@simplepush/cli 0.1.0

package/dist/main.mjs

@@ -0,0 +1,3417 @@
+#!/usr/bin/env node
+import { Args, Command, HelpDoc, Options, Prompt, ValidationError } from "@effect/cli";
+import { FetchHttpClient, FileSystem, HttpBody, HttpClient, HttpClientRequest, HttpClientResponse, Path, Terminal } from "@effect/platform";
+import { NodeContext, NodeRuntime, NodeSocketServer } from "@effect/platform-node";
+import { Cause, Chunk, Config, Data, Deferred, Duration, Effect, Exit, Fiber, HashSet, Layer, Option, ParseResult, PubSub, Redacted, Ref, Schedule, Schema, Stream, SubscriptionRef } from "effect";
+import { createHash, randomBytes } from "node:crypto";
+import _sodium from "libsodium-wrappers-sumo";
+import { wordlist } from "@scure/bip39/wordlists/english.js";
+import { homedir, tmpdir } from "node:os";
+import { createServer } from "node:http";
+import { spawn } from "node:child_process";
+import { mkdir } from "node:fs/promises";
+import { Client, OrgClient, TypeFilter, buildOrgNotificationRequest, buildOrgSubtaskRequest, buildOrgTaskRequest, isNotificationGroupResponse, isSubtaskGroupResponse, isTaskGroupResponse, prepareFileAttachments, tryDecryptEventData, uploadFileAttachments } from "@simplepush/sdk";
+import { connect, createConnection } from "node:net";
+import { basename, extname, join } from "node:path";
+//#region src/errors.ts
+/** No CLI session saved — `sp auth login` hasn't been run (or was logged out). */
+var NotLoggedIn = class extends Data.TaggedError("NotLoggedIn") {};
+/** A personal-credential command was invoked without --api-token / $SP_API_TOKEN. */
+var MissingApiToken = class extends Data.TaggedError("MissingApiToken") {};
+/** The backend answered non-2xx. `action` names the operation for the message. */
+var ApiFailure = class extends Data.TaggedError("ApiFailure") {};
+/** The request never produced an HTTP response (DNS, refused, TLS...). */
+var TransportFailure = class extends Data.TaggedError("TransportFailure") {};
+/** A promise-based SDK call or stream failed. */
+var SdkFailure = class extends Data.TaggedError("SdkFailure") {};
+/** A libsodium operation failed or was fed mis-sized material. */
+var CryptoFailure = class extends Data.TaggedError("CryptoFailure") {};
+/** Vault blob would not decrypt — wrong passphrase or corrupted blob. */
+var VaultUnlockFailed = class extends Data.TaggedError("VaultUnlockFailed") {};
+/** The org has no encryption config enabled. */
+var EncryptionDisabled = class extends Data.TaggedError("EncryptionDisabled") {};
+/** A user-facing validation / usage error with a ready-to-print message. */
+var UserError = class extends Data.TaggedError("UserError") {};
+/** The failure has already been reported on stderr — exit 1 silently. */
+var Aborted = class extends Data.TaggedError("Aborted") {};
+const causeMessage = (cause) => cause instanceof Error ? cause.message : String(cause);
+/** One error -> one stderr line (sans the `error: ` prefix added by the
+* renderer). `undefined` means "print nothing" — the error was already
+* reported (Aborted), or another layer printed it (@effect/cli usage text,
+* an interrupted prompt). */
+function renderError(e) {
+	if (e instanceof NotLoggedIn) return "not logged in. Run `sp auth login` first.";
+	if (e instanceof MissingApiToken) return "an API token is required: pass --api-token or set $SP_API_TOKEN";
+	if (e instanceof ApiFailure) return `${e.action} failed (${e.status}): ${e.detail}`;
+	if (e instanceof TransportFailure) return `${e.action} failed: ${causeMessage(e.cause)}`;
+	if (e instanceof SdkFailure) return `${e.action} failed: ${causeMessage(e.cause)}`;
+	if (e instanceof CryptoFailure) return e.message;
+	if (e instanceof VaultUnlockFailed) return "could not unlock the vault — passphrase is wrong, or the vault is corrupted.";
+	if (e instanceof EncryptionDisabled) return "encryption is not enabled for this org. Run `org encryption enable` first.";
+	if (e instanceof UserError) return e.message;
+	if (e instanceof Aborted) return void 0;
+	if (ValidationError.isValidationError(e)) return void 0;
+	if (e instanceof Terminal.QuitException) return void 0;
+	if (ParseResult.isParseError(e)) return ParseResult.TreeFormatter.formatErrorSync(e);
+	return causeMessage(e);
+}
+//#endregion
+//#region src/services/output.ts
+const isEpipe = (e) => e instanceof Error && e.code === "EPIPE";
+var CliOutput = class extends Effect.Service()("cli/CliOutput", { effect: Effect.gen(function* () {
+	const quietRef = yield* Ref.make(false);
+	const stderr = (line) => Effect.sync(() => {
+		try {
+			process.stderr.write(line + "\n");
+		} catch (e) {
+			if (!isEpipe(e)) throw e;
+		}
+	});
+	return {
+		setQuiet: (quiet) => Ref.set(quietRef, quiet),
+		info: (msg) => Effect.flatMap(Ref.get(quietRef), (quiet) => quiet ? Effect.void : stderr(`info: ${msg}`)),
+		warn: (msg) => stderr(`warn: ${msg}`),
+		error: (msg) => stderr(`error: ${msg}`),
+		/** One payload line on stdout, flushed immediately. EPIPE means the
+		* downstream reader is gone (`sp collect | head`, a dead pipeline
+		* neighbor): stop writing and exit quietly, like any pipeline citizen. */
+		print: (line) => Effect.sync(() => {
+			try {
+				process.stdout.write(line + "\n");
+			} catch (e) {
+				if (isEpipe(e)) process.exit(0);
+				throw e;
+			}
+		})
+	};
+}) }) {};
+//#endregion
+//#region src/crypto/params.ts
+const KdfParams = Schema.Struct({
+	algo: Schema.Literal("argon2id"),
+	t: Schema.Number,
+	m: Schema.Number,
+	p: Schema.Number
+});
+const DEFAULT_KDF_PARAMS = {
+	algo: "argon2id",
+	t: 3,
+	m: 64 * 1024 * 1024,
+	p: 1
+};
+const MasterKeySchema = Schema.Struct({
+	version: Schema.Number,
+	key: Schema.Uint8ArrayFromSelf
+});
+const VaultContents = Schema.Struct({
+	adminPublicKey: Schema.Uint8ArrayFromSelf,
+	adminPrivateKey: Schema.Uint8ArrayFromSelf,
+	masterKeyCurrent: MasterKeySchema,
+	masterKeyHistory: Schema.Array(MasterKeySchema)
+});
+const MasterKeyJson = Schema.Struct({
+	version: Schema.Number,
+	key: Schema.Uint8ArrayFromBase64
+});
+const VaultJson = Schema.Struct({
+	formatVersion: Schema.Literal(1),
+	adminPublicKey: Schema.Uint8ArrayFromBase64,
+	adminPrivateKey: Schema.Uint8ArrayFromBase64,
+	masterKeyCurrent: MasterKeyJson,
+	masterKeyHistory: Schema.Array(MasterKeyJson)
+});
+function normalizePassphrase(input) {
+	return input.trim().toLowerCase().split(/\s+/).join(" ");
+}
+function normalizeInviteCode(input) {
+	return input.trim().toUpperCase().replace(/[-\s]/g, "");
+}
+function hashInviteCode(plain) {
+	return createHash("sha256").update(normalizeInviteCode(plain), "utf8").digest("hex");
+}
+//#endregion
+//#region src/crypto/sodium.ts
+const WRAP_NONCE_BYTES = 24;
+const VAULT_NONCE_BYTES = 24;
+const InviteAlphabet = "ABCDEFGHJKMNPQRSTUVWXYZ23456789";
+const InviteGroupSize = 4;
+const InviteGroups = 2;
+const encodeVaultJson = Schema.encodeSync(VaultJson);
+const decodeVaultJson = Schema.decodeUnknownSync(Schema.parseJson(VaultJson));
+var Sodium = class extends Effect.Service()("cli/Sodium", { effect: Effect.gen(function* () {
+	const sodium = yield* Effect.promise(() => _sodium.ready.then(() => _sodium));
+	const fail = (message) => new CryptoFailure({ message });
+	const attempt = (message, f) => Effect.try({
+		try: f,
+		catch: (e) => fail(e instanceof CryptoFailure ? e.message : message)
+	});
+	const toB64 = (bytes) => sodium.to_base64(bytes, sodium.base64_variants.ORIGINAL);
+	const fromB64 = (s) => sodium.from_base64(s, sodium.base64_variants.ORIGINAL);
+	return {
+		toB64,
+		fromB64,
+		randomBytes: (length) => Effect.sync(() => sodium.randombytes_buf(length)),
+		generateVaultSalt: Effect.sync(() => sodium.randombytes_buf(sodium.crypto_pwhash_SALTBYTES)),
+		generateMasterKey: Effect.sync(() => sodium.randombytes_buf(sodium.crypto_aead_xchacha20poly1305_ietf_KEYBYTES)),
+		generateAdminKeyPair: Effect.sync(() => {
+			const kp = sodium.crypto_box_keypair();
+			return {
+				publicKey: kp.publicKey,
+				privateKey: kp.privateKey
+			};
+		}),
+		generatePassphrase: (wordCount = 8) => Effect.gen(function* () {
+			if (!Number.isInteger(wordCount) || wordCount < 1) return yield* fail(`wordCount must be a positive integer (got ${wordCount})`);
+			if (wordlist.length !== 2048) return yield* fail(`unexpected wordlist length: ${wordlist.length}`);
+			const words = [];
+			for (let i = 0; i < wordCount; i++) words.push(wordlist[sodium.randombytes_uniform(wordlist.length)]);
+			return words.join(" ");
+		}),
+		generateInviteCode: Effect.sync(() => {
+			const bytes = randomBytes(InviteGroupSize * InviteGroups);
+			const groups = [];
+			for (let g = 0; g < InviteGroups; g++) {
+				let group = "";
+				for (let i = 0; i < InviteGroupSize; i++) group += InviteAlphabet.charAt(bytes[g * InviteGroupSize + i] % 31);
+				groups.push(group);
+			}
+			return groups.join("-");
+		}),
+		deriveVaultKey: (passphrase, salt, params = DEFAULT_KDF_PARAMS) => Effect.gen(function* () {
+			if (params.algo !== "argon2id") return yield* fail(`unsupported KDF algorithm: ${params.algo}`);
+			if (salt.length !== sodium.crypto_pwhash_SALTBYTES) return yield* fail(`salt must be ${sodium.crypto_pwhash_SALTBYTES} bytes (got ${salt.length})`);
+			return yield* attempt("key derivation failed", () => sodium.crypto_pwhash(32, passphrase, salt, params.t, params.m, sodium.crypto_pwhash_ALG_ARGON2ID13));
+		}),
+		encryptVault: (contents, vaultKey) => Effect.gen(function* () {
+			if (vaultKey.length !== sodium.crypto_aead_xchacha20poly1305_ietf_KEYBYTES) return yield* fail(`vaultKey must be ${sodium.crypto_aead_xchacha20poly1305_ietf_KEYBYTES} bytes`);
+			return yield* attempt("vault encryption failed", () => {
+				const json = encodeVaultJson({
+					formatVersion: 1,
+					...contents
+				});
+				const plaintext = new TextEncoder().encode(JSON.stringify(json));
+				const nonce = sodium.randombytes_buf(VAULT_NONCE_BYTES);
+				const ct = sodium.crypto_aead_xchacha20poly1305_ietf_encrypt(plaintext, null, null, nonce, vaultKey);
+				const out = new Uint8Array(nonce.length + ct.length);
+				out.set(nonce, 0);
+				out.set(ct, nonce.length);
+				return out;
+			});
+		}),
+		decryptVault: (blob, vaultKey) => Effect.gen(function* () {
+			if (vaultKey.length !== sodium.crypto_aead_xchacha20poly1305_ietf_KEYBYTES) return yield* fail(`vaultKey must be ${sodium.crypto_aead_xchacha20poly1305_ietf_KEYBYTES} bytes`);
+			if (blob.length < VAULT_NONCE_BYTES + sodium.crypto_aead_xchacha20poly1305_ietf_ABYTES) return yield* fail("vault blob is truncated");
+			return yield* attempt("vault decryption failed", () => {
+				const nonce = blob.slice(0, VAULT_NONCE_BYTES);
+				const ct = blob.slice(VAULT_NONCE_BYTES);
+				const plaintext = sodium.crypto_aead_xchacha20poly1305_ietf_decrypt(null, ct, null, nonce, vaultKey);
+				return decodeVaultJson(new TextDecoder().decode(plaintext));
+			});
+		}),
+		wrapMasterKey: (masterKey, adminPrivateKey, devicePublicKey) => Effect.gen(function* () {
+			if (adminPrivateKey.length !== sodium.crypto_box_SECRETKEYBYTES) return yield* fail(`adminPrivateKey must be ${sodium.crypto_box_SECRETKEYBYTES} bytes`);
+			if (devicePublicKey.length !== sodium.crypto_box_PUBLICKEYBYTES) return yield* fail(`devicePublicKey must be ${sodium.crypto_box_PUBLICKEYBYTES} bytes`);
+			return yield* attempt("master-key wrap failed", () => {
+				const nonce = sodium.randombytes_buf(WRAP_NONCE_BYTES);
+				const ct = sodium.crypto_box_easy(masterKey, nonce, devicePublicKey, adminPrivateKey);
+				const out = new Uint8Array(nonce.length + ct.length);
+				out.set(nonce, 0);
+				out.set(ct, nonce.length);
+				return out;
+			});
+		}),
+		unwrapMasterKey: (blob, devicePrivateKey, adminPublicKey) => Effect.gen(function* () {
+			if (devicePrivateKey.length !== sodium.crypto_box_SECRETKEYBYTES) return yield* fail(`devicePrivateKey must be ${sodium.crypto_box_SECRETKEYBYTES} bytes`);
+			if (adminPublicKey.length !== sodium.crypto_box_PUBLICKEYBYTES) return yield* fail(`adminPublicKey must be ${sodium.crypto_box_PUBLICKEYBYTES} bytes`);
+			if (blob.length < WRAP_NONCE_BYTES + sodium.crypto_box_MACBYTES) return yield* fail("wrapped blob is truncated");
+			return yield* attempt("master-key unwrap failed", () => sodium.crypto_box_open_easy(blob.slice(WRAP_NONCE_BYTES), blob.slice(0, WRAP_NONCE_BYTES), adminPublicKey, devicePrivateKey));
+		}),
+		hmacInviteBinding: (inviteCode, devicePublicKey) => {
+			const state = sodium.crypto_auth_hmacsha256_init(normalizeInviteCode(inviteCode));
+			sodium.crypto_auth_hmacsha256_update(state, devicePublicKey);
+			return sodium.crypto_auth_hmacsha256_final(state);
+		},
+		constantTimeEqual: (a, b) => a.length === b.length && sodium.memcmp(a, b)
+	};
+}) }) {};
+//#endregion
+//#region src/services/stores.ts
+function configDir() {
+	if (process.platform === "win32") return `${process.env.APPDATA ?? `${homedir()}/AppData/Roaming`}/simplepush`;
+	const xdg = process.env.XDG_CONFIG_HOME;
+	return xdg ? `${xdg}/simplepush` : `${homedir()}/.config/simplepush`;
+}
+const isNotFound = (e) => e._tag === "SystemError" && e.reason === "NotFound";
+/** One Schema-validated JSON file with 0600 perms. `load` distinguishes
+* "absent" (Option.none) from real IO/decode failures. */
+const jsonFile = (fileName, schema) => Effect.gen(function* () {
+	const fs = yield* FileSystem.FileSystem;
+	const path = yield* Path.Path;
+	const decode = Schema.decodeUnknown(Schema.parseJson(schema));
+	const encode = Schema.encode(schema);
+	const filePath = path.join(configDir(), fileName);
+	const load = fs.readFileString(filePath).pipe(Effect.flatMap(decode), Effect.map(Option.some), Effect.catchIf(isNotFound, () => Effect.succeed(Option.none())));
+	const save = (value) => Effect.gen(function* () {
+		yield* fs.makeDirectory(configDir(), { recursive: true }).pipe(Effect.ignore);
+		yield* fs.chmod(configDir(), 448).pipe(Effect.ignore);
+		const encoded = yield* encode(value);
+		yield* fs.writeFileString(filePath, JSON.stringify(encoded, null, 2));
+		if (process.platform !== "win32") yield* fs.chmod(filePath, 384);
+		return filePath;
+	});
+	return {
+		filePath,
+		load,
+		save,
+		clear: fs.remove(filePath).pipe(Effect.as(true), Effect.catchIf(isNotFound, () => Effect.succeed(false)))
+	};
+});
+const StoredAuth = Schema.Struct({
+	baseUrl: Schema.String,
+	token: Schema.Redacted(Schema.String),
+	loggedInAt: Schema.String
+});
+const bearerToken = (auth) => Redacted.value(auth.token);
+var AuthStore = class extends Effect.Service()("cli/AuthStore", { effect: jsonFile("auth.json", StoredAuth) }) {};
+const StoredVault = Schema.Struct({
+	formatVersion: Schema.Literal(1),
+	adminPublicKeyB64: Schema.Uint8ArrayFromBase64,
+	adminPrivateKeyB64: Schema.Uint8ArrayFromBase64,
+	masterKeyCurrent: Schema.Struct({
+		version: Schema.Number,
+		keyB64: Schema.Uint8ArrayFromBase64
+	}),
+	masterKeyHistory: Schema.Array(Schema.Struct({
+		version: Schema.Number,
+		keyB64: Schema.Uint8ArrayFromBase64
+	}))
+});
+const VaultFromStored = Schema.transform(StoredVault, VaultContents, {
+	strict: true,
+	decode: (s) => ({
+		adminPublicKey: s.adminPublicKeyB64,
+		adminPrivateKey: s.adminPrivateKeyB64,
+		masterKeyCurrent: {
+			version: s.masterKeyCurrent.version,
+			key: s.masterKeyCurrent.keyB64
+		},
+		masterKeyHistory: s.masterKeyHistory.map((m) => ({
+			version: m.version,
+			key: m.keyB64
+		}))
+	}),
+	encode: (v) => ({
+		formatVersion: 1,
+		adminPublicKeyB64: v.adminPublicKey,
+		adminPrivateKeyB64: v.adminPrivateKey,
+		masterKeyCurrent: {
+			version: v.masterKeyCurrent.version,
+			keyB64: v.masterKeyCurrent.key
+		},
+		masterKeyHistory: v.masterKeyHistory.map((m) => ({
+			version: m.version,
+			keyB64: m.key
+		}))
+	})
+});
+var VaultStore = class extends Effect.Service()("cli/VaultStore", { effect: jsonFile("vault.json", VaultFromStored) }) {};
+const IssuedInvite = Schema.Struct({
+	code: Schema.String,
+	name: Schema.String,
+	role: Schema.Literal("member", "admin"),
+	issuedAt: Schema.String,
+	expiresAt: Schema.String
+});
+const InvitesFile = Schema.Struct({ invites: Schema.Array(IssuedInvite) });
+var InviteStore = class extends Effect.Service()("cli/InviteStore", { effect: Effect.gen(function* () {
+	const file = yield* jsonFile("invites.json", InvitesFile);
+	const loadAll = file.load.pipe(Effect.map(Option.match({
+		onNone: () => [],
+		onSome: (f) => f.invites
+	})), Effect.catchTag("ParseError", () => Effect.succeed([])));
+	return {
+		filePath: file.filePath,
+		clear: file.clear,
+		/** Drops any prior entry for the same plaintext code so re-issuance under
+		* the same code (shouldn't happen, but defensively) can't duplicate. */
+		append: (invite) => Effect.gen(function* () {
+			const existing = yield* loadAll;
+			yield* file.save({ invites: [...existing.filter((i) => i.code !== invite.code), invite] });
+		}),
+		/** Currently-valid invites only — past-expiration entries are pruned from
+		* disk as a side effect, shrinking the HMAC candidate set per device. */
+		listValid: Effect.gen(function* () {
+			const now = /* @__PURE__ */ new Date();
+			const all = yield* loadAll;
+			const fresh = all.filter((i) => new Date(i.expiresAt) > now);
+			if (fresh.length !== all.length) yield* file.save({ invites: fresh });
+			return fresh;
+		}),
+		/** Removes the given code (post-sync consumption). Idempotent. */
+		consume: (code) => Effect.gen(function* () {
+			const all = yield* loadAll;
+			const next = all.filter((i) => i.code !== code);
+			if (next.length === all.length) return false;
+			yield* file.save({ invites: next });
+			return true;
+		})
+	};
+}) }) {};
+//#endregion
+//#region src/services/api.ts
+const ErrorBody = Schema.Struct({
+	error: Schema.String,
+	msg: Schema.String
+});
+const decodeErrorBody = Schema.decodeUnknownOption(Schema.parseJson(ErrorBody));
+const trimSlash = (url) => url.replace(/\/+$/, "");
+var Api = class extends Effect.Service()("cli/Api", {
+	dependencies: [AuthStore.Default],
+	effect: Effect.gen(function* () {
+		const http = yield* HttpClient.HttpClient;
+		/** The saved CLI session, or NotLoggedIn. */
+		const session = (yield* AuthStore).load.pipe(Effect.orElseSucceed(() => Option.none()), Effect.flatMap(Option.match({
+			onNone: () => Effect.fail(new NotLoggedIn()),
+			onSome: Effect.succeed
+		})));
+		/** Extract the human-readable message from a failed response: the standard
+		* `{error, msg}` body when present, the raw body text otherwise. */
+		const failWith = (action, res) => res.text.pipe(Effect.orElseSucceed(() => ""), Effect.flatMap((body) => {
+			const parsed = decodeErrorBody(body);
+			const detail = Option.isSome(parsed) && parsed.value.msg ? parsed.value.msg : body || `HTTP ${res.status}`;
+			return Effect.fail(new ApiFailure({
+				action,
+				status: res.status,
+				detail
+			}));
+		}));
+		/** Authenticated request; resolves with the (scoped) response once the
+		* status is 2xx, fails with ApiFailure/TransportFailure otherwise. */
+		const request = (action, method, pathname, body) => Effect.gen(function* () {
+			const auth = yield* session;
+			const base = HttpClientRequest.make(method)(`${trimSlash(auth.baseUrl)}${pathname}`).pipe(HttpClientRequest.bearerToken(bearerToken(auth)));
+			const req = body === void 0 ? base : HttpClientRequest.setBody(base, HttpBody.unsafeJson(body));
+			const res = yield* http.execute(req).pipe(Effect.mapError((cause) => new TransportFailure({
+				action,
+				cause
+			})));
+			if (res.status >= 400) return yield* failWith(action, res);
+			return res;
+		});
+		/** Request + Schema-decode the JSON success body. */
+		const requestJson = (action, method, pathname, schema, body) => Effect.scoped(request(action, method, pathname, body).pipe(Effect.flatMap(HttpClientResponse.schemaBodyJson(schema))));
+		return {
+			session,
+			getJson: (action, pathname, schema) => requestJson(action, "GET", pathname, schema),
+			postJson: (action, pathname, schema, body) => requestJson(action, "POST", pathname, schema, body),
+			putJson: (action, pathname, schema, body) => requestJson(action, "PUT", pathname, schema, body),
+			/** Fire-and-forget variants for endpoints whose response body we ignore. */
+			post: (action, pathname, body) => Effect.scoped(Effect.asVoid(request(action, "POST", pathname, body))),
+			put: (action, pathname, body) => Effect.scoped(Effect.asVoid(request(action, "PUT", pathname, body))),
+			delete: (action, pathname) => Effect.scoped(Effect.asVoid(request(action, "DELETE", pathname))),
+			/** Unauthenticated POST against an explicit base URL (the `sp auth login`
+			* flows run before any session exists). Returns status + body text so
+			* callers can branch on OAuth-style error payloads. */
+			unauthedPost: (action, url, body) => Effect.scoped(Effect.gen(function* () {
+				const base = HttpClientRequest.post(url);
+				const req = body === void 0 ? base : HttpClientRequest.setBody(base, HttpBody.unsafeJson(body));
+				const res = yield* http.execute(req).pipe(Effect.mapError((cause) => new TransportFailure({
+					action,
+					cause
+				})));
+				const text = yield* res.text.pipe(Effect.orElseSucceed(() => ""));
+				return {
+					status: res.status,
+					body: text
+				};
+			}))
+		};
+	})
+}) {};
+//#endregion
+//#region src/services/vault-access.ts
+const OrgEncryptionConfig = Schema.Struct({
+	enabled: Schema.Boolean,
+	adminPubkeyB64: Schema.optional(Schema.NullOr(Schema.String)),
+	vaultBlobB64: Schema.optional(Schema.NullOr(Schema.String)),
+	vaultSaltB64: Schema.optional(Schema.NullOr(Schema.String)),
+	kdfParams: Schema.optional(Schema.NullOr(KdfParams))
+});
+async function readWholeStdin() {
+	const chunks = [];
+	for await (const chunk of process.stdin) chunks.push(chunk);
+	return Buffer.concat(chunks).toString("utf8").replace(/\r?\n$/, "");
+}
+var VaultAccess = class extends Effect.Service()("cli/VaultAccess", {
+	dependencies: [
+		Api.Default,
+		VaultStore.Default,
+		Sodium.Default,
+		CliOutput.Default
+	],
+	effect: Effect.gen(function* () {
+		const api = yield* Api;
+		const vaultStore = yield* VaultStore;
+		const sodium = yield* Sodium;
+		const out = yield* CliOutput;
+		/** Hidden-input passphrase prompt on a TTY; piped stdin passes through
+		* unchanged (trailing newline trimmed) for scripted flows. */
+		const readPassphrase = (message) => process.stdin.isTTY ? Prompt.run(Prompt.password({ message })).pipe(Effect.map(Redacted.value)) : Effect.promise(readWholeStdin);
+		const fetchConfig = api.getJson("fetch encryption config", "/v1/org/encryption", OrgEncryptionConfig);
+		/** Narrows a config to its enabled shape or fails EncryptionDisabled. */
+		const requireEnabled = (cfg) => !cfg.enabled || !cfg.vaultBlobB64 || !cfg.vaultSaltB64 || !cfg.kdfParams ? Effect.fail(new EncryptionDisabled()) : Effect.succeed({
+			vaultBlobB64: cfg.vaultBlobB64,
+			vaultSaltB64: cfg.vaultSaltB64,
+			kdfParams: cfg.kdfParams
+		});
+		/** Prompt → Argon2id → AEAD-open. Any decrypt failure collapses to
+		* VaultUnlockFailed (wrong passphrase and corrupt blob are
+		* indistinguishable by design of the AEAD). */
+		const unlock = (cfg, promptText) => Effect.gen(function* () {
+			const passphrase = yield* readPassphrase(promptText);
+			const derived = yield* sodium.deriveVaultKey(normalizePassphrase(passphrase), sodium.fromB64(cfg.vaultSaltB64), cfg.kdfParams).pipe(Effect.mapError(() => new VaultUnlockFailed()));
+			return {
+				vault: yield* sodium.decryptVault(sodium.fromB64(cfg.vaultBlobB64), derived).pipe(Effect.mapError(() => new VaultUnlockFailed())),
+				vaultKey: derived
+			};
+		});
+		/** True when the cached vault belongs to THIS org's current encryption
+		* config: the config is enabled and its admin pubkey matches the cache's.
