@capxul/sdk 0.1.0-alpha.8 → 0.2.0-alpha.3

package/dist/index.cjs

@@ -1,10 +1,12 @@
 'use strict';
 
 var server = require('convex/server');
-var viem = require('viem');
 var accounts$1 = require('permissionless/accounts');
+var viem = require('viem');
 var accountAbstraction = require('viem/account-abstraction');
 var chains = require('viem/chains');
+var safeDerive = require('@repo/safe-derive');
+var browser = require('convex/browser');
 var xstate = require('xstate');
 var accounts = require('viem/accounts');
 
@@ -123,6 +125,160 @@ function identify(userId, traits) {
   debugLog(`[IDENTIFY] ${userId} ${formatDebugValue2(traits ?? "")}`);
 }
 
+// ../config/src/chain.ts
+var CAPXUL_PAYMENTS_ADDRESS = "0xe740ea65521edc9bef0ea75d30b5334711db99f4";
+var TEST_USDC_ADDRESS = "0xf09fcbb6df9f8f918e58f9c8ab15a76ade862b77";
+var CAPXUL_API_BASE_URL = "https://elated-oyster-269.convex.site";
+
+// ../config/src/timing.ts
+var FLOW_INVOKE_TIMEOUT_MS = 3e4;
+var WEBHOOK_FRESHNESS_WINDOW_MS = 5 * 60 * 1e3;
+
+// ../config/src/errors.ts
+var CapxulError2 = class extends Error {
+  code;
+  details;
+  correlationId;
+  layer;
+  constructor(code, message, options) {
+    super(message, options?.cause ? { cause: options.cause } : void 0);
+    this.code = code;
+    this.details = options?.details;
+    this.correlationId = options?.correlationId;
+    this.layer = options?.layer;
+  }
+};
+var Errors = {
+  notAuthenticated: () => new CapxulError2("NOT_AUTHENTICATED", "Not authenticated"),
+  profileNotFound: (authUserId) => new CapxulError2("PROFILE_NOT_FOUND", `Profile not found for user ${authUserId}`),
+  smartAccountMissing: (authUserId) => new CapxulError2("SMART_ACCOUNT_MISSING", `Smart account not provisioned for user ${authUserId}`),
+  envMissing: (name) => new CapxulError2("ENV_MISSING", `Environment variable ${name} not configured`),
+  openfortApi: (operation, cause) => new CapxulError2(
+    "PROVIDER_ERROR",
+    `Openfort ${operation} failed: ${cause instanceof Error ? cause.message : String(cause)}`,
+    { cause, details: { provider: "openfort", operation } }
+  ),
+  shieldApi: (status, detail) => new CapxulError2(
+    "PROVIDER_ERROR",
+    `Shield API error (${status}): ${detail}`,
+    { details: { provider: "shield", status } }
+  ),
+  providerError: (provider, operation, cause) => (
+    // Public `message` is redacted to a fixed shape so provider-side
+    // exception text never leaks to the client. The original `cause`
+    // is preserved on `Error.cause` for server-side debugging via
+    // observability sinks (Sentry, console traces).
+    new CapxulError2(
+      "PROVIDER_ERROR",
+      `Provider error: ${provider} ${operation}`,
+      { cause, details: { provider, operation } }
+    )
+  ),
+  invalidInput: (field, reason) => new CapxulError2(
+    "INVALID_INPUT",
+    `Invalid ${field}: ${reason}`,
+    { details: { field, reason } }
+  ),
+  playerNotFound: (playerId) => new CapxulError2(
+    "PLAYER_NOT_FOUND",
+    playerId ? `Openfort player ${playerId} not found` : "Openfort player not found"
+  ),
+  accountNotFound: (accountId) => new CapxulError2(
+    "ACCOUNT_NOT_FOUND",
+    accountId ? `Openfort account ${accountId} not found` : "Openfort smart account not found"
+  ),
+  invalidRecipient: (reason) => new CapxulError2("INVALID_RECIPIENT", reason),
+  permissionDenied: (reason = "Permission denied") => new CapxulError2("PERMISSION_DENIED", reason),
+  notFound: (resource, id) => new CapxulError2(
+    "NOT_FOUND",
+    id ? `${resource} ${id} not found` : `${resource} not found`
+  ),
+  idempotencyConflict: (details) => new CapxulError2(
+    "IDEMPOTENCY_CONFLICT",
+    "Idempotency key was already used for a different request",
+    { details }
+  ),
+  emailDeliveryFailed: (detail, details) => new CapxulError2("EMAIL_DELIVERY_FAILED", `Failed to send email: ${detail}`, {
+    details
+  }),
+  rateLimited: (details) => new CapxulError2("RATE_LIMITED", "Request was rate limited", {
+    details: { ...details }
+  }),
+  internalError: (reason) => new CapxulError2("INTERNAL_ERROR", `Internal error: ${reason}`),
+  /**
+   * Verification gate. Surfaced when a request hits a verification
+   * boundary the actor cannot cross under their current state. Two
+   * variants share this code:
+   *
+   * - Rail gate (Withdrawals v1 W2, #465): the resolved
+   *   `external_account.kind` routes to a withdrawal rail (e.g.
+   *   `fiat_offramp`, `card_payout`) that is not yet supported. Carries
+   *   `details.rail` + `details.currentKind`.
+   * - KYC tier gate (legacy / future): the actor's KYC tier is below
+   *   the required tier. Carries `details.requiredTier`.
+   *
+   * Code is shared because both expose the same UX shape ("you cannot
+   * proceed until verification advances"); the `details.*` keys
+   * differentiate the route.
+   */
+  verificationRequired: (details) => {
+    const message = "rail" in details ? `Withdrawal rail "${details.rail}" (kind=${details.currentKind}) is not yet supported.` : `Verification tier ${details.requiredTier} is required.`;
+    return new CapxulError2("VERIFICATION_REQUIRED", message, {
+      details: { ...details }
+    });
+  }
+};
+
+// ../config/src/safe.ts
+var SAFE_PROXY_FACTORY = "0x4e1dcf7ad4e460cfd30791ccc4f9c8a4f820ec67";
+var SAFE_L2_SINGLETON = "0x29fcb43b46531bca003ddc8fcb67ffe91900c762";
+var SAFE_MODULE_SETUP = "0x2dd68b007b46fbe91b9a7c3eda5a7a1063cb5b47";
+var SAFE_4337_MODULE = "0x75cf11467937ce3f2f357ce24ffc3dbf8fd5c226";
+
+// ../config/src/org-roles.ts
+function roleKeyFromLabel(label) {
+  const bytes = new TextEncoder().encode(label);
+  const hex = Array.from(bytes).map((b) => b.toString(16).padStart(2, "0")).join("");
+  return "0x" + hex.padEnd(64, "0");
+}
+roleKeyFromLabel("OWNER");
+roleKeyFromLabel("FINANCE_MANAGER");
+roleKeyFromLabel("PAYMENTS_OPERATOR");
+async function buildSafeAccount(signer, chain) {
+  try {
+    const publicClient = viem.createPublicClient({
+      chain: chains.baseSepolia,
+      transport: viem.http(chain.rpcUrl)
+    });
+    return await accounts$1.toSafeSmartAccount({
+      client: publicClient,
+      entryPoint: { address: accountAbstraction.entryPoint07Address, version: "0.7" },
+      version: "1.4.1",
+      owners: [signer],
+      saltNonce: computeSaltNonce(signer.address),
+      safeSingletonAddress: SAFE_L2_SINGLETON,
+      safeProxyFactoryAddress: SAFE_PROXY_FACTORY,
+      safeModuleSetupAddress: SAFE_MODULE_SETUP,
+      safe4337ModuleAddress: SAFE_4337_MODULE,
+      safeModules: [],
+      setupTransactions: []
+    });
+  } catch (cause) {
+    throw new CapxulError({
+      code: "NETWORK_ERROR",
+      message: cause instanceof Error ? cause.message : String(cause),
+      cause,
+      details: { chainId: chain.chainId }
+    });
+  }
+}
+function computeSaltNonce(ownerAddress) {
+  return BigInt(`0x${ownerAddress.toLowerCase().slice(2).padEnd(64, "0")}`);
+}
+function deriveSafeAddress(signerAddress) {
+  return safeDerive.deriveSafeAddress(signerAddress, safeDerive.defaultSafeDeriveConfig);
+}
+
 // ../platform-kernel/src/ids.ts
 function makePrefixedIdConstructor(prefix, fieldName) {
   const re = new RegExp(`^${prefix}_[A-Za-z0-9_\\-]+$`);
@@ -141,7 +297,7 @@ var toAccountId = makePrefixedIdConstructor(
 );
 var toOrganizationId = makePrefixedIdConstructor("org", "organizationId");
 var toMemberId = makePrefixedIdConstructor(
-  "mem",
+  "mb",
   "memberId"
 );
 var toSafeId = makePrefixedIdConstructor(
@@ -255,13 +411,13 @@ function brandExternalAccount(raw) {
 function createExternalAccountsClient(config = {}) {
   return {
     retrieve: async (externalAccountId) => {
-      if (!config.data) {
+      if (!config._data) {
         return stub(
           "externalAccounts.retrieve"
         );
       }
       const [err, raw] = await tryCatch(
-        config.data.query(api.externalAccounts.queries.retrievePersonal, {
+        config._data.query(api.externalAccounts.queries.retrievePersonal, {
           externalAccountId
         })
       );
@@ -283,11 +439,11 @@ function createExternalAccountsClient(config = {}) {
       return [null, brandExternalAccount(raw)];
     },
     remove: async (externalAccountId) => {
-      if (!config.data) {
+      if (!config._data) {
         return stub("externalAccounts.remove");
       }
       const [err] = await tryCatch(
-        config.data.mutation(api.externalAccounts.mutations.removePersonal, {
+        config._data.mutation(api.externalAccounts.mutations.removePersonal, {
           externalAccountId
         })
       );
@@ -302,17 +458,203 @@ function createExternalAccountsClient(config = {}) {
   };
 }
 
+// src/core/sub-accounts.ts
+function malformedWireError(reason, raw) {
+  return new CapxulError({
+    code: "PROVIDER_ERROR",
+    message: `convex brandSubAccount failed: ${reason}`,
+    details: {
+      provider: "convex",
+      operation: "brandSubAccount",
+      reason,
+      // PII discipline (`.claude/rules/posthog.md`): user-authored
+      // strings on the wire (`name`, `purpose`) are customer-confidential
+      // — sub-account names like "Q3 Acquisition Reserve" or
+      // "Vendor ABC payments" must not flow into telemetry. We emit a
+      // structural keys-only sample via a strict ALLOWLIST so any future
+      // wire-shape addition (e.g. `recipientEmail`, `tags`) is dropped
+      // by construction rather than leaked through a denylist gap.
+      sample: safeSampleShape(raw)
+    }
+  });
+}
+function safeSampleShape(raw) {
+  if (raw === null || typeof raw !== "object") {
+    return { type: typeof raw };
+  }
+  const r = raw;
+  const balance = r.balance;
+  return {
+    object: typeof r.object === "string" ? r.object : typeof r.object,
+    idPresent: typeof r.id === "string" && r.id.length > 0,
+    // First 4 chars only — enough to distinguish "sub_" prefixed IDs
+    // from accidental other resource IDs without leaking the full ID.
