@capxul/sdk 0.1.0-alpha.1 → 0.1.0-alpha.12

package/dist/index.js

@@ -68,12 +68,775 @@ function fromConvexError(error) {
   });
 }
 
+// ../observability/src/try-catch.ts
+async function tryCatch(promise) {
+  try {
+    return [null, await promise];
+  } catch (e) {
+    return [e instanceof Error ? e : new Error(String(e)), null];
+  }
+}
+
+// ../observability/src/debug-log.ts
+function isDevelopmentBuild() {
+  if (typeof process === "undefined") {
+    return false;
+  }
+  return process.env?.NODE_ENV === "development" || process.env?.NODE_ENV === "test";
+}
+function debugLog(line) {
+  if (!isDevelopmentBuild()) return;
+  if (typeof globalThis !== "undefined" && "window" in globalThis && typeof console?.info === "function") {
+    console.info(line);
+    return;
+  }
+  if (typeof process !== "undefined" && typeof process.stderr?.write === "function") {
+    process.stderr.write(`${line}
+`);
+  }
+}
+function formatDebugValue(value) {
+  if (value === void 0 || value === "") return "";
+  if (typeof value === "string") return value;
+  try {
+    return JSON.stringify(value);
+  } catch {
+    return String(value);
+  }
+}
+function track(...args) {
+  const [name, props] = args;
+  debugLog(`[TRACK] ${name} ${formatDebugValue(props ?? "")}`);
+}
+function formatDebugValue2(value) {
+  if (value === void 0 || value === "") return "";
+  if (typeof value === "string") return value;
+  try {
+    return JSON.stringify(value);
+  } catch {
+    return String(value);
+  }
+}
+function identify(userId, traits) {
+  debugLog(`[IDENTIFY] ${userId} ${formatDebugValue2(traits ?? "")}`);
+}
+
+// ../platform-kernel/src/ids.ts
+function makePrefixedIdConstructor(prefix, fieldName) {
+  const re = new RegExp(`^${prefix}_[A-Za-z0-9_\\-]+$`);
+  return (raw) => {
+    if (typeof raw !== "string" || !re.test(raw)) {
+      throw new Error(
+        `Invalid ${fieldName}: expected string matching ^${prefix}_[A-Za-z0-9_\\-]+$, got ${String(raw)}`
+      );
+    }
+    return raw;
+  };
+}
+var toAccountId = makePrefixedIdConstructor(
+  "acct",
+  "accountId"
+);
+var toOrganizationId = makePrefixedIdConstructor("org", "organizationId");
+var toMemberId = makePrefixedIdConstructor(
+  "mem",
+  "memberId"
+);
+var toSafeId = makePrefixedIdConstructor(
+  "safe",
+  "safeId"
+);
+var toTreasuryId = makePrefixedIdConstructor(
+  "try",
+  "treasuryId"
+);
+var toApiKeyId = makePrefixedIdConstructor(
+  "ak",
+  "apiKeyId"
+);
+var toOperationId = makePrefixedIdConstructor(
+  "op",
+  "operationId"
+);
+var toCorrelationId = makePrefixedIdConstructor("ctx", "correlationId");
+var toKycProfileId = makePrefixedIdConstructor(
+  "kyc",
+  "kycProfileId"
+);
+var toKybProfileId = makePrefixedIdConstructor(
+  "kyb",
+  "kybProfileId"
+);
+var toExternalAccountId = makePrefixedIdConstructor("ext", "externalAccountId");
+var toPaymentId = makePrefixedIdConstructor(
+  "pay",
+  "paymentId"
+);
+var toWithdrawalId = makePrefixedIdConstructor(
+  "wd",
+  "withdrawalId"
+);
+var toWebhookEndpointId = makePrefixedIdConstructor("we", "webhookEndpointId");
+var toWebhookEventId = makePrefixedIdConstructor("evt", "webhookEventId");
+var toSubAccountId = makePrefixedIdConstructor(
+  "sub",
+  "subAccountId"
+);
+var toVirtualAccountId = makePrefixedIdConstructor("va", "virtualAccountId");
+var toVirtualCardId = makePrefixedIdConstructor(
+  "vc",
+  "virtualCardId"
+);
+var toTransferId = makePrefixedIdConstructor(
+  "txfr",
+  "transferId"
+);
+var toDocumentId = makePrefixedIdConstructor(
+  "doc",
+  "documentId"
+);
+var toBalanceLedgerEntryId = makePrefixedIdConstructor("bal", "balanceLedgerEntryId");
+
+// ../platform-kernel/src/value-objects.ts
+var PHONE_NUMBER_RE = /^\+[1-9]\d{1,14}$/;
+function toPhoneNumber(raw) {
+  if (typeof raw !== "string" || !PHONE_NUMBER_RE.test(raw)) {
+    throw new Error(
+      `Invalid phoneNumber: expected E.164 string matching ^\\+[1-9]\\d{1,14}$, got ${String(raw)}`
+    );
+  }
+  return raw;
+}
+var EMAIL_RE = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
+function toEmail(raw) {
+  if (typeof raw !== "string") {
+    throw new Error(
+      `Invalid email: expected string, got ${String(raw)}`
+    );
+  }
+  const lowered = raw.trim().toLowerCase();
+  if (!EMAIL_RE.test(lowered)) {
+    throw new Error(
+      `Invalid email: expected local@domain.tld, got ${String(raw)}`
+    );
+  }
+  return lowered;
+}
+var USERNAME_RE = /^[a-z][a-z0-9_-]{2,29}$/;
+function toUsername(raw) {
+  if (typeof raw !== "string") {
+    throw new Error(
+      `Invalid username: expected string, got ${String(raw)}`
+    );
+  }
+  const lowered = raw.toLowerCase();
+  if (!USERNAME_RE.test(lowered)) {
+    throw new Error(
+      `Invalid username: expected 3-30 chars, letter-first, [a-z0-9_-], got ${String(raw)}`
+    );
+  }
+  return lowered;
+}
+
+// src/core/external-accounts.ts
+function brandExternalAccount(raw) {
+  return {
+    ...raw,
+    id: toExternalAccountId(raw.id),
+    operation: {
+      id: toOperationId(raw.operation.id),
+      status: raw.operation.status,
+      correlationId: toCorrelationId(raw.operation.correlationId)
+    }
+  };
+}
+function createExternalAccountsClient(config = {}) {
+  return {
+    retrieve: async (externalAccountId) => {
+      if (!config.data) {
+        return stub(
+          "externalAccounts.retrieve"
+        );
+      }
+      const [err, raw] = await tryCatch(
+        config.data.query(api.externalAccounts.queries.retrievePersonal, {
+          externalAccountId
+        })
+      );
+      if (err) {
+        return [
+          fromConvexError(err),
+          null
+        ];
+      }
+      if (!raw) {
+        return [
+          new CapxulError({
+            code: "NOT_FOUND",
+            message: `external_account ${externalAccountId} not found`
+          }),
+          null
+        ];
+      }
+      return [null, brandExternalAccount(raw)];
+    },
+    remove: async (externalAccountId) => {
+      if (!config.data) {
+        return stub("externalAccounts.remove");
+      }
+      const [err] = await tryCatch(
+        config.data.mutation(api.externalAccounts.mutations.removePersonal, {
+          externalAccountId
+        })
+      );
+      if (err) {
+        return [
+          fromConvexError(err),
+          null
+        ];
+      }
+      return [null, void 0];
+    }
+  };
+}
+
+// src/core/sub-accounts.ts
+function malformedWireError(reason, raw) {
+  return new CapxulError({
+    code: "PROVIDER_ERROR",
+    message: `convex brandSubAccount failed: ${reason}`,
+    details: {
+      provider: "convex",
+      operation: "brandSubAccount",
+      reason,
+      // PII discipline (`.claude/rules/posthog.md`): user-authored
+      // strings on the wire (`name`, `purpose`) are customer-confidential
+      // — sub-account names like "Q3 Acquisition Reserve" or
+      // "Vendor ABC payments" must not flow into telemetry. We emit a
+      // structural keys-only sample via a strict ALLOWLIST so any future
+      // wire-shape addition (e.g. `recipientEmail`, `tags`) is dropped
+      // by construction rather than leaked through a denylist gap.
+      sample: safeSampleShape(raw)
+    }
+  });
+}
+function safeSampleShape(raw) {
+  if (raw === null || typeof raw !== "object") {
+    return { type: typeof raw };
+  }
+  const r = raw;
+  const balance = r.balance;
+  return {
+    object: typeof r.object === "string" ? r.object : typeof r.object,
+    idPresent: typeof r.id === "string" && r.id.length > 0,
+    // First 4 chars only — enough to distinguish "sub_" prefixed IDs
+    // from accidental other resource IDs without leaking the full ID.
+    idPrefix: typeof r.id === "string" ? r.id.slice(0, 4) : void 0,
+    parentKind: r.parent !== null && typeof r.parent === "object" ? r.parent.kind : typeof r.parent,
+    status: r.status,
+    hasName: typeof r.name === "string",
+    hasPurpose: r.purpose !== void 0,
+    balanceShape: balance !== null && typeof balance === "object" ? Object.keys(balance).sort() : typeof balance,
+    createdAtType: typeof r.createdAt,
+    updatedAtType: typeof r.updatedAt
+  };
+}
+function isMoneyShape(v) {
+  if (typeof v !== "object" || v === null) return false;
+  const m = v;
+  return typeof m.value === "string" && typeof m.currency === "string";
+}
+function isParentShape(v) {
+  if (typeof v !== "object" || v === null) return false;
+  const p = v;
+  return (p.kind === "account" || p.kind === "organization") && typeof p.id === "string";
+}
+function isFiniteNonNegativeInteger(v) {
+  return typeof v === "number" && Number.isFinite(v) && Number.isInteger(v) && v >= 0;
+}
+function validateWireSubAccount(raw) {
+  if (typeof raw !== "object" || raw === null) {
+    return { ok: false, reason: "not an object" };
+  }
+  const r = raw;
+  if (r.object !== "sub_account") {
+    return { ok: false, reason: `object must be "sub_account" (got ${String(r.object)})` };
+  }
+  if (typeof r.id !== "string" || r.id.length === 0) {
+    return { ok: false, reason: "id must be a non-empty string" };
+  }
+  if (!isParentShape(r.parent)) {
+    return { ok: false, reason: "parent must be { kind: 'account' | 'organization', id: string }" };
+  }
+  if (typeof r.name !== "string") {
+    return { ok: false, reason: "name must be a string" };
+  }
+  if (r.purpose !== void 0 && typeof r.purpose !== "string") {
+    return { ok: false, reason: "purpose must be a string when present" };
+  }
+  if (r.status !== "active" && r.status !== "archived") {
+    return { ok: false, reason: `status must be "active" | "archived" (got ${String(r.status)})` };
+  }
+  if (!isMoneyShape(r.balance)) {
+    return { ok: false, reason: "balance must be { value: string, currency: string }" };
+  }
+  if (!isFiniteNonNegativeInteger(r.createdAt)) {
+    return { ok: false, reason: "createdAt must be a finite non-negative integer (epoch ms)" };
+  }
+  if (r.updatedAt !== void 0 && !isFiniteNonNegativeInteger(r.updatedAt)) {
+    return { ok: false, reason: "updatedAt must be a finite non-negative integer when present" };
+  }
+  return { ok: true, value: r };
+}
+function brandSubAccount(raw) {
+  const result = validateWireSubAccount(raw);
+  if (!result.ok) {
+    throw malformedWireError(result.reason, raw);
+  }
+  const wire = result.value;
+  return {
+    object: wire.object,
+    id: toSubAccountId(wire.id),
+    parent: wire.parent,
+    name: wire.name,
+    ...wire.purpose !== void 0 ? { purpose: wire.purpose } : {},
+    status: wire.status,
+    balance: wire.balance,
+    createdAt: new Date(wire.createdAt).toISOString()
+  };
+}
+function tryBrandSubAccount(raw) {
+  try {
+    return [null, brandSubAccount(raw)];
+  } catch (err) {
+    if (err instanceof CapxulError && err.code === "PROVIDER_ERROR") {
+      return [err, null];
+    }
+    return [
+      malformedWireError(
+        err instanceof Error ? err.message : String(err),
+        raw
+      ),
+      null
+    ];
+  }
+}
+function createSubAccountsClient(config = {}) {
+  return {
+    retrieve: async (subAccountId) => {
+      if (!config.data) {
+        return stub("subAccounts.retrieve");
+      }
+      const [err, raw] = await tryCatch(
+        config.data.query(api.subAccounts.queries.retrieve, {
+          subAccountId
+        })
+      );
+      if (err) {
+        return [
+          fromConvexError(err),
+          null
+        ];
+      }
+      if (!raw) {
+        return [
+          new CapxulError({
+            code: "NOT_FOUND",
+            message: `sub_account ${subAccountId} not found`
+          }),
+          null
+        ];
+      }
+      const [brandErr, branded] = tryBrandSubAccount(raw);
+      if (brandErr) {
+        return [brandErr, null];
+      }
+      return [null, branded];
+    },
+    remove: async (subAccountId) => {
+      if (!config.data) {
+        return stub("subAccounts.remove");
+      }
+      const [err, raw] = await tryCatch(
+        config.data.mutation(api.subAccounts.mutations.archive, {
+          subAccountId
+        })
+      );
+      if (err) {
+        return [
+          fromConvexError(err),
+          null
+        ];
+      }
+      if (!raw) {
+        return [
+          new CapxulError({
+            code: "NOT_FOUND",
+            message: `sub_account ${subAccountId} not found`
+          }),
+          null
+        ];
+      }
+      const [brandErr, branded] = tryBrandSubAccount(raw);
+      if (brandErr) {
+        return [brandErr, null];
+      }
+      return [null, branded];
+    }
+  };
+}
+
 // src/core/accounts.ts
+function createAccountExternalAccountsClient(config) {
+  return {
+    create: async (input) => {
+      if (!config.data) {
+        return stub(
+          "accounts.externalAccounts.create"
+        );
+      }
+      const [err, raw] = await tryCatch(
+        config.data.mutation(
+          api.externalAccounts.mutations.createPersonal,
+          {
+            kind: input.kind,
+            label: input.label,
+            address: input.address,
+            iban: input.iban,
+            bic: input.bic,
+            accountHolder: input.accountHolder,
+            network: input.network,
+            panToken: input.panToken,
+            last4: input.last4
+          }
+        )
+      );
+      if (err) {
+        return [
+          fromConvexError(err),
+          null
+        ];
+      }
+      if (!raw) {
+        return [
+          new CapxulError({
+            code: "NOT_FOUND",
+            message: "external_account creation returned no resource"
+          }),
+          null
+        ];
+      }
+      return [
+        null,
+        brandExternalAccount(
+          raw
+        )
+      ];
+    },
+    list: async (input) => {
+      if (!config.data) {
+        return stub(
+          "accounts.externalAccounts.list"
+        );
+      }
+      const [err, result] = await tryCatch(
+        config.data.query(api.externalAccounts.queries.listPersonal, {
+          limit: input.limit,