+		* A cache left behind by a different login (or a re-enabled config) fails
+		* this and must not be used — sends encrypted under it would be
+		* undecryptable by every recipient device. */
+		const cacheMatches = (vault, cfg) => cfg.enabled && typeof cfg.adminPubkeyB64 === "string" && sodium.constantTimeEqual(vault.adminPublicKey, sodium.fromB64(cfg.adminPubkeyB64));
+		/** The decrypted vault: the local cache when it matches the org's current
+		* config, otherwise prompt, unlock, and cache for next time. The config is
+		* fetched even on the cache path — one GET per encrypted send buys the
+		* staleness check above (without it, a `vault.json` surviving a re-login
+		* would silently encrypt under the previous org's key). */
+		const getOrPrompt = Effect.gen(function* () {
+			const cached = yield* vaultStore.load;
+			const cfg = yield* fetchConfig;
+			if (cached._tag === "Some") {
+				if (cacheMatches(cached.value, cfg)) return cached.value;
+				yield* vaultStore.clear;
+				yield* out.warn("cached vault doesn't match this org's encryption config (stale login?) — cleared it");
+			}
+			const { vault } = yield* unlock(yield* requireEnabled(cfg), "Org encryption passphrase: ");
+			yield* vaultStore.save(vault);
+			return vault;
+		});
+		return {
+			readPassphrase,
+			fetchConfig,
+			requireEnabled,
+			getOrPrompt,
+			/** The auto-encrypt decision for org sends: the unlocked vault when the
+			* org has encryption (prompting inline on a fresh machine rather than
+			* silently going plaintext), `undefined` when encryption is disabled or
+			* the caller opted out with --no-encrypt. */
+			forSendOrPlaintext: (noEncrypt) => noEncrypt ? Effect.succeed(void 0) : getOrPrompt.pipe(Effect.map((vault) => vault), Effect.catchTag("EncryptionDisabled", () => Effect.succeed(void 0))),
+			/** Rotation needs `vault_key` itself (not just the decrypted contents) to
+			* re-encrypt the updated vault, and the cache deliberately doesn't store
+			* it — so this ALWAYS re-prompts, which is also defensible on its own
+			* merits for a privileged op. */
+			unlockForRotation: Effect.gen(function* () {
+				return yield* unlock(yield* fetchConfig.pipe(Effect.flatMap(requireEnabled)), "Org encryption passphrase (required for rotation): ");
+			})
+		};
+	})
+}) {};
+//#endregion
+//#region src/global-options.ts
+const DEFAULT_BASE_URL = "https://api.simplepu.sh";
+const toHelp = (e) => HelpDoc.p(e instanceof Error ? e.message : String(e));
+const topicOption = Options.text("topic").pipe(Options.withAlias("t"), Options.withDescription("Topic to send to (`task`) or filter on (`events`, repeatable). Omit on `task` for a self-send to your own devices."), Options.repeated);
+const apiTokenOption = Options.text("api-token").pipe(Options.withDescription("API token. Required for `events` and `get`; `collect` falls back to the logged-in org session when omitted. Defaults to $SP_API_TOKEN."), Options.withFallbackConfig(Config.string("SP_API_TOKEN")), Options.optional);
+/** Personal-credential commands need the token; fail typed when absent. */
+const requireApiToken = (token) => Option.match(token, {
+	onNone: () => Effect.fail(new MissingApiToken()),
+	onSome: Effect.succeed
+});
+function parsePasswordFlag(value) {
+	const at = value.lastIndexOf("@");
+	if (at === -1) return value;
+	const password = value.slice(0, at);
+	const topic = value.slice(at + 1);
+	if (!password || !topic) throw new Error(`invalid --password \`${value}\`: use \`password@topic\` for a topic password, or a bare password for the account default`);
+	return [password, topic];
+}
+const passwordOption = Options.text("password").pipe(Options.withAlias("p"), Options.withDescription("End-to-end encryption password. `password@topic` sets a topic's password (encrypts sends to it and decrypts its content); a bare `password` is your account default (decrypts your submissions). Repeatable."), Options.repeated, Options.mapTryCatch((values) => values.map(parsePasswordFlag), toHelp));
+/** True when the SDK will E2E-encrypt a send: a `password@topic` pair matching
+* the topic, or (for a note-to-self) a bare account-default password. */
+const willEncrypt = (passwords, topic) => topic !== void 0 ? passwords.some((p) => Array.isArray(p) && p[1] === topic) : passwords.some((p) => typeof p === "string");
+const baseUrlOption = Options.text("base-url").pipe(Options.withDescription(`API base URL. Defaults to $SP_BASE_URL or ${DEFAULT_BASE_URL}.`), Options.withFallbackConfig(Config.string("SP_BASE_URL")), Options.withDefault(DEFAULT_BASE_URL));
+const quietOption = Options.boolean("quiet").pipe(Options.withAlias("q"), Options.withDescription("Suppress informational output, only print payloads."));
+/** Shared helper for repeatable validated text options. */
+const mappedText = (name, parse) => Options.text(name).pipe(Options.mapTryCatch(parse, toHelp));
+//#endregion
+//#region src/format.ts
+function formatInstant(iso) {
+	const d = new Date(iso);
+	if (Number.isNaN(d.getTime())) return iso;
+	return d.toISOString().replace("T", " ").replace(/\..+/, " UTC");
+}
+function maskToken(t) {
+	if (t.length <= 8) return "*".repeat(t.length);
+	return `${t.slice(0, 4)}…${t.slice(-4)}`;
+}
+//#endregion
+//#region src/commands/auth.ts
+const LOGIN_TIMEOUT = Duration.minutes(5);
+const successPage = `<!DOCTYPE html>
+<html><head><meta charset="utf-8"><title>Logged in</title>
+<style>body{font-family:-apple-system,sans-serif;display:grid;place-items:center;min-height:100vh;margin:0;color:#1d1d1f;}
+@media (prefers-color-scheme:dark){body{background:#1c1c1e;color:#f5f5f7;}}</style></head>
+<body><div><h1 style="font-weight:600;">Logged in</h1><p>You can close this tab and return to your terminal.</p></div></body></html>`;
+const errorPage = (msg) => `<!DOCTYPE html>
+<html><head><meta charset="utf-8"><title>Error</title></head>
+<body style="font-family:-apple-system,sans-serif;padding:2rem;"><h1>Authentication failed</h1><p>${escapeHtml(msg)}</p></body></html>`;
+function escapeHtml(s) {
+	return s.replace(/[&<>"']/g, (c) => ({
+		"&": "&amp;",
+		"<": "&lt;",
+		">": "&gt;",
+		"\"": "&quot;",
+		"'": "&#39;"
+	})[c] ?? c);
+}
+const ExchangePayload = Schema.Struct({
+	token: Schema.String,
+	apiKey: Schema.optional(Schema.NullOr(Schema.String)),
+	apiKeyInfo: Schema.Struct({
+		prefix: Schema.String,
+		createdAt: Schema.String,
+		lastRotatedAt: Schema.optional(Schema.NullOr(Schema.String))
+	})
+});
+const DeviceStartResponse = Schema.Struct({
+	deviceCode: Schema.String,
+	userCode: Schema.String,
+	expiresIn: Schema.Number,
+	interval: Schema.Number
+});
+const DeviceTokenError = Schema.Struct({ error: Schema.optional(Schema.String) });
+const decodeJson = (schema) => Schema.decodeUnknown(Schema.parseJson(schema));
+/** One-shot loopback server: resolves the Deferred with the redirected
+* code+state. Scoped — releasing tears down the server AND its keep-alive
+* sockets (Connection: close + closeAllConnections; without both, the process
+* would hang on the browser's held-open socket). */
+const startCallbackServer = Effect.gen(function* () {
+	const callback = yield* Deferred.make();
+	const noKeepAlive = {
+		"Content-Type": "text/html; charset=utf-8",
+		Connection: "close"
+	};
+	const server = yield* Effect.acquireRelease(Effect.sync(() => createServer((req, res) => {
+		const path = req.url ?? "/";
+		if (!path.startsWith("/callback")) {
+			res.writeHead(404, { Connection: "close" }).end();
+			return;
+		}
+		const url = new URL(path, "http://localhost");
+		const code = url.searchParams.get("code");
+		const state = url.searchParams.get("state");
+		if (!code || !state) {
+			res.writeHead(400, noKeepAlive).end(errorPage("Missing code or state."));
+			Deferred.unsafeDone(callback, Exit.fail(new UserError({ message: "callback missing code or state" })));
+			return;
+		}
+		res.writeHead(200, noKeepAlive).end(successPage);
+		Deferred.unsafeDone(callback, Exit.succeed({
+			code,
+			state
+		}));
+	})), (server) => Effect.sync(() => {
+		server.closeAllConnections();
+		server.close();
+	}));
+	return {
+		port: yield* Effect.async((resume) => {
+			server.once("error", (e) => resume(Effect.fail(new UserError({ message: `callback server failed: ${e.message}` }))));
+			server.listen(0, "127.0.0.1", () => resume(Effect.succeed(server.address().port)));
+		}),
+		awaitCallback: Deferred.await(callback)
+	};
+});
+const openInBrowser = (url) => Effect.sync(() => {
+	const cmd = process.platform === "darwin" ? "open" : process.platform === "win32" ? "cmd" : "xdg-open";
+	const args = process.platform === "win32" ? [
+		"/c",
+		"start",
+		"",
+		url
+	] : [url];
+	try {
+		spawn(cmd, args, {
+			detached: true,
+			stdio: "ignore"
+		}).unref();
+	} catch {}
+});
+function preferDeviceFlow() {
+	if (process.env.SP_AUTH_DEVICE === "1") return true;
+	if (process.env.SSH_CONNECTION || process.env.SSH_TTY) return true;
+	if (process.platform === "linux" && !process.env.DISPLAY && !process.env.WAYLAND_DISPLAY) return true;
+	return false;
+}
+const finishLogin = (baseUrl, payload) => Effect.gen(function* () {
+	const out = yield* CliOutput;
+	const store = yield* AuthStore;
+	if (!payload.token) return yield* Effect.fail(new UserError({ message: "exchange returned empty token" }));
+	const path = yield* store.save({
+		baseUrl,
+		token: Redacted.make(payload.token),
+		loggedInAt: (/* @__PURE__ */ new Date()).toISOString()
+	});
+	yield* out.info(`saved credentials to ${path}`);
+	yield* out.print("Logged in.");
+	if (payload.apiKey) {
+		yield* out.print("\nOrganization API key (shown once, copy now):");
+		yield* out.print(`  ${payload.apiKey}`);
+	} else yield* out.print(`\nOrganization API key already provisioned (prefix ${payload.apiKeyInfo.prefix}…).\nRun \`simplepush org api-key rotate\` to surface a fresh one.`);
+});
+const runLocalhostFlow = (baseUrl) => Effect.scoped(Effect.gen(function* () {
+	const out = yield* CliOutput;
+	const api = yield* Api;
+	const state = randomBytes(16).toString("hex");
+	const { port, awaitCallback } = yield* startCallbackServer;
+	const redirectUri = `http://127.0.0.1:${port}/callback`;
+	const authUrl = `${baseUrl}/cli/auth/approve?redirect_uri=${encodeURIComponent(redirectUri)}&state=${encodeURIComponent(state)}`;
+	yield* out.info(`opening browser: ${authUrl}`);
+	yield* out.info("(if it didn't open, paste that URL into your browser)");
+	yield* openInBrowser(authUrl);
+	const callback = yield* awaitCallback.pipe(Effect.timeoutFail({
+		duration: LOGIN_TIMEOUT,
+		onTimeout: () => new UserError({ message: `login timed out after ${Duration.toSeconds(LOGIN_TIMEOUT)}s` })
+	}));
+	if (callback.state !== state) return yield* Effect.fail(new UserError({ message: "state mismatch — refusing to exchange (possible CSRF)" }));
+	yield* out.info("approved, exchanging code...");
+	const res = yield* api.unauthedPost("exchange", `${baseUrl}/cli/auth/exchange`, { code: callback.code });
+	if (res.status >= 400) return yield* Effect.fail(new UserError({ message: `exchange failed: ${res.status} ${res.body}` }));
+	yield* finishLogin(baseUrl, yield* decodeJson(ExchangePayload)(res.body));
+}));
+const runDeviceFlow = (baseUrl) => Effect.gen(function* () {
+	const out = yield* CliOutput;
+	const startRes = yield* (yield* Api).unauthedPost("device start", `${baseUrl}/cli/auth/device/start`);
+	if (startRes.status >= 400) return yield* Effect.fail(new UserError({ message: `device start failed: ${startRes.status} ${startRes.body}` }));
+	const start = yield* decodeJson(DeviceStartResponse)(startRes.body);
+	const verifyUrl = `${baseUrl}/cli/auth/device`;
+	const verifyUrlComplete = `${verifyUrl}?user_code=${encodeURIComponent(start.userCode)}`;
+	yield* out.print(`\nTo authorize this CLI, open:\n  ${verifyUrl}`);
+	yield* out.print(`and enter the code:\n  ${start.userCode}\n`);
+	if (!preferDeviceFlow()) yield* openInBrowser(verifyUrlComplete);
+	yield* out.info("waiting for approval... (Ctrl-C to cancel)");
+	const poll = (intervalSeconds) => Effect.gen(function* () {
+		yield* Effect.sleep(Duration.seconds(intervalSeconds));
+		const res = yield* (yield* Api).unauthedPost("device token", `${baseUrl}/cli/auth/device/token`, { deviceCode: start.deviceCode }).pipe(Effect.mapError((e) => new UserError({ message: `device token exchange failed: ${String(e.cause)}` })));
+		if (res.status < 400) return yield* decodeJson(ExchangePayload)(res.body).pipe(Effect.mapError(() => new UserError({ message: "device token exchange returned an unreadable payload" })));
+		switch ((yield* decodeJson(DeviceTokenError)(res.body).pipe(Effect.orElseSucceed(() => ({ error: void 0 })))).error) {
+			case "authorization_pending": return yield* poll(intervalSeconds);
+			case "slow_down": return yield* poll(intervalSeconds + 5);
+			case "access_denied": return yield* Effect.fail(new UserError({ message: "authorization was denied" }));
+			case "expired_token": return yield* Effect.fail(new UserError({ message: "the code expired — run `sp auth login` again" }));
+			default: return yield* Effect.fail(new UserError({ message: `device token exchange failed: ${res.status}` }));
+		}
+	});
+	yield* finishLogin(baseUrl, yield* poll(start.interval > 0 ? start.interval : 5).pipe(Effect.timeoutFail({
+		duration: Duration.seconds(start.expiresIn),
+		onTimeout: () => new UserError({ message: "device authorization timed out" })
+	})));
+});
+const deviceFlagOption = Options.boolean("device").pipe(Options.withDescription("Use the device-code flow (for SSH / headless machines). Auto-selected when no local browser is detected."));
+const webFlagOption = Options.boolean("web").pipe(Options.withDescription("Use the localhost-callback browser flow (default on a desktop with a browser)."));
+const authLogin = Command.make("login", {
+	"base-url": baseUrlOption,
+	quiet: quietOption,
+	device: deviceFlagOption,
+	web: webFlagOption
+}, (args) => Effect.gen(function* () {
+	yield* (yield* CliOutput).setQuiet(args.quiet);
+	const baseUrl = args["base-url"].replace(/\/+$/, "");
+	yield* args.device || !args.web && preferDeviceFlow() ? runDeviceFlow(baseUrl) : runLocalhostFlow(baseUrl);
+}));
+const authLogout = Command.make("logout", { quiet: quietOption }, (args) => Effect.gen(function* () {
+	const out = yield* CliOutput;
+	yield* out.setQuiet(args.quiet);
+	const auth = yield* AuthStore;
+	const removed = yield* auth.clear;
+	yield* (yield* VaultStore).clear;
+	yield* (yield* InviteStore).clear;
+	yield* out.print(removed ? `Logged out (deleted ${auth.filePath}).` : `No saved credentials at ${auth.filePath}.`);
+}));
+const authStatus = Command.make("status", { quiet: quietOption }, (args) => Effect.gen(function* () {
+	const out = yield* CliOutput;
+	yield* out.setQuiet(args.quiet);
+	const store = yield* AuthStore;
+	const auth = yield* store.load;
+	if (Option.isNone(auth)) {
+		yield* out.print("Not logged in. Run `sp auth login` to authenticate.");
+		return yield* Effect.fail(new Aborted());
+	}
+	yield* out.print("Logged in.");
+	yield* out.print(`  base url:  ${auth.value.baseUrl}`);
+	yield* out.print(`  token:     ${maskToken(bearerToken(auth.value))}`);
+	yield* out.print(`  since:     ${auth.value.loggedInAt}`);
+	yield* out.print(`  file:      ${store.filePath}`);
+}));
+const authCommand = Command.make("auth").pipe(Command.withSubcommands([
+	authLogin,
+	authLogout,
+	authStatus
+]));
+//#endregion
+//#region src/services/sdk.ts
+/** A Client whose websocket/http resources are released with the scope. */
+const acquireClient = (config) => Effect.acquireRelease(Effect.sync(() => new Client(config)), (client) => Effect.promise(async () => client.close()).pipe(Effect.ignore));
+/** An OrgClient (Api-Key or CLI-session bearer) scoped like `acquireClient`. */
+const acquireOrgClient = (config) => Effect.acquireRelease(Effect.sync(() => new OrgClient(config)), (client) => Effect.promise(async () => client.close()).pipe(Effect.ignore));
+/** One promise-returning SDK call as a typed Effect. */
+const sdkCall = (action, f) => Effect.tryPromise({
+	try: f,
+	catch: (cause) => new SdkFailure({
+		action,
+		cause
+	})
+});
+/** An SDK async-iterable as a Stream.
