@capxul/sdk-react 4.20.0-beta.4 → 4.20.0-beta.40

package/dist/{controllers-DXmEHrnw.mjs → onboarding-controller-BCrkmLxQ.mjs}

@@ -1,8 +1,8 @@
 import { createContext, useCallback, useContext, useEffect, useMemo, useRef, useState, useSyncExternalStore } from "react";
 import { QueryClient, QueryClientProvider, useQueryClient } from "@tanstack/react-query";
-import { CapxulError, createCapxulClient, isCapxulError, resolveIdentityDestination, toCountryCode, toHandle } from "@capxul/sdk";
+import { CapxulError, createCapxulClient, isCapxulError, resolveIdentityDestination, toCountryCode, toHandle, toOrgId } from "@capxul/sdk";
 import { jsx } from "react/jsx-runtime";
-//#region src/internal/capxul-bootstrap-context.tsx
+//#region src/platform/bootstrap-context.tsx
 const CapxulBootstrapContext = createContext(null);
 function CapxulBootstrapProvider({ value, children }) {
 	return /* @__PURE__ */ jsx(CapxulBootstrapContext.Provider, {
@@ -16,7 +16,7 @@ function useCapxul() {
 	return state;
 }
 //#endregion
-//#region src/internal/capxul-client-context.tsx
+//#region src/platform/client-context.tsx
 const MISSING_CAPXUL_CLIENT_PROVIDER = Symbol("MISSING_CAPXUL_CLIENT_PROVIDER");
 const CapxulClientContext = createContext(MISSING_CAPXUL_CLIENT_PROVIDER);
 function CapxulClientProvider({ client, children }) {
@@ -36,7 +36,14 @@ function useCapxulClientOrNull() {
 	return client;
 }
 //#endregion
-//#region src/internal/reactivity-keys.ts
+//#region src/platform/query-keys.ts
+/**
+* An Organization id a consumer passed as a plain string (often a URL
+* parameter), as a key segment. An absent or empty id names no Organization.
+*/
+function orgKeySegment(orgId) {
+	return orgId === void 0 || orgId === "" ? void 0 : toOrgId(orgId);
+}
 /**
 * The account a read is answered FOR, as a key segment (#2007 R19).
 *
@@ -144,7 +151,7 @@ const capxulKeys = {
 		"terms"
 	],
 	activity: ["capxul", "activity"],
-	activityDetail: (reference, actor = void 0) => [
+	activityDetail: (reference, actor) => [
 		"capxul",
 		"activity",
 		actor ?? "self",
@@ -170,7 +177,7 @@ const capxulKeys = {
 	]
 };
 //#endregion
-//#region src/internal/invocation-controls.ts
+//#region src/platform/invocation-controls.ts
 /**
 * Keep only the five public option fields, and only when they hold the right
 * kind of value. A named action verb takes its attempt as an optional FIRST
@@ -209,72 +216,23 @@ function toInvocationControls(options) {
 	};
 }
 //#endregion
-//#region src/identity.tsx
-const MISSING_IDENTITY_PROVIDER = Symbol("MISSING_IDENTITY_PROVIDER");
-const IdentityContext = createContext(MISSING_IDENTITY_PROVIDER);
+//#region src/platform/identity-lanes.ts
 const failure = (result) => result.ok ? null : {
 	ok: false,
 	reason: result.refused
 };
-async function guarded(runtime, verb, options, run) {
-	const invocation = toInvocationControls(options);
-	try {
-		return await (runtime.runFacade?.(verb, invocation, run) ?? run(invocation));
-	} catch {
-		return {
-			ok: false,
-			reason: "UNKNOWN"
-		};
-	}
-}
-function organizationFailure(reason, state) {
-	const stateFailure = state.phase === "faulted" ? state.failure : state.phase === "authenticated" && state.account.at === "failed" ? state.account.failure : state.phase === "authenticated" && state.account.at === "claimed" && state.account.org?.at === "failed" ? state.account.org.failure : void 0;
-	if (stateFailure?.code === reason) return {
-		ok: false,
-		reason,
-		error: stateFailure.error ?? new CapxulError(stateFailure.code === "WORK_DIED" ? "UNKNOWN" : stateFailure.code, stateFailure.message, {
-			...stateFailure.mode === void 0 ? {} : { details: { failure_mode: stateFailure.mode } },
-			layer: "identity"
-		})
-	};
-	return {
-		ok: false,
-		reason,
-		error: new CapxulError(reason === "WORK_DIED" ? "UNKNOWN" : reason, reason === "INVALID_INPUT" ? "Organization details are invalid." : "Organization creation failed.", { layer: "identity" })
