@capxul/sdk 0.1.0-alpha.8 → 0.1.0-alpha.9

package/dist/index.d.ts

@@ -1,36 +1,15 @@
-import { S as Session, C as CapxulClient, A as AccountProvisionPersonalInput } from './client-ByzDfG98.js';
-export { a as AccountsClient, b as ApiKeyCreateResult, c as ApiKeysClient, d as AuthClient, e as AuthSessionStore, B as BrowserCapxulConfig, f as CapxulAuthConfig, g as CapxulConfig, h as CapxulDataClient, i as CapxulFlowFactories, j as CapxulSigningConfig, D as DocumentsClient, E as ExternalAccountsClient, H as HttpTransport, L as LocalPrivateKeySignerProvider, M as MeClient, O as OperationsClient, k as OrgDocumentsClient, l as OrgPaymentsClient, m as OrgSafesClient, n as OrgTransfersClient, o as OrgTreasuryClient, p as OrgWithdrawalsClient, q as OrganizationsClient, P as PaymentsClient, r as SubAccountsClient, T as TokenTransfer, s as TokenTransferId, t as TokenTransfersClient, u as TokenTransfersListInput, v as TokenTransfersListPage, w as TokenTransfersRetrieveInput, x as TransfersClient, y as TransportRuntime, z as TransportState, V as VirtualAccountsClient, F as VirtualCardsClient, W as WebhookEndpointCreateResult, G as WebhookEndpointsClient, I as WebhookEventsClient, J as WithdrawalsClient, K as createCapxulClient, N as makeHttpTransport, Q as toTokenTransferId } from './client-ByzDfG98.js';
+import { S as Session, C as CapxulError$1, a as CapxulClient, A as AccountProvisionPersonalInput } from './client-ChZrdf3R.js';
+export { b as AccountsClient, c as ApiKeyCreateResult, d as ApiKeysClient, e as AuthBootstrapFlowContext, f as AuthBootstrapFlowError, g as AuthBootstrapFlowEvent, h as AuthBootstrapReason, i as AuthBootstrapToken, j as AuthClient, k as AuthSessionStore, B as BrowserCapxulConfig, l as CapxulAuthConfig, m as CapxulConfig, n as CapxulDataClient, o as CapxulFlowFactories, p as CapxulSigningConfig, q as CompleteBootstrapInput, r as CompleteBootstrapResult, D as DocumentsClient, E as ExternalAccountsClient, H as HttpTransport, L as LocalPrivateKeySignerProvider, M as MeClient, O as OperationsClient, s as OrgDocumentsClient, t as OrgPaymentsClient, u as OrgSafesClient, v as OrgTransfersClient, w as OrgTreasuryClient, x as OrgWithdrawalsClient, y as OrganizationsClient, P as PaymentsClient, z as SubAccountsClient, T as TokenTransfer, F as TokenTransferId, G as TokenTransfersClient, I as TokenTransfersListInput, J as TokenTransfersListPage, K as TokenTransfersRetrieveInput, N as TransfersClient, Q as TransportRuntime, R as TransportState, V as VerifyOtpResult, U as VirtualAccountsClient, W as VirtualCardsClient, X as WebhookEndpointCreateResult, Y as WebhookEndpointsClient, Z as WebhookEventsClient, _ as WithdrawalsClient, $ as createAuthBootstrapFlowMachine, a0 as createCapxulClient, a1 as makeHttpTransport, a2 as toTokenTransferId } from './client-ChZrdf3R.js';
 import * as xstate from 'xstate';
 import { E as Email, U as Username, O as OperationId, N as NextAction } from './next-action-DkrwXYay.js';
 export { A as AccountId, a as ApiKeyId, B as BalanceLedgerEntryId, C as CorrelationId, D as DocumentId, b as ExternalAccountId, K as KybProfileId, c as KycProfileId, M as MemberId, d as OrganizationId, P as PaymentId, e as PhoneNumber, S as SafeId, f as SubAccountId, T as TransactionIntentId, g as TransferId, h as TreasuryId, V as VirtualAccountId, i as VirtualCardId, W as WebhookEndpointId, j as WebhookEventId, k as WithdrawalId, t as toAccountId, l as toApiKeyId, m as toBalanceLedgerEntryId, n as toDocumentId, o as toEmail, p as toExternalAccountId, q as toKybProfileId, r as toKycProfileId, s as toMemberId, u as toOperationId, v as toOrganizationId, w as toPaymentId, x as toPhoneNumber, y as toSafeId, z as toSubAccountId, F as toTransferId, G as toTreasuryId, H as toUsername, I as toVirtualAccountId, J as toVirtualCardId, L as toWebhookEndpointId, Q as toWebhookEventId, R as toWithdrawalId } from './next-action-DkrwXYay.js';