+*
+* Termination MUST go through the AbortSignal, never a bare generator
+* `.return()`: the SDK's reconnect backoff only unblocks on signal-abort, so a
+* plain return() deadlocks against the backoff sleep. The iterator wrapper
+* below aborts FIRST (which breaks the sleep), then lets the generator's own
+* cleanup run. The controller is also aborted by the scope finalizer, covering
+* interruption (timeouts, races, Ctrl-C). */
+const sdkStream = (action, make) => Stream.unwrapScoped(Effect.map(Effect.acquireRelease(Effect.sync(() => new AbortController()), (controller) => Effect.sync(() => controller.abort())), (controller) => Stream.fromAsyncIterable(abortFirst(make(controller.signal), controller), (cause) => new SdkFailure({
+	action,
+	cause
+}))));
+function abortFirst(iterable, controller) {
+	return { [Symbol.asyncIterator]() {
+		const it = iterable[Symbol.asyncIterator]();
+		return {
+			next: () => it.next(),
+			return: async () => {
+				controller.abort();
+				try {
+					await it.return?.();
+				} catch {}
+				return {
+					done: true,
+					value: void 0
+				};
+			},
+			throw: (e) => it.throw?.(e) ?? Promise.reject(e instanceof Error ? e : new Error(String(e)))
+		};
+	} };
+}
+//#endregion
+//#region src/daemon/paths.ts
+/** Directory for broker sockets. Prefer `$XDG_RUNTIME_DIR` (0700, user-only,
+* tmpfs) when set; otherwise the OS temp dir. */
+function daemonDir() {
+	const xdg = process.env.XDG_RUNTIME_DIR;
+	return xdg && xdg.length > 0 ? join(xdg, "simplepush") : join(tmpdir(), "simplepush");
+}
+/** Socket path for a given credential. The hash covers the credential kind,
+* the secret AND the base URL so two accounts, an account vs its org session,
+* or prod vs a local backend never collide on one broker. The kind also
+* appears in the filename for debuggability. */
+function daemonSocketPath(credential, baseUrl) {
+	const secret = credential.kind === "personal" ? credential.apiToken : credential.bearer;
+	const key = createHash("sha256").update(`${credential.kind}\n${baseUrl}\n${secret}`).digest("hex").slice(0, 16);
+	return join(daemonDir(), `events-${credential.kind}-${key}.sock`);
+}
+//#endregion
+//#region src/daemon/server.ts
+const RING_MAX = 1e3;
+const IDLE_EXIT = "60 seconds";
+const UPSTREAM_LOOKBACK_MS = 10 * 6e4;
+/** True if a broker is already listening on `path` (so we don't double-bind). */
+const probeDaemon = (path, timeoutMs = 500) => Effect.async((resume) => {
+	const sock = createConnection(path);
+	const done = (live) => {
+		sock.destroy();
+		resume(Effect.succeed(live));
+	};
+	const timer = setTimeout(() => done(false), timeoutMs);
+	sock.once("connect", () => {
+		clearTimeout(timer);
+		done(true);
+	});
+	sock.once("error", () => {
+		clearTimeout(timer);
+		done(false);
+	});
+	return Effect.sync(() => {
+		clearTimeout(timer);
+		sock.destroy();
+	});
+});
+/** Wait for a just-spawned broker to come up. */
+const waitForDaemon = (path, timeout) => probeDaemon(path, 200).pipe(Effect.filterOrFail((up) => up, () => "not-up"), Effect.retry(Schedule.spaced("100 millis")), Effect.timeoutOption(timeout), Effect.map(Option.isSome), Effect.orElseSucceed(() => false));
+const parseSubscribeLine = (line) => {
+	try {
+		return JSON.parse(line).since;
+	} catch {
+		return;
+	}
+};
+/** Run the broker for a credential until the upstream dies or it idle-exits.
+* Resolves when the broker has fully shut down. */
+const runDaemon = (opts) => Effect.gen(function* () {
+	const out = yield* CliOutput;
+	const fs = yield* FileSystem.FileSystem;
+	const path = daemonSocketPath(opts.credential, opts.baseUrl);
+	yield* fs.makeDirectory(daemonDir(), { recursive: true }).pipe(Effect.ignore);
+	yield* fs.chmod(daemonDir(), 448).pipe(Effect.ignore);
+	if (yield* probeDaemon(path)) return yield* out.info("a broker is already running for this credential; exiting");
+	yield* fs.remove(path).pipe(Effect.ignore);
+	const reason = yield* Effect.scoped(Effect.gen(function* () {
+		const server = yield* NodeSocketServer.make({ path });
+		yield* Effect.addFinalizer(() => fs.remove(path).pipe(Effect.ignore));
+		yield* fs.chmod(path, 384).pipe(Effect.ignore);
+		const events = yield* PubSub.unbounded();
+		const ring = yield* Ref.make(Chunk.empty());
+		const clients = yield* SubscriptionRef.make(0);
+		const handleClient = (socket) => Effect.scoped(Effect.gen(function* () {
+			yield* SubscriptionRef.update(clients, (n) => n + 1);
+			yield* Effect.addFinalizer(() => SubscriptionRef.update(clients, (n) => n - 1));
+			const write = yield* socket.writer;
+			const firstLine = yield* Deferred.make();
+			const readState = {
+				buf: "",
+				done: false
+			};
+			const reader = yield* Effect.fork(socket.run((data) => {
+				if (readState.done) return;
+				readState.buf += Buffer.from(data).toString("utf8");
+				const nl = readState.buf.indexOf("\n");
+				if (nl === -1) return;
+				readState.done = true;
+				return Deferred.succeed(firstLine, readState.buf.slice(0, nl));
+			}));
+			const dequeue = yield* PubSub.subscribe(events);
+			const line = yield* Deferred.await(firstLine).pipe(Effect.timeoutOption("100 millis"));
+			const since = Option.match(line, {
+				onNone: () => void 0,
+				onSome: parseSubscribeLine
+			});
+			const snapshot = Chunk.toReadonlyArray(yield* Ref.get(ring));
+			const backlog = since === void 0 ? snapshot : snapshot.filter((e) => e.createdAt !== void 0 && e.createdAt >= since);
+			const seen = new Set(snapshot);
+			for (const ev of backlog) yield* write(JSON.stringify(ev) + "\n");
+			const live = Stream.fromQueue(dequeue).pipe(Stream.filterEffect((ev) => Effect.sync(() => !seen.delete(ev))), Stream.runForEach((ev) => write(JSON.stringify(ev) + "\n")));
+			yield* Effect.raceFirst(live, Fiber.join(reader));
+		})).pipe(Effect.catchAllCause(() => Effect.void));
+		const acceptLoop = server.run(handleClient);
+		const idleExit = clients.changes.pipe(Stream.debounce(IDLE_EXIT), Stream.filter((n) => n === 0), Stream.take(1), Stream.runDrain, Effect.as("idle, no clients"));
+		const upstream = Effect.scoped(Effect.gen(function* () {
+			const client = opts.credential.kind === "personal" ? yield* acquireClient({
+				baseUrl: opts.baseUrl,
+				apiToken: opts.credential.apiToken
+			}) : yield* acquireOrgClient({
+				baseUrl: opts.baseUrl,
+				bearerToken: opts.credential.bearer
+			});
+			const since = new Date(Date.now() - UPSTREAM_LOOKBACK_MS).toISOString();
+			yield* sdkStream("upstream events", (signal) => client.events({
+				since,
+				signal
+			})).pipe(Stream.runForEach((ev) => Ref.update(ring, (r) => {
+				const next = Chunk.append(r, ev);
+				return Chunk.size(next) > RING_MAX ? Chunk.drop(next, 1) : next;
+			}).pipe(Effect.zipRight(PubSub.publish(events, ev)))));
+			return "upstream closed";
+		})).pipe(Effect.catchTag("SdkFailure", (e) => out.warn(`upstream events stream failed: ${e.cause instanceof Error ? e.cause.message : String(e.cause)}`).pipe(Effect.as("upstream error"))));
+		yield* out.info(`broker listening at ${path}`);
+		return yield* Effect.raceAll([
+			upstream,
+			idleExit,
+			acceptLoop
+		]);
+	}));
+	yield* out.info(`broker shut down (${reason})`);
+});
+//#endregion
+//#region src/daemon/transport.ts
+/** Adapt a connected Unix socket carrying newline-delimited event JSON into a
+* `SimplepushWebSocket`. The broker only ever sends us event frames, so
+* `messages()` yields each line verbatim. */
+function adaptSocket(socket, since) {
+	const queue = [];
+	let waiter = null;
+	const push = (f) => {
+		if (waiter) {
+			const w = waiter;
+			waiter = null;
+			w(f);
+		} else queue.push(f);
+	};
+	let closed = false;
+	let resolveClosed;
+	const closedPromise = new Promise((res) => {
+		resolveClosed = res;
+	});
+	socket.once("connect", () => {
+		socket.write(JSON.stringify({ since }) + "\n");
+	});
+	let buf = "";
+	socket.on("data", (chunk) => {
+		buf += chunk.toString("utf8");
+		let nl;
+		while ((nl = buf.indexOf("\n")) !== -1) {
+			const ln = buf.slice(0, nl);
+			buf = buf.slice(nl + 1);
+			if (ln.trim().length > 0) push({
+				kind: "msg",
+				text: ln
+			});
+		}
+	});
+	socket.on("close", () => {
+		if (!closed) {
+			closed = true;
+			push({ kind: "end" });
+			resolveClosed();
+		}
+	});
+	socket.on("error", (err) => push({
+		kind: "error",
+		err
+	}));
+	async function* messages() {
+		while (true) {
+			const next = queue.length > 0 ? queue.shift() : await new Promise((res) => {
+				waiter = res;
+			});
+			if (next.kind === "msg") yield next.text;
+			else if (next.kind === "end") return;
+			else throw next.err;
+		}
+	}
+	return {
+		closed: closedPromise,
+		messages,
+		close: () => {
+			try {
+				socket.destroy();
+			} catch {}
+		}
+	};
+}
+/** A factory that connects to the broker at `path`. The SDK passes the ws url
+* (with `?since=`), which we forward to the broker as the backlog cursor. */
+function daemonWebSocketFactory(path) {
+	return (url) => {
+		let since;
+		try {
+			since = new URL(url).searchParams.get("since") ?? void 0;
+		} catch {}
+		return adaptSocket(connect(path), since);
+	};
+}
+/** Spawn the broker detached; credentials/base-url go via env, NOT argv, so
+* they don't show up in `ps`. Org mode passes the session bearer explicitly
+* (SP_DAEMON_BEARER) rather than letting the child re-read auth.json,
+* so the child's socket path deterministically matches the one we probe. */
+const spawnDetachedDaemon = (opts) => Effect.sync(() => {
+	const credentialEnv = opts.credential.kind === "personal" ? { SP_API_TOKEN: opts.credential.apiToken } : { SP_DAEMON_BEARER: opts.credential.bearer };
+	spawn(process.execPath, [process.argv[1], "daemon"], {
+		detached: true,
+		stdio: "ignore",
+		env: {
+			...process.env,
+			...credentialEnv,
+			SP_BASE_URL: opts.baseUrl
+		}
+	}).unref();
+});
+/** Resolve the WebSocket transport for a shared-mode client: attach to a running
+* broker, auto-spawning one (detached) if absent. Returns `Option.none` to fall
+* back to a direct connection when the broker can't be reached — the broker is
+* an optimisation and must never break `sp`. */
+const sharedWebSocketFactory = (opts) => Effect.gen(function* () {
+	const out = yield* CliOutput;
+	const path = daemonSocketPath(opts.credential, opts.baseUrl);
+	return yield* Effect.gen(function* () {
+		if (yield* probeDaemon(path)) {
+			yield* out.info("attached to the shared events broker");
+			return Option.some(daemonWebSocketFactory(path));
+		}
+		yield* spawnDetachedDaemon(opts);
+		if (!(yield* waitForDaemon(path, "3 seconds"))) {
+			yield* out.warn("could not start the shared events broker; using a direct connection");
+			return Option.none();
+		}
+		yield* out.info("started shared events broker");
+		return Option.some(daemonWebSocketFactory(path));
+	}).pipe(Effect.catchAllCause((cause) => out.warn(`shared broker unavailable (${cause.toString()}); using a direct connection`).pipe(Effect.as(Option.none()))));
+});
+//#endregion
+//#region src/since.ts
+const UNIT_MS = {
+	ms: 1,
+	s: 1e3,
+	sec: 1e3,
+	secs: 1e3,
+	m: 6e4,
+	min: 6e4,
+	mins: 6e4,
+	h: 36e5,
+	hr: 36e5,
+	hrs: 36e5,
+	d: 864e5,
+	day: 864e5,
+	days: 864e5,
+	w: 6048e5,
+	wk: 6048e5,
+	wks: 6048e5
+};
+const HUMANTIME_RE = /^\s*(\d+)\s*([a-zA-Z]+)\s*$/;
+function parseDurationMs(input) {
+	const m = HUMANTIME_RE.exec(input);
+	if (!m) return void 0;
+	const n = Number(m[1]);
+	const factor = UNIT_MS[m[2].toLowerCase()];
+	if (factor === void 0) return void 0;
+	return n * factor;
+}
+function parseIso(input) {
+	const d = new Date(input);
+	return Number.isFinite(d.getTime()) ? d : void 0;
+}
+/** ISO 8601 string suitable for the `--since` query param. */
+function resolveSince(input) {
+	const iso = parseIso(input);
+	if (iso) return iso.toISOString();
+	const ms = parseDurationMs(input);
+	if (ms !== void 0) return new Date(Date.now() - ms).toISOString();
+	throw new Error(`could not parse \`--since ${input}\`: expected a duration (e.g. \`24h\`, \`7d\`) or ISO 8601 timestamp`);
+}
+function resolveUntil(input) {
+	const iso = parseIso(input);
+	if (iso) return iso;
+	const ms = parseDurationMs(input);
+	if (ms !== void 0) return new Date(Date.now() - ms);
+	throw new Error(`could not parse \`--until ${input}\`: expected a duration or ISO 8601 timestamp`);
+}
+//#endregion
+//#region src/collect-output.ts
+/** Drops circular / non-serialisable internals from SDK view objects: `raw`
+* (the whole wire Event — circular) and `_ctx` (a download context that
+* captures the client). Download methods (`read`/`save`/`downloadUrl` when a
+* function) are omitted by JSON.stringify automatically, leaving file views as
+* their plain metadata (id / contentType / filename / size / checksum). */
+function cleanReplacer(key, value) {
+	if (key === "raw" || key === "_ctx") return void 0;
+	return value;
+}
+function line(obj) {
+	return JSON.stringify(obj, cleanReplacer);
+}
+function createdAtOf(item) {
+	return item.createdAt ?? item.raw?.createdAt;
+}
+/** Wire-absent → null, and absent inner fields → null, per the envelope's
+* `?? null` convention. */
+function actorOf(item) {
+	const a = item.actor;
+	if (!a) return null;
+	return {
+		publicId: a.publicId,
+		name: a.name ?? null,
+		devicePublicId: a.devicePublicId ?? null,
+		deviceName: a.deviceName ?? null
+	};
+}
+function formatSent(groupId, createdAt, members) {
+	return line({
+		type: "sent",
+		groupId: groupId ?? null,
+		createdAt: createdAt ?? null,
+		members: members.map((m) => ({
+			...m.kind === "notification" ? { notificationId: m.id } : { taskId: m.id },
+			recipient: m.recipient
+		}))
+	});
+}
+/** The member instance's entity id under its kind-specific key. */
+function instanceId(instance) {
+	const inst = instance;
+	return inst.taskId !== void 0 ? { taskId: inst.taskId } : { notificationId: inst.notificationId ?? null };
+}
+/** A single collected item — from `replies()`, `inputs()`, the combined
+* `activity()`, or a notification group's answers — into one envelope line,
+* keyed off `item.kind`. Reply, input, terminal completion, and deletion all
+* funnel through here so every collect mode emits the same schema. */
+function formatItem(g, groupId) {
+	const item = g.item;
+	const base = {
+		groupId: groupId ?? null,
+		...instanceId(g.instance),
+		recipient: g.recipient ?? null,
+		actor: actorOf(item),
+		createdAt: createdAtOf(item) ?? null
+	};
+	switch (item.kind) {
+		case "reply": return line({
+			type: "reply",
+			...base,
+			subtaskId: item.subtaskId ?? null,
+			id: item.id ?? null,
+			body: item.body ?? null,
+			photo: item.photo ?? null,
+			file: item.file ?? null,
+			audio: item.audio ?? null,
+			location: item.location ?? null
+		});
+		case "input": return line({
+			type: "input",
+			...base,
+			inputType: item.type,
+			uploads: item.uploads ?? []
+		});
+		case "taskCompleted": return line({
+			type: "completed",
+			...base,
+			uploads: item.uploads ?? []
+		});
+		case "notificationCompleted": return line({
+			type: "completed",
+			...base,
+			reply: item.reply ?? null
+		});
+		case "taskDeleted": return line({
+			type: "deleted",
+			...base
+		});
+	}
+}
+function formatSubmission(s) {
+	return line({
+		type: "submission",
+		id: s.id ?? null,
+		actor: actorOf(s),
+		body: s.body ?? null,
+		photo: s.photo ?? null,
+		file: s.file ?? null,
+		audio: s.audio ?? null,
+		location: s.location ?? null,
+		createdAt: s.createdAt ?? null
+	});
+}
+const isFileView = (v) => typeof v === "object" && v !== null && typeof v.save === "function";
+/** The downloadable file views an item carries: its `uploads` array (photo /
+* voice / file kinds — text/choice/… carry no `save` and drop out) or its
+* reply/submission `photo`/`file`/`audio` fields. Items with neither (deleted
+* markers, notification answers) yield []. */
+function fileViewsOf(item) {
+	const o = item;
+	return (Array.isArray(o.uploads) ? o.uploads : [
+		o.photo,
+		o.file,
+		o.audio
+	]).filter(isFileView);
+}
+/** The terminal line: reason the stream stopped, per-type counts, and (for
+* group modes) per-member status. Always the last line on a clean run. */
+function formatEnd(reason, counts, members, errorMsg) {
+	const obj = {
+		type: "end",
+		reason,
+		counts
+	};
+	if (members) obj.members = members;
+	if (errorMsg !== void 0) obj.error = errorMsg;
+	return line(obj);
+}
+function fmtBytes(n) {
+	if (n < 1024) return `${n}B`;
+	if (n < 1024 * 1024) return `${(n / 1024).toFixed(1)}KB`;
+	return `${(n / (1024 * 1024)).toFixed(1)}MB`;
+}
+/** `inp_1a2b… cat.jpg 2.1MB -> files/inp_1a2b…-cat.jpg` — the id feeds
+* `sp download`, the path (when saved) locates the local copy. */
+function prettyFile(f) {
+	const parts = [f.id ?? "?"];
+	if (f.filename) parts.push(f.filename);
+	else if (f.contentType) parts.push(f.contentType);
+	if (f.size !== void 0) parts.push(fmtBytes(f.size));
+	if (f.path) parts.push(`-> ${f.path}`);
+	return parts.join(" ");
+}
+function prettyFileSuffix(item) {
+	const files = fileViewsOf(item);
+	return files.length === 0 ? "" : ` files: ${files.map(prettyFile).join(", ")}`;
+}
+function formatPrettyItem(g) {
+	const a = g.item.actor;
+	const inst = g.instance;
+	const who = a?.name ?? g.recipient?.name ?? a?.publicId ?? g.recipient?.publicId ?? inst.taskId ?? inst.notificationId;
+	const item = g.item;
+	switch (item.kind) {
+		case "reply": return `  ${who} (reply): ${item.body?.kind === "text" ? item.body.text ?? "" : JSON.stringify(item.body)}${prettyFileSuffix(item)}`;
+		case "input": return `  ${who} [${item.type}]${prettyFileSuffix(item)}`;
+		case "taskCompleted": return `  ${who} [completed]${prettyFileSuffix(item)}`;
+		case "notificationCompleted": {
+			const r = item.reply;
+			return `  ${who} [answered]${r === void 0 ? "" : r.type === "text" ? `: ${r.value}` : r.type === "choice" ? `: ${r.selectedValue}` : `: ${r.selectedKey}`}`;
+		}
+		case "taskDeleted": return `  ${who} [deleted]`;
+	}
+}
+function formatPrettySubmission(s) {
+	const text = s.body?.kind === "text" ? s.body.text ?? "" : JSON.stringify(s.body);
+	const who = s.actor ? s.actor.name ?? s.actor.publicId : void 0;
+	const device = s.actor?.deviceName;
+	return `  submission${who ? ` from ${who}${device ? ` (${device})` : ""}` : ""}: ${text}${prettyFileSuffix(s)}`;
+}
+//#endregion
+//#region src/save-files.ts
+const EXT = {
+	"image/jpeg": ".jpg",
+	"image/png": ".png",
+	"audio/ogg": ".ogg",
+	"audio/wav": ".wav",
+	"audio/mp4": ".m4a",
+	"video/mp4": ".mp4",
+	"application/pdf": ".pdf",
+	"application/zip": ".zip",
+	"text/plain": ".txt"
+};
+/** The unique in-directory name for a file view: `<id>-<filename>` when the
+* uploader named it (basename'd — a filename is client-supplied wire data and
+* must not traverse), else `<id>` + a content-type extension. */
+function targetName(f) {
+	const id = f.id ?? "file";
+	if (f.filename) return `${id}-${basename(f.filename)}`;
+	return `${id}${EXT[f.contentType ?? ""] ?? ""}`;
+}
+/** Download every file the item carries into `dir`, stamping each view's
+* `path`. Never throws: per-file failures stamp `path: null` and come back as
+* warning strings. */
+async function saveItemFiles(item, dir) {
+	const warnings = [];
+	for (const f of fileViewsOf(item)) try {
+		f.path = await f.save(join(dir, targetName(f)));
+	} catch (err) {
+		f.path = null;
+		warnings.push(`could not save ${f.id ?? "file"}: ${err instanceof Error ? err.message : String(err)}`);
+	}
+	return warnings;
+}
+//#endregion
+//#region src/until.ts
+function parseDuration(s) {
+	const m = /^(\d+(?:\.\d+)?)(ms|s|m|h)$/.exec(s.trim());
+	if (!m) throw new Error(`invalid duration \`${s}\`: use e.g. 500ms, 30s, 2m, 1h`);
+	const n = Number(m[1]);
+	const unit = m[2];
+	return Math.round(n * (unit === "ms" ? 1 : unit === "s" ? 1e3 : unit === "m" ? 6e4 : 36e5));
+}
+function parseUntil(specs) {
+	const cfg = { complete: false };
+	for (const raw of specs) {
+		const spec = raw.trim();
+		if (spec === "complete") {
+			cfg.complete = true;
+			continue;
+		}
+		if (spec === "forever") {
+			cfg.forever = true;
+			continue;
+		}
