@capxul/sdk 0.1.0-alpha.9 → 0.2.0-alpha.4

package/dist/index.js

@@ -1,10 +1,11 @@
 import { componentsGeneric, anyApi } from 'convex/server';
-import { getAddress, parseUnits, createPublicClient, http, encodeFunctionData } from 'viem';
 import { toSafeSmartAccount } from 'permissionless/accounts';
+import { getAddress, encodeFunctionData, encodePacked, keccak256, getContractAddress, parseUnits, createPublicClient, http } from 'viem';
 import { entryPoint07Address, createPaymasterClient, createBundlerClient } from 'viem/account-abstraction';
 import { baseSepolia } from 'viem/chains';
+import { ConvexHttpClient } from 'convex/browser';
 import { setup, fromPromise, assign } from 'xstate';
-import { privateKeyToAccount } from 'viem/accounts';
+import { privateKeyToAccount, generatePrivateKey } from 'viem/accounts';
 
 // src/_generated/api.js
 var api = anyApi;
@@ -108,17 +109,271 @@ function track(...args) {
   const [name, props] = args;
   debugLog(`[TRACK] ${name} ${formatDebugValue(props ?? "")}`);
 }
-function formatDebugValue2(value) {
-  if (value === void 0 || value === "") return "";
-  if (typeof value === "string") return value;
+
+// ../config/src/chain.ts
+var CAPXUL_PAYMENTS_ADDRESS = "0xe740ea65521edc9bef0ea75d30b5334711db99f4";
+var TEST_USDC_ADDRESS = "0xf09fcbb6df9f8f918e58f9c8ab15a76ade862b77";
+var CAPXUL_API_BASE_URL = "https://elated-oyster-269.convex.site";
+
+// ../config/src/timing.ts
+var FLOW_INVOKE_TIMEOUT_MS = 3e4;
+var WEBHOOK_FRESHNESS_WINDOW_MS = 5 * 60 * 1e3;
+
+// ../config/src/errors.ts
+var CapxulError2 = class extends Error {
+  code;
+  details;
+  correlationId;
+  layer;
+  constructor(code, message, options) {
+    super(message, options?.cause ? { cause: options.cause } : void 0);
+    this.code = code;
+    this.details = options?.details;
+    this.correlationId = options?.correlationId;
+    this.layer = options?.layer;
+  }
+};
+var Errors = {
+  notAuthenticated: () => new CapxulError2("NOT_AUTHENTICATED", "Not authenticated"),
+  profileNotFound: (authUserId) => new CapxulError2("PROFILE_NOT_FOUND", `Profile not found for user ${authUserId}`),
+  smartAccountMissing: (authUserId) => new CapxulError2("SMART_ACCOUNT_MISSING", `Smart account not provisioned for user ${authUserId}`),
+  envMissing: (name) => new CapxulError2("ENV_MISSING", `Environment variable ${name} not configured`),
+  openfortApi: (operation, cause) => new CapxulError2(
+    "PROVIDER_ERROR",
+    `Openfort ${operation} failed: ${cause instanceof Error ? cause.message : String(cause)}`,
+    { cause, details: { provider: "openfort", operation } }
+  ),
+  shieldApi: (status, detail) => new CapxulError2(
+    "PROVIDER_ERROR",
+    `Shield API error (${status}): ${detail}`,
+    { details: { provider: "shield", status } }
+  ),
+  providerError: (provider, operation, cause) => (
+    // Public `message` is redacted to a fixed shape so provider-side
+    // exception text never leaks to the client. The original `cause`
+    // is preserved on `Error.cause` for server-side debugging via
+    // observability sinks (Sentry, console traces).
+    new CapxulError2(
+      "PROVIDER_ERROR",
+      `Provider error: ${provider} ${operation}`,
+      { cause, details: { provider, operation } }
+    )
+  ),
+  invalidInput: (field, reason) => new CapxulError2(
+    "INVALID_INPUT",
+    `Invalid ${field}: ${reason}`,
+    { details: { field, reason } }
+  ),
+  playerNotFound: (playerId) => new CapxulError2(
+    "PLAYER_NOT_FOUND",
+    playerId ? `Openfort player ${playerId} not found` : "Openfort player not found"
+  ),
+  accountNotFound: (accountId) => new CapxulError2(
+    "ACCOUNT_NOT_FOUND",
+    accountId ? `Openfort account ${accountId} not found` : "Openfort smart account not found"
+  ),
+  invalidRecipient: (reason) => new CapxulError2("INVALID_RECIPIENT", reason),
+  permissionDenied: (reason = "Permission denied") => new CapxulError2("PERMISSION_DENIED", reason),
+  notFound: (resource, id) => new CapxulError2(
+    "NOT_FOUND",
+    id ? `${resource} ${id} not found` : `${resource} not found`
+  ),
+  idempotencyConflict: (details) => new CapxulError2(
+    "IDEMPOTENCY_CONFLICT",
+    "Idempotency key was already used for a different request",
+    { details }
+  ),
+  emailDeliveryFailed: (detail, details) => new CapxulError2("EMAIL_DELIVERY_FAILED", `Failed to send email: ${detail}`, {
+    details
+  }),
+  rateLimited: (details) => new CapxulError2("RATE_LIMITED", "Request was rate limited", {
+    details: { ...details }
+  }),
+  internalError: (reason) => new CapxulError2("INTERNAL_ERROR", `Internal error: ${reason}`),
+  /**
+   * Verification gate. Surfaced when a request hits a verification
+   * boundary the actor cannot cross under their current state. Two
+   * variants share this code:
+   *
+   * - Rail gate (Withdrawals v1 W2, #465): the resolved
+   *   `external_account.kind` routes to a withdrawal rail (e.g.
+   *   `fiat_offramp`, `card_payout`) that is not yet supported. Carries
+   *   `details.rail` + `details.currentKind`.
+   * - KYC tier gate (legacy / future): the actor's KYC tier is below
+   *   the required tier. Carries `details.requiredTier`.
+   *
+   * Code is shared because both expose the same UX shape ("you cannot
+   * proceed until verification advances"); the `details.*` keys
+   * differentiate the route.
+   */
+  verificationRequired: (details) => {
+    const message = "rail" in details ? `Withdrawal rail "${details.rail}" (kind=${details.currentKind}) is not yet supported.` : `Verification tier ${details.requiredTier} is required.`;
+    return new CapxulError2("VERIFICATION_REQUIRED", message, {
+      details: { ...details }
+    });
+  }
+};
+
+// ../config/src/safe.ts
+var SAFE_PROXY_FACTORY = "0x4e1dcf7ad4e460cfd30791ccc4f9c8a4f820ec67";
+var SAFE_L2_SINGLETON = "0x29fcb43b46531bca003ddc8fcb67ffe91900c762";
+var SAFE_MODULE_SETUP = "0x2dd68b007b46fbe91b9a7c3eda5a7a1063cb5b47";
+var SAFE_4337_MODULE = "0x75cf11467937ce3f2f357ce24ffc3dbf8fd5c226";
+var MULTI_SEND = "0x38869bf66a61cf6bdb996a6ae40d5853fd43b526";
+
+// ../config/src/org-roles.ts
+function roleKeyFromLabel(label) {
+  const bytes = new TextEncoder().encode(label);
+  const hex = Array.from(bytes).map((b) => b.toString(16).padStart(2, "0")).join("");
+  return "0x" + hex.padEnd(64, "0");
+}
+roleKeyFromLabel("OWNER");
+roleKeyFromLabel("FINANCE_MANAGER");
+roleKeyFromLabel("PAYMENTS_OPERATOR");
+var defaultSafeDeriveConfig = {
+  safeProxyFactory: SAFE_PROXY_FACTORY,
+  safeL2Singleton: SAFE_L2_SINGLETON,
+  safeModuleSetup: SAFE_MODULE_SETUP,
+  safe4337Module: SAFE_4337_MODULE,
+  multiSend: MULTI_SEND
+};
+var SAFE_PROXY_CREATION_CODE = "0x608060405234801561001057600080fd5b506040516101e63803806101e68339818101604052602081101561003357600080fd5b8101908080519060200190929190505050600073ffffffffffffffffffffffffffffffffffffffff168173ffffffffffffffffffffffffffffffffffffffff1614156100ca576040517f08c379a00000000000000000000000000000000000000000000000000000000081526004018080602001828103825260228152602001806101c46022913960400191505060405180910390fd5b806000806101000a81548173ffffffffffffffffffffffffffffffffffffffff021916908373ffffffffffffffffffffffffffffffffffffffff1602179055505060ab806101196000396000f3fe608060405273ffffffffffffffffffffffffffffffffffffffff600054167fa619486e0000000000000000000000000000000000000000000000000000000060003514156050578060005260206000f35b3660008037600080366000845af43d6000803e60008114156070573d6000fd5b3d6000f3fea264697066735822122003d1488ee65e08fa41e58e888a9865554c535f2c77126a82cb4c0f917f31441364736f6c63430007060033496e76616c69642073696e676c65746f6e20616464726573732070726f7669646564";
+var enableModulesAbi = [
+  {
+    type: "function",
+    name: "enableModules",
+    inputs: [{ type: "address[]", name: "modules" }],
+    outputs: [],
+    stateMutability: "nonpayable"
+  }
+];
+var multiSendAbi = [
+  {
+    type: "function",
+    name: "multiSend",
+    inputs: [{ type: "bytes", name: "transactions" }],
+    outputs: [],
+    stateMutability: "payable"
+  }
+];
+var setupAbi = [
+  {
+    type: "function",
+    name: "setup",
+    inputs: [
+      { type: "address[]", name: "owners" },
+      { type: "uint256", name: "threshold" },
+      { type: "address", name: "to" },
+      { type: "bytes", name: "data" },
+      { type: "address", name: "fallbackHandler" },
+      { type: "address", name: "paymentToken" },
+      { type: "uint256", name: "payment" },
+      { type: "address", name: "paymentReceiver" }
+    ],
+    outputs: [],
+    stateMutability: "nonpayable"
+  }
+];
+function encodeInternalTransaction(tx) {
+  const encoded = encodePacked(
+    ["uint8", "address", "uint256", "uint256", "bytes"],
+    [
+      tx.operation,
+      tx.to,
+      tx.value,
+      BigInt(tx.data.slice(2).length / 2),
+      tx.data
+    ]
+  );
+  return encoded.slice(2);
+}
+function computeSaltNonce(ownerAddress) {
+  return BigInt(`0x${ownerAddress.toLowerCase().slice(2).padEnd(64, "0")}`);
+}
+function deriveSafeAddress(signerAddress, config = defaultSafeDeriveConfig) {
+  const saltNonce = computeSaltNonce(signerAddress);
+  const enableModulesData = encodeFunctionData({
+    abi: enableModulesAbi,
+    functionName: "enableModules",
+    args: [[config.safe4337Module]]
+  });
+  const innerTx = encodeInternalTransaction({
+    operation: 1,
+    to: config.safeModuleSetup,
+    value: 0n,
+    data: enableModulesData
+  });
+  const multiSendCallData = encodeFunctionData({
+    abi: multiSendAbi,
+    functionName: "multiSend",
+    args: [`0x${innerTx}`]
+  });
+  const initializer = encodeFunctionData({
+    abi: setupAbi,
+    functionName: "setup",
+    args: [
+      [signerAddress],
+      1n,
+      config.multiSend,
+      multiSendCallData,
+      config.safe4337Module,
+      "0x0000000000000000000000000000000000000000",
+      0n,
+      "0x0000000000000000000000000000000000000000"
+    ]
+  });
+  const deploymentCode = encodePacked(
+    ["bytes", "uint256"],
+    [SAFE_PROXY_CREATION_CODE, BigInt(config.safeL2Singleton)]
+  );
+  const salt = keccak256(
+    encodePacked(
+      ["bytes32", "uint256"],
+      [keccak256(encodePacked(["bytes"], [initializer])), saltNonce]
+    )
+  );
+  return getContractAddress({
+    from: config.safeProxyFactory,
+    salt,
+    bytecode: deploymentCode,
+    opcode: "CREATE2"
+  });
+}
+
+// src/internal/safe/account.ts
+async function buildSafeAccount(signer, chain) {
   try {
-    return JSON.stringify(value);
-  } catch {
-    return String(value);
+    const publicClient = createPublicClient({
+      chain: baseSepolia,
+      transport: http(chain.rpcUrl)
+    });
+    return await toSafeSmartAccount({
+      client: publicClient,
+      entryPoint: { address: entryPoint07Address, version: "0.7" },
+      version: "1.4.1",
+      owners: [signer],
+      saltNonce: computeSaltNonce2(signer.address),
+      safeSingletonAddress: SAFE_L2_SINGLETON,
+      safeProxyFactoryAddress: SAFE_PROXY_FACTORY,
+      safeModuleSetupAddress: SAFE_MODULE_SETUP,
+      safe4337ModuleAddress: SAFE_4337_MODULE,
+      safeModules: [],
+      setupTransactions: []
+    });
+  } catch (cause) {
+    throw new CapxulError({
+      code: "NETWORK_ERROR",
+      message: cause instanceof Error ? cause.message : String(cause),
+      cause,
+      details: { chainId: chain.chainId }
+    });
   }
 }
-function identify(userId, traits) {
-  debugLog(`[IDENTIFY] ${userId} ${formatDebugValue2(traits ?? "")}`);
+function computeSaltNonce2(ownerAddress) {
+  return BigInt(`0x${ownerAddress.toLowerCase().slice(2).padEnd(64, "0")}`);
+}
+function deriveSafeAddress2(signerAddress) {
+  return deriveSafeAddress(signerAddress, defaultSafeDeriveConfig);
 }
 
 // ../platform-kernel/src/ids.ts
@@ -139,7 +394,7 @@ var toAccountId = makePrefixedIdConstructor(
 );
 var toOrganizationId = makePrefixedIdConstructor("org", "organizationId");
 var toMemberId = makePrefixedIdConstructor(
-  "mem",
+  "mb",
   "memberId"
 );
 var toSafeId = makePrefixedIdConstructor(
@@ -253,13 +508,13 @@ function brandExternalAccount(raw) {
 function createExternalAccountsClient(config = {}) {
   return {
     retrieve: async (externalAccountId) => {
-      if (!config.data) {
+      if (!config._data) {
         return stub(
           "externalAccounts.retrieve"
         );
       }
       const [err, raw] = await tryCatch(
-        config.data.query(api.externalAccounts.queries.retrievePersonal, {
+        config._data.query(api.externalAccounts.queries.retrievePersonal, {
           externalAccountId
         })
       );
@@ -281,11 +536,11 @@ function createExternalAccountsClient(config = {}) {
       return [null, brandExternalAccount(raw)];
     },
     remove: async (externalAccountId) => {
-      if (!config.data) {
+      if (!config._data) {
         return stub("externalAccounts.remove");
       }
       const [err] = await tryCatch(
-        config.data.mutation(api.externalAccounts.mutations.removePersonal, {
+        config._data.mutation(api.externalAccounts.mutations.removePersonal, {
           externalAccountId
         })
       );
@@ -300,17 +555,203 @@ function createExternalAccountsClient(config = {}) {
   };
 }
 
+// src/core/sub-accounts.ts
+function malformedWireError(reason, raw) {
+  return new CapxulError({
+    code: "PROVIDER_ERROR",
+    message: `convex brandSubAccount failed: ${reason}`,
+    details: {
+      provider: "convex",
+      operation: "brandSubAccount",
+      reason,
+      // PII discipline (`.claude/rules/posthog.md`): user-authored
+      // strings on the wire (`name`, `purpose`) are customer-confidential
+      // — sub-account names like "Q3 Acquisition Reserve" or
+      // "Vendor ABC payments" must not flow into telemetry. We emit a
+      // structural keys-only sample via a strict ALLOWLIST so any future
+      // wire-shape addition (e.g. `recipientEmail`, `tags`) is dropped
+      // by construction rather than leaked through a denylist gap.
