@nearform/fling 0.5.1 → 0.6.0

package/dist/cli.js

@@ -1,22 +1,99 @@
 #!/usr/bin/env node
 
-// src/cli.ts
-import chalk10 from "chalk";
-import { Command } from "commander";
-
-// src/commands/auth.ts
-import chalk5 from "chalk";
-
-// src/auth.ts
-import { randomBytes } from "node:crypto";
-import { createServer } from "node:http";
-import { hostname as osHostname } from "node:os";
-
 // ../../packages/shared/src/api.ts
-import { z as z2 } from "zod";
+import { z as z3 } from "zod";
 
-// ../../packages/shared/src/manifest.ts
+// ../../packages/shared/src/audience.ts
 import { z } from "zod";
+var AUDIENCE_EMAILS_MAX = 100;
+var AUDIENCE_GROUPS_MAX = 10;
+var AudienceEmailSchema = z.object({ email: z.string(), known: z.boolean() });
+var AudienceGroupSchema = z.object({
+  slug: z.string(),
+  name: z.string(),
+  size: z.number(),
+  deleted: z.boolean().optional()
+});
+var AudienceSchema = z.object({
+  emails: z.array(AudienceEmailSchema),
+  groups: z.array(AudienceGroupSchema).default([])
+});
+var AudienceInputSchema = z.object({
+  emails: z.array(z.string().trim().toLowerCase().min(3).max(254)).max(AUDIENCE_EMAILS_MAX, `An audience holds at most ${AUDIENCE_EMAILS_MAX} addresses`),
+  groups: z.array(z.string().trim().toLowerCase().min(1).max(100)).max(AUDIENCE_GROUPS_MAX, `An audience names at most ${AUDIENCE_GROUPS_MAX} groups`).default([])
+});
+var normaliseEmail = (email) => email.trim().toLowerCase();
+function splitEmails(values) {
+  const all = typeof values === "string" ? [values] : values;
+  return all.flatMap((v) => v.split(/[\s,;]+/)).map(normaliseEmail).filter(Boolean);
+}
+function editAudience(current, change) {
+  let emails2 = change.clear ? [] : change.set ? [...change.set] : [...current];
+  emails2 = [...emails2, ...change.add ?? []].map(normaliseEmail);
+  const removed = new Set((change.remove ?? []).map(normaliseEmail));
+  return [...new Set(emails2)].filter((e) => e && !removed.has(e));
+}
+function editAudienceGroups(current, change) {
+  const norm = (s) => s.trim().toLowerCase();
+  let groups2 = change.clear ? [] : change.setGroups ? [...change.setGroups] : [...current];
+  groups2 = [...groups2, ...change.addGroups ?? []].map(norm);
+  const removed = new Set((change.removeGroups ?? []).map(norm));
+  return [...new Set(groups2)].filter((g) => g && !removed.has(g));
+}
+function editAudienceInput(current, change) {
+  return {
+    emails: editAudience(
+      current.emails.map((e) => e.email),
+      change
+    ),
+    groups: editAudienceGroups(
+      current.groups.map((g) => g.slug),
+      change
+    )
+  };
+}
+var changesAudience = (change) => Boolean(
+  change.clear || change.set || change.add?.length || change.remove?.length || change.setGroups || change.addGroups?.length || change.removeGroups?.length
+);
+var people = (n) => `${n} ${n === 1 ? "person" : "people"}`;
+var groupLabel = (g) => g.deleted ? `a deleted group (${g.slug})` : `${g.slug} (${g.name !== g.slug ? `${g.name}, ` : ""}${people(g.size)})`;
+function whoIn(emails2, groups2) {
+  const live = groups2.filter((g) => !g.deleted);
+  return [
+    emails2.length ? people(emails2.length) : "",
+    live.length ? `${live.length === 1 ? "the group" : "the groups"} ${live.map(groupLabel).join(", ")}` : "",
+    ...groups2.filter((g) => g.deleted).map(groupLabel)
+  ].filter(Boolean);
+}
+var and = (parts) => parts.length > 1 ? `${parts.slice(0, -1).join(", ")} and ${parts.at(-1)}` : parts[0] ?? "";
+var audienceList = (emails2) => emails2.map((e) => e.known ? e.email : `${e.email} (hasn't signed in yet)`).join(", ");
+function describeAudience(site, privateAudience2) {
+  const emails2 = site.audience?.emails ?? [];
+  const groups2 = site.audience?.groups ?? [];
+  const empty = emails2.length + groups2.length === 0;
+  const list = emails2.length ? `: ${audienceList(emails2)}` : "";
+  if (site.visibility === "public") {
+    return empty ? "Public: anyone can open the site; reviewing it still needs sign-in." : `Public: anyone can open the site; reviewing it still needs sign-in. Its audience (${and(whoIn(emails2, groups2))}${list}) applies when it is private again.`;
+  }
+  if (empty) return `Private: ${privateAudience2} can open it.`;
+  const share2 = site.shareUrl ? ` A share link is active: anyone with it can still open the site (${site.shareUrl}).` : "";
+  if (emails2.length === 0 && groups2.every((g) => g.deleted)) {
+    const refs = groups2.map((g) => g.slug).join(", ");
+    return `Restricted: only you can open it. Its audience names only ${groups2.length === 1 ? "a deleted group" : "deleted groups"} (${refs}), which let nobody in: add people or groups, or clear it.${share2}`;
+  }
+  return `Restricted: only ${and(["you", ...whoIn(emails2, groups2)])} can open it${list}.${share2}`;
+}
+function sharedVia(site) {
+  const { direct, groups: groups2 } = site.via;
+  return and([
+    ...direct ? ["your address"] : [],
+    ...groups2.length ? [`${groups2.length === 1 ? "group" : "groups"} ${groups2.join(", ")}`] : []
+  ]);
+}
+var describeSharedSite = (site) => `- ${site.name}: ${site.url} (shared by ${site.owner}, through ${sharedVia(site)}${site.reviewUrl ? `; review: ${site.reviewUrl}` : ""})`;
+
+// ../../packages/shared/src/manifest.ts
+import { z as z2 } from "zod";
 
 // ../../packages/shared/src/limits.ts
 var MAX_DEPLOY_BYTES = 100 * 1024 * 1024;
@@ -214,226 +291,246 @@ function isValidSitePath(path3) {
   if (path3.startsWith("/") || path3.includes("\\") || path3.includes("\0")) return false;
   return path3.split("/").every((seg) => seg !== "" && !seg.startsWith("."));
 }
-var ManifestFileSchema = z.object({
-  path: z.string().refine(isValidSitePath, "invalid path (dotfiles are never published)").refine((p) => !isSecretPath(p), "secret file (keys, certificates, credentials) never published"),
-  sha256: z.string().regex(/^[a-f0-9]{64}$/),
-  size: z.number().int().min(0).max(MAX_FILE_BYTES),
-  contentType: z.string().min(1).max(255)
+var ManifestFileSchema = z2.object({
+  path: z2.string().refine(isValidSitePath, "invalid path (dotfiles are never published)").refine((p) => !isSecretPath(p), "secret file (keys, certificates, credentials) never published"),
+  sha256: z2.string().regex(/^[a-f0-9]{64}$/),
+  size: z2.number().int().min(0).max(MAX_FILE_BYTES),
+  contentType: z2.string().min(1).max(255)
 });
-var ManifestSchema = z.object({ files: z.array(ManifestFileSchema).min(1).max(MAX_FILES) }).refine((m) => new Set(m.files.map((f) => f.path)).size === m.files.length, "duplicate paths").refine((m) => m.files.reduce((n, f) => n + f.size, 0) <= MAX_DEPLOY_BYTES, "deploy too large");
+var ManifestSchema = z2.object({ files: z2.array(ManifestFileSchema).min(1).max(MAX_FILES) }).refine((m) => new Set(m.files.map((f) => f.path)).size === m.files.length, "duplicate paths").refine((m) => m.files.reduce((n, f) => n + f.size, 0) <= MAX_DEPLOY_BYTES, "deploy too large");
 
