@simplepush/cli 0.1.1 → 0.2.1

package/dist/main.mjs

@@ -9,10 +9,10 @@ import { wordlist } from "@scure/bip39/wordlists/english.js";
 import { homedir, tmpdir } from "node:os";
 import { createServer } from "node:http";
 import { spawn } from "node:child_process";
-import { mkdir } from "node:fs/promises";
-import { Client, OrgClient, TypeFilter, buildOrgNotificationRequest, buildOrgSubtaskRequest, buildOrgTaskRequest, isNotificationGroupResponse, isSubtaskGroupResponse, isTaskGroupResponse, prepareFileAttachments, tryDecryptEventData, uploadFileAttachments } from "@simplepush/sdk";
+import { Client, Keyring, OrgClient, TypeFilter, cancelSubtask, cancelTask, cancelTaskGroup, decryptBytes, deriveKey, encrypt, fetchUserInfo, isSubtaskGroupResponse, tryDecryptEventData } from "@simplepush/sdk";
+import { mkdir, stat, writeFile } from "node:fs/promises";
 import { connect, createConnection } from "node:net";
-import { basename, extname, join } from "node:path";
+import path, { basename, extname, join } from "node:path";
 //#region src/errors.ts
 /** No CLI session saved — `sp auth login` hasn't been run (or was logged out). */
 var NotLoggedIn = class extends Data.TaggedError("NotLoggedIn") {};
@@ -103,11 +103,17 @@ const MasterKeySchema = Schema.Struct({
 	version: Schema.Number,
 	key: Schema.Uint8ArrayFromSelf
 });
+const IntegrationPin = Schema.Struct({
+	id: Schema.String,
+	pubkeyB64: Schema.String,
+	name: Schema.String
+});
 const VaultContents = Schema.Struct({
 	adminPublicKey: Schema.Uint8ArrayFromSelf,
 	adminPrivateKey: Schema.Uint8ArrayFromSelf,
 	masterKeyCurrent: MasterKeySchema,
-	masterKeyHistory: Schema.Array(MasterKeySchema)
+	masterKeyHistory: Schema.Array(MasterKeySchema),
+	integrations: Schema.optionalWith(Schema.Array(IntegrationPin), { default: () => [] })
 });
 const MasterKeyJson = Schema.Struct({
 	version: Schema.Number,
@@ -118,7 +124,8 @@ const VaultJson = Schema.Struct({
 	adminPublicKey: Schema.Uint8ArrayFromBase64,
 	adminPrivateKey: Schema.Uint8ArrayFromBase64,
 	masterKeyCurrent: MasterKeyJson,
-	masterKeyHistory: Schema.Array(MasterKeyJson)
+	masterKeyHistory: Schema.Array(MasterKeyJson),
+	integrations: Schema.optionalWith(Schema.Array(IntegrationPin), { default: () => [] })
 });
 function normalizePassphrase(input) {
 	return input.trim().toLowerCase().split(/\s+/).join(" ");
@@ -147,10 +154,13 @@ var Sodium = class extends Effect.Service()("cli/Sodium", { effect: Effect.gen(f
 	});
 	const toB64 = (bytes) => sodium.to_base64(bytes, sodium.base64_variants.ORIGINAL);
 	const fromB64 = (s) => sodium.from_base64(s, sodium.base64_variants.ORIGINAL);
+	const toB64Url = (bytes) => sodium.to_base64(bytes, sodium.base64_variants.URLSAFE_NO_PADDING);
 	return {
 		toB64,
 		fromB64,
+		toB64Url,
 		randomBytes: (length) => Effect.sync(() => sodium.randombytes_buf(length)),
+		seedKeypair: (seed) => attempt("keypair derivation failed", () => sodium.crypto_box_seed_keypair(seed)),
 		generateVaultSalt: Effect.sync(() => sodium.randombytes_buf(sodium.crypto_pwhash_SALTBYTES)),
 		generateMasterKey: Effect.sync(() => sodium.randombytes_buf(sodium.crypto_aead_xchacha20poly1305_ietf_KEYBYTES)),
 		generateAdminKeyPair: Effect.sync(() => {
@@ -284,7 +294,8 @@ const StoredVault = Schema.Struct({
 	masterKeyHistory: Schema.Array(Schema.Struct({
 		version: Schema.Number,
 		keyB64: Schema.Uint8ArrayFromBase64
-	}))
+	})),
+	integrations: Schema.optionalWith(Schema.Array(IntegrationPin), { default: () => [] })
 });
 const VaultFromStored = Schema.transform(StoredVault, VaultContents, {
 	strict: true,
@@ -298,7 +309,8 @@ const VaultFromStored = Schema.transform(StoredVault, VaultContents, {
 		masterKeyHistory: s.masterKeyHistory.map((m) => ({
 			version: m.version,
 			key: m.keyB64
-		}))
+		})),
+		integrations: s.integrations
 	}),
 	encode: (v) => ({
 		formatVersion: 1,
@@ -311,7 +323,8 @@ const VaultFromStored = Schema.transform(StoredVault, VaultContents, {
 		masterKeyHistory: v.masterKeyHistory.map((m) => ({
 			version: m.version,
 			keyB64: m.key
-		}))
+		})),
+		integrations: v.integrations ?? []
 	})
 });
 var VaultStore = class extends Effect.Service()("cli/VaultStore", { effect: jsonFile("vault.json", VaultFromStored) }) {};
@@ -365,6 +378,8 @@ const ErrorBody = Schema.Struct({
 });
 const decodeErrorBody = Schema.decodeUnknownOption(Schema.parseJson(ErrorBody));
 const trimSlash = (url) => url.replace(/\/+$/, "");
+const isRetryableCreateFailure = (e) => e instanceof TransportFailure || e instanceof ApiFailure && (e.status === 503 || e.status === 409 && e.code === "idempotency_in_flight");
+const createRetrySchedule = Schedule.exponential("1 seconds").pipe(Schedule.intersect(Schedule.recurs(5)), Schedule.whileInput(isRetryableCreateFailure));
 var Api = class extends Effect.Service()("cli/Api", {
 	dependencies: [AuthStore.Default],
 	effect: Effect.gen(function* () {
@@ -379,10 +394,12 @@ var Api = class extends Effect.Service()("cli/Api", {
 		const failWith = (action, res) => res.text.pipe(Effect.orElseSucceed(() => ""), Effect.flatMap((body) => {
 			const parsed = decodeErrorBody(body);
 			const detail = Option.isSome(parsed) && parsed.value.msg ? parsed.value.msg : body || `HTTP ${res.status}`;
+			const code = Option.isSome(parsed) ? parsed.value.error : void 0;
 			return Effect.fail(new ApiFailure({
 				action,
 				status: res.status,
-				detail
+				detail,
+				code
 			}));
 		}));
 		/** Authenticated request; resolves with the (scoped) response once the
@@ -404,6 +421,13 @@ var Api = class extends Effect.Service()("cli/Api", {
 			session,
 			getJson: (action, pathname, schema) => requestJson(action, "GET", pathname, schema),
 			postJson: (action, pathname, schema, body) => requestJson(action, "POST", pathname, schema, body),
+			/** POST for the org create endpoints, whose bodies carry an idempotency
+			* key (minted by the SDK's buildOrg*Request): transient failures —
+			* transport errors, 503 database-unavailable, 409 idempotency_in_flight —
+			* are retried with 1s→16s backoff (~31s total, outlasting a managed-
+			* Postgres failover); the backend replays a create that already
+			* committed, so a resend never double-sends. */
+			postJsonIdempotent: (action, pathname, schema, body) => requestJson(action, "POST", pathname, schema, body).pipe(Effect.retry(createRetrySchedule)),
 			putJson: (action, pathname, schema, body) => requestJson(action, "PUT", pathname, schema, body),
 			/** Fire-and-forget variants for endpoints whose response body we ignore. */
 			post: (action, pathname, body) => Effect.scoped(Effect.asVoid(request(action, "POST", pathname, body))),
@@ -523,7 +547,7 @@ var VaultAccess = class extends Effect.Service()("cli/VaultAccess", {
 const DEFAULT_BASE_URL = "https://api.simplepu.sh";
 const toHelp = (e) => HelpDoc.p(e instanceof Error ? e.message : String(e));
 const topicOption = Options.text("topic").pipe(Options.withAlias("t"), Options.withDescription("Topic to send to (`task`) or filter on (`events`, repeatable). Omit on `task` for a self-send to your own devices."), Options.repeated);
-const apiTokenOption = Options.text("api-token").pipe(Options.withDescription("API token. Required for `events` and `get`; `collect` falls back to the logged-in org session when omitted. Defaults to $SP_API_TOKEN."), Options.withFallbackConfig(Config.string("SP_API_TOKEN")), Options.optional);
+const apiTokenOption = Options.text("api-token").pipe(Options.withDescription("API token. Required for `get`; `collect`, `events`, and `subtask` fall back to the logged-in org session when omitted. Defaults to $SP_API_TOKEN."), Options.withFallbackConfig(Config.string("SP_API_TOKEN")), Options.optional);
 /** Personal-credential commands need the token; fail typed when absent. */
 const requireApiToken = (token) => Option.match(token, {
 	onNone: () => Effect.fail(new MissingApiToken()),
@@ -1089,6 +1113,16 @@ function resolveSince(input) {
 	if (ms !== void 0) return new Date(Date.now() - ms).toISOString();
 	throw new Error(`could not parse \`--since ${input}\`: expected a duration (e.g. \`24h\`, \`7d\`) or ISO 8601 timestamp`);
 }
+/** ISO 8601 string for a FUTURE deadline (`--expires`): a humantime duration
+* is added to now (`2h` = two hours from now), an ISO timestamp passes
+* through. The server rejects deadlines in the past. */
+function resolveExpiresAt(input) {
+	const iso = parseIso(input);
+	if (iso) return iso.toISOString();
+	const ms = parseDurationMs(input);
+	if (ms !== void 0) return new Date(Date.now() + ms).toISOString();
+	throw new Error(`could not parse \`--expires ${input}\`: expected a duration (e.g. \`2h\`, \`7d\`) or ISO 8601 timestamp`);
+}
 function resolveUntil(input) {
 	const iso = parseIso(input);
 	if (iso) return iso;
@@ -1130,15 +1164,22 @@ function formatSent(groupId, createdAt, members) {
 		type: "sent",
 		groupId: groupId ?? null,
 		createdAt: createdAt ?? null,
-		members: members.map((m) => ({
+		instances: members.map((m) => ({
 			...m.kind === "notification" ? { notificationId: m.id } : { taskId: m.id },
+			...m.subtaskId !== void 0 ? { subtaskId: m.subtaskId } : {},
 			recipient: m.recipient
 		}))
 	});
 }
-/** The member instance's entity id under its kind-specific key. */
+/** The member instance's entity id under its kind-specific key. A subtask
+* instance keys on its PARENT task (the demux key) and stamps its own
+* `subtaskId`, so every line of a subtask collect carries both. */
 function instanceId(instance) {
 	const inst = instance;
+	if (inst.subtaskId !== void 0 && inst.parentTaskId !== void 0) return {
+		taskId: inst.parentTaskId,
+		subtaskId: inst.subtaskId
+	};
 	return inst.taskId !== void 0 ? { taskId: inst.taskId } : { notificationId: inst.notificationId ?? null };
 }
 /** A single collected item — from `replies()`, `inputs()`, the combined
@@ -1177,6 +1218,12 @@ function formatItem(g, groupId) {
 			...base,
 			uploads: item.uploads ?? []
 		});
+		case "subtaskCompleted": return line({
+			type: "completed",
+			...base,
+			subtaskId: item.subtaskId ?? null,
+			uploads: item.uploads ?? []
+		});
 		case "notificationCompleted": return line({
 			type: "completed",
 			...base,
@@ -1186,6 +1233,47 @@ function formatItem(g, groupId) {
 			type: "deleted",
 			...base
 		});
+		case "taskCanceled": return line({
+			type: "canceled",
+			...base,
+			reason: item.reason ?? null,
+			note: item.note ?? null,
+			supersededBy: item.supersededBy ?? null
+		});
+		case "subtaskCanceled": return line({
+			type: "canceled",
+			...base,
+			subtaskId: item.subtaskId ?? null,
+			reason: item.reason ?? null,
+			note: item.note ?? null,
+			supersededBy: item.supersededBy ?? null
+		});
+		case "taskDeclinedByRecipient": return line({
+			type: "declined",
+			...base,
+			reason: item.reason ?? null,
+			note: item.note ?? null
+		});
+		case "taskDeclined": return line({
+			type: "all-declined",
+			...base
+		});
+		case "subtaskDeclinedByRecipient": return line({
+			type: "declined",
+			...base,
+			subtaskId: item.subtaskId ?? null,
+			reason: item.reason ?? null,
+			note: item.note ?? null
+		});
+		case "subtaskDeclined": return line({
+			type: "all-declined",
+			...base,
+			subtaskId: item.subtaskId ?? null
+		});
+		case "taskExpired": return line({
+			type: "expired",
+			...base
+		});
 	}
 }
 function formatSubmission(s) {
@@ -1215,14 +1303,14 @@ function fileViewsOf(item) {
 	]).filter(isFileView);
 }
 /** The terminal line: reason the stream stopped, per-type counts, and (for
-* group modes) per-member status. Always the last line on a clean run. */
+* group modes) per-instance status. Always the last line on a clean run. */
 function formatEnd(reason, counts, members, errorMsg) {
 	const obj = {
 		type: "end",
 		reason,
 		counts
 	};
-	if (members) obj.members = members;
+	if (members) obj.instances = members;
 	if (errorMsg !== void 0) obj.error = errorMsg;
 	return line(obj);
 }
@@ -1254,11 +1342,19 @@ function formatPrettyItem(g) {
 		case "reply": return `  ${who} (reply): ${item.body?.kind === "text" ? item.body.text ?? "" : JSON.stringify(item.body)}${prettyFileSuffix(item)}`;
 		case "input": return `  ${who} [${item.type}]${prettyFileSuffix(item)}`;
