artifact-cafe 0.0.11 → 0.0.13

package/dist/index.js

@@ -100,10 +100,22 @@ var workspaceAvatarResponseSchema = z2.object({
 });
 
 // ../shared/src/comments.ts
-import { z as z4 } from "zod";
+import { z as z5 } from "zod";
 
 // ../shared/src/publish.ts
+import { z as z4 } from "zod";
+
+// ../shared/src/review-mode.ts
 import { z as z3 } from "zod";
+var reviewModeSchema = z3.enum(["open", "readonly", "off"]);
+var setReviewModeSchema = z3.object({
+  mode: reviewModeSchema
+});
+var reviewModeResponseSchema = z3.object({
+  mode: reviewModeSchema
+});
+
+// ../shared/src/publish.ts
 function isSafeArtifactPath(p) {
   if (p.length === 0 || p.length > 1024) {
     return false;
@@ -116,140 +128,148 @@ function isSafeArtifactPath(p) {
   }
   return p.split("/").every((seg) => seg.length > 0 && seg !== "." && seg !== "..");
 }
-var manifestFileSchema = z3.object({
-  hash: z3.string().regex(/^sha256_[a-f0-9]{64}$/),
-  mimeType: z3.string().regex(/^[-\w.+]+\/[-\w.+]+$/, { message: "invalid MIME type" }),
-  path: z3.string().min(1).max(1024).refine(isSafeArtifactPath, {
+var manifestFileSchema = z4.object({
+  hash: z4.string().regex(/^sha256_[a-f0-9]{64}$/),
+  mimeType: z4.string().regex(/^[-\w.+]+\/[-\w.+]+$/, { message: "invalid MIME type" }),
+  path: z4.string().min(1).max(1024).refine(isSafeArtifactPath, {
     message: "path must be a safe relative path"
   }),
-  size: z3.number().int().positive()
+  size: z4.number().int().positive()
 });
-var publishSourceSchema = z3.object({
-  agent: z3.string().optional(),
-  runId: z3.string().optional(),
-  type: z3.literal("cli")
+var publishSourceSchema = z4.object({
+  agent: z4.string().optional(),
+  runId: z4.string().optional(),
+  type: z4.literal("cli")
 });
-var createPublishSessionSchema = z3.object({
-  artifactId: z3.string().nullable(),
-  entryPath: z3.string().optional(),
-  files: z3.array(manifestFileSchema).min(1).max(1e3),
+var createPublishSessionSchema = z4.object({
+  artifactId: z4.string().nullable(),
+  entryPath: z4.string().optional(),
+  files: z4.array(manifestFileSchema).min(1).max(1e3),
   // SPEC-2 §6.4 — workspace placement is available only to authenticated
   // members; the API enforces membership and folder ownership. folderId
   // without workspaceId resolves against the account's personal workspace.
-  folderId: z3.string().min(1).optional(),
+  folderId: z4.string().min(1).optional(),
   // Bullet-point changelog for this version, authored by the publisher.
   // Optional on every publish (incl. v1); stored immutably on the version.
-  notes: z3.string().max(4e3).optional(),
+  notes: z4.string().max(4e3).optional(),
   source: publishSourceSchema,
-  title: z3.string().max(200).optional(),
-  workspaceId: z3.string().min(1).optional()
-});
-var publishSessionResponseSchema = z3.object({
-  artifactId: z3.string(),
-  expiresAt: z3.string(),
-  filesToUpload: z3.array(
-    z3.object({
-      method: z3.literal("PUT"),
-      path: z3.string(),
-      uploadUrl: z3.string().url()
+  title: z4.string().max(200).optional(),
+  workspaceId: z4.string().min(1).optional()
+});
+var publishSessionResponseSchema = z4.object({
+  artifactId: z4.string(),
+  expiresAt: z4.string(),
+  filesToUpload: z4.array(
+    z4.object({
+      method: z4.literal("PUT"),
+      path: z4.string(),
+      uploadUrl: z4.string().url()
     })
   ),
-  publishSessionId: z3.string(),
-  skippedFiles: z3.array(z3.string()),
-  versionId: z3.string()
+  publishSessionId: z4.string(),
+  skippedFiles: z4.array(z4.string()),
+  versionId: z4.string()
 });
-var finalizeResponseSchema = z3.object({
-  artifactId: z3.string(),
+var finalizeResponseSchema = z4.object({
+  artifactId: z4.string(),
   // API-key publishes create the artifact already claimed (SPEC §5.4) —
   // the CLI uses this to tell "claim URL pending" from "already yours".
-  claimed: z3.boolean(),
+  claimed: z4.boolean(),
   // Returned only on first publish of a new artifact (one-time).
-  claimUrl: z3.string().url().optional(),
-  publishToken: z3.string().optional(),
-  url: z3.string().url(),
-  versionId: z3.string(),
-  versionNumber: z3.number().int().positive()
-});
-var artifactResponseSchema = z3.object({
-  claimed: z3.boolean(),
-  currentVersion: z3.object({
-    entryUrl: z3.string().url(),
-    id: z3.string(),
-    versionNumber: z3.number().int().positive()
+  claimUrl: z4.string().url().optional(),
+  publishToken: z4.string().optional(),
+  url: z4.string().url(),
+  versionId: z4.string(),
+  versionNumber: z4.number().int().positive(),
+  // SPEC-2 §5.2 — who can open the review URL. A publish into a folder
+  // inherits that folder's visibility, so this is the only place the CLI
+  // learns that a link it just printed is members-only. Optional so a new
+  // CLI against an older API degrades to "unknown" instead of failing the
+  // publish over a field that only shapes the closing message.
+  visibility: z4.enum(["public", "unlisted", "workspace", "private"]).optional()
+});
+var artifactResponseSchema = z4.object({
+  claimed: z4.boolean(),
+  currentVersion: z4.object({
+    entryUrl: z4.string().url(),
+    id: z4.string(),
+    versionNumber: z4.number().int().positive()
   }).nullable(),
   // SPEC-2 §6.4 — placement + visibility surface on the artifact.
-  folderId: z3.string().nullable(),
-  id: z3.string(),
-  slug: z3.string(),
-  title: z3.string(),
-  visibility: z3.enum(["public", "unlisted", "workspace", "private"]),
-  workspaceId: z3.string().nullable()
+  folderId: z4.string().nullable(),
+  id: z4.string(),
+  // SPEC-2 §5.8 — what a viewer may do once in (open / readonly / off).
+  reviewMode: reviewModeSchema,
+  slug: z4.string(),
+  title: z4.string(),
+  visibility: z4.enum(["public", "unlisted", "workspace", "private"]),
+  workspaceId: z4.string().nullable()
 });
 
