@capxul/sdk 0.1.0-alpha.9 → 0.2.0-alpha.4

package/dist/client.cjs

@@ -1,10 +1,11 @@
 'use strict';
 
 var server = require('convex/server');
-var viem = require('viem');
 var accounts = require('permissionless/accounts');
+var viem = require('viem');
 var accountAbstraction = require('viem/account-abstraction');
 var chains = require('viem/chains');
+var browser = require('convex/browser');
 var xstate = require('xstate');
 
 // src/_generated/api.js
@@ -109,17 +110,270 @@ function track(...args) {
   const [name, props] = args;
   debugLog(`[TRACK] ${name} ${formatDebugValue(props ?? "")}`);
 }
-function formatDebugValue2(value) {
-  if (value === void 0 || value === "") return "";
-  if (typeof value === "string") return value;
+
+// ../config/src/chain.ts
+var CAPXUL_PAYMENTS_ADDRESS = "0xe740ea65521edc9bef0ea75d30b5334711db99f4";
+var TEST_USDC_ADDRESS = "0xf09fcbb6df9f8f918e58f9c8ab15a76ade862b77";
+var CAPXUL_API_BASE_URL = "https://elated-oyster-269.convex.site";
+
+// ../config/src/timing.ts
+var FLOW_INVOKE_TIMEOUT_MS = 3e4;
+
+// ../config/src/errors.ts
+var CapxulError2 = class extends Error {
+  code;
+  details;
+  correlationId;
+  layer;
+  constructor(code, message, options) {
+    super(message, options?.cause ? { cause: options.cause } : void 0);
+    this.code = code;
+    this.details = options?.details;
+    this.correlationId = options?.correlationId;
+    this.layer = options?.layer;
+  }
+};
+var Errors = {
+  notAuthenticated: () => new CapxulError2("NOT_AUTHENTICATED", "Not authenticated"),
+  profileNotFound: (authUserId) => new CapxulError2("PROFILE_NOT_FOUND", `Profile not found for user ${authUserId}`),
+  smartAccountMissing: (authUserId) => new CapxulError2("SMART_ACCOUNT_MISSING", `Smart account not provisioned for user ${authUserId}`),
+  envMissing: (name) => new CapxulError2("ENV_MISSING", `Environment variable ${name} not configured`),
+  openfortApi: (operation, cause) => new CapxulError2(
+    "PROVIDER_ERROR",
+    `Openfort ${operation} failed: ${cause instanceof Error ? cause.message : String(cause)}`,
+    { cause, details: { provider: "openfort", operation } }
+  ),
+  shieldApi: (status, detail) => new CapxulError2(
+    "PROVIDER_ERROR",
+    `Shield API error (${status}): ${detail}`,
+    { details: { provider: "shield", status } }
+  ),
+  providerError: (provider, operation, cause) => (
+    // Public `message` is redacted to a fixed shape so provider-side
+    // exception text never leaks to the client. The original `cause`
+    // is preserved on `Error.cause` for server-side debugging via
+    // observability sinks (Sentry, console traces).
+    new CapxulError2(
+      "PROVIDER_ERROR",
+      `Provider error: ${provider} ${operation}`,
+      { cause, details: { provider, operation } }
+    )
+  ),
+  invalidInput: (field, reason) => new CapxulError2(
+    "INVALID_INPUT",
+    `Invalid ${field}: ${reason}`,
+    { details: { field, reason } }
+  ),
+  playerNotFound: (playerId) => new CapxulError2(
+    "PLAYER_NOT_FOUND",
+    playerId ? `Openfort player ${playerId} not found` : "Openfort player not found"
+  ),
+  accountNotFound: (accountId) => new CapxulError2(
+    "ACCOUNT_NOT_FOUND",
+    accountId ? `Openfort account ${accountId} not found` : "Openfort smart account not found"
+  ),
+  invalidRecipient: (reason) => new CapxulError2("INVALID_RECIPIENT", reason),
+  permissionDenied: (reason = "Permission denied") => new CapxulError2("PERMISSION_DENIED", reason),
+  notFound: (resource, id) => new CapxulError2(
+    "NOT_FOUND",
+    id ? `${resource} ${id} not found` : `${resource} not found`
+  ),
+  idempotencyConflict: (details) => new CapxulError2(
+    "IDEMPOTENCY_CONFLICT",
+    "Idempotency key was already used for a different request",
+    { details }
+  ),
+  emailDeliveryFailed: (detail, details) => new CapxulError2("EMAIL_DELIVERY_FAILED", `Failed to send email: ${detail}`, {
+    details
+  }),
+  rateLimited: (details) => new CapxulError2("RATE_LIMITED", "Request was rate limited", {
+    details: { ...details }
+  }),
+  internalError: (reason) => new CapxulError2("INTERNAL_ERROR", `Internal error: ${reason}`),
+  /**
+   * Verification gate. Surfaced when a request hits a verification
+   * boundary the actor cannot cross under their current state. Two
+   * variants share this code:
+   *
+   * - Rail gate (Withdrawals v1 W2, #465): the resolved
+   *   `external_account.kind` routes to a withdrawal rail (e.g.
+   *   `fiat_offramp`, `card_payout`) that is not yet supported. Carries
+   *   `details.rail` + `details.currentKind`.
+   * - KYC tier gate (legacy / future): the actor's KYC tier is below
+   *   the required tier. Carries `details.requiredTier`.
+   *
+   * Code is shared because both expose the same UX shape ("you cannot
+   * proceed until verification advances"); the `details.*` keys
+   * differentiate the route.
+   */
+  verificationRequired: (details) => {
+    const message = "rail" in details ? `Withdrawal rail "${details.rail}" (kind=${details.currentKind}) is not yet supported.` : `Verification tier ${details.requiredTier} is required.`;
+    return new CapxulError2("VERIFICATION_REQUIRED", message, {
+      details: { ...details }
+    });
+  }
+};
+
+// ../config/src/safe.ts
+var SAFE_PROXY_FACTORY = "0x4e1dcf7ad4e460cfd30791ccc4f9c8a4f820ec67";
+var SAFE_L2_SINGLETON = "0x29fcb43b46531bca003ddc8fcb67ffe91900c762";
+var SAFE_MODULE_SETUP = "0x2dd68b007b46fbe91b9a7c3eda5a7a1063cb5b47";
+var SAFE_4337_MODULE = "0x75cf11467937ce3f2f357ce24ffc3dbf8fd5c226";
+var MULTI_SEND = "0x38869bf66a61cf6bdb996a6ae40d5853fd43b526";
+
+// ../config/src/org-roles.ts
+function roleKeyFromLabel(label) {
+  const bytes = new TextEncoder().encode(label);
+  const hex = Array.from(bytes).map((b) => b.toString(16).padStart(2, "0")).join("");
+  return "0x" + hex.padEnd(64, "0");
+}
+roleKeyFromLabel("OWNER");
+roleKeyFromLabel("FINANCE_MANAGER");
+roleKeyFromLabel("PAYMENTS_OPERATOR");
+var defaultSafeDeriveConfig = {
+  safeProxyFactory: SAFE_PROXY_FACTORY,
+  safeL2Singleton: SAFE_L2_SINGLETON,
+  safeModuleSetup: SAFE_MODULE_SETUP,
+  safe4337Module: SAFE_4337_MODULE,
+  multiSend: MULTI_SEND
+};
+var SAFE_PROXY_CREATION_CODE = "0x608060405234801561001057600080fd5b506040516101e63803806101e68339818101604052602081101561003357600080fd5b8101908080519060200190929190505050600073ffffffffffffffffffffffffffffffffffffffff168173ffffffffffffffffffffffffffffffffffffffff1614156100ca576040517f08c379a00000000000000000000000000000000000000000000000000000000081526004018080602001828103825260228152602001806101c46022913960400191505060405180910390fd5b806000806101000a81548173ffffffffffffffffffffffffffffffffffffffff021916908373ffffffffffffffffffffffffffffffffffffffff1602179055505060ab806101196000396000f3fe608060405273ffffffffffffffffffffffffffffffffffffffff600054167fa619486e0000000000000000000000000000000000000000000000000000000060003514156050578060005260206000f35b3660008037600080366000845af43d6000803e60008114156070573d6000fd5b3d6000f3fea264697066735822122003d1488ee65e08fa41e58e888a9865554c535f2c77126a82cb4c0f917f31441364736f6c63430007060033496e76616c69642073696e676c65746f6e20616464726573732070726f7669646564";
+var enableModulesAbi = [
+  {
+    type: "function",
+    name: "enableModules",
+    inputs: [{ type: "address[]", name: "modules" }],
+    outputs: [],
+    stateMutability: "nonpayable"
+  }
+];
+var multiSendAbi = [
+  {
+    type: "function",
+    name: "multiSend",
+    inputs: [{ type: "bytes", name: "transactions" }],
+    outputs: [],
+    stateMutability: "payable"
+  }
+];
+var setupAbi = [
+  {
+    type: "function",
+    name: "setup",
+    inputs: [
+      { type: "address[]", name: "owners" },
+      { type: "uint256", name: "threshold" },
+      { type: "address", name: "to" },
+      { type: "bytes", name: "data" },
+      { type: "address", name: "fallbackHandler" },
+      { type: "address", name: "paymentToken" },
+      { type: "uint256", name: "payment" },
+      { type: "address", name: "paymentReceiver" }
+    ],
+    outputs: [],
+    stateMutability: "nonpayable"
+  }
+];
+function encodeInternalTransaction(tx) {
+  const encoded = viem.encodePacked(
+    ["uint8", "address", "uint256", "uint256", "bytes"],
+    [
+      tx.operation,
+      tx.to,
+      tx.value,
+      BigInt(tx.data.slice(2).length / 2),
+      tx.data
+    ]
+  );
+  return encoded.slice(2);
+}
+function computeSaltNonce(ownerAddress) {
+  return BigInt(`0x${ownerAddress.toLowerCase().slice(2).padEnd(64, "0")}`);
+}
+function deriveSafeAddress(signerAddress, config = defaultSafeDeriveConfig) {
+  const saltNonce = computeSaltNonce(signerAddress);
+  const enableModulesData = viem.encodeFunctionData({
+    abi: enableModulesAbi,
+    functionName: "enableModules",
+    args: [[config.safe4337Module]]
+  });
+  const innerTx = encodeInternalTransaction({
+    operation: 1,
+    to: config.safeModuleSetup,
+    value: 0n,
+    data: enableModulesData
+  });
+  const multiSendCallData = viem.encodeFunctionData({
+    abi: multiSendAbi,
+    functionName: "multiSend",
+    args: [`0x${innerTx}`]
+  });
+  const initializer = viem.encodeFunctionData({
+    abi: setupAbi,
+    functionName: "setup",
+    args: [
+      [signerAddress],
+      1n,
+      config.multiSend,
+      multiSendCallData,
+      config.safe4337Module,
+      "0x0000000000000000000000000000000000000000",
+      0n,
+      "0x0000000000000000000000000000000000000000"
+    ]
+  });
+  const deploymentCode = viem.encodePacked(
+    ["bytes", "uint256"],
+    [SAFE_PROXY_CREATION_CODE, BigInt(config.safeL2Singleton)]
+  );
+  const salt = viem.keccak256(
+    viem.encodePacked(
+      ["bytes32", "uint256"],
+      [viem.keccak256(viem.encodePacked(["bytes"], [initializer])), saltNonce]
+    )
+  );
+  return viem.getContractAddress({
+    from: config.safeProxyFactory,
+    salt,
+    bytecode: deploymentCode,
+    opcode: "CREATE2"
+  });
+}
+
+// src/internal/safe/account.ts
+async function buildSafeAccount(signer, chain) {
   try {
-    return JSON.stringify(value);
-  } catch {
-    return String(value);
+    const publicClient = viem.createPublicClient({
+      chain: chains.baseSepolia,
+      transport: viem.http(chain.rpcUrl)
+    });
+    return await accounts.toSafeSmartAccount({
+      client: publicClient,
+      entryPoint: { address: accountAbstraction.entryPoint07Address, version: "0.7" },
+      version: "1.4.1",
+      owners: [signer],
+      saltNonce: computeSaltNonce2(signer.address),
+      safeSingletonAddress: SAFE_L2_SINGLETON,
+      safeProxyFactoryAddress: SAFE_PROXY_FACTORY,
+      safeModuleSetupAddress: SAFE_MODULE_SETUP,
+      safe4337ModuleAddress: SAFE_4337_MODULE,
+      safeModules: [],
+      setupTransactions: []
+    });
+  } catch (cause) {
+    throw new CapxulError({
+      code: "NETWORK_ERROR",
+      message: cause instanceof Error ? cause.message : String(cause),
+      cause,
+      details: { chainId: chain.chainId }
+    });
   }
 }
-function identify(userId, traits) {
-  debugLog(`[IDENTIFY] ${userId} ${formatDebugValue2(traits ?? "")}`);
+function computeSaltNonce2(ownerAddress) {
+  return BigInt(`0x${ownerAddress.toLowerCase().slice(2).padEnd(64, "0")}`);
+}
+function deriveSafeAddress2(signerAddress) {
+  return deriveSafeAddress(signerAddress, defaultSafeDeriveConfig);
 }
 
 // ../platform-kernel/src/ids.ts
@@ -134,12 +388,24 @@ function makePrefixedIdConstructor(prefix, fieldName) {
     return raw;
   };
 }
+var toSafeId = makePrefixedIdConstructor(
+  "safe",
+  "safeId"
+);
+var toTreasuryId = makePrefixedIdConstructor(
+  "try",
+  "treasuryId"
+);
 var toOperationId = makePrefixedIdConstructor(
   "op",
   "operationId"
 );
 var toCorrelationId = makePrefixedIdConstructor("ctx", "correlationId");
 var toExternalAccountId = makePrefixedIdConstructor("ext", "externalAccountId");
+var toSubAccountId = makePrefixedIdConstructor(
+  "sub",
+  "subAccountId"
+);
 
 // src/core/external-accounts.ts
 function brandExternalAccount(raw) {
@@ -156,13 +422,13 @@ function brandExternalAccount(raw) {
 function createExternalAccountsClient(config = {}) {
   return {
     retrieve: async (externalAccountId) => {
-      if (!config.data) {
+      if (!config._data) {
         return stub(
           "externalAccounts.retrieve"
         );
       }
       const [err, raw] = await tryCatch(
-        config.data.query(api.externalAccounts.queries.retrievePersonal, {
+        config._data.query(api.externalAccounts.queries.retrievePersonal, {
           externalAccountId
         })
       );
@@ -184,11 +450,11 @@ function createExternalAccountsClient(config = {}) {
       return [null, brandExternalAccount(raw)];
     },
     remove: async (externalAccountId) => {
-      if (!config.data) {
+      if (!config._data) {
         return stub("externalAccounts.remove");
       }
       const [err] = await tryCatch(
-        config.data.mutation(api.externalAccounts.mutations.removePersonal, {
+        config._data.mutation(api.externalAccounts.mutations.removePersonal, {
           externalAccountId
         })
       );
@@ -203,17 +469,203 @@ function createExternalAccountsClient(config = {}) {
   };
 }
 
+// src/core/sub-accounts.ts
+function malformedWireError(reason, raw) {
+  return new CapxulError({
+    code: "PROVIDER_ERROR",
+    message: `convex brandSubAccount failed: ${reason}`,
+    details: {
+      provider: "convex",
+      operation: "brandSubAccount",
+      reason,
+      // PII discipline (`.claude/rules/posthog.md`): user-authored
+      // strings on the wire (`name`, `purpose`) are customer-confidential
+      // — sub-account names like "Q3 Acquisition Reserve" or
+      // "Vendor ABC payments" must not flow into telemetry. We emit a
+      // structural keys-only sample via a strict ALLOWLIST so any future
+      // wire-shape addition (e.g. `recipientEmail`, `tags`) is dropped
+      // by construction rather than leaked through a denylist gap.