-import { C as CapxulError$1, a as CapxulErrorCode$1 } from './errors-QHD5Tlok.js';
+import { C as CapxulError, a as CapxulErrorCode } from './errors-QHD5Tlok.js';
 export { b as CapxulErrorDetails, c as CapxulErrorEnvelope, d as CapxulResult } from './errors-QHD5Tlok.js';
 import { A as Account } from './types-PM4AQRLP.js';
 export { a as AccountLookupResult, b as ApiKey, c as ApiKeyEnvironment, d as ApiKeyType, B as BalanceLedgerEntry, e as BankStatementDocument, C as CreatePaymentResult, f as CreateTransferResult, g as CreateWithdrawalResult, D as Document, E as ExternalAccount, h as ExternalAccountKind, I as InvoiceDocument, K as KybProfile, i as KycProfile, j as KycUploadDocument, L as List, M as Member, k as Money, O as Operation, l as OperationStatus, m as OperationSummary, n as Organization, P as PageInfo, o as Payment, p as PaymentParty, q as PaymentStatus, r as PayrollRunDocument, s as PayrollScheduleDocument, R as ReceiptDocument, S as Safe, t as Scope, u as Settlement, v as SubAccount, w as SubAccountOwnerKind, T as TaxFormDocument, x as TimestampIso, y as Transfer, z as TransferCustody, F as TransferEndpoint, G as TransferFx, H as TransferStatus, J as Treasury, U as UserIdentifier, V as VirtualAccount, N as VirtualAccountOwnerKind, Q as VirtualCard, W as VirtualCardLimits, X as VirtualCardOwnerKind, Y as WebhookEndpoint, Z as WebhookEvent, _ as Withdrawal, $ as WithdrawalStatus } from './types-PM4AQRLP.js';
 import { Account as Account$1 } from 'viem';
 export { WebhookVerificationOptions, WebhookVerificationResult, verifyWebhook } from './webhooks.js';
 
-/**
- * Unified error type used across the entire stack: backend, SDK, and frontend.
- * One class, one set of codes, one language.
- *
- * Backend throws CapxulError → withErrorBoundary serializes to ConvexError →
- * SDK deserializes back to CapxulError → frontend routes on err.code.
- */
-type CapxulErrorCode = "NOT_AUTHENTICATED" | "EMAIL_DELIVERY_FAILED" | "API_KEY_INVALID" | "API_KEY_EXPIRED" | "PROFILE_NOT_FOUND" | "SMART_ACCOUNT_MISSING" | "PLAYER_NOT_FOUND" | "ACCOUNT_NOT_FOUND" | "PROVIDER_ERROR" | "INVALID_INPUT" | "ENV_MISSING" | "NOT_IMPLEMENTED" | "VERIFICATION_REQUIRED" | "INSUFFICIENT_BALANCE" | "INVALID_RECIPIENT" | "TRANSACTION_FAILED" | "RATE_LIMITED" | "NETWORK_ERROR" | "PERMISSION_DENIED" | "IDEMPOTENCY_CONFLICT" | "NOT_FOUND" | "OPERATION_CANCELED" | "OPERATION_TIMEOUT" | "ACTION_REQUIRED" | "KYC_REQUIRED" | "POLICY_DENIED" | "SAFE_NOT_READY" | "PROVIDER_UNAVAILABLE" | "PROVIDER_REJECTED" | "RECONCILIATION_FAILED" | "INTERNAL_ERROR" | "QUOTE_EXPIRED" | "QUOTE_NOT_FOUND" | "UNKNOWN";
-declare class CapxulError extends Error {
-    readonly code: CapxulErrorCode;
-    readonly details?: Record<string, unknown>;
-    readonly correlationId?: string;
-    readonly layer?: string;
-    constructor(code: CapxulErrorCode, message: string, options?: {
-        cause?: unknown;
-        details?: Record<string, unknown>;
-        correlationId?: string;
-        layer?: string;
-    });
-}
-
 /**
  * Auth flow errors may originate from two CapxulError surfaces:
  *  - the SDK-local generic `CapxulError<Codes>` returned by
@@ -42,7 +21,7 @@ declare class CapxulError extends Error {
  * union keeps either origin assignable to `context.error` without an
  * `as` cast at the call site.
