@capxul/cli 4.20.0-beta.7 → 4.20.0-beta.8

package/dist/main.mjs

@@ -4174,11 +4174,11 @@ function encodePacked(types, values) {
 	for (let i = 0; i < types.length; i++) {
 		const type = types[i];
 		const value = values[i];
-		data.push(encode$2(type, value));
+		data.push(encode$3(type, value));
 	}
 	return concatHex(data);
 }
-function encode$2(type, value, isArray = false) {
+function encode$3(type, value, isArray = false) {
 	if (type === "address") {
 		const address = value;
 		if (!isAddress(address)) throw new InvalidAddressError({ address });
@@ -4212,7 +4212,7 @@ function encode$2(type, value, isArray = false) {
 	if (arrayMatch && Array.isArray(value)) {
 		const [_type, childType] = arrayMatch;
 		const data = [];
-		for (let i = 0; i < value.length; i++) data.push(encode$2(childType, value[i], true));
+		for (let i = 0; i < value.length; i++) data.push(encode$3(childType, value[i], true));
 		if (data.length === 0) return "0x";
 		return concatHex(data);
 	}
@@ -11001,6 +11001,18 @@ function withInvocationParentSpan(effect, controls) {
 	const parent = controls?.[INVOCATION_PARENT_SPAN];
 	return parent === void 0 ? effect : effect.pipe(Effect.withParentSpan(parent));
 }
+/**
+* The input field a refused request named.
+*
+* The surfaces that call the port directly already carry `details.field` for an
+* `INVALID_INPUT` refusal. The actor keeps that one allowlisted detail instead of
+* dropping it, so a caller sees the same refusal either way.
+*/
+const refusedInputField = (failure) => {
+	if (failure.code !== "INVALID_INPUT") return void 0;
+	const field = failure.error?.details?.field;
+	return typeof field === "string" && field.length > 0 ? { field } : void 0;
+};
 var ActorFailure = class extends Error {
 	reason;
 	machine;
@@ -11166,7 +11178,7 @@ const boot = (spec, options = {}) => Effect.gen(function* () {
 				const event = { _tag: env.origin.event };
 				const failedState = exit.failure === timeoutFailure || exit.failure === cancelledFailure ? yield* recoverFailure(state, env.origin, exit.failure) : state;
 				yield* emit(nonApplied(failedState, event, exit.failure.code, outcome, env, exit.failure));
-				const details = exit.failure === timeoutFailure ? { reason: "timeout" } : void 0;
+				const details = exit.failure === timeoutFailure ? { reason: "timeout" } : refusedInputField(exit.failure);
 				yield* failReply(held.reply, makeFailure(failedState, event, exit.failure.code, details, exit.failure.error ?? exit.failure));
 				return;
 			}
@@ -13225,7 +13237,7 @@ function subscribeActivity(deps, actor, controls, onChange) {
 }
 //#endregion
 //#region ../../packages/sdk/package.json
-var version$1 = "4.20.0-beta.7";
+var version$1 = "4.20.0-beta.8";
 //#endregion
 //#region ../../packages/sdk/src/telemetry/exception-projection.ts
 /** Fixed fallback for failures that have no safe message. */
@@ -25087,7 +25099,7 @@ function toFormData$1(obj, formData, options) {
 *
 * @returns {string} The encoded string.
 */
-function encode$1(str) {
+function encode$2(str) {
 	const charMap = {
 		"!": "%21",
 		"'": "%27",
@@ -25118,8 +25130,8 @@ prototype.append = function append(name, value) {
 };
 prototype.toString = function toString(encoder) {
 	const _encode = encoder ? function(value) {
-		return encoder.call(this, value, encode$1);
-	} : encode$1;
+		return encoder.call(this, value, encode$2);
+	} : encode$2;
 	return this._pairs.map(function each(pair) {
 		return _encode(pair[0]) + "=" + _encode(pair[1]);
 	}, "").join("&");
@@ -25134,7 +25146,7 @@ prototype.toString = function toString(encoder) {
 *
 * @returns {string} The encoded value.
 */
-function encode(val) {
+function encode$1(val) {
 	return encodeURIComponent(val).replace(/%3A/gi, ":").replace(/%24/g, "$").replace(/%2C/gi, ",").replace(/%20/g, "+");
 }
 /**
@@ -25148,7 +25160,7 @@ function encode(val) {
 */
 function buildURL(url, params, options) {
 	if (!params) return url;
-	const _encode = options && options.encode || encode;
+	const _encode = options && options.encode || encode$1;
 	const _options = utils_default.isFunction(options) ? { serialize: options } : options;
 	const serializeFn = _options && _options.serialize;
 	let serializedParams;
@@ -41029,6 +41041,7 @@ function mapBetterAuthError(operation, body) {
 		const code = typeof errBody.code === "string" ? errBody.code : "";
 		if (code === "OTP_EXPIRED") return Errors.otpExpired();
 		if (code === "INVALID_OTP") return Errors.invalidInput("otp", errBody.message ?? "invalid OTP");
+		if (code === "TOO_MANY_ATTEMPTS") return Errors.rateLimited({ resource: "better-auth/verifyOtp" });
 		if (code === "VALIDATION_ERROR" || code === "INVALID_EMAIL") return Errors.invalidInput("email", errBody.message ?? "invalid email");
 	}
 	return Errors.providerError("better-auth", operation, new Error(String(body)));
@@ -41646,6 +41659,10 @@ var BetterAuthNodeAdapter = class {
 						ok: false,
 						error: Errors.invalidInput("otp", errBody.message ?? "invalid OTP")
 					};
+					if (errBody.code === "TOO_MANY_ATTEMPTS") return {
+						ok: false,
+						error: Errors.rateLimited({ resource: "better-auth/verifyOtp" })
+					};
 				}
 			}
 			return {
@@ -45158,6 +45175,12 @@ const stderrConvexLogger = {
 	error: writeConvexDiagnostic,
 	logVerbose: () => void 0
 };
+const silentConvexLogger = {
+	log: () => void 0,
+	warn: () => void 0,
+	error: () => void 0,
+	logVerbose: () => void 0
+};
 /** Exact floor-first allowlist; every additional handler must migrate its validator first. */
 const OBSERVED_CONVEX_ACTIONS = /* @__PURE__ */ new Set([
 	"system:healthObserved",
@@ -45246,7 +45269,7 @@ var ConvexCallAdapter = class {
 		const webSocketConstructor = this.#connectionMonitor.observedWebSocketConstructor();
 		this.#client = deps.client ?? new ConvexClient(deps.convexUrl, {
 			...webSocketConstructor === void 0 ? {} : { webSocketConstructor },
-			...deps.logToStderr === true ? { logger: stderrConvexLogger } : {}
+			logger: deps.localDiagnostics === true ? stderrConvexLogger : silentConvexLogger
 		});
 		this.#tokenProvider = deps.tokenProvider;
 		this.#applicationId = deps.applicationId;
@@ -51040,7 +51063,7 @@ function productionAuthCacheLayer(input) {
 function productionConvexCallLayer(input, refreshConvexAuthRef) {
 	return Layer.unwrap(Effect.map(AuthClientPortTag, (authClient) => ConvexCallLayer({
 		convexUrl: input.runtimeUrls.convexUrl,
-		logToStderr: input.runtime === "node",
+		localDiagnostics: input.localDiagnostics,
 		...input.applicationId === void 0 ? {} : { applicationId: input.applicationId },
 		...input.observation === void 0 ? {} : { observation: input.observation },
 		...input.convexClient === void 0 ? {} : { client: input.convexClient },
@@ -51079,6 +51102,7 @@ function resolveProductionObservability(input) {
 	};
 }
 async function createProductionAdapters(input) {
+	const localDiagnostics = productionLocalDiagnostics(input);
 	const { observation, telemetry, invocationObservation, invocationTelemetry } = resolveProductionObservability(input);
 	const resolvedInput = resolveInput(input);
 	if (!resolvedInput.ok) return resolvedInput;
@@ -51149,6 +51173,7 @@ async function createProductionAdapters(input) {
 		const portsLayer = mergeProductionAdapterLayers(makeProductionAdapterLayerEntries({
 			bootstrap,
 			runtime: resolvedInput.value.runtime,
+			localDiagnostics,
 			...resolvedInput.value.origin === void 0 ? {} : { origin: resolvedInput.value.origin },
 			runtimeUrls: runtimeUrls.value,
 			chainId: bootstrapResult.value.chainId,
@@ -51163,7 +51188,7 @@ async function createProductionAdapters(input) {
 			...input.signal === void 0 ? {} : { signal: input.signal },
 			...input.resetSignerSession === void 0 ? {} : { resetSignerSession: input.resetSignerSession }
 		}));
-		const applicationLayer = Layer.merge(portsLayer, optionalEngineeringTelemetryLayer(bootstrapResult.value.engineeringTelemetry, resolvedInput.value.runtime, hostEngineeringPolicy(input.observability))).pipe(Layer.provideMerge(resolvedInput.value.runtime === "node" ? Layer.succeed(Logger.LogToStderr, true) : Layer.empty));
+		const applicationLayer = Layer.merge(portsLayer, optionalEngineeringTelemetryLayer(bootstrapResult.value.engineeringTelemetry, resolvedInput.value.runtime, hostEngineeringPolicy(input.observability))).pipe(Layer.provideMerge(localDiagnosticsLayer(localDiagnostics, resolvedInput.value.runtime)));
 		const context = await Effect.runPromise(Layer.buildWithScope(applicationLayer, scope));
 		const collected = await Effect.runPromise(collectProductionFlowPorts.pipe(Effect.provide(context)));
 		const indexerUrl = input.indexerUrl ?? bootstrapResult.value.indexerUrl;
