@capxul/sdk 0.1.0-alpha.4 → 0.1.0-alpha.6

package/dist/index.cjs

@@ -70,7 +70,366 @@ function fromConvexError(error) {
   });
 }
 
+// ../observability/src/try-catch.ts
+async function tryCatch(promise) {
+  try {
+    return [null, await promise];
+  } catch (e) {
+    return [e instanceof Error ? e : new Error(String(e)), null];
+  }
+}
+
+// ../observability/src/debug-log.ts
+function isDevelopmentBuild() {
+  if (typeof process === "undefined") {
+    return false;
+  }
+  return process.env?.NODE_ENV === "development" || process.env?.NODE_ENV === "test";
+}
+function debugLog(line) {
+  if (!isDevelopmentBuild()) return;
+  if (typeof globalThis !== "undefined" && "window" in globalThis && typeof console?.info === "function") {
+    console.info(line);
+    return;
+  }
+  if (typeof process !== "undefined" && typeof process.stderr?.write === "function") {
+    process.stderr.write(`${line}
+`);
+  }
+}
+function formatDebugValue(value) {
+  if (value === void 0 || value === "") return "";
+  if (typeof value === "string") return value;
+  try {
+    return JSON.stringify(value);
+  } catch {
+    return String(value);
+  }
+}
+function track(...args) {
+  const [name, props] = args;
+  debugLog(`[TRACK] ${name} ${formatDebugValue(props ?? "")}`);
+}
+function formatDebugValue2(value) {
+  if (value === void 0 || value === "") return "";
+  if (typeof value === "string") return value;
+  try {
+    return JSON.stringify(value);
+  } catch {
+    return String(value);
+  }
+}
+function identify(userId, traits) {
+  debugLog(`[IDENTIFY] ${userId} ${formatDebugValue2(traits ?? "")}`);
+}
+
+// ../platform-kernel/src/ids.ts
+function makePrefixedIdConstructor(prefix, fieldName) {
+  const re = new RegExp(`^${prefix}_[A-Za-z0-9_\\-]+$`);
+  return (raw) => {
+    if (typeof raw !== "string" || !re.test(raw)) {
+      throw new Error(
+        `Invalid ${fieldName}: expected string matching ^${prefix}_[A-Za-z0-9_\\-]+$, got ${String(raw)}`
+      );
+    }
+    return raw;
+  };
+}
+var toAccountId = makePrefixedIdConstructor(
+  "acct",
+  "accountId"
+);
+var toOrganizationId = makePrefixedIdConstructor("org", "organizationId");
+var toMemberId = makePrefixedIdConstructor(
+  "mem",
+  "memberId"
+);
+var toSafeId = makePrefixedIdConstructor(
+  "safe",
+  "safeId"
+);
+var toTreasuryId = makePrefixedIdConstructor(
+  "try",
+  "treasuryId"
+);
+var toApiKeyId = makePrefixedIdConstructor(
+  "ak",
+  "apiKeyId"
+);
+var toOperationId = makePrefixedIdConstructor(
+  "op",
+  "operationId"
+);
+var toCorrelationId = makePrefixedIdConstructor("ctx", "correlationId");
+var toKycProfileId = makePrefixedIdConstructor(
+  "kyc",
+  "kycProfileId"
+);
+var toKybProfileId = makePrefixedIdConstructor(
+  "kyb",
+  "kybProfileId"
+);
+var toExternalAccountId = makePrefixedIdConstructor("ext", "externalAccountId");
+var toPaymentId = makePrefixedIdConstructor(
+  "pay",
+  "paymentId"
+);
+var toWithdrawalId = makePrefixedIdConstructor(
+  "wd",
+  "withdrawalId"
+);
+var toWebhookEndpointId = makePrefixedIdConstructor("we", "webhookEndpointId");
+var toWebhookEventId = makePrefixedIdConstructor("evt", "webhookEventId");
+var toSubAccountId = makePrefixedIdConstructor(
+  "sub",
+  "subAccountId"
+);
+var toVirtualAccountId = makePrefixedIdConstructor("va", "virtualAccountId");
+var toVirtualCardId = makePrefixedIdConstructor(
+  "vc",
+  "virtualCardId"
+);
+var toTransferId = makePrefixedIdConstructor(
+  "txfr",
+  "transferId"
+);
+var toDocumentId = makePrefixedIdConstructor(
+  "doc",
+  "documentId"
+);
+var toBalanceLedgerEntryId = makePrefixedIdConstructor("bal", "balanceLedgerEntryId");
+
+// ../platform-kernel/src/value-objects.ts
+var PHONE_NUMBER_RE = /^\+[1-9]\d{1,14}$/;
+function toPhoneNumber(raw) {
+  if (typeof raw !== "string" || !PHONE_NUMBER_RE.test(raw)) {
+    throw new Error(
+      `Invalid phoneNumber: expected E.164 string matching ^\\+[1-9]\\d{1,14}$, got ${String(raw)}`
+    );
+  }
+  return raw;
+}
+var EMAIL_RE = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
+function toEmail(raw) {
+  if (typeof raw !== "string") {
+    throw new Error(
+      `Invalid email: expected string, got ${String(raw)}`
+    );
+  }
+  const lowered = raw.trim().toLowerCase();
+  if (!EMAIL_RE.test(lowered)) {
+    throw new Error(
+      `Invalid email: expected local@domain.tld, got ${String(raw)}`
+    );
+  }
+  return lowered;
+}
+var USERNAME_RE = /^[a-z][a-z0-9_-]{2,29}$/;
+function toUsername(raw) {
+  if (typeof raw !== "string") {
+    throw new Error(
+      `Invalid username: expected string, got ${String(raw)}`
+    );
+  }
+  const lowered = raw.toLowerCase();
+  if (!USERNAME_RE.test(lowered)) {
+    throw new Error(
+      `Invalid username: expected 3-30 chars, letter-first, [a-z0-9_-], got ${String(raw)}`
