@capxul/sdk 0.1.0-alpha.8 → 0.2.0-alpha.3

package/dist/index.js

@@ -1,10 +1,12 @@
 import { componentsGeneric, anyApi } from 'convex/server';
-import { getAddress, parseUnits, createPublicClient, http, encodeFunctionData } from 'viem';
 import { toSafeSmartAccount } from 'permissionless/accounts';
+import { getAddress, parseUnits, createPublicClient, http, encodeFunctionData } from 'viem';
 import { entryPoint07Address, createPaymasterClient, createBundlerClient } from 'viem/account-abstraction';
 import { baseSepolia } from 'viem/chains';
+import { deriveSafeAddress as deriveSafeAddress$1, defaultSafeDeriveConfig } from '@repo/safe-derive';
+import { ConvexHttpClient } from 'convex/browser';
 import { setup, fromPromise, assign } from 'xstate';
-import { privateKeyToAccount } from 'viem/accounts';
+import { privateKeyToAccount, generatePrivateKey } from 'viem/accounts';
 
 // src/_generated/api.js
 var api = anyApi;
@@ -121,6 +123,160 @@ function identify(userId, traits) {
   debugLog(`[IDENTIFY] ${userId} ${formatDebugValue2(traits ?? "")}`);
 }
 
+// ../config/src/chain.ts
+var CAPXUL_PAYMENTS_ADDRESS = "0xe740ea65521edc9bef0ea75d30b5334711db99f4";
+var TEST_USDC_ADDRESS = "0xf09fcbb6df9f8f918e58f9c8ab15a76ade862b77";
+var CAPXUL_API_BASE_URL = "https://elated-oyster-269.convex.site";
+
+// ../config/src/timing.ts
+var FLOW_INVOKE_TIMEOUT_MS = 3e4;
+var WEBHOOK_FRESHNESS_WINDOW_MS = 5 * 60 * 1e3;
+
+// ../config/src/errors.ts
+var CapxulError2 = class extends Error {
+  code;
+  details;
+  correlationId;
+  layer;
+  constructor(code, message, options) {
+    super(message, options?.cause ? { cause: options.cause } : void 0);
+    this.code = code;
+    this.details = options?.details;
+    this.correlationId = options?.correlationId;
+    this.layer = options?.layer;
+  }
+};
+var Errors = {
+  notAuthenticated: () => new CapxulError2("NOT_AUTHENTICATED", "Not authenticated"),
+  profileNotFound: (authUserId) => new CapxulError2("PROFILE_NOT_FOUND", `Profile not found for user ${authUserId}`),
+  smartAccountMissing: (authUserId) => new CapxulError2("SMART_ACCOUNT_MISSING", `Smart account not provisioned for user ${authUserId}`),
+  envMissing: (name) => new CapxulError2("ENV_MISSING", `Environment variable ${name} not configured`),
+  openfortApi: (operation, cause) => new CapxulError2(
+    "PROVIDER_ERROR",
+    `Openfort ${operation} failed: ${cause instanceof Error ? cause.message : String(cause)}`,
+    { cause, details: { provider: "openfort", operation } }
+  ),
+  shieldApi: (status, detail) => new CapxulError2(
+    "PROVIDER_ERROR",
+    `Shield API error (${status}): ${detail}`,
+    { details: { provider: "shield", status } }
+  ),
+  providerError: (provider, operation, cause) => (
+    // Public `message` is redacted to a fixed shape so provider-side
+    // exception text never leaks to the client. The original `cause`
+    // is preserved on `Error.cause` for server-side debugging via
+    // observability sinks (Sentry, console traces).
+    new CapxulError2(
+      "PROVIDER_ERROR",
+      `Provider error: ${provider} ${operation}`,
+      { cause, details: { provider, operation } }
+    )
+  ),
+  invalidInput: (field, reason) => new CapxulError2(
+    "INVALID_INPUT",
+    `Invalid ${field}: ${reason}`,
+    { details: { field, reason } }
+  ),
+  playerNotFound: (playerId) => new CapxulError2(
+    "PLAYER_NOT_FOUND",
+    playerId ? `Openfort player ${playerId} not found` : "Openfort player not found"
+  ),
+  accountNotFound: (accountId) => new CapxulError2(
+    "ACCOUNT_NOT_FOUND",
+    accountId ? `Openfort account ${accountId} not found` : "Openfort smart account not found"
+  ),
+  invalidRecipient: (reason) => new CapxulError2("INVALID_RECIPIENT", reason),
+  permissionDenied: (reason = "Permission denied") => new CapxulError2("PERMISSION_DENIED", reason),
+  notFound: (resource, id) => new CapxulError2(
+    "NOT_FOUND",
+    id ? `${resource} ${id} not found` : `${resource} not found`
+  ),
+  idempotencyConflict: (details) => new CapxulError2(
+    "IDEMPOTENCY_CONFLICT",
+    "Idempotency key was already used for a different request",
+    { details }
+  ),
+  emailDeliveryFailed: (detail, details) => new CapxulError2("EMAIL_DELIVERY_FAILED", `Failed to send email: ${detail}`, {
+    details
+  }),
+  rateLimited: (details) => new CapxulError2("RATE_LIMITED", "Request was rate limited", {
+    details: { ...details }
+  }),
+  internalError: (reason) => new CapxulError2("INTERNAL_ERROR", `Internal error: ${reason}`),
+  /**
+   * Verification gate. Surfaced when a request hits a verification
+   * boundary the actor cannot cross under their current state. Two
+   * variants share this code:
+   *
+   * - Rail gate (Withdrawals v1 W2, #465): the resolved
+   *   `external_account.kind` routes to a withdrawal rail (e.g.
+   *   `fiat_offramp`, `card_payout`) that is not yet supported. Carries
+   *   `details.rail` + `details.currentKind`.
+   * - KYC tier gate (legacy / future): the actor's KYC tier is below
+   *   the required tier. Carries `details.requiredTier`.
+   *
+   * Code is shared because both expose the same UX shape ("you cannot
+   * proceed until verification advances"); the `details.*` keys
+   * differentiate the route.
+   */
+  verificationRequired: (details) => {
+    const message = "rail" in details ? `Withdrawal rail "${details.rail}" (kind=${details.currentKind}) is not yet supported.` : `Verification tier ${details.requiredTier} is required.`;
+    return new CapxulError2("VERIFICATION_REQUIRED", message, {
+      details: { ...details }
+    });
+  }
+};
+
+// ../config/src/safe.ts
+var SAFE_PROXY_FACTORY = "0x4e1dcf7ad4e460cfd30791ccc4f9c8a4f820ec67";
+var SAFE_L2_SINGLETON = "0x29fcb43b46531bca003ddc8fcb67ffe91900c762";
+var SAFE_MODULE_SETUP = "0x2dd68b007b46fbe91b9a7c3eda5a7a1063cb5b47";
+var SAFE_4337_MODULE = "0x75cf11467937ce3f2f357ce24ffc3dbf8fd5c226";
+
+// ../config/src/org-roles.ts
+function roleKeyFromLabel(label) {
+  const bytes = new TextEncoder().encode(label);
+  const hex = Array.from(bytes).map((b) => b.toString(16).padStart(2, "0")).join("");
+  return "0x" + hex.padEnd(64, "0");
+}
+roleKeyFromLabel("OWNER");
+roleKeyFromLabel("FINANCE_MANAGER");
+roleKeyFromLabel("PAYMENTS_OPERATOR");
+async function buildSafeAccount(signer, chain) {
+  try {
+    const publicClient = createPublicClient({
+      chain: baseSepolia,
+      transport: http(chain.rpcUrl)
+    });
+    return await toSafeSmartAccount({
+      client: publicClient,
+      entryPoint: { address: entryPoint07Address, version: "0.7" },
+      version: "1.4.1",
+      owners: [signer],
+      saltNonce: computeSaltNonce(signer.address),
+      safeSingletonAddress: SAFE_L2_SINGLETON,
+      safeProxyFactoryAddress: SAFE_PROXY_FACTORY,
+      safeModuleSetupAddress: SAFE_MODULE_SETUP,
+      safe4337ModuleAddress: SAFE_4337_MODULE,
+      safeModules: [],
+      setupTransactions: []
+    });
+  } catch (cause) {
+    throw new CapxulError({
+      code: "NETWORK_ERROR",
+      message: cause instanceof Error ? cause.message : String(cause),
+      cause,
+      details: { chainId: chain.chainId }
+    });
+  }
+}
+function computeSaltNonce(ownerAddress) {
+  return BigInt(`0x${ownerAddress.toLowerCase().slice(2).padEnd(64, "0")}`);
+}
+function deriveSafeAddress(signerAddress) {
+  return deriveSafeAddress$1(signerAddress, defaultSafeDeriveConfig);
+}
+
 // ../platform-kernel/src/ids.ts
 function makePrefixedIdConstructor(prefix, fieldName) {
   const re = new RegExp(`^${prefix}_[A-Za-z0-9_\\-]+$`);
@@ -139,7 +295,7 @@ var toAccountId = makePrefixedIdConstructor(
 );
 var toOrganizationId = makePrefixedIdConstructor("org", "organizationId");
 var toMemberId = makePrefixedIdConstructor(
-  "mem",
+  "mb",
   "memberId"
 );
 var toSafeId = makePrefixedIdConstructor(
@@ -253,13 +409,13 @@ function brandExternalAccount(raw) {
 function createExternalAccountsClient(config = {}) {
   return {
     retrieve: async (externalAccountId) => {
-      if (!config.data) {
+      if (!config._data) {
         return stub(
           "externalAccounts.retrieve"
         );
       }
       const [err, raw] = await tryCatch(
-        config.data.query(api.externalAccounts.queries.retrievePersonal, {
+        config._data.query(api.externalAccounts.queries.retrievePersonal, {
           externalAccountId
         })
       );
@@ -281,11 +437,11 @@ function createExternalAccountsClient(config = {}) {
       return [null, brandExternalAccount(raw)];
     },
     remove: async (externalAccountId) => {
-      if (!config.data) {
+      if (!config._data) {
         return stub("externalAccounts.remove");
       }
       const [err] = await tryCatch(
-        config.data.mutation(api.externalAccounts.mutations.removePersonal, {
+        config._data.mutation(api.externalAccounts.mutations.removePersonal, {
           externalAccountId
         })
       );
@@ -300,17 +456,203 @@ function createExternalAccountsClient(config = {}) {
   };
 }
 
+// src/core/sub-accounts.ts
+function malformedWireError(reason, raw) {
+  return new CapxulError({
+    code: "PROVIDER_ERROR",
+    message: `convex brandSubAccount failed: ${reason}`,
+    details: {
+      provider: "convex",
+      operation: "brandSubAccount",
+      reason,
+      // PII discipline (`.claude/rules/posthog.md`): user-authored
+      // strings on the wire (`name`, `purpose`) are customer-confidential
+      // — sub-account names like "Q3 Acquisition Reserve" or
+      // "Vendor ABC payments" must not flow into telemetry. We emit a
+      // structural keys-only sample via a strict ALLOWLIST so any future
+      // wire-shape addition (e.g. `recipientEmail`, `tags`) is dropped
+      // by construction rather than leaked through a denylist gap.
+      sample: safeSampleShape(raw)
+    }
+  });
+}
+function safeSampleShape(raw) {
+  if (raw === null || typeof raw !== "object") {
+    return { type: typeof raw };
+  }
+  const r = raw;
+  const balance = r.balance;
+  return {
+    object: typeof r.object === "string" ? r.object : typeof r.object,
+    idPresent: typeof r.id === "string" && r.id.length > 0,
+    // First 4 chars only — enough to distinguish "sub_" prefixed IDs
+    // from accidental other resource IDs without leaking the full ID.
