@capxul/cli 4.20.0-beta.26 → 4.20.0-beta.27

package/dist/{entry-CXlsnqyc.mjs → entry-GLdITgH4.mjs}

@@ -1,5 +1,5 @@
 import { i as __exportAll, o as __require, r as __commonJSMin, s as __toESM } from "./lib-DnmstTkB.mjs";
-import { A as hexToBigInt, B as padHex, C as InvalidAddressError, D as concat$1, E as createCursor, F as bytesToHex, G as InvalidBytesBooleanError, H as size, I as numberToHex, K as BaseError$1, L as stringToHex, M as hexToBytes, N as toBytes$1, O as concatHex, P as boolToHex, R as toHex, S as keccak256$1, T as toRlp, U as isHex$1, V as trim$1, W as IntegerOutOfRangeError, _ as slice, a as ENVIRONMENT_NAMES, b as checksumAddress, d as explicitOrganization$2, f as flagValue, g as readField, h as isRecord, j as hexToNumber, k as assertSize, l as describeWhere, m as parseWhere, n as styleFor, o as STAGING_ORIGIN, p as flagValues, r as whoamiLines, s as chooseEnvironment, t as headerLine, u as environmentOf, v as sliceBytes, w as format, x as getAddress$1, y as isAddress$1, z as pad } from "./where-view-C0WT0ARR.mjs";
+import { A as assertSize, B as pad, C as keccak256$1, D as createCursor, E as toRlp, F as boolToHex, G as IntegerOutOfRangeError, H as trim$1, I as bytesToHex, K as InvalidBytesBooleanError, L as numberToHex, M as hexToNumber, N as hexToBytes, O as concat$1, P as toBytes$1, R as stringToHex, S as getAddress$1, T as format, U as size, V as padHex, W as isHex$1, _ as readField, a as ENVIRONMENT_NAMES, b as isAddress$1, d as explicitOrganization$2, f as flagValue, g as isRecord, h as parseWhere, j as hexToBigInt, k as concatHex, l as describeWhere, m as networkName, n as styleFor, o as STAGING_ORIGIN, p as flagValues, q as BaseError$1, r as whoamiLines, s as chooseEnvironment, t as headerLine, u as environmentOf, v as slice, w as InvalidAddressError, x as checksumAddress, y as sliceBytes, z as toHex } from "./where-view-Csv4lEES.mjs";
 import { t as require_lib } from "./lib-CoGPQsbr.mjs";
 import process$1, { arch, platform } from "node:process";
 import { fileURLToPath } from "node:url";
@@ -4844,10 +4844,19 @@ const ApprovalNetworkSchema = Schema.Struct({
 	name: Schema.String,
 	explorerUrl: Schema.String
 });
+/**
+* Whose money the operation moves: the person's own, or an Organization's,
+* which a reader follows through that Organization's scope.
+*/
+const ApprovalActorSchema = Schema.Union([Schema.Struct({ kind: Schema.Literal("personal") }), Schema.Struct({
+	kind: Schema.Literal("organization"),
+	orgId: Schema.NonEmptyString
+})]);
 /** What the person reads before they sign. */
 const ApprovalSummarySchema = Schema.Struct({
 	title: Schema.String,
 	from: Schema.Struct({
+		kind: Schema.Literals(["personal", "organization"]),
 		label: Schema.String,
 		address: AddressSchema$1
 	}),
@@ -4869,6 +4878,7 @@ const ApprovalSchema = Schema.Struct({
 	url: Schema.String,
 	kind: Schema.Literals(APPROVAL_KINDS),
 	state: Schema.Literals(APPROVAL_STATES),
+	actor: ApprovalActorSchema,
 	summary: ApprovalSummarySchema,
 	operation: ApprovalOperationSchema,
 	/** Who must sign: the owner key of the paying Safe. */
@@ -5023,7 +5033,7 @@ faucetMint: Operation.action("accounts.grants.faucetMint", {
 	]
 }) };
 /** Every approval call: the record is not the signed-in person's, or there is none. */
-const APPROVAL = ["ROLE_PERMISSION_DENIED"];
+const APPROVAL$1 = ["ROLE_PERMISSION_DENIED"];
 /**
 * A prepared money action waits here for the person to sign it with their own
 * key, on the approval page. The backend never signs: it records the person's
@@ -5048,7 +5058,7 @@ const approvals = {
 		errors: [
 			...CALL$10,
 			...DEFECTS,
-			...APPROVAL
+			...APPROVAL$1
 		]
 	}),
 	/** The person opened the approval page: stamp the first review of a pending approval. */
@@ -5058,7 +5068,7 @@ const approvals = {
 		errors: [
 			...CALL$10,
 			...DEFECTS,
-			...APPROVAL
+			...APPROVAL$1
 		]
 	}),
 	/**
@@ -5074,7 +5084,7 @@ const approvals = {
 		errors: [
 			...CALL$10,
 			...DEFECTS,
-			...APPROVAL,
+			...APPROVAL$1,
 			"WRONG_STATE"
 		]
 	}),
@@ -5085,7 +5095,7 @@ const approvals = {
 		errors: [
 			...CALL$10,
 			...DEFECTS,
-			...APPROVAL,
+			...APPROVAL$1,
 			"WRONG_STATE"
 		]
 	}),
@@ -5096,7 +5106,7 @@ const approvals = {
 		errors: [
 			...CALL$10,
 			...DEFECTS,
-			...APPROVAL,
+			...APPROVAL$1,
 			"WRONG_STATE"
 		]
 	})
@@ -9528,7 +9538,11 @@ const ORGANIZATION_OPERATIONS = {
 			seedNativeReadiness: "operator.fixtures.seedNativeReadiness",
 			seedPrerequisites: "operator.fixtures.seedPrerequisites"
 		},
-		identities: { purgeByEmail: "operator.identities.purgeByEmail" }
+		identities: {
+			purgeByEmail: "operator.identities.purgeByEmail",
+			/** One Account and every row that refers to it, unless it has Payments or an Organization tie. */
+			purgeAccount: "operator.identities.purgeAccount"
+		}
 	},
 	/** Organizations' internal functions; its public rows join from `OPERATIONS`. */
 	organizations: {
@@ -9778,7 +9792,11 @@ const PLATFORM_OPERATIONS = {
 			recordUse: "applications.bootstraps.recordUse",
 			resolve: "applications.bootstraps.resolve"
 		},
-		keys: { issue: "applications.keys.issue" },
+		keys: {
+			issue: "applications.keys.issue",
+			/** Operator-only: revoke one key by its id, whoever owns it. */
+			revokeById: "applications.keys.revokeById"
+		},
 		quickstarts: {
 			claim: "applications.quickstarts.claim",
 			mint: "applications.quickstarts.mint"
@@ -14852,7 +14870,7 @@ function mapAccountLifecycle(input) {
 }
 //#endregion
 //#region ../../packages/sdk/package.json
-var version$2 = "4.20.0-beta.26";
+var version$2 = "4.20.0-beta.27";
 //#endregion
 //#region ../../packages/sdk/src/observability/telemetry/exception-projection.ts
 /** Fixed fallback for failures that have no safe message. */
@@ -19211,6 +19229,13 @@ function subscribeFreshQuery(deps, args, listener, operation, projection, option
 }
 //#endregion
 //#region ../../packages/sdk/src/payments/lifecycle-execution.ts
+/**
+* The prepared command is this lifecycle intent; a retry also names the
+* original birth command of the scope it was asked for.
+*/
+const lifecycleCommandCheck = (intent, expectedOrganizationId) => async (request, evidence) => await matchesIntent(intent)(request, evidence) && (intent.kind !== "retry" || (expectedOrganizationId === void 0 ? evidence.sourceCommand?.kind === "birth" && evidence.sourceCommand.actor.kind === "account" : evidence.sourceCommand?.kind === "birth" && evidence.sourceCommand.actor.kind === "organization" && evidence.sourceCommand.actor.orgId === expectedOrganizationId));
+/** The prepared command pays exactly the request the payer confirmed. */
+const requestPaymentCheck = (confirmation) => async (request) => "kind" in request && request.kind === "payment_request" && canonicalJson(request.confirmation) === canonicalJson(confirmation);
 function executePaymentLifecycle(deps, intent, signal, controls, expectedOrganizationId, onPrepared) {
 	return executePrepared(deps, (signerAddress) => runIfActive(signal, CAPXUL_OPERATIONS.payments.prepareLifecycleExecution, () => withInvocationParentSpan(Effect.suspend(() => callOperation(deps.convexCall, lifecycles.prepareScoped, copyInvocationObservation(controls, {
 		signerAddress,
@@ -19219,13 +19244,13 @@ function executePaymentLifecycle(deps, intent, signal, controls, expectedOrganiz
 			kind: "organization",
 			orgId: expectedOrganizationId
 		}
-	})).pipe(Effect.mapError((publicError) => ({ publicError })))), controls), deps.runPromise), async (request, evidence) => await matchesIntent(intent)(request, evidence) && (intent.kind !== "retry" || (expectedOrganizationId === void 0 ? evidence.sourceCommand?.kind === "birth" && evidence.sourceCommand.actor.kind === "account" : evidence.sourceCommand?.kind === "birth" && evidence.sourceCommand.actor.kind === "organization" && evidence.sourceCommand.actor.orgId === expectedOrganizationId)), false, void 0, signal, controls, onPrepared);
+	})).pipe(Effect.mapError((publicError) => ({ publicError })))), controls), deps.runPromise), lifecycleCommandCheck(intent, expectedOrganizationId), false, void 0, signal, controls, onPrepared);
 }
 function executeRequestPayment(deps, confirmation, controls, onPrepared) {
 	return executePrepared(deps, (signerAddress) => runIfActive(controls?.signal, commands$1.prepareRequest.name, () => withInvocationParentSpan(Effect.suspend(() => callOperation(deps.convexCall, commands$1.prepareRequest, copyInvocationObservation(controls, {
 		confirmation,
 		signerAddress
-	})).pipe(Effect.mapError((publicError) => ({ publicError })))), controls), deps.runPromise), async (request) => "kind" in request && request.kind === "payment_request" && canonicalJson(request.confirmation) === canonicalJson(confirmation), false, void 0, controls?.signal, controls, onPrepared);
+	})).pipe(Effect.mapError((publicError) => ({ publicError })))), controls), deps.runPromise), requestPaymentCheck(confirmation), false, void 0, controls?.signal, controls, onPrepared);
 }
 function executeOrganizationPayment(deps, input, signal, onPreparedClosed, controls, onPrepared) {
 	return executePrepared(deps, (signerAddress) => runIfActive(signal, CAPXUL_OPERATIONS.organizationPayments.prepareExecution, () => withInvocationParentSpan(Effect.suspend(() => callOperation(deps.convexCall, commands$1.prepareOrganization, copyInvocationObservation(controls, {
@@ -21705,6 +21730,524 @@ function sleep(ms, signal) {
 	});
 }
 //#endregion
+//#region ../../packages/protocol/src/payroll/model.ts
+function toPayrollRunId(raw) {
+	return toNonEmptyStringBrand(raw, "payrollRunId", (value) => isNonEmptyString(value));
+}
+function toPayrollGroupId(raw) {
+	return toNonEmptyStringBrand(raw, "payrollGroupId", (value) => isNonEmptyString(value));
+}
+//#endregion
+//#region ../../packages/sdk/src/payroll/run-checks.ts
+/** Match the caller's compensation to the committed V3 Payslip. */
+function payslipIdentityMatches(message, item, index, runId, period) {
+	return message.runId === runId && message.itemIndex === index && message.employeeRef === item.partyId && message.periodStart === period.start && message.periodEnd === period.end && message.adjustmentsHash === hashAdjustmentsV3(item.adjustments);
+}
+function payslipAmountMatches(message, item) {
+	const exact = toExactAssetAmount(item.amount, CONFIGURED_MONEY_ASSETS);
+	return message.gross.asset === exact.asset && message.gross.minorUnits === item.gross && message.gross.decimals === exact.decimals && message.net.asset === exact.asset && message.net.minorUnits === item.net && message.net.decimals === exact.decimals;
+}
+function isRunItem(prepared, item, evidence, index, runId, period) {
+	if (prepared === void 0) return false;
+	const bundle = evidence.preparedCommand?.documentBundles?.[index];
+	const preparedItem = evidence.preparedCommand?.items[index];
+	const payslip = bundle?.envelope;
+	if (bundle === void 0 || payslip?.primaryType !== "Payslip") return false;
+	return canonicalJson(prepared.to) === canonicalJson(item.to) && prepared.paymentType === "payroll" && canonicalJson(prepared.amount) === canonicalJson(item.amount) && bundle.adjustments !== void 0 && canonicalJson(bundle.adjustments) === canonicalJson(item.adjustments) && payslipIdentityMatches(payslip.message, item, index, runId, period) && payslipAmountMatches(payslip.message, item) && (preparedItem?.operation === "send" || preparedItem?.operation === "create_commitment") && preparedItem.documentHash === evidence.preparedCommand?.instructionDocuments?.[index]?.documentHash;
+}
+/**
+* The batch the backend derived from a payroll intent must be the batch this
+* caller asked for, checked before the digest is signed.
+*
+* The payslip envelope on each item is server-built and carries the run row's
+* own `issuedAt`, so the batch cannot be fingerprinted against a local copy
+* (`matchesIntent` is unavailable here). What CAN be verified is every field
+* the caller supplied — the org, the Budget, the request key, and per item the
+* recipient, the amount and the payslip figures — plus the lineage binding the
+* batch to the run just written. A prepared command that pays a different
+* person, a different amount, from a different Budget, or under a different
+* run never reaches the signer.
+*/
+function isRunBatch(input) {
+	return (batch, evidence) => Promise.resolve(!("kind" in batch) && batch.orgId === input.orgId && batch.permissionId === input.permissionId && batch.requestKey === input.requestKey && batch.lineage?.kind === "payroll" && batch.lineage.runId === input.runId && batch.items.length === input.items.length && batch.items.every((item) => item.amount.asset === input.asset) && input.items.every((item, index) => isRunItem(batch.items[index], item, evidence, index, input.runId, input.period)));
+}
+/**
+* The batch is `isRunBatch` for the run the backend just wrote, and that run
+* is the period the caller asked for: the payslip's `period` is a
+* server-formatted label, so the stored run is where the caller's own two
+* numbers are checkable.
+*/
+function isAuthorizedRunBatch(input, run) {
+	return (request, evidence) => run === void 0 || run.periodStart !== input.period.start || run.periodEnd !== input.period.end ? Promise.resolve(false) : isRunBatch({
+		...input,
+		runId: run.id
+	})(request, evidence);
+}
+/** A decoded detail is the run asked for, whole: its scope, membership and quantities agree. */
+function checkPayrollRunDetail(value, orgId, runId) {
+	if (value === null) return {
+		ok: true,
+		value: null
+	};
+	if (value.orgId !== orgId || value.run.id !== runId || value.items.length === 0 || value.items.length !== value.run.recipientCount || new Set(value.items.map((item) => item.payment.id)).size !== value.items.length || value.items.some((item, index) => item.itemIndex !== index || item.amount.asset !== value.run.total.asset || item.payment.amount.asset !== item.amount.asset || item.payment.paymentType !== "payroll")) return {
+		ok: false,
+		error: Errors.invalidInput("run", "Payroll run scope or membership does not match")
+	};
+	try {
+		const total = toExactAssetAmount(value.run.total, CONFIGURED_MONEY_ASSETS);
+		let rawTotal = 0n;
+		for (const item of value.items) {
+			const amount = toExactAssetAmount(item.amount, CONFIGURED_MONEY_ASSETS);
+			const payment = toExactAssetAmount(item.payment.amount, CONFIGURED_MONEY_ASSETS);
+			if (amount.minorUnits !== payment.minorUnits) return {
+				ok: false,
+				error: Errors.invalidInput("run", "Payroll item quantity does not match its Payment")
+			};
+			rawTotal += BigInt(amount.minorUnits);
+		}
+		if (rawTotal !== BigInt(total.minorUnits)) return {
+			ok: false,
+			error: Errors.invalidInput("run", "Payroll run total does not match its items")
+		};
+	} catch {
+		return {
+			ok: false,
+			error: Errors.invalidInput("run", "Payroll run quantities are invalid")
+		};
+	}
+	return {
+		ok: true,
+		value
+	};
+}
+//#endregion
+//#region ../../packages/sdk/src/payroll/run-decoding.ts
+function toPayrollRun(wire) {
+	return {
+		id: toPayrollRunId(wire.id),
+		status: wire.status,
+		periodStart: wire.periodStart,
+		periodEnd: wire.periodEnd,
+		total: wire.total,
+		recipientCount: wire.recipientCount
+	};
+}
+function toPayrollRuns(wire) {
+	return {
+		...mapPage(wire, toPayrollRun),
+		settledThisMonth: wire.settledThisMonth
+	};
+}
+function toPayrollGroup(wire) {
+	return {
+		id: toPayrollGroupId(wire.id),
+		name: wire.name,
+		tone: wire.tone,
+		members: wire.members.map((member) => ({
+			partyId: member.partyId,
+			amount: member.amount,
+			currency: member.currency
+		}))
+	};
+}
+function validateRunItems(input) {
+	for (const [index, item] of input.items.entries()) {
+		if (Schema.decodeResult(PayrollRunItemInputSchema, { onExcessProperty: "error" })(item)._tag === "Failure") return Errors.invalidInput(`items.${index}`, "invalid Payroll item");
+		try {
+			const exact = toExactAssetAmount(item.amount, CONFIGURED_MONEY_ASSETS);
+			const net = BigInt(item.net);
+			const gross = BigInt(item.gross);
+			const adjustments = item.adjustments.reduce((sum, row) => sum + BigInt(row.amount), 0n);
+			if (item.amount.asset !== input.asset || item.net !== exact.minorUnits || gross + adjustments !== net) return Errors.invalidInput(`items.${index}`, "invalid Payroll units");
+		} catch {
+			return Errors.invalidInput(`items.${index}`, "invalid Payroll units");
+		}
+	}
+	return null;
+}
+const RunInputSchema = Schema.Struct({
+	permissionId: AuthorizePayrollRunExecutionInputSchema.fields.permissionId,
+	asset: AuthorizePayrollRunExecutionInputSchema.fields.asset,
+	period: AuthorizePayrollRunExecutionInputSchema.fields.period,
+	items: AuthorizePayrollRunExecutionInputSchema.fields.items,
+	requestKey: Schema.optional(AuthorizePayrollRunExecutionInputSchema.fields.requestKey)
+});
+/** Decode caller input before session or signer work. Keep routing outside the input. */
+function decodePayrollRunInput(value) {
+	try {
+		const decoded = Schema.decodeUnknownSync(RunInputSchema, { onExcessProperty: "error" })(value);
+		const input = {
+			permissionId: decoded.permissionId,
+			asset: decoded.asset,
+			period: decoded.period,
+			...decoded.requestKey === void 0 ? {} : { requestKey: decoded.requestKey },
+			items: decoded.items.map((item) => ({
+				amount: item.amount,
+				gross: item.gross,
+				net: item.net,
+				adjustments: item.adjustments,
+				partyId: toPartyId(item.partyId),
+				to: item.to.kind === "party" ? {
+					kind: "party",
+					partyId: toPartyId(item.to.partyId)
+				} : item.to.kind === "address" ? {
+					kind: "address",
+					address: toAddress(item.to.address)
+				} : item.to
+			}))
+		};
+		if (input.items.length === 0 || input.period.start > input.period.end) throw Errors.invalidInput("input", "Payroll requires items and an ordered period");
+		const error = validateRunItems(input);
+		if (error !== null) throw error;
+		return input;
+	} catch (cause) {
+		throw cause instanceof CapxulError ? cause : Errors.invalidInput("input", "Invalid Payroll input");
+	}
+}
+/** Read only the exact backend prepare receipt, never an arbitrary signer failure. */
+function payrollResolution(error, requestKey) {
+	const details = error.details;
+	if (error.code !== "WRONG_STATE" || details?.method !== runs.authorize.name || details.requestKey !== requestKey || typeof details.commandId !== "string" || typeof details.runId !== "string") return void 0;
+	return details.payrollResolution === "failed" || details.payrollResolution === "settled" ? details.payrollResolution : void 0;
+}
+function validatePayrollRunLookup(orgId, runId) {
+	return !Schema.is(PayrollRunIdSchema)(runId) || orgId.length === 0 ? {
+		ok: false,
+		error: Errors.invalidInput("runId", "Organization and run ID must be valid")
+	} : {
+		ok: true,
+		value: void 0
+	};
+}
+/** Strict saved detail decoder shared by the read and fresh stream. */
+function decodePayrollRunDetail(raw, orgId, runId) {
+	const decoded = Schema.decodeUnknownResult(Schema.NullOr(PayrollRunDetailSchema), { onExcessProperty: "error" })(raw);
+	if (decoded._tag === "Failure") return {
+		ok: false,
+		error: Errors.invalidInput("run", "Invalid Payroll run detail")
+	};
+	return checkPayrollRunDetail(decoded.success, orgId, runId);
+}
+//#endregion
+//#region ../../packages/sdk/src/payroll/run-subscription.ts
+function detailValue(result) {
+	if (!result.ok) throw result.error;
+	return result.value;
+}
+function subscribePayrollRun(deps, orgId, runId, listener, options) {
+	const operation = CAPXUL_OPERATIONS.org.payroll.subscribeRun;
+	const valid = deps.validate(orgId, runId);
+	if (!valid.ok) return runCapxulEffect(Effect.fail(valid.error), observationOnlyControls(deps.invocationControls?.(options) ?? options), operation, deps.runPromise);
+	const decode = (raw) => detailValue(deps.decode(raw, orgId, runId));
+	return subscribeFreshQuery(deps, {
+		orgId,
+		runId
+	}, listener, operation, {
+		decode,
+		validateCached: (raw) => {
+			decode(raw);
+		},
+		invalidValue: (cause) => isCapxulError(cause) ? cause : Errors.invalidInput("run", "Invalid Payroll run detail"),
+		invalidScope: () => Errors.invalidInput("run", "Payroll run subscription scope does not match"),
+		lostValue: () => Errors.invalidInput("run", "Payroll run is no longer readable"),
+		unavailable: () => Errors.notImplemented("payroll", "subscribeRun")
+	}, options);
+}
+//#endregion
+//#region ../../packages/sdk/src/payroll/run-authorization.ts
+/**
+* Authorize one payroll run: a stable request key, the prepared batch checked
+* against the run the caller asked for, the signature, and the submission.
+*/
+async function authorizePayrollRun(scope, input, controls, onRequestKey, onResolved) {
+	const { deps, orgId, requestKeyScope } = scope;
+	const signal = controls?.signal;
+	const execution = executionDependencies(deps);
+	if (execution === null) return {
+		ok: false,
+		error: Errors.notImplemented("payroll", "executionComposition")
+	};
+	try {
+		input = decodePayrollRunInput(input);
+	} catch (cause) {
+		return {
+			ok: false,
+			error: asCapxulError(cause)
+		};
+	}
+	const { requestKey: provided, ...canonicalInput } = input;
+	const actorId = onRequestKey === void 0 ? void 0 : execution.actor.authSession()?.authUserId;
+	if (onRequestKey !== void 0 && actorId === void 0) return {
+		ok: false,
+		error: Errors.notAuthenticated()
+	};
+	const requestKey = await paymentRequestKeyLifecycle(`${requestKeyScope}:${AUTHORIZE_RUN}`, onRequestKey === void 0 ? {
+		orgId,
+		input
+	} : {
+		actorId,
+		orgId,
+		input: canonicalInput
+	}, provided, onRequestKey === void 0 ? void 0 : { manageProvidedKey: true });
+	try {
+		await onRequestKey?.(requestKey.key);
+		if (onRequestKey !== void 0 && execution.actor.authSession()?.authUserId !== actorId) {
+			await requestKey.finish(false).catch(() => void 0);
+			return {
+				ok: false,
+				error: Errors.notAuthenticated()
+			};
+		}
+	} catch (cause) {
+		await requestKey.finish(false).catch(() => void 0);
+		return {
+			ok: false,
+			error: asCapxulError(cause)
+		};
+	}
+	let authorized;
+	let acceptedReplay;
+	let preparedClosed = false;
+	let terminalReplay;
+	const submitted = await executePrepared(execution, async (signerAddress) => {
+		const prepared = await runIfActive(signal, AUTHORIZE_RUN, () => withInvocationParentSpan(Effect.suspend(() => callOperation(deps.convexCall, runs.authorize, copyInvocationObservation(controls, {
+			orgId,
+			permissionId: input.permissionId,
+			asset: input.asset,
+			requestKey: requestKey.key,
+			signerAddress,
+			period: input.period,
+			items: input.items
+		}))).pipe(Effect.mapError((publicError) => ({ publicError }))), controls), deps.runPromise);
+		if (!prepared.ok) {
+			terminalReplay = payrollResolution(prepared.error, requestKey.key);
+			return prepared;
+		}
+		authorized = prepared.value.run;
+		acceptedReplay = prepared.value.replay.kind === "accepted" ? prepared.value.replay.submission : void 0;
+		return {
+			ok: true,
+			value: prepared.value.execution
+		};
+	}, (request, evidence) => isAuthorizedRunBatch({
+		orgId,
+		permissionId: input.permissionId,
+		requestKey: requestKey.key,
+		asset: input.asset,
+		period: input.period,
+		items: input.items
+	}, authorized)(request, evidence), true, () => preparedClosed = true, signal, controls, void 0, () => acceptedReplay);
+	const resolution = preparedClosed ? "failed" : terminalReplay;
+	if (resolution !== void 0) try {
+		await onResolved?.(resolution);
+	} catch {}
+	try {
+		await requestKey.finish(submitted.ok || resolution !== void 0);
+	} catch {}
+	if (!submitted.ok) return submitted;
+	return authorized === void 0 ? {
+		ok: false,
+		error: Errors.unknown()
+	} : {
+		ok: true,
+		value: toPayrollRun(authorized)
+	};
+}
+const AUTHORIZE_RUN = runs.authorize.name;
+function executionDependencies(deps) {
+	return deps.actor === void 0 || deps.chainId === void 0 || deps.signer === void 0 ? null : {
+		actor: deps.actor,
+		chainId: deps.chainId,
+		convexCall: deps.convexCall,
+		runPromise: deps.runPromise,
+		signer: deps.signer,
+		...deps.telemetry === void 0 ? {} : { telemetry: deps.telemetry }
+	};
+}
+//#endregion
+//#region ../../packages/sdk/src/payroll/runs.ts
+function makePayrollMethods(deps, orgId) {
+	const requestKeyScope = deps.requestKeyScope ?? `client-${crypto.randomUUID()}`;
+	/** One observed call of one payroll row, its reply projected inside the call, under the row's name. */
+	const call = (row, args, options, project) => {
+		const controls = deps.invocationControls?.(options) ?? options;
+		return runPortEffect(callOperation(deps.convexCall, row, copyInvocationObservation(controls, args)).pipe(Effect.map(project), Effect.mapError((publicError) => ({ publicError }))), controls, row.name, deps.runPromise);
+	};
+	return {
+		subscribeRun: (runId, listener, options) => subscribePayrollRun({
+			actor: deps.actor,
+			convexCall: deps.convexCall,
+			query: reference(runs.get),
+			runPromise: deps.runPromise,
+			invocationControls: deps.invocationControls,
+			decode: decodePayrollRunDetail,
+			validate: validatePayrollRunLookup
+		}, orgId, runId, listener, options),
+		getRun: (runId, options) => {
+			const controls = deps.invocationControls?.(options) ?? options;
+			const lifetime = deps.actor?.authLifetime();
+			const operation = runs.get.name;
+			return runCapxulEffect(Effect.gen(function* () {
+				const lookup = validatePayrollRunLookup(orgId, runId);
+				if (!lookup.ok) return yield* Effect.fail(lookup.error);
+				if (lifetime === void 0 || lifetime.authUserId === null || deps.actor === void 0) return yield* Effect.fail(Errors.notAuthenticated());
+				const current = () => deps.actor?.matchesAuthLifetime(lifetime, lifetime.authUserId) === true;
+				if (!current()) return yield* Effect.fail(Errors.notAuthenticated());
+				const parent = yield* Effect.currentSpan.pipe(Effect.orDie);
+				const captured = carryInvocationParentSpan(controls, parent);
+				const run = yield* awaitCapxulResult(() => runIfActive(controls?.signal, operation, () => withInvocationParentSpan(Effect.suspend(() => callOperation(deps.convexCall, runs.get, copyInvocationObservation(captured, {
+					orgId,
+					runId
+				}))).pipe(Effect.mapError((publicError) => ({ publicError }))), captured), deps.runPromise));
+				if (!current()) return yield* Effect.fail(Errors.cancelled({ operation }));
+				const checked = checkPayrollRunDetail(run, orgId, runId);
+				return yield* checked.ok ? Effect.succeed(checked.value) : Effect.fail(checked.error);
+			}), observationOnlyControls(controls), operation, deps.runPromise);
+		},
+		runs: (options) => call(runs.list, { orgId }, options, toPayrollRuns),
+		authorizeRun: (input, options) => {
+			const controls = deps.invocationControls?.(options) ?? options;
+			return runCapxulEffect(Effect.gen(function* () {
+				if (controls?.signal?.aborted === true) return yield* Effect.fail(Errors.cancelled({ operation: AUTHORIZE_RUN }));
+				const parent = yield* Effect.currentSpan.pipe(Effect.orDie);
+				return yield* awaitCapxulResult(() => authorizePayrollRun({
+					deps,
+					orgId,
+					requestKeyScope
+				}, input, carryInvocationParentSpan(controls, parent), options?.onRequestKey, options?.onResolved));
+			}), observationOnlyControls(controls), AUTHORIZE_RUN, deps.runPromise);
+		},
+		terms: (options) => call(terms.list, { orgId }, options, (rates) => rates),
+		groups: {
+			list: (options) => call(groups$1.list, { orgId }, options, (saved) => mapPage(saved, toPayrollGroup)),
+			save: (input, options) => call(groups$1.save, {
+				orgId,
+				...input.id === void 0 ? {} : { id: String(input.id) },
+				name: input.name,
+				tone: input.tone,
+				members: input.members
+			}, options, toPayrollGroup),
+			remove: (id, options) => call(groups$1.remove, {
+				orgId,
+				id
+			}, options, () => void 0)
+		}
+	};
+}
+const payrollUnavailable = () => Promise.resolve({
+	ok: false,
+	error: Errors.notImplemented("payroll", "executionComposition")
+});
+/** The bundle an unconfigured client exposes — every verb refuses, none throws. */
+function makeUnavailablePayrollMethods() {
+	return {
+		getRun: payrollUnavailable,
+		subscribeRun: payrollUnavailable,
+		runs: payrollUnavailable,
+		authorizeRun: payrollUnavailable,
+		terms: payrollUnavailable,
+		groups: {
+			list: payrollUnavailable,
+			save: payrollUnavailable,
+			remove: payrollUnavailable
+		}
+	};
+}
+//#endregion
+//#region ../../packages/sdk/src/accounts/command-approvals.ts
+/**
+* Keep a prepared command only when it is the one asked for and its operation
+* is the person's own. A mismatch is closed unsent when `close`, as the signed
+* path closes a new Payment; a retry or a request keeps its Payment open.
