@capxul/sdk 4.2.0 → 4.20.0-beta.1

package/dist/index.mjs

@@ -1,14 +1,8 @@
-import { $ as stampTelemetryEnvelope, A as safeExceptionLabel, B as resolveFailureMode, C as observeFailedResult, D as normalizeExceptionErrorKind, E as SDK_VERSION$1, F as causeChain, G as sanitizeObservationContext, H as readInvocationObservation, I as injectedWalletSigner, J as CAPXUL_FUNCTIONS, K as PAYMENT_DIRECTIONS, L as isSignerNotReadySignal, M as fromWei, N as isSettingUpLifecycle, O as normalizeExceptionOperation, P as formatTraceparent, Q as redactTelemetryProps, R as openfortSignerNotReadyCode, S as observationContextProps, T as EXCEPTION_MESSAGE, U as OBSERVATION_CONTEXT_HEADER, V as copyInvocationObservation, W as encodeObservationContextHeader, X as EngineeringTelemetryBootstrapPolicy, Y as BootstrapEnvelope, _ as fingerprintPaymentIntent, a as AccountReadPortTag, at as isRestoring, b as failureDetail, c as retryIdempotentRead, d as IdentityPortTag, et as CAPXUL_OPERATIONS, f as identityErrorFromCapxul, g as bootstrapErrorFromCapxul, h as BootstrapPortTag, i as smartAccountErrorFromCapxul, it as isClaimed, j as version, k as projectSdkException, l as PRODUCT_INVOCATION, m as convexCallErrorFromCapxul, n as detectAuthCacheAdapter, nt as normalizeCapxulOperation, o as accountReadErrorFromCapxul, p as ConvexCallPortTag, q as PAYMENT_STATUSES, r as SmartAccountPortTag, rt as destination, s as TelemetryPortTag, t as assembleCapxulClient, tt as isCapxulOperation, u as wireChainId, v as toWei, w as postHogFailureObservation, x as failureEvidenceProps, y as CAPXUL_SDK_EXPECTED_OUTCOME_EVENT, z as signerFailure } from "./create-capxul-client-B6PUjdld.mjs";
-import { $ as CapxulError, A as toAuthUserId, B as toJwtToken, D as toAddress, E as toAccountId, F as toDurationMs, H as toOrgId, I as toEmail, J as toSessionToken, K as toPublishableKey, L as toEpochMs, M as toChainId, N as toCountryCode, O as toAllowedOrigin, P as toCurrencyCode, Q as CAPXUL_ERROR_CODES, R as toEpochSeconds, T as currencySymbolFor, U as toPartyId, V as toKycTier, X as HANDLE_RE, Y as toTesterKind, Z as decodeConvexError, d as AuthClientError, f as AuthClientPortTag, g as BASE_SEPOLIA_CHAIN_ID, gt as redactUrlSecrets, h as normalizeBindingEmail, ht as redactSecrets, it as FAILURE_MODES, l as ClockPortTag, m as CAPXUL_PAYMENTS_V2_ADDRESS, mt as isCredentialField, nt as isCapxulError, q as toRoleKey, rt as CHAIN_UPSTREAMS, s as AuthCachePortTag, tt as Errors, u as authClientPortFromPromiseAdapter, x as EVM_ADDRESS_RE, z as toHandle } from "./clock-DIfTX44d.mjs";
-import { n as SystemClockLayer } from "./OAuthBearerAuthClient-ByPzJZr8.mjs";
-import { Cause, Context, Data, Duration, Effect, Exit, FiberSet, Layer, Result, Schedule, SchemaIssue, SchemaParser, Scope, Stream, Tracer } from "effect";
-import { keccak256, recoverAddress, stringToHex } from "viem";
-import { getFunctionName, makeFunctionReference } from "convex/server";
+import { A as signerFailure, B as isRestoring, C as normalizeExceptionErrorKind, E as safeExceptionLabel, F as CAPXUL_OPERATIONS, I as isCapxulOperation, L as normalizeCapxulOperation, M as PAYMENT_DIRECTIONS, N as PAYMENT_STATUSES, O as isSettingUpLifecycle, R as destination, S as SDK_VERSION, T as projectSdkException, _ as fingerprintPaymentIntent, b as failureDetail, d as embeddedSigner, f as openfortEmbeddedSigner, g as devPrivateKeySigner, h as deriveDevPrivateKey, j as resolveFailureMode, k as injectedWalletSigner, m as openfortEmbeddedWalletPort, p as openfortEmbeddedSignerFromWallet, r as postHogObservability, t as createCapxulClient$1, w as normalizeExceptionOperation, x as EXCEPTION_MESSAGE, y as CAPXUL_SDK_EXPECTED_OUTCOME_EVENT, z as isClaimed } from "./production-BmsFhDUr.mjs";
+import { A as currencySymbolFor, B as toCurrencyCode, G as toHandle, M as toAddress, T as EVM_ADDRESS_RE, Y as toPartyId, at as HANDLE_RE, b as configuredMoneyAssetById, ct as CapxulError, dt as isCapxulError, ft as CHAIN_UPSTREAMS, g as CAPXUL_PAYMENTS_V2_ADDRESS, k as assetIdFor, pt as FAILURE_MODES, st as CAPXUL_ERROR_CODES, ut as Errors, z as toCountryCode } from "./OAuthBearerAuthClient-DDD0JlaI.mjs";
+import { formatUnits } from "viem";
+import { Effect } from "effect";
 import { privateKeyToAccount } from "viem/accounts";
-import { FetchHttpClient, Headers, HttpClient } from "effect/unstable/http";
-import { OtlpExporter, OtlpLogger, OtlpSerialization, OtlpTracer } from "effect/unstable/observability";
-import { ConvexClient } from "convex/browser";
-import { AccountTypeEnum, ChainTypeEnum, EmbeddedState, Openfort, RecoveryMethod, ThirdPartyOAuthProvider } from "@openfort/openfort-js";
 //#region src/domain/activity/phase.ts
 const PENDING = Object.freeze({
 	terminal: false,
@@ -92,40 +86,6 @@ function inboxPhase(status) {
 	}
 }
 //#endregion
-//#region src/domain/money/format-money.ts
-function formatMoney(money, options = {}) {
-	if (!Number.isInteger(money.decimals) || money.decimals < 0) throw Errors.invalidInput("money.decimals", "must be a non-negative integer");
-	const symbol = currencySymbolFor(toCurrencyCode(money.currency));
-	const maximumFractionDigits = options.grammar === "code" ? 4 : 2;
-	const rounded = roundDecimal(money.value, money.decimals, maximumFractionDigits);
-	const grouped = rounded.integer.replace(/\B(?=(\d{3})+(?!\d))/g, ",");
-	const signed = `${rounded.negative ? "-" : ""}${grouped}`;
-	if (options.grammar === "code") {
-		if (!rounded.hadFraction) return `${signed} ${String(money.currency)}`;
-		let displayedFraction = rounded.fraction;
-		while (displayedFraction.length > 2 && displayedFraction.endsWith("0")) displayedFraction = displayedFraction.slice(0, -1);
-		return `${signed}.${displayedFraction} ${String(money.currency)}`;
-	}
-	return `${symbol}${signed}.${rounded.fraction}`;
-}
-function roundDecimal(value, decimals, maximumFractionDigits) {
-	const match = /^(-?)(\d+)(?:\.(\d+))?$/.exec(value);
-	if (match === null) throw Errors.invalidInput("money.value", "must be a base-10 decimal string");
-	const integer = match[2] ?? "0";
-	const sourceFraction = match[3] ?? "";
-	if (sourceFraction.length > decimals) throw Errors.invalidInput("money.value", "fraction exceeds money.decimals");
-	const scale = 10n ** BigInt(maximumFractionDigits);
-	const keptFraction = sourceFraction.slice(0, maximumFractionDigits).padEnd(maximumFractionDigits, "0");
-	let scaled = BigInt(integer) * scale + BigInt(keptFraction || "0");
-	if ((sourceFraction[maximumFractionDigits] ?? "0") >= "5") scaled += 1n;
-	return {
-		negative: match[1] === "-",
-		integer: (scaled / scale).toString(),
-		fraction: (scaled % scale).toString().padStart(maximumFractionDigits, "0"),
-		hadFraction: /[1-9]/.test(sourceFraction)
-	};
-}
-//#endregion
 //#region src/domain/money/parse-money.ts
 /**
 * ADR-0023 R1: the reason is a closed code and the ONLY failure vocabulary —
@@ -138,13 +98,22 @@ function isMoneyParseError(value) {
 const AMOUNT_PATTERN = /^(?:\d{1,3}(?:,\d{3})+|\d+)(?:\.\d+)?$/;
 const ZERO_PATTERN = /^0+(?:\.0+)?$/;
 function parseMoney(input, asset) {
-	if (!Number.isInteger(asset.decimals) || asset.decimals < 0) throw Errors.invalidInput("asset.decimals", "must be a non-negative integer");
+	const parsed = parseDecimalInput(input, asset.decimals, 24);
+	return "kind" in parsed ? parsed : {
+		currency: asset.currency,
+		value: parsed.value,
+		decimals: asset.decimals
+	};
+}
+/** Shared input grammar. Callers retain their own amount size limits. */
+function parseDecimalInput(input, decimals, maximumLength) {
+	if (!Number.isInteger(decimals) || decimals < 0) throw Errors.invalidInput("asset.decimals", "must be a non-negative integer");
 	const value = input.trim();
 	if (value.length === 0) return {
 		kind: "error",
 		reason: "required"
 	};
-	if (value.length > 24) return {
+	if (value.length > maximumLength) return {
 		kind: "error",
 		reason: "too-long"
 	};
@@ -160,7 +129,7 @@ function parseMoney(input, asset) {
 	};
 	const normalized = unsigned.replaceAll(",", "");
 	const fraction = normalized.split(".")[1];
-	if (fraction !== void 0 && fraction.length > asset.decimals) return {
+	if (fraction !== void 0 && fraction.length > decimals) return {
 		kind: "error",
 		reason: "too-many-decimals"
 	};
@@ -168,10 +137,133 @@ function parseMoney(input, asset) {
 		kind: "error",
 		reason: "non-positive"
 	};
+	return { value: normalized };
+}
+//#endregion
+//#region src/domain/money/asset-amount.ts
+/** Exact scaling. This rejects excess precision instead of rounding it. */
+function toRaw(amount, asset) {
+	validateMetadata(asset);
+	if (amount.asset !== asset.assetId) throw Errors.invalidInput("amount.asset", "must match the selected asset on its chain");
+	return decimalToRaw(amount.value, asset.decimals);
+}
+function parseAssetAmount(input, asset) {
+	validateMetadata(asset);
+	const parsed = parseDecimalInput(input, asset.decimals, 100);
+	return "kind" in parsed ? parsed : {
+		asset: asset.assetId,
+		value: parsed.value.replace(/^0+(?=\d)/, "")
+	};
+}
+/** Display the full quantity. Only fiat formatting rounds for display. */
+function formatAssetAmount(amount) {
+	const asset = requireAsset(amount.asset);
+	const [integer = "0", fraction] = formatUnits(toRaw(amount, asset), asset.decimals).split(".");
+	return `${integer.replace(/\B(?=(\d{3})+(?!\d))/g, ",")}${fraction === void 0 ? "" : `.${fraction}`} ${asset.symbol}`;
+}
+function assetSymbolFor(asset) {
+	return requireAsset(asset).symbol;
+}
+function requireAsset(id) {
+	const asset = configuredMoneyAssetById(id);
+	if (asset === null) throw Errors.invalidInput("amount.asset", "is not a registered asset");
+	return asset;
+}
+function decimalToRaw(value, decimals) {
+	validatePrecision(decimals);
+	if (!/^\d+(?:\.\d+)?$/.test(value) || value.trim() !== value || value.length > 512) throw Errors.invalidInput("amount.value", "must be a non-negative decimal string of at most 512 characters");
+	const [integer = "0", fraction = ""] = value.split(".");
+	if (fraction.length > decimals) throw Errors.invalidInput("amount.value", "fraction exceeds asset precision");
+	return BigInt(integer) * 10n ** BigInt(decimals) + BigInt(fraction.padEnd(decimals, "0") || "0");
+}
+function validatePrecision(decimals) {
+	if (!Number.isInteger(decimals) || decimals < 0 || decimals > 255) throw Errors.invalidInput("decimals", "must be an integer from 0 to 255");
+}
+function validateMetadata(asset) {
+	validatePrecision(asset.decimals);
+	if (asset.assetId !== assetIdFor(asset.chainId, asset.tokenAddress)) throw Errors.invalidInput("amount.asset", "metadata must match its chain and token");
+}
+//#endregion
+//#region src/domain/money/valuation.ts
+const PEG_RATES = (source, into) => (typeof source === "string" ? source : source.peg) === into ? {
+	value: "1",
+	decimals: 0
+} : null;
+/** Sum exact fixed-point values. Missing rates never contribute zero. */
+function valueIn(amounts, displayCurrency, rates = PEG_RATES) {
+	const currency = toCurrencyCode(displayCurrency);
+	const counted = [];
+	const unrated = [];
+	let sum = 0n;
+	let scale = 0;
+	for (const amount of amounts) {
+		let source;
+		let raw;
+		let decimals;
+		if ("asset" in amount) {
+			source = requireAsset(amount.asset);
+			raw = toRaw(amount, source);
+			decimals = source.decimals;
+		} else {
+			source = toCurrencyCode(amount.currency);
+			raw = decimalToRaw(amount.value, amount.decimals);
+			decimals = amount.decimals;
+		}
+		const rate = rates(source, currency);
+		if (rate === null) {
+			unrated.push(amount);
+			continue;
+		}
+		validatePrecision(rate.decimals);
+		if (!/^\d+$/.test(rate.value) || rate.value.trim() !== rate.value || rate.value.length > 256 || BigInt(rate.value) <= 0n) throw Errors.invalidInput("rate.value", "must be a positive fixed-point integer");
+		const termScale = decimals + rate.decimals;
+		const nextScale = Math.max(scale, termScale);
+		sum = sum * 10n ** BigInt(nextScale - scale) + raw * BigInt(rate.value) * 10n ** BigInt(nextScale - termScale);
+		scale = nextScale;
+		counted.push(amount);
+	}
+	return {
+		total: counted.length === 0 ? null : {
+			currency,
+			value: formatUnits(sum, scale),
+			decimals: scale
+		},
+		counted,
+		unrated
+	};
+}
+//#endregion
+//#region src/domain/money/format-money.ts
+function formatMoney(money, options = {}) {
+	if (!Number.isInteger(money.decimals) || money.decimals < 0) throw Errors.invalidInput("money.decimals", "must be a non-negative integer");
+	const symbol = currencySymbolFor(toCurrencyCode(money.currency));
+	const maximumFractionDigits = options.grammar === "code" ? 4 : 2;
+	const rounded = roundDecimal(money.value, money.decimals, maximumFractionDigits);
+	const grouped = rounded.integer.replace(/\B(?=(\d{3})+(?!\d))/g, ",");
+	const signed = `${rounded.negative ? "-" : ""}${grouped}`;
+	if (options.grammar === "code") {
+		if (!rounded.hadFraction) return `${signed} ${String(money.currency)}`;
+		let displayedFraction = rounded.fraction;
+		while (displayedFraction.length > 2 && displayedFraction.endsWith("0")) displayedFraction = displayedFraction.slice(0, -1);
+		return `${signed}.${displayedFraction} ${String(money.currency)}`;
+	}
+	return `${symbol}${signed}.${rounded.fraction}`;
+}
+function roundDecimal(value, decimals, maximumFractionDigits) {
+	const match = /^(-?)(\d+)(?:\.(\d+))?$/.exec(value);
+	if (match === null) throw Errors.invalidInput("money.value", "must be a base-10 decimal string");
+	const integer = match[2] ?? "0";
+	const sourceFraction = match[3] ?? "";
+	if (sourceFraction.length > decimals) throw Errors.invalidInput("money.value", "fraction exceeds money.decimals");
+	const scale = 10n ** BigInt(maximumFractionDigits);
+	const keptFraction = sourceFraction.slice(0, maximumFractionDigits).padEnd(maximumFractionDigits, "0");
+	let scaled = BigInt(integer) * scale + BigInt(keptFraction || "0");
+	if ((sourceFraction[maximumFractionDigits] ?? "0") >= "5") scaled += 1n;
 	return {
-		currency: asset.currency,
-		value: normalized,
-		decimals: asset.decimals
+		negative: match[1] === "-",
+		integer: (scaled / scale).toString(),
+		fraction: (scaled % scale).toString().padStart(maximumFractionDigits, "0"),
+		hadFraction: /[1-9]/.test(sourceFraction)
 	};
 }
 //#endregion
@@ -245,3523 +337,6 @@ function firstAccount(value) {
 	return typeof first === "string" ? first : null;
 }
 //#endregion
-//#region src/dev-signer.ts
-const SESSION_KEY = "capxul.session";
-/**
-* Chains a `local-private-key` signer may sign on. Base Sepolia only, and this
-* list does not grow without an ADR: the keys are deterministic throwaways
-* derived from a shared seed (see `deriveDevPrivateKey`), so anyone holding
-* the seed holds every account. A dev key on a value-bearing chain is a
-* custody incident, not a config mistake.
-*/
-const DEV_KEY_ALLOWED_CHAIN_IDS = [BASE_SEPOLIA_CHAIN_ID];
-/**
-* Testnet fence for the dev-key signing lane (#1149, folds #1065; ADR-0018 P9
-* human/Openfort vs agent/dev-key split). Call it wherever a signer first
-* meets a resolved chain; it refuses before the signer can be used.
-*
-* Only `local-private-key` signers are fenced — Openfort-embedded and injected
-* wallets carry their own custody and are the sanctioned human paths.
-*/
-function assertDevKeySignerIsTestnetOnly(signer, chainId) {
-	if (signer?.source !== "local-private-key") return {
-		ok: true,
-		value: void 0
-	};
-	if (DEV_KEY_ALLOWED_CHAIN_IDS.includes(chainId)) return {
-		ok: true,
-		value: void 0
-	};
-	return {
-		ok: false,
-		error: Errors.invalidInput("signer", `dev-key signer is testnet-only: chain ${chainId} is not allowed (expected ${DEV_KEY_ALLOWED_CHAIN_IDS.join(", ")})`)
-	};
-}
-/** Deterministic dev private key for an email under a seed. Exported for probes. */
-function deriveDevPrivateKey(seed, email) {
-	return keccak256(stringToHex(seed + normalizeBindingEmail(email)));
-}
-function readSessionEmail(storage) {
-	const resolved = storage ?? globalThis.window?.localStorage;
-	if (resolved === void 0) throw new Error("devPrivateKeySigner: no browser localStorage available and no explicit email supplied");
-	const raw = resolved.getItem(SESSION_KEY);
-	if (raw === null) throw new Error("devPrivateKeySigner: no cached session yet — sign in before the account lane uses the signer");
-	let email;
-	try {
-		email = JSON.parse(raw).email;
-	} catch {
-		throw new Error("devPrivateKeySigner: cached session is not valid JSON");
-	}
-	if (typeof email !== "string" || email.length === 0) throw new Error("devPrivateKeySigner: cached session has no email");
-	return email;
-}
-/**
-* Browser-safe dev signer. Lazy: the email (and so the key) is resolved at
-* each `getAddress()` / `signUserOpHash()` from the cached session, so the
-* same signer instance follows whichever user is signed in.
-*/
-function devPrivateKeySigner(input) {
-	if (input.seed.trim().length === 0) throw new Error("devPrivateKeySigner: seed must be non-empty");
-	const accounts = /* @__PURE__ */ new Map();
-	const resolveAccount = () => {
-		const email = normalizeBindingEmail(input.email ?? readSessionEmail(input.storage));
-		const cached = accounts.get(email);
-		if (cached !== void 0) return cached;
-		const account = privateKeyToAccount(deriveDevPrivateKey(input.seed, email));
-		accounts.set(email, account);
-		return account;
-	};
-	return {
-		source: "local-private-key",
-		async getAddress() {
-			return toAddress(resolveAccount().address);
-		},
-		async signUserOpHash(hash) {
-			return resolveAccount().sign({ hash });
-		}
-	};
-}
-//#endregion
-//#region src/ports/embedded-wallet.ts
-function openfortEmbeddedWalletPort(input) {
-	return {
-		async getAddress() {
-			if (input.ensureReady !== void 0) await input.ensureReady();
-			return (await input.embeddedWallet.get()).address;
-		},
-		async signRawDigest(hash) {
-			if (input.ensureReady !== void 0) await input.ensureReady();
-			return await input.embeddedWallet.signMessage(hash, {
-				hashMessage: false,
-				arrayifyMessage: false
-			});
-		}
-	};
-}
-//#endregion
-//#region src/openfort-embedded-signer.ts
-const EVM_ADDRESS_HEX = /^0x[0-9a-fA-F]{40}$/;
-const ECDSA_SIGNATURE_HEX = /^0x[0-9a-fA-F]{130}$/;
-const SAFE_OP_DIGEST_HEX = /^0x[0-9a-fA-F]{64}$/;
-/** Browser helper: wrap an initialized Openfort `embeddedWallet` API. */
-function openfortEmbeddedSignerFromWallet(input) {
-	return openfortEmbeddedSigner({ wallet: openfortEmbeddedWalletPort({
-		embeddedWallet: input.embeddedWallet,
-		...input.ensureWalletReady === void 0 ? {} : { ensureReady: input.ensureWalletReady }
-	}) });
-}
-function openfortEmbeddedSigner(input) {
-	let cachedAddress = null;
-	let addressInFlight = null;
-	let cacheEpoch = 0;
-	const resetAddressCache = () => {
-		cacheEpoch += 1;
-		cachedAddress = null;
-		addressInFlight = null;
-	};
-	const resolveAddress = async () => {
-		if (cachedAddress !== null) return cachedAddress;
-		if (addressInFlight !== null) return addressInFlight;
-		const epoch = cacheEpoch;
-		addressInFlight = (async () => {
-			try {
-				const raw = await input.wallet.getAddress();
-				if (!EVM_ADDRESS_HEX.test(raw)) throw new Error("openfortEmbeddedSigner: embedded wallet returned invalid address format");
-				const address = toAddress(raw);
-				if (epoch === cacheEpoch) cachedAddress = address;
-				return address;
-			} finally {
-				if (epoch === cacheEpoch) addressInFlight = null;
-			}
-		})();
-		return addressInFlight;
-	};
-	return {
-		source: "openfort-embedded",
-		getAddress: resolveAddress,
-		resetAddressCache,
-		async signUserOpHash(hash) {
-			if (!SAFE_OP_DIGEST_HEX.test(hash)) throw new Error("openfortEmbeddedSigner: SafeOp digest must be a 0x-prefixed 32-byte hex");
-			const address = await resolveAddress();
-			let signature;
-			try {
-				signature = await input.wallet.signRawDigest(hash);
-			} catch (cause) {
-				const detail = cause instanceof Error ? cause.message : String(cause);
-				throw new Error(`openfortEmbeddedSigner: raw digest signing failed; ensure the embedded wallet is configured (${detail})`, { cause });
-			}
-			if (!ECDSA_SIGNATURE_HEX.test(signature)) throw new Error("openfortEmbeddedSigner: embedded wallet returned invalid signature format");
-			if ((await recoverRawDigestSigner({
-				hash,
-				signature
-			})).toLowerCase() !== address.toLowerCase()) throw new Error("openfortEmbeddedSigner: signature did not recover the embedded wallet address for the raw SafeOp digest");
-			return signature;
-		}
-	};
-}
-/**
-* Canonical name for the embedded-wallet `CapxulSigner` constructor
-* (backend-orchestrated-deploy.md). The embedded-wallet (passkey / Openfort)
-* member of the named constructor trio `localPrivateKeySigner` /
-* `injectedWalletSigner` / `embeddedSigner`. Takes the provider-agnostic
-* `OpenfortEmbeddedWalletPort` (getAddress + signRawDigest); the Openfort-API
-* convenience wrapper is `openfortEmbeddedSignerFromWallet`.
