@capxul/sdk 4.20.0-beta.31 → 4.20.0-beta.33

package/dist/{production-2L76NWS5.mjs → production-BzEOaP6l.mjs}

@@ -1,5 +1,5 @@
-import { c as deserializeCapxulError, n as makeOrgMethods, o as ConvexOrganizationAdapter, s as OrgPortTag, t as ConvexOrganizationSetupAdapter } from "./organizations-wucUfgJr.mjs";
-import { $r as ActorFailure, $t as version, A as registerProductTelemetryInvocation, Ai as toEpochMs, An as details, Bi as isFailureMode, Br as runIdentityFacade, Bt as failureEvidenceProps, C as AccountReadPortTag, Ci as detectAuthCacheAdapter, Cn as CLI_INVOCATION_KINDS, D as convexCallErrorFromCapxul, Dn as isCapxulOperation, E as ConvexCallPortTag, En as CAPXUL_OPERATIONS, Gt as observationContextProps, H as makePaymentsMethods, Hi as readField, Hr as sessionFromActor, Ht as postHogFailureObservation, Ii as Errors, It as callOperation, J as makeTargetsMethods, Jn as ORGANIZATION_SETUP_REASONS, K as makeCheckoutMethods, Kt as withCapturedAttemptContext, L as makeAccountMethods, Li as CapxulError, Lr as makeAuthMethods, Lt as asCapxulError, M as makeApprovalsMethods, Mi as toAuthUserId, Mr as toAddress, Ni as toEmail, Nt as BASE_SEPOLIA_CHAIN_ID, On as normalizeCapxulOperation, Ri as isCapxulError, Rr as askIdentity, Rt as toPublicError, Si as AuthClientPortTag, Sn as CLI_COMMAND_NAMES, T as TelemetryPortTag, Tn as stampTelemetryEnvelope, Tr as ChainIdSchema, Ut as observeFailedResult, V as makeOfframpMethods, Vi as isRecord, Vr as runPortEffect, W as makeDestinationsMethods, Wi as AuthCachePortTag, Wn as setups, Wr as runCapxulEffect, Wt as observeSdkClient, Xr as formatTraceparent, Yn as ORGANIZATION_SETUP_STATUSES, Yr as toCapxulResult, Zn as decodeChainCause, Zr as CAPXUL_ERROR_CODES, _i as toAllowedOrigin, ai as ClockPortTag, an as isSignerNotReadySignal, bn as redactTelemetryProps, br as EpochMsSchema, c as makePaymentDocumentsMethods, ci as BetterAuthBrowserLayer, cn as signerFailure, cr as AppIdSchema, d as SmartAccountPortTag, di as copyInvocationObservation, dn as makeClientRequestMethods, ei as carryInvocationParentSpan, fi as readInvocationObservation, fn as toCountryCode, fr as isBytes32, g as ConvexAccountLayer, gi as isCredentialField, gn as toHandle, h as makeAccountsMethods, hi as redactUrlSecrets, in as isEcdsaSignatureHex, jn as onboardings, jr as isEvmAddress, k as bindProductTelemetryInvocation, kn as OPERATIONS, kt as normalizeSafeSaltEmail, l as makeSmartAccountMethods, li as observationRequestHeaders, lr as images, m as PonderIndexerAdapter, mi as redactSecrets, mn as toTesterKind, n as bootIdentityFlow, nn as causeChain, on as openfortSignerNotReadyCode, p as makeHoldingsMethods, pi as sanitizeObservationContext, pn as toKycTier, r as makeMeMethods, ri as SystemClockLayer, s as makeActivityMethods, si as BetterAuthNodeLayer, sn as recoverRawDigestSigner, sr as diagnostics, t as executeIdentityProductObservation, tn as UNOBSERVABLE_SIGNER_STATUS, u as ConvexSmartAccountLayer, ui as attachInvocationObservation, un as makeCurrentUserMethods, vn as validateHandle, wi as globalLocalStorage, xi as AuthClientError, xn as CLI_CAPABILITIES, yi as toPublishableKey, yr as DurationMsSchema, z as logDroppedEvent, zi as FAILURE_MODES, zr as publicIdentityFailure, zt as failureDetail } from "./access-B-2qmxF_.mjs";
+import { c as OrgPortTag, l as deserializeCapxulError, n as makeOrgMethods, r as makeBankingMethods, s as ConvexOrganizationAdapter, t as ConvexOrganizationSetupAdapter } from "./organizations-UEg_C-_v.mjs";
+import { A as registerProductTelemetryInvocation, An as onboardings, B as makePaymentsMethods, Bi as FAILURE_MODES, Br as publicIdentityFailure, C as AccountReadPortTag, Ci as AuthClientPortTag, D as convexCallErrorFromCapxul, Dn as normalizeCapxulOperation, E as ConvexCallPortTag, En as isCapxulOperation, Er as ChainIdSchema, Ft as callOperation, Gi as AuthCachePortTag, Gr as runCapxulEffect, Gt as withCapturedAttemptContext, H as makeDestinationsMethods, Hi as isRecord, Hr as runPortEffect, Ht as observeFailedResult, It as asCapxulError, Jn as ORGANIZATION_SETUP_STATUSES, K as makeTargetsMethods, L as makeAccountMethods, Li as Errors, Lt as toPublicError, M as makeApprovalsMethods, Mr