@capxul/sdk 0.2.0-alpha.3 → 0.2.0-alpha.4

package/dist/index.js

@@ -1,9 +1,8 @@
 import { componentsGeneric, anyApi } from 'convex/server';
 import { toSafeSmartAccount } from 'permissionless/accounts';
-import { getAddress, parseUnits, createPublicClient, http, encodeFunctionData } from 'viem';
+import { getAddress, encodeFunctionData, encodePacked, keccak256, getContractAddress, parseUnits, createPublicClient, http } from 'viem';
 import { entryPoint07Address, createPaymasterClient, createBundlerClient } from 'viem/account-abstraction';
 import { baseSepolia } from 'viem/chains';
-import { deriveSafeAddress as deriveSafeAddress$1, defaultSafeDeriveConfig } from '@repo/safe-derive';
 import { ConvexHttpClient } from 'convex/browser';
 import { setup, fromPromise, assign } from 'xstate';
 import { privateKeyToAccount, generatePrivateKey } from 'viem/accounts';
@@ -110,18 +109,6 @@ function track(...args) {
   const [name, props] = args;
   debugLog(`[TRACK] ${name} ${formatDebugValue(props ?? "")}`);
 }
-function formatDebugValue2(value) {
-  if (value === void 0 || value === "") return "";
-  if (typeof value === "string") return value;
-  try {
-    return JSON.stringify(value);
-  } catch {
-    return String(value);
-  }
-}
-function identify(userId, traits) {
-  debugLog(`[IDENTIFY] ${userId} ${formatDebugValue2(traits ?? "")}`);
-}
 
 // ../config/src/chain.ts
 var CAPXUL_PAYMENTS_ADDRESS = "0xe740ea65521edc9bef0ea75d30b5334711db99f4";
@@ -232,6 +219,7 @@ var SAFE_PROXY_FACTORY = "0x4e1dcf7ad4e460cfd30791ccc4f9c8a4f820ec67";
 var SAFE_L2_SINGLETON = "0x29fcb43b46531bca003ddc8fcb67ffe91900c762";
 var SAFE_MODULE_SETUP = "0x2dd68b007b46fbe91b9a7c3eda5a7a1063cb5b47";
 var SAFE_4337_MODULE = "0x75cf11467937ce3f2f357ce24ffc3dbf8fd5c226";
+var MULTI_SEND = "0x38869bf66a61cf6bdb996a6ae40d5853fd43b526";
 
 // ../config/src/org-roles.ts
 function roleKeyFromLabel(label) {
@@ -242,6 +230,117 @@ function roleKeyFromLabel(label) {
 roleKeyFromLabel("OWNER");
 roleKeyFromLabel("FINANCE_MANAGER");
 roleKeyFromLabel("PAYMENTS_OPERATOR");
+var defaultSafeDeriveConfig = {
+  safeProxyFactory: SAFE_PROXY_FACTORY,
+  safeL2Singleton: SAFE_L2_SINGLETON,
+  safeModuleSetup: SAFE_MODULE_SETUP,
+  safe4337Module: SAFE_4337_MODULE,
+  multiSend: MULTI_SEND
+};
+var SAFE_PROXY_CREATION_CODE = "0x608060405234801561001057600080fd5b506040516101e63803806101e68339818101604052602081101561003357600080fd5b8101908080519060200190929190505050600073ffffffffffffffffffffffffffffffffffffffff168173ffffffffffffffffffffffffffffffffffffffff1614156100ca576040517f08c379a00000000000000000000000000000000000000000000000000000000081526004018080602001828103825260228152602001806101c46022913960400191505060405180910390fd5b806000806101000a81548173ffffffffffffffffffffffffffffffffffffffff021916908373ffffffffffffffffffffffffffffffffffffffff1602179055505060ab806101196000396000f3fe608060405273ffffffffffffffffffffffffffffffffffffffff600054167fa619486e0000000000000000000000000000000000000000000000000000000060003514156050578060005260206000f35b3660008037600080366000845af43d6000803e60008114156070573d6000fd5b3d6000f3fea264697066735822122003d1488ee65e08fa41e58e888a9865554c535f2c77126a82cb4c0f917f31441364736f6c63430007060033496e76616c69642073696e676c65746f6e20616464726573732070726f7669646564";
+var enableModulesAbi = [
+  {
+    type: "function",
+    name: "enableModules",
+    inputs: [{ type: "address[]", name: "modules" }],
+    outputs: [],
+    stateMutability: "nonpayable"
+  }
+];
+var multiSendAbi = [
+  {
+    type: "function",
+    name: "multiSend",
+    inputs: [{ type: "bytes", name: "transactions" }],
+    outputs: [],
+    stateMutability: "payable"
+  }
+];
+var setupAbi = [
+  {
+    type: "function",
+    name: "setup",
+    inputs: [
+      { type: "address[]", name: "owners" },
+      { type: "uint256", name: "threshold" },
+      { type: "address", name: "to" },
+      { type: "bytes", name: "data" },
+      { type: "address", name: "fallbackHandler" },
+      { type: "address", name: "paymentToken" },
+      { type: "uint256", name: "payment" },
+      { type: "address", name: "paymentReceiver" }
+    ],
+    outputs: [],
+    stateMutability: "nonpayable"
+  }
+];
+function encodeInternalTransaction(tx) {
+  const encoded = encodePacked(
+    ["uint8", "address", "uint256", "uint256", "bytes"],
+    [
+      tx.operation,
+      tx.to,
+      tx.value,
+      BigInt(tx.data.slice(2).length / 2),
+      tx.data
+    ]
+  );
+  return encoded.slice(2);
+}
+function computeSaltNonce(ownerAddress) {
+  return BigInt(`0x${ownerAddress.toLowerCase().slice(2).padEnd(64, "0")}`);
+}
+function deriveSafeAddress(signerAddress, config = defaultSafeDeriveConfig) {
+  const saltNonce = computeSaltNonce(signerAddress);
+  const enableModulesData = encodeFunctionData({
+    abi: enableModulesAbi,
+    functionName: "enableModules",