@@ -51227,6 +51252,13 @@ function optionalEngineeringTelemetryLayer(policy, runtime, hostPolicy) {
 		return Layer.empty;
 	}
 }
+function localDiagnosticsLayer(enabled, runtime) {
+	if (!enabled) return Logger.layer([]);
+	return runtime === "node" ? Layer.succeed(Logger.LogToStderr, true) : Layer.empty;
+}
+function productionLocalDiagnostics(input) {
+	return input.localDiagnostics !== false;
+}
 function refreshConvexAuthOnSession(authClient, refresh) {
 	return {
 		...authClient,
@@ -51291,7 +51323,7 @@ async function createCapxulClientWithSignerControls(input, controls) {
 			runtime,
 			authBaseUrl: resolvedAuthBaseUrl,
 			createBrowserSigner: createOpenfortBrowserSignerFromBootstrap,
-			diagnostic: new EffectLogDiagnosticAdapter(adapters.value.context, new ConsoleDiagnosticAdapter()),
+			diagnostic: new EffectLogDiagnosticAdapter(adapters.value.context, productionLocalDiagnostics(input) ? new ConsoleDiagnosticAdapter() : void 0),
 			signer: input.signer,
 			factory: input.openfortSignerFactory,
 			finalSign: controls.signUserOpHash,
@@ -51663,8 +51695,8 @@ function captureException(telemetry, error, context) {
 }
 //#endregion
 //#region src/version.ts
-const cliVersion = "4.20.0-beta.7";
-const sdkVersion = "4.20.0-beta.7";
+const cliVersion = "4.20.0-beta.8";
+const sdkVersion = "4.20.0-beta.8";
 const ReleaseVersion = Schema.String.check(Schema.isMaxLength(256), Schema.isPattern(/^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)(?:-((?:0|[1-9]\d*|\d*[a-zA-Z-][0-9a-zA-Z-]*)(?:\.(?:0|[1-9]\d*|\d*[a-zA-Z-][0-9a-zA-Z-]*))*))?(?:\+[0-9a-zA-Z-]+(?:\.[0-9a-zA-Z-]+)*)?$/u)).pipe(Schema.brand("CliReleaseVersion"));
 const parts = (version) => {
 	const [core = "", ...prerelease] = version.split("+")[0].split("-");
@@ -52193,7 +52225,7 @@ const finishUpdateCheck = Effect.fn(function* (directory, attempt, target) {
 });
 //#endregion
 //#region src/platform/collection-policy.ts
-const decode$2 = Schema.decodeUnknownOption(Schema.fromJsonString(Settings), { onExcessProperty: "error" });
+const decode$3 = Schema.decodeUnknownOption(Schema.fromJsonString(Settings), { onExcessProperty: "error" });
 const missing = (error) => error instanceof Error && "code" in error && error.code === "ENOENT";
 const resolveProtectedDirectory = (directory, uid) => {
 	const stateDirectory = lstatSync(directory, { throwIfNoEntry: false });
@@ -52237,7 +52269,7 @@ const collectionPolicy = (settingsPath, forcedDisabled) => () => {
 			length += count;
 		}
 		if (length > 65536) return false;
-		const settings = decode$2(bytes.toString("utf8", 0, length));
+		const settings = decode$3(bytes.toString("utf8", 0, length));
 		return Option.isSome(settings) && settings.value.collection.enabled;
 	} catch {
 		return false;
@@ -52258,9 +52290,31 @@ var CliFailure = class extends Data.TaggedError("CliFailure") {};
 */
 const WRONG_STATE_MESSAGE = "The command cannot run from the current state.";
 const ORGANIZATION_WRONG_STATE_MESSAGE = "The Organization cannot run this command from its current state. Resume that exact Organization with capxul org retry --org instead of creating a replacement.";
+const PERSONAL_ACCOUNT_WRONG_STATE_MESSAGE = "The personal Account cannot run this command from its current state. Resume the same Account and Profile with capxul auth signup instead of creating a replacement.";
 const INPUT_MESSAGE = "The input was refused. Check the email and verification code, or request a new code.";
+const PROFILE_INPUT_MESSAGE = "The Profile input was refused. Correct the display name, country, or handle, then run capxul auth signup again.";
+const HANDLE_INPUT_MESSAGE = "That handle is not available. Choose another handle, then run capxul auth signup again.";
 const organizationCommand = (command) => command === "org" || command?.startsWith("org.") === true;
 /**
+* The authentication journey family. A Profile or personal Account refusal is
+* not an email or verification-code problem, so it never reuses OTP copy.
+*/
+const authCommand = (command) => command === "auth" || command?.startsWith("auth.") === true;
+/** The Profile fields a personal signup states. */
+const PROFILE_FIELDS = /* @__PURE__ */ new Set([
+	"profile",
+	"displayName",
+	"country",
+	"countryCode",
+	"handle"
+]);
+const authInputMessage = (error) => {
+	const field = typeof error.details?.field === "string" ? error.details.field : "";
+	if (field === "handle") return HANDLE_INPUT_MESSAGE;
+	if (PROFILE_FIELDS.has(field)) return PROFILE_INPUT_MESSAGE;
+	return INPUT_MESSAGE;
+};
+/**
 * The one allowlist. Only a WRONG_STATE whose SDK details carry an Organization
 * ID the public constructor accepts emits that ID, and it never enters message
 * text or valid states. No other error detail reaches terminal output, and a
@@ -52310,7 +52364,7 @@ function classifyFailure(cause, command) {
 		const details = allowlistedDetails(error);
 		return {
 			code: error.code,
-			message: auth ? "Authentication is required." : denied ? "This action is not permitted." : wrongState ? organizationCommand(command) ? ORGANIZATION_WRONG_STATE_MESSAGE : WRONG_STATE_MESSAGE : input ? INPUT_MESSAGE : "The Capxul request failed.",
+			message: auth ? "Authentication is required." : denied ? "This action is not permitted." : wrongState ? organizationCommand(command) ? ORGANIZATION_WRONG_STATE_MESSAGE : authCommand(command) ? PERSONAL_ACCOUNT_WRONG_STATE_MESSAGE : WRONG_STATE_MESSAGE : input ? authCommand(command) ? authInputMessage(error) : INPUT_MESSAGE : "The Capxul request failed.",
 			exitCode: auth ? 3 : denied ? 4 : input || wrongState ? 2 : 5,
 			outcome: auth || denied || input || wrongState ? "refused" : "failed",
 			...details === void 0 ? {} : { details }
@@ -52330,7 +52384,7 @@ function parsedCommand(cause) {
 //#endregion
 //#region src/runtime/config.ts
 const bundledKey = Redacted.make("cap_pk_test_DXF9C0HPKB9GPQX5C6RDP6NXKZG1B0D7");
-const bundledOrigin = "https://site.preview.abuusama.dev";
+const bundledOrigin = "https://api.staging.capxul.com";
 const defaultHost = "https://us.i.posthog.com";
 const defaultProjectToken = Redacted.make("phc_BZuAVofrkNXzwpJkuDG7Rdfurir45fj2dudQvJZk847e");
 const optionalText$1 = (name) => Config.option(Config.string(name));
@@ -53005,9 +53059,14 @@ const runCommand = (options, work) => Effect.gen(function* () {
 //#endregion
 //#region src/platform/capxul.ts
 const resultValue = (result) => result.ok ? Effect.succeed(result.value) : Effect.fail(result.error);
+const localDiagnosticsEnabled = (args) => args.some((arg, index) => arg === "--log-level=debug" || arg === "--logLevel=debug" || (arg === "--log-level" || arg === "--logLevel") && args[index + 1] === "debug");
 const acquireClient = (input, onFinalize) => Effect.uninterruptibleMask((restore) => Effect.gen(function* () {
+	const runtime = yield* CliRuntime;
 	const created = yield* restore(Effect.promise(async (signal) => {
-		const result = await createCapxulClient(input);
+		const result = await createCapxulClient({
+			...input,
+			localDiagnostics: localDiagnosticsEnabled(runtime.args ?? [])
+		});
 		if (signal.aborted && result.ok) await result.value.close();
 		return result;
 	}));
@@ -53166,11 +53225,11 @@ const CurrentSession = Schema.Struct({
 		authUserId: Schema.NonEmptyString
 	}))
 });
-const decode$1 = (value) => Schema.decodeUnknownEffect(Schema.fromJsonString(CurrentSession), { onExcessProperty: "error" })(value).pipe(Effect.mapError(() => new StateFileError({ reason: "Corrupt" })));
+const decode$2 = (value) => Schema.decodeUnknownEffect(Schema.fromJsonString(CurrentSession), { onExcessProperty: "error" })(value).pipe(Effect.mapError(() => new StateFileError({ reason: "Corrupt" })));
 const readCurrentSession = (config) => Effect.gen(function* () {
 	const { directory, scope } = yield* privateRecordScope(config, "current-session", "current");
 	const value = yield* readPrivateRecord(directory, scope);
-	return value === null ? null : (yield* decode$1(value)).current;
+	return value === null ? null : (yield* decode$2(value)).current;
 });
 const rememberCurrentSession = (config, session, stillAuthenticated) => Effect.gen(function* () {
 	const { directory, scope } = yield* privateRecordScope(config, "current-session", "current");
@@ -53183,7 +53242,7 @@ const rememberCurrentSession = (config, session, stillAuthenticated) => Effect.g
 	};
 	for (let attempt = 0; attempt < 2; attempt += 1) {
 		const expected = yield* readPrivateRecord(directory, scope);
-		if (expected !== null) yield* decode$1(expected);
+		if (expected !== null) yield* decode$2(expected);
 		if (yield* compareAndSetPrivateRecord(directory, scope, expected, JSON.stringify(next), stillAuthenticated)) return;
