@capxul/sdk 0.2.0-alpha.3 → 0.2.0-alpha.4

package/dist/client.js

@@ -1,9 +1,8 @@
 import { componentsGeneric, anyApi } from 'convex/server';
 import { toSafeSmartAccount } from 'permissionless/accounts';
-import { getAddress, parseUnits, createPublicClient, http, encodeFunctionData } from 'viem';
+import { getAddress, parseUnits, encodeFunctionData, encodePacked, keccak256, getContractAddress, createPublicClient, http } from 'viem';
 import { entryPoint07Address, createPaymasterClient, createBundlerClient } from 'viem/account-abstraction';
 import { baseSepolia } from 'viem/chains';
-import { deriveSafeAddress as deriveSafeAddress$1, defaultSafeDeriveConfig } from '@repo/safe-derive';
 import { ConvexHttpClient } from 'convex/browser';
 import { setup, fromPromise, assign } from 'xstate';
 
@@ -109,18 +108,6 @@ function track(...args) {
   const [name, props] = args;
   debugLog(`[TRACK] ${name} ${formatDebugValue(props ?? "")}`);
 }
-function formatDebugValue2(value) {
-  if (value === void 0 || value === "") return "";
-  if (typeof value === "string") return value;
-  try {
-    return JSON.stringify(value);
-  } catch {
-    return String(value);
-  }
-}
-function identify(userId, traits) {
-  debugLog(`[IDENTIFY] ${userId} ${formatDebugValue2(traits ?? "")}`);
-}
 
 // ../config/src/chain.ts
 var CAPXUL_PAYMENTS_ADDRESS = "0xe740ea65521edc9bef0ea75d30b5334711db99f4";
@@ -230,6 +217,7 @@ var SAFE_PROXY_FACTORY = "0x4e1dcf7ad4e460cfd30791ccc4f9c8a4f820ec67";
 var SAFE_L2_SINGLETON = "0x29fcb43b46531bca003ddc8fcb67ffe91900c762";
 var SAFE_MODULE_SETUP = "0x2dd68b007b46fbe91b9a7c3eda5a7a1063cb5b47";
 var SAFE_4337_MODULE = "0x75cf11467937ce3f2f357ce24ffc3dbf8fd5c226";
+var MULTI_SEND = "0x38869bf66a61cf6bdb996a6ae40d5853fd43b526";
 
 // ../config/src/org-roles.ts
 function roleKeyFromLabel(label) {
@@ -240,6 +228,117 @@ function roleKeyFromLabel(label) {
 roleKeyFromLabel("OWNER");
 roleKeyFromLabel("FINANCE_MANAGER");
 roleKeyFromLabel("PAYMENTS_OPERATOR");
+var defaultSafeDeriveConfig = {
+  safeProxyFactory: SAFE_PROXY_FACTORY,
+  safeL2Singleton: SAFE_L2_SINGLETON,
+  safeModuleSetup: SAFE_MODULE_SETUP,
+  safe4337Module: SAFE_4337_MODULE,
+  multiSend: MULTI_SEND
+};
+var SAFE_PROXY_CREATION_CODE = "0x608060405234801561001057600080fd5b506040516101e63803806101e68339818101604052602081101561003357600080fd5b8101908080519060200190929190505050600073ffffffffffffffffffffffffffffffffffffffff168173ffffffffffffffffffffffffffffffffffffffff1614156100ca576040517f08c379a00000000000000000000000000000000000000000000000000000000081526004018080602001828103825260228152602001806101c46022913960400191505060405180910390fd5b806000806101000a81548173ffffffffffffffffffffffffffffffffffffffff021916908373ffffffffffffffffffffffffffffffffffffffff1602179055505060ab806101196000396000f3fe608060405273ffffffffffffffffffffffffffffffffffffffff600054167fa619486e0000000000000000000000000000000000000000000000000000000060003514156050578060005260206000f35b3660008037600080366000845af43d6000803e60008114156070573d6000fd5b3d6000f3fea264697066735822122003d1488ee65e08fa41e58e888a9865554c535f2c77126a82cb4c0f917f31441364736f6c63430007060033496e76616c69642073696e676c65746f6e20616464726573732070726f7669646564";
+var enableModulesAbi = [
+  {
+    type: "function",
+    name: "enableModules",
+    inputs: [{ type: "address[]", name: "modules" }],
+    outputs: [],
+    stateMutability: "nonpayable"
+  }
+];
+var multiSendAbi = [
+  {
+    type: "function",
+    name: "multiSend",
+    inputs: [{ type: "bytes", name: "transactions" }],
+    outputs: [],
+    stateMutability: "payable"
+  }
+];
+var setupAbi = [
+  {
+    type: "function",
+    name: "setup",
+    inputs: [
+      { type: "address[]", name: "owners" },
+      { type: "uint256", name: "threshold" },
+      { type: "address", name: "to" },
+      { type: "bytes", name: "data" },
+      { type: "address", name: "fallbackHandler" },
+      { type: "address", name: "paymentToken" },
+      { type: "uint256", name: "payment" },
