@capxul/cli 4.20.0-beta.10 → 4.20.0-beta.11

package/README.md

@@ -89,29 +89,21 @@ These commands accept `--email`. Without it, they restore the protected current
 session. Organization reads accept `--org` or its alias `--org-id`. Identical
 repeated IDs are accepted. Different IDs are refused.
 
-A read without `--org` resolves one exact Organization in this order: the saved
-read default, then the recovery handle this machine recorded for the person's
-Organization journey. A recovery handle can also name an Organization whose
-setup lane still runs, which the own-access list does not carry yet; the read
-reports that exact lane, and it applies the usual current-access rule again once
-the Organization reports ready. The read refuses an Organization it cannot
-reach, and it never substitutes another one.
-
-`org use` requires an explicit Organization ID. It checks current access and
-saves a protected per-person read default. The default never grants authority.
-Each read checks current access again. Without an explicit ID or saved default,
-interactive mode asks you to select an Organization. JSON, CI, and noninteractive
-mode refuse missing scope. No command starts a signer or changes backend state.
-
-`org get` reports the canonical command `org.status`. Both member list forms
-report `org.members` and retain pending members with `accountId: null`.
-`org member get` matches the full AccountId, not a Safe address or ID prefix.
-No match returns exit 2. Duplicate matches return exit 1.
-
-`org wait` reads the same lifecycle every second until it reports `ready` or
-`failed`. It never retries setup. The timeout accepts integers from 1 to 3600
-seconds and defaults to 120. Timeout returns exit 5; interruption returns 130.
-A successful read can report a failed or pending domain state.
+A read without --org uses the saved read default, then this machine's
+recovery ID, then the one unfinished setup returned by the backend. org list
+includes unfinished founder setups. This works from a clean authenticated home.
+If more than one Organization is possible, give an exact --org. A ready
+Organization must still appear in current access.
+
+org use saves a protected per-person read default. The default grants no
+authority. Member lookup uses an exact AccountId. Reads do not sign or change
+setup state.
+
+org wait opens one exact setup subscription. It continues when needsAttention
+has a scheduled next check. It stops at ready, failed, awaitingAuthorization,
+or attention without a next check. It does not request a check or poll. The
+timeout accepts 1 to 3600 seconds and defaults to 120. A deadline returns
+CLI_DEADLINE at exit 5; Ctrl-C returns CANCELLED at exit 130.
 
 ## Invitation commands
 
@@ -175,109 +167,33 @@ returned view is the authorization-time view of the consent commit
 
 ## Organization writes
 
-`org create` and `org retry` restore the protected current session and start the
-existing command-scoped browser signer. They never read or write the saved read
-default. `org create` writes the person's Organization recovery handle. That
-handle holds the exact business handle and the exact Organization ID, and it
-holds nothing else. Local input checks run before any client, browser, or
-backend work, and they include the confirmation gate:
-
-- A noninteractive or JSON write requires `--confirm`. Without it the command
-  refuses with exit 2 before any client, browser, or mutation work.
-- A terminal write verifies the session and performs its Organization reads
-  first, then prints the resolved preview and asks a default-no prompt, even when
-  `--confirm` is supplied. Rejection refuses with exit 2. An absent session is
-  exit 3 before any preview. The browser signer is built only after confirmation
-  succeeds, so a refused write never starts it.
-
-`--email` selects the session explicitly. Otherwise the protected
-current-session pointer decides. An invalid explicit email refuses with exit 2.
-
-`--timeout-seconds` bounds the command's own wait, not backend execution. It
-accepts integers from 1 to 3600 and defaults to 120, and it is one deadline for
-the whole write: the `completeOrganization` or `retrySetup` call and the
-settlement that follows share it. While a lane settles the command reads the
-exact Organization lifecycle every second with no overlapping read. At the
-deadline the active SDK signal is aborted, so the command stops waiting and
-forwards no further signature, while the durable backend lane keeps running.
