artifact-cafe 0.0.0 → 0.0.2

package/dist/index.js

@@ -0,0 +1,1013 @@
+#!/usr/bin/env node
+
+// src/index.ts
+import { defineCommand, runMain } from "citty";
+
+// src/comments.ts
+import path2 from "path";
+
+// ../shared/src/comments.ts
+import { z } from "zod";
+var elementSnapshotSchema = z.object({
+  classes: z.string().max(256).optional(),
+  id: z.string().max(256).optional(),
+  tag: z.string().min(1).max(128),
+  text: z.string().max(200).optional()
+});
+var pointAnchorSchema = z.object({
+  element: elementSnapshotSchema.optional(),
+  // elementPath is the primary anchor; x/y are offsets within the
+  // element's box, normalized 0..1 (SPEC.md §8.1).
+  elementPath: z.string().max(2048),
+  type: z.literal("point"),
+  viewportHeight: z.number().int().positive().max(1e5),
+  viewportWidth: z.number().int().positive().max(1e5),
+  x: z.number().min(0).max(1),
+  y: z.number().min(0).max(1)
+});
+var textAnchorSchema = z.object({
+  elementPath: z.string().max(2048),
+  endOffset: z.number().int().nonnegative().max(1e8),
+  prefix: z.string().max(200).optional(),
+  quote: z.string().min(1).max(1e3),
+  startOffset: z.number().int().nonnegative().max(1e8),
+  suffix: z.string().max(200).optional(),
+  type: z.literal("text")
+});
+var anchorSchema = z.discriminatedUnion("type", [
+  pointAnchorSchema,
+  textAnchorSchema
+]);
+var guestSchema = z.object({
+  displayName: z.string().min(1).max(64),
+  guestId: z.string().min(16)
+});
+var createCommentThreadSchema = z.object({
+  anchor: anchorSchema,
+  body: z.string().min(1).max(1e4),
+  guest: guestSchema.optional(),
+  versionId: z.string()
+});
+var createCommentMessageSchema = z.object({
+  body: z.string().min(1).max(1e4),
+  guest: guestSchema.optional()
+});
+var threadActionSchema = z.object({
+  guest: guestSchema.optional()
+});
+var commentAuthorSchema = z.object({
+  displayName: z.string(),
+  guestId: z.string().nullable()
+});
+var commentMessageSchema = z.object({
+  author: commentAuthorSchema,
+  body: z.string(),
+  createdAt: z.string(),
+  id: z.string()
+});
+var commentThreadSchema = z.object({
+  anchor: anchorSchema,
+  artifactId: z.string(),
+  createdAt: z.string(),
+  createdBy: commentAuthorSchema,
+  id: z.string(),
+  messages: z.array(commentMessageSchema),
+  status: z.enum(["open", "resolved"]),
+  versionId: z.string()
+});
+var commentThreadListSchema = z.object({
+  threads: z.array(commentThreadSchema)
+});
+var commentExportQuerySchema = z.object({
+  status: z.enum(["open", "resolved", "all"]).default("open"),
+  version: z.enum(["current", "all"]).default("current")
+});
+var commentExportReplySchema = z.object({
+  author: z.string(),
+  body: z.string(),
+  createdAt: z.string()
+});
+var commentExportThreadSchema = z.object({
+  anchor: anchorSchema,
+  author: z.string(),
+  body: z.string(),
+  createdAt: z.string(),
+  id: z.string(),
+  replies: z.array(commentExportReplySchema),
+  status: z.enum(["open", "resolved"]),
+  versionNumber: z.number().int().positive()
+});
+var commentExportSchema = z.object({
+  artifactId: z.string(),
+  comments: z.array(commentExportThreadSchema),
+  // The artifact's current version (null before the first finalize).
