@arcadiasystems/morse-cli 0.2.0 → 0.4.0

package/CHANGELOG.md

@@ -4,6 +4,73 @@ All notable changes to `@arcadiasystems/morse-cli` are documented here. The
 format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/) and this
 project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.4.0] - 2026-06-04
+
+Ports the file commands to the SDK 0.4.0 `RecipientFile` primitive, which
+replaces the per-wallet allowlist plus encrypted-file pair with a single object
+that carries its recipient list inline. This is a breaking change to the `morse
+file` surface and removes `morse allowlist` entirely.
+
+### Added
+
+- `morse file recipient add|remove|list <file> [address]`: manage a file's
+  recipient list directly on the file object (replaces `morse allowlist`).
+- Recipients on uploads and registration via repeatable `-r, --recipient <addr>`;
+  the sender is always included.
+- Encrypted uploads emit a **share string** (`mf1.<fileId>.<prefix>.<nonce>`,
+  see `format/share.ts`) bundling everything a recipient needs to decrypt, plus
+  the raw `sealIdPrefix` and `sealNonce` (hex) in `--json`.
+- `morse file download` accepts `--share <string>`, or `--prefix <hex> --nonce
+  <hex>`, to decrypt; the file id becomes an optional positional (the share
+  string carries it).
+- `morse file register --encrypted --seal-prefix <hex>` / `--public`: register
+  on-chain metadata for an existing Walrus blob as a `RecipientFile`.
+
+### Changed
+
+- Depends on `@arcadiasystems/morse-sdk` `^0.4.0`.
+- `morse file list` reconciles `RecipientFile` events; `--accessible` now lists
+  files you can decrypt as a recipient (recipient-list membership), not allowlist
+  membership. The human listing shows a `recipients` count column.
+- `morse file get` shows the recipient list instead of an allowlist reference.
+
+### Removed
+
+- `morse allowlist` and all its subcommands. Recipient access now lives on the
+  file via `morse file recipient`.
+- `file upload -a <allowlist>` and `file download --seal-id <hex>`. Use
+  `--encrypt` / `--recipient` on upload and `--share` (or `--prefix`/`--nonce`)
+  on download.
+
+## [0.3.0] - 2026-06-04
+
+Event-based file listing, wrapping the SDK 0.3.0 reconcile helpers. Purely
+additive; all existing commands are unchanged.
+
+### Added
+
+- `morse file list`: list files owned by an address (default: the active
+  account), or, with `--accessible`, files decryptable via allowlist membership.
+  `--address <addr>` queries another address, `--hydrate` fetches the full record
+  per file (adds `blobId`; one read each), `--limit <n>` caps results, `--json`
+  emits the summary array.
+- Event fetching via `cli/events.ts`: a paginator over `suix_queryEvents` feeding
+  the SDK's pure `reconcileFilesOwnedBy` / `reconcileFilesAccessibleBy` helpers.
+  `--indexer-url <url>` overrides the event source (any endpoint that speaks
+  `suix_queryEvents`).
+
+### Changed
+
+- Depends on `@arcadiasystems/morse-sdk` `^0.3.0`.
+
+### Notes
+
+- Listing reads `suix_queryEvents`, a deprecated Sui JSON-RPC endpoint Mysten is
+  sunsetting; on the public RPC it may degrade over time. Use `--indexer-url` to
+  point at your own indexer. Results are best-effort and eventually consistent.
+- Summaries omit `blobId`/`blobObjectId` (not in the `FileCreated` event); use
+  `--hydrate` to fetch them.
+
 ## [0.2.0] - 2026-06-04
 
 Wraps the allowlist + encrypted-file surface from `@arcadiasystems/morse-sdk`

package/README.md

@@ -6,7 +6,7 @@ content entries from your terminal, signing with a locally encrypted key.
 Content is stored on [Walrus](https://walrus.xyz); private entries are encrypted
 with [Seal](https://github.com/MystenLabs/seal).
 
-> Status: v0.2.0, targeting Sui testnet. The command surface is stable; mainnet
+> Status: v0.3.0, targeting Sui testnet. The command surface is stable; mainnet
 > support lands when the contracts are frozen.
 
 ## Requirements
@@ -228,46 +228,52 @@ OwnerCap and PublisherCap IDs are auto-resolved from the active account when the
 `--owner-cap` / `--publisher-cap` override is omitted. Destructive operations
 (`delete`, `revoke`, `destroy`, `transfer`) confirm interactively unless `--yes`.
 
-### allowlist
-
-Per-wallet allowlists gate who can decrypt encrypted files. The admin Cap is
-auto-resolved from the active account when `--cap` is omitted.
-
-| Command | Purpose |
-| --- | --- |
-| `allowlist create --name <name>` | Create an allowlist; transfers its admin Cap to you. |
-| `allowlist add-member <addr> -a <id> [--cap <id>]` | Add a wallet that may decrypt. |
-| `allowlist remove-member <addr> -a <id> [--cap <id>]` | Remove a wallet. |
-| `allowlist transfer-cap <recipient> -a <id> [--cap <id>] [-y]` | Hand off admin rights. |
-| `allowlist delete -a <id> [--cap <id>] [-y]` | Delete an allowlist (dependent files become undecryptable). |
-| `allowlist get <id>` | Show an allowlist's name and members. |
-| `allowlist list-caps [address]` | List allowlist admin Caps held by an address. |
-
 ### file
 
+A `RecipientFile` is a single object that carries its own recipient list: the
+addresses allowed to decrypt it live inline on the file, managed by its owner.
+There is no separate allowlist object.
+
 | Command | Purpose |
 | --- | --- |
-| `file upload <path> --name <n> [-a <id>] [--public] [--content-type <m>] [--epochs <n>]` | Upload to Walrus and register; `-a` encrypts, `--public` is world-readable. |
-| `file register --blob-id <id> --name <n> --content-type <m> --size <bytes> [-a <id>] [--public] [--blob-object-id <id>]` | Register metadata for a blob already on Walrus. |
-| `file download <file> [--out <path>] [--seal-id <hex>] [--via-aggregator]` | Download content; decrypts in place when encrypted. |
-| `file get <file>` | Fetch a file's on-chain metadata. |
+| `file upload <path> --name <n> (--public \| --encrypt \| -r <addr>...) [--content-type <m>] [--epochs <n>]` | Upload to Walrus and register. `--public` is world-readable; `--encrypt` (or supplying `-r`) encrypts, and the sender is always a recipient. One of the three is required. |
+| `file register --blob-id <id> --name <n> --content-type <m> --size <bytes> (--public \| --encrypted --seal-prefix <hex>) [-r <addr>...] [--blob-object-id <id>]` | Register metadata for a blob already on Walrus. |
+| `file download [file] [--out <path>] [--share <s>] [--prefix <hex> --nonce <hex>] [--via-aggregator]` | Download content; decrypts in place with a share string (or prefix + nonce). |
+| `file list [--address <addr>] [--accessible] [--hydrate] [--limit <n>] [--indexer-url <url>]` | List files owned by (or, with `--accessible`, decryptable by) an address. |
+| `file get <file>` | Fetch a file's on-chain metadata and recipient list. |
 | `file update <file> --name <n> --content-type <m>` | Update name and MIME (owner only). |
-| `file transfer-ownership <file> <newOwner> [-y]` | Transfer the metadata right (not decrypt access). |
+| `file transfer-ownership <file> <newOwner> [-y]` | Transfer ownership (not recipient access, which the list governs). |
 | `file delete <file> [-y]` | Delete the metadata record (the Walrus blob expires on its own lease). |
-
-Encrypting a file (`file upload -a <allowlist>`) prints a **seal id**. It is not
-recoverable from the ciphertext, so save it: `file download` needs it (via
-`--seal-id`) plus allowlist membership to decrypt. Listing "files I can decrypt
-as a member" is not supported on-chain (encrypted files are shared objects with
-no owner index); track file ids yourself or index the contract events.
+| `file recipient add <file> <address>` | Allow an address to decrypt the file. |
+| `file recipient remove <file> <address>` | Revoke an address's access. |
+| `file recipient list <file>` | List the file's recipients. |
+
+An encrypted `file upload` prints a **share string** (`mf1.<fileId>.<prefix>.<nonce>`)
+that bundles the file id and the Seal prefix and nonce. The prefix and nonce are
+not recoverable from the ciphertext, so save the share string: `file download
+--share <s>` needs it (plus being on the recipient list) to decrypt. `--json`
+also returns the raw `sealIdPrefix` and `sealNonce` as hex, usable as `--prefix`
+/ `--nonce` if you prefer to pass them separately.
+
+`file list` reconstructs the file set from contract events. `RecipientFile`
+objects have no on-chain owner index for the shared case, so listing is
+event-derived, not a direct query. By default the command reads events via
+`suix_queryEvents` on the configured Sui RPC. That endpoint is **deprecated**
+(Mysten is sunsetting it), so listing may degrade or stop working on the public
+RPC over time; point `--indexer-url <url>` at any source that speaks
+`suix_queryEvents` (a self-hosted indexer, a third-party endpoint) to stay in
+control. Results are best-effort and eventually consistent (subject to indexer
+lag and retention). Summary rows omit `blobId`/`blobObjectId`; add `--hydrate`
+to fetch the full record per file (one read each) when you need them.
 