-Committed lifecycle progress is flushed first, so the Organization ID stays on
-stderr and the same Organization resumes with `org retry --org`. Exceeding the
-deadline returns exit 5.
-
-`org create` validates `--name`, the `--handle` grammar, and the ISO `--country`
-code first, and its terminal preview also lists the Organizations the person
-already has. It subscribes to the onboarding Organization-state projection, then
-completes the Organization with an explicit create intent. The first committed
-Organization ID is retained, and each committed lifecycle change is written to
-stderr before the next Organization authorization digest reaches the signer.
-JSON mode writes one newline-delimited progress object per change:
-
-```json
-{ "type": "organization.lifecycle", "organizationId": "O", "status": "settingUp" }
-```
-
-Human mode prints the full Organization ID and lifecycle status. A refused or
-failed lane still reports the Organization it is about. The command returns
-success only after an exact `org(O).getLifecycle()` read reports `ready`. It
-never saves a read default and never returns a different ready Organization.
-
-`org create` continues the Organization journey this machine already prepared.
-Before the first durable write it records the exact business handle as the safe
-recovery handle. It adds the first committed Organization ID to that handle
-before it forwards any founder authorization digest, and it keeps that handle
-after a failure, an interruption, or a ready result. A later create therefore
-resolves exactly one Organization:
-
-- The same handle resumes the exact recorded Organization. It calls the SDK
-  recovery owner once per attempt and settles the same lifecycle. It never
-  submits a second bootstrap, and it never creates a second Organization or
-  treasury.
-- A different handle refuses with exit 2 while the recorded Organization is not
-  ready. The refusal names the exact Organization.
-- A different handle creates one Organization only after the recorded
-  Organization reaches ready.
-- A recorded Organization that is already ready, and still in the person's
-  current access, returns unchanged, with no write and no signature. A ready
-  result the person can no longer reach refuses, and the committed recovery
-  handle stays recorded for exact recovery.
-- A create that continues a recorded handle checks current access before it
-  reports success. The committed Organization ID becomes durable first, so a
-  refusal or an interruption keeps the exact recovery handle, and a ready
-  lifecycle line reaches stderr only after the check resolves.
-- A terminal preview reads the recorded Organization's lifecycle only for the
-  handle that continues it. A different handle is a new creation, so an
-  unreachable recorded Organization never blocks it.
-- A handle the backend refuses is refused before any Organization write. The
-  command releases the prepared handle, so the person can correct the handle and
-  create. Every other failure keeps the handle, because its Organization may
-  already exist.
-
-The recovery line names the exact Organization and the safe handle. JSON mode
-writes it as one newline-delimited progress object:
-
-```json
-{ "type": "organization.recovery", "organizationId": "O", "handle": "acme" }
-```
-
-`org retry` stays explicit: `--org` (or its alias `--org-id`) is the one write
-scope, and no read default or recovery handle is consulted.
-
-`org retry` requires an explicit `--org` (or `--org-id`). It validates the ID
-with the public `toOrgId` constructor, reads that exact Organization's lifecycle
-for its terminal preview, resumes that same durable setup lane, then settles the
-same Organization's lifecycle. A resumed lane that asks the
-signer to reset its session clears the stale readiness, closes that browser
-bridge, and opens the next one for the same command. `org retry` never creates a
-replacement Organization and never changes the read default. An already-ready
-Organization returns that exact readiness without a signature. A conflicting
-failed or in-flight lane is preserved and refused.
-
-The result data for both commands is `{ organizationId, lifecycle }`. A known
-Organization ID on a `WRONG_STATE` refusal appears only in the SDK-supplied
-`error.details.organizationId` field, and the refusal copy names the recovery
-action instead of authentication guidance. No token, OTP, signature, or signer
-capability is ever printed. Interruption returns 130 and closes both the
-subscription and the browser bridge.
+org create and org retry use the protected current session unless --email names
+one. A JSON or noninteractive write requires --confirm. A terminal write shows
+the current Organization and recovery information, then asks a default-no
+question. The signer starts after confirmation.