+      { type: "address", name: "paymentReceiver" }
+    ],
+    outputs: [],
+    stateMutability: "nonpayable"
+  }
+];
+function encodeInternalTransaction(tx) {
+  const encoded = encodePacked(
+    ["uint8", "address", "uint256", "uint256", "bytes"],
+    [
+      tx.operation,
+      tx.to,
+      tx.value,
+      BigInt(tx.data.slice(2).length / 2),
+      tx.data
+    ]
+  );
+  return encoded.slice(2);
+}
+function computeSaltNonce(ownerAddress) {
+  return BigInt(`0x${ownerAddress.toLowerCase().slice(2).padEnd(64, "0")}`);
+}
+function deriveSafeAddress(signerAddress, config = defaultSafeDeriveConfig) {
+  const saltNonce = computeSaltNonce(signerAddress);
+  const enableModulesData = encodeFunctionData({
+    abi: enableModulesAbi,
+    functionName: "enableModules",
+    args: [[config.safe4337Module]]
+  });
+  const innerTx = encodeInternalTransaction({
+    operation: 1,
+    to: config.safeModuleSetup,
+    value: 0n,
+    data: enableModulesData
+  });
+  const multiSendCallData = encodeFunctionData({
+    abi: multiSendAbi,
+    functionName: "multiSend",
+    args: [`0x${innerTx}`]
+  });
+  const initializer = encodeFunctionData({
+    abi: setupAbi,
+    functionName: "setup",
+    args: [
+      [signerAddress],
+      1n,
+      config.multiSend,
+      multiSendCallData,
+      config.safe4337Module,
+      "0x0000000000000000000000000000000000000000",
+      0n,
+      "0x0000000000000000000000000000000000000000"
+    ]
+  });
+  const deploymentCode = encodePacked(
+    ["bytes", "uint256"],
+    [SAFE_PROXY_CREATION_CODE, BigInt(config.safeL2Singleton)]
+  );
+  const salt = keccak256(
+    encodePacked(
+      ["bytes32", "uint256"],
+      [keccak256(encodePacked(["bytes"], [initializer])), saltNonce]
+    )
+  );
+  return getContractAddress({
+    from: config.safeProxyFactory,
+    salt,
+    bytecode: deploymentCode,
+    opcode: "CREATE2"
+  });
+}
+
+// src/internal/safe/account.ts
 async function buildSafeAccount(signer, chain) {
   try {
     const publicClient = createPublicClient({
@@ -251,7 +350,7 @@ async function buildSafeAccount(signer, chain) {
       entryPoint: { address: entryPoint07Address, version: "0.7" },
       version: "1.4.1",
       owners: [signer],
-      saltNonce: computeSaltNonce(signer.address),
+      saltNonce: computeSaltNonce2(signer.address),
       safeSingletonAddress: SAFE_L2_SINGLETON,
       safeProxyFactoryAddress: SAFE_PROXY_FACTORY,
       safeModuleSetupAddress: SAFE_MODULE_SETUP,
@@ -268,11 +367,11 @@ async function buildSafeAccount(signer, chain) {
     });
   }
 }
-function computeSaltNonce(ownerAddress) {
+function computeSaltNonce2(ownerAddress) {
   return BigInt(`0x${ownerAddress.toLowerCase().slice(2).padEnd(64, "0")}`);
 }
-function deriveSafeAddress(signerAddress) {
-  return deriveSafeAddress$1(signerAddress, defaultSafeDeriveConfig);
+function deriveSafeAddress2(signerAddress) {
+  return deriveSafeAddress(signerAddress, defaultSafeDeriveConfig);
 }
 
 // ../platform-kernel/src/ids.ts
@@ -928,7 +1027,7 @@ function createAccountsClient(config = {}) {
             username: input.username,
             countryCode: input.countryCode,
             eoaAddress: input.signerProvider.signerAddress,
-            safeAddress: deriveSafeAddress(input.signerProvider.signerAddress)
+            safeAddress: deriveSafeAddress2(input.signerProvider.signerAddress)
           }
         );
         const account = await config._data.query(
@@ -1514,8 +1613,17 @@ function createAuthClient(config = {}) {
         ];
       }
       try {
-        const safeAddress = deriveSafeAddress(signerAddress);
-        const result = await data.mutation(api.authBootstrap.completeBootstrap, {
+        const safeAddress = deriveSafeAddress2(signerAddress);
+        if (!data.action) {
+          return [
+            new CapxulError({
+              code: "INVALID_INPUT",
+              message: "completeBootstrap requires a data client that can execute Convex actions."