-*/
-const embeddedSigner = openfortEmbeddedSigner;
-async function recoverRawDigestSigner(input) {
-	try {
-		return toAddress(await recoverAddress(input));
-	} catch (cause) {
-		const detail = cause instanceof Error ? cause.message : String(cause);
-		throw new Error(`openfortEmbeddedSigner: could not verify raw SafeOp digest signature (${detail})`, { cause });
-	}
-}
-//#endregion
-//#region ../observability/src/engineering.ts
-const ENGINEERING_CAPXUL_ENVS = [
-	"development",
-	"staging",
-	"production",
-	"local"
-];
-const traceHeaderFilter = (_name) => true;
-const credentialHeaderPattern = Object.assign(/./u, { test: (name) => isCredentialField(name, "header") });
-const postHogOtlpEndpoints = (host) => {
-	const base = host.replace(/\/+$/, "");
-	return {
-		logs: `${base}/i/v1/logs`,
-		traces: `${base}/i/v1/traces`
-	};
-};
-const ENGINEERING_CAPXUL_ENV_SET = new Set(ENGINEERING_CAPXUL_ENVS);
-const ENGINEERING_PRODUCERS = /* @__PURE__ */ new Set(["browser", "server"]);
-const PUBLIC_POSTHOG_AUTHORIZATION = /^Bearer phc_[A-Za-z0-9_-]{1,191}$/u;
-const SAFE_RESOURCE_VALUE = /^[A-Za-z0-9][A-Za-z0-9._+@/-]{0,127}$/u;
-const validateEngineeringTelemetryConfig = (config) => {
-	let url;
-	try {
-		url = new URL(config.host);
-	} catch {
-		throw new TypeError("engineering telemetry host must be an absolute HTTPS URL");
-	}
-	if (url.protocol !== "https:" || url.username.length > 0 || url.password.length > 0 || url.pathname !== "/" || url.search.length > 0 || url.hash.length > 0 || !(url.hostname === "posthog.com" || url.hostname.endsWith(".posthog.com"))) throw new TypeError("engineering telemetry host must be a credential-free HTTPS origin");
-	if (!ENGINEERING_CAPXUL_ENV_SET.has(config.capxulEnv)) throw new TypeError("engineering telemetry capxulEnv is not canonical");
-	if (!ENGINEERING_PRODUCERS.has(config.producer)) throw new TypeError("engineering telemetry producer is not canonical");
-	if (!SAFE_RESOURCE_VALUE.test(config.sdkVersion)) throw new TypeError("engineering telemetry sdkVersion must be a bounded safe value");
-	if (config.serviceName !== void 0 && !SAFE_RESOURCE_VALUE.test(config.serviceName)) throw new TypeError("engineering telemetry serviceName must be a bounded safe value");
-	const headerEntries = Object.entries(config.headers);
-	if (headerEntries.length !== 1 || headerEntries[0]?.[0].toLowerCase() !== "authorization" || !PUBLIC_POSTHOG_AUTHORIZATION.test(headerEntries[0]?.[1] ?? "")) throw new TypeError("engineering telemetry headers must contain exactly one public PostHog authorization token");
-	return {
-		...config,
-		host: url.origin,
-		headers: Object.freeze({ authorization: headerEntries[0][1] })
-	};
-};
-const failureText = (failure, key, limit, source) => {
-	if (failure === null || typeof failure !== "object") return void 0;
-	try {
-		let owner = failure;
-		let descriptor;
-		for (let depth = 0; owner !== null && depth < 4; depth += 1) {
-			descriptor = Object.getOwnPropertyDescriptor(owner, key);
-			if (descriptor !== void 0 || key !== "name") break;
-			owner = Object.getPrototypeOf(owner);
-		}
-		const value = descriptor?.value;
-		return typeof value === "string" || key === "code" && typeof value === "number" ? redactSecrets(String(value), source).slice(0, limit) : void 0;
-	} catch {
-		return;
-	}
-};
-const exportFailure = (failure, source) => {
-	const message = failureText(failure, "message", 2048, source) ?? (typeof failure === "string" ? redactSecrets(failure, source).slice(0, 2048) : "Engineering operation failed");
-	const code = failureText(failure, "code", 128);
-	const error = new Error((code === void 0 ? message : `${message} [code=${code}]`).slice(0, 2048));
-	error.name = failureText(failure, "_tag", 128) ?? failureText(failure, "name", 128) ?? "Error";
-	error.stack = failureText(failure, "stack", 8192, source) ?? `${error.name}: ${error.message}`;
-	return error;
-};
-const exportFailureExit = (cause, source) => Exit.failCause(Cause.fromReasons(cause.reasons.filter((reason) => !Cause.isInterruptReason(reason)).slice(0, 8).map((reason) => Cause.isFailReason(reason) ? Cause.makeFailReason(exportFailure(reason.error, source)) : Cause.makeDieReason(exportFailure(reason.defect, source)))));
-const BROWSER_KEEPALIVE_BYTES = 65536;
-let unfinishedBrowserExportBytes = 0;
-const hasBrowserDocument = () => typeof window !== "undefined" && typeof document !== "undefined";
-const browserExportClient = (client) => HttpClient.transform(client, (response, request) => Effect.acquireUseRelease(Effect.sync(() => {
-	const bytes = "contentLength" in request.body ? request.body.contentLength : void 0;
-	if (request.body._tag === "Stream" || request.body._tag === "FormData" || bytes === void 0 || !Number.isSafeInteger(bytes) || bytes < 0 || unfinishedBrowserExportBytes + bytes > BROWSER_KEEPALIVE_BYTES) return;
-	unfinishedBrowserExportBytes += bytes;
-	return bytes;
-}), (bytes) => response.pipe(Effect.provideService(FetchHttpClient.RequestInit, { keepalive: bytes !== void 0 }), Effect.tap((result) => bytes === void 0 ? Effect.void : Stream.runDrain(result.stream).pipe(Effect.catch((error) => error.reason._tag === "EmptyBodyError" ? Effect.void : Effect.fail(error))))), (bytes) => Effect.sync(() => {
-	if (bytes !== void 0) unfinishedBrowserExportBytes -= bytes;
-})));
-const spanUpstream = (span) => {
-	let current = span;
-	while (current?._tag === "Span") {
-		const upstream = current.attributes.get("chain.upstream");
-		if (upstream === "alchemy" || upstream === "infura") return upstream;
-		current = current.parent._tag === "Some" ? current.parent.value : void 0;
-	}
-};
-/** Preserve domain exits while preventing the OTLP serializer from seeing raw causes. */
-const makeLeakSafeEngineeringTracer = (delegate) => Tracer.make({
-	span(options) {
-		const span = delegate.span(options);
-		const wrapped = Object.create(span);
-		Object.defineProperty(wrapped, "attribute", { value: (name, value) => {
-			const source = spanUpstream(span);
-			const header = /^http\.(?:request|response)\.header\.(.+)$/u.exec(name)?.[1];
-			if (header !== void 0 && isCredentialField(header, "header")) span.attribute(name, "[REDACTED]");
-			else if (typeof value === "string" && name === "url.query") span.attribute(name, redactUrlSecrets(`?${value}`).slice(1, 2049));
-			else if (typeof value === "string" && name === "url.path") {
-				const fullUrl = span.attributes.get("url.full");
-				const path = typeof fullUrl === "string" ? /^https?:\/\/[^/]+([^?#]*)/u.exec(fullUrl)?.[1] ?? value : value;
-				span.attribute(name, redactUrlSecrets(path, source).slice(0, 2048));
-			} else if (typeof value === "string" && (name === "url.full" || header === "location" || header === "referer" || header === "referrer")) span.attribute(name, redactUrlSecrets(value, source).slice(0, 2048));
-			else if (header !== void 0 && typeof value === "string") span.attribute(name, redactSecrets(value, source).slice(0, 2048));
-			else span.attribute(name, value);
-		} });
-		Object.defineProperty(wrapped, "end", {
-			configurable: false,
-			enumerable: false,
-			value: (endTime, exit) => {
-				if (Exit.isFailure(exit) && !Cause.hasInterruptsOnly(exit.cause)) {
-					const first = exit.cause.reasons.find((reason) => !Cause.isInterruptReason(reason));
-					const code = failureText(first === void 0 ? void 0 : Cause.isFailReason(first) ? first.error : first.defect, "code", 128);
-					if (code !== void 0) span.attribute("error.code", code);
-					span.end(endTime, exportFailureExit(exit.cause, spanUpstream(span)));
-				} else span.end(endTime, exit);
-			},
-			writable: false
-		});
-		return wrapped;
-	},
-	...delegate.context === void 0 ? {} : { context: delegate.context.bind(delegate) }
-});
-/** Shared browser/server OTLP layer. OtlpLogger merges with incumbent loggers once. */
-const makeEngineeringTelemetryLayer = (config) => {
-	const validated = validateEngineeringTelemetryConfig(config);
-	const endpoints = postHogOtlpEndpoints(validated.host);
-	const resource = {
-		serviceName: validated.serviceName ?? "capxul-sdk",
-		serviceVersion: validated.sdkVersion,
-		attributes: {
-			capxul_env: validated.capxulEnv,
-			producer: validated.producer,
-			sdk_version: validated.sdkVersion
-		}
-	};
-	const tracing = Layer.effect(Tracer.Tracer, OtlpTracer.make({
-		url: endpoints.traces,
-		headers: validated.headers,
-		resource
-	}).pipe(Effect.map(makeLeakSafeEngineeringTracer))).pipe(Layer.provideMerge(OtlpExporter.layerFlusher));
-	const logging = OtlpLogger.layer({
-		url: endpoints.logs,
-		headers: validated.headers,
-		resource,
-		mergeWithExisting: true
-	});
-	const headerPolicy = Layer.merge(Layer.succeed(HttpClient.TracerHeaderFilter, traceHeaderFilter), Layer.succeed(Headers.CurrentRedactedNames, [credentialHeaderPattern]));
-	const browserLifecycle = Layer.effectDiscard(Effect.gen(function* () {
-		if (validated.producer !== "browser" || !hasBrowserDocument()) return;
-		const browserWindow = window;
-		const browserDocument = document;
-		const flusher = yield* OtlpExporter.Flusher;
-		const run = yield* FiberSet.makeRuntime();
-		const flush = () => {
-			run(flusher.flush);
-		};
-		const visibilityChanged = () => {
-			if (browserDocument.visibilityState === "hidden") flush();
-		};
-		yield* Effect.acquireRelease(Effect.sync(() => {
-			browserDocument.addEventListener("visibilitychange", visibilityChanged);
-			browserWindow.addEventListener("pagehide", flush);
-		}), () => Effect.sync(() => {
-			browserDocument.removeEventListener("visibilitychange", visibilityChanged);
-			browserWindow.removeEventListener("pagehide", flush);
-		}));
-	}));
-	const transport = Layer.effect(HttpClient.HttpClient, Effect.map(HttpClient.HttpClient, (client) => validated.producer === "browser" && hasBrowserDocument() ? browserExportClient(client) : client)).pipe(Layer.provide(FetchHttpClient.layer));
-	return browserLifecycle.pipe(Layer.provideMerge(Layer.mergeAll(tracing, logging, headerPolicy)), Layer.provide(OtlpSerialization.layerJson), Layer.provide(transport));
-};
-//#endregion
-//#region src/adapters/auth-client/resolve-auth-url.ts
-/** Join bootstrap `authBaseUrl` with a BetterAuth route without duplicating `/api/auth`. */
-function resolveAuthClientUrl(authBaseUrl, path) {
-	const base = authBaseUrl.replace(/\/$/, "");
-	if (base.endsWith("/api/auth") && path.startsWith("/api/auth")) return `${base}${path.slice(9)}`;
-	return `${base}${path}`;
-}
-//#endregion
-//#region src/internal/observation-http.ts
-/** Resolve one bounded pre-auth snapshot for an outbound SDK HTTP request. */
-function observationRequestHeaders(adapter, source) {
-	if (adapter === void 0) return {};
-	try {
-		const invocation = readInvocationObservation(source);
-		if (invocation !== void 0 && !invocation.active) return {};
-		const encoded = encodeObservationContextHeader(invocation === void 0 ? adapter.resolveContext?.() : invocation.context);
-		return encoded === void 0 ? {} : { [OBSERVATION_CONTEXT_HEADER]: encoded };
-	} catch {
-		return {};
-	}
-}
-//#endregion
-//#region src/adapters/auth-client/BetterAuthBrowserAdapter.ts
-function withSignal$1(init, signal) {
-	return signal === void 0 ? init : {
-		...init,
-		signal
-	};
-}
-const DEFAULT_JWT_LIFETIME_S$1 = 900;
-function decodeJwtExp$1(jwt) {
-	const parts = jwt.split(".");
-	if (parts.length < 2 || parts[1] === void 0) return Math.floor(Date.now() / 1e3) + DEFAULT_JWT_LIFETIME_S$1;
-	try {
-		const raw = parts[1].replace(/\s+/g, "");
-		const pad = "=".repeat((4 - raw.length % 4) % 4);
-		const decoded = atob(raw.replace(/-/g, "+").replace(/_/g, "/") + pad);
-		const payload = JSON.parse(decoded);
-		if (typeof payload.exp === "number" && Number.isFinite(payload.exp) && payload.exp > 0) return payload.exp;
-	} catch {}
-	return Math.floor(Date.now() / 1e3) + DEFAULT_JWT_LIFETIME_S$1;
-}
-function authSessionFromBetterAuth$1(token, user) {
-	return {
-		authUserId: toAuthUserId(user.id),
-		email: toEmail(user.email),
-		token: toSessionToken(token),
-		expiresAt: toEpochMs(Date.now() + 6048e5)
-	};
-}
-async function safeJson$1(res) {
-	const raw = await res.text();
-	if (raw.length === 0 || raw === "null") return null;
-	try {
-		return JSON.parse(raw);
-	} catch {
-		return null;
-	}
-}
-function mapBetterAuthError(operation, body) {
-	if (typeof body === "object" && body !== null) {
-		const errBody = body;
-		const code = typeof errBody.code === "string" ? errBody.code : "";
-		if (code === "OTP_EXPIRED") return Errors.otpExpired();
-		if (code === "INVALID_OTP") return Errors.invalidInput("otp", errBody.message ?? "invalid OTP");
-		if (code === "VALIDATION_ERROR" || code === "INVALID_EMAIL") return Errors.invalidInput("email", errBody.message ?? "invalid email");
-	}
-	return Errors.providerError("better-auth", operation, new Error(String(body)));
-}
-function isAbortError$1(err, signal) {
-	return signal?.aborted === true || err instanceof Error && err.name === "AbortError" || typeof DOMException !== "undefined" && err instanceof DOMException && err.name === "AbortError";
-}
-function mapFetchError$1(operation, err, signal) {
-	if (isAbortError$1(err, signal)) return Errors.cancelled({ operation });
-	return Errors.networkError(operation, err instanceof Error ? err : new Error(String(err)));
-}
-var BetterAuthBrowserAdapter = class {
-	authBaseUrl;
-	fetchImpl;
-	observation;
-	constructor(deps) {
-		this.authBaseUrl = deps.authBaseUrl.replace(/\/$/, "");
-		this.observation = deps.observation;
-		this.fetchImpl = deps.fetch ?? ((input, init) => globalThis.fetch(input, init));
-	}
-	url(path) {
-		return resolveAuthClientUrl(this.authBaseUrl, path);
-	}
-	async canSendOtp(_input, options) {
-		if (options?.signal?.aborted) return {
-			ok: false,
-			error: Errors.cancelled({ operation: "canSendOtp" })
-		};
-		return {
-			ok: true,
-			value: {
-				allowed: true,
-				cooldownMs: toDurationMs(0)
-			}
-		};
-	}
-	async sendOtp(input, options) {
-		if (options?.signal?.aborted) return {
-			ok: false,
-			error: Errors.cancelled({ operation: "sendOtp" })
-		};
-		try {
-			const res = await this.fetchImpl(this.url("/api/auth/email-otp/send-verification-otp"), withSignal$1({
-				method: "POST",
-				headers: {
-					"Content-Type": "application/json",
-					...observationRequestHeaders(this.observation, input)
-				},
-				body: JSON.stringify({
-					email: input.email,
-					type: "sign-in"
-				}),
-				credentials: "include"
-			}, options?.signal));
-			if (options?.signal?.aborted) return {
-				ok: false,
-				error: Errors.cancelled({ operation: "sendOtp" })
-			};
-			if (res.ok) return {
-				ok: true,
-				value: void 0
-			};
-			if (res.status === 429) return {
-				ok: false,
-				error: Errors.rateLimited({ resource: "better-auth/sendOtp" })
-			};
-			const body = await safeJson$1(res);
-			if (typeof body === "object" && body !== null) {
-				const errBody = body;
-				if (errBody.code === "INVALID_EMAIL" || errBody.code === "VALIDATION_ERROR") return {
-					ok: false,
-					error: Errors.invalidInput("email", errBody.message ?? "invalid email")
-				};
-			}
-			return {
-				ok: false,
-				error: Errors.providerError("better-auth", "sendOtp", /* @__PURE__ */ new Error(`HTTP ${res.status}`))
-			};
-		} catch (err) {
-			return {
-				ok: false,
-				error: mapFetchError$1("sendOtp", err, options?.signal)
-			};
-		}
-	}
-	async verifyOtp(input, options) {
-		if (options?.signal?.aborted) return {
-			ok: false,
-			error: Errors.cancelled({ operation: "verifyOtp" })
-		};
-		try {
-			const res = await this.fetchImpl(this.url("/api/auth/sign-in/email-otp"), withSignal$1({
-				method: "POST",
-				headers: { "Content-Type": "application/json" },
-				body: JSON.stringify({
-					email: input.email,
-					otp: input.otp
-				}),
-				credentials: "include"
-			}, options?.signal));
-			if (options?.signal?.aborted) return {
-				ok: false,
-				error: Errors.cancelled({ operation: "verifyOtp" })
-			};
-			const body = await safeJson$1(res);
-			if (res.ok) {
-				if (typeof body === "object" && body !== null) {
-					const okBody = body;
-					if (typeof okBody.token === "string" && typeof okBody.user === "object" && okBody.user !== null) return {
-						ok: true,
-						value: authSessionFromBetterAuth$1(okBody.token, okBody.user)
-					};
-				}
-				return {
-					ok: false,
-					error: Errors.providerError("better-auth", "verifyOtp", /* @__PURE__ */ new Error("unexpected 200 body"))
-				};
-			}
-			return {
-				ok: false,
-				error: mapBetterAuthError("verifyOtp", body)
-			};
-		} catch (err) {
-			return {
-				ok: false,
-				error: mapFetchError$1("verifyOtp", err, options?.signal)
-			};
-		}
-	}
-	async getSession(options) {
-		if (options?.signal?.aborted) return {
-			ok: false,
-			error: Errors.cancelled({ operation: "getSession" })
-		};
-		try {
-			const res = await this.fetchImpl(this.url("/api/auth/get-session"), withSignal$1({
-				method: "GET",
-				credentials: "include"
-			}, options?.signal));
-			if (options?.signal?.aborted) return {
-				ok: false,
