@capxul/sdk 4.2.0-rc.1 → 4.2.0-rc.11

package/dist/{production-CBKHzqYP.d.mts → production-A1zW1JPt.d.mts}

@@ -1,4 +1,4 @@
-import { $ as PayrollGroupId, A as AllowanceKey, B as ChainId, C as AuthCachePort, D as Account$1, Et as FailureMode, H as CurrencyCode, I as AuthSession, K as Email, L as AuthUserId, M as AnonymousDistinctId, N as AppId, Q as PaymentCommandId, R as BlockNumber, U as DocumentHash, V as CountryCode, W as DurationMs, X as OrgId, Y as Money, Z as PartyId, _ as Session$1, _t as CapxulErrorCode, at as RoleKey, b as AuthClientPort, bt as Failure, ct as TesterKind, d as AccountRequirement, et as PayrollRunId, g as Profile$1, gt as CapxulError, h as CapxulResult, i as CapxulSigner, it as PublishableKey, j as AllowedOrigin, k as Address$1, lt as TxHash, nt as PermissionId, ot as SessionToken, q as EpochMs, rt as Profile, s as SignerStatusStore, st as SmartAccount, tt as PermissionAssignmentId, u as AccountProviderSource, ut as WeiAmount, v as SmartAccount$1, vt as CapxulErrorDetails, x as CanSendOtpStatus, y as ClockPort, z as BudgetId } from "./OAuthBearerAuthClient-C-ip-z8M.mjs";
+import { $ as PayrollGroupId, A as AllowanceKey, B as ChainId, C as AuthCachePort, D as Account$1, Et as FailureMode, F as AssetId, H as CurrencyCode, I as AuthSession, K as Email, L as AuthUserId, M as AnonymousDistinctId, N as AppId, Q as PaymentCommandId, R as BlockNumber, U as DocumentHash, V as CountryCode, W as DurationMs, X as OrgId, Y as Money, Z as PartyId, _ as Session$1, _t as CapxulErrorCode, at as RoleKey, b as AuthClientPort, bt as Failure, ct as TesterKind, d as AccountRequirement, et as PayrollRunId, g as Profile$1, gt as CapxulError, h as CapxulResult, i as CapxulSigner, it as PublishableKey, j as AllowedOrigin, k as Address$1, lt as TxHash, nt as PermissionId, ot as SessionToken, q as EpochMs, rt as Profile, s as SignerStatusStore, st as SmartAccount, tt as PermissionAssignmentId, u as AccountProviderSource, ut as WeiAmount, v as SmartAccount$1, vt as CapxulErrorDetails, x as CanSendOtpStatus, y as ClockPort, z as BudgetId } from "./OAuthBearerAuthClient-C-ip-z8M.mjs";
 import { Hex } from "viem";
 import { Context, Effect, Layer, Schema, Scope, Tracer } from "effect";
 import { FunctionReference } from "convex/server";
@@ -284,7 +284,7 @@ interface TelemetryPort {
 }
 //#endregion
 //#region ../observability/src/index.d.ts
-declare const TELEMETRY_EVENT_NAMES: readonly ["auth_otp_requested", "auth_otp_delivered", "auth_otp_expired", "auth_verified", "auth_failed", "auth_signed_out", "onboarding_intent_selected", "onboarding_profile_submitted", "onboarding_organization_submitted", "onboarding_dashboard_reached", "provisioning_safe_created", "provisioning_safe_confirmed", "bootstrap_resolved", "bootstrap_failed", "member_activation_started", "member_activation_ready", "member_activation_failed", "organization_creation_started", "organization_creation_ready", "organization_creation_failed", "chain_upstream_fallback", "bundler_error", "receipt_pending", "operation_retried", "account_balance_read", "account_balance_failed", "faucet_requested", "faucet_confirmed", "faucet_failed", "org_create_started", "org_safe_created", "org_safe_confirmed", "org_roles_seeded", "org_created", "org_create_failed", "org_invite_sent", "org_invite_accepted", "org_invite_expired", "payment_initiated", "payment_settled", "payment_failed", "payment_verification_retry", "payment_lifecycle_transition", "quick_pay_external_address_acknowledged", "deposit_initiated", "deposit_settled", "permission_mirror_verification", "movement_scan_window", "movement_scan_checkpoint", "movement_scan_incident", "activity_annotation_saved", "ui_activity_action_completed", "contact_relationship_changed", "ui_contact_action_completed"];