+            }),
+            null
+          ];
+        }
+        const result = await data.action(api.authBootstrap.completeBootstrap, {
           bootstrapToken: input.bootstrapToken,
           sessionToken: session.token,
           username: input.username,
@@ -1698,16 +1806,227 @@ function mutableConfig(config) {
   return config;
 }
 
+// src/core/auth-service.ts
+var AuthService = class {
+  authClient;
+  sessionStore;
+  config;
+  constructor(config = {}) {
+    this.config = config;
+    this.sessionStore = config.auth?.sessionStore ?? createMemorySessionStore2();
+    this.authClient = createAuthClient({
+      ...config,
+      auth: { ...config.auth, sessionStore: this.sessionStore }
+    });
+  }
+  async sendOtp(email, options) {
+    const [err] = await this.authClient.sendOtp({ email }, options);
+    if (err) throw err;
+  }
+  async verifyOtp(email, otp, options) {
+    const [err, result] = await this.authClient.verifyOtp(
+      { email, otp },
+      options
+    );
+    if (err) throw err;
+    return result;
+  }
+  async completeBootstrap(params, signer) {
+    if (signer) {
+      const tempClient = createAuthClient({
+        ...this.config,
+        signer,
+        auth: { ...this.config.auth, sessionStore: this.sessionStore }
+      });
+      const [err2, result2] = await tempClient.completeBootstrap(params);
+      if (err2) throw err2;
+      return result2;
+    }
+    const [err, result] = await this.authClient.completeBootstrap(params);
+    if (err) throw err;
+    return result;
+  }
+  /**
+   * Clears the persisted session and, when a transport was pre-injected,
+   * drops the cached auth header.
+   *
+   * **Transport safety note:** `clearAuth()` is only invoked when
+   * `config._transport` was supplied at construction (e.g. by the React
+   * provider). If `AuthService` is instantiated directly in a Node/CLI
+   * context without an injected transport, the transport-side auth cache
+   * is the caller's responsibility.
+   */
+  async signOut() {
+    if (!this.config._transport) {
+      const [err] = await this.authClient.signOut();
+      if (err) throw err;
+      mutableConfig2(this.config)._data = void 0;
+      return;
+    }
+    this.sessionStore.clear();
+    this.config._transport.clearAuth();
+  }
+  async getSession() {
+    const [err, session] = await this.authClient.getSession();
+    if (err) throw err;
+    return session;
+  }
+};
+function mutableConfig2(config) {
+  return config;
+}
+function createMemorySessionStore2() {
+  let current = null;
+  return {
+    get: () => current,
+    set: (session) => {
+      current = session;
+    },
+    clear: () => {
+      current = null;
+    }
+  };
+}
+
 // src/core/documents.ts
-function createDocumentsClient() {
+function requireInvoiceHash(row) {
+  if (!row.invoiceHash) {
+    throw new CapxulError({
+      code: "INVALID_INPUT",
+      message: `invoice document ${row.documentId ?? row._id} is missing its canonical invoiceHash`
+    });
+  }
+  return row.invoiceHash;
+}
+function mapInvoiceRow(row) {
+  const status = row.status === "cancelled" ? "canceled" : row.status === "pending" ? "open" : row.status === "overdue" ? "expired" : row.status;
   return {
-    create: async () => stub("documents.create"),
-    retrieve: async () => stub("documents.retrieve"),
-    list: async () => stub("documents.list"),
-    cancel: async () => stub("documents.cancel")
+    object: "document",
+    id: row.documentId ?? row._id,
+    type: "invoice",
+    owner: {
+      kind: row.scope === "org" ? "organization" : "account",
+      id: row.orgId ?? row.payeeEmail ?? row.payeeLabel
+    },
+    recipient: { email: row.payerEmail },
+    amount: {
+      value: row.amount,
+      currency: row.currency
+    },
+    reference: row.note,
+    lineItems: row.items,
+    invoiceHash: requireInvoiceHash(row),
+    dueAt: row.dueDate,
+    status,
+    createdAt: new Date(row.createdAt).toISOString()
   };
 }
-function createOrgDocumentsClient() {
+function mapDocumentError(cause) {
+  return fromConvexError(cause);
+}
+function createDocumentsClient(config = {}) {
+  return {
+    create: async (input) => {
+      if (!config._data) return stub("documents.create");
+      if (input.type !== "invoice") {
+        return [
+          new CapxulError({
+            code: "INVALID_INPUT",
+            message: "documents.create currently supports personal invoice documents only."
+          }),
+          null
+        ];
+      }
+      if (!("email" in input.recipient)) {
+        return [
+          new CapxulError({
+            code: "INVALID_INPUT",
+            message: "personal invoice documents currently require an email recipient."