as isEvmAddress, Mt as BASE_SEPOLIA_CHAIN_ID, Ni as toAuthUserId, Nr as toAddress, On as OPERATIONS, Ot as normalizeSafeSaltEmail, Pi as toEmail, Qr as CAPXUL_ERROR_CODES, Qt as version, Ri as CapxulError, Rr as makeAuthMethods, Rt as failureDetail, Si as AuthClientError, Sn as CLI_INVOCATION_KINDS, T as TelemetryPortTag, Ti as globalLocalStorage, Tn as CAPXUL_OPERATIONS, Ui as readField, Un as setups, Ur as sessionFromActor, Ut as observeSdkClient, Vi as isFailureMode, Vr as runIdentityFacade, Vt as postHogFailureObservation, W as makeCheckoutMethods, Wt as observationContextProps, Xn as decodeChainCause, Xr as toCapxulResult, Zr as formatTraceparent, _i as isCredentialField, _n as validateHandle, an as openfortSignerNotReadyCode, bi as toPublishableKey, bn as CLI_CAPABILITIES, br as DurationMsSchema, c as makePaymentDocumentsMethods, ci as BetterAuthNodeLayer, cr as images, d as SmartAccountPortTag, di as attachInvocationObservation, dn as toCountryCode, ei as ActorFailure, en as UNOBSERVABLE_SIGNER_STATUS, fi as copyInvocationObservation, fn as toKycTier, g as ConvexAccountLayer, gi as redactUrlSecrets, h as makeAccountsMethods, hi as redactSecrets, hn as toHandle, ii as SystemClockLayer, in as isSignerNotReadySignal, ji as toEpochMs, k as bindProductTelemetryInvocation, kn as details, l as makeSmartAccountMethods, li as BetterAuthBrowserLayer, ln as makeCurrentUserMethods, m as PonderIndexerAdapter, mi as sanitizeObservationContext, n as bootIdentityFlow, oi as ClockPortTag, on as recoverRawDigestSigner, or as diagnostics, p as makeHoldingsMethods, pi as readInvocationObservation, pn as toTesterKind, pr as isBytes32, q as makeVerificationMethods, qn as ORGANIZATION_SETUP_REASONS, r as makeMeMethods, rn as isEcdsaSignatureHex, s as makeActivityMethods, sn as signerFailure, sr as AppIdSchema, t as executeIdentityProductObservation, ti as carryInvocationParentSpan, tn as causeChain, u as ConvexSmartAccountLayer, ui as observationRequestHeaders, un as makeClientRequestMethods, vi as toAllowedOrigin, wi as detectAuthCacheAdapter, wn as stampTelemetryEnvelope, xn as CLI_COMMAND_NAMES, xr as EpochMsSchema, yn as redactTelemetryProps, zi as isCapxulError, zr as askIdentity, zt as failureEvidenceProps } from "./access-l_ci38yt.mjs";
 import { Cause, Clock, Context, Data, Deferred, Duration, Effect, Exit, FiberSet, Layer, Logger, Metric, Option, Predicate, References, Result, Schedule, Schema, SchemaIssue, SchemaParser, Scope, Stream, Tracer } from "effect";
 import { getFunctionName } from "convex/server";
 import { keccak256, stringToHex } from "viem";
@@ -797,6 +797,76 @@ function devPrivateKeySigner(input) {
 	};
 }
 //#endregion
+//#region ../observability/src/devtools.ts
+/** Local inspection is an explicit host choice, independent of remote telemetry. */
+function validateDevToolsUrl(value) {
+	const url = new URL(value);
+	if (!["ws:", "wss:"].includes(url.protocol) || ![
+		"localhost",
+		"127.0.0.1",
+		"[::1]",
+		"host.docker.internal"
+	].includes(url.hostname) || url.username !== "" || url.password !== "" || url.search !== "" || url.hash !== "") throw new TypeError("devToolsUrl must be a local WebSocket URL without credentials");
+	return url.href;
+}
+function localSpan(delegate) {
+	const attributes = new Map(delegate.attributes);
+	let status = delegate.status;
+	return {
+		_tag: "Span",
+		name: delegate.name,
+		spanId: delegate.spanId,
+		traceId: delegate.traceId,
+		parent: delegate.parent,
+		annotations: delegate.annotations,
+		sampled: delegate.sampled,
+		kind: delegate.kind,
+		attributes,
+		get status() {
+			return status;
+		},
+		get links() {
+			return delegate.links;
+		},
+		attribute(key, value) {
+			attributes.set(key, value);
+			delegate.attribute(key, value);
+		},
+		event(name, time, values) {
+			delegate.event(name, time, values);
+		},
+		addLinks(links) {
+			delegate.addLinks(links);
+		},
+		end(endTime, exit) {
+			delegate.end(endTime, exit);
+			status = {
+				_tag: "Ended",
+				startTime: status.startTime,
+				endTime,
+				exit
+			};
+		}
+	};
+}
+/** Acquire after the host layer so traces and metrics use the same context. */
+function withDevTools(layer, url) {
