if (typeof carrier.status === "number") return carrier.status;
+}
+function isUnauthorizedCause(cause) {
+	for (const link of causeChain(cause)) if (httpStatusOf(link) === 401) return true;
+	return false;
+}
+function openfortProviderError(operation, cause) {
+	if (cause instanceof CapxulError) return cause;
+	const failure_mode = operation === "configure" && isUnauthorizedCause(cause) ? "unauthorized" : "unknown";
+	return Errors.providerError("openfort", operation, cause, { failure_mode });
+}
+function openfortFailureMode(error) {
+	return error.mode ?? "unknown";
+}
+/** Build a named PROVIDER_ERROR. The assembled Core SDK boundary reports it. */
+function failOpenfort(operation, failure_mode, cause) {
+	return Errors.providerError("openfort", operation, cause, { failure_mode });
+}
+/**
+* True when the browser cannot perform Web Crypto — sandboxed iframes, headless
+* agent browsers, or non-HTTPS origins. OpenFort's embedded-wallet `configure`
+* silently produces no address in this state, so we detect it up front and name
+* it `no-secure-context` instead of letting it decay into `unknown`.
+*/
+function isInsecureBrowserContext() {
+	return globalThis.isSecureContext === false || globalThis.crypto?.subtle === void 0;
+}
+/** Openfort SDK storage keys (`@openfort/openfort-js` StorageKeys). */
+const OPENFORT_BROWSER_STORAGE_KEYS = [
+	"openfort.authentication",
+	"openfort.account",
+	"openfort.session",
+	"openfort.configuration"
+];
+/**
+* Matches `@openfort/openfort-js` ScopedStorage.createScope — chars 8–15 of the
+* publishable key, prefixed onto each StorageKeys entry in localStorage.
+*/
+function openfortBrowserStorageScope(publishableKey) {
+	const trimmed = publishableKey.trim();
+	if (trimmed.length < 16) return;
+	return trimmed.substring(8, 16);
+}
+/**
+* Drop cached Openfort auth/account state so third-party login re-runs for the
+* current Better Auth session. The SDK skips `authenticateThirdParty` when a
+* stale `userId` is already in storage, which yields 401 on `v2/accounts`.
+*/
+function clearStaleOpenfortBrowserStorage(publishableKey) {
+	if (typeof localStorage === "undefined") return;
+	const scope = openfortBrowserStorageScope(publishableKey);
+	if (scope === void 0) return;
+	for (const key of OPENFORT_BROWSER_STORAGE_KEYS) localStorage.removeItem(`${scope}.${key}`);
+}
+/**
+* The Openfort error code that names the stale-user class (#1435).
+* `getThirdPartyAuthToken` skips `authenticateThirdParty` while a `userId` sits
+* in scoped storage. A purged `userId` therefore pins every later call to a 401
+* that `extractApiError` reports as `USER_NOT_FOUND`.
+*
+* The set holds one member on purpose. Session-expiry codes (`SESSION_EXPIRED`,
+* `NOT_LOGGED_IN`, `INVALID_TOKEN`, `REFRESH_TOKEN_ERROR`) are a different
+* cause, and a bare 401 is a different cause again: `app-env-allowlist` is a
+* 401 by definition (`packages/errors/src/errors.ts:80-81`). Healing those and
+* tagging them `stale-openfort-cache` would delete the triage signal the tag
+* exists to carry.
+*/
+const STALE_USER_ERROR_CODES = /* @__PURE__ */ new Set(["USER_NOT_FOUND"]);
+/**
+* The one predicate that opens the heal. It reads the Openfort error code and
+* never the message text (ADR-0023 R4). It walks the cause chain the way
+* `isTransportError` walks it in the Convex transport adapter.
+*
+* Known ceiling (#1435): a 401 that carries no recognized code is NOT healed.
+* `extractApiError` keeps the status only on `AuthenticationError`, so such a
+* payload is reachable. Add the code a live payload shows; do not add a message
+* match, because that trades one bug class for an ADR-0023 R4 violation.
+*/
+function isStaleUserSignal(cause) {
+	for (const link of causeChain(cause)) {
+		const error = link;
+		if (typeof error.error === "string" && STALE_USER_ERROR_CODES.has(error.error) || typeof error.code === "string" && STALE_USER_ERROR_CODES.has(error.code)) return true;
+	}
+	return false;
+}
+function createOpenfortBrowserSignerFromBootstrap(bootstrap, options = {}) {
+	const diagnostic = options.diagnostic;
+	const authBaseUrl = normalizeBetterAuthBaseUrl(bootstrap.authBaseUrl);
+	let currentStatus = "unknown";
+	const statusListeners = /* @__PURE__ */ new Set();
+	function setStatus(next) {
+		if (currentStatus === next) return;
+		currentStatus = next;
+		for (const listener of statusListeners) try {
+			listener(next);
+		} catch {
+			statusListeners.delete(listener);
+			diagnostic?.trace("openfort.signerStatusListener", {
+				ok: false,
+				failure_mode: "unknown"
+			});
+		}
+	}
+	const statusStore = {
+		status: () => currentStatus,
+		subscribe: (listener) => {
+			statusListeners.add(listener);
+			return () => {
+				statusListeners.delete(listener);
+			};
+		}
+	};
+	/**
+	* Closes the black hole: when the browser has no Web Crypto, OpenFort's
+	* `configure` would resolve to no address and the failure would be reported
+	* as `unknown`. Detect it before any network or wallet work. Tag it
+	* `no-secure-context` on a PROVIDER_ERROR scoped to `configure`. Add a
+	* DiagnosticPort breadcrumb. The assembled Core SDK boundary reports it.
