@capxul/sdk 4.20.0-beta.1 → 4.20.0-beta.3

package/dist/{production-BmsFhDUr.mjs → production-M4dWz5g4.mjs}

@@ -1,9 +1,9 @@
-import { $ as toRoleKey, B as toCurrencyCode, C as ASSET_ID_RE, Ct as isCredentialField, D as WEI_RE, E as SUPPORTED_CURRENCY_CODES, F as toAssetId, G as toHandle, H as toEmail, I as toAuthUserId, J as toOrgId, K as toJwtToken, L as toBudgetId, M as toAddress, N as toAllowedOrigin, O as ZERO_BYTES32, Q as toPublishableKey, R as toChainId, S as APP_ID_RE, St as containsSensitiveMaterial, T as EVM_ADDRESS_RE$1, Tt as redactUrlSecrets, U as toEpochMs, V as toDurationMs, W as toEpochSeconds, X as toPayrollGroupId, Y as toPartyId, Z as toPayrollRunId, _ as normalizeBindingEmail, _t as decodeChainCause, b as configuredMoneyAssetById, bt as isFailureMode, c as AuthCachePortTag, ct as CapxulError, d as authClientPortFromPromiseAdapter, dt as isCapxulError, et as toSessionToken, f as AuthClientError, ft as CHAIN_UPSTREAMS, gt as chainEvidenceLabel, h as orgRoleKeyForLabel, ht as chainCauseProperties, i as BrowserAuthCacheAdapter, it as validateHandle, j as toAccountId, l as SystemClockLayer, lt as EXPECTED_OPERATION_OUTCOMES, m as ADMIN_ROLE_LABEL, mt as boundedResponseHeaders, nt as toTxHash, ot as decodeConvexError, p as AuthClientPortTag, pt as FAILURE_MODES$1, q as toKycTier, r as InMemoryAuthCacheAdapter, rt as toWeiAmount, st as CAPXUL_ERROR_CODES, tt as toTesterKind, u as ClockPortTag, ut as Errors, v as BASE_SEPOLIA_CHAIN_ID, vt as failureFingerprint, w as BYTES32_RE, wt as redactSecrets, x as ACCOUNT_ID_RE, xt as revertSummaryText, y as deriveCapxulSafeAddress, yt as isChainUpstream, z as toCountryCode } from "./OAuthBearerAuthClient-DDD0JlaI.mjs";
+import { $ as toPartyId, A as SUPPORTED_CURRENCY_CODES, B as toAuthUserId, C as ASSET_ID_RE, Ct as isChainUpstream, D as COUNTRY_CODE_RE, Dt as isCredentialField, E as CLIENT_REQUEST_ID_RE, Et as containsSensitiveMaterial, F as toAccountId, G as toDurationMs, H as toChainId, I as toAddress, J as toEpochSeconds, K as toEmail, L as toAllowedOrigin, M as ZERO_BYTES32, O as EMAIL_RE$1, Ot as redactSecrets, Q as toOrgId, S as APP_ID_RE, St as failureFingerprint, T as CLIENT_GRANT_ID_RE, Tt as revertSummaryText, U as toCountryCode, V as toBudgetId, W as toCurrencyCode, X as toJwtToken, Y as toHandle, Z as toKycTier, _ as normalizeBindingEmail, _t as FAILURE_MODES$1, at as toTesterKind, b as configuredMoneyAssetById, bt as chainEvidenceLabel, c as AuthCachePortTag, ct as validateHandle, d as authClientPortFromPromiseAdapter, dt as CAPXUL_ERROR_CODES, et as toPayrollGroupId, f as AuthClientError, ft as CapxulError, gt as CHAIN_UPSTREAMS, h as orgRoleKeyForLabel, ht as isCapxulError, i as BrowserAuthCacheAdapter, it as toSessionToken, j as WEI_RE, k as EVM_ADDRESS_RE$1, kt as redactUrlSecrets, l as SystemClockLayer, lt as HANDLE_RE$1, m as ADMIN_ROLE_LABEL, mt as Errors, nt as toPublishableKey, ot as toTxHash, p as AuthClientPortTag, pt as EXPECTED_OPERATION_OUTCOMES, q as toEpochMs, r as InMemoryAuthCacheAdapter, rt as toRoleKey, st as toWeiAmount, tt as toPayrollRunId, u as ClockPortTag, ut as decodeConvexError, v as BASE_SEPOLIA_CHAIN_ID, vt as boundedResponseHeaders, w as BYTES32_RE, wt as isFailureMode, x as ACCOUNT_ID_RE, xt as decodeChainCause, y as deriveCapxulSafeAddress, yt as chainCauseProperties, z as toAssetId } from "./OAuthBearerAuthClient-DWkofxdZ.mjs";
 import { formatUnits, keccak256, parseUnits, recoverAddress, stringToHex, toBytes } from "viem";
-import { Cause, Clock, Context, Data, Deferred, Duration, Effect, Exit, Fiber, FiberSet, Layer, Logger, Option, Queue, Ref, Result, Schedule, Schema, SchemaGetter, SchemaIssue, SchemaParser, Scope, Stream, Tracer } from "effect";
+import { Cause, Clock, Context, Data, Deferred, Duration, Effect, Exit, Fiber, FiberSet, Layer, Logger, Metric, Option, Queue, Ref, References, Result, Schedule, Schema, SchemaGetter, SchemaIssue, SchemaParser, Scope, Stream, Tracer } from "effect";
 import { getFunctionName, makeFunctionReference } from "convex/server";
 import { privateKeyToAccount } from "viem/accounts";
-import { FetchHttpClient, Headers, HttpBody, HttpClient, HttpClientResponse, HttpTraceContext } from "effect/unstable/http";
+import { FetchHttpClient, Headers, HttpBody, HttpClient, HttpClientError, HttpClientResponse, HttpTraceContext } from "effect/unstable/http";
 import { OtlpExporter, OtlpLogger, OtlpMetrics, OtlpSerialization, OtlpTracer } from "effect/unstable/observability";
 import { ConvexClient } from "convex/browser";
 import { AccountTypeEnum, ChainTypeEnum, EmbeddedState, Openfort, RecoveryMethod, ThirdPartyOAuthProvider } from "@openfort/openfort-js";
@@ -1735,6 +1735,92 @@ const ContactActionProps = {
 	party_id: OptionalString,
 	reason_code: OptionalReasonCode
 };
+/** One completed online CLI diagnostic. No command input or provider text. */
+const CLI_COMMAND_NAMES = [
+	"capxul",
+	"doctor",
+	"telemetry",
+	"telemetry.status",
+	"telemetry.enable",
+	"telemetry.disable",
+	"unknown"
+];
+const CLI_CAPABILITIES = [
+	"cli",
+	"diagnostics",
+	"collection"
+];
+const CLI_INVOCATION_KINDS = [
+	"command",
+	"help",
+	"version",
+	"completion",
+	"parse_refusal",
+	"collection_control"
+];
+const CliRelease = Schema.String.check(Schema.isPattern(/^[A-Za-z0-9][A-Za-z0-9._+-]{0,127}$/u));
+const CliInvocationProps = {
+	...TelemetryEnvelopeProps,
+	schema_version: Schema.Literal(1),
+	command: Schema.Literals(CLI_COMMAND_NAMES),
+	capability: Schema.Literals(CLI_CAPABILITIES),
+	invocation_kind: Schema.Literals(CLI_INVOCATION_KINDS),
+	invocation_id: Schema.String.check(Schema.isPattern(/^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/u)),
+	cli_identity_kind: Schema.optional(Schema.Literal("anonymous")),
+	anonymous_id: Schema.optional(Schema.String.check(Schema.isPattern(/^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/u))),
+	occurred_at: Schema.Number,
+	cli_version: CliRelease,
+	sdk_version: CliRelease,
+	release: CliRelease,
+	platform: Schema.Literals([
+		"darwin",
+		"linux",
+		"unknown"
+	]),
+	architecture: Schema.Literals([
+		"arm64",
+		"x64",
+		"unknown"
+	]),
+	ci: Schema.Boolean,
+	tty: Schema.Boolean,
+	output_mode: Schema.Literals(["human", "json"])
+};
+Schema.Struct({
+	name: Schema.Literal("cli_first_used"),
+	props: Schema.Struct(CliInvocationProps)
+});
+Schema.Struct({
+	name: Schema.Literal("cli_command_started"),
+	props: Schema.Struct({
+		...CliInvocationProps,
+		invocation_kind: Schema.Literals([
+			"command",
+			"help",
+			"version"
+		])
+	})
+});
+Schema.Struct({
+	name: Schema.Literal("cli_command_completed"),
+	props: Schema.Struct({
+		...CliInvocationProps,
+		outcome: Schema.Literals([
+			"succeeded",
+			"refused",
+			"failed",
+			"cancelled"
+		]),
+		duration_ms: Schema.Number,
+		error_code: Schema.optional(Schema.Literals([
+			...CAPXUL_ERROR_CODES,
+			"CLI_USAGE",
+			"CLI_CONFIG",
+			"CLI_STORAGE",
+			"CLI_DEFECT"
+		]))
+	})
+});
 Schema.Struct({
 	name: Schema.Literal("cli_diagnostic_completed"),
 	props: Schema.Struct({
@@ -2607,6 +2693,30 @@ const PAYMENT_DOCUMENT_KINDS = [
 	"receipt",
 	"withdrawal"
 ];
+/** Native browser projection, distinct from the issuer's persisted request state. */
+const CLIENT_AUTHORIZATION_PHASE = {
+	OTP_REQUIRED: "otp_required",
+	REVIEW: "review",
+	PROCESSING: "processing",
+	CONNECTED: "connected",
+	REFUSED: "refused"
+};
+CLIENT_AUTHORIZATION_PHASE.OTP_REQUIRED, CLIENT_AUTHORIZATION_PHASE.REVIEW, CLIENT_AUTHORIZATION_PHASE.PROCESSING, CLIENT_AUTHORIZATION_PHASE.CONNECTED, CLIENT_AUTHORIZATION_PHASE.REFUSED;
+/** Closed native refusals; existing Capxul error codes retain their own meaning. */
+const CLIENT_AUTHORIZATION_REFUSALS = [
+	"signup_required",
+	"setup_required",
+	"already_signed_up",
+	"identity_mismatch",
+	"invalid_request",
+	"request_expired",
+	"request_denied",
+	"cancelled",
+	"grant_revoked",
+	"grant_expired",
+	"refresh_reused",
+	"revoke_unconfirmed"
+];
 //#endregion
 //#region ../wire/src/financial-ops.ts
 const MINOR_UNIT_STRING_RE = /^[0-9]+$/;
@@ -4308,6 +4418,251 @@ function isSafeField(field, value) {
 	return value.length > 0 && value.length <= rule.maxLength && value === value.trim() && !value.includes("://") && !containsSensitiveMaterial(value) && rule.pattern.test(value);
 }
 //#endregion
+//#region ../wire/src/client-authorization.ts
+const NATIVE_CLIENT_ID = "capxul-cli";
+const NATIVE_CLIENT_SCOPE = "account:read";
+const NATIVE_CLIENT_LIMITS = {
+	accessMs: 36e5,
+	renewalMs: 2592e6,
+	absoluteMs: 7776e6,
+	requestMs: 6e5,
+	pollSeconds: 5,
+	imageBytes: 5242880
+};
+const strict = { parseOptions: { onExcessProperty: "error" } };
+const text$2 = (max) => Schema.String.check(Schema.isMinLength(1), Schema.isMaxLength(max));
+const nonNegativeInt = Schema.Number.check(Schema.makeFilter((n) => Number.isSafeInteger(n) && n >= 0));
+const normalize = (f) => Schema.String.pipe(Schema.decodeTo(Schema.String, {
+	decode: SchemaGetter.transform(f),
+	encode: SchemaGetter.transform((s) => s)
+}));
+const ClientRequestIdSchema = Schema.String.pipe(Schema.refine((s) => CLIENT_REQUEST_ID_RE.test(s)));
+const ClientGrantIdSchema = Schema.String.pipe(Schema.refine((s) => CLIENT_GRANT_ID_RE.test(s)));
+const authUserId = Schema.String.pipe(Schema.refine((s) => s.length > 0));
+const keyId = Schema.String.pipe(Schema.refine((s) => s.length > 0));
+const email = normalize((s) => s.toLowerCase()).pipe(Schema.refine((s) => EMAIL_RE$1.test(s))).check(Schema.isMaxLength(254));
+const handle = Schema.String.pipe(Schema.refine((s) => HANDLE_RE$1.test(s)));
+const country = normalize((s) => s.toUpperCase()).pipe(Schema.refine((s) => COUNTRY_CODE_RE.test(s)));
+const credential = Schema.RedactedFromValue(Schema.String.check(Schema.isMinLength(32), Schema.isMaxLength(8192), Schema.isPattern(/^[A-Za-z0-9._~-]+$/u)), { label: "native authorization credential" });
