artifact-cafe 0.0.1 → 0.0.3

package/dist/index.js

@@ -6,135 +6,121 @@ import { defineCommand, runMain } from "citty";
 // src/comments.ts
 import path2 from "path";
 
-// ../shared/src/publish.ts
+// ../shared/src/account.ts
 import { z } from "zod";
-function isSafeArtifactPath(p) {
-  if (p.length === 0 || p.length > 1024) return false;
-  if (p.includes("\\") || p.includes("\0")) return false;
-  if (p.startsWith("/") || p.startsWith("~")) return false;
-  return p.split("/").every((seg) => seg.length > 0 && seg !== "." && seg !== "..");
-}
-var manifestFileSchema = z.object({
-  path: z.string().min(1).max(1024).refine(isSafeArtifactPath, { message: "path must be a safe relative path" }),
-  hash: z.string().regex(/^sha256_[a-f0-9]{64}$/),
-  size: z.number().int().positive(),
-  mimeType: z.string().regex(/^[-\w.+]+\/[-\w.+]+$/, { message: "invalid MIME type" })
-});
-var publishSourceSchema = z.object({
-  type: z.literal("cli"),
-  agent: z.string().optional(),
-  runId: z.string().optional()
-});
-var createPublishSessionSchema = z.object({
-  artifactId: z.string().nullable(),
-  title: z.string().max(200).optional(),
-  entryPath: z.string().optional(),
-  files: z.array(manifestFileSchema).min(1).max(1e3),
-  source: publishSourceSchema
-});
-var publishSessionResponseSchema = z.object({
-  publishSessionId: z.string(),
-  artifactId: z.string(),
-  versionId: z.string(),
-  filesToUpload: z.array(
-    z.object({
-      path: z.string(),
-      uploadUrl: z.string().url(),
-      method: z.literal("PUT")
-    })
-  ),
-  skippedFiles: z.array(z.string()),
-  expiresAt: z.string()
+var createApiKeySchema = z.object({
+  name: z.string().trim().min(1).max(60).optional()
 });
-var finalizeResponseSchema = z.object({
-  artifactId: z.string(),
-  versionId: z.string(),
-  versionNumber: z.number().int().positive(),
-  url: z.string().url(),
-  // Returned only on first publish of a new artifact (one-time).
-  claimUrl: z.string().url().optional(),
-  publishToken: z.string().optional()
+var createdApiKeySchema = z.object({
+  createdAt: z.string(),
+  id: z.string(),
+  key: z.string(),
+  keyPrefix: z.string(),
+  name: z.string()
+});
+var apiKeySummarySchema = z.object({
+  createdAt: z.string(),
+  id: z.string(),
+  keyPrefix: z.string(),
+  lastUsedAt: z.string().nullable(),
+  name: z.string()
+});
+var apiKeyListResponseSchema = z.object({
+  keys: z.array(apiKeySummarySchema)
+});
+var revokeApiKeyResponseSchema = z.object({
+  revoked: z.literal(true)
+});
+var meResponseSchema = z.object({
+  // Best-effort profile field from our own user table; null when unknown.
+  email: z.string().nullable(),
+  // Present when the request was authenticated with an API key.
+  keyName: z.string().optional(),
+  userId: z.string()
 });
-var artifactResponseSchema = z.object({
+var artifactListItemSchema = z.object({
+  createdAt: z.string(),
+  currentVersionNumber: z.number().int().positive().nullable(),
   id: z.string(),
+  openCommentCount: z.number().int().nonnegative(),
   slug: z.string(),
   title: z.string(),
-  currentVersion: z.object({
-    id: z.string(),
-    versionNumber: z.number().int().positive(),
-    entryUrl: z.string().url()
-  }).nullable(),
-  claimed: z.boolean()
+  updatedAt: z.string(),
+  url: z.string().url(),
+  versionCount: z.number().int().nonnegative()
+});
+var artifactListResponseSchema = z.object({
+  artifacts: z.array(artifactListItemSchema)
 });
 
 // ../shared/src/comments.ts
 import { z as z2 } from "zod";
 var elementSnapshotSchema = z2.object({
-  tag: z2.string().min(1).max(128),
-  id: z2.string().max(256).optional(),
   classes: z2.string().max(256).optional(),
+  id: z2.string().max(256).optional(),
+  tag: z2.string().min(1).max(128),
   text: z2.string().max(200).optional()
 });
 var pointAnchorSchema = z2.object({
-  type: z2.literal("point"),
+  element: elementSnapshotSchema.optional(),
   // elementPath is the primary anchor; x/y are offsets within the
   // element's box, normalized 0..1 (SPEC.md §8.1).
   elementPath: z2.string().max(2048),
-  x: z2.number().min(0).max(1),
-  y: z2.number().min(0).max(1),
-  viewportWidth: z2.number().int().positive().max(1e5),
+  type: z2.literal("point"),
   viewportHeight: z2.number().int().positive().max(1e5),
-  element: elementSnapshotSchema.optional()
+  viewportWidth: z2.number().int().positive().max(1e5),
+  x: z2.number().min(0).max(1),
+  y: z2.number().min(0).max(1)
 });
 var textAnchorSchema = z2.object({
-  type: z2.literal("text"),
-  quote: z2.string().min(1).max(1e3),
+  elementPath: z2.string().max(2048),
+  endOffset: z2.number().int().nonnegative().max(1e8),
   prefix: z2.string().max(200).optional(),
-  suffix: z2.string().max(200).optional(),
+  quote: z2.string().min(1).max(1e3),
   startOffset: z2.number().int().nonnegative().max(1e8),
-  endOffset: z2.number().int().nonnegative().max(1e8),
-  elementPath: z2.string().max(2048)
+  suffix: z2.string().max(200).optional(),
+  type: z2.literal("text")
 });
 var anchorSchema = z2.discriminatedUnion("type", [
   pointAnchorSchema,
   textAnchorSchema
 ]);
 var guestSchema = z2.object({
-  guestId: z2.string().min(16),
-  displayName: z2.string().min(1).max(64)
+  displayName: z2.string().min(1).max(64),
+  guestId: z2.string().min(16)
 });
 var createCommentThreadSchema = z2.object({
-  versionId: z2.string(),
-  guest: guestSchema.optional(),
   anchor: anchorSchema,
-  body: z2.string().min(1).max(1e4)
+  body: z2.string().min(1).max(1e4),
+  guest: guestSchema.optional(),
+  versionId: z2.string()
 });
 var createCommentMessageSchema = z2.object({
-  guest: guestSchema.optional(),
-  body: z2.string().min(1).max(1e4)
+  body: z2.string().min(1).max(1e4),
+  guest: guestSchema.optional()
 });
 var threadActionSchema = z2.object({
   guest: guestSchema.optional()
 });
 var commentAuthorSchema = z2.object({
-  guestId: z2.string().nullable(),
-  displayName: z2.string()
+  displayName: z2.string(),
+  guestId: z2.string().nullable()
 });
 var commentMessageSchema = z2.object({
-  id: z2.string(),
-  body: z2.string(),
   author: commentAuthorSchema,
-  createdAt: z2.string()
+  body: z2.string(),
+  createdAt: z2.string(),
+  id: z2.string()
 });
 var commentThreadSchema = z2.object({
-  id: z2.string(),
-  artifactId: z2.string(),
-  versionId: z2.string(),
   anchor: anchorSchema,
-  status: z2.enum(["open", "resolved"]),
-  createdBy: commentAuthorSchema,
+  artifactId: z2.string(),
   createdAt: z2.string(),
-  messages: z2.array(commentMessageSchema)
+  createdBy: commentAuthorSchema,
+  id: z2.string(),
+  messages: z2.array(commentMessageSchema),
+  status: z2.enum(["open", "resolved"]),
+  versionId: z2.string()
 });
 var commentThreadListSchema = z2.object({
   threads: z2.array(commentThreadSchema)
@@ -149,23 +135,25 @@ var commentExportReplySchema = z2.object({
   createdAt: z2.string()
 });
 var commentExportThreadSchema = z2.object({
-  id: z2.string(),
-  status: z2.enum(["open", "resolved"]),
-  versionNumber: z2.number().int().positive(),
+  anchor: anchorSchema,
   author: z2.string(),
   body: z2.string(),
-  anchor: anchorSchema,
   createdAt: z2.string(),
-  replies: z2.array(commentExportReplySchema)
+  id: z2.string(),
+  replies: z2.array(commentExportReplySchema),
+  status: z2.enum(["open", "resolved"]),
+  versionNumber: z2.number().int().positive()
 });
 var commentExportSchema = z2.object({
   artifactId: z2.string(),
+  comments: z2.array(commentExportThreadSchema),
   // The artifact's current version (null before the first finalize).
