artifact-cafe 0.0.1 → 0.0.2

package/dist/index.js

@@ -6,225 +6,262 @@ import { defineCommand, runMain } from "citty";
 // src/comments.ts
 import path2 from "path";
 
-// ../shared/src/publish.ts
-import { z } from "zod";
-function isSafeArtifactPath(p) {
-  if (p.length === 0 || p.length > 1024) return false;
-  if (p.includes("\\") || p.includes("\0")) return false;
-  if (p.startsWith("/") || p.startsWith("~")) return false;
-  return p.split("/").every((seg) => seg.length > 0 && seg !== "." && seg !== "..");
-}
-var manifestFileSchema = z.object({
-  path: z.string().min(1).max(1024).refine(isSafeArtifactPath, { message: "path must be a safe relative path" }),
-  hash: z.string().regex(/^sha256_[a-f0-9]{64}$/),
-  size: z.number().int().positive(),
-  mimeType: z.string().regex(/^[-\w.+]+\/[-\w.+]+$/, { message: "invalid MIME type" })
-});
-var publishSourceSchema = z.object({
-  type: z.literal("cli"),
-  agent: z.string().optional(),
-  runId: z.string().optional()
-});
-var createPublishSessionSchema = z.object({
-  artifactId: z.string().nullable(),
-  title: z.string().max(200).optional(),
-  entryPath: z.string().optional(),
-  files: z.array(manifestFileSchema).min(1).max(1e3),
-  source: publishSourceSchema
-});
-var publishSessionResponseSchema = z.object({
-  publishSessionId: z.string(),
-  artifactId: z.string(),
-  versionId: z.string(),
-  filesToUpload: z.array(
-    z.object({
-      path: z.string(),
-      uploadUrl: z.string().url(),
-      method: z.literal("PUT")
-    })
-  ),
-  skippedFiles: z.array(z.string()),
-  expiresAt: z.string()
-});
-var finalizeResponseSchema = z.object({
-  artifactId: z.string(),
-  versionId: z.string(),
-  versionNumber: z.number().int().positive(),
-  url: z.string().url(),
-  // Returned only on first publish of a new artifact (one-time).
-  claimUrl: z.string().url().optional(),
-  publishToken: z.string().optional()
-});
-var artifactResponseSchema = z.object({
-  id: z.string(),
-  slug: z.string(),
-  title: z.string(),
-  currentVersion: z.object({
-    id: z.string(),
-    versionNumber: z.number().int().positive(),
-    entryUrl: z.string().url()
-  }).nullable(),
-  claimed: z.boolean()
-});
-
 // ../shared/src/comments.ts
-import { z as z2 } from "zod";
-var elementSnapshotSchema = z2.object({
-  tag: z2.string().min(1).max(128),
-  id: z2.string().max(256).optional(),
-  classes: z2.string().max(256).optional(),
-  text: z2.string().max(200).optional()
-});
-var pointAnchorSchema = z2.object({
-  type: z2.literal("point"),
+import { z } from "zod";
+var elementSnapshotSchema = z.object({
+  classes: z.string().max(256).optional(),
+  id: z.string().max(256).optional(),
+  tag: z.string().min(1).max(128),
+  text: z.string().max(200).optional()
+});
+var pointAnchorSchema = z.object({
+  element: elementSnapshotSchema.optional(),
   // elementPath is the primary anchor; x/y are offsets within the
   // element's box, normalized 0..1 (SPEC.md §8.1).
-  elementPath: z2.string().max(2048),
-  x: z2.number().min(0).max(1),
-  y: z2.number().min(0).max(1),
-  viewportWidth: z2.number().int().positive().max(1e5),
-  viewportHeight: z2.number().int().positive().max(1e5),
-  element: elementSnapshotSchema.optional()
-});
-var textAnchorSchema = z2.object({
-  type: z2.literal("text"),
-  quote: z2.string().min(1).max(1e3),
-  prefix: z2.string().max(200).optional(),
-  suffix: z2.string().max(200).optional(),
-  startOffset: z2.number().int().nonnegative().max(1e8),
-  endOffset: z2.number().int().nonnegative().max(1e8),
-  elementPath: z2.string().max(2048)
-});
-var anchorSchema = z2.discriminatedUnion("type", [
+  elementPath: z.string().max(2048),
+  type: z.literal("point"),
+  viewportHeight: z.number().int().positive().max(1e5),
+  viewportWidth: z.number().int().positive().max(1e5),
+  x: z.number().min(0).max(1),
+  y: z.number().min(0).max(1)
+});
+var textAnchorSchema = z.object({
+  elementPath: z.string().max(2048),
+  endOffset: z.number().int().nonnegative().max(1e8),
+  prefix: z.string().max(200).optional(),
+  quote: z.string().min(1).max(1e3),
+  startOffset: z.number().int().nonnegative().max(1e8),
+  suffix: z.string().max(200).optional(),
+  type: z.literal("text")
+});
+var anchorSchema = z.discriminatedUnion("type", [
   pointAnchorSchema,
   textAnchorSchema
 ]);
-var guestSchema = z2.object({
-  guestId: z2.string().min(16),
-  displayName: z2.string().min(1).max(64)
+var guestSchema = z.object({
+  displayName: z.string().min(1).max(64),
+  guestId: z.string().min(16)
 });
-var createCommentThreadSchema = z2.object({
-  versionId: z2.string(),
-  guest: guestSchema.optional(),
+var createCommentThreadSchema = z.object({
   anchor: anchorSchema,
-  body: z2.string().min(1).max(1e4)
-});
-var createCommentMessageSchema = z2.object({
+  body: z.string().min(1).max(1e4),
   guest: guestSchema.optional(),
-  body: z2.string().min(1).max(1e4)
+  versionId: z.string()
+});
+var createCommentMessageSchema = z.object({
+  body: z.string().min(1).max(1e4),