+  versionNumber: z.number().int().positive().nullable()
+});
+function elementLabel(el) {
+  if (el.id) {
+    return `<${el.tag}#${el.id}>`;
+  }
+  const classes = el.classes ? el.classes.split(" ").slice(0, 2) : [];
+  return classes.length ? `<${el.tag}.${classes.join(".")}>` : `<${el.tag}>`;
+}
+
+// ../shared/src/errors.ts
+import { z as z2 } from "zod";
+var apiErrorSchema = z2.object({
+  code: z2.string(),
+  docsUrl: z2.string().url(),
+  message: z2.string(),
+  retryAfter: z2.number().int().positive().optional()
+});
+
+// ../shared/src/owner.ts
+import { z as z3 } from "zod";
+var SLUG_PATTERN = /^[a-z0-9](?:[a-z0-9-]{1,61}[a-z0-9])$/;
+var claimResponseSchema = z3.object({
+  artifactId: z3.string(),
+  slug: z3.string(),
+  title: z3.string(),
+  url: z3.string().url()
+});
+var updateArtifactSchema = z3.object({
+  slug: z3.string().min(3).max(63).regex(SLUG_PATTERN, {
+    message: "slug must be lowercase letters, digits, and hyphens, with no leading/trailing hyphen"
+  }).optional(),
+  title: z3.string().min(1).max(200).optional()
+}).refine((body) => body.title !== void 0 || body.slug !== void 0, {
+  message: "provide at least one of title, slug"
+});
+var deleteArtifactResponseSchema = z3.object({
+  deleted: z3.literal(true)
+});
+
+// ../shared/src/protection.ts
+import { z as z4 } from "zod";
+var PASSWORD_MIN = 6;
+var PASSWORD_MAX = 128;
+var gatePasswordSchema = z4.string().min(PASSWORD_MIN, `Password must be at least ${PASSWORD_MIN} characters.`).max(PASSWORD_MAX, `Password must be at most ${PASSWORD_MAX} characters.`);
+var setProtectionSchema = z4.object({
+  password: gatePasswordSchema.nullable()
+});
+var protectionResponseSchema = z4.object({
+  protected: z4.boolean()
+});
+var unlockSchema = z4.object({
+  password: z4.string().min(1).max(1024)
+});
+var unlockResponseSchema = z4.object({
+  unlocked: z4.literal(true)
+});
+
+// ../shared/src/publish.ts
+import { z as z5 } from "zod";
+function isSafeArtifactPath(p) {
+  if (p.length === 0 || p.length > 1024) {
+    return false;
+  }
+  if (p.includes("\\") || p.includes("\0")) {
+    return false;
+  }
+  if (p.startsWith("/") || p.startsWith("~")) {
+    return false;
+  }
+  return p.split("/").every((seg) => seg.length > 0 && seg !== "." && seg !== "..");
+}
+var manifestFileSchema = z5.object({
+  hash: z5.string().regex(/^sha256_[a-f0-9]{64}$/),
+  mimeType: z5.string().regex(/^[-\w.+]+\/[-\w.+]+$/, { message: "invalid MIME type" }),
+  path: z5.string().min(1).max(1024).refine(isSafeArtifactPath, {
+    message: "path must be a safe relative path"
+  }),
+  size: z5.number().int().positive()
+});
+var publishSourceSchema = z5.object({
+  agent: z5.string().optional(),
+  runId: z5.string().optional(),
+  type: z5.literal("cli")
+});
+var createPublishSessionSchema = z5.object({
+  artifactId: z5.string().nullable(),
+  entryPath: z5.string().optional(),
+  files: z5.array(manifestFileSchema).min(1).max(1e3),
+  source: publishSourceSchema,
+  title: z5.string().max(200).optional()
+});
+var publishSessionResponseSchema = z5.object({
+  artifactId: z5.string(),
+  expiresAt: z5.string(),
+  filesToUpload: z5.array(
+    z5.object({
+      method: z5.literal("PUT"),
+      path: z5.string(),
+      uploadUrl: z5.string().url()
+    })
+  ),
+  publishSessionId: z5.string(),
+  skippedFiles: z5.array(z5.string()),
+  versionId: z5.string()
+});
+var finalizeResponseSchema = z5.object({
+  artifactId: z5.string(),
+  // Returned only on first publish of a new artifact (one-time).
+  claimUrl: z5.string().url().optional(),
+  publishToken: z5.string().optional(),
+  url: z5.string().url(),
+  versionId: z5.string(),
+  versionNumber: z5.number().int().positive()
+});
+var artifactResponseSchema = z5.object({
+  claimed: z5.boolean(),
+  currentVersion: z5.object({
+    entryUrl: z5.string().url(),
+    id: z5.string(),
+    versionNumber: z5.number().int().positive()
+  }).nullable(),
+  id: z5.string(),
+  slug: z5.string(),
+  title: z5.string()
+});
+
+// ../shared/src/report.ts
+import { z as z6 } from "zod";
+var reportRequestSchema = z6.object({
+  reason: z6.string().max(1e3).optional()
+});
+var reportResponseSchema = z6.object({
+  reported: z6.literal(true)
+});
+
+// ../shared/src/versions.ts
+import { z as z7 } from "zod";
+var versionSourceSchema = z7.object({
+  agentName: z7.string().nullable(),
+  type: z7.string()
+});
+var versionChangesSchema = z7.object({
+  added: z7.array(z7.string()),
+  changed: z7.array(z7.string()),
+  removed: z7.array(z7.string())
+});
+var versionSummarySchema = z7.object({
+  // Absent for the first version — there is no previous version to diff against.