+    idPrefix: typeof r.id === "string" ? r.id.slice(0, 4) : void 0,
+    parentKind: r.parent !== null && typeof r.parent === "object" ? r.parent.kind : typeof r.parent,
+    status: r.status,
+    hasName: typeof r.name === "string",
+    hasPurpose: r.purpose !== void 0,
+    balanceShape: balance !== null && typeof balance === "object" ? Object.keys(balance).sort() : typeof balance,
+    createdAtType: typeof r.createdAt,
+    updatedAtType: typeof r.updatedAt
+  };
+}
+function isMoneyShape(v) {
+  if (typeof v !== "object" || v === null) return false;
+  const m = v;
+  return typeof m.value === "string" && typeof m.currency === "string";
+}
+function isParentShape(v) {
+  if (typeof v !== "object" || v === null) return false;
+  const p = v;
+  return (p.kind === "account" || p.kind === "organization") && typeof p.id === "string";
+}
+function isFiniteNonNegativeInteger(v) {
+  return typeof v === "number" && Number.isFinite(v) && Number.isInteger(v) && v >= 0;
+}
+function validateWireSubAccount(raw) {
+  if (typeof raw !== "object" || raw === null) {
+    return { ok: false, reason: "not an object" };
+  }
+  const r = raw;
+  if (r.object !== "sub_account") {
+    return { ok: false, reason: `object must be "sub_account" (got ${String(r.object)})` };
+  }
+  if (typeof r.id !== "string" || r.id.length === 0) {
+    return { ok: false, reason: "id must be a non-empty string" };
+  }
+  if (!isParentShape(r.parent)) {
+    return { ok: false, reason: "parent must be { kind: 'account' | 'organization', id: string }" };
+  }
+  if (typeof r.name !== "string") {
+    return { ok: false, reason: "name must be a string" };
+  }
+  if (r.purpose !== void 0 && typeof r.purpose !== "string") {
+    return { ok: false, reason: "purpose must be a string when present" };
+  }
+  if (r.status !== "active" && r.status !== "archived") {
+    return { ok: false, reason: `status must be "active" | "archived" (got ${String(r.status)})` };
+  }
+  if (!isMoneyShape(r.balance)) {
+    return { ok: false, reason: "balance must be { value: string, currency: string }" };
+  }
+  if (!isFiniteNonNegativeInteger(r.createdAt)) {
+    return { ok: false, reason: "createdAt must be a finite non-negative integer (epoch ms)" };
+  }
+  if (r.updatedAt !== void 0 && !isFiniteNonNegativeInteger(r.updatedAt)) {
+    return { ok: false, reason: "updatedAt must be a finite non-negative integer when present" };
+  }
+  return { ok: true, value: r };
+}
+function brandSubAccount(raw) {
+  const result = validateWireSubAccount(raw);
+  if (!result.ok) {
+    throw malformedWireError(result.reason, raw);
+  }
+  const wire = result.value;
+  return {
+    object: wire.object,
+    id: toSubAccountId(wire.id),
+    parent: wire.parent,
+    name: wire.name,
+    ...wire.purpose !== void 0 ? { purpose: wire.purpose } : {},
+    status: wire.status,
+    balance: wire.balance,
+    createdAt: new Date(wire.createdAt).toISOString()
+  };
+}
+function tryBrandSubAccount(raw) {
+  try {
+    return [null, brandSubAccount(raw)];
+  } catch (err) {
+    if (err instanceof CapxulError && err.code === "PROVIDER_ERROR") {
+      return [err, null];
+    }
+    return [
+      malformedWireError(
+        err instanceof Error ? err.message : String(err),
+        raw
+      ),
+      null
+    ];
+  }
+}
+function createSubAccountsClient(config = {}) {
+  return {
+    retrieve: async (subAccountId) => {
+      if (!config._data) {
+        return stub("subAccounts.retrieve");
+      }
+      const [err, raw] = await tryCatch(
+        config._data.query(api.subAccounts.queries.retrieve, {
+          subAccountId
+        })
+      );
+      if (err) {
+        return [
+          fromConvexError(err),
+          null
+        ];
+      }
+      if (!raw) {
+        return [
+          new CapxulError({
+            code: "NOT_FOUND",
+            message: `sub_account ${subAccountId} not found`
+          }),
+          null
+        ];
+      }
+      const [brandErr, branded] = tryBrandSubAccount(raw);
+      if (brandErr) {
+        return [brandErr, null];
+      }
+      return [null, branded];
+    },
+    remove: async (subAccountId) => {
+      if (!config._data) {
+        return stub("subAccounts.remove");
+      }
+      const [err, raw] = await tryCatch(
+        config._data.mutation(api.subAccounts.mutations.archive, {
+          subAccountId
+        })
+      );
+      if (err) {
+        return [
+          fromConvexError(err),
+          null
+        ];
+      }
+      if (!raw) {
+        return [
+          new CapxulError({
+            code: "NOT_FOUND",
+            message: `sub_account ${subAccountId} not found`
+          }),
+          null
+        ];
+      }
+      const [brandErr, branded] = tryBrandSubAccount(raw);
+      if (brandErr) {
+        return [brandErr, null];
+      }
+      return [null, branded];
+    }
+  };
+}
+
 // src/core/accounts.ts
 function createAccountExternalAccountsClient(config) {
   return {
     create: async (input) => {
-      if (!config.data) {
+      if (!config._data) {
         return stub(
           "accounts.externalAccounts.create"
         );
       }
       const [err, raw] = await tryCatch(
-        config.data.mutation(
+        config._data.mutation(
           api.externalAccounts.mutations.createPersonal,
           {
             kind: input.kind,
@@ -348,13 +690,13 @@ function createAccountExternalAccountsClient(config) {
       ];
     },
     list: async (input) => {
-      if (!config.data) {
+      if (!config._data) {
         return stub(
           "accounts.externalAccounts.list"
         );
       }
       const [err, result] = await tryCatch(
-        config.data.query(api.externalAccounts.queries.listPersonal, {
+        config._data.query(api.externalAccounts.queries.listPersonal, {
           limit: input.limit,
           cursor: input.cursor
         })
@@ -377,13 +719,13 @@ function createAccountExternalAccountsClient(config) {
       ];
     },
     retrieve: async (externalAccountId) => {
-      if (!config.data) {
+      if (!config._data) {
         return stub(
           "accounts.externalAccounts.retrieve"
         );
       }
       const [err, raw] = await tryCatch(
-        config.data.query(api.externalAccounts.queries.retrievePersonal, {
+        config._data.query(api.externalAccounts.queries.retrievePersonal, {
           externalAccountId
         })
       );
@@ -410,11 +752,11 @@ function createAccountExternalAccountsClient(config) {
       ];
     },
     remove: async (externalAccountId) => {
-      if (!config.data) {
+      if (!config._data) {
         return stub("accounts.externalAccounts.remove");
       }
       const [err] = await tryCatch(
-        config.data.mutation(api.externalAccounts.mutations.removePersonal, {
+        config._data.mutation(api.externalAccounts.mutations.removePersonal, {
           externalAccountId
         })
       );
@@ -428,43 +770,191 @@ function createAccountExternalAccountsClient(config) {
     }
   };
 }
-function createAccountsClient(config = {}) {
+function createAccountSubAccountsClient(config) {
   return {
-    retrieve: async (accountId) => {
-      if (!config.data) {
-        return stub("accounts.retrieve");
-      }
-      try {
-        const account = await config.data.query(
-          api.openfort.queries.getMyAccount,
-          {}
+    create: async (input) => {
+      if (!config._data) {
+        return stub(
+          "accounts.subAccounts.create"
         );
-        if (account.id !== accountId) {
-          return [
-            new CapxulError({
-              code: "PERMISSION_DENIED",
-              message: "accounts.retrieve currently supports the authenticated caller's own account only.",
-              details: {
-                requestedAccountId: accountId,
-                authenticatedAccountId: account.id
-              }
-            }),
-            null
-          ];
-        }
-        return [null, account];
-      } catch (cause) {
-        return [fromConvexError(cause), null];
       }
-    },
-    lookup: async () => stub("accounts.lookup"),
-    update: async (input) => {
-      if (!config.data) {
-        return stub("accounts.update");
-      }
-      if (input.countryCode !== void 0) {
-        return [
-          new CapxulError({
+      const [err, raw] = await tryCatch(
+        config._data.mutation(api.subAccounts.mutations.create, {
+          parent: { kind: "account", id: input.accountId },
+          name: input.name,
+          purpose: input.purpose
+        })
+      );
+      if (err) {
+        return [
+          fromConvexError(err),
+          null
+        ];
+      }
+      if (!raw) {
+        return [
+          new CapxulError({
+            code: "NOT_FOUND",
+            message: "sub_account creation returned no resource"
+          }),
+          null
+        ];
+      }
+      const [brandErr, branded] = tryBrandSubAccount(raw);
+      if (brandErr) {
+        return [
+          brandErr,
+          null
+        ];
+      }
+      return [null, branded];
+    },
+    list: async (input) => {
+      if (!config._data) {
+        return stub(
+          "accounts.subAccounts.list"
+        );
+      }
+      const [err, rows] = await tryCatch(
+        config._data.query(api.subAccounts.queries.listByAccount, {
+          accountId: input.accountId
+        })
+      );
+      if (err) {
+        return [
+          fromConvexError(err),
+          null
+        ];
+      }
+      const branded = [];
+      for (const row of rows) {
+        const [brandErr, value] = tryBrandSubAccount(row);
+        if (brandErr) {
+          return [
+            brandErr,
+            null
+          ];
+        }
+        branded.push(value);
+      }
+      return [
+        null,
+        {
+          object: "list",
+          data: branded,
+          page: { hasMore: false }
+        }
+      ];
+    },
+    retrieve: async (subAccountId) => {
+      if (!config._data) {
+        return stub(
+          "accounts.subAccounts.retrieve"
+        );
+      }
+      const [err, raw] = await tryCatch(
+        config._data.query(api.subAccounts.queries.retrieve, {
+          subAccountId
+        })
+      );
+      if (err) {
+        return [
+          fromConvexError(err),
+          null
+        ];
+      }
+      if (!raw) {
+        return [
+          new CapxulError({
+            code: "NOT_FOUND",
+            message: `sub_account ${subAccountId} not found`
+          }),
+          null
+        ];
+      }
+      const [brandErr, branded] = tryBrandSubAccount(raw);
+      if (brandErr) {
+        return [
+          brandErr,
+          null
+        ];
+      }
+      return [null, branded];
+    },
+    remove: async (subAccountId) => {
+      if (!config._data) {
+        return stub(
+          "accounts.subAccounts.remove"
+        );
+      }
+      const [err, raw] = await tryCatch(
+        config._data.mutation(api.subAccounts.mutations.archive, {
+          subAccountId
+        })
+      );
+      if (err) {
+        return [
+          fromConvexError(err),
+          null
+        ];
+      }
+      if (!raw) {
+        return [
+          new CapxulError({
+            code: "NOT_FOUND",
+            message: `sub_account ${subAccountId} not found`
+          }),
+          null
+        ];
+      }
+      const [brandErr, branded] = tryBrandSubAccount(raw);
+      if (brandErr) {
+        return [
+          brandErr,
+          null
+        ];
+      }
+      return [null, branded];
+    }
+  };
+}
+function createAccountsClient(config = {}) {
+  return {
+    retrieve: async (accountId) => {
+      if (!config._data) {
+        return stub("accounts.retrieve");
+      }
+      try {
+        const account = await config._data.query(
+          api.openfort.queries.getMyAccount,
+          {}
+        );
+        if (account.id !== accountId) {
+          return [
+            new CapxulError({
+              code: "PERMISSION_DENIED",