+  guest: guestSchema.optional()
 });
-var threadActionSchema = z2.object({
+var threadActionSchema = z.object({
   guest: guestSchema.optional()
 });
-var commentAuthorSchema = z2.object({
-  guestId: z2.string().nullable(),
-  displayName: z2.string()
+var commentAuthorSchema = z.object({
+  displayName: z.string(),
+  guestId: z.string().nullable()
 });
-var commentMessageSchema = z2.object({
-  id: z2.string(),
-  body: z2.string(),
+var commentMessageSchema = z.object({
   author: commentAuthorSchema,
-  createdAt: z2.string()
+  body: z.string(),
+  createdAt: z.string(),
+  id: z.string()
 });
-var commentThreadSchema = z2.object({
-  id: z2.string(),
-  artifactId: z2.string(),
-  versionId: z2.string(),
+var commentThreadSchema = z.object({
   anchor: anchorSchema,
-  status: z2.enum(["open", "resolved"]),
+  artifactId: z.string(),
+  createdAt: z.string(),
   createdBy: commentAuthorSchema,
-  createdAt: z2.string(),
-  messages: z2.array(commentMessageSchema)
-});
-var commentThreadListSchema = z2.object({
-  threads: z2.array(commentThreadSchema)
-});
-var commentExportQuerySchema = z2.object({
-  status: z2.enum(["open", "resolved", "all"]).default("open"),
-  version: z2.enum(["current", "all"]).default("current")
-});
-var commentExportReplySchema = z2.object({
-  author: z2.string(),
-  body: z2.string(),
-  createdAt: z2.string()
-});
-var commentExportThreadSchema = z2.object({
-  id: z2.string(),
-  status: z2.enum(["open", "resolved"]),
-  versionNumber: z2.number().int().positive(),
-  author: z2.string(),
-  body: z2.string(),
+  id: z.string(),
+  messages: z.array(commentMessageSchema),
+  status: z.enum(["open", "resolved"]),
+  versionId: z.string()
+});
+var commentThreadListSchema = z.object({
+  threads: z.array(commentThreadSchema)
+});
+var commentExportQuerySchema = z.object({
+  status: z.enum(["open", "resolved", "all"]).default("open"),
+  version: z.enum(["current", "all"]).default("current")
+});
+var commentExportReplySchema = z.object({
+  author: z.string(),
+  body: z.string(),
+  createdAt: z.string()
+});
+var commentExportThreadSchema = z.object({
   anchor: anchorSchema,
-  createdAt: z2.string(),
-  replies: z2.array(commentExportReplySchema)
+  author: z.string(),
+  body: z.string(),
+  createdAt: z.string(),
+  id: z.string(),
+  replies: z.array(commentExportReplySchema),
+  status: z.enum(["open", "resolved"]),
+  versionNumber: z.number().int().positive()
 });
-var commentExportSchema = z2.object({
-  artifactId: z2.string(),
+var commentExportSchema = z.object({
+  artifactId: z.string(),
+  comments: z.array(commentExportThreadSchema),
   // The artifact's current version (null before the first finalize).
-  versionNumber: z2.number().int().positive().nullable(),
-  comments: z2.array(commentExportThreadSchema)
+  versionNumber: z.number().int().positive().nullable()
 });
 function elementLabel(el) {
-  if (el.id) return `<${el.tag}#${el.id}>`;
+  if (el.id) {
+    return `<${el.tag}#${el.id}>`;
+  }
   const classes = el.classes ? el.classes.split(" ").slice(0, 2) : [];
   return classes.length ? `<${el.tag}.${classes.join(".")}>` : `<${el.tag}>`;
 }
 
 // ../shared/src/errors.ts
+import { z as z2 } from "zod";
+var apiErrorSchema = z2.object({
+  code: z2.string(),
+  docsUrl: z2.string().url(),
+  message: z2.string(),
+  retryAfter: z2.number().int().positive().optional()
+});
+
+// ../shared/src/owner.ts
 import { z as z3 } from "zod";
-var apiErrorSchema = z3.object({
-  code: z3.string(),
-  message: z3.string(),
-  retryAfter: z3.number().int().positive().optional(),
-  docsUrl: z3.string().url()
+var SLUG_PATTERN = /^[a-z0-9](?:[a-z0-9-]{1,61}[a-z0-9])$/;
+var claimResponseSchema = z3.object({
+  artifactId: z3.string(),
+  slug: z3.string(),
+  title: z3.string(),
+  url: z3.string().url()
+});
+var updateArtifactSchema = z3.object({
+  slug: z3.string().min(3).max(63).regex(SLUG_PATTERN, {
+    message: "slug must be lowercase letters, digits, and hyphens, with no leading/trailing hyphen"
+  }).optional(),
+  title: z3.string().min(1).max(200).optional()
+}).refine((body) => body.title !== void 0 || body.slug !== void 0, {
+  message: "provide at least one of title, slug"
+});
+var deleteArtifactResponseSchema = z3.object({
+  deleted: z3.literal(true)
 });
 
-// ../shared/src/versions.ts
+// ../shared/src/protection.ts
 import { z as z4 } from "zod";
-var versionSourceSchema = z4.object({
-  type: z4.string(),
-  agentName: z4.string().nullable()
-});
-var versionChangesSchema = z4.object({
-  added: z4.array(z4.string()),
-  changed: z4.array(z4.string()),
-  removed: z4.array(z4.string())
-});
-var versionSummarySchema = z4.object({
-  id: z4.string(),
-  versionNumber: z4.number().int().positive(),
-  createdAt: z4.string(),
-  entryUrl: z4.string().url(),
-  fileCount: z4.number().int().nonnegative(),
-  totalSizeBytes: z4.number().int().nonnegative(),
-  source: versionSourceSchema,
-  isCurrent: z4.boolean(),
-  // Absent for the first version — there is no previous version to diff against.
