@capxul/sdk 4.2.0-rc.9 → 4.20.0-beta.1

package/dist/{production-Du4Vc7YD.d.mts → production-DvGDNIwu.d.mts}

@@ -284,7 +284,7 @@ interface TelemetryPort {
 }
 //#endregion
 //#region ../observability/src/index.d.ts
-declare const TELEMETRY_EVENT_NAMES: readonly ["auth_otp_requested", "auth_otp_delivered", "auth_otp_expired", "auth_verified", "auth_failed", "identity_refused", "auth_signed_out", "onboarding_intent_selected", "onboarding_profile_submitted", "onboarding_organization_submitted", "onboarding_dashboard_reached", "provisioning_safe_created", "provisioning_safe_confirmed", "bootstrap_resolved", "bootstrap_failed", "member_activation_started", "member_activation_ready", "member_activation_failed", "organization_creation_started", "organization_creation_ready", "organization_creation_failed", "chain_upstream_fallback", "bundler_error", "receipt_pending", "operation_retried", "account_balance_read", "account_balance_failed", "faucet_requested", "faucet_confirmed", "faucet_failed", "org_create_started", "org_safe_created", "org_safe_confirmed", "org_roles_seeded", "org_created", "org_create_failed", "org_invite_sent", "org_invite_accepted", "org_invite_expired", "payment_initiated", "payment_settled", "payment_failed", "payment_verification_retry", "payment_lifecycle_transition", "quick_pay_external_address_acknowledged", "deposit_initiated", "deposit_settled", "permission_mirror_verification", "movement_scan_window", "movement_scan_checkpoint", "movement_scan_incident", "activity_annotation_saved", "ui_activity_action_completed", "contact_relationship_changed", "ui_contact_action_completed", "access_recovery_completed", "ui_access_step_completed", "org_invite_progressed", "invoice_issued", "invoice_request_transitioned", "ui_invoice_step_completed", "ui_treasury_step_completed", "ui_receive_step_completed", "payroll_group_changed", "payroll_run_transitioned", "ui_payroll_action_completed"];
+declare const TELEMETRY_EVENT_NAMES: readonly ["auth_otp_requested", "auth_otp_delivered", "auth_otp_expired", "auth_verified", "auth_failed", "identity_refused", "auth_signed_out", "onboarding_intent_selected", "onboarding_profile_submitted", "onboarding_organization_submitted", "onboarding_dashboard_reached", "provisioning_safe_created", "provisioning_safe_confirmed", "bootstrap_resolved", "bootstrap_failed", "member_activation_started", "member_activation_ready", "member_activation_failed", "organization_creation_started", "organization_creation_ready", "organization_creation_failed", "chain_upstream_fallback", "bundler_error", "receipt_pending", "operation_retried", "account_balance_read", "account_balance_failed", "faucet_requested", "faucet_confirmed", "faucet_failed", "org_create_started", "org_safe_created", "org_safe_confirmed", "org_roles_seeded", "org_created", "org_create_failed", "org_invite_sent", "org_invite_accepted", "org_invite_expired", "payment_initiated", "payment_settled", "payment_failed", "payment_verification_retry", "payment_lifecycle_transition", "quick_pay_external_address_acknowledged", "deposit_initiated", "deposit_settled", "permission_mirror_verification", "movement_scan_window", "movement_scan_checkpoint", "movement_scan_incident", "indexer_drift_corrected", "activity_annotation_saved", "ui_activity_action_completed", "contact_relationship_changed", "ui_contact_action_completed", "access_recovery_completed", "ui_access_step_completed", "org_invite_progressed", "invoice_issued", "invoice_request_transitioned", "ui_invoice_step_completed", "ui_treasury_step_completed", "ui_receive_step_completed", "payroll_group_changed", "payroll_run_transitioned", "ui_payroll_action_completed", "cli_diagnostic_completed"];
 type TelemetryEventName = (typeof TELEMETRY_EVENT_NAMES)[number];
 type TelemetryProps = Record<string, unknown>;
 type TelemetryEvent = {
@@ -938,6 +938,12 @@ interface IndexerEventIdentity {
   readonly chainId: ChainId;
   readonly txHash: TxHash;
   readonly transactionLogOrdinal: number;
+  /**
+   * The block-global log index of the same log, as the transaction receipt
+   * reports it. The ordinal above is the identity; this is the key Convex
+   * settles a Payment on (P12).