+              message: "accounts.retrieve currently supports the authenticated caller's own account only.",
+              details: {
+                requestedAccountId: accountId,
+                authenticatedAccountId: account.id
+              }
+            }),
+            null
+          ];
+        }
+        return [null, account];
+      } catch (cause) {
+        return [fromConvexError(cause), null];
+      }
+    },
+    lookup: async () => stub("accounts.lookup"),
+    update: async (input) => {
+      if (!config._data) {
+        return stub("accounts.update");
+      }
+      if (input.countryCode !== void 0) {
+        return [
+          new CapxulError({
             code: "INVALID_INPUT",
             message: "accounts.update does not support countryCode yet \u2014 backend mutation only patches displayName and username.",
             details: { field: "countryCode" }
@@ -473,7 +963,7 @@ function createAccountsClient(config = {}) {
         ];
       }
       try {
-        const current = await config.data.query(
+        const current = await config._data.query(
           api.openfort.queries.getMyAccount,
           {}
         );
@@ -490,11 +980,11 @@ function createAccountsClient(config = {}) {
             null
           ];
         }
-        await config.data.mutation(api.openfort.mutations.updateProfile, {
+        await config._data.mutation(api.openfort.mutations.updateProfile, {
           displayName: input.name,
           username: input.username
         });
-        const updated = await config.data.query(
+        const updated = await config._data.query(
           api.openfort.queries.getMyAccount,
           {}
         );
@@ -504,7 +994,7 @@ function createAccountsClient(config = {}) {
       }
     },
     provisionPersonal: async (input) => {
-      if (!config.data) {
+      if (!config._data) {
         return stub(
           "accounts.provisionPersonal"
         );
@@ -519,17 +1009,17 @@ function createAccountsClient(config = {}) {
         ];
       }
       try {
-        await config.data.mutation(
+        await config._data.mutation(
           api.safe.mutations.provisionLocalPersonalAccount,
           {
             displayName: input.displayName,
             username: input.username,
             countryCode: input.countryCode,
             eoaAddress: input.signerProvider.signerAddress,
-            safeAddress: input.signerProvider.safeAddress
+            safeAddress: deriveSafeAddress(input.signerProvider.signerAddress)
           }
         );
-        const account = await config.data.query(
+        const account = await config._data.query(
           api.openfort.queries.getMyAccount,
           {}
         );
@@ -552,11 +1042,11 @@ function createAccountsClient(config = {}) {
     },
     safes: {
       retrieve: async (safeId) => {
-        if (!config.data) {
+        if (!config._data) {
           return stub("accounts.safes.retrieve");
         }
         try {
-          const safe = await config.data.query(
+          const safe = await config._data.query(
             api.safe.queries.retrieveAccountSafe,
             { safeId }
           );
@@ -583,19 +1073,50 @@ function createAccountsClient(config = {}) {
       retrieve: async () => stub("accounts.kycProfiles.retrieve")
     },
     externalAccounts: createAccountExternalAccountsClient(config),
-    subAccounts: {
-      create: async () => stub("accounts.subAccounts.create"),
-      list: async () => stub("accounts.subAccounts.list"),
-      retrieve: async () => stub("accounts.subAccounts.retrieve"),
-      remove: async () => stub("accounts.subAccounts.remove")
-    },
+    subAccounts: createAccountSubAccountsClient(config),
     balanceLedger: {
-      list: async () => stub(
-        "accounts.balanceLedger.list"
-      ),
-      retrieve: async () => stub(
-        "accounts.balanceLedger.retrieve"
-      )
+      list: async (input) => {
+        if (!config._data) {
+          return stub(
+            "accounts.balanceLedger.list"
+          );
+        }
+        try {
+          const accountId = input.accountId.replace(/^acct_/, "");
+          const page = await config._data.query(
+            api.balanceLedger.queries.listForAccount,
+            { accountId, limit: input.limit, cursor: input.cursor }
+          );
+          return [null, page];
+        } catch (cause) {
+          return [fromConvexError(cause), null];
+        }
+      },
+      retrieve: async (entryId) => {
+        if (!config._data) {
+          return stub(
+            "accounts.balanceLedger.retrieve"
+          );
+        }
+        try {
+          const entry = await config._data.query(
+            api.balanceLedger.queries.retrieve,
+            { entryId }
+          );
+          if (!entry) {
+            return [
+              new CapxulError({
+                code: "NOT_FOUND",
+                message: `balance_ledger_entry ${entryId} not found`
+              }),
+              null
+            ];
+          }
+          return [null, entry];
+        } catch (cause) {
+          return [fromConvexError(cause), null];
+        }
+      }
     }
   };
 }
@@ -609,130 +1130,21 @@ function createApiKeysClient() {
     revoke: async () => stub("apiKeys.revoke")
   };
 }
+function createDefaultDataClient(convexUrl, jwt) {
+  const client = new ConvexHttpClient(convexUrl);
+  client.setAuth(jwt);
+  return client;
+}
 
-// ../config/src/chain.ts
-var CAPXUL_PAYMENTS_ADDRESS = "0xe740ea65521edc9bef0ea75d30b5334711db99f4";
-var TEST_USDC_ADDRESS = "0xf09fcbb6df9f8f918e58f9c8ab15a76ade862b77";
-var CAPXUL_API_BASE_URL = "https://elated-oyster-269.convex.site";
-
-// ../config/src/timing.ts
-var FLOW_INVOKE_TIMEOUT_MS = 3e4;
-var WEBHOOK_FRESHNESS_WINDOW_MS = 5 * 60 * 1e3;
-
-// ../config/src/errors.ts
-var CapxulError2 = class extends Error {
-  code;
-  details;
-  correlationId;
-  layer;
-  constructor(code, message, options) {
-    super(message, options?.cause ? { cause: options.cause } : void 0);
-    this.code = code;
-    this.details = options?.details;
-    this.correlationId = options?.correlationId;
-    this.layer = options?.layer;
-  }
-};
-var Errors = {
-  notAuthenticated: () => new CapxulError2("NOT_AUTHENTICATED", "Not authenticated"),
-  profileNotFound: (authUserId) => new CapxulError2("PROFILE_NOT_FOUND", `Profile not found for user ${authUserId}`),
-  smartAccountMissing: (authUserId) => new CapxulError2("SMART_ACCOUNT_MISSING", `Smart account not provisioned for user ${authUserId}`),
-  envMissing: (name) => new CapxulError2("ENV_MISSING", `Environment variable ${name} not configured`),
-  openfortApi: (operation, cause) => new CapxulError2(
-    "PROVIDER_ERROR",
-    `Openfort ${operation} failed: ${cause instanceof Error ? cause.message : String(cause)}`,
-    { cause, details: { provider: "openfort", operation } }
-  ),
-  shieldApi: (status, detail) => new CapxulError2(
-    "PROVIDER_ERROR",
-    `Shield API error (${status}): ${detail}`,
-    { details: { provider: "shield", status } }
-  ),
-  providerError: (provider, operation, cause) => new CapxulError2(
-    "PROVIDER_ERROR",
-    `${provider} ${operation} failed: ${cause instanceof Error ? cause.message : String(cause)}`,
-    { cause, details: { provider, operation } }
-  ),
-  invalidInput: (field, reason) => new CapxulError2(
-    "INVALID_INPUT",
-    `Invalid ${field}: ${reason}`,
-    { details: { field, reason } }
-  ),
-  playerNotFound: (playerId) => new CapxulError2(
-    "PLAYER_NOT_FOUND",
-    playerId ? `Openfort player ${playerId} not found` : "Openfort player not found"
-  ),
-  accountNotFound: (accountId) => new CapxulError2(
-    "ACCOUNT_NOT_FOUND",
-    accountId ? `Openfort account ${accountId} not found` : "Openfort smart account not found"
-  ),
-  invalidRecipient: (reason) => new CapxulError2("INVALID_RECIPIENT", reason),
-  permissionDenied: (reason = "Permission denied") => new CapxulError2("PERMISSION_DENIED", reason),
-  notFound: (resource, id) => new CapxulError2(
-    "NOT_FOUND",
-    id ? `${resource} ${id} not found` : `${resource} not found`
-  ),
-  idempotencyConflict: (details) => new CapxulError2(
-    "IDEMPOTENCY_CONFLICT",
-    "Idempotency key was already used for a different request",
-    { details }
-  ),
-  emailDeliveryFailed: (detail, details) => new CapxulError2("EMAIL_DELIVERY_FAILED", `Failed to send email: ${detail}`, {
-    details
-  }),
-  rateLimited: (details) => new CapxulError2("RATE_LIMITED", "Request was rate limited", {
-    details: { ...details }
-  }),
-  internalError: (reason) => new CapxulError2("INTERNAL_ERROR", `Internal error: ${reason}`),
-  /**
-   * Verification gate. Surfaced when a request hits a verification
-   * boundary the actor cannot cross under their current state. Two
-   * variants share this code:
-   *
-   * - Rail gate (Withdrawals v1 W2, #465): the resolved
-   *   `external_account.kind` routes to a withdrawal rail (e.g.
-   *   `fiat_offramp`, `card_payout`) that is not yet supported. Carries
-   *   `details.rail` + `details.currentKind`.
-   * - KYC tier gate (legacy / future): the actor's KYC tier is below
-   *   the required tier. Carries `details.requiredTier`.
-   *
-   * Code is shared because both expose the same UX shape ("you cannot
-   * proceed until verification advances"); the `details.*` keys
-   * differentiate the route.
-   */
-  verificationRequired: (details) => {
-    const message = "rail" in details ? `Withdrawal rail "${details.rail}" (kind=${details.currentKind}) is not yet supported.` : `Verification tier ${details.requiredTier} is required.`;
-    return new CapxulError2("VERIFICATION_REQUIRED", message, {
-      details: { ...details }
-    });
-  }
-};
-
-// ../config/src/safe.ts
-var SAFE_PROXY_FACTORY = "0x4e1dcf7ad4e460cfd30791ccc4f9c8a4f820ec67";
-var SAFE_L2_SINGLETON = "0x29fcb43b46531bca003ddc8fcb67ffe91900c762";
-var SAFE_MODULE_SETUP = "0x2dd68b007b46fbe91b9a7c3eda5a7a1063cb5b47";
-var SAFE_4337_MODULE = "0x75cf11467937ce3f2f357ce24ffc3dbf8fd5c226";
-
-// ../config/src/org-roles.ts
-function roleKeyFromLabel(label) {
-  const bytes = new TextEncoder().encode(label);
-  const hex = Array.from(bytes).map((b) => b.toString(16).padStart(2, "0")).join("");
-  return "0x" + hex.padEnd(64, "0");
-}
-roleKeyFromLabel("OWNER");
-roleKeyFromLabel("FINANCE_MANAGER");
-roleKeyFromLabel("TEAM_LEAD");
-
-// src/transport.ts
-function makeHttpTransport(config) {
-  switch (config.mode) {
-    case "build-time-urls":
-      return makeBuildTimeUrlsTransport(config);
-    case "publishable-key":
-      return makePublishableKeyTransport(config);
-    default:
-      return assertNever(config);
+// src/transport.ts
+function makeHttpTransport(config) {
+  switch (config.mode) {
+    case "build-time-urls":
+      return makeBuildTimeUrlsTransport(config);
+    case "publishable-key":
+      return makePublishableKeyTransport(config);
+    default:
+      return assertNever(config);
   }
 }
 function createLifecycle(initial) {
@@ -1053,7 +1465,7 @@ function readNonEmptyString(value) {
 
 // src/core/auth.ts
 function createAuthClient(config = {}) {
-  let dataClient = config.data ?? null;
+  let dataClient = config._data ?? null;
   const sessionStore = config.auth?.sessionStore ?? createMemorySessionStore();
   const getTransport = createTransportProvider(config);
   return {
@@ -1109,11 +1521,20 @@ function createAuthClient(config = {}) {
         ).toISOString()
       };
       sessionStore.set(session);
-      if (config.auth?.createDataClient) {
+      if (!dataClient) {
         try {
-          dataClient = await config.auth.createDataClient(session);
-          mutableConfig(config).data = dataClient;
-          transport.markAuthenticated({ dataClient });
+          const convexUrl = transport.convexUrl;
+          if (!convexUrl || !session.convexJwt) {
+            return [
+              new CapxulError({
+                code: "NETWORK_ERROR",
+                message: "Cannot create data client: missing convex URL or JWT."