+*/
+async function checked(deps, signerAddress, prepared, expected, close) {
+	if (!prepared.ok) return prepared;
+	const session = deps.actor?.authSession() ?? null;
+	if (session === null || deps.chainId === void 0) return {
+		ok: false,
+		error: Errors.notAuthenticated()
+	};
+	const evidence = prepared.value;
+	if (await expected(evidence.request, evidence) && await verifiedPreparedCommand(evidence, session.email, signerAddress, deps.chainId)) return prepared;
+	const refused = {
+		ok: false,
+		error: Errors.invalidInput("execution", "prepared command mismatch")
+	};
+	return close ? abandonPrepared(deps, evidence.executionId, "prepared_mismatch", refused) : refused;
+}
+/** A retry, a request payment or a payroll run, rather than a new Payment. */
+const isCommandApproval = (input) => "retry" in input || "request" in input || "payrollRun" in input;
+/** Prepare a retry, a request payment or a payroll run for `signerAddress`, checked. */
+function prepareVerifiedCommand(deps, input, signerAddress, signal) {
+	if ("retry" in input) return prepareVerifiedRetry(deps, input, signerAddress, signal);
+	if ("request" in input) return prepareVerifiedRequestPayment(deps, input, signerAddress, signal);
+	return prepareVerifiedPayrollRun(deps, input, signerAddress, signal);
+}
+/** The retry of one Payment, prepared in the scope that paid it. */
+async function prepareVerifiedRetry(deps, input, signerAddress, signal) {
+	const intent = {
+		kind: "retry",
+		paymentId: input.retry
+	};
+	return checked(deps, signerAddress, await runIfActive(signal, CAPXUL_OPERATIONS.payments.prepareLifecycleExecution, () => callOperation(deps.convexCall, lifecycles.prepareScoped, {
+		signerAddress,
+		intent,
+		expectedScope: input.organizationId === void 0 ? { kind: "account" } : {
+			kind: "organization",
+			orgId: input.organizationId
+		}
+	}).pipe(Effect.mapError((publicError) => ({ publicError }))), deps.runPromise), lifecycleCommandCheck(intent, input.organizationId), false);
+}
+/** The Payment of one request, exactly as the request froze it. */
+async function prepareVerifiedRequestPayment(deps, input, signerAddress, signal) {
+	const decoded = Schema.decodeResult(RequestPaymentConfirmationSchema, { onExcessProperty: "error" })(input.request);
+	if (decoded._tag === "Failure") return {
+		ok: false,
+		error: Errors.invalidInput("confirmation", "invalid request confirmation")
+	};
+	const confirmation = decoded.success;
+	return checked(deps, signerAddress, await runIfActive(signal, commands$1.prepareRequest.name, () => callOperation(deps.convexCall, commands$1.prepareRequest, {
+		confirmation,
+		signerAddress
+	}).pipe(Effect.mapError((publicError) => ({ publicError }))), deps.runPromise), requestPaymentCheck(confirmation), false);
+}
+/** One payroll run: the run the backend writes and the batch that pays it, checked together. */
+async function prepareVerifiedPayrollRun(deps, input, signerAddress, signal) {
+	let run;
+	try {
+		run = decodePayrollRunInput(input.payrollRun);
+	} catch (cause) {
+		return {
+			ok: false,
+			error: asCapxulError(cause)
+		};
+	}
+	const orgId = input.organizationId;
+	const requestKey = run.requestKey ?? `payroll_${crypto.randomUUID()}`;
+	const { permissionId, asset, period, items } = run;
+	const authorized = await runIfActive(signal, runs.authorize.name, () => callOperation(deps.convexCall, runs.authorize, {
+		orgId,
+		permissionId,
+		asset,
+		requestKey,
+		signerAddress,
+		period,
+		items
+	}).pipe(Effect.mapError((publicError) => ({ publicError }))), deps.runPromise);
+	if (!authorized.ok) return authorized;
+	return checked(deps, signerAddress, {
+		ok: true,
+		value: authorized.value.execution
+	}, isAuthorizedRunBatch({
+		orgId,
+		permissionId,
+		requestKey,
+		asset,
+		period,
+		items
+	}, authorized.value.run), authorized.value.replay.kind !== "accepted");
+}
+//#endregion
 //#region ../../packages/sdk/src/accounts/organization-approvals.ts
 /** The Organization Payment prepared for `signerAddress` and checked, before any approval. */
 async function prepareVerifiedOrganizationPayment(deps, input, signerAddress, signal) {
@@ -21811,6 +22354,7 @@ function makeApprovalsMethods(deps) {
 	};
 	const prepare = async (input, options) => {
 		const signal = options?.signal;
+		if (isCommandApproval(input)) return openApproval(signal, (signerAddress) => prepareVerifiedCommand(deps, input, signerAddress, signal));
 		if ("organizationId" in input) return openApproval(signal, (signerAddress) => prepareVerifiedOrganizationPayment(deps, input, signerAddress, signal));
 		const intent = paymentExecutionIntent(input);
 		if (!intent.ok) return intent;
@@ -21903,7 +22447,7 @@ function makeApprovalsMethods(deps) {
 			ok: true,
 			value: null
 		};
-		const payments = await readApprovalPayments(deps, approval.operation.paymentIds, organizationId, signal);
+		const payments = await readApprovalPayments(deps, approval.operation.paymentIds, organizationId ?? (approval.actor.kind === "organization" ? approval.actor.orgId : void 0), signal);
 		if (!payments.ok) return payments;
 		if (unsent(approval, payments.value)) {
 			const sent = await submit(approvalId);
@@ -24761,14 +25305,6 @@ function executeIdentityProductObservation(telemetry, record, state) {
 	return ignoreTransportFailure(() => invocationTelemetry.emit(mapped), "emit", mapped.name).pipe(Effect.andThen(ignoreTransportFailure(after, mapped.name === "auth_signed_out" ? "reset" : "identify", mapped.name)));
 }
 //#endregion
-//#region ../../packages/protocol/src/payroll/model.ts
-function toPayrollRunId(raw) {
-	return toNonEmptyStringBrand(raw, "payrollRunId", (value) => isNonEmptyString(value));
-}
-function toPayrollGroupId(raw) {
-	return toNonEmptyStringBrand(raw, "payrollGroupId", (value) => isNonEmptyString(value));
-}
-//#endregion
 //#region ../../packages/sdk/src/permissions/command-decoding.ts
 /** The caller's input as a command: ids branded and the intent decoded, or invalid input thrown. */
 const buildCommand = {
@@ -35678,7 +36214,7 @@ function preparedIdentity(verified) {
 		...effect?.operation === "assign" || effect?.operation === "revoke" ? { assignmentEffect: effect } : {}
 	};
 }
-async function execute$94(deps, orgId, command, signal, controls, verifiedOrganization, onPrepared, expectedSnapshotHash) {
+async function execute$93(deps, orgId, command, signal, controls, verifiedOrganization, onPrepared, expectedSnapshotHash) {
 	if (isAborted$1(signal)) return {
 		ok: false,
 		error: Errors.cancelled({ operation: "permissions" })
@@ -35804,7 +36340,7 @@ function makePermissionMethods(deps, orgId) {
 		};
 		return result;
 	};
-	const command = (operation, build, options) => observed$1(deps, operation, options, (signal, captured, verifiedOrganization) => execute$94(deps, orgId, build(), signal, captured, verifiedOrganization, options?.onPrepared));
+	const command = (operation, build, options) => observed$1(deps, operation, options, (signal, captured, verifiedOrganization) => execute$93(deps, orgId, build(), signal, captured, verifiedOrganization, options?.onPrepared));
 	return {
 		previewReplacement: (requestKey, options) => {
 			const session = deps.actor?.authSession();
@@ -35896,7 +36432,7 @@ function makePermissionMethods(deps, orgId) {
 		change: (input, options) => command(ops.change, () => buildCommand.change(input), options),
 		assign: (input, options) => command(ops.assign, () => buildCommand.assign(input), options),
 		revoke: (input, options) => command(ops.revoke, () => buildCommand.revoke(input), options),
-		replace: (input, options) => observed$1(deps, ops.replace, options, (signal, captured, verifiedOrganization) => execute$94(deps, orgId, {
+		replace: (input, options) => observed$1(deps, ops.replace, options, (signal, captured, verifiedOrganization) => execute$93(deps, orgId, {
 			operation: "replace",
 			requestKey: input.requestKey
 		}, signal, captured, verifiedOrganization, options?.onPrepared, input.expectedSnapshotHash)),
@@ -35912,411 +36448,6 @@ function makePermissionMethods(deps, orgId) {
 	};
 }
 //#endregion
-//#region ../../packages/sdk/src/payroll/run-checks.ts
-/** Match the caller's compensation to the committed V3 Payslip. */
-function payslipIdentityMatches(message, item, index, runId, period) {
-	return message.runId === runId && message.itemIndex === index && message.employeeRef === item.partyId && message.periodStart === period.start && message.periodEnd === period.end && message.adjustmentsHash === hashAdjustmentsV3(item.adjustments);
-}
-function payslipAmountMatches(message, item) {
-	const exact = toExactAssetAmount(item.amount, CONFIGURED_MONEY_ASSETS);
-	return message.gross.asset === exact.asset && message.gross.minorUnits === item.gross && message.gross.decimals === exact.decimals && message.net.asset === exact.asset && message.net.minorUnits === item.net && message.net.decimals === exact.decimals;
-}
-function isRunItem(prepared, item, evidence, index, runId, period) {
-	if (prepared === void 0) return false;
-	const bundle = evidence.preparedCommand?.documentBundles?.[index];
-	const preparedItem = evidence.preparedCommand?.items[index];
-	const payslip = bundle?.envelope;
-	if (bundle === void 0 || payslip?.primaryType !== "Payslip") return false;
-	return canonicalJson(prepared.to) === canonicalJson(item.to) && prepared.paymentType === "payroll" && canonicalJson(prepared.amount) === canonicalJson(item.amount) && bundle.adjustments !== void 0 && canonicalJson(bundle.adjustments) === canonicalJson(item.adjustments) && payslipIdentityMatches(payslip.message, item, index, runId, period) && payslipAmountMatches(payslip.message, item) && (preparedItem?.operation === "send" || preparedItem?.operation === "create_commitment") && preparedItem.documentHash === evidence.preparedCommand?.instructionDocuments?.[index]?.documentHash;
-}
-/**
-* The batch the backend derived from a payroll intent must be the batch this
-* caller asked for, checked before the digest is signed.
-*
-* The payslip envelope on each item is server-built and carries the run row's
-* own `issuedAt`, so the batch cannot be fingerprinted against a local copy
-* (`matchesIntent` is unavailable here). What CAN be verified is every field
-* the caller supplied — the org, the Budget, the request key, and per item the
-* recipient, the amount and the payslip figures — plus the lineage binding the
-* batch to the run just written. A prepared command that pays a different
-* person, a different amount, from a different Budget, or under a different
-* run never reaches the signer.
-*/
-function isRunBatch(input) {
-	return (batch, evidence) => Promise.resolve(!("kind" in batch) && batch.orgId === input.orgId && batch.permissionId === input.permissionId && batch.requestKey === input.requestKey && batch.lineage?.kind === "payroll" && batch.lineage.runId === input.runId && batch.items.length === input.items.length && batch.items.every((item) => item.amount.asset === input.asset) && input.items.every((item, index) => isRunItem(batch.items[index], item, evidence, index, input.runId, input.period)));
-}
-/** A decoded detail is the run asked for, whole: its scope, membership and quantities agree. */
-function checkPayrollRunDetail(value, orgId, runId) {
-	if (value === null) return {
-		ok: true,
-		value: null
-	};
-	if (value.orgId !== orgId || value.run.id !== runId || value.items.length === 0 || value.items.length !== value.run.recipientCount || new Set(value.items.map((item) => item.payment.id)).size !== value.items.length || value.items.some((item, index) => item.itemIndex !== index || item.amount.asset !== value.run.total.asset || item.payment.amount.asset !== item.amount.asset || item.payment.paymentType !== "payroll")) return {
-		ok: false,
-		error: Errors.invalidInput("run", "Payroll run scope or membership does not match")
-	};
-	try {
-		const total = toExactAssetAmount(value.run.total, CONFIGURED_MONEY_ASSETS);
-		let rawTotal = 0n;
-		for (const item of value.items) {
-			const amount = toExactAssetAmount(item.amount, CONFIGURED_MONEY_ASSETS);
-			const payment = toExactAssetAmount(item.payment.amount, CONFIGURED_MONEY_ASSETS);
-			if (amount.minorUnits !== payment.minorUnits) return {
-				ok: false,
-				error: Errors.invalidInput("run", "Payroll item quantity does not match its Payment")
-			};
-			rawTotal += BigInt(amount.minorUnits);
-		}
-		if (rawTotal !== BigInt(total.minorUnits)) return {
-			ok: false,
-			error: Errors.invalidInput("run", "Payroll run total does not match its items")
-		};
-	} catch {
-		return {
-			ok: false,
-			error: Errors.invalidInput("run", "Payroll run quantities are invalid")
-		};
-	}
-	return {
-		ok: true,
-		value
-	};
-}
-//#endregion
-//#region ../../packages/sdk/src/payroll/run-decoding.ts
-function toPayrollRun(wire) {
-	return {
-		id: toPayrollRunId(wire.id),
-		status: wire.status,
-		periodStart: wire.periodStart,
-		periodEnd: wire.periodEnd,
-		total: wire.total,
-		recipientCount: wire.recipientCount
-	};
-}
-function toPayrollRuns(wire) {
-	return {
-		...mapPage(wire, toPayrollRun),
-		settledThisMonth: wire.settledThisMonth
-	};
-}
-function toPayrollGroup(wire) {
-	return {
-		id: toPayrollGroupId(wire.id),
-		name: wire.name,
-		tone: wire.tone,
-		members: wire.members.map((member) => ({
-			partyId: member.partyId,
-			amount: member.amount,
-			currency: member.currency
-		}))
-	};
-}
-function validateRunItems(input) {
-	for (const [index, item] of input.items.entries()) {
-		if (Schema.decodeResult(PayrollRunItemInputSchema, { onExcessProperty: "error" })(item)._tag === "Failure") return Errors.invalidInput(`items.${index}`, "invalid Payroll item");
-		try {
-			const exact = toExactAssetAmount(item.amount, CONFIGURED_MONEY_ASSETS);
-			const net = BigInt(item.net);
-			const gross = BigInt(item.gross);
-			const adjustments = item.adjustments.reduce((sum, row) => sum + BigInt(row.amount), 0n);
-			if (item.amount.asset !== input.asset || item.net !== exact.minorUnits || gross + adjustments !== net) return Errors.invalidInput(`items.${index}`, "invalid Payroll units");
-		} catch {
-			return Errors.invalidInput(`items.${index}`, "invalid Payroll units");
-		}
-	}
-	return null;
-}
-const RunInputSchema = Schema.Struct({
-	permissionId: AuthorizePayrollRunExecutionInputSchema.fields.permissionId,
-	asset: AuthorizePayrollRunExecutionInputSchema.fields.asset,
-	period: AuthorizePayrollRunExecutionInputSchema.fields.period,
-	items: AuthorizePayrollRunExecutionInputSchema.fields.items,
-	requestKey: Schema.optional(AuthorizePayrollRunExecutionInputSchema.fields.requestKey)
-});
-/** Decode caller input before session or signer work. Keep routing outside the input. */
-function decodePayrollRunInput(value) {
-	try {
-		const decoded = Schema.decodeUnknownSync(RunInputSchema, { onExcessProperty: "error" })(value);
-		const input = {
-			permissionId: decoded.permissionId,
-			asset: decoded.asset,
-			period: decoded.period,
-			...decoded.requestKey === void 0 ? {} : { requestKey: decoded.requestKey },
-			items: decoded.items.map((item) => ({
-				amount: item.amount,
-				gross: item.gross,
-				net: item.net,
-				adjustments: item.adjustments,
-				partyId: toPartyId(item.partyId),
-				to: item.to.kind === "party" ? {
-					kind: "party",
-					partyId: toPartyId(item.to.partyId)
-				} : item.to.kind === "address" ? {
-					kind: "address",
-					address: toAddress(item.to.address)
-				} : item.to
-			}))
-		};
-		if (input.items.length === 0 || input.period.start > input.period.end) throw Errors.invalidInput("input", "Payroll requires items and an ordered period");
-		const error = validateRunItems(input);
-		if (error !== null) throw error;
-		return input;
-	} catch (cause) {
-		throw cause instanceof CapxulError ? cause : Errors.invalidInput("input", "Invalid Payroll input");
-	}
-}
-/** Read only the exact backend prepare receipt, never an arbitrary signer failure. */
-function payrollResolution(error, requestKey) {
-	const details = error.details;
-	if (error.code !== "WRONG_STATE" || details?.method !== runs.authorize.name || details.requestKey !== requestKey || typeof details.commandId !== "string" || typeof details.runId !== "string") return void 0;
-	return details.payrollResolution === "failed" || details.payrollResolution === "settled" ? details.payrollResolution : void 0;
-}
-function validatePayrollRunLookup(orgId, runId) {
-	return !Schema.is(PayrollRunIdSchema)(runId) || orgId.length === 0 ? {
-		ok: false,
-		error: Errors.invalidInput("runId", "Organization and run ID must be valid")
-	} : {
-		ok: true,
-		value: void 0
-	};
-}
-/** Strict saved detail decoder shared by the read and fresh stream. */
-function decodePayrollRunDetail(raw, orgId, runId) {
-	const decoded = Schema.decodeUnknownResult(Schema.NullOr(PayrollRunDetailSchema), { onExcessProperty: "error" })(raw);
-	if (decoded._tag === "Failure") return {
-		ok: false,
-		error: Errors.invalidInput("run", "Invalid Payroll run detail")
-	};
-	return checkPayrollRunDetail(decoded.success, orgId, runId);
-}
-//#endregion
-//#region ../../packages/sdk/src/payroll/run-subscription.ts
-function detailValue(result) {
-	if (!result.ok) throw result.error;
-	return result.value;
-}
-function subscribePayrollRun(deps, orgId, runId, listener, options) {
-	const operation = CAPXUL_OPERATIONS.org.payroll.subscribeRun;
-	const valid = deps.validate(orgId, runId);
-	if (!valid.ok) return runCapxulEffect(Effect.fail(valid.error), observationOnlyControls(deps.invocationControls?.(options) ?? options), operation, deps.runPromise);
-	const decode = (raw) => detailValue(deps.decode(raw, orgId, runId));
-	return subscribeFreshQuery(deps, {
-		orgId,
-		runId
-	}, listener, operation, {
-		decode,
-		validateCached: (raw) => {
-			decode(raw);
-		},
-		invalidValue: (cause) => isCapxulError(cause) ? cause : Errors.invalidInput("run", "Invalid Payroll run detail"),
-		invalidScope: () => Errors.invalidInput("run", "Payroll run subscription scope does not match"),
-		lostValue: () => Errors.invalidInput("run", "Payroll run is no longer readable"),
-		unavailable: () => Errors.notImplemented("payroll", "subscribeRun")
-	}, options);
-}
-//#endregion
-//#region ../../packages/sdk/src/payroll/run-authorization.ts
-/**
-* Authorize one payroll run: a stable request key, the prepared batch checked
-* against the run the caller asked for, the signature, and the submission.
-*/
-async function authorizePayrollRun(scope, input, controls, onRequestKey, onResolved) {
-	const { deps, orgId, requestKeyScope } = scope;
-	const signal = controls?.signal;
-	const execution = executionDependencies(deps);
-	if (execution === null) return {
-		ok: false,
-		error: Errors.notImplemented("payroll", "executionComposition")
-	};
-	try {
-		input = decodePayrollRunInput(input);
-	} catch (cause) {
-		return {
-			ok: false,
-			error: asCapxulError(cause)
-		};
-	}
-	const { requestKey: provided, ...canonicalInput } = input;
-	const actorId = onRequestKey === void 0 ? void 0 : execution.actor.authSession()?.authUserId;
-	if (onRequestKey !== void 0 && actorId === void 0) return {
-		ok: false,
-		error: Errors.notAuthenticated()
-	};
-	const requestKey = await paymentRequestKeyLifecycle(`${requestKeyScope}:${AUTHORIZE_RUN}`, onRequestKey === void 0 ? {
-		orgId,
-		input
-	} : {
-		actorId,
-		orgId,
-		input: canonicalInput
-	}, provided, onRequestKey === void 0 ? void 0 : { manageProvidedKey: true });
-	try {
-		await onRequestKey?.(requestKey.key);
-		if (onRequestKey !== void 0 && execution.actor.authSession()?.authUserId !== actorId) {
-			await requestKey.finish(false).catch(() => void 0);
-			return {
-				ok: false,
-				error: Errors.notAuthenticated()
-			};
-		}
-	} catch (cause) {
-		await requestKey.finish(false).catch(() => void 0);
-		return {
-			ok: false,
-			error: asCapxulError(cause)
-		};
-	}
-	let authorized;
-	let acceptedReplay;
-	let preparedClosed = false;
-	let terminalReplay;
-	const submitted = await executePrepared(execution, async (signerAddress) => {
-		const prepared = await runIfActive(signal, AUTHORIZE_RUN, () => withInvocationParentSpan(Effect.suspend(() => callOperation(deps.convexCall, runs.authorize, copyInvocationObservation(controls, {
-			orgId,
-			permissionId: input.permissionId,
-			asset: input.asset,
-			requestKey: requestKey.key,
-			signerAddress,
-			period: input.period,
-			items: input.items
-		}))).pipe(Effect.mapError((publicError) => ({ publicError }))), controls), deps.runPromise);
-		if (!prepared.ok) {
-			terminalReplay = payrollResolution(prepared.error, requestKey.key);
-			return prepared;
-		}
-		authorized = prepared.value.run;
-		acceptedReplay = prepared.value.replay.kind === "accepted" ? prepared.value.replay.submission : void 0;
-		return {
-			ok: true,
-			value: prepared.value.execution
-		};
-	}, (request, evidence) => authorized === void 0 || authorized.periodStart !== input.period.start || authorized.periodEnd !== input.period.end ? Promise.resolve(false) : isRunBatch({
-		orgId,
-		permissionId: input.permissionId,
-		requestKey: requestKey.key,
-		runId: authorized.id,
-		asset: input.asset,
-		period: input.period,
-		items: input.items
-	})(request, evidence), true, () => preparedClosed = true, signal, controls, void 0, () => acceptedReplay);
-	const resolution = preparedClosed ? "failed" : terminalReplay;
-	if (resolution !== void 0) try {
-		await onResolved?.(resolution);
-	} catch {}
-	try {
-		await requestKey.finish(submitted.ok || resolution !== void 0);
-	} catch {}
-	if (!submitted.ok) return submitted;
-	return authorized === void 0 ? {
-		ok: false,
-		error: Errors.unknown()
-	} : {
-		ok: true,
-		value: toPayrollRun(authorized)
-	};
-}
-const AUTHORIZE_RUN = runs.authorize.name;
-function executionDependencies(deps) {
-	return deps.actor === void 0 || deps.chainId === void 0 || deps.signer === void 0 ? null : {
-		actor: deps.actor,
-		chainId: deps.chainId,
-		convexCall: deps.convexCall,
-		runPromise: deps.runPromise,
-		signer: deps.signer,
-		...deps.telemetry === void 0 ? {} : { telemetry: deps.telemetry }
-	};
-}
-//#endregion
-//#region ../../packages/sdk/src/payroll/runs.ts
-function makePayrollMethods(deps, orgId) {
-	const requestKeyScope = deps.requestKeyScope ?? `client-${crypto.randomUUID()}`;
-	/** One observed call of one payroll row, its reply projected inside the call, under the row's name. */
-	const call = (row, args, options, project) => {
-		const controls = deps.invocationControls?.(options) ?? options;
-		return runPortEffect(callOperation(deps.convexCall, row, copyInvocationObservation(controls, args)).pipe(Effect.map(project), Effect.mapError((publicError) => ({ publicError }))), controls, row.name, deps.runPromise);
-	};
-	return {
-		subscribeRun: (runId, listener, options) => subscribePayrollRun({
-			actor: deps.actor,
-			convexCall: deps.convexCall,
-			query: reference(runs.get),
-			runPromise: deps.runPromise,
-			invocationControls: deps.invocationControls,
-			decode: decodePayrollRunDetail,
-			validate: validatePayrollRunLookup
-		}, orgId, runId, listener, options),
-		getRun: (runId, options) => {
-			const controls = deps.invocationControls?.(options) ?? options;
-			const lifetime = deps.actor?.authLifetime();
-			const operation = runs.get.name;
-			return runCapxulEffect(Effect.gen(function* () {
-				const lookup = validatePayrollRunLookup(orgId, runId);
-				if (!lookup.ok) return yield* Effect.fail(lookup.error);
-				if (lifetime === void 0 || lifetime.authUserId === null || deps.actor === void 0) return yield* Effect.fail(Errors.notAuthenticated());
-				const current = () => deps.actor?.matchesAuthLifetime(lifetime, lifetime.authUserId) === true;
-				if (!current()) return yield* Effect.fail(Errors.notAuthenticated());
-				const parent = yield* Effect.currentSpan.pipe(Effect.orDie);
-				const captured = carryInvocationParentSpan(controls, parent);
-				const run = yield* awaitCapxulResult(() => runIfActive(controls?.signal, operation, () => withInvocationParentSpan(Effect.suspend(() => callOperation(deps.convexCall, runs.get, copyInvocationObservation(captured, {
-					orgId,
-					runId
-				}))).pipe(Effect.mapError((publicError) => ({ publicError }))), captured), deps.runPromise));
-				if (!current()) return yield* Effect.fail(Errors.cancelled({ operation }));
-				const checked = checkPayrollRunDetail(run, orgId, runId);
-				return yield* checked.ok ? Effect.succeed(checked.value) : Effect.fail(checked.error);
-			}), observationOnlyControls(controls), operation, deps.runPromise);
-		},
-		runs: (options) => call(runs.list, { orgId }, options, toPayrollRuns),
-		authorizeRun: (input, options) => {
-			const controls = deps.invocationControls?.(options) ?? options;
-			return runCapxulEffect(Effect.gen(function* () {
-				if (controls?.signal?.aborted === true) return yield* Effect.fail(Errors.cancelled({ operation: AUTHORIZE_RUN }));
-				const parent = yield* Effect.currentSpan.pipe(Effect.orDie);
-				return yield* awaitCapxulResult(() => authorizePayrollRun({
-					deps,
-					orgId,
-					requestKeyScope
-				}, input, carryInvocationParentSpan(controls, parent), options?.onRequestKey, options?.onResolved));
-			}), observationOnlyControls(controls), AUTHORIZE_RUN, deps.runPromise);
-		},
-		terms: (options) => call(terms.list, { orgId }, options, (rates) => rates),
-		groups: {
-			list: (options) => call(groups$1.list, { orgId }, options, (saved) => mapPage(saved, toPayrollGroup)),
-			save: (input, options) => call(groups$1.save, {
-				orgId,
-				...input.id === void 0 ? {} : { id: String(input.id) },
-				name: input.name,
-				tone: input.tone,
-				members: input.members
-			}, options, toPayrollGroup),
-			remove: (id, options) => call(groups$1.remove, {
-				orgId,
-				id
-			}, options, () => void 0)
-		}
-	};
-}
-const payrollUnavailable = () => Promise.resolve({
-	ok: false,
-	error: Errors.notImplemented("payroll", "executionComposition")
-});
-/** The bundle an unconfigured client exposes — every verb refuses, none throws. */
-function makeUnavailablePayrollMethods() {
-	return {
-		getRun: payrollUnavailable,
-		subscribeRun: payrollUnavailable,
-		runs: payrollUnavailable,
-		authorizeRun: payrollUnavailable,
-		terms: payrollUnavailable,
-		groups: {
-			list: payrollUnavailable,
-			save: payrollUnavailable,
-			remove: payrollUnavailable
-		}
-	};
-}
-//#endregion
 //#region ../../node_modules/.pnpm/axios@1.17.0/node_modules/axios/lib/helpers/bind.js
 /**
 * Create a bound version of a function with a specified `this` context
@@ -70390,12 +70521,14 @@ const writeStderr = (text) => Effect.flatMap(Stdio.Stdio, (stdio) => Stream.run(
 /** Wrap pending work only. Keep terminal prompts outside this scope. */
 const withWaiting = (work, options) => Effect.scoped(Effect.gen(function* () {
 	const stdio = yield* Stdio.Stdio;
+	const terminal = options.stderrTty === true && (yield* stdio.stdoutIsTerminal);
+	if (options.mode === "human" && !terminal) return yield* work;
 	yield* writeStderr(options.mode === "json" ? `${JSON.stringify({
 		type: "cli.waiting",
 		label: options.label,
 		status: "waiting"
 	})}\n` : `Waiting: ${terminalText(options.label)}\n`);
-	if (!(options.mode === "human" && options.tty && !options.ci && options.stderrTty === true)) return yield* work;
+	if (!(options.mode === "human" && options.tty && !options.ci)) return yield* work;
 	const clear = "\r\x1B[2K";
 	const frames = [
 		"⠋",
@@ -70447,8 +70580,8 @@ const terminalText = (value) => value.replace(/[\p{Cc}\p{Cf}]/gu, (character) =>
 const shellArgument = (value) => `'${value.replaceAll("'", "'\"'\"'")}'`;
 //#endregion
 //#region src/runtime/version.ts
-const cliVersion = "4.20.0-beta.26";
-const sdkVersion = "4.20.0-beta.26";
+const cliVersion = "4.20.0-beta.27";
+const sdkVersion = "4.20.0-beta.27";
 const ReleaseVersion = Schema.String.check(Schema.isMaxLength(256), Schema.isPattern(/^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)(?:-((?:0|[1-9]\d*|\d*[a-zA-Z-][0-9a-zA-Z-]*)(?:\.(?:0|[1-9]\d*|\d*[a-zA-Z-][0-9a-zA-Z-]*))*))?(?:\+[0-9a-zA-Z-]+(?:\.[0-9a-zA-Z-]+)*)?$/u)).pipe(Schema.brand("CliReleaseVersion"));
 const parts = (version) => {
 	const [core = "", ...prerelease] = version.split("+")[0].split("-");
@@ -71594,7 +71727,7 @@ const lifecycleResult = (lifecycle, email) => ({
 const balanceLines$1 = (account) => [
 	`Account ${terminalText(account.id)}`,
 	...account.balances.length === 0 ? ["No asset balances returned."] : account.balances.flatMap((position) => [
-		`  Asset: ${terminalText(position.symbol)} (${terminalText(position.asset)})`,
+		`  Asset: ${terminalText(position.symbol)} on ${networkName(requireAsset(position.asset).chainId)}`,
 		`  Balance: ${terminalText(position.balance)}`,
 		`  Available: ${terminalText(position.available)}`
 	]),
@@ -71610,7 +71743,7 @@ const depositLines = (instructions) => [
 ];
 //#endregion
 //#region src/commands/account/subcommands/show/execute.ts
-const execute$93 = (config, email) => Effect.gen(function* () {
+const execute$92 = (config, email) => Effect.gen(function* () {
 	const { client, session } = yield* restoreAuthenticatedClient(config, email);
 	const runtime = yield* CliRuntime;
 	return yield* withWaiting(Effect.promise(() => client.account.getLifecycle()).pipe(Effect.flatMap(resultValue), Effect.map((lifecycle) => lifecycleResult(lifecycle, session.email)), Effect.mapError((error) => accountReadFailure(error, session.email))), {
@@ -71620,7 +71753,7 @@ const execute$93 = (config, email) => Effect.gen(function* () {
 });
 //#endregion
 //#region src/commands/account/subcommands/show/command.ts
-const command$80 = Command.make("show", { email: emailFlag$10 }, ({ email }) => dispatch$9("show", (config) => execute$93(config, Option.getOrUndefined(email)))).pipe(annotate$8("show"), Command.withDescription("Read your Account lifecycle without starting setup"));
+const command$80 = Command.make("show", { email: emailFlag$10 }, ({ email }) => dispatch$9("show", (config) => execute$92(config, Option.getOrUndefined(email)))).pipe(annotate$8("show"), Command.withDescription("Read your Account lifecycle without starting setup"));
 //#endregion
 //#region src/auth/actor.ts
 /** An Organization ID, as opposed to a handle. */
@@ -71683,7 +71816,7 @@ const actorScope = (actor) => actor.kind === "personal" ? {
 //#region src/commands/org/subcommands/shared.ts
 const emailFlag$9 = Flag.String("email").pipe(Flag.optional);
 const scoped$1 = { email: emailFlag$9 };
-const confirmFlag$7 = Flag.Boolean("confirm").pipe(Flag.withDefault(false));
+const confirmFlag$6 = Flag.Boolean("confirm").pipe(Flag.withDefault(false));
 const timeoutFlag$4 = Flag.Int("timeout-seconds").pipe(Flag.withDefault(120));
 const metadata$18 = (name) => ({
 	name,
@@ -73259,7 +73392,7 @@ const readWriteTimeout = (value) => Schema.decodeEffect(Schema.Int.check(Schema.