+      sample: safeSampleShape(raw)
+    }
+  });
+}
+function safeSampleShape(raw) {
+  if (raw === null || typeof raw !== "object") {
+    return { type: typeof raw };
+  }
+  const r = raw;
+  const balance = r.balance;
+  return {
+    object: typeof r.object === "string" ? r.object : typeof r.object,
+    idPresent: typeof r.id === "string" && r.id.length > 0,
+    // First 4 chars only — enough to distinguish "sub_" prefixed IDs
+    // from accidental other resource IDs without leaking the full ID.
+    idPrefix: typeof r.id === "string" ? r.id.slice(0, 4) : void 0,
+    parentKind: r.parent !== null && typeof r.parent === "object" ? r.parent.kind : typeof r.parent,
+    status: r.status,
+    hasName: typeof r.name === "string",
+    hasPurpose: r.purpose !== void 0,
+    balanceShape: balance !== null && typeof balance === "object" ? Object.keys(balance).sort() : typeof balance,
+    createdAtType: typeof r.createdAt,
+    updatedAtType: typeof r.updatedAt
+  };
+}
+function isMoneyShape(v) {
+  if (typeof v !== "object" || v === null) return false;
+  const m = v;
+  return typeof m.value === "string" && typeof m.currency === "string";
+}
+function isParentShape(v) {
+  if (typeof v !== "object" || v === null) return false;
+  const p = v;
+  return (p.kind === "account" || p.kind === "organization") && typeof p.id === "string";
+}
+function isFiniteNonNegativeInteger(v) {
+  return typeof v === "number" && Number.isFinite(v) && Number.isInteger(v) && v >= 0;
+}
+function validateWireSubAccount(raw) {
+  if (typeof raw !== "object" || raw === null) {
+    return { ok: false, reason: "not an object" };
+  }
+  const r = raw;
+  if (r.object !== "sub_account") {
+    return { ok: false, reason: `object must be "sub_account" (got ${String(r.object)})` };
+  }
+  if (typeof r.id !== "string" || r.id.length === 0) {
+    return { ok: false, reason: "id must be a non-empty string" };
+  }
+  if (!isParentShape(r.parent)) {
+    return { ok: false, reason: "parent must be { kind: 'account' | 'organization', id: string }" };
+  }
+  if (typeof r.name !== "string") {
+    return { ok: false, reason: "name must be a string" };
+  }
+  if (r.purpose !== void 0 && typeof r.purpose !== "string") {
+    return { ok: false, reason: "purpose must be a string when present" };
+  }
+  if (r.status !== "active" && r.status !== "archived") {
+    return { ok: false, reason: `status must be "active" | "archived" (got ${String(r.status)})` };
+  }
+  if (!isMoneyShape(r.balance)) {
+    return { ok: false, reason: "balance must be { value: string, currency: string }" };
+  }
+  if (!isFiniteNonNegativeInteger(r.createdAt)) {
+    return { ok: false, reason: "createdAt must be a finite non-negative integer (epoch ms)" };
+  }
+  if (r.updatedAt !== void 0 && !isFiniteNonNegativeInteger(r.updatedAt)) {
+    return { ok: false, reason: "updatedAt must be a finite non-negative integer when present" };
+  }
+  return { ok: true, value: r };
+}
+function brandSubAccount(raw) {
+  const result = validateWireSubAccount(raw);
+  if (!result.ok) {
+    throw malformedWireError(result.reason, raw);
+  }
+  const wire = result.value;
+  return {
+    object: wire.object,
+    id: toSubAccountId(wire.id),
+    parent: wire.parent,
+    name: wire.name,
+    ...wire.purpose !== void 0 ? { purpose: wire.purpose } : {},
+    status: wire.status,
+    balance: wire.balance,
+    createdAt: new Date(wire.createdAt).toISOString()
+  };
+}
+function tryBrandSubAccount(raw) {
+  try {
+    return [null, brandSubAccount(raw)];
+  } catch (err) {
+    if (err instanceof CapxulError && err.code === "PROVIDER_ERROR") {
+      return [err, null];
+    }
+    return [
+      malformedWireError(
+        err instanceof Error ? err.message : String(err),
+        raw
+      ),
+      null
+    ];
+  }
+}
+function createSubAccountsClient(config = {}) {
+  return {
+    retrieve: async (subAccountId) => {
+      if (!config._data) {
+        return stub("subAccounts.retrieve");
+      }
+      const [err, raw] = await tryCatch(
+        config._data.query(api.subAccounts.queries.retrieve, {
+          subAccountId
+        })
+      );
+      if (err) {
+        return [
+          fromConvexError(err),
+          null
+        ];
+      }
+      if (!raw) {
+        return [
+          new CapxulError({
+            code: "NOT_FOUND",
+            message: `sub_account ${subAccountId} not found`
+          }),
+          null
+        ];
+      }
+      const [brandErr, branded] = tryBrandSubAccount(raw);
+      if (brandErr) {
+        return [brandErr, null];
+      }
+      return [null, branded];
+    },
+    remove: async (subAccountId) => {
+      if (!config._data) {
+        return stub("subAccounts.remove");
+      }
+      const [err, raw] = await tryCatch(
+        config._data.mutation(api.subAccounts.mutations.archive, {
+          subAccountId
+        })
+      );
+      if (err) {
+        return [
+          fromConvexError(err),
+          null
+        ];
+      }
+      if (!raw) {
+        return [
+          new CapxulError({
+            code: "NOT_FOUND",
+            message: `sub_account ${subAccountId} not found`
+          }),
+          null
+        ];
+      }
+      const [brandErr, branded] = tryBrandSubAccount(raw);
+      if (brandErr) {
+        return [brandErr, null];
+      }
+      return [null, branded];
+    }
+  };
+}
+
 // src/core/accounts.ts
 function createAccountExternalAccountsClient(config) {
   return {
     create: async (input) => {
-      if (!config.data) {
+      if (!config._data) {
         return stub(
           "accounts.externalAccounts.create"
         );
       }
       const [err, raw] = await tryCatch(
-        config.data.mutation(
+        config._data.mutation(
           api.externalAccounts.mutations.createPersonal,
           {
             kind: input.kind,
@@ -251,13 +703,13 @@ function createAccountExternalAccountsClient(config) {
       ];
     },
     list: async (input) => {
-      if (!config.data) {
+      if (!config._data) {
         return stub(
           "accounts.externalAccounts.list"
         );
       }
       const [err, result] = await tryCatch(
-        config.data.query(api.externalAccounts.queries.listPersonal, {
+        config._data.query(api.externalAccounts.queries.listPersonal, {
           limit: input.limit,
           cursor: input.cursor
         })
@@ -280,13 +732,13 @@ function createAccountExternalAccountsClient(config) {
       ];
     },
     retrieve: async (externalAccountId) => {
-      if (!config.data) {
+      if (!config._data) {
         return stub(
           "accounts.externalAccounts.retrieve"
         );
       }
       const [err, raw] = await tryCatch(
-        config.data.query(api.externalAccounts.queries.retrievePersonal, {
+        config._data.query(api.externalAccounts.queries.retrievePersonal, {
           externalAccountId
         })
       );
@@ -313,11 +765,11 @@ function createAccountExternalAccountsClient(config) {
       ];
     },
     remove: async (externalAccountId) => {
-      if (!config.data) {
+      if (!config._data) {
         return stub("accounts.externalAccounts.remove");
       }
       const [err] = await tryCatch(
-        config.data.mutation(api.externalAccounts.mutations.removePersonal, {
+        config._data.mutation(api.externalAccounts.mutations.removePersonal, {
           externalAccountId
         })
       );
@@ -331,14 +783,162 @@ function createAccountExternalAccountsClient(config) {
     }
   };
 }
+function createAccountSubAccountsClient(config) {
+  return {
+    create: async (input) => {
+      if (!config._data) {
+        return stub(
+          "accounts.subAccounts.create"
+        );
+      }
+      const [err, raw] = await tryCatch(
+        config._data.mutation(api.subAccounts.mutations.create, {
+          parent: { kind: "account", id: input.accountId },
+          name: input.name,
+          purpose: input.purpose
+        })
+      );
+      if (err) {
+        return [
+          fromConvexError(err),
+          null
+        ];
+      }
+      if (!raw) {
+        return [
+          new CapxulError({
+            code: "NOT_FOUND",
+            message: "sub_account creation returned no resource"
+          }),
+          null
+        ];
+      }
+      const [brandErr, branded] = tryBrandSubAccount(raw);
+      if (brandErr) {
+        return [
+          brandErr,
+          null
+        ];
+      }
+      return [null, branded];
+    },
+    list: async (input) => {
+      if (!config._data) {
+        return stub(
+          "accounts.subAccounts.list"
+        );
+      }
+      const [err, rows] = await tryCatch(
+        config._data.query(api.subAccounts.queries.listByAccount, {
+          accountId: input.accountId
+        })
+      );
+      if (err) {
+        return [
+          fromConvexError(err),
+          null
+        ];
+      }
+      const branded = [];
+      for (const row of rows) {
+        const [brandErr, value] = tryBrandSubAccount(row);
+        if (brandErr) {
+          return [
+            brandErr,
+            null
+          ];
+        }
+        branded.push(value);
+      }
+      return [
+        null,
+        {
+          object: "list",
+          data: branded,
+          page: { hasMore: false }
+        }
+      ];
+    },
+    retrieve: async (subAccountId) => {
+      if (!config._data) {
+        return stub(
+          "accounts.subAccounts.retrieve"
+        );
+      }
+      const [err, raw] = await tryCatch(
+        config._data.query(api.subAccounts.queries.retrieve, {
+          subAccountId
+        })
+      );
+      if (err) {
+        return [
+          fromConvexError(err),
+          null
+        ];
+      }
+      if (!raw) {
+        return [
+          new CapxulError({
+            code: "NOT_FOUND",
+            message: `sub_account ${subAccountId} not found`
+          }),
+          null
+        ];
+      }
+      const [brandErr, branded] = tryBrandSubAccount(raw);
+      if (brandErr) {
+        return [
+          brandErr,
+          null
+        ];
+      }
+      return [null, branded];
+    },
+    remove: async (subAccountId) => {
+      if (!config._data) {
+        return stub(
+          "accounts.subAccounts.remove"
+        );
+      }
+      const [err, raw] = await tryCatch(
+        config._data.mutation(api.subAccounts.mutations.archive, {
+          subAccountId
+        })
+      );
+      if (err) {
+        return [
+          fromConvexError(err),
+          null
+        ];
+      }
+      if (!raw) {
+        return [
+          new CapxulError({
+            code: "NOT_FOUND",
+            message: `sub_account ${subAccountId} not found`
+          }),
+          null
+        ];
+      }
+      const [brandErr, branded] = tryBrandSubAccount(raw);
+      if (brandErr) {
+        return [
+          brandErr,
+          null
+        ];
+      }
+      return [null, branded];
+    }
+  };
+}
 function createAccountsClient(config = {}) {
   return {
     retrieve: async (accountId) => {
-      if (!config.data) {
+      if (!config._data) {
         return stub("accounts.retrieve");
       }
       try {
-        const account = await config.data.query(
+        const account = await config._data.query(
           api.openfort.queries.getMyAccount,
           {}
         );
@@ -362,7 +962,7 @@ function createAccountsClient(config = {}) {
     },
     lookup: async () => stub("accounts.lookup"),
     update: async (input) => {
-      if (!config.data) {
+      if (!config._data) {
         return stub("accounts.update");
       }
       if (input.countryCode !== void 0) {
@@ -376,7 +976,7 @@ function createAccountsClient(config = {}) {
         ];
       }
       try {
-        const current = await config.data.query(
+        const current = await config._data.query(
           api.openfort.queries.getMyAccount,
           {}
         );
@@ -393,11 +993,11 @@ function createAccountsClient(config = {}) {
             null
           ];
         }
-        await config.data.mutation(api.openfort.mutations.updateProfile, {
+        await config._data.mutation(api.openfort.mutations.updateProfile, {
           displayName: input.name,
           username: input.username
         });
-        const updated = await config.data.query(
+        const updated = await config._data.query(
           api.openfort.queries.getMyAccount,
           {}
         );
@@ -407,7 +1007,7 @@ function createAccountsClient(config = {}) {
       }
     },
     provisionPersonal: async (input) => {
-      if (!config.data) {
+      if (!config._data) {
         return stub(
           "accounts.provisionPersonal"
         );
@@ -422,17 +1022,17 @@ function createAccountsClient(config = {}) {
         ];
       }
       try {
-        await config.data.mutation(
+        await config._data.mutation(
           api.safe.mutations.provisionLocalPersonalAccount,
           {
             displayName: input.displayName,
             username: input.username,
             countryCode: input.countryCode,
             eoaAddress: input.signerProvider.signerAddress,
-            safeAddress: input.signerProvider.safeAddress
+            safeAddress: deriveSafeAddress2(input.signerProvider.signerAddress)
           }
         );
-        const account = await config.data.query(
+        const account = await config._data.query(
           api.openfort.queries.getMyAccount,
           {}
         );
@@ -455,11 +1055,11 @@ function createAccountsClient(config = {}) {
     },
     safes: {
       retrieve: async (safeId) => {
-        if (!config.data) {
+        if (!config._data) {
           return stub("accounts.safes.retrieve");
         }
         try {
-          const safe = await config.data.query(
+          const safe = await config._data.query(
             api.safe.queries.retrieveAccountSafe,
             { safeId }
           );
@@ -486,19 +1086,50 @@ function createAccountsClient(config = {}) {
       retrieve: async () => stub("accounts.kycProfiles.retrieve")
     },
     externalAccounts: createAccountExternalAccountsClient(config),
-    subAccounts: {
