@capxul/sdk 4.20.0-beta.3 → 4.20.0-beta.31

package/dist/production-2L76NWS5.mjs

@@ -0,0 +1,4882 @@
+import { c as deserializeCapxulError, n as makeOrgMethods, o as ConvexOrganizationAdapter, s as OrgPortTag, t as ConvexOrganizationSetupAdapter } from "./organizations-wucUfgJr.mjs";
+import { $r as ActorFailure, $t as version, A as registerProductTelemetryInvocation, Ai as toEpochMs, An as details, Bi as isFailureMode, Br as runIdentityFacade, Bt as failureEvidenceProps, C as AccountReadPortTag, Ci as detectAuthCacheAdapter, Cn as CLI_INVOCATION_KINDS, D as convexCallErrorFromCapxul, Dn as isCapxulOperation, E as ConvexCallPortTag, En as CAPXUL_OPERATIONS, Gt as observationContextProps, H as makePaymentsMethods, Hi as readField, Hr as sessionFromActor, Ht as postHogFailureObservation, Ii as Errors, It as callOperation, J as makeTargetsMethods, Jn as ORGANIZATION_SETUP_REASONS, K as makeCheckoutMethods, Kt as withCapturedAttemptContext, L as makeAccountMethods, Li as CapxulError, Lr as makeAuthMethods, Lt as asCapxulError, M as makeApprovalsMethods, Mi as toAuthUserId, Mr as toAddress, Ni as toEmail, Nt as BASE_SEPOLIA_CHAIN_ID, On as normalizeCapxulOperation, Ri as isCapxulError, Rr as askIdentity, Rt as toPublicError, Si as AuthClientPortTag, Sn as CLI_COMMAND_NAMES, T as TelemetryPortTag, Tn as stampTelemetryEnvelope, Tr as ChainIdSchema, Ut as observeFailedResult, V as makeOfframpMethods, Vi as isRecord, Vr as runPortEffect, W as makeDestinationsMethods, Wi as AuthCachePortTag, Wn as setups, Wr as runCapxulEffect, Wt as observeSdkClient, Xr as formatTraceparent, Yn as ORGANIZATION_SETUP_STATUSES, Yr as toCapxulResult, Zn as decodeChainCause, Zr as CAPXUL_ERROR_CODES, _i as toAllowedOrigin, ai as ClockPortTag, an as isSignerNotReadySignal, bn as redactTelemetryProps, br as EpochMsSchema, c as makePaymentDocumentsMethods, ci as BetterAuthBrowserLayer, cn as signerFailure, cr as AppIdSchema, d as SmartAccountPortTag, di as copyInvocationObservation, dn as makeClientRequestMethods, ei as carryInvocationParentSpan, fi as readInvocationObservation, fn as toCountryCode, fr as isBytes32, g as ConvexAccountLayer, gi as isCredentialField, gn as toHandle, h as makeAccountsMethods, hi as redactUrlSecrets, in as isEcdsaSignatureHex, jn as onboardings, jr as isEvmAddress, k as bindProductTelemetryInvocation, kn as OPERATIONS, kt as normalizeSafeSaltEmail, l as makeSmartAccountMethods, li as observationRequestHeaders, lr as images, m as PonderIndexerAdapter, mi as redactSecrets, mn as toTesterKind, n as bootIdentityFlow, nn as causeChain, on as openfortSignerNotReadyCode, p as makeHoldingsMethods, pi as sanitizeObservationContext, pn as toKycTier, r as makeMeMethods, ri as SystemClockLayer, s as makeActivityMethods, si as BetterAuthNodeLayer, sn as recoverRawDigestSigner, sr as diagnostics, t as executeIdentityProductObservation, tn as UNOBSERVABLE_SIGNER_STATUS, u as ConvexSmartAccountLayer, ui as attachInvocationObservation, un as makeCurrentUserMethods, vn as validateHandle, wi as globalLocalStorage, xi as AuthClientError, xn as CLI_CAPABILITIES, yi as toPublishableKey, yr as DurationMsSchema, z as logDroppedEvent, zi as FAILURE_MODES, zr as publicIdentityFailure, zt as failureDetail } from "./access-B-2qmxF_.mjs";
+import { Cause, Clock, Context, Data, Deferred, Duration, Effect, Exit, FiberSet, Layer, Logger, Metric, Option, Predicate, References, Result, Schedule, Schema, SchemaIssue, SchemaParser, Scope, Stream, Tracer } from "effect";
+import { getFunctionName } from "convex/server";
+import { keccak256, stringToHex } from "viem";
+import { privateKeyToAccount } from "viem/accounts";
+import { AccountTypeEnum, ChainTypeEnum, EmbeddedState, Openfort, RecoveryMethod, ThirdPartyOAuthProvider } from "@openfort/openfort-js";
+import { ConvexClient, ConvexHttpClient } from "convex/browser";
+import { FetchHttpClient, Headers, HttpBody, HttpClient, HttpClientError, HttpClientResponse } from "effect/http";
+import { OtlpExporter, OtlpLogger, OtlpMetrics, OtlpSerialization, OtlpTracer } from "effect/observability";
+//#region ../observability/src/browser/network.ts
+/** In unstructured bodies, preserve text around explicitly named credentials. */
+const NETWORK_FIELD = /((?:"?)([A-Za-z_][A-Za-z0-9_.-]*)(?:"?)\s*[:=]\s*)("(?:[^"\\]|\\.)*"|'(?:[^'\\]|\\.)*'|[^\s,;&}]+)/gu;
+function maskNetworkText(text, context) {
+	return redactSecrets(text).replace(NETWORK_FIELD, (whole, prefix, name, value) => {
+		if (!isCredentialField(name, context)) return whole;
+		const quote = value.startsWith("\"") ? "\"" : value.startsWith("'") ? "'" : "";
+		return `${prefix}${quote}[REDACTED]${quote}`;
+	});
+}
+function maskNetworkHeaders(headers) {
+	if (headers === void 0) return void 0;
+	const masked = {};
+	for (const [name, value] of Object.entries(headers)) masked[name] = isCredentialField(name, "header") ? "[REDACTED]" : /^(?:location|content-location|referer)$/iu.test(name) ? redactUrlSecrets(value) : maskNetworkText(value);
+	return masked;
+}
+function maskJsonValue(value, depth = 0, context) {
+	if (typeof value === "function" || typeof value === "symbol") return "[UNREADABLE]";
+	if (typeof value === "string") return maskNetworkText(value, context);
+	if (typeof value !== "object" || value === null) return value;
+	if (depth >= 16) return "[REDACTED]";
+	if (Array.isArray(value)) return value.map((item) => maskJsonValue(item, depth + 1, context));
+	const masked = Object.create(null);
+	for (const [key, descriptor] of Object.entries(Object.getOwnPropertyDescriptors(value))) {
+		if (!descriptor.enumerable) continue;
+		masked[key] = isCredentialField(key, context) ? "[REDACTED]" : !("value" in descriptor) ? "[UNREADABLE]" : typeof descriptor.value === "string" && isPostHogUrlProperty(key) ? redactUrlSecrets(descriptor.value) : maskJsonValue(descriptor.value, depth + 1, context);
+	}
+	return masked;
+}
+function maskNetworkBody(body, context) {
+	try {
+		if (typeof body !== "string") return maskJsonValue(body, 0, context);
+		let parsed;
+		try {
+			parsed = JSON.parse(body);
+		} catch {
+			if (/^[^=&\s]+=[\s\S]*$/u.test(body)) return new URLSearchParams(Array.from(new URLSearchParams(body), ([name, value]) => [name, isCredentialField(name, context) ? "[REDACTED]" : maskNetworkText(value)])).toString();
+			return maskNetworkText(body, context);
+		}
+		return JSON.stringify(maskJsonValue(parsed, 0, context));
+	} catch {
+		return "[UNREADABLE]";
+	}
+}
+/** Keep request evidence while masking credential values at the browser boundary. */
+function maskCapturedNetworkRequest(request) {
+	const requestUrl = request.name ?? request.url ?? "";
+	let context;
+	try {
+		const path = new URL(requestUrl, "https://capxul.invalid").pathname;
+		if (/\/(?:auth|oauth|sign-in|signin|login|verify-otp|verify-email)(?:\/|$)/iu.test(path)) context = "authentication";
+	} catch {}
+	return {
+		...request,
+		...request.name === void 0 ? {} : { name: redactUrlSecrets(request.name) },
+		...request.url === void 0 ? {} : { url: redactUrlSecrets(request.url) },
+		requestHeaders: maskNetworkHeaders(request.requestHeaders),
+		responseHeaders: maskNetworkHeaders(request.responseHeaders),
+		requestBody: maskNetworkBody(request.requestBody, context),
+		responseBody: maskNetworkBody(request.responseBody)
+	};
+}
+function isPostHogUrlProperty(key) {
+	const normalized = key.toLowerCase();
+	return normalized.includes("url") || normalized.includes("referrer") || normalized.includes("path") || normalized.includes("filename");
+}
+//#endregion
+//#region src/signing/embedded-wallet.ts
+function openfortEmbeddedWalletPort(input) {
+	return {
+		async getAddress() {
+			if (input.ensureReady !== void 0) await input.ensureReady();
+			return (await input.embeddedWallet.get()).address;
+		},
+		async signRawDigest(hash) {
+			if (input.ensureReady !== void 0) await input.ensureReady();
+			const signature = await input.embeddedWallet.signMessage(hash, {
+				hashMessage: false,
+				arrayifyMessage: false
+			});
+			if (!isEcdsaSignatureHex(signature)) throw new Error("embeddedSigner: embedded wallet returned invalid signature format");
+			return signature;
+		}
+	};
+}
+//#endregion
+//#region src/signing/openfort-embedded.ts
+/** Browser helper: wrap an initialized Openfort `embeddedWallet` API. */
+function openfortEmbeddedSignerFromWallet(input) {
+	return embeddedSigner({ wallet: openfortEmbeddedWalletPort({
+		embeddedWallet: input.embeddedWallet,
+		...input.ensureWalletReady === void 0 ? {} : { ensureReady: input.ensureWalletReady }
+	}) });
+}
+/**
+* The embedded-wallet (passkey / Openfort) member of the named `CapxulSigner`
+* constructor trio `localPrivateKeySigner` / `injectedWalletSigner` /
+* `embeddedSigner` (backend-orchestrated-deploy.md). Takes the
+* provider-agnostic `OpenfortEmbeddedWalletPort` (getAddress + signRawDigest);
+* the Openfort-API convenience wrapper is `openfortEmbeddedSignerFromWallet`.
+*/
+function embeddedSigner(input) {
+	let cachedAddress = null;
+	let addressInFlight = null;
+	let cacheEpoch = 0;
+	const resetAddressCache = () => {
+		cacheEpoch += 1;
+		cachedAddress = null;
+		addressInFlight = null;
+	};
+	const resolveAddress = async () => {
+		if (cachedAddress !== null) return cachedAddress;
+		if (addressInFlight !== null) return addressInFlight;
+		const epoch = cacheEpoch;
+		addressInFlight = (async () => {
+			try {
+				const raw = await input.wallet.getAddress();
+				if (!isEvmAddress(raw)) throw new Error("embeddedSigner: embedded wallet returned invalid address format");
+				const address = toAddress(raw);
+				if (epoch === cacheEpoch) cachedAddress = address;
+				return address;
+			} finally {
+				if (epoch === cacheEpoch) addressInFlight = null;
+			}
+		})();
+		return addressInFlight;
+	};
+	return {
+		source: "openfort-embedded",
+		getAddress: resolveAddress,
+		resetAddressCache,
+		async signUserOpHash(hash) {
+			if (!isBytes32(hash)) throw new Error("embeddedSigner: SafeOp digest must be a 0x-prefixed 32-byte hex");
+			const address = await resolveAddress();
+			let signature;
+			try {
+				signature = await input.wallet.signRawDigest(hash);
+			} catch (cause) {
+				const detail = cause instanceof Error ? cause.message : String(cause);
+				throw new Error(`embeddedSigner: raw digest signing failed; ensure the embedded wallet is configured (${detail})`, { cause });
+			}
+			if (!isEcdsaSignatureHex(signature)) throw new Error("embeddedSigner: embedded wallet returned invalid signature format");
+			if ((await recoverRawDigestSigner("embeddedSigner", {
+				hash,
+				signature
+			})).toLowerCase() !== address.toLowerCase()) throw new Error("embeddedSigner: signature did not recover the embedded wallet address for the raw SafeOp digest");
+			return signature;
+		}
+	};
+}
+//#endregion
+//#region src/signing/openfort-failures.ts
+function httpStatusOf(link) {
+	for (const status of [
+		readField(link.response, "status"),
+		link.statusCode,
+		link.status,
+		readField(link.details, "httpStatus")
+	]) if (typeof status === "number") return status;
+}
+function isUnauthorizedCause(cause) {
+	for (const link of causeChain(cause)) if (httpStatusOf(link) === 401) return true;
+	return false;
+}
+function openfortProviderError(operation, cause) {
+	if (cause instanceof CapxulError) return cause;
+	const failure_mode = operation === "configure" && isUnauthorizedCause(cause) ? "unauthorized" : "unknown";
+	return Errors.providerError("openfort", operation, cause, { failure_mode });
+}
+function openfortFailureMode(error) {
+	return error.mode ?? "unknown";
+}
+/** Build a named PROVIDER_ERROR. The assembled Core SDK boundary reports it. */
+function failOpenfort(operation, failure_mode, cause) {
+	return Errors.providerError("openfort", operation, cause, { failure_mode });
+}
+/**
+* True when the browser cannot perform Web Crypto — sandboxed iframes, headless
+* agent browsers, or non-HTTPS origins. OpenFort's embedded-wallet `configure`
+* silently produces no address in this state, so we detect it up front and name
+* it `no-secure-context` instead of letting it decay into `unknown`.
+*/
+function isInsecureBrowserContext() {
+	return readField(globalThis, "isSecureContext") === false || globalThis.crypto?.subtle === void 0;
+}
+//#endregion
+//#region src/signing/openfort-credentials.ts
+const sinceCycleStart = (clock) => clock.cycleStartedAt === null ? void 0 : Date.now() - clock.cycleStartedAt;
+/**
+* The auth server's token reply: `token` from the OIDC endpoint, `session.token`
+* from better-auth. A reply of any other shape fails the token read.
+*/
+const AccessTokenBody = Schema.Struct({
+	token: Schema.optional(Schema.NullOr(Schema.String)),
+	session: Schema.optional(Schema.NullOr(Schema.Struct({ token: Schema.optional(Schema.NullOr(Schema.String)) })))
+});
+/**
+* The two credentials Openfort needs from the signed-in session: the access
+* token it verifies, and an encryption session for automatic recovery. A host
+* that owns login passes `auth`; otherwise both come from the auth server.
+*/
+function makeOpenfortCredentials(input) {
+	const { authProvider, authBaseUrl, auth, diagnostic, clock } = input;
+	function accessTokenUrl() {
+		return authProvider === "oidc" ? `${authBaseUrl}/convex/token` : `${authBaseUrl}/get-session`;
+	}
+	function encryptionSessionUrl() {
+		return `${authBaseUrl}/encryption-session`;
+	}
+	async function fetchBetterAuthAccessToken() {
+		clock.tokenCalls += 1;
+		const tokenStartedAt = Date.now();
+		try {
+			if (auth !== void 0) {
+				const token = (await auth.getAccessToken())?.trim() ?? "";
+				diagnostic?.trace("openfort.token", {
+					ok: token.length > 0,
+					tokenPresent: token.length > 0,
+					provider: authProvider,
+					call: clock.tokenCalls,
+					duration_ms: Date.now() - tokenStartedAt,
+					elapsed_ms: sinceCycleStart(clock)
+				});
+				return token.length === 0 ? null : token;
+			}
+			const response = await fetch(accessTokenUrl(), {
+				credentials: "include",
+				cache: "no-store"
+			});
+			if (!response.ok) {
+				diagnostic?.trace("openfort.token", {
+					ok: false,
+					tokenPresent: false,
+					httpStatus: response.status,
+					failure_mode: "unknown"
+				});
+				return null;
+			}
+			const body = Schema.decodeUnknownSync(AccessTokenBody)(await response.json());
+			const token = (authProvider === "oidc" ? body.token : body.session?.token)?.trim();
+			if (token === void 0 || token.length === 0) {
+				diagnostic?.trace("openfort.token", {
+					ok: false,
+					tokenPresent: false,
+					failure_mode: "unknown"
+				});
+				return null;
+			}
+			diagnostic?.trace("openfort.token", {
+				ok: true,
+				tokenPresent: true,
+				provider: authProvider,
+				call: clock.tokenCalls,
+				duration_ms: Date.now() - tokenStartedAt,
+				elapsed_ms: sinceCycleStart(clock)
+			});
+			return token;
+		} catch (cause) {
+			diagnostic?.trace("openfort.token", {
+				ok: false,
+				tokenPresent: false,
+				failure_mode: "unknown"
+			});
+			throw openfortProviderError("token", cause);
+		}
+	}
+	async function createEncryptionSession(accessToken) {
+		if (auth !== void 0) {
+			const sessionId = (await auth.createEncryptionSession(accessToken)).trim();
+			if (sessionId.length === 0) throw Errors.providerError("openfort", "encryptionSession", /* @__PURE__ */ new Error("Openfort encryption session response missing sessionId"), { failure_mode: "unknown" });
+			return { sessionId };
+		}
+		const response = await fetch(encryptionSessionUrl(), {
+			method: "POST",
+			credentials: "include",
+			headers: {
+				Authorization: `Bearer ${accessToken}`,
+				"Content-Type": "application/json"
+			},
+			body: JSON.stringify({})
+		});
+		if (!response.ok) throw Errors.providerError("openfort", "encryptionSession", /* @__PURE__ */ new Error(`Openfort encryption session failed (${response.status})`), {
+			httpStatus: response.status,
+			failure_mode: "unknown"
+		});
+		const sessionId = readField(await response.json(), "sessionId");
+		if (typeof sessionId !== "string" || sessionId.length === 0) throw Errors.providerError("openfort", "encryptionSession", /* @__PURE__ */ new Error("Openfort encryption session response missing sessionId"), {
+			httpStatus: response.status,
+			failure_mode: "unknown"
+		});
+		return {
+			sessionId,
+			httpStatus: response.status
+		};
+	}
+	return {
+		fetchBetterAuthAccessToken,
+		createEncryptionSession
+	};
+}
+//#endregion
+//#region src/signing/openfort-storage.ts
+/** Openfort SDK storage keys (`@openfort/openfort-js` StorageKeys). */
+const OPENFORT_BROWSER_STORAGE_KEYS = [
+	"openfort.authentication",
+	"openfort.account",
+	"openfort.session",
+	"openfort.configuration"
+];
+/**
+* Matches `@openfort/openfort-js` ScopedStorage.createScope — chars 8–15 of the
+* publishable key, prefixed onto each StorageKeys entry in localStorage.
+*/
+function openfortBrowserStorageScope(publishableKey) {
+	const trimmed = publishableKey.trim();
+	if (trimmed.length < 16) return;
+	return trimmed.substring(8, 16);
+}
+/**
+* Drop cached Openfort auth/account state so third-party login re-runs for the
+* current Better Auth session. The SDK skips `authenticateThirdParty` when a
+* stale `userId` is already in storage, which yields 401 on `v2/accounts`.
+*/
+function clearStaleOpenfortBrowserStorage(publishableKey) {
+	if (typeof localStorage === "undefined") return;
+	const scope = openfortBrowserStorageScope(publishableKey);
+	if (scope === void 0) return;
+	for (const key of OPENFORT_BROWSER_STORAGE_KEYS) localStorage.removeItem(`${scope}.${key}`);
+}
+/**
+* The Openfort error code that names the stale-user class (#1435).
+* `getThirdPartyAuthToken` skips `authenticateThirdParty` while a `userId` sits
+* in scoped storage. A purged `userId` therefore pins every later call to a 401
+* that `extractApiError` reports as `USER_NOT_FOUND`.
+*
+* The set holds one member on purpose. Session-expiry codes (`SESSION_EXPIRED`,
+* `NOT_LOGGED_IN`, `INVALID_TOKEN`, `REFRESH_TOKEN_ERROR`) are a different
+* cause, and a bare 401 is a different cause again: `app-env-allowlist` is a
+* 401 by definition (`packages/errors/src/errors.ts:80-81`). Healing those and
+* tagging them `stale-openfort-cache` would delete the triage signal the tag
+* exists to carry.
+*/
+const STALE_USER_ERROR_CODES = /* @__PURE__ */ new Set(["USER_NOT_FOUND"]);
+/**
+* The one predicate that opens the heal. It reads the Openfort error code and
+* never the message text (ADR-0023 R4). It walks the cause chain the way
+* `isTransportError` walks it in the Convex transport adapter.
+*
+* Known ceiling (#1435): a 401 that carries no recognized code is NOT healed.
+* `extractApiError` keeps the status only on `AuthenticationError`, so such a
+* payload is reachable. Add the code a live payload shows; do not add a message
+* match, because that trades one bug class for an ADR-0023 R4 violation.
+*/
+function isStaleUserSignal(cause) {
+	for (const link of causeChain(cause)) if (typeof link.error === "string" && STALE_USER_ERROR_CODES.has(link.error) || typeof link.code === "string" && STALE_USER_ERROR_CODES.has(link.code)) return true;
+	return false;
+}
+//#endregion
+//#region src/signing/openfort-readiness.ts
+/**
+* One wallet readiness cycle: initialize, read the access token, open an
+* encryption session, configure the embedded wallet when it is not ready, and
+* read it back, healing a stale cached Openfort user once.
+*/
+function makeWalletReadyCycle(input) {
+	const { openfort, publishableKey, diagnostic, credentials, clock } = input;
+	const step = (name, extra = {}) => {
+		const now = Date.now();
+		diagnostic?.trace("openfort.step", {
+			step: name,
+			duration_ms: now - clock.stepStartedAt,
+			elapsed_ms: sinceCycleStart(clock),
+			...extra
+		});
+		clock.stepStartedAt = now;
+	};
+	/**
+	* Closes the black hole: when the browser has no Web Crypto, OpenFort's
+	* `configure` would resolve to no address and the failure would be reported
+	* as `unknown`. Detect it before any network or wallet work. Tag it
+	* `no-secure-context` on a PROVIDER_ERROR scoped to `configure`. Add a
+	* DiagnosticPort breadcrumb. The assembled Core SDK boundary reports it.
+	*/
+	function failNoSecureContext() {
+		diagnostic?.trace("openfort.configure", {
+			ok: false,
+			failure_mode: "no-secure-context"
+		});
+		throw failOpenfort("configure", "no-secure-context", /* @__PURE__ */ new Error("Web Crypto unavailable: browser is not a secure context"));
+	}
+	async function configureEmbeddedWallet(encryptionSession) {
+		await openfort.embeddedWallet.configure({
+			accountType: AccountTypeEnum.EOA,
+			chainType: ChainTypeEnum.EVM,
+			recoveryParams: {
+				recoveryMethod: RecoveryMethod.AUTOMATIC,
+				encryptionSession
+			}
+		});
+	}
+	/**
+	* ONE heal cycle on the stale-user rejection (#1435). Clear the scoped
+	* storage that pins the dead `userId`, run the existing configure path — it
+	* re-runs third-party auth against the live Better Auth session now that no
+	* `userId` is cached — and retry the read once. Exactly one cycle: a second
+	* rejection is terminal and carries `failure_mode: "stale-openfort-cache"`.
+	* The caller stays in `recovering` throughout; only the outcome moves it.
+	*/
+	async function healStaleOpenfortCache(encryptionSession) {
+		try {
+			clearStaleOpenfortBrowserStorage(publishableKey);
+			diagnostic?.trace("openfort.storageCleared", { beforeConfigure: false });
+			await configureEmbeddedWallet(encryptionSession);
+			await openfort.embeddedWallet.get();
+		} catch (cause) {
+			diagnostic?.trace("openfort.staleCacheHeal", {
+				ok: false,
+				failure_mode: "stale-openfort-cache"
+			});
+			throw failOpenfort("get", "stale-openfort-cache", cause);
+		}
+		diagnostic?.trace("openfort.staleCacheHeal", { ok: true });
+	}
+	return function startWalletReady() {
+		return (async () => {
+			const startedAt = Date.now();
+			clock.cycleStartedAt = startedAt;
+			clock.stepStartedAt = startedAt;
+			clock.tokenCalls = 0;
+			if (isInsecureBrowserContext()) failNoSecureContext();
+			await openfort.waitForInitialization();
+			step("initialize");
+			const accessToken = await credentials.fetchBetterAuthAccessToken();
+			if (accessToken === null) throw openfortProviderError("token", /* @__PURE__ */ new Error("Better Auth access token unavailable for Openfort"));
+			step("token");
+			let encryption;
+			try {
+				encryption = await credentials.createEncryptionSession(accessToken);
+			} catch (cause) {
+				let httpStatus;
+				for (const link of causeChain(cause)) httpStatus ??= httpStatusOf(link);
+				diagnostic?.trace("openfort.encryptionSession", {
+					ok: false,
+					...httpStatus === void 0 ? {} : { httpStatus },
+					failure_mode: "unknown"
+				});
+				throw openfortProviderError("encryptionSession", cause);
+			}
+			diagnostic?.trace("openfort.encryptionSession", {
+				ok: true,
+				...encryption.httpStatus === void 0 ? {} : { httpStatus: encryption.httpStatus }
+			});
+			step("encryptionSession", encryption.httpStatus === void 0 ? {} : { httpStatus: encryption.httpStatus });
+			let embeddedState;
+			try {
+				embeddedState = await openfort.embeddedWallet.getEmbeddedState();
+				diagnostic?.trace("openfort.embeddedState", { state: embeddedState });
+				step("embeddedState", { state: embeddedState });
+			} catch (cause) {
+				diagnostic?.trace("openfort.embeddedState", {
+					ok: false,
+					failure_mode: "unknown"
+				});
+				throw openfortProviderError("embeddedState", cause);
+			}
+			if (embeddedState !== EmbeddedState.READY) {
+				clearStaleOpenfortBrowserStorage(publishableKey);
+				diagnostic?.trace("openfort.storageCleared", { beforeConfigure: true });
+				try {
+					await configureEmbeddedWallet(encryption.sessionId);
+					diagnostic?.trace("openfort.configure", { ok: true });
+					step("configure");
+				} catch (cause) {
+					const error = openfortProviderError("configure", cause);
+					diagnostic?.trace("openfort.configure", {
+						ok: false,
+						failure_mode: openfortFailureMode(error)
+					});
+					throw error;
+				}
+			}
+			try {
+				await openfort.embeddedWallet.get();
+				diagnostic?.trace("openfort.get", { ok: true });
+				step("get");
+			} catch (cause) {
+				if (!isStaleUserSignal(cause)) {
+					diagnostic?.trace("openfort.get", {
+						ok: false,
+						failure_mode: "unknown"
+					});
+					throw openfortProviderError("get", cause);
+				}
+				diagnostic?.trace("openfort.get", {
+					ok: false,
+					failure_mode: "stale-openfort-cache"
+				});
+				await healStaleOpenfortCache(encryption.sessionId);
+				step("healStaleCache");
+			}
+			step("walletReady", {
+				ok: true,
+				total_ms: Date.now() - startedAt,
+				token_calls: clock.tokenCalls
+			});
+		})();
+	};
+}
+//#endregion
+//#region src/signing/openfort-recovery.ts
+/**
+* Sign once; when Openfort reports the signer not ready, reset readiness, run
+* one fresh readiness cycle and sign again. A rejection by the person is never
+* retried, and a second not-ready answer is a named `signer-not-ready` failure.