+    idPrefix: typeof r.id === "string" ? r.id.slice(0, 4) : void 0,
+    parentKind: r.parent !== null && typeof r.parent === "object" ? r.parent.kind : typeof r.parent,
+    status: r.status,
+    hasName: typeof r.name === "string",
+    hasPurpose: r.purpose !== void 0,
+    balanceShape: balance !== null && typeof balance === "object" ? Object.keys(balance).sort() : typeof balance,
+    createdAtType: typeof r.createdAt,
+    updatedAtType: typeof r.updatedAt
+  };
+}
+function isMoneyShape(v) {
+  if (typeof v !== "object" || v === null) return false;
+  const m = v;
+  return typeof m.value === "string" && typeof m.currency === "string";
+}
+function isParentShape(v) {
+  if (typeof v !== "object" || v === null) return false;
+  const p = v;
+  return (p.kind === "account" || p.kind === "organization") && typeof p.id === "string";
+}
+function isFiniteNonNegativeInteger(v) {
+  return typeof v === "number" && Number.isFinite(v) && Number.isInteger(v) && v >= 0;
+}
+function validateWireSubAccount(raw) {
+  if (typeof raw !== "object" || raw === null) {
+    return { ok: false, reason: "not an object" };
+  }
+  const r = raw;
+  if (r.object !== "sub_account") {
+    return { ok: false, reason: `object must be "sub_account" (got ${String(r.object)})` };
+  }
+  if (typeof r.id !== "string" || r.id.length === 0) {
+    return { ok: false, reason: "id must be a non-empty string" };
+  }
+  if (!isParentShape(r.parent)) {
+    return { ok: false, reason: "parent must be { kind: 'account' | 'organization', id: string }" };
+  }
+  if (typeof r.name !== "string") {
+    return { ok: false, reason: "name must be a string" };
+  }
+  if (r.purpose !== void 0 && typeof r.purpose !== "string") {
+    return { ok: false, reason: "purpose must be a string when present" };
+  }
+  if (r.status !== "active" && r.status !== "archived") {
+    return { ok: false, reason: `status must be "active" | "archived" (got ${String(r.status)})` };
+  }
+  if (!isMoneyShape(r.balance)) {
+    return { ok: false, reason: "balance must be { value: string, currency: string }" };
+  }
+  if (!isFiniteNonNegativeInteger(r.createdAt)) {
+    return { ok: false, reason: "createdAt must be a finite non-negative integer (epoch ms)" };
+  }
+  if (r.updatedAt !== void 0 && !isFiniteNonNegativeInteger(r.updatedAt)) {
+    return { ok: false, reason: "updatedAt must be a finite non-negative integer when present" };
+  }
+  return { ok: true, value: r };
+}
+function brandSubAccount(raw) {
+  const result = validateWireSubAccount(raw);
+  if (!result.ok) {
+    throw malformedWireError(result.reason, raw);
+  }
+  const wire = result.value;
+  return {
+    object: wire.object,
+    id: toSubAccountId(wire.id),
+    parent: wire.parent,
+    name: wire.name,
+    ...wire.purpose !== void 0 ? { purpose: wire.purpose } : {},
+    status: wire.status,
+    balance: wire.balance,
+    createdAt: new Date(wire.createdAt).toISOString()
+  };
+}
+function tryBrandSubAccount(raw) {
+  try {
+    return [null, brandSubAccount(raw)];
+  } catch (err) {
+    if (err instanceof CapxulError && err.code === "PROVIDER_ERROR") {
+      return [err, null];
+    }
+    return [
+      malformedWireError(
+        err instanceof Error ? err.message : String(err),
+        raw
+      ),
+      null
+    ];
+  }
+}
+function createSubAccountsClient(config = {}) {
+  return {
+    retrieve: async (subAccountId) => {
+      if (!config._data) {
+        return stub("subAccounts.retrieve");
+      }
+      const [err, raw] = await tryCatch(
+        config._data.query(api.subAccounts.queries.retrieve, {
+          subAccountId
+        })
+      );
+      if (err) {
+        return [
+          fromConvexError(err),
+          null
+        ];
+      }
+      if (!raw) {
+        return [
+          new CapxulError({
+            code: "NOT_FOUND",
+            message: `sub_account ${subAccountId} not found`
+          }),
+          null
+        ];
+      }
+      const [brandErr, branded] = tryBrandSubAccount(raw);
+      if (brandErr) {
+        return [brandErr, null];
+      }
+      return [null, branded];
+    },
+    remove: async (subAccountId) => {
+      if (!config._data) {
+        return stub("subAccounts.remove");
+      }
+      const [err, raw] = await tryCatch(
+        config._data.mutation(api.subAccounts.mutations.archive, {
+          subAccountId
+        })
+      );
+      if (err) {
+        return [
+          fromConvexError(err),
+          null
+        ];
+      }
+      if (!raw) {
+        return [
+          new CapxulError({
+            code: "NOT_FOUND",
+            message: `sub_account ${subAccountId} not found`
+          }),
+          null
+        ];
+      }
+      const [brandErr, branded] = tryBrandSubAccount(raw);
+      if (brandErr) {
+        return [brandErr, null];
+      }
+      return [null, branded];
+    }
+  };
+}
+
 // src/core/accounts.ts
 function createAccountExternalAccountsClient(config) {
   return {
     create: async (input) => {
-      if (!config.data) {
+      if (!config._data) {
         return stub(
           "accounts.externalAccounts.create"
         );
       }
       const [err, raw] = await tryCatch(
-        config.data.mutation(
+        config._data.mutation(
           api.externalAccounts.mutations.createPersonal,
           {
             kind: input.kind,
@@ -350,13 +692,13 @@ function createAccountExternalAccountsClient(config) {
       ];
     },
     list: async (input) => {
-      if (!config.data) {
+      if (!config._data) {
         return stub(
           "accounts.externalAccounts.list"
         );
       }
       const [err, result] = await tryCatch(
-        config.data.query(api.externalAccounts.queries.listPersonal, {
+        config._data.query(api.externalAccounts.queries.listPersonal, {
           limit: input.limit,
           cursor: input.cursor
         })
@@ -379,13 +721,13 @@ function createAccountExternalAccountsClient(config) {
       ];
     },
     retrieve: async (externalAccountId) => {
-      if (!config.data) {
+      if (!config._data) {
         return stub(
           "accounts.externalAccounts.retrieve"
         );
       }
       const [err, raw] = await tryCatch(
-        config.data.query(api.externalAccounts.queries.retrievePersonal, {
+        config._data.query(api.externalAccounts.queries.retrievePersonal, {
           externalAccountId
         })
       );
@@ -412,11 +754,11 @@ function createAccountExternalAccountsClient(config) {
       ];
     },
     remove: async (externalAccountId) => {
-      if (!config.data) {
+      if (!config._data) {
         return stub("accounts.externalAccounts.remove");
       }
       const [err] = await tryCatch(
-        config.data.mutation(api.externalAccounts.mutations.removePersonal, {
+        config._data.mutation(api.externalAccounts.mutations.removePersonal, {
           externalAccountId
         })
       );
@@ -430,43 +772,191 @@ function createAccountExternalAccountsClient(config) {
     }
   };
 }
-function createAccountsClient(config = {}) {
+function createAccountSubAccountsClient(config) {
   return {
-    retrieve: async (accountId) => {
-      if (!config.data) {
-        return stub("accounts.retrieve");
-      }
-      try {
-        const account = await config.data.query(
-          api.openfort.queries.getMyAccount,
-          {}
+    create: async (input) => {
+      if (!config._data) {
+        return stub(
+          "accounts.subAccounts.create"
         );
-        if (account.id !== accountId) {
-          return [
-            new CapxulError({
-              code: "PERMISSION_DENIED",
-              message: "accounts.retrieve currently supports the authenticated caller's own account only.",
-              details: {
-                requestedAccountId: accountId,
-                authenticatedAccountId: account.id
-              }
-            }),
-            null
-          ];
-        }
-        return [null, account];
-      } catch (cause) {
-        return [fromConvexError(cause), null];
       }
-    },
-    lookup: async () => stub("accounts.lookup"),
-    update: async (input) => {
-      if (!config.data) {
-        return stub("accounts.update");
-      }
-      if (input.countryCode !== void 0) {
-        return [
-          new CapxulError({
+      const [err, raw] = await tryCatch(
+        config._data.mutation(api.subAccounts.mutations.create, {
+          parent: { kind: "account", id: input.accountId },
+          name: input.name,
+          purpose: input.purpose
+        })
+      );
+      if (err) {
+        return [
+          fromConvexError(err),
+          null
+        ];
+      }
+      if (!raw) {
+        return [
+          new CapxulError({
+            code: "NOT_FOUND",
+            message: "sub_account creation returned no resource"
+          }),
+          null
+        ];
+      }
+      const [brandErr, branded] = tryBrandSubAccount(raw);
+      if (brandErr) {
+        return [
+          brandErr,
+          null
+        ];
+      }
+      return [null, branded];
+    },
+    list: async (input) => {
+      if (!config._data) {
+        return stub(
+          "accounts.subAccounts.list"
+        );
+      }
+      const [err, rows] = await tryCatch(
+        config._data.query(api.subAccounts.queries.listByAccount, {
+          accountId: input.accountId
+        })
+      );
+      if (err) {
+        return [
+          fromConvexError(err),
+          null
+        ];
+      }
+      const branded = [];
+      for (const row of rows) {
+        const [brandErr, value] = tryBrandSubAccount(row);
+        if (brandErr) {
+          return [
+            brandErr,
+            null
+          ];
+        }
+        branded.push(value);
+      }
+      return [
+        null,
+        {
+          object: "list",
+          data: branded,
+          page: { hasMore: false }
+        }
+      ];
+    },
+    retrieve: async (subAccountId) => {
+      if (!config._data) {
+        return stub(
+          "accounts.subAccounts.retrieve"
+        );
+      }
+      const [err, raw] = await tryCatch(
+        config._data.query(api.subAccounts.queries.retrieve, {
+          subAccountId
+        })
+      );
+      if (err) {
+        return [
+          fromConvexError(err),
+          null
+        ];
+      }
+      if (!raw) {
+        return [
+          new CapxulError({
+            code: "NOT_FOUND",
+            message: `sub_account ${subAccountId} not found`
+          }),
+          null
+        ];
+      }
+      const [brandErr, branded] = tryBrandSubAccount(raw);
+      if (brandErr) {
+        return [
+          brandErr,
+          null
+        ];
+      }
+      return [null, branded];
+    },
+    remove: async (subAccountId) => {
+      if (!config._data) {
+        return stub(
+          "accounts.subAccounts.remove"
+        );
+      }
+      const [err, raw] = await tryCatch(
+        config._data.mutation(api.subAccounts.mutations.archive, {
+          subAccountId
+        })
+      );
+      if (err) {
+        return [
+          fromConvexError(err),
+          null
+        ];
+      }
+      if (!raw) {
+        return [
+          new CapxulError({
+            code: "NOT_FOUND",
+            message: `sub_account ${subAccountId} not found`
+          }),
+          null
+        ];
+      }
+      const [brandErr, branded] = tryBrandSubAccount(raw);
+      if (brandErr) {
+        return [
+          brandErr,
+          null
+        ];
+      }
+      return [null, branded];
+    }
+  };
+}
+function createAccountsClient(config = {}) {
+  return {
+    retrieve: async (accountId) => {
+      if (!config._data) {
+        return stub("accounts.retrieve");
+      }
+      try {
+        const account = await config._data.query(
+          api.openfort.queries.getMyAccount,
+          {}
+        );
+        if (account.id !== accountId) {
+          return [
+            new CapxulError({
+              code: "PERMISSION_DENIED",