-      create: async () => stub("accounts.subAccounts.create"),
-      list: async () => stub("accounts.subAccounts.list"),
-      retrieve: async () => stub("accounts.subAccounts.retrieve"),
-      remove: async () => stub("accounts.subAccounts.remove")
-    },
+    subAccounts: createAccountSubAccountsClient(config),
     balanceLedger: {
-      list: async () => stub(
-        "accounts.balanceLedger.list"
-      ),
-      retrieve: async () => stub(
-        "accounts.balanceLedger.retrieve"
-      )
+      list: async (input) => {
+        if (!config._data) {
+          return stub(
+            "accounts.balanceLedger.list"
+          );
+        }
+        try {
+          const accountId = input.accountId.replace(/^acct_/, "");
+          const page = await config._data.query(
+            api.balanceLedger.queries.listForAccount,
+            { accountId, limit: input.limit, cursor: input.cursor }
+          );
+          return [null, page];
+        } catch (cause) {
+          return [fromConvexError(cause), null];
+        }
+      },
+      retrieve: async (entryId) => {
+        if (!config._data) {
+          return stub(
+            "accounts.balanceLedger.retrieve"
+          );
+        }
+        try {
+          const entry = await config._data.query(
+            api.balanceLedger.queries.retrieve,
+            { entryId }
+          );
+          if (!entry) {
+            return [
+              new CapxulError({
+                code: "NOT_FOUND",
+                message: `balance_ledger_entry ${entryId} not found`
+              }),
+              null
+            ];
+          }
+          return [null, entry];
+        } catch (cause) {
+          return [fromConvexError(cause), null];
+        }
+      }
     }
   };
 }
@@ -512,119 +1143,11 @@ function createApiKeysClient() {
     revoke: async () => stub("apiKeys.revoke")
   };
 }
-
-// ../config/src/chain.ts
-var CAPXUL_PAYMENTS_ADDRESS = "0xe740ea65521edc9bef0ea75d30b5334711db99f4";
-var TEST_USDC_ADDRESS = "0xf09fcbb6df9f8f918e58f9c8ab15a76ade862b77";
-var CAPXUL_API_BASE_URL = "https://elated-oyster-269.convex.site";
-
-// ../config/src/timing.ts
-var FLOW_INVOKE_TIMEOUT_MS = 3e4;
-
-// ../config/src/errors.ts
-var CapxulError2 = class extends Error {
-  code;
-  details;
-  correlationId;
-  layer;
-  constructor(code, message, options) {
-    super(message, options?.cause ? { cause: options.cause } : void 0);
-    this.code = code;
-    this.details = options?.details;
-    this.correlationId = options?.correlationId;
-    this.layer = options?.layer;
-  }
-};
-var Errors = {
-  notAuthenticated: () => new CapxulError2("NOT_AUTHENTICATED", "Not authenticated"),
-  profileNotFound: (authUserId) => new CapxulError2("PROFILE_NOT_FOUND", `Profile not found for user ${authUserId}`),
-  smartAccountMissing: (authUserId) => new CapxulError2("SMART_ACCOUNT_MISSING", `Smart account not provisioned for user ${authUserId}`),
-  envMissing: (name) => new CapxulError2("ENV_MISSING", `Environment variable ${name} not configured`),
-  openfortApi: (operation, cause) => new CapxulError2(
-    "PROVIDER_ERROR",
-    `Openfort ${operation} failed: ${cause instanceof Error ? cause.message : String(cause)}`,
-    { cause, details: { provider: "openfort", operation } }
-  ),
-  shieldApi: (status, detail) => new CapxulError2(
-    "PROVIDER_ERROR",
-    `Shield API error (${status}): ${detail}`,
-    { details: { provider: "shield", status } }
-  ),
-  providerError: (provider, operation, cause) => new CapxulError2(
-    "PROVIDER_ERROR",
-    `${provider} ${operation} failed: ${cause instanceof Error ? cause.message : String(cause)}`,
-    { cause, details: { provider, operation } }
-  ),
-  invalidInput: (field, reason) => new CapxulError2(
-    "INVALID_INPUT",
-    `Invalid ${field}: ${reason}`,
-    { details: { field, reason } }
-  ),
-  playerNotFound: (playerId) => new CapxulError2(
-    "PLAYER_NOT_FOUND",
-    playerId ? `Openfort player ${playerId} not found` : "Openfort player not found"
-  ),
-  accountNotFound: (accountId) => new CapxulError2(
-    "ACCOUNT_NOT_FOUND",
-    accountId ? `Openfort account ${accountId} not found` : "Openfort smart account not found"
-  ),
-  invalidRecipient: (reason) => new CapxulError2("INVALID_RECIPIENT", reason),
-  permissionDenied: (reason = "Permission denied") => new CapxulError2("PERMISSION_DENIED", reason),
-  notFound: (resource, id) => new CapxulError2(
-    "NOT_FOUND",
-    id ? `${resource} ${id} not found` : `${resource} not found`
-  ),
-  idempotencyConflict: (details) => new CapxulError2(
-    "IDEMPOTENCY_CONFLICT",
-    "Idempotency key was already used for a different request",
-    { details }
-  ),
-  emailDeliveryFailed: (detail, details) => new CapxulError2("EMAIL_DELIVERY_FAILED", `Failed to send email: ${detail}`, {
-    details
-  }),
-  rateLimited: (details) => new CapxulError2("RATE_LIMITED", "Request was rate limited", {
-    details: { ...details }
-  }),
-  internalError: (reason) => new CapxulError2("INTERNAL_ERROR", `Internal error: ${reason}`),
-  /**
-   * Verification gate. Surfaced when a request hits a verification
-   * boundary the actor cannot cross under their current state. Two
-   * variants share this code:
-   *
-   * - Rail gate (Withdrawals v1 W2, #465): the resolved
-   *   `external_account.kind` routes to a withdrawal rail (e.g.
-   *   `fiat_offramp`, `card_payout`) that is not yet supported. Carries
-   *   `details.rail` + `details.currentKind`.
-   * - KYC tier gate (legacy / future): the actor's KYC tier is below
-   *   the required tier. Carries `details.requiredTier`.
-   *
-   * Code is shared because both expose the same UX shape ("you cannot
-   * proceed until verification advances"); the `details.*` keys
-   * differentiate the route.
-   */
-  verificationRequired: (details) => {
-    const message = "rail" in details ? `Withdrawal rail "${details.rail}" (kind=${details.currentKind}) is not yet supported.` : `Verification tier ${details.requiredTier} is required.`;
-    return new CapxulError2("VERIFICATION_REQUIRED", message, {
-      details: { ...details }
-    });
-  }
-};
-
-// ../config/src/safe.ts
-var SAFE_PROXY_FACTORY = "0x4e1dcf7ad4e460cfd30791ccc4f9c8a4f820ec67";
-var SAFE_L2_SINGLETON = "0x29fcb43b46531bca003ddc8fcb67ffe91900c762";
-var SAFE_MODULE_SETUP = "0x2dd68b007b46fbe91b9a7c3eda5a7a1063cb5b47";
-var SAFE_4337_MODULE = "0x75cf11467937ce3f2f357ce24ffc3dbf8fd5c226";
-
-// ../config/src/org-roles.ts
-function roleKeyFromLabel(label) {
-  const bytes = new TextEncoder().encode(label);
-  const hex = Array.from(bytes).map((b) => b.toString(16).padStart(2, "0")).join("");
-  return "0x" + hex.padEnd(64, "0");
+function createDefaultDataClient(convexUrl, jwt) {
+  const client = new browser.ConvexHttpClient(convexUrl);
+  client.setAuth(jwt);
+  return client;
 }
-roleKeyFromLabel("OWNER");
-roleKeyFromLabel("FINANCE_MANAGER");
-roleKeyFromLabel("TEAM_LEAD");
 
 // src/transport.ts
 function makeHttpTransport(config) {
@@ -955,7 +1478,7 @@ function readNonEmptyString(value) {
 
 // src/core/auth.ts
 function createAuthClient(config = {}) {
-  let dataClient = config.data ?? null;
+  let dataClient = config._data ?? null;
   const sessionStore = config.auth?.sessionStore ?? createMemorySessionStore();
   const getTransport = createTransportProvider(config);
   return {
@@ -1011,11 +1534,20 @@ function createAuthClient(config = {}) {
         ).toISOString()
       };
       sessionStore.set(session);
-      if (config.auth?.createDataClient) {
+      if (!dataClient) {
         try {
-          dataClient = await config.auth.createDataClient(session);
-          mutableConfig(config).data = dataClient;
-          transport.markAuthenticated({ dataClient });
+          const convexUrl = transport.convexUrl;
+          if (!convexUrl || !session.convexJwt) {
+            return [
+              new CapxulError({
+                code: "NETWORK_ERROR",
+                message: "Cannot create data client: missing convex URL or JWT."
+              }),
+              null
+            ];
+          }
+          dataClient = createDefaultDataClient(convexUrl, session.convexJwt);
+          mutableConfig(config)._data = dataClient;
         } catch (cause) {
           return [
             new CapxulError({
@@ -1026,7 +1558,15 @@ function createAuthClient(config = {}) {
             null
           ];
         }
+      } else {
+        const injected = dataClient;
+        if (typeof injected.refreshAuth === "function") {
+          injected.refreshAuth();
+        } else if (typeof injected.setAuth === "function" && session.convexJwt) {
+          injected.setAuth(session.convexJwt);
+        }
       }
+      transport.markAuthenticated({ dataClient });
       if (!dataClient) {
         return [
           new CapxulError({
@@ -1054,7 +1594,7 @@ function createAuthClient(config = {}) {
     },
     completeBootstrap: async (input) => {
       const session = sessionStore.get();
-      const data = dataClient ?? config.data;
+      const data = dataClient ?? config._data;
       if (!session || !data) {
         return [
           new CapxulError({
@@ -1064,23 +1604,38 @@ function createAuthClient(config = {}) {
           null
         ];
       }
-      if (input.signerProvider.kind !== "local-private-key") {
+      const signerAddress = config.signer?.address;
+      if (!signerAddress) {
         return [
           new CapxulError({
             code: "INVALID_INPUT",
-            message: "completeBootstrap currently supports local-private-key signer providers only."
+            message: "completeBootstrap requires a signer to be configured on the client."
           }),
           null
         ];
       }
       try {
-        const result = await data.mutation(api.authBootstrap.completeBootstrap, {
+        const safeAddress = deriveSafeAddress2(signerAddress);
+        if (!data.action) {
+          return [
+            new CapxulError({
+              code: "INVALID_INPUT",
+              message: "completeBootstrap requires a data client that can execute Convex actions."
+            }),
+            null
+          ];
+        }
+        const result = await data.action(api.authBootstrap.completeBootstrap, {
           bootstrapToken: input.bootstrapToken,
           sessionToken: session.token,
           username: input.username,
           displayName: input.displayName,
           countryCode: input.countryCode,
-          signerProvider: input.signerProvider
+          signerProvider: {
+            kind: "local-private-key",
+            signerAddress,
+            safeAddress
+          }
         });
         return [null, { kind: "authenticated", session, ...result }];
       } catch (cause) {
@@ -1094,7 +1649,7 @@ function createAuthClient(config = {}) {
     signOut: async () => {
       sessionStore.clear();
       dataClient = null;
-      mutableConfig(config).data = void 0;
+      mutableConfig(config)._data = void 0;
       const transport = getTransport();
       transport?.clearAuth();
       return [null, void 0];
@@ -1165,6 +1720,9 @@ async function postBetterAuth(transport, path, body, code, signal) {
     }
     return [null, text ? JSON.parse(text) : void 0];
   } catch (cause) {
+    if (cause instanceof CapxulError) {
+      return [cause, null];
+    }
     return [
       new CapxulError({
         code: "NETWORK_ERROR",
@@ -1203,7 +1761,7 @@ function parseBetterAuthError(text) {
   }
 }
 function isCapxulErrorCode2(code) {
-  return code === "NOT_AUTHENTICATED" || code === "EMAIL_DELIVERY_FAILED" || code === "INVALID_INPUT" || code === "RATE_LIMITED" || code === "NETWORK_ERROR" || code === "API_KEY_INVALID" || code === "API_KEY_EXPIRED";
+  return code === "NOT_AUTHENTICATED" || code === "EMAIL_DELIVERY_FAILED" || code === "INVALID_INPUT" || code === "RATE_LIMITED" || code === "NETWORK_ERROR" || code === "API_KEY_INVALID" || code === "API_KEY_EXPIRED" || code === "INTERNAL_ERROR" || code === "ENV_MISSING" || code === "UNKNOWN" || code === "PROVIDER_ERROR";
 }
 async function exchangeConvexToken(transport, config, token, signal) {
   const path = config.auth?.convexTokenUrl ?? "/convex/token";
@@ -1233,6 +1791,9 @@ async function exchangeConvexToken(transport, config, token, signal) {
     }
     return [null, body.token];
   } catch (cause) {
+    if (cause instanceof CapxulError) {
+      return [cause, null];
+    }
     return [
       new CapxulError({
         code: "NETWORK_ERROR",
@@ -1247,16 +1808,227 @@ function mutableConfig(config) {
   return config;
 }
 
-// src/core/documents.ts
-function createDocumentsClient() {
-  return {
-    create: async () => stub("documents.create"),
-    retrieve: async () => stub("documents.retrieve"),
-    list: async () => stub("documents.list"),
-    cancel: async () => stub("documents.cancel")
+// src/core/auth-service.ts
+var AuthService = class {
+  authClient;
+  sessionStore;
+  config;
+  constructor(config = {}) {
+    this.config = config;
+    this.sessionStore = config.auth?.sessionStore ?? createMemorySessionStore2();
+    this.authClient = createAuthClient({
+      ...config,
+      auth: { ...config.auth, sessionStore: this.sessionStore }
+    });
+  }
+  async sendOtp(email, options) {
+    const [err] = await this.authClient.sendOtp({ email }, options);
+    if (err) throw err;
+  }
+  async verifyOtp(email, otp, options) {
+    const [err, result] = await this.authClient.verifyOtp(
+      { email, otp },
+      options
+    );
+    if (err) throw err;
+    return result;
+  }
+  async completeBootstrap(params, signer) {
+    if (signer) {
+      const tempClient = createAuthClient({
+        ...this.config,
+        signer,
+        auth: { ...this.config.auth, sessionStore: this.sessionStore }
+      });
+      const [err2, result2] = await tempClient.completeBootstrap(params);
+      if (err2) throw err2;
+      return result2;
+    }
+    const [err, result] = await this.authClient.completeBootstrap(params);
+    if (err) throw err;
+    return result;
+  }
+  /**
+   * Clears the persisted session and, when a transport was pre-injected,
+   * drops the cached auth header.