-				error: Errors.cancelled({ operation: "getSession" })
-			};
-			if (!res.ok) return {
-				ok: false,
-				error: Errors.providerError("better-auth", "getSession", /* @__PURE__ */ new Error(`HTTP ${res.status}`))
-			};
-			const body = await safeJson$1(res);
-			if (body === null) return {
-				ok: true,
-				value: null
-			};
-			if (typeof body === "object" && body !== null) {
-				const okBody = body;
-				if (typeof okBody.user === "object" && okBody.user !== null) return {
-					ok: true,
-					value: authSessionFromBetterAuth$1(okBody.session?.token ?? okBody.session?.id ?? "session", okBody.user)
-				};
-			}
-			return {
-				ok: true,
-				value: null
-			};
-		} catch (err) {
-			return {
-				ok: false,
-				error: mapFetchError$1("getSession", err, options?.signal)
-			};
-		}
-	}
-	async signOut(options) {
-		if (options?.signal?.aborted) return {
-			ok: false,
-			error: Errors.cancelled({ operation: "signOut" })
-		};
-		try {
-			const res = await this.fetchImpl(this.url("/api/auth/sign-out"), withSignal$1({
-				method: "POST",
-				headers: { "Content-Type": "application/json" },
-				body: "{}",
-				credentials: "include"
-			}, options?.signal));
-			if (options?.signal?.aborted) return {
-				ok: false,
-				error: Errors.cancelled({ operation: "signOut" })
-			};
-			if (res.ok) return {
-				ok: true,
-				value: void 0
-			};
-			return {
-				ok: false,
-				error: Errors.providerError("better-auth", "signOut", /* @__PURE__ */ new Error(`HTTP ${res.status}`))
-			};
-		} catch (err) {
-			return {
-				ok: false,
-				error: mapFetchError$1("signOut", err, options?.signal)
-			};
-		}
-	}
-	async getConvexJwt(options) {
-		if (options?.signal?.aborted) return {
-			ok: false,
-			error: Errors.cancelled({ operation: "getConvexJwt" })
-		};
-		try {
-			const res = await this.fetchImpl(this.url("/api/auth/convex/token"), withSignal$1({
-				method: "GET",
-				credentials: "include"
-			}, options?.signal));
-			if (options?.signal?.aborted) return {
-				ok: false,
-				error: Errors.cancelled({ operation: "getConvexJwt" })
-			};
-			if (res.status === 401) return {
-				ok: false,
-				error: Errors.notAuthenticated()
-			};
-			if (!res.ok) return {
-				ok: false,
-				error: Errors.providerError("better-auth", "getConvexJwt", /* @__PURE__ */ new Error(`HTTP ${res.status}`))
-			};
-			const body = await safeJson$1(res);
-			if (typeof body === "object" && body !== null) {
-				const okBody = body;
-				if (typeof okBody.token === "string" && okBody.token.length > 0) return {
-					ok: true,
-					value: {
-						token: toJwtToken(okBody.token),
-						expEpochSeconds: toEpochSeconds(decodeJwtExp$1(okBody.token))
-					}
-				};
-			}
-			return {
-				ok: false,
-				error: Errors.providerError("better-auth", "getConvexJwt", /* @__PURE__ */ new Error("unexpected body"))
-			};
-		} catch (err) {
-			return {
-				ok: false,
-				error: mapFetchError$1("getConvexJwt", err, options?.signal)
-			};
-		}
-	}
-};
-function BetterAuthBrowserLayer(deps) {
-	return Layer.succeed(AuthClientPortTag, authClientPortFromPromiseAdapter(new BetterAuthBrowserAdapter(deps)));
-}
-//#endregion
-//#region src/adapters/auth-client/cookie-jar.ts
-function parseSetCookie(raw) {
-	const parts = raw.split(";").map((p) => p.trim());
-	if (parts.length === 0 || parts[0] === void 0) return null;
-	const nameValue = parts[0];
-	const eq = nameValue.indexOf("=");
-	if (eq < 0) return null;
-	const name = nameValue.slice(0, eq).trim();
-	const value = nameValue.slice(eq + 1).trim();
-	if (name.length === 0) return null;
-	let maxAgeSeconds = null;
-	let expiresEpochMs = null;
-	let path = null;
-	let httpOnly = false;
-	let secure = false;
-	let sameSite = null;
-	for (let i = 1; i < parts.length; i++) {
-		const part = parts[i];
-		if (part === void 0) continue;
-		const partEq = part.indexOf("=");
-		const key = (partEq < 0 ? part : part.slice(0, partEq)).trim().toLowerCase();
-		const val = partEq < 0 ? "" : part.slice(partEq + 1).trim();
-		if (key === "max-age") {
-			const n = Number(val);
-			if (Number.isFinite(n)) maxAgeSeconds = n;
-		} else if (key === "expires") {
-			const t = Date.parse(val);
-			if (Number.isFinite(t)) expiresEpochMs = t;
-		} else if (key === "path") path = val;
-		else if (key === "httponly") httpOnly = true;
-		else if (key === "secure") secure = true;
-		else if (key === "samesite") {
-			const lc = val.toLowerCase();
-			if (lc === "strict" || lc === "lax" || lc === "none") sameSite = lc;
-		}
-	}
-	return {
-		name,
-		value,
-		maxAgeSeconds,
-		expiresEpochMs,
-		path,
-		httpOnly,
-		secure,
-		sameSite
-	};
-}
-function isExpired(cookie, nowEpochMs) {
-	if (cookie.maxAgeSeconds !== null) {
-		if (cookie.maxAgeSeconds <= 0) return true;
-		return nowEpochMs >= cookie.storedAtEpochMs + cookie.maxAgeSeconds * 1e3;
-	}
-	if (cookie.expiresEpochMs !== null) return nowEpochMs >= cookie.expiresEpochMs;
-	return false;
-}
-var CookieJar = class {
-	store = /* @__PURE__ */ new Map();
-	set(host, setCookieHeaders) {
-		let perHost = this.store.get(host);
-		const now = Date.now();
-		for (const raw of setCookieHeaders) {
-			const parsed = parseSetCookie(raw);
-			if (parsed === null) continue;
-			if (perHost === void 0) {
-				perHost = /* @__PURE__ */ new Map();
-				this.store.set(host, perHost);
-			}
-			if (parsed.maxAgeSeconds !== null && parsed.maxAgeSeconds <= 0) {
-				perHost.delete(parsed.name);
-				continue;
-			}
-			perHost.set(parsed.name, {
-				...parsed,
-				storedAtEpochMs: now
-			});
-		}
-		if (perHost !== void 0 && perHost.size === 0) this.store.delete(host);
-	}
-	getCookieHeader(host) {
-		const perHost = this.store.get(host);
-		if (perHost === void 0 || perHost.size === 0) return null;
-		const now = Date.now();
-		const live = [];
-		for (const [name, cookie] of perHost.entries()) {
-			if (isExpired(cookie, now)) {
-				perHost.delete(name);
-				continue;
-			}
-			live.push(`${name}=${cookie.value}`);
-		}
-		if (live.length === 0) {
-			this.store.delete(host);
-			return null;
-		}
-		return live.join("; ");
-	}
-};
-//#endregion
-//#region src/adapters/auth-client/BetterAuthNodeAdapter.ts
-function withSignal(init, signal) {
-	return signal === void 0 ? init : {
-		...init,
-		signal
-	};
-}
-const DEFAULT_JWT_LIFETIME_S = 900;
-function decodeJwtExp(jwt) {
-	const parts = jwt.split(".");
-	if (parts.length < 2 || parts[1] === void 0) return Math.floor(Date.now() / 1e3) + DEFAULT_JWT_LIFETIME_S;
-	try {
-		const raw = parts[1].replace(/\s+/g, "");
-		const pad = "=".repeat((4 - raw.length % 4) % 4);
-		const decoded = Buffer.from(raw.replace(/-/g, "+").replace(/_/g, "/") + pad, "base64").toString("utf-8");
-		const payload = JSON.parse(decoded);
-		if (typeof payload.exp === "number" && Number.isFinite(payload.exp) && payload.exp > 0) return payload.exp;
-	} catch {}
-	return Math.floor(Date.now() / 1e3) + DEFAULT_JWT_LIFETIME_S;
-}
-function authSessionFromBetterAuth(token, user) {
-	return {
-		authUserId: toAuthUserId(user.id),
-		email: toEmail(user.email),
-		token: toSessionToken(token),
-		expiresAt: toEpochMs(Date.now() + 6048e5)
-	};
-}
-async function safeJson(res) {
-	const raw = await res.text();
-	if (raw.length === 0 || raw === "null") return null;
-	try {
-		return JSON.parse(raw);
-	} catch {
-		return null;
-	}
-}
-function hostFromBaseUrl(baseUrl) {
-	try {
-		return new URL(baseUrl).host;
-	} catch {
-		return baseUrl;
-	}
-}
-function originFromBaseUrl(baseUrl) {
-	try {
-		return new URL(baseUrl).origin;
-	} catch {
-		return;
-	}
-}
-function setCookiesFromResponse(jar, host, res) {
-	const ext = res.headers;
-	let setCookies = [];
-	if (typeof ext.getSetCookie === "function") setCookies = ext.getSetCookie();
-	else res.headers.forEach((value, key) => {
-		if (key.toLowerCase() === "set-cookie") setCookies.push(value);
-	});
-	if (setCookies.length > 0) jar.set(host, setCookies);
-}
-function isAbortError(err, signal) {
-	return signal?.aborted === true || err instanceof Error && err.name === "AbortError" || typeof DOMException !== "undefined" && err instanceof DOMException && err.name === "AbortError";
-}
-function mapFetchError(operation, err, signal) {
-	if (isAbortError(err, signal)) return Errors.cancelled({ operation });
-	return Errors.networkError(operation, err instanceof Error ? err : new Error(String(err)));
-}
-var BetterAuthNodeAdapter = class {
-	authBaseUrl;
-	host;
-	origin;
-	cookieJar;
-	fetchImpl;
-	observation;
-	constructor(deps) {
-		this.authBaseUrl = deps.authBaseUrl.replace(/\/$/, "");
-		this.host = hostFromBaseUrl(this.authBaseUrl);
-		this.origin = deps.origin?.replace(/\/$/, "");
-		this.cookieJar = deps.cookieJar ?? new CookieJar();
-		this.fetchImpl = deps.fetch ?? fetch;
-		this.observation = deps.observation;
-	}
-	url(path) {
-		return resolveAuthClientUrl(this.authBaseUrl, path);
-	}
-	headersWithCookie(extra = {}) {
-		const cookie = this.cookieJar.getCookieHeader(this.host);
-		return cookie !== null ? {
-			...extra,
-			cookie
-		} : { ...extra };
-	}
-	async canSendOtp(_input, options) {
-		if (options?.signal?.aborted) return {
-			ok: false,
-			error: Errors.cancelled({ operation: "canSendOtp" })
-		};
-		return {
-			ok: true,
-			value: {
-				allowed: true,
-				cooldownMs: toDurationMs(0)
-			}
-		};
-	}
-	async sendOtp(input, options) {
-		if (options?.signal?.aborted) return {
-			ok: false,
-			error: Errors.cancelled({ operation: "sendOtp" })
-		};
-		try {
-			const res = await this.fetchImpl(this.url("/api/auth/email-otp/send-verification-otp"), withSignal({
-				method: "POST",
-				headers: {
-					"content-type": "application/json",
-					...this.origin ? { origin: this.origin } : {},
-					...observationRequestHeaders(this.observation, input)
-				},
-				body: JSON.stringify({
-					email: input.email,
-					type: "sign-in"
-				})
-			}, options?.signal));
-			if (options?.signal?.aborted) return {
-				ok: false,
-				error: Errors.cancelled({ operation: "sendOtp" })
-			};
-			if (res.ok) return {
-				ok: true,
-				value: void 0
-			};
-			if (res.status === 429) return {
-				ok: false,
-				error: Errors.rateLimited({ resource: "better-auth/sendOtp" })
-			};
-			const body = await safeJson(res);
-			if (typeof body === "object" && body !== null) {
-				const errBody = body;
-				if (errBody.code === "INVALID_EMAIL" || errBody.code === "VALIDATION_ERROR") return {
-					ok: false,
-					error: Errors.invalidInput("email", errBody.message ?? "invalid email")
-				};
-			}
-			return {
-				ok: false,
-				error: Errors.providerError("better-auth", "sendOtp", /* @__PURE__ */ new Error(`HTTP ${res.status}`))
-			};
-		} catch (err) {
-			return {
-				ok: false,
-				error: mapFetchError("sendOtp", err, options?.signal)
-			};
-		}
-	}
-	async verifyOtp(input, options) {
-		if (options?.signal?.aborted) return {
-			ok: false,
-			error: Errors.cancelled({ operation: "verifyOtp" })
-		};
-		try {
-			const res = await this.fetchImpl(this.url("/api/auth/sign-in/email-otp"), withSignal({
-				method: "POST",
-				headers: {
-					"content-type": "application/json",
-					...this.origin ? { origin: this.origin } : {}
-				},
-				body: JSON.stringify({
-					email: input.email,
-					otp: input.otp
-				})
-			}, options?.signal));
-			if (options?.signal?.aborted) return {
-				ok: false,
-				error: Errors.cancelled({ operation: "verifyOtp" })
-			};
-			setCookiesFromResponse(this.cookieJar, this.host, res);
-			const body = await safeJson(res);
-			if (res.ok && typeof body === "object" && body !== null) {
-				const okBody = body;
-				if (typeof okBody.token === "string" && typeof okBody.user === "object" && okBody.user !== null) return {
-					ok: true,
-					value: authSessionFromBetterAuth(okBody.token, okBody.user)
-				};
-			}
-			if (!res.ok) {
-				if (typeof body === "object" && body !== null) {
-					const errBody = body;
-					if (errBody.code === "OTP_EXPIRED") return {
-						ok: false,
-						error: Errors.otpExpired()
-					};
-					if (errBody.code === "INVALID_OTP") return {
-						ok: false,
-						error: Errors.invalidInput("otp", errBody.message ?? "invalid OTP")
-					};
-				}
-			}
-			return {
-				ok: false,
-				error: Errors.providerError("better-auth", "verifyOtp", /* @__PURE__ */ new Error(`HTTP ${res.status}`))
-			};
-		} catch (err) {
-			return {
-				ok: false,
-				error: mapFetchError("verifyOtp", err, options?.signal)
-			};
-		}
-	}
-	async getSession(options) {
-		if (options?.signal?.aborted) return {
-			ok: false,
-			error: Errors.cancelled({ operation: "getSession" })
-		};
-		try {
-			const res = await this.fetchImpl(this.url("/api/auth/get-session"), withSignal({
-				method: "GET",
-				headers: this.headersWithCookie()
-			}, options?.signal));
-			if (options?.signal?.aborted) return {
-				ok: false,
-				error: Errors.cancelled({ operation: "getSession" })
-			};
-			if (!res.ok) return {
-				ok: false,
-				error: Errors.providerError("better-auth", "getSession", /* @__PURE__ */ new Error(`HTTP ${res.status}`))
-			};
-			const body = await safeJson(res);
-			if (body === null) return {
-				ok: true,
-				value: null
-			};
-			if (typeof body === "object" && body !== null) {
-				const okBody = body;
-				if (typeof okBody.user === "object" && okBody.user !== null) return {
-					ok: true,
-					value: authSessionFromBetterAuth(okBody.session?.token ?? okBody.session?.id ?? "session", okBody.user)
-				};
-			}
-			return {
-				ok: true,
-				value: null
-			};
-		} catch (err) {
-			return {
-				ok: false,
-				error: mapFetchError("getSession", err, options?.signal)
-			};
-		}
-	}
-	async signOut(options) {
-		if (options?.signal?.aborted) return {
-			ok: false,
-			error: Errors.cancelled({ operation: "signOut" })
-		};
-		try {
-			const signOutOrigin = originFromBaseUrl(this.authBaseUrl) ?? this.origin;
-			const res = await this.fetchImpl(this.url("/api/auth/sign-out"), withSignal({
-				method: "POST",
-				headers: this.headersWithCookie({
-					"content-type": "application/json",
-					...signOutOrigin ? { origin: signOutOrigin } : {}
-				}),
-				body: "{}"
-			}, options?.signal));
-			if (options?.signal?.aborted) return {
-				ok: false,
-				error: Errors.cancelled({ operation: "signOut" })
-			};
-			setCookiesFromResponse(this.cookieJar, this.host, res);
-			if (res.ok) return {
-				ok: true,
-				value: void 0
-			};
-			return {
-				ok: false,
-				error: Errors.providerError("better-auth", "signOut", /* @__PURE__ */ new Error(`HTTP ${res.status}`))
-			};
-		} catch (err) {
-			return {
-				ok: false,
-				error: mapFetchError("signOut", err, options?.signal)
-			};
-		}
-	}
-	async getConvexJwt(options) {
-		if (options?.signal?.aborted) return {
-			ok: false,
-			error: Errors.cancelled({ operation: "getConvexJwt" })
-		};
-		try {
-			const res = await this.fetchImpl(this.url("/api/auth/convex/token"), withSignal({
-				method: "GET",
-				headers: this.headersWithCookie()
-			}, options?.signal));
-			if (options?.signal?.aborted) return {
-				ok: false,
-				error: Errors.cancelled({ operation: "getConvexJwt" })
-			};
-			if (res.status === 401) return {
-				ok: false,
-				error: Errors.notAuthenticated()
-			};
-			if (!res.ok) return {
-				ok: false,
-				error: Errors.providerError("better-auth", "getConvexJwt", /* @__PURE__ */ new Error(`HTTP ${res.status}`))
-			};
-			const body = await safeJson(res);
-			if (typeof body === "object" && body !== null) {
-				const okBody = body;
-				if (typeof okBody.token === "string" && okBody.token.length > 0) return {
-					ok: true,
-					value: {
-						token: toJwtToken(okBody.token),
-						expEpochSeconds: toEpochSeconds(decodeJwtExp(okBody.token))
-					}
-				};
-			}
-			return {
-				ok: false,
-				error: Errors.providerError("better-auth", "getConvexJwt", /* @__PURE__ */ new Error("unexpected body"))
-			};
-		} catch (err) {
-			return {
-				ok: false,
-				error: mapFetchError("getConvexJwt", err, options?.signal)
-			};
-		}
-	}
-};
-function BetterAuthNodeLayer(deps) {
-	return Layer.succeed(AuthClientPortTag, authClientPortFromPromiseAdapter(new BetterAuthNodeAdapter(deps)));
-}
-//#endregion
-//#region src/adapters/bootstrap/HttpBootstrapAdapter.ts
-const DEFAULT_RETRY = {
-	attempts: 2,
-	baseDelayMs: 400
-};
-/** Request-side statuses a proxy or backend returns while momentarily unable to serve. */
-const TRANSIENT_HTTP_STATUSES = /* @__PURE__ */ new Set([
-	408,
-	425,
-	429
-]);
-/** Every 5xx is a server-side condition worth one more try; the client sent nothing wrong. */
-function isTransientHttpStatus(status) {
-	return status >= 500 || TRANSIENT_HTTP_STATUSES.has(status);
-}
-/**
-* A transient HTTP status is worth one more try. The bootstrap call crosses
-* the host's own proxy before it reaches Convex, and every observed failure
-* of that hop cleared on a retry seconds later. A network rejection (offline,
-* DNS, CORS) is not retried: it does not clear in a second, and the caller
-* surfaces it as `NETWORK_ERROR` at once. Auth and input rejections are
-* deterministic and never retried.