 // ../shared/src/comments.ts
-var anchorPageSchema = z4.string().max(1024).refine(isSafeArtifactPath, {
+var anchorPageSchema = z5.string().max(1024).refine(isSafeArtifactPath, {
   message: "page must be a safe relative path"
 }).optional();
-var elementSnapshotSchema = z4.object({
-  classes: z4.string().max(256).optional(),
-  id: z4.string().max(256).optional(),
-  tag: z4.string().min(1).max(128),
-  text: z4.string().max(200).optional()
+var elementSnapshotSchema = z5.object({
+  classes: z5.string().max(256).optional(),
+  id: z5.string().max(256).optional(),
+  tag: z5.string().min(1).max(128),
+  text: z5.string().max(200).optional()
 });
-var pointAnchorSchema = z4.object({
+var pointAnchorSchema = z5.object({
   element: elementSnapshotSchema.optional(),
   // elementPath is the primary anchor; x/y are offsets within the
   // element's box, normalized 0..1 (SPEC.md §8.1).
-  elementPath: z4.string().max(2048),
+  elementPath: z5.string().max(2048),
   page: anchorPageSchema,
-  type: z4.literal("point"),
-  viewportHeight: z4.number().int().positive().max(1e5),
-  viewportWidth: z4.number().int().positive().max(1e5),
-  x: z4.number().min(0).max(1),
-  y: z4.number().min(0).max(1)
-});
-var textAnchorSchema = z4.object({
-  elementPath: z4.string().max(2048),
-  endOffset: z4.number().int().nonnegative().max(1e8),
+  type: z5.literal("point"),
+  viewportHeight: z5.number().int().positive().max(1e5),
+  viewportWidth: z5.number().int().positive().max(1e5),
+  x: z5.number().min(0).max(1),
+  y: z5.number().min(0).max(1)
+});
+var textAnchorSchema = z5.object({
+  elementPath: z5.string().max(2048),
+  endOffset: z5.number().int().nonnegative().max(1e8),
   page: anchorPageSchema,
-  prefix: z4.string().max(200).optional(),
-  quote: z4.string().min(1).max(1e3),
-  startOffset: z4.number().int().nonnegative().max(1e8),
-  suffix: z4.string().max(200).optional(),
-  type: z4.literal("text")
+  prefix: z5.string().max(200).optional(),
+  quote: z5.string().min(1).max(1e3),
+  startOffset: z5.number().int().nonnegative().max(1e8),
+  suffix: z5.string().max(200).optional(),
+  type: z5.literal("text")
 });
-var pageAnchorSchema = z4.object({
+var pageAnchorSchema = z5.object({
   page: anchorPageSchema,
-  type: z4.literal("page")
+  type: z5.literal("page")
 });
-var anchorSchema = z4.discriminatedUnion("type", [
+var anchorSchema = z5.discriminatedUnion("type", [
   pointAnchorSchema,
   textAnchorSchema,
   pageAnchorSchema
 ]);
-var displayNameSchema = z4.string().trim().min(1).max(64);
-var guestSchema = z4.object({
+var displayNameSchema = z5.string().trim().min(1).max(64);
+var guestSchema = z5.object({
   displayName: displayNameSchema,
-  guestId: z4.string().min(16)
+  guestId: z5.string().min(16)
 });
-var viaLabelSchema = z4.string().trim().min(1).max(64);
-var createCommentThreadSchema = z4.object({
+var viaLabelSchema = z5.string().trim().min(1).max(64);
+var createCommentThreadSchema = z5.object({
   anchor: anchorSchema,
-  body: z4.string().min(1).max(1e4),
+  body: z5.string().min(1).max(1e4),
   guest: guestSchema.optional(),
-  versionId: z4.string(),
+  versionId: z5.string(),
   via: viaLabelSchema.optional()
 });
-var createCommentMessageSchema = z4.object({
-  body: z4.string().min(1).max(1e4),
+var createCommentMessageSchema = z5.object({
+  body: z5.string().min(1).max(1e4),
   guest: guestSchema.optional(),
   via: viaLabelSchema.optional()
 });
-var editCommentMessageSchema = z4.object({
-  body: z4.string().min(1).max(1e4),
+var editCommentMessageSchema = z5.object({
+  body: z5.string().min(1).max(1e4),
   guest: guestSchema.optional()
 });
-var threadActionSchema = z4.object({
+var threadActionSchema = z5.object({
   guest: guestSchema.optional()
 });
 var SINGLE_EMOJI = new RegExp("^\\p{RGI_Emoji}$", "v");
@@ -257,117 +277,117 @@ var REDUNDANT_VS16 = new RegExp("(\\p{Emoji_Presentation})\\uFE0F", "gu");
 function canonicalizeEmoji(s) {
   return s.replace(REDUNDANT_VS16, "$1");
 }
-var reactionEmojiSchema = z4.string().max(64).transform(canonicalizeEmoji).refine((s) => SINGLE_EMOJI.test(s), { message: "Must be a single emoji." }).describe("A single emoji, e.g. \u{1F44D}");
-var toggleReactionSchema = z4.object({
+var reactionEmojiSchema = z5.string().max(64).transform(canonicalizeEmoji).refine((s) => SINGLE_EMOJI.test(s), { message: "Must be a single emoji." }).describe("A single emoji, e.g. \u{1F44D}");
+var toggleReactionSchema = z5.object({
   emoji: reactionEmojiSchema,
   guest: guestSchema.optional()
 });
-var commentAuthorSchema = z4.object({
-  avatarUrl: z4.string().nullable(),
-  displayName: z4.string(),
-  guestId: z4.string().nullable(),
-  isViewer: z4.boolean(),
-  kind: z4.enum(["member", "guest"]),
+var commentAuthorSchema = z5.object({
+  avatarUrl: z5.string().nullable(),
+  displayName: z5.string(),
+  guestId: z5.string().nullable(),
+  isViewer: z5.boolean(),
+  kind: z5.enum(["member", "guest"]),
   // Optional "via" attribution (§6.4). Null for plain comments; a bounded
   // label the shell appends after the display name.
-  via: z4.string().nullable()
+  via: z5.string().nullable()
 });
-var messageReactionSchema = z4.object({
-  emoji: z4.string(),
-  reactors: z4.array(commentAuthorSchema)
+var messageReactionSchema = z5.object({
+  emoji: z5.string(),
+  reactors: z5.array(commentAuthorSchema)
 });
-var commentMessageSchema = z4.object({
+var commentMessageSchema = z5.object({
   author: commentAuthorSchema,
   // Empty string for a deleted message — the body is stripped server-side
   // (§6.7.1 tombstone), never sent to the client and hidden there.
-  body: z4.string(),