+const otp = Schema.RedactedFromValue(Schema.String.check(Schema.isPattern(/^[0-9]{6}$/u)), { label: "OTP" });
+const scopes = Schema.Tuple([Schema.Literal(NATIVE_CLIENT_SCOPE)]);
+/** Exact HTTPS origin, no credentials/path/query and no retired cloud deployment. */
+const NativeHttpsOriginSchema = Schema.String.check(Schema.makeFilter((value) => {
+	try {
+		const url = new URL(value);
+		const host = url.hostname.toLowerCase().replace(/\.$/u, "");
+		return url.protocol === "https:" && value === url.origin && !url.username && !url.password && !url.search && !url.hash && host !== "convex.cloud" && !host.endsWith(".convex.cloud") && host !== "convex.site" && !host.endsWith(".convex.site");
+	} catch {
+		return false;
+	}
+}, { message: "must be a canonical credential-free HTTPS origin outside retired Convex cloud hosts" }));
+const NativeClientConfigurationSchema = Schema.Struct({
+	clientId: Schema.Literal(NATIVE_CLIENT_ID),
+	applicationId: AppIdSchema,
+	keyId,
+	environment: Schema.Literals([
+		"development",
+		"staging",
+		"production"
+	]),
+	keyEnvironment: Schema.Literals(["test", "live"]),
+	issuer: NativeHttpsOriginSchema,
+	verificationOrigin: NativeHttpsOriginSchema
+}).annotate(strict).check(Schema.makeFilter((c) => c.keyEnvironment === (c.environment === "production" ? "live" : "test"), { message: "key environment must match the configured deployment" })).annotate(strict);
+const NativeSignupProfileSchema = Schema.Struct({
+	displayName: normalize((s) => s.trim()).check(Schema.isMinLength(1), Schema.isMaxLength(200)),
+	country,
+	handle,
+	payoutAddresses: Schema.optional(Schema.Array(Schema.Struct({
+		chain: Schema.Literals([
+			"evm",
+			"solana",
+			"starknet"
+		]),
+		address: text$2(256)
+	}).annotate(strict)).check(Schema.isMaxLength(10))),
+	image: Schema.optional(Schema.Struct({
+		mediaType: Schema.Literals([
+			"image/jpeg",
+			"image/png",
+			"image/webp"
+		]),
+		byteLength: Schema.Number.check(Schema.isInt(), Schema.isBetween({
+			minimum: 1,
+			maximum: NATIVE_CLIENT_LIMITS.imageBytes
+		})),
+		sha256: Schema.String.check(Schema.isPattern(/^[0-9a-f]{64}$/u))
+	}).annotate(strict))
+}).annotate(strict);
+const ClientAuthorizationIntentSchema = Schema.Union([Schema.Struct({ mode: Schema.Literal("login") }).annotate(strict), Schema.Struct({
+	mode: Schema.Literal("signup"),
+	profile: NativeSignupProfileSchema
+}).annotate(strict)]).annotate(strict);
+Schema.Struct({
+	clientId: Schema.Literal(NATIVE_CLIENT_ID),
+	email,
+	intent: ClientAuthorizationIntentSchema,
+	waitMs: Schema.Number.check(Schema.isInt(), Schema.isBetween({
+		minimum: 1,
+		maximum: NATIVE_CLIENT_LIMITS.requestMs
+	})),
+	continuityToken: Schema.optional(credential)
+}).annotate(strict);
+const request = {
+	requestId: ClientRequestIdSchema,
+	revision: nonNegativeInt,
+	expiresAt: EpochMsSchema
+};
+const principal = {
+	authUserId,
+	email
+};
+const profileSummary = {
+	displayName: text$2(200),
+	handle,
+	country
+};
+Schema.Union([
+	Schema.Struct({
+		...request,
+		phase: Schema.Literal(CLIENT_AUTHORIZATION_PHASE.OTP_REQUIRED),
+		email,
+		resendAt: EpochMsSchema
+	}).annotate(strict),
+	Schema.Struct({
+		...request,
+		phase: Schema.Literal(CLIENT_AUTHORIZATION_PHASE.REVIEW),
+		...principal,
+		clientLabel: Schema.Literal("Capxul CLI"),
+		scopes,
+		intent: ClientAuthorizationIntentSchema,
+		setupState: Schema.Literals([
+			"not_required",
+			"new",
+			"resumable"
+		])
+	}).annotate(strict).check(Schema.makeFilter((v) => v.intent.mode === "login" === (v.setupState === "not_required"), { message: "login review cannot permit account setup" })),
+	Schema.Struct({
+		...request,
+		phase: Schema.Literal(CLIENT_AUTHORIZATION_PHASE.PROCESSING),
+		...principal,
+		purpose: Schema.Literals(["login", "signup"]),
+		step: Schema.Literals([
+			"profile",
+			"wallet",
+			"account",
+			"delivery"
+		])
+	}).annotate(strict).check(Schema.makeFilter((v) => v.purpose === "signup" || v.step === "delivery", { message: "login may wait for delivery but cannot enter signup processing" })),
+	Schema.Struct({
+		...request,
+		phase: Schema.Literal(CLIENT_AUTHORIZATION_PHASE.CONNECTED),
+		...principal,
+		...profileSummary,
+		accountId: AccountIdSchema,
+		grantId: ClientGrantIdSchema
+	}).annotate(strict),
+	Schema.Struct({
+		...request,
+		phase: Schema.Literal(CLIENT_AUTHORIZATION_PHASE.REFUSED),
+		reason: Schema.Literals(CLIENT_AUTHORIZATION_REFUSALS),
+		code: Schema.Literals(CAPXUL_ERROR_CODES),
+		field: Schema.optional(Schema.Literals([
+			"email",
+			"displayName",
+			"country",
+			"handle",
+			"image",
+			"payoutAddresses"
+		])),
+		retryable: Schema.Boolean
+	}).annotate(strict)
+]).annotate(strict);
+Schema.Struct({
+	requestId: ClientRequestIdSchema,
+	revision: nonNegativeInt
+}).annotate(strict);
+Schema.Struct({
+	requestId: ClientRequestIdSchema,
+	code: otp
+}).annotate(strict);
+Schema.Struct({
+	client_id: Schema.Literal(NATIVE_CLIENT_ID),
+	grant_type: Schema.Literal("refresh_token"),
+	refresh_token: credential,
+	refreshAttemptId: Schema.RedactedFromValue(Schema.String.check(Schema.isPattern(/^[A-Za-z0-9_-]{32,128}$/u)), { label: "refresh attempt" })
+}).annotate(strict);
+Schema.Struct({
+	client_id: Schema.Literal(NATIVE_CLIENT_ID),
+	applicationId: AppIdSchema,
+	resource: text$2(2048),
+	token_type: Schema.Literal("Bearer"),
+	access_token: credential,
+	refresh_token: credential,
+	scope: Schema.Literal(NATIVE_CLIENT_SCOPE),
+	expires_in: Schema.Number.check(Schema.isInt(), Schema.isBetween({
+		minimum: 1,
+		maximum: NATIVE_CLIENT_LIMITS.accessMs / 1e3
+	})),
+	grantId: ClientGrantIdSchema,
+	...principal,
+	accountId: AccountIdSchema,
+	issuedAt: EpochMsSchema,
+	grantCreatedAt: EpochMsSchema,
+	accessExpiresAt: EpochMsSchema,
+	renewalExpiresAt: EpochMsSchema,
+	absoluteExpiresAt: EpochMsSchema,
+	revision: nonNegativeInt
+}).annotate(strict).check(Schema.makeFilter((t) => t.grantCreatedAt <= t.issuedAt && t.absoluteExpiresAt - t.grantCreatedAt === NATIVE_CLIENT_LIMITS.absoluteMs && t.renewalExpiresAt <= Math.min(t.issuedAt + NATIVE_CLIENT_LIMITS.renewalMs, t.absoluteExpiresAt) && t.accessExpiresAt <= Math.min(t.issuedAt + NATIVE_CLIENT_LIMITS.accessMs, t.renewalExpiresAt) && t.expires_in === Math.floor((t.accessExpiresAt - t.issuedAt) / 1e3), { message: "native credentials must obey the approved access, renewal and absolute deadlines" })).annotate(strict);
+/** One endpoint mapping; consumers cannot substitute callback or resource URLs. */
+function nativeClientEndpoints(config) {
+	const resource = `${config.issuer}/api/auth/native`;
+	return {
+		resource,
+		device_authorization_endpoint: `${resource}/device/code`,
+		token_endpoint: `${resource}/token`,
+		revocation_endpoint: `${resource}/revoke`,
+		session_endpoint: `${resource}/session`,
+		verification_uri: `${config.verificationOrigin}/connect`
+	};
+}
+Schema.Struct({
+	protocol: Schema.Literal("capxul.client-authorization"),
+	version: Schema.Literal(1),
+	configuration: NativeClientConfigurationSchema,
+	scopes_supported: scopes,
+	grant_types_supported: Schema.Tuple([Schema.Literal("urn:ietf:params:oauth:grant-type:device_code"), Schema.Literal("refresh_token")]),
+	resource: text$2(2048),
+	device_authorization_endpoint: text$2(2048),
+	token_endpoint: text$2(2048),
+	revocation_endpoint: text$2(2048),
+	session_endpoint: text$2(2048),
+	verification_uri: text$2(2048)
+}).annotate(strict).check(Schema.makeFilter((m) => {
+	const expected = nativeClientEndpoints(m.configuration);
+	return m.resource === expected.resource && m.device_authorization_endpoint === expected.device_authorization_endpoint && m.token_endpoint === expected.token_endpoint && m.revocation_endpoint === expected.revocation_endpoint && m.session_endpoint === expected.session_endpoint && m.verification_uri === expected.verification_uri;
+}, { message: "native endpoints must match their configured issuer and verification origin" })).annotate(strict);
+Schema.Struct({
+	client_id: Schema.Literal(NATIVE_CLIENT_ID),
+	grant_type: Schema.Literal("urn:ietf:params:oauth:grant-type:device_code"),
+	device_code: credential
+}).annotate(strict);
+Schema.Struct({
+	requestId: ClientRequestIdSchema,
+	device_code: credential,
+	user_code: Schema.RedactedFromValue(Schema.String.check(Schema.isPattern(/^[A-Z0-9]{4}-[A-Z0-9]{4}$/u)), { label: "device user code" }),
+	continuityToken: credential,
+	verification_uri: text$2(2048),
+	expires_in: Schema.Number.check(Schema.isInt(), Schema.isBetween({
+		minimum: 1,
+		maximum: NATIVE_CLIENT_LIMITS.requestMs / 1e3
+	})),
+	interval: Schema.Number.check(Schema.isInt(), Schema.isBetween({
+		minimum: NATIVE_CLIENT_LIMITS.pollSeconds,
+		maximum: NATIVE_CLIENT_LIMITS.requestMs / 1e3
+	}))
+}).annotate(strict);
+//#endregion
 //#region src/internal/invocation-observation.ts
 const INVOCATION_OBSERVATION = Symbol("capxul.invocation-observation");
 const FAILURE_INVOCATION_SNAPSHOT = Symbol("capxul.failure-invocation-snapshot");
@@ -5894,6 +6249,9 @@ const moneyExecutionContract = {
 //#region src/ports/indexer-read.ts
 /** The indexer's own page bound. Exceeding it is a caller defect, not a refusal. */
 const INDEXER_MAX_LIMIT = 1e3;
+function validTime(value) {
+	return Number.isSafeInteger(value) && value >= 0 && value <= Math.floor(Number.MAX_SAFE_INTEGER / 1e3);
+}
 const LOWER_CASE_ADDRESS = /^0x[0-9a-f]{40}$/;
 /**
 * Refuse a page the indexer would refuse, before any implementation spends a
@@ -5901,12 +6259,21 @@ const LOWER_CASE_ADDRESS = /^0x[0-9a-f]{40}$/;
 * against the hermetic adapter cannot pass on input production rejects. Throws
 * a `CapxulError`; callers convert it to an `IndexerReadError`.