+    );
+  }
+  return lowered;
+}
+
+// src/core/external-accounts.ts
+function brandExternalAccount(raw) {
+  return {
+    ...raw,
+    id: toExternalAccountId(raw.id),
+    operation: {
+      id: toOperationId(raw.operation.id),
+      status: raw.operation.status,
+      correlationId: toCorrelationId(raw.operation.correlationId)
+    }
+  };
+}
+function createExternalAccountsClient(config = {}) {
+  return {
+    retrieve: async (externalAccountId) => {
+      if (!config.data) {
+        return stub(
+          "externalAccounts.retrieve"
+        );
+      }
+      const [err, raw] = await tryCatch(
+        config.data.query(api.externalAccounts.queries.retrievePersonal, {
+          externalAccountId
+        })
+      );
+      if (err) {
+        return [
+          fromConvexError(err),
+          null
+        ];
+      }
+      if (!raw) {
+        return [
+          new CapxulError({
+            code: "NOT_FOUND",
+            message: `external_account ${externalAccountId} not found`
+          }),
+          null
+        ];
+      }
+      return [null, brandExternalAccount(raw)];
+    },
+    remove: async (externalAccountId) => {
+      if (!config.data) {
+        return stub("externalAccounts.remove");
+      }
+      const [err] = await tryCatch(
+        config.data.mutation(api.externalAccounts.mutations.removePersonal, {
+          externalAccountId
+        })
+      );
+      if (err) {
+        return [
+          fromConvexError(err),
+          null
+        ];
+      }
+      return [null, void 0];
+    }
+  };
+}
+
 // src/core/accounts.ts
+function createAccountExternalAccountsClient(config) {
+  return {
+    create: async (input) => {
+      if (!config.data) {
+        return stub(
+          "accounts.externalAccounts.create"
+        );
+      }
+      const [err, raw] = await tryCatch(
+        config.data.mutation(
+          api.externalAccounts.mutations.createPersonal,
+          {
+            kind: input.kind,
+            label: input.label,
+            address: input.address,
+            iban: input.iban,
+            bic: input.bic,
+            accountHolder: input.accountHolder,
+            network: input.network,
+            panToken: input.panToken,
+            last4: input.last4
+          }
+        )
+      );
+      if (err) {
+        return [
+          fromConvexError(err),
+          null
+        ];
+      }
+      if (!raw) {
+        return [
+          new CapxulError({
+            code: "NOT_FOUND",
+            message: "external_account creation returned no resource"
+          }),
+          null
+        ];
+      }
+      return [
+        null,
+        brandExternalAccount(
+          raw
+        )
+      ];
+    },
+    list: async (input) => {
+      if (!config.data) {
+        return stub(
+          "accounts.externalAccounts.list"
+        );
+      }
+      const [err, result] = await tryCatch(
+        config.data.query(api.externalAccounts.queries.listPersonal, {
+          limit: input.limit,
+          cursor: input.cursor
+        })
+      );
+      if (err) {
+        return [fromConvexError(err), null];
+      }
+      const branded = result.data.map(
+        (row) => brandExternalAccount(
+          row
+        )
+      );
+      return [
+        null,
+        {
+          object: "list",
+          data: branded,
+          page: result.page
+        }
+      ];
+    },
+    retrieve: async (externalAccountId) => {
+      if (!config.data) {
+        return stub(
+          "accounts.externalAccounts.retrieve"
+        );
+      }
+      const [err, raw] = await tryCatch(
+        config.data.query(api.externalAccounts.queries.retrievePersonal, {
+          externalAccountId
+        })
+      );
+      if (err) {
+        return [
+          fromConvexError(err),
+          null
+        ];
+      }
+      if (!raw) {
+        return [
+          new CapxulError({
+            code: "NOT_FOUND",
+            message: `external_account ${externalAccountId} not found`
+          }),
+          null
+        ];
+      }
+      return [
+        null,
+        brandExternalAccount(
+          raw
+        )
+      ];
+    },
+    remove: async (externalAccountId) => {
+      if (!config.data) {
+        return stub("accounts.externalAccounts.remove");
+      }
+      const [err] = await tryCatch(
+        config.data.mutation(api.externalAccounts.mutations.removePersonal, {
+          externalAccountId
+        })
+      );
+      if (err) {
+        return [
+          fromConvexError(err),
+          null
+        ];
+      }
+      return [null, void 0];
+    }
+  };
+}
 function createAccountsClient(config = {}) {
   return {
     retrieve: async (accountId) => {
@@ -225,18 +584,7 @@ function createAccountsClient(config = {}) {