+          cursor: input.cursor
+        })
+      );
+      if (err) {
+        return [fromConvexError(err), null];
+      }
+      const branded = result.data.map(
+        (row) => brandExternalAccount(
+          row
+        )
+      );
+      return [
+        null,
+        {
+          object: "list",
+          data: branded,
+          page: result.page
+        }
+      ];
+    },
+    retrieve: async (externalAccountId) => {
+      if (!config.data) {
+        return stub(
+          "accounts.externalAccounts.retrieve"
+        );
+      }
+      const [err, raw] = await tryCatch(
+        config.data.query(api.externalAccounts.queries.retrievePersonal, {
+          externalAccountId
+        })
+      );
+      if (err) {
+        return [
+          fromConvexError(err),
+          null
+        ];
+      }
+      if (!raw) {
+        return [
+          new CapxulError({
+            code: "NOT_FOUND",
+            message: `external_account ${externalAccountId} not found`
+          }),
+          null
+        ];
+      }
+      return [
+        null,
+        brandExternalAccount(
+          raw
+        )
+      ];
+    },
+    remove: async (externalAccountId) => {
+      if (!config.data) {
+        return stub("accounts.externalAccounts.remove");
+      }
+      const [err] = await tryCatch(
+        config.data.mutation(api.externalAccounts.mutations.removePersonal, {
+          externalAccountId
+        })
+      );
+      if (err) {
+        return [
+          fromConvexError(err),
+          null
+        ];
+      }
+      return [null, void 0];
+    }
+  };
+}
+function createAccountSubAccountsClient(config) {
+  return {
+    create: async (input) => {
+      if (!config.data) {
+        return stub(
+          "accounts.subAccounts.create"
+        );
+      }
+      const [err, raw] = await tryCatch(
+        config.data.mutation(api.subAccounts.mutations.create, {
+          parent: { kind: "account", id: input.accountId },
+          name: input.name,
+          purpose: input.purpose
+        })
+      );
+      if (err) {
+        return [
+          fromConvexError(err),
+          null
+        ];
+      }
+      if (!raw) {
+        return [
+          new CapxulError({
+            code: "NOT_FOUND",
+            message: "sub_account creation returned no resource"
+          }),
+          null
+        ];
+      }
+      const [brandErr, branded] = tryBrandSubAccount(raw);
+      if (brandErr) {
+        return [
+          brandErr,
+          null
+        ];
+      }
+      return [null, branded];
+    },
+    list: async (input) => {
+      if (!config.data) {
+        return stub(
+          "accounts.subAccounts.list"
+        );
+      }
+      const [err, rows] = await tryCatch(
+        config.data.query(api.subAccounts.queries.listByAccount, {
+          accountId: input.accountId
+        })
+      );
+      if (err) {
+        return [
+          fromConvexError(err),
+          null
+        ];
+      }
+      const branded = [];
+      for (const row of rows) {
+        const [brandErr, value] = tryBrandSubAccount(row);
+        if (brandErr) {
+          return [
+            brandErr,
+            null
+          ];
+        }
+        branded.push(value);
+      }
+      return [
+        null,
+        {
+          object: "list",
+          data: branded,
+          page: { hasMore: false }
+        }
+      ];
+    },
+    retrieve: async (subAccountId) => {
+      if (!config.data) {
+        return stub(
+          "accounts.subAccounts.retrieve"
+        );
+      }
+      const [err, raw] = await tryCatch(
+        config.data.query(api.subAccounts.queries.retrieve, {
+          subAccountId
+        })
+      );
+      if (err) {
+        return [
+          fromConvexError(err),
+          null
+        ];
+      }
+      if (!raw) {
+        return [
+          new CapxulError({
+            code: "NOT_FOUND",
+            message: `sub_account ${subAccountId} not found`
+          }),
+          null
+        ];
+      }
+      const [brandErr, branded] = tryBrandSubAccount(raw);
+      if (brandErr) {
+        return [
+          brandErr,
+          null
+        ];
+      }
+      return [null, branded];
+    },
+    remove: async (subAccountId) => {
+      if (!config.data) {
+        return stub(
+          "accounts.subAccounts.remove"
+        );
+      }
+      const [err, raw] = await tryCatch(
+        config.data.mutation(api.subAccounts.mutations.archive, {
+          subAccountId
+        })
+      );
+      if (err) {
+        return [
+          fromConvexError(err),
+          null
+        ];
+      }
+      if (!raw) {
+        return [
+          new CapxulError({
+            code: "NOT_FOUND",
+            message: `sub_account ${subAccountId} not found`
+          }),
+          null
+        ];
+      }
+      const [brandErr, branded] = tryBrandSubAccount(raw);
+      if (brandErr) {
+        return [
+          brandErr,
+          null
+        ];
+      }
+      return [null, branded];
+    }
+  };
+}
 function createAccountsClient(config = {}) {
   return {
-    retrieve: async () => stub("accounts.retrieve"),
+    retrieve: async (accountId) => {
+      if (!config.data) {
+        return stub("accounts.retrieve");
+      }
+      try {
+        const account = await config.data.query(
+          api.openfort.queries.getMyAccount,
+          {}
+        );
+        if (account.id !== accountId) {
+          return [
+            new CapxulError({
+              code: "PERMISSION_DENIED",
+              message: "accounts.retrieve currently supports the authenticated caller's own account only.",
+              details: {
+                requestedAccountId: accountId,
+                authenticatedAccountId: account.id
+              }
+            }),
+            null
+          ];
+        }
+        return [null, account];
+      } catch (cause) {
+        return [fromConvexError(cause), null];
+      }
+    },
     lookup: async () => stub("accounts.lookup"),
-    update: async () => stub("accounts.update"),
+    update: async (input) => {
+      if (!config.data) {
+        return stub("accounts.update");
+      }
+      if (input.countryCode !== void 0) {
+        return [
+          new CapxulError({
+            code: "INVALID_INPUT",
+            message: "accounts.update does not support countryCode yet \u2014 backend mutation only patches displayName and username.",
+            details: { field: "countryCode" }
+          }),
+          null
+        ];
+      }
+      try {
+        const current = await config.data.query(
+          api.openfort.queries.getMyAccount,
+          {}
+        );
+        if (current.id !== input.accountId) {
+          return [
+            new CapxulError({
+              code: "PERMISSION_DENIED",
+              message: "accounts.update currently supports the authenticated caller's own account only.",
+              details: {
+                requestedAccountId: input.accountId,
+                authenticatedAccountId: current.id
+              }
+            }),
+            null
+          ];
+        }
+        await config.data.mutation(api.openfort.mutations.updateProfile, {
+          displayName: input.name,
+          username: input.username
+        });
+        const updated = await config.data.query(
+          api.openfort.queries.getMyAccount,
+          {}
+        );
+        return [null, updated];
+      } catch (cause) {
+        return [fromConvexError(cause), null];
+      }
+    },
     provisionPersonal: async (input) => {
       if (!config.data) {
         return stub(
@@ -153,24 +916,8 @@ function createAccountsClient(config = {}) {
       create: async () => stub("accounts.kycProfiles.create"),
       retrieve: async () => stub("accounts.kycProfiles.retrieve")
     },
-    externalAccounts: {
-      create: async () => stub(
-        "accounts.externalAccounts.create"
-      ),
-      list: async () => stub(
-        "accounts.externalAccounts.list"
-      ),
-      retrieve: async () => stub(
-        "accounts.externalAccounts.retrieve"
-      ),
-      remove: async () => stub("accounts.externalAccounts.remove")
-    },
-    subAccounts: {
-      create: async () => stub("accounts.subAccounts.create"),
-      list: async () => stub("accounts.subAccounts.list"),
-      retrieve: async () => stub("accounts.subAccounts.retrieve"),
-      remove: async () => stub("accounts.subAccounts.remove")
-    },
+    externalAccounts: createAccountExternalAccountsClient(config),
+    subAccounts: createAccountSubAccountsClient(config),
     balanceLedger: {
       list: async () => stub(
         "accounts.balanceLedger.list"
@@ -230,10 +977,16 @@ var Errors = {
     `Shield API error (${status}): ${detail}`,
     { details: { provider: "shield", status } }
   ),
-  providerError: (provider, operation, cause) => new CapxulError2(
-    "PROVIDER_ERROR",
-    `${provider} ${operation} failed: ${cause instanceof Error ? cause.message : String(cause)}`,
-    { cause, details: { provider, operation } }
+  providerError: (provider, operation, cause) => (
+    // Public `message` is redacted to a fixed shape so provider-side
+    // exception text never leaks to the client. The original `cause`
+    // is preserved on `Error.cause` for server-side debugging via
+    // observability sinks (Sentry, console traces).
+    new CapxulError2(
+      "PROVIDER_ERROR",
+      `Provider error: ${provider} ${operation}`,
+      { cause, details: { provider, operation } }
+    )
   ),
   invalidInput: (field, reason) => new CapxulError2(
     "INVALID_INPUT",
@@ -259,8 +1012,35 @@ var Errors = {
     "Idempotency key was already used for a different request",
     { details }
   ),
-  emailDeliveryFailed: (detail) => new CapxulError2("EMAIL_DELIVERY_FAILED", `Failed to send email: ${detail}`),
-  internalError: (reason) => new CapxulError2("INTERNAL_ERROR", `Internal error: ${reason}`)
+  emailDeliveryFailed: (detail, details) => new CapxulError2("EMAIL_DELIVERY_FAILED", `Failed to send email: ${detail}`, {
+    details
+  }),
+  rateLimited: (details) => new CapxulError2("RATE_LIMITED", "Request was rate limited", {
+    details: { ...details }
+  }),
+  internalError: (reason) => new CapxulError2("INTERNAL_ERROR", `Internal error: ${reason}`),
+  /**
+   * Verification gate. Surfaced when a request hits a verification
+   * boundary the actor cannot cross under their current state. Two
+   * variants share this code:
+   *
+   * - Rail gate (Withdrawals v1 W2, #465): the resolved
+   *   `external_account.kind` routes to a withdrawal rail (e.g.
+   *   `fiat_offramp`, `card_payout`) that is not yet supported. Carries
+   *   `details.rail` + `details.currentKind`.
+   * - KYC tier gate (legacy / future): the actor's KYC tier is below
+   *   the required tier. Carries `details.requiredTier`.
+   *
+   * Code is shared because both expose the same UX shape ("you cannot
+   * proceed until verification advances"); the `details.*` keys
+   * differentiate the route.
+   */
+  verificationRequired: (details) => {
+    const message = "rail" in details ? `Withdrawal rail "${details.rail}" (kind=${details.currentKind}) is not yet supported.` : `Verification tier ${details.requiredTier} is required.`;
+    return new CapxulError2("VERIFICATION_REQUIRED", message, {
+      details: { ...details }
+    });
+  }
 };
 
 // ../config/src/safe.ts
@@ -310,13 +1090,13 @@ function createLifecycle(initial) {
 }
 function makeBuildTimeUrlsTransport(config) {
   if (!config.authBaseUrl || config.authBaseUrl.trim().length === 0) {
-    throw Errors.invalidInput(
+    throw invalidConfigError(
       "authBaseUrl",
       "build-time-urls transport requires a non-empty authBaseUrl."
     );
   }
   if (!config.convexUrl || config.convexUrl.trim().length === 0) {
-    throw Errors.invalidInput(
+    throw invalidConfigError(
       "convexUrl",
       "build-time-urls transport requires a non-empty convexUrl."
     );
@@ -330,6 +1110,7 @@ function makeBuildTimeUrlsTransport(config) {
   return {
     authBaseUrl,
     convexUrl,
+    ensureRuntime: async () => runtime,
     fetch: (path, init) => fetchImpl(resolveUrl(authBaseUrl, path), init),
     getState: lifecycle.getState,
     subscribe: lifecycle.subscribe,
@@ -345,14 +1126,15 @@ function makeBuildTimeUrlsTransport(config) {
   };
 }
 function makePublishableKeyTransport(config) {
-  if (!config.publishableKey || config.publishableKey.trim().length === 0) {
-    throw Errors.invalidInput(
+  const publishableKey = config.publishableKey?.trim();
+  if (!publishableKey) {
+    throw invalidConfigError(
       "publishableKey",
       "publishable-key transport requires a non-empty publishableKey."
     );
   }
   const fetchImpl = config.fetchImpl ?? globalThis.fetch;
-  const bootstrapUrl = stripTrailingSlash(
+  const bootstrapUrl = normalizeBootstrapUrl(
     config.bootstrapUrl ?? `${CAPXUL_API_BASE_URL}/v1/client/bootstrap`
   );
   let authBaseUrl = "";
@@ -367,23 +1149,20 @@ function makePublishableKeyTransport(config) {
       const response = await fetchImpl(bootstrapUrl, {
         method: "POST",
         headers: { "content-type": "application/json" },
-        body: JSON.stringify({ publishableKey: config.publishableKey })
+        body: JSON.stringify({ publishableKey })
       });
       if (!response.ok) {
-        throw Errors.invalidInput(
-          "publishableKey",
-          `${bootstrapUrl} failed with HTTP ${response.status}.`
-        );
+        throw await bootstrapResponseError(response, bootstrapUrl);
       }
-      const body = await response.json();
+      const body = await readBootstrapSuccessBody(response);
       if (typeof body.authBaseUrl !== "string" || body.authBaseUrl.trim().length === 0) {
-        throw Errors.invalidInput(
+        throw bootstrapContractError(
           "authBaseUrl",
           "/v1/client/bootstrap returned no authBaseUrl."