-  versionNumber: z2.number().int().positive().nullable(),
-  comments: z2.array(commentExportThreadSchema)
+  versionNumber: z2.number().int().positive().nullable()
 });
 function elementLabel(el) {
-  if (el.id) return `<${el.tag}#${el.id}>`;
+  if (el.id) {
+    return `<${el.tag}#${el.id}>`;
+  }
   const classes = el.classes ? el.classes.split(" ").slice(0, 2) : [];
   return classes.length ? `<${el.tag}.${classes.join(".")}>` : `<${el.tag}>`;
 }
@@ -174,57 +162,186 @@ function elementLabel(el) {
 import { z as z3 } from "zod";
 var apiErrorSchema = z3.object({
   code: z3.string(),
+  docsUrl: z3.string().url(),
   message: z3.string(),
-  retryAfter: z3.number().int().positive().optional(),
-  docsUrl: z3.string().url()
-});
-
-// ../shared/src/versions.ts
-import { z as z4 } from "zod";
-var versionSourceSchema = z4.object({
-  type: z4.string(),
-  agentName: z4.string().nullable()
-});
-var versionChangesSchema = z4.object({
-  added: z4.array(z4.string()),
-  changed: z4.array(z4.string()),
-  removed: z4.array(z4.string())
-});
-var versionSummarySchema = z4.object({
-  id: z4.string(),
-  versionNumber: z4.number().int().positive(),
-  createdAt: z4.string(),
-  entryUrl: z4.string().url(),
-  fileCount: z4.number().int().nonnegative(),
-  totalSizeBytes: z4.number().int().nonnegative(),
-  source: versionSourceSchema,
-  isCurrent: z4.boolean(),
-  // Absent for the first version — there is no previous version to diff against.
-  changes: versionChangesSchema.nullable()
-});
-var versionListResponseSchema = z4.object({
-  versions: z4.array(versionSummarySchema)
+  retryAfter: z3.number().int().positive().optional()
 });
 
 // ../shared/src/owner.ts
-import { z as z5 } from "zod";
+import { z as z4 } from "zod";
 var SLUG_PATTERN = /^[a-z0-9](?:[a-z0-9-]{1,61}[a-z0-9])$/;
-var claimResponseSchema = z5.object({
-  artifactId: z5.string(),
-  slug: z5.string(),
-  title: z5.string(),
-  url: z5.string().url()
-});
-var updateArtifactSchema = z5.object({
-  title: z5.string().min(1).max(200).optional(),
-  slug: z5.string().min(3).max(63).regex(SLUG_PATTERN, {
+var claimResponseSchema = z4.object({
+  artifactId: z4.string(),
+  slug: z4.string(),
+  title: z4.string(),
+  url: z4.string().url()
+});
+var updateArtifactSchema = z4.object({
+  slug: z4.string().min(3).max(63).regex(SLUG_PATTERN, {
     message: "slug must be lowercase letters, digits, and hyphens, with no leading/trailing hyphen"
-  }).optional()
+  }).optional(),
+  title: z4.string().min(1).max(200).optional()
 }).refine((body) => body.title !== void 0 || body.slug !== void 0, {
   message: "provide at least one of title, slug"
 });
-var deleteArtifactResponseSchema = z5.object({
-  deleted: z5.literal(true)
+var deleteArtifactResponseSchema = z4.object({
+  deleted: z4.literal(true)
+});
+
+// ../shared/src/protection.ts
+import { z as z5 } from "zod";
+var PASSWORD_MIN = 6;
+var PASSWORD_MAX = 128;
+var gatePasswordSchema = z5.string().min(PASSWORD_MIN, `Password must be at least ${PASSWORD_MIN} characters.`).max(PASSWORD_MAX, `Password must be at most ${PASSWORD_MAX} characters.`);
+var setProtectionSchema = z5.object({
+  password: gatePasswordSchema.nullable()
+});
+var protectionResponseSchema = z5.object({
+  protected: z5.boolean()
+});
+var unlockSchema = z5.object({
+  password: z5.string().min(1).max(1024)
+});
+var unlockResponseSchema = z5.object({
+  unlocked: z5.literal(true)
+});
+
+// ../shared/src/publish.ts
+import { z as z6 } from "zod";
+function isSafeArtifactPath(p) {
+  if (p.length === 0 || p.length > 1024) {
+    return false;
+  }
+  if (p.includes("\\") || p.includes("\0")) {
+    return false;
+  }
+  if (p.startsWith("/") || p.startsWith("~")) {
+    return false;
+  }
+  return p.split("/").every((seg) => seg.length > 0 && seg !== "." && seg !== "..");
+}
+var manifestFileSchema = z6.object({
+  hash: z6.string().regex(/^sha256_[a-f0-9]{64}$/),
+  mimeType: z6.string().regex(/^[-\w.+]+\/[-\w.+]+$/, { message: "invalid MIME type" }),
+  path: z6.string().min(1).max(1024).refine(isSafeArtifactPath, {
+    message: "path must be a safe relative path"
+  }),
+  size: z6.number().int().positive()
+});
+var publishSourceSchema = z6.object({
+  agent: z6.string().optional(),
+  runId: z6.string().optional(),
+  type: z6.literal("cli")
+});
+var createPublishSessionSchema = z6.object({
+  artifactId: z6.string().nullable(),
+  entryPath: z6.string().optional(),
+  files: z6.array(manifestFileSchema).min(1).max(1e3),
+  source: publishSourceSchema,
+  title: z6.string().max(200).optional()
+});
+var publishSessionResponseSchema = z6.object({
+  artifactId: z6.string(),
+  expiresAt: z6.string(),
+  filesToUpload: z6.array(
+    z6.object({
+      method: z6.literal("PUT"),
+      path: z6.string(),
+      uploadUrl: z6.string().url()
+    })
+  ),
+  publishSessionId: z6.string(),
+  skippedFiles: z6.array(z6.string()),
+  versionId: z6.string()
+});
+var finalizeResponseSchema = z6.object({
+  artifactId: z6.string(),
+  // API-key publishes create the artifact already claimed (SPEC §5.4) —
+  // the CLI uses this to tell "claim URL pending" from "already yours".