       create: async () => stub("accounts.kycProfiles.create"),
       retrieve: async () => stub("accounts.kycProfiles.retrieve")
     },
-    externalAccounts: {
-      create: async () => stub(
-        "accounts.externalAccounts.create"
-      ),
-      list: async () => stub(
-        "accounts.externalAccounts.list"
-      ),
-      retrieve: async () => stub(
-        "accounts.externalAccounts.retrieve"
-      ),
-      remove: async () => stub("accounts.externalAccounts.remove")
-    },
+    externalAccounts: createAccountExternalAccountsClient(config),
     subAccounts: {
       create: async () => stub("accounts.subAccounts.create"),
       list: async () => stub("accounts.subAccounts.list"),
@@ -332,7 +680,29 @@ var Errors = {
     { details }
   ),
   emailDeliveryFailed: (detail) => new CapxulError2("EMAIL_DELIVERY_FAILED", `Failed to send email: ${detail}`),
-  internalError: (reason) => new CapxulError2("INTERNAL_ERROR", `Internal error: ${reason}`)
+  internalError: (reason) => new CapxulError2("INTERNAL_ERROR", `Internal error: ${reason}`),
+  /**
+   * Verification gate. Surfaced when a request hits a verification
+   * boundary the actor cannot cross under their current state. Two
+   * variants share this code:
+   *
+   * - Rail gate (Withdrawals v1 W2, #465): the resolved
+   *   `external_account.kind` routes to a withdrawal rail (e.g.
+   *   `fiat_offramp`, `card_payout`) that is not yet supported. Carries
+   *   `details.rail` + `details.currentKind`.
+   * - KYC tier gate (legacy / future): the actor's KYC tier is below
+   *   the required tier. Carries `details.requiredTier`.
+   *
+   * Code is shared because both expose the same UX shape ("you cannot
+   * proceed until verification advances"); the `details.*` keys
+   * differentiate the route.
+   */
+  verificationRequired: (details) => {
+    const message = "rail" in details ? `Withdrawal rail "${details.rail}" (kind=${details.currentKind}) is not yet supported.` : `Verification tier ${details.requiredTier} is required.`;
+    return new CapxulError2("VERIFICATION_REQUIRED", message, {
+      details: { ...details }
+    });
+  }
 };
 
 // ../config/src/safe.ts
@@ -744,14 +1114,6 @@ function createOrgDocumentsClient() {
   };
 }
 
-// src/core/external-accounts.ts
-function createExternalAccountsClient() {
-  return {
-    retrieve: async () => stub("externalAccounts.retrieve"),
-    remove: async () => stub("externalAccounts.remove")
-  };
-}
-
 // src/core/me.ts
 function createMeClient(config = {}) {
   return {
@@ -1199,67 +1561,68 @@ function createOrgTransfersClient() {
     cancel: async () => stub("organizations.transfers.cancel")
   };
 }
-var EVM_ADDRESS_RE = /^0x[0-9a-fA-F]{40}$/;
 function createWithdrawalsClient(config = {}) {
   return {
     create: async (input) => {
       if (!config.data) {
         return stub("withdrawals.create");
       }
-      let created = null;
-      let submitted = null;
-      try {
-        created = await config.data.mutation(
-          api.withdrawals.mutations.create,
-          {
-            amount: input.amount,
-            destination: {
-              externalAccountId: input.destination.externalAccountId,
-              kind: input.destination.kind
-            },
-            source: input.source,
-            reference: input.reference,
-            idempotencyKey: input.idempotencyKey
-          }
-        );
-        if (!created) {
-          return [
-            new CapxulError({
-              code: "NETWORK_ERROR",
-              message: "withdrawals.create returned no withdrawal resource"
-            }),
-            null
-          ];
-        }
-        if (created.status !== "processing" || created.operation.status !== "processing") {
-          return [null, created];
-        }
-        if (input.destination.kind !== "evm") {
-          return [null, created];
-        }
-        if (!config.signer || !config.signing) {
-          return [null, created];
-        }
-        if (!EVM_ADDRESS_RE.test(input.destination.externalAccountId)) {
-          throw new CapxulError({
-            code: "INVALID_INPUT",
-            message: "destination.externalAccountId must be a 0x-prefixed EVM address while external_accounts resolution is pending (slice 1).",
-            details: { field: "destination.externalAccountId" }
-          });
-        }
-        const currentSigner = await config.data.query(
-          api.safe.queries.getMySignerAddress,
-          {}
+      const [createErr, createdRaw] = await tryCatch(
+        config.data.mutation(api.withdrawals.mutations.create, {
+          amount: input.amount,
+          destination: {
+            externalAccountId: input.destination.externalAccountId
+          },
+          source: input.source,