+	*/
+	function failNoSecureContext() {
+		diagnostic?.trace("openfort.configure", {
+			ok: false,
+			failure_mode: "no-secure-context"
+		});
+		throw failOpenfort("configure", "no-secure-context", /* @__PURE__ */ new Error("Web Crypto unavailable: browser is not a secure context"));
+	}
+	function betterAuthSessionUrl() {
+		return `${authBaseUrl}/get-session`;
+	}
+	function encryptionSessionUrl() {
+		return `${authBaseUrl}/encryption-session`;
+	}
+	async function fetchBetterAuthAccessToken() {
+		try {
+			const response = await fetch(betterAuthSessionUrl(), { credentials: "include" });
+			if (!response.ok) {
+				diagnostic?.trace("openfort.token", {
+					ok: false,
+					tokenPresent: false,
+					httpStatus: response.status,
+					failure_mode: "unknown"
+				});
+				return null;
+			}
+			const token = (await response.json()).session?.token?.trim();
+			if (token === void 0 || token.length === 0) {
+				diagnostic?.trace("openfort.token", {
+					ok: false,
+					tokenPresent: false,
+					failure_mode: "unknown"
+				});
+				return null;
+			}
+			diagnostic?.trace("openfort.token", {
+				ok: true,
+				tokenPresent: true
+			});
+			return token;
+		} catch (cause) {
+			diagnostic?.trace("openfort.token", {
+				ok: false,
+				tokenPresent: false,
+				failure_mode: "unknown"
+			});
+			throw openfortProviderError("token", cause);
+		}
+	}
+	const openfort = new Openfort({
+		baseConfiguration: { publishableKey: bootstrap.openfortPublishableKey },
+		shieldConfiguration: { shieldPublishableKey: bootstrap.shieldPublishableKey },
+		thirdPartyAuth: {
+			provider: ThirdPartyOAuthProvider.BETTER_AUTH,
+			getAccessToken: fetchBetterAuthAccessToken
+		}
+	});
+	async function configureEmbeddedWallet(encryptionSession) {
+		await openfort.embeddedWallet.configure({
+			accountType: AccountTypeEnum.EOA,
+			chainType: ChainTypeEnum.EVM,
+			recoveryParams: {
+				recoveryMethod: RecoveryMethod.AUTOMATIC,
+				encryptionSession
+			}
+		});
+	}
+	/**
+	* ONE heal cycle on the stale-user rejection (#1435). Clear the scoped
+	* storage that pins the dead `userId`, run the existing configure path — it
+	* re-runs third-party auth against the live Better Auth session now that no
+	* `userId` is cached — and retry the read once. Exactly one cycle: a second
+	* rejection is terminal and carries `failure_mode: "stale-openfort-cache"`.
+	* The caller stays in `recovering` throughout; only the outcome moves it.
+	*/
+	async function healStaleOpenfortCache(encryptionSession) {
+		try {
+			clearStaleOpenfortBrowserStorage(bootstrap.openfortPublishableKey);
+			diagnostic?.trace("openfort.storageCleared", { beforeConfigure: false });
+			await configureEmbeddedWallet(encryptionSession);
+			await openfort.embeddedWallet.get();
+		} catch (cause) {
+			diagnostic?.trace("openfort.staleCacheHeal", {
+				ok: false,
+				failure_mode: "stale-openfort-cache"
+			});
+			throw failOpenfort("get", "stale-openfort-cache", cause);
+		}
+		diagnostic?.trace("openfort.staleCacheHeal", { ok: true });
+	}
+	let walletReadyPromise = null;
+	function startWalletReady() {
+		return (async () => {
+			if (isInsecureBrowserContext()) failNoSecureContext();
+			await openfort.waitForInitialization();
+			const accessToken = await fetchBetterAuthAccessToken();
+			if (accessToken === null) throw openfortProviderError("token", /* @__PURE__ */ new Error("Better Auth access token unavailable for Openfort"));
+			let encryptionResponse;
+			try {
+				encryptionResponse = await fetch(encryptionSessionUrl(), {
+					method: "POST",
+					credentials: "include",
+					headers: {
+						Authorization: `Bearer ${accessToken}`,
+						"Content-Type": "application/json"
+					},
+					body: JSON.stringify({})
+				});
+			} catch (cause) {
+				diagnostic?.trace("openfort.encryptionSession", {
+					ok: false,
+					failure_mode: "unknown"
+				});
+				throw openfortProviderError("encryptionSession", cause);
+			}
+			if (!encryptionResponse.ok) {
+				diagnostic?.trace("openfort.encryptionSession", {
+					ok: false,
+					httpStatus: encryptionResponse.status,
+					failure_mode: "unknown"
+				});
+				throw Errors.providerError("openfort", "encryptionSession", /* @__PURE__ */ new Error(`Openfort encryption session failed (${encryptionResponse.status})`), { failure_mode: "unknown" });
+			}
+			let encryptionBody;
+			try {
+				encryptionBody = await encryptionResponse.json();
+				if (typeof encryptionBody.sessionId !== "string" || encryptionBody.sessionId.length === 0) throw new Error("Openfort encryption session response missing sessionId");
+			} catch (cause) {
+				diagnostic?.trace("openfort.encryptionSession", {
+					ok: false,
+					httpStatus: encryptionResponse.status,
+					failure_mode: "unknown"
+				});
+				throw openfortProviderError("encryptionSession", cause);
+			}
+			diagnostic?.trace("openfort.encryptionSession", {
+				ok: true,
+				httpStatus: encryptionResponse.status
+			});
+			let embeddedState;
+			try {
+				embeddedState = await openfort.embeddedWallet.getEmbeddedState();
+				diagnostic?.trace("openfort.embeddedState", { state: embeddedState });
+			} catch (cause) {
+				diagnostic?.trace("openfort.embeddedState", {
+					ok: false,
+					failure_mode: "unknown"
+				});
+				throw openfortProviderError("embeddedState", cause);
+			}
+			if (embeddedState !== EmbeddedState.READY) {
+				clearStaleOpenfortBrowserStorage(bootstrap.openfortPublishableKey);
+				diagnostic?.trace("openfort.storageCleared", { beforeConfigure: true });
+				try {
+					await configureEmbeddedWallet(encryptionBody.sessionId);
+					diagnostic?.trace("openfort.configure", { ok: true });
+				} catch (cause) {
+					const error = openfortProviderError("configure", cause);
+					diagnostic?.trace("openfort.configure", {
+						ok: false,
+						failure_mode: openfortFailureMode(error)
+					});
+					throw error;
+				}
+			}
+			try {
+				await openfort.embeddedWallet.get();
+				diagnostic?.trace("openfort.get", { ok: true });
+			} catch (cause) {
+				if (!isStaleUserSignal(cause)) {
+					diagnostic?.trace("openfort.get", {
+						ok: false,
+						failure_mode: "unknown"
+					});
+					throw openfortProviderError("get", cause);
+				}
+				diagnostic?.trace("openfort.get", {
+					ok: false,
+					failure_mode: "stale-openfort-cache"
+				});
+				await healStaleOpenfortCache(encryptionBody.sessionId);
+			}
+		})();
+	}
+	async function ensureOpenfortWalletReady() {
+		let joined = walletReadyPromise;
+		if (joined === null) {
+			joined = startWalletReady();
+			walletReadyPromise = joined;
+			setStatus("recovering");
+		}
+		try {
+			await joined;
+			if (walletReadyPromise === joined) setStatus("ready");
+		} catch (cause) {
+			if (walletReadyPromise === joined) {
