@capxul/sdk 4.2.0-rc.1 → 4.2.0-rc.10

package/dist/{production-FgHUndeX.mjs → production-BndbwuVx.mjs}

@@ -1,4 +1,4 @@
-import { $ as toTesterKind, A as toAccountId, B as toEmail, C as BYTES32_RE, D as ZERO_BYTES32, E as WEI_RE, F as toBudgetId, G as toKycTier, H as toEpochSeconds, I as toChainId, J as toPayrollGroupId, K as toOrgId, L as toCountryCode, M as toAllowedOrigin, P as toAuthUserId, Q as toSessionToken, R as toCurrencyCode, S as ASSET_ID_RE, T as SUPPORTED_CURRENCY_CODES, U as toHandle, V as toEpochMs, W as toJwtToken, X as toPublishableKey, Y as toPayrollRunId, Z as toRoleKey, _ as BASE_SEPOLIA_CHAIN_ID, _t as revertSummaryText, at as EXPECTED_OPERATION_OUTCOMES, b as ACCOUNT_ID_RE, bt as redactSecrets, c as AuthCachePortTag, ct as CHAIN_UPSTREAMS, d as authClientPortFromPromiseAdapter, dt as chainCauseProperties, et as validateHandle, f as AuthClientError, ft as chainEvidenceLabel, g as normalizeBindingEmail, gt as isFailureMode, ht as isChainUpstream, i as BrowserAuthCacheAdapter, it as CapxulError, j as toAddress, l as SystemClockLayer, lt as FAILURE_MODES$1, m as orgRoleKeyForLabel, mt as failureFingerprint, nt as decodeConvexError, ot as Errors, p as AuthClientPortTag, pt as decodeChainCause, q as toPartyId, r as InMemoryAuthCacheAdapter, rt as CAPXUL_ERROR_CODES, st as isCapxulError, u as ClockPortTag, ut as boundedResponseHeaders, v as deriveCapxulSafeAddress, vt as containsSensitiveMaterial, w as EVM_ADDRESS_RE$1, x as APP_ID_RE, xt as redactUrlSecrets, yt as isCredentialField, z as toDurationMs } from "./OAuthBearerAuthClient-BrbXrndM.mjs";
+import { $ as toRoleKey, B as toCurrencyCode, C as ASSET_ID_RE, Ct as redactSecrets, D as WEI_RE, E as SUPPORTED_CURRENCY_CODES, F as toAssetId, G as toHandle, H as toEmail, I as toAuthUserId, J as toOrgId, K as toJwtToken, L as toBudgetId, M as toAddress, N as toAllowedOrigin, O as ZERO_BYTES32, Q as toPublishableKey, R as toChainId, S as APP_ID_RE, St as isCredentialField, T as EVM_ADDRESS_RE$1, U as toEpochMs, V as toDurationMs, W as toEpochSeconds, X as toPayrollGroupId, Y as toPartyId, Z as toPayrollRunId, _ as normalizeBindingEmail, _t as failureFingerprint, at as decodeConvexError, bt as revertSummaryText, c as AuthCachePortTag, ct as EXPECTED_OPERATION_OUTCOMES, d as authClientPortFromPromiseAdapter, dt as CHAIN_UPSTREAMS, et as toSessionToken, f as AuthClientError, ft as FAILURE_MODES$1, gt as decodeChainCause, h as orgRoleKeyForLabel, ht as chainEvidenceLabel, i as BrowserAuthCacheAdapter, j as toAccountId, l as SystemClockLayer, lt as Errors, m as ADMIN_ROLE_LABEL, mt as chainCauseProperties, nt as toTxHash, ot as CAPXUL_ERROR_CODES, p as AuthClientPortTag, pt as boundedResponseHeaders, q as toKycTier, r as InMemoryAuthCacheAdapter, rt as validateHandle, st as CapxulError, tt as toTesterKind, u as ClockPortTag, ut as isCapxulError, v as BASE_SEPOLIA_CHAIN_ID, vt as isChainUpstream, w as BYTES32_RE, wt as redactUrlSecrets, x as ACCOUNT_ID_RE, xt as containsSensitiveMaterial, y as deriveCapxulSafeAddress, yt as isFailureMode, z as toCountryCode } from "./OAuthBearerAuthClient-IB2W1Fzj.mjs";
 import { formatUnits, keccak256, parseUnits, recoverAddress, stringToHex, toBytes } from "viem";
 import { Cause, Clock, Context, Data, Deferred, Duration, Effect, Exit, Fiber, FiberSet, Layer, Option, Queue, Ref, Result, Schedule, Schema, SchemaGetter, SchemaIssue, SchemaParser, Scope, Stream, Tracer } from "effect";
 import { getFunctionName, makeFunctionReference } from "convex/server";
@@ -448,6 +448,8 @@ const CAPXUL_OPERATIONS = {
 		emitAnnotationSaved: "activity.emitAnnotationSaved",
 		get: "activity.get",
 		list: "activity.list",
+		/** The SDK's live Activity read over the indexer's SSE stream. */
+		subscribe: "activity.subscribe",
 		summary: "activity.summary"
 	},
 	addressBook: {
@@ -946,6 +948,17 @@ const AuthFailedProps = Schema.Struct({
 	auth_type: OptionalString,
 	reason: OptionalString
 });
+const IdentityRefusedProps = Schema.Struct({
+	...TelemetryEnvelopeProps,
+	/** The refused identity event tag, for example CreateOrganization. */
+	event: OptionalString,
+	/** The machine's refusal code: WRONG_STATE, SUPERSEDED or STALE_EPOCH. */
+	refusal_code: OptionalString,
+	/** The machine slot the request targeted, for example identity:org. */
+	slot: OptionalString,
+	/** The machine state at refusal, for example authenticated:claiming. */
+	state: OptionalString
+});
 const AuthSignedOutProps = Schema.Struct(TelemetryEnvelopeProps);
 const ProvisioningSafeCreatedProps = Schema.Struct({
 	...TelemetryEnvelopeProps,
@@ -1333,10 +1346,24 @@ const DepositSettledProps = Schema.Struct({
 });
 const PermissionMirrorVerificationProps = Schema.Struct({
 	...TelemetryEnvelopeProps,
+	/** The RECEIPT verification outcome. What the mirror then did is separate. */
 	outcome: Schema.String,
 	reason: Schema.String,
 	chain_id: Schema.Number,
-	retry_count: Schema.Number
+	retry_count: Schema.Number,
+	/**
+	* #1960 R02, consumed by R03. A verified receipt is not an applied Permission:
+	* these two optional fields let the producer say what the applying mutation
+	* actually returned, and which command it was, without either fact rewriting
+	* the receipt outcome above. Absent when application has not happened yet.