+          }),
+          null
+        ];
+      }
+      try {
+        const created = await config._data.mutation(
+          api.paymentRecords.mutations.createInvoice,
+          {
+            scope: "personal",
+            payerEmail: input.recipient.email,
+            amount: input.amount.value,
+            currency: input.amount.currency,
+            dueDate: input.dueAt ?? (/* @__PURE__ */ new Date()).toISOString(),
+            note: input.reference,
+            items: input.lineItems
+          }
+        );
+        const row = await config._data.query(
+          api.paymentRecords.queries.getInvoiceByDocumentId,
+          { documentId: created.documentId }
+        );
+        if (!row) throw new Error("created invoice was not readable");
+        return [null, mapInvoiceRow(row)];
+      } catch (cause) {
+        return [mapDocumentError(cause), null];
+      }
+    },
+    retrieve: async (documentId) => {
+      if (!config._data)
+        return stub("documents.retrieve");
+      try {
+        const row = await config._data.query(
+          api.paymentRecords.queries.getInvoiceByDocumentId,
+          { documentId }
+        );
+        if (!row) {
+          return [
+            new CapxulError({
+              code: "NOT_FOUND",
+              message: `document ${documentId} not found`
+            }),
+            null
+          ];
+        }
+        return [null, mapInvoiceRow(row)];
+      } catch (cause) {
+        return [mapDocumentError(cause), null];
+      }
+    },
+    list: async (input = {}) => {
+      if (!config._data)
+        return stub("documents.list");
+      try {
+        if (input.type && input.type !== "invoice") {
+          return [null, { object: "list", data: [], page: { hasMore: false } }];
+        }
+        const rows = await config._data.query(
+          api.paymentRecords.queries.listMyInvoices,
+          {
+            limit: input.limit,
+            cursor: input.cursor
+          }
+        );
+        const page = rows;
+        const data = page.data.map((row) => mapInvoiceRow(row));
+        return [null, { object: "list", data, page: page.page }];
+      } catch (cause) {
+        return [mapDocumentError(cause), null];
+      }
+    },
+    cancel: async (documentId) => {
+      if (!config._data) return stub("documents.cancel");
+      try {
+        const row = await config._data.mutation(
+          api.paymentRecords.mutations.cancelInvoice,
+          { documentId }
+        );
+        return [null, mapInvoiceRow(row)];
+      } catch (cause) {
+        return [mapDocumentError(cause), null];
+      }
+    }
+  };
+}
+function createOrgDocumentsClient(_config = {}) {
   return {
     create: async () => stub("organizations.documents.create"),
     retrieve: async () => stub("organizations.documents.retrieve"),
@@ -3035,7 +3354,9 @@ function createOrganizationsClient(config = {}) {
       },
       invite: async (input) => {
         if (!config._data?.action) {
-          return stub("organizations.members.invite");
+          return stub(
+            "organizations.members.invite"
+          );
         }
         try {
           const orgId = input.organizationId.replace(/^org_/, "");
@@ -3123,7 +3444,9 @@ function createOrganizationsClient(config = {}) {
       },
       resend: async (input) => {
         if (!config._data?.action) {
-          return stub("organizations.members.resend");
+          return stub(
+            "organizations.members.resend"
+          );
         }
         try {
           const orgId = input.organizationId.replace(/^org_/, "");
@@ -3191,7 +3514,7 @@ function createOrganizationsClient(config = {}) {
     payments: createOrgPaymentsClient(),
     transfers: createOrgTransfersClient(),
     withdrawals: createOrgWithdrawalsClient(config),
-    documents: createOrgDocumentsClient(),
+    documents: createOrgDocumentsClient(config),
     webhookEndpoints: createWebhookEndpointsClient(),
     webhookEvents: createWebhookEventsClient()
   };
@@ -3308,609 +3631,6 @@ function createVirtualCardsClient() {
     cancel: async () => stub("virtualCards.cancel")
   };
 }
-function createAuthFlowMachine(client) {
-  return setup({
-    types: {},
-    actors: {
-      // XState v5's `fromPromise` injects an `AbortSignal` that aborts
-      // when the actor is stopped (parent transition fires, machine is
-      // disposed, etc.). Plumbing it through `client.auth.sendOtp` /
-      // `client.auth.verifyOtp` makes the in-flight HTTP request
-      // cancellable: stale responses can't race a state machine
-      // that's already moved on. See PR #406 S5.