+
+org create validates name, handle, and country before client work. It calls
+onboarding.beginOrganization, saves and prints the exact Organization ID,
+authorizes only an awaitingAuthorization setup, then subscribes to setup
+changes. It reports success only after ready and current access. JSON progress
+uses one line per state:
+
+    { "type": "organization.lifecycle", "organizationId": "O", "status": "processing" }
+
+org retry requires one exact --org. It authorizes only awaitingAuthorization.
+For an accepted setup it asks the backend to check the same operation hash
+through setup.resume, then subscribes. Neither command replaces a submitted
+operation. The local recovery record keeps a safe handle and Organization ID
+for convenience; the backend unfinished list supports recovery without it.
+
+--timeout-seconds sets one 1-to-3600-second deadline for the command. A
+deadline stops local work and returns exit 5. If the last observed setup has
+another automatic check scheduled, the message is "Stopped waiting.
+Organization setup continues in the background." Before acceptance or without
+a scheduled check, the message is "Stopped waiting. Read the Organization
+setup status." The error details include the safe Organization ID when known,
+last observed setup state, setup reason, and bounded provider diagnostics.
+Ctrl-C stops local work at exit 130. Neither stop writes a backend failure.
 
 ## Configuration
 

package/dist/browser/signer.js

@@ -56,8 +56,8 @@
 		"RetryAccount",
 		"CreateOrganization",
 		"AttachOrganization",
-		"RetryOrganization",
-		"LeaveOrganization"
+		"LeaveOrganization",
+		"ObserveOrganization"
 	];
 	const PRIVATE_EVENT_TAGS = [
 		"OtpSent",
@@ -73,9 +73,8 @@
 		"AccountClaiming",
 		"AccountClaimed",
 		"AccountFailed",
-		"OrgAt",
-		"OrgReady",
-		"OrgFailed"
+		"OrgSelected",
+		"OrgSelectionFailed"
 	];
 	const IDENTITY_EVENT_TAGS = [...EVENT_TAGS, ...PRIVATE_EVENT_TAGS];
 	/** Valid in every `authenticated:*` position — the pre-S1 auth machine's row. */
@@ -84,7 +83,7 @@
 		"SignOut",
 		"Reset"
 	];
-	[...SESSION_EVENTS], [...SESSION_EVENTS], [...SESSION_EVENTS], [...SESSION_EVENTS], [...SESSION_EVENTS], [...SESSION_EVENTS], [...SESSION_EVENTS], [...SESSION_EVENTS], [...SESSION_EVENTS], [...SESSION_EVENTS], [...SESSION_EVENTS];
+	[...SESSION_EVENTS], [...SESSION_EVENTS], [...SESSION_EVENTS], [...SESSION_EVENTS], [...SESSION_EVENTS], [...SESSION_EVENTS], [...SESSION_EVENTS];
 	new Set(PRIVATE_EVENT_TAGS);
 	//#endregion
 	//#region ../../packages/errors/src/secret-material.ts
@@ -4413,6 +4412,38 @@
 		}));
 	}
 	//#endregion
+	//#region ../../packages/types/src/organization-setup.ts
+	/** Backend-owned Organization setup states shared by wire and telemetry. */
+	const ORGANIZATION_SETUP_STATUSES = [
+		"awaitingAuthorization",
+		"processing",
+		"needsAttention",
+		"ready",
+		"rechecking",
+		"failed"
+	];
+	/** Closed reasons for a stored Organization setup issue. */
+	const ORGANIZATION_SETUP_REASONS = [
+		"submission_unknown",
+		"receipt_unresolved",
+		"provider_unavailable",
+		"receipt_reverted",
+		"deterministic_address_mismatch",
+		"receipt_mismatch",
+		"block_identity_changed",
+		"authority_event_mismatch",
+		"allowance_timestamp_mismatch",
+		"receipt_identity_unavailable",
+		"receipt_identity_mismatch",
+		"contract_code_unavailable",
+		"contract_state_mismatch",
+		"permission_projection_mismatch",
+		"bootstrap_reorg",
+		"dependent_authority_unresolved",
+		"historical_evidence_missing",
+		"worker_failed"
+	];
+	//#endregion
 	//#region ../../packages/types/src/index.ts
 	const ASSET_ID_RE = /^eip155:([1-9][0-9]*)\/erc20:(0x[0-9a-f]{40})$/;
 	const EVM_ADDRESS_RE$1 = /^0x[0-9a-f]{40}$/i;
@@ -18999,8 +19030,8 @@
 	* failure came from the chain path. Spread into every failure event and posted
 	* on `$exception`, so one PostHog filter finds a cause wherever it was seen.