 */
+function assertEventLookup(input, id) {
+	if (input.limit !== 1 || (input.offset ?? 0) !== 0 || input.timeline !== void 0 || input.settlements !== void 0 || !/^[1-9][0-9]{0,9}:0x[0-9a-f]{64}:[0-9]{1,10}$/.test(id)) throw Errors.invalidInput("eventId", "must identify one logical event without another cursor");
+}
 function assertIndexerPage(input) {
 	const safe = String(input.safe).toLowerCase();
 	if (!LOWER_CASE_ADDRESS.test(safe)) throw Errors.invalidInput("safe", "must be a lower-case EVM address");
 	if (!Number.isSafeInteger(input.limit) || input.limit < 1 || input.limit > 1e3) throw Errors.invalidInput("limit", `must be an integer from 1 to ${INDEXER_MAX_LIMIT}`);
 	const offset = input.offset ?? 0;
 	if (!Number.isSafeInteger(offset) || offset < 0) throw Errors.invalidInput("offset", "must be a non-negative integer");
+	const timeline = input.timeline;
+	if (input.eventId !== void 0) assertEventLookup(input, input.eventId);
+	if (input.settlements !== void 0 && (offset !== 0 || timeline !== void 0 || input.settlements.length < 1 || input.settlements.length > 50 || !input.settlements.every((id) => /^0x[0-9a-f]{64}$/.test(id)))) throw Errors.invalidInput("settlements", "must hold 1 to 50 settlement IDs without another cursor");
+	if (timeline !== void 0) {
+		if (offset !== 0 || !validTime(timeline.from) || !validTime(timeline.to) || timeline.from > timeline.to || timeline.before !== void 0 && (!validTime(timeline.before.timestamp) || !/^[1-9][0-9]{0,9}:0x[0-9a-f]{64}:[0-9]{1,10}$/.test(timeline.before.id))) throw Errors.invalidInput("timeline", "must be a bounded time window with a logical event cursor and no offset");
+	}
 	return safe;
 }
 var IndexerReadError = class extends Data.TaggedError("IndexerReadError") {};
@@ -5936,20 +6303,6 @@ function directionFor(safe, transfer) {
 	if (from === safe && to === safe) return "self";
 	return to === safe ? "in" : "out";
 }
-/**
-* The Transfer a protocol Payment moved is the same money as its `payment`
-* row. One actor sees one item for it, so the Transfer is claimed and does not
-* become a second row. Another transfer in the same transaction that this
-* payment did not move stays unclaimed and keeps its own row.
-*/
-function claimedTransferIds(transfers, payments) {
-	const claimed = /* @__PURE__ */ new Set();
-	for (const payment of payments) {
-		const match = transfers.find((transfer) => !claimed.has(transfer.id) && transfer.txHash === payment.txHash && transfer.token.toLowerCase() === payment.token.toLowerCase() && transfer.amount === payment.amount && transfer.to.toLowerCase() === payment.recipient.toLowerCase());
-		if (match !== void 0) claimed.add(match.id);
-	}
-	return claimed;
-}
 function withAnnotation(item, annotation) {
 	return annotation?.counterpartyLabel === void 0 ? item : {
 		...item,
@@ -5960,10 +6313,14 @@ function withAnnotation(item, annotation) {
 * An indexed settlement confirms the intent. A missing row can be outside
 * this page or still backfilling; only the correction owner can prove rollback.
 */
-function confirmPayment(intent, chain) {
-	if (chain !== void 0) return {
+function confirmPayment(intent, chain, expected) {
+	if (chain !== void 0 && matchesPaymentFact(chain, expected)) return {
 		...intent,
 		status: "settled",
+		...intent.execution === void 0 ? {} : { execution: {
+			status: "settled",
+			retryRequired: false
+		} },
 		receipt: {
 			chainId: chain.chainId,
 			transactionHash: chain.txHash
@@ -5972,16 +6329,22 @@ function confirmPayment(intent, chain) {
 	};
 	return intent;
 }
+function matchesPaymentFact(chain, expected) {
+	return chain !== void 0 && expected !== void 0 && chain.chainId === expected.chainId && chain.contract.toLowerCase() === expected.contract.toLowerCase() && chain.sender.toLowerCase() === expected.sender.toLowerCase() && chain.recipient.toLowerCase() === expected.recipient.toLowerCase() && chain.token.toLowerCase() === expected.token.toLowerCase() && chain.amount.toString() === expected.rawAmount && chain.documentHash.toLowerCase() === expected.documentHash.toLowerCase() && chain.kind === expected.kind;
+}
 /**
 * One unclaimed Transfer as an Activity row, or `null` when this SDK cannot
 * denominate its asset. The indexer serves only configured assets, so a row
 * the registry does not know means the SDK and that deployment disagree; it is
 * dropped rather than shown with a guessed currency.
