@capxul/sdk 4.2.0-rc.8 → 4.2.0-rc.9

package/dist/{OAuthBearerAuthClient-hPwtSpEf.mjs → OAuthBearerAuthClient-IB2W1Fzj.mjs}

@@ -902,6 +902,7 @@ const COUNTRY_CODE_RE = /^[A-Z]{2}$/;
 const ACCOUNT_ID_RE = /^account_[0-9A-Za-z]+$/;
 const PARTY_ID_RE = /^party_[0-9A-Za-z]+$/;
 const APP_ID_RE = /^app_[0-7][0-9A-HJKMNP-TV-Z]{25}$/;
+const TX_HASH_RE = /^0x[0-9a-f]{64}$/i;
 const WEI_RE = /^[0-9]+$/;
 Math.floor(Number.MAX_SAFE_INTEGER / 1e3);
 function toAddress(raw) {
@@ -957,6 +958,10 @@ function toPublishableKey(raw) {
 	if (typeof raw !== "string" || !PUBLISHABLE_KEY_PATTERN.test(raw)) throw Errors.invalidInput("publishableKey", invalidValueReason("must match cap_pk_(test|live) plus 32 Crockford base32 chars", raw));
 	return raw;
 }
+function toTxHash(raw) {
+	if (typeof raw !== "string" || !TX_HASH_RE.test(raw)) throw Errors.invalidInput("txHash", invalidValueReason("must be 0x + 64 hex chars", raw));
+	return raw.toLowerCase();
+}
 function toEpochMs(raw) {
 	assertSafeNonNegativeInteger(raw, "epochMs");
 	return raw;
@@ -1041,23 +1046,117 @@ function invalidValueReason(prefix, raw) {
 //#region ../config/src/tokens.ts
 /** `TestUSDC` ("USDX") — Base Sepolia, 6 decimals, open `mint`. (Canon §1.) */
 const USDX_ADDRESS_BASE_SEPOLIA = "0xf09fcbb6df9f8f918e58f9c8ab15a76ade862b77";
+const USDX_DEPLOYMENT_START_BLOCK = 39860173;
+/**
+* The ERC-20 `symbol()` the deployed `TestUSDC` contract returns
+* (`packages/contracts/src/TestUSDC.sol:10`). It travels with the address and
+* the decimals so a holdings row can never carry one token's address with
+* another token's display symbol. This is the display symbol, not the
+* currency: see `USDX_CURRENCY` below.
+*/
+const USDX_SYMBOL = "USDX";
+const SYNTHETIC_TEST_ASSET_SOURCE = "synthetic-test-liquidity";
 const USDX_ASSET = {
 	assetId: assetIdFor(84532, USDX_ADDRESS_BASE_SEPOLIA),
 	chainId: toChainId(84532),
-	symbol: "USDX",
+	symbol: USDX_SYMBOL,
 	peg: toCurrencyCode("USD"),
 	tokenAddress: USDX_ADDRESS_BASE_SEPOLIA,
-	deploymentStartBlock: 39860173,
-	decimals: 6
+	deploymentStartBlock: USDX_DEPLOYMENT_START_BLOCK,
+	decimals: 6,
+	source: "settlement"
 };
+/**
+* The settlement tier: rows the exact-transfer path and the Movement scanner
+* admit, each carrying the legacy `currency` projection those readers expect.
+* Adding an owned test asset here would put candidate liquidity on the
+* money-write path, so M03's rows go to the candidate tier below instead.
+*/
 const CONFIGURED_MONEY_ASSETS = [{
 	...USDX_ASSET,
 	currency: USDX_ASSET.peg
 }];
+/**
+* The candidate tier: five owned test assets, every field read back from Base
+* Sepolia after the deployment that created it (chain 84532, blocks
+* 46,465,978–46,465,982). Real contracts, authored liquidity, no settlement
+* admission — so rollback is removing consumers, never relabelling a
+* deployed address or deleting its history.
+*
+* `symbol` is the display string the owned contract returns. A
+* provider-supported USDC would be a different contract at a different
+* address returning the same symbol, which is why the resolvers below key on
+* `assetId`, or on chain plus address, and never on a symbol.
+*/
+const SYNTHETIC_TEST_ASSETS = [
+	{
+		assetId: assetIdFor(84532, "0xb3d8566fb90f7df939f4bc08a09b19047117f549"),
+		chainId: toChainId(84532),
+		tokenAddress: "0xb3d8566fb90f7df939f4bc08a09b19047117f549",
+		symbol: "USDC",
+		decimals: 6,
+		peg: toCurrencyCode("USD"),
+		deploymentStartBlock: 46465978,
+		deploymentTransaction: "0xa7fb8bb9d1fd1cc5fe2fc42fa4cdccace7742efae8ea99f091a283e5709343de",
+		source: SYNTHETIC_TEST_ASSET_SOURCE
+	},
+	{
+		assetId: assetIdFor(84532, "0x7ddcfb6aaffb9908c4c2db308b784c269eec8a01"),
+		chainId: toChainId(84532),
+		tokenAddress: "0x7ddcfb6aaffb9908c4c2db308b784c269eec8a01",
+		symbol: "USDT",
+		decimals: 6,
+		peg: toCurrencyCode("USD"),
+		deploymentStartBlock: 46465979,
+		deploymentTransaction: "0xa17ad76fe8b24cdf1fbcff245c3eb022444710cf9fa7b5ee59818be654f4ae10",
+		source: SYNTHETIC_TEST_ASSET_SOURCE
+	},
+	{
+		assetId: assetIdFor(84532, "0x1d93d525f73453fe18eebf044e8a3954bfe3721e"),
+		chainId: toChainId(84532),
+		tokenAddress: "0x1d93d525f73453fe18eebf044e8a3954bfe3721e",
+		symbol: "WETH",
+		decimals: 18,
+		peg: null,
+		deploymentStartBlock: 46465980,
+		deploymentTransaction: "0xcb9b2d024686fac93ec1243ccf02d3567fd531da46176115660cba2ba644b09d",
+		source: SYNTHETIC_TEST_ASSET_SOURCE
+	},
+	{
+		assetId: assetIdFor(84532, "0x8fe52c70aa9f7b6d74d8bb26eca33d87413cb624"),
+		chainId: toChainId(84532),
+		tokenAddress: "0x8fe52c70aa9f7b6d74d8bb26eca33d87413cb624",
+		symbol: "WBTC",
+		decimals: 8,
+		peg: null,
+		deploymentStartBlock: 46465981,
+		deploymentTransaction: "0x728ba7b430ffd141f83d0ed5ce429d050049d7b097c936fd11e9c572d1243854",
+		source: SYNTHETIC_TEST_ASSET_SOURCE
+	},
+	{
+		assetId: assetIdFor(84532, "0x5865fe9787ac214feb5facaebaec06969ac0a9a3"),
+		chainId: toChainId(84532),
+		tokenAddress: "0x5865fe9787ac214feb5facaebaec06969ac0a9a3",
+		symbol: "cNGN",
+		decimals: 6,
+		peg: toCurrencyCode("NGN"),
+		deploymentStartBlock: 46465982,
+		deploymentTransaction: "0xcedf254bcef57fc64189261a5ab1161bc4fde370e470933f627c4d8ddb5a2e26",
+		source: SYNTHETIC_TEST_ASSET_SOURCE
+	}
+];
+toChainId(84532);
+/**
+* Every known asset in ONE identity space. The tiers above declare admission;
+* this is the only list an identity resolves against, so an asset is never
+* two different things depending on which list a caller happened to read.
+*/
+const MONEY_ASSET_REGISTRY = [...CONFIGURED_MONEY_ASSETS, ...SYNTHETIC_TEST_ASSETS];
 CONFIGURED_MONEY_ASSETS.map((asset) => asset.tokenAddress.toLowerCase());
+/** The registry row for `assetId` across every tier, or `null`. */
 function configuredMoneyAssetById(assetId) {
 	const canonical = toAssetId(assetId);
-	return CONFIGURED_MONEY_ASSETS.find((asset) => asset.assetId === canonical) ?? null;
+	return MONEY_ASSET_REGISTRY.find((asset) => asset.assetId === canonical) ?? null;
 }
 //#endregion
 //#region ../config/src/org-payments.ts
@@ -2369,4 +2468,4 @@ function readExchange(body) {
 	};
 }
 //#endregion
-export { toSessionToken as $, currencySymbolFor as A, toDurationMs as B, ASSET_ID_RE as C, WEI_RE as D, SUPPORTED_CURRENCY_CODES as E, toAuthUserId as F, toJwtToken as G, toEpochMs as H, toBudgetId as I, toPartyId as J, toKycTier as K, toChainId as L, toAddress as M, toAllowedOrigin as N, ZERO_BYTES32 as O, toAppId as P, toRoleKey as Q, toCountryCode as R, APP_ID_RE as S, redactUrlSecrets as St, EVM_ADDRESS_RE as T, toEpochSeconds as U, toEmail as V, toHandle as W, toPayrollRunId as X, toPayrollGroupId as Y, toPublishableKey as Z, normalizeBindingEmail as _, isFailureMode as _t, parseAuthSession as a, CapxulError as at, configuredMoneyAssetById as b, isCredentialField as bt, AuthCachePortTag as c, isCapxulError as ct, authClientPortFromPromiseAdapter as d, boundedResponseHeaders as dt, toTesterKind as et, AuthClientError as f, chainCauseProperties as ft, CAPXUL_PAYMENTS_V2_ADDRESS as g, isChainUpstream as gt, orgRoleKeyForLabel as h, failureFingerprint as ht, BrowserAuthCacheAdapter as i, CAPXUL_ERROR_CODES as it, toAccountId as j, assetIdFor as k, SystemClockLayer as l, CHAIN_UPSTREAMS as lt, ADMIN_ROLE_LABEL as m, decodeChainCause as mt, readClockNow as n, HANDLE_RE as nt, parseCachedJwt as o, EXPECTED_OPERATION_OUTCOMES as ot, AuthClientPortTag as p, chainEvidenceLabel as pt, toOrgId as q, InMemoryAuthCacheAdapter as r, decodeConvexError as rt, AuthCacheError as s, Errors as st, oauthBearerAuthClient as t, validateHandle as tt, ClockPortTag as u, FAILURE_MODES as ut, BASE_SEPOLIA_CHAIN_ID as v, revertSummaryText as vt, BYTES32_RE as w, ACCOUNT_ID_RE as x, redactSecrets as xt, deriveCapxulSafeAddress as y, containsSensitiveMaterial as yt, toCurrencyCode as z };
+export { toRoleKey as $, currencySymbolFor as A, toCurrencyCode as B, ASSET_ID_RE as C, redactSecrets as Ct, WEI_RE as D, SUPPORTED_CURRENCY_CODES as E, toAssetId as F, toHandle as G, toEmail as H, toAuthUserId as I, toOrgId as J, toJwtToken as K, toBudgetId as L, toAddress as M, toAllowedOrigin as N, ZERO_BYTES32 as O, toAppId as P, toPublishableKey as Q, toChainId as R, APP_ID_RE as S, isCredentialField as St, EVM_ADDRESS_RE as T, toEpochMs as U, toDurationMs as V, toEpochSeconds as W, toPayrollGroupId as X, toPartyId as Y, toPayrollRunId as Z, normalizeBindingEmail as _, failureFingerprint as _t, parseAuthSession as a, decodeConvexError as at, configuredMoneyAssetById as b, revertSummaryText as bt, AuthCachePortTag as c, EXPECTED_OPERATION_OUTCOMES as ct, authClientPortFromPromiseAdapter as d, CHAIN_UPSTREAMS as dt, toSessionToken as et, AuthClientError as f, FAILURE_MODES as ft, CAPXUL_PAYMENTS_V2_ADDRESS as g, decodeChainCause as gt, orgRoleKeyForLabel as h, chainEvidenceLabel as ht, BrowserAuthCacheAdapter as i, HANDLE_RE as it, toAccountId as j, assetIdFor as k, SystemClockLayer as l, Errors as lt, ADMIN_ROLE_LABEL as m, chainCauseProperties as mt, readClockNow as n, toTxHash as nt, parseCachedJwt as o, CAPXUL_ERROR_CODES as ot, AuthClientPortTag as p, boundedResponseHeaders as pt, toKycTier as q, InMemoryAuthCacheAdapter as r, validateHandle as rt, AuthCacheError as s, CapxulError as st, oauthBearerAuthClient as t, toTesterKind as tt, ClockPortTag as u, isCapxulError as ut, BASE_SEPOLIA_CHAIN_ID as v, isChainUpstream as vt, BYTES32_RE as w, redactUrlSecrets as wt, ACCOUNT_ID_RE as x, containsSensitiveMaterial as xt, deriveCapxulSafeAddress as y, isFailureMode as yt, toCountryCode as z };

