@capxul/sdk-react 0.1.0-alpha.9 → 0.2.0-alpha.4

package/dist/index.js

@@ -1,7 +1,7 @@
 "use client";
-import { createContext, useContext, useSyncExternalStore, useMemo, useEffect, useState } from 'react';
-import { makeHttpTransport, createCapxulClient, CapxulError as CapxulError$1 } from '@capxul/sdk';
-import { QueryClient, QueryClientProvider, useQuery } from '@tanstack/react-query';
+import { createContext, useContext, useSyncExternalStore, useMemo, useEffect, useState, useRef, useCallback } from 'react';
+import { makeHttpTransport, createCapxulClient, AuthService, CapxulError as CapxulError$1, SignerProvisioner } from '@capxul/sdk';
+import { QueryClient, QueryClientProvider, useQuery, useMutation } from '@tanstack/react-query';
 import { jsx } from 'react/jsx-runtime';
 import { ConvexReactClient } from 'convex/react';
 import { CapxulError as CapxulError$2 } from '@capxul/sdk/errors';
@@ -10,6 +10,22 @@ import { getAddress } from 'viem';
 import { privateKeyToAccount } from 'viem/accounts';
 
 // src/provider.tsx
+var AuthServiceContext = createContext(null);
+function AuthServiceProvider({
+  authService,
+  children
+}) {
+  return /* @__PURE__ */ jsx(AuthServiceContext.Provider, { value: authService, children });
+}
+function useAuthService() {
+  const authService = useContext(AuthServiceContext);
+  if (!authService) {
+    throw new Error(
+      "useAuthService() was called outside a <CapxulProvider>. Wrap your app in <CapxulProvider config={...}> before rendering hooks from @capxul/sdk-react."
+    );
+  }
+  return authService;
+}
 var CapxulClientContext = createContext(null);
 function CapxulClientProvider({
   client,
@@ -79,10 +95,16 @@ var Errors = {
     `Shield API error (${status}): ${detail}`,
     { details: { provider: "shield", status } }
   ),
-  providerError: (provider, operation, cause) => new CapxulError(
-    "PROVIDER_ERROR",
-    `${provider} ${operation} failed: ${cause instanceof Error ? cause.message : String(cause)}`,
-    { cause, details: { provider, operation } }
+  providerError: (provider, operation, cause) => (
+    // Public `message` is redacted to a fixed shape so provider-side
+    // exception text never leaks to the client. The original `cause`
+    // is preserved on `Error.cause` for server-side debugging via
+    // observability sinks (Sentry, console traces).
+    new CapxulError(
+      "PROVIDER_ERROR",
+      `Provider error: ${provider} ${operation}`,
+      { cause, details: { provider, operation } }
+    )
   ),
   invalidInput: (field, reason) => new CapxulError(
     "INVALID_INPUT",
@@ -147,7 +169,7 @@ function roleKeyFromLabel(label) {
 }
 roleKeyFromLabel("OWNER");
 roleKeyFromLabel("FINANCE_MANAGER");
-roleKeyFromLabel("TEAM_LEAD");
+roleKeyFromLabel("PAYMENTS_OPERATOR");
 
 // src/config.ts
 function createCapxulConfig(input) {
@@ -286,7 +308,7 @@ function CapxulProvider({
     []
   );
   const effectiveClient = queryClient ?? defaultClient;
-  return /* @__PURE__ */ jsx(QueryClientProvider, { client: effectiveClient, children: /* @__PURE__ */ jsx(CapxulTransportProvider, { transport: wiring.transport, children: /* @__PURE__ */ jsx(CapxulClientProvider, { client: wiring.client, children }) }) });
+  return /* @__PURE__ */ jsx(QueryClientProvider, { client: effectiveClient, children: /* @__PURE__ */ jsx(CapxulTransportProvider, { transport: wiring.transport, children: /* @__PURE__ */ jsx(CapxulClientProvider, { client: wiring.client, children: /* @__PURE__ */ jsx(AuthServiceProvider, { authService: wiring.authService, children }) }) }) });
 }
 function buildWiring(config, sessionStore) {
   const validated = createCapxulConfig(config);
@@ -295,7 +317,7 @@ function buildWiring(config, sessionStore) {
   const sdkConfig = {
     _transport: transport,
     publishableKey: validated.mode === "publishable-key" ? validated.publishableKey : void 0,
-    data: dataClient ?? void 0,
+    _data: dataClient ?? void 0,
     auth: validated.mode === "build-time-urls" || validated.mode === "publishable-key" ? {
       // The auth client builds the BetterAuth root URL from this
       // value. Convex's `.cloud` URL is the wrong host (BetterAuth
@@ -305,29 +327,16 @@ function buildWiring(config, sessionStore) {
       // `core/auth.ts`'s `createTransportProvider` short-circuits
       // to the externally-injected `_transport` cache slot.