  */
-type AuthFlowError = CapxulError$1 | CapxulError;
+type AuthFlowError = CapxulError | CapxulError$1;
 type AuthFlowContext = {
     readonly email: Email | null;
     readonly session: Session | null;
@@ -118,7 +97,7 @@ declare function createAuthFlowMachine(client: CapxulClient): xstate.StateMachin
 } | {
     type: "trackSignedOut";
     params: unknown;
-}, never, never, "error" | "idle" | "sending_otp" | "otp_requested" | "verifying" | "authenticated" | "signing_out", string, xstate.NonReducibleUnknown, xstate.NonReducibleUnknown, xstate.EventObject, xstate.MetaObject, {
+}, never, never, "idle" | "authenticated" | "error" | "sending_otp" | "otp_requested" | "verifying" | "signing_out", string, xstate.NonReducibleUnknown, xstate.NonReducibleUnknown, xstate.EventObject, xstate.MetaObject, {
     id: "auth";
     states: {
         readonly idle: {};
@@ -141,7 +120,7 @@ declare function createAuthFlowMachine(client: CapxulClient): xstate.StateMachin
  *
  * Both share `.code`, `.message`, `.details`, and extend `Error`.
  */
-type ProvisioningFlowError = CapxulError$1 | CapxulError;
+type ProvisioningFlowError = CapxulError | CapxulError$1;
 type ProvisioningFlowContext = {
     readonly input: AccountProvisionPersonalInput | null;
     readonly account: Account | null;
@@ -218,7 +197,7 @@ declare function createProvisioningMachine(client: CapxulClient): xstate.StateMa
 }, {
     type: "hasInput";
     params: unknown;
-}, never, "done" | "error" | "idle" | "starting" | "running", string, {
+}, never, "idle" | "error" | "done" | "starting" | "running", string, {
     readonly input: AccountProvisionPersonalInput;
 }, {
     readonly account: Account;
@@ -248,7 +227,7 @@ declare function createProvisioningMachine(client: CapxulClient): xstate.StateMa
  *
  * Both share `.code`, `.message`, `.details`, and extend `Error`.
  */
-type OnboardingFlowError = CapxulError$1 | CapxulError;
+type OnboardingFlowError = CapxulError | CapxulError$1;
 /** Subjects supported by the onboarding flow. */
 type OnboardingSubjectKind = "account" | "organization";
 /**
@@ -326,7 +305,7 @@ declare function createOnboardingFlowMachine(client: CapxulClient): xstate.State
     }, {
         type: "hasInput";
         params: unknown;
-    }, never, "done" | "error" | "idle" | "starting" | "running", string, {
+    }, never, "idle" | "error" | "done" | "starting" | "running", string, {
         readonly input: AccountProvisionPersonalInput;
     }, {
         readonly account: Account;
@@ -368,7 +347,7 @@ declare function createOnboardingFlowMachine(client: CapxulClient): xstate.State
     }, {
         type: "hasInput";
         params: unknown;
-    }, never, "done" | "error" | "idle" | "starting" | "running", string, {
+    }, never, "idle" | "error" | "done" | "starting" | "running", string, {
         readonly input: AccountProvisionPersonalInput;
     }, {
         readonly account: Account;
@@ -438,7 +417,7 @@ declare function createOnboardingFlowMachine(client: CapxulClient): xstate.State
 } | {
     type: "childReportedError";
     params: unknown;
-}, never, "error" | "provisioning" | "profile" | "complete" | "action_required", string, xstate.NonReducibleUnknown, xstate.NonReducibleUnknown, xstate.EventObject, xstate.MetaObject, {
+}, never, "action_required" | "provisioning" | "error" | "profile" | "complete", string, xstate.NonReducibleUnknown, xstate.NonReducibleUnknown, xstate.EventObject, xstate.MetaObject, {
     id: "onboarding";
     states: {
         readonly profile: {};
@@ -461,8 +440,8 @@ declare function createOnboardingFlowMachine(client: CapxulClient): xstate.State
  * No `default:` arm needed — the compile-time exhaustiveness check is
  * the contract.