+				walletReadyPromise = null;
+				setStatus("unavailable");
+			}
+			throw cause;
+		}
+	}
+	const signer = openfortEmbeddedSignerFromWallet({
+		embeddedWallet: openfort.embeddedWallet,
+		ensureWalletReady: ensureOpenfortWalletReady
+	});
+	const controlledSign = options.signUserOpHash;
+	const signEmbeddedHash = controlledSign === void 0 ? signer.signUserOpHash : (hash) => controlledSign(hash, signer.signUserOpHash);
+	const resetReadiness = () => {
+		walletReadyPromise = null;
+		clearStaleOpenfortBrowserStorage(bootstrap.openfortPublishableKey);
+		signer.resetAddressCache();
+		setStatus("unknown");
+	};
+	const signUserOpHash = async (hash) => {
+		try {
+			return await signEmbeddedHash(hash);
+		} catch (cause) {
+			const providerErrorCode = openfortSignerNotReadyCode(cause);
+			if (providerErrorCode === void 0) throw cause;
+			diagnostic?.trace("openfort.signerRecovery", {
+				outcome: "started",
+				attempt: 1,
+				failure_mode: "signer-not-ready"
+			});
+			resetReadiness();
+			try {
+				await ensureOpenfortWalletReady();
+				const signature = await signEmbeddedHash(hash);
+				diagnostic?.trace("openfort.signerRecovery", {
+					outcome: "succeeded",
+					attempt: 1,
+					failure_mode: "signer-not-ready"
+				});
+				return signature;
+			} catch (retryCause) {
+				const retryFailure = signerFailure("openfort-embedded", "signUserOpHash", retryCause);
+				if (retryFailure.code === "SIGNER_REJECTED") throw retryFailure;
+				if (isSignerNotReadySignal(retryCause)) {
+					walletReadyPromise = null;
+					signer.resetAddressCache();
+					setStatus("unavailable");
+				}
+				diagnostic?.trace("openfort.signerRecovery", {
+					outcome: "failed",
+					attempt: 1,
+					failure_mode: isSignerNotReadySignal(retryCause) ? "signer-not-ready" : "unknown"
+				});
+				throw Errors.providerError("openfort", "signerRecovery", retryCause, {
+					failure_mode: "signer-not-ready",
+					details: {
+						provider_error_source: "openfort",
+						provider_error_code: providerErrorCode
+					}
+				});
+			}
+		}
+	};
+	return {
+		...signer,
+		signUserOpHash,
+		statusStore,
+		ensureWalletReady: ensureOpenfortWalletReady,
+		getAddress: async () => {
+			try {
+				const address = await signer.getAddress();
+				diagnostic?.trace("openfort.address", { ok: true });
+				return address;
+			} catch (cause) {
+				diagnostic?.trace("openfort.address", {
+					ok: false,
+					failure_mode: "unknown"
+				});
+				throw openfortProviderError("getAddress", cause);
+			}
+		},
+		resetSession: resetReadiness
+	};
+}
+function normalizeBetterAuthBaseUrl(raw) {
+	const trimmed = raw.replace(/\/$/, "");
+	return trimmed.endsWith("/api/auth") ? trimmed : `${trimmed}/api/auth`;
 }
-var SmartAccountPortTag = class extends Context.Service()("@capxul/sdk/ports/SmartAccountPort") {};
 //#endregion
 //#region src/flows/identity.ts
 const IDENTITY_SLOT = {
@@ -8060,8 +11166,52 @@ const loadIdentityProgram = Effect.gen(function* () {
 	if (authUserId === void 0) return null;
 	return yield* deps.identityPort.loadByAuthUserId(authUserId).pipe(Effect.catchDefect((cause) => Effect.fail(identityErrorFromCapxul("loadByAuthUserId", cause instanceof CapxulError ? cause : Errors.unknown(cause), cause))), Effect.mapError((failure) => failure.publicError));
 });
-//#endregion
-//#region src/surface/identity.ts
+/**
+* THE ONE boundary grammar for those optional fields. Both `completeProfile`
+* entry points — the method bundle here and the identity runtime in
+* `create-capxul-client.ts` — run it, so a malformed value is refused the same
+* way at each and never reaches the port.
+*/
+function checkProfileCarriage(profile) {
+	const carriage = {};
+	if (profile.imageStorageId !== void 0) {
+		if (typeof profile.imageStorageId !== "string" || profile.imageStorageId.trim().length === 0) return {
+			ok: false,
+			field: "imageStorageId",
+			message: "must be a non-empty storage id"
+		};
+		carriage.imageStorageId = profile.imageStorageId.trim();
+	}
+	if (profile.payoutAddresses !== void 0) {
+		if (!Array.isArray(profile.payoutAddresses)) return {
+			ok: false,
+			field: "payoutAddresses",
+			message: "must be an array"
+		};
+		if (profile.payoutAddresses.length > 10) return {
+			ok: false,
+			field: "payoutAddresses",
+			message: `must carry at most 10 addresses`
+		};
+		const entries = [];
+		for (const entry of profile.payoutAddresses) {
+			if (typeof entry !== "object" || entry === null || !PAYOUT_CHAINS.some((chain) => chain === entry.chain) || typeof entry.address !== "string" || entry.address.trim().length === 0) return {
+				ok: false,
+				field: "payoutAddresses",
+				message: `each entry needs a chain of ${PAYOUT_CHAINS.join(", ")} and an address`
+			};
+			entries.push({
+				chain: entry.chain,
+				address: entry.address.trim()
+			});
+		}
+		carriage.payoutAddresses = entries;
+	}
+	return {
+		ok: true,
+		carriage
+	};
+}
 function makeIdentityMethods(deps) {
 	const convexCall = deps.convexCall;
 	return {
@@ -8100,6 +11250,11 @@ function makeIdentityMethods(deps) {
 					error: Errors.invalidInput("country", "unsupported country")
 				};
 			}
+			const carried = checkProfileCarriage(profile);
+			if (!carried.ok) return {
+				ok: false,
+				error: Errors.invalidInput(carried.field, carried.message)
+			};
 			const session = deps.actor?.authSession();
 			if (session === void 0 || session === null) return {
 				ok: false,
@@ -8110,7 +11265,8 @@ function makeIdentityMethods(deps) {
 				email: session.email,
 				displayName,
 				country,
-				handle
+				handle,
+				...carried.carriage
 			}), options, CAPXUL_OPERATIONS.identity.completeProfile);
 		},
 		async handleAvailable(handle, options) {
@@ -10096,6 +13252,11 @@ function assembleCapxulClient(input) {
 				ok: false,
 				reason: "INVALID_INPUT"
 			};
+			const carried = checkProfileCarriage(profile);
+			if (!carried.ok) return {
+				ok: false,
+				reason: "INVALID_INPUT"
+			};
 			const session = actor.authSession();
 			if (session === null) return {
 				ok: false,
@@ -10106,7 +13267,8 @@ function assembleCapxulClient(input) {
 				email: session.email,
 				displayName,
 				country,
-				handle
+				handle,
+				...carried.carriage
 			}), controls, CAPXUL_OPERATIONS.identity.completeProfile, effectRunner.runPromise);
 			return result.ok ? { ok: true } : {
 				ok: false,
@@ -10205,4 +13367,721 @@ function withHostObservationControls(snapshot, input, actorId) {
 	});
 }
 //#endregion