-	};
-}
-function normalizeOrganization(organization) {
-	const name = typeof organization.name === "string" ? organization.name.trim() : "";
-	const handle = typeof organization.handle === "string" ? organization.handle.trim().toLowerCase() : "";
-	if (name.length === 0) return null;
-	if (organization.bio !== void 0 && typeof organization.bio !== "string") return null;
-	if (organization.size !== void 0 && typeof organization.size !== "string") return null;
-	if (organization.logoStorageId !== void 0 && (typeof organization.logoStorageId !== "string" || organization.logoStorageId.length === 0)) return null;
-	try {
-		return {
-			name,
-			handle: toHandle(handle),
-			country: toCountryCode(organization.country),
-			...organization.bio === void 0 ? {} : { bio: organization.bio },
-			...organization.size === void 0 ? {} : { size: organization.size },
-			...organization.logoStorageId === void 0 ? {} : { logoStorageId: organization.logoStorageId }
-		};
-	} catch {
-		return null;
-	}
-}
-/** The Organization id when its lane is already running or finished, else null. */
-const runningOrganization = (state) => {
-	if (state.phase !== "authenticated" || state.account.at !== "claimed") return null;
-	const org = state.account.org;
-	return org !== null && (org.at === "loading" || org.at === "settingUp" || org.at === "ready") ? org.orgId : null;
-};
 /** A superseded session read waits at most this long for the winning read. */
 const SESSION_SETTLE_LIMIT_MS = 3e4;
 const accountInFlight = (state) => state.phase === "authenticated" && (state.account.at === "deriving" || state.account.at === "claiming");
-function createAuth(client, clearAuthenticatedQueries) {
-	const runtime = client._internal.identity;
-	const settledSession = (invocation) => new Promise((resolve) => {
+/**
+* The session slot keeps the latest ReadSession only: a second reader
+* interrupts the first and the machine refuses the first with SUPERSEDED.
+* Two onboarding callers read at once after a reload (the controller's
+* resume and the recovery submit), so the loser must wait for the winner's
+* read to land and then continue on the shared state, not fail.
+*/
+function settledSession(runtime, invocation) {
+	return new Promise((resolve) => {
 		let done = false;
 		let stop = null;
 		let timer = null;
@@ -310,20 +268,29 @@ function createAuth(client, clearAuthenticatedQueries) {
 		stop = unsubscribe;
 		timer = setTimeout(() => finish({
 			ok: false,
-			reason: "UNKNOWN"
+			reason: "UNKNOWN",
+			error: new CapxulError("UNKNOWN", "The session did not settle in time.", {
+				mode: "timeout",
+				layer: "identity",
+				details: { limitMs: SESSION_SETTLE_LIMIT_MS }
+			})
 		}), SESSION_SETTLE_LIMIT_MS);
 	});
-	const read = async (invocation) => {
-		const result = await runtime.send({ _tag: "ReadSession" }, invocation);
-		const refused = failure(result);
-		if (refused === null) return { ok: true };
-		return refused.reason === "SUPERSEDED" ? settledSession(invocation) : refused;
-	};
-	const ensureAccount = async (invocation) => {
-		const result = await runtime.send({ _tag: "EnsureAccount" }, invocation);
-		return failure(result) ?? { ok: true };
-	};
-	const settledAccount = (invocation) => new Promise((resolve) => {
+}
+/** Read the session; a superseded read waits for the winning one. */
+async function readSession(runtime, invocation) {
+	const result = await runtime.send({ _tag: "ReadSession" }, invocation);
+	const refused = failure(result);
+	if (refused === null) return { ok: true };
+	return refused.reason === "SUPERSEDED" ? settledSession(runtime, invocation) : refused;
+}
+/**
+* The account lane accepts no account event while a derivation or claim is
+* landing. A person who submits the Organization before their own Safe claim
+* settles must wait for it, not be refused with WRONG_STATE.