       baseUrl: transport.authBaseUrl,
-      sessionStore,
-      createDataClient: async (_session) => {
-        dataClient.refreshAuth();
-        return dataClient;
-      }
+      sessionStore
     } : void 0
   };
   const client = createCapxulClient(sdkConfig);
-  if (dataClient) {
-    const originalSignOut = client.auth.signOut;
-    Object.assign(client.auth, {
-      signOut: async () => {
-        const result = await originalSignOut();
-        dataClient.refreshAuth();
-        sdkConfig.data = dataClient;
-        return result;
-      }
-    });
-  }
+  const authService = new AuthService(sdkConfig);
   return {
     client,
     transport,
-    dataClient
+    dataClient,
+    authService
   };
 }
 function createMemorySessionStore() {
@@ -436,11 +445,59 @@ function useAccount(accountId) {
     [capxul, accountId]
   );
 }
-function useOrganization(_organizationId) {
-  return notImplementedQuery("useOrganization");
+function useOrganization(organizationId) {
+  const capxul = useCapxul();
+  return useQuery({
+    queryKey: [capxul.id, "capxul", "organizations", organizationId],
+    queryFn: () => capxul.organizations.retrieve(organizationId).then(([error, data]) => {
+      if (error) {
+        throw error;
+      }
+      return data;
+    }).catch((cause) => {
+      if (cause instanceof CapxulError$1) {
+        throw cause;
+      }
+      throw new CapxulError$1({
+        code: "UNKNOWN",
+        message: "SDK read failed before returning a CapxulResult.",
+        cause
+      });
+    }),
+    staleTime: 3e4
+  });
 }
-function useMember(_args) {
-  return notImplementedQuery("useMember");
+function useMember(args) {
+  const capxul = useCapxul();
+  return useQuery({
+    queryKey: [
+      capxul.id,
+      "capxul",
+      "organizations",
+      args.organizationId,
+      "members",
+      args.memberId
+    ],
+    queryFn: () => capxul.organizations.members.retrieve({
+      organizationId: args.organizationId,
+      memberId: args.memberId
+    }).then(([error, data]) => {
+      if (error) {
+        throw error;
+      }
+      return data;
+    }).catch((cause) => {
+      if (cause instanceof CapxulError$1) {
+        throw cause;
+      }
+      throw new CapxulError$1({
+        code: "UNKNOWN",
+        message: "SDK read failed before returning a CapxulResult.",
+        cause
+      });
+    }),
+    staleTime: 3e4
+  });
 }
 function useSafe(safeId) {
   const capxul = useCapxul();
@@ -449,8 +506,33 @@ function useSafe(safeId) {
     [capxul, safeId]
   );
 }
-function useTreasury(_organizationId) {
-  return notImplementedQuery("useTreasury");
+function useTreasury(organizationId) {
+  const capxul = useCapxul();
+  return useQuery({
+    queryKey: [
+      capxul.id,
+      "capxul",
+      "organizations",
+      organizationId,
+      "treasury"
+    ],
+    queryFn: () => capxul.organizations.treasury.retrieve(organizationId).then(([error, data]) => {
+      if (error) {
+        throw error;
+      }
+      return data;
+    }).catch((cause) => {
+      if (cause instanceof CapxulError$1) {
+        throw cause;
+      }
+      throw new CapxulError$1({
+        code: "UNKNOWN",
+        message: "SDK read failed before returning a CapxulResult.",
+        cause
+      });
+    }),
+    staleTime: 3e4
+  });
 }
 function useApiKey(_args) {
   return notImplementedQuery("useApiKey");
@@ -458,9 +540,6 @@ function useApiKey(_args) {
 function useKycProfile(_accountId) {
   return notImplementedQuery("useKycProfile");
 }
-function useKybProfile(_organizationId) {
-  return notImplementedQuery("useKybProfile");
-}
 function useExternalAccount(args) {
   const capxul = useCapxul();
   return useSdkQuery(
@@ -471,8 +550,12 @@ function useExternalAccount(args) {
     [capxul, args.ownerKind, args.ownerId, args.externalAccountId]
   );
 }
-function useSubAccount(_subAccountId) {
-  return notImplementedQuery("useSubAccount");
+function useSubAccount(subAccountId) {
+  const capxul = useCapxul();
+  return useSdkQuery(
+    () => capxul.subAccounts.retrieve(subAccountId),