 ## Output and scripting
 
 - Human-readable output goes to stdout; progress, warnings, and prompts go to
   stderr. Redirecting stdout yields only the result.
 - `--json` emits a single JSON document on stdout (nothing else). `bigint` values
-  (e.g. `gasUsedMist`) are encoded as decimal strings and byte arrays (`sealId`,
-  quilt patch ids) as `0x`-hex.
+  (e.g. `gasUsedMist`) are encoded as decimal strings and byte arrays (quilt patch
+  ids) as `0x`-hex. Encrypted uploads also return `sealIdPrefix` / `sealNonce` as
+  hex and a `share` string.
 - Color is emitted only to a TTY and honors `NO_COLOR` and `FORCE_COLOR`.
 
 ## Exit codes
@@ -290,7 +296,7 @@ no owner index); track file ids yourself or index the contract events.
   - [`encrypt-decrypt.sh`](./examples/encrypt-decrypt.sh): encrypt with Seal and decrypt back.
   - [`delegation.sh`](./examples/delegation.sh): issue a PublisherCap to a delegate, then revoke it.
   - [`ci-noninteractive.sh`](./examples/ci-noninteractive.sh): env-var auth, `--yes`, and `--json` parsing.
-  - [`files.sh`](./examples/files.sh): allowlist + encrypted file round-trip (create allowlist, add a member, upload, download/decrypt, plus a public file).
+  - [`files.sh`](./examples/files.sh): RecipientFile round-trip (upload an encrypted file, download/decrypt via its share string, manage recipients, plus a public file).
 
 ## Limitations
 

package/dist/index.js

@@ -148,7 +148,7 @@ import { Command } from "commander";
 // package.json
 var package_default = {
   name: "@arcadiasystems/morse-cli",
-  version: "0.2.0",
+  version: "0.4.0",
   description: "Command-line interface for the Morse decentralized CMS on Sui.",
   license: "MIT",
   type: "module",
@@ -203,7 +203,7 @@ var package_default = {
     prepublishOnly: "bun run check && bun run build"
   },
   dependencies: {
-    "@arcadiasystems/morse-sdk": "^0.2.0",
+    "@arcadiasystems/morse-sdk": "^0.4.0",
     "@mysten/seal": "1.1.3",
     "@mysten/sui": "2.16.2",
     "@mysten/walrus": "1.1.6",
@@ -889,29 +889,30 @@ async function resolveActiveAccount(gopts) {
   return accountAddress(resolveSettings(gopts, await loadConfig()).account);
 }
 
-// src/commands/allowlist.ts
+// src/commands/cap.ts
 import {
-  addMember,
-  createAllowlist,
-  deleteAllowlist,
-  removeMember,
-  toAllowlistId,
+  destroyPublisherCap,
+  issuePublisherCap,
+  revokePublisherCap,
+  toPublisherCapId as toPublisherCapId2,
   toSuiAddress as toSuiAddress3,
-  transferAllowlistCap
+  transferPublisherCap
 } from "@arcadiasystems/morse-sdk";
 
 // src/cli/context.ts
 import {
+  buildRecipientFileEventTypes,
   DefaultSealAdapter,
   DefaultWalrusReadAdapter,
   DefaultWalrusWriteAdapter,
   HttpAggregatorReadAdapter,
   KeypairAdapter,
   morseConfig,
-  RpcFilesReader,
-  RpcPublicationReader
+  RpcPublicationReader,
+  RpcRecipientFilesReader
 } from "@arcadiasystems/morse-sdk";
 import { SuiGrpcClient } from "@mysten/sui/grpc";
+import { SuiJsonRpcClient } from "@mysten/sui/jsonRpc";
 async function buildReadContext(command) {
   const opts = globalOptions(command);
   const output = outputFor(command);
@@ -952,14 +953,9 @@ async function buildFilesReadContext(command) {
   const base = await buildReadContext(command);
   return {
     ...base,
-    filesReader: RpcFilesReader.fromMorseConfig(base.config, base.client)
-  };
-}
-async function buildAllowlistWriteContext(command) {
-  const base = await buildWriteContext(command);
-  return {
-    ...base,
-    filesReader: RpcFilesReader.fromMorseConfig(base.config, base.client)
+    filesReader: RpcRecipientFilesReader.fromConfig(base.client, {
+      packageId: base.config.packageId
+    })
   };
 }
 async function buildContentContext(command) {
@@ -1020,12 +1016,77 @@ async function buildFileDownloadContext(command, opts = {}) {
   }
   return {
     ...base,
-    filesReader: RpcFilesReader.fromMorseConfig(base.config, base.client),
+    filesReader: RpcRecipientFilesReader.fromConfig(base.client, {
+      packageId: base.config.packageId
+    }),
     walrusRead: walrusReadAdapter(base, network, Boolean(opts.viaAggregator)),
     seal: DefaultSealAdapter.fromMorseConfig(base.config, {}, base.client),
     unlockSigner: () => resolveSigner(base.settings.account, process.env, base.signal)
   };
 }
+async function buildFileListContext(command, opts = {}) {
+  const base = await buildReadContext(command);
+  const originPackageId = base.config.recipientFileEventOriginPackageId;
+  if (originPackageId === undefined) {
+    throw new CliError("File listing is unavailable on this network: no recipientFileEventOriginPackageId in the config. Use testnet, or supply a config that sets it.", ExitCode.Usage);
+  }
+  const events = new SuiJsonRpcClient({
+    network: base.settings.network,
+    url: opts.indexerUrl ?? base.config.rpcUrl
+  });
+  return {
+    ...base,
+    filesReader: RpcRecipientFilesReader.fromConfig(base.client, {
+      packageId: base.config.packageId
+    }),
+    events,
+    eventTypes: buildRecipientFileEventTypes(originPackageId)
+  };
+}
+
+// src/cli/target.ts
+import { toPublicationId } from "@arcadiasystems/morse-sdk";
+var OBJECT_ID = /^0x[0-9a-f]{1,64}$/i;
+var SLUG_PAGE_LIMIT = 50;
+async function resolvePublication(ctx, override) {
+  const value = override ?? ctx.settings.publication;
+  if (value === undefined) {
+    throw new UsageError("No publication selected. Pass --publication <slug|id> or run `morse use <slug|id>`.");
+  }
+  if (OBJECT_ID.test(value)) {
+    return toPublicationId(value.toLowerCase());
+  }
+  return resolveSlug(ctx, value);
+}
+function resolveCollection(ctx, override) {
+  const value = override ?? ctx.settings.collection;
+  if (value === undefined) {
+    throw new UsageError("No collection selected. Pass --collection <name> or run `morse use <slug|id> <collection>`.");
+  }
+  return value;
+}
+async function resolveSlug(ctx, slug) {
+  if (ctx.ownerAddress === undefined) {
+    throw new UsageError(`Cannot resolve the slug "${slug}" without an active account. Pass the publication id, or select an account.`);
+  }
+  ctx.output.info(`Resolving slug "${slug}" among owned publications...`);
+  let cursor;
+  do {
+    const page = await ctx.reader.listPublicationsOwnedBy(ctx.ownerAddress, {
+      limit: SLUG_PAGE_LIMIT,
+      signal: ctx.signal,
+      ...cursor === undefined ? {} : { cursor }
+    });
+    for (const owned of page.results) {
+      const publication = await ctx.reader.getPublication(owned.publicationId, ctx.signal);
+      if (publication.slug === slug) {
+        return publication.id;
+      }
+    }
+    cursor = page.nextCursor ?? undefined;
+  } while (cursor !== undefined);
+  throw new UsageError(`No publication with slug "${slug}" owned by the active account. Pass the publication id instead.`);
+}
 