+   */
+  readonly logIndex: number;
   readonly blockNumber: bigint;
   readonly blockHash: string;
   /** Block timestamp in epoch seconds. */
@@ -1274,10 +1280,17 @@ interface ResolvedTarget {
     readonly canPayout: boolean;
   };
 }
+/**
+ * R09 (#1967): the declared option type is the `InvocationControls` the money
+ * surface already forwards to `deps.invocationControls`, named here exactly as
+ * R02 named it on the address book and R13 on payroll. A caller that captured
+ * one user attempt can hand the same `correlation_id`/`journey_id` to the read
+ * it starts, so the read joins that attempt instead of standing alone.
+ * `{ signal }` callers are unaffected.
+ */
+type PaymentReadOptions = InvocationControls;
 interface TargetsMethods {
-  resolve(reference: TargetReference, options?: {
-    readonly signal?: AbortSignal;
-  }): Promise<CapxulResult<ResolvedTarget>>;
+  resolve(reference: TargetReference, options?: PaymentReadOptions): Promise<CapxulResult<ResolvedTarget>>;
 }
 type Ref$1 = {
   readonly kind: "handle";
@@ -1324,9 +1337,8 @@ interface MeMethods {
   get(options?: {
     readonly signal?: AbortSignal;
   }): Promise<CapxulResult<MeProfile>>;
-  depositInstructions(options?: {
-    readonly signal?: AbortSignal;
-  }): Promise<CapxulResult<DepositInstructions>>;
+  /** R08 (#1966): accepts a captured attempt, exactly as the treasury read does. */
+  depositInstructions(options?: InvocationControls): Promise<CapxulResult<DepositInstructions>>;
 }
 interface PaymentMoney {
   readonly currency: string;
@@ -1561,6 +1573,8 @@ type ActivityItem = {
   readonly updatedAt: number;
 };
 interface ActivityPage {
+  /** Usable fallback data omits indexed movements; never present it as complete. */
+  readonly readWarning?: "indexer-unavailable";
   readonly items: readonly ActivityItem[];
   readonly cursor: string | null;
   readonly checkpoint: number;
@@ -1582,6 +1596,7 @@ interface ActivitySummaryTotal {
   readonly pendingIn: string;
 }
 interface ActivitySummary {
+  readonly readWarning?: ActivityPage["readWarning"];
   readonly window: {
     readonly from: number | null;
     readonly to: number | null;
@@ -1679,6 +1694,17 @@ interface ActivityAnnotationInput {
  * are unaffected.
  */
 interface ActivityMethods {
+  /**
+   * Tell the caller when the indexed page for this actor's Safe changed, over
+   * the indexer's one live connection. The callback carries no rows: it is the
+   * signal to re-read `list` or `summary`. Without an indexer this resolves a
+   * no-op teardown, so a caller needs no branch.
+   *
+   * @internal-use — substrate reactive transport, like `ConvexCallPort.subscribe`.
