Architecture

System overview

The contract holds the money and decides. Everything else is convenience.

Components

Agency / Client / Supplier (browser)
        │  email sign-in, EIP-712 signatures
        ▼
Next.js app on Vercel ── Privy (email login, embedded wallets)
        │            ├── Supabase (drafts, invites, profiles, terms text, tx log)
        │            └── Gmail SMTP (invites, setup links, payout notices)
        ▼
Relayer route (server key, pays gas)
        │  QuickNode RPC
        ▼
SetloPackages contract ── Paxos USDG (permit, transfers)
        │
        └── events ─▶ QuickNode Webhooks ─▶ /api/webhooks/quicknode ─▶ claimFor + payout emails

Who owns what

Component	Owns	Does not own
SetloPackages contract	Package state, funds custody, acceptance rules, credits and claims	Identity, emails, terms text
Next.js app	Screens for each role, signing, reading live state from the chain	Balances or statuses as truth
Relayer	Submitting signed actions and permissionless calls, paying gas	Any decision: it can only submit what users signed or what anyone may call
Privy	Email login, embedded wallets, signing	Funds rules
Supabase	Drafts, invites, profiles, terms text, package versions, tx log, processed events	Money: balances and statuses are always read from the contract
QuickNode	RPC reads/writes and contract event delivery	Correctness: events are deduplicated and re-checked onchain