 // src/format/ids.ts
 var HEAD = 6;
@@ -1094,36 +1155,30 @@ function renderEntryList(entries) {
   return entries.map((entry) => `#${entry.id} ${entry.name} (${entry.revisions.length} revisions)`).join(`
 `);
 }
-function renderAllowlist(allowlist) {
-  const members = allowlist.members.length === 0 ? "(none)" : allowlist.members.map((m) => `  ${m}`).join(`
-`);
-  return [
-    `${allowlist.name} (${shortId(allowlist.id)})`,
-    `members (${allowlist.members.length}):`,
-    members
-  ].join(`
-`);
-}
-function renderAllowlistCapList(caps) {
-  if (caps.length === 0) {
-    return "No allowlist caps held by this address.";
+function renderFileList(items) {
+  if (items.length === 0) {
+    return "No files.";
   }
-  return caps.map((cap) => `${cap.id}  allowlist ${cap.allowlistId}`).join(`
+  const header = "id  name  size  recipients  created";
+  const rows = items.map((file) => {
+    const created = new Date(file.createdAtMs).toISOString().slice(0, 10);
+    return `${shortId(file.id)}  ${file.name}  ${file.size}  ${file.members.length}  ${created}`;
+  });
+  return [header, ...rows].join(`
 `);
 }
-function renderEncryptedFile(file) {
-  const lines = [
+function renderRecipientFile(file) {
+  const recipients = file.members.length === 0 ? "(none)" : file.members.map((m) => `  ${m}`).join(`
+`);
+  return [
     `${file.name} (${shortId(file.id)})`,
     `contentType: ${file.contentType}`,
     `size:        ${file.size}`,
-    `encrypted:   ${file.encrypted}`,
     `blobId:      ${file.blobId}`,
-    `owner:       ${file.owner}`
-  ];
-  if (file.allowlistId !== null) {
-    lines.push(`allowlist:   ${file.allowlistId}`);
-  }
-  return lines.join(`
+    `owner:       ${file.owner}`,
+    `recipients (${file.members.length}):`,
+    recipients
+  ].join(`
 `);
 }
 function headLabel(value) {
@@ -1148,11 +1203,11 @@ function publisherCapOption(command) {
 function ownerCapOption(command) {
   return command.option("--owner-cap <id>", "OwnerCap ID (auto-resolved if omitted)");
 }
-function allowlistOption(command) {
-  return command.option("-a, --allowlist <id>", "Allowlist object id");
+function collect(value, previous) {
+  return [...previous, value];
 }
-function allowlistCapOption(command) {
-  return command.option("--cap <id>", "Allowlist admin Cap id (auto-resolved from owned caps if omitted)");
+function recipientOption(command) {
+  return command.option("-r, --recipient <addr>", "Recipient address allowed to decrypt (repeatable); the sender is always added", collect, []);
 }
 function viaAggregatorOption(command) {
   return command.option("--via-aggregator", "Fetch content via the Walrus aggregator HTTP service. More reliable when storage nodes are flaky; no client-side blob verification.");
@@ -1163,7 +1218,6 @@ function contentOptions(command) {
 
 // src/commands/resolve.ts
 import {
-  toAllowlistCapId,
   toOwnerCapId,
   toPublisherCapId
 } from "@arcadiasystems/morse-sdk";
@@ -1206,25 +1260,6 @@ async function resolvePublisherCap(reader, address, publicationId, override, sig
   } while (cursor !== undefined);
   throw new CliError(`No PublisherCap for ${publicationId} held by ${address}. Pass --publisher-cap, or check that the active account holds one.`, ExitCode.NotFound);
 }
-async function resolveAllowlistCap(filesReader, address, allowlistId, override, signal) {
-  if (override !== undefined) {
-    return toAllowlistCapId(override);
-  }
-  let cursor;
-  do {
-    const page = await filesReader.listAllowlistCapsOwnedBy(address, {
-      limit: PAGE_LIMIT,
-      signal,
-      ...cursor === undefined ? {} : { cursor }
-    });
-    const match = page.results.find((c) => c.allowlistId === allowlistId);
-    if (match !== undefined) {
-      return match.id;
-    }
-    cursor = page.nextCursor ?? undefined;
-  } while (cursor !== undefined);
-  throw new CliError(`No allowlist Cap for ${allowlistId} held by ${address}. Pass --cap, or check that the active account administers it.`, ExitCode.NotFound);
-}
 
 // src/commands/shared.ts
 import { StorageMode } from "@arcadiasystems/morse-sdk";
@@ -1249,7 +1284,7 @@ function parseByteSize(value, name) {
   if (!/^\d+$/.test(value)) {
     throw new UsageError(`${name} must be a non-negative integer, got "${value}".`);
   }
-  return BigInt(value);
+  return Number(value);
 }
 function parseId(value, name) {
   const id = Number(value);
@@ -1259,191 +1294,9 @@ function parseId(value, name) {
   return id;
 }
 