+*/
+function settledAccount(runtime, invocation) {
+	return new Promise((resolve) => {
 		let done = false;
 		let stop = null;
 		const onAbort = () => finish({
@@ -352,44 +319,110 @@ function createAuth(client, clearAuthenticatedQueries) {
 		stop = unsubscribe;
 		if (!accountInFlight(runtime.snapshot())) finish({ ok: true });
 	});
-	const reachClaimed = async (invocation) => {
-		let state = runtime.snapshot();
-		if (accountInFlight(state)) {
-			const settled = await settledAccount(invocation);
-			if (!settled.ok) return settled;
-			state = runtime.snapshot();
-		}
-		if (state.phase !== "authenticated" || state.account.at === "unknown") {
-			const result = await runtime.send({ _tag: "EnsureAccount" }, invocation);
-			const refused = failure(result);
-			if (refused !== null) return refused;
-			state = result.state;
-		}
+}
+/** Drive the person's own Account to claimed, waiting out a landing derivation or claim. */
+async function reachClaimed(runtime, invocation) {
+	let state = runtime.snapshot();
+	if (accountInFlight(state)) {
+		const settled = await settledAccount(runtime, invocation);
+		if (!settled.ok) return settled;
+		state = runtime.snapshot();
+	}
+	if (state.phase !== "authenticated" || state.account.at === "unknown") {
+		const result = await runtime.send({ _tag: "EnsureAccount" }, invocation);
+		const refused = failure(result);
+		if (refused !== null) return refused;
+		state = result.state;
+	}
+	if (state.phase !== "authenticated") return {
+		ok: false,
+		reason: "WRONG_STATE"
+	};
+	if (state.account.at === "claimed") return { ok: true };
+	if (accountInFlight(state)) {
+		const settled = await settledAccount(runtime, invocation);
+		if (!settled.ok) return settled;
+		state = runtime.snapshot();
 		if (state.phase !== "authenticated") return {
 			ok: false,
 			reason: "WRONG_STATE"
 		};
 		if (state.account.at === "claimed") return { ok: true };
-		if (accountInFlight(state)) {
-			const settled = await settledAccount(invocation);
-			if (!settled.ok) return settled;
-			state = runtime.snapshot();
-			if (state.phase !== "authenticated") return {
-				ok: false,
-				reason: "WRONG_STATE"
-			};
-			if (state.account.at === "claimed") return { ok: true };
-		}
-		const event = state.account.at === "failed" ? { _tag: "RetryAccount" } : state.account.at === "counterfactual" ? { _tag: "ClaimAccount" } : { _tag: "EnsureAccount" };
-		const result = await runtime.send(event, invocation);
-		const refused = failure(result);
-		if (refused !== null) return refused;
-		const next = result.state;
-		return next.phase === "authenticated" && next.account.at === "claimed" ? { ok: true } : {
+	}
+	const event = state.account.at === "failed" ? { _tag: "RetryAccount" } : state.account.at === "counterfactual" ? { _tag: "ClaimAccount" } : { _tag: "EnsureAccount" };
+	const result = await runtime.send(event, invocation);
+	const refused = failure(result);
+	if (refused !== null) return refused;
+	const next = result.state;
+	return next.phase === "authenticated" && next.account.at === "claimed" ? { ok: true } : {
+		ok: false,
+		reason: "WRONG_STATE"
+	};
+}
+//#endregion
+//#region src/platform/organization-submission.ts
+function organizationFailure(reason, state) {
+	const stateFailure = state.phase === "faulted" ? state.failure : state.phase === "authenticated" && state.account.at === "failed" ? state.account.failure : state.phase === "authenticated" && state.account.at === "claimed" ? state.account.org?.failure : void 0;
+	if (stateFailure?.code === reason) return {
+		ok: false,
+		reason,
+		error: stateFailure.error ?? new CapxulError(stateFailure.code === "WORK_DIED" ? "UNKNOWN" : stateFailure.code, stateFailure.message, {