+              message: "accounts.retrieve currently supports the authenticated caller's own account only.",
+              details: {
+                requestedAccountId: accountId,
+                authenticatedAccountId: account.id
+              }
+            }),
+            null
+          ];
+        }
+        return [null, account];
+      } catch (cause) {
+        return [fromConvexError(cause), null];
+      }
+    },
+    lookup: async () => stub("accounts.lookup"),
+    update: async (input) => {
+      if (!config._data) {
+        return stub("accounts.update");
+      }
+      if (input.countryCode !== void 0) {
+        return [
+          new CapxulError({
             code: "INVALID_INPUT",
             message: "accounts.update does not support countryCode yet \u2014 backend mutation only patches displayName and username.",
             details: { field: "countryCode" }
@@ -475,7 +965,7 @@ function createAccountsClient(config = {}) {
         ];
       }
       try {
-        const current = await config.data.query(
+        const current = await config._data.query(
           api.openfort.queries.getMyAccount,
           {}
         );
@@ -492,11 +982,11 @@ function createAccountsClient(config = {}) {
             null
           ];
         }
-        await config.data.mutation(api.openfort.mutations.updateProfile, {
+        await config._data.mutation(api.openfort.mutations.updateProfile, {
           displayName: input.name,
           username: input.username
         });
-        const updated = await config.data.query(
+        const updated = await config._data.query(
           api.openfort.queries.getMyAccount,
           {}
         );
@@ -506,7 +996,7 @@ function createAccountsClient(config = {}) {
       }
     },
     provisionPersonal: async (input) => {
-      if (!config.data) {
+      if (!config._data) {
         return stub(
           "accounts.provisionPersonal"
         );
@@ -521,17 +1011,17 @@ function createAccountsClient(config = {}) {
         ];
       }
       try {
-        await config.data.mutation(
+        await config._data.mutation(
           api.safe.mutations.provisionLocalPersonalAccount,
           {
             displayName: input.displayName,
             username: input.username,
             countryCode: input.countryCode,
             eoaAddress: input.signerProvider.signerAddress,
-            safeAddress: input.signerProvider.safeAddress
+            safeAddress: deriveSafeAddress(input.signerProvider.signerAddress)
           }
         );
-        const account = await config.data.query(
+        const account = await config._data.query(
           api.openfort.queries.getMyAccount,
           {}
         );
@@ -554,11 +1044,11 @@ function createAccountsClient(config = {}) {
     },
     safes: {
       retrieve: async (safeId) => {
-        if (!config.data) {
+        if (!config._data) {
           return stub("accounts.safes.retrieve");
         }
         try {
-          const safe = await config.data.query(
+          const safe = await config._data.query(
             api.safe.queries.retrieveAccountSafe,
             { safeId }
           );
@@ -585,19 +1075,50 @@ function createAccountsClient(config = {}) {
       retrieve: async () => stub("accounts.kycProfiles.retrieve")
     },
     externalAccounts: createAccountExternalAccountsClient(config),
-    subAccounts: {
-      create: async () => stub("accounts.subAccounts.create"),
-      list: async () => stub("accounts.subAccounts.list"),
-      retrieve: async () => stub("accounts.subAccounts.retrieve"),
-      remove: async () => stub("accounts.subAccounts.remove")
-    },
+    subAccounts: createAccountSubAccountsClient(config),
     balanceLedger: {
-      list: async () => stub(
-        "accounts.balanceLedger.list"
-      ),
-      retrieve: async () => stub(
-        "accounts.balanceLedger.retrieve"
-      )
+      list: async (input) => {
+        if (!config._data) {
+          return stub(
+            "accounts.balanceLedger.list"
+          );
+        }
+        try {
+          const accountId = input.accountId.replace(/^acct_/, "");
+          const page = await config._data.query(
+            api.balanceLedger.queries.listForAccount,
+            { accountId, limit: input.limit, cursor: input.cursor }
+          );
+          return [null, page];
+        } catch (cause) {
+          return [fromConvexError(cause), null];
+        }
+      },
+      retrieve: async (entryId) => {
+        if (!config._data) {
+          return stub(
+            "accounts.balanceLedger.retrieve"
+          );
+        }
+        try {
+          const entry = await config._data.query(
+            api.balanceLedger.queries.retrieve,
+            { entryId }
+          );
+          if (!entry) {
+            return [
+              new CapxulError({
+                code: "NOT_FOUND",
+                message: `balance_ledger_entry ${entryId} not found`
+              }),
+              null
+            ];
+          }
+          return [null, entry];
+        } catch (cause) {
+          return [fromConvexError(cause), null];
+        }
+      }
     }
   };
 }
@@ -611,130 +1132,21 @@ function createApiKeysClient() {
     revoke: async () => stub("apiKeys.revoke")
   };
 }
+function createDefaultDataClient(convexUrl, jwt) {
+  const client = new browser.ConvexHttpClient(convexUrl);
+  client.setAuth(jwt);
+  return client;
+}
 
-// ../config/src/chain.ts
-var CAPXUL_PAYMENTS_ADDRESS = "0xe740ea65521edc9bef0ea75d30b5334711db99f4";
-var TEST_USDC_ADDRESS = "0xf09fcbb6df9f8f918e58f9c8ab15a76ade862b77";
-var CAPXUL_API_BASE_URL = "https://elated-oyster-269.convex.site";
-
-// ../config/src/timing.ts
-var FLOW_INVOKE_TIMEOUT_MS = 3e4;
-var WEBHOOK_FRESHNESS_WINDOW_MS = 5 * 60 * 1e3;
-
-// ../config/src/errors.ts
-var CapxulError2 = class extends Error {
-  code;
-  details;
-  correlationId;
-  layer;
-  constructor(code, message, options) {
-    super(message, options?.cause ? { cause: options.cause } : void 0);
-    this.code = code;
-    this.details = options?.details;
-    this.correlationId = options?.correlationId;
-    this.layer = options?.layer;
-  }
-};
-var Errors = {
-  notAuthenticated: () => new CapxulError2("NOT_AUTHENTICATED", "Not authenticated"),
-  profileNotFound: (authUserId) => new CapxulError2("PROFILE_NOT_FOUND", `Profile not found for user ${authUserId}`),
-  smartAccountMissing: (authUserId) => new CapxulError2("SMART_ACCOUNT_MISSING", `Smart account not provisioned for user ${authUserId}`),
-  envMissing: (name) => new CapxulError2("ENV_MISSING", `Environment variable ${name} not configured`),
-  openfortApi: (operation, cause) => new CapxulError2(
-    "PROVIDER_ERROR",
-    `Openfort ${operation} failed: ${cause instanceof Error ? cause.message : String(cause)}`,
-    { cause, details: { provider: "openfort", operation } }
-  ),
-  shieldApi: (status, detail) => new CapxulError2(
-    "PROVIDER_ERROR",
-    `Shield API error (${status}): ${detail}`,
-    { details: { provider: "shield", status } }
-  ),
-  providerError: (provider, operation, cause) => new CapxulError2(
-    "PROVIDER_ERROR",
-    `${provider} ${operation} failed: ${cause instanceof Error ? cause.message : String(cause)}`,
-    { cause, details: { provider, operation } }
-  ),
-  invalidInput: (field, reason) => new CapxulError2(
-    "INVALID_INPUT",
-    `Invalid ${field}: ${reason}`,
-    { details: { field, reason } }
-  ),
-  playerNotFound: (playerId) => new CapxulError2(
-    "PLAYER_NOT_FOUND",
-    playerId ? `Openfort player ${playerId} not found` : "Openfort player not found"
-  ),
-  accountNotFound: (accountId) => new CapxulError2(
-    "ACCOUNT_NOT_FOUND",
-    accountId ? `Openfort account ${accountId} not found` : "Openfort smart account not found"
-  ),
-  invalidRecipient: (reason) => new CapxulError2("INVALID_RECIPIENT", reason),
-  permissionDenied: (reason = "Permission denied") => new CapxulError2("PERMISSION_DENIED", reason),
-  notFound: (resource, id) => new CapxulError2(
-    "NOT_FOUND",
-    id ? `${resource} ${id} not found` : `${resource} not found`
-  ),
-  idempotencyConflict: (details) => new CapxulError2(
-    "IDEMPOTENCY_CONFLICT",
-    "Idempotency key was already used for a different request",
-    { details }
-  ),
-  emailDeliveryFailed: (detail, details) => new CapxulError2("EMAIL_DELIVERY_FAILED", `Failed to send email: ${detail}`, {
-    details
-  }),
-  rateLimited: (details) => new CapxulError2("RATE_LIMITED", "Request was rate limited", {
-    details: { ...details }
-  }),
-  internalError: (reason) => new CapxulError2("INTERNAL_ERROR", `Internal error: ${reason}`),
-  /**
-   * Verification gate. Surfaced when a request hits a verification
-   * boundary the actor cannot cross under their current state. Two
-   * variants share this code:
-   *
-   * - Rail gate (Withdrawals v1 W2, #465): the resolved
-   *   `external_account.kind` routes to a withdrawal rail (e.g.
-   *   `fiat_offramp`, `card_payout`) that is not yet supported. Carries
-   *   `details.rail` + `details.currentKind`.
-   * - KYC tier gate (legacy / future): the actor's KYC tier is below
-   *   the required tier. Carries `details.requiredTier`.
-   *
-   * Code is shared because both expose the same UX shape ("you cannot
-   * proceed until verification advances"); the `details.*` keys
-   * differentiate the route.
-   */
-  verificationRequired: (details) => {
-    const message = "rail" in details ? `Withdrawal rail "${details.rail}" (kind=${details.currentKind}) is not yet supported.` : `Verification tier ${details.requiredTier} is required.`;
-    return new CapxulError2("VERIFICATION_REQUIRED", message, {
-      details: { ...details }
-    });
-  }
-};
-
-// ../config/src/safe.ts
-var SAFE_PROXY_FACTORY = "0x4e1dcf7ad4e460cfd30791ccc4f9c8a4f820ec67";
-var SAFE_L2_SINGLETON = "0x29fcb43b46531bca003ddc8fcb67ffe91900c762";
-var SAFE_MODULE_SETUP = "0x2dd68b007b46fbe91b9a7c3eda5a7a1063cb5b47";
-var SAFE_4337_MODULE = "0x75cf11467937ce3f2f357ce24ffc3dbf8fd5c226";
-
-// ../config/src/org-roles.ts
-function roleKeyFromLabel(label) {
-  const bytes = new TextEncoder().encode(label);
-  const hex = Array.from(bytes).map((b) => b.toString(16).padStart(2, "0")).join("");
-  return "0x" + hex.padEnd(64, "0");
-}
-roleKeyFromLabel("OWNER");
-roleKeyFromLabel("FINANCE_MANAGER");
-roleKeyFromLabel("TEAM_LEAD");
-
-// src/transport.ts
-function makeHttpTransport(config) {
-  switch (config.mode) {
-    case "build-time-urls":
-      return makeBuildTimeUrlsTransport(config);
-    case "publishable-key":
-      return makePublishableKeyTransport(config);
-    default:
-      return assertNever(config);
+// src/transport.ts
+function makeHttpTransport(config) {
+  switch (config.mode) {
+    case "build-time-urls":
+      return makeBuildTimeUrlsTransport(config);
+    case "publishable-key":
+      return makePublishableKeyTransport(config);
+    default:
+      return assertNever(config);
   }
 }
 function createLifecycle(initial) {
@@ -1055,7 +1467,7 @@ function readNonEmptyString(value) {
 
 // src/core/auth.ts
 function createAuthClient(config = {}) {
-  let dataClient = config.data ?? null;
+  let dataClient = config._data ?? null;
   const sessionStore = config.auth?.sessionStore ?? createMemorySessionStore();
   const getTransport = createTransportProvider(config);
   return {
@@ -1111,11 +1523,20 @@ function createAuthClient(config = {}) {
         ).toISOString()
       };
       sessionStore.set(session);
-      if (config.auth?.createDataClient) {
+      if (!dataClient) {
         try {
-          dataClient = await config.auth.createDataClient(session);
-          mutableConfig(config).data = dataClient;
-          transport.markAuthenticated({ dataClient });
+          const convexUrl = transport.convexUrl;
+          if (!convexUrl || !session.convexJwt) {
+            return [
+              new CapxulError({
+                code: "NETWORK_ERROR",
+                message: "Cannot create data client: missing convex URL or JWT."