+   *
+   * **Transport safety note:** `clearAuth()` is only invoked when
+   * `config._transport` was supplied at construction (e.g. by the React
+   * provider). If `AuthService` is instantiated directly in a Node/CLI
+   * context without an injected transport, the transport-side auth cache
+   * is the caller's responsibility.
+   */
+  async signOut() {
+    if (!this.config._transport) {
+      const [err] = await this.authClient.signOut();
+      if (err) throw err;
+      mutableConfig2(this.config)._data = void 0;
+      return;
+    }
+    this.sessionStore.clear();
+    this.config._transport.clearAuth();
+  }
+  async getSession() {
+    const [err, session] = await this.authClient.getSession();
+    if (err) throw err;
+    return session;
+  }
+};
+function mutableConfig2(config) {
+  return config;
+}
+function createMemorySessionStore2() {
+  let current = null;
+  return {
+    get: () => current,
+    set: (session) => {
+      current = session;
+    },
+    clear: () => {
+      current = null;
+    }
+  };
+}
+
+// src/core/documents.ts
+function requireInvoiceHash(row) {
+  if (!row.invoiceHash) {
+    throw new CapxulError({
+      code: "INVALID_INPUT",
+      message: `invoice document ${row.documentId ?? row._id} is missing its canonical invoiceHash`
+    });
+  }
+  return row.invoiceHash;
+}
+function mapInvoiceRow(row) {
+  const status = row.status === "cancelled" ? "canceled" : row.status === "pending" ? "open" : row.status === "overdue" ? "expired" : row.status;
+  return {
+    object: "document",
+    id: row.documentId ?? row._id,
+    type: "invoice",
+    owner: {
+      kind: row.scope === "org" ? "organization" : "account",
+      id: row.orgId ?? row.payeeEmail ?? row.payeeLabel
+    },
+    recipient: { email: row.payerEmail },
+    amount: {
+      value: row.amount,
+      currency: row.currency
+    },
+    reference: row.note,
+    lineItems: row.items,
+    invoiceHash: requireInvoiceHash(row),
+    dueAt: row.dueDate,
+    status,
+    createdAt: new Date(row.createdAt).toISOString()
+  };
+}
+function mapDocumentError(cause) {
+  return fromConvexError(cause);
+}
+function createDocumentsClient(config = {}) {
+  return {
+    create: async (input) => {
+      if (!config._data) return stub("documents.create");
+      if (input.type !== "invoice") {
+        return [
+          new CapxulError({
+            code: "INVALID_INPUT",
+            message: "documents.create currently supports personal invoice documents only."
+          }),
+          null
+        ];
+      }
+      if (!("email" in input.recipient)) {
+        return [
+          new CapxulError({
+            code: "INVALID_INPUT",
+            message: "personal invoice documents currently require an email recipient."
+          }),
+          null
+        ];
+      }
+      try {
+        const created = await config._data.mutation(
+          api.paymentRecords.mutations.createInvoice,
+          {
+            scope: "personal",
+            payerEmail: input.recipient.email,
+            amount: input.amount.value,
+            currency: input.amount.currency,
+            dueDate: input.dueAt ?? (/* @__PURE__ */ new Date()).toISOString(),
+            note: input.reference,
+            items: input.lineItems
+          }
+        );
+        const row = await config._data.query(
+          api.paymentRecords.queries.getInvoiceByDocumentId,
+          { documentId: created.documentId }
+        );
+        if (!row) throw new Error("created invoice was not readable");
+        return [null, mapInvoiceRow(row)];
+      } catch (cause) {
+        return [mapDocumentError(cause), null];
+      }
+    },
+    retrieve: async (documentId) => {
+      if (!config._data)
+        return stub("documents.retrieve");
+      try {
+        const row = await config._data.query(
+          api.paymentRecords.queries.getInvoiceByDocumentId,
+          { documentId }
+        );
+        if (!row) {
+          return [
+            new CapxulError({
+              code: "NOT_FOUND",
+              message: `document ${documentId} not found`
+            }),
+            null
+          ];
+        }
+        return [null, mapInvoiceRow(row)];
+      } catch (cause) {
+        return [mapDocumentError(cause), null];
+      }
+    },
+    list: async (input = {}) => {
+      if (!config._data)
+        return stub("documents.list");
+      try {
+        if (input.type && input.type !== "invoice") {
+          return [null, { object: "list", data: [], page: { hasMore: false } }];
+        }
+        const rows = await config._data.query(
+          api.paymentRecords.queries.listMyInvoices,
+          {
+            limit: input.limit,
+            cursor: input.cursor
+          }
+        );
+        const page = rows;
+        const data = page.data.map((row) => mapInvoiceRow(row));
+        return [null, { object: "list", data, page: page.page }];
+      } catch (cause) {
+        return [mapDocumentError(cause), null];
+      }
+    },
+    cancel: async (documentId) => {
+      if (!config._data) return stub("documents.cancel");
+      try {
+        const row = await config._data.mutation(
+          api.paymentRecords.mutations.cancelInvoice,
+          { documentId }
+        );
+        return [null, mapInvoiceRow(row)];
+      } catch (cause) {
+        return [mapDocumentError(cause), null];
+      }
+    }
   };
 }
-function createOrgDocumentsClient() {
+function createOrgDocumentsClient(_config = {}) {
   return {
     create: async () => stub("organizations.documents.create"),
     retrieve: async () => stub("organizations.documents.retrieve"),
@@ -1269,11 +2041,11 @@ function createOrgDocumentsClient() {
 function createMeClient(config = {}) {
   return {
     get: async () => {
-      if (!config.data) {
+      if (!config._data) {
         return stub("me.get");
       }
       try {
-        const account = await config.data.query(
+        const account = await config._data.query(
           api.openfort.queries.getMyAccount,
           {}
         );
@@ -1283,7 +2055,7 @@ function createMeClient(config = {}) {
       }
     },
     update: async (input) => {
-      if (!config.data) {
+      if (!config._data) {
         return stub("me.update");
       }
       if (input.countryCode !== void 0) {
@@ -1297,11 +2069,11 @@ function createMeClient(config = {}) {
         ];
       }
       try {
-        await config.data.mutation(api.openfort.mutations.updateProfile, {
+        await config._data.mutation(api.openfort.mutations.updateProfile, {
           displayName: input.name,
           username: input.username
         });
-        const account = await config.data.query(
+        const account = await config._data.query(
           api.openfort.queries.getMyAccount,
           {}
         );
@@ -1316,11 +2088,11 @@ function createMeClient(config = {}) {
 // src/core/operations.ts
 function createOperationsClient(config = {}) {
   const retrieve = async (operationId) => {
-    if (!config.data) {
+    if (!config._data) {
       return stub("operations.retrieve");
     }
     try {
-      const operation = await config.data.query(api.operations.queries.retrieve, {
+      const operation = await config._data.query(api.operations.queries.retrieve, {
         operationId
       });
       if (!operation) {
@@ -1337,7 +2109,7 @@ function createOperationsClient(config = {}) {
   return {
     retrieve,
     wait: async (operationId, input = {}) => {
-      if (!config.data) {
+      if (!config._data) {
         return stub("operations.wait");
       }
       const until = new Set(
@@ -1372,49 +2144,22 @@ function toTokenUnits(value, decimals = 6) {
   return viem.parseUnits(value, decimals);
 }
 
-// src/internal/payment-token.ts
-function resolvePaymentTokenAddress(currency) {
+// src/core/token-registry.ts
+function resolvePaymentToken(currency) {
   const normalized = currency.trim().toUpperCase();
   if (normalized === "USD" || normalized === "USDC") {
-    return TEST_USDC_ADDRESS.toLowerCase();
+    return {
+      address: TEST_USDC_ADDRESS.toLowerCase(),
+      decimals: 6,
+      symbol: "USDC"
+    };
   }
   throw new CapxulError({
-    code: "NETWORK_ERROR",
-    message: `Currency ${currency} is not configured for on-chain payment submission.`,
+    code: "NOT_IMPLEMENTED",
+    message: `Currency ${currency} is not yet supported by the token registry.`,
     details: { currency: normalized }
   });
 }
-async function buildSafeAccount(signer, chain) {
-  try {
-    const publicClient = viem.createPublicClient({
-      chain: chains.baseSepolia,
-      transport: viem.http(chain.rpcUrl)
-    });
-    return await accounts.toSafeSmartAccount({
-      client: publicClient,
-      entryPoint: { address: accountAbstraction.entryPoint07Address, version: "0.7" },
-      version: "1.4.1",
-      owners: [signer],
-      saltNonce: computeSaltNonce(signer.address),
-      safeSingletonAddress: SAFE_L2_SINGLETON,
-      safeProxyFactoryAddress: SAFE_PROXY_FACTORY,
-      safeModuleSetupAddress: SAFE_MODULE_SETUP,
-      safe4337ModuleAddress: SAFE_4337_MODULE,
-      safeModules: [],
-      setupTransactions: []
-    });
-  } catch (cause) {
-    throw new CapxulError({
-      code: "NETWORK_ERROR",
-      message: cause instanceof Error ? cause.message : String(cause),
-      cause,
-      details: { chainId: chain.chainId }
-    });
-  }
-}
-function computeSaltNonce(ownerAddress) {
-  return BigInt(`0x${ownerAddress.toLowerCase().slice(2).padEnd(64, "0")}`);
-}
 function createCapxulBundler(config) {
   const paymaster = accountAbstraction.createPaymasterClient({
     transport: viem.http(config.rpcUrl)
@@ -1521,13 +2266,13 @@ async function transferAsOwner(config, params) {
 function createPaymentsClient(config = {}) {
   return {
     create: async (input) => {
-      if (!config.data || !config.signer || !config.signing) {
+      if (!config._data || !config.signer || !config.signing) {
         return stub("payments.create");
       }
       let created = null;
       let submitted = null;
       try {
-        created = await config.data.mutation(api.payments.mutations.create, {
+        created = await config._data.mutation(api.payments.mutations.create, {
           to: input.to,
           amount: input.amount,
           reference: input.reference,
@@ -1535,15 +2280,21 @@ function createPaymentsClient(config = {}) {
           source: input.source
         });
         if (!created) {
-          return [new CapxulError({
-            code: "NETWORK_ERROR",
-            message: "payments.create returned no payment resource"
-          }), null];
+          return [
+            new CapxulError({
+              code: "NETWORK_ERROR",
+              message: "payments.create returned no payment resource"
+            }),
+            null
+          ];
         }
         if (created.status !== "processing" || created.operation.status !== "processing") {
           return [null, created];
         }
-        const currentSigner = await config.data.query(api.safe.queries.getMySignerAddress, {});
+        const currentSigner = await config._data.query(
+          api.safe.queries.getMySignerAddress,
+          {}
+        );
         if (!currentSigner?.address) {
           throw new CapxulError({
             code: "PERMISSION_DENIED",
@@ -1562,9 +2313,12 @@ function createPaymentsClient(config = {}) {
             }
           });
         }
-        const submission = await config.data.query(api.payments.queries.prepareSubmission, {
-          paymentId: created.id
-        });
+        const submission = await config._data.query(
+          api.payments.queries.prepareSubmission,
+          {
+            paymentId: created.id
+          }
+        );
         if (!submission?.recipientAddress) {
           throw new CapxulError({
             code: "NETWORK_ERROR",
@@ -1572,15 +2326,16 @@ function createPaymentsClient(config = {}) {
             details: { paymentId: created.id }
           });
         }
+        const token = resolvePaymentToken(submission.amount.currency);
         const transfer = await transferAsOwner(
           {
             signer: config.signer,
             signing: config.signing
           },
           {
-            tokenAddress: resolvePaymentTokenAddress(submission.amount.currency),
+            tokenAddress: token.address,
             recipientAddress: submission.recipientAddress,
-            amount: toTokenUnits(submission.amount.value, 6)
+            amount: toTokenUnits(submission.amount.value, token.decimals)
           }
         );
         if (!transfer.success) {
@@ -1598,7 +2353,7 @@ function createPaymentsClient(config = {}) {
           txHash: transfer.txHash,
           userOpHash: transfer.userOpHash
         };
-        await config.data.mutation(api.payments.mutations.recordSubmitted, {
+        await config._data.mutation(api.payments.mutations.recordSubmitted, {
           paymentId: created.id,
           txHash: transfer.txHash,
           userOpHash: transfer.userOpHash,
@@ -1608,43 +2363,65 @@ function createPaymentsClient(config = {}) {
       } catch (cause) {
         const error = mapCreateError(fromConvexError(cause));
         if (created?.id && created.status === "processing" && !submitted) {
-          await bestEffortMarkFailed({ data: config.data }, created.id, error);
+          await bestEffortMarkFailed({ _data: config._data }, created.id, error);
         }
         if (submitted && created?.id) {
-          return [new CapxulError({
-            code: "NETWORK_ERROR",
-            message: "Payment was submitted on-chain, but backend submission tracking failed.",
-            cause,
-            details: {
-              paymentId: created.id,
-              txHash: submitted.txHash,
-              userOpHash: submitted.userOpHash
-            }
-          }), null];
+          return [
+            new CapxulError({
+              code: "NETWORK_ERROR",
+              message: "Payment was submitted on-chain, but backend submission tracking failed.",
+              cause,
+              details: {
+                paymentId: created.id,
+                txHash: submitted.txHash,
+                userOpHash: submitted.userOpHash
+              }
+            }),
+            null
+          ];
         }
         return [error, null];
       }
     },
     retrieve: async (paymentId) => {
-      if (!config.data) {
+      if (!config._data) {
         return stub("payments.retrieve");
       }
       try {
-        const payment = await config.data.query(api.payments.queries.retrieve, {
-          paymentId
-        });
+        const payment = await config._data.query(
+          api.payments.queries.retrieve,
+          {
+            paymentId
+          }
+        );
         if (!payment) {
-          return [new CapxulError({
-            code: "NOT_FOUND",
-            message: `payment ${paymentId} not found`
