@samva/cli 0.1.0 → 0.1.1

package/dist/bin.mjs

@@ -0,0 +1,4624 @@
+#!/usr/bin/env bun
+import { BunRuntime, BunServices } from "@effect/platform-bun";
+import * as Console from "effect/Console";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Logger from "effect/Logger";
+import * as LogLevel from "effect/LogLevel";
+import * as Predicate from "effect/Predicate";
+import * as CliError from "effect/unstable/cli/CliError";
+import * as CliOutput from "effect/unstable/cli/CliOutput";
+import * as Command from "effect/unstable/cli/Command";
+import { identity } from "effect/Function";
+import * as Option from "effect/Option";
+import * as References from "effect/References";
+import * as Argument from "effect/unstable/cli/Argument";
+import * as Flag from "effect/unstable/cli/Flag";
+import * as Campaigns from "samva/effect/campaigns";
+import * as Schema from "effect/Schema";
+import { ConflictError } from "samva/effect";
+import * as Clock from "effect/Clock";
+import * as Client from "samva/effect/client";
+import * as FileSystem from "effect/FileSystem";
+import * as GlobalFlag from "effect/unstable/cli/GlobalFlag";
+import * as Path from "effect/Path";
+import { isatty } from "node:tty";
+import * as Prompt from "effect/unstable/cli/Prompt";
+import { mkdir, readFile, writeFile } from "node:fs/promises";
+import { dirname, join, resolve } from "node:path";
+import { formatDiagnostic } from "@samva/markup/diagnostics";
+import { flattenFontTokens } from "@samva/markup/theme";
+import { parseThemeCss, printThemeCss } from "@samva/markup/theme-css";
+import { Result } from "effect";
+import * as Design from "samva/effect/design";
+import * as Email from "samva/effect/email";
+import * as Organizations from "samva/effect/organizations";
+import * as Duration from "effect/Duration";
+import * as Schedule from "effect/Schedule";
+import * as Messages from "samva/effect/messages";
+import * as Ref from "effect/Ref";
+import * as ScheduledMessages from "samva/effect/scheduled-messages";
+import MarkupPackageJson from "@samva/markup/package.json" with { type: "json" };
+import VitePackageJson from "@samva/vite/package.json" with { type: "json" };
+import * as Templates from "samva/effect/templates";
+import { createHash } from "node:crypto";
+import * as Redacted from "effect/Redacted";
+import * as Webhooks from "samva/effect/webhooks";
+//#region package.json
+var version = "0.1.1";
+//#endregion
+//#region src/errors.ts
+/**
+* A user-facing CLI error. Its `message` is printed to stderr and the process
+* exits non-zero. Use this for expected failures (missing key, API errors,
+* bad input) — not for programmer bugs, which should surface as defects.
+*/
+var SamvaCliError = class extends Schema.TaggedErrorClass()("SamvaCliError", { message: Schema.String }) {};
+/** Expected process failures remain typed through the CLI boundary. */
+var CliUsageError = class extends Schema.TaggedErrorClass()("CliUsageError", {
+	message: Schema.String,
+	code: Schema.String
+}) {};
+var CliConfigError = class extends Schema.TaggedErrorClass()("CliConfigError", {
+	message: Schema.String,
+	code: Schema.String
+}) {};
+var CliAuthError = class extends Schema.TaggedErrorClass()("CliAuthError", {
+	message: Schema.String,
+	code: Schema.String
+}) {};
+var CliTimeoutError = class extends Schema.TaggedErrorClass()("CliTimeoutError", {
+	message: Schema.String,
+	code: Schema.String
+}) {};
+/** A completed operation failed, but its structured result remains authoritative. */
+var CliResultError = class extends Schema.TaggedErrorClass()("CliResultError", {
+	message: Schema.String,
+	code: Schema.String,
+	result: Schema.Unknown,
+	human: Schema.String
+}) {};
+/**
+* A lifecycle command rendered its last authoritative Message before failing.
+* The process boundary preserves that output by branching on this class
+* (`instanceof`), so no marker field is needed on the error itself.
+*/
+var CliMessageLifecycleError = class extends Schema.TaggedErrorClass()("CliMessageLifecycleError", {
+	message: Schema.String,
+	code: Schema.String,
+	partialMessage: Schema.Unknown,
+	next: Schema.String,
+	human: Schema.String
+}) {};
+const processErrorCode = (error) => {
+	if (CliError.isCliError(error)) return 2;
+	if (error instanceof CliUsageError || error instanceof CliConfigError) return 2;
+	if (error instanceof CliAuthError) return 4;
+	if (error instanceof CliTimeoutError) return 124;
+	if (error instanceof CliResultError) return 1;
+	if (error instanceof CliMessageLifecycleError) return error.code === "message_wait_timeout" ? 124 : 1;
+	return 1;
+};
+const processErrorReason = (error) => {
+	if (CliError.isCliError(error)) return "usage_error";
+	if (error instanceof CliUsageError) return error.code;
+	if (error instanceof CliConfigError) return error.code;
+	if (error instanceof CliAuthError) return error.code;
+	if (error instanceof CliTimeoutError) return error.code;
+	if (error instanceof CliResultError) return error.code;
+	if (error instanceof CliMessageLifecycleError) return error.code;
+	return "operational_failure";
+};
+const processErrorNext = (error) => error instanceof CliMessageLifecycleError ? error.next : void 0;
+/**
+* Build a friendly one-line message from an SDK error. The Effect SDK's error
+* channel carries the server's real tagged error classes (or `HttpClientError`
+* / `SchemaError`) directly — the failure value itself has the message, not a
+* `.cause` wrapper. Most tagged errors expose `.message`; a few
+* (`FlagDisabledError`, `WebhookEnqueueError`) only expose `.errorMessage`.
+*/
+const formatApiError = (prefix, error) => {
+	if (Predicate.isObject(error)) {
+		if (Predicate.hasProperty(error, "message") && typeof error["message"] === "string") return `${prefix}: ${error["message"]}`;
+		if (Predicate.hasProperty(error, "errorMessage") && typeof error["errorMessage"] === "string") return `${prefix}: ${error["errorMessage"]}`;
+	}
+	return prefix;
+};
+const getConflictError = (error) => error instanceof ConflictError ? error : void 0;
+//#endregion
+//#region src/env.ts
+/**
+* The CLI's environment module — the single legitimate reader of `process.env`.
+*
+* Cloudflare Workers (apps/api, apps/web) get their env from bindings, so the
+* `node/no-process-env` lint rule steers them to typed env modules. A CLI runs
+* as a normal Node process, where `process.env` *is* the source of truth; this
+* file is the env module for it (the rule exempts `**​/env.*`). Read env here and
+* nowhere else.
+*/
+const env = process.env;
+/** API key for authenticated calls (`samva email send`, `samva org list`, …). */
+const SAMVA_API_KEY = env["SAMVA_API_KEY"];
+/** API base URL override; falls back to config then the production default. */
+const SAMVA_API_URL = env["SAMVA_API_URL"];
+/** Named execution profile override for humans, CI, and agents. */
+const SAMVA_PROFILE = env["SAMVA_PROFILE"];
+/** OAuth organization override; rejected when SAMVA_API_KEY is in use. */
+const SAMVA_ORG = env["SAMVA_ORG"];
+/** XDG config root; the CLI stores state under `$XDG_CONFIG_HOME/samva`. */
+const XDG_CONFIG_HOME = env["XDG_CONFIG_HOME"];
+/** User home directory (used when `XDG_CONFIG_HOME` is unset). */
+const HOME = env["HOME"] ?? env["USERPROFILE"];
+//#endregion
+//#region src/lib/runtime.ts
+/** Process-wide output and execution settings. */
+const Json = GlobalFlag.setting("json")({ flag: Flag.boolean("json").pipe(Flag.withDefault(false), Flag.withDescription("Output machine-readable JSON")) });
+const JsonLines = GlobalFlag.setting("jsonl")({ flag: Flag.boolean("jsonl").pipe(Flag.withDefault(false), Flag.withDescription("Output newline-delimited JSON result envelopes")) });
+const Quiet = GlobalFlag.setting("quiet")({ flag: Flag.boolean("quiet").pipe(Flag.withDefault(false), Flag.withDescription("Suppress all successful output")) });
+const Profile = GlobalFlag.setting("profile")({ flag: Flag.string("profile").pipe(Flag.optional, Flag.withDescription("Execution profile (overrides SAMVA_PROFILE and the active profile)")) });
+const ApiUrl = GlobalFlag.setting("api-url")({ flag: Flag.string("api-url").pipe(Flag.optional, Flag.withDescription("Explicit API URL (development/E2E escape hatch)")) });
+const Org = GlobalFlag.setting("org")({ flag: Flag.string("org").pipe(Flag.optional, Flag.withDescription("Organization slug for OAuth profiles")) });
+const NoInput = GlobalFlag.setting("no-input")({ flag: Flag.boolean("no-input").pipe(Flag.withDefault(false), Flag.withDescription("Never prompt or open a browser")) });
+const globalFlags = [
+	Json,
+	JsonLines,
+	Quiet,
+	Profile,
+	ApiUrl,
+	Org,
+	NoInput
+];
+const outputFlags = /* @__PURE__ */ new Set([
+	"--json",
+	"--jsonl",
+	"--quiet"
+]);
+const outputAssignments = /^(--json|--jsonl|--quiet)=/;
+/** Final M3 process-boundary metadata, solely for stable envelope command names. */
+const commandTree = {
+	login: {},
+	logout: {},
+	org: {
+		list: {},
+		use: {},
+		current: {}
+	},
+	email: {
+		send: {},
+		doctor: {},
+		receiving: {
+			status: {},
+			enable: {}
+		},
+		domains: {
+			list: {},
+			add: {},
+			check: {},
+			remove: {}
+		},
+		senders: {
+			list: {},
+			add: {},
+			check: {},
+			remove: {}
+		},
+		theme: {
+			pull: {},
+			push: {}
+		}
+	},
+	messages: {
+		list: {},
+		get: {},
+		events: {},
+		wait: {}
+	},
+	campaigns: {
+		create: {},
+		list: {},
+		get: {},
+		update: {},
+		archive: {},
+		runs: {
+			create: {},
+			list: {},
+			get: {},
+			pause: {},
+			resume: {},
+			cancel: {},
+			recipients: {}
+		}
+	},
+	"scheduled-messages": {
+		create: {},
+		list: {},
+		get: {},
+		cancel: {}
+	},
+	templates: {
+		init: {},
+		push: {},
+		pull: {},
+		list: {},
+		get: {},
+		create: {},
+		update: {},
+		publish: {},
+		unpublish: {},
+		remove: {},
+		versions: {
+			list: {},
+			restore: {}
+		}
+	},
+	webhooks: {
+		list: {},
+		get: {},
+		create: {},
+		update: {},
+		test: {},
+		logs: {},
+		stats: {},
+		retry: {},
+		"rotate-secret": {},
+		remove: {}
+	},
+	profile: {
+		list: {},
+		show: {},
+		create: {},
+		use: {},
+		delete: {}
+	},
+	help: {}
+};
+/** Command handlers remain the grammar authority. */
+const isKnownRootCommand = (token) => token in commandTree;
+const globalOptionsWithValue = /* @__PURE__ */ new Set([
+	"--profile",
+	"--api-url",
+	"--org",
+	"--log-level"
+]);
+/**
+* Return the released command path in its stable dotted form. This only reads
+* tokens before `--`; positional data after a recognized leaf never becomes
+* command metadata.
+*/
+const commandNameFromArgv = (argv) => {
+	let tree = commandTree;
+	const path = [];
+	for (let index = 0; index < argv.length; index++) {
+		const token = argv[index];
+		if (token === "--") break;
+		if (globalOptionsWithValue.has(token)) {
+			index++;
+			continue;
+		}
+		if (token.startsWith("--profile=") || token.startsWith("--api-url=") || token.startsWith("--org=") || token.startsWith("--log-level=")) continue;
+		if (token.startsWith("-")) continue;
+		if (path.length === 0) {
+			if (token in tree) {
+				path.push(token);
+				tree = tree[token];
+			}
+			continue;
+		}
+		if (token in tree) {
+			path.push(token);
+			tree = tree[token];
+			continue;
+		}
+		break;
+	}
+	return path.length === 0 ? "samva" : path.join(".");
+};
+/**
+* Validate the tiny set of process-wide syntax rules before Effect CLI begins
+* parsing command-local flags. Stops at `--`, so a positional value cannot
+* accidentally select machine mode.
+*/
+const validateProcessArgs = (argv) => Effect.gen(function* () {
+	const selected = /* @__PURE__ */ new Set();
+	for (const token of argv) {
+		if (token === "--") break;
+		if (outputAssignments.test(token)) return yield* new CliUsageError({
+			message: "Use --json, --jsonl, or --quiet without =true or =false.",
+			code: "invalid_output_mode_syntax"
+		});
+		if (outputFlags.has(token)) selected.add(token);
+	}
+	if (selected.size > 1) return yield* new CliUsageError({
+		message: "Use only one of --json, --jsonl, or --quiet.",
+		code: "mutually_exclusive_output_mode"
+	});
+});
+const outputModeFromArgv = (argv) => {
+	let selected = "human";
+	for (const token of argv) {
+		if (token === "--") break;
+		if (token === "--jsonl" || token.startsWith("--jsonl=")) selected = "jsonl";
+		else if (token === "--json" || token.startsWith("--json=")) {
+			if (selected !== "jsonl") selected = "json";
+		} else if (token === "--quiet" || token.startsWith("--quiet=")) {
+			if (selected === "human") selected = "quiet";
+		}
+	}
+	return selected;
+};
+const isJsonRequested = () => outputModeFromArgv(process.argv.slice(2)) === "json";
+const isJsonLinesRequested = () => outputModeFromArgv(process.argv.slice(2)) === "jsonl";
+//#endregion
+//#region src/config/credential-store.ts
+const SERVICE = "dev.samva.cli";
+const readCredentialCommand = (platform, command, profile) => platform === "darwin" ? { args: [
+	command,
+	"find-generic-password",
+	"-s",
+	SERVICE,
+	"-a",
+	profile,
+	"-w"
+] } : { args: [
+	command,
+	"lookup",
+	"service",
+	SERVICE,
+	"profile",
+	profile
+] };
+const writeCredentialCommand = (platform, command, profile, secret) => platform === "darwin" ? {
+	args: [command, "-i"],
+	input: `add-generic-password -U -s ${SERVICE} -a ${profile} -X ${Buffer.from(secret, "utf8").toString("hex")}\n`
+} : {
+	args: [
+		command,
+		"store",
+		"--label",
+		`Samva CLI profile ${profile}`,
+		"service",
+		SERVICE,
+		"profile",
+		profile
+	],
+	input: secret
+};
+const commandForPlatform = () => {
+	if (process.platform === "darwin") return "/usr/bin/security";
+	if (process.platform === "linux") return "secret-tool";
+};
+const runSecretCommand = (args, input) => Effect.tryPromise({
+	try: async () => {
+		const child = Bun.spawn({
+			cmd: [...args],
+			stdin: input === void 0 ? "ignore" : new Blob([input]),
+			stdout: "pipe",
+			stderr: "pipe"
+		});
+		const [stdout, stderr, exitCode] = await Promise.all([
+			new Response(child.stdout).text(),
+			new Response(child.stderr).text(),
+			child.exited
+		]);
+		return {
+			stdout: stdout.trim(),
+			stderr: stderr.trim(),
+			exitCode
+		};
+	},
+	catch: () => new CliConfigError({
+		code: "credential_store_unavailable",
+		message: "Could not run the operating-system credential store."
+	})
+});
+const keyring = () => {
+	const command = commandForPlatform();
+	return command === void 0 ? Effect.fail(new CliConfigError({
+		code: "credential_store_unsupported",
+		message: "Samva CLI credentials require macOS Keychain or Linux secret-tool."
+	})) : Effect.succeed(command);
+};
+const isMissingSecretResult = (platform, result) => platform === "darwin" ? result.exitCode === 44 : platform === "linux" ? result.exitCode === 1 && result.stdout.length === 0 && result.stderr.length === 0 : false;
+/** Read one profile secret. A missing item is normal; no plaintext fallback exists. */
+const readCredentialSecret = (profile) => Effect.gen(function* () {
+	const command = yield* keyring();
+	const spec = readCredentialCommand(process.platform, command, profile);
+	const result = yield* runSecretCommand(spec.args, spec.input);
+	if (result.exitCode !== 0) {
+		if (isMissingSecretResult(process.platform, result)) return void 0;
+		return yield* new CliConfigError({
+			code: "credential_store_read_failed",
+			message: "Could not read credentials from the operating-system credential store."
+		});
+	}
+	return result.stdout;
+});
+/** Store a secret in the OS keyring. Failure is explicit and never falls back to a file. */
+const writeCredentialSecret = (profile, secret) => Effect.gen(function* () {
+	const command = yield* keyring();
+	const spec = writeCredentialCommand(process.platform, command, profile, secret);
+	if ((yield* runSecretCommand(spec.args, spec.input)).exitCode !== 0) return yield* new CliConfigError({
+		code: "credential_store_write_failed",
+		message: "Could not save credentials in the operating-system credential store."
+	});
+});
+const clearCredentialSecret = (profile) => Effect.gen(function* () {
+	const command = yield* keyring();
+	const result = process.platform === "darwin" ? yield* runSecretCommand([
+		command,
+		"delete-generic-password",
+		"-s",
+		SERVICE,
+		"-a",
+		profile
+	]) : yield* runSecretCommand([
+		command,
+		"clear",
+		"service",
+		SERVICE,
+		"profile",
+		profile
+	]);
+	if (result.exitCode !== 0 && !isMissingSecretResult(process.platform, result)) return yield* new CliConfigError({
+		code: "credential_store_delete_failed",
+		message: "Could not remove credentials from the operating-system credential store."
+	});
+});
+//#endregion
+//#region src/config/paths.ts
+/**
+* Absolute path to the Samva CLI config directory:
+* `$XDG_CONFIG_HOME/samva` when set, otherwise `~/.config/samva`.
+*/
+const configDir = Effect.gen(function* () {
+	const path = yield* Path.Path;
+	const base = XDG_CONFIG_HOME && XDG_CONFIG_HOME.length > 0 ? XDG_CONFIG_HOME : HOME && HOME.length > 0 ? path.join(HOME, ".config") : yield* new SamvaCliError({ message: "Could not resolve config directory. Set XDG_CONFIG_HOME, HOME, or USERPROFILE." });
+	return path.join(base, "samva");
+});
+/** Path to `config.json` (api url + active org). */
+const configFilePath = Effect.gen(function* () {
+	const path = yield* Path.Path;
+	const dir = yield* configDir;
+	return path.join(dir, "config.json");
+});
+//#endregion
+//#region src/config/store.ts
+const DEFAULT_API_URL = "https://api.samva.dev";
+const LOCAL_API_URL = "http://127.0.0.1:8787";
+const ProfileNameSchema = Schema.String.check(Schema.isPattern(/^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$/));
+const ProfileSchema = Schema.Struct({
+	target: Schema.Literals(["production", "local"]),
+	orgSlug: Schema.optional(Schema.String),
+	credentialIdentity: Schema.Literals(["none", "oauth"])
+});
+const ConfigSchema = Schema.Struct({
+	version: Schema.Literal(2),
+	activeProfile: Schema.optional(Schema.String),
+	profiles: Schema.Record(ProfileNameSchema, ProfileSchema)
+});
+const CredentialsSchema = Schema.Struct({
+	accessToken: Schema.String,
+	tokenType: Schema.String,
+	expiresAt: Schema.Finite,
+	scope: Schema.optional(Schema.String)
+});
+const emptyConfig = {
+	version: 2,
+	profiles: {}
+};
+const validateProfileName = (name) => Schema.decodeUnknownEffect(ProfileNameSchema)(name).pipe(Effect.mapError(() => new CliUsageError({
+	code: "invalid_profile_name",
+	message: "Profile names must be 1-64 characters and contain only letters, numbers, dots, underscores, or hyphens."
+})));
+const parseConfig = (raw, file) => Effect.gen(function* () {
+	const rawValue = yield* Effect.try({
+		try: () => JSON.parse(raw),
+		catch: () => new CliConfigError({
+			code: "invalid_config",
+			message: `Could not parse CLI config at ${file}. Fix or delete it.`
+		})
+	});
+	return yield* Schema.decodeUnknownEffect(ConfigSchema)(rawValue).pipe(Effect.mapError(() => new CliConfigError({
+		code: "invalid_config",
+		message: `Could not parse CLI config at ${file}. Fix or delete it.`
+	})));
+});
+const readConfig = Effect.gen(function* () {
+	const fs = yield* FileSystem.FileSystem;
+	const file = yield* configFilePath;
+	if (!(yield* fs.exists(file))) return emptyConfig;
+	return yield* parseConfig(yield* fs.readFileString(file), file);
+});
+const writeConfig = Effect.fnUntraced(function* (config) {
+	const fs = yield* FileSystem.FileSystem;
+	yield* fs.makeDirectory(yield* configDir, { recursive: true });
+	yield* fs.writeFileString(yield* configFilePath, `${JSON.stringify(config, null, 2)}\n`);
+});
+/** Resolve flags/profile/target/identity without reading or decoding a secret. */
+const resolveExecutionSelection = Effect.gen(function* () {
+	const profileFlag = Option.getOrUndefined(yield* Profile);
+	const apiUrlFlag = Option.getOrUndefined(yield* ApiUrl);
+	const orgFlag = Option.getOrUndefined(yield* Org);
+	const config = yield* readConfig;
+	const profile = profileFlag ?? SAMVA_PROFILE ?? config.activeProfile ?? "default";
+	if (profile !== "default" && config.profiles[profile] === void 0) return yield* new CliConfigError({
+		code: "unknown_profile",
+		message: `Profile ${profile} does not exist. Create it with \`samva profile create ${profile}\`.`
+	});
+	const stored = config.profiles[profile] ?? {
+		target: "production",
+		credentialIdentity: "none"
+	};
+	const apiUrl = apiUrlFlag ?? SAMVA_API_URL ?? (stored.target === "local" ? LOCAL_API_URL : DEFAULT_API_URL);
+	const orgSlug = orgFlag ?? SAMVA_ORG ?? stored.orgSlug;
+	const apiKey = SAMVA_API_KEY && SAMVA_API_KEY.length > 0 ? SAMVA_API_KEY : void 0;
+	if (apiKey && (orgFlag !== void 0 || SAMVA_ORG !== void 0)) return yield* new CliAuthError({
+		code: "api_key_org_override",
+		message: "--org/SAMVA_ORG cannot override an organization-scoped SAMVA_API_KEY."
+	});
+	if (apiKey) return {
+		profile,
+		target: stored.target,
+		apiUrl,
+		apiKey
+	};
+	return {
+		profile,
+		target: stored.target,
+		apiUrl,
+		orgSlug,
+		profileOrgSlug: stored.orgSlug,
+		apiKey
+	};
+});
+const resolveExecutionContext = Effect.gen(function* () {
+	const selection = yield* resolveExecutionSelection;
+	if (selection.apiKey) return {
+		...selection,
+		credentials: void 0
+	};
+	const rawCredentials = ((yield* readConfig).profiles[selection.profile] ?? {
+		target: "production",
+		credentialIdentity: "none"
+	}).credentialIdentity === "oauth" ? yield* readCredentialSecret(selection.profile) : void 0;
+	const credentials = rawCredentials ? yield* decodeStoredCredentials(selection.profile, rawCredentials) : void 0;
+	return {
+		...selection,
+		credentials
+	};
+});
+/** Decode a keyring payload only after its non-secret profile selection is fixed. */
+const decodeStoredCredentials = (profile, rawCredentials) => Effect.try({
+	try: () => JSON.parse(rawCredentials),
+	catch: () => new CliConfigError({
+		code: "invalid_credential_record",
+		message: `Stored credentials for profile ${profile} are invalid. Run \`samva logout\` then \`samva login\`.`
+	})
+}).pipe(Effect.flatMap(Schema.decodeUnknownEffect(CredentialsSchema)), Effect.mapError(() => new CliConfigError({
+	code: "invalid_credential_record",
+	message: `Stored credentials for profile ${profile} are invalid. Run \`samva logout\` then \`samva login\`.`
+})));
+/** URL-only callers must not decode credentials before they begin recovery. */
+const resolveApiUrl = Effect.map(resolveExecutionSelection, (selection) => selection.apiUrl);
+/**
+* OAuth access tokens carry a second-resolution expiry. Compared against the
+* Effect `Clock` (not `Date.now`) so the check is deterministic under TestClock.
+*/
+const isCredentialExpired = (credentials, nowMillis) => credentials.expiresAt <= Math.floor(nowMillis / 1e3);
+Effect.gen(function* () {
+	const context = yield* resolveExecutionContext;
+	if (!context.credentials) return void 0;
+	if (isCredentialExpired(context.credentials, yield* Clock.currentTimeMillis)) return yield* new CliAuthError({
+		code: "expired_credentials",
+		message: "Your session has expired. Run `samva login` to sign in again."
+	});
+	return context.credentials.accessToken;
+});
+const writeCredentials = Effect.fnUntraced(function* (credentials) {
+	const context = yield* resolveExecutionSelection;
+	const config = yield* readConfig;
+	const current = config.profiles[context.profile] ?? {
+		target: context.target,
+		credentialIdentity: "none"
+	};
+	yield* writeConfig({
+		...config,
+		profiles: {
+			...config.profiles,
+			[context.profile]: {
+				...current,
+				credentialIdentity: "oauth"
+			}
+		}
+	});
+	yield* writeCredentialSecret(context.profile, JSON.stringify(credentials));
+});
+const readCredentials = Effect.map(resolveExecutionContext, (context) => context.credentials);
+const clearCredentials = Effect.gen(function* () {
+	const context = yield* resolveExecutionSelection;
+	const config = yield* readConfig;
+	const current = config.profiles[context.profile];
+	if (!current || current.credentialIdentity === "none") return;
+	yield* writeConfig({
+		...config,
+		profiles: {
+			...config.profiles,
+			[context.profile]: {
+				...current,
+				credentialIdentity: "none"
+			}
+		}
+	});
+	yield* clearCredentialSecret(context.profile);
+});
+//#endregion
+//#region src/lib/client.ts
+const missingOrgMessage = "No active organization. Run `samva org use <slug>` after `samva login`, or use SAMVA_API_KEY for single-org automation.";
+const provider = (config) => ({ provide: (effect) => Effect.provide(effect, Client.layerFetch(config)) });
+/** Build an authenticated SDK operation provider for an explicit API base URL. */
+const getClientProviderForContext = (context, baseUrl) => Effect.gen(function* () {
+	if (context.apiKey) return provider({
+		apiKey: context.apiKey,
+		baseUrl
+	});
+	if (context.credentials) {
+		if (isCredentialExpired(context.credentials, yield* Clock.currentTimeMillis)) return yield* new CliAuthError({
+			code: "expired_credentials",
+			message: "Your session has expired. Run `samva login` to sign in again."
+		});
+		const authToken = context.credentials.accessToken;
+		const activeOrgSlug = context.orgSlug;
+		if (!activeOrgSlug) return yield* new CliAuthError({
+			code: "missing_organization",
+			message: missingOrgMessage
+		});
+		return provider({
+			authToken,
+			baseUrl,
+			headers: { "x-org-slug": activeOrgSlug }
+		});
+	}
+	return yield* new CliAuthError({
+		code: "missing_credentials",
+		message: "No credentials found. Run `samva login`, or set SAMVA_API_KEY for automation."
+	});
+});
+/**
+* Build an authenticated Samva SDK operation provider. This is the single seam all command
+* handlers go through. `SAMVA_API_KEY` takes precedence over stored OAuth
+* credentials. OAuth is the interactive fallback; its user-scoped token sends
+* the active org (`samva org use`) as the `x-org-slug` header.
+*/
+const getClientProvider = Effect.flatMap(resolveExecutionContext, (context) => getClientProviderForContext(context, context.apiUrl));
+//#endregion
+//#region src/lib/confirm.ts
+/** Confirm a destructive action in a real TTY; automation must pass --yes. */
+const confirmDestructive = (options) => Effect.gen(function* () {
+	if (options.yes) return;
+	if ((yield* NoInput) || options.json || !isatty(0) || !isatty(1)) return yield* new CliUsageError({
+		code: "confirmation_required",
+		message: options.nonInteractiveMessage
+	});
+	if (!(yield* Prompt.run(Prompt.confirm({
+		message: options.message,
+		initial: false
+	})))) return yield* new CliUsageError({
+		code: "confirmation_declined",
+		message: "Cancelled; no changes were made."
+	});
+});
+//#endregion
+//#region src/lib/output.ts
+const CLI_SCHEMA_VERSION = 1;
+const resultEnvelope = (command, data, partial) => ({
+	schemaVersion: CLI_SCHEMA_VERSION,
+	type: "result",
+	command,
+	data,
+	partial
+});
+const errorEnvelope = (error, command, message) => ({
+	schemaVersion: CLI_SCHEMA_VERSION,
+	type: "error",
+	command,
+	reason: processErrorReason(error),
+	message,
+	next: processErrorNext(error)
+});
+/**
+* Shared `--json` flag for read commands. Hidden from help because the global
+* `--json` (see {@link Json} in lib/runtime) already documents it — otherwise it
+* lists twice, e.g. `samva org current --help`. Parsing behavior is unchanged.