+   */
+  subscribe(onChange: () => void, params?: {
+    readonly actor?: ActorReference;
+  }, options?: InvocationControls): Promise<CapxulResult<() => void>>;
   list(params?: ActivityListParams, options?: InvocationControls): Promise<CapxulResult<ActivityPage>>;
   summary(params?: ActivitySummaryParams, options?: InvocationControls): Promise<CapxulResult<ActivitySummary>>;
   get(reference: ActivityReference, options?: InvocationControls & {
@@ -1752,12 +1778,8 @@ interface PaymentsMethods {
   claim(paymentId: string, options?: {
     readonly signal?: AbortSignal;
   }): Promise<CapxulResult<Payment>>;
-  list(options?: {
-    readonly signal?: AbortSignal;
-  }): Promise<CapxulResult<readonly Payment[]>>;
-  get(paymentId: string, options?: {
-    readonly signal?: AbortSignal;
-  }): Promise<CapxulResult<Payment | null>>;
+  list(options?: PaymentReadOptions): Promise<CapxulResult<readonly Payment[]>>;
+  get(paymentId: string, options?: PaymentReadOptions): Promise<CapxulResult<Payment | null>>;
   cancel(paymentId: string, options?: {
     readonly signal?: AbortSignal;
   }): Promise<CapxulResult<Payment>>;
@@ -1867,19 +1889,17 @@ interface ActorRequestIssueInput {
   readonly memo?: string;
   readonly expiresAt?: number;
 }
+/**
+ * The issuer's own requests. The options are the address book's
+ * `InvocationControls` (R07 #1965), so a caller that captured one browser
+ * attempt hands it to the operation that attempt started; `{ signal }` callers
+ * are unaffected.
+ */
 interface ActorRequestsMethods {
-  issue(input: ActorRequestIssueInput, options?: {
-    readonly signal?: AbortSignal;
-  }): Promise<CapxulResult<ActorRequest>>;
-  list(options?: {
-    readonly signal?: AbortSignal;
-  }): Promise<CapxulResult<readonly ActorRequest[]>>;
-  get(requestId: string, options?: {
-    readonly signal?: AbortSignal;
-  }): Promise<CapxulResult<ActorRequest | null>>;
-  cancel(requestId: string, options?: {
-    readonly signal?: AbortSignal;
-  }): Promise<CapxulResult<ActorRequest>>;
+  issue(input: ActorRequestIssueInput, options?: InvocationControls): Promise<CapxulResult<ActorRequest>>;
+  list(options?: InvocationControls): Promise<CapxulResult<readonly ActorRequest[]>>;
+  get(requestId: string, options?: InvocationControls): Promise<CapxulResult<ActorRequest | null>>;
+  cancel(requestId: string, options?: InvocationControls): Promise<CapxulResult<ActorRequest>>;
 }
 interface InboxItem {
   readonly id: string;
@@ -1893,24 +1913,18 @@ interface InboxApproveInput {
   readonly timing?: PaymentTiming;
   readonly permissionId?: string;
 }
+/** The payer's own inbox. Its scope is the payer's, never the issuer's. */
 interface InboxMethods {
-  list(options?: {
-    readonly signal?: AbortSignal;
-  }): Promise<CapxulResult<readonly InboxItem[]>>;
-  approve(input: InboxApproveInput, options?: {
-    readonly signal?: AbortSignal;
-  }): Promise<CapxulResult<Payment>>;
-  decline(requestId: string, options?: {
-    readonly signal?: AbortSignal;
-  }): Promise<CapxulResult<InboxItem>>;
+  list(options?: InvocationControls): Promise<CapxulResult<readonly InboxItem[]>>;
+  approve(input: InboxApproveInput, options?: InvocationControls): Promise<CapxulResult<Payment>>;
+  decline(requestId: string, options?: InvocationControls): Promise<CapxulResult<InboxItem>>;
 }
 interface ActorProfileMethods {
   get(options?: {
     readonly signal?: AbortSignal;
   }): Promise<CapxulResult<ActorProfile>>;
-  depositInstructions(options?: {
-    readonly signal?: AbortSignal;
-  }): Promise<CapxulResult<DepositInstructions>>;
+  /** R08 (#1966): accepts a captured attempt, exactly as the treasury read does. */
+  depositInstructions(options?: InvocationControls): Promise<CapxulResult<DepositInstructions>>;
 }
 interface ActorRelationshipMethods {
   readonly addressBook: AddressBookMethods;
@@ -2071,6 +2085,12 @@ type ListOrgRolesInput = {
 type ListOrgMembersInput = {
   readonly orgId: OrgId;
 };
+/**
+ * R06 (#1964): the program attaches the caller's captured attempt to this
+ * record through `copyInvocationObservation`, so the adapter forwards one
+ * observation context to the backend action that owns `org_invite_sent`. The
+ * carrier is a non-enumerable symbol and never becomes a wire field.