-export { stampTelemetryEnvelope as $, safeExceptionLabel as A, resolveFailureMode as B, observeFailedResult as C, normalizeExceptionErrorKind as D, SDK_VERSION as E, causeChain as F, sanitizeObservationContext as G, readInvocationObservation as H, injectedWalletSigner as I, CAPXUL_FUNCTIONS as J, PAYMENT_DIRECTIONS as K, isSignerNotReadySignal as L, fromWei as M, isSettingUpLifecycle as N, normalizeExceptionOperation as O, formatTraceparent as P, redactTelemetryProps as Q, openfortSignerNotReadyCode as R, observationContextProps as S, EXCEPTION_MESSAGE as T, OBSERVATION_CONTEXT_HEADER as U, copyInvocationObservation as V, encodeObservationContextHeader as W, EngineeringTelemetryBootstrapPolicy as X, BootstrapEnvelope as Y, redactTelemetryEvent as Z, fingerprintPaymentIntent as _, AccountReadPortTag as a, isRestoring as at, failureDetail as b, retryIdempotentRead as c, IdentityPortTag as d, CAPXUL_OPERATIONS as et, identityErrorFromCapxul as f, bootstrapErrorFromCapxul as g, BootstrapPortTag as h, smartAccountErrorFromCapxul as i, isClaimed as it, version as j, projectSdkException as k, PRODUCT_INVOCATION as l, convexCallErrorFromCapxul as m, detectAuthCacheAdapter as n, normalizeCapxulOperation as nt, accountReadErrorFromCapxul as o, ConvexCallPortTag as p, PAYMENT_STATUSES as q, SmartAccountPortTag as r, destination as rt, TelemetryPortTag as s, assembleCapxulClient as t, isCapxulOperation as tt, wireChainId as u, toWei as v, postHogFailureObservation as w, failureEvidenceProps as x, CAPXUL_SDK_EXPECTED_OUTCOME_EVENT as y, signerFailure as z };
+//#region src/telemetry/from-posthog.ts
+/**
+* Drop props that must never cross to a host-owned external sink. Today that is
+* the `$exception` `details` blob: `captureException` serializes
+* `CapxulError.details` (e.g. `{ asset, available, required }`, `{ name }`,
+* `{ accountId }` — errors.ts) into it, and the shared redactor has no
+* `$exception` rule, so it is stripped here at the boundary (infra#1037). The
+* safe fields (error code, operation, failure_mode, the fixed leak-safe message,
+* stack frames) are preserved.
+*/
+function stripHostUnsafeProps(props) {
+	if (props === void 0) return void 0;
+	const { details: _details, ...safe } = props;
+	return safe;
+}
+/**
+* The subset of a posthog-js client the seam calls. `identify` / `group` /
+* `reset` are optional — a host that only wants event capture can omit them.
+*/
+/**
+* Adapt the host's already-initialized posthog-like client into a
+* `TelemetryPort` for the `telemetry` prop / input. This port SUPPLANTS the
+* SDK's no-op default telemetry sink (`production.ts` binds it via
+* `Layer.succeed`, not `compose` — there is no client-side success relay to
+* compose with); it is additive to Capxul's backend first-party record and
+* never owns the client.
+*/
+function postHogProductTelemetry(policy, fixedSnapshot) {
+	const telemetry = new PostHogTelemetryAdapter({
+		capture: (name, props, source) => {
+			const snapshot = readInvocationObservation(source) ?? fixedSnapshot ?? policy.snapshot();
+			if (!snapshot.active || policy.client === null || policy.client === void 0) return;
+			const event = stampTelemetryEnvelope({
+				name,
+				props
+			}, {
+				capxul_env: policy.capxulEnv,
+				producer: "sdk"
+			});
+			policy.deliver(() => policy.client.capture(name, {
+				...stripHostUnsafeProps(event.props),
+				...observationContextProps(snapshot.context)
+			}));
+		},
+		identify: (input) => {
+			if (!(fixedSnapshot ?? policy.snapshot()).active || policy.client?.identify === void 0) return;
+			policy.deliver(() => policy.client.identify(input.distinctId, {
+				...input.traits,
+				...input.properties
+			}));
+		},
+		group: (input) => {
+			if (!(fixedSnapshot ?? policy.snapshot()).active || policy.client?.group === void 0) return;
+			policy.deliver(() => policy.client.group(input.groupType, input.groupKey, input.properties === void 0 ? void 0 : { ...input.properties }));
+		},
+		reset: () => {
+			if (!(fixedSnapshot ?? policy.snapshot()).active || policy.client?.reset === void 0) return;
+			policy.deliver(() => policy.client.reset());
+		}
+	});
+	Object.defineProperty(telemetry, PRODUCT_INVOCATION, {
+		enumerable: false,
+		value: (source) => postHogProductTelemetry(policy, readInvocationObservation(source) ?? fixedSnapshot ?? policy.snapshot())
+	});
+	return telemetry;
+}
+//#endregion
+//#region src/host-observability.ts
+const HOST_INVOCATION = Symbol("capxul.host-observability-invocation");
+/** Build the SDK's one host module around an already-initialized PostHog client. */
+function postHogObservability(client, options = {}) {
+	const inactive = Object.freeze({
+		active: false,
+		contextProps: Object.freeze({})
+	});
+	const snapshot = () => {
+		if (client === null || client === void 0) return inactive;
+		try {
+			if (!(typeof options.enabled === "function" ? options.enabled() : options.enabled ?? true)) return inactive;
+			const sanitized = sanitizeObservationContext(typeof options.context === "function" ? options.context() : options.context);
+			const context = sanitized === void 0 ? void 0 : Object.freeze({ ...sanitized });
+			return Object.freeze({
+				active: true,
+				...context === void 0 ? {} : { context },
+				contextProps: Object.freeze(observationContextProps(context))
+			});
+		} catch {
+			return inactive;
+		}
+	};
+	const policy = {
+		client,
+		capxulEnv: options.capxulEnv ?? "unknown",
+		snapshot,
+		deliver: (capture) => {
+			try {
+				const delivery = capture();
+				if (isPromiseLike(delivery)) Promise.resolve(delivery).catch(() => void 0);
+			} catch {}
+		}
+	};
+	const module = {
+		failures: postHogFailureObservation(policy),
+		product: postHogProductTelemetry(policy)
+	};
+	Object.defineProperty(module, HOST_INVOCATION, {
+		enumerable: false,
+		value: {
+			bind: () => {
+				const invocation = snapshot();
+				return {
+					failures: postHogFailureObservation(policy, invocation),
+					product: postHogProductTelemetry(policy, invocation)
+				};
+			},
+			snapshot
+		}
+	});
+	return module;
+}
+/** @internal Bind both projections to one call-start decision/context snapshot. */
+function bindHostObservabilityInvocation(observability) {
+	return observability?.[HOST_INVOCATION]?.bind() ?? observability;
+}
+/** @internal Read one call-start snapshot for actor/transition carriage. */
+function snapshotHostObservability(observability) {
+	const snapshot = observability?.[HOST_INVOCATION]?.snapshot();
+	return snapshot === void 0 ? void 0 : {
+		active: snapshot.active,
+		...snapshot.context === void 0 ? {} : { context: snapshot.context }
+	};
+}
+function isPromiseLike(value) {
+	return (typeof value === "object" && value !== null || typeof value === "function") && "then" in value;
+}
+const SDK_VERSION = version;
+/**
+* Project the built graph into the flat `FlowPorts` record the method bundles
+* still take. It is a VIEW of `ProductionAdapters.context`, taken from the
+* graph and never instead of it — the graph stays alive in the scope and is
+* handed to every caller.