+          reference: input.reference,
+          idempotencyKey: input.idempotencyKey
+        })
+      );
+      if (createErr) {
+        return [mapCreateError2(fromConvexError(createErr)), null];
+      }
+      const created = createdRaw;
+      if (!created) {
+        return [
+          new CapxulError({
+            code: "NETWORK_ERROR",
+            message: "withdrawals.create returned no withdrawal resource"
+          }),
+          null
+        ];
+      }
+      if (created.status !== "processing" || created.operation.status !== "processing") {
+        return [null, created];
+      }
+      if (!config.signer || !config.signing) {
+        return [null, created];
+      }
+      const [signerErr, currentSigner] = await tryCatch(
+        config.data.query(api.safe.queries.getMySignerAddress, {})
+      );
+      if (signerErr) {
+        return await handleSubmissionFailure(
+          { data: config.data },
+          created.id,
+          mapCreateError2(fromConvexError(signerErr))
         );
-        if (!currentSigner?.address) {
-          throw new CapxulError({
+      }
+      if (!currentSigner?.address) {
+        return await handleSubmissionFailure(
+          { data: config.data },
+          created.id,
+          new CapxulError({
             code: "PERMISSION_DENIED",
             message: "No signer is registered for the authenticated account.",
             details: { withdrawalId: created.id }
-          });
-        }
-        if (viem.getAddress(currentSigner.address) !== viem.getAddress(config.signer.address)) {
-          throw new CapxulError({
+          })
+        );
+      }
+      if (viem.getAddress(currentSigner.address) !== viem.getAddress(config.signer.address)) {
+        return await handleSubmissionFailure(
+          { data: config.data },
+          created.id,
+          new CapxulError({
             code: "PERMISSION_DENIED",
             message: "Configured signer does not match the authenticated account signer.",
             details: {
@@ -1267,170 +1630,228 @@ function createWithdrawalsClient(config = {}) {
               expectedSignerAddress: currentSigner.address,
               actualSignerAddress: config.signer.address
             }
-          });
-        }
-        const submission = await config.data.query(
-          api.withdrawals.queries.prepareSubmission,
-          { withdrawalId: created.id }
+          })
         );
-        if (!submission?.externalAccountId) {
-          throw new CapxulError({
+      }
+      const [prepErr, submission] = await tryCatch(
+        config.data.query(api.withdrawals.queries.prepareSubmission, {
+          withdrawalId: created.id
+        })
+      );
+      if (prepErr) {
+        return await handleSubmissionFailure(
+          { data: config.data },
+          created.id,
+          mapCreateError2(fromConvexError(prepErr))
+        );
+      }
+      const destinationAddress = submission?.destinationAddress;
+      if (!submission || !destinationAddress) {
+        return await handleSubmissionFailure(
+          { data: config.data },
+          created.id,
+          new CapxulError({
             code: "NETWORK_ERROR",
             message: "withdrawals.prepareSubmission returned no destination.",
             details: { withdrawalId: created.id }
-          });
-        }
-        const transfer = await transferAsOwner(
+          })
+        );
+      }
+      const [transferErr, transferOk] = await tryCatch(
+        transferAsOwner(
           {
             signer: config.signer,
             signing: config.signing
           },
           {
             tokenAddress: resolvePaymentTokenAddress(submission.amount.currency),
-            recipientAddress: submission.externalAccountId,
+            recipientAddress: destinationAddress,
             amount: toTokenUnits(submission.amount.value, 6)
           }
+        )
+      );
+      if (transferErr) {
+        return await handleSubmissionFailure(
+          { data: config.data },
+          created.id,
+          mapCreateError2(fromConvexError(transferErr))
         );
-        if (!transfer.success) {
-          throw new CapxulError({
+      }
+      if (!transferOk.success) {
+        return await handleSubmissionFailure(
+          { data: config.data },
+          created.id,
+          new CapxulError({
             code: "NETWORK_ERROR",
             message: "Bundler submission did not succeed.",
             details: {
               withdrawalId: created.id,
-              txHash: transfer.txHash,
-              userOpHash: transfer.userOpHash
+              txHash: transferOk.txHash,
+              userOpHash: transferOk.userOpHash
             }
-          });
-        }
-        submitted = {
-          txHash: transfer.txHash,