-  createdAt: z4.string(),
+  body: z5.string(),
+  createdAt: z5.string(),
   // Soft-deleted (§6.7.1). A tombstone keeps thread structure and replies;
   // the shell renders "Comment deleted" instead of the (absent) body.
-  deleted: z4.boolean(),
+  deleted: z5.boolean(),
   // Last edit time (§6.7.1), or null if never edited — drives the "edited"
   // badge. No edit history is kept.
-  editedAt: z4.string().nullable(),
-  id: z4.string(),
+  editedAt: z5.string().nullable(),
+  id: z5.string(),
   // Defaulted, not required: a new CLI parsing an older server's
   // response must not fail on the missing key.
-  reactions: z4.array(messageReactionSchema).default([])
+  reactions: z5.array(messageReactionSchema).default([])
 });
-var threadActorSchema = z4.object({
-  displayName: z4.string(),
-  kind: z4.enum(["member", "guest", "agent"])
+var threadActorSchema = z5.object({
+  displayName: z5.string(),
+  kind: z5.enum(["member", "guest", "agent"])
 });
-var commentThreadSchema = z4.object({
+var commentThreadSchema = z5.object({
   // §6.6.1 — set while open to signal "seen, working on it"; cleared on
   // reopen, kept (but superseded in display) once resolved. Defaulted so
   // clients parsing an older server's response don't fail.
-  acknowledgedAt: z4.string().nullable().default(null),
+  acknowledgedAt: z5.string().nullable().default(null),
   acknowledgedBy: threadActorSchema.nullable().default(null),
   anchor: anchorSchema,
-  artifactId: z4.string(),
-  createdAt: z4.string(),
+  artifactId: z5.string(),
+  createdAt: z5.string(),
   createdBy: commentAuthorSchema,
-  id: z4.string(),
-  messages: z4.array(commentMessageSchema),
+  id: z5.string(),
+  messages: z5.array(commentMessageSchema),
   // Null on threads resolved before actor recording existed, and always
   // null while open.
   resolvedBy: threadActorSchema.nullable().default(null),
-  status: z4.enum(["open", "resolved"]),
-  versionId: z4.string()
+  status: z5.enum(["open", "resolved"]),
+  versionId: z5.string()
 });
-var commentThreadListSchema = z4.object({
-  threads: z4.array(commentThreadSchema)
+var commentThreadListSchema = z5.object({
+  threads: z5.array(commentThreadSchema)
 });
-var commentExportQuerySchema = z4.object({
-  status: z4.enum(["open", "resolved", "all"]).default("open"),
-  version: z4.enum(["current", "all"]).default("current")
+var commentExportQuerySchema = z5.object({
+  status: z5.enum(["open", "resolved", "all"]).default("open"),
+  version: z5.enum(["current", "all"]).default("current")
 });
-var exportReactionSchema = z4.object({
-  count: z4.number().int().positive(),
-  emoji: z4.string()
+var exportReactionSchema = z5.object({
+  count: z5.number().int().positive(),
+  emoji: z5.string()
 });
-var commentExportReplySchema = z4.object({
-  author: z4.string(),
-  authorKind: z4.enum(["member", "guest"]),
-  body: z4.string(),
-  createdAt: z4.string(),
+var commentExportReplySchema = z5.object({
+  author: z5.string(),
+  authorKind: z5.enum(["member", "guest"]),
+  body: z5.string(),
+  createdAt: z5.string(),
   // Soft-delete tombstone (§6.7.1): body is "" when true.
-  deleted: z4.boolean(),
-  editedAt: z4.string().nullable(),
+  deleted: z5.boolean(),
+  editedAt: z5.string().nullable(),
   // The message id — what `edit`/`delete` target (§5.1).
-  id: z4.string(),
-  reactions: z4.array(exportReactionSchema).optional()
+  id: z5.string(),
+  reactions: z5.array(exportReactionSchema).optional()
 });
-var commentExportThreadSchema = z4.object({
+var commentExportThreadSchema = z5.object({
   // §6.6.1 — lets a polling agent skip threads it already acknowledged
   // (acknowledged threads stay in status=open exports on purpose).
-  acknowledgedAt: z4.string().nullable().default(null),
+  acknowledgedAt: z5.string().nullable().default(null),
   anchor: anchorSchema,
-  author: z4.string(),
-  authorKind: z4.enum(["member", "guest"]),
-  body: z4.string(),
-  createdAt: z4.string(),
-  deleted: z4.boolean(),
-  editedAt: z4.string().nullable(),
-  id: z4.string(),
+  author: z5.string(),
+  authorKind: z5.enum(["member", "guest"]),
+  body: z5.string(),
+  createdAt: z5.string(),
+  deleted: z5.boolean(),
+  editedAt: z5.string().nullable(),
+  id: z5.string(),
   // The opening message's id (distinct from the thread `id`) — `edit`/
   // `delete` operate on messages, so the CLI needs it to target the first
   // comment, not just the replies.
-  messageId: z4.string(),
-  reactions: z4.array(exportReactionSchema).optional(),
-  replies: z4.array(commentExportReplySchema),
+  messageId: z5.string(),
+  reactions: z5.array(exportReactionSchema).optional(),
+  replies: z5.array(commentExportReplySchema),
   resolvedBy: threadActorSchema.nullable().default(null),
-  status: z4.enum(["open", "resolved"]),
-  versionNumber: z4.number().int().positive()
+  status: z5.enum(["open", "resolved"]),
+  versionNumber: z5.number().int().positive()
 });
-var commentExportSchema = z4.object({
-  artifactId: z4.string(),
-  comments: z4.array(commentExportThreadSchema),
+var commentExportSchema = z5.object({
+  artifactId: z5.string(),
+  comments: z5.array(commentExportThreadSchema),
   // The artifact's current version (null before the first finalize).
-  versionNumber: z4.number().int().positive().nullable()
+  versionNumber: z5.number().int().positive().nullable()
 });
-var commentReadResponseSchema = z4.object({
-  lastSeenAt: z4.string()
+var commentReadResponseSchema = z5.object({
+  lastSeenAt: z5.string()
 });
 function elementLabel(el) {
   if (el.id) {
@@ -378,228 +398,236 @@ function elementLabel(el) {
 }
 