         );
       }
       if (typeof body.convexUrl !== "string" || body.convexUrl.trim().length === 0) {
-        throw Errors.invalidInput(
+        throw bootstrapContractError(
           "convexUrl",
           "/v1/client/bootstrap returned no convexUrl."
         );
@@ -395,16 +1174,13 @@ function makePublishableKeyTransport(config) {
       return runtime;
     })();
     bootstrapPromise = attempt.catch((err) => {
+      const error = normalizeBootstrapThrownError(err);
       bootstrapPromise = null;
       lifecycle.setState({
         status: "error",
-        error: err instanceof CapxulError ? err : new CapxulError({
-          code: "UNKNOWN",
-          message: "Bootstrap failed without a typed CapxulError.",
-          cause: err
-        })
+        error
       });
-      throw err;
+      throw error;
     });
     return await bootstrapPromise;
   }
@@ -415,6 +1191,7 @@ function makePublishableKeyTransport(config) {
     get convexUrl() {
       return convexUrl;
     },
+    ensureRuntime: ensureBootstrap,
     fetch: async (path, init) => {
       const resolved = await ensureBootstrap();
       return await fetchImpl(resolveUrl(resolved.authBaseUrl, path), init);
@@ -425,7 +1202,7 @@ function makePublishableKeyTransport(config) {
     markAuthenticated: ({ dataClient: nextDataClient }) => {
       const current = lifecycle.getState();
       if (current.status !== "ready" && current.status !== "authenticated") {
-        throw Errors.internalError(
+        throw internalTransportError(
           `markAuthenticated() called from status="${current.status}". Expected "ready" or "authenticated".`
         );
       }
@@ -447,6 +1224,24 @@ function makePublishableKeyTransport(config) {
 function stripTrailingSlash(url) {
   return url.replace(/\/+$/, "");
 }
+function normalizeBootstrapUrl(url) {
+  const normalized = stripTrailingSlash(url.trim());
+  if (!isAbsoluteHttpUrl(normalized)) {
+    throw invalidConfigError(
+      "bootstrapUrl",
+      "publishable-key transport requires an absolute http(s) bootstrapUrl."
+    );
+  }
+  return normalized;
+}
+function isAbsoluteHttpUrl(url) {
+  try {
+    const parsed = new URL(url);
+    return parsed.protocol === "http:" || parsed.protocol === "https:";
+  } catch {
+    return false;
+  }
+}
 function resolveUrl(authBaseUrl, path) {
   if (path.startsWith("http://") || path.startsWith("https://")) {
     return path;
@@ -454,10 +1249,142 @@ function resolveUrl(authBaseUrl, path) {
   return `${authBaseUrl}${path}`;
 }
 function assertNever(value) {
-  throw Errors.internalError(
+  throw internalTransportError(
     `Unhandled BrowserCapxulConfig.mode: ${String(value.mode)}.`
   );
 }
+function invalidConfigError(field, reason) {
+  return new CapxulError({
+    code: "INVALID_INPUT",
+    message: `Invalid ${field}: ${reason}`,
+    details: { source: "sdk-config", field, reason }
+  });
+}
+function bootstrapContractError(field, message) {
+  return new CapxulError({
+    code: "INVALID_INPUT",
+    message,
+    details: {
+      source: "backend-bootstrap",
+      phase: "publishable-key-bootstrap",
+      field,
+      reason: message
+    }
+  });
+}
+function internalTransportError(reason) {
+  return new CapxulError({
+    code: "INTERNAL_ERROR",
+    message: `Internal error: ${reason}`,
+    details: { source: "sdk-transport", reason }
+  });
+}
+async function bootstrapResponseError(response, bootstrapUrl) {
+  const envelope = await readBootstrapErrorEnvelope(response);
+  const wireCode = readNonEmptyString(envelope?.error?.code);
+  const normalized = normalizeBootstrapErrorCode(wireCode);
+  const message = readNonEmptyString(envelope?.error?.message) ?? `${bootstrapUrl} failed with HTTP ${response.status}.`;
+  const backendDetails = readRecord(envelope?.error?.details);
+  return new CapxulError({
+    code: normalized.code,
+    message,
+    details: {
+      ...backendDetails,
+      source: "backend-bootstrap",
+      phase: "publishable-key-bootstrap",
+      httpStatus: response.status,
+      ...normalized.wireCode ? { wireCode: normalized.wireCode } : {}
+    },
+    operationId: readNonEmptyString(envelope?.error?.operationId),
+    correlationId: readNonEmptyString(envelope?.error?.correlationId),
+    retryable: typeof envelope?.error?.retryable === "boolean" ? envelope.error.retryable : void 0
+  });
+}
+async function readBootstrapErrorEnvelope(response) {
+  try {
+    const parsed = await response.json();
+    return typeof parsed === "object" && parsed !== null ? parsed : null;
+  } catch {
+    return null;
+  }
+}
+async function readBootstrapSuccessBody(response) {
+  try {
+    const parsed = await response.json();
+    return typeof parsed === "object" && parsed !== null ? parsed : {};
+  } catch {
+    throw bootstrapContractError(
+      "body",
+      "/v1/client/bootstrap returned invalid JSON."
+    );
+  }
+}
+function normalizeBootstrapThrownError(error) {
+  if (error instanceof CapxulError) return error;
+  return new CapxulError({
+    code: "NETWORK_ERROR",
+    message: "Publishable-key bootstrap network failure.",
+    cause: error,
+    details: {
+      source: "bootstrap-network",
+      phase: "publishable-key-bootstrap"
+    }
+  });
+}
+function normalizeBootstrapErrorCode(wireCode) {
+  if (wireCode === "INTERNAL_SERVER_ERROR") {
+    return { code: "INTERNAL_ERROR", wireCode };
+  }
+  if (wireCode && isCapxulErrorCode(wireCode)) {
+    return { code: wireCode };
+  }
+  return wireCode ? { code: "UNKNOWN", wireCode } : { code: "UNKNOWN" };
+}
+var CAPXUL_ERROR_CODES = /* @__PURE__ */ new Set([
+  "NOT_AUTHENTICATED",
+  "EMAIL_DELIVERY_FAILED",
+  "PROFILE_NOT_FOUND",
+  "SMART_ACCOUNT_MISSING",
+  "PLAYER_NOT_FOUND",
+  "ACCOUNT_NOT_FOUND",
+  "PROVIDER_ERROR",
+  "INVALID_INPUT",
+  "ENV_MISSING",
+  "NOT_IMPLEMENTED",
+  "VERIFICATION_REQUIRED",
+  "INSUFFICIENT_BALANCE",
+  "INVALID_RECIPIENT",
+  "TRANSACTION_FAILED",
+  "RATE_LIMITED",
+  "NETWORK_ERROR",
+  "UNKNOWN",
+  "PERMISSION_DENIED",
+  "API_KEY_INVALID",
+  "API_KEY_EXPIRED",
+  "IDEMPOTENCY_CONFLICT",
+  "NOT_FOUND",
+  "OPERATION_CANCELED",
+  "OPERATION_TIMEOUT",
+  "ACTION_REQUIRED",
+  "KYC_REQUIRED",
+  "POLICY_DENIED",
+  "SAFE_NOT_READY",
+  "PROVIDER_UNAVAILABLE",
+  "PROVIDER_REJECTED",
+  "RECONCILIATION_FAILED",
+  "INTERNAL_ERROR",
+  "QUOTE_EXPIRED",
+  "QUOTE_NOT_FOUND"
+]);
+function isCapxulErrorCode(value) {
+  return CAPXUL_ERROR_CODES.has(value);
+}
+function readRecord(value) {
+  return typeof value === "object" && value !== null ? value : null;
+}
+function readNonEmptyString(value) {
+  return typeof value === "string" && value.trim().length > 0 ? value.trim() : null;
+}
 
 // src/core/auth.ts
 function createAuthClient(config = {}) {
@@ -512,13 +1439,16 @@ function createAuthClient(config = {}) {
         email: signIn.user.email,
         token: signIn.token,
         convexJwt,
-        expiresAt: new Date(Date.now() + 30 * 24 * 60 * 60 * 1e3).toISOString()
+        expiresAt: new Date(
+          Date.now() + 30 * 24 * 60 * 60 * 1e3
+        ).toISOString()
       };
       sessionStore.set(session);
       if (config.auth?.createDataClient) {
         try {
           dataClient = await config.auth.createDataClient(session);
           mutableConfig(config).data = dataClient;
+          transport.markAuthenticated({ dataClient });
         } catch (cause) {
           return [
             new CapxulError({
@@ -530,13 +1460,76 @@ function createAuthClient(config = {}) {
           ];
         }
       }
-      return [null, session];
+      if (!dataClient) {
+        return [
+          new CapxulError({
+            code: "NOT_AUTHENTICATED",
+            message: "Auth bootstrap requires an authenticated Convex data client."
+          }),
+          null
+        ];
+      }
+      try {
+        const resolution = await dataClient.mutation(
+          api.authBootstrap.resolveAfterOtp,
+          {
+            email: session.email,
+            sessionToken: session.token
+          }
+        );
+        if (resolution.kind === "existing_member") {
+          return [null, { ...resolution, session }];
+        }
+        return [null, { ...resolution, session }];
+      } catch (cause) {
+        return [fromConvexError(cause), null];
+      }
+    },
+    completeBootstrap: async (input) => {
+      const session = sessionStore.get();
+      const data = dataClient ?? config.data;
+      if (!session || !data) {
+        return [
+          new CapxulError({
+            code: "INVALID_INPUT",
+            message: "completeBootstrap requires the OTP-verified session that issued the bootstrap token."
+          }),
+          null
+        ];
+      }
+      if (input.signerProvider.kind !== "local-private-key") {
+        return [
+          new CapxulError({
+            code: "INVALID_INPUT",
+            message: "completeBootstrap currently supports local-private-key signer providers only."
+          }),
+          null
+        ];
+      }
+      try {
+        const result = await data.mutation(api.authBootstrap.completeBootstrap, {
+          bootstrapToken: input.bootstrapToken,
+          sessionToken: session.token,
+          username: input.username,
+          displayName: input.displayName,
+          countryCode: input.countryCode,
+          signerProvider: input.signerProvider
+        });
+        return [null, { kind: "authenticated", session, ...result }];
+      } catch (cause) {
+        return [
+          fromConvexError(cause),
+          null
+        ];
+      }
     },
     getSession: async () => [null, sessionStore.get()],
     signOut: async () => {
       sessionStore.clear();
       dataClient = null;
       mutableConfig(config).data = void 0;
+      const transport = getTransport();
+      transport?.clearAuth();
       return [null, void 0];
     },
     serviceTokenMint: async () => stub("auth.serviceTokenMint"),
@@ -590,16 +1583,19 @@ async function postBetterAuth(transport, path, body, code, signal) {
       body: JSON.stringify(body),
       signal
     });
+    const text = await response.text();
     if (!response.ok) {
+      const parsedError = parseBetterAuthError(text);
       return [
         new CapxulError({
-          code,
-          message: `BetterAuth ${path} failed with HTTP ${response.status}.`
+          code: parsedError.code ?? code,
+          message: parsedError.message ?? `BetterAuth ${path} failed with HTTP ${response.status}.`,
+          details: parsedError.details,
+          retryable: parsedError.retryable
         }),
         null
       ];
     }
-    const text = await response.text();
     return [null, text ? JSON.parse(text) : void 0];
   } catch (cause) {
     return [
@@ -612,6 +1608,36 @@ async function postBetterAuth(transport, path, body, code, signal) {
     ];
   }
 }
+function parseBetterAuthError(text) {
+  if (!text.trim()) {
+    return {};
+  }
+  try {
+    const body = JSON.parse(text);
+    if (!body || typeof body !== "object") {
+      return {};
+    }
+    const record = body;
+    const nested = record.error && typeof record.error === "object" ? record.error : record;
+    const code = typeof nested.code === "string" ? nested.code : void 0;
+    const message = typeof nested.message === "string" ? nested.message : void 0;
+    const details = nested.details && typeof nested.details === "object" ? nested.details : void 0;
+    const correlationId = typeof nested.correlationId === "string" ? nested.correlationId : void 0;
+    const retryable = typeof nested.retryable === "boolean" ? nested.retryable : void 0;
+    return {
+      code: isCapxulErrorCode2(code) ? code : void 0,
+      message,
+      details,
+      correlationId,
+      retryable
+    };
+  } catch {
+    return {};
+  }
+}
+function isCapxulErrorCode2(code) {
+  return code === "NOT_AUTHENTICATED" || code === "EMAIL_DELIVERY_FAILED" || code === "INVALID_INPUT" || code === "RATE_LIMITED" || code === "NETWORK_ERROR" || code === "API_KEY_INVALID" || code === "API_KEY_EXPIRED" || code === "INTERNAL_ERROR" || code === "ENV_MISSING" || code === "UNKNOWN" || code === "PROVIDER_ERROR";
+}
 async function exchangeConvexToken(transport, config, token, signal) {
   const path = config.auth?.convexTokenUrl ?? "/convex/token";
   try {
@@ -672,14 +1698,6 @@ function createOrgDocumentsClient() {
   };
 }
 
-// src/core/external-accounts.ts
-function createExternalAccountsClient() {
-  return {
-    retrieve: async () => stub("externalAccounts.retrieve"),
-    remove: async () => stub("externalAccounts.remove")
-  };
-}
-
 // src/core/me.ts
 function createMeClient(config = {}) {
   return {
@@ -697,7 +1715,34 @@ function createMeClient(config = {}) {
         return [fromConvexError(cause), null];
       }
     },
-    update: async () => stub("me.update")
+    update: async (input) => {
+      if (!config.data) {
+        return stub("me.update");
+      }
+      if (input.countryCode !== void 0) {
+        return [
+          new CapxulError({
+            code: "INVALID_INPUT",
+            message: "me.update does not support countryCode yet \u2014 backend mutation only patches displayName and username.",
+            details: { field: "countryCode" }
+          }),
+          null
+        ];
+      }
+      try {
+        await config.data.mutation(api.openfort.mutations.updateProfile, {
+          displayName: input.name,
+          username: input.username
+        });
+        const account = await config.data.query(
+          api.openfort.queries.getMyAccount,
+          {}
+        );
+        return [null, account];
+      } catch (cause) {
+        return [fromConvexError(cause), null];
+      }
+    }
   };
 }
 
@@ -1001,70 +2046,464 @@ function createPaymentsClient(config = {}) {
         if (submitted && created?.id) {
           return [new CapxulError({
             code: "NETWORK_ERROR",
-            message: "Payment was submitted on-chain, but backend submission tracking failed.",
-            cause,
-            details: {
-              paymentId: created.id,
-              txHash: submitted.txHash,
-              userOpHash: submitted.userOpHash
-            }
-          }), null];
-        }
-        return [error, null];
+            message: "Payment was submitted on-chain, but backend submission tracking failed.",
+            cause,
+            details: {
+              paymentId: created.id,
+              txHash: submitted.txHash,
+              userOpHash: submitted.userOpHash
+            }
+          }), null];
+        }
+        return [error, null];
+      }
+    },
+    retrieve: async (paymentId) => {
+      if (!config.data) {
+        return stub("payments.retrieve");
+      }
+      try {
+        const payment = await config.data.query(api.payments.queries.retrieve, {
+          paymentId
+        });
+        if (!payment) {
+          return [new CapxulError({
+            code: "NOT_FOUND",
+            message: `payment ${paymentId} not found`
+          }), null];
+        }
+        return [null, payment];
+      } catch (cause) {
+        return [fromConvexError(cause), null];
+      }
+    },
+    list: async () => stub("payments.list")
+  };
+}
+function createOrgPaymentsClient() {
+  return {
+    create: async () => stub(
+      "organizations.payments.create"
+    ),
+    retrieve: async () => stub("organizations.payments.retrieve"),
+    list: async () => stub("organizations.payments.list")
+  };
+}
+async function bestEffortMarkFailed(config, paymentId, error) {
+  try {
+    await config.data.mutation(api.payments.mutations.markFailed, {
+      paymentId,
+      errorCode: error.code,
+      errorMessage: error.message,
+      source: "sdk"
+    });
+  } catch {
+  }
+}
+function mapCreateError(error) {