+*/
+function recoveringSign(input) {
+	return async (hash) => {
+		try {
+			return await input.sign(hash);
+		} catch (cause) {
+			const providerErrorCode = openfortSignerNotReadyCode(cause);
+			const normalized = signerFailure("openfort-embedded", "signUserOpHash", cause);
+			if (normalized.code === "SIGNER_REJECTED" || providerErrorCode === void 0) throw normalized;
+			input.diagnostic?.trace("openfort.signerRecovery", {
+				outcome: "started",
+				attempt: 1,
+				failure_mode: "signer-not-ready"
+			});
+			input.resetReadiness();
+			try {
+				await input.ensureWalletReady();
+				const signature = await input.sign(hash);
+				input.diagnostic?.trace("openfort.signerRecovery", {
+					outcome: "succeeded",
+					attempt: 1,
+					failure_mode: "signer-not-ready"
+				});
+				return signature;
+			} catch (retryCause) {
+				const retryFailure = signerFailure("openfort-embedded", "signUserOpHash", retryCause);
+				if (retryFailure.code === "SIGNER_REJECTED") throw retryFailure;
+				if (isSignerNotReadySignal(retryCause)) input.markUnavailable();
+				input.diagnostic?.trace("openfort.signerRecovery", {
+					outcome: "failed",
+					attempt: 1,
+					failure_mode: isSignerNotReadySignal(retryCause) ? "signer-not-ready" : "unknown"
+				});
+				throw Errors.providerError("openfort", "signerRecovery", retryCause, {
+					failure_mode: "signer-not-ready",
+					details: {
+						provider_error_source: "openfort",
+						provider_error_code: providerErrorCode
+					}
+				});
+			}
+		}
+	};
+}
+//#endregion
+//#region src/signing/openfort-browser.ts
+function isolatedDiagnostic(diagnostic) {
+	if (diagnostic === void 0) return void 0;
+	return { trace: (scope, detail) => {
+		try {
+			Promise.resolve(diagnostic.trace(scope, detail)).catch(() => void 0);
+		} catch {}
+	} };
+}
+function createOpenfortBrowserSignerFromBootstrap(bootstrap, options = {}) {
+	const diagnostic = isolatedDiagnostic(options.diagnostic);
+	const authBaseUrl = normalizeBetterAuthBaseUrl(bootstrap.authBaseUrl);
+	let currentStatus = "unknown";
+	const statusListeners = /* @__PURE__ */ new Set();
+	function setStatus(next) {
+		if (currentStatus === next) return;
+		currentStatus = next;
+		for (const listener of statusListeners) try {
+			listener(next);
+		} catch {
+			statusListeners.delete(listener);
+			diagnostic?.trace("openfort.signerStatusListener", {
+				ok: false,
+				failure_mode: "unknown"
+			});
+		}
+	}
+	const statusStore = {
+		status: () => currentStatus,
+		subscribe: (listener) => {
+			statusListeners.add(listener);
+			return () => {
+				statusListeners.delete(listener);
+			};
+		}
+	};
+	const authProvider = bootstrap.openfortAuthProvider ?? "better-auth";
+	const clock = {
+		cycleStartedAt: null,
+		stepStartedAt: 0,
+		tokenCalls: 0
+	};
+	const credentials = makeOpenfortCredentials({
+		authProvider,
+		authBaseUrl,
+		auth: options.auth,
+		diagnostic,
+		clock
+	});
+	const openfort = new Openfort({
+		baseConfiguration: { publishableKey: bootstrap.openfortPublishableKey },
+		shieldConfiguration: { shieldPublishableKey: bootstrap.shieldPublishableKey },
+		thirdPartyAuth: {
+			provider: authProvider === "oidc" ? ThirdPartyOAuthProvider.OIDC : ThirdPartyOAuthProvider.BETTER_AUTH,
+			getAccessToken: credentials.fetchBetterAuthAccessToken
+		}
+	});
+	const startWalletReady = makeWalletReadyCycle({
+		openfort,
+		publishableKey: bootstrap.openfortPublishableKey,
+		diagnostic,
+		credentials,
+		clock
+	});
+	let walletReadyPromise = null;
+	async function ensureOpenfortWalletReady() {
+		let joined = walletReadyPromise;
+		if (joined === null) {
+			joined = startWalletReady();
+			walletReadyPromise = joined;
+			setStatus("recovering");
+		}
+		try {
+			await joined;
+			if (walletReadyPromise === joined) setStatus("ready");
+		} catch (cause) {
+			if (walletReadyPromise === joined) {
+				walletReadyPromise = null;
+				setStatus("unavailable");
+			}
+			throw cause;
+		}
+	}
+	const signer = openfortEmbeddedSignerFromWallet({
+		embeddedWallet: openfort.embeddedWallet,
+		ensureWalletReady: ensureOpenfortWalletReady
+	});
+	const controlledSign = options.signUserOpHash;
+	const signEmbeddedHash = controlledSign === void 0 ? (hash) => signer.signUserOpHash(hash) : (hash) => controlledSign(hash, (digest) => signer.signUserOpHash(digest));
+	const resetReadiness = () => {
+		walletReadyPromise = null;
+		clearStaleOpenfortBrowserStorage(bootstrap.openfortPublishableKey);
+		signer.resetAddressCache();
+		setStatus("unknown");
+	};
+	const signUserOpHash = recoveringSign({
+		sign: signEmbeddedHash,
+		resetReadiness,
+		ensureWalletReady: ensureOpenfortWalletReady,
+		markUnavailable: () => {
+			walletReadyPromise = null;
+			signer.resetAddressCache();
+			setStatus("unavailable");
+		},
+		diagnostic
+	});
+	return {
+		...signer,
+		signUserOpHash,
+		statusStore,
+		ensureWalletReady: ensureOpenfortWalletReady,
+		getAddress: async () => {
+			const addressStartedAt = Date.now();
+			try {
+				const address = await signer.getAddress();
+				diagnostic?.trace("openfort.address", {
+					ok: true,
+					duration_ms: Date.now() - addressStartedAt
+				});
+				return address;
+			} catch (cause) {
+				diagnostic?.trace("openfort.address", {
+					ok: false,
+					failure_mode: "unknown"
+				});
+				throw openfortProviderError("getAddress", cause);
+			}
+		},
+		resetSession: resetReadiness
+	};
+}
+/** Build the existing browser signer around host-owned authenticated callbacks. */
+function createOpenfortBrowserSigner(input) {
+	return createOpenfortBrowserSignerFromBootstrap(input.bootstrap, {
+		auth: input.auth,
+		...input.diagnostic === void 0 ? {} : { diagnostic: input.diagnostic }
+	});
+}
+function normalizeBetterAuthBaseUrl(raw) {
+	const trimmed = raw.replace(/\/$/, "");
+	return trimmed.endsWith("/api/auth") ? trimmed : `${trimmed}/api/auth`;
+}
+/**
+* Normalize a raw email for binding id + Safe salt derivation.
+* Delegates to {@link normalizeSafeSaltEmail} so binding resolution and
+* `deriveCapxulSafeAddress` never drift apart.
+*/
+function normalizeBindingEmail(email) {
+	return normalizeSafeSaltEmail(email);
+}
+//#endregion
+//#region src/signing/dev-signer.ts
+const SESSION_KEY = "capxul.session";
+/**
+* Chains a `local-private-key` signer may sign on. Base Sepolia only, and this
+* list does not grow without an ADR: the keys are deterministic throwaways
+* derived from a shared seed (see `deriveDevPrivateKey`), so anyone holding
+* the seed holds every account. A dev key on a value-bearing chain is a
+* custody incident, not a config mistake.
+*/
+const DEV_KEY_ALLOWED_CHAIN_IDS = [BASE_SEPOLIA_CHAIN_ID];
+/**
+* Testnet fence for the dev-key signing lane (#1149, folds #1065; ADR-0018 P9
+* human/Openfort vs agent/dev-key split). Call it wherever a signer first
+* meets a resolved chain; it refuses before the signer can be used.
+*
+* Only `local-private-key` signers are fenced — Openfort-embedded and injected
+* wallets carry their own custody and are the sanctioned human paths.
+*/
+function assertDevKeySignerIsTestnetOnly(signer, chainId) {
+	if (signer?.source !== "local-private-key") return {
+		ok: true,
+		value: void 0
+	};
+	if (DEV_KEY_ALLOWED_CHAIN_IDS.includes(chainId)) return {
+		ok: true,
+		value: void 0
+	};
+	return {
+		ok: false,
+		error: Errors.invalidInput("signer", `dev-key signer is testnet-only: chain ${chainId} is not allowed (expected ${DEV_KEY_ALLOWED_CHAIN_IDS.join(", ")})`)
+	};
+}
+/** Deterministic dev private key for an email under a seed. Exported for probes. */
+function deriveDevPrivateKey(seed, email) {
+	return keccak256(stringToHex(seed + normalizeBindingEmail(email)));
+}
+function readSessionEmail(storage) {
+	const resolved = storage ?? globalLocalStorage();
+	if (resolved === void 0) throw new Error("devPrivateKeySigner: no browser localStorage available and no explicit email supplied");
+	const raw = resolved.getItem(SESSION_KEY);
+	if (raw === null) throw new Error("devPrivateKeySigner: no cached session yet — sign in before the account lane uses the signer");
+	let session;
+	try {
+		session = JSON.parse(raw);
+	} catch {
+		throw new Error("devPrivateKeySigner: cached session is not valid JSON");
+	}
+	if (session === null) throw new Error("devPrivateKeySigner: cached session is not valid JSON");
+	const email = readField(session, "email");
+	if (typeof email !== "string" || email.length === 0) throw new Error("devPrivateKeySigner: cached session has no email");
+	return email;
+}
+/**
+* Browser-safe dev signer. Lazy: the email (and so the key) is resolved at
+* each `getAddress()` / `signUserOpHash()` from the cached session, so the
+* same signer instance follows whichever user is signed in.
+*/
+function devPrivateKeySigner(input) {
+	if (input.seed.trim().length === 0) throw new Error("devPrivateKeySigner: seed must be non-empty");
+	const accounts = /* @__PURE__ */ new Map();
+	const resolveAccount = () => {
+		const email = normalizeBindingEmail(input.email ?? readSessionEmail(input.storage));
+		const cached = accounts.get(email);
+		if (cached !== void 0) return cached;
+		const account = privateKeyToAccount(deriveDevPrivateKey(input.seed, email));
+		accounts.set(email, account);
+		return account;
+	};
+	return {
+		source: "local-private-key",
+		async getAddress() {
+			return toAddress(resolveAccount().address);
+		},
+		async signUserOpHash(hash) {
+			return resolveAccount().sign({ hash });
+		}
+	};
+}
+//#endregion
+//#region ../protocol/src/errors/convex-decoding.ts
+const KNOWN_CODES = new Set(CAPXUL_ERROR_CODES);
+function isCapxulCode(value) {
+	return typeof value === "string" && KNOWN_CODES.has(value);
+}
+/**
+* A serialized failure, rebuilt whole. Nothing that crossed is dropped: a code
+* this build does not know (a newer backend) becomes an explicit `UNKNOWN` that
+* names the code it received, and an unrecognized mode or chain shape is kept
+* raw in `details` instead of being guessed at or discarded.
+*/
+function reconstruct(serialized) {
+	if (typeof serialized.code !== "string") return null;
+	const unrecognized = {
+		...isCapxulCode(serialized.code) ? {} : { receivedCode: serialized.code },
+		...serialized.mode === void 0 || isFailureMode(serialized.mode) ? {} : { unrecognizedMode: serialized.mode }
+	};
+	const chain = serialized.chain === void 0 ? null : decodeChainCause(serialized.chain);
+	if (serialized.chain !== void 0 && chain === null) unrecognized.unrecognizedChain = serialized.chain;
+	const hasDetails = isRecord(serialized.details) || Object.keys(unrecognized).length > 0;
+	const cause = causeLinks(serialized.cause);
+	const payload = {
+		code: isCapxulCode(serialized.code) ? serialized.code : "UNKNOWN",
+		message: typeof serialized.message === "string" ? serialized.message : serialized.code,
+		...hasDetails ? { details: {
+			...isRecord(serialized.details) ? serialized.details : {},
+			...unrecognized
+		} } : {},
+		...typeof serialized.correlationId === "string" ? { correlationId: serialized.correlationId } : {},
+		...typeof serialized.layer === "string" ? { layer: serialized.layer } : {},
+		...isFailureMode(serialized.mode) ? { mode: serialized.mode } : {},
+		...chain === null ? {} : { chain },
+		...cause === void 0 ? {} : { cause }
+	};
+	return deserializeCapxulError(payload);
+}
+function causeLinks(value) {
+	if (!Array.isArray(value)) return void 0;
+	const links = value.filter((link) => isRecord(link) && typeof link.name === "string" && typeof link.message === "string");
+	return links.length === 0 ? void 0 : links;
+}
+function decodeConvexError(err) {
+	if (err === null || err === void 0) return null;
+	if (err instanceof CapxulError) return err;
+	if (typeof err !== "object") return null;
+	if (!("data" in err)) return null;
+	const data = err.data;
+	if (isRecord(data)) return reconstruct(data);
+	if (typeof data === "string") try {
+		const parsed = JSON.parse(data);
+		if (isRecord(parsed)) return reconstruct(parsed);
+	} catch {
+		return null;
+	}
+	return null;
+}
+//#endregion
+//#region src/applications/bootstrap-port.ts
+var BootstrapError = class extends Data.TaggedError("BootstrapError") {};
+function bootstrapErrorFromCapxul(kind, error) {
+	return new BootstrapError({
+		operation: "resolve",
+		kind,
+		publicCode: error.code,
+		cause: error,
+		...kind === "notAuthenticated" || error.details === void 0 ? {} : { details: error.details }
+	});
+}
+var BootstrapPortTag = class extends Context.Service()("@capxul/sdk/ports/BootstrapPort") {};
+//#endregion
+//#region ../protocol/src/access/value-schema.ts
+/**
+* `SessionToken` schema. Mirrors `toSessionToken`: non-empty string.
+* Issuance source distinguishes SDK-handshake tokens from auth-session
+* tokens; the brand itself is opaque.
+*/
+const SessionTokenSchema = Schema.String.pipe(Schema.refine((s) => s.length > 0, { message: "must be a non-empty string" }));
+//#endregion
+//#region ../protocol/src/access/bootstrap-schema.ts
+const PUBLIC_POSTHOG_PROJECT_TOKEN = /^phc_[A-Za-z0-9_-]{1,191}$/u;
+const PostHogIngestOrigin = Schema.String.pipe(Schema.refine((value) => {
+	try {
+		const url = new URL(value);
+		return url.protocol === "https:" && url.username.length === 0 && url.password.length === 0 && url.pathname === "/" && url.search.length === 0 && url.hash.length === 0 && (url.hostname === "posthog.com" || url.hostname.endsWith(".posthog.com"));
+	} catch {
+		return false;
+	}
+}, { message: "must be a credential-free PostHog HTTPS ingest origin" }));
+const EngineeringTelemetryBootstrapPolicy = Schema.Struct({
+	host: PostHogIngestOrigin,
+	projectToken: Schema.String.pipe(Schema.refine((value) => PUBLIC_POSTHOG_PROJECT_TOKEN.test(value), { message: "must be a public PostHog project token" })),
+	capxulEnv: Schema.Union([
+		Schema.Literal("development"),
+		Schema.Literal("staging"),
+		Schema.Literal("production"),
+		Schema.Literal("local")
+	])
+});
+/**
+* `BootstrapEnvelope` v1.
+*
+* - `protocol`: discriminator that lets future protocols coexist on the
+*   same endpoint without a wire-shape conflict.
+* - `version`: numeric version inside the protocol. Unknown versions MUST
+*   fail decode with an INVALID_INPUT-class `CapxulError` at the SDK seam.
+* - `state`: the resolved bootstrap payload. Field shape matches the
+*   `BootstrapResolution` port; the SDK consumer can pass `state`
+*   directly (after `normalizeRuntimeUrl` on the two URL fields) into
+*   the port without re-branding.
+*/
+const BootstrapEnvelope = Schema.Struct({
+	protocol: Schema.Literal("capxul.bootstrap"),
+	version: Schema.Literal(1),
+	state: Schema.Struct({
+		applicationId: AppIdSchema,
+		chainId: ChainIdSchema,
+		sessionToken: SessionTokenSchema,
+		issuedAt: EpochMsSchema,
+		expiresIn: DurationMsSchema,
+		authBaseUrl: Schema.String,
+		convexUrl: Schema.String,
+		siteBaseUrl: Schema.String,
+		openfortPublishableKey: Schema.String,
+		shieldPublishableKey: Schema.String,
+		/** Which Openfort third-party auth provider the signer presents; absent means better-auth. */
+		openfortAuthProvider: Schema.optional(Schema.Literals(["better-auth", "oidc"])),
+		/** Origin of the Ponder indexer the SDK reads directly; absent means no indexer reads. */
+		indexerUrl: Schema.optional(Schema.String),
+		engineeringTelemetry: Schema.optional(EngineeringTelemetryBootstrapPolicy)
+	})
+});
+//#endregion
+//#region src/applications/bootstrap-envelope.ts
+/**
+* Decode a bootstrap body. A body the envelope refuses throws INVALID_INPUT
+* (#119 AC1): unknown `version` literals, missing fields and brand-rule
+* failures all land there. The engineering telemetry policy decodes on its
+* own, so a policy the SDK does not admit turns SDK telemetry off instead of
+* failing the bootstrap.
+*/
+function decodeBootstrapBody(body) {
+	const state = readField(body, "state");
+	const rawEngineeringTelemetry = readField(state, "engineeringTelemetry");
+	const decoded = SchemaParser.decodeUnknownResult(BootstrapEnvelope)(isRecord(body) && isRecord(state) ? {
+		...body,
+		state: withoutPolicy(state)
+	} : body);
+	if (Result.isFailure(decoded)) throw Errors.invalidInput("bootstrapEnvelope", SchemaIssue.makeFormatterDefault()(decoded.failure));
+	const { state: decodedState } = decoded.success;
+	const decodedEngineeringTelemetry = rawEngineeringTelemetry === void 0 ? void 0 : SchemaParser.decodeUnknownResult(EngineeringTelemetryBootstrapPolicy)(rawEngineeringTelemetry, { onExcessProperty: "error" });
+	return {
+		applicationId: decodedState.applicationId,
+		chainId: decodedState.chainId,
+		sessionToken: decodedState.sessionToken,
+		issuedAt: decodedState.issuedAt,
+		expiresIn: decodedState.expiresIn,
+		authBaseUrl: normalizeRuntimeUrl("authBaseUrl", decodedState.authBaseUrl),
+		convexUrl: normalizeRuntimeUrl("convexUrl", decodedState.convexUrl),
+		siteBaseUrl: normalizeRuntimeUrl("siteBaseUrl", decodedState.siteBaseUrl),
+		openfortPublishableKey: decodedState.openfortPublishableKey,
+		shieldPublishableKey: decodedState.shieldPublishableKey,
+		...decodedState.openfortAuthProvider === void 0 ? {} : { openfortAuthProvider: decodedState.openfortAuthProvider },
+		...decodedState.indexerUrl === void 0 ? {} : { indexerUrl: decodedState.indexerUrl },
+		...engineeringTelemetryOf(decodedEngineeringTelemetry)
+	};
+}
+/** The bootstrap state without the policy, which decodes separately. */
+function withoutPolicy(state) {
+	const { engineeringTelemetry: _policy, ...rest } = state;
+	return rest;
+}
+/**
+* The engineering telemetry policy the backend sent. One it does not admit
+* leaves SDK telemetry off, and says so once with the decode issue.
+*/
+function engineeringTelemetryOf(decoded) {
+	if (decoded === void 0) return {};
+	if (Result.isSuccess(decoded)) return { engineeringTelemetry: decoded.success };
+	console.warn("[capxul-sdk] engineering telemetry policy refused; SDK telemetry is off", { issue: SchemaIssue.makeFormatterDefault()(decoded.failure) });
+	return {};
+}
+function normalizeRuntimeUrl(field, raw) {
+	let parsed;
+	try {
+		parsed = new URL(raw);
+	} catch {
+		throw Errors.invalidInput(field, "must be an http or https URL");
+	}
+	if (parsed.protocol !== "http:" && parsed.protocol !== "https:") throw Errors.invalidInput(field, "must be an http or https URL");
+	return parsed.toString().replace(/\/$/, "");
+}
+//#endregion
+//#region src/applications/bootstrap-adapter.ts
+/** A cached envelope this close to its expiry is fetched again, so it cannot lapse mid-command. */
+const CACHE_EXPIRY_MARGIN_MS = 3e4;
+/**
+* The cached envelope, when it is still inside its own lifetime. It is decoded
+* as a fresh body is; anything that does not decode, or a store that fails,
+* is a miss.
+*/
+async function cachedEnvelope(cache, now) {
+	try {
+		const cached = decodeBootstrapBody(await cache.load());
+		const expiresAt = cached.issuedAt + cached.expiresIn - CACHE_EXPIRY_MARGIN_MS;
+		return cached.issuedAt <= now && now < expiresAt ? cached : null;
+	} catch {
+		return null;
+	}
+}
+const DEFAULT_RETRY = {
+	attempts: 2,
+	baseDelayMs: 400
+};
+/** Request-side statuses a proxy or backend returns while momentarily unable to serve. */
+const TRANSIENT_HTTP_STATUSES = /* @__PURE__ */ new Set([
+	408,
+	425,
+	429
+]);
+/** Every 5xx is a server-side condition worth one more try; the client sent nothing wrong. */
+function isTransientHttpStatus(status) {
+	return status >= 500 || TRANSIENT_HTTP_STATUSES.has(status);
+}
+/**
+* A transient HTTP status is worth one more try. The bootstrap call crosses
+* the host's own proxy before it reaches Convex, and every observed failure
+* of that hop cleared on a retry seconds later. A network rejection (offline,
+* DNS, CORS) is not retried: it does not clear in a second, and the caller
+* surfaces it as `NETWORK_ERROR` at once. Auth and input rejections are
+* deterministic and never retried.
+*/
+function isTransientBootstrapFailure(error) {
+	if (error.kind !== "provider") return false;
+	const status = readField(error.details, "httpStatus");
+	return typeof status === "number" && isTransientHttpStatus(status);
+}
+async function safeText(res) {
+	try {
+		return await res.text();
+	} catch {
+		return "";
+	}
+}
+var HttpBootstrapAdapter = class {
+	bootstrapBaseUrl;
+	bootstrapHost;
+	fetchImpl;
+	observation;
+	retry;
+	cache;
+	constructor(deps) {
+		this.bootstrapBaseUrl = deps.bootstrapBaseUrl.replace(/\/$/, "");
+		this.bootstrapHost = hostOf(this.bootstrapBaseUrl);
+		this.observation = deps.observation;
+		this.retry = deps.retry ?? DEFAULT_RETRY;
+		this.cache = deps.cache;
+		this.fetchImpl = deps.fetch ?? ((input, init) => globalThis.fetch(input, init));
+	}
+	resolve(input) {
+		const fetched = this.attempt(input).pipe(Effect.retry({
+			times: this.retry.attempts,
+			while: isTransientBootstrapFailure,
+			schedule: Schedule.exponential(Duration.millis(this.retry.baseDelayMs))
+		}));
+		const cache = this.cache;
+		if (cache === void 0) return fetched;
+		return Effect.promise(() => cachedEnvelope(cache, Date.now())).pipe(Effect.filterOrElse((cached) => cached !== null, () => fetched));
+	}
+	attempt(input) {
+		return Effect.tryPromise({
+			try: () => {
+				const headers = {
+					"content-type": "application/json",
+					...input.origin === void 0 ? {} : { origin: input.origin },
+					...observationRequestHeaders(this.observation)
+				};
+				return this.fetchImpl(`${this.bootstrapBaseUrl}/v1/client/bootstrap`, {
+					method: "POST",
+					headers,
+					body: JSON.stringify({ publishableKey: input.publishableKey })
+				});
+			},
+			catch: (cause) => bootstrapErrorFromCapxul("network", Errors.networkError("bootstrap", cause, {
+				provider: "bootstrap",
+				failure_mode: "upstream-down",
+				...this.bootstrapHost === void 0 ? {} : { target_host: this.bootstrapHost }
+			}))
+		}).pipe(Effect.flatMap((res) => this.mapResponse(res, input)));
+	}
+	mapResponse(res, input) {
+		if (res.ok) return Effect.tryPromise({
+			try: async () => {
+				const body = await res.json();
+				const resolution = decodeBootstrapBody(body);
+				const cache = this.cache;
+				if (cache !== void 0) await Promise.resolve().then(() => cache.save(body)).catch(() => void 0);
+				return resolution;
+			},
+			catch: (cause) => {
+				if (cause instanceof CapxulError && cause.code === "INVALID_INPUT") return bootstrapErrorFromCapxul("invalidInput", cause);
+				return bootstrapErrorFromCapxul("malformedBody", Errors.providerError("convex", "bootstrap", cause instanceof Error ? cause : new Error(String(cause))));
+			}
+		});
+		return Effect.promise(() => safeText(res)).pipe(Effect.flatMap((body) => {
+			const refused = backendFailure$1(body);
+			if (refused !== null) return Effect.fail(bootstrapErrorFromCapxul(bootstrapKind(refused.code), refused));
+			const responseBody = body.slice(0, 300);
+			const edgeError = res.headers?.get?.("x-vercel-error") ?? void 0;
+			const edgeRequestId = res.headers?.get?.("x-vercel-id") ?? void 0;
+			const evidence = {
+				...responseBody.length === 0 ? {} : { responseBody },
+				...edgeError === void 0 ? {} : { edgeError },
+				...edgeRequestId === void 0 ? {} : { edgeRequestId }
+			};
+			if (res.status === 401) return Effect.fail(bootstrapErrorFromCapxul("notAuthenticated", keyRefused(input, evidence)));
+			return Effect.fail(bootstrapErrorFromCapxul("provider", Errors.providerError("convex", "bootstrap", /* @__PURE__ */ new Error(`HTTP ${res.status}${edgeError === void 0 ? "" : ` ${edgeError}`}`), {
+				httpStatus: res.status,
+				details: evidence
+			})));
+		}));
+	}
+};
+/** A JSON `SerializedCapxulError` body, decoded whole; anything else is not the backend's. */
+function backendFailure$1(body) {
+	try {
+		return decodeConvexError({ data: JSON.parse(body) });
+	} catch {
+		return null;
+	}
+}
+/**
+* A 401 the backend did not answer with its own refusal body (an older
+* backend answers `NOT_AUTHENTICATED: …` as text). The backend checks the
+* origin only when one is sent, so without one the key is what it refused.