+declare const TELEMETRY_EVENT_NAMES: readonly ["auth_otp_requested", "auth_otp_delivered", "auth_otp_expired", "auth_verified", "auth_failed", "identity_refused", "auth_signed_out", "onboarding_intent_selected", "onboarding_profile_submitted", "onboarding_organization_submitted", "onboarding_dashboard_reached", "provisioning_safe_created", "provisioning_safe_confirmed", "bootstrap_resolved", "bootstrap_failed", "member_activation_started", "member_activation_ready", "member_activation_failed", "organization_creation_started", "organization_creation_ready", "organization_creation_failed", "chain_upstream_fallback", "bundler_error", "receipt_pending", "operation_retried", "account_balance_read", "account_balance_failed", "faucet_requested", "faucet_confirmed", "faucet_failed", "org_create_started", "org_safe_created", "org_safe_confirmed", "org_roles_seeded", "org_created", "org_create_failed", "org_invite_sent", "org_invite_accepted", "org_invite_expired", "payment_initiated", "payment_settled", "payment_failed", "payment_verification_retry", "payment_lifecycle_transition", "quick_pay_external_address_acknowledged", "deposit_initiated", "deposit_settled", "permission_mirror_verification", "movement_scan_window", "movement_scan_checkpoint", "movement_scan_incident", "activity_annotation_saved", "ui_activity_action_completed", "contact_relationship_changed", "ui_contact_action_completed", "access_recovery_completed", "ui_access_step_completed", "org_invite_progressed", "invoice_issued", "invoice_request_transitioned", "ui_invoice_step_completed", "ui_treasury_step_completed", "ui_receive_step_completed", "payroll_group_changed", "payroll_run_transitioned", "ui_payroll_action_completed"];
 type TelemetryEventName = (typeof TELEMETRY_EVENT_NAMES)[number];
 type TelemetryProps = Record<string, unknown>;
 type TelemetryEvent = {
@@ -611,6 +611,10 @@ type BootstrapResolution = {
   readonly siteBaseUrl: string;
   readonly openfortPublishableKey: string;
   readonly shieldPublishableKey: string;
+  /** Openfort third-party auth provider the signer presents; absent means better-auth. */
+  readonly openfortAuthProvider?: "better-auth" | "oidc";
+  /** Origin of the Ponder indexer the SDK reads directly; absent means no indexer reads. */
+  readonly indexerUrl?: string;
   readonly engineeringTelemetry?: EngineeringTelemetryBootstrapPolicyV1;
 };
 type BootstrapErrorKind = "notAuthenticated" | "network" | "provider" | "malformedBody" | "invalidInput" | "rateLimited";
@@ -904,6 +908,118 @@ interface AccountReadPort {
   fundFromFaucet(input: FundFromFaucetInput): Effect.Effect<FundFromFaucetResult, AccountReadError, never>;
 }
 //#endregion
+//#region src/ports/indexer-read.d.ts
+/**
+ * IndexerReadPort is the SDK's read seam onto the Ponder read model
+ * (`apps/indexer`). Ponder holds what the chain said; Convex holds what the
+ * user meant. Nothing here is copied into Convex, nothing waits for a
+ * finality tag, and no write path may read through this port.
+ *
+ * Every read is scoped to one Safe and one page. The indexer accepts only the
+ * exact compiled statements in `apps/indexer/src/queries.ts`, so the adapter
+ * that implements this port reproduces those statements byte for byte and the
+ * service refuses anything else with 403.