 */
+function isActivityVisible(item) {
+	return !(item.kind === "payment" && item.direction === "in" && item.execution?.notSent);
+}
 function transferItem(safe, transfer, annotation) {
 	const asset = configuredMoneyAssetById(transfer.assetId);
 	if (asset === null) return null;
-	const direction = directionFor(safe, transfer);
+	const direction = directionFor(safe.toLowerCase(), transfer);
 	const counterparty = direction === "in" ? transfer.from : transfer.to;
 	const at = blockMillis(transfer);
 	return withAnnotation({
@@ -6003,47 +6366,6 @@ function transferItem(safe, transfer, annotation) {
 		updatedAt: at
 	}, annotation);
 }
-/** Newest first. A Payment precedes a Movement at one instant, as the ledger reader orders them. */
-function compareItems(left, right) {
-	if (right.createdAt !== left.createdAt) return right.createdAt - left.createdAt;
-	if (left.kind !== right.kind) return left.kind === "payment" ? -1 : 1;
-	if (left.id === right.id) return 0;
-	return left.id < right.id ? 1 : -1;
-}
-function stitchActivity(input) {
-	const safe = input.safe.toLowerCase();
-	const chainBySettlement = /* @__PURE__ */ new Map();
-	for (const row of input.payments) chainBySettlement.set(row.settlementId.toLowerCase(), row);
-	const chainByPaymentId = /* @__PURE__ */ new Map();
-	for (const link of input.links) {
-		const row = chainBySettlement.get(link.settlementId.toLowerCase());
-		if (row !== void 0) chainByPaymentId.set(link.paymentId, row);
-	}
-	const annotations = /* @__PURE__ */ new Map();
-	for (const annotation of input.annotations) annotations.set(`${annotation.reference.kind}:${annotation.reference.id}`, annotation);
-	const items = [];
-	const claiming = [];
-	for (const intent of input.intents) {
-		if (intent.kind !== "payment") continue;
-		const chain = chainByPaymentId.get(intent.id);
-		if (chain !== void 0) claiming.push(chain);
-		items.push(withAnnotation(confirmPayment(intent, chain), annotations.get(`payment:${intent.id}`)));
-	}
-	const claimed = claimedTransferIds(input.transfers, claiming);
-	for (const transfer of input.transfers) {
-		if (claimed.has(transfer.id)) continue;
-		const item = transferItem(safe, transfer, annotations.get(`movement:${transfer.id}`));
-		if (item !== null) items.push(item);
-	}
-	return items.sort(compareItems);
-}
-/** The reference ids one stitched page needs its Convex overlay for. */
-function overlayReferences(items) {
-	return items.map((item) => ({
-		kind: item.kind,
-		id: item.id
-	}));
-}
 /**
 * Money in, money out and the pending share, one bucket per currency and
 * precision. Two assets that peg to the same currency at different precision
@@ -6062,7 +6384,7 @@ function summarizeItems(items) {
 		};
 		const raw = rawUnits(item.amount.value, item.amount.decimals);
 		if (item.kind === "payment" && item.status !== "settled") {
-			if (item.direction === "in" && item.status !== "cancelled" && item.status !== "failed") bucket.pendingIn += raw;
+			if (item.direction === "in" && item.status !== "cancelled" && item.status !== "failed" && !item.execution?.notSent) bucket.pendingIn += raw;
 		} else if (item.direction === "in") bucket.in += raw;
 		else if (item.direction === "out") bucket.out += raw;
 		buckets.set(key, bucket);
@@ -6085,179 +6407,412 @@ function rawUnits(value, decimals) {
 }
 //#endregion
 //#region src/surface/activity-read.ts
-/** How many Convex intent rows one page reads for its labels and pending rows. */
-const INTENT_WINDOW = 100;
-/** movement/annotations:overlay bounds each identifier array to 200. */
+const BATCH = 100;
 const MAX_OVERLAY_IDS = 200;
-/** The window a summary aggregates over. The indexer's own page bound. */
-const SUMMARY_WINDOW = INDEXER_MAX_LIMIT;
-function parseCursor(value) {
-	if (value === void 0) return 0;
-	try {
-		const parsed = JSON.parse(value);
-		return Number.isSafeInteger(parsed.offset) && parsed.offset >= 0 ? parsed.offset : 0;
-	} catch {
-		return 0;
-	}
-}
-function inRange(item, range) {
-	if (range?.from !== void 0 && item.createdAt < range.from) return false;
-	return range?.to === void 0 || item.createdAt <= range.to;
+function actorKey(actor) {
+	return actor.kind === "account" ? `account:${actor.accountId}` : `organization:${actor.orgId}`;
+}
+function scopeKey(scope) {
+	return `${scope.principalAccountId ?? "legacy"}|${actorKey(scope.actor)}|${scope.safe?.toLowerCase() ?? "none"}`;
+}
+function selectionKey(params) {
+	const filter = params?.filter;
+	return JSON.stringify([
+		params?.range?.from ?? null,
+		params?.range?.to ?? null,
+		filter?.kind ?? null,
+		filter?.direction ?? null,
+		filter?.status === void 0 ? null : [...new Set(filter.status)].sort()
+	]);
+}
+function validString(value, max) {
+	return typeof value === "string" && value.length <= max;
+}
+function validPosition(position) {
+	return position === null || position !== void 0 && typeof position === "object" && Number.isSafeInteger(position.timestamp) && position.timestamp >= 0 && /^[1-9][0-9]{0,9}:0x[0-9a-f]{64}:[0-9]{1,10}$/.test(position.id);
+}
+function parseCursor(value, scope, selection) {
+	if (value === void 0) return null;
+	if (value.length > 4e4) throw Errors.invalidInput("cursor", "invalid Activity cursor");
+	const cursor = JSON.parse(value);
+	if (cursor === null || typeof cursor !== "object" || cursor.version !== 1 || cursor.scope !== scope || cursor.selection !== selection || !Number.isSafeInteger(cursor.checkpoint) || cursor.checkpoint < 0 || cursor.source !== "indexed" && cursor.source !== "fallback" || cursor.paymentCursor !== null && !validString(cursor.paymentCursor, 2048) || typeof cursor.paymentDone !== "boolean" || typeof cursor.transferDone !== "boolean" || typeof cursor.degraded !== "boolean" || !Array.isArray(cursor.paymentPending) || cursor.paymentPending.length > BATCH || new Set(cursor.paymentPending).size !== cursor.paymentPending.length || !cursor.paymentPending.every((id) => validString(id, 256)) || !validPosition(cursor.transferBefore)) throw Errors.invalidInput("cursor", "Activity scope or filters changed; restart from the first page");
+	return cursor;
+}
+function requireParams(params) {
+	const limit = params?.limit ?? 25;
+	if (!Number.isSafeInteger(limit) || limit < 1 || limit > BATCH) throw Errors.invalidInput("limit", "must be an integer from 1 to 100");
+	for (const value of [params?.range?.from, params?.range?.to]) if (value !== void 0 && !Number.isSafeInteger(value)) throw Errors.invalidInput("range", "must contain integer epoch milliseconds");
+	const f = params?.filter;
+	if (f?.kind !== void 0 && f.kind !== "payment" && f.kind !== "movement" || f?.direction !== void 0 && ![
+		"in",
+		"out",
+		"self"
+	].includes(f.direction) || f?.status !== void 0 && (!Array.isArray(f.status) || !f.status.every((status) => PAYMENT_STATUSES.includes(status)))) throw Errors.invalidInput("filter", "invalid Activity filter");
 }
-/** The caller's filter applied to the merged page. The join owns the order. */
 function matchesFilter(item, filter) {
-	if (filter === void 0) return true;
-	if (filter.kind !== void 0 && item.kind !== filter.kind) return false;
-	if (filter.direction !== void 0 && item.direction !== filter.direction) return false;
-	if (filter.status === void 0) return true;
-	return item.kind === "payment" && filter.status.includes(item.status);
+	return (filter?.kind === void 0 || item.kind === filter.kind) && (filter?.direction === void 0 || item.direction === filter.direction) && (filter?.status === void 0 || item.kind === "payment" && filter.status.includes(item.status));
 }
 function overlay(deps, actor, controls, input) {
 	const count = Math.max(input.references?.length ?? 0, input.settlementIds?.length ?? 0);
-	const offsets = Array.from({ length: Math.max(1, Math.ceil(count / MAX_OVERLAY_IDS)) }, (_, index) => index * MAX_OVERLAY_IDS);
+	const offsets = Array.from({ length: Math.max(1, Math.ceil(count / MAX_OVERLAY_IDS)) }, (_, i) => i * MAX_OVERLAY_IDS);
 	return Effect.forEach(offsets, (offset) => deps.convexCall.query(deps.functions.activityOverlay, copyInvocationObservation(controls, { input: {
 		...actor === void 0 ? {} : { actor },
 		...input.references === void 0 ? {} : { references: input.references.slice(offset, offset + MAX_OVERLAY_IDS) },
 		...input.settlementIds === void 0 ? {} : { settlementIds: input.settlementIds.slice(offset, offset + MAX_OVERLAY_IDS) }
-	} })), { concurrency: 2 }).pipe(Effect.map((pages) => ({
-		...pages[0],
-		links: pages.flatMap((page) => page.links),
-		annotations: pages.flatMap((page) => page.annotations)
-	})));
+	} })), { concurrency: 2 }).pipe(Effect.flatMap((pages) => {
+		const first = pages[0];
+		if (pages.some((page) => scopeKey(page) !== scopeKey(first))) return Effect.fail({ publicError: Errors.invalidInput("actor", "Activity scope changed during the read") });
+		return Effect.succeed({
+			...first,
+			links: pages.flatMap((page) => page.links),
+			annotations: pages.flatMap((page) => page.annotations),
+			...pages.every((page) => page.payments !== void 0) ? { payments: pages.flatMap((page) => page.payments ?? []) } : {}
+		});
+	}));
 }
 function convexPage(deps, actor, controls, input) {
 	return deps.convexCall.query(deps.functions.activityList, copyInvocationObservation(controls, { input: {
-		...actor === void 0 ? {} : { actor },
-		...input.cursor === void 0 ? {} : { cursor: input.cursor },
-		...input.limit === void 0 ? {} : { limit: input.limit },
-		...input.range === void 0 ? {} : { range: input.range }
+		...input,
+		actor
 	} }));
 }
-/** Both indexed tables for one Safe, or `null` when the indexer cannot answer. */
-function chainRows(deps, safe, limit) {
-	const page = {
-		safe,
-		limit: Math.min(limit, INDEXER_MAX_LIMIT)
-	};
-	return Effect.all([deps.indexer.read("transfer", page), deps.indexer.read("payment", page)], { concurrency: 2 }).pipe(Effect.map(([transfers, payments]) => ({
-		transfers,
-		payments
-	})), Effect.catch(() => Effect.succeed(null)));
+function chainRead(deps, table, input) {
+	return deps.indexer.read(table, input).pipe(Effect.catch((error) => {
+		if (error.publicError.details?.reason === "scope-refused" || ![
+			"NETWORK_ERROR",
+			"RATE_LIMITED",
+			"PROVIDER_ERROR",
+			"CAPABILITY_UNAVAILABLE",
+			"TIMEOUT"
+		].includes(error.publicCode)) return Effect.fail({ publicError: error.publicError });
+		return Effect.succeed(null);
+	}));
 }
-/** The stitched, filtered rows of one window, newest first. */