 // ../shared/src/errors.ts
-import { z as z5 } from "zod";
-var apiErrorSchema = z5.object({
-  code: z5.string(),
-  docsUrl: z5.string().url(),
-  message: z5.string(),
-  retryAfter: z5.number().int().positive().optional()
+import { z as z6 } from "zod";
+var apiErrorSchema = z6.object({
+  code: z6.string(),
+  docsUrl: z6.string().url(),
+  message: z6.string(),
+  retryAfter: z6.number().int().positive().optional()
 });
 
 // ../shared/src/feedback.ts
-import { z as z6 } from "zod";
-var feedbackRequestSchema = z6.object({
-  email: z6.string().trim().toLowerCase().email().optional().or(z6.literal("")),
-  message: z6.string().trim().min(1).max(4e3)
+import { z as z7 } from "zod";
+var feedbackRequestSchema = z7.object({
+  email: z7.string().trim().toLowerCase().email().optional().or(z7.literal("")),
+  message: z7.string().trim().min(1).max(4e3)
 });
-var feedbackResponseSchema = z6.object({
-  sent: z6.literal(true)
+var feedbackResponseSchema = z7.object({
+  sent: z7.literal(true)
 });
 
 // ../shared/src/grants.ts
-import { z as z7 } from "zod";
-var grantRoleSchema = z7.enum(["viewer"]);
-var createGrantSchema = z7.object({
-  email: z7.string().trim().toLowerCase().email().optional(),
+import { z as z8 } from "zod";
+var grantRoleSchema = z8.enum(["viewer"]);
+var createGrantSchema = z8.object({
+  email: z8.string().trim().toLowerCase().email().optional(),
   role: grantRoleSchema.default("viewer"),
-  userId: z7.string().min(1).optional()
+  userId: z8.string().min(1).optional()
 }).refine((body) => Boolean(body.email) !== Boolean(body.userId), {
   message: "provide exactly one of email or userId"
 });
-var grantSchema = z7.object({
-  createdAt: z7.string(),
-  email: z7.string().email().nullable(),
-  expiresAt: z7.string().nullable(),
-  id: z7.string(),
+var grantSchema = z8.object({
+  createdAt: z8.string(),
+  email: z8.string().email().nullable(),
+  expiresAt: z8.string().nullable(),
+  id: z8.string(),
   // The subject's avatar once they have an account; null otherwise.
-  image: z7.string().nullable(),
+  image: z8.string().nullable(),
   // Present on the invited account after redemption / when granting an
   // existing user; null for a still-pending email invite.
-  name: z7.string().nullable(),
-  redeemedAt: z7.string().nullable(),
+  name: z8.string().nullable(),
+  redeemedAt: z8.string().nullable(),
   role: grantRoleSchema,
   // Shown as "· pending" beside the role until the link is redeemed.
-  status: z7.enum(["pending", "active"]),
+  status: z8.enum(["pending", "active"]),
   // Display fragment of the live invitation token, or null once redeemed.
-  tokenPrefix: z7.string().nullable(),
-  userId: z7.string().nullable()
+  tokenPrefix: z8.string().nullable(),
+  userId: z8.string().nullable()
 });
 var createdGrantSchema = grantSchema.extend({
-  url: z7.string().url()
+  url: z8.string().url()
 });
-var grantListResponseSchema = z7.object({
-  grants: z7.array(grantSchema),
+var grantListResponseSchema = z8.object({
+  grants: z8.array(grantSchema),
   // The artifact's current general-access value, so the share surface can
   // render the "General access" line without a second read.
-  visibility: z7.enum(["public", "unlisted", "workspace", "private"])
-});
-var revokeGrantResponseSchema = z7.object({
-  revoked: z7.literal(true)
+  visibility: z8.enum(["public", "unlisted", "workspace", "private"]),
+  // The owning workspace's logo, so the share modal can draw the workspace
+  // itself rather than a generic glyph. Null when none was uploaded.
+  workspaceLogo: z8.string().nullable().optional(),
+  // The owning workspace's display name, so "People with access" can name the
+  // audience `workspace` visibility actually admits ("All Acme members") rather
+  // than leaving an empty list to imply nobody. Null for a workspace-less
+  // artifact; optional so an older server still parses.
+  workspaceName: z8.string().nullable().optional()
+});
+var revokeGrantResponseSchema = z8.object({
+  revoked: z8.literal(true)
 });
-var acceptGrantSchema = z7.object({
-  token: z7.string().min(1)
+var acceptGrantSchema = z8.object({
+  token: z8.string().min(1)
 });
-var acceptGrantResponseSchema = z7.object({
-  artifactId: z7.string(),
+var acceptGrantResponseSchema = z8.object({
+  artifactId: z8.string(),
   // The review shell URL to land on, carrying ?invited=1 for the banner.
-  artifactUrl: z7.string().url(),
-  slug: z7.string(),
-  title: z7.string()
-});
-var workspaceGuestSchema = z7.object({
-  artifacts: z7.array(
-    z7.object({
-      artifactId: z7.string(),
-      grantId: z7.string(),
-      slug: z7.string(),
-      status: z7.enum(["pending", "active"]),
-      title: z7.string()
+  artifactUrl: z8.string().url(),
+  slug: z8.string(),
+  title: z8.string()
+});
+var workspaceGuestSchema = z8.object({
+  artifacts: z8.array(
+    z8.object({
+      artifactId: z8.string(),
+      grantId: z8.string(),
+      slug: z8.string(),
+      status: z8.enum(["pending", "active"]),
+      title: z8.string()
     })
   ),
-  email: z7.string().nullable(),
-  image: z7.string().nullable(),
-  name: z7.string().nullable(),
-  userId: z7.string().nullable()
-});
-var workspaceGuestListResponseSchema = z7.object({
-  guests: z7.array(workspaceGuestSchema)
-});
-var sharedWithMeArtifactSchema = z7.object({
-  artifactId: z7.string(),
-  slug: z7.string(),
-  title: z7.string(),
-  url: z7.string().url(),
+  email: z8.string().nullable(),
+  image: z8.string().nullable(),
+  name: z8.string().nullable(),
+  userId: z8.string().nullable()
+});
+var workspaceGuestListResponseSchema = z8.object({
+  guests: z8.array(workspaceGuestSchema)
+});
+var sharedWithMeArtifactSchema = z8.object({
+  artifactId: z8.string(),
+  slug: z8.string(),
+  title: z8.string(),
+  url: z8.string().url(),
   // Who shared it, for the "Shared with me" list.
-  workspaceName: z7.string()
+  workspaceName: z8.string()
 });
-var sharedWithMeListResponseSchema = z7.object({
-  artifacts: z7.array(sharedWithMeArtifactSchema)
+var sharedWithMeListResponseSchema = z8.object({
+  artifacts: z8.array(sharedWithMeArtifactSchema)
 });
 