+ */
+/** One page of rows for one Safe. `offset` defaults to 0 (the first page). */
+interface IndexerReadInput {
+  /** The Safe the caller owns. The indexer refuses a Safe outside the session claim. */
+  readonly safe: Address$1;
+  /** 1 to 1000 inclusive — the indexer's own bound. */
+  readonly limit: number;
+  readonly offset?: number;
+}
+/**
+ * The chain evidence every indexed row carries. `id` is the logical event id
+ * `chainId:txHash:transactionLogOrdinal`; it survives a reorg, so it is the
+ * key a Convex intent row stitches against.
+ */
+interface IndexerEventIdentity {
+  readonly id: string;
+  readonly chainId: ChainId;
+  readonly txHash: TxHash;
+  readonly transactionLogOrdinal: number;
+  readonly blockNumber: bigint;
+  readonly blockHash: string;
+  /** Block timestamp in epoch seconds. */
+  readonly timestamp: bigint;
+}
+interface IndexerTransferRow extends IndexerEventIdentity {
+  readonly assetId: AssetId;
+  readonly token: Address$1;
+  readonly from: Address$1;
+  readonly to: Address$1;
+  /**
+   * Raw token units, exact. This is an evidence boundary, so the row never
+   * carries Money or AssetAmount: the reader owns the asset's decimals.
+   */
+  readonly amount: bigint;
+}
+interface IndexerPaymentRow extends IndexerEventIdentity {
+  readonly contract: Address$1;
+  /** The protocol settlement id a Convex Payment command stitches against. */
+  readonly settlementId: string;
+  readonly sender: Address$1;
+  readonly recipient: Address$1;
+  readonly assetId: AssetId;
+  readonly token: Address$1;
+  /** Raw token units, exact. */
+  readonly amount: bigint;
+  readonly kind: number;
+  readonly documentHash: string;
+}
+/** A row of the indexer's signed-transfer `balance` view. */
+interface IndexerBalanceRow {
+  readonly chainId: ChainId;
+  readonly assetId: AssetId;
+  readonly address: Address$1;
+  /** Raw token units, exact. */
+  readonly amount: bigint;
+}
+/** One chain's sync position, from the indexer's native `/status` route. */
+interface IndexerChainStatus {
+  readonly chain: string;
+  readonly chainId: ChainId;
+  readonly blockNumber: bigint;
+  /** Block timestamp in epoch seconds. Its age is the freshness label. */
+  readonly blockTimestamp: bigint;
+}
+/**
+ * The tables this seam reads today. P04 adds the authority rows (`safe`,
+ * `safe_event`, `roles_module`) and P05 adds `commitment`: each is one more
+ * entry here plus its statement and decoder.
+ */
+interface IndexerRowsByTable {
+  readonly transfer: readonly IndexerTransferRow[];
+  readonly payment: readonly IndexerPaymentRow[];
+  readonly balance: readonly IndexerBalanceRow[];
+}
+type IndexerTable = keyof IndexerRowsByTable;
+declare const IndexerReadError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+  readonly _tag: "IndexerReadError";
+} & Readonly<A>;
+declare class IndexerReadError extends IndexerReadError_base<{
+  readonly operation: string;
+  readonly publicCode: CapxulErrorCode;
+  readonly publicError: CapxulError;
+  readonly cause: unknown;
+  readonly details?: CapxulErrorDetails;
+}> {}
+interface IndexerReadPort {
+  /** One page of rows, newest block first. An empty page is a value, not an error. */
+  read<T extends IndexerTable>(table: T, input: IndexerReadInput): Effect.Effect<IndexerRowsByTable[T], IndexerReadError>;
+  /**
+   * The same page over the indexer's live stream. The first snapshot is
+   * `loading`; each later snapshot carries the whole page again. The indexer
+   * closes the stream on token expiry or revoked authority, which arrives as
+   * one `error` snapshot — the caller re-reads with a refreshed token.