-*/
-function isTransientBootstrapFailure(error) {
-	if (error.kind !== "provider") return false;
-	const status = error.details?.httpStatus;
-	return typeof status === "number" && isTransientHttpStatus(status);
-}
-async function safeText(res) {
-	try {
-		return await res.text();
-	} catch {
-		return "";
-	}
-}
-var HttpBootstrapAdapter = class {
-	bootstrapBaseUrl;
-	bootstrapHost;
-	fetchImpl;
-	observation;
-	retry;
-	constructor(deps) {
-		this.bootstrapBaseUrl = deps.bootstrapBaseUrl.replace(/\/$/, "");
-		this.bootstrapHost = hostOf(this.bootstrapBaseUrl);
-		this.observation = deps.observation;
-		this.retry = deps.retry ?? DEFAULT_RETRY;
-		this.fetchImpl = deps.fetch ?? ((input, init) => globalThis.fetch(input, init));
-	}
-	resolve(input) {
-		return this.attempt(input).pipe(Effect.retry({
-			times: this.retry.attempts,
-			while: isTransientBootstrapFailure,
-			schedule: Schedule.exponential(Duration.millis(this.retry.baseDelayMs))
-		}));
-	}
-	attempt(input) {
-		return Effect.tryPromise({
-			try: () => {
-				const headers = {
-					"content-type": "application/json",
-					...input.origin === void 0 ? {} : { origin: input.origin },
-					...observationRequestHeaders(this.observation)
-				};
-				return this.fetchImpl(`${this.bootstrapBaseUrl}/v1/client/bootstrap`, {
-					method: "POST",
-					headers,
-					body: JSON.stringify({ publishableKey: input.publishableKey })
-				});
-			},
-			catch: (cause) => bootstrapErrorFromCapxul("network", Errors.networkError("bootstrap", cause, {
-				provider: "bootstrap",
-				failure_mode: "upstream-down",
-				...this.bootstrapHost === void 0 ? {} : { target_host: this.bootstrapHost }
-			}))
-		}).pipe(Effect.flatMap((res) => this.mapResponse(res)));
-	}
-	mapResponse(res) {
-		if (res.ok) return Effect.tryPromise({
-			try: async () => {
-				const body = await res.json();
-				const state = typeof body === "object" && body !== null && "state" in body && typeof body.state === "object" && body.state !== null ? body.state : void 0;
-				const rawEngineeringTelemetry = state?.engineeringTelemetry;
-				const baseBody = state === void 0 || rawEngineeringTelemetry === void 0 ? body : {
-					...body,
-					state: Object.fromEntries(Object.entries(state).filter(([key]) => key !== "engineeringTelemetry"))
-				};
-				const decoded = SchemaParser.decodeUnknownResult(BootstrapEnvelope)(baseBody);
-				if (Result.isFailure(decoded)) throw Errors.invalidInput("bootstrapEnvelope", SchemaIssue.makeFormatterDefault()(decoded.failure));
-				const { state: decodedState } = decoded.success;
-				const decodedEngineeringTelemetry = rawEngineeringTelemetry === void 0 ? void 0 : SchemaParser.decodeUnknownResult(EngineeringTelemetryBootstrapPolicy)(rawEngineeringTelemetry, { onExcessProperty: "error" });
-				return {
-					applicationId: decodedState.applicationId,
-					chainId: decodedState.chainId,
-					sessionToken: decodedState.sessionToken,
-					issuedAt: decodedState.issuedAt,
-					expiresIn: decodedState.expiresIn,
-					authBaseUrl: normalizeRuntimeUrl("authBaseUrl", decodedState.authBaseUrl),
-					convexUrl: normalizeRuntimeUrl("convexUrl", decodedState.convexUrl),
-					siteBaseUrl: normalizeRuntimeUrl("siteBaseUrl", decodedState.siteBaseUrl),
-					openfortPublishableKey: decodedState.openfortPublishableKey,
-					shieldPublishableKey: decodedState.shieldPublishableKey,
-					...decodedEngineeringTelemetry !== void 0 && Result.isSuccess(decodedEngineeringTelemetry) ? { engineeringTelemetry: decodedEngineeringTelemetry.success } : {}
-				};
-			},
-			catch: (cause) => {
-				if (cause instanceof CapxulError && cause.code === "INVALID_INPUT") return bootstrapErrorFromCapxul("invalidInput", cause);
-				return bootstrapErrorFromCapxul("malformedBody", Errors.providerError("convex", "bootstrap", cause instanceof Error ? cause : new Error(String(cause))));
-			}
-		});
-		return Effect.promise(() => safeText(res)).pipe(Effect.flatMap((body) => {
-			if (res.status === 401 || body.startsWith("NOT_AUTHENTICATED")) return Effect.fail(bootstrapErrorFromCapxul("notAuthenticated", Errors.notAuthenticated()));
-			if (res.status === 400 || body.startsWith("INVALID_INPUT")) return Effect.fail(bootstrapErrorFromCapxul("invalidInput", Errors.invalidInput("publishableKey", "rejected by bootstrap")));
-			const responseBody = body.slice(0, 300);
-			const edgeError = res.headers?.get?.("x-vercel-error") ?? void 0;
-			const edgeRequestId = res.headers?.get?.("x-vercel-id") ?? void 0;
-			return Effect.fail(bootstrapErrorFromCapxul("provider", Errors.providerError("convex", "bootstrap", /* @__PURE__ */ new Error(`HTTP ${res.status}${edgeError === void 0 ? "" : ` ${edgeError}`}`), {
-				httpStatus: res.status,
-				details: {
-					...responseBody.length === 0 ? {} : { responseBody },
-					...edgeError === void 0 ? {} : { edgeError },
-					...edgeRequestId === void 0 ? {} : { edgeRequestId }
-				}
-			})));
-		}));
-	}
-};
-function HttpBootstrapLayer(deps) {
-	return Layer.succeed(BootstrapPortTag, new HttpBootstrapAdapter(deps));
-}
-function hostOf(url) {
-	try {
-		return new URL(url).hostname;
-	} catch {
-		return;
-	}
-}
-function normalizeRuntimeUrl(field, raw) {
-	let parsed;
-	try {
-		parsed = new URL(raw);
-	} catch {
-		throw Errors.invalidInput(field, "must be an http or https URL");
-	}
-	if (parsed.protocol !== "http:" && parsed.protocol !== "https:") throw Errors.invalidInput(field, "must be an http or https URL");
-	return parsed.toString().replace(/\/$/, "");
-}
-//#endregion
-//#region src/adapters/convex-call/convex-connection-monitor.ts
-var ConvexConnectionMonitor = class {
-	#connectionId = makeConnectionId();
-	#browser = new BrowserLifecycleMonitor();
-	#lastClose;
-	observedWebSocketConstructor() {
-		const NativeWebSocket = globalThis.WebSocket;
-		if (typeof globalThis.window === "undefined" || NativeWebSocket === void 0) return void 0;
-		return new Proxy(NativeWebSocket, { construct: (Target, args) => {
-			const socket = Reflect.construct(Target, args);
-			socket.addEventListener("close", (event) => {
-				this.#lastClose = this.#browser.socketClose(event);
-			});
-			return socket;
-		} });
-	}
-	close() {
-		this.#browser.close();
-	}
-	observe(client, observer) {
-		const subscribe = client.subscribeToConnectionState?.bind(client);
-		if (subscribe === void 0) return () => this.#browser.close();
-		let previous;
-		const unsubscribe = subscribe((next) => {
-			const diagnostics = this.#diagnostics(previous, next);
-			previous = next;
-			for (const diagnostic of diagnostics) emitDiagnostic(observer, diagnostic);
-		});
-		if (previous === void 0) {
-			const current = safeConnectionState(client);
-			if (current !== void 0) {
-				previous = current;
-				for (const diagnostic of this.#diagnostics(void 0, current)) emitDiagnostic(observer, diagnostic);
-			}
-		}
-		let closed = false;
-		return () => {
-			if (closed) return;
-			closed = true;
-			try {
-				unsubscribe();
-			} finally {
-				this.#browser.close();
-			}
-		};
-	}
-	reconnectEvidence(start, end) {
-		if (!connectionRestarted(start, end)) return void 0;
-		return {
-			kind: "connection-lost-in-flight",
-			connection_id: this.#connectionId,
-			start_connection_count: start.connectionCount,
-			connection_count: end.connectionCount,
-			...end.connectionRetries === void 0 ? {} : { connection_retries: end.connectionRetries },
-			...closeFields(this.#lastClose)
-		};
-	}
-	#diagnostics(previous, next) {
-		const transitions = connectionTransitions(previous, next);
-		if (transitions.length === 0) return [];
-		const oldest = next.timeOfOldestInflightRequest;
-		const oldestInflightMs = oldest instanceof Date && Number.isFinite(oldest.getTime()) ? Math.max(0, Date.now() - oldest.getTime()) : void 0;
-		return transitions.map((transition) => ({
-			connection_id: this.#connectionId,
-			transition,
-			previous_connected: previous?.isWebSocketConnected ?? false,
-			connected: next.isWebSocketConnected,
-			...next.hasEverConnected === void 0 ? {} : { has_ever_connected: next.hasEverConnected },
-			connection_count: next.connectionCount,
-			...next.connectionRetries === void 0 ? {} : { connection_retries: next.connectionRetries },
-			...next.hasInflightRequests === void 0 ? {} : { has_inflight_requests: next.hasInflightRequests },
-			...next.inflightActions === void 0 ? {} : { inflight_actions: next.inflightActions },
-			...next.inflightMutations === void 0 ? {} : { inflight_mutations: next.inflightMutations },
-			...oldestInflightMs === void 0 ? {} : { oldest_inflight_ms: oldestInflightMs },
-			...closeFields(this.#lastClose)
-		}));
-	}
-};
-function connectionRestarted(start, end) {
-	if (start === void 0 || end === void 0) return false;
-	const opensBeforeCancellation = start.isWebSocketConnected ? 1 : 2;
-	return end.connectionCount >= start.connectionCount + opensBeforeCancellation;
-}
-function connectionTransitions(previous, next) {
-	if (previous === void 0) {
-		if (next.isWebSocketConnected) return (next.connectionRetries ?? 0) > 0 ? ["retrying", "connected"] : ["connected"];
-		return (next.connectionRetries ?? 0) > 0 ? ["disconnected", "retrying"] : [];
-	}
-	const transitions = [];
-	if (previous.isWebSocketConnected !== next.isWebSocketConnected) transitions.push(next.isWebSocketConnected ? "connected" : "disconnected");
-	if ((next.connectionRetries ?? 0) > (previous.connectionRetries ?? 0)) transitions.push("retrying");
-	return transitions;
-}
-function emitDiagnostic(observer, diagnostic) {
-	try {
-		observer(diagnostic);
-	} catch {}
-}
-function safeConnectionState(client) {
-	try {
-		return client.connectionState?.();
-	} catch {
-		return;
-	}
-}
-function closeFields(close) {
-	if (close === void 0) return {};
-	return {
-		close_code: close.code,
-		close_was_clean: close.wasClean,
-		close_reason_present: close.reasonPresent,
-		...close.documentVisibility === void 0 ? {} : { document_visibility: close.documentVisibility },
-		...close.navigatorOnline === void 0 ? {} : { navigator_online: close.navigatorOnline },
-		...close.browserEvent === void 0 ? {} : { last_browser_event: close.browserEvent },
-		...close.msSinceBrowserEvent === void 0 ? {} : { ms_since_browser_event: close.msSinceBrowserEvent }
-	};
-}
-var BrowserLifecycleMonitor = class {
-	#listeners = [];
-	#last = {};
-	constructor() {
-		const windowTarget = eventTarget(globalThis.window);
-		const documentTarget = eventTarget(globalThis.document);
-		if (windowTarget === void 0 || documentTarget === void 0) return;
-		this.#listen(documentTarget, "visibilitychange", () => {
-			this.#record(globalThis.document?.visibilityState === "hidden" ? "visibility-hidden" : "visibility-visible");
-		});
-		this.#listen(windowTarget, "pagehide", () => this.#record("pagehide"));
-		this.#listen(windowTarget, "pageshow", () => this.#record("pageshow"));
-		this.#listen(windowTarget, "online", () => this.#record("online"));
-		this.#listen(windowTarget, "offline", () => this.#record("offline"));
-	}
-	socketClose(event) {
-		const now = Date.now();
-		return {
-			code: event.code,
-			wasClean: event.wasClean,
-			reasonPresent: event.reason.length > 0,
-			...this.#last.event === void 0 ? {} : { browserEvent: this.#last.event },
-			...this.#last.at === void 0 ? {} : { msSinceBrowserEvent: Math.max(0, now - this.#last.at) },
-			...globalThis.document?.visibilityState === void 0 ? {} : { documentVisibility: globalThis.document.visibilityState },
-			...globalThis.navigator?.onLine === void 0 ? {} : { navigatorOnline: globalThis.navigator.onLine }
-		};
-	}
-	close() {
-		for (const [target, name, listener] of this.#listeners) target.removeEventListener(name, listener);
-		this.#listeners.length = 0;
-	}
-	#listen(target, name, listener) {
-		target.addEventListener(name, listener);
-		this.#listeners.push([
-			target,
-			name,
-			listener
-		]);
-	}
-	#record(event) {
-		this.#last = {
-			event,
-			at: Date.now()
-		};
-	}
-};
-function eventTarget(value) {
-	if (typeof value !== "object" || value === null || !("addEventListener" in value) || typeof value.addEventListener !== "function" || !("removeEventListener" in value) || typeof value.removeEventListener !== "function") return;
-	return value;
-}
-let fallbackConnectionId = 0;
-function makeConnectionId() {
-	try {
-		return `convex_${globalThis.crypto.randomUUID()}`;
-	} catch {
-		fallbackConnectionId += 1;
-		return `convex_${Date.now().toString(36)}_${fallbackConnectionId.toString(36)}`;
-	}
-}
-//#endregion
-//#region src/adapters/convex-call/ConvexCallAdapter.ts
-/** Exact floor-first allowlist; every additional handler must migrate its validator first. */
-const OBSERVED_CONVEX_ACTIONS = /* @__PURE__ */ new Set([
-	"payroll/actions:authorizeRun",
-	"account/actions:readBalance",
-	"holdings/actions:current",
-	"smartAccount/actions:claim",
-	"org/actions:prepareFounderAccount",
-	"org/actions:prepareBootstrap",
-	"org/actions:submitBootstrap",
-	"org/actions:resumeBootstrapSubmission",
-	"org/actions:confirmBootstrap",
-	"org/actions:readTreasury",
-	"moneyExecution/actions:preparePaymentExecution",
-	"moneyExecution/actions:abandonPaymentExecution",
-	"moneyExecution/actions:submitPaymentExecution",
-	"moneyExecution/paymentCommandActions:preparePaymentLifecycleExecution",
-	"moneyExecution/paymentCommandActions:prepareOrganizationPaymentExecution",
-	"moneyExecution/paymentCommandActions:submitPaymentCommandExecution"
-]);
-const OBSERVED_CONVEX_QUERIES = /* @__PURE__ */ new Set([
-	"movement/activity:list",
-	"movement/activity:summary",
-	"movement/activity:get",
-	"financialOps/queries:depositInstructions",
-	"financialOps/destinations:list",
-	"financialOps/queries:verifyPaymentDocument",
-	"financialOps/queries:renderStoredDocument",
-	"financialOps/addressBook:list",
-	"financialOps/addressBook:get",
-	"financialOps/requestsInbox:list",
-	"financialOps/requestsInbox:get",
-	"financialOps/requestsInbox:inboxList",
-	"payroll/queries:runs",
-	"payroll/queries:groups",
-	"payroll/queries:terms",
-	"financialOps/queries:resolveRecipient",
-	"identity/queries:loadByAuthUserId",
-	"smartAccount/queries:loadByAuthUserId",
-	"org/lifecycle:load"
-]);
-const OBSERVED_CONVEX_MUTATIONS = /* @__PURE__ */ new Set([
-	"movement/activity:annotate",
-	"financialOps/destinations:add",
-	"financialOps/destinations:remove",
-	"financialOps/addressBook:add",
-	"financialOps/addressBook:hide",
-	"financialOps/addressBook:unhide",
-	"financialOps/addressBook:label",
-	"financialOps/requestsInbox:issue",
-	"financialOps/requestsInbox:cancel",
-	"financialOps/requestsInbox:approve",
-	"financialOps/requestsInbox:decline",
-	"payroll/mutations:saveGroup",
-	"payroll/mutations:removeGroup",
-	"identity/mutations:create",
-	"identity/mutations:update",
-	"identity/mutations:completeOnboarding",
-	"smartAccount/mutations:provision",
-	"org/lifecycle:startOrResume",
-	"org/lifecycle:recordFailure",
-	"org/lifecycle:retry"
-]);
-var ConvexCallAdapter = class {
-	#client;
-	#tokenProvider;
-	#applicationId;
-	#observation;
-	#connectionMonitor;
-	constructor(deps) {
-		this.#connectionMonitor = new ConvexConnectionMonitor();
-		const webSocketConstructor = this.#connectionMonitor.observedWebSocketConstructor();
-		this.#client = deps.client ?? new ConvexClient(deps.convexUrl, webSocketConstructor === void 0 ? {} : { webSocketConstructor });
-		this.#tokenProvider = deps.tokenProvider;
-		this.#applicationId = deps.applicationId;
-		this.#observation = deps.observation;
-		if (this.#tokenProvider) this.#client.setAuth(this.#tokenProvider);
-	}
-	refreshAuth() {
-		if (this.#tokenProvider) this.#client.setAuth(this.#tokenProvider);
-	}
-	observeConnection(observer) {
-		return this.#connectionMonitor.observe(this.#client, observer);
-	}
-	query(fn, args) {
-		const path = getFunctionName(fn);
-		return Effect.serviceOption(Tracer.ParentSpan).pipe(Effect.flatMap((parent) => {
-			const traceparent = parent._tag === "Some" ? formatTraceparent(parent.value) : void 0;
-			return Effect.tryPromise({
-				try: () => this.#client.query(fn, this.#observedArgs(OBSERVED_CONVEX_QUERIES, path, args, traceparent)),
-				catch: (cause) => mapToConvexCallError(path, cause)
-			});
-		}));
-	}
-	mutation(fn, args) {
-		const path = getFunctionName(fn);
-		return Effect.serviceOption(Tracer.ParentSpan).pipe(Effect.flatMap((parent) => {
-			const traceparent = parent._tag === "Some" ? formatTraceparent(parent.value) : void 0;
-			return Effect.tryPromise({
-				try: () => this.#client.mutation(fn, this.#observedArgs(OBSERVED_CONVEX_MUTATIONS, path, args, traceparent)),
-				catch: (cause) => mapToConvexCallError(path, cause)
-			});
-		}));
-	}
-	action(fn, args) {
-		const path = getFunctionName(fn);
-		return Effect.serviceOption(Tracer.ParentSpan).pipe(Effect.flatMap((parent) => {
-			const traceparent = parent._tag === "Some" ? formatTraceparent(parent.value) : void 0;
-			const connectionAtStart = connectionState(this.#client);
-			return Effect.tryPromise({
-				try: () => this.#client.action(fn, this.#observedArgs(OBSERVED_CONVEX_ACTIONS, path, args, traceparent)),
-				catch: (cause) => {
-					const transport = this.#connectionMonitor.reconnectEvidence(connectionAtStart, connectionState(this.#client));
-					return mapToConvexCallError(path, cause, transport);
-				}
-			}).pipe(Effect.tapError((error) => logActionTransportFailure(path, error)));
-		}));
-	}
-	#observedArgs(allowlist, path, args, traceparent) {
-		if (!allowlist.has(path)) return args;
-		const carriedContext = sanitizeObservationContext(args.observationContext);
-		let hostContext;
-		const invocationSnapshot = readInvocationObservation(args);
-		if (invocationSnapshot !== void 0) hostContext = invocationSnapshot.active ? invocationSnapshot.context : void 0;
-		else {
-			const resolveContext = this.#observation?.resolveContext;
-			if (resolveContext !== void 0) try {
-				hostContext = resolveContext();
-			} catch {
-				hostContext = void 0;
-			}
-		}
-		if (hostContext === void 0 && carriedContext === void 0 && traceparent === void 0) return args;
-		hostContext = sanitizeObservationContext({
-			...hostContext,
-			...carriedContext,
-			...this.#applicationId === void 0 ? {} : { applicationId: this.#applicationId },
-			...traceparent === void 0 ? {} : { traceparent }
-		});
-		if (hostContext === void 0) return args;
-		return {
-			...args,
-			observationContext: hostContext
-		};
-	}
-	subscribe(fn, args, callback) {
-		return Effect.try({
-			try: () => {
-				const path = getFunctionName(fn);
-				const unsubscribe = this.#client.onUpdate(fn, args, (value) => callback({
-					status: "ok",
-					value
-				}), (err) => callback({
-					status: "error",
-					error: mapToCapxulError(path, err)
-				}));
-				let active = true;
-				return () => {
-					if (!active) return;
-					active = false;
-					unsubscribe();
-				};
-			},