+	if (url === void 0) return layer;
+	const endpoint = validateDevToolsUrl(url);
+	return Layer.unwrap(Effect.promise(async () => {
+		const [{ DevToolsClient }, { Socket }] = await Promise.all([import("effect/devtools"), import("effect/socket")]);
+		const client = DevToolsClient.layer.pipe(Layer.provide(Socket.layerWebSocket(endpoint)), Layer.provide(Socket.layerWebSocketConstructorGlobal));
+		return Layer.effect(Tracer.Tracer, Effect.gen(function* () {
+			const delegate = yield* Effect.tracer;
+			const mirror = Tracer.make({
+				span: (options) => localSpan(delegate.span(options)),
+				...delegate.context === void 0 ? {} : { context: delegate.context.bind(delegate) }
+			});
+			return yield* DevToolsClient.makeTracer.pipe(Effect.provideService(Tracer.Tracer, mirror));
+		})).pipe(Layer.provide(client), Layer.provideMerge(layer));
+	}));
+}
+//#endregion
 //#region ../protocol/src/errors/convex-decoding.ts
 const KNOWN_CODES = new Set(CAPXUL_ERROR_CODES);
 function isCapxulCode(value) {
@@ -2851,6 +2921,123 @@ const attributes = (input, limit = 32) => {
 };
 const terminalName = (name) => name === "cli.command.completed" || name === "cli.wallet.step" || CLI_COMMAND_NAMES.some((command) => name === `cli.command.${command}`);
 //#endregion
+//#region ../observability/src/engineering/tracer.ts
+const failureText = (failure, key, limit, source) => {
+	if (failure === null || typeof failure !== "object") return void 0;
+	try {
+		let owner = failure;
+		let descriptor;
+		for (let depth = 0; owner !== null && depth < 4; depth += 1) {
+			descriptor = Object.getOwnPropertyDescriptor(owner, key);
+			if (descriptor !== void 0 || key !== "name") break;
+			owner = Object.getPrototypeOf(owner);
+		}
+		const value = descriptor?.value;
+		return typeof value === "string" || key === "code" && typeof value === "number" ? redactSecrets(String(value), source).slice(0, limit) : void 0;
+	} catch {
+		return;
+	}
+};
+const exportFailure = (failure, source) => {
+	const message = failureText(failure, "message", 2048, source) ?? (typeof failure === "string" ? redactSecrets(failure, source).slice(0, 2048) : "Engineering operation failed");
+	const code = failureText(failure, "code", 128);
+	const error = new Error((code === void 0 ? message : `${message} [code=${code}]`).slice(0, 2048));
+	error.name = failureText(failure, "_tag", 128) ?? failureText(failure, "name", 128) ?? "Error";
+	error.stack = failureText(failure, "stack", 8192, source) ?? `${error.name}: ${error.message}`;
+	return error;
+};
+const exportFailureExit = (cause, source) => Exit.failCause(Cause.fromReasons(cause.reasons.filter((reason) => !Cause.isInterruptReason(reason)).slice(0, 8).map((reason) => Cause.isFailReason(reason) ? Cause.makeFailReason(exportFailure(reason.error, source)) : Cause.makeDieReason(exportFailure(reason.defect, source)))));
+const BROWSER_KEEPALIVE_BYTES = 65536;
+let unfinishedBrowserExportBytes = 0;
+const hasBrowserDocument = () => typeof window !== "undefined" && typeof document !== "undefined";
+const browserExportClient = (client) => HttpClient.transform(client, (response, request) => Effect.acquireUseRelease(Effect.sync(() => {
+	const bytes = "contentLength" in request.body ? request.body.contentLength : void 0;
+	if (request.body._tag === "Stream" || request.body._tag === "FormData" || bytes === void 0 || !Number.isSafeInteger(bytes) || bytes < 0 || unfinishedBrowserExportBytes + bytes > BROWSER_KEEPALIVE_BYTES) return;
+	unfinishedBrowserExportBytes += bytes;
+	return bytes;
+}), (bytes) => response.pipe(Effect.provideService(FetchHttpClient.RequestInit, { keepalive: bytes !== void 0 }), Effect.tap((result) => bytes === void 0 ? Effect.void : Stream.runDrain(result.stream).pipe(Effect.catchIf((error) => error.reason._tag === "EmptyBodyError", () => Effect.void)))), (bytes) => Effect.sync(() => {
+	if (bytes !== void 0) unfinishedBrowserExportBytes -= bytes;
+})));
+const spanUpstream = (span) => {
+	let current = span;
+	while (current?._tag === "Span") {
+		const upstream = current.attributes.get("chain.upstream");
+		if (upstream === "alchemy" || upstream === "infura" || upstream === "gateway") return upstream;