+*/
+function keyRefused(input, evidence) {
+	return new CapxulError("NOT_AUTHENTICATED", input.origin === void 0 ? "The bootstrap refused the publishable key." : "The bootstrap refused the publishable key or its origin.", { details: {
+		...input.origin === void 0 ? {
+			field: "publishableKey",
+			reason: "unknown or revoked key"
+		} : {},
+		provider: "bootstrap",
+		httpStatus: 401,
+		...evidence
+	} });
+}
+function bootstrapKind(code) {
+	if (code === "NOT_AUTHENTICATED") return "notAuthenticated";
+	if (code === "INVALID_INPUT") return "invalidInput";
+	if (code === "RATE_LIMITED") return "rateLimited";
+	return "provider";
+}
+function HttpBootstrapLayer(deps) {
+	return Layer.succeed(BootstrapPortTag, new HttpBootstrapAdapter(deps));
+}
+function hostOf(url) {
+	try {
+		return new URL(url).hostname;
+	} catch {
+		return;
+	}
+}
+//#endregion
+//#region src/profiles/port.ts
+/** The chain families a payout address may name (#1955). */
+const PAYOUT_CHAINS = [
+	"evm",
+	"solana",
+	"starknet"
+];
+var IdentityError = class extends Data.TaggedError("IdentityError") {};
+function identityErrorFromCapxul(operation, error, cause = error) {
+	return new IdentityError({
+		operation,
+		publicCode: error.code,
+		publicError: error,
+		cause,
+		...error.details === void 0 ? {} : { details: error.details }
+	});
+}
+var IdentityPortTag = class extends Context.Service()("@capxul/sdk/ports/IdentityPort") {};
+//#endregion
+//#region src/profiles/adapter.ts
+var ConvexIdentityAdapter = class {
+	#convex;
+	constructor(deps) {
+		this.#convex = deps.convex;
+	}
+	loadByAuthUserId = (authUserId) => this.#call(details.get, { authUserId }, (view) => view === null ? null : brandProfile(view));
+	create = (input) => this.#call(details.create, input, brandProfile);
+	update = (input) => this.#call(details.update, input, brandProfile);
+	completeOnboarding = (input) => this.#call(onboardings.complete, input, brandProfile);
+	/** One row call: its failure as an IdentityError named by the row, its reply branded. */
+	#call(row, args, brand) {
+		return callOperation(this.#convex, row, args).pipe(Effect.mapError((error) => identityErrorFromCapxul(row.name, error)), Effect.flatMap((output) => Effect.try({
+			try: () => brand(output),
+			catch: (cause) => identityErrorFromUnknown(row.name, cause)
+		})), Effect.catchDefect((cause) => Effect.fail(identityErrorFromUnknown(row.name, cause))));
+	}
+};
+const ConvexIdentityLayer = Layer.effect(IdentityPortTag, Effect.map(ConvexCallPortTag, (convex) => new ConvexIdentityAdapter({ convex })));
+function brandProfile(view) {
+	return {
+		authUserId: toAuthUserId(view.authUserId),
+		...view.testerKind === void 0 ? {} : { testerKind: toTesterKind(view.testerKind) },
+		email: toEmail(view.email),
+		displayName: view.displayName,
+		country: view.country === null ? null : toCountryCode(view.country),
+		onboarded: view.onboarded,
+		withdrawalAddress: view.withdrawalAddress === null ? null : toAddress(view.withdrawalAddress),
+		handle: view.handle === null ? null : toHandle(view.handle),
+		imageUrl: view.imageUrl,
+		kycTier: toKycTier(view.kycTier),
+		createdAt: toEpochMs(view.createdAt),
+		updatedAt: toEpochMs(view.updatedAt)
+	};
+}
+/** A branding refusal keeps its code; anything else is a defect, never a provider failure. */
+function identityErrorFromUnknown(operation, cause) {
+	if (cause instanceof CapxulError) return identityErrorFromCapxul(operation, cause);
+	return identityErrorFromCapxul(operation, Errors.unknown(cause), cause);
+}
+//#endregion
+//#region src/profiles/programs.ts
+/** The single Context tag the profile atom + `identity.loadCurrent` resolve. */
+var IdentityDepsTag = class extends Context.Service()("@capxul/sdk/IdentityDeps") {};
+/** Wrap a bundle as the `Context<IdentityDepsTag>` the React provider consumes. */
+function identityDepsContext(deps) {
+	return Context.make(IdentityDepsTag, deps);
+}
+/**
+* `identity.loadCurrent` as a single Effect requiring ONLY `IdentityDepsTag`.
+* Faithful transcription of the current public method body (`identity.ts`):
+* the leading `signal.aborted` pre-check stays in the thin method wrapper;
+* the program snapshots the actor session, then narrows the `IdentityPort`
+* failure to its `publicError`. Defects/sync-throws surface as `UNKNOWN`
+* through `toCapxulResult`'s `catchAllDefect` (and the atom's runtime), which
+* replaces the old outer `try/catch`.
+*/
+const loadIdentityProgram = Effect.gen(function* () {
+	const deps = yield* IdentityDepsTag;
+	if (deps.actor === void 0) return yield* Effect.fail(Errors.notAuthenticated());
+	const state = deps.actor.snapshot();
+	if (state.phase === "faulted") return yield* Effect.fail(publicIdentityFailure(state.failure));
+	const authUserId = sessionFromActor(deps.actor)?.authUserId;
+	if (authUserId === void 0) return null;
+	return yield* deps.identityPort.loadByAuthUserId(authUserId).pipe(Effect.catchDefect((cause) => Effect.fail(identityErrorFromCapxul("loadByAuthUserId", asCapxulError(cause), cause))), Effect.mapError((failure) => failure.publicError));
+});
+/**
+* THE ONE boundary grammar for those optional fields. Both `completeProfile`
+* entry points — the method bundle here and the identity runtime in
+* `create-capxul-client.ts` — run it, so a malformed value is refused the same
+* way at each and never reaches the port.
+*/
+function checkProfileCarriage(profile) {
+	const carriage = {};
+	if (profile.imageStorageId !== void 0) {
+		if (typeof profile.imageStorageId !== "string" || profile.imageStorageId.trim().length === 0) return {
+			ok: false,
+			field: "imageStorageId",
+			message: "must be a non-empty storage id"
+		};
+		carriage.imageStorageId = profile.imageStorageId.trim();
+	}
+	if (profile.payoutAddresses !== void 0) {
+		if (!Array.isArray(profile.payoutAddresses)) return {
+			ok: false,
+			field: "payoutAddresses",
+			message: "must be an array"
+		};
+		if (profile.payoutAddresses.length > 10) return {
+			ok: false,
+			field: "payoutAddresses",
+			message: `must carry at most 10 addresses`
+		};
+		const entries = [];
+		for (const entry of profile.payoutAddresses) {
+			if (typeof entry !== "object" || entry === null || !PAYOUT_CHAINS.some((chain) => chain === entry.chain) || typeof entry.address !== "string" || entry.address.trim().length === 0) return {
+				ok: false,
+				field: "payoutAddresses",
+				message: `each entry needs a chain of ${PAYOUT_CHAINS.join(", ")} and an address`
+			};
+			entries.push({
+				chain: entry.chain,
+				address: entry.address.trim()
+			});
+		}
+		carriage.payoutAddresses = entries;
+	}
+	return {
+		ok: true,
+		carriage
+	};
+}
+function makeIdentityMethods(deps) {
+	const convexCall = deps.convexCall;
+	return {
+		async loadCurrent(options) {
+			if (options?.signal?.aborted) return {
+				ok: false,
+				error: Errors.cancelled({ operation: CAPXUL_OPERATIONS.identity.loadCurrent })
+			};
+			return toCapxulResult(loadIdentityProgram, identityDepsContext(deps), deps.runPromise);
+		},
+		async completeProfile(profile, options) {
+			if (options?.signal?.aborted) return {
+				ok: false,
+				error: Errors.cancelled({ operation: onboardings.complete.name })
+			};
+			if (typeof profile !== "object" || profile === null || typeof profile.displayName !== "string" || typeof profile.country !== "string" || typeof profile.handle !== "string") return {
+				ok: false,
+				error: Errors.invalidInput("profile", "invalid profile")
+			};
+			const displayName = profile.displayName.trim();
+			const handle = profile.handle.trim();
+			if (displayName.length === 0) return {
+				ok: false,
+				error: Errors.invalidInput("displayName", "must not be empty")
+			};
+			if (handle.length === 0) return {
+				ok: false,
+				error: Errors.invalidInput("handle", "must not be empty")
+			};
+			let country;
+			try {
+				country = toCountryCode(profile.country);
+			} catch {
+				return {
+					ok: false,
+					error: Errors.invalidInput("country", "unsupported country")
+				};
+			}
+			const carried = checkProfileCarriage(profile);
+			if (!carried.ok) return {
+				ok: false,
+				error: Errors.invalidInput(carried.field, carried.message)
+			};
+			const session = deps.actor?.authSession();
+			if (session === void 0 || session === null) return {
+				ok: false,
+				error: Errors.notAuthenticated()
+			};
+			return runPortEffect(deps.identityPort.completeOnboarding({
+				authUserId: session.authUserId,
+				email: session.email,
+				displayName,
+				country,
+				handle,
+				...carried.carriage
+			}), options, onboardings.complete.name, deps.runPromise);
+		},
+		async handleAvailable(handle, options) {
+			const row = details.handleAvailable;
+			if (options?.signal?.aborted) return {
+				ok: false,
+				error: Errors.cancelled({ operation: row.name })
+			};
+			if (convexCall === void 0) return {
+				ok: false,
+				error: Errors.notImplemented("identity", "handleAvailable")
+			};
+			return runCapxulEffect(callOperation(convexCall, row, { handle }), options, row.name, deps.runPromise);
+		}
+	};
+}
+//#endregion
+//#region src/profiles/person-onboarding.ts
+function normalizeHandleInput(input) {
+	if (typeof input !== "string") return {
+		ok: false,
+		error: Errors.invalidInput("handle", "is required")
+	};
+	try {
+		return {
+			ok: true,
+			value: validateHandle(input)
+		};
+	} catch (error) {
+		return failed(error);
+	}
+}
+function isClaimedIdentityState(state) {
+	return state.phase === "authenticated" && state.account.at === "claimed";
+}
+function accountInFlight(state) {
+	return state.phase === "authenticated" && (state.account.at === "deriving" || state.account.at === "claiming");
+}
+function settledAccount(deps, options) {
+	return new Promise((resolve) => {
+		let done = false;
+		let unsubscribe = null;
+		const onAbort = () => finish({
+			ok: false,
+			error: Errors.cancelled({ operation: CAPXUL_OPERATIONS.onboarding.completeOrganization })
+		});
+		const finish = (result) => {
+			if (done) return;
+			done = true;
+			unsubscribe?.();
+			options?.signal?.removeEventListener("abort", onAbort);
+			resolve(result);
+		};
+		if (options?.signal?.aborted) {
+			onAbort();
+			return;
+		}
+		options?.signal?.addEventListener("abort", onAbort, { once: true });
+		const stop = deps.subscribeIdentity((state) => {
+			if (!accountInFlight(state)) finish({
+				ok: true,
+				value: state
+			});
+		});
+		if (done) {
+			stop();
+			return;
+		}
+		unsubscribe = stop;
+		const current = deps.snapshotIdentity();
+		if (!accountInFlight(current)) finish({
+			ok: true,
+			value: current
+		});
+	});
+}
+async function reachClaimedAccount(deps, options) {
+	let state = deps.snapshotIdentity();
+	if (accountInFlight(state)) {
+		const settled = await settledAccount(deps, options);
+		if (!settled.ok) return settled;
+		state = settled.value;
+	}
+	if (state.phase !== "authenticated" || state.account.at === "unknown") {
+		const ensured = await deps.sendIdentity({ _tag: "EnsureAccount" }, options);
+		if (!ensured.ok) return ensured;
+		state = ensured.value;
+	}
+	if (state.phase !== "authenticated") return organizationWrongState(state.phase, ["authenticated:claimed"]);
+	if (accountInFlight(state)) {
+		const settled = await settledAccount(deps, options);
+		if (!settled.ok) return settled;
+		state = settled.value;
+		if (state.phase !== "authenticated") return organizationWrongState(state.phase, ["authenticated:claimed"]);
+	}
+	if (state.account.at !== "claimed") {
+		const event = state.account.at === "failed" ? { _tag: "RetryAccount" } : state.account.at === "counterfactual" ? { _tag: "ClaimAccount" } : { _tag: "EnsureAccount" };
+		const claimed = await deps.sendIdentity(event, options);
+		if (!claimed.ok) return claimed;
+		state = claimed.value;
+	}
+	return isClaimedIdentityState(state) ? {
+		ok: true,
+		value: state
+	} : organizationWrongState(state.phase === "authenticated" ? state.account.at : state.phase, ["claimed"]);
+}
+const cancelledPerson = () => ({
+	ok: false,
+	error: Errors.cancelled({ operation: CAPXUL_OPERATIONS.onboarding.completePerson })
+});
+const joinPerson = (pending, signal) => {
+	if (signal === void 0) return pending;
+	if (signal.aborted) return Promise.resolve(cancelledPerson());
+	return new Promise((resolve) => {
+		let done = false;
+		const onAbort = () => finish(cancelledPerson());
+		const finish = (result) => {
+			if (done) return;
+			done = true;
+			signal.removeEventListener("abort", onAbort);
+			resolve(result);
+		};
+		signal.addEventListener("abort", onAbort, { once: true });
+		if (signal.aborted) onAbort();
+		pending.then(finish, (cause) => finish(failed(cause)));
+	});
+};
+const waitForRestoreReady = (ready, signal) => {
+	if (signal === void 0) return ready.then(() => true);
+	if (signal.aborted) return Promise.resolve(false);
+	return new Promise((resolve) => {
+		let done = false;
+		const onAbort = () => finish(false);
+		const finish = (value) => {
+			if (done) return;
+			done = true;
+			signal.removeEventListener("abort", onAbort);
+			resolve(value);
+		};
+		signal.addEventListener("abort", onAbort, { once: true });
+		if (signal.aborted) onAbort();
+		ready.then(() => finish(true), () => finish(false));
+	});
+};
+const samePersonInput = (left, right) => {
+	if (left.displayName !== right.displayName || left.country !== right.country || left.imageStorageId !== right.imageStorageId) return false;
+	const a = left.payoutAddresses;
+	const b = right.payoutAddresses;
+	if (a === void 0 || b === void 0) return a === b;
+	if (!Array.isArray(a) || !Array.isArray(b) || a.length !== b.length) return false;
+	return a.every((address, index) => address?.chain === b[index]?.chain && address?.address === b[index]?.address);
+};
+//#endregion
+//#region src/profiles/organization-onboarding.ts
+function normalizeOrganization(input) {
+	if (typeof input !== "object" || input === null) return {
+		ok: false,
+		error: Errors.invalidInput("organization", "is required")
+	};
+	const name = typeof input.name === "string" ? input.name.trim() : "";
+	if (name.length === 0) return {
+		ok: false,
+		error: Errors.invalidInput("name", "is required")
+	};
+	const handle = normalizeHandleInput(input.handle);
+	if (!handle.ok) return handle;
+	if (input.bio !== void 0 && typeof input.bio !== "string") return {
+		ok: false,
+		error: Errors.invalidInput("bio", "must be text")
+	};
+	if (input.size !== void 0 && typeof input.size !== "string") return {
+		ok: false,
+		error: Errors.invalidInput("size", "must be text")
+	};
+	if (input.logoStorageId !== void 0 && typeof input.logoStorageId !== "string") return {
+		ok: false,
+		error: Errors.invalidInput("logoStorageId", "must be a storage ID")
+	};
+	let country;
+	try {
+		country = toCountryCode(input.country);
+	} catch {
+		return {
+			ok: false,
+			error: Errors.invalidInput("country", "must be an ISO country code")
+		};
+	}
+	const bio = input.bio?.trim() ?? "";
+	const size = input.size?.trim() ?? "";
+	return {
+		ok: true,
+		value: {
+			name,
+			handle: handle.value,
+			country,
+			...bio.length === 0 ? {} : { bio },
+			...size.length === 0 ? {} : { size },
+			...input.logoStorageId === void 0 ? {} : { logoStorageId: input.logoStorageId }
+		}
+	};
+}
+function organizationWrongState(currentState, validStates, organizationId) {
+	return {
+		ok: false,
+		error: Errors.wrongState({
+			method: CAPXUL_OPERATIONS.onboarding.completeOrganization,
+			currentState,
+			validStates: [...validStates],
+			...organizationId === void 0 ? {} : { organizationId }
+		})
+	};
+}
+function requestCancelled(options) {
+	return options?.signal?.aborted === true;
+}
+async function beginOrganization(deps, input, options) {
+	const normalized = normalizeOrganization(input);
+	if (!normalized.ok) return normalized;
+	const setup = deps.organizationSetup;
+	if (setup === void 0) return {
+		ok: false,
+		error: Errors.notImplemented("organizationSetup", "begin")
+	};
+	const captured = deps.authLifetime();
+	try {
+		const session = await deps.restoreSession(options);
+		if (!session.ok) return session;
+		if (session.value === null) return {
+			ok: false,
+			error: Errors.notAuthenticated()
+		};
+		const authUserId = String(session.value.authUserId);
+		const current = () => deps.matchesAuthLifetime(captured, authUserId) && !requestCancelled(options);
+		if (!current()) return cancelledOrganization();
+		const profile = await deps.loadProfile(options);
+		if (!current()) return cancelledOrganization();
+		if (!profile.ok) return profile;
+		if (profile.value?.displayName === null || profile.value?.handle === null || profile.value === null) return organizationWrongState("profile-incomplete", ["profile-complete"]);
+		const refreshed = await deps.refreshIdentity(options);
+		if (!current()) return cancelledOrganization();
+		if (!refreshed.ok) return refreshed;
+		const claimed = await reachClaimedAccount(deps, options);
+		if (!current()) return cancelledOrganization();
+		if (!claimed.ok) return claimed;
+		const begun = await setup.begin(normalized.value);
+		if (!current()) return cancelledOrganization();
+		if (begun.ok) {
+			await deps.sendIdentity({
+				_tag: "AttachOrganization",
+				orgId: String(begun.value.orgId)
+			}, options);
+			if (!current()) return cancelledOrganization();
+		}
+		return begun;
+	} catch (cause) {
+		return failed(cause);
+	}
+}
+function setupFailure(setup) {
+	const issue = setup.issue;
+	const details = {
+		...issue?.error?.details,
+		organizationId: String(setup.orgId),
+		...issue !== null && { setupReason: issue.reason }
+	};
+	if (issue?.error !== void 0) {
+		const error = issue.error;
+		return new CapxulError(error.code, error.message, {
+			details,
+			...error.mode === void 0 ? {} : { mode: error.mode },
+			...error.chain === void 0 ? {} : { chain: error.chain },
+			...error.layer === void 0 ? {} : { layer: error.layer },
+			...error.correlationId === void 0 ? {} : { correlationId: error.correlationId }
+		});
+	}
+	const fallback = Errors.wrongState({
+		method: CAPXUL_OPERATIONS.onboarding.completeOrganization,
+		currentState: setup.status,
+		validStates: ["ready"],
+		organizationId: String(setup.orgId)
+	});
+	return new CapxulError(fallback.code, fallback.message, { details: {
+		...fallback.details,
+		...details
+	} });
+}
+const cancelledOrganization = () => ({
+	ok: false,
+	error: Errors.cancelled({ operation: CAPXUL_OPERATIONS.onboarding.completeOrganization })
+});
+function awaitReady(deps, orgId, options) {
+	const setup = deps.organizationSetup;
+	if (setup === void 0) return Promise.resolve({
+		ok: false,
+		error: Errors.notImplemented("organizationSetup", "subscribe")
+	});
+	const lifetime = deps.authLifetime();
+	const isCurrent = () => deps.matchesAuthLifetime(lifetime, lifetime.authUserId);
+	return new Promise((resolve) => {
+		let done = false;
+		let stopRemote = null;
+		let stopIdentity = null;
+		const finish = (result) => {
+			if (done) return;
+			done = true;
+			stopRemote?.();
+			stopIdentity?.();
+			options?.signal?.removeEventListener("abort", onAbort);
+			resolve(result);
+		};
+		const onAbort = () => finish(cancelledOrganization());
+		options?.signal?.addEventListener("abort", onAbort, { once: true });
+		const releaseIdentity = deps.subscribeIdentity((state) => {
+			if (state.phase !== "authenticated" || !deps.matchesAuthLifetime(lifetime, state.session.authUserId)) finish(cancelledOrganization());
+		});
+		if (done) releaseIdentity();
+		else stopIdentity = releaseIdentity;
+		if (options?.signal?.aborted || !isCurrent()) return onAbort();
+		setup.subscribe(orgId, (snapshot) => {
+			if (done) return;
+			if (!isCurrent()) return finish(cancelledOrganization());
+			if (snapshot.status === "loading") return;
+			if (snapshot.status === "error") return finish({
+				ok: false,
+				error: snapshot.error
+			});
+			if (snapshot.value.status === "ready") return finish({
+				ok: true,
+				value: { organizationId: orgId }
+			});
+			if (snapshot.value.status === "needsAttention" || snapshot.value.status === "failed") finish({
+				ok: false,
+				error: setupFailure(snapshot.value)
+			});
+		}, options).then((result) => {
+			if (!result.ok) return finish(result);
+			if (done) result.value();
+			else stopRemote = result.value;
+		}).catch((cause) => finish(failed(cause)));
+	});
+}
+//#endregion
+//#region src/profiles/onboardings.ts
+/** A thrown failure as a result: a CapxulError keeps its code; anything else is a defect. */
+function failed(cause) {
+	return {
+		ok: false,
+		error: isCapxulError(cause) ? cause : Errors.unknown(cause)
+	};
+}
+function makeOnboardingMethods(deps) {
+	let personFlight = null;
+	return {
+		async listOrganizationSetups(input, options) {
+			if (requestCancelled(options)) return cancelledOrganization();
+			if (deps.organizationSetup === void 0) return {
+				ok: false,
+				error: Errors.notImplemented("organizationSetup", "listMine")
+			};
+			const lifetime = deps.authLifetime();
+			const session = await deps.restoreSession(options);
+			if (!session.ok) return session;
+			if (session.value === null) return {
+				ok: false,
+				error: Errors.notAuthenticated()
+			};
+			if (!deps.matchesAuthLifetime(lifetime, String(session.value.authUserId)) || requestCancelled(options)) return cancelledOrganization();
+			const listed = await deps.organizationSetup.listMine(input, options);
+			return deps.matchesAuthLifetime(lifetime, String(session.value.authUserId)) && !requestCancelled(options) ? listed : cancelledOrganization();
+		},
+		async completePerson(input, options) {
+			if (options?.signal?.aborted) return cancelledPerson();
+			if (typeof input !== "object" || input === null || typeof input.displayName !== "string" || typeof input.country !== "string") return {
+				ok: false,
+				error: Errors.invalidInput("profile", "displayName and country are required")
+			};
+			const handle = normalizeHandleInput(input.handle);
+			if (!handle.ok) return handle;
+			const entryAuthority = deps.authLifetime();
+			if (personFlight !== null && personFlight.generation === entryAuthority.generation) {
+				if (personFlight.handle !== handle.value || !samePersonInput(personFlight.input, input)) return {
+					ok: false,
+					error: Errors.wrongState({
+						method: CAPXUL_OPERATIONS.onboarding.completePerson,
+						currentState: "settingUp",
+						validStates: ["ready"]
+					})
+				};
+				const held = personFlight;
+				if (!await waitForRestoreReady(held.ready, options?.signal)) return cancelledPerson();
+				const verified = await deps.restoreSession(options);
+				if (!verified.ok) return verified;
+				if (verified.value === null) return {
+					ok: false,
+					error: Errors.notAuthenticated()
+				};
+				if (held.authUserId() === String(verified.value.authUserId) && deps.matchesAuthLifetime({
+					generation: held.generation,
+					authUserId: held.authUserId()
+				}, held.authUserId())) {
+					const result = await joinPerson(held.pending, options?.signal);
+					return deps.matchesAuthLifetime({
+						generation: held.generation,
+						authUserId: held.authUserId()
+					}, held.authUserId()) ? result : cancelledPerson();
+				}
+			}
+			let ownerAuthUserId = null;
+			let readyReported = false;
+			let markReady;
+			const ready = new Promise((resolve) => {
+				markReady = resolve;
+			});
+			const pending = (async () => {
+				try {
+					const isCancelled = () => options?.signal?.aborted === true;
+					const session = await deps.restoreSession(options);
+					if (!session.ok) return session;
+					if (session.value === null) return {
+						ok: false,
+						error: Errors.notAuthenticated()
+					};
+					ownerAuthUserId = String(session.value.authUserId);
+					readyReported = true;
+					markReady();
+					const isCurrent = () => {
+						return deps.matchesAuthLifetime(entryAuthority, ownerAuthUserId);
+					};
+					if (!isCurrent()) return cancelledPerson();
+					const available = await deps.handleAvailable(handle.value, options);
+					if (!isCurrent()) return cancelledPerson();
+					if (!available.ok) return available;
+					if (!available.value.available) return {
+						ok: false,
+						error: Errors.invalidInput("handle", "handle is already taken")
+					};
+					if (!isCurrent()) return cancelledPerson();
+					const completed = await deps.completeProfile({
+						...input,
+						handle: available.value.normalized
+					}, options);
+					if (!isCurrent()) return cancelledPerson();
+					if (!completed.ok) return completed;
+					const refreshed = await deps.refreshIdentity(options);
+					if (!isCurrent()) return cancelledPerson();
+					if (!refreshed.ok) return refreshed;
+					if (isCancelled()) return {
+						ok: false,
+						error: Errors.cancelled({ operation: CAPXUL_OPERATIONS.onboarding.completePerson })
+					};
+					if (!isCurrent()) return cancelledPerson();
+					const ensured = await deps.ensureAccount(options);
+					if (!isCurrent()) return cancelledPerson();
+					if (!ensured.ok) return ensured;
+					if (isCancelled()) return {
+						ok: false,
+						error: Errors.cancelled({ operation: CAPXUL_OPERATIONS.onboarding.completePerson })
+					};
+					const lifecycle = await deps.getLifecycle();
+					if (!isCurrent()) return cancelledPerson();
+					if (!lifecycle.ok) return lifecycle;
+					if (isCancelled()) return {
+						ok: false,
+						error: Errors.cancelled({ operation: CAPXUL_OPERATIONS.onboarding.completePerson })
+					};
+					if (lifecycle.value.status !== "ready") return {
+						ok: false,
+						error: Errors.wrongState({
+							method: CAPXUL_OPERATIONS.onboarding.completePerson,
+							currentState: lifecycle.value.status,
+							validStates: ["ready"]
+						})
+					};
+					const profile = await deps.loadProfile(options);
+					if (!isCurrent()) return cancelledPerson();
+					if (!profile.ok) return profile;
+					if (profile.value === null || profile.value.displayName === null || profile.value.handle !== available.value.normalized) return {
+						ok: false,
+						error: Errors.wrongState({
+							method: CAPXUL_OPERATIONS.onboarding.completePerson,
+							currentState: "profile-incomplete",
+							validStates: ["profile-complete"]
+						})
+					};
+					if (!isCurrent()) return cancelledPerson();
+					return {
+						ok: true,
+						value: {
+							profile: {
+								...profile.value,
+								displayName: profile.value.displayName,
+								handle: profile.value.handle
+							},
+							account: lifecycle.value
+						}
+					};
+				} finally {
+					if (!readyReported) markReady();
+				}
+			})();
+			personFlight = {
+				input,
+				handle: handle.value,
+				generation: entryAuthority.generation,
+				ready,
+				authUserId: () => ownerAuthUserId,
+				pending
+			};
+			try {
+				return await pending;
+			} finally {
+				if (personFlight?.pending === pending) personFlight = null;
+			}
+		},
+		beginOrganization(input, options) {
+			return beginOrganization(deps, input, options);
+		},
+		async completeOrganization(input, options) {
+			try {
+				const begun = await beginOrganization(deps, input, options);
+				if (!begun.ok) return begun;
+				const lifetime = deps.authLifetime();
+				const isCurrent = () => deps.matchesAuthLifetime(lifetime, lifetime.authUserId);
+				if (!isCurrent()) return cancelledOrganization();
+				const { orgId } = begun.value;
+				let setup = begun.value.setup;
+				if (setup.status === "awaitingAuthorization") {
+					const authorized = await deps.organizationSetup.authorize(orgId, options);
+					if (!isCurrent()) return cancelledOrganization();
+					if (!authorized.ok) return authorized;
+					setup = authorized.value;
+				}
+				if (requestCancelled(options) || !isCurrent()) return cancelledOrganization();
+				if (setup.status === "ready") return {
+					ok: true,
+					value: { organizationId: orgId }
+				};
+				if (setup.status === "needsAttention" || setup.status === "failed") return {
+					ok: false,
+					error: setupFailure(setup)
+				};
+				return awaitReady(deps, orgId, options);
+			} catch (cause) {
+				return failed(cause);
+			}
+		}
+	};
+}
+//#endregion
+//#region src/platform/production-sessions.ts
+function resolveProductionObservability(input) {
+	const observation = input.observability?.failures ?? input.observation;
+	const telemetry = input.observability?.product ?? input.telemetry;
+	const invocationObservability = input.invocationObservability;
+	return {
+		observation,
+		telemetry,
+		invocationObservation: invocationObservability?.failures ?? observation,
+		invocationTelemetry: invocationObservability?.product ?? telemetry
+	};
+}
+function hasConnectionObserver(port) {
+	return "observeConnection" in port && typeof port.observeConnection === "function";
+}
+function observeProductionConvexConnection(convexCall, context) {
+	if (!hasConnectionObserver(convexCall)) return () => {};
+	const runPromise = Effect.runPromiseWith(context);
+	try {
+		return convexCall.observeConnection((diagnostic) => {
+			const message = diagnostic.transition === "connected" ? Effect.logInfo("convex.connection.changed") : Effect.logWarning("convex.connection.changed");
+			runPromise(message.pipe(Effect.annotateLogs(diagnostic), Effect.ignoreCause)).catch(() => void 0);
+		});
+	} catch {
+		return () => {};
+	}
+}
+function refreshConvexAuthOnSession(authClient, refresh) {
+	return {
+		...authClient,
+		verifyOtp: (input, options) => authClient.verifyOtp(input, options).pipe(Effect.tap(() => Effect.sync(refresh))),
+		signOut: (options) => authClient.signOut(options).pipe(Effect.tap(() => Effect.sync(refresh)))
+	};
+}
+/**
+* Signer-session reset, as a port wrapper INSIDE the Layer graph (blueprint §2:
+* "wrappers become Layers, not post-hoc spreads/Proxies").