+ */
 type InviteOrgMemberInput = {
   readonly orgId: OrgId;
   readonly input: InviteMemberInput;
@@ -2332,9 +2352,15 @@ interface AuthorizeRunInput {
    */
   readonly requestKey?: string;
 }
-type PayrollOptions = {
-  readonly signal?: AbortSignal;
-};
+/**
+ * R13 (#1968): the declared option type is the `InvocationControls` these
+ * methods have always forwarded to `deps.invocationControls` — the same naming
+ * R02 gave the address book. It lets a caller that captured one browser attempt
+ * hand that attempt's `correlation_id`/`journey_id` to the payroll operation it
+ * starts, so `ui_payroll_action_completed` and the durable group and run events
+ * share a correlation. `{ signal }` callers are unaffected.
+ */
+type PayrollOptions = InvocationControls;
 type AuthorizeRunOptions = PayrollOptions & {
   /** Persist this SDK-allocated key before the first backend write. Reject to prevent execution. */
   readonly onRequestKey?: (key: string) => void | Promise<void>;
@@ -2484,14 +2510,15 @@ interface OrgScopedMethods extends ActorRelationshipMethods {
   retrySetup(options?: {
     readonly signal?: AbortSignal;
   }): Promise<CapxulResult<OrgLifecycle>>;
-  /** The Organization treasury Account. */
-  treasury(options?: {
-    readonly signal?: AbortSignal;
-  }): Promise<CapxulResult<Account$1>>;
+  /**
+   * The Organization treasury Account. R08 (#1966): the declared option type is
+   * the `InvocationControls` this surface already forwards, so a screen that
+   * captured one user attempt can hand the same `correlation_id`/`journey_id`
+   * to the read it starts. `{ signal }` callers are unaffected.
+   */
+  treasury(options?: InvocationControls): Promise<CapxulResult<Account$1>>;
   readonly account: {
-    get(options?: {
-      readonly signal?: AbortSignal;
-    }): Promise<CapxulResult<OrganizationAccount>>;
+    get(options?: InvocationControls): Promise<CapxulResult<OrganizationAccount>>;
   };
   members(options?: {
     readonly signal?: AbortSignal;
@@ -2499,9 +2526,14 @@ interface OrgScopedMethods extends ActorRelationshipMethods {
   roles(options?: {
     readonly signal?: AbortSignal;
   }): Promise<CapxulResult<readonly RoleView[]>>;
-  invite(input: InviteMemberInput, options?: {
-    readonly signal?: AbortSignal;
-  }): Promise<CapxulResult<MemberView>>;
+  /**
+   * Invite a member by email. `options` is the browser attempt the caller
+   * captured before the person pressed the button (R06 #1964); it reaches the
+   * backend action unchanged, so the durable `org_invite_sent` and the later
+   * `org_invite_progressed` share the attempt's correlation. `{ signal }`
+   * callers are unaffected.
