@capxul/sdk 4.2.0-rc.1 → 4.2.0-rc.11

package/dist/{production-FgHUndeX.mjs → production-7jr-KUvX.mjs}

@@ -1,4 +1,4 @@
-import { $ as toTesterKind, A as toAccountId, B as toEmail, C as BYTES32_RE, D as ZERO_BYTES32, E as WEI_RE, F as toBudgetId, G as toKycTier, H as toEpochSeconds, I as toChainId, J as toPayrollGroupId, K as toOrgId, L as toCountryCode, M as toAllowedOrigin, P as toAuthUserId, Q as toSessionToken, R as toCurrencyCode, S as ASSET_ID_RE, T as SUPPORTED_CURRENCY_CODES, U as toHandle, V as toEpochMs, W as toJwtToken, X as toPublishableKey, Y as toPayrollRunId, Z as toRoleKey, _ as BASE_SEPOLIA_CHAIN_ID, _t as revertSummaryText, at as EXPECTED_OPERATION_OUTCOMES, b as ACCOUNT_ID_RE, bt as redactSecrets, c as AuthCachePortTag, ct as CHAIN_UPSTREAMS, d as authClientPortFromPromiseAdapter, dt as chainCauseProperties, et as validateHandle, f as AuthClientError, ft as chainEvidenceLabel, g as normalizeBindingEmail, gt as isFailureMode, ht as isChainUpstream, i as BrowserAuthCacheAdapter, it as CapxulError, j as toAddress, l as SystemClockLayer, lt as FAILURE_MODES$1, m as orgRoleKeyForLabel, mt as failureFingerprint, nt as decodeConvexError, ot as Errors, p as AuthClientPortTag, pt as decodeChainCause, q as toPartyId, r as InMemoryAuthCacheAdapter, rt as CAPXUL_ERROR_CODES, st as isCapxulError, u as ClockPortTag, ut as boundedResponseHeaders, v as deriveCapxulSafeAddress, vt as containsSensitiveMaterial, w as EVM_ADDRESS_RE$1, x as APP_ID_RE, xt as redactUrlSecrets, yt as isCredentialField, z as toDurationMs } from "./OAuthBearerAuthClient-BrbXrndM.mjs";
+import { $ as toRoleKey, B as toCurrencyCode, C as ASSET_ID_RE, Ct as isCredentialField, D as WEI_RE, E as SUPPORTED_CURRENCY_CODES, F as toAssetId, G as toHandle, H as toEmail, I as toAuthUserId, J as toOrgId, K as toJwtToken, L as toBudgetId, M as toAddress, N as toAllowedOrigin, O as ZERO_BYTES32, Q as toPublishableKey, R as toChainId, S as APP_ID_RE, St as containsSensitiveMaterial, T as EVM_ADDRESS_RE$1, Tt as redactUrlSecrets, U as toEpochMs, V as toDurationMs, W as toEpochSeconds, X as toPayrollGroupId, Y as toPartyId, Z as toPayrollRunId, _ as normalizeBindingEmail, _t as decodeChainCause, b as configuredMoneyAssetById, bt as isFailureMode, c as AuthCachePortTag, ct as CapxulError, d as authClientPortFromPromiseAdapter, dt as isCapxulError, et as toSessionToken, f as AuthClientError, ft as CHAIN_UPSTREAMS, gt as chainEvidenceLabel, h as orgRoleKeyForLabel, ht as chainCauseProperties, i as BrowserAuthCacheAdapter, it as validateHandle, j as toAccountId, l as SystemClockLayer, lt as EXPECTED_OPERATION_OUTCOMES, m as ADMIN_ROLE_LABEL, mt as boundedResponseHeaders, nt as toTxHash, ot as decodeConvexError, p as AuthClientPortTag, pt as FAILURE_MODES$1, q as toKycTier, r as InMemoryAuthCacheAdapter, rt as toWeiAmount, st as CAPXUL_ERROR_CODES, tt as toTesterKind, u as ClockPortTag, ut as Errors, v as BASE_SEPOLIA_CHAIN_ID, vt as failureFingerprint, w as BYTES32_RE, wt as redactSecrets, x as ACCOUNT_ID_RE, xt as revertSummaryText, y as deriveCapxulSafeAddress, yt as isChainUpstream, z as toCountryCode } from "./OAuthBearerAuthClient-CbU_W9Sp.mjs";
 import { formatUnits, keccak256, parseUnits, recoverAddress, stringToHex, toBytes } from "viem";
 import { Cause, Clock, Context, Data, Deferred, Duration, Effect, Exit, Fiber, FiberSet, Layer, Option, Queue, Ref, Result, Schedule, Schema, SchemaGetter, SchemaIssue, SchemaParser, Scope, Stream, Tracer } from "effect";
 import { getFunctionName, makeFunctionReference } from "convex/server";
@@ -448,6 +448,8 @@ const CAPXUL_OPERATIONS = {
 		emitAnnotationSaved: "activity.emitAnnotationSaved",
 		get: "activity.get",
 		list: "activity.list",
+		/** The SDK's live Activity read over the indexer's SSE stream. */
+		subscribe: "activity.subscribe",
 		summary: "activity.summary"
 	},
 	addressBook: {
@@ -946,6 +948,17 @@ const AuthFailedProps = Schema.Struct({
 	auth_type: OptionalString,
 	reason: OptionalString
 });
+const IdentityRefusedProps = Schema.Struct({
+	...TelemetryEnvelopeProps,
+	/** The refused identity event tag, for example CreateOrganization. */
+	event: OptionalString,
+	/** The machine's refusal code: WRONG_STATE, SUPERSEDED or STALE_EPOCH. */
+	refusal_code: OptionalString,
+	/** The machine slot the request targeted, for example identity:org. */
+	slot: OptionalString,
+	/** The machine state at refusal, for example authenticated:claiming. */
+	state: OptionalString
+});
 const AuthSignedOutProps = Schema.Struct(TelemetryEnvelopeProps);
 const ProvisioningSafeCreatedProps = Schema.Struct({
 	...TelemetryEnvelopeProps,
@@ -1333,10 +1346,44 @@ const DepositSettledProps = Schema.Struct({
 });
 const PermissionMirrorVerificationProps = Schema.Struct({
 	...TelemetryEnvelopeProps,
+	/** The RECEIPT verification outcome. What the mirror then did is separate. */
 	outcome: Schema.String,
 	reason: Schema.String,
 	chain_id: Schema.Number,
-	retry_count: Schema.Number
+	retry_count: Schema.Number,
+	/**
+	* #1960 R02, consumed by R03. A verified receipt is not an applied Permission:
+	* these two optional fields let the producer say what the applying mutation
+	* actually returned, and which command it was, without either fact rewriting
+	* the receipt outcome above. Absent when application has not happened yet.
+	*/
+	application_result: Schema.optional(Schema.Literals([
+		"applied",
+		"replayed",
+		"conflicting_replay",
+		"revision_mismatch"
+	])),
+	command_id: OptionalString,
+	/**
+	* #1961 R03. The authorized stored row names the Permission it changed; the
+	* verified receipt names the chain facts that prove it. Every field is
+	* optional because a pending or provider-failed verification has neither an
+	* application result nor a receipt to report.
+	*/
+	permission_id: OptionalString,
+	permission_assignment_id: OptionalString,
+	permission_operation: Schema.optional(Schema.Literals([
+		"create",
+		"change",
+		"assign",
+		"revoke",
+		"replace"
+	])),
+	revision: Schema.optional(Schema.Number),
+	user_op_hash: OptionalString,
+	transaction_hash: OptionalString,
+	block_number: Schema.optional(Schema.Number),
+	log_index: Schema.optional(Schema.Number)
 });
 const MovementScanWindowProps = Schema.Struct({
 	...TelemetryEnvelopeProps,
@@ -1382,6 +1429,10 @@ Schema.Struct({
 	name: Schema.Literal("auth_failed"),
 	props: AuthFailedProps
 });
+Schema.Struct({
+	name: Schema.Literal("identity_refused"),
+	props: IdentityRefusedProps
+});
 Schema.Struct({
 	name: Schema.Literal("auth_signed_out"),
 	props: AuthSignedOutProps
@@ -1562,6 +1613,10 @@ Schema.Struct({
 	name: Schema.Literal("movement_scan_incident"),
 	props: MovementScanIncidentProps
 });
+/** The one spelling of "whose scope did this happen in" across every surface. */
+const ScopeKindSchema = Schema.Literals(["account", "organization"]);
+const AccountKindSchema = Schema.Literals(["personalSafe", "orgTreasury"]);
+const OptionalReasonCode = Schema.optional(Schema.Literals(CAPXUL_ERROR_CODES));
 const ActivityReferenceProps = {
 	reference_kind: Schema.Literals(["payment", "movement"]),
 	reference_id: Schema.String
@@ -1592,8 +1647,8 @@ const ActivityFilterProps = {
 };
 const ActivityActionProps = {
 	...TelemetryEnvelopeProps,
-	scope_kind: Schema.Literals(["account", "organization"]),
-	reason_code: Schema.optional(Schema.Literals(CAPXUL_ERROR_CODES))
+	scope_kind: ScopeKindSchema,
+	reason_code: OptionalReasonCode
 };
 Schema.Struct({
 	name: Schema.Literal("contact_relationship_changed"),
@@ -1605,7 +1660,7 @@ Schema.Struct({
 			"hidden",
 			"restored"
 		]),
-		scope_kind: Schema.Literals(["account", "organization"]),
+		scope_kind: ScopeKindSchema,
 		scope_id: Schema.String,
 		owner_party_id: Schema.String,
 		party_id: Schema.String,
@@ -1621,9 +1676,9 @@ Schema.Struct({
 });
 const ContactActionProps = {
 	...TelemetryEnvelopeProps,
-	scope_kind: Schema.Literals(["account", "organization"]),
+	scope_kind: ScopeKindSchema,
 	party_id: OptionalString,
-	reason_code: Schema.optional(Schema.Literals(CAPXUL_ERROR_CODES))
+	reason_code: OptionalReasonCode
 };
 Schema.Struct({
 	name: Schema.Literal("ui_contact_action_completed"),
@@ -1650,7 +1705,7 @@ Schema.Struct({
 	props: Schema.Struct({
 		...TelemetryEnvelopeProps,
 		...ActivityReferenceProps,
-		scope_kind: Schema.Literals(["account", "organization"]),
+		scope_kind: ScopeKindSchema,
 		scope_id: Schema.String,
 		occurred_at: Schema.Number
 	})
@@ -1705,6 +1760,193 @@ Schema.Struct({
 		})
 	])
 });
+/**
+* Reliability closeout (#1960 R02) — the shape every explicit UI observation
+* below shares. `scope_kind` says whose surface the person was looking at,
+* `organization_id` is the verified Organization the producer resolved (absent
+* on a personal action), and `reason_code` is a catalog error code, never copy.