+*
+* This was a spread over the assembled client — `{...client, auth: {...,
+* signOut}}` — applied after composition finished, so the reset lived on one
+* particular object rather than on the auth seam itself. Here it wraps
+* `AuthClientPort.signOut`, so it holds for every route to a sign-out.
+*
+* Capture the sign-out exit before reset. This preserves the old `try/finally`
+* order and keeps a reset failure in the typed error channel.
+*/
+function resetSignerSessionOnSignOut(authClient, resetRef) {
+	return {
+		...authClient,
+		signOut: (options) => Effect.gen(function* () {
+			const exit = yield* Effect.exit(authClient.signOut(options));
+			yield* Effect.try({
+				try: () => resetRef.current?.(),
+				catch: (cause) => new AuthClientError({
+					operation: "signOut",
+					kind: "signer",
+					cause
+				})
+			});
+			return yield* exit;
+		})
+	};
+}
+//#endregion
+//#region src/platform/transport/browser-lifecycle.ts
+var BrowserLifecycleMonitor = class {
+	#listeners = [];
+	#last = {};
+	constructor() {
+		const windowTarget = eventTarget(globalThis.window);
+		const documentTarget = eventTarget(globalThis.document);
+		if (windowTarget === void 0 || documentTarget === void 0) return;
+		this.#listen(documentTarget, "visibilitychange", () => {
+			this.#record(globalThis.document?.visibilityState === "hidden" ? "visibility-hidden" : "visibility-visible");
+		});
+		this.#listen(windowTarget, "pagehide", () => this.#record("pagehide"));
+		this.#listen(windowTarget, "pageshow", () => this.#record("pageshow"));
+		this.#listen(windowTarget, "online", () => this.#record("online"));
+		this.#listen(windowTarget, "offline", () => this.#record("offline"));
+	}
+	socketClose(event) {
+		const now = Date.now();
+		return {
+			code: event.code,
+			wasClean: event.wasClean,
+			reasonPresent: event.reason.length > 0,
+			...this.#last.event === void 0 ? {} : { browserEvent: this.#last.event },
+			...this.#last.at === void 0 ? {} : { msSinceBrowserEvent: Math.max(0, now - this.#last.at) },
+			...globalThis.document?.visibilityState === void 0 ? {} : { documentVisibility: globalThis.document.visibilityState },
+			...globalThis.navigator?.onLine === void 0 ? {} : { navigatorOnline: globalThis.navigator.onLine }
+		};
+	}
+	close() {
+		for (const [target, name, listener] of this.#listeners) target.removeEventListener(name, listener);
+		this.#listeners.length = 0;
+	}
+	#listen(target, name, listener) {
+		target.addEventListener(name, listener);
+		this.#listeners.push([
+			target,
+			name,
+			listener
+		]);
+	}
+	#record(event) {
+		this.#last = {
+			event,
+			at: Date.now()
+		};
+	}
+};
+function eventTarget(value) {
+	return isEventTarget(value) ? value : void 0;
+}
+function isEventTarget(value) {
+	return isRecord(value) && typeof value.addEventListener === "function" && typeof value.removeEventListener === "function" && typeof value.dispatchEvent === "function";
+}
+//#endregion
+//#region src/platform/transport/connection-monitor.ts
+var ConvexConnectionMonitor = class {
+	#connectionId = makeConnectionId();
+	#browser = new BrowserLifecycleMonitor();
+	#lastClose;
+	observedWebSocketConstructor() {
+		const NativeWebSocket = globalThis.WebSocket;
+		if (typeof globalThis.window === "undefined" || NativeWebSocket === void 0) return void 0;
+		return new Proxy(NativeWebSocket, { construct: (Target, args) => {
+			const socket = new Target(...args);
+			socket.addEventListener("close", (event) => {
+				this.#lastClose = this.#browser.socketClose(event);
+			});
+			return socket;
+		} });
+	}
+	close() {
+		this.#browser.close();
+	}
+	observe(client, observer) {
+		const subscribe = client.subscribeToConnectionState?.bind(client);
+		if (subscribe === void 0) return () => this.#browser.close();
+		let previous;
+		const unsubscribe = subscribe((next) => {
+			const diagnostics = this.#diagnostics(previous, next);
+			previous = next;
+			for (const diagnostic of diagnostics) emitDiagnostic(observer, diagnostic);
+		});
+		if (previous === void 0) {
+			const current = safeConnectionState(client);
+			if (current !== void 0) {
+				previous = current;
+				for (const diagnostic of this.#diagnostics(void 0, current)) emitDiagnostic(observer, diagnostic);
+			}
+		}
+		let closed = false;
+		return () => {
+			if (closed) return;
+			closed = true;
+			try {
+				unsubscribe();
+			} finally {
+				this.#browser.close();
+			}
+		};
+	}
+	reconnectEvidence(start, end) {
+		if (!connectionRestarted(start, end)) return void 0;
+		return {
+			kind: "connection-lost-in-flight",
+			connection_id: this.#connectionId,
+			start_connection_count: start.connectionCount,
+			connection_count: end.connectionCount,
+			...end.connectionRetries === void 0 ? {} : { connection_retries: end.connectionRetries },
+			...closeFields(this.#lastClose)
+		};
+	}
+	#diagnostics(previous, next) {
+		const transitions = connectionTransitions(previous, next);
+		if (transitions.length === 0) return [];
+		const oldest = next.timeOfOldestInflightRequest;
+		const oldestInflightMs = oldest instanceof Date && Number.isFinite(oldest.getTime()) ? Math.max(0, Date.now() - oldest.getTime()) : void 0;
+		const shared = {
+			previous_connected: previous?.isWebSocketConnected ?? false,
+			connected: next.isWebSocketConnected,
+			...next.hasEverConnected === void 0 ? {} : { has_ever_connected: next.hasEverConnected },
+			connection_count: next.connectionCount,
+			...next.connectionRetries === void 0 ? {} : { connection_retries: next.connectionRetries },
+			...next.hasInflightRequests === void 0 ? {} : { has_inflight_requests: next.hasInflightRequests },
+			...next.inflightActions === void 0 ? {} : { inflight_actions: next.inflightActions },
+			...next.inflightMutations === void 0 ? {} : { inflight_mutations: next.inflightMutations },
+			...oldestInflightMs === void 0 ? {} : { oldest_inflight_ms: oldestInflightMs },
+			...closeFields(this.#lastClose)
+		};
+		return transitions.map((transition) => ({
+			connection_id: this.#connectionId,
+			transition,
+			...shared
+		}));
+	}
+};
+function connectionRestarted(start, end) {
+	if (start === void 0 || end === void 0) return false;
+	const opensBeforeCancellation = start.isWebSocketConnected ? 1 : 2;
+	return end.connectionCount >= start.connectionCount + opensBeforeCancellation;
+}
+function connectionTransitions(previous, next) {
+	if (previous === void 0) {
+		if (next.isWebSocketConnected) return (next.connectionRetries ?? 0) > 0 ? ["retrying", "connected"] : ["connected"];
+		return (next.connectionRetries ?? 0) > 0 ? ["disconnected", "retrying"] : [];
+	}
+	const transitions = [];
+	if (previous.isWebSocketConnected !== next.isWebSocketConnected) transitions.push(next.isWebSocketConnected ? "connected" : "disconnected");
+	if ((next.connectionRetries ?? 0) > (previous.connectionRetries ?? 0)) transitions.push("retrying");
+	return transitions;
+}
+function emitDiagnostic(observer, diagnostic) {
+	try {
+		observer(diagnostic);
+	} catch {}
+}
+function safeConnectionState(client) {
+	try {
+		return client.connectionState?.();
+	} catch {
+		return;
+	}
+}
+function closeFields(close) {
+	if (close === void 0) return {};
+	return {
+		close_code: close.code,
+		close_was_clean: close.wasClean,
+		close_reason_present: close.reasonPresent,
+		...close.documentVisibility === void 0 ? {} : { document_visibility: close.documentVisibility },
+		...close.navigatorOnline === void 0 ? {} : { navigator_online: close.navigatorOnline },
+		...close.browserEvent === void 0 ? {} : { last_browser_event: close.browserEvent },
+		...close.msSinceBrowserEvent === void 0 ? {} : { ms_since_browser_event: close.msSinceBrowserEvent }
+	};
+}
+let fallbackConnectionId = 0;
+function makeConnectionId() {
+	try {
+		return `convex_${globalThis.crypto.randomUUID()}`;
+	} catch {
+		fallbackConnectionId += 1;
+		return `convex_${Date.now().toString(36)}_${fallbackConnectionId.toString(36)}`;
+	}
+}
+//#endregion
+//#region src/platform/transport/convex-diagnostics.ts
+const writeConvexDiagnostic = (...args) => {
+	try {
+		console.error(...maskCapturedNetworkRequest({ requestBody: args }).requestBody);
+	} catch {}
+};
+const stderrConvexLogger = {
+	log: writeConvexDiagnostic,
+	warn: writeConvexDiagnostic,
+	error: writeConvexDiagnostic,
+	logVerbose: () => void 0
+};
+const silentConvexLogger = {
+	log: () => void 0,
+	warn: () => void 0,
+	error: () => void 0,
+	logVerbose: () => void 0
+};
+/** Exact floor-first allowlist; every additional handler must migrate its validator first. */
+const OBSERVED_CONVEX_ACTIONS = new Set(OPERATIONS.filter((row) => row.kind === "action").map((row) => row.path));
+const OBSERVED_CONVEX_QUERIES = new Set(OPERATIONS.filter((row) => row.kind === "query").map((row) => row.path));
+const OBSERVED_CONVEX_MUTATIONS = new Set(OPERATIONS.filter((row) => row.kind === "mutation").map((row) => row.path));
+//#endregion
+//#region src/platform/transport/convex-errors.ts
+/**
+* All a redacting backend says about an error it raised itself: its request
+* id. The WebSocket client wraps it as `[CONVEX Q(path)] … Called by client`.
+*/
+const REDACTED_ERROR = /^(?:\[CONVEX [QMA?]\([^)]*\)\] )?\[Request ID: ([^\]\s]+)\] Server Error(?:\s+Called by client)?$/u;
+function mapToCapxulError(operation, err, transport) {
+	const decoded = decodeConvexError(err);
+	if (decoded !== null) return decoded;
+	if (err instanceof CapxulError) return err;
+	if (transport !== void 0) {
+		const { kind: _kind, start_connection_count: _start, ...connection } = transport;
+		return Errors.networkError(operation, err, {
+			provider: "convex",
+			failure_mode: "upstream-down",
+			reason: "connection-lost-in-flight",
+			...connection
+		});
+	}
+	if (err instanceof Error && isTransportError(err)) return Errors.networkError(operation, err, { provider: "convex" });
+	return backendFailure(operation, err);
+}
+/**
+* A failure the backend raised outside its own error boundary: Convex
+* refusing the arguments (`ArgumentValidationError`) is the caller's input; a
+* function this deployment does not have is `CAPABILITY_UNAVAILABLE` naming
+* its path, because the backend runs a different version from this client;
+* anything else (an uncaught "Server Error") is a backend defect. None is a
+* provider outage. The Convex request id rides in details, so the backend's
+* log line can be found.
+*
+* A deployed backend redacts these errors (`REDACT_LOGS_TO_CLIENT`, #2304):
+* the message is only the request id, and no structured cause exists, so the
+* message shape is the only discriminator. Neither case can be told apart, and
+* the reply says where to look instead. The text matches stay for a backend
+* that does not redact (development, local).
+*/
+function backendFailure(operation, err) {
+	const text = err instanceof Error ? err.message : String(err);
+	const redacted = REDACTED_ERROR.exec(text.trim())?.[1];
+	if (redacted !== void 0) return new CapxulError("UNKNOWN", `The backend refused ${operation} and gave no detail. Find Convex request ${redacted} in the backend logs. If the backend can be newer than this client, update the CLI or SDK.`, {
+		cause: err,
+		layer: "convex",
+		details: {
+			operation,
+			provider: "convex",
+			requestId: redacted,
+			reason: "backend-error-redacted"
+		}
+	});
+	const requestId = /\[Request ID: ([^\]\s]+)\]/u.exec(text)?.[1];
+	const where = {
+		operation,
+		provider: "convex",
+		...requestId === void 0 ? {} : { requestId }
+	};
+	const argument = /ArgumentValidationError:?\s*([^\n]*)/u.exec(text);
+	if (argument !== null) return new CapxulError("INVALID_INPUT", `Invalid arguments for ${operation}`, {
+		cause: err,
+		layer: "convex",
+		details: {
+			field: "args",
+			reason: argument[1] ?? "",
+			...where
+		}
+	});
+	const path = /Could not find public function for '([^']+)'/u.exec(text)?.[1];
+	if (path !== void 0) return new CapxulError("CAPABILITY_UNAVAILABLE", `The backend has no function ${path}: it runs a different version from this client.`, {
+		cause: err,
+		layer: "convex",
+		details: {
+			reason: "backend-function-missing",
+			path,
+			...where
+		}
+	});
+	return new CapxulError("UNKNOWN", text, {
+		cause: err,
+		layer: "convex",
+		details: where
+	});
+}
+function mapToConvexCallError(operation, err, transport) {
+	return convexCallErrorFromCapxul(operation, mapToCapxulError(operation, err, transport), transport);
+}
+function logActionTransportFailure(operation, error) {
+	if (error.transport === void 0) return Effect.void;
+	const { kind, ...connection } = error.transport;
+	return Effect.logWarning("convex.action.connection_lost").pipe(Effect.annotateLogs({
+		operation,
+		failure_mode: "upstream-down",
+		reason: kind,
+		...connection
+	}), Effect.ignoreCause);
+}
+const TRANSPORT_ERROR_CODES = /* @__PURE__ */ new Set([
+	"EAI_AGAIN",
+	"ECONNREFUSED",
+	"ECONNRESET",
+	"ENOTFOUND",
+	"EPIPE",
+	"ETIMEDOUT",
+	"UND_ERR_CONNECT_TIMEOUT",
+	"UND_ERR_HEADERS_TIMEOUT",
+	"UND_ERR_SOCKET"
+]);
+function isTransportError(err) {
+	const seen = /* @__PURE__ */ new Set();
+	let current = err;
+	while (current !== void 0 && !seen.has(current)) {
+		seen.add(current);
+		const code = current.code;
+		if (current.name === "FetchError" || current.name === "NetworkError" || typeof code === "string" && TRANSPORT_ERROR_CODES.has(code)) return true;
+		current = current.cause instanceof Error ? current.cause : void 0;
+	}
+	return false;
+}
+//#endregion
+//#region src/platform/transport/observed-args.ts
+/**
+* The args one allowlisted Convex call carries: the caller's own observation
+* context, the host's, the application and the trace parent, merged and
+* sanitized. A call off the allowlist, or with nothing to carry, is unchanged.
+*/
+function observedConvexArgs(input) {
+	const { allowlist, path, args, traceparent } = input;
+	if (!allowlist.has(path)) return args;
+	const invocationSnapshot = readInvocationObservation(args);
+	if (path === diagnostics.health.path && invocationSnapshot?.active === false) {
+		const unobservedArgs = { ...args };
+		delete unobservedArgs.observationContext;
+		return unobservedArgs;
+	}
+	const carriedContext = sanitizeObservationContext(args.observationContext);
+	let hostContext;
+	if (invocationSnapshot !== void 0) hostContext = invocationSnapshot.active ? invocationSnapshot.context : void 0;
+	else {
+		const resolveContext = input.resolveContext;
+		if (resolveContext !== void 0) try {
+			hostContext = resolveContext();
+		} catch (cause) {
+			hostContext = void 0;
+			input.reportContextFailure(cause);
+		}
+	}
+	if (hostContext === void 0 && carriedContext === void 0 && traceparent === void 0) return args;
+	hostContext = sanitizeObservationContext({
+		...hostContext,
+		...carriedContext,
+		...input.applicationId === void 0 ? {} : { applicationId: input.applicationId },
+		...traceparent === void 0 ? {} : { traceparent }
+	});
+	if (hostContext === void 0) return args;
+	return {
+		...args,
+		observationContext: hostContext
+	};
+}
+//#endregion
+//#region src/platform/transport/convex-subscription.ts
+/**
+* Subscribe one query, and the connection state when the caller asks for it.
+* The returned stop always finishes, and a callback never runs after it.
+*/
+function subscribeConvexQuery(client, fn, args, callback, options) {
+	const path = getFunctionName(fn);
+	let active = true;
+	let unsubscribeQuery;
+	let unsubscribeConnection;
+	const stop = () => {
+		if (!active) return;
+		active = false;
+		try {
+			unsubscribeQuery?.();
+		} catch {}
+		try {
+			unsubscribeConnection?.();
+		} catch {}
+	};
+	try {
+		if (options?.onConnectionChange !== void 0) {
+			if (client.connectionState === void 0 || client.subscribeToConnectionState === void 0) throw Errors.notImplemented("convex", "connectionState");
+			let previous;
+			const observe = (state) => {
+				if (!active || previous === state.isWebSocketConnected) return;
+				previous = state.isWebSocketConnected;
+				try {
+					options.onConnectionChange?.(previous);
+				} catch {}
+			};
+			unsubscribeConnection = client.subscribeToConnectionState(observe);
+			observe(client.connectionState());
+		}
+		unsubscribeQuery = client.onUpdate(fn, args, (value) => {
+			if (active) callback({
+				status: "ok",
+				value
+			});
+		}, (err) => {
+			if (active) callback({
+				status: "error",
+				error: mapToCapxulError(path, err)
+			});
+		});
+		if (!active) unsubscribeQuery();
+		return stop;
+	} catch (cause) {
+		stop();
+		throw cause;
+	}
+}
+//#endregion
+//#region src/platform/transport/convex-adapter.ts
+/**
+* A socket that has not emitted `close` within this window is not going to.
+* ponytail: one fixed bound; `closeTimeoutMs` is the knob if a slow runtime
+* ever needs a different one.
+*/
+const DEFAULT_CLOSE_TIMEOUT_MS = 5e3;
+/**
+* The fetcher the Convex client's auth handshake gets. Convex first asks for
+* "a possibly cached token" (`forceRefreshToken: false`) and, as soon as the
+* server accepts it, for a fresh one (`true`): the token whose `exp` it
+* schedules the next refresh from. The Better Auth clients keep no token: each
+* ask mints one over the network, so the cached ask was a second token fetch
+* and a second server verification (a JWKS read) on every session restore. It
+* answers "none" instead, and Convex makes its one fetch forced, as a fresh
+* token. Every forced ask still reaches the auth client: that first fetch, the
+* refresh before `exp`, and the retry after the server rejects a token.
+* ponytail: the OAuth bearer client can hold a cached exchange; it now pays one
+* exchange for the first authentication instead of reusing it (never more
+* fetches than before). Pass the cache through if that start ever matters.
+*/
+function freshTokenHandshake(fetchToken) {
+	return async (args) => args.forceRefreshToken ? fetchToken(args) : null;
+}
+/** Run a Convex call under the current trace parent, when there is one. */
+const withTraceparent = (run) => Effect.flatMap(Effect.serviceOption(Tracer.ParentSpan), (parent) => run(parent._tag === "Some" ? formatTraceparent(parent.value) : void 0));
+var ConvexCallAdapter = class {
+	#client;
+	#convexUrl;
+	#logger;
+	#tokenProvider;
+	#applicationId;
+	#observation;
+	#connectionMonitor;
+	#closeTimeoutMs;
+	constructor(deps) {
+		this.#convexUrl = deps.convexUrl;
+		this.#logger = deps.localDiagnostics === true ? stderrConvexLogger : silentConvexLogger;
+		this.#closeTimeoutMs = deps.closeTimeoutMs ?? DEFAULT_CLOSE_TIMEOUT_MS;
+		this.#connectionMonitor = new ConvexConnectionMonitor();
+		const webSocketConstructor = this.#connectionMonitor.observedWebSocketConstructor();
+		this.#client = deps.client ?? new ConvexClient(deps.convexUrl, {
+			...webSocketConstructor === void 0 ? {} : { webSocketConstructor },
+			logger: this.#logger
+		});
+		this.#tokenProvider = deps.tokenProvider;
+		this.#applicationId = deps.applicationId;
+		this.#observation = deps.observation;
+		this.refreshAuth();
+	}
+	refreshAuth() {
+		if (this.#tokenProvider) this.#client.setAuth(freshTokenHandshake(this.#tokenProvider));
+	}
+	observeConnection(observer) {
+		return this.#connectionMonitor.observe(this.#client, observer);
+	}
+	query(fn, args, options) {
+		const path = getFunctionName(fn);
+		return withTraceparent((traceparent) => {
+			return Effect.tryPromise({
+				try: (signal) => {
+					const observed = this.#observedArgs(OBSERVED_CONVEX_QUERIES, path, args, traceparent);
+					return options?.fresh === true ? this.#freshQuery(fn, observed, signal, path) : this.#client.query(fn, observed);
+				},
+				catch: (cause) => mapToConvexCallError(path, cause)
+			});
+		});
+	}
+	async #freshQuery(fn, args, signal, path) {
+		const token = await this.#tokenProvider?.({ forceRefreshToken: false });
+		if (signal.aborted) throw Errors.cancelled({ operation: path });
+		const client = new ConvexHttpClient(this.#convexUrl, {
+			logger: this.#logger,
+			fetch: (input, init) => globalThis.fetch(input, {
+				...init,
+				signal
+			})
+		});
+		if (token !== void 0 && token !== null) client.setAuth(token);
+		const query = fn;
+		return client.query(query, args);
+	}
+	mutation(fn, args) {
+		const path = getFunctionName(fn);
+		return withTraceparent((traceparent) => {
+			return Effect.tryPromise({
+				try: () => this.#client.mutation(fn, this.#observedArgs(OBSERVED_CONVEX_MUTATIONS, path, args, traceparent)),
+				catch: (cause) => mapToConvexCallError(path, cause)
+			});
+		});
+	}
+	action(fn, args) {
+		const path = getFunctionName(fn);
+		return withTraceparent((traceparent) => {
+			const connectionAtStart = connectionState(this.#client);
+			return Effect.tryPromise({
+				try: () => this.#client.action(fn, this.#observedArgs(OBSERVED_CONVEX_ACTIONS, path, args, traceparent)),
+				catch: (cause) => {
+					const transport = this.#connectionMonitor.reconnectEvidence(connectionAtStart, connectionState(this.#client));
+					return mapToConvexCallError(path, cause, transport);
+				}
+			}).pipe(Effect.tapError((error) => logActionTransportFailure(path, error)));
+		});
+	}
+	#observedArgs(allowlist, path, args, traceparent) {
+		return observedConvexArgs({
+			allowlist,
+			path,
+			args,
+			traceparent,
+			applicationId: this.#applicationId,
+			resolveContext: this.#observation?.resolveContext,
+			reportContextFailure: (cause) => this.#reportContextFailure(cause)
+		});
+	}
+	#contextFailureReported = false;
+	#reportContextFailure(cause) {
+		if (this.#contextFailureReported) return;
+		this.#contextFailureReported = true;
+		console.warn("[capxul-sdk] observation resolveContext failed; calls are uncorrelated", { reason: cause instanceof Error ? cause.message : String(cause) });
+	}
+	subscribe(fn, args, callback, options) {
+		return Effect.try({
+			try: () => subscribeConvexQuery(this.#client, fn, args, callback, options),
+			catch: (cause) => mapToConvexCallError(getFunctionName(fn), cause)
+		}).pipe(Effect.tap(() => Effect.sync(() => {
+			callback({ status: "loading" });
+		})));
+	}
+	/**
+	* Teardown always completes. `ConvexClient.close()` resolves only when the
+	* socket emits `close`, and `WebSocketManager.close()` in the `connecting`
+	* state arms `ws.onopen = () => ws.close()` without ever closing the socket
+	* itself — so a handshake that stalls right after a server-initiated close
+	* (code 1012, which is what a Convex deploy sends) leaves that promise
+	* pending for as long as the page lives. Convex marks the client closed and
+	* terminates the socket manager synchronously before returning it, so
+	* abandoning it drops nothing. A rejection is dropped for the same reason —
+	* the layer release turns it into a defect that fails the whole scope close,
+	* and teardown has no caller who can act on it.