+    args: [[config.safe4337Module]]
+  });
+  const innerTx = encodeInternalTransaction({
+    operation: 1,
+    to: config.safeModuleSetup,
+    value: 0n,
+    data: enableModulesData
+  });
+  const multiSendCallData = encodeFunctionData({
+    abi: multiSendAbi,
+    functionName: "multiSend",
+    args: [`0x${innerTx}`]
+  });
+  const initializer = encodeFunctionData({
+    abi: setupAbi,
+    functionName: "setup",
+    args: [
+      [signerAddress],
+      1n,
+      config.multiSend,
+      multiSendCallData,
+      config.safe4337Module,
+      "0x0000000000000000000000000000000000000000",
+      0n,
+      "0x0000000000000000000000000000000000000000"
+    ]
+  });
+  const deploymentCode = encodePacked(
+    ["bytes", "uint256"],
+    [SAFE_PROXY_CREATION_CODE, BigInt(config.safeL2Singleton)]
+  );
+  const salt = keccak256(
+    encodePacked(
+      ["bytes32", "uint256"],
+      [keccak256(encodePacked(["bytes"], [initializer])), saltNonce]
+    )
+  );
+  return getContractAddress({
+    from: config.safeProxyFactory,
+    salt,
+    bytecode: deploymentCode,
+    opcode: "CREATE2"
+  });
+}
+
+// src/internal/safe/account.ts
 async function buildSafeAccount(signer, chain) {
   try {
     const publicClient = createPublicClient({
@@ -253,7 +352,7 @@ async function buildSafeAccount(signer, chain) {
       entryPoint: { address: entryPoint07Address, version: "0.7" },
       version: "1.4.1",
       owners: [signer],
-      saltNonce: computeSaltNonce(signer.address),
+      saltNonce: computeSaltNonce2(signer.address),
       safeSingletonAddress: SAFE_L2_SINGLETON,
       safeProxyFactoryAddress: SAFE_PROXY_FACTORY,
       safeModuleSetupAddress: SAFE_MODULE_SETUP,
@@ -270,11 +369,11 @@ async function buildSafeAccount(signer, chain) {
     });
   }
 }
-function computeSaltNonce(ownerAddress) {
+function computeSaltNonce2(ownerAddress) {
   return BigInt(`0x${ownerAddress.toLowerCase().slice(2).padEnd(64, "0")}`);
 }
-function deriveSafeAddress(signerAddress) {
-  return deriveSafeAddress$1(signerAddress, defaultSafeDeriveConfig);
+function deriveSafeAddress2(signerAddress) {
+  return deriveSafeAddress(signerAddress, defaultSafeDeriveConfig);
 }
 
 // ../platform-kernel/src/ids.ts
@@ -1016,7 +1115,7 @@ function createAccountsClient(config = {}) {
             username: input.username,
             countryCode: input.countryCode,
             eoaAddress: input.signerProvider.signerAddress,
-            safeAddress: deriveSafeAddress(input.signerProvider.signerAddress)
+            safeAddress: deriveSafeAddress2(input.signerProvider.signerAddress)
           }
         );
         const account = await config._data.query(
@@ -1602,8 +1701,17 @@ function createAuthClient(config = {}) {
         ];
       }
       try {
-        const safeAddress = deriveSafeAddress(signerAddress);
-        const result = await data.mutation(api.authBootstrap.completeBootstrap, {
+        const safeAddress = deriveSafeAddress2(signerAddress);
+        if (!data.action) {
+          return [
+            new CapxulError({
+              code: "INVALID_INPUT",
+              message: "completeBootstrap requires a data client that can execute Convex actions."
+            }),
+            null
+          ];
+        }
+        const result = await data.action(api.authBootstrap.completeBootstrap, {
           bootstrapToken: input.bootstrapToken,
           sessionToken: session.token,
           username: input.username,
@@ -1786,16 +1894,227 @@ function mutableConfig(config) {
   return config;
 }
 
+// src/core/auth-service.ts
+var AuthService = class {
+  authClient;
+  sessionStore;
+  config;
+  constructor(config = {}) {
+    this.config = config;
+    this.sessionStore = config.auth?.sessionStore ?? createMemorySessionStore2();
+    this.authClient = createAuthClient({
+      ...config,
+      auth: { ...config.auth, sessionStore: this.sessionStore }
+    });
+  }
+  async sendOtp(email, options) {
+    const [err] = await this.authClient.sendOtp({ email }, options);
+    if (err) throw err;
+  }
+  async verifyOtp(email, otp, options) {
+    const [err, result] = await this.authClient.verifyOtp(
+      { email, otp },
+      options
+    );
+    if (err) throw err;
+    return result;
+  }
+  async completeBootstrap(params, signer) {
+    if (signer) {
+      const tempClient = createAuthClient({
+        ...this.config,
+        signer,
+        auth: { ...this.config.auth, sessionStore: this.sessionStore }
+      });
+      const [err2, result2] = await tempClient.completeBootstrap(params);
+      if (err2) throw err2;
+      return result2;
+    }
+    const [err, result] = await this.authClient.completeBootstrap(params);
+    if (err) throw err;
+    return result;
+  }
+  /**
+   * Clears the persisted session and, when a transport was pre-injected,
+   * drops the cached auth header.