+              }),
+              null
+            ];
+          }
+          dataClient = createDefaultDataClient(convexUrl, session.convexJwt);
+          mutableConfig(config)._data = dataClient;
         } catch (cause) {
           return [
             new CapxulError({
@@ -1124,14 +1545,89 @@ function createAuthClient(config = {}) {
             null
           ];
         }
+      } else {
+        const injected = dataClient;
+        if (typeof injected.refreshAuth === "function") {
+          injected.refreshAuth();
+        } else if (typeof injected.setAuth === "function" && session.convexJwt) {
+          injected.setAuth(session.convexJwt);
+        }
+      }
+      transport.markAuthenticated({ dataClient });
+      if (!dataClient) {
+        return [
+          new CapxulError({
+            code: "NOT_AUTHENTICATED",
+            message: "Auth bootstrap requires an authenticated Convex data client."
+          }),
+          null
+        ];
+      }
+      try {
+        const resolution = await dataClient.mutation(
+          api.authBootstrap.resolveAfterOtp,
+          {
+            email: session.email,
+            sessionToken: session.token
+          }
+        );
+        if (resolution.kind === "existing_member") {
+          return [null, { ...resolution, session }];
+        }
+        return [null, { ...resolution, session }];
+      } catch (cause) {
+        return [fromConvexError(cause), null];
+      }
+    },
+    completeBootstrap: async (input) => {
+      const session = sessionStore.get();
+      const data = dataClient ?? config._data;
+      if (!session || !data) {
+        return [
+          new CapxulError({
+            code: "INVALID_INPUT",
+            message: "completeBootstrap requires the OTP-verified session that issued the bootstrap token."
+          }),
+          null
+        ];
+      }
+      const signerAddress = config.signer?.address;
+      if (!signerAddress) {
+        return [
+          new CapxulError({
+            code: "INVALID_INPUT",
+            message: "completeBootstrap requires a signer to be configured on the client."
+          }),
+          null
+        ];
+      }
+      try {
+        const safeAddress = deriveSafeAddress(signerAddress);
+        const result = await data.mutation(api.authBootstrap.completeBootstrap, {
+          bootstrapToken: input.bootstrapToken,
+          sessionToken: session.token,
+          username: input.username,
+          displayName: input.displayName,
+          countryCode: input.countryCode,
+          signerProvider: {
+            kind: "local-private-key",
+            signerAddress,
+            safeAddress
+          }
+        });
+        return [null, { kind: "authenticated", session, ...result }];
+      } catch (cause) {
+        return [
+          fromConvexError(cause),
+          null
+        ];
       }
-      return [null, session];
     },
     getSession: async () => [null, sessionStore.get()],
     signOut: async () => {
       sessionStore.clear();
       dataClient = null;
-      mutableConfig(config).data = void 0;
+      mutableConfig(config)._data = void 0;
       const transport = getTransport();
       transport?.clearAuth();
       return [null, void 0];
@@ -1202,6 +1698,9 @@ async function postBetterAuth(transport, path, body, code, signal) {
     }
     return [null, text ? JSON.parse(text) : void 0];
   } catch (cause) {
+    if (cause instanceof CapxulError) {
+      return [cause, null];
+    }
     return [
       new CapxulError({
         code: "NETWORK_ERROR",
@@ -1240,7 +1739,7 @@ function parseBetterAuthError(text) {
   }
 }
 function isCapxulErrorCode2(code) {
-  return code === "NOT_AUTHENTICATED" || code === "EMAIL_DELIVERY_FAILED" || code === "INVALID_INPUT" || code === "RATE_LIMITED" || code === "NETWORK_ERROR" || code === "API_KEY_INVALID" || code === "API_KEY_EXPIRED";
+  return code === "NOT_AUTHENTICATED" || code === "EMAIL_DELIVERY_FAILED" || code === "INVALID_INPUT" || code === "RATE_LIMITED" || code === "NETWORK_ERROR" || code === "API_KEY_INVALID" || code === "API_KEY_EXPIRED" || code === "INTERNAL_ERROR" || code === "ENV_MISSING" || code === "UNKNOWN" || code === "PROVIDER_ERROR";
 }
 async function exchangeConvexToken(transport, config, token, signal) {
   const path = config.auth?.convexTokenUrl ?? "/convex/token";
@@ -1270,6 +1769,9 @@ async function exchangeConvexToken(transport, config, token, signal) {
     }
     return [null, body.token];
   } catch (cause) {
+    if (cause instanceof CapxulError) {
+      return [cause, null];
+    }
     return [
       new CapxulError({
         code: "NETWORK_ERROR",
@@ -1306,11 +1808,11 @@ function createOrgDocumentsClient() {
 function createMeClient(config = {}) {
   return {
     get: async () => {
-      if (!config.data) {
+      if (!config._data) {
         return stub("me.get");
       }
       try {
-        const account = await config.data.query(
+        const account = await config._data.query(
           api.openfort.queries.getMyAccount,
           {}
         );
@@ -1320,7 +1822,7 @@ function createMeClient(config = {}) {
       }
     },
     update: async (input) => {
-      if (!config.data) {
+      if (!config._data) {
         return stub("me.update");
       }
       if (input.countryCode !== void 0) {
@@ -1334,11 +1836,11 @@ function createMeClient(config = {}) {
         ];
       }
       try {
-        await config.data.mutation(api.openfort.mutations.updateProfile, {
+        await config._data.mutation(api.openfort.mutations.updateProfile, {
           displayName: input.name,
           username: input.username
         });
-        const account = await config.data.query(
+        const account = await config._data.query(
           api.openfort.queries.getMyAccount,
           {}
         );
@@ -1353,11 +1855,11 @@ function createMeClient(config = {}) {
 // src/core/operations.ts
 function createOperationsClient(config = {}) {
   const retrieve = async (operationId) => {
-    if (!config.data) {
+    if (!config._data) {
       return stub("operations.retrieve");
     }
     try {
-      const operation = await config.data.query(api.operations.queries.retrieve, {
+      const operation = await config._data.query(api.operations.queries.retrieve, {
         operationId
       });
       if (!operation) {
@@ -1374,7 +1876,7 @@ function createOperationsClient(config = {}) {
   return {
     retrieve,
     wait: async (operationId, input = {}) => {
-      if (!config.data) {
+      if (!config._data) {
         return stub("operations.wait");
       }
       const until = new Set(
@@ -1409,49 +1911,22 @@ function toTokenUnits(value, decimals = 6) {
   return parseUnits(value, decimals);
 }
 
-// src/internal/payment-token.ts
-function resolvePaymentTokenAddress(currency) {
+// src/core/token-registry.ts
+function resolvePaymentToken(currency) {
   const normalized = currency.trim().toUpperCase();
   if (normalized === "USD" || normalized === "USDC") {
-    return TEST_USDC_ADDRESS.toLowerCase();
+    return {
+      address: TEST_USDC_ADDRESS.toLowerCase(),
+      decimals: 6,
+      symbol: "USDC"
+    };
   }
   throw new CapxulError({
-    code: "NETWORK_ERROR",
-    message: `Currency ${currency} is not configured for on-chain payment submission.`,
+    code: "NOT_IMPLEMENTED",
+    message: `Currency ${currency} is not yet supported by the token registry.`,
     details: { currency: normalized }
   });
 }
-async function buildSafeAccount(signer, chain) {
-  try {
-    const publicClient = createPublicClient({
-      chain: baseSepolia,
-      transport: http(chain.rpcUrl)
-    });
-    return await toSafeSmartAccount({
-      client: publicClient,
-      entryPoint: { address: entryPoint07Address, version: "0.7" },
-      version: "1.4.1",
-      owners: [signer],
-      saltNonce: computeSaltNonce(signer.address),
-      safeSingletonAddress: SAFE_L2_SINGLETON,
-      safeProxyFactoryAddress: SAFE_PROXY_FACTORY,
-      safeModuleSetupAddress: SAFE_MODULE_SETUP,
-      safe4337ModuleAddress: SAFE_4337_MODULE,
-      safeModules: [],
-      setupTransactions: []
-    });
-  } catch (cause) {
-    throw new CapxulError({
-      code: "NETWORK_ERROR",
-      message: cause instanceof Error ? cause.message : String(cause),
-      cause,
-      details: { chainId: chain.chainId }
-    });
-  }
-}
-function computeSaltNonce(ownerAddress) {
-  return BigInt(`0x${ownerAddress.toLowerCase().slice(2).padEnd(64, "0")}`);
-}
 function createCapxulBundler(config) {
   const paymaster = createPaymasterClient({
     transport: http(config.rpcUrl)
@@ -1558,13 +2033,13 @@ async function transferAsOwner(config, params) {
 function createPaymentsClient(config = {}) {
   return {
     create: async (input) => {
-      if (!config.data || !config.signer || !config.signing) {
+      if (!config._data || !config.signer || !config.signing) {
         return stub("payments.create");
       }
       let created = null;
       let submitted = null;
       try {
-        created = await config.data.mutation(api.payments.mutations.create, {
+        created = await config._data.mutation(api.payments.mutations.create, {
           to: input.to,
           amount: input.amount,
           reference: input.reference,
@@ -1572,15 +2047,21 @@ function createPaymentsClient(config = {}) {
           source: input.source
         });
         if (!created) {
-          return [new CapxulError({
-            code: "NETWORK_ERROR",
-            message: "payments.create returned no payment resource"
-          }), null];
+          return [
+            new CapxulError({
+              code: "NETWORK_ERROR",
+              message: "payments.create returned no payment resource"
+            }),
+            null
+          ];
         }
         if (created.status !== "processing" || created.operation.status !== "processing") {
           return [null, created];
         }
-        const currentSigner = await config.data.query(api.safe.queries.getMySignerAddress, {});
+        const currentSigner = await config._data.query(
+          api.safe.queries.getMySignerAddress,
+          {}
+        );
         if (!currentSigner?.address) {
           throw new CapxulError({
             code: "PERMISSION_DENIED",
@@ -1599,9 +2080,12 @@ function createPaymentsClient(config = {}) {
             }
           });
         }
-        const submission = await config.data.query(api.payments.queries.prepareSubmission, {
-          paymentId: created.id
-        });
+        const submission = await config._data.query(
+          api.payments.queries.prepareSubmission,
+          {
+            paymentId: created.id
+          }
+        );
         if (!submission?.recipientAddress) {
           throw new CapxulError({
             code: "NETWORK_ERROR",
@@ -1609,15 +2093,16 @@ function createPaymentsClient(config = {}) {
             details: { paymentId: created.id }
           });
         }
+        const token = resolvePaymentToken(submission.amount.currency);
         const transfer = await transferAsOwner(
           {
             signer: config.signer,
             signing: config.signing
           },
           {
-            tokenAddress: resolvePaymentTokenAddress(submission.amount.currency),
+            tokenAddress: token.address,
             recipientAddress: submission.recipientAddress,
-            amount: toTokenUnits(submission.amount.value, 6)
+            amount: toTokenUnits(submission.amount.value, token.decimals)
           }
         );
         if (!transfer.success) {
@@ -1635,7 +2120,7 @@ function createPaymentsClient(config = {}) {
           txHash: transfer.txHash,
           userOpHash: transfer.userOpHash
         };
-        await config.data.mutation(api.payments.mutations.recordSubmitted, {
+        await config._data.mutation(api.payments.mutations.recordSubmitted, {
           paymentId: created.id,
           txHash: transfer.txHash,
           userOpHash: transfer.userOpHash,
@@ -1645,43 +2130,65 @@ function createPaymentsClient(config = {}) {
       } catch (cause) {
         const error = mapCreateError(fromConvexError(cause));
         if (created?.id && created.status === "processing" && !submitted) {
-          await bestEffortMarkFailed({ data: config.data }, created.id, error);
+          await bestEffortMarkFailed({ _data: config._data }, created.id, error);
         }
         if (submitted && created?.id) {
-          return [new CapxulError({
-            code: "NETWORK_ERROR",
-            message: "Payment was submitted on-chain, but backend submission tracking failed.",
-            cause,
-            details: {
-              paymentId: created.id,
-              txHash: submitted.txHash,
-              userOpHash: submitted.userOpHash
-            }
-          }), null];
+          return [
+            new CapxulError({
+              code: "NETWORK_ERROR",
+              message: "Payment was submitted on-chain, but backend submission tracking failed.",
+              cause,
+              details: {
+                paymentId: created.id,
+                txHash: submitted.txHash,
+                userOpHash: submitted.userOpHash
+              }
+            }),
+            null
+          ];
         }
         return [error, null];
       }
     },
     retrieve: async (paymentId) => {
-      if (!config.data) {
+      if (!config._data) {
         return stub("payments.retrieve");
       }
       try {
-        const payment = await config.data.query(api.payments.queries.retrieve, {
-          paymentId
-        });
+        const payment = await config._data.query(
+          api.payments.queries.retrieve,
+          {
+            paymentId