-  changes: versionChangesSchema.nullable()
+var PASSWORD_MIN = 6;
+var PASSWORD_MAX = 128;
+var gatePasswordSchema = z4.string().min(PASSWORD_MIN, `Password must be at least ${PASSWORD_MIN} characters.`).max(PASSWORD_MAX, `Password must be at most ${PASSWORD_MAX} characters.`);
+var setProtectionSchema = z4.object({
+  password: gatePasswordSchema.nullable()
+});
+var protectionResponseSchema = z4.object({
+  protected: z4.boolean()
 });
-var versionListResponseSchema = z4.object({
-  versions: z4.array(versionSummarySchema)
+var unlockSchema = z4.object({
+  password: z4.string().min(1).max(1024)
+});
+var unlockResponseSchema = z4.object({
+  unlocked: z4.literal(true)
 });
 
-// ../shared/src/owner.ts
+// ../shared/src/publish.ts
 import { z as z5 } from "zod";
-var SLUG_PATTERN = /^[a-z0-9](?:[a-z0-9-]{1,61}[a-z0-9])$/;
-var claimResponseSchema = z5.object({
+function isSafeArtifactPath(p) {
+  if (p.length === 0 || p.length > 1024) {
+    return false;
+  }
+  if (p.includes("\\") || p.includes("\0")) {
+    return false;
+  }
+  if (p.startsWith("/") || p.startsWith("~")) {
+    return false;
+  }
+  return p.split("/").every((seg) => seg.length > 0 && seg !== "." && seg !== "..");
+}
+var manifestFileSchema = z5.object({
+  hash: z5.string().regex(/^sha256_[a-f0-9]{64}$/),
+  mimeType: z5.string().regex(/^[-\w.+]+\/[-\w.+]+$/, { message: "invalid MIME type" }),
+  path: z5.string().min(1).max(1024).refine(isSafeArtifactPath, {
+    message: "path must be a safe relative path"
+  }),
+  size: z5.number().int().positive()
+});
+var publishSourceSchema = z5.object({
+  agent: z5.string().optional(),
+  runId: z5.string().optional(),
+  type: z5.literal("cli")
+});
+var createPublishSessionSchema = z5.object({
+  artifactId: z5.string().nullable(),
+  entryPath: z5.string().optional(),
+  files: z5.array(manifestFileSchema).min(1).max(1e3),
+  source: publishSourceSchema,
+  title: z5.string().max(200).optional()
+});
+var publishSessionResponseSchema = z5.object({
+  artifactId: z5.string(),
+  expiresAt: z5.string(),
+  filesToUpload: z5.array(
+    z5.object({
+      method: z5.literal("PUT"),
+      path: z5.string(),
+      uploadUrl: z5.string().url()
+    })
+  ),
+  publishSessionId: z5.string(),
+  skippedFiles: z5.array(z5.string()),
+  versionId: z5.string()
+});
+var finalizeResponseSchema = z5.object({
   artifactId: z5.string(),
+  // Returned only on first publish of a new artifact (one-time).
+  claimUrl: z5.string().url().optional(),
+  publishToken: z5.string().optional(),
+  url: z5.string().url(),
+  versionId: z5.string(),
+  versionNumber: z5.number().int().positive()
+});
+var artifactResponseSchema = z5.object({
+  claimed: z5.boolean(),
+  currentVersion: z5.object({
+    entryUrl: z5.string().url(),
+    id: z5.string(),
+    versionNumber: z5.number().int().positive()
+  }).nullable(),
+  id: z5.string(),
   slug: z5.string(),
-  title: z5.string(),
-  url: z5.string().url()
+  title: z5.string()
 });
-var updateArtifactSchema = z5.object({
-  title: z5.string().min(1).max(200).optional(),
-  slug: z5.string().min(3).max(63).regex(SLUG_PATTERN, {
-    message: "slug must be lowercase letters, digits, and hyphens, with no leading/trailing hyphen"
-  }).optional()
-}).refine((body) => body.title !== void 0 || body.slug !== void 0, {
-  message: "provide at least one of title, slug"
+
+// ../shared/src/report.ts
+import { z as z6 } from "zod";
+var reportRequestSchema = z6.object({
+  reason: z6.string().max(1e3).optional()
+});
+var reportResponseSchema = z6.object({
+  reported: z6.literal(true)
+});
+
+// ../shared/src/versions.ts
+import { z as z7 } from "zod";
+var versionSourceSchema = z7.object({
+  agentName: z7.string().nullable(),
+  type: z7.string()
+});
+var versionChangesSchema = z7.object({
+  added: z7.array(z7.string()),
+  changed: z7.array(z7.string()),
+  removed: z7.array(z7.string())
+});
+var versionSummarySchema = z7.object({
+  // Absent for the first version — there is no previous version to diff against.