-      sendOtp: fromPromise(async ({ input, signal }) => {
-        const [error] = await client.auth.sendOtp(
-          { email: input.email },
-          { signal }
-        );
-        if (error) throw error;
-      }),
-      verifyOtp: fromPromise(
-        async ({ input, signal }) => {
-          const [error, result] = await client.auth.verifyOtp(
-            {
-              email: input.email,
-              otp: input.code
-            },
-            { signal }
-          );
-          if (error) throw error;
-          if (result.kind === "bootstrap_required") {
-            throw new CapxulError({
-              code: "ACTION_REQUIRED",
-              message: "OTP verified but auth bootstrap is required. Use createAuthBootstrapFlowMachine for product sign-up.",
-              details: { reason: result.reason }
-            });
-          }
-          return result.session;
-        }
-      ),
-      signOut: fromPromise(async () => {
-        const [error] = await client.auth.signOut();
-        if (error) throw error;
-      })
-    },
-    actions: {
-      trackOtpRequested: ({ context }) => {
-        if (!context.email) return;
-        track("auth_otp_requested", {
-          email_domain: emailDomain(context.email)
-        });
-      },
-      trackOtpFailed: ({ event }) => {
-        const error = errorFromEvent(event);
-        track("auth_failed", {
-          auth_type: "email_otp",
-          reason: error.code
-        });
-      },
-      trackTimeoutFailed: () => {
-        track("auth_failed", {
-          auth_type: "email_otp",
-          reason: "timeout"
-        });
-      },
-      trackVerified: () => {
-        track("auth_verified", { auth_type: "email_otp" });
-      },
-      identifyAndTrack: ({ context }) => {
-        if (!context.session) return;
-        identify(context.session.authUserId, {
-          email_domain: emailDomain(context.session.email)
-        });
-        track("auth_identified", {
-          email_domain: emailDomain(context.session.email)
-        });
-      },
-      trackSignedOut: () => {
-        track("auth_signed_out");
-      }
-    }
-  }).createMachine({
-    id: "auth",
-    initial: "idle",
-    context: { email: null, session: null, error: null },
-    states: {
-      idle: {
-        on: {
-          REQUEST_OTP: {
-            target: "sending_otp",
-            actions: assign({
-              email: ({ event }) => event.email,
-              error: () => null
-            })
-          }
-        }
-      },
-      sending_otp: {
-        invoke: {
-          src: "sendOtp",
-          input: ({ context }) => ({ email: requireEmail(context) }),
-          onDone: {
-            target: "otp_requested",
-            actions: ["trackOtpRequested"]
-          },
-          onError: {
-            target: "error",
-            actions: [
-              assign({ error: ({ event }) => errorFromEvent(event) }),
-              "trackOtpFailed"
-            ]
-          }
-        },
-        after: {
-          [FLOW_INVOKE_TIMEOUT_MS]: {
-            target: "error",
-            actions: [
-              assign({
-                error: () => timeoutError("sending_otp")
-              }),
-              "trackTimeoutFailed"
-            ]
-          }
-        }
-      },
-      otp_requested: {
-        on: {
-          VERIFY: { target: "verifying" },
-          RESET: {
-            target: "idle",
-            actions: assign({ email: () => null, error: () => null })
-          }
-        }
-      },
-      verifying: {
-        invoke: {
-          src: "verifyOtp",
-          input: ({ context, event }) => ({
-            email: requireEmail(context),
-            code: requireCodeFromEvent(event)
-          }),
-          onDone: {
-            target: "authenticated",
-            actions: [
-              // Scrub the duplicate `context.email` (input value
-              // captured during sendOtp) since the verified
-              // `session.email` is now the canonical source
-              // post-authentication. The session's email is
-              // intentionally retained — it's the auth result, not
-              // lingering input. See PR #406 S2.
-              assign({
-                session: ({ event }) => event.output,
-                email: () => null
-              }),
-              "trackVerified",
-              "identifyAndTrack"
-            ]
-          },
-          onError: {
-            target: "error",
-            actions: [
-              assign({ error: ({ event }) => errorFromEvent(event) }),
-              "trackOtpFailed"
-            ]
-          }
-        },
-        after: {
-          [FLOW_INVOKE_TIMEOUT_MS]: {
-            target: "error",
-            actions: [
-              assign({
-                error: () => timeoutError("verifying")
-              }),
-              "trackTimeoutFailed"
-            ]
-          }
-        }
-      },
-      authenticated: {
-        on: {
-          SIGN_OUT: { target: "signing_out" }
-        }
-      },
-      signing_out: {
-        invoke: {
-          src: "signOut",
-          onDone: {
-            target: "idle",
-            actions: [
-              assign({
-                session: () => null,
-                email: () => null,
-                error: () => null
-              }),
-              "trackSignedOut"
-            ]
-          },
-          onError: {
-            target: "error",
-            actions: assign({ error: ({ event }) => errorFromEvent(event) })
-          }
-        }
-      },
-      error: {
-        on: {
-          RESET: {
-            target: "idle",
-            actions: assign({ error: () => null })
-          }
-        }
-      }
-    }
-  });
-}
-function requireEmail(context) {
-  if (!context.email) {
-    throw Errors.invalidInput(
-      "email",
-      "Auth flow advanced without an email captured in context."