+  switch (error.code) {
+    case "NOT_AUTHENTICATED":
+    case "PERMISSION_DENIED":
+    case "INVALID_INPUT":
+    case "INVALID_RECIPIENT":
+    case "INSUFFICIENT_BALANCE":
+    case "IDEMPOTENCY_CONFLICT":
+    case "RATE_LIMITED":
+    case "NETWORK_ERROR":
+      return error;
+    default:
+      return new CapxulError({
+        code: "NETWORK_ERROR",
+        message: error.message,
+        cause: error,
+        details: error.details,
+        operationId: error.operationId,
+        correlationId: error.correlationId,
+        retryable: error.retryable
+      });
+  }
+}
+
+// src/core/transfers.ts
+function createTransfersClient() {
+  return {
+    create: async () => stub("transfers.create"),
+    retrieve: async () => stub("transfers.retrieve"),
+    list: async () => stub("transfers.list"),
+    confirm: async () => stub("transfers.confirm"),
+    cancel: async () => stub("transfers.cancel")
+  };
+}
+function createOrgTransfersClient() {
+  return {
+    create: async () => stub(
+      "organizations.transfers.create"
+    ),
+    retrieve: async () => stub("organizations.transfers.retrieve"),
+    list: async () => stub("organizations.transfers.list"),
+    confirm: async () => stub("organizations.transfers.confirm"),
+    cancel: async () => stub("organizations.transfers.cancel")
+  };
+}
+function createWithdrawalsClient(config = {}) {
+  return {
+    create: async (input) => {
+      if (!config.data) {
+        return stub("withdrawals.create");
+      }
+      const [createErr, createdRaw] = await tryCatch(
+        config.data.mutation(api.withdrawals.mutations.create, {
+          amount: input.amount,
+          destination: {
+            externalAccountId: input.destination.externalAccountId
+          },
+          source: input.source,
+          reference: input.reference,
+          idempotencyKey: input.idempotencyKey
+        })
+      );
+      if (createErr) {
+        return [mapCreateError2(fromConvexError(createErr)), null];
+      }
+      const created = createdRaw;
+      if (!created) {
+        return [
+          new CapxulError({
+            code: "NETWORK_ERROR",
+            message: "withdrawals.create returned no withdrawal resource"
+          }),
+          null
+        ];
+      }
+      if (created.status !== "processing" || created.operation.status !== "processing") {
+        return [null, created];
+      }
+      if (!config.signer || !config.signing) {
+        return [null, created];
+      }
+      const [signerErr, currentSigner] = await tryCatch(
+        config.data.query(api.safe.queries.getMySignerAddress, {})
+      );
+      if (signerErr) {
+        return await handleSubmissionFailure(
+          { data: config.data },
+          created.id,
+          mapCreateError2(fromConvexError(signerErr))
+        );
+      }
+      if (!currentSigner?.address) {
+        return await handleSubmissionFailure(
+          { data: config.data },
+          created.id,
+          new CapxulError({
+            code: "PERMISSION_DENIED",
+            message: "No signer is registered for the authenticated account.",
+            details: { withdrawalId: created.id }
+          })
+        );
+      }
+      if (getAddress(currentSigner.address) !== getAddress(config.signer.address)) {
+        return await handleSubmissionFailure(
+          { data: config.data },
+          created.id,
+          new CapxulError({
+            code: "PERMISSION_DENIED",
+            message: "Configured signer does not match the authenticated account signer.",
+            details: {
+              withdrawalId: created.id,
+              expectedSignerAddress: currentSigner.address,
+              actualSignerAddress: config.signer.address
+            }
+          })
+        );
+      }
+      const [prepErr, submission] = await tryCatch(
+        config.data.query(api.withdrawals.queries.prepareSubmission, {
+          withdrawalId: created.id
+        })
+      );
+      if (prepErr) {
+        return await handleSubmissionFailure(
+          { data: config.data },
+          created.id,
+          mapCreateError2(fromConvexError(prepErr))
+        );
+      }
+      const destinationAddress = submission?.destinationAddress;
+      if (!submission || !destinationAddress) {
+        return await handleSubmissionFailure(
+          { data: config.data },
+          created.id,
+          new CapxulError({
+            code: "NETWORK_ERROR",
+            message: "withdrawals.prepareSubmission returned no destination.",
+            details: { withdrawalId: created.id }
+          })
+        );
+      }
+      const [transferErr, transferOk] = await tryCatch(
+        transferAsOwner(
+          {
+            signer: config.signer,
+            signing: config.signing
+          },
+          {
+            tokenAddress: resolvePaymentTokenAddress(submission.amount.currency),
+            recipientAddress: destinationAddress,
+            amount: toTokenUnits(submission.amount.value, 6)
+          }
+        )
+      );
+      if (transferErr) {
+        return await handleSubmissionFailure(
+          { data: config.data },
+          created.id,
+          mapCreateError2(fromConvexError(transferErr))
+        );
+      }
+      if (!transferOk.success) {
+        return await handleSubmissionFailure(
+          { data: config.data },
+          created.id,
+          new CapxulError({
+            code: "NETWORK_ERROR",
+            message: "Bundler submission did not succeed.",
+            details: {
+              withdrawalId: created.id,
+              txHash: transferOk.txHash,
+              userOpHash: transferOk.userOpHash
+            }
+          })
+        );
+      }
+      const [recordErr] = await tryCatch(
+        config.data.mutation(api.withdrawals.mutations.recordSubmitted, {
+          withdrawalId: created.id,
+          txHash: transferOk.txHash,
+          userOpHash: transferOk.userOpHash
+        })
+      );
+      if (recordErr) {
+        return [
+          new CapxulError({
+            code: "NETWORK_ERROR",
+            message: "Withdrawal was submitted on-chain, but backend submission tracking failed.",
+            cause: recordErr,
+            details: {
+              withdrawalId: created.id,
+              txHash: transferOk.txHash,
+              userOpHash: transferOk.userOpHash
+            }
+          }),
+          null
+        ];
+      }
+      return [null, created];
+    },
+    retrieve: async (withdrawalId) => {
+      if (!config.data) {
+        return stub("withdrawals.retrieve");
+      }
+      const [err, raw] = await tryCatch(
+        config.data.query(api.withdrawals.queries.retrieve, { withdrawalId })
+      );
+      if (err) {
+        return [fromConvexError(err), null];
+      }
+      const withdrawal = raw;
+      if (!withdrawal) {
+        return [
+          new CapxulError({
+            code: "NOT_FOUND",
+            message: `withdrawal ${withdrawalId} not found`
+          }),
+          null
+        ];
+      }
+      return [null, withdrawal];
+    },
+    list: async (input) => {
+      if (!config.data) {
+        return stub("withdrawals.list");
+      }
+      const [err, raw] = await tryCatch(
+        config.data.query(api.withdrawals.queries.list, {
+          limit: input?.limit,
+          cursor: input?.cursor
+        })
+      );
+      if (err) {
+        return [fromConvexError(err), null];
+      }
+      return [null, raw];
+    },
+    recordCompleted: async (input) => {
+      if (!config.data) {
+        return stub(
+          "withdrawals.recordCompleted"
+        );
+      }
+      const [err] = await tryCatch(
+        config.data.mutation(api.withdrawals.mutations.recordCompleted, {
+          withdrawalId: input.withdrawalId,
+          txHash: input.txHash
+        })
+      );
+      if (err) {
+        return [
+          mapRecordCompletedError(fromConvexError(err)),
+          null
+        ];
+      }
+      return [null, null];
+    }
+  };
+}
+function createOrgWithdrawalsClient(config = {}) {
+  return {
+    /**
+     * Org-scope create (Withdrawals v1 W2, #465).
+     *
+     * D6 — returns the `processing` row only. No `transferAsOwner`
+     * tail, no `recordSubmitted` call. Org Safe + Zodiac submission
+     * orchestration ships in W3+.
+     */
+    create: async (input) => {
+      if (!config.data) {
+        return stub(
+          "organizations.withdrawals.create"
+        );
+      }
+      const [err, raw] = await tryCatch(
+        config.data.mutation(api.withdrawals.mutations.createOrg, {
+          organizationId: input.organizationId,
+          amount: input.amount,
+          destination: {
+            externalAccountId: input.destination.externalAccountId
+          },
+          source: input.source,
+          reference: input.reference,
+          idempotencyKey: input.idempotencyKey
+        })
+      );
+      if (err) {
+        return [mapCreateError2(fromConvexError(err)), null];
+      }
+      const created = raw;
+      if (!created) {
+        return [
+          new CapxulError({
+            code: "NETWORK_ERROR",
+            message: "organizations.withdrawals.create returned no withdrawal resource"
+          }),
+          null
+        ];
       }
+      return [null, created];
     },
-    retrieve: async (paymentId) => {
+    retrieve: async (input) => {
       if (!config.data) {
-        return stub("payments.retrieve");
+        return stub(
+          "organizations.withdrawals.retrieve"
+        );
       }
-      try {
-        const payment = await config.data.query(api.payments.queries.retrieve, {
-          paymentId
-        });
-        if (!payment) {
-          return [new CapxulError({
+      const [err, raw] = await tryCatch(
+        config.data.query(api.withdrawals.queries.retrieve, {
+          withdrawalId: input.withdrawalId
+        })
+      );
+      if (err) {
+        return [fromConvexError(err), null];
+      }
+      const withdrawal = raw;
+      if (!withdrawal) {
+        return [
+          new CapxulError({
             code: "NOT_FOUND",
-            message: `payment ${paymentId} not found`
-          }), null];
-        }
-        return [null, payment];
-      } catch (cause) {
-        return [fromConvexError(cause), null];
+            message: `withdrawal ${input.withdrawalId} not found`
+          }),
+          null
+        ];
+      }
+      const ownerCheck = withdrawal.owner;
+      if (ownerCheck?.type !== "organization" || ownerCheck.id !== input.organizationId) {
+        return [
+          new CapxulError({
+            code: "NOT_FOUND",
+            message: `withdrawal ${input.withdrawalId} does not belong to organization ${input.organizationId}`
+          }),
+          null
+        ];
       }
+      return [null, withdrawal];
     },
-    list: async () => stub("payments.list")
+    list: async (input) => {
+      if (!config.data) {
+        return stub(
+          "organizations.withdrawals.list"
+        );
+      }
+      const [err, raw] = await tryCatch(
+        config.data.query(api.withdrawals.queries.listOrg, {
+          organizationId: input.organizationId,
+          limit: input.limit,
+          cursor: input.cursor
+        })
+      );
+      if (err) {
+        return [fromConvexError(err), null];
+      }
+      return [null, raw];
+    }
   };
 }
-function createOrgPaymentsClient() {
-  return {
-    create: async () => stub(
-      "organizations.payments.create"
-    ),
-    retrieve: async () => stub("organizations.payments.retrieve"),
-    list: async () => stub("organizations.payments.list")
-  };
+async function handleSubmissionFailure(config, withdrawalId, error) {
+  await bestEffortMarkFailed2(config, withdrawalId, error);
+  return [error, null];
 }
-async function bestEffortMarkFailed(config, paymentId, error) {
-  try {
-    await config.data.mutation(api.payments.mutations.markFailed, {
-      paymentId,
+async function bestEffortMarkFailed2(config, withdrawalId, error) {
+  await tryCatch(
+    config.data.mutation(api.withdrawals.mutations.markFailed, {
+      withdrawalId,
       errorCode: error.code,
-      errorMessage: error.message,
-      source: "sdk"
-    });
-  } catch {
-  }
+      errorMessage: error.message
+    })
+  );
 }
-function mapCreateError(error) {
+function mapCreateError2(error) {
   switch (error.code) {
     case "NOT_AUTHENTICATED":
     case "PERMISSION_DENIED":
     case "INVALID_INPUT":
-    case "INVALID_RECIPIENT":
     case "INSUFFICIENT_BALANCE":
     case "IDEMPOTENCY_CONFLICT":
+    case "KYC_REQUIRED":
+    case "POLICY_DENIED":
     case "RATE_LIMITED":
     case "NETWORK_ERROR":
+    case "NOT_FOUND":
+    case "VERIFICATION_REQUIRED":
+      return error;
+    default:
+      return new CapxulError({
+        code: "NETWORK_ERROR",
+        message: error.message,
+        cause: error,
+        details: error.details,
+        operationId: error.operationId,
+        correlationId: error.correlationId,
+        retryable: error.retryable
+      });
+  }
+}
+function mapRecordCompletedError(error) {
+  switch (error.code) {
+    case "NOT_AUTHENTICATED":
+    case "PERMISSION_DENIED":
+    case "INVALID_INPUT":
+    case "NOT_FOUND":
+    case "NETWORK_ERROR":
+    case "INTERNAL_ERROR":
       return error;
     default:
       return new CapxulError({
@@ -1079,508 +2518,785 @@ function mapCreateError(error) {
   }
 }
 
-// src/core/transfers.ts
-function createTransfersClient() {
+// src/core/webhook-endpoints.ts
+function createWebhookEndpointsClient() {
   return {
-    create: async () => stub("transfers.create"),
-    retrieve: async () => stub("transfers.retrieve"),
-    list: async () => stub("transfers.list"),
-    confirm: async () => stub("transfers.confirm"),
-    cancel: async () => stub("transfers.cancel")
+    create: async () => stub(
+      "webhookEndpoints.create"
+    ),
+    retrieve: async () => stub("webhookEndpoints.retrieve"),
+    list: async () => stub("webhookEndpoints.list"),
+    remove: async () => stub("webhookEndpoints.remove")
   };
 }
-function createOrgTransfersClient() {
+
+// src/core/webhook-events.ts
+function createWebhookEventsClient() {
   return {
-    create: async () => stub(
-      "organizations.transfers.create"
-    ),
-    retrieve: async () => stub("organizations.transfers.retrieve"),
-    list: async () => stub("organizations.transfers.list"),
-    confirm: async () => stub("organizations.transfers.confirm"),
-    cancel: async () => stub("organizations.transfers.cancel")
+    retrieve: async () => stub("webhookEvents.retrieve"),
+    list: async () => stub("webhookEvents.list")
   };
 }
-var EVM_ADDRESS_RE = /^0x[0-9a-fA-F]{40}$/;
-function createWithdrawalsClient(config = {}) {
+
+// src/core/organizations.ts
+function createOrgExternalAccountsClient(config) {
   return {
     create: async (input) => {
-      if (!config.data) {
-        return stub("withdrawals.create");
-      }
-      let created = null;
-      let submitted = null;
-      try {
-        created = await config.data.mutation(
-          api.withdrawals.mutations.create,
-          {
-            amount: input.amount,
-            destination: {
-              externalAccountId: input.destination.externalAccountId,
-              kind: input.destination.kind
-            },
-            source: input.source,
-            reference: input.reference,
-            idempotencyKey: input.idempotencyKey
-          }
-        );
-        if (!created) {
-          return [
-            new CapxulError({
-              code: "NETWORK_ERROR",
-              message: "withdrawals.create returned no withdrawal resource"
-            }),
-            null
-          ];
-        }