+  changes: versionChangesSchema.nullable(),
+  createdAt: z7.string(),
+  entryUrl: z7.string().url(),
+  fileCount: z7.number().int().nonnegative(),
+  id: z7.string(),
+  isCurrent: z7.boolean(),
+  source: versionSourceSchema,
+  totalSizeBytes: z7.number().int().nonnegative(),
+  versionNumber: z7.number().int().positive()
 });
-var deleteArtifactResponseSchema = z5.object({
-  deleted: z5.literal(true)
+var versionListResponseSchema = z7.object({
+  versions: z7.array(versionSummarySchema)
 });
 
 // src/api.ts
@@ -246,7 +283,8 @@ async function request(url, init, parse) {
     res = await fetch(url, init);
   } catch (err) {
     throw new Error(
-      `Could not reach ${new URL(url).origin} \u2014 is the API up? (${err instanceof Error ? err.message : err})`
+      `Could not reach ${new URL(url).origin} \u2014 is the API up? (${err instanceof Error ? err.message : err})`,
+      { cause: err }
     );
   }
   const body = await res.json().catch(() => null);
@@ -260,26 +298,45 @@ async function request(url, init, parse) {
         parsed.data.retryAfter
       );
     }
-    throw new ApiRequestError(res.status, "unknown_error", `API returned ${res.status}`);
+    throw new ApiRequestError(
+      res.status,
+      "unknown_error",
+      `API returned ${res.status}`
+    );
   }
   return parse(body);
 }
 function createApiClient(apiUrl, publishToken) {
   const base = apiUrl.replace(/\/$/, "");
-  const headers = { "content-type": "application/json" };
-  if (publishToken) headers.authorization = `Bearer ${publishToken}`;
+  const headers = {
+    "content-type": "application/json"
+  };
+  if (publishToken) {
+    headers.authorization = `Bearer ${publishToken}`;
+  }
   return {
     async createSession(body) {
       return request(
         `${base}/api/v1/publish`,
-        { method: "POST", headers, body: JSON.stringify(body) },
+        { body: JSON.stringify(body), headers, method: "POST" },
         (d) => publishSessionResponseSchema.parse(d)
       );
     },
+    async exportComments(artifactId, query) {
+      const params = new URLSearchParams({
+        status: query.status,
+        version: query.version
+      });
+      return request(
+        `${base}/api/v1/artifacts/${artifactId}/comments/export?${params}`,
+        { method: "GET" },
+        (d) => commentExportSchema.parse(d)
+      );
+    },
     async finalize(publishSessionId) {
       return request(
         `${base}/api/v1/publish/${publishSessionId}/finalize`,
-        { method: "POST", headers },
+        { headers, method: "POST" },
         (d) => finalizeResponseSchema.parse(d)
       );
     },
@@ -290,43 +347,57 @@ function createApiClient(apiUrl, publishToken) {
         (d) => artifactResponseSchema.parse(d)
       );
     },
-    async exportComments(artifactId, query) {
-      const params = new URLSearchParams({ status: query.status, version: query.version });
+    // SPEC §6.16 — set a password (string) or clear it (null). Authorized
+    // by the publish token this client was created with.
+    async setProtection(artifactId, password) {
       return request(
-        `${base}/api/v1/artifacts/${artifactId}/comments/export?${params}`,
-        { method: "GET" },
-        (d) => commentExportSchema.parse(d)
+        `${base}/api/v1/artifacts/${artifactId}/protection`,
+        { body: JSON.stringify({ password }), headers, method: "PUT" },
+        (d) => protectionResponseSchema.parse(d)
       );
     }
   };
 }
 async function uploadFile(uploadUrl, content, mimeType) {
   const res = await fetch(uploadUrl, {
-    method: "PUT",
-    headers: { "content-type": mimeType, "content-length": String(content.byteLength) },
-    body: new Uint8Array(content)
+    body: new Uint8Array(content),
+    headers: {
+      "content-length": String(content.byteLength),
+      "content-type": mimeType
+    },
+    method: "PUT"
   });
   if (!res.ok) {
-    throw new Error(`Upload failed (${res.status}): ${(await res.text()).slice(0, 200)}`);
+    throw new Error(
+      `Upload failed (${res.status}): ${(await res.text()).slice(0, 200)}`
+    );
   }
 }
 
 // src/config.ts
-import { existsSync, mkdirSync, readFileSync, writeFileSync, appendFileSync } from "fs";
+import {
+  appendFileSync,
+  existsSync,
+  mkdirSync,
+  readFileSync,
+  writeFileSync
+} from "fs";
 import path from "path";
-import { z as z6 } from "zod";
-var configSchema = z6.object({
-  artifactId: z6.string(),
-  slug: z6.string(),
-  url: z6.string(),
-  apiUrl: z6.string(),
-  publishToken: z6.string()
+import { z as z8 } from "zod";
+var configSchema = z8.object({
+  apiUrl: z8.string(),
+  artifactId: z8.string(),
+  publishToken: z8.string(),
+  slug: z8.string(),
+  url: z8.string()
 });
 var CONFIG_DIR = ".artifactcafe";
 var CONFIG_FILE = "config.json";
 function readConfig(dir) {
   const file = path.join(dir, CONFIG_DIR, CONFIG_FILE);
-  if (!existsSync(file)) return null;
+  if (!existsSync(file)) {