-function stitchedWindow(deps, actor, controls, window, params) {
+function fallbackPage(deps, scope, controls, params, state, degraded) {
 	return Effect.gen(function* () {
-		const scope = yield* overlay(deps, actor, controls, {});
-		const convex = yield* convexPage(deps, actor, controls, {
-			limit: INTENT_WINDOW,
-			...params.range === void 0 ? {} : { range: params.range }
+		const page = yield* convexPage(deps, scope.actor, controls, {
+			limit: params?.limit ?? 25,
+			...state.paymentCursor === null ? {} : { cursor: state.paymentCursor },
+			range: {
+				...params?.range?.from === void 0 ? {} : { from: params.range.from },
+				to: Math.min(state.checkpoint, params?.range?.to ?? state.checkpoint)
+			},
+			...params?.filter === void 0 ? {} : { filter: params.filter }
 		});
-		const rows = scope.safe === null ? null : yield* chainRows(deps, scope.safe, window);
-		if (rows === null || scope.safe === null) {
-			if (scope.safe !== null) yield* Effect.annotateCurrentSpan({
-				read_source: "convex",
-				read_warning: "indexer-unavailable"
-			});
-			return {
-				items: convex.items.filter((item) => matchesFilter(item, params.filter)),
-				stitched: false,
-				...scope.safe === null ? {} : { readWarning: "indexer-unavailable" }
-			};
+		const decoration = yield* overlay(deps, scope.actor, controls, { references: page.items.map((item) => ({
+			kind: item.kind,
+			id: item.id
+		})) });
+		if (scopeKey(decoration) !== scopeKey(scope)) return yield* Effect.fail({ publicError: Errors.invalidInput("actor", "Activity scope changed during fallback") });
+		const annotations = new Map(decoration.annotations.map((annotation) => [`${annotation.reference.kind}:${annotation.reference.id}`, annotation]));
+		yield* Effect.annotateCurrentSpan({
+			read_source: "convex",
+			...degraded ? { read_warning: "indexer-unavailable" } : {}
+		});
+		return {
+			...page,
+			items: page.items.filter(isActivityVisible).map((item) => withAnnotation(item, annotations.get(`${item.kind}:${item.id}`))),
+			checkpoint: state.checkpoint,
+			cursor: page.cursor === null ? null : JSON.stringify({
+				...state,
+				source: "fallback",
+				paymentCursor: page.cursor,
+				degraded
+			}),
+			...degraded ? { readWarning: "indexer-unavailable" } : {}
+		};
+	});
+}
+function boundedRange(range, checkpoint) {
+	return {
+		...range?.from === void 0 ? {} : { from: range.from },
+		to: Math.min(checkpoint, range?.to ?? checkpoint)
+	};
+}
+function unavailablePage(deps, scope, controls, params, state, first) {
+	if (first) return fallbackPage(deps, scope, controls, params, state, true);
+	return Effect.annotateCurrentSpan({
+		read_source: "indexer",
+		read_warning: "indexer-unavailable"
+	}).pipe(Effect.as({
+		items: [],
+		cursor: null,
+		checkpoint: state.checkpoint,
+		observedAt: Date.now(),
+		readWarning: "indexer-unavailable"
+	}));
+}
+function readTransfers(deps, safe, range, state, wanted, first) {
+	const from = Math.max(0, Math.ceil((range.from ?? 0) / 1e3));
+	const to = Math.floor(range.to / 1e3);
+	if (state.transferDone || from > to || !wanted && !first) return Effect.succeed([]);
+	return chainRead(deps, "transfer", {
+		safe: toAddress(safe),
+		limit: wanted ? BATCH : 1,
+		timeline: {
+			from,
+			to,
+			...state.transferBefore === null ? {} : { before: state.transferBefore }
 		}
-		yield* Effect.annotateCurrentSpan({ read_source: "indexer" });
-		const decoration = yield* overlay(deps, actor, controls, {
-			references: [...overlayReferences(convex.items), ...rows.transfers.map((row) => ({
+	});
+}
+function readPayments(deps, scope, controls, range, state, wanted) {
+	const done = state.paymentDone || !wanted;
+	if (state.paymentPending.length > 0 || done) return Effect.succeed({
+		items: [],
+		pending: state.paymentPending,
+		cursor: state.paymentCursor,
+		done
+	});
+	return convexPage(deps, scope.actor, controls, {
+		limit: BATCH,
+		range,
+		filter: { kind: "payment" },
+		...state.paymentCursor === null ? {} : { cursor: state.paymentCursor }
+	}).pipe(Effect.map((page) => ({
+		items: page.items,
+		pending: page.items.map((item) => item.id),
+		cursor: page.cursor,
+		done: page.cursor === null
+	})));
+}
+function readPaymentFacts(deps, safe, settlements) {
+	const offsets = Array.from({ length: Math.ceil(settlements.length / 50) }, (_, i) => i * 50);
+	return Effect.forEach(offsets, (offset) => chainRead(deps, "payment", {
+		safe: toAddress(safe),
+		limit: 50,
+		settlements: settlements.slice(offset, offset + 50)
+	}), { concurrency: 2 }).pipe(Effect.map((pages) => pages.some((page) => page === null) ? null : pages.flatMap((page) => page ?? [])));
+}
+function decoratePage(deps, scope, controls, transfers, page, range) {
+	return Effect.gen(function* () {
+		const decoration = yield* overlay(deps, scope.actor, controls, {
+			references: [...page.pending.map((id) => ({
+				kind: "payment",
+				id
+			})), ...transfers.map((row) => ({
 				kind: "movement",
 				id: row.id
 			}))],
-			settlementIds: rows.payments.map((row) => row.settlementId)
+			settlementIds: [...new Set(transfers.flatMap((row) => row.paymentSettlementId ? [row.paymentSettlementId] : []))]
 		});
-		const intents = [...convex.items];
-		const missing = new Set(decoration.links.map((link) => link.paymentId));
-		for (const item of intents) if (item.kind === "payment") missing.delete(item.id);
-		let cursor = convex.cursor;
-		while (missing.size > 0 && cursor !== null) {
-			const page = yield* convexPage(deps, actor, controls, {
-				limit: INTENT_WINDOW,
-				cursor,
-				...params.range === void 0 ? {} : { range: params.range }
-			});
-			for (const item of page.items) if (item.kind === "payment" && missing.delete(item.id)) intents.push(item);
-			cursor = page.cursor;
+		if (scopeKey(decoration) !== scopeKey(scope)) return yield* Effect.fail({ publicError: Errors.invalidInput("actor", "Activity scope changed during the read") });
+		const byId = new Map([...page.items, ...decoration.payments ?? []].map((item) => [item.id, item]));
+		const settlements = [...new Set(decoration.links.map((link) => link.settlementId))];
+		const facts = yield* readPaymentFacts(deps, scope.safe, settlements);
+		if (facts === null) return null;
+		const bySettlement = new Map(facts.map((row) => [row.settlementId, row]));
+		const byPayment = new Map(decoration.links.map((link) => [link.paymentId, {
+			fact: bySettlement.get(link.settlementId),
+			expected: link.expected
+		}]));
+		const annotations = new Map(decoration.annotations.map((annotation) => [`${annotation.reference.kind}:${annotation.reference.id}`, annotation]));
+		return {
+			payments: page.pending.flatMap((id) => {
+				const item = byId.get(id);
+				if (item === void 0 || item.kind !== "payment" || item.createdAt > range.to || range.from !== void 0 && item.createdAt < range.from) return [];
+				const confirmed = withAnnotation(confirmPayment(item, byPayment.get(id)?.fact, byPayment.get(id)?.expected), annotations.get(`payment:${id}`));
+				return isActivityVisible(confirmed) ? [confirmed] : [];
+			}),
+			annotations,
+			linked: new Set(decoration.links.filter((link) => matchesPaymentFact(bySettlement.get(link.settlementId), link.expected)).map((link) => link.settlementId))
+		};
+	});
+}
+function mergePage(safe, filter, limit, state, page, decoration, transfers, wantsTransfers) {
+	const { payments, annotations, linked } = decoration;
+	let pi = 0;
+	let ti = 0;
+	const items = [];
+	const transferEnd = !wantsTransfers || transfers.length < BATCH;
+	let transferBefore = state.transferBefore;
+	while (items.length < limit) {
+		if (pi === payments.length && !page.done || ti === transfers.length && !transferEnd) break;
+		const payment = payments[pi];
+		const row = transfers[ti];
+		if (payment === void 0 && row === void 0) break;
+		if (payment !== void 0 && (row === void 0 || payment.createdAt >= Number(row.timestamp) * 1e3)) {
+			pi += 1;
+			if (matchesFilter(payment, filter)) items.push(payment);
+		} else if (row !== void 0) {
+			ti += 1;
+			transferBefore = {
+				timestamp: Number(row.timestamp),
+				id: row.id
+			};
+			if (row.paymentSettlementId && linked.has(row.paymentSettlementId)) continue;
+			const item = transferItem(safe, row, annotations.get(`movement:${row.id}`));
+			if (item !== null && matchesFilter(item, filter)) items.push(item);
 		}
-		const older = intents.slice(convex.items.length);
-		const olderDecoration = older.length === 0 ? [] : (yield* overlay(deps, actor, controls, { references: overlayReferences(older) })).annotations;
+	}
+	return {
+		items,
+		next: {
+			...state,
+			paymentCursor: page.cursor,
+			paymentDone: page.done,
+			paymentPending: payments.slice(pi).map((item) => item.id),
+			transferBefore,
+			transferDone: ti === transfers.length && transferEnd
+		}
+	};
+}
+function indexedPage(deps, scope, controls, params, state, first) {
+	return Effect.gen(function* () {
+		const range = boundedRange(params?.range, state.checkpoint);
+		const wantsTransfers = params?.filter?.kind !== "payment" && params?.filter?.status === void 0;
+		const found = yield* readTransfers(deps, scope.safe, range, state, wantsTransfers, first);
+		if (found === null) return yield* unavailablePage(deps, scope, controls, params, state, first);
+		const transfers = wantsTransfers ? found : [];
+		const page = yield* readPayments(deps, scope, controls, range, state, params?.filter?.kind !== "movement");
+		const decoration = yield* decoratePage(deps, scope, controls, transfers, page, range);
+		if (decoration === null) return yield* unavailablePage(deps, scope, controls, params, state, first);
+		const { items, next } = mergePage(scope.safe, params?.filter, params?.limit ?? 25, state, page, decoration, transfers, wantsTransfers);
+		const cursor = next.paymentDone && next.paymentPending.length === 0 && next.transferDone ? null : JSON.stringify(next);
+		if (cursor !== null && cursor === params?.cursor) return yield* Effect.fail({ publicError: Errors.invalidInput("cursor", "Activity source did not advance") });
+		yield* Effect.annotateCurrentSpan({ read_source: "indexer" });
 		return {
-			items: stitchActivity({
-				safe: scope.safe,
-				transfers: rows.transfers,
-				payments: rows.payments,
-				intents,
-				links: decoration.links,
-				annotations: [...decoration.annotations, ...olderDecoration]