+*/
+const jsonFlag = Flag.boolean("json").pipe(Flag.withDefault(isJsonRequested() || isJsonLinesRequested()), Flag.withDescription("Output machine-readable JSON instead of formatted text"), Flag.withHidden);
+/** Print a value as pretty-printed JSON. */
+const printJson = (value) => {
+	if (isJsonLinesRequested()) return Effect.sync(() => process.stdout.write(`${JSON.stringify(resultEnvelope(commandNameFromArgv(process.argv.slice(2)), value))}\n`));
+	return Console.log(JSON.stringify(value, null, 2));
+};
+/** A stable diagnostics schema paired with the versioned result envelope. */
+const printJsonError = (error, message) => {
+	const payload = errorEnvelope(error, commandNameFromArgv(process.argv.slice(2)), message);
+	return Console.error(JSON.stringify(payload, null, isJsonLinesRequested() ? void 0 : 2));
+};
+/** NDJSON is intentionally unbuffered and versioned, one outer envelope per resource. */
+const printJsonLine = (value) => Effect.sync(() => process.stdout.write(`${JSON.stringify(resultEnvelope(commandNameFromArgv(process.argv.slice(2)), value))}\n`));
+const printResult = (value, human) => isJsonRequested() || isJsonLinesRequested() ? printJson(value) : Console.log(human);
+/**
+* Whether to emit ANSI styling. `Bun.enableANSIColors` already accounts for a
+* TTY, `NO_COLOR`, and `FORCE_COLOR`, so styling stays off when stdout is piped
+* or the machine path is in use. Read lazily (not at module load) so importing
+* this module stays free of runtime-global side effects — process e2e tests run
+* the CLI under Bun, but unit tests import these helpers under Node/vitest.
+*/
+const colorsEnabled = () => Bun.enableANSIColors;
+const sgr = (open, close) => (text) => colorsEnabled() ? `\x1b[${open}m${text}\x1b[${close}m` : text;
+/** Dim text (gated on {@link colorsEnabled}). */
+const dim = sgr(2, 22);
+const MAX_DUMP_LINES = 40;
+const MAX_DUMP_CHARS = 4e3;
+/**
+* Bound a large human-facing text dump (an email body, a template source, a
+* payload preview) so a huge input can't flood the terminal or an agent's
+* context. Appends an explicit truncation tail stating what was dropped. The
+* `--json` path is never truncated — an agent that asked for the payload gets
+* all of it.
+*/
+const truncateForDisplay = (text, maxLines = MAX_DUMP_LINES, maxChars = MAX_DUMP_CHARS) => {
+	let out = text;
+	const lines = out.split("\n");
+	if (lines.length > maxLines) out = `${lines.slice(0, maxLines).join("\n")}\n${dim(`… ${lines.length - maxLines} more line(s) truncated`)}`;
+	if (out.length > maxChars) out = `${out.slice(0, maxChars)}\n${dim(`… truncated at ${maxChars} characters`)}`;
+	return out;
+};
+/** Print aligned `Label: value` lines, skipping nullish/empty values. */
+const printFields = (fields) => {
+	const visible = fields.filter(([, value]) => value !== null && value !== void 0 && value !== "");
+	const width = Math.max(0, ...visible.map(([label]) => Bun.stringWidth(label)));
+	const lines = visible.map(([label, value]) => {
+		return `${label}${" ".repeat(Math.max(0, width - Bun.stringWidth(label)))}  ${String(value)}`;
+	});
+	return Console.log(lines.join("\n"));
+};
+//#endregion
+//#region src/commands/campaigns.ts
+const CAMPAIGN_STATUSES = ["draft", "archived"];
+const RUN_STATUSES = [
+	"scheduled",
+	"resolving",
+	"dispatching",
+	"paused",
+	"completed",
+	"cancelled",
+	"failed"
+];
+const RECIPIENT_STATUSES = [
+	"pending",
+	"dispatching",
+	"dispatched",
+	"failed",
+	"skipped"
+];
+const ABSOLUTE_INSTANT_PATTERN$1 = /^(\d{4})-(\d{2})-(\d{2})T\d{2}:\d{2}:\d{2}(?:\.\d+)?(?:Z|[+-]\d{2}:\d{2})$/;
+const isAbsoluteInstant$1 = (value) => {
+	const match = ABSOLUTE_INSTANT_PATTERN$1.exec(value);
+	if (!match || Number.isNaN(Date.parse(value))) return false;
+	const year = Number(match[1]);
+	const month = Number(match[2]);
+	const day = Number(match[3]);
+	const calendarDate = new Date(Date.UTC(year, month - 1, day));
+	return calendarDate.getUTCFullYear() === year && calendarDate.getUTCMonth() === month - 1 && calendarDate.getUTCDate() === day;
+};
+/**
+* Flatten repeated and comma-separated flag values into a clean tag list.
+* `--include-tags a,b --include-tags c` and `--include-tags a --include-tags b`
+* both collapse to `["a", "b", ...]`. Pure so it can be unit-tested.
+*/
+const parseTagList = (values) => values.flatMap((value) => value.split(",").map((entry) => entry.trim()).filter((entry) => entry.length > 0));
+/**
+* Assemble the `campaigns.create` email payload from resolved flags. Pure so the
+* flag-to-request mapping can be unit-tested without the network.
+*/
+const assembleCampaignCreatePayload = (input) => {
+	const hasPolicy = input.unsubscribeGroupId !== void 0 || input.pageSize !== void 0;
+	return {
+		name: input.name,
+		channel: "email",
+		content: {
+			channel: "email",
+			email: {
+				subject: input.subject,
+				html: input.html,
+				text: input.text,
+				templateId: input.templateId,
+				templateSlug: input.templateSlug,
+				templateData: input.templateData,
+				...input.tracking === void 0 ? {} : { tracking: input.tracking }
+			}
+		},
+		audience: {
+			includeTags: input.includeTags.length > 0 ? [...input.includeTags] : void 0,
+			excludeTags: input.excludeTags.length > 0 ? [...input.excludeTags] : void 0,
+			contactIds: input.contactIds.length > 0 ? [...input.contactIds] : void 0
+		},
+		policy: hasPolicy ? {
+			unsubscribeGroupId: input.unsubscribeGroupId,
+			pageSize: input.pageSize
+		} : void 0
+	};
+};
+const parseTemplateData$2 = (raw) => Option.match(raw, {
+	onNone: () => Effect.succeed(void 0),
+	onSome: (value) => Effect.try({
+		try: () => JSON.parse(value),
+		catch: () => new SamvaCliError({ message: "--template-data must be a JSON object." })
+	}).pipe(Effect.flatMap((parsed) => Predicate.isObject(parsed) ? Effect.succeed(parsed) : Effect.fail(new SamvaCliError({ message: "--template-data must be a JSON object." }))))
+});
+const nameFlag = Flag.string("name").pipe(Flag.withDescription("Campaign name"));
+const subjectFlag$2 = Flag.string("subject").pipe(Flag.withDescription("Email subject line"), Flag.optional);
+const htmlFlag$2 = Flag.string("html").pipe(Flag.withDescription("HTML body"), Flag.optional);
+const textFlag$2 = Flag.string("text").pipe(Flag.withDescription("Plain-text body"), Flag.optional);
+const templateIdFlag$2 = Flag.string("template-id").pipe(Flag.withDescription("Template id (uuid) to render instead of inline body"), Flag.optional);
+const templateSlugFlag$2 = Flag.string("template-slug").pipe(Flag.withDescription("Template handle to render instead of inline body, e.g. welcome-email"), Flag.optional);
+const templateDataFlag$2 = Flag.string("template-data").pipe(Flag.withDescription("JSON object of variables for the template"), Flag.optional);
+const includeTagsFlag = Flag.string("include-tags").pipe(Flag.withDescription("Contact tags to include (comma-separated or repeated)"), Flag.atLeast(0));
+const excludeTagsFlag = Flag.string("exclude-tags").pipe(Flag.withDescription("Contact tags to exclude from the include set (comma-separated or repeated)"), Flag.atLeast(0));
+const contactIdsFlag = Flag.string("contact-ids").pipe(Flag.withDescription("Explicit contact ids to target (comma-separated or repeated)"), Flag.atLeast(0));
+const unsubscribeGroupIdFlag = Flag.string("unsubscribe-group-id").pipe(Flag.withDescription("Unsubscribe group id applied to every send"), Flag.optional);
+const pageSizeFlag = Flag.integer("page-size").pipe(Flag.withDescription("Recipients dispatched per batch"), Flag.optional);
+const dryRunFlag$4 = Flag.boolean("dry-run").pipe(Flag.withDescription("Validate inputs and print the request payload without calling the API"), Flag.withDefault(false));
+const trackOpensFlag$2 = Flag.choice("track-opens", ["on", "off"]).pipe(Flag.withDescription("Override open tracking for campaign sends; recipient opt-out wins"), Flag.optional);
+const trackClicksFlag$2 = Flag.choice("track-clicks", ["on", "off"]).pipe(Flag.withDescription("Override click tracking for campaign sends; recipient opt-out wins"), Flag.optional);
+const atFlag$1 = Flag.string("at").pipe(Flag.withDescription("Absolute run start instant as ISO 8601 (defaults to now)"), Flag.optional);
+const idempotencyKeyFlag$2 = Flag.string("idempotency-key").pipe(Flag.withDescription("Organization-scoped key so retries return the original run"), Flag.optional);
+const campaignStatusFlag = Flag.choice("status", CAMPAIGN_STATUSES).pipe(Flag.withDescription("Filter by status"), Flag.optional);
+const runStatusFlag = Flag.choice("status", RUN_STATUSES).pipe(Flag.withDescription("Filter by run status"), Flag.optional);
+const recipientStatusFlag = Flag.choice("status", RECIPIENT_STATUSES).pipe(Flag.withDescription("Filter by recipient status"), Flag.optional);
+const pageFlag$2 = Flag.integer("page").pipe(Flag.withDescription("Page number (1-based)"), Flag.optional);
+const limitFlag$2 = Flag.integer("limit").pipe(Flag.withDescription("Items per page"), Flag.optional);
+const allFlag$2 = Flag.boolean("all").pipe(Flag.withDescription("Traverse every page (requires --jsonl)"), Flag.withDefault(false));
+const create$3 = Command.make("create", {
+	name: nameFlag,
+	subject: subjectFlag$2,
+	html: htmlFlag$2,
+	text: textFlag$2,
+	templateId: templateIdFlag$2,
+	templateSlug: templateSlugFlag$2,
+	templateData: templateDataFlag$2,
+	includeTags: includeTagsFlag,
+	excludeTags: excludeTagsFlag,
+	contactIds: contactIdsFlag,
+	unsubscribeGroupId: unsubscribeGroupIdFlag,
+	pageSize: pageSizeFlag,
+	trackOpens: trackOpensFlag$2,
+	trackClicks: trackClicksFlag$2,
+	dryRun: dryRunFlag$4,
+	json: jsonFlag
+}).pipe(Command.withDescription("Create an email campaign targeting tags or explicit contacts"), Command.withExamples([{
+	command: "samva campaigns create --name \"Spring launch\" --subject \"We are live\" --html \"<h1>Hi</h1>\" --include-tags newsletter,customers",
+	description: "Campaign to tagged contacts"
+}, {
+	command: "samva campaigns create --name \"VIP note\" --subject Hi --html \"<p>Hello</p>\" --text Hello --contact-ids c_1 --contact-ids c_2 --dry-run",
+	description: "Target explicit contacts and preview the payload"
+}]), Command.withHandler(({ name, subject, html, text, templateId, templateSlug, templateData, includeTags, excludeTags, contactIds, unsubscribeGroupId, pageSize, trackOpens, trackClicks, dryRun, json }) => Effect.gen(function* () {
+	const htmlValue = Option.getOrUndefined(html);
+	const textValue = Option.getOrUndefined(text);
+	const templateIdValue = Option.getOrUndefined(templateId);
+	const templateSlugValue = Option.getOrUndefined(templateSlug);
+	const templateDataValue = yield* parseTemplateData$2(templateData);
+	if (templateIdValue && templateSlugValue) return yield* new SamvaCliError({ message: "Use either --template-id or --template-slug, not both." });
+	const templateRefValue = templateSlugValue ?? templateIdValue;
+	if (templateRefValue && (Option.isSome(subject) || htmlValue || textValue)) return yield* new SamvaCliError({ message: "Choose one content source: a template, or inline --subject with --html (and optional --text)." });
+	if (!templateRefValue && Option.isNone(subject)) return yield* new SamvaCliError({ message: "Provide --subject with inline --html, or reference a published template." });
+	if (!templateRefValue && !htmlValue) return yield* new SamvaCliError({ message: "Provide --html for inline email; --text is an optional fallback." });
+	const includeTagsValue = parseTagList(includeTags);
+	const excludeTagsValue = parseTagList(excludeTags);
+	const contactIdsValue = parseTagList(contactIds);
+	if (includeTagsValue.length === 0 && contactIdsValue.length === 0) return yield* new SamvaCliError({ message: "Provide an audience: at least one of --include-tags or --contact-ids (--exclude-tags only narrows an include set)." });
+	const payload = assembleCampaignCreatePayload({
+		name,
+		subject: Option.getOrUndefined(subject),
+		html: htmlValue,
+		text: textValue,
+		templateId: templateIdValue,
+		templateSlug: templateSlugValue,
+		templateData: templateDataValue,
+		includeTags: includeTagsValue,
+		excludeTags: excludeTagsValue,
+		contactIds: contactIdsValue,
+		unsubscribeGroupId: Option.getOrUndefined(unsubscribeGroupId),
+		pageSize: Option.getOrUndefined(pageSize),
+		tracking: Option.isSome(trackOpens) || Option.isSome(trackClicks) ? {
+			...Option.isSome(trackOpens) ? { opens: trackOpens.value === "on" } : {},
+			...Option.isSome(trackClicks) ? { clicks: trackClicks.value === "on" } : {}
+		} : void 0
+	});
+	if (dryRun) {
+		if (json) return yield* printJson({
+			dryRun: true,
+			request: payload
+		});
+		yield* Effect.logInfo("Dry run — no campaign created.\n");
+		yield* printFields([
+			["Name", name],
+			["Include tags", includeTagsValue.join(", ")],
+			["Exclude tags", excludeTagsValue.join(", ")],
+			["Contact ids", contactIdsValue.join(", ")]
+		]);
+		return yield* Console.log(`\nPayload:\n${truncateForDisplay(JSON.stringify(payload, null, 2))}`);
+	}
+	const client = yield* getClientProvider;
+	const data = yield* Campaigns.create(payload).pipe(client.provide, Effect.mapError((error) => new SamvaCliError({ message: formatApiError("Failed to create campaign", error) })));
+	if (json) return yield* printJson(data);
+	yield* Effect.logInfo("Campaign created.\n");
+	yield* printFields([
+		["ID", data.id],
+		["Name", data.name],
+		["Channel", data.channel],
+		["Status", data.status]
+	]);
+	yield* Effect.logInfo(`\nCreate a run:  samva campaigns runs create ${data.id}`);
+}).pipe(json ? Effect.provideService(References.MinimumLogLevel, "None") : identity)));
+const list$7 = Command.make("list", {
+	status: campaignStatusFlag,
+	page: pageFlag$2,
+	limit: limitFlag$2,
+	all: allFlag$2,
+	json: jsonFlag
+}).pipe(Command.withDescription("List campaigns"), Command.withExamples([
+	{ command: "samva campaigns list" },
+	{ command: "samva campaigns list --status draft --json" },
+	{
+		command: "samva campaigns list --all --jsonl",
+		description: "Stream every page as JSONL"
+	}
+]), Command.withHandler(({ status, page, limit, all, json }) => Effect.gen(function* () {
+	if (all && !isJsonLinesRequested()) return yield* new CliUsageError({
+		code: "all_requires_jsonl",
+		message: "--all is an unbounded traversal and requires --jsonl."
+	});
+	const pageValue = Option.getOrUndefined(page);
+	const limitValue = Option.getOrUndefined(limit);
+	const client = yield* getClientProvider;
+	const query = {
+		status: Option.getOrUndefined(status),
+		page: pageValue?.toString(),
+		limit: limitValue?.toString()
+	};
+	if (all) {
+		let nextPage = pageValue ?? 1;
+		for (;;) {
+			const data = yield* Campaigns.list({
+				...query,
+				page: nextPage.toString()
+			}).pipe(client.provide, Effect.mapError((error) => new SamvaCliError({ message: formatApiError("Could not list campaigns", error) })));
+			for (const item of data.items) yield* printJsonLine(item);
+			if (nextPage >= data.pagination.totalPages || data.items.length === 0) return;
+			nextPage += 1;
+		}
+	}
+	const data = yield* Campaigns.list(query).pipe(client.provide, Effect.mapError((error) => new SamvaCliError({ message: formatApiError("Could not list campaigns", error) })));
+	if (isJsonLinesRequested()) {
+		for (const item of data.items) yield* printJsonLine(item);
+		return;
+	}
+	if (json) return yield* printJson(data);
+	if (data.items.length === 0) return yield* Console.log("No campaigns yet. Create one with `samva campaigns create`.");
+	for (const campaign of data.items) {
+		yield* printFields([
+			["ID", campaign.id],
+			["Name", campaign.name],
+			["Channel", campaign.channel],
+			["Status", campaign.status]
+		]);
+		yield* Console.log("");
+	}
+	yield* Console.log(`Page ${String(data.pagination.page)} of ${String(data.pagination.totalPages)} (${String(data.pagination.total)} total)`);
+}).pipe(json ? Effect.provideService(References.MinimumLogLevel, "None") : identity)));
+const printCampaign = (campaign) => printFields([
+	["ID", campaign.id],
+	["Name", campaign.name],
+	["Channel", campaign.channel],
+	["Status", campaign.status],
+	["Include tags", (campaign.audience.includeTags ?? []).join(", ")],
+	["Exclude tags", (campaign.audience.excludeTags ?? []).join(", ")],
+	["Contact ids", (campaign.audience.contactIds ?? []).join(", ")],
+	["Created", campaign.createdAt],
+	["Updated", campaign.updatedAt]
+]);
+const get$3 = Command.make("get", {
+	id: Argument.string("id"),
+	json: jsonFlag
+}).pipe(Command.withDescription("Show a campaign by id"), Command.withExamples([{ command: "samva campaigns get camp_abc123" }]), Command.withHandler(({ id, json }) => Effect.gen(function* () {
+	const client = yield* getClientProvider;
+	const data = yield* Campaigns.get({ id }).pipe(client.provide, Effect.mapError((error) => new SamvaCliError({ message: formatApiError("Could not fetch campaign", error) })));
+	if (json) return yield* printJson(data);
+	yield* printCampaign(data);
+}).pipe(json ? Effect.provideService(References.MinimumLogLevel, "None") : identity)));
+const update$1 = Command.make("update", {
+	id: Argument.string("id"),
+	name: Flag.string("name").pipe(Flag.withDescription("New campaign name"), Flag.optional),
+	subject: subjectFlag$2,
+	html: htmlFlag$2,
+	text: textFlag$2,
+	templateId: templateIdFlag$2,
+	templateSlug: templateSlugFlag$2,
+	templateData: templateDataFlag$2,
+	includeTags: includeTagsFlag,
+	excludeTags: excludeTagsFlag,
+	contactIds: contactIdsFlag,
+	unsubscribeGroupId: unsubscribeGroupIdFlag,
+	pageSize: pageSizeFlag,
+	trackOpens: trackOpensFlag$2,
+	trackClicks: trackClicksFlag$2,
+	json: jsonFlag
+}).pipe(Command.withDescription("Update a draft campaign before its first run"), Command.withExamples([{ command: "samva campaigns update camp_abc123 --name \"August launch\"" }, {
+	command: "samva campaigns update camp_abc123 --template-slug august-launch --include-tags newsletter",
+	description: "Replace content and audience while the definition is still editable"
+}]), Command.withHandler(({ id, name, subject, html, text, templateId, templateSlug, templateData, includeTags, excludeTags, contactIds, unsubscribeGroupId, pageSize, trackOpens, trackClicks, json }) => Effect.gen(function* () {
+	const htmlValue = Option.getOrUndefined(html);
+	const textValue = Option.getOrUndefined(text);
+	const templateIdValue = Option.getOrUndefined(templateId);
+	const templateSlugValue = Option.getOrUndefined(templateSlug);
+	if (templateIdValue && templateSlugValue) return yield* new SamvaCliError({ message: "Use either --template-id or --template-slug, not both." });
+	const templateDataValue = yield* parseTemplateData$2(templateData);
+	const templateRefValue = templateSlugValue ?? templateIdValue;
+	const hasContentFlags = Option.isSome(subject) || Boolean(htmlValue || textValue || templateRefValue) || Option.isSome(templateData) || Option.isSome(trackOpens) || Option.isSome(trackClicks);
+	if (templateRefValue && (Option.isSome(subject) || htmlValue || textValue)) return yield* new SamvaCliError({ message: "Choose one content source: a template, or inline --subject with --html (and optional --text)." });
+	if (hasContentFlags && !templateRefValue && Option.isNone(subject)) return yield* new SamvaCliError({ message: "Provide --subject with inline --html, or reference a published template." });
+	if (hasContentFlags && !templateRefValue && !htmlValue) return yield* new SamvaCliError({ message: "Provide --html for inline email; --text is an optional fallback." });
+	const includeTagsValue = parseTagList(includeTags);
+	const excludeTagsValue = parseTagList(excludeTags);
+	const contactIdsValue = parseTagList(contactIds);
+	const hasAudience = includeTagsValue.length > 0 || excludeTagsValue.length > 0 || contactIdsValue.length > 0;
+	const hasPolicy = Option.isSome(unsubscribeGroupId) || Option.isSome(pageSize);
+	const hasContent = hasContentFlags;
+	const tracking = Option.isSome(trackOpens) || Option.isSome(trackClicks) ? {
+		...Option.isSome(trackOpens) ? { opens: trackOpens.value === "on" } : {},
+		...Option.isSome(trackClicks) ? { clicks: trackClicks.value === "on" } : {}
+	} : void 0;
+	if (hasAudience && includeTagsValue.length === 0 && contactIdsValue.length === 0) return yield* new SamvaCliError({ message: "A replacement audience requires --include-tags or --contact-ids; --exclude-tags only narrows it." });
+	if (!Option.isSome(name) && !hasContent && !hasAudience && !hasPolicy) return yield* new SamvaCliError({ message: "Provide at least one field to update. Run `samva campaigns update --help`." });
+	const payload = {
+		name: Option.getOrUndefined(name),
+		content: hasContent ? {
+			channel: "email",
+			email: {
+				subject: Option.getOrUndefined(subject),
+				html: htmlValue,
+				text: textValue,
+				templateId: templateIdValue,
+				templateSlug: templateSlugValue,
+				templateData: templateDataValue,
+				...tracking === void 0 ? {} : { tracking }
+			}
+		} : void 0,
+		audience: hasAudience ? {
+			includeTags: includeTagsValue.length > 0 ? includeTagsValue : void 0,
+			excludeTags: excludeTagsValue.length > 0 ? excludeTagsValue : void 0,
+			contactIds: contactIdsValue.length > 0 ? contactIdsValue : void 0
+		} : void 0,
+		policy: hasPolicy ? {
+			unsubscribeGroupId: Option.getOrUndefined(unsubscribeGroupId),
+			pageSize: Option.getOrUndefined(pageSize)
+		} : void 0
+	};
+	const client = yield* getClientProvider;
+	const data = yield* Campaigns.update({
+		id,
+		...payload
+	}).pipe(client.provide, Effect.mapError((error) => new SamvaCliError({ message: formatApiError("Could not update campaign", error) })));
+	if (json) return yield* printJson(data);
+	yield* Effect.logInfo("Campaign updated. Definitions freeze after the first run.\n");
+	yield* printCampaign(data);
+}).pipe(json ? Effect.provideService(References.MinimumLogLevel, "None") : identity)));
+const archive = Command.make("archive", {
+	id: Argument.string("id"),
+	dryRun: Flag.boolean("dry-run").pipe(Flag.withDefault(false)),
+	yes: Flag.boolean("yes").pipe(Flag.withDefault(false)),
+	json: jsonFlag
+}).pipe(Command.withDescription("Archive a campaign"), Command.withExamples([{ command: "samva campaigns archive camp_abc123 --dry-run" }, { command: "samva campaigns archive camp_abc123 --yes" }]), Command.withHandler(({ id, dryRun, yes, json }) => Effect.gen(function* () {
+	if (dryRun) return yield* json ? printJson({
+		dryRun: true,
+		action: "campaigns.archive",
+		id
+	}) : Console.log(`[dry-run] Would archive campaign ${id}.`);
+	yield* confirmDestructive({
+		yes,
+		json,
+		message: `Archive campaign ${id}? It will no longer be eligible to run.`,
+		nonInteractiveMessage: "Campaign archival requires --yes in non-interactive mode. Preview with --dry-run."
+	});
+	const client = yield* getClientProvider;
+	const data = yield* Campaigns.archive({ id }).pipe(client.provide, Effect.mapError((error) => new SamvaCliError({ message: formatApiError("Could not archive campaign", error) })));
+	if (json) return yield* printJson(data);
+	yield* Effect.logInfo("Campaign archived.\n");
+	yield* printFields([
+		["ID", data.id],
+		["Name", data.name],
+		["Status", data.status]
+	]);
+}).pipe(json ? Effect.provideService(References.MinimumLogLevel, "None") : identity)));
+const printRun = (run) => printFields([
+	["Run ID", run.id],
+	["Campaign", run.campaignId],
+	["Status", run.status],
+	["Scheduled for", run.scheduledFor],
+	["Started", run.startedAt],
+	["Completed", run.completedAt],
+	["Recipients", String(run.totalRecipients)],
+	["Dispatched", String(run.dispatchedCount)],
+	["Failed", String(run.failedCount)],
+	["Skipped", String(run.skippedCount)],
+	["Failure", run.failureReason]
+]);
+const runCreate = Command.make("create", {
+	campaignId: Argument.string("campaignId"),
+	at: atFlag$1,
+	idempotencyKey: idempotencyKeyFlag$2,
+	dryRun: dryRunFlag$4,
+	json: jsonFlag
+}).pipe(Command.withDescription("Create a run for a campaign (starts immediately without --at)"), Command.withExamples([{
+	command: "samva campaigns runs create camp_abc123",
+	description: "Start now"
+}, {
+	command: "samva campaigns runs create camp_abc123 --at 2026-08-01T09:00:00Z",
+	description: "Start at a future time"
+}]), Command.withHandler(({ campaignId, at, idempotencyKey, dryRun, json }) => Effect.gen(function* () {
+	const atValue = Option.getOrUndefined(at);
+	if (atValue !== void 0 && !isAbsoluteInstant$1(atValue)) return yield* new SamvaCliError({ message: "--at must be an absolute ISO 8601 instant with Z or an offset, e.g. 2026-08-01T09:00:00Z." });
+	const idempotencyKeyValue = Option.getOrUndefined(idempotencyKey);
+	if (dryRun) return yield* json ? printJson({
+		dryRun: true,
+		action: "campaigns.runs.create",
+		campaignId,
+		scheduledFor: atValue,
+		idempotencyKey: idempotencyKeyValue
+	}) : Console.log(`[dry-run] Would create a run for campaign ${campaignId}${atValue ? ` at ${atValue}` : " now"}.`);
+	const client = yield* getClientProvider;
+	const data = yield* Campaigns.scheduleRun({
+		id: campaignId,
+		scheduledFor: atValue === void 0 ? void 0 : new Date(atValue),
+		idempotencyKey: idempotencyKeyValue
+	}).pipe(client.provide, Effect.mapError((error) => new SamvaCliError({ message: formatApiError("Could not schedule run", error) })));
+	if (json) return yield* printJson(data);
+	yield* Effect.logInfo("Run scheduled.\n");
+	yield* printRun(data);
+}).pipe(json ? Effect.provideService(References.MinimumLogLevel, "None") : identity)));
+const runList = Command.make("list", {
+	campaignId: Argument.string("campaignId"),
+	status: runStatusFlag,
+	page: pageFlag$2,
+	limit: limitFlag$2,
+	all: allFlag$2,
+	json: jsonFlag
+}).pipe(Command.withDescription("List runs for a campaign"), Command.withExamples([{ command: "samva campaigns runs list camp_abc123" }]), Command.withHandler(({ campaignId, status, page, limit, all, json }) => Effect.gen(function* () {
+	if (all && !isJsonLinesRequested()) return yield* new CliUsageError({
+		code: "all_requires_jsonl",
+		message: "--all is an unbounded traversal and requires --jsonl."