-          }), null];
+          return [
+            new CapxulError({
+              code: "NOT_FOUND",
+              message: `payment ${paymentId} not found`
+            }),
+            null
+          ];
         }
         return [null, payment];
       } catch (cause) {
         return [fromConvexError(cause), null];
       }
     },
-    list: async () => stub("payments.list")
+    list: async (input) => {
+      if (!config._data) {
+        return stub("payments.list");
+      }
+      try {
+        const page = await config._data.query(api.payments.queries.list, {
+          limit: input?.limit,
+          cursor: input?.cursor
+        });
+        return [null, page];
+      } catch (cause) {
+        return [fromConvexError(cause), null];
+      }
+    }
   };
 }
 function createOrgPaymentsClient() {
@@ -1658,7 +2435,7 @@ function createOrgPaymentsClient() {
 }
 async function bestEffortMarkFailed(config, paymentId, error) {
   try {
-    await config.data.mutation(api.payments.mutations.markFailed, {
+    await config._data.mutation(api.payments.mutations.markFailed, {
       paymentId,
       errorCode: error.code,
       errorMessage: error.message,
@@ -1715,11 +2492,11 @@ function createOrgTransfersClient() {
 function createWithdrawalsClient(config = {}) {
   return {
     create: async (input) => {
-      if (!config.data) {
+      if (!config._data) {
         return stub("withdrawals.create");
       }
       const [createErr, createdRaw] = await tryCatch(
-        config.data.mutation(api.withdrawals.mutations.create, {
+        config._data.mutation(api.withdrawals.mutations.create, {
           amount: input.amount,
           destination: {
             externalAccountId: input.destination.externalAccountId
@@ -1749,18 +2526,18 @@ function createWithdrawalsClient(config = {}) {
         return [null, created];
       }
       const [signerErr, currentSigner] = await tryCatch(
-        config.data.query(api.safe.queries.getMySignerAddress, {})
+        config._data.query(api.safe.queries.getMySignerAddress, {})
       );
       if (signerErr) {
         return await handleSubmissionFailure(
-          { data: config.data },
+          { _data: config._data },
           created.id,
           mapCreateError2(fromConvexError(signerErr))
         );
       }
       if (!currentSigner?.address) {
         return await handleSubmissionFailure(
-          { data: config.data },
+          { _data: config._data },
           created.id,
           new CapxulError({
             code: "PERMISSION_DENIED",
@@ -1771,7 +2548,7 @@ function createWithdrawalsClient(config = {}) {
       }
       if (viem.getAddress(currentSigner.address) !== viem.getAddress(config.signer.address)) {
         return await handleSubmissionFailure(
-          { data: config.data },
+          { _data: config._data },
           created.id,
           new CapxulError({
             code: "PERMISSION_DENIED",
@@ -1785,13 +2562,13 @@ function createWithdrawalsClient(config = {}) {
         );
       }
       const [prepErr, submission] = await tryCatch(
-        config.data.query(api.withdrawals.queries.prepareSubmission, {
+        config._data.query(api.withdrawals.queries.prepareSubmission, {
           withdrawalId: created.id
         })
       );
       if (prepErr) {
         return await handleSubmissionFailure(
-          { data: config.data },
+          { _data: config._data },
           created.id,
           mapCreateError2(fromConvexError(prepErr))
         );
@@ -1799,7 +2576,7 @@ function createWithdrawalsClient(config = {}) {
       const destinationAddress = submission?.destinationAddress;
       if (!submission || !destinationAddress) {
         return await handleSubmissionFailure(
-          { data: config.data },
+          { _data: config._data },
           created.id,
           new CapxulError({
             code: "NETWORK_ERROR",
@@ -1808,6 +2585,7 @@ function createWithdrawalsClient(config = {}) {
           })
         );
       }
+      const token = resolvePaymentToken(submission.amount.currency);
       const [transferErr, transferOk] = await tryCatch(
         transferAsOwner(
           {
@@ -1815,22 +2593,22 @@ function createWithdrawalsClient(config = {}) {
             signing: config.signing
           },
           {
-            tokenAddress: resolvePaymentTokenAddress(submission.amount.currency),
+            tokenAddress: token.address,
             recipientAddress: destinationAddress,
-            amount: toTokenUnits(submission.amount.value, 6)
+            amount: toTokenUnits(submission.amount.value, token.decimals)
           }
         )
       );
       if (transferErr) {
         return await handleSubmissionFailure(
-          { data: config.data },
+          { _data: config._data },
           created.id,
           mapCreateError2(fromConvexError(transferErr))
         );
       }
       if (!transferOk.success) {
         return await handleSubmissionFailure(
-          { data: config.data },
+          { _data: config._data },
           created.id,
           new CapxulError({
             code: "NETWORK_ERROR",
@@ -1844,7 +2622,7 @@ function createWithdrawalsClient(config = {}) {
         );
       }
       const [recordErr] = await tryCatch(
-        config.data.mutation(api.withdrawals.mutations.recordSubmitted, {
+        config._data.mutation(api.withdrawals.mutations.recordSubmitted, {
           withdrawalId: created.id,
           txHash: transferOk.txHash,
           userOpHash: transferOk.userOpHash
@@ -1868,11 +2646,11 @@ function createWithdrawalsClient(config = {}) {
       return [null, created];
     },
     retrieve: async (withdrawalId) => {
-      if (!config.data) {
+      if (!config._data) {
         return stub("withdrawals.retrieve");
       }
       const [err, raw] = await tryCatch(
-        config.data.query(api.withdrawals.queries.retrieve, { withdrawalId })
+        config._data.query(api.withdrawals.queries.retrieve, { withdrawalId })
       );
       if (err) {
         return [fromConvexError(err), null];
@@ -1890,11 +2668,11 @@ function createWithdrawalsClient(config = {}) {
       return [null, withdrawal];
     },
     list: async (input) => {
-      if (!config.data) {
+      if (!config._data) {
         return stub("withdrawals.list");
       }
       const [err, raw] = await tryCatch(
-        config.data.query(api.withdrawals.queries.list, {
+        config._data.query(api.withdrawals.queries.list, {
           limit: input?.limit,
           cursor: input?.cursor
         })
@@ -1905,13 +2683,13 @@ function createWithdrawalsClient(config = {}) {
       return [null, raw];
     },
     recordCompleted: async (input) => {
-      if (!config.data) {
+      if (!config._data) {
         return stub(
           "withdrawals.recordCompleted"
         );
       }
       const [err] = await tryCatch(
-        config.data.mutation(api.withdrawals.mutations.recordCompleted, {
+        config._data.mutation(api.withdrawals.mutations.recordCompleted, {
           withdrawalId: input.withdrawalId,
           txHash: input.txHash
         })
@@ -1936,13 +2714,13 @@ function createOrgWithdrawalsClient(config = {}) {
      * orchestration ships in W3+.
      */
     create: async (input) => {
-      if (!config.data) {
+      if (!config._data) {
         return stub(
           "organizations.withdrawals.create"
         );
       }
       const [err, raw] = await tryCatch(
-        config.data.mutation(api.withdrawals.mutations.createOrg, {
+        config._data.mutation(api.withdrawals.mutations.createOrg, {
           organizationId: input.organizationId,
           amount: input.amount,
           destination: {
@@ -1969,13 +2747,13 @@ function createOrgWithdrawalsClient(config = {}) {
       return [null, created];
     },
     retrieve: async (input) => {
-      if (!config.data) {
+      if (!config._data) {
         return stub(
           "organizations.withdrawals.retrieve"
         );
       }
       const [err, raw] = await tryCatch(
-        config.data.query(api.withdrawals.queries.retrieve, {
+        config._data.query(api.withdrawals.queries.retrieve, {
           withdrawalId: input.withdrawalId
         })
       );
@@ -2005,13 +2783,13 @@ function createOrgWithdrawalsClient(config = {}) {
       return [null, withdrawal];
     },
     list: async (input) => {
-      if (!config.data) {
+      if (!config._data) {
         return stub(
           "organizations.withdrawals.list"
         );
       }
       const [err, raw] = await tryCatch(
-        config.data.query(api.withdrawals.queries.listOrg, {
+        config._data.query(api.withdrawals.queries.listOrg, {
           organizationId: input.organizationId,
           limit: input.limit,
           cursor: input.cursor
@@ -2030,7 +2808,7 @@ async function handleSubmissionFailure(config, withdrawalId, error) {
 }
 async function bestEffortMarkFailed2(config, withdrawalId, error) {
   await tryCatch(
-    config.data.mutation(api.withdrawals.mutations.markFailed, {
+    config._data.mutation(api.withdrawals.mutations.markFailed, {
       withdrawalId,
       errorCode: error.code,
       errorMessage: error.message
@@ -2109,13 +2887,13 @@ function createWebhookEventsClient() {
 function createOrgExternalAccountsClient(config) {
   return {
     create: async (input) => {
-      if (!config.data) {
+      if (!config._data) {
         return stub(
           "organizations.externalAccounts.create"
         );
       }
       const [err, raw] = await tryCatch(
-        config.data.mutation(api.externalAccounts.mutations.createOrg, {
+        config._data.mutation(api.externalAccounts.mutations.createOrg, {
           organizationId: input.organizationId,
           kind: input.kind,
           label: input.label,
@@ -2129,10 +2907,7 @@ function createOrgExternalAccountsClient(config) {
         })
       );
       if (err) {
-        return [
-          fromConvexError(err),
-          null
-        ];
+        return [fromConvexError(err), null];
       }
       if (!raw) {
         return [
@@ -2143,21 +2918,16 @@ function createOrgExternalAccountsClient(config) {
           null
         ];
       }
-      return [
-        null,
-        brandExternalAccount(
-          raw
-        )
-      ];
+      return [null, brandExternalAccount(raw)];
     },
     list: async (input) => {
-      if (!config.data) {
+      if (!config._data) {
         return stub(
           "organizations.externalAccounts.list"
         );
       }
       const [err, result] = await tryCatch(
-        config.data.query(api.externalAccounts.queries.listOrg, {
+        config._data.query(api.externalAccounts.queries.listOrg, {
           organizationId: input.organizationId,
           limit: input.limit,
           cursor: input.cursor
@@ -2167,9 +2937,7 @@ function createOrgExternalAccountsClient(config) {
         return [fromConvexError(err), null];
       }
       const branded = result.data.map(
-        (row) => brandExternalAccount(
-          row
-        )
+        (row) => brandExternalAccount(row)
       );
       return [
         null,
@@ -2181,17 +2949,66 @@ function createOrgExternalAccountsClient(config) {
       ];
     },
     retrieve: async (input) => {
-      if (!config.data) {
+      if (!config._data) {
         return stub(
           "organizations.externalAccounts.retrieve"
         );
       }
       const [err, raw] = await tryCatch(
-        config.data.query(api.externalAccounts.queries.retrieveOrg, {
+        config._data.query(api.externalAccounts.queries.retrieveOrg, {
+          organizationId: input.organizationId,
+          externalAccountId: input.externalAccountId
+        })
+      );
+      if (err) {
+        return [fromConvexError(err), null];
+      }
+      if (!raw) {
+        return [
+          new CapxulError({
+            code: "NOT_FOUND",
+            message: `external_account ${input.externalAccountId} not found`
+          }),
+          null
+        ];
+      }
+      return [null, brandExternalAccount(raw)];
+    },
+    remove: async (input) => {
+      if (!config._data) {
+        return stub("organizations.externalAccounts.remove");
+      }
+      const [err] = await tryCatch(
+        config._data.mutation(api.externalAccounts.mutations.removeOrg, {
           organizationId: input.organizationId,
           externalAccountId: input.externalAccountId
         })
       );
+      if (err) {
+        return [fromConvexError(err), null];
+      }
+      return [null, void 0];
+    }
+  };
+}
+function createOrgSubAccountsClient(config) {
+  return {
+    create: async (input) => {
+      if (!config._data) {
+        return stub(
+          "organizations.subAccounts.create"
+        );
+      }
+      const [err, raw] = await tryCatch(
+        config._data.mutation(api.subAccounts.mutations.create, {
+          parent: {
+            kind: "organization",
+            id: input.organizationId
+          },
+          name: input.name,
+          purpose: input.purpose
+        })
+      );
       if (err) {
         return [
           fromConvexError(err),
@@ -2202,28 +3019,60 @@ function createOrgExternalAccountsClient(config) {
         return [
           new CapxulError({
             code: "NOT_FOUND",
-            message: `external_account ${input.externalAccountId} not found`
+            message: "sub_account creation returned no resource"
           }),
           null
         ];
       }
+      const [brandErr, branded] = tryBrandSubAccount(raw);
+      if (brandErr) {
+        return [brandErr, null];
+      }
+      return [null, branded];
+    },
+    list: async (input) => {
+      if (!config._data) {
+        return stub(
+          "organizations.subAccounts.list"
+        );
+      }
+      const [err, rows] = await tryCatch(
+        config._data.query(api.subAccounts.queries.listByOrganization, {
+          organizationId: input.organizationId
+        })
+      );
+      if (err) {
+        return [
+          fromConvexError(err),
+          null
+        ];
+      }
+      const branded = [];
+      for (const row of rows) {
+        const [brandErr, value] = tryBrandSubAccount(row);
+        if (brandErr) {
+          return [brandErr, null];
+        }
+        branded.push(value);
+      }
       return [
         null,
-        brandExternalAccount(
-          raw
-        )
+        {
+          object: "list",
+          data: branded,
+          page: { hasMore: false }
+        }
       ];
     },
-    remove: async (input) => {
-      if (!config.data) {
+    retrieve: async (input) => {
+      if (!config._data) {
         return stub(
-          "organizations.externalAccounts.remove"
+          "organizations.subAccounts.retrieve"
         );
       }
-      const [err] = await tryCatch(
-        config.data.mutation(api.externalAccounts.mutations.removeOrg, {