 		if (!(yield* stillAuthenticated)) break;
 	}
@@ -53193,7 +53252,7 @@ const forgetCurrentSession = (config, email, stillCleared) => Effect.gen(functio
 	const { directory, scope } = yield* privateRecordScope(config, "current-session", "current");
 	const expected = yield* readPrivateRecordSnapshot(directory, scope);
 	if (expected === null) return false;
-	if ((yield* decode$1(expected)).current?.email !== email.toLowerCase()) return false;
+	if ((yield* decode$2(expected)).current?.email !== email.toLowerCase()) return false;
 	return yield* compareAndSetPrivateRecord(directory, scope, expected, JSON.stringify({
 		version: 1,
 		current: null
@@ -53210,48 +53269,118 @@ const inputRequired = (message) => new CliFailure({
 const readEmail = (email) => Effect.gen(function* () {
 	const runtime = yield* CliRuntime;
 	if (email === void 0) {
-		if (!runtime.tty || runtime.ci || runtime.mode === "json") return yield* Effect.fail(inputRequired("Provide --email. Use auth send, then auth verify --otp-stdin for non-interactive login."));
+		if (!runtime.tty || runtime.ci || runtime.mode === "json") return yield* Effect.fail(inputRequired("Provide --email."));
 		email = yield* Prompt.text({ message: "Email" });
 	}
 	const normalized = email.trim().toLowerCase();
 	if (!/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(normalized)) return yield* Effect.fail(inputRequired("Provide a valid email."));
 	return normalized;
 });
+const OTP_INPUT_ERROR = "OTP input must contain six digits only.";
+const OTP_BOUNDARY_MARKS = /^[\s\p{Cf}]+|[\s\p{Cf}]+$/gu;
+const normalizeOtpInput = (input) => {
+	if (new TextEncoder().encode(input).byteLength > 64) return null;
+	const normalized = input.replace(OTP_BOUNDARY_MARKS, "");
+	return /^[0-9]{6}$/.test(normalized) ? normalized : null;
+};
 const readOtp = (stdin) => Effect.gen(function* () {
 	const runtime = yield* CliRuntime;
 	if (!stdin) {
 		if (!runtime.tty || runtime.ci || runtime.mode === "json") return yield* Effect.fail(inputRequired("Provide the OTP on stdin with --otp-stdin; OTP arguments are not accepted."));
-		return Redacted.value(yield* Prompt.hidden({ message: "Email verification code" }));
+		return Redacted.value(yield* Prompt.password({
+			message: "Email OTP",
+			validate: (input) => {
+				const normalized = normalizeOtpInput(input);
+				return normalized === null ? Effect.fail(OTP_INPUT_ERROR) : Effect.succeed(normalized);
+			}
+		}));
 	}
 	const stdio = yield* Stdio.Stdio;
 	let length = 0;
 	const chunks = yield* stdio.stdin.pipe(Stream.mapEffect((chunk) => {
 		length += chunk.byteLength;
-		return length > 64 ? Effect.fail(inputRequired("OTP input must contain six digits only.")) : Effect.succeed(chunk);
+		return length > 64 ? Effect.fail(inputRequired(OTP_INPUT_ERROR)) : Effect.succeed(chunk);
 	}), Stream.decodeText(), Stream.runCollect);
-	const code = Array.from(chunks).join("").trim();
-	if (!/^\d{6}$/.test(code)) return yield* Effect.fail(inputRequired("OTP input must contain six digits only."));
+	const code = normalizeOtpInput(Array.from(chunks).join(""));
+	if (code === null) return yield* Effect.fail(inputRequired(OTP_INPUT_ERROR));
 	return code;
 });
-const readRequired = (label, flag, supplied) => Effect.gen(function* () {
-	const runtime = yield* CliRuntime;
-	let value = supplied;
-	if (value === void 0) {
-		if (!runtime.tty || runtime.ci || runtime.mode === "json") return yield* Effect.fail(inputRequired(`Provide --${flag}.`));
-		value = yield* Prompt.text({ message: label });
+const PROFILE_FLAGS = {
+	displayName: "--display-name",
+	country: "--country",
+	handle: "--handle"
+};
+const PROFILE_REFUSALS = {
+	displayName: "Provide --display-name with at least one visible character.",
+	country: "Provide --country as a two-letter ISO country code, for example GH.",
+	handle: "Provide --handle as 3 to 30 characters of a-z, 0-9, underscore, or hyphen."
+};
+/**
+* Accept one Profile value, or return the refusal that names its field.
+*
+* Country and handle use the public SDK constructors, so the CLI accepts
+* exactly the values the backend stores. A handle loses its leading `@` and
+* its case before the check, which is the canon spelling the owner persists.
+*/
+const acceptPersonField = (field, raw) => {
+	const trimmed = raw.trim();
+	if (trimmed.length === 0) return { refusal: inputRequired(PROFILE_REFUSALS[field]) };
+	try {
+		if (field === "country") return { value: toCountryCode(trimmed) };
+		if (field === "handle") return { value: toHandle(trimmed.replace(/^@/u, "").toLowerCase()) };
+		return { value: trimmed };
+	} catch {
+		return { refusal: inputRequired(PROFILE_REFUSALS[field]) };
+	}
+};
+/**
+* Validate the Profile values a caller supplied, before any client work.
+*
+* `auth signup` runs this first, so a malformed value refuses locally and
+* consumes no one-time code. An absent field stays with `readPersonInput`,
+* which prompts on a terminal and refuses headlessly.
+*/
+const checkPersonFlags = (flags) => Effect.gen(function* () {
+	for (const field of [
+		"displayName",
+		"country",
+		"handle"
+	]) {
+		const supplied = flags[field];
+		if (supplied === void 0) continue;
+		const accepted = acceptPersonField(field, supplied);
+		if ("refusal" in accepted) return yield* Effect.fail(accepted.refusal);
 	}
-	const trimmed = value.trim();
-	if (trimmed.length === 0) return yield* Effect.fail(inputRequired(`Provide --${flag}.`));
-	return trimmed;
+});
+/**
+* One required Profile field.
+*
+* A non-interactive run accepts only the explicit flag, so headless signup is
+* deterministic and never prompts. An interactive run prompts, and offers the
+* existing Profile value as the default so a continuation keeps it.
+*/
+const readRequired = (label, field, supplied, existing) => Effect.gen(function* () {
+	const runtime = yield* CliRuntime;
+	if (!runtime.tty || runtime.ci || runtime.mode === "json") {
+		if (supplied === void 0) return yield* Effect.fail(inputRequired(`Provide ${PROFILE_FLAGS[field]}.`));
+		const accepted = acceptPersonField(field, supplied);
+		if ("refusal" in accepted) return yield* Effect.fail(accepted.refusal);
+		return accepted.value;
+	}
+	const fallback = supplied ?? existing;
+	const value = yield* Prompt.text({
+		message: label,
+		...fallback === void 0 || fallback.trim().length === 0 ? {} : { default: fallback }
+	});
+	const accepted = acceptPersonField(field, value);
+	if ("refusal" in accepted) return yield* Effect.fail(accepted.refusal);
+	return accepted.value;
 });
 const readPersonInput = (flags, profile) => Effect.gen(function* () {
-	const displayName = yield* readRequired("Display name", "display-name", flags.displayName ?? profile?.displayName ?? void 0);
-	const country = yield* readRequired("Country code", "country", flags.country ?? profile?.country ?? void 0);
-	const handle = yield* readRequired("Handle", "handle", flags.handle ?? profile?.handle ?? void 0);
 	return {
-		displayName,
-		country: country.toUpperCase(),
-		handle
+		displayName: yield* readRequired("Display name", "displayName", flags.displayName, profile?.displayName ?? void 0),
+		country: yield* readRequired("Country code", "country", flags.country, profile?.country ?? void 0),
+		handle: yield* readRequired("Handle", "handle", flags.handle, profile?.handle ?? void 0)
 	};
 });
 //#endregion
@@ -53928,6 +54057,17 @@ const verifiedSession = (client, email) => Effect.gen(function* () {
 	if (session === null || session.email.toLowerCase() !== email) return yield* Effect.fail(Errors.notAuthenticated());
 	return session;
 });
+const submitOtp = (otpStdin, verify) => Effect.gen(function* () {
+	const submissionLimit = otpStdin ? 1 : 3;
+	for (let submission = 1; submission <= submissionLimit; submission += 1) {
+		const code = yield* readOtp(otpStdin);
+		const result = yield* Effect.result(verify(code));
+		if (Result.isSuccess(result)) return;
+		const error = result.failure;
+		if (!(error.code === "INVALID_INPUT" && error.details?.field === "otp") || submission === submissionLimit) return yield* Effect.fail(error);
+		yield* writeStderr("Invalid OTP. Try again.\n");
+	}
+});
 /**
 * Local authentication checks only: the current-session pointer, the explicit
 * email, and a stored credential. No bootstrap, client, or network work. A
@@ -54005,6 +54145,60 @@ const flushWalletDiagnostics = (bridge, invocationId) => Effect.suspend(() => br
 	invocation_id: invocationId,
 	journey_id: invocationId
 }), { discard: true }));
+const SIGNUP_OTP_INPUT_REQUIRED = "Use --otp-stdin for non-interactive signup. OTP arguments are not accepted.";
+/**
+* One account-setup continuation: profile input, then wallet and Account work.