+	});
+	const pageValue = Option.getOrUndefined(page);
+	const limitValue = Option.getOrUndefined(limit);
+	const client = yield* getClientProvider;
+	const query = {
+		id: campaignId,
+		status: Option.getOrUndefined(status),
+		page: pageValue?.toString(),
+		limit: limitValue?.toString()
+	};
+	if (all) {
+		let nextPage = pageValue ?? 1;
+		for (;;) {
+			const data = yield* Campaigns.listRuns({
+				...query,
+				page: nextPage.toString()
+			}).pipe(client.provide, Effect.mapError((error) => new SamvaCliError({ message: formatApiError("Could not list runs", error) })));
+			for (const item of data.items) yield* printJsonLine(item);
+			if (nextPage >= data.pagination.totalPages || data.items.length === 0) return;
+			nextPage += 1;
+		}
+	}
+	const data = yield* Campaigns.listRuns(query).pipe(client.provide, Effect.mapError((error) => new SamvaCliError({ message: formatApiError("Could not list runs", error) })));
+	if (isJsonLinesRequested()) {
+		for (const item of data.items) yield* printJsonLine(item);
+		return;
+	}
+	if (json) return yield* printJson(data);
+	if (data.items.length === 0) return yield* Console.log("No runs yet. Create one with `samva campaigns runs create`.");
+	for (const run of data.items) {
+		yield* printFields([
+			["Run ID", run.id],
+			["Status", run.status],
+			["Scheduled for", run.scheduledFor],
+			["Dispatched", String(run.dispatchedCount)],
+			["Failed", String(run.failedCount)],
+			["Skipped", String(run.skippedCount)]
+		]);
+		yield* Console.log("");
+	}
+	yield* Console.log(`Page ${String(data.pagination.page)} of ${String(data.pagination.totalPages)} (${String(data.pagination.total)} total)`);
+}).pipe(json ? Effect.provideService(References.MinimumLogLevel, "None") : identity)));
+const runGet = Command.make("get", {
+	campaignId: Argument.string("campaignId"),
+	runId: Argument.string("runId"),
+	json: jsonFlag
+}).pipe(Command.withDescription("Show a campaign run"), Command.withExamples([{ command: "samva campaigns runs get camp_abc123 run_def456" }]), Command.withHandler(({ campaignId, runId, json }) => Effect.gen(function* () {
+	const client = yield* getClientProvider;
+	const data = yield* Campaigns.getRun({
+		id: campaignId,
+		runId
+	}).pipe(client.provide, Effect.mapError((error) => new SamvaCliError({ message: formatApiError("Could not fetch run", error) })));
+	if (json) return yield* printJson(data);
+	yield* printRun(data);
+}).pipe(json ? Effect.provideService(References.MinimumLogLevel, "None") : identity)));
+const runPause = Command.make("pause", {
+	campaignId: Argument.string("campaignId"),
+	runId: Argument.string("runId"),
+	dryRun: dryRunFlag$4,
+	json: jsonFlag
+}).pipe(Command.withDescription("Pause a running campaign run"), Command.withExamples([{ command: "samva campaigns runs pause camp_abc123 run_def456" }]), Command.withHandler(({ campaignId, runId, dryRun, json }) => Effect.gen(function* () {
+	if (dryRun) return yield* json ? printJson({
+		dryRun: true,
+		action: "campaigns.runs.pause",
+		campaignId,
+		runId
+	}) : Console.log(`[dry-run] Would pause campaign run ${runId}.`);
+	const client = yield* getClientProvider;
+	const data = yield* Campaigns.pauseRun({
+		id: campaignId,
+		runId
+	}).pipe(client.provide, Effect.mapError((error) => new SamvaCliError({ message: formatApiError("Could not pause run", error) })));
+	if (json) return yield* printJson(data);
+	yield* Effect.logInfo("Run paused.\n");
+	yield* printRun(data.item);
+}).pipe(json ? Effect.provideService(References.MinimumLogLevel, "None") : identity)));
+const runResume = Command.make("resume", {
+	campaignId: Argument.string("campaignId"),
+	runId: Argument.string("runId"),
+	dryRun: dryRunFlag$4,
+	json: jsonFlag
+}).pipe(Command.withDescription("Resume a paused campaign run"), Command.withExamples([{ command: "samva campaigns runs resume camp_abc123 run_def456" }]), Command.withHandler(({ campaignId, runId, dryRun, json }) => Effect.gen(function* () {
+	if (dryRun) return yield* json ? printJson({
+		dryRun: true,
+		action: "campaigns.runs.resume",
+		campaignId,
+		runId
+	}) : Console.log(`[dry-run] Would resume campaign run ${runId}.`);
+	const client = yield* getClientProvider;
+	const data = yield* Campaigns.resumeRun({
+		id: campaignId,
+		runId
+	}).pipe(client.provide, Effect.mapError((error) => new SamvaCliError({ message: formatApiError("Could not resume run", error) })));
+	if (json) return yield* printJson(data);
+	yield* Effect.logInfo("Run resumed.\n");
+	yield* printRun(data.item);
+}).pipe(json ? Effect.provideService(References.MinimumLogLevel, "None") : identity)));
+const runCancel = Command.make("cancel", {
+	campaignId: Argument.string("campaignId"),
+	runId: Argument.string("runId"),
+	dryRun: Flag.boolean("dry-run").pipe(Flag.withDefault(false)),
+	yes: Flag.boolean("yes").pipe(Flag.withDefault(false)),
+	json: jsonFlag
+}).pipe(Command.withDescription("Cancel a campaign run (best effort once dispatch has started; terminal when scheduled)"), Command.withExamples([{ command: "samva campaigns runs cancel camp_abc123 run_def456 --dry-run" }, { command: "samva campaigns runs cancel camp_abc123 run_def456 --yes" }]), Command.withHandler(({ campaignId, runId, dryRun, yes, json }) => Effect.gen(function* () {
+	if (dryRun) return yield* json ? printJson({
+		dryRun: true,
+		action: "campaigns.runs.cancel",
+		campaignId,
+		runId
+	}) : Console.log(`[dry-run] Would cancel campaign run ${runId}.`);
+	yield* confirmDestructive({
+		yes,
+		json,
+		message: `Cancel campaign run ${runId}? Dispatches already in progress may still complete.`,
+		nonInteractiveMessage: "Campaign run cancellation requires --yes in non-interactive mode. Preview with --dry-run."
+	});
+	const client = yield* getClientProvider;
+	const data = yield* Campaigns.cancelRun({
+		id: campaignId,
+		runId
+	}).pipe(client.provide, Effect.mapError((error) => new SamvaCliError({ message: formatApiError("Could not cancel run", error) })));
+	if (json) return yield* printJson(data);
+	yield* Effect.logInfo("Run cancelled.\n");
+	yield* printRun(data.item);
+}).pipe(json ? Effect.provideService(References.MinimumLogLevel, "None") : identity)));
+const runRecipients = Command.make("recipients", {
+	campaignId: Argument.string("campaignId"),
+	runId: Argument.string("runId"),
+	status: recipientStatusFlag,
+	page: pageFlag$2,
+	limit: limitFlag$2,
+	all: allFlag$2,
+	json: jsonFlag
+}).pipe(Command.withDescription("List recipients for a campaign run"), Command.withExamples([{ command: "samva campaigns runs recipients camp_abc123 run_def456" }, {
+	command: "samva campaigns runs recipients camp_abc123 run_def456 --status failed",
+	description: "Only failed recipients"
+}]), Command.withHandler(({ campaignId, runId, status, page, limit, all, json }) => Effect.gen(function* () {
+	if (all && !isJsonLinesRequested()) return yield* new CliUsageError({
+		code: "all_requires_jsonl",
+		message: "--all is an unbounded traversal and requires --jsonl."
+	});
+	const pageValue = Option.getOrUndefined(page);
+	const limitValue = Option.getOrUndefined(limit);
+	const client = yield* getClientProvider;
+	const query = {
+		id: campaignId,
+		runId,
+		status: Option.getOrUndefined(status),
+		page: pageValue?.toString(),
+		limit: limitValue?.toString()
+	};
+	if (all) {
+		let nextPage = pageValue ?? 1;
+		for (;;) {
+			const data = yield* Campaigns.listRecipients({
+				...query,
+				page: nextPage.toString()
+			}).pipe(client.provide, Effect.mapError((error) => new SamvaCliError({ message: formatApiError("Could not list recipients", error) })));
+			for (const item of data.items) yield* printJsonLine(item);
+			if (nextPage >= data.pagination.totalPages || data.items.length === 0) return;
+			nextPage += 1;
+		}
+	}
+	const data = yield* Campaigns.listRecipients(query).pipe(client.provide, Effect.mapError((error) => new SamvaCliError({ message: formatApiError("Could not list recipients", error) })));
+	if (isJsonLinesRequested()) {
+		for (const item of data.items) yield* printJsonLine(item);
+		return;
+	}
+	if (json) return yield* printJson(data);
+	if (data.items.length === 0) return yield* Console.log("No recipients for this run.");
+	for (const recipient of data.items) {
+		yield* printFields([
+			["Contact", recipient.contactId],
+			["Status", recipient.status],
+			["Message ID", recipient.messageId],
+			["Skipped", recipient.skippedReason],
+			["Failure", recipient.failureReason]
+		]);
+		yield* Console.log("");
+	}
+	yield* Console.log(`Page ${String(data.pagination.page)} of ${String(data.pagination.totalPages)} (${String(data.pagination.total)} total)`);
+}).pipe(json ? Effect.provideService(References.MinimumLogLevel, "None") : identity)));
+const runsCommand = Command.make("runs").pipe(Command.withDescription("Manage campaign runs"), Command.withExamples([{
+	command: "samva campaigns runs create camp_abc123",
+	description: "Start a run now"
+}, {
+	command: "samva campaigns runs list camp_abc123",
+	description: "List runs"
+}]), Command.withSubcommands([
+	runCreate,
+	runList,
+	runGet,
+	runPause,
+	runResume,
+	runCancel,
+	runRecipients
+]));
+const campaignsCommand = Command.make("campaigns").pipe(Command.withDescription("Create and operate audience-targeted campaigns"), Command.withExamples([{
+	command: "samva campaigns create --name \"Spring launch\" --subject Hi --html \"<h1>Hi</h1>\" --include-tags newsletter",
+	description: "Create a campaign"
+}, {
+	command: "samva campaigns runs create camp_abc123",
+	description: "Create a run"
+}]), Command.withSubcommands([
+	create$3,
+	list$7,
+	get$3,
+	update$1,
+	archive,
+	runsCommand
+]));
+//#endregion
+//#region src/commands/design.ts
+const fileFlag = Flag.file("file").pipe(Flag.withDescription("Path to the Tailwind-v4 @theme CSS file"), Flag.withDefault("theme.css"));
+const dryRunFlag$3 = Flag.boolean("dry-run").pipe(Flag.withDescription("Preview without updating the API (theme push may read current tokens)"), Flag.withDefault(false));
+const toMarkupFontToken = (token) => ({
+	family: token.family,
+	fallback: token.fallback,
+	faces: token.faces == null ? void 0 : token.faces.map((face) => ({
+		weight: face.weight,
+		style: face.style,
+		src: face.src,
+		unicodeRange: face.unicodeRange ?? void 0
+	}))
+});
+const toMarkupFontFamilies = (fontFamilies) => {
+	const result = {};
+	for (const [name, token] of Object.entries(fontFamilies)) result[name] = toMarkupFontToken(token);
+	return result;
+};
+/**
+* The GET response folds the persisted font tokens onto the compiler's inline
+* stack string (the same `flattenFontTokens` transform apps/api and the web
+* canvas share), and every other namespace's `null` onto `undefined` so the
+* printer sees the ParsedTheme shape it expects.
+*/
+const fromServerTheme = (theme) => ({
+	colors: theme.colors ?? void 0,
+	colorsDark: theme.colorsDark ?? void 0,
+	radiusPx: theme.radiusPx ?? void 0,
+	fontFamilies: theme.fontFamilies == null ? void 0 : flattenFontTokens(toMarkupFontFamilies(theme.fontFamilies)).fontFamilies,
+	fontWeights: theme.fontWeights ?? void 0,
+	text: theme.text ?? void 0,
+	leading: theme.leading ?? void 0,
+	spacingPx: theme.spacingPx ?? void 0,
+	containerPx: theme.containerPx ?? void 0,
+	tracking: theme.tracking ?? void 0
+});
+const FALLBACK_STACK_DEFAULT = "sans-serif";
+const unquote = (value) => value.startsWith("'") && value.endsWith("'") ? value.slice(1, -1) : value;
+/** Split a flattened inline stack (`'Family', fallback, generic`) into the
+*  leading family (quotes stripped) and the remaining fallback, for building a
+*  system font token from a `--font-*` line that doesn't match any existing
+*  server-hosted token. */
+const splitFontStack = (stack) => {
+	const commaIndex = stack.indexOf(",");
+	if (commaIndex === -1) return {
+		family: unquote(stack.trim()),
+		fallback: FALLBACK_STACK_DEFAULT
+	};
+	const family = unquote(stack.slice(0, commaIndex).trim());
+	const fallback = stack.slice(commaIndex + 1).trim();
+	return {
+		family,
+		fallback: fallback.length > 0 ? fallback : FALLBACK_STACK_DEFAULT
+	};
+};
+/**
+* Resolve the PUT payload's `fontFamilies` from the parsed CSS against the
+* org's current server tokens. A `--font-*` line whose flattened value is
+* unchanged from the server's keeps that server token verbatim (preserving a
+* hosted google/custom token's faces); a new or edited line becomes a
+* `source: "system"` token built from the stack text. Names absent from the
+* parsed CSS are dropped — full-replace, matching every other namespace.
+*/
+const buildPushFontFamilies = (parsedFontFamilies, serverFontFamilies) => {
+	if (parsedFontFamilies === void 0) return {
+		fontFamilies: void 0,
+		notices: []
+	};
+	const serverFlattened = serverFontFamilies === void 0 ? {} : flattenFontTokens(toMarkupFontFamilies(serverFontFamilies)).fontFamilies;
+	const notices = [];
+	const result = {};
+	for (const [name, stack] of Object.entries(parsedFontFamilies)) {
+		const serverToken = serverFontFamilies?.[name];
+		if (serverToken !== void 0 && serverFlattened[name] === stack) {
+			result[name] = serverToken;
+			continue;
+		}
+		if (serverToken !== void 0 && serverToken.source !== "system") notices.push(`Editing --font-${name} in CSS converts it to a system font stack; use the dashboard font picker for hosted/Google fonts.`);
+		const { family, fallback } = splitFontStack(stack);
+		result[name] = {
+			source: "system",
+			family,
+			fallback
+		};
+	}
+	return {
+		fontFamilies: result,
+		notices
+	};
+};
+/** Fold ParsedTheme onto the persisted shape for the PUT payload. `fontFamilies`
+*  comes from `buildPushFontFamilies` (the parsed stack strings alone can't
+*  recover a hosted token's source/faces). */
+const toServerTheme = (parsed, fontFamilies) => {
+	const tracking = parsed.tracking ?? parsed.trackingEm;
+	return {
+		...parsed.colors === void 0 ? {} : { colors: parsed.colors },
+		...parsed.colorsDark === void 0 ? {} : { colorsDark: parsed.colorsDark },
+		...parsed.radiusPx === void 0 ? {} : { radiusPx: parsed.radiusPx },
+		...fontFamilies === void 0 ? {} : { fontFamilies },
+		...parsed.fontWeights === void 0 ? {} : { fontWeights: parsed.fontWeights },
+		...parsed.text === void 0 ? {} : { text: parsed.text },
+		...parsed.leading === void 0 ? {} : { leading: parsed.leading },
+		...parsed.spacingPx === void 0 ? {} : { spacingPx: parsed.spacingPx },
+		...parsed.containerPx === void 0 ? {} : { containerPx: parsed.containerPx },
+		...tracking === void 0 ? {} : { tracking }
+	};
+};
+const pull$1 = Command.make("pull", {
+	file: fileFlag,
+	dryRun: dryRunFlag$3,
+	json: jsonFlag
+}).pipe(Command.withDescription("Write the org's email theme to a Tailwind-v4 @theme CSS file"), Command.withExamples([{
+	command: "samva email design pull",
+	description: "Write the org theme to theme.css"
+}, {
+	command: "samva email design pull --file emails/theme.css",
+	description: "Write the org theme to a specific path"
+}]), Command.withHandler(({ file, dryRun, json }) => Effect.gen(function* () {
+	const target = resolve(file);
+	if (dryRun) return yield* json ? printJson({
+		dryRun: true,
+		action: "theme.pull",
+		file: target
+	}) : Console.log(`[dry-run] Would write the org theme to ${target}.`);
+	const client = yield* getClientProvider;
+	const theme = (yield* Design.get().pipe(client.provide, Effect.mapError((error) => new SamvaCliError({ message: formatApiError("Could not read design", error) })))).design?.theme ?? null;
+	if (theme === null) {
+		if (json) return yield* printJson({
+			action: "design.pull",
+			file: target,
+			theme: null,
+			written: false
+		});
+		return yield* Console.log("This org has no configured theme yet. Author one and run `samva email design push`.");
+	}
+	const css = printThemeCss(fromServerTheme(theme));
+	yield* Effect.tryPromise({
+		try: async () => {
+			await mkdir(dirname(target), { recursive: true });
+			await writeFile(target, css, "utf8");
+		},
+		catch: (cause) => new SamvaCliError({ message: `Could not write ${target}: ${String(cause)}` })
+	});
+	if (json) return yield* printJson({
+		action: "design.pull",
+		file: target,
+		theme,
+		written: true
+	});
+	yield* Effect.logInfo(`Wrote ${target}`);
+	yield* Console.log(`\n${css}`);
+}).pipe(json ? Effect.provideService(References.MinimumLogLevel, "None") : identity)));
+const push$1 = Command.make("push", {
+	file: fileFlag,
+	dryRun: dryRunFlag$3,
+	json: jsonFlag
+}).pipe(Command.withDescription("Parse a @theme CSS file and set it as the org's email theme"), Command.withExamples([{
+	command: "samva email design push",
+	description: "Parse theme.css and set it as the org theme"
+}, {
+	command: "samva email design push --dry-run",
+	description: "Preview without updating the org theme (may read current tokens)"
+}]), Command.withHandler(({ file, dryRun, json }) => Effect.gen(function* () {
+	const target = resolve(file);
+	const css = yield* Effect.tryPromise({
+		try: () => readFile(target, "utf8"),
+		catch: () => new SamvaCliError({ message: `Could not read ${target}. Run \`samva email design pull\` first, or point --file at your @theme CSS.` })
+	});
+	const parsed = parseThemeCss(css);
+	if (Result.isFailure(parsed)) {
+		const diagnostics = parsed.failure;
+		if (json) yield* printJson({
+			action: "theme.push",
+			file: target,
+			ok: false,
+			diagnostics: diagnostics.map((diagnostic) => ({
+				code: diagnostic.code,
+				message: diagnostic.message,
+				span: diagnostic.span
+			}))
+		});
+		else {
+			yield* Effect.logWarning(`${target} has ${diagnostics.length} theme error(s):\n`);
+			for (const diagnostic of diagnostics) yield* Effect.logWarning(`  ✗ ${formatDiagnostic(css, diagnostic)}`);
+		}
+		return yield* new SamvaCliError({ message: `Theme not pushed — fix ${diagnostics.length} diagnostic(s) in ${target}.` });
+	}
+	const client = yield* getClientProvider;
+	const current = yield* Design.get().pipe(client.provide, Effect.mapError((error) => new SamvaCliError({ message: formatApiError("Could not read design", error) })));
+	const { fontFamilies, notices } = buildPushFontFamilies(parsed.success.fontFamilies, current.design?.theme?.fontFamilies ?? void 0);
+	for (const notice of notices) yield* Effect.logWarning(notice);
+	const theme = toServerTheme(parsed.success, fontFamilies);
+	const design = {
+		...current.design,
+		theme
+	};
+	if (dryRun) {
+		if (json) return yield* printJson({
+			action: "design.push",
+			file: target,
+			dryRun: true,
+			theme
+		});
+		yield* Effect.logInfo(`Parsed ${target}`);
+		return yield* Console.log(`\n${truncateForDisplay(JSON.stringify(theme, null, 2))}`);
+	}
+	yield* Design.update({ design }).pipe(client.provide, Effect.mapError((error) => new SamvaCliError({ message: formatApiError("Could not set design", error) })));
+	if (json) return yield* printJson({
+		action: "design.push",
+		file: target,
+		dryRun: false,
+		theme
+	});
+	yield* Effect.logInfo(`✓ Set org theme from ${target}`);
+}).pipe(json ? Effect.provideService(References.MinimumLogLevel, "None") : identity)));
+const designCommand = Command.make("design").pipe(Command.withDescription("Pull and push the org's email theme as Tailwind-v4 @theme CSS"), Command.withExamples([{
+	command: "samva email design pull",
+	description: "Write the org theme to theme.css"
+}, {
+	command: "samva email design push --dry-run",
+	description: "Parse theme.css and preview the tokens"
+}]), Command.withSubcommands([pull$1, push$1]));
+//#endregion
+//#region src/lib/http.ts
+const postJson = (url, payload) => Effect.tryPromise({
+	try: async () => {
+		const res = await fetch(url, {
+			method: "POST",
+			headers: { "content-type": "application/json" },
+			body: JSON.stringify(payload)
+		});
+		return {
+			ok: res.ok,
+			status: res.status,
+			body: await res.text()
+		};
+	},
+	catch: (cause) => new SamvaCliError({ message: `Request to ${url} failed: ${String(cause)}` })
+});
+const getText = (url) => Effect.tryPromise({
+	try: async () => {
+		const res = await fetch(url);
+		return {
+			ok: res.ok,
+			status: res.status,
+			body: await res.text()
+		};
+	},
+	catch: (cause) => new SamvaCliError({ message: `Request to ${url} failed: ${String(cause)}` })
+});
+//#endregion
+//#region src/commands/email/doctor.ts
+/** Surface the real failure text so a failed check is actionable, not uniform. */
+const detailFromError = (error) => Predicate.isObject(error) && Predicate.hasProperty(error, "message") && typeof error["message"] === "string" ? error["message"] : "Read failed";
+const check$2 = (name, run) => run.pipe(Effect.match({
+	onFailure: (error) => ({
+		name,
+		status: "failed",
+		detail: detailFromError(error)
+	}),
+	onSuccess: (detail) => ({
+		name,
+		status: "passed",
+		detail
+	})
+}));
+const reachability = (apiUrl) => check$2("API reachability", getText(`${apiUrl.replace(/\/+$/, "")}/v1/health/ping`).pipe(Effect.flatMap((response) => response.ok ? Effect.succeed("Health endpoint responded") : Effect.fail(new SamvaCliError({ message: `Health endpoint returned ${response.status}` })))));
+const orgAccess = check$2("Organization permissions", getClientProvider.pipe(Effect.flatMap((client) => Organizations.get().pipe(client.provide, Effect.map((organization) => `${organization.name} (${organization.slug})`), Effect.mapError((error) => new SamvaCliError({ message: formatApiError("Organization read failed", error) }))))));
+const domains = check$2("Sending domains", getClientProvider.pipe(Effect.flatMap((client) => Email.listDomains({ limit: "1" }).pipe(client.provide, Effect.map((result) => {
+	const verified = result.items.filter((domain) => domain.status === "verified").length;
+	return `${result.pagination.total} configured; ${verified} verified on this page`;
+}), Effect.mapError((error) => new SamvaCliError({ message: formatApiError("Domain read failed", error) }))))));
+const senders = check$2("Senders", getClientProvider.pipe(Effect.flatMap((client) => Email.listSenders({ limit: "1" }).pipe(client.provide, Effect.map((result) => {
+	const verified = result.items.filter((sender) => sender.verificationStatus === "verified").length;
+	return `${result.pagination.total} configured; ${verified} verified on this page`;
+}), Effect.mapError((error) => new SamvaCliError({ message: formatApiError("Sender read failed", error) }))))));
+const domainVerificationReadback = getClientProvider.pipe(Effect.flatMap((client) => Email.listDomains({ limit: "1" }).pipe(client.provide, Effect.mapError((error) => new SamvaCliError({ message: formatApiError("Domain verification read failed", error) })), Effect.flatMap((result) => {
+	const domain = result.items[0];
+	if (!domain) return Effect.succeed({
+		name: "Domain verification readback",
+		status: "unavailable",
+		detail: "No sending domain configured"
+	});
+	return Email.getDomainStatus({ id: domain.id }).pipe(client.provide, Effect.map((status) => {
+		const verification = status.status.toLowerCase();
+		return {
+			name: "Domain verification readback",
+			status: verification === "verified" ? "passed" : verification === "failed" ? "failed" : "unavailable",
+			detail: `${status.domain}: ${status.status}`
+		};
+	}), Effect.mapError((error) => new SamvaCliError({ message: formatApiError("Domain verification read failed", error) })));
+}))), Effect.catch((error) => Effect.succeed({
+	name: "Domain verification readback",
+	status: "failed",
+	detail: detailFromError(error)
+})));
+const doctorCommand = Command.make("doctor", { json: jsonFlag }).pipe(Command.withDescription("Read local configuration and remote email state"), Command.withExamples([{ command: "samva email doctor --json" }]), Command.withHandler(({ json }) => Effect.gen(function* () {
+	const context = yield* resolveExecutionContext;
+	const authSource = context.apiKey ? "SAMVA_API_KEY" : context.credentials ? "stored OAuth credential" : "none";
+	const checks = yield* Effect.all([
+		reachability(context.apiUrl),
+		orgAccess,
+		domains,
+		senders,
+		domainVerificationReadback
+	]);
+	const ok = checks.every((result) => result.status !== "failed");
+	const payload = {
+		schemaVersion: 1,
+		mode: "read-only",
+		ok,
+		limitations: "Checks CLI/API visibility only. It does not send, mutate, replay fixtures, verify DNS, or verify provider readiness.",
+		resolved: {
+			profile: context.profile,
+			target: context.target,
+			apiUrl: context.apiUrl,
+			authSource,
+			organization: context.orgSlug ?? null
+		},
+		checks
+	};
+	if (!ok) yield* Effect.sync(() => void (process.exitCode = 1));
+	if (json) return yield* printJson(payload);
+	yield* printFields([
+		["Profile", payload.resolved.profile],
+		["Target", payload.resolved.target],
+		["API", payload.resolved.apiUrl],
+		["Auth source", payload.resolved.authSource],
+		["Organization", payload.resolved.organization]
+	]);
+	yield* Console.log("\nRead-only checks:");
+	for (const result of checks) {
+		const glyph = result.status === "passed" ? "✓" : result.status === "unavailable" ? "!" : "✗";
+		yield* Console.log(`${glyph} ${result.name}: ${result.detail}`);
+	}
+	yield* Console.log(`\n${payload.limitations}`);
+}).pipe(json ? Effect.provideService(References.MinimumLogLevel, "None") : identity)));
+//#endregion
+//#region src/commands/email/domains.ts
+const list$6 = Command.make("list", {
+	page: Flag.integer("page").pipe(Flag.withDescription("Page number"), Flag.optional),
+	limit: Flag.integer("limit").pipe(Flag.withDescription("Items per page"), Flag.optional),
+	all: Flag.boolean("all").pipe(Flag.withDescription("Traverse every page (requires --jsonl)"), Flag.withDefault(false)),
+	json: jsonFlag
+}).pipe(Command.withDescription("List email sending domains"), Command.withExamples([{ command: "samva email domains list" }, { command: "samva email domains list --json" }]), Command.withHandler(({ page, limit, all, json }) => Effect.gen(function* () {
+	if (all && !isJsonLinesRequested()) return yield* new CliUsageError({
+		code: "all_requires_jsonl",
+		message: "--all is an unbounded traversal and requires --jsonl."
+	});
+	const client = yield* getClientProvider;
+	const pageValue = Option.getOrUndefined(page);
+	const limitValue = Option.getOrUndefined(limit);
+	const query = {
+		page: pageValue?.toString(),
+		limit: limitValue?.toString()
+	};
+	if (all) {
+		let nextPage = pageValue ?? 1;
+		for (;;) {
+			const data = yield* Email.listDomains({
+				...query,
+				page: nextPage.toString()
+			}).pipe(client.provide, Effect.mapError((error) => new SamvaCliError({ message: formatApiError("Could not list domains", error) })));
+			for (const item of data.items) yield* printJsonLine(item);
+			if (nextPage >= data.pagination.totalPages || data.items.length === 0) return;
+			nextPage += 1;
+		}
+	}
+	const data = yield* Email.listDomains(query).pipe(client.provide, Effect.mapError((error) => new SamvaCliError({ message: formatApiError("Could not list domains", error) })));
+	if (isJsonLinesRequested()) {
+		for (const item of data.items) yield* printJsonLine(item);
+		return;
+	}
+	if (json) return yield* printJson(data.items);
+	if (data.items.length === 0) return yield* Console.log("No domains yet. Add one with `samva email domains add --domain example.com`.");
+	for (const domain of data.items) {
+		yield* printFields([
+			["Domain", domain.domain],
+			["Status", domain.status],
+			["ID", domain.id]
+		]);
+		yield* Console.log("");
+	}
+}).pipe(json ? Effect.provideService(References.MinimumLogLevel, "None") : identity)));
+const add$1 = Command.make("add", {
+	domain: Flag.string("domain").pipe(Flag.withDescription("Domain to add, e.g. example.com")),
+	dryRun: Flag.boolean("dry-run").pipe(Flag.withDescription("Print the planned change without calling the API"), Flag.withDefault(false)),
+	json: jsonFlag
+}).pipe(Command.withDescription("Add an email sending domain"), Command.withExamples([{
+	command: "samva email domains add --domain example.com --dry-run",
+	description: "Preview add"
+}, {
+	command: "samva email domains add --domain example.com",
+	description: "Apply domain add"
+}]), Command.withHandler(({ domain, dryRun, json }) => Effect.gen(function* () {
+	if (dryRun) {
+		if (json) return yield* printJson({
+			dryRun: true,
+			action: "email.domains.add",
+			domain
+		});
+		return yield* Console.log(`[dry-run] Would add domain "${domain}".`);
+	}
+	const client = yield* getClientProvider;
+	yield* Effect.matchEffect(Email.addDomain({ domain }).pipe(client.provide), {
+		onFailure: (error) => {
+			const conflict = getConflictError(error);
+			if (!conflict) return Effect.fail(new SamvaCliError({ message: formatApiError("Could not add domain", error) }));
+			const findExisting = Effect.gen(function* () {
+				if (typeof conflict.id === "string" && conflict.id.length > 0) {
+					const fetched = yield* Email.getDomainById({ id: conflict.id }).pipe(client.provide, Effect.catchTag("ResourceNotFoundError", () => Effect.void), Effect.mapError((lookupError) => new SamvaCliError({ message: formatApiError("Domain already exists but could not fetch it by id", lookupError) })));
+					if (fetched) return fetched;
+				}
+				let page = 1;
+				while (true) {
+					const listed = yield* Email.listDomains({
+						page: page.toString(),
+						limit: "100"
+					}).pipe(client.provide, Effect.mapError((listError) => new SamvaCliError({ message: formatApiError("Domain may already exist but could not verify idempotently", listError) })));
+					const existing = listed.items.find((item) => item.domain === domain);
+					if (existing) return existing;
+					const totalPages = Number(listed.pagination.totalPages);
+					if (!Number.isFinite(totalPages) || page >= totalPages) break;
+					page += 1;
+				}
+				return yield* new SamvaCliError({ message: formatApiError("Could not add domain", error) });
+			});
+			return Effect.gen(function* () {
+				const existing = yield* findExisting;
+				if (json) yield* printJson({
+					...existing,
+					idempotent: true
+				});
+				else yield* Effect.logWarning(`Domain "${existing.domain}" already exists (status: ${existing.status}).`);
+			});
+		},
+		onSuccess: (data) => Effect.gen(function* () {
+			if (json) return yield* printJson(data);
+			yield* Effect.logInfo(`Domain "${data.domain}" added (status: ${data.status}). Add these DNS records:\n`);
+			for (const record of data.dnsRecords) {
+				yield* printFields([
+					["Type", record.type],
+					["Name", record.name],
+					["Value", record.value],
+					["TTL", record.ttl],
+					["Priority", record.priority]
+				]);
+				yield* Console.log("");
+			}
+			yield* Effect.logInfo(`Then verify:  samva email domains check ${data.id}`);
+		})
+	});
+}).pipe(json ? Effect.provideService(References.MinimumLogLevel, "None") : identity)));
+const check$1 = Command.make("check", {
+	id: Argument.string("id").pipe(Argument.withDescription("Domain id to check")),
+	json: jsonFlag
+}).pipe(Command.withDescription("Check an email domain's verification status"), Command.withExamples([{
+	command: "samva email domains check dom_abc123",
+	description: "Poll domain verification"
+}]), Command.withHandler(({ id, json }) => Effect.gen(function* () {
+	const client = yield* getClientProvider;
+	const data = yield* Email.checkDomainVerification({ id }).pipe(client.provide, Effect.mapError((error) => new SamvaCliError({ message: formatApiError("Could not check domain", error) })));
+	if (json) return yield* printJson(data);
+	yield* printFields([
+		["Domain", data.domain],
+		["Verified", data.isVerified ? "yes" : "no"],
+		["Verification status", data.verificationStatus],
+		["Mail-from", data.mailFromStatus]
+	]);
+}).pipe(json ? Effect.provideService(References.MinimumLogLevel, "None") : identity)));
+const remove$3 = Command.make("remove", {
+	id: Argument.string("id").pipe(Argument.withDescription("Domain id to permanently remove")),
+	dryRun: Flag.boolean("dry-run").pipe(Flag.withDescription("Print the deletion plan without calling the API"), Flag.withDefault(false)),
+	yes: Flag.boolean("yes").pipe(Flag.withDescription("Confirm permanent deletion (required for non-interactive use)"), Flag.withDefault(false)),
+	json: jsonFlag
+}).pipe(Command.withDescription("Permanently remove an email sending domain"), Command.withExamples([{ command: "samva email domains remove dom_abc123 --dry-run" }, { command: "samva email domains remove dom_abc123 --yes" }]), Command.withHandler(({ id, dryRun, yes, json }) => Effect.gen(function* () {
+	if (dryRun) return yield* json ? printJson({
+		dryRun: true,
+		action: "email.domains.remove",
+		id
+	}) : Console.log(`[dry-run] Would permanently remove domain ${id}.`);
+	yield* confirmDestructive({
+		yes,
+		json,
+		message: `Permanently remove domain ${id}?`,
+		nonInteractiveMessage: "Permanent domain deletion requires --yes in non-interactive mode. Preview with --dry-run."