+			...stateFailure.mode === void 0 ? {} : { details: { failure_mode: stateFailure.mode } },
+			layer: "identity"
+		})
+	};
+	return {
+		ok: false,
+		reason,
+		error: new CapxulError(reason === "WORK_DIED" ? "UNKNOWN" : reason, reason === "INVALID_INPUT" ? "Organization details are invalid." : "Organization creation failed.", { layer: "identity" })
+	};
+}
+function normalizeOrganization(organization) {
+	const name = typeof organization.name === "string" ? organization.name.trim() : "";
+	const handle = typeof organization.handle === "string" ? organization.handle.trim().toLowerCase() : "";
+	if (name.length === 0) return null;
+	if (organization.bio !== void 0 && typeof organization.bio !== "string") return null;
+	if (organization.size !== void 0 && typeof organization.size !== "string") return null;
+	if (organization.logoStorageId !== void 0 && (typeof organization.logoStorageId !== "string" || organization.logoStorageId.length === 0)) return null;
+	try {
+		return {
+			name,
+			handle: toHandle(handle),
+			country: toCountryCode(organization.country),
+			...organization.bio === void 0 ? {} : { bio: organization.bio },
+			...organization.size === void 0 ? {} : { size: organization.size },
+			...organization.logoStorageId === void 0 ? {} : { logoStorageId: organization.logoStorageId }
+		};
+	} catch {
+		return null;
+	}
+}
+/** The Organization id when its lane is already running or finished, else null. */
+const runningOrganization = (state) => {
+	if (state.phase !== "authenticated" || state.account.at !== "claimed") return null;
+	return state.account.org?.orgId ?? null;
+};
+//#endregion
+//#region src/platform/identity-auth.ts
+async function guarded(runtime, verb, options, run) {
+	const invocation = toInvocationControls(options);
+	try {
+		return await (runtime.runFacade?.(verb, invocation, run) ?? run(invocation));
+	} catch (cause) {
+		const error = isCapxulError(cause) ? cause : new CapxulError("UNKNOWN", "The identity request failed unexpectedly.", {
+			cause,
+			layer: "identity"
+		});
+		return {
 			ok: false,
-			reason: "WRONG_STATE"
+			reason: error.code,
+			error
 		};
-	};
+	}
+}
+/** The auth verbs behind `useCapxulAuth`, each run as one guarded facade call. */
+function createAuth(client, clearAuthenticatedQueries) {
+	const runtime = client._internal.identity;
 	const completeProfile = async (profile, invocation) => {
 		const result = await runtime.completeProfile(profile, invocation);
 		return result.ok ? { ok: true } : result;
@@ -400,14 +433,14 @@ function createAuth(client, clearAuthenticatedQueries) {
 			ok: false,
 			reason: "INVALID_INPUT"
 		};
-		const refreshed = await read(invocation);
+		const refreshed = await readSession(runtime, invocation);
 		if (!refreshed.ok) return refreshed;
 		const current = runtime.snapshot();
 		if (current.phase !== "authenticated" || !current.profileComplete) {
 			const completed = await runtime.completeProfile(submission.profileDetails, invocation);
 			if (!completed.ok) return completed;
 		}
-		const claimed = await reachClaimed(invocation);
+		const claimed = await reachClaimed(runtime, invocation);
 		return claimed.ok ? {
 			ok: true,
 			organization
@@ -477,9 +510,9 @@ function createAuth(client, clearAuthenticatedQueries) {
 				ok: false,
 				reason: completed.reason
 			};
-			const refreshed = await read(invocation);
+			const refreshed = await readSession(runtime, invocation);
 			if (!refreshed.ok) return refreshed;
-			return ensureAccount(invocation);
+			return failure(await runtime.send({ _tag: "EnsureAccount" }, invocation)) ?? { ok: true };