+   *
+   * **Transport safety note:** `clearAuth()` is only invoked when
+   * `config._transport` was supplied at construction (e.g. by the React
+   * provider). If `AuthService` is instantiated directly in a Node/CLI
+   * context without an injected transport, the transport-side auth cache
+   * is the caller's responsibility.
+   */
+  async signOut() {
+    if (!this.config._transport) {
+      const [err] = await this.authClient.signOut();
+      if (err) throw err;
+      mutableConfig2(this.config)._data = void 0;
+      return;
+    }
+    this.sessionStore.clear();
+    this.config._transport.clearAuth();
+  }
+  async getSession() {
+    const [err, session] = await this.authClient.getSession();
+    if (err) throw err;
+    return session;
+  }
+};
+function mutableConfig2(config) {
+  return config;
+}
+function createMemorySessionStore2() {
+  let current = null;
+  return {
+    get: () => current,
+    set: (session) => {
+      current = session;
+    },
+    clear: () => {
+      current = null;
+    }
+  };
+}
+
 // src/core/documents.ts
-function createDocumentsClient() {
+function requireInvoiceHash(row) {
+  if (!row.invoiceHash) {
+    throw new CapxulError({
+      code: "INVALID_INPUT",
+      message: `invoice document ${row.documentId ?? row._id} is missing its canonical invoiceHash`
+    });
+  }
+  return row.invoiceHash;
+}
+function mapInvoiceRow(row) {
+  const status = row.status === "cancelled" ? "canceled" : row.status === "pending" ? "open" : row.status === "overdue" ? "expired" : row.status;
   return {
-    create: async () => stub("documents.create"),
-    retrieve: async () => stub("documents.retrieve"),
-    list: async () => stub("documents.list"),
-    cancel: async () => stub("documents.cancel")
+    object: "document",
+    id: row.documentId ?? row._id,
+    type: "invoice",
+    owner: {
+      kind: row.scope === "org" ? "organization" : "account",
+      id: row.orgId ?? row.payeeEmail ?? row.payeeLabel
+    },
+    recipient: { email: row.payerEmail },
+    amount: {
+      value: row.amount,
+      currency: row.currency
+    },
+    reference: row.note,
+    lineItems: row.items,
+    invoiceHash: requireInvoiceHash(row),
+    dueAt: row.dueDate,
+    status,
+    createdAt: new Date(row.createdAt).toISOString()
   };
 }
-function createOrgDocumentsClient() {
+function mapDocumentError(cause) {
+  return fromConvexError(cause);
+}
+function createDocumentsClient(config = {}) {
+  return {
+    create: async (input) => {
+      if (!config._data) return stub("documents.create");
+      if (input.type !== "invoice") {
+        return [
+          new CapxulError({
+            code: "INVALID_INPUT",
+            message: "documents.create currently supports personal invoice documents only."
+          }),
+          null
+        ];
+      }
+      if (!("email" in input.recipient)) {
+        return [
+          new CapxulError({
+            code: "INVALID_INPUT",
+            message: "personal invoice documents currently require an email recipient."
+          }),
+          null
+        ];
+      }
+      try {
+        const created = await config._data.mutation(
+          api.paymentRecords.mutations.createInvoice,
+          {
+            scope: "personal",
+            payerEmail: input.recipient.email,
+            amount: input.amount.value,
+            currency: input.amount.currency,
+            dueDate: input.dueAt ?? (/* @__PURE__ */ new Date()).toISOString(),
+            note: input.reference,
+            items: input.lineItems
+          }
+        );
+        const row = await config._data.query(
+          api.paymentRecords.queries.getInvoiceByDocumentId,
+          { documentId: created.documentId }
+        );
+        if (!row) throw new Error("created invoice was not readable");
+        return [null, mapInvoiceRow(row)];
+      } catch (cause) {
+        return [mapDocumentError(cause), null];
+      }
+    },
+    retrieve: async (documentId) => {
+      if (!config._data)
+        return stub("documents.retrieve");
+      try {
+        const row = await config._data.query(
+          api.paymentRecords.queries.getInvoiceByDocumentId,
+          { documentId }
+        );
+        if (!row) {
+          return [
+            new CapxulError({
+              code: "NOT_FOUND",
+              message: `document ${documentId} not found`
+            }),
+            null
+          ];
+        }
+        return [null, mapInvoiceRow(row)];
+      } catch (cause) {
+        return [mapDocumentError(cause), null];
+      }
+    },
+    list: async (input = {}) => {
+      if (!config._data)
+        return stub("documents.list");
+      try {
+        if (input.type && input.type !== "invoice") {
+          return [null, { object: "list", data: [], page: { hasMore: false } }];
+        }
+        const rows = await config._data.query(
+          api.paymentRecords.queries.listMyInvoices,
+          {
+            limit: input.limit,
+            cursor: input.cursor
+          }
+        );
+        const page = rows;
+        const data = page.data.map((row) => mapInvoiceRow(row));
+        return [null, { object: "list", data, page: page.page }];
+      } catch (cause) {
+        return [mapDocumentError(cause), null];
+      }
+    },
+    cancel: async (documentId) => {
+      if (!config._data) return stub("documents.cancel");
+      try {
+        const row = await config._data.mutation(
+          api.paymentRecords.mutations.cancelInvoice,
+          { documentId }
+        );
+        return [null, mapInvoiceRow(row)];
+      } catch (cause) {
+        return [mapDocumentError(cause), null];
+      }
+    }
+  };
+}
+function createOrgDocumentsClient(_config = {}) {
   return {
     create: async () => stub("organizations.documents.create"),
     retrieve: async () => stub("organizations.documents.retrieve"),
@@ -3123,7 +3442,9 @@ function createOrganizationsClient(config = {}) {