+  claimed: z6.boolean(),
+  // Returned only on first publish of a new artifact (one-time).
+  claimUrl: z6.string().url().optional(),
+  publishToken: z6.string().optional(),
+  url: z6.string().url(),
+  versionId: z6.string(),
+  versionNumber: z6.number().int().positive()
+});
+var artifactResponseSchema = z6.object({
+  claimed: z6.boolean(),
+  currentVersion: z6.object({
+    entryUrl: z6.string().url(),
+    id: z6.string(),
+    versionNumber: z6.number().int().positive()
+  }).nullable(),
+  id: z6.string(),
+  slug: z6.string(),
+  title: z6.string()
+});
+
+// ../shared/src/report.ts
+import { z as z7 } from "zod";
+var reportRequestSchema = z7.object({
+  reason: z7.string().max(1e3).optional()
+});
+var reportResponseSchema = z7.object({
+  reported: z7.literal(true)
+});
+
+// ../shared/src/stats.ts
+import { z as z8 } from "zod";
+var avgViewSecondsSchema = z8.number().int().nonnegative().nullable();
+var versionViewStatsSchema = z8.object({
+  avgViewSeconds: avgViewSecondsSchema,
+  // Views from inside the review shell's iframe vs. direct visits to
+  // the render URL. views = embeddedViews + directViews.
+  directViews: z8.number().int().nonnegative(),
+  embeddedViews: z8.number().int().nonnegative(),
+  // Distinct hashed viewer IPs across the version's lifetime.
+  uniqueViewers: z8.number().int().nonnegative(),
+  versionNumber: z8.number().int().positive(),
+  views: z8.number().int().nonnegative()
+});
+var dailyViewsSchema = z8.object({
+  avgViewSeconds: avgViewSecondsSchema,
+  // UTC day, YYYY-MM-DD.
+  day: z8.string(),
+  uniqueViewers: z8.number().int().nonnegative(),
+  views: z8.number().int().nonnegative()
+});
+var artifactStatsResponseSchema = z8.object({
+  avgViewSeconds: avgViewSecondsSchema,
+  daily: z8.array(dailyViewsSchema),
+  // Distinct hashed viewer IPs across all versions and days.
+  totalUniqueViewers: z8.number().int().nonnegative(),
+  totalViews: z8.number().int().nonnegative(),
+  versions: z8.array(versionViewStatsSchema)
+});
+
+// ../shared/src/versions.ts
+import { z as z9 } from "zod";
+var versionSourceSchema = z9.object({
+  agentName: z9.string().nullable(),
+  type: z9.string()
+});
+var versionChangesSchema = z9.object({
+  added: z9.array(z9.string()),
+  changed: z9.array(z9.string()),
+  removed: z9.array(z9.string())
+});
+var versionSummarySchema = z9.object({
+  // Absent for the first version — there is no previous version to diff against.
+  changes: versionChangesSchema.nullable(),
+  createdAt: z9.string(),
+  entryUrl: z9.string().url(),
+  fileCount: z9.number().int().nonnegative(),
+  id: z9.string(),
+  isCurrent: z9.boolean(),
+  source: versionSourceSchema,
+  totalSizeBytes: z9.number().int().nonnegative(),
+  versionNumber: z9.number().int().positive()
+});
+var versionListResponseSchema = z9.object({
+  versions: z9.array(versionSummarySchema)
 });
 
 // src/api.ts
@@ -246,7 +363,8 @@ async function request(url, init, parse) {
     res = await fetch(url, init);
   } catch (err) {
     throw new Error(
-      `Could not reach ${new URL(url).origin} \u2014 is the API up? (${err instanceof Error ? err.message : err})`
+      `Could not reach ${new URL(url).origin} \u2014 is the API up? (${err instanceof Error ? err.message : err})`,
+      { cause: err }
     );
   }
   const body = await res.json().catch(() => null);
@@ -260,26 +378,45 @@ async function request(url, init, parse) {
         parsed.data.retryAfter
       );
     }
-    throw new ApiRequestError(res.status, "unknown_error", `API returned ${res.status}`);
+    throw new ApiRequestError(
+      res.status,
+      "unknown_error",
+      `API returned ${res.status}`
+    );
   }
   return parse(body);
 }
-function createApiClient(apiUrl, publishToken) {
-  const base = apiUrl.replace(/\/$/, "");
-  const headers = { "content-type": "application/json" };
-  if (publishToken) headers.authorization = `Bearer ${publishToken}`;
+function createApiClient(apiUrl2, publishToken) {
+  const base = apiUrl2.replace(/\/$/, "");
+  const headers = {
+    "content-type": "application/json"
+  };
+  if (publishToken) {
+    headers.authorization = `Bearer ${publishToken}`;
+  }
   return {
     async createSession(body) {
       return request(
         `${base}/api/v1/publish`,
-        { method: "POST", headers, body: JSON.stringify(body) },
+        { body: JSON.stringify(body), headers, method: "POST" },
         (d) => publishSessionResponseSchema.parse(d)
       );
     },
+    async exportComments(artifactId, query) {
+      const params = new URLSearchParams({
+        status: query.status,
+        version: query.version
+      });
+      return request(
+        `${base}/api/v1/artifacts/${artifactId}/comments/export?${params}`,
+        { method: "GET" },
+        (d) => commentExportSchema.parse(d)
+      );
+    },
     async finalize(publishSessionId) {
       return request(
         `${base}/api/v1/publish/${publishSessionId}/finalize`,
-        { method: "POST", headers },
+        { headers, method: "POST" },
         (d) => finalizeResponseSchema.parse(d)
       );
     },
@@ -290,43 +427,75 @@ function createApiClient(apiUrl, publishToken) {
         (d) => artifactResponseSchema.parse(d)
       );
     },
-    async exportComments(artifactId, query) {
-      const params = new URLSearchParams({ status: query.status, version: query.version });
+    // SPEC §6.18 — everything owned by the account this client's API
+    // key (or session) belongs to.
+    async listArtifacts() {
       return request(
-        `${base}/api/v1/artifacts/${artifactId}/comments/export?${params}`,
-        { method: "GET" },
-        (d) => commentExportSchema.parse(d)
+        `${base}/api/v1/artifacts`,
+        { headers, method: "GET" },
+        (d) => artifactListResponseSchema.parse(d)
+      );
+    },
+    // SPEC §6.14 — who the presented credential belongs to. Used by
+    // `login` to verify a pasted key and by `whoami`.
+    async me() {
+      return request(
+        `${base}/api/v1/me`,
+        { headers, method: "GET" },
+        (d) => meResponseSchema.parse(d)
+      );
+    },
+    // SPEC §6.16 — set a password (string) or clear it (null). Authorized
+    // by the publish token this client was created with.