 // ../../packages/shared/src/api.ts
-var VisibilitySchema = z2.enum(["private", "public"]);
-var MeSchema = z2.object({
-  email: z2.string(),
-  name: z2.string(),
-  picture: z2.string().nullable(),
-  userSlug: z2.string(),
+var VisibilitySchema = z3.enum(["private", "public"]);
+var MeSchema = z3.object({
+  email: z3.string(),
+  name: z3.string(),
+  picture: z3.string().nullable(),
+  userSlug: z3.string(),
   /** one of the instance's admins (servers from before admins don't say: false) */
-  admin: z2.boolean().default(false),
+  admin: z3.boolean().default(false),
   /** while an admin impersonates this user: the admin (browser sessions only) */
-  impersonator: z2.string().optional(),
+  impersonator: z3.string().optional(),
   /** …and when the impersonation lapses */
-  impersonationEndsAt: z2.string().optional()
+  impersonationEndsAt: z3.string().optional()
 });
-var SiteSchema = z2.object({
-  name: z2.string(),
-  url: z2.string(),
+var SiteSchema = z3.object({
+  name: z3.string(),
+  url: z3.string(),
   visibility: VisibilitySchema,
-  spa: z2.boolean(),
-  archived: z2.boolean(),
-  currentVersionId: z2.string().nullable(),
-  shareUrl: z2.string().nullable(),
-  createdAt: z2.string(),
-  updatedAt: z2.string()
+  spa: z3.boolean(),
+  archived: z3.boolean(),
+  currentVersionId: z3.string().nullable(),
+  shareUrl: z3.string().nullable(),
+  /** private with an audience: only the owner and the people in it can open it */
+  restricted: z3.boolean().default(false),
+  /** how many addresses and groups the audience names (kept, and ignored, while public) */
+  audienceSize: z3.number().default(0),
+  /** how many of those are groups */
+  audienceGroups: z3.number().default(0),
+  createdAt: z3.string(),
+  updatedAt: z3.string()
+});
+var SiteWithAudienceSchema = SiteSchema.extend({ audience: AudienceSchema.optional() });
+var VersionSchema = z3.object({
+  id: z3.string(),
+  fileCount: z3.number(),
+  totalBytes: z3.number(),
+  createdAt: z3.string()
 });
-var VersionSchema = z2.object({
-  id: z2.string(),
-  fileCount: z2.number(),
-  totalBytes: z2.number(),
-  createdAt: z2.string()
+var SiteDetailSchema = SiteWithAudienceSchema.extend({ versions: z3.array(VersionSchema) });
+var SiteListSchema = z3.object({ sites: z3.array(SiteSchema) });
+var SharedSiteSchema = z3.object({
+  name: z3.string(),
+  url: z3.string(),
+  /** the site's review page (`comments` capability) */
+  reviewUrl: z3.string().optional(),
+  owner: z3.string(),
+  /** how the caller is in the audience: by address, and through which of their groups (slugs) */
+  via: z3.object({ direct: z3.boolean(), groups: z3.array(z3.string()) }),
+  createdAt: z3.string(),
+  updatedAt: z3.string()
 });
-var SiteDetailSchema = SiteSchema.extend({ versions: z2.array(VersionSchema) });
-var SiteListSchema = z2.object({ sites: z2.array(SiteSchema) });
-var SiteFileSchema = z2.object({
-  path: z2.string(),
-  size: z2.number(),
-  contentType: z2.string()
+var SharedSiteListSchema = z3.object({ sites: z3.array(SharedSiteSchema) });
+var SiteFileSchema = z3.object({
+  path: z3.string(),
+  size: z3.number(),
+  contentType: z3.string()
 });
-var VersionFilesSchema = z2.object({
-  versionId: z2.string(),
-  files: z2.array(SiteFileSchema),
-  totalBytes: z2.number(),
-  generatedIndex: z2.boolean()
+var VersionFilesSchema = z3.object({
+  versionId: z3.string(),
+  files: z3.array(SiteFileSchema),
+  totalBytes: z3.number(),
+  generatedIndex: z3.boolean()
 });
-var NameCheckSchema = z2.object({
-  name: z2.string(),
-  status: z2.enum(["available", "yours", "taken", "invalid"]),
-  suggestions: z2.array(z2.string())
+var NameCheckSchema = z3.object({
+  name: z3.string(),
+  status: z3.enum(["available", "yours", "taken", "invalid"]),
+  suggestions: z3.array(z3.string())
 });
-var DeployRequestSchema = z2.object({
+var DeployRequestSchema = z3.object({
   manifest: ManifestSchema,
-  spa: z2.boolean().optional(),
+  spa: z3.boolean().optional(),
   visibility: VisibilitySchema.optional()
 });
-var UploadSchema = z2.object({
-  path: z2.string(),
-  url: z2.string(),
+var UploadSchema = z3.object({
+  path: z3.string(),
+  url: z3.string(),
   /** headers the client must send with the PUT (they are part of the signature) */
-  headers: z2.record(z2.string(), z2.string())
+  headers: z3.record(z3.string(), z3.string())
 });
-var DeployResponseSchema = z2.discriminatedUnion("status", [
+var DeployResponseSchema = z3.discriminatedUnion("status", [
   /** content identical to the current version — nothing happened */
-  z2.object({ status: z2.literal("unchanged"), versionId: z2.string(), site: SiteSchema }),
+  z3.object({ status: z3.literal("unchanged"), versionId: z3.string(), site: SiteSchema }),
   /** this content was deployed before — site now points at that version again */
-  z2.object({ status: z2.literal("repointed"), versionId: z2.string(), site: SiteSchema }),
+  z3.object({ status: z3.literal("repointed"), versionId: z3.string(), site: SiteSchema }),
   /** new content — PUT every upload, then POST /api/sites/:name/deploys/:versionId/finalize */
-  z2.object({
-    status: z2.literal("upload"),
-    versionId: z2.string(),
-    uploads: z2.array(UploadSchema)
+  z3.object({
+    status: z3.literal("upload"),
+    versionId: z3.string(),
+    uploads: z3.array(UploadSchema)
   })
 ]);
-var FinalizeResponseSchema = z2.object({
-  status: z2.literal("live"),
-  versionId: z2.string(),
+var FinalizeResponseSchema = z3.object({
+  status: z3.literal("live"),
+  versionId: z3.string(),
   site: SiteSchema
 });
-var RollbackRequestSchema = z2.object({ versionId: z2.string() });
-var UpdateSiteRequestSchema = z2.object({
+var RollbackRequestSchema = z3.object({ versionId: z3.string() });
+var UpdateSiteRequestSchema = z3.object({
   visibility: VisibilitySchema.optional(),
-  spa: z2.boolean().optional()
+  spa: z3.boolean().optional(),
+  audience: AudienceInputSchema.optional()
 });
-var ApiKeySchema = z2.object({
-  id: z2.string(),
-  name: z2.string(),
-  createdAt: z2.string(),
-  lastUsedAt: z2.string().nullable()
+var ApiKeySchema = z3.object({
+  id: z3.string(),
+  name: z3.string(),
+  createdAt: z3.string(),
+  lastUsedAt: z3.string().nullable()
 });
-var ApiKeyListSchema = z2.object({ keys: z2.array(ApiKeySchema) });
-var ErrorEnvelopeSchema = z2.object({
-  error: z2.object({ code: z2.string(), message: z2.string() })
+var ApiKeyListSchema = z3.object({ keys: z3.array(ApiKeySchema) });
+var ErrorEnvelopeSchema = z3.object({
+  error: z3.object({ code: z3.string(), message: z3.string() })
 });
-var ShareResponseSchema = z2.object({ shareUrl: z2.string() });
-var ConnectionSchema = z2.object({
-  id: z2.string(),
-  clientName: z2.string(),
+var ShareResponseSchema = z3.object({ shareUrl: z3.string() });
+var ConnectionSchema = z3.object({
+  id: z3.string(),
+  clientName: z3.string(),
   /** host the client identifies as (CIMD client_id host or redirect URI host) */
-  clientHost: z2.string().nullable(),
-  createdAt: z2.string(),
-  lastUsedAt: z2.string().nullable()
+  clientHost: z3.string().nullable(),
+  createdAt: z3.string(),
+  lastUsedAt: z3.string().nullable()
 });
-var ConnectionListSchema = z2.object({ connections: z2.array(ConnectionSchema) });
-var OAuthRequestInfoSchema = z2.object({
-  clientName: z2.string(),
-  clientUri: z2.string().nullable(),
+var ConnectionListSchema = z3.object({ connections: z3.array(ConnectionSchema) });
+var OAuthRequestInfoSchema = z3.object({
+  clientName: z3.string(),
+  clientUri: z3.string().nullable(),
   /** host of the CIMD client_id URL, when the client identified itself that way */
-  clientIdHost: z2.string().nullable(),
-  redirectHost: z2.string(),
+  clientIdHost: z3.string().nullable(),
+  redirectHost: z3.string(),
   /** true when the code goes to a loopback address (any local program could be asking) */
-  loopback: z2.boolean(),
-  scopes: z2.array(z2.string()),
-  email: z2.string()
+  loopback: z3.boolean(),
+  scopes: z3.array(z3.string()),
+  email: z3.string()
 });
-var OAuthDecisionSchema = z2.object({ redirectUrl: z2.string() });
-var AdminUserSchema = z2.object({
-  email: z2.string(),
-  name: z2.string(),
-  picture: z2.string().nullable(),
-  userSlug: z2.string(),
-  createdAt: z2.string().nullable(),
-  lastSignInAt: z2.string().nullable(),
+var OAuthDecisionSchema = z3.object({ redirectUrl: z3.string() });
+var AdminUserSchema = z3.object({
+  email: z3.string(),
+  name: z3.string(),
+  picture: z3.string().nullable(),
+  userSlug: z3.string(),
+  createdAt: z3.string().nullable(),
+  lastSignInAt: z3.string().nullable(),
   /** sites the user holds, archived ones included */
-  siteCount: z2.number(),
-  admin: z2.boolean()
+  siteCount: z3.number(),
+  admin: z3.boolean()
 });
-var AdminUserListSchema = z2.object({
-  users: z2.array(AdminUserSchema),
+var AdminUserListSchema = z3.object({
+  users: z3.array(AdminUserSchema),
   /** pass back as `cursor` for the next page; null: no more */
-  cursor: z2.string().nullable()
+  cursor: z3.string().nullable()
 });
-var AuditEntrySchema = z2.object({
-  id: z2.string(),
-  at: z2.string(),
-  action: z2.enum(["impersonation.start", "impersonation.stop"]),
-  actor: z2.string(),
-  target: z2.string(),
-  until: z2.string().optional(),
-  lapsed: z2.boolean().optional()
+var AuditEntrySchema = z3.object({
+  id: z3.string(),
+  at: z3.string(),
+  action: z3.enum(["impersonation.start", "impersonation.stop"]),
+  actor: z3.string(),
+  target: z3.string(),
+  until: z3.string().optional(),
+  lapsed: z3.boolean().optional()
 });
-var AuditListSchema = z2.object({ entries: z2.array(AuditEntrySchema) });
-var ImpersonateRequestSchema = z2.object({ email: z2.string().trim().toLowerCase().min(3) });
+var AuditListSchema = z3.object({ entries: z3.array(AuditEntrySchema) });
+var ImpersonateRequestSchema = z3.object({ email: z3.string().trim().toLowerCase().min(3) });
 
 // ../../packages/shared/src/comments.ts
-import { z as z3 } from "zod";
+import { z as z4 } from "zod";
 var COMMENT_MAX_CHARS = 4e3;
 var COMMENT_PATH_MAX = 1024;
-var CommentAuthorSchema = z3.discriminatedUnion("kind", [
-  z3.object({ kind: z3.literal("user"), email: z3.string() }),
-  z3.object({ kind: z3.literal("guest"), name: z3.string() })
+var CommentAuthorSchema = z4.discriminatedUnion("kind", [
+  z4.object({ kind: z4.literal("user"), email: z4.string() }),
+  z4.object({ kind: z4.literal("guest"), name: z4.string() })
 ]);
 var ANCHOR_SELECTOR_MAX = 512;
 var ANCHOR_QUOTE_MAX = 500;
-var px = z3.number().finite().min(-1e7).max(1e7);
-var percent = z3.number().min(0).max(100);
-var CommentAnchorSchema = z3.object({
+var px = z4.number().finite().min(-1e7).max(1e7);
+var percent = z4.number().min(0).max(100);
+var CommentAnchorSchema = z4.object({
   x: percent,
   y: percent,
-  selector: z3.string().min(1).max(ANCHOR_SELECTOR_MAX).optional(),
+  selector: z4.string().min(1).max(ANCHOR_SELECTOR_MAX).optional(),
   ex: percent.optional(),
   ey: percent.optional(),
   docX: px.optional(),
   docY: px.optional(),
   scrollX: px.optional(),
   scrollY: px.optional(),
-  vw: z3.number().finite().min(0).max(1e5).optional(),
-  vh: z3.number().finite().min(0).max(1e5).optional(),
-  hash: z3.string().max(COMMENT_PATH_MAX).optional(),
+  vw: z4.number().finite().min(0).max(1e5).optional(),
+  vh: z4.number().finite().min(0).max(1e5).optional(),
+  hash: z4.string().max(COMMENT_PATH_MAX).optional(),
   ew: percent.optional(),
   eh: percent.optional(),
-  docW: z3.number().finite().min(0).max(1e7).optional(),
-  docH: z3.number().finite().min(0).max(1e7).optional(),
-  quote: z3.string().min(1).max(ANCHOR_QUOTE_MAX).optional()
+  docW: z4.number().finite().min(0).max(1e7).optional(),
+  docH: z4.number().finite().min(0).max(1e7).optional(),
+  quote: z4.string().min(1).max(ANCHOR_QUOTE_MAX).optional()
 });
-var CommentSchema = z3.object({
-  id: z3.string(),
+var CommentSchema = z4.object({
+  id: z4.string(),
   /** the thread this replies to; null for the comment that starts a thread */
-  parentId: z3.string().nullable(),
+  parentId: z4.string().nullable(),
   /** the page, as normalizeCommentPath() writes it ('/', '/docs/', '/about.html') */
-  path: z3.string(),
+  path: z4.string(),
   /** the version the site was serving when the comment was made (null: none was) */
-  versionId: z3.string().nullable(),
+  versionId: z4.string().nullable(),
   anchor: CommentAnchorSchema.nullable(),
-  body: z3.string(),
+  body: z4.string(),
   author: CommentAuthorSchema,
-  createdAt: z3.string(),
+  createdAt: z4.string(),
   /** threads only: when and by whom it was resolved (null: open) */
-  resolvedAt: z3.string().nullable(),
+  resolvedAt: z4.string().nullable(),
   resolvedBy: CommentAuthorSchema.nullable(),
   /** whether the caller may delete it (policy's answer, so clients don't guess) */
-  canDelete: z3.boolean()
+  canDelete: z4.boolean()
 });
-var CommentListSchema = z3.object({
-  site: z3.object({
-    name: z3.string(),
-    url: z3.string(),
-    currentVersionId: z3.string().nullable()
+var CommentListSchema = z4.object({
+  site: z4.object({
+    name: z4.string(),
+    url: z4.string(),
+    currentVersionId: z4.string().nullable()
   }),
-  comments: z3.array(CommentSchema),
-  can: z3.object({
-    create: z3.boolean(),
-    resolve: z3.boolean(),
+  comments: z4.array(CommentSchema),
+  can: z4.object({
+    create: z4.boolean(),
+    resolve: z4.boolean(),
     /** delete anyone's comment (everyone may delete their own) */
-    deleteAny: z3.boolean()
+    deleteAny: z4.boolean()
   })
 });
-var CreateCommentRequestSchema = z3.object({
-  body: z3.string().trim().min(1).max(COMMENT_MAX_CHARS),
-  path: z3.string().max(COMMENT_PATH_MAX).optional(),
-  parentId: z3.string().min(1).max(100).optional(),
+var CreateCommentRequestSchema = z4.object({
+  body: z4.string().trim().min(1).max(COMMENT_MAX_CHARS),
+  path: z4.string().max(COMMENT_PATH_MAX).optional(),
+  parentId: z4.string().min(1).max(100).optional(),
   anchor: CommentAnchorSchema.optional()
 });
-var UpdateCommentRequestSchema = z3.object({ resolved: z3.boolean() });
+var UpdateCommentRequestSchema = z4.object({ resolved: z4.boolean() });
 function commentThreads(comments) {
   const threads = /* @__PURE__ */ new Map();
   for (const c of comments) {
@@ -457,6 +554,60 @@ var CLI_PACKAGE = "@nearform/fling";
 var REPO_SLUG = "nearform/fling";
 var DEFAULT_INSTALL_COMMAND = `npm install -g ${CLI_PACKAGE}`;
 