+		current = current.parent._tag === "Some" ? current.parent.value : void 0;
+	}
+};
+function redactHttpPath(path, fullUrl, source) {
+	let origin = "https://redaction.invalid";
+	try {
+		const url = new URL(String(fullUrl));
+		if (url.protocol === "https:" || url.protocol === "http:") origin = url.origin;
+	} catch {}
+	const prefix = path.startsWith("/") ? origin : "";
+	return redactUrlSecrets(`${prefix}${path}`, source).slice(prefix.length, prefix.length + 2048);
+}
+/** A span whose prototype is `span`: it answers every Span member until an own property overrides it. */
+function inheritSpan(span) {
+	const wrapped = Object.create(span);
+	Object.defineProperties(wrapped, {
+		traceId: { get: () => span.traceId },
+		spanId: { get: () => span.spanId },
+		attributes: { get: () => span.attributes },
+		event: {
+			value: span.event.bind(span),
+			configurable: true
+		},
+		addLinks: {
+			value: span.addLinks.bind(span),
+			configurable: true
+		}
+	});
+	return wrapped;
+}
+/** Preserve domain exits while preventing the OTLP serializer from seeing raw causes. */
+const makeLeakSafeEngineeringTracer = (delegate, enabled = () => true) => Tracer.make({
+	span(options) {
+		const span = enabled() ? delegate.span(options) : new Tracer.NativeSpan(options);
+		const wrapped = inheritSpan(span);
+		Object.defineProperty(wrapped, "attribute", { value: (name, value) => {
+			const source = spanUpstream(span);
+			const header = /^http\.(?:request|response)\.header\.(.+)$/u.exec(name)?.[1];
+			if (header !== void 0 && isCredentialField(header, "header")) span.attribute(name, "[REDACTED]");
+			else if (typeof value === "string" && name === "url.query") span.attribute(name, redactUrlSecrets(`?${value}`).slice(1, 2049));
+			else if (typeof value === "string" && (name === "url.path" || name === "http.target")) {
+				const fullUrl = span.attributes.get("url.full") ?? span.attributes.get("http.url");
+				const path = name === "url.path" && typeof fullUrl === "string" ? /^https?:\/\/[^/]+([^?#]*)/u.exec(fullUrl)?.[1] ?? value : value;
+				span.attribute(name, redactHttpPath(path, fullUrl, source));
+			} else if (typeof value === "string" && (name === "url.full" || name === "http.url" || header === "location" || header === "referer" || header === "referrer")) span.attribute(name, redactUrlSecrets(value, source).slice(0, 2048));
+			else if (header !== void 0 && typeof value === "string") span.attribute(name, redactSecrets(value, source).slice(0, 2048));
+			else span.attribute(name, value);
+		} });
+		Object.defineProperty(wrapped, "end", {
+			configurable: false,
+			enumerable: false,
+			value: (endTime, exit) => {
+				if (!enabled()) {
+					Object.defineProperty(wrapped, "status", { value: {
+						_tag: "Ended",
+						startTime: span.status.startTime,
+						endTime,
+						exit
+					} });
+					return;
+				}
+				if (Exit.isFailure(exit) && !Cause.hasInterruptsOnly(exit.cause)) {
+					const first = exit.cause.reasons.find((reason) => !Cause.isInterruptReason(reason));
+					const code = failureText(first === void 0 ? void 0 : Cause.isFailReason(first) ? first.error : first.defect, "code", 128);
+					if (code !== void 0) span.attribute("error.code", code);
+					span.end(endTime, exportFailureExit(exit.cause, spanUpstream(span)));
+				} else span.end(endTime, exit);
+			},
+			writable: false
+		});
+		return wrapped;
+	},
+	...delegate.context === void 0 ? {} : { context: delegate.context.bind(delegate) }
+});
+//#endregion
 //#region ../observability/src/delivery/records.ts
 function admittedLogger(state, delegate) {
 	return Logger.make((options) => {
@@ -2906,7 +3093,7 @@ function admittedTracer(state, delegate) {
 /** The span as a producer sees it: at most 32 fields and 2000 attribute bytes, 2 events, 2 links. */
 function boundedSpan(state, span) {
 	const { budget } = state;
-	const wrapped = Object.create(span);
+	const wrapped = inheritSpan(span);
 	let fields = 0, events = 0, links = 0, attributeBytes = 0;
 	let ended = false;
 	Object.defineProperties(wrapped, {
@@ -3139,109 +3326,6 @@ const validateEngineeringTelemetryConfig = (config) => {
 	};
 };
 //#endregion