 		}),
 		createOrganization: (submission, options) => guarded(runtime, "createOrganization", options, async (invocation) => {
 			const current = runtime.snapshot();
@@ -488,20 +521,6 @@ function createAuth(client, clearAuthenticatedQueries) {
 				ok: true,
 				orgId: running
 			};
-			if (current.phase === "authenticated" && current.account.at === "claimed") {
-				const org = current.account.org;
-				if (org?.at === "failed" && org.orgId !== null) {
-					if (!org.retryable) return {
-						ok: false,
-						reason: org.failure.code
-					};
-					const retried = await runtime.send({ _tag: "RetryOrganization" }, invocation);
-					return failure(retried) ?? {
-						ok: true,
-						orgId: org.orgId
-					};
-				}
-			}
 			const prepared = await prepareOrganization(submission, invocation);
 			if (!prepared.ok) return prepared;
 			const opened = runningOrganization(runtime.snapshot());
@@ -509,20 +528,24 @@ function createAuth(client, clearAuthenticatedQueries) {
 				ok: true,
 				orgId: opened
 			};
-			const created = await runtime.send({
-				_tag: "CreateOrganization",
-				draft: prepared.organization
-			}, invocation);
-			const refused = failure(created);
-			if (refused !== null) return refused;
-			const state = created.state;
-			const org = state.phase === "authenticated" && state.account.at === "claimed" ? state.account.org : null;
-			return org?.at === "ready" && org.orgId !== null ? {
-				ok: true,
-				orgId: org.orgId
-			} : {
+			const begun = await client.onboarding.beginOrganization(prepared.organization, invocation);
+			if (!begun.ok) return {
 				ok: false,
-				reason: "UNKNOWN"
+				reason: begun.error.code,
+				error: begun.error
+			};
+			const { orgId, setup } = begun.value;
+			if (setup.status === "awaitingAuthorization") {
+				const authorized = await client.org(orgId).setup.authorize(invocation);
+				if (!authorized.ok) return {
+					ok: false,
+					reason: authorized.error.code,
+					error: authorized.error
+				};
+			}
+			return {
+				ok: true,
+				orgId: String(orgId)
 			};
 		}).then((result) => {
 			if (result.ok) return result;
@@ -535,8 +558,21 @@ function createAuth(client, clearAuthenticatedQueries) {
 		}),
 		retry: (options) => guarded(runtime, "retry", options, async (invocation) => {
 			const state = runtime.snapshot();
-			const event = state.phase === "authenticated" && state.account.at === "claimed" ? { _tag: "RetryOrganization" } : { _tag: "RetryAccount" };
-			const result = await runtime.send(event, invocation);
+			const orgId = runningOrganization(state);
+			if (orgId !== null) {
+				const scoped = client.org(toOrgId(orgId));
+				const current = await scoped.setup.get(invocation);
+				if (!current.ok) return {
+					ok: false,
+					reason: current.error.code
+				};
+				const result = current.value.status === "awaitingAuthorization" ? await scoped.setup.authorize(invocation) : await scoped.setup.resume(invocation);
+				return result.ok ? { ok: true } : {
+					ok: false,
+					reason: result.error.code
+				};
+			}
+			const result = await runtime.send({ _tag: "RetryAccount" }, invocation);
 			return failure(result) ?? { ok: true };
 		}),
 		resumeSubmittedOrganization: (submission, options) => guarded(runtime, "createOrganization", options, async (invocation) => {
@@ -548,6 +584,10 @@ function createAuth(client, clearAuthenticatedQueries) {
 		})
 	};
 }
+//#endregion
+//#region src/platform/identity.tsx
+const MISSING_IDENTITY_PROVIDER = Symbol("MISSING_IDENTITY_PROVIDER");
+const IdentityContext = createContext(MISSING_IDENTITY_PROVIDER);
 function CapxulIdentityProvider({ client, children }) {