-          userOpHash: transfer.userOpHash
-        };
-        await config.data.mutation(
-          api.withdrawals.mutations.recordSubmitted,
-          {
-            withdrawalId: created.id,
-            txHash: transfer.txHash,
-            userOpHash: transfer.userOpHash
-          }
+          })
         );
-        return [null, created];
-      } catch (cause) {
-        const error = mapCreateError2(fromConvexError(cause));
-        if (created?.id && created.status === "processing" && !submitted) {
-          await bestEffortMarkFailed2({ data: config.data }, created.id, error);
-        }
-        if (submitted && created?.id) {
-          return [
-            new CapxulError({
-              code: "NETWORK_ERROR",
-              message: "Withdrawal was submitted on-chain, but backend submission tracking failed.",
-              cause,
-              details: {
-                withdrawalId: created.id,
-                txHash: submitted.txHash,
-                userOpHash: submitted.userOpHash
-              }
-            }),
-            null
-          ];
-        }
-        return [error, null];
       }
+      const [recordErr] = await tryCatch(
+        config.data.mutation(api.withdrawals.mutations.recordSubmitted, {
+          withdrawalId: created.id,
+          txHash: transferOk.txHash,
+          userOpHash: transferOk.userOpHash
+        })
+      );
+      if (recordErr) {
+        return [
+          new CapxulError({
+            code: "NETWORK_ERROR",
+            message: "Withdrawal was submitted on-chain, but backend submission tracking failed.",
+            cause: recordErr,
+            details: {
+              withdrawalId: created.id,
+              txHash: transferOk.txHash,
+              userOpHash: transferOk.userOpHash
+            }
+          }),
+          null
+        ];
+      }
+      return [null, created];
     },
     retrieve: async (withdrawalId) => {
       if (!config.data) {
         return stub("withdrawals.retrieve");
       }
-      try {
-        const withdrawal = await config.data.query(
-          api.withdrawals.queries.retrieve,
-          { withdrawalId }
-        );
-        if (!withdrawal) {
-          return [
-            new CapxulError({
-              code: "NOT_FOUND",
-              message: `withdrawal ${withdrawalId} not found`
-            }),
-            null
-          ];
-        }
-        return [null, withdrawal];
-      } catch (cause) {
+      const [err, raw] = await tryCatch(
+        config.data.query(api.withdrawals.queries.retrieve, { withdrawalId })
+      );
+      if (err) {
+        return [fromConvexError(err), null];
+      }
+      const withdrawal = raw;
+      if (!withdrawal) {
         return [
-          fromConvexError(cause),
+          new CapxulError({
+            code: "NOT_FOUND",
+            message: `withdrawal ${withdrawalId} not found`
+          }),
           null
         ];
       }
+      return [null, withdrawal];
     },
     list: async (input) => {
       if (!config.data) {
         return stub("withdrawals.list");
       }
-      try {
-        const result = await config.data.query(
-          api.withdrawals.queries.list,
-          {
-            limit: input?.limit,
-            cursor: input?.cursor
-          }
+      const [err, raw] = await tryCatch(
+        config.data.query(api.withdrawals.queries.list, {
+          limit: input?.limit,
+          cursor: input?.cursor
+        })
+      );
+      if (err) {
+        return [fromConvexError(err), null];
+      }
+      return [null, raw];
+    },
+    recordCompleted: async (input) => {
+      if (!config.data) {
+        return stub(
+          "withdrawals.recordCompleted"
         );
-        return [null, result];
-      } catch (cause) {
+      }
+      const [err] = await tryCatch(
+        config.data.mutation(api.withdrawals.mutations.recordCompleted, {
+          withdrawalId: input.withdrawalId,
+          txHash: input.txHash
+        })
+      );
+      if (err) {
         return [
-          fromConvexError(cause),
+          mapRecordCompletedError(fromConvexError(err)),
           null
         ];
       }
+      return [null, null];
     }
   };
 }
 function createOrgWithdrawalsClient(config = {}) {
   return {
-    // Slice 1 ships personal-scope only end-to-end; org-scope create
-    // remains stubbed pending org-scoped backend mutation. List + retrieve
-    // are wired through the org-aware query.
-    create: async () => stub(
-      "organizations.withdrawals.create"
-    ),
+    /**
+     * Org-scope create (Withdrawals v1 W2, #465).
+     *
+     * D6 — returns the `processing` row only. No `transferAsOwner`
+     * tail, no `recordSubmitted` call. Org Safe + Zodiac submission
+     * orchestration ships in W3+.