-			}).filter((item) => inRange(item, params.range) && matchesFilter(item, params.filter)),
-			stitched: true
+			items,
+			cursor,
+			checkpoint: state.checkpoint,
+			observedAt: Date.now()
 		};
 	});
 }
 function readActivityPage(deps, actor, controls, params) {
-	const limit = params?.limit ?? 25;
-	const offset = parseCursor(params?.cursor);
-	return stitchedWindow(deps, actor, controls, offset + limit + 1, {
-		...params?.range === void 0 ? {} : { range: params.range },
-		...params?.filter === void 0 ? {} : { filter: params.filter }
-	}).pipe(Effect.map(({ items, stitched, readWarning }) => {
-		const observedAt = Date.now();
-		if (!stitched) return {
-			items: items.slice(0, limit),
+	return Effect.gen(function* () {
+		yield* Effect.try({
+			try: () => requireParams(params),
+			catch: (cause) => ({ publicError: cause })
+		});
+		const scope = yield* overlay(deps, actor, controls, {});
+		const selection = selectionKey(params);
+		const cursor = yield* Effect.try({
+			try: () => parseCursor(params?.cursor, scopeKey(scope), selection),
+			catch: () => ({ publicError: Errors.invalidInput("cursor", "invalid or obsolete Activity cursor; restart the read") })
+		});
+		const state = cursor ?? {
+			version: 1,
+			scope: scopeKey(scope),
+			selection,
+			checkpoint: Date.now(),
+			source: "indexed",
+			paymentCursor: null,
+			paymentDone: false,
+			paymentPending: [],
+			transferBefore: null,
+			transferDone: false,
+			degraded: false
+		};
+		const range = boundedRange(params?.range, state.checkpoint);
+		if (range.from !== void 0 && range.from > range.to) return {
+			items: [],
 			cursor: null,
-			checkpoint: observedAt,
-			observedAt,
-			...readWarning === void 0 ? {} : { readWarning }
+			checkpoint: state.checkpoint,
+			observedAt: Date.now()
 		};
+		if (state.source === "fallback" || scope.safe === null) return yield* fallbackPage(deps, scope, controls, params, state, state.degraded);
+		if (scope.payments === void 0) return yield* unavailablePage(deps, scope, controls, params, state, cursor === null);
+		return yield* indexedPage(deps, scope, controls, params, state, cursor === null);
+	});
+}
+function readActivitySummary(deps, actor, controls, params) {
+	return Effect.gen(function* () {
+		const totals = /* @__PURE__ */ new Map();
+		let cursor;
+		let count = 0;
+		let readWarning;
+		do {
+			const page = yield* readActivityPage(deps, actor, controls, {
+				limit: BATCH,
+				...cursor === void 0 ? {} : { cursor },
+				...params?.window === void 0 ? {} : { range: params.window }
+			});
+			count += page.items.length;
+			readWarning ??= page.readWarning;
+			for (const total of summarizeItems(page.items)) {
+				const key = `${total.currency}:${total.decimals}`;
+				const old = totals.get(key);
+				totals.set(key, old === void 0 ? total : {
+					...total,
+					in: String(BigInt(old.in) + BigInt(total.in)),
+					out: String(BigInt(old.out) + BigInt(total.out)),
+					net: String(BigInt(old.net) + BigInt(total.net)),
+					pendingIn: String(BigInt(old.pendingIn) + BigInt(total.pendingIn))
+				});
+			}
+			cursor = page.cursor ?? void 0;
+		} while (cursor !== void 0);
 		return {
-			items: items.slice(offset, offset + limit),
-			cursor: items.length > offset + limit ? JSON.stringify({ offset: offset + limit }) : null,
-			checkpoint: observedAt,
-			observedAt
+			window: {
+				from: params?.window?.from ?? null,
+				to: params?.window?.to ?? null
+			},
+			totals: [...totals.values()],
+			count,
+			observedAt: Date.now(),
+			...readWarning === void 0 ? {} : { readWarning }
 		};
-	}));
+	});
 }
-function readActivitySummary(deps, actor, controls, params) {
-	return stitchedWindow(deps, actor, controls, SUMMARY_WINDOW, params?.window === void 0 ? {} : { range: params.window }).pipe(Effect.map(({ items, readWarning }) => ({
-		window: {
-			from: params?.window?.from ?? null,
-			to: params?.window?.to ?? null
-		},
-		totals: summarizeItems(items),
-		count: items.length,
-		observedAt: Date.now(),
-		...readWarning === void 0 ? {} : { readWarning }
-	})));
+/** An indexed Movement has no Convex materialization. Read its exact native row. */
+function readIndexedMovement(deps, actor, controls, eventId) {
+	return Effect.gen(function* () {
+		const scope = yield* overlay(deps, actor, controls, { references: [{
+			kind: "movement",
+			id: eventId
+		}] });
+		if (scope.safe === null) return null;
+		const safe = scope.safe.toLowerCase();
+		const row = (yield* deps.indexer.read("transfer", {
+			safe: toAddress(safe),
+			limit: 1,
+			eventId
+		}).pipe(Effect.catch((error) => Effect.fail({ publicError: error.publicError }))))[0];
+		if (row === void 0) return null;
+		const blockNumber = Number(row.blockNumber);
+		if (row.id !== eventId || row.from.toLowerCase() !== safe && row.to.toLowerCase() !== safe || !Number.isSafeInteger(blockNumber) || blockNumber < 0 || !Number.isSafeInteger(row.logIndex) || row.logIndex < 0) return yield* Effect.fail({ publicError: Errors.invalidInput("activity", "indexed Movement does not match the requested scope or evidence") });
+		yield* Effect.annotateCurrentSpan({ read_source: "indexer" });
+		return {
+			kind: "movement",
+			movementId: row.id,
+			viewer: scope.actor,
+			annotation: scope.annotations.find((annotation) => annotation.reference.kind === "movement" && annotation.reference.id === row.id) ?? null,
+			evidence: {
+				chainId: row.chainId,
+				contractAddress: row.token,
+				tokenAddress: row.token,
+				transactionHash: row.txHash,
+				blockNumber,
+				blockHash: row.blockHash,
+				inclusion: "included",
+				verification: "verified",
+				canonicalState: "finalized",
+				transferLogIndex: row.logIndex,
+				source: row.from,
+				destination: row.to,
+				rawAmount: row.amount.toString(),
+				link: {
+					movementId: row.id,
+					depositPaymentId: null
+				}
+			}
+		};
+	});
 }
-/**
-* Tell the caller when the indexed page for this Safe changed.
-*
-* The transport is the indexer's one SSE connection, wired in the Ponder
-* adapter under `activity.subscribe`. A reactive snapshot is not a product
-* event, so nothing here emits telemetry: the adapter reports a teardown, and
-* the caller re-reads.
-*/
 function subscribeActivity(deps, actor, controls, onChange) {
 	return Effect.gen(function* () {
 		const scope = yield* overlay(deps, actor, controls, {});
 		if (scope.safe === null) return () => {};
-		const page = {
-			safe: scope.safe,
-			limit: INTENT_WINDOW
-		};
 		let delivered = false;
-		const notify = () => {
-			if (delivered) onChange();
-			delivered = true;
-		};
-		return yield* deps.indexer.subscribe("transfer", page, (snapshot) => {
-			if (snapshot.status === "ok") notify();
+		return yield* deps.indexer.subscribe("transfer", {
+			safe: toAddress(scope.safe),
+			limit: BATCH
+		}, (snapshot) => {
+			if (snapshot.status === "ok") {
+				if (delivered) onChange();
+				delivered = true;
+			}
 			if (snapshot.status === "error") {
 				delivered = true;
 				onChange();
@@ -6267,7 +6822,7 @@ function subscribeActivity(deps, actor, controls, onChange) {
 }
 //#endregion
 //#region package.json
-var version = "4.20.0-beta.1";
+var version = "4.20.0-beta.3";
 //#endregion
 //#region src/telemetry/exception-projection.ts
 /** Fixed fallback for failures that have no safe message. */
@@ -7833,7 +8388,10 @@ function makeFinancialOpsMethods(deps) {
 					...params?.limit === void 0 ? {} : { limit: params.limit },
 					...params?.range === void 0 ? {} : { range: params.range },
 					...params?.filter === void 0 ? {} : { filter: params.filter }
-				} })) : readActivityPage(indexerDeps, actor, controls, params)).pipe(Effect.tap(() => observeActivityScope(actor))))), controls, CAPXUL_OPERATIONS.activity.list, deps.runPromise);
+				} })) : readActivityPage(indexerDeps, actor, controls, params)).pipe(Effect.map((page) => ({
+					...page,
+					items: page.items.filter(isActivityVisible)
+				})), Effect.tap(() => observeActivityScope(actor))))), controls, CAPXUL_OPERATIONS.activity.list, deps.runPromise);
 			},
 			summary: (params, options) => {
 				const controls = deps.invocationControls?.(options) ?? options;
@@ -7854,7 +8412,10 @@ function makeFinancialOpsMethods(deps) {
 						actor: scope,
 						referenceActor: reference.kind === "payment" ? activityActorField(reference.actor).actor : void 0
 					});
-				}).pipe(Effect.flatMap(({ actor, referenceActor }) => Effect.suspend(() => deps.convexCall.query(fns.activityGet, copyInvocationObservation(controls, {
+				}).pipe(Effect.flatMap(({ actor, referenceActor }) => Effect.suspend(() => indexerDeps !== void 0 && reference.kind === "movement" && /^[1-9][0-9]{0,9}:0x[0-9a-f]{64}:[0-9]{1,10}$/.test(reference.id) ? readIndexedMovement(indexerDeps, actor?.kind === "org" ? {
+					kind: "organization",
+					orgId: actor.orgId
+				} : void 0, controls, reference.id) : deps.convexCall.query(fns.activityGet, copyInvocationObservation(controls, {
 					input: {
 						kind: reference.kind,
 						id: reference.id,
@@ -8375,6 +8936,277 @@ async function recoverRawDigestSigner(input) {
 	}
 }
 //#endregion
+//#region ../observability/src/engineering-delivery.ts
+/** Fixed admission limits for one CLI invocation and its SDK client. */
+const CLI_ENGINEERING_LIMITS = Object.freeze({
+	records: 80,
+	ordinaryRecords: 64,
+	recordBytes: 16384,
+	requests: 5,
+	ordinaryRequests: 2,
+	requestBytes: 1572864,
+	metricSeries: 16,
+	requestTimeoutMs: 1e3
+});
+const text$1 = (value) => typeof value === "string" ? value.slice(0, 128) : "capxul.engineering";
+const attributes = (input, limit = 32) => {
+	const out = {};
+	let count = 0;
+	let bytes = 0;
+	try {
+		for (const key in input) {
+			if (count++ >= limit) break;
+			if (key.length > 64) continue;
+			const value = Object.getOwnPropertyDescriptor(input, key)?.value;
+			const scalar = typeof value === "string" ? value.slice(0, 128) : typeof value === "boolean" || typeof value === "number" && Number.isFinite(value) ? value : void 0;
+			if (scalar === void 0) continue;
+			bytes += new TextEncoder().encode(JSON.stringify([key, scalar])).length;
+			if (bytes > (limit >= 24 ? 2e3 : 300)) break;
+			out[key] = scalar;
+		}
+	} catch {}
+	return out;
+};
+const terminalName = (name) => name === "cli.command.completed" || CLI_COMMAND_NAMES.some((command) => name === `cli.command.${command}`);
+/** Native exporters retain their serialization and scheduling; this owns admission only. */