+// ../../packages/shared/src/groups.ts
+import { z as z5 } from "zod";
+var GROUP_MEMBERS_MAX = 500;
+var GROUP_SLUG_MAX = 50;
+var GROUP_NAME_MAX = 100;
+var GROUP_SLUG_RE = /^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$/;
+function isValidGroupSlug(slug) {
+  return slug.length <= GROUP_SLUG_MAX && GROUP_SLUG_RE.test(slug) && !slug.includes("--");
+}
+var GROUP_SLUG_RULES = `1-${GROUP_SLUG_MAX} lowercase letters, digits and single hyphens`;
+var GroupSlugSchema = z5.string().trim().toLowerCase().refine(isValidGroupSlug, `A group's slug is ${GROUP_SLUG_RULES}`);
+var GroupNameSchema = z5.string().trim().min(1).max(GROUP_NAME_MAX);
+var memberEmails = z5.array(z5.string().trim().toLowerCase().min(3).max(254)).max(GROUP_MEMBERS_MAX, `A group holds at most ${GROUP_MEMBERS_MAX} people`);
+var GroupSummarySchema = z5.object({
+  slug: z5.string(),
+  name: z5.string(),
+  /** the email of the user who made it, the only one who may change it */
+  owner: z5.string(),
+  size: z5.number(),
+  createdAt: z5.string(),
+  updatedAt: z5.string()
+});
+var GroupListSchema = z5.object({ groups: z5.array(GroupSummarySchema) });
+var GroupDetailSchema = GroupSummarySchema.extend({
+  members: z5.array(AudienceEmailSchema),
+  canManage: z5.boolean()
+});
+var CreateGroupRequestSchema = z5.object({
+  slug: GroupSlugSchema,
+  name: GroupNameSchema,
+  members: memberEmails.optional()
+});
+var UpdateGroupRequestSchema = z5.object({ name: GroupNameSchema });
+var GroupMembersRequestSchema = z5.object({
+  add: memberEmails.optional(),
+  remove: memberEmails.optional()
+});
+function splitGroups(values) {
+  const all = typeof values === "string" ? [values] : values;
+  return all.flatMap((v) => v.split(/[\s,;]+/)).map((s) => s.trim().toLowerCase()).filter(Boolean);
+}
+function describeGroups(groups2, me) {
+  if (groups2.length === 0) return "No groups yet.";
+  return groups2.map((g) => `- ${groupLabel(g)}, owned by ${g.owner === me ? "you" : g.owner}`).join("\n");
+}
+function describeGroup(group) {
+  const members2 = group.members;
+  const who = group.canManage ? "you (you can change it)" : `${group.owner} (only they can change it)`;
+  return [
+    `${groupLabel(group)}, owned by ${who}.`,
+    members2.length ? `Members: ${audienceList(members2)}.` : "No members yet."
+  ].join("\n");
+}
+
 // ../../packages/shared/src/site-labels.ts
 var SITE_NAME_MAX = 50;
 var SHARE_TOKEN_LENGTH = 20;
@@ -491,47 +642,47 @@ function siteUrl(label, sitesDomain, protocol = "https:") {
 }
 
 // ../../packages/shared/src/instance.ts
-import { z as z4 } from "zod";
+import { z as z6 } from "zod";
 var INSTANCE_METADATA_PATH = "/.well-known/fling";
 var HEX_COLOR_RE = /^#(?:[0-9a-f]{3}|[0-9a-f]{6})$/i;
-var color = z4.string().regex(HEX_COLOR_RE);
-var InstanceAuthSchema = z4.looseObject({
-  kind: z4.string().min(1),
-  displayName: z4.string().min(1),
-  issuer: z4.string().optional(),
-  emailDomains: z4.array(z4.string()).default([]),
-  invitedEmails: z4.boolean().optional()
+var color = z6.string().regex(HEX_COLOR_RE);
+var InstanceAuthSchema = z6.looseObject({
+  kind: z6.string().min(1),
+  displayName: z6.string().min(1),
+  issuer: z6.string().optional(),
+  emailDomains: z6.array(z6.string()).default([]),
+  invitedEmails: z6.boolean().optional()
 });
-var BrandColorsSchema = z4.looseObject({
+var BrandColorsSchema = z6.looseObject({
   primary: color.optional(),
   primaryContent: color.optional(),
   accent: color.optional(),
   ink: color.optional(),
   highlight: color.optional()
 });
-var InstanceBrandSchema = z4.looseObject({
+var InstanceBrandSchema = z6.looseObject({
   /** https: or data: URL of the logo mark shown before the name (light theme). */
-  logoUrl: z4.string().optional(),
+  logoUrl: z6.string().optional(),
   /** The same for the dark theme; defaults to `logoUrl`. */
-  logoDarkUrl: z4.string().optional(),
-  faviconUrl: z4.string().optional(),
+  logoDarkUrl: z6.string().optional(),
+  faviconUrl: z6.string().optional(),
   colors: BrandColorsSchema.default({})
 });
-var InstanceMetadataSchema = z4.looseObject({
-  version: z4.number().int().min(1),
+var InstanceMetadataSchema = z6.looseObject({
+  version: z6.number().int().min(1),
   /** Display name, e.g. "Fling". */
-  name: z4.string().min(1),
+  name: z6.string().min(1),
   /** e.g. `https://fling.example.test` (no trailing slash) */
-  appOrigin: z4.string().url(),
+  appOrigin: z6.string().url(),
   /** host[:port] sites hang off: a site is `<name>.<sitesDomain>` */
-  sitesDomain: z4.string().min(1),
-  siteScheme: z4.enum(["http", "https"]),
+  sitesDomain: z6.string().min(1),
+  siteScheme: z6.enum(["http", "https"]),
   auth: InstanceAuthSchema,
   brand: InstanceBrandSchema.default({ colors: {} }),
   /** Feature flags: a client hides what is missing or false. */
-  capabilities: z4.record(z4.string(), z4.boolean()).default({}),
+  capabilities: z6.record(z6.string(), z6.boolean()).default({}),
   /** How to install the CLI, e.g. `npm install -g <package>`. */
-  installCommand: z4.string().min(1)
+  installCommand: z6.string().min(1)
 });
 function instanceSitesPattern(instance) {
   return `${instance.siteScheme}://<name>.${instance.sitesDomain}`;
@@ -555,15 +706,22 @@ function instanceMetadataUrl(serverUrl) {
 }
 
 // ../../packages/shared/src/kvs.ts
-import { z as z5 } from "zod";
-var KvsSiteValueSchema = z5.object({
+import { z as z7 } from "zod";
+
+// ../../packages/shared/src/route-keys.ts
+var SITE_PASS_TTL_SECONDS = 5 * 60;
+
+// ../../packages/shared/src/kvs.ts
+var KvsSiteValueSchema = z7.object({
   /** siteId — S3 prefix is `sites/<id>/<v>/` */
-  id: z5.string(),
+  id: z7.string(),
   /** current versionId */
-  v: z5.string(),
-  vis: z5.enum(["private", "public"]),
+  v: z7.string(),
+  vis: z7.enum(["private", "public"]),
   /** serve /index.html for unknown extensionless paths */
-  spa: z5.boolean()
+  spa: z7.boolean(),
+  /** present when the site is restricted (private with an audience): the edge wants a site pass */
+  r: z7.literal(1).optional()
 });
 
 // ../../packages/shared/src/listing.ts
@@ -583,13 +741,13 @@ function extractHtmlTitle(html) {
 }
 function renderHtmlListing(siteName2, entries) {
   const pages = entries.filter((e) => isHtmlPath(e.path) && e.path.toLowerCase() !== "index.html").sort((a, b) => a.path < b.path ? -1 : a.path > b.path ? 1 : 0);
-  const groups = /* @__PURE__ */ new Map();
+  const groups2 = /* @__PURE__ */ new Map();
   for (const page of pages) {
     const slash = page.path.lastIndexOf("/");
     const folder = slash === -1 ? "" : page.path.slice(0, slash);
-    groups.set(folder, [...groups.get(folder) ?? [], page]);
+    groups2.set(folder, [...groups2.get(folder) ?? [], page]);
   }
-  const sections = [...groups.entries()].sort(([a], [b]) => a === "" ? -1 : b === "" ? 1 : a < b ? -1 : 1).map(([folder, items]) => {
+  const sections = [...groups2.entries()].sort(([a], [b]) => a === "" ? -1 : b === "" ? 1 : a < b ? -1 : 1).map(([folder, items]) => {
     const heading = folder ? `<h2>${escapeHtml(folder)}/</h2>` : "";
     const rows = items.map((item) => {
       const file = item.path.slice(item.path.lastIndexOf("/") + 1);
@@ -647,7 +805,19 @@ ${body}
 }
 