-        if (created.status !== "processing" || created.operation.status !== "processing") {
-          return [null, created];
-        }
-        if (input.destination.kind !== "evm") {
-          return [null, created];
-        }
-        if (!config.signer || !config.signing) {
-          return [null, created];
-        }
-        if (!EVM_ADDRESS_RE.test(input.destination.externalAccountId)) {
-          throw new CapxulError({
-            code: "INVALID_INPUT",
-            message: "destination.externalAccountId must be a 0x-prefixed EVM address while external_accounts resolution is pending (slice 1).",
-            details: { field: "destination.externalAccountId" }
-          });
-        }
-        const currentSigner = await config.data.query(
-          api.safe.queries.getMySignerAddress,
-          {}
-        );
-        if (!currentSigner?.address) {
-          throw new CapxulError({
-            code: "PERMISSION_DENIED",
-            message: "No signer is registered for the authenticated account.",
-            details: { withdrawalId: created.id }
-          });
-        }
-        if (getAddress(currentSigner.address) !== getAddress(config.signer.address)) {
-          throw new CapxulError({
-            code: "PERMISSION_DENIED",
-            message: "Configured signer does not match the authenticated account signer.",
-            details: {
-              withdrawalId: created.id,
-              expectedSignerAddress: currentSigner.address,
-              actualSignerAddress: config.signer.address
-            }
-          });
-        }
-        const submission = await config.data.query(
-          api.withdrawals.queries.prepareSubmission,
-          { withdrawalId: created.id }
-        );
-        if (!submission?.externalAccountId) {
-          throw new CapxulError({
-            code: "NETWORK_ERROR",
-            message: "withdrawals.prepareSubmission returned no destination.",
-            details: { withdrawalId: created.id }
-          });
-        }
-        const transfer = await transferAsOwner(
-          {
-            signer: config.signer,
-            signing: config.signing
-          },
-          {
-            tokenAddress: resolvePaymentTokenAddress(submission.amount.currency),
-            recipientAddress: submission.externalAccountId,
-            amount: toTokenUnits(submission.amount.value, 6)
-          }
-        );
-        if (!transfer.success) {
-          throw new CapxulError({
-            code: "NETWORK_ERROR",
-            message: "Bundler submission did not succeed.",
-            details: {
-              withdrawalId: created.id,
-              txHash: transfer.txHash,
-              userOpHash: transfer.userOpHash
-            }
-          });
-        }
-        submitted = {
-          txHash: transfer.txHash,
-          userOpHash: transfer.userOpHash
-        };
-        await config.data.mutation(
-          api.withdrawals.mutations.recordSubmitted,
-          {
-            withdrawalId: created.id,
-            txHash: transfer.txHash,
-            userOpHash: transfer.userOpHash
-          }
-        );
-        return [null, created];
-      } catch (cause) {
-        const error = mapCreateError2(fromConvexError(cause));
-        if (created?.id && created.status === "processing" && !submitted) {
-          await bestEffortMarkFailed2({ data: config.data }, created.id, error);
-        }
-        if (submitted && created?.id) {
-          return [
-            new CapxulError({
-              code: "NETWORK_ERROR",
-              message: "Withdrawal was submitted on-chain, but backend submission tracking failed.",
-              cause,
-              details: {
-                withdrawalId: created.id,
-                txHash: submitted.txHash,
-                userOpHash: submitted.userOpHash
-              }
-            }),
-            null
-          ];
-        }
-        return [error, null];
+      if (!config.data) {
+        return stub(
+          "organizations.externalAccounts.create"
+        );
+      }
+      const [err, raw] = await tryCatch(
+        config.data.mutation(api.externalAccounts.mutations.createOrg, {
+          organizationId: input.organizationId,
+          kind: input.kind,
+          label: input.label,
+          address: input.address,
+          iban: input.iban,
+          bic: input.bic,
+          accountHolder: input.accountHolder,
+          network: input.network,
+          panToken: input.panToken,
+          last4: input.last4
+        })
+      );
+      if (err) {
+        return [
+          fromConvexError(err),
+          null
+        ];
+      }
+      if (!raw) {
+        return [
+          new CapxulError({
+            code: "NOT_FOUND",
+            message: "external_account creation returned no resource"
+          }),
+          null
+        ];
       }
+      return [
+        null,
+        brandExternalAccount(
+          raw
+        )
+      ];
     },
-    retrieve: async (withdrawalId) => {
+    list: async (input) => {
       if (!config.data) {
-        return stub("withdrawals.retrieve");
-      }
-      try {
-        const withdrawal = await config.data.query(
-          api.withdrawals.queries.retrieve,
-          { withdrawalId }
+        return stub(
+          "organizations.externalAccounts.list"
         );
-        if (!withdrawal) {
-          return [
-            new CapxulError({
-              code: "NOT_FOUND",
-              message: `withdrawal ${withdrawalId} not found`
-            }),
-            null
-          ];
+      }
+      const [err, result] = await tryCatch(
+        config.data.query(api.externalAccounts.queries.listOrg, {
+          organizationId: input.organizationId,
+          limit: input.limit,
+          cursor: input.cursor
+        })
+      );
+      if (err) {
+        return [fromConvexError(err), null];
+      }
+      const branded = result.data.map(
+        (row) => brandExternalAccount(
+          row
+        )
+      );
+      return [
+        null,
+        {
+          object: "list",
+          data: branded,
+          page: result.page
         }
-        return [null, withdrawal];
-      } catch (cause) {
+      ];
+    },
+    retrieve: async (input) => {
+      if (!config.data) {
+        return stub(
+          "organizations.externalAccounts.retrieve"
+        );
+      }
+      const [err, raw] = await tryCatch(
+        config.data.query(api.externalAccounts.queries.retrieveOrg, {
+          organizationId: input.organizationId,
+          externalAccountId: input.externalAccountId
+        })
+      );
+      if (err) {
         return [
-          fromConvexError(cause),
+          fromConvexError(err),
+          null
+        ];
+      }
+      if (!raw) {
+        return [
+          new CapxulError({
+            code: "NOT_FOUND",
+            message: `external_account ${input.externalAccountId} not found`
+          }),
           null
         ];
       }
+      return [
+        null,
+        brandExternalAccount(
+          raw
+        )
+      ];
     },
-    list: async (input) => {
+    remove: async (input) => {
       if (!config.data) {
-        return stub("withdrawals.list");
-      }
-      try {
-        const result = await config.data.query(
-          api.withdrawals.queries.list,
-          {
-            limit: input?.limit,
-            cursor: input?.cursor
-          }
+        return stub(
+          "organizations.externalAccounts.remove"
         );
-        return [null, result];
-      } catch (cause) {
+      }
+      const [err] = await tryCatch(
+        config.data.mutation(api.externalAccounts.mutations.removeOrg, {
+          organizationId: input.organizationId,
+          externalAccountId: input.externalAccountId
+        })
+      );
+      if (err) {
         return [
-          fromConvexError(cause),
+          fromConvexError(err),
           null
         ];
       }
+      return [null, void 0];
     }
   };
 }
-function createOrgWithdrawalsClient(config = {}) {
+function createOrgSubAccountsClient(config) {
   return {
-    // Slice 1 ships personal-scope only end-to-end; org-scope create
-    // remains stubbed pending org-scoped backend mutation. List + retrieve
-    // are wired through the org-aware query.
-    create: async () => stub(
-      "organizations.withdrawals.create"
-    ),
+    create: async (input) => {
+      if (!config.data) {
+        return stub(
+          "organizations.subAccounts.create"
+        );
+      }
+      const [err, raw] = await tryCatch(
+        config.data.mutation(api.subAccounts.mutations.create, {
+          parent: {
+            kind: "organization",
+            id: input.organizationId
+          },
+          name: input.name,
+          purpose: input.purpose
+        })
+      );
+      if (err) {
+        return [
+          fromConvexError(err),
+          null
+        ];
+      }
+      if (!raw) {
+        return [
+          new CapxulError({
+            code: "NOT_FOUND",
+            message: "sub_account creation returned no resource"
+          }),
+          null
+        ];
+      }
+      const [brandErr, branded] = tryBrandSubAccount(raw);
+      if (brandErr) {
+        return [
+          brandErr,
+          null
+        ];
+      }
+      return [null, branded];
+    },
+    list: async (input) => {
+      if (!config.data) {
+        return stub(
+          "organizations.subAccounts.list"
+        );
+      }
+      const [err, rows] = await tryCatch(
+        config.data.query(api.subAccounts.queries.listByOrganization, {
+          organizationId: input.organizationId
+        })
+      );
+      if (err) {
+        return [
+          fromConvexError(err),
+          null
+        ];
+      }
+      const branded = [];
+      for (const row of rows) {
+        const [brandErr, value] = tryBrandSubAccount(row);
+        if (brandErr) {
+          return [
+            brandErr,
+            null
+          ];
+        }
+        branded.push(value);
+      }
+      return [
+        null,
+        {
+          object: "list",
+          data: branded,
+          page: { hasMore: false }
+        }
+      ];
+    },
     retrieve: async (input) => {
       if (!config.data) {
         return stub(
-          "organizations.withdrawals.retrieve"
+          "organizations.subAccounts.retrieve"
         );
       }
-      try {
-        const withdrawal = await config.data.query(
-          api.withdrawals.queries.retrieve,
-          { withdrawalId: input.withdrawalId }
+      const [err, raw] = await tryCatch(
+        config.data.query(api.subAccounts.queries.retrieve, {
+          subAccountId: input.subAccountId
+        })
+      );
+      if (err) {
+        return [
+          fromConvexError(err),
+          null
+        ];
+      }
+      if (!raw) {
+        return [
+          new CapxulError({
+            code: "NOT_FOUND",
+            message: `sub_account ${input.subAccountId} not found`
+          }),
+          null
+        ];
+      }
+      const [brandErr, branded] = tryBrandSubAccount(raw);
+      if (brandErr) {
+        return [
+          brandErr,
+          null
+        ];
+      }
+      return [null, branded];
+    },
+    remove: async (input) => {
+      if (!config.data) {
+        return stub(
+          "organizations.subAccounts.remove"
         );
-        if (!withdrawal) {
+      }
+      const [err, raw] = await tryCatch(
+        config.data.mutation(api.subAccounts.mutations.archive, {
+          subAccountId: input.subAccountId
+        })
+      );
+      if (err) {
+        return [
+          fromConvexError(err),
+          null
+        ];
+      }
+      if (!raw) {
+        return [
+          new CapxulError({
+            code: "NOT_FOUND",
+            message: `sub_account ${input.subAccountId} not found`
+          }),
+          null
+        ];
+      }
+      const [brandErr, branded] = tryBrandSubAccount(raw);
+      if (brandErr) {
+        return [
+          brandErr,
+          null
+        ];
+      }
+      return [null, branded];
+    }
+  };
+}
+function createOrganizationsClient(config = {}) {
+  return {
+    create: async () => stub("organizations.create"),
+    retrieve: async () => stub("organizations.retrieve"),
+    list: async () => stub("organizations.list"),
+    update: async () => stub("organizations.update"),
+    safes: {
+      retrieve: async (input) => {
+        if (!config.data) {
+          return stub("organizations.safes.retrieve");
+        }
+        try {
+          const safe = await config.data.query(
+            api.safe.queries.retrieveOrganizationSafe,
+            input
+          );
+          if (!safe) {
+            return [
+              new CapxulError({
+                code: "NOT_FOUND",
+                message: `safe ${input.safeId} not found`
+              }),
+              null
+            ];
+          }
+          return [null, safe];
+        } catch (cause) {
           return [
-            new CapxulError({
-              code: "NOT_FOUND",
-              message: `withdrawal ${input.withdrawalId} not found`
-            }),
+            fromConvexError(cause),
             null
           ];
         }
-        const ownerCheck = withdrawal.owner;
-        if (ownerCheck?.type !== "organization" || ownerCheck.id !== input.organizationId) {
+      }
+    },
+    treasury: {
+      retrieve: async () => stub("organizations.treasury.retrieve")
+    },
+    members: {
+      list: async () => stub("organizations.members.list"),
+      retrieve: async () => stub("organizations.members.retrieve"),
+      invite: async () => stub("organizations.members.invite"),
+      updateRole: async () => stub("organizations.members.updateRole"),
+      remove: async () => stub("organizations.members.remove")
+    },
+    apiKeys: createApiKeysClient(),
+    kybProfile: {
+      start: async () => stub("organizations.kybProfile.start"),
+      retrieve: async () => stub("organizations.kybProfile.retrieve")
+    },
+    subAccounts: createOrgSubAccountsClient(config),
+    externalAccounts: createOrgExternalAccountsClient(config),
+    balanceLedger: {
+      list: async () => stub(
+        "organizations.balanceLedger.list"
+      ),
+      retrieve: async () => stub(
+        "organizations.balanceLedger.retrieve"
+      )
+    },
+    payments: createOrgPaymentsClient(),
+    transfers: createOrgTransfersClient(),
+    withdrawals: createOrgWithdrawalsClient(config),
+    documents: createOrgDocumentsClient(),
+    webhookEndpoints: createWebhookEndpointsClient(),
+    webhookEvents: createWebhookEventsClient()
+  };
+}
+
+// src/core/token-transfers.ts
+var toTokenTransferId = (raw) => {
+  if (typeof raw !== "string" || raw.length === 0) {
+    throw new Error(
+      `Invalid tokenTransferId: expected non-empty string, got ${String(raw)}`
+    );
+  }
+  return raw;
+};
+function brandRow(row) {
+  return {
+    ...row,
+    id: toTokenTransferId(row.id)
+  };
+}
+function createTokenTransfersClient(config = {}) {
+  return {
+    list: async (input) => {
+      if (!config.data) {
+        return stub("tokenTransfers.list");
+      }
+      try {
+        const raw = await config.data.query(
+          api.tokenTransfers.queries.list,
+          {
+            limit: input?.limit,
+            cursor: input?.cursor,
+            direction: input?.direction
+          }
+        );
+        if (!raw) {
           return [
             new CapxulError({
-              code: "NOT_FOUND",
-              message: `withdrawal ${input.withdrawalId} does not belong to organization ${input.organizationId}`
+              code: "NOT_AUTHENTICATED",
+              message: "tokenTransfers.list requires an authenticated session."