+          }
+        );
         if (!payment) {
-          return [new CapxulError({
-            code: "NOT_FOUND",
-            message: `payment ${paymentId} not found`
-          }), null];
+          return [
+            new CapxulError({
+              code: "NOT_FOUND",
+              message: `payment ${paymentId} not found`
+            }),
+            null
+          ];
         }
         return [null, payment];
       } catch (cause) {
         return [fromConvexError(cause), null];
       }
     },
-    list: async () => stub("payments.list")
+    list: async (input) => {
+      if (!config._data) {
+        return stub("payments.list");
+      }
+      try {
+        const page = await config._data.query(api.payments.queries.list, {
+          limit: input?.limit,
+          cursor: input?.cursor
+        });
+        return [null, page];
+      } catch (cause) {
+        return [fromConvexError(cause), null];
+      }
+    }
   };
 }
 function createOrgPaymentsClient() {
@@ -1695,7 +2202,7 @@ function createOrgPaymentsClient() {
 }
 async function bestEffortMarkFailed(config, paymentId, error) {
   try {
-    await config.data.mutation(api.payments.mutations.markFailed, {
+    await config._data.mutation(api.payments.mutations.markFailed, {
       paymentId,
       errorCode: error.code,
       errorMessage: error.message,
@@ -1752,11 +2259,11 @@ function createOrgTransfersClient() {
 function createWithdrawalsClient(config = {}) {
   return {
     create: async (input) => {
-      if (!config.data) {
+      if (!config._data) {
         return stub("withdrawals.create");
       }
       const [createErr, createdRaw] = await tryCatch(
-        config.data.mutation(api.withdrawals.mutations.create, {
+        config._data.mutation(api.withdrawals.mutations.create, {
           amount: input.amount,
           destination: {
             externalAccountId: input.destination.externalAccountId
@@ -1786,18 +2293,18 @@ function createWithdrawalsClient(config = {}) {
         return [null, created];
       }
       const [signerErr, currentSigner] = await tryCatch(
-        config.data.query(api.safe.queries.getMySignerAddress, {})
+        config._data.query(api.safe.queries.getMySignerAddress, {})
       );
       if (signerErr) {
         return await handleSubmissionFailure(
-          { data: config.data },
+          { _data: config._data },
           created.id,
           mapCreateError2(fromConvexError(signerErr))
         );
       }
       if (!currentSigner?.address) {
         return await handleSubmissionFailure(
-          { data: config.data },
+          { _data: config._data },
           created.id,
           new CapxulError({
             code: "PERMISSION_DENIED",
@@ -1808,7 +2315,7 @@ function createWithdrawalsClient(config = {}) {
       }
       if (getAddress(currentSigner.address) !== getAddress(config.signer.address)) {
         return await handleSubmissionFailure(
-          { data: config.data },
+          { _data: config._data },
           created.id,
           new CapxulError({
             code: "PERMISSION_DENIED",
@@ -1822,13 +2329,13 @@ function createWithdrawalsClient(config = {}) {
         );
       }
       const [prepErr, submission] = await tryCatch(
-        config.data.query(api.withdrawals.queries.prepareSubmission, {
+        config._data.query(api.withdrawals.queries.prepareSubmission, {
           withdrawalId: created.id
         })
       );
       if (prepErr) {
         return await handleSubmissionFailure(
-          { data: config.data },
+          { _data: config._data },
           created.id,
           mapCreateError2(fromConvexError(prepErr))
         );
@@ -1836,7 +2343,7 @@ function createWithdrawalsClient(config = {}) {
       const destinationAddress = submission?.destinationAddress;
       if (!submission || !destinationAddress) {
         return await handleSubmissionFailure(
-          { data: config.data },
+          { _data: config._data },
           created.id,
           new CapxulError({
             code: "NETWORK_ERROR",
@@ -1845,6 +2352,7 @@ function createWithdrawalsClient(config = {}) {
           })
         );
       }
+      const token = resolvePaymentToken(submission.amount.currency);
       const [transferErr, transferOk] = await tryCatch(
         transferAsOwner(
           {
@@ -1852,22 +2360,22 @@ function createWithdrawalsClient(config = {}) {
             signing: config.signing
           },
           {
-            tokenAddress: resolvePaymentTokenAddress(submission.amount.currency),
+            tokenAddress: token.address,
             recipientAddress: destinationAddress,
-            amount: toTokenUnits(submission.amount.value, 6)
+            amount: toTokenUnits(submission.amount.value, token.decimals)
           }
         )
       );
       if (transferErr) {
         return await handleSubmissionFailure(
-          { data: config.data },
+          { _data: config._data },
           created.id,
           mapCreateError2(fromConvexError(transferErr))
         );
       }
       if (!transferOk.success) {
         return await handleSubmissionFailure(
-          { data: config.data },
+          { _data: config._data },
           created.id,
           new CapxulError({
             code: "NETWORK_ERROR",
@@ -1881,7 +2389,7 @@ function createWithdrawalsClient(config = {}) {
         );
       }
       const [recordErr] = await tryCatch(
-        config.data.mutation(api.withdrawals.mutations.recordSubmitted, {
+        config._data.mutation(api.withdrawals.mutations.recordSubmitted, {
           withdrawalId: created.id,
           txHash: transferOk.txHash,
           userOpHash: transferOk.userOpHash
@@ -1905,11 +2413,11 @@ function createWithdrawalsClient(config = {}) {
       return [null, created];
     },
     retrieve: async (withdrawalId) => {
-      if (!config.data) {
+      if (!config._data) {
         return stub("withdrawals.retrieve");
       }
       const [err, raw] = await tryCatch(
-        config.data.query(api.withdrawals.queries.retrieve, { withdrawalId })
+        config._data.query(api.withdrawals.queries.retrieve, { withdrawalId })
       );
       if (err) {
         return [fromConvexError(err), null];
@@ -1927,11 +2435,11 @@ function createWithdrawalsClient(config = {}) {
       return [null, withdrawal];
     },
     list: async (input) => {
-      if (!config.data) {
+      if (!config._data) {
         return stub("withdrawals.list");
       }
       const [err, raw] = await tryCatch(
-        config.data.query(api.withdrawals.queries.list, {
+        config._data.query(api.withdrawals.queries.list, {
           limit: input?.limit,
           cursor: input?.cursor
         })
@@ -1942,13 +2450,13 @@ function createWithdrawalsClient(config = {}) {
       return [null, raw];
     },
     recordCompleted: async (input) => {
-      if (!config.data) {
+      if (!config._data) {
         return stub(
           "withdrawals.recordCompleted"
         );
       }
       const [err] = await tryCatch(
-        config.data.mutation(api.withdrawals.mutations.recordCompleted, {
+        config._data.mutation(api.withdrawals.mutations.recordCompleted, {
           withdrawalId: input.withdrawalId,
           txHash: input.txHash
         })
@@ -1973,13 +2481,13 @@ function createOrgWithdrawalsClient(config = {}) {
      * orchestration ships in W3+.
      */
     create: async (input) => {
-      if (!config.data) {
+      if (!config._data) {
         return stub(
           "organizations.withdrawals.create"
         );
       }
       const [err, raw] = await tryCatch(
-        config.data.mutation(api.withdrawals.mutations.createOrg, {
+        config._data.mutation(api.withdrawals.mutations.createOrg, {
           organizationId: input.organizationId,
           amount: input.amount,
           destination: {
@@ -2006,13 +2514,13 @@ function createOrgWithdrawalsClient(config = {}) {
       return [null, created];
     },
     retrieve: async (input) => {
-      if (!config.data) {
+      if (!config._data) {
         return stub(
           "organizations.withdrawals.retrieve"
         );
       }
       const [err, raw] = await tryCatch(
-        config.data.query(api.withdrawals.queries.retrieve, {
+        config._data.query(api.withdrawals.queries.retrieve, {
           withdrawalId: input.withdrawalId
         })
       );
@@ -2042,13 +2550,13 @@ function createOrgWithdrawalsClient(config = {}) {
       return [null, withdrawal];
     },
     list: async (input) => {
-      if (!config.data) {
+      if (!config._data) {
         return stub(
           "organizations.withdrawals.list"
         );
       }
       const [err, raw] = await tryCatch(
-        config.data.query(api.withdrawals.queries.listOrg, {
+        config._data.query(api.withdrawals.queries.listOrg, {
           organizationId: input.organizationId,
           limit: input.limit,
           cursor: input.cursor
@@ -2067,7 +2575,7 @@ async function handleSubmissionFailure(config, withdrawalId, error) {
 }
 async function bestEffortMarkFailed2(config, withdrawalId, error) {
   await tryCatch(
-    config.data.mutation(api.withdrawals.mutations.markFailed, {
+    config._data.mutation(api.withdrawals.mutations.markFailed, {
       withdrawalId,
       errorCode: error.code,
       errorMessage: error.message
@@ -2146,13 +2654,13 @@ function createWebhookEventsClient() {
 function createOrgExternalAccountsClient(config) {
   return {
     create: async (input) => {
-      if (!config.data) {
+      if (!config._data) {
         return stub(
           "organizations.externalAccounts.create"
         );
       }
       const [err, raw] = await tryCatch(
-        config.data.mutation(api.externalAccounts.mutations.createOrg, {
+        config._data.mutation(api.externalAccounts.mutations.createOrg, {
           organizationId: input.organizationId,
           kind: input.kind,
           label: input.label,
@@ -2166,10 +2674,7 @@ function createOrgExternalAccountsClient(config) {
         })
       );
       if (err) {
-        return [
-          fromConvexError(err),
-          null
-        ];
+        return [fromConvexError(err), null];
       }
       if (!raw) {
         return [
@@ -2180,21 +2685,16 @@ function createOrgExternalAccountsClient(config) {
           null
         ];
       }
-      return [
-        null,
-        brandExternalAccount(
-          raw
-        )
-      ];
+      return [null, brandExternalAccount(raw)];
     },
     list: async (input) => {
-      if (!config.data) {
+      if (!config._data) {
         return stub(
           "organizations.externalAccounts.list"
         );
       }
       const [err, result] = await tryCatch(
-        config.data.query(api.externalAccounts.queries.listOrg, {
+        config._data.query(api.externalAccounts.queries.listOrg, {
           organizationId: input.organizationId,
           limit: input.limit,
           cursor: input.cursor
@@ -2204,9 +2704,7 @@ function createOrgExternalAccountsClient(config) {
         return [fromConvexError(err), null];
       }
       const branded = result.data.map(
-        (row) => brandExternalAccount(
-          row
-        )
+        (row) => brandExternalAccount(row)
       );
       return [
         null,
@@ -2218,17 +2716,66 @@ function createOrgExternalAccountsClient(config) {
       ];
     },
     retrieve: async (input) => {
-      if (!config.data) {
+      if (!config._data) {
         return stub(
           "organizations.externalAccounts.retrieve"
         );
       }
       const [err, raw] = await tryCatch(
-        config.data.query(api.externalAccounts.queries.retrieveOrg, {
+        config._data.query(api.externalAccounts.queries.retrieveOrg, {
+          organizationId: input.organizationId,
+          externalAccountId: input.externalAccountId
+        })
+      );
+      if (err) {
+        return [fromConvexError(err), null];
+      }
+      if (!raw) {
+        return [
+          new CapxulError({
+            code: "NOT_FOUND",
+            message: `external_account ${input.externalAccountId} not found`
+          }),
+          null
+        ];
+      }
+      return [null, brandExternalAccount(raw)];
+    },
+    remove: async (input) => {
+      if (!config._data) {
+        return stub("organizations.externalAccounts.remove");
+      }
+      const [err] = await tryCatch(
+        config._data.mutation(api.externalAccounts.mutations.removeOrg, {
           organizationId: input.organizationId,
           externalAccountId: input.externalAccountId
         })
       );
+      if (err) {
+        return [fromConvexError(err), null];
+      }
+      return [null, void 0];
+    }
+  };
+}
+function createOrgSubAccountsClient(config) {
+  return {
+    create: async (input) => {
+      if (!config._data) {
+        return stub(
+          "organizations.subAccounts.create"
+        );
+      }
+      const [err, raw] = await tryCatch(
+        config._data.mutation(api.subAccounts.mutations.create, {
+          parent: {
+            kind: "organization",
+            id: input.organizationId
+          },
+          name: input.name,
+          purpose: input.purpose
+        })
+      );
       if (err) {
         return [
           fromConvexError(err),
@@ -2239,28 +2786,95 @@ function createOrgExternalAccountsClient(config) {
         return [
           new CapxulError({
             code: "NOT_FOUND",
-            message: `external_account ${input.externalAccountId} not found`
+            message: "sub_account creation returned no resource"
           }),
           null
         ];
       }
+      const [brandErr, branded] = tryBrandSubAccount(raw);
+      if (brandErr) {