-          organizationId: input.organizationId,
-          externalAccountId: input.externalAccountId
+      const [err, raw] = await tryCatch(
+        config._data.query(api.subAccounts.queries.retrieve, {
+          subAccountId: input.subAccountId
         })
       );
       if (err) {
@@ -2232,822 +3081,557 @@ function createOrgExternalAccountsClient(config) {
           null
         ];
       }
-      return [null, void 0];
-    }
-  };
-}
-function createOrganizationsClient(config = {}) {
-  return {
-    create: async () => stub("organizations.create"),
-    retrieve: async () => stub("organizations.retrieve"),
-    list: async () => stub("organizations.list"),
-    update: async () => stub("organizations.update"),
-    safes: {
-      retrieve: async (input) => {
-        if (!config.data) {
-          return stub("organizations.safes.retrieve");
-        }
-        try {
-          const safe = await config.data.query(
-            api.safe.queries.retrieveOrganizationSafe,
-            input
-          );
-          if (!safe) {
-            return [
-              new CapxulError({
-                code: "NOT_FOUND",
-                message: `safe ${input.safeId} not found`
-              }),
-              null
-            ];
-          }
-          return [null, safe];
-        } catch (cause) {
-          return [
-            fromConvexError(cause),
-            null
-          ];
-        }
+      if (!raw) {
+        return [
+          new CapxulError({
+            code: "NOT_FOUND",
+            message: `sub_account ${input.subAccountId} not found`
+          }),
+          null
+        ];
       }
+      const [brandErr, branded] = tryBrandSubAccount(raw);
+      if (brandErr) {
+        return [
+          brandErr,
+          null
+        ];
+      }
+      return [null, branded];
     },
-    treasury: {
-      retrieve: async () => stub("organizations.treasury.retrieve")
-    },
-    members: {
-      list: async () => stub("organizations.members.list"),
-      retrieve: async () => stub("organizations.members.retrieve"),
-      invite: async () => stub("organizations.members.invite"),
-      updateRole: async () => stub("organizations.members.updateRole"),
-      remove: async () => stub("organizations.members.remove")
-    },
-    apiKeys: createApiKeysClient(),
-    kybProfile: {
-      start: async () => stub("organizations.kybProfile.start"),
-      retrieve: async () => stub("organizations.kybProfile.retrieve")
-    },
-    subAccounts: {
-      create: async () => stub("organizations.subAccounts.create"),
-      list: async () => stub("organizations.subAccounts.list"),
-      retrieve: async () => stub("organizations.subAccounts.retrieve"),
-      remove: async () => stub("organizations.subAccounts.remove")
-    },
-    externalAccounts: createOrgExternalAccountsClient(config),
-    balanceLedger: {
-      list: async () => stub(
-        "organizations.balanceLedger.list"
-      ),
-      retrieve: async () => stub(
-        "organizations.balanceLedger.retrieve"
-      )
-    },
-    payments: createOrgPaymentsClient(),
-    transfers: createOrgTransfersClient(),
-    withdrawals: createOrgWithdrawalsClient(config),
-    documents: createOrgDocumentsClient(),
-    webhookEndpoints: createWebhookEndpointsClient(),
-    webhookEvents: createWebhookEventsClient()
-  };
-}
-
-// src/core/sub-accounts.ts
-function createSubAccountsClient() {
-  return {
-    retrieve: async () => stub("subAccounts.retrieve"),
-    remove: async () => stub("subAccounts.remove")
-  };
-}
-
-// src/core/token-transfers.ts
-var toTokenTransferId = (raw) => {
-  if (typeof raw !== "string" || raw.length === 0) {
-    throw new Error(
-      `Invalid tokenTransferId: expected non-empty string, got ${String(raw)}`
-    );
-  }
-  return raw;
-};
-function brandRow(row) {
-  return {
-    ...row,
-    id: toTokenTransferId(row.id)
+    remove: async (input) => {
+      if (!config._data) {
+        return stub(
+          "organizations.subAccounts.remove"
+        );
+      }
+      const [err, raw] = await tryCatch(
+        config._data.mutation(api.subAccounts.mutations.archive, {
+          subAccountId: input.subAccountId
+        })
+      );
+      if (err) {
+        return [
+          fromConvexError(err),
+          null
+        ];
+      }
+      if (!raw) {
+        return [
+          new CapxulError({
+            code: "NOT_FOUND",
+            message: `sub_account ${input.subAccountId} not found`
+          }),
+          null
+        ];
+      }
+      const [brandErr, branded] = tryBrandSubAccount(raw);
+      if (brandErr) {
+        return [
+          brandErr,
+          null
+        ];
+      }
+      return [null, branded];
+    }
   };
 }
-function createTokenTransfersClient(config = {}) {
+function createOrganizationsClient(config = {}) {
   return {
-    list: async (input) => {
-      if (!config.data) {
-        return stub("tokenTransfers.list");
+    create: async (input) => {
+      if (!config._data) {
+        return stub("organizations.create");
+      }
+      if (input.country !== void 0) {
+        return [
+          new CapxulError({
+            code: "INVALID_INPUT",
+            message: "organizations.create does not support country yet \u2014 backend mutation only accepts name.",
+            details: { field: "country" }
+          }),
+          null
+        ];
       }
       try {
-        const raw = await config.data.query(
-          api.tokenTransfers.queries.list,
-          {
-            limit: input?.limit,
-            cursor: input?.cursor,
-            direction: input?.direction
-          }
-        );
-        if (!raw) {
+        const orgId = await config._data.mutation(api.org.mutations.create, {
+          name: input.name
+        });
+        const org = await config._data.query(api.org.queries.retrieve, {
+          orgId
+        });
+        if (!org) {
           return [
             new CapxulError({
-              code: "NOT_AUTHENTICATED",
-              message: "tokenTransfers.list requires an authenticated session."
+              code: "NETWORK_ERROR",
+              message: "organization created but could not be retrieved"
             }),
             null
           ];
         }
-        return [
-          null,
-          {
-            object: "list",
-            data: raw.items.map(brandRow),
-            page: {
-              hasMore: raw.hasMore,
-              nextCursor: raw.nextCursor
-            },
-            displayCurrency: raw.displayCurrency
-          }
-        ];
+        return [null, org];
       } catch (cause) {
         return [fromConvexError(cause), null];
       }
     },
-    retrieve: async (input) => {
-      if (!config.data) {
-        return stub("tokenTransfers.retrieve");
+    retrieve: async (organizationId) => {
+      if (!config._data) {
+        return stub("organizations.retrieve");
       }
       try {
-        const raw = await config.data.query(
-          api.tokenTransfers.queries.getByTxLogIndex,
-          {
-            txHash: input.txHash,
-            logIndex: input.logIndex,
-            chainId: input.chainId
-          }
-        );
-        if (!raw) {
+        const orgId = organizationId.replace(/^org_/, "");
+        const org = await config._data.query(api.org.queries.retrieve, {
+          orgId
+        });
+        if (!org) {
           return [
             new CapxulError({
               code: "NOT_FOUND",
-              message: `tokenTransfer (txHash=${input.txHash}, logIndex=${input.logIndex}) not found or not visible to caller.`,
-              details: {
-                txHash: input.txHash,
-                logIndex: input.logIndex,
-                chainId: input.chainId
-              }
+              message: `organization ${organizationId} not found`
             }),
             null
           ];
         }
-        return [null, brandRow(raw)];
+        return [null, org];
       } catch (cause) {
         return [fromConvexError(cause), null];
       }
-    }
-  };
-}
-
-// src/core/virtual-accounts.ts
-function createVirtualAccountsClient() {
-  return {
-    create: async () => stub("virtualAccounts.create"),
-    retrieve: async () => stub("virtualAccounts.retrieve"),
-    list: async () => stub("virtualAccounts.list"),
-    remove: async () => stub("virtualAccounts.remove")
-  };
-}
-
-// src/core/virtual-cards.ts
-function createVirtualCardsClient() {
-  return {
-    create: async () => stub("virtualCards.create"),
-    retrieve: async () => stub("virtualCards.retrieve"),
-    list: async () => stub("virtualCards.list"),
-    freeze: async () => stub("virtualCards.freeze"),
-    unfreeze: async () => stub("virtualCards.unfreeze"),
-    cancel: async () => stub("virtualCards.cancel")
-  };
-}
-function createAuthFlowMachine(client) {
-  return xstate.setup({
-    types: {},
-    actors: {
-      // XState v5's `fromPromise` injects an `AbortSignal` that aborts
-      // when the actor is stopped (parent transition fires, machine is
-      // disposed, etc.). Plumbing it through `client.auth.sendOtp` /
-      // `client.auth.verifyOtp` makes the in-flight HTTP request
-      // cancellable: stale responses can't race a state machine
-      // that's already moved on. See PR #406 S5.
-      sendOtp: xstate.fromPromise(async ({ input, signal }) => {
-        const [error] = await client.auth.sendOtp(
-          { email: input.email },
-          { signal }
-        );
-        if (error) throw error;
-      }),
-      verifyOtp: xstate.fromPromise(
-        async ({ input, signal }) => {
-          const [error, result] = await client.auth.verifyOtp(
-            {
-              email: input.email,
-              otp: input.code
-            },
-            { signal }
-          );
-          if (error) throw error;
-          if (result.kind === "bootstrap_required") {
-            throw new CapxulError({
-              code: "ACTION_REQUIRED",
-              message: "OTP verified but auth bootstrap is required. Use createAuthBootstrapFlowMachine for product sign-up.",
-              details: { reason: result.reason }
-            });
-          }
-          return result.session;
-        }
-      ),
-      signOut: xstate.fromPromise(async () => {
-        const [error] = await client.auth.signOut();
-        if (error) throw error;
-      })
     },
-    actions: {
-      trackOtpRequested: ({ context }) => {
-        if (!context.email) return;
-        track("auth_otp_requested", {
-          email_domain: emailDomain(context.email)
-        });
-      },
-      trackOtpFailed: ({ event }) => {
-        const error = errorFromEvent(event);
-        track("auth_failed", {
-          auth_type: "email_otp",
-          reason: error.code
-        });
-      },
-      trackTimeoutFailed: () => {
-        track("auth_failed", {
-          auth_type: "email_otp",
-          reason: "timeout"
-        });
-      },
-      trackVerified: () => {
-        track("auth_verified", { auth_type: "email_otp" });
-      },
-      identifyAndTrack: ({ context }) => {
-        if (!context.session) return;
-        identify(context.session.authUserId, {
-          email_domain: emailDomain(context.session.email)
-        });
-        track("auth_identified", {
-          email_domain: emailDomain(context.session.email)
-        });
-      },
-      trackSignedOut: () => {
-        track("auth_signed_out");
+    list: async (input) => {
+      if (!config._data) {
+        return stub("organizations.list");
       }
-    }
-  }).createMachine({
-    id: "auth",
-    initial: "idle",
-    context: { email: null, session: null, error: null },
-    states: {
-      idle: {
-        on: {
-          REQUEST_OTP: {
-            target: "sending_otp",
-            actions: xstate.assign({
-              email: ({ event }) => event.email,
-              error: () => null
-            })
-          }
-        }
-      },
-      sending_otp: {
-        invoke: {
-          src: "sendOtp",
-          input: ({ context }) => ({ email: requireEmail(context) }),
-          onDone: {
-            target: "otp_requested",
-            actions: ["trackOtpRequested"]
-          },
-          onError: {
-            target: "error",
-            actions: [
-              xstate.assign({ error: ({ event }) => errorFromEvent(event) }),
-              "trackOtpFailed"
-            ]
-          }
-        },
-        after: {
-          [FLOW_INVOKE_TIMEOUT_MS]: {
-            target: "error",
-            actions: [
-              xstate.assign({
-                error: () => timeoutError("sending_otp")
-              }),
-              "trackTimeoutFailed"
-            ]
+      try {
+        const page = await config._data.query(api.org.queries.list, {
+          limit: input?.limit,
+          cursor: input?.cursor
+        });
+        const result = {
+          object: "list",
+          data: page.data,
+          page: {
+            hasMore: page.hasMore,
+            cursor: page.nextCursor
           }
+        };
+        return [null, result];
+      } catch (cause) {
+        return [fromConvexError(cause), null];
+      }
+    },
+    update: async (input) => {
+      if (!config._data) {
+        return stub("organizations.update");
+      }
+      try {
+        const orgId = input.organizationId.replace(/^org_/, "");
+        const org = await config._data.mutation(api.org.mutations.update, {
+          orgId,
+          name: input.name
+        });
+        if (!org) {
+          return [
+            new CapxulError({
+              code: "NOT_FOUND",
+              message: `organization ${input.organizationId} not found`
+            }),
+            null
+          ];
         }
-      },
-      otp_requested: {
-        on: {
-          VERIFY: { target: "verifying" },
-          RESET: {
-            target: "idle",
-            actions: xstate.assign({ email: () => null, error: () => null })
-          }
+        return [null, org];
+      } catch (cause) {
+        return [fromConvexError(cause), null];
+      }
+    },
+    safes: {
+      retrieve: async (input) => {
+        if (!config._data) {
+          return stub("organizations.safes.retrieve");
         }
-      },
-      verifying: {
-        invoke: {
-          src: "verifyOtp",
-          input: ({ context, event }) => ({
-            email: requireEmail(context),
-            code: requireCodeFromEvent(event)
-          }),
-          onDone: {
-            target: "authenticated",
-            actions: [
-              // Scrub the duplicate `context.email` (input value
-              // captured during sendOtp) since the verified
-              // `session.email` is now the canonical source
-              // post-authentication. The session's email is
-              // intentionally retained — it's the auth result, not
-              // lingering input. See PR #406 S2.