+	*/
+	async close() {
+		this.#connectionMonitor.close();
+		await settledWithin(this.#client.close(), this.#closeTimeoutMs);
+	}
+};
+function settledWithin(promise, timeoutMs) {
+	return new Promise((resolve) => {
+		const timer = setTimeout(resolve, timeoutMs);
+		const finish = () => {
+			clearTimeout(timer);
+			resolve();
+		};
+		promise.then(finish, finish);
+	});
+}
+function ConvexCallLayer(deps) {
+	return Layer.effect(ConvexCallPortTag, Effect.acquireRelease(Effect.sync(() => new ConvexCallAdapter(deps)), (adapter) => Effect.promise(() => adapter.close()).pipe(Effect.orDie)));
+}
+function connectionState(client) {
+	try {
+		const state = client.connectionState?.();
+		return typeof state?.connectionCount === "number" ? state : void 0;
+	} catch {
+		return;
+	}
+}
+//#endregion
+//#region src/observability/telemetry/clone.ts
+function cloneTelemetryProps(props) {
+	const cloned = {};
+	for (const [key, value] of Object.entries(props)) cloned[key] = cloneTelemetryValue(value);
+	return cloned;
+}
+function cloneTelemetryEvent(event) {
+	return event.props === void 0 ? { name: event.name } : {
+		name: event.name,
+		props: cloneTelemetryProps(event.props)
+	};
+}
+function cloneTelemetryValue(value) {
+	if (Array.isArray(value)) return value.map(cloneTelemetryValue);
+	if (value === null || typeof value !== "object") return value;
+	if (Object.getPrototypeOf(value) !== Object.prototype) return value;
+	const cloned = {};
+	for (const [key, nested] of Object.entries(value)) cloned[key] = cloneTelemetryValue(nested);
+	return cloned;
+}
+//#endregion
+//#region src/observability/telemetry/posthog-adapter.ts
+/** The PostHog transport refused one call; its reason rides the drop log. */
+var TelemetryTransportRejected = class extends Data.TaggedError("TelemetryTransportRejected") {};
+var PostHogTelemetryAdapter = class {
+	#capture;
+	#identify;
+	#group;
+	#reset;
+	constructor(deps) {
+		this.#capture = deps.capture;
+		this.#identify = deps.identify ?? (() => void 0);
+		this.#group = deps.group ?? (() => void 0);
+		this.#reset = deps.reset ?? (() => void 0);
+	}
+	emit(event) {
+		return this.#run(() => this.#capture(event.name, redactTelemetryProps(event.name, cloneTelemetryEvent(event).props), event), "emit", event.name);
+	}
+	identify(input) {
+		return this.#run(() => this.#identify(cloneIdentifyInput(input)), "identify");
+	}
+	group(input) {
+		return this.#run(() => this.#group(cloneGroupInput(input)), "group");
+	}
+	reset() {
+		return this.#run(() => this.#reset(), "reset");
+	}
+	#run(operation, operationName, eventName) {
+		const diagnose = (reason) => Effect.logWarning("product.telemetry.transport.dropped").pipe(Effect.annotateLogs({
+			operation: operationName,
+			reason: dropReason(reason),
+			...eventName === void 0 ? {} : { product_event: eventName }
+		}), Effect.ignoreCause);
+		return Effect.suspend(() => {
+			let pending;
+			try {
+				pending = operation();
+			} catch (reason) {
+				return diagnose(reason);
+			}
+			if (pending === void 0) return Effect.void;
+			const transport = Effect.tryPromise({
+				try: () => pending,
+				catch: (reason) => new TelemetryTransportRejected({ reason })
+			}).pipe(Effect.catch((rejected) => diagnose(rejected.reason)));
+			return Effect.forkDetach(transport, { startImmediately: true }).pipe(Effect.asVoid);
+		});
+	}
+};
+const DROP_REASON_MAX = 200;
+function dropReason(reason) {
+	const text = reason instanceof Error ? `${reason.name}: ${reason.message}` : String(reason);
+	return text.length <= DROP_REASON_MAX ? text : `${text.slice(0, DROP_REASON_MAX)}…`;
+}
+function PostHogTelemetryLayer(deps) {
+	return Layer.succeed(TelemetryPortTag, new PostHogTelemetryAdapter(deps));
+}
+function cloneIdentifyInput(input) {
+	const traits = input.traits === void 0 ? void 0 : cloneTelemetryProps(input.traits);
+	const properties = input.properties === void 0 ? void 0 : cloneTelemetryProps(input.properties);
+	return {
+		distinctId: input.distinctId,
+		...input.anonDistinctId === void 0 ? {} : { anonDistinctId: input.anonDistinctId },
+		...traits === void 0 ? {} : { traits },
+		...properties === void 0 ? {} : { properties }
+	};
+}
+function cloneGroupInput(input) {
+	const properties = input.properties === void 0 ? void 0 : cloneTelemetryProps(input.properties);
+	return properties === void 0 ? {
+		groupType: input.groupType,
+		groupKey: input.groupKey
+	} : {
+		groupType: input.groupType,
+		groupKey: input.groupKey,
+		properties
+	};
+}
+//#endregion
+//#region src/observability/telemetry/from-posthog.ts
+/**
+* Drop props that must never cross to a host-owned external sink. Today that is
+* the `$exception` `details` blob: `captureException` serializes
+* `CapxulError.details` (e.g. `{ asset, available, required }`, `{ name }`,
+* `{ accountId }` — errors.ts) into it, and the shared redactor has no
+* `$exception` rule, so it is stripped here at the boundary (infra#1037). The
+* safe fields (error code, operation, failure_mode, the fixed leak-safe message,
+* stack frames) are preserved.
+*/
+function stripHostUnsafeProps(props) {
+	if (props === void 0) return void 0;
+	const { details: _details, ...safe } = props;
+	return safe;
+}
+/**
+* The subset of a posthog-js client the seam calls. `identify` / `group` /
+* `reset` are optional — a host that only wants event capture can omit them.
+*/
+/**
+* Adapt the host's already-initialized posthog-like client into a
+* `TelemetryPort` for the `telemetry` prop / input. This port SUPPLANTS the
+* SDK's no-op default telemetry sink (`production.ts` binds it via
+* `Layer.succeed`, not `compose` — there is no client-side success relay to
+* compose with); it is additive to Capxul's backend first-party record and
+* never owns the client.
+*/
+function postHogProductTelemetry(policy, fixedSnapshot) {
+	const telemetry = new PostHogTelemetryAdapter({
+		capture: (name, props, source) => {
+			const snapshot = readInvocationObservation(source) ?? fixedSnapshot ?? policy.snapshot();
+			if (!snapshot.active || policy.client === null || policy.client === void 0) return;
+			const event = stampTelemetryEnvelope({
+				name,
+				props
+			}, {
+				capxul_env: policy.capxulEnv,
+				producer: "sdk"
+			});
+			policy.deliver(() => policy.client.capture(name, {
+				...stripHostUnsafeProps(event.props),
+				...observationContextProps(snapshot.context)
+			}));
+		},
+		identify: (input) => {
+			if (!(fixedSnapshot ?? policy.snapshot()).active || policy.client?.identify === void 0) return;
+			policy.deliver(() => policy.client.identify(input.distinctId, {
+				...input.traits,
+				...input.properties
+			}));
+		},
+		group: (input) => {
+			if (!(fixedSnapshot ?? policy.snapshot()).active || policy.client?.group === void 0) return;
+			policy.deliver(() => policy.client.group(input.groupType, input.groupKey, input.properties === void 0 ? void 0 : { ...input.properties }));
+		},
+		reset: () => {
+			if (!(fixedSnapshot ?? policy.snapshot()).active || policy.client?.reset === void 0) return;
+			policy.deliver(() => policy.client.reset());
+		}
+	});
+	registerProductTelemetryInvocation(telemetry, (source) => postHogProductTelemetry(policy, readInvocationObservation(source) ?? fixedSnapshot ?? policy.snapshot()));
+	return telemetry;
+}
+//#endregion
+//#region src/observability/host.ts
+const HOST_INTERNALS = /* @__PURE__ */ new WeakMap();
+/** Build the SDK's one host module around an already-initialized PostHog client. */
+function postHogObservability(client, options = {}) {
+	const inactive = Object.freeze({
+		active: false,
+		contextProps: Object.freeze({})
+	});
+	const snapshot = () => {
+		if (client === null || client === void 0) return inactive;
+		try {
+			if (!(typeof options.enabled === "function" ? options.enabled() : options.enabled ?? true)) return inactive;
+			const rawContext = typeof options.context === "function" ? options.context() : options.context;
+			const sanitized = sanitizeObservationContext(rawContext);
+			const context = sanitized === void 0 ? void 0 : Object.freeze({ ...sanitized });
+			return Object.freeze({
+				active: true,
+				...context === void 0 ? {} : { context },
+				contextProps: Object.freeze(observationContextProps(context))
+			});
+		} catch {
+			return inactive;
+		}
+	};
+	const policy = {
+		client,
+		capxulEnv: options.capxulEnv ?? "unknown",
+		snapshot,
+		deliver: (capture) => {
+			try {
+				const delivery = capture();
+				if (Predicate.isPromiseLike(delivery)) Promise.resolve(delivery).catch(() => void 0);
+			} catch {}
+		}
+	};
+	const module = {
+		failures: postHogFailureObservation(policy),
+		product: postHogProductTelemetry(policy)
+	};
+	HOST_INTERNALS.set(module, {
+		engineeringPolicy: Object.freeze({
+			...options.engineeringDeliveryBudget === void 0 ? {} : { engineeringDeliveryBudget: options.engineeringDeliveryBudget },
+			...options.engineeringEnabled === void 0 ? {} : { engineeringEnabled: options.engineeringEnabled },
+			...options.engineeringPrivacy === void 0 ? {} : { engineeringPrivacy: options.engineeringPrivacy }
+		}),
+		bind: () => {
+			const invocation = snapshot();
+			return {
+				failures: postHogFailureObservation(policy, invocation),
+				product: postHogProductTelemetry(policy, invocation)
+			};
+		},
+		snapshot
+	});
+	return module;
+}
+/** @internal Bind both projections to one call-start decision/context snapshot. */
+function bindHostObservabilityInvocation(observability) {
+	if (observability === void 0) return void 0;
+	return HOST_INTERNALS.get(observability)?.bind() ?? observability;
+}
+/** @internal Read one call-start snapshot for actor/transition carriage. */
+function snapshotHostObservability(observability) {
+	const snapshot = observability === void 0 ? void 0 : HOST_INTERNALS.get(observability)?.snapshot();
+	return snapshot === void 0 ? void 0 : {
+		active: snapshot.active,
+		...snapshot.context === void 0 ? {} : { context: snapshot.context }
+	};
+}
+/** @internal Carry the explicit host engineering policy into production composition. */
+function hostEngineeringPolicy(observability) {
+	const policy = observability === void 0 ? void 0 : HOST_INTERNALS.get(observability)?.engineeringPolicy;
+	return {
+		...policy?.engineeringDeliveryBudget === void 0 ? {} : { deliveryBudget: policy.engineeringDeliveryBudget },
+		...policy?.engineeringEnabled === void 0 ? {} : { enabled: policy.engineeringEnabled },
+		...policy?.engineeringPrivacy === void 0 ? {} : { privacy: policy.engineeringPrivacy }
+	};
+}
+//#endregion
+//#region ../observability/src/delivery/admission.ts
+function newDeliveryState(budget, ownsMetrics) {
+	return {
+		budget,
+		ownsMetrics,
+		closed: Deferred.makeUnsafe(),
+		isClosed: false,
+		metricsRunning: false,
+		logs: [],
+		spans: /* @__PURE__ */ new Map(),
+		terminalBodies: /* @__PURE__ */ new WeakSet(),
+		bodyLeases: /* @__PURE__ */ new WeakMap(),
+		pendingBodies: /* @__PURE__ */ new Set()
+	};
+}
+/** Hold the records a body carries until its request finishes or the body is discarded. */
+function holdBody(state, body, releases) {
+	if (releases.length === 0) return;
+	const lease = {
+		started: false,
+		release: () => {
+			if (!state.pendingBodies.delete(lease)) return;
+			state.bodyLeases.delete(body);
+			for (const release of releases) release();
+		}
+	};
+	state.bodyLeases.set(body, lease);
+	state.pendingBodies.add(lease);
+}
+const discardBody = (state, body) => state.bodyLeases.get(body)?.release();
+const drainLogs = (state) => {
+	for (const release of state.logs.splice(0)) release();
+};
+function closeDelivery(state) {
+	state.isClosed = true;
+	Deferred.doneUnsafe(state.closed, Effect.void);
+	for (const lease of state.pendingBodies) if (!lease.started) lease.release();
+	drainLogs(state);
+	for (const release of state.spans.values()) release();
+	state.spans.clear();
+	if (state.ownsMetrics) state.budget.metricRegistry.clear();
+}
+const text = (value) => typeof value === "string" ? value.slice(0, 128) : "capxul.engineering";
+const attributes = (input, limit = 32) => {
+	const out = {};
+	let count = 0;
+	let bytes = 0;
+	try {
+		for (const key in input) {
+			if (count++ >= limit) break;
+			if (key.length > 64) continue;
+			const value = Object.getOwnPropertyDescriptor(input, key)?.value;
+			const scalar = typeof value === "string" ? value.slice(0, 128) : typeof value === "boolean" || typeof value === "number" && Number.isFinite(value) ? value : void 0;
+			if (scalar === void 0) continue;
+			bytes += new TextEncoder().encode(JSON.stringify([key, scalar])).length;
+			if (bytes > (limit >= 24 ? 2e3 : 300)) break;
+			out[key] = scalar;
+		}
+	} catch {}
+	return out;
+};
+const terminalName = (name) => name === "cli.command.completed" || name === "cli.wallet.step" || CLI_COMMAND_NAMES.some((command) => name === `cli.command.${command}`);
+//#endregion
+//#region ../observability/src/delivery/records.ts
+function admittedLogger(state, delegate) {
+	return Logger.make((options) => {
+		if (state.isClosed) return;
+		let release;
+		try {
+			const message = text(Array.isArray(options.message) ? Object.getOwnPropertyDescriptor(options.message, "0")?.value : options.message);
+			release = state.budget.admitRecord(terminalName(message));
+			if (release === void 0) return;
+			const context = Context.add(options.fiber.context, References.CurrentLogAnnotations, attributes(options.fiber.getRef(References.CurrentLogAnnotations)));
+			const fiber = Object.create(options.fiber);
+			Object.defineProperty(fiber, "getRef", { value: (ref) => Context.get(context, ref) });
+			state.logs.push(release);
+			delegate.log({
+				...options,
+				message,
+				cause: Cause.empty,
+				fiber
+			});
+		} catch {
+			if (release !== void 0) {
+				const index = state.logs.indexOf(release);
+				if (index !== -1) state.logs.splice(index, 1);
+				release();
+			}
+			state.budget.drop();
+		}
+	});
+}
+function admittedTracer(state, delegate) {
+	return Tracer.make({
+		span(options) {
+			const name = text(options.name);
+			const release = state.isClosed ? void 0 : state.budget.admitRecord(terminalName(name));
+			const spanOptions = {
+				...options,
+				name,
+				annotations: Context.empty(),
+				links: []
+			};
+			const span = release === void 0 ? new Tracer.NativeSpan({
+				...spanOptions,
+				sampled: false
+			}) : delegate.span(spanOptions);
+			if (release !== void 0) state.spans.set(span.spanId, release);
+			const wrapped = boundedSpan(state, span);
+			wrapped.addLinks(options.links ?? []);
+			return wrapped;
+		},
+		...delegate.context === void 0 ? {} : { context: delegate.context.bind(delegate) }
+	});
+}
+/** The span as a producer sees it: at most 32 fields and 2000 attribute bytes, 2 events, 2 links. */
+function boundedSpan(state, span) {
+	const { budget } = state;
+	const wrapped = Object.create(span);
+	let fields = 0, events = 0, links = 0, attributeBytes = 0;
+	let ended = false;
+	Object.defineProperties(wrapped, {
+		attribute: { value: (key, value) => {
+			if (fields >= 32 && !span.attributes.has(key)) {
+				budget.drop();
+				return;
+			}
+			const safe = attributes({ [key]: value }, 1);
+			if (!Object.hasOwn(safe, key)) return;
+			const previous = span.attributes.has(key) ? new TextEncoder().encode(JSON.stringify([key, span.attributes.get(key)])).length : 0;
+			const next = new TextEncoder().encode(JSON.stringify([key, safe[key]])).length;
+			if (attributeBytes - previous + next > 2e3) {
+				budget.drop();
+				return;
+			}
+			attributeBytes += next - previous;
+			if (!span.attributes.has(key)) fields += 1;
+			span.attribute(key, safe[key]);
+		} },
+		event: { value: (eventName, time, attrs) => {
+			if (events++ >= 2) {
+				budget.drop();
+				return;
+			}
+			span.event(text(eventName), time, attributes(attrs ?? {}, 4));
+		} },
+		addLinks: { value: (items) => {
+			for (const item of items.slice(0, Math.max(0, 2 - links))) {
+				if (!/^[a-f0-9]{32}$/u.test(item.span.traceId) || !/^[a-f0-9]{16}$/u.test(item.span.spanId)) {
+					budget.drop();
+					continue;
+				}
+				span.addLinks([{
+					span: Tracer.externalSpan({
+						traceId: item.span.traceId,
+						spanId: item.span.spanId,
+						sampled: item.span.sampled
+					}),
+					attributes: attributes(item.attributes, 4)
+				}]);
+				links += 1;
+			}
+		} },
+		end: { value: (time, exit) => {
+			if (ended) return;
+			ended = true;
+			span.end(time, Exit.isFailure(exit) ? Exit.fail("CLI operation failed") : Exit.void);
+		} }
+	});
+	return wrapped;
+}
+//#endregion
+//#region ../observability/src/delivery/budget.ts
+/** Fixed admission limits for one CLI invocation and its SDK client. */
+const CLI_ENGINEERING_LIMITS = Object.freeze({
+	records: 80,
+	ordinaryRecords: 64,
+	recordBytes: 16384,
+	requests: 5,
+	ordinaryRequests: 2,
+	requestBytes: 1572864,
+	metricSeries: 16,
+	requestTimeoutMs: 1e3
+});
+//#endregion
+//#region ../observability/src/delivery/requests.ts
+function admittedSerialization(state, delegate) {
+	return {
+		logs(data) {
+			const releases = state.logs.splice(0);
+			try {
+				const body = delegate.logs(data);
+				if (data.resourceLogs.some((r) => r.scopeLogs.some((s) => s.logRecords?.some((l) => terminalName(l.body?.stringValue ?? ""))))) state.terminalBodies.add(body);
+				holdBody(state, body, releases);
+				return body;
+			} catch (error) {
+				for (const release of releases) release();
+				throw error;
+			}
+		},
+		traces(data) {
+			const releases = [];
+			for (const resource of data.resourceSpans) for (const scope of resource.scopeSpans) for (const span of scope.spans) {
+				const release = state.spans.get(span.spanId);
+				if (release !== void 0) releases.push(release);
+				state.spans.delete(span.spanId);
+			}
+			try {
+				const body = delegate.traces(data);
+				if (data.resourceSpans.some((r) => r.scopeSpans.some((s) => s.spans.some((span) => terminalName(span.name))))) state.terminalBodies.add(body);
+				holdBody(state, body, releases);
+				return body;
+			} catch (error) {
+				for (const release of releases) release();
+				throw error;
+			}
+		},
+		metrics(data) {
+			const body = delegate.metrics(data);
+			state.terminalBodies.add(body);
+			return body;
+		}
+	};
+}
+/** A 429's Retry-After, bounded to two seconds; any other failure retries at once. */
+const retryAfter = Schedule.spaced("100 millis").pipe(Schedule.addDelay(({ input }) => Effect.map(Clock.currentTimeMillis, (now) => {
+	if (!HttpClientError.isHttpClientError(input) || input.reason._tag !== "StatusCodeError" || input.reason.response.status !== 429) return Duration.zero;
+	const header = input.reason.response.headers["retry-after"];
+	const numeric = Number(header);
+	const delay = header === void 0 ? 2e3 : Number.isFinite(numeric) ? numeric * 1e3 : Date.parse(header) - now;
+	return Duration.millis(Number.isFinite(delay) ? Math.min(2e3, Math.max(0, delay)) : 2e3);
+})));
+function admittedTransport(state, client, enabled = () => true) {
+	const { budget } = state;
+	const retrying = HttpClient.transform(client, (response, request) => Effect.suspend(() => {
+		if (enabled()) return response;
+		budget.drop();
+		return Effect.succeed(HttpClientResponse.fromWeb(request, new Response(null)));
+	})).pipe(HttpClient.transformResponse((response) => Effect.tap(response, (result) => {
+		let received = 0;
+		return Stream.runForEach(result.stream, (chunk) => Effect.sync(() => {
+			received += chunk.byteLength;
+			if (received > 65536) throw new Error("Engineering response limit exceeded");
+		})).pipe(Effect.catchReason("HttpClientError", "EmptyBodyError", () => Effect.void));
+	}))).pipe(HttpClient.filterStatusOk, HttpClient.retryTransient({
+		times: 1,
+		schedule: retryAfter
+	}));
+	return HttpClient.transform(retrying, (response, request) => Effect.suspend(() => {
+		if (state.isClosed) {
+			discardBody(state, request.body);
+			return Effect.succeed(HttpClientResponse.fromWeb(request, new Response(null)));
+		}
+		const droppedResponse = () => HttpClientResponse.fromWeb(request, new Response(null, { status: 200 }));
+		if (request.body._tag === "Empty") {
+			discardBody(state, request.body);
+			return Effect.succeed(droppedResponse());
+		}
+		const bytes = request.body.contentLength;
+		const release = budget.admitRequest(bytes ?? Number.POSITIVE_INFINITY, state.terminalBodies.has(request.body));
+		if (release === void 0) {
+			discardBody(state, request.body);
+			return Effect.succeed(droppedResponse());
+		}
+		const lease = state.bodyLeases.get(request.body);
+		if (lease !== void 0) lease.started = true;
+		return response.pipe(Effect.asVoid, Effect.timeoutOption(CLI_ENGINEERING_LIMITS.requestTimeoutMs), Effect.raceFirst(Deferred.await(state.closed).pipe(Effect.andThen(Effect.interrupt))), Effect.tap((result) => Effect.sync(() => {
+			if (Option.isNone(result)) budget.drop();
+		})), Effect.catchCause(() => Effect.sync(() => {
+			budget.drop();
+		})), Effect.as(droppedResponse()), Effect.ensuring(Effect.sync(() => {
+			release();
+			discardBody(state, request.body);
+		})));
+	}));
+}
+//#endregion
+//#region ../observability/src/engineering-delivery.ts
+/** Native exporters retain their serialization and scheduling; this owns admission only. */
+function cliEngineeringDelivery(budget, ownsMetrics) {
+	const state = newDeliveryState(budget, ownsMetrics);
+	return {
+		close: () => closeDelivery(state),
+		discardBody: (body) => discardBody(state, body),
+		metrics(run) {
+			return Effect.suspend(() => {
+				if (state.isClosed || state.metricsRunning) return Effect.void;
+				state.metricsRunning = true;
+				return run.pipe(Effect.ensuring(Effect.sync(() => {
+					state.metricsRunning = false;
+				})));
+			});
+		},
+		logger: (delegate) => admittedLogger(state, delegate),
+		tracer: (delegate) => admittedTracer(state, delegate),
+		serialization: (delegate) => admittedSerialization(state, delegate),
+		transport: (client, enabled) => admittedTransport(state, client, enabled)
+	};
+}
+//#endregion
+//#region ../observability/src/engineering/config.ts
+const ENGINEERING_CAPXUL_ENVS = [
+	"development",
+	"staging",
+	"production",
+	"local"
+];
+const traceHeaderFilter = (_name) => true;
+const credentialHeaderPattern = Object.assign(/./u, { exec: (name) => isCredentialField(name, "header") ? Object.assign([name], {
+	index: 0,
+	input: name
+}) : null });
+const postHogOtlpEndpoints = (host) => {
+	const base = host.replace(/\/+$/, "");
+	return {
+		logs: `${base}/i/v1/logs`,
+		traces: `${base}/i/v1/traces`,
+		metrics: `${base}/i/v1/metrics`
+	};
+};
+const ENGINEERING_CAPXUL_ENV_SET = new Set(ENGINEERING_CAPXUL_ENVS);
+const ENGINEERING_PRODUCERS = /* @__PURE__ */ new Set(["browser", "server"]);
+const PUBLIC_POSTHOG_AUTHORIZATION = /^Bearer phc_[A-Za-z0-9_-]{1,191}$/u;
+const SAFE_RESOURCE_VALUE = /^[A-Za-z0-9][A-Za-z0-9._+@/-]{0,127}$/u;
+function validateEngineeringPrivacy(config) {
+	if (config.privacy !== void 0 && config.privacy !== "minimal") throw new TypeError("engineering telemetry privacy must be minimal when specified");
+	if (config.privacy === "minimal" && (!/^[A-Za-z0-9][A-Za-z0-9._+@-]{0,127}$/u.test(config.sdkVersion) || config.serviceName !== void 0 && !/^[A-Za-z0-9][A-Za-z0-9._+@-]{0,127}$/u.test(config.serviceName))) throw new TypeError("minimal engineering resource values must not contain paths");
+}
+const validateEngineeringTelemetryConfig = (config) => {
+	let url;
+	try {
+		url = new URL(config.host);
+	} catch {
+		throw new TypeError("engineering telemetry host must be an absolute HTTPS URL");
+	}
+	if (url.protocol !== "https:" || url.username.length > 0 || url.password.length > 0 || url.pathname !== "/" || url.search.length > 0 || url.hash.length > 0 || !(url.hostname === "posthog.com" || url.hostname.endsWith(".posthog.com"))) throw new TypeError("engineering telemetry host must be a credential-free HTTPS origin");
+	if (!ENGINEERING_CAPXUL_ENV_SET.has(config.capxulEnv)) throw new TypeError("engineering telemetry capxulEnv is not canonical");
+	if (!ENGINEERING_PRODUCERS.has(config.producer)) throw new TypeError("engineering telemetry producer is not canonical");
+	if (config.enabled !== void 0 && typeof config.enabled !== "boolean" && typeof config.enabled !== "function") throw new TypeError("engineering telemetry enabled must be a boolean or callback");
+	validateEngineeringPrivacy(config);
+	if (!SAFE_RESOURCE_VALUE.test(config.sdkVersion)) throw new TypeError("engineering telemetry sdkVersion must be a bounded safe value");
+	if (config.serviceName !== void 0 && !SAFE_RESOURCE_VALUE.test(config.serviceName)) throw new TypeError("engineering telemetry serviceName must be a bounded safe value");
+	const headerEntries = Object.entries(config.headers);
+	if (headerEntries.length !== 1 || headerEntries[0]?.[0].toLowerCase() !== "authorization" || !PUBLIC_POSTHOG_AUTHORIZATION.test(headerEntries[0]?.[1] ?? "")) throw new TypeError("engineering telemetry headers must contain exactly one public PostHog authorization token");
+	return {
+		...config,
+		host: url.origin,
+		headers: Object.freeze({ authorization: headerEntries[0][1] })
+	};
+};
+//#endregion
+//#region ../observability/src/engineering/tracer.ts