+              }),
+              null
+            ];
+          }
+          dataClient = createDefaultDataClient(convexUrl, session.convexJwt);
+          mutableConfig(config)._data = dataClient;
         } catch (cause) {
           return [
             new CapxulError({
@@ -1126,14 +1547,89 @@ function createAuthClient(config = {}) {
             null
           ];
         }
+      } else {
+        const injected = dataClient;
+        if (typeof injected.refreshAuth === "function") {
+          injected.refreshAuth();
+        } else if (typeof injected.setAuth === "function" && session.convexJwt) {
+          injected.setAuth(session.convexJwt);
+        }
+      }
+      transport.markAuthenticated({ dataClient });
+      if (!dataClient) {
+        return [
+          new CapxulError({
+            code: "NOT_AUTHENTICATED",
+            message: "Auth bootstrap requires an authenticated Convex data client."
+          }),
+          null
+        ];
+      }
+      try {
+        const resolution = await dataClient.mutation(
+          api.authBootstrap.resolveAfterOtp,
+          {
+            email: session.email,
+            sessionToken: session.token
+          }
+        );
+        if (resolution.kind === "existing_member") {
+          return [null, { ...resolution, session }];
+        }
+        return [null, { ...resolution, session }];
+      } catch (cause) {
+        return [fromConvexError(cause), null];
+      }
+    },
+    completeBootstrap: async (input) => {
+      const session = sessionStore.get();
+      const data = dataClient ?? config._data;
+      if (!session || !data) {
+        return [
+          new CapxulError({
+            code: "INVALID_INPUT",
+            message: "completeBootstrap requires the OTP-verified session that issued the bootstrap token."
+          }),
+          null
+        ];
+      }
+      const signerAddress = config.signer?.address;
+      if (!signerAddress) {
+        return [
+          new CapxulError({
+            code: "INVALID_INPUT",
+            message: "completeBootstrap requires a signer to be configured on the client."
+          }),
+          null
+        ];
+      }
+      try {
+        const safeAddress = deriveSafeAddress(signerAddress);
+        const result = await data.mutation(api.authBootstrap.completeBootstrap, {
+          bootstrapToken: input.bootstrapToken,
+          sessionToken: session.token,
+          username: input.username,
+          displayName: input.displayName,
+          countryCode: input.countryCode,
+          signerProvider: {
+            kind: "local-private-key",
+            signerAddress,
+            safeAddress
+          }
+        });
+        return [null, { kind: "authenticated", session, ...result }];
+      } catch (cause) {
+        return [
+          fromConvexError(cause),
+          null
+        ];
       }
-      return [null, session];
     },
     getSession: async () => [null, sessionStore.get()],
     signOut: async () => {
       sessionStore.clear();
       dataClient = null;
-      mutableConfig(config).data = void 0;
+      mutableConfig(config)._data = void 0;
       const transport = getTransport();
       transport?.clearAuth();
       return [null, void 0];
@@ -1204,6 +1700,9 @@ async function postBetterAuth(transport, path, body, code, signal) {
     }
     return [null, text ? JSON.parse(text) : void 0];
   } catch (cause) {
+    if (cause instanceof CapxulError) {
+      return [cause, null];
+    }
     return [
       new CapxulError({
         code: "NETWORK_ERROR",
@@ -1242,7 +1741,7 @@ function parseBetterAuthError(text) {
   }
 }
 function isCapxulErrorCode2(code) {
-  return code === "NOT_AUTHENTICATED" || code === "EMAIL_DELIVERY_FAILED" || code === "INVALID_INPUT" || code === "RATE_LIMITED" || code === "NETWORK_ERROR" || code === "API_KEY_INVALID" || code === "API_KEY_EXPIRED";
+  return code === "NOT_AUTHENTICATED" || code === "EMAIL_DELIVERY_FAILED" || code === "INVALID_INPUT" || code === "RATE_LIMITED" || code === "NETWORK_ERROR" || code === "API_KEY_INVALID" || code === "API_KEY_EXPIRED" || code === "INTERNAL_ERROR" || code === "ENV_MISSING" || code === "UNKNOWN" || code === "PROVIDER_ERROR";
 }
 async function exchangeConvexToken(transport, config, token, signal) {
   const path = config.auth?.convexTokenUrl ?? "/convex/token";
@@ -1272,6 +1771,9 @@ async function exchangeConvexToken(transport, config, token, signal) {
     }
     return [null, body.token];
   } catch (cause) {
+    if (cause instanceof CapxulError) {
+      return [cause, null];
+    }
     return [
       new CapxulError({
         code: "NETWORK_ERROR",
@@ -1308,11 +1810,11 @@ function createOrgDocumentsClient() {
 function createMeClient(config = {}) {
   return {
     get: async () => {
-      if (!config.data) {
+      if (!config._data) {
         return stub("me.get");
       }
       try {
-        const account = await config.data.query(
+        const account = await config._data.query(
           api.openfort.queries.getMyAccount,
           {}
         );
@@ -1322,7 +1824,7 @@ function createMeClient(config = {}) {
       }
     },
     update: async (input) => {
-      if (!config.data) {
+      if (!config._data) {
         return stub("me.update");
       }
       if (input.countryCode !== void 0) {
@@ -1336,11 +1838,11 @@ function createMeClient(config = {}) {
         ];
       }
       try {
-        await config.data.mutation(api.openfort.mutations.updateProfile, {
+        await config._data.mutation(api.openfort.mutations.updateProfile, {
           displayName: input.name,
           username: input.username
         });
-        const account = await config.data.query(
+        const account = await config._data.query(
           api.openfort.queries.getMyAccount,
           {}
         );
@@ -1355,11 +1857,11 @@ function createMeClient(config = {}) {
 // src/core/operations.ts
 function createOperationsClient(config = {}) {
   const retrieve = async (operationId) => {
-    if (!config.data) {
+    if (!config._data) {
       return stub("operations.retrieve");
     }
     try {
-      const operation = await config.data.query(api.operations.queries.retrieve, {
+      const operation = await config._data.query(api.operations.queries.retrieve, {
         operationId
       });
       if (!operation) {
@@ -1376,7 +1878,7 @@ function createOperationsClient(config = {}) {
   return {
     retrieve,
     wait: async (operationId, input = {}) => {
-      if (!config.data) {
+      if (!config._data) {
         return stub("operations.wait");
       }
       const until = new Set(
@@ -1411,49 +1913,22 @@ function toTokenUnits(value, decimals = 6) {
   return viem.parseUnits(value, decimals);
 }
 
-// src/internal/payment-token.ts
-function resolvePaymentTokenAddress(currency) {
+// src/core/token-registry.ts
+function resolvePaymentToken(currency) {
   const normalized = currency.trim().toUpperCase();
   if (normalized === "USD" || normalized === "USDC") {
-    return TEST_USDC_ADDRESS.toLowerCase();
+    return {
+      address: TEST_USDC_ADDRESS.toLowerCase(),
+      decimals: 6,
+      symbol: "USDC"
+    };
   }
   throw new CapxulError({
-    code: "NETWORK_ERROR",
-    message: `Currency ${currency} is not configured for on-chain payment submission.`,
+    code: "NOT_IMPLEMENTED",
+    message: `Currency ${currency} is not yet supported by the token registry.`,
     details: { currency: normalized }
   });
 }
-async function buildSafeAccount(signer, chain) {
-  try {
-    const publicClient = viem.createPublicClient({
-      chain: chains.baseSepolia,
-      transport: viem.http(chain.rpcUrl)
-    });
-    return await accounts$1.toSafeSmartAccount({
-      client: publicClient,
-      entryPoint: { address: accountAbstraction.entryPoint07Address, version: "0.7" },
-      version: "1.4.1",
-      owners: [signer],
-      saltNonce: computeSaltNonce(signer.address),
-      safeSingletonAddress: SAFE_L2_SINGLETON,
-      safeProxyFactoryAddress: SAFE_PROXY_FACTORY,
-      safeModuleSetupAddress: SAFE_MODULE_SETUP,
-      safe4337ModuleAddress: SAFE_4337_MODULE,
-      safeModules: [],
-      setupTransactions: []
-    });
-  } catch (cause) {
-    throw new CapxulError({
-      code: "NETWORK_ERROR",
-      message: cause instanceof Error ? cause.message : String(cause),
-      cause,
-      details: { chainId: chain.chainId }
-    });
-  }
-}
-function computeSaltNonce(ownerAddress) {
-  return BigInt(`0x${ownerAddress.toLowerCase().slice(2).padEnd(64, "0")}`);
-}
 function createCapxulBundler(config) {
   const paymaster = accountAbstraction.createPaymasterClient({
     transport: viem.http(config.rpcUrl)
@@ -1560,13 +2035,13 @@ async function transferAsOwner(config, params) {
 function createPaymentsClient(config = {}) {
   return {
     create: async (input) => {
-      if (!config.data || !config.signer || !config.signing) {
+      if (!config._data || !config.signer || !config.signing) {
         return stub("payments.create");
       }
       let created = null;
       let submitted = null;
       try {
-        created = await config.data.mutation(api.payments.mutations.create, {
+        created = await config._data.mutation(api.payments.mutations.create, {
           to: input.to,
           amount: input.amount,
           reference: input.reference,
@@ -1574,15 +2049,21 @@ function createPaymentsClient(config = {}) {
           source: input.source
         });
         if (!created) {
-          return [new CapxulError({
-            code: "NETWORK_ERROR",
-            message: "payments.create returned no payment resource"
-          }), null];
+          return [
+            new CapxulError({
+              code: "NETWORK_ERROR",
+              message: "payments.create returned no payment resource"
+            }),
+            null
+          ];
         }
         if (created.status !== "processing" || created.operation.status !== "processing") {
           return [null, created];
         }
-        const currentSigner = await config.data.query(api.safe.queries.getMySignerAddress, {});
+        const currentSigner = await config._data.query(
+          api.safe.queries.getMySignerAddress,
+          {}
+        );
         if (!currentSigner?.address) {
           throw new CapxulError({
             code: "PERMISSION_DENIED",
@@ -1601,9 +2082,12 @@ function createPaymentsClient(config = {}) {
             }
           });
         }
-        const submission = await config.data.query(api.payments.queries.prepareSubmission, {
-          paymentId: created.id
-        });