 		case "taskCompleted": return `  ${who} [completed]${prettyFileSuffix(item)}`;
+		case "subtaskCompleted": return `  ${who} [subtask completed]${prettyFileSuffix(item)}`;
 		case "notificationCompleted": {
 			const r = item.reply;
 			return `  ${who} [answered]${r === void 0 ? "" : r.type === "text" ? `: ${r.value}` : r.type === "choice" ? `: ${r.selectedValue}` : `: ${r.selectedKey}`}`;
 		}
 		case "taskDeleted": return `  ${who} [deleted]`;
+		case "taskCanceled": return `  ${who} [canceled${item.reason && item.reason !== "canceled" ? `: ${item.reason}` : ""}]${item.note ? ` ${item.note}` : ""}`;
+		case "subtaskCanceled": return `  ${who} [subtask canceled${item.reason && item.reason !== "canceled" ? `: ${item.reason}` : ""}]`;
+		case "taskDeclinedByRecipient": return `  ${who} [declined${item.reason === "failed" ? ": failed" : ""}]${item.note ? ` ${item.note}` : ""}`;
+		case "taskDeclined": return `  ${who} [all declined]`;
+		case "subtaskDeclinedByRecipient": return `  ${who} [subtask declined${item.reason === "failed" ? ": failed" : ""}]${item.note ? ` ${item.note}` : ""}`;
+		case "subtaskDeclined": return `  ${who} [subtask all declined]`;
+		case "taskExpired": return `  ${who} [expired]`;
 	}
 }
 function formatPrettySubmission(s) {
@@ -1367,9 +1463,10 @@ const SentLine = Schema.Struct({
 	type: Schema.Literal("sent"),
 	groupId: Schema.optional(Schema.NullOr(Schema.String)),
 	createdAt: Schema.optional(Schema.NullOr(Schema.String)),
-	members: Schema.optional(Schema.Array(Schema.Struct({
+	instances: Schema.optional(Schema.Array(Schema.Struct({
 		taskId: Schema.optional(Schema.String),
 		notificationId: Schema.optional(Schema.String),
+		subtaskId: Schema.optional(Schema.String),
 		recipient: Schema.optional(Schema.NullOr(Schema.Struct({
 			publicId: Schema.String,
 			name: Schema.optional(Schema.NullOr(Schema.String))
@@ -1428,9 +1525,9 @@ const loadOrgMasterKeys = Effect.gen(function* () {
 });
 const collectCommand = Command.make("collect", {
 	group: Options.text("group").pipe(Options.withDescription("Group id (grptsk_…) to collect over. Usually supplied via the piped `sent` line instead."), Options.optional),
-	instance: Options.text("instance").pipe(Options.withDescription("Member instance id to collect: a task (tsk_…) or a notification (ntf_…). Repeatable. Augments/overrides the piped `sent` line's members."), Options.repeated),
+	instance: Options.text("instance").pipe(Options.withDescription("Instance id to collect: a task (tsk_…), a notification (ntf_…), or a subtask-scoped pair (tsk_…/sub_…). Repeatable. Augments/overrides the piped `sent` line's instances."), Options.repeated),
 	replies: Options.boolean("replies").pipe(Options.withDescription("Collect only replies. Default (no mode flag) is the full activity stream: inputs, replies, and completions.")),
-	inputs: Options.boolean("inputs").pipe(Options.withDescription("Collect only input events (waits for every member to complete by default).")),
+	inputs: Options.boolean("inputs").pipe(Options.withDescription("Collect only input events (waits for every instance to complete by default).")),
 	submissions: Options.boolean("submissions").pipe(Options.withDescription("Collect submissions (your inbox) instead of a group's events.")),
 	since: mappedText("since", resolveSince).pipe(Options.withDescription("Resume point (`24h`, `7d`, or ISO 8601). Backfills group events or submissions from that point; defaults to the send's createdAt from the piped `sent` line. Implies --direct (the broker can't serve a deep backfill)."), Options.optional),
 	until: Options.text("until").pipe(Options.withDescription("Stop condition. Repeatable: complete | idle:<dur> | count:<n> | timeout:<dur> | forever (never stop; Ctrl-C to end). Default: complete for group collects; --replies / --submissions watch forever."), Options.repeated),
@@ -1491,24 +1588,32 @@ const collectCommand = Command.make("collect", {
 		const createdAt = sinceIso ?? sent?.createdAt ?? void 0;
 		const members = [];
 		const seen = /* @__PURE__ */ new Set();
-		const addMember = (id, recipient) => {
-			if (id && !seen.has(id)) {
-				seen.add(id);
+		const addMember = (id, recipient, subtaskId) => {
+			const key = subtaskId !== void 0 ? `${id}/${subtaskId}` : id;
+			if (id && key && !seen.has(key)) {
+				seen.add(key);
 				members.push({
 					id,
 					kind: id.startsWith("ntf_") ? "notification" : "task",
-					recipient
+					recipient,
+					...subtaskId !== void 0 ? { subtaskId } : {}
 				});
 			}
 		};
-		for (const m of sent?.members ?? []) addMember(m.taskId ?? m.notificationId, m.recipient ? {
+		for (const m of sent?.instances ?? []) addMember(m.taskId ?? m.notificationId, m.recipient ? {
 			publicId: m.recipient.publicId,
 			name: m.recipient.name ?? null
-		} : null);
-		for (const id of args.instance) addMember(id, null);
-		if (members.length === 0) return yield* Effect.fail(new UserError({ message: "no members to collect: pipe a send's `sent` line (`sp task --format json | sp collect`) or pass --instance <tsk_…|ntf_…> (repeatable)" }));
+		} : null, m.subtaskId);
+		for (const spec of args.instance) {
+			const [id, subtaskId] = spec.split("/", 2);
+			if (id.startsWith("sub_")) return yield* Effect.fail(new UserError({ message: `a subtask cannot be collected by its id alone (events route under the parent task) — pass --instance <parent tsk_…>/${id}` }));
+			addMember(id, null, subtaskId);
+		}
+		if (members.length === 0) return yield* Effect.fail(new UserError({ message: "no instances to collect: pipe a send's `sent` line (`sp task --format json | sp collect`) or pass --instance <tsk_…|ntf_…|tsk_…/sub_…> (repeatable)" }));
 		const notifRoster = members[0].kind === "notification";
-		if (members.some((m) => m.kind === "notification" !== notifRoster)) return yield* Effect.fail(new UserError({ message: "cannot mix task (tsk_…) and notification (ntf_…) members in one collect — run one per kind" }));
+		if (members.some((m) => m.kind === "notification" !== notifRoster)) return yield* Effect.fail(new UserError({ message: "cannot mix task (tsk_…) and notification (ntf_…) instances in one collect — run one per kind" }));
+		const subRoster = members[0].subtaskId !== void 0;
+		if (members.some((m) => m.subtaskId !== void 0 !== subRoster)) return yield* Effect.fail(new UserError({ message: "cannot mix subtask-scoped instances (a piped `sp subtask --format json` line or --instance tsk_…/sub_…) with plain task/notification instances in one collect" }));
 		const streamOpts = {
 			replay: true,
 			...until.idleMs !== void 0 ? { idleMs: until.idleMs } : {}
@@ -1529,6 +1634,26 @@ const collectCommand = Command.make("collect", {
 				...streamOpts,
 				signal
 			});
+		} else if (subRoster) {
+			const group = client.watchSubtaskGroup({
+				groupId: watchGroupId,
+				...createdAt ? { createdAt } : {},
+				members: members.map((m) => ({
+					taskId: m.id,
+					subtaskId: m.subtaskId,
+					...m.recipient ? { recipient: m.recipient } : {}
+				}))
+			});
+			source = (signal) => mode === "inputs" ? group.inputs({
+				...streamOpts,
+				signal
+			}) : mode === "replies" ? group.replies({
+				...streamOpts,
+				signal
+			}) : group.activity({
+				...streamOpts,
+				signal
+			});
 		} else {
 			const group = client.watchTaskGroup({
 				groupId: watchGroupId,
@@ -1550,7 +1675,7 @@ const collectCommand = Command.make("collect", {
 			});
 		}
 		if (args.format === "json") yield* out.print(formatSent(groupId, createdAt, members));
-		else yield* out.info(`collecting ${mode} over ${members.length} member(s)${groupId ? ` of ${groupId}` : ""}`);
+		else yield* out.info(`collecting ${mode} over ${members.length} instance(s)${groupId ? ` of ${groupId}` : ""}`);
 		yield* collectGroup(watchGroupId, source, members, args.format, until, saveDir);
 	}));
 }));
@@ -1593,26 +1718,34 @@ const collectGroup = (groupId, source, members, format, until, saveDir) => Effec
 	const counts = yield* Ref.make({});
 	const completed = yield* Ref.make(HashSet.empty());
 	const deleted = yield* Ref.make(HashSet.empty());
+	const canceled = yield* Ref.make(HashSet.empty());
+	const declined = yield* Ref.make(HashSet.empty());
+	const expired = yield* Ref.make(HashSet.empty());
 	const total = yield* Ref.make(0);
 	const doneCount = Effect.gen(function* () {
-		return HashSet.size(yield* Ref.get(completed)) + HashSet.size(yield* Ref.get(deleted));
+		return HashSet.size(yield* Ref.get(completed)) + HashSet.size(yield* Ref.get(deleted)) + HashSet.size(yield* Ref.get(canceled)) + HashSet.size(yield* Ref.get(declined)) + HashSet.size(yield* Ref.get(expired));
 	});
 	const instanceIdOf = (g) => {
 		const inst = g.instance;
+		if (inst.subtaskId !== void 0) return `${inst.parentTaskId}/${inst.subtaskId}`;
 		return inst.taskId ?? inst.notificationId ?? "";
 	};
+	const subScoped = (g) => g.instance.subtaskId !== void 0;
 	const failed = yield* sdkStream("collect stream", source).pipe(Stream.tap((g) => Effect.gen(function* () {
 		yield* saveFiles(g.item, saveDir);
 		yield* out.print(format === "json" ? formatItem(g, groupId) : formatPrettyItem(g));
 		yield* Ref.update(total, (n) => n + 1);
 		const kind = g.item.kind;
-		const label = kind === "reply" ? "reply" : kind === "input" ? "input" : kind === "taskDeleted" ? "deleted" : "completed";
+		const label = kind === "reply" ? "reply" : kind === "input" ? "input" : kind === "taskDeleted" ? "deleted" : kind === "taskCanceled" || kind === "subtaskCanceled" ? "canceled" : kind === "taskDeclinedByRecipient" || kind === "subtaskDeclinedByRecipient" ? "declined" : kind === "taskDeclined" || kind === "subtaskDeclined" ? "all-declined" : kind === "taskExpired" ? "expired" : "completed";
 		yield* Ref.update(counts, (c) => ({
 			...c,
 			[label]: (c[label] ?? 0) + 1
 		}));
-		if (kind === "taskCompleted" || kind === "notificationCompleted") yield* Ref.update(completed, HashSet.add(instanceIdOf(g)));
+		if (kind === "taskCompleted" || kind === "notificationCompleted" || kind === "subtaskCompleted") yield* Ref.update(completed, HashSet.add(instanceIdOf(g)));
 		if (kind === "taskDeleted") yield* Ref.update(deleted, HashSet.add(instanceIdOf(g)));
+		if (kind === "taskCanceled" || kind === "subtaskCanceled" && subScoped(g)) yield* Ref.update(canceled, HashSet.add(instanceIdOf(g)));
+		if (kind === "taskDeclined" || kind === "subtaskDeclined" && subScoped(g)) yield* Ref.update(declined, HashSet.add(instanceIdOf(g)));
+		if (kind === "taskExpired") yield* Ref.update(expired, HashSet.add(instanceIdOf(g)));
 	})), until.count !== void 0 ? Stream.takeUntilEffect(() => Effect.gen(function* () {
 		if ((yield* Ref.get(total)) < until.count) return false;
 		yield* reason.set("count");
@@ -1632,6 +1765,9 @@ const collectGroup = (groupId, source, members, format, until, saveDir) => Effec
 		total: members.length,
 		completed: HashSet.size(yield* Ref.get(completed)),
 		deleted: HashSet.size(yield* Ref.get(deleted)),
+		canceled: HashSet.size(yield* Ref.get(canceled)),
+		declined: HashSet.size(yield* Ref.get(declined)),
+		expired: HashSet.size(yield* Ref.get(expired)),
 		pending: members.length - done
 	};
 	if (format === "json") yield* out.print(formatEnd(why, yield* Ref.get(counts), memberStatus, why === "error" ? "collect stream failed" : void 0));
@@ -1639,6 +1775,117 @@ const collectGroup = (groupId, source, members, format, until, saveDir) => Effec
 	if (failed) return yield* Effect.fail(new Aborted());
 });
 //#endregion
+//#region src/commands/cancel.ts
+const idArg$2 = Args.text({ name: "id" }).pipe(Args.withDescription("What to cancel: a task (`tsk_…`), a subtask (`sub_…`), or a task group (`grptsk_…`)."));
+const reasonOption = Options.choice("reason", [
+	"canceled",
+	"answered",
+	"superseded"
+]).pipe(Options.withDescription("Why: plain withdrawal (default), another recipient's answer made the rest moot (`answered`), or a replacement exists (`superseded`)."), Options.withDefault("canceled"));
+const noteOption = Options.text("note").pipe(Options.withDescription("Free-text explanation shown on the recipients' canceled card. Encrypted under the org master key on the org path (default when enabled); on the personal path seal it with --password pw@topic (topic send) or a bare --password (self-send, account default key)."), Options.optional);