+*/
+const collectProductionFlowPorts = Effect.gen(function* () {
+	const authClient = yield* AuthClientPortTag;
+	const authCache = yield* AuthCachePortTag;
+	const bootstrap = yield* BootstrapPortTag;
+	const clock = yield* ClockPortTag;
+	const convexCall = yield* ConvexCallPortTag;
+	return {
+		authClient,
+		authCache,
+		identity: yield* IdentityPortTag,
+		smartAccount: yield* SmartAccountPortTag,
+		accountRead: yield* AccountReadPortTag,
+		bootstrap,
+		clock,
+		telemetry: yield* TelemetryPortTag,
+		convexCall
+	};
+});
+function makeProductionAdapterLayerEntries(input) {
+	const refreshConvexAuthRef = {
+		current: null,
+		pending: false
+	};
+	return [
+		{
+			name: "bootstrap",
+			layer: productionBootstrapPortLayer(input.bootstrap)
+		},
+		{
+			name: "authClient",
+			layer: productionAuthClientLayer(input, refreshConvexAuthRef, input.resetSignerSession)
+		},
+		{
+			name: "authCache",
+			layer: productionAuthCacheLayer(input)
+		},
+		{
+			name: "identity",
+			layer: ConvexIdentityLayer()
+		},
+		{
+			name: "smartAccount",
+			layer: ConvexSmartAccountLayer()
+		},
+		{
+			name: "accountRead",
+			layer: ConvexAccountLayer()
+		},
+		{
+			name: "clock",
+			layer: SystemClockLayer()
+		},
+		{
+			name: "telemetry",
+			layer: input.telemetry === void 0 ? PostHogTelemetryLayer({ capture: () => void 0 }) : Layer.succeed(TelemetryPortTag, input.telemetry)
+		},
+		{
+			name: "convexCall",
+			layer: productionConvexCallLayer(input, refreshConvexAuthRef)
+		},
+		{
+			name: "org",
+			layer: Layer.effect(OrgPortTag, Effect.all([ConvexCallPortTag, TelemetryPortTag]).pipe(Effect.map(([convex, telemetry]) => new ConvexOrganizationAdapter({
+				convex,
+				telemetry
+			}))))
+		}
+	];
+}
+function mergeProductionAdapterLayers(entries) {
+	const byName = /* @__PURE__ */ new Map();
+	for (const entry of entries) byName.set(entry.name, entry.layer);
+	const authClientLayer = byName.get("authClient");
+	const convexCallLayer = byName.get("convexCall");
+	const telemetryLayer = byName.get("telemetry");
+	const convexCallReadyLayer = convexCallLayer === void 0 || authClientLayer === void 0 ? convexCallLayer : convexCallLayer.pipe(Layer.provide(authClientLayer));
+	const observedConvexCallLayer = convexCallReadyLayer === void 0 ? telemetryLayer : telemetryLayer === void 0 ? convexCallReadyLayer : Layer.merge(convexCallReadyLayer, telemetryLayer);
+	return entries.map((entry) => {
+		const layer = byName.get(entry.name) ?? entry.layer;
+		if (entry.name === "convexCall") return convexCallReadyLayer ?? layer;
+		if (entry.name === "accountRead" || entry.name === "org") return observedConvexCallLayer === void 0 ? layer : layer.pipe(Layer.provide(observedConvexCallLayer));
+		if (isConvexDependentLayer(entry.name)) return convexCallReadyLayer === void 0 ? layer : layer.pipe(Layer.provide(convexCallReadyLayer));
+		return layer;
+	}).reduce((current, layer) => Layer.merge(current, layer), Layer.empty);
+}
+function isConvexDependentLayer(name) {
+	return name === "identity" || name === "smartAccount" || name === "accountRead" || name === "org";
+}
+function productionBootstrapPortLayer(bootstrap) {
+	return Layer.succeed(BootstrapPortTag, bootstrap);
+}
+function productionAuthClientLayer(input, refreshConvexAuthRef, resetSignerSessionRef) {
+	return (input.authClient !== void 0 ? Layer.succeed(AuthClientPortTag, input.authClient) : input.runtime === "browser" ? BetterAuthBrowserLayer({
+		authBaseUrl: input.runtimeUrls.authBaseUrl,
+		...input.fetch === void 0 ? {} : { fetch: input.fetch },
+		...input.observation === void 0 ? {} : { observation: input.observation }
+	}) : BetterAuthNodeLayer({
+		authBaseUrl: input.runtimeUrls.authBaseUrl,
+		...input.origin === void 0 ? {} : { origin: input.origin },
+		...input.fetch === void 0 ? {} : { fetch: input.fetch },
+		...input.observation === void 0 ? {} : { observation: input.observation }
+	})).pipe(Layer.flatMap((context) => {
+		const refreshed = refreshConvexAuthOnSession(Context.get(context, AuthClientPortTag), () => {
+			const refresh = refreshConvexAuthRef.current;
+			if (refresh === null) {
+				refreshConvexAuthRef.pending = true;
+				return;
+			}
+			refresh();
+		});
+		return Layer.succeedContext(Context.make(AuthClientPortTag, resetSignerSessionRef === void 0 ? refreshed : resetSignerSessionOnSignOut(refreshed, resetSignerSessionRef)));
+	}));
+}
+function productionAuthCacheLayer(input) {
+	return Layer.succeed(AuthCachePortTag, input.authCache ?? detectAuthCacheAdapter());
+}
+function productionConvexCallLayer(input, refreshConvexAuthRef) {
+	return Layer.unwrap(Effect.map(AuthClientPortTag, (authClient) => ConvexCallLayer({
+		convexUrl: input.runtimeUrls.convexUrl,
+		...input.applicationId === void 0 ? {} : { applicationId: input.applicationId },
+		...input.observation === void 0 ? {} : { observation: input.observation },
+		...input.convexClient === void 0 ? {} : { client: input.convexClient },
+		tokenProvider: async ({ forceRefreshToken }) => {
+			const tokenResult = await Effect.runPromise(Effect.result(authClient.getConvexJwt({
+				forceRefresh: forceRefreshToken,
+				...input.signal === void 0 ? {} : { signal: input.signal }
+			})));
+			if (Result.isFailure(tokenResult)) return null;
+			return String(tokenResult.success.token);
+		}
+	}).pipe(Layer.flatMap((context) => {
+		const convexCall = Context.get(context, ConvexCallPortTag);
+		if (isRefreshableConvexCallPort(convexCall)) {
+			refreshConvexAuthRef.current = () => convexCall.refreshAuth();
+			if (refreshConvexAuthRef.pending) {
+				refreshConvexAuthRef.pending = false;
+				refreshConvexAuthRef.current();
+			}
+		}
+		return Layer.succeedContext(context);
+	}))));
+}
+function isRefreshableConvexCallPort(convexCall) {
+	return "refreshAuth" in convexCall && typeof convexCall.refreshAuth === "function";
+}
+function resolveProductionObservability(input) {
+	const observation = input.observability?.failures ?? input.observation;
+	const telemetry = input.observability?.product ?? input.telemetry;
+	const invocationObservability = input.invocationObservability;
+	return {
+		observation,
+		telemetry,
+		invocationObservation: invocationObservability?.failures ?? observation,