 	*/
-	const FailureModeSchema = Literals(FAILURE_MODES$1);
-	const ChainUpstreamSchema = Literals(CHAIN_UPSTREAMS);
+	const FailureModeSchema$1 = Literals(FAILURE_MODES$1);
+	const ChainUpstreamSchema$1 = Literals(CHAIN_UPSTREAMS);
 	/**
 	* The refusing upstream's response headers (#1818): exactly the names in
 	* `RESPONSE_HEADER_ALLOWLIST`, each optional, so the catalog itself refuses a
@@ -19018,15 +19049,15 @@
 	});
 	/** One upstream tried, flat (#1818): the `chain_attempts` entry on every producer's row. */
 	const ChainAttemptSchema = Struct({
-		upstream: ChainUpstreamSchema,
-		failure_mode: FailureModeSchema,
+		upstream: ChainUpstreamSchema$1,
+		failure_mode: FailureModeSchema$1,
 		http_status: optional(Number$1),
 		rpc_code: optional(Number$1),
 		duration_ms: Number$1
 	});
 	const ChainCauseTelemetryProps = {
-		failure_mode: optional(FailureModeSchema),
-		chain_upstream: optional(ChainUpstreamSchema),
+		failure_mode: optional(FailureModeSchema$1),
+		chain_upstream: optional(ChainUpstreamSchema$1),
 		chain_method: OptionalString,
 		chain_retryable: optional(Boolean$1),
 		chain_http_status: optional(Number$1),
@@ -19210,9 +19241,9 @@
 		...TelemetryEnvelopeProps,
 		service: ChainServiceSchema,
 		method: String$1,
-		from_upstream: ChainUpstreamSchema,
-		to_upstream: optional(ChainUpstreamSchema),
-		failure_mode: FailureModeSchema,
+		from_upstream: ChainUpstreamSchema$1,
+		to_upstream: optional(ChainUpstreamSchema$1),
+		failure_mode: FailureModeSchema$1,
 		exhausted: Boolean$1,
 		http_status: optional(Number$1),
 		rpc_code: optional(Number$1),
@@ -19221,8 +19252,8 @@
 	const BundlerErrorProps = Struct({
 		...TelemetryEnvelopeProps,
 		method: String$1,
-		failure_mode: FailureModeSchema,
-		chain_upstream: ChainUpstreamSchema,
+		failure_mode: FailureModeSchema$1,
+		chain_upstream: ChainUpstreamSchema$1,
 		chain_retryable: Boolean$1,
 		http_status: optional(Number$1),
 		rpc_code: optional(Number$1),
@@ -19233,13 +19264,13 @@
 		...TelemetryEnvelopeProps,
 		service: ChainServiceSchema,
 		method: String$1,
-		chain_upstream: ChainUpstreamSchema,
+		chain_upstream: ChainUpstreamSchema$1,
 		reason: Literals(["zero_block_hash", "no_receipt"])
 	});
 	const OperationRetriedProps = Struct({
 		...TelemetryEnvelopeProps,
 		operation: String$1,
-		failure_mode: FailureModeSchema,
+		failure_mode: FailureModeSchema$1,
 		reason: optional(Literal("connection-lost-in-flight")),
 		connection_id: OptionalString,
 		connection_count: optional(Number$1),
@@ -19280,14 +19311,16 @@
 		...TelemetryEnvelopeProps,
 		$insert_id: String$1,
 		organization_id: OrgIdTelemetrySchema,
-		attempt_number: AttemptNumberSchema
+		attempt_number: AttemptNumberSchema,