-    );
-  }
-  return context.email;
-}
-function requireCodeFromEvent(event) {
-  if (event.type !== "VERIFY") {
-    throw Errors.invalidInput(
-      "code",
-      `Auth flow's verifying state requires a VERIFY event, got ${event.type}.`
-    );
-  }
-  return event.code;
-}
-function errorFromEvent(event) {
-  const cause = typeof event === "object" && event !== null && "error" in event ? event.error : event;
-  if (cause instanceof CapxulError) {
-    if (!EMAIL_MATCH_PATTERN.test(cause.message)) return cause;
-    return new CapxulError({
-      code: cause.code,
-      message: redactEmail(cause.message),
-      cause,
-      details: cause.details,
-      operationId: cause.operationId,
-      correlationId: cause.correlationId,
-      retryable: cause.retryable
-    });
-  }
-  if (cause instanceof CapxulError2) {
-    if (!EMAIL_MATCH_PATTERN.test(cause.message)) return cause;
-    return new CapxulError2(cause.code, redactEmail(cause.message), {
-      cause,
-      details: cause.details,
-      correlationId: cause.correlationId,
-      layer: cause.layer
-    });
-  }
-  return Errors.providerError("auth", "flow", redactCauseEmail(cause));
-}
-var EMAIL_MATCH_PATTERN = /[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}/;
-var EMAIL_REDACT_PATTERN = /[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}/g;
-function redactEmail(message) {
-  return message.replace(EMAIL_REDACT_PATTERN, "<redacted>");
-}
-function redactCauseEmail(cause) {
-  if (cause instanceof Error) {
-    if (!EMAIL_MATCH_PATTERN.test(cause.message)) return cause;
-    const redacted = new Error(redactEmail(cause.message));
-    redacted.cause = cause;
-    return redacted;
-  }
-  if (typeof cause === "string") {
-    return redactEmail(cause);
-  }
-  return cause;
-}
-function timeoutError(state) {
-  return Errors.providerError(
-    "auth",
-    "flow",
-    new Error(`timeout: ${state} exceeded ${FLOW_INVOKE_TIMEOUT_MS}ms`)
-  );
-}
-function emailDomain(email) {
-  const domain = email.split("@")[1]?.trim().toLowerCase();
-  return domain || "unknown";
-}
-var initialContext = {
-  email: null,
-  code: null,
-  username: null,
-  bootstrapToken: null,
-  bootstrapReason: null,
-  session: null,
-  account: null,
-  safe: null,
-  error: null
-};
-function createAuthBootstrapFlowMachine(client) {
-  return setup({
-    types: {},
-    actors: {
-      sendOtp: fromPromise(async ({ input, signal }) => {
-        const [error] = await client.auth.sendOtp(
-          { email: input.email },
-          { signal }
-        );
-        if (error) throw error;
-      }),
-      verifyOtp: fromPromise(
-        async ({ input, signal }) => {
-          const [error, result] = await client.auth.verifyOtp(
-            { email: input.email, otp: input.code },
-            { signal }
-          );
-          if (error) throw error;
-          return result;
-        }
-      ),
-      completeBootstrap: fromPromise(async ({ input }) => {
-        const [error, result] = await client.auth.completeBootstrap(input);
-        if (error) throw error;
-        return result;
-      }),
-      signOut: fromPromise(async () => {
-        const [error] = await client.auth.signOut();
-        if (error) throw error;
-      })
-    },
-    actions: {
-      trackOtpRequested: ({ context }) => {
-        if (!context.email) return;
-        track("auth_otp_requested", {
-          email_domain: emailDomain2(context.email)
-        });
-      },
-      trackFailed: ({ event }) => {
-        track("auth_failed", {
-          auth_type: "email_otp",
-          reason: errorFromEvent2(event).code
-        });
-      },
-      trackTimeoutFailed: () => {
-        track("auth_failed", {
-          auth_type: "email_otp",
-          reason: "timeout"
-        });
-      },
-      trackVerified: () => {
-        track("auth_verified", { auth_type: "email_otp" });
-      },
-      trackBootstrapRequired: ({ context }) => {
-        track("auth_verified", {
-          auth_type: "email_otp",
-          auth_mode: context.bootstrapReason ?? "bootstrap_required"
-        });
-      },
-      identifyAndTrack: ({ context }) => {
-        if (!context.session) return;
-        identify(context.session.authUserId, {
-          email_domain: emailDomain2(context.session.email)
-        });
-        track("auth_identified", {
-          email_domain: emailDomain2(context.session.email)
-        });
-      },
-      trackSignedOut: () => {
-        track("auth_signed_out");
-      }
-    }
-  }).createMachine({
-    id: "authBootstrap",
-    initial: "email",
-    context: initialContext,
-    states: {
-      email: {
-        on: {
-          ENTER_EMAIL: {
-            actions: assign({
-              email: ({ event }) => event.email,
-              error: () => null
-            })
-          },
-          REQUEST_OTP: { target: "sending_otp" }
-        }
-      },
-      sending_otp: {
-        invoke: {
-          src: "sendOtp",
-          input: ({ context }) => ({ email: requireEmail2(context) }),
-          onDone: { target: "otp_requested", actions: "trackOtpRequested" },
-          onError: {
-            target: "otp_requested",
-            actions: [
-              assign({ error: ({ event }) => errorFromEvent2(event) }),
-              "trackFailed"
-            ]
-          }
-        },
-        after: {
-          [FLOW_INVOKE_TIMEOUT_MS]: {
-            target: "otp_requested",
-            actions: [
-              assign({ error: () => timeoutError2("sending_otp") }),
-              "trackTimeoutFailed"
-            ]
-          }
-        }
-      },
-      otp_requested: {
-        on: {
-          ENTER_OTP: {