             }),
             null
           ];
         }
-        return [null, withdrawal];
-      } catch (cause) {
         return [
-          fromConvexError(cause),
-          null
+          null,
+          {
+            object: "list",
+            data: raw.items.map(brandRow),
+            page: {
+              hasMore: raw.hasMore,
+              nextCursor: raw.nextCursor
+            },
+            displayCurrency: raw.displayCurrency
+          }
         ];
+      } catch (cause) {
+        return [fromConvexError(cause), null];
       }
     },
-    list: async (input) => {
-      if (!config.data) {
-        return stub(
-          "organizations.withdrawals.list"
-        );
+    retrieve: async (input) => {
+      if (!config.data) {
+        return stub("tokenTransfers.retrieve");
       }
       try {
-        const result = await config.data.query(
-          api.withdrawals.queries.listOrg,
+        const raw = await config.data.query(
+          api.tokenTransfers.queries.getByTxLogIndex,
           {
-            organizationId: input.organizationId,
-            limit: input.limit,
-            cursor: input.cursor
+            txHash: input.txHash,
+            logIndex: input.logIndex,
+            chainId: input.chainId
           }
         );
-        return [null, result];
+        if (!raw) {
+          return [
+            new CapxulError({
+              code: "NOT_FOUND",
+              message: `tokenTransfer (txHash=${input.txHash}, logIndex=${input.logIndex}) not found or not visible to caller.`,
+              details: {
+                txHash: input.txHash,
+                logIndex: input.logIndex,
+                chainId: input.chainId
+              }
+            }),
+            null
+          ];
+        }
+        return [null, brandRow(raw)];
       } catch (cause) {
-        return [
-          fromConvexError(cause),
-          null
-        ];
+        return [fromConvexError(cause), null];
       }
     }
   };
 }
-async function bestEffortMarkFailed2(config, withdrawalId, error) {
-  try {
-    await config.data.mutation(api.withdrawals.mutations.markFailed, {
-      withdrawalId,
-      errorCode: error.code,
-      errorMessage: error.message
-    });
-  } catch {
-  }
-}
-function mapCreateError2(error) {
-  switch (error.code) {
-    case "NOT_AUTHENTICATED":
-    case "PERMISSION_DENIED":
-    case "INVALID_INPUT":
-    case "INSUFFICIENT_BALANCE":
-    case "IDEMPOTENCY_CONFLICT":
-    case "KYC_REQUIRED":
-    case "POLICY_DENIED":
-    case "RATE_LIMITED":
-    case "NETWORK_ERROR":
-      return error;
-    default:
-      return new CapxulError({
-        code: "NETWORK_ERROR",
-        message: error.message,
-        cause: error,
-        details: error.details,
-        operationId: error.operationId,
-        correlationId: error.correlationId,
-        retryable: error.retryable
-      });
-  }
-}
 
-// src/core/webhook-endpoints.ts
-function createWebhookEndpointsClient() {
+// src/core/virtual-accounts.ts
+function createVirtualAccountsClient() {
   return {
-    create: async () => stub(
-      "webhookEndpoints.create"
-    ),
-    retrieve: async () => stub("webhookEndpoints.retrieve"),
-    list: async () => stub("webhookEndpoints.list"),
-    remove: async () => stub("webhookEndpoints.remove")
+    create: async () => stub("virtualAccounts.create"),
+    retrieve: async () => stub("virtualAccounts.retrieve"),
+    list: async () => stub("virtualAccounts.list"),
+    remove: async () => stub("virtualAccounts.remove")
   };
 }
 
-// src/core/webhook-events.ts
-function createWebhookEventsClient() {
+// src/core/virtual-cards.ts
+function createVirtualCardsClient() {
   return {
-    retrieve: async () => stub("webhookEvents.retrieve"),
-    list: async () => stub("webhookEvents.list")
+    create: async () => stub("virtualCards.create"),
+    retrieve: async () => stub("virtualCards.retrieve"),
+    list: async () => stub("virtualCards.list"),
+    freeze: async () => stub("virtualCards.freeze"),
+    unfreeze: async () => stub("virtualCards.unfreeze"),
+    cancel: async () => stub("virtualCards.cancel")
   };
 }
-
-// src/core/organizations.ts
-function createOrganizationsClient(config = {}) {
-  return {
-    create: async () => stub("organizations.create"),
-    retrieve: async () => stub("organizations.retrieve"),
-    list: async () => stub("organizations.list"),
-    update: async () => stub("organizations.update"),
-    safes: {
-      retrieve: async (input) => {
-        if (!config.data) {
-          return stub("organizations.safes.retrieve");
+function createAuthFlowMachine(client) {
+  return setup({
+    types: {},
+    actors: {
+      // XState v5's `fromPromise` injects an `AbortSignal` that aborts
+      // when the actor is stopped (parent transition fires, machine is
+      // disposed, etc.). Plumbing it through `client.auth.sendOtp` /
+      // `client.auth.verifyOtp` makes the in-flight HTTP request
+      // cancellable: stale responses can't race a state machine
+      // that's already moved on. See PR #406 S5.
+      sendOtp: fromPromise(async ({ input, signal }) => {
+        const [error] = await client.auth.sendOtp(
+          { email: input.email },
+          { signal }
+        );
+        if (error) throw error;
+      }),
+      verifyOtp: fromPromise(
+        async ({ input, signal }) => {
+          const [error, result] = await client.auth.verifyOtp(
+            {
+              email: input.email,
+              otp: input.code
+            },
+            { signal }
+          );
+          if (error) throw error;
+          if (result.kind === "bootstrap_required") {
+            throw new CapxulError({
+              code: "ACTION_REQUIRED",
+              message: "OTP verified but auth bootstrap is required. Use createAuthBootstrapFlowMachine for product sign-up.",
+              details: { reason: result.reason }
+            });
+          }
+          return result.session;
+        }
+      ),
+      signOut: fromPromise(async () => {
+        const [error] = await client.auth.signOut();
+        if (error) throw error;
+      })
+    },
+    actions: {
+      trackOtpRequested: ({ context }) => {
+        if (!context.email) return;
+        track("auth_otp_requested", {
+          email_domain: emailDomain(context.email)
+        });
+      },
+      trackOtpFailed: ({ event }) => {
+        const error = errorFromEvent(event);
+        track("auth_failed", {
+          auth_type: "email_otp",
+          reason: error.code
+        });
+      },
+      trackTimeoutFailed: () => {
+        track("auth_failed", {
+          auth_type: "email_otp",
+          reason: "timeout"
+        });
+      },
+      trackVerified: () => {
+        track("auth_verified", { auth_type: "email_otp" });
+      },
+      identifyAndTrack: ({ context }) => {
+        if (!context.session) return;
+        identify(context.session.authUserId, {
+          email_domain: emailDomain(context.session.email)
+        });
+        track("auth_identified", {
+          email_domain: emailDomain(context.session.email)
+        });
+      },
+      trackSignedOut: () => {
+        track("auth_signed_out");
+      }
+    }
+  }).createMachine({
+    id: "auth",
+    initial: "idle",
+    context: { email: null, session: null, error: null },
+    states: {
+      idle: {
+        on: {
+          REQUEST_OTP: {
+            target: "sending_otp",
+            actions: assign({
+              email: ({ event }) => event.email,
+              error: () => null
+            })
+          }
+        }
+      },
+      sending_otp: {
+        invoke: {
+          src: "sendOtp",
+          input: ({ context }) => ({ email: requireEmail(context) }),
+          onDone: {
+            target: "otp_requested",
+            actions: ["trackOtpRequested"]
+          },
+          onError: {
+            target: "error",
+            actions: [
+              assign({ error: ({ event }) => errorFromEvent(event) }),
+              "trackOtpFailed"
+            ]
+          }
+        },
+        after: {
+          [FLOW_INVOKE_TIMEOUT_MS]: {
+            target: "error",
+            actions: [
+              assign({
+                error: () => timeoutError("sending_otp")
+              }),
+              "trackTimeoutFailed"
+            ]
+          }
+        }
+      },
+      otp_requested: {
+        on: {
+          VERIFY: { target: "verifying" },
+          RESET: {
+            target: "idle",
+            actions: assign({ email: () => null, error: () => null })
+          }
+        }
+      },
+      verifying: {
+        invoke: {
+          src: "verifyOtp",
+          input: ({ context, event }) => ({
+            email: requireEmail(context),
+            code: requireCodeFromEvent(event)
+          }),
+          onDone: {
+            target: "authenticated",
+            actions: [
+              // Scrub the duplicate `context.email` (input value
+              // captured during sendOtp) since the verified
+              // `session.email` is now the canonical source
+              // post-authentication. The session's email is
+              // intentionally retained — it's the auth result, not
+              // lingering input. See PR #406 S2.
+              assign({
+                session: ({ event }) => event.output,
+                email: () => null
+              }),
+              "trackVerified",
+              "identifyAndTrack"
+            ]
+          },
+          onError: {
+            target: "error",
+            actions: [
+              assign({ error: ({ event }) => errorFromEvent(event) }),
+              "trackOtpFailed"
+            ]
+          }
+        },
+        after: {
+          [FLOW_INVOKE_TIMEOUT_MS]: {
+            target: "error",
+            actions: [
+              assign({
+                error: () => timeoutError("verifying")
+              }),
+              "trackTimeoutFailed"
+            ]
+          }
+        }
+      },
+      authenticated: {
+        on: {
+          SIGN_OUT: { target: "signing_out" }
         }
-        try {
-          const safe = await config.data.query(
-            api.safe.queries.retrieveOrganizationSafe,
-            input
-          );
-          if (!safe) {
-            return [
-              new CapxulError({
-                code: "NOT_FOUND",
-                message: `safe ${input.safeId} not found`
+      },
+      signing_out: {
+        invoke: {
+          src: "signOut",
+          onDone: {
+            target: "idle",
+            actions: [
+              assign({
+                session: () => null,
+                email: () => null,
+                error: () => null
               }),
-              null
-            ];
+              "trackSignedOut"
+            ]
+          },
+          onError: {
+            target: "error",
+            actions: assign({ error: ({ event }) => errorFromEvent(event) })
+          }
+        }
+      },
+      error: {
+        on: {
+          RESET: {
+            target: "idle",
+            actions: assign({ error: () => null })
           }
-          return [null, safe];
-        } catch (cause) {
-          return [
-            fromConvexError(cause),
-            null
-          ];
         }
       }
-    },
-    treasury: {
-      retrieve: async () => stub("organizations.treasury.retrieve")
-    },
-    members: {
-      list: async () => stub("organizations.members.list"),
-      retrieve: async () => stub("organizations.members.retrieve"),
-      invite: async () => stub("organizations.members.invite"),
-      updateRole: async () => stub("organizations.members.updateRole"),
-      remove: async () => stub("organizations.members.remove")
-    },
-    apiKeys: createApiKeysClient(),
-    kybProfile: {
-      start: async () => stub("organizations.kybProfile.start"),
-      retrieve: async () => stub("organizations.kybProfile.retrieve")
-    },
-    subAccounts: {
-      create: async () => stub("organizations.subAccounts.create"),
-      list: async () => stub("organizations.subAccounts.list"),
-      retrieve: async () => stub("organizations.subAccounts.retrieve"),
-      remove: async () => stub("organizations.subAccounts.remove")
-    },
-    externalAccounts: {
-      create: async () => stub(
-        "organizations.externalAccounts.create"
-      ),
-      list: async () => stub(
-        "organizations.externalAccounts.list"
-      ),
-      retrieve: async () => stub(
-        "organizations.externalAccounts.retrieve"
-      ),
-      remove: async () => stub("organizations.externalAccounts.remove")
-    },
-    balanceLedger: {
-      list: async () => stub(
-        "organizations.balanceLedger.list"
-      ),
-      retrieve: async () => stub(
-        "organizations.balanceLedger.retrieve"
-      )
-    },
-    payments: createOrgPaymentsClient(),
-    transfers: createOrgTransfersClient(),
-    withdrawals: createOrgWithdrawalsClient(config),
-    documents: createOrgDocumentsClient(),
-    webhookEndpoints: createWebhookEndpointsClient(),
-    webhookEvents: createWebhookEventsClient()
-  };
-}
-
-// src/core/sub-accounts.ts
-function createSubAccountsClient() {
-  return {
-    retrieve: async () => stub("subAccounts.retrieve"),
-    remove: async () => stub("subAccounts.remove")
-  };
-}
-
-// src/core/virtual-accounts.ts
-function createVirtualAccountsClient() {
-  return {
-    create: async () => stub("virtualAccounts.create"),
-    retrieve: async () => stub("virtualAccounts.retrieve"),
-    list: async () => stub("virtualAccounts.list"),
-    remove: async () => stub("virtualAccounts.remove")
-  };
-}
-
-// src/core/virtual-cards.ts
-function createVirtualCardsClient() {
-  return {
-    create: async () => stub("virtualCards.create"),
-    retrieve: async () => stub("virtualCards.retrieve"),
-    list: async () => stub("virtualCards.list"),
-    freeze: async () => stub("virtualCards.freeze"),
-    unfreeze: async () => stub("virtualCards.unfreeze"),
-    cancel: async () => stub("virtualCards.cancel")
-  };
+    }
+  });
 }
-
-// ../observability/src/debug-log.ts
-function isDevelopmentBuild() {
-  if (typeof process === "undefined") {
-    return false;
+function requireEmail(context) {
+  if (!context.email) {
+    throw Errors.invalidInput(
+      "email",
+      "Auth flow advanced without an email captured in context."