-			catch: (cause) => mapToConvexCallError(getFunctionName(fn), cause)
-		}).pipe(Effect.tap(() => Effect.sync(() => {
-			callback({ status: "loading" });
-		})));
-	}
-	async close() {
-		this.#connectionMonitor.close();
-		await this.#client.close();
-	}
-};
-function ConvexCallLayer(deps) {
-	return Layer.effect(ConvexCallPortTag, Effect.acquireRelease(Effect.sync(() => new ConvexCallAdapter(deps)), (adapter) => Effect.promise(() => adapter.close()).pipe(Effect.orDie)));
-}
-function mapToCapxulError(operation, err, transport) {
-	const decoded = decodeConvexError(err);
-	if (decoded !== null) return decoded;
-	if (err instanceof CapxulError) return err;
-	if (transport !== void 0) {
-		const { kind: _kind, start_connection_count: _start, ...connection } = transport;
-		return Errors.networkError(operation, err, {
-			provider: "convex",
-			failure_mode: "upstream-down",
-			reason: "connection-lost-in-flight",
-			...connection
-		});
-	}
-	if (err instanceof Error) {
-		if (isTransportError(err)) return Errors.networkError(operation, err, { provider: "convex" });
-		return Errors.providerError("convex", operation, err);
-	}
-	return Errors.providerError("convex", operation, new Error(String(err)));
-}
-function mapToConvexCallError(operation, err, transport) {
-	return convexCallErrorFromCapxul(operation, mapToCapxulError(operation, err, transport), transport);
-}
-function connectionState(client) {
-	try {
-		const state = client.connectionState?.();
-		return typeof state?.connectionCount === "number" ? state : void 0;
-	} catch {
-		return;
-	}
-}
-function logActionTransportFailure(operation, error) {
-	if (error.transport === void 0) return Effect.void;
-	const { kind, ...connection } = error.transport;
-	return Effect.logWarning("convex.action.connection_lost").pipe(Effect.annotateLogs({
-		operation,
-		failure_mode: "upstream-down",
-		reason: kind,
-		...connection
-	}), Effect.catchCause(() => Effect.void));
-}
-const TRANSPORT_ERROR_CODES = /* @__PURE__ */ new Set([
-	"EAI_AGAIN",
-	"ECONNREFUSED",
-	"ECONNRESET",
-	"ENOTFOUND",
-	"EPIPE",
-	"ETIMEDOUT",
-	"UND_ERR_CONNECT_TIMEOUT",
-	"UND_ERR_HEADERS_TIMEOUT",
-	"UND_ERR_SOCKET"
-]);
-function isTransportError(err) {
-	const seen = /* @__PURE__ */ new Set();
-	let current = err;
-	while (current !== void 0 && !seen.has(current)) {
-		seen.add(current);
-		const code = current.code;
-		if (current.name === "FetchError" || current.name === "NetworkError" || typeof code === "string" && TRANSPORT_ERROR_CODES.has(code)) return true;
-		current = current.cause instanceof Error ? current.cause : void 0;
-	}
-	return false;
-}
-//#endregion
-//#region src/adapters/identity/ConvexIdentityAdapter.ts
-const identityLoadByAuthUserIdQuery = makeFunctionReference(CAPXUL_FUNCTIONS["identity/queries"].loadByAuthUserId);
-const identityCreateMutation = makeFunctionReference(CAPXUL_FUNCTIONS["identity/mutations"].create);
-const identityUpdateMutation = makeFunctionReference(CAPXUL_FUNCTIONS["identity/mutations"].update);
-const identityCompleteOnboardingMutation = makeFunctionReference(CAPXUL_FUNCTIONS["identity/mutations"].completeOnboarding);
-var ConvexIdentityAdapter = class {
-	#convex;
-	constructor(deps) {
-		this.#convex = deps.convex;
-	}
-	loadByAuthUserId(authUserId) {
-		return this.#convex.query(identityLoadByAuthUserIdQuery, { authUserId }).pipe(Effect.mapError((error) => identityErrorFromCapxul("loadByAuthUserId", error.publicError, error)), Effect.flatMap((row) => Effect.try({
-			try: () => row === null ? null : brandProfile(row),
-			catch: (cause) => identityErrorFromUnknown("loadByAuthUserId", cause)
-		})), Effect.catchDefect((cause) => Effect.fail(identityErrorFromUnknown("loadByAuthUserId", cause))));
-	}
-	create(input) {
-		return this.#convex.mutation(identityCreateMutation, input).pipe(Effect.mapError((error) => identityErrorFromCapxul("create", error.publicError, error)), Effect.flatMap((row) => Effect.try({
-			try: () => brandProfile(row),
-			catch: (cause) => identityErrorFromUnknown("create", cause)
-		})), Effect.catchDefect((cause) => Effect.fail(identityErrorFromUnknown("create", cause))));
-	}
-	update(input) {
-		return this.#convex.mutation(identityUpdateMutation, input).pipe(Effect.mapError((error) => identityErrorFromCapxul("update", error.publicError, error)), Effect.flatMap((row) => Effect.try({
-			try: () => brandProfile(row),
-			catch: (cause) => identityErrorFromUnknown("update", cause)
-		})), Effect.catchDefect((cause) => Effect.fail(identityErrorFromUnknown("update", cause))));
-	}
-	completeOnboarding(input) {
-		return this.#convex.mutation(identityCompleteOnboardingMutation, input).pipe(Effect.mapError((error) => identityErrorFromCapxul("completeOnboarding", error.publicError, error)), Effect.flatMap((row) => Effect.try({
-			try: () => brandProfile(row),
-			catch: (cause) => identityErrorFromUnknown("completeOnboarding", cause)
-		})), Effect.catchDefect((cause) => Effect.fail(identityErrorFromUnknown("completeOnboarding", cause))));
-	}
-};
-function ConvexIdentityLayer() {
-	return Layer.effect(IdentityPortTag, Effect.map(ConvexCallPortTag, (convex) => new ConvexIdentityAdapter({ convex })));
-}
-function brandProfile(raw) {
-	return {
-		authUserId: toAuthUserId(raw.authUserId),
-		...raw.testerKind === void 0 ? {} : { testerKind: toTesterKind(raw.testerKind) },
-		email: toEmail(raw.email),
-		displayName: raw.displayName,
-		country: raw.country === null ? null : toCountryCode(raw.country),
-		onboarded: raw.onboarded ?? false,
-		withdrawalAddress: raw.withdrawalAddress === null || raw.withdrawalAddress === void 0 ? null : toAddress(raw.withdrawalAddress),
-		handle: raw.handle === null || raw.handle === void 0 ? null : toHandle(raw.handle),
-		imageUrl: raw.imageUrl ?? null,
-		kycTier: toKycTier(raw.kycTier),
-		createdAt: toEpochMs(raw.createdAt),
-		updatedAt: toEpochMs(raw.updatedAt)
-	};
-}
-function identityErrorFromUnknown(operation, cause) {
-	if (cause instanceof CapxulError) return identityErrorFromCapxul(operation, cause);
-	return identityErrorFromCapxul(operation, Errors.providerError("convex", operation, cause), cause);
-}
-//#endregion
-//#region src/adapters/account-read/ConvexAccountAdapter.ts
-const DEFAULT_FUNCTIONS$3 = {
-	readBalance: makeFunctionReference(CAPXUL_FUNCTIONS["account/actions"].readBalance),
-	faucetMint: makeFunctionReference(CAPXUL_FUNCTIONS["account/actions"].faucetMint)
-};
-var ConvexAccountAdapter = class {
-	#convex;
-	#fns;
-	#telemetry;
-	constructor(deps) {
-		this.#convex = deps.convex;
-		this.#fns = deps.functions ?? DEFAULT_FUNCTIONS$3;
-		this.#telemetry = deps.telemetry;
-	}
-	readBalance(input) {
-		return retryIdempotentRead(this.#convex.action(this.#fns.readBalance, copyInvocationObservation(input, { chainId: wireChainId(input.chainId) })), CAPXUL_OPERATIONS.accounts.read, this.#telemetry, input).pipe(Effect.mapError((error) => accountReadErrorFromCapxul("readBalance", error.publicError, error)), Effect.flatMap((wire) => brandAccountEffect("readBalance", wire)), Effect.catchDefect((cause) => Effect.fail(accountReadErrorFromUnknown("readBalance", cause))));
-	}
-	fundFromFaucet(input) {
-		const operation = "fundFromFaucet";
-		return Effect.suspend(() => {
-			const rawAmount = toWei(input.amount);
-			return this.#convex.action(this.#fns.faucetMint, {
-				chainId: wireChainId(input.chainId),
-				rawAmount
-			});
-		}).pipe(Effect.mapError((error) => accountReadErrorFromCapxul(operation, error.publicError, error)), Effect.map((wire) => ({ txHash: wire.txHash })), Effect.catchDefect((cause) => Effect.fail(accountReadErrorFromUnknown(operation, cause))));
-	}
-};
-function ConvexAccountLayer() {
-	return Layer.effect(AccountReadPortTag, Effect.all([ConvexCallPortTag, TelemetryPortTag]).pipe(Effect.map(([convex, telemetry]) => new ConvexAccountAdapter({
-		convex,
-		telemetry
-	}))));
-}
-function brandAccountEffect(operation, wire) {
-	return Effect.try({
-		try: () => brandAccount(wire),
-		catch: (cause) => accountReadErrorFromUnknown(operation, cause)
-	});
-}
-function brandAccount(wire) {
-	const balance = fromWei(wire.rawBalance, wire.decimals, wire.currency);
-	const available = fromWei(wire.rawAvailableBalance ?? wire.rawBalance, wire.decimals, wire.currency);
-	return {
-		id: toAccountId(wire.accountId),
-		balance,
-		available
-	};
-}
-function accountReadErrorFromUnknown(operation, cause) {
-	if (cause instanceof CapxulError) return accountReadErrorFromCapxul(operation, cause);
-	return accountReadErrorFromCapxul(operation, Errors.providerError("convex", operation, cause), cause);
-}
-//#endregion
-//#region src/adapters/smart-account/ConvexSmartAccountAdapter.ts
-const DEFAULT_FUNCTIONS$2 = {
-	loadByAuthUserId: makeFunctionReference(CAPXUL_FUNCTIONS["smartAccount/queries"].loadByAuthUserId),
-	loadBySmartAccountAddress: makeFunctionReference(CAPXUL_FUNCTIONS["smartAccount/queries"].loadBySmartAccountAddress),
-	provision: makeFunctionReference(CAPXUL_FUNCTIONS["smartAccount/mutations"].provision),
-	confirmDeployment: makeFunctionReference(CAPXUL_FUNCTIONS["smartAccount/actions"].confirmDeployment),
-	claim: makeFunctionReference(CAPXUL_FUNCTIONS["smartAccount/actions"].claim)
-};
-var ConvexSmartAccountAdapter = class {
-	#convex;
-	#fns;
-	constructor(deps) {
-		this.#convex = deps.convex;
-		this.#fns = deps.functions ?? DEFAULT_FUNCTIONS$2;
-	}
-	loadByAuthUserId(authUserId) {
-		return this.#convex.query(this.#fns.loadByAuthUserId, { authUserId }).pipe(Effect.mapError((error) => smartAccountErrorFromCapxul("loadByAuthUserId", error.publicError, error)), Effect.flatMap((row) => brandSmartAccountEffect("loadByAuthUserId", row)), Effect.catchDefect((cause) => Effect.fail(smartAccountErrorFromUnknown("loadByAuthUserId", cause))));
-	}
-	loadBySmartAccountAddress(address) {
-		return this.#convex.query(this.#fns.loadBySmartAccountAddress, { address }).pipe(Effect.mapError((error) => smartAccountErrorFromCapxul("loadBySmartAccountAddress", error.publicError, error)), Effect.flatMap((row) => brandSmartAccountEffect("loadBySmartAccountAddress", row)), Effect.catchDefect((cause) => Effect.fail(smartAccountErrorFromUnknown("loadBySmartAccountAddress", cause))));
-	}
-	provision(input) {
-		return this.#convex.mutation(this.#fns.provision, { chainId: wireChainId(input.chainId) }).pipe(Effect.mapError((error) => smartAccountErrorFromCapxul("provision", error.publicError, error)), Effect.flatMap((row) => Effect.try({
-			try: () => brandProvisionedSmartAccount(input.authUserId, row),
-			catch: (cause) => smartAccountErrorFromUnknown("provision", cause)
-		})), Effect.catchDefect((cause) => Effect.fail(smartAccountErrorFromUnknown("provision", cause))));
-	}
-	confirmDeployment(input) {
-		const evidence = {
-			chainId: wireChainId(input.evidence.chainId),
-			signerAddress: input.evidence.signerAddress,
-			safeAddress: input.evidence.safeAddress,
-			...input.evidence.userOpHash === void 0 ? {} : { userOpHash: input.evidence.userOpHash },
-			...input.evidence.txHash === void 0 ? {} : { txHash: input.evidence.txHash },
-			...input.evidence.blockNumber === void 0 ? {} : { blockNumber: input.evidence.blockNumber }
-		};
-		return this.#convex.action(this.#fns.confirmDeployment, {
-			chainId: wireChainId(input.chainId),
-			safeAddress: input.safeAddress,
-			evidence
-		}).pipe(Effect.mapError((error) => smartAccountErrorFromCapxul("confirmDeployment", error.publicError, error)), Effect.flatMap((row) => Effect.try({
-			try: () => brandProvisionedSmartAccount(input.authUserId, row),
-			catch: (cause) => smartAccountErrorFromUnknown("confirmDeployment", cause)
-		})), Effect.catchDefect((cause) => Effect.fail(smartAccountErrorFromUnknown("confirmDeployment", cause))));
-	}
-	claim(input) {
-		return this.#convex.action(this.#fns.claim, copyInvocationObservation(input, {
-			chainId: wireChainId(input.chainId),
-			signerAddress: input.signerAddress
-		})).pipe(Effect.mapError((error) => smartAccountErrorFromCapxul("claim", error.publicError, error)), Effect.flatMap((row) => Effect.try({
-			try: () => brandProvisionedSmartAccount(input.authUserId, row),
-			catch: (cause) => smartAccountErrorFromUnknown("claim", cause)
-		})), Effect.catchDefect((cause) => Effect.fail(smartAccountErrorFromUnknown("claim", cause))));
-	}
-};
-function ConvexSmartAccountLayer() {
-	return Layer.effect(SmartAccountPortTag, Effect.map(ConvexCallPortTag, (convex) => new ConvexSmartAccountAdapter({ convex })));
-}
-function brandSmartAccountEffect(operation, wire) {
-	return Effect.try({
-		try: () => wire === null ? null : brandNonNullSmartAccount(wire),
-		catch: (cause) => smartAccountErrorFromUnknown(operation, cause)
-	});
-}
-function brandNonNullSmartAccount(wire) {
-	return {
-		authUserId: toAuthUserId(wire.authUserId),
-		signerAddress: wire.signerAddress === null ? null : toAddress(wire.signerAddress),
-		smartAccountAddress: toAddress(wire.smartAccountAddress),
-		chainId: toChainId(wire.chainId),
-		deployedAt: wire.deployedAt === null ? null : toEpochMs(wire.deployedAt),
-		claimedAt: wire.claimedAt === null ? null : toEpochMs(wire.claimedAt),
-		createdAt: toEpochMs(wire.createdAt)
-	};
-}
-function brandProvisionedSmartAccount(requestedAuthUserId, wire) {
-	if (wire.authUserId !== String(requestedAuthUserId)) throw Errors.notAuthenticated();
-	return brandNonNullSmartAccount(wire);
-}
-function smartAccountErrorFromUnknown(operation, cause) {
-	if (cause instanceof CapxulError) return smartAccountErrorFromCapxul(operation, cause);
-	return smartAccountErrorFromCapxul(operation, Errors.providerError("convex", operation, cause), cause);
-}
-//#endregion
-//#region src/ports/org.ts
-var OrgError = class extends Data.TaggedError("OrgError") {};
-function orgErrorFromCapxul(operation, error, cause = error) {
-	return new OrgError({
-		operation,
-		publicCode: error.code,
-		publicError: error,
-		cause,
-		...error.details === void 0 ? {} : { details: error.details }
-	});
-}
-var OrgPortTag = class extends Context.Service()("@capxul/sdk/ports/OrgPort") {};
-//#endregion
-//#region src/adapters/org/parse.ts
-/**
-* Map a `WireOrg` + its (separately read) treasury `Account` into the branded
-* `OrgView`. The viewer role is projected by the authenticated backend read;
-* it must never be inferred from Organization ownership. Brands at the read
-* edge: `orgId`, `safeAddress`.
-*/
-function brandOrgView(wire, treasury, viewerRole) {
-	return {
-		id: toOrgId(wire.orgId),
-		...wire.creationSource === void 0 ? {} : { creationSource: toTesterKind(wire.creationSource) },
-		name: wire.name,
-		handle: wire.handle,
-		safeAddress: toAddress(wire.safeAddress.toLowerCase()),
-		role: viewerRole,
-		treasury,
-		bio: wire.bio ?? null,
-		size: wire.size ?? null,
-		logoUrl: wire.logoUrl ?? null
-	};
-}
-/**
-* Build the Org treasury `Account` from the raw on-chain `balanceOf` integer
-* (the D3 RPC read). `available === balance` for a treasury with no envelope
-* partition yet (a fresh Org reads back $0).
-*/
-function brandOrgTreasury(input) {
-	return {
-		id: toAccountId(`account_${orgIdBody(input.orgId)}`),
-		balance: input.money,
-		available: input.money
-	};
-}
-function brandOrgRole(wire) {
-	return {
-		orgId: toOrgId(wire.orgId),
-		label: wire.label,
-		roleKey: toRoleKey(wire.roleKey),
-		definition: parseRoleDefinition(wire.definitionJson)
-	};
-}
-function brandOrgMember(wire) {
-	return {
-		orgId: toOrgId(wire.orgId),
-		email: toEmail(wire.email),
-		name: wire.name,
-		personalSafeAddress: wire.personalSafeAddress === null ? null : toAddress(wire.personalSafeAddress),
-		role: wire.role,
-		roleKey: wire.roleKey === null ? null : toRoleKey(wire.roleKey),
-		status: wire.status,
-		grantTxHash: wire.grantTxHash,
-		revokeTxHash: wire.revokeTxHash
-	};
-}
-function parseRoleDefinition(json) {
-	let raw;
-	try {
-		const parsed = JSON.parse(json);
-		if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) throw new Error("expected object");
-		raw = parsed;
-	} catch (err) {
-		throw new Error(`Invalid role definition: malformed JSON - ${err instanceof Error ? err.message : String(err)}`, { cause: err });
-	}
-	if (typeof raw.label !== "string" || raw.label.trim().length === 0) throw new Error("Invalid role definition: missing label");
-	return {
-		label: raw.label,
-		...raw.spend === void 0 ? {} : { spend: {
-			...raw.spend.perTx === void 0 ? {} : { perTx: parseRoleMoney(raw.spend.perTx, "perTx") },
-			...raw.spend.perDay === void 0 ? {} : { perDay: parseRoleMoney(raw.spend.perDay, "perDay") },
-			...raw.spend.toRecipients === void 0 ? {} : { toRecipients: parseRoleRecipients(raw.spend.toRecipients) }
-		} },
-		...typeof raw.canSpend === "boolean" ? { canSpend: raw.canSpend } : {},
-		...typeof raw.canManageMembers === "boolean" ? { canManageMembers: raw.canManageMembers } : {},
-		...typeof raw.canManageRoles === "boolean" ? { canManageRoles: raw.canManageRoles } : {}
-	};
-}
-function parseRoleMoney(raw, field) {
-	if (typeof raw.currency !== "string" || typeof raw.value !== "string" || !/^\d+$/.test(raw.value) || raw.decimals !== 6) throw new Error(`Invalid role money: ${field}`);
-	return {
-		currency: toCurrencyCode(raw.currency),
-		value: raw.value,
-		decimals: raw.decimals
-	};
-}
-function parseRoleRecipients(raw) {
-	if (raw === "anyone") return "anyone";
-	if (!Array.isArray(raw)) throw new Error("Invalid role definition: toRecipients must be \"anyone\" or an array");
-	return raw.map((recipient) => {
-		if (typeof recipient !== "string") throw new Error("Invalid role definition: toRecipients must be \"anyone\" or an array");
-		return toAddress(recipient);
-	});
-}
-/** Strip the `org_` prefix + non-alphanumerics so the body re-seeds `account_`. */
-function orgIdBody(orgId) {
-	const underscore = orgId.indexOf("_");
-	const cleaned = (underscore < 0 ? orgId : orgId.slice(underscore + 1)).replace(/[^0-9A-Za-z]/g, "");
-	return cleaned.length > 0 ? cleaned : "0";
-}
-//#endregion
-//#region src/adapters/org/ConvexOrganizationAdapter.ts
-const DEFAULT_FUNCTIONS$1 = {
-	listAll: makeFunctionReference(CAPXUL_FUNCTIONS["org/queries"].listAll),
-	listRoles: makeFunctionReference(CAPXUL_FUNCTIONS["org/queries"].listRolesByOrgId),
-	listMembers: makeFunctionReference(CAPXUL_FUNCTIONS["org/queries"].listMembersByOrgId),
-	readTreasury: makeFunctionReference(CAPXUL_FUNCTIONS["org/actions"].readTreasury),
-	inviteMember: makeFunctionReference(CAPXUL_FUNCTIONS["org/actions"].inviteMember),
-	resendInvite: makeFunctionReference(CAPXUL_FUNCTIONS["org/mutations"].resendInviteToken),
-	detectInvitations: makeFunctionReference(CAPXUL_FUNCTIONS["org/actions"].detectAndAcceptPendingInvitations)
-};
-/**
-* Standard production Organization read adapter. It intentionally has no
-* deployer/RPC/test configuration: authenticated Convex actions own live chain
-* reads, while the lifecycle adapter owns the single sponsored bootstrap.