+    [capxul, subAccountId]
+  );
 }
 function useVirtualAccount(_virtualAccountId) {
   return notImplementedQuery("useVirtualAccount");
@@ -480,8 +563,27 @@ function useVirtualAccount(_virtualAccountId) {
 function useVirtualCard(_virtualCardId) {
   return notImplementedQuery("useVirtualCard");
 }
-function usePayment(_paymentId) {
-  return notImplementedQuery("usePayment");
+function usePayment(paymentId) {
+  const capxul = useCapxul();
+  return useQuery({
+    queryKey: [capxul.id, "capxul", "payments", paymentId],
+    queryFn: () => capxul.payments.retrieve(paymentId).then(([error, data]) => {
+      if (error) {
+        throw error;
+      }
+      return data;
+    }).catch((cause) => {
+      if (cause instanceof CapxulError$1) {
+        throw cause;
+      }
+      throw new CapxulError$1({
+        code: "UNKNOWN",
+        message: "SDK read failed before returning a CapxulResult.",
+        cause
+      });
+    }),
+    staleTime: 3e4
+  });
 }
 function useTransfer(_transferId) {
   return notImplementedQuery("useTransfer");
@@ -493,25 +595,32 @@ function useTokenTransfer(args) {
     [capxul, args.txHash, args.logIndex, args.chainId]
   );
 }
-function useBalanceLedgerEntry(_args) {
-  return notImplementedQuery("useBalanceLedgerEntry");
+function useBalanceLedgerEntry(args) {
+  const capxul = useCapxul();
+  return useSdkQuery(
+    () => args.ownerKind === "account" ? capxul.accounts.balanceLedger.retrieve(args.entryId) : capxul.organizations.balanceLedger.retrieve({
+      organizationId: args.ownerId,
+      entryId: args.entryId
+    }),
+    [capxul, args.ownerKind, args.ownerId, args.entryId]
+  );
 }
 function useDocument(_documentId) {
   return notImplementedQuery("useDocument");
 }
 function useWithdrawal(withdrawalId) {
   const capxul = useCapxul();
-  return useSdkQuery(() => capxul.withdrawals.retrieve(withdrawalId), [
-    capxul,
-    withdrawalId
-  ]);
+  return useSdkQuery(
+    () => capxul.withdrawals.retrieve(withdrawalId),
+    [capxul, withdrawalId]
+  );
 }
 function useOperation(operationId) {
   const capxul = useCapxul();
-  return useSdkQuery(() => capxul.operations.retrieve(operationId), [
-    capxul,
-    operationId
-  ]);
+  return useSdkQuery(
+    () => capxul.operations.retrieve(operationId),
+    [capxul, operationId]
+  );
 }
 function useWebhookEndpoint(_endpointId) {
   return notImplementedQuery("useWebhookEndpoint");
@@ -519,13 +628,57 @@ function useWebhookEndpoint(_endpointId) {
 function useWebhookEvent(_eventId) {
   return notImplementedQuery("useWebhookEvent");
 }
-
-// src/hooks/list.ts
-function useOrganizations() {
-  return notImplementedQuery("useOrganizations");
+function useOrganizations(filters) {
+  const capxul = useCapxul();
+  return useQuery({
+    queryKey: [capxul.id, "capxul", "organizations", "list", filters],
+    queryFn: () => capxul.organizations.list(filters).then(([error, data]) => {
+      if (error) {
+        throw error;
+      }
+      return data;
+    }).catch((cause) => {
+      if (cause instanceof CapxulError$1) {
+        throw cause;
+      }
+      throw new CapxulError$1({
+        code: "UNKNOWN",
+        message: "SDK read failed before returning a CapxulResult.",
+        cause
+      });
+    }),
+    staleTime: 3e4
+  });
 }
-function useMembers(_organizationId) {
-  return notImplementedQuery("useMembers");
+function useMembers(organizationId, filters) {
+  const capxul = useCapxul();
+  return useQuery({
+    queryKey: [
+      capxul.id,
+      "capxul",
+      "organizations",
+      organizationId,
+      "members",
+      "list",
+      filters?.status
+    ],
+    queryFn: () => capxul.organizations.members.list({ organizationId, status: filters?.status }).then(([error, data]) => {
+      if (error) {
+        throw error;
+      }
+      return data;
+    }).catch((cause) => {
+      if (cause instanceof CapxulError$1) {
+        throw cause;
+      }
+      throw new CapxulError$1({
+        code: "UNKNOWN",
+        message: "SDK read failed before returning a CapxulResult.",
+        cause