+      sample: safeSampleShape(raw)
+    }
+  });
+}
+function safeSampleShape(raw) {
+  if (raw === null || typeof raw !== "object") {
+    return { type: typeof raw };
+  }
+  const r = raw;
+  const balance = r.balance;
+  return {
+    object: typeof r.object === "string" ? r.object : typeof r.object,
+    idPresent: typeof r.id === "string" && r.id.length > 0,
+    // First 4 chars only — enough to distinguish "sub_" prefixed IDs
+    // from accidental other resource IDs without leaking the full ID.
+    idPrefix: typeof r.id === "string" ? r.id.slice(0, 4) : void 0,
+    parentKind: r.parent !== null && typeof r.parent === "object" ? r.parent.kind : typeof r.parent,
+    status: r.status,
+    hasName: typeof r.name === "string",
+    hasPurpose: r.purpose !== void 0,
+    balanceShape: balance !== null && typeof balance === "object" ? Object.keys(balance).sort() : typeof balance,
+    createdAtType: typeof r.createdAt,
+    updatedAtType: typeof r.updatedAt
+  };
+}
+function isMoneyShape(v) {
+  if (typeof v !== "object" || v === null) return false;
+  const m = v;
+  return typeof m.value === "string" && typeof m.currency === "string";
+}
+function isParentShape(v) {
+  if (typeof v !== "object" || v === null) return false;
+  const p = v;
+  return (p.kind === "account" || p.kind === "organization") && typeof p.id === "string";
+}
+function isFiniteNonNegativeInteger(v) {
+  return typeof v === "number" && Number.isFinite(v) && Number.isInteger(v) && v >= 0;
+}
+function validateWireSubAccount(raw) {
+  if (typeof raw !== "object" || raw === null) {
+    return { ok: false, reason: "not an object" };
+  }
+  const r = raw;
+  if (r.object !== "sub_account") {
+    return { ok: false, reason: `object must be "sub_account" (got ${String(r.object)})` };
+  }
+  if (typeof r.id !== "string" || r.id.length === 0) {
+    return { ok: false, reason: "id must be a non-empty string" };
+  }
+  if (!isParentShape(r.parent)) {
+    return { ok: false, reason: "parent must be { kind: 'account' | 'organization', id: string }" };
+  }
+  if (typeof r.name !== "string") {
+    return { ok: false, reason: "name must be a string" };
+  }
+  if (r.purpose !== void 0 && typeof r.purpose !== "string") {
+    return { ok: false, reason: "purpose must be a string when present" };
+  }
+  if (r.status !== "active" && r.status !== "archived") {
+    return { ok: false, reason: `status must be "active" | "archived" (got ${String(r.status)})` };
+  }
+  if (!isMoneyShape(r.balance)) {
+    return { ok: false, reason: "balance must be { value: string, currency: string }" };
+  }
+  if (!isFiniteNonNegativeInteger(r.createdAt)) {
+    return { ok: false, reason: "createdAt must be a finite non-negative integer (epoch ms)" };
+  }
+  if (r.updatedAt !== void 0 && !isFiniteNonNegativeInteger(r.updatedAt)) {
+    return { ok: false, reason: "updatedAt must be a finite non-negative integer when present" };
+  }
+  return { ok: true, value: r };
+}
+function brandSubAccount(raw) {
+  const result = validateWireSubAccount(raw);
+  if (!result.ok) {
+    throw malformedWireError(result.reason, raw);
+  }
+  const wire = result.value;
+  return {
+    object: wire.object,
+    id: toSubAccountId(wire.id),
+    parent: wire.parent,
+    name: wire.name,
+    ...wire.purpose !== void 0 ? { purpose: wire.purpose } : {},
+    status: wire.status,
+    balance: wire.balance,
+    createdAt: new Date(wire.createdAt).toISOString()
+  };
+}
+function tryBrandSubAccount(raw) {
+  try {
+    return [null, brandSubAccount(raw)];
+  } catch (err) {
+    if (err instanceof CapxulError && err.code === "PROVIDER_ERROR") {
+      return [err, null];
+    }
+    return [
+      malformedWireError(
+        err instanceof Error ? err.message : String(err),
+        raw
+      ),
+      null
+    ];
+  }
+}
+function createSubAccountsClient(config = {}) {
+  return {
+    retrieve: async (subAccountId) => {
+      if (!config._data) {
+        return stub("subAccounts.retrieve");
+      }
+      const [err, raw] = await tryCatch(
+        config._data.query(api.subAccounts.queries.retrieve, {
+          subAccountId
+        })
+      );
+      if (err) {
+        return [
+          fromConvexError(err),
+          null
+        ];
+      }
+      if (!raw) {
+        return [
+          new CapxulError({
+            code: "NOT_FOUND",
+            message: `sub_account ${subAccountId} not found`
+          }),
+          null
+        ];
+      }
+      const [brandErr, branded] = tryBrandSubAccount(raw);
+      if (brandErr) {
+        return [brandErr, null];
+      }
+      return [null, branded];
+    },
+    remove: async (subAccountId) => {
+      if (!config._data) {
+        return stub("subAccounts.remove");
+      }
+      const [err, raw] = await tryCatch(
+        config._data.mutation(api.subAccounts.mutations.archive, {
+          subAccountId
+        })
+      );
+      if (err) {
+        return [
+          fromConvexError(err),
+          null
+        ];
+      }
+      if (!raw) {
+        return [
+          new CapxulError({
+            code: "NOT_FOUND",
+            message: `sub_account ${subAccountId} not found`
+          }),
+          null
+        ];
+      }
+      const [brandErr, branded] = tryBrandSubAccount(raw);
+      if (brandErr) {
+        return [brandErr, null];
+      }
+      return [null, branded];
+    }
+  };
+}
+
 // src/core/accounts.ts
 function createAccountExternalAccountsClient(config) {
   return {
     create: async (input) => {
-      if (!config.data) {
+      if (!config._data) {
         return stub(
           "accounts.externalAccounts.create"
         );
       }
       const [err, raw] = await tryCatch(
-        config.data.mutation(
+        config._data.mutation(
           api.externalAccounts.mutations.createPersonal,
           {
             kind: input.kind,
@@ -348,13 +789,13 @@ function createAccountExternalAccountsClient(config) {
       ];
     },
     list: async (input) => {
-      if (!config.data) {
+      if (!config._data) {
         return stub(
           "accounts.externalAccounts.list"
         );
       }
       const [err, result] = await tryCatch(
-        config.data.query(api.externalAccounts.queries.listPersonal, {
+        config._data.query(api.externalAccounts.queries.listPersonal, {
           limit: input.limit,
           cursor: input.cursor
         })
@@ -377,13 +818,13 @@ function createAccountExternalAccountsClient(config) {
       ];
     },
     retrieve: async (externalAccountId) => {
-      if (!config.data) {
+      if (!config._data) {
         return stub(
           "accounts.externalAccounts.retrieve"
         );
       }
       const [err, raw] = await tryCatch(
-        config.data.query(api.externalAccounts.queries.retrievePersonal, {
+        config._data.query(api.externalAccounts.queries.retrievePersonal, {
           externalAccountId
         })
       );
@@ -410,11 +851,11 @@ function createAccountExternalAccountsClient(config) {
       ];
     },
     remove: async (externalAccountId) => {
-      if (!config.data) {
+      if (!config._data) {
         return stub("accounts.externalAccounts.remove");
       }
       const [err] = await tryCatch(
-        config.data.mutation(api.externalAccounts.mutations.removePersonal, {
+        config._data.mutation(api.externalAccounts.mutations.removePersonal, {
           externalAccountId
         })
       );
@@ -428,14 +869,162 @@ function createAccountExternalAccountsClient(config) {
     }
   };
 }
-function createAccountsClient(config = {}) {
+function createAccountSubAccountsClient(config) {
   return {
-    retrieve: async (accountId) => {
-      if (!config.data) {
-        return stub("accounts.retrieve");
-      }
+    create: async (input) => {
+      if (!config._data) {
+        return stub(
+          "accounts.subAccounts.create"
+        );
+      }
+      const [err, raw] = await tryCatch(
+        config._data.mutation(api.subAccounts.mutations.create, {
+          parent: { kind: "account", id: input.accountId },
+          name: input.name,
+          purpose: input.purpose
+        })
+      );
+      if (err) {
+        return [
+          fromConvexError(err),
+          null
+        ];
+      }
+      if (!raw) {
+        return [
+          new CapxulError({
+            code: "NOT_FOUND",
+            message: "sub_account creation returned no resource"
+          }),
+          null
+        ];
+      }
+      const [brandErr, branded] = tryBrandSubAccount(raw);
+      if (brandErr) {
+        return [
+          brandErr,
+          null
+        ];
+      }
+      return [null, branded];
+    },
+    list: async (input) => {
+      if (!config._data) {
+        return stub(
+          "accounts.subAccounts.list"
+        );
+      }
+      const [err, rows] = await tryCatch(
+        config._data.query(api.subAccounts.queries.listByAccount, {
+          accountId: input.accountId
+        })
+      );
+      if (err) {
+        return [
+          fromConvexError(err),
+          null
+        ];
+      }
+      const branded = [];
+      for (const row of rows) {
+        const [brandErr, value] = tryBrandSubAccount(row);
+        if (brandErr) {
+          return [
+            brandErr,
+            null
+          ];
+        }
+        branded.push(value);
+      }
+      return [
+        null,
+        {
+          object: "list",
+          data: branded,
+          page: { hasMore: false }
+        }
+      ];
+    },
+    retrieve: async (subAccountId) => {
+      if (!config._data) {
+        return stub(
+          "accounts.subAccounts.retrieve"
+        );
+      }
+      const [err, raw] = await tryCatch(
+        config._data.query(api.subAccounts.queries.retrieve, {
+          subAccountId
+        })
+      );
+      if (err) {
+        return [
+          fromConvexError(err),
+          null
+        ];
+      }
+      if (!raw) {
+        return [
+          new CapxulError({
+            code: "NOT_FOUND",
+            message: `sub_account ${subAccountId} not found`
+          }),
+          null
+        ];
+      }
+      const [brandErr, branded] = tryBrandSubAccount(raw);
+      if (brandErr) {
+        return [
+          brandErr,
+          null
+        ];
+      }
+      return [null, branded];
+    },
+    remove: async (subAccountId) => {
+      if (!config._data) {
+        return stub(
+          "accounts.subAccounts.remove"
+        );
+      }
+      const [err, raw] = await tryCatch(
+        config._data.mutation(api.subAccounts.mutations.archive, {
+          subAccountId
+        })
+      );
+      if (err) {
+        return [
+          fromConvexError(err),
+          null
+        ];
+      }
+      if (!raw) {
+        return [
+          new CapxulError({
+            code: "NOT_FOUND",
+            message: `sub_account ${subAccountId} not found`
+          }),
+          null
+        ];
+      }
+      const [brandErr, branded] = tryBrandSubAccount(raw);
+      if (brandErr) {
+        return [
+          brandErr,
+          null
+        ];
+      }
+      return [null, branded];
+    }
+  };
+}
+function createAccountsClient(config = {}) {
+  return {
+    retrieve: async (accountId) => {
+      if (!config._data) {
+        return stub("accounts.retrieve");
+      }
       try {
-        const account = await config.data.query(
+        const account = await config._data.query(
           api.openfort.queries.getMyAccount,
           {}
         );
@@ -459,7 +1048,7 @@ function createAccountsClient(config = {}) {
     },
     lookup: async () => stub("accounts.lookup"),
     update: async (input) => {
-      if (!config.data) {
+      if (!config._data) {
         return stub("accounts.update");
       }
       if (input.countryCode !== void 0) {
@@ -473,7 +1062,7 @@ function createAccountsClient(config = {}) {
         ];
       }
       try {
-        const current = await config.data.query(
+        const current = await config._data.query(
           api.openfort.queries.getMyAccount,
           {}
         );
@@ -490,11 +1079,11 @@ function createAccountsClient(config = {}) {
             null
           ];
         }
-        await config.data.mutation(api.openfort.mutations.updateProfile, {
+        await config._data.mutation(api.openfort.mutations.updateProfile, {
           displayName: input.name,
           username: input.username
         });
-        const updated = await config.data.query(
+        const updated = await config._data.query(
           api.openfort.queries.getMyAccount,
           {}
         );
@@ -504,7 +1093,7 @@ function createAccountsClient(config = {}) {
       }
     },
     provisionPersonal: async (input) => {
-      if (!config.data) {
+      if (!config._data) {
         return stub(
           "accounts.provisionPersonal"
         );
@@ -519,17 +1108,17 @@ function createAccountsClient(config = {}) {
         ];
       }
       try {
-        await config.data.mutation(
+        await config._data.mutation(
           api.safe.mutations.provisionLocalPersonalAccount,
           {
             displayName: input.displayName,
             username: input.username,
             countryCode: input.countryCode,
             eoaAddress: input.signerProvider.signerAddress,
-            safeAddress: input.signerProvider.safeAddress
+            safeAddress: deriveSafeAddress2(input.signerProvider.signerAddress)
           }
         );
-        const account = await config.data.query(
+        const account = await config._data.query(
           api.openfort.queries.getMyAccount,
           {}
         );
@@ -552,11 +1141,11 @@ function createAccountsClient(config = {}) {
     },
     safes: {
       retrieve: async (safeId) => {
-        if (!config.data) {
+        if (!config._data) {
           return stub("accounts.safes.retrieve");
         }
         try {
-          const safe = await config.data.query(
+          const safe = await config._data.query(
             api.safe.queries.retrieveAccountSafe,
             { safeId }
           );
@@ -583,19 +1172,50 @@ function createAccountsClient(config = {}) {