-// src/commands/allowlist.ts
-function requireAllowlistId(value) {
-  if (value === undefined) {
-    throw new UsageError("Pass --allowlist <id>.");
-  }
-  return toAllowlistId(value);
-}
-async function runAllowlistCreate(ctx, options) {
-  ctx.output.info(`Creating allowlist "${options.name}"...`);
-  const result = await createAllowlist(ctx.adapter, ctx.config, {
-    name: options.name,
-    signal: ctx.signal
-  });
-  const human = [
-    `Created allowlist "${options.name}" (${result.allowlistId})`,
-    `  cap: ${result.capId}`,
-    `  tx:  ${result.digest}`,
-    "Save the cap id: it is the admin token for managing members."
-  ].join(`
-`);
-  ctx.output.result(human, result);
-}
-async function runAllowlistAddMember(ctx, member, options) {
-  const allowlistId = requireAllowlistId(options.allowlist);
-  const memberAddress = toSuiAddress3(member);
-  const capId = await resolveAllowlistCap(ctx.filesReader, ctx.address, allowlistId, options.cap, ctx.signal);
-  const result = await addMember(ctx.adapter, ctx.config, {
-    allowlistId,
-    capId,
-    member: memberAddress,
-    signal: ctx.signal
-  });
-  ctx.output.result(`Added ${memberAddress} to allowlist ${shortId(allowlistId)}. (tx: ${result.digest})`, result);
-}
-async function runAllowlistRemoveMember(ctx, member, options) {
-  const allowlistId = requireAllowlistId(options.allowlist);
-  const memberAddress = toSuiAddress3(member);
-  const capId = await resolveAllowlistCap(ctx.filesReader, ctx.address, allowlistId, options.cap, ctx.signal);
-  const result = await removeMember(ctx.adapter, ctx.config, {
-    allowlistId,
-    capId,
-    member: memberAddress,
-    signal: ctx.signal
-  });
-  ctx.output.result(`Removed ${memberAddress} from allowlist ${shortId(allowlistId)}. (tx: ${result.digest})`, result);
-}
-async function runAllowlistTransferCap(ctx, recipient, options, gopts) {
-  const allowlistId = requireAllowlistId(options.allowlist);
-  const to = toSuiAddress3(recipient);
-  const proceed = await confirm(`Transfer admin of allowlist ${shortId(allowlistId)} to ${to}? You will lose member-management rights.`, { assumeYes: Boolean(gopts.yes), signal: ctx.signal });
-  if (!proceed) {
-    cancelled();
-  }
-  ctx.output.info("Resolving allowlist Cap...");
-  const capId = await resolveAllowlistCap(ctx.filesReader, ctx.address, allowlistId, options.cap, ctx.signal);
-  const result = await transferAllowlistCap(ctx.adapter, ctx.config, {
-    capId,
-    recipient: to,
-    signal: ctx.signal
-  });
-  ctx.output.result(`Transferred allowlist admin to ${to}. (tx: ${result.digest})`, result);
-}
-async function runAllowlistDelete(ctx, options, gopts) {
-  const allowlistId = requireAllowlistId(options.allowlist);
-  const proceed = await confirm(`Delete allowlist ${shortId(allowlistId)}? Files gated by it become permanently undecryptable.`, { assumeYes: Boolean(gopts.yes), signal: ctx.signal });
-  if (!proceed) {
-    cancelled();
-  }
-  ctx.output.info("Resolving allowlist Cap...");
-  const capId = await resolveAllowlistCap(ctx.filesReader, ctx.address, allowlistId, options.cap, ctx.signal);
-  const result = await deleteAllowlist(ctx.adapter, ctx.config, {
-    allowlistId,
-    capId,
-    signal: ctx.signal
-  });
-  ctx.output.result(`Deleted allowlist ${allowlistId}. (tx: ${result.digest})`, result);
-}
-async function runAllowlistGet(ctx, target) {
-  const result = await ctx.filesReader.getAllowlist(toAllowlistId(target), ctx.signal);
-  ctx.output.result(renderAllowlist(result), result);
-}
-async function runAllowlistListCaps(ctx, address, options) {
-  const holder = address === undefined ? ctx.ownerAddress : toSuiAddress3(address);
-  if (holder === undefined) {
-    throw new UsageError("No address given and no active account. Pass an address or import an account.");
-  }
-  const page = await ctx.filesReader.listAllowlistCapsOwnedBy(holder, {
-    signal: ctx.signal,
-    ...options.limit === undefined ? {} : { limit: parseLimit(options.limit) },
-    ...options.cursor === undefined ? {} : { cursor: options.cursor }
-  });
-  if (page.nextCursor !== null) {
-    ctx.output.info(`More results: pass --cursor "${page.nextCursor}"`);
-  }
-  ctx.output.result(renderAllowlistCapList(page.results), {
-    results: page.results,
-    nextCursor: page.nextCursor
-  });
-}
-function registerAllowlistCommands(program) {
-  const allowlist = program.command("allowlist").description("Manage allowlists that gate decryption of encrypted files");
-  allowlist.command("create").description("Create an allowlist and transfer its admin cap to you").requiredOption("-n, --name <name>", "Allowlist name").action(async (options, command) => {
-    await runAllowlistCreate(await buildWriteContext(command), options);
-  });
-  const addMemberCmd = allowlist.command("add-member <member>").description("Add a wallet address to an allowlist");
-  allowlistCapOption(allowlistOption(addMemberCmd)).action(async (member, options, command) => {
-    await runAllowlistAddMember(await buildAllowlistWriteContext(command), member, options);
-  });
-  const removeMemberCmd = allowlist.command("remove-member <member>").description("Remove a wallet address from an allowlist");
-  allowlistCapOption(allowlistOption(removeMemberCmd)).action(async (member, options, command) => {
-    await runAllowlistRemoveMember(await buildAllowlistWriteContext(command), member, options);
-  });
-  const transferCmd = allowlist.command("transfer-cap <recipient>").description("Transfer allowlist admin rights to another address");
-  allowlistCapOption(allowlistOption(transferCmd)).action(async (recipient, options, command) => {
-    await runAllowlistTransferCap(await buildAllowlistWriteContext(command), recipient, options, globalOptions(command));
-  });
-  const deleteCmd = allowlist.command("delete").description("Delete an allowlist (dependent files become undecryptable)");
-  allowlistCapOption(allowlistOption(deleteCmd)).action(async (options, command) => {
-    await runAllowlistDelete(await buildAllowlistWriteContext(command), options, globalOptions(command));
-  });
-  allowlist.command("get <allowlist>").description("Fetch an allowlist's name and members").action(async (target, _options, command) => {
-    await runAllowlistGet(await buildFilesReadContext(command), target);
-  });
-  allowlist.command("list-caps [address]").description("List allowlist admin caps held by an address (default: the active account)").option("--limit <n>", "Maximum results per page").option("--cursor <cursor>", "Continue from a previous page cursor").action(async (address, options, command) => {
-    await runAllowlistListCaps(await buildFilesReadContext(command), address, options);
-  });
-}
-
-// src/commands/cap.ts
-import {
-  destroyPublisherCap,
-  issuePublisherCap,
-  revokePublisherCap,
-  toPublisherCapId as toPublisherCapId2,
-  toSuiAddress as toSuiAddress4,
-  transferPublisherCap
-} from "@arcadiasystems/morse-sdk";
-
-// src/cli/target.ts
-import { toPublicationId } from "@arcadiasystems/morse-sdk";
-var OBJECT_ID = /^0x[0-9a-f]{1,64}$/i;
-var SLUG_PAGE_LIMIT = 50;
-async function resolvePublication(ctx, override) {
-  const value = override ?? ctx.settings.publication;
-  if (value === undefined) {
-    throw new UsageError("No publication selected. Pass --publication <slug|id> or run `morse use <slug|id>`.");
-  }
-  if (OBJECT_ID.test(value)) {
-    return toPublicationId(value.toLowerCase());
-  }
-  return resolveSlug(ctx, value);
-}
-function resolveCollection(ctx, override) {
-  const value = override ?? ctx.settings.collection;
-  if (value === undefined) {
-    throw new UsageError("No collection selected. Pass --collection <name> or run `morse use <slug|id> <collection>`.");
-  }
-  return value;
-}
-async function resolveSlug(ctx, slug) {
-  if (ctx.ownerAddress === undefined) {
-    throw new UsageError(`Cannot resolve the slug "${slug}" without an active account. Pass the publication id, or select an account.`);
-  }
-  ctx.output.info(`Resolving slug "${slug}" among owned publications...`);
-  let cursor;
-  do {
-    const page = await ctx.reader.listPublicationsOwnedBy(ctx.ownerAddress, {
-      limit: SLUG_PAGE_LIMIT,
-      signal: ctx.signal,
-      ...cursor === undefined ? {} : { cursor }
-    });
-    for (const owned of page.results) {
-      const publication = await ctx.reader.getPublication(owned.publicationId, ctx.signal);
-      if (publication.slug === slug) {
-        return publication.id;
-      }
-    }
-    cursor = page.nextCursor ?? undefined;
-  } while (cursor !== undefined);
-  throw new UsageError(`No publication with slug "${slug}" owned by the active account. Pass the publication id instead.`);
-}
-
 // src/commands/cap.ts
 async function runCapList(ctx, address, options) {
-  const holder = address === undefined ? ctx.ownerAddress : toSuiAddress4(address);
+  const holder = address === undefined ? ctx.ownerAddress : toSuiAddress3(address);
   if (holder === undefined) {
     throw new UsageError("No address given and no active account. Pass an address or import an account.");
   }
@@ -1462,7 +1315,7 @@ async function runCapList(ctx, address, options) {
 }
 async function runCapIssue(ctx, holder, options) {
   const id = await resolvePublication(ctx, options.publication);
-  const holderAddress = toSuiAddress4(holder);
+  const holderAddress = toSuiAddress3(holder);
   ctx.output.info("Resolving OwnerCap...");
   const ownerCapId = await resolveOwnerCap(ctx.reader, ctx.address, id, options.ownerCap, ctx.signal);
   const result = await issuePublisherCap(ctx.adapter, ctx.config, {
@@ -1506,7 +1359,7 @@ async function runCapDestroy(ctx, publisherCapId, options, gopts) {
 }
 async function runCapTransfer(ctx, publisherCapId, recipient, gopts) {
   const capId = toPublisherCapId2(publisherCapId);
-  const to = toSuiAddress4(recipient);
+  const to = toSuiAddress3(recipient);
   const proceed = await confirm(`Transfer PublisherCap ${capId} to ${to}?`, {
     assumeYes: Boolean(gopts.yes),
     signal: ctx.signal
@@ -1993,22 +1846,57 @@ function registerEntryCommands(program) {
 