+    async setProtection(artifactId, password) {
+      return request(
+        `${base}/api/v1/artifacts/${artifactId}/protection`,
+        { body: JSON.stringify({ password }), headers, method: "PUT" },
+        (d) => protectionResponseSchema.parse(d)
       );
     }
   };
 }
 async function uploadFile(uploadUrl, content, mimeType) {
   const res = await fetch(uploadUrl, {
-    method: "PUT",
-    headers: { "content-type": mimeType, "content-length": String(content.byteLength) },
-    body: new Uint8Array(content)
+    body: new Uint8Array(content),
+    headers: {
+      "content-length": String(content.byteLength),
+      "content-type": mimeType
+    },
+    method: "PUT"
   });
   if (!res.ok) {
-    throw new Error(`Upload failed (${res.status}): ${(await res.text()).slice(0, 200)}`);
+    throw new Error(
+      `Upload failed (${res.status}): ${(await res.text()).slice(0, 200)}`
+    );
   }
 }
 
 // src/config.ts
-import { existsSync, mkdirSync, readFileSync, writeFileSync, appendFileSync } from "fs";
+import {
+  appendFileSync,
+  existsSync,
+  mkdirSync,
+  readFileSync,
+  writeFileSync
+} from "fs";
 import path from "path";
-import { z as z6 } from "zod";
-var configSchema = z6.object({
-  artifactId: z6.string(),
-  slug: z6.string(),
-  url: z6.string(),
-  apiUrl: z6.string(),
-  publishToken: z6.string()
+import { z as z10 } from "zod";
+var configSchema = z10.object({
+  apiUrl: z10.string(),
+  artifactId: z10.string(),
+  publishToken: z10.string(),
+  slug: z10.string(),
+  url: z10.string()
 });
 var CONFIG_DIR = ".artifactcafe";
 var CONFIG_FILE = "config.json";
 function readConfig(dir) {
   const file = path.join(dir, CONFIG_DIR, CONFIG_FILE);
-  if (!existsSync(file)) return null;
+  if (!existsSync(file)) {
+    return null;
+  }
   try {
     return configSchema.parse(JSON.parse(readFileSync(file, "utf8")));
   } catch {
@@ -337,24 +506,30 @@ function writeConfig(dir, config) {
   mkdirSync(path.join(dir, CONFIG_DIR), { recursive: true });
   writeFileSync(
     path.join(dir, CONFIG_DIR, CONFIG_FILE),
-    JSON.stringify(config, null, 2) + "\n",
+    `${JSON.stringify(config, null, 2)}
+`,
     { mode: 384 }
   );
   ensureGitignored(dir);
 }
 function ensureGitignored(dir) {
   const gitignore = path.join(dir, ".gitignore");
-  if (!existsSync(gitignore)) return;
+  if (!existsSync(gitignore)) {
+    return;
+  }
   const lines = readFileSync(gitignore, "utf8").split(/\r?\n/);
   const present = lines.some((l) => {
     const t = l.trim();
     return t === CONFIG_DIR || t === `${CONFIG_DIR}/` || t === `/${CONFIG_DIR}` || t === `/${CONFIG_DIR}/`;
   });
   if (!present) {
-    appendFileSync(gitignore, `
+    appendFileSync(
+      gitignore,
+      `
 # artifact.cafe publish token
 ${CONFIG_DIR}/
-`);
+`
+    );
   }
 }
 
@@ -363,10 +538,14 @@ var STATUSES = ["open", "resolved", "all"];
 var VERSIONS = ["current", "all"];
 async function comments(opts) {
   if (!STATUSES.includes(opts.status)) {
-    throw new Error(`--status must be one of: ${STATUSES.join(", ")} (got "${opts.status}").`);
+    throw new Error(
+      `--status must be one of: ${STATUSES.join(", ")} (got "${opts.status}").`
+    );
   }
   if (!VERSIONS.includes(opts.version)) {
-    throw new Error(`--version must be one of: ${VERSIONS.join(", ")} (got "${opts.version}").`);
+    throw new Error(
+      `--version must be one of: ${VERSIONS.join(", ")} (got "${opts.version}").`
+    );
   }
   const status = opts.status;
   const version = opts.version;
@@ -377,9 +556,12 @@ async function comments(opts) {
       `No artifact linked in ${dir} \u2014 run \`artifact-cafe publish\` there first (.artifactcafe/config.json not found).`
     );
   }
-  const apiUrl = process.env.ARTIFACT_CAFE_URL ?? config.apiUrl;
-  const client = createApiClient(apiUrl);
-  const data = await client.exportComments(config.artifactId, { status, version });
+  const apiUrl2 = process.env.ARTIFACT_CAFE_URL ?? config.apiUrl;
+  const client = createApiClient(apiUrl2);
+  const data = await client.exportComments(config.artifactId, {
+    status,
+    version
+  });
   if (opts.json) {
     console.log(JSON.stringify(data, null, 2));
     return;
@@ -388,14 +570,19 @@ async function comments(opts) {
 }
 function printHuman(data, url, status, version) {
   const statusLabel = status === "all" ? "" : `${status} `;
-  const scope = version === "current" ? data.versionNumber !== null ? `on v${data.versionNumber}` : "on the current version" : "across all versions";
+  let scope = "across all versions";
+  if (version === "current") {
+    scope = data.versionNumber === null ? "on the current version" : `on v${data.versionNumber}`;
+  }
   if (data.comments.length === 0) {
     console.log(`No ${statusLabel}comments ${scope}.`);
     return;
   }
   const plural = data.comments.length === 1 ? "" : "s";
-  console.log(`${data.comments.length} ${statusLabel}thread${plural} ${scope} \u2014 ${url}
-`);
+  console.log(
+    `${data.comments.length} ${statusLabel}thread${plural} ${scope} \u2014 ${url}
+`
+  );
   for (const thread of data.comments) {
     printThread(thread);
   }
@@ -403,7 +590,9 @@ function printHuman(data, url, status, version) {
 function printThread(t) {
   const marker = t.status === "resolved" ? "\u2713" : "\u25CF";
   const date = t.createdAt.slice(0, 10);
-  console.log(`${marker} ${t.author} \xB7 v${t.versionNumber} \xB7 ${date} \xB7 ${t.id}`);
+  console.log(
+    `${marker} ${t.author} \xB7 v${t.versionNumber} \xB7 ${date} \xB7 ${t.id}`
+  );
   if (t.anchor.type === "text") {
     console.log(`  \u21B3 "${t.anchor.quote}"`);
   } else if (t.anchor.element) {
@@ -429,73 +618,203 @@ function printCliError(err, json) {
     if (json) {
       console.log(
         JSON.stringify({
-          error: { code: err.code, message: err.message, retryAfter: err.retryAfter }
+          error: {
+            code: err.code,
+            message: err.message,
+            retryAfter: err.retryAfter
+          }
         })
       );
     } else {
       console.error(`\u2717 ${err.message} (${err.code})`);
-      if (err.retryAfter) console.error(`  Retry in ${err.retryAfter}s.`);
+      if (err.retryAfter) {
+        console.error(`  Retry in ${err.retryAfter}s.`);
+      }
     }
     return;
   }
   const message = err instanceof Error ? err.message : String(err);
-  if (json) console.log(JSON.stringify({ error: { code: "cli_error", message } }));