       retrieve: async () => stub("accounts.kycProfiles.retrieve")
     },
     externalAccounts: createAccountExternalAccountsClient(config),
-    subAccounts: {
-      create: async () => stub("accounts.subAccounts.create"),
-      list: async () => stub("accounts.subAccounts.list"),
-      retrieve: async () => stub("accounts.subAccounts.retrieve"),
-      remove: async () => stub("accounts.subAccounts.remove")
-    },
+    subAccounts: createAccountSubAccountsClient(config),
     balanceLedger: {
-      list: async () => stub(
-        "accounts.balanceLedger.list"
-      ),
-      retrieve: async () => stub(
-        "accounts.balanceLedger.retrieve"
-      )
+      list: async (input) => {
+        if (!config._data) {
+          return stub(
+            "accounts.balanceLedger.list"
+          );
+        }
+        try {
+          const accountId = input.accountId.replace(/^acct_/, "");
+          const page = await config._data.query(
+            api.balanceLedger.queries.listForAccount,
+            { accountId, limit: input.limit, cursor: input.cursor }
+          );
+          return [null, page];
+        } catch (cause) {
+          return [fromConvexError(cause), null];
+        }
+      },
+      retrieve: async (entryId) => {
+        if (!config._data) {
+          return stub(
+            "accounts.balanceLedger.retrieve"
+          );
+        }
+        try {
+          const entry = await config._data.query(
+            api.balanceLedger.queries.retrieve,
+            { entryId }
+          );
+          if (!entry) {
+            return [
+              new CapxulError({
+                code: "NOT_FOUND",
+                message: `balance_ledger_entry ${entryId} not found`
+              }),
+              null
+            ];
+          }
+          return [null, entry];
+        } catch (cause) {
+          return [fromConvexError(cause), null];
+        }
+      }
     }
   };
 }
@@ -609,120 +1229,11 @@ function createApiKeysClient() {
     revoke: async () => stub("apiKeys.revoke")
   };
 }
-
-// ../config/src/chain.ts
-var CAPXUL_PAYMENTS_ADDRESS = "0xe740ea65521edc9bef0ea75d30b5334711db99f4";
-var TEST_USDC_ADDRESS = "0xf09fcbb6df9f8f918e58f9c8ab15a76ade862b77";
-var CAPXUL_API_BASE_URL = "https://elated-oyster-269.convex.site";
-
-// ../config/src/timing.ts
-var FLOW_INVOKE_TIMEOUT_MS = 3e4;
-var WEBHOOK_FRESHNESS_WINDOW_MS = 5 * 60 * 1e3;
-
-// ../config/src/errors.ts
-var CapxulError2 = class extends Error {
-  code;
-  details;
-  correlationId;
-  layer;
-  constructor(code, message, options) {
-    super(message, options?.cause ? { cause: options.cause } : void 0);
-    this.code = code;
-    this.details = options?.details;
-    this.correlationId = options?.correlationId;
-    this.layer = options?.layer;
-  }
-};
-var Errors = {
-  notAuthenticated: () => new CapxulError2("NOT_AUTHENTICATED", "Not authenticated"),
-  profileNotFound: (authUserId) => new CapxulError2("PROFILE_NOT_FOUND", `Profile not found for user ${authUserId}`),
-  smartAccountMissing: (authUserId) => new CapxulError2("SMART_ACCOUNT_MISSING", `Smart account not provisioned for user ${authUserId}`),
-  envMissing: (name) => new CapxulError2("ENV_MISSING", `Environment variable ${name} not configured`),
-  openfortApi: (operation, cause) => new CapxulError2(
-    "PROVIDER_ERROR",
-    `Openfort ${operation} failed: ${cause instanceof Error ? cause.message : String(cause)}`,
-    { cause, details: { provider: "openfort", operation } }
-  ),
-  shieldApi: (status, detail) => new CapxulError2(
-    "PROVIDER_ERROR",
-    `Shield API error (${status}): ${detail}`,
-    { details: { provider: "shield", status } }
-  ),
-  providerError: (provider, operation, cause) => new CapxulError2(
-    "PROVIDER_ERROR",
-    `${provider} ${operation} failed: ${cause instanceof Error ? cause.message : String(cause)}`,
-    { cause, details: { provider, operation } }
-  ),
-  invalidInput: (field, reason) => new CapxulError2(
-    "INVALID_INPUT",
-    `Invalid ${field}: ${reason}`,
-    { details: { field, reason } }
-  ),
-  playerNotFound: (playerId) => new CapxulError2(
-    "PLAYER_NOT_FOUND",
-    playerId ? `Openfort player ${playerId} not found` : "Openfort player not found"
-  ),
-  accountNotFound: (accountId) => new CapxulError2(
-    "ACCOUNT_NOT_FOUND",
-    accountId ? `Openfort account ${accountId} not found` : "Openfort smart account not found"
-  ),
-  invalidRecipient: (reason) => new CapxulError2("INVALID_RECIPIENT", reason),
-  permissionDenied: (reason = "Permission denied") => new CapxulError2("PERMISSION_DENIED", reason),
-  notFound: (resource, id) => new CapxulError2(
-    "NOT_FOUND",
-    id ? `${resource} ${id} not found` : `${resource} not found`
-  ),
-  idempotencyConflict: (details) => new CapxulError2(
-    "IDEMPOTENCY_CONFLICT",
-    "Idempotency key was already used for a different request",
-    { details }
-  ),
-  emailDeliveryFailed: (detail, details) => new CapxulError2("EMAIL_DELIVERY_FAILED", `Failed to send email: ${detail}`, {
-    details
-  }),
-  rateLimited: (details) => new CapxulError2("RATE_LIMITED", "Request was rate limited", {
-    details: { ...details }
-  }),
-  internalError: (reason) => new CapxulError2("INTERNAL_ERROR", `Internal error: ${reason}`),
-  /**
-   * Verification gate. Surfaced when a request hits a verification
-   * boundary the actor cannot cross under their current state. Two
-   * variants share this code:
-   *
-   * - Rail gate (Withdrawals v1 W2, #465): the resolved
-   *   `external_account.kind` routes to a withdrawal rail (e.g.
-   *   `fiat_offramp`, `card_payout`) that is not yet supported. Carries
-   *   `details.rail` + `details.currentKind`.
-   * - KYC tier gate (legacy / future): the actor's KYC tier is below
-   *   the required tier. Carries `details.requiredTier`.
-   *
-   * Code is shared because both expose the same UX shape ("you cannot
-   * proceed until verification advances"); the `details.*` keys
-   * differentiate the route.
-   */
-  verificationRequired: (details) => {
-    const message = "rail" in details ? `Withdrawal rail "${details.rail}" (kind=${details.currentKind}) is not yet supported.` : `Verification tier ${details.requiredTier} is required.`;
-    return new CapxulError2("VERIFICATION_REQUIRED", message, {
-      details: { ...details }
-    });
-  }
-};
-
-// ../config/src/safe.ts
-var SAFE_PROXY_FACTORY = "0x4e1dcf7ad4e460cfd30791ccc4f9c8a4f820ec67";
-var SAFE_L2_SINGLETON = "0x29fcb43b46531bca003ddc8fcb67ffe91900c762";
-var SAFE_MODULE_SETUP = "0x2dd68b007b46fbe91b9a7c3eda5a7a1063cb5b47";
-var SAFE_4337_MODULE = "0x75cf11467937ce3f2f357ce24ffc3dbf8fd5c226";
-
-// ../config/src/org-roles.ts
-function roleKeyFromLabel(label) {
-  const bytes = new TextEncoder().encode(label);
-  const hex = Array.from(bytes).map((b) => b.toString(16).padStart(2, "0")).join("");
-  return "0x" + hex.padEnd(64, "0");
+function createDefaultDataClient(convexUrl, jwt) {
+  const client = new ConvexHttpClient(convexUrl);
+  client.setAuth(jwt);
+  return client;
 }
-roleKeyFromLabel("OWNER");
-roleKeyFromLabel("FINANCE_MANAGER");
-roleKeyFromLabel("TEAM_LEAD");
 
 // src/transport.ts
 function makeHttpTransport(config) {
@@ -1053,7 +1564,7 @@ function readNonEmptyString(value) {
 
 // src/core/auth.ts
 function createAuthClient(config = {}) {
-  let dataClient = config.data ?? null;
+  let dataClient = config._data ?? null;
   const sessionStore = config.auth?.sessionStore ?? createMemorySessionStore();
   const getTransport = createTransportProvider(config);
   return {
@@ -1109,11 +1620,20 @@ function createAuthClient(config = {}) {
         ).toISOString()
       };
       sessionStore.set(session);
-      if (config.auth?.createDataClient) {
+      if (!dataClient) {
         try {
-          dataClient = await config.auth.createDataClient(session);
-          mutableConfig(config).data = dataClient;
-          transport.markAuthenticated({ dataClient });
+          const convexUrl = transport.convexUrl;
+          if (!convexUrl || !session.convexJwt) {
+            return [
+              new CapxulError({
+                code: "NETWORK_ERROR",
+                message: "Cannot create data client: missing convex URL or JWT."
+              }),
+              null
+            ];
+          }
+          dataClient = createDefaultDataClient(convexUrl, session.convexJwt);
+          mutableConfig(config)._data = dataClient;
         } catch (cause) {
           return [
             new CapxulError({
@@ -1124,7 +1644,15 @@ function createAuthClient(config = {}) {
             null
           ];
         }
+      } else {
+        const injected = dataClient;
+        if (typeof injected.refreshAuth === "function") {
+          injected.refreshAuth();
+        } else if (typeof injected.setAuth === "function" && session.convexJwt) {
+          injected.setAuth(session.convexJwt);
+        }
       }
+      transport.markAuthenticated({ dataClient });
       if (!dataClient) {
         return [
           new CapxulError({
@@ -1152,7 +1680,7 @@ function createAuthClient(config = {}) {
     },
     completeBootstrap: async (input) => {
       const session = sessionStore.get();
-      const data = dataClient ?? config.data;
+      const data = dataClient ?? config._data;
       if (!session || !data) {
         return [
           new CapxulError({
@@ -1162,23 +1690,38 @@ function createAuthClient(config = {}) {
           null
         ];
       }
-      if (input.signerProvider.kind !== "local-private-key") {
+      const signerAddress = config.signer?.address;
+      if (!signerAddress) {
         return [
           new CapxulError({
             code: "INVALID_INPUT",
-            message: "completeBootstrap currently supports local-private-key signer providers only."
+            message: "completeBootstrap requires a signer to be configured on the client."
           }),
           null
         ];
       }
       try {
-        const result = await data.mutation(api.authBootstrap.completeBootstrap, {
+        const safeAddress = deriveSafeAddress2(signerAddress);
+        if (!data.action) {
+          return [
+            new CapxulError({
+              code: "INVALID_INPUT",
+              message: "completeBootstrap requires a data client that can execute Convex actions."
+            }),
+            null
+          ];
+        }
+        const result = await data.action(api.authBootstrap.completeBootstrap, {
           bootstrapToken: input.bootstrapToken,
           sessionToken: session.token,
           username: input.username,
           displayName: input.displayName,
           countryCode: input.countryCode,
-          signerProvider: input.signerProvider
+          signerProvider: {
+            kind: "local-private-key",
+            signerAddress,
+            safeAddress
+          }
         });
         return [null, { kind: "authenticated", session, ...result }];
       } catch (cause) {
@@ -1192,7 +1735,7 @@ function createAuthClient(config = {}) {
     signOut: async () => {
       sessionStore.clear();
       dataClient = null;
-      mutableConfig(config).data = void 0;
+      mutableConfig(config)._data = void 0;
       const transport = getTransport();
       transport?.clearAuth();
       return [null, void 0];
@@ -1263,6 +1806,9 @@ async function postBetterAuth(transport, path, body, code, signal) {
     }
     return [null, text ? JSON.parse(text) : void 0];
   } catch (cause) {
+    if (cause instanceof CapxulError) {
+      return [cause, null];
+    }
     return [
       new CapxulError({
         code: "NETWORK_ERROR",
@@ -1301,7 +1847,7 @@ function parseBetterAuthError(text) {
   }
 }
 function isCapxulErrorCode2(code) {
-  return code === "NOT_AUTHENTICATED" || code === "EMAIL_DELIVERY_FAILED" || code === "INVALID_INPUT" || code === "RATE_LIMITED" || code === "NETWORK_ERROR" || code === "API_KEY_INVALID" || code === "API_KEY_EXPIRED";
+  return code === "NOT_AUTHENTICATED" || code === "EMAIL_DELIVERY_FAILED" || code === "INVALID_INPUT" || code === "RATE_LIMITED" || code === "NETWORK_ERROR" || code === "API_KEY_INVALID" || code === "API_KEY_EXPIRED" || code === "INTERNAL_ERROR" || code === "ENV_MISSING" || code === "UNKNOWN" || code === "PROVIDER_ERROR";
 }
 async function exchangeConvexToken(transport, config, token, signal) {
   const path = config.auth?.convexTokenUrl ?? "/convex/token";
@@ -1331,6 +1877,9 @@ async function exchangeConvexToken(transport, config, token, signal) {
     }
     return [null, body.token];
   } catch (cause) {
+    if (cause instanceof CapxulError) {
+      return [cause, null];
+    }
     return [
       new CapxulError({
         code: "NETWORK_ERROR",
@@ -1345,16 +1894,227 @@ function mutableConfig(config) {
   return config;
 }
 
+// src/core/auth-service.ts
+var AuthService = class {
+  authClient;
+  sessionStore;
+  config;
+  constructor(config = {}) {
+    this.config = config;
+    this.sessionStore = config.auth?.sessionStore ?? createMemorySessionStore2();
+    this.authClient = createAuthClient({
+      ...config,
+      auth: { ...config.auth, sessionStore: this.sessionStore }
+    });
+  }
+  async sendOtp(email, options) {
+    const [err] = await this.authClient.sendOtp({ email }, options);
+    if (err) throw err;
+  }
+  async verifyOtp(email, otp, options) {
+    const [err, result] = await this.authClient.verifyOtp(
+      { email, otp },
+      options
+    );
+    if (err) throw err;
+    return result;
+  }
+  async completeBootstrap(params, signer) {
+    if (signer) {
+      const tempClient = createAuthClient({
+        ...this.config,
+        signer,
+        auth: { ...this.config.auth, sessionStore: this.sessionStore }
+      });
+      const [err2, result2] = await tempClient.completeBootstrap(params);
+      if (err2) throw err2;
+      return result2;
+    }
+    const [err, result] = await this.authClient.completeBootstrap(params);
+    if (err) throw err;
+    return result;
+  }
+  /**
+   * Clears the persisted session and, when a transport was pre-injected,
+   * drops the cached auth header.