+function cliEngineeringDelivery(budget, ownsMetrics) {
+	const closed = Deferred.makeUnsafe();
+	let isClosed = false;
+	let metricsRunning = false;
+	const logs = [];
+	const spans = /* @__PURE__ */ new Map();
+	const terminalBodies = /* @__PURE__ */ new WeakSet();
+	const bodyLeases = /* @__PURE__ */ new WeakMap();
+	const pendingBodies = /* @__PURE__ */ new Set();
+	const holdBody = (body, releases) => {
+		if (releases.length === 0) return;
+		const lease = {
+			started: false,
+			release: () => {
+				if (!pendingBodies.delete(lease)) return;
+				bodyLeases.delete(body);
+				for (const release of releases) release();
+			}
+		};
+		bodyLeases.set(body, lease);
+		pendingBodies.add(lease);
+	};
+	const discardBody = (body) => bodyLeases.get(body)?.release();
+	const drainLogs = () => {
+		for (const release of logs.splice(0)) release();
+	};
+	const close = () => {
+		isClosed = true;
+		Deferred.doneUnsafe(closed, Effect.void);
+		for (const lease of pendingBodies) if (!lease.started) lease.release();
+		drainLogs();
+		for (const release of spans.values()) release();
+		spans.clear();
+		if (ownsMetrics) budget.metricRegistry.clear();
+	};
+	return {
+		close,
+		discardBody,
+		metrics(run) {
+			return Effect.suspend(() => {
+				if (isClosed || metricsRunning) return Effect.void;
+				metricsRunning = true;
+				return run.pipe(Effect.ensuring(Effect.sync(() => {
+					metricsRunning = false;
+				})));
+			});
+		},
+		logger(delegate) {
+			return Logger.make((options) => {
+				if (isClosed) return;
+				let release;
+				try {
+					const message = text$1(Array.isArray(options.message) ? Object.getOwnPropertyDescriptor(options.message, "0")?.value : options.message);
+					release = budget.admitRecord(terminalName(message));
+					if (release === void 0) return;
+					const context = Context.add(options.fiber.context, References.CurrentLogAnnotations, attributes(options.fiber.getRef(References.CurrentLogAnnotations)));
+					const fiber = Object.create(options.fiber);
+					Object.defineProperty(fiber, "getRef", { value: (ref) => Context.get(context, ref) });
+					logs.push(release);
+					delegate.log({
+						...options,
+						message,
+						cause: Cause.empty,
+						fiber
+					});
+				} catch {
+					if (release !== void 0) {
+						const index = logs.indexOf(release);
+						if (index !== -1) logs.splice(index, 1);
+						release();
+					}
+					budget.drop();
+				}
+			});
+		},
+		tracer(delegate) {
+			return Tracer.make({
+				span(options) {
+					const name = text$1(options.name);
+					const release = isClosed ? void 0 : budget.admitRecord(terminalName(name));
+					const spanOptions = {
+						...options,
+						name,
+						annotations: Context.empty(),
+						links: []
+					};
+					const span = release === void 0 ? new Tracer.NativeSpan({
+						...spanOptions,
+						sampled: false
+					}) : delegate.span(spanOptions);
+					if (release !== void 0) spans.set(span.spanId, release);
+					const wrapped = Object.create(span);
+					let fields = 0, events = 0, links = 0, attributeBytes = 0;
+					let ended = false;
+					Object.defineProperties(wrapped, {
+						attribute: { value: (key, value) => {
+							if (fields >= 32 && !span.attributes.has(key)) {
+								budget.drop();
+								return;
+							}
+							const safe = attributes({ [key]: value }, 1);
+							if (!Object.hasOwn(safe, key)) return;
+							const previous = span.attributes.has(key) ? new TextEncoder().encode(JSON.stringify([key, span.attributes.get(key)])).length : 0;
+							const next = new TextEncoder().encode(JSON.stringify([key, safe[key]])).length;
+							if (attributeBytes - previous + next > 2e3) {
+								budget.drop();
+								return;
+							}
+							attributeBytes += next - previous;
+							if (!span.attributes.has(key)) fields += 1;
+							span.attribute(key, safe[key]);
+						} },
+						event: { value: (eventName, time, attrs) => {
+							if (events++ >= 2) {
+								budget.drop();
+								return;
+							}
+							span.event(text$1(eventName), time, attributes(attrs ?? {}, 4));
+						} },
+						addLinks: { value: (items) => {
+							for (const item of items.slice(0, Math.max(0, 2 - links))) {
+								if (!/^[a-f0-9]{32}$/u.test(item.span.traceId) || !/^[a-f0-9]{16}$/u.test(item.span.spanId)) {
+									budget.drop();
+									continue;
+								}
+								span.addLinks([{
+									span: Tracer.externalSpan({
+										traceId: item.span.traceId,
+										spanId: item.span.spanId,
+										sampled: item.span.sampled
+									}),
+									attributes: attributes(item.attributes, 4)
+								}]);
+								links += 1;
+							}
+						} },
+						end: { value: (time, exit) => {
+							if (ended) return;
+							ended = true;
+							span.end(time, Exit.isFailure(exit) ? Exit.fail("CLI operation failed") : Exit.void);
+						} }
+					});
+					wrapped.addLinks(options.links ?? []);
+					return wrapped;
+				},
+				...delegate.context === void 0 ? {} : { context: delegate.context.bind(delegate) }
+			});
+		},
+		serialization(delegate) {
+			return {
+				logs(data) {
+					const releases = logs.splice(0);
+					try {
+						const body = delegate.logs(data);
+						if (data.resourceLogs.some((r) => r.scopeLogs.some((s) => s.logRecords?.some((l) => l.body?.stringValue === "cli.command.completed")))) terminalBodies.add(body);
+						holdBody(body, releases);
+						return body;
+					} catch (error) {
+						for (const release of releases) release();
+						throw error;
+					}
+				},
+				traces(data) {
+					const releases = [];
+					for (const resource of data.resourceSpans) for (const scope of resource.scopeSpans) for (const span of scope.spans) {
+						const release = spans.get(span.spanId);
+						if (release !== void 0) releases.push(release);
+						spans.delete(span.spanId);
+					}
+					try {
+						const body = delegate.traces(data);
+						if (data.resourceSpans.some((r) => r.scopeSpans.some((s) => s.spans.some((span) => terminalName(span.name))))) terminalBodies.add(body);
+						holdBody(body, releases);
+						return body;
+					} catch (error) {
+						for (const release of releases) release();
+						throw error;
+					}
+				},
+				metrics(data) {
+					const body = delegate.metrics(data);
+					terminalBodies.add(body);
+					return body;
+				}
+			};
+		},
+		transport(client, enabled = () => true) {
+			const retrying = HttpClient.transform(client, (response, request) => Effect.suspend(() => {
+				if (enabled()) return response;
+				budget.drop();
+				return Effect.succeed(HttpClientResponse.fromWeb(request, new Response(null)));
+			})).pipe(HttpClient.transformResponse((response) => Effect.tap(response, (result) => {
+				let received = 0;
+				return Stream.runForEach(result.stream, (chunk) => Effect.sync(() => {
+					received += chunk.byteLength;
+					if (received > 65536) throw new Error("Engineering response limit exceeded");
+				})).pipe(Effect.catchTag("HttpClientError", (error) => error.reason._tag === "EmptyBodyError" ? Effect.void : Effect.fail(error)));
+			}))).pipe(HttpClient.filterStatusOk, HttpClient.retryTransient({
+				times: 1,
+				schedule: Schedule.spaced("100 millis").pipe(Schedule.addDelay(({ input }) => Effect.map(Clock.currentTimeMillis, (now) => {
+					if (!HttpClientError.isHttpClientError(input) || input.reason._tag !== "StatusCodeError" || input.reason.response.status !== 429) return Duration.zero;
+					const header = input.reason.response.headers["retry-after"];
+					const numeric = Number(header);
+					const delay = header === void 0 ? 2e3 : Number.isFinite(numeric) ? numeric * 1e3 : Date.parse(header) - now;
+					return Duration.millis(Number.isFinite(delay) ? Math.min(2e3, Math.max(0, delay)) : 2e3);
+				})))
+			}));
+			return HttpClient.transform(retrying, (response, request) => Effect.suspend(() => {
+				if (isClosed) {
+					discardBody(request.body);
+					return Effect.succeed(HttpClientResponse.fromWeb(request, new Response(null)));
+				}
+				const droppedResponse = () => HttpClientResponse.fromWeb(request, new Response(null, { status: 200 }));
+				if (request.body._tag === "Empty") {
+					discardBody(request.body);
+					return Effect.succeed(droppedResponse());
+				}
+				const bytes = request.body.contentLength;
+				const release = budget.admitRequest(bytes ?? Number.POSITIVE_INFINITY, terminalBodies.has(request.body));
+				if (release === void 0) {
+					discardBody(request.body);
+					return Effect.succeed(droppedResponse());
+				}
+				const lease = bodyLeases.get(request.body);
+				if (lease !== void 0) lease.started = true;
+				return response.pipe(Effect.asVoid, Effect.timeoutOption(CLI_ENGINEERING_LIMITS.requestTimeoutMs), Effect.raceFirst(Deferred.await(closed).pipe(Effect.andThen(Effect.interrupt))), Effect.tap((result) => Effect.sync(() => {
+					if (Option.isNone(result)) budget.drop();
+				})), Effect.catchCause(() => Effect.sync(() => {
+					budget.drop();
+				})), Effect.as(droppedResponse()), Effect.ensuring(Effect.sync(() => {
+					release();
+					discardBody(request.body);
+				})));
+			}));
+		}
+	};
+}
+//#endregion
 //#region ../observability/src/engineering.ts
 const ENGINEERING_CAPXUL_ENVS = [
 	"development",
@@ -8549,10 +9381,13 @@ const MINIMAL_NUMBERS = /* @__PURE__ */ new Set([
 const MINIMAL_CORRELATIONS = /* @__PURE__ */ new Set([
 	"correlation_id",
 	"journey_id",
-	"invocation_id"
+	"invocation_id",
+	"posthogDistinctId"
 ]);
 const MINIMAL_METRIC_LABELS = /* @__PURE__ */ new Set([
 	"command",
+	"capability",
+	"invocation_kind",
 	"outcome",
 	"capxul_env",
 	"unit"
@@ -8560,7 +9395,7 @@ const MINIMAL_METRIC_LABELS = /* @__PURE__ */ new Set([
 const MINIMAL_METRIC_NAMES = /* @__PURE__ */ new Set(["capxul.cli.command.count", "capxul.cli.command.duration"]);
 const traceId = (value) => typeof value === "string" && /^(?!0+$)[0-9a-f]{32}$/u.test(value);
 const spanId = (value) => typeof value === "string" && /^(?!0+$)[0-9a-f]{16}$/u.test(value);
-const minimalName = (value) => typeof value === "string" && (MINIMAL_LOG_NAMES.has(value) || isCapxulOperation(value)) ? value : "capxul.engineering";
+const minimalName = (value) => typeof value === "string" && (MINIMAL_LOG_NAMES.has(value) || isCapxulOperation(value) || CLI_COMMAND_NAMES.some((command) => value === `cli.command.${command}`)) ? value : "capxul.engineering";
 const MINIMAL_ENUM_VALUES = /* @__PURE__ */ new Map([