+        const submission = await config._data.query(
+          api.payments.queries.prepareSubmission,
+          {
+            paymentId: created.id
+          }
+        );
         if (!submission?.recipientAddress) {
           throw new CapxulError({
             code: "NETWORK_ERROR",
@@ -1611,15 +2095,16 @@ function createPaymentsClient(config = {}) {
             details: { paymentId: created.id }
           });
         }
+        const token = resolvePaymentToken(submission.amount.currency);
         const transfer = await transferAsOwner(
           {
             signer: config.signer,
             signing: config.signing
           },
           {
-            tokenAddress: resolvePaymentTokenAddress(submission.amount.currency),
+            tokenAddress: token.address,
             recipientAddress: submission.recipientAddress,
-            amount: toTokenUnits(submission.amount.value, 6)
+            amount: toTokenUnits(submission.amount.value, token.decimals)
           }
         );
         if (!transfer.success) {
@@ -1637,7 +2122,7 @@ function createPaymentsClient(config = {}) {
           txHash: transfer.txHash,
           userOpHash: transfer.userOpHash
         };
-        await config.data.mutation(api.payments.mutations.recordSubmitted, {
+        await config._data.mutation(api.payments.mutations.recordSubmitted, {
           paymentId: created.id,
           txHash: transfer.txHash,
           userOpHash: transfer.userOpHash,
@@ -1647,43 +2132,65 @@ function createPaymentsClient(config = {}) {
       } catch (cause) {
         const error = mapCreateError(fromConvexError(cause));
         if (created?.id && created.status === "processing" && !submitted) {
-          await bestEffortMarkFailed({ data: config.data }, created.id, error);
+          await bestEffortMarkFailed({ _data: config._data }, created.id, error);
         }
         if (submitted && created?.id) {
-          return [new CapxulError({
-            code: "NETWORK_ERROR",
-            message: "Payment was submitted on-chain, but backend submission tracking failed.",
-            cause,
-            details: {
-              paymentId: created.id,
-              txHash: submitted.txHash,
-              userOpHash: submitted.userOpHash
-            }
-          }), null];
+          return [
+            new CapxulError({
+              code: "NETWORK_ERROR",
+              message: "Payment was submitted on-chain, but backend submission tracking failed.",
+              cause,
+              details: {
+                paymentId: created.id,
+                txHash: submitted.txHash,
+                userOpHash: submitted.userOpHash
+              }
+            }),
+            null
+          ];
         }
         return [error, null];
       }
     },
     retrieve: async (paymentId) => {
-      if (!config.data) {
+      if (!config._data) {
         return stub("payments.retrieve");
       }
       try {
-        const payment = await config.data.query(api.payments.queries.retrieve, {
-          paymentId
-        });
+        const payment = await config._data.query(
+          api.payments.queries.retrieve,
+          {
+            paymentId
+          }
+        );
         if (!payment) {
-          return [new CapxulError({
-            code: "NOT_FOUND",
-            message: `payment ${paymentId} not found`
-          }), null];
+          return [
+            new CapxulError({
+              code: "NOT_FOUND",
+              message: `payment ${paymentId} not found`
+            }),
+            null
+          ];
         }
         return [null, payment];
       } catch (cause) {
         return [fromConvexError(cause), null];
       }
     },
-    list: async () => stub("payments.list")
+    list: async (input) => {
+      if (!config._data) {
+        return stub("payments.list");
+      }
+      try {
+        const page = await config._data.query(api.payments.queries.list, {
+          limit: input?.limit,
+          cursor: input?.cursor
+        });
+        return [null, page];
+      } catch (cause) {
+        return [fromConvexError(cause), null];
+      }
+    }
   };
 }
 function createOrgPaymentsClient() {
@@ -1697,7 +2204,7 @@ function createOrgPaymentsClient() {
 }
 async function bestEffortMarkFailed(config, paymentId, error) {
   try {
-    await config.data.mutation(api.payments.mutations.markFailed, {
+    await config._data.mutation(api.payments.mutations.markFailed, {
       paymentId,
       errorCode: error.code,
       errorMessage: error.message,
@@ -1754,11 +2261,11 @@ function createOrgTransfersClient() {
 function createWithdrawalsClient(config = {}) {
   return {
     create: async (input) => {
-      if (!config.data) {
+      if (!config._data) {
         return stub("withdrawals.create");
       }
       const [createErr, createdRaw] = await tryCatch(
-        config.data.mutation(api.withdrawals.mutations.create, {
+        config._data.mutation(api.withdrawals.mutations.create, {
           amount: input.amount,
           destination: {
             externalAccountId: input.destination.externalAccountId
@@ -1788,18 +2295,18 @@ function createWithdrawalsClient(config = {}) {
         return [null, created];
       }
       const [signerErr, currentSigner] = await tryCatch(
-        config.data.query(api.safe.queries.getMySignerAddress, {})
+        config._data.query(api.safe.queries.getMySignerAddress, {})
       );
       if (signerErr) {
         return await handleSubmissionFailure(
-          { data: config.data },
+          { _data: config._data },
           created.id,
           mapCreateError2(fromConvexError(signerErr))
         );
       }
       if (!currentSigner?.address) {
         return await handleSubmissionFailure(
-          { data: config.data },
+          { _data: config._data },
           created.id,
           new CapxulError({
             code: "PERMISSION_DENIED",
@@ -1810,7 +2317,7 @@ function createWithdrawalsClient(config = {}) {
       }
       if (viem.getAddress(currentSigner.address) !== viem.getAddress(config.signer.address)) {
         return await handleSubmissionFailure(
-          { data: config.data },
+          { _data: config._data },
           created.id,
           new CapxulError({
             code: "PERMISSION_DENIED",
@@ -1824,13 +2331,13 @@ function createWithdrawalsClient(config = {}) {
         );
       }
       const [prepErr, submission] = await tryCatch(
-        config.data.query(api.withdrawals.queries.prepareSubmission, {
+        config._data.query(api.withdrawals.queries.prepareSubmission, {
           withdrawalId: created.id
         })
       );
       if (prepErr) {
         return await handleSubmissionFailure(
-          { data: config.data },
+          { _data: config._data },
           created.id,
           mapCreateError2(fromConvexError(prepErr))
         );
@@ -1838,7 +2345,7 @@ function createWithdrawalsClient(config = {}) {
       const destinationAddress = submission?.destinationAddress;
       if (!submission || !destinationAddress) {
         return await handleSubmissionFailure(
-          { data: config.data },
+          { _data: config._data },
           created.id,
           new CapxulError({
             code: "NETWORK_ERROR",
@@ -1847,6 +2354,7 @@ function createWithdrawalsClient(config = {}) {
           })
         );
       }
+      const token = resolvePaymentToken(submission.amount.currency);
       const [transferErr, transferOk] = await tryCatch(
         transferAsOwner(
           {
@@ -1854,22 +2362,22 @@ function createWithdrawalsClient(config = {}) {
             signing: config.signing
           },
           {
-            tokenAddress: resolvePaymentTokenAddress(submission.amount.currency),
+            tokenAddress: token.address,
             recipientAddress: destinationAddress,
-            amount: toTokenUnits(submission.amount.value, 6)
+            amount: toTokenUnits(submission.amount.value, token.decimals)
           }
         )
       );
       if (transferErr) {
         return await handleSubmissionFailure(
-          { data: config.data },
+          { _data: config._data },
           created.id,
           mapCreateError2(fromConvexError(transferErr))
         );
       }
       if (!transferOk.success) {
         return await handleSubmissionFailure(
-          { data: config.data },
+          { _data: config._data },
           created.id,
           new CapxulError({
             code: "NETWORK_ERROR",
@@ -1883,7 +2391,7 @@ function createWithdrawalsClient(config = {}) {
         );
       }
       const [recordErr] = await tryCatch(
-        config.data.mutation(api.withdrawals.mutations.recordSubmitted, {
+        config._data.mutation(api.withdrawals.mutations.recordSubmitted, {
           withdrawalId: created.id,
           txHash: transferOk.txHash,
           userOpHash: transferOk.userOpHash
@@ -1907,11 +2415,11 @@ function createWithdrawalsClient(config = {}) {
       return [null, created];
     },
     retrieve: async (withdrawalId) => {
-      if (!config.data) {
+      if (!config._data) {
         return stub("withdrawals.retrieve");
       }
       const [err, raw] = await tryCatch(
-        config.data.query(api.withdrawals.queries.retrieve, { withdrawalId })
+        config._data.query(api.withdrawals.queries.retrieve, { withdrawalId })
       );
       if (err) {
         return [fromConvexError(err), null];
@@ -1929,11 +2437,11 @@ function createWithdrawalsClient(config = {}) {
       return [null, withdrawal];
     },
     list: async (input) => {
-      if (!config.data) {
+      if (!config._data) {
         return stub("withdrawals.list");
       }
       const [err, raw] = await tryCatch(
-        config.data.query(api.withdrawals.queries.list, {
+        config._data.query(api.withdrawals.queries.list, {
           limit: input?.limit,
           cursor: input?.cursor
         })
@@ -1944,13 +2452,13 @@ function createWithdrawalsClient(config = {}) {
       return [null, raw];
     },
     recordCompleted: async (input) => {
-      if (!config.data) {
+      if (!config._data) {
         return stub(
           "withdrawals.recordCompleted"
         );
       }
       const [err] = await tryCatch(
-        config.data.mutation(api.withdrawals.mutations.recordCompleted, {
+        config._data.mutation(api.withdrawals.mutations.recordCompleted, {
           withdrawalId: input.withdrawalId,
           txHash: input.txHash
         })
@@ -1975,13 +2483,13 @@ function createOrgWithdrawalsClient(config = {}) {
      * orchestration ships in W3+.