+*
+* `signup` calls this after authentication. An interactive `login` calls it
+* only after the person accepts the setup offer. A headless `login` never calls
+* it, so sign-in cannot become signup.
+*
+* The step returns a ready report only. When the personal Account is not ready,
+* it returns a typed recoverable report: `setupState` names the state, the
+* lifecycle carries the failure code, and the copy names the exact resume
+* action. The step never starts wallet work for a ready Account, so a retry
+* reuses the one Profile, wallet, Smart Account, and Account.
+*/
+const completeAccountSetup = (config, store, client, session, suppliedProfile) => Effect.gen(function* () {
+	const current = yield* call((signal) => client.identity.loadCurrent({ signal }));
+	const before = yield* profileReport(client, session);
+	if (before.data.setupState === "ready") return before;
+	const profile = yield* readPersonInput(suppliedProfile, current);
+	const runtime = yield* CliRuntime;
+	const run = Effect.runPromiseWith(yield* Effect.context());
+	let bridge;
+	const invocation = yield* Ref.get(runtime.current);
+	const openfortSignerFactory = (bootstrap) => {
+		const created = createBrowserSignerBridge({
+			bootstrap,
+			environment: config.environment,
+			handle: () => profile.handle,
+			trustedAuthOrigin: new URL(config.bootstrapBaseUrl).origin,
+			sessionToken: () => run(store.tokenIfCurrent())
+		});
+		bridge = created;
+		invocation?.onFinalize?.(Effect.promise(() => created.close()).pipe(Effect.asVoid, Effect.catchCause(() => Effect.void)));
+		return created.signer;
+	};
+	const walletClient = yield* clientFor(config, store, {
+		restore: true,
+		requirement: "deployed",
+		openfortSignerFactory
+	});
+	const verified = yield* verifiedSession(walletClient, session.email);
+	yield* writeStderr("Preparing your wallet in the browser. Keep that tab open.\n");
+	const report = yield* Effect.gen(function* () {
+		yield* call((signal) => walletClient.onboarding.completePerson(profile, { signal }));
+		return yield* profileReport(walletClient, verified);
+	}).pipe(Effect.ensuring(Effect.suspend(() => flushWalletDiagnostics(bridge, runtime.invocationId))));
+	return {
+		data: {
+			...report.data,
+			signerStatus: walletClient.signer.status()
+		},
+		lines: report.lines
+	};
+});
 const sendOtp = (config, suppliedEmail) => Effect.gen(function* () {
 	const email = yield* readEmail(suppliedEmail);
 	const store = yield* openSessionRecord(config, email);
@@ -54029,7 +54223,6 @@ const verifyOtp = (config, suppliedEmail, otpStdin) => Effect.gen(function* () {
 	const store = yield* openSessionRecord(config, email);
 	const flow = store.current().flow;
 	if (flow === null || flow.email !== email) return yield* Effect.fail(inputRequired("No pending OTP. Run auth send --email <email> first."));
-	const code = yield* readOtp(otpStdin);
 	const client = yield* clientFor(config, store, { restore: false });
 	yield* call((signal) => client.auth.getSession({ signal }));
 	yield* call((signal) => client.auth.resumeOtp({
@@ -54039,13 +54232,13 @@ const verifyOtp = (config, suppliedEmail, otpStdin) => Effect.gen(function* () {
 		signal,
 		journey_id: flow.journeyId
 	}));
-	yield* call((signal) => client.auth.verifyOtp({
+	yield* submitOtp(otpStdin, (code) => call((signal) => client.auth.verifyOtp({
 		email,
 		code
 	}, {
 		signal,
 		journey_id: flow.journeyId
-	}));
+	})));
 	const session = yield* verifiedSession(client, email);
 	yield* bindPerson(config, store, session);
 	const report = yield* profileReport(client, session);
@@ -54060,95 +54253,64 @@ const verifyOtp = (config, suppliedEmail, otpStdin) => Effect.gen(function* () {
 const login = (config, suppliedEmail, otpStdin) => Effect.gen(function* () {
 	const email = yield* readEmail(suppliedEmail);
 	const runtime = yield* CliRuntime;
-	if (!otpStdin && (!runtime.tty || runtime.ci || runtime.mode === "json")) return yield* Effect.fail(inputRequired("Use auth send, then auth verify --otp-stdin. Interactive login reads the OTP without echo."));
+	if (!otpStdin && (!runtime.tty || runtime.ci || runtime.mode === "json")) return yield* Effect.fail(inputRequired("Provide the OTP on stdin with --otp-stdin. Use capxul auth send, then capxul auth verify, to split sign-in across two commands."));
 	const store = yield* openSessionRecord(config, email);
 	const client = yield* clientFor(config, store, { restore: false });
 	yield* call((signal) => client.auth.getSession({ signal }));
 	yield* store.begin(yield* Clock.currentTimeMillis, runtime.invocationId);
 	yield* call((signal) => client.auth.signIn({ email }, { signal }));
 	yield* writeStderr("Verification email sent. Enter the code to continue.\n");
-	const code = yield* readOtp(otpStdin);
-	yield* call((signal) => client.auth.verifyOtp({
+	yield* submitOtp(otpStdin, (code) => call((signal) => client.auth.verifyOtp({
 		email,
 		code
 	}, {
 		signal,
 		journey_id: runtime.invocationId
-	}));
+	})));
 	const session = yield* verifiedSession(client, email);
 	yield* bindPerson(config, store, session);
-	return yield* profileReport(client, session);
+	const report = yield* profileReport(client, session);
+	if (report.data.setupState === "ready") return report;
+	if (!runtime.tty || runtime.ci || runtime.mode === "json") return report;
+	if (!(yield* Prompt.confirm({
+		message: "Your Capxul account is not set up yet. Continue setup now?",
+		initial: false
+	}))) return report;
+	return yield* completeAccountSetup(config, store, client, session, {});
 });
 const signup = (config, suppliedEmail, otpStdin, suppliedProfile) => Effect.gen(function* () {
 	const email = yield* readEmail(suppliedEmail);
 	const runtime = yield* CliRuntime;
+	yield* checkPersonFlags(suppliedProfile);
 	const store = yield* openSessionRecord(config, email);
-	const run = Effect.runPromiseWith(yield* Effect.context());
 	const restore = store.current().token !== null;
-	let handle = suppliedProfile.handle ?? "personal";
-	let bridge;
+	if (!restore && !otpStdin && (!runtime.tty || runtime.ci || runtime.mode === "json")) return yield* Effect.fail(inputRequired(SIGNUP_OTP_INPUT_REQUIRED));
 	let client = yield* clientFor(config, store, { restore });
 	let session = restore ? yield* verifiedSession(client, email).pipe(Effect.catch((error) => error.code === "NOT_AUTHENTICATED" ? store.clear.pipe(Effect.as(null)) : Effect.fail(error))) : null;
 	if (session === null) {
 		if (restore) client = yield* clientFor(config, store, { restore: false });
-		if (!otpStdin && (!runtime.tty || runtime.ci || runtime.mode === "json")) return yield* Effect.fail(inputRequired("Use --otp-stdin for non-interactive signup. OTP arguments are not accepted."));
+		if (!otpStdin && (!runtime.tty || runtime.ci || runtime.mode === "json")) return yield* Effect.fail(inputRequired(SIGNUP_OTP_INPUT_REQUIRED));
 		yield* call((signal) => client.auth.getSession({ signal }));
 		yield* store.begin(yield* Clock.currentTimeMillis, runtime.invocationId);
 		yield* call((signal) => client.auth.signIn({ email }, { signal }));
 		yield* writeStderr("Verification email sent. Enter the code to continue.\n");
-		const code = yield* readOtp(otpStdin);
-		yield* call((signal) => client.auth.verifyOtp({
+		yield* submitOtp(otpStdin, (code) => call((signal) => client.auth.verifyOtp({
 			email,
 			code
 		}, {
 			signal,
 			journey_id: runtime.invocationId
-		}));
+		})));
 		session = yield* verifiedSession(client, email);
 	}
 	yield* bindPerson(config, store, session);
-	const current = yield* call((signal) => client.identity.loadCurrent({ signal }));
-	const before = yield* profileReport(client, session);
-	if (before.data.setupState === "ready") return before;
-	const profile = yield* readPersonInput(suppliedProfile, current);
-	handle = profile.handle;
-	const invocation = yield* Ref.get(runtime.current);
-	const openfortSignerFactory = (bootstrap) => {
-		const created = createBrowserSignerBridge({
-			bootstrap,
-			environment: config.environment,
-			handle: () => handle,
-			trustedAuthOrigin: new URL(config.bootstrapBaseUrl).origin,
-			sessionToken: () => run(store.tokenIfCurrent())
-		});
-		bridge = created;
-		invocation?.onFinalize?.(Effect.promise(() => created.close()).pipe(Effect.asVoid, Effect.catchCause(() => Effect.void)));
-		return created.signer;
-	};
-	const walletClient = yield* clientFor(config, store, {