+   *
+   * @internal-use — substrate reactive transport, like `ConvexCallPort.subscribe`.
+   */
+  subscribe<T extends IndexerTable>(table: T, input: IndexerReadInput, callback: (snapshot: Snapshot<IndexerRowsByTable[T]>) => void): Effect.Effect<Unsubscribe, IndexerReadError>;
+  /** Sync position per chain. Unauthenticated: a stale index is not a refusal. */
+  readonly status: Effect.Effect<readonly IndexerChainStatus[], IndexerReadError>;
+}
+//#endregion
 //#region src/flows/types.d.ts
 /** The runtime port bundle that `assembleCapxulClient` uses. */
 interface FlowPorts {
@@ -916,6 +1032,11 @@ interface FlowPorts {
   readonly clock: ClockPort;
   readonly telemetry: TelemetryPort;
   readonly convexCall: ConvexCallPort;
+  /**
+   * The Ponder read seam (P02). Optional: it is present only when the client
+   * was given an indexer origin, and every existing flow works without it.
+   */
+  readonly indexerRead?: IndexerReadPort;
 }
 /** Legacy method input retained by the imperative auth surface. */
 interface ExternalSigner {
@@ -1551,20 +1672,30 @@ interface ActivityAnnotationInput {
   readonly accountingCategory?: string;
   readonly memo?: string;
 }
+/**
+ * #1960 R02: the declared option type is the `InvocationControls` these methods
+ * have always forwarded to `deps.invocationControls`, so an Activity action can
+ * carry the correlation its UI observation already used. `{ signal }` callers
+ * are unaffected.
+ */
 interface ActivityMethods {
-  list(params?: ActivityListParams, options?: {
-    readonly signal?: AbortSignal;
-  }): Promise<CapxulResult<ActivityPage>>;
-  summary(params?: ActivitySummaryParams, options?: {
-    readonly signal?: AbortSignal;
-  }): Promise<CapxulResult<ActivitySummary>>;
-  get(reference: ActivityReference, options?: {
-    readonly signal?: AbortSignal;
+  /**
+   * Tell the caller when the indexed page for this actor's Safe changed, over
+   * the indexer's one live connection. The callback carries no rows: it is the
+   * signal to re-read `list` or `summary`. Without an indexer this resolves a
+   * no-op teardown, so a caller needs no branch.
+   *
+   * @internal-use — substrate reactive transport, like `ConvexCallPort.subscribe`.
+   */
+  subscribe(onChange: () => void, params?: {
+    readonly actor?: ActorReference;
+  }, options?: InvocationControls): Promise<CapxulResult<() => void>>;
+  list(params?: ActivityListParams, options?: InvocationControls): Promise<CapxulResult<ActivityPage>>;
+  summary(params?: ActivitySummaryParams, options?: InvocationControls): Promise<CapxulResult<ActivitySummary>>;
+  get(reference: ActivityReference, options?: InvocationControls & {
     readonly actor?: ActorReference;
   }): Promise<CapxulResult<ActivityDetail | null>>;
-  annotate(input: ActivityAnnotationInput, options?: {
-    readonly signal?: AbortSignal;
-  }): Promise<CapxulResult<ActivityAnnotation>>;
+  annotate(input: ActivityAnnotationInput, options?: InvocationControls): Promise<CapxulResult<ActivityAnnotation>>;
 }
 interface OfframpQuoteInput {
   readonly actor?: ActorReference;
@@ -1718,25 +1849,19 @@ interface AddressBookLabelInput {
 interface AddressBookListInput {
   readonly includeHidden?: boolean;
 }
+/**
+ * #1960 R02: the declared option type is the `InvocationControls` these methods
+ * have always forwarded to `deps.invocationControls`. Naming it lets a caller
+ * that captured one user attempt hand the same `correlation_id`/`journey_id` to
+ * the operation the attempt starts. `{ signal }` callers are unaffected.