 })))(value).pipe(Effect.mapError(() => inputRequired("Provide --timeout-seconds as an integer from 1 to 3600.")));
 //#endregion
 //#region src/commands/account/subcommands/retry/execute.ts
-const execute$92 = (config, input) => Effect.gen(function* () {
+const execute$91 = (config, input) => Effect.gen(function* () {
 	const timeout = yield* readWriteTimeout(input.timeoutSeconds);
 	const interactive = yield* requireWriteConfirmation(input.confirm);
 	const opened = yield* openAuthenticatedSession(config, input.email);
@@ -73347,7 +73480,7 @@ const execute$92 = (config, input) => Effect.gen(function* () {
 const profileFlag = (name, description) => Flag.String(name).pipe(Flag.withDescription(description), Flag.optional);
 const command$79 = Command.make("retry", {
 	email: emailFlag$10,
-	confirm: confirmFlag$7,
+	confirm: confirmFlag$6,
 	timeoutSeconds: timeoutFlag$4,
 	otpStdin: Flag.Boolean("otp-stdin").pipe(Flag.withDefault(false), Flag.withDescription("Read the sign-in code from stdin when no session is saved")),
 	displayName: profileFlag("display-name", "Your display name, for a first setup"),
@@ -73357,7 +73490,7 @@ const command$79 = Command.make("retry", {
 	displayName: Option.getOrUndefined(displayName),
 	country: Option.getOrUndefined(country),
 	handle: Option.getOrUndefined(handle)
-}) : execute$92(config, {
+}) : execute$91(config, {
 	kind: "retry",
 	email: Option.getOrUndefined(email),
 	confirm,
@@ -73377,7 +73510,7 @@ const account = Command.make("account").pipe(annotate$8("root"), Command.withDes
 const emailFlag$8 = Flag.String("email").pipe(Flag.optional);
 const fromFlag = Flag.Int("from").pipe(Flag.optional);
 const toFlag = Flag.Int("to").pipe(Flag.optional);
-const confirmFlag$6 = Flag.Boolean("confirm").pipe(Flag.withDefault(false));
+const confirmFlag$5 = Flag.Boolean("confirm").pipe(Flag.withDefault(false));
 const names$7 = {
 	root: "activity",
 	list: "activity.list",
@@ -73576,7 +73709,7 @@ const annotationPreview = (annotation, actor) => [
 ];
 //#endregion
 //#region src/commands/activity/subcommands/list/execute.ts
-const execute$91 = (config, input) => Effect.gen(function* () {
+const execute$90 = (config, input) => Effect.gen(function* () {
 	const actor = yield* actorFor(input.orgId);
 	const params = yield* pageParams(input);
 	const { client } = yield* restoreAuthenticatedClient(config, input.email);
@@ -73600,7 +73733,7 @@ const command$78 = Command.make("list", {
 	statuses: Flag.String("status").pipe(Flag.atLeast(0)),
 	from: fromFlag,
 	to: toFlag
-}, ({ email, limit, cursor, activityKind, direction, statuses, from, to }) => dispatch$7("list", (config, orgId) => execute$91(config, {
+}, ({ email, limit, cursor, activityKind, direction, statuses, from, to }) => dispatch$7("list", (config, orgId) => execute$90(config, {
 	kind: "list",
 	email: Option.getOrUndefined(email),
 	orgId,
@@ -73765,7 +73898,7 @@ const documentReferenceLines = (payment) => {
 };
 //#endregion
 //#region src/commands/activity/subcommands/get/execute.ts
-const execute$90 = (config, input) => Effect.gen(function* () {
+const execute$89 = (config, input) => Effect.gen(function* () {
 	const actor = yield* actorFor(input.orgId);
 	const reference = {
 		kind: yield* activityKind(input.activityKind),
@@ -73789,7 +73922,7 @@ const command$77 = Command.make("get", {
 	email: emailFlag$8,
 	activityKind: Flag.String("kind"),
 	id: Flag.String("id")
-}, ({ email, activityKind, id }) => dispatch$7("get", (config, orgId) => execute$90(config, {
+}, ({ email, activityKind, id }) => dispatch$7("get", (config, orgId) => execute$89(config, {
 	kind: "get",
 	email: Option.getOrUndefined(email),
 	orgId,
@@ -73798,7 +73931,7 @@ const command$77 = Command.make("get", {
 }))).pipe(annotate$7("get"), Command.withDescription("Read one exact Payment or Movement"));
 //#endregion
 //#region src/commands/activity/subcommands/summary/execute.ts
-const execute$89 = (config, input) => Effect.gen(function* () {
+const execute$88 = (config, input) => Effect.gen(function* () {
 	const actor = yield* actorFor(input.orgId);
 	const window = yield* summaryRange(input.from, input.to);
 	const { client } = yield* restoreAuthenticatedClient(config, input.email);
@@ -73817,7 +73950,7 @@ const command$76 = Command.make("summary", {
 	email: emailFlag$8,
 	from: fromFlag,
 	to: toFlag
-}, ({ email, from, to }) => dispatch$7("summary", (config, orgId) => execute$89(config, {
+}, ({ email, from, to }) => dispatch$7("summary", (config, orgId) => execute$88(config, {
 	kind: "summary",
 	email: Option.getOrUndefined(email),
 	orgId,
@@ -73826,7 +73959,7 @@ const command$76 = Command.make("summary", {
 }))).pipe(annotate$7("summary"), Command.withDescription("Summarize exact raw-unit activity totals"));
 //#endregion
 //#region src/commands/activity/subcommands/annotate/execute.ts
-const execute$88 = (config, input) => Effect.gen(function* () {
+const execute$87 = (config, input) => Effect.gen(function* () {
 	const actor = yield* actorFor(input.orgId);
 	const interactive = yield* requireWriteConfirmation(input.confirm);
 	const annotation = yield* readAnnotation(input.source);
@@ -73852,8 +73985,8 @@ const execute$88 = (config, input) => Effect.gen(function* () {
 const command$75 = Command.make("annotate", {
 	email: emailFlag$8,
 	source: Flag.String("input").pipe(Flag.optional),
-	confirm: confirmFlag$6
-}, ({ email, source, confirm }) => dispatch$7("annotate", (config, orgId) => execute$88(config, {
+	confirm: confirmFlag$5
+}, ({ email, source, confirm }) => dispatch$7("annotate", (config, orgId) => execute$87(config, {
 	kind: "annotate",
 	email: Option.getOrUndefined(email),
 	orgId,
@@ -73870,7 +74003,7 @@ const activity = Command.make("activity").pipe(annotate$7("root"), Command.withD
 ]));
 //#endregion
 //#region src/commands/account/subcommands/deposit/execute.ts
-const execute$87 = (config, email) => Effect.gen(function* () {
+const execute$86 = (config, email) => Effect.gen(function* () {
 	const { client, session } = yield* restoreAuthenticatedClient(config, email);
 	const runtime = yield* CliRuntime;
 	return yield* withWaiting(Effect.promise((signal) => client.account.profile.depositInstructions({ signal })).pipe(Effect.flatMap(resultValue), Effect.map((depositInstructions) => ({
@@ -73893,14 +74026,14 @@ const perform$11 = (scoped, organizationId, organization) => Effect.gen(function
 		label: "Organization deposit instructions"
 	});
 });
-const execute$86 = (config, input) => readOrganization(config, "deposit", input, {
+const execute$85 = (config, input) => readOrganization(config, "deposit", input, {
 	kind: "scoped",
 	run: ({ scoped, organizationId, organization }) => perform$11(scoped(), organizationId, organization)
 });
 //#endregion
 //#region src/commands/address/execute.ts
 /** Where to send crypto to your Account, or to the Organization you act as. */
-const execute$85 = (config, email) => Effect.flatMap(selectActor(config), (actor) => actor.kind === "personal" ? execute$87(config, email) : execute$86(config, {
+const execute$84 = (config, email) => Effect.flatMap(selectActor(config), (actor) => actor.kind === "personal" ? execute$86(config, email) : execute$85(config, {
 	email,
 	orgs: [actor.id]
 }));
@@ -73914,7 +74047,7 @@ const metadata$16 = {
 const address = Command.make("address", { email: Flag.String("email").pipe(Flag.optional) }, ({ email }) => runCommand({
 	...metadata$16,
 	network: true
-}, (config) => execute$85(config, Option.getOrUndefined(email)))).pipe(Command.annotate(CliCommandMetadata, metadata$16), Command.withDescription("where to send crypto to this account"), Command.withExamples([{ command: "capxul address" }]));
+}, (config) => execute$84(config, Option.getOrUndefined(email)))).pipe(Command.annotate(CliCommandMetadata, metadata$16), Command.withDescription("where to send crypto to this account"), Command.withExamples([{ command: "capxul address" }]));
 //#endregion
 //#region src/commands/auth/subcommands/shared.ts
 const emailFlag$7 = Flag.String("email").pipe(Flag.withDescription("Email address"), Flag.optional);
@@ -73960,7 +74093,7 @@ const sendCode = (config, email) => Effect.gen(function* () {
 });
 //#endregion
 //#region src/commands/auth/subcommands/login/execute.ts
-const execute$84 = (config, suppliedEmail, otpStdin) => Effect.gen(function* () {
+const execute$83 = (config, suppliedEmail, otpStdin) => Effect.gen(function* () {
 	const email = yield* readEmail(suppliedEmail);
 	const runtime = yield* CliRuntime;
 	if (!otpStdin && (!runtime.tty || runtime.ci || runtime.mode === "json")) return yield* sendCode(config, email);
@@ -73983,14 +74116,14 @@ const execute$84 = (config, suppliedEmail, otpStdin) => Effect.gen(function* ()
 const command$74 = Command.make("login", {
 	email: emailFlag$7,
 	otpStdin: otpStdinFlag
-}, ({ email, otpStdin }) => dispatch$6("login", (config) => execute$84(config, Option.getOrUndefined(email), otpStdin))).pipe(annotate$6("login"), Command.withDescription("Sign in with your email and a one-time code"));
+}, ({ email, otpStdin }) => dispatch$6("login", (config) => execute$83(config, Option.getOrUndefined(email), otpStdin))).pipe(annotate$6("login"), Command.withDescription("Sign in with your email and a one-time code"));
 //#endregion
 //#region src/commands/auth/subcommands/verify/execute.ts
 /**
 * Finish a sign-in that `auth login` started without a terminal. The email is
 * the one that sign-in saved, unless `--email` names another pending one.
 */
-const execute$83 = (config, input) => Effect.gen(function* () {
+const execute$82 = (config, input) => Effect.gen(function* () {
 	const pending = (yield* readWhere(config)).origins?.[config.bootstrapBaseUrl]?.pending;
 	if (input.email === void 0 && pending === void 0) return yield* inputRequired("No sign-in is waiting for a code. Start one with: capxul auth login");
 	const email = yield* readEmail(input.email ?? pending);
@@ -74032,7 +74165,7 @@ const command$73 = Command.make("verify", {
 	code: Argument.String("code").pipe(Argument.withDescription("The six-digit code from your email (or use --otp-stdin)"), Argument.optional),
 	email: emailFlag$7,
 	otpStdin: otpStdinFlag
-}, ({ code, email, otpStdin }) => dispatch$6("verify", (config) => execute$83(config, {
+}, ({ code, email, otpStdin }) => dispatch$6("verify", (config) => execute$82(config, {
 	...Option.isSome(email) ? { email: email.value } : {},
 	...Option.isSome(code) ? { code: code.value } : {},
 	otpStdin
@@ -74093,7 +74226,7 @@ const cleanupStoredNativeGrant = (config, email) => Effect.gen(function* () {
 });
 //#endregion
 //#region src/commands/auth/subcommands/logout/execute.ts
-const execute$82 = (config, suppliedEmail) => Effect.gen(function* () {
+const execute$81 = (config, suppliedEmail) => Effect.gen(function* () {
 	const current = suppliedEmail === void 0 ? yield* readCurrentSession(config) : null;
 	if (suppliedEmail === void 0 && current === null) return {
 		data: {
@@ -74142,11 +74275,11 @@ const execute$82 = (config, suppliedEmail) => Effect.gen(function* () {
 });
 //#endregion
 //#region src/commands/auth/subcommands/logout/command.ts
-const command$72 = Command.make("logout", { email: emailFlag$7 }, ({ email }) => dispatch$6("logout", (config) => execute$82(config, Option.getOrUndefined(email)))).pipe(annotate$6("logout"), Command.withDescription("Sign out on this device"));
+const command$72 = Command.make("logout", { email: emailFlag$7 }, ({ email }) => dispatch$6("logout", (config) => execute$81(config, Option.getOrUndefined(email)))).pipe(annotate$6("logout"), Command.withDescription("Sign out on this device"));
 //#endregion
 //#region src/commands/auth/subcommands/switch/execute.ts
 /** Make another person already signed in on this machine the current one. */
-const execute$81 = (config, suppliedEmail) => Effect.gen(function* () {
+const execute$80 = (config, suppliedEmail) => Effect.gen(function* () {
 	const email = yield* readEmail(suppliedEmail);
 	const store = yield* openSessionRecord(config, email);
 	if (store.current().token === null) return yield* Effect.fail(authenticationFailure(Errors.notAuthenticated(), email));
@@ -74164,7 +74297,7 @@ const execute$81 = (config, suppliedEmail) => Effect.gen(function* () {
 });
 //#endregion
 //#region src/commands/auth/subcommands/switch/command.ts
-const command$71 = Command.make("switch", { email: Argument.String("email").pipe(Argument.withDescription("The email of someone already signed in on this machine")) }, ({ email }) => dispatch$6("switch", (config) => execute$81(config, email))).pipe(annotate$6("switch"), Command.withDescription("Switch to another person signed in on this machine"), Command.withExamples([{ command: "capxul auth switch ada@example.com" }]));
+const command$71 = Command.make("switch", { email: Argument.String("email").pipe(Argument.withDescription("The email of someone already signed in on this machine")) }, ({ email }) => dispatch$6("switch", (config) => execute$80(config, email))).pipe(annotate$6("switch"), Command.withDescription("Switch to another person signed in on this machine"), Command.withExamples([{ command: "capxul auth switch ada@example.com" }]));
 //#endregion
 //#region src/commands/auth/command.ts
 const auth = Command.make("auth").pipe(annotate$6("root"), Command.withDescription("sign in, switch person, sign out"), Command.withSubcommands([
@@ -74175,7 +74308,7 @@ const auth = Command.make("auth").pipe(annotate$6("root"), Command.withDescripti
 ]));
 //#endregion
 //#region src/commands/account/subcommands/balance/execute.ts
-const execute$80 = (config, email) => Effect.gen(function* () {
+const execute$79 = (config, email) => Effect.gen(function* () {
 	const { client, session } = yield* restoreAuthenticatedClient(config, email);
 	const runtime = yield* CliRuntime;
 	return yield* withWaiting(Effect.promise((signal) => client.accounts.read({ signal })).pipe(Effect.flatMap(resultValue), Effect.map((account) => ({
@@ -74198,14 +74331,14 @@ const perform$10 = (scoped, organizationId, organization) => Effect.gen(function
 		label: "Organization balance"
 	});
 });
-const execute$79 = (config, input) => readOrganization(config, "balance", input, {
+const execute$78 = (config, input) => readOrganization(config, "balance", input, {
 	kind: "scoped",
 	run: ({ scoped, organizationId, organization }) => perform$10(scoped(), organizationId, organization)
 });
 //#endregion
 //#region src/commands/balance/execute.ts
 /** Your Account's balances, or the treasury of the Organization you act as. */
-const execute$78 = (config, email) => Effect.flatMap(selectActor(config), (actor) => actor.kind === "personal" ? execute$80(config, email) : execute$79(config, {
+const execute$77 = (config, email) => Effect.flatMap(selectActor(config), (actor) => actor.kind === "personal" ? execute$79(config, email) : execute$78(config, {
 	email,
 	orgs: [actor.id]
 }));
@@ -74219,7 +74352,7 @@ const metadata$14 = {
 const balance = Command.make("balance", { email: Flag.String("email").pipe(Flag.optional) }, ({ email }) => runCommand({
 	...metadata$14,
 	network: true
-}, (config) => execute$78(config, Option.getOrUndefined(email)))).pipe(Command.annotate(CliCommandMetadata, metadata$14), Command.withDescription("balances for whoever you're acting as"), Command.withExamples([{ command: "capxul balance" }, {
+}, (config) => execute$77(config, Option.getOrUndefined(email)))).pipe(Command.annotate(CliCommandMetadata, metadata$14), Command.withDescription("balances for whoever you're acting as"), Command.withExamples([{ command: "capxul balance" }, {
 	command: "capxul balance --org acme",
 	description: "An Organization's treasury"
 }]));
@@ -74248,22 +74381,22 @@ const renderReport$1 = (config, status) => ({
 });
 //#endregion
 //#region src/commands/config/subcommands/off/execute.ts
-const execute$77 = (config) => setCollectionEnabled(config.settingsPath, false).pipe(Effect.andThen(collectionStatus(config)), Effect.map((status) => renderReport$1(config, status)));
+const execute$76 = (config) => setCollectionEnabled(config.settingsPath, false).pipe(Effect.andThen(collectionStatus(config)), Effect.map((status) => renderReport$1(config, status)));
 //#endregion
 //#region src/commands/config/subcommands/off/command.ts
-const command$70 = Command.make("off", {}, () => dispatch$5("off", execute$77)).pipe(annotate$5("off"), Command.withDescription("Turn off usage and diagnostics collection"));
+const command$70 = Command.make("off", {}, () => dispatch$5("off", execute$76)).pipe(annotate$5("off"), Command.withDescription("Turn off usage and diagnostics collection"));
 //#endregion
 //#region src/commands/config/subcommands/on/execute.ts
-const execute$76 = (config) => setCollectionEnabled(config.settingsPath, true).pipe(Effect.andThen(collectionStatus(config)), Effect.map((status) => renderReport$1(config, status)));
+const execute$75 = (config) => setCollectionEnabled(config.settingsPath, true).pipe(Effect.andThen(collectionStatus(config)), Effect.map((status) => renderReport$1(config, status)));
 //#endregion
 //#region src/commands/config/subcommands/on/command.ts
-const command$69 = Command.make("on", {}, () => dispatch$5("on", execute$76)).pipe(annotate$5("on"), Command.withDescription("Turn on usage and diagnostics collection"));
+const command$69 = Command.make("on", {}, () => dispatch$5("on", execute$75)).pipe(annotate$5("on"), Command.withDescription("Turn on usage and diagnostics collection"));
 //#endregion
 //#region src/commands/config/subcommands/status/execute.ts
-const execute$75 = (config) => collectionStatus(config).pipe(Effect.map((status) => renderReport$1(config, status)));
+const execute$74 = (config) => collectionStatus(config).pipe(Effect.map((status) => renderReport$1(config, status)));
 //#endregion
 //#region src/commands/config/subcommands/status/command.ts
-const command$68 = Command.make("status", {}, () => dispatch$5("status", execute$75)).pipe(annotate$5("status"), Command.withDescription("Show whether this CLI collects usage and diagnostics"));
+const command$68 = Command.make("status", {}, () => dispatch$5("status", execute$74)).pipe(annotate$5("status"), Command.withDescription("Show whether this CLI collects usage and diagnostics"));
 //#endregion
 //#region src/commands/config/command.ts
 const telemetry = Command.make("telemetry").pipe(Command.annotate(CliCommandMetadata, {
@@ -74287,7 +74420,7 @@ const includeHiddenFlag = Flag.Boolean("include-hidden").pipe(Flag.withDefault(f
 const entryIdArgument = Argument.String("id").pipe(Argument.withDescription("The contact's PartyId"), Argument.optional);
 const labelFlag = Flag.String("label");
 const inputFlag = Flag.String("input").pipe(Flag.optional);
-const confirmFlag$5 = Flag.Boolean("confirm").pipe(Flag.withDefault(false));
+const confirmFlag$4 = Flag.Boolean("confirm").pipe(Flag.withDefault(false));
 const names$6 = {
 	root: "contact",
 	list: "contact.list",
@@ -74536,7 +74669,7 @@ const perform$9 = (book, prepared, orgs, email) => Effect.gen(function* () {
 		]
 	};
 });
-const execute$74 = (config, input) => Effect.gen(function* () {
+const execute$73 = (config, input) => Effect.gen(function* () {
 	const prepared = yield* prepare$4(input);
 	const { client, session } = yield* restoreAuthenticatedClient(config, input.email);
 	const book = yield* selectedBook(client, input.actor, input.orgs);
@@ -74547,14 +74680,14 @@ const execute$74 = (config, input) => Effect.gen(function* () {
 const command$67 = (context) => Command.make("add", {
 	email: emailFlag$6,
 	input: inputFlag,
-	confirm: confirmFlag$5
+	confirm: confirmFlag$4
 }, ({ email, input, confirm }) => context.dispatch("add", (scope) => ({
 	kind: "add",
 	...scope,
 	email: Option.getOrUndefined(email),
 	source: Option.getOrUndefined(input),
 	confirm
-}), execute$74)).pipe(context.annotate("add"), Command.withDescription("Add one contact from AddressBookAddInput JSON"));
+}), execute$73)).pipe(context.annotate("add"), Command.withDescription("Add one contact from AddressBookAddInput JSON"));
 //#endregion
 //#region src/commands/contact/subcommands/get/execute.ts
 const prepare$3 = (input) => optionalPartyId(input.entryId);
@@ -74566,7 +74699,7 @@ const perform$8 = (book, entryId, orgs) => Effect.gen(function* () {
 		lines: [actorLine(orgs), ...entry === null ? ["No contact found."] : contactLines(entry)]
 	};
 });
-const execute$73 = (config, input) => Effect.gen(function* () {
+const execute$72 = (config, input) => Effect.gen(function* () {
 	const entryId = yield* prepare$3(input);
 	const { client } = yield* restoreAuthenticatedClient(config, input.email);
 	const book = yield* selectedBook(client, input.actor, input.orgs);
@@ -74582,7 +74715,7 @@ const command$66 = (context) => Command.make("get", {
 	...scope,
 	email: Option.getOrUndefined(email),
 	entryId: Option.getOrUndefined(entryId)
-}), execute$73)).pipe(context.annotate("get"), Command.withDescription("Read one contact by stable PartyId"));
+}), execute$72)).pipe(context.annotate("get"), Command.withDescription("Read one contact by stable PartyId"));
 //#endregion
 //#region src/commands/contact/internal/write.ts
 /**
@@ -74653,20 +74786,20 @@ const visibilityVerbs = (kind) => {
 };
 //#endregion
 //#region src/commands/contact/subcommands/hide/execute.ts
-const { prepare: prepare$2, perform: perform$7, execute: execute$72 } = visibilityVerbs("hide");
+const { prepare: prepare$2, perform: perform$7, execute: execute$71 } = visibilityVerbs("hide");
 //#endregion
 //#region src/commands/contact/subcommands/hide/command.ts
 const command$65 = (context) => Command.make("hide", {
 	email: emailFlag$6,
 	entryId: entryIdArgument,
-	confirm: confirmFlag$5
+	confirm: confirmFlag$4
 }, ({ email, entryId, confirm }) => context.dispatch("hide", (scope) => ({
 	kind: "hide",
 	...scope,
 	email: Option.getOrUndefined(email),
 	entryId: Option.getOrUndefined(entryId),
 	confirm
-}), execute$72)).pipe(context.annotate("hide"), Command.withDescription("Hide one contact"));
+}), execute$71)).pipe(context.annotate("hide"), Command.withDescription("Hide one contact"));
 //#endregion
 //#region src/commands/contact/subcommands/label/execute.ts
 const prepare$1 = (input) => Effect.gen(function* () {
@@ -74695,7 +74828,7 @@ const perform$6 = (book, prepared, orgs, email) => Effect.gen(function* () {
 		]
 	};
 });
-const execute$71 = (config, input) => Effect.gen(function* () {
+const execute$70 = (config, input) => Effect.gen(function* () {
 	const prepared = yield* prepare$1(input);
 	const { client, session } = yield* restoreAuthenticatedClient(config, input.email);
 	const book = yield* selectedBook(client, input.actor, input.orgs);
@@ -74707,7 +74840,7 @@ const command$64 = (context) => Command.make("label", {
 	email: emailFlag$6,
 	entryId: entryIdArgument,
 	label: labelFlag,
-	confirm: confirmFlag$5
+	confirm: confirmFlag$4
 }, ({ email, entryId, label, confirm }) => context.dispatch("label", (scope) => ({
 	kind: "label",
 	...scope,
@@ -74715,14 +74848,14 @@ const command$64 = (context) => Command.make("label", {
 	entryId: Option.getOrUndefined(entryId),
 	label,
 	confirm
-}), execute$71)).pipe(context.annotate("label"), Command.withDescription("Change one contact label by stable PartyId"));
+}), execute$70)).pipe(context.annotate("label"), Command.withDescription("Change one contact label by stable PartyId"));
 //#endregion
 //#region src/commands/contact/subcommands/list/execute.ts
 const perform$5 = (book, input, orgs) => contactWaiting(Effect.promise((signal) => book.list(input.includeHidden ? { includeHidden: true } : void 0, { signal })).pipe(Effect.flatMap(resultValue)), "Contact list").pipe(Effect.mapError((error) => normalizeContactScopeFailure(error, orgs)), Effect.map((page) => ({
 	data: page,
 	lines: [actorLine(orgs), ...page.items.length === 0 ? ["No contacts found."] : page.items.flatMap(contactLines)]
 })));
-const execute$70 = (config, input) => Effect.gen(function* () {
+const execute$69 = (config, input) => Effect.gen(function* () {
 	const { client } = yield* restoreAuthenticatedClient(config, input.email);
 	const book = yield* selectedBook(client, input.actor, input.orgs);
 	return yield* perform$5(book, input, input.orgs);
@@ -74737,23 +74870,23 @@ const command$63 = (context) => Command.make("list", {
 	...scope,
 	email: Option.getOrUndefined(email),
 	includeHidden
-}), execute$70)).pipe(context.annotate("list"), Command.withDescription("List contacts in the selected actor's address book"));
+}), execute$69)).pipe(context.annotate("list"), Command.withDescription("List contacts in the selected actor's address book"));
 //#endregion
 //#region src/commands/contact/subcommands/unhide/execute.ts
-const { prepare, perform: perform$4, execute: execute$69 } = visibilityVerbs("unhide");
+const { prepare, perform: perform$4, execute: execute$68 } = visibilityVerbs("unhide");
 //#endregion
 //#region src/commands/contact/subcommands/unhide/command.ts
 const command$62 = (context) => Command.make("unhide", {
 	email: emailFlag$6,
 	entryId: entryIdArgument,
-	confirm: confirmFlag$5
+	confirm: confirmFlag$4
 }, ({ email, entryId, confirm }) => context.dispatch("unhide", (scope) => ({
 	kind: "unhide",
 	...scope,
 	email: Option.getOrUndefined(email),
 	entryId: Option.getOrUndefined(entryId),
 	confirm
-}), execute$69)).pipe(context.annotate("unhide"), Command.withDescription("Restore one contact"));
+}), execute$68)).pipe(context.annotate("unhide"), Command.withDescription("Restore one contact"));
 //#endregion
 //#region src/commands/contact/command.ts
 const makeContactCommand = () => {
@@ -74820,7 +74953,7 @@ const readSendWords = (to, amount) => Effect.gen(function* () {
 });
 //#endregion
 //#region src/commands/dev/fund.ts
-const execute$68 = (config, input) => Effect.gen(function* () {
+const execute$67 = (config, input) => Effect.gen(function* () {
 	const runtime = yield* CliRuntime;
 	const { client } = yield* restoreAuthenticatedClient(config, input.email);
 	const account = yield* withWaiting(Effect.promise((signal) => client.accounts.read({ signal })).pipe(Effect.flatMap(resultValue)), {
@@ -74892,7 +75025,7 @@ const mint = (config, origin) => Effect.tryPromise({
 		outcome: "failed"
 	})
 });
-const execute$67 = (config, input) => Effect.gen(function* () {
+const execute$66 = (config, input) => Effect.gen(function* () {
 	const origin = yield* readOrigin(input.origin);
 	const runtime = yield* CliRuntime;
 	const answer = yield* withWaiting(mint(config, origin), {
@@ -74939,7 +75072,7 @@ const keyCommand = Command.make("key", {
 }, ({ origin, print }) => runCommand({
 	...metadata$11("dev.key"),
 	network: true
-}, (config) => execute$67(config, {
+}, (config) => execute$66(config, {
 	origin,
 	write: !print
 }))).pipe(Command.annotate(CliCommandMetadata, metadata$11("dev.key")), Command.withDescription("a sandbox publishable key for your app, in .env.local"));
@@ -74950,7 +75083,7 @@ const fundCommand = Command.make("fund", {
 }, ({ amount, asset, email }) => runCommand({
 	...metadata$11("dev.fund"),
 	network: true
-}, (config) => execute$68(config, {
+}, (config) => execute$67(config, {
 	amount,
 	asset,
 	email: Option.getOrUndefined(email)
@@ -75026,7 +75159,7 @@ const renderReport = (local, network) => ({
 });
 //#endregion
 //#region src/commands/doctor/execute.ts
-const execute$66 = (config, input) => Effect.gen(function* () {
+const execute$65 = (config, input) => Effect.gen(function* () {
 	const local = yield* readLocalState(config);
 	if (!input.online) return renderReport(local, { status: "not_checked" });
 	const publishableKey = yield* requireApplicationKey(config);
@@ -75055,7 +75188,7 @@ const doctor = Command.make("doctor", {
 }, ({ online, timeoutMs }) => runCommand({
 	...metadata$10,
 	network: online
-}, (config, observation, onFinalize) => execute$66(config, {
+}, (config, observation, onFinalize) => execute$65(config, {
 	online,
 	timeoutMs,
 	...observation === void 0 ? {} : { observation },
@@ -75180,7 +75313,7 @@ const readHome = (client, orgId, scope) => Effect.promise((signal) => client.me.