package/dist/capxul-source.json

@@ -1,11 +1,11 @@
 {
   "source": {
-    "commit": "29f8bbef5a60b623572ba982e895a10b47aaba27",
-    "tree": "9d831c3273591ecc4767094f887088781e786531",
+    "commit": "1c96a26356e8f36402e47eb4ac60bb89d6aeed7f",
+    "tree": "375f49f76377eeec331fd44ce17238d4a6f02ad4",
     "branch": "codex/programme-rc",
     "repository": "https://github.com/Xelmar-tech/infrastructure",
     "lockfileSha256": "5870f53b72706d103220c1bcf733cb4fb71196aea32a9cfbdc277d73cc959264"
   },
   "name": "@capxul/sdk",
-  "version": "4.2.0-rc.8"
+  "version": "4.2.0-rc.9"
 }

package/dist/index.d.mts

@@ -1,5 +1,5 @@
 import { $ as PayrollGroupId, B as ChainId, Ct as ChainCause, D as Account, Dt as RevertSummary, E as CAPXUL_PAYMENTS_V2_ADDRESS, Et as FailureMode, F as AssetId, G as EVM_ADDRESS_RE, H as CurrencyCode, I as AuthSession, J as Handle, L as AuthUserId, O as AccountId, P as AssetAmount, St as CHAIN_UPSTREAMS, Tt as FAILURE_MODES, V as CountryCode, X as OrgId, Y as Money, Z as PartyId, _ as Session, _t as CapxulErrorCode, a as Eip1193RequestProvider, at as RoleKey, c as injectedWalletSigner, ct as TesterKind, d as AccountRequirement, dt as toAddress, et as PayrollRunId, f as Eip1193Provider, ft as toCountryCode, g as Profile, gt as CapxulError, h as CapxulResult, ht as CAPXUL_ERROR_CODES, i as CapxulSigner, k as Address, l as AccountProvider, m as localPrivateKeyAccountProvider, mt as toPartyId, o as SignerStatus, p as eip1193AccountProvider, pt as toHandle, r as CapxulDigestSigner, s as SignerStatusStore, u as AccountProviderSource, v as SmartAccount, vt as CapxulErrorDetails, wt as ChainUpstream, xt as isCapxulError, yt as Errors, z as BudgetId } from "./OAuthBearerAuthClient-C-ip-z8M.mjs";
-import { $ as OrganizationPaymentBatchInput, $n as RequestStatus, $t as Destination, A as OrgScopedMethods, An as Ref, At as AddressBookAddInput, B as AuthorizeRunOptions, Bn as SmartAccountMethods, Bt as ActivityFilter, C as CurrentUserMethods, Cn as PaymentMoney, Ct as AccountMethods, D as MemberStatus, Dn as PaymentsMethods, Dt as ActorRequest, E as InviteMemberInput, En as PaymentType, Et as ActorRelationshipMethods, F as ResendInviteTokenInput, Fn as AccountLifecycle, Ft as InboxItem, G as PayrollGroupsMethods, Gn as ActorRef, Gt as ActivityPage, H as PayrollGroup, Hn as OrgLifecycle, Ht as ActivityKind, I as RoleDefinition, In as AccountSetupStep, It as InboxMethods, J as PayrollRun, Jn as SubmittedPermissionExecution, Jt as ActivitySummary, K as PayrollMethods, Kn as CurrentHoldings, Kt as ActivityRange, L as RoleSpendCap, Ln as isSettingUpLifecycle, Lt as ActivityAnnotation, M as OrgView, Mn as TargetReference, Mt as AddressBookLabelInput, N as OrganizationAccount, Nn as TargetsMethods, Nt as AddressBookMethods, O as MemberView, On as PaymentsPayInput, Ot as ActorRequestIssueInput, P as OrganizationAuditLogItem, Pn as fingerprintPaymentIntent, Pt as InboxApproveInput, Q as PayrollTermsUnit, Qn as PaymentStatus$1, Qt as DepositInstructions, R as RoleView, Rn as CompleteProfileInput, Rt as ActivityAnnotationInput, S as CurrentUserContext, Sn as PaymentDocumentsMethods, St as ReadyAccountLifecycle, T as DetectPendingOrgInvitationsResult, Tn as PaymentTiming, Tt as ActorProfileMethods, U as PayrollGroupInput, Un as OrgSetupStep, Ut as ActivityListParams, V as PayrollEngagementTerms, Vn as AuthMethods, Vt as ActivityItem, W as PayrollGroupMember, Wn as PayoutAddress, Wt as ActivityMethods, X as PayrollRunStatus, Xn as PAYMENT_DIRECTIONS, Xt as ActivitySummaryTotal, Y as PayrollRunItemInput, Yn as InboxStatus, Yt as ActivitySummaryParams, Z as PayrollRuns, Zn as PAYMENT_STATUSES, Zt as ActorReference, _ as HoldingsMethods, _n as PaymentDirection, _t as OnboardingMethods, a as ObservationContext, an as DestinationRemoveInput, ar as IdentityEvent, at as PermissionCreateInput, b as SystemHealth, bn as PaymentDocumentRender, bt as PersonOnboarding, c as HostObservability, cn as MeMethods, cr as Readiness, ct as PermissionReplaceInput, d as postHogObservability, dn as OfframpMethods, dr as isClaimed, dt as Budget, en as DestinationAddInput, et as OrganizationPaymentInput, f as CapxulClient, fn as OfframpQuote, fr as isRestoring, ft as OrgMe, g as IdentityRuntimeSendResult, gn as PaymentActivityEvidence, gt as CompletedPersonProfile, h as IdentityRuntime, hn as Payment, ht as AccountsMethods, i as ObservationAdapter, in as DestinationRail, ir as Destination$1, it as PermissionChangeInput, j as OrgTemplate, jn as ResolvedTarget, jt as AddressBookEntry, k as OrgMethods, kn as RecipientResolution, kt as ActorRequestsMethods, l as PostHogObservabilityClient, ln as MeProfile, lr as StateLabel, lt as PermissionRevokeInput, m as IdentityProfileDetails, mn as OfframpStatus, mr as InvocationControls, mt as OrgMeOptions, nn as DestinationListInput, nt as OrganizationPaymentsMethods, o as ObservationDelivery, on as DestinationsMethods, or as IdentityState, ot as PermissionMethods, p as CreateCapxulClientInput, pn as OfframpQuoteInput, pr as IdentityTransition, pt as OrgMeMethod, q as PayrollOptions, qn as Permission, qt as ActivityReference, r as CAPXUL_SDK_EXPECTED_OUTCOME_EVENT, rn as DestinationPayload, rr as TelemetryPort, rt as PermissionAssignInput, s as SdkFailureObservation, sn as FinancialOpsMethods, sr as OrgLane, st as PermissionOptions, t as CapxulClientInput, tn as DestinationKind, tt as OrganizationPaymentItemInput, u as PostHogObservabilityOptions, un as MovementActivityEvidence, ur as destination, ut as PermissionReadResult, v as Holding, vn as PaymentDocumentKind, vt as OrganizationOnboarding, w as CreateOrgInput, wn as PaymentStatus, wt as ActorProfile, x as MediaMethods, xn as PaymentDocumentVerification, xt as PersonOnboardingInput, y as SystemMethods, yn as PaymentDocumentRef, yt as OrganizationOnboardingInput, z as AuthorizeRunInput, zn as IdentityMethods, zt as ActivityDetail } from "./production-BOMKT0n7.mjs";
+import { $ as OrganizationPaymentBatchInput, $n as RequestStatus, $t as Destination, A as OrgScopedMethods, An as Ref, At as AddressBookAddInput, B as AuthorizeRunOptions, Bn as SmartAccountMethods, Bt as ActivityFilter, C as CurrentUserMethods, Cn as PaymentMoney, Ct as AccountMethods, D as MemberStatus, Dn as PaymentsMethods, Dt as ActorRequest, E as InviteMemberInput, En as PaymentType, Et as ActorRelationshipMethods, F as ResendInviteTokenInput, Fn as AccountLifecycle, Ft as InboxItem, G as PayrollGroupsMethods, Gn as ActorRef, Gt as ActivityPage, H as PayrollGroup, Hn as OrgLifecycle, Ht as ActivityKind, I as RoleDefinition, In as AccountSetupStep, It as InboxMethods, J as PayrollRun, Jn as SubmittedPermissionExecution, Jt as ActivitySummary, K as PayrollMethods, Kn as CurrentHoldings, Kt as ActivityRange, L as RoleSpendCap, Ln as isSettingUpLifecycle, Lt as ActivityAnnotation, M as OrgView, Mn as TargetReference, Mt as AddressBookLabelInput, N as OrganizationAccount, Nn as TargetsMethods, Nt as AddressBookMethods, O as MemberView, On as PaymentsPayInput, Ot as ActorRequestIssueInput, P as OrganizationAuditLogItem, Pn as fingerprintPaymentIntent, Pt as InboxApproveInput, Q as PayrollTermsUnit, Qn as PaymentStatus$1, Qt as DepositInstructions, R as RoleView, Rn as CompleteProfileInput, Rt as ActivityAnnotationInput, S as CurrentUserContext, Sn as PaymentDocumentsMethods, St as ReadyAccountLifecycle, T as DetectPendingOrgInvitationsResult, Tn as PaymentTiming, Tt as ActorProfileMethods, U as PayrollGroupInput, Un as OrgSetupStep, Ut as ActivityListParams, V as PayrollEngagementTerms, Vn as AuthMethods, Vt as ActivityItem, W as PayrollGroupMember, Wn as PayoutAddress, Wt as ActivityMethods, X as PayrollRunStatus, Xn as PAYMENT_DIRECTIONS, Xt as ActivitySummaryTotal, Y as PayrollRunItemInput, Yn as InboxStatus, Yt as ActivitySummaryParams, Z as PayrollRuns, Zn as PAYMENT_STATUSES, Zt as ActorReference, _ as HoldingsMethods, _n as PaymentDirection, _t as OnboardingMethods, a as ObservationContext, an as DestinationRemoveInput, ar as IdentityEvent, at as PermissionCreateInput, b as SystemHealth, bn as PaymentDocumentRender, bt as PersonOnboarding, c as HostObservability, cn as MeMethods, cr as Readiness, ct as PermissionReplaceInput, d as postHogObservability, dn as OfframpMethods, dr as isClaimed, dt as Budget, en as DestinationAddInput, et as OrganizationPaymentInput, f as CapxulClient, fn as OfframpQuote, fr as isRestoring, ft as OrgMe, g as IdentityRuntimeSendResult, gn as PaymentActivityEvidence, gt as CompletedPersonProfile, h as IdentityRuntime, hn as Payment, ht as AccountsMethods, i as ObservationAdapter, in as DestinationRail, ir as Destination$1, it as PermissionChangeInput, j as OrgTemplate, jn as ResolvedTarget, jt as AddressBookEntry, k as OrgMethods, kn as RecipientResolution, kt as ActorRequestsMethods, l as PostHogObservabilityClient, ln as MeProfile, lr as StateLabel, lt as PermissionRevokeInput, m as IdentityProfileDetails, mn as OfframpStatus, mr as InvocationControls, mt as OrgMeOptions, nn as DestinationListInput, nt as OrganizationPaymentsMethods, o as ObservationDelivery, on as DestinationsMethods, or as IdentityState, ot as PermissionMethods, p as CreateCapxulClientInput, pn as OfframpQuoteInput, pr as IdentityTransition, pt as OrgMeMethod, q as PayrollOptions, qn as Permission, qt as ActivityReference, r as CAPXUL_SDK_EXPECTED_OUTCOME_EVENT, rn as DestinationPayload, rr as TelemetryPort, rt as PermissionAssignInput, s as SdkFailureObservation, sn as FinancialOpsMethods, sr as OrgLane, st as PermissionOptions, t as CapxulClientInput, tn as DestinationKind, tt as OrganizationPaymentItemInput, u as PostHogObservabilityOptions, un as MovementActivityEvidence, ur as destination, ut as PermissionReadResult, v as Holding, vn as PaymentDocumentKind, vt as OrganizationOnboarding, w as CreateOrgInput, wn as PaymentStatus, wt as ActorProfile, x as MediaMethods, xn as PaymentDocumentVerification, xt as PersonOnboardingInput, y as SystemMethods, yn as PaymentDocumentRef, yt as OrganizationOnboardingInput, z as AuthorizeRunInput, zn as IdentityMethods, zt as ActivityDetail } from "./production-Du4Vc7YD.mjs";
 import { Hex } from "viem";
 import { Effect, Layer } from "effect";
 //#region ../errors/src/index.d.ts
@@ -7,6 +7,15 @@ import { Effect, Layer } from "effect";
 declare const HANDLE_RE: RegExp;
 //#endregion
 //#region ../config/src/tokens.d.ts
+/**
+ * Where a registry row's liquidity comes from. `settlement` is the tier the
+ * exact-transfer path and the Movement scanner read;
+ * `synthetic-test-liquidity` marks an owned fixture whose balances and rates
+ * are authored inputs, never market or provider data. Every row states its
+ * tier, so a row that reaches a caller through the registry always carries
+ * that fact with it.
+ */
+type AssetSource = "settlement" | "synthetic-test-liquidity";
 /** Canonical metadata. A missing peg does not imply a missing market price. */
 interface AssetMetadata {
   readonly assetId: AssetId;
@@ -16,6 +25,7 @@ interface AssetMetadata {
   readonly decimals: number;
   readonly peg: CurrencyCode | null;
   readonly deploymentStartBlock: number;
+  readonly source: AssetSource;
 }
 //#endregion
 //#region ../observability/src/operations.d.ts
@@ -60,6 +70,8 @@ declare const CAPXUL_OPERATIONS: {
     readonly emitAnnotationSaved: "activity.emitAnnotationSaved";
     readonly get: "activity.get";
     readonly list: "activity.list";
+    /** The SDK's live Activity read over the indexer's SSE stream. */
+    readonly subscribe: "activity.subscribe";
     readonly summary: "activity.summary";
   };
   readonly addressBook: {