 // ../shared/src/me.ts
-import { z as z9 } from "zod";
+import { z as z10 } from "zod";
 
 // ../shared/src/workspaces.ts
-import { z as z8 } from "zod";
+import { z as z9 } from "zod";
 var WORKSPACE_HANDLE_PATTERN = /^[a-z0-9](?:[a-z0-9-]{1,30}[a-z0-9])$/;
-var workspaceHandleUnavailableReasonSchema = z8.enum([
+var workspaceHandleUnavailableReasonSchema = z9.enum([
   "held",
   "invalid",
   "reserved",
   "taken"
 ]);
-var workspaceHandleAvailabilitySchema = z8.object({
-  available: z8.boolean(),
-  handle: z8.string(),
+var workspaceHandleAvailabilitySchema = z9.object({
+  available: z9.boolean(),
+  handle: z9.string(),
   // Human-readable sentence for the field hint; null when available.
-  message: z8.string().nullable(),
+  message: z9.string().nullable(),
   reason: workspaceHandleUnavailableReasonSchema.nullable()
 });
-var workspaceRoleSchema = z8.enum(["owner", "admin", "member"]);
-var workspaceInviteRoleSchema = z8.enum(["admin", "member"]);
-var workspaceHandleSchema = z8.string().min(3).max(32).regex(WORKSPACE_HANDLE_PATTERN, {
+var workspaceRoleSchema = z9.enum(["owner", "admin", "member"]);
+var workspaceInviteRoleSchema = z9.enum(["admin", "member"]);
+var workspaceHandleSchema = z9.string().min(3).max(32).regex(WORKSPACE_HANDLE_PATTERN, {
   message: "handle must be lowercase letters, digits, and hyphens, with no leading/trailing hyphen"
 });
-var createWorkspaceSchema = z8.object({
+var createWorkspaceSchema = z9.object({
   handle: workspaceHandleSchema.optional(),
-  name: z8.string().trim().min(1).max(100)
+  name: z9.string().trim().min(1).max(100)
 });
-var updateWorkspaceSchema = z8.object({
+var updateWorkspaceSchema = z9.object({
   handle: workspaceHandleSchema.optional(),
-  name: z8.string().trim().min(1).max(100).optional()
+  name: z9.string().trim().min(1).max(100).optional()
 }).refine((body) => body.handle !== void 0 || body.name !== void 0, {
   message: "provide at least one of name or handle"
 });
-var workspaceSchema = z8.object({
-  createdAt: z8.string(),
-  handle: z8.string(),
+var workspaceSchema = z9.object({
+  createdAt: z9.string(),
+  handle: z9.string(),
   // ISO timestamp when `{handle}.artifact.cafe` was provisioned, or null.
   // Set by the one-time, self-serve enable flow (§4.4); never auto at
   // create, and always null for personal workspaces.
-  hostnameProvisionedAt: z8.string().nullable(),
-  id: z8.string(),
+  hostnameProvisionedAt: z9.string().nullable(),
+  id: z9.string(),
   // Auto-provisioned solo workspace, one per user: non-deletable, takes
   // no members, renameable like any workspace.
-  isPersonal: z8.boolean(),
+  isPersonal: z9.boolean(),
   // Uploaded logo URL, or null for the initials fallback. Set through the
   // dedicated /workspaces/:id/avatar route, never the generic update.
-  logo: z8.string().nullable(),
-  name: z8.string(),
+  logo: z9.string().nullable(),
+  name: z9.string(),
   role: workspaceRoleSchema.nullable(),
-  updatedAt: z8.string()
+  updatedAt: z9.string()
 });
-var workspaceListResponseSchema = z8.object({
-  workspaces: z8.array(workspaceSchema)
+var workspaceListResponseSchema = z9.object({
+  workspaces: z9.array(workspaceSchema)
 });
-var deleteWorkspaceResponseSchema = z8.object({
-  deleted: z8.literal(true)
+var deleteWorkspaceResponseSchema = z9.object({
+  deleted: z9.literal(true)
 });
-var workspaceMemberSchema = z8.object({
-  createdAt: z8.string(),
-  email: z8.string().email(),
-  image: z8.string().nullable(),
-  name: z8.string(),
+var workspaceMemberSchema = z9.object({
+  createdAt: z9.string(),
+  email: z9.string().email(),
+  image: z9.string().nullable(),
+  name: z9.string(),
   role: workspaceRoleSchema,
-  userId: z8.string()
+  userId: z9.string()
 });
-var workspaceMemberListResponseSchema = z8.object({
-  members: z8.array(workspaceMemberSchema)
+var workspaceMemberListResponseSchema = z9.object({
+  members: z9.array(workspaceMemberSchema)
 });
-var updateWorkspaceMemberSchema = z8.object({
+var updateWorkspaceMemberSchema = z9.object({
   role: workspaceRoleSchema
 });
-var removeWorkspaceMemberResponseSchema = z8.object({
-  removed: z8.literal(true)
+var removeWorkspaceMemberResponseSchema = z9.object({
+  removed: z9.literal(true)
 });
-var createWorkspaceInviteSchema = z8.object({
-  email: z8.string().trim().toLowerCase().email().optional(),
-  expiresAt: z8.string().datetime(),
-  maxUses: z8.number().int().positive().optional(),
+var createWorkspaceInviteSchema = z9.object({
+  email: z9.string().trim().toLowerCase().email().optional(),
+  expiresAt: z9.string().datetime(),
+  maxUses: z9.number().int().positive().optional(),
   role: workspaceInviteRoleSchema
 });
-var workspaceInviteSchema = z8.object({
-  createdAt: z8.string(),
-  email: z8.string().email().nullable(),
-  expiresAt: z8.string(),
-  id: z8.string(),
-  maxUses: z8.number().int().positive().nullable(),
+var workspaceInviteSchema = z9.object({