+	*/
+	application_result: Schema.optional(Schema.Literals([
+		"applied",
+		"replayed",
+		"conflicting_replay",
+		"revision_mismatch"
+	])),
+	command_id: OptionalString
 });
 const MovementScanWindowProps = Schema.Struct({
 	...TelemetryEnvelopeProps,
@@ -1382,6 +1409,10 @@ Schema.Struct({
 	name: Schema.Literal("auth_failed"),
 	props: AuthFailedProps
 });
+Schema.Struct({
+	name: Schema.Literal("identity_refused"),
+	props: IdentityRefusedProps
+});
 Schema.Struct({
 	name: Schema.Literal("auth_signed_out"),
 	props: AuthSignedOutProps
@@ -1562,6 +1593,10 @@ Schema.Struct({
 	name: Schema.Literal("movement_scan_incident"),
 	props: MovementScanIncidentProps
 });
+/** The one spelling of "whose scope did this happen in" across every surface. */
+const ScopeKindSchema = Schema.Literals(["account", "organization"]);
+const AccountKindSchema = Schema.Literals(["personalSafe", "orgTreasury"]);
+const OptionalReasonCode = Schema.optional(Schema.Literals(CAPXUL_ERROR_CODES));
 const ActivityReferenceProps = {
 	reference_kind: Schema.Literals(["payment", "movement"]),
 	reference_id: Schema.String
@@ -1592,8 +1627,8 @@ const ActivityFilterProps = {
 };
 const ActivityActionProps = {
 	...TelemetryEnvelopeProps,
-	scope_kind: Schema.Literals(["account", "organization"]),
-	reason_code: Schema.optional(Schema.Literals(CAPXUL_ERROR_CODES))
+	scope_kind: ScopeKindSchema,
+	reason_code: OptionalReasonCode
 };
 Schema.Struct({
 	name: Schema.Literal("contact_relationship_changed"),
@@ -1605,7 +1640,7 @@ Schema.Struct({
 			"hidden",
 			"restored"
 		]),
-		scope_kind: Schema.Literals(["account", "organization"]),
+		scope_kind: ScopeKindSchema,
 		scope_id: Schema.String,
 		owner_party_id: Schema.String,
 		party_id: Schema.String,
@@ -1621,9 +1656,9 @@ Schema.Struct({
 });
 const ContactActionProps = {
 	...TelemetryEnvelopeProps,
-	scope_kind: Schema.Literals(["account", "organization"]),
+	scope_kind: ScopeKindSchema,
 	party_id: OptionalString,
-	reason_code: Schema.optional(Schema.Literals(CAPXUL_ERROR_CODES))
+	reason_code: OptionalReasonCode
 };
 Schema.Struct({
 	name: Schema.Literal("ui_contact_action_completed"),
@@ -1650,7 +1685,7 @@ Schema.Struct({
 	props: Schema.Struct({
 		...TelemetryEnvelopeProps,
 		...ActivityReferenceProps,
-		scope_kind: Schema.Literals(["account", "organization"]),
+		scope_kind: ScopeKindSchema,
 		scope_id: Schema.String,
 		occurred_at: Schema.Number
 	})
@@ -1705,6 +1740,193 @@ Schema.Struct({
 		})
 	])
 });
+/**
+* Reliability closeout (#1960 R02) — the shape every explicit UI observation
+* below shares. `scope_kind` says whose surface the person was looking at,
+* `organization_id` is the verified Organization the producer resolved (absent
+* on a personal action), and `reason_code` is a catalog error code, never copy.
+*/
+const UiStepProps = {
+	...TelemetryEnvelopeProps,
+	scope_kind: ScopeKindSchema,
+	organization_id: OptionalOrgId,
+	reason_code: OptionalReasonCode
+};
+const AccessRecoveryCompletedProps = Schema.Union([Schema.Struct({
+	...TelemetryEnvelopeProps,
+	recovery: Schema.Literal("session_restoration"),
+	outcome: Schema.Literals([
+		"restored",
+		"absent",
+		"failed"
+	]),
+	reason_code: OptionalReasonCode,
+	organization_id: OptionalOrgId
+}), Schema.Struct({
+	...TelemetryEnvelopeProps,
+	recovery: Schema.Literal("signer_readiness"),
+	outcome: Schema.Literals(["ready", "unavailable"]),
+	reason_code: OptionalReasonCode,
+	organization_id: OptionalOrgId
+})]);
+Schema.Struct({
+	name: Schema.Literal("access_recovery_completed"),
+	props: AccessRecoveryCompletedProps
+});
+Schema.Struct({
+	name: Schema.Literal("ui_access_step_completed"),
+	props: Schema.Struct({
+		...UiStepProps,
+		step: Schema.Literals([
+			"dashboard_granted",
+			"redirect_completed",
+			"gate_error_displayed",
+			"retry_selected",
+			"capability_refusal_displayed",
+			"signer_refusal_displayed"
+		]),
+		capability: Schema.optional(Schema.Literals(["spend", "managePeople"])),
+		probe: Schema.optional(Schema.Literals([
+			"session",
+			"membership",
+			"lifecycle"
+		])),
+		reason: Schema.optional(Schema.Literals([
+			"loading",
+			"no-permission",
+			"org-unavailable"
+		]))
+	})
+});
+Schema.Struct({
+	name: Schema.Literal("org_invite_progressed"),
+	props: Schema.Struct({
+		...TelemetryEnvelopeProps,
+		organization_id: OrgIdTelemetrySchema,
+		progress: Schema.Literals([
+			"account_ready",
+			"permission_applied",
+			"membership_activated",
+			"revoked"
+		]),
+		/** The invited Party. The initiating actor stays on the envelope's identity. */
+		member_party_id: Schema.String,
+		occurred_at: Schema.Number
+	})
+});
+Schema.Struct({
+	name: Schema.Literal("invoice_issued"),
+	props: Schema.Struct({
+		...TelemetryEnvelopeProps,
+		request_id: Schema.String,
+		issuer_scope_kind: ScopeKindSchema,
+		issuer_scope_id: Schema.String,
+		payer_party_id: OptionalString,
+		occurred_at: Schema.Number
+	})
+});
+Schema.Struct({
+	name: Schema.Literal("invoice_request_transitioned"),
+	props: Schema.Struct({
+		...TelemetryEnvelopeProps,
+		request_id: Schema.String,
+		transition: Schema.Literals([
+			"approval_prepared",
+			"declined",
+			"cancelled"
+		]),
+		actor_scope_kind: ScopeKindSchema,
+		actor_scope_id: Schema.String,
+		occurred_at: Schema.Number
+	})
+});
+Schema.Struct({
+	name: Schema.Literal("ui_invoice_step_completed"),
+	props: Schema.Struct({
+		...UiStepProps,
+		step: Schema.Literals([
+			"opened",
+			"previewed",
+			"dismissed",
+			"submitted",
+			"result_displayed",
+			"refusal_displayed",
+			"retry_selected"
+		]),
+		request_id: OptionalString
+	})
+});
+Schema.Struct({
+	name: Schema.Literal("ui_treasury_step_completed"),
+	props: Schema.Struct({
+		...UiStepProps,
+		step: Schema.Literals([
+			"balance_displayed",
+			"read_refusal_displayed",
+			"retry_selected",
+			"recovery_completed"
+		]),
+		account_kind: Schema.optional(AccountKindSchema)
+	})
+});
+Schema.Struct({
+	name: Schema.Literal("ui_receive_step_completed"),
+	props: Schema.Struct({
+		...UiStepProps,
+		step: Schema.Literals([
+			"instructions_displayed",
+			"address_copied",
+			"copy_failed",
+			"refusal_displayed",
+			"retry_selected"
+		]),
+		account_kind: Schema.optional(AccountKindSchema)
+	})
+});
+Schema.Struct({
+	name: Schema.Literal("payroll_group_changed"),
+	props: Schema.Struct({
+		...TelemetryEnvelopeProps,
+		organization_id: OrgIdTelemetrySchema,
+		change: Schema.Literals([
+			"created",
+			"updated",
+			"deleted"
+		]),
+		group_id: Schema.String,
+		member_count: Schema.Number,
+		occurred_at: Schema.Number
+	})
+});
+Schema.Struct({
+	name: Schema.Literal("payroll_run_transitioned"),
+	props: Schema.Struct({
+		...TelemetryEnvelopeProps,
+		organization_id: OrgIdTelemetrySchema,
+		transition: Schema.Literals([
+			"prepared",
+			"authorized",
+			"settled"
+		]),
+		run_id: Schema.String,
+		payment_count: Schema.optional(Schema.Number),
+		occurred_at: Schema.Number
+	})
+});
+Schema.Struct({
+	name: Schema.Literal("ui_payroll_action_completed"),
+	props: Schema.Struct({
+		...UiStepProps,
+		action: Schema.Literals([
+			"opened",
+			"refusal_displayed",
+			"recovery_completed",
+			"cancelled",
+			"submitted_displayed"
+		]),
+		run_id: OptionalString
+	})
+});
 function redactTelemetryEvent(event, options = {}) {
 	const props = redactTelemetryProps(event.name, event.props, options);
 	return props === void 0 ? { name: event.name } : {
@@ -2007,6 +2229,10 @@ const BootstrapEnvelope = Schema.Struct({
 		siteBaseUrl: Schema.String,
 		openfortPublishableKey: Schema.String,
 		shieldPublishableKey: Schema.String,
+		/** Which Openfort third-party auth provider the signer presents; absent means better-auth. */
+		openfortAuthProvider: Schema.optional(Schema.Literals(["better-auth", "oidc"])),
+		/** Origin of the Ponder indexer the SDK reads directly; absent means no indexer reads. */
+		indexerUrl: Schema.optional(Schema.String),
 		engineeringTelemetry: Schema.optional(EngineeringTelemetryBootstrapPolicy)
 	})
 });
@@ -2081,6 +2307,7 @@ const CAPXUL_FUNCTIONS = {
 		prepareOrganizationPaymentExecution: "moneyExecution/paymentCommandActions:prepareOrganizationPaymentExecution",
 		submitPaymentCommandExecution: "moneyExecution/paymentCommandActions:submitPaymentCommandExecution"
 	},
+	"moneyExecution/providerSendWitness": { read: "moneyExecution/providerSendWitness:read" },
 	media: {
 		generateUploadUrl: "media:generateUploadUrl",
 		setOrgLogo: "media:setOrgLogo",
@@ -2140,6 +2367,11 @@ const CAPXUL_FUNCTIONS = {
 		loadByAuthUserId: "smartAccount/queries:loadByAuthUserId",
 		loadBySmartAccountAddress: "smartAccount/queries:loadBySmartAccountAddress"
 	},
+	e2eControls: {
+		holdUserOperationReceipt: "e2eControls:holdUserOperationReceipt",
+		isUserOperationReceiptHeld: "e2eControls:isUserOperationReceiptHeld",
+		releaseUserOperationReceipt: "e2eControls:releaseUserOperationReceipt"
+	},
 	system: { health: "system:health" }
 };
 //#endregion
@@ -5451,7 +5683,7 @@ const moneyExecutionContract = {
 };
 //#endregion
 //#region package.json
-var version = "4.2.0-rc.1";
+var version = "4.2.0-rc.10";
 //#endregion
 //#region src/telemetry/exception-projection.ts
 /** Fixed fallback for failures that have no safe message. */
@@ -5644,6 +5876,17 @@ function observeFailedResult(result, adapter, operation, origin) {
 	return result;
 }
 /**
+* @internal Reports a failure that can never become a method result.