 	balances: null,
 	needs: null
 })));
-const execute$65 = (config) => Effect.gen(function* () {
+const execute$64 = (config) => Effect.gen(function* () {
 	const runtime = yield* CliRuntime;
 	const human = runtime.mode === "human";
 	const where = yield* currentWhere(config, runtime.args ?? [], "context");
@@ -75250,7 +75383,7 @@ const metadata$9 = {
 const home = Command.make("home", {}, () => runCommand({
 	...metadata$9,
 	network: true
-}, execute$65)).pipe(Command.annotate(CliCommandMetadata, metadata$9), Command.withDescription("home screen: where you are, what needs you"), Command.unlisted);
+}, execute$64)).pipe(Command.annotate(CliCommandMetadata, metadata$9), Command.withDescription("home screen: where you are, what needs you"), Command.unlisted);
 //#endregion
 //#region src/commands/document/subcommands/shared.ts
 const documentHashFlag = Flag.String("document-hash");
@@ -75293,7 +75426,7 @@ const readRef = (documentHash, contentHash) => Effect.gen(function* () {
 const matchingRef = (expected, actual) => expected.documentHash === actual.documentHash.toLowerCase() && expected.contentHash === actual.contentHash.toLowerCase();
 //#endregion
 //#region src/commands/document/subcommands/get/execute.ts
-const execute$64 = (config, input) => Effect.gen(function* () {
+const execute$63 = (config, input) => Effect.gen(function* () {
 	const ref = yield* readRef(input.documentHash, input.contentHash);
 	const { client } = yield* restoreAuthenticatedClient(config, input.email);
 	const document = yield* Effect.promise((signal) => client.paymentDocuments.get(ref, { signal })).pipe(Effect.flatMap(resultValue));
@@ -75321,7 +75454,7 @@ const command$61 = Command.make("get", {
 	documentHash: documentHashFlag,
 	contentHash: contentHashFlag,
 	email: emailFlag$5
-}, ({ documentHash, contentHash, email }) => dispatch$4("get", (config) => execute$64(config, {
+}, ({ documentHash, contentHash, email }) => dispatch$4("get", (config) => execute$63(config, {
 	kind: "get",
 	documentHash,
 	contentHash,
@@ -75329,7 +75462,7 @@ const command$61 = Command.make("get", {
 }))).pipe(annotate$4("get"), Command.withDescription("Read exact document bytes and metadata"));
 //#endregion
 //#region src/commands/document/subcommands/verify/execute.ts
-const execute$63 = (config, input) => Effect.gen(function* () {
+const execute$62 = (config, input) => Effect.gen(function* () {
 	const ref = yield* readRef(input.documentHash, input.contentHash);
 	const { client } = yield* restoreAuthenticatedClient(config, input.email);
 	const verification = yield* Effect.promise((signal) => client.paymentDocuments.verify(ref, { signal })).pipe(Effect.flatMap(resultValue));
@@ -75350,7 +75483,7 @@ const command$60 = Command.make("verify", {
 	documentHash: documentHashFlag,
 	contentHash: contentHashFlag,
 	email: emailFlag$5
-}, ({ documentHash, contentHash, email }) => dispatch$4("verify", (config) => execute$63(config, {
+}, ({ documentHash, contentHash, email }) => dispatch$4("verify", (config) => execute$62(config, {
 	kind: "verify",
 	documentHash,
 	contentHash,
@@ -75358,7 +75491,7 @@ const command$60 = Command.make("verify", {
 }))).pipe(annotate$4("verify"), Command.withDescription("Check an authorized document"));
 //#endregion
 //#region src/commands/document/subcommands/render/execute.ts
-const execute$62 = (config, input) => Effect.gen(function* () {
+const execute$61 = (config, input) => Effect.gen(function* () {
 	const ref = yield* readRef(input.documentHash, input.contentHash);
 	const { client } = yield* restoreAuthenticatedClient(config, input.email);
 	const document = yield* Effect.promise((signal) => client.paymentDocuments.render(ref, { signal })).pipe(Effect.flatMap(resultValue));
@@ -75376,7 +75509,7 @@ const command$59 = Command.make("render", {
 	contentHash: contentHashFlag,
 	email: emailFlag$5,
 	outputDirectory: Flag.String("output-dir").pipe(Flag.optional)
-}, ({ documentHash, contentHash, email, outputDirectory }) => dispatch$4("render", (config) => execute$62(config, {
+}, ({ documentHash, contentHash, email, outputDirectory }) => dispatch$4("render", (config) => execute$61(config, {
 	kind: "render",
 	documentHash,
 	contentHash,
@@ -75385,7 +75518,7 @@ const command$59 = Command.make("render", {
 }))).pipe(annotate$4("render"), Command.withDescription("Save a verified document as PDF"));
 //#endregion
 //#region src/commands/document/subcommands/export/execute.ts
-const execute$61 = (config, input) => Effect.gen(function* () {
+const execute$60 = (config, input) => Effect.gen(function* () {
 	const ref = yield* readRef(input.documentHash, input.contentHash);
 	if (input.out.length === 0) return yield* inputFailure("Provide --out with a new file path.");
 	const { client } = yield* restoreAuthenticatedClient(config, input.email);
@@ -75419,7 +75552,7 @@ const command$58 = Command.make("export", {
 	contentHash: contentHashFlag,
 	email: emailFlag$5,
 	out: outFlag
-}, ({ documentHash, contentHash, email, out }) => dispatch$4("export", (config) => execute$61(config, {
+}, ({ documentHash, contentHash, email, out }) => dispatch$4("export", (config) => execute$60(config, {
 	kind: "export",
 	documentHash,
 	contentHash,
@@ -75870,7 +76003,7 @@ const preparedLine = (mode, prepared) => mode === "json" ? `${JSON.stringify({
 * is composed only after confirmation, and the durable identity reaches stderr
 * before any digest is forwarded.
 */
-const execute$60 = (config, input) => Effect.gen(function* () {
+const execute$59 = (config, input) => Effect.gen(function* () {
 	const request = yield* buildInviteRequest(input);
 	const timeoutSeconds = yield* readWriteTimeout(input.timeoutSeconds);
 	const email = input.email === void 0 ? void 0 : yield* readEmail(input.email);
@@ -75959,7 +76092,7 @@ const previewLines$1 = (preview, recipient) => [
 const emailFlag$4 = Flag.String("email").pipe(Flag.optional);
 const invitationIdArgument = Argument.String("id").pipe(Argument.withDescription("The invitation ID"), Argument.optional);
 const timeoutFlag$3 = Flag.Int("timeout-seconds").pipe(Flag.withDefault(120));
-const confirmFlag$4 = Flag.Boolean("confirm").pipe(Flag.withDefault(false));
+const confirmFlag$3 = Flag.Boolean("confirm").pipe(Flag.withDefault(false));
 const target = {
 	invitationId: invitationIdArgument,
 	email: emailFlag$4
@@ -75998,7 +76131,7 @@ const command$57 = Command.make("invite", {
 	email: emailFlag$4,
 	requestKey: Flag.String("request-key").pipe(Flag.optional),
 	preview: Flag.Boolean("preview").pipe(Flag.withDefault(false)),
-	confirm: confirmFlag$4,
+	confirm: confirmFlag$3,
 	timeoutSeconds: timeoutFlag$3
 }, ({ email, toEmail, accountId, budgetIds, permissionIds, newBudgetName, asset, limit, unlimited, recipientAccounts, anyRecipient, actions, requestKey, preview, confirm, timeoutSeconds }) => Effect.gen(function* () {
 	const input = {
@@ -76047,7 +76180,7 @@ const command$57 = Command.make("invite", {
 			errors: missing.map((option) => new CliError.MissingOption({ option }))
 		});
 	}
-	yield* dispatch$3("org.member.invite", "org", (config, orgs) => execute$60(config, {
+	yield* dispatch$3("org.member.invite", "org", (config, orgs) => execute$59(config, {
 		...input,
 		orgs
 	}));
@@ -76220,7 +76353,7 @@ const readOfferDigest = (value, flag) => Effect.gen(function* () {
 * technical granter after the consent commits. Only the exact grantee can
 * accept; Admin access to the offer does not grant consent authority.
 */
-const execute$59 = (config, input) => Effect.gen(function* () {
+const execute$58 = (config, input) => Effect.gen(function* () {
 	const timeoutSeconds = yield* readWriteTimeout(input.timeoutSeconds);
 	const email = input.email === void 0 ? void 0 : yield* readEmail(input.email);
 	const runtime = yield* CliRuntime;
@@ -76265,9 +76398,9 @@ const command$56 = Command.make("accept", {
 	...target,
 	offerDigest: Flag.String("offer-digest").pipe(Flag.optional),
 	expectedOffer: Flag.String("expected-offer").pipe(Flag.optional),
-	confirm: confirmFlag$4,
+	confirm: confirmFlag$3,
 	timeoutSeconds: timeoutFlag$3
-}, ({ email, invitationId, offerDigest, expectedOffer, confirm, timeoutSeconds }) => dispatch$3("invite.accept", "own", (config, orgs) => execute$59(config, {
+}, ({ email, invitationId, offerDigest, expectedOffer, confirm, timeoutSeconds }) => dispatch$3("invite.accept", "own", (config, orgs) => execute$58(config, {
 	email: Option.getOrUndefined(email),
 	orgs,
 	invitationId: Option.getOrUndefined(invitationId),
@@ -76307,14 +76440,14 @@ const transitionInvitation = (action, question) => (config, input) => Effect.gen
 });
 //#endregion
 //#region src/commands/org-invite/subcommands/cancel/execute.ts
-const execute$58 = transitionInvitation("cancel", "Cancel this invitation?");
+const execute$57 = transitionInvitation("cancel", "Cancel this invitation?");
 //#endregion
 //#region src/commands/org-invite/subcommands/cancel/command.ts
 const command$55 = Command.make("cancel", {
 	...target,
-	confirm: confirmFlag$4,
+	confirm: confirmFlag$3,
 	timeoutSeconds: timeoutFlag$3
-}, ({ email, invitationId, confirm, timeoutSeconds }) => dispatch$3("org.invite.cancel", "org", (config, orgs) => execute$58(config, {
+}, ({ email, invitationId, confirm, timeoutSeconds }) => dispatch$3("org.invite.cancel", "org", (config, orgs) => execute$57(config, {
 	email: Option.getOrUndefined(email),
 	orgs,
 	invitationId: Option.getOrUndefined(invitationId),
@@ -76323,14 +76456,14 @@ const command$55 = Command.make("cancel", {
 }))).pipe(annotate$3("org.invite.cancel"), Command.withDescription("Cancel a pending offer you administer; starts its cleanup"));
 //#endregion
 //#region src/commands/org-invite/subcommands/decline/execute.ts
-const execute$57 = transitionInvitation("decline", "Decline this invitation?");
+const execute$56 = transitionInvitation("decline", "Decline this invitation?");
 //#endregion
 //#region src/commands/org-invite/subcommands/decline/command.ts
 const command$54 = Command.make("decline", {
 	...target,
-	confirm: confirmFlag$4,
+	confirm: confirmFlag$3,
 	timeoutSeconds: timeoutFlag$3
-}, ({ email, invitationId, confirm, timeoutSeconds }) => dispatch$3("invite.decline", "own", (config, orgs) => execute$57(config, {
+}, ({ email, invitationId, confirm, timeoutSeconds }) => dispatch$3("invite.decline", "own", (config, orgs) => execute$56(config, {
 	email: Option.getOrUndefined(email),
 	orgs,
 	invitationId: Option.getOrUndefined(invitationId),
@@ -76339,7 +76472,7 @@ const command$54 = Command.make("decline", {
 }))).pipe(annotate$3("invite.decline"), Command.withDescription("Decline your own pending offer; starts its cleanup"));
 //#endregion
 //#region src/commands/org-invite/subcommands/get/execute.ts
-const execute$56 = (config, input) => Effect.gen(function* () {
+const execute$55 = (config, input) => Effect.gen(function* () {
 	const { timeoutSeconds, email, invitationId, organizationId: explicitOrg } = yield* readInvitationReadInput(input, "optional");
 	const { client, session } = yield* restoreAuthenticatedClient(config, email);
 	const invitation = yield* readInvitationWithin(client, explicitOrg === null ? resolveOwningOrganization(client, invitationId) : Effect.succeed(explicitOrg), invitationId, timeoutSeconds);
@@ -76359,7 +76492,7 @@ const make$2 = (side) => {
 	return Command.make("get", {
 		...target,
 		timeoutSeconds: timeoutFlag$3
-	}, ({ email, invitationId, timeoutSeconds }) => dispatch$3(name, side, (config, orgs) => execute$56(config, {
+	}, ({ email, invitationId, timeoutSeconds }) => dispatch$3(name, side, (config, orgs) => execute$55(config, {
 		email: Option.getOrUndefined(email),
 		orgs,
 		invitationId: Option.getOrUndefined(invitationId),
@@ -76370,7 +76503,7 @@ const command$53 = make$2("own");
 const sent$2 = make$2("org");
 //#endregion
 //#region src/commands/org-invite/subcommands/list/execute.ts
-const execute$55 = (config, input) => Effect.gen(function* () {
+const execute$54 = (config, input) => Effect.gen(function* () {
 	const bounds = yield* readPageBounds(input);
 	const explicitOrg = yield* readExactOrg(input.orgs ?? [], "optional");
 	if (input.mine === true && explicitOrg !== null) return yield* inputRequired("Provide either --mine or --org; the Organization list is not filtered to you.");
@@ -76397,7 +76530,7 @@ const make$1 = (side) => {
 		limit: Flag.Int("limit").pipe(Flag.optional),
 		cursor: Flag.String("after").pipe(Flag.withDescription("the next page's cursor"), Flag.optional),
 		phases: Flag.String("phase").pipe(Flag.atLeast(0))
-	}, ({ email, limit, cursor, phases }) => dispatch$3(name, side, (config, orgs) => side === "org" && orgs.length === 0 ? Effect.fail(inputRequired("Provide --org.")) : execute$55(config, {
+	}, ({ email, limit, cursor, phases }) => dispatch$3(name, side, (config, orgs) => side === "org" && orgs.length === 0 ? Effect.fail(inputRequired("Provide --org.")) : execute$54(config, {
 		email: Option.getOrUndefined(email),
 		orgs,
 		limit: Option.getOrUndefined(limit),
@@ -76411,14 +76544,14 @@ const command$52 = make$1("own");
 const sent$1 = make$1("org");
 //#endregion
 //#region src/commands/org-invite/subcommands/resend/execute.ts
-const execute$54 = transitionInvitation("resend", "Resend this invitation?");
+const execute$53 = transitionInvitation("resend", "Resend this invitation?");
 //#endregion
 //#region src/commands/org-invite/subcommands/resend/command.ts
 const command$51 = Command.make("resend", {
 	...target,
-	confirm: confirmFlag$4,
+	confirm: confirmFlag$3,
 	timeoutSeconds: timeoutFlag$3
-}, ({ email, invitationId, confirm, timeoutSeconds }) => dispatch$3("org.invite.resend", "org", (config, orgs) => execute$54(config, {
+}, ({ email, invitationId, confirm, timeoutSeconds }) => dispatch$3("org.invite.resend", "org", (config, orgs) => execute$53(config, {
 	email: Option.getOrUndefined(email),
 	orgs,
 	invitationId: Option.getOrUndefined(invitationId),
@@ -76427,15 +76560,15 @@ const command$51 = Command.make("resend", {
 }))).pipe(annotate$3("org.invite.resend"), Command.withDescription("Retry delivery of a verified pending offer; never extends expiry"));
 //#endregion
 //#region src/commands/org-invite/subcommands/retry/execute.ts
-const execute$53 = transitionInvitation("retry", "Retry this invitation?");
+const execute$52 = transitionInvitation("retry", "Retry this invitation?");
 //#endregion
 //#region src/commands/org-invite/subcommands/retry/command.ts
 /** The backend's own recovery action for an offer; its guidance names it, the help does not. */
 const command$50 = Command.make("retry", {
 	...target,
-	confirm: confirmFlag$4,
+	confirm: confirmFlag$3,
 	timeoutSeconds: timeoutFlag$3
-}, ({ email, invitationId, confirm, timeoutSeconds }) => dispatch$3("org.invite.retry", "org", (config, orgs) => execute$53(config, {
+}, ({ email, invitationId, confirm, timeoutSeconds }) => dispatch$3("org.invite.retry", "org", (config, orgs) => execute$52(config, {
 	email: Option.getOrUndefined(email),
 	orgs,
 	invitationId: Option.getOrUndefined(invitationId),
@@ -76444,7 +76577,7 @@ const command$50 = Command.make("retry", {
 }))).pipe(annotate$3("org.invite.retry"), Command.withDescription("Resume the current offer state; creates no new consent or grant"), Command.unlisted);
 //#endregion
 //#region src/commands/org-invite/subcommands/review/execute.ts
-const execute$52 = (config, input) => Effect.gen(function* () {
+const execute$51 = (config, input) => Effect.gen(function* () {
 	const { timeoutSeconds, email, invitationId, organizationId } = yield* readInvitationReadInput(input, "optional");
 	const { client, session } = yield* restoreAuthenticatedClient(config, email);
 	const invitation = yield* readInvitationWithin(client, organizationId === null ? resolveOwningOrganization(client, invitationId) : Effect.succeed(organizationId), invitationId, timeoutSeconds);
@@ -76459,7 +76592,7 @@ const execute$52 = (config, input) => Effect.gen(function* () {
 const command$49 = Command.make("review", {
 	...target,
 	timeoutSeconds: timeoutFlag$3
-}, ({ email, invitationId, timeoutSeconds }) => dispatch$3("invite.review", "own", (config, orgs) => execute$52(config, {
+}, ({ email, invitationId, timeoutSeconds }) => dispatch$3("invite.review", "own", (config, orgs) => execute$51(config, {
 	email: Option.getOrUndefined(email),
 	orgs,
 	invitationId: Option.getOrUndefined(invitationId),
@@ -76467,7 +76600,7 @@ const command$49 = Command.make("review", {
 }))).pipe(annotate$3("invite.review"), Command.withDescription("Review one exact current offer without writing or signing"), Command.unlisted);
 //#endregion
 //#region src/commands/org-invite/subcommands/wait/execute.ts
-const execute$51 = (config, input) => Effect.gen(function* () {
+const execute$50 = (config, input) => Effect.gen(function* () {
 	const { timeoutSeconds, email, invitationId, organizationId: explicitOrg } = yield* readInvitationReadInput(input, "optional");
 	const { client, session } = yield* restoreAuthenticatedClient(config, email);
 	let resolvedOrg = null;
@@ -76510,7 +76643,7 @@ const make = (side) => {
 	return Command.make("wait", {
 		...target,
 		timeoutSeconds: timeoutFlag$3
-	}, ({ email, invitationId, timeoutSeconds }) => dispatch$3(name, side, (config, orgs) => execute$51(config, {
+	}, ({ email, invitationId, timeoutSeconds }) => dispatch$3(name, side, (config, orgs) => execute$50(config, {
 		email: Option.getOrUndefined(email),
 		orgs,
 		invitationId: Option.getOrUndefined(invitationId),
@@ -76568,7 +76701,7 @@ const makeContext$1 = () => ({
 //#region src/commands/request/subcommands/shared.ts
 const emailFlag$3 = Flag.String("email").pipe(Flag.optional);
 const idArgument = Argument.String("id").pipe(Argument.withDescription("The request ID"));
-const confirmFlag$3 = Flag.Boolean("confirm").pipe(Flag.withDefault(false));
+const confirmFlag$2 = Flag.Boolean("confirm").pipe(Flag.withDefault(false));
 const names$3 = {
 	"issued.root": "request",
 	"issued.issue": "request.issue",
@@ -76648,7 +76781,7 @@ const offerLines = (offer) => [
 ];
 //#endregion
 //#region src/commands/offer/subcommands/list/execute.ts
-const execute$50 = (config, input) => Effect.gen(function* () {
+const execute$49 = (config, input) => Effect.gen(function* () {
 	const orgId = yield* readScope(input);
 	const { client } = yield* restoreAuthenticatedClient(config, input.email);
 	const offers = (orgId === null ? client.account : client.org(orgId)).offers;
@@ -76668,7 +76801,7 @@ const command$47 = (context) => Command.make("list", { email: emailFlag$3 }, ({
 	kind: "list",
 	...scope,
 	email: Option.getOrUndefined(email)
-}), execute$50)).pipe(context.annotate("list"), Command.withDescription("List fixed offers"));
+}), execute$49)).pipe(context.annotate("list"), Command.withDescription("List fixed offers"));
 //#endregion
 //#region src/commands/offer/internal/input.ts
 const exactText = (value, flag) => value.trim().length === 0 || new TextEncoder().encode(value).length > 128 || /[\p{Cc}\p{Cf}]/u.test(value) ? Effect.fail(inputRequired(`Provide a nonempty --${flag} of at most 128 bytes without control characters.`)) : Effect.succeed(value);
@@ -76697,7 +76830,7 @@ const readOfferInput = (source) => Effect.gen(function* () {
 }).pipe(Effect.mapError((error) => error instanceof UpdateUnavailable ? inputRequired("Offer input exceeds 64 KiB.") : error));
 //#endregion
 //#region src/commands/offer/subcommands/get/execute.ts
-const execute$49 = (config, input) => Effect.gen(function* () {
+const execute$48 = (config, input) => Effect.gen(function* () {
 	const orgId = yield* readScope(input);
 	const id = yield* exactText(input.id, "offer-id");
 	const { client } = yield* restoreAuthenticatedClient(config, input.email);
@@ -76719,7 +76852,7 @@ const command$46 = (context) => Command.make("get", {
 	...scope,
 	email: Option.getOrUndefined(email),
 	id
-}), execute$49)).pipe(context.annotate("get"), Command.withDescription("Get fixed offers"));
+}), execute$48)).pipe(context.annotate("get"), Command.withDescription("Get fixed offers"));
 //#endregion
 //#region src/commands/offer/internal/write.ts
 /** An uncertain write returns scoped readback, never an automatic retry. */
@@ -76758,7 +76891,7 @@ const changeOffer = (config, email, target, change) => Effect.gen(function* () {
 });
 //#endregion
 //#region src/commands/offer/subcommands/create/execute.ts
-const execute$48 = (config, input) => Effect.gen(function* () {
+const execute$47 = (config, input) => Effect.gen(function* () {
 	const orgId = yield* readScope(input);
 	const requestKey = yield* exactText(input.requestKey, "request-key");
 	const terms = yield* readOfferInput(input.source);
@@ -76789,7 +76922,7 @@ const command$45 = (context) => Command.make("create", {
 	email: emailFlag$3,
 	source: Flag.String("input"),
 	requestKey: Flag.String("request-key"),
-	confirm: confirmFlag$3
+	confirm: confirmFlag$2
 }, ({ email, source, requestKey, confirm }) => context.dispatch("create", (scope) => ({
 	kind: "create",
 	...scope,
@@ -76797,10 +76930,10 @@ const command$45 = (context) => Command.make("create", {
 	source,
 	requestKey,
 	confirm
-}), execute$48)).pipe(context.annotate("create"), Command.withDescription("Create fixed offers"));
+}), execute$47)).pipe(context.annotate("create"), Command.withDescription("Create fixed offers"));
 //#endregion
 //#region src/commands/offer/subcommands/revise/execute.ts
-const execute$47 = (config, input) => Effect.gen(function* () {
+const execute$46 = (config, input) => Effect.gen(function* () {
 	const orgId = yield* readScope(input);
 	const id = yield* exactText(input.id, "offer-id");
 	const expectedRevision = yield* exactRevision(input.revision);
@@ -76828,7 +76961,7 @@ const command$44 = (context) => Command.make("revise", {
 	id: idArgument$1,
 	revision: revisionFlag,
 	source: Flag.String("input"),
-	confirm: confirmFlag$3
+	confirm: confirmFlag$2
 }, ({ email, id, revision, source, confirm }) => context.dispatch("revise", (scope) => ({
 	kind: "revise",
 	...scope,
@@ -76837,10 +76970,10 @@ const command$44 = (context) => Command.make("revise", {
 	revision,
 	source,
 	confirm
-}), execute$47)).pipe(context.annotate("revise"), Command.withDescription("Revise fixed offers"));
+}), execute$46)).pipe(context.annotate("revise"), Command.withDescription("Revise fixed offers"));
 //#endregion
 //#region src/commands/offer/subcommands/deactivate/execute.ts
-const execute$46 = (config, input) => Effect.gen(function* () {
+const execute$45 = (config, input) => Effect.gen(function* () {
 	const orgId = yield* readScope(input);
 	const id = yield* exactText(input.id, "offer-id");
 	const expectedRevision = yield* exactRevision(input.revision);
@@ -76865,7 +76998,7 @@ const command$43 = (context) => Command.make("deactivate", {
 	email: emailFlag$3,
 	id: idArgument$1,
 	revision: revisionFlag,
-	confirm: confirmFlag$3
+	confirm: confirmFlag$2
 }, ({ email, id, revision, confirm }) => context.dispatch("deactivate", (scope) => ({
 	kind: "deactivate",
 	...scope,
@@ -76873,7 +77006,7 @@ const command$43 = (context) => Command.make("deactivate", {
 	id,
 	revision,
 	confirm
-}), execute$46)).pipe(context.annotate("deactivate"), Command.withDescription("Deactivate fixed offers"));
+}), execute$45)).pipe(context.annotate("deactivate"), Command.withDescription("Deactivate fixed offers"));
 //#endregion
 //#region src/commands/offer/command.ts
 const makeCommand = () => {
@@ -76896,7 +77029,7 @@ const accountIdFlag = Flag.String("account-id").pipe(Flag.optional);
 const assignmentIdArgument = Argument.String("id").pipe(Argument.withDescription("The Permission assignment ID"), Argument.optional);
 const expectedMemberEmailFlag = Flag.String("expected-member-email").pipe(Flag.optional);
 const requestKeyFlag$2 = Flag.String("request-key").pipe(Flag.between(0, 1), Flag.map((values) => Option.fromUndefinedOr(values[0])));
-const confirmFlag$2 = Flag.Boolean("confirm").pipe(Flag.withDefault(false));
+const confirmFlag$1 = Flag.Boolean("confirm").pipe(Flag.withDefault(false));
 const timeoutFlag$2 = Flag.Int("timeout-seconds").pipe(Flag.withDefault(120));
 const names$2 = {
 	root: "org.permission",
@@ -77315,7 +77448,7 @@ const resolvePermissionScope = (config, email, explicit) => Effect.gen(function*
 });
 //#endregion
 //#region src/commands/org/subcommands/permission/subcommands/list/execute.ts
-const execute$45 = (config, input) => Effect.gen(function* () {
+const execute$44 = (config, input) => Effect.gen(function* () {
 	const explicit = yield* explicitOrganization$1(input.orgs);
 	const { orgId, organization, permissions } = yield* resolvePermissionScope(config, input.email, explicit);
 	const runtime = yield* CliRuntime;
@@ -77330,7 +77463,7 @@ const execute$45 = (config, input) => Effect.gen(function* () {
 });
 //#endregion
 //#region src/commands/org/subcommands/permission/subcommands/list/command.ts
-const command$42 = Command.make("list", { email: emailFlag$2 }, ({ email }) => dispatch$2("list", (config, orgs) => execute$45(config, {
+const command$42 = Command.make("list", { email: emailFlag$2 }, ({ email }) => dispatch$2("list", (config, orgs) => execute$44(config, {
 	kind: "list",
 	orgs,
 	email: Option.getOrUndefined(email)
@@ -77348,7 +77481,7 @@ const notFound = () => new CliFailure({
 	exitCode: 2,
 	message: "The Permission was not found or is unavailable to this session. Check the Permission ID."