+		const colon = spec.indexOf(":");
+		if (colon === -1) throw new Error(`invalid --until \`${spec}\`: expected complete | idle:<dur> | count:<n> | timeout:<dur> | forever`);
+		const key = spec.slice(0, colon);
+		const val = spec.slice(colon + 1);
+		switch (key) {
+			case "idle":
+				cfg.idleMs = parseDuration(val);
+				break;
+			case "timeout":
+				cfg.timeoutMs = parseDuration(val);
+				break;
+			case "count": {
+				const n = Number(val);
+				if (!Number.isInteger(n) || n <= 0) throw new Error(`invalid --until count:\`${val}\`: expected a positive integer`);
+				cfg.count = n;
+				break;
+			}
+			default: throw new Error(`invalid --until \`${spec}\`: unknown condition \`${key}\` (expected idle|count|timeout|complete|forever)`);
+		}
+	}
+	if (cfg.forever && (cfg.complete || cfg.idleMs !== void 0 || cfg.count !== void 0 || cfg.timeoutMs !== void 0)) throw new Error("--until forever cannot be combined with other stop conditions");
+	return cfg;
+}
+/** Fill in a sensible default when the caller passed no `--until`: inputs /
+* activity (which have a natural terminal) default to waiting for every member
+* to finish; replies / submissions (no terminal) run `forever` — they're
+* watchers, ended by Ctrl-C or an explicit `--until`. */
+function withDefaults(cfg, mode) {
+	if (cfg.forever) return cfg;
+	if (!(!cfg.complete && cfg.idleMs === void 0 && cfg.count === void 0 && cfg.timeoutMs === void 0)) return cfg;
+	if (mode === "inputs" || mode === "activity") return {
+		...cfg,
+		complete: true
+	};
+	return {
+		...cfg,
+		forever: true
+	};
+}
+//#endregion
+//#region src/commands/collect.ts
+const SentLine = Schema.Struct({
+	type: Schema.Literal("sent"),
+	groupId: Schema.optional(Schema.NullOr(Schema.String)),
+	createdAt: Schema.optional(Schema.NullOr(Schema.String)),
+	members: Schema.optional(Schema.Array(Schema.Struct({
+		taskId: Schema.optional(Schema.String),
+		notificationId: Schema.optional(Schema.String),
+		recipient: Schema.optional(Schema.NullOr(Schema.Struct({
+			publicId: Schema.String,
+			name: Schema.optional(Schema.NullOr(Schema.String))
+		})))
+	})))
+});
+const parseSentLine = Schema.decodeUnknownOption(Schema.parseJson(SentLine));
+/** Read the first `{"type":"sent",…}` line off stdin (when piped), returning as
+* soon as it's found — it never blocks waiting for the producer to close. */
+const readSentLine = Effect.suspend(() => {
+	if (process.stdin.isTTY) return Effect.succeedNone;
+	return Stream.fromAsyncIterable(process.stdin, (e) => e).pipe(Stream.map((chunk) => chunk.toString("utf8")), Stream.splitLines, Stream.filterMap((line) => parseSentLine(line.trim())), Stream.runHead, Effect.orElseSucceed(() => Option.none()), Effect.ensuring(Effect.sync(() => {
+		try {
+			process.stdin.unref?.();
+		} catch {}
+	})));
+});
+/** Personal mode when `--api-token` (or $SP_API_TOKEN) is given;
+* otherwise fall back to the saved CLI session (org mode) — the same session
+* that powers org sends, so a logged-in admin collects without extra
+* credentials. Org mode follows the session's base URL; an explicitly
+* different `--base-url` is a conflict, not a silent override. */
+const resolveCredential = (tokenOpt, baseUrlArg) => Effect.gen(function* () {
+	if (Option.isSome(tokenOpt)) return {
+		kind: "personal",
+		apiToken: tokenOpt.value,
+		baseUrl: baseUrlArg
+	};
+	const auth = yield* (yield* AuthStore).load.pipe(Effect.orElseSucceed(Option.none));
+	if (Option.isNone(auth)) return yield* Effect.fail(new UserError({ message: "no credential: pass --api-token (or set $SP_API_TOKEN) to collect your personal stream, or `sp auth login` to collect your organization's" }));
+	const session = auth.value;
+	if (baseUrlArg !== "https://api.simplepu.sh" && baseUrlArg !== session.baseUrl) return yield* Effect.fail(new UserError({ message: `the CLI session is for ${session.baseUrl}, not ${baseUrlArg} — log in there, or pass --api-token to collect a personal stream instead` }));
+	return {
+		kind: "org",
+		bearer: bearerToken(session),
+		baseUrl: session.baseUrl
+	};
+});
+/** Org master keys for decryption: the cached vault when present; a missing
+* cache prompts for the passphrase on a TTY (same UX as an encrypted org
+* send). Piped runs never prompt — stdin belongs to the `sent` line — and
+* proceed keyless with a warning (encrypted content passes through
+* undecrypted). `EncryptionDisabled` means keyless is simply correct. */
+const loadOrgMasterKeys = Effect.gen(function* () {
+	const out = yield* CliOutput;
+	const cached = yield* (yield* VaultStore).load.pipe(Effect.orElseSucceed(Option.none));
+	const vault = Option.isSome(cached) ? cached.value : process.stdin.isTTY ? yield* (yield* VaultAccess).getOrPrompt.pipe(Effect.catchTag("EncryptionDisabled", () => Effect.succeed(void 0))) : void 0;
+	if (vault === void 0) {
+		if (Option.isNone(cached) && !process.stdin.isTTY) yield* out.warn("org vault is locked on this machine — encrypted org content will not decrypt (run `sp collect` once on a TTY to unlock)");
+		return;
+	}
+	return [vault.masterKeyCurrent, ...vault.masterKeyHistory].map((k) => ({
+		version: k.version,
+		key: k.key
+	}));
+});
+const collectCommand = Command.make("collect", {
+	group: Options.text("group").pipe(Options.withDescription("Group id (grptsk_…) to collect over. Usually supplied via the piped `sent` line instead."), Options.optional),
+	instance: Options.text("instance").pipe(Options.withDescription("Member instance id to collect: a task (tsk_…) or a notification (ntf_…). Repeatable. Augments/overrides the piped `sent` line's members."), Options.repeated),
+	replies: Options.boolean("replies").pipe(Options.withDescription("Collect only replies. Default (no mode flag) is the full activity stream: inputs, replies, and completions.")),
+	inputs: Options.boolean("inputs").pipe(Options.withDescription("Collect only input events (waits for every member to complete by default).")),
+	submissions: Options.boolean("submissions").pipe(Options.withDescription("Collect submissions (your inbox) instead of a group's events.")),
+	since: mappedText("since", resolveSince).pipe(Options.withDescription("Resume point (`24h`, `7d`, or ISO 8601). Backfills group events or submissions from that point; defaults to the send's createdAt from the piped `sent` line. Implies --direct (the broker can't serve a deep backfill)."), Options.optional),
+	until: Options.text("until").pipe(Options.withDescription("Stop condition. Repeatable: complete | idle:<dur> | count:<n> | timeout:<dur> | forever (never stop; Ctrl-C to end). Default: complete for group collects; --replies / --submissions watch forever."), Options.repeated),
+	format: Options.choice("format", ["json", "pretty"]).pipe(Options.withDescription("Output format: json (NDJSON, agent contract) or pretty (human)."), Options.withDefault("json")),
+	direct: Options.boolean("direct").pipe(Options.withDescription("Open an independent WS connection. By default sp shares ONE broker connection across all processes (auto-started); --direct bypasses it.")),
+	"save-files": Options.text("save-files").pipe(Options.withDescription("Download every collected file (photo/voice/file uploads, reply and submission files) into this directory as it streams in, decrypted and checksum-verified. Each file object on the emitted line gains `path`: the saved location, or null when its download failed."), Options.optional),
+	"api-token": apiTokenOption,
+	password: passwordOption,
+	"base-url": baseUrlOption,
+	quiet: quietOption
+}, (args) => Effect.gen(function* () {
+	const out = yield* CliOutput;
+	yield* out.setQuiet(args.quiet);
+	const cred = yield* resolveCredential(args["api-token"], args["base-url"]);
+	const baseUrl = cred.baseUrl;
+	const sinceIso = Option.getOrUndefined(args.since);
+	const mode = args.submissions ? "submissions" : args.inputs && args.replies ? "activity" : args.inputs ? "inputs" : args.replies ? "replies" : "activity";
+	const until = withDefaults(yield* Effect.try({
+		try: () => parseUntil(args.until),
+		catch: (e) => new UserError({ message: e instanceof Error ? e.message : String(e) })
+	}), mode);
+	const webSocketFactory = args.direct || sinceIso !== void 0 ? Option.none() : yield* sharedWebSocketFactory({
+		credential: cred.kind === "personal" ? {
+			kind: "personal",
+			apiToken: cred.apiToken
+		} : {
+			kind: "org",
+			bearer: cred.bearer
+		},
+		baseUrl
+	});
+	const factoryConfig = Option.match(webSocketFactory, {
+		onNone: () => ({}),
+		onSome: (f) => ({ webSocketFactory: f })
+	});
+	const orgKeys = cred.kind === "org" ? yield* loadOrgMasterKeys : void 0;
+	if (cred.kind === "org") yield* out.info(`collecting via org session (${baseUrl})`);
+	const saveDir = Option.getOrUndefined(args["save-files"]);
+	if (saveDir !== void 0) yield* Effect.tryPromise({
+		try: () => mkdir(saveDir, { recursive: true }),
+		catch: (e) => new UserError({ message: `cannot create --save-files directory ${saveDir}: ${e instanceof Error ? e.message : String(e)}` })
+	});
+	yield* Effect.scoped(Effect.gen(function* () {
+		const client = cred.kind === "personal" ? yield* acquireClient({
+			baseUrl,
+			apiToken: cred.apiToken,
+			passwords: [...args.password],
+			...factoryConfig
+		}) : yield* acquireOrgClient({
+			baseUrl,
+			bearerToken: cred.bearer,
+			...orgKeys !== void 0 ? { orgMasterKeys: orgKeys } : {},
+			...factoryConfig
+		});
+		if (mode === "submissions") return yield* collectSubmissions(client, args.format, until, sinceIso, saveDir);
+		const sent = Option.getOrUndefined(yield* readSentLine);
+		const groupId = Option.getOrUndefined(args.group) ?? sent?.groupId ?? void 0;
+		const createdAt = sinceIso ?? sent?.createdAt ?? void 0;
+		const members = [];
+		const seen = /* @__PURE__ */ new Set();
+		const addMember = (id, recipient) => {
+			if (id && !seen.has(id)) {
+				seen.add(id);
+				members.push({
+					id,
+					kind: id.startsWith("ntf_") ? "notification" : "task",
+					recipient
+				});
+			}
+		};
+		for (const m of sent?.members ?? []) addMember(m.taskId ?? m.notificationId, m.recipient ? {
+			publicId: m.recipient.publicId,
+			name: m.recipient.name ?? null
+		} : null);
+		for (const id of args.instance) addMember(id, null);
+		if (members.length === 0) return yield* Effect.fail(new UserError({ message: "no members to collect: pipe a send's `sent` line (`sp task --format json | sp collect`) or pass --instance <tsk_…|ntf_…> (repeatable)" }));
+		const notifRoster = members[0].kind === "notification";
+		if (members.some((m) => m.kind === "notification" !== notifRoster)) return yield* Effect.fail(new UserError({ message: "cannot mix task (tsk_…) and notification (ntf_…) members in one collect — run one per kind" }));
+		const streamOpts = {
+			replay: true,
+			...until.idleMs !== void 0 ? { idleMs: until.idleMs } : {}
+		};
+		const watchGroupId = groupId ?? members[0].id;
+		let source;
+		if (notifRoster) {
+			if (mode === "replies") return yield* Effect.fail(new UserError({ message: "notifications have no replies — collect their answers with --inputs or no mode flag" }));
+			const group = client.watchNotificationGroup({
+				groupId: watchGroupId,
+				...createdAt ? { createdAt } : {},
+				members: members.map((m) => m.recipient ? {
+					notificationId: m.id,
+					recipient: m.recipient
+				} : { notificationId: m.id })
+			});
+			source = (signal) => group.inputs({
+				...streamOpts,
+				signal
+			});
+		} else {
+			const group = client.watchTaskGroup({
+				groupId: watchGroupId,
+				...createdAt ? { createdAt } : {},
+				members: members.map((m) => m.recipient ? {
+					taskId: m.id,
+					recipient: m.recipient
+				} : { taskId: m.id })
+			});
+			source = (signal) => mode === "inputs" ? group.inputs({
+				...streamOpts,
+				signal
+			}) : mode === "replies" ? group.replies({
+				...streamOpts,
+				signal
+			}) : group.activity({
+				...streamOpts,
+				signal
+			});
+		}
+		if (args.format === "json") yield* out.print(formatSent(groupId, createdAt, members));
+		else yield* out.info(`collecting ${mode} over ${members.length} member(s)${groupId ? ` of ${groupId}` : ""}`);
+		yield* collectGroup(watchGroupId, source, members, args.format, until, saveDir);
+	}));
+}));
+/** A set-once end-reason cell: the first condition to trip names the reason. */
+const makeReason = Effect.map(Ref.make(Option.none()), (ref) => ({
+	set: (r) => Ref.update(ref, Option.orElse(() => Option.some(r))),
+	get: Ref.get(ref)
+}));
+/** Download the item's files into `dir` (stamping each view's `path`) before
+* its line is emitted; failures warn on stderr and stamp `path: null`. */
+const saveFiles = (item, dir) => dir === void 0 ? Effect.void : Effect.gen(function* () {
+	const out = yield* CliOutput;
+	const warnings = yield* Effect.promise(() => saveItemFiles(item, dir));
+	for (const w of warnings) yield* out.warn(w);
+});
+const collectSubmissions = (client, format, until, since, saveDir) => Effect.gen(function* () {
+	const out = yield* CliOutput;
+	const reason = yield* makeReason;
+	const counts = yield* Ref.make(0);
+	const failed = yield* sdkStream("submissions stream", (signal) => client.submissions({
+		signal,
+		...since !== void 0 ? { since } : {}
+	})).pipe(until.idleMs !== void 0 ? Stream.timeoutTo(Duration.millis(until.idleMs), Stream.drain(Stream.fromEffect(reason.set("idle")))) : (s) => s, Stream.tap((s) => saveFiles(s, saveDir).pipe(Effect.zipRight(out.print(format === "json" ? formatSubmission(s) : formatPrettySubmission(s))), Effect.zipRight(Ref.update(counts, (n) => n + 1)))), until.count !== void 0 ? Stream.takeUntilEffect(() => Effect.gen(function* () {
+		if ((yield* Ref.get(counts)) < until.count) return false;
+		yield* reason.set("count");
+		return true;
+	})) : (s) => s, until.timeoutMs !== void 0 ? Stream.interruptWhen(Effect.sleep(Duration.millis(until.timeoutMs)).pipe(Effect.zipRight(reason.set("timeout")))) : (s) => s, Stream.runDrain, Effect.matchEffect({
+		onFailure: (e) => reason.set("error").pipe(Effect.zipRight(out.error(`submissions stream failed: ${e.cause instanceof Error ? e.cause.message : String(e.cause)}`)), Effect.as(true)),
+		onSuccess: () => Effect.succeed(false)
+	}));
+	const total = yield* Ref.get(counts);
+	const why = Option.getOrElse(yield* reason.get, () => "closed");
+	if (format === "json") yield* out.print(formatEnd(why, total > 0 ? { submission: total } : {}, void 0, why === "error" ? "submissions stream failed" : void 0));
+	else yield* out.info(`done (${why}): ${JSON.stringify(total > 0 ? { submission: total } : {})}`);
+	if (failed) return yield* Effect.fail(new Aborted());
+});
+const collectGroup = (groupId, source, members, format, until, saveDir) => Effect.gen(function* () {
+	const out = yield* CliOutput;
+	const reason = yield* makeReason;
+	const counts = yield* Ref.make({});
+	const completed = yield* Ref.make(HashSet.empty());
+	const deleted = yield* Ref.make(HashSet.empty());
+	const total = yield* Ref.make(0);
+	const doneCount = Effect.gen(function* () {
+		return HashSet.size(yield* Ref.get(completed)) + HashSet.size(yield* Ref.get(deleted));
+	});
+	const instanceIdOf = (g) => {
+		const inst = g.instance;
+		return inst.taskId ?? inst.notificationId ?? "";
+	};
+	const failed = yield* sdkStream("collect stream", source).pipe(Stream.tap((g) => Effect.gen(function* () {
+		yield* saveFiles(g.item, saveDir);
+		yield* out.print(format === "json" ? formatItem(g, groupId) : formatPrettyItem(g));
+		yield* Ref.update(total, (n) => n + 1);
+		const kind = g.item.kind;
+		const label = kind === "reply" ? "reply" : kind === "input" ? "input" : kind === "taskDeleted" ? "deleted" : "completed";
+		yield* Ref.update(counts, (c) => ({
+			...c,
+			[label]: (c[label] ?? 0) + 1
+		}));
+		if (kind === "taskCompleted" || kind === "notificationCompleted") yield* Ref.update(completed, HashSet.add(instanceIdOf(g)));
+		if (kind === "taskDeleted") yield* Ref.update(deleted, HashSet.add(instanceIdOf(g)));
+	})), until.count !== void 0 ? Stream.takeUntilEffect(() => Effect.gen(function* () {
+		if ((yield* Ref.get(total)) < until.count) return false;
+		yield* reason.set("count");
+		return true;
+	})) : (s) => s, until.complete && members.length > 0 ? Stream.takeUntilEffect(() => Effect.gen(function* () {
+		if ((yield* doneCount) < members.length) return false;
+		yield* reason.set("complete");
+		return true;
+	})) : (s) => s, until.timeoutMs !== void 0 ? Stream.interruptWhen(Effect.sleep(Duration.millis(until.timeoutMs)).pipe(Effect.zipRight(reason.set("timeout")))) : (s) => s, Stream.runDrain, Effect.matchEffect({
+		onFailure: (e) => reason.set("error").pipe(Effect.zipRight(out.error(`collect stream failed: ${e.cause instanceof Error ? e.cause.message : String(e.cause)}`)), Effect.as(true)),
+		onSuccess: () => Effect.succeed(false)
+	}));
+	const done = yield* doneCount;
+	const fallback = members.length > 0 && done >= members.length ? "complete" : until.idleMs !== void 0 ? "idle" : "closed";
+	const why = Option.getOrElse(yield* reason.get, () => fallback);
+	const memberStatus = {
+		total: members.length,
+		completed: HashSet.size(yield* Ref.get(completed)),
+		deleted: HashSet.size(yield* Ref.get(deleted)),
+		pending: members.length - done
+	};
+	if (format === "json") yield* out.print(formatEnd(why, yield* Ref.get(counts), memberStatus, why === "error" ? "collect stream failed" : void 0));
+	else yield* out.info(`done (${why}): ${JSON.stringify(yield* Ref.get(counts))}`);
+	if (failed) return yield* Effect.fail(new Aborted());
+});
+//#endregion
+//#region src/commands/daemon.ts
+const resolveDaemonCredential = (tokenOpt) => Effect.gen(function* () {
+	if (Option.isSome(tokenOpt)) return {
+		kind: "personal",
+		apiToken: tokenOpt.value
+	};
+	const spawnedBearer = process.env.SP_DAEMON_BEARER;
+	if (spawnedBearer) return {
+		kind: "org",
+		bearer: spawnedBearer
+	};
+	const auth = yield* (yield* AuthStore).load.pipe(Effect.orElseSucceed(Option.none));
+	if (Option.isSome(auth)) return {
+		kind: "org",
+		bearer: bearerToken(auth.value)
+	};
+	return yield* Effect.fail(new UserError({ message: "no credential: pass --api-token (or set $SP_API_TOKEN) for a personal broker, or `sp auth login` for an org broker" }));
+});
+const daemonCommand = Command.make("daemon", {
+	"api-token": apiTokenOption,
+	"base-url": baseUrlOption,
+	quiet: quietOption
+}, (args) => Effect.gen(function* () {
+	yield* (yield* CliOutput).setQuiet(args.quiet);
+	yield* runDaemon({
+		credential: yield* resolveDaemonCredential(args["api-token"]),
+		baseUrl: args["base-url"]
+	});
+}));
+//#endregion
+//#region src/commands/download.ts
+const IDLE_MS = 1e4;
+const resolveScope = (scopeId, fileId) => {
+	if (scopeId.startsWith("sub_")) return Effect.fail(new UserError({ message: "subtask files are addressed by their parent task: pass the tsk_… id (collect reply/input lines carry it as taskId)" }));
+	const kind = scopeId.startsWith("tsk_") ? "task" : scopeId.startsWith("sbm_") ? "submission" : void 0;
+	if (kind === void 0) return Effect.fail(new UserError({ message: `expected a task (tsk_…) or submission (sbm_…) scope id, got '${scopeId}'` }));
+	const wantedScope = fileId.startsWith("inp_") || fileId.startsWith("rfl_") ? "task" : fileId.startsWith("sbf_") ? "submission" : void 0;
+	if (wantedScope === void 0) return Effect.fail(new UserError({ message: `expected an input upload (inp_…), reply file (rfl_…), or submission file (sbf_…) id, got '${fileId}'` }));
+	if (wantedScope !== kind) return Effect.fail(new UserError({ message: wantedScope === "task" ? `${fileId} is a task-scoped file — pass its tsk_… id, not ${scopeId}` : `${fileId} is a submission file — pass its sbm_… id, not ${scopeId}` }));
+	return Effect.succeed(kind);
+};
+const downloadCommand = Command.make("download", {
+	scopeId: Args.text({ name: "scope-id" }).pipe(Args.withDescription("The containing entity: a task (tsk_…, the `taskId` on collect reply/input lines) or a submission (sbm_…, the `id` on submission lines).")),