+const supersededByOption = Options.text("superseded-by").pipe(Options.withDescription("The replacement's id — a task id, a subtask id of the same chain, or (for a group cancel) the replacement group id. Requires --reason superseded."), Options.optional);
+const noEncryptOption$3 = Options.boolean("no-encrypt").pipe(Options.withDescription("For org cancels: send the note in plaintext even when the org vault is unlocked."));
+const cancelCommand = Command.make("cancel", {
+	id: idArg$2,
+	reason: reasonOption,
+	note: noteOption,
+	"superseded-by": supersededByOption,
+	password: passwordOption,
+	"no-encrypt": noEncryptOption$3,
+	"api-token": apiTokenOption,
+	"base-url": baseUrlOption,
+	quiet: quietOption
+}, (args) => Effect.gen(function* () {
+	const out = yield* CliOutput;
+	yield* out.setQuiet(args.quiet);
+	const note = Option.getOrUndefined(args.note);
+	const supersededBy = Option.getOrUndefined(args["superseded-by"]);
+	if (supersededBy !== void 0 && args.reason !== "superseded") return yield* Effect.fail(new UserError({ message: "--superseded-by requires --reason superseded" }));
+	const credential = yield* resolveCredential(args["api-token"], args["base-url"]);
+	let noteFields = {};
+	if (note !== void 0) if (credential.kind === "org") {
+		const vault = yield* (yield* VaultAccess).forSendOrPlaintext(args["no-encrypt"]);
+		if (vault) noteFields = {
+			note: yield* sdkCall("encrypt note", () => encrypt(vault.masterKeyCurrent.key, note)),
+			encryption: {
+				type: "org",
+				v: vault.masterKeyCurrent.version
+			}
+		};
+		else {
+			noteFields = { note };
+			yield* out.warn("note sent unencrypted (org encryption disabled or --no-encrypt)");
+		}
+	} else {
+		const passwords = args.password;
+		if (passwords.length > 1) return yield* Effect.fail(new UserError({ message: "pass exactly one --password so the note's key is unambiguous" }));
+		const flag = passwords[0];
+		if (flag === void 0) {
+			noteFields = { note };
+			yield* out.warn("note sent unencrypted — seal it with --password <pw>@<topic> (topic send) or a bare --password (self-send)");
+		} else if (Array.isArray(flag)) {
+			const derived = yield* sdkCall("derive note key", () => deriveKey(flag[0], flag[1]));
+			noteFields = {
+				note: yield* sdkCall("encrypt note", () => encrypt(derived.symmetricKey, note)),
+				encryption: {
+					type: "personal",
+					keyFingerprint: derived.fingerprint
+				}
+			};
+		} else {
+			const info = yield* sdkCall("fetch password salt", () => fetchUserInfo({
+				baseUrl: new URL(credential.baseUrl),
+				apiToken: credential.apiToken,
+				fetch
+			}));
+			const derived = yield* sdkCall("derive note key", () => deriveKey(flag, info.passwordSalt));
+			noteFields = {
+				note: yield* sdkCall("encrypt note", () => encrypt(derived.symmetricKey, note)),
+				encryption: {
+					type: "personal",
+					keyFingerprint: derived.fingerprint
+				}
+			};
+		}
+	}
+	const body = {
+		reason: args.reason,
+		...noteFields,
+		...supersededBy !== void 0 ? { supersededBy } : {}
+	};
+	const baseUrl = new URL(credential.baseUrl);
+	const authHeaders = credential.kind === "personal" ? { "API-Token": credential.apiToken } : { Authorization: `Bearer ${credential.bearer}` };
+	if (args.id.startsWith("grptsk_")) {
+		const result = yield* sdkCall("cancel task group", () => cancelTaskGroup({
+			baseUrl,
+			groupId: args.id,
+			body,
+			authHeaders
+		}));
+		yield* out.print(JSON.stringify({
+			type: "canceled",
+			groupId: args.id,
+			...result
+		}));
+	} else if (args.id.startsWith("tsk_")) {
+		yield* sdkCall("cancel task", () => cancelTask({
+			baseUrl,
+			taskId: args.id,
+			body,
+			authHeaders
+		}));
+		yield* out.info(`canceled ${args.id}`);
+	} else if (args.id.startsWith("sub_")) {
+		yield* sdkCall("cancel subtask", () => cancelSubtask({
+			baseUrl,
+			subtaskId: args.id,
+			body,
+			authHeaders
+		}));
+		yield* out.info(`canceled ${args.id}`);
+	} else return yield* Effect.fail(new UserError({ message: `cannot cancel \`${args.id}\`: expected a tsk_…, sub_…, or grptsk_… id` }));
+})).pipe(Command.withDescription("Cancel a pending task, subtask, or task group you sent (sender-side withdrawal)."));
+//#endregion
 //#region src/commands/daemon.ts
 const resolveDaemonCredential = (tokenOpt) => Effect.gen(function* () {
 	if (Option.isSome(tokenOpt)) return {
@@ -1670,21 +1917,36 @@ const daemonCommand = Command.make("daemon", {
 }));
 //#endregion
 //#region src/commands/download.ts
-const IDLE_MS = 1e4;
+const ID_GLOSSARY = "(ids: tsk_ task, sub_ subtask, sbm_ submission; files: inp_ input upload, rfl_ reply file, sbf_ submission file)";
 const resolveScope = (scopeId, fileId) => {
-	if (scopeId.startsWith("sub_")) return Effect.fail(new UserError({ message: "subtask files are addressed by their parent task: pass the tsk_… id (collect reply/input lines carry it as taskId)" }));
-	const kind = scopeId.startsWith("tsk_") ? "task" : scopeId.startsWith("sbm_") ? "submission" : void 0;
-	if (kind === void 0) return Effect.fail(new UserError({ message: `expected a task (tsk_…) or submission (sbm_…) scope id, got '${scopeId}'` }));
-	const wantedScope = fileId.startsWith("inp_") || fileId.startsWith("rfl_") ? "task" : fileId.startsWith("sbf_") ? "submission" : void 0;
-	if (wantedScope === void 0) return Effect.fail(new UserError({ message: `expected an input upload (inp_…), reply file (rfl_…), or submission file (sbf_…) id, got '${fileId}'` }));
-	if (wantedScope !== kind) return Effect.fail(new UserError({ message: wantedScope === "task" ? `${fileId} is a task-scoped file — pass its tsk_… id, not ${scopeId}` : `${fileId} is a submission file — pass its sbm_… id, not ${scopeId}` }));
-	return Effect.succeed(kind);
+	const scope = scopeId.startsWith("tsk_") ? "task" : scopeId.startsWith("sub_") ? "subtask" : scopeId.startsWith("sbm_") ? "submission" : void 0;
+	if (scope === void 0) return Effect.fail(new UserError({ message: `expected a task (tsk_…), subtask (sub_…), or submission (sbm_…) scope id, got '${scopeId}' ${ID_GLOSSARY}` }));
+	const wantsChain = fileId.startsWith("inp_") || fileId.startsWith("rfl_");
+	const wantsSubmission = fileId.startsWith("sbf_");
+	if (!wantsChain && !wantsSubmission) return Effect.fail(new UserError({ message: `expected an input upload (inp_…), reply file (rfl_…), or submission file (sbf_…) id, got '${fileId}' ${ID_GLOSSARY}` }));
+	if (wantsSubmission !== (scope === "submission")) return Effect.fail(new UserError({ message: wantsSubmission ? `${fileId} is a submission file — pass its sbm_… id, not ${scopeId} ${ID_GLOSSARY}` : `${fileId} lives on a task chain — pass the tsk_… or sub_… id it belongs to, not ${scopeId} ${ID_GLOSSARY}` }));
+	return Effect.succeed(scope);
+};
+const downloadUrlPath = (scope, scopeId, fileId) => {
+	if (scope === "submission") return `/v1/submissions/${scopeId}/files/${fileId}/download-url`;
+	const kind = fileId.startsWith("inp_") ? "inputs" : "replies";
+	return `/v1/${scope === "task" ? "tasks" : "subtasks"}/${scopeId}/${kind}/${fileId}/download-url`;
+};
+/** Resolve where to write: an explicit file path, an existing directory (the
+* server-declared filename inside it), or the current directory. */
+const resolveTarget = async (outArg, filename) => {
+	if (outArg === void 0) return path.join(process.cwd(), filename);
+	try {
+		if ((await stat(outArg)).isDirectory()) return path.join(outArg, filename);
+	} catch {
+		await mkdir(path.dirname(outArg), { recursive: true });
+	}
+	return outArg;
 };
 const downloadCommand = Command.make("download", {
-	scopeId: Args.text({ name: "scope-id" }).pipe(Args.withDescription("The containing entity: a task (tsk_…, the `taskId` on collect reply/input lines) or a submission (sbm_…, the `id` on submission lines).")),
+	scopeId: Args.text({ name: "scope-id" }).pipe(Args.withDescription("The containing entity: a task (tsk_…), a subtask (sub_…), or a submission (sbm_…) — the id the collect line carries.")),
 	fileId: Args.text({ name: "file-id" }).pipe(Args.withDescription("The file to download: an input upload (inp_…), reply file (rfl_…), or submission file (sbf_…) — the `id` on the line's file object.")),
 	out: Options.text("out").pipe(Options.withDescription("Where to save: a file path, an existing directory (the upload's filename is used inside it), or omitted for the current directory."), Options.optional),
-	since: Options.text("since").pipe(Options.withDescription("How far back to search the event stream for the file (`24h`, `90d`, or ISO 8601). Default: 7d."), Options.withDefault("7d")),
 	format: Options.choice("format", ["json", "pretty"]).pipe(Options.withDescription("Output format: json (one `downloaded` line) or pretty (the saved path)."), Options.withDefault("json")),
 	"api-token": apiTokenOption,
 	password: passwordOption,
@@ -1694,67 +1956,91 @@ const downloadCommand = Command.make("download", {
 	const out = yield* CliOutput;
 	yield* out.setQuiet(args.quiet);
 	const scope = yield* resolveScope(args.scopeId, args.fileId);
-	const sinceIso = resolveSince(args.since);
 	const cred = yield* resolveCredential(args["api-token"], args["base-url"]);
 	const orgKeys = cred.kind === "org" ? yield* loadOrgMasterKeys : void 0;
-	yield* Effect.scoped(Effect.gen(function* () {
-		const health = {
-			reconnects: 0,
-			lastError: void 0,
-			eventsSeen: 0
-		};
-		const onReconnect = (_attempt, _backoffMs, lastError) => {
-			health.reconnects += 1;
-			if (lastError) health.lastError = lastError;
-		};
-		const client = cred.kind === "personal" ? yield* acquireClient({
-			baseUrl: cred.baseUrl,
-			apiToken: cred.apiToken,
-			passwords: [...args.password],
-			onReconnect
-		}) : yield* acquireOrgClient({
-			baseUrl: cred.baseUrl,
-			bearerToken: cred.bearer,
-			...orgKeys !== void 0 ? { orgMasterKeys: orgKeys } : {},
-			onReconnect
+	const baseUrl = cred.baseUrl.replace(/\/+$/, "");
+	const authHeaders = cred.kind === "personal" ? { "API-Token": cred.apiToken } : { Authorization: `Bearer ${cred.bearer}` };
+	const meta = yield* Effect.tryPromise({
+		try: async () => {
+			const res = await fetch(`${baseUrl}${downloadUrlPath(scope, args.scopeId, args.fileId)}`, {
+				method: "POST",
+				headers: authHeaders
+			});
+			if (!res.ok) {
+				const body = await res.text().catch(() => "");
+				let msg = `download-url failed (${res.status})`;
+				try {
+					const parsed = JSON.parse(body);
+					if (parsed.msg) msg = `${msg}: ${parsed.msg}`;
+				} catch {
+					if (body) msg = `${msg}: ${body.slice(0, 200)}`;
+				}
+				throw new Error(msg);
+			}
+			return await res.json();
+		},
+		catch: (e) => new UserError({ message: e instanceof Error ? e.message : String(e) })
+	});
+	const stored = yield* Effect.tryPromise({
+		try: async () => {
+			const res = await fetch(meta.presignedGetUrl);
+			if (!res.ok) throw new Error(`fetching the file failed (${res.status})`);
+			return new Uint8Array(await res.arrayBuffer());
+		},
+		catch: (e) => new UserError({ message: e instanceof Error ? e.message : String(e) })
+	});
+	if (meta.checksumSha256 !== void 0) {
+		const actual = createHash("sha256").update(stored).digest("base64");
+		if (actual !== meta.checksumSha256) return yield* Effect.fail(new UserError({ message: `checksum mismatch: stored blob hashes to ${actual}, server declared ${meta.checksumSha256}` }));
+	}
+	let bytes = stored;
+	if (meta.encryption !== void 0) {
+		const passwords = [...args.password];
+		const passwordSalt = passwords.filter((p) => typeof p === "string").length > 0 && cred.kind === "personal" ? yield* Effect.tryPromise({
+			try: async () => (await fetchUserInfo({
+				baseUrl: new URL(baseUrl),
+				apiToken: cred.apiToken,
+				fetch
+			})).passwordSalt,
+			catch: (e) => new UserError({ message: `fetching the password salt failed: ${e instanceof Error ? e.message : String(e)}` })
+		}) : void 0;
+		const key = yield* Effect.tryPromise({
+			try: async () => {
+				const ring = await Keyring.build({
+					passwords: [],
+					topics: [],
+					...orgKeys !== void 0 ? { orgMasterKeys: orgKeys } : {}
+				});
+				for (const p of passwords) if (typeof p !== "string") ring.add(await deriveKey(p[0], p[1]));
+				else if (passwordSalt !== void 0) ring.add(await deriveKey(p, passwordSalt));