+   */
+  invite(input: InviteMemberInput, options?: InvocationControls): Promise<CapxulResult<MemberView>>;
   /**
    * Leak-safe Organization payment: execute through the payments engine with
    * the selected receipt-verified Budget Permission
@@ -2600,11 +2632,11 @@ interface MediaMethods {
 }
 //#endregion
 //#region src/contract/system.d.ts
-/** What `system:health` answers. */
+/** What `system:healthObserved` answers. */
 interface SystemHealth {
   /** The nonce the caller sent, as the backend saw it. */
   readonly nonce: string;
-  /** Deployment that answered, e.g. `little-sandpiper-974`. */
+  /** Deployment that answered, e.g. `api` for the Railway staging host. */
   readonly deployment: string;
   /** Backend clock at execution (epoch ms). */
   readonly at: number;
@@ -2716,6 +2748,8 @@ interface IdentityRuntime {
   readonly runFacade?: <T>(verb: IdentityFacadeVerb, controls: InvocationControls | undefined, run: (controls: InvocationControls) => Promise<T>) => Promise<T>;
 }
 interface CapxulClient {
+  /** Stop this client's resources. Repeated calls share the same cleanup. */
+  close(): Promise<CapxulResult<void>>;
   readonly auth: AuthMethods;
   readonly smartAccount: SmartAccountMethods;
   readonly identity: IdentityMethods;
@@ -2892,6 +2926,10 @@ interface PostHogObservabilityClient {
 interface PostHogObservabilityOptions {
   /** Consent / kill-switch seam. Defaults to enabled. */
   readonly enabled?: boolean | (() => boolean);
+  /** Omission preserves bootstrap engineering. False/throw closes the acquired runtime's collection. */
+  readonly engineeringEnabled?: boolean | (() => boolean);
+  /** Opt in to code/timing/correlation-only engineering exports. Omission preserves full safe diagnostics. */
+  readonly engineeringPrivacy?: "minimal";
   /** Host environment stamped on every SDK-owned product event. */
   readonly capxulEnv?: CapxulEnv;
   /** Host-owned correlation context shared by product and failure delivery. */
@@ -3017,6 +3055,8 @@ interface OpenfortBrowserSignerOptions {
  */
 interface CapxulClientInput {
   readonly publishableKey: string;
+  /** Public Capxul bootstrap origin; defaults remain unchanged when omitted. */
+  readonly bootstrapBaseUrl?: string;
   /**
    * One host-owned product/failure observability module around the host's
    * existing analytics client. Omit for zero host observation work.

package/dist/testing/index.d.mts

@@ -1,5 +1,5 @@
 import { h as CapxulResult } from "../OAuthBearerAuthClient-C-ip-z8M.mjs";
-import { er as TelemetryEvent, f as CapxulClient, i as ObservationAdapter, n as ProductionSignerControls, nr as TelemetryIdentifyInput, pr as IdentityTransition, t as CapxulClientInput, tr as TelemetryGroupInput } from "../production-Du4Vc7YD.mjs";
+import { er as TelemetryEvent, f as CapxulClient, i as ObservationAdapter, n as ProductionSignerControls, nr as TelemetryIdentifyInput, pr as IdentityTransition, t as CapxulClientInput, tr as TelemetryGroupInput } from "../production-DvGDNIwu.mjs";
 import { Effect, Layer } from "effect";
 //#region src/testing/production-client.d.ts
 /** Create the one production client with per-client controls at its signing boundaries. */

package/dist/testing/index.mjs

@@ -1,5 +1,5 @@
-import { D as fromWei, P as redactTelemetryEvent, a as smartAccountErrorFromCapxul, c as identityErrorFromCapxul, i as assembleCapxulClient, l as convexCallErrorFromCapxul, n as createCapxulClientWithSignerControls, o as accountReadErrorFromCapxul, s as wireChainId, u as bootstrapErrorFromCapxul, v as toWei } from "../production-216hsAKc.mjs";