-		restore: true,
-		requirement: "deployed",
-		openfortSignerFactory
-	});
-	session = yield* verifiedSession(walletClient, email);
-	yield* writeStderr("Preparing your wallet in the browser. Keep that tab open.\n");
-	const report = yield* Effect.gen(function* () {
-		yield* call((signal) => walletClient.onboarding.completePerson(profile, { signal }));
-		return yield* profileReport(walletClient, session);
-	}).pipe(Effect.ensuring(Effect.suspend(() => flushWalletDiagnostics(bridge, runtime.invocationId))));
-	return {
-		data: {
-			...report.data,
-			signerStatus: walletClient.signer.status()
-		},
-		lines: report.lines
-	};
+	return yield* completeAccountSetup(config, store, client, session, suppliedProfile);
 });
 const readProfile = (config, suppliedEmail) => Effect.gen(function* () {
 	const email = yield* readEmail(suppliedEmail);
 	const store = yield* openSessionRecord(config, email);
 	if (store.current().token === null) {
-		if (usableGrant(yield* loadGrant(config, email))) return yield* Effect.fail(inputRequired("A legacy account:read grant is stored. Run auth login or auth send/verify to explicitly establish a broader first-party session."));
+		if (usableGrant(yield* loadGrant(config, email))) return yield* Effect.fail(inputRequired("Sign in again with capxul auth login to use this command."));
 		return yield* Effect.fail(Errors.notAuthenticated());
 	}
 	const client = yield* clientFor(config, store, { restore: true });
@@ -54207,11 +54369,11 @@ const logout = (config, suppliedEmail) => Effect.gen(function* () {
 });
 //#endregion
 //#region src/commands/auth.ts
-const emailFlag$3 = Flag.string("email").pipe(Flag.withDescription("Account email"), Flag.optional);
-const otpStdinFlag = Flag.boolean("otp-stdin").pipe(Flag.withDefault(false), Flag.withDescription("Read the six-digit OTP from stdin; never pass it as an argument"));
-const displayNameFlag = Flag.string("display-name").pipe(Flag.withDescription("Profile display name"), Flag.optional);
-const countryFlag = Flag.string("country").pipe(Flag.withDescription("Two-letter ISO country code"), Flag.optional);
-const handleFlag = Flag.string("handle").pipe(Flag.withDescription("Globally unique Capxul handle"), Flag.optional);
+const emailFlag$3 = Flag.string("email").pipe(Flag.withDescription("Email address"), Flag.optional);
+const otpStdinFlag = Flag.boolean("otp-stdin").pipe(Flag.withDefault(false), Flag.withDescription("Read the six-digit OTP from standard input; never pass it as an argument"));
+const displayNameFlag = Flag.string("display-name").pipe(Flag.withDescription("Your display name"), Flag.optional);
+const countryFlag = Flag.string("country").pipe(Flag.withDescription("Two-letter country code"), Flag.optional);
+const handleFlag = Flag.string("handle").pipe(Flag.withDescription("Your unique Capxul handle"), Flag.optional);
 const metadata$4 = (name) => ({
 	name,
 	capability: "authentication",
@@ -54223,7 +54385,7 @@ const loginCommand = Command.make("login", {
 }, ({ email, otpStdin }) => runCommand({
 	...metadata$4("auth.login"),
 	network: true
-}, (config) => login(config, Option.getOrUndefined(email), otpStdin))).pipe(Command.annotate(CliCommandMetadata, metadata$4("auth.login")), Command.withDescription("Establish a first-party session with terminal-owned email OTP"));
+}, (config) => login(config, Option.getOrUndefined(email), otpStdin))).pipe(Command.annotate(CliCommandMetadata, metadata$4("auth.login")), Command.withDescription("Sign in with your email and a one-time code"));
 const signupCommand = Command.make("signup", {
 	email: emailFlag$3,
 	otpStdin: otpStdinFlag,
@@ -54237,31 +54399,31 @@ const signupCommand = Command.make("signup", {
 	displayName: Option.getOrUndefined(displayName),
 	country: Option.getOrUndefined(country),
 	handle: Option.getOrUndefined(handle)
-}))).pipe(Command.annotate(CliCommandMetadata, metadata$4("auth.signup")), Command.withDescription("Verify email and complete Profile, Openfort wallet, and Account setup"));
+}))).pipe(Command.annotate(CliCommandMetadata, metadata$4("auth.signup")), Command.withDescription("Create your Capxul account and wallet"));
 const sendCommand = Command.make("send", { email: emailFlag$3 }, ({ email }) => runCommand({
 	...metadata$4("auth.send"),
 	network: true
-}, (config) => sendOtp(config, Option.getOrUndefined(email)))).pipe(Command.annotate(CliCommandMetadata, metadata$4("auth.send")), Command.withDescription("Send an OTP and save non-secret continuation context"));
+}, (config) => sendOtp(config, Option.getOrUndefined(email)))).pipe(Command.annotate(CliCommandMetadata, metadata$4("auth.send")), Command.withDescription("Send a sign-in code to your email"));
 const verifyCommand = Command.make("verify", {
 	email: emailFlag$3,
 	otpStdin: otpStdinFlag
 }, ({ email, otpStdin }) => runCommand({
 	...metadata$4("auth.verify"),
 	network: true
-}, (config) => verifyOtp(config, Option.getOrUndefined(email), otpStdin))).pipe(Command.annotate(CliCommandMetadata, metadata$4("auth.verify")), Command.withDescription("Verify a delivered OTP and persist the first-party session"));
+}, (config) => verifyOtp(config, Option.getOrUndefined(email), otpStdin))).pipe(Command.annotate(CliCommandMetadata, metadata$4("auth.verify")), Command.withDescription("Finish signing in with the code from your email"));
 const profileCommand = Command.make("profile", { email: emailFlag$3 }, ({ email }) => runCommand({
 	...metadata$4("auth.profile"),
 	network: true
-}, (config) => readProfile(config, Option.getOrUndefined(email)))).pipe(Command.annotate(CliCommandMetadata, metadata$4("auth.profile")), Command.withDescription("Restore the session and read the backend profile and account lifecycle"));
+}, (config) => readProfile(config, Option.getOrUndefined(email)))).pipe(Command.annotate(CliCommandMetadata, metadata$4("auth.profile")), Command.withDescription("Show your profile and account readiness"));
 const statusCommand = Command.make("status", { email: emailFlag$3 }, ({ email }) => runCommand({
 	...metadata$4("auth.status"),
 	network: true
-}, (config) => status$2(config, Option.getOrUndefined(email)))).pipe(Command.annotate(CliCommandMetadata, metadata$4("auth.status")), Command.withDescription("Validate a first-party session or show a tagged legacy grant"));
+}, (config) => status$2(config, Option.getOrUndefined(email)))).pipe(Command.annotate(CliCommandMetadata, metadata$4("auth.status")), Command.withDescription("Show whether you are signed in"));
 const logoutCommand = Command.make("logout", { email: emailFlag$3 }, ({ email }) => runCommand({
 	...metadata$4("auth.logout"),
 	network: true
-}, (config) => logout(config, Option.getOrUndefined(email)))).pipe(Command.annotate(CliCommandMetadata, metadata$4("auth.logout")), Command.withDescription("Forget local credentials and revoke their remote session or grant"));
-const auth = Command.make("auth").pipe(Command.annotate(CliCommandMetadata, metadata$4("auth")), Command.withDescription("First-party email sessions (broader authority than legacy account:read grants)"), Command.withSubcommands([
+}, (config) => logout(config, Option.getOrUndefined(email)))).pipe(Command.annotate(CliCommandMetadata, metadata$4("auth.logout")), Command.withDescription("Sign out on this device"));
+const auth = Command.make("auth").pipe(Command.annotate(CliCommandMetadata, metadata$4("auth")), Command.withDescription("Sign in, create your account, and manage your session"), Command.withSubcommands([
 	loginCommand,
 	signupCommand,
 	sendCommand,
@@ -54334,6 +54496,73 @@ const telemetry = Command.make("telemetry").pipe(Command.annotate(CliCommandMeta
 	disable
 ]));
 //#endregion
+//#region src/org-recovery.ts
+/**
+* The one safe recovery handle for a person's Organization journey.
+*
+* `handle` is the exact business handle the create prepared. It is the only
+* identity the CLI knows while the first durable Organization write is in
+* flight, and the backend resumes the same Organization for that handle.
+* `organizationId` is added from the first committed Organization. After that
+* the ID is the recovery target.
+*
+* A record with no handle releases the journey: the backend refused that exact
+* handle before it wrote any Organization row, so no Organization waits to be
+* resumed. The record stores no draft, submission, credential, or token.