+const failureText = (failure, key, limit, source) => {
+	if (failure === null || typeof failure !== "object") return void 0;
+	try {
+		let owner = failure;
+		let descriptor;
+		for (let depth = 0; owner !== null && depth < 4; depth += 1) {
+			descriptor = Object.getOwnPropertyDescriptor(owner, key);
+			if (descriptor !== void 0 || key !== "name") break;
+			owner = Object.getPrototypeOf(owner);
+		}
+		const value = descriptor?.value;
+		return typeof value === "string" || key === "code" && typeof value === "number" ? redactSecrets(String(value), source).slice(0, limit) : void 0;
+	} catch {
+		return;
+	}
+};
+const exportFailure = (failure, source) => {
+	const message = failureText(failure, "message", 2048, source) ?? (typeof failure === "string" ? redactSecrets(failure, source).slice(0, 2048) : "Engineering operation failed");
+	const code = failureText(failure, "code", 128);
+	const error = new Error((code === void 0 ? message : `${message} [code=${code}]`).slice(0, 2048));
+	error.name = failureText(failure, "_tag", 128) ?? failureText(failure, "name", 128) ?? "Error";
+	error.stack = failureText(failure, "stack", 8192, source) ?? `${error.name}: ${error.message}`;
+	return error;
+};
+const exportFailureExit = (cause, source) => Exit.failCause(Cause.fromReasons(cause.reasons.filter((reason) => !Cause.isInterruptReason(reason)).slice(0, 8).map((reason) => Cause.isFailReason(reason) ? Cause.makeFailReason(exportFailure(reason.error, source)) : Cause.makeDieReason(exportFailure(reason.defect, source)))));
+const BROWSER_KEEPALIVE_BYTES = 65536;
+let unfinishedBrowserExportBytes = 0;
+const hasBrowserDocument = () => typeof window !== "undefined" && typeof document !== "undefined";
+const browserExportClient = (client) => HttpClient.transform(client, (response, request) => Effect.acquireUseRelease(Effect.sync(() => {
+	const bytes = "contentLength" in request.body ? request.body.contentLength : void 0;
+	if (request.body._tag === "Stream" || request.body._tag === "FormData" || bytes === void 0 || !Number.isSafeInteger(bytes) || bytes < 0 || unfinishedBrowserExportBytes + bytes > BROWSER_KEEPALIVE_BYTES) return;
+	unfinishedBrowserExportBytes += bytes;
+	return bytes;
+}), (bytes) => response.pipe(Effect.provideService(FetchHttpClient.RequestInit, { keepalive: bytes !== void 0 }), Effect.tap((result) => bytes === void 0 ? Effect.void : Stream.runDrain(result.stream).pipe(Effect.catchIf((error) => error.reason._tag === "EmptyBodyError", () => Effect.void)))), (bytes) => Effect.sync(() => {
+	if (bytes !== void 0) unfinishedBrowserExportBytes -= bytes;
+})));
+const spanUpstream = (span) => {
+	let current = span;
+	while (current?._tag === "Span") {
+		const upstream = current.attributes.get("chain.upstream");
+		if (upstream === "alchemy" || upstream === "infura" || upstream === "gateway") return upstream;
+		current = current.parent._tag === "Some" ? current.parent.value : void 0;
+	}
+};
+function redactHttpPath(path, fullUrl, source) {
+	let origin = "https://redaction.invalid";
+	try {
+		const url = new URL(String(fullUrl));
+		if (url.protocol === "https:" || url.protocol === "http:") origin = url.origin;
+	} catch {}
+	const prefix = path.startsWith("/") ? origin : "";
+	return redactUrlSecrets(`${prefix}${path}`, source).slice(prefix.length, prefix.length + 2048);
+}
+/** A span whose prototype is `span`: it answers every Span member until an own property overrides it. */
+function inheritSpan(span) {
+	return Object.create(span);
+}
+/** Preserve domain exits while preventing the OTLP serializer from seeing raw causes. */
+const makeLeakSafeEngineeringTracer = (delegate, enabled = () => true) => Tracer.make({
+	span(options) {
+		const span = enabled() ? delegate.span(options) : new Tracer.NativeSpan(options);
+		const wrapped = inheritSpan(span);
+		Object.defineProperty(wrapped, "attribute", { value: (name, value) => {
+			const source = spanUpstream(span);
+			const header = /^http\.(?:request|response)\.header\.(.+)$/u.exec(name)?.[1];
+			if (header !== void 0 && isCredentialField(header, "header")) span.attribute(name, "[REDACTED]");
+			else if (typeof value === "string" && name === "url.query") span.attribute(name, redactUrlSecrets(`?${value}`).slice(1, 2049));
+			else if (typeof value === "string" && (name === "url.path" || name === "http.target")) {
+				const fullUrl = span.attributes.get("url.full") ?? span.attributes.get("http.url");
+				const path = name === "url.path" && typeof fullUrl === "string" ? /^https?:\/\/[^/]+([^?#]*)/u.exec(fullUrl)?.[1] ?? value : value;
+				span.attribute(name, redactHttpPath(path, fullUrl, source));
+			} else if (typeof value === "string" && (name === "url.full" || name === "http.url" || header === "location" || header === "referer" || header === "referrer")) span.attribute(name, redactUrlSecrets(value, source).slice(0, 2048));
+			else if (header !== void 0 && typeof value === "string") span.attribute(name, redactSecrets(value, source).slice(0, 2048));
+			else span.attribute(name, value);
+		} });
+		Object.defineProperty(wrapped, "end", {
+			configurable: false,
+			enumerable: false,
+			value: (endTime, exit) => {
+				if (!enabled()) {
+					Object.defineProperty(wrapped, "status", { value: {
+						_tag: "Ended",
+						startTime: span.status.startTime,
+						endTime,
+						exit
+					} });
+					return;
+				}
+				if (Exit.isFailure(exit) && !Cause.hasInterruptsOnly(exit.cause)) {
+					const first = exit.cause.reasons.find((reason) => !Cause.isInterruptReason(reason));
+					const code = failureText(first === void 0 ? void 0 : Cause.isFailReason(first) ? first.error : first.defect, "code", 128);
+					if (code !== void 0) span.attribute("error.code", code);
+					span.end(endTime, exportFailureExit(exit.cause, spanUpstream(span)));
+				} else span.end(endTime, exit);
+			},
+			writable: false
+		});
+		return wrapped;
+	},
+	...delegate.context === void 0 ? {} : { context: delegate.context.bind(delegate) }
+});
+//#endregion
+//#region ../observability/src/engineering/minimal.ts
+const MINIMAL_LOG_NAMES = /* @__PURE__ */ new Set([
+	"capxul_sdk_operation",
+	"identity.transition",
+	"convex.connection.changed",
+	"convex.action.connection_lost",
+	"cli.command.completed",
+	"cli.sdk.operation.failed",
+	"cli.signer.wait",
+	"cli.wallet.step"
+]);
+const MINIMAL_ERROR_CODES = /* @__PURE__ */ new Set([
+	...CAPXUL_ERROR_CODES,
+	"CLI_USAGE",
+	"CLI_CONFIG",
+	"CLI_STORAGE",
+	"CLI_DEFECT",
+	"CLI_DEADLINE"
+]);
+const MINIMAL_NUMBERS = /* @__PURE__ */ new Set([
+	"schema_version",
+	"duration_ms",
+	"wait_duration_ms",
+	"retry_count",
+	"http.status_code",
+	"http.response.status_code",
+	"http_status",
+	"rpc.code",
+	"connection_count",
+	"connection_retries",
+	"elapsed_ms",
+	"total_ms",
+	"token_calls",
+	"call",
+	"attempt",
+	"bridge_protocol_version",
+	"httpStatus"
+]);
+const MINIMAL_CORRELATIONS = /* @__PURE__ */ new Set([
+	"correlation_id",
+	"journey_id",
+	"invocation_id",
+	"posthogDistinctId"
+]);
+const MINIMAL_METRIC_LABELS = /* @__PURE__ */ new Set([
+	"command",
+	"capability",
+	"invocation_kind",
+	"outcome",
+	"capxul_env",
+	"unit"
+]);
+const MINIMAL_METRIC_NAMES = /* @__PURE__ */ new Set(["capxul.cli.command.count", "capxul.cli.command.duration"]);
+const traceId = (value) => typeof value === "string" && /^(?!0+$)[0-9a-f]{32}$/u.test(value);
+const spanId = (value) => typeof value === "string" && /^(?!0+$)[0-9a-f]{16}$/u.test(value);
+const minimalName = (value) => typeof value === "string" && (MINIMAL_LOG_NAMES.has(value) || isCapxulOperation(value) || CLI_COMMAND_NAMES.some((command) => value === `cli.command.${command}`)) ? value : "capxul.engineering";
+const MINIMAL_ENUM_VALUES = /* @__PURE__ */ new Map([
+	["outcome", [
+		"succeeded",
+		"refused",
+		"failed",
+		"cancelled",
+		"applied"
+	]],
+	["mode", FAILURE_MODES],
+	["failure_mode", FAILURE_MODES],
+	["capxul_env", ENGINEERING_CAPXUL_ENVS],
+	["producer", ["browser", "server"]],
+	["command", CLI_COMMAND_NAMES],
+	["capability", CLI_CAPABILITIES],
+	["invocation_kind", CLI_INVOCATION_KINDS],
+	["diagnostic_scope", [
+		"openfort.step",
+		"openfort.token",
+		"openfort.encryptionSession",
+		"openfort.embeddedState",
+		"openfort.storageCleared",
+		"openfort.configure",
+		"openfort.get",
+		"openfort.address",
+		"openfort.staleCacheHeal",
+		"openfort.signerRecovery",
+		"openfort.signerStatusListener"
+	]],
+	["step", [
+		"initialize",
+		"token",
+		"encryptionSession",
+		"embeddedState",
+		"configure",
+		"get",
+		"healStaleCache",
+		"walletReady"
+	]],
+	["provider", ["better-auth", "oidc"]],
+	["cli_identity_kind", ["anonymous", "identified"]],
+	["output_mode", ["human", "json"]],
+	["setup_status", ORGANIZATION_SETUP_STATUSES],
+	["setup_reason", ORGANIZATION_SETUP_REASONS],
+	["signer_stage", [
+		"address",
+		"readiness",
+		"sign"
+	]],
+	["unit", [
+		"1",
+		"s",
+		"ms"
+	]]
+]);
+const MINIMAL_CODE_KEYS = /* @__PURE__ */ new Set([
+	"error.code",
+	"error_code",
+	"failure_code",
+	"refusal_code",
+	"capxul_error_code"
+]);
+const MINIMAL_VERSION_KEYS = /* @__PURE__ */ new Set([
+	"sdk_version",
+	"cli_version",
+	"release"
+]);
+function minimalStringValue(key, text) {
+	if (key === "operation") return isCapxulOperation(text);
+	if (key === "organization_id") return /^org_[0-9A-Za-z]+$/u.test(text);
+	if (MINIMAL_CODE_KEYS.has(key)) return MINIMAL_ERROR_CODES.has(text);
+	if (MINIMAL_VERSION_KEYS.has(key)) return /^[A-Za-z0-9][A-Za-z0-9._+@-]{0,127}$/u.test(text);
+	if (key === "trace_id") return traceId(text);
+	if (key === "span_id" || key === "parent_span_id") return spanId(text);
+	const values = MINIMAL_ENUM_VALUES.get(key);
+	if (values !== void 0) return values.includes(text);
+	return MINIMAL_CORRELATIONS.has(key) && /^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$/u.test(text) && !/^0x[0-9a-f]+$/iu.test(text) && redactSecrets(text) === text;
+}
+/** A named privacy projection, separate from the default credential-only redaction policy. */
+function minimalAttributes(attributes, metric = false) {
+	return attributes.flatMap(({ key, value }) => {
+		if (metric && !MINIMAL_METRIC_LABELS.has(key)) return [];
+		const text = value.stringValue;
+		const number = value.doubleValue ?? value.intValue;
+		if (MINIMAL_NUMBERS.has(key) && typeof number === "number" && Number.isFinite(number)) return [{
+			key,
+			value: { doubleValue: number }
+		}];
+		if (typeof text !== "string") return [];
+		return minimalStringValue(key, text) ? [{
+			key,
+			value: { stringValue: text }
+		}] : [];
+	});
+}
+//#endregion
+//#region ../observability/src/engineering/metric-points.ts
+const finiteProtocolNumber = (value) => typeof value === "number" && Number.isFinite(value) ? value : void 0;
+const protocolCount = (value, maximum = Number.MAX_SAFE_INTEGER) => typeof value === "number" && Number.isSafeInteger(value) && value >= 0 && value <= maximum ? value : void 0;
+const protocolFlags = (value) => protocolCount(Object.getOwnPropertyDescriptor(value, "flags")?.value, 4294967295);
+function protocolTime(value) {
+	if (typeof value === "string" && /^\d{1,20}$/u.test(value) && BigInt(value) <= 18446744073709551615n) return value;
+	const number = protocolCount(value);
+	if (number !== void 0) return String(number);
+	if (value === null || typeof value !== "object") return void 0;
+	const low = protocolCount(Object.getOwnPropertyDescriptor(value, "low")?.value, 4294967295);
+	const high = protocolCount(Object.getOwnPropertyDescriptor(value, "high")?.value, 4294967295);
+	return low === void 0 || high === void 0 ? void 0 : (BigInt(high) << 32n | BigInt(low)).toString();
+}
+function minimalNumberPoints(points) {
+	return points.flatMap((point) => {
+		const attributes = minimalAttributes(point.attributes, true);
+		const asDouble = finiteProtocolNumber(point.asDouble);
+		const asInt = typeof point.asInt === "number" && Number.isSafeInteger(point.asInt) ? point.asInt : void 0;
+		if (attributes.length !== point.attributes.length || asDouble === void 0 && asInt === void 0) return [];
+		return [{
+			attributes,
+			timeUnixNano: protocolTime(point.timeUnixNano),
+			startTimeUnixNano: protocolTime(point.startTimeUnixNano),
+			asDouble,
+			asInt: asDouble === void 0 ? asInt : void 0,
+			flags: protocolFlags(point)
+		}];
+	});
+}
+function minimalHistogramPoints(points) {
+	return points.flatMap((point) => {
+		const attributes = minimalAttributes(point.attributes ?? [], true);
+		const count = protocolCount(point.count);
+		const bucketCounts = point.bucketCounts;
+		const explicitBounds = point.explicitBounds;
+		if (attributes.length !== (point.attributes?.length ?? 0) || count === void 0 || !Array.isArray(bucketCounts) || !bucketCounts.every((value) => protocolCount(value) !== void 0) || !Array.isArray(explicitBounds) || !explicitBounds.every((value) => finiteProtocolNumber(value) !== void 0) || bucketCounts.length !== explicitBounds.length + 1) return [];
+		return [{
+			attributes,
+			timeUnixNano: protocolTime(point.timeUnixNano),
+			startTimeUnixNano: protocolTime(point.startTimeUnixNano),
+			count,
+			sum: finiteProtocolNumber(point.sum),
+			min: finiteProtocolNumber(point.min),
+			max: finiteProtocolNumber(point.max),
+			bucketCounts: bucketCounts.map((value) => value),
+			explicitBounds: explicitBounds.map((value) => value),
+			flags: protocolFlags(point)
+		}];
+	});
+}
+//#endregion
+//#region ../observability/src/engineering/serialization.ts
+function minimalSerialization(config) {
+	const service = config.serviceName ?? "capxul-sdk";
+	const resource = { attributes: Object.entries({
+		"service.name": service,
+		"service.version": config.sdkVersion,
+		sdk_version: config.sdkVersion,
+		capxul_env: config.capxulEnv,
+		producer: config.producer
+	}).map(([key, value]) => ({
+		key,
+		value: { stringValue: value }
+	})) };
+	return {
+		logs: (data) => HttpBody.jsonUnsafe({ resourceLogs: data.resourceLogs.map((entry) => ({
+			resource,
+			scopeLogs: entry.scopeLogs.map((scope) => ({
+				scope: { name: service },
+				logRecords: (scope.logRecords ?? []).map((record) => ({
+					timeUnixNano: protocolTime(record.timeUnixNano),
+					observedTimeUnixNano: protocolTime(record.observedTimeUnixNano),
+					severityNumber: protocolCount(record.severityNumber, 24),
+					severityText: [
+						"All",
+						"Trace",
+						"Debug",
+						"Info",
+						"Warn",
+						"Error",
+						"Fatal",
+						"None"
+					].includes(record.severityText ?? "") ? record.severityText : void 0,
+					body: { stringValue: minimalName(record.body?.stringValue) },
+					attributes: minimalAttributes(record.attributes),
+					droppedAttributesCount: protocolCount(record.droppedAttributesCount) ?? 0,
+					traceId: traceId(record.traceId) ? record.traceId : void 0,
+					spanId: spanId(record.spanId) ? record.spanId : void 0,
+					flags: protocolFlags(record)
+				}))
+			}))
+		})) }),
+		traces: (data) => HttpBody.jsonUnsafe({ resourceSpans: data.resourceSpans.map((entry) => ({
+			resource,
+			scopeSpans: entry.scopeSpans.map((scope) => ({
+				scope: { name: service },
+				spans: scope.spans.filter((span) => traceId(span.traceId) && spanId(span.spanId)).map((span) => {
+					const attributes = minimalAttributes(span.attributes);
+					const code = attributes.find((attribute) => attribute.key === "error.code");
+					return {
+						traceId: span.traceId,
+						spanId: span.spanId,
+						name: minimalName(span.name),
+						kind: protocolCount(span.kind, 5) ?? 0,
+						startTimeUnixNano: protocolTime(span.startTimeUnixNano),
+						endTimeUnixNano: protocolTime(span.endTimeUnixNano),
+						attributes,
+						droppedAttributesCount: protocolCount(span.droppedAttributesCount) ?? 0,
+						parentSpanId: spanId(span.parentSpanId) ? span.parentSpanId : void 0,
+						flags: protocolFlags(span),
+						status: { code: protocolCount(span.status.code, 2) ?? 0 },
+						events: span.events.slice(0, 8).map((event) => ({
+							timeUnixNano: protocolTime(event.timeUnixNano),
+							droppedAttributesCount: protocolCount(event.droppedAttributesCount) ?? 0,
+							name: event.name === "exception" ? "exception" : minimalName(event.name),
+							attributes: event.name === "exception" ? [{
+								key: "exception.type",
+								value: code?.value ?? { stringValue: "Error" }
+							}] : minimalAttributes(event.attributes)
+						})),
+						droppedEventsCount: protocolCount(span.droppedEventsCount) ?? 0,
+						links: span.links.filter((link) => traceId(link.traceId) && spanId(link.spanId)).slice(0, 8).map((link) => ({
+							traceId: link.traceId,
+							spanId: link.spanId,
+							flags: protocolFlags(link),
+							attributes: minimalAttributes(link.attributes),
+							droppedAttributesCount: protocolCount(link.droppedAttributesCount) ?? 0
+						})),
+						droppedLinksCount: protocolCount(span.droppedLinksCount) ?? 0
+					};
+				})
+			}))
+		})) }),
+		metrics: (data) => {
+			const resourceMetrics = data.resourceMetrics.map((entry) => ({
+				resource,
+				scopeMetrics: entry.scopeMetrics.map((scope) => ({
+					scope: { name: service },
+					metrics: scope.metrics.filter((metric) => MINIMAL_METRIC_NAMES.has(metric.name)).flatMap((metric) => {
+						const gauge = metric.gauge === void 0 ? void 0 : { dataPoints: minimalNumberPoints(metric.gauge.dataPoints) };
+						const sum = metric.sum === void 0 ? void 0 : {
+							aggregationTemporality: protocolCount(metric.sum.aggregationTemporality, 2) ?? 0,
+							isMonotonic: metric.sum.isMonotonic,
+							dataPoints: minimalNumberPoints(metric.sum.dataPoints)
+						};
+						const histogram = metric.histogram === void 0 ? void 0 : {
+							aggregationTemporality: protocolCount(metric.histogram.aggregationTemporality, 2) ?? 0,
+							dataPoints: minimalHistogramPoints(metric.histogram.dataPoints)
+						};
+						if (![
+							gauge,
+							sum,
+							histogram
+						].some((series) => (series?.dataPoints.length ?? 0) > 0)) return [];
+						return [{
+							name: metric.name,
+							unit: [
+								"1",
+								"s",
+								"ms"
+							].includes(metric.unit ?? "") ? metric.unit : "1",
+							...gauge === void 0 ? {} : { gauge },
+							...sum === void 0 ? {} : { sum },
+							...histogram === void 0 ? {} : { histogram }
+						}];
+					})
+				}))
+			}));
+			return resourceMetrics.some((entry) => entry.scopeMetrics.some((scope) => scope.metrics.length > 0)) ? HttpBody.jsonUnsafe({ resourceMetrics }) : HttpBody.empty;
+		}
+	};
+}
+Effect.flatMap(OtlpExporter.Flusher, (flusher) => flusher.flush);
+var EngineeringLog = class extends Context.Service()("capxul/EngineeringLog") {};
+//#endregion
+//#region ../observability/src/engineering.ts
+/** Shared browser/server OTLP layer. OtlpLogger merges with incumbent loggers once. */
+const makeEngineeringTelemetryLayer = (config) => {
+	const validated = validateEngineeringTelemetryConfig(config);
+	return Layer.suspend(() => {
+		const bounded = validated.deliveryBudget === void 0 ? void 0 : cliEngineeringDelivery(validated.deliveryBudget, validated.serviceName === "capxul-cli");
+		const endpoints = postHogOtlpEndpoints(validated.host);
+		let disabled = false;
+		const enabled = () => {
+			if (disabled) return false;
+			try {
+				disabled = (typeof validated.enabled === "function" ? validated.enabled() : validated.enabled ?? true) !== true;
+			} catch {
+				disabled = true;
+			}
+			return !disabled;
+		};
+		const delivery = {
+			...validated.shutdownTimeout === void 0 ? {} : { shutdownTimeout: validated.shutdownTimeout },
+			...validated.exportInterval === void 0 ? {} : { exportInterval: validated.exportInterval },
+			...bounded === void 0 ? {} : {
+				maxBatchSize: Number.MAX_SAFE_INTEGER,
+				exportInterval: 1e3,
+				shutdownTimeout: validated.serviceName === "capxul-cli" ? 0 : 500
+			}
+		};
+		const resource = {
+			serviceName: validated.serviceName ?? "capxul-sdk",
+			serviceVersion: validated.sdkVersion,
+			attributes: {
+				capxul_env: validated.capxulEnv,
+				producer: validated.producer,
+				sdk_version: validated.sdkVersion
+			}
+		};
+		const tracing = Layer.effect(Tracer.Tracer, OtlpTracer.make({
+			url: endpoints.traces,
+			headers: validated.headers,
+			resource,
+			...delivery
+		}).pipe(Effect.map((tracer) => makeLeakSafeEngineeringTracer(bounded?.tracer(tracer) ?? tracer, enabled)))).pipe(Layer.provideMerge(OtlpExporter.layerFlusher));
+		const ownedLogging = Layer.effect(EngineeringLog, OtlpLogger.make({
+			url: endpoints.logs,
+			headers: validated.headers,
+			resource,
+			...delivery,
+			...bounded === void 0 ? {} : { excludeLogSpans: true }
+		}).pipe(Effect.map((nativeLogger) => {
+			const logger = bounded?.logger(nativeLogger) ?? nativeLogger;
+			return Logger.make((options) => {
+				if (enabled()) logger.log(options);
+			});
+		}))).pipe(Layer.provideMerge(OtlpExporter.layerFlusher));
+		const logging = Logger.layer([EngineeringLog], { mergeWithExisting: true }).pipe(Layer.provideMerge(ownedLogging));
+		const metricConfig = {
+			url: endpoints.metrics,
+			headers: validated.headers,
+			resource,
+			temporality: "delta",
+			...delivery
+		};
+		const metrics = bounded === void 0 ? OtlpMetrics.layer(metricConfig) : validated.serviceName !== "capxul-cli" ? Layer.empty : Layer.effectDiscard(Effect.gen(function* () {
+			const flusher = yield* OtlpExporter.Flusher;
+			yield* OtlpMetrics.make({
+				...metricConfig,
+				exportInterval: Number.POSITIVE_INFINITY,
+				shutdownTimeout: 0
+			}).pipe(Effect.provideService(OtlpExporter.Flusher, {
+				...flusher,
+				register: (run) => flusher.register(bounded.metrics(run))
+			}));
+		})).pipe(Layer.provideMerge(OtlpExporter.layerFlusher));
+		const headerPolicy = Layer.merge(Layer.succeed(HttpClient.TracerHeaderFilter, traceHeaderFilter), Layer.succeed(Headers.CurrentRedactedNames, [credentialHeaderPattern]));
+		const browserLifecycle = Layer.effectDiscard(Effect.gen(function* () {
+			if (validated.producer !== "browser" || !hasBrowserDocument()) return;
+			const browserWindow = window;
+			const browserDocument = document;
+			const flusher = yield* OtlpExporter.Flusher;
+			const run = yield* FiberSet.makeRuntime();
+			const flush = () => {
+				run(flusher.flush);
+			};
+			const visibilityChanged = () => {
+				if (browserDocument.visibilityState === "hidden") flush();
+			};
+			yield* Effect.acquireRelease(Effect.sync(() => {
+				browserDocument.addEventListener("visibilitychange", visibilityChanged);
+				browserWindow.addEventListener("pagehide", flush);
+			}), () => Effect.sync(() => {
+				browserDocument.removeEventListener("visibilitychange", visibilityChanged);
+				browserWindow.removeEventListener("pagehide", flush);
+			}));
+		}));
+		const transport = Layer.effect(HttpClient.HttpClient, Effect.map(HttpClient.HttpClient, (client) => {
+			const originalTransport = validated.producer === "browser" && hasBrowserDocument() ? browserExportClient(client) : client;
+			const selectedTransport = bounded?.transport(originalTransport, enabled) ?? originalTransport;
+			return HttpClient.transform(selectedTransport, (response, request) => Effect.suspend(() => {
+				if (enabled() && request.body._tag !== "Empty") return response;
+				bounded?.discardBody(request.body);
+				return Effect.succeed(HttpClientResponse.fromWeb(request, new Response(null, { status: 200 })));
+			}));
+		})).pipe(Layer.provide(FetchHttpClient.layer));
+		const serialization = Layer.effect(OtlpSerialization.OtlpSerialization, Effect.map(OtlpSerialization.OtlpSerialization, (json) => {
+			const projected = minimalSerialization(validated);
+			const selected = validated.privacy === "minimal" ? projected : {
+				...json,
+				metrics: projected.metrics
+			};
+			return bounded?.serialization(selected) ?? selected;
+		})).pipe(Layer.provide(OtlpSerialization.layerJson));
+		const combined = browserLifecycle.pipe(Layer.provideMerge(Layer.mergeAll(tracing, logging, metrics, headerPolicy)), Layer.provide(serialization), Layer.provide(transport));
+		const scoped = bounded === void 0 ? combined : combined.pipe(Layer.provideMerge(Layer.effectDiscard(Effect.addFinalizer(() => Effect.sync(bounded.close)))));
+		return validated.deliveryBudget === void 0 ? scoped : scoped.pipe(Layer.provideMerge(Layer.succeed(Metric.MetricRegistry, validated.serviceName === "capxul-cli" ? validated.deliveryBudget.metricRegistry : validated.deliveryBudget.emptyMetricRegistry())));
+	});
+};
+function derivedBrowserOrigin(runtime) {
+	if (runtime !== "browser") throw Errors.invalidInput("origin", "required outside browser runtime");
+	const origin = readField(readField(globalThis, "location"), "origin");
+	if (typeof origin === "string" && origin.length > 0) return origin;
+	throw Errors.invalidInput("origin", "required when browser location is unavailable");
+}
+/**
+* Browser local dev serves `/api/auth` via the Vite proxy on `window.location.origin`
+* while bootstrap returns the remote Convex site host. Openfort wallet setup reads
+* Better Auth cookies from `get-session` — those only attach on the same origin the
+* OTP flow used, so rewrite when hosts differ.