+  changes: versionChangesSchema.nullable(),
+  createdAt: z7.string(),
+  entryUrl: z7.string().url(),
+  fileCount: z7.number().int().nonnegative(),
+  id: z7.string(),
+  isCurrent: z7.boolean(),
+  source: versionSourceSchema,
+  totalSizeBytes: z7.number().int().nonnegative(),
+  versionNumber: z7.number().int().positive()
+});
+var versionListResponseSchema = z7.object({
+  versions: z7.array(versionSummarySchema)
+});
+
+// src/api.ts
+var ApiRequestError = class extends Error {
+  constructor(status, code, message, retryAfter) {
+    super(message);
+    this.status = status;
+    this.code = code;
+    this.retryAfter = retryAfter;
+    this.name = "ApiRequestError";
+  }
+  status;
+  code;
+  retryAfter;
+};
+async function request(url, init, parse) {
+  let res;
+  try {
+    res = await fetch(url, init);
+  } catch (err) {
+    throw new Error(
+      `Could not reach ${new URL(url).origin} \u2014 is the API up? (${err instanceof Error ? err.message : err})`,
+      { cause: err }
+    );
+  }
+  const body = await res.json().catch(() => null);
+  if (!res.ok) {
+    const parsed = apiErrorSchema.safeParse(body);
+    if (parsed.success) {
+      throw new ApiRequestError(
+        res.status,
+        parsed.data.code,
+        parsed.data.message,
+        parsed.data.retryAfter
+      );
+    }
+    throw new ApiRequestError(
+      res.status,
+      "unknown_error",
+      `API returned ${res.status}`
+    );
+  }
+  return parse(body);
+}
+function createApiClient(apiUrl, publishToken) {
+  const base = apiUrl.replace(/\/$/, "");
+  const headers = {
+    "content-type": "application/json"
+  };
+  if (publishToken) {
+    headers.authorization = `Bearer ${publishToken}`;
+  }
+  return {
+    async createSession(body) {
+      return request(
+        `${base}/api/v1/publish`,
+        { body: JSON.stringify(body), headers, method: "POST" },
+        (d) => publishSessionResponseSchema.parse(d)
+      );
+    },
+    async exportComments(artifactId, query) {
+      const params = new URLSearchParams({
+        status: query.status,
+        version: query.version
+      });
+      return request(
+        `${base}/api/v1/artifacts/${artifactId}/comments/export?${params}`,
+        { method: "GET" },
+        (d) => commentExportSchema.parse(d)
+      );
+    },
+    async finalize(publishSessionId) {
+      return request(
+        `${base}/api/v1/publish/${publishSessionId}/finalize`,
+        { headers, method: "POST" },
+        (d) => finalizeResponseSchema.parse(d)
+      );
+    },
+    async getArtifact(artifactId) {
+      return request(
+        `${base}/api/v1/artifacts/${artifactId}`,
+        { method: "GET" },
+        (d) => artifactResponseSchema.parse(d)
+      );
+    },
+    // SPEC §6.16 — set a password (string) or clear it (null). Authorized
+    // by the publish token this client was created with.