+*
+* A reactive stream is torn down after its call already returned, so nothing
+* downstream observes it. `captureException` is the right kind: the caller did
+* not ask for the end, so it is not an expected product outcome.
+*/
+function observeStreamFailure(adapter, operation, cause) {
+	if (adapter === void 0) return;
+	report(adapter, "exception", operation, cause, resolveAdapterSnapshot(adapter));
+}
+/**
 * One failure, one event. The identity machine reports a failed transition
 * first; when the same `CapxulError` then surfaces as a public method result
 * (directly or down its `cause` chain), the boundary drops that second report.
@@ -5721,6 +5964,34 @@ function ignoreDeliveryFailure(delivery) {
 	} catch {}
 }
 /**
+* Fold a caller-captured attempt identity into the host's resolved context.
+*
+* The host's `resolveContext` runs at the moment an SDK method is entered, so a
+* host that mints a correlation per resolve gives every operation of one user
+* attempt a different identity — and a user or Organization switch between the
+* click and the reply relabels an action that already started. When the caller
+* captured `correlation_id`/`journey_id` BEFORE the action started, that is the
+* attempt, and it replaces what the resolver returned for this one call. The
+* result is what the SDK span/Log, the failure envelope and the backend carrier
+* all read, so the three agree by construction rather than by convention.
+*
+* A caller that captured nothing gets the resolver's context unchanged, so
+* automatic reads keep their own invocation context.
+*/
+function withCapturedAttemptContext(context, controls) {
+	const correlationId = controls?.correlation_id;
+	const journeyId = controls?.journey_id;
+	if (correlationId === void 0 && journeyId === void 0) return context;
+	const captured = sanitizeObservationContext({
+		...correlationId === void 0 ? {} : { correlationId },
+		...journeyId === void 0 ? {} : { journeyId }
+	});
+	return captured === void 0 ? context : {
+		...context,
+		...captured
+	};
+}
+/**
 * Map an ALREADY-sanitized observation context to the snake_case PostHog
 * property keys. Shared by the failure boundary here and the host
 * success-telemetry seam (`telemetry/from-posthog.ts`) so both attach identical
@@ -7852,7 +8123,8 @@ var BetterAuthBrowserAdapter = class {
 		try {
 			const res = await this.fetchImpl(this.url("/api/auth/get-session"), withSignal$1({
 				method: "GET",
-				credentials: "include"
+				credentials: "include",
+				cache: "no-store"
 			}, options?.signal));
 			if (options?.signal?.aborted) return {
 				ok: false,
@@ -7924,7 +8196,8 @@ var BetterAuthBrowserAdapter = class {
 		try {
 			const res = await this.fetchImpl(this.url("/api/auth/convex/token"), withSignal$1({
 				method: "GET",
-				credentials: "include"
+				credentials: "include",
+				cache: "no-store"
 			}, options?.signal));
 			if (options?.signal?.aborted) return {
 				ok: false,
@@ -8437,7 +8710,7 @@ function isTransientBootstrapFailure(error) {
 	const status = error.details?.httpStatus;
 	return typeof status === "number" && isTransientHttpStatus(status);
 }
-async function safeText(res) {
+async function safeText$1(res) {
 	try {
 		return await res.text();
 	} catch {
@@ -8510,6 +8783,8 @@ var HttpBootstrapAdapter = class {
 					siteBaseUrl: normalizeRuntimeUrl("siteBaseUrl", decodedState.siteBaseUrl),
 					openfortPublishableKey: decodedState.openfortPublishableKey,
 					shieldPublishableKey: decodedState.shieldPublishableKey,
+					...decodedState.openfortAuthProvider === void 0 ? {} : { openfortAuthProvider: decodedState.openfortAuthProvider },
+					...decodedState.indexerUrl === void 0 ? {} : { indexerUrl: decodedState.indexerUrl },
 					...decodedEngineeringTelemetry !== void 0 && Result.isSuccess(decodedEngineeringTelemetry) ? { engineeringTelemetry: decodedEngineeringTelemetry.success } : {}
 				};
 			},
@@ -8518,7 +8793,7 @@ var HttpBootstrapAdapter = class {
 				return bootstrapErrorFromCapxul("malformedBody", Errors.providerError("convex", "bootstrap", cause instanceof Error ? cause : new Error(String(cause))));
 			}
 		});
-		return Effect.promise(() => safeText(res)).pipe(Effect.flatMap((body) => {
+		return Effect.promise(() => safeText$1(res)).pipe(Effect.flatMap((body) => {
 			if (res.status === 401 || body.startsWith("NOT_AUTHENTICATED")) return Effect.fail(bootstrapErrorFromCapxul("notAuthenticated", Errors.notAuthenticated()));
 			if (res.status === 400 || body.startsWith("INVALID_INPUT")) return Effect.fail(bootstrapErrorFromCapxul("invalidInput", Errors.invalidInput("publishableKey", "rejected by bootstrap")));
 			const responseBody = body.slice(0, 300);
@@ -8748,6 +9023,12 @@ function makeConnectionId() {
 }
 //#endregion
 //#region src/adapters/convex-call/ConvexCallAdapter.ts
+/**
+* A socket that has not emitted `close` within this window is not going to.
+* ponytail: one fixed bound; `closeTimeoutMs` is the knob if a slow runtime
+* ever needs a different one.
+*/
+const DEFAULT_CLOSE_TIMEOUT_MS = 5e3;
 /** Exact floor-first allowlist; every additional handler must migrate its validator first. */
 const OBSERVED_CONVEX_ACTIONS = /* @__PURE__ */ new Set([
 	"payroll/actions:authorizeRun",
@@ -8816,7 +9097,9 @@ var ConvexCallAdapter = class {
 	#applicationId;
 	#observation;
 	#connectionMonitor;
+	#closeTimeoutMs;
 	constructor(deps) {
+		this.#closeTimeoutMs = deps.closeTimeoutMs ?? DEFAULT_CLOSE_TIMEOUT_MS;
 		this.#connectionMonitor = new ConvexConnectionMonitor();
 		const webSocketConstructor = this.#connectionMonitor.observedWebSocketConstructor();
 		this.#client = deps.client ?? new ConvexClient(deps.convexUrl, webSocketConstructor === void 0 ? {} : { webSocketConstructor });
@@ -8915,11 +9198,33 @@ var ConvexCallAdapter = class {
 			callback({ status: "loading" });
 		})));
 	}
+	/**
+	* Teardown always completes. `ConvexClient.close()` resolves only when the
+	* socket emits `close`, and `WebSocketManager.close()` in the `connecting`
+	* state arms `ws.onopen = () => ws.close()` without ever closing the socket
+	* itself — so a handshake that stalls right after a server-initiated close
+	* (code 1012, which is what a Convex deploy sends) leaves that promise
+	* pending for as long as the page lives. Convex marks the client closed and
+	* terminates the socket manager synchronously before returning it, so
+	* abandoning it drops nothing. A rejection is dropped for the same reason —
+	* the layer release turns it into a defect that fails the whole scope close,
+	* and teardown has no caller who can act on it.