+   *
+   * **Transport safety note:** `clearAuth()` is only invoked when
+   * `config._transport` was supplied at construction (e.g. by the React
+   * provider). If `AuthService` is instantiated directly in a Node/CLI
+   * context without an injected transport, the transport-side auth cache
+   * is the caller's responsibility.
+   */
+  async signOut() {
+    if (!this.config._transport) {
+      const [err] = await this.authClient.signOut();
+      if (err) throw err;
+      mutableConfig2(this.config)._data = void 0;
+      return;
+    }
+    this.sessionStore.clear();
+    this.config._transport.clearAuth();
+  }
+  async getSession() {
+    const [err, session] = await this.authClient.getSession();
+    if (err) throw err;
+    return session;
+  }
+};
+function mutableConfig2(config) {
+  return config;
+}
+function createMemorySessionStore2() {
+  let current = null;
+  return {
+    get: () => current,
+    set: (session) => {
+      current = session;
+    },
+    clear: () => {
+      current = null;
+    }
+  };
+}
+
 // src/core/documents.ts
-function createDocumentsClient() {
+function requireInvoiceHash(row) {
+  if (!row.invoiceHash) {
+    throw new CapxulError({
+      code: "INVALID_INPUT",
+      message: `invoice document ${row.documentId ?? row._id} is missing its canonical invoiceHash`
+    });
+  }
+  return row.invoiceHash;
+}
+function mapInvoiceRow(row) {
+  const status = row.status === "cancelled" ? "canceled" : row.status === "pending" ? "open" : row.status === "overdue" ? "expired" : row.status;
+  return {
+    object: "document",
+    id: row.documentId ?? row._id,
+    type: "invoice",
+    owner: {
+      kind: row.scope === "org" ? "organization" : "account",
+      id: row.orgId ?? row.payeeEmail ?? row.payeeLabel
+    },
+    recipient: { email: row.payerEmail },
+    amount: {
+      value: row.amount,
+      currency: row.currency
+    },
+    reference: row.note,
+    lineItems: row.items,
+    invoiceHash: requireInvoiceHash(row),
+    dueAt: row.dueDate,
+    status,
+    createdAt: new Date(row.createdAt).toISOString()
+  };
+}
+function mapDocumentError(cause) {
+  return fromConvexError(cause);
+}
+function createDocumentsClient(config = {}) {
   return {
-    create: async () => stub("documents.create"),
-    retrieve: async () => stub("documents.retrieve"),
-    list: async () => stub("documents.list"),
-    cancel: async () => stub("documents.cancel")
+    create: async (input) => {
+      if (!config._data) return stub("documents.create");
+      if (input.type !== "invoice") {
+        return [
+          new CapxulError({
+            code: "INVALID_INPUT",
+            message: "documents.create currently supports personal invoice documents only."
+          }),
+          null
+        ];
+      }
+      if (!("email" in input.recipient)) {
+        return [
+          new CapxulError({
+            code: "INVALID_INPUT",
+            message: "personal invoice documents currently require an email recipient."
+          }),
+          null
+        ];
+      }
+      try {
+        const created = await config._data.mutation(
+          api.paymentRecords.mutations.createInvoice,
+          {
+            scope: "personal",
+            payerEmail: input.recipient.email,
+            amount: input.amount.value,
+            currency: input.amount.currency,
+            dueDate: input.dueAt ?? (/* @__PURE__ */ new Date()).toISOString(),
+            note: input.reference,
+            items: input.lineItems
+          }
+        );
+        const row = await config._data.query(
+          api.paymentRecords.queries.getInvoiceByDocumentId,
+          { documentId: created.documentId }
+        );
+        if (!row) throw new Error("created invoice was not readable");
+        return [null, mapInvoiceRow(row)];
+      } catch (cause) {
+        return [mapDocumentError(cause), null];
+      }
+    },
+    retrieve: async (documentId) => {
+      if (!config._data)
+        return stub("documents.retrieve");
+      try {
+        const row = await config._data.query(
+          api.paymentRecords.queries.getInvoiceByDocumentId,
+          { documentId }
+        );
+        if (!row) {
+          return [
+            new CapxulError({
+              code: "NOT_FOUND",
+              message: `document ${documentId} not found`
+            }),
+            null
+          ];
+        }
+        return [null, mapInvoiceRow(row)];
+      } catch (cause) {
+        return [mapDocumentError(cause), null];
+      }
+    },
+    list: async (input = {}) => {
+      if (!config._data)
+        return stub("documents.list");
+      try {
+        if (input.type && input.type !== "invoice") {
+          return [null, { object: "list", data: [], page: { hasMore: false } }];
+        }
+        const rows = await config._data.query(
+          api.paymentRecords.queries.listMyInvoices,
+          {
+            limit: input.limit,
+            cursor: input.cursor
+          }
+        );
+        const page = rows;
+        const data = page.data.map((row) => mapInvoiceRow(row));
+        return [null, { object: "list", data, page: page.page }];
+      } catch (cause) {
+        return [mapDocumentError(cause), null];
+      }
+    },
+    cancel: async (documentId) => {
+      if (!config._data) return stub("documents.cancel");
+      try {
+        const row = await config._data.mutation(
+          api.paymentRecords.mutations.cancelInvoice,
+          { documentId }
+        );
+        return [null, mapInvoiceRow(row)];
+      } catch (cause) {
+        return [mapDocumentError(cause), null];
+      }
+    }
   };
 }
-function createOrgDocumentsClient() {
+function createOrgDocumentsClient(_config = {}) {
   return {
     create: async () => stub("organizations.documents.create"),
     retrieve: async () => stub("organizations.documents.retrieve"),
@@ -1367,11 +2127,11 @@ function createOrgDocumentsClient() {
 function createMeClient(config = {}) {
   return {
     get: async () => {
-      if (!config.data) {
+      if (!config._data) {
         return stub("me.get");
       }
       try {
-        const account = await config.data.query(
+        const account = await config._data.query(
           api.openfort.queries.getMyAccount,
           {}
         );
@@ -1381,7 +2141,7 @@ function createMeClient(config = {}) {
       }
     },
     update: async (input) => {
-      if (!config.data) {
+      if (!config._data) {
         return stub("me.update");
       }
       if (input.countryCode !== void 0) {
@@ -1395,11 +2155,11 @@ function createMeClient(config = {}) {
         ];
       }
       try {
-        await config.data.mutation(api.openfort.mutations.updateProfile, {
+        await config._data.mutation(api.openfort.mutations.updateProfile, {
           displayName: input.name,
           username: input.username
         });
-        const account = await config.data.query(
+        const account = await config._data.query(
           api.openfort.queries.getMyAccount,
           {}
         );
@@ -1414,11 +2174,11 @@ function createMeClient(config = {}) {
 // src/core/operations.ts
 function createOperationsClient(config = {}) {
   const retrieve = async (operationId) => {
-    if (!config.data) {
+    if (!config._data) {
       return stub("operations.retrieve");
     }
     try {
-      const operation = await config.data.query(api.operations.queries.retrieve, {
+      const operation = await config._data.query(api.operations.queries.retrieve, {
         operationId
       });
       if (!operation) {
@@ -1435,7 +2195,7 @@ function createOperationsClient(config = {}) {
   return {
     retrieve,
     wait: async (operationId, input = {}) => {
-      if (!config.data) {
+      if (!config._data) {
         return stub("operations.wait");
       }
       const until = new Set(
@@ -1470,49 +2230,22 @@ function toTokenUnits(value, decimals = 6) {
   return parseUnits(value, decimals);
 }
 
-// src/internal/payment-token.ts
-function resolvePaymentTokenAddress(currency) {
+// src/core/token-registry.ts
+function resolvePaymentToken(currency) {
   const normalized = currency.trim().toUpperCase();
   if (normalized === "USD" || normalized === "USDC") {
-    return TEST_USDC_ADDRESS.toLowerCase();
+    return {
+      address: TEST_USDC_ADDRESS.toLowerCase(),
+      decimals: 6,
+      symbol: "USDC"
+    };
   }
   throw new CapxulError({
-    code: "NETWORK_ERROR",
-    message: `Currency ${currency} is not configured for on-chain payment submission.`,
+    code: "NOT_IMPLEMENTED",
+    message: `Currency ${currency} is not yet supported by the token registry.`,
     details: { currency: normalized }
   });
 }
-async function buildSafeAccount(signer, chain) {
-  try {
-    const publicClient = createPublicClient({
-      chain: baseSepolia,
-      transport: http(chain.rpcUrl)
-    });
-    return await toSafeSmartAccount({
-      client: publicClient,
-      entryPoint: { address: entryPoint07Address, version: "0.7" },
-      version: "1.4.1",
-      owners: [signer],
-      saltNonce: computeSaltNonce(signer.address),
-      safeSingletonAddress: SAFE_L2_SINGLETON,
-      safeProxyFactoryAddress: SAFE_PROXY_FACTORY,
-      safeModuleSetupAddress: SAFE_MODULE_SETUP,
-      safe4337ModuleAddress: SAFE_4337_MODULE,
-      safeModules: [],
-      setupTransactions: []
-    });
-  } catch (cause) {
-    throw new CapxulError({
-      code: "NETWORK_ERROR",
-      message: cause instanceof Error ? cause.message : String(cause),
-      cause,
-      details: { chainId: chain.chainId }
-    });
-  }
-}
-function computeSaltNonce(ownerAddress) {
-  return BigInt(`0x${ownerAddress.toLowerCase().slice(2).padEnd(64, "0")}`);
-}
 function createCapxulBundler(config) {
   const paymaster = createPaymasterClient({
     transport: http(config.rpcUrl)
@@ -1619,13 +2352,13 @@ async function transferAsOwner(config, params) {
 function createPaymentsClient(config = {}) {
   return {
     create: async (input) => {
-      if (!config.data || !config.signer || !config.signing) {
+      if (!config._data || !config.signer || !config.signing) {
         return stub("payments.create");
       }
       let created = null;
       let submitted = null;
       try {
-        created = await config.data.mutation(api.payments.mutations.create, {
+        created = await config._data.mutation(api.payments.mutations.create, {
           to: input.to,
           amount: input.amount,
           reference: input.reference,
@@ -1633,15 +2366,21 @@ function createPaymentsClient(config = {}) {
           source: input.source
         });
         if (!created) {
-          return [new CapxulError({
-            code: "NETWORK_ERROR",
-            message: "payments.create returned no payment resource"
-          }), null];
+          return [
+            new CapxulError({
+              code: "NETWORK_ERROR",
+              message: "payments.create returned no payment resource"
+            }),
+            null
+          ];
         }
         if (created.status !== "processing" || created.operation.status !== "processing") {
           return [null, created];
         }
-        const currentSigner = await config.data.query(api.safe.queries.getMySignerAddress, {});
+        const currentSigner = await config._data.query(
+          api.safe.queries.getMySignerAddress,
+          {}
+        );
         if (!currentSigner?.address) {
           throw new CapxulError({
             code: "PERMISSION_DENIED",
@@ -1660,9 +2399,12 @@ function createPaymentsClient(config = {}) {
             }
           });
         }
-        const submission = await config.data.query(api.payments.queries.prepareSubmission, {
-          paymentId: created.id
-        });
+        const submission = await config._data.query(
+          api.payments.queries.prepareSubmission,
+          {
+            paymentId: created.id
+          }
+        );
         if (!submission?.recipientAddress) {
           throw new CapxulError({
             code: "NETWORK_ERROR",
@@ -1670,15 +2412,16 @@ function createPaymentsClient(config = {}) {
             details: { paymentId: created.id }
           });
         }
+        const token = resolvePaymentToken(submission.amount.currency);
         const transfer = await transferAsOwner(
           {
             signer: config.signer,
             signing: config.signing
           },
           {
-            tokenAddress: resolvePaymentTokenAddress(submission.amount.currency),
+            tokenAddress: token.address,
             recipientAddress: submission.recipientAddress,
-            amount: toTokenUnits(submission.amount.value, 6)
+            amount: toTokenUnits(submission.amount.value, token.decimals)
           }
         );
         if (!transfer.success) {
@@ -1696,7 +2439,7 @@ function createPaymentsClient(config = {}) {
           txHash: transfer.txHash,
           userOpHash: transfer.userOpHash
         };
-        await config.data.mutation(api.payments.mutations.recordSubmitted, {
+        await config._data.mutation(api.payments.mutations.recordSubmitted, {
           paymentId: created.id,
           txHash: transfer.txHash,
           userOpHash: transfer.userOpHash,
@@ -1706,43 +2449,65 @@ function createPaymentsClient(config = {}) {
       } catch (cause) {
         const error = mapCreateError(fromConvexError(cause));
         if (created?.id && created.status === "processing" && !submitted) {
-          await bestEffortMarkFailed({ data: config.data }, created.id, error);
+          await bestEffortMarkFailed({ _data: config._data }, created.id, error);
         }
         if (submitted && created?.id) {
-          return [new CapxulError({
-            code: "NETWORK_ERROR",
-            message: "Payment was submitted on-chain, but backend submission tracking failed.",
-            cause,
-            details: {
-              paymentId: created.id,
-              txHash: submitted.txHash,
-              userOpHash: submitted.userOpHash
-            }
-          }), null];
+          return [
+            new CapxulError({
+              code: "NETWORK_ERROR",
+              message: "Payment was submitted on-chain, but backend submission tracking failed.",
+              cause,
+              details: {
+                paymentId: created.id,
+                txHash: submitted.txHash,
+                userOpHash: submitted.userOpHash
+              }
+            }),
+            null
+          ];
         }
         return [error, null];
       }
     },
     retrieve: async (paymentId) => {
-      if (!config.data) {
+      if (!config._data) {
         return stub("payments.retrieve");
       }
       try {
-        const payment = await config.data.query(api.payments.queries.retrieve, {
-          paymentId
-        });
+        const payment = await config._data.query(
+          api.payments.queries.retrieve,
+          {
+            paymentId