+	fileId: Args.text({ name: "file-id" }).pipe(Args.withDescription("The file to download: an input upload (inp_…), reply file (rfl_…), or submission file (sbf_…) — the `id` on the line's file object.")),
+	out: Options.text("out").pipe(Options.withDescription("Where to save: a file path, an existing directory (the upload's filename is used inside it), or omitted for the current directory."), Options.optional),
+	since: Options.text("since").pipe(Options.withDescription("How far back to search the event stream for the file (`24h`, `90d`, or ISO 8601). Default: 7d."), Options.withDefault("7d")),
+	format: Options.choice("format", ["json", "pretty"]).pipe(Options.withDescription("Output format: json (one `downloaded` line) or pretty (the saved path)."), Options.withDefault("json")),
+	"api-token": apiTokenOption,
+	password: passwordOption,
+	"base-url": baseUrlOption,
+	quiet: quietOption
+}, (args) => Effect.gen(function* () {
+	const out = yield* CliOutput;
+	yield* out.setQuiet(args.quiet);
+	const scope = yield* resolveScope(args.scopeId, args.fileId);
+	const sinceIso = resolveSince(args.since);
+	const cred = yield* resolveCredential(args["api-token"], args["base-url"]);
+	const orgKeys = cred.kind === "org" ? yield* loadOrgMasterKeys : void 0;
+	yield* Effect.scoped(Effect.gen(function* () {
+		const health = {
+			reconnects: 0,
+			lastError: void 0,
+			eventsSeen: 0
+		};
+		const onReconnect = (_attempt, _backoffMs, lastError) => {
+			health.reconnects += 1;
+			if (lastError) health.lastError = lastError;
+		};
+		const client = cred.kind === "personal" ? yield* acquireClient({
+			baseUrl: cred.baseUrl,
+			apiToken: cred.apiToken,
+			passwords: [...args.password],
+			onReconnect
+		}) : yield* acquireOrgClient({
+			baseUrl: cred.baseUrl,
+			bearerToken: cred.bearer,
+			...orgKeys !== void 0 ? { orgMasterKeys: orgKeys } : {},
+			onReconnect
+		});
+		const matching = (item) => Option.fromNullable(fileViewsOf(item).find((f) => f.id === args.fileId));
+		const countSeen = (s) => s.pipe(Stream.tap(() => Effect.sync(() => {
+			health.eventsSeen += 1;
+		})));
+		const fileStream = scope === "task" ? countSeen(sdkStream("task activity", (signal) => client.watchTaskGroup({
+			groupId: args.scopeId,
+			createdAt: sinceIso,
+			members: [{ taskId: args.scopeId }]
+		}).activity({
+			replay: true,
+			idleMs: IDLE_MS,
+			signal
+		}))).pipe(Stream.filterMap((g) => matching(g.item))) : countSeen(sdkStream("submissions stream", (signal) => client.submissions({
+			signal,
+			since: sinceIso,
+			idleMs: IDLE_MS
+		}))).pipe(Stream.filterMap((s) => s.id === args.scopeId ? matching(s) : Option.none()));
+		const found = yield* Stream.runHead(fileStream).pipe(Effect.mapError((e) => new UserError({ message: `event stream failed: ${e.cause instanceof Error ? e.cause.message : String(e.cause)} — check --base-url and the credential` })));
+		if (Option.isNone(found)) {
+			const message = health.lastError !== void 0 ? `could not read the event stream (${health.lastError.message}) — check --base-url and the credential` : health.eventsSeen === 0 ? `no events for ${args.scopeId} arrived since ${args.since} — check the ids and --base-url, or widen the search with --since (e.g. --since 90d)` : `${args.fileId} not seen on ${args.scopeId} since ${args.since} (${health.eventsSeen} events replayed) — check the file id, or widen the search with --since (e.g. --since 90d)`;
+			return yield* Effect.fail(new UserError({ message }));
+		}
+		const file = found.value;
+		const path = yield* Effect.tryPromise({
+			try: () => file.save(Option.getOrUndefined(args.out)),
+			catch: (e) => new UserError({ message: `download failed: ${e instanceof Error ? e.message : String(e)}` })
+		});
+		if (args.format === "json") yield* out.print(JSON.stringify({
+			type: "downloaded",
+			id: file.id ?? null,
+			path,
+			filename: file.filename ?? null,
+			contentType: file.contentType ?? null,
+			size: file.size ?? null
+		}));
+		else yield* out.print(path);
+	}));
+}));
+//#endregion
+//#region src/output.ts
+function formatEvent(event, format, decrypted) {
+	switch (format) {
+		case "json": {
+			const value = { ...event };
+			if (decrypted !== void 0) value.decrypted = decrypted;
+			return JSON.stringify(value);
+		}
+		case "pretty": {
+			const lines = [`=== ${event.eventType} ===`];
+			if (event.createdAt) lines.push(`  at:          ${event.createdAt}`);
+			if (event.streamId) lines.push(`  stream:      ${event.streamId}`);
+			if (event.actor) {
+				const a = event.actor;
+				lines.push(`  actor:       ${a.name ? `${a.name} (${a.publicId})` : a.publicId}`);
+				if (a.devicePublicId || a.deviceName) lines.push(`  device:      ${a.deviceName ? `${a.deviceName} (${a.devicePublicId ?? "?"})` : a.devicePublicId}`);
+			}
+			if (event.encryption) {
+				const enc = event.encryption.type === "personal" ? `personal (${event.encryption.passwordFingerprint})` : `org (v${event.encryption.v})`;
+				lines.push(`  encryption:  ${enc}`);
+			}
+			if (decrypted !== void 0) lines.push(`  decrypted:   ${prettyValue(decrypted)}`);
+			else lines.push(`  data:        ${prettyValue(event.data)}`);
+			return lines.join("\n") + "\n";
+		}
+		case "raw": {
+			const payload = decrypted ?? event.data;
+			return extractRaw(payload) ?? JSON.stringify(payload);
+		}
+	}
+}
+function prettyValue(v) {
+	try {
+		return JSON.stringify(v, null, 2);
+	} catch {
+		return String(v);
+	}
+}
+function extractRaw(v) {
+	if (!v || typeof v !== "object") return void 0;
+	const obj = v;
+	for (const k of [
+		"text",
+		"value",
+		"selectedValue",
+		"url",
+		"presignedGetUrl",
+		"objectKey"
+	]) {
+		const x = obj[k];
+		if (typeof x === "string") return x;
+	}
+}
+//#endregion
+//#region src/commands/events.ts
+const eventTypeOption = Options.text("type").pipe(Options.withDescription("Filter by event type. Repeatable."), Options.repeated);
+const sinceOption = mappedText("since", resolveSince).pipe(Options.withDescription("Replay from this point. Accepts `24h`, `7d`, or an ISO 8601 timestamp."), Options.optional);
+const untilOption = mappedText("until", resolveUntil).pipe(Options.withDescription("Stop at this timestamp. Forces a finite range, so `--follow` is ignored."), Options.optional);
+const limitOption = Options.integer("limit").pipe(Options.withDescription("Maximum number of events to print, then exit."), Options.optional);
+const followOption = Options.boolean("follow").pipe(Options.withAlias("f"), Options.withDescription("After history is drained, keep streaming live instead of exiting. Only meaningful with `--since`."));
+const formatOption$2 = Options.choice("format", [
+	"json",
+	"pretty",
+	"raw"
+]).pipe(Options.withDescription("Output format."), Options.withDefault("json"));
+const directOption = Options.boolean("direct").pipe(Options.withDescription("Open an independent WS connection. By default a LIVE stream (no --since) shares ONE broker connection across all sp processes; --direct bypasses it. A --since history replay always goes direct."));
+const QUIET_EXIT_AFTER_DRAIN = "2 seconds";
+const eventsCommand = Command.make("events", {
+	type: eventTypeOption,
+	since: sinceOption,
+	until: untilOption,
+	limit: limitOption,
+	follow: followOption,
+	format: formatOption$2,
+	direct: directOption,
+	topic: topicOption,
+	"api-token": apiTokenOption,
+	password: passwordOption,
+	"base-url": baseUrlOption,
+	quiet: quietOption
+}, (args) => Effect.gen(function* () {
+	const out = yield* CliOutput;
+	yield* out.setQuiet(args.quiet);
+	const apiToken = yield* requireApiToken(args["api-token"]);
+	const baseUrl = args["base-url"];
+	const sinceIso = Option.getOrUndefined(args.since);
+	const untilDate = Option.getOrUndefined(args.until);
+	const limit = Option.getOrUndefined(args.limit);
+	const filter = new TypeFilter(args.type);
+	yield* Effect.forEach(filter.unknown, (u) => out.warn(`ignoring unknown --type \`${u}\``));
+	const webSocketFactory = args.direct || sinceIso !== void 0 ? Option.none() : yield* sharedWebSocketFactory({
+		credential: {
+			kind: "personal",
+			apiToken
+		},
+		baseUrl
+	});
+	yield* Effect.scoped(Effect.gen(function* () {
+		const client = yield* acquireClient({
+			baseUrl,
+			apiToken,
+			passwords: args.password,
+			...Option.match(webSocketFactory, {
+				onNone: () => ({}),
+				onSome: (f) => ({ webSocketFactory: f })
+			})
+		});
+		const keyring = args.password.length > 0 ? yield* sdkCall("keyring", () => client.keyring({ includePasswordSalt: true })) : void 0;
+		if (keyring) if (keyring.size > 0) yield* out.info(`keyring built with ${keyring.size} fingerprint(s)`);
+		else yield* out.warn(`no symmetric keys derived from --password (count=${args.password.length})`);
+		yield* out.info(`connecting to ${baseUrl.replace(/\/+$/, "")}/ws/v1/events${sinceIso ? `?since=${sinceIso}` : ""}`);
+		const exitWhenQuiet = sinceIso !== void 0 && !args.follow && untilDate === void 0;
+		const printed = yield* Ref.make(0);
+		const endNote = yield* Ref.make(Option.none());
+		const note = (msg) => Ref.set(endNote, Option.some(msg));
+		const untilReached = (ev) => {
+			if (untilDate === void 0 || !ev.createdAt) return false;
+			const t = new Date(ev.createdAt);
+			return Number.isFinite(t.getTime()) && t >= untilDate;
+		};
+		yield* sdkStream("events stream", (signal) => client.events({
+			...sinceIso !== void 0 ? { since: sinceIso } : {},
+			signal
+		})).pipe(exitWhenQuiet ? Stream.timeoutTo(QUIET_EXIT_AFTER_DRAIN, Stream.drain(Stream.fromEffect(note("history drained, exiting (use --follow to keep streaming)")))) : (s) => s, untilDate !== void 0 ? Stream.takeUntilEffect((ev) => untilReached(ev) ? note("--until reached, exiting").pipe(Effect.as(true)) : Effect.succeed(false)) : (s) => s, Stream.filter((ev) => !untilReached(ev) && filter.matches(ev)), Stream.mapEffect((ev) => Effect.gen(function* () {
+			const decrypted = keyring ? yield* sdkCall("decrypt event", () => tryDecryptEventData(ev, keyring)) : void 0;
+			yield* out.print(formatEvent(ev, args.format, decrypted));
+			const n = yield* Ref.updateAndGet(printed, (x) => x + 1);
+			if (limit !== void 0 && n >= limit) yield* note(`--limit ${limit} reached, exiting`);
+		})), limit !== void 0 ? Stream.take(limit) : (s) => s, Stream.runDrain);
+		yield* Ref.get(endNote).pipe(Effect.flatMap(Option.match({
+			onNone: () => Effect.void,
+			onSome: (msg) => out.info(msg)
+		})));
+		const total = yield* Ref.get(printed);
+		if (args.format === "raw" && total === 0) yield* out.warn("no events matched");
+	}));
+}));
+//#endregion
+//#region src/input-spec.ts
+const SETTING_RE = /^[A-Za-z_][A-Za-z0-9_]*=/;
+function looksLikeSetting(seg) {
+	return SETTING_RE.test(seg);
+}
+function supportedKeys(kind) {
+	if (kind === "text") return ["required", "defaultValue"];
+	if (kind === "choice") return [
+		"required",
+		"multi",
+		"minSelections",
+		"maxSelections"
+	];
+	return ["required"];
+}
+function parseBool(s) {
+	if (s === "true" || s === "yes" || s === "1") return true;
+	if (s === "false" || s === "no" || s === "0") return false;
+	throw new Error(`expected boolean (true/false), got \`${s}\``);
+}
+function parseCount(s, floor) {
+	const n = Number(s);
+	if (!Number.isInteger(n) || n < floor) throw new Error(`expected an integer >= ${floor}, got \`${s}\``);
+	return n;
+}
+function applySetting(spec, seg, kind) {
+	const eq = seg.indexOf("=");
+	if (eq < 0) throw new Error(`expected \`key=value\` segment, got \`${seg}\``);
+	const key = seg.slice(0, eq).trim();
+	const value = seg.slice(eq + 1).trim();
+	if (key === "required") {
+		spec.required = parseBool(value);
+		return;
+	}
+	if (key === "defaultValue") {
+		if (kind !== "text") throw new Error("`defaultValue=` is not supported on this input type (only --text-input)");
+		spec.defaultValue = value;
+		return;
+	}
+	if (key === "multi") {
+		if (kind !== "choice") throw new Error("`multi=` is not supported on this input type (only --choice-input)");
+		spec.multi = parseBool(value);
+		return;
+	}
+	if (key === "minSelections") {
+		if (kind !== "choice") throw new Error("`minSelections=` is not supported on this input type (only --choice-input)");
+		spec.minSelections = parseCount(value, 0);
+		return;
+	}
+	if (key === "maxSelections") {
+		if (kind !== "choice") throw new Error("`maxSelections=` is not supported on this input type (only --choice-input)");
+		spec.maxSelections = parseCount(value, 1);
+		return;
+	}
+	throw new Error(`unknown input setting \`${key}=\`; supported: ${supportedKeys(kind).join(", ")}`);
+}
+function splitUnescaped(s, sep) {
+	const out = [];
+	let cur = "";
+	for (let i = 0; i < s.length; i++) {
+		const c = s[i];
+		if (c === "\\") {
+			const next = s[i + 1];
+			if (next === sep || next === "\\") {
+				cur += next;
+				i += 1;
+				continue;
+			}
+			cur += c;
+			continue;
+		}
+		if (c === sep) {
+			out.push(cur);
+			cur = "";
+			continue;
+		}
+		cur += c;
+	}
+	out.push(cur);
+	return out;
+}
+function parseInputSpec(raw, kind) {
+	const segments = splitUnescaped(raw, ";");
+	const first = segments.shift() ?? "";
+	const spec = { required: true };
+	if (first !== "") spec.description = first;
+	for (const seg of segments) applySetting(spec, seg, kind);
+	return spec;
+}
+function parseChoiceSpec(raw) {
+	const segments = splitUnescaped(raw, ";");
+	const nonSettings = [];
+	const settings = [];
+	for (const seg of segments) (looksLikeSetting(seg) ? settings : nonSettings).push(seg);
+	let description;
+	let optionsRaw;
+	if (nonSettings.length === 0) throw new Error("--choice-input requires a comma-separated options list");
+	else if (nonSettings.length === 1) optionsRaw = nonSettings[0];
+	else if (nonSettings.length === 2) {
+		description = nonSettings[0] !== "" ? nonSettings[0] : void 0;
+		optionsRaw = nonSettings[1];
+	} else throw new Error("--choice-input has too many `;`-separated non-setting segments (expected `[description;]options[;key=value...]`)");
+	const options = optionsRaw.split(",").map((s) => s.trim()).filter((s) => s.length > 0);
+	if (options.length === 0) throw new Error("--choice-input options list is empty");
+	const spec = { required: true };
+	if (description !== void 0) spec.description = description;
+	for (const seg of settings) applySetting(spec, seg, "choice");
+	return {
+		spec,
+		options
+	};
+}
+const VALID_ACTION_STYLES = new Set([
+	"default",
+	"primary",
+	"destructive"
+]);
+function parseActionToken(token) {
+	const eq = token.indexOf("=");
+	if (eq < 0) throw new Error(`each action must be \`key=Label[:style]\`, got \`${token}\``);
+	const key = token.slice(0, eq).trim();
+	let label = token.slice(eq + 1).trim();
+	if (key.length === 0) throw new Error(`action key must not be empty in \`${token}\``);
+	if (label.length === 0) throw new Error(`action label must not be empty in \`${token}\``);
+	let style;
+	const lastColon = label.lastIndexOf(":");
+	if (lastColon >= 0) {
+		const maybe = label.slice(lastColon + 1).trim();
+		if (VALID_ACTION_STYLES.has(maybe)) {
+			style = maybe;
+			label = label.slice(0, lastColon).trim();
+			if (label.length === 0) throw new Error(`action label must not be empty in \`${token}\``);
+		}
+	}
+	return style ? {
+		key,
+		label,
+		style
+	} : {
+		key,
+		label
+	};
+}
+function parseActionsSpec(raw) {
+	const segments = splitUnescaped(raw, ";");
+	const settings = [];
+	const nonSettings = [];
+	for (const seg of segments) (/^\s*required\s*=/.test(seg) ? settings : nonSettings).push(seg);
+	let description;
+	let actionsRaw;
+	if (nonSettings.length === 0) throw new Error("--action-input requires a comma-separated `key=Label[:style]` list");
+	else if (nonSettings.length === 1) actionsRaw = nonSettings[0];
+	else if (nonSettings.length === 2) {
+		description = nonSettings[0] !== "" ? nonSettings[0] : void 0;
+		actionsRaw = nonSettings[1];
+	} else throw new Error("--action-input has too many `;`-separated non-setting segments (expected `[description;]key=Label[:style],...[;required=...]`)");
+	const actions = splitUnescaped(actionsRaw, ",").map((s) => s.trim()).filter((s) => s.length > 0).map(parseActionToken);
+	if (actions.length === 0) throw new Error("--action-input list is empty");
+	const seenKeys = /* @__PURE__ */ new Set();
+	for (const a of actions) {
+		if (seenKeys.has(a.key)) throw new Error(`duplicate action key: \`${a.key}\``);
+		seenKeys.add(a.key);
+	}
+	const spec = { required: true };
+	if (description !== void 0) spec.description = description;
+	for (const seg of settings) applySetting(spec, seg, "actions");
+	return {
+		spec,
+		actions
+	};
+}
+function parseNum(s, name) {
+	const n = Number(s);
+	if (!Number.isFinite(n)) throw new Error(`slider \`${name}\` must be a number, got \`${s}\``);
+	return n;
+}
+function parseSliderSpec(raw) {
+	const segments = splitUnescaped(raw, ";");
+	let description;
+	const settings = [];
+	segments.forEach((seg, i) => {
+		if (i === 0 && !looksLikeSetting(seg)) {
+			if (seg !== "") description = seg;
+		} else settings.push(seg);
+	});
+	let min, max, step, defaultValue;
+	let unit;
+	let required = true;
+	for (const seg of settings) {
+		const eq = seg.indexOf("=");
+		if (eq < 0) throw new Error(`expected \`key=value\` segment, got \`${seg}\``);
+		const key = seg.slice(0, eq).trim();
+		const value = seg.slice(eq + 1).trim();
+		switch (key) {
+			case "min":
+				min = parseNum(value, "min");
+				break;
+			case "max":
+				max = parseNum(value, "max");
+				break;
+			case "step":
+				step = parseNum(value, "step");
+				break;
+			case "unit":
+				unit = value;
+				break;
+			case "default":
+				defaultValue = parseNum(value, "default");
+				break;
+			case "required":
+				required = parseBool(value);
+				break;
+			default: throw new Error(`unknown slider setting \`${key}=\`; supported: min, max, step, unit, default, required`);
+		}
+	}
+	if (min === void 0 || max === void 0) throw new Error("--slider-input requires `min=` and `max=`");
+	if (min >= max) throw new Error("--slider-input `min` must be less than `max`");
+	if (step !== void 0 && step <= 0) throw new Error("--slider-input `step` must be positive");
+	if (defaultValue !== void 0 && (defaultValue < min || defaultValue > max)) throw new Error("--slider-input `default` must be within [min, max]");
+	const spec = { required };
+	if (description !== void 0) spec.description = description;
+	return {
+		spec,
+		slider: {
+			min,
+			max,
+			...step !== void 0 ? { step } : {},
+			...unit !== void 0 && unit !== "" ? { unit } : {},
+			...defaultValue !== void 0 ? { defaultValue } : {}
+		}
+	};
+}
+function textInputJson(spec) {
+	const out = {
+		type: "text",
+		required: spec.required
+	};
+	if (spec.description !== void 0) out.description = spec.description;
+	if (spec.defaultValue !== void 0) out.defaultValue = spec.defaultValue;
+	return out;
+}
+function simpleInputJson(type, spec) {
+	const out = {
+		type,
+		required: spec.required
+	};
+	if (spec.description !== void 0) out.description = spec.description;
+	return out;
+}
+function choiceInputJson(spec, options) {
+	const out = {
+		type: "choice",
+		required: spec.required,
+		options
+	};
+	if (spec.description !== void 0) out.description = spec.description;
+	if (spec.multi) out.multi = true;
+	if (spec.minSelections !== void 0) out.minSelections = spec.minSelections;
+	if (spec.maxSelections !== void 0) out.maxSelections = spec.maxSelections;
+	return out;
+}
+function sliderInputJson(spec, slider) {
+	const out = {
+		type: "slider",
+		required: spec.required,
+		min: slider.min,
+		max: slider.max,
+		...slider.step !== void 0 ? { step: slider.step } : {},
+		...slider.unit !== void 0 ? { unit: slider.unit } : {},
+		...slider.defaultValue !== void 0 ? { defaultValue: slider.defaultValue } : {}
+	};
+	if (spec.description !== void 0) out.description = spec.description;
+	return out;
+}
+function actionsInputJson(spec, actions) {
+	const out = {
+		type: "actions",
+		required: spec.required,
+		actions
+	};
+	if (spec.description !== void 0) out.description = spec.description;
+	return out;
+}
+/** Parse every `--*-input` flag into the ordered `Input[]` sent on the wire.