       },
       invite: async (input) => {
         if (!config._data?.action) {
-          return stub("organizations.members.invite");
+          return stub(
+            "organizations.members.invite"
+          );
         }
         try {
           const orgId = input.organizationId.replace(/^org_/, "");
@@ -3211,7 +3532,9 @@ function createOrganizationsClient(config = {}) {
       },
       resend: async (input) => {
         if (!config._data?.action) {
-          return stub("organizations.members.resend");
+          return stub(
+            "organizations.members.resend"
+          );
         }
         try {
           const orgId = input.organizationId.replace(/^org_/, "");
@@ -3279,7 +3602,7 @@ function createOrganizationsClient(config = {}) {
     payments: createOrgPaymentsClient(),
     transfers: createOrgTransfersClient(),
     withdrawals: createOrgWithdrawalsClient(config),
-    documents: createOrgDocumentsClient(),
+    documents: createOrgDocumentsClient(config),
     webhookEndpoints: createWebhookEndpointsClient(),
     webhookEvents: createWebhookEventsClient()
   };
@@ -3396,609 +3719,6 @@ function createVirtualCardsClient() {
     cancel: async () => stub("virtualCards.cancel")
   };
 }
-function createAuthFlowMachine(client) {
-  return setup({
-    types: {},
-    actors: {
-      // XState v5's `fromPromise` injects an `AbortSignal` that aborts
-      // when the actor is stopped (parent transition fires, machine is
-      // disposed, etc.). Plumbing it through `client.auth.sendOtp` /
-      // `client.auth.verifyOtp` makes the in-flight HTTP request
-      // cancellable: stale responses can't race a state machine
-      // that's already moved on. See PR #406 S5.
-      sendOtp: fromPromise(async ({ input, signal }) => {
-        const [error] = await client.auth.sendOtp(
-          { email: input.email },
-          { signal }
-        );
-        if (error) throw error;
-      }),
-      verifyOtp: fromPromise(
-        async ({ input, signal }) => {
-          const [error, result] = await client.auth.verifyOtp(
-            {
-              email: input.email,
-              otp: input.code
-            },
-            { signal }
-          );
-          if (error) throw error;
-          if (result.kind === "bootstrap_required") {
-            throw new CapxulError({
-              code: "ACTION_REQUIRED",
-              message: "OTP verified but auth bootstrap is required. Use createAuthBootstrapFlowMachine for product sign-up.",
-              details: { reason: result.reason }
-            });
-          }
-          return result.session;
-        }
-      ),
-      signOut: fromPromise(async () => {
-        const [error] = await client.auth.signOut();
-        if (error) throw error;
-      })
-    },
-    actions: {
-      trackOtpRequested: ({ context }) => {
-        if (!context.email) return;
-        track("auth_otp_requested", {
-          email_domain: emailDomain(context.email)
-        });
-      },
-      trackOtpFailed: ({ event }) => {
-        const error = errorFromEvent(event);
-        track("auth_failed", {
-          auth_type: "email_otp",
-          reason: error.code
-        });
-      },
-      trackTimeoutFailed: () => {
-        track("auth_failed", {
-          auth_type: "email_otp",
-          reason: "timeout"
-        });
-      },
-      trackVerified: () => {
-        track("auth_verified", { auth_type: "email_otp" });
-      },
-      identifyAndTrack: ({ context }) => {
-        if (!context.session) return;
-        identify(context.session.authUserId, {
-          email_domain: emailDomain(context.session.email)
-        });
-        track("auth_identified", {
-          email_domain: emailDomain(context.session.email)
-        });
-      },
-      trackSignedOut: () => {
-        track("auth_signed_out");
-      }
-    }
-  }).createMachine({
-    id: "auth",
-    initial: "idle",
-    context: { email: null, session: null, error: null },
-    states: {
-      idle: {
-        on: {
-          REQUEST_OTP: {
-            target: "sending_otp",
-            actions: assign({
-              email: ({ event }) => event.email,
-              error: () => null
-            })
-          }
-        }
-      },
-      sending_otp: {
-        invoke: {
-          src: "sendOtp",
-          input: ({ context }) => ({ email: requireEmail(context) }),
-          onDone: {
-            target: "otp_requested",
-            actions: ["trackOtpRequested"]
-          },
-          onError: {
-            target: "error",
-            actions: [
-              assign({ error: ({ event }) => errorFromEvent(event) }),
-              "trackOtpFailed"
-            ]
-          }
-        },
-        after: {
-          [FLOW_INVOKE_TIMEOUT_MS]: {
-            target: "error",
-            actions: [
-              assign({
-                error: () => timeoutError("sending_otp")
-              }),
-              "trackTimeoutFailed"
-            ]
-          }
-        }
-      },
-      otp_requested: {
-        on: {
-          VERIFY: { target: "verifying" },
-          RESET: {
-            target: "idle",
-            actions: assign({ email: () => null, error: () => null })
-          }
-        }
-      },
-      verifying: {
-        invoke: {
-          src: "verifyOtp",
-          input: ({ context, event }) => ({
-            email: requireEmail(context),
-            code: requireCodeFromEvent(event)
-          }),
-          onDone: {
-            target: "authenticated",
-            actions: [
-              // Scrub the duplicate `context.email` (input value
-              // captured during sendOtp) since the verified
-              // `session.email` is now the canonical source
-              // post-authentication. The session's email is
-              // intentionally retained — it's the auth result, not
-              // lingering input. See PR #406 S2.