 // src/commands/file.ts
 import {
-  buildAllowlistSealId,
-  createEncryptedFile,
-  createPublicFile,
-  deleteFile,
-  toAllowlistId as toAllowlistId2,
+  addRecipient,
+  buildRecipientFileSealId,
+  createEncryptedRecipientFile,
+  createRecipientFile,
+  deleteRecipientFile,
+  reconcileRecipientFilesAccessibleBy,
+  reconcileRecipientFilesOwnedBy,
+  removeRecipient,
   toBlobObjectId,
-  toEncryptedFileId,
-  toSuiAddress as toSuiAddress5,
+  toRecipientFileId,
+  toSuiAddress as toSuiAddress4,
   toWalrusBlobId,
-  transferFileOwnership,
-  updateFileMetadata,
-  uploadEncryptedFileFromBytes,
-  uploadPublicFileFromBytes
+  transferRecipientFileOwnership,
+  updateRecipientFileMetadata,
+  uploadEncryptedRecipientFileFromBytes,
+  uploadRecipientFileFromBytes
 } from "@arcadiasystems/morse-sdk";
 import { SessionKey as SessionKey2 } from "@mysten/seal";
 
+// src/cli/events.ts
+var PAGE_LIMIT2 = 50;
+async function fetchEventStream(client, eventType, signal) {
+  const out = [];
+  let cursor;
+  for (;; ) {
+    const page = await client.queryEvents({
+      query: { MoveEventType: eventType },
+      limit: PAGE_LIMIT2,
+      order: "descending",
+      ...cursor === undefined ? {} : { cursor },
+      ...signal === undefined ? {} : { signal }
+    });
+    for (const event of page.data) {
+      out.push({
+        type: event.type,
+        json: event.parsedJson ?? {},
+        timestampMs: event.timestampMs == null ? 0 : Number(event.timestampMs)
+      });
+    }
+    if (!page.hasNextPage || page.nextCursor === null || page.nextCursor === undefined) {
+      break;
+    }
+    cursor = page.nextCursor;
+  }
+  return out;
+}
+async function fetchEventStreams(client, eventTypes, signal) {
+  const streams = await Promise.all(eventTypes.map((type) => fetchEventStream(client, type, signal)));
+  return streams.flat();
+}
+
 // src/format/hex.ts
 var HEX = /^[0-9a-fA-F]+$/;
 function encodeHex(bytes) {
@@ -2030,9 +1918,35 @@ function decodeHex(value) {
   return bytes;
 }
 