-*/
-var ConvexOrganizationAdapter = class {
-	#convex;
-	#fns;
-	#telemetry;
-	constructor(input) {
-		this.#convex = input.convex;
-		this.#fns = input.functions ?? DEFAULT_FUNCTIONS$1;
-		this.#telemetry = input.telemetry;
-	}
-	createOrg(_input) {
-		return Effect.fail(orgErrorFromCapxul("createOrg", Errors.notImplemented("organizationSetup", "use onboarding.completeOrganization")));
-	}
-	listOrgs(input) {
-		return this.#convex.query(this.#fns.listAll, copyInvocationObservation(input, {})).pipe(Effect.mapError((error) => orgErrorFromCapxul("listOrgs", error.publicError, error)), Effect.flatMap((wires) => Effect.forEach(wires, (wire) => this.#readTreasuryWire(copyInvocationObservation(input, { orgId: toOrgId(wire.orgId) })).pipe(Effect.map((treasury) => {
-			const viewerRole = wire.viewerRole.trim();
-			if (viewerRole.length === 0) throw Errors.wrongState({
-				method: "listOrgs",
-				currentState: "viewerRoleMissing",
-				validStates: ["activeViewerRole"]
-			});
-			return brandOrgView(wire, treasury, viewerRole);
-		})))), Effect.catchDefect((cause) => Effect.fail(toOrgError("listOrgs", cause))));
-	}
-	readTreasury(input) {
-		return this.#readTreasuryWire(input).pipe(Effect.catchDefect((cause) => Effect.fail(toOrgError("readTreasury", cause))));
-	}
-	listRoles(input) {
-		return this.#convex.query(this.#fns.listRoles, { orgId: input.orgId }).pipe(Effect.mapError((error) => orgErrorFromCapxul("listRoles", error.publicError, error)), Effect.flatMap((rows) => rows.length === 0 ? Effect.fail(partialOrgTruth("listRoles", "activeRoleMissing")) : Effect.succeed(rows.map(brandOrgRole))), Effect.catchDefect((cause) => Effect.fail(toOrgError("listRoles", cause))));
-	}
-	listMembers(input) {
-		return this.#convex.query(this.#fns.listMembers, { orgId: input.orgId }).pipe(Effect.mapError((error) => orgErrorFromCapxul("listMembers", error.publicError, error)), Effect.flatMap((rows) => rows.length === 0 ? Effect.fail(partialOrgTruth("listMembers", "activeMemberMissing")) : Effect.succeed(rows.map(brandOrgMember))), Effect.catchDefect((cause) => Effect.fail(toOrgError("listMembers", cause))));
-	}
-	pendingMembers(input) {
-		return this.listMembers(input).pipe(Effect.map((members) => members.filter((member) => member.status === "pending" || member.status === "pending_safe" || member.status === "pending_grant")));
-	}
-	inviteMember(input) {
-		return this.#convex.action(this.#fns.inviteMember, {
-			orgId: input.orgId,
-			email: input.input.email,
-			role: input.input.role
-		}).pipe(Effect.mapError((error) => orgErrorFromCapxul("inviteMember", error.publicError, error)), Effect.map(brandOrgMember), Effect.catchDefect((cause) => Effect.fail(toOrgError("inviteMember", cause))));
-	}
-	resendInviteToken(input) {
-		return this.#convex.mutation(this.#fns.resendInvite, {
-			orgId: input.orgId,
-			email: input.email
-		}).pipe(Effect.mapError((error) => orgErrorFromCapxul("resendInviteToken", error.publicError, error)), Effect.map(brandOrgMember), Effect.catchDefect((cause) => Effect.fail(toOrgError("resendInviteToken", cause))));
-	}
-	detectAndAcceptPendingInvitations(_input) {
-		return this.#convex.action(this.#fns.detectInvitations, {}).pipe(Effect.mapError((error) => orgErrorFromCapxul("detectAndAcceptPendingInvitations", error.publicError, error)), Effect.map((result) => ({ matched: result.matched.map(toOrgId) })), Effect.catchDefect((cause) => Effect.fail(toOrgError("detectAndAcceptPendingInvitations", cause))));
-	}
-	#readTreasuryWire(input) {
-		const orgId = String(input.orgId);
-		return retryIdempotentRead(this.#convex.action(this.#fns.readTreasury, copyInvocationObservation(input, { orgId })), CAPXUL_OPERATIONS.org.treasury, this.#telemetry, input).pipe(Effect.mapError((error) => orgErrorFromCapxul("readTreasury", error.publicError, error)), Effect.map((wire) => {
-			if (wire.orgId !== orgId) throw Errors.invalidInput("orgId", "Organization treasury scope does not match");
-			const balance = fromWei(wire.rawBalance, wire.decimals, wire.currency);
-			const available = fromWei(wire.rawAvailableBalance, wire.decimals, wire.currency);
-			return {
-				...brandOrgTreasury({
-					orgId: wire.orgId,
-					money: balance
-				}),
-				available
-			};
-		}));
-	}
-};
-function toOrgError(operation, cause) {
-	if (cause instanceof CapxulError) return orgErrorFromCapxul(operation, cause);
-	return orgErrorFromCapxul(operation, Errors.providerError("convex", operation, cause), cause);
-}
-function partialOrgTruth(operation, currentState) {
-	return orgErrorFromCapxul(operation, Errors.wrongState({
-		method: operation,
-		currentState,
-		validStates: ["completeProductionOrganizationTruth"]
-	}));
-}
-//#endregion
-//#region src/adapters/org/ConvexOrganizationSetupAdapter.ts
-const DEFAULT_FUNCTIONS = {
-	startOrResume: makeFunctionReference(CAPXUL_FUNCTIONS["org/lifecycle"].startOrResume),
-	prepareFounderAccount: makeFunctionReference(CAPXUL_FUNCTIONS["org/actions"].prepareFounderAccount),
-	prepareBootstrap: makeFunctionReference(CAPXUL_FUNCTIONS["org/actions"].prepareBootstrap),
-	submitBootstrap: makeFunctionReference(CAPXUL_FUNCTIONS["org/actions"].submitBootstrap),
-	resumeBootstrapSubmission: makeFunctionReference(CAPXUL_FUNCTIONS["org/actions"].resumeBootstrapSubmission),
-	confirmBootstrap: makeFunctionReference(CAPXUL_FUNCTIONS["org/actions"].confirmBootstrap),
-	recordFailure: makeFunctionReference(CAPXUL_FUNCTIONS["org/lifecycle"].recordFailure),
-	load: makeFunctionReference(CAPXUL_FUNCTIONS["org/lifecycle"].load),
-	retry: makeFunctionReference(CAPXUL_FUNCTIONS["org/lifecycle"].retry)
-};
-/** Durable Organization setup capability composed by the standard client. */
-var ConvexOrganizationSetupAdapter = class {
-	#convex;
-	#signer;
-	#chainId;
-	#fns;
-	constructor(input) {
-		this.#convex = input.convex;
-		this.#signer = input.signer;
-		this.#chainId = input.chainId;
-		this.#fns = input.functions ?? DEFAULT_FUNCTIONS;
-	}
-	async startOrResume(input) {
-		const result = await runCall("startOrResume", this.#convex.mutation(this.#fns.startOrResume, copyInvocationObservation(input, {
-			...input,
-			chainId: this.#chainId
-		})));
-		if (!result.ok) return result;
-		const lifecycle = parseLifecycle("startOrResume", result.value.lifecycle);
-		if (!lifecycle.ok) return lifecycle;
-		const orgId = parseOrgId("startOrResume", result.value.orgId);
-		if (!orgId.ok) return orgId;
-		if (String(orgId.value) !== String(lifecycle.value.orgId)) return fail(Errors.invalidInput("orgId", "Organization lifecycle scope does not match"));
-		return {
-			ok: true,
-			value: {
-				orgId: orgId.value,
-				lifecycle: lifecycle.value
-			}
-		};
-	}
-	prepareFounderAccount(input) {
-		return this.#lifecycleAction("prepareFounderAccount", input, () => this.#convex.action(this.#fns.prepareFounderAccount, copyInvocationObservation(input, {
-			orgId: input.orgId,
-			...input.observationContext === void 0 ? {} : { observationContext: input.observationContext }
-		})));
-	}
-	async authorizeAndSubmitBootstrap(input) {
-		const cancelled = cancellation(input.signal);
-		if (cancelled !== void 0) return cancelled;
-		const signerAddress = await signerResult(this.#signer.source, "getAddress", () => this.#signer.getAddress());
-		if (!signerAddress.ok) return signerAddress;
-		const prepared = await runCall("prepareBootstrap", this.#convex.action(this.#fns.prepareBootstrap, copyInvocationObservation(input, {
-			orgId: input.orgId,
-			signerAddress: signerAddress.value,
-			...input.observationContext === void 0 ? {} : { observationContext: input.observationContext }
-		})));
-		if (!prepared.ok) return prepared;
-		const authority = validatePreparedAuthorities(prepared.value, signerAddress.value);
-		if (!authority.ok) return authority;
-		const cancelledAfterPrepare = cancellation(input.signal);
-		if (cancelledAfterPrepare !== void 0) return cancelledAfterPrepare;
-		const signature = await signerResult(this.#signer.source, "signUserOpHash", () => this.#signer.signUserOpHash(prepared.value.digest));
-		if (!signature.ok) return signature;
-		const cancelledAfterSign = cancellation(input.signal);
-		if (cancelledAfterSign !== void 0) return cancelledAfterSign;
-		const submitted = await runCall("submitBootstrap", this.#convex.action(this.#fns.submitBootstrap, copyInvocationObservation(input, {
-			orgId: input.orgId,
-			signerAddress: signerAddress.value,
-			signature: signature.value,
-			userOp: prepared.value.userOp,
-			...input.observationContext === void 0 ? {} : { observationContext: input.observationContext }
-		})));
-		if (!submitted.ok) return submitted;
-		return parseLifecycle("submitBootstrap", submitted.value);
-	}
-	resumeSubmittedBootstrap(input) {
-		return this.#lifecycleAction("resumeBootstrapSubmission", input, () => this.#convex.action(this.#fns.resumeBootstrapSubmission, copyInvocationObservation(input, {
-			orgId: input.orgId,
-			...input.observationContext === void 0 ? {} : { observationContext: input.observationContext }
-		})));
-	}
-	confirmSubmittedBootstrap(input) {
-		return this.#lifecycleAction("confirmBootstrap", input, () => this.#convex.action(this.#fns.confirmBootstrap, copyInvocationObservation(input, {
-			orgId: input.orgId,
-			...input.observationContext === void 0 ? {} : { observationContext: input.observationContext },
-			...input.retryDelayMs === void 0 ? {} : { retryDelayMs: input.retryDelayMs }
-		})));
-	}
-	async recordFailure(input) {
-		const errorProvider = input.error.details?.provider;
-		const errorOperation = input.error.details?.operation;
-		const result = await runCall("recordFailure", this.#convex.mutation(this.#fns.recordFailure, copyInvocationObservation(input, {
-			orgId: input.orgId,
-			errorCode: input.error.code,
-			...typeof errorProvider === "string" && typeof errorOperation === "string" ? {
-				errorProvider,
-				errorOperation
-			} : {},
-			retryable: input.retryable,
-			...input.observationContext === void 0 ? {} : { observationContext: input.observationContext }
-		})));
-		return result.ok ? parseLifecycle("recordFailure", result.value) : result;
-	}
-	async loadLifecycle(input) {
-		const result = await runCall("loadLifecycle", this.#convex.query(this.#fns.load, input));
-		if (!result.ok) return result;
-		if (result.value === null) return fail(Errors.invalidInput("orgId", "Organization lifecycle was not found"));
-		return parseLifecycle("loadLifecycle", result.value);
-	}
-	async retry(input) {
-		const cancelled = cancellation(input.signal);
-		if (cancelled !== void 0) return cancelled;
-		const current = await this.loadLifecycle({
-			orgId: input.orgId,
-			...input.observationContext === void 0 ? {} : { observationContext: input.observationContext }
-		});
-		if (!current.ok) return current;
-		if (current.value.status === "failed" && current.value.retryable && (current.value.at === "awaitingFounderAuthorization" || current.value.at === "submittingBootstrap")) {
-			const reset = resetSignerSession(this.#signer);
-			if (!reset.ok) return reset;
-		}
-		const result = await runCall("retry", this.#convex.mutation(this.#fns.retry, copyInvocationObservation(input, {
-			orgId: input.orgId,
-			...input.observationContext === void 0 ? {} : { observationContext: input.observationContext }
-		})));
-		if (!result.ok) return result;
-		return parseLifecycle("retry", result.value);
-	}
-	async #lifecycleAction(operation, input, call) {
-		const cancelled = cancellation(input.signal);
-		if (cancelled !== void 0) return cancelled;
-		const result = await runCall(operation, call());
-		if (!result.ok) return result;
-		const cancelledAfter = cancellation(input.signal);
-		if (cancelledAfter !== void 0) return cancelledAfter;
-		return parseLifecycle(operation, result.value);
-	}
-};
-function resetSignerSession(signer) {
-	const resetSession = signer.resetSession;
-	if (typeof resetSession !== "function") return {
-		ok: true,
-		value: void 0
-	};
-	try {
-		resetSession.call(signer);
-		return {
-			ok: true,
-			value: void 0
-		};
-	} catch (cause) {
-		return fail(signerFailure(signer.source, "resetSession", cause));
-	}
-}
-async function runCall(operation, effect) {
-	try {
-		const result = await Effect.runPromise(Effect.result(effect));
-		return Result.isSuccess(result) ? {
-			ok: true,
-			value: result.success
-		} : fail(publicError(operation, result.failure));
-	} catch (cause) {
-		return fail(publicError(operation, cause));
-	}
-}
-function publicError(operation, cause) {
-	if (cause instanceof CapxulError) return cause;
-	if (typeof cause === "object" && cause !== null) {
-		const carried = cause.publicError;
-		if (carried instanceof CapxulError) return carried;
-	}
-	return Errors.providerError("convex-organization", operation, cause);
-}
-async function signerResult(source, operation, run) {
-	try {
-		return {
-			ok: true,
-			value: await run()
-		};
-	} catch (cause) {
-		return fail(signerFailure(source, operation, cause));
-	}
-}
-function validatePreparedAuthorities(prepared, signerAddress) {
-	const signer = signerAddress.toLowerCase();
-	const preparedSigner = prepared.signerAddress.toLowerCase();
-	const founder = prepared.founderPersonalAccount.toLowerCase();
-	const organization = prepared.organizationAccountAddress.toLowerCase();
-	const sender = prepared.userOp.sender.toLowerCase();
-	if (preparedSigner !== signer) return fail(Errors.invalidInput("signerAddress", "Prepared signer does not match configured signer"));
-	if (founder === signer || organization === signer || organization === founder) return fail(Errors.invalidInput("organizationAuthority", "Signer EOA, founder Account, and Organization Account must be distinct"));
-	if (sender !== founder) return fail(Errors.invalidInput("userOp.sender", "Bootstrap sender must be the founder Account"));
-	if (!/^0x[0-9a-fA-F]{64}$/u.test(prepared.digest)) return fail(Errors.invalidInput("digest", "Prepared bootstrap digest must be 32-byte hex"));
-	return {
-		ok: true,
-		value: void 0
-	};
-}
-function parseLifecycle(operation, wire) {
-	const orgId = parseOrgId(operation, wire.orgId);
-	if (!orgId.ok) return orgId;
-	if (wire.status === "loading") return {
-		ok: true,
-		value: {
-			status: "loading",
-			orgId: orgId.value
-		}
-	};
-	if (wire.status === "ready") return {
-		ok: true,
-		value: {
-			status: "ready",
-			orgId: orgId.value,
-			canTransact: true
-		}
-	};
-	if (wire.status === "failed") {
-		if (!isSetupStep(wire.at)) return fail(Errors.invalidInput("lifecycle.at", "Unknown setup step"));
-		return {
-			ok: true,
-			value: {
-				status: "failed",
-				orgId: orgId.value,
-				at: wire.at,
-				error: new CapxulError(wire.error.code, wire.error.message),
-				retryable: wire.retryable
-			}
-		};
-	}
-	if (!isSetupStep(wire.step)) return fail(Errors.invalidInput("lifecycle.step", `Unknown setup step from ${operation}`));
-	return {
-		ok: true,
-		value: {
-			status: "settingUp",
-			orgId: orgId.value,
-			step: wire.step
-		}
-	};
-}
-function parseOrgId(operation, value) {
-	try {
-		return {
-			ok: true,
-			value: toOrgId(value)
-		};
-	} catch (cause) {
-		return fail(Errors.providerError("convex-organization", operation, cause));
-	}
-}
-function isSetupStep(value) {
-	return value === "preparingFounderAccount" || value === "awaitingFounderAuthorization" || value === "submittingBootstrap" || value === "confirmingBootstrap";
-}
-function cancellation(signal) {
-	return signal?.aborted ? fail(Errors.cancelled({ operation: CAPXUL_OPERATIONS.organization.setup })) : void 0;
-}
-function fail(error) {
-	return {
-		ok: false,
-		error
-	};
-}
-//#endregion
-//#region src/adapters/telemetry/PostHogTelemetryAdapter.ts
-var PostHogTelemetryAdapter = class {
-	#capture;
-	#identify;
-	#group;
-	#reset;
-	constructor(deps) {
-		this.#capture = deps.capture;
-		this.#identify = deps.identify ?? (() => void 0);
-		this.#group = deps.group ?? (() => void 0);
-		this.#reset = deps.reset ?? (() => void 0);
-	}
-	emit(event) {
-		return this.#run(() => this.#capture(event.name, redactTelemetryProps(event.name, cloneProps(event.props)), event), "emit", event.name);
-	}
-	identify(input) {
-		return this.#run(() => this.#identify(cloneIdentifyInput(input)), "identify");
-	}
-	group(input) {
-		return this.#run(() => this.#group(cloneGroupInput(input)), "group");
-	}
-	reset() {
-		return this.#run(() => this.#reset(), "reset");
-	}
-	#run(operation, operationName, eventName) {
-		const diagnose = Effect.logWarning("product.telemetry.transport.dropped").pipe(Effect.annotateLogs({
-			operation: operationName,
-			...eventName === void 0 ? {} : { product_event: eventName }
-		}), Effect.catchCause(() => Effect.void));
-		return Effect.suspend(() => {
-			let pending;
-			try {
-				pending = operation();
-			} catch {
-				return diagnose;
-			}
-			if (pending === void 0) return Effect.void;
-			const transport = Effect.tryPromise({
-				try: () => pending,
-				catch: () => void 0
-			}).pipe(Effect.catch(() => diagnose));
-			return Effect.forkDetach(transport, { startImmediately: true }).pipe(Effect.asVoid);
-		});
-	}
-};
-function PostHogTelemetryLayer(deps) {
-	return Layer.succeed(TelemetryPortTag, new PostHogTelemetryAdapter(deps));
-}
-function cloneIdentifyInput(input) {
-	const traits = input.traits === void 0 ? void 0 : cloneProps(input.traits);
-	const properties = input.properties === void 0 ? void 0 : cloneProps(input.properties);
-	return {
-		distinctId: input.distinctId,
-		...input.anonDistinctId === void 0 ? {} : { anonDistinctId: input.anonDistinctId },
-		...traits === void 0 ? {} : { traits },
-		...properties === void 0 ? {} : { properties }
-	};
-}
-function cloneGroupInput(input) {
-	const properties = input.properties === void 0 ? void 0 : cloneProps(input.properties);
-	return properties === void 0 ? {
-		groupType: input.groupType,
-		groupKey: input.groupKey
-	} : {
-		groupType: input.groupType,
-		groupKey: input.groupKey,
-		properties
-	};
-}
-function cloneProps(props) {
-	if (props === void 0) return void 0;
-	const cloned = {};
-	for (const [key, value] of Object.entries(props)) cloned[key] = cloneTelemetryValue(value);
-	return cloned;
-}
-function cloneTelemetryValue(value) {
-	if (Array.isArray(value)) return value.map(cloneTelemetryValue);
-	if (value === null || typeof value !== "object") return value;
-	if (Object.getPrototypeOf(value) !== Object.prototype) return value;
-	const cloned = {};
-	for (const [key, nested] of Object.entries(value)) cloned[key] = cloneTelemetryValue(nested);
-	return cloned;
-}
-//#endregion
-//#region src/adapters/diagnostic/ConsoleDiagnosticAdapter.ts
-const DEFAULT_ACCOUNT_SETUP_LOG_PREFIX = "[capxul:account-setup]";
-var ConsoleDiagnosticAdapter = class {
-	prefix;
-	constructor(prefix = DEFAULT_ACCOUNT_SETUP_LOG_PREFIX) {
-		this.prefix = prefix;
-	}
-	trace(scope, detail) {
-		globalThis.console?.debug?.(`${this.prefix} ${scope}`, detail);
-	}
-};
-//#endregion
-//#region src/openfort/create-openfort-browser-signer.ts
-function httpStatusOf(link) {
-	const carrier = link;
-	if (typeof carrier.response?.status === "number") return carrier.response.status;
-	if (typeof carrier.statusCode === "number") return carrier.statusCode;
-	if (typeof carrier.status === "number") return carrier.status;
-}
-function isUnauthorizedCause(cause) {
-	for (const link of causeChain(cause)) if (httpStatusOf(link) === 401) return true;
-	return false;
-}
-function openfortProviderError(operation, cause) {
-	if (cause instanceof CapxulError) return cause;
-	const failure_mode = operation === "configure" && isUnauthorizedCause(cause) ? "unauthorized" : "unknown";
-	return Errors.providerError("openfort", operation, cause, { failure_mode });
-}
-function openfortFailureMode(error) {
-	return error.mode ?? "unknown";
-}
-/** Build a named PROVIDER_ERROR. The assembled Core SDK boundary reports it. */
-function failOpenfort(operation, failure_mode, cause) {
-	return Errors.providerError("openfort", operation, cause, { failure_mode });
-}
-/**
-* True when the browser cannot perform Web Crypto — sandboxed iframes, headless
-* agent browsers, or non-HTTPS origins. OpenFort's embedded-wallet `configure`
-* silently produces no address in this state, so we detect it up front and name
-* it `no-secure-context` instead of letting it decay into `unknown`.
-*/
-function isInsecureBrowserContext() {
-	return globalThis.isSecureContext === false || globalThis.crypto?.subtle === void 0;
-}
-/** Openfort SDK storage keys (`@openfort/openfort-js` StorageKeys). */
-const OPENFORT_BROWSER_STORAGE_KEYS = [
-	"openfort.authentication",
-	"openfort.account",
-	"openfort.session",
-	"openfort.configuration"
-];
-/**
-* Matches `@openfort/openfort-js` ScopedStorage.createScope — chars 8–15 of the
-* publishable key, prefixed onto each StorageKeys entry in localStorage.
-*/
-function openfortBrowserStorageScope(publishableKey) {
-	const trimmed = publishableKey.trim();
-	if (trimmed.length < 16) return;
-	return trimmed.substring(8, 16);
-}
-/**
-* Drop cached Openfort auth/account state so third-party login re-runs for the
-* current Better Auth session. The SDK skips `authenticateThirdParty` when a
-* stale `userId` is already in storage, which yields 401 on `v2/accounts`.
-*/
-function clearStaleOpenfortBrowserStorage(publishableKey) {
-	if (typeof localStorage === "undefined") return;
-	const scope = openfortBrowserStorageScope(publishableKey);
-	if (scope === void 0) return;
-	for (const key of OPENFORT_BROWSER_STORAGE_KEYS) localStorage.removeItem(`${scope}.${key}`);
-}
-/**
-* The Openfort error code that names the stale-user class (#1435).
-* `getThirdPartyAuthToken` skips `authenticateThirdParty` while a `userId` sits
-* in scoped storage. A purged `userId` therefore pins every later call to a 401
-* that `extractApiError` reports as `USER_NOT_FOUND`.
-*
-* The set holds one member on purpose. Session-expiry codes (`SESSION_EXPIRED`,
-* `NOT_LOGGED_IN`, `INVALID_TOKEN`, `REFRESH_TOKEN_ERROR`) are a different
-* cause, and a bare 401 is a different cause again: `app-env-allowlist` is a
-* 401 by definition (`packages/errors/src/errors.ts:80-81`). Healing those and
-* tagging them `stale-openfort-cache` would delete the triage signal the tag
-* exists to carry.
-*/
-const STALE_USER_ERROR_CODES = /* @__PURE__ */ new Set(["USER_NOT_FOUND"]);
-/**
-* The one predicate that opens the heal. It reads the Openfort error code and
-* never the message text (ADR-0023 R4). It walks the cause chain the way
-* `isTransportError` walks it in the Convex transport adapter.
-*
-* Known ceiling (#1435): a 401 that carries no recognized code is NOT healed.
-* `extractApiError` keeps the status only on `AuthenticationError`, so such a
-* payload is reachable. Add the code a live payload shows; do not add a message
-* match, because that trades one bug class for an ADR-0023 R4 violation.
-*/
-function isStaleUserSignal(cause) {
-	for (const link of causeChain(cause)) {
-		const error = link;
-		if (typeof error.error === "string" && STALE_USER_ERROR_CODES.has(error.error) || typeof error.code === "string" && STALE_USER_ERROR_CODES.has(error.code)) return true;
-	}
-	return false;
-}
-function createOpenfortBrowserSignerFromBootstrap(bootstrap, options = {}) {
-	const diagnostic = options.diagnostic;
-	const authBaseUrl = normalizeBetterAuthBaseUrl(bootstrap.authBaseUrl);
-	let currentStatus = "unknown";
-	const statusListeners = /* @__PURE__ */ new Set();
-	function setStatus(next) {
-		if (currentStatus === next) return;
-		currentStatus = next;
-		for (const listener of statusListeners) try {
-			listener(next);
-		} catch {
-			statusListeners.delete(listener);
-			diagnostic?.trace("openfort.signerStatusListener", {
-				ok: false,
-				failure_mode: "unknown"
-			});
-		}
-	}
-	const statusStore = {
-		status: () => currentStatus,
-		subscribe: (listener) => {
-			statusListeners.add(listener);
-			return () => {
-				statusListeners.delete(listener);
-			};
-		}
-	};
-	/**
-	* Closes the black hole: when the browser has no Web Crypto, OpenFort's
-	* `configure` would resolve to no address and the failure would be reported
-	* as `unknown`. Detect it before any network or wallet work. Tag it
-	* `no-secure-context` on a PROVIDER_ERROR scoped to `configure`. Add a
-	* DiagnosticPort breadcrumb. The assembled Core SDK boundary reports it.