+      });
+    }),
+    staleTime: 3e4
+  });
 }
 function useExternalAccounts(args) {
   const capxul = useCapxul();
@@ -536,8 +689,14 @@ function useExternalAccounts(args) {
     [capxul, args.ownerKind, args.ownerId]
   );
 }
-function useSubAccounts(_args) {
-  return notImplementedQuery("useSubAccounts");
+function useSubAccounts(args) {
+  const capxul = useCapxul();
+  return useSdkQuery(
+    () => args.ownerKind === "account" ? capxul.accounts.subAccounts.list({ accountId: args.ownerId }) : capxul.organizations.subAccounts.list({
+      organizationId: args.ownerId
+    }),
+    [capxul, args.ownerKind, args.ownerId]
+  );
 }
 function useVirtualAccounts(_filters) {
   return notImplementedQuery("useVirtualAccounts");
@@ -545,8 +704,27 @@ function useVirtualAccounts(_filters) {
 function useVirtualCards(_filters) {
   return notImplementedQuery("useVirtualCards");
 }
-function usePayments(_filters) {
-  return notImplementedQuery("usePayments");
+function usePayments(filters) {
+  const capxul = useCapxul();
+  return useQuery({
+    queryKey: [capxul.id, "capxul", "payments", "list", filters],
+    queryFn: () => capxul.payments.list(filters).then(([error, data]) => {
+      if (error) {
+        throw error;
+      }
+      return data;
+    }).catch((cause) => {
+      if (cause instanceof CapxulError$1) {
+        throw cause;
+      }
+      throw new CapxulError$1({
+        code: "UNKNOWN",
+        message: "SDK read failed before returning a CapxulResult.",
+        cause
+      });
+    }),
+    staleTime: 3e4
+  });
 }
 function useOrgPayments(_args) {
   return notImplementedQuery("useOrgPayments");
@@ -564,8 +742,34 @@ function useTokenTransfers(filters) {
     [capxul, filters?.limit, filters?.cursor, filters?.direction]
   );
 }
-function useBalanceLedger(_args) {
-  return notImplementedQuery("useBalanceLedger");
+function useBalanceLedger(args) {
+  const capxul = useCapxul();
+  return useSdkQuery(
+    () => args.ownerKind === "account" ? capxul.accounts.balanceLedger.list({
+      accountId: args.ownerId,
+      limit: args.limit,
+      cursor: args.cursor
+    }) : capxul.organizations.balanceLedger.list({
+      organizationId: args.ownerId,
+      limit: args.limit,
+      cursor: args.cursor
+    }),
+    [capxul, args.ownerKind, args.ownerId, args.limit, args.cursor]
+  );
+}
+function useAccountBalanceLedger(accountId, filters) {
+  const capxul = useCapxul();
+  return useSdkQuery(
+    () => capxul.accounts.balanceLedger.list({ accountId, ...filters }),
+    [capxul, accountId, filters?.limit, filters?.cursor]
+  );
+}
+function useOrgBalanceLedger(args) {
+  const capxul = useCapxul();
+  return useSdkQuery(
+    () => capxul.organizations.balanceLedger.list(args),
+    [capxul, args.organizationId, args.limit, args.cursor]
+  );
 }
 function useDocuments(_filters) {
   return notImplementedQuery("useDocuments");
@@ -593,17 +797,337 @@ function useApiKeys(_organizationId) {
 function useWebhookEndpoints() {
   return notImplementedQuery("useWebhookEndpoints");
 }
-function useAuthFlow() {
-  const client = useCapxul();
-  const machine = useMemo(() => client.flows.auth(), [client]);
-  const [snapshot, send] = useActor(machine);
-  return { snapshot, send };
+function useInviteMember() {
+  const capxul = useCapxul();
+  return useMutation({
+    mutationFn: async (args) => {
+      const [error, data] = await capxul.organizations.members.invite(args);
+      if (error) throw error;
+      return data;
+    }
+  });
 }
-function useAuthBootstrapFlow() {
-  const client = useCapxul();
-  const machine = useMemo(() => client.flows.authBootstrap(), [client]);
-  const [snapshot, send] = useActor(machine);
-  return { snapshot, send };
+function useAcceptInvitation() {
+  const capxul = useCapxul();
+  return useMutation({
+    mutationFn: async (args) => {
+      const [error, data] = await capxul.organizations.members.accept(args);
+      if (error) throw error;
+      return data;
+    }
+  });
+}
+function useUpdateMemberRole() {
+  const capxul = useCapxul();
+  return useMutation({