+	});
+	const client = yield* getClientProvider;
+	const data = yield* Email.removeDomain({ id }).pipe(client.provide, Effect.mapError((error) => new SamvaCliError({ message: formatApiError("Could not remove domain", error) })));
+	if (json) return yield* printJson(data);
+	yield* Console.log(`Removed domain ${id}.`);
+}).pipe(json ? Effect.provideService(References.MinimumLogLevel, "None") : identity)));
+const printBrandedTracking = (data) => Effect.gen(function* () {
+	if (!data.enabled || data.brandedTracking === null) return yield* Console.log("Branded tracking is not enabled for this domain.");
+	const branded = data.brandedTracking;
+	yield* printFields([
+		["Status", branded.status],
+		["Host", branded.hostname],
+		["Region", branded.region],
+		["Certificate", branded.sslStatus ?? "pending"],
+		["CAA blocked", branded.caaBlocked ? "yes" : "no"]
+	]);
+	yield* Console.log("\nCreate these DNS records:");
+	for (const record of [branded.dnsRecords.tracking, branded.dnsRecords.dcvDelegation]) {
+		if (record === null) continue;
+		yield* printFields([
+			["Type", record.type],
+			["Name", record.name],
+			["Value", record.value]
+		]);
+		yield* Console.log("");
+	}
+});
+const brandedEnable = Command.make("enable", {
+	id: Argument.string("id").pipe(Argument.withDescription("Domain id to enable branded tracking for")),
+	label: Flag.string("label").pipe(Flag.withDescription("First-level label under the domain (default: track)"), Flag.optional),
+	dryRun: Flag.boolean("dry-run").pipe(Flag.withDescription("Print the planned change without calling the API"), Flag.withDefault(false)),
+	json: jsonFlag
+}).pipe(Command.withDescription("Enable a branded tracking domain"), Command.withExamples([{ command: "samva email domains branded-tracking enable dom_abc123" }, { command: "samva email domains branded-tracking enable dom_abc123 --label links" }]), Command.withHandler(({ id, label, dryRun, json }) => Effect.gen(function* () {
+	const chosenLabel = Option.getOrUndefined(label);
+	if (dryRun) return yield* json ? printJson({
+		dryRun: true,
+		action: "email.domains.branded-tracking.enable",
+		id,
+		label: chosenLabel
+	}) : Console.log(`[dry-run] Would enable branded tracking for ${id}.`);
+	const client = yield* getClientProvider;
+	const data = yield* Email.enableBrandedTracking({
+		id,
+		...chosenLabel === void 0 ? {} : { label: chosenLabel }
+	}).pipe(client.provide, Effect.mapError((error) => new SamvaCliError({ message: formatApiError("Could not enable branded tracking", error) })));
+	if (json) return yield* printJson(data);
+	yield* printBrandedTracking(data);
+}).pipe(json ? Effect.provideService(References.MinimumLogLevel, "None") : identity)));
+const brandedStatus = Command.make("status", {
+	id: Argument.string("id").pipe(Argument.withDescription("Domain id to inspect")),
+	json: jsonFlag
+}).pipe(Command.withDescription("Show a domain's branded tracking status"), Command.withExamples([{ command: "samva email domains branded-tracking status dom_abc123" }]), Command.withHandler(({ id, json }) => Effect.gen(function* () {
+	const client = yield* getClientProvider;
+	const data = yield* Email.getBrandedTracking({ id }).pipe(client.provide, Effect.mapError((error) => new SamvaCliError({ message: formatApiError("Could not get branded tracking status", error) })));
+	if (json) return yield* printJson(data);
+	yield* printBrandedTracking(data);
+}).pipe(json ? Effect.provideService(References.MinimumLogLevel, "None") : identity)));
+const brandedDisable = Command.make("disable", {
+	id: Argument.string("id").pipe(Argument.withDescription("Domain id to disable branded tracking for")),
+	dryRun: Flag.boolean("dry-run").pipe(Flag.withDescription("Print the teardown plan without calling the API"), Flag.withDefault(false)),
+	yes: Flag.boolean("yes").pipe(Flag.withDescription("Confirm teardown (required for non-interactive use)"), Flag.withDefault(false)),
+	json: jsonFlag
+}).pipe(Command.withDescription("Disable and tear down a branded tracking domain"), Command.withExamples([{ command: "samva email domains branded-tracking disable dom_abc123 --dry-run" }, { command: "samva email domains branded-tracking disable dom_abc123 --yes" }]), Command.withHandler(({ id, dryRun, yes, json }) => Effect.gen(function* () {
+	if (dryRun) return yield* json ? printJson({
+		dryRun: true,
+		action: "email.domains.branded-tracking.disable",
+		id
+	}) : Console.log(`[dry-run] Would disable branded tracking for ${id}.`);
+	yield* confirmDestructive({
+		yes,
+		json,
+		message: `Disable branded tracking for ${id}? Existing branded links in delivered mail will break.`,
+		nonInteractiveMessage: "Branded tracking teardown requires --yes in non-interactive mode. Preview with --dry-run."
+	});
+	const client = yield* getClientProvider;
+	const data = yield* Email.disableBrandedTracking({ id }).pipe(client.provide, Effect.mapError((error) => new SamvaCliError({ message: formatApiError("Could not disable branded tracking", error) })));
+	if (json) return yield* printJson(data);
+	yield* Console.log(`Disabled branded tracking for ${id}.`);
+}).pipe(json ? Effect.provideService(References.MinimumLogLevel, "None") : identity)));
+const brandedTracking = Command.make("branded-tracking").pipe(Command.withDescription("Manage a domain's branded tracking (custom open/click subdomain)"), Command.withExamples([{ command: "samva email domains branded-tracking enable dom_abc123" }]), Command.withSubcommands([
+	brandedEnable,
+	brandedStatus,
+	brandedDisable
+]));
+const domainsCommand = Command.make("domains").pipe(Command.withDescription("Manage email sending domains"), Command.withExamples([{
+	command: "samva email domains list",
+	description: "List configured domains"
+}]), Command.withSubcommands([
+	list$6,
+	add$1,
+	check$1,
+	remove$3,
+	brandedTracking
+]));
+//#endregion
+//#region src/commands/email/receiving.ts
+const status = Command.make("status", {
+	domainId: Argument.string("domain-id").pipe(Argument.withDescription("Sending domain id")),
+	json: jsonFlag
+}).pipe(Command.withDescription("Get a domain's receiving prerequisite status"), Command.withExamples([{ command: "samva email receiving status dom_abc123 --json" }]), Command.withHandler(({ domainId, json }) => Effect.gen(function* () {
+	const client = yield* getClientProvider;
+	const data = yield* Email.getDomainStatus({ id: domainId }).pipe(client.provide, Effect.mapError((error) => new SamvaCliError({ message: formatApiError("Could not get receiving status", error) })));
+	if (json) return yield* printJson(data);
+	yield* printFields([["Domain", data.domain], ["Status", data.status]]);
+}).pipe(json ? Effect.provideService(References.MinimumLogLevel, "None") : identity)));
+const enable = Command.make("enable", {
+	domainId: Argument.string("domain-id").pipe(Argument.withDescription("Sending domain id")),
+	domain: Flag.string("domain").pipe(Flag.withDescription("Verified domain name")),
+	address: Flag.string("address").pipe(Flag.withDescription("Recipient address to receive (repeatable)"), Flag.atLeast(1)),
+	catchAll: Flag.boolean("catch-all").pipe(Flag.withDescription("Also receive unmatched addresses"), Flag.withDefault(false)),
+	dryRun: Flag.boolean("dry-run").pipe(Flag.withDescription("Print the provider setup request without calling the API"), Flag.withDefault(false)),
+	json: jsonFlag
+}).pipe(Command.withDescription("Enable inbound receiving for a verified domain"), Command.withExamples([{ command: "samva email receiving enable dom_abc123 --domain example.com --address replies@example.com --dry-run" }, { command: "samva email receiving enable dom_abc123 --domain example.com --address replies@example.com" }]), Command.withHandler(({ domainId, domain, address, catchAll, dryRun, json }) => Effect.gen(function* () {
+	const request = {
+		domain,
+		catchAll,
+		addresses: [...address]
+	};
+	if (dryRun) return yield* json ? printJson({
+		dryRun: true,
+		action: "email.receiving.enable",
+		domainId,
+		request
+	}) : Console.log(`[dry-run] Would enable receiving for ${domain} (${address.join(", ")}).`);
+	const client = yield* getClientProvider;
+	const data = yield* Email.enableReceiving({
+		id: domainId,
+		...request
+	}).pipe(client.provide, Effect.mapError((error) => new SamvaCliError({ message: formatApiError("Could not enable receiving", error) })));
+	if (json) return yield* printJson(data);
+	yield* printFields([["Rule", data.ruleName], ["Recipients", data.recipients.join(", ")]]);
+}).pipe(json ? Effect.provideService(References.MinimumLogLevel, "None") : identity)));
+const receivingCommand = Command.make("receiving").pipe(Command.withDescription("Configure inbound email receiving"), Command.withExamples([{ command: "samva email receiving status dom_abc123" }]), Command.withSubcommands([status, enable]));
+//#endregion
+//#region src/lib/stdin.ts
+/** Read piped stdin as UTF-8 (fd 0). Fails fast when stdin is a TTY (no pipe). */
+const readStdinUtf8 = Effect.gen(function* () {
+	if (isatty(0)) return yield* new SamvaCliError({ message: "Expected piped stdin for `-`; redirect input (e.g. `echo … | samva …`) or pass the body inline instead of `-`." });
+	return yield* Effect.tryPromise({
+		try: () => readFile(0, "utf8"),
+		catch: () => new SamvaCliError({ message: "Could not read stdin." })
+	});
+});
+//#endregion
+//#region src/commands/messages.ts
+/** The deliberately small Message shape shared by send, get, and wait. */
+const projectMessage = (message) => ({
+	id: message.id,
+	channel: message.channel,
+	status: message.status,
+	conversationId: message.conversationId,
+	createdAt: message.createdAt,
+	updatedAt: message.updatedAt,
+	deliveries: message.deliveries.map((delivery) => ({
+		status: delivery.status,
+		recipient: delivery.recipientId
+	}))
+});
+const printMessage = (message) => printFields([
+	["Message ID", message.id],
+	["Channel", message.channel],
+	["Status", message.status],
+	["Conversation", message.conversationId],
+	["Created", message.createdAt],
+	["Updated", message.updatedAt]
+]);
+const classifyMessageLifecycle = (message) => {
+	const failed = (status) => status === "failed" || status === "bounced" || status === "complained";
+	const succeeded = (status) => status === "delivered" || status === "read";
+	const messageStatus = message.status.toLowerCase();
+	const deliveryStatuses = message.deliveries.map((delivery) => delivery.status.toLowerCase());
+	if (failed(messageStatus) || deliveryStatuses.some(failed)) return "failure";
+	if (succeeded(messageStatus) || deliveryStatuses.length > 0 && deliveryStatuses.every(succeeded)) return "success";
+	return "pending";
+};
+var MessageStillPending = class extends Schema.TaggedErrorClass()("MessageStillPending", { message: Schema.String }) {};
+const messageLifecycleError = (code, message, partialMessage) => new CliMessageLifecycleError({
+	code,
+	message,
+	partialMessage,
+	next: `samva messages wait ${partialMessage.id}`,
+	human: [
+		`Message ID    ${partialMessage.id}`,
+		`Status        ${partialMessage.status}`,
+		`Next          samva messages wait ${partialMessage.id}`
+	].join("\n")
+});
+/**
+* `--timeout` is modelled as an optional flag rather than one with a baked-in
+* default so `Option.isSome` tells callers whether the user actually passed it.
+* The parser owns detection, so a flag *value* of `--timeout` (e.g.
+* `--subject "--timeout"`) and a trailing `--` no longer false-positive.
+*/
+const timeoutFlag = Flag.string("timeout").pipe(Flag.withDescription("Maximum wait duration (default: 2m; only used with --wait)"), Flag.optional);
+/** Duration.fromInput unit word for each `--timeout` compact-form suffix. */
+const DURATION_UNIT_WORD_BY_SUFFIX = {
+	ms: "millis",
+	s: "seconds",
+	m: "minutes"
+};
+const durationFromFlag = (raw) => {
+	const invalidTimeout = () => Effect.fail(new CliUsageError({
+		code: "invalid_timeout",
+		message: "--timeout must be a positive duration, for example `--timeout 2m` or `--timeout \"2 minutes\"`."
+	}));
+	const compact = /^(\d+(?:\.\d+)?)(ms|s|m|h)$/i.exec(raw);
+	const value = compact ? `${compact[1]} ${DURATION_UNIT_WORD_BY_SUFFIX[compact[2]?.toLowerCase() ?? ""] ?? "hours"}` : raw;
+	const isDurationInput = (input) => /^\d+(?:\.\d+)?\s+(?:nanos?|micros?|millis?|seconds?|minutes?|hours?)$/.test(input);
+	if (!isDurationInput(value)) return invalidTimeout();
+	return Option.match(Duration.fromInput(value), {
+		onNone: invalidTimeout,
+		onSome: (duration) => Duration.isFinite(duration) && Duration.toMillis(duration) > 0 ? Effect.succeed(duration) : invalidTimeout()
+	});
+};
+const getMessage = (id) => getClientProvider.pipe(Effect.flatMap((client) => Messages.get({ id }).pipe(client.provide, Effect.mapError((error) => new SamvaCliError({ message: formatApiError("Could not get message", error) })))));
+/** Poll with an owned Effect timeout; interruption cancels the active request/fiber. */
+const waitForMessage = (initial, timeout) => Effect.gen(function* () {
+	let latest = initial;
+	if (classifyMessageLifecycle(latest) !== "pending") return latest;
+	const result = yield* Effect.gen(function* () {
+		latest = yield* getMessage(initial.id);
+		if (classifyMessageLifecycle(latest) === "pending") return yield* new MessageStillPending({ message: `Message ${latest.id} is ${latest.status}.` });
+		return latest;
+	}).pipe(Effect.retry({
+		schedule: Schedule.spaced("1 second"),
+		while: (error) => error instanceof MessageStillPending
+	})).pipe(Effect.timeoutOption(timeout), Effect.catch((error) => messageLifecycleError("message_observation_failed", formatApiError(`Could not continue observing message ${latest.id}`, error), projectMessage(latest))));
+	return Option.getOrElse(result, () => latest);
+});
+const lifecycleResult = (message, timeout) => Effect.gen(function* () {
+	const result = yield* waitForMessage(message, timeout);
+	const resultTerminal = classifyMessageLifecycle(result);
+	return {
+		message: result,
+		resultTerminal,
+		timedOut: resultTerminal === "pending"
+	};
+});
+const pageFlag$1 = Flag.integer("page").pipe(Flag.withDescription("Page number (1-based)"), Flag.optional);
+const limitFlag$1 = Flag.integer("limit").pipe(Flag.withDescription("Maximum messages per page"), Flag.optional);
+const statusFlag$1 = Flag.string("status").pipe(Flag.withDescription("Filter by message status"), Flag.optional);
+const channelFlag = Flag.string("channel").pipe(Flag.withDescription("Filter by channel"), Flag.optional);
+const conversationIdFlag = Flag.string("conversation-id").pipe(Flag.withDescription("Filter by conversation id"), Flag.optional);
+const contactIdFlag = Flag.string("contact-id").pipe(Flag.withDescription("Filter by contact id"), Flag.optional);
+const startDateFlag = Flag.string("start-date").pipe(Flag.withDescription("Filter messages created on or after this ISO 8601 instant"), Flag.optional);
+const endDateFlag = Flag.string("end-date").pipe(Flag.withDescription("Filter messages created on or before this ISO 8601 instant"), Flag.optional);
+const allFlag$1 = Flag.boolean("all").pipe(Flag.withDescription("Traverse every page (requires --jsonl)"), Flag.withDefault(false));
+const list$5 = Command.make("list", {
+	page: pageFlag$1,
+	limit: limitFlag$1,
+	status: statusFlag$1,
+	channel: channelFlag,
+	conversationId: conversationIdFlag,
+	contactId: contactIdFlag,
+	startDate: startDateFlag,
+	endDate: endDateFlag,
+	all: allFlag$1,
+	json: jsonFlag
+}).pipe(Command.withDescription("List messages"), Command.withExamples([
+	{ command: "samva messages list --channel email --limit 25" },
+	{ command: "samva messages list --status failed --json" },
+	{
+		command: "samva messages list --all --jsonl",
+		description: "Stream every page as JSONL"
+	}
+]), Command.withHandler(({ page, limit, status, channel, conversationId, contactId, startDate, endDate, all, json }) => Effect.gen(function* () {
+	if (all && !isJsonLinesRequested()) return yield* new CliUsageError({
+		code: "all_requires_jsonl",
+		message: "--all is an unbounded traversal and requires --jsonl."
+	});
+	const client = yield* getClientProvider;
+	const pageValue = Option.getOrUndefined(page);
+	const limitValue = Option.getOrUndefined(limit);
+	const query = {
+		channel: Option.getOrUndefined(channel),
+		status: Option.getOrUndefined(status),
+		conversationId: Option.getOrUndefined(conversationId),
+		contactId: Option.getOrUndefined(contactId),
+		startDate: Option.getOrUndefined(startDate),
+		endDate: Option.getOrUndefined(endDate),
+		page: pageValue?.toString(),
+		limit: limitValue?.toString()
+	};
+	if (all) {
+		let nextPage = pageValue ?? 1;
+		for (;;) {
+			const data = yield* Messages.list({
+				...query,
+				page: nextPage.toString()
+			}).pipe(client.provide, Effect.mapError((error) => new SamvaCliError({ message: formatApiError("Could not list messages", error) })));
+			for (const item of data.items) yield* printJsonLine(projectMessage(item));
+			if (nextPage >= data.pagination.totalPages || data.items.length === 0) return;
+			nextPage += 1;
+		}
+	}
+	const data = yield* Messages.list(query).pipe(client.provide, Effect.mapError((error) => new SamvaCliError({ message: formatApiError("Could not list messages", error) })));
+	const payload = {
+		items: data.items.map(projectMessage),
+		pagination: data.pagination
+	};
+	if (isJsonLinesRequested()) {
+		for (const item of payload.items) yield* printJsonLine(item);
+		return;
+	}
+	if (json) return yield* printJson(payload);
+	if (payload.items.length === 0) return yield* Console.log("No messages found.");
+	for (const message of payload.items) {
+		yield* printMessage(message);
+		yield* Console.log("");
+	}
+	yield* printFields([["Page", payload.pagination.page], ["Total", payload.pagination.total]]);
+}).pipe(json ? Effect.provideService(References.MinimumLogLevel, "None") : identity)));
+const get$2 = Command.make("get", {
+	id: Argument.string("id"),
+	json: jsonFlag
+}).pipe(Command.withDescription("Get a message"), Command.withExamples([{ command: "samva messages get msg_abc123 --json" }]), Command.withHandler(({ id, json }) => getMessage(id).pipe(Effect.flatMap((message) => json ? printJson(projectMessage(message)) : printMessage(projectMessage(message))), (effect) => json ? effect.pipe(Effect.provideService(References.MinimumLogLevel, "None")) : effect)));
+const events = Command.make("events", {
+	id: Argument.string("id"),
+	json: jsonFlag
+}).pipe(Command.withDescription("List lifecycle events for a message"), Command.withExamples([{ command: "samva messages events msg_abc123 --json" }]), Command.withHandler(({ id, json }) => Effect.gen(function* () {
+	const client = yield* getClientProvider;
+	const data = yield* Messages.getEvents({ id }).pipe(client.provide, Effect.mapError((error) => new SamvaCliError({ message: formatApiError("Could not list message events", error) })));
+	if (json) return yield* printJson(data);
+	for (const event of data) yield* printFields([
+		["Event", event.eventType],
+		["Status", event.status],
+		["Time", event.timestamp]
+	]);
+}).pipe(json ? Effect.provideService(References.MinimumLogLevel, "None") : identity)));
+const wait = Command.make("wait", {
+	id: Argument.string("id"),
+	timeout: timeoutFlag,
+	json: jsonFlag
+}).pipe(Command.withDescription("Wait for a message to be delivered or read"), Command.withExamples([{ command: "samva messages wait msg_abc123" }, { command: "samva messages wait msg_abc123 --timeout 30s --json" }]), Command.withHandler(({ id, timeout, json }) => Effect.gen(function* () {
+	const duration = yield* durationFromFlag(Option.getOrElse(timeout, () => "2m"));
+	const initial = yield* getMessage(id);
+	const result = yield* lifecycleResult(initial, duration);
+	const projection = projectMessage(result.message);
+	if (result.timedOut) return yield* messageLifecycleError("message_wait_timeout", `Timed out waiting for message ${projection.id}; it remains ${projection.status}.`, projection);
+	if (result.resultTerminal === "failure") return yield* messageLifecycleError("message_terminal_failure", `Message ${projection.id} reached terminal status ${projection.status}.`, projection);
+	if (json) return yield* printJson(projection);
+	yield* printMessage(projection);
+}).pipe(json ? Effect.provideService(References.MinimumLogLevel, "None") : identity)));
+const messagesCommand = Command.make("messages").pipe(Command.withDescription("Inspect messages and their lifecycle"), Command.withExamples([{ command: "samva messages list --channel email --json" }]), Command.withSubcommands([
+	list$5,
+	get$2,
+	events,
+	wait
+]));
+//#endregion
+//#region src/commands/email/send.ts
+/** Human status line for a definite (non-`undefined`) lifecycle outcome. */
+const STATUS_LINE_BY_OUTCOME = {
+	success: "Email lifecycle completed.",
+	failure: "Email delivery failed."
+};
+const toFlag$1 = Flag.string("to").pipe(Flag.withDescription("Recipient email address (repeatable)"), Flag.atLeast(1));
+const ccFlag$1 = Flag.string("cc").pipe(Flag.withDescription("Cc recipient email address"), Flag.optional);
+const bccFlag$1 = Flag.string("bcc").pipe(Flag.withDescription("Bcc recipient email address"), Flag.optional);
+const subjectFlag$1 = Flag.string("subject").pipe(Flag.withDescription("Email subject line (required for inline content; omit for templates)"), Flag.optional);
+const htmlFlag$1 = Flag.string("html").pipe(Flag.withDescription("HTML body (use `-` to read from stdin)"), Flag.optional);
+const textFlag$1 = Flag.string("text").pipe(Flag.withDescription("Plain-text body (use `-` to read from stdin)"), Flag.optional);
+const templateIdFlag$1 = Flag.string("template-id").pipe(Flag.withDescription("Template id (uuid) to render instead of inline body"), Flag.optional);
+const templateSlugFlag$1 = Flag.string("template-slug").pipe(Flag.withDescription("Template handle to render instead of inline body, e.g. welcome-email"), Flag.optional);
+const templateDataFlag$1 = Flag.string("template-data").pipe(Flag.withDescription("JSON object of variables for the template"), Flag.optional);
+const replyToMessageFlag = Flag.string("reply-to-message-id").pipe(Flag.withDescription("Message id this email replies to (threads the conversation)"), Flag.optional);
+const replyToAddressFlag = Flag.string("reply-to").pipe(Flag.withDescription("Reply-To header email address"), Flag.optional);
+const idempotencyKeyFlag$1 = Flag.string("idempotency-key").pipe(Flag.withDescription("Key (1-255 characters) so identical retries return the original email"), Flag.optional);
+const trackOpensFlag$1 = Flag.choice("track-opens", ["on", "off"]).pipe(Flag.withDescription("Override open tracking for this send; recipient opt-out still wins"), Flag.optional);
+const trackClicksFlag$1 = Flag.choice("track-clicks", ["on", "off"]).pipe(Flag.withDescription("Override click tracking for this send; recipient opt-out still wins"), Flag.optional);
+const dryRunFlag$2 = Flag.boolean("dry-run").pipe(Flag.withDescription("Validate inputs and print the request payload without calling the API"), Flag.withDefault(false));
+const bodySourceName = (input) => {
+	if (input.templateRefValue) return "template";
+	if (input.stdin) return "stdin";
+	if (input.resolvedHtml) return "html";
+	return "text";
+};
+const parseTemplateData$1 = (raw) => Option.match(raw, {
+	onNone: () => Effect.succeed(void 0),
+	onSome: (value) => Effect.try({
+		try: () => JSON.parse(value),
+		catch: () => new SamvaCliError({ message: "--template-data must be a JSON object." })
+	}).pipe(Effect.flatMap((parsed) => Predicate.isObject(parsed) ? Effect.succeed(parsed) : Effect.fail(new SamvaCliError({ message: "--template-data must be a JSON object." }))))
+});
+const send = Command.make("send", {
+	to: toFlag$1,
+	cc: ccFlag$1,
+	bcc: bccFlag$1,
+	subject: subjectFlag$1,
+	html: htmlFlag$1,
+	text: textFlag$1,
+	templateId: templateIdFlag$1,
+	templateSlug: templateSlugFlag$1,
+	templateData: templateDataFlag$1,
+	replyTo: replyToMessageFlag,
+	replyToAddress: replyToAddressFlag,
+	idempotencyKey: idempotencyKeyFlag$1,
+	trackOpens: trackOpensFlag$1,
+	trackClicks: trackClicksFlag$1,
+	dryRun: dryRunFlag$2,
+	wait: Flag.boolean("wait").pipe(Flag.withDescription("Wait for delivered/read or a terminal delivery failure"), Flag.withDefault(false)),
+	timeout: timeoutFlag,
+	json: jsonFlag
+}).pipe(Command.withDescription("Send an email"), Command.withExamples([
+	{
+		command: "samva email send --to you@example.com --subject Hi --text Hello",
+		description: "Plain-text body (SAMVA_API_KEY)"
+	},
+	{
+		command: "samva email send --to you@example.com --template-slug welcome-email --template-data '{\"name\":\"Ada\"}'",
+		description: "Render a template by handle"
+	},
+	{
+		command: "echo \"Hello\" | samva email send --to you@example.com --subject Hi --text -",
+		description: "Pipe plain-text body from stdin"
+	},
+	{
+		command: "samva email send --to you@example.com --subject Hi --text Hello --dry-run",
+		description: "Validate and print the request payload without sending"
+	},
+	{
+		command: "samva email send --to you@example.com --subject Hi --text Hello --idempotency-key welcome-email-ada",
+		description: "Retry a send safely with an idempotency key"
+	}
+]), Command.withHandler(({ to, cc, bcc, subject, html, text, templateId, templateSlug, templateData, replyTo, replyToAddress, idempotencyKey, trackOpens, trackClicks, dryRun, wait, timeout, json }) => Effect.gen(function* () {
+	const subjectValue = Option.getOrUndefined(subject);
+	const htmlValue = Option.getOrUndefined(html);
+	const textValue = Option.getOrUndefined(text);
+	const templateIdValue = Option.getOrUndefined(templateId);
+	const templateSlugValue = Option.getOrUndefined(templateSlug);
+	const replyToValue = Option.getOrUndefined(replyTo);
+	const replyToAddressValue = Option.getOrUndefined(replyToAddress);
+	const idempotencyKeyValue = Option.getOrUndefined(idempotencyKey);
+	const trackOpensValue = Option.getOrUndefined(trackOpens);
+	const trackClicksValue = Option.getOrUndefined(trackClicks);
+	const ccValue = Option.getOrUndefined(cc);
+	const bccValue = Option.getOrUndefined(bcc);
+	const templateDataValue = yield* parseTemplateData$1(templateData);
+	if (idempotencyKeyValue !== void 0 && (idempotencyKeyValue.length < 1 || idempotencyKeyValue.length > 255)) return yield* new SamvaCliError({ message: "--idempotency-key must contain between 1 and 255 characters." });
+	if (templateIdValue && templateSlugValue) return yield* new SamvaCliError({ message: "Use either --template-id or --template-slug, not both." });
+	const templateRefValue = templateSlugValue ?? templateIdValue;
+	if (templateRefValue && subjectValue) return yield* new SamvaCliError({ message: "Template sends derive their subject from the template. Omit --subject." });
+	if (!templateRefValue && !subjectValue) return yield* new CliUsageError({
+		code: "missing_subject",
+		message: "Inline email content requires --subject. Run `samva email send --help` for examples."