+*/
+const UiStepProps = {
+	...TelemetryEnvelopeProps,
+	scope_kind: ScopeKindSchema,
+	organization_id: OptionalOrgId,
+	reason_code: OptionalReasonCode
+};
+const AccessRecoveryCompletedProps = Schema.Union([Schema.Struct({
+	...TelemetryEnvelopeProps,
+	recovery: Schema.Literal("session_restoration"),
+	outcome: Schema.Literals([
+		"restored",
+		"absent",
+		"failed"
+	]),
+	reason_code: OptionalReasonCode,
+	organization_id: OptionalOrgId
+}), Schema.Struct({
+	...TelemetryEnvelopeProps,
+	recovery: Schema.Literal("signer_readiness"),
+	outcome: Schema.Literals(["ready", "unavailable"]),
+	reason_code: OptionalReasonCode,
+	organization_id: OptionalOrgId
+})]);
+Schema.Struct({
+	name: Schema.Literal("access_recovery_completed"),
+	props: AccessRecoveryCompletedProps
+});
+Schema.Struct({
+	name: Schema.Literal("ui_access_step_completed"),
+	props: Schema.Struct({
+		...UiStepProps,
+		step: Schema.Literals([
+			"dashboard_granted",
+			"redirect_completed",
+			"gate_error_displayed",
+			"retry_selected",
+			"capability_refusal_displayed",
+			"signer_refusal_displayed"
+		]),
+		capability: Schema.optional(Schema.Literals(["spend", "managePeople"])),
+		probe: Schema.optional(Schema.Literals([
+			"session",
+			"membership",
+			"lifecycle"
+		])),
+		reason: Schema.optional(Schema.Literals([
+			"loading",
+			"no-permission",
+			"org-unavailable"
+		]))
+	})
+});
+Schema.Struct({
+	name: Schema.Literal("org_invite_progressed"),
+	props: Schema.Struct({
+		...TelemetryEnvelopeProps,
+		organization_id: OrgIdTelemetrySchema,
+		progress: Schema.Literals([
+			"account_ready",
+			"permission_applied",
+			"membership_activated",
+			"revoked"
+		]),
+		/** The invited Party. The initiating actor stays on the envelope's identity. */
+		member_party_id: Schema.String,
+		occurred_at: Schema.Number
+	})
+});
+Schema.Struct({
+	name: Schema.Literal("invoice_issued"),
+	props: Schema.Struct({
+		...TelemetryEnvelopeProps,
+		request_id: Schema.String,
+		issuer_scope_kind: ScopeKindSchema,
+		issuer_scope_id: Schema.String,
+		payer_party_id: OptionalString,
+		occurred_at: Schema.Number
+	})
+});
+Schema.Struct({
+	name: Schema.Literal("invoice_request_transitioned"),
+	props: Schema.Struct({
+		...TelemetryEnvelopeProps,
+		request_id: Schema.String,
+		transition: Schema.Literals([
+			"approval_prepared",
+			"declined",
+			"cancelled"
+		]),
+		actor_scope_kind: ScopeKindSchema,
+		actor_scope_id: Schema.String,
+		occurred_at: Schema.Number
+	})
+});
+Schema.Struct({
+	name: Schema.Literal("ui_invoice_step_completed"),
+	props: Schema.Struct({
+		...UiStepProps,
+		step: Schema.Literals([
+			"opened",
+			"previewed",
+			"dismissed",
+			"submitted",
+			"result_displayed",
+			"refusal_displayed",
+			"retry_selected"
+		]),
+		request_id: OptionalString
+	})
+});
+Schema.Struct({
+	name: Schema.Literal("ui_treasury_step_completed"),
+	props: Schema.Struct({
+		...UiStepProps,
+		step: Schema.Literals([
+			"balance_displayed",
+			"read_refusal_displayed",
+			"retry_selected",
+			"recovery_completed"
+		]),
+		account_kind: Schema.optional(AccountKindSchema)
+	})
+});
+Schema.Struct({
+	name: Schema.Literal("ui_receive_step_completed"),
+	props: Schema.Struct({
+		...UiStepProps,
+		step: Schema.Literals([
+			"instructions_displayed",
+			"address_copied",
+			"copy_failed",
+			"refusal_displayed",
+			"retry_selected"
+		]),
+		account_kind: Schema.optional(AccountKindSchema)
+	})
+});
+Schema.Struct({
+	name: Schema.Literal("payroll_group_changed"),
+	props: Schema.Struct({
+		...TelemetryEnvelopeProps,
+		organization_id: OrgIdTelemetrySchema,
+		change: Schema.Literals([
+			"created",
+			"updated",
+			"deleted"
+		]),
+		group_id: Schema.String,
+		member_count: Schema.Number,
+		occurred_at: Schema.Number
+	})
+});
+Schema.Struct({
+	name: Schema.Literal("payroll_run_transitioned"),
+	props: Schema.Struct({
+		...TelemetryEnvelopeProps,
+		organization_id: OrgIdTelemetrySchema,
+		transition: Schema.Literals([
+			"prepared",
+			"authorized",
+			"settled"
+		]),
+		run_id: Schema.String,
+		payment_count: Schema.optional(Schema.Number),
+		occurred_at: Schema.Number
+	})
+});
+Schema.Struct({
+	name: Schema.Literal("ui_payroll_action_completed"),
+	props: Schema.Struct({
+		...UiStepProps,
+		action: Schema.Literals([
+			"opened",
+			"refusal_displayed",
+			"recovery_completed",
+			"cancelled",
+			"submitted_displayed"
+		]),
+		run_id: OptionalString
+	})
+});
 function redactTelemetryEvent(event, options = {}) {
 	const props = redactTelemetryProps(event.name, event.props, options);
 	return props === void 0 ? { name: event.name } : {
@@ -2007,6 +2249,10 @@ const BootstrapEnvelope = Schema.Struct({
 		siteBaseUrl: Schema.String,
 		openfortPublishableKey: Schema.String,
 		shieldPublishableKey: Schema.String,
+		/** Which Openfort third-party auth provider the signer presents; absent means better-auth. */
+		openfortAuthProvider: Schema.optional(Schema.Literals(["better-auth", "oidc"])),
+		/** Origin of the Ponder indexer the SDK reads directly; absent means no indexer reads. */
+		indexerUrl: Schema.optional(Schema.String),
 		engineeringTelemetry: Schema.optional(EngineeringTelemetryBootstrapPolicy)
 	})
 });
@@ -2069,6 +2315,7 @@ const CAPXUL_FUNCTIONS = {
 		list: "movement/activity:list",
 		summary: "movement/activity:summary"
 	},
+	"movement/annotations": { overlay: "movement/annotations:overlay" },
 	"moneyExecution/actions": {
 		abandonPaymentExecution: "moneyExecution/actions:abandonPaymentExecution",
 		preparePermissionExecution: "moneyExecution/actions:preparePermissionExecution",
@@ -2081,6 +2328,7 @@ const CAPXUL_FUNCTIONS = {
 		prepareOrganizationPaymentExecution: "moneyExecution/paymentCommandActions:prepareOrganizationPaymentExecution",
 		submitPaymentCommandExecution: "moneyExecution/paymentCommandActions:submitPaymentCommandExecution"
 	},
+	"moneyExecution/providerSendWitness": { read: "moneyExecution/providerSendWitness:read" },
 	media: {
 		generateUploadUrl: "media:generateUploadUrl",
 		setOrgLogo: "media:setOrgLogo",
@@ -2140,6 +2388,11 @@ const CAPXUL_FUNCTIONS = {
 		loadByAuthUserId: "smartAccount/queries:loadByAuthUserId",
 		loadBySmartAccountAddress: "smartAccount/queries:loadBySmartAccountAddress"
 	},
+	e2eControls: {
+		holdUserOperationReceipt: "e2eControls:holdUserOperationReceipt",
+		isUserOperationReceiptHeld: "e2eControls:isUserOperationReceiptHeld",
+		releaseUserOperationReceipt: "e2eControls:releaseUserOperationReceipt"
+	},
 	system: { health: "system:health" }
 };
 //#endregion
@@ -2661,7 +2914,19 @@ const StoredPermissionCommandSchema = Schema.Struct({
 	roleKey: RoleKeySchema,
 	allowanceKey: Schema.NullOr(AllowanceKeySchema),
 	memberSafe: Schema.NullOr(SafeAddressSchema),
-	expectedAuthorityEvents: Schema.Array(Bytes32Schema)
+	expectedAuthorityEvents: Schema.Array(Bytes32Schema),
+	/**
+	* #1961 R03. The authenticated user who created the command, and the browser
+	* linkage captured with it. Delayed verification and bounded retries read
+	* this snapshot instead of the current viewer, so one command keeps one
+	* origin. Both are absent on commands created before this contract.
+	*
+	* The context stays `unknown` on purpose: `sanitizeObservationContext` owns
+	* the field allowlist, and every reader passes the stored value through it
+	* rather than repeating those rules here.
+	*/
+	originatingAuthUserId: Schema.optional(Schema.String),
+	originatingObservationContext: Schema.optional(Schema.Unknown)
 });
 Schema.Struct({
 	command: StoredPermissionCommandSchema,
@@ -5434,6 +5699,7 @@ const financialOpsContract = {
 	activitySummary: makeFunctionReference(CAPXUL_FUNCTIONS["movement/activity"].summary),
 	activityGet: makeFunctionReference(CAPXUL_FUNCTIONS["movement/activity"].get),
 	activityAnnotate: makeFunctionReference(CAPXUL_FUNCTIONS["movement/activity"].annotate),
+	activityOverlay: makeFunctionReference(CAPXUL_FUNCTIONS["movement/annotations"].overlay),
 	verifyPaymentDocument: makeFunctionReference(CAPXUL_FUNCTIONS["financialOps/queries"].verifyPaymentDocument),
 	renderStoredDocument: makeFunctionReference(CAPXUL_FUNCTIONS["financialOps/queries"].renderStoredDocument)
 };
@@ -5450,8 +5716,357 @@ const moneyExecutionContract = {
 	submitPaymentCommandExecution: makeFunctionReference(CAPXUL_FUNCTIONS["moneyExecution/paymentCommandActions"].submitPaymentCommandExecution)
 };
 //#endregion
+//#region src/ports/indexer-read.ts
+/** The indexer's own page bound. Exceeding it is a caller defect, not a refusal. */
+const INDEXER_MAX_LIMIT = 1e3;
+const LOWER_CASE_ADDRESS = /^0x[0-9a-f]{40}$/;
+/**
+* Refuse a page the indexer would refuse, before any implementation spends a
+* round trip on it. Every implementation calls this, so a consumer test written
+* against the hermetic adapter cannot pass on input production rejects. Throws
+* a `CapxulError`; callers convert it to an `IndexerReadError`.
+*/
+function assertIndexerPage(input) {
+	const safe = String(input.safe).toLowerCase();
+	if (!LOWER_CASE_ADDRESS.test(safe)) throw Errors.invalidInput("safe", "must be a lower-case EVM address");
+	if (!Number.isSafeInteger(input.limit) || input.limit < 1 || input.limit > 1e3) throw Errors.invalidInput("limit", `must be an integer from 1 to ${INDEXER_MAX_LIMIT}`);
+	const offset = input.offset ?? 0;
+	if (!Number.isSafeInteger(offset) || offset < 0) throw Errors.invalidInput("offset", "must be a non-negative integer");
+	return safe;
+}
+var IndexerReadError = class extends Data.TaggedError("IndexerReadError") {};
+function indexerReadErrorFromCapxul(operation, error, cause = error) {
+	return new IndexerReadError({
+		operation,
+		publicCode: error.code,
+		publicError: error,
+		cause,
+		...error.details === void 0 ? {} : { details: error.details }
+	});
+}
+Context.Service()("@capxul/sdk/ports/IndexerReadPort");
+//#endregion
+//#region src/surface/activity-stitch.ts
+/** Epoch milliseconds of the block that carried the row. */
+function blockMillis(row) {
+	return Number(row.timestamp) * 1e3;
+}
+/** `0x1234…abcd` — the counterparty of an unclaimed transfer is an address. */
+function shortAddressLabel(address) {
+	return address.length <= 12 ? address : `${address.slice(0, 6)}…${address.slice(-4)}`;
+}
+function directionFor(safe, transfer) {
+	const from = transfer.from.toLowerCase();
+	const to = transfer.to.toLowerCase();
+	if (from === safe && to === safe) return "self";
+	return to === safe ? "in" : "out";
+}
+/**
+* The Transfer a protocol Payment moved is the same money as its `payment`
+* row. One actor sees one item for it, so the Transfer is claimed and does not
+* become a second row. Another transfer in the same transaction that this
+* payment did not move stays unclaimed and keeps its own row.
+*/
+function claimedTransferIds(transfers, payments) {
+	const claimed = /* @__PURE__ */ new Set();
+	for (const payment of payments) {
+		const match = transfers.find((transfer) => !claimed.has(transfer.id) && transfer.txHash === payment.txHash && transfer.token.toLowerCase() === payment.token.toLowerCase() && transfer.amount === payment.amount && transfer.to.toLowerCase() === payment.recipient.toLowerCase());
+		if (match !== void 0) claimed.add(match.id);
+	}
+	return claimed;
+}
+function withAnnotation(item, annotation) {
+	return annotation?.counterpartyLabel === void 0 ? item : {
+		...item,
+		counterpartyLabel: annotation.counterpartyLabel
+	};
+}
+/**
+* Confirmation comes from the chain, never from Convex.
+*
+* A Ponder row for this Payment's settlement means settled, and its receipt is
+* the indexed transaction. No Ponder row and a Convex row that still says
+* settled means the block that carried it was dropped: the row goes back to
+* `settling` and its annotation, which keys on the Payment id, is untouched.
+*/
+function confirmPayment(intent, chain, hasSettlement) {
+	if (chain !== void 0) return {
+		...intent,
+		status: "settled",
+		receipt: {
+			chainId: chain.chainId,
+			transactionHash: chain.txHash
+		},
+		updatedAt: blockMillis(chain)
+	};
+	if (hasSettlement && intent.status === "settled") return {
+		...intent,
+		status: "settling",
+		receipt: null
+	};
+	return intent;
+}
+/**
+* One unclaimed Transfer as an Activity row, or `null` when this SDK cannot
+* denominate its asset. The indexer serves only configured assets, so a row
+* the registry does not know means the SDK and that deployment disagree; it is
+* dropped rather than shown with a guessed currency.