+// src/format/share.ts
+var VERSION = "mf1";
+function b64url(bytes) {
+  return Buffer.from(bytes).toString("base64url");
+}
+function encodeShare(fileId, prefix, nonce) {
+  return [
+    VERSION,
+    Buffer.from(fileId, "utf8").toString("base64url"),
+    b64url(prefix),
+    b64url(nonce)
+  ].join(".");
+}
+function decodeShare(value) {
+  const parts = value.split(".");
+  if (parts.length !== 4 || parts[0] !== VERSION) {
+    throw new UsageError(`Invalid share string: expected "${VERSION}.<fileId>.<prefix>.<nonce>".`);
+  }
+  const fileId = Buffer.from(parts[1] ?? "", "base64url").toString("utf8");
+  const prefix = new Uint8Array(Buffer.from(parts[2] ?? "", "base64url"));
+  const nonce = new Uint8Array(Buffer.from(parts[3] ?? "", "base64url"));
+  if (fileId.length === 0 || prefix.length === 0 || nonce.length === 0) {
+    throw new UsageError("Invalid share string: a bundled field was empty.");
+  }
+  return { fileId, prefix, nonce };
+}
+
 // src/commands/file.ts
 var SESSION_KEY_TTL_MIN2 = 10;
-var SEAL_NONCE_BYTES2 = 16;
 function uploadProgress(output) {
   const labels = {
     encrypting: "Encrypting...",
@@ -2048,42 +1962,47 @@ function uploadProgress(output) {
   };
 }
 async function runFileGet(ctx, target) {
-  const result = await ctx.filesReader.getEncryptedFile(toEncryptedFileId(target), ctx.signal);
-  ctx.output.result(renderEncryptedFile(result), result);
+  const result = await ctx.filesReader.getRecipientFile(toRecipientFileId(target), ctx.signal);
+  ctx.output.result(renderRecipientFile(result), result);
 }
 async function runFileRegister(ctx, options) {
-  if (options.allowlist === undefined && options.public !== true) {
-    throw new UsageError("Pass --allowlist <id> to register an encrypted file, or --public for a world-readable one.");
+  if (options.public && options.encrypted) {
+    throw new UsageError("Pass --public or --encrypted, not both.");
   }
+  const recipients = (options.recipient ?? []).map((r) => toSuiAddress4(r));
   const blobId = toWalrusBlobId(options.blobId);
   const size = parseByteSize(options.size, "--size");
   const blobObjectId = options.blobObjectId === undefined ? undefined : toBlobObjectId(options.blobObjectId);
-  if (options.allowlist !== undefined) {
-    const result2 = await createEncryptedFile(ctx.adapter, ctx.config, {
-      allowlistId: toAllowlistId2(options.allowlist),
-      blobId,
-      ...blobObjectId === undefined ? {} : { blobObjectId },
-      name: options.name,
-      contentType: options.contentType,
-      size,
-      signal: ctx.signal
-    });
-    ctx.output.result(`Registered encrypted file ${result2.fileId}. (tx: ${result2.digest})`, result2);
-    return;
-  }
-  const result = await createPublicFile(ctx.adapter, ctx.config, {
+  const common = {
     blobId,
     ...blobObjectId === undefined ? {} : { blobObjectId },
     name: options.name,
     contentType: options.contentType,
     size,
+    recipients,
     signal: ctx.signal
-  });
-  ctx.output.result(`Registered public file ${result.fileId}. (tx: ${result.digest})`, result);
+  };
+  if (options.encrypted) {
+    if (options.sealPrefix === undefined) {
+      throw new UsageError("--encrypted requires --seal-prefix <hex> (the prefix the blob was encrypted under).");
+    }
+    const result = await createEncryptedRecipientFile(ctx.adapter, ctx.config, {
+      ...common,
+      sealIdPrefix: decodeHex(options.sealPrefix)
+    });
+    ctx.output.result(`Registered encrypted file ${result.fileId}. (tx: ${result.digest})`, result);
+    return;
+  }
+  if (options.public) {
+    const result = await createRecipientFile(ctx.adapter, ctx.config, common);
+    ctx.output.result(`Registered public file ${result.fileId}. (tx: ${result.digest})`, result);
+    return;
+  }
+  throw new UsageError("Pass --public for a world-readable file, or --encrypted --seal-prefix <hex>.");
 }
 async function runFileUpdate(ctx, target, options) {
-  const result = await updateFileMetadata(ctx.adapter, ctx.config, {
-    fileId: toEncryptedFileId(target),
+  const result = await updateRecipientFileMetadata(ctx.adapter, ctx.config, {
+    fileId: toRecipientFileId(target),
     name: options.name,
     contentType: options.contentType,
     signal: ctx.signal
@@ -2091,13 +2010,13 @@ async function runFileUpdate(ctx, target, options) {
   ctx.output.result(`Updated file ${shortId(target)} metadata. (tx: ${result.digest})`, result);
 }
 async function runFileTransferOwnership(ctx, target, newOwner, gopts) {
-  const fileId = toEncryptedFileId(target);
-  const to = toSuiAddress5(newOwner);
-  const proceed = await confirm(`Transfer metadata ownership of file ${shortId(fileId)} to ${to}? Decryption access is governed separately by the allowlist.`, { assumeYes: Boolean(gopts.yes), signal: ctx.signal });
+  const fileId = toRecipientFileId(target);
+  const to = toSuiAddress4(newOwner);
+  const proceed = await confirm(`Transfer ownership of file ${shortId(fileId)} to ${to}? Recipient access is governed separately by the recipient list.`, { assumeYes: Boolean(gopts.yes), signal: ctx.signal });
   if (!proceed) {
     cancelled();
   }
-  const result = await transferFileOwnership(ctx.adapter, ctx.config, {
+  const result = await transferRecipientFileOwnership(ctx.adapter, ctx.config, {
     fileId,
     newOwner: to,
     signal: ctx.signal
@@ -2105,76 +2024,140 @@ async function runFileTransferOwnership(ctx, target, newOwner, gopts) {
   ctx.output.result(`Transferred file ownership to ${to}. (tx: ${result.digest})`, result);
 }
 async function runFileDelete(ctx, target, gopts) {
-  const fileId = toEncryptedFileId(target);
-  const proceed = await confirm(`Delete file metadata ${shortId(fileId)}? The Walrus blob is not deleted; it expires on its own lease.`, { assumeYes: Boolean(gopts.yes), signal: ctx.signal });
+  const fileId = toRecipientFileId(target);
+  const proceed = await confirm(`Delete file ${shortId(fileId)}? The Walrus blob is not deleted; it expires on its own lease.`, { assumeYes: Boolean(gopts.yes), signal: ctx.signal });
   if (!proceed) {
     cancelled();
   }
-  const result = await deleteFile(ctx.adapter, ctx.config, {
+  const result = await deleteRecipientFile(ctx.adapter, ctx.config, {
     fileId,
     signal: ctx.signal
   });
   ctx.output.result(`Deleted file ${fileId}. (tx: ${result.digest})`, result);
 }
+async function runFileRecipientAdd(ctx, target, recipient) {
+  const fileId = toRecipientFileId(target);
+  const member = toSuiAddress4(recipient);
+  const result = await addRecipient(ctx.adapter, ctx.config, {
+    fileId,
+    recipient: member,
+    signal: ctx.signal
+  });
+  ctx.output.result(`Added ${member} to file ${shortId(fileId)}. (tx: ${result.digest})`, result);
+}
+async function runFileRecipientRemove(ctx, target, recipient) {
+  const fileId = toRecipientFileId(target);
+  const member = toSuiAddress4(recipient);
+  const result = await removeRecipient(ctx.adapter, ctx.config, {
+    fileId,
+    recipient: member,
+    signal: ctx.signal
+  });
+  ctx.output.result(`Removed ${member} from file ${shortId(fileId)}. (tx: ${result.digest})`, result);
+}
+async function runFileRecipientList(ctx, target) {
+  const file = await ctx.filesReader.getRecipientFile(toRecipientFileId(target), ctx.signal);
+  const human = file.members.length === 0 ? "No recipients." : file.members.join(`
+`);
+  ctx.output.result(human, { fileId: file.id, recipients: file.members });
+}
 async function runFileUpload(ctx, path, options) {
-  if (options.allowlist === undefined && options.public !== true) {
-    throw new UsageError("Pass --allowlist <id> to upload an encrypted file, or --public for a world-readable one.");
+  if (options.public && options.encrypt) {
+    throw new UsageError("Pass --public or --encrypt, not both.");
+  }
+  const recipients = (options.recipient ?? []).map((r) => toSuiAddress4(r));
+  if (options.public && recipients.length > 0) {
+    throw new UsageError("--recipient applies to encrypted uploads; a public file is readable by anyone.");
+  }
+  if (!options.public && !options.encrypt && recipients.length === 0) {
+    throw new UsageError("Pass --public for a world-readable file, or --encrypt (optionally with --recipient <addr>).");
   }
   const epochs = parsePositiveInt(options.epochs ?? "3", "--epochs");
   const bytes = await readContentBytes({ file: path });
   const contentType = resolveContentType(options.contentType, path);
   const upload = { epochs, deletable: true };
   const onProgress = uploadProgress(ctx.output);
-  if (options.allowlist !== undefined) {
-    const allowlistId = toAllowlistId2(options.allowlist);
-    const sealId = buildAllowlistSealId(allowlistId, crypto.getRandomValues(new Uint8Array(SEAL_NONCE_BYTES2)));
-    const result2 = await uploadEncryptedFileFromBytes(ctx.adapter, ctx.config, {
+  if (options.public) {
+    const result2 = await uploadRecipientFileFromBytes(ctx.adapter, ctx.config, {
       walrus: ctx.walrus,
-      seal: ctx.seal,
-      allowlistId,
-      sealId,
-      plaintext: bytes,
+      bytes,
+      recipients: [],
       name: options.name,
       contentType,
       upload,
       signal: ctx.signal,
       onProgress
     });
-    const sealIdHex = encodeHex(sealId);
-    const human2 = [
-      `Uploaded encrypted file ${result2.fileId}`,
-      `  blobId: ${result2.blobId}`,
-      `  sealId: ${sealIdHex}`,
-      `  tx:     ${result2.digest}`,
-      "Save the seal id: decrypting later needs it plus allowlist membership."
-    ].join(`
-`);
-    ctx.output.result(human2, { ...result2, sealId: sealIdHex });
+    const aggregator = ctx.config.walrusEndpoints.aggregator;
+    const viewUrl = aggregator.length > 0 ? `${aggregator}/v1/blobs/${result2.blobId}` : undefined;
+    const human2 = viewUrl === undefined ? `Uploaded public file ${result2.fileId}. (tx: ${result2.digest})` : `Uploaded public file ${result2.fileId}. (tx: ${result2.digest})
+  view: ${viewUrl}`;
+    ctx.output.result(human2, { ...result2, viewUrl: viewUrl ?? null });
     return;
   }
-  const result = await uploadPublicFileFromBytes(ctx.adapter, ctx.config, {
+  const result = await uploadEncryptedRecipientFileFromBytes(ctx.adapter, ctx.config, {
     walrus: ctx.walrus,
-    bytes,
+    seal: ctx.seal,
+    plaintext: bytes,
+    recipients,
     name: options.name,
     contentType,
     upload,
     signal: ctx.signal,
     onProgress
   });
-  const aggregator = ctx.config.walrusEndpoints.aggregator;
-  const viewUrl = aggregator.length > 0 ? `${aggregator}/v1/blobs/${result.blobId}` : undefined;
-  const human = viewUrl === undefined ? `Uploaded public file ${result.fileId}. (tx: ${result.digest})` : `Uploaded public file ${result.fileId}. (tx: ${result.digest})
-  view: ${viewUrl}`;
-  ctx.output.result(human, { ...result, viewUrl: viewUrl ?? null });
-}
-async function decryptFile(ctx, file, ciphertext, sealIdHex) {
-  if (sealIdHex === undefined) {
-    throw new UsageError("This file is encrypted; pass --seal-id <hex> (printed when the file was uploaded).");
+  const prefixHex = encodeHex(result.sealIdPrefix);
+  const nonceHex = encodeHex(result.sealNonce);
+  const share = encodeShare(result.fileId, result.sealIdPrefix, result.sealNonce);
+  const human = [
+    `Uploaded encrypted file ${result.fileId}`,
+    `  blobId: ${result.blobId}`,
+    `  share:  ${share}`,
+    `  tx:     ${result.digest}`,
+    "Give the share string to recipients; they need it (plus membership) to decrypt."
+  ].join(`
+`);