 	const queryClient = useQueryClient();
 	const runtime = client?._internal.identity ?? null;
@@ -565,7 +605,7 @@ function CapxulIdentityProvider({ client, children }) {
 				if (!active) return;
 				state = runtime.snapshot();
 			}
-			if (state.phase === "authenticated" && state.profileComplete && state.account.at === "unknown") await runtime.send({ _tag: "EnsureAccount" }, { signal: controller.signal });
+			if (client._internal.accountSetup !== "explicit" && state.phase === "authenticated" && state.profileComplete && state.account.at === "unknown") await runtime.send({ _tag: "EnsureAccount" }, { signal: controller.signal });
 		}).catch(() => void 0);
 		return () => {
 			active = false;
@@ -580,7 +620,7 @@ function CapxulIdentityProvider({ client, children }) {
 			const account = actingAccount(state);
 			const accountChanged = previousAccount !== void 0 && account !== void 0 && account !== previousAccount;
 			previousAccount = account;
-			if (record.outcome === "applied" && (record.from !== record.to || accountChanged) && (record.to === "authenticated:claimed" || record.to === "authenticated:claimed:ready")) queryClient.invalidateQueries({
+			if (record.outcome === "applied" && (record.from !== record.to || accountChanged) && (record.to === "authenticated:claimed" || record.to === "authenticated:claimed:organization")) queryClient.invalidateQueries({
 				queryKey: capxulKeys.root,
 				...accountChanged ? { refetchType: "none" } : {}
 			});
@@ -665,7 +705,7 @@ function useCapxulTransitions(listener) {
 }
 const entered = (record, target) => record.outcome === "applied" && record.from !== target && record.to === target;
 //#endregion
-//#region src/provider.tsx
+//#region src/platform/provider.tsx
 /**
 * Transient failure codes worth a retry — network blips, rate limits, and
 * upstream provider/unknown hiccups that a later attempt may clear. Everything
@@ -720,6 +760,7 @@ function clearClientScopedQueries(queryClient, ownsQueryClient) {
 }
 function CapxulProvider(props) {
 	const { publishableKey, client: injectedClient, requirement, signer, observability, bootstrapBaseUrl, queryClient, children } = props;
+	const accountSetup = "accountSetup" in props ? props.accountSetup : void 0;
 	const [resolvedQueryClient] = useState(() => queryClient ?? makeDefaultQueryClient());
 	const [ownsQueryClient] = useState(() => queryClient === void 0);
 	const [attempt, setAttempt] = useState(0);
@@ -731,13 +772,15 @@ function CapxulProvider(props) {
 		...requirement === void 0 ? {} : { requirement },
 		...signer === void 0 ? {} : { signer },
 		...observability === void 0 ? {} : { observability },
-		...bootstrapBaseUrl === void 0 ? {} : { bootstrapBaseUrl }
+		...bootstrapBaseUrl === void 0 ? {} : { bootstrapBaseUrl },
+		...accountSetup === void 0 ? {} : { accountSetup }
 	}, [
 		publishableKey,
 		requirement,
 		signer,
 		observability,
 		bootstrapBaseUrl,
+		accountSetup,
 		attempt
 	]);
 	const [ownedBootstrap, setOwnedBootstrap] = useState(null);
@@ -814,7 +857,84 @@ function CapxulProvider(props) {
 	});
 }
 //#endregion
-//#region src/controllers.tsx
+//#region ../protocol/src/errors/failure-modes.ts
+/**
+* Why an operation failed — the one flat vocabulary. The first five are the
+* auth and signer diagnoses that predate this file. The next eleven name the
+* chain path. `refused` and `defect` name a provider refusal and a Capxul
+* fault on any path (ADR-0039 D2). `FailureMode` is derived from this list so
+* a runtime membership check (the SDK's `$exception` projection, the
+* observability schema) and the type can never drift apart. Every word has a
+* failure class in `classes.ts`.