+				return ring.keyForMarker(meta.encryption);
+			},
+			catch: (e) => new UserError({ message: `building the keyring failed: ${e instanceof Error ? e.message : String(e)}` })
 		});
-		const matching = (item) => Option.fromNullable(fileViewsOf(item).find((f) => f.id === args.fileId));
-		const countSeen = (s) => s.pipe(Stream.tap(() => Effect.sync(() => {
-			health.eventsSeen += 1;
-		})));
-		const fileStream = scope === "task" ? countSeen(sdkStream("task activity", (signal) => client.watchTaskGroup({
-			groupId: args.scopeId,
-			createdAt: sinceIso,
-			members: [{ taskId: args.scopeId }]
-		}).activity({
-			replay: true,
-			idleMs: IDLE_MS,
-			signal
-		}))).pipe(Stream.filterMap((g) => matching(g.item))) : countSeen(sdkStream("submissions stream", (signal) => client.submissions({
-			signal,
-			since: sinceIso,
-			idleMs: IDLE_MS
-		}))).pipe(Stream.filterMap((s) => s.id === args.scopeId ? matching(s) : Option.none()));
-		const found = yield* Stream.runHead(fileStream).pipe(Effect.mapError((e) => new UserError({ message: `event stream failed: ${e.cause instanceof Error ? e.cause.message : String(e.cause)} — check --base-url and the credential` })));
-		if (Option.isNone(found)) {
-			const message = health.lastError !== void 0 ? `could not read the event stream (${health.lastError.message}) — check --base-url and the credential` : health.eventsSeen === 0 ? `no events for ${args.scopeId} arrived since ${args.since} — check the ids and --base-url, or widen the search with --since (e.g. --since 90d)` : `${args.fileId} not seen on ${args.scopeId} since ${args.since} (${health.eventsSeen} events replayed) — check the file id, or widen the search with --since (e.g. --since 90d)`;
-			return yield* Effect.fail(new UserError({ message }));
-		}
-		const file = found.value;
-		const path = yield* Effect.tryPromise({
-			try: () => file.save(Option.getOrUndefined(args.out)),
-			catch: (e) => new UserError({ message: `download failed: ${e instanceof Error ? e.message : String(e)}` })
+		if (key === void 0) return yield* Effect.fail(new UserError({ message: meta.encryption.type === "org" ? `the file is sealed under org master_key v${meta.encryption.v} — unlock the vault (org session) to decrypt` : "the file is encrypted — pass the matching -p/--password (`pw@topic`, or a bare account password)" }));
+		bytes = yield* Effect.tryPromise({
+			try: () => decryptBytes(key, stored),
+			catch: (e) => new UserError({ message: `decryption failed: ${e instanceof Error ? e.message : String(e)}` })
 		});
-		if (args.format === "json") yield* out.print(JSON.stringify({
-			type: "downloaded",
-			id: file.id ?? null,
-			path,
-			filename: file.filename ?? null,
-			contentType: file.contentType ?? null,
-			size: file.size ?? null
-		}));
-		else yield* out.print(path);
+	}
+	const filename = meta.filename ?? args.fileId;
+	const target = yield* Effect.tryPromise({
+		try: async () => {
+			const t = await resolveTarget(Option.getOrUndefined(args.out), filename);
+			await writeFile(t, bytes);
+			return t;
+		},
+		catch: (e) => new UserError({ message: `saving failed: ${e instanceof Error ? e.message : String(e)}` })
+	});
+	if (args.format === "json") yield* out.print(JSON.stringify({
+		type: "downloaded",
+		id: args.fileId,
+		path: target,
+		filename: meta.filename ?? null,
+		contentType: meta.contentType ?? null,
+		size: meta.size ?? null
 	}));
+	else yield* out.print(target);
 }));
 //#endregion
 //#region src/output.ts
@@ -1775,7 +2061,7 @@ function formatEvent(event, format, decrypted) {
 				if (a.devicePublicId || a.deviceName) lines.push(`  device:      ${a.deviceName ? `${a.deviceName} (${a.devicePublicId ?? "?"})` : a.devicePublicId}`);
 			}
 			if (event.encryption) {
-				const enc = event.encryption.type === "personal" ? `personal (${event.encryption.passwordFingerprint})` : `org (v${event.encryption.v})`;
+				const enc = event.encryption.type === "personal" ? `personal (${event.encryption.keyFingerprint})` : `org (v${event.encryption.v})`;
 				lines.push(`  encryption:  ${enc}`);
 			}
 			if (decrypted !== void 0) lines.push(`  decrypted:   ${prettyValue(decrypted)}`);
@@ -1817,20 +2103,20 @@ const sinceOption = mappedText("since", resolveSince).pipe(Options.withDescripti
 const untilOption = mappedText("until", resolveUntil).pipe(Options.withDescription("Stop at this timestamp. Forces a finite range, so `--follow` is ignored."), Options.optional);
 const limitOption = Options.integer("limit").pipe(Options.withDescription("Maximum number of events to print, then exit."), Options.optional);
 const followOption = Options.boolean("follow").pipe(Options.withAlias("f"), Options.withDescription("After history is drained, keep streaming live instead of exiting. Only meaningful with `--since`."));
-const formatOption$2 = Options.choice("format", [
+const formatOption$3 = Options.choice("format", [
 	"json",
 	"pretty",
 	"raw"
 ]).pipe(Options.withDescription("Output format."), Options.withDefault("json"));
 const directOption = Options.boolean("direct").pipe(Options.withDescription("Open an independent WS connection. By default a LIVE stream (no --since) shares ONE broker connection across all sp processes; --direct bypasses it. A --since history replay always goes direct."));
-const QUIET_EXIT_AFTER_DRAIN = "2 seconds";
+const QUIET_EXIT_MS = 2e3;
 const eventsCommand = Command.make("events", {
 	type: eventTypeOption,
 	since: sinceOption,
 	until: untilOption,
 	limit: limitOption,
 	follow: followOption,
-	format: formatOption$2,
+	format: formatOption$3,
 	direct: directOption,
 	topic: topicOption,
 	"api-token": apiTokenOption,
@@ -1840,52 +2126,83 @@ const eventsCommand = Command.make("events", {
 }, (args) => Effect.gen(function* () {
 	const out = yield* CliOutput;
 	yield* out.setQuiet(args.quiet);
-	const apiToken = yield* requireApiToken(args["api-token"]);
-	const baseUrl = args["base-url"];
+	const cred = yield* resolveCredential(args["api-token"], args["base-url"]);
+	const baseUrl = cred.baseUrl;
 	const sinceIso = Option.getOrUndefined(args.since);
 	const untilDate = Option.getOrUndefined(args.until);
 	const limit = Option.getOrUndefined(args.limit);
 	const filter = new TypeFilter(args.type);
 	yield* Effect.forEach(filter.unknown, (u) => out.warn(`ignoring unknown --type \`${u}\``));
 	const webSocketFactory = args.direct || sinceIso !== void 0 ? Option.none() : yield* sharedWebSocketFactory({
-		credential: {
+		credential: cred.kind === "personal" ? {
 			kind: "personal",
-			apiToken
+			apiToken: cred.apiToken
+		} : {
+			kind: "org",
+			bearer: cred.bearer
 		},
 		baseUrl
 	});
+	const factoryConfig = Option.match(webSocketFactory, {
+		onNone: () => ({}),
+		onSome: (f) => ({ webSocketFactory: f })
+	});
+	const orgKeys = cred.kind === "org" ? yield* loadOrgMasterKeys : void 0;
+	if (cred.kind === "org") yield* out.info(`streaming via org session (${baseUrl})`);
 	yield* Effect.scoped(Effect.gen(function* () {
-		const client = yield* acquireClient({
+		const client = cred.kind === "personal" ? yield* acquireClient({
 			baseUrl,
-			apiToken,
+			apiToken: cred.apiToken,
 			passwords: args.password,
-			...Option.match(webSocketFactory, {
-				onNone: () => ({}),
-				onSome: (f) => ({ webSocketFactory: f })
-			})
+			...factoryConfig
+		}) : yield* acquireOrgClient({
+			baseUrl,
+			bearerToken: cred.bearer,
+			...orgKeys !== void 0 ? { orgMasterKeys: orgKeys } : {},
+			...factoryConfig
 		});
-		const keyring = args.password.length > 0 ? yield* sdkCall("keyring", () => client.keyring({ includePasswordSalt: true })) : void 0;
-		if (keyring) if (keyring.size > 0) yield* out.info(`keyring built with ${keyring.size} fingerprint(s)`);
+		const keyring = cred.kind === "org" ? orgKeys !== void 0 ? yield* sdkCall("keyring", () => client.keyring()) : void 0 : args.password.length > 0 ? yield* sdkCall("keyring", () => client.keyring({ includePasswordSalt: true })) : void 0;
+		if (keyring && cred.kind === "org") yield* out.info(`keyring built with ${orgKeys.length} org master key(s)`);
+		else if (keyring) if (keyring.size > 0) yield* out.info(`keyring built with ${keyring.size} fingerprint(s)`);
 		else yield* out.warn(`no symmetric keys derived from --password (count=${args.password.length})`);
-		yield* out.info(`connecting to ${baseUrl.replace(/\/+$/, "")}/ws/v1/events${sinceIso ? `?since=${sinceIso}` : ""}`);
+		const wsPath = cred.kind === "org" ? "/ws/v1/events/organization" : "/ws/v1/events";
+		yield* out.info(`connecting to ${baseUrl.replace(/\/+$/, "")}${wsPath}${sinceIso ? `?since=${sinceIso}` : ""}`);
 		const exitWhenQuiet = sinceIso !== void 0 && !args.follow && untilDate === void 0;
 		const printed = yield* Ref.make(0);
 		const endNote = yield* Ref.make(Option.none());
 		const note = (msg) => Ref.set(endNote, Option.some(msg));
+		const halt = yield* Deferred.make();
+		const lastActivity = yield* Ref.make(Date.now());
+		if (exitWhenQuiet) yield* Effect.forkScoped(Effect.gen(function* () {
+			while (true) {
+				yield* Effect.sleep("250 millis");
+				const last = yield* Ref.get(lastActivity);
+				if (Date.now() - last >= QUIET_EXIT_MS) {
+					yield* note("history drained, exiting (use --follow to keep streaming)");
+					yield* Deferred.succeed(halt, void 0);
+					return;
+				}
+			}
+		}));
 		const untilReached = (ev) => {
 			if (untilDate === void 0 || !ev.createdAt) return false;
 			const t = new Date(ev.createdAt);
 			return Number.isFinite(t.getTime()) && t >= untilDate;
 		};
+		const endController = new AbortController();
+		yield* Effect.forkScoped(Deferred.await(halt).pipe(Effect.andThen(Effect.sync(() => endController.abort()))));
 		yield* sdkStream("events stream", (signal) => client.events({
 			...sinceIso !== void 0 ? { since: sinceIso } : {},
-			signal
-		})).pipe(exitWhenQuiet ? Stream.timeoutTo(QUIET_EXIT_AFTER_DRAIN, Stream.drain(Stream.fromEffect(note("history drained, exiting (use --follow to keep streaming)")))) : (s) => s, untilDate !== void 0 ? Stream.takeUntilEffect((ev) => untilReached(ev) ? note("--until reached, exiting").pipe(Effect.as(true)) : Effect.succeed(false)) : (s) => s, Stream.filter((ev) => !untilReached(ev) && filter.matches(ev)), Stream.mapEffect((ev) => Effect.gen(function* () {
+			signal: AbortSignal.any([signal, endController.signal])
+		})).pipe(Stream.tap(() => Ref.set(lastActivity, Date.now())), Stream.interruptWhen(Deferred.await(halt)), untilDate !== void 0 ? Stream.takeUntilEffect((ev) => untilReached(ev) ? note("--until reached, exiting").pipe(Effect.zipRight(Deferred.succeed(halt, void 0)), Effect.as(true)) : Effect.succeed(false)) : (s) => s, Stream.filter((ev) => !untilReached(ev) && filter.matches(ev)), Stream.mapEffect((ev) => Effect.gen(function* () {
 			const decrypted = keyring ? yield* sdkCall("decrypt event", () => tryDecryptEventData(ev, keyring)) : void 0;
 			yield* out.print(formatEvent(ev, args.format, decrypted));
 			const n = yield* Ref.updateAndGet(printed, (x) => x + 1);
-			if (limit !== void 0 && n >= limit) yield* note(`--limit ${limit} reached, exiting`);
-		})), limit !== void 0 ? Stream.take(limit) : (s) => s, Stream.runDrain);
+			if (limit !== void 0 && n >= limit) {
+				yield* note(`--limit ${limit} reached, exiting`);
+				yield* Deferred.succeed(halt, void 0);
+			}
+		})), limit !== void 0 ? Stream.take(limit) : (s) => s, Stream.runDrain, Effect.catchAll((e) => Effect.flatMap(Deferred.isDone(halt), (done) => done ? Effect.void : Effect.fail(e))));
 		yield* Ref.get(endNote).pipe(Effect.flatMap(Option.match({
 			onNone: () => Effect.void,
 			onSome: (msg) => out.info(msg)
@@ -2255,7 +2572,7 @@ const actionInputOption = Options.text("action-input").pipe(Options.withAlias("a
 const textInputOption = Options.boolean("text-input").pipe(Options.withDescription("Add a free-text reply input the recipient types an answer into. Mutually exclusive with --choice-input / --action-input (a notification carries at most one input)."));
 const choiceInputOption = Options.text("choice-input").pipe(Options.withAlias("c"), Options.withDescription("Add a single-choice input: a comma-separated options list (e.g. \"Approve,Deny\") the recipient picks one of. Notifications are single-select only. Mutually exclusive with --text-input / --action-input."), Options.optional);