+    async setProtection(artifactId, password) {
+      return request(
+        `${base}/api/v1/artifacts/${artifactId}/protection`,
+        { body: JSON.stringify({ password }), headers, method: "PUT" },
+        (d) => protectionResponseSchema.parse(d)
+      );
+    }
+  };
+}
+async function uploadFile(uploadUrl, content, mimeType) {
+  const res = await fetch(uploadUrl, {
+    body: new Uint8Array(content),
+    headers: {
+      "content-length": String(content.byteLength),
+      "content-type": mimeType
+    },
+    method: "PUT"
+  });
+  if (!res.ok) {
+    throw new Error(
+      `Upload failed (${res.status}): ${(await res.text()).slice(0, 200)}`
+    );
+  }
+}
+
+// src/config.ts
+import {
+  appendFileSync,
+  existsSync,
+  mkdirSync,
+  readFileSync,
+  writeFileSync
+} from "fs";
+import path from "path";
+import { z as z8 } from "zod";
+var configSchema = z8.object({
+  apiUrl: z8.string(),
+  artifactId: z8.string(),
+  publishToken: z8.string(),
+  slug: z8.string(),
+  url: z8.string()
+});
+var CONFIG_DIR = ".artifactcafe";
+var CONFIG_FILE = "config.json";
+function readConfig(dir) {
+  const file = path.join(dir, CONFIG_DIR, CONFIG_FILE);
+  if (!existsSync(file)) {
+    return null;
+  }
+  try {
+    return configSchema.parse(JSON.parse(readFileSync(file, "utf8")));
+  } catch {
+    return null;
+  }
+}
+function writeConfig(dir, config) {
+  mkdirSync(path.join(dir, CONFIG_DIR), { recursive: true });
+  writeFileSync(
+    path.join(dir, CONFIG_DIR, CONFIG_FILE),
+    `${JSON.stringify(config, null, 2)}
+`,
+    { mode: 384 }
+  );
+  ensureGitignored(dir);
+}
+function ensureGitignored(dir) {
+  const gitignore = path.join(dir, ".gitignore");
+  if (!existsSync(gitignore)) {
+    return;
+  }
+  const lines = readFileSync(gitignore, "utf8").split(/\r?\n/);
+  const present = lines.some((l) => {
+    const t = l.trim();
+    return t === CONFIG_DIR || t === `${CONFIG_DIR}/` || t === `/${CONFIG_DIR}` || t === `/${CONFIG_DIR}/`;
+  });
+  if (!present) {
+    appendFileSync(
+      gitignore,
+      `
+# artifact.cafe publish token
+${CONFIG_DIR}/
+`
+    );
+  }
+}
+
+// src/comments.ts
+var STATUSES = ["open", "resolved", "all"];
+var VERSIONS = ["current", "all"];
+async function comments(opts) {
+  if (!STATUSES.includes(opts.status)) {
+    throw new Error(
+      `--status must be one of: ${STATUSES.join(", ")} (got "${opts.status}").`
+    );
+  }
+  if (!VERSIONS.includes(opts.version)) {
+    throw new Error(
+      `--version must be one of: ${VERSIONS.join(", ")} (got "${opts.version}").`
+    );
+  }
+  const status = opts.status;
+  const version = opts.version;
+  const dir = path2.resolve(opts.dir);
+  const config = readConfig(dir);
+  if (!config) {
+    throw new Error(
+      `No artifact linked in ${dir} \u2014 run \`artifact-cafe publish\` there first (.artifactcafe/config.json not found).`
+    );
+  }
+  const apiUrl = process.env.ARTIFACT_CAFE_URL ?? config.apiUrl;
+  const client = createApiClient(apiUrl);
+  const data = await client.exportComments(config.artifactId, {
+    status,
+    version
+  });
+  if (opts.json) {
+    console.log(JSON.stringify(data, null, 2));
+    return;
+  }
+  printHuman(data, config.url, status, version);
+}
+function printHuman(data, url, status, version) {
+  const statusLabel = status === "all" ? "" : `${status} `;
+  let scope = "across all versions";
+  if (version === "current") {
+    scope = data.versionNumber === null ? "on the current version" : `on v${data.versionNumber}`;
+  }
+  if (data.comments.length === 0) {
+    console.log(`No ${statusLabel}comments ${scope}.`);
+    return;
+  }
+  const plural = data.comments.length === 1 ? "" : "s";
+  console.log(
+    `${data.comments.length} ${statusLabel}thread${plural} ${scope} \u2014 ${url}
+`
+  );
+  for (const thread of data.comments) {
+    printThread(thread);
+  }
+}
+function printThread(t) {
+  const marker = t.status === "resolved" ? "\u2713" : "\u25CF";
+  const date = t.createdAt.slice(0, 10);
+  console.log(
+    `${marker} ${t.author} \xB7 v${t.versionNumber} \xB7 ${date} \xB7 ${t.id}`