+*/
+const FAILURE_MODES = [
+	"auth-origin-mismatch",
+	"stale-openfort-cache",
+	"app-env-allowlist",
+	"no-secure-context",
+	"signer-not-ready",
+	"rate-limited",
+	"timeout",
+	"upstream-down",
+	"revert",
+	"insufficient-balance",
+	"insufficient-allowance",
+	"rejected",
+	"unauthorized",
+	"forbidden",
+	"bad-request",
+	"method-unsupported",
+	"refused",
+	"defect",
+	"unknown"
+];
+function isFailureMode(value) {
+	return typeof value === "string" && FAILURE_MODES.includes(value);
+}
+//#endregion
+//#region ../protocol/src/errors/model.ts
+/**
+* `Code` narrows to the literal a factory passes, so `Errors.invalidInput(...)`
+* is a `CapxulError<"INVALID_INPUT">`. An operation's error channel is then the
+* union of the codes it can actually produce.
+*/
+var CapxulError$1 = class extends Error {
+	code;
+	details;
+	correlationId;
+	layer;
+	/** The one-word cause (`FailureMode`). `chain.mode` when a chain cause is set. */
+	mode;
+	/** The structured chain-path cause. Never rewritten by a later layer. */
+	chain;
+	constructor(code, message, options = {}) {
+		super(message, "cause" in options ? { cause: options.cause } : void 0);
+		this.name = "CapxulError";
+		this.code = code;
+		if (options.details !== void 0) this.details = options.details;
+		if (options.correlationId !== void 0) this.correlationId = options.correlationId;
+		if (options.layer !== void 0) this.layer = options.layer;
+		const legacy = options.details?.failure_mode;
+		const mode = options.chain?.mode ?? (isFailureMode(options.mode) ? options.mode : void 0) ?? (isFailureMode(legacy) ? legacy : void 0);
+		if (mode !== void 0) this.mode = mode;
+		if (options.chain !== void 0) this.chain = options.chain;
+	}
+};
+//#endregion
+//#region ../protocol/src/primitives/absurd.ts
+/**
+* The default branch of an exhaustive switch: `default: return absurd(value)`.
+* The compiler proves it unreachable; if a value the types rule out arrives at
+* run time anyway, it fails as a named defect instead of falling through.
+*/
+function absurd(value) {
+	throw new CapxulError$1("UNKNOWN", "An exhaustive switch received a value its type rules out.", { details: {
+		defect: "unreachable_case",
+		value: String(value)
+	} });
+}
+//#endregion
+//#region src/access/controllers.tsx
 const action = async (send, event) => {
 	const result = await send(event);
 	return result.ok ? { ok: true } : {
@@ -853,11 +973,14 @@ function CapxulAuthenticationController({ slots }) {
 			state,
 			destination
 		});
+		default: return absurd(state);
 	}
 }
 function ready(destination) {
 	return destination?.to === "dashboardPersonal" || destination?.to === "dashboardOrganization";
 }
+//#endregion
+//#region src/access/onboarding-controller.tsx
 function CapxulOnboardingController(props) {
 	const state = useCapxulIdentity();
 	const destination = useCapxulDestination();
@@ -865,6 +988,16 @@ function CapxulOnboardingController(props) {
 	const resumeSubmittedOrganization = useResumeSubmittedOrganization();
 	const resumedSubmission = useRef(null);
 	const [failedRecovery, setFailedRecovery] = useState(null);
+	const [organizationActions, setOrganizationActions] = useState(0);
+	async function withOrganizationProgress(action) {
+		setOrganizationActions((count) => count + 1);
+		try {
+			return await action();
+		} finally {
+			setOrganizationActions((count) => count - 1);
+		}
+	}
+	const createOrganization = (submission, options) => withOrganizationProgress(() => auth.createOrganization(submission, options));
 	const submission = props.submittedOrganization;
 	const accountAt = state.phase === "authenticated" ? state.account.at : null;
 	useEffect(() => {
@@ -900,11 +1033,11 @@ function CapxulOnboardingController(props) {
 		continueOrganization: props.onOrganizationProfile,
 		cancel: navigation.profileCancel
 	});
-	if (props.intent === "organization" && props.organizationProfile !== null && submission === null) return organizationForm(props, state, auth, null);
-	if (submission !== null && failedRecovery === submission && state.account.at !== "claimed") return organizationForm(props, state, auth, submission);