 const sharedOption$1 = Options.boolean("shared").pipe(Options.withDescription("Shared mode: ONE notification all recipients see and answer together (the first reply completes it for everyone). Default (without this flag) is independent mode: every recipient gets their own notification instance under a group."));
-const formatOption$1 = Options.choice("format", ["text", "json"]).pipe(Options.withDescription("stdout format for a send: `text` (the bare id, default) or `json` (a `sent` line piped to `sp collect`)."), Options.withDefault("text"));
+const formatOption$2 = Options.choice("format", ["text", "json"]).pipe(Options.withDescription("stdout format for a send: `text` (the bare id, default) or `json` (a `sent` line piped to `sp collect`)."), Options.withDefault("text"));
 /** Parse the (at most one) notification input off the three flags. */
 const parseNotificationInput = (textInputOn, choiceRaw, actionRaw) => Effect.gen(function* () {
 	if ([
@@ -2302,7 +2619,7 @@ const notifyCommand = Command.make("notify", {
 	"choice-input": choiceInputOption,
 	"action-input": actionInputOption,
 	shared: sharedOption$1,
-	format: formatOption$1,
+	format: formatOption$2,
 	noEncrypt: noEncryptOption$2,
 	topic: topicOption,
 	"api-token": apiTokenOption,
@@ -2330,67 +2647,75 @@ const notifyCommand = Command.make("notify", {
 	if (imageUrl !== void 0 && audioUrl !== void 0) return yield* Effect.fail(new UserError({ message: "only one of --image or --audio may be set" }));
 	const mediaUrl = imageUrl ?? audioUrl;
 	const mediaKind = imageUrl !== void 0 ? "image" : "audio";
-	let mediaContentType;
 	if (mediaUrl !== void 0) {
 		if (!/^https?:\/\//.test(mediaUrl)) return yield* Effect.fail(new UserError({ message: "notification media from the CLI must be an http(s) URL; file uploads aren't supported here (use the SDK)" }));
-		const contentType = notifyMediaContentType(mediaUrl, mediaKind);
-		if (contentType === null) return yield* Effect.fail(new UserError({ message: `--${mediaKind} URL must point to a supported ${mediaKind} type (by extension); got "${mediaUrl}"` }));
-		mediaContentType = contentType;
+		if (notifyMediaContentType(mediaUrl, mediaKind) === null) return yield* Effect.fail(new UserError({ message: `--${mediaKind} URL must point to a supported ${mediaKind} type (by extension); got "${mediaUrl}"` }));
 	}
 	const input = yield* parseNotificationInput(args["text-input"], Option.getOrUndefined(args["choice-input"]), Option.getOrUndefined(args["action-input"]));
 	if (isOrgTarget) {
 		const api = yield* Api;
 		const vault = yield* (yield* VaultAccess).forSendOrPlaintext(args.noEncrypt);
+		const auth = yield* api.session;
 		const target = memberName !== void 0 ? { member: memberName } : args.broadcast ? { broadcast: true } : { topic: orgTopicName };
-		const media = mediaUrl !== void 0 ? {
-			type: "link",
-			url: mediaUrl,
-			contentType: mediaContentType
-		} : void 0;
-		const masterKey = vault ? {
-			key: vault.masterKeyCurrent.key,
-			version: vault.masterKeyCurrent.version
-		} : void 0;
-		const opts = {
+		const orgMasterKeys = vault ? [vault.masterKeyCurrent, ...vault.masterKeyHistory].map((k) => ({
+			version: k.version,
+			key: k.key
+		})) : void 0;
+		const encNote = vault ? ` (encrypted under master_key v${vault.masterKeyCurrent.version})` : " (plaintext)";
+		const orgOpts = {
 			content: message,
 			...titleOpt !== void 0 ? { title: titleOpt } : {},
 			...tagOpt !== void 0 ? { tag: tagOpt } : {},
 			...input !== void 0 ? { input } : {},
-			...args.shared ? { shared: true } : {}
+			...imageUrl !== void 0 ? { image: imageUrl } : {},
+			...audioUrl !== void 0 ? { audio: audioUrl } : {}
 		};
-		const body = yield* sdkCall("build notification request", () => buildOrgNotificationRequest(target, opts, media, masterKey));
-		const payload = yield* api.postJson("notify", "/v1/org/notifications/json", Schema.Unknown, body);
-		const encNote = vault ? ` (encrypted under master_key v${vault.masterKeyCurrent.version})` : " (plaintext)";
-		if (isNotificationGroupResponse(payload)) {
-			const n = payload.instances.length;
-			yield* out.info(`notification group created: ${payload.groupId} (${n} recipient${n === 1 ? "" : "s"})${encNote}`);
-			yield* Effect.forEach(payload.instances, (inst) => {
-				const who = `${inst.recipient.publicId}${inst.recipient.name ? ` (${inst.recipient.name})` : ""}`;
+		yield* Effect.scoped(Effect.gen(function* () {
+			const client = yield* acquireOrgClient({
+				baseUrl: auth.baseUrl,
+				bearerToken: bearerToken(auth),
+				...orgMasterKeys !== void 0 ? { orgMasterKeys } : {}
+			});
+			if (args.shared) {
+				const note = yield* sdkCall("notify", () => client.sendNotification({
+					...target,
+					...orgOpts,
+					shared: true
+				}));
+				yield* out.info(`Notification sent${encNote}.`);
+				yield* out.info(`Id:      ${note.notificationId}`);
+				yield* out.info(`Created: ${note.createdAt}`);
+				if (args.format === "json") yield* out.print(formatSent(void 0, note.createdAt, [{
+					id: note.notificationId,
+					kind: "notification",
+					recipient: null
+				}]));
+				else yield* out.print(note.notificationId);
+				return;
+			}
+			const group = yield* sdkCall("notify", () => client.sendNotification({
+				...target,
+				...orgOpts
+			}));
+			const n = group.instances.length;
+			yield* out.info(`notification group created: ${group.groupId} (${n} recipient${n === 1 ? "" : "s"})${encNote}`);
+			yield* Effect.forEach(group.instances, (inst) => {
+				const who = inst.recipient ? `${inst.recipient.publicId}${inst.recipient.name ? ` (${inst.recipient.name})` : ""}` : "unknown";
 				return out.info(`instance: ${who} -> ${inst.notificationId}`);
 			});
 			if (n === 0) yield* out.warn("the target has no recipients — the group is empty");
 			if (args.format === "json") {
-				const members = payload.instances.map((inst) => ({
+				const members = group.instances.map((inst) => ({
 					id: inst.notificationId,
 					kind: "notification",
-					recipient: {
+					recipient: inst.recipient ? {
 						publicId: inst.recipient.publicId,
 						name: inst.recipient.name ?? null
-					}
+					} : null
 				}));
-				yield* out.print(formatSent(payload.groupId, payload.createdAt, members));
-			} else yield* out.print(payload.groupId);
-		} else {
-			yield* out.info(`Notification sent${encNote}.`);
-			yield* out.info(`Id:      ${payload.notificationId}`);
-			yield* out.info(`Created: ${payload.createdAt}`);
-			if (args.format === "json") yield* out.print(formatSent(void 0, payload.createdAt, [{
-				id: payload.notificationId,
-				kind: "notification",
-				recipient: null
-			}]));
-			else yield* out.print(payload.notificationId);
-		}
+				yield* out.print(formatSent(group.groupId, group.createdAt, members));
+			} else yield* out.print(group.groupId);
+		}));
 		return;
 	}
 	const apiToken = yield* requireApiToken(args["api-token"]);
@@ -2457,6 +2782,125 @@ const notifyCommand = Command.make("notify", {
 	}));
 }));
 //#endregion
+//#region src/commands/integration.ts
+const WrappedKey$1 = Schema.Struct({
+	version: Schema.Number,
+	blob: Schema.String
+});
+const CreateOrgIntegrationResponse = Schema.Struct({
+	id: Schema.String,
+	credential: Schema.String
+});
+const OrgIntegrationSummary = Schema.Struct({
+	id: Schema.String,
+	name: Schema.String,
+	scopes: Schema.Array(Schema.String),
+	pubkeyB64: Schema.String,
+	wrappedKeys: Schema.Array(WrappedKey$1),
+	createdAt: Schema.String,
+	revokedAt: Schema.optional(Schema.String),
+	lastUsedAt: Schema.optional(Schema.String)
+});
+const ListOrgIntegrationsResponse = Schema.Struct({ integrations: Schema.Array(OrgIntegrationSummary) });
+/** Shared with the org-encryption rotation walk. */
+const fetchOrgIntegrations = Effect.gen(function* () {
+	const { integrations } = yield* (yield* Api).getJson("fetch integrations", "/v1/org/integrations", ListOrgIntegrationsResponse);
+	return integrations;
+});
+/** Shared with the org-encryption rotation walk. */
+const putIntegrationWraps = (id, wraps) => Effect.gen(function* () {
+	yield* (yield* Api).put("integration wrap", `/v1/org/integrations/${encodeURIComponent(id)}/wraps`, { wraps });
+});
+const nameOption = Options.text("name").pipe(Options.withDescription("Human-readable label, shown in `sp integration list` and nowhere else."));
+const scopesOption = Options.text("scopes").pipe(Options.withDefault("send,events:read"), Options.withDescription("Comma-separated scopes (send, events:read, files:read). org:admin is refused — administration is a human act."));
+const createCommand = Command.make("create", {
+	name: nameOption,
+	scopes: scopesOption,
+	quiet: quietOption
+}, (args) => Effect.gen(function* () {
+	const out = yield* CliOutput;
+	yield* out.setQuiet(args.quiet);
+	const api = yield* Api;
+	const access = yield* VaultAccess;
+	const vaultStore = yield* VaultStore;
+	const sodium = yield* Sodium;
+	const scopes = args.scopes.split(",").map((s) => s.trim()).filter(Boolean);
+	const cfg = yield* access.fetchConfig;
+	const unlocked = cfg.enabled ? yield* access.unlockForRotation.pipe(Effect.map((u) => ({
+		...u,
+		cfg
+	}))) : void 0;
+	const seed = yield* sodium.randomBytes(32);
+	const keypair = yield* sodium.seedKeypair(seed);
+	const wraps = [];
+	if (unlocked) {
+		const versions = [...unlocked.vault.masterKeyHistory, unlocked.vault.masterKeyCurrent];
+		for (const mk of versions) {
+			const blob = yield* sodium.wrapMasterKey(mk.key, unlocked.vault.adminPrivateKey, keypair.publicKey);
+			wraps.push({
+				version: mk.version,
+				blob: sodium.toB64(blob)
+			});
+		}
+	}
+	const made = yield* api.postJson("create integration", "/v1/org/integrations", CreateOrgIntegrationResponse, {
+		name: args.name,
+		scopes,
+		pubkeyB64: sodium.toB64(keypair.publicKey),
+		wrappedKeys: wraps
+	});
+	if (unlocked) {
+		const nextVault = {
+			...unlocked.vault,
+			integrations: [...unlocked.vault.integrations, {
+				id: made.id,
+				pubkeyB64: sodium.toB64(keypair.publicKey),
+				name: args.name
+			}]
+		};
+		const enabledCfg = yield* access.requireEnabled(unlocked.cfg);
+		const newBlob = yield* sodium.encryptVault(nextVault, unlocked.vaultKey);
+		yield* api.put("vault update", "/v1/org/encryption/vault", {
+			vaultBlobB64: sodium.toB64(newBlob),
+			vaultSaltB64: enabledCfg.vaultSaltB64,
+			kdfParams: enabledCfg.kdfParams
+		}).pipe(Effect.tap(() => vaultStore.save(nextVault)), Effect.catchAll(() => out.error("integration created, but pinning its pubkey in the vault failed — key rotation will SKIP this integration until a `create` or vault write succeeds again.")));
+	}
+	const token = `${made.credential}.${sodium.toB64Url(seed)}`;
+	yield* out.info(`Integration '${args.name}' created (id ${made.id}, scopes: ${scopes.join(" ")}).`);
+	yield* out.info("This token is shown ONCE and cannot be recovered — store it now:");
+	yield* out.print(token);
+	if (!cfg.enabled) yield* out.info("Org encryption is not enabled; sends made with this token go out plaintext.");
+	yield* out.info(`Revoke with: sp integration revoke ${made.id}`);
+}));
+const listCommand = Command.make("list", { quiet: quietOption }, (args) => Effect.gen(function* () {
+	const out = yield* CliOutput;
+	yield* out.setQuiet(args.quiet);
+	const integrations = yield* fetchOrgIntegrations;
+	if (integrations.length === 0) return yield* out.info("No integrations. Mint one with `sp integration create --name <name>`.");
+	for (const i of integrations) {
+		const state = i.revokedAt ? `revoked ${i.revokedAt}` : "active";
+		const used = i.lastUsedAt ? `last used ${i.lastUsedAt}` : "never used";
+		const keys = i.wrappedKeys.length > 0 ? `keys v${i.wrappedKeys.map((w) => w.version).join(",v")}` : "no keys";
+		yield* out.print(`${i.id}  ${i.name}  [${i.scopes.join(" ")}]  ${state}  ${used}  ${keys}`);
+	}
+}));
+const idArg$1 = Args.text({ name: "id" }).pipe(Args.withDescription("Integration id, from `sp integration list`."));
+const revokeCommand = Command.make("revoke", {
+	id: idArg$1,
+	quiet: quietOption
+}, (args) => Effect.gen(function* () {
+	const out = yield* CliOutput;
+	yield* out.setQuiet(args.quiet);