+     */
+    create: async (input) => {
+      if (!config.data) {
+        return stub(
+          "organizations.withdrawals.create"
+        );
+      }
+      const [err, raw] = await tryCatch(
+        config.data.mutation(api.withdrawals.mutations.createOrg, {
+          organizationId: input.organizationId,
+          amount: input.amount,
+          destination: {
+            externalAccountId: input.destination.externalAccountId
+          },
+          source: input.source,
+          reference: input.reference,
+          idempotencyKey: input.idempotencyKey
+        })
+      );
+      if (err) {
+        return [mapCreateError2(fromConvexError(err)), null];
+      }
+      const created = raw;
+      if (!created) {
+        return [
+          new CapxulError({
+            code: "NETWORK_ERROR",
+            message: "organizations.withdrawals.create returned no withdrawal resource"
+          }),
+          null
+        ];
+      }
+      return [null, created];
+    },
     retrieve: async (input) => {
       if (!config.data) {
         return stub(
           "organizations.withdrawals.retrieve"
         );
       }
-      try {
-        const withdrawal = await config.data.query(
-          api.withdrawals.queries.retrieve,
-          { withdrawalId: input.withdrawalId }
-        );
-        if (!withdrawal) {
-          return [
-            new CapxulError({
-              code: "NOT_FOUND",
-              message: `withdrawal ${input.withdrawalId} not found`
-            }),
-            null
-          ];
-        }
-        const ownerCheck = withdrawal.owner;
-        if (ownerCheck?.type !== "organization" || ownerCheck.id !== input.organizationId) {
-          return [
-            new CapxulError({
-              code: "NOT_FOUND",
-              message: `withdrawal ${input.withdrawalId} does not belong to organization ${input.organizationId}`
-            }),
-            null
-          ];
-        }
-        return [null, withdrawal];
-      } catch (cause) {
+      const [err, raw] = await tryCatch(
+        config.data.query(api.withdrawals.queries.retrieve, {
+          withdrawalId: input.withdrawalId
+        })
+      );
+      if (err) {
+        return [fromConvexError(err), null];
+      }
+      const withdrawal = raw;
+      if (!withdrawal) {
         return [
-          fromConvexError(cause),
+          new CapxulError({
+            code: "NOT_FOUND",
+            message: `withdrawal ${input.withdrawalId} not found`
+          }),
+          null
+        ];
+      }
+      const ownerCheck = withdrawal.owner;
+      if (ownerCheck?.type !== "organization" || ownerCheck.id !== input.organizationId) {
+        return [
+          new CapxulError({
+            code: "NOT_FOUND",
+            message: `withdrawal ${input.withdrawalId} does not belong to organization ${input.organizationId}`
+          }),
           null
         ];
       }
+      return [null, withdrawal];
     },
     list: async (input) => {
       if (!config.data) {
@@ -1438,46 +1859,67 @@ function createOrgWithdrawalsClient(config = {}) {
           "organizations.withdrawals.list"
         );
       }
-      try {
-        const result = await config.data.query(
-          api.withdrawals.queries.listOrg,
-          {
-            organizationId: input.organizationId,
-            limit: input.limit,
-            cursor: input.cursor
-          }
-        );
-        return [null, result];
-      } catch (cause) {
-        return [
-          fromConvexError(cause),
-          null
-        ];
+      const [err, raw] = await tryCatch(
+        config.data.query(api.withdrawals.queries.listOrg, {
+          organizationId: input.organizationId,
+          limit: input.limit,
+          cursor: input.cursor
+        })
+      );
+      if (err) {
+        return [fromConvexError(err), null];
       }
+      return [null, raw];
     }
   };
 }
+async function handleSubmissionFailure(config, withdrawalId, error) {
+  await bestEffortMarkFailed2(config, withdrawalId, error);
+  return [error, null];
+}
 async function bestEffortMarkFailed2(config, withdrawalId, error) {
-  try {
-    await config.data.mutation(api.withdrawals.mutations.markFailed, {
+  await tryCatch(
+    config.data.mutation(api.withdrawals.mutations.markFailed, {
       withdrawalId,
       errorCode: error.code,
       errorMessage: error.message
-    });
-  } catch {
+    })
+  );
+}
+function mapCreateError2(error) {
+  switch (error.code) {
+    case "NOT_AUTHENTICATED":
+    case "PERMISSION_DENIED":
+    case "INVALID_INPUT":
+    case "INSUFFICIENT_BALANCE":
+    case "IDEMPOTENCY_CONFLICT":
+    case "KYC_REQUIRED":
+    case "POLICY_DENIED":
+    case "RATE_LIMITED":
+    case "NETWORK_ERROR":
+    case "NOT_FOUND":
+    case "VERIFICATION_REQUIRED":
+      return error;
+    default:
+      return new CapxulError({
+        code: "NETWORK_ERROR",
+        message: error.message,
+        cause: error,
+        details: error.details,
+        operationId: error.operationId,
+        correlationId: error.correlationId,
+        retryable: error.retryable