+		invocationTelemetry: invocationObservability?.product ?? telemetry
+	};
+}
+async function createProductionAdapters(input) {
+	const { observation, telemetry, invocationObservation, invocationTelemetry } = resolveProductionObservability(input);
+	const resolvedInput = resolveInput(input);
+	if (!resolvedInput.ok) return resolvedInput;
+	const scope = await Effect.runPromise(Scope.make());
+	const closeScope = idempotentClose(() => Effect.runPromise(Scope.close(scope, Exit.void)));
+	const bootstrapLayer = HttpBootstrapLayer({
+		bootstrapBaseUrl: resolvedInput.value.bootstrapBaseUrl,
+		...input.fetch === void 0 ? {} : { fetch: input.fetch },
+		...invocationObservation === void 0 ? {} : { observation: invocationObservation }
+	});
+	try {
+		const bootstrapContext = await Effect.runPromise(Layer.buildWithScope(bootstrapLayer, scope));
+		const bootstrap = Context.get(bootstrapContext, BootstrapPortTag);
+		const bootstrapResult = await runBootstrap(bootstrap.resolve({
+			publishableKey: resolvedInput.value.publishableKey,
+			...resolvedInput.value.origin === void 0 ? {} : { origin: resolvedInput.value.origin }
+		}));
+		if (!bootstrapResult.ok) {
+			await emitBootstrapTelemetry(invocationTelemetry, {
+				name: "bootstrap_failed",
+				props: {
+					...bootstrapTelemetryEnvelope(input, resolvedInput.value),
+					reason: bootstrapResult.error.code,
+					...failureDetail(bootstrapResult.error),
+					...failureEvidenceProps(bootstrapResult.error)
+				}
+			});
+			await closeScope().catch(() => void 0);
+			return bootstrapResult;
+		}
+		const chainFence = assertDevKeySignerIsTestnetOnly(input.signer, bootstrapResult.value.chainId);
+		if (!chainFence.ok) {
+			await closeScope().catch(() => void 0);
+			return chainFence;
+		}
+		const runtimeUrlsResult = resolveRuntimeUrls(bootstrapResult.value, resolvedInput.value.runtime, input.authBaseUrl);
+		if (!runtimeUrlsResult.ok) {
+			await emitBootstrapTelemetry(invocationTelemetry, {
+				name: "bootstrap_failed",
+				props: {
+					...bootstrapTelemetryEnvelope(input, resolvedInput.value),
+					applicationId: bootstrapResult.value.applicationId,
+					reason: runtimeUrlsResult.error.code
+				}
+			});
+			await closeScope().catch(() => void 0);
+			return runtimeUrlsResult;
+		}
+		const runtimeUrls = runtimeUrlsResult;
+		await emitBootstrapTelemetry(invocationTelemetry, {
+			name: "bootstrap_resolved",
+			props: {
+				...bootstrapTelemetryEnvelope(input, resolvedInput.value),
+				applicationId: bootstrapResult.value.applicationId
+			}
+		});
+		let injectedClient;
+		const convexClientFactory = input.convexClientFactory;
+		if (convexClientFactory !== void 0) try {
+			injectedClient = convexClientFactory(runtimeUrls.value.convexUrl);
+		} catch (cause) {
+			await closeScope().catch(() => void 0);
+			return {
+				ok: false,
+				error: toPublicError(cause, "createProductionAdapters")
+			};
+		}
+		const portsLayer = mergeProductionAdapterLayers(makeProductionAdapterLayerEntries({
+			bootstrap,
+			runtime: resolvedInput.value.runtime,
+			...resolvedInput.value.origin === void 0 ? {} : { origin: resolvedInput.value.origin },
+			runtimeUrls: runtimeUrls.value,
+			chainId: bootstrapResult.value.chainId,
+			applicationId: bootstrapResult.value.applicationId,
+			...observation === void 0 ? {} : { observation },
+			...input.authCache === void 0 ? {} : { authCache: input.authCache },
+			...input.authClient === void 0 ? {} : { authClient: input.authClient },
+			...telemetry === void 0 ? {} : { telemetry },
+			...injectedClient === void 0 ? {} : { convexClient: injectedClient },
+			...input.fetch === void 0 ? {} : { fetch: input.fetch },
+			...input.signal === void 0 ? {} : { signal: input.signal },
+			...input.resetSignerSession === void 0 ? {} : { resetSignerSession: input.resetSignerSession }
+		}));
+		const applicationLayer = Layer.merge(portsLayer, optionalEngineeringTelemetryLayer(bootstrapResult.value.engineeringTelemetry, resolvedInput.value.runtime));
+		const context = await Effect.runPromise(Layer.buildWithScope(applicationLayer, scope));
+		const ports = await Effect.runPromise(collectProductionFlowPorts.pipe(Effect.provide(context)));
+		const stopConnectionObservation = observeProductionConvexConnection(ports.convexCall, context);
+		const close = idempotentClose(async () => {
+			try {
+				stopConnectionObservation();
+			} finally {
+				await closeScope();
+			}
+		});
+		return {
+			ok: true,
+			value: {
+				context,
+				ports,
+				bootstrap: bootstrapResult.value,
+				close
+			}
+		};
+	} catch (cause) {
+		await closeScope().catch(() => void 0);
+		return {
+			ok: false,
+			error: toPublicError(cause, "createProductionAdapters")
+		};
+	}
+}
+function observeProductionConvexConnection(convexCall, context) {
+	if (!("observeConnection" in convexCall) || typeof convexCall.observeConnection !== "function") return () => {};
+	const runPromise = Effect.runPromiseWith(context);
+	try {
+		return convexCall.observeConnection((diagnostic) => {
+			const message = diagnostic.transition === "connected" ? Effect.logInfo("convex.connection.changed") : Effect.logWarning("convex.connection.changed");
+			runPromise(message.pipe(Effect.annotateLogs(diagnostic), Effect.catchCause(() => Effect.void))).catch(() => void 0);
+		});
+	} catch {
+		return () => {};
+	}
+}
+function optionalEngineeringTelemetryLayer(policy, runtime) {
+	if (policy === void 0) return Layer.empty;
+	try {
+		return makeEngineeringTelemetryLayer({
+			host: policy.host,
+			headers: { authorization: `Bearer ${policy.projectToken}` },
+			capxulEnv: policy.capxulEnv,
+			producer: runtime === "browser" ? "browser" : "server",
+			sdkVersion: SDK_VERSION
+		});
+	} catch {
+		return Layer.empty;
+	}
+}
+function refreshConvexAuthOnSession(authClient, refresh) {
+	return {
+		...authClient,
+		verifyOtp: (input, options) => authClient.verifyOtp(input, options).pipe(Effect.tap(() => Effect.sync(refresh))),
+		signOut: (options) => authClient.signOut(options).pipe(Effect.tap(() => Effect.sync(refresh)))
+	};
+}
+/**
+* Signer-session reset, as a port wrapper INSIDE the Layer graph (blueprint §2:
+* "wrappers become Layers, not post-hoc spreads/Proxies").