+	yield* (yield* Api).delete("revoke integration", `/v1/org/integrations/${encodeURIComponent(args.id)}`);
+	yield* out.info(`Integration ${args.id} revoked — its credential stops working immediately. It keeps any keys it already unwrapped: if it was compromised, also run \`sp org encryption key rotate\`.`);
+}));
+const integrationCommand = Command.make("integration").pipe(Command.withSubcommands([
+	createCommand,
+	listCommand,
+	revokeCommand
+]));
+//#endregion
 //#region src/commands/org-encryption.ts
 const WrappedKey = Schema.Struct({
 	version: Schema.Number,
@@ -2473,7 +2917,7 @@ const fetchEncryptionDevices = Effect.gen(function* () {
 	const { devices } = yield* (yield* Api).getJson("fetch encryption devices", "/v1/org/encryption/devices", ListOrgEncryptionDevicesResponse);
 	return devices;
 });
-const yesIWroteItDownOption = Options.boolean("i-saved-the-passphrase").pipe(Options.withDescription("Confirm you have copied the passphrase somewhere safe. The passphrase is the only way to unlock the org's encryption vault on another machine; if lost, the only recovery is to re-enable encryption and re-onboard every device."));
+const yesIWroteItDownOption = Options.boolean("i-saved-the-passphrase").pipe(Options.withDescription("Acknowledge that enable will print the org passphrase exactly once and that you will copy it somewhere safe. The passphrase is the only way to unlock the org's encryption vault on another machine; if lost, the only recovery is to re-enable encryption and re-onboard every device."));
 const enableCommand = Command.make("enable", {
 	confirm: yesIWroteItDownOption,
 	quiet: quietOption
@@ -2488,6 +2932,17 @@ const enableCommand = Command.make("enable", {
 		yield* out.error("encryption is already enabled for this org. Use `sp org encryption key rotate` to rotate the key.");
 		return yield* Effect.fail(new Aborted());
 	}
+	if (!args.confirm) {
+		yield* out.info("Enabling encryption generates an org passphrase that is shown exactly once.");
+		yield* out.info("It is the ONLY way to:");
+		yield* out.info("  - unlock the encryption vault from another admin's machine");
+		yield* out.info("  - recover access if your CLI state is lost");
+		yield* out.info("It cannot be recovered if forgotten. Re-enabling encryption forces");
+		yield* out.info("every member device to re-onboard from scratch.");
+		yield* out.info("");
+		yield* out.info("Re-run with --i-saved-the-passphrase to generate the passphrase and enable encryption.");
+		return yield* Effect.fail(new Aborted());
+	}
 	const passphrase = yield* sodium.generatePassphrase();
 	const vaultSalt = yield* sodium.generateVaultSalt;
 	const adminKp = yield* sodium.generateAdminKeyPair;
@@ -2499,7 +2954,8 @@ const enableCommand = Command.make("enable", {
 			version: 1,
 			key: masterKey
 		},
-		masterKeyHistory: []
+		masterKeyHistory: [],
+		integrations: []
 	};
 	const vaultKey = yield* sodium.deriveVaultKey(passphrase, vaultSalt, DEFAULT_KDF_PARAMS);
 	const vaultBlob = yield* sodium.encryptVault(vaultContents, vaultKey);
@@ -2514,10 +2970,6 @@ const enableCommand = Command.make("enable", {
 	yield* out.info("It cannot be recovered if forgotten. Re-enabling encryption forces");
 	yield* out.info("every member device to re-onboard from scratch.");
 	yield* out.info("");
-	if (!args.confirm) {
-		yield* out.info("Re-run with --i-saved-the-passphrase to push this config to the server.");
-		return yield* Effect.fail(new Aborted());
-	}
 	yield* api.post("enable", "/v1/org/encryption/enable", {
 		adminPubkeyB64: sodium.toB64(adminKp.publicKey),
 		vaultBlobB64: sodium.toB64(vaultBlob),
@@ -2572,23 +3024,27 @@ const wrapCurrentKeyToAllDevices = (vault) => Effect.gen(function* () {
 	yield* Effect.forEach(devices, (dev) => Effect.gen(function* () {
 		const pubkey = sodium.fromB64(dev.devicePubkeyB64);
 		const storedHmac = sodium.fromB64(dev.inviteHmacB64);
-		const matchedInvite = knownInvites.find((inv) => sodium.constantTimeEqual(sodium.hmacInviteBinding(inv.code, pubkey), storedHmac));
-		if (!matchedInvite) {
+		const currentWrap = dev.wrappedKeys.find((w) => w.version === currentMaster.version);
+		if (currentWrap !== void 0 && (yield* sodium.unwrapMasterKey(sodium.fromB64(currentWrap.blob), vault.adminPrivateKey, pubkey).pipe(Effect.map((key) => sodium.constantTimeEqual(key, currentMaster.key)), Effect.orElseSucceed(() => false)))) {
 			counts = {
 				...counts,
-				unverified: counts.unverified + 1
+				alreadyCurrent: counts.alreadyCurrent + 1
 			};
-			return yield* out.error(`device ${dev.deviceId}: HMAC doesn't match any locally-known invite — skipping. (This device joined via an invite issued from a different CLI install, or the invite has been pruned.)`);
+			return;
 		}
-		if (dev.wrappedKeys.some((w) => w.version === currentMaster.version)) {
+		const matchedInvite = knownInvites.find((inv) => sodium.constantTimeEqual(sodium.hmacInviteBinding(inv.code, pubkey), storedHmac));
+		if (!matchedInvite) {
 			counts = {
 				...counts,
-				alreadyCurrent: counts.alreadyCurrent + 1
+				unverified: counts.unverified + 1
 			};
-			return;
+			return yield* out.error(`device ${dev.deviceId}: HMAC doesn't match any locally-known invite — skipping. (This device joined via an invite issued from a different CLI install, or the invite has been pruned.)`);
 		}
 		const blob = yield* sodium.wrapMasterKey(currentMaster.key, vault.adminPrivateKey, pubkey);
-		const nextWraps = [...dev.wrappedKeys.filter((w) => w.version !== currentMaster.version), {
+		const nextWraps = currentWrap !== void 0 ? [{
+			version: currentMaster.version,
+			blob: sodium.toB64(blob)
+		}] : [...dev.wrappedKeys, {
 			version: currentMaster.version,
 			blob: sodium.toB64(blob)
 		}];
@@ -2614,11 +3070,69 @@ const summarize = (counts) => `wrapped=${counts.wrapped} already-current=${count
 const syncCommand = Command.make("sync", { quiet: quietOption }, (args) => Effect.gen(function* () {
 	const out = yield* CliOutput;
 	yield* out.setQuiet(args.quiet);
-	const counts = yield* wrapCurrentKeyToAllDevices(yield* (yield* VaultAccess).getOrPrompt);
-	yield* out.info(`Sync complete. ${summarize(counts)}`);
+	const vault = yield* (yield* VaultAccess).getOrPrompt;
+	const counts = yield* wrapCurrentKeyToAllDevices(vault);
+	const integCounts = yield* wrapCurrentKeyToAllIntegrations(vault);
+	yield* out.info(`Sync complete. Devices: ${summarize(counts)} Integrations: ${summarize(integCounts)}`);
 	if (counts.unverified > 0) yield* out.info("Unverified devices were left untouched — their pubkeys weren't bound to any invite code this CLI knows about.");
-	if (counts.failed > 0) return yield* Effect.fail(new Aborted());
+	if (counts.failed > 0 || integCounts.failed > 0) return yield* Effect.fail(new Aborted());
 }));
+const wrapCurrentKeyToAllIntegrations = (vault) => Effect.gen(function* () {
+	const out = yield* CliOutput;
+	const sodium = yield* Sodium;
+	const active = (yield* fetchOrgIntegrations).filter((i) => !i.revokedAt);
+	const currentMaster = vault.masterKeyCurrent;
+	let counts = {
+		wrapped: 0,
+		alreadyCurrent: 0,
+		unverified: 0,
+		failed: 0
+	};
+	yield* Effect.forEach(active, (integ) => Effect.gen(function* () {
+		const pin = vault.integrations.find((p) => p.id === integ.id);
+		if (!pin) {
+			counts = {
+				...counts,
+				unverified: counts.unverified + 1
+			};
+			return yield* out.error(`integration ${integ.id} ('${integ.name}') has no pubkey pin in the vault — skipping. (Created before encryption was enabled, or its vault write failed. Revoke and re-create it.)`);
+		}
+		if (pin.pubkeyB64 !== integ.pubkeyB64) {
+			counts = {
+				...counts,
+				unverified: counts.unverified + 1
+			};
+			return yield* out.error(`integration ${integ.id} ('${integ.name}'): server pubkey DIFFERS from the vault pin — skipping. This should never happen and may indicate backend tampering.`);
+		}
+		if (integ.wrappedKeys.some((w) => w.version === currentMaster.version)) {
+			counts = {
+				...counts,
+				alreadyCurrent: counts.alreadyCurrent + 1
+			};
+			return;
+		}
+		const blob = yield* sodium.wrapMasterKey(currentMaster.key, vault.adminPrivateKey, sodium.fromB64(pin.pubkeyB64));
+		const nextWraps = [...integ.wrappedKeys.filter((w) => w.version !== currentMaster.version), {
+			version: currentMaster.version,
+			blob: sodium.toB64(blob)
+		}];
+		yield* putIntegrationWraps(integ.id, nextWraps).pipe(Effect.matchEffect({
+			onFailure: (e) => Effect.sync(() => {
+				counts = {
+					...counts,
+					failed: counts.failed + 1
+				};
+			}).pipe(Effect.zipRight(out.error(`integration wrap failed: ${String(e)}`))),
+			onSuccess: () => Effect.sync(() => {
+				counts = {
+					...counts,
+					wrapped: counts.wrapped + 1
+				};
+			})
+		}));
+	}), { discard: true });
+	return counts;
+});
 const keyShowCommand = Command.make("show", { quiet: quietOption }, (args) => Effect.gen(function* () {
 	const out = yield* CliOutput;
 	yield* out.setQuiet(args.quiet);
@@ -2646,7 +3160,8 @@ const keyRotateCommand = Command.make("rotate", { quiet: quietOption }, (args) =
 			version: nextVersion,
 			key: yield* sodium.generateMasterKey
 		},
-		masterKeyHistory: [...vault.masterKeyHistory, vault.masterKeyCurrent]
+		masterKeyHistory: [...vault.masterKeyHistory, vault.masterKeyCurrent],
+		integrations: vault.integrations
 	};
 	const cfg = yield* access.fetchConfig.pipe(Effect.flatMap(access.requireEnabled));
 	const newBlob = yield* sodium.encryptVault(nextVault, vaultKey);
@@ -2659,13 +3174,15 @@ const keyRotateCommand = Command.make("rotate", { quiet: quietOption }, (args) =
 	yield* out.info(`Generated master_key v${nextVersion} and updated the org vault.`);
 	yield* out.info("Wrapping the new key to every onboarded device...");
 	const counts = yield* wrapCurrentKeyToAllDevices(nextVault);
-	yield* out.info(`Rotation complete. ${summarize(counts)}`);
+	yield* out.info("Wrapping the new key to every integration...");
+	const integCounts = yield* wrapCurrentKeyToAllIntegrations(nextVault);
+	yield* out.info(`Rotation complete. Devices: ${summarize(counts)} Integrations: ${summarize(integCounts)}`);
 	yield* out.info("");
 	yield* out.info(`New encryption key (master_key v${nextVersion}):`);
 	yield* out.print(sodium.toB64(nextVault.masterKeyCurrent.key));
 	yield* out.info("Update any library clients with this new value. The previous key remains valid for decrypting historical notifications only.");
 	if (counts.unverified > 0) yield* out.info("Unverified devices were skipped — they'll need a fresh invite redeem before they can pick up the new key.");
-	if (counts.failed > 0) return yield* Effect.fail(new Aborted());
+	if (counts.failed > 0 || integCounts.failed > 0) return yield* Effect.fail(new Aborted());
 }));
 const keyCommand = Command.make("key").pipe(Command.withSubcommands([keyShowCommand, keyRotateCommand]));
 const encryptionCommand = Command.make("encryption").pipe(Command.withSubcommands([
@@ -2937,21 +3454,6 @@ const buildFiles = (paths) => Effect.gen(function* () {
 		};
 	}));
 });
-/** Drive the presign -> PUT -> complete lifecycle for an org send's prepared
-* attachments over the CLI bearer session (`/v1/org/attachments/...` — the
-* bearer-auth'd variants of the attachment lifecycle endpoints). No-op when the
-* send carried no files. Per-file failures are marked `failed` server-side and
-* skipped (the SDK's best-effort semantics) — the task/subtask itself stands. */
-const uploadOrgAttachments = (prepared, created) => Effect.gen(function* () {
-	if (prepared.length === 0) return;
-	const auth = yield* (yield* Api).session;
-	const ctx = {
-		baseUrl: new URL(`${auth.baseUrl.replace(/\/+$/, "")}/`),
-		authHeaders: { Authorization: `Bearer ${bearerToken(auth)}` },
-		basePath: "v1/org/attachments"
-	};
-	yield* sdkCall("upload attachments", () => uploadFileAttachments(ctx, prepared, created ?? []));
-});
 const CONTENT_TYPES = {
 	png: "image/png",
 	jpg: "image/jpeg",
@@ -2994,8 +3496,8 @@ const locationInput$1 = repeatedText("location-input", void 0, "Add a location i
 const linkOption$1 = repeatedText("link", "l", "Attach a remote URL (a link attachment). Repeatable. For local files use --file.");