 });
-const execute$44 = (config, input) => Effect.gen(function* () {
+const execute$43 = (config, input) => Effect.gen(function* () {
 	const explicit = yield* explicitOrganization$1(input.orgs);
 	const permissionId = yield* readPermissionId(input.permissionId);
 	const { orgId, permissions } = yield* resolvePermissionScope(config, input.email, explicit);
@@ -77374,7 +77507,7 @@ const execute$44 = (config, input) => Effect.gen(function* () {
 const command$41 = Command.make("get", {
 	email: emailFlag$2,
 	permissionId: permissionIdArgument
-}, ({ email, permissionId }) => dispatch$2("get", (config, orgs) => execute$44(config, {
+}, ({ email, permissionId }) => dispatch$2("get", (config, orgs) => execute$43(config, {
 	kind: "get",
 	orgs,
 	email: Option.getOrUndefined(email),
@@ -77589,7 +77722,7 @@ const writeValidatedPermission = (config, input, validated, submit) => Effect.ge
 });
 //#endregion
 //#region src/commands/org/subcommands/permission/subcommands/create/execute.ts
-const execute$43 = (config, input) => Effect.gen(function* () {
+const execute$42 = (config, input) => Effect.gen(function* () {
 	const validated = yield* validateWriteInput(input);
 	return yield* writeValidatedPermission(config, input, validated, (methods, selection, key, signal, onPrepared) => {
 		if (selection.kind !== "create") throw new Error("Expected Permission creation preview");
@@ -77608,9 +77741,9 @@ const command$40 = Command.make("create", {
 	email: emailFlag$2,
 	input: sourceFlag$2,
 	requestKey: requestKeyFlag$2,
-	confirm: confirmFlag$2,
+	confirm: confirmFlag$1,
 	timeoutSeconds: timeoutFlag$2
-}, ({ email, input, requestKey, confirm, timeoutSeconds }) => dispatch$2("create", (config, orgs) => execute$43(config, {
+}, ({ email, input, requestKey, confirm, timeoutSeconds }) => dispatch$2("create", (config, orgs) => execute$42(config, {
 	kind: "create",
 	orgs,
 	email: Option.getOrUndefined(email),
@@ -77621,7 +77754,7 @@ const command$40 = Command.make("create", {
 }))).pipe(annotate$2("create"), Command.withDescription("Create a Permission from its complete policy"));
 //#endregion
 //#region src/commands/org/subcommands/permission/subcommands/change/execute.ts
-const execute$42 = (config, input) => Effect.gen(function* () {
+const execute$41 = (config, input) => Effect.gen(function* () {
 	const validated = yield* validateWriteInput(input);
 	return yield* writeValidatedPermission(config, input, validated, (methods, selection, key, signal, onPrepared) => {
 		if (selection.kind !== "change" || selection.permission === null) throw new Error("Expected an active Permission for change");
@@ -77642,9 +77775,9 @@ const command$39 = Command.make("change", {
 	permissionId: permissionIdArgument.pipe(Argument.optional),
 	input: sourceFlag$2,
 	requestKey: requestKeyFlag$2,
-	confirm: confirmFlag$2,
+	confirm: confirmFlag$1,
 	timeoutSeconds: timeoutFlag$2
-}, ({ email, permissionId, input, requestKey, confirm, timeoutSeconds }) => dispatch$2("change", (config, orgs) => execute$42(config, {
+}, ({ email, permissionId, input, requestKey, confirm, timeoutSeconds }) => dispatch$2("change", (config, orgs) => execute$41(config, {
 	kind: "change",
 	orgs,
 	email: Option.getOrUndefined(email),
@@ -77656,7 +77789,7 @@ const command$39 = Command.make("change", {
 }))).pipe(annotate$2("change"), Command.withDescription("Replace one active Permission's complete policy"));
 //#endregion
 //#region src/commands/org/subcommands/permission/subcommands/assign/execute.ts
-const execute$41 = (config, input) => Effect.gen(function* () {
+const execute$40 = (config, input) => Effect.gen(function* () {
 	const validated = yield* validateWriteInput(input);
 	return yield* writeValidatedPermission(config, input, validated, (methods, selection, key, signal, onPrepared) => {
 		if (selection.kind !== "assign") throw new Error("Expected Permission assignment preview");
@@ -77679,9 +77812,9 @@ const command$38 = Command.make("assign", {
 	accountId: accountIdFlag,
 	expectedMemberEmail: expectedMemberEmailFlag,
 	requestKey: requestKeyFlag$2,
-	confirm: confirmFlag$2,
+	confirm: confirmFlag$1,
 	timeoutSeconds: timeoutFlag$2
-}, ({ email, permissionId, accountId, expectedMemberEmail, requestKey, confirm, timeoutSeconds }) => dispatch$2("assign", (config, orgs) => execute$41(config, {
+}, ({ email, permissionId, accountId, expectedMemberEmail, requestKey, confirm, timeoutSeconds }) => dispatch$2("assign", (config, orgs) => execute$40(config, {
 	kind: "assign",
 	orgs,
 	email: Option.getOrUndefined(email),
@@ -77694,7 +77827,7 @@ const command$38 = Command.make("assign", {
 }))).pipe(annotate$2("assign"), Command.withDescription("Assign one active Permission to one exact Account"));
 //#endregion
 //#region src/commands/org/subcommands/permission/subcommands/revoke/execute.ts
-const execute$40 = (config, input) => Effect.gen(function* () {
+const execute$39 = (config, input) => Effect.gen(function* () {
 	const validated = yield* validateWriteInput(input);
 	return yield* writeValidatedPermission(config, input, validated, (methods, selection, key, signal, onPrepared) => {
 		if (selection.kind !== "revoke") throw new Error("Expected Permission revocation preview");
@@ -77713,9 +77846,9 @@ const command$37 = Command.make("revoke", {
 	email: emailFlag$2,
 	assignmentId: assignmentIdArgument,
 	requestKey: requestKeyFlag$2,
-	confirm: confirmFlag$2,
+	confirm: confirmFlag$1,
 	timeoutSeconds: timeoutFlag$2
-}, ({ email, assignmentId, requestKey, confirm, timeoutSeconds }) => dispatch$2("revoke", (config, orgs) => execute$40(config, {
+}, ({ email, assignmentId, requestKey, confirm, timeoutSeconds }) => dispatch$2("revoke", (config, orgs) => execute$39(config, {
 	kind: "revoke",
 	orgs,
 	email: Option.getOrUndefined(email),
@@ -77726,7 +77859,7 @@ const command$37 = Command.make("revoke", {
 }))).pipe(annotate$2("revoke"), Command.withDescription("Revoke one exact active Permission assignment"));
 //#endregion
 //#region src/commands/org/subcommands/permission/subcommands/replace/execute.ts
-const execute$39 = (config, input) => Effect.gen(function* () {
+const execute$38 = (config, input) => Effect.gen(function* () {
 	const validated = yield* validateWriteInput(input);
 	return yield* writeValidatedPermission(config, input, validated, (methods, selection, requestKey, signal, onPrepared) => {
 		if (selection.kind !== "replace") throw new Error("Expected Permission replacement preview");
@@ -77744,9 +77877,9 @@ const execute$39 = (config, input) => Effect.gen(function* () {
 const command$36 = Command.make("replace", {
 	email: emailFlag$2,
 	requestKey: requestKeyFlag$2,
-	confirm: confirmFlag$2,
+	confirm: confirmFlag$1,
 	timeoutSeconds: timeoutFlag$2
-}, ({ email, requestKey, confirm, timeoutSeconds }) => dispatch$2("replace", (config, orgs) => execute$39(config, {
+}, ({ email, requestKey, confirm, timeoutSeconds }) => dispatch$2("replace", (config, orgs) => execute$38(config, {
 	kind: "replace",
 	orgs,
 	email: Option.getOrUndefined(email),
@@ -77964,7 +78097,7 @@ const observeValidatedCommand = (config, input, validated, read) => Effect.gen(f
 });
 //#endregion
 //#region src/commands/org/subcommands/permission/subcommands/command/subcommands/get/execute.ts
-const execute$38 = (config, input) => Effect.gen(function* () {
+const execute$37 = (config, input) => Effect.gen(function* () {
 	const validated = yield* validateObservationInput(input);
 	return yield* observeValidatedCommand(config, input, validated, (methods, _org, key) => Effect.promise((signal) => methods.getCommand(key, { signal })).pipe(Effect.flatMap(resultValue)));
 });
@@ -77974,7 +78107,7 @@ const command$35 = Command.make("get", {
 	email: emailFlag$2,
 	requestKey: requestKeyFlag$2,
 	timeoutSeconds: timeoutFlag$2
-}, ({ email, requestKey, timeoutSeconds }) => dispatch$2("commandGet", (config, orgs) => execute$38(config, {
+}, ({ email, requestKey, timeoutSeconds }) => dispatch$2("commandGet", (config, orgs) => execute$37(config, {
 	kind: "commandGet",
 	orgs,
 	email: Option.getOrUndefined(email),
@@ -77983,7 +78116,7 @@ const command$35 = Command.make("get", {
 }))).pipe(annotate$2("commandGet"), Command.withDescription("Read one exact owned Permission command"));
 //#endregion
 //#region src/commands/org/subcommands/permission/subcommands/command/subcommands/wait/execute.ts
-const execute$37 = (config, input) => Effect.gen(function* () {
+const execute$36 = (config, input) => Effect.gen(function* () {
 	const validated = yield* validateObservationInput(input);
 	return yield* observeValidatedCommand(config, input, validated, (methods, orgId, key, seen) => observeCommand((listener, signal) => methods.subscribeCommand(key, listener, { signal }), orgId, key, seen));
 });
@@ -77993,7 +78126,7 @@ const command$34 = Command.make("wait", {
 	email: emailFlag$2,
 	requestKey: requestKeyFlag$2,
 	timeoutSeconds: timeoutFlag$2
-}, ({ email, requestKey, timeoutSeconds }) => dispatch$2("commandWait", (config, orgs) => execute$37(config, {
+}, ({ email, requestKey, timeoutSeconds }) => dispatch$2("commandWait", (config, orgs) => execute$36(config, {
 	kind: "commandWait",
 	orgs,
 	email: Option.getOrUndefined(email),
@@ -78023,7 +78156,7 @@ const groupIdArgument = Argument.String("id").pipe(Argument.withDescription("The
 const runIdArgument = Argument.String("id").pipe(Argument.withDescription("The Payroll run ID"), Argument.optional, Argument.map(Option.toArray));
 const requestKeyFlag$1 = Flag.String("request-key").pipe(Flag.atLeast(0));
 const resumeFlag = Flag.String("resume").pipe(Flag.atLeast(0));
-const confirmFlag$1 = Flag.Boolean("confirm").pipe(Flag.withDefault(false));
+const confirmFlag = Flag.Boolean("confirm").pipe(Flag.withDefault(false));
 const timeoutFlag$1 = Flag.Int("timeout-seconds").pipe(Flag.withDefault(120));
 const names$1 = {
 	root: "org.payroll",
@@ -78256,7 +78389,7 @@ const runLines$1 = (value) => [
 ];
 //#endregion
 //#region src/commands/org/subcommands/payroll/subcommands/groups/subcommands/list/execute.ts
-const execute$36 = (config, input) => Effect.gen(function* () {
+const execute$35 = (config, input) => Effect.gen(function* () {
 	const { client, organization, orgId, timeout } = yield* resolvePayrollContext(config, input);
 	const result = yield* boundedNetwork(Effect.promise((signal) => client.org(orgId).payroll.groups.list({ signal })).pipe(Effect.flatMap(resultValue)), timeout).pipe(Effect.mapError((error) => normalizeOrganizationReadFailure(error, orgId)));
 	return {
@@ -78269,7 +78402,7 @@ const execute$36 = (config, input) => Effect.gen(function* () {
 const command$32 = Command.make("list", {
 	email: emailFlag$1,
 	timeout: timeoutFlag$1
-}, ({ email, timeout }) => dispatch$1("groups.list", (config, orgs) => execute$36(config, {
+}, ({ email, timeout }) => dispatch$1("groups.list", (config, orgs) => execute$35(config, {
 	kind: "groups.list",
 	orgs,
 	email: Option.getOrUndefined(email),
@@ -78277,7 +78410,7 @@ const command$32 = Command.make("list", {
 }))).pipe(annotate$1("groups.list"), Command.withDescription("List saved roster drafts in one Organization"));
 //#endregion
 //#region src/commands/org/subcommands/payroll/subcommands/groups/subcommands/save/execute.ts
-const execute$35 = (config, input) => Effect.gen(function* () {
+const execute$34 = (config, input) => Effect.gen(function* () {
 	const { client, session, stillAuthenticated, orgId, prepared, timeout } = yield* resolvePayrollContext(config, input);
 	if (prepared?.kind !== "groups.save") return yield* Effect.die("Expected Payroll group save");
 	const scoped = client.org(orgId);
@@ -78332,9 +78465,9 @@ const execute$35 = (config, input) => Effect.gen(function* () {
 const command$31 = Command.make("save", {
 	email: emailFlag$1,
 	input: sourceFlag$1,
-	confirm: confirmFlag$1,
+	confirm: confirmFlag,
 	timeout: timeoutFlag$1
-}, ({ email, input, confirm, timeout }) => dispatch$1("groups.save", (config, orgs) => execute$35(config, {
+}, ({ email, input, confirm, timeout }) => dispatch$1("groups.save", (config, orgs) => execute$34(config, {
 	kind: "groups.save",
 	orgs,
 	email: Option.getOrUndefined(email),
@@ -78344,7 +78477,7 @@ const command$31 = Command.make("save", {
 }))).pipe(annotate$1("groups.save"), Command.withDescription("Create or replace one complete Payroll roster draft"));
 //#endregion
 //#region src/commands/org/subcommands/payroll/subcommands/groups/subcommands/remove/execute.ts
-const execute$34 = (config, input) => Effect.gen(function* () {
+const execute$33 = (config, input) => Effect.gen(function* () {
 	const { client, session, stillAuthenticated, orgId, prepared, timeout } = yield* resolvePayrollContext(config, input);
 	if (prepared?.kind !== "groups.remove") return yield* Effect.die("Expected Payroll group remove");
 	const scoped = client.org(orgId);
@@ -78387,9 +78520,9 @@ const execute$34 = (config, input) => Effect.gen(function* () {
 const command$30 = Command.make("remove", {
 	email: emailFlag$1,
 	groupId: groupIdArgument,
-	confirm: confirmFlag$1,
+	confirm: confirmFlag,
 	timeout: timeoutFlag$1
-}, ({ email, groupId, confirm, timeout }) => dispatch$1("groups.remove", (config, orgs) => execute$34(config, {
+}, ({ email, groupId, confirm, timeout }) => dispatch$1("groups.remove", (config, orgs) => execute$33(config, {
 	kind: "groups.remove",
 	orgs,
 	email: Option.getOrUndefined(email),
@@ -78406,7 +78539,7 @@ const groups = Command.make("groups").pipe(annotate$1("groups"), Command.withDes
 ]));
 //#endregion
 //#region src/commands/org/subcommands/payroll/subcommands/list/execute.ts
-const execute$33 = (config, input) => Effect.gen(function* () {
+const execute$32 = (config, input) => Effect.gen(function* () {
 	const { client, organization, orgId, timeout } = yield* resolvePayrollContext(config, input);
 	const result = yield* boundedNetwork(Effect.promise((signal) => client.org(orgId).payroll.runs({ signal })).pipe(Effect.flatMap(resultValue)), timeout).pipe(Effect.mapError((error) => normalizeOrganizationReadFailure(error, orgId)));
 	return {
@@ -78419,7 +78552,7 @@ const execute$33 = (config, input) => Effect.gen(function* () {
 const command$29 = Command.make("list", {
 	email: emailFlag$1,
 	timeout: timeoutFlag$1
-}, ({ email, timeout }) => dispatch$1("list", (config, orgs) => execute$33(config, {
+}, ({ email, timeout }) => dispatch$1("list", (config, orgs) => execute$32(config, {
 	kind: "list",
 	orgs,
 	email: Option.getOrUndefined(email),
@@ -78427,7 +78560,7 @@ const command$29 = Command.make("list", {
 }))).pipe(annotate$1("list"), Command.withDescription("List Payroll runs and backend monthly totals"));
 //#endregion
 //#region src/commands/org/subcommands/payroll/subcommands/terms/execute.ts
-const execute$32 = (config, input) => Effect.gen(function* () {
+const execute$31 = (config, input) => Effect.gen(function* () {
 	const { client, organization, orgId, timeout } = yield* resolvePayrollContext(config, input);
 	const terms = yield* boundedNetwork(Effect.promise((signal) => client.org(orgId).payroll.terms({ signal })).pipe(Effect.flatMap(resultValue)), timeout).pipe(Effect.mapError((error) => normalizeOrganizationReadFailure(error, orgId)));
 	return {
@@ -78440,7 +78573,7 @@ const execute$32 = (config, input) => Effect.gen(function* () {
 const command$28 = Command.make("terms", {
 	email: emailFlag$1,
 	timeout: timeoutFlag$1
-}, ({ email, timeout }) => dispatch$1("terms", (config, orgs) => execute$32(config, {
+}, ({ email, timeout }) => dispatch$1("terms", (config, orgs) => execute$31(config, {
 	kind: "terms",
 	orgs,
 	email: Option.getOrUndefined(email),
@@ -78597,13 +78730,11 @@ const prepareRunInput = (input) => Effect.gen(function* () {
 	if (!interactive && orgId === null) return yield* inputRequired("Provide exact --org to run Payroll.");
 	if (!interactive && source === void 0 && resume === void 0) return yield* inputRequired("Provide --input FILE or --input -.");
 	if (!interactive && suppliedKey === void 0 && resumeKey === void 0) return yield* inputRequired("Provide --request-key for scripted Payroll.");
-	yield* requireWriteConfirmation(input.confirm);
 	return {
 		timeout,
 		email,
 		orgId,
 		resume,
-		interactive,
 		fresh: source === void 0 ? void 0 : yield* readRunInput(source),
 		key: resumeKey ?? suppliedKey ?? (yield* (yield* Crypto.Crypto).randomUUIDv4)
 	};
@@ -78712,204 +78843,6 @@ const guideRunInput = (budgets, groups, terms, contacts) => Effect.gen(function*
 	});
 });
 //#endregion
-//#region src/commands/org/subcommands/payroll/internal/run-lookup.ts
-const isPayrollRunId = (value) => /^payroll_run_[0-9a-f]{64}$/u.test(value);
-const exactRunId = (value) => isPayrollRunId(value) ? Effect.succeed(value) : Effect.fail(inputRequired("Provide the Payroll run ID: payroll_run_ followed by a 64-character digest."));
-const validateRunInput = (input) => Effect.gen(function* () {
-	const timeout = yield* readWriteTimeout(input.timeoutSeconds);
-	const email = input.email === void 0 ? void 0 : yield* readEmail(input.email);
-	if (input.orgs.length > 1) return yield* inputRequired("Provide one exact --org ID.");
-	const orgId = yield* explicitOrganization(input.orgs);
-	if (input.runIds.length > 1) return yield* inputRequired("Provide one exact Payroll run ID.");
-	let runId = input.runIds[0];
-	if (runId !== void 0) yield* exactRunId(runId);
-	const runtime = yield* CliRuntime;
-	if (!runtime.tty || runtime.ci || runtime.mode === "json") {
-		if (orgId === null) return yield* inputRequired("Provide one exact --org ID.");
-		if (runId === void 0) return yield* inputRequired("Provide the Payroll run ID.");
-	}
-	if (runId === void 0) runId = yield* Prompt.String({ message: "Payroll run ID" });
-	return {
-		orgId,
-		runId: yield* exactRunId(runId),
-		timeout,
-		email
-	};
-});
-const missingRun = () => new CliFailure({
-	code: "INVALID_INPUT",
-	outcome: "refused",
-	exitCode: 2,
-	message: "The Payroll run was not found or is unavailable to this session. Check --org and the Payroll run ID."