+	*/
 	async close() {
 		this.#connectionMonitor.close();
-		await this.#client.close();
+		await settledWithin(this.#client.close(), this.#closeTimeoutMs);
 	}
 };
+function settledWithin(promise, timeoutMs) {
+	return new Promise((resolve) => {
+		const timer = setTimeout(resolve, timeoutMs);
+		const finish = () => {
+			clearTimeout(timer);
+			resolve();
+		};
+		promise.then(finish, finish);
+	});
+}
 function ConvexCallLayer(deps) {
 	return Layer.effect(ConvexCallPortTag, Effect.acquireRelease(Effect.sync(() => new ConvexCallAdapter(deps)), (adapter) => Effect.promise(() => adapter.close()).pipe(Effect.orDie)));
 }
@@ -9872,6 +10177,32 @@ var ConsoleDiagnosticAdapter = class {
 	}
 };
 //#endregion
+//#region src/adapters/diagnostic/EffectLogDiagnosticAdapter.ts
+/**
+* Diagnostic breadcrumbs as SDK log records. The signer's readiness cycle
+* traces (`openfort.*`) used to reach only the browser console; through this
+* adapter they run in the client's own Effect context, so the engineering
+* telemetry layer ships them to PostHog Logs beside `identity.transition`.
+* Logging never throws back into the cycle that emitted it.
+*/
+var EffectLogDiagnosticAdapter = class {
+	#runPromise;
+	#console;
+	constructor(context, consoleFallback) {
+		this.#runPromise = Effect.runPromiseWith(context);
+		this.#console = consoleFallback;
+	}
+	trace(scope, detail) {
+		this.#console?.trace(scope, detail);
+		try {
+			this.#runPromise(Effect.logInfo(scope).pipe(Effect.annotateLogs({
+				...detail,
+				diagnostic_scope: scope
+			}), Effect.catchCause(() => Effect.void))).catch(() => void 0);
+		} catch {}
+	}
+};
+//#endregion
 //#region src/openfort/create-openfort-browser-signer.ts
 function httpStatusOf(link) {
 	const carrier = link;
@@ -10003,15 +10334,35 @@ function createOpenfortBrowserSignerFromBootstrap(bootstrap, options = {}) {
 		});
 		throw failOpenfort("configure", "no-secure-context", /* @__PURE__ */ new Error("Web Crypto unavailable: browser is not a secure context"));
 	}
-	function betterAuthSessionUrl() {
-		return `${authBaseUrl}/get-session`;
+	const authProvider = bootstrap.openfortAuthProvider ?? "better-auth";
+	function accessTokenUrl() {
+		return authProvider === "oidc" ? `${authBaseUrl}/convex/token` : `${authBaseUrl}/get-session`;
 	}
 	function encryptionSessionUrl() {
 		return `${authBaseUrl}/encryption-session`;
 	}
+	let cycleStartedAt = null;
+	let stepStartedAt = 0;
+	let tokenCalls = 0;
+	const sinceCycleStart = () => cycleStartedAt === null ? void 0 : Date.now() - cycleStartedAt;
+	const step = (name, extra = {}) => {
+		const now = Date.now();
+		diagnostic?.trace("openfort.step", {
+			step: name,
+			duration_ms: now - stepStartedAt,
+			elapsed_ms: sinceCycleStart(),
+			...extra
+		});
+		stepStartedAt = now;
+	};
 	async function fetchBetterAuthAccessToken() {
+		tokenCalls += 1;
+		const tokenStartedAt = Date.now();
 		try {
-			const response = await fetch(betterAuthSessionUrl(), { credentials: "include" });
+			const response = await fetch(accessTokenUrl(), {
+				credentials: "include",
+				cache: "no-store"
+			});
 			if (!response.ok) {
 				diagnostic?.trace("openfort.token", {
 					ok: false,
@@ -10021,7 +10372,8 @@ function createOpenfortBrowserSignerFromBootstrap(bootstrap, options = {}) {
 				});
 				return null;
 			}
-			const token = (await response.json()).session?.token?.trim();
+			const body = await response.json();
+			const token = (authProvider === "oidc" ? body.token : body.session?.token)?.trim();
 			if (token === void 0 || token.length === 0) {
 				diagnostic?.trace("openfort.token", {
 					ok: false,
@@ -10032,7 +10384,11 @@ function createOpenfortBrowserSignerFromBootstrap(bootstrap, options = {}) {
 			}
 			diagnostic?.trace("openfort.token", {
 				ok: true,
-				tokenPresent: true
+				tokenPresent: true,
+				provider: authProvider,
+				call: tokenCalls,
+				duration_ms: Date.now() - tokenStartedAt,
+				elapsed_ms: sinceCycleStart()
 			});
 			return token;
 		} catch (cause) {
@@ -10048,7 +10404,7 @@ function createOpenfortBrowserSignerFromBootstrap(bootstrap, options = {}) {
 		baseConfiguration: { publishableKey: bootstrap.openfortPublishableKey },
 		shieldConfiguration: { shieldPublishableKey: bootstrap.shieldPublishableKey },
 		thirdPartyAuth: {
-			provider: ThirdPartyOAuthProvider.BETTER_AUTH,
+			provider: authProvider === "oidc" ? ThirdPartyOAuthProvider.OIDC : ThirdPartyOAuthProvider.BETTER_AUTH,
 			getAccessToken: fetchBetterAuthAccessToken
 		}
 	});
@@ -10088,10 +10444,16 @@ function createOpenfortBrowserSignerFromBootstrap(bootstrap, options = {}) {
 	let walletReadyPromise = null;
 	function startWalletReady() {
 		return (async () => {
+			const startedAt = Date.now();
+			cycleStartedAt = startedAt;
+			stepStartedAt = startedAt;
+			tokenCalls = 0;
 			if (isInsecureBrowserContext()) failNoSecureContext();
 			await openfort.waitForInitialization();
+			step("initialize");
 			const accessToken = await fetchBetterAuthAccessToken();
 			if (accessToken === null) throw openfortProviderError("token", /* @__PURE__ */ new Error("Better Auth access token unavailable for Openfort"));
+			step("token");
 			let encryptionResponse;
 			try {
 				encryptionResponse = await fetch(encryptionSessionUrl(), {
@@ -10134,10 +10496,12 @@ function createOpenfortBrowserSignerFromBootstrap(bootstrap, options = {}) {
 				ok: true,
 				httpStatus: encryptionResponse.status
 			});
+			step("encryptionSession", { httpStatus: encryptionResponse.status });
 			let embeddedState;
 			try {
 				embeddedState = await openfort.embeddedWallet.getEmbeddedState();
 				diagnostic?.trace("openfort.embeddedState", { state: embeddedState });
+				step("embeddedState", { state: embeddedState });
 			} catch (cause) {
 				diagnostic?.trace("openfort.embeddedState", {
 					ok: false,
@@ -10151,6 +10515,7 @@ function createOpenfortBrowserSignerFromBootstrap(bootstrap, options = {}) {
 				try {
 					await configureEmbeddedWallet(encryptionBody.sessionId);
 					diagnostic?.trace("openfort.configure", { ok: true });
+					step("configure");
 				} catch (cause) {
 					const error = openfortProviderError("configure", cause);
 					diagnostic?.trace("openfort.configure", {
@@ -10163,6 +10528,7 @@ function createOpenfortBrowserSignerFromBootstrap(bootstrap, options = {}) {
 			try {
 				await openfort.embeddedWallet.get();
 				diagnostic?.trace("openfort.get", { ok: true });
+				step("get");
 			} catch (cause) {
 				if (!isStaleUserSignal(cause)) {
 					diagnostic?.trace("openfort.get", {
@@ -10176,7 +10542,13 @@ function createOpenfortBrowserSignerFromBootstrap(bootstrap, options = {}) {
 					failure_mode: "stale-openfort-cache"
 				});
 				await healStaleOpenfortCache(encryptionBody.sessionId);
+				step("healStaleCache");
 			}
+			step("walletReady", {
+				ok: true,
+				total_ms: Date.now() - startedAt,
+				token_calls: tokenCalls
+			});
 		})();
 	}
 	async function ensureOpenfortWalletReady() {