+    );
   }
-  return process.env?.NODE_ENV === "development" || process.env?.NODE_ENV === "test";
+  return context.email;
 }
-function debugLog(line) {
-  if (!isDevelopmentBuild()) return;
-  if (typeof globalThis !== "undefined" && "window" in globalThis && typeof console?.info === "function") {
-    console.info(line);
-    return;
-  }
-  if (typeof process !== "undefined" && typeof process.stderr?.write === "function") {
-    process.stderr.write(`${line}
-`);
+function requireCodeFromEvent(event) {
+  if (event.type !== "VERIFY") {
+    throw Errors.invalidInput(
+      "code",
+      `Auth flow's verifying state requires a VERIFY event, got ${event.type}.`
+    );
   }
+  return event.code;
 }
-function formatDebugValue(value) {
-  if (value === void 0 || value === "") return "";
-  if (typeof value === "string") return value;
-  try {
-    return JSON.stringify(value);
-  } catch {
-    return String(value);
+function errorFromEvent(event) {
+  const cause = typeof event === "object" && event !== null && "error" in event ? event.error : event;
+  if (cause instanceof CapxulError) {
+    if (!EMAIL_MATCH_PATTERN.test(cause.message)) return cause;
+    return new CapxulError({
+      code: cause.code,
+      message: redactEmail(cause.message),
+      cause,
+      details: cause.details,
+      operationId: cause.operationId,
+      correlationId: cause.correlationId,
+      retryable: cause.retryable
+    });
   }
+  if (cause instanceof CapxulError2) {
+    if (!EMAIL_MATCH_PATTERN.test(cause.message)) return cause;
+    return new CapxulError2(cause.code, redactEmail(cause.message), {
+      cause,
+      details: cause.details,
+      correlationId: cause.correlationId,
+      layer: cause.layer
+    });
+  }
+  return Errors.providerError("auth", "flow", redactCauseEmail(cause));
 }
-function track(...args) {
-  const [name, props] = args;
-  debugLog(`[TRACK] ${name} ${formatDebugValue(props ?? "")}`);
+var EMAIL_MATCH_PATTERN = /[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}/;
+var EMAIL_REDACT_PATTERN = /[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}/g;
+function redactEmail(message) {
+  return message.replace(EMAIL_REDACT_PATTERN, "<redacted>");
 }
-function formatDebugValue2(value) {
-  if (value === void 0 || value === "") return "";
-  if (typeof value === "string") return value;
-  try {
-    return JSON.stringify(value);
-  } catch {
-    return String(value);
+function redactCauseEmail(cause) {
+  if (cause instanceof Error) {
+    if (!EMAIL_MATCH_PATTERN.test(cause.message)) return cause;
+    const redacted = new Error(redactEmail(cause.message));
+    redacted.cause = cause;
+    return redacted;
+  }
+  if (typeof cause === "string") {
+    return redactEmail(cause);
   }
+  return cause;
 }
-function identify(userId, traits) {
-  debugLog(`[IDENTIFY] ${userId} ${formatDebugValue2(traits ?? "")}`);
+function timeoutError(state) {
+  return Errors.providerError(
+    "auth",
+    "flow",
+    new Error(`timeout: ${state} exceeded ${FLOW_INVOKE_TIMEOUT_MS}ms`)
+  );
 }
-function createAuthFlowMachine(client) {
+function emailDomain(email) {
+  const domain = email.split("@")[1]?.trim().toLowerCase();
+  return domain || "unknown";
+}
+var initialContext = {
+  email: null,
+  code: null,
+  username: null,
+  signerProvider: null,
+  bootstrapToken: null,
+  bootstrapReason: null,
+  session: null,
+  account: null,
+  safe: null,
+  error: null
+};
+function createAuthBootstrapFlowMachine(client) {
   return setup({
     types: {},
     actors: {
-      // XState v5's `fromPromise` injects an `AbortSignal` that aborts
-      // when the actor is stopped (parent transition fires, machine is
-      // disposed, etc.). Plumbing it through `client.auth.sendOtp` /
-      // `client.auth.verifyOtp` makes the in-flight HTTP request
-      // cancellable: stale responses can't race a state machine
-      // that's already moved on. See PR #406 S5.
       sendOtp: fromPromise(async ({ input, signal }) => {
         const [error] = await client.auth.sendOtp(
           { email: input.email },
@@ -1590,17 +3306,19 @@ function createAuthFlowMachine(client) {
       }),
       verifyOtp: fromPromise(
         async ({ input, signal }) => {
-          const [error, session] = await client.auth.verifyOtp(
-            {
-              email: input.email,
-              otp: input.code
-            },
+          const [error, result] = await client.auth.verifyOtp(
+            { email: input.email, otp: input.code },
             { signal }
           );
           if (error) throw error;
-          return session;
+          return result;
         }
       ),
+      completeBootstrap: fromPromise(async ({ input }) => {
+        const [error, result] = await client.auth.completeBootstrap(input);
+        if (error) throw error;
+        return result;
+      }),
       signOut: fromPromise(async () => {
         const [error] = await client.auth.signOut();
         if (error) throw error;
@@ -1610,14 +3328,13 @@ function createAuthFlowMachine(client) {
       trackOtpRequested: ({ context }) => {
         if (!context.email) return;
         track("auth_otp_requested", {
-          email_domain: emailDomain(context.email)
+          email_domain: emailDomain2(context.email)
         });
       },
-      trackOtpFailed: ({ event }) => {
-        const error = errorFromEvent(event);
+      trackFailed: ({ event }) => {
         track("auth_failed", {
           auth_type: "email_otp",
-          reason: error.code
+          reason: errorFromEvent2(event).code
         });
       },
       trackTimeoutFailed: () => {
@@ -1629,13 +3346,19 @@ function createAuthFlowMachine(client) {
       trackVerified: () => {
         track("auth_verified", { auth_type: "email_otp" });
       },
+      trackBootstrapRequired: ({ context }) => {
+        track("auth_verified", {
+          auth_type: "email_otp",
+          auth_mode: context.bootstrapReason ?? "bootstrap_required"
+        });
+      },
       identifyAndTrack: ({ context }) => {
         if (!context.session) return;
         identify(context.session.authUserId, {
-          email_domain: emailDomain(context.session.email)
+          email_domain: emailDomain2(context.session.email)
         });
         track("auth_identified", {
-          email_domain: emailDomain(context.session.email)
+          email_domain: emailDomain2(context.session.email)
         });
       },
       trackSignedOut: () => {
@@ -1643,97 +3366,172 @@ function createAuthFlowMachine(client) {
       }
     }
   }).createMachine({
-    id: "auth",
-    initial: "idle",
-    context: { email: null, session: null, error: null },
+    id: "authBootstrap",
+    initial: "email",
+    context: initialContext,
     states: {
-      idle: {
+      email: {
         on: {
-          REQUEST_OTP: {
-            target: "sending_otp",
+          ENTER_EMAIL: {
             actions: assign({
               email: ({ event }) => event.email,
               error: () => null
             })
-          }
+          },
+          REQUEST_OTP: { target: "sending_otp" }
         }
       },
       sending_otp: {
         invoke: {
           src: "sendOtp",
-          input: ({ context }) => ({ email: requireEmail(context) }),
-          onDone: {
+          input: ({ context }) => ({ email: requireEmail2(context) }),
+          onDone: { target: "otp_requested", actions: "trackOtpRequested" },
+          onError: {
             target: "otp_requested",
-            actions: ["trackOtpRequested"]
+            actions: [
+              assign({ error: ({ event }) => errorFromEvent2(event) }),
+              "trackFailed"
+            ]
+          }
+        },
+        after: {
+          [FLOW_INVOKE_TIMEOUT_MS]: {
+            target: "otp_requested",
+            actions: [
+              assign({ error: () => timeoutError2("sending_otp") }),
+              "trackTimeoutFailed"
+            ]
+          }
+        }
+      },
+      otp_requested: {
+        on: {
+          ENTER_OTP: {
+            actions: assign({
+              code: ({ event }) => event.code,
+              error: () => null
+            })
           },
+          VERIFY_OTP: { target: "verifying_otp" },
+          BACK: { target: "email" },
+          RESET: { target: "email", actions: assign(() => initialContext) }
+        }
+      },
+      verifying_otp: {
+        invoke: {
+          src: "verifyOtp",
+          input: ({ context }) => ({
+            email: requireEmail2(context),
+            code: requireCode(context)
+          }),
+          onDone: [
+            {
+              guard: ({ event }) => event.output.kind === "existing_member",
+              target: "authenticated",
+              actions: [
+                assign({
+                  session: ({ event }) => event.output.session,
+                  account: ({ event }) => event.output.kind === "existing_member" ? event.output.account : null,
+                  username: ({ event }) => event.output.kind === "existing_member" ? event.output.username : null,
+                  safe: ({ event }) => event.output.kind === "existing_member" ? event.output.safe : null,
+                  email: () => null,
+                  error: () => null
+                }),
+                "trackVerified",
+                "identifyAndTrack"
+              ]
+            },
+            {
+              target: "bootstrap_required",
+              actions: [
+                assign({
+                  session: ({ event }) => event.output.session,
+                  bootstrapToken: ({ event }) => event.output.kind === "bootstrap_required" ? event.output.bootstrapToken : null,
+                  bootstrapReason: ({ event }) => event.output.kind === "bootstrap_required" ? event.output.reason : null,
+                  username: ({ event }) => event.output.kind === "bootstrap_required" ? event.output.username ?? null : null,
+                  email: ({ event }) => event.output.kind === "bootstrap_required" ? event.output.email : null,
+                  error: () => null
+                }),
+                "trackVerified",
+                "trackBootstrapRequired"
+              ]
+            }
+          ],
           onError: {
-            target: "error",
+            target: "otp_requested",
             actions: [
-              assign({ error: ({ event }) => errorFromEvent(event) }),
-              "trackOtpFailed"
+              assign({ error: ({ event }) => errorFromEvent2(event) }),
+              "trackFailed"
             ]
           }
         },
         after: {
           [FLOW_INVOKE_TIMEOUT_MS]: {
-            target: "error",
+            target: "otp_requested",
             actions: [
-              assign({
-                error: () => timeoutError("sending_otp")
-              }),
+              assign({ error: () => timeoutError2("verifying_otp") }),
               "trackTimeoutFailed"
             ]
           }
         }
       },
-      otp_requested: {
+      bootstrap_required: {
         on: {
-          VERIFY: { target: "verifying" },
-          RESET: {
-            target: "idle",
-            actions: assign({ email: () => null, error: () => null })
-          }
+          ENTER_USERNAME: {
+            actions: assign({
+              username: ({ event }) => event.username,
+              error: () => null
+            })
+          },
+          ENTER_SIGNER_PROVIDER: {
+            actions: assign({
+              signerProvider: ({ event }) => event.signerProvider,
+              error: () => null
+            })
+          },
+          COMPLETE_BOOTSTRAP: { target: "completing_bootstrap" },
+          BACK: { target: "otp_requested" },
+          RESET: { target: "email", actions: assign(() => initialContext) }
         }
       },
-      verifying: {
+      completing_bootstrap: {
         invoke: {
-          src: "verifyOtp",
-          input: ({ context, event }) => ({
-            email: requireEmail(context),
-            code: requireCodeFromEvent(event)
+          src: "completeBootstrap",
+          input: ({ context }) => ({
+            bootstrapToken: requireBootstrapToken(context),
+            username: requireUsername(context),
+            signerProvider: requireSignerProvider(context)
           }),
           onDone: {
             target: "authenticated",
             actions: [
-              // Scrub the duplicate `context.email` (input value
-              // captured during sendOtp) since the verified
-              // `session.email` is now the canonical source
-              // post-authentication. The session's email is
-              // intentionally retained — it's the auth result, not
-              // lingering input. See PR #406 S2.
               assign({
-                session: ({ event }) => event.output,
-                email: () => null
+                session: ({ event }) => event.output.session,
+                account: ({ event }) => event.output.account,
+                username: ({ event }) => event.output.username,
+                safe: ({ event }) => event.output.safe,
+                bootstrapToken: () => null,
+                bootstrapReason: () => null,
+                signerProvider: () => null,
+                email: () => null,
+                error: () => null
               }),
-              "trackVerified",
               "identifyAndTrack"
             ]
           },
           onError: {
-            target: "error",
+            target: "bootstrap_required",
             actions: [
-              assign({ error: ({ event }) => errorFromEvent(event) }),
-              "trackOtpFailed"
+              assign({ error: ({ event }) => errorFromEvent2(event) }),
+              "trackFailed"
             ]
           }
         },
         after: {
           [FLOW_INVOKE_TIMEOUT_MS]: {
-            target: "error",
+            target: "bootstrap_required",
             actions: [
-              assign({
-                error: () => timeoutError("verifying")
-              }),
+              assign({ error: () => timeoutError2("completing_bootstrap") }),
               "trackTimeoutFailed"
             ]
           }
@@ -1748,220 +3546,80 @@ function createAuthFlowMachine(client) {
         invoke: {
           src: "signOut",
           onDone: {
-            target: "idle",
+            target: "email",
             actions: [
-              assign({
-                session: () => null,
-                email: () => null,
-                error: () => null
-              }),
+              assign(() => initialContext),
               "trackSignedOut"
             ]
           },
           onError: {
             target: "error",
-            actions: assign({ error: ({ event }) => errorFromEvent(event) })
+            actions: assign({ error: ({ event }) => errorFromEvent2(event) })
           }
         }
       },
       error: {
         on: {
-          RESET: {
-            target: "idle",
-            actions: assign({ error: () => null })
-          }
+          RESET: { target: "email", actions: assign(() => initialContext) }
         }
       }
     }
   });
 }
-function requireEmail(context) {
+function requireEmail2(context) {
   if (!context.email) {
-    throw Errors.invalidInput(
-      "email",
-      "Auth flow advanced without an email captured in context."