+    mutationFn: async (args) => {
+      const [error, data] = await capxul.organizations.members.updateRole(args);
+      if (error) throw error;
+      return data;
+    }
+  });
+}
+function useRevokeMember() {
+  const capxul = useCapxul();
+  return useMutation({
+    mutationFn: async (args) => {
+      const [error, data] = await capxul.organizations.members.revoke(args);
+      if (error) throw error;
+      return data;
+    }
+  });
+}
+function useRemoveMember() {
+  const capxul = useCapxul();
+  return useMutation({
+    mutationFn: async (args) => {
+      const [error, data] = await capxul.organizations.members.remove(args);
+      if (error) throw error;
+      return data;
+    }
+  });
+}
+function useResendInvitation() {
+  const capxul = useCapxul();
+  return useMutation({
+    mutationFn: async (args) => {
+      const [error, data] = await capxul.organizations.members.resend(args);
+      if (error) throw error;
+      return data;
+    }
+  });
+}
+
+// ../observability/src/debug-log.ts
+function isDevelopmentBuild() {
+  if (typeof process === "undefined") {
+    return false;
+  }
+  return process.env?.NODE_ENV === "development" || process.env?.NODE_ENV === "test";
+}
+function debugLog(line) {
+  if (!isDevelopmentBuild()) return;
+  if (typeof globalThis !== "undefined" && "window" in globalThis && typeof console?.info === "function") {
+    console.info(line);
+    return;
+  }
+  if (typeof process !== "undefined" && typeof process.stderr?.write === "function") {
+    process.stderr.write(`${line}
+`);
+  }
+}
+function formatDebugValue(value) {
+  if (value === void 0 || value === "") return "";
+  if (typeof value === "string") return value;
+  try {
+    return JSON.stringify(value);
+  } catch {
+    return String(value);
+  }
+}
+function track(...args) {
+  const [name, props] = args;
+  debugLog(`[TRACK] ${name} ${formatDebugValue(props ?? "")}`);
+}
+function formatDebugValue2(value) {
+  if (value === void 0 || value === "") return "";
+  if (typeof value === "string") return value;
+  try {
+    return JSON.stringify(value);
+  } catch {
+    return String(value);
+  }
+}
+function identify(userId, traits) {
+  debugLog(`[IDENTIFY] ${userId} ${formatDebugValue2(traits ?? "")}`);
+}
+function resetIdentity() {
+}
+function useAuth(options) {
+  const authService = useAuthService();
+  const signerProvisioner = useMemoizedSignerProvisioner();
+  const injectedSigner = options?.signer;
+  const [state, setState] = useState("idle");
+  const [user, setUser] = useState(null);
+  const [bootstrap, setBootstrap] = useState(
+    null
+  );
+  const bootstrapRef = useRef(null);
+  const [error, setError] = useState(null);
+  const signIn = useCallback(
+    async (email) => {
+      setState("sendingOtp");
+      setError(null);
+      try {
+        await authService.sendOtp(email);
+        track("auth_otp_requested", {
+          email_domain: emailDomain(email)
+        });
+        setState("awaitingOtp");
+      } catch (err) {
+        const wrapped = err instanceof Error ? err : new Error(String(err));
+        trackAuthFailure("otp_request", wrapped);
+        setError(wrapped);
+        setState("error");
+        throw wrapped;
+      }
+    },
+    [authService]
+  );
+  const verifyOtp = useCallback(
+    async (email, otp) => {
+      setState("awaitingOtp");
+      setError(null);
+      try {
+        const result = await authService.verifyOtp(email, otp);
+        if (result.kind === "existing_member") {
+          track("auth_otp_verified", {
+            email_domain: emailDomain(result.session.email),
+            branch: "existing_member"
+          });
+          const nextUser = {
+            account: result.account,
+            username: result.username,
+            safe: result.safe,
+            session: result.session
+          };
+          setUser(nextUser);
+          setBootstrap(null);
+          bootstrapRef.current = null;
+          identify(result.session.authUserId, {
+            auth_branch: "existing_member"
+          });