+    return null;
+  }
   try {
     return configSchema.parse(JSON.parse(readFileSync(file, "utf8")));
   } catch {
@@ -337,24 +408,30 @@ function writeConfig(dir, config) {
   mkdirSync(path.join(dir, CONFIG_DIR), { recursive: true });
   writeFileSync(
     path.join(dir, CONFIG_DIR, CONFIG_FILE),
-    JSON.stringify(config, null, 2) + "\n",
+    `${JSON.stringify(config, null, 2)}
+`,
     { mode: 384 }
   );
   ensureGitignored(dir);
 }
 function ensureGitignored(dir) {
   const gitignore = path.join(dir, ".gitignore");
-  if (!existsSync(gitignore)) return;
+  if (!existsSync(gitignore)) {
+    return;
+  }
   const lines = readFileSync(gitignore, "utf8").split(/\r?\n/);
   const present = lines.some((l) => {
     const t = l.trim();
     return t === CONFIG_DIR || t === `${CONFIG_DIR}/` || t === `/${CONFIG_DIR}` || t === `/${CONFIG_DIR}/`;
   });
   if (!present) {
-    appendFileSync(gitignore, `
+    appendFileSync(
+      gitignore,
+      `
 # artifact.cafe publish token
 ${CONFIG_DIR}/
-`);
+`
+    );
   }
 }
 
@@ -363,10 +440,14 @@ var STATUSES = ["open", "resolved", "all"];
 var VERSIONS = ["current", "all"];
 async function comments(opts) {
   if (!STATUSES.includes(opts.status)) {
-    throw new Error(`--status must be one of: ${STATUSES.join(", ")} (got "${opts.status}").`);
+    throw new Error(
+      `--status must be one of: ${STATUSES.join(", ")} (got "${opts.status}").`
+    );
   }
   if (!VERSIONS.includes(opts.version)) {
-    throw new Error(`--version must be one of: ${VERSIONS.join(", ")} (got "${opts.version}").`);
+    throw new Error(
+      `--version must be one of: ${VERSIONS.join(", ")} (got "${opts.version}").`
+    );
   }
   const status = opts.status;
   const version = opts.version;
@@ -379,7 +460,10 @@ async function comments(opts) {
   }
   const apiUrl = process.env.ARTIFACT_CAFE_URL ?? config.apiUrl;
   const client = createApiClient(apiUrl);
-  const data = await client.exportComments(config.artifactId, { status, version });
+  const data = await client.exportComments(config.artifactId, {
+    status,
+    version
+  });
   if (opts.json) {
     console.log(JSON.stringify(data, null, 2));
     return;
@@ -388,14 +472,19 @@ async function comments(opts) {
 }
 function printHuman(data, url, status, version) {
   const statusLabel = status === "all" ? "" : `${status} `;
-  const scope = version === "current" ? data.versionNumber !== null ? `on v${data.versionNumber}` : "on the current version" : "across all versions";
+  let scope = "across all versions";
+  if (version === "current") {
+    scope = data.versionNumber === null ? "on the current version" : `on v${data.versionNumber}`;
+  }
   if (data.comments.length === 0) {
     console.log(`No ${statusLabel}comments ${scope}.`);
     return;
   }
   const plural = data.comments.length === 1 ? "" : "s";
-  console.log(`${data.comments.length} ${statusLabel}thread${plural} ${scope} \u2014 ${url}
-`);
+  console.log(
+    `${data.comments.length} ${statusLabel}thread${plural} ${scope} \u2014 ${url}
+`
+  );
   for (const thread of data.comments) {
     printThread(thread);
   }
@@ -403,7 +492,9 @@ function printHuman(data, url, status, version) {
 function printThread(t) {
   const marker = t.status === "resolved" ? "\u2713" : "\u25CF";
   const date = t.createdAt.slice(0, 10);
-  console.log(`${marker} ${t.author} \xB7 v${t.versionNumber} \xB7 ${date} \xB7 ${t.id}`);
+  console.log(
+    `${marker} ${t.author} \xB7 v${t.versionNumber} \xB7 ${date} \xB7 ${t.id}`
+  );
   if (t.anchor.type === "text") {
     console.log(`  \u21B3 "${t.anchor.quote}"`);
   } else if (t.anchor.element) {
@@ -429,27 +520,36 @@ function printCliError(err, json) {
     if (json) {
       console.log(
         JSON.stringify({
-          error: { code: err.code, message: err.message, retryAfter: err.retryAfter }
+          error: {
+            code: err.code,
+            message: err.message,
+            retryAfter: err.retryAfter
+          }
         })
       );
     } else {
       console.error(`\u2717 ${err.message} (${err.code})`);
-      if (err.retryAfter) console.error(`  Retry in ${err.retryAfter}s.`);
+      if (err.retryAfter) {
+        console.error(`  Retry in ${err.retryAfter}s.`);
+      }
     }
     return;
   }
   const message = err instanceof Error ? err.message : String(err);
-  if (json) console.log(JSON.stringify({ error: { code: "cli_error", message } }));
-  else console.error(`\u2717 ${message}`);
+  if (json) {
+    console.log(JSON.stringify({ error: { code: "cli_error", message } }));
+  } else {
+    console.error(`\u2717 ${message}`);
+  }
 }
 
 // src/open.ts
 import path5 from "path";
 
 // src/publish.ts
+import { exec } from "child_process";
 import { readFileSync as readFileSync3 } from "fs";
 import path4 from "path";
-import { exec } from "child_process";
 
 // src/manifest.ts
 import { createHash } from "crypto";
@@ -458,41 +558,49 @@ import path3 from "path";