+  createdAt: z9.string(),
+  email: z9.string().email().nullable(),
+  expiresAt: z9.string(),
+  id: z9.string(),
+  maxUses: z9.number().int().positive().nullable(),
   role: workspaceInviteRoleSchema,
-  tokenPrefix: z8.string(),
-  useCount: z8.number().int().nonnegative()
+  tokenPrefix: z9.string(),
+  useCount: z9.number().int().nonnegative()
 });
 var createdWorkspaceInviteSchema = workspaceInviteSchema.extend({
-  url: z8.string().url()
+  url: z9.string().url()
 });
-var workspaceInviteListResponseSchema = z8.object({
-  invites: z8.array(workspaceInviteSchema)
+var workspaceInviteListResponseSchema = z9.object({
+  invites: z9.array(workspaceInviteSchema)
 });
-var revokeWorkspaceInviteResponseSchema = z8.object({
-  revoked: z8.literal(true)
+var revokeWorkspaceInviteResponseSchema = z9.object({
+  revoked: z9.literal(true)
 });
-var acceptWorkspaceInviteSchema = z8.object({
-  token: z8.string().min(1)
+var acceptWorkspaceInviteSchema = z9.object({
+  token: z9.string().min(1)
 });
-var acceptWorkspaceInviteResponseSchema = z8.object({
+var acceptWorkspaceInviteResponseSchema = z9.object({
   role: workspaceRoleSchema,
   workspace: workspaceSchema
 });
-var folderVisibilitySchema = z8.enum(["public", "workspace"]);
-var artifactVisibilitySchema = z8.enum([
+var folderVisibilitySchema = z9.enum(["public", "workspace"]);
+var artifactVisibilitySchema = z9.enum([
   "public",
   "unlisted",
   "workspace",
   "private"
 ]);
-var createFolderSchema = z8.object({
-  name: z8.string().trim().min(1).max(100),
+var createFolderSchema = z9.object({
+  name: z9.string().trim().min(1).max(100),
   visibility: folderVisibilitySchema
 });
-var updateFolderSchema = z8.object({
+var updateFolderSchema = z9.object({
   // With `visibility`: bulk-update the folder's artifacts to match
   // (SPEC-2 §3.4 "Changing a folder's visibility offers a bulk update").
-  cascade: z8.boolean().optional(),
-  name: z8.string().trim().min(1).max(100).optional(),
-  sortOrder: z8.number().int().min(0).optional(),
+  cascade: z9.boolean().optional(),
+  name: z9.string().trim().min(1).max(100).optional(),
+  sortOrder: z9.number().int().min(0).optional(),
   visibility: folderVisibilitySchema.optional()
 }).refine(
   (body) => body.name !== void 0 || body.visibility !== void 0 || body.sortOrder !== void 0,
@@ -607,256 +635,260 @@ var updateFolderSchema = z8.object({
 ).refine((body) => !body.cascade || body.visibility !== void 0, {
   message: "cascade requires visibility"
 });
-var folderSchema = z8.object({
-  createdAt: z8.string(),
-  id: z8.string(),
-  name: z8.string(),
+var folderSchema = z9.object({
+  createdAt: z9.string(),
+  id: z9.string(),
+  name: z9.string(),
   // Permalink segment for the public folder page (/w/{handle}/f/{slug}).
   // Server-derived from the name; renames regenerate it.
-  slug: z8.string(),
-  sortOrder: z8.number().int(),
-  updatedAt: z8.string(),
+  slug: z9.string(),
+  sortOrder: z9.number().int(),
+  updatedAt: z9.string(),
   visibility: folderVisibilitySchema,
-  workspaceId: z8.string()
+  workspaceId: z9.string()
 });
-var folderListResponseSchema = z8.object({
-  folders: z8.array(folderSchema)
+var folderListResponseSchema = z9.object({
+  folders: z9.array(folderSchema)
 });
-var deleteFolderResponseSchema = z8.object({
-  deleted: z8.literal(true)
+var deleteFolderResponseSchema = z9.object({
+  deleted: z9.literal(true)
 });
-var workspaceArtifactSchema = z8.object({
-  createdAt: z8.string(),
-  currentVersionNumber: z8.number().int().nullable(),
-  folderId: z8.string().nullable(),
-  id: z8.string(),
-  openCommentCount: z8.number().int().nonnegative(),
-  slug: z8.string(),
-  title: z8.string(),
-  updatedAt: z8.string(),
-  url: z8.string().url(),
-  versionCount: z8.number().int().nonnegative(),
+var workspaceArtifactSchema = z9.object({
+  createdAt: z9.string(),
+  currentVersionNumber: z9.number().int().nullable(),
+  folderId: z9.string().nullable(),
+  id: z9.string(),
+  openCommentCount: z9.number().int().nonnegative(),
+  reviewMode: reviewModeSchema,
+  slug: z9.string(),
+  title: z9.string(),
+  updatedAt: z9.string(),
+  url: z9.string().url(),
+  versionCount: z9.number().int().nonnegative(),
   visibility: artifactVisibilitySchema
 });
-var workspaceArtifactListResponseSchema = z8.object({
-  artifacts: z8.array(workspaceArtifactSchema)
+var workspaceArtifactListResponseSchema = z9.object({
+  artifacts: z9.array(workspaceArtifactSchema)
 });
-var workspaceArtifactSearchResultSchema = z8.object({
-  id: z8.string(),
-  slug: z8.string(),
-  title: z8.string()
+var workspaceArtifactSearchResultSchema = z9.object({
+  id: z9.string(),
+  slug: z9.string(),
+  title: z9.string()
 });
-var workspaceArtifactSearchResponseSchema = z8.object({
-  results: z8.array(workspaceArtifactSearchResultSchema)
+var workspaceArtifactSearchResponseSchema = z9.object({
+  results: z9.array(workspaceArtifactSearchResultSchema)
 });
 