-});
-const matches = (detail, orgId, runId) => detail.orgId === orgId && detail.run.id === runId;
-const mismatch = () => Errors.invalidInput("runId", "Payroll run response scope does not match");
-const finishedRun = (detail) => detail.items.length > 0 && detail.items.every((item) => paymentPhase(item.payment.status).outcome === "good") || detail.items.some((item) => {
-	const phase = paymentPhase(item.payment.status);
-	return phase.terminal && phase.outcome !== "good" || phase.needsAction || item.payment.execution?.retryRequired === true;
-}) || [
-	"failed",
-	"mismatch",
-	"unresolved"
-].includes(detail.command.verificationState) || detail.command.completionOutcome === "failed" || detail.command.terminalOutcome !== void 0 && detail.command.terminalOutcome !== "settled";
-//#endregion
-//#region src/commands/org/subcommands/payroll/internal/run-lines.ts
-const runRecovery = (orgId, runId, email, command) => {
-	const args = [
-		"capxul",
-		"org",
-		"payroll",
-		"get",
-		runId,
-		"--org",
-		orgId,
-		...email === void 0 ? [] : ["--email", email]
-	];
-	return {
-		lines: `${command === void 0 ? "" : `Request key: ${terminalText(command.requestKey)}\nCommand: ${terminalText(command.commandId)}\n`}Read: ${args.map(shellArgument).join(" ")}\nWait: ${[
-			...args.slice(0, 3),
-			"wait",
-			...args.slice(4)
-		].map(shellArgument).join(" ")}`,
-		details: {
-			organizationId: orgId,
-			runId,
-			...command === void 0 ? {} : {
-				requestKey: command.requestKey,
-				commandId: command.commandId
-			},
-			recovery: {
-				kind: "read",
-				argv: args
-			}
-		}
-	};
-};
-const runDetailLines = (detail) => [
-	`Payroll run ${terminalText(detail.run.id)}: recorded status ${detail.run.status}`,
-	`  Organization: ${terminalText(detail.orgId)}`,
-	`  Period: ${detail.run.periodStart} to ${detail.run.periodEnd}`,
-	`  Total: ${terminalText(formatAssetAmount(detail.run.total))}; recipients: ${detail.run.recipientCount}`,
-	`  Request key: ${terminalText(detail.command.requestKey)}`,
-	`  Command: ${terminalText(detail.command.commandId)}; state ${detail.command.state}; verification ${detail.command.verificationState}`,
-	...detail.command.completionOutcome === void 0 ? [] : [`  Recorded completion: ${detail.command.completionOutcome}`],
-	...detail.command.terminalOutcome === void 0 ? [] : [`  Recorded terminal outcome: ${detail.command.terminalOutcome}`],
-	...detail.command.userOpHash === void 0 ? [] : [`  Submitted user operation: ${terminalText(detail.command.userOpHash)}`],
-	`  Created: ${detail.createdAt}; updated: ${detail.updatedAt}${detail.settledAt === void 0 ? "" : `; recorded settled: ${detail.settledAt}`}`,
-	"Original ordered Payments",
-	...detail.items.flatMap((item) => [
-		`  Item ${item.itemIndex}: employee ${terminalText(item.employeeRef)}; engagement ${terminalText(item.engagementEdgeId)}`,
-		`    Gross: ${terminalText(item.gross)} raw units; net: ${terminalText(item.net)} raw units`,
-		...item.adjustments.map((adjustment) => `    Adjustment: ${terminalText(adjustment.label)}; ${terminalText(adjustment.amount)} raw units`),
-		`    Quantity: ${terminalText(item.amount.value)}; asset: ${terminalText(item.amount.asset)}`,
-		`    Payment ${terminalText(item.payment.id)}: ${item.payment.status}`,
-		`    Counterparty: ${terminalText(item.payment.counterpartyLabel)}`,
-		`    Receipt: ${item.payment.receipt === null ? "none recorded" : `${terminalText(item.payment.receipt.transactionHash)} (chain ${item.payment.receipt.chainId})`}`,
-		...item.payment.execution === void 0 ? [] : [`    Execution: ${item.payment.execution.status}${item.payment.execution.retryRequired ? "; action required" : ""}`],
-		...item.payment.recipient.kind === "party" ? [`    Party: ${terminalText(item.payment.recipient.partyId)}; label: ${terminalText(item.payment.recipient.label)}`] : [],
-		...item.payment.documentState === void 0 ? [] : [`    Documents: ${item.payment.documentState}`],
-		...item.payment.documents.map((document) => `    Document: ${terminalText(document.documentHash)}; content: ${terminalText(document.contentHash)}; kind: ${document.kind}`)
-	])
-];
-//#endregion
-//#region src/commands/org/subcommands/payroll/internal/run-reads.ts
-const readValidatedRun = (config, input, validated, read) => Effect.gen(function* () {
-	let orgId = validated.orgId;
-	let email = validated.email;
-	let command;
-	const runtime = yield* CliRuntime;
-	const known = () => orgId === null ? null : runRecovery(orgId, validated.runId, email, command);
-	const observed = yield* Effect.gen(function* () {
-		const restored = yield* restoreAuthenticatedClient(config, email, { requirement: "none" });
-		email = restored.session.email;
-		const organizations = yield* Effect.promise((signal) => restored.client.orgs({ signal })).pipe(Effect.flatMap(resultItems));
-		orgId = (yield* selectOrganization(organizations, orgId)).id;
-		if (!(yield* restored.stillAuthenticated)) return yield* Effect.fail(Errors.notAuthenticated());
-		const reading = read(restored.client.org(orgId).payroll, orgId, validated.runId, (value) => {
-			command = value.command;
-		});
-		const detail = yield* input.kind === "wait" ? withWaiting(reading, {
-			...runtime,
-			label: "Observe Payroll run state"
-		}) : reading;
-		if (detail === null) return yield* missingRun();
-		if (!matches(detail, orgId, validated.runId)) return yield* Effect.fail(mismatch());
-		if (!(yield* restored.stillAuthenticated)) return yield* Effect.fail(Errors.notAuthenticated());
-		command = detail.command;
-		return {
-			detail,
-			client: restored.client
-		};
-	}).pipe(Effect.mapError((error) => {
-		const failure = classifyFailure(Cause.fail(orgId === null ? error : normalizeOrganizationReadFailure(error, orgId)), `org.payroll.${input.kind}`);
-		const recovery = known();
-		return new CliFailure({
-			...failure,
-			...recovery === null ? {} : {
-				details: {
-					...failure.details,
-					...recovery.details
-				},
-				message: `${failure.message}\n${recovery.lines}`
-			}
-		});
-	}), Effect.onInterrupt(() => {
-		const recovery = known();
-		return recovery === null ? Effect.void : writeStderr(runtime.mode === "json" ? `${JSON.stringify({
-			type: "payroll.run.recovery",
-			...recovery.details,
-			message: recovery.lines
-		})}\n` : `${recovery.lines}\n`).pipe(Effect.ignoreCause);
-	}), Effect.timeoutOption(validated.timeout * 1e3));
-	if (Option.isNone(observed)) {
-		const recovery = known();
-		return yield* new CliFailure({
-			code: "CLI_DEADLINE",
-			outcome: "failed",
-			exitCode: 5,
-			...recovery === null ? {} : { details: recovery.details },
-			message: `The CLI stopped waiting. Payroll settlement is not confirmed.${recovery === null ? "" : `\n${recovery.lines}`}`
-		});
-	}
-	const { detail } = observed.value;
-	return {
-		data: detail,
-		lines: [...runDetailLines(detail), ...detail.items.flatMap((item) => documentReferenceLines(item.payment))]
-	};
-});
-const saveRunDocuments = (config, client, detail) => Effect.forEach(detail.items, (item) => savePaymentDocuments(config, client, item.payment).pipe(Effect.map((output) => ({
-	itemIndex: item.itemIndex,
-	paymentId: item.payment.id,
-	...output
-}))));
-//#endregion
-//#region src/commands/org/subcommands/payroll/internal/run-documents.ts
-/** Save the authorized run's documents; a document failure is reported beside the run, never instead of it. */
-const readRunDocumentOutputs = (input) => {
-	const { config, scoped, client, orgId: selectedOrg, runId: completedRunId, key, within } = input;
-	const preview = { client };
-	return within(Effect.gen(function* () {
-		const detail = yield* Effect.tryPromise({
-			try: (signal) => scoped.payroll.getRun(completedRunId, { signal }),
-			catch: (cause) => Errors.unknown(cause)
-		}).pipe(Effect.flatMap(resultValue));
-		if (detail === null || detail.orgId !== selectedOrg || detail.run.id !== completedRunId || detail.command.requestKey !== key) return yield* Effect.fail(Errors.invalidInput("runId", "The Payroll document read did not match this run."));
-		return yield* saveRunDocuments(config, preview.client, detail);
-	})).pipe(Effect.map((documentOutputs) => ({
-		documentOutputs,
-		documentOutputError: void 0
-	})), Effect.catchCause((cause) => {
-		const failure = classifyFailure(cause);
-		return Effect.succeed({
-			documentOutputs: [],
-			documentOutputError: {
-				code: failure.code,
-				message: failure.message
-			}
-		});
-	}));
-};
-//#endregion
 //#region src/commands/org/subcommands/payroll/internal/run-preview.ts
 /** The recovery a Payroll run prints: resume the saved input, or read and wait for the run. */
 const runCommandRecovery = (input) => {
@@ -78931,11 +78864,10 @@ const runCommandRecovery = (input) => {
 		"run",
 		...common,
 		"--resume",
-		key,
-		"--confirm"
+		key
 	];
 	const flags = `--org ${shellArgument(orgId)} --email ${shellArgument(actorEmail)}`;
-	const resumeLine = `capxul org payroll run ${flags} --resume ${shellArgument(key)} --confirm`;
+	const resumeLine = `capxul org payroll run ${flags} --resume ${shellArgument(key)}`;
 	return {
 		details: {
 			organizationId: orgId,
@@ -79036,23 +78968,183 @@ const restoreTransactingActor = (config, opened, listOrganizations) => Effect.ge
 	};
 });
 //#endregion
+//#region src/platform/open-url.ts
+/** Open a link in the person's browser; false when this system has no opener or it fails. */
+const openUrl = (url) => Effect.promise(() => new Promise((resolve) => {
+	const command = platform === "darwin" ? "open" : platform === "linux" ? "xdg-open" : null;
+	if (command === null) return resolve(false);
+	const child = spawn(command, [url], {
+		detached: true,
+		stdio: "ignore"
+	});
+	child.once("error", () => resolve(false));
+	child.once("spawn", () => {
+		child.unref();
+		resolve(true);
+	});
+}));
+//#endregion
+//#region src/commands/payment/internal/approval.ts
+const scoped = (scope) => scope.organizationId === void 0 ? [] : ["--org", scope.organizationId];
+/** The command that follows an approval to its end. */
+const waitArgv = (approvalId, scope = {}) => [
+	"capxul",
+	"payment",
+	"wait",
+	approvalId,
+	...scoped(scope)
+];
+/** `--json`: the approval is open and nothing moves until a person approves it. */
+const awaitingApproval = (approval, scope = {}) => ({
+	status: "awaiting_approval",
+	approvalId: approval.approvalId,
+	approvalUrl: approval.url,
+	paymentIds: approval.operation.paymentIds,
+	expiresAt: approval.expiresAt,
+	next: { argv: [...waitArgv(approval.approvalId, scope), "--json"] }
+});
+/** What the person checks before they approve. Every operation is sponsored: no fee. */
+const previewLines = (approval, source) => {
+	const { from, to, amount } = approval.summary;
+	const payer = source.budget === void 0 ? from.label : `${from.label} · ${source.budget}`;
+	const left = source.left === void 0 ? "" : ` · ${shownAmount(source.left)} left`;
+	return [
+		`From     ${terminalText(payer)}${left}`,
+		`To       ${terminalText(to.label)}`,
+		`Amount   ${amount === null ? "nothing moves" : shownAmount(amount)}`,
+		"Fee      none"
+	];
+};
+const rejected = (approval) => new CliFailure({
+	code: "CANCELLED",
+	message: "Not sent: it was rejected on the approval page.",
+	exitCode: 130,
+	outcome: "cancelled",
+	details: { paymentIds: approval.operation.paymentIds }
+});
+const expired = (approval) => new CliFailure({
+	code: "WRONG_STATE",
+	message: "Not sent: the approval expired before anyone approved it.",
+	exitCode: 2,
+	outcome: "refused",
+	details: {
+		currentState: "expired",
+		paymentIds: approval.operation.paymentIds
+	}
+});
+const stillWaiting = (approvalId, scope) => new CliFailure({
+	code: "CLI_DEADLINE",
+	message: "Still waiting for the approval. Nothing is sent until a person approves it.",
+	next: waitArgv(approvalId, scope),
+	exitCode: 5,
+	outcome: "failed"
+});
+/** The Payments that did not settle, as a failure that names how to read them. */
+const unsettled = (outcome, scope) => {
+	const failed = outcome.payments.find((payment) => payment.status !== "settled");
+	return failed === void 0 ? void 0 : new CliFailure({
+		code: "TRANSACTION_FAILED",
+		message: `The payment did not settle: it is ${failed.status}.`,
+		next: [
+			"capxul",
+			"payment",
+			"get",
+			failed.id,
+			...scoped(scope)
+		],
+		exitCode: 5,
+		outcome: "failed",
+		details: { paymentIds: outcome.payments.map((payment) => payment.id) }
+	});
+};
+const read = (client, approvalId) => Effect.promise(() => client.approvals.get(approvalId)).pipe(Effect.flatMap(resultValue));
+/**
+* Follow an approval: `onSigned` once the person approves, then send it (the
+* page may already have) and wait for its Payments. A rejection is a
+* cancellation; an expired approval sent nothing.
+*/
+const followApproval = (client, approvalId, options) => Effect.gen(function* () {
+	let approval = yield* read(client, approvalId);
+	while (approval.state === "pending") {
+		yield* Effect.sleep("2 seconds");
+		approval = yield* read(client, approvalId);
+	}
+	if (approval.state === "rejected") return yield* rejected(approval);
+	if (approval.state === "expired") return yield* expired(approval);
+	yield* options.onSigned;
+	const outcome = yield* Effect.promise((signal) => client.approvals.wait(approvalId, {
+		signal,
+		...options.organizationId === void 0 ? {} : { organizationId: options.organizationId }
+	})).pipe(Effect.flatMap(resultValue));
+	if (outcome.approval.state === "rejected") return yield* rejected(outcome.approval);
+	if (outcome.approval.state === "expired") return yield* expired(outcome.approval);
+	const failure = unsettled(outcome, options);
+	if (failure !== void 0) return yield* failure;
+	return outcome;
+}).pipe(Effect.timeoutOption(options.deadlineMs), Effect.flatMap(Option.match({
+	onNone: () => Effect.fail(stillWaiting(approvalId, options)),
+	onSome: Effect.succeed
+})));
+/** `Paid 50.00 USDC to Rex · 0x5b2e…91c4`, and where the receipt is. */
+const paidLines = (outcome, scope = {}) => outcome.payments.flatMap((payment) => {
+	const hash = payment.receipt?.transactionHash;
+	return [`Paid ${shownAmount(payment.amount)} to ${terminalText(payment.counterpartyLabel)}${hash === void 0 ? "" : ` · ${hash.slice(0, 6)}…${hash.slice(-4)}`}`, `receipt: ${terminalText([
+		"capxul",
+		"payment",
+		"get",
+		payment.id,
+		...scoped(scope)
+	].join(" "))}`];
+});
+/** A progress line for a person, on stderr. */
+const progress = (line) => writeStderr(`${line}\n`);
+/** After the approval lapses, the time a send and its settlement may still take. */
+const SETTLE_MS = 12e4;
+/**
+* Hand a prepared approval over. An agent gets the link and the wait command
+* back at once. A person sees the preview, the approval page opens, and the
+* CLI follows it until the payment is confirmed: the page is the one and only
+* confirmation.
+*/
+const handOver = (client, approval, options) => Effect.gen(function* () {
+	const runtime = yield* CliRuntime;
+	if (runtime.mode === "json") return {
+		data: awaitingApproval(approval, options),
+		lines: []
+	};
+	for (const line of previewLines(approval, options)) yield* progress(line);
+	yield* progress("✓ Prepared");
+	const opened = runtime.tty && !runtime.ci ? yield* openUrl(approval.url) : false;
+	yield* progress(`… Approve in your browser${opened ? " (opened)" : ""}`);
+	yield* progress(`  ${approval.url}`);
+	const now = yield* Clock.currentTimeMillis;
+	const outcome = yield* followApproval(client, approval.approvalId, {
+		organizationId: options.organizationId,
+		deadlineMs: options.timeoutSeconds === void 0 ? Math.max(approval.expiresAt - now, 0) + SETTLE_MS : options.timeoutSeconds * 1e3,
+		onSigned: progress("✓ Signed")
+	}).pipe(Effect.onInterrupt(() => progress(`Nothing is sent until you approve. Follow it with: ${waitArgv(approval.approvalId, options).join(" ")}`).pipe(Effect.ignore)));
+	yield* progress("✓ Confirmed");
+	return {
+		data: outcome,
+		lines: paidLines(outcome, options)
+	};
+});
+//#endregion
 //#region src/commands/org/subcommands/payroll/subcommands/run/execute.ts
 const operation = CAPXUL_OPERATIONS.payroll.runs.authorize;
-const execute$31 = (config, input) => Effect.gen(function* () {
+const execute$30 = (config, input) => Effect.gen(function* () {
 	const prepared = yield* prepareRunInput(input);
-	const { timeout, email, resume, interactive, fresh, key } = prepared;
+	const { timeout, email, resume, fresh, key } = prepared;
 	let orgId = prepared.orgId;
 	const runtime = yield* CliRuntime;
 	let actorEmail = email;
-	let runId;
 	let saved = false;
-	let resolved;
 	const recovery = () => runCommandRecovery({
 		orgId,
 		actorEmail,
 		key,
-		runId,
-		canResume: saved && resolved === void 0
+		runId: void 0,
+		canResume: saved
 	});
 	const notice = (type) => {
 		const known = recovery();
@@ -79093,11 +79185,7 @@ const execute$31 = (config, input) => Effect.gen(function* () {
 			employees,
 			key
 		});
-		if (interactive) yield* confirmWrite({
-			lines,
-			question: "Authorize this complete Payroll run?"
-		});
-		else yield* writeStderr(runtime.mode === "json" ? `${JSON.stringify({
+		yield* writeStderr(runtime.mode === "json" ? `${JSON.stringify({
 			type: "org.payroll.preview",
 			organizationId: selectedOrg,
 			requestKey: key,
@@ -79107,88 +79195,22 @@ const execute$31 = (config, input) => Effect.gen(function* () {
 		yield* notice("org.payroll.requestKey");
 		const draft = stored ?? (yield* saveCommandDraft(config, selector, requested, preview.stillAuthenticated));
 		saved = true;
-		const frozen = JSON.stringify(yield* parseRunInput(draft.input));
-		const admitted = yield* parseRunInput(JSON.parse(frozen));
+		const admitted = yield* parseRunInput(draft.input);
 		yield* notice("org.payroll.saved");
-		const context = yield* Effect.context();
-		const run = Effect.runPromiseWith(context);
-		const completed = yield* within(Effect.gen(function* () {
-			const signal = yield* Effect.abortSignal;
-			let keyPersisted = false;
-			let writeLifetime;
-			const checkActor = Effect.gen(function* () {
-				const cancelled = cancelledWrite(operation, signal);
-				if (cancelled !== null) return yield* Effect.fail(cancelled);
-				if (!(yield* preview.stillAuthenticated) || writeLifetime !== void 0 && !(yield* writeLifetime)) return yield* Effect.fail(Errors.cancelled({ operation }));
-			});
-			const checkDraft = Effect.gen(function* () {
-				yield* checkActor;
-				const current = yield* loadCommandDraft(config, selector, preview.stillAuthenticated);
-				if (JSON.stringify(yield* parseRunInput(current.input)) !== frozen) return yield* Effect.fail(Errors.invalidInput("requestKey", "The saved Payroll input changed."));
-				yield* checkActor;
-			});
-			yield* checkActor;
-			const signer = yield* organizationWriteSigner(config, opened, run, async () => {
-				await run(checkDraft);
-				if (!keyPersisted || writeLifetime === void 0) throw Errors.invalidInput("requestKey", "The Payroll key was not durably confirmed.");
-			});
-			const write = yield* restoreWriteClient(config, opened, signer, preview.session, () => Errors.cancelled({ operation }));
-			writeLifetime = write.stillAuthenticated;
-			yield* checkActor;
-			const result = yield* Effect.promise((operationSignal) => write.client.org(selectedOrg).payroll.authorizeRun({
+		const approval = yield* within(withWaiting(Effect.promise((signal) => preview.client.approvals.prepare({
+			organizationId: selectedOrg,
+			payrollRun: {
 				...admitted,
 				requestKey: key
-			}, {
-				signal: operationSignal,
-				onRequestKey: async (callbackKey) => {
-					if (callbackKey !== key) throw Errors.invalidInput("requestKey", "The Payroll callback key changed.");
-					await run(checkActor);
-					await run(saveCommandDraft(config, selector, JSON.parse(frozen), preview.stillAuthenticated));
-					await run(checkDraft);
-					await run(notice("org.payroll.requestKey"));
-					await run(checkActor);
-					keyPersisted = true;
-				},
-				onResolved: async (outcome) => {
-					resolved = outcome;
-					await run(writeStderr(runtime.mode === "json" ? `${JSON.stringify({
-						type: "org.payroll.resolved",
-						organizationId: selectedOrg,
-						requestKey: key,
-						resolution: outcome
-					})}\n` : `Original Payroll command: ${outcome}. The current SDK result remains unchanged.\n`));
-				}
-			}));
-			const details = result.ok ? void 0 : result.error.details;
-			if (details?.method === operation && details.requestKey === key && typeof details.runId === "string" && isPayrollRunId(details.runId)) runId = details.runId;
-			return yield* resultValue(result);
-		}).pipe(Effect.scoped));
-		if (!isPayrollRunId(completed.id)) return yield* Effect.fail(Errors.invalidInput("runId", "The Payroll result has an invalid run ID."));
-		const completedRunId = completed.id;
-		runId = completedRunId;
-		const documents = yield* readRunDocumentOutputs({
-			config,
-			scoped,
-			client: preview.client,
-			orgId: selectedOrg,
-			runId: completedRunId,
-			key,
-			within
+			}
+		}, { signal })).pipe(Effect.flatMap(resultValue)), {
+			...runtime,
+			label: "Preparing the payroll run"
+		}));
+		return yield* handOver(preview.client, approval, {
+			organizationId: selectedOrg,
+			budget: budget.label
 		});
-		return {
-			data: {
-				run: completed,
-				requestKey: key,
-				...documents
-			},
-			lines: [
-				`Run: ${terminalText(completedRunId)} (${terminalText(completed.status)})`,
-				"Authorization or submission does not prove settlement.",
-				...recovery().lines,
-				...documents.documentOutputs.flatMap(documentOutputLines),
-				...documents.documentOutputError === void 0 ? [] : [`Document output failed: ${terminalText(documents.documentOutputError.message)}`]
-			]
-		};
 	}).pipe(Effect.mapError((error) => {
 		const scoped = orgId === null ? error : normalizeOrganizationReadFailure(error, orgId);
 		const failure = classifyFailure(Cause.fail(scoped), operation);
@@ -79210,21 +79232,185 @@ const command$27 = Command.make("run", {
 	input: sourceFlag$1,
 	requestKey: requestKeyFlag$1,
 	resume: resumeFlag,
-	confirm: confirmFlag$1,
 	timeout: timeoutFlag$1
-}, ({ email, input, requestKey, resume, confirm, timeout }) => dispatch$1("run", (config, orgs) => execute$31(config, {
+}, ({ email, input, requestKey, resume, timeout }) => dispatch$1("run", (config, orgs) => execute$30(config, {
 	kind: "run",
 	orgs,
 	email: Option.getOrUndefined(email),
 	sources: input,
 	requestKeys: requestKey,
 	resumes: resume,
-	confirm,
 	timeoutSeconds: timeout
-}))).pipe(annotate$1("run"), Command.withDescription("Authorize one exact Payroll run or resume its saved input"));
+}))).pipe(annotate$1("run"), Command.withDescription("run payroll from a Budget; you approve it in the browser"));
+//#endregion
+//#region src/commands/org/subcommands/payroll/internal/run-lookup.ts
+const isPayrollRunId = (value) => /^payroll_run_[0-9a-f]{64}$/u.test(value);
+const exactRunId = (value) => isPayrollRunId(value) ? Effect.succeed(value) : Effect.fail(inputRequired("Provide the Payroll run ID: payroll_run_ followed by a 64-character digest."));
+const validateRunInput = (input) => Effect.gen(function* () {
+	const timeout = yield* readWriteTimeout(input.timeoutSeconds);
+	const email = input.email === void 0 ? void 0 : yield* readEmail(input.email);
+	if (input.orgs.length > 1) return yield* inputRequired("Provide one exact --org ID.");
+	const orgId = yield* explicitOrganization(input.orgs);
+	if (input.runIds.length > 1) return yield* inputRequired("Provide one exact Payroll run ID.");
+	let runId = input.runIds[0];
+	if (runId !== void 0) yield* exactRunId(runId);
+	const runtime = yield* CliRuntime;
+	if (!runtime.tty || runtime.ci || runtime.mode === "json") {
+		if (orgId === null) return yield* inputRequired("Provide one exact --org ID.");
+		if (runId === void 0) return yield* inputRequired("Provide the Payroll run ID.");
+	}
+	if (runId === void 0) runId = yield* Prompt.String({ message: "Payroll run ID" });
+	return {
+		orgId,
+		runId: yield* exactRunId(runId),
+		timeout,
+		email
+	};
+});
+const missingRun = () => new CliFailure({
+	code: "INVALID_INPUT",
+	outcome: "refused",
+	exitCode: 2,
+	message: "The Payroll run was not found or is unavailable to this session. Check --org and the Payroll run ID."
+});
+const matches = (detail, orgId, runId) => detail.orgId === orgId && detail.run.id === runId;
+const mismatch = () => Errors.invalidInput("runId", "Payroll run response scope does not match");
+const finishedRun = (detail) => detail.items.length > 0 && detail.items.every((item) => paymentPhase(item.payment.status).outcome === "good") || detail.items.some((item) => {
+	const phase = paymentPhase(item.payment.status);
+	return phase.terminal && phase.outcome !== "good" || phase.needsAction || item.payment.execution?.retryRequired === true;
+}) || [
+	"failed",
+	"mismatch",
+	"unresolved"
+].includes(detail.command.verificationState) || detail.command.completionOutcome === "failed" || detail.command.terminalOutcome !== void 0 && detail.command.terminalOutcome !== "settled";
+//#endregion
+//#region src/commands/org/subcommands/payroll/internal/run-lines.ts
+const runRecovery = (orgId, runId, email, command) => {
+	const args = [
+		"capxul",
+		"org",
+		"payroll",
+		"get",
+		runId,
+		"--org",
+		orgId,
+		...email === void 0 ? [] : ["--email", email]
+	];
+	return {
+		lines: `${command === void 0 ? "" : `Request key: ${terminalText(command.requestKey)}\nCommand: ${terminalText(command.commandId)}\n`}Read: ${args.map(shellArgument).join(" ")}\nWait: ${[
+			...args.slice(0, 3),
+			"wait",
+			...args.slice(4)
+		].map(shellArgument).join(" ")}`,
+		details: {
+			organizationId: orgId,
+			runId,
+			...command === void 0 ? {} : {
+				requestKey: command.requestKey,
+				commandId: command.commandId
+			},
+			recovery: {
+				kind: "read",
+				argv: args
+			}
+		}
+	};
+};
+const runDetailLines = (detail) => [
+	`Payroll run ${terminalText(detail.run.id)}: recorded status ${detail.run.status}`,
+	`  Organization: ${terminalText(detail.orgId)}`,
+	`  Period: ${detail.run.periodStart} to ${detail.run.periodEnd}`,
+	`  Total: ${terminalText(formatAssetAmount(detail.run.total))}; recipients: ${detail.run.recipientCount}`,
+	`  Request key: ${terminalText(detail.command.requestKey)}`,
+	`  Command: ${terminalText(detail.command.commandId)}; state ${detail.command.state}; verification ${detail.command.verificationState}`,
+	...detail.command.completionOutcome === void 0 ? [] : [`  Recorded completion: ${detail.command.completionOutcome}`],
+	...detail.command.terminalOutcome === void 0 ? [] : [`  Recorded terminal outcome: ${detail.command.terminalOutcome}`],
+	...detail.command.userOpHash === void 0 ? [] : [`  Submitted user operation: ${terminalText(detail.command.userOpHash)}`],
+	`  Created: ${detail.createdAt}; updated: ${detail.updatedAt}${detail.settledAt === void 0 ? "" : `; recorded settled: ${detail.settledAt}`}`,
+	"Original ordered Payments",
+	...detail.items.flatMap((item) => [
+		`  Item ${item.itemIndex}: employee ${terminalText(item.employeeRef)}; engagement ${terminalText(item.engagementEdgeId)}`,
+		`    Gross: ${terminalText(item.gross)} raw units; net: ${terminalText(item.net)} raw units`,
+		...item.adjustments.map((adjustment) => `    Adjustment: ${terminalText(adjustment.label)}; ${terminalText(adjustment.amount)} raw units`),
+		`    Quantity: ${terminalText(item.amount.value)}; asset: ${terminalText(item.amount.asset)}`,
+		`    Payment ${terminalText(item.payment.id)}: ${item.payment.status}`,
+		`    Counterparty: ${terminalText(item.payment.counterpartyLabel)}`,
+		`    Receipt: ${item.payment.receipt === null ? "none recorded" : `${terminalText(item.payment.receipt.transactionHash)} (chain ${item.payment.receipt.chainId})`}`,
+		...item.payment.execution === void 0 ? [] : [`    Execution: ${item.payment.execution.status}${item.payment.execution.retryRequired ? "; action required" : ""}`],
+		...item.payment.recipient.kind === "party" ? [`    Party: ${terminalText(item.payment.recipient.partyId)}; label: ${terminalText(item.payment.recipient.label)}`] : [],
+		...item.payment.documentState === void 0 ? [] : [`    Documents: ${item.payment.documentState}`],
+		...item.payment.documents.map((document) => `    Document: ${terminalText(document.documentHash)}; content: ${terminalText(document.contentHash)}; kind: ${document.kind}`)
+	])
+];
+//#endregion
+//#region src/commands/org/subcommands/payroll/internal/run-reads.ts
+const readValidatedRun = (config, input, validated, read) => Effect.gen(function* () {
+	let orgId = validated.orgId;
+	let email = validated.email;
+	let command;
+	const runtime = yield* CliRuntime;
+	const known = () => orgId === null ? null : runRecovery(orgId, validated.runId, email, command);
+	const observed = yield* Effect.gen(function* () {
+		const restored = yield* restoreAuthenticatedClient(config, email, { requirement: "none" });
+		email = restored.session.email;
+		const organizations = yield* Effect.promise((signal) => restored.client.orgs({ signal })).pipe(Effect.flatMap(resultItems));
+		orgId = (yield* selectOrganization(organizations, orgId)).id;
+		if (!(yield* restored.stillAuthenticated)) return yield* Effect.fail(Errors.notAuthenticated());
+		const reading = read(restored.client.org(orgId).payroll, orgId, validated.runId, (value) => {
+			command = value.command;
+		});
+		const detail = yield* input.kind === "wait" ? withWaiting(reading, {
+			...runtime,
+			label: "Observe Payroll run state"
+		}) : reading;
+		if (detail === null) return yield* missingRun();
+		if (!matches(detail, orgId, validated.runId)) return yield* Effect.fail(mismatch());
+		if (!(yield* restored.stillAuthenticated)) return yield* Effect.fail(Errors.notAuthenticated());
+		command = detail.command;
+		return {
+			detail,
+			client: restored.client
+		};
+	}).pipe(Effect.mapError((error) => {
+		const failure = classifyFailure(Cause.fail(orgId === null ? error : normalizeOrganizationReadFailure(error, orgId)), `org.payroll.${input.kind}`);
+		const recovery = known();
+		return new CliFailure({
+			...failure,
+			...recovery === null ? {} : {
+				details: {
+					...failure.details,
+					...recovery.details
+				},
+				message: `${failure.message}\n${recovery.lines}`
+			}
+		});
+	}), Effect.onInterrupt(() => {
+		const recovery = known();
+		return recovery === null ? Effect.void : writeStderr(runtime.mode === "json" ? `${JSON.stringify({
+			type: "payroll.run.recovery",
+			...recovery.details,
+			message: recovery.lines
+		})}\n` : `${recovery.lines}\n`).pipe(Effect.ignoreCause);
+	}), Effect.timeoutOption(validated.timeout * 1e3));
+	if (Option.isNone(observed)) {
+		const recovery = known();
+		return yield* new CliFailure({
+			code: "CLI_DEADLINE",
+			outcome: "failed",
+			exitCode: 5,
+			...recovery === null ? {} : { details: recovery.details },
+			message: `The CLI stopped waiting. Payroll settlement is not confirmed.${recovery === null ? "" : `\n${recovery.lines}`}`
+		});
+	}
+	const { detail } = observed.value;
+	return {
+		data: detail,
+		lines: [...runDetailLines(detail), ...detail.items.flatMap((item) => documentReferenceLines(item.payment))]
+	};
+});
 //#endregion
 //#region src/commands/org/subcommands/payroll/subcommands/get/execute.ts
-const execute$30 = (config, input) => Effect.gen(function* () {
+const execute$29 = (config, input) => Effect.gen(function* () {
 	const validated = yield* validateRunInput(input);
 	return yield* readValidatedRun(config, input, validated, (methods, _org, runId) => Effect.promise((signal) => methods.getRun(runId, { signal })).pipe(Effect.flatMap(resultValue)));
 });
@@ -79234,7 +79420,7 @@ const command$26 = Command.make("get", {
 	runId: runIdArgument,
 	email: emailFlag$1,
 	timeout: timeoutFlag$1
-}, ({ runId, email, timeout }) => dispatch$1("get", (config, orgs) => execute$30(config, {
+}, ({ runId, email, timeout }) => dispatch$1("get", (config, orgs) => execute$29(config, {
 	kind: "get",
 	orgs,
 	runIds: runId,
@@ -79306,7 +79492,7 @@ const observeRun = (register, orgId, runId, seen) => Effect.suspend(() => {
 }).pipe(Effect.flatMap(resultValue));
 //#endregion
 //#region src/commands/org/subcommands/payroll/subcommands/wait/execute.ts
-const execute$29 = (config, input) => Effect.gen(function* () {
+const execute$28 = (config, input) => Effect.gen(function* () {
 	const validated = yield* validateRunInput(input);
 	return yield* readValidatedRun(config, input, validated, (methods, orgId, runId, seen) => observeRun((listener, signal) => methods.subscribeRun(runId, listener, { signal }), orgId, runId, seen));
 });
@@ -79316,7 +79502,7 @@ const command$25 = Command.make("wait", {
 	runId: runIdArgument,
 	email: emailFlag$1,
 	timeout: timeoutFlag$1
-}, ({ runId, email, timeout }) => dispatch$1("wait", (config, orgs) => execute$29(config, {
+}, ({ runId, email, timeout }) => dispatch$1("wait", (config, orgs) => execute$28(config, {
 	kind: "wait",
 	orgs,
 	runIds: runId,
@@ -79477,7 +79663,7 @@ const makeOrganizationProgress = (mode, run, persist) => {
 * signature, and returns the typed wait failure, while the durable backend lane
 * keeps running and stays resumable by the same create or by `org retry`.