+*/
+function transferItem(safe, transfer, annotation) {
+	const asset = configuredMoneyAssetById(transfer.assetId);
+	if (asset === null) return null;
+	const direction = directionFor(safe, transfer);
+	const counterparty = direction === "in" ? transfer.from : transfer.to;
+	const at = blockMillis(transfer);
+	return withAnnotation({
+		kind: "movement",
+		id: transfer.id,
+		classification: "movement_only_outflow",
+		amount: {
+			currency: asset.peg ?? asset.symbol,
+			value: formatUnits(transfer.amount, asset.decimals),
+			decimals: asset.decimals
+		},
+		direction,
+		counterpartyLabel: shortAddressLabel(counterparty),
+		receipt: {
+			chainId: transfer.chainId,
+			transactionHash: transfer.txHash
+		},
+		createdAt: at,
+		updatedAt: at
+	}, annotation);
+}
+/** Newest first. A Payment precedes a Movement at one instant, as the ledger reader orders them. */
+function compareItems(left, right) {
+	if (right.createdAt !== left.createdAt) return right.createdAt - left.createdAt;
+	if (left.kind !== right.kind) return left.kind === "payment" ? -1 : 1;
+	if (left.id === right.id) return 0;
+	return left.id < right.id ? 1 : -1;
+}
+function stitchActivity(input) {
+	const safe = input.safe.toLowerCase();
+	const chainBySettlement = /* @__PURE__ */ new Map();
+	for (const row of input.payments) chainBySettlement.set(row.settlementId.toLowerCase(), row);
+	const chainByPaymentId = /* @__PURE__ */ new Map();
+	const settledPaymentIds = /* @__PURE__ */ new Set();
+	for (const link of input.links) {
+		settledPaymentIds.add(link.paymentId);
+		const row = chainBySettlement.get(link.settlementId.toLowerCase());
+		if (row !== void 0) chainByPaymentId.set(link.paymentId, row);
+	}
+	const annotations = /* @__PURE__ */ new Map();
+	for (const annotation of input.annotations) annotations.set(`${annotation.reference.kind}:${annotation.reference.id}`, annotation);
+	const items = [];
+	const claiming = [];
+	for (const intent of input.intents) {
+		if (intent.kind !== "payment") continue;
+		const chain = chainByPaymentId.get(intent.id);
+		if (chain !== void 0) claiming.push(chain);
+		items.push(withAnnotation(confirmPayment(intent, chain, settledPaymentIds.has(intent.id)), annotations.get(`payment:${intent.id}`)));
+	}
+	const claimed = claimedTransferIds(input.transfers, claiming);
+	for (const transfer of input.transfers) {
+		if (claimed.has(transfer.id)) continue;
+		const item = transferItem(safe, transfer, annotations.get(`movement:${transfer.id}`));
+		if (item !== null) items.push(item);
+	}
+	return items.sort(compareItems);
+}
+/** The reference ids one stitched page needs its Convex overlay for. */
+function overlayReferences(items) {
+	return items.map((item) => ({
+		kind: item.kind,
+		id: item.id
+	}));
+}
+/**
+* Money in, money out and the pending share, one bucket per currency and
+* precision. Two assets that peg to the same currency at different precision
+* stay distinct buckets: their raw units are not interchangeable.
+*/
+function summarizeItems(items) {
+	const buckets = /* @__PURE__ */ new Map();
+	for (const item of items) {
+		const key = `${item.amount.currency}:${String(item.amount.decimals)}`;
+		const bucket = buckets.get(key) ?? {
+			currency: item.amount.currency,
+			decimals: item.amount.decimals,
+			in: 0n,
+			out: 0n,
+			pendingIn: 0n
+		};
+		const raw = rawUnits(item.amount.value, item.amount.decimals);
+		if (item.direction === "in") {
+			bucket.in += raw;
+			if (item.kind === "payment" && item.status !== "settled") bucket.pendingIn += raw;
+		} else if (item.direction === "out") bucket.out += raw;
+		buckets.set(key, bucket);
+	}
+	return [...buckets.values()].map((bucket) => ({
+		currency: bucket.currency,
+		decimals: bucket.decimals,
+		in: bucket.in.toString(),
+		out: bucket.out.toString(),
+		net: (bucket.in - bucket.out).toString(),
+		pendingIn: bucket.pendingIn.toString()
+	}));
+}
+/** The inverse of `formatUnits`, kept exact: `"1.25"` at 6 decimals is `1250000n`. */
+function rawUnits(value, decimals) {
+	const negative = value.startsWith("-");
+	const [whole = "0", fraction = ""] = (negative ? value.slice(1) : value).split(".");
+	const raw = BigInt(`${whole}${fraction.padEnd(decimals, "0").slice(0, decimals)}`);
+	return negative ? -raw : raw;
+}
+//#endregion
+//#region src/surface/activity-read.ts
+/** How many Convex intent rows one page reads for its labels and pending rows. */
+const INTENT_WINDOW = 100;
+/** The window a summary aggregates over. The indexer's own page bound. */
+const SUMMARY_WINDOW = INDEXER_MAX_LIMIT;
+function parseCursor(value) {
+	if (value === void 0) return 0;
+	try {
+		const parsed = JSON.parse(value);
+		return Number.isSafeInteger(parsed.offset) && parsed.offset >= 0 ? parsed.offset : 0;
+	} catch {
+		return 0;
+	}
+}
+function inRange(item, range) {
+	if (range?.from !== void 0 && item.createdAt < range.from) return false;
+	return range?.to === void 0 || item.createdAt <= range.to;
+}
+/** The caller's filter applied to the merged page. The join owns the order. */
+function matchesFilter(item, filter) {
+	if (filter === void 0) return true;
+	if (filter.kind !== void 0 && item.kind !== filter.kind) return false;
+	if (filter.direction !== void 0 && item.direction !== filter.direction) return false;
+	if (filter.status === void 0) return true;
+	return item.kind === "payment" && filter.status.includes(item.status);
+}
+function overlay(deps, actor, controls, input) {
+	return deps.convexCall.query(deps.functions.activityOverlay, copyInvocationObservation(controls, { input: {
+		...actor === void 0 ? {} : { actor },
+		...input.references === void 0 ? {} : { references: input.references },
+		...input.settlementIds === void 0 ? {} : { settlementIds: input.settlementIds }
+	} }));
+}
+function convexPage(deps, actor, controls, input) {
+	return deps.convexCall.query(deps.functions.activityList, copyInvocationObservation(controls, { input: {
+		...actor === void 0 ? {} : { actor },
+		...input.cursor === void 0 ? {} : { cursor: input.cursor },
+		...input.limit === void 0 ? {} : { limit: input.limit },
+		...input.range === void 0 ? {} : { range: input.range }
+	} }));
+}
+/** Both indexed tables for one Safe, or `null` when the indexer cannot answer. */
+function chainRows(deps, safe, limit) {
+	const page = {
+		safe,
+		limit: Math.min(limit, INDEXER_MAX_LIMIT)
+	};
+	return Effect.all([deps.indexer.read("transfer", page), deps.indexer.read("payment", page)], { concurrency: 2 }).pipe(Effect.map(([transfers, payments]) => ({
+		transfers,
+		payments
+	})), Effect.catch(() => Effect.succeed(null)));
+}
+/** The stitched, filtered rows of one window, newest first. */
+function stitchedWindow(deps, actor, controls, window, params) {
+	return Effect.gen(function* () {
+		const scope = yield* overlay(deps, actor, controls, {});
+		const convex = yield* convexPage(deps, actor, controls, {
+			limit: INTENT_WINDOW,
+			...params.range === void 0 ? {} : { range: params.range }
+		});
+		const rows = scope.safe === null ? null : yield* chainRows(deps, scope.safe, window);
+		if (rows === null || scope.safe === null) return {
+			items: convex.items.filter((item) => matchesFilter(item, params.filter)),
+			stitched: false
+		};
+		const decoration = yield* overlay(deps, actor, controls, {
+			references: [...overlayReferences(convex.items), ...rows.transfers.map((row) => ({
+				kind: "movement",
+				id: row.id
+			}))],
+			settlementIds: rows.payments.map((row) => row.settlementId)
+		});
+		return {
+			items: stitchActivity({
+				safe: scope.safe,
+				transfers: rows.transfers,
+				payments: rows.payments,
+				intents: convex.items,
+				links: decoration.links,
+				annotations: decoration.annotations
+			}).filter((item) => inRange(item, params.range) && matchesFilter(item, params.filter)),
+			stitched: true
+		};
+	});
+}
+function readActivityPage(deps, actor, controls, params) {
+	const limit = params?.limit ?? 25;
+	const offset = parseCursor(params?.cursor);
+	return stitchedWindow(deps, actor, controls, offset + limit + 1, {
+		...params?.range === void 0 ? {} : { range: params.range },
+		...params?.filter === void 0 ? {} : { filter: params.filter }
+	}).pipe(Effect.map(({ items, stitched }) => {
+		const observedAt = Date.now();
+		if (!stitched) return {
+			items: items.slice(0, limit),
+			cursor: null,
+			checkpoint: observedAt,
+			observedAt
+		};
+		return {
+			items: items.slice(offset, offset + limit),
+			cursor: items.length > offset + limit ? JSON.stringify({ offset: offset + limit }) : null,
+			checkpoint: observedAt,
+			observedAt
+		};
+	}));
+}
+function readActivitySummary(deps, actor, controls, params) {
+	return stitchedWindow(deps, actor, controls, SUMMARY_WINDOW, params?.window === void 0 ? {} : { range: params.window }).pipe(Effect.map(({ items }) => ({
+		window: {
+			from: params?.window?.from ?? null,
+			to: params?.window?.to ?? null
+		},
+		totals: summarizeItems(items),
+		count: items.length,
+		observedAt: Date.now()
+	})));
+}
+/**
+* Tell the caller when the indexed page for this Safe changed.
+*
+* The transport is the indexer's one SSE connection, wired in the Ponder
+* adapter under `activity.subscribe`. A reactive snapshot is not a product
+* event, so nothing here emits telemetry: the adapter reports a teardown, and
+* the caller re-reads.
+*/
+function subscribeActivity(deps, actor, controls, onChange) {
+	return Effect.gen(function* () {
+		const scope = yield* overlay(deps, actor, controls, {});
+		if (scope.safe === null) return () => {};
+		const page = {
+			safe: scope.safe,
+			limit: INTENT_WINDOW
+		};
+		let delivered = false;
+		const notify = () => {
+			if (delivered) onChange();
+			delivered = true;
+		};
+		return yield* deps.indexer.subscribe("transfer", page, (snapshot) => {
+			if (snapshot.status === "ok") notify();
+		});
+	});
+}
+//#endregion
 //#region package.json
-var version = "4.2.0-rc.1";
+var version = "4.2.0-rc.11";
 //#endregion
 //#region src/telemetry/exception-projection.ts
 /** Fixed fallback for failures that have no safe message. */
@@ -5644,6 +6259,22 @@ function observeFailedResult(result, adapter, operation, origin) {
 	return result;
 }
 /**
+* @internal Reports a failure that can never become a method result.
+*
+* A reactive stream is torn down after its call already returned, so nothing
+* downstream observes it. `captureException` is the right kind: the caller did
+* not ask for the end, so it is not an expected product outcome.
+*
+* A caller that DID ask for the end — the session it authenticated with
+* expired, and the service closed the stream on purpose — passes
+* `kind: "operation"` instead, so the refusal lands in the expected-outcome
+* stream its code already declares.
+*/
+function observeStreamFailure(adapter, operation, cause, kind = "exception") {
+	if (adapter === void 0) return;
+	report(adapter, kind, operation, cause, resolveAdapterSnapshot(adapter));
+}
+/**
 * One failure, one event. The identity machine reports a failed transition
 * first; when the same `CapxulError` then surfaces as a public method result
 * (directly or down its `cause` chain), the boundary drops that second report.
@@ -5721,6 +6352,34 @@ function ignoreDeliveryFailure(delivery) {
 	} catch {}
 }
 /**
+* Fold a caller-captured attempt identity into the host's resolved context.
+*
+* The host's `resolveContext` runs at the moment an SDK method is entered, so a
+* host that mints a correlation per resolve gives every operation of one user
+* attempt a different identity — and a user or Organization switch between the
+* click and the reply relabels an action that already started. When the caller
+* captured `correlation_id`/`journey_id` BEFORE the action started, that is the
+* attempt, and it replaces what the resolver returned for this one call. The
+* result is what the SDK span/Log, the failure envelope and the backend carrier
+* all read, so the three agree by construction rather than by convention.
+*
+* A caller that captured nothing gets the resolver's context unchanged, so
+* automatic reads keep their own invocation context.