+          }
+        );
         if (!payment) {
-          return [new CapxulError({
-            code: "NOT_FOUND",
-            message: `payment ${paymentId} not found`
-          }), null];
+          return [
+            new CapxulError({
+              code: "NOT_FOUND",
+              message: `payment ${paymentId} not found`
+            }),
+            null
+          ];
         }
         return [null, payment];
       } catch (cause) {
         return [fromConvexError(cause), null];
       }
     },
-    list: async () => stub("payments.list")
+    list: async (input) => {
+      if (!config._data) {
+        return stub("payments.list");
+      }
+      try {
+        const page = await config._data.query(api.payments.queries.list, {
+          limit: input?.limit,
+          cursor: input?.cursor
+        });
+        return [null, page];
+      } catch (cause) {
+        return [fromConvexError(cause), null];
+      }
+    }
   };
 }
 function createOrgPaymentsClient() {
@@ -1756,7 +2521,7 @@ function createOrgPaymentsClient() {
 }
 async function bestEffortMarkFailed(config, paymentId, error) {
   try {
-    await config.data.mutation(api.payments.mutations.markFailed, {
+    await config._data.mutation(api.payments.mutations.markFailed, {
       paymentId,
       errorCode: error.code,
       errorMessage: error.message,
@@ -1813,11 +2578,11 @@ function createOrgTransfersClient() {
 function createWithdrawalsClient(config = {}) {
   return {
     create: async (input) => {
-      if (!config.data) {
+      if (!config._data) {
         return stub("withdrawals.create");
       }
       const [createErr, createdRaw] = await tryCatch(
-        config.data.mutation(api.withdrawals.mutations.create, {
+        config._data.mutation(api.withdrawals.mutations.create, {
           amount: input.amount,
           destination: {
             externalAccountId: input.destination.externalAccountId
@@ -1847,18 +2612,18 @@ function createWithdrawalsClient(config = {}) {
         return [null, created];
       }
       const [signerErr, currentSigner] = await tryCatch(
-        config.data.query(api.safe.queries.getMySignerAddress, {})
+        config._data.query(api.safe.queries.getMySignerAddress, {})
       );
       if (signerErr) {
         return await handleSubmissionFailure(
-          { data: config.data },
+          { _data: config._data },
           created.id,
           mapCreateError2(fromConvexError(signerErr))
         );
       }
       if (!currentSigner?.address) {
         return await handleSubmissionFailure(
-          { data: config.data },
+          { _data: config._data },
           created.id,
           new CapxulError({
             code: "PERMISSION_DENIED",
@@ -1869,7 +2634,7 @@ function createWithdrawalsClient(config = {}) {
       }
       if (getAddress(currentSigner.address) !== getAddress(config.signer.address)) {
         return await handleSubmissionFailure(
-          { data: config.data },
+          { _data: config._data },
           created.id,
           new CapxulError({
             code: "PERMISSION_DENIED",
@@ -1883,13 +2648,13 @@ function createWithdrawalsClient(config = {}) {
         );
       }
       const [prepErr, submission] = await tryCatch(
-        config.data.query(api.withdrawals.queries.prepareSubmission, {
+        config._data.query(api.withdrawals.queries.prepareSubmission, {
           withdrawalId: created.id
         })
       );
       if (prepErr) {
         return await handleSubmissionFailure(
-          { data: config.data },
+          { _data: config._data },
           created.id,
           mapCreateError2(fromConvexError(prepErr))
         );
@@ -1897,7 +2662,7 @@ function createWithdrawalsClient(config = {}) {
       const destinationAddress = submission?.destinationAddress;
       if (!submission || !destinationAddress) {
         return await handleSubmissionFailure(
-          { data: config.data },
+          { _data: config._data },
           created.id,
           new CapxulError({
             code: "NETWORK_ERROR",
@@ -1906,6 +2671,7 @@ function createWithdrawalsClient(config = {}) {
           })
         );
       }
+      const token = resolvePaymentToken(submission.amount.currency);
       const [transferErr, transferOk] = await tryCatch(
         transferAsOwner(
           {
@@ -1913,22 +2679,22 @@ function createWithdrawalsClient(config = {}) {
             signing: config.signing
           },
           {
-            tokenAddress: resolvePaymentTokenAddress(submission.amount.currency),
+            tokenAddress: token.address,
             recipientAddress: destinationAddress,
-            amount: toTokenUnits(submission.amount.value, 6)
+            amount: toTokenUnits(submission.amount.value, token.decimals)
           }
         )
       );
       if (transferErr) {
         return await handleSubmissionFailure(
-          { data: config.data },
+          { _data: config._data },
           created.id,
           mapCreateError2(fromConvexError(transferErr))
         );
       }
       if (!transferOk.success) {
         return await handleSubmissionFailure(
-          { data: config.data },
+          { _data: config._data },
           created.id,
           new CapxulError({
             code: "NETWORK_ERROR",
@@ -1942,7 +2708,7 @@ function createWithdrawalsClient(config = {}) {
         );
       }
       const [recordErr] = await tryCatch(
-        config.data.mutation(api.withdrawals.mutations.recordSubmitted, {
+        config._data.mutation(api.withdrawals.mutations.recordSubmitted, {
           withdrawalId: created.id,
           txHash: transferOk.txHash,
           userOpHash: transferOk.userOpHash
@@ -1966,11 +2732,11 @@ function createWithdrawalsClient(config = {}) {
       return [null, created];
     },
     retrieve: async (withdrawalId) => {
-      if (!config.data) {
+      if (!config._data) {
         return stub("withdrawals.retrieve");
       }
       const [err, raw] = await tryCatch(
-        config.data.query(api.withdrawals.queries.retrieve, { withdrawalId })
+        config._data.query(api.withdrawals.queries.retrieve, { withdrawalId })
       );
       if (err) {
         return [fromConvexError(err), null];
@@ -1988,11 +2754,11 @@ function createWithdrawalsClient(config = {}) {
       return [null, withdrawal];
     },
     list: async (input) => {
-      if (!config.data) {
+      if (!config._data) {
         return stub("withdrawals.list");
       }
       const [err, raw] = await tryCatch(
-        config.data.query(api.withdrawals.queries.list, {
+        config._data.query(api.withdrawals.queries.list, {
           limit: input?.limit,
           cursor: input?.cursor
         })
@@ -2003,13 +2769,13 @@ function createWithdrawalsClient(config = {}) {
       return [null, raw];
     },
     recordCompleted: async (input) => {
-      if (!config.data) {
+      if (!config._data) {
         return stub(
           "withdrawals.recordCompleted"
         );
       }
       const [err] = await tryCatch(
-        config.data.mutation(api.withdrawals.mutations.recordCompleted, {
+        config._data.mutation(api.withdrawals.mutations.recordCompleted, {
           withdrawalId: input.withdrawalId,
           txHash: input.txHash
         })
@@ -2034,13 +2800,13 @@ function createOrgWithdrawalsClient(config = {}) {
      * orchestration ships in W3+.
      */
     create: async (input) => {
-      if (!config.data) {
+      if (!config._data) {
         return stub(
           "organizations.withdrawals.create"
         );
       }
       const [err, raw] = await tryCatch(
-        config.data.mutation(api.withdrawals.mutations.createOrg, {
+        config._data.mutation(api.withdrawals.mutations.createOrg, {
           organizationId: input.organizationId,
           amount: input.amount,
           destination: {
@@ -2067,13 +2833,13 @@ function createOrgWithdrawalsClient(config = {}) {
       return [null, created];
     },
     retrieve: async (input) => {
-      if (!config.data) {
+      if (!config._data) {
         return stub(
           "organizations.withdrawals.retrieve"
         );
       }
       const [err, raw] = await tryCatch(
-        config.data.query(api.withdrawals.queries.retrieve, {
+        config._data.query(api.withdrawals.queries.retrieve, {
           withdrawalId: input.withdrawalId
         })
       );
@@ -2103,13 +2869,13 @@ function createOrgWithdrawalsClient(config = {}) {
       return [null, withdrawal];
     },
     list: async (input) => {
-      if (!config.data) {
+      if (!config._data) {
         return stub(
           "organizations.withdrawals.list"
         );
       }
       const [err, raw] = await tryCatch(
-        config.data.query(api.withdrawals.queries.listOrg, {
+        config._data.query(api.withdrawals.queries.listOrg, {
           organizationId: input.organizationId,
           limit: input.limit,
           cursor: input.cursor
@@ -2128,7 +2894,7 @@ async function handleSubmissionFailure(config, withdrawalId, error) {
 }
 async function bestEffortMarkFailed2(config, withdrawalId, error) {
   await tryCatch(
-    config.data.mutation(api.withdrawals.mutations.markFailed, {
+    config._data.mutation(api.withdrawals.mutations.markFailed, {
       withdrawalId,
       errorCode: error.code,
       errorMessage: error.message
@@ -2207,13 +2973,13 @@ function createWebhookEventsClient() {
 function createOrgExternalAccountsClient(config) {
   return {
     create: async (input) => {
-      if (!config.data) {
+      if (!config._data) {
         return stub(
           "organizations.externalAccounts.create"
         );
       }
       const [err, raw] = await tryCatch(
-        config.data.mutation(api.externalAccounts.mutations.createOrg, {
+        config._data.mutation(api.externalAccounts.mutations.createOrg, {
           organizationId: input.organizationId,
           kind: input.kind,
           label: input.label,
@@ -2227,10 +2993,7 @@ function createOrgExternalAccountsClient(config) {
         })
       );
       if (err) {
-        return [
-          fromConvexError(err),
-          null
-        ];
+        return [fromConvexError(err), null];
       }
       if (!raw) {
         return [
@@ -2241,21 +3004,16 @@ function createOrgExternalAccountsClient(config) {
           null
         ];
       }
-      return [
-        null,
-        brandExternalAccount(
-          raw
-        )
-      ];
+      return [null, brandExternalAccount(raw)];
     },
     list: async (input) => {
-      if (!config.data) {
+      if (!config._data) {
         return stub(
           "organizations.externalAccounts.list"
         );
       }
       const [err, result] = await tryCatch(
-        config.data.query(api.externalAccounts.queries.listOrg, {
+        config._data.query(api.externalAccounts.queries.listOrg, {
           organizationId: input.organizationId,
           limit: input.limit,
           cursor: input.cursor
@@ -2265,9 +3023,7 @@ function createOrgExternalAccountsClient(config) {
         return [fromConvexError(err), null];
       }
       const branded = result.data.map(
-        (row) => brandExternalAccount(
-          row
-        )
+        (row) => brandExternalAccount(row)
       );
       return [
         null,
@@ -2279,17 +3035,66 @@ function createOrgExternalAccountsClient(config) {
       ];
     },
     retrieve: async (input) => {
-      if (!config.data) {
+      if (!config._data) {
         return stub(
           "organizations.externalAccounts.retrieve"
         );
       }
       const [err, raw] = await tryCatch(
-        config.data.query(api.externalAccounts.queries.retrieveOrg, {
+        config._data.query(api.externalAccounts.queries.retrieveOrg, {
+          organizationId: input.organizationId,
+          externalAccountId: input.externalAccountId
+        })
+      );
+      if (err) {
+        return [fromConvexError(err), null];
+      }
+      if (!raw) {
+        return [
+          new CapxulError({
+            code: "NOT_FOUND",
+            message: `external_account ${input.externalAccountId} not found`
+          }),
+          null
+        ];
+      }
+      return [null, brandExternalAccount(raw)];
+    },
+    remove: async (input) => {
+      if (!config._data) {
+        return stub("organizations.externalAccounts.remove");
+      }
+      const [err] = await tryCatch(
+        config._data.mutation(api.externalAccounts.mutations.removeOrg, {
           organizationId: input.organizationId,
           externalAccountId: input.externalAccountId
         })
       );
+      if (err) {
+        return [fromConvexError(err), null];
+      }
+      return [null, void 0];
+    }
+  };
+}
+function createOrgSubAccountsClient(config) {
+  return {
+    create: async (input) => {
+      if (!config._data) {
+        return stub(
+          "organizations.subAccounts.create"
+        );
+      }
+      const [err, raw] = await tryCatch(
+        config._data.mutation(api.subAccounts.mutations.create, {
+          parent: {
+            kind: "organization",
+            id: input.organizationId
+          },
+          name: input.name,
+          purpose: input.purpose
+        })
+      );
       if (err) {
         return [
           fromConvexError(err),
@@ -2300,28 +3105,60 @@ function createOrgExternalAccountsClient(config) {
         return [
           new CapxulError({
             code: "NOT_FOUND",
-            message: `external_account ${input.externalAccountId} not found`
+            message: "sub_account creation returned no resource"
           }),
           null
         ];
       }
+      const [brandErr, branded] = tryBrandSubAccount(raw);
+      if (brandErr) {
+        return [brandErr, null];
+      }
+      return [null, branded];
+    },
+    list: async (input) => {
+      if (!config._data) {
+        return stub(
+          "organizations.subAccounts.list"
+        );
+      }
+      const [err, rows] = await tryCatch(
+        config._data.query(api.subAccounts.queries.listByOrganization, {
+          organizationId: input.organizationId
+        })
+      );
+      if (err) {
+        return [
+          fromConvexError(err),
+          null
+        ];
+      }
+      const branded = [];
+      for (const row of rows) {
+        const [brandErr, value] = tryBrandSubAccount(row);
+        if (brandErr) {
+          return [brandErr, null];
+        }
+        branded.push(value);
+      }
       return [
         null,
-        brandExternalAccount(
-          raw
-        )
+        {
+          object: "list",
+          data: branded,
+          page: { hasMore: false }
+        }
       ];
     },
-    remove: async (input) => {
-      if (!config.data) {
+    retrieve: async (input) => {
+      if (!config._data) {
         return stub(
-          "organizations.externalAccounts.remove"
+          "organizations.subAccounts.retrieve"