package/dist/index.mjs

@@ -1,5 +1,5 @@
-import { A as signerFailure, B as isRestoring, C as normalizeExceptionErrorKind, E as safeExceptionLabel, F as CAPXUL_OPERATIONS, I as isCapxulOperation, L as normalizeCapxulOperation, M as PAYMENT_DIRECTIONS, N as PAYMENT_STATUSES, O as isSettingUpLifecycle, R as destination, S as SDK_VERSION, T as projectSdkException, _ as fingerprintPaymentIntent, b as failureDetail, d as embeddedSigner, f as openfortEmbeddedSigner, g as devPrivateKeySigner, h as deriveDevPrivateKey, j as resolveFailureMode, k as injectedWalletSigner, m as openfortEmbeddedWalletPort, p as openfortEmbeddedSignerFromWallet, r as postHogObservability, t as createCapxulClient$1, w as normalizeExceptionOperation, x as EXCEPTION_MESSAGE, y as CAPXUL_SDK_EXPECTED_OUTCOME_EVENT, z as isClaimed } from "./production-Y3yqeOSE.mjs";
-import { A as currencySymbolFor, J as toPartyId, M as toAddress, R as toCountryCode, T as EVM_ADDRESS_RE, W as toHandle, at as CapxulError, b as configuredMoneyAssetById, ct as isCapxulError, g as CAPXUL_PAYMENTS_V2_ADDRESS, it as CAPXUL_ERROR_CODES, k as assetIdFor, lt as CHAIN_UPSTREAMS, nt as HANDLE_RE, st as Errors, ut as FAILURE_MODES, z as toCurrencyCode } from "./OAuthBearerAuthClient-hPwtSpEf.mjs";
+import { A as signerFailure, B as isRestoring, C as normalizeExceptionErrorKind, E as safeExceptionLabel, F as CAPXUL_OPERATIONS, I as isCapxulOperation, L as normalizeCapxulOperation, M as PAYMENT_DIRECTIONS, N as PAYMENT_STATUSES, O as isSettingUpLifecycle, R as destination, S as SDK_VERSION, T as projectSdkException, _ as fingerprintPaymentIntent, b as failureDetail, d as embeddedSigner, f as openfortEmbeddedSigner, g as devPrivateKeySigner, h as deriveDevPrivateKey, j as resolveFailureMode, k as injectedWalletSigner, m as openfortEmbeddedWalletPort, p as openfortEmbeddedSignerFromWallet, r as postHogObservability, t as createCapxulClient$1, w as normalizeExceptionOperation, x as EXCEPTION_MESSAGE, y as CAPXUL_SDK_EXPECTED_OUTCOME_EVENT, z as isClaimed } from "./production-216hsAKc.mjs";
+import { A as currencySymbolFor, B as toCurrencyCode, G as toHandle, M as toAddress, T as EVM_ADDRESS_RE, Y as toPartyId, b as configuredMoneyAssetById, dt as CHAIN_UPSTREAMS, ft as FAILURE_MODES, g as CAPXUL_PAYMENTS_V2_ADDRESS, it as HANDLE_RE, k as assetIdFor, lt as Errors, ot as CAPXUL_ERROR_CODES, st as CapxulError, ut as isCapxulError, z as toCountryCode } from "./OAuthBearerAuthClient-IB2W1Fzj.mjs";
 import { formatUnits } from "viem";
 import { Effect } from "effect";
 import { privateKeyToAccount } from "viem/accounts";

package/dist/node/index.mjs

@@ -1,4 +1,4 @@
-import { M as toAddress, a as parseAuthSession, c as AuthCachePortTag, i as BrowserAuthCacheAdapter, o as parseCachedJwt, r as InMemoryAuthCacheAdapter, s as AuthCacheError, t as oauthBearerAuthClient } from "../OAuthBearerAuthClient-hPwtSpEf.mjs";
+import { M as toAddress, a as parseAuthSession, c as AuthCachePortTag, i as BrowserAuthCacheAdapter, o as parseCachedJwt, r as InMemoryAuthCacheAdapter, s as AuthCacheError, t as oauthBearerAuthClient } from "../OAuthBearerAuthClient-IB2W1Fzj.mjs";
 import { Effect, FileSystem, Layer, Path } from "effect";
 import { privateKeyToAccount } from "viem/accounts";
 import * as os from "node:os";