@@ -10259,9 +10631,13 @@ function createOpenfortBrowserSignerFromBootstrap(bootstrap, options = {}) {
 		statusStore,
 		ensureWalletReady: ensureOpenfortWalletReady,
 		getAddress: async () => {
+			const addressStartedAt = Date.now();
 			try {
 				const address = await signer.getAddress();
-				diagnostic?.trace("openfort.address", { ok: true });
+				diagnostic?.trace("openfort.address", {
+					ok: true,
+					duration_ms: Date.now() - addressStartedAt
+				});
 				return address;
 			} catch (cause) {
 				diagnostic?.trace("openfort.address", {
@@ -11363,14 +11739,66 @@ function organizationWrongState(currentState, validStates) {
 function requestCancelled(options) {
 	return options?.signal?.aborted === true;
 }
+function accountInFlight(state) {
+	return state.phase === "authenticated" && (state.account.at === "deriving" || state.account.at === "claiming");
+}
+function settledAccount(deps, options) {
+	return new Promise((resolve) => {
+		let done = false;
+		let unsubscribe = null;
+		const onAbort = () => finish({
+			ok: false,
+			error: Errors.cancelled({ operation: CAPXUL_OPERATIONS.onboarding.completeOrganization })
+		});
+		const finish = (result) => {
+			if (done) return;
+			done = true;
+			unsubscribe?.();
+			options?.signal?.removeEventListener("abort", onAbort);
+			resolve(result);
+		};
+		if (options?.signal?.aborted) {
+			onAbort();
+			return;
+		}
+		options?.signal?.addEventListener("abort", onAbort, { once: true });
+		const stop = deps.subscribeIdentity((state) => {
+			if (!accountInFlight(state)) finish({
+				ok: true,
+				value: state
+			});
+		});
+		if (done) {
+			stop();
+			return;
+		}
+		unsubscribe = stop;
+		const current = deps.snapshotIdentity();
+		if (!accountInFlight(current)) finish({
+			ok: true,
+			value: current
+		});
+	});
+}
 async function reachClaimedAccount(deps, options) {
 	let state = deps.snapshotIdentity();
+	if (accountInFlight(state)) {
+		const settled = await settledAccount(deps, options);
+		if (!settled.ok) return settled;
+		state = settled.value;
+	}
 	if (state.phase !== "authenticated" || state.account.at === "unknown") {
 		const ensured = await deps.sendIdentity({ _tag: "EnsureAccount" }, options);
 		if (!ensured.ok) return ensured;
 		state = ensured.value;
 	}
 	if (state.phase !== "authenticated") return organizationWrongState(state.phase, ["authenticated:claimed"]);
+	if (accountInFlight(state)) {
+		const settled = await settledAccount(deps, options);
+		if (!settled.ok) return settled;
+		state = settled.value;
+		if (state.phase !== "authenticated") return organizationWrongState(state.phase, ["authenticated:claimed"]);
+	}
 	if (state.account.at !== "claimed") {
 		const event = state.account.at === "failed" ? { _tag: "RetryAccount" } : state.account.at === "counterfactual" ? { _tag: "ClaimAccount" } : { _tag: "EnsureAccount" };
 		const claimed = await deps.sendIdentity(event, options);
@@ -11722,6 +12150,25 @@ const permissionContract = { read: makeFunctionReference(CAPXUL_FUNCTIONS["permi
 function isAborted(signal) {
 	return signal?.aborted === true;
 }
+/**
+* One owning operation per public Permission method. The compound command
+* (prepare, equality checks, sign, submit) keeps owning its own cancellation;
+* the observed runner around it is what gives the attempt its
+* `capxul_sdk_operation` record, its span and its failure capture, so a signer
+* refusal or an unexpected provider error joins to the operation like every
+* other public surface.
+*/
+function observed(deps, operation, options, run) {
+	const controls = deps.invocationControls?.(options) ?? options;
+	return runCapxulEffect(Effect.gen(function* () {
+		if (controls?.signal?.aborted === true) return yield* Effect.fail(Errors.cancelled({ operation }));
+		const result = yield* Effect.tryPromise({
+			try: () => run(controls?.signal),
+			catch: (cause) => cause instanceof CapxulError ? cause : Errors.unknown(cause)
+		});
+		return yield* result.ok ? Effect.succeed(result.value) : Effect.fail(result.error);
+	}), observationOnlyControls(controls), operation, deps.runPromise);
+}
 async function execute(deps, orgId, command, signal) {
 	if (isAborted(signal)) return {
 		ok: false,
@@ -11781,36 +12228,37 @@ async function execute(deps, orgId, command, signal) {
 }
 function makePermissionMethods(deps, orgId) {
 	const reads = deps.permissionFunctions ?? permissionContract;
+	const ops = CAPXUL_OPERATIONS.org.permissions;
 	return {
-		create: (input, options) => execute(deps, orgId, {
+		create: (input, options) => observed(deps, ops.create, options, (signal) => execute(deps, orgId, {
 			operation: "create",
 			...input
-		}, options?.signal),
-		change: (input, options) => execute(deps, orgId, {
+		}, signal)),
+		change: (input, options) => observed(deps, ops.change, options, (signal) => execute(deps, orgId, {
 			operation: "change",
 			...input
-		}, options?.signal),
-		assign: (input, options) => execute(deps, orgId, {
+		}, signal)),
+		assign: (input, options) => observed(deps, ops.assign, options, (signal) => execute(deps, orgId, {
 			operation: "assign",
 			...input
-		}, options?.signal),
-		revoke: (input, options) => execute(deps, orgId, {
+		}, signal)),
+		revoke: (input, options) => observed(deps, ops.revoke, options, (signal) => execute(deps, orgId, {
 			operation: "revoke",
 			...input
-		}, options?.signal),
-		replace: (input, options) => execute(deps, orgId, {
+		}, signal)),
+		replace: (input, options) => observed(deps, ops.replace, options, (signal) => execute(deps, orgId, {
 			operation: "replace",
 			...input
-		}, options?.signal),
-		list: (options) => runIfActive(options?.signal, CAPXUL_OPERATIONS.permissions.list, () => deps.convexCall.query(reads.read, { orgId })),
-		get: async (permissionId, options) => {
-			const listed = await runIfActive(options?.signal, CAPXUL_OPERATIONS.permissions.get, () => deps.convexCall.query(reads.read, { orgId }));
+		}, signal)),
+		list: (options) => observed(deps, ops.list, options, (signal) => runIfActive(signal, CAPXUL_OPERATIONS.permissions.list, () => deps.convexCall.query(reads.read, { orgId }))),
+		get: (permissionId, options) => observed(deps, ops.get, options, async (signal) => {
+			const listed = await runIfActive(signal, CAPXUL_OPERATIONS.permissions.get, () => deps.convexCall.query(reads.read, { orgId }));
 			if (!listed.ok) return listed;
 			return {
 				ok: true,
 				value: listed.value.permissions.find((row) => row.permissionId === permissionId) ?? null
 			};
-		}
+		})
 	};
 }
 //#endregion
@@ -12372,7 +12820,7 @@ function hermeticOrgView(input) {
 		name: input.name,
 		handle: input.handle,
 		safeAddress: toAddress(placeholder),
-		role: "Owner",
+		role: ADMIN_ROLE_LABEL,
 		treasury: zeroTreasury(orgId),
 		bio: null,
 		size: null,
@@ -12618,6 +13066,13 @@ function isRetryableOrganizationSetupFailure(error) {
 * constructed for each `org(orgId)` call. It has no shared mutable active-Org
 * state. The closed-over `orgId` is its only entity reference.