  */
-declare function matchError<Codes extends CapxulErrorCode$1, R>(err: CapxulError$1<Codes>, handlers: {
-    [K in Codes]: (err: CapxulError$1<K>) => R;
+declare function matchError<Codes extends CapxulErrorCode, R>(err: CapxulError<Codes>, handlers: {
+    [K in Codes]: (err: CapxulError<K>) => R;
 }): R;
 /**
  * Exhaustive resource-status dispatch per CANON.md §4.44.
@@ -518,4 +497,4 @@ declare function tryCatch<T>(promise: Promise<T>): Promise<[Error, null] | [null
  */
 declare function createLocalSigner(privateKey: `0x${string}`): Account$1;
 
-export { Account, AccountProvisionPersonalInput, type AuthFlowContext, type AuthFlowError, type AuthFlowEvent, CapxulClient, CapxulError$1 as CapxulError, CapxulErrorCode$1 as CapxulErrorCode, Email, NextAction, type OnboardingFlowContext, type OnboardingFlowError, type OnboardingFlowEvent, type OnboardingProfileInput, type OnboardingSubjectKind, OperationId, type ProvisioningFlowContext, type ProvisioningFlowError, type ProvisioningFlowEvent, type ProvisioningFlowInput, type ProvisioningFlowOutput, Session, Username, createAuthFlowMachine, createLocalSigner, createOnboardingFlowMachine, createProvisioningMachine as createProvisioningFlowMachine, matchAction, matchError, matchStatus, tryCatch };
+export { Account, AccountProvisionPersonalInput, type AuthFlowContext, type AuthFlowError, type AuthFlowEvent, CapxulClient, CapxulError, CapxulErrorCode, Email, NextAction, type OnboardingFlowContext, type OnboardingFlowError, type OnboardingFlowEvent, type OnboardingProfileInput, type OnboardingSubjectKind, OperationId, type ProvisioningFlowContext, type ProvisioningFlowError, type ProvisioningFlowEvent, type ProvisioningFlowInput, type ProvisioningFlowOutput, Session, Username, createAuthFlowMachine, createLocalSigner, createOnboardingFlowMachine, createProvisioningMachine as createProvisioningFlowMachine, matchAction, matchError, matchStatus, tryCatch };

package/dist/index.js

@@ -1125,7 +1125,68 @@ function createAuthClient(config = {}) {
           ];
         }
       }
-      return [null, session];
+      if (!dataClient) {
+        return [
+          new CapxulError({
+            code: "NOT_AUTHENTICATED",
+            message: "Auth bootstrap requires an authenticated Convex data client."
+          }),
+          null
+        ];
+      }
+      try {
+        const resolution = await dataClient.mutation(
+          api.authBootstrap.resolveAfterOtp,
+          {
+            email: session.email,
+            sessionToken: session.token
+          }
+        );
+        if (resolution.kind === "existing_member") {
+          return [null, { ...resolution, session }];
+        }
+        return [null, { ...resolution, session }];
+      } catch (cause) {
+        return [fromConvexError(cause), null];
+      }
+    },
+    completeBootstrap: async (input) => {
+      const session = sessionStore.get();
+      const data = dataClient ?? config.data;
+      if (!session || !data) {
+        return [
+          new CapxulError({
+            code: "INVALID_INPUT",
+            message: "completeBootstrap requires the OTP-verified session that issued the bootstrap token."
+          }),
+          null
+        ];
+      }
+      if (input.signerProvider.kind !== "local-private-key") {
+        return [
+          new CapxulError({
+            code: "INVALID_INPUT",
+            message: "completeBootstrap currently supports local-private-key signer providers only."