-              assign({
-                session: ({ event }) => event.output,
-                email: () => null
-              }),
-              "trackVerified",
-              "identifyAndTrack"
-            ]
-          },
-          onError: {
-            target: "error",
-            actions: [
-              assign({ error: ({ event }) => errorFromEvent(event) }),
-              "trackOtpFailed"
-            ]
-          }
-        },
-        after: {
-          [FLOW_INVOKE_TIMEOUT_MS]: {
-            target: "error",
-            actions: [
-              assign({
-                error: () => timeoutError("verifying")
-              }),
-              "trackTimeoutFailed"
-            ]
-          }
-        }
-      },
-      authenticated: {
-        on: {
-          SIGN_OUT: { target: "signing_out" }
-        }
-      },
-      signing_out: {
-        invoke: {
-          src: "signOut",
-          onDone: {
-            target: "idle",
-            actions: [
-              assign({
-                session: () => null,
-                email: () => null,
-                error: () => null
-              }),
-              "trackSignedOut"
-            ]
-          },
-          onError: {
-            target: "error",
-            actions: assign({ error: ({ event }) => errorFromEvent(event) })
-          }
-        }
-      },
-      error: {
-        on: {
-          RESET: {
-            target: "idle",
-            actions: assign({ error: () => null })
-          }
-        }
-      }
-    }
-  });
-}
-function requireEmail(context) {
-  if (!context.email) {
-    throw Errors.invalidInput(
-      "email",
-      "Auth flow advanced without an email captured in context."
-    );
-  }
-  return context.email;
-}
-function requireCodeFromEvent(event) {
-  if (event.type !== "VERIFY") {
-    throw Errors.invalidInput(
-      "code",
-      `Auth flow's verifying state requires a VERIFY event, got ${event.type}.`
-    );
-  }
-  return event.code;
-}
-function errorFromEvent(event) {
-  const cause = typeof event === "object" && event !== null && "error" in event ? event.error : event;
-  if (cause instanceof CapxulError) {
-    if (!EMAIL_MATCH_PATTERN.test(cause.message)) return cause;
-    return new CapxulError({
-      code: cause.code,
-      message: redactEmail(cause.message),
-      cause,
-      details: cause.details,
-      operationId: cause.operationId,
-      correlationId: cause.correlationId,
-      retryable: cause.retryable
-    });
-  }
-  if (cause instanceof CapxulError2) {
-    if (!EMAIL_MATCH_PATTERN.test(cause.message)) return cause;
-    return new CapxulError2(cause.code, redactEmail(cause.message), {
-      cause,
-      details: cause.details,
-      correlationId: cause.correlationId,
-      layer: cause.layer
-    });
-  }
-  return Errors.providerError("auth", "flow", redactCauseEmail(cause));
-}
-var EMAIL_MATCH_PATTERN = /[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}/;
-var EMAIL_REDACT_PATTERN = /[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}/g;
-function redactEmail(message) {
-  return message.replace(EMAIL_REDACT_PATTERN, "<redacted>");
-}
-function redactCauseEmail(cause) {
-  if (cause instanceof Error) {
-    if (!EMAIL_MATCH_PATTERN.test(cause.message)) return cause;
-    const redacted = new Error(redactEmail(cause.message));
-    redacted.cause = cause;
-    return redacted;
-  }
-  if (typeof cause === "string") {
-    return redactEmail(cause);
-  }
-  return cause;
-}
-function timeoutError(state) {
-  return Errors.providerError(
-    "auth",
-    "flow",
-    new Error(`timeout: ${state} exceeded ${FLOW_INVOKE_TIMEOUT_MS}ms`)
-  );
-}
-function emailDomain(email) {
-  const domain = email.split("@")[1]?.trim().toLowerCase();
-  return domain || "unknown";
-}
-var initialContext = {
-  email: null,
-  code: null,
-  username: null,
-  bootstrapToken: null,
-  bootstrapReason: null,
-  session: null,
-  account: null,
-  safe: null,
-  error: null
-};
-function createAuthBootstrapFlowMachine(client) {
-  return setup({
-    types: {},
-    actors: {
-      sendOtp: fromPromise(async ({ input, signal }) => {
-        const [error] = await client.auth.sendOtp(
-          { email: input.email },
-          { signal }
-        );
-        if (error) throw error;
-      }),
-      verifyOtp: fromPromise(
-        async ({ input, signal }) => {
-          const [error, result] = await client.auth.verifyOtp(
-            { email: input.email, otp: input.code },
-            { signal }
-          );
-          if (error) throw error;
-          return result;
-        }
-      ),
-      completeBootstrap: fromPromise(async ({ input }) => {
-        const [error, result] = await client.auth.completeBootstrap(input);
-        if (error) throw error;
-        return result;
-      }),
-      signOut: fromPromise(async () => {
-        const [error] = await client.auth.signOut();
-        if (error) throw error;
-      })
-    },
-    actions: {
-      trackOtpRequested: ({ context }) => {
-        if (!context.email) return;
-        track("auth_otp_requested", {
-          email_domain: emailDomain2(context.email)
-        });
-      },
-      trackFailed: ({ event }) => {
-        track("auth_failed", {
-          auth_type: "email_otp",
-          reason: errorFromEvent2(event).code
-        });
-      },
-      trackTimeoutFailed: () => {
-        track("auth_failed", {
-          auth_type: "email_otp",
-          reason: "timeout"
-        });
-      },
-      trackVerified: () => {
-        track("auth_verified", { auth_type: "email_otp" });
-      },
-      trackBootstrapRequired: ({ context }) => {
-        track("auth_verified", {
-          auth_type: "email_otp",
-          auth_mode: context.bootstrapReason ?? "bootstrap_required"
-        });
-      },
-      identifyAndTrack: ({ context }) => {
-        if (!context.session) return;
-        identify(context.session.authUserId, {
-          email_domain: emailDomain2(context.session.email)
-        });
-        track("auth_identified", {
-          email_domain: emailDomain2(context.session.email)
-        });
-      },
-      trackSignedOut: () => {
-        track("auth_signed_out");
-      }
-    }
-  }).createMachine({
-    id: "authBootstrap",
-    initial: "email",
-    context: initialContext,
-    states: {
-      email: {
-        on: {
-          ENTER_EMAIL: {
-            actions: assign({
-              email: ({ event }) => event.email,
-              error: () => null
-            })