+  ctx.output.result(human, {
+    fileId: result.fileId,
+    blobId: result.blobId,
+    blobObjectId: result.blobObjectId,
+    digest: result.digest,
+    gasUsedMist: result.gasUsedMist,
+    sealIdPrefix: prefixHex,
+    sealNonce: nonceHex,
+    share
+  });
+}
+function resolveDownloadTarget(positional, options) {
+  if (options.share !== undefined) {
+    const decoded = decodeShare(options.share);
+    if (positional !== undefined && String(toRecipientFileId(positional)) !== String(toRecipientFileId(decoded.fileId))) {
+      throw new UsageError("The <file> argument does not match the file id in --share.");
+    }
+    return {
+      fileId: decoded.fileId,
+      decrypt: { prefix: decoded.prefix, nonce: decoded.nonce }
+    };
+  }
+  if (positional === undefined) {
+    throw new UsageError("Pass a <file> id, or --share <string>.");
   }
-  if (file.allowlistId === null) {
-    throw new UsageError(`File ${file.id} is marked encrypted but carries no allowlist; it cannot be decrypted.`);
+  if (options.prefix !== undefined || options.nonce !== undefined) {
+    if (options.prefix === undefined || options.nonce === undefined) {
+      throw new UsageError("Decrypting needs both --prefix and --nonce (or use --share).");
+    }
+    return {
+      fileId: positional,
+      decrypt: {
+        prefix: decodeHex(options.prefix),
+        nonce: decodeHex(options.nonce)
+      }
+    };
   }
-  const sealId = decodeHex(sealIdHex);
+  return { fileId: positional };
+}
+async function decryptRecipientFile(ctx, fileId, ciphertext, prefix, nonce) {
+  const sealId = buildRecipientFileSealId(prefix, nonce);
   const { keypair, address } = await ctx.unlockSigner();
   ctx.output.info("Signing a SessionKey with the active account...");
   const sessionKey = await SessionKey2.create({
@@ -2184,24 +2167,29 @@ async function decryptFile(ctx, file, ciphertext, sealIdHex) {
     signer: keypair,
     suiClient: ctx.client
   });
-  return ctx.seal.decryptUnderAllowlist(ciphertext, {
+  return ctx.seal.decryptUnderRecipientFile(ciphertext, {
+    sessionKey,
     sealId,
-    allowlistId: file.allowlistId,
-    sessionKey
+    fileId
   });
 }
-async function runFileDownload(ctx, target, options) {
+async function runFileDownload(ctx, positional, options) {
   if (ctx.output.isJson && options.out === undefined) {
     throw new UsageError("Downloading content to stdout is not supported in --json mode; pass --out <path>.");
   }
-  const file = await ctx.filesReader.getEncryptedFile(toEncryptedFileId(target), ctx.signal);
+  const target = resolveDownloadTarget(positional, options);
+  const fileId = toRecipientFileId(target.fileId);
+  const file = await ctx.filesReader.getRecipientFile(fileId, ctx.signal);
+  if (target.decrypt === undefined && file.members.length > 0) {
+    ctx.output.warn("This file has a recipient list, so its bytes are likely encrypted. Pass --share (or --prefix and --nonce) to decrypt; writing the raw bytes as-is.");
+  }
   ctx.output.info("Fetching content from Walrus...");
   const bytes = await ctx.walrusRead.readBlob(file.blobId, {
     signal: ctx.signal
   });
   let content = bytes;
-  if (file.encrypted) {
-    content = await decryptFile(ctx, file, bytes, options.sealId);
+  if (target.decrypt !== undefined) {
+    content = await decryptRecipientFile(ctx, fileId, bytes, target.decrypt.prefix, target.decrypt.nonce);
   }
   if (options.out !== undefined) {
     await writeFileContents(options.out, content);
@@ -2216,13 +2204,57 @@ async function runFileDownload(ctx, target, options) {
   }
   process.stdout.write(content);
 }
+async function runFileList(ctx, options) {
+  const limit = options.limit === undefined ? undefined : parseLimit(options.limit);
+  const address = options.address === undefined ? ctx.ownerAddress : toSuiAddress4(options.address);
+  if (address === undefined) {
+    throw new UsageError("No address given and no active account. Pass --address or import an account.");
+  }
+  const types = ctx.eventTypes;
+  let summaries;
+  if (options.accessible) {
+    ctx.output.info("Fetching recipient and file events...");
+    const events = await fetchEventStreams(ctx.events, [
+      types.RecipientFileCreated,
+      types.RecipientAdded,
+      types.RecipientRemoved,
+      types.RecipientFileDeleted
+    ], ctx.signal);
+    summaries = reconcileRecipientFilesAccessibleBy(events, address, types);
+  } else {
+    ctx.output.info("Fetching file events...");
+    const events = await fetchEventStreams(ctx.events, [
+      types.RecipientFileCreated,
+      types.RecipientFileOwnershipTransferred,
+      types.RecipientFileDeleted
+    ], ctx.signal);
+    summaries = reconcileRecipientFilesOwnedBy(events, address, types);
+  }
+  const limited = limit === undefined ? summaries : summaries.slice(0, limit);
+  let items = limited;
+  if (options.hydrate) {
+    ctx.output.info(`Hydrating ${limited.length} file(s)...`);
+    const full = [];
+    for (const summary of limited) {
+      const record = await ctx.filesReader.getRecipientFile(summary.id, ctx.signal);
+      full.push({ ...record, kind: "full" });
+    }
+    items = full;
+  }
+  ctx.output.result(renderFileList(items), items);
+}
 function registerFileCommands(program) {
-  const file = program.command("file").description("Upload, register, read, and manage files on Walrus");
-  const upload = file.command("upload <path>").description("Encrypt (or not), upload to Walrus, and register a file").requiredOption("-n, --name <name>", "File name").option("--public", "Upload a world-readable (unencrypted) file").option("--content-type <mime>", "MIME content type (inferred from the path if omitted)").option("--epochs <n>", "Walrus storage epochs", "3");
-  allowlistOption(upload).action(async (path, options, command) => {
+  const file = program.command("file").description("Upload, register, read, list, and manage files on Walrus");
+  const upload = file.command("upload <path>").description("Encrypt (or not), upload to Walrus, and register a file").requiredOption("-n, --name <name>", "File name").option("--public", "Upload a world-readable (unencrypted) file").option("--encrypt", "Encrypt the file (implied when --recipient is given)").option("--content-type <mime>", "MIME content type (inferred from the path if omitted)").option("--epochs <n>", "Walrus storage epochs", "3");
+  recipientOption(upload).action(async (path, options, command) => {
     await runFileUpload(await buildEncryptContext(command), path, options);
   });
-  const download = file.command("download <file>").description("Download a file's content; decrypts in place when encrypted").option("--out <path>", "Write content to a file instead of stdout").option("--seal-id <hex>", "Seal id from upload (required to decrypt an encrypted file)");
+  file.command("list").description("List files owned by (or accessible to) an address, via event indexing").option("--address <addr>", "Address to query (default: the active account)").option("--accessible", "List files you can decrypt as a recipient, not just owned").option("--hydrate", "Fetch full records (one read per file)").option("--limit <n>", "Cap the number of results").option("--indexer-url <url>", "Event source URL (default: the RPC; uses suix_queryEvents, a deprecated Sui endpoint)").action(async (options, command) => {
+    await runFileList(await buildFileListContext(command, {
+      indexerUrl: options.indexerUrl
+    }), options);
+  });
+  const download = file.command("download [file]").description("Download a file's content; decrypts in place when encrypted").option("--out <path>", "Write content to a file instead of stdout").option("--share <string>", "Share string from upload (bundles file id, prefix, nonce)").option("--prefix <hex>", "Seal prefix (with --nonce) to decrypt").option("--nonce <hex>", "Seal nonce (with --prefix) to decrypt");
   viaAggregatorOption(download).action(async (target, options, command) => {
     await runFileDownload(await buildFileDownloadContext(command, {
       viaAggregator: options.viaAggregator
@@ -2231,26 +2263,36 @@ function registerFileCommands(program) {
   file.command("get <file>").description("Fetch a file's on-chain metadata").action(async (target, _options, command) => {
     await runFileGet(await buildFilesReadContext(command), target);
   });
-  const register = file.command("register").description("Register on-chain metadata for a blob already on Walrus").requiredOption("--blob-id <id>", "Walrus content id").requiredOption("-n, --name <name>", "File name").requiredOption("--content-type <mime>", "MIME content type").requiredOption("--size <bytes>", "Plaintext byte length").option("--public", "Register a world-readable (unencrypted) file").option("--blob-object-id <id>", "On-chain Walrus Blob object id, if known");
-  allowlistOption(register).action(async (options, command) => {
+  const register = file.command("register").description("Register on-chain metadata for a blob already on Walrus").requiredOption("--blob-id <id>", "Walrus content id").requiredOption("-n, --name <name>", "File name").requiredOption("--content-type <mime>", "MIME content type").requiredOption("--size <bytes>", "Plaintext byte length").option("--public", "Register a world-readable (unencrypted) file").option("--encrypted", "Register an encrypted file (needs --seal-prefix)").option("--seal-prefix <hex>", "Seal prefix the blob was encrypted under").option("--blob-object-id <id>", "On-chain Walrus Blob object id, if known");
+  recipientOption(register).action(async (options, command) => {
     await runFileRegister(await buildWriteContext(command), options);
   });
   file.command("update <file>").description("Update a file's name and content type (owner only)").requiredOption("-n, --name <name>", "New file name").requiredOption("--content-type <mime>", "New MIME content type").action(async (target, options, command) => {
     await runFileUpdate(await buildWriteContext(command), target, options);
   });
-  file.command("transfer-ownership <file> <newOwner>").description("Transfer a file's metadata-mutation right (not decrypt access)").action(async (target, newOwner, _options, command) => {
+  file.command("transfer-ownership <file> <newOwner>").description("Transfer a file's ownership (not recipient access)").action(async (target, newOwner, _options, command) => {
     await runFileTransferOwnership(await buildWriteContext(command), target, newOwner, globalOptions(command));
   });
   file.command("delete <file>").description("Delete a file's metadata record (does not delete the blob)").action(async (target, _options, command) => {
     await runFileDelete(await buildWriteContext(command), target, globalOptions(command));
   });
+  const recipient = file.command("recipient").description("Manage a file's recipient list");
+  recipient.command("add <file> <address>").description("Allow an address to decrypt the file").action(async (target, address, _options, command) => {
+    await runFileRecipientAdd(await buildWriteContext(command), target, address);
+  });
+  recipient.command("remove <file> <address>").description("Revoke an address's access to the file").action(async (target, address, _options, command) => {
+    await runFileRecipientRemove(await buildWriteContext(command), target, address);
+  });
+  recipient.command("list <file>").description("List the file's recipients").action(async (target, _options, command) => {
+    await runFileRecipientList(await buildFilesReadContext(command), target);
+  });
 }
 