+          }),
+          null
+        ];
+      }
+      try {
+        const result = await data.mutation(api.authBootstrap.completeBootstrap, {
+          bootstrapToken: input.bootstrapToken,
+          sessionToken: session.token,
+          username: input.username,
+          displayName: input.displayName,
+          countryCode: input.countryCode,
+          signerProvider: input.signerProvider
+        });
+        return [null, { kind: "authenticated", session, ...result }];
+      } catch (cause) {
+        return [
+          fromConvexError(cause),
+          null
+        ];
+      }
     },
     getSession: async () => [null, sessionStore.get()],
     signOut: async () => {
@@ -2484,7 +2545,7 @@ function createAuthFlowMachine(client) {
       }),
       verifyOtp: fromPromise(
         async ({ input, signal }) => {
-          const [error, session] = await client.auth.verifyOtp(
+          const [error, result] = await client.auth.verifyOtp(
             {
               email: input.email,
               otp: input.code
@@ -2492,7 +2553,14 @@ function createAuthFlowMachine(client) {
             { signal }
           );
           if (error) throw error;
-          return session;
+          if (result.kind === "bootstrap_required") {
+            throw new CapxulError({
+              code: "ACTION_REQUIRED",
+              message: "OTP verified but auth bootstrap is required. Use createAuthBootstrapFlowMachine for product sign-up.",
+              details: { reason: result.reason }
+            });
+          }
+          return result.session;
         }
       ),
       signOut: fromPromise(async () => {
@@ -2740,6 +2808,345 @@ function emailDomain(email) {
   const domain = email.split("@")[1]?.trim().toLowerCase();
   return domain || "unknown";
 }
+var initialContext = {
+  email: null,
+  code: null,
+  username: null,
+  signerProvider: null,
+  bootstrapToken: null,
+  bootstrapReason: null,
+  session: null,
+  account: null,
+  safe: null,
+  error: null
+};
+function createAuthBootstrapFlowMachine(client) {
+  return setup({
+    types: {},
+    actors: {
+      sendOtp: fromPromise(async ({ input, signal }) => {
+        const [error] = await client.auth.sendOtp(
+          { email: input.email },
+          { signal }
+        );
+        if (error) throw error;
+      }),
+      verifyOtp: fromPromise(
+        async ({ input, signal }) => {
+          const [error, result] = await client.auth.verifyOtp(
+            { email: input.email, otp: input.code },
+            { signal }
+          );
+          if (error) throw error;
+          return result;
+        }
+      ),
+      completeBootstrap: fromPromise(async ({ input }) => {
+        const [error, result] = await client.auth.completeBootstrap(input);
+        if (error) throw error;
+        return result;
+      }),
+      signOut: fromPromise(async () => {
+        const [error] = await client.auth.signOut();
+        if (error) throw error;
+      })
+    },
+    actions: {
+      trackOtpRequested: ({ context }) => {
+        if (!context.email) return;
+        track("auth_otp_requested", {
+          email_domain: emailDomain2(context.email)
+        });
+      },
+      trackFailed: ({ event }) => {
+        track("auth_failed", {
+          auth_type: "email_otp",
+          reason: errorFromEvent2(event).code
+        });
+      },
+      trackTimeoutFailed: () => {
+        track("auth_failed", {
+          auth_type: "email_otp",
+          reason: "timeout"
+        });
+      },
+      trackVerified: () => {
+        track("auth_verified", { auth_type: "email_otp" });
+      },
+      trackBootstrapRequired: ({ context }) => {
+        track("auth_verified", {
+          auth_type: "email_otp",
+          auth_mode: context.bootstrapReason ?? "bootstrap_required"
+        });
+      },
+      identifyAndTrack: ({ context }) => {
+        if (!context.session) return;
+        identify(context.session.authUserId, {
+          email_domain: emailDomain2(context.session.email)
+        });
+        track("auth_identified", {
+          email_domain: emailDomain2(context.session.email)
+        });
+      },
+      trackSignedOut: () => {
+        track("auth_signed_out");
+      }
+    }
+  }).createMachine({
+    id: "authBootstrap",
+    initial: "email",
+    context: initialContext,
+    states: {
+      email: {
+        on: {
+          ENTER_EMAIL: {