+* Shared between `sp task` and `sp subtask`. Inputs are emitted grouped by kind
+* (text, choice, actions, slider, photo, voice, file, location). */
+function buildInputs(args) {
+	const out = [];
+	for (const raw of args["text-input"] ?? []) out.push(textInputJson(parseInputSpec(raw, "text")));
+	for (const raw of args["choice-input"] ?? []) {
+		const { spec, options } = parseChoiceSpec(raw);
+		out.push(choiceInputJson(spec, options));
+	}
+	for (const raw of args["action-input"] ?? []) {
+		const { spec, actions } = parseActionsSpec(raw);
+		out.push(actionsInputJson(spec, actions));
+	}
+	for (const raw of args["slider-input"] ?? []) {
+		const { spec, slider } = parseSliderSpec(raw);
+		out.push(sliderInputJson(spec, slider));
+	}
+	for (const raw of args["photo-input"] ?? []) out.push(simpleInputJson("photo", parseInputSpec(raw, "photo")));
+	for (const raw of args["voice-recording-input"] ?? []) out.push(simpleInputJson("voiceRecording", parseInputSpec(raw, "voiceRecording")));
+	for (const raw of args["file-input"] ?? []) out.push(simpleInputJson("file", parseInputSpec(raw, "file")));
+	for (const raw of args["location-input"] ?? []) out.push(simpleInputJson("location", parseInputSpec(raw, "location")));
+	return out;
+}
+//#endregion
+//#region src/commands/notify.ts
+const NOTIFY_MEDIA_TYPES = {
+	image: new Set([
+		"image/jpeg",
+		"image/png",
+		"image/gif"
+	]),
+	audio: new Set([
+		"audio/aiff",
+		"audio/x-aiff",
+		"audio/wav",
+		"audio/x-wav",
+		"audio/vnd.wave",
+		"audio/mpeg",
+		"audio/mp3",
+		"audio/mp4",
+		"audio/aac",
+		"audio/x-m4a"
+	])
+};
+const NOTIFY_MEDIA_EXT = {
+	png: "image/png",
+	jpg: "image/jpeg",
+	jpeg: "image/jpeg",
+	gif: "image/gif",
+	aiff: "audio/aiff",
+	aif: "audio/aiff",
+	wav: "audio/wav",
+	mp3: "audio/mpeg",
+	m4a: "audio/mp4",
+	aac: "audio/aac"
+};
+/** Derive + validate the media content type from a URL's extension, or null if
+* unsupported for the kind. */
+function notifyMediaContentType(url, kind) {
+	const clean = url.split("?")[0] ?? url;
+	const ct = NOTIFY_MEDIA_EXT[clean.slice(clean.lastIndexOf(".") + 1).toLowerCase()];
+	return ct && NOTIFY_MEDIA_TYPES[kind].has(ct) ? ct : null;
+}
+const contentOption$2 = Options.text("content").pipe(Options.withDescription("Notification body. Encrypted under the org master_key when the vault is unlocked, plaintext otherwise."));
+const titleOption$2 = Options.text("title").pipe(Options.withDescription("Optional notification title shown above the body on the recipient's lock screen."), Options.optional);
+const memberOption$1 = Options.text("member").pipe(Options.withAlias("m"), Options.withDescription("Send to a single org member by display name (case-insensitive). Org send; mutually exclusive with --broadcast, --org-topic, and -k/--topic."), Options.optional);
+const broadcastOption$1 = Options.boolean("broadcast").pipe(Options.withAlias("b"), Options.withDescription("Send to every member of the org. Org send; mutually exclusive with --member, --org-topic, and -k/--topic."));
+const orgTopicOption$1 = Options.text("org-topic").pipe(Options.withAlias("o"), Options.withDescription("Send to an org topic by value (from `sp org topics list`). Org send; mutually exclusive with --member, --broadcast, and -k/--topic (the personal topic)."), Options.optional);
+const tagOption$1 = Options.text("tag").pipe(Options.withDescription("Optional notification tag — recipients can use it to coalesce / replace prior notifications with the same tag."), Options.optional);
+const imageOption = Options.text("image").pipe(Options.withDescription("Image URL to show in the push (PNG/JPEG/GIF). Renders on iOS + Android. Mutually exclusive with --audio. URLs only — file uploads are SDK-only."), Options.optional);
+const audioOption = Options.text("audio").pipe(Options.withDescription("Audio URL to play inline in the push (AIFF/WAV/MP3/M4A; iOS only). Mutually exclusive with --image. URLs only."), Options.optional);
+const noEncryptOption$2 = Options.boolean("no-encrypt").pipe(Options.withDescription("Send the body in plaintext even when an unlocked vault is available."));
+const actionInputOption = Options.text("action-input").pipe(Options.withAlias("a"), Options.withDescription("Add an actions input: tap-buttons the recipient answers with (e.g. Accept/Deny). Format: `[description;]key=Label[:style],...`, actions comma-separated; style is default|destructive. Use `\\,` for a literal comma in a label. A notification carries at most one input."), Options.optional);
+const textInputOption = Options.boolean("text-input").pipe(Options.withDescription("Add a free-text reply input the recipient types an answer into. Mutually exclusive with --choice-input / --action-input (a notification carries at most one input)."));
+const choiceInputOption = Options.text("choice-input").pipe(Options.withAlias("c"), Options.withDescription("Add a single-choice input: a comma-separated options list (e.g. \"Approve,Deny\") the recipient picks one of. Notifications are single-select only. Mutually exclusive with --text-input / --action-input."), Options.optional);
+const sharedOption$1 = Options.boolean("shared").pipe(Options.withDescription("Shared mode: ONE notification all recipients see and answer together (the first reply completes it for everyone). Default (without this flag) is independent mode: every recipient gets their own notification instance under a group."));
+const formatOption$1 = Options.choice("format", ["text", "json"]).pipe(Options.withDescription("stdout format for a send: `text` (the bare id, default) or `json` (a `sent` line piped to `sp collect`)."), Options.withDefault("text"));
+/** Parse the (at most one) notification input off the three flags. */
+const parseNotificationInput = (textInputOn, choiceRaw, actionRaw) => Effect.gen(function* () {
+	if ([
+		textInputOn,
+		choiceRaw !== void 0,
+		actionRaw !== void 0
+	].filter(Boolean).length > 1) return yield* Effect.fail(new UserError({ message: "a notification carries at most one input: pass only one of --text-input, --choice-input, or --action-input" }));
+	if (textInputOn) return { type: "text" };
+	if (choiceRaw !== void 0) {
+		const options = choiceRaw.split(",").map((o) => o.trim()).filter((o) => o.length > 0);
+		if (options.length === 0) return yield* Effect.fail(new UserError({ message: "--choice-input needs at least one comma-separated option" }));
+		return {
+			type: "choice",
+			options
+		};
+	}
+	if (actionRaw !== void 0) {
+		const actions = yield* Effect.try({
+			try: () => parseActionsSpec(actionRaw).actions,
+			catch: (e) => new UserError({ message: e instanceof Error ? e.message : String(e) })
+		});
+		const primary = actions.find((a) => a.style === "primary");
+		if (primary !== void 0) return yield* Effect.fail(new UserError({ message: `notification action styles must be 'default' or 'destructive' (got 'primary' on key \`${primary.key}\`) — 'primary' is task-only` }));
+		return {
+			type: "actions",
+			actions: actions.map((a) => ({
+				key: a.key,
+				label: a.label,
+				...a.style !== void 0 ? { style: a.style } : {}
+			}))
+		};
+	}
+});
+const notifyCommand = Command.make("notify", {
+	content: contentOption$2,
+	title: titleOption$2,
+	member: memberOption$1,
+	broadcast: broadcastOption$1,
+	"org-topic": orgTopicOption$1,
+	tag: tagOption$1,
+	image: imageOption,
+	audio: audioOption,
+	"text-input": textInputOption,
+	"choice-input": choiceInputOption,
+	"action-input": actionInputOption,
+	shared: sharedOption$1,
+	format: formatOption$1,
+	noEncrypt: noEncryptOption$2,
+	topic: topicOption,
+	"api-token": apiTokenOption,
+	password: passwordOption,
+	"base-url": baseUrlOption,
+	quiet: quietOption
+}, (args) => Effect.gen(function* () {
+	const out = yield* CliOutput;
+	yield* out.setQuiet(args.quiet);
+	const memberName = Option.getOrUndefined(args.member);
+	const orgTopicName = Option.getOrUndefined(args["org-topic"]);
+	const personalTopic = args.topic[0];
+	const isOrgTarget = memberName !== void 0 || args.broadcast || orgTopicName !== void 0;
+	if ([
+		memberName !== void 0,
+		args.broadcast,
+		orgTopicName !== void 0,
+		personalTopic !== void 0
+	].filter(Boolean).length > 1) return yield* Effect.fail(new UserError({ message: "pass at most one target: -m <member> | -b (broadcast) | -o <org-topic> | -t <topic> (omit all for a self-send)" }));
+	const titleOpt = Option.getOrUndefined(args.title);
+	const tagOpt = Option.getOrUndefined(args.tag);
+	const message = args.content;
+	const imageUrl = Option.getOrUndefined(args.image);
+	const audioUrl = Option.getOrUndefined(args.audio);
+	if (imageUrl !== void 0 && audioUrl !== void 0) return yield* Effect.fail(new UserError({ message: "only one of --image or --audio may be set" }));
+	const mediaUrl = imageUrl ?? audioUrl;
+	const mediaKind = imageUrl !== void 0 ? "image" : "audio";
+	let mediaContentType;
+	if (mediaUrl !== void 0) {
+		if (!/^https?:\/\//.test(mediaUrl)) return yield* Effect.fail(new UserError({ message: "notification media from the CLI must be an http(s) URL; file uploads aren't supported here (use the SDK)" }));
+		const contentType = notifyMediaContentType(mediaUrl, mediaKind);
+		if (contentType === null) return yield* Effect.fail(new UserError({ message: `--${mediaKind} URL must point to a supported ${mediaKind} type (by extension); got "${mediaUrl}"` }));
+		mediaContentType = contentType;
+	}
+	const input = yield* parseNotificationInput(args["text-input"], Option.getOrUndefined(args["choice-input"]), Option.getOrUndefined(args["action-input"]));
+	if (isOrgTarget) {
+		const api = yield* Api;
+		const vault = yield* (yield* VaultAccess).forSendOrPlaintext(args.noEncrypt);
+		const target = memberName !== void 0 ? { member: memberName } : args.broadcast ? { broadcast: true } : { topic: orgTopicName };
+		const media = mediaUrl !== void 0 ? {
+			type: "link",
+			url: mediaUrl,
+			contentType: mediaContentType
+		} : void 0;
+		const masterKey = vault ? {
+			key: vault.masterKeyCurrent.key,
+			version: vault.masterKeyCurrent.version
+		} : void 0;
+		const opts = {
+			content: message,
+			...titleOpt !== void 0 ? { title: titleOpt } : {},
+			...tagOpt !== void 0 ? { tag: tagOpt } : {},
+			...input !== void 0 ? { input } : {},
+			...args.shared ? { shared: true } : {}
+		};
+		const body = yield* sdkCall("build notification request", () => buildOrgNotificationRequest(target, opts, media, masterKey));
+		const payload = yield* api.postJson("notify", "/v1/org/notifications/json", Schema.Unknown, body);
+		const encNote = vault ? ` (encrypted under master_key v${vault.masterKeyCurrent.version})` : " (plaintext)";
+		if (isNotificationGroupResponse(payload)) {
+			const n = payload.instances.length;
+			yield* out.info(`notification group created: ${payload.groupId} (${n} recipient${n === 1 ? "" : "s"})${encNote}`);
+			yield* Effect.forEach(payload.instances, (inst) => {
+				const who = `${inst.recipient.publicId}${inst.recipient.name ? ` (${inst.recipient.name})` : ""}`;
+				return out.info(`instance: ${who} -> ${inst.notificationId}`);
+			});
+			if (n === 0) yield* out.warn("the target has no recipients — the group is empty");
+			if (args.format === "json") {
+				const members = payload.instances.map((inst) => ({
+					id: inst.notificationId,
+					kind: "notification",
+					recipient: {
+						publicId: inst.recipient.publicId,
+						name: inst.recipient.name ?? null
+					}
+				}));
+				yield* out.print(formatSent(payload.groupId, payload.createdAt, members));
+			} else yield* out.print(payload.groupId);
+		} else {
+			yield* out.info(`Notification sent${encNote}.`);
+			yield* out.info(`Id:      ${payload.notificationId}`);
+			yield* out.info(`Created: ${payload.createdAt}`);
+			if (args.format === "json") yield* out.print(formatSent(void 0, payload.createdAt, [{
+				id: payload.notificationId,
+				kind: "notification",
+				recipient: null
+			}]));
+			else yield* out.print(payload.notificationId);
+		}
+		return;
+	}
+	const apiToken = yield* requireApiToken(args["api-token"]);
+	const encrypting = willEncrypt(args.password, personalTopic);
+	if (encrypting) yield* out.info("encrypting outgoing notification (Argon2id, this takes a moment)");
+	const encNote = encrypting ? " (encrypted)" : " (plaintext)";
+	const baseOpts = {
+		content: message,
+		...titleOpt !== void 0 ? { title: titleOpt } : {},
+		...tagOpt !== void 0 ? { tag: tagOpt } : {},
+		...input !== void 0 ? { input } : {},
+		...imageUrl !== void 0 ? { image: imageUrl } : {},
+		...audioUrl !== void 0 ? { audio: audioUrl } : {}
+	};
+	yield* Effect.scoped(Effect.gen(function* () {
+		const client = yield* acquireClient({
+			baseUrl: args["base-url"],
+			apiToken,
+			passwords: [...args.password]
+		});
+		const printSingle = (note) => args.format === "json" ? out.print(formatSent(void 0, note.createdAt, [{
+			id: note.notificationId,
+			kind: "notification",
+			recipient: null
+		}])) : out.print(note.notificationId);
+		if (personalTopic === void 0) {
+			const note = yield* sdkCall("notify", () => client.sendNotification(baseOpts));
+			yield* out.info(`self-send notification sent${encNote}.`);
+			yield* out.info(`Id:      ${note.notificationId}`);
+			yield* printSingle(note);
+		} else if (args.shared) {
+			const note = yield* sdkCall("notify", () => client.sendNotification({
+				...baseOpts,
+				topic: personalTopic,
+				shared: true
+			}));
+			yield* out.info(`notification sent${encNote}.`);
+			yield* out.info(`Id:      ${note.notificationId}`);
+			yield* printSingle(note);
+		} else {
+			const group = yield* sdkCall("notify", () => client.sendNotification({
+				...baseOpts,
+				topic: personalTopic
+			}));
+			const n = group.instances.length;
+			yield* out.info(`notification group created: ${group.groupId} (${n} recipient${n === 1 ? "" : "s"})${encNote}`);
+			yield* Effect.forEach(group.instances, (inst) => {
+				const who = `${inst.recipient?.publicId ?? "unknown"}${inst.recipient?.name ? ` (${inst.recipient.name})` : ""}`;
+				return out.info(`instance: ${who} -> ${inst.notificationId}`);
+			});
+			if (n === 0) yield* out.warn("the topic has no recipients — the group is empty");
+			if (args.format === "json") {
+				const members = group.instances.map((inst) => ({
+					id: inst.notificationId,
+					kind: "notification",
+					recipient: inst.recipient ? {
+						publicId: inst.recipient.publicId,
+						name: inst.recipient.name ?? null
+					} : null
+				}));
+				yield* out.print(formatSent(group.groupId, group.createdAt, members));
+			} else yield* out.print(group.groupId);
+		}
+	}));
+}));
+//#endregion
+//#region src/commands/org-encryption.ts
+const WrappedKey = Schema.Struct({
+	version: Schema.Number,
+	blob: Schema.String
+});
+const OrgEncryptionDeviceSummary = Schema.Struct({
+	deviceId: Schema.String,
+	devicePubkeyB64: Schema.String,
+	inviteHmacB64: Schema.String,
+	wrappedKeys: Schema.Array(WrappedKey)
+});
+const ListOrgEncryptionDevicesResponse = Schema.Struct({ devices: Schema.Array(OrgEncryptionDeviceSummary) });
+const fetchEncryptionDevices = Effect.gen(function* () {
+	const { devices } = yield* (yield* Api).getJson("fetch encryption devices", "/v1/org/encryption/devices", ListOrgEncryptionDevicesResponse);
+	return devices;
+});
+const yesIWroteItDownOption = Options.boolean("i-saved-the-passphrase").pipe(Options.withDescription("Confirm you have copied the passphrase somewhere safe. The passphrase is the only way to unlock the org's encryption vault on another machine; if lost, the only recovery is to re-enable encryption and re-onboard every device."));
+const enableCommand = Command.make("enable", {
+	confirm: yesIWroteItDownOption,
+	quiet: quietOption
+}, (args) => Effect.gen(function* () {
+	const out = yield* CliOutput;
+	yield* out.setQuiet(args.quiet);
+	const api = yield* Api;
+	const access = yield* VaultAccess;
+	const vaultStore = yield* VaultStore;
+	const sodium = yield* Sodium;
+	if ((yield* access.fetchConfig).enabled) {
+		yield* out.error("encryption is already enabled for this org. Use `sp org encryption key rotate` to rotate the key.");
+		return yield* Effect.fail(new Aborted());
+	}
+	const passphrase = yield* sodium.generatePassphrase();
+	const vaultSalt = yield* sodium.generateVaultSalt;
+	const adminKp = yield* sodium.generateAdminKeyPair;
+	const masterKey = yield* sodium.generateMasterKey;
+	const vaultContents = {
+		adminPublicKey: adminKp.publicKey,
+		adminPrivateKey: adminKp.privateKey,
+		masterKeyCurrent: {
+			version: 1,
+			key: masterKey
+		},
+		masterKeyHistory: []
+	};
+	const vaultKey = yield* sodium.deriveVaultKey(passphrase, vaultSalt, DEFAULT_KDF_PARAMS);
+	const vaultBlob = yield* sodium.encryptVault(vaultContents, vaultKey);
+	yield* out.info("");
+	yield* out.info("=== ORG ENCRYPTION PASSPHRASE — copy this now, it will not be shown again ===");
+	yield* out.info("");
+	yield* out.print(`  ${passphrase}`);
+	yield* out.info("");
+	yield* out.info("This passphrase is the ONLY way to:");
+	yield* out.info("  - unlock the encryption vault from another admin's machine");
+	yield* out.info("  - recover access if your CLI state is lost");
+	yield* out.info("It cannot be recovered if forgotten. Re-enabling encryption forces");
+	yield* out.info("every member device to re-onboard from scratch.");
+	yield* out.info("");
+	if (!args.confirm) {
+		yield* out.info("Re-run with --i-saved-the-passphrase to push this config to the server.");
+		return yield* Effect.fail(new Aborted());
+	}
+	yield* api.post("enable", "/v1/org/encryption/enable", {
+		adminPubkeyB64: sodium.toB64(adminKp.publicKey),
+		vaultBlobB64: sodium.toB64(vaultBlob),
+		vaultSaltB64: sodium.toB64(vaultSalt),
+		kdfParams: DEFAULT_KDF_PARAMS
+	});
+	yield* vaultStore.save(vaultContents);
+	yield* out.info("Encryption enabled. master_key version 1 generated.");
+	yield* out.info("Local vault cached at ~/.config/simplepush/vault.json (subsequent commands won't prompt).");
+}));
+const statusCommand = Command.make("status", { quiet: quietOption }, (args) => Effect.gen(function* () {
+	const out = yield* CliOutput;
+	yield* out.setQuiet(args.quiet);
+	const access = yield* VaultAccess;
+	const vaultStore = yield* VaultStore;
+	const sodium = yield* Sodium;
+	const cfg = yield* access.fetchConfig;
+	if (!cfg.enabled) {
+		yield* out.print("Encryption: disabled");
+		return yield* out.info("Run `org encryption enable` to set it up.");
+	}
+	yield* out.print("Encryption:   enabled");
+	yield* out.print(`Admin pubkey: ${cfg.adminPubkeyB64 ?? "?"}`);
+	const vault = Option.getOrUndefined(yield* vaultStore.load);
+	const cacheStale = vault !== void 0 && typeof cfg.adminPubkeyB64 === "string" && !sodium.constantTimeEqual(vault.adminPublicKey, sodium.fromB64(cfg.adminPubkeyB64));
+	yield* out.print(`Vault cache:  ${vault ? cacheStale ? "STALE (doesn't match this org — next encryption command re-prompts)" : `present (master_key v${vault.masterKeyCurrent.version})` : "absent (next encryption command will prompt)"}`);
+	const devices = yield* fetchEncryptionDevices;
+	const currentVersion = cacheStale ? void 0 : vault?.masterKeyCurrent.version;
+	const upToDate = currentVersion === void 0 ? 0 : devices.filter((d) => d.wrappedKeys.some((w) => w.version === currentVersion)).length;
+	const pending = devices.length - upToDate;
+	yield* out.print(`Devices onboarded: ${devices.length}`);
+	if (currentVersion !== void 0) {
+		yield* out.print(`  current key wrapped:  ${upToDate}`);
+		yield* out.print(`  pending sync:         ${pending}`);
+		if (pending > 0) yield* out.info("Run `org encryption sync` to wrap the current master key to pending devices.");
+	} else yield* out.info("Local vault cache is absent — `org encryption sync` will prompt for the passphrase.");
+}));
+const wrapCurrentKeyToAllDevices = (vault) => Effect.gen(function* () {
+	const out = yield* CliOutput;
+	const api = yield* Api;
+	const invites = yield* InviteStore;
+	const sodium = yield* Sodium;
+	const devices = yield* fetchEncryptionDevices;
+	const knownInvites = yield* invites.listValid;
+	const currentMaster = vault.masterKeyCurrent;
+	let counts = {
+		wrapped: 0,
+		alreadyCurrent: 0,
+		unverified: 0,
+		failed: 0
+	};
+	yield* Effect.forEach(devices, (dev) => Effect.gen(function* () {
+		const pubkey = sodium.fromB64(dev.devicePubkeyB64);
+		const storedHmac = sodium.fromB64(dev.inviteHmacB64);
+		const matchedInvite = knownInvites.find((inv) => sodium.constantTimeEqual(sodium.hmacInviteBinding(inv.code, pubkey), storedHmac));
+		if (!matchedInvite) {
+			counts = {
+				...counts,
+				unverified: counts.unverified + 1
+			};
+			return yield* out.error(`device ${dev.deviceId}: HMAC doesn't match any locally-known invite — skipping. (This device joined via an invite issued from a different CLI install, or the invite has been pruned.)`);
+		}
+		if (dev.wrappedKeys.some((w) => w.version === currentMaster.version)) {
+			counts = {
+				...counts,
+				alreadyCurrent: counts.alreadyCurrent + 1
+			};
+			return;
+		}
+		const blob = yield* sodium.wrapMasterKey(currentMaster.key, vault.adminPrivateKey, pubkey);
+		const nextWraps = [...dev.wrappedKeys.filter((w) => w.version !== currentMaster.version), {
+			version: currentMaster.version,
+			blob: sodium.toB64(blob)
+		}];
+		yield* api.put("device wrap", `/v1/org/encryption/devices/${encodeURIComponent(dev.deviceId)}/wraps`, { wraps: nextWraps }).pipe(Effect.matchEffect({
+			onFailure: (e) => Effect.sync(() => {
+				counts = {
+					...counts,
+					failed: counts.failed + 1
+				};
+			}).pipe(Effect.zipRight(out.error(`device wrap failed (${"status" in e ? e.status : "?"}): ${"detail" in e ? e.detail : String(e)}`))),
+			onSuccess: () => Effect.gen(function* () {
+				counts = {
+					...counts,
+					wrapped: counts.wrapped + 1
+				};
+				yield* invites.consume(matchedInvite.code).pipe(Effect.ignore);
+			})
+		}));
+	}), { discard: true });
+	return counts;
+});
+const summarize = (counts) => `wrapped=${counts.wrapped} already-current=${counts.alreadyCurrent} unverified=${counts.unverified}`;