+  );
+  if (t.anchor.type === "text") {
+    console.log(`  \u21B3 "${t.anchor.quote}"`);
+  } else if (t.anchor.element) {
+    const el = t.anchor.element;
+    const text = el.text ? ` "${el.text}"` : "";
+    console.log(`  \u21B3 at ${elementLabel(el)}${text} \u2014 ${t.anchor.elementPath}`);
+  } else {
+    console.log(`  \u21B3 at ${t.anchor.elementPath}`);
+  }
+  console.log(indent(t.body, "  "));
+  for (const reply of t.replies) {
+    console.log(indent(`${reply.author}: ${reply.body}`, "    "));
+  }
+  console.log("");
+}
+function indent(text, pad) {
+  return text.split("\n").map((line) => pad + line).join("\n");
+}
+
+// src/errors.ts
+function printCliError(err, json) {
+  if (err instanceof ApiRequestError) {
+    if (json) {
+      console.log(
+        JSON.stringify({
+          error: {
+            code: err.code,
+            message: err.message,
+            retryAfter: err.retryAfter
+          }
+        })
+      );
+    } else {
+      console.error(`\u2717 ${err.message} (${err.code})`);
+      if (err.retryAfter) {
+        console.error(`  Retry in ${err.retryAfter}s.`);
+      }
+    }
+    return;
+  }
+  const message = err instanceof Error ? err.message : String(err);
+  if (json) {
+    console.log(JSON.stringify({ error: { code: "cli_error", message } }));
+  } else {
+    console.error(`\u2717 ${message}`);
+  }
+}
+
+// src/open.ts
+import path5 from "path";
+
+// src/publish.ts
+import { exec } from "child_process";
+import { readFileSync as readFileSync3 } from "fs";
+import path4 from "path";
+
+// src/manifest.ts
+import { createHash } from "crypto";
+import { readdirSync, readFileSync as readFileSync2, statSync } from "fs";
+import path3 from "path";
+var IGNORED_DIRS = /* @__PURE__ */ new Set([".git", "node_modules", ".artifactcafe"]);
+var IGNORED_FILES = /* @__PURE__ */ new Set([".DS_Store"]);
+function isIgnoredFile(name) {
+  if (IGNORED_FILES.has(name)) {
+    return true;
+  }
+  if (name === ".env" || name.startsWith(".env.")) {
+    return true;
+  }
+  if (name.endsWith(".pem") || name.endsWith(".key")) {
+    return true;
+  }
+  if (name.startsWith(".git")) {
+    return true;
+  }
+  return false;
+}
+var MIME_TYPES = {
+  ".avif": "image/avif",
+  ".css": "text/css",
+  ".gif": "image/gif",
+  ".htm": "text/html",
+  ".html": "text/html",
+  ".ico": "image/x-icon",
+  ".jpeg": "image/jpeg",
+  ".jpg": "image/jpeg",
+  ".js": "text/javascript",
+  ".json": "application/json",
+  ".map": "application/json",
+  ".md": "text/markdown",
+  ".mjs": "text/javascript",
+  ".mp3": "audio/mpeg",
+  ".mp4": "video/mp4",
+  ".otf": "font/otf",
+  ".pdf": "application/pdf",
+  ".png": "image/png",
+  ".svg": "image/svg+xml",
+  ".ttf": "font/ttf",
+  ".txt": "text/plain",
+  ".wasm": "application/wasm",
+  ".wav": "audio/wav",
+  ".webm": "video/webm",
+  ".webp": "image/webp",
+  ".woff": "font/woff",
+  ".woff2": "font/woff2",
+  ".xml": "application/xml"
+};
+function mimeFor(filePath) {
+  return MIME_TYPES[path3.extname(filePath).toLowerCase()] ?? "application/octet-stream";
+}
+function scanDirectory(dir) {
+  const files = [];
+  const skipped = [];
+  function walk(current, relPrefix) {
+    for (const entry of readdirSync(current, { withFileTypes: true })) {
+      const rel = relPrefix ? `${relPrefix}/${entry.name}` : entry.name;
+      const abs = path3.join(current, entry.name);
+      if (entry.isSymbolicLink()) {
+        skipped.push(rel);
+        continue;
+      }
+      if (entry.isDirectory()) {
+        if (IGNORED_DIRS.has(entry.name) || entry.name.startsWith(".git")) {
+          skipped.push(`${rel}/`);
+        } else {
+          walk(abs, rel);
+        }
+        continue;
+      }
+      if (!entry.isFile()) {
+        continue;
+      }
+      if (isIgnoredFile(entry.name) || !isSafeArtifactPath(rel)) {
+        skipped.push(rel);
+        continue;
+      }
+      const { size } = statSync(abs);
+      if (size === 0) {
+        skipped.push(rel);
+        continue;
+      }
+      const content = readFileSync2(abs);
+      files.push({