+        return [brandErr, null];
+      }
+      return [null, branded];
+    },
+    list: async (input) => {
+      if (!config._data) {
+        return stub(
+          "organizations.subAccounts.list"
+        );
+      }
+      const [err, rows] = await tryCatch(
+        config._data.query(api.subAccounts.queries.listByOrganization, {
+          organizationId: input.organizationId
+        })
+      );
+      if (err) {
+        return [
+          fromConvexError(err),
+          null
+        ];
+      }
+      const branded = [];
+      for (const row of rows) {
+        const [brandErr, value] = tryBrandSubAccount(row);
+        if (brandErr) {
+          return [brandErr, null];
+        }
+        branded.push(value);
+      }
       return [
         null,
-        brandExternalAccount(
-          raw
-        )
+        {
+          object: "list",
+          data: branded,
+          page: { hasMore: false }
+        }
       ];
     },
+    retrieve: async (input) => {
+      if (!config._data) {
+        return stub(
+          "organizations.subAccounts.retrieve"
+        );
+      }
+      const [err, raw] = await tryCatch(
+        config._data.query(api.subAccounts.queries.retrieve, {
+          subAccountId: input.subAccountId
+        })
+      );
+      if (err) {
+        return [
+          fromConvexError(err),
+          null
+        ];
+      }
+      if (!raw) {
+        return [
+          new CapxulError({
+            code: "NOT_FOUND",
+            message: `sub_account ${input.subAccountId} not found`
+          }),
+          null
+        ];
+      }
+      const [brandErr, branded] = tryBrandSubAccount(raw);
+      if (brandErr) {
+        return [
+          brandErr,
+          null
+        ];
+      }
+      return [null, branded];
+    },
     remove: async (input) => {
-      if (!config.data) {
+      if (!config._data) {
         return stub(
-          "organizations.externalAccounts.remove"
+          "organizations.subAccounts.remove"
         );
       }
-      const [err] = await tryCatch(
-        config.data.mutation(api.externalAccounts.mutations.removeOrg, {
-          organizationId: input.organizationId,
-          externalAccountId: input.externalAccountId
+      const [err, raw] = await tryCatch(
+        config._data.mutation(api.subAccounts.mutations.archive, {
+          subAccountId: input.subAccountId
         })
       );
       if (err) {
@@ -2269,23 +2883,139 @@ function createOrgExternalAccountsClient(config) {
           null
         ];
       }
-      return [null, void 0];
+      if (!raw) {
+        return [
+          new CapxulError({
+            code: "NOT_FOUND",
+            message: `sub_account ${input.subAccountId} not found`
+          }),
+          null
+        ];
+      }
+      const [brandErr, branded] = tryBrandSubAccount(raw);
+      if (brandErr) {
+        return [
+          brandErr,
+          null
+        ];
+      }
+      return [null, branded];
     }
   };
 }
 function createOrganizationsClient(config = {}) {
   return {
-    create: async () => stub("organizations.create"),
-    retrieve: async () => stub("organizations.retrieve"),
-    list: async () => stub("organizations.list"),
-    update: async () => stub("organizations.update"),
+    create: async (input) => {
+      if (!config._data) {
+        return stub("organizations.create");
+      }
+      if (input.country !== void 0) {
+        return [
+          new CapxulError({
+            code: "INVALID_INPUT",
+            message: "organizations.create does not support country yet \u2014 backend mutation only accepts name.",
+            details: { field: "country" }
+          }),
+          null
+        ];
+      }
+      try {
+        const orgId = await config._data.mutation(api.org.mutations.create, {
+          name: input.name
+        });
+        const org = await config._data.query(api.org.queries.retrieve, {
+          orgId
+        });
+        if (!org) {
+          return [
+            new CapxulError({
+              code: "NETWORK_ERROR",
+              message: "organization created but could not be retrieved"
+            }),
+            null
+          ];
+        }
+        return [null, org];
+      } catch (cause) {
+        return [fromConvexError(cause), null];
+      }
+    },
+    retrieve: async (organizationId) => {
+      if (!config._data) {
+        return stub("organizations.retrieve");
+      }
+      try {
+        const orgId = organizationId.replace(/^org_/, "");
+        const org = await config._data.query(api.org.queries.retrieve, {
+          orgId
+        });
+        if (!org) {
+          return [
+            new CapxulError({
+              code: "NOT_FOUND",
+              message: `organization ${organizationId} not found`
+            }),
+            null
+          ];
+        }
+        return [null, org];
+      } catch (cause) {
+        return [fromConvexError(cause), null];
+      }
+    },
+    list: async (input) => {
+      if (!config._data) {
+        return stub("organizations.list");
+      }
+      try {
+        const page = await config._data.query(api.org.queries.list, {
+          limit: input?.limit,
+          cursor: input?.cursor
+        });
+        const result = {
+          object: "list",
+          data: page.data,
+          page: {
+            hasMore: page.hasMore,
+            cursor: page.nextCursor
+          }
+        };
+        return [null, result];
+      } catch (cause) {
+        return [fromConvexError(cause), null];
+      }
+    },
+    update: async (input) => {
+      if (!config._data) {
+        return stub("organizations.update");
+      }
+      try {
+        const orgId = input.organizationId.replace(/^org_/, "");
+        const org = await config._data.mutation(api.org.mutations.update, {
+          orgId,
+          name: input.name
+        });
+        if (!org) {
+          return [
+            new CapxulError({
+              code: "NOT_FOUND",
+              message: `organization ${input.organizationId} not found`
+            }),
+            null
+          ];
+        }
+        return [null, org];
+      } catch (cause) {
+        return [fromConvexError(cause), null];
+      }
+    },
     safes: {
       retrieve: async (input) => {
-        if (!config.data) {
+        if (!config._data) {
           return stub("organizations.safes.retrieve");
         }
         try {
-          const safe = await config.data.query(
+          const safe = await config._data.query(
             api.safe.queries.retrieveOrganizationSafe,
             input
           );
@@ -2307,36 +3037,245 @@ function createOrganizationsClient(config = {}) {
         }
       }
     },
-    treasury: {
-      retrieve: async () => stub("organizations.treasury.retrieve")
-    },
-    members: {
-      list: async () => stub("organizations.members.list"),
-      retrieve: async () => stub("organizations.members.retrieve"),
-      invite: async () => stub("organizations.members.invite"),
-      updateRole: async () => stub("organizations.members.updateRole"),
-      remove: async () => stub("organizations.members.remove")
-    },
-    apiKeys: createApiKeysClient(),
-    kybProfile: {
-      start: async () => stub("organizations.kybProfile.start"),
-      retrieve: async () => stub("organizations.kybProfile.retrieve")
-    },
-    subAccounts: {
-      create: async () => stub("organizations.subAccounts.create"),
-      list: async () => stub("organizations.subAccounts.list"),
-      retrieve: async () => stub("organizations.subAccounts.retrieve"),
-      remove: async () => stub("organizations.subAccounts.remove")
-    },
-    externalAccounts: createOrgExternalAccountsClient(config),
-    balanceLedger: {
-      list: async () => stub(
-        "organizations.balanceLedger.list"
-      ),
-      retrieve: async () => stub(
-        "organizations.balanceLedger.retrieve"
-      )
-    },
+    treasury: {
+      retrieve: async (organizationId) => {
+        if (!config._data) {
+          return stub(
+            "organizations.treasury.retrieve"
+          );
+        }
+        try {
+          const orgId = organizationId.replace(/^org_/, "");
+          const raw = await config._data.query(
+            api.safe.queries.getOrgTreasuryBalance,
+            { orgId }
+          );
+          if (!raw) {
+            return [
+              new CapxulError({
+                code: "NOT_FOUND",
+                message: `treasury for organization ${organizationId} not found`
+              }),
+              null
+            ];
+          }
+          const treasury = {
+            object: "treasury",
+            id: toTreasuryId(`try_${orgId}`),
+            organizationId,
+            status: "active",
+            safeId: toSafeId(
+              `safe_${raw.safeAddress.replace(/^0x/, "").toLowerCase()}`
+            ),
+            totalBalance: { value: "0", currency: "USD" },
+            positions: raw.tokens.map((t) => ({
+              symbol: t.symbol,
+              contractAddress: t.tokenAddress,
+              amount: t.balance
+            })),
+            asOf: raw.lastUpdatedAt ? new Date(raw.lastUpdatedAt).toISOString() : (/* @__PURE__ */ new Date()).toISOString()
+          };
+          return [null, treasury];
+        } catch (cause) {
+          return [
+            fromConvexError(cause),
+            null
+          ];
+        }
+      }
+    },
+    members: {
+      list: async (input) => {
+        if (!config._data?.action) {
+          return stub("organizations.members.list");
+        }
+        try {
+          const orgId = input.organizationId.replace(/^org_/, "");
+          const page = await config._data.action(api.org.actions.membersList, {
+            organizationId: orgId,
+            status: input.status,
+            limit: input.limit,
+            cursor: input.cursor
+          });
+          return [null, page];
+        } catch (cause) {
+          return [fromConvexError(cause), null];
+        }
+      },
+      retrieve: async (input) => {
+        if (!config._data?.action) {
+          return stub("organizations.members.retrieve");
+        }
+        try {
+          const orgId = input.organizationId.replace(/^org_/, "");
+          const memberId = input.memberId.replace(/^mb_/, "");
+          const member = await config._data.action(
+            api.org.actions.retrieveMember,
+            {
+              organizationId: orgId,
+              memberId
+            }
+          );
+          return [null, member];
+        } catch (cause) {
+          return [fromConvexError(cause), null];
+        }
+      },
+      invite: async (input) => {
+        if (!config._data?.action) {
+          return stub("organizations.members.invite");
+        }
+        try {
+          const orgId = input.organizationId.replace(/^org_/, "");
+          const result = await config._data.action(
+            api.org.actions.inviteMember,
+            {
+              organizationId: orgId,
+              email: input.email,
+              role: input.role
+            }
+          );
+          return [null, result];
+        } catch (cause) {
+          return [fromConvexError(cause), null];
+        }
+      },
+      accept: async (input) => {
+        if (!config._data?.action) {
+          return stub("organizations.members.accept");
+        }
+        try {
+          const member = await config._data.action(
+            api.org.actions.acceptInvitation,
+            { token: input.token }
+          );
+          return [null, member];
+        } catch (cause) {
+          return [fromConvexError(cause), null];
+        }
+      },
+      updateRole: async (input) => {
+        if (!config._data?.action) {
+          return stub("organizations.members.updateRole");
+        }
+        try {
+          const orgId = input.organizationId.replace(/^org_/, "");
+          const memberId = input.memberId.replace(/^mb_/, "");
+          const member = await config._data.action(
+            api.org.actions.updateMemberRole,
+            {
+              organizationId: orgId,
+              memberId,
+              role: input.role
+            }
+          );
+          return [null, member];
+        } catch (cause) {
+          return [fromConvexError(cause), null];
+        }
+      },
+      revoke: async (input) => {
+        if (!config._data?.action) {
+          return stub("organizations.members.revoke");
+        }
+        try {
+          const orgId = input.organizationId.replace(/^org_/, "");
+          const memberId = input.memberId.replace(/^mb_/, "");
+          const member = await config._data.action(
+            api.org.actions.revokeMember,
+            {
+              organizationId: orgId,
+              memberId
+            }
+          );
+          return [null, member];
+        } catch (cause) {
+          return [fromConvexError(cause), null];
+        }
+      },
+      remove: async (input) => {
+        if (!config._data?.action) {
+          return stub("organizations.members.remove");
+        }
+        try {
+          const orgId = input.organizationId.replace(/^org_/, "");
+          const memberId = input.memberId.replace(/^mb_/, "");
+          await config._data.action(api.org.actions.removeMember, {
+            organizationId: orgId,
+            memberId
+          });
+          return [null, void 0];
+        } catch (cause) {
+          return [fromConvexError(cause), null];
+        }
+      },
+      resend: async (input) => {
+        if (!config._data?.action) {
+          return stub("organizations.members.resend");
+        }
+        try {