+		release: optional(String$1.check(isPattern(/^[0-9a-f]{40}$/u)))
 	});
 	const OrganizationCreationReadyProps = Struct({
 		...TelemetryEnvelopeProps,
 		$insert_id: String$1,
 		organization_id: OrgIdTelemetrySchema,
 		attempt_number: AttemptNumberSchema,
-		duration_ms: DurationMsSchema$1
+		duration_ms: DurationMsSchema$1,
+		release: optional(String$1.check(isPattern(/^[0-9a-f]{40}$/u)))
 	});
 	const OrganizationCreationFailedProps = Struct({
 		...TelemetryEnvelopeProps,
@@ -19298,20 +19331,13 @@
 		stage: OnboardingStageSchema,
 		error_code: String$1,
 		retryable: Boolean$1,
+		release: optional(String$1.check(isPattern(/^[0-9a-f]{40}$/u))),
 		/** #1655: the SDK's backoff before this attempt. Absent on the first attempt. */
 		backoff_ms: optional(DurationMsSchema$1),
 		failure_reason: optional(Literals([
-			"deterministic_address_mismatch",
 			"receipt_provider_unavailable",
-			"receipt_mismatch",
 			"block_provider_unavailable",
-			"authority_event_mismatch",
-			"allowance_timestamp_mismatch",
-			"receipt_identity_unavailable",
-			"receipt_identity_mismatch",
-			"contract_code_unavailable",
-			"contract_state_mismatch",
-			"permission_projection_mismatch"
+			...ORGANIZATION_SETUP_REASONS
 		]))
 	});
 	const OnboardingIntentSchema = Literals(["personal", "organization"]);
@@ -20068,12 +20094,17 @@
 				"cancelled"
 			]),
 			duration_ms: Number$1,
+			organization_id: optional(OrgIdTelemetrySchema),
+			setup_status: optional(Literals(ORGANIZATION_SETUP_STATUSES)),
+			setup_reason: optional(Literals(ORGANIZATION_SETUP_REASONS)),
+			$groups: optional(Struct({ organization: OrgIdTelemetrySchema })),
 			error_code: optional(Literals([
 				...CAPXUL_ERROR_CODES,
 				"CLI_USAGE",
 				"CLI_CONFIG",
 				"CLI_STORAGE",
-				"CLI_DEFECT"
+				"CLI_DEFECT",
+				"CLI_DEADLINE"
 			]))
 		})
 	});
@@ -20567,14 +20598,7 @@
 			setOrgLogo: "media:setOrgLogo",
 			setProfileImage: "media:setProfileImage"
 		},
-		"org/actions": {
-			confirmBootstrap: "org/actions:confirmBootstrap",
-			prepareBootstrap: "org/actions:prepareBootstrap",
-			prepareFounderAccount: "org/actions:prepareFounderAccount",
-			readTreasury: "org/actions:readTreasury",
-			resumeBootstrapSubmission: "org/actions:resumeBootstrapSubmission",
-			submitBootstrap: "org/actions:submitBootstrap"
-		},
+		"org/actions": { readTreasury: "org/actions:readTreasury" },
 		"payroll/actions": { authorizeRun: "payroll/actions:authorizeRun" },
 		"payroll/mutations": {
 			removeGroup: "payroll/mutations:removeGroup",
@@ -20591,17 +20615,18 @@
 			authorize: "permission/queries:authorize",
 			read: "permission/queries:read"
 		},
-		"org/lifecycle": {
-			getProofReceipt: "org/lifecycle:getProofReceipt",