-              xstate.assign({
-                session: ({ event }) => event.output,
-                email: () => null
-              }),
-              "trackVerified",
-              "identifyAndTrack"
-            ]
-          },
-          onError: {
-            target: "error",
-            actions: [
-              xstate.assign({ error: ({ event }) => errorFromEvent(event) }),
-              "trackOtpFailed"
-            ]
-          }
-        },
-        after: {
-          [FLOW_INVOKE_TIMEOUT_MS]: {
-            target: "error",
-            actions: [
-              xstate.assign({
-                error: () => timeoutError("verifying")
+        try {
+          const safe = await config._data.query(
+            api.safe.queries.retrieveOrganizationSafe,
+            input
+          );
+          if (!safe) {
+            return [
+              new CapxulError({
+                code: "NOT_FOUND",
+                message: `safe ${input.safeId} not found`
               }),
-              "trackTimeoutFailed"
-            ]
+              null
+            ];
           }
+          return [null, safe];
+        } catch (cause) {
+          return [
+            fromConvexError(cause),
+            null
+          ];
         }
-      },
-      authenticated: {
-        on: {
-          SIGN_OUT: { target: "signing_out" }
+      }
+    },
+    treasury: {
+      retrieve: async (organizationId) => {
+        if (!config._data) {
+          return stub(
+            "organizations.treasury.retrieve"
+          );
         }
-      },
-      signing_out: {
-        invoke: {
-          src: "signOut",
-          onDone: {
-            target: "idle",
-            actions: [
-              xstate.assign({
-                session: () => null,
-                email: () => null,
-                error: () => null
+        try {
+          const orgId = organizationId.replace(/^org_/, "");
+          const raw = await config._data.query(
+            api.safe.queries.getOrgTreasuryBalance,
+            { orgId }
+          );
+          if (!raw) {
+            return [
+              new CapxulError({
+                code: "NOT_FOUND",
+                message: `treasury for organization ${organizationId} not found`
               }),
-              "trackSignedOut"
-            ]
-          },
-          onError: {
-            target: "error",
-            actions: xstate.assign({ error: ({ event }) => errorFromEvent(event) })
-          }
-        }
-      },
-      error: {
-        on: {
-          RESET: {
-            target: "idle",
-            actions: xstate.assign({ error: () => null })
+              null
+            ];
           }
+          const treasury = {
+            object: "treasury",
+            id: toTreasuryId(`try_${orgId}`),
+            organizationId,
+            status: "active",
+            safeId: toSafeId(
+              `safe_${raw.safeAddress.replace(/^0x/, "").toLowerCase()}`
+            ),
+            totalBalance: { value: "0", currency: "USD" },
+            positions: raw.tokens.map((t) => ({
+              symbol: t.symbol,
+              contractAddress: t.tokenAddress,
+              amount: t.balance
+            })),
+            asOf: raw.lastUpdatedAt ? new Date(raw.lastUpdatedAt).toISOString() : (/* @__PURE__ */ new Date()).toISOString()
+          };
+          return [null, treasury];
+        } catch (cause) {
+          return [
+            fromConvexError(cause),
+            null
+          ];
         }
       }
-    }
-  });
-}
-function requireEmail(context) {
-  if (!context.email) {
-    throw Errors.invalidInput(
-      "email",
-      "Auth flow advanced without an email captured in context."
-    );
-  }
-  return context.email;
-}
-function requireCodeFromEvent(event) {
-  if (event.type !== "VERIFY") {
-    throw Errors.invalidInput(
-      "code",
-      `Auth flow's verifying state requires a VERIFY event, got ${event.type}.`
-    );
-  }
-  return event.code;
-}
-function errorFromEvent(event) {
-  const cause = typeof event === "object" && event !== null && "error" in event ? event.error : event;
-  if (cause instanceof CapxulError) {
-    if (!EMAIL_MATCH_PATTERN.test(cause.message)) return cause;
-    return new CapxulError({
-      code: cause.code,
-      message: redactEmail(cause.message),
-      cause,
-      details: cause.details,
-      operationId: cause.operationId,
-      correlationId: cause.correlationId,
-      retryable: cause.retryable
-    });
-  }
-  if (cause instanceof CapxulError2) {
-    if (!EMAIL_MATCH_PATTERN.test(cause.message)) return cause;
-    return new CapxulError2(cause.code, redactEmail(cause.message), {
-      cause,
-      details: cause.details,
-      correlationId: cause.correlationId,
-      layer: cause.layer
-    });
-  }
-  return Errors.providerError("auth", "flow", redactCauseEmail(cause));
-}
-var EMAIL_MATCH_PATTERN = /[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}/;
-var EMAIL_REDACT_PATTERN = /[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}/g;
-function redactEmail(message) {
-  return message.replace(EMAIL_REDACT_PATTERN, "<redacted>");
-}
-function redactCauseEmail(cause) {
-  if (cause instanceof Error) {
-    if (!EMAIL_MATCH_PATTERN.test(cause.message)) return cause;
-    const redacted = new Error(redactEmail(cause.message));
-    redacted.cause = cause;
-    return redacted;
-  }
-  if (typeof cause === "string") {
-    return redactEmail(cause);
-  }
-  return cause;
-}
-function timeoutError(state) {
-  return Errors.providerError(
-    "auth",
-    "flow",
-    new Error(`timeout: ${state} exceeded ${FLOW_INVOKE_TIMEOUT_MS}ms`)
-  );
-}
-function emailDomain(email) {
-  const domain = email.split("@")[1]?.trim().toLowerCase();
-  return domain || "unknown";
-}
-var initialContext = {
-  email: null,
-  code: null,
-  username: null,
-  signerProvider: null,
-  bootstrapToken: null,
-  bootstrapReason: null,
-  session: null,
-  account: null,
-  safe: null,
-  error: null
-};
-function createAuthBootstrapFlowMachine(client) {
-  return xstate.setup({
-    types: {},
-    actors: {
-      sendOtp: xstate.fromPromise(async ({ input, signal }) => {
-        const [error] = await client.auth.sendOtp(
-          { email: input.email },
-          { signal }
-        );
-        if (error) throw error;
-      }),
-      verifyOtp: xstate.fromPromise(
-        async ({ input, signal }) => {
-          const [error, result] = await client.auth.verifyOtp(
-            { email: input.email, otp: input.code },
-            { signal }
-          );
-          if (error) throw error;
-          return result;
-        }
-      ),
-      completeBootstrap: xstate.fromPromise(async ({ input }) => {
-        const [error, result] = await client.auth.completeBootstrap(input);
-        if (error) throw error;
-        return result;
-      }),
-      signOut: xstate.fromPromise(async () => {
-        const [error] = await client.auth.signOut();
-        if (error) throw error;
-      })
     },
-    actions: {
-      trackOtpRequested: ({ context }) => {
-        if (!context.email) return;
-        track("auth_otp_requested", {
-          email_domain: emailDomain2(context.email)
-        });
-      },
-      trackFailed: ({ event }) => {
-        track("auth_failed", {
-          auth_type: "email_otp",
-          reason: errorFromEvent2(event).code
-        });
-      },
-      trackTimeoutFailed: () => {
-        track("auth_failed", {
-          auth_type: "email_otp",
-          reason: "timeout"
-        });
-      },
-      trackVerified: () => {
-        track("auth_verified", { auth_type: "email_otp" });
-      },
-      trackBootstrapRequired: ({ context }) => {
-        track("auth_verified", {
-          auth_type: "email_otp",
-          auth_mode: context.bootstrapReason ?? "bootstrap_required"
-        });
-      },
-      identifyAndTrack: ({ context }) => {
-        if (!context.session) return;
-        identify(context.session.authUserId, {
-          email_domain: emailDomain2(context.session.email)
-        });
-        track("auth_identified", {
-          email_domain: emailDomain2(context.session.email)
-        });
-      },
-      trackSignedOut: () => {
-        track("auth_signed_out");
-      }
-    }
-  }).createMachine({
-    id: "authBootstrap",
-    initial: "email",
-    context: initialContext,
-    states: {
-      email: {
-        on: {
-          ENTER_EMAIL: {
-            actions: xstate.assign({
-              email: ({ event }) => event.email,
-              error: () => null
-            })
-          },
-          REQUEST_OTP: { target: "sending_otp" }
+    members: {
+      list: async (input) => {
+        if (!config._data?.action) {
+          return stub("organizations.members.list");
+        }
+        try {
+          const orgId = input.organizationId.replace(/^org_/, "");
+          const page = await config._data.action(api.org.actions.membersList, {
+            organizationId: orgId,
+            status: input.status,
+            limit: input.limit,
+            cursor: input.cursor
+          });
+          return [null, page];
+        } catch (cause) {
+          return [fromConvexError(cause), null];
         }
       },
-      sending_otp: {
-        invoke: {
-          src: "sendOtp",
-          input: ({ context }) => ({ email: requireEmail2(context) }),
-          onDone: { target: "otp_requested", actions: "trackOtpRequested" },
-          onError: {
-            target: "otp_requested",
-            actions: [
-              xstate.assign({ error: ({ event }) => errorFromEvent2(event) }),
-              "trackFailed"
-            ]
-          }
-        },
-        after: {
-          [FLOW_INVOKE_TIMEOUT_MS]: {
-            target: "otp_requested",
-            actions: [
-              xstate.assign({ error: () => timeoutError2("sending_otp") }),
-              "trackTimeoutFailed"
-            ]
-          }
+      retrieve: async (input) => {
+        if (!config._data?.action) {
+          return stub("organizations.members.retrieve");
         }
-      },
-      otp_requested: {
-        on: {
-          ENTER_OTP: {
-            actions: xstate.assign({
-              code: ({ event }) => event.code,
-              error: () => null
-            })
-          },
-          VERIFY_OTP: { target: "verifying_otp" },
-          BACK: { target: "email" },
-          RESET: { target: "email", actions: xstate.assign(() => initialContext) }
+        try {
+          const orgId = input.organizationId.replace(/^org_/, "");
+          const memberId = input.memberId.replace(/^mb_/, "");
+          const member = await config._data.action(
+            api.org.actions.retrieveMember,
+            {
+              organizationId: orgId,
+              memberId
+            }
+          );
+          return [null, member];
+        } catch (cause) {
+          return [fromConvexError(cause), null];
         }
       },
-      verifying_otp: {
-        invoke: {
-          src: "verifyOtp",
-          input: ({ context }) => ({
-            email: requireEmail2(context),
-            code: requireCode(context)
-          }),
-          onDone: [
-            {
-              guard: ({ event }) => event.output.kind === "existing_member",
-              target: "authenticated",
-              actions: [
-                xstate.assign({
-                  session: ({ event }) => event.output.session,
-                  account: ({ event }) => event.output.kind === "existing_member" ? event.output.account : null,
-                  username: ({ event }) => event.output.kind === "existing_member" ? event.output.username : null,
-                  safe: ({ event }) => event.output.kind === "existing_member" ? event.output.safe : null,
-                  email: () => null,
-                  error: () => null
-                }),
-                "trackVerified",
-                "identifyAndTrack"
-              ]
-            },
+      invite: async (input) => {
+        if (!config._data?.action) {
+          return stub(
+            "organizations.members.invite"
+          );
+        }
+        try {
+          const orgId = input.organizationId.replace(/^org_/, "");
+          const result = await config._data.action(
+            api.org.actions.inviteMember,
             {
-              target: "bootstrap_required",
-              actions: [
-                xstate.assign({
-                  session: ({ event }) => event.output.session,
-                  bootstrapToken: ({ event }) => event.output.kind === "bootstrap_required" ? event.output.bootstrapToken : null,
-                  bootstrapReason: ({ event }) => event.output.kind === "bootstrap_required" ? event.output.reason : null,
-                  username: ({ event }) => event.output.kind === "bootstrap_required" ? event.output.username ?? null : null,
-                  email: ({ event }) => event.output.kind === "bootstrap_required" ? event.output.email : null,
-                  error: () => null
-                }),
-                "trackVerified",
-                "trackBootstrapRequired"
-              ]
+              organizationId: orgId,
+              email: input.email,
+              role: input.role
             }
-          ],
-          onError: {
-            target: "otp_requested",
-            actions: [
-              xstate.assign({ error: ({ event }) => errorFromEvent2(event) }),
-              "trackFailed"
-            ]
-          }
-        },
-        after: {
-          [FLOW_INVOKE_TIMEOUT_MS]: {
-            target: "otp_requested",
-            actions: [
-              xstate.assign({ error: () => timeoutError2("verifying_otp") }),
-              "trackTimeoutFailed"
-            ]
-          }
+          );
+          return [null, result];
+        } catch (cause) {
+          return [fromConvexError(cause), null];
         }
       },
-      bootstrap_required: {
-        on: {
-          ENTER_USERNAME: {
-            actions: xstate.assign({
-              username: ({ event }) => event.username,
-              error: () => null
-            })
-          },
-          ENTER_SIGNER_PROVIDER: {
-            actions: xstate.assign({
-              signerProvider: ({ event }) => event.signerProvider,
-              error: () => null
-            })
-          },
-          COMPLETE_BOOTSTRAP: { target: "completing_bootstrap" },
-          BACK: { target: "otp_requested" },
-          RESET: { target: "email", actions: xstate.assign(() => initialContext) }
+      accept: async (input) => {
+        if (!config._data?.action) {
+          return stub("organizations.members.accept");
+        }
+        try {
+          const member = await config._data.action(
+            api.org.actions.acceptInvitation,
+            { token: input.token }
+          );
+          return [null, member];
+        } catch (cause) {
+          return [fromConvexError(cause), null];
         }
       },
-      completing_bootstrap: {
-        invoke: {
-          src: "completeBootstrap",
-          input: ({ context }) => ({