+*/
+function withCapturedAttemptContext(context, controls) {
+	const correlationId = controls?.correlation_id;
+	const journeyId = controls?.journey_id;
+	if (correlationId === void 0 && journeyId === void 0) return context;
+	const captured = sanitizeObservationContext({
+		...correlationId === void 0 ? {} : { correlationId },
+		...journeyId === void 0 ? {} : { journeyId }
+	});
+	return captured === void 0 ? context : {
+		...context,
+		...captured
+	};
+}
+/**
 * Map an ALREADY-sanitized observation context to the snake_case PostHog
 * property keys. Shared by the failure boundary here and the host
 * success-telemetry seam (`telemetry/from-posthog.ts`) so both attach identical
@@ -6718,6 +7377,11 @@ function paymentExecutionIntent(input) {
 }
 function makeFinancialOpsMethods(deps) {
 	const fns = deps.functions ?? financialOpsContract;
+	const indexerDeps = deps.indexerRead === void 0 ? void 0 : {
+		indexer: deps.indexerRead,
+		convexCall: deps.convexCall,
+		functions: fns
+	};
 	const executionFns = deps.moneyExecutionFunctions ?? moneyExecutionContract;
 	const requestKeyScope = deps.requestKeyScope ?? randomPaymentRequestKey();
 	const inFlightPersonalPayments = /* @__PURE__ */ new Map();
@@ -6948,22 +7612,26 @@ function makeFinancialOpsMethods(deps) {
 			}
 		},
 		activity: {
+			subscribe: (onChange, params, options) => {
+				const controls = deps.invocationControls?.(options) ?? options;
+				return runPortEffect(captureActivityInput(() => Effect.succeed(activityActorField(params?.actor).actor)).pipe(Effect.flatMap((actor) => indexerDeps === void 0 ? Effect.succeed(() => {}) : Effect.suspend(() => subscribeActivity(indexerDeps, actor, controls, onChange)).pipe(Effect.tap(() => observeActivityScope(actor))))), controls, CAPXUL_OPERATIONS.activity.subscribe, deps.runPromise);
+			},
 			list: (params, options) => {
 				const controls = deps.invocationControls?.(options) ?? options;
-				return runPortEffect(captureActivityInput(() => Effect.succeed(activityActorField(params?.actor).actor)).pipe(Effect.flatMap((actor) => Effect.suspend(() => deps.convexCall.query(fns.activityList, copyInvocationObservation(controls, { input: {
+				return runPortEffect(captureActivityInput(() => Effect.succeed(activityActorField(params?.actor).actor)).pipe(Effect.flatMap((actor) => Effect.suspend(() => indexerDeps === void 0 ? deps.convexCall.query(fns.activityList, copyInvocationObservation(controls, { input: {
 					...actor === void 0 ? {} : { actor },
 					...params?.cursor === void 0 ? {} : { cursor: params.cursor },
 					...params?.limit === void 0 ? {} : { limit: params.limit },
 					...params?.range === void 0 ? {} : { range: params.range },
 					...params?.filter === void 0 ? {} : { filter: params.filter }
-				} }))).pipe(Effect.tap(() => observeActivityScope(actor))))), controls, CAPXUL_OPERATIONS.activity.list, deps.runPromise);
+				} })) : readActivityPage(indexerDeps, actor, controls, params)).pipe(Effect.tap(() => observeActivityScope(actor))))), controls, CAPXUL_OPERATIONS.activity.list, deps.runPromise);
 			},
 			summary: (params, options) => {
 				const controls = deps.invocationControls?.(options) ?? options;
-				return runPortEffect(captureActivityInput(() => Effect.succeed(activityActorField(params?.actor).actor)).pipe(Effect.flatMap((actor) => Effect.suspend(() => deps.convexCall.query(fns.activitySummary, copyInvocationObservation(controls, { input: {
+				return runPortEffect(captureActivityInput(() => Effect.succeed(activityActorField(params?.actor).actor)).pipe(Effect.flatMap((actor) => Effect.suspend(() => indexerDeps === void 0 ? deps.convexCall.query(fns.activitySummary, copyInvocationObservation(controls, { input: {
 					...actor === void 0 ? {} : { actor },
 					...params?.window === void 0 ? {} : { window: params.window }
-				} }))).pipe(Effect.tap(() => observeActivityScope(actor))))), controls, CAPXUL_OPERATIONS.activity.summary, deps.runPromise);
+				} })) : readActivitySummary(indexerDeps, actor, controls, params)).pipe(Effect.tap(() => observeActivityScope(actor))))), controls, CAPXUL_OPERATIONS.activity.summary, deps.runPromise);
 			},
 			get: (reference, options) => {
 				const controls = deps.invocationControls?.(options) ?? options;
@@ -7852,7 +8520,8 @@ var BetterAuthBrowserAdapter = class {
 		try {
 			const res = await this.fetchImpl(this.url("/api/auth/get-session"), withSignal$1({
 				method: "GET",
-				credentials: "include"
+				credentials: "include",
+				cache: "no-store"
 			}, options?.signal));
 			if (options?.signal?.aborted) return {
 				ok: false,
@@ -7924,7 +8593,8 @@ var BetterAuthBrowserAdapter = class {
 		try {
 			const res = await this.fetchImpl(this.url("/api/auth/convex/token"), withSignal$1({
 				method: "GET",
-				credentials: "include"
+				credentials: "include",
+				cache: "no-store"
 			}, options?.signal));
 			if (options?.signal?.aborted) return {
 				ok: false,
@@ -8437,7 +9107,7 @@ function isTransientBootstrapFailure(error) {
 	const status = error.details?.httpStatus;
 	return typeof status === "number" && isTransientHttpStatus(status);
 }
-async function safeText(res) {
+async function safeText$1(res) {
 	try {
 		return await res.text();
 	} catch {
@@ -8510,6 +9180,8 @@ var HttpBootstrapAdapter = class {
 					siteBaseUrl: normalizeRuntimeUrl("siteBaseUrl", decodedState.siteBaseUrl),
 					openfortPublishableKey: decodedState.openfortPublishableKey,
 					shieldPublishableKey: decodedState.shieldPublishableKey,
+					...decodedState.openfortAuthProvider === void 0 ? {} : { openfortAuthProvider: decodedState.openfortAuthProvider },
+					...decodedState.indexerUrl === void 0 ? {} : { indexerUrl: decodedState.indexerUrl },
 					...decodedEngineeringTelemetry !== void 0 && Result.isSuccess(decodedEngineeringTelemetry) ? { engineeringTelemetry: decodedEngineeringTelemetry.success } : {}
 				};
 			},
@@ -8518,7 +9190,7 @@ var HttpBootstrapAdapter = class {
 				return bootstrapErrorFromCapxul("malformedBody", Errors.providerError("convex", "bootstrap", cause instanceof Error ? cause : new Error(String(cause))));
 			}
 		});
-		return Effect.promise(() => safeText(res)).pipe(Effect.flatMap((body) => {
+		return Effect.promise(() => safeText$1(res)).pipe(Effect.flatMap((body) => {
 			if (res.status === 401 || body.startsWith("NOT_AUTHENTICATED")) return Effect.fail(bootstrapErrorFromCapxul("notAuthenticated", Errors.notAuthenticated()));
 			if (res.status === 400 || body.startsWith("INVALID_INPUT")) return Effect.fail(bootstrapErrorFromCapxul("invalidInput", Errors.invalidInput("publishableKey", "rejected by bootstrap")));
 			const responseBody = body.slice(0, 300);
@@ -8748,6 +9420,12 @@ function makeConnectionId() {
 }
 //#endregion
 //#region src/adapters/convex-call/ConvexCallAdapter.ts
+/**
+* A socket that has not emitted `close` within this window is not going to.
+* ponytail: one fixed bound; `closeTimeoutMs` is the knob if a slow runtime
+* ever needs a different one.
+*/
+const DEFAULT_CLOSE_TIMEOUT_MS = 5e3;
 /** Exact floor-first allowlist; every additional handler must migrate its validator first. */
 const OBSERVED_CONVEX_ACTIONS = /* @__PURE__ */ new Set([
 	"payroll/actions:authorizeRun",
@@ -8760,6 +9438,9 @@ const OBSERVED_CONVEX_ACTIONS = /* @__PURE__ */ new Set([
 	"org/actions:resumeBootstrapSubmission",
 	"org/actions:confirmBootstrap",
 	"org/actions:readTreasury",
+	"moneyExecution/actions:preparePermissionExecution",
+	"moneyExecution/actions:submitPermissionExecution",
+	"permission/actions:verify",
 	"moneyExecution/actions:preparePaymentExecution",
 	"moneyExecution/actions:abandonPaymentExecution",
 	"moneyExecution/actions:submitPaymentExecution",
@@ -8784,6 +9465,9 @@ const OBSERVED_CONVEX_QUERIES = /* @__PURE__ */ new Set([
 	"payroll/queries:groups",
 	"payroll/queries:terms",
 	"financialOps/queries:resolveRecipient",
+	"org/queries:me",
+	"permission/queries:read",
+	"permission/queries:authorize",
 	"identity/queries:loadByAuthUserId",
 	"smartAccount/queries:loadByAuthUserId",
 	"org/lifecycle:load"
@@ -8802,6 +9486,7 @@ const OBSERVED_CONVEX_MUTATIONS = /* @__PURE__ */ new Set([
 	"financialOps/requestsInbox:decline",
 	"payroll/mutations:saveGroup",
 	"payroll/mutations:removeGroup",
+	"permission/mutations:command",
 	"identity/mutations:create",
 	"identity/mutations:update",
 	"identity/mutations:completeOnboarding",
@@ -8816,7 +9501,9 @@ var ConvexCallAdapter = class {
 	#applicationId;
 	#observation;
 	#connectionMonitor;
+	#closeTimeoutMs;
 	constructor(deps) {
+		this.#closeTimeoutMs = deps.closeTimeoutMs ?? DEFAULT_CLOSE_TIMEOUT_MS;
 		this.#connectionMonitor = new ConvexConnectionMonitor();
 		const webSocketConstructor = this.#connectionMonitor.observedWebSocketConstructor();
 		this.#client = deps.client ?? new ConvexClient(deps.convexUrl, webSocketConstructor === void 0 ? {} : { webSocketConstructor });
@@ -8915,11 +9602,33 @@ var ConvexCallAdapter = class {
 			callback({ status: "loading" });
 		})));
 	}
+	/**
+	* Teardown always completes. `ConvexClient.close()` resolves only when the
+	* socket emits `close`, and `WebSocketManager.close()` in the `connecting`
+	* state arms `ws.onopen = () => ws.close()` without ever closing the socket
+	* itself — so a handshake that stalls right after a server-initiated close
+	* (code 1012, which is what a Convex deploy sends) leaves that promise
+	* pending for as long as the page lives. Convex marks the client closed and
+	* terminates the socket manager synchronously before returning it, so
+	* abandoning it drops nothing. A rejection is dropped for the same reason —
+	* the layer release turns it into a defect that fails the whole scope close,
+	* and teardown has no caller who can act on it.
+	*/
 	async close() {
 		this.#connectionMonitor.close();
-		await this.#client.close();
+		await settledWithin(this.#client.close(), this.#closeTimeoutMs);
 	}
 };
+function settledWithin(promise, timeoutMs) {
+	return new Promise((resolve) => {
+		const timer = setTimeout(resolve, timeoutMs);
+		const finish = () => {
+			clearTimeout(timer);
+			resolve();
+		};
+		promise.then(finish, finish);
+	});
+}
 function ConvexCallLayer(deps) {
 	return Layer.effect(ConvexCallPortTag, Effect.acquireRelease(Effect.sync(() => new ConvexCallAdapter(deps)), (adapter) => Effect.promise(() => adapter.close()).pipe(Effect.orDie)));
 }
@@ -9872,6 +10581,32 @@ var ConsoleDiagnosticAdapter = class {
 	}
 };
 //#endregion
+//#region src/adapters/diagnostic/EffectLogDiagnosticAdapter.ts
+/**
+* Diagnostic breadcrumbs as SDK log records. The signer's readiness cycle
+* traces (`openfort.*`) used to reach only the browser console; through this
+* adapter they run in the client's own Effect context, so the engineering
+* telemetry layer ships them to PostHog Logs beside `identity.transition`.
+* Logging never throws back into the cycle that emitted it.