-			load: "org/lifecycle:load",
-			recordFailure: "org/lifecycle:recordFailure",
-			retry: "org/lifecycle:retry",
-			startOrResume: "org/lifecycle:startOrResume"
+		"org/setup": {
+			begin: "org/setup:begin",
+			get: "org/setup:get",
+			getProofReceipt: "org/setup:getProofReceipt",
+			listMine: "org/setup:listMine",
+			prepareAuthorization: "org/setup:prepareAuthorization",
+			resume: "org/setup:resume",
+			submitAuthorization: "org/setup:submitAuthorization"
 		},
 		"org/mutations": {
 			accept: "org/mutations:accept",
 			cancel: "org/mutations:cancel",
-			createOrg: "org/mutations:createOrg",
 			decline: "org/mutations:decline",
 			invite: "org/mutations:invite",
 			resend: "org/mutations:resend",
@@ -20722,6 +20747,60 @@
 		"revoke_unconfirmed"
 	];
 	//#endregion
+	//#region ../../packages/wire/src/organization-setup.ts
+	const FailureModeSchema = Literals(FAILURE_MODES$1);
+	const ChainUpstreamSchema = Literals(CHAIN_UPSTREAMS);
+	const ChainCauseSchema = Struct({
+		mode: FailureModeSchema,
+		upstream: ChainUpstreamSchema,
+		method: String$1,
+		retryable: Boolean$1,
+		httpStatus: optional(Number$1),
+		rpcCode: optional(Number$1),
+		revert: optional(Struct({
+			name: NullOr(String$1),
+			selector: String$1,
+			args: Record(String$1, String$1)
+		})),
+		providerMessage: optional(String$1),
+		attempts: optional(ArraySchema(Struct({
+			upstream: ChainUpstreamSchema,
+			mode: FailureModeSchema,
+			httpStatus: optional(Number$1),
+			rpcCode: optional(Number$1),
+			durationMs: Number$1
+		}))),
+		responseHeaders: optional(Record(String$1, String$1))
+	});
+	const ErrorSchema = Struct({
+		code: Literals(CAPXUL_ERROR_CODES),
+		message: String$1,
+		details: optional(Record(String$1, Unknown)),
+		correlationId: optional(String$1),
+		layer: optional(String$1),
+		mode: optional(FailureModeSchema),
+		chain: optional(ChainCauseSchema)
+	});
+	const OrganizationSetupIssueSchema = Struct({
+		reason: Literals(ORGANIZATION_SETUP_REASONS),
+		error: optional(ErrorSchema)
+	});
+	Struct({
+		orgId: String$1,
+		status: Literals(ORGANIZATION_SETUP_STATUSES),
+		completedAt: NullOr(Number$1),
+		lastCheckedAt: NullOr(Number$1),
+		nextCheckAt: NullOr(Number$1),
+		issue: NullOr(OrganizationSetupIssueSchema),
+		lastSendIssue: NullOr(OrganizationSetupIssueSchema),
+		recovery: Literals([
+			"authorize",
+			"checkAgain",
+			"none"
+		]),
+		phase: optional(Literals(["resolvingSubmission", "confirmingBootstrap"]))
+	});
+	//#endregion
 	//#region ../../packages/wire/src/payment-document.ts
 	const UINT256_MAX = 2n ** 256n - 1n;
 	const INT256_MIN = -(2n ** 255n);
@@ -75470,7 +75549,7 @@ ${SUCCESS}
 	TaggedError("OrgError");