         );
       }
-      const [err] = await tryCatch(
-        config.data.mutation(api.externalAccounts.mutations.removeOrg, {
-          organizationId: input.organizationId,
-          externalAccountId: input.externalAccountId
+      const [err, raw] = await tryCatch(
+        config._data.query(api.subAccounts.queries.retrieve, {
+          subAccountId: input.subAccountId
         })
       );
       if (err) {
@@ -2330,822 +3167,557 @@ function createOrgExternalAccountsClient(config) {
           null
         ];
       }
-      return [null, void 0];
-    }
-  };
+      if (!raw) {
+        return [
+          new CapxulError({
+            code: "NOT_FOUND",
+            message: `sub_account ${input.subAccountId} not found`
+          }),
+          null
+        ];
+      }
+      const [brandErr, branded] = tryBrandSubAccount(raw);
+      if (brandErr) {
+        return [
+          brandErr,
+          null
+        ];
+      }
+      return [null, branded];
+    },
+    remove: async (input) => {
+      if (!config._data) {
+        return stub(
+          "organizations.subAccounts.remove"
+        );
+      }
+      const [err, raw] = await tryCatch(
+        config._data.mutation(api.subAccounts.mutations.archive, {
+          subAccountId: input.subAccountId
+        })
+      );
+      if (err) {
+        return [
+          fromConvexError(err),
+          null
+        ];
+      }
+      if (!raw) {
+        return [
+          new CapxulError({
+            code: "NOT_FOUND",
+            message: `sub_account ${input.subAccountId} not found`
+          }),
+          null
+        ];
+      }
+      const [brandErr, branded] = tryBrandSubAccount(raw);
+      if (brandErr) {
+        return [
+          brandErr,
+          null
+        ];
+      }
+      return [null, branded];
+    }
+  };
 }
 function createOrganizationsClient(config = {}) {
   return {
-    create: async () => stub("organizations.create"),
-    retrieve: async () => stub("organizations.retrieve"),
-    list: async () => stub("organizations.list"),
-    update: async () => stub("organizations.update"),
-    safes: {
-      retrieve: async (input) => {
-        if (!config.data) {
-          return stub("organizations.safes.retrieve");
-        }
-        try {
-          const safe = await config.data.query(
-            api.safe.queries.retrieveOrganizationSafe,
-            input
-          );
-          if (!safe) {
-            return [
-              new CapxulError({
-                code: "NOT_FOUND",
-                message: `safe ${input.safeId} not found`
-              }),
-              null
-            ];
-          }
-          return [null, safe];
-        } catch (cause) {
+    create: async (input) => {
+      if (!config._data) {
+        return stub("organizations.create");
+      }
+      if (input.country !== void 0) {
+        return [
+          new CapxulError({
+            code: "INVALID_INPUT",
+            message: "organizations.create does not support country yet \u2014 backend mutation only accepts name.",
+            details: { field: "country" }
+          }),
+          null
+        ];
+      }
+      try {
+        const orgId = await config._data.mutation(api.org.mutations.create, {
+          name: input.name
+        });
+        const org = await config._data.query(api.org.queries.retrieve, {
+          orgId
+        });
+        if (!org) {
           return [
-            fromConvexError(cause),
+            new CapxulError({
+              code: "NETWORK_ERROR",
+              message: "organization created but could not be retrieved"
+            }),
             null
           ];
         }
+        return [null, org];
+      } catch (cause) {
+        return [fromConvexError(cause), null];
       }
     },
-    treasury: {
-      retrieve: async () => stub("organizations.treasury.retrieve")
-    },
-    members: {
-      list: async () => stub("organizations.members.list"),
-      retrieve: async () => stub("organizations.members.retrieve"),
-      invite: async () => stub("organizations.members.invite"),
-      updateRole: async () => stub("organizations.members.updateRole"),
-      remove: async () => stub("organizations.members.remove")
-    },
-    apiKeys: createApiKeysClient(),
-    kybProfile: {
-      start: async () => stub("organizations.kybProfile.start"),
-      retrieve: async () => stub("organizations.kybProfile.retrieve")
-    },
-    subAccounts: {
-      create: async () => stub("organizations.subAccounts.create"),
-      list: async () => stub("organizations.subAccounts.list"),
-      retrieve: async () => stub("organizations.subAccounts.retrieve"),
-      remove: async () => stub("organizations.subAccounts.remove")
-    },
-    externalAccounts: createOrgExternalAccountsClient(config),
-    balanceLedger: {
-      list: async () => stub(
-        "organizations.balanceLedger.list"
-      ),
-      retrieve: async () => stub(
-        "organizations.balanceLedger.retrieve"
-      )
-    },
-    payments: createOrgPaymentsClient(),
-    transfers: createOrgTransfersClient(),
-    withdrawals: createOrgWithdrawalsClient(config),
-    documents: createOrgDocumentsClient(),
-    webhookEndpoints: createWebhookEndpointsClient(),
-    webhookEvents: createWebhookEventsClient()
-  };
-}
-
-// src/core/sub-accounts.ts
-function createSubAccountsClient() {
-  return {
-    retrieve: async () => stub("subAccounts.retrieve"),
-    remove: async () => stub("subAccounts.remove")
-  };
-}
-
-// src/core/token-transfers.ts
-var toTokenTransferId = (raw) => {
-  if (typeof raw !== "string" || raw.length === 0) {
-    throw new Error(
-      `Invalid tokenTransferId: expected non-empty string, got ${String(raw)}`
-    );
-  }
-  return raw;
-};
-function brandRow(row) {
-  return {
-    ...row,
-    id: toTokenTransferId(row.id)
-  };
-}
-function createTokenTransfersClient(config = {}) {
-  return {
-    list: async (input) => {
-      if (!config.data) {
-        return stub("tokenTransfers.list");
+    retrieve: async (organizationId) => {
+      if (!config._data) {
+        return stub("organizations.retrieve");
       }
       try {
-        const raw = await config.data.query(
-          api.tokenTransfers.queries.list,
-          {
-            limit: input?.limit,
-            cursor: input?.cursor,
-            direction: input?.direction
-          }
-        );
-        if (!raw) {
+        const orgId = organizationId.replace(/^org_/, "");
+        const org = await config._data.query(api.org.queries.retrieve, {
+          orgId
+        });
+        if (!org) {
           return [
             new CapxulError({
-              code: "NOT_AUTHENTICATED",
-              message: "tokenTransfers.list requires an authenticated session."
+              code: "NOT_FOUND",
+              message: `organization ${organizationId} not found`
             }),
             null
           ];
         }
-        return [
-          null,
-          {
-            object: "list",
-            data: raw.items.map(brandRow),
-            page: {
-              hasMore: raw.hasMore,
-              nextCursor: raw.nextCursor
-            },
-            displayCurrency: raw.displayCurrency
-          }
-        ];
+        return [null, org];
       } catch (cause) {
         return [fromConvexError(cause), null];
       }
     },
-    retrieve: async (input) => {
-      if (!config.data) {
-        return stub("tokenTransfers.retrieve");
+    list: async (input) => {
+      if (!config._data) {
+        return stub("organizations.list");
       }
       try {
-        const raw = await config.data.query(
-          api.tokenTransfers.queries.getByTxLogIndex,
-          {
-            txHash: input.txHash,
-            logIndex: input.logIndex,
-            chainId: input.chainId
+        const page = await config._data.query(api.org.queries.list, {
+          limit: input?.limit,
+          cursor: input?.cursor
+        });
+        const result = {
+          object: "list",
+          data: page.data,
+          page: {
+            hasMore: page.hasMore,
+            cursor: page.nextCursor
           }
-        );
-        if (!raw) {
+        };
+        return [null, result];
+      } catch (cause) {
+        return [fromConvexError(cause), null];
+      }
+    },
+    update: async (input) => {
+      if (!config._data) {
+        return stub("organizations.update");
+      }
+      try {
+        const orgId = input.organizationId.replace(/^org_/, "");
+        const org = await config._data.mutation(api.org.mutations.update, {
+          orgId,
+          name: input.name
+        });
+        if (!org) {
           return [
             new CapxulError({
               code: "NOT_FOUND",
-              message: `tokenTransfer (txHash=${input.txHash}, logIndex=${input.logIndex}) not found or not visible to caller.`,
-              details: {
-                txHash: input.txHash,
-                logIndex: input.logIndex,
-                chainId: input.chainId
-              }
+              message: `organization ${input.organizationId} not found`
             }),
             null
           ];
         }
-        return [null, brandRow(raw)];
+        return [null, org];
       } catch (cause) {
         return [fromConvexError(cause), null];
       }
-    }
-  };
-}
-
-// src/core/virtual-accounts.ts
-function createVirtualAccountsClient() {
-  return {
-    create: async () => stub("virtualAccounts.create"),
-    retrieve: async () => stub("virtualAccounts.retrieve"),
-    list: async () => stub("virtualAccounts.list"),
-    remove: async () => stub("virtualAccounts.remove")
-  };
-}
-
-// src/core/virtual-cards.ts
-function createVirtualCardsClient() {
-  return {
-    create: async () => stub("virtualCards.create"),
-    retrieve: async () => stub("virtualCards.retrieve"),
-    list: async () => stub("virtualCards.list"),
-    freeze: async () => stub("virtualCards.freeze"),
-    unfreeze: async () => stub("virtualCards.unfreeze"),
-    cancel: async () => stub("virtualCards.cancel")
-  };
-}
-function createAuthFlowMachine(client) {
-  return setup({
-    types: {},
-    actors: {
-      // XState v5's `fromPromise` injects an `AbortSignal` that aborts
-      // when the actor is stopped (parent transition fires, machine is
-      // disposed, etc.). Plumbing it through `client.auth.sendOtp` /
-      // `client.auth.verifyOtp` makes the in-flight HTTP request
-      // cancellable: stale responses can't race a state machine
-      // that's already moved on. See PR #406 S5.
-      sendOtp: fromPromise(async ({ input, signal }) => {
-        const [error] = await client.auth.sendOtp(
-          { email: input.email },
-          { signal }
-        );
-        if (error) throw error;
-      }),
-      verifyOtp: fromPromise(
-        async ({ input, signal }) => {
-          const [error, result] = await client.auth.verifyOtp(
-            {
-              email: input.email,
-              otp: input.code
-            },
-            { signal }
-          );
-          if (error) throw error;
-          if (result.kind === "bootstrap_required") {
-            throw new CapxulError({
-              code: "ACTION_REQUIRED",
-              message: "OTP verified but auth bootstrap is required. Use createAuthBootstrapFlowMachine for product sign-up.",
-              details: { reason: result.reason }
-            });
-          }
-          return result.session;
-        }
-      ),
-      signOut: fromPromise(async () => {
-        const [error] = await client.auth.signOut();
-        if (error) throw error;
-      })
     },
-    actions: {
-      trackOtpRequested: ({ context }) => {
-        if (!context.email) return;
-        track("auth_otp_requested", {
-          email_domain: emailDomain(context.email)
-        });
-      },
-      trackOtpFailed: ({ event }) => {
-        const error = errorFromEvent(event);
-        track("auth_failed", {
-          auth_type: "email_otp",
-          reason: error.code
-        });
-      },
-      trackTimeoutFailed: () => {
-        track("auth_failed", {
-          auth_type: "email_otp",
-          reason: "timeout"
-        });
-      },
-      trackVerified: () => {
-        track("auth_verified", { auth_type: "email_otp" });
-      },
-      identifyAndTrack: ({ context }) => {
-        if (!context.session) return;
-        identify(context.session.authUserId, {
-          email_domain: emailDomain(context.session.email)
-        });
-        track("auth_identified", {
-          email_domain: emailDomain(context.session.email)
-        });
-      },
-      trackSignedOut: () => {
-        track("auth_signed_out");
-      }
-    }
-  }).createMachine({
-    id: "auth",
-    initial: "idle",
-    context: { email: null, session: null, error: null },
-    states: {
-      idle: {
-        on: {
-          REQUEST_OTP: {
-            target: "sending_otp",
-            actions: assign({
-              email: ({ event }) => event.email,
-              error: () => null
-            })
-          }
-        }
-      },
-      sending_otp: {
-        invoke: {
-          src: "sendOtp",
-          input: ({ context }) => ({ email: requireEmail(context) }),
-          onDone: {
-            target: "otp_requested",
-            actions: ["trackOtpRequested"]
-          },
-          onError: {
-            target: "error",
-            actions: [
-              assign({ error: ({ event }) => errorFromEvent(event) }),
-              "trackOtpFailed"
-            ]
-          }
-        },
-        after: {
-          [FLOW_INVOKE_TIMEOUT_MS]: {
-            target: "error",
-            actions: [
-              assign({
-                error: () => timeoutError("sending_otp")
-              }),
-              "trackTimeoutFailed"
-            ]
-          }
-        }
-      },
-      otp_requested: {
-        on: {
-          VERIFY: { target: "verifying" },
-          RESET: {
-            target: "idle",
-            actions: assign({ email: () => null, error: () => null })
-          }
+    safes: {
+      retrieve: async (input) => {
+        if (!config._data) {
+          return stub("organizations.safes.retrieve");
         }
-      },
-      verifying: {
-        invoke: {
-          src: "verifyOtp",
-          input: ({ context, event }) => ({
-            email: requireEmail(context),
-            code: requireCodeFromEvent(event)
-          }),
-          onDone: {
-            target: "authenticated",
-            actions: [
-              // Scrub the duplicate `context.email` (input value
-              // captured during sendOtp) since the verified
-              // `session.email` is now the canonical source
-              // post-authentication. The session's email is
-              // intentionally retained — it's the auth result, not
-              // lingering input. See PR #406 S2.