+*/
+var EffectLogDiagnosticAdapter = class {
+	#runPromise;
+	#console;
+	constructor(context, consoleFallback) {
+		this.#runPromise = Effect.runPromiseWith(context);
+		this.#console = consoleFallback;
+	}
+	trace(scope, detail) {
+		this.#console?.trace(scope, detail);
+		try {
+			this.#runPromise(Effect.logInfo(scope).pipe(Effect.annotateLogs({
+				...detail,
+				diagnostic_scope: scope
+			}), Effect.catchCause(() => Effect.void))).catch(() => void 0);
+		} catch {}
+	}
+};
+//#endregion
 //#region src/openfort/create-openfort-browser-signer.ts
 function httpStatusOf(link) {
 	const carrier = link;
@@ -10003,15 +10738,35 @@ function createOpenfortBrowserSignerFromBootstrap(bootstrap, options = {}) {
 		});
 		throw failOpenfort("configure", "no-secure-context", /* @__PURE__ */ new Error("Web Crypto unavailable: browser is not a secure context"));
 	}
-	function betterAuthSessionUrl() {
-		return `${authBaseUrl}/get-session`;
+	const authProvider = bootstrap.openfortAuthProvider ?? "better-auth";
+	function accessTokenUrl() {
+		return authProvider === "oidc" ? `${authBaseUrl}/convex/token` : `${authBaseUrl}/get-session`;
 	}
 	function encryptionSessionUrl() {
 		return `${authBaseUrl}/encryption-session`;
 	}
+	let cycleStartedAt = null;
+	let stepStartedAt = 0;
+	let tokenCalls = 0;
+	const sinceCycleStart = () => cycleStartedAt === null ? void 0 : Date.now() - cycleStartedAt;
+	const step = (name, extra = {}) => {
+		const now = Date.now();
+		diagnostic?.trace("openfort.step", {
+			step: name,
+			duration_ms: now - stepStartedAt,
+			elapsed_ms: sinceCycleStart(),
+			...extra
+		});
+		stepStartedAt = now;
+	};
 	async function fetchBetterAuthAccessToken() {
+		tokenCalls += 1;
+		const tokenStartedAt = Date.now();
 		try {
-			const response = await fetch(betterAuthSessionUrl(), { credentials: "include" });
+			const response = await fetch(accessTokenUrl(), {
+				credentials: "include",
+				cache: "no-store"
+			});
 			if (!response.ok) {
 				diagnostic?.trace("openfort.token", {
 					ok: false,
@@ -10021,7 +10776,8 @@ function createOpenfortBrowserSignerFromBootstrap(bootstrap, options = {}) {
 				});
 				return null;
 			}
-			const token = (await response.json()).session?.token?.trim();
+			const body = await response.json();
+			const token = (authProvider === "oidc" ? body.token : body.session?.token)?.trim();
 			if (token === void 0 || token.length === 0) {
 				diagnostic?.trace("openfort.token", {
 					ok: false,
@@ -10032,7 +10788,11 @@ function createOpenfortBrowserSignerFromBootstrap(bootstrap, options = {}) {
 			}
 			diagnostic?.trace("openfort.token", {
 				ok: true,
-				tokenPresent: true
+				tokenPresent: true,
+				provider: authProvider,
+				call: tokenCalls,
+				duration_ms: Date.now() - tokenStartedAt,
+				elapsed_ms: sinceCycleStart()
 			});
 			return token;
 		} catch (cause) {
@@ -10048,7 +10808,7 @@ function createOpenfortBrowserSignerFromBootstrap(bootstrap, options = {}) {
 		baseConfiguration: { publishableKey: bootstrap.openfortPublishableKey },
 		shieldConfiguration: { shieldPublishableKey: bootstrap.shieldPublishableKey },
 		thirdPartyAuth: {
-			provider: ThirdPartyOAuthProvider.BETTER_AUTH,
+			provider: authProvider === "oidc" ? ThirdPartyOAuthProvider.OIDC : ThirdPartyOAuthProvider.BETTER_AUTH,
 			getAccessToken: fetchBetterAuthAccessToken
 		}
 	});
@@ -10088,10 +10848,16 @@ function createOpenfortBrowserSignerFromBootstrap(bootstrap, options = {}) {
 	let walletReadyPromise = null;
 	function startWalletReady() {
 		return (async () => {
+			const startedAt = Date.now();
+			cycleStartedAt = startedAt;
+			stepStartedAt = startedAt;
+			tokenCalls = 0;
 			if (isInsecureBrowserContext()) failNoSecureContext();
 			await openfort.waitForInitialization();
+			step("initialize");
 			const accessToken = await fetchBetterAuthAccessToken();
 			if (accessToken === null) throw openfortProviderError("token", /* @__PURE__ */ new Error("Better Auth access token unavailable for Openfort"));
+			step("token");
 			let encryptionResponse;
 			try {
 				encryptionResponse = await fetch(encryptionSessionUrl(), {
@@ -10134,10 +10900,12 @@ function createOpenfortBrowserSignerFromBootstrap(bootstrap, options = {}) {
 				ok: true,
 				httpStatus: encryptionResponse.status
 			});
+			step("encryptionSession", { httpStatus: encryptionResponse.status });
 			let embeddedState;
 			try {
 				embeddedState = await openfort.embeddedWallet.getEmbeddedState();
 				diagnostic?.trace("openfort.embeddedState", { state: embeddedState });
+				step("embeddedState", { state: embeddedState });
 			} catch (cause) {
 				diagnostic?.trace("openfort.embeddedState", {
 					ok: false,
@@ -10151,6 +10919,7 @@ function createOpenfortBrowserSignerFromBootstrap(bootstrap, options = {}) {
 				try {
 					await configureEmbeddedWallet(encryptionBody.sessionId);
 					diagnostic?.trace("openfort.configure", { ok: true });
+					step("configure");
 				} catch (cause) {
 					const error = openfortProviderError("configure", cause);
 					diagnostic?.trace("openfort.configure", {
@@ -10163,6 +10932,7 @@ function createOpenfortBrowserSignerFromBootstrap(bootstrap, options = {}) {
 			try {
 				await openfort.embeddedWallet.get();
 				diagnostic?.trace("openfort.get", { ok: true });
+				step("get");
 			} catch (cause) {
 				if (!isStaleUserSignal(cause)) {
 					diagnostic?.trace("openfort.get", {
@@ -10176,7 +10946,13 @@ function createOpenfortBrowserSignerFromBootstrap(bootstrap, options = {}) {
 					failure_mode: "stale-openfort-cache"
 				});
 				await healStaleOpenfortCache(encryptionBody.sessionId);
+				step("healStaleCache");
 			}
+			step("walletReady", {
+				ok: true,
+				total_ms: Date.now() - startedAt,
+				token_calls: tokenCalls
+			});
 		})();
 	}
 	async function ensureOpenfortWalletReady() {
@@ -10259,9 +11035,13 @@ function createOpenfortBrowserSignerFromBootstrap(bootstrap, options = {}) {
 		statusStore,
 		ensureWalletReady: ensureOpenfortWalletReady,
 		getAddress: async () => {
+			const addressStartedAt = Date.now();
 			try {
 				const address = await signer.getAddress();
-				diagnostic?.trace("openfort.address", { ok: true });
+				diagnostic?.trace("openfort.address", {
+					ok: true,
+					duration_ms: Date.now() - addressStartedAt
+				});
 				return address;
 			} catch (cause) {
 				diagnostic?.trace("openfort.address", {
@@ -11363,14 +12143,66 @@ function organizationWrongState(currentState, validStates) {
 function requestCancelled(options) {
 	return options?.signal?.aborted === true;
 }
+function accountInFlight(state) {
+	return state.phase === "authenticated" && (state.account.at === "deriving" || state.account.at === "claiming");
+}
+function settledAccount(deps, options) {
+	return new Promise((resolve) => {
+		let done = false;
+		let unsubscribe = null;
+		const onAbort = () => finish({
+			ok: false,
+			error: Errors.cancelled({ operation: CAPXUL_OPERATIONS.onboarding.completeOrganization })
+		});
+		const finish = (result) => {
+			if (done) return;
+			done = true;
+			unsubscribe?.();
+			options?.signal?.removeEventListener("abort", onAbort);
+			resolve(result);
+		};
+		if (options?.signal?.aborted) {
+			onAbort();
+			return;
+		}
+		options?.signal?.addEventListener("abort", onAbort, { once: true });
+		const stop = deps.subscribeIdentity((state) => {
+			if (!accountInFlight(state)) finish({
+				ok: true,
+				value: state
+			});
+		});
+		if (done) {
+			stop();
+			return;
+		}
+		unsubscribe = stop;
+		const current = deps.snapshotIdentity();
+		if (!accountInFlight(current)) finish({
+			ok: true,
+			value: current
+		});
+	});
+}
 async function reachClaimedAccount(deps, options) {
 	let state = deps.snapshotIdentity();
+	if (accountInFlight(state)) {
+		const settled = await settledAccount(deps, options);
+		if (!settled.ok) return settled;
+		state = settled.value;
+	}
 	if (state.phase !== "authenticated" || state.account.at === "unknown") {
 		const ensured = await deps.sendIdentity({ _tag: "EnsureAccount" }, options);
 		if (!ensured.ok) return ensured;
 		state = ensured.value;
 	}
 	if (state.phase !== "authenticated") return organizationWrongState(state.phase, ["authenticated:claimed"]);
+	if (accountInFlight(state)) {
+		const settled = await settledAccount(deps, options);
+		if (!settled.ok) return settled;
+		state = settled.value;
+		if (state.phase !== "authenticated") return organizationWrongState(state.phase, ["authenticated:claimed"]);
+	}
 	if (state.account.at !== "claimed") {
 		const event = state.account.at === "failed" ? { _tag: "RetryAccount" } : state.account.at === "counterfactual" ? { _tag: "ClaimAccount" } : { _tag: "EnsureAccount" };
 		const claimed = await deps.sendIdentity(event, options);
@@ -11711,8 +12543,33 @@ function toOrgMe(wire) {
 		observedAt: wire.observedAt
 	};
 }
+/**
+* The read runs through the canonical observed runner, so `org.me` owns one
+* `capxul_sdk_operation` record and one span like every other public method.
+*
+* The call-start invocation snapshot travels on the query arguments: the
+* Convex adapter reads it there and sends the browser linkage with the call,
+* so an account switch mid-flight cannot re-resolve the actor. A successful
+* read proves participation in this Organization, so the owning span carries
+* the verified Organization and the two authority booleans the backend
+* actually enforces. Labels and Budget caps stay off the record.
+*/
 function makeOrgMeMethod(deps, orgId) {
-	return (options) => runIfActive(options?.signal, CAPXUL_OPERATIONS.org.me, () => Effect.map(deps.convexCall.query(orgReadContract.me, { orgId }), toOrgMe));
+	return (options) => {
+		const controls = deps.invocationControls?.(options) ?? options;
+		return runCapxulEffect(Effect.gen(function* () {
+			const wire = yield* deps.convexCall.query(orgReadContract.me, copyInvocationObservation(controls, { orgId })).pipe(Effect.mapError((failure) => failure.publicError));
+			yield* Effect.annotateCurrentSpan({
+				verified_organization_id: orgId,
+				scope_kind: "organization",
+				can_manage_people: wire.capabilities.canManagePeople,
+				can_spend: wire.capabilities.canSpend,
+				budget_count: wire.budgets.length,
+				observed_at: wire.observedAt
+			}).pipe(Effect.catchCause(() => Effect.void));
+			return toOrgMe(wire);
+		}), controls, CAPXUL_OPERATIONS.org.me, deps.runPromise);
+	};
 }
 //#endregion
 //#region src/contract/permission.ts
@@ -11722,7 +12579,34 @@ const permissionContract = { read: makeFunctionReference(CAPXUL_FUNCTIONS["permi
 function isAborted(signal) {
 	return signal?.aborted === true;
 }
-async function execute(deps, orgId, command, signal) {
+/**
+* One owning operation per public Permission method. The compound command
+* (prepare, equality checks, sign, submit) keeps owning its own cancellation;
+* the observed runner around it is what gives the attempt its
+* `capxul_sdk_operation` record, its span and its failure capture, so a signer
+* refusal or an unexpected provider error joins to the operation like every
+* other public surface.