-	*/
-	function failNoSecureContext() {
-		diagnostic?.trace("openfort.configure", {
-			ok: false,
-			failure_mode: "no-secure-context"
-		});
-		throw failOpenfort("configure", "no-secure-context", /* @__PURE__ */ new Error("Web Crypto unavailable: browser is not a secure context"));
-	}
-	function betterAuthSessionUrl() {
-		return `${authBaseUrl}/get-session`;
-	}
-	function encryptionSessionUrl() {
-		return `${authBaseUrl}/encryption-session`;
-	}
-	async function fetchBetterAuthAccessToken() {
-		try {
-			const response = await fetch(betterAuthSessionUrl(), { credentials: "include" });
-			if (!response.ok) {
-				diagnostic?.trace("openfort.token", {
-					ok: false,
-					tokenPresent: false,
-					httpStatus: response.status,
-					failure_mode: "unknown"
-				});
-				return null;
-			}
-			const token = (await response.json()).session?.token?.trim();
-			if (token === void 0 || token.length === 0) {
-				diagnostic?.trace("openfort.token", {
-					ok: false,
-					tokenPresent: false,
-					failure_mode: "unknown"
-				});
-				return null;
-			}
-			diagnostic?.trace("openfort.token", {
-				ok: true,
-				tokenPresent: true
-			});
-			return token;
-		} catch (cause) {
-			diagnostic?.trace("openfort.token", {
-				ok: false,
-				tokenPresent: false,
-				failure_mode: "unknown"
-			});
-			throw openfortProviderError("token", cause);
-		}
-	}
-	const openfort = new Openfort({
-		baseConfiguration: { publishableKey: bootstrap.openfortPublishableKey },
-		shieldConfiguration: { shieldPublishableKey: bootstrap.shieldPublishableKey },
-		thirdPartyAuth: {
-			provider: ThirdPartyOAuthProvider.BETTER_AUTH,
-			getAccessToken: fetchBetterAuthAccessToken
-		}
-	});
-	async function configureEmbeddedWallet(encryptionSession) {
-		await openfort.embeddedWallet.configure({
-			accountType: AccountTypeEnum.EOA,
-			chainType: ChainTypeEnum.EVM,
-			recoveryParams: {
-				recoveryMethod: RecoveryMethod.AUTOMATIC,
-				encryptionSession
-			}
-		});
-	}
-	/**
-	* ONE heal cycle on the stale-user rejection (#1435). Clear the scoped
-	* storage that pins the dead `userId`, run the existing configure path — it
-	* re-runs third-party auth against the live Better Auth session now that no
-	* `userId` is cached — and retry the read once. Exactly one cycle: a second
-	* rejection is terminal and carries `failure_mode: "stale-openfort-cache"`.
-	* The caller stays in `recovering` throughout; only the outcome moves it.
-	*/
-	async function healStaleOpenfortCache(encryptionSession) {
-		try {
-			clearStaleOpenfortBrowserStorage(bootstrap.openfortPublishableKey);
-			diagnostic?.trace("openfort.storageCleared", { beforeConfigure: false });
-			await configureEmbeddedWallet(encryptionSession);
-			await openfort.embeddedWallet.get();
-		} catch (cause) {
-			diagnostic?.trace("openfort.staleCacheHeal", {
-				ok: false,
-				failure_mode: "stale-openfort-cache"
-			});
-			throw failOpenfort("get", "stale-openfort-cache", cause);
-		}
-		diagnostic?.trace("openfort.staleCacheHeal", { ok: true });
-	}
-	let walletReadyPromise = null;
-	function startWalletReady() {
-		return (async () => {
-			if (isInsecureBrowserContext()) failNoSecureContext();
-			await openfort.waitForInitialization();
-			const accessToken = await fetchBetterAuthAccessToken();
-			if (accessToken === null) throw openfortProviderError("token", /* @__PURE__ */ new Error("Better Auth access token unavailable for Openfort"));
-			let encryptionResponse;
-			try {
-				encryptionResponse = await fetch(encryptionSessionUrl(), {
-					method: "POST",
-					credentials: "include",
-					headers: {
-						Authorization: `Bearer ${accessToken}`,
-						"Content-Type": "application/json"
-					},
-					body: JSON.stringify({})
-				});
-			} catch (cause) {
-				diagnostic?.trace("openfort.encryptionSession", {
-					ok: false,
-					failure_mode: "unknown"
-				});
-				throw openfortProviderError("encryptionSession", cause);
-			}
-			if (!encryptionResponse.ok) {
-				diagnostic?.trace("openfort.encryptionSession", {
-					ok: false,
-					httpStatus: encryptionResponse.status,
-					failure_mode: "unknown"
-				});
-				throw Errors.providerError("openfort", "encryptionSession", /* @__PURE__ */ new Error(`Openfort encryption session failed (${encryptionResponse.status})`), { failure_mode: "unknown" });
-			}
-			let encryptionBody;
-			try {
-				encryptionBody = await encryptionResponse.json();
-				if (typeof encryptionBody.sessionId !== "string" || encryptionBody.sessionId.length === 0) throw new Error("Openfort encryption session response missing sessionId");
-			} catch (cause) {
-				diagnostic?.trace("openfort.encryptionSession", {
-					ok: false,
-					httpStatus: encryptionResponse.status,
-					failure_mode: "unknown"
-				});
-				throw openfortProviderError("encryptionSession", cause);
-			}
-			diagnostic?.trace("openfort.encryptionSession", {
-				ok: true,
-				httpStatus: encryptionResponse.status
-			});
-			let embeddedState;
-			try {
-				embeddedState = await openfort.embeddedWallet.getEmbeddedState();
-				diagnostic?.trace("openfort.embeddedState", { state: embeddedState });
-			} catch (cause) {
-				diagnostic?.trace("openfort.embeddedState", {
-					ok: false,
-					failure_mode: "unknown"
-				});
-				throw openfortProviderError("embeddedState", cause);
-			}
-			if (embeddedState !== EmbeddedState.READY) {
-				clearStaleOpenfortBrowserStorage(bootstrap.openfortPublishableKey);
-				diagnostic?.trace("openfort.storageCleared", { beforeConfigure: true });
-				try {
-					await configureEmbeddedWallet(encryptionBody.sessionId);
-					diagnostic?.trace("openfort.configure", { ok: true });
-				} catch (cause) {
-					const error = openfortProviderError("configure", cause);
-					diagnostic?.trace("openfort.configure", {
-						ok: false,
-						failure_mode: openfortFailureMode(error)
-					});
-					throw error;
-				}
-			}
-			try {
-				await openfort.embeddedWallet.get();
-				diagnostic?.trace("openfort.get", { ok: true });
-			} catch (cause) {
-				if (!isStaleUserSignal(cause)) {
-					diagnostic?.trace("openfort.get", {
-						ok: false,
-						failure_mode: "unknown"
-					});
-					throw openfortProviderError("get", cause);
-				}
-				diagnostic?.trace("openfort.get", {
-					ok: false,
-					failure_mode: "stale-openfort-cache"
-				});
-				await healStaleOpenfortCache(encryptionBody.sessionId);
-			}
-		})();
-	}
-	async function ensureOpenfortWalletReady() {
-		let joined = walletReadyPromise;
-		if (joined === null) {
-			joined = startWalletReady();
-			walletReadyPromise = joined;
-			setStatus("recovering");
-		}
-		try {
-			await joined;
-			if (walletReadyPromise === joined) setStatus("ready");
-		} catch (cause) {
-			if (walletReadyPromise === joined) {
-				walletReadyPromise = null;
-				setStatus("unavailable");
-			}
-			throw cause;
-		}
-	}
-	const signer = openfortEmbeddedSignerFromWallet({
-		embeddedWallet: openfort.embeddedWallet,
-		ensureWalletReady: ensureOpenfortWalletReady
-	});
-	const resetReadiness = () => {
-		walletReadyPromise = null;
-		clearStaleOpenfortBrowserStorage(bootstrap.openfortPublishableKey);
-		signer.resetAddressCache();
-		setStatus("unknown");
-	};
-	const signUserOpHash = async (hash) => {
-		try {
-			return await signer.signUserOpHash(hash);
-		} catch (cause) {
-			const providerErrorCode = openfortSignerNotReadyCode(cause);
-			if (providerErrorCode === void 0) throw cause;
-			diagnostic?.trace("openfort.signerRecovery", {
-				outcome: "started",
-				attempt: 1,
-				failure_mode: "signer-not-ready"
-			});
-			resetReadiness();
-			try {
-				await ensureOpenfortWalletReady();
-				const signature = await signer.signUserOpHash(hash);
-				diagnostic?.trace("openfort.signerRecovery", {
-					outcome: "succeeded",
-					attempt: 1,
-					failure_mode: "signer-not-ready"
-				});
-				return signature;
-			} catch (retryCause) {
-				const retryFailure = signerFailure("openfort-embedded", "signUserOpHash", retryCause);
-				if (retryFailure.code === "SIGNER_REJECTED") throw retryFailure;
-				if (isSignerNotReadySignal(retryCause)) {
-					walletReadyPromise = null;
-					signer.resetAddressCache();
-					setStatus("unavailable");
-				}
-				diagnostic?.trace("openfort.signerRecovery", {
-					outcome: "failed",
-					attempt: 1,
-					failure_mode: isSignerNotReadySignal(retryCause) ? "signer-not-ready" : "unknown"
-				});
-				throw Errors.providerError("openfort", "signerRecovery", retryCause, {
-					failure_mode: "signer-not-ready",
-					details: {
-						provider_error_source: "openfort",
-						provider_error_code: providerErrorCode
-					}
-				});
-			}
-		}
-	};
-	return {
-		...signer,
-		signUserOpHash,
-		statusStore,
-		ensureWalletReady: ensureOpenfortWalletReady,
-		getAddress: async () => {
-			try {
-				const address = await signer.getAddress();
-				diagnostic?.trace("openfort.address", { ok: true });
-				return address;
-			} catch (cause) {
-				diagnostic?.trace("openfort.address", {
-					ok: false,
-					failure_mode: "unknown"
-				});
-				throw openfortProviderError("getAddress", cause);
-			}
-		},
-		resetSession: resetReadiness
-	};
-}
-function normalizeBetterAuthBaseUrl(raw) {
-	const trimmed = raw.replace(/\/$/, "");
-	return trimmed.endsWith("/api/auth") ? trimmed : `${trimmed}/api/auth`;
-}
-//#endregion
-//#region src/telemetry/from-posthog.ts
-/**
-* Drop props that must never cross to a host-owned external sink. Today that is
-* the `$exception` `details` blob: `captureException` serializes
-* `CapxulError.details` (e.g. `{ asset, available, required }`, `{ name }`,
-* `{ accountId }` — errors.ts) into it, and the shared redactor has no
-* `$exception` rule, so it is stripped here at the boundary (infra#1037). The
-* safe fields (error code, operation, failure_mode, the fixed leak-safe message,
-* stack frames) are preserved.
-*/
-function stripHostUnsafeProps(props) {
-	if (props === void 0) return void 0;
-	const { details: _details, ...safe } = props;
-	return safe;
-}
-/**
-* The subset of a posthog-js client the seam calls. `identify` / `group` /
-* `reset` are optional — a host that only wants event capture can omit them.
-*/
-/**
-* Adapt the host's already-initialized posthog-like client into a
-* `TelemetryPort` for the `telemetry` prop / input. This port SUPPLANTS the
-* SDK's no-op default telemetry sink (`production.ts` binds it via
-* `Layer.succeed`, not `compose` — there is no client-side success relay to
-* compose with); it is additive to Capxul's backend first-party record and
-* never owns the client.
-*/
-function postHogProductTelemetry(policy, fixedSnapshot) {
-	const telemetry = new PostHogTelemetryAdapter({
-		capture: (name, props, source) => {
-			const snapshot = readInvocationObservation(source) ?? fixedSnapshot ?? policy.snapshot();
-			if (!snapshot.active || policy.client === null || policy.client === void 0) return;
-			const event = stampTelemetryEnvelope({
-				name,
-				props
-			}, {
-				capxul_env: policy.capxulEnv,
-				producer: "sdk"
-			});
-			policy.deliver(() => policy.client.capture(name, {
-				...stripHostUnsafeProps(event.props),
-				...observationContextProps(snapshot.context)
-			}));
-		},
-		identify: (input) => {
-			if (!(fixedSnapshot ?? policy.snapshot()).active || policy.client?.identify === void 0) return;
-			policy.deliver(() => policy.client.identify(input.distinctId, {
-				...input.traits,
-				...input.properties
-			}));
-		},
-		group: (input) => {
-			if (!(fixedSnapshot ?? policy.snapshot()).active || policy.client?.group === void 0) return;
-			policy.deliver(() => policy.client.group(input.groupType, input.groupKey, input.properties === void 0 ? void 0 : { ...input.properties }));
-		},
-		reset: () => {
-			if (!(fixedSnapshot ?? policy.snapshot()).active || policy.client?.reset === void 0) return;
-			policy.deliver(() => policy.client.reset());
-		}
-	});
-	Object.defineProperty(telemetry, PRODUCT_INVOCATION, {
-		enumerable: false,
-		value: (source) => postHogProductTelemetry(policy, readInvocationObservation(source) ?? fixedSnapshot ?? policy.snapshot())
-	});
-	return telemetry;
-}
-//#endregion
-//#region src/host-observability.ts
-const HOST_INVOCATION = Symbol("capxul.host-observability-invocation");
-/** Build the SDK's one host module around an already-initialized PostHog client. */
-function postHogObservability(client, options = {}) {
-	const inactive = Object.freeze({
-		active: false,
-		contextProps: Object.freeze({})
-	});
-	const snapshot = () => {
-		if (client === null || client === void 0) return inactive;
-		try {
-			if (!(typeof options.enabled === "function" ? options.enabled() : options.enabled ?? true)) return inactive;
-			const rawContext = typeof options.context === "function" ? options.context() : options.context;
-			const sanitized = sanitizeObservationContext(rawContext);
-			const context = sanitized === void 0 ? void 0 : Object.freeze({ ...sanitized });
-			return Object.freeze({
-				active: true,
-				...context === void 0 ? {} : { context },
-				contextProps: Object.freeze(observationContextProps(context))
-			});
-		} catch {
-			return inactive;
-		}
-	};
-	const policy = {
-		client,
-		capxulEnv: options.capxulEnv ?? "unknown",
-		snapshot,
-		deliver: (capture) => {
-			try {
-				const delivery = capture();
-				if (isPromiseLike(delivery)) Promise.resolve(delivery).catch(() => void 0);
-			} catch {}
-		}
-	};
-	const module = {
-		failures: postHogFailureObservation(policy),
-		product: postHogProductTelemetry(policy)
-	};
-	Object.defineProperty(module, HOST_INVOCATION, {
-		enumerable: false,
-		value: {
-			bind: () => {
-				const invocation = snapshot();
-				return {
-					failures: postHogFailureObservation(policy, invocation),
-					product: postHogProductTelemetry(policy, invocation)
-				};
-			},
-			snapshot
-		}
-	});
-	return module;
-}
-/** @internal Bind both projections to one call-start decision/context snapshot. */
-function bindHostObservabilityInvocation(observability) {
-	return observability?.[HOST_INVOCATION]?.bind() ?? observability;
-}
-/** @internal Read one call-start snapshot for actor/transition carriage. */
-function snapshotHostObservability(observability) {
-	const snapshot = observability?.[HOST_INVOCATION]?.snapshot();
-	return snapshot === void 0 ? void 0 : {
-		active: snapshot.active,
-		...snapshot.context === void 0 ? {} : { context: snapshot.context }
-	};
-}
-function isPromiseLike(value) {
-	return (typeof value === "object" && value !== null || typeof value === "function") && "then" in value;
-}
-const SDK_VERSION = version;
-/**
-* Project the built graph into the flat `FlowPorts` record the method bundles
-* still take. It is a VIEW of `ProductionAdapters.context`, taken from the
-* graph and never instead of it — the graph stays alive in the scope and is
-* handed to every caller.