-import { G as toHandle, H as toEmail, I as toAuthUserId, K as toJwtToken, M as toAddress, N as toAllowedOrigin, P as toAppId, Q as toPublishableKey, R as toChainId, U as toEpochMs, V as toDurationMs, W as toEpochSeconds, d as authClientPortFromPromiseAdapter, et as toSessionToken, j as toAccountId, lt as Errors, n as readClockNow, q as toKycTier, r as InMemoryAuthCacheAdapter, rt as validateHandle, st as CapxulError, y as deriveCapxulSafeAddress, z as toCountryCode } from "../OAuthBearerAuthClient-IB2W1Fzj.mjs";
+import { D as fromWei, P as redactTelemetryEvent, a as smartAccountErrorFromCapxul, c as identityErrorFromCapxul, i as assembleCapxulClient, l as convexCallErrorFromCapxul, n as createCapxulClientWithSignerControls, o as accountReadErrorFromCapxul, s as wireChainId, u as bootstrapErrorFromCapxul, v as toWei } from "../production-BmsFhDUr.mjs";
+import { G as toHandle, H as toEmail, I as toAuthUserId, K as toJwtToken, M as toAddress, N as toAllowedOrigin, P as toAppId, Q as toPublishableKey, R as toChainId, U as toEpochMs, V as toDurationMs, W as toEpochSeconds, ct as CapxulError, d as authClientPortFromPromiseAdapter, et as toSessionToken, it as validateHandle, j as toAccountId, n as readClockNow, q as toKycTier, r as InMemoryAuthCacheAdapter, ut as Errors, y as deriveCapxulSafeAddress, z as toCountryCode } from "../OAuthBearerAuthClient-DDD0JlaI.mjs";
 import { keccak256 } from "viem";
 import { Effect, Result, Semaphore } from "effect";
 import { getFunctionName } from "convex/server";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@capxul/sdk",
-  "version": "4.2.0-rc.9",
+  "version": "4.20.0-beta.1",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/Xelmar-tech/infrastructure.git",
@@ -30,14 +30,14 @@
     "access": "public"
   },
   "dependencies": {
-    "@effect/platform-node": "4.0.0-beta.105",
+    "@effect/platform-node": "4.0.0-rc.112",
     "@openfort/openfort-js": "^1.3.6",
     "convex": "^1.39.1",
-    "effect": "4.0.0-beta.105",
+    "effect": "4.0.0-rc.112",
     "viem": "^2.53.1"
   },
   "devDependencies": {
-    "@effect/vitest": "4.0.0-beta.105",
+    "@effect/vitest": "4.0.0-rc.112",
     "@typescript/native": "npm:typescript@7.0.2",
     "@vitest/coverage-v8": "4.1.11",
     "fast-check": "^3.23.2",
@@ -48,11 +48,11 @@
     "vite-plus": "0.3.0",
     "vitest": "4.1.11",
     "@capxul/config": "0.3.0",
-    "@capxul/observability": "4.2.0-rc.9",
-    "@capxul/errors": "0.3.0",
-    "@capxul/wire": "0.7.0",
+    "@capxul/typescript-config": "0.0.0",
     "@capxul/types": "0.3.0",
-    "@capxul/typescript-config": "0.0.0"
+    "@capxul/errors": "0.3.0",
+    "@capxul/wire": "0.8.0-beta.0",
+    "@capxul/observability": "4.20.0-beta.1"
   },
   "_permissionlessPinReason": "permissionless.toSafeSmartAccount is pinned to 0.3.4 for live Safe deployment E2E. Counterfactual address fixtures captured 2026-05-17 in packages/backend/convex/_shared/__tests__/counterfactual.test.ts and packages/config/tests/safe.test.ts must be re-verified before upgrading.",
   "scripts": {

package/dist/capxul-source.json

@@ -1,11 +0,0 @@
-{
-  "source": {
-    "commit": "1c96a26356e8f36402e47eb4ac60bb89d6aeed7f",
-    "tree": "375f49f76377eeec331fd44ce17238d4a6f02ad4",
-    "branch": "codex/programme-rc",
-    "repository": "https://github.com/Xelmar-tech/infrastructure",
-    "lockfileSha256": "5870f53b72706d103220c1bcf733cb4fb71196aea32a9cfbdc277d73cc959264"
-  },
-  "name": "@capxul/sdk",
-  "version": "4.2.0-rc.9"
-}