 // ../../packages/shared/src/mcp-tools.ts
-import { z as z6 } from "zod";
+import { z as z8 } from "zod";
+
+// ../../packages/shared/src/site-sort.ts
+var SITE_SORTS = ["updated", "created", "name"];
+var DEFAULT_SITE_SORT = "updated";
+var byName = (a, b) => a.name < b.name ? -1 : a.name > b.name ? 1 : 0;
+function sortSites(sites, sort = DEFAULT_SITE_SORT) {
+  const newest = (key) => (a, b) => Date.parse(b[key]) - Date.parse(a[key]) || byName(a, b);
+  const compare = sort === "name" ? byName : newest(sort === "created" ? "createdAt" : "updatedAt");
+  return [...sites].sort(compare);
+}
+
+// ../../packages/shared/src/mcp-tools.ts
 var MCP_PUBLISH_MAX_BYTES = 4 * 1024 * 1024;
 var MCP_UPLOAD_CHUNK_MAX_CHARS = 4 * 1024 * 1024;
 var MCP_UPLOAD_TTL_SECONDS = 60 * 60;
@@ -676,23 +846,28 @@ var INLINE_ONLY = "If you created the content in this conversation, pass it dire
 var NEVER_PUBLISHED = "Fling never publishes dotfiles, gitignored files, secret files (keys, certs, credentials) or files that contain secrets (API keys, tokens, private keys, passwords in database URLs); it stops and tells you which file and line. Remove the secret (or leave the file out) and retry \u2014 there is no way to override this.";
 var ENCODING = '`encoding` is "utf8" (default, for text: HTML, CSS, JS, SVG, JSON, Markdown\u2026) or "base64" (binary: images, fonts, PDFs).';
 var LIST_HTML = "If the files have no root index.html but do include HTML pages, the call does not publish: it reports how many HTML pages there are and asks you to check with the user. Ask them whether to generate an index.html listing those pages (retry with `listHtml: true`) or to publish without one (`listHtml: false` \u2014 the site root will 404, the pages still work at their own paths), then retry.";
-var listHtml = z6.boolean().optional().describe(
+var listHtml = z8.boolean().optional().describe(
   "Only matters when there is no root index.html: true \u2192 generate an index.html linking every HTML page; false \u2192 publish without one (root 404s). Omit until the user has decided"
 );
-var siteName = z6.string().min(1).max(200).describe('Site name, e.g. "q3-report"');
-var sitePath = z6.string().min(1).max(1024).describe(
+var siteName = z8.string().min(1).max(200).describe('Site name, e.g. "q3-report"');
+var sitePath = z8.string().min(1).max(1024).describe(
   'Site-relative path with forward slashes, e.g. "index.html", "css/app.css", "img/logo.png". The root page must be "index.html". No dotfiles (".env", ".well-known/\u2026")'
 );
-var commentPath = z6.string().max(1024);
-var commentId = z6.string().min(1).max(100);
-var encoding = z6.enum(["utf8", "base64"]).optional().describe('How `content` is encoded: "utf8" (default) for text, "base64" for binary files');
-var spa = z6.boolean().optional().describe(
+var emails = z8.array(z8.string().min(3).max(254)).max(AUDIENCE_EMAILS_MAX);
+var groupSlugs = z8.array(z8.string().min(1).max(100)).max(AUDIENCE_GROUPS_MAX);
+var groupSlug = z8.string().min(1).max(100).describe(`The group's slug, e.g. "design"`);
+var members = z8.array(z8.string().min(3).max(254)).max(GROUP_MEMBERS_MAX);
+var groupName = z8.string().min(1).max(GROUP_NAME_MAX);
+var commentPath = z8.string().max(1024);
+var commentId = z8.string().min(1).max(100);
+var encoding = z8.enum(["utf8", "base64"]).optional().describe('How `content` is encoded: "utf8" (default) for text, "base64" for binary files');
+var spa = z8.boolean().optional().describe(
   "Single-page app: serve index.html for unknown paths (client-side routing). Omit to keep the current setting"
 );
 function mcpToolsFor(w) {
   const NAME_RULES = `Site names are 1-${SITE_NAME_MAX} chars of lowercase letters, digits and single hyphens, and are one global namespace (first come, first served): the site is served at ${w.sitesPattern}.`;
   const VISIBILITY = `Sites are private by default (only ${w.privateAudience} can open them); pass \`public: true\` only if the user asks for a public site. Share links (fling_share) are public to anyone who has them.`;
-  const isPublic = z6.boolean().optional().describe(
+  const isPublic = z8.boolean().optional().describe(
     `true \u2192 anyone can view; false \u2192 only ${w.privateAudience}. Omit to keep the current setting (new sites are private)`
   );
   return {
@@ -706,9 +881,13 @@ function mcpToolsFor(w) {
     list: tool({
       name: "fling_list",
       title: "List sites",
-      description: "List the user's Fling sites with URL, visibility and share link.",
+      description: "List the user's Fling sites with URL, visibility and share link. With `shared: true`, list instead the restricted sites other people have shared with the user (by address or through a group they're in), with URL, review link and owner.",
       inputSchema: {
-        archived: z6.boolean().optional().describe("List archived sites instead of live ones")
+        archived: z8.boolean().optional().describe("List archived sites instead of live ones"),
+        shared: z8.boolean().optional().describe("List the sites others have shared with the user instead of the user's own"),
+        sort: z8.enum(SITE_SORTS).optional().describe(
+          "Order: updated (last updated, newest first; the default), created (newest first) or name (A\u2013Z)"
+        )
       },
       annotations: { readOnlyHint: true, openWorldHint: false }
     }),
@@ -725,7 +904,7 @@ function mcpToolsFor(w) {
       description: "List the files in a site's current version (or in `versionId`, from fling_info): path, size and content type, sorted by path. Use it to check what was actually published \u2014 e.g. when the user sees a 404, confirm the page exists at that path and that there is a root index.html (without one the site root 404s).",
       inputSchema: {
         name: siteName,
-        versionId: z6.string().min(1).max(100).optional().describe("Version id (from fling_info); omit for the version being served")
+        versionId: z8.string().min(1).max(100).optional().describe("Version id (from fling_info); omit for the version being served")
       },
       annotations: { readOnlyHint: true, openWorldHint: false }
     }),
@@ -733,7 +912,7 @@ function mcpToolsFor(w) {
       name: "fling_check_name",
       title: "Check a site name",
       description: "Check whether a site name can be used before publishing: `available` (a new site), `yours` (publishing updates the user's existing site), `taken` (someone else's \u2014 free `suggestions` are returned) or `invalid`. " + NAME_RULES,
-      inputSchema: { name: z6.string().min(1).max(200).describe("Site name to check") },
+      inputSchema: { name: z8.string().min(1).max(200).describe("Site name to check") },
       annotations: { readOnlyHint: true, openWorldHint: false }
     }),
     publish: tool({
@@ -742,10 +921,10 @@ function mcpToolsFor(w) {
       description: `Publish a static site to Fling in one call and get back its URL. Pass every file of the site inline in \`files\` (whole site, up to ${MCP_PUBLISH_MAX_BYTES / 1024 / 1024} MB decoded in total; bigger sites: fling_upload_begin / fling_upload_file / fling_upload_finish). ${INLINE_ONLY} ${ENCODING} Publishing replaces the whole site with exactly these files (it is not a patch: include unchanged files too); publishing identical content again is a no-op. ${NAME_REQUIRED} ${NAME_RULES} ${VISIBILITY} ${LIST_HTML} ${NEVER_PUBLISHED} The result includes \`warnings\`. Share the returned URL with the user; fling_files shows exactly which files the site has.`,
       inputSchema: {
         name: siteName,
-        files: z6.array(
-          z6.object({
+        files: z8.array(
+          z8.object({
             path: sitePath,
-            content: z6.string().describe("The file content, encoded as `encoding` says"),
+            content: z8.string().describe("The file content, encoded as `encoding` says"),
             encoding
           })
         ).min(1).max(MAX_FILES).describe("Every file of the site"),
@@ -767,11 +946,11 @@ function mcpToolsFor(w) {
       title: "Upload a file (chunked)",
       description: `Add one file to a chunked upload started with fling_upload_begin. Sending the same path again replaces it. A file larger than ${MCP_UPLOAD_CHUNK_MAX_CHARS / 1024 / 1024} MB of content can span calls: send the first part normally, then the following parts in order with \`append: true\` (same path and encoding; send appends one at a time, not in parallel). ${ENCODING} ${NEVER_PUBLISHED}`,
       inputSchema: {
-        uploadId: z6.string().min(1).max(100).describe("From fling_upload_begin"),
+        uploadId: z8.string().min(1).max(100).describe("From fling_upload_begin"),
         path: sitePath,
-        content: z6.string().max(MCP_UPLOAD_CHUNK_MAX_CHARS).describe("The file content (or the next part of it, with `append`)"),
+        content: z8.string().max(MCP_UPLOAD_CHUNK_MAX_CHARS).describe("The file content (or the next part of it, with `append`)"),
         encoding,
-        append: z6.boolean().optional().describe("Append this content to the file sent earlier with the same path")
+        append: z8.boolean().optional().describe("Append this content to the file sent earlier with the same path")
       },
       annotations: { destructiveHint: false, openWorldHint: false }
     }),
@@ -780,7 +959,7 @@ function mcpToolsFor(w) {
       title: "Finish a chunked upload",
       description: `Publish everything sent with fling_upload_file as the new version of the site and return its URL. The site becomes exactly the uploaded files. ${LIST_HTML} The upload stays open, so just call fling_upload_finish again with \`listHtml\`. The result includes \`warnings\`.`,
       inputSchema: {
-        uploadId: z6.string().min(1).max(100).describe("From fling_upload_begin"),
+        uploadId: z8.string().min(1).max(100).describe("From fling_upload_begin"),
         listHtml
       },
       annotations: { destructiveHint: false, openWorldHint: true }
@@ -791,25 +970,97 @@ function mcpToolsFor(w) {
       description: "Get or create a public share link for a site: anyone with the link can view it without signing in (use it to show a private site to someone who cannot sign in). `refresh` replaces the link (the old one stops working); `revoke` removes it.",
       inputSchema: {
         name: siteName,
-        refresh: z6.boolean().optional().describe("Rotate the link"),
-        revoke: z6.boolean().optional().describe("Remove the link")
+        refresh: z8.boolean().optional().describe("Rotate the link"),
+        revoke: z8.boolean().optional().describe("Remove the link")
       },
       annotations: { destructiveHint: false, openWorldHint: true }
     }),
     setVisibility: tool({
       name: "fling_set_visibility",
       title: "Set visibility",
-      description: `Make a site private (only ${w.privateAudience}) or public (anyone).`,
-      inputSchema: { name: siteName, visibility: z6.enum(["private", "public"]) },
+      description: `Make a site private (open to ${w.privateAudience}) or public (anyone can open the site; its review page and comments still need sign-in).`,
+      inputSchema: { name: siteName, visibility: z8.enum(["private", "public"]) },
       annotations: { idempotentHint: true, openWorldHint: true }
     }),
+    setAudience: tool({
+      name: "fling_set_audience",
+      title: "Set who can see a private site",
+      description: `Limit a private site to listed people and groups (its audience), or open it again to ${w.privateAudience}. \`add\` and \`remove\` change the addresses and \`set\` replaces them; \`addGroups\`, \`removeGroups\` and \`setGroups\` do the same for groups, by slug (fling_groups lists them); \`clear\` empties both (then every signed-in member can see it again). The owner always sees the site. Each address must be one that can sign in to ${w.name}. The audience only applies while the site is private (fling_set_visibility); share links still open it to anyone. Removing someone takes up to 5 minutes to shut them out. fling_info shows the audience.`,
+      inputSchema: {
+        name: siteName,
+        add: emails.optional().describe("Addresses to let in"),
+        remove: emails.optional().describe("Addresses to take out"),
+        set: emails.optional().describe("Replace the addresses with exactly these"),
+        addGroups: groupSlugs.optional().describe("Groups (slugs) to let in"),
+        removeGroups: groupSlugs.optional().describe("Groups (slugs) to take out"),
+        setGroups: groupSlugs.optional().describe("Replace the groups with exactly these slugs"),
+        clear: z8.boolean().optional().describe("Empty the audience (addresses and groups): every signed-in member sees it")
+      },
+      annotations: { idempotentHint: true, openWorldHint: false }
+    }),
+    groups: tool({
+      name: "fling_groups",
+      title: "List groups",
+      description: `List the groups on ${w.name}: named lists of people (a team) that any member can use in a site's audience (fling_set_audience \`addGroups\`). Each has a slug, a name, a size and an owner; \`mine\` lists only the user's own. \`members\` lists only the groups of exactly those people: use it before making a group, or to swap a list of addresses in an audience for a group that already holds them.`,
+      inputSchema: {
+        mine: z8.boolean().optional().describe("Only the groups the user owns"),
+        members: members.optional().describe("Only the groups whose members are exactly these addresses")
+      },
+      annotations: { readOnlyHint: true, openWorldHint: false }
+    }),
+    groupShow: tool({
+      name: "fling_group_show",
+      title: "Show a group",
+      description: "Show a group and its members (each marked when they have not signed in yet), and whether the user owns it (only the owner can change it).",
+      inputSchema: { slug: groupSlug },
+      annotations: { readOnlyHint: true, openWorldHint: false }
+    }),
+    groupCreate: tool({
+      name: "fling_group_create",
+      title: "Create a group",
+      description: `Create a group the user owns: a named list of people that anyone signed in to ${w.name} can see and use in a site's audience, but only the user can change. The slug is ${GROUP_SLUG_RULES}, unique on ${w.name}; each member must be an address that can sign in (at most ${GROUP_MEMBERS_MAX}).`,
+      inputSchema: {
+        slug: groupSlug,
+        name: groupName.describe('Its display name, e.g. "Design team"'),
+        members: members.optional().describe("Addresses to put in it")
+      },
+      annotations: { destructiveHint: false, openWorldHint: false }
+    }),
+    groupMembers: tool({
+      name: "fling_group_members",
+      title: "Change who is in a group",
+      description: "Add people to a group the user owns, or take them out. Every site whose audience names the group follows: someone taken out is shut out within 5 minutes.",
+      inputSchema: {
+        slug: groupSlug,
+        add: members.optional().describe("Addresses to add"),
+        remove: members.optional().describe("Addresses to take out")
+      },
+      annotations: { idempotentHint: true, openWorldHint: false }
+    }),
+    groupRename: tool({
+      name: "fling_group_rename",
+      title: "Rename a group",
+      description: "Change the display name of a group the user owns (the slug stays).",
+      inputSchema: { slug: groupSlug, name: groupName.describe("The new display name") },
+      annotations: { idempotentHint: true, openWorldHint: false }
+    }),
+    groupDelete: tool({
+      name: "fling_group_delete",
+      title: "Delete a group",
+      description: "Permanently delete a group the user owns. Sites whose audience names it keep their restriction, and anyone it let in loses access (a site limited to it alone is left to its owner). Cannot be undone \u2014 confirm with the user first and pass `confirm: true`.",
+      inputSchema: {
+        slug: groupSlug,
+        confirm: z8.literal(true).describe("Must be true: the user has confirmed the deletion")
+      },
+      annotations: { destructiveHint: true, openWorldHint: false }
+    }),
     archive: tool({
       name: "fling_archive",
       title: "Archive or restore a site",
       description: "Archive a site (it stops being served and is hidden from lists, but its name, files and versions are kept) or, with `unarchive`, bring it back. Prefer this over deleting.",
       inputSchema: {
         name: siteName,
-        unarchive: z6.boolean().optional().describe("Restore an archived site")
+        unarchive: z8.boolean().optional().describe("Restore an archived site")
       },
       annotations: { idempotentHint: true, openWorldHint: false }
     }),
@@ -819,7 +1070,7 @@ function mcpToolsFor(w) {
       description: "Permanently delete a site and every version of it, freeing its name. Cannot be undone \u2014 confirm with the user first and pass `confirm: true`. Consider fling_archive instead.",
       inputSchema: {
         name: siteName,
-        confirm: z6.literal(true).describe("Must be true: the user has confirmed the deletion")
+        confirm: z8.literal(true).describe("Must be true: the user has confirmed the deletion")
       },
       annotations: { destructiveHint: true, openWorldHint: false }
     }),
@@ -830,7 +1081,7 @@ function mcpToolsFor(w) {
       inputSchema: {
         name: siteName,
         path: commentPath.optional().describe('Only this page, e.g. "/" or "/docs/"'),
-        includeResolved: z6.boolean().optional().describe("Include resolved threads")
+        includeResolved: z8.boolean().optional().describe("Include resolved threads")
       },
       annotations: { readOnlyHint: true, openWorldHint: false }
     }),
@@ -840,7 +1091,7 @@ function mcpToolsFor(w) {
       description: `Comment on a page of a site (shown on its review page, ${w.reviewPattern}), or reply to a thread (\`replyTo\`: a thread id from fling_comments_list). Comments are signed with the user's name, so only write one the user asked for.`,
       inputSchema: {
         name: siteName,
-        body: z6.string().min(1).max(COMMENT_MAX_CHARS).describe("The comment (plain text)"),
+        body: z8.string().min(1).max(COMMENT_MAX_CHARS).describe("The comment (plain text)"),
         path: commentPath.optional().describe('The page it is about (default "/"); ignored for a reply'),
         replyTo: commentId.optional().describe("Reply to this thread instead of starting one")
       },
@@ -853,7 +1104,7 @@ function mcpToolsFor(w) {
       inputSchema: {
         name: siteName,
         id: commentId.describe("The thread id"),
-        reopen: z6.boolean().optional().describe("Reopen a resolved thread")
+        reopen: z8.boolean().optional().describe("Reopen a resolved thread")
       },
       annotations: { idempotentHint: true, openWorldHint: false }
     }),
@@ -870,7 +1121,7 @@ function mcpToolsFor(w) {
       description: "Point a site at an earlier version (ids from fling_info). Instant; nothing is uploaded.",
       inputSchema: {
         name: siteName,
-        versionId: z6.string().min(1).max(100).describe("Version id to serve")
+        versionId: z8.string().min(1).max(100).describe("Version id to serve")
       },
       annotations: { idempotentHint: true, openWorldHint: false }
     })
@@ -967,97 +1218,109 @@ function readinessWaitDisabled(env) {
 }
 