+	});
+	if (textValue === "-" && htmlValue === "-") return yield* new CliUsageError({
+		code: "multiple_stdin_bodies",
+		message: "Only one body can be read from stdin: use --text - or --html -, not both."
+	});
+	const resolvedText = textValue === "-" ? yield* readStdinUtf8 : textValue;
+	const resolvedHtml = htmlValue === "-" ? yield* readStdinUtf8 : htmlValue;
+	if (!resolvedHtml && !resolvedText && !templateRefValue) return yield* new SamvaCliError({ message: "Provide a body: one of --html, --text (or --text - for stdin), --template-id, or --template-slug." });
+	if ([
+		resolvedHtml,
+		resolvedText,
+		templateRefValue
+	].filter(Boolean).length > 1) return yield* new SamvaCliError({ message: "Choose exactly one body source: --html, --text, or a template (--template-id/--template-slug)." });
+	const request = {
+		to: [...to],
+		...ccValue ? { cc: [{ email: ccValue }] } : {},
+		...bccValue ? { bcc: [{ email: bccValue }] } : {},
+		...subjectValue === void 0 ? {} : { subject: subjectValue },
+		...resolvedHtml === void 0 ? {} : { html: resolvedHtml },
+		...resolvedText === void 0 ? {} : { text: resolvedText },
+		...templateIdValue === void 0 ? {} : { templateId: templateIdValue },
+		...templateSlugValue === void 0 ? {} : { templateSlug: templateSlugValue },
+		...templateDataValue === void 0 ? {} : { templateData: templateDataValue },
+		...replyToValue === void 0 ? {} : { inReplyToMessageId: replyToValue },
+		...replyToAddressValue === void 0 ? {} : { replyTo: replyToAddressValue },
+		...trackOpensValue !== void 0 || trackClicksValue !== void 0 ? { tracking: {
+			...trackOpensValue !== void 0 ? { opens: trackOpensValue === "on" } : {},
+			...trackClicksValue !== void 0 ? { clicks: trackClicksValue === "on" } : {}
+		} } : {}
+	};
+	const sendOptions = idempotencyKeyValue !== void 0 ? { idempotencyKey: idempotencyKeyValue } : {};
+	const source = bodySourceName({
+		templateRefValue,
+		resolvedHtml,
+		stdin: textValue === "-" || htmlValue === "-"
+	});
+	if (dryRun && wait) return yield* new CliUsageError({
+		code: "dry_run_wait_conflict",
+		message: "--wait cannot be combined with --dry-run; a dry run sends nothing to wait on."
+	});
+	if (!wait && Option.isSome(timeout)) return yield* new CliUsageError({
+		code: "timeout_requires_wait",
+		message: "--timeout is meaningful only with --wait."
+	});
+	const waitDuration = wait ? yield* durationFromFlag(Option.getOrElse(timeout, () => "2m")) : void 0;
+	if (dryRun) {
+		if (json) return yield* printJson({
+			dryRun: true,
+			bodySource: source,
+			request,
+			idempotencyKey: idempotencyKeyValue
+		});
+		yield* Effect.logInfo("Dry run — no credentials, configuration, DNS, or API request used.");
+		yield* printFields([["Body source", source]]);
+		yield* Console.log("");
+		yield* printFields([
+			["To", request.to.join(", ")],
+			...ccValue ? [["Cc", ccValue]] : [],
+			...bccValue ? [["Bcc", bccValue]] : [],
+			["Subject", request.subject],
+			...request.templateSlug ? [["Template", `${request.templateSlug} (handle)`]] : request.templateId ? [["Template", request.templateId]] : [],
+			...request.inReplyToMessageId ? [["Reply to", request.inReplyToMessageId]] : [],
+			...request.replyTo ? [["Reply-To", request.replyTo]] : [],
+			...idempotencyKeyValue ? [["Idempotency key", idempotencyKeyValue]] : [],
+			...request.tracking ? [["Track opens", request.tracking.opens], ["Track clicks", request.tracking.clicks]] : []
+		]);
+		if (request.text) yield* Console.log(`\nText body (${request.text.length} chars):\n${truncateForDisplay(request.text)}`);
+		if (request.html) yield* Console.log(`\nHTML body (${request.html.length} chars):\n${truncateForDisplay(request.html)}`);
+		if (request.templateData) yield* Console.log(`\nTemplate data:\n${truncateForDisplay(JSON.stringify(request.templateData, null, 2))}`);
+		return;
+	}
+	const client = yield* getClientProvider;
+	const data = yield* Email.send(request, sendOptions).pipe(client.provide, Effect.mapError((error) => new SamvaCliError({ message: formatApiError("Failed to send email", error) })));
+	const finalMessage = waitDuration === void 0 ? data : yield* waitForMessage(data, waitDuration);
+	const projection = projectMessage(finalMessage);
+	const outcome = wait ? classifyMessageLifecycle(finalMessage) : void 0;
+	if (outcome === "pending") return yield* messageLifecycleError("message_wait_timeout", `Timed out waiting for message ${projection.id}; it remains ${projection.status}.`, projection);
+	if (outcome === "failure") return yield* messageLifecycleError("message_terminal_failure", `Message ${projection.id} reached terminal status ${projection.status}.`, projection);
+	if (json) yield* printJson(projection);
+	else {
+		const statusLine = outcome === void 0 ? "Email queued." : STATUS_LINE_BY_OUTCOME[outcome] ?? "Email delivery timed out.";
+		yield* Effect.logInfo(`${statusLine}\n`);
+		yield* printFields([
+			["Message ID", projection.id],
+			["Status", projection.status],
+			["Conversation", projection.conversationId]
+		]);
+	}
+}).pipe(json ? Effect.provideService(References.MinimumLogLevel, "None") : identity)));
+//#endregion
+//#region src/commands/email/senders.ts
+const list$4 = Command.make("list", {
+	page: Flag.integer("page").pipe(Flag.withDescription("Page number"), Flag.optional),
+	limit: Flag.integer("limit").pipe(Flag.withDescription("Items per page"), Flag.optional),
+	all: Flag.boolean("all").pipe(Flag.withDescription("Traverse every page (requires --jsonl)"), Flag.withDefault(false)),
+	json: jsonFlag
+}).pipe(Command.withDescription("List verified sender addresses"), Command.withExamples([{ command: "samva email senders list" }, { command: "samva email senders list --json" }]), Command.withHandler(({ page, limit, all, json }) => Effect.gen(function* () {
+	if (all && !isJsonLinesRequested()) return yield* new CliUsageError({
+		code: "all_requires_jsonl",
+		message: "--all is an unbounded traversal and requires --jsonl."
+	});
+	const client = yield* getClientProvider;
+	const pageValue = Option.getOrUndefined(page);
+	const limitValue = Option.getOrUndefined(limit);
+	const query = {
+		page: pageValue?.toString(),
+		limit: limitValue?.toString()
+	};
+	if (all) {
+		let nextPage = pageValue ?? 1;
+		for (;;) {
+			const data = yield* Email.listSenders({
+				...query,
+				page: nextPage.toString()
+			}).pipe(client.provide, Effect.mapError((error) => new SamvaCliError({ message: formatApiError("Could not list senders", error) })));
+			for (const item of data.items) yield* printJsonLine(item);
+			if (nextPage >= data.pagination.totalPages || data.items.length === 0) return;
+			nextPage += 1;
+		}
+	}
+	const data = yield* Email.listSenders(query).pipe(client.provide, Effect.mapError((error) => new SamvaCliError({ message: formatApiError("Could not list senders", error) })));
+	if (isJsonLinesRequested()) {
+		for (const item of data.items) yield* printJsonLine(item);
+		return;
+	}
+	if (json) return yield* printJson(data.items);
+	if (data.items.length === 0) return yield* Console.log("No senders yet. Add one with `samva email senders add --email you@example.com`.");
+	for (const sender of data.items) {
+		yield* printFields([
+			["Email", sender.email],
+			["Name", sender.name],
+			["Status", sender.verificationStatus],
+			["Default", sender.isDefault ? "yes" : "no"],
+			["ID", sender.id]
+		]);
+		yield* Console.log("");
+	}
+}).pipe(json ? Effect.provideService(References.MinimumLogLevel, "None") : identity)));
+const add = Command.make("add", {
+	email: Flag.string("email").pipe(Flag.withDescription("Sender email address")),
+	name: Flag.string("name").pipe(Flag.withDescription("Display name for the sender"), Flag.optional),
+	dryRun: Flag.boolean("dry-run").pipe(Flag.withDescription("Print the planned change without calling the API"), Flag.withDefault(false)),
+	json: jsonFlag
+}).pipe(Command.withDescription("Add a sender address"), Command.withExamples([{
+	command: "samva email senders add --email hello@example.com --dry-run",
+	description: "Preview add"
+}, {
+	command: "samva email senders add --email hello@example.com",
+	description: "Apply sender add"
+}]), Command.withHandler(({ email, name, dryRun, json }) => Effect.gen(function* () {
+	const nameValue = Option.getOrUndefined(name);
+	if (dryRun) {
+		if (json) return yield* printJson({
+			dryRun: true,
+			action: "email.senders.add",
+			email,
+			name: nameValue
+		});
+		return yield* Console.log(`[dry-run] Would add sender "${email}".`);
+	}
+	const client = yield* getClientProvider;
+	yield* Effect.matchEffect(Email.addSender({
+		email,
+		...nameValue === void 0 ? {} : { name: nameValue }
+	}).pipe(client.provide), {
+		onFailure: (error) => {
+			const conflict = getConflictError(error);
+			if (!conflict) return Effect.fail(new SamvaCliError({ message: formatApiError("Could not add sender", error) }));
+			return Effect.gen(function* () {
+				let page = 1;
+				while (true) {
+					const listed = yield* Email.listSenders({
+						page: page.toString(),
+						limit: "100"
+					}).pipe(client.provide, Effect.mapError((listError) => new SamvaCliError({ message: formatApiError("Sender may already exist but could not verify idempotently", listError) })));
+					const existing = (conflict.id ? listed.items.find((item) => item.id === conflict.id) : void 0) ?? listed.items.find((item) => item.email === email);
+					if (existing) {
+						if (json) yield* printJson({
+							...existing,
+							idempotent: true
+						});
+						else {
+							yield* printFields([
+								["Email", existing.email],
+								["Status", existing.verificationStatus],
+								["ID", existing.id]
+							]);
+							yield* Effect.logWarning("\nSender already exists.");
+						}
+						return;
+					}
+					const totalPages = Number(listed.pagination.totalPages);
+					if (!Number.isFinite(totalPages) || page >= totalPages) break;
+					page += 1;
+				}
+				return yield* new SamvaCliError({ message: formatApiError("Could not add sender", error) });
+			});
+		},
+		onSuccess: (data) => Effect.gen(function* () {
+			if (json) return yield* printJson(data);
+			yield* printFields([
+				["Email", data.email],
+				["Status", data.status],
+				["ID", data.id]
+			]);
+			yield* Effect.logInfo(`\nVerify:  samva email senders check ${data.id}`);
+		})
+	});
+}).pipe(json ? Effect.provideService(References.MinimumLogLevel, "None") : identity)));
+const check = Command.make("check", {
+	id: Argument.string("id").pipe(Argument.withDescription("Sender id to check")),
+	json: jsonFlag
+}).pipe(Command.withDescription("Check a sender's verification status"), Command.withExamples([{
+	command: "samva email senders check snd_abc123",
+	description: "Poll sender verification"
+}]), Command.withHandler(({ id, json }) => Effect.gen(function* () {
+	const client = yield* getClientProvider;
+	const data = yield* Email.checkSenderVerification({ id }).pipe(client.provide, Effect.mapError((error) => new SamvaCliError({ message: formatApiError("Could not check sender", error) })));
+	if (json) return yield* printJson(data);
+	yield* printFields([
+		["Email", data.email],
+		["Status", data.status],
+		["Verified at", data.verifiedAt ?? null]
+	]);
+}).pipe(json ? Effect.provideService(References.MinimumLogLevel, "None") : identity)));
+const remove$2 = Command.make("remove", {
+	id: Argument.string("id").pipe(Argument.withDescription("Sender id to permanently remove")),
+	dryRun: Flag.boolean("dry-run").pipe(Flag.withDescription("Print the deletion plan without calling the API"), Flag.withDefault(false)),
+	yes: Flag.boolean("yes").pipe(Flag.withDescription("Confirm permanent deletion (required for non-interactive use)"), Flag.withDefault(false)),
+	json: jsonFlag
+}).pipe(Command.withDescription("Permanently remove a sender identity"), Command.withExamples([{ command: "samva email senders remove snd_abc123 --dry-run" }, { command: "samva email senders remove snd_abc123 --yes" }]), Command.withHandler(({ id, dryRun, yes, json }) => Effect.gen(function* () {
+	if (dryRun) return yield* json ? printJson({
+		dryRun: true,
+		action: "email.senders.remove",
+		id
+	}) : Console.log(`[dry-run] Would permanently remove sender ${id}.`);
+	yield* confirmDestructive({
+		yes,
+		json,
+		message: `Permanently remove sender ${id}?`,
+		nonInteractiveMessage: "Permanent sender deletion requires --yes in non-interactive mode. Preview with --dry-run."
+	});
+	const client = yield* getClientProvider;
+	const data = yield* Email.removeSender({ id }).pipe(client.provide, Effect.mapError((error) => new SamvaCliError({ message: formatApiError("Could not remove sender", error) })));
+	if (json) return yield* printJson(data);
+	yield* Console.log(`Removed sender ${id}.`);
+}).pipe(json ? Effect.provideService(References.MinimumLogLevel, "None") : identity)));
+const sendersCommand = Command.make("senders").pipe(Command.withDescription("Manage sender addresses"), Command.withExamples([{
+	command: "samva email senders list",
+	description: "List sender addresses"
+}]), Command.withSubcommands([
+	list$4,
+	add,
+	check,
+	remove$2
+]));
+//#endregion
+//#region src/commands/email/tracking.ts
+const toggle = (name, description) => Flag.choice(name, ["on", "off"]).pipe(Flag.withDescription(description), Flag.optional);
+const validateRecipientEmail = (email) => Schema.decodeUnknownEffect(Email.TrackingRecipientEmail)(email).pipe(Effect.mapError(() => new CliUsageError({
+	code: "invalid_recipient_email",
+	message: "Recipient must be a valid email address."
+})));
+const defaultsGet = Command.make("get", { json: jsonFlag }).pipe(Command.withDescription("Get organization email tracking defaults"), Command.withExamples([{ command: "samva email tracking defaults get --json" }]), Command.withHandler(({ json }) => Effect.gen(function* () {
+	const client = yield* getClientProvider;
+	const data = yield* Email.getTrackingDefaults().pipe(client.provide, Effect.mapError((error) => new SamvaCliError({ message: formatApiError("Could not get email tracking defaults", error) })));
+	if (json) return yield* printJson(data);
+	yield* printFields([["Track opens", data.opens ? "on" : "off"], ["Track clicks", data.clicks ? "on" : "off"]]);
+}).pipe(json ? Effect.provideService(References.MinimumLogLevel, "None") : identity)));
+const defaultsSet = Command.make("set", {
+	opens: toggle("opens", "Set the organization open-tracking default (on or off)"),
+	clicks: toggle("clicks", "Set the organization click-tracking default (on or off)"),
+	dryRun: Flag.boolean("dry-run").pipe(Flag.withDescription("Print the planned change without calling the API"), Flag.withDefault(false)),
+	json: jsonFlag
+}).pipe(Command.withDescription("Update one or both organization email tracking defaults"), Command.withExamples([{ command: "samva email tracking defaults set --opens off --dry-run" }, { command: "samva email tracking defaults set --opens on --clicks off" }]), Command.withHandler(({ opens, clicks, dryRun, json }) => Effect.gen(function* () {
+	const opensValue = Option.getOrUndefined(opens);
+	const clicksValue = Option.getOrUndefined(clicks);
+	if (opensValue === void 0 && clicksValue === void 0) return yield* new CliUsageError({
+		code: "missing_tracking_default",
+		message: "Provide --opens, --clicks, or both."
+	});
+	const request = {
+		...opensValue === void 0 ? {} : { opens: opensValue === "on" },
+		...clicksValue === void 0 ? {} : { clicks: clicksValue === "on" }
+	};
+	if (dryRun) {
+		if (json) return yield* printJson({
+			dryRun: true,
+			action: "email.tracking.defaults.set",
+			request
+		});
+		return yield* Console.log(`[dry-run] Would update email tracking defaults: ${JSON.stringify(request)}.`);
+	}
+	const client = yield* getClientProvider;
+	const data = yield* Email.updateTrackingDefaults(request).pipe(client.provide, Effect.mapError((error) => new SamvaCliError({ message: formatApiError("Could not update email tracking defaults", error) })));
+	if (json) return yield* printJson(data);
+	yield* printFields([["Track opens", data.opens ? "on" : "off"], ["Track clicks", data.clicks ? "on" : "off"]]);
+}).pipe(json ? Effect.provideService(References.MinimumLogLevel, "None") : identity)));
+const recipientGet = Command.make("get", {
+	email: Argument.string("email").pipe(Argument.withDescription("Recipient email address")),
+	json: jsonFlag
+}).pipe(Command.withDescription("Get a recipient's email tracking preference"), Command.withExamples([{ command: "samva email tracking recipient get person@example.com --json" }]), Command.withHandler(({ email, json }) => Effect.gen(function* () {
+	const validatedEmail = yield* validateRecipientEmail(email);
+	const client = yield* getClientProvider;
+	const data = yield* Email.getRecipientTrackingPreference({ email: validatedEmail }).pipe(client.provide, Effect.mapError((error) => new SamvaCliError({ message: formatApiError("Could not get recipient tracking preference", error) })));
+	if (json) return yield* printJson(data);
+	yield* printFields([
+		["Email", data.email],
+		["Tracking", data.optedOut ? "opted out" : "opted in"],
+		["Opted out at", data.trackingOptedOutAt ?? null],
+		["Updated at", data.updatedAt ?? null]
+	]);
+}).pipe(json ? Effect.provideService(References.MinimumLogLevel, "None") : identity)));
+const recipientSet = Command.make("set", {
+	email: Argument.string("email").pipe(Argument.withDescription("Recipient email address")),
+	state: Flag.choice("state", ["opted-in", "opted-out"]).pipe(Flag.withDescription("Set the recipient tracking state (opted-in or opted-out)")),
+	dryRun: Flag.boolean("dry-run").pipe(Flag.withDescription("Print the planned change without calling the API"), Flag.withDefault(false)),
+	json: jsonFlag
+}).pipe(Command.withDescription("Opt a recipient in or out of email engagement tracking"), Command.withExamples([{ command: "samva email tracking recipient set person@example.com --state opted-out --dry-run" }, { command: "samva email tracking recipient set person@example.com --state opted-in" }]), Command.withHandler(({ email, state, dryRun, json }) => Effect.gen(function* () {
+	const request = {
+		email: yield* validateRecipientEmail(email),
+		optedOut: state === "opted-out"
+	};
+	if (dryRun) {
+		if (json) return yield* printJson({
+			dryRun: true,
+			action: "email.tracking.recipient.set",
+			request
+		});
+		return yield* Console.log(`[dry-run] Would set ${email} to ${state} for email engagement tracking.`);
+	}
+	const client = yield* getClientProvider;
+	const data = yield* Email.updateRecipientTrackingPreference(request).pipe(client.provide, Effect.mapError((error) => new SamvaCliError({ message: formatApiError("Could not update recipient tracking preference", error) })));
+	if (json) return yield* printJson(data);
+	yield* printFields([
+		["Email", data.email],
+		["Tracking", data.optedOut ? "opted out" : "opted in"],
+		["Opted out at", data.trackingOptedOutAt ?? null],
+		["Updated at", data.updatedAt ?? null]
+	]);
+}).pipe(json ? Effect.provideService(References.MinimumLogLevel, "None") : identity)));
+const defaults = Command.make("defaults").pipe(Command.withDescription("Read or update organization tracking defaults"), Command.withSubcommands([defaultsGet, defaultsSet]));
+const recipient = Command.make("recipient").pipe(Command.withDescription("Read or update a recipient tracking preference"), Command.withSubcommands([recipientGet, recipientSet]));
+const trackingCommand = Command.make("tracking").pipe(Command.withDescription("Configure email engagement tracking"), Command.withExamples([{ command: "samva email tracking defaults get" }]), Command.withSubcommands([defaults, recipient]));
+//#endregion
+//#region src/commands/email.ts
+const emailCommand = Command.make("email").pipe(Command.withDescription("Send, inspect, and configure email"), Command.withExamples([{
+	command: "samva email send --to you@example.com --subject Hi --text Hello",
+	description: "Send a plain-text email"
+}, {
+	command: "samva email doctor",
+	description: "Inspect read-only email readiness"
+}]), Command.withSubcommands([
+	send,
+	doctorCommand,
+	receivingCommand,
+	domainsCommand,
+	sendersCommand,
+	trackingCommand,
+	designCommand
+]));
+//#endregion
+//#region src/lib/examples.ts
+/** Shown in help descriptions for automation-oriented commands. */
+const AGENT_AUTH_HINT = "For CI and agents, set SAMVA_API_KEY instead of samva login.";
+//#endregion
+//#region src/lib/oauth.ts
+/**
+* OAuth device-authorization flow for `samva login`. These call Better Auth's
+* device endpoints under `/v1/auth/*` directly (not the product SDK) — the same
+* documented exception as `lib/http` for auth/ingress/health endpoints.
+*/
+/** First-party public client id; allow-listed by the AS `validateClient`. */
+const SAMVA_CLI_CLIENT_ID = "samva-cli";
+const DEVICE_SCOPE = "openid profile email";
+const parseJson = (body, context) => Effect.try({
+	try: () => JSON.parse(body),
+	catch: () => new SamvaCliError({ message: `Unexpected response from ${context}.` })
+});
+/** RFC 8628 §3.1 — request a device code + user code. */
+const requestDeviceCode = (apiUrl) => Effect.gen(function* () {
+	const res = yield* postJson(`${apiUrl}/v1/auth/device/code`, {
+		client_id: SAMVA_CLI_CLIENT_ID,
+		scope: DEVICE_SCOPE
+	});
+	if (!res.ok) return yield* new SamvaCliError({ message: `Could not start login (device/code returned ${res.status}). ${res.body}` });
+	return yield* parseJson(res.body, "device/code");
+});
+/**
+* Internal retry signal for the RFC 8628 poll loop: the grant is not yet
+* decided (`authorization_pending` / `slow_down`). Never escapes
+* `pollForToken` — the retry schedule always recurs on it and only the
+* `expires_in` deadline ends the loop.
+*/
+var DeviceAuthorizationPending = class extends Schema.TaggedErrorClass()("DeviceAuthorizationPending", {}) {};
+/**
+* RFC 8628 §3.4 — poll the token endpoint until the user approves, denies, or
+* the code expires. Honors `authorization_pending` / `slow_down` backoff.
+*
+* Clock/Schedule-driven: waits come from a retry schedule whose delay reads a
+* `Ref` holding the current interval (§3.5 `slow_down` grows it by 5s), and
+* the `expires_in` deadline is an `Effect.timeoutOrElse` — all TestClock-
+* advanceable.
+*/
+const pollForToken = (apiUrl, deviceCode, intervalSeconds, expiresInSeconds) => Effect.gen(function* () {
+	const initialInterval = Duration.seconds(Math.max(intervalSeconds, 1));
+	const interval = yield* Ref.make(initialInterval);
+	const pollOnce = Effect.gen(function* () {
+		const res = yield* postJson(`${apiUrl}/v1/auth/device/token`, {
+			grant_type: "urn:ietf:params:oauth:grant-type:device_code",
+			device_code: deviceCode,
+			client_id: SAMVA_CLI_CLIENT_ID
+		});
+		if (res.ok) return yield* parseJson(res.body, "device/token");
+		const { error, error_description } = yield* parseJson(res.body, "device/token");
+		if (error === "authorization_pending") return yield* new DeviceAuthorizationPending();
+		if (error === "slow_down") {
+			yield* Ref.update(interval, Duration.sum(Duration.seconds(5)));
+			return yield* new DeviceAuthorizationPending();
+		}
+		if (error === "access_denied") return yield* new CliAuthError({
+			code: "authorization_denied",
+			message: "Login was denied in the browser."
+		});
+		if (error === "expired_token") return yield* new CliTimeoutError({
+			code: "login_timeout",
+			message: "The login request expired before approval. Run `samva login` again."
+		});
+		return yield* new SamvaCliError({ message: `Login failed: ${error_description ?? error ?? res.body}` });
+	});
+	const pendingRetry = Schedule.forever.pipe(Schedule.setInputType(), Schedule.while(({ input }) => input instanceof DeviceAuthorizationPending), Schedule.modifyDelay(() => Ref.get(interval)));
+	return yield* Effect.gen(function* () {
+		yield* Effect.sleep(initialInterval);
+		return yield* pollOnce.pipe(Effect.retry(pendingRetry));
+	}).pipe(Effect.timeoutOrElse({
+		duration: Duration.seconds(expiresInSeconds),
+		orElse: () => Effect.fail(new CliTimeoutError({
+			code: "login_timeout",
+			message: "Login timed out. Run `samva login` again."
+		}))
+	}), Effect.catchTag("DeviceAuthorizationPending", () => Effect.fail(new CliTimeoutError({
+		code: "login_timeout",
+		message: "Login timed out. Run `samva login` again."
+	}))));
+});
+/** Open a URL in the system browser. Best-effort — never fails the flow. */
+const openBrowser = (url) => {
+	const platform = process.platform;
+	const [command, args] = platform === "darwin" ? ["open", [url]] : platform === "win32" ? ["cmd", [
+		"/c",
+		"start",
+		"",
+		url
+	]] : ["xdg-open", [url]];
+	return Effect.tryPromise(async () => {
+		const { spawn } = await import("node:child_process");
+		const child = spawn(command, [...args], {
+			stdio: "ignore",
+			detached: true
+		});
+		child.on("error", () => void 0);
+		child.unref();
+	}).pipe(Effect.catchTag("UnknownError", () => Effect.void));
+};
+/** Best-effort server-side session revoke on logout (Better Auth `/sign-out`). */
+const revokeSession = (apiUrl, accessToken) => Effect.tryPromise({
+	try: async () => {
+		await fetch(`${apiUrl}/v1/auth/sign-out`, {
+			method: "POST",
+			headers: {
+				"content-type": "application/json",
+				authorization: `Bearer ${accessToken}`
+			}
+		});
+	},
+	catch: (cause) => new SamvaCliError({ message: `Sign-out request failed: ${String(cause)}` })
+});
+/**
+* List the organizations the signed-in user belongs to (Better Auth org plugin
+* `/organization/list`). User-scoped — unlike the product `organizations.get()`
+* endpoint it needs no `x-org-slug`, so it works immediately after `samva login`.
+*/
+const listOrganizations = (apiUrl, accessToken) => Effect.gen(function* () {
+	const result = yield* Effect.tryPromise({
+		try: async () => {
+			const res = await fetch(`${apiUrl}/v1/auth/organization/list`, { headers: { authorization: `Bearer ${accessToken}` } });
+			return {
+				ok: res.ok,
+				status: res.status,
+				body: await res.text()
+			};
+		},
+		catch: (cause) => new SamvaCliError({ message: `Could not list organizations: ${String(cause)}` })
+	});
+	if (!result.ok) return yield* new SamvaCliError({ message: `Could not list organizations (returned ${result.status}). ${result.body}` });
+	return yield* parseJson(result.body, "organization/list");
+});
+//#endregion
+//#region src/commands/login.ts
+const noBrowserFlag = Flag.boolean("no-browser").pipe(Flag.withDescription("Print the verification URL instead of opening a browser"));
+const loginCommand = Command.make("login", { noBrowser: noBrowserFlag }).pipe(Command.withDescription(`Sign in to Samva in your browser (OAuth device flow). ${AGENT_AUTH_HINT}`), Command.withExamples([{
+	command: "samva login",
+	description: "Interactive OAuth (opens browser)"
+}, {
+	command: "samva login --no-browser",
+	description: "Print verification URL instead of opening a browser"
+}]), Command.withHandler(Effect.fnUntraced(function* ({ noBrowser }) {
+	if ((yield* Json) || (yield* JsonLines) || (yield* NoInput)) return yield* new CliUsageError({
+		code: "interactive_login_disabled",
+		message: "Login is interactive and unavailable with --json, --jsonl, or --no-input. Use human mode, or set SAMVA_API_KEY for automation."
+	});
+	if (!process.stdin.isTTY && !noBrowser) return yield* new CliUsageError({
+		code: "non_interactive_login_requires_device_flow",
+		message: "Login without a terminal requires SAMVA_API_KEY for automation. To use OAuth device flow explicitly, run `samva login --no-browser`."