package/dist/{production-Y3yqeOSE.mjs → production-216hsAKc.mjs}

@@ -1,4 +1,4 @@
-import { $ as toSessionToken, B as toDurationMs, C as ASSET_ID_RE, D as WEI_RE, E as SUPPORTED_CURRENCY_CODES, F as toAuthUserId, G as toJwtToken, H as toEpochMs, I as toBudgetId, J as toPartyId, K as toKycTier, L as toChainId, M as toAddress, N as toAllowedOrigin, O as ZERO_BYTES32, Q as toRoleKey, R as toCountryCode, S as APP_ID_RE, St as redactUrlSecrets, T as EVM_ADDRESS_RE$1, U as toEpochSeconds, V as toEmail, W as toHandle, X as toPayrollRunId, Y as toPayrollGroupId, Z as toPublishableKey, _ as normalizeBindingEmail, _t as isFailureMode, at as CapxulError, bt as isCredentialField, c as AuthCachePortTag, ct as isCapxulError, d as authClientPortFromPromiseAdapter, dt as boundedResponseHeaders, et as toTesterKind, f as AuthClientError, ft as chainCauseProperties, gt as isChainUpstream, h as orgRoleKeyForLabel, ht as failureFingerprint, i as BrowserAuthCacheAdapter, it as CAPXUL_ERROR_CODES, j as toAccountId, l as SystemClockLayer, lt as CHAIN_UPSTREAMS, m as ADMIN_ROLE_LABEL, mt as decodeChainCause, ot as EXPECTED_OPERATION_OUTCOMES, p as AuthClientPortTag, pt as chainEvidenceLabel, q as toOrgId, r as InMemoryAuthCacheAdapter, rt as decodeConvexError, st as Errors, tt as validateHandle, u as ClockPortTag, ut as FAILURE_MODES$1, v as BASE_SEPOLIA_CHAIN_ID, vt as revertSummaryText, w as BYTES32_RE, x as ACCOUNT_ID_RE, xt as redactSecrets, y as deriveCapxulSafeAddress, yt as containsSensitiveMaterial, z as toCurrencyCode } from "./OAuthBearerAuthClient-hPwtSpEf.mjs";
+import { $ as toRoleKey, B as toCurrencyCode, C as ASSET_ID_RE, Ct as redactSecrets, D as WEI_RE, E as SUPPORTED_CURRENCY_CODES, F as toAssetId, G as toHandle, H as toEmail, I as toAuthUserId, J as toOrgId, K as toJwtToken, L as toBudgetId, M as toAddress, N as toAllowedOrigin, O as ZERO_BYTES32, Q as toPublishableKey, R as toChainId, S as APP_ID_RE, St as isCredentialField, T as EVM_ADDRESS_RE$1, U as toEpochMs, V as toDurationMs, W as toEpochSeconds, X as toPayrollGroupId, Y as toPartyId, Z as toPayrollRunId, _ as normalizeBindingEmail, _t as failureFingerprint, at as decodeConvexError, bt as revertSummaryText, c as AuthCachePortTag, ct as EXPECTED_OPERATION_OUTCOMES, d as authClientPortFromPromiseAdapter, dt as CHAIN_UPSTREAMS, et as toSessionToken, f as AuthClientError, ft as FAILURE_MODES$1, gt as decodeChainCause, h as orgRoleKeyForLabel, ht as chainEvidenceLabel, i as BrowserAuthCacheAdapter, j as toAccountId, l as SystemClockLayer, lt as Errors, m as ADMIN_ROLE_LABEL, mt as chainCauseProperties, nt as toTxHash, ot as CAPXUL_ERROR_CODES, p as AuthClientPortTag, pt as boundedResponseHeaders, q as toKycTier, r as InMemoryAuthCacheAdapter, rt as validateHandle, st as CapxulError, tt as toTesterKind, u as ClockPortTag, ut as isCapxulError, v as BASE_SEPOLIA_CHAIN_ID, vt as isChainUpstream, w as BYTES32_RE, wt as redactUrlSecrets, x as ACCOUNT_ID_RE, xt as containsSensitiveMaterial, y as deriveCapxulSafeAddress, yt as isFailureMode, z as toCountryCode } from "./OAuthBearerAuthClient-IB2W1Fzj.mjs";
 import { formatUnits, keccak256, parseUnits, recoverAddress, stringToHex, toBytes } from "viem";
 import { Cause, Clock, Context, Data, Deferred, Duration, Effect, Exit, Fiber, FiberSet, Layer, Option, Queue, Ref, Result, Schedule, Schema, SchemaGetter, SchemaIssue, SchemaParser, Scope, Stream, Tracer } from "effect";
 import { getFunctionName, makeFunctionReference } from "convex/server";
@@ -448,6 +448,8 @@ const CAPXUL_OPERATIONS = {
 		emitAnnotationSaved: "activity.emitAnnotationSaved",
 		get: "activity.get",
 		list: "activity.list",
+		/** The SDK's live Activity read over the indexer's SSE stream. */
+		subscribe: "activity.subscribe",
 		summary: "activity.summary"
 	},
 	addressBook: {
@@ -946,6 +948,17 @@ const AuthFailedProps = Schema.Struct({
 	auth_type: OptionalString,
 	reason: OptionalString
 });
+const IdentityRefusedProps = Schema.Struct({
+	...TelemetryEnvelopeProps,
+	/** The refused identity event tag, for example CreateOrganization. */
+	event: OptionalString,
+	/** The machine's refusal code: WRONG_STATE, SUPERSEDED or STALE_EPOCH. */
+	refusal_code: OptionalString,
+	/** The machine slot the request targeted, for example identity:org. */
+	slot: OptionalString,
+	/** The machine state at refusal, for example authenticated:claiming. */
+	state: OptionalString
+});
 const AuthSignedOutProps = Schema.Struct(TelemetryEnvelopeProps);
 const ProvisioningSafeCreatedProps = Schema.Struct({
 	...TelemetryEnvelopeProps,
@@ -1396,6 +1409,10 @@ Schema.Struct({
 	name: Schema.Literal("auth_failed"),
 	props: AuthFailedProps
 });
+Schema.Struct({
+	name: Schema.Literal("identity_refused"),
+	props: IdentityRefusedProps
+});
 Schema.Struct({
 	name: Schema.Literal("auth_signed_out"),
 	props: AuthSignedOutProps
@@ -2214,6 +2231,8 @@ const BootstrapEnvelope = Schema.Struct({
 		shieldPublishableKey: Schema.String,
 		/** Which Openfort third-party auth provider the signer presents; absent means better-auth. */
 		openfortAuthProvider: Schema.optional(Schema.Literals(["better-auth", "oidc"])),
+		/** Origin of the Ponder indexer the SDK reads directly; absent means no indexer reads. */
+		indexerUrl: Schema.optional(Schema.String),
 		engineeringTelemetry: Schema.optional(EngineeringTelemetryBootstrapPolicy)
 	})
 });
@@ -2288,6 +2307,7 @@ const CAPXUL_FUNCTIONS = {
 		prepareOrganizationPaymentExecution: "moneyExecution/paymentCommandActions:prepareOrganizationPaymentExecution",
 		submitPaymentCommandExecution: "moneyExecution/paymentCommandActions:submitPaymentCommandExecution"
 	},
+	"moneyExecution/providerSendWitness": { read: "moneyExecution/providerSendWitness:read" },
 	media: {
 		generateUploadUrl: "media:generateUploadUrl",
 		setOrgLogo: "media:setOrgLogo",
@@ -2347,6 +2367,11 @@ const CAPXUL_FUNCTIONS = {
 		loadByAuthUserId: "smartAccount/queries:loadByAuthUserId",
 		loadBySmartAccountAddress: "smartAccount/queries:loadBySmartAccountAddress"
 	},
+	e2eControls: {
+		holdUserOperationReceipt: "e2eControls:holdUserOperationReceipt",
+		isUserOperationReceiptHeld: "e2eControls:isUserOperationReceiptHeld",
+		releaseUserOperationReceipt: "e2eControls:releaseUserOperationReceipt"
+	},
 	system: { health: "system:health" }
 };
 //#endregion
@@ -5658,7 +5683,7 @@ const moneyExecutionContract = {
 };
 //#endregion
 //#region package.json
-var version = "4.2.0-rc.8";
+var version = "4.2.0-rc.9";
 //#endregion
 //#region src/telemetry/exception-projection.ts
 /** Fixed fallback for failures that have no safe message. */
@@ -5851,6 +5876,17 @@ function observeFailedResult(result, adapter, operation, origin) {
 	return result;
 }
 /**
+* @internal Reports a failure that can never become a method result.
+*
+* A reactive stream is torn down after its call already returned, so nothing
+* downstream observes it. `captureException` is the right kind: the caller did
+* not ask for the end, so it is not an expected product outcome.
+*/
+function observeStreamFailure(adapter, operation, cause) {
+	if (adapter === void 0) return;
+	report(adapter, "exception", operation, cause, resolveAdapterSnapshot(adapter));
+}
+/**
 * One failure, one event. The identity machine reports a failed transition
 * first; when the same `CapxulError` then surfaces as a public method result
 * (directly or down its `cause` chain), the boundary drops that second report.
@@ -8674,7 +8710,7 @@ function isTransientBootstrapFailure(error) {
 	const status = error.details?.httpStatus;
 	return typeof status === "number" && isTransientHttpStatus(status);
 }
-async function safeText(res) {
+async function safeText$1(res) {
 	try {
 		return await res.text();
 	} catch {
@@ -8748,6 +8784,7 @@ var HttpBootstrapAdapter = class {
 					openfortPublishableKey: decodedState.openfortPublishableKey,
 					shieldPublishableKey: decodedState.shieldPublishableKey,
 					...decodedState.openfortAuthProvider === void 0 ? {} : { openfortAuthProvider: decodedState.openfortAuthProvider },
+					...decodedState.indexerUrl === void 0 ? {} : { indexerUrl: decodedState.indexerUrl },
 					...decodedEngineeringTelemetry !== void 0 && Result.isSuccess(decodedEngineeringTelemetry) ? { engineeringTelemetry: decodedEngineeringTelemetry.success } : {}
 				};
 			},
@@ -8756,7 +8793,7 @@ var HttpBootstrapAdapter = class {
 				return bootstrapErrorFromCapxul("malformedBody", Errors.providerError("convex", "bootstrap", cause instanceof Error ? cause : new Error(String(cause))));
 			}
 		});
-		return Effect.promise(() => safeText(res)).pipe(Effect.flatMap((body) => {
+		return Effect.promise(() => safeText$1(res)).pipe(Effect.flatMap((body) => {
 			if (res.status === 401 || body.startsWith("NOT_AUTHENTICATED")) return Effect.fail(bootstrapErrorFromCapxul("notAuthenticated", Errors.notAuthenticated()));
 			if (res.status === 400 || body.startsWith("INVALID_INPUT")) return Effect.fail(bootstrapErrorFromCapxul("invalidInput", Errors.invalidInput("publishableKey", "rejected by bootstrap")));
 			const responseBody = body.slice(0, 300);
@@ -8986,6 +9023,12 @@ function makeConnectionId() {
 }
 //#endregion
 //#region src/adapters/convex-call/ConvexCallAdapter.ts
+/**
+* A socket that has not emitted `close` within this window is not going to.
+* ponytail: one fixed bound; `closeTimeoutMs` is the knob if a slow runtime
+* ever needs a different one.
+*/
+const DEFAULT_CLOSE_TIMEOUT_MS = 5e3;
 /** Exact floor-first allowlist; every additional handler must migrate its validator first. */
 const OBSERVED_CONVEX_ACTIONS = /* @__PURE__ */ new Set([
 	"payroll/actions:authorizeRun",
@@ -9054,7 +9097,9 @@ var ConvexCallAdapter = class {
 	#applicationId;
 	#observation;
 	#connectionMonitor;
+	#closeTimeoutMs;
 	constructor(deps) {
+		this.#closeTimeoutMs = deps.closeTimeoutMs ?? DEFAULT_CLOSE_TIMEOUT_MS;
 		this.#connectionMonitor = new ConvexConnectionMonitor();
 		const webSocketConstructor = this.#connectionMonitor.observedWebSocketConstructor();
 		this.#client = deps.client ?? new ConvexClient(deps.convexUrl, webSocketConstructor === void 0 ? {} : { webSocketConstructor });
@@ -9153,11 +9198,33 @@ var ConvexCallAdapter = class {
 			callback({ status: "loading" });
 		})));
 	}
+	/**
+	* Teardown always completes. `ConvexClient.close()` resolves only when the
+	* socket emits `close`, and `WebSocketManager.close()` in the `connecting`