 	Service()("@capxul/sdk/ports/OrgPort");
 	CAPXUL_FUNCTIONS["org/queries"].listAll, CAPXUL_FUNCTIONS["org/queries"].listRolesByOrgId, CAPXUL_FUNCTIONS["org/queries"].listMembersByOrgId, CAPXUL_FUNCTIONS["org/actions"].readTreasury;
-	CAPXUL_FUNCTIONS["org/lifecycle"].startOrResume, CAPXUL_FUNCTIONS["org/actions"].prepareFounderAccount, CAPXUL_FUNCTIONS["org/actions"].prepareBootstrap, CAPXUL_FUNCTIONS["org/actions"].submitBootstrap, CAPXUL_FUNCTIONS["org/actions"].resumeBootstrapSubmission, CAPXUL_FUNCTIONS["org/actions"].confirmBootstrap, CAPXUL_FUNCTIONS["org/lifecycle"].recordFailure, CAPXUL_FUNCTIONS["org/lifecycle"].load, CAPXUL_FUNCTIONS["org/lifecycle"].retry;
+	CAPXUL_FUNCTIONS["org/setup"].begin, CAPXUL_FUNCTIONS["org/setup"].get, CAPXUL_FUNCTIONS["org/setup"].listMine, CAPXUL_FUNCTIONS["org/setup"].resume, CAPXUL_FUNCTIONS["org/setup"].prepareAuthorization, CAPXUL_FUNCTIONS["org/setup"].submitAuthorization;
 	//#endregion
 	//#region ../../packages/sdk/src/flows/identity.ts
 	const IDENTITY_SLOT = {
@@ -75479,8 +75558,8 @@ ${SUCCESS}
 		account: "identity:account",
 		org: "identity:org"
 	};
-	IDENTITY_SLOT.session, IDENTITY_SLOT.session, IDENTITY_SLOT.session, IDENTITY_SLOT.session, IDENTITY_SLOT.session, IDENTITY_SLOT.session, IDENTITY_SLOT.auth, IDENTITY_SLOT.auth, IDENTITY_SLOT.auth, IDENTITY_SLOT.auth, IDENTITY_SLOT.auth, IDENTITY_SLOT.auth, IDENTITY_SLOT.auth, IDENTITY_SLOT.auth, IDENTITY_SLOT.auth, IDENTITY_SLOT.auth, IDENTITY_SLOT.auth, IDENTITY_SLOT.auth, IDENTITY_SLOT.account, IDENTITY_SLOT.account, IDENTITY_SLOT.account, IDENTITY_SLOT.account, IDENTITY_SLOT.account, IDENTITY_SLOT.account, IDENTITY_SLOT.account, IDENTITY_SLOT.account, IDENTITY_SLOT.org, IDENTITY_SLOT.org, IDENTITY_SLOT.org, IDENTITY_SLOT.org, IDENTITY_SLOT.org, IDENTITY_SLOT.org, IDENTITY_SLOT.org;
-	CAPXUL_FUNCTIONS["org/lifecycle"].getProofReceipt;
+	IDENTITY_SLOT.session, IDENTITY_SLOT.session, IDENTITY_SLOT.session, IDENTITY_SLOT.session, IDENTITY_SLOT.session, IDENTITY_SLOT.session, IDENTITY_SLOT.auth, IDENTITY_SLOT.auth, IDENTITY_SLOT.auth, IDENTITY_SLOT.auth, IDENTITY_SLOT.auth, IDENTITY_SLOT.auth, IDENTITY_SLOT.auth, IDENTITY_SLOT.auth, IDENTITY_SLOT.auth, IDENTITY_SLOT.auth, IDENTITY_SLOT.auth, IDENTITY_SLOT.auth, IDENTITY_SLOT.account, IDENTITY_SLOT.account, IDENTITY_SLOT.account, IDENTITY_SLOT.account, IDENTITY_SLOT.account, IDENTITY_SLOT.account, IDENTITY_SLOT.account, IDENTITY_SLOT.account, IDENTITY_SLOT.org, IDENTITY_SLOT.org, IDENTITY_SLOT.org, IDENTITY_SLOT.org, IDENTITY_SLOT.org, IDENTITY_SLOT.org;
+	CAPXUL_FUNCTIONS["org/setup"].getProofReceipt;
 	//#endregion
 	//#region ../../packages/sdk/src/surface/capxul-deps.ts
 	/** The single Context tag the atoms + public methods both resolve. */