 const fileOption$1 = repeatedText("file", "f", "Attach a local file, uploaded as a file attachment (encrypted under the send's key — topic password or org master key — when the send is encrypted). Repeatable.");
 const submitOption$1 = Options.boolean("submit").pipe(Options.withDescription("Require the recipient to explicitly submit the task. Without this, it auto-completes once the required inputs are filled."));
-const waitOption = Options.boolean("wait").pipe(Options.withDescription("Block until the task is completed; print the result to stdout. Requires exactly one input on the request."));
-const replyOption = Options.choice("reply", [
+const waitOption$1 = Options.boolean("wait").pipe(Options.withDescription("Block until the task is completed; print the result to stdout. Requires exactly one input on the request."));
+const replyOption$1 = Options.choice("reply", [
 	"one-shot",
 	"sticky",
 	"one-time-per-user"
@@ -3005,8 +3507,9 @@ const broadcastOption = Options.boolean("broadcast").pipe(Options.withAlias("b")
 const orgTopicOption = Options.text("org-topic").pipe(Options.withAlias("o"), Options.withDescription("Send to an org topic by value (from `sp org topics list`). Org send; mutually exclusive with --member, --broadcast, and -k/--topic (which is the personal topic)."), Options.optional);
 const noEncryptOption$1 = Options.boolean("no-encrypt").pipe(Options.withDescription("For org sends: send fields in plaintext even when the org vault is unlocked."));
 const markdownOption$1 = Options.boolean("markdown").pipe(Options.withDescription("Render the task body as Markdown on the recipient's device (sets contentFormat=markdown)."));
+const expiresOption = Options.text("expires").pipe(Options.withDescription("Deadline: a duration from now (`2h`, `7d`) or an ISO 8601 timestamp. Past it, an unanswered task flips to expired (terminal; further answers are rejected)."), Options.optional);
 const sharedOption = Options.boolean("shared").pipe(Options.withDescription("Shared mode: ONE task all recipients see and answer together (user A's input is visible to user B). Default (without this flag) is independent mode: every recipient gets their own task instance under a group."));
-const formatOption = Options.choice("format", ["text", "json"]).pipe(Options.withDescription("stdout format for a send: `text` (the bare id, default) or `json` (a `sent` line piped to `sp collect`)."), Options.withDefault("text"));
+const formatOption$1 = Options.choice("format", ["text", "json"]).pipe(Options.withDescription("stdout format for a send: `text` (the bare id, default) or `json` (a `sent` line piped to `sp collect`)."), Options.withDefault("text"));
 const taskCommand = Command.make("task", {
 	title: titleOption$1,
 	content: contentOption$1,
@@ -3022,15 +3525,16 @@ const taskCommand = Command.make("task", {
 	link: linkOption$1,
 	file: fileOption$1,
 	submit: submitOption$1,
-	wait: waitOption,
-	reply: replyOption,
+	wait: waitOption$1,
+	reply: replyOption$1,
 	member: memberOption,
 	broadcast: broadcastOption,
 	"org-topic": orgTopicOption,
 	"no-encrypt": noEncryptOption$1,
 	markdown: markdownOption$1,
 	shared: sharedOption,
-	format: formatOption,
+	expires: expiresOption,
+	format: formatOption$1,
 	topic: topicOption,
 	"api-token": apiTokenOption,
 	password: passwordOption,
@@ -3056,6 +3560,11 @@ const taskCommand = Command.make("task", {
 	const tag = Option.getOrElse(args.tag, () => process.env.SP_TAG ?? "");
 	const title = Option.getOrUndefined(args.title);
 	const content = Option.getOrUndefined(args.content);
+	const expiresRaw = Option.getOrUndefined(args.expires);
+	const expiresAt = expiresRaw !== void 0 ? yield* Effect.try({
+		try: () => resolveExpiresAt(expiresRaw),
+		catch: (e) => new UserError({ message: e instanceof Error ? e.message : String(e) })
+	}) : void 0;
 	if (memberName !== void 0 || args.broadcast || orgTopicName !== void 0) return yield* sendOrgTask({
 		member: memberName,
 		broadcast: args.broadcast,
@@ -3072,6 +3581,7 @@ const taskCommand = Command.make("task", {
 		noEncrypt: args["no-encrypt"],
 		wait: args.wait,
 		shared: args.shared,
+		expiresAt,
 		format: args.format
 	});
 	const passwords = args.password;
@@ -3094,7 +3604,8 @@ const taskCommand = Command.make("task", {
 			...files.length > 0 ? { files } : {},
 			autoCommit: !args.submit,
 			...Option.isSome(args.reply) ? { reply: args.reply.value } : {},
-			...args.markdown ? { contentFormat: "markdown" } : {}
+			...args.markdown ? { contentFormat: "markdown" } : {},
+			...expiresAt !== void 0 ? { expiresAt } : {}
 		};
 		if (topic === void 0) {
 			const response = yield* sdkCall("task send", () => client.sendTask(baseOpts));
@@ -3182,75 +3693,106 @@ const waitForFirstCompletion = (tasks) => Effect.gen(function* () {
 		return yield* Effect.fail(new Aborted());
 	}
 	const ev = first.value;
-	const uploads = ev.kind === "taskCompleted" ? ev.uploads : [];
+	yield* out.print(completionValue(ev.kind === "taskCompleted" ? ev.uploads : []));
+});
+/** stdout value for a completion's uploads (`--wait`): a single
+* text/choice/action/multi-choice answer prints as the bare value; anything
+* else (multiple inputs, binary uploads) prints as the uploads JSON. */
+const completionValue = (uploads) => {
 	const single = uploads.length === 1 ? uploads[0] : void 0;
 	const value = single && (single.kind === "text" || single.kind === "choice") ? single.value : single && single.kind === "action" ? single.key : single && single.kind === "multiChoice" ? (single.values ?? []).filter((v) => typeof v === "string").join(", ") : void 0;
-	yield* out.print(typeof value === "string" ? value : JSON.stringify(uploads));
-});
+	return typeof value === "string" ? value : JSON.stringify(uploads);
+};
 /** Send a task to org recipients (a member, a broadcast, or an org topic) over
-* the CLI bearer session, encrypting each user-visible field under the current
-* org master_key when the vault is unlocked. Mirrors `sp notify` and the SDK's
-* OrgClient.sendTask field set (tag/title/content/links + each input's
-* description/default/options). File attachments are not supported (the bearer
-* session can't drive uploads). */
+* the CLI bearer session via the SDK's OrgClient — the same send surface an
+* Api-Key client uses. Fields (tag/title/content/links + each input's
+* description/default/options) and file bytes are encrypted under the current
+* org master_key when the vault is unlocked. With --wait, the returned handles
+* stream off the org event hub until the first completion. */
 const sendOrgTask = (params) => Effect.gen(function* () {
 	const out = yield* CliOutput;
 	const api = yield* Api;
 	const access = yield* VaultAccess;
 	if (params.content === void 0 && params.inputs.length === 0) return yield* Effect.fail(new UserError({ message: "an org task needs --content or at least one input" }));
-	if (params.wait) yield* out.warn("--wait isn't supported on org sends; ignoring");
 	const vault = yield* access.forSendOrPlaintext(params.noEncrypt);
+	const auth = yield* api.session;
 	const target = params.orgTopic !== void 0 ? { topic: params.orgTopic } : params.member !== void 0 ? { member: params.member } : { broadcast: true };
+	const files = yield* buildFiles(params.files);
 	const opts = {
 		...params.tag ? { tag: params.tag } : {},
 		...params.title !== void 0 ? { title: params.title } : {},
 		...params.content !== void 0 ? { content: params.content } : {},
 		inputs: params.inputs,
 		links: params.links,
+		...files.length > 0 ? { files } : {},
 		autoCommit: params.autoCommit,
 		...params.reply !== void 0 ? { reply: params.reply } : {},
 		...params.markdown ? { contentFormat: "markdown" } : {},
-		...params.shared ? { shared: true } : {}
+		...params.expiresAt !== void 0 ? { expiresAt: params.expiresAt } : {}
 	};
-	const masterKey = vault ? {
-		key: vault.masterKeyCurrent.key,
-		version: vault.masterKeyCurrent.version
-	} : void 0;
-	const fileAttachments = yield* buildFiles(params.files);
-	const prepared = yield* sdkCall("prepare attachments", () => prepareFileAttachments(fileAttachments, masterKey?.key));
-	const body = yield* sdkCall("build task request", () => buildOrgTaskRequest(target, opts, masterKey, prepared.map((p) => p.meta)));
-	const payload = yield* api.postJson("task", "/v1/org/tasks/json", Schema.Unknown, body);
-	yield* uploadOrgAttachments(prepared, payload.attachments);
+	const orgMasterKeys = vault ? [vault.masterKeyCurrent, ...vault.masterKeyHistory].map((k) => ({
+		version: k.version,
+		key: k.key
+	})) : void 0;
 	const enc = vault ? ` (encrypted under master_key v${vault.masterKeyCurrent.version})` : " (plaintext)";
-	if (isTaskGroupResponse(payload)) {
+	yield* Effect.scoped(Effect.gen(function* () {
+		const client = yield* acquireOrgClient({
+			baseUrl: auth.baseUrl,
+			bearerToken: bearerToken(auth),
+			...orgMasterKeys !== void 0 ? { orgMasterKeys } : {}
+		});
+		if (params.shared) {
+			const response = yield* sdkCall("task send", () => client.sendTask({
+				...target,
+				...opts,
+				shared: true
+			}));
+			yield* out.info(`Org task sent${enc}.`);
+			yield* out.info(`Id:      ${response.taskId}`);
+			yield* out.info(`Append:  ${response.appendToken}`);
+			if (!params.wait) {
+				if (params.format === "json") yield* out.print(formatSent(void 0, response.createdAt, [{
+					id: response.taskId,
+					kind: "task",
+					recipient: null
+				}]));
+				else yield* out.print(response.taskId);
+				return;
+			}
+			yield* out.info(`waiting for completion of task ${response.taskId}`);
+			return yield* waitForFirstCompletion([response]);
+		}
+		const group = yield* sdkCall("task send", () => client.sendTask({
+			...target,
+			...opts
+		}));
 		yield* out.info(`Org task group sent${enc}.`);
-		yield* out.info(`Group:   ${payload.groupId} (${payload.instances.length} recipient${payload.instances.length === 1 ? "" : "s"})`);
-		yield* out.info(`Append:  ${payload.groupAppendToken}`);
-		yield* Effect.forEach(payload.instances, (inst) => {
-			const who = `${inst.recipient.publicId}${inst.recipient.name ? ` (${inst.recipient.name})` : ""}`;
+		yield* out.info(`Group:   ${group.groupId} (${group.instances.length} recipient${group.instances.length === 1 ? "" : "s"})`);
+		yield* out.info(`Append:  ${group.appendToken}`);
+		yield* Effect.forEach(group.instances, (inst) => {
+			const who = inst.recipient ? `${inst.recipient.publicId}${inst.recipient.name ? ` (${inst.recipient.name})` : ""}` : "unknown";
 			return out.info(`Instance: ${inst.taskId} -> ${who} append token: ${inst.appendToken}`);
 		});
-		if (payload.instances.length === 0) yield* out.warn("the target has no recipients — the group is empty");
-		if (params.format === "json") yield* out.print(formatSent(payload.groupId, payload.createdAt, payload.instances.map((i) => ({
-			id: i.taskId,
-			kind: "task",
-			recipient: {
-				publicId: i.recipient.publicId,
-				name: i.recipient.name ?? null
-			}
-		}))));
-		else yield* out.print(payload.groupId);
-	} else {
-		yield* out.info(`Org task sent${enc}.`);
-		yield* out.info(`Id:      ${payload.taskId}`);
-		yield* out.info(`Append:  ${payload.appendToken}`);
-		if (params.format === "json") yield* out.print(formatSent(void 0, payload.createdAt, [{
-			id: payload.taskId,
-			kind: "task",
-			recipient: null
-		}]));
-		else yield* out.print(payload.taskId);
-	}
+		if (group.instances.length === 0) yield* out.warn("the target has no recipients — the group is empty");
+		if (!params.wait) {
+			if (params.format === "json") yield* out.print(formatSent(group.groupId, group.createdAt, group.instances.map((i) => ({
+				id: i.taskId,
+				kind: "task",
+				recipient: i.recipient ? {
+					publicId: i.recipient.publicId,
+					name: i.recipient.name ?? null
+				} : null
+			}))));
+			else yield* out.print(group.groupId);
+			return;
+		}
+		if (group.instances.length === 0) {
+			yield* out.warn("--wait requested but the group has no instances; nothing will complete");
+			return yield* Effect.fail(new Aborted());
+		}
+		yield* out.info(`waiting for the first completion across ${group.instances.length} instance(s) of ${group.groupId}`);
+		yield* waitForFirstCompletion(group.instances);
+	}));
 });
 //#endregion
 //#region src/commands/subtask.ts