+*/
+function observed(deps, operation, options, run) {
+	const controls = deps.invocationControls?.(options) ?? options;
+	let verifiedOrganizationId;
+	return runCapxulEffect(Effect.gen(function* () {
+		if (controls?.signal?.aborted === true) return yield* Effect.fail(Errors.cancelled({ operation }));
+		const parent = yield* Effect.currentSpan.pipe(Effect.orDie);
+		const captured = carryInvocationParentSpan(controls, parent);
+		const result = yield* Effect.tryPromise({
+			try: () => run(controls?.signal, captured, (orgId) => {
+				verifiedOrganizationId = orgId;
+			}),
+			catch: (cause) => cause instanceof CapxulError ? cause : Errors.unknown(cause)
+		});
+		return yield* result.ok ? Effect.succeed(result.value) : Effect.fail(result.error);
+	}).pipe(Effect.ensuring(Effect.suspend(() => verifiedOrganizationId === void 0 ? Effect.void : Effect.annotateCurrentSpan({
+		verified_organization_id: verifiedOrganizationId,
+		scope_kind: "organization"
+	})).pipe(Effect.catchCause(() => Effect.void)))), observationOnlyControls(controls), operation, deps.runPromise);
+}
+async function execute(deps, orgId, command, signal, controls, verifiedOrganization) {
 	if (isAborted(signal)) return {
 		ok: false,
 		error: Errors.cancelled({ operation: "permissions" })
@@ -11746,17 +12630,18 @@ async function execute(deps, orgId, command, signal) {
 		};
 	}
 	const executionFns = deps.executionFunctions ?? moneyExecutionContract;
-	const prepared = await runIfActive(signal, CAPXUL_OPERATIONS.permissions.prepareExecution, () => deps.convexCall.action(executionFns.preparePermissionExecution, { input: {
+	const prepared = await runIfActive(signal, CAPXUL_OPERATIONS.permissions.prepareExecution, () => withInvocationParentSpan(Effect.suspend(() => deps.convexCall.action(executionFns.preparePermissionExecution, copyInvocationObservation(controls, { input: {
 		orgId,
 		signerAddress,
 		command
-	} }));
+	} }))), controls), deps.runPromise);
 	if (!prepared.ok) return prepared;
 	const expectedSafe = deriveCapxulSafeAddress({ email: session.email });
 	if (prepared.value.chainId !== deps.chainId || prepared.value.signerAddress.toLowerCase() !== signerAddress.toLowerCase() || prepared.value.userOpSenderSafe.toLowerCase() !== expectedSafe.toLowerCase() || prepared.value.operation !== command.operation || prepared.value.orgId !== orgId || canonicalJson(prepared.value.command) !== canonicalJson(command)) return {
 		ok: false,
 		error: Errors.invalidInput("permission", "prepared authority mismatch")
 	};
+	verifiedOrganization(prepared.value.orgId);
 	if (isAborted(signal)) return {
 		ok: false,
 		error: Errors.cancelled({ operation: "permissions" })
@@ -11774,43 +12659,46 @@ async function execute(deps, orgId, command, signal) {
 		ok: false,
 		error: Errors.cancelled({ operation: "permissions" })
 	};
-	return runIfActive(void 0, CAPXUL_OPERATIONS.permissions.submitExecution, () => deps.convexCall.action(executionFns.submitPermissionExecution, { input: {
+	return runIfActive(void 0, CAPXUL_OPERATIONS.permissions.submitExecution, () => withInvocationParentSpan(Effect.suspend(() => deps.convexCall.action(executionFns.submitPermissionExecution, copyInvocationObservation(controls, { input: {
 		executionId: prepared.value.executionId,
 		signature
-	} }));
+	} }))), controls), deps.runPromise);
 }
 function makePermissionMethods(deps, orgId) {
 	const reads = deps.permissionFunctions ?? permissionContract;
+	const ops = CAPXUL_OPERATIONS.org.permissions;
+	const read = (signal, operation, controls) => runIfActive(signal, operation, () => withInvocationParentSpan(Effect.suspend(() => deps.convexCall.query(reads.read, copyInvocationObservation(controls, { orgId }))), controls), deps.runPromise);
+	const command = (operation, build, options) => observed(deps, operation, options, (signal, captured, verifiedOrganization) => execute(deps, orgId, build(), signal, captured, verifiedOrganization));
 	return {
-		create: (input, options) => execute(deps, orgId, {
+		create: (input, options) => command(ops.create, () => ({
 			operation: "create",
 			...input
-		}, options?.signal),
-		change: (input, options) => execute(deps, orgId, {
+		}), options),
+		change: (input, options) => command(ops.change, () => ({
 			operation: "change",
 			...input
-		}, options?.signal),
-		assign: (input, options) => execute(deps, orgId, {
+		}), options),
+		assign: (input, options) => command(ops.assign, () => ({
 			operation: "assign",
 			...input
-		}, options?.signal),
-		revoke: (input, options) => execute(deps, orgId, {
+		}), options),
+		revoke: (input, options) => command(ops.revoke, () => ({
 			operation: "revoke",
 			...input
-		}, options?.signal),
-		replace: (input, options) => execute(deps, orgId, {
+		}), options),
+		replace: (input, options) => command(ops.replace, () => ({
 			operation: "replace",
 			...input
-		}, options?.signal),
-		list: (options) => runIfActive(options?.signal, CAPXUL_OPERATIONS.permissions.list, () => deps.convexCall.query(reads.read, { orgId })),
-		get: async (permissionId, options) => {
-			const listed = await runIfActive(options?.signal, CAPXUL_OPERATIONS.permissions.get, () => deps.convexCall.query(reads.read, { orgId }));
+		}), options),
+		list: (options) => observed(deps, ops.list, options, (signal, captured) => read(signal, CAPXUL_OPERATIONS.permissions.list, captured)),
+		get: (permissionId, options) => observed(deps, ops.get, options, async (signal, captured) => {
+			const listed = await read(signal, CAPXUL_OPERATIONS.permissions.get, captured);
 			if (!listed.ok) return listed;
 			return {
 				ok: true,
 				value: listed.value.permissions.find((row) => row.permissionId === permissionId) ?? null
 			};
-		}
+		})
 	};
 }
 //#endregion
@@ -12372,7 +13260,7 @@ function hermeticOrgView(input) {
 		name: input.name,
 		handle: input.handle,
 		safeAddress: toAddress(placeholder),
-		role: "Owner",
+		role: ADMIN_ROLE_LABEL,
 		treasury: zeroTreasury(orgId),
 		bio: null,
 		size: null,
@@ -12618,6 +13506,13 @@ function isRetryableOrganizationSetupFailure(error) {
 * constructed for each `org(orgId)` call. It has no shared mutable active-Org
 * state. The closed-over `orgId` is its only entity reference.
 */
+/** The observed-runner pair a method bundle needs to own its operation records. */
+function observedRunnerDeps(deps) {
+	return {
+		...deps.runPromise === void 0 ? {} : { runPromise: deps.runPromise },
+		...deps.invocationControls === void 0 ? {} : { invocationControls: deps.invocationControls }
+	};
+}
 function makeOrgMethods(deps) {
 	const orgDeps = {
 		...deps.orgPort === void 0 ? {} : { orgPort: deps.orgPort },
@@ -12668,7 +13563,10 @@ function makeOrgMethods(deps) {
 					},
 					...convexCall === void 0 ? {} : { convexCall }
 				}),
-				me: convexCall === void 0 ? orgMeUnavailable : makeOrgMeMethod({ convexCall }, String(orgId)),
+				me: convexCall === void 0 ? orgMeUnavailable : makeOrgMeMethod({
+					convexCall,
+					...observedRunnerDeps(deps)
+				}, String(orgId)),
 				async getLifecycle(options) {
 					if (options?.signal?.aborted) return {
 						ok: false,
@@ -12785,6 +13683,7 @@ function makeOrgMethods(deps) {
 				},
 				permissions: convexCall === void 0 ? makeNotImplementedPermissionMethods() : makePermissionMethods({
 					convexCall,
+					...observedRunnerDeps(deps),
 					...deps.actor === void 0 ? {} : { actor: deps.actor },
 					...deps.chainId === void 0 ? {} : { chainId: Number(deps.chainId) },
 					...deps.signer === void 0 ? {} : { signer: deps.signer }
@@ -12904,14 +13803,65 @@ function compareDecimal(first, second) {
 }
 //#endregion
 //#region src/surface/holdings.ts
+/** SPEC Freshness: past this block age the read is labelled stale. Nothing refuses. */
+const FRESHNESS_LIMIT_SECONDS = 60;
+/**
+* The Ponder balance view for one Safe as `CurrentHoldings`.
+*
+* The view is the signed sum of every indexed transfer, so the balance IS what
+* the chain said — there is no snapshot to go stale behind it. `observedAt` is
+* the indexed block's own timestamp, which is what the last-good label reads,
+* and `stale` is that block's age. A stopped indexer therefore shows an old
+* "as of" and the stale flag; it never turns the read into a refusal.
+*/
+function indexerHoldings(indexer, convexCall, overlay, actor, controls) {
+	return Effect.gen(function* () {
+		const scope = yield* convexCall.query(overlay, copyInvocationObservation(controls, actor?.kind === "organization" ? { input: { actor: {
+			kind: "organization",
+			orgId: actor.organizationId
+		} } } : { input: {} }));
+		if (scope.safe === null) return null;
+		const balances = yield* indexer.read("balance", {
+			safe: toAddress(scope.safe),
+			limit: INDEXER_MAX_LIMIT
+		});
+		const status = yield* indexer.status.pipe(Effect.catch(() => Effect.succeed([])));
+		const rows = [];
+		for (const balance of balances) {
+			const asset = configuredMoneyAssetById(balance.assetId);
+			if (asset === null || balance.amount < 0n) continue;
+			rows.push({
+				assetKind: "erc20",
+				tokenAddress: toAddress(asset.tokenAddress),
+				symbol: asset.symbol,
+				decimals: asset.decimals,
+				rawBalance: toWeiAmount(balance.amount.toString())
+			});
+		}
+		const chainId = balances[0]?.chainId ?? status[0]?.chainId;
+		if (chainId === void 0) return null;
+		const head = status.find((entry) => entry.chainId === chainId);
+		const nowSeconds = Math.floor(Date.now() / 1e3);
+		const headSeconds = head === void 0 ? void 0 : Number(head.blockTimestamp);
+		return {
+			actor: scope.actor,
+			chainId: toChainId(chainId),
+			observedAt: headSeconds === void 0 ? Date.now() : headSeconds * 1e3,
+			stale: headSeconds === void 0 || nowSeconds - headSeconds > FRESHNESS_LIMIT_SECONDS,
+			rows
+		};
+	}).pipe(Effect.catch(() => Effect.succeed(null)));
+}
 function makeHoldingsMethods(deps) {
 	const functions = deps.functions ?? holdingsContract;
+	const overlay = (deps.financialOpsFunctions ?? financialOpsContract).activityOverlay;
 	const read = (operation, actor, options, pick) => {
 		const controls = deps.invocationControls?.(options) ?? options;
-		return runCapxulEffect(retryIdempotentRead(deps.convexCall.action(functions.current, copyInvocationObservation(controls, actor?.kind === "organization" ? { actor: {
+		const convexSnapshot = retryIdempotentRead(deps.convexCall.action(functions.current, copyInvocationObservation(controls, actor?.kind === "organization" ? { actor: {
 			kind: "organization",
 			orgId: actor.organizationId
-		} } : {})), operation, deps.telemetry, controls).pipe(Effect.map(pick), Effect.mapError((error) => error.publicError)), controls, operation, deps.runPromise);
+		} } : {})), operation, deps.telemetry, controls).pipe(Effect.mapError((error) => error.publicError));
+		return runCapxulEffect((deps.indexerRead === void 0 ? convexSnapshot : indexerHoldings(deps.indexerRead, deps.convexCall, overlay, actor, controls).pipe(Effect.flatMap((current) => current === null ? convexSnapshot : Effect.succeed(current)))).pipe(Effect.map(pick)), controls, operation, deps.runPromise);
 	};
 	return {
 		current: (input, options) => read(CAPXUL_OPERATIONS.holdings.current, input?.actor, options, (snapshot) => snapshot),
@@ -12937,8 +13887,8 @@ const APPLIED_ACTION_BY_EVENT = {
 	RestoreSession: "none",
 	ResumeOtpEntry: "none",
 	Reset: "none",
-	SessionRestored: "none",
-	SessionAbsent: "none",
+	SessionRestored: "restoration",
+	SessionAbsent: "restoration",
 	EnsureAccount: "none",
 	ClaimAccount: "none",
 	RetryAccount: "none",
@@ -12950,8 +13900,8 @@ const APPLIED_ACTION_BY_EVENT = {
 	OtpFailed: "failed",
 	Verified: "verified",
 	VerifyFailed: "failed",
-	SessionRead: "none",
-	SessionReadFailed: "none",
+	SessionRead: "restoration",
+	SessionReadFailed: "restoration",
 	SignedOut: "signed-out",
 	SignOutFailed: "failed",
 	AccountAt: "none",
@@ -12977,11 +13927,71 @@ const authFailure = (record, reason, mode) => ({
 		...linkage(record)
 	}
 });
+/**
+* The label of the restore window every client boots into. A settled session
+* fact that left this label is the restoration result (#1962 R04); the same
+* facts from a signed-out or authenticated state are the routine session probe
+* that `getSession()` runs, and a probe is not a restoration attempt.
+*/
+const RESTORE_WINDOW = "restoring";
+/**
+* Which result the window settled on. `SessionRestored` and `SessionAbsent` are
+* the cache door and say it themselves. `ReadSession` is also valid inside the
+* window — `getSession()` drives it on a cache miss and its `SessionRead`
+* completion settles the window — so that one event reports both halves and the
+* state it produced is what separates them.
+*/
+const restorationOutcome = (event, state) => {
+	switch (event) {
+		case "SessionRestored": return "restored";
+		case "SessionAbsent": return "absent";
+		case "SessionReadFailed": return "failed";
+		case "SessionRead":
+			if (state.phase === "authenticated") return "restored";
+			return state.phase === "signed_out" ? "absent" : void 0;
+		default: return;
+	}
+};
+/**
+* The restore window's one result, or nothing when this settled session fact
+* belongs to a probe rather than to the window.
+*/
+const restorationObservation = (record, state) => {
+	if (record.slot !== "identity:session" || record.from !== RESTORE_WINDOW) return NONE;
+	const outcome = restorationOutcome(record.event, state);
+	if (outcome === void 0) return NONE;
+	return {
+		name: "access_recovery_completed",
+		props: {
+			recovery: "session_restoration",
+			outcome,
+			...outcome === "failed" && state.phase === "faulted" ? { reason_code: state.failure.code } : {},
+			...linkage(record)
+		}
+	};
+};
+const REFUSAL_EVENTS = /* @__PURE__ */ new Set([
+	"ClaimAccount",
+	"RetryAccount",
+	"CreateOrganization",
+	"AttachOrganization",
+	"RetryOrganization"
+]);
 function mapIdentityProductObservation(record, state) {
 	if (record.machine !== "identity" || !IDENTITY_EVENT_TAG_SET.has(record.event)) return NONE;
 	if (record.outcome === "cancelled") return NONE;
 	if (record.slot === "identity:auth" && record.outcome === "refused") return authFailure(record, record.refusal_code, void 0);
 	if (record.slot === "identity:auth" && record.outcome === "failed") return authFailure(record, record.error_code, record.failure?.mode);
+	if (record.outcome === "refused" && REFUSAL_EVENTS.has(record.event)) return {
+		name: "identity_refused",
+		props: {
+			event: record.event,
+			refusal_code: record.refusal_code,
+			slot: record.slot,
+			state: record.state,
+			...linkage(record)
+		}
+	};
 	if (record.outcome !== "applied") return NONE;
 	switch (APPLIED_ACTION_BY_EVENT[record.event]) {
 		case "none": return NONE;
@@ -13004,6 +14014,7 @@ function mapIdentityProductObservation(record, state) {
 			name: "auth_signed_out",
 			props: linkage(record)
 		};
+		case "restoration": return restorationObservation(record, state);
 	}
 }
 const ignoreTransportFailure = (operation, operationName, eventName) => Effect.suspend(operation).pipe(Effect.catchCause(() => Effect.logWarning("identity.product.telemetry.dropped").pipe(Effect.annotateLogs({
@@ -13015,7 +14026,7 @@ function executeIdentityProductObservation(telemetry, record, state) {
 	if (mapped === null) return Effect.void;
 	copyInvocationObservation(record, mapped);
 	const invocationTelemetry = bindProductTelemetryInvocation(telemetry, mapped);
-	const after = () => mapped.name === "auth_verified" && state.phase === "authenticated" ? invocationTelemetry.identify({
+	const after = () => state.phase === "authenticated" && (mapped.name === "auth_verified" || mapped.name === "access_recovery_completed") ? invocationTelemetry.identify({
 		distinctId: state.session.authUserId,
 		traits: { email_domain: emailDomain(state.session.email) }
 	}) : mapped.name === "auth_signed_out" ? invocationTelemetry.reset() : Effect.void;
@@ -13060,6 +14071,51 @@ function startSignerReadinessOnClaim(actor, signer) {
 		browserSigner.ensureWalletReady?.().catch(() => {});
 	});
 }
+/**
+* Report the result of each signer readiness cycle (#1962 R04).