-          },
-          REQUEST_OTP: { target: "sending_otp" }
-        }
-      },
-      sending_otp: {
-        invoke: {
-          src: "sendOtp",
-          input: ({ context }) => ({ email: requireEmail2(context) }),
-          onDone: { target: "otp_requested", actions: "trackOtpRequested" },
-          onError: {
-            target: "otp_requested",
-            actions: [
-              assign({ error: ({ event }) => errorFromEvent2(event) }),
-              "trackFailed"
-            ]
-          }
-        },
-        after: {
-          [FLOW_INVOKE_TIMEOUT_MS]: {
-            target: "otp_requested",
-            actions: [
-              assign({ error: () => timeoutError2("sending_otp") }),
-              "trackTimeoutFailed"
-            ]
-          }
-        }
-      },
-      otp_requested: {
-        on: {
-          ENTER_OTP: {
-            actions: assign({
-              code: ({ event }) => event.code,
-              error: () => null
-            })
-          },
-          VERIFY_OTP: { target: "verifying_otp" },
-          BACK: { target: "email" },
-          RESET: { target: "email", actions: assign(() => initialContext) }
-        }
-      },
-      verifying_otp: {
-        invoke: {
-          src: "verifyOtp",
-          input: ({ context }) => ({
-            email: requireEmail2(context),
-            code: requireCode(context)
-          }),
-          onDone: [
-            {
-              guard: ({ event }) => event.output.kind === "existing_member",
-              target: "authenticated",
-              actions: [
-                assign({
-                  session: ({ event }) => event.output.session,
-                  account: ({ event }) => event.output.kind === "existing_member" ? event.output.account : null,
-                  username: ({ event }) => event.output.kind === "existing_member" ? event.output.username : null,
-                  safe: ({ event }) => event.output.kind === "existing_member" ? event.output.safe : null,
-                  email: () => null,
-                  error: () => null
-                }),
-                "trackVerified",
-                "identifyAndTrack"
-              ]
-            },
-            {
-              target: "bootstrap_required",
-              actions: [
-                assign({
-                  session: ({ event }) => event.output.session,
-                  bootstrapToken: ({ event }) => event.output.kind === "bootstrap_required" ? event.output.bootstrapToken : null,
-                  bootstrapReason: ({ event }) => event.output.kind === "bootstrap_required" ? event.output.reason : null,
-                  username: ({ event }) => event.output.kind === "bootstrap_required" ? event.output.username ?? null : null,
-                  email: ({ event }) => event.output.kind === "bootstrap_required" ? event.output.email : null,
-                  error: () => null
-                }),
-                "trackVerified",
-                "trackBootstrapRequired"
-              ]
-            }
-          ],
-          onError: {
-            target: "otp_requested",
-            actions: [
-              assign({ error: ({ event }) => errorFromEvent2(event) }),
-              "trackFailed"
-            ]
-          }
-        },
-        after: {
-          [FLOW_INVOKE_TIMEOUT_MS]: {
-            target: "otp_requested",
-            actions: [
-              assign({ error: () => timeoutError2("verifying_otp") }),
-              "trackTimeoutFailed"
-            ]
-          }
-        }
-      },
-      bootstrap_required: {
-        on: {
-          ENTER_USERNAME: {
-            actions: assign({
-              username: ({ event }) => event.username,
-              error: () => null
-            })
-          },
-          COMPLETE_BOOTSTRAP: { target: "completing_bootstrap" },
-          BACK: { target: "otp_requested" },
-          RESET: { target: "email", actions: assign(() => initialContext) }
-        }
-      },
-      completing_bootstrap: {
-        invoke: {
-          src: "completeBootstrap",
-          input: ({ context }) => ({
-            bootstrapToken: requireBootstrapToken(context),
-            username: requireUsername(context)
-          }),
-          onDone: {
-            target: "authenticated",
-            actions: [
-              assign({
-                session: ({ event }) => event.output.session,
-                account: ({ event }) => event.output.account,
-                username: ({ event }) => event.output.username,
-                safe: ({ event }) => event.output.safe,
-                bootstrapToken: () => null,
-                bootstrapReason: () => null,
-                email: () => null,
-                error: () => null
-              }),
-              "identifyAndTrack"
-            ]
-          },
-          onError: {
-            target: "bootstrap_required",
-            actions: [
-              assign({ error: ({ event }) => errorFromEvent2(event) }),
-              "trackFailed"
-            ]
-          }
-        },
-        after: {
-          [FLOW_INVOKE_TIMEOUT_MS]: {
-            target: "bootstrap_required",
-            actions: [
-              assign({ error: () => timeoutError2("completing_bootstrap") }),
-              "trackTimeoutFailed"
-            ]
-          }
-        }
-      },
-      authenticated: {
-        on: {
-          SIGN_OUT: { target: "signing_out" }
-        }
-      },
-      signing_out: {
-        invoke: {
-          src: "signOut",
-          onDone: {
-            target: "email",
-            actions: [
-              assign(() => initialContext),
-              "trackSignedOut"
-            ]
-          },
-          onError: {
-            target: "error",
-            actions: assign({ error: ({ event }) => errorFromEvent2(event) })
-          }
-        }
-      },
-      error: {
-        on: {
-          RESET: { target: "email", actions: assign(() => initialContext) }
-        }
-      }
-    }
-  });
-}
-function requireEmail2(context) {
-  if (!context.email) {
-    throw Errors.invalidInput("email", "Auth bootstrap requires an email.");
-  }
-  return context.email;
-}
-function requireCode(context) {
-  if (!context.code) {
-    throw Errors.invalidInput("code", "Auth bootstrap requires an OTP code.");
-  }
-  return context.code;
-}
-function requireBootstrapToken(context) {
-  if (!context.bootstrapToken) {
-    throw Errors.invalidInput(
-      "bootstrapToken",
-      "Auth bootstrap requires a continuation token."