+            actions: assign({
+              email: ({ event }) => event.email,
+              error: () => null
+            })
+          },
+          REQUEST_OTP: { target: "sending_otp" }
+        }
+      },
+      sending_otp: {
+        invoke: {
+          src: "sendOtp",
+          input: ({ context }) => ({ email: requireEmail2(context) }),
+          onDone: { target: "otp_requested", actions: "trackOtpRequested" },
+          onError: {
+            target: "otp_requested",
+            actions: [
+              assign({ error: ({ event }) => errorFromEvent2(event) }),
+              "trackFailed"
+            ]
+          }
+        },
+        after: {
+          [FLOW_INVOKE_TIMEOUT_MS]: {
+            target: "otp_requested",
+            actions: [
+              assign({ error: () => timeoutError2("sending_otp") }),
+              "trackTimeoutFailed"
+            ]
+          }
+        }
+      },
+      otp_requested: {
+        on: {
+          ENTER_OTP: {
+            actions: assign({
+              code: ({ event }) => event.code,
+              error: () => null
+            })
+          },
+          VERIFY_OTP: { target: "verifying_otp" },
+          BACK: { target: "email" },
+          RESET: { target: "email", actions: assign(() => initialContext) }
+        }
+      },
+      verifying_otp: {
+        invoke: {
+          src: "verifyOtp",
+          input: ({ context }) => ({
+            email: requireEmail2(context),
+            code: requireCode(context)
+          }),
+          onDone: [
+            {
+              guard: ({ event }) => event.output.kind === "existing_member",
+              target: "authenticated",
+              actions: [
+                assign({
+                  session: ({ event }) => event.output.session,
+                  account: ({ event }) => event.output.kind === "existing_member" ? event.output.account : null,
+                  username: ({ event }) => event.output.kind === "existing_member" ? event.output.username : null,
+                  safe: ({ event }) => event.output.kind === "existing_member" ? event.output.safe : null,
+                  email: () => null,
+                  error: () => null
+                }),
+                "trackVerified",
+                "identifyAndTrack"
+              ]
+            },
+            {
+              target: "bootstrap_required",
+              actions: [
+                assign({
+                  session: ({ event }) => event.output.session,
+                  bootstrapToken: ({ event }) => event.output.kind === "bootstrap_required" ? event.output.bootstrapToken : null,
+                  bootstrapReason: ({ event }) => event.output.kind === "bootstrap_required" ? event.output.reason : null,
+                  username: ({ event }) => event.output.kind === "bootstrap_required" ? event.output.username ?? null : null,
+                  email: ({ event }) => event.output.kind === "bootstrap_required" ? event.output.email : null,
+                  error: () => null
+                }),
+                "trackVerified",
+                "trackBootstrapRequired"
+              ]
+            }
+          ],
+          onError: {
+            target: "otp_requested",
+            actions: [
+              assign({ error: ({ event }) => errorFromEvent2(event) }),
+              "trackFailed"
+            ]
+          }
+        },
+        after: {
+          [FLOW_INVOKE_TIMEOUT_MS]: {
+            target: "otp_requested",
+            actions: [
+              assign({ error: () => timeoutError2("verifying_otp") }),
+              "trackTimeoutFailed"
+            ]
+          }
+        }
+      },
+      bootstrap_required: {
+        on: {
+          ENTER_USERNAME: {
+            actions: assign({
+              username: ({ event }) => event.username,
+              error: () => null
+            })
+          },
+          ENTER_SIGNER_PROVIDER: {
+            actions: assign({
+              signerProvider: ({ event }) => event.signerProvider,
+              error: () => null
+            })
+          },
+          COMPLETE_BOOTSTRAP: { target: "completing_bootstrap" },
+          BACK: { target: "otp_requested" },
+          RESET: { target: "email", actions: assign(() => initialContext) }
+        }
+      },
+      completing_bootstrap: {
+        invoke: {
+          src: "completeBootstrap",
+          input: ({ context }) => ({