+          track("auth_session_ready", {
+            branch: "existing_member",
+            has_convex_jwt: typeof result.session.convexJwt === "string"
+          });
+          setState("authenticated");
+          return {
+            kind: "existing_member",
+            session: result.session,
+            user: nextUser
+          };
+        }
+        const nextBootstrap = {
+          bootstrapToken: result.bootstrapToken,
+          email: result.email,
+          reason: result.reason,
+          username: result.username,
+          session: result.session
+        };
+        setUser(null);
+        setBootstrap(nextBootstrap);
+        bootstrapRef.current = nextBootstrap;
+        track("auth_otp_verified", {
+          email_domain: emailDomain(result.session.email),
+          branch: "bootstrap_required"
+        });
+        track("auth_bootstrap_required", {
+          reason: result.reason,
+          has_suggested_username: result.username !== void 0,
+          has_convex_jwt: typeof result.session.convexJwt === "string"
+        });
+        setState("bootstrapRequired");
+        return {
+          kind: "bootstrap_required",
+          session: result.session,
+          bootstrap: nextBootstrap
+        };
+      } catch (err) {
+        const wrapped = err instanceof Error ? err : new Error(String(err));
+        trackAuthFailure("otp_verify", wrapped);
+        setError(wrapped);
+        setState("error");
+        throw wrapped;
+      }
+    },
+    [authService]
+  );
+  const completeBootstrap = useCallback(
+    async (username, signer) => {
+      const pendingBootstrap = bootstrapRef.current;
+      if (!pendingBootstrap) {
+        const missing = new Error(
+          "completeBootstrap requires a prior bootstrap_required OTP result."
+        );
+        track("auth_session_lost", { step: "complete_bootstrap" });
+        setError(missing);
+        setState("error");
+        throw missing;
+      }
+      setError(null);
+      track("auth_username_submitted", {
+        has_suggested_username: pendingBootstrap.username !== void 0
+      });
+      setState("provisioningSigner");
+      try {
+        const signerKind = signer ? "provided" : injectedSigner ? "configured" : "generated";
+        const selectedSigner = signer ?? injectedSigner ?? signerProvisioner.provision().signer;
+        track("auth_signer_provisioned", { signer_kind: signerKind });
+        setState("bootstrapping");
+        const bootstrapResult = await authService.completeBootstrap(
+          {
+            bootstrapToken: pendingBootstrap.bootstrapToken,
+            username
+          },
+          selectedSigner
+        );
+        const nextUser = {
+          account: bootstrapResult.account,
+          username: bootstrapResult.username,
+          safe: bootstrapResult.safe,
+          session: bootstrapResult.session
+        };
+        track("auth_safe_provisioned", {
+          safe_status: bootstrapResult.safe.status
+        });
+        setUser(nextUser);
+        setBootstrap(null);
+        bootstrapRef.current = null;
+        identify(bootstrapResult.session.authUserId, {
+          auth_branch: "bootstrap_required"
+        });
+        track("auth_bootstrap_completed", {
+          reason: pendingBootstrap.reason
+        });
+        track("auth_session_ready", {
+          branch: "bootstrap_required",
+          has_convex_jwt: typeof bootstrapResult.session.convexJwt === "string"
+        });
+        setState("authenticated");
+        return nextUser;
+      } catch (err) {
+        const wrapped = err instanceof Error ? err : new Error(String(err));
+        trackAuthFailure("complete_bootstrap", wrapped);
+        setError(wrapped);
+        setState("error");
+        throw wrapped;
+      }
+    },
+    [authService, injectedSigner, signerProvisioner]
+  );
+  const signOut = useCallback(async () => {
+    setError(null);
+    try {
+      await authService.signOut();
+      track("auth_signed_out");
+      resetIdentity();
+      setUser(null);
+      setBootstrap(null);