-  else console.error(`\u2717 ${message}`);
+  if (json) {
+    console.log(JSON.stringify({ error: { code: "cli_error", message } }));
+  } else {
+    console.error(`\u2717 ${message}`);
+  }
 }
 
-// src/open.ts
-import path5 from "path";
+// src/credentials.ts
+import { existsSync as existsSync2, mkdirSync as mkdirSync2, readFileSync as readFileSync2, writeFileSync as writeFileSync2 } from "fs";
+import { homedir } from "os";
+import path3 from "path";
+import { z as z11 } from "zod";
+var DEFAULT_API_URL = "https://artifact.cafe";
+var credentialsSchema = z11.object({
+  keys: z11.record(z11.string(), z11.string()),
+  version: z11.literal(1)
+});
+function credentialsPath() {
+  return path3.join(homedir(), ".artifactcafe", "credentials");
+}
+function apiOrigin(apiUrl2) {
+  return new URL(apiUrl2).origin;
+}
+function readCredentials() {
+  const file = credentialsPath();
+  if (!existsSync2(file)) {
+    return { keys: {}, version: 1 };
+  }
+  try {
+    return credentialsSchema.parse(JSON.parse(readFileSync2(file, "utf8")));
+  } catch {
+    return { keys: {}, version: 1 };
+  }
+}
+function writeCredentials(credentials) {
+  const file = credentialsPath();
+  mkdirSync2(path3.dirname(file), { mode: 448, recursive: true });
+  writeFileSync2(file, `${JSON.stringify(credentials, null, 2)}
+`, {
+    mode: 384
+  });
+}
+function storedApiKey(apiUrl2) {
+  return readCredentials().keys[apiOrigin(apiUrl2)] ?? null;
+}
+function storeApiKey(apiUrl2, key) {
+  const credentials = readCredentials();
+  credentials.keys[apiOrigin(apiUrl2)] = key;
+  writeCredentials(credentials);
+}
+function removeApiKey(apiUrl2) {
+  const credentials = readCredentials();
+  const origin = apiOrigin(apiUrl2);
+  if (!(origin in credentials.keys)) {
+    return false;
+  }
+  delete credentials.keys[origin];
+  writeCredentials(credentials);
+  return true;
+}
+function resolveApiKey(apiUrl2, flag) {
+  return flag ?? process.env.ARTIFACT_CAFE_API_KEY ?? storedApiKey(apiUrl2) ?? void 0;
+}
+
+// src/list.ts
+async function list(opts) {
+  const apiUrl2 = (process.env.ARTIFACT_CAFE_URL ?? DEFAULT_API_URL).replace(
+    /\/$/,
+    ""
+  );
+  const key = resolveApiKey(apiUrl2, opts.apiKey);
+  if (!key) {
+    throw new Error(
+      `Listing your artifacts needs an account \u2014 run \`artifact-cafe login\` first (no API key for ${apiOrigin(apiUrl2)}).`
+    );
+  }
+  const data = await createApiClient(apiUrl2, key).listArtifacts();
+  if (opts.json) {
+    console.log(JSON.stringify(data, null, 2));
+    return;
+  }
+  if (data.artifacts.length === 0) {
+    console.log(
+      "No artifacts in your account yet \u2014 publish while logged in, or claim one via its claim link."
+    );
+    return;
+  }
+  const plural = data.artifacts.length === 1 ? "" : "s";
+  console.log(`${data.artifacts.length} artifact${plural}
+`);
+  for (const artifact of data.artifacts) {
+    printArtifact(artifact);
+  }
+}
+function printArtifact(a) {
+  const version = a.currentVersionNumber === null ? "no version" : `v${a.currentVersionNumber}`;
+  const open2 = a.openCommentCount === 0 ? "no open comments" : `${a.openCommentCount} open comment${a.openCommentCount === 1 ? "" : "s"}`;
+  const marker = a.openCommentCount > 0 ? "\u25CF" : "\u25CB";
+  console.log(`${marker} ${a.title}`);
+  console.log(`  ${version} \xB7 ${open2} \xB7 updated ${relativeTime(a.updatedAt)}`);
+  console.log(`  ${a.url}
+`);
+}
+function relativeTime(iso) {
+  const seconds = Math.max(0, (Date.now() - new Date(iso).getTime()) / 1e3);
+  if (seconds < 60) {
+    return "just now";
+  }
+  if (seconds < 3600) {
+    return `${Math.floor(seconds / 60)}m ago`;
+  }
+  if (seconds < 86400) {
+    return `${Math.floor(seconds / 3600)}h ago`;
+  }
+  if (seconds < 30 * 86400) {
+    return `${Math.floor(seconds / 86400)}d ago`;
+  }
+  return iso.slice(0, 10);
+}
+
+// src/login.ts
+import { createInterface } from "readline";
 
 // src/publish.ts
-import { readFileSync as readFileSync3 } from "fs";
-import path4 from "path";
 import { exec } from "child_process";
+import { readFileSync as readFileSync4 } from "fs";
+import path5 from "path";
 
 // src/manifest.ts
 import { createHash } from "crypto";
-import { readdirSync, readFileSync as readFileSync2, statSync } from "fs";
-import path3 from "path";
+import { readdirSync, readFileSync as readFileSync3, statSync } from "fs";
+import path4 from "path";
 var IGNORED_DIRS = /* @__PURE__ */ new Set([".git", "node_modules", ".artifactcafe"]);
 var IGNORED_FILES = /* @__PURE__ */ new Set([".DS_Store"]);
 function isIgnoredFile(name) {
-  if (IGNORED_FILES.has(name)) return true;
-  if (name === ".env" || name.startsWith(".env.")) return true;
-  if (name.endsWith(".pem") || name.endsWith(".key")) return true;
-  if (name.startsWith(".git")) return true;
+  if (IGNORED_FILES.has(name)) {
+    return true;
+  }
+  if (name === ".env" || name.startsWith(".env.")) {
+    return true;
+  }
+  if (name.endsWith(".pem") || name.endsWith(".key")) {
+    return true;
+  }
+  if (name.startsWith(".git")) {
+    return true;
+  }
   return false;
 }
 var MIME_TYPES = {
-  ".html": "text/html",
-  ".htm": "text/html",
+  ".avif": "image/avif",
   ".css": "text/css",
+  ".gif": "image/gif",
+  ".htm": "text/html",
+  ".html": "text/html",
+  ".ico": "image/x-icon",
+  ".jpeg": "image/jpeg",
+  ".jpg": "image/jpeg",
   ".js": "text/javascript",
-  ".mjs": "text/javascript",
   ".json": "application/json",
   ".map": "application/json",
-  ".txt": "text/plain",
   ".md": "text/markdown",
-  ".xml": "application/xml",
-  ".svg": "image/svg+xml",
+  ".mjs": "text/javascript",
+  ".mp3": "audio/mpeg",
+  ".mp4": "video/mp4",
+  ".otf": "font/otf",
+  ".pdf": "application/pdf",
   ".png": "image/png",
-  ".jpg": "image/jpeg",
-  ".jpeg": "image/jpeg",
-  ".gif": "image/gif",
+  ".svg": "image/svg+xml",
+  ".ttf": "font/ttf",
+  ".txt": "text/plain",
+  ".wasm": "application/wasm",
+  ".wav": "audio/wav",
+  ".webm": "video/webm",
   ".webp": "image/webp",
-  ".avif": "image/avif",
-  ".ico": "image/x-icon",
   ".woff": "font/woff",
   ".woff2": "font/woff2",
-  ".ttf": "font/ttf",
-  ".otf": "font/otf",
-  ".pdf": "application/pdf",
-  ".mp4": "video/mp4",
-  ".webm": "video/webm",
-  ".mp3": "audio/mpeg",
-  ".wav": "audio/wav",
-  ".wasm": "application/wasm"
+  ".xml": "application/xml"
 };
 function mimeFor(filePath) {