 var IGNORED_DIRS = /* @__PURE__ */ new Set([".git", "node_modules", ".artifactcafe"]);
 var IGNORED_FILES = /* @__PURE__ */ new Set([".DS_Store"]);
 function isIgnoredFile(name) {
-  if (IGNORED_FILES.has(name)) return true;
-  if (name === ".env" || name.startsWith(".env.")) return true;
-  if (name.endsWith(".pem") || name.endsWith(".key")) return true;
-  if (name.startsWith(".git")) return true;
+  if (IGNORED_FILES.has(name)) {
+    return true;
+  }
+  if (name === ".env" || name.startsWith(".env.")) {
+    return true;
+  }
+  if (name.endsWith(".pem") || name.endsWith(".key")) {
+    return true;
+  }
+  if (name.startsWith(".git")) {
+    return true;
+  }
   return false;
 }
 var MIME_TYPES = {
-  ".html": "text/html",
-  ".htm": "text/html",
+  ".avif": "image/avif",
   ".css": "text/css",
+  ".gif": "image/gif",
+  ".htm": "text/html",
+  ".html": "text/html",
+  ".ico": "image/x-icon",
+  ".jpeg": "image/jpeg",
+  ".jpg": "image/jpeg",
   ".js": "text/javascript",
-  ".mjs": "text/javascript",
   ".json": "application/json",
   ".map": "application/json",
-  ".txt": "text/plain",
   ".md": "text/markdown",
-  ".xml": "application/xml",
-  ".svg": "image/svg+xml",
+  ".mjs": "text/javascript",
+  ".mp3": "audio/mpeg",
+  ".mp4": "video/mp4",
+  ".otf": "font/otf",
+  ".pdf": "application/pdf",
   ".png": "image/png",
-  ".jpg": "image/jpeg",
-  ".jpeg": "image/jpeg",
-  ".gif": "image/gif",
+  ".svg": "image/svg+xml",
+  ".ttf": "font/ttf",
+  ".txt": "text/plain",
+  ".wasm": "application/wasm",
+  ".wav": "audio/wav",
+  ".webm": "video/webm",
   ".webp": "image/webp",
-  ".avif": "image/avif",
-  ".ico": "image/x-icon",
   ".woff": "font/woff",
   ".woff2": "font/woff2",
-  ".ttf": "font/ttf",
-  ".otf": "font/otf",
-  ".pdf": "application/pdf",
-  ".mp4": "video/mp4",
-  ".webm": "video/webm",
-  ".mp3": "audio/mpeg",
-  ".wav": "audio/wav",
-  ".wasm": "application/wasm"
+  ".xml": "application/xml"
 };
 function mimeFor(filePath) {
   return MIME_TYPES[path3.extname(filePath).toLowerCase()] ?? "application/octet-stream";
@@ -516,23 +624,25 @@ function scanDirectory(dir) {
         }
         continue;
       }
-      if (!entry.isFile()) continue;
+      if (!entry.isFile()) {
+        continue;
+      }
       if (isIgnoredFile(entry.name) || !isSafeArtifactPath(rel)) {
         skipped.push(rel);
         continue;
       }
-      const size = statSync(abs).size;
+      const { size } = statSync(abs);
       if (size === 0) {
         skipped.push(rel);
         continue;
       }
       const content = readFileSync2(abs);
       files.push({
-        path: rel,
+        absPath: abs,
         hash: `sha256_${createHash("sha256").update(content).digest("hex")}`,
-        size,
         mimeType: mimeFor(rel),
-        absPath: abs
+        path: rel,
+        size
       });
     }
   }
@@ -543,13 +653,22 @@ function scanDirectory(dir) {
 function resolveEntry(files, explicit) {
   if (explicit) {
     if (!files.some((f) => f.path === explicit)) {
-      throw new Error(`Entry file "${explicit}" not found in the publish folder.`);
+      throw new Error(
+        `Entry file "${explicit}" not found in the publish folder.`
+      );
     }
     return explicit;
   }
-  if (files.some((f) => f.path === "index.html")) return "index.html";
-  const htmlFiles = files.filter((f) => f.path.endsWith(".html") && !f.path.includes("/"));
-  if (htmlFiles.length === 1) return htmlFiles[0].path;
+  if (files.some((f) => f.path === "index.html")) {
+    return "index.html";
+  }
+  const htmlFiles = files.filter(
+    (f) => f.path.endsWith(".html") && !f.path.includes("/")
+  );
+  const [onlyHtmlFile] = htmlFiles;
+  if (onlyHtmlFile && htmlFiles.length === 1) {
+    return onlyHtmlFile.path;
+  }
   throw new Error(
     htmlFiles.length === 0 ? "No entry file found. Add an index.html or pass --entry <file>." : `Multiple HTML files found (${htmlFiles.map((f) => f.path).join(", ")}). Pass --entry <file>.`
   );
@@ -561,6 +680,12 @@ var UPLOAD_CONCURRENCY = 6;
 async function publish(opts) {
   const dir = path4.resolve(opts.dir);
   const config = readConfig(dir);
+  if (opts.password !== void 0) {
+    const parsed = gatePasswordSchema.safeParse(opts.password);
+    if (!parsed.success) {
+      throw new Error(parsed.error.issues[0]?.message ?? "Invalid password.");
+    }
+  }
   const artifactId = opts.artifact ?? config?.artifactId ?? null;
   const token = (artifactId !== null && artifactId === config?.artifactId ? config.publishToken : void 0) ?? process.env.ARTIFACT_CAFE_TOKEN;
   const apiUrl = process.env.ARTIFACT_CAFE_URL ?? config?.apiUrl ?? DEFAULT_API_URL;
@@ -570,7 +695,9 @@ async function publish(opts) {
   }
   const entryPath = resolveEntry(files, opts.entry);
   const log = (msg) => {
-    if (!opts.json) console.log(msg);
+    if (!opts.json) {
+      console.log(msg);
+    }
   };
   if (skipped.length) {
     log(`  ignoring ${skipped.length} item(s): ${preview(skipped)}`);