+*
+* This was a spread over the assembled client — `{...client, auth: {...,
+* signOut}}` — applied after composition finished, so the reset lived on one
+* particular object rather than on the auth seam itself. Here it wraps
+* `AuthClientPort.signOut`, so it holds for every route to a sign-out.
+*
+* Capture the sign-out exit before reset. This preserves the old `try/finally`
+* order and keeps a reset failure in the typed error channel.
+*/
+function resetSignerSessionOnSignOut(authClient, resetRef) {
+	return {
+		...authClient,
+		signOut: (options) => Effect.gen(function* () {
+			const exit = yield* Effect.exit(authClient.signOut(options));
+			yield* Effect.try({
+				try: () => resetRef.current?.(),
+				catch: (cause) => new AuthClientError({
+					operation: "signOut",
+					kind: "signer",
+					cause
+				})
+			});
+			return yield* exit;
+		})
+	};
+}
+async function createCapxulClient(input) {
+	return createCapxulClientWithSignerControls(input, {});
+}
+function withSignerControl(signer, control) {
+	if (signer === void 0 || control === void 0) return signer;
+	return {
+		source: signer.source,
+		getAddress: () => signer.getAddress(),
+		signUserOpHash: (hash) => control(hash, signer),
+		...signer.statusStore === void 0 ? {} : { statusStore: signer.statusStore },
+		...signer.ensureWalletReady === void 0 ? {} : { ensureWalletReady: signer.ensureWalletReady.bind(signer) },
+		..."resetSession" in signer ? { resetSession: () => signer.resetSession() } : {}
+	};
+}
+/** Shared production composition. The normal factory passes no controls. */
+async function createCapxulClientWithSignerControls(input, controls) {
+	const invocationObservability = bindHostObservabilityInvocation(input.observability);
+	const observation = invocationObservability?.failures ?? input.observation;
+	const validation = validateCreateCapxulClientInput(input);
+	if (!validation.ok) return observeFailedResult(validation, observation, "createCapxulClient");
+	const resetSignerSession = { current: null };
+	const adapters = await createProductionAdapters({
+		...input,
+		resetSignerSession,
+		...invocationObservability === void 0 ? {} : { invocationObservability }
+	});
+	if (!adapters.ok) return observeFailedResult(adapters, observation, "createCapxulClient");
+	try {
+		const runtime = input.runtime ?? detectRuntime();
+		const resolvedAuthBaseUrl = resolveBrowserAuthBaseUrl({
+			bootstrapAuthBaseUrl: adapters.value.bootstrap.authBaseUrl,
+			runtime,
+			...input.authBaseUrl === void 0 ? {} : { override: input.authBaseUrl }
+		});
+		let signer = input.signer;
+		if (signer === void 0 && runtime === "browser") signer = createOpenfortBrowserSignerFromBootstrap({
+			...adapters.value.bootstrap,
+			authBaseUrl: resolvedAuthBaseUrl
+		}, {
+			diagnostic: new ConsoleDiagnosticAdapter(),
+			signUserOpHash: controls.signEmbeddedUserOpHash
+		});
+		signer = withSignerControl(signer, controls.signUserOpHash);
+		if (signer !== void 0 && "resetSession" in signer) {
+			const { resetSession, source } = signer;
+			resetSignerSession.current = () => {
+				try {
+					resetSession();
+				} catch (cause) {
+					throw signerFailure(source, "resetSession", cause);
+				}
+			};
+		}
+		const client = assembleCapxulClient({
+			ports: adapters.value.ports,
+			bootstrap: adapters.value.bootstrap,
+			authCache: adapters.value.ports.authCache,
+			requirement: input.requirement ?? "none",
+			...signer === void 0 ? {} : { signer },
+			orgPort: Context.get(adapters.value.context, OrgPortTag),
+			...signer === void 0 ? {} : { organizationSetup: new ConvexOrganizationSetupAdapter({
+				convex: adapters.value.ports.convexCall,
+				signer,
+				chainId: adapters.value.bootstrap.chainId
+			}) },
+			...input.signal === void 0 ? {} : { signal: input.signal },
+			...input.otpTtlMs === void 0 ? {} : { otpTtlMs: input.otpTtlMs },
+			invokeTimeoutMs: input.invokeTimeoutMs ?? 3e4,
+			...input.observability?.failures === void 0 && input.observation === void 0 ? {} : { failureObservation: input.observability?.failures ?? input.observation },
+			...input.observability === void 0 ? {} : { hostObservationSnapshot: () => snapshotHostObservability(input.observability) },
+			effectRunner: {
+				runSync: Effect.runSyncWith(adapters.value.context),
+				runPromise: Effect.runPromiseWith(adapters.value.context)
+			}
+		});
+		const upstreamClose = adapters.value.close;
+		const close = idempotentClose(async () => {
+			try {
+				if (signer !== void 0 && "resetSession" in signer) try {
+					signer.resetSession();
+				} catch (cause) {
+					throw signerFailure(signer.source, "resetSession", cause);
+				}
+			} finally {
+				await Promise.all([client._internal.close?.(), upstreamClose()]);
+			}
+		});
+		return {
+			ok: true,
+			value: {
+				...client,
+				_internal: {
+					...client._internal,
+					close
+				}
+			}
+		};
+	} catch (cause) {
+		await adapters.value.close().catch(() => void 0);
+		return observeFailedResult({
+			ok: false,
+			error: toPublicError(cause, "createCapxulClient")
+		}, observation, "createCapxulClient");
+	}
+}
+function validateCreateCapxulClientInput(input) {
+	const runtime = input.runtime ?? detectRuntime();
+	if ((input.requirement ?? "none") === "deployed" && input.signer === void 0 && runtime !== "browser") return {
+		ok: false,
+		error: Errors.invalidInput("signer", "required when requirement is \"deployed\"")
+	};
+	return {
+		ok: true,
+		value: void 0
+	};
+}
+function resolveInput(input) {
+	try {
+		const runtime = input.runtime ?? detectRuntime();
+		const publishableKey = toPublishableKey(input.publishableKey);
+		const origin = input.origin === void 0 ? runtime === "browser" ? toAllowedOrigin(derivedBrowserOrigin(runtime)) : void 0 : toAllowedOrigin(input.origin);
+		return {
+			ok: true,
+			value: {
+				publishableKey,
+				...origin === void 0 ? {} : { origin },
+				bootstrapBaseUrl: normalizeHttpUrl("bootstrapBaseUrl", input.bootstrapBaseUrl ?? (runtime === "browser" ? derivedBrowserOrigin(runtime) : "https://api.capxul.com")),
+				runtime
+			}
+		};
+	} catch (cause) {
+		return {
+			ok: false,
+			error: toPublicError(cause, "createProductionAdapters")
+		};
+	}
+}
+function detectRuntime() {
+	const globalAny = globalThis;
+	return globalAny.window !== void 0 || globalAny.document !== void 0 ? "browser" : "node";
+}
+function derivedBrowserOrigin(runtime) {
+	if (runtime !== "browser") throw Errors.invalidInput("origin", "required outside browser runtime");
+	const globalAny = globalThis;
+	if (typeof globalAny.location?.origin === "string" && globalAny.location.origin.length > 0) return globalAny.location.origin;
+	throw Errors.invalidInput("origin", "required when browser location is unavailable");
+}
+/**
+* Browser local dev serves `/api/auth` via the Vite proxy on `window.location.origin`
+* while bootstrap returns the remote Convex site host. Openfort wallet setup reads
+* Better Auth cookies from `get-session` — those only attach on the same origin the
+* OTP flow used, so rewrite when hosts differ.