 */
-const execute$28 = (config, input) => Effect.gen(function* () {
+const execute$27 = (config, input) => Effect.gen(function* () {
 	const operation = CAPXUL_OPERATIONS.org.create;
 	const draft = yield* readOrganizationDraft(input);
 	const timeout = yield* readWriteTimeout(input.timeoutSeconds);
@@ -79627,9 +79813,9 @@ const command$24 = Command.make("create", {
 	bio: Flag.String("bio").pipe(Flag.optional),
 	size: Flag.String("size").pipe(Flag.optional),
 	email: emailFlag$9,
-	confirm: confirmFlag$7,
+	confirm: confirmFlag$6,
 	timeoutSeconds: timeoutFlag$4
-}, ({ email, name, handle, country, bio, size, confirm, timeoutSeconds }) => dispatch$8(CAPXUL_OPERATIONS.org.create, (config) => execute$28(config, {
+}, ({ email, name, handle, country, bio, size, confirm, timeoutSeconds }) => dispatch$8(CAPXUL_OPERATIONS.org.create, (config) => execute$27(config, {
 	email: Option.getOrUndefined(email),
 	name,
 	handle,
@@ -79649,7 +79835,7 @@ const perform$3 = (organizations, unfinishedSetups) => ({
 	},
 	lines: organizationListLines(organizations, unfinishedSetups)
 });
-const execute$27 = (config, input) => readOrganization(config, "list", input, {
+const execute$26 = (config, input) => readOrganization(config, "list", input, {
 	kind: "list",
 	listOrganizations: (client, signal) => client.orgs({ signal }),
 	readSetupPage: (client, pageInput, signal) => client.onboarding.listOrganizationSetups(pageInput, { signal }),
@@ -79657,7 +79843,7 @@ const execute$27 = (config, input) => readOrganization(config, "list", input, {
 });
 //#endregion
 //#region src/commands/org/subcommands/list/command.ts
-const command$23 = Command.make("list", { email: emailFlag$9 }, ({ email }) => read$1(CAPXUL_OPERATIONS.org.list, { email }, execute$27)).pipe(Command.annotate(CliCommandMetadata, metadata$18(CAPXUL_OPERATIONS.org.list)), Command.withDescription("List current Organization access"));
+const command$23 = Command.make("list", { email: emailFlag$9 }, ({ email }) => read$1(CAPXUL_OPERATIONS.org.list, { email }, execute$26)).pipe(Command.annotate(CliCommandMetadata, metadata$18(CAPXUL_OPERATIONS.org.list)), Command.withDescription("List current Organization access"));
 //#endregion
 //#region src/commands/org/subcommands/me/execute.ts
 const perform$2 = (scoped, organizationId, organization) => Effect.gen(function* () {
@@ -79670,13 +79856,13 @@ const perform$2 = (scoped, organizationId, organization) => Effect.gen(function*
 		label: "Organization membership"
 	});
 });
-const execute$26 = (config, input) => readOrganization(config, "me", input, {
+const execute$25 = (config, input) => readOrganization(config, "me", input, {
 	kind: "scoped",
 	run: ({ scoped, organizationId, organization }) => perform$2(scoped(), organizationId, organization)
 });
 //#endregion
 //#region src/commands/org/subcommands/me/command.ts
-const command$22 = Command.make("me", scoped$1, ({ email }) => read$1(CAPXUL_OPERATIONS.org.me, { email }, execute$26)).pipe(Command.annotate(CliCommandMetadata, metadata$18(CAPXUL_OPERATIONS.org.me)), Command.withDescription("Read your standing in the Organization"));
+const command$22 = Command.make("me", scoped$1, ({ email }) => read$1(CAPXUL_OPERATIONS.org.me, { email }, execute$25)).pipe(Command.annotate(CliCommandMetadata, metadata$18(CAPXUL_OPERATIONS.org.me)), Command.withDescription("Read your standing in the Organization"));
 //#endregion
 //#region src/commands/org/subcommands/member/get/execute.ts
 const perform$1 = (scoped, organizationId, organization, selectedAccountId) => Effect.gen(function* () {
@@ -79715,7 +79901,7 @@ const perform$1 = (scoped, organizationId, organization, selectedAccountId) => E
 		]
 	};
 });
-const execute$25 = (config, input) => readOrganization(config, "member.get", input, {
+const execute$24 = (config, input) => readOrganization(config, "member.get", input, {
 	kind: "scoped",
 	run: ({ scoped, organizationId, organization, accountId }) => perform$1(scoped(), organizationId, organization, accountId)
 });
@@ -79724,7 +79910,7 @@ const execute$25 = (config, input) => readOrganization(config, "member.get", inp
 const command$21 = Command.make("get", {
 	...scoped$1,
 	accountId: Argument.String("id").pipe(Argument.withDescription("The member's Account ID"), Argument.optional)
-}, ({ email, accountId }) => read$1("org.member.get", { email }, execute$25, Option.isSome(accountId) ? { accountId: accountId.value } : {})).pipe(Command.annotate(CliCommandMetadata, metadata$18("org.member.get")), Command.withDescription("Read one member by exact Account ID"));
+}, ({ email, accountId }) => read$1("org.member.get", { email }, execute$24, Option.isSome(accountId) ? { accountId: accountId.value } : {})).pipe(Command.annotate(CliCommandMetadata, metadata$18("org.member.get")), Command.withDescription("Read one member by exact Account ID"));
 //#endregion
 //#region src/commands/org/internal/members.ts
 const perform = (scoped, organizationId, organization) => Effect.gen(function* () {
@@ -79751,10 +79937,10 @@ const readOrganizationMembers = (config, command, input) => readOrganization(con
 });
 //#endregion
 //#region src/commands/org/subcommands/member/list/execute.ts
-const execute$24 = (config, input) => readOrganizationMembers(config, "member.list", input);
+const execute$23 = (config, input) => readOrganizationMembers(config, "member.list", input);
 //#endregion
 //#region src/commands/org/subcommands/member/list/command.ts
-const command$20 = Command.make("list", scoped$1, ({ email }) => read$1("org.member.list", { email }, execute$24)).pipe(Command.annotate(CliCommandMetadata, metadata$18("org.member.list")), Command.withDescription("List members, including pending members"));
+const command$20 = Command.make("list", scoped$1, ({ email }) => read$1("org.member.list", { email }, execute$23)).pipe(Command.annotate(CliCommandMetadata, metadata$18("org.member.list")), Command.withDescription("List members, including pending members"));
 //#endregion
 //#region src/commands/org/subcommands/member/command.ts
 const command$19 = Command.make("member").pipe(Command.annotate(CliCommandMetadata, metadata$18("org.member")), Command.withDescription("List, read, and invite Organization members"), Command.withSubcommands([
@@ -79770,7 +79956,7 @@ const command$19 = Command.make("member").pipe(Command.annotate(CliCommandMetada
 * ever created. One deadline covers the retry call and its settlement, exactly as
 * it does for create.
 */
-const execute$23 = (config, input) => Effect.gen(function* () {
+const execute$22 = (config, input) => Effect.gen(function* () {
 	const operation = CAPXUL_OPERATIONS.org.retry;
 	const timeout = yield* readWriteTimeout(input.timeoutSeconds);
 	const email = input.email === void 0 ? void 0 : yield* readEmail(input.email);
@@ -79850,9 +80036,9 @@ const execute$23 = (config, input) => Effect.gen(function* () {
 //#region src/commands/org/subcommands/retry/command.ts
 const command$18 = Command.make("retry", {
 	email: emailFlag$9,
-	confirm: confirmFlag$7,
+	confirm: confirmFlag$6,
 	timeoutSeconds: timeoutFlag$4
-}, ({ email, confirm, timeoutSeconds }) => dispatch$8(CAPXUL_OPERATIONS.org.retry, (config, orgs) => execute$23(config, {
+}, ({ email, confirm, timeoutSeconds }) => dispatch$8(CAPXUL_OPERATIONS.org.retry, (config, orgs) => execute$22(config, {
 	email: Option.getOrUndefined(email),
 	orgs,
 	confirm,
@@ -79882,7 +80068,7 @@ const settleOrganizationSetup = (read, input) => Effect.gen(function* () {
 });
 //#endregion
 //#region src/commands/org/subcommands/show/execute.ts
-const execute$22 = (config, input) => readOrganization(config, "status", input, {
+const execute$21 = (config, input) => readOrganization(config, "status", input, {
 	kind: "scoped",
 	run: ({ client, scoped, organizationId, organization, session, timeout }) => settleOrganizationSetup((observed) => Effect.gen(function* () {
 		const lifecycle = yield* Effect.promise((signal) => scoped().setup.get({ signal })).pipe(Effect.flatMap(resultValue));
@@ -79900,7 +80086,7 @@ const execute$22 = (config, input) => readOrganization(config, "status", input,
 });
 //#endregion
 //#region src/commands/org/subcommands/show/command.ts
-const command$17 = Command.make("show", scoped$1, ({ email }) => read$1("org.show", { email }, execute$22)).pipe(Command.annotate(CliCommandMetadata, metadata$18("org.show")), Command.withDescription("Read the exact Organization lifecycle"));
+const command$17 = Command.make("show", scoped$1, ({ email }) => read$1("org.show", { email }, execute$21)).pipe(Command.annotate(CliCommandMetadata, metadata$18("org.show")), Command.withDescription("Read the exact Organization lifecycle"));
 //#endregion
 //#region src/commands/org/subcommands/wait/execute.ts
 /** Follow the setup subscription to a settled state, printing each change once. */
@@ -79928,7 +80114,7 @@ const follow = (client, scoped, organizationId, email, observed) => Effect.gen(f
 		label: "Organization setup"
 	});
 });
-const execute$21 = (config, input) => readOrganization(config, "wait", input, {
+const execute$20 = (config, input) => readOrganization(config, "wait", input, {
 	kind: "scoped",
 	run: ({ client, scoped, organizationId, organization, session, timeout }) => settleOrganizationSetup((observed) => follow(client, scoped(), organizationId, session.email, observed), {
 		organizationId,
@@ -79942,7 +80128,7 @@ const execute$21 = (config, input) => readOrganization(config, "wait", input, {
 const command$16 = Command.make("wait", {
 	...scoped$1,
 	timeoutSeconds: timeoutFlag$4
-}, ({ email, timeoutSeconds }) => read$1("org.wait", { email }, execute$21, { timeoutSeconds })).pipe(Command.annotate(CliCommandMetadata, metadata$18("org.wait")), Command.withDescription("Poll the lifecycle until ready or failed; never retry setup"));
+}, ({ email, timeoutSeconds }) => read$1("org.wait", { email }, execute$20, { timeoutSeconds })).pipe(Command.annotate(CliCommandMetadata, metadata$18("org.wait")), Command.withDescription("Poll the lifecycle until ready or failed; never retry setup"));
 //#endregion
 //#region src/commands/org/command.ts
 /** Organization-only commands. They act as `--org`, `CAPXUL_ORG`, or the Organization `use org` saved. */
@@ -79965,7 +80151,6 @@ const paymentIdArgument = Argument.String("id").pipe(Argument.withDescription("T
 const timeoutFlag = Flag.Int("timeout-seconds").pipe(Flag.withDefault(120));
 const sourceFlag = Flag.String("input").pipe(Flag.withDescription("the SDK payment JSON, from a file or - for stdin"), Flag.optional);
 const requestKeyFlag = Flag.String("request-key").pipe(Flag.withDescription("a key that makes repeating the same payment safe"), Flag.optional);
-const confirmFlag = Flag.Boolean("confirm").pipe(Flag.withDefault(false));
 const names = {
 	root: "payment",
 	list: "payment.list",
@@ -80059,7 +80244,7 @@ const scopedFailure = (error, organizationId, kind) => {
 };
 //#endregion
 //#region src/commands/org/subcommands/payment/subcommands/list/execute.ts
-const execute$20 = (config, input) => Effect.gen(function* () {
+const execute$19 = (config, input) => Effect.gen(function* () {
 	const email = input.email === void 0 ? void 0 : yield* readEmail(input.email);
 	const organizationId = yield* readOrganizationId(input.orgs);
 	const named = flagValue((yield* CliRuntime).args ?? [], "org");
@@ -80074,7 +80259,7 @@ const execute$20 = (config, input) => Effect.gen(function* () {
 });
 //#endregion
 //#region src/commands/payment/subcommands/list/execute.ts
-const execute$19 = (config, email) => Effect.gen(function* () {
+const execute$18 = (config, email) => Effect.gen(function* () {
 	const { client, session } = yield* restoreAuthenticatedClient(config, email);
 	const page = yield* Effect.promise((signal) => client.payments.list({ signal })).pipe(Effect.flatMap(resultValue), Effect.mapError((error) => isCapxulError(error) ? accountReadFailure(error, session.email) : error));
 	return {
@@ -80085,8 +80270,8 @@ const execute$19 = (config, email) => Effect.gen(function* () {
 //#endregion
 //#region src/commands/payment/subcommands/list/command.ts
 const command$15 = Command.make("list", { email: emailFlag }, ({ email }) => dispatch("list", {
-	personal: (config) => execute$19(config, Option.getOrUndefined(email)),
-	organization: (config, orgId) => execute$20(config, {
+	personal: (config) => execute$18(config, Option.getOrUndefined(email)),
+	organization: (config, orgId) => execute$19(config, {
 		kind: "list",
 		orgs: [orgId],
 		email: Option.getOrUndefined(email)
@@ -80094,7 +80279,7 @@ const command$15 = Command.make("list", { email: emailFlag }, ({ email }) => dis
 })).pipe(annotate("list"), Command.withDescription("Payments sent and received"));
 //#endregion
 //#region src/commands/org/subcommands/payment/subcommands/get/execute.ts
-const execute$18 = (config, input) => Effect.gen(function* () {
+const execute$17 = (config, input) => Effect.gen(function* () {
 	const paymentId = yield* readPaymentId(input.paymentId);
 	const email = input.email === void 0 ? void 0 : yield* readEmail(input.email);
 	const organizationId = yield* readOrganizationId(input.orgs);
@@ -80117,7 +80302,7 @@ const execute$18 = (config, input) => Effect.gen(function* () {
 });
 //#endregion
 //#region src/commands/payment/subcommands/get/execute.ts
-const execute$17 = (config, paymentId, email) => Effect.gen(function* () {
+const execute$16 = (config, paymentId, email) => Effect.gen(function* () {
 	const id = yield* readPaymentId(paymentId);
 	const { client, session } = yield* restoreAuthenticatedClient(config, email);
 	const payment = yield* Effect.promise((signal) => client.payments.get(id, { signal })).pipe(Effect.flatMap(resultValue), Effect.mapError((error) => isCapxulError(error) ? accountReadFailure(error, session.email) : error));
@@ -80139,8 +80324,8 @@ const command$14 = Command.make("get", {
 	paymentId: paymentIdArgument,
 	email: emailFlag
 }, ({ paymentId, email }) => dispatch("get", {
-	personal: (config) => execute$17(config, paymentId, Option.getOrUndefined(email)),
-	organization: (config, orgId) => execute$18(config, {
+	personal: (config) => execute$16(config, paymentId, Option.getOrUndefined(email)),
+	organization: (config, orgId) => execute$17(config, {
 		kind: "get",
 		orgs: [orgId],
 		paymentId,
@@ -80286,7 +80471,7 @@ const waitForPayment = (config, input, register, organizationId) => Effect.gen(f
 });
 //#endregion
 //#region src/commands/org/subcommands/payment/subcommands/wait/execute.ts
-const execute$16 = (config, input) => Effect.gen(function* () {
+const execute$15 = (config, input) => Effect.gen(function* () {
 	const paymentId = yield* readPaymentId(input.paymentId);
 	const timeoutSeconds = yield* readWriteTimeout(input.timeoutSeconds);
 	const email = input.email === void 0 ? void 0 : yield* readEmail(input.email);
@@ -80299,168 +80484,6 @@ const execute$16 = (config, input) => Effect.gen(function* () {
 	}, (client, selectedPaymentId, listener, signal) => client.org(organizationId).payments.subscribe(selectedPaymentId, listener, { signal }), organizationId);
 });
 //#endregion
-//#region src/platform/open-url.ts
-/** Open a link in the person's browser; false when this system has no opener or it fails. */
-const openUrl = (url) => Effect.promise(() => new Promise((resolve) => {
-	const command = platform === "darwin" ? "open" : platform === "linux" ? "xdg-open" : null;
-	if (command === null) return resolve(false);
-	const child = spawn(command, [url], {
-		detached: true,
-		stdio: "ignore"
-	});
-	child.once("error", () => resolve(false));
-	child.once("spawn", () => {
-		child.unref();
-		resolve(true);
-	});
-}));
-//#endregion
-//#region src/commands/payment/internal/approval.ts
-const scoped = (scope) => scope.organizationId === void 0 ? [] : ["--org", scope.organizationId];
-/** The command that follows an approval to its end. */
-const waitArgv = (approvalId, scope = {}) => [
-	"capxul",
-	"payment",
-	"wait",
-	approvalId,
-	...scoped(scope)
-];
-/** `--json`: the approval is open and nothing moves until a person approves it. */
-const awaitingApproval = (approval, scope = {}) => ({
-	status: "awaiting_approval",
-	approvalId: approval.approvalId,
-	approvalUrl: approval.url,
-	paymentIds: approval.operation.paymentIds,
-	expiresAt: approval.expiresAt,
-	next: { argv: [...waitArgv(approval.approvalId, scope), "--json"] }
-});
-/** What the person checks before they approve. Every operation is sponsored: no fee. */
-const previewLines = (approval, source) => {
-	const { from, to, amount } = approval.summary;
-	const payer = source.budget === void 0 ? from.label : `${from.label} · ${source.budget}`;
-	const left = source.left === void 0 ? "" : ` · ${shownAmount(source.left)} left`;
-	return [
-		`From     ${terminalText(payer)}${left}`,
-		`To       ${terminalText(to.label)}`,
-		`Amount   ${amount === null ? "nothing moves" : shownAmount(amount)}`,
-		"Fee      none"
-	];
-};
-const rejected = (approval) => new CliFailure({
-	code: "CANCELLED",
-	message: "Not sent: it was rejected on the approval page.",
-	exitCode: 130,
-	outcome: "cancelled",
-	details: { paymentIds: approval.operation.paymentIds }
-});
-const expired = (approval) => new CliFailure({
-	code: "WRONG_STATE",
-	message: "Not sent: the approval expired before anyone approved it.",
-	exitCode: 2,
-	outcome: "refused",
-	details: {
-		currentState: "expired",
-		paymentIds: approval.operation.paymentIds
-	}
-});
-const stillWaiting = (approvalId, scope) => new CliFailure({
-	code: "CLI_DEADLINE",
-	message: "Still waiting for the approval. Nothing is sent until a person approves it.",
-	next: waitArgv(approvalId, scope),
-	exitCode: 5,
-	outcome: "failed"
-});
-/** The Payments that did not settle, as a failure that names how to read them. */
-const unsettled = (outcome, scope) => {
-	const failed = outcome.payments.find((payment) => payment.status !== "settled");
-	return failed === void 0 ? void 0 : new CliFailure({
-		code: "TRANSACTION_FAILED",
-		message: `The payment did not settle: it is ${failed.status}.`,
-		next: [
-			"capxul",
-			"payment",
-			"get",
-			failed.id,
-			...scoped(scope)
-		],
-		exitCode: 5,
-		outcome: "failed",
-		details: { paymentIds: outcome.payments.map((payment) => payment.id) }
-	});
-};
-const read = (client, approvalId) => Effect.promise(() => client.approvals.get(approvalId)).pipe(Effect.flatMap(resultValue));
-/**
-* Follow an approval: `onSigned` once the person approves, then send it (the
-* page may already have) and wait for its Payments. A rejection is a
-* cancellation; an expired approval sent nothing.
-*/
-const followApproval = (client, approvalId, options) => Effect.gen(function* () {
-	let approval = yield* read(client, approvalId);
-	while (approval.state === "pending") {
-		yield* Effect.sleep("2 seconds");
-		approval = yield* read(client, approvalId);
-	}
-	if (approval.state === "rejected") return yield* rejected(approval);
-	if (approval.state === "expired") return yield* expired(approval);
-	yield* options.onSigned;
-	const outcome = yield* Effect.promise((signal) => client.approvals.wait(approvalId, {
-		signal,
-		...options.organizationId === void 0 ? {} : { organizationId: options.organizationId }
-	})).pipe(Effect.flatMap(resultValue));
-	if (outcome.approval.state === "rejected") return yield* rejected(outcome.approval);
-	if (outcome.approval.state === "expired") return yield* expired(outcome.approval);
-	const failure = unsettled(outcome, options);
-	if (failure !== void 0) return yield* failure;
-	return outcome;
-}).pipe(Effect.timeoutOption(options.deadlineMs), Effect.flatMap(Option.match({
-	onNone: () => Effect.fail(stillWaiting(approvalId, options)),
-	onSome: Effect.succeed
-})));
-/** `Paid 50.00 USDC to Rex · 0x5b2e…91c4`, and where the receipt is. */
-const paidLines = (outcome, scope = {}) => outcome.payments.flatMap((payment) => {
-	const hash = payment.receipt?.transactionHash;
-	return [`Paid ${shownAmount(payment.amount)} to ${terminalText(payment.counterpartyLabel)}${hash === void 0 ? "" : ` · ${hash.slice(0, 6)}…${hash.slice(-4)}`}`, `receipt: ${terminalText([
-		"capxul",
-		"payment",
-		"get",
-		payment.id,
-		...scoped(scope)
-	].join(" "))}`];
-});
-/** A progress line for a person, on stderr. */
-const progress = (line) => writeStderr(`${line}\n`);
-/** After the approval lapses, the time a send and its settlement may still take. */
-const SETTLE_MS = 12e4;
-/**
-* Hand a prepared approval over. An agent gets the link and the wait command
-* back at once. A person sees the preview, the approval page opens, and the
-* CLI follows it until the payment is confirmed: the page is the one and only
-* confirmation.
-*/
-const handOver = (client, approval, options) => Effect.gen(function* () {
-	const runtime = yield* CliRuntime;
-	if (runtime.mode === "json") return {
-		data: awaitingApproval(approval, options),
-		lines: []
-	};
-	for (const line of previewLines(approval, options)) yield* progress(line);
-	yield* progress("✓ Prepared");
-	const opened = runtime.tty && !runtime.ci ? yield* openUrl(approval.url) : false;
-	yield* progress(`… Approve in your browser${opened ? " (opened)" : ""}`);
-	yield* progress(`  ${approval.url}`);
-	const now = yield* Clock.currentTimeMillis;
-	const outcome = yield* followApproval(client, approval.approvalId, {
-		organizationId: options.organizationId,
-		deadlineMs: options.timeoutSeconds === void 0 ? Math.max(approval.expiresAt - now, 0) + SETTLE_MS : options.timeoutSeconds * 1e3,
-		onSigned: progress("✓ Signed")
-	}).pipe(Effect.onInterrupt(() => progress(`Nothing is sent until you approve. Follow it with: ${waitArgv(approval.approvalId, options).join(" ")}`).pipe(Effect.ignore)));
-	yield* progress("✓ Confirmed");
-	return {
-		data: outcome,
-		lines: paidLines(outcome, options)
-	};
-});
-//#endregion
 //#region src/commands/payment/subcommands/wait/approval.ts
 const APPROVAL_ID = /^approval_[0-9A-HJKMNP-TV-Z]{26}$/u;
 /** An approval ID, as `payment send --json` returns it. */
@@ -80489,7 +80512,7 @@ const waitForApproval = (config, input) => Effect.gen(function* () {
 });
 //#endregion
 //#region src/commands/payment/subcommands/wait/execute.ts
-const execute$15 = (config, input) => waitForPayment(config, input, (client, paymentId, listener, signal) => client.payments.subscribe(paymentId, listener, { signal }));
+const execute$14 = (config, input) => waitForPayment(config, input, (client, paymentId, listener, signal) => client.payments.subscribe(paymentId, listener, { signal }));
 //#endregion
 //#region src/commands/payment/subcommands/wait/command.ts
 const command$13 = Command.make("wait", {
@@ -80501,7 +80524,7 @@ const command$13 = Command.make("wait", {
 		approvalId: paymentId,
 		email: Option.getOrUndefined(email),
 		timeoutSeconds
-	}) : execute$15(config, {
+	}) : execute$14(config, {
 		kind: "wait",
 		paymentId,
 		email: Option.getOrUndefined(email),
@@ -80512,7 +80535,7 @@ const command$13 = Command.make("wait", {
 		email: Option.getOrUndefined(email),
 		timeoutSeconds,
 		organizationId: orgId
-	}) : execute$16(config, {
+	}) : execute$15(config, {
 		kind: "wait",
 		orgs: [orgId],
 		paymentId,
@@ -80704,7 +80727,7 @@ const readWords = (input, holder) => Effect.gen(function* () {
 		amount
 	};
 });
-const execute$14 = (config, input) => Effect.gen(function* () {
+const execute$13 = (config, input) => Effect.gen(function* () {
 	const flags = yield* readSendFlags(input);
 	const runtime = yield* CliRuntime;
 	const { client } = yield* restoreAuthenticatedClient(config, input.email);
@@ -80824,7 +80847,7 @@ const readOrganizationPaymentInput = (source) => Effect.gen(function* () {
 }).pipe(Effect.mapError((error) => error instanceof UpdateUnavailable ? inputRequired("Organization Payment input exceeds 64 KiB.") : error));
 //#endregion
 //#region src/commands/org/subcommands/payment/subcommands/send/execute.ts
-const execute$13 = (config, orgId, input) => Effect.gen(function* () {
+const execute$12 = (config, orgId, input) => Effect.gen(function* () {
 	const flags = yield* readSendFlags(input);
 	const runtime = yield* CliRuntime;
 	const { client } = yield* restoreAuthenticatedClient(config, input.email);
@@ -80884,352 +80907,47 @@ const command$12 = Command.make("send", {
 		timeoutSeconds: Option.getOrUndefined(flags.timeoutSeconds)
 	};
 	return dispatch("send", {
-		personal: (config) => execute$14(config, input),
-		organization: (config, orgId) => execute$13(config, orgId, input)
+		personal: (config) => execute$13(config, input),
+		organization: (config, orgId) => execute$12(config, orgId, input)
 	});
 }).pipe(annotate("send"), Command.withDescription("you approve it in the browser"));
 //#endregion
-//#region src/commands/org/subcommands/payment/internal/retry-recovery.ts
-/** What an interrupted or failed retry prints: the selected and prepared Payments to read or wait for. */
-const retryRecovery = (input) => {
-	const { organizationId, selectedPaymentId, recoveryEmail, previewIds, preparedIds, commandId } = input;
-	const ids = [.../* @__PURE__ */ new Set([selectedPaymentId, ...preparedIds.length === 0 ? previewIds : preparedIds])];
-	const argv = (id, verb) => [
-		"capxul",
-		"payment",
-		verb,
-		id,
-		"--org",
-		organizationId,
-		...recoveryEmail === void 0 ? [] : ["--email", recoveryEmail]
-	];
-	return {
-		details: {
-			paymentId: selectedPaymentId,
-			...organizationId === null ? {} : {
-				organizationId,
-				recovery: {
-					kind: "read",
-					argv: argv(selectedPaymentId, "get")
-				}
-			},
-			...preparedIds.length === 0 ? {} : { paymentIds: preparedIds },
-			...commandId === void 0 ? {} : { commandId }
-		},
-		lines: [
-			...organizationId === null ? [] : [`Organization: ${terminalText(organizationId)}`],
-			`Selected Payment: ${terminalText(selectedPaymentId)}`,
-			...preparedIds.length > 0 ? [`Verified prepared Payment IDs: ${preparedIds.map(terminalText).join(", ")}`] : previewIds.length > 0 ? [`Preview Payment IDs for read guidance: ${previewIds.map(terminalText).join(", ")}`] : [],
-			...organizationId === null ? [] : ids.flatMap((id) => [`Read: capxul payment get ${shellArgument(id)} --org ${shellArgument(organizationId)}${recoveryEmail === void 0 ? "" : ` --email ${shellArgument(recoveryEmail)}`}`, `Wait: capxul payment wait ${shellArgument(id)} --org ${shellArgument(organizationId)}${recoveryEmail === void 0 ? "" : ` --email ${shellArgument(recoveryEmail)}`}`])
-		]
-	};
-};
-//#endregion
-//#region src/commands/org/subcommands/payment/internal/retry-cohort.ts
-/** The preview is the selected Organization's complete outgoing cohort, with valid Payment IDs. */
-const requireRetryCohort = (cohort, selectedOrg, selectedPaymentId) => Effect.gen(function* () {
-	if (cohort === null || cohort === void 0 || cohort.orgId !== selectedOrg || !cohort.paymentIds.includes(selectedPaymentId) || new Set(cohort.paymentIds).size !== cohort.paymentIds.length || cohort.payments.length !== cohort.paymentIds.length || cohort.payments.some((payment, index) => payment?.id !== cohort.paymentIds[index] || payment.direction !== "out")) return yield* Effect.fail(Errors.invalidInput("preview", "The Organization retry preview does not match the selected scope and complete outgoing cohort."));
-	yield* Effect.forEach(cohort.paymentIds, readPaymentId).pipe(Effect.mapError(() => Errors.invalidInput("preview", "The retry preview contains an invalid Payment ID.")));
-});
-/** What the retry shows before it starts: the actor, the original command and every Payment. */
-const retryCohortLines = (session, selectedOrg, cohort) => {
-	const preview = { session };
-	return [
-		`Acting as: ${terminalText(preview.session.email)} (${terminalText(preview.session.authUserId)})`,
-		`Organization: ${terminalText(selectedOrg)}`,
-		`Original command: ${terminalText(cohort.commandId)}`,
-		`Stored Budget: ${cohort.permissionId === null ? "not recorded" : terminalText(cohort.permissionId)}`,
-		...cohort.payments.flatMap((payment) => [
-			...paymentLines(payment),
-			`  Recipient: ${terminalText(JSON.stringify(payment.recipient))}`,
-			`  AssetId: ${terminalText(payment.amount.asset)}`,
-			`  Quantity: ${terminalText(payment.amount.value)}`,
-			`  Timing: ${terminalText(JSON.stringify(payment.timing))}`
-		])
-	];
-};
-//#endregion
-//#region src/commands/org/subcommands/payment/subcommands/retry/execute.ts
-const execute$12 = (config, input) => Effect.gen(function* () {
-	const timeout = yield* readWriteTimeout(input.timeoutSeconds);
-	const email = input.email === void 0 ? void 0 : yield* readEmail(input.email);
-	let organizationId = input.orgs.length === 0 ? null : yield* readOrganizationId(input.orgs);
-	let paymentId = input.paymentId === void 0 ? void 0 : yield* readPaymentId(input.paymentId);
-	const runtime = yield* CliRuntime;
-	const human = runtime.tty && !runtime.ci && runtime.mode !== "json";
-	if (!human && organizationId === null) return yield* inputRequired("Provide --org with one exact Organization ID.");
-	if (!human && paymentId === void 0) return yield* inputRequired("Provide the exact Payment ID.");
-	const interactive = yield* requireWriteConfirmation(input.confirm);
-	if (paymentId === void 0) paymentId = yield* readPaymentId(yield* Prompt.String({ message: "Payment ID" }));
-	const selectedPaymentId = paymentId;
-	let recoveryEmail = email;
-	let previewIds = [];
-	let preparedIds = [];
-	let commandId;
-	let retryStarted = false;
-	const sameIds = (ids) => ids.length === previewIds.length && ids.every((id, index) => id === previewIds[index]);
-	const recovery = () => retryRecovery({
-		organizationId,
-		selectedPaymentId,
-		recoveryEmail,
-		previewIds,
-		preparedIds,
-		commandId
-	});
-	const recoveryNotice = () => {
-		const known = recovery();
-		return writeStderr(runtime.mode === "json" ? `${JSON.stringify({
-			type: "org.payment.recovery",
-			...known.details,
-			...preparedIds.length === 0 ? { previewPaymentIds: previewIds } : {}
-		})}\n` : `${known.lines.join("\n")}\n`).pipe(Effect.ignoreCause);
-	};
-	const within = (work) => work.pipe(Effect.timeoutOrElse({
-		duration: timeout * 1e3,
-		orElse: () => Effect.fail(new CliFailure({
-			code: "CLI_DEADLINE",
-			exitCode: 5,
-			outcome: "failed",
-			message: retryStarted ? "The CLI stopped waiting. The Payments may still settle." : "The retry preview or signer did not finish. No retry was started."