+const syncCommand = Command.make("sync", { quiet: quietOption }, (args) => Effect.gen(function* () {
+	const out = yield* CliOutput;
+	yield* out.setQuiet(args.quiet);
+	const counts = yield* wrapCurrentKeyToAllDevices(yield* (yield* VaultAccess).getOrPrompt);
+	yield* out.info(`Sync complete. ${summarize(counts)}`);
+	if (counts.unverified > 0) yield* out.info("Unverified devices were left untouched — their pubkeys weren't bound to any invite code this CLI knows about.");
+	if (counts.failed > 0) return yield* Effect.fail(new Aborted());
+}));
+const keyShowCommand = Command.make("show", { quiet: quietOption }, (args) => Effect.gen(function* () {
+	const out = yield* CliOutput;
+	yield* out.setQuiet(args.quiet);
+	const access = yield* VaultAccess;
+	const sodium = yield* Sodium;
+	const vault = yield* access.getOrPrompt;
+	yield* out.info(`Current encryption key (master_key v${vault.masterKeyCurrent.version}):`);
+	yield* out.print(sodium.toB64(vault.masterKeyCurrent.key));
+	yield* out.info("Use this value plus the org API key when configuring library clients.");
+	yield* out.info("If it ever leaks, run `sp org encryption key rotate` to invalidate it.");
+}));
+const keyRotateCommand = Command.make("rotate", { quiet: quietOption }, (args) => Effect.gen(function* () {
+	const out = yield* CliOutput;
+	yield* out.setQuiet(args.quiet);
+	const api = yield* Api;
+	const access = yield* VaultAccess;
+	const vaultStore = yield* VaultStore;
+	const sodium = yield* Sodium;
+	const { vault, vaultKey } = yield* access.unlockForRotation;
+	const nextVersion = vault.masterKeyCurrent.version + 1;
+	const nextVault = {
+		adminPublicKey: vault.adminPublicKey,
+		adminPrivateKey: vault.adminPrivateKey,
+		masterKeyCurrent: {
+			version: nextVersion,
+			key: yield* sodium.generateMasterKey
+		},
+		masterKeyHistory: [...vault.masterKeyHistory, vault.masterKeyCurrent]
+	};
+	const cfg = yield* access.fetchConfig.pipe(Effect.flatMap(access.requireEnabled));
+	const newBlob = yield* sodium.encryptVault(nextVault, vaultKey);
+	yield* api.put("vault update", "/v1/org/encryption/vault", {
+		vaultBlobB64: sodium.toB64(newBlob),
+		vaultSaltB64: cfg.vaultSaltB64,
+		kdfParams: cfg.kdfParams
+	});
+	yield* vaultStore.save(nextVault);
+	yield* out.info(`Generated master_key v${nextVersion} and updated the org vault.`);
+	yield* out.info("Wrapping the new key to every onboarded device...");
+	const counts = yield* wrapCurrentKeyToAllDevices(nextVault);
+	yield* out.info(`Rotation complete. ${summarize(counts)}`);
+	yield* out.info("");
+	yield* out.info(`New encryption key (master_key v${nextVersion}):`);
+	yield* out.print(sodium.toB64(nextVault.masterKeyCurrent.key));
+	yield* out.info("Update any library clients with this new value. The previous key remains valid for decrypting historical notifications only.");
+	if (counts.unverified > 0) yield* out.info("Unverified devices were skipped — they'll need a fresh invite redeem before they can pick up the new key.");
+	if (counts.failed > 0) return yield* Effect.fail(new Aborted());
+}));
+const keyCommand = Command.make("key").pipe(Command.withSubcommands([keyShowCommand, keyRotateCommand]));
+const encryptionCommand = Command.make("encryption").pipe(Command.withSubcommands([
+	enableCommand,
+	statusCommand,
+	syncCommand,
+	keyCommand
+]));
+//#endregion
+//#region src/commands/org.ts
+const optionalString = Schema.optional(Schema.NullOr(Schema.String));
+const InviteResponse = Schema.Struct({
+	role: Schema.String,
+	expiresAt: Schema.String,
+	seatsUsed: Schema.Number,
+	seatsTotal: Schema.Number
+});
+const InviteSummary = Schema.Struct({
+	id: Schema.String,
+	name: Schema.String,
+	email: optionalString,
+	role: Schema.String,
+	expiresAt: Schema.String,
+	createdAt: Schema.String
+});
+const MemberSummary = Schema.Struct({
+	id: Schema.String,
+	name: optionalString,
+	email: optionalString,
+	createdAt: Schema.String
+});
+const MembersResponse = Schema.Struct({ members: Schema.Array(MemberSummary) });
+const InvitesResponse = Schema.Struct({ invites: Schema.Array(InviteSummary) });
+const ApiKeyInfoResponse = Schema.Struct({
+	prefix: Schema.String,
+	createdAt: Schema.String,
+	lastRotatedAt: optionalString
+});
+const RotateApiKeyResponse = Schema.Struct({
+	apiKey: Schema.String,
+	prefix: Schema.String,
+	createdAt: Schema.String,
+	lastRotatedAt: optionalString
+});
+const OrgTopicSummary = Schema.Struct({
+	id: Schema.String,
+	value: Schema.String,
+	createdAt: Schema.String
+});
+const ListOrgTopicsResponse = Schema.Struct({ topics: Schema.Array(OrgTopicSummary) });
+const ListOrgTopicMembersResponse = Schema.Struct({ members: Schema.Array(Schema.Struct({
+	id: Schema.String,
+	name: optionalString,
+	email: optionalString
+})) });
+const nameArg = Args.text({ name: "name" }).pipe(Args.withDescription("Display name of the person being invited (used to address them)."));
+const idArg = Args.text({ name: "id" }).pipe(Args.withDescription("Resource id (UUID) — copy from the matching `list` output."));
+const memberNameArg = Args.text({ name: "name" }).pipe(Args.withDescription("Display name of the member to remove (case-insensitive). Per-org names are unique."));
+const roleOption = Options.choice("role", ["member", "admin"]).pipe(Options.withDescription("Role for the invitee. Members consume a seat; admins do not."), Options.withDefault("member"));
+const emailOption = Options.text("email").pipe(Options.withDescription("Optional contact email. Saved on the invite and propagated to user.email on redemption. Not used for sending — just a label."), Options.optional);
+const inviteCommand = Command.make("invite", {
+	name: nameArg,
+	role: roleOption,
+	email: emailOption,
+	quiet: quietOption
+}, (args) => Effect.gen(function* () {
+	const out = yield* CliOutput;
+	yield* out.setQuiet(args.quiet);
+	const api = yield* Api;
+	const invites = yield* InviteStore;
+	const sodium = yield* Sodium;
+	const email = Option.getOrUndefined(args.email);
+	const code = yield* sodium.generateInviteCode;
+	const codeHash = hashInviteCode(code);
+	const body = {
+		name: args.name,
+		role: args.role,
+		codeHash
+	};
+	if (email !== void 0) body.email = email;
+	const payload = yield* api.postJson("invite", "/v1/org/members/invites", InviteResponse, body);
+	yield* invites.append({
+		code,
+		name: args.name,
+		role: args.role,
+		issuedAt: (/* @__PURE__ */ new Date()).toISOString(),
+		expiresAt: payload.expiresAt
+	}).pipe(Effect.catchAll((err) => out.error(`(warning) failed to persist invite locally for encryption sync: ${err instanceof Error ? err.message : String(err)}`)));
+	yield* out.info(`Invite created for ${args.name}${email ? ` <${email}>` : ""} (role: ${payload.role}).`);
+	yield* out.info(`Expires:    ${formatInstant(payload.expiresAt)}`);
+	if (payload.role === "member") yield* out.info(`Seats used: ${payload.seatsUsed} / ${payload.seatsTotal}`);
+	yield* out.print(`Login code: ${code}`);
+}));
+const membersListCommand = Command.make("list", { quiet: quietOption }, (args) => Effect.gen(function* () {
+	const out = yield* CliOutput;
+	yield* out.setQuiet(args.quiet);
+	const { members } = yield* (yield* Api).getJson("list", "/v1/org/members", MembersResponse);
+	if (members.length === 0) return yield* out.info("no active members");
+	yield* Effect.forEach(members, (m) => out.print(`${m.name ?? "(unnamed)"}\t${m.email ?? "-"}\t${formatInstant(m.createdAt)}`));
+}));
+const yesOption = Options.boolean("yes").pipe(Options.withAlias("y"), Options.withDescription("Confirm the removal. Without this flag the command only prints a warning and exits."));
+const resolveMemberByName = (name) => Effect.gen(function* () {
+	const { members } = yield* (yield* Api).getJson("resolve member", "/v1/org/members", MembersResponse);
+	const target = name.trim().toLowerCase();
+	const match = members.find((m) => (m.name ?? "").toLowerCase() === target);
+	if (!match) return yield* Effect.fail(new UserError({ message: `no member named '${name}' — run \`simplepush org members list\` to see members` }));
+	return match;
+});
+const membersRemoveCommand = Command.make("remove", {
+	name: memberNameArg,
+	yes: yesOption,
+	quiet: quietOption
+}, (args) => Effect.gen(function* () {
+	const out = yield* CliOutput;
+	yield* out.setQuiet(args.quiet);
+	const api = yield* Api;
+	const match = yield* resolveMemberByName(args.name).pipe(Effect.mapError((e) => e._tag === "UserError" ? new UserError({ message: `no member named '${args.name}' in this org` }) : e));
+	yield* out.info(`Removing '${match.name ?? args.name}' permanently deletes all of their associated data. Only event history is retained.`);
+	if (!args.yes) {
+		yield* out.info("Re-run with --yes (or -y) to confirm.");
+		return yield* Effect.fail(new Aborted());
+	}
+	yield* api.delete("remove", `/v1/org/members/${encodeURIComponent(match.id)}`);
+	yield* out.info(`removed member ${match.name ?? args.name}`);
+}));
+const invitesListCommand = Command.make("list", { quiet: quietOption }, (args) => Effect.gen(function* () {
+	const out = yield* CliOutput;
+	yield* out.setQuiet(args.quiet);
+	const { invites } = yield* (yield* Api).getJson("list", "/v1/org/members/invites", InvitesResponse);
+	if (invites.length === 0) return yield* out.info("no pending invites");
+	yield* Effect.forEach(invites, (inv) => out.print(`${inv.id}\t${inv.name}\t${inv.email ?? "-"}\t${inv.role}\texpires ${formatInstant(inv.expiresAt)}`));
+}));
+const invitesRevokeCommand = Command.make("revoke", {
+	id: idArg,
+	quiet: quietOption
+}, (args) => Effect.gen(function* () {
+	const out = yield* CliOutput;
+	yield* out.setQuiet(args.quiet);
+	yield* (yield* Api).delete("revoke", `/v1/org/members/invites/${encodeURIComponent(args.id)}`);
+	yield* out.info(`revoked invite ${args.id}`);
+}));
+const membersCommand = Command.make("members").pipe(Command.withSubcommands([
+	inviteCommand,
+	membersListCommand,
+	membersRemoveCommand
+]));
+const invitesCommand = Command.make("invites").pipe(Command.withSubcommands([invitesListCommand, invitesRevokeCommand]));
+const apiKeyInfoCommand = Command.make("info", { quiet: quietOption }, (args) => Effect.gen(function* () {
+	const out = yield* CliOutput;
+	yield* out.setQuiet(args.quiet);
+	const payload = yield* (yield* Api).getJson("info", "/v1/org/api-key", ApiKeyInfoResponse);
+	yield* out.print(`Prefix:       ${payload.prefix}…`);
+	yield* out.print(`Created:      ${formatInstant(payload.createdAt)}`);
+	yield* out.print(`Last rotated: ${payload.lastRotatedAt ? formatInstant(payload.lastRotatedAt) : "never"}`);
+	yield* out.info("(plaintext is unrecoverable; run `api-key rotate` to surface a new key)");
+}));
+const apiKeyRotateCommand = Command.make("rotate", { quiet: quietOption }, (args) => Effect.gen(function* () {
+	const out = yield* CliOutput;
+	yield* out.setQuiet(args.quiet);
+	const payload = yield* (yield* Api).postJson("rotate", "/v1/org/api-key/rotate", RotateApiKeyResponse);
+	yield* out.info("The previous key (if any) is now invalid.");
+	yield* out.print("\nOrganization API key (shown once, copy now):");
+	yield* out.print(`  ${payload.apiKey}`);
+}));
+const apiKeyCommand = Command.make("api-key").pipe(Command.withSubcommands([apiKeyInfoCommand, apiKeyRotateCommand]));
+const topicValueArg = Args.text({ name: "value" }).pipe(Args.withDescription("Topic value (no whitespace, ≤ 255 chars). Case-insensitive uniqueness within the org."));
+const resolveOrgTopicIdByValue = (value) => Effect.gen(function* () {
+	const { topics } = yield* (yield* Api).getJson("list org topics", "/v1/org/topics", ListOrgTopicsResponse);
+	const target = value.trim().toLowerCase();
+	const match = topics.find((t) => t.value.toLowerCase() === target);
+	if (!match) return yield* Effect.fail(new UserError({ message: `no org topic '${value}' — run \`simplepush org topics list\` to see available topics` }));
+	return match.id;
+});
+const topicsCreateCommand = Command.make("create", {
+	value: topicValueArg,
+	quiet: quietOption
+}, (args) => Effect.gen(function* () {
+	const out = yield* CliOutput;
+	yield* out.setQuiet(args.quiet);
+	const payload = yield* (yield* Api).postJson("create", "/v1/org/topics", OrgTopicSummary, { value: args.value });
+	yield* out.info(`Created org topic '${payload.value}'.`);
+}));
+const topicsListCommand = Command.make("list", { quiet: quietOption }, (args) => Effect.gen(function* () {
+	const out = yield* CliOutput;
+	yield* out.setQuiet(args.quiet);
+	const { topics } = yield* (yield* Api).getJson("list", "/v1/org/topics", ListOrgTopicsResponse);
+	if (topics.length === 0) return yield* out.info("no org topics");
+	yield* Effect.forEach(topics, (t) => out.print(`${t.value}\tcreated ${formatInstant(t.createdAt)}`));
+}));
+const topicsDeleteCommand = Command.make("delete", {
+	value: topicValueArg,
+	quiet: quietOption
+}, (args) => Effect.gen(function* () {
+	const out = yield* CliOutput;
+	yield* out.setQuiet(args.quiet);
+	const api = yield* Api;
+	const orgTopicId = yield* resolveOrgTopicIdByValue(args.value);
+	yield* api.delete("delete", `/v1/org/topics/${encodeURIComponent(orgTopicId)}`);
+	yield* out.info(`Deleted org topic '${args.value}'.`);
+}));
+const topicValueAssignArg = Args.text({ name: "topic" }).pipe(Args.withDescription("Org topic value (from `topics list`)."));
+const memberNameAssignArg = Args.text({ name: "member" }).pipe(Args.withDescription("Member display name (case-insensitive, from `members list`)."));
+const topicsAssignCommand = Command.make("assign", {
+	topic: topicValueAssignArg,
+	member: memberNameAssignArg,
+	quiet: quietOption
+}, (args) => Effect.gen(function* () {
+	const out = yield* CliOutput;
+	yield* out.setQuiet(args.quiet);
+	const api = yield* Api;
+	const orgTopicId = yield* resolveOrgTopicIdByValue(args.topic);
+	const member = yield* resolveMemberByName(args.member);
+	yield* api.put("assign", `/v1/org/topics/${encodeURIComponent(orgTopicId)}/members/${encodeURIComponent(member.id)}`);
+	yield* out.info(`Assigned ${args.member} to org topic '${args.topic}'.`);
+}));
+const topicsUnassignCommand = Command.make("unassign", {
+	topic: topicValueAssignArg,
+	member: memberNameAssignArg,
+	quiet: quietOption
+}, (args) => Effect.gen(function* () {
+	const out = yield* CliOutput;
+	yield* out.setQuiet(args.quiet);
+	const api = yield* Api;
+	const orgTopicId = yield* resolveOrgTopicIdByValue(args.topic);
+	const member = yield* resolveMemberByName(args.member);
+	yield* api.delete("unassign", `/v1/org/topics/${encodeURIComponent(orgTopicId)}/members/${encodeURIComponent(member.id)}`);
+	yield* out.info(`Unassigned ${args.member} from org topic '${args.topic}'.`);
+}));
+const topicsMembersCommand = Command.make("members", {
+	topic: topicValueAssignArg,
+	quiet: quietOption
+}, (args) => Effect.gen(function* () {
+	const out = yield* CliOutput;
+	yield* out.setQuiet(args.quiet);
+	const api = yield* Api;
+	const orgTopicId = yield* resolveOrgTopicIdByValue(args.topic);
+	const { members } = yield* api.getJson("members", `/v1/org/topics/${encodeURIComponent(orgTopicId)}/members`, ListOrgTopicMembersResponse);
+	if (members.length === 0) return yield* out.info("no members assigned");
+	yield* Effect.forEach(members, (m) => out.print(`${m.name ?? "(unnamed)"}\t${m.email ?? "-"}`));
+}));
+const topicsCommand = Command.make("topics").pipe(Command.withSubcommands([
+	topicsCreateCommand,
+	topicsListCommand,
+	topicsDeleteCommand,
+	topicsAssignCommand,
+	topicsUnassignCommand,
+	topicsMembersCommand
+]));
+const orgCommand = Command.make("org").pipe(Command.withSubcommands([
+	membersCommand,
+	invitesCommand,
+	apiKeyCommand,
+	topicsCommand,
+	encryptionCommand
+]));
+//#endregion
+//#region src/files.ts
+/** Read each `--file` path into a `FileAttachment` the SDK can upload: bytes +
+* basename + a best-effort content type guessed from the extension (the SDK
+* defaults to application/octet-stream when undefined). */
+const buildFiles = (paths) => Effect.gen(function* () {
+	const fs = yield* FileSystem.FileSystem;
+	return yield* Effect.forEach(paths, (p) => Effect.map(fs.readFile(p), (data) => {
+		const contentType = guessContentType(p);
+		return {
+			filename: basename(p),
+			data,
+			...contentType !== void 0 ? { contentType } : {}
+		};
+	}));
+});
+/** Drive the presign -> PUT -> complete lifecycle for an org send's prepared
+* attachments over the CLI bearer session (`/v1/org/attachments/...` — the
+* bearer-auth'd variants of the attachment lifecycle endpoints). No-op when the
+* send carried no files. Per-file failures are marked `failed` server-side and
+* skipped (the SDK's best-effort semantics) — the task/subtask itself stands. */
+const uploadOrgAttachments = (prepared, created) => Effect.gen(function* () {
+	if (prepared.length === 0) return;
+	const auth = yield* (yield* Api).session;
+	const ctx = {
+		baseUrl: new URL(`${auth.baseUrl.replace(/\/+$/, "")}/`),
+		authHeaders: { Authorization: `Bearer ${bearerToken(auth)}` },
+		basePath: "v1/org/attachments"
+	};
+	yield* sdkCall("upload attachments", () => uploadFileAttachments(ctx, prepared, created ?? []));
+});
+const CONTENT_TYPES = {
+	png: "image/png",
+	jpg: "image/jpeg",
+	jpeg: "image/jpeg",
+	gif: "image/gif",
+	webp: "image/webp",
+	heic: "image/heic",
+	svg: "image/svg+xml",
+	pdf: "application/pdf",
+	txt: "text/plain",
+	json: "application/json",
+	csv: "text/csv",
+	zip: "application/zip",
+	mp4: "video/mp4",
+	mov: "video/quicktime",
+	mp3: "audio/mpeg",
+	m4a: "audio/mp4",
+	wav: "audio/wav"
+};
+function guessContentType(path) {
+	return CONTENT_TYPES[extname(path).slice(1).toLowerCase()];
+}
+//#endregion
+//#region src/commands/task.ts
+const titleOption$1 = Options.text("title").pipe(Options.withDescription("Task title."), Options.optional);
+const contentOption$1 = Options.text("content").pipe(Options.withDescription("Task description / body content."), Options.optional);
+const tagOption = Options.text("tag").pipe(Options.withDescription("Tag the task for receiver-side filtering. Defaults to $SP_TAG."), Options.optional);
+const repeatedText = (name, alias, description) => {
+	const base = Options.text(name).pipe(Options.withDescription(description), Options.repeated);
+	return alias ? Options.withAlias(alias)(base) : base;
+};
+const textInput$1 = repeatedText("text-input", void 0, "Add a text input. Format: `description[;key=value...]`. Settings: `required=true|false` (default true), `defaultValue=...`. Repeatable.");
+const choiceInput$1 = repeatedText("choice-input", "c", "Add a choice input. Format: `[description;]options[;key=value...]`, options comma-separated. Settings: `required=true|false`, `multi=true|false` (allow picking more than one option, default false), `minSelections=<int>`/`maxSelections=<int>` (only with multi). Use `\\;` for a literal semicolon. Repeatable.");
+const actionInput$1 = repeatedText("action-input", "a", "Add an actions input (buttons the recipient taps, e.g. Accept/Deny). Format: `[description;]key=Label[:style],...[;required=true|false]`, actions comma-separated; style is default|primary|destructive. Use `\\,` for a literal comma in a label. Repeatable.");
+const sliderInput$1 = repeatedText("slider-input", "s", "Add a slider input (the recipient picks a number on a scale). Format: `[description;]min=0;max=14;step=0.1;unit=pH;default=7`. `min`/`max` are required; `step`/`unit`/`default` optional. Repeatable.");
+const photoInput$1 = repeatedText("photo-input", void 0, "Add a photo input. Format: `description[;key=value...]`. Settings: `required=true|false`. Repeatable.");
+const voiceRecordingInput$1 = repeatedText("voice-recording-input", void 0, "Add a voice recording input. Format: `description[;key=value...]`. Settings: `required=true|false`. Repeatable.");
+const fileInput$1 = repeatedText("file-input", void 0, "Add a file upload input. Format: `description[;key=value...]`. Settings: `required=true|false`. Repeatable.");
+const locationInput$1 = repeatedText("location-input", void 0, "Add a location input (the recipient shares their device GPS position from the app). Format: `description[;key=value...]`. Settings: `required=true|false`. Repeatable.");
+const linkOption$1 = repeatedText("link", "l", "Attach a remote URL (a link attachment). Repeatable. For local files use --file.");
+const fileOption$1 = repeatedText("file", "f", "Attach a local file, uploaded as a file attachment (encrypted under the send's key — topic password or org master key — when the send is encrypted). Repeatable.");
+const submitOption$1 = Options.boolean("submit").pipe(Options.withDescription("Require the recipient to explicitly submit the task. Without this, it auto-completes once the required inputs are filled."));
+const waitOption = Options.boolean("wait").pipe(Options.withDescription("Block until the task is completed; print the result to stdout. Requires exactly one input on the request."));
+const replyOption = Options.choice("reply", [
+	"one-shot",
+	"sticky",
+	"one-time-per-user"
+]).pipe(Options.withDescription("Show a reply composer on the recipient's task: 'one-shot' (first reply wins, closes the slot), 'sticky' (open indefinitely), 'one-time-per-user' (one reply per user)."), Options.optional);
+const memberOption = Options.text("member").pipe(Options.withAlias("m"), Options.withDescription("Send to a single org member by display name (case-insensitive). Org send; mutually exclusive with --broadcast, --org-topic, and -k/--topic."), Options.optional);
+const broadcastOption = Options.boolean("broadcast").pipe(Options.withAlias("b"), Options.withDescription("Send to every member of the org. Org send; mutually exclusive with --member, --org-topic, and -k/--topic."));
+const orgTopicOption = Options.text("org-topic").pipe(Options.withAlias("o"), Options.withDescription("Send to an org topic by value (from `sp org topics list`). Org send; mutually exclusive with --member, --broadcast, and -k/--topic (which is the personal topic)."), Options.optional);