+	* state arms `ws.onopen = () => ws.close()` without ever closing the socket
+	* itself — so a handshake that stalls right after a server-initiated close
+	* (code 1012, which is what a Convex deploy sends) leaves that promise
+	* pending for as long as the page lives. Convex marks the client closed and
+	* terminates the socket manager synchronously before returning it, so
+	* abandoning it drops nothing. A rejection is dropped for the same reason —
+	* the layer release turns it into a defect that fails the whole scope close,
+	* and teardown has no caller who can act on it.
+	*/
 	async close() {
 		this.#connectionMonitor.close();
-		await this.#client.close();
+		await settledWithin(this.#client.close(), this.#closeTimeoutMs);
 	}
 };
+function settledWithin(promise, timeoutMs) {
+	return new Promise((resolve) => {
+		const timer = setTimeout(resolve, timeoutMs);
+		const finish = () => {
+			clearTimeout(timer);
+			resolve();
+		};
+		promise.then(finish, finish);
+	});
+}
 function ConvexCallLayer(deps) {
 	return Layer.effect(ConvexCallPortTag, Effect.acquireRelease(Effect.sync(() => new ConvexCallAdapter(deps)), (adapter) => Effect.promise(() => adapter.close()).pipe(Effect.orDie)));
 }
@@ -13338,11 +13405,28 @@ const authFailure = (record, reason, mode) => ({
 		...linkage(record)
 	}
 });
+const REFUSAL_EVENTS = /* @__PURE__ */ new Set([
+	"ClaimAccount",
+	"RetryAccount",
+	"CreateOrganization",
+	"AttachOrganization",
+	"RetryOrganization"
+]);
 function mapIdentityProductObservation(record, state) {
 	if (record.machine !== "identity" || !IDENTITY_EVENT_TAG_SET.has(record.event)) return NONE;
 	if (record.outcome === "cancelled") return NONE;
 	if (record.slot === "identity:auth" && record.outcome === "refused") return authFailure(record, record.refusal_code, void 0);
 	if (record.slot === "identity:auth" && record.outcome === "failed") return authFailure(record, record.error_code, record.failure?.mode);
+	if (record.outcome === "refused" && REFUSAL_EVENTS.has(record.event)) return {
+		name: "identity_refused",
+		props: {
+			event: record.event,
+			refusal_code: record.refusal_code,
+			slot: record.slot,
+			state: record.state,
+			...linkage(record)
+		}
+	};
 	if (record.outcome !== "applied") return NONE;
 	switch (APPLIED_ACTION_BY_EVENT[record.event]) {
 		case "none": return NONE;
@@ -13668,6 +13752,7 @@ function assembleCapxulClient(input) {
 			identity: identityRuntime,
 			bootstrap: input.bootstrap,
 			accounts: { fund: accounts.fund },
+			...input.ports.indexerRead === void 0 ? {} : { indexer: input.ports.indexerRead },
 			organizationSetup: { getProofReceipt: (orgId) => runPortEffect(input.ports.convexCall.query(organizationSetupProofReceiptQuery, { orgId })) },
 			telemetry: input.ports.telemetry,
 			captureExternalAddressAcknowledged: (address, organizationId) => {
@@ -13869,6 +13954,382 @@ function snapshotHostObservability(observability) {
 function isPromiseLike(value) {
 	return (typeof value === "object" && value !== null || typeof value === "function") && "then" in value;
 }
+//#endregion
+//#region src/ports/indexer-read.ts
+/** The indexer's own page bound. Exceeding it is a caller defect, not a refusal. */
+const INDEXER_MAX_LIMIT = 1e3;
+const LOWER_CASE_ADDRESS = /^0x[0-9a-f]{40}$/;
+/**
+* Refuse a page the indexer would refuse, before any implementation spends a
+* round trip on it. Every implementation calls this, so a consumer test written
+* against the hermetic adapter cannot pass on input production rejects. Throws
+* a `CapxulError`; callers convert it to an `IndexerReadError`.
+*/
+function assertIndexerPage(input) {
+	const safe = String(input.safe).toLowerCase();
+	if (!LOWER_CASE_ADDRESS.test(safe)) throw Errors.invalidInput("safe", "must be a lower-case EVM address");
+	if (!Number.isSafeInteger(input.limit) || input.limit < 1 || input.limit > 1e3) throw Errors.invalidInput("limit", `must be an integer from 1 to ${INDEXER_MAX_LIMIT}`);
+	const offset = input.offset ?? 0;
+	if (!Number.isSafeInteger(offset) || offset < 0) throw Errors.invalidInput("offset", "must be a non-negative integer");
+	return safe;
+}
+var IndexerReadError = class extends Data.TaggedError("IndexerReadError") {};
+function indexerReadErrorFromCapxul(operation, error, cause = error) {
+	return new IndexerReadError({
+		operation,
+		publicCode: error.code,
+		publicError: error,
+		cause,
+		...error.details === void 0 ? {} : { details: error.details }
+	});
+}
+Context.Service()("@capxul/sdk/ports/IndexerReadPort");
+//#endregion
+//#region src/adapters/ponder/decode.ts
+/**
+* Decode the indexer's rows at the trust boundary.
+*
+* Ponder returns the raw PostgreSQL result: `integer` arrives as a number,
+* `numeric(78)` and `text` arrive as strings. Amounts, block numbers and
+* timestamps are `numeric(78)`, so they become `bigint` here and never pass
+* through `Number`. Every decoder throws a `CapxulError`; the adapter turns
+* that into a typed `IndexerReadError`.
+*/
+const HEX = /^0x[0-9a-fA-F]+$/;
+function field(row, key) {
+	if (!(key in row)) throw Errors.invalidInput(key, "missing from the indexer row");
+	return row[key];
+}
+function text(row, key) {
+	const value = field(row, key);
+	if (typeof value !== "string") throw Errors.invalidInput(key, "must be a string");
+	return value;
+}
+function hex(row, key) {
+	const value = text(row, key);
+	if (!HEX.test(value)) throw Errors.invalidInput(key, "must be a hex string");
+	return value.toLowerCase();
+}
+function integer(row, key) {
+	const value = field(row, key);
+	const parsed = typeof value === "string" ? Number(value) : value;
+	if (typeof parsed !== "number" || !Number.isSafeInteger(parsed)) throw Errors.invalidInput(key, "must be an integer");
+	return parsed;
+}
+/** `numeric(78)` crosses the wire as a decimal string; keep every digit. */
+function big(row, key) {
+	const value = field(row, key);
+	if (typeof value === "bigint") return value;
+	const raw = typeof value === "number" ? String(value) : value;
+	if (typeof raw !== "string" || !/^-?[0-9]+$/.test(raw)) throw Errors.invalidInput(key, "must be an exact integer amount");
+	return BigInt(raw);
+}
+function asRow(value) {
+	if (typeof value !== "object" || value === null || Array.isArray(value)) throw Errors.invalidInput("row", "must be an object");
+	return value;
+}
+function identity(row) {
+	return {
+		id: text(row, "id"),
+		chainId: toChainId(integer(row, "chain_id")),
+		txHash: toTxHash(hex(row, "tx_hash")),
+		transactionLogOrdinal: integer(row, "transaction_log_ordinal"),
+		blockNumber: big(row, "block_number"),
+		blockHash: hex(row, "block_hash"),
+		timestamp: big(row, "timestamp")
+	};
+}
+function decodeTransfer(value) {
+	const row = asRow(value);
+	return {
+		...identity(row),
+		assetId: toAssetId(text(row, "asset_id")),
+		token: toAddress(hex(row, "token")),
+		from: toAddress(hex(row, "from")),
+		to: toAddress(hex(row, "to")),
+		amount: big(row, "amount")
+	};
+}
+function decodePayment(value) {
+	const row = asRow(value);
+	return {
+		...identity(row),
+		contract: toAddress(hex(row, "contract")),
+		settlementId: hex(row, "settlement_id"),
+		sender: toAddress(hex(row, "sender")),
+		recipient: toAddress(hex(row, "recipient")),
+		assetId: toAssetId(text(row, "asset_id")),
+		token: toAddress(hex(row, "token")),
+		amount: big(row, "amount"),
+		kind: integer(row, "kind"),
+		documentHash: hex(row, "document_hash")
+	};
+}
+/** The `balance` view exposes the signed sum under the underlying column name `to`. */
+function decodeBalance(value) {
+	const row = asRow(value);
+	return {
+		chainId: toChainId(integer(row, "chain_id")),
+		assetId: toAssetId(text(row, "asset_id")),
+		address: toAddress(hex(row, "to")),
+		amount: big(row, "amount")
+	};
+}
+const DECODERS = {
+	transfer: decodeTransfer,
+	payment: decodePayment,
+	balance: decodeBalance
+};
+/** Decode one `/sql/db` or `/sql/live` payload. Ponder returns `{ rows: [...] }`. */
+function decodeRows(table, body) {
+	const rows = asRow(body).rows;
+	if (!Array.isArray(rows)) throw Errors.invalidInput("rows", "must be an array");
+	const decode = DECODERS[table];
+	return rows.map(decode);
+}
+/** Decode Ponder's native `/status`: `{ [chainName]: { id, block: { number, timestamp } } }`. */
+function decodeStatus(body) {
+	const chains = asRow(body);
+	return Object.entries(chains).map(([chain, value]) => {
+		const entry = asRow(value);
+		const block = asRow(field(entry, "block"));
+		return {
+			chain,
+			chainId: toChainId(integer(entry, "id")),
+			blockNumber: big(block, "number"),
+			blockTimestamp: big(block, "timestamp")
+		};
+	});
+}
+//#endregion
+//#region src/adapters/ponder/statements.ts
+/**
+* The exact statements the indexer accepts.
+*
+* `apps/indexer/src/queries.ts` compiles its allowlist with `@ponder/client`
+* and compares `sql`, `params` and `typings` byte for byte against the caller's
+* statement. Anything else gets 403. The SDK therefore reproduces the compiled
+* text here rather than pulling Ponder and Drizzle into a published browser
+* bundle to regenerate three fixed statements.
+*
+* `statements.test.ts` pins the text. When the indexer schema or a query in
+* that allowlist changes, this file changes with it or every read fails 403.
+*/
+const HEADS = {
+	transfer: "select \"id\", \"chain_id\", \"tx_hash\", \"transaction_log_ordinal\", \"block_number\", \"block_hash\", \"timestamp\", \"asset_id\", \"token\", \"from\", \"to\", \"amount\" from \"transfer\" where (\"transfer\".\"from\" = $1 or \"transfer\".\"to\" = $2) order by \"transfer\".\"block_number\" desc, \"transfer\".\"id\" desc",
+	payment: "select \"id\", \"chain_id\", \"tx_hash\", \"transaction_log_ordinal\", \"block_number\", \"block_hash\", \"timestamp\", \"contract\", \"settlement_id\", \"sender\", \"recipient\", \"asset_id\", \"token\", \"amount\", \"kind\", \"document_hash\" from \"payment\" where (\"payment\".\"sender\" = $1 or \"payment\".\"recipient\" = $2) order by \"payment\".\"block_number\" desc, \"payment\".\"id\" desc",
+	balance: "select \"chain_id\", \"asset_id\", \"to\", \"amount\" from \"balance\" where \"balance\".\"to\" = $1"
+};
+/** How many times the statement binds the Safe address. */
+const ACTOR_PARAMS = {
+	transfer: 2,
+	payment: 2,
+	balance: 1
+};
+/**
+* Build the compiled query for one table and page. Throws a `CapxulError` for