 */
+/** The observed-runner pair a method bundle needs to own its operation records. */
+function observedRunnerDeps(deps) {
+	return {
+		...deps.runPromise === void 0 ? {} : { runPromise: deps.runPromise },
+		...deps.invocationControls === void 0 ? {} : { invocationControls: deps.invocationControls }
+	};
+}
 function makeOrgMethods(deps) {
 	const orgDeps = {
 		...deps.orgPort === void 0 ? {} : { orgPort: deps.orgPort },
@@ -12785,6 +13240,7 @@ function makeOrgMethods(deps) {
 				},
 				permissions: convexCall === void 0 ? makeNotImplementedPermissionMethods() : makePermissionMethods({
 					convexCall,
+					...observedRunnerDeps(deps),
 					...deps.actor === void 0 ? {} : { actor: deps.actor },
 					...deps.chainId === void 0 ? {} : { chainId: Number(deps.chainId) },
 					...deps.signer === void 0 ? {} : { signer: deps.signer }
@@ -12977,11 +13433,28 @@ const authFailure = (record, reason, mode) => ({
 		...linkage(record)
 	}
 });
+const REFUSAL_EVENTS = /* @__PURE__ */ new Set([
+	"ClaimAccount",
+	"RetryAccount",
+	"CreateOrganization",
+	"AttachOrganization",
+	"RetryOrganization"
+]);
 function mapIdentityProductObservation(record, state) {
 	if (record.machine !== "identity" || !IDENTITY_EVENT_TAG_SET.has(record.event)) return NONE;
 	if (record.outcome === "cancelled") return NONE;
 	if (record.slot === "identity:auth" && record.outcome === "refused") return authFailure(record, record.refusal_code, void 0);
 	if (record.slot === "identity:auth" && record.outcome === "failed") return authFailure(record, record.error_code, record.failure?.mode);
+	if (record.outcome === "refused" && REFUSAL_EVENTS.has(record.event)) return {
+		name: "identity_refused",
+		props: {
+			event: record.event,
+			refusal_code: record.refusal_code,
+			slot: record.slot,
+			state: record.state,
+			...linkage(record)
+		}
+	};
 	if (record.outcome !== "applied") return NONE;
 	switch (APPLIED_ACTION_BY_EVENT[record.event]) {
 		case "none": return NONE;
@@ -13140,10 +13613,13 @@ function assembleCapxulClient(input) {
 		...input.invokeTimeoutMs === void 0 ? {} : { invokeTimeoutMs: input.invokeTimeoutMs },
 		afterVerifyOtp: async () => {
 			const browserSigner = input.signer;
-			if (browserSigner !== void 0 && "resetSession" in browserSigner && typeof browserSigner.resetSession === "function") try {
-				browserSigner.resetSession();
-			} catch (cause) {
-				throw signerFailure(browserSigner.source, "resetSession", cause);
+			if (browserSigner !== void 0 && "resetSession" in browserSigner && typeof browserSigner.resetSession === "function") {
+				try {
+					browserSigner.resetSession();
+				} catch (cause) {
+					throw signerFailure(browserSigner.source, "resetSession", cause);
+				}
+				if (browserSigner.statusStore?.status() === "unknown" && typeof browserSigner.ensureWalletReady === "function") browserSigner.ensureWalletReady().catch(() => {});
 			}
 			await detectPendingOrgInvitations?.();
 			kickProvisioning?.();
@@ -13170,6 +13646,7 @@ function assembleCapxulClient(input) {
 		ensureAccount: account._internal.ensureReady,
 		getLifecycle: account.getLifecycle,
 		snapshotIdentity: actor.snapshot,
+		subscribeIdentity: actor.subscribe,
 		sendIdentity: (event, options) => runCapxulEffect(askIdentity(actor, event, options), options, CAPXUL_OPERATIONS._internal.identity.send, effectRunner.runPromise)
 	});
 	const system = makeSystemMethods({ convexCall: input.ports.convexCall });
@@ -13303,6 +13780,7 @@ function assembleCapxulClient(input) {
 			identity: identityRuntime,
 			bootstrap: input.bootstrap,
 			accounts: { fund: accounts.fund },
+			...input.ports.indexerRead === void 0 ? {} : { indexer: input.ports.indexerRead },
 			organizationSetup: { getProofReceipt: (orgId) => runPortEffect(input.ports.convexCall.query(organizationSetupProofReceiptQuery, { orgId })) },
 			telemetry: input.ports.telemetry,
 			captureExternalAddressAcknowledged: (address, organizationId) => {
@@ -13361,8 +13839,10 @@ function withHostObservationControls(snapshot, input, actorId) {
 	const previous = readInvocationObservation(input);
 	if (previous !== void 0) return attachInvocationObservation({ ...input }, previous);
 	const captured = snapshot?.() ?? { active: true };
+	const context = captured.active ? withCapturedAttemptContext(captured.context, input) : captured.context;
 	return attachInvocationObservation({ ...input }, {
 		...captured,
+		...context === void 0 ? {} : { context },
 		...actorId === void 0 ? {} : { actorId }
 	});
 }
@@ -13502,6 +13982,382 @@ function snapshotHostObservability(observability) {
 function isPromiseLike(value) {
 	return (typeof value === "object" && value !== null || typeof value === "function") && "then" in value;
 }
+//#endregion
+//#region src/ports/indexer-read.ts
+/** The indexer's own page bound. Exceeding it is a caller defect, not a refusal. */
+const INDEXER_MAX_LIMIT = 1e3;
+const LOWER_CASE_ADDRESS = /^0x[0-9a-f]{40}$/;
+/**
+* Refuse a page the indexer would refuse, before any implementation spends a
+* round trip on it. Every implementation calls this, so a consumer test written
+* against the hermetic adapter cannot pass on input production rejects. Throws
+* a `CapxulError`; callers convert it to an `IndexerReadError`.
+*/
+function assertIndexerPage(input) {
+	const safe = String(input.safe).toLowerCase();
+	if (!LOWER_CASE_ADDRESS.test(safe)) throw Errors.invalidInput("safe", "must be a lower-case EVM address");
+	if (!Number.isSafeInteger(input.limit) || input.limit < 1 || input.limit > 1e3) throw Errors.invalidInput("limit", `must be an integer from 1 to ${INDEXER_MAX_LIMIT}`);
+	const offset = input.offset ?? 0;
+	if (!Number.isSafeInteger(offset) || offset < 0) throw Errors.invalidInput("offset", "must be a non-negative integer");
+	return safe;
+}
+var IndexerReadError = class extends Data.TaggedError("IndexerReadError") {};
+function indexerReadErrorFromCapxul(operation, error, cause = error) {
+	return new IndexerReadError({
+		operation,
+		publicCode: error.code,
+		publicError: error,
+		cause,
+		...error.details === void 0 ? {} : { details: error.details }
+	});
+}
+Context.Service()("@capxul/sdk/ports/IndexerReadPort");
+//#endregion
+//#region src/adapters/ponder/decode.ts
+/**
+* Decode the indexer's rows at the trust boundary.
+*
+* Ponder returns the raw PostgreSQL result: `integer` arrives as a number,
+* `numeric(78)` and `text` arrive as strings. Amounts, block numbers and
+* timestamps are `numeric(78)`, so they become `bigint` here and never pass
+* through `Number`. Every decoder throws a `CapxulError`; the adapter turns
+* that into a typed `IndexerReadError`.