-  return MIME_TYPES[path3.extname(filePath).toLowerCase()] ?? "application/octet-stream";
+  return MIME_TYPES[path4.extname(filePath).toLowerCase()] ?? "application/octet-stream";
 }
 function scanDirectory(dir) {
   const files = [];
@@ -503,7 +822,7 @@ function scanDirectory(dir) {
   function walk(current, relPrefix) {
     for (const entry of readdirSync(current, { withFileTypes: true })) {
       const rel = relPrefix ? `${relPrefix}/${entry.name}` : entry.name;
-      const abs = path3.join(current, entry.name);
+      const abs = path4.join(current, entry.name);
       if (entry.isSymbolicLink()) {
         skipped.push(rel);
         continue;
@@ -516,23 +835,25 @@ function scanDirectory(dir) {
         }
         continue;
       }
-      if (!entry.isFile()) continue;
+      if (!entry.isFile()) {
+        continue;
+      }
       if (isIgnoredFile(entry.name) || !isSafeArtifactPath(rel)) {
         skipped.push(rel);
         continue;
       }
-      const size = statSync(abs).size;
+      const { size } = statSync(abs);
       if (size === 0) {
         skipped.push(rel);
         continue;
       }
-      const content = readFileSync2(abs);
+      const content = readFileSync3(abs);
       files.push({
-        path: rel,
+        absPath: abs,
         hash: `sha256_${createHash("sha256").update(content).digest("hex")}`,
-        size,
         mimeType: mimeFor(rel),
-        absPath: abs
+        path: rel,
+        size
       });
     }
   }
@@ -543,96 +864,146 @@ function scanDirectory(dir) {
 function resolveEntry(files, explicit) {
   if (explicit) {
     if (!files.some((f) => f.path === explicit)) {
-      throw new Error(`Entry file "${explicit}" not found in the publish folder.`);
+      throw new Error(
+        `Entry file "${explicit}" not found in the publish folder.`
+      );
     }
     return explicit;
   }
-  if (files.some((f) => f.path === "index.html")) return "index.html";
-  const htmlFiles = files.filter((f) => f.path.endsWith(".html") && !f.path.includes("/"));
-  if (htmlFiles.length === 1) return htmlFiles[0].path;
+  if (files.some((f) => f.path === "index.html")) {
+    return "index.html";
+  }
+  const htmlFiles = files.filter(
+    (f) => f.path.endsWith(".html") && !f.path.includes("/")
+  );
+  const [onlyHtmlFile] = htmlFiles;
+  if (onlyHtmlFile && htmlFiles.length === 1) {
+    return onlyHtmlFile.path;
+  }
   throw new Error(
     htmlFiles.length === 0 ? "No entry file found. Add an index.html or pass --entry <file>." : `Multiple HTML files found (${htmlFiles.map((f) => f.path).join(", ")}). Pass --entry <file>.`
   );
 }
 
 // src/publish.ts
-var DEFAULT_API_URL = "https://artifact.cafe";
 var UPLOAD_CONCURRENCY = 6;
 async function publish(opts) {
-  const dir = path4.resolve(opts.dir);
+  const dir = path5.resolve(opts.dir);
   const config = readConfig(dir);
+  if (opts.password !== void 0) {
+    const parsed = gatePasswordSchema.safeParse(opts.password);
+    if (!parsed.success) {
+      throw new Error(parsed.error.issues[0]?.message ?? "Invalid password.");
+    }
+  }
   const artifactId = opts.artifact ?? config?.artifactId ?? null;
   const token = (artifactId !== null && artifactId === config?.artifactId ? config.publishToken : void 0) ?? process.env.ARTIFACT_CAFE_TOKEN;
-  const apiUrl = process.env.ARTIFACT_CAFE_URL ?? config?.apiUrl ?? DEFAULT_API_URL;
+  const apiUrl2 = process.env.ARTIFACT_CAFE_URL ?? config?.apiUrl ?? DEFAULT_API_URL;
+  const apiKey = resolveApiKey(apiUrl2, opts.apiKey);
   const { files, skipped } = scanDirectory(dir);
   if (files.length === 0) {
     throw new Error(`Nothing to publish in ${dir} (after ignore rules).`);
   }
   const entryPath = resolveEntry(files, opts.entry);
   const log = (msg) => {
-    if (!opts.json) console.log(msg);
+    if (!opts.json) {
+      console.log(msg);
+    }
   };
   if (skipped.length) {
     log(`  ignoring ${skipped.length} item(s): ${preview(skipped)}`);
   }
-  const client = createApiClient(apiUrl, token);
-  const session = await client.createSession({
+  const sessionBody = {
     artifactId,
-    title: opts.title,
     entryPath,
     files: files.map(({ absPath: _absPath, ...manifest }) => manifest),
     source: {
-      type: "cli",
       agent: process.env.ARTIFACT_CAFE_AGENT,
-      runId: process.env.ARTIFACT_CAFE_RUN_ID
+      runId: process.env.ARTIFACT_CAFE_RUN_ID,
+      type: "cli"
+    },
+    title: opts.title
+  };
+  let credential = apiKey ?? token;
+  let client = createApiClient(apiUrl2, credential);
+  let session;
+  try {
+    session = await client.createSession(sessionBody);
+  } catch (err) {
+    const keyRefused = apiKey !== void 0 && token !== void 0 && apiKey !== token && artifactId !== null && err instanceof ApiRequestError && (err.status === 401 || err.status === 403);
+    if (!keyRefused) {
+      throw err;
     }
-  });
+    credential = token;
+    client = createApiClient(apiUrl2, credential);
+    session = await client.createSession(sessionBody);
+  }
   const byPath = new Map(files.map((f) => [f.path, f]));
   log(
     `  uploading ${session.filesToUpload.length} file(s)` + (session.skippedFiles.length ? `, ${session.skippedFiles.length} unchanged` : "")
   );
   await inBatches(session.filesToUpload, UPLOAD_CONCURRENCY, async (upload) => {
     const file = byPath.get(upload.path);
-    if (!file) throw new Error(`Server asked for unknown file ${upload.path}`);
-    await uploadFile(upload.uploadUrl, readFileSync3(file.absPath), file.mimeType);
+    if (!file) {
+      throw new Error(`Server asked for unknown file ${upload.path}`);
+    }
+    await uploadFile(
+      upload.uploadUrl,
+      readFileSync4(file.absPath),
+      file.mimeType
+    );
   });
   const result = await client.finalize(session.publishSessionId);
   if (result.publishToken) {
     writeConfig(dir, {
+      apiUrl: apiUrl2,
       artifactId: result.artifactId,
+      publishToken: result.publishToken,
       slug: slugFromUrl(result.url),
-      url: result.url,
-      apiUrl,
-      publishToken: result.publishToken
+      url: result.url
     });
   }
+  if (opts.password !== void 0) {
+    const protectClient = createApiClient(
+      apiUrl2,
+      credential ?? result.publishToken
+    );
+    await protectClient.setProtection(result.artifactId, opts.password);
+  }
   if (opts.json) {
     console.log(
       JSON.stringify(
         {
           artifactId: result.artifactId,
-          versionNumber: result.versionNumber,