-    );
-  }
-  return context.bootstrapToken;
-}
-function requireUsername(context) {
-  if (!context.username) {
-    throw Errors.invalidInput("username", "Auth bootstrap requires a username.");
-  }
-  return context.username;
-}
-function errorFromEvent2(event) {
-  const cause = typeof event === "object" && event !== null && "error" in event ? event.error : event;
-  if (cause instanceof CapxulError || cause instanceof CapxulError2) {
-    return cause;
-  }
-  return Errors.providerError("auth", "bootstrap", cause);
-}
-function timeoutError2(state) {
-  return Errors.providerError(
-    "auth",
-    "bootstrap",
-    new Error(`timeout: ${state} exceeded ${FLOW_INVOKE_TIMEOUT_MS}ms`)
-  );
-}
-function emailDomain2(email) {
-  const domain = email.split("@")[1]?.trim().toLowerCase();
-  return domain || "unknown";
-}
 function createProvisioningMachine(client) {
   return setup({
     types: {},
@@ -4026,7 +3746,7 @@ function createProvisioningMachine(client) {
         const provider = context.input?.signerProvider;
         if (!provider) return;
         track("provisioning_safe_created", {
-          safe_address: deriveSafeAddress(provider.signerAddress)
+          safe_address: deriveSafeAddress2(provider.signerAddress)
         });
       }
     }
@@ -4071,13 +3791,13 @@ function createProvisioningMachine(client) {
           },
           onError: {
             target: "error",
-            actions: assign({ error: ({ event }) => errorFromEvent3(event) })
+            actions: assign({ error: ({ event }) => errorFromEvent(event) })
           }
         },
         after: {
           [FLOW_INVOKE_TIMEOUT_MS]: {
             target: "error",
-            actions: assign({ error: () => timeoutError3() })
+            actions: assign({ error: () => timeoutError() })
           }
         }
       },
@@ -4095,7 +3815,7 @@ function createProvisioningMachine(client) {
      * this payload on its `onDone` transition and branches via guards
      * on `event.output.error`.
      */
-    output: ({ context }) => context.error ? { error: context.error } : context.account ? { account: context.account } : { error: timeoutError3() }
+    output: ({ context }) => context.error ? { error: context.error } : context.account ? { account: context.account } : { error: timeoutError() }
   });
 }
 function requireProvisionInput(context) {
@@ -4107,13 +3827,13 @@ function requireProvisionInput(context) {
   }
   return context.input;
 }
-function errorFromEvent3(event) {
+function errorFromEvent(event) {
   const cause = typeof event === "object" && event !== null && "error" in event ? event.error : event;
   if (cause instanceof CapxulError) return cause;
   if (cause instanceof CapxulError2) return cause;
   return Errors.providerError("provisioning", "flow", cause);
 }
-function timeoutError3() {
+function timeoutError() {
   return Errors.providerError(
     "provisioning",
     "flow",
@@ -4206,7 +3926,7 @@ function createOnboardingFlowMachine(client) {
         error: ({ event }) => extractChildErrorOrFallback(event)
       }),
       assignChildThrown: assign({
-        error: ({ event }) => errorFromEvent4(event)
+        error: ({ event }) => errorFromEvent2(event)
       }),
       assignAccountFromChild: assign({
         account: ({ event }) => extractChildAccountOrNull(event)
@@ -4368,7 +4088,7 @@ function extractChildAccountOrNull(event) {
   if (output && "account" in output && output.account) return output.account;
   return null;
 }
-function errorFromEvent4(event) {
+function errorFromEvent2(event) {
   const cause = typeof event === "object" && event !== null && "error" in event ? event.error : event;
   if (cause instanceof CapxulError) return cause;
   if (cause instanceof CapxulError2) return cause;
@@ -4379,7 +4099,7 @@ function errorFromEvent4(event) {
 function createCapxulClient(config = {}) {
   const clientWithoutFlows = {
     id: crypto.randomUUID(),
-    auth: createAuthClient(config),
+    auth: new AuthService(config),
     me: createMeClient(config),
     accounts: createAccountsClient(config),
     organizations: createOrganizationsClient(config),
@@ -4387,7 +4107,7 @@ function createCapxulClient(config = {}) {
     transfers: createTransfersClient(),
     tokenTransfers: createTokenTransfersClient(config),
     withdrawals: createWithdrawalsClient(config),
-    documents: createDocumentsClient(),
+    documents: createDocumentsClient(config),
     subAccounts: createSubAccountsClient(config),
     virtualAccounts: createVirtualAccountsClient(),