-    );
+    throw Errors.invalidInput("email", "Auth bootstrap requires an email.");
   }
   return context.email;
 }
-function requireCodeFromEvent(event) {
-  if (event.type !== "VERIFY") {
+function requireCode(context) {
+  if (!context.code) {
+    throw Errors.invalidInput("code", "Auth bootstrap requires an OTP code.");
+  }
+  return context.code;
+}
+function requireBootstrapToken(context) {
+  if (!context.bootstrapToken) {
     throw Errors.invalidInput(
-      "code",
-      `Auth flow's verifying state requires a VERIFY event, got ${event.type}.`
+      "bootstrapToken",
+      "Auth bootstrap requires a continuation token."
     );
   }
-  return event.code;
+  return context.bootstrapToken;
 }
-function errorFromEvent(event) {
-  const cause = typeof event === "object" && event !== null && "error" in event ? event.error : event;
-  if (cause instanceof CapxulError) {
-    if (!EMAIL_MATCH_PATTERN.test(cause.message)) return cause;
-    return new CapxulError({
-      code: cause.code,
-      message: redactEmail(cause.message),
-      cause,
-      details: cause.details,
-      operationId: cause.operationId,
-      correlationId: cause.correlationId,
-      retryable: cause.retryable
-    });
-  }
-  if (cause instanceof CapxulError2) {
-    if (!EMAIL_MATCH_PATTERN.test(cause.message)) return cause;
-    return new CapxulError2(cause.code, redactEmail(cause.message), {
-      cause,
-      details: cause.details,
-      correlationId: cause.correlationId,
-      layer: cause.layer
-    });
+function requireUsername(context) {
+  if (!context.username) {
+    throw Errors.invalidInput("username", "Auth bootstrap requires a username.");
   }
-  return Errors.providerError("auth", "flow", redactCauseEmail(cause));
-}
-var EMAIL_MATCH_PATTERN = /[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}/;
-var EMAIL_REDACT_PATTERN = /[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}/g;
-function redactEmail(message) {
-  return message.replace(EMAIL_REDACT_PATTERN, "<redacted>");
+  return context.username;
 }
-function redactCauseEmail(cause) {
-  if (cause instanceof Error) {
-    if (!EMAIL_MATCH_PATTERN.test(cause.message)) return cause;
-    const redacted = new Error(redactEmail(cause.message));
-    redacted.cause = cause;
-    return redacted;
+function requireSignerProvider(context) {
+  if (!context.signerProvider) {
+    throw Errors.invalidInput(
+      "signerProvider",
+      "Auth bootstrap requires a signer provider."
+    );
   }
-  if (typeof cause === "string") {
-    return redactEmail(cause);
+  return context.signerProvider;
+}
+function errorFromEvent2(event) {
+  const cause = typeof event === "object" && event !== null && "error" in event ? event.error : event;
+  if (cause instanceof CapxulError || cause instanceof CapxulError2) {
+    return cause;
   }
-  return cause;
+  return Errors.providerError("auth", "bootstrap", cause);
 }
-function timeoutError(state) {
+function timeoutError2(state) {
   return Errors.providerError(
     "auth",
-    "flow",
+    "bootstrap",
     new Error(`timeout: ${state} exceeded ${FLOW_INVOKE_TIMEOUT_MS}ms`)
   );
 }
-function emailDomain(email) {
+function emailDomain2(email) {
   const domain = email.split("@")[1]?.trim().toLowerCase();
   return domain || "unknown";
 }
-
-// ../platform-kernel/src/ids.ts
-function makePrefixedIdConstructor(prefix, fieldName) {
-  const re = new RegExp(`^${prefix}_[A-Za-z0-9_\\-]+$`);
-  return (raw) => {
-    if (typeof raw !== "string" || !re.test(raw)) {
-      throw new Error(
-        `Invalid ${fieldName}: expected string matching ^${prefix}_[A-Za-z0-9_\\-]+$, got ${String(raw)}`
-      );
-    }
-    return raw;
-  };
-}
-var toAccountId = makePrefixedIdConstructor(
-  "acct",
-  "accountId"
-);
-var toOrganizationId = makePrefixedIdConstructor("org", "organizationId");
-var toMemberId = makePrefixedIdConstructor(
-  "mem",
-  "memberId"
-);
-var toSafeId = makePrefixedIdConstructor(
-  "safe",
-  "safeId"
-);
-var toTreasuryId = makePrefixedIdConstructor(
-  "try",
-  "treasuryId"
-);
-var toApiKeyId = makePrefixedIdConstructor(
-  "ak",
-  "apiKeyId"
-);
-var toOperationId = makePrefixedIdConstructor(
-  "op",
-  "operationId"
-);
-var toKycProfileId = makePrefixedIdConstructor(
-  "kyc",
-  "kycProfileId"
-);
-var toKybProfileId = makePrefixedIdConstructor(
-  "kyb",
-  "kybProfileId"
-);
-var toExternalAccountId = makePrefixedIdConstructor("ext", "externalAccountId");
-var toPaymentId = makePrefixedIdConstructor(
-  "pay",
-  "paymentId"
-);
-var toWithdrawalId = makePrefixedIdConstructor(
-  "wd",
-  "withdrawalId"
-);
-var toWebhookEndpointId = makePrefixedIdConstructor("we", "webhookEndpointId");
-var toWebhookEventId = makePrefixedIdConstructor("evt", "webhookEventId");
-var toSubAccountId = makePrefixedIdConstructor(
-  "sub",
-  "subAccountId"
-);
-var toVirtualAccountId = makePrefixedIdConstructor("va", "virtualAccountId");
-var toVirtualCardId = makePrefixedIdConstructor(
-  "vc",
-  "virtualCardId"
-);
-var toTransferId = makePrefixedIdConstructor(
-  "txfr",
-  "transferId"
-);
-var toDocumentId = makePrefixedIdConstructor(
-  "doc",
-  "documentId"
-);
-var toBalanceLedgerEntryId = makePrefixedIdConstructor("bal", "balanceLedgerEntryId");
-
-// ../platform-kernel/src/value-objects.ts
-var PHONE_NUMBER_RE = /^\+[1-9]\d{1,14}$/;
-function toPhoneNumber(raw) {
-  if (typeof raw !== "string" || !PHONE_NUMBER_RE.test(raw)) {
-    throw new Error(
-      `Invalid phoneNumber: expected E.164 string matching ^\\+[1-9]\\d{1,14}$, got ${String(raw)}`
-    );
-  }
-  return raw;
-}
-var EMAIL_RE = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
-function toEmail(raw) {
-  if (typeof raw !== "string") {
-    throw new Error(
-      `Invalid email: expected string, got ${String(raw)}`
-    );
-  }
-  const lowered = raw.trim().toLowerCase();
-  if (!EMAIL_RE.test(lowered)) {
-    throw new Error(
-      `Invalid email: expected local@domain.tld, got ${String(raw)}`
-    );
-  }
-  return lowered;
-}
-var USERNAME_RE = /^[a-z][a-z0-9_-]{2,29}$/;
-function toUsername(raw) {
-  if (typeof raw !== "string") {
-    throw new Error(
-      `Invalid username: expected string, got ${String(raw)}`
-    );
-  }
-  const lowered = raw.toLowerCase();
-  if (!USERNAME_RE.test(lowered)) {
-    throw new Error(
-      `Invalid username: expected 3-30 chars, letter-first, [a-z0-9_-], got ${String(raw)}`
-    );
-  }
-  return lowered;
-}
 function createProvisioningMachine(client) {
   return setup({
     types: {},
@@ -2034,13 +3692,13 @@ function createProvisioningMachine(client) {
           },
           onError: {
             target: "error",
-            actions: assign({ error: ({ event }) => errorFromEvent2(event) })
+            actions: assign({ error: ({ event }) => errorFromEvent3(event) })
           }
         },
         after: {
           [FLOW_INVOKE_TIMEOUT_MS]: {
             target: "error",
-            actions: assign({ error: () => timeoutError2() })
+            actions: assign({ error: () => timeoutError3() })
           }
         }
       },
@@ -2058,7 +3716,7 @@ function createProvisioningMachine(client) {
      * this payload on its `onDone` transition and branches via guards
      * on `event.output.error`.
      */
-    output: ({ context }) => context.error ? { error: context.error } : context.account ? { account: context.account } : { error: timeoutError2() }
+    output: ({ context }) => context.error ? { error: context.error } : context.account ? { account: context.account } : { error: timeoutError3() }
   });
 }
 function requireProvisionInput(context) {
@@ -2070,13 +3728,13 @@ function requireProvisionInput(context) {
   }
   return context.input;
 }
-function errorFromEvent2(event) {
+function errorFromEvent3(event) {
   const cause = typeof event === "object" && event !== null && "error" in event ? event.error : event;
   if (cause instanceof CapxulError) return cause;
   if (cause instanceof CapxulError2) return cause;
   return Errors.providerError("provisioning", "flow", cause);
 }
-function timeoutError2() {
+function timeoutError3() {
   return Errors.providerError(
     "provisioning",
     "flow",
@@ -2169,7 +3827,7 @@ function createOnboardingFlowMachine(client) {
         error: ({ event }) => extractChildErrorOrFallback(event)
       }),
       assignChildThrown: assign({
-        error: ({ event }) => errorFromEvent3(event)
+        error: ({ event }) => errorFromEvent4(event)
       }),
       assignAccountFromChild: assign({
         account: ({ event }) => extractChildAccountOrNull(event)
@@ -2331,7 +3989,7 @@ function extractChildAccountOrNull(event) {
   if (output && "account" in output && output.account) return output.account;
   return null;
 }
-function errorFromEvent3(event) {
+function errorFromEvent4(event) {
   const cause = typeof event === "object" && event !== null && "error" in event ? event.error : event;
   if (cause instanceof CapxulError) return cause;
   if (cause instanceof CapxulError2) return cause;
@@ -2348,12 +4006,13 @@ function createCapxulClient(config = {}) {
     organizations: createOrganizationsClient(config),
     payments: createPaymentsClient(config),
     transfers: createTransfersClient(),
+    tokenTransfers: createTokenTransfersClient(config),
     withdrawals: createWithdrawalsClient(config),
     documents: createDocumentsClient(),
-    subAccounts: createSubAccountsClient(),
+    subAccounts: createSubAccountsClient(config),
     virtualAccounts: createVirtualAccountsClient(),
     virtualCards: createVirtualCardsClient(),
-    externalAccounts: createExternalAccountsClient(),
+    externalAccounts: createExternalAccountsClient(config),
     operations: createOperationsClient(config),
     webhookEndpoints: createWebhookEndpointsClient(),
     webhookEvents: createWebhookEventsClient(),
@@ -2362,6 +4021,7 @@ function createCapxulClient(config = {}) {
   const client = clientWithoutFlows;
   client.flows = {
     auth: () => createAuthFlowMachine(client),
+    authBootstrap: () => createAuthBootstrapFlowMachine(client),
     onboarding: () => createOnboardingFlowMachine(client),
     provisioning: () => createProvisioningMachine(client)
   };
@@ -2466,4 +4126,4 @@ function isWebhookEvent(value) {
   return typeof candidate.id === "string" && typeof candidate.type === "string" && typeof candidate.createdAt === "string" && (candidate.operationId === void 0 || typeof candidate.operationId === "string") && (candidate.correlationId === void 0 || typeof candidate.correlationId === "string") && !!candidate.data && typeof candidate.data === "object" && !Array.isArray(candidate.data);
 }
 
-export { CapxulError, createAuthFlowMachine, createCapxulClient, createLocalSigner, createOnboardingFlowMachine, createProvisioningMachine as createProvisioningFlowMachine, makeHttpTransport, matchAction, matchError, matchStatus, toAccountId, toApiKeyId, toBalanceLedgerEntryId, toDocumentId, toEmail, toExternalAccountId, toKybProfileId, toKycProfileId, toMemberId, toOperationId, toOrganizationId, toPaymentId, toPhoneNumber, toSafeId, toSubAccountId, toTransferId, toTreasuryId, toUsername, toVirtualAccountId, toVirtualCardId, toWebhookEndpointId, toWebhookEventId, toWithdrawalId, verifyWebhook };
+export { CapxulError, createAuthBootstrapFlowMachine, createAuthFlowMachine, createCapxulClient, createLocalSigner, createOnboardingFlowMachine, createProvisioningMachine as createProvisioningFlowMachine, makeHttpTransport, matchAction, matchError, matchStatus, toAccountId, toApiKeyId, toBalanceLedgerEntryId, toDocumentId, toEmail, toExternalAccountId, toKybProfileId, toKycProfileId, toMemberId, toOperationId, toOrganizationId, toPaymentId, toPhoneNumber, toSafeId, toSubAccountId, toTokenTransferId, toTransferId, toTreasuryId, toUsername, toVirtualAccountId, toVirtualCardId, toWebhookEndpointId, toWebhookEventId, toWithdrawalId, tryCatch, verifyWebhook };