@@ -578,14 +705,14 @@ async function publish(opts) {
   const client = createApiClient(apiUrl, token);
   const session = await client.createSession({
     artifactId,
-    title: opts.title,
     entryPath,
     files: files.map(({ absPath: _absPath, ...manifest }) => manifest),
     source: {
-      type: "cli",
       agent: process.env.ARTIFACT_CAFE_AGENT,
-      runId: process.env.ARTIFACT_CAFE_RUN_ID
-    }
+      runId: process.env.ARTIFACT_CAFE_RUN_ID,
+      type: "cli"
+    },
+    title: opts.title
   });
   const byPath = new Map(files.map((f) => [f.path, f]));
   log(
@@ -593,46 +720,60 @@ async function publish(opts) {
   );
   await inBatches(session.filesToUpload, UPLOAD_CONCURRENCY, async (upload) => {
     const file = byPath.get(upload.path);
-    if (!file) throw new Error(`Server asked for unknown file ${upload.path}`);
-    await uploadFile(upload.uploadUrl, readFileSync3(file.absPath), file.mimeType);
+    if (!file) {
+      throw new Error(`Server asked for unknown file ${upload.path}`);
+    }
+    await uploadFile(
+      upload.uploadUrl,
+      readFileSync3(file.absPath),
+      file.mimeType
+    );
   });
   const result = await client.finalize(session.publishSessionId);
   if (result.publishToken) {
     writeConfig(dir, {
+      apiUrl,
       artifactId: result.artifactId,
+      publishToken: result.publishToken,
       slug: slugFromUrl(result.url),
-      url: result.url,
-      apiUrl,
-      publishToken: result.publishToken
+      url: result.url
     });
   }
+  if (opts.password !== void 0) {
+    const protectClient = createApiClient(apiUrl, token ?? result.publishToken);
+    await protectClient.setProtection(result.artifactId, opts.password);
+  }
   if (opts.json) {
     console.log(
       JSON.stringify(
         {
           artifactId: result.artifactId,
-          versionNumber: result.versionNumber,
           url: result.url,
+          versionNumber: result.versionNumber,
           ...result.claimUrl ? { claimUrl: result.claimUrl } : {},
+          ...opts.password === void 0 ? {} : { protected: true },
           filesUploaded: session.filesToUpload.map((f) => f.path),
-          skippedFiles: session.skippedFiles,
-          ignored: skipped
+          ignored: skipped,
+          skippedFiles: session.skippedFiles
         },
         null,
         2
       )
     );
   } else if (result.versionNumber === 1) {
-    console.log(`
-\u2713 Published to artifact.cafe
-`);
+    console.log("\n\u2713 Published to artifact.cafe\n");
     console.log(`Review URL:
 ${result.url}
 `);
     if (result.claimUrl) {
-      console.log(`Claim URL (shown once \u2014 claim to keep this artifact):
+      console.log(
+        `Claim URL (shown once \u2014 claim to keep this artifact):
 ${result.claimUrl}
-`);
+`
+      );
+    }
+    if (opts.password !== void 0) {
+      console.log("Password protection: on\n");
     }
   } else {
     console.log(`
@@ -640,6 +781,9 @@ ${result.claimUrl}
 `);
     console.log(`${result.url}
 `);
+    if (opts.password !== void 0) {
+      console.log("Password protection: on\n");
+    }
   }
   if (opts.open && !opts.json && process.stdout.isTTY) {
     openInBrowser(result.url);
@@ -647,12 +791,19 @@ ${result.claimUrl}
 }
 async function inBatches(items, concurrency, fn) {
   let next = 0;
-  const workers = Array.from({ length: Math.min(concurrency, items.length) }, async () => {
-    while (next < items.length) {
-      const item = items[next++];
-      await fn(item);
+  const workers = Array.from(
+    { length: Math.min(concurrency, items.length) },
+    async () => {
+      while (next < items.length) {
+        const item = items[next];
+        next += 1;
+        if (item === void 0) {
+          continue;
+        }
+        await fn(item);
+      }
     }
-  });
+  );
   await Promise.all(workers);
 }
 function slugFromUrl(url) {
@@ -662,7 +813,12 @@ function preview(items) {
   return items.slice(0, 5).join(", ") + (items.length > 5 ? ", \u2026" : "");
 }
 function openInBrowser(url) {
-  const cmd = process.platform === "darwin" ? "open" : process.platform === "win32" ? "start" : "xdg-open";
+  let cmd = "xdg-open";
+  if (process.platform === "darwin") {
+    cmd = "open";
+  } else if (process.platform === "win32") {
+    cmd = "start";
+  }
   exec(`${cmd} ${JSON.stringify(url)}`, () => {
   });
 }
@@ -677,29 +833,85 @@ function openArtifact(opts) {
     );
   }
   console.log(config.url);
-  if (process.stdout.isTTY) openInBrowser(config.url);
+  if (process.stdout.isTTY) {
+    openInBrowser(config.url);
+  }
+}
+
+// src/protect.ts
+import path6 from "path";
+async function protect(opts) {
+  if (opts.off && opts.password !== void 0) {
+    throw new Error("Pass either --password or --off, not both.");
+  }
+  if (!opts.off && opts.password === void 0) {
+    throw new Error(
+      "Provide --password <password> to set a gate, or --off to remove it."