      */
     create: async (input) => {
-      if (!config.data) {
+      if (!config._data) {
         return stub(
           "organizations.withdrawals.create"
         );
       }
       const [err, raw] = await tryCatch(
-        config.data.mutation(api.withdrawals.mutations.createOrg, {
+        config._data.mutation(api.withdrawals.mutations.createOrg, {
           organizationId: input.organizationId,
           amount: input.amount,
           destination: {
@@ -2008,13 +2516,13 @@ function createOrgWithdrawalsClient(config = {}) {
       return [null, created];
     },
     retrieve: async (input) => {
-      if (!config.data) {
+      if (!config._data) {
         return stub(
           "organizations.withdrawals.retrieve"
         );
       }
       const [err, raw] = await tryCatch(
-        config.data.query(api.withdrawals.queries.retrieve, {
+        config._data.query(api.withdrawals.queries.retrieve, {
           withdrawalId: input.withdrawalId
         })
       );
@@ -2044,13 +2552,13 @@ function createOrgWithdrawalsClient(config = {}) {
       return [null, withdrawal];
     },
     list: async (input) => {
-      if (!config.data) {
+      if (!config._data) {
         return stub(
           "organizations.withdrawals.list"
         );
       }
       const [err, raw] = await tryCatch(
-        config.data.query(api.withdrawals.queries.listOrg, {
+        config._data.query(api.withdrawals.queries.listOrg, {
           organizationId: input.organizationId,
           limit: input.limit,
           cursor: input.cursor
@@ -2069,7 +2577,7 @@ async function handleSubmissionFailure(config, withdrawalId, error) {
 }
 async function bestEffortMarkFailed2(config, withdrawalId, error) {
   await tryCatch(
-    config.data.mutation(api.withdrawals.mutations.markFailed, {
+    config._data.mutation(api.withdrawals.mutations.markFailed, {
       withdrawalId,
       errorCode: error.code,
       errorMessage: error.message
@@ -2148,13 +2656,13 @@ function createWebhookEventsClient() {
 function createOrgExternalAccountsClient(config) {
   return {
     create: async (input) => {
-      if (!config.data) {
+      if (!config._data) {
         return stub(
           "organizations.externalAccounts.create"
         );
       }
       const [err, raw] = await tryCatch(
-        config.data.mutation(api.externalAccounts.mutations.createOrg, {
+        config._data.mutation(api.externalAccounts.mutations.createOrg, {
           organizationId: input.organizationId,
           kind: input.kind,
           label: input.label,
@@ -2168,10 +2676,7 @@ function createOrgExternalAccountsClient(config) {
         })
       );
       if (err) {
-        return [
-          fromConvexError(err),
-          null
-        ];
+        return [fromConvexError(err), null];
       }
       if (!raw) {
         return [
@@ -2182,21 +2687,16 @@ function createOrgExternalAccountsClient(config) {
           null
         ];
       }
-      return [
-        null,
-        brandExternalAccount(
-          raw
-        )
-      ];
+      return [null, brandExternalAccount(raw)];
     },
     list: async (input) => {
-      if (!config.data) {
+      if (!config._data) {
         return stub(
           "organizations.externalAccounts.list"
         );
       }
       const [err, result] = await tryCatch(
-        config.data.query(api.externalAccounts.queries.listOrg, {
+        config._data.query(api.externalAccounts.queries.listOrg, {
           organizationId: input.organizationId,
           limit: input.limit,
           cursor: input.cursor
@@ -2206,9 +2706,7 @@ function createOrgExternalAccountsClient(config) {
         return [fromConvexError(err), null];
       }
       const branded = result.data.map(
-        (row) => brandExternalAccount(
-          row
-        )
+        (row) => brandExternalAccount(row)
       );
       return [
         null,
@@ -2220,17 +2718,66 @@ function createOrgExternalAccountsClient(config) {
       ];
     },
     retrieve: async (input) => {
-      if (!config.data) {
+      if (!config._data) {
         return stub(
           "organizations.externalAccounts.retrieve"
         );
       }
       const [err, raw] = await tryCatch(
-        config.data.query(api.externalAccounts.queries.retrieveOrg, {
+        config._data.query(api.externalAccounts.queries.retrieveOrg, {
+          organizationId: input.organizationId,
+          externalAccountId: input.externalAccountId
+        })
+      );
+      if (err) {
+        return [fromConvexError(err), null];
+      }
+      if (!raw) {
+        return [
+          new CapxulError({
+            code: "NOT_FOUND",
+            message: `external_account ${input.externalAccountId} not found`
+          }),
+          null
+        ];
+      }
+      return [null, brandExternalAccount(raw)];
+    },
+    remove: async (input) => {
+      if (!config._data) {
+        return stub("organizations.externalAccounts.remove");
+      }
+      const [err] = await tryCatch(
+        config._data.mutation(api.externalAccounts.mutations.removeOrg, {
           organizationId: input.organizationId,
           externalAccountId: input.externalAccountId
         })
       );
+      if (err) {
+        return [fromConvexError(err), null];
+      }
+      return [null, void 0];
+    }
+  };
+}
+function createOrgSubAccountsClient(config) {
+  return {
+    create: async (input) => {
+      if (!config._data) {
+        return stub(
+          "organizations.subAccounts.create"
+        );
+      }
+      const [err, raw] = await tryCatch(
+        config._data.mutation(api.subAccounts.mutations.create, {
+          parent: {
+            kind: "organization",
+            id: input.organizationId
+          },
+          name: input.name,
+          purpose: input.purpose
+        })
+      );
       if (err) {
         return [
           fromConvexError(err),
@@ -2241,28 +2788,95 @@ function createOrgExternalAccountsClient(config) {
         return [
           new CapxulError({
             code: "NOT_FOUND",
-            message: `external_account ${input.externalAccountId} not found`
+            message: "sub_account creation returned no resource"
           }),
           null
         ];
       }
+      const [brandErr, branded] = tryBrandSubAccount(raw);
+      if (brandErr) {
+        return [brandErr, null];
+      }
+      return [null, branded];
+    },
+    list: async (input) => {
+      if (!config._data) {
+        return stub(
+          "organizations.subAccounts.list"
+        );
+      }
+      const [err, rows] = await tryCatch(
+        config._data.query(api.subAccounts.queries.listByOrganization, {
+          organizationId: input.organizationId
+        })
+      );
+      if (err) {
+        return [
+          fromConvexError(err),
+          null
+        ];
+      }
+      const branded = [];
+      for (const row of rows) {
+        const [brandErr, value] = tryBrandSubAccount(row);
+        if (brandErr) {
+          return [brandErr, null];
+        }
+        branded.push(value);
+      }
       return [
         null,
-        brandExternalAccount(
-          raw
-        )
+        {
+          object: "list",
+          data: branded,
+          page: { hasMore: false }
+        }
       ];
     },
+    retrieve: async (input) => {
+      if (!config._data) {
+        return stub(
+          "organizations.subAccounts.retrieve"
+        );
+      }
+      const [err, raw] = await tryCatch(
+        config._data.query(api.subAccounts.queries.retrieve, {
+          subAccountId: input.subAccountId
+        })
+      );
+      if (err) {
+        return [
+          fromConvexError(err),
+          null
+        ];
+      }
+      if (!raw) {
+        return [
+          new CapxulError({
+            code: "NOT_FOUND",
+            message: `sub_account ${input.subAccountId} not found`
+          }),
+          null
+        ];
+      }
+      const [brandErr, branded] = tryBrandSubAccount(raw);
+      if (brandErr) {
+        return [
+          brandErr,
+          null
+        ];
+      }
+      return [null, branded];
+    },
     remove: async (input) => {
-      if (!config.data) {
+      if (!config._data) {
         return stub(
-          "organizations.externalAccounts.remove"
+          "organizations.subAccounts.remove"
         );
       }
-      const [err] = await tryCatch(
-        config.data.mutation(api.externalAccounts.mutations.removeOrg, {
-          organizationId: input.organizationId,
-          externalAccountId: input.externalAccountId
+      const [err, raw] = await tryCatch(
+        config._data.mutation(api.subAccounts.mutations.archive, {
+          subAccountId: input.subAccountId
         })
       );
       if (err) {
@@ -2271,23 +2885,139 @@ function createOrgExternalAccountsClient(config) {
           null
         ];
       }
-      return [null, void 0];
+      if (!raw) {
+        return [
+          new CapxulError({
+            code: "NOT_FOUND",
+            message: `sub_account ${input.subAccountId} not found`
+          }),
+          null
+        ];
+      }
+      const [brandErr, branded] = tryBrandSubAccount(raw);
+      if (brandErr) {
+        return [
+          brandErr,
+          null
+        ];
+      }
+      return [null, branded];
     }
   };
 }
 function createOrganizationsClient(config = {}) {
   return {
-    create: async () => stub("organizations.create"),
-    retrieve: async () => stub("organizations.retrieve"),
-    list: async () => stub("organizations.list"),
-    update: async () => stub("organizations.update"),
+    create: async (input) => {
+      if (!config._data) {
+        return stub("organizations.create");
+      }
+      if (input.country !== void 0) {
+        return [
+          new CapxulError({
+            code: "INVALID_INPUT",
+            message: "organizations.create does not support country yet \u2014 backend mutation only accepts name.",
+            details: { field: "country" }
+          }),
+          null
+        ];
+      }
+      try {
+        const orgId = await config._data.mutation(api.org.mutations.create, {
+          name: input.name
+        });
+        const org = await config._data.query(api.org.queries.retrieve, {
+          orgId
+        });
+        if (!org) {
+          return [
+            new CapxulError({
+              code: "NETWORK_ERROR",
+              message: "organization created but could not be retrieved"
+            }),
+            null
+          ];
+        }
+        return [null, org];
+      } catch (cause) {
+        return [fromConvexError(cause), null];
+      }
+    },
+    retrieve: async (organizationId) => {
+      if (!config._data) {
+        return stub("organizations.retrieve");
+      }
+      try {
+        const orgId = organizationId.replace(/^org_/, "");
+        const org = await config._data.query(api.org.queries.retrieve, {
+          orgId
+        });
+        if (!org) {
+          return [
+            new CapxulError({
+              code: "NOT_FOUND",
+              message: `organization ${organizationId} not found`
+            }),
+            null
+          ];
+        }
+        return [null, org];
+      } catch (cause) {
+        return [fromConvexError(cause), null];
+      }
+    },
+    list: async (input) => {
+      if (!config._data) {
+        return stub("organizations.list");
+      }
+      try {
+        const page = await config._data.query(api.org.queries.list, {
+          limit: input?.limit,
+          cursor: input?.cursor
+        });
+        const result = {
+          object: "list",
+          data: page.data,
+          page: {
+            hasMore: page.hasMore,
+            cursor: page.nextCursor
+          }
+        };
+        return [null, result];
+      } catch (cause) {
+        return [fromConvexError(cause), null];
+      }
+    },
+    update: async (input) => {
+      if (!config._data) {
+        return stub("organizations.update");
+      }
+      try {
+        const orgId = input.organizationId.replace(/^org_/, "");
+        const org = await config._data.mutation(api.org.mutations.update, {
+          orgId,
+          name: input.name
+        });
+        if (!org) {
+          return [
+            new CapxulError({
+              code: "NOT_FOUND",
+              message: `organization ${input.organizationId} not found`
+            }),
+            null
+          ];
+        }
+        return [null, org];
+      } catch (cause) {
+        return [fromConvexError(cause), null];
+      }
+    },
     safes: {
       retrieve: async (input) => {
-        if (!config.data) {
+        if (!config._data) {
           return stub("organizations.safes.retrieve");
         }
         try {
-          const safe = await config.data.query(
+          const safe = await config._data.query(
             api.safe.queries.retrieveOrganizationSafe,
             input
           );
@@ -2309,36 +3039,245 @@ function createOrganizationsClient(config = {}) {
         }
       }
     },
-    treasury: {
-      retrieve: async () => stub("organizations.treasury.retrieve")
-    },
-    members: {
-      list: async () => stub("organizations.members.list"),
-      retrieve: async () => stub("organizations.members.retrieve"),
-      invite: async () => stub("organizations.members.invite"),
-      updateRole: async () => stub("organizations.members.updateRole"),
-      remove: async () => stub("organizations.members.remove")
-    },
-    apiKeys: createApiKeysClient(),
-    kybProfile: {
-      start: async () => stub("organizations.kybProfile.start"),
-      retrieve: async () => stub("organizations.kybProfile.retrieve")
-    },
-    subAccounts: {
-      create: async () => stub("organizations.subAccounts.create"),
-      list: async () => stub("organizations.subAccounts.list"),
-      retrieve: async () => stub("organizations.subAccounts.retrieve"),
-      remove: async () => stub("organizations.subAccounts.remove")