+const noEncryptOption$1 = Options.boolean("no-encrypt").pipe(Options.withDescription("For org sends: send fields in plaintext even when the org vault is unlocked."));
+const markdownOption$1 = Options.boolean("markdown").pipe(Options.withDescription("Render the task body as Markdown on the recipient's device (sets contentFormat=markdown)."));
+const sharedOption = Options.boolean("shared").pipe(Options.withDescription("Shared mode: ONE task all recipients see and answer together (user A's input is visible to user B). Default (without this flag) is independent mode: every recipient gets their own task instance under a group."));
+const formatOption = Options.choice("format", ["text", "json"]).pipe(Options.withDescription("stdout format for a send: `text` (the bare id, default) or `json` (a `sent` line piped to `sp collect`)."), Options.withDefault("text"));
+const taskCommand = Command.make("task", {
+	title: titleOption$1,
+	content: contentOption$1,
+	tag: tagOption,
+	"text-input": textInput$1,
+	"choice-input": choiceInput$1,
+	"action-input": actionInput$1,
+	"slider-input": sliderInput$1,
+	"photo-input": photoInput$1,
+	"voice-recording-input": voiceRecordingInput$1,
+	"file-input": fileInput$1,
+	"location-input": locationInput$1,
+	link: linkOption$1,
+	file: fileOption$1,
+	submit: submitOption$1,
+	wait: waitOption,
+	reply: replyOption,
+	member: memberOption,
+	broadcast: broadcastOption,
+	"org-topic": orgTopicOption,
+	"no-encrypt": noEncryptOption$1,
+	markdown: markdownOption$1,
+	shared: sharedOption,
+	format: formatOption,
+	topic: topicOption,
+	"api-token": apiTokenOption,
+	password: passwordOption,
+	"base-url": baseUrlOption,
+	quiet: quietOption
+}, (args) => Effect.gen(function* () {
+	const out = yield* CliOutput;
+	yield* out.setQuiet(args.quiet);
+	const memberName = Option.getOrUndefined(args.member);
+	const orgTopicName = Option.getOrUndefined(args["org-topic"]);
+	const topic = args.topic[0];
+	if ([
+		memberName !== void 0,
+		args.broadcast,
+		orgTopicName !== void 0,
+		topic !== void 0
+	].filter(Boolean).length > 1) return yield* Effect.fail(new UserError({ message: "pass at most one target: -m <member> | -b (broadcast) | --org-topic <value> | -t <topic> (omit all for a self-send)" }));
+	const inputs = yield* Effect.try({
+		try: () => buildInputs(args),
+		catch: (e) => new UserError({ message: e instanceof Error ? e.message : String(e) })
+	});
+	if (inputs.length === 0 && args.wait) yield* out.warn("--wait requested but no inputs were defined; the server will never produce a TaskCompleted event");
+	const tag = Option.getOrElse(args.tag, () => process.env.SP_TAG ?? "");
+	const title = Option.getOrUndefined(args.title);
+	const content = Option.getOrUndefined(args.content);
+	if (memberName !== void 0 || args.broadcast || orgTopicName !== void 0) return yield* sendOrgTask({
+		member: memberName,
+		broadcast: args.broadcast,
+		orgTopic: orgTopicName,
+		tag,
+		title,
+		content,
+		inputs,
+		links: [...args.link],
+		files: [...args.file],
+		autoCommit: !args.submit,
+		reply: Option.getOrUndefined(args.reply),
+		markdown: args.markdown,
+		noEncrypt: args["no-encrypt"],
+		wait: args.wait,
+		shared: args.shared,
+		format: args.format
+	});
+	const passwords = args.password;
+	const encrypting = willEncrypt(passwords, topic);
+	const files = yield* buildFiles(args.file);
+	const apiToken = yield* requireApiToken(args["api-token"]);
+	yield* Effect.scoped(Effect.gen(function* () {
+		const client = yield* acquireClient({
+			baseUrl: args["base-url"],
+			apiToken,
+			passwords: [...passwords]
+		});
+		if (encrypting) yield* out.info("encrypting outgoing task (Argon2id, this takes a moment)");
+		const baseOpts = {
+			...tag ? { tag } : {},
+			...title !== void 0 ? { title } : {},
+			...content !== void 0 ? { content } : {},
+			inputs,
+			links: [...args.link],
+			...files.length > 0 ? { files } : {},
+			autoCommit: !args.submit,
+			...Option.isSome(args.reply) ? { reply: args.reply.value } : {},
+			...args.markdown ? { contentFormat: "markdown" } : {}
+		};
+		if (topic === void 0) {
+			const response = yield* sdkCall("task send", () => client.sendTask(baseOpts));
+			yield* out.info(`self-send task created: ${response.taskId}`);
+			yield* out.info(`append token: ${response.appendToken}`);
+			if (!args.wait) {
+				if (args.format === "json") yield* out.print(formatSent(void 0, response.createdAt, [{
+					id: response.taskId,
+					kind: "task",
+					recipient: null
+				}]));
+				else yield* out.print(response.taskId);
+				return;
+			}
+			yield* out.info(`waiting for completion of task ${response.taskId}`);
+			return yield* waitForFirstCompletion([response]);
+		}
+		const sendOpts = {
+			...baseOpts,
+			topic
+		};
+		if (args.shared) {
+			const response = yield* sdkCall("task send", () => client.sendTask({
+				...sendOpts,
+				shared: true
+			}));
+			yield* out.info(`task created: ${response.taskId}`);
+			yield* out.info(`append token: ${response.appendToken}`);
+			if (!args.wait) {
+				if (args.format === "json") yield* out.print(formatSent(void 0, response.createdAt, [{
+					id: response.taskId,
+					kind: "task",
+					recipient: null
+				}]));
+				else yield* out.print(response.taskId);
+				return;
+			}
+			yield* out.info(`waiting for completion of task ${response.taskId}`);
+			return yield* waitForFirstCompletion([response]);
+		}
+		const group = yield* sdkCall("task send", () => client.sendTask(sendOpts));
+		yield* out.info(`task group created: ${group.groupId} (${group.instances.length} recipient${group.instances.length === 1 ? "" : "s"})`);
+		yield* out.info(`group append token: ${group.appendToken}`);
+		yield* Effect.forEach(group.instances, (inst) => {
+			const who = inst.recipient ? `${inst.recipient.publicId}${inst.recipient.name ? ` (${inst.recipient.name})` : ""}` : "unknown";
+			return out.info(`instance: ${inst.taskId} -> ${who} append token: ${inst.appendToken}`);
+		});
+		if (group.instances.length === 0) yield* out.warn("the topic has no recipients — the group is empty");
+		if (!args.wait) {
+			if (args.format === "json") yield* out.print(formatSent(group.groupId, group.createdAt, group.instances.map((i) => ({
+				id: i.taskId,
+				kind: "task",
+				recipient: i.recipient ? {
+					publicId: i.recipient.publicId,
+					name: i.recipient.name ?? null
+				} : null
+			}))));
+			else yield* out.print(group.groupId);
+			return;
+		}
+		if (group.instances.length === 0) {
+			yield* out.warn("--wait requested but the group has no instances; nothing will complete");
+			return yield* Effect.fail(new Aborted());
+		}
+		yield* out.info(`waiting for the first completion across ${group.instances.length} instance(s) of ${group.groupId}`);
+		yield* waitForFirstCompletion(group.instances);
+	}));
+}));
+/** Merge every instance's input stream and take the FIRST completed answer
+* (mirrors the backend's curl Wait semantics: one answer from any recipient).
+* Per instance, a `taskDeleted` benignly ends that sub-stream. No completion
+* anywhere is a FAILURE (exit 1, empty stdout); a real stream error (auth,
+* transport) fails the merge and is surfaced as such. */
+const waitForFirstCompletion = (tasks) => Effect.gen(function* () {
+	const out = yield* CliOutput;
+	const completions = tasks.map((t) => sdkStream("task wait stream", (signal) => t.inputs({
+		replay: true,
+		signal
+	})).pipe(Stream.takeWhile((ev) => ev.kind !== "taskDeleted"), Stream.filter((ev) => ev.kind === "taskCompleted"), Stream.take(1)));
+	const first = yield* Stream.mergeAll(completions, { concurrency: "unbounded" }).pipe(Stream.runHead, Effect.mapError((e) => {
+		return new UserError({ message: `stream failed while waiting: ${e.cause instanceof Error ? e.cause.message : String(e.cause)}` });
+	}));
+	if (Option.isNone(first)) {
+		yield* out.warn("every instance ended (deleted or stream closed) before a completion");
+		return yield* Effect.fail(new Aborted());
+	}
+	const ev = first.value;
+	const uploads = ev.kind === "taskCompleted" ? ev.uploads : [];
+	const single = uploads.length === 1 ? uploads[0] : void 0;
+	const value = single && (single.kind === "text" || single.kind === "choice") ? single.value : single && single.kind === "action" ? single.key : single && single.kind === "multiChoice" ? (single.values ?? []).filter((v) => typeof v === "string").join(", ") : void 0;
+	yield* out.print(typeof value === "string" ? value : JSON.stringify(uploads));
+});
+/** Send a task to org recipients (a member, a broadcast, or an org topic) over
+* the CLI bearer session, encrypting each user-visible field under the current
+* org master_key when the vault is unlocked. Mirrors `sp notify` and the SDK's
+* OrgClient.sendTask field set (tag/title/content/links + each input's
+* description/default/options). File attachments are not supported (the bearer
+* session can't drive uploads). */
+const sendOrgTask = (params) => Effect.gen(function* () {
+	const out = yield* CliOutput;
+	const api = yield* Api;
+	const access = yield* VaultAccess;
+	if (params.content === void 0 && params.inputs.length === 0) return yield* Effect.fail(new UserError({ message: "an org task needs --content or at least one input" }));
+	if (params.wait) yield* out.warn("--wait isn't supported on org sends; ignoring");
+	const vault = yield* access.forSendOrPlaintext(params.noEncrypt);
+	const target = params.orgTopic !== void 0 ? { topic: params.orgTopic } : params.member !== void 0 ? { member: params.member } : { broadcast: true };
+	const opts = {
+		...params.tag ? { tag: params.tag } : {},
+		...params.title !== void 0 ? { title: params.title } : {},
+		...params.content !== void 0 ? { content: params.content } : {},
+		inputs: params.inputs,
+		links: params.links,
+		autoCommit: params.autoCommit,
+		...params.reply !== void 0 ? { reply: params.reply } : {},
+		...params.markdown ? { contentFormat: "markdown" } : {},
+		...params.shared ? { shared: true } : {}
+	};
+	const masterKey = vault ? {
+		key: vault.masterKeyCurrent.key,
+		version: vault.masterKeyCurrent.version
+	} : void 0;
+	const fileAttachments = yield* buildFiles(params.files);
+	const prepared = yield* sdkCall("prepare attachments", () => prepareFileAttachments(fileAttachments, masterKey?.key));
+	const body = yield* sdkCall("build task request", () => buildOrgTaskRequest(target, opts, masterKey, prepared.map((p) => p.meta)));
+	const payload = yield* api.postJson("task", "/v1/org/tasks/json", Schema.Unknown, body);
+	yield* uploadOrgAttachments(prepared, payload.attachments);
+	const enc = vault ? ` (encrypted under master_key v${vault.masterKeyCurrent.version})` : " (plaintext)";
+	if (isTaskGroupResponse(payload)) {
+		yield* out.info(`Org task group sent${enc}.`);
+		yield* out.info(`Group:   ${payload.groupId} (${payload.instances.length} recipient${payload.instances.length === 1 ? "" : "s"})`);
+		yield* out.info(`Append:  ${payload.groupAppendToken}`);
+		yield* Effect.forEach(payload.instances, (inst) => {
+			const who = `${inst.recipient.publicId}${inst.recipient.name ? ` (${inst.recipient.name})` : ""}`;
+			return out.info(`Instance: ${inst.taskId} -> ${who} append token: ${inst.appendToken}`);
+		});
+		if (payload.instances.length === 0) yield* out.warn("the target has no recipients — the group is empty");
+		if (params.format === "json") yield* out.print(formatSent(payload.groupId, payload.createdAt, payload.instances.map((i) => ({
+			id: i.taskId,
+			kind: "task",
+			recipient: {
+				publicId: i.recipient.publicId,
+				name: i.recipient.name ?? null
+			}
+		}))));
+		else yield* out.print(payload.groupId);
+	} else {
+		yield* out.info(`Org task sent${enc}.`);
+		yield* out.info(`Id:      ${payload.taskId}`);
+		yield* out.info(`Append:  ${payload.appendToken}`);
+		if (params.format === "json") yield* out.print(formatSent(void 0, payload.createdAt, [{
+			id: payload.taskId,
+			kind: "task",
+			recipient: null
+		}]));
+		else yield* out.print(payload.taskId);
+	}
+});
+//#endregion
+//#region src/commands/subtask.ts
+const appendTokenOption = Options.text("append-token").pipe(Options.withDescription("The parent task's append token (the `appendToken` printed by `sp task`)."));
+const titleOption = Options.text("title").pipe(Options.withDescription("Subtask title."), Options.optional);
+const contentOption = Options.text("content").pipe(Options.withDescription("Subtask description / body content."), Options.optional);
+const linkOption = Options.text("link").pipe(Options.withAlias("l"), Options.withDescription("Attach a remote URL (a link attachment). Repeatable. For local files use --file."), Options.repeated);
+const fileOption = Options.text("file").pipe(Options.withAlias("f"), Options.withDescription("Attach a local file, uploaded as a file attachment (encrypted under the parent chain's key — topic password or org master key — when the chain is encrypted). Repeatable."), Options.repeated);
+const textInput = Options.text("text-input").pipe(Options.withDescription("Add a text input. Format: `description[;key=value...]`. Settings: `required=true|false` (default true), `defaultValue=...`. Repeatable."), Options.repeated);
+const actionInput = Options.text("action-input").pipe(Options.withAlias("a"), Options.withDescription("Add an actions input (buttons the recipient taps, e.g. Accept/Deny). Format: `[description;]key=Label[:style],...[;required=true|false]`, actions comma-separated; style is default|primary|destructive. Repeatable."), Options.repeated);
+const choiceInput = Options.text("choice-input").pipe(Options.withAlias("c"), Options.withDescription("Add a choice input. Format: `[description;]options[;key=value...]`, options comma-separated. Settings: `required=true|false`, `multi=true|false` (allow picking more than one option, default false), `minSelections=<int>`/`maxSelections=<int>` (only with multi). Use `\\;` for a literal semicolon. Repeatable."), Options.repeated);
+const sliderInput = Options.text("slider-input").pipe(Options.withAlias("s"), Options.withDescription("Add a slider input (the recipient picks a number on a scale). Format: `[description;]min=0;max=14;step=0.1;unit=pH;default=7`. `min`/`max` required; `step`/`unit`/`default` optional. Repeatable."), Options.repeated);
+const photoInput = Options.text("photo-input").pipe(Options.withDescription("Add a photo input. Format: `description[;key=value...]`. Settings: `required=true|false`. Repeatable."), Options.repeated);
+const voiceRecordingInput = Options.text("voice-recording-input").pipe(Options.withDescription("Add a voice recording input. Format: `description[;key=value...]`. Settings: `required=true|false`. Repeatable."), Options.repeated);
+const fileInput = Options.text("file-input").pipe(Options.withDescription("Add a file upload input. Format: `description[;key=value...]`. Settings: `required=true|false`. Repeatable."), Options.repeated);
+const locationInput = Options.text("location-input").pipe(Options.withDescription("Add a location input (the recipient shares their device GPS position from the app). Format: `description[;key=value...]`. Settings: `required=true|false`. Repeatable."), Options.repeated);
+const submitOption = Options.boolean("submit").pipe(Options.withDescription("Require the recipient to explicitly submit the subtask. Without this, it auto-completes once the required inputs are filled."));
+const markdownOption = Options.boolean("markdown").pipe(Options.withDescription("Render the subtask body as Markdown on the recipient's device (sets contentFormat=markdown)."));
+const noEncryptOption = Options.boolean("no-encrypt").pipe(Options.withDescription("For org appends: send fields in plaintext even when the org vault is unlocked."));
+const instanceOption = Options.text("instance").pipe(Options.withDescription("With a group append token (grptsk_ group): append only to these member task instances (tsk_ ids printed by `sp task`). Repeatable; without it the subtask goes to every member."), Options.repeated);
+const subtaskCommand = Command.make("subtask", {
+	"append-token": appendTokenOption,
+	title: titleOption,
+	content: contentOption,
+	"text-input": textInput,
+	"choice-input": choiceInput,
+	"action-input": actionInput,
+	"slider-input": sliderInput,
+	"photo-input": photoInput,
+	"voice-recording-input": voiceRecordingInput,
+	"file-input": fileInput,
+	"location-input": locationInput,
+	link: linkOption,
+	file: fileOption,
+	submit: submitOption,
+	markdown: markdownOption,
+	"no-encrypt": noEncryptOption,
+	instance: instanceOption,
+	topic: topicOption,
+	"api-token": apiTokenOption,
+	password: passwordOption,
+	"base-url": baseUrlOption,
+	quiet: quietOption
+}, (args) => Effect.gen(function* () {
+	const out = yield* CliOutput;
+	yield* out.setQuiet(args.quiet);
+	const appendToken = args["append-token"];
+	const title = Option.getOrUndefined(args.title);
+	const content = Option.getOrUndefined(args.content);
+	const topic = args.topic[0];
+	const inputs = yield* Effect.try({
+		try: () => buildInputs(args),
+		catch: (e) => new UserError({ message: e instanceof Error ? e.message : String(e) })
+	});
+	if (content === void 0 && inputs.length === 0) return yield* Effect.fail(new UserError({ message: "a subtask needs --content or at least one input" }));
+	const opts = {
+		...title !== void 0 ? { title } : {},
+		...content !== void 0 ? { content } : {},
+		...inputs.length > 0 ? { inputs } : {},
+		links: [...args.link],
+		autoCommit: !args.submit,
+		...args.markdown ? { contentFormat: "markdown" } : {}
+	};
+	const instances = args.instance.length > 0 ? [...args.instance] : void 0;
+	if (topic !== void 0) {
+		const files = yield* buildFiles(args.file);
+		const apiToken = yield* requireApiToken(args["api-token"]);
+		yield* Effect.scoped(Effect.gen(function* () {
+			const client = yield* acquireClient({
+				baseUrl: args["base-url"],
+				apiToken,
+				passwords: args.password
+			});
+			if (willEncrypt(args.password, topic)) yield* out.info("encrypting outgoing subtask (Argon2id, this takes a moment)");
+			yield* printSubtaskResponse(yield* sdkCall("subtask append", () => client.appendSubtask({
+				appendToken,
+				topic,
+				...instances !== void 0 ? { instances } : {},
+				...opts,
+				...files.length > 0 ? { files } : {}
+			})));
+		}));
+		return;
+	}
+	yield* sendOrgSubtask({
+		appendToken,
+		opts,
+		instances,
+		files: [...args.file],
+		noEncrypt: args["no-encrypt"]
+	});
+}));
+/** Shared output contract for both append paths. Single append: one subtask id
+* on stdout. Group append (grptsk_ token): one subtask id per member on stdout,
+* with the taskId -> subtaskId mapping on the info channel. */
+const printSubtaskResponse = (resp, suffix = "") => Effect.gen(function* () {
+	const out = yield* CliOutput;
+	if (isSubtaskGroupResponse(resp)) {
+		yield* out.info(`subtask appended to group ${resp.groupId} (${resp.subtasks.length} member${resp.subtasks.length === 1 ? "" : "s"})${suffix}`);
+		yield* Effect.forEach(resp.subtasks, (s) => out.info(`instance: ${s.taskId} -> subtask ${s.subtaskId}`).pipe(Effect.zipRight(out.print(s.subtaskId))));
+	} else {
+		yield* out.info(`subtask appended: ${resp.subtaskId}${suffix}`);
+		yield* out.print(resp.subtaskId);
+	}
+});
+/** Append a subtask to an org task over the CLI bearer session, encrypting each
+* field under the current org master_key when the vault is unlocked. Mirrors
+* `sendOrgTask` in task.ts; the subtask inherits the parent's recipients. */
+const sendOrgSubtask = (params) => Effect.gen(function* () {
+	const api = yield* Api;
+	const vault = yield* (yield* VaultAccess).forSendOrPlaintext(params.noEncrypt);
+	const masterKey = vault ? {
+		key: vault.masterKeyCurrent.key,
+		version: vault.masterKeyCurrent.version
+	} : void 0;
+	const fileAttachments = yield* buildFiles(params.files);
+	const prepared = yield* sdkCall("prepare attachments", () => prepareFileAttachments(fileAttachments, masterKey?.key));
+	const body = yield* sdkCall("build subtask request", () => buildOrgSubtaskRequest(params.appendToken, params.opts, masterKey, params.instances, prepared.map((p) => p.meta)));
+	const payload = yield* api.postJson("subtask append", "/v1/org/subtasks/json", Schema.Unknown, body);
+	yield* uploadOrgAttachments(prepared, payload.attachments);
+	yield* printSubtaskResponse(payload, vault ? ` (encrypted under master_key v${vault.masterKeyCurrent.version})` : " (plaintext)");
+});
+//#endregion
+//#region src/main.ts
+const onPipeError = (exit) => (e) => {
+	if (e.code !== "EPIPE") throw e;
+	if (exit) process.exit(0);
+};
+process.stdout.on("error", onPipeError(true));
+process.stderr.on("error", onPipeError(false));
+const root = Command.make("simplepush").pipe(Command.withSubcommands([
+	authCommand,
+	orgCommand,
+	eventsCommand,
+	collectCommand,
+	daemonCommand,
+	downloadCommand,
+	notifyCommand,
+	taskCommand,
+	subtaskCommand
+]));
+const cli = Command.run(root, {
+	name: "Simplepush CLI",
+	version: "0.1.0"
+});
+const MainLive = Layer.mergeAll(CliOutput.Default, Sodium.Default, AuthStore.Default, VaultStore.Default, InviteStore.Default, Api.Default, VaultAccess.Default).pipe(Layer.provideMerge(FetchHttpClient.layer), Layer.provideMerge(NodeContext.layer));
+/** Render any failure through the typed-error table, then re-fail so the
+* runtime exits non-zero. Defects (bugs) keep their full pretty cause. */
+const reportErrors = (effect) => effect.pipe(Effect.catchAllCause((cause) => Effect.gen(function* () {
+	const out = yield* CliOutput;
+	if (!Cause.isInterruptedOnly(cause)) {
+		const failure = Cause.failureOption(cause);
+		if (Option.isSome(failure)) {
+			const message = renderError(failure.value);
+			if (message !== void 0) yield* out.error(message);
+		} else yield* out.error(Cause.pretty(cause));
+	}
+	return yield* Effect.failCause(cause);
+})));
+cli(process.argv).pipe(reportErrors, Effect.provide(MainLive), NodeRuntime.runMain({ disableErrorReporting: true }));
+//#endregion
+export {};
+
+//# sourceMappingURL=main.mjs.map