-//#region ../observability/src/engineering/tracer.ts
-const failureText = (failure, key, limit, source) => {
-	if (failure === null || typeof failure !== "object") return void 0;
-	try {
-		let owner = failure;
-		let descriptor;
-		for (let depth = 0; owner !== null && depth < 4; depth += 1) {
-			descriptor = Object.getOwnPropertyDescriptor(owner, key);
-			if (descriptor !== void 0 || key !== "name") break;
-			owner = Object.getPrototypeOf(owner);
-		}
-		const value = descriptor?.value;
-		return typeof value === "string" || key === "code" && typeof value === "number" ? redactSecrets(String(value), source).slice(0, limit) : void 0;
-	} catch {
-		return;
-	}
-};
-const exportFailure = (failure, source) => {
-	const message = failureText(failure, "message", 2048, source) ?? (typeof failure === "string" ? redactSecrets(failure, source).slice(0, 2048) : "Engineering operation failed");
-	const code = failureText(failure, "code", 128);
-	const error = new Error((code === void 0 ? message : `${message} [code=${code}]`).slice(0, 2048));
-	error.name = failureText(failure, "_tag", 128) ?? failureText(failure, "name", 128) ?? "Error";
-	error.stack = failureText(failure, "stack", 8192, source) ?? `${error.name}: ${error.message}`;
-	return error;
-};
-const exportFailureExit = (cause, source) => Exit.failCause(Cause.fromReasons(cause.reasons.filter((reason) => !Cause.isInterruptReason(reason)).slice(0, 8).map((reason) => Cause.isFailReason(reason) ? Cause.makeFailReason(exportFailure(reason.error, source)) : Cause.makeDieReason(exportFailure(reason.defect, source)))));
-const BROWSER_KEEPALIVE_BYTES = 65536;
-let unfinishedBrowserExportBytes = 0;
-const hasBrowserDocument = () => typeof window !== "undefined" && typeof document !== "undefined";
-const browserExportClient = (client) => HttpClient.transform(client, (response, request) => Effect.acquireUseRelease(Effect.sync(() => {
-	const bytes = "contentLength" in request.body ? request.body.contentLength : void 0;
-	if (request.body._tag === "Stream" || request.body._tag === "FormData" || bytes === void 0 || !Number.isSafeInteger(bytes) || bytes < 0 || unfinishedBrowserExportBytes + bytes > BROWSER_KEEPALIVE_BYTES) return;
-	unfinishedBrowserExportBytes += bytes;
-	return bytes;
-}), (bytes) => response.pipe(Effect.provideService(FetchHttpClient.RequestInit, { keepalive: bytes !== void 0 }), Effect.tap((result) => bytes === void 0 ? Effect.void : Stream.runDrain(result.stream).pipe(Effect.catchIf((error) => error.reason._tag === "EmptyBodyError", () => Effect.void)))), (bytes) => Effect.sync(() => {
-	if (bytes !== void 0) unfinishedBrowserExportBytes -= bytes;
-})));
-const spanUpstream = (span) => {
-	let current = span;
-	while (current?._tag === "Span") {
-		const upstream = current.attributes.get("chain.upstream");
-		if (upstream === "alchemy" || upstream === "infura" || upstream === "gateway") return upstream;
-		current = current.parent._tag === "Some" ? current.parent.value : void 0;
-	}
-};
-function redactHttpPath(path, fullUrl, source) {
-	let origin = "https://redaction.invalid";
-	try {
-		const url = new URL(String(fullUrl));
-		if (url.protocol === "https:" || url.protocol === "http:") origin = url.origin;
-	} catch {}
-	const prefix = path.startsWith("/") ? origin : "";
-	return redactUrlSecrets(`${prefix}${path}`, source).slice(prefix.length, prefix.length + 2048);
-}
-/** A span whose prototype is `span`: it answers every Span member until an own property overrides it. */
-function inheritSpan(span) {
-	return Object.create(span);
-}
-/** Preserve domain exits while preventing the OTLP serializer from seeing raw causes. */
-const makeLeakSafeEngineeringTracer = (delegate, enabled = () => true) => Tracer.make({
-	span(options) {
-		const span = enabled() ? delegate.span(options) : new Tracer.NativeSpan(options);
-		const wrapped = inheritSpan(span);
-		Object.defineProperty(wrapped, "attribute", { value: (name, value) => {
-			const source = spanUpstream(span);
-			const header = /^http\.(?:request|response)\.header\.(.+)$/u.exec(name)?.[1];
-			if (header !== void 0 && isCredentialField(header, "header")) span.attribute(name, "[REDACTED]");