+	if (props.intent === "organization" && props.organizationProfile !== null && submission === null) return organizationForm(props, state, createOrganization, null);
+	if (submission !== null && failedRecovery === submission && state.account.at !== "claimed") return organizationForm(props, state, createOrganization, submission);
 	if (submission !== null && state.account.at !== "claimed") {
 		if (state.account.at === "failed") {
-			const retry = state.account.retryable ? (options) => auth.createOrganization(submission, options) : void 0;
+			const retry = state.account.retryable ? (options) => createOrganization(submission, options) : void 0;
 			return slots.accountFailure({
 				state,
 				account: state.account,
@@ -918,16 +1051,16 @@ function CapxulOnboardingController(props) {
 	}
 	if (submission !== null && state.account.at === "claimed") {
 		const org = state.account.org;
-		if (org === null) return organizationForm(props, state, auth, submission);
-		if (org.at === "failed") {
-			const retry = org.retryable ? org.orgId === null ? (options) => auth.createOrganization(submission, options) : auth.retry : void 0;
+		if (org === null) return organizationForm(props, state, createOrganization, submission);
+		if (org.observation === "error" || org.setup?.status === "failed" || org.setup?.status === "needsAttention" || org.setup?.status === "awaitingAuthorization" && organizationActions === 0) {
+			const retry = org.orgId === null ? (options) => createOrganization(submission, options) : (options) => withOrganizationProgress(() => auth.retry(options));
 			return slots.organizationFailure({
 				state,
 				org,
-				...retry === void 0 ? {} : { retry }
+				retry
 			});
 		}
-		if (org.at !== "ready") return slots.organizationProgress({
+		if (org.setup?.status !== "ready" || org.observation !== "connected") return slots.organizationProgress({
 			state,
 			org
 		});
@@ -946,7 +1079,7 @@ function CapxulOnboardingController(props) {
 		destination
 	}) : null;
 }
-function organizationForm(props, state, auth, submitted) {
+function organizationForm(props, state, createOrganization, submitted) {
 	const profileDetails = submitted?.profileDetails ?? props.organizationProfile;
 	if (profileDetails === null) return null;
 	return props.slots.organization({
@@ -955,9 +1088,9 @@ function organizationForm(props, state, auth, submitted) {
 		submitted,
 		pinnedHandle: submitted?.organization.handle ?? null,
 		submit: (organization, options) => {
-			if (submitted !== null) return auth.createOrganization(submitted, options);
+			if (submitted !== null) return createOrganization(submitted, options);
 			const normalized = normalizeOrganization(organization);
-			if (normalized === null) return auth.createOrganization({
+			if (normalized === null) return createOrganization({
 				profileDetails,
 				organization
 			}, options);
@@ -966,7 +1099,7 @@ function organizationForm(props, state, auth, submitted) {
 				organization: normalized
 			};
 			props.onSubmittedOrganization(next);
-			return auth.createOrganization(next, options);
+			return createOrganization(next, options);
 		},
 		back: () => {
 			props.onOrganizationProfile(null);
@@ -976,4 +1109,4 @@ function organizationForm(props, state, auth, submitted) {
 	});
 }
 //#endregion
-export { useCapxul as _, useCapxulAuth as a, useCapxulIdentityOrNull as c, toInvocationControls as d, toInvocationOptions as f, useCapxulClientOrNull as g, capxulKeys as h, entered as i, useCapxulSend as l, actingAccount as m, CapxulOnboardingController as n, useCapxulDestination as o, accountKey as p, CapxulProvider as r, useCapxulIdentity as s, CapxulAuthenticationController as t, useCapxulTransitions as u };
+export { orgKeySegment as _, entered as a, useCapxulIdentity as c, useCapxulTransitions as d, toInvocationControls as f, capxulKeys as g, actingAccount as h, CapxulProvider as i, useCapxulIdentityOrNull as l, accountKey as m, CapxulAuthenticationController as n, useCapxulAuth as o, toInvocationOptions as p, absurd as r, useCapxulDestination as s, CapxulOnboardingController as t, useCapxulSend as u, useCapxulClientOrNull as v, useCapxul as y };