-		}))
-	}));
-	return yield* Effect.gen(function* () {
-		const opened = yield* openAuthenticatedSession(config, email);
-		const preview = yield* within(restoreTransactingActor(config, opened, organizationId === null));
-		recoveryEmail = preview.session.email;
-		if (organizationId === null) {
-			if (preview.organizations.length === 0) return yield* inputRequired("No current Organization is available. Provide an authorized --org.");
-			organizationId = yield* Prompt.Select({
-				message: "Organization",
-				choices: preview.organizations.map((organization) => ({
-					title: organizationLabel(organization),
-					value: organization.id
-				}))
-			});
-		}
-		const selectedOrg = organizationId;
-		const cohort = yield* within(Effect.promise((signal) => preview.client.org(selectedOrg).payments.previewRetry(selectedPaymentId, { signal })).pipe(Effect.flatMap(resultValue)));
-		yield* requireRetryCohort(cohort, selectedOrg, selectedPaymentId);
-		previewIds = [...cohort.paymentIds];
-		commandId = cohort.commandId;
-		const lines = retryCohortLines(preview.session, selectedOrg, cohort);
-		if (interactive) yield* confirmWrite({
-			lines,
-			question: "Retry this complete original Payment cohort?"
-		});
-		else yield* writeStderr(runtime.mode === "json" ? `${JSON.stringify({
-			type: "org.payment.preview",
-			organizationId: selectedOrg,
-			selectedPaymentId,
-			commandId: cohort.commandId,
-			permissionId: cohort.permissionId,
-			previewPaymentIds: previewIds,
-			payments: cohort.payments
-		})}\n` : `${lines.join("\n")}\n`);
-		const context = yield* Effect.context();
-		const run = Effect.runPromiseWith(context);
-		const operation = CAPXUL_OPERATIONS.organizationPayments.retry;
-		const completed = yield* within(Effect.gen(function* () {
-			const signal = yield* Effect.abortSignal;
-			let writeLifetime;
-			const checkActor = Effect.gen(function* () {
-				const stopped = cancelledWrite(operation, signal);
-				if (stopped !== null) return yield* Effect.fail(stopped);
-				if (!(yield* preview.stillAuthenticated)) return yield* Effect.fail(Errors.cancelled({ operation }));
-			});
-			yield* checkActor;
-			const signer = yield* organizationWriteSigner(config, opened, run, async () => {
-				await run(checkActor);
-				if (writeLifetime === void 0 || !await run(writeLifetime)) throw Errors.cancelled({ operation });
-				if (!sameIds(preparedIds)) throw Errors.invalidInput("paymentIds", "The verified prepared retry cohort was not confirmed.");
-			});
-			const write = yield* restoreWriteClient(config, opened, signer, preview.session, () => Errors.cancelled({ operation }));
-			writeLifetime = write.stillAuthenticated;
-			yield* checkActor;
-			const onPrepared = async ({ paymentIds }) => {
-				const stopped = cancelledWrite(operation, signal);
-				if (stopped !== null) throw stopped;
-				preparedIds = [...paymentIds];
-				if (!sameIds(preparedIds)) throw Errors.invalidInput("paymentIds", "The prepared retry Payments differ from the confirmed preview.");
-				await run(writeStderr(runtime.mode === "json" ? `${JSON.stringify({
-					type: "org.payment.prepared",
-					...recovery().details
-				})}\n` : `Verified prepared Payment IDs: ${preparedIds.map(terminalText).join(", ")}\n`));
-				await run(checkActor);
-				if (!await run(write.stillAuthenticated)) throw Errors.cancelled({ operation });
-			};
-			retryStarted = true;
-			return yield* Effect.promise((operationSignal) => write.client.org(selectedOrg).payments.retry(selectedPaymentId, {
-				signal: operationSignal,
-				onPrepared
-			})).pipe(Effect.flatMap(resultValue));
-		}).pipe(Effect.scoped));
-		const documentOutputs = yield* Effect.forEach(completed, (payment) => savePaymentDocuments(config, preview.client, payment).pipe(Effect.map((output) => ({
-			paymentId: payment.id,
-			...output
-		}))));
-		return {
-			data: {
-				payments: completed,
-				documentOutputs
-			},
-			lines: [
-				`Organization: ${terminalText(selectedOrg)}`,
-				...completed.flatMap(paymentLines),
-				...documentOutputs.flatMap(documentOutputLines)
-			]
-		};
-	}).pipe(Effect.mapError((error) => {
-		const account = isCapxulError(error) && recoveryEmail !== void 0 ? accountReadFailure(error, recoveryEmail) : error;
-		const scoped = organizationId === null ? account : normalizeOrganizationReadFailure(account, organizationId);
-		const failure = classifyFailure(Cause.fail(scoped), "org.payment.retry");
-		const known = recovery();
-		const message = isCapxulError(error) && error.code === "INVALID_INPUT" && (error.details?.field === "preview" || error.details?.field === "paymentIds") ? "The retry preview or Payment cohort does not match this command." : failure.message;
-		return new CliFailure({
-			...failure,
-			details: {
-				...failure.details,
-				...known.details
-			},
-			message: `${message}\n${known.lines.join("\n")}`
-		});
-	}), Effect.onInterrupt(recoveryNotice));
-});
-//#endregion
 //#region src/commands/payment/subcommands/retry/execute.ts
-const readLine = (id, email) => `capxul payment get ${shellArgument(id)} --email ${shellArgument(email)}`;
-const waitLine = (id, email) => `capxul payment wait ${shellArgument(id)} --email ${shellArgument(email)}`;
-const execute$11 = (config, input) => Effect.gen(function* () {
+const execute$11 = (config, input, organizationId) => Effect.gen(function* () {
 	const id = yield* readPaymentId(input.paymentId);
-	const timeout = yield* readWriteTimeout(input.timeoutSeconds);
-	const interactive = yield* requireWriteConfirmation(input.confirm);
-	const opened = yield* openAuthenticatedSession(config, input.email);
-	const previewRead = yield* Effect.gen(function* () {
-		const restored = yield* restoreVerifiedClient(config, opened, { requirement: "none" });
-		return {
-			payment: yield* Effect.promise((signal) => restored.client.payments.get(id, { signal })).pipe(Effect.flatMap(resultValue)),
-			session: restored.session,
-			client: restored.client
-		};
-	}).pipe(Effect.timeoutOption(timeout * 1e3));
-	if (Option.isNone(previewRead)) return yield* new CliFailure({
-		code: "CLI_DEADLINE",
-		outcome: "failed",
-		exitCode: 5,
-		message: `The Payment retry preview did not finish. No retry was started. Read: ${readLine(id, opened.email)}`
-	});
-	const { payment, session } = previewRead.value;
-	if (payment === null) return yield* paymentNotFound();
-	if (payment.id !== id) return yield* new CliFailure({
-		code: "INVALID_INPUT",
-		outcome: "refused",
-		exitCode: 2,
-		message: "The Payment response did not match the Payment ID."
-	});
-	if (interactive) yield* confirmWrite({
-		lines: [`Acting as: ${terminalText(session.email)}`, ...paymentLines(payment)],
-		question: "Retry this exact Payment?"
-	});
+	const timeoutSeconds = input.timeoutSeconds === void 0 ? void 0 : yield* readWriteTimeout(input.timeoutSeconds);
 	const runtime = yield* CliRuntime;
-	yield* writeStderr(runtime.mode === "json" ? `${JSON.stringify({
-		type: "payment.retry",
-		paymentId: id
-	})}\n` : `Retrying Payment: ${terminalText(id)}\n`);
-	const context = yield* Effect.context();
-	const run = Effect.runPromiseWith(context);
-	const result = yield* Effect.gen(function* () {
-		const signal = yield* Effect.abortSignal;
-		const signer = yield* organizationWriteSigner(config, opened, run, async () => {
-			const stopped = cancelledWrite(CAPXUL_OPERATIONS.payments.retry, signal);
-			if (stopped !== null) throw stopped;
-		});
-		const { client } = yield* restoreVerifiedClient(config, opened, {
-			requirement: "deployed",
-			openfortSignerFactory: signer
-		});
-		return yield* Effect.promise((operationSignal) => client.payments.retry(id, { signal: operationSignal })).pipe(Effect.flatMap(resultValue));
-	}).pipe(Effect.scoped, Effect.timeoutOption(timeout * 1e3)).pipe(Effect.mapError((error) => {
-		const account = isCapxulError(error) ? accountReadFailure(error, opened.email) : error;
-		const classified = classifyFailure(Cause.fail(account), "payment.retry");
-		return new CliFailure({
-			code: classified.code,
-			outcome: classified.outcome,
-			exitCode: classified.exitCode,
-			...classified.mode === void 0 ? {} : { mode: classified.mode },
-			details: {
-				...classified.details,
-				paymentId: id,
-				recovery: {
-					kind: "read",
-					argv: [
-						"capxul",
-						"payment",
-						"get",
-						id,
-						"--email",
-						opened.email
-					]
-				}
-			},
-			message: `${classified.message}\nRead: ${readLine(id, opened.email)}\nWait: ${waitLine(id, opened.email)}`
-		});
-	}));
-	if (Option.isNone(result)) return yield* new CliFailure({
-		code: "CLI_DEADLINE",
-		outcome: "failed",
-		exitCode: 5,
-		details: {
-			paymentId: id,
-			recovery: {
-				kind: "read",
-				argv: [
-					"capxul",
-					"payment",
-					"get",
-					id,
-					"--email",
-					opened.email
-				]
-			}
-		},
-		message: `The CLI stopped waiting. The Payment may still settle.\nRead: ${readLine(id, opened.email)}\nWait: ${waitLine(id, opened.email)}`
+	const { client } = yield* restoreAuthenticatedClient(config, input.email);
+	const approval = yield* withWaiting(Effect.promise((signal) => client.approvals.prepare({
+		retry: id,
+		...organizationId === void 0 ? {} : { organizationId }
+	}, { signal })).pipe(Effect.flatMap(resultValue)), {
+		...runtime,
+		label: "Preparing the retry"
+	});
+	return yield* handOver(client, approval, {
+		organizationId,
+		timeoutSeconds
 	});
-	const documentOutputs = yield* Effect.forEach(result.value, (returnedPayment) => savePaymentDocuments(config, previewRead.value.client, returnedPayment).pipe(Effect.map((output) => ({
-		paymentId: returnedPayment.id,
-		...output
-	}))));
-	return {
-		data: {
-			payments: result.value,
-			documentOutputs
-		},
-		lines: [...result.value.flatMap(paymentLines), ...documentOutputs.flatMap(documentOutputLines)]
-	};
 });
 //#endregion
 //#region src/commands/payment/subcommands/retry/command.ts
 const command$11 = Command.make("retry", {
 	paymentId: paymentIdArgument,
 	email: emailFlag,
-	confirm: confirmFlag,
-	timeoutSeconds: timeoutFlag
-}, ({ paymentId, email, confirm, timeoutSeconds }) => dispatch("retry", {
-	personal: (config) => execute$11(config, {
-		kind: "retry",
-		paymentId,
-		email: Option.getOrUndefined(email),
-		confirm,
-		timeoutSeconds
-	}),
-	organization: (config, orgId) => execute$12(config, {
+	timeoutSeconds: Flag.Int("timeout-seconds").pipe(Flag.withDescription("how long to follow it (default: until the approval lapses)"), Flag.optional)
+}, ({ paymentId, email, timeoutSeconds }) => {
+	const input = {
 		kind: "retry",
-		orgs: [orgId],
 		paymentId,
 		email: Option.getOrUndefined(email),
-		confirm,
-		timeoutSeconds
-	})
-})).pipe(annotate("retry"), Command.withDescription("Retry the exact existing Payment"));
+		timeoutSeconds: Option.getOrUndefined(timeoutSeconds)
+	};
+	return dispatch("retry", {
+		personal: (config) => execute$11(config, input),
+		organization: (config, orgId) => execute$11(config, input, orgId)
+	});
+}).pipe(annotate("retry"), Command.withDescription("retry the exact Payment; you approve it in the browser"));
 //#endregion
 //#region src/commands/payment/command.ts
 const payment = Command.make("payment").pipe(annotate("root"), Command.withDescription("send, read and follow Payments"), Command.withSubcommands([
@@ -81375,7 +81093,7 @@ const execute$8 = (config, input) => Effect.gen(function* () {
 const command$8 = (context) => Command.make("cancel", {
 	email: emailFlag$3,
 	id: idArgument,
-	confirm: confirmFlag$3
+	confirm: confirmFlag$2
 }, ({ email, id, confirm }) => context.dispatch("cancel", (scope) => ({
 	kind: "cancel",
 	id,
@@ -81410,7 +81128,7 @@ const execute$7 = (config, input) => Effect.gen(function* () {
 const command$7 = (context) => Command.make("decline", {
 	email: emailFlag$3,
 	id: idArgument,
-	confirm: confirmFlag$3
+	confirm: confirmFlag$2
 }, ({ email, id, confirm }) => context.dispatch("decline", (scope) => ({
 	kind: "decline",
 	id,
@@ -81529,7 +81247,7 @@ const execute$6 = (config, input) => Effect.gen(function* () {
 const command$6 = (context) => Command.make("issue", {
 	email: emailFlag$3,
 	source: Flag.String("input"),
-	confirm: confirmFlag$3,
+	confirm: confirmFlag$2,
 	outputDirectory: Flag.String("output-dir").pipe(Flag.optional)
 }, ({ email, source, confirm, outputDirectory }) => context.dispatch("issue", (scope) => ({
 	kind: "issue",
@@ -81546,38 +81264,46 @@ const command$5 = (args) => args.map(shellArgument).join(" ");
 const execute$5 = (config, input) => Effect.gen(function* () {
 	const orgId = yield* readScope(input);
 	const id = yield* requestId(input.id);
-	const timeout = yield* readWriteTimeout(input.timeoutSeconds);
+	const timeoutSeconds = input.timeoutSeconds === void 0 ? void 0 : yield* readWriteTimeout(input.timeoutSeconds);
 	if (input.direction !== "received") return yield* inputRequired("Use inbox pay for received Invoices.");
 	const permissionId = yield* readPaymentPermission(orgId, input.permissionId);
-	const interactive = yield* requireWriteConfirmation(input.confirm);
 	const runtime = yield* CliRuntime;
-	const opened = yield* openAuthenticatedSession(config, input.email);
-	const preview = yield* restoreVerifiedClient(config, opened, { requirement: "none" });
-	const actor = orgId === null ? preview.client.account : preview.client.org(orgId);
-	const item = (yield* Effect.promise((signal) => actor.inbox.list({ signal })).pipe(Effect.flatMap(resultItems), Effect.mapError((error) => orgId === null ? error : normalizeOrganizationReadFailure(error, orgId)))).find((entry) => entry.id === id);
+	const { client, session } = yield* restoreAuthenticatedClient(config, input.email);
+	const actor = orgId === null ? client.account : client.org(orgId);
+	const scoped = (work) => work.pipe(Effect.mapError((error) => orgId === null ? error : normalizeOrganizationReadFailure(error, orgId)));
+	const item = (yield* withWaiting(scoped(Effect.promise((signal) => actor.inbox.list({ signal })).pipe(Effect.flatMap(resultItems))), {
+		...runtime,
+		label: "Reading the request"
+	})).find((entry) => entry.id === id);
 	if (item === void 0) return yield* inputRequired("The Invoice is unavailable to this payer.");
 	const orgArgs = orgId === null ? [] : ["--org", orgId];
-	const readArgs = (paymentId) => [
+	const readArgs = [
 		"capxul",
-		paymentId === void 0 ? "inbox" : "payment",
-		"get",
-		paymentId ?? id,
+		...item.paymentId === void 0 ? [
+			"inbox",
+			"get",
+			id
+		] : [
+			"payment",
+			"get",
+			item.paymentId
+		],
 		...orgArgs,
 		"--email",
-		preview.session.email
+		session.email
 	];
 	const resuming = input.resume === true && item.status === "approved" && item.paymentId !== void 0;
 	if (input.resume === true && !resuming || item.status !== "open" && !resuming) return yield* new CliFailure({
 		code: "WRONG_STATE",
 		outcome: "refused",
 		exitCode: 2,
-		message: `The Invoice is ${terminalText(item.status)}. Read its current state:\n  ${command$5(readArgs(item.paymentId))}`,
+		message: `The Invoice is ${terminalText(item.status)}. Read its current state:\n  ${command$5(readArgs)}`,
 		details: { recovery: {
 			kind: "read",
-			argv: readArgs(item.paymentId)
+			argv: readArgs
 		} }
 	});
-	const terms = yield* Effect.promise((signal) => actor.inbox.paymentTerms(id, { signal })).pipe(Effect.flatMap(resultValue), Effect.mapError((error) => orgId === null ? error : normalizeOrganizationReadFailure(error, orgId)));
+	const terms = yield* scoped(Effect.promise((signal) => actor.inbox.paymentTerms(id, { signal })).pipe(Effect.flatMap(resultValue)));
 	if (terms.requestId !== id || terms.amount.asset !== item.amount.asset || terms.amount.value !== item.amount.value) return yield* inputRequired("The payment terms differ from the selected request. Read it again.");
 	const confirmation = {
 		...terms,
@@ -81589,113 +81315,35 @@ const execute$5 = (config, input) => Effect.gen(function* () {
 			permissionId
 		}
 	};
-	if (interactive) yield* confirmWrite({
-		lines: [
-			`Scope: ${orgId === null ? "Personal" : `Organization ${terminalText(orgId)}`}`,
-			...requestLines(item, preview.session.email, orgId),
-			`Recipient Safe: ${terminalText(terms.issuerSafe)}`,
-			`Instruction: ${terminalText(terms.instruction.kind)}`,
-			...permissionId === void 0 ? [] : [`Permission: ${terminalText(permissionId)}`]
-		],
-		question: "Pay this exact request now?"
+	const approval = yield* withWaiting(scoped(Effect.promise((signal) => client.approvals.prepare({ request: confirmation }, { signal })).pipe(Effect.flatMap(resultValue))), {
+		...runtime,
+		label: "Preparing the payment"
 	});
-	const expectedPaymentId = resuming ? item.paymentId : void 0;
-	let preparedIds = expectedPaymentId === void 0 ? [] : [expectedPaymentId];
-	const context = yield* Effect.context();
-	const run = Effect.runPromiseWith(context);
-	const result = yield* Effect.gen(function* () {
-		const signal = yield* Effect.abortSignal;
-		let writeLifetime;
-		const checkActor = Effect.gen(function* () {
-			const stopped = cancelledWrite(CAPXUL_OPERATIONS.inbox.fulfill, signal);
-			if (stopped !== null) return yield* Effect.fail(stopped);
-			if (!(yield* preview.stillAuthenticated) || writeLifetime !== void 0 && !(yield* writeLifetime)) return yield* Effect.fail(Errors.cancelled({ operation: CAPXUL_OPERATIONS.inbox.fulfill }));
-		});
-		yield* checkActor;
-		const signer = yield* organizationWriteSigner(config, opened, run, async () => {
-			await run(checkActor);
-			if (writeLifetime === void 0 || preparedIds.length === 0) throw Errors.cancelled({ operation: CAPXUL_OPERATIONS.inbox.fulfill });
-		});
-		const write = yield* restoreWriteClient(config, opened, signer, preview.session, () => Errors.cancelled({ operation: CAPXUL_OPERATIONS.inbox.fulfill }));
-		writeLifetime = write.stillAuthenticated;
-		yield* checkActor;
-		const payer = orgId === null ? write.client.account : write.client.org(orgId);
-		return yield* Effect.promise((operationSignal) => payer.inbox.fulfill(confirmation, {
-			signal: operationSignal,
-			onPrepared: async ({ paymentIds }) => {
-				if (expectedPaymentId !== void 0 && (paymentIds.length !== 1 || paymentIds[0] !== expectedPaymentId)) throw Errors.invalidInput("paymentIds", "Prepared Payment does not match the linked Invoice.");
-				preparedIds = [...paymentIds];
-				await run(checkActor);
-				await run(writeStderr(runtime.mode === "json" ? `${JSON.stringify({
-					type: "payment.prepared",
-					paymentIds
-				})}\n` : paymentIds.map((paymentId) => `Prepared Payment: ${terminalText(paymentId)}\n`).join("")));
-				await run(checkActor);
-			}
-		})).pipe(Effect.flatMap(resultValue));
-	}).pipe(Effect.scoped, Effect.timeoutOption(`${timeout} seconds`), Effect.catchCause((cause) => {
-		const failure = classifyFailure(cause, orgId === null ? "inbox.pay" : "org.inbox.pay");
-		const argv = readArgs(preparedIds[0]);
-		return Effect.fail(new CliFailure({
-			...failure,
-			outcome: failure.outcome,
-			message: `${failure.message}\nRead before another payment attempt:\n  ${command$5(argv)}`,
-			details: {
-				...failure.details,
-				...preparedIds.length === 0 ? {} : { paymentIds: preparedIds },
-				recovery: {
-					kind: "read",
-					argv
-				}
-			}
-		}));
-	}));
-	if (Option.isNone(result)) return yield* new CliFailure({
-		code: "CLI_DEADLINE",
-		outcome: "failed",
-		exitCode: 5,
-		message: `The CLI stopped waiting. The Payment may still settle.\n  ${command$5(readArgs(preparedIds[0]))}`,
-		details: {
-			paymentIds: preparedIds,
-			recovery: {
-				kind: "read",
-				argv: readArgs(preparedIds[0])
-			}
-		}
+	const paymentIds = approval.operation.paymentIds;
+	if (resuming && (paymentIds.length !== 1 || paymentIds[0] !== item.paymentId)) return yield* inputRequired("The prepared Payment does not match the linked Invoice.");
+	return yield* handOver(client, approval, {
+		organizationId: orgId ?? void 0,
+		timeoutSeconds
 	});
-	const documents = yield* Effect.forEach(result.value.payments, (payment) => savePaymentDocuments(config, preview.client, payment));
-	const lines = ["Payment submission accepted. Read Payment state to check settlement."];
-	for (const [index, payment] of result.value.payments.entries()) lines.push(`Payment ${terminalText(payment.id)}: ${terminalText(payment.status)}`, `  ${command$5(readArgs(payment.id))}`, ...documentOutputLines(documents[index]));
-	return {
-		data: {
-			scope: scopeValue(orgId),
-			requestId: id,
-			submission: result.value,
-			documents
-		},
-		lines
-	};
 });
 //#endregion
 //#region src/commands/request/subcommands/pay/command.ts
 const command$4 = (context) => Command.make("pay", {
 	email: emailFlag$3,
 	id: idArgument,
-	confirm: confirmFlag$3,
 	permissionId: Flag.String("permission-id").pipe(Flag.withDescription("The Permission an Organization pays under"), Flag.optional),
-	timeoutSeconds: Flag.Int("timeout-seconds").pipe(Flag.withDefault(120)),
-	resume: Flag.Boolean("resume").pipe(Flag.withDefault(false))
-}, ({ email, id, confirm, permissionId, timeoutSeconds, resume }) => context.dispatch("pay", (scope) => ({
+	timeoutSeconds: Flag.Int("timeout-seconds").pipe(Flag.withDescription("how long to follow it (default: until the approval lapses)"), Flag.optional),
+	resume: Flag.Boolean("resume").pipe(Flag.withDescription("open the approval again for a request whose Payment is prepared"), Flag.withDefault(false))
+}, ({ email, id, permissionId, timeoutSeconds, resume }) => context.dispatch("pay", (scope) => ({
 	kind: "pay",
 	...scope,
 	direction: context.direction,
 	id,
-	confirm,
-	timeoutSeconds,
+	timeoutSeconds: Option.getOrUndefined(timeoutSeconds),
 	resume,
 	email: Option.getOrUndefined(email),
 	permissionId: Option.getOrUndefined(permissionId)
-}), execute$5)).pipe(context.annotate("pay"), Command.withDescription("Review and sign payment of a received Invoice"));
+}), execute$5)).pipe(context.annotate("pay"), Command.withDescription("pay a received request; you approve it in the browser"));
 //#endregion
 //#region src/commands/request/command.ts
 const issued = makeContext("issued");
@@ -81714,7 +81362,7 @@ const inbox = Command.make("inbox").pipe(received.annotate("root"), Command.with
 ]));
 //#endregion
 //#region src/commands/schema/internal/contract.ts
-/** Commands that move money. Each one hands over to the approval page or signs. */
+/** Commands that move money. Each one hands over to the approval page. */
 const MONEY = /* @__PURE__ */ new Set([
 	"payment.send",
 	"payment.retry",
@@ -81731,17 +81379,21 @@ const LOCAL = /* @__PURE__ */ new Set([
 	"config.telemetry.status",
 	"schema"
 ]);
+/** A money command's `data`: the approval link for an agent, the outcome for a person. */
+const APPROVAL = "--json: { status: 'awaiting_approval', approvalId, approvalUrl, paymentIds, expiresAt, next: { argv } }; a person: ApprovalOutcome { approval, payments }";
 /** `data` of the commands an agent reaches for most; other lists are pages, others the SDK value. */
 const OUTPUT = {
 	home: "{ where, signedIn, balances: Account | null, needsYou: NeedsYou[] | null, try }",
 	whoami: "Where: { user, actingAs, safe, env }",
 	balance: "Account: { id, balances: AccountPosition[], balance, available }",
 	address: "DepositInstructions",
-	"payment.send": "--json: { status: 'awaiting_approval', approvalId, approvalUrl, paymentIds, expiresAt, next: { argv } }; a person: ApprovalOutcome { approval, payments }",
+	"payment.send": APPROVAL,
 	"payment.wait": "Payment, or for an approval ID: ApprovalOutcome { approval, payments }",
 	"payment.get": "Payment",
 	"payment.list": "Page<Payment>: { items, nextCursor }",
-	"payment.retry": "{ payments: Payment[] }",
+	"payment.retry": APPROVAL,
+	"inbox.pay": APPROVAL,
+	"org.payroll.run": APPROVAL,
 	[CAPXUL_OPERATIONS.inbox.list]: "Page<InboxItem>",
 	"inbox.get": "InboxItem",
 	"request.list": "Page<ActorRequest>",
@@ -82836,4 +82488,4 @@ const runCli = (platform) => Effect.uninterruptibleMask((restore) => Effect.gen(
 //#endregion
 export { runCli };
 
-//# sourceMappingURL=entry-CXlsnqyc.mjs.map
+//# sourceMappingURL=entry-GLdITgH4.mjs.map