+      });
   }
 }
-function mapCreateError2(error) {
+function mapRecordCompletedError(error) {
   switch (error.code) {
     case "NOT_AUTHENTICATED":
     case "PERMISSION_DENIED":
     case "INVALID_INPUT":
-    case "INSUFFICIENT_BALANCE":
-    case "IDEMPOTENCY_CONFLICT":
-    case "KYC_REQUIRED":
-    case "POLICY_DENIED":
-    case "RATE_LIMITED":
+    case "NOT_FOUND":
     case "NETWORK_ERROR":
+    case "INTERNAL_ERROR":
       return error;
     default:
       return new CapxulError({
@@ -1513,6 +1955,136 @@ function createWebhookEventsClient() {
 }
 
 // src/core/organizations.ts
+function createOrgExternalAccountsClient(config) {
+  return {
+    create: async (input) => {
+      if (!config.data) {
+        return stub(
+          "organizations.externalAccounts.create"
+        );
+      }
+      const [err, raw] = await tryCatch(
+        config.data.mutation(api.externalAccounts.mutations.createOrg, {
+          organizationId: input.organizationId,
+          kind: input.kind,
+          label: input.label,
+          address: input.address,
+          iban: input.iban,
+          bic: input.bic,
+          accountHolder: input.accountHolder,
+          network: input.network,
+          panToken: input.panToken,
+          last4: input.last4
+        })
+      );
+      if (err) {
+        return [
+          fromConvexError(err),
+          null
+        ];
+      }
+      if (!raw) {
+        return [
+          new CapxulError({
+            code: "NOT_FOUND",
+            message: "external_account creation returned no resource"
+          }),
+          null
+        ];
+      }
+      return [
+        null,
+        brandExternalAccount(
+          raw
+        )
+      ];
+    },
+    list: async (input) => {
+      if (!config.data) {
+        return stub(
+          "organizations.externalAccounts.list"
+        );
+      }
+      const [err, result] = await tryCatch(
+        config.data.query(api.externalAccounts.queries.listOrg, {
+          organizationId: input.organizationId,
+          limit: input.limit,
+          cursor: input.cursor
+        })
+      );
+      if (err) {
+        return [fromConvexError(err), null];
+      }
+      const branded = result.data.map(
+        (row) => brandExternalAccount(
+          row
+        )
+      );
+      return [
+        null,
+        {
+          object: "list",
+          data: branded,
+          page: result.page
+        }
+      ];
+    },
+    retrieve: async (input) => {
+      if (!config.data) {
+        return stub(
+          "organizations.externalAccounts.retrieve"
+        );
+      }
+      const [err, raw] = await tryCatch(
+        config.data.query(api.externalAccounts.queries.retrieveOrg, {
+          organizationId: input.organizationId,
+          externalAccountId: input.externalAccountId
+        })
+      );
+      if (err) {
+        return [
+          fromConvexError(err),
+          null
+        ];
+      }
+      if (!raw) {
+        return [
+          new CapxulError({
+            code: "NOT_FOUND",
+            message: `external_account ${input.externalAccountId} not found`
+          }),
+          null
+        ];
+      }
+      return [
+        null,
+        brandExternalAccount(
+          raw
+        )
+      ];
+    },
+    remove: async (input) => {
+      if (!config.data) {
+        return stub(
+          "organizations.externalAccounts.remove"
+        );
+      }
+      const [err] = await tryCatch(
+        config.data.mutation(api.externalAccounts.mutations.removeOrg, {
+          organizationId: input.organizationId,
+          externalAccountId: input.externalAccountId
+        })
+      );
+      if (err) {
+        return [
+          fromConvexError(err),
+          null
+        ];
+      }
+      return [null, void 0];
+    }
+  };
+}
 function createOrganizationsClient(config = {}) {
   return {
     create: async () => stub("organizations.create"),
@@ -1568,18 +2140,7 @@ function createOrganizationsClient(config = {}) {
       retrieve: async () => stub("organizations.subAccounts.retrieve"),
       remove: async () => stub("organizations.subAccounts.remove")
     },
-    externalAccounts: {
-      create: async () => stub(
-        "organizations.externalAccounts.create"
-      ),
-      list: async () => stub(
-        "organizations.externalAccounts.list"
-      ),
-      retrieve: async () => stub(
-        "organizations.externalAccounts.retrieve"
-      ),
-      remove: async () => stub("organizations.externalAccounts.remove")
-    },
+    externalAccounts: createOrgExternalAccountsClient(config),
     balanceLedger: {
       list: async () => stub(
         "organizations.balanceLedger.list"
@@ -1716,59 +2277,6 @@ function createVirtualCardsClient() {
     cancel: async () => stub("virtualCards.cancel")
   };
 }
-
-// ../observability/src/try-catch.ts
-async function tryCatch(promise) {
-  try {
-    return [null, await promise];
-  } catch (e) {
-    return [e instanceof Error ? e : new Error(String(e)), null];
-  }
-}
-
-// ../observability/src/debug-log.ts
-function isDevelopmentBuild() {