+*
+* The readiness store already carries the cycle boundary this needs, so no
+* public signer hook, second identity subscriber, or render counter is added.
+* `ensureOpenfortWalletReady` writes `recovering` synchronously when it starts
+* a cycle, and only the cycle that is still the current one writes `ready` or
+* `unavailable` (`create-openfort-browser-signer.ts:501-521`). Callers that
+* join a live cycle share that single write, and a `resetSession` writes
+* `unknown` first, so a cycle that a reset or an account replacement outran
+* reports nothing.
+*
+* The host context is bound when the cycle starts, so a person who signs out
+* and back in while a cycle runs cannot relabel the result that began under
+* the previous person. A signer with no readiness cycle — a node or dev key,
+* and a headless client whose requirement never opens the account lane —
+* writes no status and reports nothing.
+*/
+function observeSignerReadinessCycles(signer, telemetry, hostObservationSnapshot, runPromise) {
+	const statusStore = signer?.statusStore;
+	if (statusStore === void 0 || telemetry === void 0) return () => {};
+	let running = false;
+	let startContext;
+	return statusStore.subscribe((status) => {
+		if (status === "recovering") {
+			running = true;
+			startContext = hostObservationSnapshot?.();
+			return;
+		}
+		const cycleContext = startContext;
+		const completesCycle = running;
+		running = false;
+		startContext = void 0;
+		if (!completesCycle || status !== "ready" && status !== "unavailable") return;
+		const event = {
+			name: "access_recovery_completed",
+			props: {
+				recovery: "signer_readiness",
+				outcome: status
+			}
+		};
+		if (cycleContext !== void 0) attachInvocationObservation(event, cycleContext);
+		runPromise(Effect.suspend(() => bindProductTelemetryInvocation(telemetry, event).emit(event)).pipe(Effect.catchCause(() => Effect.void))).catch(() => {});
+	});
+}
 function assembleCapxulClient(input) {
 	const observation = input;
 	const authCache = input.authCache ?? detectAuthCacheAdapter();
@@ -13089,12 +14145,14 @@ function assembleCapxulClient(input) {
 		}, failureObservation, normalizeCapxulOperation(`identity.${record.event}`), "machine");
 	});
 	const unsubscribeSignerReadiness = startSignerReadinessOnClaim(actor, input.signer);
+	const unsubscribeReadinessObservation = observeSignerReadinessCycles(input.signer, input.ports.telemetry, observation.hostObservationSnapshot, effectRunner.runPromise);
 	let stopPromise = null;
 	const stopActor = () => {
 		if (stopPromise === null) {
 			unsubscribeProductTelemetry();
 			unsubscribeFailureObservation();
 			unsubscribeSignerReadiness();
+			unsubscribeReadinessObservation();
 			stopPromise = effectRunner.runPromise(Scope.close(scope, Exit.void));
 		}
 		return stopPromise;
@@ -13111,7 +14169,8 @@ function assembleCapxulClient(input) {
 		convexCall: input.ports.convexCall,
 		...input.signer === void 0 ? {} : { signer: input.signer },
 		telemetry: input.ports.telemetry,
-		requestKeyScope: `${input.bootstrap.convexUrl}:${String(input.bootstrap.chainId)}`
+		requestKeyScope: `${input.bootstrap.convexUrl}:${String(input.bootstrap.chainId)}`,
+		...input.ports.indexerRead === void 0 ? {} : { indexerRead: input.ports.indexerRead }
 	});
 	const accountBundle = makeAccountMethods({
 		actor,
@@ -13140,10 +14199,13 @@ function assembleCapxulClient(input) {
 		...input.invokeTimeoutMs === void 0 ? {} : { invokeTimeoutMs: input.invokeTimeoutMs },
 		afterVerifyOtp: async () => {
 			const browserSigner = input.signer;
-			if (browserSigner !== void 0 && "resetSession" in browserSigner && typeof browserSigner.resetSession === "function") try {
-				browserSigner.resetSession();
-			} catch (cause) {
-				throw signerFailure(browserSigner.source, "resetSession", cause);
+			if (browserSigner !== void 0 && "resetSession" in browserSigner && typeof browserSigner.resetSession === "function") {
+				try {
+					browserSigner.resetSession();
+				} catch (cause) {
+					throw signerFailure(browserSigner.source, "resetSession", cause);
+				}
+				if (browserSigner.statusStore?.status() === "unknown" && typeof browserSigner.ensureWalletReady === "function") browserSigner.ensureWalletReady().catch(() => {});
 			}
 			await detectPendingOrgInvitations?.();
 			kickProvisioning?.();
@@ -13170,6 +14232,7 @@ function assembleCapxulClient(input) {
 		ensureAccount: account._internal.ensureReady,
 		getLifecycle: account.getLifecycle,
 		snapshotIdentity: actor.snapshot,
+		subscribeIdentity: actor.subscribe,
 		sendIdentity: (event, options) => runCapxulEffect(askIdentity(actor, event, options), options, CAPXUL_OPERATIONS._internal.identity.send, effectRunner.runPromise)
 	});
 	const system = makeSystemMethods({ convexCall: input.ports.convexCall });
@@ -13178,7 +14241,8 @@ function assembleCapxulClient(input) {
 		convexCall: input.ports.convexCall,
 		telemetry: input.ports.telemetry,
 		runPromise: effectRunner.runPromise,
-		invocationControls: (controls) => withHostObservationControls(observation.hostObservationSnapshot, controls, actor.authSession()?.authUserId)
+		invocationControls: (controls) => withHostObservationControls(observation.hostObservationSnapshot, controls, actor.authSession()?.authUserId),
+		...input.ports.indexerRead === void 0 ? {} : { indexerRead: input.ports.indexerRead }
 	});
 	const accounts = makeAccountsMethods({
 		accountReadPort: input.ports.accountRead,
@@ -13303,6 +14367,7 @@ function assembleCapxulClient(input) {
 			identity: identityRuntime,
 			bootstrap: input.bootstrap,
 			accounts: { fund: accounts.fund },
+			...input.ports.indexerRead === void 0 ? {} : { indexer: input.ports.indexerRead },
 			organizationSetup: { getProofReceipt: (orgId) => runPortEffect(input.ports.convexCall.query(organizationSetupProofReceiptQuery, { orgId })) },
 			telemetry: input.ports.telemetry,
 			captureExternalAddressAcknowledged: (address, organizationId) => {
@@ -13361,8 +14426,10 @@ function withHostObservationControls(snapshot, input, actorId) {
 	const previous = readInvocationObservation(input);
 	if (previous !== void 0) return attachInvocationObservation({ ...input }, previous);
 	const captured = snapshot?.() ?? { active: true };
+	const context = captured.active ? withCapturedAttemptContext(captured.context, input) : captured.context;
 	return attachInvocationObservation({ ...input }, {
 		...captured,
+		...context === void 0 ? {} : { context },
 		...actorId === void 0 ? {} : { actorId }
 	});
 }
@@ -13502,6 +14569,352 @@ function snapshotHostObservability(observability) {
 function isPromiseLike(value) {
 	return (typeof value === "object" && value !== null || typeof value === "function") && "then" in value;
 }
+//#endregion
+//#region src/adapters/ponder/decode.ts
+/**
+* Decode the indexer's rows at the trust boundary.
+*
+* Ponder returns the raw PostgreSQL result: `integer` arrives as a number,
+* `numeric(78)` and `text` arrive as strings. Amounts, block numbers and
+* timestamps are `numeric(78)`, so they become `bigint` here and never pass
+* through `Number`. Every decoder throws a `CapxulError`; the adapter turns
+* that into a typed `IndexerReadError`.
+*/
+const HEX = /^0x[0-9a-fA-F]+$/;
+function field(row, key) {
+	if (!(key in row)) throw Errors.invalidInput(key, "missing from the indexer row");
+	return row[key];
+}
+function text(row, key) {
+	const value = field(row, key);
+	if (typeof value !== "string") throw Errors.invalidInput(key, "must be a string");
+	return value;
+}
+function hex(row, key) {
+	const value = text(row, key);
+	if (!HEX.test(value)) throw Errors.invalidInput(key, "must be a hex string");
+	return value.toLowerCase();
+}
+function integer(row, key) {
+	const value = field(row, key);
+	const parsed = typeof value === "string" ? Number(value) : value;
+	if (typeof parsed !== "number" || !Number.isSafeInteger(parsed)) throw Errors.invalidInput(key, "must be an integer");
+	return parsed;
+}
+/** `numeric(78)` crosses the wire as a decimal string; keep every digit. */
+function big(row, key) {
+	const value = field(row, key);
+	if (typeof value === "bigint") return value;
+	const raw = typeof value === "number" ? String(value) : value;
+	if (typeof raw !== "string" || !/^-?[0-9]+$/.test(raw)) throw Errors.invalidInput(key, "must be an exact integer amount");
+	return BigInt(raw);
+}
+function asRow(value) {
+	if (typeof value !== "object" || value === null || Array.isArray(value)) throw Errors.invalidInput("row", "must be an object");
+	return value;
+}
+function identity(row) {
+	return {
+		id: text(row, "id"),
+		chainId: toChainId(integer(row, "chain_id")),
+		txHash: toTxHash(hex(row, "tx_hash")),
+		transactionLogOrdinal: integer(row, "transaction_log_ordinal"),
+		blockNumber: big(row, "block_number"),
+		blockHash: hex(row, "block_hash"),
+		timestamp: big(row, "timestamp")
+	};
+}
+function decodeTransfer(value) {
+	const row = asRow(value);
+	return {
+		...identity(row),
+		assetId: toAssetId(text(row, "asset_id")),
+		token: toAddress(hex(row, "token")),
+		from: toAddress(hex(row, "from")),
+		to: toAddress(hex(row, "to")),
+		amount: big(row, "amount")
+	};
+}
+function decodePayment(value) {
+	const row = asRow(value);
+	return {
+		...identity(row),
+		contract: toAddress(hex(row, "contract")),
+		settlementId: hex(row, "settlement_id"),
+		sender: toAddress(hex(row, "sender")),
+		recipient: toAddress(hex(row, "recipient")),
+		assetId: toAssetId(text(row, "asset_id")),
+		token: toAddress(hex(row, "token")),
+		amount: big(row, "amount"),
+		kind: integer(row, "kind"),
+		documentHash: hex(row, "document_hash")
+	};
+}
+/** The `balance` view exposes the signed sum under the underlying column name `to`. */
+function decodeBalance(value) {
+	const row = asRow(value);
+	return {
+		chainId: toChainId(integer(row, "chain_id")),
+		assetId: toAssetId(text(row, "asset_id")),
+		address: toAddress(hex(row, "to")),
+		amount: big(row, "amount")
+	};
+}
+const DECODERS = {
+	transfer: decodeTransfer,
+	payment: decodePayment,
+	balance: decodeBalance
+};
+/** Decode one `/sql/db` or `/sql/live` payload. Ponder returns `{ rows: [...] }`. */
+function decodeRows(table, body) {
+	const rows = asRow(body).rows;
+	if (!Array.isArray(rows)) throw Errors.invalidInput("rows", "must be an array");
+	const decode = DECODERS[table];
+	return rows.map(decode);
+}
+/** Decode Ponder's native `/status`: `{ [chainName]: { id, block: { number, timestamp } } }`. */
+function decodeStatus(body) {
+	const chains = asRow(body);
+	return Object.entries(chains).map(([chain, value]) => {
+		const entry = asRow(value);
+		const block = asRow(field(entry, "block"));
+		return {
+			chain,
+			chainId: toChainId(integer(entry, "id")),
+			blockNumber: big(block, "number"),
+			blockTimestamp: big(block, "timestamp")
+		};
+	});
+}
+//#endregion
+//#region src/adapters/ponder/statements.ts
+/**
+* The exact statements the indexer accepts.
+*
+* `apps/indexer/src/queries.ts` compiles its allowlist with `@ponder/client`
+* and compares `sql`, `params` and `typings` byte for byte against the caller's
+* statement. Anything else gets 403. The SDK therefore reproduces the compiled
+* text here rather than pulling Ponder and Drizzle into a published browser
+* bundle to regenerate three fixed statements.