+*/
+function resolveBrowserAuthBaseUrl(input) {
+	if (input.override !== void 0) return normalizeHttpUrl("authBaseUrl", input.override);
+	const bootstrapUrl = normalizeHttpUrl("authBaseUrl", input.bootstrapAuthBaseUrl);
+	if (input.runtime !== "browser") return bootstrapUrl;
+	try {
+		const localAuthBase = normalizeHttpUrl("authBaseUrl", `${derivedBrowserOrigin(input.runtime)}/api/auth`);
+		const remoteAuthBase = bootstrapUrl.endsWith("/api/auth") ? bootstrapUrl : `${bootstrapUrl}/api/auth`;
+		if (new URL(remoteAuthBase).host !== new URL(localAuthBase).host) return localAuthBase;
+		return bootstrapUrl;
+	} catch {
+		return bootstrapUrl;
+	}
+}
+function resolveRuntimeUrls(bootstrap, runtime, authBaseUrlOverride) {
+	try {
+		return {
+			ok: true,
+			value: {
+				authBaseUrl: resolveBrowserAuthBaseUrl({
+					bootstrapAuthBaseUrl: bootstrap.authBaseUrl,
+					runtime,
+					...authBaseUrlOverride === void 0 ? {} : { override: authBaseUrlOverride }
+				}),
+				convexUrl: normalizeHttpUrl("convexUrl", bootstrap.convexUrl)
+			}
+		};
+	} catch (cause) {
+		return {
+			ok: false,
+			error: toPublicError(cause, "createProductionAdapters")
+		};
+	}
+}
+async function runBootstrap(effect) {
+	const result = await Effect.runPromise(Effect.result(effect));
+	if (Result.isSuccess(result)) return {
+		ok: true,
+		value: result.success
+	};
+	return {
+		ok: false,
+		error: toPublicError(result.failure, "bootstrap.resolve")
+	};
+}
+/**
+* Bootstrap-event props. `runtime` used to be called `capxulEnv`, which was a
+* name collision, not a value: it carried "browser"/"node", never an
+* environment. ADR-0020 A1 makes `capxul_env` the environment discriminator
+* every synced artifact filters on, so this field was renamed to what it
+* actually is. `sdk_version` follows the canon envelope spelling.
+*/
+function bootstrapTelemetryEnvelope(input, resolvedInput) {
+	return {
+		runtime: resolvedInput.runtime,
+		env: input.requirement ?? "none",
+		...resolvedInput.origin === void 0 ? {} : { origin: resolvedInput.origin },
+		sdk_version: SDK_VERSION
+	};
+}
+async function emitBootstrapTelemetry(telemetry, event) {
+	if (telemetry === void 0) return;
+	await Effect.runPromise(telemetry.emit(event).pipe(Effect.catchDefect(() => Effect.void)));
+}
+function normalizeHttpUrl(field, raw) {
+	let parsed;
+	try {
+		parsed = new URL(raw);
+	} catch {
+		throw Errors.invalidInput(field, "must be an http or https URL");
+	}
+	if (parsed.protocol !== "http:" && parsed.protocol !== "https:") throw Errors.invalidInput(field, "must be an http or https URL");
+	return parsed.toString().replace(/\/$/, "");
+}
+function toPublicError(cause, operation) {
+	if (cause instanceof CapxulError) return cause;
+	if (typeof cause === "object" && cause !== null) {
+		const publicError = cause.publicError;
+		if (publicError instanceof CapxulError) return publicError;
+		const nestedCause = cause.cause;
+		if (nestedCause instanceof CapxulError) return nestedCause;
+	}
+	return Errors.providerError("sdk-production-adapters", operation, cause);
+}
+function idempotentClose(close) {
+	let closed = false;
+	return async () => {
+		if (closed) return;
+		closed = true;
+		await close();
+	};
+}
+//#endregion
+export { signerFailure as A, isRestoring as B, normalizeExceptionErrorKind as C, fromWei as D, safeExceptionLabel as E, CAPXUL_OPERATIONS as F, isCapxulOperation as I, normalizeCapxulOperation as L, PAYMENT_DIRECTIONS as M, PAYMENT_STATUSES as N, isSettingUpLifecycle as O, redactTelemetryEvent as P, destination as R, SDK_VERSION$1 as S, projectSdkException as T, fingerprintPaymentIntent as _, smartAccountErrorFromCapxul as a, failureDetail as b, identityErrorFromCapxul as c, embeddedSigner as d, openfortEmbeddedSigner as f, devPrivateKeySigner as g, deriveDevPrivateKey as h, assembleCapxulClient as i, resolveFailureMode as j, injectedWalletSigner as k, convexCallErrorFromCapxul as l, openfortEmbeddedWalletPort as m, createCapxulClientWithSignerControls as n, accountReadErrorFromCapxul as o, openfortEmbeddedSignerFromWallet as p, postHogObservability as r, wireChainId as s, createCapxulClient as t, bootstrapErrorFromCapxul as u, toWei as v, normalizeExceptionOperation as w, EXCEPTION_MESSAGE as x, CAPXUL_SDK_EXPECTED_OUTCOME_EVENT as y, isClaimed as z };