-			else if (typeof value === "string" && name === "url.query") span.attribute(name, redactUrlSecrets(`?${value}`).slice(1, 2049));
-			else if (typeof value === "string" && (name === "url.path" || name === "http.target")) {
-				const fullUrl = span.attributes.get("url.full") ?? span.attributes.get("http.url");
-				const path = name === "url.path" && typeof fullUrl === "string" ? /^https?:\/\/[^/]+([^?#]*)/u.exec(fullUrl)?.[1] ?? value : value;
-				span.attribute(name, redactHttpPath(path, fullUrl, source));
-			} else if (typeof value === "string" && (name === "url.full" || name === "http.url" || header === "location" || header === "referer" || header === "referrer")) span.attribute(name, redactUrlSecrets(value, source).slice(0, 2048));
-			else if (header !== void 0 && typeof value === "string") span.attribute(name, redactSecrets(value, source).slice(0, 2048));
-			else span.attribute(name, value);
-		} });
-		Object.defineProperty(wrapped, "end", {
-			configurable: false,
-			enumerable: false,
-			value: (endTime, exit) => {
-				if (!enabled()) {
-					Object.defineProperty(wrapped, "status", { value: {
-						_tag: "Ended",
-						startTime: span.status.startTime,
-						endTime,
-						exit
-					} });
-					return;
-				}
-				if (Exit.isFailure(exit) && !Cause.hasInterruptsOnly(exit.cause)) {
-					const first = exit.cause.reasons.find((reason) => !Cause.isInterruptReason(reason));
-					const code = failureText(first === void 0 ? void 0 : Cause.isFailReason(first) ? first.error : first.defect, "code", 128);
-					if (code !== void 0) span.attribute("error.code", code);
-					span.end(endTime, exportFailureExit(exit.cause, spanUpstream(span)));
-				} else span.end(endTime, exit);
-			},
-			writable: false
-		});
-		return wrapped;
-	},
-	...delegate.context === void 0 ? {} : { context: delegate.context.bind(delegate) }
-});
-//#endregion
 //#region ../observability/src/engineering/minimal.ts
 const MINIMAL_LOG_NAMES = /* @__PURE__ */ new Set([
 	"capxul_sdk_operation",
@@ -3901,6 +3985,14 @@ function makeProductionAdapterLayer(input) {
 //#region src/platform/production-input.ts
 function validateCreateCapxulClientInput(input) {
 	const runtime = input.runtime ?? detectRuntime();
+	if (input.devToolsUrl !== void 0) try {
+		validateDevToolsUrl(input.devToolsUrl);
+	} catch {
+		return {
+			ok: false,
+			error: Errors.invalidInput("devToolsUrl", "must be a local ws or wss URL without credentials")
+		};
+	}
 	if (input.signer !== void 0 && input.openfortSignerFactory !== void 0) return {
 		ok: false,
 		error: Errors.invalidInput("signer", "choose signer or openfortSignerFactory")
@@ -4065,7 +4157,7 @@ async function createProductionAdapters(input) {
 			...input.resetSignerSession === void 0 ? {} : { resetSignerSession: input.resetSignerSession }
 		});
 		const applicationLayer = Layer.merge(portsLayer, optionalEngineeringTelemetryLayer(bootstrapResult.value.engineeringTelemetry, resolvedInput.value.runtime, hostEngineeringPolicy(input.observability))).pipe(Layer.provideMerge(localDiagnosticsLayer(localDiagnostics, resolvedInput.value.runtime)));
-		const context = await Effect.runPromise(Layer.buildWithScope(applicationLayer, scope));
+		const context = await Effect.runPromise(Layer.buildWithScope(withDevTools(applicationLayer, input.devToolsUrl), scope));
 		const collected = await Effect.runPromise(collectProductionFlowPorts.pipe(Effect.provide(context)));
 		const indexerUrl = input.indexerUrl ?? bootstrapResult.value.indexerUrl;
 		const indexerRead = productionIndexerReadPort(indexerUrl === void 0 ? input : {
@@ -4119,7 +4211,6 @@ function makeFinancialOpsMethods(deps) {
 		payments: makePaymentsMethods(deps),
 		approvals: makeApprovalsMethods(deps),
 		activity: makeActivityMethods(deps),
-		offramp: makeOfframpMethods(),
 		paymentDocuments: makePaymentDocumentsMethods(deps)
 	};
 }
@@ -4244,6 +4335,21 @@ function withHostObservationControls(snapshot, input, actorId) {
 	});
 }
 //#endregion
+//#region src/observability/telemetry/emit-once.ts
+/**
+* A product event that could not be built or emitted never reaches the caller
+* as a failure, and is never lost silently: the drop is logged by event name.