+* a page or address the indexer would refuse, so the caller never spends a
+* round trip to learn it built the request wrong.
+*/
+function ponderQuery(table, input) {
+	const safe = assertIndexerPage(input);
+	const offset = input.offset ?? 0;
+	const actors = ACTOR_PARAMS[table];
+	const params = [];
+	for (let i = 0; i < actors; i++) params.push(safe);
+	params.push(input.limit);
+	let sql = `${HEADS[table]} limit $${actors + 1}`;
+	if (offset > 0) {
+		params.push(offset);
+		sql = `${sql} offset $${actors + 2}`;
+	}
+	return {
+		sql,
+		params,
+		typings: params.map(() => "none")
+	};
+}
+/**
+* The `?sql=` value. `@ponder/client` sends `superjson.stringify(query)`; for a
+* payload of strings and numbers superjson emits no `meta`, so the wire form is
+* exactly this envelope.
+*/
+function ponderQueryParam(query) {
+	return JSON.stringify({ json: query });
+}
+//#endregion
+//#region src/adapters/ponder/sse.ts
+/**
+* The smallest SSE reader that can carry an `Authorization` header.
+*
+* `@ponder/client` opens its live query with `EventSource`, which accepts no
+* headers, so it cannot reach the guarded indexer at all. The indexer's CORS
+* policy allows exactly one request header (`Authorization`), so this reader
+* sends nothing else. Ponder writes one `data:` line per frame.
+*/
+async function readEventStream(body, onData, stopped) {
+	const reader = body.getReader();
+	const decoder = new TextDecoder();
+	let buffer = "";
+	try {
+		for (;;) {
+			const { done, value } = await reader.read();
+			if (done || stopped()) return;
+			buffer += decoder.decode(value, { stream: true });
+			let split = buffer.indexOf("\n\n");
+			while (split !== -1) {
+				const frame = buffer.slice(0, split);
+				buffer = buffer.slice(split + 2);
+				const data = frameData(frame);
+				if (data !== void 0) onData(data);
+				if (stopped()) return;
+				split = buffer.indexOf("\n\n");
+			}
+		}
+	} finally {
+		await reader.cancel().catch(() => void 0);
+	}
+}
+function frameData(frame) {
+	const lines = [];
+	for (const line of frame.split("\n")) {
+		if (!line.startsWith("data:")) continue;
+		lines.push(line.slice(line.startsWith("data: ") ? 6 : 5));
+	}
+	return lines.length === 0 ? void 0 : lines.join("\n");
+}
+//#endregion
+//#region src/adapters/ponder/PonderIndexerAdapter.ts
+var PonderIndexerAdapter = class {
+	#baseUrl;
+	#token;
+	#fetch;
+	#observation;
+	constructor(deps) {
+		this.#baseUrl = deps.baseUrl.replace(/\/$/, "");
+		this.#token = deps.token;
+		this.#observation = deps.observation;
+		this.#fetch = deps.fetch ?? ((input, init) => globalThis.fetch(input, init));
+	}
+	read(table, input) {
+		const operation = `indexer.read.${table}`;
+		return Effect.tryPromise({
+			try: async () => {
+				return decodeRows(table, await (await this.#request("db", table, input, operation)).json());
+			},
+			catch: (cause) => toIndexerReadError(operation, cause)
+		});
+	}
+	subscribe(table, input, callback) {
+		const operation = CAPXUL_OPERATIONS.activity.subscribe;
+		return Effect.sync(() => {
+			let stopped = false;
+			const unsubscribe = () => {
+				stopped = true;
+			};
+			callback({ status: "loading" });
+			this.#stream(table, input, operation, callback, () => stopped).catch(() => void 0);
+			return unsubscribe;
+		});
+	}
+	status = Effect.tryPromise({
+		try: async () => {
+			const response = await this.#fetch(`${this.#baseUrl}/status`, { method: "GET" });
+			if (!response.ok) throw httpError("indexer.status", response.status, await safeText(response));
+			return decodeStatus(await response.json());
+		},
+		catch: (cause) => toIndexerReadError("indexer.status", cause)
+	});
+	/** One authenticated `/sql/:method` call. Throws a `CapxulError` on refusal. */
+	async #request(method, table, input, operation) {
+		const query = ponderQuery(table, input);
+		const token = await this.#token({ forceRefreshToken: false });
+		if (token === null || token === "") throw Errors.notAuthenticated();
+		const url = `${this.#baseUrl}/sql/${method}?sql=${encodeURIComponent(ponderQueryParam(query))}`;
+		const headers = { authorization: `Bearer ${token}` };
+		if (method === "live") headers.accept = "text/event-stream";
+		let response;
+		try {
+			response = await this.#fetch(url, {
+				method: "GET",
+				headers
+			});
+		} catch (cause) {
+			throw Errors.networkError(operation, cause, {
+				provider: "indexer",
+				failure_mode: "upstream-down"
+			});
+		}
+		if (!response.ok) throw httpError(operation, response.status, await safeText(response));
+		return response;
+	}
+	/**
+	* Follow the live stream until the caller unsubscribes or the indexer closes
+	* it. The indexer closes the stream on token expiry or revoked authority
+	* with no frame, so any end the caller did not ask for is a teardown: it
+	* reaches `captureException` under `activity.subscribe` and the caller sees
+	* one `error` snapshot.
+	*/
+	async #stream(table, input, operation, callback, stopped) {
+		let failure;
+		try {
+			const response = await this.#request("live", table, input, operation);
+			if (response.body === null) throw Errors.providerError("indexer", operation, "empty stream");
+			await readEventStream(response.body, (data) => {
+				try {
+					callback({
+						status: "ok",
+						value: decodeRows(table, JSON.parse(data))
+					});
+				} catch (cause) {
+					failure = toPublicError$1(operation, cause);
+				}
+			}, () => stopped() || failure !== void 0);
+		} catch (cause) {
+			failure = toPublicError$1(operation, cause);
+		}
+		if (stopped()) return;
+		const error = failure ?? Errors.capabilityUnavailable("indexer", operation);
+		observeStreamFailure(this.#observation, CAPXUL_OPERATIONS.activity.subscribe, error);
+		callback({
+			status: "error",
+			error
+		});
+	}
+};
+/**
+* Map an indexer refusal into the shared error vocabulary.
+*
+* 401 is the expected outcome of an expired or revoked session. 403 is not:
+* the indexer accepts only its own compiled statements for a Safe in the
+* claim, so a refusal means this SDK and that deployment disagree, or the
+* session gained a Safe and still holds the older token. Both must be loud.
+*/
+function httpError(operation, status, body) {
+	if (status === 401) return Errors.notAuthenticated();
+	if (status === 429) return Errors.rateLimited({ resource: "indexer" });
+	if (status === 503) return Errors.capabilityUnavailable("indexer", operation);
+	return Errors.providerError("indexer", operation, body, {
+		httpStatus: status,
+		...status >= 500 ? { failure_mode: "upstream-down" } : {},
+		details: { reason: status === 403 ? "scope-refused" : "http-status" }
+	});
+}
+function toPublicError$1(operation, cause) {
+	if (cause instanceof CapxulError) return cause;
+	return Errors.providerError("indexer", operation, cause);
+}
+function toIndexerReadError(operation, cause) {
+	if (cause instanceof IndexerReadError) return cause;
+	return indexerReadErrorFromCapxul(operation, toPublicError$1(operation, cause), cause);
+}
+async function safeText(response) {
+	try {
+		return await response.text();
+	} catch {
+		return "";
+	}
+}
 const SDK_VERSION = version;
 /**
 * Project the built graph into the flat `FlowPorts` record the method bundles
@@ -14118,7 +14579,16 @@ async function createProductionAdapters(input) {
 		}));
 		const applicationLayer = Layer.merge(portsLayer, optionalEngineeringTelemetryLayer(bootstrapResult.value.engineeringTelemetry, resolvedInput.value.runtime));
 		const context = await Effect.runPromise(Layer.buildWithScope(applicationLayer, scope));
-		const ports = await Effect.runPromise(collectProductionFlowPorts.pipe(Effect.provide(context)));
+		const collected = await Effect.runPromise(collectProductionFlowPorts.pipe(Effect.provide(context)));
+		const indexerUrl = input.indexerUrl ?? bootstrapResult.value.indexerUrl;
+		const indexerRead = productionIndexerReadPort(indexerUrl === void 0 ? input : {
+			...input,
+			indexerUrl
+		}, collected, observation);
+		const ports = indexerRead === void 0 ? collected : {
+			...collected,
+			indexerRead
+		};
 		const stopConnectionObservation = observeProductionConvexConnection(ports.convexCall, context);
 		const close = idempotentClose(async () => {
 			try {
@@ -14450,5 +14920,27 @@ function idempotentClose(close) {
 		await close();
 	};
 }
+/**
+* Build the Ponder read port for this client, or `undefined` when no indexer
+* origin was supplied. The token provider is the same
+* `AuthClientPort.getConvexJwt` closure `ConvexCallPort` uses, so the indexer
+* and Convex see one session with one scope.
+*/
+function productionIndexerReadPort(input, ports, observation) {
+	if (input.indexerUrl === void 0 || input.indexerUrl === "") return void 0;
+	return new PonderIndexerAdapter({
+		baseUrl: normalizeHttpUrl("indexerUrl", input.indexerUrl),
+		token: async ({ forceRefreshToken }) => {
+			const token = await Effect.runPromise(Effect.result(ports.authClient.getConvexJwt({
+				forceRefresh: forceRefreshToken,
+				...input.signal === void 0 ? {} : { signal: input.signal }
+			})));
+			if (Result.isFailure(token)) return null;
+			return String(token.success.token);
+		},
+		...input.fetch === void 0 ? {} : { fetch: input.fetch },
+		...observation === void 0 ? {} : { observation }
+	});
+}
 //#endregion
 export { signerFailure as A, isRestoring as B, normalizeExceptionErrorKind as C, fromWei as D, safeExceptionLabel as E, CAPXUL_OPERATIONS as F, isCapxulOperation as I, normalizeCapxulOperation as L, PAYMENT_DIRECTIONS as M, PAYMENT_STATUSES as N, isSettingUpLifecycle as O, redactTelemetryEvent as P, destination as R, SDK_VERSION$1 as S, projectSdkException as T, fingerprintPaymentIntent as _, smartAccountErrorFromCapxul as a, failureDetail as b, identityErrorFromCapxul as c, embeddedSigner as d, openfortEmbeddedSigner as f, devPrivateKeySigner as g, deriveDevPrivateKey as h, assembleCapxulClient as i, resolveFailureMode as j, injectedWalletSigner as k, convexCallErrorFromCapxul as l, openfortEmbeddedWalletPort as m, createCapxulClientWithSignerControls as n, accountReadErrorFromCapxul as o, openfortEmbeddedSignerFromWallet as p, postHogObservability as r, wireChainId as s, createCapxulClient as t, bootstrapErrorFromCapxul as u, toWei as v, normalizeExceptionOperation as w, EXCEPTION_MESSAGE as x, CAPXUL_SDK_EXPECTED_OUTCOME_EVENT as y, isClaimed as z };