-              assign({
-                session: ({ event }) => event.output,
-                email: () => null
-              }),
-              "trackVerified",
-              "identifyAndTrack"
-            ]
-          },
-          onError: {
-            target: "error",
-            actions: [
-              assign({ error: ({ event }) => errorFromEvent(event) }),
-              "trackOtpFailed"
-            ]
-          }
-        },
-        after: {
-          [FLOW_INVOKE_TIMEOUT_MS]: {
-            target: "error",
-            actions: [
-              assign({
-                error: () => timeoutError("verifying")
+        try {
+          const safe = await config._data.query(
+            api.safe.queries.retrieveOrganizationSafe,
+            input
+          );
+          if (!safe) {
+            return [
+              new CapxulError({
+                code: "NOT_FOUND",
+                message: `safe ${input.safeId} not found`
               }),
-              "trackTimeoutFailed"
-            ]
+              null
+            ];
           }
+          return [null, safe];
+        } catch (cause) {
+          return [
+            fromConvexError(cause),
+            null
+          ];
         }
-      },
-      authenticated: {
-        on: {
-          SIGN_OUT: { target: "signing_out" }
+      }
+    },
+    treasury: {
+      retrieve: async (organizationId) => {
+        if (!config._data) {
+          return stub(
+            "organizations.treasury.retrieve"
+          );
         }
-      },
-      signing_out: {
-        invoke: {
-          src: "signOut",
-          onDone: {
-            target: "idle",
-            actions: [
-              assign({
-                session: () => null,
-                email: () => null,
-                error: () => null
+        try {
+          const orgId = organizationId.replace(/^org_/, "");
+          const raw = await config._data.query(
+            api.safe.queries.getOrgTreasuryBalance,
+            { orgId }
+          );
+          if (!raw) {
+            return [
+              new CapxulError({
+                code: "NOT_FOUND",
+                message: `treasury for organization ${organizationId} not found`
               }),
-              "trackSignedOut"
-            ]
-          },
-          onError: {
-            target: "error",
-            actions: assign({ error: ({ event }) => errorFromEvent(event) })
-          }
-        }
-      },
-      error: {
-        on: {
-          RESET: {
-            target: "idle",
-            actions: assign({ error: () => null })
+              null
+            ];
           }
+          const treasury = {
+            object: "treasury",
+            id: toTreasuryId(`try_${orgId}`),
+            organizationId,
+            status: "active",
+            safeId: toSafeId(
+              `safe_${raw.safeAddress.replace(/^0x/, "").toLowerCase()}`
+            ),
+            totalBalance: { value: "0", currency: "USD" },
+            positions: raw.tokens.map((t) => ({
+              symbol: t.symbol,
+              contractAddress: t.tokenAddress,
+              amount: t.balance
+            })),
+            asOf: raw.lastUpdatedAt ? new Date(raw.lastUpdatedAt).toISOString() : (/* @__PURE__ */ new Date()).toISOString()
+          };
+          return [null, treasury];
+        } catch (cause) {
+          return [
+            fromConvexError(cause),
+            null
+          ];
         }
       }
-    }
-  });
-}
-function requireEmail(context) {
-  if (!context.email) {
-    throw Errors.invalidInput(
-      "email",
-      "Auth flow advanced without an email captured in context."
-    );
-  }
-  return context.email;
-}
-function requireCodeFromEvent(event) {
-  if (event.type !== "VERIFY") {
-    throw Errors.invalidInput(
-      "code",
-      `Auth flow's verifying state requires a VERIFY event, got ${event.type}.`
-    );
-  }
-  return event.code;
-}
-function errorFromEvent(event) {
-  const cause = typeof event === "object" && event !== null && "error" in event ? event.error : event;
-  if (cause instanceof CapxulError) {
-    if (!EMAIL_MATCH_PATTERN.test(cause.message)) return cause;
-    return new CapxulError({
-      code: cause.code,
-      message: redactEmail(cause.message),
-      cause,
-      details: cause.details,
-      operationId: cause.operationId,
-      correlationId: cause.correlationId,
-      retryable: cause.retryable
-    });
-  }
-  if (cause instanceof CapxulError2) {
-    if (!EMAIL_MATCH_PATTERN.test(cause.message)) return cause;
-    return new CapxulError2(cause.code, redactEmail(cause.message), {
-      cause,
-      details: cause.details,
-      correlationId: cause.correlationId,
-      layer: cause.layer
-    });
-  }
-  return Errors.providerError("auth", "flow", redactCauseEmail(cause));
-}
-var EMAIL_MATCH_PATTERN = /[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}/;
-var EMAIL_REDACT_PATTERN = /[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}/g;
-function redactEmail(message) {
-  return message.replace(EMAIL_REDACT_PATTERN, "<redacted>");
-}
-function redactCauseEmail(cause) {
-  if (cause instanceof Error) {
-    if (!EMAIL_MATCH_PATTERN.test(cause.message)) return cause;
-    const redacted = new Error(redactEmail(cause.message));
-    redacted.cause = cause;
-    return redacted;
-  }
-  if (typeof cause === "string") {
-    return redactEmail(cause);
-  }
-  return cause;
-}
-function timeoutError(state) {
-  return Errors.providerError(
-    "auth",
-    "flow",
-    new Error(`timeout: ${state} exceeded ${FLOW_INVOKE_TIMEOUT_MS}ms`)
-  );
-}
-function emailDomain(email) {
-  const domain = email.split("@")[1]?.trim().toLowerCase();
-  return domain || "unknown";
-}
-var initialContext = {
-  email: null,
-  code: null,
-  username: null,
-  signerProvider: null,
-  bootstrapToken: null,
-  bootstrapReason: null,
-  session: null,
-  account: null,
-  safe: null,
-  error: null
-};
-function createAuthBootstrapFlowMachine(client) {
-  return setup({
-    types: {},
-    actors: {
-      sendOtp: fromPromise(async ({ input, signal }) => {
-        const [error] = await client.auth.sendOtp(
-          { email: input.email },
-          { signal }
-        );
-        if (error) throw error;
-      }),
-      verifyOtp: fromPromise(
-        async ({ input, signal }) => {
-          const [error, result] = await client.auth.verifyOtp(
-            { email: input.email, otp: input.code },
-            { signal }
-          );
-          if (error) throw error;
-          return result;
-        }
-      ),
-      completeBootstrap: fromPromise(async ({ input }) => {
-        const [error, result] = await client.auth.completeBootstrap(input);
-        if (error) throw error;
-        return result;
-      }),
-      signOut: fromPromise(async () => {
-        const [error] = await client.auth.signOut();
-        if (error) throw error;
-      })
     },
-    actions: {
-      trackOtpRequested: ({ context }) => {
-        if (!context.email) return;
-        track("auth_otp_requested", {
-          email_domain: emailDomain2(context.email)
-        });
-      },
-      trackFailed: ({ event }) => {
-        track("auth_failed", {
-          auth_type: "email_otp",
-          reason: errorFromEvent2(event).code
-        });
-      },
-      trackTimeoutFailed: () => {
-        track("auth_failed", {
-          auth_type: "email_otp",
-          reason: "timeout"
-        });
-      },
-      trackVerified: () => {
-        track("auth_verified", { auth_type: "email_otp" });
-      },
-      trackBootstrapRequired: ({ context }) => {
-        track("auth_verified", {
-          auth_type: "email_otp",
-          auth_mode: context.bootstrapReason ?? "bootstrap_required"
-        });
-      },
-      identifyAndTrack: ({ context }) => {
-        if (!context.session) return;
-        identify(context.session.authUserId, {
-          email_domain: emailDomain2(context.session.email)
-        });
-        track("auth_identified", {
-          email_domain: emailDomain2(context.session.email)
-        });
+    members: {
+      list: async (input) => {
+        if (!config._data?.action) {
+          return stub("organizations.members.list");
+        }
+        try {
+          const orgId = input.organizationId.replace(/^org_/, "");
+          const page = await config._data.action(api.org.actions.membersList, {
+            organizationId: orgId,
+            status: input.status,
+            limit: input.limit,
+            cursor: input.cursor
+          });
+          return [null, page];
+        } catch (cause) {
+          return [fromConvexError(cause), null];
+        }
       },
-      trackSignedOut: () => {
-        track("auth_signed_out");
-      }
-    }
-  }).createMachine({
-    id: "authBootstrap",
-    initial: "email",
-    context: initialContext,
-    states: {
-      email: {
-        on: {
-          ENTER_EMAIL: {
-            actions: assign({
-              email: ({ event }) => event.email,
-              error: () => null
-            })
-          },
-          REQUEST_OTP: { target: "sending_otp" }
+      retrieve: async (input) => {
+        if (!config._data?.action) {
+          return stub("organizations.members.retrieve");
+        }
+        try {
+          const orgId = input.organizationId.replace(/^org_/, "");
+          const memberId = input.memberId.replace(/^mb_/, "");
+          const member = await config._data.action(
+            api.org.actions.retrieveMember,
+            {
+              organizationId: orgId,
+              memberId
+            }
+          );
+          return [null, member];
+        } catch (cause) {
+          return [fromConvexError(cause), null];
         }
       },
-      sending_otp: {
-        invoke: {
-          src: "sendOtp",
-          input: ({ context }) => ({ email: requireEmail2(context) }),
-          onDone: { target: "otp_requested", actions: "trackOtpRequested" },
-          onError: {
-            target: "otp_requested",
-            actions: [
-              assign({ error: ({ event }) => errorFromEvent2(event) }),
-              "trackFailed"
-            ]
-          }
-        },
-        after: {
-          [FLOW_INVOKE_TIMEOUT_MS]: {
-            target: "otp_requested",
-            actions: [
-              assign({ error: () => timeoutError2("sending_otp") }),
-              "trackTimeoutFailed"
-            ]
-          }
+      invite: async (input) => {
+        if (!config._data?.action) {
+          return stub(
+            "organizations.members.invite"
+          );
+        }
+        try {
+          const orgId = input.organizationId.replace(/^org_/, "");
+          const result = await config._data.action(
+            api.org.actions.inviteMember,
+            {
+              organizationId: orgId,
+              email: input.email,
+              role: input.role
+            }
+          );
+          return [null, result];
+        } catch (cause) {
+          return [fromConvexError(cause), null];
         }
       },
-      otp_requested: {
-        on: {
-          ENTER_OTP: {
-            actions: assign({
-              code: ({ event }) => event.code,
-              error: () => null
-            })
-          },
-          VERIFY_OTP: { target: "verifying_otp" },
-          BACK: { target: "email" },
-          RESET: { target: "email", actions: assign(() => initialContext) }
+      accept: async (input) => {
+        if (!config._data?.action) {
+          return stub("organizations.members.accept");
+        }
+        try {
+          const member = await config._data.action(
+            api.org.actions.acceptInvitation,
+            { token: input.token }
+          );
+          return [null, member];
+        } catch (cause) {
+          return [fromConvexError(cause), null];
         }
       },
-      verifying_otp: {
-        invoke: {
-          src: "verifyOtp",
-          input: ({ context }) => ({
-            email: requireEmail2(context),
-            code: requireCode(context)
-          }),
-          onDone: [
-            {
-              guard: ({ event }) => event.output.kind === "existing_member",
-              target: "authenticated",
-              actions: [
-                assign({
-                  session: ({ event }) => event.output.session,
-                  account: ({ event }) => event.output.kind === "existing_member" ? event.output.account : null,
-                  username: ({ event }) => event.output.kind === "existing_member" ? event.output.username : null,
-                  safe: ({ event }) => event.output.kind === "existing_member" ? event.output.safe : null,
-                  email: () => null,
-                  error: () => null
-                }),
-                "trackVerified",
-                "identifyAndTrack"
-              ]
-            },
+      updateRole: async (input) => {
+        if (!config._data?.action) {
+          return stub("organizations.members.updateRole");
+        }
+        try {
+          const orgId = input.organizationId.replace(/^org_/, "");
+          const memberId = input.memberId.replace(/^mb_/, "");
+          const member = await config._data.action(
+            api.org.actions.updateMemberRole,
             {
-              target: "bootstrap_required",
-              actions: [
-                assign({
-                  session: ({ event }) => event.output.session,
-                  bootstrapToken: ({ event }) => event.output.kind === "bootstrap_required" ? event.output.bootstrapToken : null,
-                  bootstrapReason: ({ event }) => event.output.kind === "bootstrap_required" ? event.output.reason : null,
-                  username: ({ event }) => event.output.kind === "bootstrap_required" ? event.output.username ?? null : null,
-                  email: ({ event }) => event.output.kind === "bootstrap_required" ? event.output.email : null,
-                  error: () => null
-                }),
-                "trackVerified",
-                "trackBootstrapRequired"
-              ]
+              organizationId: orgId,
+              memberId,
+              role: input.role
             }
-          ],
-          onError: {
-            target: "otp_requested",
-            actions: [
-              assign({ error: ({ event }) => errorFromEvent2(event) }),
-              "trackFailed"
-            ]
-          }
-        },
-        after: {
-          [FLOW_INVOKE_TIMEOUT_MS]: {
-            target: "otp_requested",
-            actions: [
-              assign({ error: () => timeoutError2("verifying_otp") }),
-              "trackTimeoutFailed"
-            ]
-          }
+          );
+          return [null, member];
+        } catch (cause) {
+          return [fromConvexError(cause), null];
         }
       },
-      bootstrap_required: {
-        on: {
-          ENTER_USERNAME: {
-            actions: assign({
-              username: ({ event }) => event.username,
-              error: () => null
-            })
-          },
-          ENTER_SIGNER_PROVIDER: {
-            actions: assign({
-              signerProvider: ({ event }) => event.signerProvider,
-              error: () => null
-            })
-          },
-          COMPLETE_BOOTSTRAP: { target: "completing_bootstrap" },
-          BACK: { target: "otp_requested" },
-          RESET: { target: "email", actions: assign(() => initialContext) }
+      revoke: async (input) => {
+        if (!config._data?.action) {
+          return stub("organizations.members.revoke");
         }
-      },
-      completing_bootstrap: {
-        invoke: {
-          src: "completeBootstrap",
-          input: ({ context }) => ({
-            bootstrapToken: requireBootstrapToken(context),
-            username: requireUsername(context),
-            signerProvider: requireSignerProvider(context)
-          }),
-          onDone: {
-            target: "authenticated",
-            actions: [
-              assign({
-                session: ({ event }) => event.output.session,
-                account: ({ event }) => event.output.account,
-                username: ({ event }) => event.output.username,
-                safe: ({ event }) => event.output.safe,
-                bootstrapToken: () => null,
-                bootstrapReason: () => null,
-                signerProvider: () => null,
-                email: () => null,
-                error: () => null
-              }),
-              "identifyAndTrack"
-            ]
-          },
-          onError: {
-            target: "bootstrap_required",
-            actions: [
-              assign({ error: ({ event }) => errorFromEvent2(event) }),
-              "trackFailed"
-            ]
-          }
-        },
-        after: {
-          [FLOW_INVOKE_TIMEOUT_MS]: {
-            target: "bootstrap_required",
-            actions: [
-              assign({ error: () => timeoutError2("completing_bootstrap") }),
-              "trackTimeoutFailed"
-            ]
-          }
+        try {
+          const orgId = input.organizationId.replace(/^org_/, "");
+          const memberId = input.memberId.replace(/^mb_/, "");
+          const member = await config._data.action(
+            api.org.actions.revokeMember,
+            {
+              organizationId: orgId,
+              memberId
+            }
+          );
+          return [null, member];
+        } catch (cause) {
+          return [fromConvexError(cause), null];
         }
       },
-      authenticated: {
-        on: {
-          SIGN_OUT: { target: "signing_out" }
+      remove: async (input) => {
+        if (!config._data?.action) {
+          return stub("organizations.members.remove");
+        }
+        try {
+          const orgId = input.organizationId.replace(/^org_/, "");
+          const memberId = input.memberId.replace(/^mb_/, "");
+          await config._data.action(api.org.actions.removeMember, {
+            organizationId: orgId,
+            memberId
+          });
+          return [null, void 0];
+        } catch (cause) {
+          return [fromConvexError(cause), null];
         }
       },
-      signing_out: {
-        invoke: {
-          src: "signOut",
-          onDone: {
-            target: "email",
-            actions: [
-              assign(() => initialContext),
-              "trackSignedOut"
-            ]
-          },
-          onError: {
-            target: "error",
-            actions: assign({ error: ({ event }) => errorFromEvent2(event) })
-          }
+      resend: async (input) => {
+        if (!config._data?.action) {
+          return stub(
+            "organizations.members.resend"
+          );
+        }
+        try {
+          const orgId = input.organizationId.replace(/^org_/, "");
+          const memberId = input.memberId.replace(/^mb_/, "");
+          const result = await config._data.action(
+            api.org.actions.resendInvitation,
+            {
+              organizationId: orgId,
+              memberId
+            }
+          );
+          return [null, result];
+        } catch (cause) {
+          return [fromConvexError(cause), null];
+        }
+      }
+    },
+    apiKeys: createApiKeysClient(),
+    subAccounts: createOrgSubAccountsClient(config),
+    externalAccounts: createOrgExternalAccountsClient(config),
+    balanceLedger: {
+      list: async (input) => {
+        if (!config._data) {
+          return stub(
+            "organizations.balanceLedger.list"
+          );
+        }
+        try {
+          const orgId = input.organizationId.replace(/^org_/, "");
+          const page = await config._data.query(
+            api.balanceLedger.queries.listForOrg,
+            { orgId, limit: input.limit, cursor: input.cursor }
+          );
+          return [null, page];
+        } catch (cause) {
+          return [fromConvexError(cause), null];
         }
       },
-      error: {
-        on: {
-          RESET: { target: "email", actions: assign(() => initialContext) }
+      retrieve: async (input) => {
+        if (!config._data) {
+          return stub(
+            "organizations.balanceLedger.retrieve"
+          );
+        }
+        try {
+          const entry = await config._data.query(
+            api.balanceLedger.queries.retrieve,
+            { entryId: input.entryId }
+          );
+          if (!entry) {
+            return [
+              new CapxulError({
+                code: "NOT_FOUND",
+                message: `balance_ledger_entry ${input.entryId} not found`
+              }),
+              null
+            ];
+          }
+          return [null, entry];
+        } catch (cause) {
+          return [fromConvexError(cause), null];
         }
       }
-    }
-  });
-}
-function requireEmail2(context) {
-  if (!context.email) {
-    throw Errors.invalidInput("email", "Auth bootstrap requires an email.");
-  }
-  return context.email;
-}
-function requireCode(context) {
-  if (!context.code) {
-    throw Errors.invalidInput("code", "Auth bootstrap requires an OTP code.");
-  }
-  return context.code;
-}
-function requireBootstrapToken(context) {
-  if (!context.bootstrapToken) {
-    throw Errors.invalidInput(
-      "bootstrapToken",
-      "Auth bootstrap requires a continuation token."