+          const orgId = input.organizationId.replace(/^org_/, "");
+          const memberId = input.memberId.replace(/^mb_/, "");
+          const result = await config._data.action(
+            api.org.actions.resendInvitation,
+            {
+              organizationId: orgId,
+              memberId
+            }
+          );
+          return [null, result];
+        } catch (cause) {
+          return [fromConvexError(cause), null];
+        }
+      }
+    },
+    apiKeys: createApiKeysClient(),
+    subAccounts: createOrgSubAccountsClient(config),
+    externalAccounts: createOrgExternalAccountsClient(config),
+    balanceLedger: {
+      list: async (input) => {
+        if (!config._data) {
+          return stub(
+            "organizations.balanceLedger.list"
+          );
+        }
+        try {
+          const orgId = input.organizationId.replace(/^org_/, "");
+          const page = await config._data.query(
+            api.balanceLedger.queries.listForOrg,
+            { orgId, limit: input.limit, cursor: input.cursor }
+          );
+          return [null, page];
+        } catch (cause) {
+          return [fromConvexError(cause), null];
+        }
+      },
+      retrieve: async (input) => {
+        if (!config._data) {
+          return stub(
+            "organizations.balanceLedger.retrieve"
+          );
+        }
+        try {
+          const entry = await config._data.query(
+            api.balanceLedger.queries.retrieve,
+            { entryId: input.entryId }
+          );
+          if (!entry) {
+            return [
+              new CapxulError({
+                code: "NOT_FOUND",
+                message: `balance_ledger_entry ${input.entryId} not found`
+              }),
+              null
+            ];
+          }
+          return [null, entry];
+        } catch (cause) {
+          return [fromConvexError(cause), null];
+        }
+      }
+    },
     payments: createOrgPaymentsClient(),
     transfers: createOrgTransfersClient(),
     withdrawals: createOrgWithdrawalsClient(config),
@@ -2346,14 +3285,6 @@ function createOrganizationsClient(config = {}) {
   };
 }
 
-// src/core/sub-accounts.ts
-function createSubAccountsClient() {
-  return {
-    retrieve: async () => stub("subAccounts.retrieve"),
-    remove: async () => stub("subAccounts.remove")
-  };
-}
-
 // src/core/token-transfers.ts
 var toTokenTransferId = (raw) => {
   if (typeof raw !== "string" || raw.length === 0) {
@@ -2372,11 +3303,11 @@ function brandRow(row) {
 function createTokenTransfersClient(config = {}) {
   return {
     list: async (input) => {
-      if (!config.data) {
+      if (!config._data) {
         return stub("tokenTransfers.list");
       }
       try {
-        const raw = await config.data.query(
+        const raw = await config._data.query(
           api.tokenTransfers.queries.list,
           {
             limit: input?.limit,
@@ -2410,11 +3341,11 @@ function createTokenTransfersClient(config = {}) {
       }
     },
     retrieve: async (input) => {
-      if (!config.data) {
+      if (!config._data) {
         return stub("tokenTransfers.retrieve");
       }
       try {
-        const raw = await config.data.query(
+        const raw = await config._data.query(
           api.tokenTransfers.queries.getByTxLogIndex,
           {
             txHash: input.txHash,
@@ -2484,7 +3415,7 @@ function createAuthFlowMachine(client) {
       }),
       verifyOtp: fromPromise(
         async ({ input, signal }) => {
-          const [error, session] = await client.auth.verifyOtp(
+          const [error, result] = await client.auth.verifyOtp(
             {
               email: input.email,
               otp: input.code
@@ -2492,7 +3423,14 @@ function createAuthFlowMachine(client) {
             { signal }
           );
           if (error) throw error;
-          return session;
+          if (result.kind === "bootstrap_required") {
+            throw new CapxulError({
+              code: "ACTION_REQUIRED",
+              message: "OTP verified but auth bootstrap is required. Use createAuthBootstrapFlowMachine for product sign-up.",
+              details: { reason: result.reason }
+            });
+          }
+          return result.session;
         }
       ),
       signOut: fromPromise(async () => {
@@ -2740,6 +3678,327 @@ function emailDomain(email) {
   const domain = email.split("@")[1]?.trim().toLowerCase();
   return domain || "unknown";
 }
+var initialContext = {
+  email: null,
+  code: null,
+  username: null,
+  bootstrapToken: null,
+  bootstrapReason: null,
+  session: null,
+  account: null,
+  safe: null,
+  error: null
+};
+function createAuthBootstrapFlowMachine(client) {
+  return setup({
+    types: {},
+    actors: {
+      sendOtp: fromPromise(async ({ input, signal }) => {
+        const [error] = await client.auth.sendOtp(
+          { email: input.email },
+          { signal }
+        );
+        if (error) throw error;
+      }),
+      verifyOtp: fromPromise(
+        async ({ input, signal }) => {
+          const [error, result] = await client.auth.verifyOtp(
+            { email: input.email, otp: input.code },
+            { signal }
+          );
+          if (error) throw error;
+          return result;
+        }
+      ),
+      completeBootstrap: fromPromise(async ({ input }) => {
+        const [error, result] = await client.auth.completeBootstrap(input);
+        if (error) throw error;
+        return result;
+      }),
+      signOut: fromPromise(async () => {
+        const [error] = await client.auth.signOut();
+        if (error) throw error;
+      })
+    },
+    actions: {
+      trackOtpRequested: ({ context }) => {
+        if (!context.email) return;
+        track("auth_otp_requested", {
+          email_domain: emailDomain2(context.email)
+        });
+      },
+      trackFailed: ({ event }) => {
+        track("auth_failed", {
+          auth_type: "email_otp",
+          reason: errorFromEvent2(event).code
+        });
+      },
+      trackTimeoutFailed: () => {
+        track("auth_failed", {
+          auth_type: "email_otp",
+          reason: "timeout"
+        });
+      },
+      trackVerified: () => {
+        track("auth_verified", { auth_type: "email_otp" });
+      },
+      trackBootstrapRequired: ({ context }) => {
+        track("auth_verified", {
+          auth_type: "email_otp",
+          auth_mode: context.bootstrapReason ?? "bootstrap_required"
+        });
+      },
+      identifyAndTrack: ({ context }) => {
+        if (!context.session) return;
+        identify(context.session.authUserId, {
+          email_domain: emailDomain2(context.session.email)
+        });
+        track("auth_identified", {
+          email_domain: emailDomain2(context.session.email)
+        });
+      },
+      trackSignedOut: () => {
+        track("auth_signed_out");
+      }
+    }
+  }).createMachine({
+    id: "authBootstrap",
+    initial: "email",
+    context: initialContext,
+    states: {
+      email: {
+        on: {
+          ENTER_EMAIL: {
+            actions: assign({
+              email: ({ event }) => event.email,
+              error: () => null
+            })
+          },
+          REQUEST_OTP: { target: "sending_otp" }
+        }
+      },
+      sending_otp: {
+        invoke: {
+          src: "sendOtp",
+          input: ({ context }) => ({ email: requireEmail2(context) }),
+          onDone: { target: "otp_requested", actions: "trackOtpRequested" },
+          onError: {
+            target: "otp_requested",
+            actions: [
+              assign({ error: ({ event }) => errorFromEvent2(event) }),
+              "trackFailed"
+            ]
+          }
+        },
+        after: {
+          [FLOW_INVOKE_TIMEOUT_MS]: {
+            target: "otp_requested",
+            actions: [
+              assign({ error: () => timeoutError2("sending_otp") }),
+              "trackTimeoutFailed"
+            ]
+          }
+        }
+      },
+      otp_requested: {
+        on: {
+          ENTER_OTP: {
+            actions: assign({
+              code: ({ event }) => event.code,
+              error: () => null
+            })
+          },
+          VERIFY_OTP: { target: "verifying_otp" },
+          BACK: { target: "email" },
+          RESET: { target: "email", actions: assign(() => initialContext) }
+        }
+      },
+      verifying_otp: {
+        invoke: {
+          src: "verifyOtp",
+          input: ({ context }) => ({
+            email: requireEmail2(context),
+            code: requireCode(context)
+          }),
+          onDone: [
+            {
+              guard: ({ event }) => event.output.kind === "existing_member",
+              target: "authenticated",
+              actions: [
+                assign({
+                  session: ({ event }) => event.output.session,
+                  account: ({ event }) => event.output.kind === "existing_member" ? event.output.account : null,
+                  username: ({ event }) => event.output.kind === "existing_member" ? event.output.username : null,
+                  safe: ({ event }) => event.output.kind === "existing_member" ? event.output.safe : null,
+                  email: () => null,
+                  error: () => null
+                }),
+                "trackVerified",
+                "identifyAndTrack"
+              ]
+            },
+            {
+              target: "bootstrap_required",
+              actions: [
+                assign({
+                  session: ({ event }) => event.output.session,
+                  bootstrapToken: ({ event }) => event.output.kind === "bootstrap_required" ? event.output.bootstrapToken : null,
+                  bootstrapReason: ({ event }) => event.output.kind === "bootstrap_required" ? event.output.reason : null,
+                  username: ({ event }) => event.output.kind === "bootstrap_required" ? event.output.username ?? null : null,
+                  email: ({ event }) => event.output.kind === "bootstrap_required" ? event.output.email : null,
+                  error: () => null
+                }),
+                "trackVerified",
+                "trackBootstrapRequired"
+              ]
+            }
+          ],
+          onError: {
+            target: "otp_requested",
+            actions: [
+              assign({ error: ({ event }) => errorFromEvent2(event) }),
+              "trackFailed"
+            ]
+          }
+        },
+        after: {
+          [FLOW_INVOKE_TIMEOUT_MS]: {
+            target: "otp_requested",
+            actions: [
+              assign({ error: () => timeoutError2("verifying_otp") }),
+              "trackTimeoutFailed"
+            ]
+          }
+        }
+      },
+      bootstrap_required: {
+        on: {
+          ENTER_USERNAME: {
+            actions: assign({
+              username: ({ event }) => event.username,
+              error: () => null
+            })
+          },
+          COMPLETE_BOOTSTRAP: { target: "completing_bootstrap" },
+          BACK: { target: "otp_requested" },
+          RESET: { target: "email", actions: assign(() => initialContext) }
+        }
+      },
+      completing_bootstrap: {
+        invoke: {
+          src: "completeBootstrap",
+          input: ({ context }) => ({
+            bootstrapToken: requireBootstrapToken(context),
+            username: requireUsername(context)
+          }),
+          onDone: {
+            target: "authenticated",
+            actions: [
+              assign({
+                session: ({ event }) => event.output.session,
+                account: ({ event }) => event.output.account,
+                username: ({ event }) => event.output.username,
+                safe: ({ event }) => event.output.safe,
+                bootstrapToken: () => null,
+                bootstrapReason: () => null,
+                email: () => null,
+                error: () => null
+              }),
+              "identifyAndTrack"
+            ]
+          },
+          onError: {
+            target: "bootstrap_required",
+            actions: [
+              assign({ error: ({ event }) => errorFromEvent2(event) }),
+              "trackFailed"
+            ]
+          }
+        },
+        after: {
+          [FLOW_INVOKE_TIMEOUT_MS]: {
+            target: "bootstrap_required",
+            actions: [
+              assign({ error: () => timeoutError2("completing_bootstrap") }),
+              "trackTimeoutFailed"
+            ]
+          }
+        }
+      },
+      authenticated: {
+        on: {
+          SIGN_OUT: { target: "signing_out" }
+        }
+      },
+      signing_out: {
+        invoke: {
+          src: "signOut",
+          onDone: {
+            target: "email",
+            actions: [
+              assign(() => initialContext),
+              "trackSignedOut"
+            ]
+          },
+          onError: {
+            target: "error",
+            actions: assign({ error: ({ event }) => errorFromEvent2(event) })
+          }
+        }
+      },
+      error: {
+        on: {
+          RESET: { target: "email", actions: assign(() => initialContext) }
+        }
+      }
+    }
+  });
+}
+function requireEmail2(context) {
+  if (!context.email) {
+    throw Errors.invalidInput("email", "Auth bootstrap requires an email.");
+  }
+  return context.email;
+}
+function requireCode(context) {
+  if (!context.code) {
+    throw Errors.invalidInput("code", "Auth bootstrap requires an OTP code.");
+  }
+  return context.code;
+}
+function requireBootstrapToken(context) {
+  if (!context.bootstrapToken) {
+    throw Errors.invalidInput(
+      "bootstrapToken",
+      "Auth bootstrap requires a continuation token."