 // ../../packages/shared/src/review-bridge.ts
-import { z as z7 } from "zod";
-var tag = { fling: z7.literal("review") };
-var path = z7.string().max(COMMENT_PATH_MAX);
-var hash = z7.string().max(COMMENT_PATH_MAX);
-var BridgePinSchema = z7.object({
-  id: z7.string(),
-  n: z7.number().int().min(1),
+import { z as z9 } from "zod";
+var tag = { fling: z9.literal("review") };
+var path = z9.string().max(COMMENT_PATH_MAX);
+var hash = z9.string().max(COMMENT_PATH_MAX);
+var BridgePinSchema = z9.object({
+  id: z9.string(),
+  n: z9.number().int().min(1),
   anchor: CommentAnchorSchema,
-  selected: z7.boolean(),
-  resolved: z7.boolean()
+  selected: z9.boolean(),
+  resolved: z9.boolean()
 });
-var BridgeCursorSchema = z7.object({
-  id: z7.string(),
-  name: z7.string().max(100),
-  colour: z7.string().max(32),
+var BridgeCursorSchema = z9.object({
+  id: z9.string(),
+  name: z9.string().max(100),
+  colour: z9.string().max(32),
   anchor: CommentAnchorSchema
 });
-var ShellMessageSchema = z7.discriminatedUnion("type", [
-  z7.object({ ...tag, type: z7.literal("ready") }),
+var ShellMessageSchema = z9.discriminatedUnion("type", [
+  z9.object({ ...tag, type: z9.literal("ready") }),
   /** the frame is on `path` (normalised, see normalizeCommentPath) with fragment `hash` ('' or '#…') */
-  z7.object({ ...tag, type: z7.literal("location"), path, hash, title: z7.string().max(300) }),
+  z9.object({ ...tag, type: z9.literal("location"), path, hash, title: z9.string().max(300) }),
   /** a pin placed while placing: a click (a spot) or a drag (a box) */
-  z7.object({ ...tag, type: z7.literal("pinPlaced"), anchor: CommentAnchorSchema }),
+  z9.object({ ...tag, type: z9.literal("pinPlaced"), anchor: CommentAnchorSchema }),
   /** the reviewer selected text in the page: an anchor on it, with its quote */
-  z7.object({ ...tag, type: z7.literal("textSelected"), anchor: CommentAnchorSchema }),
-  z7.object({ ...tag, type: z7.literal("pinCancelled") }),
-  z7.object({ ...tag, type: z7.literal("pinClicked"), id: z7.string() }),
+  z9.object({ ...tag, type: z9.literal("textSelected"), anchor: CommentAnchorSchema }),
+  z9.object({ ...tag, type: z9.literal("pinCancelled") }),
+  z9.object({ ...tag, type: z9.literal("pinClicked"), id: z9.string() }),
   /** this reviewer's pointer on the page; null when it left the frame */
-  z7.object({ ...tag, type: z7.literal("cursor"), anchor: CommentAnchorSchema.nullable() }),
+  z9.object({ ...tag, type: z9.literal("cursor"), anchor: CommentAnchorSchema.nullable() }),
   /** a link or form to another origin, stopped: the frame stays on the site */
-  z7.object({ ...tag, type: z7.literal("blocked"), href: z7.string().max(2048) }),
-  z7.object({ ...tag, type: z7.literal("escape") })
+  z9.object({ ...tag, type: z9.literal("blocked"), href: z9.string().max(2048) }),
+  z9.object({ ...tag, type: z9.literal("escape") })
 ]);
-var PageMessageSchema = z7.discriminatedUnion("type", [
+var PageMessageSchema = z9.discriminatedUnion("type", [
   /** load `path` (site-relative, may carry `?query` and `#hash`) in the frame */
-  z7.object({ ...tag, type: z7.literal("navigate"), path: z7.string().max(COMMENT_PATH_MAX * 2) }),
-  z7.object({ ...tag, type: z7.literal("reload") }),
-  z7.object({ ...tag, type: z7.literal("placing"), on: z7.boolean() }),
+  z9.object({ ...tag, type: z9.literal("navigate"), path: z9.string().max(COMMENT_PATH_MAX * 2) }),
+  z9.object({ ...tag, type: z9.literal("reload") }),
+  z9.object({ ...tag, type: z9.literal("placing"), on: z9.boolean() }),
   /** the pins on the frame's current page */
-  z7.object({ ...tag, type: z7.literal("pins"), pins: z7.array(BridgePinSchema) }),
+  z9.object({ ...tag, type: z9.literal("pins"), pins: z9.array(BridgePinSchema) }),
   /** scroll the pin into view and draw attention to it */
-  z7.object({ ...tag, type: z7.literal("focusPin"), id: z7.string() }),
-  z7.object({ ...tag, type: z7.literal("cursors"), cursors: z7.array(BridgeCursorSchema) })
+  z9.object({ ...tag, type: z9.literal("focusPin"), id: z9.string() }),
+  z9.object({ ...tag, type: z9.literal("cursors"), cursors: z9.array(BridgeCursorSchema) })
 ]);
 
 // ../../packages/shared/src/review-live.ts
-import { z as z8 } from "zod";
+import { z as z10 } from "zod";
 var LIVE_PICTURE_MAX = 1024;
-var LivePeerSchema = z8.object({
-  id: z8.string(),
-  name: z8.string().max(100),
-  colour: z8.string().max(32),
+var LivePeerSchema = z10.object({
+  id: z10.string(),
+  name: z10.string().max(100),
+  colour: z10.string().max(32),
   /** their profile picture (https), when sign-in gave one; else clients show initials */
-  picture: z8.string().max(LIVE_PICTURE_MAX).optional()
+  picture: z10.string().max(LIVE_PICTURE_MAX).optional()
 });
-var LiveTicketSchema = z8.object({
-  url: z8.string(),
-  ticket: z8.string(),
+var LiveTicketSchema = z10.object({
+  url: z10.string(),
+  ticket: z10.string(),
   /** seconds the ticket is good for: connect before then */
-  expiresIn: z8.number().int()
+  expiresIn: z10.number().int()
 });
-var path2 = z8.string().max(COMMENT_PATH_MAX);
-var hash2 = z8.string().max(COMMENT_PATH_MAX);
-var LiveClientMessageSchema = z8.discriminatedUnion("type", [
-  z8.object({ type: z8.literal("hello") }),
+var path2 = z10.string().max(COMMENT_PATH_MAX);
+var hash2 = z10.string().max(COMMENT_PATH_MAX);
+var LiveClientMessageSchema = z10.discriminatedUnion("type", [
+  z10.object({ type: z10.literal("hello") }),
   /** where this peer's pointer is; `anchor` null when it left the page */
-  z8.object({
-    type: z8.literal("cursor"),
+  z10.object({
+    type: z10.literal("cursor"),
     path: path2,
     hash: hash2,
     anchor: CommentAnchorSchema.nullable()
   }),
-  z8.object({ type: z8.literal("ping") })
+  z10.object({ type: z10.literal("ping") })
 ]);
-var LiveServerMessageSchema = z8.discriminatedUnion("type", [
+var LiveServerMessageSchema = z10.discriminatedUnion("type", [
   /** the answer to `hello`: who this connection is, and who else is in the room */
-  z8.object({ type: z8.literal("welcome"), you: LivePeerSchema, peers: z8.array(LivePeerSchema) }),
-  z8.object({ type: z8.literal("join"), peer: LivePeerSchema }),
-  z8.object({ type: z8.literal("leave"), peerId: z8.string() }),
-  z8.object({
-    type: z8.literal("cursor"),
-    peerId: z8.string(),
+  z10.object({ type: z10.literal("welcome"), you: LivePeerSchema, peers: z10.array(LivePeerSchema) }),
+  z10.object({ type: z10.literal("join"), peer: LivePeerSchema }),
+  z10.object({ type: z10.literal("leave"), peerId: z10.string() }),
+  z10.object({
+    type: z10.literal("cursor"),
+    peerId: z10.string(),
     path: path2,
     hash: hash2,
     anchor: CommentAnchorSchema.nullable()
   }),
   /** the site's comments changed: refetch them */
-  z8.object({ type: z8.literal("comments") }),
-  z8.object({ type: z8.literal("pong") })
+  z10.object({ type: z10.literal("comments") }),
+  z10.object({ type: z10.literal("pong") })
 ]);
 
+// src/cli.ts
+import chalk11 from "chalk";
+import { Command, Option } from "commander";
+
+// src/commands/auth.ts
+import chalk5 from "chalk";
+
+// src/auth.ts
+import { randomBytes } from "node:crypto";
+import { createServer } from "node:http";
+import { hostname as osHostname } from "node:os";
+
 // src/errors.ts
 var EXIT_ERROR = 1;
 var EXIT_NOT_LOGGED_IN = 2;
@@ -1097,7 +1360,7 @@ function exitCodeFor(error) {
 // package.json
 var package_default = {
   name: "@nearform/fling",
-  version: "0.5.1",
+  version: "0.6.0",
   license: "MIT",
   description: "Fling a folder of static files at a Fling server and get a link back. CLI + MCP server.",
   type: "module",
@@ -1308,7 +1571,7 @@ function describeCause(cause) {
 import { chmod, mkdir, readFile, stat, writeFile } from "node:fs/promises";
 import { homedir } from "node:os";
 import { join } from "node:path";
-import { z as z9 } from "zod";
+import { z as z11 } from "zod";
 var CONFIG_DIR_NAME = ".fling";
 var CONFIG_FILE_NAME = "config.json";
 var ENV = {
@@ -1321,14 +1584,14 @@ var ENV = {
   /** A server the local MCP server adds to the remembered ones on start (the .mcpb bakes it in). */
   addServer: "FLING_ADD_SERVER"
 };
-var serverEntrySchema = z9.object({
+var serverEntrySchema = z11.object({
   /** What the server said about itself at login. A copy this CLI can't read is just refetched. */
   instance: InstanceMetadataSchema.optional().catch(void 0),
-  apiKey: z9.string().min(1).optional().catch(void 0),
-  user: z9.object({
-    email: z9.string().optional(),
-    name: z9.string().optional(),
-    userSlug: z9.string().optional()
+  apiKey: z11.string().min(1).optional().catch(void 0),
+  user: z11.object({
+    email: z11.string().optional(),
+    name: z11.string().optional(),
+    userSlug: z11.string().optional()
   }).optional().catch(void 0)
 });
 function systemLocateOptions(env = process.env) {
@@ -1946,8 +2209,8 @@ function requireClient(ctx) {
 }
 
 // src/sites.ts
-import { z as z10 } from "zod";
-var ShareResponseSchema2 = z10.looseObject({ shareUrl: z10.string() });
+import { z as z12 } from "zod";
+var ShareResponseSchema2 = z12.looseObject({ shareUrl: z12.string() });
 var sitePath2 = (name) => `/api/sites/${encodeURIComponent(name)}`;
 function whoami(client) {
   return client.request("GET", "/api/me", { schema: MeSchema });
@@ -1971,7 +2234,11 @@ async function listSites(client, opts = {}) {
     schema: SiteListSchema,
     query: { archived: opts.archived ? 1 : void 0 }
   });
-  return res.sites;
+  return sortSites(res.sites, opts.sort);
+}
+async function listShared(client, opts = {}) {
+  const res = await client.request("GET", "/api/shared", { schema: SharedSiteListSchema });
+  return sortSites(res.sites, opts.sort);
 }
 function getSite(client, name) {
   return client.request("GET", sitePath2(name), { schema: SiteDetailSchema });
@@ -2002,6 +2269,74 @@ async function setVisibility(client, name, visibility) {
   const raw = await client.request("PATCH", sitePath2(name), { body: { visibility } });
   return siteAfter(client, name, raw);
 }
+async function getAudience(client, name) {
+  const site = await getSite(client, name);
+  if (!site.audience) throw noAudiences();
+  return site;
+}
+var noAudiences = () => new CliError("This Fling does not support limiting a site to listed people", {
+  hint: "Ask its operator to update it."
+});
+async function setAudience(client, name, change) {
+  const current = await getAudience(client, name);
+  const audience = current.audience;
+  const site = await client.request("PATCH", sitePath2(name), {
+    schema: SiteWithAudienceSchema,
+    body: { audience: editAudienceInput(audience, change) }
+  });
+  if (!site.audience) throw noAudiences();
+  return site;
+}
+function audienceWarnings(site) {
+  const n = site.audience ? site.audience.emails.length + site.audience.groups.length : site.audienceSize;
+  if (site.visibility === "public" && n > 0) {
+    return [
+      `${site.name} is public, so its audience doesn't apply yet; it does once the site is private: fling visibility ${site.name} private`
+    ];
+  }
+  if (site.restricted && site.shareUrl) {
+    return [`${site.name} has a share link: anyone with it can still open the site`];
+  }
+  return [];
+}
+function audiencesEnabled(instance) {
+  if (!instance) return false;
+  return instance.capabilities.audiences ?? true;
+}
+var groupPath = (slug) => `/api/groups/${encodeURIComponent(slug)}`;
+async function listGroups(client, opts = {}) {
+  const res = await client.request("GET", "/api/groups", {
+    schema: GroupListSchema,
+    query: {
+      mine: opts.mine ? 1 : void 0,
+      members: opts.members ? splitEmails(opts.members).join(",") : void 0
+    }
+  });
+  return res.groups;
+}
+function getGroup(client, slug) {
+  return client.request("GET", groupPath(slug), { schema: GroupDetailSchema });
+}
+function createGroup(client, input) {
+  return client.request("POST", "/api/groups", { schema: GroupDetailSchema, body: input });
+}
+function changeGroupMembers(client, slug, change) {
+  return client.request("POST", `${groupPath(slug)}/members`, {
+    schema: GroupDetailSchema,
+    body: change
+  });
+}
+function renameGroup(client, slug, name) {
+  return client.request("PATCH", groupPath(slug), { schema: GroupDetailSchema, body: { name } });
+}
+async function deleteGroup(client, slug) {
+  await client.request("DELETE", groupPath(slug));
+  return { slug, deleted: true };
+}
+function groupsEnabled(instance) {
+  if (!instance) return false;
+  return instance.capabilities.groups ?? true;
+}
 async function archiveSite(client, name, opts = {}) {
   const raw = await client.request(
     "POST",
@@ -3121,7 +3456,7 @@ async function deployPrepared(ctx, client, instance, base, prepared, opts, ask)
     local.files.map((f) => f.path),
     { progress: ctx.progress, warn: (m) => ctx.log.warn(m) }
   )).ready;
-  const who = instance ? `only ${privateAudience(instance)} can open it` : "sign-in required";
+  const who = instance ? `${privateAudience(instance)} can open it` : "sign-in required";
   const privateNote = `Private: ${who}. Share publicly with \`${ctx.binName} share ${result.name}\`.`;
   const review = instance && commentsEnabled(instance) ? reviewUrl(instance.appOrigin, result.name) : void 0;
   const reviewNote = instance ? `Share for feedback (reviewers sign in to ${instance.name}):` : "Share for feedback:";
@@ -3204,9 +3539,76 @@ async function confirmSiteName(ctx, client, generated, base) {
   }
 }
 