-*/
-const collectProductionFlowPorts = Effect.gen(function* () {
-	const authClient = yield* AuthClientPortTag;
-	const authCache = yield* AuthCachePortTag;
-	const bootstrap = yield* BootstrapPortTag;
-	const clock = yield* ClockPortTag;
-	const convexCall = yield* ConvexCallPortTag;
-	return {
-		authClient,
-		authCache,
-		identity: yield* IdentityPortTag,
-		smartAccount: yield* SmartAccountPortTag,
-		accountRead: yield* AccountReadPortTag,
-		bootstrap,
-		clock,
-		telemetry: yield* TelemetryPortTag,
-		convexCall
-	};
-});
-function makeProductionAdapterLayerEntries(input) {
-	const refreshConvexAuthRef = {
-		current: null,
-		pending: false
-	};
-	return [
-		{
-			name: "bootstrap",
-			layer: productionBootstrapPortLayer(input.bootstrap)
-		},
-		{
-			name: "authClient",
-			layer: productionAuthClientLayer(input, refreshConvexAuthRef, input.resetSignerSession)
-		},
-		{
-			name: "authCache",
-			layer: productionAuthCacheLayer(input)
-		},
-		{
-			name: "identity",
-			layer: ConvexIdentityLayer()
-		},
-		{
-			name: "smartAccount",
-			layer: ConvexSmartAccountLayer()
-		},
-		{
-			name: "accountRead",
-			layer: ConvexAccountLayer()
-		},
-		{
-			name: "clock",
-			layer: SystemClockLayer()
-		},
-		{
-			name: "telemetry",
-			layer: input.telemetry === void 0 ? PostHogTelemetryLayer({ capture: () => void 0 }) : Layer.succeed(TelemetryPortTag, input.telemetry)
-		},
-		{
-			name: "convexCall",
-			layer: productionConvexCallLayer(input, refreshConvexAuthRef)
-		},
-		{
-			name: "org",
-			layer: Layer.effect(OrgPortTag, Effect.all([ConvexCallPortTag, TelemetryPortTag]).pipe(Effect.map(([convex, telemetry]) => new ConvexOrganizationAdapter({
-				convex,
-				telemetry
-			}))))
-		}
-	];
-}
-function mergeProductionAdapterLayers(entries) {
-	const byName = /* @__PURE__ */ new Map();
-	for (const entry of entries) byName.set(entry.name, entry.layer);
-	const authClientLayer = byName.get("authClient");
-	const convexCallLayer = byName.get("convexCall");
-	const telemetryLayer = byName.get("telemetry");
-	const convexCallReadyLayer = convexCallLayer === void 0 || authClientLayer === void 0 ? convexCallLayer : convexCallLayer.pipe(Layer.provide(authClientLayer));
-	const observedConvexCallLayer = convexCallReadyLayer === void 0 ? telemetryLayer : telemetryLayer === void 0 ? convexCallReadyLayer : Layer.merge(convexCallReadyLayer, telemetryLayer);
-	return entries.map((entry) => {
-		const layer = byName.get(entry.name) ?? entry.layer;
-		if (entry.name === "convexCall") return convexCallReadyLayer ?? layer;
-		if (entry.name === "accountRead" || entry.name === "org") return observedConvexCallLayer === void 0 ? layer : layer.pipe(Layer.provide(observedConvexCallLayer));
-		if (isConvexDependentLayer(entry.name)) return convexCallReadyLayer === void 0 ? layer : layer.pipe(Layer.provide(convexCallReadyLayer));
-		return layer;
-	}).reduce((current, layer) => Layer.merge(current, layer), Layer.empty);
-}
-function isConvexDependentLayer(name) {
-	return name === "identity" || name === "smartAccount" || name === "accountRead" || name === "org";
-}
-function productionBootstrapPortLayer(bootstrap) {
-	return Layer.succeed(BootstrapPortTag, bootstrap);
-}
-function productionAuthClientLayer(input, refreshConvexAuthRef, resetSignerSessionRef) {
-	return (input.authClient !== void 0 ? Layer.succeed(AuthClientPortTag, input.authClient) : input.runtime === "browser" ? BetterAuthBrowserLayer({
-		authBaseUrl: input.runtimeUrls.authBaseUrl,
-		...input.fetch === void 0 ? {} : { fetch: input.fetch },
-		...input.observation === void 0 ? {} : { observation: input.observation }
-	}) : BetterAuthNodeLayer({
-		authBaseUrl: input.runtimeUrls.authBaseUrl,
-		...input.origin === void 0 ? {} : { origin: input.origin },
-		...input.fetch === void 0 ? {} : { fetch: input.fetch },
-		...input.observation === void 0 ? {} : { observation: input.observation }
-	})).pipe(Layer.flatMap((context) => {
-		const refreshed = refreshConvexAuthOnSession(Context.get(context, AuthClientPortTag), () => {
-			const refresh = refreshConvexAuthRef.current;
-			if (refresh === null) {
-				refreshConvexAuthRef.pending = true;
-				return;
-			}
-			refresh();
-		});
-		return Layer.succeedContext(Context.make(AuthClientPortTag, resetSignerSessionRef === void 0 ? refreshed : resetSignerSessionOnSignOut(refreshed, resetSignerSessionRef)));
-	}));
-}
-function productionAuthCacheLayer(input) {
-	return Layer.succeed(AuthCachePortTag, input.authCache ?? detectAuthCacheAdapter());
-}
-function productionConvexCallLayer(input, refreshConvexAuthRef) {
-	return Layer.unwrap(Effect.map(AuthClientPortTag, (authClient) => ConvexCallLayer({
-		convexUrl: input.runtimeUrls.convexUrl,
-		...input.applicationId === void 0 ? {} : { applicationId: input.applicationId },
-		...input.observation === void 0 ? {} : { observation: input.observation },
-		...input.convexClient === void 0 ? {} : { client: input.convexClient },
-		tokenProvider: async ({ forceRefreshToken }) => {
-			const tokenResult = await Effect.runPromise(Effect.result(authClient.getConvexJwt({
-				forceRefresh: forceRefreshToken,
-				...input.signal === void 0 ? {} : { signal: input.signal }
-			})));
-			if (Result.isFailure(tokenResult)) return null;
-			return String(tokenResult.success.token);
-		}
-	}).pipe(Layer.flatMap((context) => {
-		const convexCall = Context.get(context, ConvexCallPortTag);
-		if (isRefreshableConvexCallPort(convexCall)) {
-			refreshConvexAuthRef.current = () => convexCall.refreshAuth();
-			if (refreshConvexAuthRef.pending) {
-				refreshConvexAuthRef.pending = false;
-				refreshConvexAuthRef.current();
-			}
-		}
-		return Layer.succeedContext(context);
-	}))));
-}
-function isRefreshableConvexCallPort(convexCall) {
-	return "refreshAuth" in convexCall && typeof convexCall.refreshAuth === "function";
-}
-function resolveProductionObservability(input) {
-	const observation = input.observability?.failures ?? input.observation;
-	const telemetry = input.observability?.product ?? input.telemetry;
-	const invocationObservability = input.invocationObservability;
-	return {
-		observation,
-		telemetry,
-		invocationObservation: invocationObservability?.failures ?? observation,
-		invocationTelemetry: invocationObservability?.product ?? telemetry
-	};
-}
-async function createProductionAdapters(input) {
-	const { observation, telemetry, invocationObservation, invocationTelemetry } = resolveProductionObservability(input);
-	const resolvedInput = resolveInput(input);
-	if (!resolvedInput.ok) return resolvedInput;
-	const scope = await Effect.runPromise(Scope.make());
-	const closeScope = idempotentClose(() => Effect.runPromise(Scope.close(scope, Exit.void)));
-	const bootstrapLayer = HttpBootstrapLayer({
-		bootstrapBaseUrl: resolvedInput.value.bootstrapBaseUrl,
-		...input.fetch === void 0 ? {} : { fetch: input.fetch },
-		...invocationObservation === void 0 ? {} : { observation: invocationObservation }
-	});
-	try {
-		const bootstrapContext = await Effect.runPromise(Layer.buildWithScope(bootstrapLayer, scope));
-		const bootstrap = Context.get(bootstrapContext, BootstrapPortTag);
-		const bootstrapResult = await runBootstrap(bootstrap.resolve({
-			publishableKey: resolvedInput.value.publishableKey,
-			...resolvedInput.value.origin === void 0 ? {} : { origin: resolvedInput.value.origin }
-		}));
-		if (!bootstrapResult.ok) {
-			await emitBootstrapTelemetry(invocationTelemetry, {
-				name: "bootstrap_failed",
-				props: {
-					...bootstrapTelemetryEnvelope(input, resolvedInput.value),
-					reason: bootstrapResult.error.code,
-					...failureDetail(bootstrapResult.error),
-					...failureEvidenceProps(bootstrapResult.error)
-				}
-			});
-			await closeScope().catch(() => void 0);
-			return bootstrapResult;
-		}
-		const chainFence = assertDevKeySignerIsTestnetOnly(input.signer, bootstrapResult.value.chainId);
-		if (!chainFence.ok) {
-			await closeScope().catch(() => void 0);
-			return chainFence;
-		}
-		const runtimeUrlsResult = resolveRuntimeUrls(bootstrapResult.value, resolvedInput.value.runtime, input.authBaseUrl);
-		if (!runtimeUrlsResult.ok) {
-			await emitBootstrapTelemetry(invocationTelemetry, {
-				name: "bootstrap_failed",
-				props: {
-					...bootstrapTelemetryEnvelope(input, resolvedInput.value),
-					applicationId: bootstrapResult.value.applicationId,
-					reason: runtimeUrlsResult.error.code
-				}
-			});
-			await closeScope().catch(() => void 0);
-			return runtimeUrlsResult;
-		}
-		const runtimeUrls = runtimeUrlsResult;
-		await emitBootstrapTelemetry(invocationTelemetry, {
-			name: "bootstrap_resolved",
-			props: {
-				...bootstrapTelemetryEnvelope(input, resolvedInput.value),
-				applicationId: bootstrapResult.value.applicationId
-			}
-		});
-		let injectedClient;
-		const convexClientFactory = input.convexClientFactory;
-		if (convexClientFactory !== void 0) try {
-			injectedClient = convexClientFactory(runtimeUrls.value.convexUrl);
-		} catch (cause) {
-			await closeScope().catch(() => void 0);
-			return {
-				ok: false,
-				error: toPublicError(cause, "createProductionAdapters")
-			};
-		}
-		const portsLayer = mergeProductionAdapterLayers(makeProductionAdapterLayerEntries({
-			bootstrap,
-			runtime: resolvedInput.value.runtime,
-			...resolvedInput.value.origin === void 0 ? {} : { origin: resolvedInput.value.origin },
-			runtimeUrls: runtimeUrls.value,
-			chainId: bootstrapResult.value.chainId,
-			applicationId: bootstrapResult.value.applicationId,
-			...observation === void 0 ? {} : { observation },
-			...input.authCache === void 0 ? {} : { authCache: input.authCache },
-			...input.authClient === void 0 ? {} : { authClient: input.authClient },
-			...telemetry === void 0 ? {} : { telemetry },
-			...injectedClient === void 0 ? {} : { convexClient: injectedClient },
-			...input.fetch === void 0 ? {} : { fetch: input.fetch },
-			...input.signal === void 0 ? {} : { signal: input.signal },
-			...input.resetSignerSession === void 0 ? {} : { resetSignerSession: input.resetSignerSession }
-		}));
-		const applicationLayer = Layer.merge(portsLayer, optionalEngineeringTelemetryLayer(bootstrapResult.value.engineeringTelemetry, resolvedInput.value.runtime));
-		const context = await Effect.runPromise(Layer.buildWithScope(applicationLayer, scope));
-		const ports = await Effect.runPromise(collectProductionFlowPorts.pipe(Effect.provide(context)));
-		const stopConnectionObservation = observeProductionConvexConnection(ports.convexCall, context);
-		const close = idempotentClose(async () => {
-			try {
-				stopConnectionObservation();
-			} finally {
-				await closeScope();
-			}
-		});
-		return {
-			ok: true,
-			value: {
-				context,
-				ports,
-				bootstrap: bootstrapResult.value,
-				close
-			}
-		};
-	} catch (cause) {
-		await closeScope().catch(() => void 0);
-		return {
-			ok: false,
-			error: toPublicError(cause, "createProductionAdapters")
-		};
-	}
-}
-function observeProductionConvexConnection(convexCall, context) {
-	if (!("observeConnection" in convexCall) || typeof convexCall.observeConnection !== "function") return () => {};
-	const runPromise = Effect.runPromiseWith(context);
-	try {
-		return convexCall.observeConnection((diagnostic) => {
-			const message = diagnostic.transition === "connected" ? Effect.logInfo("convex.connection.changed") : Effect.logWarning("convex.connection.changed");
-			runPromise(message.pipe(Effect.annotateLogs(diagnostic), Effect.catchCause(() => Effect.void))).catch(() => void 0);
-		});
-	} catch {
-		return () => {};
-	}
-}
-function optionalEngineeringTelemetryLayer(policy, runtime) {
-	if (policy === void 0) return Layer.empty;
-	try {
-		return makeEngineeringTelemetryLayer({
-			host: policy.host,
-			headers: { authorization: `Bearer ${policy.projectToken}` },
-			capxulEnv: policy.capxulEnv,
-			producer: runtime === "browser" ? "browser" : "server",
-			sdkVersion: SDK_VERSION
-		});
-	} catch {
-		return Layer.empty;
-	}
-}
-function refreshConvexAuthOnSession(authClient, refresh) {
-	return {
-		...authClient,
-		verifyOtp: (input, options) => authClient.verifyOtp(input, options).pipe(Effect.tap(() => Effect.sync(refresh))),
-		signOut: (options) => authClient.signOut(options).pipe(Effect.tap(() => Effect.sync(refresh)))
-	};
-}
-/**
-* Signer-session reset, as a port wrapper INSIDE the Layer graph (blueprint §2:
-* "wrappers become Layers, not post-hoc spreads/Proxies").
-*
-* This was a spread over the assembled client — `{...client, auth: {...,
-* signOut}}` — applied after composition finished, so the reset lived on one
-* particular object rather than on the auth seam itself. Here it wraps
-* `AuthClientPort.signOut`, so it holds for every route to a sign-out.
-*
-* Capture the sign-out exit before reset. This preserves the old `try/finally`
-* order and keeps a reset failure in the typed error channel.
-*/
-function resetSignerSessionOnSignOut(authClient, resetRef) {
-	return {
-		...authClient,
-		signOut: (options) => Effect.gen(function* () {
-			const exit = yield* Effect.exit(authClient.signOut(options));
-			yield* Effect.try({
-				try: () => resetRef.current?.(),
-				catch: (cause) => new AuthClientError({
-					operation: "signOut",
-					kind: "signer",
-					cause
-				})
-			});
-			return yield* exit;
-		})
-	};
-}
-async function createCapxulClient$1(input) {
-	const invocationObservability = bindHostObservabilityInvocation(input.observability);
-	const observation = invocationObservability?.failures ?? input.observation;
-	const validation = validateCreateCapxulClientInput(input);
-	if (!validation.ok) return observeFailedResult(validation, observation, "createCapxulClient");
-	const resetSignerSession = { current: null };
-	const adapters = await createProductionAdapters({
-		...input,
-		resetSignerSession,
-		...invocationObservability === void 0 ? {} : { invocationObservability }
-	});
-	if (!adapters.ok) return observeFailedResult(adapters, observation, "createCapxulClient");
-	try {
-		const runtime = input.runtime ?? detectRuntime();
-		const resolvedAuthBaseUrl = resolveBrowserAuthBaseUrl({
-			bootstrapAuthBaseUrl: adapters.value.bootstrap.authBaseUrl,
-			runtime,
-			...input.authBaseUrl === void 0 ? {} : { override: input.authBaseUrl }
-		});
-		let signer = input.signer;
-		if (signer === void 0 && runtime === "browser") signer = createOpenfortBrowserSignerFromBootstrap({
-			...adapters.value.bootstrap,
-			authBaseUrl: resolvedAuthBaseUrl
-		}, { diagnostic: new ConsoleDiagnosticAdapter() });
-		if (signer !== void 0 && "resetSession" in signer) {
-			const { resetSession, source } = signer;
-			resetSignerSession.current = () => {
-				try {
-					resetSession();
-				} catch (cause) {
-					throw signerFailure(source, "resetSession", cause);
-				}
-			};
-		}
-		const client = assembleCapxulClient({
-			ports: adapters.value.ports,
-			bootstrap: adapters.value.bootstrap,
-			authCache: adapters.value.ports.authCache,
-			requirement: input.requirement ?? "none",
-			...signer === void 0 ? {} : { signer },
-			orgPort: Context.get(adapters.value.context, OrgPortTag),
-			...signer === void 0 ? {} : { organizationSetup: new ConvexOrganizationSetupAdapter({
-				convex: adapters.value.ports.convexCall,
-				signer,
-				chainId: adapters.value.bootstrap.chainId
-			}) },
-			...input.signal === void 0 ? {} : { signal: input.signal },
-			...input.otpTtlMs === void 0 ? {} : { otpTtlMs: input.otpTtlMs },
-			invokeTimeoutMs: input.invokeTimeoutMs ?? 3e4,
-			...input.observability?.failures === void 0 && input.observation === void 0 ? {} : { failureObservation: input.observability?.failures ?? input.observation },
-			...input.observability === void 0 ? {} : { hostObservationSnapshot: () => snapshotHostObservability(input.observability) },
-			effectRunner: {
-				runSync: Effect.runSyncWith(adapters.value.context),
-				runPromise: Effect.runPromiseWith(adapters.value.context)
-			}
-		});
-		const upstreamClose = adapters.value.close;
-		const close = idempotentClose(async () => {
-			try {
-				if (signer !== void 0 && "resetSession" in signer) try {
-					signer.resetSession();
-				} catch (cause) {
-					throw signerFailure(signer.source, "resetSession", cause);
-				}
-			} finally {
-				await Promise.all([client._internal.close?.(), upstreamClose()]);
-			}
-		});
-		return {
-			ok: true,
-			value: {
-				...client,
-				_internal: {
-					...client._internal,
-					close
-				}
-			}
-		};
-	} catch (cause) {
-		await adapters.value.close().catch(() => void 0);
-		return observeFailedResult({
-			ok: false,
-			error: toPublicError(cause, "createCapxulClient")
-		}, observation, "createCapxulClient");
-	}
-}
-function validateCreateCapxulClientInput(input) {
-	const runtime = input.runtime ?? detectRuntime();
-	if ((input.requirement ?? "none") === "deployed" && input.signer === void 0 && runtime !== "browser") return {
-		ok: false,
-		error: Errors.invalidInput("signer", "required when requirement is \"deployed\"")
-	};
-	return {
-		ok: true,
-		value: void 0
-	};
-}
-function resolveInput(input) {
-	try {
-		const runtime = input.runtime ?? detectRuntime();
-		const publishableKey = toPublishableKey(input.publishableKey);
-		const origin = input.origin === void 0 ? runtime === "browser" ? toAllowedOrigin(derivedBrowserOrigin(runtime)) : void 0 : toAllowedOrigin(input.origin);
-		return {
-			ok: true,
-			value: {
-				publishableKey,
-				...origin === void 0 ? {} : { origin },
-				bootstrapBaseUrl: normalizeHttpUrl("bootstrapBaseUrl", input.bootstrapBaseUrl ?? (runtime === "browser" ? derivedBrowserOrigin(runtime) : "https://api.capxul.com")),
-				runtime
-			}
-		};
-	} catch (cause) {
-		return {
-			ok: false,
-			error: toPublicError(cause, "createProductionAdapters")
-		};
-	}
-}
-function detectRuntime() {
-	const globalAny = globalThis;
-	return globalAny.window !== void 0 || globalAny.document !== void 0 ? "browser" : "node";
-}
-function derivedBrowserOrigin(runtime) {
-	if (runtime !== "browser") throw Errors.invalidInput("origin", "required outside browser runtime");
-	const globalAny = globalThis;
-	if (typeof globalAny.location?.origin === "string" && globalAny.location.origin.length > 0) return globalAny.location.origin;
-	throw Errors.invalidInput("origin", "required when browser location is unavailable");
-}
-/**
-* Browser local dev serves `/api/auth` via the Vite proxy on `window.location.origin`
-* while bootstrap returns the remote Convex site host. Openfort wallet setup reads
-* Better Auth cookies from `get-session` — those only attach on the same origin the
-* OTP flow used, so rewrite when hosts differ.
-*/
-function resolveBrowserAuthBaseUrl(input) {
-	if (input.override !== void 0) return normalizeHttpUrl("authBaseUrl", input.override);
-	const bootstrapUrl = normalizeHttpUrl("authBaseUrl", input.bootstrapAuthBaseUrl);
-	if (input.runtime !== "browser") return bootstrapUrl;
-	try {
-		const localAuthBase = normalizeHttpUrl("authBaseUrl", `${derivedBrowserOrigin(input.runtime)}/api/auth`);
-		const remoteAuthBase = bootstrapUrl.endsWith("/api/auth") ? bootstrapUrl : `${bootstrapUrl}/api/auth`;
-		if (new URL(remoteAuthBase).host !== new URL(localAuthBase).host) return localAuthBase;
-		return bootstrapUrl;
-	} catch {
-		return bootstrapUrl;
-	}
-}
-function resolveRuntimeUrls(bootstrap, runtime, authBaseUrlOverride) {
-	try {
-		return {
-			ok: true,
-			value: {
-				authBaseUrl: resolveBrowserAuthBaseUrl({
-					bootstrapAuthBaseUrl: bootstrap.authBaseUrl,
-					runtime,
-					...authBaseUrlOverride === void 0 ? {} : { override: authBaseUrlOverride }
-				}),
-				convexUrl: normalizeHttpUrl("convexUrl", bootstrap.convexUrl)
-			}
-		};
-	} catch (cause) {
-		return {
-			ok: false,
-			error: toPublicError(cause, "createProductionAdapters")
-		};
-	}
-}
-async function runBootstrap(effect) {
-	const result = await Effect.runPromise(Effect.result(effect));
-	if (Result.isSuccess(result)) return {
-		ok: true,
-		value: result.success
-	};
-	return {
-		ok: false,
-		error: toPublicError(result.failure, "bootstrap.resolve")
-	};
-}
-/**
-* Bootstrap-event props. `runtime` used to be called `capxulEnv`, which was a
-* name collision, not a value: it carried "browser"/"node", never an
-* environment. ADR-0020 A1 makes `capxul_env` the environment discriminator
-* every synced artifact filters on, so this field was renamed to what it
-* actually is. `sdk_version` follows the canon envelope spelling.
-*/
-function bootstrapTelemetryEnvelope(input, resolvedInput) {
-	return {
-		runtime: resolvedInput.runtime,
-		env: input.requirement ?? "none",
-		...resolvedInput.origin === void 0 ? {} : { origin: resolvedInput.origin },
-		sdk_version: SDK_VERSION
-	};
-}
-async function emitBootstrapTelemetry(telemetry, event) {
-	if (telemetry === void 0) return;
-	await Effect.runPromise(telemetry.emit(event).pipe(Effect.catchDefect(() => Effect.void)));
-}
-function normalizeHttpUrl(field, raw) {
-	let parsed;
-	try {
-		parsed = new URL(raw);
-	} catch {
-		throw Errors.invalidInput(field, "must be an http or https URL");
-	}
-	if (parsed.protocol !== "http:" && parsed.protocol !== "https:") throw Errors.invalidInput(field, "must be an http or https URL");
-	return parsed.toString().replace(/\/$/, "");
-}
-function toPublicError(cause, operation) {
-	if (cause instanceof CapxulError) return cause;
-	if (typeof cause === "object" && cause !== null) {
-		const publicError = cause.publicError;
-		if (publicError instanceof CapxulError) return publicError;
-		const nestedCause = cause.cause;
-		if (nestedCause instanceof CapxulError) return nestedCause;
-	}
-	return Errors.providerError("sdk-production-adapters", operation, cause);
-}
-function idempotentClose(close) {
-	let closed = false;
-	return async () => {
-		if (closed) return;
-		closed = true;
-		await close();
-	};
-}
-//#endregion
 //#region src/surface/create-capxul-client-from-production.ts
 /** Consumer-facing factory — accepts only production-meaningful inputs (#326). */
 async function createCapxulClient(input) {
@@ -3886,7 +461,7 @@ function captureException(telemetry, error, context) {
 		for (const key of Object.keys(properties)) if (properties[key] === void 0) delete properties[key];
 		const props = projectSdkException({
 			properties,
-			sdkVersion: SDK_VERSION$1,
+			sdkVersion: SDK_VERSION,
 			operation,
 			errorKind: errorCode,
 			failureMode,
@@ -3921,4 +496,4 @@ function captureExceptionSync(telemetry, error, context) {
 	} catch {}
 }
 //#endregion
-export { CAPXUL_ERROR_CODES, CAPXUL_OPERATIONS, CAPXUL_PAYMENTS_V2_ADDRESS, CAPXUL_SDK_EXPECTED_OUTCOME_EVENT, CHAIN_UPSTREAMS, CapxulError, EVM_ADDRESS_RE, Errors, FAILURE_MODES, HANDLE_RE, PAYMENT_DIRECTIONS, PAYMENT_STATUSES, captureException, captureExceptionSync, createCapxulClient, deriveDevPrivateKey, devPrivateKeySigner, eip1193AccountProvider, embeddedSigner, fingerprintPaymentIntent, formatMoney, inboxPhase, injectedWalletSigner, isCapxulError, isCapxulOperation, isClaimed, isMoneyParseError, isRestoring, isSettingUpLifecycle, localPrivateKeyAccountProvider, normalizeCapxulOperation, openfortEmbeddedSigner, openfortEmbeddedSignerFromWallet, openfortEmbeddedWalletPort, parseMoney, paymentPhase, postHogObservability, requestPhase, destination as resolveIdentityDestination, toCountryCode, toAddress as toEvmAddress, toHandle, toPartyId };
+export { CAPXUL_ERROR_CODES, CAPXUL_OPERATIONS, CAPXUL_PAYMENTS_V2_ADDRESS, CAPXUL_SDK_EXPECTED_OUTCOME_EVENT, CHAIN_UPSTREAMS, CapxulError, EVM_ADDRESS_RE, Errors, FAILURE_MODES, HANDLE_RE, PAYMENT_DIRECTIONS, PAYMENT_STATUSES, PEG_RATES, assetSymbolFor, captureException, captureExceptionSync, createCapxulClient, deriveDevPrivateKey, devPrivateKeySigner, eip1193AccountProvider, embeddedSigner, fingerprintPaymentIntent, formatAssetAmount, formatMoney, inboxPhase, injectedWalletSigner, isCapxulError, isCapxulOperation, isClaimed, isMoneyParseError, isRestoring, isSettingUpLifecycle, localPrivateKeyAccountProvider, normalizeCapxulOperation, openfortEmbeddedSigner, openfortEmbeddedSignerFromWallet, openfortEmbeddedWalletPort, parseAssetAmount, parseMoney, paymentPhase, postHogObservability, requestPhase, destination as resolveIdentityDestination, toCountryCode, toAddress as toEvmAddress, toHandle, toPartyId, valueIn };