+	});
+	const apiUrl = yield* resolveApiUrl;
+	const device = yield* requestDeviceCode(apiUrl);
+	const verifyUrl = device.verification_uri_complete ?? device.verification_uri;
+	yield* Console.error(`\nTo authorize the Samva CLI, visit:\n\n  ${device.verification_uri}\n`);
+	yield* Console.error(`and enter the code:\n\n  ${device.user_code}\n`);
+	if (noBrowser) yield* Console.error(`Or open this URL directly:\n\n  ${verifyUrl}\n`);
+	else {
+		yield* openBrowser(verifyUrl);
+		yield* Effect.logInfo("Opened your browser to finish login. Waiting for approval…");
+	}
+	const token = yield* pollForToken(apiUrl, device.device_code, device.interval, device.expires_in);
+	const nowMs = yield* Clock.currentTimeMillis;
+	yield* writeCredentials({
+		accessToken: token.access_token,
+		tokenType: token.token_type,
+		expiresAt: Math.floor(nowMs / 1e3) + token.expires_in,
+		scope: token.scope
+	});
+	yield* printResult({ action: "login" }, "Logged in.");
+})));
+//#endregion
+//#region src/commands/logout.ts
+const logoutCommand = Command.make("logout").pipe(Command.withDescription("Sign out and remove stored credentials"), Command.withExamples([{
+	command: "samva logout",
+	description: "Clear stored OAuth tokens"
+}]), Command.withHandler(Effect.fnUntraced(function* () {
+	const credentials = yield* readCredentials.pipe(Effect.catchIf((error) => error instanceof CliConfigError && error.code === "invalid_credential_record", () => Effect.void));
+	if (credentials) {
+		const apiUrl = yield* resolveApiUrl;
+		yield* revokeSession(apiUrl, credentials.accessToken).pipe(Effect.catchTag("SamvaCliError", () => Effect.void));
+	}
+	yield* clearCredentials;
+	yield* printResult({ action: "logout" }, "Logged out.");
+})));
+//#endregion
+//#region src/commands/usage.ts
+const periodFlag = Flag.choice("period", [
+	"current",
+	"last_30_days",
+	"last_90_days",
+	"last_year"
+]).pipe(Flag.withDescription("Reporting period"), Flag.withDefault("current"));
+const usageCommand = Command.make("usage", {
+	period: periodFlag,
+	json: jsonFlag
+}).pipe(Command.withDescription("Get organization usage"), Command.withExamples([{ command: "samva org usage --period last_30_days --json" }]), Command.withHandler(({ period, json }) => Effect.gen(function* () {
+	const client = yield* getClientProvider;
+	const data = yield* Organizations.getUsage({ period }).pipe(client.provide, Effect.mapError((error) => new SamvaCliError({ message: formatApiError("Could not get usage", error) })));
+	if (json) return yield* printJson(data);
+	const { periodStart, periodEnd, ...counts } = data.usage;
+	yield* printFields([
+		["Start", periodStart],
+		["End", periodEnd],
+		["Plan emails", data.billing.includedEmails === null ? "—" : `${data.billing.usedEmails} of ${data.billing.includedEmails}`],
+		["Overage", data.billing.overageCost === null ? "—" : `${data.billing.overageCost} ${data.billing.currency}`]
+	]);
+	yield* printJson(counts);
+}).pipe(json ? Effect.provideService(References.MinimumLogLevel, "None") : identity)));
+//#endregion
+//#region src/commands/org.ts
+const list$3 = Command.make("list", { json: jsonFlag }).pipe(Command.withDescription("List the organizations you can access (multi-org under OAuth; single org under API key)"), Command.withExamples([{
+	command: "samva org list",
+	description: "List orgs (OAuth) or show API-key org"
+}, {
+	command: "samva org list --json",
+	description: "Machine-readable org list"
+}]), Command.withHandler(({ json }) => Effect.gen(function* () {
+	const context = yield* resolveExecutionContext;
+	if (context.credentials) {
+		if (isCredentialExpired(context.credentials, yield* Clock.currentTimeMillis)) return yield* new CliAuthError({
+			code: "expired_credentials",
+			message: "Your session has expired. Run `samva login` to sign in again."
+		});
+		const orgs = yield* listOrganizations(context.apiUrl, context.credentials.accessToken);
+		if (json) return yield* printJson(orgs);
+		if (orgs.length === 0) return yield* Console.log("You are not a member of any organizations yet.");
+		const lines = orgs.map((org) => {
+			return `${org.slug === context.profileOrgSlug ? "* " : "  "}${org.slug}  ${org.name}`;
+		});
+		yield* Console.log(lines.join("\n"));
+		return yield* Effect.logInfo("\nSet the active organization with `samva org use <slug>`.");
+	}
+	const client = yield* getClientProvider;
+	const data = yield* Organizations.get().pipe(client.provide, Effect.mapError((error) => new SamvaCliError({ message: formatApiError("Could not load organization", error) })));
+	if (json) return yield* printJson([data]);
+	yield* printFields([
+		["Name", data.name],
+		["Slug", data.slug],
+		["ID", data.id],
+		["Plan", data.plan]
+	]);
+	yield* Effect.logInfo("\nNote: an API key is scoped to a single organization. Run `samva login` for multi-org access.");
+}).pipe(json ? Effect.provideService(References.MinimumLogLevel, "None") : identity)));
+const use$1 = Command.make("use", { slug: Argument.string("slug") }).pipe(Command.withDescription("Set the active organization for OAuth sessions (ignored when using SAMVA_API_KEY)"), Command.withExamples([{
+	command: "samva org use my-org-slug",
+	description: "Set active org after samva login"
+}]), Command.withHandler(Effect.fnUntraced(function* ({ slug }) {
+	const config = yield* readConfig;
+	const context = yield* resolveExecutionContext;
+	if (context.apiKey) return yield* new CliAuthError({
+		code: "api_key_org_override",
+		message: "samva org use is unavailable with SAMVA_API_KEY; API keys are organization-scoped."
+	});
+	const current = config.profiles[context.profile] ?? {
+		target: "production",
+		credentialIdentity: "none"
+	};
+	yield* writeConfig({
+		...config,
+		profiles: {
+			...config.profiles,
+			[context.profile]: {
+				...current,
+				orgSlug: slug
+			}
+		}
+	});
+	yield* printResult({
+		action: "org.use",
+		slug
+	}, `Active organization set to "${slug}".`);
+})));
+const current = Command.make("current", { json: jsonFlag }).pipe(Command.withDescription("Show the active organization slug"), Command.withExamples([{
+	command: "samva org current",
+	description: "Print active org slug"
+}, {
+	command: "samva org current --json",
+	description: "JSON: { \"activeOrgSlug\": \"...\" }"
+}]), Command.withHandler(({ json }) => Effect.gen(function* () {
+	const slug = (yield* resolveExecutionContext).orgSlug;
+	if (json) {
+		if (!slug) return yield* new CliAuthError({
+			code: "missing_organization",
+			message: "No active organization set. Run `samva org use <slug>` or `samva org list`."
+		});
+		return yield* printJson({ activeOrgSlug: slug });
+	}
+	if (!slug) return yield* new CliAuthError({
+		code: "missing_organization",
+		message: "No active organization set. Run `samva org use <slug>` or `samva org list`."
+	});
+	yield* Console.log(slug);
+}).pipe(json ? Effect.provideService(References.MinimumLogLevel, "None") : identity)));
+const orgCommand = Command.make("org").pipe(Command.withDescription(`Manage organizations. ${AGENT_AUTH_HINT}`), Command.withExamples([{
+	command: "samva org list",
+	description: "List accessible organizations"
+}, {
+	command: "samva org use my-org-slug",
+	description: "Set active org (OAuth)"
+}]), Command.withSubcommands([
+	list$3,
+	use$1,
+	current,
+	usageCommand
+]));
+//#endregion
+//#region src/commands/profile.ts
+const list$2 = Command.make("list").pipe(Command.withDescription("List user-level execution profiles"), Command.withHandler(Effect.fnUntraced(function* () {
+	const config = yield* readConfig;
+	if ((yield* Json) || (yield* JsonLines)) return yield* printJson({
+		activeProfile: config.activeProfile ?? "default",
+		profiles: config.profiles
+	});
+	const active = config.activeProfile ?? "default";
+	const lines = Object.entries(config.profiles).map(([name, profile]) => `${name === active ? "* " : "  "}${name}\t${profile.target}${profile.orgSlug ? `\t${profile.orgSlug}` : ""}`);
+	yield* Console.log(lines.length > 0 ? lines.join("\n") : "No profiles yet. Use `samva profile create <name>`.");
+})));
+const show = Command.make("show", { name: Argument.string("name").pipe(Argument.optional) }).pipe(Command.withDescription("Show the resolved execution context"), Command.withHandler(Effect.fnUntraced(function* ({ name }) {
+	const context = yield* resolveExecutionContext;
+	const selected = Option.getOrUndefined(name) ?? context.profile;
+	const profile = (yield* readConfig).profiles[selected];
+	if (!profile && selected !== "default") return yield* new CliUsageError({
+		code: "unknown_profile",
+		message: `Profile ${selected} does not exist.`
+	});
+	const output = {
+		name: selected,
+		...profile ?? {
+			target: "production",
+			credentialIdentity: "none"
+		},
+		apiUrl: selected === context.profile ? context.apiUrl : void 0
+	};
+	if ((yield* Json) || (yield* JsonLines)) return yield* printJson(output);
+	yield* Console.log(`${output.name}\t${output.target}${output.orgSlug ? `\t${output.orgSlug}` : ""}`);
+})));
+const create$2 = Command.make("create", {
+	name: Argument.string("name"),
+	target: Flag.choice("target", ["production", "local"]).pipe(Flag.withDefault("production")),
+	org: Flag.string("org").pipe(Flag.optional)
+}).pipe(Command.withDescription("Create a non-secret execution profile"), Command.withHandler(Effect.fnUntraced(function* ({ name, target, org }) {
+	yield* validateProfileName(name);
+	const config = yield* readConfig;
+	if (config.profiles[name]) return yield* new CliUsageError({
+		code: "profile_exists",
+		message: `Profile ${name} already exists. Delete it first or choose another name.`
+	});
+	const orgSlug = Option.getOrUndefined(org);
+	yield* writeConfig({
+		...config,
+		profiles: {
+			...config.profiles,
+			[name]: {
+				target,
+				orgSlug,
+				credentialIdentity: "none"
+			}
+		}
+	});
+	yield* printResult({
+		action: "profile.create",
+		name,
+		target,
+		orgSlug
+	}, `Created profile ${name}.`);
+})));
+const use = Command.make("use", { name: Argument.string("name") }).pipe(Command.withDescription("Select the active user-level execution profile"), Command.withHandler(Effect.fnUntraced(function* ({ name }) {
+	const config = yield* readConfig;
+	if (!config.profiles[name]) return yield* new CliUsageError({
+		code: "unknown_profile",
+		message: `Profile ${name} does not exist. Create it with \`samva profile create ${name}\`.`
+	});
+	yield* writeConfig({
+		...config,
+		activeProfile: name
+	});
+	yield* printResult({
+		action: "profile.use",
+		name
+	}, `Active profile set to ${name}.`);
+})));
+const remove$1 = Command.make("delete", {
+	name: Argument.string("name"),
+	yes: Flag.boolean("yes").pipe(Flag.withDefault(false))
+}).pipe(Command.withDescription("Delete a profile and its OS-keyring credential"), Command.withHandler(Effect.fnUntraced(function* ({ name, yes }) {
+	const config = yield* readConfig;
+	const profile = config.profiles[name];
+	if (!profile) return yield* new CliUsageError({
+		code: "unknown_profile",
+		message: `Profile ${name} does not exist.`
+	});
+	const machine = (yield* Json) || (yield* JsonLines);
+	yield* confirmDestructive({
+		yes,
+		json: machine,
+		message: `Delete profile ${name} and its saved credential?`,
+		nonInteractiveMessage: "Profile deletion requires --yes in non-interactive mode."
+	});
+	const { [name]: _, ...profiles } = config.profiles;
+	yield* writeConfig(config.activeProfile === name ? {
+		version: 2,
+		profiles
+	} : {
+		...config,
+		profiles
+	});
+	if (profile.credentialIdentity === "oauth") yield* clearCredentialSecret(name);
+	yield* printResult({
+		action: "profile.delete",
+		name
+	}, `Deleted profile ${name}.`);
+})));
+const profileCommand = Command.make("profile").pipe(Command.withDescription("Manage user-level target, credential identity, and organization contexts"), Command.withSubcommands([
+	list$2,
+	show,
+	create$2,
+	use,
+	remove$1
+]));
+//#endregion
+//#region src/commands/scheduled.ts
+const SCHEDULED_STATUSES = [
+	"pending",
+	"dispatching",
+	"dispatched",
+	"cancelled",
+	"failed"
+];
+const ABSOLUTE_INSTANT_PATTERN = /^(\d{4})-(\d{2})-(\d{2})T\d{2}:\d{2}:\d{2}(?:\.\d+)?(?:Z|[+-]\d{2}:\d{2})$/;
+const isAbsoluteInstant = (value) => {
+	const match = ABSOLUTE_INSTANT_PATTERN.exec(value);
+	if (!match || Number.isNaN(Date.parse(value))) return false;
+	const year = Number(match[1]);
+	const month = Number(match[2]);
+	const day = Number(match[3]);
+	const calendarDate = new Date(Date.UTC(year, month - 1, day));
+	return calendarDate.getUTCFullYear() === year && calendarDate.getUTCMonth() === month - 1 && calendarDate.getUTCDate() === day;
+};
+/**
+* Assemble the `scheduledMessages.create` email payload from resolved flags.
+* Pure so the flag-to-request mapping can be unit-tested without the network.
+*/
+const assembleScheduledEmailPayload = (input) => ({
+	send: {
+		channel: "email",
+		to: input.to.map((email) => ({ email })),
+		cc: input.cc ? [{ email: input.cc }] : void 0,
+		bcc: input.bcc ? [{ email: input.bcc }] : void 0,
+		email: {
+			subject: input.subject,
+			html: input.html,
+			text: input.text,
+			templateId: input.templateId,
+			templateSlug: input.templateSlug,
+			templateData: input.templateData,
+			...input.tracking === void 0 ? {} : { tracking: input.tracking }
+		}
+	},
+	scheduledFor: input.scheduledFor,
+	timezone: input.timezone,
+	idempotencyKey: input.idempotencyKey,
+	referenceId: input.referenceId
+});
+const parseTemplateData = (raw) => Option.match(raw, {
+	onNone: () => Effect.succeed(void 0),
+	onSome: (value) => Effect.try({
+		try: () => JSON.parse(value),
+		catch: () => new SamvaCliError({ message: "--template-data must be a JSON object." })
+	}).pipe(Effect.flatMap((parsed) => Predicate.isObject(parsed) ? Effect.succeed(parsed) : Effect.fail(new SamvaCliError({ message: "--template-data must be a JSON object." }))))
+});
+const toFlag = Flag.string("to").pipe(Flag.withDescription("Recipient email address (repeatable)"), Flag.atLeast(1));
+const ccFlag = Flag.string("cc").pipe(Flag.withDescription("Cc recipient email address"), Flag.optional);
+const bccFlag = Flag.string("bcc").pipe(Flag.withDescription("Bcc recipient email address"), Flag.optional);
+const subjectFlag = Flag.string("subject").pipe(Flag.withDescription("Email subject line (required with inline --html; omit for templates)"), Flag.optional);
+const htmlFlag = Flag.string("html").pipe(Flag.withDescription("HTML body"), Flag.optional);
+const textFlag = Flag.string("text").pipe(Flag.withDescription("Plain-text body"), Flag.optional);
+const templateIdFlag = Flag.string("template-id").pipe(Flag.withDescription("Template id (uuid) to render instead of inline body"), Flag.optional);
+const templateSlugFlag = Flag.string("template-slug").pipe(Flag.withDescription("Template handle to render instead of inline body, e.g. welcome-email"), Flag.optional);
+const templateDataFlag = Flag.string("template-data").pipe(Flag.withDescription("JSON object of variables for the template"), Flag.optional);
+const atFlag = Flag.string("at").pipe(Flag.withDescription("Absolute send instant as an ISO 8601 datetime, e.g. 2026-08-01T09:00:00Z"));
+const timezoneFlag = Flag.string("timezone").pipe(Flag.withDescription("IANA timezone for the schedule, e.g. America/New_York"), Flag.optional);
+const idempotencyKeyFlag = Flag.string("idempotency-key").pipe(Flag.withDescription("Idempotency key so retries do not schedule duplicates"), Flag.optional);
+const referenceIdFlag = Flag.string("reference-id").pipe(Flag.withDescription("Your own reference id to correlate this schedule"), Flag.optional);
+const dryRunFlag$1 = Flag.boolean("dry-run").pipe(Flag.withDescription("Validate inputs and print the request payload without calling the API"), Flag.withDefault(false));
+const trackOpensFlag = Flag.choice("track-opens", ["on", "off"]).pipe(Flag.withDescription("Override open tracking for this scheduled send; recipient opt-out wins"), Flag.optional);
+const trackClicksFlag = Flag.choice("track-clicks", ["on", "off"]).pipe(Flag.withDescription("Override click tracking for this scheduled send; recipient opt-out wins"), Flag.optional);
+const statusFlag = Flag.choice("status", SCHEDULED_STATUSES).pipe(Flag.withDescription("Filter by status"), Flag.optional);
+const pageFlag = Flag.integer("page").pipe(Flag.withDescription("Page number (1-based)"), Flag.optional);
+const limitFlag = Flag.integer("limit").pipe(Flag.withDescription("Items per page"), Flag.optional);
+const allFlag = Flag.boolean("all").pipe(Flag.withDescription("Traverse every page (requires --jsonl)"), Flag.withDefault(false));
+const create$1 = Command.make("create", {
+	to: toFlag,
+	cc: ccFlag,
+	bcc: bccFlag,
+	subject: subjectFlag,
+	html: htmlFlag,
+	text: textFlag,
+	templateId: templateIdFlag,
+	templateSlug: templateSlugFlag,
+	templateData: templateDataFlag,
+	at: atFlag,
+	timezone: timezoneFlag,
+	idempotencyKey: idempotencyKeyFlag,
+	referenceId: referenceIdFlag,
+	trackOpens: trackOpensFlag,
+	trackClicks: trackClicksFlag,
+	dryRun: dryRunFlag$1,
+	json: jsonFlag
+}).pipe(Command.withDescription("Schedule an email to send at a future time"), Command.withExamples([
+	{
+		command: "samva scheduled-messages create --to you@example.com --subject Hi --html \"<p>Hello</p>\" --text Hello --at 2026-08-01T09:00:00Z",
+		description: "Schedule an inline HTML email with a text fallback"
+	},
+	{
+		command: "samva scheduled-messages create --to you@example.com --template-slug welcome-email --template-data '{\"name\":\"Ada\"}' --at 2026-08-01T09:00:00Z --timezone America/New_York",
+		description: "Schedule a published template; timezone is descriptive metadata"
+	},
+	{
+		command: "samva scheduled-messages create --to you@example.com --subject Hi --html \"<p>Hello</p>\" --at 2026-08-01T09:00:00Z --dry-run",
+		description: "Validate and print the payload without scheduling"
+	}
+]), Command.withHandler(({ to, cc, bcc, subject, html, text, templateId, templateSlug, templateData, at, timezone, idempotencyKey, referenceId, trackOpens, trackClicks, dryRun, json }) => Effect.gen(function* () {
+	const htmlValue = Option.getOrUndefined(html);
+	const textValue = Option.getOrUndefined(text);
+	const templateIdValue = Option.getOrUndefined(templateId);
+	const templateSlugValue = Option.getOrUndefined(templateSlug);
+	const templateDataValue = yield* parseTemplateData(templateData);
+	if (templateIdValue && templateSlugValue) return yield* new SamvaCliError({ message: "Use either --template-id or --template-slug, not both." });
+	const templateRefValue = templateSlugValue ?? templateIdValue;
+	if (templateRefValue && (Option.isSome(subject) || htmlValue || textValue)) return yield* new SamvaCliError({ message: "Choose one content source: a template, or inline --subject with --html (and optional --text)." });
+	if (!templateRefValue && Option.isNone(subject)) return yield* new SamvaCliError({ message: "Provide --subject with inline --html, or reference a published template." });
+	if (!templateRefValue && !htmlValue) return yield* new SamvaCliError({ message: "Provide --html for inline email; --text is an optional fallback, not a body source." });
+	if (!isAbsoluteInstant(at)) return yield* new SamvaCliError({ message: "--at must be an absolute ISO 8601 instant with Z or an offset, e.g. 2026-08-01T09:00:00Z." });
+	const payload = assembleScheduledEmailPayload({
+		to: [...to],
+		subject: Option.getOrUndefined(subject),
+		html: htmlValue,
+		text: textValue,
+		templateId: templateIdValue,
+		templateSlug: templateSlugValue,
+		templateData: templateDataValue,
+		cc: Option.getOrUndefined(cc),
+		bcc: Option.getOrUndefined(bcc),
+		scheduledFor: new Date(at),
+		timezone: Option.getOrUndefined(timezone),
+		idempotencyKey: Option.getOrUndefined(idempotencyKey),
+		referenceId: Option.getOrUndefined(referenceId),
+		tracking: Option.isSome(trackOpens) || Option.isSome(trackClicks) ? {
+			...Option.isSome(trackOpens) ? { opens: trackOpens.value === "on" } : {},
+			...Option.isSome(trackClicks) ? { clicks: trackClicks.value === "on" } : {}
+		} : void 0
+	});
+	if (dryRun) {
+		if (json) return yield* printJson({
+			dryRun: true,
+			request: payload
+		});
+		yield* Effect.logInfo("Dry run — no schedule created.\n");
+		yield* printFields([
+			["To", [...to].join(", ")],
+			["Subject", Option.getOrUndefined(subject)],
+			["Send at", at],
+			["Timezone", Option.getOrUndefined(timezone)]
+		]);
+		return yield* Console.log(`\nPayload:\n${truncateForDisplay(JSON.stringify(payload, null, 2))}`);
+	}
+	const client = yield* getClientProvider;
+	const data = yield* ScheduledMessages.create(payload).pipe(client.provide, Effect.mapError((error) => new SamvaCliError({ message: formatApiError("Failed to schedule message", error) })));
+	if (json) return yield* printJson(data);
+	yield* Effect.logInfo("Message scheduled.\n");
+	yield* printFields([
+		["ID", data.id],
+		["Status", data.status],
+		["Send at", data.scheduledFor],
+		["Timezone", data.timezone]
+	]);
+	yield* Effect.logInfo(`\nInspect it:  samva scheduled-messages get ${data.id}`);
+}).pipe(json ? Effect.provideService(References.MinimumLogLevel, "None") : identity)));
+const list$1 = Command.make("list", {
+	status: statusFlag,
+	page: pageFlag,
+	limit: limitFlag,
+	all: allFlag,
+	json: jsonFlag
+}).pipe(Command.withDescription("List scheduled messages"), Command.withExamples([
+	{
+		command: "samva scheduled-messages list",
+		description: "List all scheduled messages"
+	},
+	{
+		command: "samva scheduled-messages list --status pending",
+		description: "Only pending schedules"
+	},
+	{ command: "samva scheduled-messages list --json" },
+	{
+		command: "samva scheduled-messages list --all --jsonl",
+		description: "Stream every page as JSONL"
+	}
+]), Command.withHandler(({ status, page, limit, all, json }) => Effect.gen(function* () {
+	if (all && !isJsonLinesRequested()) return yield* new CliUsageError({
+		code: "all_requires_jsonl",
+		message: "--all is an unbounded traversal and requires --jsonl."
+	});
+	const pageValue = Option.getOrUndefined(page);
+	const limitValue = Option.getOrUndefined(limit);
+	const client = yield* getClientProvider;
+	const query = {
+		status: Option.getOrUndefined(status),
+		page: pageValue?.toString(),
+		limit: limitValue?.toString()
+	};
+	if (all) {
+		let nextPage = pageValue ?? 1;
+		for (;;) {
+			const data = yield* ScheduledMessages.list({
+				...query,
+				page: nextPage.toString()
+			}).pipe(client.provide, Effect.mapError((error) => new SamvaCliError({ message: formatApiError("Could not list scheduled messages", error) })));
+			for (const item of data.items) yield* printJsonLine(item);
+			if (nextPage >= data.pagination.totalPages || data.items.length === 0) return;
+			nextPage += 1;
+		}
+	}
+	const data = yield* ScheduledMessages.list(query).pipe(client.provide, Effect.mapError((error) => new SamvaCliError({ message: formatApiError("Could not list scheduled messages", error) })));
+	if (isJsonLinesRequested()) {
+		for (const item of data.items) yield* printJsonLine(item);
+		return;
+	}
+	if (json) return yield* printJson(data);
+	if (data.items.length === 0) return yield* Console.log("No scheduled messages. Create one with `samva scheduled-messages create`.");
+	for (const item of data.items) {
+		yield* printFields([
+			["ID", item.id],
+			["Status", item.status],
+			["Channel", item.send.channel],
+			["Send at", item.scheduledFor],
+			["Timezone", item.timezone]
+		]);
+		yield* Console.log("");
+	}
+	yield* Console.log(`Page ${String(data.pagination.page)} of ${String(data.pagination.totalPages)} (${String(data.pagination.total)} total)`);
+}).pipe(json ? Effect.provideService(References.MinimumLogLevel, "None") : identity)));
+const get$1 = Command.make("get", {
+	id: Argument.string("id"),
+	json: jsonFlag
+}).pipe(Command.withDescription("Show a scheduled message by id"), Command.withExamples([{ command: "samva scheduled-messages get sched_abc123" }]), Command.withHandler(({ id, json }) => Effect.gen(function* () {
+	const client = yield* getClientProvider;
+	const data = yield* ScheduledMessages.get({ id }).pipe(client.provide, Effect.mapError((error) => new SamvaCliError({ message: formatApiError("Could not fetch scheduled message", error) })));
+	if (json) return yield* printJson(data);
+	yield* printFields([
+		["ID", data.id],
+		["Status", data.status],
+		["Channel", data.send.channel],
+		["Send at", data.scheduledFor],
+		["Timezone", data.timezone],
+		["Message ID", data.messageId],
+		["Reference", data.referenceId],
+		["Failure", data.failureReason]
+	]);
+}).pipe(json ? Effect.provideService(References.MinimumLogLevel, "None") : identity)));
+const cancel = Command.make("cancel", {
+	id: Argument.string("id"),
+	dryRun: Flag.boolean("dry-run").pipe(Flag.withDefault(false)),
+	yes: Flag.boolean("yes").pipe(Flag.withDefault(false)),
+	json: jsonFlag
+}).pipe(Command.withDescription("Cancel a pending scheduled message"), Command.withExamples([{ command: "samva scheduled-messages cancel sched_abc123 --dry-run" }, { command: "samva scheduled-messages cancel sched_abc123 --yes" }]), Command.withHandler(({ id, dryRun, yes, json }) => Effect.gen(function* () {
+	if (dryRun) return yield* json ? printJson({
+		dryRun: true,
+		action: "scheduled.cancel",
+		id
+	}) : Console.log(`[dry-run] Would cancel scheduled message ${id}.`);
+	yield* confirmDestructive({
+		yes,
+		json,
+		message: `Cancel scheduled message ${id}?`,
+		nonInteractiveMessage: "Scheduled message cancellation requires --yes in non-interactive mode. Preview with --dry-run."
+	});
+	const client = yield* getClientProvider;
+	const data = yield* ScheduledMessages.cancel({ id }).pipe(client.provide, Effect.mapError((error) => new SamvaCliError({ message: formatApiError("Could not cancel scheduled message", error) })));
+	if (json) return yield* printJson(data);
+	yield* Effect.logInfo("Scheduled message cancelled.\n");
+	yield* printFields([["ID", data.item.id], ["Status", data.item.status]]);
+}).pipe(json ? Effect.provideService(References.MinimumLogLevel, "None") : identity)));
+const scheduledMessagesCommand = Command.make("scheduled-messages").pipe(Command.withDescription("Schedule messages to send at a future time"), Command.withExamples([{
+	command: "samva scheduled-messages create --to you@example.com --subject Hi --html \"<p>Hello</p>\" --at 2026-08-01T09:00:00Z",
+	description: "Schedule an email"
+}, {
+	command: "samva scheduled-messages list",
+	description: "List scheduled messages"
+}]), Command.withSubcommands([
+	create$1,
+	list$1,
+	get$1,
+	cancel
+]));
+//#endregion
+//#region src/commands/templates/plan.ts
+const emptyLock = {
+	version: 1,
+	entries: {}
+};
+const sha256 = (value) => createHash("sha256").update(value, "utf8").digest("hex");
+/**
+* Derives a platform slug from a file-backed template name.
+* `welcome-email` → `welcome-email`, `accountUpdate2` → `account-update-2`.
+*/
+const slugFromName = (name) => name.replace(/([a-z0-9])([A-Z])/g, "$1-$2").replace(/([A-Z]+)([A-Z][a-z])/g, "$1-$2").replace(/[^a-zA-Z0-9]+/g, "-").toLowerCase().replace(/^-+|-+$/g, "");
+/**
+* Builds the push plan. `platformSlugs` are the slugs currently on the platform
+* (from listTemplates) so we distinguish create vs update. `platformBaseHash`
+* maps a slug to the platform's current source hash (the CLI derives it from the
+* `source` the list now returns); when absent, divergence falls back to the lock.