package/dist/{production-BOMKT0n7.d.mts → production-Du4Vc7YD.d.mts}

@@ -1,4 +1,4 @@
-import { $ as PayrollGroupId, A as AllowanceKey, B as ChainId, C as AuthCachePort, D as Account$1, Et as FailureMode, H as CurrencyCode, I as AuthSession, K as Email, L as AuthUserId, M as AnonymousDistinctId, N as AppId, Q as PaymentCommandId, R as BlockNumber, U as DocumentHash, V as CountryCode, W as DurationMs, X as OrgId, Y as Money, Z as PartyId, _ as Session$1, _t as CapxulErrorCode, at as RoleKey, b as AuthClientPort, bt as Failure, ct as TesterKind, d as AccountRequirement, et as PayrollRunId, g as Profile$1, gt as CapxulError, h as CapxulResult, i as CapxulSigner, it as PublishableKey, j as AllowedOrigin, k as Address$1, lt as TxHash, nt as PermissionId, ot as SessionToken, q as EpochMs, rt as Profile, s as SignerStatusStore, st as SmartAccount, tt as PermissionAssignmentId, u as AccountProviderSource, ut as WeiAmount, v as SmartAccount$1, vt as CapxulErrorDetails, x as CanSendOtpStatus, y as ClockPort, z as BudgetId } from "./OAuthBearerAuthClient-C-ip-z8M.mjs";
+import { $ as PayrollGroupId, A as AllowanceKey, B as ChainId, C as AuthCachePort, D as Account$1, Et as FailureMode, F as AssetId, H as CurrencyCode, I as AuthSession, K as Email, L as AuthUserId, M as AnonymousDistinctId, N as AppId, Q as PaymentCommandId, R as BlockNumber, U as DocumentHash, V as CountryCode, W as DurationMs, X as OrgId, Y as Money, Z as PartyId, _ as Session$1, _t as CapxulErrorCode, at as RoleKey, b as AuthClientPort, bt as Failure, ct as TesterKind, d as AccountRequirement, et as PayrollRunId, g as Profile$1, gt as CapxulError, h as CapxulResult, i as CapxulSigner, it as PublishableKey, j as AllowedOrigin, k as Address$1, lt as TxHash, nt as PermissionId, ot as SessionToken, q as EpochMs, rt as Profile, s as SignerStatusStore, st as SmartAccount, tt as PermissionAssignmentId, u as AccountProviderSource, ut as WeiAmount, v as SmartAccount$1, vt as CapxulErrorDetails, x as CanSendOtpStatus, y as ClockPort, z as BudgetId } from "./OAuthBearerAuthClient-C-ip-z8M.mjs";
 import { Hex } from "viem";
 import { Context, Effect, Layer, Schema, Scope, Tracer } from "effect";
 import { FunctionReference } from "convex/server";
@@ -284,7 +284,7 @@ interface TelemetryPort {
 }
 //#endregion
 //#region ../observability/src/index.d.ts
-declare const TELEMETRY_EVENT_NAMES: readonly ["auth_otp_requested", "auth_otp_delivered", "auth_otp_expired", "auth_verified", "auth_failed", "auth_signed_out", "onboarding_intent_selected", "onboarding_profile_submitted", "onboarding_organization_submitted", "onboarding_dashboard_reached", "provisioning_safe_created", "provisioning_safe_confirmed", "bootstrap_resolved", "bootstrap_failed", "member_activation_started", "member_activation_ready", "member_activation_failed", "organization_creation_started", "organization_creation_ready", "organization_creation_failed", "chain_upstream_fallback", "bundler_error", "receipt_pending", "operation_retried", "account_balance_read", "account_balance_failed", "faucet_requested", "faucet_confirmed", "faucet_failed", "org_create_started", "org_safe_created", "org_safe_confirmed", "org_roles_seeded", "org_created", "org_create_failed", "org_invite_sent", "org_invite_accepted", "org_invite_expired", "payment_initiated", "payment_settled", "payment_failed", "payment_verification_retry", "payment_lifecycle_transition", "quick_pay_external_address_acknowledged", "deposit_initiated", "deposit_settled", "permission_mirror_verification", "movement_scan_window", "movement_scan_checkpoint", "movement_scan_incident", "activity_annotation_saved", "ui_activity_action_completed", "contact_relationship_changed", "ui_contact_action_completed", "access_recovery_completed", "ui_access_step_completed", "org_invite_progressed", "invoice_issued", "invoice_request_transitioned", "ui_invoice_step_completed", "ui_treasury_step_completed", "ui_receive_step_completed", "payroll_group_changed", "payroll_run_transitioned", "ui_payroll_action_completed"];
+declare const TELEMETRY_EVENT_NAMES: readonly ["auth_otp_requested", "auth_otp_delivered", "auth_otp_expired", "auth_verified", "auth_failed", "identity_refused", "auth_signed_out", "onboarding_intent_selected", "onboarding_profile_submitted", "onboarding_organization_submitted", "onboarding_dashboard_reached", "provisioning_safe_created", "provisioning_safe_confirmed", "bootstrap_resolved", "bootstrap_failed", "member_activation_started", "member_activation_ready", "member_activation_failed", "organization_creation_started", "organization_creation_ready", "organization_creation_failed", "chain_upstream_fallback", "bundler_error", "receipt_pending", "operation_retried", "account_balance_read", "account_balance_failed", "faucet_requested", "faucet_confirmed", "faucet_failed", "org_create_started", "org_safe_created", "org_safe_confirmed", "org_roles_seeded", "org_created", "org_create_failed", "org_invite_sent", "org_invite_accepted", "org_invite_expired", "payment_initiated", "payment_settled", "payment_failed", "payment_verification_retry", "payment_lifecycle_transition", "quick_pay_external_address_acknowledged", "deposit_initiated", "deposit_settled", "permission_mirror_verification", "movement_scan_window", "movement_scan_checkpoint", "movement_scan_incident", "activity_annotation_saved", "ui_activity_action_completed", "contact_relationship_changed", "ui_contact_action_completed", "access_recovery_completed", "ui_access_step_completed", "org_invite_progressed", "invoice_issued", "invoice_request_transitioned", "ui_invoice_step_completed", "ui_treasury_step_completed", "ui_receive_step_completed", "payroll_group_changed", "payroll_run_transitioned", "ui_payroll_action_completed"];
 type TelemetryEventName = (typeof TELEMETRY_EVENT_NAMES)[number];
 type TelemetryProps = Record<string, unknown>;
 type TelemetryEvent = {
@@ -613,6 +613,8 @@ type BootstrapResolution = {
   readonly shieldPublishableKey: string;
   /** Openfort third-party auth provider the signer presents; absent means better-auth. */
   readonly openfortAuthProvider?: "better-auth" | "oidc";
+  /** Origin of the Ponder indexer the SDK reads directly; absent means no indexer reads. */
+  readonly indexerUrl?: string;
   readonly engineeringTelemetry?: EngineeringTelemetryBootstrapPolicyV1;
 };
 type BootstrapErrorKind = "notAuthenticated" | "network" | "provider" | "malformedBody" | "invalidInput" | "rateLimited";
@@ -906,6 +908,118 @@ interface AccountReadPort {
   fundFromFaucet(input: FundFromFaucetInput): Effect.Effect<FundFromFaucetResult, AccountReadError, never>;
 }
 //#endregion
+//#region src/ports/indexer-read.d.ts
+/**
+ * IndexerReadPort is the SDK's read seam onto the Ponder read model
+ * (`apps/indexer`). Ponder holds what the chain said; Convex holds what the
+ * user meant. Nothing here is copied into Convex, nothing waits for a
+ * finality tag, and no write path may read through this port.
+ *
+ * Every read is scoped to one Safe and one page. The indexer accepts only the
+ * exact compiled statements in `apps/indexer/src/queries.ts`, so the adapter
+ * that implements this port reproduces those statements byte for byte and the
+ * service refuses anything else with 403.
+ */
+/** One page of rows for one Safe. `offset` defaults to 0 (the first page). */
+interface IndexerReadInput {
+  /** The Safe the caller owns. The indexer refuses a Safe outside the session claim. */
+  readonly safe: Address$1;
+  /** 1 to 1000 inclusive — the indexer's own bound. */
+  readonly limit: number;
+  readonly offset?: number;
+}
+/**
+ * The chain evidence every indexed row carries. `id` is the logical event id
+ * `chainId:txHash:transactionLogOrdinal`; it survives a reorg, so it is the
+ * key a Convex intent row stitches against.
+ */
+interface IndexerEventIdentity {
+  readonly id: string;
+  readonly chainId: ChainId;
+  readonly txHash: TxHash;
+  readonly transactionLogOrdinal: number;
+  readonly blockNumber: bigint;
+  readonly blockHash: string;
+  /** Block timestamp in epoch seconds. */
+  readonly timestamp: bigint;
+}
+interface IndexerTransferRow extends IndexerEventIdentity {
+  readonly assetId: AssetId;
+  readonly token: Address$1;
+  readonly from: Address$1;
+  readonly to: Address$1;
+  /**
+   * Raw token units, exact. This is an evidence boundary, so the row never
+   * carries Money or AssetAmount: the reader owns the asset's decimals.
+   */
+  readonly amount: bigint;
+}
+interface IndexerPaymentRow extends IndexerEventIdentity {
+  readonly contract: Address$1;
+  /** The protocol settlement id a Convex Payment command stitches against. */
+  readonly settlementId: string;
+  readonly sender: Address$1;
+  readonly recipient: Address$1;
+  readonly assetId: AssetId;
+  readonly token: Address$1;
+  /** Raw token units, exact. */
+  readonly amount: bigint;
+  readonly kind: number;
+  readonly documentHash: string;
+}
+/** A row of the indexer's signed-transfer `balance` view. */
+interface IndexerBalanceRow {
+  readonly chainId: ChainId;
+  readonly assetId: AssetId;
+  readonly address: Address$1;
+  /** Raw token units, exact. */
+  readonly amount: bigint;
+}
+/** One chain's sync position, from the indexer's native `/status` route. */
+interface IndexerChainStatus {
+  readonly chain: string;
+  readonly chainId: ChainId;
+  readonly blockNumber: bigint;
+  /** Block timestamp in epoch seconds. Its age is the freshness label. */
+  readonly blockTimestamp: bigint;
+}
+/**
+ * The tables this seam reads today. P04 adds the authority rows (`safe`,
+ * `safe_event`, `roles_module`) and P05 adds `commitment`: each is one more
+ * entry here plus its statement and decoder.
+ */
+interface IndexerRowsByTable {
+  readonly transfer: readonly IndexerTransferRow[];
+  readonly payment: readonly IndexerPaymentRow[];
+  readonly balance: readonly IndexerBalanceRow[];
+}
+type IndexerTable = keyof IndexerRowsByTable;
+declare const IndexerReadError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+  readonly _tag: "IndexerReadError";
+} & Readonly<A>;
+declare class IndexerReadError extends IndexerReadError_base<{
+  readonly operation: string;
+  readonly publicCode: CapxulErrorCode;
+  readonly publicError: CapxulError;
+  readonly cause: unknown;
+  readonly details?: CapxulErrorDetails;
+}> {}
+interface IndexerReadPort {
+  /** One page of rows, newest block first. An empty page is a value, not an error. */
+  read<T extends IndexerTable>(table: T, input: IndexerReadInput): Effect.Effect<IndexerRowsByTable[T], IndexerReadError>;
+  /**
+   * The same page over the indexer's live stream. The first snapshot is
+   * `loading`; each later snapshot carries the whole page again. The indexer
+   * closes the stream on token expiry or revoked authority, which arrives as
+   * one `error` snapshot — the caller re-reads with a refreshed token.
+   *
+   * @internal-use — substrate reactive transport, like `ConvexCallPort.subscribe`.
+   */
+  subscribe<T extends IndexerTable>(table: T, input: IndexerReadInput, callback: (snapshot: Snapshot<IndexerRowsByTable[T]>) => void): Effect.Effect<Unsubscribe, IndexerReadError>;
+  /** Sync position per chain. Unauthenticated: a stale index is not a refusal. */
+  readonly status: Effect.Effect<readonly IndexerChainStatus[], IndexerReadError>;
+}
+//#endregion
 //#region src/flows/types.d.ts
 /** The runtime port bundle that `assembleCapxulClient` uses. */
 interface FlowPorts {
@@ -918,6 +1032,11 @@ interface FlowPorts {
   readonly clock: ClockPort;
   readonly telemetry: TelemetryPort;
   readonly convexCall: ConvexCallPort;
+  /**
+   * The Ponder read seam (P02). Optional: it is present only when the client
+   * was given an indexer origin, and every existing flow works without it.
+   */
+  readonly indexerRead?: IndexerReadPort;
 }
 /** Legacy method input retained by the imperative auth surface. */
 interface ExternalSigner {
@@ -2671,6 +2790,13 @@ interface CapxulClient {
      * NOT on the public `client.accounts` surface.
      */
     readonly accounts: AccountsFaucetMethods;
+    /**
+     * Ponder read seam (P02). Present only when the client was built with an
+     * indexer origin, so every reader treats it as optional. Ponder holds what
+     * the chain said; Convex holds what the user meant. Reads here never run
+     * inside a write path and never wait for a finality tag.
+     */
+    readonly indexer?: IndexerReadPort;
     /** Quarantined Reference-harness evidence; never a product Organization method. */
     readonly organizationSetup: OrganizationSetupProofMethods;
     /** Product telemetry projection for internal composition and test harnesses. */