 // src/commands/publication.ts
 import {
   createPublication,
   deletePublication,
-  toSuiAddress as toSuiAddress6,
+  toSuiAddress as toSuiAddress5,
   transferOwnership
 } from "@arcadiasystems/morse-sdk";
 async function runPublicationGet(ctx, target) {
@@ -2259,7 +2301,7 @@ async function runPublicationGet(ctx, target) {
   ctx.output.result(renderPublication(result), result);
 }
 async function runPublicationList(ctx, address, options) {
-  const owner = address === undefined ? ctx.ownerAddress : toSuiAddress6(address);
+  const owner = address === undefined ? ctx.ownerAddress : toSuiAddress5(address);
   if (owner === undefined) {
     throw new UsageError("No address given and no active account. Pass an address or import an account.");
   }
@@ -2338,7 +2380,7 @@ async function runPublicationDelete(ctx, target, options, gopts) {
 }
 async function runPublicationTransferOwnership(ctx, recipient, options, gopts) {
   const id = await resolvePublication(ctx, options.publication);
-  const to = toSuiAddress6(recipient);
+  const to = toSuiAddress5(recipient);
   const proceed = await confirm(`Transfer ownership of ${shortId(id)} to ${to}? You will lose owner control.`, { assumeYes: Boolean(gopts.yes), signal: ctx.signal });
   if (!proceed) {
     cancelled();
@@ -2530,7 +2572,6 @@ function registerCommands(program) {
   registerEntryCommands(program);
   registerRevisionCommands(program);
   registerCapCommands(program);
-  registerAllowlistCommands(program);
   registerFileCommands(program);
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@arcadiasystems/morse-cli",
-	"version": "0.2.0",
+	"version": "0.4.0",
 	"description": "Command-line interface for the Morse decentralized CMS on Sui.",
 	"license": "MIT",
 	"type": "module",
@@ -55,7 +55,7 @@
 		"prepublishOnly": "bun run check && bun run build"
 	},
 	"dependencies": {
-		"@arcadiasystems/morse-sdk": "^0.2.0",
+		"@arcadiasystems/morse-sdk": "^0.4.0",
 		"@mysten/seal": "1.1.3",
 		"@mysten/sui": "2.16.2",
 		"@mysten/walrus": "1.1.6",