+*/
+function resolveBrowserAuthBaseUrl(input) {
+	if (input.override !== void 0) return normalizeHttpUrl("authBaseUrl", input.override);
+	const bootstrapUrl = normalizeHttpUrl("authBaseUrl", input.bootstrapAuthBaseUrl);
+	if (input.runtime !== "browser") return bootstrapUrl;
+	try {
+		const localAuthBase = normalizeHttpUrl("authBaseUrl", `${derivedBrowserOrigin(input.runtime)}/api/auth`);
+		const remoteAuthBase = bootstrapUrl.endsWith("/api/auth") ? bootstrapUrl : `${bootstrapUrl}/api/auth`;
+		if (new URL(remoteAuthBase).host !== new URL(localAuthBase).host) return localAuthBase;
+		return bootstrapUrl;
+	} catch {
+		return bootstrapUrl;
+	}
+}
+function resolveRuntimeUrls(bootstrap, runtime, authBaseUrlOverride) {
+	try {
+		return {
+			ok: true,
+			value: {
+				authBaseUrl: resolveBrowserAuthBaseUrl({
+					bootstrapAuthBaseUrl: bootstrap.authBaseUrl,
+					runtime,
+					...authBaseUrlOverride === void 0 ? {} : { override: authBaseUrlOverride }
+				}),
+				convexUrl: normalizeHttpUrl("convexUrl", bootstrap.convexUrl)
+			}
+		};
+	} catch (cause) {
+		return {
+			ok: false,
+			error: toPublicError(cause)
+		};
+	}
+}
+function normalizeHttpUrl(field, raw) {
+	let parsed;
+	try {
+		parsed = new URL(raw);
+	} catch {
+		throw Errors.invalidInput(field, "must be an http or https URL");
+	}
+	if (parsed.protocol !== "http:" && parsed.protocol !== "https:") throw Errors.invalidInput(field, "must be an http or https URL");
+	return parsed.toString().replace(/\/$/, "");
+}
+//#endregion
+//#region src/platform/production-ports.ts
+function productionBootstrapPortLayer(bootstrap) {
+	return Layer.succeed(BootstrapPortTag, bootstrap);
+}
+function productionAuthClientLayer(input, refreshConvexAuthRef, resetSignerSessionRef) {
+	return (input.authClient !== void 0 ? Layer.succeed(AuthClientPortTag, input.authClient) : input.runtime === "browser" ? BetterAuthBrowserLayer({
+		authBaseUrl: input.runtimeUrls.authBaseUrl,
+		...input.fetch === void 0 ? {} : { fetch: input.fetch },
+		...input.observation === void 0 ? {} : { observation: input.observation }
+	}) : BetterAuthNodeLayer({
+		...input.nodeSessionStorage === void 0 ? {} : { nodeSessionStorage: input.nodeSessionStorage },
+		authBaseUrl: input.runtimeUrls.authBaseUrl,
+		...input.origin === void 0 ? {} : { origin: input.origin },
+		...input.fetch === void 0 ? {} : { fetch: input.fetch },
+		...input.observation === void 0 ? {} : { observation: input.observation }
+	})).pipe(Layer.flatMap((context) => {
+		const refreshed = refreshConvexAuthOnSession(Context.get(context, AuthClientPortTag), () => {
+			const refresh = refreshConvexAuthRef.current;
+			if (refresh === null) {
+				refreshConvexAuthRef.pending = true;
+				return;
+			}
+			refresh();
+		});
+		return Layer.succeedContext(Context.make(AuthClientPortTag, resetSignerSessionRef === void 0 ? refreshed : resetSignerSessionOnSignOut(refreshed, resetSignerSessionRef)));
+	}));
+}
+function productionAuthCacheLayer(input) {
+	return Layer.succeed(AuthCachePortTag, input.authCache ?? detectAuthCacheAdapter());
+}
+function productionConvexCallLayer(input, refreshConvexAuthRef) {
+	return Layer.unwrap(Effect.map(AuthClientPortTag, (authClient) => ConvexCallLayer({
+		convexUrl: input.runtimeUrls.convexUrl,
+		localDiagnostics: input.localDiagnostics,
+		...input.applicationId === void 0 ? {} : { applicationId: input.applicationId },
+		...input.observation === void 0 ? {} : { observation: input.observation },
+		...input.convexClient === void 0 ? {} : { client: input.convexClient },
+		tokenProvider: async ({ forceRefreshToken }) => {
+			const tokenResult = await Effect.runPromise(Effect.result(authClient.getConvexJwt({
+				forceRefresh: forceRefreshToken,
+				...input.signal === void 0 ? {} : { signal: input.signal }
+			})));
+			if (Result.isFailure(tokenResult)) return null;
+			return String(tokenResult.success.token);
+		}
+	}).pipe(Layer.flatMap((context) => {
+		const convexCall = Context.get(context, ConvexCallPortTag);
+		if (isRefreshableConvexCallPort(convexCall)) {
+			refreshConvexAuthRef.current = () => convexCall.refreshAuth();
+			if (refreshConvexAuthRef.pending) {
+				refreshConvexAuthRef.pending = false;
+				refreshConvexAuthRef.current();
+			}
+		}
+		return Layer.succeedContext(context);
+	}))));
+}
+function isRefreshableConvexCallPort(convexCall) {
+	return "refreshAuth" in convexCall && typeof convexCall.refreshAuth === "function";
+}
+function optionalEngineeringTelemetryLayer(policy, runtime, hostPolicy) {
+	if (policy === void 0) return Layer.empty;
+	try {
+		return makeEngineeringTelemetryLayer({
+			host: policy.host,
+			headers: { authorization: `Bearer ${policy.projectToken}` },
+			capxulEnv: policy.capxulEnv,
+			producer: runtime === "browser" ? "browser" : "server",
+			sdkVersion: SDK_VERSION,
+			...hostPolicy
+		});
+	} catch {
+		return Layer.empty;
+	}
+}
+function localDiagnosticsLayer(enabled, runtime) {
+	if (!enabled) return Logger.layer([]);
+	return runtime === "node" ? Layer.succeed(Logger.LogToStderr, true) : Layer.empty;
+}
+function productionLocalDiagnostics(input) {
+	return input.localDiagnostics !== false;
+}
+/**
+* Build the Ponder read port for this client, or `undefined` when no indexer
+* origin was supplied. The token provider is the same
+* `AuthClientPort.getConvexJwt` closure `ConvexCallPort` uses, so the indexer
+* and Convex see one session with one scope.
+*/
+function productionIndexerReadPort(input, ports, observation) {
+	if (input.activityReadSource === "convex") return void 0;
+	if (input.indexerUrl === void 0 || input.indexerUrl === "") return void 0;
+	const baseUrl = normalizeHttpUrl("indexerUrl", input.indexerUrl);
+	return new PonderIndexerAdapter({
+		baseUrl,
+		token: async ({ forceRefreshToken, signal }) => {
+			const tokenSignal = input.signal === void 0 ? signal : signal === void 0 ? input.signal : AbortSignal.any([input.signal, signal]);
+			const token = await Effect.runPromise(Effect.result(ports.authClient.getConvexJwt({
+				forceRefresh: forceRefreshToken,
+				...tokenSignal === void 0 ? {} : { signal: tokenSignal }
+			})));
+			if (Result.isFailure(token)) throw toPublicError(token.failure);
+			return String(token.success.token);
+		},
+		...input.fetch === void 0 ? {} : { fetch: input.fetch },
+		...observation === void 0 ? {} : { observation }
+	});
+}
+//#endregion
+//#region src/platform/production-layers.ts
+/**
+* Project the built graph into the flat `FlowPorts` record the method bundles
+* still take. It is a VIEW of `ProductionAdapters.context`, taken from the
+* graph and never instead of it — the graph stays alive in the scope and is
+* handed to every caller.
+*/
+const collectProductionFlowPorts = Effect.gen(function* () {
+	const authClient = yield* AuthClientPortTag;
+	const authCache = yield* AuthCachePortTag;
+	const bootstrap = yield* BootstrapPortTag;
+	const clock = yield* ClockPortTag;
+	const convexCall = yield* ConvexCallPortTag;
+	return {
+		authClient,
+		authCache,
+		identity: yield* IdentityPortTag,
+		smartAccount: yield* SmartAccountPortTag,
+		accountRead: yield* AccountReadPortTag,
+		bootstrap,
+		clock,
+		telemetry: yield* TelemetryPortTag,
+		convexCall
+	};
+});
+/**
+* The production port graph. Every port is named here once, so a port left
+* out does not compile: the return type requires all of them.
+*
+* Phase 1: authClient -> convexCall. The auth wrapper reads
+* RefreshConvexAuthRef at call time, after the convex layer registers the
+* concrete refreshAuth callback during construction. Phase 2: the ready
+* convexCall (and telemetry, for the reads that observe) -> the Convex-backed
+* domain ports. A layer used twice is built once.
+*/
+function makeProductionAdapterLayer(input) {
+	const refreshConvexAuthRef = {
+		current: null,
+		pending: false
+	};
+	const authClient = productionAuthClientLayer(input, refreshConvexAuthRef, input.resetSignerSession);
+	const convexCall = productionConvexCallLayer(input, refreshConvexAuthRef).pipe(Layer.provide(authClient));
+	const telemetry = input.telemetry === void 0 ? PostHogTelemetryLayer({ capture: () => void 0 }) : Layer.succeed(TelemetryPortTag, input.telemetry);
+	const observedConvexCall = Layer.merge(convexCall, telemetry);
+	const org = Layer.effect(OrgPortTag, Effect.all([ConvexCallPortTag, TelemetryPortTag]).pipe(Effect.map(([convex, telemetryPort]) => new ConvexOrganizationAdapter({
+		convex,
+		telemetry: telemetryPort
+	}))));
+	return Layer.mergeAll(productionBootstrapPortLayer(input.bootstrap), authClient, productionAuthCacheLayer(input), ConvexIdentityLayer.pipe(Layer.provide(convexCall)), ConvexSmartAccountLayer.pipe(Layer.provide(convexCall)), ConvexAccountLayer().pipe(Layer.provide(observedConvexCall)), SystemClockLayer, telemetry, convexCall, org.pipe(Layer.provide(observedConvexCall)));
+}
+//#endregion
+//#region src/platform/production-input.ts
+function validateCreateCapxulClientInput(input) {
+	const runtime = input.runtime ?? detectRuntime();
+	if (input.signer !== void 0 && input.openfortSignerFactory !== void 0) return {
+		ok: false,
+		error: Errors.invalidInput("signer", "choose signer or openfortSignerFactory")
+	};
+	if (input.nodeSessionStorage !== void 0 && runtime === "browser") return {
+		ok: false,
+		error: Errors.invalidInput("nodeSessionStorage", "is only supported in Node")
+	};
+	if ((input.requirement ?? "none") === "deployed" && input.signer === void 0 && input.openfortSignerFactory === void 0 && runtime !== "browser") return {
+		ok: false,
+		error: Errors.invalidInput("signer", "required when requirement is \"deployed\"")
+	};
+	return {
+		ok: true,
+		value: void 0
+	};
+}
+function detectRuntime() {
+	return readField(globalThis, "window") !== void 0 || readField(globalThis, "document") !== void 0 ? "browser" : "node";
+}
+//#endregion
+//#region src/platform/production-bootstrap.ts
+function resolveInput(input) {
+	try {
+		const runtime = input.runtime ?? detectRuntime();
+		const publishableKey = toPublishableKey(input.publishableKey);
+		const origin = input.origin === void 0 ? runtime === "browser" ? toAllowedOrigin(derivedBrowserOrigin(runtime)) : void 0 : toAllowedOrigin(input.origin);
+		return {
+			ok: true,
+			value: {
+				publishableKey,
+				...origin === void 0 ? {} : { origin },
+				bootstrapBaseUrl: normalizeHttpUrl("bootstrapBaseUrl", input.bootstrapBaseUrl ?? (runtime === "browser" ? derivedBrowserOrigin(runtime) : "https://api.staging.capxul.com")),
+				runtime
+			}
+		};
+	} catch (cause) {
+		return {
+			ok: false,
+			error: toPublicError(cause)
+		};
+	}
+}
+async function runBootstrap(effect) {
+	const result = await Effect.runPromise(Effect.result(effect));
+	if (Result.isSuccess(result)) return {
+		ok: true,
+		value: result.success
+	};
+	return {
+		ok: false,
+		error: toPublicError(result.failure)
+	};
+}
+/**
+* Bootstrap-event props. `runtime` used to be called `capxulEnv`, which was a
+* name collision, not a value: it carried "browser"/"node", never an
+* environment. ADR-0020 A1 makes `capxul_env` the environment discriminator
+* every synced artifact filters on, so this field was renamed to what it
+* actually is. `sdk_version` follows the canon envelope spelling.
+*/
+function bootstrapTelemetryEnvelope(input, resolvedInput) {
+	return {
+		runtime: resolvedInput.runtime,
+		env: input.requirement ?? "none",
+		...resolvedInput.origin === void 0 ? {} : { origin: resolvedInput.origin },
+		sdk_version: SDK_VERSION
+	};
+}
+async function emitBootstrapTelemetry(telemetry, event) {
+	if (telemetry === void 0) return;
+	await Effect.runPromise(telemetry.emit(event).pipe(Effect.catchDefect(() => Effect.void)));
+}
+//#endregion
+//#region src/platform/production-adapters.ts
+async function createProductionAdapters(input) {
+	const localDiagnostics = productionLocalDiagnostics(input);
+	const { observation, telemetry, invocationObservation, invocationTelemetry } = resolveProductionObservability(input);
+	const resolvedInput = resolveInput(input);
+	if (!resolvedInput.ok) return resolvedInput;
+	const scope = await Effect.runPromise(Scope.make());
+	const closeScope = idempotentClose(() => Effect.runPromise(Scope.close(scope, Exit.void)));
+	const bootstrapLayer = HttpBootstrapLayer({
+		bootstrapBaseUrl: resolvedInput.value.bootstrapBaseUrl,
+		...input.fetch === void 0 ? {} : { fetch: input.fetch },
+		...invocationObservation === void 0 ? {} : { observation: invocationObservation },
+		...input.bootstrapCache === void 0 ? {} : { cache: input.bootstrapCache }
+	});
+	try {
+		const bootstrapContext = await Effect.runPromise(Layer.buildWithScope(bootstrapLayer, scope));
+		const bootstrap = Context.get(bootstrapContext, BootstrapPortTag);
+		const bootstrapResult = await runBootstrap(bootstrap.resolve({
+			publishableKey: resolvedInput.value.publishableKey,
+			...resolvedInput.value.origin === void 0 ? {} : { origin: resolvedInput.value.origin }
+		}));
+		if (!bootstrapResult.ok) {
+			await emitBootstrapTelemetry(invocationTelemetry, {
+				name: "bootstrap_failed",
+				props: {
+					...bootstrapTelemetryEnvelope(input, resolvedInput.value),
+					reason: bootstrapResult.error.code,
+					...failureDetail(bootstrapResult.error),
+					...failureEvidenceProps(bootstrapResult.error)
+				}
+			});
+			await closeScope().catch(() => void 0);
+			return bootstrapResult;
+		}
+		const chainFence = assertDevKeySignerIsTestnetOnly(input.signer, bootstrapResult.value.chainId);
+		if (!chainFence.ok) {
+			await closeScope().catch(() => void 0);
+			return chainFence;
+		}
+		const runtimeUrlsResult = resolveRuntimeUrls(bootstrapResult.value, resolvedInput.value.runtime, input.authBaseUrl);
+		if (!runtimeUrlsResult.ok) {
+			await emitBootstrapTelemetry(invocationTelemetry, {
+				name: "bootstrap_failed",
+				props: {
+					...bootstrapTelemetryEnvelope(input, resolvedInput.value),
+					applicationId: bootstrapResult.value.applicationId,
+					reason: runtimeUrlsResult.error.code
+				}
+			});
+			await closeScope().catch(() => void 0);
+			return runtimeUrlsResult;
+		}
+		const runtimeUrls = runtimeUrlsResult;
+		await emitBootstrapTelemetry(invocationTelemetry, {
+			name: "bootstrap_resolved",
+			props: {
+				...bootstrapTelemetryEnvelope(input, resolvedInput.value),
+				applicationId: bootstrapResult.value.applicationId
+			}
+		});
+		let injectedClient;
+		const convexClientFactory = input.convexClientFactory;
+		if (convexClientFactory !== void 0) try {
+			injectedClient = convexClientFactory(runtimeUrls.value.convexUrl);
+		} catch (cause) {
+			await closeScope().catch(() => void 0);
+			return {
+				ok: false,
+				error: toPublicError(cause)
+			};
+		}
+		const portsLayer = makeProductionAdapterLayer({
+			bootstrap,
+			runtime: resolvedInput.value.runtime,
+			localDiagnostics,
+			...resolvedInput.value.origin === void 0 ? {} : { origin: resolvedInput.value.origin },
+			runtimeUrls: runtimeUrls.value,
+			chainId: bootstrapResult.value.chainId,
+			applicationId: bootstrapResult.value.applicationId,
+			...observation === void 0 ? {} : { observation },
+			...input.nodeSessionStorage === void 0 ? {} : { nodeSessionStorage: input.nodeSessionStorage },
+			...input.authCache === void 0 ? {} : { authCache: input.authCache },
+			...input.authClient === void 0 ? {} : { authClient: input.authClient },
+			...telemetry === void 0 ? {} : { telemetry },
+			...injectedClient === void 0 ? {} : { convexClient: injectedClient },
+			...input.fetch === void 0 ? {} : { fetch: input.fetch },
+			...input.signal === void 0 ? {} : { signal: input.signal },
+			...input.resetSignerSession === void 0 ? {} : { resetSignerSession: input.resetSignerSession }
+		});
+		const applicationLayer = Layer.merge(portsLayer, optionalEngineeringTelemetryLayer(bootstrapResult.value.engineeringTelemetry, resolvedInput.value.runtime, hostEngineeringPolicy(input.observability))).pipe(Layer.provideMerge(localDiagnosticsLayer(localDiagnostics, resolvedInput.value.runtime)));
+		const context = await Effect.runPromise(Layer.buildWithScope(applicationLayer, scope));
+		const collected = await Effect.runPromise(collectProductionFlowPorts.pipe(Effect.provide(context)));
+		const indexerUrl = input.indexerUrl ?? bootstrapResult.value.indexerUrl;
+		const indexerRead = productionIndexerReadPort(indexerUrl === void 0 ? input : {
+			...input,
+			indexerUrl
+		}, collected, observation);
+		const ports = indexerRead === void 0 ? collected : {
+			...collected,
+			indexerRead
+		};
+		const stopConnectionObservation = observeProductionConvexConnection(ports.convexCall, context);
+		const close = idempotentClose(async () => {
+			try {
+				stopConnectionObservation();
+			} finally {
+				await closeScope();
+			}
+		});
+		return {
+			ok: true,
+			value: {
+				context,
+				ports,
+				bootstrap: bootstrapResult.value,
+				close
+			}
+		};
+	} catch (cause) {
+		await closeScope().catch(() => void 0);
+		return {
+			ok: false,
+			error: toPublicError(cause)
+		};
+	}
+}
+function idempotentClose(close) {
+	let closed = false;
+	return async () => {
+		if (closed) return;
+		closed = true;
+		await close();
+	};
+}
+//#endregion
+//#region src/platform/client/financial-ops.ts
+function makeFinancialOpsMethods(deps) {
+	return {
+		me: makeMeMethods(deps),
+		targets: makeTargetsMethods(deps),
+		destinations: makeDestinationsMethods(deps),
+		payments: makePaymentsMethods(deps),
+		approvals: makeApprovalsMethods(deps),
+		activity: makeActivityMethods(deps),
+		offramp: makeOfframpMethods(),
+		paymentDocuments: makePaymentDocumentsMethods(deps)
+	};
+}
+//#endregion
+//#region src/media/images.ts
+/** The upload POST failed: the storage provider, not the row, refused. */
+function uploadFailed(cause) {
+	return {
+		ok: false,
+		error: Errors.providerError("convex-storage", "uploadImage", cause)
+	};
+}
+/** The storage id the upload response names, if it names one. */
+function storageIdOf(body) {
+	const storageId = readField(body, "storageId");
+	return typeof storageId === "string" && storageId.length > 0 ? storageId : void 0;
+}
+function makeMediaMethods(deps) {
+	const fetchImpl = deps.fetch ?? ((input, init) => globalThis.fetch(input, init));
+	/** One observed call of one row, recorded under the row's name. */
+	const call = (row, args, options) => {
+		const controls = deps.invocationControls?.(options) ?? options;
+		return runCapxulEffect(callOperation(deps.convexCall, row, copyInvocationObservation(controls, args)), controls, row.name, deps.runPromise);
+	};
+	return {
+		async uploadImage(blob, options) {
+			const url = await call(images.generateUploadUrl, {}, options);
+			if (!url.ok) return url;
+			try {
+				const response = await fetchImpl(url.value.uploadUrl, {
+					method: "POST",
+					headers: { "Content-Type": blob.type },
+					body: blob,
+					...options?.signal === void 0 ? {} : { signal: options.signal }
+				});
+				if (!response.ok) return uploadFailed(`upload failed with status ${response.status}`);
+				const storageId = storageIdOf(await response.json());
+				if (storageId === void 0) return uploadFailed("upload response carried no storageId");
+				return {
+					ok: true,
+					value: { storageId }
+				};
+			} catch (cause) {
+				return uploadFailed(cause);
+			}
+		},
+		setProfileImage: (input, options) => call(images.setProfileImage, { storageId: input.storageId }, options),
+		setOrgLogo: (input, options) => call(images.setOrgLogo, {
+			orgId: input.orgId,
+			storageId: input.storageId
+		}, options)
+	};
+}
+//#endregion
+//#region src/operator/diagnostics.ts
+/** A W3C version-00 `traceparent` as the caller's span; anything else carries no parent. */
+const traceparentSpan = (traceparent) => {
+	const parts = traceparent.split("-");
+	const [version, traceId = "", spanId = "", flags = ""] = parts;
+	if (parts.length !== 4 || version !== "00" || !/^[0-9a-f]{32}$/iu.test(traceId) || !/^[0-9a-f]{16}$/iu.test(spanId)) return void 0;
+	return Tracer.externalSpan({
+		traceId,
+		spanId,
+		sampled: (Number.parseInt(flags, 16) & 1) === 1
+	});
+};
+function makeSystemMethods(deps) {
+	return { health: (nonce, options) => {
+		let controls = deps.invocationControls?.(options) ?? options;
+		const invocation = readInvocationObservation(controls);
+		const traceparent = invocation?.active === false ? void 0 : sanitizeObservationContext(invocation?.context)?.traceparent;
+		const parent = traceparent === void 0 ? void 0 : traceparentSpan(traceparent);
+		if (parent !== void 0) controls = carryInvocationParentSpan(controls, parent);
+		return runCapxulEffect(callOperation(deps.convexCall, diagnostics.health, copyInvocationObservation(controls, { nonce })), controls, diagnostics.health.name, deps.runPromise);
+	} };
+}
+//#endregion
+//#region src/platform/client/host-observation.ts
+function transitionError(record) {
+	const failure = record.failure;
+	if (failure?.error !== void 0) {
+		const error = failure.error;
+		if (record.correlation_id === void 0 || error.correlationId !== void 0) return error;
+		return new CapxulError(error.code, error.message, {
+			cause: error,
+			correlationId: record.correlation_id,
+			...error.details === void 0 ? {} : { details: error.details },
+			...error.layer === void 0 ? {} : { layer: error.layer }
+		});
+	}
+	return new CapxulError(record.error_code, failure?.message ?? "Identity work failed", {
+		...failure === void 0 ? {} : { cause: failure },
+		details: {
+			machine: record.machine,
+			state: record.state,
+			event: record.event,
+			slot: record.slot,
+			...failure?.mode === void 0 ? {} : { failure_mode: failure.mode }
+		},
+		...record.correlation_id === void 0 ? {} : { correlationId: record.correlation_id }
+	});
+}
+function withHostObservation(actor, snapshot) {
+	if (snapshot === void 0) return actor;
+	const controls = (input) => withHostObservationControls(snapshot, input, actor.authSession()?.authUserId);
+	return {
+		...actor,
+		ask: (event, input) => actor.ask(event, controls(input)),
+		tell: (event, input) => actor.tell(event, controls(input)),
+		restoreAuthSession: (session, input) => actor.restoreAuthSession(session, controls(input))
+	};
+}
+function withHostObservationControls(snapshot, input, actorId) {
+	const previous = readInvocationObservation(input);
+	if (previous !== void 0) return attachInvocationObservation({ ...input }, previous);
+	const captured = snapshot?.() ?? { active: true };
+	const context = captured.active ? withCapturedAttemptContext(captured.context, input) : captured.context;
+	return attachInvocationObservation({ ...input }, {
+		...captured,
+		...context === void 0 ? {} : { context },
+		...actorId === void 0 ? {} : { actorId }
+	});
+}
+//#endregion
+//#region src/platform/client/signer-readiness.ts
+/**
+* Start the signer readiness cycle when the identity becomes claimed (#1667).
+*
+* The cycle used to run only from the embedded-wallet port's `getAddress` and
+* `signRawDigest`. Nothing calls those after a sign-in or a session restore,
+* and `resetSession`, which every OTP verify performs, sets the status back to
+* `unknown`. Thus `client.signer.status()` never left `unknown` on a fresh
+* session, and each `.Actions` gate that requires `ready` stayed closed. A
+* claimed identity is the first point where the browser signer has a session to
+* recover. A signed-out client starts no cycle and reports `unknown`.