+*/
+function logDroppedEvent(eventName) {
+	return (effect) => effect.pipe(Effect.catchCause((cause) => {
+		const reason = Cause.squash(cause);
+		return Effect.logWarning("product.telemetry.emit.dropped").pipe(Effect.annotateLogs({
+			product_event: eventName,
+			reason: reason instanceof Error ? reason.message : String(reason)
+		}), Effect.ignoreCause);
+	}));
+}
+//#endregion
 //#region src/platform/client/signer-readiness.ts
 /**
 * Start the signer readiness cycle when the identity becomes claimed (#1667).
@@ -4527,6 +4633,37 @@ function makeClientInternals(input, shared) {
 	};
 }
 //#endregion
+//#region src/platform/client/scopes.ts
+const makeClientScopes = (input, runPromise, invocationControls) => {
+	const shared = {
+		convexCall: input.ports.convexCall,
+		runPromise,
+		invocationControls
+	};
+	const verification = {
+		...input.ports,
+		siteBaseUrl: input.bootstrap.siteBaseUrl,
+		runPromise,
+		invocationControls
+	};
+	return {
+		personal: {
+			banking: makeBankingMethods(shared),
+			verification: makeVerificationMethods(verification)
+		},
+		organization: {
+			banking: (orgId) => makeBankingMethods(shared, {
+				kind: "org",
+				orgId
+			}),
+			verification: (orgId) => makeVerificationMethods(verification, {
+				kind: "organization",
+				orgId
+			})
+		}
+	};
+};
+//#endregion
 //#region src/platform/client/assemble.ts
 function assembleCapxulClient(input) {
 	const observation = input;
@@ -4538,7 +4675,6 @@ function assembleCapxulClient(input) {
 	};
 	const { actor, stopActor } = bootClientActor(input, effectRunner, observation);
 	const invocationControls = (controls) => withHostObservationControls(observation.hostObservationSnapshot, controls, actor.authSession()?.authUserId);
-	const selectedOrgPort = input.orgPort;
 	let kickProvisioning;
 	const financialOps = makeFinancialOpsMethods({
 		runPromise: effectRunner.runPromise,
@@ -4647,6 +4783,7 @@ function assembleCapxulClient(input) {
 		invocationControls
 	};
 	const accounts = makeAccountsMethods(accountsInput);
+	const scopes = makeClientScopes(input, effectRunner.runPromise, invocationControls);
 	const orgMethods = makeOrgMethods({
 		actor,
 		chainId: input.bootstrap.chainId,
@@ -4654,8 +4791,9 @@ function assembleCapxulClient(input) {
 		runPromise: effectRunner.runPromise,
 		invocationControls,
 		requestKeyScope: `${input.bootstrap.convexUrl}:${String(input.bootstrap.chainId)}`,
-		...selectedOrgPort === void 0 ? {} : { orgPort: selectedOrgPort },
+		...input.orgPort === void 0 ? {} : { orgPort: input.orgPort },
 		convexCall: input.ports.convexCall,
+		...scopes.organization,
 		...input.signer === void 0 ? {} : { signer: input.signer },
 		...input.organizationSetup === void 0 ? {} : { organizationSetup: input.organizationSetup }
 	});
@@ -4667,6 +4805,7 @@ function assembleCapxulClient(input) {
 	});
 	const identityRuntime = makeIdentityRuntime(actor, input.ports.identity, effectRunner.runPromise);
 	const client = {
+		...scopes.personal,
 		checkouts: makeCheckoutMethods({
 			convexCall: input.ports.convexCall,
 			runPromise: effectRunner.runPromise,

package/dist/testing/index.d.mts

@@ -1,4 +1,4 @@
-import { Aa as OrganizationSetup, Co as CapxulResult, E as OpenfortBrowserSignerOptions, Ji as CapxulSigner, ao as TelemetryPortEvent, io as TelemetryEvent, l as CapxulClientInput, mo as ObservationAdapter, no as TelemetryGroupInput, ot as IdentityTransition, ro as TelemetryIdentifyInput, z as CapxulClient } from "../index-DidkO1aY.mjs";
+import { Ao as TelemetryIdentifyInput, Mo as TelemetryPortEvent, R as CapxulClient, T as OpenfortBrowserSignerOptions, Vo as ObservationAdapter, Xo as CapxulResult, at as IdentityTransition, ba as CapxulSigner, c as CapxulClientInput, jo as TelemetryEvent, ko as TelemetryGroupInput, ro as OrganizationSetup } from "../index-VeQh7FNW.mjs";