+          claimed: result.claimed,
           url: result.url,
+          versionNumber: result.versionNumber,
           ...result.claimUrl ? { claimUrl: result.claimUrl } : {},
+          ...opts.password === void 0 ? {} : { protected: true },
           filesUploaded: session.filesToUpload.map((f) => f.path),
-          skippedFiles: session.skippedFiles,
-          ignored: skipped
+          ignored: skipped,
+          skippedFiles: session.skippedFiles
         },
         null,
         2
       )
     );
   } else if (result.versionNumber === 1) {
-    console.log(`
-\u2713 Published to artifact.cafe
-`);
+    console.log("\n\u2713 Published to artifact.cafe\n");
     console.log(`Review URL:
 ${result.url}
 `);
     if (result.claimUrl) {
-      console.log(`Claim URL (shown once \u2014 claim to keep this artifact):
+      console.log(
+        `Claim URL (shown once \u2014 claim to keep this artifact):
 ${result.claimUrl}
-`);
+`
+      );
+    } else if (result.claimed) {
+      console.log("Claimed by your account \u2014 no expiry.\n");
+    }
+    if (opts.password !== void 0) {
+      console.log("Password protection: on\n");
     }
   } else {
     console.log(`
@@ -640,6 +1011,9 @@ ${result.claimUrl}
 `);
     console.log(`${result.url}
 `);
+    if (opts.password !== void 0) {
+      console.log("Password protection: on\n");
+    }
   }
   if (opts.open && !opts.json && process.stdout.isTTY) {
     openInBrowser(result.url);
@@ -647,12 +1021,19 @@ ${result.claimUrl}
 }
 async function inBatches(items, concurrency, fn) {
   let next = 0;
-  const workers = Array.from({ length: Math.min(concurrency, items.length) }, async () => {
-    while (next < items.length) {
-      const item = items[next++];
-      await fn(item);
+  const workers = Array.from(
+    { length: Math.min(concurrency, items.length) },
+    async () => {
+      while (next < items.length) {
+        const item = items[next];
+        next += 1;
+        if (item === void 0) {
+          continue;
+        }
+        await fn(item);
+      }
     }
-  });
+  );
   await Promise.all(workers);
 }
 function slugFromUrl(url) {
@@ -662,14 +1043,133 @@ function preview(items) {
   return items.slice(0, 5).join(", ") + (items.length > 5 ? ", \u2026" : "");
 }
 function openInBrowser(url) {
-  const cmd = process.platform === "darwin" ? "open" : process.platform === "win32" ? "start" : "xdg-open";
+  let cmd = "xdg-open";
+  if (process.platform === "darwin") {
+    cmd = "open";
+  } else if (process.platform === "win32") {
+    cmd = "start";
+  }
   exec(`${cmd} ${JSON.stringify(url)}`, () => {
   });
 }
 
+// src/login.ts
+function apiUrl() {
+  return (process.env.ARTIFACT_CAFE_URL ?? DEFAULT_API_URL).replace(/\/$/, "");
+}
+function promptSecret(question) {
+  return new Promise((resolve) => {
+    const rl = createInterface({
+      input: process.stdin,
+      output: process.stdout
+    });
+    let muted = false;
+    const raw = rl;
+    raw._writeToOutput = (s) => {
+      if (!muted) {
+        process.stdout.write(s);
+      }
+    };
+    rl.question(question, (answer) => {
+      rl.close();
+      process.stdout.write("\n");
+      resolve(answer);
+    });
+    muted = true;
+  });
+}
+async function login(opts) {
+  const base = apiUrl();
+  const keysUrl = `${base}/cli`;
+  let key = opts.apiKey?.trim();
+  if (!key) {
+    if (!opts.json) {
+      console.log(`
+Opening ${keysUrl}`);
+      console.log("Create a CLI key there, then paste it below.\n");
+    }
+    if (process.stdout.isTTY) {
+      openInBrowser(keysUrl);
+    }
+    key = (await promptSecret("API key: ")).trim();
+  }
+  if (!key) {
+    throw new Error("No key entered \u2014 nothing was saved.");
+  }
+  if (!key.startsWith("ack_")) {
+    throw new Error(
+      `That doesn't look like an artifact.cafe API key (they start with "ack_").`
+    );
+  }
+  const me = await createApiClient(base, key).me();
+  storeApiKey(base, key);
+  const who = me.email ?? me.userId;
+  if (opts.json) {
+    console.log(
+      JSON.stringify(
+        { apiUrl: base, email: me.email, loggedIn: true, userId: me.userId },
+        null,
+        2
+      )
+    );
+    return;
+  }
+  console.log(`
+\u2713 Logged in to ${apiOrigin(base)} as ${who}`);
+  console.log(
+    "New publishes are claimed by your account automatically. Try `artifact-cafe list`.\n"
+  );
+}
+async function whoami(opts) {
+  const base = apiUrl();
+  const key = resolveApiKey(base);
+  if (!key) {
+    throw new Error(
+      `Not logged in to ${apiOrigin(base)} \u2014 run \`artifact-cafe login\` first.`
+    );
+  }
+  const me = await createApiClient(base, key).me();
+  if (opts.json) {
+    console.log(
+      JSON.stringify(
+        {
+          apiUrl: base,
+          email: me.email,
+          keyName: me.keyName ?? null,
+          userId: me.userId
+        },
+        null,
+        2
+      )
+    );
+    return;
+  }
+  const keyLabel = me.keyName ? ` (key: ${me.keyName})` : "";
+  console.log(
+    `Logged in to ${apiOrigin(base)} as ${me.email ?? me.userId}${keyLabel}`
+  );
+}
+function logout(opts) {
+  const base = apiUrl();
+  const removed = removeApiKey(base);
+  if (opts.json) {
+    console.log(JSON.stringify({ apiUrl: base, loggedOut: removed }, null, 2));
+    return;
+  }
+  if (!removed) {
+    console.log(`No stored key for ${apiOrigin(base)} \u2014 already logged out.`);
+    return;
+  }
+  console.log(`\u2713 Logged out of ${apiOrigin(base)} on this machine.`);
+  console.log(
+    `The key itself is still active \u2014 revoke it at ${base}/cli if this machine is shared.`
+  );
+}
+
 // src/open.ts
+import path6 from "path";
 function openArtifact(opts) {
-  const dir = path5.resolve(opts.dir);
+  const dir = path6.resolve(opts.dir);
   const config = readConfig(dir);
   if (!config) {
     throw new Error(
@@ -677,29 +1177,90 @@ function openArtifact(opts) {
     );
   }
   console.log(config.url);
-  if (process.stdout.isTTY) openInBrowser(config.url);
+  if (process.stdout.isTTY) {
+    openInBrowser(config.url);
+  }
+}
+
+// src/protect.ts
+import path7 from "path";
+async function protect(opts) {
+  if (opts.off && opts.password !== void 0) {
+    throw new Error("Pass either --password or --off, not both.");
+  }
+  if (!opts.off && opts.password === void 0) {
+    throw new Error(
+      "Provide --password <password> to set a gate, or --off to remove it."