+*/
+const HEX = /^0x[0-9a-fA-F]+$/;
+function field(row, key) {
+	if (!(key in row)) throw Errors.invalidInput(key, "missing from the indexer row");
+	return row[key];
+}
+function text(row, key) {
+	const value = field(row, key);
+	if (typeof value !== "string") throw Errors.invalidInput(key, "must be a string");
+	return value;
+}
+function hex(row, key) {
+	const value = text(row, key);
+	if (!HEX.test(value)) throw Errors.invalidInput(key, "must be a hex string");
+	return value.toLowerCase();
+}
+function integer(row, key) {
+	const value = field(row, key);
+	const parsed = typeof value === "string" ? Number(value) : value;
+	if (typeof parsed !== "number" || !Number.isSafeInteger(parsed)) throw Errors.invalidInput(key, "must be an integer");
+	return parsed;
+}
+/** `numeric(78)` crosses the wire as a decimal string; keep every digit. */
+function big(row, key) {
+	const value = field(row, key);
+	if (typeof value === "bigint") return value;
+	const raw = typeof value === "number" ? String(value) : value;
+	if (typeof raw !== "string" || !/^-?[0-9]+$/.test(raw)) throw Errors.invalidInput(key, "must be an exact integer amount");
+	return BigInt(raw);
+}
+function asRow(value) {
+	if (typeof value !== "object" || value === null || Array.isArray(value)) throw Errors.invalidInput("row", "must be an object");
+	return value;
+}
+function identity(row) {
+	return {
+		id: text(row, "id"),
+		chainId: toChainId(integer(row, "chain_id")),
+		txHash: toTxHash(hex(row, "tx_hash")),
+		transactionLogOrdinal: integer(row, "transaction_log_ordinal"),
+		blockNumber: big(row, "block_number"),
+		blockHash: hex(row, "block_hash"),
+		timestamp: big(row, "timestamp")
+	};
+}
+function decodeTransfer(value) {
+	const row = asRow(value);
+	return {
+		...identity(row),
+		assetId: toAssetId(text(row, "asset_id")),
+		token: toAddress(hex(row, "token")),
+		from: toAddress(hex(row, "from")),
+		to: toAddress(hex(row, "to")),
+		amount: big(row, "amount")
+	};
+}
+function decodePayment(value) {
+	const row = asRow(value);
+	return {
+		...identity(row),
+		contract: toAddress(hex(row, "contract")),
+		settlementId: hex(row, "settlement_id"),
+		sender: toAddress(hex(row, "sender")),
+		recipient: toAddress(hex(row, "recipient")),
+		assetId: toAssetId(text(row, "asset_id")),
+		token: toAddress(hex(row, "token")),
+		amount: big(row, "amount"),
+		kind: integer(row, "kind"),
+		documentHash: hex(row, "document_hash")
+	};
+}
+/** The `balance` view exposes the signed sum under the underlying column name `to`. */
+function decodeBalance(value) {
+	const row = asRow(value);
+	return {
+		chainId: toChainId(integer(row, "chain_id")),
+		assetId: toAssetId(text(row, "asset_id")),
+		address: toAddress(hex(row, "to")),
+		amount: big(row, "amount")
+	};
+}
+const DECODERS = {
+	transfer: decodeTransfer,
+	payment: decodePayment,
+	balance: decodeBalance
+};
+/** Decode one `/sql/db` or `/sql/live` payload. Ponder returns `{ rows: [...] }`. */
+function decodeRows(table, body) {
+	const rows = asRow(body).rows;
+	if (!Array.isArray(rows)) throw Errors.invalidInput("rows", "must be an array");
+	const decode = DECODERS[table];
+	return rows.map(decode);
+}
+/** Decode Ponder's native `/status`: `{ [chainName]: { id, block: { number, timestamp } } }`. */
+function decodeStatus(body) {
+	const chains = asRow(body);
+	return Object.entries(chains).map(([chain, value]) => {
+		const entry = asRow(value);
+		const block = asRow(field(entry, "block"));
+		return {
+			chain,
+			chainId: toChainId(integer(entry, "id")),
+			blockNumber: big(block, "number"),
+			blockTimestamp: big(block, "timestamp")
+		};
+	});
+}
+//#endregion
+//#region src/adapters/ponder/statements.ts
+/**
+* The exact statements the indexer accepts.
+*
+* `apps/indexer/src/queries.ts` compiles its allowlist with `@ponder/client`
+* and compares `sql`, `params` and `typings` byte for byte against the caller's
+* statement. Anything else gets 403. The SDK therefore reproduces the compiled
+* text here rather than pulling Ponder and Drizzle into a published browser
+* bundle to regenerate three fixed statements.
+*
+* `statements.test.ts` pins the text. When the indexer schema or a query in
+* that allowlist changes, this file changes with it or every read fails 403.
+*/
+const HEADS = {
+	transfer: "select \"id\", \"chain_id\", \"tx_hash\", \"transaction_log_ordinal\", \"block_number\", \"block_hash\", \"timestamp\", \"asset_id\", \"token\", \"from\", \"to\", \"amount\" from \"transfer\" where (\"transfer\".\"from\" = $1 or \"transfer\".\"to\" = $2) order by \"transfer\".\"block_number\" desc, \"transfer\".\"id\" desc",
+	payment: "select \"id\", \"chain_id\", \"tx_hash\", \"transaction_log_ordinal\", \"block_number\", \"block_hash\", \"timestamp\", \"contract\", \"settlement_id\", \"sender\", \"recipient\", \"asset_id\", \"token\", \"amount\", \"kind\", \"document_hash\" from \"payment\" where (\"payment\".\"sender\" = $1 or \"payment\".\"recipient\" = $2) order by \"payment\".\"block_number\" desc, \"payment\".\"id\" desc",
+	balance: "select \"chain_id\", \"asset_id\", \"to\", \"amount\" from \"balance\" where \"balance\".\"to\" = $1"
+};
+/** How many times the statement binds the Safe address. */
+const ACTOR_PARAMS = {
+	transfer: 2,
+	payment: 2,
+	balance: 1
+};
+/**
+* Build the compiled query for one table and page. Throws a `CapxulError` for
+* a page or address the indexer would refuse, so the caller never spends a
+* round trip to learn it built the request wrong.
+*/
+function ponderQuery(table, input) {
+	const safe = assertIndexerPage(input);
+	const offset = input.offset ?? 0;
+	const actors = ACTOR_PARAMS[table];
+	const params = [];
+	for (let i = 0; i < actors; i++) params.push(safe);
+	params.push(input.limit);
+	let sql = `${HEADS[table]} limit $${actors + 1}`;
+	if (offset > 0) {
+		params.push(offset);
+		sql = `${sql} offset $${actors + 2}`;
+	}
+	return {
+		sql,
+		params,
+		typings: params.map(() => "none")
+	};
+}
+/**
+* The `?sql=` value. `@ponder/client` sends `superjson.stringify(query)`; for a
+* payload of strings and numbers superjson emits no `meta`, so the wire form is
+* exactly this envelope.
+*/
+function ponderQueryParam(query) {
+	return JSON.stringify({ json: query });
+}
+//#endregion
+//#region src/adapters/ponder/sse.ts
+/**
+* The smallest SSE reader that can carry an `Authorization` header.
+*
+* `@ponder/client` opens its live query with `EventSource`, which accepts no
+* headers, so it cannot reach the guarded indexer at all. The indexer's CORS
+* policy allows exactly one request header (`Authorization`), so this reader
+* sends nothing else. Ponder writes one `data:` line per frame.
+*/
+async function readEventStream(body, onData, stopped) {
+	const reader = body.getReader();
+	const decoder = new TextDecoder();
+	let buffer = "";
+	try {
+		for (;;) {
+			const { done, value } = await reader.read();
+			if (done || stopped()) return;
+			buffer += decoder.decode(value, { stream: true });
+			let split = buffer.indexOf("\n\n");
+			while (split !== -1) {
+				const frame = buffer.slice(0, split);
+				buffer = buffer.slice(split + 2);
+				const data = frameData(frame);
+				if (data !== void 0) onData(data);
+				if (stopped()) return;
+				split = buffer.indexOf("\n\n");
+			}
+		}
+	} finally {
+		await reader.cancel().catch(() => void 0);
+	}
+}
+function frameData(frame) {
+	const lines = [];
+	for (const line of frame.split("\n")) {
+		if (!line.startsWith("data:")) continue;
+		lines.push(line.slice(line.startsWith("data: ") ? 6 : 5));
+	}
+	return lines.length === 0 ? void 0 : lines.join("\n");
+}
+//#endregion
+//#region src/adapters/ponder/PonderIndexerAdapter.ts
+var PonderIndexerAdapter = class {
+	#baseUrl;
+	#token;
+	#fetch;
+	#observation;
+	constructor(deps) {
+		this.#baseUrl = deps.baseUrl.replace(/\/$/, "");
+		this.#token = deps.token;
+		this.#observation = deps.observation;
+		this.#fetch = deps.fetch ?? ((input, init) => globalThis.fetch(input, init));
+	}
+	read(table, input) {
+		const operation = `indexer.read.${table}`;
+		return Effect.tryPromise({
+			try: async () => {
+				return decodeRows(table, await (await this.#request("db", table, input, operation)).json());
+			},
+			catch: (cause) => toIndexerReadError(operation, cause)
+		});
+	}
+	subscribe(table, input, callback) {
+		const operation = CAPXUL_OPERATIONS.activity.subscribe;
+		return Effect.sync(() => {
+			let stopped = false;
+			const unsubscribe = () => {
+				stopped = true;
+			};
+			callback({ status: "loading" });
+			this.#stream(table, input, operation, callback, () => stopped).catch(() => void 0);
+			return unsubscribe;
+		});
+	}
+	status = Effect.tryPromise({
+		try: async () => {
+			const response = await this.#fetch(`${this.#baseUrl}/status`, { method: "GET" });
+			if (!response.ok) throw httpError("indexer.status", response.status, await safeText(response));
+			return decodeStatus(await response.json());
+		},
+		catch: (cause) => toIndexerReadError("indexer.status", cause)
+	});
+	/** One authenticated `/sql/:method` call. Throws a `CapxulError` on refusal. */
+	async #request(method, table, input, operation) {
+		const query = ponderQuery(table, input);
+		const token = await this.#token({ forceRefreshToken: false });
+		if (token === null || token === "") throw Errors.notAuthenticated();
+		const url = `${this.#baseUrl}/sql/${method}?sql=${encodeURIComponent(ponderQueryParam(query))}`;
+		const headers = { authorization: `Bearer ${token}` };
+		if (method === "live") headers.accept = "text/event-stream";
+		let response;
+		try {
+			response = await this.#fetch(url, {
+				method: "GET",
+				headers
+			});
+		} catch (cause) {
+			throw Errors.networkError(operation, cause, {
+				provider: "indexer",
+				failure_mode: "upstream-down"
+			});
+		}
+		if (!response.ok) throw httpError(operation, response.status, await safeText(response));
+		return response;
+	}
+	/**
+	* Follow the live stream until the caller unsubscribes or the indexer closes
+	* it. The indexer closes the stream on token expiry or revoked authority
+	* with no frame, so any end the caller did not ask for is a teardown: it
+	* reaches `captureException` under `activity.subscribe` and the caller sees
+	* one `error` snapshot.