+*/
+const Recovery = Schema.Struct({
+	version: Schema.Literal(1),
+	handle: Schema.optional(Schema.NonEmptyString),
+	organizationId: Schema.optional(Schema.NonEmptyString)
+});
+const decode$1 = (value) => Schema.decodeUnknownEffect(Schema.fromJsonString(Recovery), { onExcessProperty: "error" })(value).pipe(Effect.flatMap((record) => {
+	const organizationId = record.organizationId ?? null;
+	if (record.handle === void 0) return organizationId === null ? Effect.succeed(null) : Effect.fail(new StateFileError({ reason: "Corrupt" }));
+	const handle = record.handle;
+	return Effect.try(() => ({
+		handle: String(toHandle(handle)),
+		organizationId: organizationId === null ? null : toOrgId(organizationId)
+	}));
+}), Effect.mapError(() => new StateFileError({ reason: "Corrupt" })));
+const encode = (recovery) => JSON.stringify({
+	version: 1,
+	handle: recovery.handle,
+	...recovery.organizationId === null ? {} : { organizationId: String(recovery.organizationId) }
+});
+/** The released shape: no handle waits to be resumed. */
+const RELEASED = JSON.stringify({ version: 1 });
+/** Read the safe recovery handle without writing. A corrupt record refuses the command. */
+const readOrganizationRecovery = (config, authUserId) => Effect.gen(function* () {
+	const { directory, scope } = yield* privateRecordScope(config, "organization-recovery", authUserId);
+	const value = yield* readPrivateRecord(directory, scope);
+	return value === null ? null : yield* decode$1(value);
+});
+/**
+* Open the recovery handle for one command.
+*
+* `save` and `release` replace only the exact record this command read, so two
+* commands cannot overwrite each other's Organization journey, and a delayed
+* write cannot follow a newer one. A record this command did not read refuses
+* the write.
+*/
+const openOrganizationRecovery = (config, authUserId, stillAuthenticated) => Effect.gen(function* () {
+	const { directory, scope } = yield* privateRecordScope(config, "organization-recovery", authUserId);
+	let encoded = yield* readPrivateRecord(directory, scope);
+	let record = encoded === null ? null : yield* decode$1(encoded);
+	const write = (next) => Effect.gen(function* () {
+		const value = next === null ? RELEASED : encode(next);
+		if (value === encoded) return;
+		if (!(yield* compareAndSetPrivateRecord(directory, scope, encoded, value, stillAuthenticated))) return yield* Effect.fail(Errors.notAuthenticated("The local Organization recovery state changed. Retry the command."));
+		encoded = value;
+		record = next;
+	});
+	return {
+		current: () => record,
+		save: (next) => write(next),
+		release: () => write(null)
+	};
+});
+//#endregion
 //#region src/org-selection.ts
 const Selection = Schema.Struct({
 	version: Schema.Literal(1),
@@ -54356,6 +54585,37 @@ const saveOrganizationSelection = (config, authUserId, organizationId, stillAuth
 });
 //#endregion
 //#region src/org.ts
+/**
+* The exact Organization a read uses when the caller named no ID: the saved read
+* default first, then the recorded recovery handle for this person's
+* Organization journey. `recoverable` marks the handle source, whose Organization
+* may still run its setup lane and be absent from the own-access list.
+*/
+const readResolvedOrganization = (config, authUserId, organizationId) => Effect.gen(function* () {
+	if (organizationId !== null) return {
+		organizationId,
+		recoverable: false
+	};
+	const selected = yield* readOrganizationSelection(config, authUserId);
+	if (selected !== null) return {
+		organizationId: selected,
+		recoverable: false
+	};
+	const recovery = yield* readOrganizationRecovery(config, authUserId);
+	return {
+		organizationId: recovery?.organizationId ?? null,
+		recoverable: recovery?.organizationId !== null && recovery?.organizationId !== void 0
+	};
+});
+/**
+* A ready Organization this command reports must satisfy current access.
+*
+* The own-access list carries a founder's unfinished Organizations through the
+* backend's founder fallback, and the backend lifecycle read admits the founder
+* for the durable lane. A confirmed result therefore reads the list again: an
+* Organization the person cannot reach refuses instead of reporting its state.
+*/
+const requireCurrentAccess = (client, organizationId, lifecycle) => lifecycle.status !== "ready" ? Effect.void : Effect.promise((signal) => client.orgs({ signal })).pipe(Effect.flatMap(resultValue), Effect.flatMap((organizations) => organizations.some((organization) => organization.id === organizationId) ? Effect.void : Effect.fail(Errors.invalidInput("org", "The Organization is not accessible."))));
 const readOrganization = (config, command, input) => Effect.gen(function* () {
 	const timeout = yield* Schema.decodeUnknownEffect(Schema.Int.check(Schema.isBetween({
 		minimum: 1,
@@ -54382,7 +54642,8 @@ const readOrganization = (config, command, input) => Effect.gen(function* () {
 			address: org.account.address
 		}))
 	};
-	organizationId ??= yield* readOrganizationSelection(config, session.authUserId);
+	const resolved = yield* readResolvedOrganization(config, session.authUserId, organizationId);
+	organizationId = resolved.organizationId;
 	if (organizationId === null) {
 		const runtime = yield* CliRuntime;
 		if (!runtime.tty || runtime.ci || runtime.mode === "json" || organizations.length === 0) return yield* Effect.fail(inputRequired("Provide --org or select a read default with org use."));
@@ -54397,7 +54658,7 @@ const readOrganization = (config, command, input) => Effect.gen(function* () {
 			}))
 		});
 	}
-	if (!organizations.some((org) => org.id === organizationId)) return yield* Effect.fail(Errors.invalidInput("org", "The Organization is not accessible."));
+	if (!organizations.some((org) => org.id === organizationId) && !resolved.recoverable) return yield* Effect.fail(Errors.invalidInput("org", "The Organization is not accessible."));
 	if (command === "use") {
 		yield* saveOrganizationSelection(config, session.authUserId, organizationId, stillAuthenticated);
 		return {
@@ -54450,11 +54711,13 @@ const readOrganization = (config, command, input) => Effect.gen(function* () {
 	const read = Effect.promise((signal) => scoped.getLifecycle({ signal })).pipe(Effect.flatMap(resultValue));
 	const observed = yield* Effect.gen(function* () {
 		let lifecycle = yield* read;
+		if (resolved.recoverable) yield* requireCurrentAccess(client, organizationId, lifecycle);
 		if (command !== "wait") return lifecycle;
 		while (lifecycle.status !== "ready" && lifecycle.status !== "failed") {
 			yield* Effect.sleep(1e3);
 			lifecycle = yield* read;
 		}
+		if (resolved.recoverable) yield* requireCurrentAccess(client, organizationId, lifecycle);
 		return lifecycle;
 	}).pipe(Effect.timeoutOption(timeout * 1e3));
 	if (Option.isNone(observed)) return yield* Effect.fail(new CliFailure({
@@ -54538,45 +54801,89 @@ const requireWriteConfirmation = (supplied) => Effect.gen(function* () {
 *
 * The committed Organization ID is retained from the first state that carries
 * one and never replaced, so a later failed lane keeps reporting the ID it was
-* committed to. `flush` never resolves a signature on an unwritten line: the
-* command-scoped signer awaits it before forwarding a digest, and a failed or
-* cancelled write throws here instead.
+* committed to. `flush` writes the queued lines first, then makes the ID durable
+* as this person's safe recovery handle, and only then resolves: the
+* command-scoped signer awaits it before forwarding a digest, so a failed or
+* cancelled write saves no handle and forwards no signature.
 */
-const makeOrganizationProgress = (mode, run) => {
+const makeOrganizationProgress = (mode, run, persist) => {
 	const queued = [];
+	const held = [];
+	const heldSet = /* @__PURE__ */ new Set();
 	const written = /* @__PURE__ */ new Set();
 	let committed = null;
+	let persisted = null;
+	let readyAllowed = false;
 	let failure = null;
+	/** One command owns one committed Organization. A second ID is a defect. */
+	const retain = (observed) => {
+		if (committed === null) {
+			committed = observed;
+			return true;
+		}
+		if (committed === observed) return true;
+		failure ??= new CliFailure({
+			code: "CLI_DEFECT",
+			message: "The onboarding stream reported a different Organization.",
+			exitCode: 1,
+			outcome: "failed"
+		});
+		return false;
+	};
+	/**
+	* A ready line waits until the command confirms current access. Every other
+	* line is progress evidence and goes out with the committed ID.