+ */
 interface AddressBookMethods {
-  list(input?: AddressBookListInput, options?: {
-    readonly signal?: AbortSignal;
-  }): Promise<CapxulResult<readonly AddressBookEntry[]>>;
-  get(entryId: PartyId, options?: {
-    readonly signal?: AbortSignal;
-  }): Promise<CapxulResult<AddressBookEntry | null>>;
-  add(input: AddressBookAddInput, options?: {
-    readonly signal?: AbortSignal;
-  }): Promise<CapxulResult<AddressBookEntry>>;
-  hide(entryId: PartyId, options?: {
-    readonly signal?: AbortSignal;
-  }): Promise<CapxulResult<AddressBookEntry>>;
-  unhide(entryId: PartyId, options?: {
-    readonly signal?: AbortSignal;
-  }): Promise<CapxulResult<AddressBookEntry>>;
-  label(input: AddressBookLabelInput, options?: {
-    readonly signal?: AbortSignal;
-  }): Promise<CapxulResult<AddressBookEntry>>;
+  list(input?: AddressBookListInput, options?: InvocationControls): Promise<CapxulResult<readonly AddressBookEntry[]>>;
+  get(entryId: PartyId, options?: InvocationControls): Promise<CapxulResult<AddressBookEntry | null>>;
+  add(input: AddressBookAddInput, options?: InvocationControls): Promise<CapxulResult<AddressBookEntry>>;
+  hide(entryId: PartyId, options?: InvocationControls): Promise<CapxulResult<AddressBookEntry>>;
+  unhide(entryId: PartyId, options?: InvocationControls): Promise<CapxulResult<AddressBookEntry>>;
+  label(input: AddressBookLabelInput, options?: InvocationControls): Promise<CapxulResult<AddressBookEntry>>;
 }
 interface ActorRequest {
   readonly id: string;
@@ -2676,6 +2801,13 @@ interface CapxulClient {
      * NOT on the public `client.accounts` surface.
      */
     readonly accounts: AccountsFaucetMethods;
+    /**
+     * Ponder read seam (P02). Present only when the client was built with an
+     * indexer origin, so every reader treats it as optional. Ponder holds what
+     * the chain said; Convex holds what the user meant. Reads here never run
+     * inside a write path and never wait for a finality tag.
+     */
+    readonly indexer?: IndexerReadPort;
     /** Quarantined Reference-harness evidence; never a product Organization method. */
     readonly organizationSetup: OrganizationSetupProofMethods;
     /** Product telemetry projection for internal composition and test harnesses. */

package/dist/testing/index.d.mts

@@ -1,10 +1,85 @@
 import { h as CapxulResult } from "../OAuthBearerAuthClient-C-ip-z8M.mjs";
-import { er as TelemetryEvent, f as CapxulClient, i as ObservationAdapter, n as ProductionSignerControls, nr as TelemetryIdentifyInput, pr as IdentityTransition, t as CapxulClientInput, tr as TelemetryGroupInput } from "../production-CBKHzqYP.mjs";
+import { er as TelemetryEvent, f as CapxulClient, i as ObservationAdapter, n as ProductionSignerControls, nr as TelemetryIdentifyInput, pr as IdentityTransition, t as CapxulClientInput, tr as TelemetryGroupInput } from "../production-A1zW1JPt.mjs";
 import { Effect, Layer } from "effect";
 //#region src/testing/production-client.d.ts
 /** Create the one production client with per-client controls at its signing boundaries. */
 declare function createCapxulProductionTestClient(input: CapxulClientInput, controls: ProductionSignerControls): Promise<CapxulResult<CapxulClient>>;
 //#endregion
+//#region src/testing/signer-faults.d.ts
+/**
+ * Which provider refusal to inject. The codes are the ones the SDK's own
+ * classifiers decode (`src/signer.ts`), so a fault reaches the public error
+ * contract through the real decode path rather than a shortcut.