package/dist/testing/index.d.mts

@@ -1,10 +1,85 @@
 import { h as CapxulResult } from "../OAuthBearerAuthClient-C-ip-z8M.mjs";
-import { er as TelemetryEvent, f as CapxulClient, i as ObservationAdapter, n as ProductionSignerControls, nr as TelemetryIdentifyInput, pr as IdentityTransition, t as CapxulClientInput, tr as TelemetryGroupInput } from "../production-BOMKT0n7.mjs";
+import { er as TelemetryEvent, f as CapxulClient, i as ObservationAdapter, n as ProductionSignerControls, nr as TelemetryIdentifyInput, pr as IdentityTransition, t as CapxulClientInput, tr as TelemetryGroupInput } from "../production-Du4Vc7YD.mjs";
 import { Effect, Layer } from "effect";
 //#region src/testing/production-client.d.ts
 /** Create the one production client with per-client controls at its signing boundaries. */
 declare function createCapxulProductionTestClient(input: CapxulClientInput, controls: ProductionSignerControls): Promise<CapxulResult<CapxulClient>>;
 //#endregion
+//#region src/testing/signer-faults.d.ts
+/**
+ * Which provider refusal to inject. The codes are the ones the SDK's own
+ * classifiers decode (`src/signer.ts`), so a fault reaches the public error
+ * contract through the real decode path rather than a shortcut.
+ *
+ * - `missing-signer` — Openfort's typed not-ready code. `openfortSignerNotReadyCode`
+ *   decodes it, so the production recovery wrapper runs its single retry (A02).
+ * - `user-rejected` — the EIP-1193 4001 result. `signerFailure` decodes it to
+ *   `SIGNER_REJECTED`, an expected refusal (A08).
+ * - `unexpected` — no provider code at all, so it stays an unexpected
+ *   `PROVIDER_ERROR` (A09).
+ */
+type SignerFaultKind = "missing-signer" | "user-rejected" | "unexpected";
+/** The value a controlled fault throws. Named so a test can assert its origin. */
+declare class ControlledSignerFault extends Error {
+  readonly kind: SignerFaultKind;
+  /** Provider code the SDK classifiers read; absent for `unexpected`. */
+  readonly code: string | number | undefined;
+  constructor(kind: SignerFaultKind);
+}
+/** Build one fault value without the harness, for a caller that writes its own control. */
+declare function signerFaultCause(kind: SignerFaultKind): ControlledSignerFault;
+interface SignerFaultPlan {
+  /**
+   * Fault the next embedded signature ONCE, beneath the production recovery
+   * wrapper, then delegate every later call to the real signer. The address
+   * read and the readiness cycle still run first, so the fault lands at the
+   * actual final signing boundary after the prepared-command equality checks.
+   */
+  readonly signOnce?: SignerFaultKind;
+  /**
+   * Call the production signer's own `resetSession()` ONCE, immediately before
+   * the next signature and after the command is prepared. The delegate then
+   * re-runs the real readiness cycle, so the configure request under test is
+   * the first one the browser observes after the `reset-session` record (A03).
+   *
+   * Throws when the composed signer owns no session — a silently skipped reset
+   * would leave the run looking green while proving nothing.
+   */
+  readonly resetSessionBeforeNextSign?: boolean;
+}
+/** What the seam did. JSON-serializable, so a browser test can read it back. */
+interface SignerSeamRecord {
+  readonly boundary: "reset-session" | "embedded-sign";
+  /** 1-based count of calls at that boundary. */
+  readonly attempt: number;
+  readonly hash?: string;
+  /** Present only on the call that actually threw. */
+  readonly fault?: SignerFaultKind;
+  readonly atMs: number;
+}
+interface ArmedSignerSeam {
+  /** Hand these to `createCapxulProductionTestClient`. */
+  readonly controls: ProductionSignerControls;
+  /** Oldest first. Empty until the client reaches a signing boundary. */
+  readonly records: () => readonly SignerSeamRecord[];
+  /** True once every armed one-shot has fired. */
+  readonly spent: () => boolean;
+}
+/**
+ * Arm one-shot faults on the production embedded signer.
+ *
+ * ```ts
+ * const seam = armSignerFaults({ signOnce: "user-rejected" });
+ * const client = await createCapxulProductionTestClient(input, seam.controls);
+ * const result = await client.org(orgId).permissions.create(command);
+ * // result.error.code === "SIGNER_REJECTED"; nothing was submitted.
+ * // seam.records() names the boundary that refused.
+ * ```
+ *
+ * An empty plan installs no controls, which composes the ordinary client.
+ */
+declare function armSignerFaults(plan?: SignerFaultPlan): ArmedSignerSeam;
+//#endregion
 //#region src/testing/telemetry/RecordingTelemetryAdapter.d.ts
 type RecordingTelemetryOperation = {
   readonly type: "emit";
@@ -56,4 +131,4 @@ interface CapxulTestObservation {
  */
 declare function createCapxulTestClient(options?: CreateCapxulTestClientOptions): CapxulTestClient;
 //#endregion
-export { CapxulTestClient, CapxulTestClock, CapxulTestObservation, CreateCapxulTestClientOptions, type ProductionSignerControls, SeedTestIdentityInput, createCapxulProductionTestClient, createCapxulTestClient };
+export { type ArmedSignerSeam, CapxulTestClient, CapxulTestClock, CapxulTestObservation, ControlledSignerFault, CreateCapxulTestClientOptions, type ProductionSignerControls, SeedTestIdentityInput, type SignerFaultKind, type SignerFaultPlan, type SignerSeamRecord, armSignerFaults, createCapxulProductionTestClient, createCapxulTestClient, signerFaultCause };

package/dist/testing/index.mjs

@@ -1,5 +1,5 @@
-import { D as fromWei, P as redactTelemetryEvent, a as smartAccountErrorFromCapxul, c as identityErrorFromCapxul, i as assembleCapxulClient, l as convexCallErrorFromCapxul, n as createCapxulClientWithSignerControls, o as accountReadErrorFromCapxul, s as wireChainId, u as bootstrapErrorFromCapxul, v as toWei } from "../production-Y3yqeOSE.mjs";
-import { $ as toSessionToken, B as toDurationMs, F as toAuthUserId, G as toJwtToken, H as toEpochMs, K as toKycTier, L as toChainId, M as toAddress, N as toAllowedOrigin, P as toAppId, R as toCountryCode, U as toEpochSeconds, V as toEmail, W as toHandle, Z as toPublishableKey, at as CapxulError, d as authClientPortFromPromiseAdapter, j as toAccountId, n as readClockNow, r as InMemoryAuthCacheAdapter, st as Errors, tt as validateHandle, y as deriveCapxulSafeAddress } from "../OAuthBearerAuthClient-hPwtSpEf.mjs";
+import { D as fromWei, P as redactTelemetryEvent, a as smartAccountErrorFromCapxul, c as identityErrorFromCapxul, i as assembleCapxulClient, l as convexCallErrorFromCapxul, n as createCapxulClientWithSignerControls, o as accountReadErrorFromCapxul, s as wireChainId, u as bootstrapErrorFromCapxul, v as toWei } from "../production-216hsAKc.mjs";
+import { G as toHandle, H as toEmail, I as toAuthUserId, K as toJwtToken, M as toAddress, N as toAllowedOrigin, P as toAppId, Q as toPublishableKey, R as toChainId, U as toEpochMs, V as toDurationMs, W as toEpochSeconds, d as authClientPortFromPromiseAdapter, et as toSessionToken, j as toAccountId, lt as Errors, n as readClockNow, q as toKycTier, r as InMemoryAuthCacheAdapter, rt as validateHandle, st as CapxulError, y as deriveCapxulSafeAddress, z as toCountryCode } from "../OAuthBearerAuthClient-IB2W1Fzj.mjs";
 import { keccak256 } from "viem";
 import { Effect, Result, Semaphore } from "effect";
 import { getFunctionName } from "convex/server";
@@ -9,6 +9,97 @@ function createCapxulProductionTestClient(input, controls) {
 	return createCapxulClientWithSignerControls(input, controls);
 }
 //#endregion
+//#region src/testing/signer-faults.ts
+const FAULT_CODES = {
+	"missing-signer": "MISSING_SIGNER",
+	"user-rejected": 4001,
+	unexpected: void 0
+};
+/** The value a controlled fault throws. Named so a test can assert its origin. */
+var ControlledSignerFault = class extends Error {
+	kind;
+	/** Provider code the SDK classifiers read; absent for `unexpected`. */
+	code;
+	constructor(kind) {
+		super(`controlled signer fault (${kind})`);
+		this.name = "ControlledSignerFault";
+		this.kind = kind;
+		this.code = FAULT_CODES[kind];
+	}
+};
+/** Build one fault value without the harness, for a caller that writes its own control. */
+function signerFaultCause(kind) {
+	return new ControlledSignerFault(kind);
+}
+/**
+* Arm one-shot faults on the production embedded signer.
+*
+* ```ts
+* const seam = armSignerFaults({ signOnce: "user-rejected" });
+* const client = await createCapxulProductionTestClient(input, seam.controls);
+* const result = await client.org(orgId).permissions.create(command);
+* // result.error.code === "SIGNER_REJECTED"; nothing was submitted.
+* // seam.records() names the boundary that refused.
+* ```
+*
+* An empty plan installs no controls, which composes the ordinary client.
+*/
+function armSignerFaults(plan = {}) {
+	const records = [];
+	let pendingFault = plan.signOnce;
+	let pendingReset = plan.resetSessionBeforeNextSign === true;
+	let resetCalls = 0;
+	let embeddedCalls = 0;
+	function record(entry) {
+		records.push({
+			...entry,
+			atMs: Date.now()
+		});
+	}
+	const resetThenSign = async (hash, signer) => {
+		if (pendingReset) {
+			pendingReset = false;
+			resetCalls += 1;
+			if (signer.resetSession === void 0) throw new Error("armSignerFaults: resetSessionBeforeNextSign needs the embedded browser signer; this client composed a signer with no session");
+			signer.resetSession();
+			record({
+				boundary: "reset-session",
+				attempt: resetCalls,
+				hash
+			});
+		}
+		return signer.signUserOpHash(hash);
+	};
+	const faultThenDelegate = async (hash, delegate) => {
+		embeddedCalls += 1;
+		const fault = pendingFault;
+		if (fault === void 0) {
+			record({
+				boundary: "embedded-sign",
+				attempt: embeddedCalls,
+				hash
+			});
+			return delegate(hash);
+		}
+		pendingFault = void 0;
+		record({
+			boundary: "embedded-sign",
+			attempt: embeddedCalls,
+			hash,
+			fault
+		});
+		throw signerFaultCause(fault);
+	};
+	return {
+		controls: {
+			...plan.resetSessionBeforeNextSign === true ? { signUserOpHash: resetThenSign } : {},
+			...plan.signOnce === void 0 ? {} : { signEmbeddedUserOpHash: faultThenDelegate }
+		},
+		records: () => records.slice(),
+		spent: () => pendingFault === void 0 && !pendingReset
+	};
+}
+//#endregion
 //#region src/testing/account/InMemoryAccountReadAdapter.ts
 var InMemoryAccountReadAdapter = class {
 	#deps;
@@ -915,4 +1006,4 @@ function createCapxulTestClient(options = {}) {
 	};
 }
 //#endregion
-export { createCapxulProductionTestClient, createCapxulTestClient };
+export { ControlledSignerFault, armSignerFaults, createCapxulProductionTestClient, createCapxulTestClient, signerFaultCause };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@capxul/sdk",
-  "version": "4.2.0-rc.8",
+  "version": "4.2.0-rc.9",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/Xelmar-tech/infrastructure.git",
@@ -48,10 +48,10 @@
     "vite-plus": "0.3.0",
     "vitest": "4.1.11",
     "@capxul/config": "0.3.0",
-    "@capxul/observability": "4.2.0-rc.8",
+    "@capxul/observability": "4.2.0-rc.9",
     "@capxul/errors": "0.3.0",
-    "@capxul/types": "0.3.0",
     "@capxul/wire": "0.7.0",
+    "@capxul/types": "0.3.0",
     "@capxul/typescript-config": "0.0.0"
   },
   "_permissionlessPinReason": "permissionless.toSafeSmartAccount is pinned to 0.3.4 for live Safe deployment E2E. Counterfactual address fixtures captured 2026-05-17 in packages/backend/convex/_shared/__tests__/counterfactual.test.ts and packages/config/tests/safe.test.ts must be re-verified before upgrading.",