+        absPath: abs,
+        hash: `sha256_${createHash("sha256").update(content).digest("hex")}`,
+        mimeType: mimeFor(rel),
+        path: rel,
+        size
+      });
+    }
+  }
+  walk(dir, "");
+  files.sort((a, b) => a.path.localeCompare(b.path));
+  return { files, skipped };
+}
+function resolveEntry(files, explicit) {
+  if (explicit) {
+    if (!files.some((f) => f.path === explicit)) {
+      throw new Error(
+        `Entry file "${explicit}" not found in the publish folder.`
+      );
+    }
+    return explicit;
+  }
+  if (files.some((f) => f.path === "index.html")) {
+    return "index.html";
+  }
+  const htmlFiles = files.filter(
+    (f) => f.path.endsWith(".html") && !f.path.includes("/")
+  );
+  const [onlyHtmlFile] = htmlFiles;
+  if (onlyHtmlFile && htmlFiles.length === 1) {
+    return onlyHtmlFile.path;
+  }
+  throw new Error(
+    htmlFiles.length === 0 ? "No entry file found. Add an index.html or pass --entry <file>." : `Multiple HTML files found (${htmlFiles.map((f) => f.path).join(", ")}). Pass --entry <file>.`
+  );
+}
+
+// src/publish.ts
+var DEFAULT_API_URL = "https://artifact.cafe";
+var UPLOAD_CONCURRENCY = 6;
+async function publish(opts) {
+  const dir = path4.resolve(opts.dir);
+  const config = readConfig(dir);
+  if (opts.password !== void 0) {
+    const parsed = gatePasswordSchema.safeParse(opts.password);
+    if (!parsed.success) {
+      throw new Error(parsed.error.issues[0]?.message ?? "Invalid password.");
+    }
+  }
+  const artifactId = opts.artifact ?? config?.artifactId ?? null;
+  const token = (artifactId !== null && artifactId === config?.artifactId ? config.publishToken : void 0) ?? process.env.ARTIFACT_CAFE_TOKEN;
+  const apiUrl = process.env.ARTIFACT_CAFE_URL ?? config?.apiUrl ?? DEFAULT_API_URL;
+  const { files, skipped } = scanDirectory(dir);
+  if (files.length === 0) {
+    throw new Error(`Nothing to publish in ${dir} (after ignore rules).`);
+  }
+  const entryPath = resolveEntry(files, opts.entry);
+  const log = (msg) => {
+    if (!opts.json) {
+      console.log(msg);
+    }
+  };
+  if (skipped.length) {
+    log(`  ignoring ${skipped.length} item(s): ${preview(skipped)}`);
+  }
+  const client = createApiClient(apiUrl, token);
+  const session = await client.createSession({
+    artifactId,
+    entryPath,
+    files: files.map(({ absPath: _absPath, ...manifest }) => manifest),
+    source: {
+      agent: process.env.ARTIFACT_CAFE_AGENT,
+      runId: process.env.ARTIFACT_CAFE_RUN_ID,
+      type: "cli"
+    },
+    title: opts.title
+  });
+  const byPath = new Map(files.map((f) => [f.path, f]));
+  log(
+    `  uploading ${session.filesToUpload.length} file(s)` + (session.skippedFiles.length ? `, ${session.skippedFiles.length} unchanged` : "")
+  );
+  await inBatches(session.filesToUpload, UPLOAD_CONCURRENCY, async (upload) => {
+    const file = byPath.get(upload.path);
+    if (!file) {
+      throw new Error(`Server asked for unknown file ${upload.path}`);
+    }
+    await uploadFile(
+      upload.uploadUrl,
+      readFileSync3(file.absPath),
+      file.mimeType
+    );
+  });
+  const result = await client.finalize(session.publishSessionId);
+  if (result.publishToken) {
+    writeConfig(dir, {
+      apiUrl,
+      artifactId: result.artifactId,
+      publishToken: result.publishToken,
+      slug: slugFromUrl(result.url),
+      url: result.url
+    });
+  }
+  if (opts.password !== void 0) {
+    const protectClient = createApiClient(apiUrl, token ?? result.publishToken);
+    await protectClient.setProtection(result.artifactId, opts.password);
+  }
+  if (opts.json) {
+    console.log(
+      JSON.stringify(
+        {
+          artifactId: result.artifactId,
+          url: result.url,
+          versionNumber: result.versionNumber,
+          ...result.claimUrl ? { claimUrl: result.claimUrl } : {},
+          ...opts.password === void 0 ? {} : { protected: true },
+          filesUploaded: session.filesToUpload.map((f) => f.path),
+          ignored: skipped,
+          skippedFiles: session.skippedFiles
+        },
+        null,