+    );
+  }
+  const password = opts.off ? null : opts.password;
+  if (password !== null) {
+    const parsed = gatePasswordSchema.safeParse(password);
+    if (!parsed.success) {
+      throw new Error(parsed.error.issues[0]?.message ?? "Invalid password.");
+    }
+  }
+  const dir = path6.resolve(opts.dir);
+  const config = readConfig(dir);
+  if (!config) {
+    throw new Error(
+      `No artifact linked in ${dir} \u2014 run \`artifact-cafe publish\` there first (.artifactcafe/config.json not found).`
+    );
+  }
+  const apiUrl = process.env.ARTIFACT_CAFE_URL ?? config.apiUrl;
+  const token = config.publishToken ?? process.env.ARTIFACT_CAFE_TOKEN;
+  const client = createApiClient(apiUrl, token);
+  const res = await client.setProtection(config.artifactId, password);
+  if (opts.json) {
+    console.log(JSON.stringify({ protected: res.protected }, null, 2));
+    return;
+  }
+  console.log(
+    res.protected ? `
+\u2713 Password protection on \u2014 ${config.url}
+` : `
+\u2713 Password protection removed \u2014 ${config.url}
+`
+  );
 }
 
 // src/index.ts
 var publish2 = defineCommand({
-  meta: { name: "publish", description: "Publish a folder as an artifact" },
   args: {
-    dir: { type: "positional", description: "Directory to publish", default: "." },
-    title: { type: "string", description: "Artifact title" },
-    entry: { type: "string", description: "Entry file (default: auto-detect)" },
-    artifact: { type: "string", description: "Publish to an existing artifact ID" },
-    json: { type: "boolean", description: "Machine-readable output" },
-    "no-open": { type: "boolean", description: "Don't open the review URL" }
+    artifact: {
+      description: "Publish to an existing artifact ID",
+      type: "string"
+    },
+    dir: {
+      default: ".",
+      description: "Directory to publish",
+      type: "positional"
+    },
+    entry: { description: "Entry file (default: auto-detect)", type: "string" },
+    json: { description: "Machine-readable output", type: "boolean" },
+    "no-open": { description: "Don't open the review URL", type: "boolean" },
+    password: {
+      description: "Password-protect the artifact (min 6 chars)",
+      type: "string"
+    },
+    title: { description: "Artifact title", type: "string" }
   },
+  meta: { description: "Publish a folder as an artifact", name: "publish" },
   async run({ args }) {
     try {
       await publish({
+        artifact: args.artifact,
         dir: args.dir,
-        title: args.title,
         entry: args.entry,
-        artifact: args.artifact,
         json: Boolean(args.json),
-        open: !args["no-open"]
+        open: !args["no-open"],
+        password: args.password,
+        title: args.title
       });
     } catch (err) {
       printCliError(err, Boolean(args.json));
@@ -708,12 +920,27 @@ var publish2 = defineCommand({
   }
 });
 var comments2 = defineCommand({
-  meta: { name: "comments", description: "Pull comments for the linked artifact" },
   args: {
-    dir: { type: "positional", description: "Published directory", default: "." },
-    json: { type: "boolean", description: "Machine-readable output" },
-    status: { type: "string", description: "Filter: open | resolved | all", default: "open" },
-    version: { type: "string", description: "Filter: current | all", default: "current" }
+    dir: {
+      default: ".",
+      description: "Published directory",
+      type: "positional"
+    },
+    json: { description: "Machine-readable output", type: "boolean" },
+    status: {
+      default: "open",
+      description: "Filter: open | resolved | all",
+      type: "string"
+    },
+    version: {
+      default: "current",
+      description: "Filter: current | all",
+      type: "string"
+    }
+  },
+  meta: {
+    description: "Pull comments for the linked artifact",
+    name: "comments"
   },
   async run({ args }) {
     try {
@@ -729,11 +956,44 @@ var comments2 = defineCommand({
     }
   }
 });
+var protect2 = defineCommand({
+  args: {
+    dir: {
+      default: ".",
+      description: "Published directory",
+      type: "positional"
+    },
+    json: { description: "Machine-readable output", type: "boolean" },
+    off: { description: "Remove the password gate", type: "boolean" },
+    password: { description: "Gate password (min 6 chars)", type: "string" }
+  },
+  meta: {
+    description: "Password-protect the linked artifact (or --off to remove)",
+    name: "protect"
+  },
+  async run({ args }) {
+    try {
+      await protect({
+        dir: args.dir,
+        json: Boolean(args.json),
+        off: Boolean(args.off),
+        password: args.password
+      });
+    } catch (err) {
+      printCliError(err, Boolean(args.json));
+      process.exit(1);
+    }
+  }
+});
 var open = defineCommand({
-  meta: { name: "open", description: "Open the linked artifact's review URL" },
   args: {
-    dir: { type: "positional", description: "Published directory", default: "." }
+    dir: {
+      default: ".",
+      description: "Published directory",
+      type: "positional"
+    }
   },
+  meta: { description: "Open the linked artifact's review URL", name: "open" },
   run({ args }) {
     try {
       openArtifact({ dir: args.dir });
@@ -743,18 +1003,11 @@ var open = defineCommand({
     }
   }
 });
-var login = defineCommand({
-  meta: { name: "login", description: "Log in (optional; needed for owner actions)" },
-  async run() {
-    console.error("login not implemented yet");
-    process.exit(1);
-  }
-});
 var main = defineCommand({
   meta: {
-    name: "artifact-cafe",
-    description: "Publish AI-generated artifacts for review \u2014 https://artifact.cafe"
+    description: "Publish AI-generated artifacts for review \u2014 https://artifact.cafe",
+    name: "artifact-cafe"
   },
-  subCommands: { publish: publish2, comments: comments2, open, login }
+  subCommands: { comments: comments2, open, protect: protect2, publish: publish2 }
 });
 runMain(main);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "artifact-cafe",
-  "version": "0.0.1",
+  "version": "0.0.2",
   "description": "Publish AI-generated artifacts for review on artifact.cafe",
   "type": "module",
   "bin": {