+	*/
+	async #stream(table, input, operation, callback, stopped) {
+		let failure;
+		try {
+			const response = await this.#request("live", table, input, operation);
+			if (response.body === null) throw Errors.providerError("indexer", operation, "empty stream");
+			await readEventStream(response.body, (data) => {
+				try {
+					callback({
+						status: "ok",
+						value: decodeRows(table, JSON.parse(data))
+					});
+				} catch (cause) {
+					failure = toPublicError$1(operation, cause);
+				}
+			}, () => stopped() || failure !== void 0);
+		} catch (cause) {
+			failure = toPublicError$1(operation, cause);
+		}
+		if (stopped()) return;
+		const error = failure ?? Errors.capabilityUnavailable("indexer", operation);
+		observeStreamFailure(this.#observation, CAPXUL_OPERATIONS.activity.subscribe, error);
+		callback({
+			status: "error",
+			error
+		});
+	}
+};
+/**
+* Map an indexer refusal into the shared error vocabulary.
+*
+* 401 is the expected outcome of an expired or revoked session. 403 is not:
+* the indexer accepts only its own compiled statements for a Safe in the
+* claim, so a refusal means this SDK and that deployment disagree, or the
+* session gained a Safe and still holds the older token. Both must be loud.
+*/
+function httpError(operation, status, body) {
+	if (status === 401) return Errors.notAuthenticated();
+	if (status === 429) return Errors.rateLimited({ resource: "indexer" });
+	if (status === 503) return Errors.capabilityUnavailable("indexer", operation);
+	return Errors.providerError("indexer", operation, body, {
+		httpStatus: status,
+		...status >= 500 ? { failure_mode: "upstream-down" } : {},
+		details: { reason: status === 403 ? "scope-refused" : "http-status" }
+	});
+}
+function toPublicError$1(operation, cause) {
+	if (cause instanceof CapxulError) return cause;
+	return Errors.providerError("indexer", operation, cause);
+}
+function toIndexerReadError(operation, cause) {
+	if (cause instanceof IndexerReadError) return cause;
+	return indexerReadErrorFromCapxul(operation, toPublicError$1(operation, cause), cause);
+}
+async function safeText(response) {
+	try {
+		return await response.text();
+	} catch {
+		return "";
+	}
+}
 const SDK_VERSION = version;
 /**
 * Project the built graph into the flat `FlowPorts` record the method bundles
@@ -13751,7 +14607,16 @@ async function createProductionAdapters(input) {
 		}));
 		const applicationLayer = Layer.merge(portsLayer, optionalEngineeringTelemetryLayer(bootstrapResult.value.engineeringTelemetry, resolvedInput.value.runtime));
 		const context = await Effect.runPromise(Layer.buildWithScope(applicationLayer, scope));
-		const ports = await Effect.runPromise(collectProductionFlowPorts.pipe(Effect.provide(context)));
+		const collected = await Effect.runPromise(collectProductionFlowPorts.pipe(Effect.provide(context)));
+		const indexerUrl = input.indexerUrl ?? bootstrapResult.value.indexerUrl;
+		const indexerRead = productionIndexerReadPort(indexerUrl === void 0 ? input : {
+			...input,
+			indexerUrl
+		}, collected, observation);
+		const ports = indexerRead === void 0 ? collected : {
+			...collected,
+			indexerRead
+		};
 		const stopConnectionObservation = observeProductionConvexConnection(ports.convexCall, context);
 		const close = idempotentClose(async () => {
 			try {
@@ -13878,7 +14743,7 @@ async function createCapxulClientWithSignerControls(input, controls) {
 			...adapters.value.bootstrap,
 			authBaseUrl: resolvedAuthBaseUrl
 		}, {
-			diagnostic: new ConsoleDiagnosticAdapter(),
+			diagnostic: new EffectLogDiagnosticAdapter(adapters.value.context, new ConsoleDiagnosticAdapter()),
 			signUserOpHash: controls.signEmbeddedUserOpHash
 		});
 		signer = withSignerControl(signer, controls.signUserOpHash);
@@ -14083,5 +14948,27 @@ function idempotentClose(close) {
 		await close();
 	};
 }
+/**
+* Build the Ponder read port for this client, or `undefined` when no indexer
+* origin was supplied. The token provider is the same
+* `AuthClientPort.getConvexJwt` closure `ConvexCallPort` uses, so the indexer
+* and Convex see one session with one scope.
+*/
+function productionIndexerReadPort(input, ports, observation) {
+	if (input.indexerUrl === void 0 || input.indexerUrl === "") return void 0;
+	return new PonderIndexerAdapter({
+		baseUrl: normalizeHttpUrl("indexerUrl", input.indexerUrl),
+		token: async ({ forceRefreshToken }) => {
+			const token = await Effect.runPromise(Effect.result(ports.authClient.getConvexJwt({
+				forceRefresh: forceRefreshToken,
+				...input.signal === void 0 ? {} : { signal: input.signal }
+			})));
+			if (Result.isFailure(token)) return null;
+			return String(token.success.token);
+		},
+		...input.fetch === void 0 ? {} : { fetch: input.fetch },
+		...observation === void 0 ? {} : { observation }
+	});
+}
 //#endregion
 export { signerFailure as A, isRestoring as B, normalizeExceptionErrorKind as C, fromWei as D, safeExceptionLabel as E, CAPXUL_OPERATIONS as F, isCapxulOperation as I, normalizeCapxulOperation as L, PAYMENT_DIRECTIONS as M, PAYMENT_STATUSES as N, isSettingUpLifecycle as O, redactTelemetryEvent as P, destination as R, SDK_VERSION$1 as S, projectSdkException as T, fingerprintPaymentIntent as _, smartAccountErrorFromCapxul as a, failureDetail as b, identityErrorFromCapxul as c, embeddedSigner as d, openfortEmbeddedSigner as f, devPrivateKeySigner as g, deriveDevPrivateKey as h, assembleCapxulClient as i, resolveFailureMode as j, injectedWalletSigner as k, convexCallErrorFromCapxul as l, openfortEmbeddedWalletPort as m, createCapxulClientWithSignerControls as n, accountReadErrorFromCapxul as o, openfortEmbeddedSignerFromWallet as p, postHogObservability as r, wireChainId as s, createCapxulClient as t, bootstrapErrorFromCapxul as u, toWei as v, normalizeExceptionOperation as w, EXCEPTION_MESSAGE as x, CAPXUL_SDK_EXPECTED_OUTCOME_EVENT as y, isClaimed as z };