+        2
+      )
+    );
+  } else if (result.versionNumber === 1) {
+    console.log("\n\u2713 Published to artifact.cafe\n");
+    console.log(`Review URL:
+${result.url}
+`);
+    if (result.claimUrl) {
+      console.log(
+        `Claim URL (shown once \u2014 claim to keep this artifact):
+${result.claimUrl}
+`
+      );
+    }
+    if (opts.password !== void 0) {
+      console.log("Password protection: on\n");
+    }
+  } else {
+    console.log(`
+\u2713 Published v${result.versionNumber}
+`);
+    console.log(`${result.url}
+`);
+    if (opts.password !== void 0) {
+      console.log("Password protection: on\n");
+    }
+  }
+  if (opts.open && !opts.json && process.stdout.isTTY) {
+    openInBrowser(result.url);
+  }
+}
+async function inBatches(items, concurrency, fn) {
+  let next = 0;
+  const workers = Array.from(
+    { length: Math.min(concurrency, items.length) },
+    async () => {
+      while (next < items.length) {
+        const item = items[next];
+        next += 1;
+        if (item === void 0) {
+          continue;
+        }
+        await fn(item);
+      }
+    }
+  );
+  await Promise.all(workers);
+}
+function slugFromUrl(url) {
+  return url.split("/a/")[1] ?? "";
+}
+function preview(items) {
+  return items.slice(0, 5).join(", ") + (items.length > 5 ? ", \u2026" : "");
+}
+function openInBrowser(url) {
+  let cmd = "xdg-open";
+  if (process.platform === "darwin") {
+    cmd = "open";
+  } else if (process.platform === "win32") {
+    cmd = "start";
+  }
+  exec(`${cmd} ${JSON.stringify(url)}`, () => {
+  });
+}
+
+// src/open.ts
+function openArtifact(opts) {
+  const dir = path5.resolve(opts.dir);
+  const config = readConfig(dir);
+  if (!config) {
+    throw new Error(
+      `No artifact linked in ${dir} \u2014 run \`artifact-cafe publish\` there first (.artifactcafe/config.json not found).`
+    );
+  }
+  console.log(config.url);
+  if (process.stdout.isTTY) {
+    openInBrowser(config.url);
+  }
+}
+
+// src/protect.ts
+import path6 from "path";
+async function protect(opts) {
+  if (opts.off && opts.password !== void 0) {
+    throw new Error("Pass either --password or --off, not both.");
+  }
+  if (!opts.off && opts.password === void 0) {
+    throw new Error(
+      "Provide --password <password> to set a gate, or --off to remove it."
+    );
+  }
+  const password = opts.off ? null : opts.password;
+  if (password !== null) {
+    const parsed = gatePasswordSchema.safeParse(password);
+    if (!parsed.success) {
+      throw new Error(parsed.error.issues[0]?.message ?? "Invalid password.");
+    }
+  }
+  const dir = path6.resolve(opts.dir);
+  const config = readConfig(dir);
+  if (!config) {
+    throw new Error(
+      `No artifact linked in ${dir} \u2014 run \`artifact-cafe publish\` there first (.artifactcafe/config.json not found).`
+    );
+  }
+  const apiUrl = process.env.ARTIFACT_CAFE_URL ?? config.apiUrl;
+  const token = config.publishToken ?? process.env.ARTIFACT_CAFE_TOKEN;
+  const client = createApiClient(apiUrl, token);
+  const res = await client.setProtection(config.artifactId, password);
+  if (opts.json) {
+    console.log(JSON.stringify({ protected: res.protected }, null, 2));
+    return;
+  }
+  console.log(
+    res.protected ? `
+\u2713 Password protection on \u2014 ${config.url}
+` : `
+\u2713 Password protection removed \u2014 ${config.url}
+`
+  );
+}
+
+// src/index.ts
+var publish2 = defineCommand({
+  args: {
+    artifact: {
+      description: "Publish to an existing artifact ID",
+      type: "string"
+    },
+    dir: {
+      default: ".",
+      description: "Directory to publish",
+      type: "positional"
+    },
+    entry: { description: "Entry file (default: auto-detect)", type: "string" },
+    json: { description: "Machine-readable output", type: "boolean" },
+    "no-open": { description: "Don't open the review URL", type: "boolean" },
+    password: {
+      description: "Password-protect the artifact (min 6 chars)",
+      type: "string"
+    },
+    title: { description: "Artifact title", type: "string" }
+  },