+ *
+ * - `missing-signer` — Openfort's typed not-ready code. `openfortSignerNotReadyCode`
+ *   decodes it, so the production recovery wrapper runs its single retry (A02).
+ * - `user-rejected` — the EIP-1193 4001 result. `signerFailure` decodes it to
+ *   `SIGNER_REJECTED`, an expected refusal (A08).
+ * - `unexpected` — no provider code at all, so it stays an unexpected
+ *   `PROVIDER_ERROR` (A09).
+ */
+type SignerFaultKind = "missing-signer" | "user-rejected" | "unexpected";
+/** The value a controlled fault throws. Named so a test can assert its origin. */
+declare class ControlledSignerFault extends Error {
+  readonly kind: SignerFaultKind;
+  /** Provider code the SDK classifiers read; absent for `unexpected`. */
+  readonly code: string | number | undefined;
+  constructor(kind: SignerFaultKind);
+}
+/** Build one fault value without the harness, for a caller that writes its own control. */
+declare function signerFaultCause(kind: SignerFaultKind): ControlledSignerFault;
+interface SignerFaultPlan {
+  /**
+   * Fault the next embedded signature ONCE, beneath the production recovery
+   * wrapper, then delegate every later call to the real signer. The address
+   * read and the readiness cycle still run first, so the fault lands at the
+   * actual final signing boundary after the prepared-command equality checks.
+   */
+  readonly signOnce?: SignerFaultKind;
+  /**
+   * Call the production signer's own `resetSession()` ONCE, immediately before
+   * the next signature and after the command is prepared. The delegate then
+   * re-runs the real readiness cycle, so the configure request under test is
+   * the first one the browser observes after the `reset-session` record (A03).
+   *
+   * Throws when the composed signer owns no session — a silently skipped reset
+   * would leave the run looking green while proving nothing.
+   */
+  readonly resetSessionBeforeNextSign?: boolean;
+}
+/** What the seam did. JSON-serializable, so a browser test can read it back. */
+interface SignerSeamRecord {
+  readonly boundary: "reset-session" | "embedded-sign";
+  /** 1-based count of calls at that boundary. */
+  readonly attempt: number;
+  readonly hash?: string;
+  /** Present only on the call that actually threw. */
+  readonly fault?: SignerFaultKind;
+  readonly atMs: number;
+}
+interface ArmedSignerSeam {
+  /** Hand these to `createCapxulProductionTestClient`. */
+  readonly controls: ProductionSignerControls;
+  /** Oldest first. Empty until the client reaches a signing boundary. */
+  readonly records: () => readonly SignerSeamRecord[];
+  /** True once every armed one-shot has fired. */
+  readonly spent: () => boolean;
+}
+/**
+ * Arm one-shot faults on the production embedded signer.
+ *
+ * ```ts
+ * const seam = armSignerFaults({ signOnce: "user-rejected" });
+ * const client = await createCapxulProductionTestClient(input, seam.controls);
+ * const result = await client.org(orgId).permissions.create(command);
+ * // result.error.code === "SIGNER_REJECTED"; nothing was submitted.
+ * // seam.records() names the boundary that refused.
+ * ```
+ *
+ * An empty plan installs no controls, which composes the ordinary client.