-            actions: assign({
-              code: ({ event }) => event.code,
-              error: () => null
-            })
-          },
-          VERIFY_OTP: { target: "verifying_otp" },
-          BACK: { target: "email" },
-          RESET: { target: "email", actions: assign(() => initialContext) }
-        }
-      },
-      verifying_otp: {
-        invoke: {
-          src: "verifyOtp",
-          input: ({ context }) => ({
-            email: requireEmail2(context),
-            code: requireCode(context)
-          }),
-          onDone: [
-            {
-              guard: ({ event }) => event.output.kind === "existing_member",
-              target: "authenticated",
-              actions: [
-                assign({
-                  session: ({ event }) => event.output.session,
-                  account: ({ event }) => event.output.kind === "existing_member" ? event.output.account : null,
-                  username: ({ event }) => event.output.kind === "existing_member" ? event.output.username : null,
-                  safe: ({ event }) => event.output.kind === "existing_member" ? event.output.safe : null,
-                  email: () => null,
-                  error: () => null
-                }),
-                "trackVerified",
-                "identifyAndTrack"
-              ]
-            },
-            {
-              target: "bootstrap_required",
-              actions: [
-                assign({
-                  session: ({ event }) => event.output.session,
-                  bootstrapToken: ({ event }) => event.output.kind === "bootstrap_required" ? event.output.bootstrapToken : null,
-                  bootstrapReason: ({ event }) => event.output.kind === "bootstrap_required" ? event.output.reason : null,
-                  username: ({ event }) => event.output.kind === "bootstrap_required" ? event.output.username ?? null : null,
-                  email: ({ event }) => event.output.kind === "bootstrap_required" ? event.output.email : null,
-                  error: () => null
-                }),
-                "trackVerified",
-                "trackBootstrapRequired"
-              ]
-            }
-          ],
-          onError: {
-            target: "otp_requested",
-            actions: [
-              assign({ error: ({ event }) => errorFromEvent2(event) }),
-              "trackFailed"
-            ]
-          }
-        },
-        after: {
-          [FLOW_INVOKE_TIMEOUT_MS]: {
-            target: "otp_requested",
-            actions: [
-              assign({ error: () => timeoutError2("verifying_otp") }),
-              "trackTimeoutFailed"
-            ]
-          }
-        }
-      },
-      bootstrap_required: {
-        on: {
-          ENTER_USERNAME: {
-            actions: assign({
-              username: ({ event }) => event.username,
-              error: () => null
-            })
-          },
-          COMPLETE_BOOTSTRAP: { target: "completing_bootstrap" },
-          BACK: { target: "otp_requested" },
-          RESET: { target: "email", actions: assign(() => initialContext) }
-        }
-      },
-      completing_bootstrap: {
-        invoke: {
-          src: "completeBootstrap",
-          input: ({ context }) => ({
-            bootstrapToken: requireBootstrapToken(context),
-            username: requireUsername(context)
-          }),
-          onDone: {
-            target: "authenticated",
-            actions: [
-              assign({
-                session: ({ event }) => event.output.session,
-                account: ({ event }) => event.output.account,
-                username: ({ event }) => event.output.username,
-                safe: ({ event }) => event.output.safe,
-                bootstrapToken: () => null,
-                bootstrapReason: () => null,
-                email: () => null,
-                error: () => null
-              }),
-              "identifyAndTrack"
-            ]
-          },
-          onError: {
-            target: "bootstrap_required",
-            actions: [
-              assign({ error: ({ event }) => errorFromEvent2(event) }),
-              "trackFailed"
-            ]
-          }
-        },
-        after: {
-          [FLOW_INVOKE_TIMEOUT_MS]: {
-            target: "bootstrap_required",
-            actions: [
-              assign({ error: () => timeoutError2("completing_bootstrap") }),
-              "trackTimeoutFailed"
-            ]
-          }
-        }
-      },
-      authenticated: {
-        on: {
-          SIGN_OUT: { target: "signing_out" }
-        }
-      },
-      signing_out: {
-        invoke: {
-          src: "signOut",
-          onDone: {
-            target: "email",
-            actions: [
-              assign(() => initialContext),
-              "trackSignedOut"
-            ]
-          },
-          onError: {
-            target: "error",
-            actions: assign({ error: ({ event }) => errorFromEvent2(event) })
-          }
-        }
-      },
-      error: {
-        on: {
-          RESET: { target: "email", actions: assign(() => initialContext) }
-        }
-      }
-    }
-  });
-}
-function requireEmail2(context) {
-  if (!context.email) {
-    throw Errors.invalidInput("email", "Auth bootstrap requires an email.");
-  }
-  return context.email;
-}
-function requireCode(context) {
-  if (!context.code) {
-    throw Errors.invalidInput("code", "Auth bootstrap requires an OTP code.");
-  }
-  return context.code;
-}
-function requireBootstrapToken(context) {
-  if (!context.bootstrapToken) {
-    throw Errors.invalidInput(
-      "bootstrapToken",
-      "Auth bootstrap requires a continuation token."