+      bootstrapRef.current = null;
+      setState("idle");
+    } catch (err) {
+      const wrapped = err instanceof Error ? err : new Error(String(err));
+      trackAuthFailure("sign_out", wrapped);
+      setError(wrapped);
+      setState("error");
+      throw wrapped;
+    }
+  }, [authService]);
+  return useMemo(
+    () => ({
+      state,
+      user,
+      bootstrap,
+      error,
+      signIn,
+      verifyOtp,
+      completeBootstrap,
+      signOut
+    }),
+    [
+      state,
+      user,
+      bootstrap,
+      error,
+      signIn,
+      verifyOtp,
+      completeBootstrap,
+      signOut
+    ]
+  );
+}
+function useMemoizedSignerProvisioner() {
+  const [provisioner] = useState(() => new SignerProvisioner());
+  return provisioner;
+}
+function emailDomain(email) {
+  const domain = email.split("@")[1]?.trim().toLowerCase();
+  return domain && /^[a-z0-9.-]+$/.test(domain) ? domain : "unknown";
+}
+function trackAuthFailure(step, error) {
+  const reason = errorCode(error);
+  if (reason === "PERMISSION_DENIED" || reason === "AUTHZ_DENIED") {
+    track("authz_denied", { step, reason });
+  }
+  track("auth_failed", {
+    step,
+    reason
+  });
+}
+function errorCode(error) {
+  const code = error.code;
+  return typeof code === "string" && code.length > 0 ? code : error.name || "Error";
 }
 function useOnboardingFlow() {
   const client = useCapxul();
@@ -658,10 +1182,6 @@ function localPrivateKeyConnector(options) {
       "must be a 0x-prefixed 32-byte (64 hex chars) string."
     );
   }
-  const safeAddress = validateAndNormalizeEvmAddress(
-    "safeAddress",
-    options.safeAddress
-  );
   const id = options.id ?? "local-private-key";
   return {
     id,
@@ -673,13 +1193,7 @@ function localPrivateKeyConnector(options) {
       return {
         connectorId: id,
         connectorKind: "local-private-key",
-        signerAddress: account.address,
-        safeAddress,
-        signerProvider: {
-          kind: "local-private-key",
-          signerAddress: account.address,
-          safeAddress
-        }
+        signerAddress: account.address
       };
     }
   };
@@ -713,4 +1227,4 @@ function validateAndNormalizeEvmAddress(field, raw) {
   }
 }
 
-export { CapxulClientProvider, CapxulProvider, CapxulTransportProvider, createCapxulConfig, injectedConnector, localPrivateKeyConnector, useAccount, useApiKey, useApiKeys, useAuthBootstrapFlow, useAuthFlow, useBalanceLedger, useBalanceLedgerEntry, useCapxul, useCapxulStatus, useDocument, useDocuments, useExternalAccount, useExternalAccounts, useKybProfile, useKycProfile, useMe, useMember, useMembers, useOnboardingFlow, useOperation, useOrgDocuments, useOrgPayments, useOrgTransfers, useOrgWithdrawals, useOrganization, useOrganizations, usePayment, usePayments, useProvisioningFlow, useSafe, useSubAccount, useSubAccounts, useTokenTransfer, useTokenTransfers, useTransfer, useTransfers, useTreasury, useVirtualAccount, useVirtualAccounts, useVirtualCard, useVirtualCards, useWebhookEndpoint, useWebhookEndpoints, useWebhookEvent, useWithdrawal, useWithdrawals };
+export { CapxulClientProvider, CapxulProvider, CapxulTransportProvider, createCapxulConfig, injectedConnector, localPrivateKeyConnector, useAcceptInvitation, useAccount, useAccountBalanceLedger, useApiKey, useApiKeys, useAuth, useBalanceLedger, useBalanceLedgerEntry, useCapxul, useCapxulStatus, useDocument, useDocuments, useExternalAccount, useExternalAccounts, useInviteMember, useKycProfile, useMe, useMember, useMembers, useOnboardingFlow, useOperation, useOrgBalanceLedger, useOrgDocuments, useOrgPayments, useOrgTransfers, useOrgWithdrawals, useOrganization, useOrganizations, usePayment, usePayments, useProvisioningFlow, useRemoveMember, useResendInvitation, useRevokeMember, useSafe, useSubAccount, useSubAccounts, useTokenTransfer, useTokenTransfers, useTransfer, useTransfers, useTreasury, useUpdateMemberRole, useVirtualAccount, useVirtualAccounts, useVirtualCard, useVirtualCards, useWebhookEndpoint, useWebhookEndpoints, useWebhookEvent, useWithdrawal, useWithdrawals };