-            bootstrapToken: requireBootstrapToken(context),
-            username: requireUsername(context),
-            signerProvider: requireSignerProvider(context)
-          }),
-          onDone: {
-            target: "authenticated",
-            actions: [
-              xstate.assign({
-                session: ({ event }) => event.output.session,
-                account: ({ event }) => event.output.account,
-                username: ({ event }) => event.output.username,
-                safe: ({ event }) => event.output.safe,
-                bootstrapToken: () => null,
-                bootstrapReason: () => null,
-                signerProvider: () => null,
-                email: () => null,
-                error: () => null
-              }),
-              "identifyAndTrack"
-            ]
-          },
-          onError: {
-            target: "bootstrap_required",
-            actions: [
-              xstate.assign({ error: ({ event }) => errorFromEvent2(event) }),
-              "trackFailed"
-            ]
-          }
-        },
-        after: {
-          [FLOW_INVOKE_TIMEOUT_MS]: {
-            target: "bootstrap_required",
-            actions: [
-              xstate.assign({ error: () => timeoutError2("completing_bootstrap") }),
-              "trackTimeoutFailed"
-            ]
-          }
+      updateRole: async (input) => {
+        if (!config._data?.action) {
+          return stub("organizations.members.updateRole");
+        }
+        try {
+          const orgId = input.organizationId.replace(/^org_/, "");
+          const memberId = input.memberId.replace(/^mb_/, "");
+          const member = await config._data.action(
+            api.org.actions.updateMemberRole,
+            {
+              organizationId: orgId,
+              memberId,
+              role: input.role
+            }
+          );
+          return [null, member];
+        } catch (cause) {
+          return [fromConvexError(cause), null];
         }
       },
-      authenticated: {
-        on: {
-          SIGN_OUT: { target: "signing_out" }
+      revoke: async (input) => {
+        if (!config._data?.action) {
+          return stub("organizations.members.revoke");
+        }
+        try {
+          const orgId = input.organizationId.replace(/^org_/, "");
+          const memberId = input.memberId.replace(/^mb_/, "");
+          const member = await config._data.action(
+            api.org.actions.revokeMember,
+            {
+              organizationId: orgId,
+              memberId
+            }
+          );
+          return [null, member];
+        } catch (cause) {
+          return [fromConvexError(cause), null];
         }
       },
-      signing_out: {
-        invoke: {
-          src: "signOut",
-          onDone: {
-            target: "email",
-            actions: [
-              xstate.assign(() => initialContext),
-              "trackSignedOut"
-            ]
-          },
-          onError: {
-            target: "error",
-            actions: xstate.assign({ error: ({ event }) => errorFromEvent2(event) })
-          }
+      remove: async (input) => {
+        if (!config._data?.action) {
+          return stub("organizations.members.remove");
+        }
+        try {
+          const orgId = input.organizationId.replace(/^org_/, "");
+          const memberId = input.memberId.replace(/^mb_/, "");
+          await config._data.action(api.org.actions.removeMember, {
+            organizationId: orgId,
+            memberId
+          });
+          return [null, void 0];
+        } catch (cause) {
+          return [fromConvexError(cause), null];
         }
       },
-      error: {
-        on: {
-          RESET: { target: "email", actions: xstate.assign(() => initialContext) }
+      resend: async (input) => {
+        if (!config._data?.action) {
+          return stub(
+            "organizations.members.resend"
+          );
+        }
+        try {
+          const orgId = input.organizationId.replace(/^org_/, "");
+          const memberId = input.memberId.replace(/^mb_/, "");
+          const result = await config._data.action(
+            api.org.actions.resendInvitation,
+            {
+              organizationId: orgId,
+              memberId
+            }
+          );
+          return [null, result];
+        } catch (cause) {
+          return [fromConvexError(cause), null];
         }
       }
-    }
-  });
-}
-function requireEmail2(context) {
-  if (!context.email) {
-    throw Errors.invalidInput("email", "Auth bootstrap requires an email.");
-  }
-  return context.email;
-}
-function requireCode(context) {
-  if (!context.code) {
-    throw Errors.invalidInput("code", "Auth bootstrap requires an OTP code.");
-  }
-  return context.code;
-}
-function requireBootstrapToken(context) {
-  if (!context.bootstrapToken) {
-    throw Errors.invalidInput(
-      "bootstrapToken",
-      "Auth bootstrap requires a continuation token."
-    );
-  }
-  return context.bootstrapToken;
-}
-function requireUsername(context) {
-  if (!context.username) {
-    throw Errors.invalidInput("username", "Auth bootstrap requires a username.");
-  }
-  return context.username;
+    },
+    apiKeys: createApiKeysClient(),
+    subAccounts: createOrgSubAccountsClient(config),
+    externalAccounts: createOrgExternalAccountsClient(config),
+    balanceLedger: {
+      list: async (input) => {
+        if (!config._data) {
+          return stub(
+            "organizations.balanceLedger.list"
+          );
+        }
+        try {
+          const orgId = input.organizationId.replace(/^org_/, "");
+          const page = await config._data.query(
+            api.balanceLedger.queries.listForOrg,
+            { orgId, limit: input.limit, cursor: input.cursor }
+          );
+          return [null, page];
+        } catch (cause) {
+          return [fromConvexError(cause), null];
+        }
+      },
+      retrieve: async (input) => {
+        if (!config._data) {
+          return stub(
+            "organizations.balanceLedger.retrieve"
+          );
+        }
+        try {
+          const entry = await config._data.query(
+            api.balanceLedger.queries.retrieve,
+            { entryId: input.entryId }
+          );
+          if (!entry) {
+            return [
+              new CapxulError({
+                code: "NOT_FOUND",
+                message: `balance_ledger_entry ${input.entryId} not found`
+              }),
+              null
+            ];
+          }
+          return [null, entry];
+        } catch (cause) {
+          return [fromConvexError(cause), null];
+        }
+      }
+    },
+    payments: createOrgPaymentsClient(),
+    transfers: createOrgTransfersClient(),
+    withdrawals: createOrgWithdrawalsClient(config),
+    documents: createOrgDocumentsClient(config),
+    webhookEndpoints: createWebhookEndpointsClient(),
+    webhookEvents: createWebhookEventsClient()
+  };
 }
-function requireSignerProvider(context) {
-  if (!context.signerProvider) {
-    throw Errors.invalidInput(
-      "signerProvider",
-      "Auth bootstrap requires a signer provider."
+
+// src/core/token-transfers.ts
+var toTokenTransferId = (raw) => {
+  if (typeof raw !== "string" || raw.length === 0) {
+    throw new Error(
+      `Invalid tokenTransferId: expected non-empty string, got ${String(raw)}`
     );
   }
-  return context.signerProvider;
+  return raw;
+};
+function brandRow(row) {
+  return {
+    ...row,
+    id: toTokenTransferId(row.id)
+  };
 }
-function errorFromEvent2(event) {
-  const cause = typeof event === "object" && event !== null && "error" in event ? event.error : event;
-  if (cause instanceof CapxulError || cause instanceof CapxulError2) {
-    return cause;
-  }
-  return Errors.providerError("auth", "bootstrap", cause);
+function createTokenTransfersClient(config = {}) {
+  return {
+    list: async (input) => {
+      if (!config._data) {
+        return stub("tokenTransfers.list");
+      }
+      try {
+        const raw = await config._data.query(
+          api.tokenTransfers.queries.list,
+          {
+            limit: input?.limit,
+            cursor: input?.cursor,
+            direction: input?.direction
+          }
+        );
+        if (!raw) {
+          return [
+            new CapxulError({
+              code: "NOT_AUTHENTICATED",
+              message: "tokenTransfers.list requires an authenticated session."
+            }),
+            null
+          ];
+        }
+        return [
+          null,
+          {
+            object: "list",
+            data: raw.items.map(brandRow),
+            page: {
+              hasMore: raw.hasMore,
+              nextCursor: raw.nextCursor
+            },
+            displayCurrency: raw.displayCurrency
+          }
+        ];
+      } catch (cause) {
+        return [fromConvexError(cause), null];
+      }
+    },
+    retrieve: async (input) => {
+      if (!config._data) {
+        return stub("tokenTransfers.retrieve");
+      }
+      try {
+        const raw = await config._data.query(
+          api.tokenTransfers.queries.getByTxLogIndex,
+          {
+            txHash: input.txHash,
+            logIndex: input.logIndex,
+            chainId: input.chainId
+          }
+        );
+        if (!raw) {
+          return [
+            new CapxulError({
+              code: "NOT_FOUND",
+              message: `tokenTransfer (txHash=${input.txHash}, logIndex=${input.logIndex}) not found or not visible to caller.`,
+              details: {
+                txHash: input.txHash,
+                logIndex: input.logIndex,
+                chainId: input.chainId
+              }
+            }),
+            null
+          ];
+        }
+        return [null, brandRow(raw)];
+      } catch (cause) {
+        return [fromConvexError(cause), null];
+      }
+    }
+  };
 }
-function timeoutError2(state) {
-  return Errors.providerError(
-    "auth",
-    "bootstrap",
-    new Error(`timeout: ${state} exceeded ${FLOW_INVOKE_TIMEOUT_MS}ms`)
-  );
+
+// src/core/virtual-accounts.ts
+function createVirtualAccountsClient() {
+  return {
+    create: async () => stub("virtualAccounts.create"),
+    retrieve: async () => stub("virtualAccounts.retrieve"),
+    list: async () => stub("virtualAccounts.list"),
+    remove: async () => stub("virtualAccounts.remove")
+  };
 }
-function emailDomain2(email) {
-  const domain = email.split("@")[1]?.trim().toLowerCase();
-  return domain || "unknown";
+
+// src/core/virtual-cards.ts
+function createVirtualCardsClient() {
+  return {
+    create: async () => stub("virtualCards.create"),
+    retrieve: async () => stub("virtualCards.retrieve"),
+    list: async () => stub("virtualCards.list"),
+    freeze: async () => stub("virtualCards.freeze"),
+    unfreeze: async () => stub("virtualCards.unfreeze"),
+    cancel: async () => stub("virtualCards.cancel")
+  };
 }
 function createProvisioningMachine(client) {
   return xstate.setup({
@@ -3076,7 +3660,7 @@ function createProvisioningMachine(client) {
         const provider = context.input?.signerProvider;
         if (!provider) return;
         track("provisioning_safe_created", {
-          safe_address: provider.safeAddress
+          safe_address: deriveSafeAddress2(provider.signerAddress)
         });
       }
     }
@@ -3121,13 +3705,13 @@ function createProvisioningMachine(client) {
           },
           onError: {
             target: "error",
-            actions: xstate.assign({ error: ({ event }) => errorFromEvent3(event) })
+            actions: xstate.assign({ error: ({ event }) => errorFromEvent(event) })
           }
         },
         after: {
           [FLOW_INVOKE_TIMEOUT_MS]: {
             target: "error",
-            actions: xstate.assign({ error: () => timeoutError3() })
+            actions: xstate.assign({ error: () => timeoutError() })
           }
         }
       },
@@ -3145,7 +3729,7 @@ function createProvisioningMachine(client) {
      * this payload on its `onDone` transition and branches via guards
      * on `event.output.error`.
      */
-    output: ({ context }) => context.error ? { error: context.error } : context.account ? { account: context.account } : { error: timeoutError3() }
+    output: ({ context }) => context.error ? { error: context.error } : context.account ? { account: context.account } : { error: timeoutError() }
   });
 }
 function requireProvisionInput(context) {
@@ -3157,13 +3741,13 @@ function requireProvisionInput(context) {
   }
   return context.input;
 }
-function errorFromEvent3(event) {
+function errorFromEvent(event) {
   const cause = typeof event === "object" && event !== null && "error" in event ? event.error : event;
   if (cause instanceof CapxulError) return cause;
   if (cause instanceof CapxulError2) return cause;
   return Errors.providerError("provisioning", "flow", cause);
 }
-function timeoutError3() {
+function timeoutError() {
   return Errors.providerError(
     "provisioning",
     "flow",
@@ -3256,7 +3840,7 @@ function createOnboardingFlowMachine(client) {
         error: ({ event }) => extractChildErrorOrFallback(event)
       }),
       assignChildThrown: xstate.assign({
-        error: ({ event }) => errorFromEvent4(event)
+        error: ({ event }) => errorFromEvent2(event)
       }),
       assignAccountFromChild: xstate.assign({
         account: ({ event }) => extractChildAccountOrNull(event)
@@ -3418,7 +4002,7 @@ function extractChildAccountOrNull(event) {
   if (output && "account" in output && output.account) return output.account;
   return null;
 }
-function errorFromEvent4(event) {
+function errorFromEvent2(event) {
   const cause = typeof event === "object" && event !== null && "error" in event ? event.error : event;
   if (cause instanceof CapxulError) return cause;
   if (cause instanceof CapxulError2) return cause;
@@ -3429,7 +4013,7 @@ function errorFromEvent4(event) {
 function createCapxulClient(config = {}) {
   const clientWithoutFlows = {
     id: crypto.randomUUID(),
-    auth: createAuthClient(config),
+    auth: new AuthService(config),
     me: createMeClient(config),
     accounts: createAccountsClient(config),
     organizations: createOrganizationsClient(config),
@@ -3437,8 +4021,8 @@ function createCapxulClient(config = {}) {
     transfers: createTransfersClient(),
     tokenTransfers: createTokenTransfersClient(config),
     withdrawals: createWithdrawalsClient(config),
-    documents: createDocumentsClient(),
-    subAccounts: createSubAccountsClient(),
+    documents: createDocumentsClient(config),
+    subAccounts: createSubAccountsClient(config),
     virtualAccounts: createVirtualAccountsClient(),
     virtualCards: createVirtualCardsClient(),
     externalAccounts: createExternalAccountsClient(config),
@@ -3449,8 +4033,6 @@ function createCapxulClient(config = {}) {
   };
   const client = clientWithoutFlows;
   client.flows = {
-    auth: () => createAuthFlowMachine(client),
-    authBootstrap: () => createAuthBootstrapFlowMachine(client),
     onboarding: () => createOnboardingFlowMachine(client),
     provisioning: () => createProvisioningMachine(client)
   };