-    },
-    externalAccounts: createOrgExternalAccountsClient(config),
-    balanceLedger: {
-      list: async () => stub(
-        "organizations.balanceLedger.list"
-      ),
-      retrieve: async () => stub(
-        "organizations.balanceLedger.retrieve"
-      )
-    },
+    treasury: {
+      retrieve: async (organizationId) => {
+        if (!config._data) {
+          return stub(
+            "organizations.treasury.retrieve"
+          );
+        }
+        try {
+          const orgId = organizationId.replace(/^org_/, "");
+          const raw = await config._data.query(
+            api.safe.queries.getOrgTreasuryBalance,
+            { orgId }
+          );
+          if (!raw) {
+            return [
+              new CapxulError({
+                code: "NOT_FOUND",
+                message: `treasury for organization ${organizationId} not found`
+              }),
+              null
+            ];
+          }
+          const treasury = {
+            object: "treasury",
+            id: toTreasuryId(`try_${orgId}`),
+            organizationId,
+            status: "active",
+            safeId: toSafeId(
+              `safe_${raw.safeAddress.replace(/^0x/, "").toLowerCase()}`
+            ),
+            totalBalance: { value: "0", currency: "USD" },
+            positions: raw.tokens.map((t) => ({
+              symbol: t.symbol,
+              contractAddress: t.tokenAddress,
+              amount: t.balance
+            })),
+            asOf: raw.lastUpdatedAt ? new Date(raw.lastUpdatedAt).toISOString() : (/* @__PURE__ */ new Date()).toISOString()
+          };
+          return [null, treasury];
+        } catch (cause) {
+          return [
+            fromConvexError(cause),
+            null
+          ];
+        }
+      }
+    },
+    members: {
+      list: async (input) => {
+        if (!config._data?.action) {
+          return stub("organizations.members.list");
+        }
+        try {
+          const orgId = input.organizationId.replace(/^org_/, "");
+          const page = await config._data.action(api.org.actions.membersList, {
+            organizationId: orgId,
+            status: input.status,
+            limit: input.limit,
+            cursor: input.cursor
+          });
+          return [null, page];
+        } catch (cause) {
+          return [fromConvexError(cause), null];
+        }
+      },
+      retrieve: async (input) => {
+        if (!config._data?.action) {
+          return stub("organizations.members.retrieve");
+        }
+        try {
+          const orgId = input.organizationId.replace(/^org_/, "");
+          const memberId = input.memberId.replace(/^mb_/, "");
+          const member = await config._data.action(
+            api.org.actions.retrieveMember,
+            {
+              organizationId: orgId,
+              memberId
+            }
+          );
+          return [null, member];
+        } catch (cause) {
+          return [fromConvexError(cause), null];
+        }
+      },
+      invite: async (input) => {
+        if (!config._data?.action) {
+          return stub("organizations.members.invite");
+        }
+        try {
+          const orgId = input.organizationId.replace(/^org_/, "");
+          const result = await config._data.action(
+            api.org.actions.inviteMember,
+            {
+              organizationId: orgId,
+              email: input.email,
+              role: input.role
+            }
+          );
+          return [null, result];
+        } catch (cause) {
+          return [fromConvexError(cause), null];
+        }
+      },
+      accept: async (input) => {
+        if (!config._data?.action) {
+          return stub("organizations.members.accept");
+        }
+        try {
+          const member = await config._data.action(
+            api.org.actions.acceptInvitation,
+            { token: input.token }
+          );
+          return [null, member];
+        } catch (cause) {
+          return [fromConvexError(cause), null];
+        }
+      },
+      updateRole: async (input) => {
+        if (!config._data?.action) {
+          return stub("organizations.members.updateRole");
+        }
+        try {
+          const orgId = input.organizationId.replace(/^org_/, "");
+          const memberId = input.memberId.replace(/^mb_/, "");
+          const member = await config._data.action(
+            api.org.actions.updateMemberRole,
+            {
+              organizationId: orgId,
+              memberId,
+              role: input.role
+            }
+          );
+          return [null, member];
+        } catch (cause) {
+          return [fromConvexError(cause), null];
+        }
+      },
+      revoke: async (input) => {
+        if (!config._data?.action) {
+          return stub("organizations.members.revoke");
+        }
+        try {
+          const orgId = input.organizationId.replace(/^org_/, "");
+          const memberId = input.memberId.replace(/^mb_/, "");
+          const member = await config._data.action(
+            api.org.actions.revokeMember,
+            {
+              organizationId: orgId,
+              memberId
+            }
+          );
+          return [null, member];
+        } catch (cause) {
+          return [fromConvexError(cause), null];
+        }
+      },
+      remove: async (input) => {
+        if (!config._data?.action) {
+          return stub("organizations.members.remove");
+        }
+        try {
+          const orgId = input.organizationId.replace(/^org_/, "");
+          const memberId = input.memberId.replace(/^mb_/, "");
+          await config._data.action(api.org.actions.removeMember, {
+            organizationId: orgId,
+            memberId
+          });
+          return [null, void 0];
+        } catch (cause) {
+          return [fromConvexError(cause), null];
+        }
+      },
+      resend: async (input) => {
+        if (!config._data?.action) {
+          return stub("organizations.members.resend");
+        }
+        try {
+          const orgId = input.organizationId.replace(/^org_/, "");
+          const memberId = input.memberId.replace(/^mb_/, "");
+          const result = await config._data.action(
+            api.org.actions.resendInvitation,
+            {
+              organizationId: orgId,
+              memberId
+            }
+          );
+          return [null, result];
+        } catch (cause) {
+          return [fromConvexError(cause), null];
+        }
+      }
+    },
+    apiKeys: createApiKeysClient(),
+    subAccounts: createOrgSubAccountsClient(config),
+    externalAccounts: createOrgExternalAccountsClient(config),
+    balanceLedger: {
+      list: async (input) => {
+        if (!config._data) {
+          return stub(
+            "organizations.balanceLedger.list"
+          );
+        }
+        try {
+          const orgId = input.organizationId.replace(/^org_/, "");
+          const page = await config._data.query(
+            api.balanceLedger.queries.listForOrg,
+            { orgId, limit: input.limit, cursor: input.cursor }
+          );
+          return [null, page];
+        } catch (cause) {
+          return [fromConvexError(cause), null];
+        }
+      },
+      retrieve: async (input) => {
+        if (!config._data) {
+          return stub(
+            "organizations.balanceLedger.retrieve"
+          );
+        }
+        try {
+          const entry = await config._data.query(
+            api.balanceLedger.queries.retrieve,
+            { entryId: input.entryId }
+          );
+          if (!entry) {
+            return [
+              new CapxulError({
+                code: "NOT_FOUND",
+                message: `balance_ledger_entry ${input.entryId} not found`
+              }),
+              null
+            ];
+          }
+          return [null, entry];
+        } catch (cause) {
+          return [fromConvexError(cause), null];
+        }
+      }
+    },
     payments: createOrgPaymentsClient(),
     transfers: createOrgTransfersClient(),
     withdrawals: createOrgWithdrawalsClient(config),
@@ -2348,14 +3287,6 @@ function createOrganizationsClient(config = {}) {
   };
 }
 
-// src/core/sub-accounts.ts
-function createSubAccountsClient() {
-  return {
-    retrieve: async () => stub("subAccounts.retrieve"),
-    remove: async () => stub("subAccounts.remove")
-  };
-}
-
 // src/core/token-transfers.ts
 var toTokenTransferId = (raw) => {
   if (typeof raw !== "string" || raw.length === 0) {
@@ -2374,11 +3305,11 @@ function brandRow(row) {
 function createTokenTransfersClient(config = {}) {
   return {
     list: async (input) => {
-      if (!config.data) {
+      if (!config._data) {
         return stub("tokenTransfers.list");
       }
       try {
-        const raw = await config.data.query(
+        const raw = await config._data.query(
           api.tokenTransfers.queries.list,
           {
             limit: input?.limit,
@@ -2412,11 +3343,11 @@ function createTokenTransfersClient(config = {}) {
       }
     },
     retrieve: async (input) => {
-      if (!config.data) {
+      if (!config._data) {
         return stub("tokenTransfers.retrieve");
       }
       try {
-        const raw = await config.data.query(
+        const raw = await config._data.query(
           api.tokenTransfers.queries.getByTxLogIndex,
           {
             txHash: input.txHash,
@@ -2486,7 +3417,7 @@ function createAuthFlowMachine(client) {
       }),
       verifyOtp: xstate.fromPromise(
         async ({ input, signal }) => {
-          const [error, session] = await client.auth.verifyOtp(
+          const [error, result] = await client.auth.verifyOtp(
             {
               email: input.email,
               otp: input.code
@@ -2494,7 +3425,14 @@ function createAuthFlowMachine(client) {
             { signal }
           );
           if (error) throw error;
-          return session;
+          if (result.kind === "bootstrap_required") {
+            throw new CapxulError({
+              code: "ACTION_REQUIRED",
+              message: "OTP verified but auth bootstrap is required. Use createAuthBootstrapFlowMachine for product sign-up.",
+              details: { reason: result.reason }
+            });
+          }
+          return result.session;
         }
       ),
       signOut: xstate.fromPromise(async () => {
@@ -2742,6 +3680,327 @@ function emailDomain(email) {
   const domain = email.split("@")[1]?.trim().toLowerCase();
   return domain || "unknown";
 }
+var initialContext = {
+  email: null,
+  code: null,
+  username: null,
+  bootstrapToken: null,
+  bootstrapReason: null,
+  session: null,
+  account: null,
+  safe: null,
+  error: null
+};
+function createAuthBootstrapFlowMachine(client) {
+  return xstate.setup({
+    types: {},
+    actors: {
+      sendOtp: xstate.fromPromise(async ({ input, signal }) => {
+        const [error] = await client.auth.sendOtp(
+          { email: input.email },
+          { signal }
+        );
+        if (error) throw error;
+      }),
+      verifyOtp: xstate.fromPromise(
+        async ({ input, signal }) => {
+          const [error, result] = await client.auth.verifyOtp(
+            { email: input.email, otp: input.code },
+            { signal }
+          );
+          if (error) throw error;
+          return result;
+        }
+      ),
+      completeBootstrap: xstate.fromPromise(async ({ input }) => {
+        const [error, result] = await client.auth.completeBootstrap(input);
+        if (error) throw error;
+        return result;
+      }),
+      signOut: xstate.fromPromise(async () => {
+        const [error] = await client.auth.signOut();
+        if (error) throw error;
+      })
+    },
+    actions: {
+      trackOtpRequested: ({ context }) => {
+        if (!context.email) return;
+        track("auth_otp_requested", {
+          email_domain: emailDomain2(context.email)
+        });
+      },
+      trackFailed: ({ event }) => {
+        track("auth_failed", {
+          auth_type: "email_otp",
+          reason: errorFromEvent2(event).code
+        });
+      },
+      trackTimeoutFailed: () => {
+        track("auth_failed", {
+          auth_type: "email_otp",
+          reason: "timeout"
+        });
+      },
+      trackVerified: () => {
+        track("auth_verified", { auth_type: "email_otp" });
+      },
+      trackBootstrapRequired: ({ context }) => {
+        track("auth_verified", {
+          auth_type: "email_otp",
+          auth_mode: context.bootstrapReason ?? "bootstrap_required"
+        });
+      },
+      identifyAndTrack: ({ context }) => {
+        if (!context.session) return;
+        identify(context.session.authUserId, {
+          email_domain: emailDomain2(context.session.email)
+        });
+        track("auth_identified", {
+          email_domain: emailDomain2(context.session.email)
+        });
+      },
+      trackSignedOut: () => {
+        track("auth_signed_out");
+      }
+    }
+  }).createMachine({
+    id: "authBootstrap",
+    initial: "email",
+    context: initialContext,
+    states: {
+      email: {
+        on: {
+          ENTER_EMAIL: {
+            actions: xstate.assign({
+              email: ({ event }) => event.email,
+              error: () => null
+            })
+          },
+          REQUEST_OTP: { target: "sending_otp" }
+        }
+      },
+      sending_otp: {
+        invoke: {
+          src: "sendOtp",
+          input: ({ context }) => ({ email: requireEmail2(context) }),
+          onDone: { target: "otp_requested", actions: "trackOtpRequested" },
+          onError: {
+            target: "otp_requested",
+            actions: [
+              xstate.assign({ error: ({ event }) => errorFromEvent2(event) }),
+              "trackFailed"
+            ]
+          }
+        },
+        after: {
+          [FLOW_INVOKE_TIMEOUT_MS]: {
+            target: "otp_requested",
+            actions: [