+*/
+const planPush = (input) => {
+	const items = input.templates.map((template) => {
+		if (template.source === void 0 || template.diagnostics.length > 0) return {
+			file: template.file,
+			name: template.name,
+			slug: template.slug,
+			action: "blocked",
+			sourceHash: void 0,
+			reason: template.diagnostics[0]?.message ?? "template did not emit valid SML"
+		};
+		const hash = sha256(template.source);
+		const lockEntry = input.lock.entries[template.slug];
+		const onPlatform = input.platformSlugs.has(template.slug);
+		const platformHash = input.platformBaseHash?.[template.slug];
+		if (!input.force && onPlatform && lockEntry !== void 0 && platformHash !== void 0 && platformHash !== lockEntry.sourceHash) return {
+			file: template.file,
+			name: template.name,
+			slug: template.slug,
+			action: "diverged",
+			sourceHash: hash,
+			reason: "the platform's template changed since your last push — re-run with --force to overwrite"
+		};
+		const platformMatchesLocal = platformHash === void 0 || platformHash === hash;
+		if (!input.force && lockEntry !== void 0 && lockEntry.sourceHash === hash && onPlatform && platformMatchesLocal) return {
+			file: template.file,
+			name: template.name,
+			slug: template.slug,
+			action: "unchanged",
+			sourceHash: hash,
+			reason: void 0
+		};
+		return {
+			file: template.file,
+			name: template.name,
+			slug: template.slug,
+			action: onPlatform ? "update" : "create",
+			sourceHash: hash,
+			reason: void 0
+		};
+	});
+	return {
+		items,
+		hasBlocking: items.some((item) => item.action === "blocked" || item.action === "diverged")
+	};
+};
+/** Applies a successful push to the lock, replacing entries for pushed slugs. */
+const applyPushToLock = (lock, pushed, compilerVersion) => {
+	const entries = { ...lock.entries };
+	for (const item of pushed) entries[item.slug] = {
+		slug: item.slug,
+		sourceHash: item.sourceHash,
+		compilerVersion
+	};
+	return {
+		version: 1,
+		entries
+	};
+};
+/**
+* Compares the CLI's compiler version (from @samva/markup) against the platform's
+* reported compilerVersion. A mismatch is preview-staleness only — the platform
+* recompiles on its side — so this returns a warning string, never an error.
+*/
+const skewWarning = (cliVersion, platformVersion) => {
+	if (platformVersion === void 0 || platformVersion === cliVersion) return void 0;
+	return `compiler version skew: your @samva/markup compiles v${cliVersion}, the platform runs v${platformVersion}. Local previews may differ from sent mail; the platform recompiles from the SML you push, so nothing wrong is sent. Update @samva/markup to match.`;
+};
+//#endregion
+//#region src/commands/templates.ts
+/**
+* `samva templates push/pull/init` — the local-repo authoring workflow for the
+* TSX email framework (design brief §7b). `push` emits SML from your `.tsx`
+* templates and (git-style) create-or-updates them on the platform; `pull`
+* writes the platform's SML back to `.samva` files; `init` scaffolds a project.
+*
+* Push sends SML ONLY — the platform recompiles server-side with the org's theme
+* layers. The templates API accepts a code-origin SML `source` (+ `origin:
+* "tsx"`) on create/update and returns it on list/get. Everything local (emit,
+* plan, divergence, skew) runs first; use --dry-run to review the SML that would
+* be sent without touching the API.
+*/
+const LOCK_FILE = ".samva/push-lock.json";
+const dirFlag = Flag.directory("dir").pipe(Flag.withDescription("Directory containing your .tsx / .samva templates"), Flag.withDefault("emails"));
+const forceFlag = Flag.boolean("force").pipe(Flag.withDescription("Overwrite templates that changed on the platform since your last push"), Flag.withDefault(false));
+const dryRunFlag = Flag.boolean("dry-run").pipe(Flag.withDescription("Emit SML and print the push plan without calling the API"), Flag.withDefault(false));
+const templateIdArgument = Argument.string("id").pipe(Argument.withDescription("Remote template id"));
+const parseObject$1 = (raw, flag) => Effect.try({
+	try: () => JSON.parse(raw),
+	catch: () => new SamvaCliError({ message: `${flag} must be a valid JSON object.` })
+}).pipe(Effect.flatMap((value) => Predicate.isObject(value) && !Array.isArray(value) ? Effect.succeed(value) : Effect.fail(new SamvaCliError({ message: `${flag} must be a non-null JSON object.` }))));
+const decodePayload$1 = (raw, flag, schema) => parseObject$1(raw, flag).pipe(Effect.flatMap(Schema.decodeUnknownEffect(schema)), Effect.mapError((error) => error instanceof SamvaCliError ? error : new SamvaCliError({ message: `${flag} does not match the API schema: ${String(error)}` })));
+const buildDir = (dir) => Effect.tryPromise({
+	try: async () => {
+		const child = Bun.spawn([
+			"node",
+			"--input-type=module",
+			"--eval",
+			"import { buildTemplates } from \"@samva/vite/build\"; const result = await buildTemplates(process.argv[1]); process.stdout.write(JSON.stringify(result));",
+			resolve(dir)
+		], {
+			cwd: process.cwd(),
+			stdout: "pipe",
+			stderr: "pipe"
+		});
+		const [stdout, stderr, exitCode] = await Promise.all([
+			new Response(child.stdout).text(),
+			new Response(child.stderr).text(),
+			child.exited
+		]);
+		if (exitCode !== 0) return Promise.reject(new SamvaCliError({ message: stderr.trim() || "Template build process failed." }));
+		return JSON.parse(stdout);
+	},
+	catch: (cause) => new SamvaCliError({ message: `Could not build templates in ${dir}. Install Node.js 22+, @samva/markup, @samva/vite, and vite in this project: ${String(cause)}` })
+});
+/** Compile-stage diagnostics across the channel-polymorphic preview payload. */
+const compileDiagnostics = (compiled) => {
+	if (compiled.channel === "email") return compiled.bases.flatMap((base) => base.ok ? [] : base.diagnostics ?? []);
+	return compiled.ok ? [] : compiled.diagnostics ?? [];
+};
+/** Flattens a build result into per-template BuiltTemplate rows for planning. */
+const toBuiltTemplates = (result) => result.files.flatMap((file) => {
+	const templates = file.preview.templates.map((template) => ({
+		file: file.id,
+		name: template.name,
+		slug: slugFromName(template.name),
+		source: template.source,
+		variables: template.variables.map((variable) => ({
+			name: variable.name,
+			required: variable.required
+		})),
+		diagnostics: [...template.diagnostics.map((diagnostic) => ({
+			code: diagnostic.code,
+			message: diagnostic.message
+		})), ...compileDiagnostics(template.compiled).map((diagnostic) => ({
+			code: diagnostic.code,
+			message: diagnostic.message
+		}))]
+	}));
+	if (templates.length > 0) return templates;
+	const errors = file.preview.diagnostics.filter((diagnostic) => diagnostic.code !== "missing-default-export");
+	if (errors.length === 0) return [];
+	const name = file.id.slice(file.id.lastIndexOf("/") + 1).replace(/\.(?:tsx|samva)$/, "");
+	return [{
+		file: file.id,
+		name,
+		slug: slugFromName(name),
+		source: void 0,
+		variables: [],
+		diagnostics: errors.map((diagnostic) => ({
+			code: diagnostic.code,
+			message: diagnostic.message
+		}))
+	}];
+});
+const buildWarnings = (result) => result.files.flatMap((file) => file.preview.diagnostics.filter((diagnostic) => diagnostic.code === "missing-default-export").map((diagnostic) => ({
+	file: file.id,
+	code: diagnostic.code,
+	message: diagnostic.message
+})));
+const compilerVersionOf = (result) => result.files[0]?.preview.compilerVersion ?? "unknown";
+/**
+* The lock lives at the PROJECT root (cwd), not inside the templates
+* directory — it's per-project push state, like a lockfile.
+*/
+const readLock = () => Effect.tryPromise({
+	try: async () => {
+		const text = await readFile(join(process.cwd(), LOCK_FILE), "utf8").catch(() => void 0);
+		if (text === void 0) return emptyLock;
+		const parsed = JSON.parse(text);
+		return parsed.version === 1 && parsed.entries ? parsed : emptyLock;
+	},
+	catch: () => new SamvaCliError({ message: `Could not read ${join(process.cwd(), LOCK_FILE)}` })
+});
+/**
+* Persist the push lock (git-index-style base) after a successful push. The lock
+* lives at the project root and is only advanced for slugs that actually landed.
+*/
+const writeLock = (lock) => Effect.tryPromise({
+	try: async () => {
+		const target = join(process.cwd(), LOCK_FILE);
+		await mkdir(dirname(target), { recursive: true });
+		await writeFile(target, `${JSON.stringify(lock, null, 2)}\n`, "utf8");
+	},
+	catch: () => new SamvaCliError({ message: `Could not write ${join(process.cwd(), LOCK_FILE)}` })
+});
+/**
+* Page through the full template list — the slug→id map and create-vs-update
+* classification must see EVERY platform template, or an org past one page
+* would misclassify existing templates as creates (409s on push).
+*/
+const listAllTemplates = (client) => Effect.gen(function* () {
+	const items = [];
+	let page = 1;
+	for (;;) {
+		const response = yield* Templates.list({
+			page: page.toString(),
+			limit: "200"
+		}).pipe(client.provide);
+		items.push(...response.items);
+		const totalPages = Number(response.pagination.totalPages);
+		if (!Number.isFinite(totalPages) || page >= totalPages || response.items.length === 0) return items;
+		page += 1;
+	}
+});
+const printPushPlan = (plan, compilerVersion, sources) => Effect.gen(function* () {
+	for (const item of plan.items) {
+		yield* printFields([[item.action.toUpperCase(), `${item.name}  →  ${item.slug}`], ...item.reason ? [["reason", item.reason]] : []]);
+		if (item.action !== "blocked") {
+			const source = sources.get(item.slug);
+			if (source) yield* Console.log(`\n${truncateForDisplay(source)}\n`);
+		}
+	}
+	yield* Console.log(`compiler v${compilerVersion} · ${plan.items.length} template(s)`);
+});
+const push = Command.make("push", {
+	dir: dirFlag,
+	force: forceFlag,
+	dryRun: dryRunFlag,
+	json: jsonFlag
+}).pipe(Command.withDescription("Emit SML from your TSX templates and push them to the platform"), Command.withExamples([{
+	command: "samva templates push --dir emails --dry-run",
+	description: "Emit SML and print the push plan without calling the API"
+}, {
+	command: "samva templates push --dir emails --force",
+	description: "Push, overwriting templates changed on the platform since your last push"
+}]), Command.withHandler(({ dir, force, dryRun, json }) => Effect.gen(function* () {
+	const built = yield* buildDir(dir);
+	const templates = toBuiltTemplates(built);
+	const warnings = buildWarnings(built);
+	if (templates.length === 0) return yield* new SamvaCliError({ message: `No templates found in ${dir}. Each TSX template file must default-export one <Email>, <Sms>, or <WhatsApp> template.` });
+	const compilerVersion = compilerVersionOf(built);
+	const lock = yield* readLock();
+	const sources = /* @__PURE__ */ new Map();
+	for (const template of templates) if (template.source) sources.set(template.slug, template.source);
+	const client = dryRun ? void 0 : yield* getClientProvider;
+	const platform = dryRun ? [] : yield* listAllTemplates(client).pipe(Effect.catch(() => Effect.succeed([])));
+	const slugToId = /* @__PURE__ */ new Map();
+	const platformBaseHash = {};
+	for (const item of platform) {
+		slugToId.set(item.slug, item.id);
+		if (item.source) platformBaseHash[item.slug] = sha256(item.source);
+	}
+	const platformSlugs = dryRun ? new Set(Object.keys(lock.entries)) : new Set(slugToId.keys());
+	const plan = planPush({
+		templates,
+		lock,
+		platformSlugs,
+		platformBaseHash,
+		force
+	});
+	const skew = skewWarning(compilerVersion, void 0);
+	if (json && dryRun) return yield* printJson({
+		action: "templates.push",
+		dryRun,
+		compilerVersion,
+		skewWarning: skew,
+		plan: plan.items,
+		sources: Object.fromEntries(sources),
+		warnings
+	});
+	if (!json) {
+		for (const warning of warnings) yield* Console.error(`⚠ ${warning.file}: ${warning.message}`);
+		if (skew) yield* Console.error(`⚠ ${skew}\n`);
+		yield* printPushPlan(plan, compilerVersion, sources);
+	}
+	if (dryRun) {
+		yield* Effect.logInfo("\nDry run — no API request sent.");
+		return;
+	}
+	if (plan.hasBlocking) {
+		const blocked = plan.items.filter((item) => item.action === "blocked" || item.action === "diverged");
+		if (json) yield* printJson({
+			action: "templates.push",
+			dryRun: false,
+			compilerVersion,
+			skewWarning: skew,
+			warnings,
+			blocked: blocked.map((item) => ({
+				slug: item.slug,
+				action: item.action,
+				reason: item.reason
+			})),
+			results: []
+		});
+		return yield* new SamvaCliError({ message: `Cannot push: ${blocked.length} template(s) blocked or diverged (${blocked.map((item) => `${item.slug} [${item.action}]`).join(", ")}). Fix the diagnostics or re-run with --force for diverged templates.` });
+	}
+	const results = [];
+	const landed = [];
+	const runItem = (send, label) => send.pipe(Effect.as({
+		ok: true,
+		error: void 0
+	}), Effect.catch((error) => Effect.succeed({
+		ok: false,
+		error: formatApiError(`${label} failed`, error)
+	})));
+	for (const item of plan.items) {
+		if (item.action !== "create" && item.action !== "update") continue;
+		const source = sources.get(item.slug);
+		if (source === void 0 || item.sourceHash === void 0) continue;
+		const outcome = yield* runItem(client.provide(item.action === "create" ? Templates.create({
+			name: item.name,
+			slug: item.slug,
+			origin: "tsx",
+			source
+		}) : Templates.update({
+			id: slugToId.get(item.slug),
+			data: {
+				origin: "tsx",
+				source
+			}
+		})), item.action);
+		results.push({
+			...item,
+			...outcome
+		});
+		if (outcome.ok) landed.push({
+			slug: item.slug,
+			sourceHash: item.sourceHash
+		});
+	}
+	if (landed.length > 0) yield* writeLock(applyPushToLock(lock, landed, compilerVersion));
+	const failed = results.filter((result) => !result.ok);
+	if (json) return yield* printJson({
+		action: "templates.push",
+		dryRun: false,
+		compilerVersion,
+		skewWarning: skew,
+		warnings,
+		results
+	});
+	for (const result of results) yield* result.ok ? Effect.logInfo(`✓ ${result.action} ${result.slug}`) : Effect.logWarning(`✗ ${result.action} ${result.slug} — ${result.error}`);
+	const created = results.filter((result) => result.ok && result.action === "create").length;
+	const updated = results.filter((result) => result.ok && result.action === "update").length;
+	yield* Effect.logInfo(`\n${created} created · ${updated} updated · ${failed.length} failed`);
+	if (failed.length > 0) return yield* new SamvaCliError({ message: `${failed.length} template(s) failed to push (${failed.map((result) => result.slug).join(", ")}).` });
+}).pipe(json ? Effect.provideService(References.MinimumLogLevel, "None") : identity)));
+const pull = Command.make("pull", {
+	dir: dirFlag,
+	dryRun: dryRunFlag,
+	json: jsonFlag
+}).pipe(Command.withDescription("Write the platform's template SML to local .samva files (one-way)"), Command.withExamples([{
+	command: "samva templates pull emails",
+	description: "Write each platform template's SML to emails/<slug>.samva"
+}]), Command.withHandler(({ dir, dryRun, json }) => Effect.gen(function* () {
+	const root = resolve(dir);
+	if (dryRun) return yield* json ? printJson({
+		dryRun: true,
+		action: "templates.pull",
+		dir: root
+	}) : Console.log(`[dry-run] Would write remote template SML to ${root}.`);
+	const client = yield* getClientProvider;
+	const listed = yield* listAllTemplates(client).pipe(Effect.mapError((error) => new SamvaCliError({ message: formatApiError("Could not list templates", error) })));
+	const withSource = listed.filter((item) => typeof item.source === "string" && item.source.length > 0);
+	const skipped = listed.filter((item) => typeof item.source !== "string" || item.source.length === 0);
+	yield* Effect.tryPromise({
+		try: () => Promise.all(withSource.map(async (item) => {
+			const target = join(root, `${item.slug}.samva`);
+			await mkdir(dirname(target), { recursive: true });
+			await writeFile(target, item.source, "utf8");
+		})),
+		catch: (cause) => new SamvaCliError({ message: `Could not write .samva files: ${String(cause)}` })
+	});
+	if (json) return yield* printJson({
+		action: "templates.pull",
+		dir: root,
+		written: withSource.map((item) => ({
+			slug: item.slug,
+			name: item.name,
+			file: `${item.slug}.samva`
+		})),
+		skipped: skipped.map((item) => ({
+			slug: item.slug,
+			name: item.name
+		}))
+	});
+	yield* printFields([
+		["Target dir", root],
+		["Written", withSource.length],
+		["Skipped (no SML source)", skipped.length]
+	]);
+	for (const item of withSource) yield* Effect.logInfo(`✓ ${item.slug}.samva`);
+	for (const item of skipped) yield* Effect.logWarning(`⤫ ${item.slug} — no SML source, skipped`);
+}).pipe(json ? Effect.provideService(References.MinimumLogLevel, "None") : identity)));
+const STARTER_WELCOME = `import { A, Button, Container, Email, Heading, Preview, Strong, Text } from "@samva/markup/components";
+import type { Variables } from "@samva/markup/variables";
+
+export default function WelcomeEmail(v: Variables<{ firstName: string; workspace: string; ctaUrl: string }>) {
+  return (
+    <Email class="bg-gray-100">
+      <Preview>Welcome aboard, {v.firstName}</Preview>
+      <Container class="max-w-[600px] rounded-lg bg-white px-8 py-6">
+        <Heading level={1} class="text-2xl font-bold text-gray-900">
+          Welcome, {v.firstName}
+        </Heading>
+        <Text class="text-base text-gray-700 dark:text-gray-200">
+          Thanks for joining <Strong>Samva</Strong>. Your workspace {v.workspace} is ready — open the{" "}
+          <A href="https://samva.dev/docs">docs</A> to begin.
+        </Text>
+        <Button href="{{ctaUrl}}" class="rounded-md bg-blue-600 px-6 py-3 font-semibold text-white dark:bg-blue-400">
+          Open dashboard
+        </Button>
+      </Container>
+    </Email>
+  );
+}
+`;
+const STARTER_VITE_CONFIG = `import { samvaEditor } from "@samva/vite";
+import { defineConfig } from "vite";
+
+// Run \`npm run samva:dev\` and open http://localhost:5173/ for the Samva editor.
+export default defineConfig({
+  plugins: [samvaEditor({ templatesDir: "emails" })],
+});
+`;
+const STARTER_TSCONFIG = `{
+  "compilerOptions": {
+    "target": "ES2022",
+    "module": "Preserve",
+    "moduleResolution": "Bundler",
+    "strict": true,
+    "skipLibCheck": true,
+    "noEmit": true,
+    "jsx": "react-jsx",
+    "jsxImportSource": "@samva/markup"
+  },
+  "include": ["emails", "samva.vite.config.ts"]
+}
+`;
+const AUTHORING_DEV_DEPENDENCIES = {
+	"@samva/markup": `^${MarkupPackageJson.version}`,
+	"@samva/vite": `^${VitePackageJson.version}`,
+	vite: "^8.0.0"
+};
+const AUTHORING_SCRIPTS = {
+	"samva:dev": "vite --config samva.vite.config.ts",
+	"samva:push": "samva templates push --dir emails"
+};
+const STARTER_PACKAGE_JSON = `${JSON.stringify({
+	private: true,
+	type: "module",
+	scripts: {
+		dev: "npm run samva:dev",
+		push: "npm run samva:push",
+		...AUTHORING_SCRIPTS
+	},
+	devDependencies: AUTHORING_DEV_DEPENDENCIES
+}, null, 2)}\n`;
+const reconcilePackageJson = async (target) => {
+	const raw = await readFile(target, "utf8").catch((error) => error.code === "ENOENT" ? void 0 : Promise.reject(error));
+	if (raw === void 0) {
+		await writeFile(target, STARTER_PACKAGE_JSON, { flag: "wx" });
+		return {
+			path: "package.json",
+			status: "created"
+		};
+	}
+	const manifest = JSON.parse(raw);
+	if (!Predicate.isObject(manifest) || Array.isArray(manifest)) return Promise.reject(new SamvaCliError({ message: "package.json must contain an object." }));
+	const dependencies = manifest.dependencies;
+	if (dependencies !== void 0 && (!Predicate.isObject(dependencies) || Array.isArray(dependencies))) return Promise.reject(new SamvaCliError({ message: "package.json dependencies must contain an object." }));
+	const devDependencies = manifest.devDependencies;
+	if (devDependencies !== void 0 && (!Predicate.isObject(devDependencies) || Array.isArray(devDependencies))) return Promise.reject(new SamvaCliError({ message: "package.json devDependencies must contain an object." }));
+	const scripts = manifest.scripts;
+	if (scripts !== void 0 && (!Predicate.isObject(scripts) || Array.isArray(scripts))) return Promise.reject(new SamvaCliError({ message: "package.json scripts must contain an object." }));
+	const nextDevDependencies = { ...devDependencies };
+	for (const [name, version] of Object.entries(AUTHORING_DEV_DEPENDENCIES)) {
+		if (Object.hasOwn(dependencies ?? {}, name) || Object.hasOwn(nextDevDependencies, name)) continue;
+		nextDevDependencies[name] = version;
+	}
+	const nextScripts = { ...scripts };
+	for (const [name, command] of Object.entries(AUTHORING_SCRIPTS)) if (!Object.hasOwn(nextScripts, name)) nextScripts[name] = command;
+	if (Object.keys(nextDevDependencies).length === Object.keys(devDependencies ?? {}).length && Object.keys(nextScripts).length === Object.keys(scripts ?? {}).length) return {
+		path: "package.json",
+		status: "unchanged"
+	};
+	await writeFile(target, `${JSON.stringify({
+		...manifest,
+		scripts: nextScripts,
+		devDependencies: nextDevDependencies
+	}, null, 2)}\n`);
+	return {
+		path: "package.json",
+		status: "updated"
+	};
+};
+const init = Command.make("init", {
+	dir: Flag.directory("dir").pipe(Flag.withDescription("Project directory to scaffold into"), Flag.withDefault(".")),
+	dryRun: dryRunFlag,
+	json: jsonFlag
+}).pipe(Command.withDescription("Scaffold a Samva email templates project (vite.config, tsconfig, example)"), Command.withExamples([{
+	command: "samva templates init",
+	description: "Scaffold into the current directory"
+}, {
+	command: "samva templates init --dir my-emails",
+	description: "Scaffold into ./my-emails"
+}]), Command.withHandler(({ dir, dryRun, json }) => Effect.gen(function* () {
+	const root = resolve(dir);
+	const files = [
+		["samva.vite.config.ts", STARTER_VITE_CONFIG],
+		["tsconfig.json", STARTER_TSCONFIG],
+		["emails/welcome.tsx", STARTER_WELCOME]
+	];
+	const paths = ["package.json", ...files.map(([path]) => path)];
+	if (dryRun) return yield* json ? printJson({
+		dryRun: true,
+		action: "templates.init",
+		dir: root,
+		files: paths
+	}) : Console.log(`[dry-run] Would scaffold Samva email templates in ${root}.`);
+	const results = yield* Effect.tryPromise({
+		try: async () => {
+			await mkdir(root, { recursive: true });
+			return Promise.all([reconcilePackageJson(join(root, "package.json")), ...files.map(async ([relPath, contents]) => {
+				const target = join(root, relPath);
+				await mkdir(dirname(target), { recursive: true });
+				return writeFile(target, contents, { flag: "wx" }).then(() => ({
+					path: relPath,
+					status: "created"
+				})).catch((error) => error.code === "EEXIST" ? {
+					path: relPath,
+					status: "unchanged"
+				} : Promise.reject(error));
+			})]);
+		},
+		catch: (cause) => new SamvaCliError({ message: `Could not scaffold project: ${String(cause)}` })
+	});
+	if (json) return yield* printJson({
+		action: "templates.init",
+		dir: root,
+		files: paths,
+		created: results.filter(({ status }) => status === "created").map(({ path }) => path),
+		updated: results.filter(({ status }) => status === "updated").map(({ path }) => path),
+		unchanged: results.filter(({ status }) => status === "unchanged").map(({ path }) => path)
+	});
+	yield* Effect.logInfo(`Initialized Samva email templates in ${root}:\n`);
+	yield* printFields(results.map(({ path, status }) => [path, status]));
+	yield* Effect.logInfo("\nNext:\n  npm install\n  npm run samva:dev   # preview at http://localhost:5173");
+}).pipe(json ? Effect.provideService(References.MinimumLogLevel, "None") : identity)));
+const listRemote = Command.make("list", {
+	page: Flag.integer("page").pipe(Flag.withDescription("Page number"), Flag.optional),
+	limit: Flag.integer("limit").pipe(Flag.withDescription("Items per page"), Flag.optional),
+	all: Flag.boolean("all").pipe(Flag.withDescription("Traverse every page (requires --jsonl)"), Flag.withDefault(false)),
+	json: jsonFlag
+}).pipe(Command.withDescription("List remote templates"), Command.withExamples([{ command: "samva templates list --json" }]), Command.withHandler(({ page, limit, all, json }) => Effect.gen(function* () {
+	if (all && !isJsonLinesRequested()) return yield* new CliUsageError({
+		code: "all_requires_jsonl",
+		message: "--all is an unbounded traversal and requires --jsonl."
+	});
+	const client = yield* getClientProvider;
+	const pageValue = Option.getOrUndefined(page);
+	const limitValue = Option.getOrUndefined(limit);
+	const query = {
+		page: pageValue?.toString(),
+		limit: limitValue?.toString()
+	};
+	if (all) {
+		let nextPage = pageValue ?? 1;
+		for (;;) {
+			const data = yield* Templates.list({
+				...query,
+				page: nextPage.toString()
+			}).pipe(client.provide, Effect.mapError((error) => new SamvaCliError({ message: formatApiError("Could not list templates", error) })));
+			for (const item of data.items) yield* printJsonLine(item);
+			if (nextPage >= data.pagination.totalPages || data.items.length === 0) return;
+			nextPage += 1;
+		}
+	}
+	const data = yield* Templates.list(query).pipe(client.provide, Effect.mapError((error) => new SamvaCliError({ message: formatApiError("Could not list templates", error) })));
+	if (isJsonLinesRequested()) {
+		for (const item of data.items) yield* printJsonLine(item);
+		return;
+	}
+	if (json) return yield* printJson(data);
+	for (const item of data.items) yield* printFields([
+		["ID", item.id],
+		["Name", item.name],
+		["Slug", item.slug],
+		["Status", item.status]
+	]);
+	yield* printFields([["Page", data.pagination.page], ["Total", data.pagination.total]]);
+}).pipe(json ? Effect.provideService(References.MinimumLogLevel, "None") : identity)));
+const getRemote = Command.make("get", {
+	id: templateIdArgument,
+	json: jsonFlag
+}).pipe(Command.withDescription("Get a remote template"), Command.withExamples([{ command: "samva templates get tmpl_abc123 --json" }]), Command.withHandler(({ id, json }) => Effect.gen(function* () {
+	const client = yield* getClientProvider;
+	const data = yield* Templates.getById({ id }).pipe(client.provide, Effect.mapError((error) => new SamvaCliError({ message: formatApiError("Could not get template", error) })));
+	if (json) return yield* printJson(data);
+	yield* printJson(data);
+}).pipe(json ? Effect.provideService(References.MinimumLogLevel, "None") : identity)));
+const createRemote = Command.make("create", {
+	data: Flag.string("data").pipe(Flag.withDescription("Complete template JSON payload")),
+	dryRun: dryRunFlag,
+	json: jsonFlag
+}).pipe(Command.withDescription("Create a remote template from JSON"), Command.withExamples([{ command: `samva templates create --data '{"name":"Welcome","slug":"welcome","subject":"Welcome","source":"<Email />"}' --dry-run` }]), Command.withHandler(({ data, dryRun, json }) => Effect.gen(function* () {
+	const payload = yield* decodePayload$1(data, "--data", Templates.CreatePayload);
+	if (dryRun) return yield* json ? printJson({
+		dryRun: true,
+		action: "templates.create",
+		request: payload
+	}) : printJson(payload);
+	const client = yield* getClientProvider;
+	const result = yield* Templates.create(payload).pipe(client.provide, Effect.mapError((error) => new SamvaCliError({ message: formatApiError("Could not create template", error) })));
+	if (json) return yield* printJson(result);
+	yield* printJson(result);
+}).pipe(json ? Effect.provideService(References.MinimumLogLevel, "None") : identity)));
+const updateRemote = Command.make("update", {
+	id: templateIdArgument,
+	data: Flag.string("data").pipe(Flag.withDescription("JSON object of template fields to update")),
+	dryRun: dryRunFlag,
+	json: jsonFlag
+}).pipe(Command.withDescription("Update a remote template from JSON"), Command.withExamples([{ command: `samva templates update tmpl_abc123 --data '{"subject":"Welcome back"}' --dry-run` }]), Command.withHandler(({ id, data, dryRun, json }) => Effect.gen(function* () {
+	const changes = yield* parseObject$1(data, "--data");
+	const payload = yield* decodePayload$1(JSON.stringify({ data: changes }), "--data", Templates.UpdatePayload);
+	if (dryRun) return yield* json ? printJson({
+		dryRun: true,
+		action: "templates.update",
+		id,
+		request: payload
+	}) : printJson(payload);
+	const client = yield* getClientProvider;
+	const result = yield* Templates.update({
+		id,
+		...payload
+	}).pipe(client.provide, Effect.mapError((error) => new SamvaCliError({ message: formatApiError("Could not update template", error) })));
+	if (json) return yield* printJson(result);
+	yield* printJson(result);
+}).pipe(json ? Effect.provideService(References.MinimumLogLevel, "None") : identity)));
+const lifecycleMutation = (name) => Command.make(name, {
+	id: templateIdArgument,
+	dryRun: dryRunFlag,
+	yes: Flag.boolean("yes").pipe(Flag.withDescription("Confirm destructive state change"), Flag.withDefault(false)),
+	json: jsonFlag
+}).pipe(Command.withDescription(name === "publish" ? "Publish a remote template" : name === "unpublish" ? "Unpublish a remote template" : "Permanently delete a remote template"), Command.withExamples([{ command: `samva templates ${name} tmpl_abc123 --dry-run` }]), Command.withHandler(({ id, dryRun, yes, json }) => Effect.gen(function* () {
+	if (dryRun) return yield* json ? printJson({
+		dryRun: true,
+		action: `templates.${name}`,
+		id
+	}) : Console.log(`[dry-run] Would ${name} template ${id}.`);
+	if (name !== "publish") yield* confirmDestructive({
+		yes,
+		json,
+		message: `${name === "remove" ? "Permanently remove" : "Unpublish"} template ${id}?`,
+		nonInteractiveMessage: `${name} requires --yes in non-interactive mode. Preview with --dry-run.`
+	});
+	const client = yield* getClientProvider;
+	let result;
+	if (name === "publish") result = yield* Templates.publish({ id }).pipe(client.provide, Effect.mapError((error) => new SamvaCliError({ message: formatApiError("Could not publish template", error) })));
+	else if (name === "unpublish") result = yield* Templates.unpublish({ id }).pipe(client.provide, Effect.mapError((error) => new SamvaCliError({ message: formatApiError("Could not unpublish template", error) })));
+	else result = yield* Templates.remove({ id }).pipe(client.provide, Effect.mapError((error) => new SamvaCliError({ message: formatApiError("Could not remove template", error) })));
+	if (json) return yield* printJson(result);
+	yield* printJson(result);
+}).pipe(json ? Effect.provideService(References.MinimumLogLevel, "None") : identity)));
+const versionsList = Command.make("list", {
+	id: templateIdArgument,
+	json: jsonFlag
+}).pipe(Command.withDescription("List remote template version history"), Command.withExamples([{ command: "samva templates versions list tmpl_abc123 --json" }]), Command.withHandler(({ id, json }) => Effect.gen(function* () {
+	const client = yield* getClientProvider;
+	const result = yield* Templates.versionHistory({ id }).pipe(client.provide, Effect.mapError((error) => new SamvaCliError({ message: formatApiError("Could not list template versions", error) })));
+	if (json) return yield* printJson(result);
+	yield* printJson(result);
+}).pipe(json ? Effect.provideService(References.MinimumLogLevel, "None") : identity)));
+const restore = Command.make("restore", {
+	id: templateIdArgument,
+	versionId: Argument.string("version-id").pipe(Argument.withDescription("Version id to restore")),
+	dryRun: dryRunFlag,
+	yes: Flag.boolean("yes").pipe(Flag.withDefault(false)),
+	json: jsonFlag
+}).pipe(Command.withDescription("Restore a previous remote template version"), Command.withExamples([{ command: "samva templates versions restore tmpl_abc123 tv_abc123 --dry-run" }]), Command.withHandler(({ id, versionId, dryRun, yes, json }) => Effect.gen(function* () {
+	if (dryRun) return yield* json ? printJson({
+		dryRun: true,
+		action: "templates.restore",
+		id,
+		versionId
+	}) : Console.log(`[dry-run] Would restore ${id} to ${versionId}.`);
+	yield* confirmDestructive({
+		yes,
+		json,
+		message: `Restore template ${id} to version ${versionId}?`,
+		nonInteractiveMessage: "Template restore requires --yes in non-interactive mode. Preview with --dry-run."