+ */
+declare function armSignerFaults(plan?: SignerFaultPlan): ArmedSignerSeam;
+//#endregion
 //#region src/testing/telemetry/RecordingTelemetryAdapter.d.ts
 type RecordingTelemetryOperation = {
   readonly type: "emit";
@@ -56,4 +131,4 @@ interface CapxulTestObservation {
  */
 declare function createCapxulTestClient(options?: CreateCapxulTestClientOptions): CapxulTestClient;
 //#endregion
-export { CapxulTestClient, CapxulTestClock, CapxulTestObservation, CreateCapxulTestClientOptions, type ProductionSignerControls, SeedTestIdentityInput, createCapxulProductionTestClient, createCapxulTestClient };
+export { type ArmedSignerSeam, CapxulTestClient, CapxulTestClock, CapxulTestObservation, ControlledSignerFault, CreateCapxulTestClientOptions, type ProductionSignerControls, SeedTestIdentityInput, type SignerFaultKind, type SignerFaultPlan, type SignerSeamRecord, armSignerFaults, createCapxulProductionTestClient, createCapxulTestClient, signerFaultCause };

package/dist/testing/index.mjs

@@ -1,5 +1,5 @@
-import { D as fromWei, P as redactTelemetryEvent, a as smartAccountErrorFromCapxul, c as identityErrorFromCapxul, i as assembleCapxulClient, l as convexCallErrorFromCapxul, n as createCapxulClientWithSignerControls, o as accountReadErrorFromCapxul, s as wireChainId, u as bootstrapErrorFromCapxul, v as toWei } from "../production-FgHUndeX.mjs";
-import { A as toAccountId, B as toEmail, G as toKycTier, H as toEpochSeconds, I as toChainId, L as toCountryCode, M as toAllowedOrigin, N as toAppId, P as toAuthUserId, Q as toSessionToken, U as toHandle, V as toEpochMs, W as toJwtToken, X as toPublishableKey, d as authClientPortFromPromiseAdapter, et as validateHandle, it as CapxulError, j as toAddress, n as readClockNow, ot as Errors, r as InMemoryAuthCacheAdapter, v as deriveCapxulSafeAddress, z as toDurationMs } from "../OAuthBearerAuthClient-BrbXrndM.mjs";
+import { D as fromWei, P as redactTelemetryEvent, a as smartAccountErrorFromCapxul, c as identityErrorFromCapxul, i as assembleCapxulClient, l as convexCallErrorFromCapxul, n as createCapxulClientWithSignerControls, o as accountReadErrorFromCapxul, s as wireChainId, u as bootstrapErrorFromCapxul, v as toWei } from "../production-7jr-KUvX.mjs";
+import { G as toHandle, H as toEmail, I as toAuthUserId, K as toJwtToken, M as toAddress, N as toAllowedOrigin, P as toAppId, Q as toPublishableKey, R as toChainId, U as toEpochMs, V as toDurationMs, W as toEpochSeconds, ct as CapxulError, d as authClientPortFromPromiseAdapter, et as toSessionToken, it as validateHandle, j as toAccountId, n as readClockNow, q as toKycTier, r as InMemoryAuthCacheAdapter, ut as Errors, y as deriveCapxulSafeAddress, z as toCountryCode } from "../OAuthBearerAuthClient-CbU_W9Sp.mjs";
 import { keccak256 } from "viem";
 import { Effect, Result, Semaphore } from "effect";
 import { getFunctionName } from "convex/server";
@@ -9,6 +9,97 @@ function createCapxulProductionTestClient(input, controls) {
 	return createCapxulClientWithSignerControls(input, controls);
 }
 //#endregion
+//#region src/testing/signer-faults.ts
+const FAULT_CODES = {
+	"missing-signer": "MISSING_SIGNER",
+	"user-rejected": 4001,
+	unexpected: void 0
+};
+/** The value a controlled fault throws. Named so a test can assert its origin. */
+var ControlledSignerFault = class extends Error {
+	kind;
+	/** Provider code the SDK classifiers read; absent for `unexpected`. */
+	code;
+	constructor(kind) {
+		super(`controlled signer fault (${kind})`);
+		this.name = "ControlledSignerFault";
+		this.kind = kind;
+		this.code = FAULT_CODES[kind];
+	}
+};
+/** Build one fault value without the harness, for a caller that writes its own control. */
+function signerFaultCause(kind) {
+	return new ControlledSignerFault(kind);
+}
+/**
+* Arm one-shot faults on the production embedded signer.