+              xstate.assign({ error: () => timeoutError2("sending_otp") }),
+              "trackTimeoutFailed"
+            ]
+          }
+        }
+      },
+      otp_requested: {
+        on: {
+          ENTER_OTP: {
+            actions: xstate.assign({
+              code: ({ event }) => event.code,
+              error: () => null
+            })
+          },
+          VERIFY_OTP: { target: "verifying_otp" },
+          BACK: { target: "email" },
+          RESET: { target: "email", actions: xstate.assign(() => initialContext) }
+        }
+      },
+      verifying_otp: {
+        invoke: {
+          src: "verifyOtp",
+          input: ({ context }) => ({
+            email: requireEmail2(context),
+            code: requireCode(context)
+          }),
+          onDone: [
+            {
+              guard: ({ event }) => event.output.kind === "existing_member",
+              target: "authenticated",
+              actions: [
+                xstate.assign({
+                  session: ({ event }) => event.output.session,
+                  account: ({ event }) => event.output.kind === "existing_member" ? event.output.account : null,
+                  username: ({ event }) => event.output.kind === "existing_member" ? event.output.username : null,
+                  safe: ({ event }) => event.output.kind === "existing_member" ? event.output.safe : null,
+                  email: () => null,
+                  error: () => null
+                }),
+                "trackVerified",
+                "identifyAndTrack"
+              ]
+            },
+            {
+              target: "bootstrap_required",
+              actions: [
+                xstate.assign({
+                  session: ({ event }) => event.output.session,
+                  bootstrapToken: ({ event }) => event.output.kind === "bootstrap_required" ? event.output.bootstrapToken : null,
+                  bootstrapReason: ({ event }) => event.output.kind === "bootstrap_required" ? event.output.reason : null,
+                  username: ({ event }) => event.output.kind === "bootstrap_required" ? event.output.username ?? null : null,
+                  email: ({ event }) => event.output.kind === "bootstrap_required" ? event.output.email : null,
+                  error: () => null
+                }),
+                "trackVerified",
+                "trackBootstrapRequired"
+              ]
+            }
+          ],
+          onError: {
+            target: "otp_requested",
+            actions: [
+              xstate.assign({ error: ({ event }) => errorFromEvent2(event) }),
+              "trackFailed"
+            ]
+          }
+        },
+        after: {
+          [FLOW_INVOKE_TIMEOUT_MS]: {
+            target: "otp_requested",
+            actions: [
+              xstate.assign({ error: () => timeoutError2("verifying_otp") }),
+              "trackTimeoutFailed"
+            ]
+          }
+        }
+      },
+      bootstrap_required: {
+        on: {
+          ENTER_USERNAME: {
+            actions: xstate.assign({
+              username: ({ event }) => event.username,
+              error: () => null
+            })
+          },
+          COMPLETE_BOOTSTRAP: { target: "completing_bootstrap" },
+          BACK: { target: "otp_requested" },
+          RESET: { target: "email", actions: xstate.assign(() => initialContext) }
+        }
+      },
+      completing_bootstrap: {
+        invoke: {
+          src: "completeBootstrap",
+          input: ({ context }) => ({
+            bootstrapToken: requireBootstrapToken(context),
+            username: requireUsername(context)
+          }),
+          onDone: {
+            target: "authenticated",
+            actions: [
+              xstate.assign({
+                session: ({ event }) => event.output.session,
+                account: ({ event }) => event.output.account,
+                username: ({ event }) => event.output.username,
+                safe: ({ event }) => event.output.safe,
+                bootstrapToken: () => null,
+                bootstrapReason: () => null,
+                email: () => null,
+                error: () => null
+              }),
+              "identifyAndTrack"
+            ]
+          },
+          onError: {
+            target: "bootstrap_required",
+            actions: [
+              xstate.assign({ error: ({ event }) => errorFromEvent2(event) }),
+              "trackFailed"
+            ]
+          }
+        },
+        after: {
+          [FLOW_INVOKE_TIMEOUT_MS]: {
+            target: "bootstrap_required",
+            actions: [
+              xstate.assign({ error: () => timeoutError2("completing_bootstrap") }),
+              "trackTimeoutFailed"
+            ]
+          }
+        }
+      },
+      authenticated: {
+        on: {
+          SIGN_OUT: { target: "signing_out" }
+        }
+      },
+      signing_out: {
+        invoke: {
+          src: "signOut",
+          onDone: {
+            target: "email",
+            actions: [
+              xstate.assign(() => initialContext),
+              "trackSignedOut"
+            ]
+          },
+          onError: {
+            target: "error",
+            actions: xstate.assign({ error: ({ event }) => errorFromEvent2(event) })
+          }
+        }
+      },
+      error: {
+        on: {
+          RESET: { target: "email", actions: xstate.assign(() => initialContext) }
+        }
+      }
+    }
+  });
+}
+function requireEmail2(context) {
+  if (!context.email) {
+    throw Errors.invalidInput("email", "Auth bootstrap requires an email.");
+  }
+  return context.email;
+}
+function requireCode(context) {
+  if (!context.code) {
+    throw Errors.invalidInput("code", "Auth bootstrap requires an OTP code.");
+  }
+  return context.code;
+}
+function requireBootstrapToken(context) {
+  if (!context.bootstrapToken) {
+    throw Errors.invalidInput(
+      "bootstrapToken",
+      "Auth bootstrap requires a continuation token."
+    );
+  }
+  return context.bootstrapToken;
+}
+function requireUsername(context) {
+  if (!context.username) {
+    throw Errors.invalidInput("username", "Auth bootstrap requires a username.");
+  }
+  return context.username;
+}
+function errorFromEvent2(event) {
+  const cause = typeof event === "object" && event !== null && "error" in event ? event.error : event;
+  if (cause instanceof CapxulError || cause instanceof CapxulError2) {
+    return cause;
+  }
+  return Errors.providerError("auth", "bootstrap", cause);
+}
+function timeoutError2(state) {
+  return Errors.providerError(
+    "auth",
+    "bootstrap",
+    new Error(`timeout: ${state} exceeded ${FLOW_INVOKE_TIMEOUT_MS}ms`)
+  );
+}
+function emailDomain2(email) {
+  const domain = email.split("@")[1]?.trim().toLowerCase();
+  return domain || "unknown";
+}
 function createProvisioningMachine(client) {
   return xstate.setup({
     types: {},
@@ -2769,7 +4028,7 @@ function createProvisioningMachine(client) {
         const provider = context.input?.signerProvider;
         if (!provider) return;
         track("provisioning_safe_created", {
-          safe_address: provider.safeAddress
+          safe_address: deriveSafeAddress(provider.signerAddress)
         });
       }
     }
@@ -2814,13 +4073,13 @@ function createProvisioningMachine(client) {
           },
           onError: {
             target: "error",
-            actions: xstate.assign({ error: ({ event }) => errorFromEvent2(event) })
+            actions: xstate.assign({ error: ({ event }) => errorFromEvent3(event) })
           }
         },
         after: {
           [FLOW_INVOKE_TIMEOUT_MS]: {
             target: "error",
-            actions: xstate.assign({ error: () => timeoutError2() })
+            actions: xstate.assign({ error: () => timeoutError3() })
           }
         }
       },
@@ -2838,7 +4097,7 @@ function createProvisioningMachine(client) {
      * this payload on its `onDone` transition and branches via guards
      * on `event.output.error`.
      */
-    output: ({ context }) => context.error ? { error: context.error } : context.account ? { account: context.account } : { error: timeoutError2() }
+    output: ({ context }) => context.error ? { error: context.error } : context.account ? { account: context.account } : { error: timeoutError3() }
   });
 }
 function requireProvisionInput(context) {
@@ -2850,13 +4109,13 @@ function requireProvisionInput(context) {
   }
   return context.input;
 }
-function errorFromEvent2(event) {
+function errorFromEvent3(event) {
   const cause = typeof event === "object" && event !== null && "error" in event ? event.error : event;
   if (cause instanceof CapxulError) return cause;
   if (cause instanceof CapxulError2) return cause;
   return Errors.providerError("provisioning", "flow", cause);
 }
-function timeoutError2() {
+function timeoutError3() {
   return Errors.providerError(
     "provisioning",
     "flow",
@@ -2949,7 +4208,7 @@ function createOnboardingFlowMachine(client) {
         error: ({ event }) => extractChildErrorOrFallback(event)
       }),
       assignChildThrown: xstate.assign({
-        error: ({ event }) => errorFromEvent3(event)
+        error: ({ event }) => errorFromEvent4(event)
       }),
       assignAccountFromChild: xstate.assign({
         account: ({ event }) => extractChildAccountOrNull(event)
@@ -3111,7 +4370,7 @@ function extractChildAccountOrNull(event) {
   if (output && "account" in output && output.account) return output.account;
   return null;
 }
-function errorFromEvent3(event) {
+function errorFromEvent4(event) {
   const cause = typeof event === "object" && event !== null && "error" in event ? event.error : event;
   if (cause instanceof CapxulError) return cause;
   if (cause instanceof CapxulError2) return cause;
@@ -3131,7 +4390,7 @@ function createCapxulClient(config = {}) {
     tokenTransfers: createTokenTransfersClient(config),
     withdrawals: createWithdrawalsClient(config),
     documents: createDocumentsClient(),
-    subAccounts: createSubAccountsClient(),
+    subAccounts: createSubAccountsClient(config),
     virtualAccounts: createVirtualAccountsClient(),
     virtualCards: createVirtualCardsClient(),
     externalAccounts: createExternalAccountsClient(config),
@@ -3143,6 +4402,7 @@ function createCapxulClient(config = {}) {
   const client = clientWithoutFlows;
   client.flows = {
     auth: () => createAuthFlowMachine(client),
+    authBootstrap: () => createAuthBootstrapFlowMachine(client),
     onboarding: () => createOnboardingFlowMachine(client),
     provisioning: () => createProvisioningMachine(client)
   };
@@ -3247,7 +4507,87 @@ function isWebhookEvent(value) {
   return typeof candidate.id === "string" && typeof candidate.type === "string" && typeof candidate.createdAt === "string" && (candidate.operationId === void 0 || typeof candidate.operationId === "string") && (candidate.correlationId === void 0 || typeof candidate.correlationId === "string") && !!candidate.data && typeof candidate.data === "object" && !Array.isArray(candidate.data);
 }
 
+// src/core/auth-service.ts
+var AuthService = class {
+  authClient;
+  sessionStore;
+  config;
+  constructor(config = {}) {
+    this.config = config;
+    this.sessionStore = config.auth?.sessionStore ?? createMemorySessionStore2();
+    this.authClient = createAuthClient({
+      ...config,
+      auth: { ...config.auth, sessionStore: this.sessionStore }
+    });
+  }
+  async sendOtp(email) {
+    const [err] = await this.authClient.sendOtp({ email });
+    if (err) throw err;
+  }
+  async verifyOtp(email, otp) {
+    const [err, result] = await this.authClient.verifyOtp({ email, otp });
+    if (err) throw err;
+    return result;
+  }
+  async completeBootstrap(params, signer) {
+    if (signer) {
+      const tempClient = createAuthClient({
+        ...this.config,
+        signer
+      });
+      const [err2, result2] = await tempClient.completeBootstrap(params);
+      if (err2) throw err2;
+      return result2;
+    }
+    const [err, result] = await this.authClient.completeBootstrap(params);
+    if (err) throw err;
+    return result;
+  }
+  /**
+   * Clears the persisted session and, when a transport was pre-injected,
+   * drops the cached auth header.
+   *
+   * **Transport safety note:** `clearAuth()` is only invoked when
+   * `config._transport` was supplied at construction (e.g. by the React
+   * provider). If `AuthService` is instantiated directly in a Node/CLI
+   * context without an injected transport, the transport-side auth cache
+   * is the caller's responsibility.
+   */
+  async signOut() {
+    this.sessionStore.clear();
+    this.config._transport?.clearAuth();
+  }
+  async getSession() {
+    const [err, session] = await this.authClient.getSession();
+    if (err) throw err;
+    return session;
+  }
+};
+function createMemorySessionStore2() {
+  let current = null;
+  return {
+    get: () => current,
+    set: (session) => {
+      current = session;
+    },
+    clear: () => {
+      current = null;
+    }
+  };
+}
+var SignerProvisioner = class {
+  provision() {
+    const privateKey = accounts.generatePrivateKey();
+    const signer = accounts.privateKeyToAccount(privateKey);
+    const safeAddress = deriveSafeAddress(signer.address);
+    return { signer, safeAddress };
+  }
+};
+
+exports.AuthService = AuthService;
 exports.CapxulError = CapxulError;
+exports.SignerProvisioner = SignerProvisioner;
+exports.createAuthBootstrapFlowMachine = createAuthBootstrapFlowMachine;
 exports.createAuthFlowMachine = createAuthFlowMachine;
 exports.createCapxulClient = createCapxulClient;
 exports.createLocalSigner = createLocalSigner;
@@ -3257,6 +4597,7 @@ exports.makeHttpTransport = makeHttpTransport;
 exports.matchAction = matchAction;
 exports.matchError = matchError;
 exports.matchStatus = matchStatus;
+exports.resolvePaymentToken = resolvePaymentToken;
 exports.toAccountId = toAccountId;
 exports.toApiKeyId = toApiKeyId;
 exports.toBalanceLedgerEntryId = toBalanceLedgerEntryId;