+            bootstrapToken: requireBootstrapToken(context),
+            username: requireUsername(context),
+            signerProvider: requireSignerProvider(context)
+          }),
+          onDone: {
+            target: "authenticated",
+            actions: [
+              assign({
+                session: ({ event }) => event.output.session,
+                account: ({ event }) => event.output.account,
+                username: ({ event }) => event.output.username,
+                safe: ({ event }) => event.output.safe,
+                bootstrapToken: () => null,
+                bootstrapReason: () => null,
+                signerProvider: () => null,
+                email: () => null,
+                error: () => null
+              }),
+              "identifyAndTrack"
+            ]
+          },
+          onError: {
+            target: "bootstrap_required",
+            actions: [
+              assign({ error: ({ event }) => errorFromEvent2(event) }),
+              "trackFailed"
+            ]
+          }
+        },
+        after: {
+          [FLOW_INVOKE_TIMEOUT_MS]: {
+            target: "bootstrap_required",
+            actions: [
+              assign({ error: () => timeoutError2("completing_bootstrap") }),
+              "trackTimeoutFailed"
+            ]
+          }
+        }
+      },
+      authenticated: {
+        on: {
+          SIGN_OUT: { target: "signing_out" }
+        }
+      },
+      signing_out: {
+        invoke: {
+          src: "signOut",
+          onDone: {
+            target: "email",
+            actions: [
+              assign(() => initialContext),
+              "trackSignedOut"
+            ]
+          },
+          onError: {
+            target: "error",
+            actions: assign({ error: ({ event }) => errorFromEvent2(event) })
+          }
+        }
+      },
+      error: {
+        on: {
+          RESET: { target: "email", actions: assign(() => initialContext) }
+        }
+      }
+    }
+  });
+}
+function requireEmail2(context) {
+  if (!context.email) {
+    throw Errors.invalidInput("email", "Auth bootstrap requires an email.");
+  }
+  return context.email;
+}
+function requireCode(context) {
+  if (!context.code) {
+    throw Errors.invalidInput("code", "Auth bootstrap requires an OTP code.");
+  }
+  return context.code;
+}
+function requireBootstrapToken(context) {
+  if (!context.bootstrapToken) {
+    throw Errors.invalidInput(
+      "bootstrapToken",
+      "Auth bootstrap requires a continuation token."
+    );
+  }
+  return context.bootstrapToken;
+}
+function requireUsername(context) {
+  if (!context.username) {
+    throw Errors.invalidInput("username", "Auth bootstrap requires a username.");
+  }
+  return context.username;
+}
+function requireSignerProvider(context) {
+  if (!context.signerProvider) {
+    throw Errors.invalidInput(
+      "signerProvider",
+      "Auth bootstrap requires a signer provider."
+    );
+  }
+  return context.signerProvider;
+}
+function errorFromEvent2(event) {
+  const cause = typeof event === "object" && event !== null && "error" in event ? event.error : event;
+  if (cause instanceof CapxulError || cause instanceof CapxulError2) {
+    return cause;
+  }
+  return Errors.providerError("auth", "bootstrap", cause);
+}
+function timeoutError2(state) {
+  return Errors.providerError(
+    "auth",
+    "bootstrap",
+    new Error(`timeout: ${state} exceeded ${FLOW_INVOKE_TIMEOUT_MS}ms`)
+  );
+}
+function emailDomain2(email) {
+  const domain = email.split("@")[1]?.trim().toLowerCase();
+  return domain || "unknown";
+}
 function createProvisioningMachine(client) {
   return setup({
     types: {},
@@ -2812,13 +3219,13 @@ function createProvisioningMachine(client) {
           },
           onError: {
             target: "error",
-            actions: assign({ error: ({ event }) => errorFromEvent2(event) })
+            actions: assign({ error: ({ event }) => errorFromEvent3(event) })
           }
         },
         after: {
           [FLOW_INVOKE_TIMEOUT_MS]: {
             target: "error",
-            actions: assign({ error: () => timeoutError2() })
+            actions: assign({ error: () => timeoutError3() })
           }
         }
       },
@@ -2836,7 +3243,7 @@ function createProvisioningMachine(client) {
      * this payload on its `onDone` transition and branches via guards
      * on `event.output.error`.