+*
+* The assembly does not await the call, on purpose: readiness must converge
+* without a signature. The cycle reports its own failure. It writes
+* `unavailable` to the same store the gate reads, and adds a DiagnosticPort
+* breadcrumb, and the next `getAddress` retries it, as before. The rejection is
+* thus observed and not discarded. A throw here would only cause an unhandled
+* rejection, and the actor shell removes an observer that throws.
+*
+* The `unknown` test holds this to ONE cycle per session. The call sets the
+* status to `recovering` synchronously, so the later claimed transitions of the
+* same session, such as the org lane, start no second cycle, and a
+* `resetSession` that sets the status back to `unknown` permits one more.
+*
+* ponytail: one cycle per claim. A cycle that fails stays `unavailable` until
+* a `getAddress` or a new claim, so a gate that refuses to sign while
+* `unavailable` needs a reload. Give the action part an explicit retry if that
+* becomes the common failure.
+*/
+function startSignerReadinessOnClaim(actor, signer) {
+	if (signer?.statusStore === void 0 || signer.ensureWalletReady === void 0) return () => {};
+	const browserSigner = signer;
+	return actor.subscribe((state) => {
+		if (state.phase !== "authenticated" || state.account.at !== "claimed") return;
+		if (browserSigner.statusStore?.status() !== "unknown") return;
+		browserSigner.ensureWalletReady?.().catch(() => {});
+	});
+}
+/**
+* Report the result of each signer readiness cycle (#1962 R04).
+*
+* The readiness store already carries the cycle boundary this needs, so no
+* public signer hook, second identity subscriber, or render counter is added.
+* `ensureOpenfortWalletReady` writes `recovering` synchronously when it starts
+* a cycle, and only the cycle that is still the current one writes `ready` or
+* `unavailable` (`create-openfort-browser-signer.ts:501-521`). Callers that
+* join a live cycle share that single write, and a `resetSession` writes
+* `unknown` first, so a cycle that a reset or an account replacement outran
+* reports nothing.
+*
+* The host context is bound when the cycle starts, so a person who signs out
+* and back in while a cycle runs cannot relabel the result that began under
+* the previous person. A signer with no readiness cycle — a node or dev key,
+* and a headless client whose requirement never opens the account lane —
+* writes no status and reports nothing.
+*/
+function observeSignerReadinessCycles(signer, telemetry, hostObservationSnapshot, runPromise) {
+	const statusStore = signer?.statusStore;
+	if (statusStore === void 0 || telemetry === void 0) return () => {};
+	let running = false;
+	let startContext;
+	return statusStore.subscribe((status) => {
+		if (status === "recovering") {
+			running = true;
+			startContext = hostObservationSnapshot?.();
+			return;
+		}
+		const cycleContext = startContext;
+		const completesCycle = running;
+		running = false;
+		startContext = void 0;
+		if (!completesCycle || status !== "ready" && status !== "unavailable") return;
+		const event = {
+			name: "access_recovery_completed",
+			props: {
+				recovery: "signer_readiness",
+				outcome: status
+			}
+		};
+		if (cycleContext !== void 0) attachInvocationObservation(event, cycleContext);
+		runPromise(Effect.suspend(() => bindProductTelemetryInvocation(telemetry, event).emit(event)).pipe(logDroppedEvent(event.name))).catch(() => {});
+	});
+}
+/**
+* A fresh OTP in the same browser tab reuses Openfort's localStorage and an
+* in-memory cached EOA unless the signer resets before the account lane runs.
+* Wallet readiness then starts on the fresh session, so Openfort's cycle (tens
+* of seconds on a new account) overlaps the profile and Organization forms
+* instead of running only when the claim finally asks for the signer address.
+*/
+function resetSignerForFreshSession(signer) {
+	if (signer === void 0 || !("resetSession" in signer) || typeof signer.resetSession !== "function") return;
+	try {
+		signer.resetSession();
+	} catch (cause) {
+		throw signerFailure(signer.source, "resetSession", cause);
+	}
+	if (signer.statusStore?.status() === "unknown" && typeof signer.ensureWalletReady === "function") signer.ensureWalletReady().catch(() => {});
+}
+//#endregion
+//#region src/platform/client/identity-runtime.ts
+/**
+* The identity runtime `_internal.identity` hands the React bindings: the
+* actor's state, its facade runner, raw sends that answer a refusal as a
+* value, and the onboarding profile write behind the same boundary grammar.
+*/
+function makeIdentityRuntime(actor, identityPort, runPromise) {
+	return {
+		snapshot: actor.snapshot,
+		subscribe: actor.subscribe,
+		subscribeTransitions: actor.subscribeTransitions,
+		runFacade: (verb, controls, run) => runIdentityFacade(verb, controls, run, runPromise),
+		async send(event, controls) {
+			try {
+				return {
+					ok: true,
+					state: await runPromise(actor.ask(event, controls))
+				};
+			} catch (cause) {
+				if (cause instanceof ActorFailure) return {
+					ok: false,
+					refused: cause.reason,
+					state: actor.snapshot()
+				};
+				throw cause;
+			}
+		},
+		async completeProfile(profile, controls) {
+			if (typeof profile !== "object" || profile === null || typeof profile.displayName !== "string" || typeof profile.country !== "string" || typeof profile.handle !== "string") return {
+				ok: false,
+				reason: "INVALID_INPUT"
+			};
+			const displayName = profile.displayName.trim();
+			if (displayName.length === 0) return {
+				ok: false,
+				reason: "INVALID_INPUT"
+			};
+			let country;
+			try {
+				country = toCountryCode(profile.country);
+			} catch {
+				return {
+					ok: false,
+					reason: "INVALID_INPUT"
+				};
+			}
+			const handle = profile.handle.trim();
+			if (handle.length === 0) return {
+				ok: false,
+				reason: "INVALID_INPUT"
+			};
+			const carried = checkProfileCarriage(profile);
+			if (!carried.ok) return {
+				ok: false,
+				reason: "INVALID_INPUT"
+			};
+			const session = actor.authSession();
+			if (session === null) return {
+				ok: false,
+				reason: "NOT_AUTHENTICATED"
+			};
+			const result = await runPortEffect(identityPort.completeOnboarding({
+				authUserId: session.authUserId,
+				email: session.email,
+				displayName,
+				country,
+				handle,
+				...carried.carriage
+			}), controls, onboardings.complete.name, runPromise);
+			return result.ok ? { ok: true } : {
+				ok: false,
+				reason: result.error.code,
+				error: result.error
+			};
+		}
+	};
+}
+//#endregion
+//#region src/platform/client/actor-lifetime.ts
+/**
+* Boot the identity actor in its own scope and attach every observer the
+* client keeps on it. `stopActor` detaches them and closes the scope once.
+*/
+function bootClientActor(input, effectRunner, observation) {
+	const scope = effectRunner.runSync(Scope.make());
+	const actor = withHostObservation(effectRunner.runSync(Scope.provide(bootIdentityFlow({
+		ports: input.ports,
+		chainId: input.bootstrap.chainId,
+		requirement: input.requirement,
+		...input.signer === void 0 ? {} : { signer: input.signer },
+		...input.organizationSetup === void 0 ? {} : { organizationSetup: input.organizationSetup },
+		...input.otpTtlMs === void 0 ? {} : { otpTtlMs: input.otpTtlMs },
+		runPromise: effectRunner.runPromise
+	}), scope)), observation.hostObservationSnapshot);
+	const unsubscribeProductTelemetry = actor.subscribeTransitions((record) => {
+		effectRunner.runPromise(executeIdentityProductObservation(input.ports.telemetry, record, actor.snapshot())).catch(() => {});
+	});
+	const failureObservation = observation.failureObservation;
+	const unsubscribeFailureObservation = failureObservation === void 0 ? () => {} : actor.subscribeTransitions((record) => {
+		if (record.outcome !== "failed") return;
+		observeFailedResult({
+			ok: false,
+			error: transitionError(record)
+		}, failureObservation, normalizeCapxulOperation(`identity.${record.event}`), "machine");
+	});
+	const unsubscribeSignerReadiness = startSignerReadinessOnClaim(actor, input.signer);
+	const unsubscribeReadinessObservation = observeSignerReadinessCycles(input.signer, input.ports.telemetry, observation.hostObservationSnapshot, effectRunner.runPromise);
+	let stopPromise = null;
+	const stopActor = () => {
+		if (stopPromise === null) {
+			actor.invalidateAuthLifetime();
+			unsubscribeProductTelemetry();
+			unsubscribeFailureObservation();
+			unsubscribeSignerReadiness();
+			unsubscribeReadinessObservation();
+			stopPromise = effectRunner.runPromise(Scope.close(scope, Exit.void));
+		}
+		return stopPromise;
+	};
+	if (input.signal !== void 0) input.signal.addEventListener("abort", () => void stopActor(), { once: true });
+	return {
+		actor,
+		stopActor
+	};
+}
+//#endregion
+//#region src/platform/client/close.ts
+/** Join the assembled actor lifetime to the adapter lifetime for internal client factories. */
+function withAdapterClose(client, closeAdapter, runPromise) {
+	const closeActor = client._internal.close;
+	let closePromise;
+	const close = () => {
+		closePromise ??= Promise.allSettled([Promise.resolve().then(() => closeActor?.()), Promise.resolve().then(closeAdapter)]).then((results) => {
+			const failure = results.find((result) => result.status === "rejected");
+			if (failure?.status === "rejected") throw failure.reason;
+		});
+		return closePromise;
+	};
+	return {
+		...client,
+		close: () => closeClientResources(close, runPromise),
+		_internal: {
+			...client._internal,
+			close
+		}
+	};
+}
+/** Keep lifecycle failures on the same public result boundary as domain work. */
+const closeClientResources = (close, runPromise) => toCapxulResult(Effect.promise(close), Context.empty(), runPromise);
+//#endregion
+//#region src/platform/client/internal-surface.ts
+/**
+* The client's `_internal` surface: the identity runtime, the dev faucet, the
+* indexer seam, the setup receipt read and the telemetry hooks first-party
+* bindings use. None of it is public API.
+*/
+function makeClientInternals(input, shared) {
+	return {
+		identity: shared.identity,
+		bootstrap: input.bootstrap,
+		accounts: { fund: (...args) => shared.accounts.fund(...args) },
+		...input.ports.indexerRead === void 0 ? {} : { indexer: input.ports.indexerRead },
+		organizationSetup: { getProofReceipt: (orgId) => runPortEffect(callOperation(input.ports.convexCall, setups.getProofReceipt, { orgId }).pipe(Effect.mapError((publicError) => ({ publicError }))), void 0, CAPXUL_OPERATIONS.runtime.port, shared.runPromise) },
+		telemetry: input.ports.telemetry,
+		accountSetup: shared.accountSetup,
+		captureExternalAddressAcknowledged: (address, organizationId) => {
+			const telemetry = input.ports.telemetry;
+			if (telemetry === void 0) return;
+			shared.runPromise(Effect.suspend(() => telemetry.emit({
+				name: "quick_pay_external_address_acknowledged",
+				props: {
+					recipient_locator_kind: "address",
+					recipient_resolution_status: "external_address",
+					recipient_address: address,
+					external_address_acknowledged: true,
+					...organizationId === void 0 ? {} : { organization_id: organizationId }
+				}
+			})).pipe(logDroppedEvent("quick_pay_external_address_acknowledged")));
+		},
+		close: shared.close
+	};
+}
+//#endregion
+//#region src/platform/client/assemble.ts
+function assembleCapxulClient(input) {
+	const observation = input;
+	const authCache = input.authCache ?? detectAuthCacheAdapter();
+	const accountSetup = input.accountSetup ?? "automatic";
+	const effectRunner = input.effectRunner ?? {
+		runSync: Effect.runSync,
+		runPromise: Effect.runPromise
+	};
+	const { actor, stopActor } = bootClientActor(input, effectRunner, observation);
+	const invocationControls = (controls) => withHostObservationControls(observation.hostObservationSnapshot, controls, actor.authSession()?.authUserId);
+	const selectedOrgPort = input.orgPort;
+	let kickProvisioning;
+	const financialOps = makeFinancialOpsMethods({
+		runPromise: effectRunner.runPromise,
+		invocationControls,
+		actor,
+		chainId: input.bootstrap.chainId,
+		convexCall: input.ports.convexCall,
+		...input.signer === void 0 ? {} : { signer: input.signer },
+		telemetry: input.ports.telemetry,
+		requestKeyScope: `${input.bootstrap.convexUrl}:${String(input.bootstrap.chainId)}`,
+		...input.ports.indexerRead === void 0 ? {} : { indexerRead: input.ports.indexerRead }
+	});
+	const accountInput = {
+		actor,
+		authCache,
+		identityPort: input.ports.identity,
+		smartAccountPort: input.ports.smartAccount,
+		telemetry: input.ports.telemetry,
+		chainId: input.bootstrap.chainId,
+		requirement: input.requirement,
+		accountReadPort: input.ports.accountRead,
+		profileMethods: financialOps.me,
+		convexCall: input.ports.convexCall,
+		runPromise: effectRunner.runPromise,
+		invocationControls,
+		...input.signer === void 0 ? {} : { signer: input.signer }
+	};
+	const accountBundle = makeAccountMethods(accountInput);
+	kickProvisioning = accountBundle.kickProvisioning;
+	const account = accountBundle.methods;
+	const authMethodsInput = {
+		actor,
+		authClient: input.ports.authClient,
+		authCache,
+		clock: input.ports.clock,
+		telemetry: input.ports.telemetry,
+		runPromise: effectRunner.runPromise,
+		...input.otpTtlMs === void 0 ? {} : { otpTtlMs: input.otpTtlMs },
+		...input.invokeTimeoutMs === void 0 ? {} : { invokeTimeoutMs: input.invokeTimeoutMs },
+		afterVerifyOtp: async () => {
+			resetSignerForFreshSession(input.signer);
+			if (accountSetup === "explicit") return;
+			kickProvisioning?.();
+		}
+	};
+	const authCore = makeAuthMethods(authMethodsInput);
+	const auth = {
+		...authCore,
+		clientRequests: makeClientRequestMethods({
+			authBaseUrl: input.bootstrap.authBaseUrl,
+			signIn: authCore.signIn,
+			verifyOtp: authCore.verifyOtp
+		})
+	};
+	const smartAccountInput = {
+		actor,
+		smartAccountPort: input.ports.smartAccount,
+		chainId: input.bootstrap.chainId,
+		sessionAuthUserIdFallback: null,
+		telemetry: input.ports.telemetry,
+		runPromise: effectRunner.runPromise
+	};
+	const smartAccount = makeSmartAccountMethods(smartAccountInput);
+	const identity = makeIdentityMethods({
+		identityPort: input.ports.identity,
+		actor,
+		convexCall: input.ports.convexCall,
+		runPromise: effectRunner.runPromise
+	});
+	const onboarding = makeOnboardingMethods({
+		authLifetime: actor.authLifetime,
+		matchesAuthLifetime: actor.matchesAuthLifetime,
+		restoreSession: (...args) => auth.getSession(...args),
+		refreshIdentity: (options) => runCapxulEffect(askIdentity(actor, { _tag: "ReadSession" }, options).pipe(Effect.asVoid), options, CAPXUL_OPERATIONS.identity.readSession, effectRunner.runPromise),
+		handleAvailable: (...args) => identity.handleAvailable(...args),
+		completeProfile: (...args) => identity.completeProfile(...args),
+		loadProfile: (...args) => identity.loadCurrent(...args),
+		ensureAccount: (...args) => account._internal.ensureReady(...args),
+		getLifecycle: (...args) => account.getLifecycle(...args),
+		snapshotIdentity: actor.snapshot,
+		subscribeIdentity: actor.subscribe,
+		sendIdentity: (event, options) => runCapxulEffect(askIdentity(actor, event, options), options, CAPXUL_OPERATIONS._internal.identity.send, effectRunner.runPromise),
+		...input.organizationSetup === void 0 ? {} : { organizationSetup: input.organizationSetup }
+	});
+	const system = makeSystemMethods({
+		convexCall: input.ports.convexCall,
+		runPromise: effectRunner.runPromise,
+		invocationControls: (controls) => withHostObservationControls(observation.hostObservationSnapshot, controls)
+	});
+	const media = makeMediaMethods({
+		convexCall: input.ports.convexCall,
+		runPromise: effectRunner.runPromise,
+		invocationControls
+	});
+	const holdings = makeHoldingsMethods({
+		convexCall: input.ports.convexCall,
+		runPromise: effectRunner.runPromise,
+		invocationControls,
+		...input.ports.indexerRead === void 0 ? {} : { indexerRead: input.ports.indexerRead }
+	});
+	const accountsInput = {
+		accountReadPort: input.ports.accountRead,
+		chainId: input.bootstrap.chainId,
+		telemetry: input.ports.telemetry,
+		runPromise: effectRunner.runPromise,
+		invocationControls
+	};
+	const accounts = makeAccountsMethods(accountsInput);
+	const orgMethods = makeOrgMethods({
+		actor,
+		chainId: input.bootstrap.chainId,
+		telemetry: input.ports.telemetry,
+		runPromise: effectRunner.runPromise,
+		invocationControls,
+		requestKeyScope: `${input.bootstrap.convexUrl}:${String(input.bootstrap.chainId)}`,
+		...selectedOrgPort === void 0 ? {} : { orgPort: selectedOrgPort },
+		convexCall: input.ports.convexCall,
+		...input.signer === void 0 ? {} : { signer: input.signer },
+		...input.organizationSetup === void 0 ? {} : { organizationSetup: input.organizationSetup }
+	});
+	const currentUser = makeCurrentUserMethods({
+		me: financialOps.me,
+		accounts,
+		smartAccount,
+		orgs: orgMethods.orgs
+	});
+	const identityRuntime = makeIdentityRuntime(actor, input.ports.identity, effectRunner.runPromise);
+	const client = {
+		checkouts: makeCheckoutMethods({
+			convexCall: input.ports.convexCall,
+			runPromise: effectRunner.runPromise,
+			...input.signer === void 0 || input.ports.convexCall === void 0 ? {} : { execution: {
+				actor,
+				signer: input.signer,
+				chainId: input.bootstrap.chainId,
+				convexCall: input.ports.convexCall,
+				runPromise: effectRunner.runPromise,
+				telemetry: input.ports.telemetry
+			} },
+			invocationControls
+		}),
+		auth,
+		smartAccount,
+		identity,
+		onboarding,
+		system,
+		account,
+		accounts,
+		currentUser,
+		...financialOps,
+		holdings,
+		media,
+		orgs: orgMethods.orgs,
+		org: (...args) => orgMethods.org(...args),
+		signer: input.signer?.statusStore ?? UNOBSERVABLE_SIGNER_STATUS,
+		_internal: makeClientInternals(input, {
+			identity: identityRuntime,
+			accounts,
+			accountSetup,
+			runPromise: effectRunner.runPromise,
+			close: stopActor
+		}),
+		close: () => closeClientResources(stopActor, effectRunner.runPromise)
+	};
+	return observeSdkClient(client, observation.failureObservation, observation.hostObservationSnapshot);
+}
+//#endregion
+//#region src/observability/diagnostics/effect-log.ts
+/**
+* Diagnostic breadcrumbs as SDK log records. The signer's readiness cycle
+* traces (`openfort.*`) used to reach only the browser console; through this
+* adapter they run in the client's own Effect context, so the engineering
+* telemetry layer ships them to PostHog Logs beside `identity.transition`.
+* Logging never throws back into the cycle that emitted it.
+*/
+var EffectLogDiagnosticAdapter = class {
+	#runPromise;
+	#console;
+	constructor(context, consoleFallback) {
+		this.#runPromise = Effect.runPromiseWith(context);
+		this.#console = consoleFallback;
+	}
+	trace(scope, detail) {
+		this.#console?.trace(scope, detail);
+		try {
+			this.#runPromise(Effect.logInfo(scope).pipe(Effect.annotateLogs({
+				...detail,
+				diagnostic_scope: scope
+			}), Effect.ignoreCause)).catch(() => void 0);
+		} catch {}
+	}
+};
+//#endregion
+//#region src/observability/diagnostics/console.ts
+const DEFAULT_ACCOUNT_SETUP_LOG_PREFIX = "[capxul:account-setup]";
+var ConsoleDiagnosticAdapter = class {
+	prefix;
+	constructor(prefix = DEFAULT_ACCOUNT_SETUP_LOG_PREFIX) {
+		this.prefix = prefix;
+	}
+	trace(scope, detail) {
+		globalThis.console?.debug?.(`${this.prefix} ${scope}`, detail);
+	}
+};
+//#endregion
+//#region src/signing/openfort-production.ts
+/** @internal Resolve the signer after production bootstrap without exposing its other fields. */
+function resolveOpenfortProductionSigner(input) {
+	const bootstrap = input.bootstrap;
+	let signer = input.signer ?? input.factory?.({
+		authBaseUrl: input.authBaseUrl,
+		openfortPublishableKey: bootstrap.openfortPublishableKey,
+		shieldPublishableKey: bootstrap.shieldPublishableKey,
+		...bootstrap.openfortAuthProvider === void 0 ? {} : { openfortAuthProvider: bootstrap.openfortAuthProvider }
+	});
+	if (signer === void 0 && input.runtime === "browser") signer = input.createBrowserSigner({
+		...bootstrap,
+		authBaseUrl: input.authBaseUrl
+	}, {
+		diagnostic: input.diagnostic,
+		signUserOpHash: input.embeddedSign
+	});
+	if (signer === void 0 || input.finalSign === void 0) return signer;
+	return {
+		source: signer.source,
+		getAddress: () => signer.getAddress(),
+		signUserOpHash: (hash) => input.finalSign(hash, signer),
+		...signer.statusStore === void 0 ? {} : { statusStore: signer.statusStore },
+		...signer.ensureWalletReady === void 0 ? {} : { ensureWalletReady: signer.ensureWalletReady.bind(signer) },
+		..."resetSession" in signer ? { resetSession: () => signer.resetSession() } : {}
+	};
+}
+//#endregion
+//#region src/platform/production-client.ts
+/** Shared production composition. The normal factory passes no controls. */
+async function createCapxulClientWithSignerControls(input, controls) {
+	const invocationObservability = bindHostObservabilityInvocation(input.observability);
+	const observation = invocationObservability?.failures ?? input.observation;
+	const validation = validateCreateCapxulClientInput(input);
+	if (!validation.ok) return observeFailedResult(validation, observation, "createCapxulClient");
+	const resetSignerSession = { current: null };
+	const adapters = await createProductionAdapters({
+		...input,
+		resetSignerSession,
+		...invocationObservability === void 0 ? {} : { invocationObservability }
+	});
+	if (!adapters.ok) return observeFailedResult(adapters, observation, "createCapxulClient");
+	try {
+		const runtime = input.runtime ?? detectRuntime();
+		const resolvedAuthBaseUrl = resolveBrowserAuthBaseUrl({
+			bootstrapAuthBaseUrl: adapters.value.bootstrap.authBaseUrl,
+			runtime,
+			...input.authBaseUrl === void 0 ? {} : { override: input.authBaseUrl }
+		});
+		const signer = resolveOpenfortProductionSigner({
+			bootstrap: adapters.value.bootstrap,
+			runtime,
+			authBaseUrl: resolvedAuthBaseUrl,
+			createBrowserSigner: createOpenfortBrowserSignerFromBootstrap,
+			diagnostic: new EffectLogDiagnosticAdapter(adapters.value.context, productionLocalDiagnostics(input) ? new ConsoleDiagnosticAdapter() : void 0),
+			signer: input.signer,
+			factory: input.openfortSignerFactory,
+			finalSign: controls.signUserOpHash,
+			embeddedSign: controls.signEmbeddedUserOpHash
+		});
+		const factoryChainFence = assertDevKeySignerIsTestnetOnly(signer, adapters.value.bootstrap.chainId);
+		if (!factoryChainFence.ok) {
+			await adapters.value.close().catch(() => void 0);
+			return observeFailedResult(factoryChainFence, observation, "createCapxulClient");
+		}
+		if (signer !== void 0 && "resetSession" in signer) {
+			const { resetSession, source } = signer;
+			resetSignerSession.current = () => {
+				try {
+					resetSession();
+				} catch (cause) {
+					throw signerFailure(source, "resetSession", cause);
+				}
+			};
+		}
+		const effectRunner = {
+			runSync: Effect.runSyncWith(adapters.value.context),
+			runPromise: Effect.runPromiseWith(adapters.value.context)
+		};
+		const ownedClient = withAdapterClose(assembleCapxulClient({
+			ports: adapters.value.ports,
+			bootstrap: adapters.value.bootstrap,
+			authCache: adapters.value.ports.authCache,
+			requirement: input.requirement ?? "none",
+			accountSetup: input.accountSetup,
+			...signer === void 0 ? {} : { signer },
+			orgPort: Context.get(adapters.value.context, OrgPortTag),
+			organizationSetup: new ConvexOrganizationSetupAdapter({
+				convex: adapters.value.ports.convexCall,
+				...signer === void 0 ? {} : { signer },
+				chainId: adapters.value.bootstrap.chainId,
+				runPromise: effectRunner.runPromise
+			}),
+			...input.signal === void 0 ? {} : { signal: input.signal },
+			...input.otpTtlMs === void 0 ? {} : { otpTtlMs: input.otpTtlMs },
+			invokeTimeoutMs: input.invokeTimeoutMs ?? 3e4,
+			...input.observability?.failures === void 0 && input.observation === void 0 ? {} : { failureObservation: input.observability?.failures ?? input.observation },
+			...input.observability === void 0 ? {} : { hostObservationSnapshot: () => snapshotHostObservability(input.observability) },
+			effectRunner
+		}), adapters.value.close, effectRunner.runPromise);
+		const close = idempotentClose(async () => {
+			try {
+				if (signer !== void 0 && "resetSession" in signer) try {
+					signer.resetSession();
+				} catch (cause) {
+					throw signerFailure(signer.source, "resetSession", cause);
+				}
+			} finally {
+				await ownedClient._internal.close?.();
+			}
+		});
+		return {
+			ok: true,
+			value: {
+				...ownedClient,
+				close: () => closeClientResources(close, effectRunner.runPromise),
+				_internal: {
+					...ownedClient._internal,
+					close
+				}
+			}
+		};
+	} catch (cause) {
+		await adapters.value.close().catch(() => void 0);
+		return observeFailedResult({
+			ok: false,
+			error: toPublicError(cause)
+		}, observation, "createCapxulClient");
+	}
+}
+const SDK_VERSION = version;
+async function createCapxulClient(input) {
+	return createCapxulClientWithSignerControls(input, {});
+}
+//#endregion
+export { cloneTelemetryEvent as a, identityErrorFromCapxul as c, devPrivateKeySigner as d, createOpenfortBrowserSigner as f, openfortEmbeddedWalletPort as h, postHogObservability as i, bootstrapErrorFromCapxul as l, openfortEmbeddedSignerFromWallet as m, createCapxulClientWithSignerControls as n, cloneTelemetryProps as o, embeddedSigner as p, assembleCapxulClient as r, IdentityPortTag as s, createCapxulClient as t, deriveDevPrivateKey as u };