+  meta: { description: "Publish a folder as an artifact", name: "publish" },
+  async run({ args }) {
+    try {
+      await publish({
+        artifact: args.artifact,
+        dir: args.dir,
+        entry: args.entry,
+        json: Boolean(args.json),
+        open: !args["no-open"],
+        password: args.password,
+        title: args.title
+      });
+    } catch (err) {
+      printCliError(err, Boolean(args.json));
+      process.exit(1);
+    }
+  }
+});
+var comments2 = defineCommand({
+  args: {
+    dir: {
+      default: ".",
+      description: "Published directory",
+      type: "positional"
+    },
+    json: { description: "Machine-readable output", type: "boolean" },
+    status: {
+      default: "open",
+      description: "Filter: open | resolved | all",
+      type: "string"
+    },
+    version: {
+      default: "current",
+      description: "Filter: current | all",
+      type: "string"
+    }
+  },
+  meta: {
+    description: "Pull comments for the linked artifact",
+    name: "comments"
+  },
+  async run({ args }) {
+    try {
+      await comments({
+        dir: args.dir,
+        json: Boolean(args.json),
+        status: args.status,
+        version: args.version
+      });
+    } catch (err) {
+      printCliError(err, Boolean(args.json));
+      process.exit(1);
+    }
+  }
+});
+var protect2 = defineCommand({
+  args: {
+    dir: {
+      default: ".",
+      description: "Published directory",
+      type: "positional"
+    },
+    json: { description: "Machine-readable output", type: "boolean" },
+    off: { description: "Remove the password gate", type: "boolean" },
+    password: { description: "Gate password (min 6 chars)", type: "string" }
+  },
+  meta: {
+    description: "Password-protect the linked artifact (or --off to remove)",
+    name: "protect"
+  },
+  async run({ args }) {
+    try {
+      await protect({
+        dir: args.dir,
+        json: Boolean(args.json),
+        off: Boolean(args.off),
+        password: args.password
+      });
+    } catch (err) {
+      printCliError(err, Boolean(args.json));
+      process.exit(1);
+    }
+  }
+});
+var open = defineCommand({
+  args: {
+    dir: {
+      default: ".",
+      description: "Published directory",
+      type: "positional"
+    }
+  },
+  meta: { description: "Open the linked artifact's review URL", name: "open" },
+  run({ args }) {
+    try {
+      openArtifact({ dir: args.dir });
+    } catch (err) {
+      printCliError(err, false);
+      process.exit(1);
+    }
+  }
+});
+var main = defineCommand({
+  meta: {
+    description: "Publish AI-generated artifacts for review \u2014 https://artifact.cafe",
+    name: "artifact-cafe"
+  },
+  subCommands: { comments: comments2, open, protect: protect2, publish: publish2 }
+});
+runMain(main);

package/package.json

@@ -1,9 +1,27 @@
 {
   "name": "artifact-cafe",
-  "version": "0.0.0",
-  "description": "Publish AI-generated artifacts for review on artifact.cafe. Name reserved — the CLI is in active development.",
-  "keywords": ["artifact", "artifact.cafe", "review", "cli"],
-  "homepage": "https://artifact.cafe",
-  "license": "MIT",
-  "files": ["README.md"]
+  "version": "0.0.2",
+  "description": "Publish AI-generated artifacts for review on artifact.cafe",
+  "type": "module",
+  "bin": {
+    "artifact-cafe": "dist/index.js"
+  },
+  "files": [
+    "dist"
+  ],
+  "scripts": {
+    "build": "tsup",
+    "typecheck": "tsc --noEmit",
+    "dev": "tsup --watch"
+  },
+  "dependencies": {
+    "citty": "^0.1.6",
+    "zod": "^4.1.0"
+  },
+  "devDependencies": {
+    "@artifact-cafe/shared": "workspace:*",
+    "@types/node": "^24.0.0",
+    "tsup": "^8.5.0",
+    "typescript": "^5.9.0"
+  }
 }

package/README.md

@@ -1,11 +0,0 @@
-# artifact-cafe
-
-The home for AI-generated work. Agents publish interactive static artifacts
-via CLI; humans review and comment through a share link.
-
-```
-npx artifact-cafe publish .
-```
-
-> **This package name is reserved.** `0.0.0` is a placeholder — the real CLI
-> is in active development and will ship as `0.0.1`+. See https://artifact.cafe