      */
-    output: ({ context }) => context.error ? { error: context.error } : context.account ? { account: context.account } : { error: timeoutError2() }
+    output: ({ context }) => context.error ? { error: context.error } : context.account ? { account: context.account } : { error: timeoutError3() }
   });
 }
 function requireProvisionInput(context) {
@@ -2848,13 +3255,13 @@ function requireProvisionInput(context) {
   }
   return context.input;
 }
-function errorFromEvent2(event) {
+function errorFromEvent3(event) {
   const cause = typeof event === "object" && event !== null && "error" in event ? event.error : event;
   if (cause instanceof CapxulError) return cause;
   if (cause instanceof CapxulError2) return cause;
   return Errors.providerError("provisioning", "flow", cause);
 }
-function timeoutError2() {
+function timeoutError3() {
   return Errors.providerError(
     "provisioning",
     "flow",
@@ -2947,7 +3354,7 @@ function createOnboardingFlowMachine(client) {
         error: ({ event }) => extractChildErrorOrFallback(event)
       }),
       assignChildThrown: assign({
-        error: ({ event }) => errorFromEvent3(event)
+        error: ({ event }) => errorFromEvent4(event)
       }),
       assignAccountFromChild: assign({
         account: ({ event }) => extractChildAccountOrNull(event)
@@ -3109,7 +3516,7 @@ function extractChildAccountOrNull(event) {
   if (output && "account" in output && output.account) return output.account;
   return null;
 }
-function errorFromEvent3(event) {
+function errorFromEvent4(event) {
   const cause = typeof event === "object" && event !== null && "error" in event ? event.error : event;
   if (cause instanceof CapxulError) return cause;
   if (cause instanceof CapxulError2) return cause;
@@ -3141,6 +3548,7 @@ function createCapxulClient(config = {}) {
   const client = clientWithoutFlows;
   client.flows = {
     auth: () => createAuthFlowMachine(client),
+    authBootstrap: () => createAuthBootstrapFlowMachine(client),
     onboarding: () => createOnboardingFlowMachine(client),
     provisioning: () => createProvisioningMachine(client)
   };
@@ -3245,4 +3653,4 @@ function isWebhookEvent(value) {
   return typeof candidate.id === "string" && typeof candidate.type === "string" && typeof candidate.createdAt === "string" && (candidate.operationId === void 0 || typeof candidate.operationId === "string") && (candidate.correlationId === void 0 || typeof candidate.correlationId === "string") && !!candidate.data && typeof candidate.data === "object" && !Array.isArray(candidate.data);
 }
 
-export { CapxulError, createAuthFlowMachine, createCapxulClient, createLocalSigner, createOnboardingFlowMachine, createProvisioningMachine as createProvisioningFlowMachine, makeHttpTransport, matchAction, matchError, matchStatus, toAccountId, toApiKeyId, toBalanceLedgerEntryId, toDocumentId, toEmail, toExternalAccountId, toKybProfileId, toKycProfileId, toMemberId, toOperationId, toOrganizationId, toPaymentId, toPhoneNumber, toSafeId, toSubAccountId, toTokenTransferId, toTransferId, toTreasuryId, toUsername, toVirtualAccountId, toVirtualCardId, toWebhookEndpointId, toWebhookEventId, toWithdrawalId, tryCatch, verifyWebhook };
+export { CapxulError, createAuthBootstrapFlowMachine, createAuthFlowMachine, createCapxulClient, createLocalSigner, createOnboardingFlowMachine, createProvisioningMachine as createProvisioningFlowMachine, makeHttpTransport, matchAction, matchError, matchStatus, toAccountId, toApiKeyId, toBalanceLedgerEntryId, toDocumentId, toEmail, toExternalAccountId, toKybProfileId, toKycProfileId, toMemberId, toOperationId, toOrganizationId, toPaymentId, toPhoneNumber, toSafeId, toSubAccountId, toTokenTransferId, toTransferId, toTreasuryId, toUsername, toVirtualAccountId, toVirtualCardId, toWebhookEndpointId, toWebhookEventId, toWithdrawalId, tryCatch, verifyWebhook };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@capxul/sdk",
-  "version": "0.1.0-alpha.8",
+  "version": "0.1.0-alpha.9",
   "description": "Headless TypeScript client for Capxul's /v1/* HTTP contract.",
   "license": "UNLICENSED",
   "private": false,
@@ -73,8 +73,8 @@
     "viem": "2.47.10",
     "vitest": "^4.1.2",
     "zod": "^4.3.6",
-    "@repo/api-contract": "0.0.0",
     "@repo/backend": "0.0.0",
+    "@repo/api-contract": "0.0.0",
     "@repo/config": "0.0.0",
     "@repo/observability": "0.0.0",
     "@repo/platform-kernel": "0.0.0",