+// src/commands/groups.ts
+import chalk8 from "chalk";
+function requireGroups(ctx) {
+  const instance = ctx.config.instance;
+  if (instance && !groupsEnabled(instance)) throw new CliError(`${instance.name} has no groups`);
+  return requireClient(ctx);
+}
+async function runGroups(ctx, opts) {
+  const client = requireGroups(ctx);
+  const members2 = opts.members ? splitEmails(opts.members) : void 0;
+  if (members2 && members2.length === 0) throw new CliError("Name at least one address");
+  const [groups2, me] = await Promise.all([
+    listGroups(client, { mine: opts.mine, members: members2 }),
+    whoami(client)
+  ]);
+  ctx.out.data(
+    { groups: groups2 },
+    () => groups2.length ? renderTable(groups2, [
+      { header: "SLUG", value: (g) => g.slug },
+      { header: "NAME", value: (g) => g.name },
+      { header: "PEOPLE", value: (g) => g.size },
+      { header: "OWNER", value: (g) => g.owner === me.email ? "you" : g.owner }
+    ]) : chalk8.dim(members2 ? "No group has exactly those people." : describeGroups([]))
+  );
+}
+async function runGroupShow(ctx, slug) {
+  const group = await getGroup(requireGroups(ctx), slug);
+  ctx.out.data(group, () => describeGroup(group));
+}
+async function runGroupCreate(ctx, slug, opts) {
+  const group = await createGroup(requireGroups(ctx), {
+    slug,
+    name: opts.name ?? slug,
+    members: splitEmails(opts.add ?? [])
+  });
+  ctx.log.success(`Group ${group.slug} created`);
+  ctx.out.data(group, () => describeGroup(group));
+}
+async function runGroupMembers(ctx, slug, emails2, how) {
+  const list = splitEmails(emails2);
+  if (list.length === 0) throw new CliError("Name at least one address");
+  const group = await changeGroupMembers(requireGroups(ctx), slug, { [how]: list });
+  ctx.out.data(group, () => describeGroup(group));
+}
+async function runGroupRename(ctx, slug, name) {
+  const group = await renameGroup(requireGroups(ctx), slug, name);
+  ctx.log.success(`Group ${group.slug} is now called ${group.name}`);
+  ctx.out.data(group, () => describeGroup(group));
+}
+async function runGroupDelete(ctx, slug, opts) {
+  const client = requireGroups(ctx);
+  if (!opts.yes) {
+    if (!ctx.interactive) {
+      throw new CliError(`Refusing to delete group ${slug} without confirmation`, {
+        hint: "Pass --yes to delete."
+      });
+    }
+    const ok = await ctx.confirm(
+      `Delete group ${slug}? Sites whose audience names it keep their restriction, and anyone it let in loses access. This cannot be undone.`
+    );
+    if (!ok) throw new CliError("Cancelled");
+  }
+  const result = await deleteGroup(client, slug);
+  ctx.log.success(`Group ${slug} deleted`);
+  if (ctx.json) ctx.out.data(result, () => "");
+}
+
 // src/commands/setup.ts
 import { intro, outro, spinner } from "@clack/prompts";
-import chalk8 from "chalk";
+import chalk9 from "chalk";
 
 // src/claude.ts
 import { execFile as execFile2 } from "node:child_process";
@@ -3299,14 +3701,14 @@ async function runSetup(baseCtx, opts, deps = {}) {
     ...baseCtx,
     log: createLogger({
       debug: baseCtx.config.debug,
-      write: (line) => process.stderr.write(`${chalk8.gray("\u2502")}  ${line}
+      write: (line) => process.stderr.write(`${chalk9.gray("\u2502")}  ${line}
 `)
     })
   } : baseCtx;
   if (fancy) {
     process.stderr.write(`${logo()}
 `);
-    intro(chalk8.bold(" fling setup "), { output: process.stderr });
+    intro(chalk9.bold(" fling setup "), { output: process.stderr });
   }
   const login = await stepLogin(ctx, opts.url);
   const results = {
@@ -3320,7 +3722,7 @@ async function runSetup(baseCtx, opts, deps = {}) {
   const failed = Object.values(results).includes("failed");
   if (fancy)
     outro(
-      failed ? chalk8.yellow("Setup finished with problems \u2014 see above, then run `fling setup` again.") : `You're set. Try ${chalk8.bold(`${ctx.binName} deploy ./dist`)}, or ask Claude to \u201Cfling this\u201D.`,
+      failed ? chalk9.yellow("Setup finished with problems \u2014 see above, then run `fling setup` again.") : `You're set. Try ${chalk9.bold(`${ctx.binName} deploy ./dist`)}, or ask Claude to \u201Cfling this\u201D.`,
       { output: process.stderr }
     );
   ctx.out.data(results, () => "");
@@ -3343,7 +3745,7 @@ async function signIn(ctx, serverUrl) {
     try {
       const me = await whoami(requireClient(ctx));
       if (ctx.config.remembered) await ctx.store.setCurrent(serverUrl);
-      ctx.log.success(`Signed in as ${chalk8.bold(me.name)} ${chalk8.dim(`<${me.email}>`)}`);
+      ctx.log.success(`Signed in as ${chalk9.bold(me.name)} ${chalk9.dim(`<${me.email}>`)}`);
       return "already";
     } catch (error) {
       if (exitCodeFor(error) !== 2) {
@@ -3364,7 +3766,7 @@ async function signIn(ctx, serverUrl) {
 async function stepClaudeCode(ctx, run, scope, ask, fancy) {
   const status = await claudeCodeStatus(run);
   if (status.claude === "missing") {
-    ctx.log.info(`Claude Code not found ${chalk8.dim("(no `claude` on your PATH) \u2014 skipped")}`);
+    ctx.log.info(`Claude Code not found ${chalk9.dim("(no `claude` on your PATH) \u2014 skipped")}`);
     ctx.log.hint(
       `Once it is installed, run \`${ctx.binName} setup\` again, or in Claude Code: /plugin marketplace add ${MARKETPLACE_SOURCE} then /plugin install ${PLUGIN_ID}`
     );
@@ -3373,7 +3775,7 @@ async function stepClaudeCode(ctx, run, scope, ask, fancy) {
   const installed = "installed" in status && status.installed;
   const question = installed ? `The Fling plugin is installed in Claude Code${status.version ? ` (${status.version})` : ""}. Update it to the latest?` : "Install the Fling plugin (skill + MCP server) into Claude Code?";
   if (ask && !await ctx.confirm(question)) {
-    ctx.log.info(chalk8.dim("Claude Code plugin: skipped"));
+    ctx.log.info(chalk9.dim("Claude Code plugin: skipped"));
     return installed ? "already" : "skipped";
   }
   const s = fancy ? spinner({ output: process.stderr }) : null;
@@ -3387,7 +3789,7 @@ async function stepClaudeCode(ctx, run, scope, ask, fancy) {
     else ctx.log.error(message);
     return "failed";
   }
-  const done = installed ? `Claude Code plugin ${PLUGIN_NAME} is up to date` : `Claude Code plugin ${PLUGIN_NAME} installed ${chalk8.dim(`(${scope} scope)`)}`;
+  const done = installed ? `Claude Code plugin ${PLUGIN_NAME} is up to date` : `Claude Code plugin ${PLUGIN_NAME} installed ${chalk9.dim(`(${scope} scope)`)}`;
   if (s) s.stop(done);
   else ctx.log.success(done);
   ctx.log.hint("Restart Claude Code (or run /reload-plugins) to pick it up.");
@@ -3397,7 +3799,7 @@ async function stepClaudeDesktop(ctx, deps, ask, fancy) {
   const app = await (deps.findClaudeDesktop ?? findClaudeDesktop)();
   if (!app) return "missing";
   if (ask && !await ctx.confirm("Add the Fling extension to Claude Desktop too?")) {
-    ctx.log.info(chalk8.dim("Claude Desktop extension: skipped"));
+    ctx.log.info(chalk9.dim("Claude Desktop extension: skipped"));
     return "skipped";
   }
   const s = fancy ? spinner({ output: process.stderr }) : null;
@@ -3418,7 +3820,7 @@ async function stepClaudeDesktop(ctx, deps, ask, fancy) {
 }
 
 // src/commands/sites.ts
-import chalk9 from "chalk";
+import chalk10 from "chalk";
 async function runList(ctx, opts) {
   const sites = await listSites(requireClient(ctx), opts);
   ctx.out.data(
@@ -3435,12 +3837,29 @@ async function runList(ctx, opts) {
     ])
   );
 }
+async function runListShared(ctx, opts) {
+  const instance = ctx.config.instance;
+  if (instance && !audiencesEnabled(instance)) {
+    throw new CliError(`${instance.name} can't limit a site to listed people, so nothing is shared`);
+  }
+  const sites = await listShared(requireClient(ctx), opts);
+  ctx.out.data(
+    { sites },
+    () => renderTable(sites, [
+      { header: "NAME", value: (s) => s.name },
+      { header: "URL", value: (s) => s.url },
+      { header: "OWNER", value: (s) => s.owner },
+      { header: "VIA", value: (s) => sharedVia(s) },
+      { header: "UPDATED", value: (s) => formatDate(s.updatedAt) }
+    ])
+  );
+}
 function describeSite(site) {
-  const row = (label, value) => `${chalk9.bold(`${label}:`.padEnd(12))}${value}`;
+  const row = (label, value) => `${chalk10.bold(`${label}:`.padEnd(12))}${value}`;
   return [
     row("Name", site.name),
     row("URL", site.url),
-    row("Visibility", site.visibility + (site.archived ? chalk9.yellow(" (archived)") : "")),
+    row("Visibility", site.visibility + (site.archived ? chalk10.yellow(" (archived)") : "")),
     row("SPA", site.spa ? "yes" : "no"),
     row("Share link", site.shareUrl ?? "-"),
     row("Version", site.currentVersionId ?? "-"),
@@ -3455,14 +3874,17 @@ function filesRow(site, row) {
   const n = current.fileCount;
   return [row("Files", `${n} file${n === 1 ? "" : "s"}, ${formatBytes(current.totalBytes)}`)];
 }
+var membersOf = (ctx) => ctx.config.instance ? privateAudience(ctx.config.instance) : "anyone signed in to this Fling";
 async function runInfo(ctx, name) {
   const site = await getSite(requireClient(ctx), name);
+  const access2 = site.audience && audiencesEnabled(ctx.config.instance) ? [`${chalk10.bold("Access:".padEnd(12))}${describeAudience(site, membersOf(ctx))}`] : [];
   ctx.out.data(
     site,
     () => [
       ...describeSite(site),
+      ...access2,
       "",
-      chalk9.dim(
+      chalk10.dim(
         `${site.versions.length} version(s) \u2014 \`fling versions ${name}\`; files \u2014 \`fling files ${name}\``
       )
     ].join("\n")
@@ -3488,7 +3910,7 @@ async function runFiles(ctx, name, versionId) {
   }
   ctx.out.data(result, () => {
     const n = result.files.length;
-    const header = chalk9.dim(
+    const header = chalk10.dim(
       `${result.versionId}${result.current ? " (current)" : " (not served)"} \u2014 ${n} file${n === 1 ? "" : "s"}, ${formatBytes(result.totalBytes)}${result.generatedIndex ? ", generated index.html" : ""}`
     );
     const table = renderTable(result.files, [
@@ -3524,7 +3946,7 @@ async function runShare(ctx, name, opts) {
     ctx.log.success("Share link created \u2014 anyone with it can view the site");
   ctx.out.data(
     ready === void 0 ? result : { ...result, ready },
-    () => result.shareUrl ? result.shareUrl : chalk9.dim("(no share link)")
+    () => result.shareUrl ? result.shareUrl : chalk10.dim("(no share link)")
   );
 }
 async function runVisibility(ctx, name, visibility) {
@@ -3537,6 +3959,27 @@ async function runVisibility(ctx, name, visibility) {
   );
   ctx.out.data(site, () => site.url);
 }
+async function runAccess(ctx, name, opts) {
+  const instance = ctx.config.instance;
+  if (instance && !audiencesEnabled(instance)) {
+    throw new CliError(`${instance.name} can't limit a site to listed people`);
+  }
+  const change = {
+    add: splitEmails(opts.add ?? []),
+    remove: splitEmails(opts.remove ?? []),
+    addGroups: splitGroups(opts.group ?? []),
+    removeGroups: splitGroups(opts.removeGroup ?? []),
+    clear: opts.clear
+  };
+  if (instance && (change.addGroups.length || change.removeGroups.length)) {
+    if (!groupsEnabled(instance)) throw new CliError(`${instance.name} has no groups`);
+  }
+  const client = requireClient(ctx);
+  const site = changesAudience(change) ? await setAudience(client, name, change) : await getAudience(client, name);
+  const warnings = audienceWarnings(site);
+  for (const w of warnings) ctx.log.warn(w);
+  ctx.out.data({ ...site, warnings }, () => describeAudience(site, membersOf(ctx)));
+}
 async function runArchive(ctx, name, unarchive = false) {
   const site = await archiveSite(requireClient(ctx), name, { unarchive });
   ctx.log.success(
@@ -3566,7 +4009,7 @@ import { tmpdir as tmpdir3 } from "node:os";
 import { basename as basename3, dirname as dirname2, join as join6 } from "node:path";
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
-import { z as z11 } from "zod";
+import { z as z13 } from "zod";
 