+    );
+  }
+  const password = opts.off ? null : opts.password;
+  if (password !== null) {
+    const parsed = gatePasswordSchema.safeParse(password);
+    if (!parsed.success) {
+      throw new Error(parsed.error.issues[0]?.message ?? "Invalid password.");
+    }
+  }
+  const dir = path7.resolve(opts.dir);
+  const config = readConfig(dir);
+  if (!config) {
+    throw new Error(
+      `No artifact linked in ${dir} \u2014 run \`artifact-cafe publish\` there first (.artifactcafe/config.json not found).`
+    );
+  }
+  const apiUrl2 = process.env.ARTIFACT_CAFE_URL ?? config.apiUrl;
+  const token = config.publishToken ?? process.env.ARTIFACT_CAFE_TOKEN;
+  const client = createApiClient(apiUrl2, token);
+  const res = await client.setProtection(config.artifactId, password);
+  if (opts.json) {
+    console.log(JSON.stringify({ protected: res.protected }, null, 2));
+    return;
+  }
+  console.log(
+    res.protected ? `
+\u2713 Password protection on \u2014 ${config.url}
+` : `
+\u2713 Password protection removed \u2014 ${config.url}
+`
+  );
 }
 
 // src/index.ts
 var publish2 = defineCommand({
-  meta: { name: "publish", description: "Publish a folder as an artifact" },
   args: {
-    dir: { type: "positional", description: "Directory to publish", default: "." },
-    title: { type: "string", description: "Artifact title" },
-    entry: { type: "string", description: "Entry file (default: auto-detect)" },
-    artifact: { type: "string", description: "Publish to an existing artifact ID" },
-    json: { type: "boolean", description: "Machine-readable output" },
-    "no-open": { type: "boolean", description: "Don't open the review URL" }
+    "api-key": {
+      description: "Publish with an account API key (default: stored login)",
+      type: "string"
+    },
+    artifact: {
+      description: "Publish to an existing artifact ID",
+      type: "string"
+    },
+    dir: {
+      default: ".",
+      description: "Directory to publish",
+      type: "positional"
+    },
+    entry: { description: "Entry file (default: auto-detect)", type: "string" },
+    json: { description: "Machine-readable output", type: "boolean" },
+    "no-open": { description: "Don't open the review URL", type: "boolean" },
+    password: {
+      description: "Password-protect the artifact (min 6 chars)",
+      type: "string"
+    },
+    title: { description: "Artifact title", type: "string" }
   },
+  meta: { description: "Publish a folder as an artifact", name: "publish" },
   async run({ args }) {
     try {
       await publish({
+        apiKey: args["api-key"],
+        artifact: args.artifact,
         dir: args.dir,
-        title: args.title,
         entry: args.entry,
-        artifact: args.artifact,
         json: Boolean(args.json),
-        open: !args["no-open"]
+        open: !args["no-open"],
+        password: args.password,
+        title: args.title
       });
     } catch (err) {
       printCliError(err, Boolean(args.json));
@@ -707,13 +1268,104 @@ var publish2 = defineCommand({
     }
   }
 });
+var login2 = defineCommand({
+  args: {
+    "api-key": {
+      description: "Store this key without the browser prompt (agents, CI)",
+      type: "string"
+    },
+    json: { description: "Machine-readable output", type: "boolean" }
+  },
+  meta: {
+    description: "Log in \u2014 mint an API key in the browser and store it",
+    name: "login"
+  },
+  async run({ args }) {
+    try {
+      await login({ apiKey: args["api-key"], json: Boolean(args.json) });
+    } catch (err) {
+      printCliError(err, Boolean(args.json));
+      process.exit(1);
+    }
+  }
+});
+var logout2 = defineCommand({
+  args: {
+    json: { description: "Machine-readable output", type: "boolean" }
+  },
+  meta: {
+    description: "Remove the stored API key for this machine",
+    name: "logout"
+  },
+  run({ args }) {
+    try {
+      logout({ json: Boolean(args.json) });
+    } catch (err) {
+      printCliError(err, Boolean(args.json));
+      process.exit(1);
+    }
+  }
+});
+var whoami2 = defineCommand({
+  args: {
+    json: { description: "Machine-readable output", type: "boolean" }
+  },
+  meta: {
+    description: "Show which account the stored API key belongs to",
+    name: "whoami"
+  },
+  async run({ args }) {
+    try {
+      await whoami({ json: Boolean(args.json) });
+    } catch (err) {
+      printCliError(err, Boolean(args.json));
+      process.exit(1);
+    }
+  }
+});
+var list2 = defineCommand({
+  args: {
+    "api-key": {
+      description: "List with this API key (default: stored login)",
+      type: "string"
+    },
+    json: { description: "Machine-readable output", type: "boolean" }
+  },
+  meta: {
+    description: "List the artifacts your account owns",
+    name: "list"
+  },
+  async run({ args }) {
+    try {
+      await list({ apiKey: args["api-key"], json: Boolean(args.json) });
+    } catch (err) {
+      printCliError(err, Boolean(args.json));
+      process.exit(1);
+    }
+  }
+});
 var comments2 = defineCommand({
-  meta: { name: "comments", description: "Pull comments for the linked artifact" },
   args: {
-    dir: { type: "positional", description: "Published directory", default: "." },
-    json: { type: "boolean", description: "Machine-readable output" },
-    status: { type: "string", description: "Filter: open | resolved | all", default: "open" },
-    version: { type: "string", description: "Filter: current | all", default: "current" }
+    dir: {
+      default: ".",
+      description: "Published directory",
+      type: "positional"
+    },
+    json: { description: "Machine-readable output", type: "boolean" },
+    status: {
+      default: "open",
+      description: "Filter: open | resolved | all",
+      type: "string"
+    },
+    version: {
+      default: "current",
+      description: "Filter: current | all",
+      type: "string"
+    }
+  },
+  meta: {
+    description: "Pull comments for the linked artifact",
+    name: "comments"
   },
   async run({ args }) {
     try {
@@ -729,11 +1381,44 @@ var comments2 = defineCommand({
     }
   }
 });
+var protect2 = defineCommand({
+  args: {
+    dir: {
+      default: ".",
+      description: "Published directory",
+      type: "positional"
+    },
+    json: { description: "Machine-readable output", type: "boolean" },
+    off: { description: "Remove the password gate", type: "boolean" },
+    password: { description: "Gate password (min 6 chars)", type: "string" }
+  },
+  meta: {
+    description: "Password-protect the linked artifact (or --off to remove)",
+    name: "protect"
+  },
+  async run({ args }) {
+    try {
+      await protect({
+        dir: args.dir,
+        json: Boolean(args.json),
+        off: Boolean(args.off),
+        password: args.password
+      });
+    } catch (err) {
+      printCliError(err, Boolean(args.json));
+      process.exit(1);
+    }
+  }
+});
 var open = defineCommand({
-  meta: { name: "open", description: "Open the linked artifact's review URL" },
   args: {
-    dir: { type: "positional", description: "Published directory", default: "." }
+    dir: {
+      default: ".",
+      description: "Published directory",
+      type: "positional"
+    }
   },
+  meta: { description: "Open the linked artifact's review URL", name: "open" },
   run({ args }) {
     try {
       openArtifact({ dir: args.dir });
@@ -743,18 +1428,20 @@ var open = defineCommand({
     }
   }
 });
-var login = defineCommand({
-  meta: { name: "login", description: "Log in (optional; needed for owner actions)" },
-  async run() {
-    console.error("login not implemented yet");
-    process.exit(1);
-  }
-});
 var main = defineCommand({
   meta: {
-    name: "artifact-cafe",
-    description: "Publish AI-generated artifacts for review \u2014 https://artifact.cafe"
+    description: "Publish AI-generated artifacts for review \u2014 https://artifact.cafe",
+    name: "artifact-cafe"
   },
-  subCommands: { publish: publish2, comments: comments2, open, login }
+  subCommands: {
+    comments: comments2,
+    list: list2,
+    login: login2,
+    logout: logout2,
+    open,
+    protect: protect2,
+    publish: publish2,
+    whoami: whoami2
+  }
 });
 runMain(main);