+	*/
+	const enqueue = (text, ready) => {
+		if (written.has(text) || heldSet.has(text)) return;
+		if (ready && !readyAllowed) {
+			heldSet.add(text);
+			held.push(text);
+			return;
+		}
+		written.add(text);
+		queued.push(text);
+	};
 	const render = (state) => {
 		const organizationId = state.organizationId;
 		if (organizationId === null) return null;
-		const observed = String(organizationId);
-		if (committed === null) committed = observed;
-		else if (committed !== observed) {
-			failure ??= new CliFailure({
-				code: "CLI_DEFECT",
-				message: "The onboarding stream reported a different Organization.",
-				exitCode: 1,
-				outcome: "failed"
-			});
-			return null;
-		}
+		if (!retain(String(organizationId))) return null;
 		const status = state.lifecycle?.status;
 		if (status === void 0) return null;
-		return `${mode === "json" ? JSON.stringify({
-			type: "organization.lifecycle",
-			organizationId: committed,
-			status
-		}) : `Organization ${JSON.stringify(committed)}: ${status}`}\n`;
+		return {
+			text: `${mode === "json" ? JSON.stringify({
+				type: "organization.lifecycle",
+				organizationId: committed,
+				status
+			}) : `Organization ${JSON.stringify(committed)}: ${status}`}\n`,
+			ready: status === "ready"
+		};
 	};
 	return {
 		/** Synchronous by contract: the SDK publishes state from its own fiber. */
 		observe: (state) => {
-			const text = render(state);
-			if (text === null || written.has(text)) return;
-			written.add(text);
-			queued.push(text);
-		},
+			const line = render(state);
+			if (line !== null) enqueue(line.text, line.ready);
+		},
+		/** One safe recovery line the command writes before it resumes a lane. */
+		notice: (text) => enqueue(text, false),
+		/** The final result ID joins the same one-Organization rule. */
+		commit: (organizationId) => {
+			retain(organizationId);
+		},
+		/** Release the ready lines once current access is confirmed. */
+		allowReady: () => {
+			readyAllowed = true;
+			while (held.length > 0) {
+				const text = held.shift();
+				heldSet.delete(text);
+				if (written.has(text)) continue;
+				written.add(text);
+				queued.push(text);
+			}
+		},
+		/** The committed ID this command observed, or null when it observed none. */
+		committed: () => committed,
 		failure: () => failure,
 		flush: async () => {
 			while (queued.length > 0) {
@@ -54589,6 +54896,13 @@ const makeOrganizationProgress = (mode, run) => {
 				}
 				queued.shift();
 			}
+			if (committed !== null && persisted !== committed) try {
+				await persist(committed);
+				persisted = committed;
+			} catch (cause) {
+				failure = cause;
+				throw cause;
+			}
 			if (failure !== null) throw failure;
 		}
 	};
@@ -54603,15 +54917,63 @@ const confirmWrite = (preview) => Effect.gen(function* () {
 	yield* writeStderr(`${preview.lines.join("\n")}\n`);
 	if (!(yield* Prompt.confirm({ message: preview.question }).pipe(Effect.catch(() => Effect.succeed(false))))) return yield* Effect.fail(inputRequired("The write was not confirmed."));
 });
-/** The Organization reads a terminal preview shows before it asks. */
-const organizationPreviewLines = (client, organizationId) => organizationId === null ? Effect.gen(function* () {
+/**
+* The Organization reads a terminal preview shows before it asks.
+*
+* A create preview also names the recovery handle this machine already holds, so
+* a person who confirms knows whether the command creates one more Organization
+* or continues the exact one their interrupted journey reached. The preview
+* reads that recorded Organization's lifecycle only when the requested handle
+* continues it; a different handle is a new creation, and the recorded
+* Organization must not block it.
+*/
+const organizationPreview = (client, organizationId, recovery, requestedHandle) => organizationId === null ? Effect.gen(function* () {
 	const organizations = yield* Effect.promise((signal) => client.orgs({ signal })).pipe(Effect.flatMap(resultValue));
-	if (organizations.length === 0) return ["Existing Organizations: none"];
-	return [`Existing Organizations: ${organizations.length}`, ...organizations.map((organization) => `  ${JSON.stringify(String(organization.id))} ${JSON.stringify(organization.name)}`)];
+	const lines = organizations.length === 0 ? ["Existing Organizations: none"] : [`Existing Organizations: ${organizations.length}`, ...organizations.map((organization) => `  ${JSON.stringify(String(organization.id))} ${JSON.stringify(organization.name)}`)];
+	if (recovery === null) return {
+		lines,
+		recovery,
+		recoveryLifecycle: null
+	};
+	const exact = recovery.organizationId;
+	if (exact === null) return {
+		lines: [...lines, `Recovery: a create for handle @${recovery.handle} is prepared on this machine.`],
+		recovery,
+		recoveryLifecycle: null
+	};
+	if (requestedHandle !== recovery.handle) return {
+		lines: [...lines, `Recovery: Organization ${JSON.stringify(String(exact))} (@${recovery.handle}) is recorded on this machine.`],
+		recovery,
+		recoveryLifecycle: null
+	};
+	const lifecycle = yield* Effect.promise((signal) => client.org(exact).getLifecycle({ signal })).pipe(Effect.flatMap(resultValue));
+	yield* requireCurrentAccess(client, exact, lifecycle);
+	return {
+		lines: [
+			...lines,
+			`Recovery: Organization ${JSON.stringify(String(exact))} (@${recovery.handle})`,
+			`Current lifecycle: ${lifecycle.status}`
+		],
+		recovery,
+		recoveryLifecycle: lifecycle
+	};
 }) : Effect.gen(function* () {
-	return [`Current lifecycle: ${(yield* Effect.promise((signal) => client.org(organizationId).getLifecycle({ signal })).pipe(Effect.flatMap(resultValue))).status}`];
+	return {
+		lines: [`Current lifecycle: ${(yield* Effect.promise((signal) => client.org(organizationId).getLifecycle({ signal })).pipe(Effect.flatMap(resultValue))).status}`],
+		recovery,
+		recoveryLifecycle: null
+	};
 });
 /**
+* The confirmation question for a create. A matching recovery handle means the
+* command continues one exact Organization instead of creating another one.
+*/
+const createOrganizationQuestion = (handle, preview) => {
+	if (preview.recovery === null || preview.recovery.organizationId === null) return "Create this Organization?";
+	if (preview.recovery.handle !== handle) return "Create this Organization?";
+	return preview.recoveryLifecycle?.status === "ready" ? "Return this ready Organization?" : "Resume this Organization's setup?";
+};
+/**
 * Settle one exact Organization lifecycle read: poll every second with no
 * overlapping read until the lane is ready or failed. The command's own deadline
 * bounds this loop together with the write that preceded it.
@@ -54625,6 +54987,81 @@ const settleOrganizationLifecycle = (read) => Effect.gen(function* () {
 	return lifecycle;
 });
 /**
+* Resume the exact durable Organization lane through the SDK recovery owner, then
+* settle that exact lifecycle. It never creates an Organization and never
+* resubmits a recorded bootstrap submission.
+*/
+const resumeOrganizationSetup = (operation, scoped, deadline) => Effect.gen(function* () {
+	yield* Effect.promise(() => scoped.retrySetup({ signal: deadline.signal })).pipe(Effect.flatMap(resultValue));
+	const lifecycle = yield* settleOrganizationLifecycle(() => scoped.getLifecycle({ signal: deadline.signal }));
+	yield* requireReadyLifecycle(operation, lifecycle);
+	return lifecycle;
+});
+/**
+* A prepared handle owns the next durable Organization for that handle, so a
+* different handle would create a second Organization and leave the prepared lane
+* abandoned. The refusal names the exact handle to continue.
+*/
+const preparedJourneyRefusal = (handle) => new CliFailure({
+	code: "WRONG_STATE",
+	message: `An Organization creation is already prepared for handle @${handle}. Run capxul org create with the same handle to continue that exact Organization.`,
+	exitCode: 2,
+	outcome: "refused"
+});
+/**
+* Read how this create continues the person's Organization journey.
+*
+* The recovery handle is the only source of the exact identity, so a matching
+* handle resumes the Organization its lane reached and never creates another
+* one. A different handle creates one Organization only after the recorded
+* Organization reaches ready.
+*/
+const readCreateRoute = (client, recovery, handle, signal) => Effect.gen(function* () {
+	if (recovery === null) return {
+		kind: "create",
+		continuesRecorded: false
+	};
+	if (recovery.organizationId === null) {
+		if (recovery.handle === handle) return {
+			kind: "create",
+			continuesRecorded: true
+		};
+		return yield* Effect.fail(preparedJourneyRefusal(recovery.handle));
+	}
+	const lifecycle = yield* Effect.promise(() => client.org(recovery.organizationId).getLifecycle({ signal })).pipe(Effect.flatMap(resultValue));
+	if (recovery.handle === handle) return {
+		kind: "recover",
+		organizationId: recovery.organizationId,
+		handle: recovery.handle,
+		lifecycle
+	};
+	if (lifecycle.status === "ready") return {
+		kind: "create",
+		continuesRecorded: false
+	};
+	return yield* Effect.fail(Errors.wrongState({
+		method: CAPXUL_OPERATIONS.onboarding.completeOrganization,
+		currentState: lifecycle.status,
+		validStates: ["ready"],
+		organizationId: String(recovery.organizationId)
+	}));
+});
+/** One safe recovery line, in the same newline-delimited shape as the lifecycle. */
+const recoveryNotice = (mode, recovery) => mode === "json" ? `${JSON.stringify({
+	type: "organization.recovery",
+	organizationId: String(recovery.organizationId),
+	handle: recovery.handle
+})}\n` : `Recovering Organization ${JSON.stringify(String(recovery.organizationId))} (@${recovery.handle}).\n`;
+/** A taken handle is refused before the backend writes any Organization row. */
+const refusedOrganizationHandle = (error) => isCapxulError(error) && error.code === "INVALID_INPUT" && error.details?.field === "handle";
+/** A write forwards no signature before its recovery handle exists; absence is a defect. */
+const organizationWriteDefect = () => new CliFailure({
+	code: "CLI_DEFECT",
+	message: "The Organization write lost its recovery handle.",
+	exitCode: 1,
+	outcome: "failed"
+});
+/**
 * The one deadline for a write: it aborts the active SDK signal, so the waiting
 * command stops and the signer forwards nothing further, while the durable
 * backend lane keeps running and stays resumable by `org retry`.
@@ -54734,10 +55171,15 @@ const requireReadyLifecycle = (operation, lifecycle) => lifecycle.status === "re
 * explicit create intent, then settle the exact Organization lifecycle. This
 * never saves a read default and never returns an unrelated ready Organization.
 *
+* A create that meets this person's prepared Organization journey continues that
+* exact Organization: the same handle resumes the lane its ID reached, and a
+* different handle refuses while that lane is unsettled. Neither path creates a
+* replacement Organization or treasury.