 import { Effect, Layer } from "effect";
 //#region src/platform/production-client.d.ts
 /** Per-client signing controls; only the testing entry exposes these to consumers. */

package/dist/testing/index.mjs

@@ -1,5 +1,5 @@
-import { Ai as toEpochMs, D as convexCallErrorFromCapxul, Et as CONFIGURED_MONEY_ASSETS, Fi as toSessionToken, Fr as absurd, Ii as Errors, Li as CapxulError, Mi as toAuthUserId, Mr as toAddress, Ni as toEmail, Nr as toChainId, Ot as deriveCapxulSafeAddress, Pi as toJwtToken, Pr as toWeiAmount, Qn as toOrgId, Ti as InMemoryAuthCacheAdapter, Z as assetAmountFromRaw, _ as accountFromAccountPositions, _i as toAllowedOrigin, ai as ClockPortTag, bi as authClientPortFromPromiseAdapter, f as smartAccountErrorFromCapxul, fn as toCountryCode, gn as toHandle, ii as ClockError, j as wireChainId, ji as toEpochSeconds, ki as toDurationMs, nt as toRaw, oi as readClockNow, pn as toKycTier, ur as toAccountId, vi as toAppId, vn as validateHandle, w as accountReadErrorFromCapxul, yi as toPublishableKey, yn as redactTelemetryEvent } from "../access-B-2qmxF_.mjs";
-import { a as cloneTelemetryEvent, c as identityErrorFromCapxul, l as bootstrapErrorFromCapxul, n as createCapxulClientWithSignerControls, o as cloneTelemetryProps, r as assembleCapxulClient, s as IdentityPortTag } from "../production-2L76NWS5.mjs";
+import { Ai as toDurationMs, D as convexCallErrorFromCapxul, Dt as deriveCapxulSafeAddress, Ei as InMemoryAuthCacheAdapter, Fi as toJwtToken, Fr as toWeiAmount, Ii as toSessionToken, Ir as absurd, Li as Errors, Mi as toEpochSeconds, Ni as toAuthUserId, Nr as toAddress, Pi as toEmail, Pr as toChainId, Ri as CapxulError, Tt as CONFIGURED_MONEY_ASSETS, X as assetAmountFromRaw, Zn as toOrgId, _ as accountFromAccountPositions, _n as validateHandle, ai as ClockError, bi as toPublishableKey, dn as toCountryCode, dr as toAccountId, f as smartAccountErrorFromCapxul, fn as toKycTier, hn as toHandle, j as wireChainId, ji as toEpochMs, oi as ClockPortTag, si as readClockNow, tt as toRaw, vi as toAllowedOrigin, vn as redactTelemetryEvent, w as accountReadErrorFromCapxul, xi as authClientPortFromPromiseAdapter, yi as toAppId } from "../access-l_ci38yt.mjs";
+import { a as cloneTelemetryEvent, c as identityErrorFromCapxul, l as bootstrapErrorFromCapxul, n as createCapxulClientWithSignerControls, o as cloneTelemetryProps, r as assembleCapxulClient, s as IdentityPortTag } from "../production-BzEOaP6l.mjs";
 import { Effect, Layer, Result, Semaphore } from "effect";
 import { getFunctionName } from "convex/server";
 //#region src/testing/production-client.ts

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@capxul/sdk",
-  "version": "4.20.0-beta.31",
+  "version": "4.20.0-beta.33",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/Xelmar-tech/infrastructure.git",
@@ -17,6 +17,7 @@
     "#accounts": "./src/accounts/index.ts",
     "#activity": "./src/activity/index.ts",
     "#applications": "./src/applications/index.ts",
+    "#banking": "./src/banking/index.ts",
     "#documents": "./src/documents/index.ts",
     "#indexing": "./src/indexing/index.ts",
     "#media": "./src/media/index.ts",
@@ -83,9 +84,9 @@
     "vite-plus": "1.0.0",
     "vitest": "5.0.1",
     "zodiac-roles-sdk": "2.22.2",
-    "@capxul/observability": "4.20.0-beta.31",
-    "@capxul/typescript-config": "0.0.0",
-    "@capxul/protocol": "0.2.0-beta.4"
+    "@capxul/observability": "4.20.0-beta.33",
+    "@capxul/protocol": "0.2.0-beta.5",
+    "@capxul/typescript-config": "0.0.0"
   },
   "_permissionlessPinReason": "permissionless.toSafeSmartAccount is pinned to 0.3.4 for live Safe deployment E2E. Counterfactual address fixtures captured 2026-05-17 in packages/backend/convex/_shared/__tests__/counterfactual.test.ts and packages/config/tests/safe.test.ts must be re-verified before upgrading.",
   "scripts": {