@@ -3268,6 +3810,13 @@ const voiceRecordingInput = Options.text("voice-recording-input").pipe(Options.w
 const fileInput = Options.text("file-input").pipe(Options.withDescription("Add a file upload input. Format: `description[;key=value...]`. Settings: `required=true|false`. Repeatable."), Options.repeated);
 const locationInput = Options.text("location-input").pipe(Options.withDescription("Add a location input (the recipient shares their device GPS position from the app). Format: `description[;key=value...]`. Settings: `required=true|false`. Repeatable."), Options.repeated);
 const submitOption = Options.boolean("submit").pipe(Options.withDescription("Require the recipient to explicitly submit the subtask. Without this, it auto-completes once the required inputs are filled."));
+const waitOption = Options.boolean("wait").pipe(Options.withDescription("Block until the subtask is completed; print the result to stdout. Requires at least one input on the append. On a group append, the first member's completion wins."));
+const formatOption = Options.choice("format", ["text", "json"]).pipe(Options.withDescription("stdout format for an append: `text` (the bare sub_ id(s), default) or `json` (a `sent` line piped to `sp collect`)."), Options.withDefault("text"));
+const replyOption = Options.choice("reply", [
+	"one-shot",
+	"sticky",
+	"one-time-per-user"
+]).pipe(Options.withDescription("Show a reply composer on the recipient's subtask: 'one-shot' (first reply wins, closes the slot), 'sticky' (open indefinitely), 'one-time-per-user' (one reply per user)."), Options.optional);
 const markdownOption = Options.boolean("markdown").pipe(Options.withDescription("Render the subtask body as Markdown on the recipient's device (sets contentFormat=markdown)."));
 const noEncryptOption = Options.boolean("no-encrypt").pipe(Options.withDescription("For org appends: send fields in plaintext even when the org vault is unlocked."));
 const instanceOption = Options.text("instance").pipe(Options.withDescription("With a group append token (grptsk_ group): append only to these member task instances (tsk_ ids printed by `sp task`). Repeatable; without it the subtask goes to every member."), Options.repeated);
@@ -3286,6 +3835,9 @@ const subtaskCommand = Command.make("subtask", {
 	link: linkOption,
 	file: fileOption,
 	submit: submitOption,
+	wait: waitOption,
+	format: formatOption,
+	reply: replyOption,
 	markdown: markdownOption,
 	"no-encrypt": noEncryptOption,
 	instance: instanceOption,
@@ -3306,18 +3858,20 @@ const subtaskCommand = Command.make("subtask", {
 		catch: (e) => new UserError({ message: e instanceof Error ? e.message : String(e) })
 	});
 	if (content === void 0 && inputs.length === 0) return yield* Effect.fail(new UserError({ message: "a subtask needs --content or at least one input" }));
+	if (inputs.length === 0 && args.wait) yield* out.warn("--wait requested but no inputs were defined; the server will never produce a SubtaskCompleted event");
 	const opts = {
 		...title !== void 0 ? { title } : {},
 		...content !== void 0 ? { content } : {},
 		...inputs.length > 0 ? { inputs } : {},
 		links: [...args.link],
 		autoCommit: !args.submit,
+		...Option.isSome(args.reply) ? { reply: args.reply.value } : {},
 		...args.markdown ? { contentFormat: "markdown" } : {}
 	};
 	const instances = args.instance.length > 0 ? [...args.instance] : void 0;
-	if (topic !== void 0) {
+	const apiToken = Option.getOrUndefined(args["api-token"]);
+	if (apiToken !== void 0) {
 		const files = yield* buildFiles(args.file);
-		const apiToken = yield* requireApiToken(args["api-token"]);
 		yield* Effect.scoped(Effect.gen(function* () {
 			const client = yield* acquireClient({
 				baseUrl: args["base-url"],
@@ -3325,53 +3879,129 @@ const subtaskCommand = Command.make("subtask", {
 				passwords: args.password
 			});
 			if (willEncrypt(args.password, topic)) yield* out.info("encrypting outgoing subtask (Argon2id, this takes a moment)");
-			yield* printSubtaskResponse(yield* sdkCall("subtask append", () => client.appendSubtask({
+			const resp = yield* sdkCall("subtask append", () => client.appendSubtask({
 				appendToken,
-				topic,
+				...topic !== void 0 ? { topic } : {},
 				...instances !== void 0 ? { instances } : {},
 				...opts,
 				...files.length > 0 ? { files } : {}
-			})));
+			}));
+			yield* printSubtaskResponse(resp, {
+				format: args.format,
+				wait: args.wait
+			});
+			if (args.wait) yield* waitForSubtaskCompletion(client, resp);
 		}));
 		return;
 	}
+	if (topic !== void 0) return yield* Effect.fail(new UserError({ message: "a personal append (-t/--topic) needs an API token (--api-token or $SP_API_TOKEN)" }));
 	yield* sendOrgSubtask({
 		appendToken,
 		opts,
 		instances,
 		files: [...args.file],
-		noEncrypt: args["no-encrypt"]
+		noEncrypt: args["no-encrypt"],
+		wait: args.wait,
+		format: args.format
 	});
 }));
-/** Shared output contract for both append paths. Single append: one subtask id
-* on stdout. Group append (grptsk_ token): one subtask id per member on stdout,
-* with the taskId -> subtaskId mapping on the info channel. */
-const printSubtaskResponse = (resp, suffix = "") => Effect.gen(function* () {
+/** Shared output contract for both append paths. `text`: the bare sub_ id(s)
+* on stdout (group: one per member, with the taskId -> subtaskId mapping on
+* the info channel). `json`: ONE `sent` line carrying the PARENT chain
+* instances (createdAt = the append time), the machine handle `sp collect`
+* consumes — collect streams the chain and stamps sub_ ids on subtask-scoped
+* items. With `--wait` the stdout contract is the completion value instead,
+* so the json line is suppressed (text ids still print, matching a bare
+* append). */
+const printSubtaskResponse = (resp, opts, suffix = "") => Effect.gen(function* () {
 	const out = yield* CliOutput;
 	if (isSubtaskGroupResponse(resp)) {
 		yield* out.info(`subtask appended to group ${resp.groupId} (${resp.subtasks.length} member${resp.subtasks.length === 1 ? "" : "s"})${suffix}`);
-		yield* Effect.forEach(resp.subtasks, (s) => out.info(`instance: ${s.taskId} -> subtask ${s.subtaskId}`).pipe(Effect.zipRight(out.print(s.subtaskId))));
+		yield* Effect.forEach(resp.subtasks, (s) => out.info(`instance: ${s.taskId} -> subtask ${s.subtaskId}`).pipe(Effect.zipRight(opts.format === "text" ? out.print(s.subtaskId) : Effect.void)));
+		if (opts.format === "json" && !opts.wait) yield* out.print(formatSent(resp.groupId, resp.createdAt, resp.subtasks.map((s) => ({
+			id: s.taskId,
+			kind: "task",
+			recipient: null,
+			subtaskId: s.subtaskId
+		}))));
 	} else {
 		yield* out.info(`subtask appended: ${resp.subtaskId}${suffix}`);
-		yield* out.print(resp.subtaskId);
+		if (opts.format === "text") yield* out.print(resp.subtaskId);
+		else if (!opts.wait) yield* out.print(formatSent(void 0, resp.createdAt, [{
+			id: resp.taskId,
+			kind: "task",
+			recipient: null,
+			subtaskId: resp.subtaskId
+		}]));
 	}
 });
-/** Append a subtask to an org task over the CLI bearer session, encrypting each
-* field under the current org master_key when the vault is unlocked. Mirrors
-* `sendOrgTask` in task.ts; the subtask inherits the parent's recipients. */
+/** Append a subtask to an org task over the CLI bearer session via the SDK's
+* OrgClient, encrypting each field (and any file bytes) under the current org
+* master_key when the vault is unlocked. Mirrors `sendOrgTask` in task.ts; the
+* subtask inherits the parent's recipients. */
 const sendOrgSubtask = (params) => Effect.gen(function* () {
 	const api = yield* Api;
 	const vault = yield* (yield* VaultAccess).forSendOrPlaintext(params.noEncrypt);
-	const masterKey = vault ? {
-		key: vault.masterKeyCurrent.key,
-		version: vault.masterKeyCurrent.version
-	} : void 0;
-	const fileAttachments = yield* buildFiles(params.files);
-	const prepared = yield* sdkCall("prepare attachments", () => prepareFileAttachments(fileAttachments, masterKey?.key));
-	const body = yield* sdkCall("build subtask request", () => buildOrgSubtaskRequest(params.appendToken, params.opts, masterKey, params.instances, prepared.map((p) => p.meta)));
-	const payload = yield* api.postJson("subtask append", "/v1/org/subtasks/json", Schema.Unknown, body);
-	yield* uploadOrgAttachments(prepared, payload.attachments);
-	yield* printSubtaskResponse(payload, vault ? ` (encrypted under master_key v${vault.masterKeyCurrent.version})` : " (plaintext)");
+	const auth = yield* api.session;
+	const orgMasterKeys = vault ? [vault.masterKeyCurrent, ...vault.masterKeyHistory].map((k) => ({
+		version: k.version,
+		key: k.key
+	})) : void 0;
+	const files = yield* buildFiles(params.files);
+	yield* Effect.scoped(Effect.gen(function* () {
+		const client = yield* acquireOrgClient({
+			baseUrl: auth.baseUrl,
+			bearerToken: bearerToken(auth),
+			...orgMasterKeys !== void 0 ? { orgMasterKeys } : {}
+		});
+		const payload = yield* sdkCall("subtask append", () => client.appendSubtask({
+			appendToken: params.appendToken,
+			...params.instances !== void 0 ? { instances: params.instances } : {},
+			...params.opts,
+			...files.length > 0 ? { files } : {}
+		}));
+		yield* printSubtaskResponse(payload, {
+			format: params.format,
+			wait: params.wait
+		}, vault ? ` (encrypted under master_key v${vault.masterKeyCurrent.version})` : " (plaintext)");
+		if (params.wait) yield* waitForSubtaskCompletion(client, payload);
+	}));
+});
+/** Block until the appended subtask completes and print the answer, mirroring
+* `sp task --wait`. Rehydrates observe handles from the append response ids
+* (single: the one subtask; group: every minted sibling, first completion
+* wins) and streams their `inputs()` off the shared event hub. A sub-stream
+* that ends without completing (canceled, declined, chain deleted) ends
+* benignly; no completion anywhere is a failure (exit 1, empty stdout). */
+const waitForSubtaskCompletion = (client, resp) => Effect.gen(function* () {
+	const out = yield* CliOutput;
+	const watches = isSubtaskGroupResponse(resp) ? resp.subtasks.map((m) => client.watchSubtask({
+		subtaskId: m.subtaskId,
+		taskId: m.taskId,
+		createdAt: resp.createdAt
+	})) : [client.watchSubtask({
+		subtaskId: resp.subtaskId,
+		taskId: resp.taskId,
+		createdAt: resp.createdAt
+	})];
+	if (watches.length === 0) {
+		yield* out.warn("--wait requested but the append minted no subtasks; nothing will complete");
+		return yield* Effect.fail(new Aborted());
+	}
+	yield* out.info(watches.length === 1 ? `waiting for completion of subtask ${watches[0].subtaskId}` : `waiting for the first completion across ${watches.length} subtask instance(s)`);
+	const completions = watches.map((w) => sdkStream("subtask wait stream", (signal) => w.inputs({
+		replay: true,
+		signal
+	})).pipe(Stream.filter((ev) => ev.kind === "subtaskCompleted"), Stream.take(1)));
+	const first = yield* Stream.mergeAll(completions, { concurrency: "unbounded" }).pipe(Stream.runHead, Effect.mapError((e) => {
+		return new UserError({ message: `stream failed while waiting: ${e.cause instanceof Error ? e.cause.message : String(e.cause)}` });
+	}));
+	if (Option.isNone(first)) {
+		yield* out.warn("every subtask ended (canceled, declined, or chain deleted) before a completion");
+		return yield* Effect.fail(new Aborted());
+	}
+	const ev = first.value;
+	yield* out.print(completionValue(ev.kind === "subtaskCompleted" ? ev.uploads : []));
 });
 //#endregion
 //#region src/main.ts
@@ -3384,17 +4014,19 @@ process.stderr.on("error", onPipeError(false));
 const root = Command.make("simplepush").pipe(Command.withSubcommands([
 	authCommand,
 	orgCommand,
+	integrationCommand,
 	eventsCommand,
 	collectCommand,
 	daemonCommand,
 	downloadCommand,
 	notifyCommand,
 	taskCommand,
-	subtaskCommand
+	subtaskCommand,
+	cancelCommand
 ]));
 const cli = Command.run(root, {
 	name: "Simplepush CLI",
-	version: "0.1.0"
+	version: "0.2.0"
 });
 const MainLive = Layer.mergeAll(CliOutput.Default, Sodium.Default, AuthStore.Default, VaultStore.Default, InviteStore.Default, Api.Default, VaultAccess.Default).pipe(Layer.provideMerge(FetchHttpClient.layer), Layer.provideMerge(NodeContext.layer));
 /** Render any failure through the typed-error table, then re-fail so the