-  if (typeof process === "undefined") {
-    return false;
-  }
-  return process.env?.NODE_ENV === "development" || process.env?.NODE_ENV === "test";
-}
-function debugLog(line) {
-  if (!isDevelopmentBuild()) return;
-  if (typeof globalThis !== "undefined" && "window" in globalThis && typeof console?.info === "function") {
-    console.info(line);
-    return;
-  }
-  if (typeof process !== "undefined" && typeof process.stderr?.write === "function") {
-    process.stderr.write(`${line}
-`);
-  }
-}
-function formatDebugValue(value) {
-  if (value === void 0 || value === "") return "";
-  if (typeof value === "string") return value;
-  try {
-    return JSON.stringify(value);
-  } catch {
-    return String(value);
-  }
-}
-function track(...args) {
-  const [name, props] = args;
-  debugLog(`[TRACK] ${name} ${formatDebugValue(props ?? "")}`);
-}
-function formatDebugValue2(value) {
-  if (value === void 0 || value === "") return "";
-  if (typeof value === "string") return value;
-  try {
-    return JSON.stringify(value);
-  } catch {
-    return String(value);
-  }
-}
-function identify(userId, traits) {
-  debugLog(`[IDENTIFY] ${userId} ${formatDebugValue2(traits ?? "")}`);
-}
 function createAuthFlowMachine(client) {
   return xstate.setup({
     types: {},
@@ -2044,122 +2552,6 @@ function emailDomain(email) {
   const domain = email.split("@")[1]?.trim().toLowerCase();
   return domain || "unknown";
 }
-
-// ../platform-kernel/src/ids.ts
-function makePrefixedIdConstructor(prefix, fieldName) {
-  const re = new RegExp(`^${prefix}_[A-Za-z0-9_\\-]+$`);
-  return (raw) => {
-    if (typeof raw !== "string" || !re.test(raw)) {
-      throw new Error(
-        `Invalid ${fieldName}: expected string matching ^${prefix}_[A-Za-z0-9_\\-]+$, got ${String(raw)}`
-      );
-    }
-    return raw;
-  };
-}
-var toAccountId = makePrefixedIdConstructor(
-  "acct",
-  "accountId"
-);
-var toOrganizationId = makePrefixedIdConstructor("org", "organizationId");
-var toMemberId = makePrefixedIdConstructor(
-  "mem",
-  "memberId"
-);
-var toSafeId = makePrefixedIdConstructor(
-  "safe",
-  "safeId"
-);
-var toTreasuryId = makePrefixedIdConstructor(
-  "try",
-  "treasuryId"
-);
-var toApiKeyId = makePrefixedIdConstructor(
-  "ak",
-  "apiKeyId"
-);
-var toOperationId = makePrefixedIdConstructor(
-  "op",
-  "operationId"
-);
-var toKycProfileId = makePrefixedIdConstructor(
-  "kyc",
-  "kycProfileId"
-);
-var toKybProfileId = makePrefixedIdConstructor(
-  "kyb",
-  "kybProfileId"
-);
-var toExternalAccountId = makePrefixedIdConstructor("ext", "externalAccountId");
-var toPaymentId = makePrefixedIdConstructor(
-  "pay",
-  "paymentId"
-);
-var toWithdrawalId = makePrefixedIdConstructor(
-  "wd",
-  "withdrawalId"
-);
-var toWebhookEndpointId = makePrefixedIdConstructor("we", "webhookEndpointId");
-var toWebhookEventId = makePrefixedIdConstructor("evt", "webhookEventId");
-var toSubAccountId = makePrefixedIdConstructor(
-  "sub",
-  "subAccountId"
-);
-var toVirtualAccountId = makePrefixedIdConstructor("va", "virtualAccountId");
-var toVirtualCardId = makePrefixedIdConstructor(
-  "vc",
-  "virtualCardId"
-);
-var toTransferId = makePrefixedIdConstructor(
-  "txfr",
-  "transferId"
-);
-var toDocumentId = makePrefixedIdConstructor(
-  "doc",
-  "documentId"
-);
-var toBalanceLedgerEntryId = makePrefixedIdConstructor("bal", "balanceLedgerEntryId");
-
-// ../platform-kernel/src/value-objects.ts
-var PHONE_NUMBER_RE = /^\+[1-9]\d{1,14}$/;
-function toPhoneNumber(raw) {
-  if (typeof raw !== "string" || !PHONE_NUMBER_RE.test(raw)) {
-    throw new Error(
-      `Invalid phoneNumber: expected E.164 string matching ^\\+[1-9]\\d{1,14}$, got ${String(raw)}`
-    );
-  }
-  return raw;
-}
-var EMAIL_RE = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
-function toEmail(raw) {
-  if (typeof raw !== "string") {
-    throw new Error(
-      `Invalid email: expected string, got ${String(raw)}`
-    );
-  }
-  const lowered = raw.trim().toLowerCase();
-  if (!EMAIL_RE.test(lowered)) {
-    throw new Error(
-      `Invalid email: expected local@domain.tld, got ${String(raw)}`
-    );
-  }
-  return lowered;
-}
-var USERNAME_RE = /^[a-z][a-z0-9_-]{2,29}$/;
-function toUsername(raw) {
-  if (typeof raw !== "string") {
-    throw new Error(
-      `Invalid username: expected string, got ${String(raw)}`
-    );
-  }
-  const lowered = raw.toLowerCase();
-  if (!USERNAME_RE.test(lowered)) {
-    throw new Error(
-      `Invalid username: expected 3-30 chars, letter-first, [a-z0-9_-], got ${String(raw)}`
-    );
-  }
-  return lowered;
-}
 function createProvisioningMachine(client) {
   return xstate.setup({
     types: {},
@@ -2552,7 +2944,7 @@ function createCapxulClient(config = {}) {
     subAccounts: createSubAccountsClient(),
     virtualAccounts: createVirtualAccountsClient(),
     virtualCards: createVirtualCardsClient(),
-    externalAccounts: createExternalAccountsClient(),
+    externalAccounts: createExternalAccountsClient(config),
     operations: createOperationsClient(config),
     webhookEndpoints: createWebhookEndpointsClient(),
     webhookEvents: createWebhookEventsClient(),