 // src/locate.ts
 import { lstat, readdir as readdir2, readFile as readFile6, realpath as realpath3, stat as stat5 } from "node:fs/promises";
@@ -3988,7 +4431,7 @@ var mcpLocalInstructions = (w, opts = {}) => [
   "When there is no index.html but there are HTML pages, fling_deploy and fling_publish do not publish: ask the user whether to generate an index page listing the pages (`listHtml: true`) or publish without one (`listHtml: false`, the root URL 404s), then retry.",
   NEVER_PUBLISHED,
   "Not logged in? Call fling_login, let the user finish signing in in the browser, then retry.",
-  `Sites are private (only ${w.privateAudience}) by default; only make one public if asked. Use fling_share for a link people who cannot sign in can open. ${opts.comments ? "Always give the user the links that come back: the review link first, as the one to share for feedback, then the site URL." : "Always give the user the URL that comes back."}`,
+  `Sites are private (open to ${w.privateAudience}) by default; only make one public if asked. Use fling_share for a link people who cannot sign in can open. ${opts.comments ? "Always give the user the links that come back: the review link first, as the one to share for feedback, then the site URL." : "Always give the user the URL that comes back."}`,
   ...opts.comments ? [COMMENTS_NOTE(w)] : []
 ].join("\n\n");
 var onFling = (url, instance) => `
@@ -4003,7 +4446,7 @@ function createMcpServer(deps = {}) {
   const several = servers.length > 1;
   const wording = mcpWording(several ? null : servers[0]?.instance);
   const mcpTools2 = mcpToolsFor(wording);
-  const serverArg = z11.string().min(1).max(500).optional().describe(serverArgDescription(servers));
+  const serverArg = z13.string().min(1).max(500).optional().describe(serverArgDescription(servers));
   const note = serverToolNote(servers);
   const serverTool = (def, description = def.description) => ({
     title: def.title,
@@ -4140,12 +4583,12 @@ To check exactly which files the site has, call fling_files with name "${result.
     "fling_deploy",
     {
       title: "Deploy a file or folder from this computer",
-      description: `Fling something that is on the user's computer and return its stable URL (${wording.sitesPattern}): a folder of static files (e.g. a build output like dist/), a single .html file (served as the site's index.html), a .zip of a site (extracted; a single top-level folder is unwrapped), or any other single file (.pdf, .svg, .png\u2026, served next to a generated page that shows it). \`path\` can be absolute, relative to the working directory, or just a file name ("Pitch Deck.html"): names are looked up, newest first, in Downloads, Desktop, Documents/Claude and Claude Desktop output folders, and the result says where the file was found. Never pass paths from your own sandbox (/mnt/user-data/\u2026, /sessions/\u2026): for content you created, use fling_publish. Without \`name\`, a name is generated: from the file name for files ("Pitch Deck (1).html" \u2192 pitch-deck), from the project and folder for folders (~/work/rocketpod/docs \u2192 rocketpod-docs). Site names are one global namespace, first come first served \u2014 confirm the name with the user first (fling_check_name with \`path\` shows the generated one). If the name is taken it fails with free suggestions \u2014 ask the user to pick one, then retry with \`name\`. If there is no index.html but there are HTML pages, it does not deploy: ask the user whether to generate an index page listing them (\`listHtml: true\`) or deploy without one (\`listHtml: false\`), then retry. Re-deploying identical content is a no-op. Sites are private (only ${wording.privateAudience}) unless \`public\` is set. ${NEVER_PUBLISHED}${note}`,
+      description: `Fling something that is on the user's computer and return its stable URL (${wording.sitesPattern}): a folder of static files (e.g. a build output like dist/), a single .html file (served as the site's index.html), a .zip of a site (extracted; a single top-level folder is unwrapped), or any other single file (.pdf, .svg, .png\u2026, served next to a generated page that shows it). \`path\` can be absolute, relative to the working directory, or just a file name ("Pitch Deck.html"): names are looked up, newest first, in Downloads, Desktop, Documents/Claude and Claude Desktop output folders, and the result says where the file was found. Never pass paths from your own sandbox (/mnt/user-data/\u2026, /sessions/\u2026): for content you created, use fling_publish. Without \`name\`, a name is generated: from the file name for files ("Pitch Deck (1).html" \u2192 pitch-deck), from the project and folder for folders (~/work/rocketpod/docs \u2192 rocketpod-docs). Site names are one global namespace, first come first served \u2014 confirm the name with the user first (fling_check_name with \`path\` shows the generated one). If the name is taken it fails with free suggestions \u2014 ask the user to pick one, then retry with \`name\`. If there is no index.html but there are HTML pages, it does not deploy: ask the user whether to generate an index page listing them (\`listHtml: true\`) or deploy without one (\`listHtml: false\`), then retry. Re-deploying identical content is a no-op. Sites are private (open to ${wording.privateAudience}) unless \`public\` is set. ${NEVER_PUBLISHED}${note}`,
       inputSchema: {
-        path: z11.string().min(1).describe(
+        path: z13.string().min(1).describe(
           "File or folder on this computer: absolute, relative to the working directory, or just its name (looked up in Downloads, Desktop and Claude output folders)"
         ),
-        name: z11.string().optional().describe(
+        name: z13.string().optional().describe(
           "Site name (lowercase letters, digits, single hyphens; max 50). Defaults to a name generated from the file or folder"
         ),
         spa: spa2,
@@ -4195,9 +4638,9 @@ To check exactly which files the site has, call fling_files with name "${result.
       title: "Find files to fling",
       description: "List recent things on this computer that could be flung, newest first: .html/.htm and .zip files, and folders containing an index.html, from the working directory, Downloads, Desktop, Documents/Claude, ~/Claude and Claude Desktop output folders. Each has its path, where it was found, size and modified time. Use it when the user refers to a file they downloaded or that Claude Desktop saved, then pass the chosen path (or name) to fling_deploy.",
       inputSchema: {
-        query: z11.string().optional().describe('Only names containing this text (case-insensitive), e.g. "deck"'),
-        limit: z11.number().int().min(1).max(100).optional().describe("Max results (default 20)"),
-        days: z11.number().int().min(1).max(3650).optional().describe("Only things modified in the last N days (default 14)")
+        query: z13.string().optional().describe('Only names containing this text (case-insensitive), e.g. "deck"'),
+        limit: z13.number().int().min(1).max(100).optional().describe("Max results (default 20)"),
+        days: z13.number().int().min(1).max(3650).optional().describe("Only things modified in the last N days (default 14)")
       },
       annotations: { readOnlyHint: true, openWorldHint: false }
     },
@@ -4258,8 +4701,8 @@ ${JSON.stringify(data, null, 2)}`);
       ...serverTool(mcpTools2.checkName),
       description: `${mcpTools2.checkName.description} Pass \`path\` instead of \`name\` to see the name fling_deploy would generate for a file or folder on this computer (same lookup as fling_deploy), so you can confirm it with the user.${note}`,
       inputSchema: {
-        name: z11.string().min(1).max(200).optional().describe("Site name to check"),
-        path: z11.string().optional().describe("File or folder whose generated default name to check (path or file name)"),
+        name: z13.string().min(1).max(200).optional().describe("Site name to check"),
+        path: z13.string().optional().describe("File or folder whose generated default name to check (path or file name)"),
         server: serverArg
       }
     },
@@ -4300,7 +4743,7 @@ ${JSON.stringify(data, null, 2)}`);
       title: "Sign in to Fling",
       description: `Sign the user in to ${several ? "a Fling" : wording.name}: opens their browser to sign in with ${wording.signIn} and stores the key on this computer (shared with the fling CLI). Waits up to ~30 seconds; if sign-in is not finished by then, it keeps waiting in the background for up to 5 minutes \u2014 tell the user to finish signing in in the browser, then retry what you were doing. Call it when another tool says the user is not logged in. Pass \`server\` (its address) to sign in to another Fling, including one not set up on this computer yet: it is remembered, and becomes the current one only when none is.` + note,
       inputSchema: {
-        server: z11.string().min(1).max(500).optional().describe(
+        server: z13.string().min(1).max(500).optional().describe(
           `The Fling to sign in to: its address (e.g. "https://fling.example.com"), or the host of one set up on this computer. ${several ? `Required while several Flings are set up (${servers.map((s) => serverLabel(s.url)).join(", ")})` : `Omit it to use ${servers[0] ? serverLabel(servers[0].url) : "the one this computer knows"}`}`
         )
       },
@@ -4384,7 +4827,7 @@ ${known.join("\n")}` : ""
       title: "List the Flings on this computer",
       description: `List the Flings set up on this computer, read now: each one's address, name, who is signed in (or "signed out") and which is current, the user's usual one. Call it when unsure which Fling the user means or which exist; the list may have changed since this conversation started. Pass \`use\` to make one the current Fling, the same as running \`${NPX_COMMAND} use <server>\`: it changes the default of the fling CLI too, so only do it when the user asks. It does not replace passing \`server\` to the other tools while several Flings are set up.`,
       inputSchema: {
-        use: z11.string().min(1).max(500).optional().describe(
+        use: z13.string().min(1).max(500).optional().describe(
           "Make this Fling current (address, host or unique part of it), like `fling use`"
         )
       },
@@ -4428,17 +4871,39 @@ ${JSON.stringify(data, null, 2)}`);
   server.registerTool(
     t.list.name,
     serverTool(t.list),
-    (args) => run(t.list.name, args.server, async ({ client, url }) => {
-      const sites = await listSites(client, { archived: args.archived });
+    (args) => run(t.list.name, args.server, async (target2) => {
+      const { client, url } = target2;
+      if (args.shared) {
+        const instance = await target2.instance();
+        if (instance && !audiencesEnabled(instance)) {
+          throw new CliError(
+            `${instance.name} (${serverLabel(url)}) can't limit a site to listed people, so nothing is shared`
+          );
+        }
+        const sites2 = await listShared(client, { sort: args.sort });
+        const lines = sites2.map(describeSharedSite).join("\n");
+        return {
+          summary: `${sites2.length} site(s) shared with you on ${serverLabel(url)}${lines ? `:
+${lines}` : ""}`,
+          data: { sites: sites2 }
+        };
+      }
+      const sites = await listSites(client, { archived: args.archived, sort: args.sort });
       return { summary: `${sites.length} site(s) on ${serverLabel(url)}`, data: { sites } };
     })
   );
+  const membersOn = async (target2) => {
+    const instance = await target2.instance();
+    return instance ? privateAudience(instance) : "anyone signed in to this Fling";
+  };
   server.registerTool(
     t.info.name,
     serverTool(t.info),
-    (args) => run(t.info.name, args.server, async ({ client }) => {
-      const site = await getSite(client, args.name);
-      return { summary: `${site.name}: ${site.url}`, data: site };
+    (args) => run(t.info.name, args.server, async (target2) => {
+      const site = await getSite(target2.client, args.name);
+      const access2 = site.audience ? `
+${describeAudience(site, await membersOn(target2))}` : "";
+      return { summary: `${site.name}: ${site.url}${access2}`, data: site };
     })
   );
   server.registerTool(
@@ -4482,6 +4947,126 @@ ${JSON.stringify(data, null, 2)}`);
       return { summary: `${site.name} is now ${site.visibility}: ${site.url}`, data: site };
     })
   );
+  if (servers.some((s) => audiencesEnabled(s.instance))) {
+    server.registerTool(
+      t.setAudience.name,
+      serverTool(t.setAudience),
+      (args) => run(t.setAudience.name, args.server, async (target2) => {
+        const instance = await target2.instance();
+        if (instance && !audiencesEnabled(instance)) {
+          throw new CliError(
+            `${instance.name} (${serverLabel(target2.url)}) can't limit a site to listed people`
+          );
+        }
+        const change = {
+          add: args.add,
+          remove: args.remove,
+          set: args.set,
+          addGroups: args.addGroups,
+          removeGroups: args.removeGroups,
+          setGroups: args.setGroups,
+          clear: args.clear
+        };
+        if (!changesAudience(change)) {
+          throw new CliError(
+            "Pass `add`, `remove`, `set`, `addGroups`, `removeGroups`, `setGroups` or `clear`"
+          );
+        }
+        const site = await setAudience(target2.client, args.name, change);
+        return {
+          summary: `${site.name}: ${describeAudience(site, await membersOn(target2))}${onFling(target2.url, instance)}`,
+          data: site
+        };
+      })
+    );
+  }
+  if (servers.some((s) => groupsEnabled(s.instance))) {
+    const withGroups = async (target2) => {
+      const instance = await target2.instance();
+      if (instance && !groupsEnabled(instance)) {
+        throw new CliError(`${instance.name} (${serverLabel(target2.url)}) has no groups`);
+      }
+      return instance;
+    };
+    server.registerTool(
+      t.groups.name,
+      serverTool(t.groups),
+      (args) => run(t.groups.name, args.server, async (target2) => {
+        const instance = await withGroups(target2);
+        const [groups2, me] = await Promise.all([
+          listGroups(target2.client, { mine: args.mine, members: args.members }),
+          whoami(target2.client)
+        ]);
+        const which = args.members ? " of exactly those people" : "";
+        return {
+          summary: args.members && groups2.length === 0 ? `No group has exactly those people${onFling(target2.url, instance)}` : `${groups2.length} ${args.mine ? "of your " : ""}group(s)${which}${onFling(target2.url, instance)}
+${describeGroups(groups2, me.email)}`,
+          data: { groups: groups2 }
+        };
+      })
+    );
+    server.registerTool(
+      t.groupShow.name,
+      serverTool(t.groupShow),
+      (args) => run(t.groupShow.name, args.server, async (target2) => {
+        await withGroups(target2);
+        const group = await getGroup(target2.client, args.slug);
+        return { summary: describeGroup(group), data: group };
+      })
+    );
+    server.registerTool(
+      t.groupCreate.name,
+      serverTool(t.groupCreate),
+      (args) => run(t.groupCreate.name, args.server, async (target2) => {
+        const instance = await withGroups(target2);
+        const group = await createGroup(target2.client, {
+          slug: args.slug,
+          name: args.name,
+          members: args.members
+        });
+        return {
+          summary: `Created ${describeGroup(group)}${onFling(target2.url, instance)}`,
+          data: group
+        };
+      })
+    );
+    server.registerTool(
+      t.groupMembers.name,
+      serverTool(t.groupMembers),
+      (args) => run(t.groupMembers.name, args.server, async (target2) => {
+        await withGroups(target2);
+        if (!args.add?.length && !args.remove?.length) {
+          throw new CliError("Pass `add` or `remove`");
+        }
+        const group = await changeGroupMembers(target2.client, args.slug, {
+          add: args.add,
+          remove: args.remove
+        });
+        return { summary: describeGroup(group), data: group };
+      })
+    );
+    server.registerTool(
+      t.groupRename.name,
+      serverTool(t.groupRename),
+      (args) => run(t.groupRename.name, args.server, async (target2) => {
+        await withGroups(target2);
+        const group = await renameGroup(target2.client, args.slug, args.name);
+        return { summary: describeGroup(group), data: group };
+      })
+    );
+    server.registerTool(
+      t.groupDelete.name,
+      serverTool(t.groupDelete),
+      (args) => run(t.groupDelete.name, args.server, async (target2) => {
+        await withGroups(target2);
+        const result = await deleteGroup(target2.client, args.slug);
+        return {
+          summary: `Group ${args.slug} deleted. Sites whose audience named it keep their restriction: anyone it let in has lost access`,
+          data: result
+        };
+      })
+    );
+  }
   server.registerTool(
     t.archive.name,
     serverTool(t.archive),
@@ -4711,18 +5296,18 @@ program.name(BIN_NAME).description("Fling a folder of static files at Fling and
   `server for this command: a URL, or the host of one you signed in to (default: $${ENV.url}, else the current one)`
 ).option("--json", "print JSON instead of human output", false).showHelpAfterError().configureHelp({
   sortSubcommands: false,
-  styleTitle: (title) => chalk10.bold(brand.primary(title)),
-  styleCommandText: (text2) => chalk10.bold(text2),
+  styleTitle: (title) => chalk11.bold(brand.primary(title)),
+  styleCommandText: (text2) => chalk11.bold(text2),
   styleSubcommandText: (text2) => brand.accent(text2),
   styleOptionText: (text2) => brand.accent(text2),
-  styleArgumentText: (text2) => chalk10.dim(text2)
+  styleArgumentText: (text2) => chalk11.dim(text2)
 }).addHelpText(
   "before",
   () => process.stdout.isTTY ? logo({ columns: process.stdout.columns }) : ""
 ).addHelpText(
   "after",
   () => `
-${chalk10.bold(brand.primary("Examples:"))}
+${chalk11.bold(brand.primary("Examples:"))}
   $ ${BIN_NAME} login https://fling.example.com  sign in to your Fling (once; there is no default)
   $ ${BIN_NAME} setup                      sign in and add Fling to Claude Code / Claude Desktop
   $ ${BIN_NAME} use                        list the Flings you signed in to; \`use <url>\` switches
@@ -4733,7 +5318,7 @@ ${chalk10.bold(brand.primary("Examples:"))}
   $ ${BIN_NAME} site.zip                   a zip of a site
   $ ${BIN_NAME} share my-app               public link for people who can't sign in
 