+	});
+	const client = yield* getClientProvider;
+	const result = yield* Templates.restoreVersion({
+		id,
+		versionId
+	}).pipe(client.provide, Effect.mapError((error) => new SamvaCliError({ message: formatApiError("Could not restore template", error) })));
+	if (json) return yield* printJson(result);
+	yield* printJson(result);
+}).pipe(json ? Effect.provideService(References.MinimumLogLevel, "None") : identity)));
+const versions = Command.make("versions").pipe(Command.withDescription("List and restore remote template versions"), Command.withExamples([{ command: "samva templates versions list tmpl_abc123 --json" }]), Command.withSubcommands([versionsList, restore]));
+const templatesCommand = Command.make("templates").pipe(Command.withDescription("Author, preview, and push email templates from local TSX"), Command.withExamples([{
+	command: "samva templates init",
+	description: "Scaffold a new templates project"
+}, {
+	command: "samva templates push --dir emails --dry-run",
+	description: "Emit SML and preview the push plan"
+}]), Command.withSubcommands([
+	listRemote,
+	getRemote,
+	createRemote,
+	updateRemote,
+	lifecycleMutation("publish"),
+	lifecycleMutation("unpublish"),
+	lifecycleMutation("remove"),
+	versions,
+	push,
+	pull,
+	init
+]));
+//#endregion
+//#region src/commands/webhooks.ts
+const idArgument = Argument.string("id").pipe(Argument.withDescription("Webhook id"));
+const parseObject = (raw, flag) => Effect.try({
+	try: () => JSON.parse(raw),
+	catch: () => new SamvaCliError({ message: `${flag} must be a valid JSON object.` })
+}).pipe(Effect.flatMap((value) => Predicate.isObject(value) && !Array.isArray(value) ? Effect.succeed(value) : Effect.fail(new SamvaCliError({ message: `${flag} must be a non-null JSON object.` }))));
+const decodePayload = (raw, flag, schema) => parseObject(raw, flag).pipe(Effect.flatMap(Schema.decodeUnknownEffect(schema)), Effect.mapError((error) => error instanceof SamvaCliError ? error : new SamvaCliError({ message: `${flag} does not match the API schema: ${String(error)}` })));
+const readData = (raw) => {
+	if (!raw.startsWith("@")) return Effect.succeed(raw);
+	const path = raw.slice(1);
+	if (path.length === 0) return Effect.fail(new CliUsageError({
+		code: "missing_data_file",
+		message: "--data @ requires a file path."
+	}));
+	return Effect.tryPromise({
+		try: () => readFile(path, "utf8"),
+		catch: () => new CliUsageError({
+			code: "data_file_unreadable",
+			message: `Could not read webhook test data from ${path}.`
+		})
+	});
+};
+const list = Command.make("list", {
+	page: Flag.integer("page").pipe(Flag.withDescription("Page number"), Flag.optional),
+	limit: Flag.integer("limit").pipe(Flag.withDescription("Items per page"), Flag.optional),
+	all: Flag.boolean("all").pipe(Flag.withDescription("Traverse every page (requires --jsonl)"), Flag.withDefault(false)),
+	json: jsonFlag
+}).pipe(Command.withDescription("List customer webhooks"), Command.withExamples([{ command: "samva webhooks list --json" }]), Command.withHandler(({ page, limit, all, json }) => Effect.gen(function* () {
+	if (all && !isJsonLinesRequested()) return yield* new CliUsageError({
+		code: "all_requires_jsonl",
+		message: "--all is an unbounded traversal and requires --jsonl."
+	});
+	const client = yield* getClientProvider;
+	const pageValue = Option.getOrUndefined(page);
+	const limitValue = Option.getOrUndefined(limit);
+	const query = {
+		page: pageValue?.toString(),
+		limit: limitValue?.toString()
+	};
+	if (all) {
+		let nextPage = pageValue ?? 1;
+		for (;;) {
+			const data = yield* Webhooks.list({
+				...query,
+				page: nextPage.toString()
+			}).pipe(client.provide, Effect.mapError((error) => new SamvaCliError({ message: formatApiError("Could not list webhooks", error) })));
+			for (const item of data.items) yield* printJsonLine(item);
+			if (nextPage >= data.pagination.totalPages || data.items.length === 0) return;
+			nextPage += 1;
+		}
+	}
+	const data = yield* Webhooks.list(query).pipe(client.provide, Effect.mapError((error) => new SamvaCliError({ message: formatApiError("Could not list webhooks", error) })));
+	if (isJsonLinesRequested()) {
+		for (const item of data.items) yield* printJsonLine(item);
+		return;
+	}
+	if (json) return yield* printJson(data);
+	if (data.items.length === 0) return yield* Console.log("No webhooks found.");
+	for (const hook of data.items) yield* printFields([
+		["ID", hook.id],
+		["Name", hook.name],
+		["Status", hook.status],
+		["URL", hook.url]
+	]);
+	yield* printFields([["Page", data.pagination.page], ["Total", data.pagination.total]]);
+}).pipe(json ? Effect.provideService(References.MinimumLogLevel, "None") : identity)));
+const get = Command.make("get", {
+	id: idArgument,
+	json: jsonFlag
+}).pipe(Command.withDescription("Get a customer webhook"), Command.withExamples([{ command: "samva webhooks get wh_abc123 --json" }]), Command.withHandler(({ id, json }) => Effect.gen(function* () {
+	const client = yield* getClientProvider;
+	const data = yield* Webhooks.get({ id }).pipe(client.provide, Effect.mapError((error) => new SamvaCliError({ message: formatApiError("Could not get webhook", error) })));
+	if (json) return yield* printJson(data);
+	yield* printFields([
+		["ID", data.id],
+		["Name", data.name],
+		["Status", data.status],
+		["URL", data.url]
+	]);
+}).pipe(json ? Effect.provideService(References.MinimumLogLevel, "None") : identity)));
+const logs = Command.make("logs", {
+	id: idArgument,
+	limit: Flag.integer("limit").pipe(Flag.optional),
+	json: jsonFlag
+}).pipe(Command.withDescription("List webhook delivery logs"), Command.withExamples([{ command: "samva webhooks logs wh_abc123 --limit 25 --json" }]), Command.withHandler(({ id, limit, json }) => Effect.gen(function* () {
+	const client = yield* getClientProvider;
+	const limitValue = Option.getOrUndefined(limit);
+	const data = yield* Webhooks.getLogs({
+		webhookId: id,
+		...limitValue === void 0 ? {} : { limit: limitValue.toString() }
+	}).pipe(client.provide, Effect.mapError((error) => new SamvaCliError({ message: formatApiError("Could not list webhook logs", error) })));
+	if (json) return yield* printJson(data);
+	yield* printJson(data.data);
+}).pipe(json ? Effect.provideService(References.MinimumLogLevel, "None") : identity)));
+const stats = Command.make("stats", {
+	id: idArgument,
+	json: jsonFlag
+}).pipe(Command.withDescription("Get webhook delivery statistics"), Command.withExamples([{ command: "samva webhooks stats wh_abc123 --json" }]), Command.withHandler(({ id, json }) => Effect.gen(function* () {
+	const client = yield* getClientProvider;
+	const data = yield* Webhooks.getStats({ webhookId: id }).pipe(client.provide, Effect.mapError((error) => new SamvaCliError({ message: formatApiError("Could not get webhook stats", error) })));
+	if (json) return yield* printJson(data);
+	yield* printJson(data);
+}).pipe(json ? Effect.provideService(References.MinimumLogLevel, "None") : identity)));
+const test = Command.make("test", {
+	id: idArgument,
+	data: Flag.string("data").pipe(Flag.withDescription("JSON object or @file to send as the signed test payload"), Flag.optional),
+	dryRun: Flag.boolean("dry-run").pipe(Flag.withDescription("Validate and preview without sending a request"), Flag.withDefault(false)),
+	json: jsonFlag
+}).pipe(Command.withDescription("Send a signed test request to a webhook endpoint"), Command.withExamples([
+	{ command: "samva webhooks test wep_abc123 --dry-run" },
+	{ command: `samva webhooks test wep_abc123 --data '{"event":"webhook.test"}' --json` },
+	{ command: "samva webhooks test wep_abc123 --data @payload.json --json" }
+]), Command.withHandler(({ id, data, dryRun, json }) => Effect.gen(function* () {
+	const raw = Option.getOrUndefined(data);
+	const payload = raw === void 0 ? yield* Schema.decodeUnknownEffect(Webhooks.TestPayload)({}) : yield* readData(raw).pipe(Effect.flatMap((content) => parseObject(content, "--data")), Effect.flatMap((value) => Schema.decodeUnknownEffect(Webhooks.TestPayload)({ data: value })), Effect.mapError((error) => error instanceof CliUsageError || error instanceof SamvaCliError ? error : new SamvaCliError({ message: `--data does not match the API schema: ${String(error)}` })));
+	if (dryRun) return yield* json ? printJson({
+		dryRun: true,
+		action: "webhooks.test",
+		id,
+		request: payload
+	}) : printFields([
+		["Action", "webhooks.test"],
+		["Webhook", id],
+		["Payload", payload.data ? JSON.stringify(payload.data) : "default"]
+	]);
+	const client = yield* getClientProvider;
+	const result = yield* Webhooks.test({
+		id,
+		...payload
+	}).pipe(client.provide, Effect.mapError((error) => new SamvaCliError({ message: formatApiError("Could not test webhook", error) })));
+	if (json) return yield* printJson(result);
+	yield* printFields([
+		["Status", "Queued"],
+		["Event", result.eventId],
+		["Delivery", result.deliveryId]
+	]);
+}).pipe(json ? Effect.provideService(References.MinimumLogLevel, "None") : identity)));
+const retry = Command.make("retry", {
+	id: idArgument,
+	deliveryId: Argument.string("delivery-id").pipe(Argument.withDescription("Webhook delivery id")),
+	dryRun: Flag.boolean("dry-run").pipe(Flag.withDefault(false)),
+	json: jsonFlag
+}).pipe(Command.withDescription("Retry a failed webhook delivery"), Command.withExamples([{ command: "samva webhooks retry wh_abc123 del_abc123 --dry-run" }]), Command.withHandler(({ id, deliveryId, dryRun, json }) => Effect.gen(function* () {
+	if (dryRun) return yield* json ? printJson({
+		dryRun: true,
+		action: "webhooks.retry",
+		id,
+		deliveryId
+	}) : Console.log(`[dry-run] Would retry delivery ${deliveryId} for webhook ${id}.`);
+	const client = yield* getClientProvider;
+	const data = yield* Webhooks.retryDelivery({
+		webhookId: id,
+		deliveryId
+	}).pipe(client.provide, Effect.mapError((error) => new SamvaCliError({ message: formatApiError("Could not retry webhook delivery", error) })));
+	if (json) return yield* printJson(data);
+	yield* printJson(data);
+}).pipe(json ? Effect.provideService(References.MinimumLogLevel, "None") : identity)));
+const rotate = Command.make("rotate-secret", {
+	id: idArgument,
+	dryRun: Flag.boolean("dry-run").pipe(Flag.withDefault(false)),
+	yes: Flag.boolean("yes").pipe(Flag.withDefault(false)),
+	json: jsonFlag
+}).pipe(Command.withDescription("Rotate a webhook signing secret"), Command.withExamples([{ command: "samva webhooks rotate-secret wh_abc123 --dry-run" }, { command: "samva webhooks rotate-secret wh_abc123 --yes --json" }]), Command.withHandler(({ id, dryRun, yes, json }) => Effect.gen(function* () {
+	if (dryRun) return yield* json ? printJson({
+		dryRun: true,
+		action: "webhooks.rotate-secret",
+		id
+	}) : Console.log(`[dry-run] Would rotate the signing secret for webhook ${id}.`);
+	yield* confirmDestructive({
+		yes,
+		json,
+		message: `Rotate the signing secret for webhook ${id}? The current secret will stop working.`,
+		nonInteractiveMessage: "Secret rotation requires --yes in non-interactive mode. Preview with --dry-run."
+	});
+	const client = yield* getClientProvider;
+	const data = yield* Webhooks.regenerateSecret({ webhookId: id }).pipe(client.provide, Effect.mapError((error) => new SamvaCliError({ message: formatApiError("Could not rotate webhook secret", error) })));
+	const warning = "This signing secret is shown once. Store it now; the previous secret remains valid for 24 hours.";
+	const secret = Redacted.value(data.secret);
+	if (json) return yield* printJson({
+		secret,
+		displayOnce: true,
+		warning
+	});
+	yield* Console.error(`WARNING: ${warning}`);
+	yield* Console.log(secret);
+}).pipe(json ? Effect.provideService(References.MinimumLogLevel, "None") : identity)));
+const create = Command.make("create", {
+	data: Flag.string("data").pipe(Flag.withDescription("Webhook JSON: name, url, events, and optional retry settings")),
+	dryRun: Flag.boolean("dry-run").pipe(Flag.withDefault(false)),
+	json: jsonFlag
+}).pipe(Command.withDescription("Create a customer webhook from JSON"), Command.withExamples([{ command: `samva webhooks create --data '{"name":"delivery","url":"https://example.com/hook","events":["message.delivered"]}' --dry-run` }]), Command.withHandler(({ data, dryRun, json }) => Effect.gen(function* () {
+	const payload = yield* decodePayload(data, "--data", Webhooks.CreatePayload);
+	if (dryRun) return yield* json ? printJson({
+		dryRun: true,
+		action: "webhooks.create",
+		request: payload
+	}) : printJson(payload);
+	const client = yield* getClientProvider;
+	const result = yield* Webhooks.create(payload).pipe(client.provide, Effect.mapError((error) => new SamvaCliError({ message: formatApiError("Could not create webhook", error) })));
+	if (json) return yield* printJson(result);
+	yield* printJson(result);
+}).pipe(json ? Effect.provideService(References.MinimumLogLevel, "None") : identity)));
+const update = Command.make("update", {
+	id: idArgument,
+	data: Flag.string("data").pipe(Flag.withDescription("JSON object of webhook fields to update")),
+	dryRun: Flag.boolean("dry-run").pipe(Flag.withDefault(false)),
+	json: jsonFlag
+}).pipe(Command.withDescription("Update a customer webhook from JSON"), Command.withExamples([{ command: `samva webhooks update wh_abc123 --data '{"url":"https://example.com/new"}' --dry-run` }]), Command.withHandler(({ id, data, dryRun, json }) => Effect.gen(function* () {
+	const payload = yield* decodePayload(data, "--data", Webhooks.UpdatePayload);
+	if (dryRun) return yield* json ? printJson({
+		dryRun: true,
+		action: "webhooks.update",
+		id,
+		request: payload
+	}) : printJson(payload);
+	const client = yield* getClientProvider;
+	const result = yield* Webhooks.update({
+		id,
+		...payload
+	}).pipe(client.provide, Effect.mapError((error) => new SamvaCliError({ message: formatApiError("Could not update webhook", error) })));
+	if (json) return yield* printJson(result);
+	yield* printJson(result);
+}).pipe(json ? Effect.provideService(References.MinimumLogLevel, "None") : identity)));
+const remove = Command.make("remove", {
+	id: idArgument,
+	dryRun: Flag.boolean("dry-run").pipe(Flag.withDefault(false)),
+	yes: Flag.boolean("yes").pipe(Flag.withDefault(false)),
+	json: jsonFlag
+}).pipe(Command.withDescription("Permanently delete a customer webhook"), Command.withExamples([{ command: "samva webhooks remove wh_abc123 --dry-run" }, { command: "samva webhooks remove wh_abc123 --yes" }]), Command.withHandler(({ id, dryRun, yes, json }) => Effect.gen(function* () {
+	if (dryRun) return yield* json ? printJson({
+		dryRun: true,
+		action: "webhooks.remove",
+		id
+	}) : Console.log(`[dry-run] Would permanently remove webhook ${id}.`);
+	yield* confirmDestructive({
+		yes,
+		json,
+		message: `Permanently remove webhook ${id}?`,
+		nonInteractiveMessage: "Permanent webhook deletion requires --yes in non-interactive mode. Preview with --dry-run."
+	});
+	const client = yield* getClientProvider;
+	const result = yield* Webhooks.remove({ id }).pipe(client.provide, Effect.mapError((error) => new SamvaCliError({ message: formatApiError("Could not remove webhook", error) })));
+	if (json) return yield* printJson(result);
+	yield* Console.log(`Removed webhook ${id}.`);
+}).pipe(json ? Effect.provideService(References.MinimumLogLevel, "None") : identity)));
+const webhooksCommand = Command.make("webhooks").pipe(Command.withDescription("Inspect, test, and recover customer webhooks"), Command.withExamples([{ command: "samva webhooks list --json" }]), Command.withSubcommands([
+	list,
+	get,
+	create,
+	update,
+	test,
+	logs,
+	stats,
+	retry,
+	rotate,
+	remove
+]));
+//#endregion
+//#region src/lib/help-manifest.ts
+const helpManifest = {
+	schemaVersion: 1,
+	name: "samva",
+	commands: [
+		"login",
+		"logout",
+		"org",
+		"email",
+		"messages",
+		"campaigns",
+		"scheduled-messages",
+		"templates",
+		"webhooks",
+		"profile",
+		"help"
+	],
+	globalOptions: [
+		"--json",
+		"--jsonl",
+		"--quiet",
+		"--profile",
+		"--api-url",
+		"--org",
+		"--no-input",
+		"--completions"
+	]
+};
+//#endregion
+//#region src/cli.ts
+const rootCommands = [
+	loginCommand,
+	logoutCommand,
+	orgCommand,
+	emailCommand,
+	messagesCommand,
+	campaignsCommand,
+	scheduledMessagesCommand,
+	templatesCommand,
+	webhooksCommand,
+	profileCommand
+];
+const helpCommand = Command.make("help").pipe(Command.withDescription("Describe released commands and global options"), Command.withHandler(Effect.fnUntraced(function* () {
+	if ((yield* Json) || (yield* JsonLines)) return yield* printJson(helpManifest);
+	if (yield* Quiet) return;
+	yield* Console.log("Run `samva <command> --help` for command-specific usage, or `samva --completions <bash|zsh|fish|sh>` for shell completions.");
+})));
+/** Root `samva` command. Subcommands are thin wrappers over the `samva` SDK. */
+const cli = Command.make("samva").pipe(Command.withDescription(`Samva — email and platform operations from your terminal. ${AGENT_AUTH_HINT}`), Command.withExamples([
+	{
+		command: "samva email send --to you@example.com --subject Hi --text Hello",
+		description: "Send email with SAMVA_API_KEY set"
+	},
+	{
+		command: "samva org current",
+		description: "Show active org (OAuth sessions; API keys are single-org)"
+	},
+	{
+		command: "samva --completions fish > ~/.config/fish/completions/samva.fish",
+		description: "Generate shell completions"
+	}
+]), Command.withSubcommands([...rootCommands, helpCommand]), Command.withGlobalFlags(globalFlags));
+//#endregion
+//#region src/bin.ts
+const argv = process.argv.slice(2);
+const outputMode = outputModeFromArgv(argv);
+const machineMode = outputMode === "json" || outputMode === "jsonl";
+const optionTerminator = argv.indexOf("--");
+const processArgs = optionTerminator === -1 ? argv : argv.slice(0, optionTerminator);
+const rootOptionsWithValue = /* @__PURE__ */ new Set([
+	"--profile",
+	"--api-url",
+	"--org",
+	"--log-level"
+]);
+const rootMachineHelp = (() => {
+	let requested = false;
+	for (let index = 0; index < processArgs.length; index++) {
+		const token = processArgs[index];
+		if (token === "--help" || token === "-h") {
+			requested = true;
+			continue;
+		}
+		if (rootOptionsWithValue.has(token)) {
+			index++;
+			continue;
+		}
+		if (token.startsWith("-")) continue;
+		return {
+			requested,
+			command: token
+		};
+	}
+	return {
+		requested,
+		command: void 0
+	};
+})();
+const isRootMachineHelp = machineMode && rootMachineHelp.requested && rootMachineHelp.command === void 0;
+const isUnknownRootMachineHelp = machineMode && rootMachineHelp.requested && rootMachineHelp.command !== void 0 && !isKnownRootCommand(rootMachineHelp.command);
+/** Status belongs on a TTY stderr; stdout is result data only. */
+const cliLogger = Logger.make(({ logLevel, message }) => {
+	const text = (Array.isArray(message) ? message : [message]).map(String).join(" ");
+	if (LogLevel.isGreaterThanOrEqualTo(logLevel, "Warn")) process.stderr.write(`${text}\n`);
+	else if (outputMode === "human" && process.stderr.isTTY) process.stderr.write(`${text}\n`);
+});
+const messageFor = (error) => {
+	if (error instanceof Error) return error.message;
+	if (Predicate.isObject(error) && Predicate.hasProperty(error, "message")) {
+		const message = error.message;
+		if (typeof message === "string") return message;
+	}
+	return "Samva CLI failed unexpectedly.";
+};
+/**
+* A bare root or parent command (no subcommand) fails as `ShowHelp` with no
+* parse errors. The framework already rendered its help into the stdout buffer,
+* so this failure is really a help request — not a diagnostic.
+*/
+const isBareHelp = (error) => error instanceof CliError.ShowHelp && error.errors.length === 0;
+/**
+* On a parse failure the framework renders a full-width `ERROR` block to stderr
+* via `Console.error`. We render our own single diagnostic (a `✗` line or the
+* JSON envelope), so blank the framework's error rendering here and drop the
+* resulting empty write inside the buffer. Help-doc rendering is untouched, so
+* `--help` and bare-command help are unaffected.
+*/
+const formatter = {
+	...CliOutput.defaultFormatter(),
+	formatError: () => "",
+	formatErrors: () => ""
+};
+const flushSuccessfulResults = (state, partial = false) => Effect.gen(function* () {
+	if (outputMode === "quiet" || outputMode === "jsonl") return;
+	if (outputMode === "human") {
+		yield* Effect.sync(() => state.lines.forEach((line) => state.originalLog(line)));
+		return;
+	}
+	const data = yield* Effect.try({
+		try: () => {
+			if (state.lines.length !== 1) return {
+				invalid: true,
+				count: state.lines.length
+			};
+			return {
+				invalid: false,
+				data: JSON.parse(state.lines[0])
+			};
+		},
+		catch: () => ({
+			invalid: true,
+			count: state.lines.length
+		})
+	});
+	if (data.invalid) {
+		process.exitCode = 1;
+		yield* printJsonError(void 0, "The command did not produce exactly one machine-readable result.");
+		return;
+	}
+	yield* Effect.sync(() => state.originalLog(JSON.stringify(resultEnvelope(commandNameFromArgv(argv), data.data, partial ? true : void 0), null, 2)));
+});
+const flushLifecycleResult = (state, error) => Effect.sync(() => {
+	state.lines.length = 0;
+	if (outputMode === "quiet") return;
+	if (outputMode === "human") {
+		state.originalLog(error.human);
+		return;
+	}
+	const result = resultEnvelope(commandNameFromArgv(argv), error.partialMessage, true);
+	state.originalLog(JSON.stringify(result, null, outputMode === "jsonl" ? void 0 : 2));
+});
+const flushFailedResult = (state, error) => Effect.sync(() => {
+	state.lines.length = 0;
+	if (outputMode === "quiet") return;
+	if (outputMode === "human") {
+		state.originalLog(error.human);
+		return;
+	}
+	const result = resultEnvelope(commandNameFromArgv(argv), error.result);
+	state.originalLog(JSON.stringify(result, null, outputMode === "jsonl" ? void 0 : 2));
+});
+const withStdoutBuffer = (program) => Effect.acquireUseRelease(Effect.sync(() => {
+	const originalLog = console.log;
+	const originalError = console.error;
+	const lines = [];
+	console.log = ((...values) => {
+		lines.push(values.map(String).join(" "));
+	});
+	console.error = ((...values) => {
+		if (values.map(String).join(" ").length === 0) return;
+		originalError(...values);
+	});
+	return {
+		originalLog,
+		originalError,
+		lines
+	};
+}), (state) => program.pipe(Effect.tap(() => flushSuccessfulResults(state)), Effect.tapError((error) => {
+	if (isBareHelp(error) && outputMode === "human") return Effect.sync(() => state.lines.forEach((line) => state.originalLog(line)));
+	if (error instanceof CliMessageLifecycleError) return flushLifecycleResult(state, error);
+	if (error instanceof CliResultError) return flushFailedResult(state, error);
+	return Effect.sync(() => {
+		state.lines.length = 0;
+	});
+})), (state) => Effect.sync(() => {
+	console.log = state.originalLog;
+	console.error = state.originalError;
+	state.lines.length = 0;
+}));
+const renderFailure = (error) => Effect.gen(function* () {
+	process.exitCode = processErrorCode(error);
+	if (isBareHelp(error)) {
+		if (machineMode) yield* printJsonError(error, messageFor(error));
+		return;
+	}
+	const message = error instanceof CliError.ShowHelp && error.errors.length > 0 ? `${error.errors[0]?.message ?? "Invalid command input."}\nTry: ${error.commandPath.join(" ")} --help` : messageFor(error);
+	if (!machineMode) {
+		yield* Console.error(`✗ ${message}`);
+		return;
+	}
+	yield* printJsonError(error, message);
+});
+const runMachineHelp = Effect.sync(() => {
+	const payload = resultEnvelope(commandNameFromArgv(argv), helpManifest);
+	process.stdout.write(`${JSON.stringify(payload, null, outputMode === "jsonl" ? void 0 : 2)}\n`);
+});
+const program = (isRootMachineHelp ? validateProcessArgs(argv).pipe(Effect.flatMap(() => runMachineHelp)) : isUnknownRootMachineHelp ? validateProcessArgs(argv).pipe(Effect.flatMap(() => new CliUsageError({
+	code: "unknown_subcommand",
+	message: `Unknown subcommand ${JSON.stringify(rootMachineHelp.command)} for samva.`
+}))) : withStdoutBuffer(validateProcessArgs(argv).pipe(Effect.flatMap(() => Command.run(cli, { version }))))).pipe(Effect.provide(Layer.mergeAll(Logger.layer([cliLogger]), BunServices.layer, CliOutput.layer(formatter))), Effect.matchEffect({
+	onFailure: renderFailure,
+	onSuccess: () => Effect.void
+}));
+BunRuntime.runMain(program, { disableErrorReporting: true });
+//#endregion
+export {};