+*
 * One deadline covers the write and its settlement. At the deadline the active
 * SDK signal is aborted: the command stops waiting, forwards no further
 * signature, and returns the typed wait failure, while the durable backend lane
-* keeps running and stays resumable by `org retry`.
+* keeps running and stays resumable by the same create or by `org retry`.
 */
 const createOrganization = (config, input) => Effect.gen(function* () {
 	const operation = CAPXUL_OPERATIONS.org.create;
@@ -54747,50 +55189,99 @@ const createOrganization = (config, input) => Effect.gen(function* () {
 	const opened = yield* openAuthenticatedSession(config, input.email);
 	if (interactivelyConfirm) {
 		const preview = yield* restoreVerifiedClient(config, opened, { requirement: "none" });
-		const resolved = yield* organizationPreviewLines(preview.client, null);
+		const recovery = yield* readOrganizationRecovery(config, preview.session.authUserId);
+		const resolved = yield* organizationPreview(preview.client, null, recovery, draft.handle);
 		yield* confirmWrite({
 			lines: [
 				`Create Organization ${JSON.stringify(draft.name)} (@${draft.handle}, ${draft.country})`,
 				...draft.bio === void 0 ? [] : [`Bio: ${JSON.stringify(draft.bio)}`],
 				...draft.size === void 0 ? [] : [`Size: ${JSON.stringify(draft.size)}`],
-				...resolved
+				...resolved.lines
 			],
-			question: "Create this Organization?"
+			question: createOrganizationQuestion(draft.handle, resolved)
 		});
 	}
 	const context = yield* Effect.context();
 	const run = Effect.runPromiseWith(context);
 	const runtime = yield* CliRuntime;
-	const progress = makeOrganizationProgress(runtime.mode, run);
+	const progressRef = yield* Ref.make(null);
 	const deadline = new AbortController();
 	const openfortSignerFactory = yield* organizationWriteSigner(config, opened, run, async () => {
 		const cancelled = cancelledWrite(operation, deadline.signal);
 		if (cancelled !== null) throw cancelled;
-		await progress.flush();
+		const live = await run(Ref.get(progressRef));
+		if (live === null) throw organizationWriteDefect();
+		await live.flush();
 		const stopped = cancelledWrite(operation, deadline.signal);
 		if (stopped !== null) throw stopped;
 	});
-	const { client } = yield* restoreVerifiedClient(config, opened, {
+	const { client, session, stillAuthenticated } = yield* restoreVerifiedClient(config, opened, {
 		requirement: "deployed",
 		openfortSignerFactory
 	});
-	const unsubscribe = client.onboarding.subscribeOrganization(progress.observe);
-	const settled = yield* Effect.gen(function* () {
-		const completed = yield* Effect.promise(() => client.onboarding.completeOrganization(draft, {
-			intent: "create",
-			signal: deadline.signal
-		})).pipe(Effect.ensuring(Effect.sync(unsubscribe)));
+	const recovery = yield* openOrganizationRecovery(config, session.authUserId, stillAuthenticated);
+	const persistRecovery = (organizationId) => Effect.gen(function* () {
+		const committed = yield* onboardingOrganizationId(organizationId);
+		yield* recovery.save({
+			handle: draft.handle,
+			organizationId: committed
+		});
+	});
+	const progress = makeOrganizationProgress(runtime.mode, run, (organizationId) => run(persistRecovery(organizationId)));
+	yield* Ref.set(progressRef, progress);
+	const flushProgress = Effect.gen(function* () {
 		yield* Effect.tryPromise({
 			try: progress.flush,
 			catch: (cause) => cause
 		}).pipe(Effect.catch(() => Effect.void));
 		const localFailure = progress.failure();
 		if (localFailure !== null && localFailure !== void 0) return yield* Effect.fail(localFailure);
-		const onboarding = yield* resultValue(completed);
+	});
+	const settled = yield* Effect.gen(function* () {
+		const route = yield* readCreateRoute(client, recovery.current(), draft.handle, deadline.signal);
+		if (route.kind === "recover") {
+			if (route.lifecycle.status === "ready") {
+				yield* requireCurrentAccess(client, route.organizationId, route.lifecycle);
+				progress.allowReady();
+				return {
+					organizationId: route.organizationId,
+					lifecycle: route.lifecycle
+				};
+			}
+			progress.notice(recoveryNotice(runtime.mode, route));
+			yield* flushProgress;
+			const lifecycle = yield* resumeOrganizationSetup(operation, client.org(route.organizationId), deadline);
+			yield* requireCurrentAccess(client, route.organizationId, lifecycle);
+			progress.allowReady();
+			return {
+				organizationId: route.organizationId,
+				lifecycle
+			};
+		}
+		yield* recovery.save({
+			handle: draft.handle,
+			organizationId: null
+		});
+		const unsubscribe = client.onboarding.subscribeOrganization(progress.observe);
+		const completed = yield* Effect.promise(() => client.onboarding.completeOrganization(draft, {
+			intent: "create",
+			signal: deadline.signal
+		})).pipe(Effect.ensuring(Effect.sync(unsubscribe)));
+		if (!completed.ok) {
+			yield* flushProgress;
+			if (refusedOrganizationHandle(completed.error) && progress.committed() === null) yield* recovery.release();
+			return yield* Effect.fail(completed.error);
+		}
+		const onboarding = completed.value;
 		const organizationId = yield* onboardingOrganizationId(onboarding.organizationId);
+		progress.commit(String(organizationId));
+		yield* flushProgress;
 		const scoped = client.org(organizationId);
 		const lifecycle = yield* settleOrganizationLifecycle(() => scoped.getLifecycle({ signal: deadline.signal }));
 		yield* requireReadyLifecycle(operation, lifecycle);
+		if (route.continuesRecorded) yield* requireCurrentAccess(client, organizationId, lifecycle);
+		progress.allowReady();
+		yield* flushProgress;
 		return {
 			organizationId,
 			lifecycle
@@ -54835,9 +55326,9 @@ const retryOrganization = (config, input) => Effect.gen(function* () {
 	const opened = yield* openAuthenticatedSession(config, input.email);
 	if (interactivelyConfirm) {
 		const preview = yield* restoreVerifiedClient(config, opened, { requirement: "none" });
-		const resolved = yield* organizationPreviewLines(preview.client, organizationId);
+		const resolved = yield* organizationPreview(preview.client, organizationId, null);
 		yield* confirmWrite({
-			lines: [`Resume setup for Organization ${JSON.stringify(String(organizationId))}`, ...resolved],
+			lines: [`Resume setup for Organization ${JSON.stringify(String(organizationId))}`, ...resolved.lines],
 			question: "Resume this Organization's setup?"
 		});
 	}
@@ -54853,12 +55344,7 @@ const retryOrganization = (config, input) => Effect.gen(function* () {
 		openfortSignerFactory
 	});
 	const scoped = client.org(organizationId);
-	const settled = yield* Effect.gen(function* () {
-		yield* Effect.promise(() => scoped.retrySetup({ signal: deadline.signal })).pipe(Effect.flatMap(resultValue));
-		const lifecycle = yield* settleOrganizationLifecycle(() => scoped.getLifecycle({ signal: deadline.signal }));
-		yield* requireReadyLifecycle(operation, lifecycle);
-		return lifecycle;
-	}).pipe(Effect.onInterrupt(() => Effect.sync(() => deadline.abort()))).pipe(Effect.timeoutOption(timeout * 1e3));
+	const settled = yield* resumeOrganizationSetup(operation, scoped, deadline).pipe(Effect.onInterrupt(() => Effect.sync(() => deadline.abort()))).pipe(Effect.timeoutOption(timeout * 1e3));
 	if (Option.isNone(settled)) return yield* Effect.fail(organizationWaitTimeout());
 	return {
 		data: {
@@ -55926,7 +56412,7 @@ const create = Command.make("create", {
 	size: Option.getOrUndefined(size),
 	confirm,
 	timeoutSeconds
-}))).pipe(Command.annotate(CliCommandMetadata, metadata(CAPXUL_OPERATIONS.org.create)), Command.withDescription("Create one Organization; never saves a read default"));
+}))).pipe(Command.annotate(CliCommandMetadata, metadata(CAPXUL_OPERATIONS.org.create)), Command.withDescription("Create one Organization, or resume the exact one this machine recorded"));
 const retry = Command.make("retry", {
 	...orgScope,
 	email: emailFlag,
@@ -55941,7 +56427,7 @@ const retry = Command.make("retry", {
 	confirm,
 	timeoutSeconds
 }))).pipe(Command.annotate(CliCommandMetadata, metadata(CAPXUL_OPERATIONS.org.retry)), Command.withDescription("Resume this exact Organization setup lane; never creates one"));
-const org = Command.make("org").pipe(Command.annotate(CliCommandMetadata, metadata("org")), Command.withDescription("Organization reads, writes, and local read defaults"), Command.withSubcommands([
+const org = Command.make("org").pipe(Command.annotate(CliCommandMetadata, metadata("org")), Command.withDescription("Organization reads, writes, recovery, and local read defaults"), Command.withSubcommands([
 	list,
 	use,
 	status,
@@ -56103,6 +56589,7 @@ const runCli = (platform) => Effect.uninterruptibleMask((restore) => Effect.gen(
 	const ci = yield* Config.string("CI").pipe(Config.withDefault("false"), Effect.map((value) => value !== "" && value !== "false" && value !== "0"), Effect.catch(() => Effect.succeed(false)));
 	const runtime = {
 		mode,
+		args,
 		current,
 		invocationId,
 		observation,