-    );
-  }
-  return context.bootstrapToken;
-}
-function requireUsername(context) {
-  if (!context.username) {
-    throw Errors.invalidInput("username", "Auth bootstrap requires a username.");
-  }
-  return context.username;
+    },
+    payments: createOrgPaymentsClient(),
+    transfers: createOrgTransfersClient(),
+    withdrawals: createOrgWithdrawalsClient(config),
+    documents: createOrgDocumentsClient(config),
+    webhookEndpoints: createWebhookEndpointsClient(),
+    webhookEvents: createWebhookEventsClient()
+  };
 }
-function requireSignerProvider(context) {
-  if (!context.signerProvider) {
-    throw Errors.invalidInput(
-      "signerProvider",
-      "Auth bootstrap requires a signer provider."
+
+// src/core/token-transfers.ts
+var toTokenTransferId = (raw) => {
+  if (typeof raw !== "string" || raw.length === 0) {
+    throw new Error(
+      `Invalid tokenTransferId: expected non-empty string, got ${String(raw)}`
     );
   }
-  return context.signerProvider;
+  return raw;
+};
+function brandRow(row) {
+  return {
+    ...row,
+    id: toTokenTransferId(row.id)
+  };
 }
-function errorFromEvent2(event) {
-  const cause = typeof event === "object" && event !== null && "error" in event ? event.error : event;
-  if (cause instanceof CapxulError || cause instanceof CapxulError2) {
-    return cause;
-  }
-  return Errors.providerError("auth", "bootstrap", cause);
+function createTokenTransfersClient(config = {}) {
+  return {
+    list: async (input) => {
+      if (!config._data) {
+        return stub("tokenTransfers.list");
+      }
+      try {
+        const raw = await config._data.query(
+          api.tokenTransfers.queries.list,
+          {
+            limit: input?.limit,
+            cursor: input?.cursor,
+            direction: input?.direction
+          }
+        );
+        if (!raw) {
+          return [
+            new CapxulError({
+              code: "NOT_AUTHENTICATED",
+              message: "tokenTransfers.list requires an authenticated session."
+            }),
+            null
+          ];
+        }
+        return [
+          null,
+          {
+            object: "list",
+            data: raw.items.map(brandRow),
+            page: {
+              hasMore: raw.hasMore,
+              nextCursor: raw.nextCursor
+            },
+            displayCurrency: raw.displayCurrency
+          }
+        ];
+      } catch (cause) {
+        return [fromConvexError(cause), null];
+      }
+    },
+    retrieve: async (input) => {
+      if (!config._data) {
+        return stub("tokenTransfers.retrieve");
+      }
+      try {
+        const raw = await config._data.query(
+          api.tokenTransfers.queries.getByTxLogIndex,
+          {
+            txHash: input.txHash,
+            logIndex: input.logIndex,
+            chainId: input.chainId
+          }
+        );
+        if (!raw) {
+          return [
+            new CapxulError({
+              code: "NOT_FOUND",
+              message: `tokenTransfer (txHash=${input.txHash}, logIndex=${input.logIndex}) not found or not visible to caller.`,
+              details: {
+                txHash: input.txHash,
+                logIndex: input.logIndex,
+                chainId: input.chainId
+              }
+            }),
+            null
+          ];
+        }
+        return [null, brandRow(raw)];
+      } catch (cause) {
+        return [fromConvexError(cause), null];
+      }
+    }
+  };
 }
-function timeoutError2(state) {
-  return Errors.providerError(
-    "auth",
-    "bootstrap",
-    new Error(`timeout: ${state} exceeded ${FLOW_INVOKE_TIMEOUT_MS}ms`)
-  );
+
+// src/core/virtual-accounts.ts
+function createVirtualAccountsClient() {
+  return {
+    create: async () => stub("virtualAccounts.create"),
+    retrieve: async () => stub("virtualAccounts.retrieve"),
+    list: async () => stub("virtualAccounts.list"),
+    remove: async () => stub("virtualAccounts.remove")
+  };
 }
-function emailDomain2(email) {
-  const domain = email.split("@")[1]?.trim().toLowerCase();
-  return domain || "unknown";
+
+// src/core/virtual-cards.ts
+function createVirtualCardsClient() {
+  return {
+    create: async () => stub("virtualCards.create"),
+    retrieve: async () => stub("virtualCards.retrieve"),
+    list: async () => stub("virtualCards.list"),
+    freeze: async () => stub("virtualCards.freeze"),
+    unfreeze: async () => stub("virtualCards.unfreeze"),
+    cancel: async () => stub("virtualCards.cancel")
+  };
 }
 function createProvisioningMachine(client) {
   return setup({
@@ -3174,7 +3746,7 @@ function createProvisioningMachine(client) {
         const provider = context.input?.signerProvider;
         if (!provider) return;
         track("provisioning_safe_created", {
-          safe_address: provider.safeAddress
+          safe_address: deriveSafeAddress2(provider.signerAddress)
         });
       }
     }
@@ -3219,13 +3791,13 @@ function createProvisioningMachine(client) {
           },
           onError: {
             target: "error",
-            actions: assign({ error: ({ event }) => errorFromEvent3(event) })
+            actions: assign({ error: ({ event }) => errorFromEvent(event) })
           }
         },
         after: {
           [FLOW_INVOKE_TIMEOUT_MS]: {
             target: "error",
-            actions: assign({ error: () => timeoutError3() })
+            actions: assign({ error: () => timeoutError() })
           }
         }
       },
@@ -3243,7 +3815,7 @@ function createProvisioningMachine(client) {
      * this payload on its `onDone` transition and branches via guards
      * on `event.output.error`.
      */
-    output: ({ context }) => context.error ? { error: context.error } : context.account ? { account: context.account } : { error: timeoutError3() }
+    output: ({ context }) => context.error ? { error: context.error } : context.account ? { account: context.account } : { error: timeoutError() }
   });
 }
 function requireProvisionInput(context) {
@@ -3255,13 +3827,13 @@ function requireProvisionInput(context) {
   }
   return context.input;
 }
-function errorFromEvent3(event) {
+function errorFromEvent(event) {
   const cause = typeof event === "object" && event !== null && "error" in event ? event.error : event;
   if (cause instanceof CapxulError) return cause;
   if (cause instanceof CapxulError2) return cause;
   return Errors.providerError("provisioning", "flow", cause);
 }
-function timeoutError3() {
+function timeoutError() {
   return Errors.providerError(
     "provisioning",
     "flow",
@@ -3354,7 +3926,7 @@ function createOnboardingFlowMachine(client) {
         error: ({ event }) => extractChildErrorOrFallback(event)
       }),
       assignChildThrown: assign({
-        error: ({ event }) => errorFromEvent4(event)
+        error: ({ event }) => errorFromEvent2(event)
       }),
       assignAccountFromChild: assign({
         account: ({ event }) => extractChildAccountOrNull(event)
@@ -3516,7 +4088,7 @@ function extractChildAccountOrNull(event) {
   if (output && "account" in output && output.account) return output.account;
   return null;
 }
-function errorFromEvent4(event) {
+function errorFromEvent2(event) {
   const cause = typeof event === "object" && event !== null && "error" in event ? event.error : event;
   if (cause instanceof CapxulError) return cause;
   if (cause instanceof CapxulError2) return cause;
@@ -3527,7 +4099,7 @@ function errorFromEvent4(event) {
 function createCapxulClient(config = {}) {
   const clientWithoutFlows = {
     id: crypto.randomUUID(),
-    auth: createAuthClient(config),
+    auth: new AuthService(config),
     me: createMeClient(config),
     accounts: createAccountsClient(config),
     organizations: createOrganizationsClient(config),
@@ -3535,8 +4107,8 @@ function createCapxulClient(config = {}) {
     transfers: createTransfersClient(),
     tokenTransfers: createTokenTransfersClient(config),
     withdrawals: createWithdrawalsClient(config),
-    documents: createDocumentsClient(),
-    subAccounts: createSubAccountsClient(),
+    documents: createDocumentsClient(config),
+    subAccounts: createSubAccountsClient(config),
     virtualAccounts: createVirtualAccountsClient(),
     virtualCards: createVirtualCardsClient(),
     externalAccounts: createExternalAccountsClient(config),
@@ -3547,8 +4119,6 @@ function createCapxulClient(config = {}) {
   };
   const client = clientWithoutFlows;
   client.flows = {
-    auth: () => createAuthFlowMachine(client),
-    authBootstrap: () => createAuthBootstrapFlowMachine(client),
     onboarding: () => createOnboardingFlowMachine(client),
     provisioning: () => createProvisioningMachine(client)
   };
@@ -3652,5 +4222,13 @@ function isWebhookEvent(value) {
   const candidate = value;
   return typeof candidate.id === "string" && typeof candidate.type === "string" && typeof candidate.createdAt === "string" && (candidate.operationId === void 0 || typeof candidate.operationId === "string") && (candidate.correlationId === void 0 || typeof candidate.correlationId === "string") && !!candidate.data && typeof candidate.data === "object" && !Array.isArray(candidate.data);
 }
+var SignerProvisioner = class {
+  provision() {
+    const privateKey = generatePrivateKey();
+    const signer = privateKeyToAccount(privateKey);
+    const safeAddress = deriveSafeAddress2(signer.address);
+    return { signer, safeAddress };
+  }
+};
 
-export { CapxulError, createAuthBootstrapFlowMachine, createAuthFlowMachine, createCapxulClient, createLocalSigner, createOnboardingFlowMachine, createProvisioningMachine as createProvisioningFlowMachine, makeHttpTransport, matchAction, matchError, matchStatus, toAccountId, toApiKeyId, toBalanceLedgerEntryId, toDocumentId, toEmail, toExternalAccountId, toKybProfileId, toKycProfileId, toMemberId, toOperationId, toOrganizationId, toPaymentId, toPhoneNumber, toSafeId, toSubAccountId, toTokenTransferId, toTransferId, toTreasuryId, toUsername, toVirtualAccountId, toVirtualCardId, toWebhookEndpointId, toWebhookEventId, toWithdrawalId, tryCatch, verifyWebhook };
+export { AuthService, CapxulError, SignerProvisioner, createCapxulClient, createLocalSigner, createOnboardingFlowMachine, createProvisioningMachine as createProvisioningFlowMachine, makeHttpTransport, matchAction, matchError, matchStatus, resolvePaymentToken, toAccountId, toApiKeyId, toBalanceLedgerEntryId, toDocumentId, toEmail, toExternalAccountId, toKybProfileId, toKycProfileId, toMemberId, toOperationId, toOrganizationId, toPaymentId, toPhoneNumber, toSafeId, toSubAccountId, toTokenTransferId, toTransferId, toTreasuryId, toUsername, toVirtualAccountId, toVirtualCardId, toWebhookEndpointId, toWebhookEventId, toWithdrawalId, tryCatch, verifyWebhook };