+*
+* ```ts
+* const seam = armSignerFaults({ signOnce: "user-rejected" });
+* const client = await createCapxulProductionTestClient(input, seam.controls);
+* const result = await client.org(orgId).permissions.create(command);
+* // result.error.code === "SIGNER_REJECTED"; nothing was submitted.
+* // seam.records() names the boundary that refused.
+* ```
+*
+* An empty plan installs no controls, which composes the ordinary client.
+*/
+function armSignerFaults(plan = {}) {
+	const records = [];
+	let pendingFault = plan.signOnce;
+	let pendingReset = plan.resetSessionBeforeNextSign === true;
+	let resetCalls = 0;
+	let embeddedCalls = 0;
+	function record(entry) {
+		records.push({
+			...entry,
+			atMs: Date.now()
+		});
+	}
+	const resetThenSign = async (hash, signer) => {
+		if (pendingReset) {
+			pendingReset = false;
+			resetCalls += 1;
+			if (signer.resetSession === void 0) throw new Error("armSignerFaults: resetSessionBeforeNextSign needs the embedded browser signer; this client composed a signer with no session");
+			signer.resetSession();
+			record({
+				boundary: "reset-session",
+				attempt: resetCalls,
+				hash
+			});
+		}
+		return signer.signUserOpHash(hash);
+	};
+	const faultThenDelegate = async (hash, delegate) => {
+		embeddedCalls += 1;
+		const fault = pendingFault;
+		if (fault === void 0) {
+			record({
+				boundary: "embedded-sign",
+				attempt: embeddedCalls,
+				hash
+			});
+			return delegate(hash);
+		}
+		pendingFault = void 0;
+		record({
+			boundary: "embedded-sign",
+			attempt: embeddedCalls,
+			hash,
+			fault
+		});
+		throw signerFaultCause(fault);
+	};
+	return {
+		controls: {
+			...plan.resetSessionBeforeNextSign === true ? { signUserOpHash: resetThenSign } : {},
+			...plan.signOnce === void 0 ? {} : { signEmbeddedUserOpHash: faultThenDelegate }
+		},
+		records: () => records.slice(),
+		spent: () => pendingFault === void 0 && !pendingReset
+	};
+}
+//#endregion
 //#region src/testing/account/InMemoryAccountReadAdapter.ts
 var InMemoryAccountReadAdapter = class {
 	#deps;
@@ -915,4 +1006,4 @@ function createCapxulTestClient(options = {}) {
 	};
 }
 //#endregion
-export { createCapxulProductionTestClient, createCapxulTestClient };
+export { ControlledSignerFault, armSignerFaults, createCapxulProductionTestClient, createCapxulTestClient, signerFaultCause };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@capxul/sdk",
-  "version": "4.2.0-rc.1",
+  "version": "4.2.0-rc.11",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/Xelmar-tech/infrastructure.git",
@@ -48,11 +48,11 @@
     "vite-plus": "0.3.0",
     "vitest": "4.1.11",
     "@capxul/config": "0.3.0",
-    "@capxul/errors": "0.3.0",
+    "@capxul/observability": "4.2.0-rc.11",
     "@capxul/types": "0.3.0",
-    "@capxul/observability": "4.2.0-rc.1",
-    "@capxul/wire": "0.7.0",
-    "@capxul/typescript-config": "0.0.0"
+    "@capxul/typescript-config": "0.0.0",
+    "@capxul/errors": "0.3.0",
+    "@capxul/wire": "0.7.0"
   },
   "_permissionlessPinReason": "permissionless.toSafeSmartAccount is pinned to 0.3.4 for live Safe deployment E2E. Counterfactual address fixtures captured 2026-05-17 in packages/backend/convex/_shared/__tests__/counterfactual.test.ts and packages/config/tests/safe.test.ts must be re-verified before upgrading.",
   "scripts": {