-    );
-  }
-  return context.bootstrapToken;
-}
-function requireUsername(context) {
-  if (!context.username) {
-    throw Errors.invalidInput("username", "Auth bootstrap requires a username.");
-  }
-  return context.username;
-}
-function errorFromEvent2(event) {
-  const cause = typeof event === "object" && event !== null && "error" in event ? event.error : event;
-  if (cause instanceof CapxulError || cause instanceof CapxulError2) {
-    return cause;
-  }
-  return Errors.providerError("auth", "bootstrap", cause);
-}
-function timeoutError2(state) {
-  return Errors.providerError(
-    "auth",
-    "bootstrap",
-    new Error(`timeout: ${state} exceeded ${FLOW_INVOKE_TIMEOUT_MS}ms`)
-  );
-}
-function emailDomain2(email) {
-  const domain = email.split("@")[1]?.trim().toLowerCase();
-  return domain || "unknown";
-}
 function createProvisioningMachine(client) {
   return setup({
     types: {},
@@ -3938,7 +3658,7 @@ function createProvisioningMachine(client) {
         const provider = context.input?.signerProvider;
         if (!provider) return;
         track("provisioning_safe_created", {
-          safe_address: deriveSafeAddress(provider.signerAddress)
+          safe_address: deriveSafeAddress2(provider.signerAddress)
         });
       }
     }
@@ -3983,13 +3703,13 @@ function createProvisioningMachine(client) {
           },
           onError: {
             target: "error",
-            actions: assign({ error: ({ event }) => errorFromEvent3(event) })
+            actions: assign({ error: ({ event }) => errorFromEvent(event) })
           }
         },
         after: {
           [FLOW_INVOKE_TIMEOUT_MS]: {
             target: "error",
-            actions: assign({ error: () => timeoutError3() })
+            actions: assign({ error: () => timeoutError() })
           }
         }
       },
@@ -4007,7 +3727,7 @@ function createProvisioningMachine(client) {
      * this payload on its `onDone` transition and branches via guards
      * on `event.output.error`.
      */
-    output: ({ context }) => context.error ? { error: context.error } : context.account ? { account: context.account } : { error: timeoutError3() }
+    output: ({ context }) => context.error ? { error: context.error } : context.account ? { account: context.account } : { error: timeoutError() }
   });
 }
 function requireProvisionInput(context) {
@@ -4019,13 +3739,13 @@ function requireProvisionInput(context) {
   }
   return context.input;
 }
-function errorFromEvent3(event) {
+function errorFromEvent(event) {
   const cause = typeof event === "object" && event !== null && "error" in event ? event.error : event;
   if (cause instanceof CapxulError) return cause;
   if (cause instanceof CapxulError2) return cause;
   return Errors.providerError("provisioning", "flow", cause);
 }
-function timeoutError3() {
+function timeoutError() {
   return Errors.providerError(
     "provisioning",
     "flow",
@@ -4118,7 +3838,7 @@ function createOnboardingFlowMachine(client) {
         error: ({ event }) => extractChildErrorOrFallback(event)
       }),
       assignChildThrown: assign({
-        error: ({ event }) => errorFromEvent4(event)
+        error: ({ event }) => errorFromEvent2(event)
       }),
       assignAccountFromChild: assign({
         account: ({ event }) => extractChildAccountOrNull(event)
@@ -4280,7 +4000,7 @@ function extractChildAccountOrNull(event) {
   if (output && "account" in output && output.account) return output.account;
   return null;
 }
-function errorFromEvent4(event) {
+function errorFromEvent2(event) {
   const cause = typeof event === "object" && event !== null && "error" in event ? event.error : event;
   if (cause instanceof CapxulError) return cause;
   if (cause instanceof CapxulError2) return cause;
@@ -4291,7 +4011,7 @@ function errorFromEvent4(event) {
 function createCapxulClient(config = {}) {
   const clientWithoutFlows = {
     id: crypto.randomUUID(),
-    auth: createAuthClient(config),
+    auth: new AuthService(config),
     me: createMeClient(config),
     accounts: createAccountsClient(config),
     organizations: createOrganizationsClient(config),
@@ -4299,7 +4019,7 @@ function createCapxulClient(config = {}) {
     transfers: createTransfersClient(),
     tokenTransfers: createTokenTransfersClient(config),
     withdrawals: createWithdrawalsClient(config),
-    documents: createDocumentsClient(),
+    documents: createDocumentsClient(config),
     subAccounts: createSubAccountsClient(config),
     virtualAccounts: createVirtualAccountsClient(),
     virtualCards: createVirtualCardsClient(),
@@ -4311,8 +4031,6 @@ function createCapxulClient(config = {}) {
   };
   const client = clientWithoutFlows;
   client.flows = {
-    auth: () => createAuthFlowMachine(client),
-    authBootstrap: () => createAuthBootstrapFlowMachine(client),
     onboarding: () => createOnboardingFlowMachine(client),
     provisioning: () => createProvisioningMachine(client)
   };