-${chalk10.dim(`Exit codes: 0 ok \xB7 1 error \xB7 2 not logged in \xB7 3 forbidden
+${chalk11.dim(`Exit codes: 0 ok \xB7 1 error \xB7 2 not logged in \xB7 3 forbidden
 Env:        ${ENV.apiKey} \xB7 ${ENV.url} \xB7 ${ENV.configDir} \xB7 ${ENV.debug}`)}`
 );
 function action(handler) {
@@ -4777,7 +5362,10 @@ program.command("deploy [path]").helpGroup("Deploy:").description(
 ).option(
   "-n, --name <name>",
   "site name \u2014 names are global, first come first served (default: generated from the project and folder, e.g. rocketpod-docs; you confirm it on a terminal)"
-).option("--spa", "single-page app: serve index.html for unknown paths").option("--public", "make the site public (default: sign-in required)").option(
+).option("--spa", "single-page app: serve index.html for unknown paths").option(
+  "--public",
+  "make the site public: anyone can open it, reviewing still needs sign-in (default: sign-in required)"
+).option(
   "-y, --yes",
   "never prompt: accept the generated name; without index.html, list the HTML pages (or fling anyway if there are none)"
 ).option("--list-html", "no index.html at the root: generate one listing the HTML pages").option("--no-list-html", "no index.html at the root: fling anyway (the root will 404)").action(
@@ -4808,7 +5396,18 @@ program.command("logout [url]").helpGroup("Setup:").description(
 ).action(action((ctx, url) => runLogout(ctx, url)));
 program.command("whoami").helpGroup("Setup:").description("show the signed-in user and the current server").action(action((ctx) => runWhoami(ctx)));
 program.commandsGroup("Setup:").helpCommand("help [command]", "show help for a command");
-program.command("ls").helpGroup("Sites:").alias("list").description("list your sites").option("--archived", "list archived sites").action(action((ctx, opts) => runList(ctx, opts)));
+program.command("ls").helpGroup("Sites:").alias("list").description("list your sites").option("--archived", "list archived sites").addOption(
+  new Option(
+    "--shared",
+    "list the sites others have shared with you instead of your own"
+  ).conflicts("archived")
+).addOption(
+  new Option("--sort <order>", "updated (newest first), created (newest first) or name (A\u2013Z)").choices(SITE_SORTS).default(DEFAULT_SITE_SORT)
+).action(
+  action(
+    (ctx, opts) => opts.shared ? runListShared(ctx, opts) : runList(ctx, opts)
+  )
+);
 program.command("info <name>").helpGroup("Sites:").description("show a site").action(action((ctx, name) => runInfo(ctx, name)));
 program.command("versions <name>").helpGroup("Sites:").description("list a site's versions (* = live)").action(action((ctx, name) => runVersions(ctx, name)));
 program.command("files <name> [versionId]").helpGroup("Sites:").description("list the files in a site's live version (or in versionId)").action(
@@ -4820,10 +5419,37 @@ program.command("share <name>").helpGroup("Sites:").description("print (or creat
     (ctx, name, opts) => runShare(ctx, name, opts)
   )
 );
-program.command("visibility <name> <visibility>").helpGroup("Sites:").description("private (sign-in required) or public (anyone)").action(action((ctx, name, visibility) => runVisibility(ctx, name, visibility)));
+program.command("visibility <name> <visibility>").helpGroup("Sites:").description(
+  "private (sign-in required) or public (anyone can open the site; reviewing it still needs sign-in)"
+).action(action((ctx, name, visibility) => runVisibility(ctx, name, visibility)));
+program.command("access <name>").helpGroup("Sites:").description("show who can open a private site, or limit it to listed people and groups").option("--add <emails...>", "let these addresses in (comma-separated or repeated)").option("--remove <emails...>", "take these addresses out").option("--group <slugs...>", "let these groups in (see `fling groups`)").option("--remove-group <slugs...>", "take these groups out").option("--clear", "empty the audience: everyone signed in can open it again").action(
+  action(
+    (ctx, name, opts) => runAccess(ctx, name, opts)
+  )
+);
 program.command("archive <name>").helpGroup("Sites:").description("take a site offline (404) but keep its files; undo with unarchive").action(action((ctx, name) => runArchive(ctx, name)));
 program.command("unarchive <name>").helpGroup("Sites:").description("bring an archived site back").action(action((ctx, name) => runArchive(ctx, name, true)));
 program.command("rm <name>").helpGroup("Sites:").alias("delete").description("delete a site and all its versions (asks first unless --yes)").option("-y, --yes", "do not ask for confirmation").action(action((ctx, name, opts) => runRemove(ctx, name, opts)));
+var groups = program.command("groups").helpGroup("Groups:").description(
+  "named lists of people anyone can use in an audience; only the owner changes one (default: list)"
+);
+groups.command("list", { isDefault: true }).alias("ls").description("list the groups on this Fling").option("--mine", "only the groups you own").option("--members <emails...>", "only the groups of exactly these people (a,b or a b)").action(action((ctx, opts) => runGroups(ctx, opts)));
+groups.command("create <slug>").description("create a group you own (slug: lowercase letters, digits and single hyphens)").option("--name <name>", "its display name (default: the slug)").option("--add <emails...>", "put these addresses in it").action(
+  action(
+    (ctx, slug, opts) => runGroupCreate(ctx, slug, opts)
+  )
+);
+groups.command("show <slug>").description("show a group and its members").action(action((ctx, slug) => runGroupShow(ctx, slug)));
+groups.command("add <slug> <emails...>").description("add people to a group you own").action(
+  action((ctx, slug, emails2) => runGroupMembers(ctx, slug, emails2, "add"))
+);
+groups.command("remove <slug> <emails...>").description("take people out of a group you own").action(
+  action((ctx, slug, emails2) => runGroupMembers(ctx, slug, emails2, "remove"))
+);
+groups.command("rename <slug> <name>").description("change the display name of a group you own").action(action((ctx, slug, name) => runGroupRename(ctx, slug, name)));
+groups.command("delete <slug>").alias("rm").description(
+  "delete a group you own; anyone it let into a site loses access (asks first unless --yes)"
+).option("-y, --yes", "do not ask for confirmation").action(action((ctx, slug, opts) => runGroupDelete(ctx, slug, opts)));
 program.command("comments <name>").helpGroup("Comments:").description("list a site's open comment threads (people leave them on its review page)").option("-p, --path <path>", "only this page, e.g. / or /docs/").option("-a, --all", "include resolved threads").action(
   action(
     (ctx, name, opts) => runComments(ctx, name, opts)