+*
+* `statements.test.ts` pins the text. When the indexer schema or a query in
+* that allowlist changes, this file changes with it or every read fails 403.
+*/
+const HEADS = {
+	transfer: "select \"id\", \"chain_id\", \"tx_hash\", \"transaction_log_ordinal\", \"block_number\", \"block_hash\", \"timestamp\", \"asset_id\", \"token\", \"from\", \"to\", \"amount\" from \"transfer\" where (\"transfer\".\"from\" = $1 or \"transfer\".\"to\" = $2) order by \"transfer\".\"block_number\" desc, \"transfer\".\"id\" desc",
+	payment: "select \"id\", \"chain_id\", \"tx_hash\", \"transaction_log_ordinal\", \"block_number\", \"block_hash\", \"timestamp\", \"contract\", \"settlement_id\", \"sender\", \"recipient\", \"asset_id\", \"token\", \"amount\", \"kind\", \"document_hash\" from \"payment\" where (\"payment\".\"sender\" = $1 or \"payment\".\"recipient\" = $2) order by \"payment\".\"block_number\" desc, \"payment\".\"id\" desc",
+	balance: "select \"chain_id\", \"asset_id\", \"to\", \"amount\" from \"balance\" where \"balance\".\"to\" = $1"
+};
+/** How many times the statement binds the Safe address. */
+const ACTOR_PARAMS = {
+	transfer: 2,
+	payment: 2,
+	balance: 1
+};
+/**
+* Build the compiled query for one table and page. Throws a `CapxulError` for
+* a page or address the indexer would refuse, so the caller never spends a
+* round trip to learn it built the request wrong.
+*/
+function ponderQuery(table, input) {
+	const safe = assertIndexerPage(input);
+	const offset = input.offset ?? 0;
+	const actors = ACTOR_PARAMS[table];
+	const params = [];
+	for (let i = 0; i < actors; i++) params.push(safe);
+	params.push(input.limit);
+	let sql = `${HEADS[table]} limit $${actors + 1}`;
+	if (offset > 0) {
+		params.push(offset);
+		sql = `${sql} offset $${actors + 2}`;
+	}
+	return {
+		sql,
+		params,
+		typings: params.map(() => "none")
+	};
+}
+/**
+* The `?sql=` value. `@ponder/client` sends `superjson.stringify(query)`; for a
+* payload of strings and numbers superjson emits no `meta`, so the wire form is
+* exactly this envelope.
+*/
+function ponderQueryParam(query) {
+	return JSON.stringify({ json: query });
+}
+//#endregion
+//#region src/adapters/ponder/sse.ts
+/**
+* The smallest SSE reader that can carry an `Authorization` header.
+*
+* `@ponder/client` opens its live query with `EventSource`, which accepts no
+* headers, so it cannot reach the guarded indexer at all. The indexer's CORS
+* policy allows exactly one request header (`Authorization`), so this reader
+* sends nothing else. Ponder writes one `data:` line per frame.
+*/
+async function readEventStream(body, onData, stopped) {
+	const reader = body.getReader();
+	const decoder = new TextDecoder();
+	let buffer = "";
+	try {
+		for (;;) {
+			const { done, value } = await reader.read();
+			if (done || stopped()) return;
+			buffer += decoder.decode(value, { stream: true });
+			let split = buffer.indexOf("\n\n");
+			while (split !== -1) {
+				const frame = buffer.slice(0, split);
+				buffer = buffer.slice(split + 2);
+				const data = frameData(frame);
+				if (data !== void 0) onData(data);
+				if (stopped()) return;
+				split = buffer.indexOf("\n\n");
+			}
+		}
+	} finally {
+		await reader.cancel().catch(() => void 0);
+	}
+}
+function frameData(frame) {
+	const lines = [];
+	for (const line of frame.split("\n")) {
+		if (!line.startsWith("data:")) continue;
+		lines.push(line.slice(line.startsWith("data: ") ? 6 : 5));
+	}
+	return lines.length === 0 ? void 0 : lines.join("\n");
+}
+//#endregion
+//#region src/adapters/ponder/PonderIndexerAdapter.ts
+var PonderIndexerAdapter = class {
+	#baseUrl;
+	#token;
+	#fetch;
+	#observation;
+	constructor(deps) {
+		this.#baseUrl = deps.baseUrl.replace(/\/$/, "");
+		this.#token = deps.token;
+		this.#observation = deps.observation;
+		this.#fetch = deps.fetch ?? ((input, init) => globalThis.fetch(input, init));
+	}
+	read(table, input) {
+		const operation = `indexer.read.${table}`;
+		return Effect.tryPromise({
+			try: async () => {
+				return decodeRows(table, await (await this.#request("db", table, input, operation)).json());
+			},
+			catch: (cause) => toIndexerReadError(operation, cause)
+		});
+	}
+	subscribe(table, input, callback) {
+		const operation = CAPXUL_OPERATIONS.activity.subscribe;
+		return Effect.sync(() => {
+			let stopped = false;
+			const unsubscribe = () => {
+				stopped = true;
+			};
+			callback({ status: "loading" });
+			this.#stream(table, input, operation, callback, () => stopped).catch(() => void 0);
+			return unsubscribe;
+		});
+	}
+	status = Effect.tryPromise({
+		try: async () => {
+			const response = await this.#fetch(`${this.#baseUrl}/status`, { method: "GET" });
+			if (!response.ok) throw httpError("indexer.status", response.status, await safeText(response));
+			return decodeStatus(await response.json());
+		},
+		catch: (cause) => toIndexerReadError("indexer.status", cause)
+	});
+	/** One authenticated `/sql/:method` call. Throws a `CapxulError` on refusal. */
+	async #request(method, table, input, operation) {
+		const query = ponderQuery(table, input);
+		const token = await this.#token({ forceRefreshToken: false });
+		if (token === null || token === "") throw Errors.notAuthenticated();
+		const url = `${this.#baseUrl}/sql/${method}?sql=${encodeURIComponent(ponderQueryParam(query))}`;
+		const headers = { authorization: `Bearer ${token}` };
+		if (method === "live") headers.accept = "text/event-stream";
+		let response;
+		try {
+			response = await this.#fetch(url, {
+				method: "GET",
+				headers
+			});
+		} catch (cause) {
+			throw Errors.networkError(operation, cause, {
+				provider: "indexer",
+				failure_mode: "upstream-down"
+			});
+		}
+		if (!response.ok) throw httpError(operation, response.status, await safeText(response));
+		return response;
+	}
+	/**
+	* Follow the live stream until the caller unsubscribes or the indexer closes
+	* it. The indexer closes the stream on token expiry or revoked authority
+	* with no frame, so any end the caller did not ask for is a teardown: it
+	* reaches `captureException` under `activity.subscribe` and the caller sees
+	* one `error` snapshot.
+	*/
+	async #stream(table, input, operation, callback, stopped) {
+		let failure;
+		try {
+			const response = await this.#request("live", table, input, operation);
+			if (response.body === null) throw Errors.providerError("indexer", operation, "empty stream");
+			await readEventStream(response.body, (data) => {
+				try {
+					callback({
+						status: "ok",
+						value: decodeRows(table, JSON.parse(data))
+					});
+				} catch (cause) {
+					failure = toPublicError$1(operation, cause);
+				}
+			}, () => stopped() || failure !== void 0);
+		} catch (cause) {
+			failure = toPublicError$1(operation, cause);
+		}
+		if (stopped()) return;
+		const error = failure ?? Errors.capabilityUnavailable("indexer", operation);
+		observeStreamFailure(this.#observation, CAPXUL_OPERATIONS.activity.subscribe, error, error.code === "NOT_AUTHENTICATED" ? "operation" : "exception");
+		callback({
+			status: "error",
+			error
+		});
+	}
+};
+/**
+* Map an indexer refusal into the shared error vocabulary.
+*
+* 401 is the expected outcome of an expired or revoked session. 403 is not:
+* the indexer accepts only its own compiled statements for a Safe in the
+* claim, so a refusal means this SDK and that deployment disagree, or the
+* session gained a Safe and still holds the older token. Both must be loud.
+*/
+function httpError(operation, status, body) {
+	if (status === 401) return Errors.notAuthenticated();
+	if (status === 429) return Errors.rateLimited({ resource: "indexer" });
+	if (status === 503) return Errors.capabilityUnavailable("indexer", operation);
+	return Errors.providerError("indexer", operation, body, {
+		httpStatus: status,
+		...status >= 500 ? { failure_mode: "upstream-down" } : {},
+		details: { reason: status === 403 ? "scope-refused" : "http-status" }
+	});
+}
+function toPublicError$1(operation, cause) {
+	if (cause instanceof CapxulError) return cause;
+	return Errors.providerError("indexer", operation, cause);
+}
+function toIndexerReadError(operation, cause) {
+	if (cause instanceof IndexerReadError) return cause;
+	return indexerReadErrorFromCapxul(operation, toPublicError$1(operation, cause), cause);
+}
+async function safeText(response) {
+	try {
+		return await response.text();
+	} catch {
+		return "";
+	}
+}
 const SDK_VERSION = version;
 /**
 * Project the built graph into the flat `FlowPorts` record the method bundles
@@ -13751,7 +15164,16 @@ async function createProductionAdapters(input) {
 		}));
 		const applicationLayer = Layer.merge(portsLayer, optionalEngineeringTelemetryLayer(bootstrapResult.value.engineeringTelemetry, resolvedInput.value.runtime));
 		const context = await Effect.runPromise(Layer.buildWithScope(applicationLayer, scope));
-		const ports = await Effect.runPromise(collectProductionFlowPorts.pipe(Effect.provide(context)));
+		const collected = await Effect.runPromise(collectProductionFlowPorts.pipe(Effect.provide(context)));
+		const indexerUrl = input.indexerUrl ?? bootstrapResult.value.indexerUrl;
+		const indexerRead = productionIndexerReadPort(indexerUrl === void 0 ? input : {
+			...input,
+			indexerUrl
+		}, collected, observation);
+		const ports = indexerRead === void 0 ? collected : {
+			...collected,
+			indexerRead
+		};
 		const stopConnectionObservation = observeProductionConvexConnection(ports.convexCall, context);
 		const close = idempotentClose(async () => {
 			try {
@@ -13878,7 +15300,7 @@ async function createCapxulClientWithSignerControls(input, controls) {
 			...adapters.value.bootstrap,
 			authBaseUrl: resolvedAuthBaseUrl
 		}, {
-			diagnostic: new ConsoleDiagnosticAdapter(),
+			diagnostic: new EffectLogDiagnosticAdapter(adapters.value.context, new ConsoleDiagnosticAdapter()),
 			signUserOpHash: controls.signEmbeddedUserOpHash
 		});
 		signer = withSignerControl(signer, controls.signUserOpHash);
@@ -14083,5 +15505,28 @@ function idempotentClose(close) {
 		await close();
 	};
 }
+/**
+* Build the Ponder read port for this client, or `undefined` when no indexer
+* origin was supplied. The token provider is the same
+* `AuthClientPort.getConvexJwt` closure `ConvexCallPort` uses, so the indexer
+* and Convex see one session with one scope.
+*/
+function productionIndexerReadPort(input, ports, observation) {
+	if (input.activityReadSource === "convex") return void 0;
+	if (input.indexerUrl === void 0 || input.indexerUrl === "") return void 0;
+	return new PonderIndexerAdapter({
+		baseUrl: normalizeHttpUrl("indexerUrl", input.indexerUrl),
+		token: async ({ forceRefreshToken }) => {
+			const token = await Effect.runPromise(Effect.result(ports.authClient.getConvexJwt({
+				forceRefresh: forceRefreshToken,
+				...input.signal === void 0 ? {} : { signal: input.signal }
+			})));
+			if (Result.isFailure(token)) return null;
+			return String(token.success.token);
+		},
+		...input.fetch === void 0 ? {} : { fetch: input.fetch },
+		...observation === void 0 ? {} : { observation }
+	});
+}
 //#endregion
 export { signerFailure as A, isRestoring as B, normalizeExceptionErrorKind as C, fromWei as D, safeExceptionLabel as E, CAPXUL_OPERATIONS as F, isCapxulOperation as I, normalizeCapxulOperation as L, PAYMENT_DIRECTIONS as M, PAYMENT_STATUSES as N, isSettingUpLifecycle as O, redactTelemetryEvent as P, destination as R, SDK_VERSION$1 as S, projectSdkException as T, fingerprintPaymentIntent as _, smartAccountErrorFromCapxul as a, failureDetail as b, identityErrorFromCapxul as c, embeddedSigner as d, openfortEmbeddedSigner as f, devPrivateKeySigner as g, deriveDevPrivateKey as h, assembleCapxulClient as i, resolveFailureMode as j, injectedWalletSigner as k, convexCallErrorFromCapxul as l, openfortEmbeddedWalletPort as m, createCapxulClientWithSignerControls as n, accountReadErrorFromCapxul as o, openfortEmbeddedSignerFromWallet as p, postHogObservability as r, wireChainId as s, createCapxulClient as t, bootstrapErrorFromCapxul as u, toWei as v, normalizeExceptionOperation as w, EXCEPTION_MESSAGE as x, CAPXUL_SDK_EXPECTED_OUTCOME_EVENT as y, isClaimed as z };