+    );
+  }
+  return context.bootstrapToken;
+}
+function requireUsername(context) {
+  if (!context.username) {
+    throw Errors.invalidInput("username", "Auth bootstrap requires a username.");
+  }
+  return context.username;
+}
+function errorFromEvent2(event) {
+  const cause = typeof event === "object" && event !== null && "error" in event ? event.error : event;
+  if (cause instanceof CapxulError || cause instanceof CapxulError2) {
+    return cause;
+  }
+  return Errors.providerError("auth", "bootstrap", cause);
+}
+function timeoutError2(state) {
+  return Errors.providerError(
+    "auth",
+    "bootstrap",
+    new Error(`timeout: ${state} exceeded ${FLOW_INVOKE_TIMEOUT_MS}ms`)
+  );
+}
+function emailDomain2(email) {
+  const domain = email.split("@")[1]?.trim().toLowerCase();
+  return domain || "unknown";
+}
 function createProvisioningMachine(client) {
   return setup({
     types: {},
@@ -2767,7 +4026,7 @@ function createProvisioningMachine(client) {
         const provider = context.input?.signerProvider;
         if (!provider) return;
         track("provisioning_safe_created", {
-          safe_address: provider.safeAddress
+          safe_address: deriveSafeAddress(provider.signerAddress)
         });
       }
     }
@@ -2812,13 +4071,13 @@ function createProvisioningMachine(client) {
           },
           onError: {
             target: "error",
-            actions: assign({ error: ({ event }) => errorFromEvent2(event) })
+            actions: assign({ error: ({ event }) => errorFromEvent3(event) })
           }
         },
         after: {
           [FLOW_INVOKE_TIMEOUT_MS]: {
             target: "error",
-            actions: assign({ error: () => timeoutError2() })
+            actions: assign({ error: () => timeoutError3() })
           }
         }
       },
@@ -2836,7 +4095,7 @@ function createProvisioningMachine(client) {
      * this payload on its `onDone` transition and branches via guards
      * on `event.output.error`.
      */
-    output: ({ context }) => context.error ? { error: context.error } : context.account ? { account: context.account } : { error: timeoutError2() }
+    output: ({ context }) => context.error ? { error: context.error } : context.account ? { account: context.account } : { error: timeoutError3() }
   });
 }
 function requireProvisionInput(context) {
@@ -2848,13 +4107,13 @@ function requireProvisionInput(context) {
   }
   return context.input;
 }
-function errorFromEvent2(event) {
+function errorFromEvent3(event) {
   const cause = typeof event === "object" && event !== null && "error" in event ? event.error : event;
   if (cause instanceof CapxulError) return cause;
   if (cause instanceof CapxulError2) return cause;
   return Errors.providerError("provisioning", "flow", cause);
 }
-function timeoutError2() {
+function timeoutError3() {
   return Errors.providerError(
     "provisioning",
     "flow",
@@ -2947,7 +4206,7 @@ function createOnboardingFlowMachine(client) {
         error: ({ event }) => extractChildErrorOrFallback(event)
       }),
       assignChildThrown: assign({
-        error: ({ event }) => errorFromEvent3(event)
+        error: ({ event }) => errorFromEvent4(event)
       }),
       assignAccountFromChild: assign({
         account: ({ event }) => extractChildAccountOrNull(event)
@@ -3109,7 +4368,7 @@ function extractChildAccountOrNull(event) {
   if (output && "account" in output && output.account) return output.account;
   return null;
 }
-function errorFromEvent3(event) {
+function errorFromEvent4(event) {
   const cause = typeof event === "object" && event !== null && "error" in event ? event.error : event;
   if (cause instanceof CapxulError) return cause;
   if (cause instanceof CapxulError2) return cause;
@@ -3129,7 +4388,7 @@ function createCapxulClient(config = {}) {
     tokenTransfers: createTokenTransfersClient(config),
     withdrawals: createWithdrawalsClient(config),
     documents: createDocumentsClient(),
-    subAccounts: createSubAccountsClient(),
+    subAccounts: createSubAccountsClient(config),
     virtualAccounts: createVirtualAccountsClient(),
     virtualCards: createVirtualCardsClient(),
     externalAccounts: createExternalAccountsClient(config),
@@ -3141,6 +4400,7 @@ function createCapxulClient(config = {}) {
   const client = clientWithoutFlows;
   client.flows = {
     auth: () => createAuthFlowMachine(client),
+    authBootstrap: () => createAuthBootstrapFlowMachine(client),
     onboarding: () => createOnboardingFlowMachine(client),
     provisioning: () => createProvisioningMachine(client)
   };
@@ -3245,4 +4505,81 @@ function isWebhookEvent(value) {
   return typeof candidate.id === "string" && typeof candidate.type === "string" && typeof candidate.createdAt === "string" && (candidate.operationId === void 0 || typeof candidate.operationId === "string") && (candidate.correlationId === void 0 || typeof candidate.correlationId === "string") && !!candidate.data && typeof candidate.data === "object" && !Array.isArray(candidate.data);
 }
 
-export { CapxulError, createAuthFlowMachine, createCapxulClient, createLocalSigner, createOnboardingFlowMachine, createProvisioningMachine as createProvisioningFlowMachine, makeHttpTransport, matchAction, matchError, matchStatus, toAccountId, toApiKeyId, toBalanceLedgerEntryId, toDocumentId, toEmail, toExternalAccountId, toKybProfileId, toKycProfileId, toMemberId, toOperationId, toOrganizationId, toPaymentId, toPhoneNumber, toSafeId, toSubAccountId, toTokenTransferId, toTransferId, toTreasuryId, toUsername, toVirtualAccountId, toVirtualCardId, toWebhookEndpointId, toWebhookEventId, toWithdrawalId, tryCatch, verifyWebhook };
+// src/core/auth-service.ts
+var AuthService = class {
+  authClient;
+  sessionStore;
+  config;
+  constructor(config = {}) {
+    this.config = config;
+    this.sessionStore = config.auth?.sessionStore ?? createMemorySessionStore2();
+    this.authClient = createAuthClient({
+      ...config,
+      auth: { ...config.auth, sessionStore: this.sessionStore }
+    });
+  }
+  async sendOtp(email) {
+    const [err] = await this.authClient.sendOtp({ email });
+    if (err) throw err;
+  }
+  async verifyOtp(email, otp) {
+    const [err, result] = await this.authClient.verifyOtp({ email, otp });
+    if (err) throw err;
+    return result;
+  }
+  async completeBootstrap(params, signer) {
+    if (signer) {
+      const tempClient = createAuthClient({
+        ...this.config,
+        signer
+      });
+      const [err2, result2] = await tempClient.completeBootstrap(params);
+      if (err2) throw err2;
+      return result2;
+    }
+    const [err, result] = await this.authClient.completeBootstrap(params);
+    if (err) throw err;
+    return result;
+  }
+  /**
+   * Clears the persisted session and, when a transport was pre-injected,
+   * drops the cached auth header.
+   *
+   * **Transport safety note:** `clearAuth()` is only invoked when
+   * `config._transport` was supplied at construction (e.g. by the React
+   * provider). If `AuthService` is instantiated directly in a Node/CLI
+   * context without an injected transport, the transport-side auth cache
+   * is the caller's responsibility.
+   */
+  async signOut() {
+    this.sessionStore.clear();
+    this.config._transport?.clearAuth();
+  }
+  async getSession() {
+    const [err, session] = await this.authClient.getSession();
+    if (err) throw err;
+    return session;
+  }
+};
+function createMemorySessionStore2() {
+  let current = null;
+  return {
+    get: () => current,
+    set: (session) => {
+      current = session;
+    },
+    clear: () => {
+      current = null;
+    }
+  };
+}
+var SignerProvisioner = class {
+  provision() {
+    const privateKey = generatePrivateKey();
+    const signer = privateKeyToAccount(privateKey);
+    const safeAddress = deriveSafeAddress(signer.address);
+    return { signer, safeAddress };
+  }
+};
+
+export { AuthService, CapxulError, SignerProvisioner, createAuthBootstrapFlowMachine, createAuthFlowMachine, createCapxulClient, createLocalSigner, createOnboardingFlowMachine, createProvisioningMachine as createProvisioningFlowMachine, makeHttpTransport, matchAction, matchError, matchStatus, resolvePaymentToken, toAccountId, toApiKeyId, toBalanceLedgerEntryId, toDocumentId, toEmail, toExternalAccountId, toKybProfileId, toKycProfileId, toMemberId, toOperationId, toOrganizationId, toPaymentId, toPhoneNumber, toSafeId, toSubAccountId, toTokenTransferId, toTransferId, toTreasuryId, toUsername, toVirtualAccountId, toVirtualCardId, toWebhookEndpointId, toWebhookEventId, toWithdrawalId, tryCatch, verifyWebhook };