 	["outcome", [
 		"succeeded",
@@ -8573,7 +9408,10 @@ const MINIMAL_ENUM_VALUES = /* @__PURE__ */ new Map([
 	["failure_mode", FAILURE_MODES$1],
 	["capxul_env", ENGINEERING_CAPXUL_ENVS],
 	["producer", ["browser", "server"]],
-	["command", ["doctor"]],
+	["command", CLI_COMMAND_NAMES],
+	["capability", CLI_CAPABILITIES],
+	["invocation_kind", CLI_INVOCATION_KINDS],
+	["cli_identity_kind", ["anonymous"]],
 	["output_mode", ["human", "json"]],
 	["unit", [
 		"1",
@@ -8790,10 +9628,12 @@ function minimalSerialization(config) {
 	};
 }
 Effect.flatMap(OtlpExporter.Flusher, (flusher) => flusher.flush);
+var EngineeringLog = class extends Context.Service()("capxul/EngineeringLog") {};
 /** Shared browser/server OTLP layer. OtlpLogger merges with incumbent loggers once. */
 const makeEngineeringTelemetryLayer = (config) => {
 	const validated = validateEngineeringTelemetryConfig(config);
 	return Layer.suspend(() => {
+		const bounded = validated.deliveryBudget === void 0 ? void 0 : cliEngineeringDelivery(validated.deliveryBudget, validated.serviceName === "capxul-cli");
 		const endpoints = postHogOtlpEndpoints(validated.host);
 		let disabled = false;
 		const enabled = () => {
@@ -8807,7 +9647,12 @@ const makeEngineeringTelemetryLayer = (config) => {
 		};
 		const delivery = {
 			...validated.shutdownTimeout === void 0 ? {} : { shutdownTimeout: validated.shutdownTimeout },
-			...validated.exportInterval === void 0 ? {} : { exportInterval: validated.exportInterval }
+			...validated.exportInterval === void 0 ? {} : { exportInterval: validated.exportInterval },
+			...bounded === void 0 ? {} : {
+				maxBatchSize: Number.MAX_SAFE_INTEGER,
+				exportInterval: 1e3,
+				shutdownTimeout: validated.serviceName === "capxul-cli" ? 0 : 500
+			}
 		};
 		const resource = {
 			serviceName: validated.serviceName ?? "capxul-sdk",
@@ -8823,22 +9668,38 @@ const makeEngineeringTelemetryLayer = (config) => {
 			headers: validated.headers,
 			resource,
 			...delivery
-		}).pipe(Effect.map((tracer) => makeLeakSafeEngineeringTracer(tracer, enabled)))).pipe(Layer.provideMerge(OtlpExporter.layerFlusher));
-		const logging = Logger.layer([OtlpLogger.make({
+		}).pipe(Effect.map((tracer) => makeLeakSafeEngineeringTracer(bounded?.tracer(tracer) ?? tracer, enabled)))).pipe(Layer.provideMerge(OtlpExporter.layerFlusher));
+		const ownedLogging = Layer.effect(EngineeringLog, OtlpLogger.make({
 			url: endpoints.logs,
 			headers: validated.headers,
 			resource,
-			...delivery
-		}).pipe(Effect.map((logger) => Logger.make((options) => {
-			if (enabled()) logger.log(options);
-		})))], { mergeWithExisting: true }).pipe(Layer.provideMerge(OtlpExporter.layerFlusher));
-		const metrics = OtlpMetrics.layer({
+			...delivery,
+			...bounded === void 0 ? {} : { excludeLogSpans: true }
+		}).pipe(Effect.map((nativeLogger) => {
+			const logger = bounded?.logger(nativeLogger) ?? nativeLogger;
+			return Logger.make((options) => {
+				if (enabled()) logger.log(options);
+			});
+		}))).pipe(Layer.provideMerge(OtlpExporter.layerFlusher));
+		const logging = Logger.layer([EngineeringLog], { mergeWithExisting: true }).pipe(Layer.provideMerge(ownedLogging));
+		const metricConfig = {
 			url: endpoints.metrics,
 			headers: validated.headers,
 			resource,
 			temporality: "delta",
 			...delivery
-		});
+		};
+		const metrics = bounded === void 0 ? OtlpMetrics.layer(metricConfig) : validated.serviceName !== "capxul-cli" ? Layer.empty : Layer.effectDiscard(Effect.gen(function* () {
+			const flusher = yield* OtlpExporter.Flusher;
+			yield* OtlpMetrics.make({
+				...metricConfig,
+				exportInterval: Number.POSITIVE_INFINITY,
+				shutdownTimeout: 0
+			}).pipe(Effect.provideService(OtlpExporter.Flusher, {
+				...flusher,
+				register: (run) => flusher.register(bounded.metrics(run))
+			}));
+		})).pipe(Layer.provideMerge(OtlpExporter.layerFlusher));
 		const headerPolicy = Layer.merge(Layer.succeed(HttpClient.TracerHeaderFilter, traceHeaderFilter), Layer.succeed(Headers.CurrentRedactedNames, [credentialHeaderPattern]));
 		const browserLifecycle = Layer.effectDiscard(Effect.gen(function* () {
 			if (validated.producer !== "browser" || !hasBrowserDocument()) return;
@@ -8861,17 +9722,25 @@ const makeEngineeringTelemetryLayer = (config) => {
 			}));
 		}));
 		const transport = Layer.effect(HttpClient.HttpClient, Effect.map(HttpClient.HttpClient, (client) => {
-			const selectedTransport = validated.producer === "browser" && hasBrowserDocument() ? browserExportClient(client) : client;
-			return HttpClient.transform(selectedTransport, (response, request) => Effect.suspend(() => enabled() && request.body._tag !== "Empty" ? response : Effect.succeed(HttpClientResponse.fromWeb(request, new Response(null, { status: 200 })))));
+			const originalTransport = validated.producer === "browser" && hasBrowserDocument() ? browserExportClient(client) : client;
+			const selectedTransport = bounded?.transport(originalTransport, enabled) ?? originalTransport;
+			return HttpClient.transform(selectedTransport, (response, request) => Effect.suspend(() => {
+				if (enabled() && request.body._tag !== "Empty") return response;
+				bounded?.discardBody(request.body);
+				return Effect.succeed(HttpClientResponse.fromWeb(request, new Response(null, { status: 200 })));
+			}));
 		})).pipe(Layer.provide(FetchHttpClient.layer));
 		const serialization = Layer.effect(OtlpSerialization.OtlpSerialization, Effect.map(OtlpSerialization.OtlpSerialization, (json) => {
 			const projected = minimalSerialization(validated);
-			return validated.privacy === "minimal" ? projected : {
+			const selected = validated.privacy === "minimal" ? projected : {
 				...json,
 				metrics: projected.metrics
 			};
+			return bounded?.serialization(selected) ?? selected;
 		})).pipe(Layer.provide(OtlpSerialization.layerJson));
-		return browserLifecycle.pipe(Layer.provideMerge(Layer.mergeAll(tracing, logging, metrics, headerPolicy)), Layer.provide(serialization), Layer.provide(transport));
+		const combined = browserLifecycle.pipe(Layer.provideMerge(Layer.mergeAll(tracing, logging, metrics, headerPolicy)), Layer.provide(serialization), Layer.provide(transport));
+		const scoped = bounded === void 0 ? combined : combined.pipe(Layer.provideMerge(Layer.effectDiscard(Effect.addFinalizer(() => Effect.sync(bounded.close)))));
+		return validated.deliveryBudget === void 0 ? scoped : scoped.pipe(Layer.provideMerge(Layer.succeed(Metric.MetricRegistry, validated.serviceName === "capxul-cli" ? validated.deliveryBudget.metricRegistry : validated.deliveryBudget.emptyMetricRegistry())));
 	});
 };
 //#endregion
@@ -15155,6 +16024,7 @@ function postHogObservability(client, options = {}) {
 		product: postHogProductTelemetry(policy)
 	};
 	Object.defineProperty(module, HOST_ENGINEERING_POLICY, { value: Object.freeze({
+		...options.engineeringDeliveryBudget === void 0 ? {} : { engineeringDeliveryBudget: options.engineeringDeliveryBudget },
 		...options.engineeringEnabled === void 0 ? {} : { engineeringEnabled: options.engineeringEnabled },
 		...options.engineeringPrivacy === void 0 ? {} : { engineeringPrivacy: options.engineeringPrivacy }
 	}) });
@@ -15192,6 +16062,7 @@ function isPromiseLike(value) {
 function hostEngineeringPolicy(observability) {
 	const policy = observability?.[HOST_ENGINEERING_POLICY];
 	return {
+		...policy?.engineeringDeliveryBudget === void 0 ? {} : { deliveryBudget: policy.engineeringDeliveryBudget },
 		...policy?.engineeringEnabled === void 0 ? {} : { enabled: policy.engineeringEnabled },
 		...policy?.engineeringPrivacy === void 0 ? {} : { privacy: policy.engineeringPrivacy }
 	};
@@ -15260,7 +16131,8 @@ function decodeTransfer(value) {
 		token: toAddress(hex(row, "token")),
 		from: toAddress(hex(row, "from")),
 		to: toAddress(hex(row, "to")),
-		amount: big(row, "amount")
+		amount: big(row, "amount"),
+		..."payment_settlement_id" in row ? { paymentSettlementId: row.payment_settlement_id === null ? null : hex(row, "payment_settlement_id") } : {}
 	};
 }
 function decodePayment(value) {
@@ -15346,6 +16218,60 @@ const ACTOR_PARAMS = {
 */
 function ponderQuery(table, input) {
 	const safe = assertIndexerPage(input);
+	if (input.eventId !== void 0) {
+		if (table !== "transfer") throw Errors.invalidInput("eventId", "only transfer reads accept a logical event ID");
+		return {
+			sql: `${HEADS.transfer.slice(0, HEADS.transfer.indexOf(" from \"transfer\""))} from "transfer" where (("transfer"."from" = $1 or "transfer"."to" = $2) and "transfer"."id" = $3) limit $4`,
+			params: [
+				safe,
+				safe,
+				input.eventId,
+				1
+			],
+			typings: [
+				"none",
+				"none",
+				"none",
+				"none"
+			]
+		};
+	}
+	if (input.settlements !== void 0) {
+		if (table !== "payment") throw Errors.invalidInput("settlements", "only Payment reads accept settlement IDs");
+		const params = [
+			safe,
+			safe,
+			...input.settlements,
+			input.limit
+		];
+		return {
+			sql: `${HEADS.payment.slice(0, HEADS.payment.indexOf("where "))}where (("payment"."sender" = $1 or "payment"."recipient" = $2) and "payment"."settlement_id" in (${input.settlements.map((_, i) => `$${i + 3}`).join(", ")})) limit $${params.length}`,
+			params,
+			typings: params.map(() => "none")
+		};
+	}
+	if (input.timeline !== void 0) {
+		if (table !== "transfer") throw Errors.invalidInput("timeline", "only transfer reads have a timeline");
+		const { from, to, before } = input.timeline;
+		const params = [
+			safe,
+			safe,
+			from,
+			to
+		];
+		const select = HEADS.transfer.slice(0, HEADS.transfer.indexOf(" from \"transfer\"")) + ", \"payment_settlement_id\" from \"activity_transfer\" ";
+		let where = "(\"activity_transfer\".\"from\" = $1 or \"activity_transfer\".\"to\" = $2) and \"activity_transfer\".\"timestamp\" >= $3 and \"activity_transfer\".\"timestamp\" <= $4";
+		if (before !== void 0) {
+			params.push(before.timestamp, before.timestamp, before.id);
+			where += " and (\"activity_transfer\".\"timestamp\" < $5 or (\"activity_transfer\".\"timestamp\" = $6 and \"activity_transfer\".\"id\" < $7))";
+		}
+		params.push(input.limit);
+		return {
+			sql: `${select}where (${where}) order by "activity_transfer"."timestamp" desc, "activity_transfer"."id" desc limit $${params.length}`,
+			params,
+			typings: params.map(() => "none")
+		};
+	}
 	const offset = input.offset ?? 0;
 	const actors = ACTOR_PARAMS[table];
 	const params = [];