     virtualCards: createVirtualCardsClient(),
@@ -4399,8 +4119,6 @@ function createCapxulClient(config = {}) {
   };
   const client = clientWithoutFlows;
   client.flows = {
-    auth: () => createAuthFlowMachine(client),
-    authBootstrap: () => createAuthBootstrapFlowMachine(client),
     onboarding: () => createOnboardingFlowMachine(client),
     provisioning: () => createProvisioningMachine(client)
   };
@@ -4504,82 +4222,13 @@ function isWebhookEvent(value) {
   const candidate = value;
   return typeof candidate.id === "string" && typeof candidate.type === "string" && typeof candidate.createdAt === "string" && (candidate.operationId === void 0 || typeof candidate.operationId === "string") && (candidate.correlationId === void 0 || typeof candidate.correlationId === "string") && !!candidate.data && typeof candidate.data === "object" && !Array.isArray(candidate.data);
 }
-
-// src/core/auth-service.ts
-var AuthService = class {
-  authClient;
-  sessionStore;
-  config;
-  constructor(config = {}) {
-    this.config = config;
-    this.sessionStore = config.auth?.sessionStore ?? createMemorySessionStore2();
-    this.authClient = createAuthClient({
-      ...config,
-      auth: { ...config.auth, sessionStore: this.sessionStore }
-    });
-  }
-  async sendOtp(email) {
-    const [err] = await this.authClient.sendOtp({ email });
-    if (err) throw err;
-  }
-  async verifyOtp(email, otp) {
-    const [err, result] = await this.authClient.verifyOtp({ email, otp });
-    if (err) throw err;
-    return result;
-  }
-  async completeBootstrap(params, signer) {
-    if (signer) {
-      const tempClient = createAuthClient({
-        ...this.config,
-        signer
-      });
-      const [err2, result2] = await tempClient.completeBootstrap(params);
-      if (err2) throw err2;
-      return result2;
-    }
-    const [err, result] = await this.authClient.completeBootstrap(params);
-    if (err) throw err;
-    return result;
-  }
-  /**
-   * Clears the persisted session and, when a transport was pre-injected,
-   * drops the cached auth header.
-   *
-   * **Transport safety note:** `clearAuth()` is only invoked when
-   * `config._transport` was supplied at construction (e.g. by the React
-   * provider). If `AuthService` is instantiated directly in a Node/CLI
-   * context without an injected transport, the transport-side auth cache
-   * is the caller's responsibility.
-   */
-  async signOut() {
-    this.sessionStore.clear();
-    this.config._transport?.clearAuth();
-  }
-  async getSession() {
-    const [err, session] = await this.authClient.getSession();
-    if (err) throw err;
-    return session;
-  }
-};
-function createMemorySessionStore2() {
-  let current = null;
-  return {
-    get: () => current,
-    set: (session) => {
-      current = session;
-    },
-    clear: () => {
-      current = null;
-    }
-  };
-}
 var SignerProvisioner = class {
   provision() {
     const privateKey = generatePrivateKey();
     const signer = privateKeyToAccount(privateKey);
-    const safeAddress = deriveSafeAddress(signer.address);
+    const safeAddress = deriveSafeAddress2(signer.address);
     return { signer, safeAddress };
   }
 };
 
-export { AuthService, CapxulError, SignerProvisioner, createAuthBootstrapFlowMachine, createAuthFlowMachine, createCapxulClient, createLocalSigner, createOnboardingFlowMachine, createProvisioningMachine as createProvisioningFlowMachine, makeHttpTransport, matchAction, matchError, matchStatus, resolvePaymentToken, toAccountId, toApiKeyId, toBalanceLedgerEntryId, toDocumentId, toEmail, toExternalAccountId, toKybProfileId, toKycProfileId, toMemberId, toOperationId, toOrganizationId, toPaymentId, toPhoneNumber, toSafeId, toSubAccountId, toTokenTransferId, toTransferId, toTreasuryId, toUsername, toVirtualAccountId, toVirtualCardId, toWebhookEndpointId, toWebhookEventId, toWithdrawalId, tryCatch, verifyWebhook };
+export { AuthService, CapxulError, SignerProvisioner, createCapxulClient, createLocalSigner, createOnboardingFlowMachine, createProvisioningMachine as createProvisioningFlowMachine, makeHttpTransport, matchAction, matchError, matchStatus, resolvePaymentToken, toAccountId, toApiKeyId, toBalanceLedgerEntryId, toDocumentId, toEmail, toExternalAccountId, toKybProfileId, toKycProfileId, toMemberId, toOperationId, toOrganizationId, toPaymentId, toPhoneNumber, toSafeId, toSubAccountId, toTokenTransferId, toTransferId, toTreasuryId, toUsername, toVirtualAccountId, toVirtualCardId, toWebhookEndpointId, toWebhookEventId, toWithdrawalId, tryCatch, verifyWebhook };