 // ../shared/src/me.ts
-var ownArtifactSchema = z9.object({
-  createdAt: z9.string(),
-  currentVersionNumber: z9.number().nullable(),
+var ownArtifactSchema = z10.object({
+  createdAt: z10.string(),
+  currentVersionNumber: z10.number().nullable(),
   // Owned artifacts normally never expire; non-null only while an
   // expiry is still set (e.g. an unclaimed publish surfaced here later).
-  expiresAt: z9.string().nullable(),
+  expiresAt: z10.string().nullable(),
   // SPEC-2 §8.4 — the containing folder for workspace-owned artifacts;
   // both null for personal artifacts. `folderId` drives the dashboard's
   // move control and folder filter; `folderName` is the display label.
-  folderId: z9.string().nullable(),
-  folderName: z9.string().nullable(),
+  folderId: z10.string().nullable(),
+  folderName: z10.string().nullable(),
   // Whether a publish token is still active — revocable from the
   // dashboard (§6.18); the token itself is never returned.
-  hasPublishToken: z9.boolean(),
-  id: z9.string(),
-  openThreads: z9.number(),
-  protected: z9.boolean(),
+  hasPublishToken: z10.boolean(),
+  id: z10.string(),
+  openThreads: z10.number(),
+  protected: z10.boolean(),
   // Who published the current version (falling back to the claiming
   // owner) — the dashboard shows a name and avatar per artifact so a
   // shared workspace reads as people's work, not anonymous rows. Null
   // when the publish was token-only and the artifact is unclaimed.
-  publishedBy: z9.object({ image: z9.string().nullable(), name: z9.string() }).nullable(),
-  slug: z9.string(),
-  title: z9.string(),
-  totalViews: z9.number(),
+  publishedBy: z10.object({ image: z10.string().nullable(), name: z10.string() }).nullable(),
+  // SPEC-2 §5.8 — the review dial, so the dashboard's settings dialog can
+  // render current state without a second fetch.
+  reviewMode: reviewModeSchema,
+  slug: z10.string(),
+  title: z10.string(),
+  totalViews: z10.number(),
   // SPEC §6.20 — messages by others newer than the viewer's last-seen
   // watermark. 0 for signed-out/API-key-less contexts.
-  unreadComments: z9.number(),
-  updatedAt: z9.string(),
-  url: z9.string(),
-  versionCount: z9.number(),
+  unreadComments: z10.number(),
+  updatedAt: z10.string(),
+  url: z10.string(),
+  versionCount: z10.number(),
   // SPEC-2 §5.1 — whether the caller clears the manage bar for this
   // artifact (workspace admin, or the person who first published it).
   // Only a manager's folder move inherits the folder's visibility, so the
   // dashboard warns exactly the people the change can actually affect, and
   // only a manager is offered the Share entry (§5.7).
-  viewerCanManage: z9.boolean(),
+  viewerCanManage: z10.boolean(),
   // SPEC-2 §5.2 — the artifact's own visibility, the single enforcement
   // source. The dashboard needs it to tell whether a folder move would
   // widen exposure before it sends the PATCH (§3.4), and to render the lock
   // glyph on `private` rows and cards (§5.7).
   visibility: artifactVisibilitySchema
 });
-var ownArtifactsResponseSchema = z9.object({
-  artifacts: z9.array(ownArtifactSchema)
+var ownArtifactsResponseSchema = z10.object({
+  artifacts: z10.array(ownArtifactSchema)
 });
-var revokePublishTokenResponseSchema = z9.object({
-  revoked: z9.boolean()
+var revokePublishTokenResponseSchema = z10.object({
+  revoked: z10.boolean()
 });
 
 // ../shared/src/owner.ts
-import { z as z10 } from "zod";
+import { z as z11 } from "zod";
 var SLUG_PATTERN = /^[a-z0-9](?:[a-z0-9-]{1,61}[a-z0-9])$/;
-var claimResponseSchema = z10.object({
-  artifactId: z10.string(),
-  slug: z10.string(),
-  title: z10.string(),
-  url: z10.string().url()
+var claimResponseSchema = z11.object({
+  artifactId: z11.string(),
+  slug: z11.string(),
+  title: z11.string(),
+  url: z11.string().url()
 });
-var updateArtifactSchema = z10.object({
+var updateArtifactSchema = z11.object({
   // SPEC-2 §6.4 — placement + visibility. `folderId: null` clears the
   // folder; `workspaceId: null` moves the artifact out of its workspace
   // (§5.5 ownership transfer).
-  folderId: z10.string().min(1).nullable().optional(),
-  slug: z10.string().min(3).max(63).regex(SLUG_PATTERN, {
+  folderId: z11.string().min(1).nullable().optional(),
+  slug: z11.string().min(3).max(63).regex(SLUG_PATTERN, {
     message: "slug must be lowercase letters, digits, and hyphens, with no leading/trailing hyphen"
   }).optional(),
-  title: z10.string().min(1).max(200).optional(),
+  title: z11.string().min(1).max(200).optional(),
   visibility: artifactVisibilitySchema.optional(),
-  workspaceId: z10.string().min(1).nullable().optional()
+  workspaceId: z11.string().min(1).nullable().optional()
 }).refine(
   (body) => body.title !== void 0 || body.slug !== void 0 || body.visibility !== void 0 || body.folderId !== void 0 || body.workspaceId !== void 0,
   {
     message: "provide at least one of title, slug, visibility, folderId, workspaceId"
   }
 );
-var deleteArtifactResponseSchema = z10.object({
-  deleted: z10.literal(true)
+var deleteArtifactResponseSchema = z11.object({
+  deleted: z11.literal(true)
 });
 
 // ../shared/src/presence.ts
-import { z as z11 } from "zod";
+import { z as z12 } from "zod";
 var AGENT_STATES = ["listening", "editing", "publishing"];
-var agentStateSchema = z11.enum(AGENT_STATES);
+var agentStateSchema = z12.enum(AGENT_STATES);
 var AGENT_PRESENCE = {
   editingTtlSeconds: 300,
   heartbeatSeconds: 15,
   shellPollSeconds: 15,
   ttlSeconds: 45
 };
-var agentHeartbeatBodySchema = z11.object({
+var agentHeartbeatBodySchema = z12.object({
   state: agentStateSchema.optional()
 });
-var agentHeartbeatResponseSchema = z11.object({
-  listening: z11.literal(true),
+var agentHeartbeatResponseSchema = z12.object({
+  listening: z12.literal(true),
   state: agentStateSchema.optional(),
-  ttlSeconds: z11.number().int().positive()
+  ttlSeconds: z12.number().int().positive()
 });
-var agentPresenceSchema = z11.object({
-  listening: z11.boolean(),
+var agentPresenceSchema = z12.object({
+  listening: z12.boolean(),
   state: agentStateSchema.nullable().optional(),
-  versionNumber: z11.number().int().positive().nullable()
+  versionNumber: z12.number().int().positive().nullable()
 });
 
 // ../shared/src/protection.ts
-import { z as z12 } from "zod";
+import { z as z13 } from "zod";
 var PASSWORD_MIN = 6;
 var PASSWORD_MAX = 128;
-var gatePasswordSchema = z12.string().min(PASSWORD_MIN, `Password must be at least ${PASSWORD_MIN} characters.`).max(PASSWORD_MAX, `Password must be at most ${PASSWORD_MAX} characters.`);
-var setProtectionSchema = z12.object({
+var gatePasswordSchema = z13.string().min(PASSWORD_MIN, `Password must be at least ${PASSWORD_MIN} characters.`).max(PASSWORD_MAX, `Password must be at most ${PASSWORD_MAX} characters.`);
+var setProtectionSchema = z13.object({
   password: gatePasswordSchema.nullable()
 });
-var protectionResponseSchema = z12.object({
-  protected: z12.boolean()
+var protectionResponseSchema = z13.object({
+  protected: z13.boolean()
 });
-var unlockSchema = z12.object({
-  password: z12.string().min(1).max(1024)
+var unlockSchema = z13.object({
+  password: z13.string().min(1).max(1024)
 });
-var unlockResponseSchema = z12.object({
-  unlocked: z12.literal(true)
+var unlockResponseSchema = z13.object({
+  unlocked: z13.literal(true)
 });
 
 // ../shared/src/report.ts
-import { z as z13 } from "zod";
-var reportRequestSchema = z13.object({
-  reason: z13.string().max(1e3).optional()
+import { z as z14 } from "zod";
+var reportRequestSchema = z14.object({
+  reason: z14.string().max(1e3).optional()
 });
-var reportResponseSchema = z13.object({
-  reported: z13.literal(true)
+var reportResponseSchema = z14.object({
+  reported: z14.literal(true)
 });
 
 // ../shared/src/reviewers.ts
-import { z as z14 } from "zod";
-var artifactReviewerSchema = z14.object({
-  avatarUrl: z14.string().nullable(),
-  displayName: z14.string(),
+import { z as z15 } from "zod";
+var artifactReviewerSchema = z15.object({
+  avatarUrl: z15.string().nullable(),
+  displayName: z15.string(),
   // Exactly one of userId/guestId is set, per `kind`.
-  guestId: z14.string().nullable(),
+  guestId: z15.string().nullable(),
   // "account", not commentAuthorSchema's "member" — the whole point here is
   // that these people need not be workspace members. A guest can be named in
   // a comment but never notified: guest_identities carries a display name and
   // no email, so there is nowhere to send anything.
-  kind: z14.enum(["account", "guest"]),
-  userId: z14.string().nullable()
+  kind: z15.enum(["account", "guest"]),
+  userId: z15.string().nullable()
 });
-var artifactReviewerListResponseSchema = z14.object({
-  reviewers: z14.array(artifactReviewerSchema)
+var artifactReviewerListResponseSchema = z15.object({
+  reviewers: z15.array(artifactReviewerSchema)
 });
 
 // ../shared/src/stats.ts
-import { z as z15 } from "zod";
-var avgViewSecondsSchema = z15.number().int().nonnegative().nullable();
-var versionViewStatsSchema = z15.object({
+import { z as z16 } from "zod";
+var avgViewSecondsSchema = z16.number().int().nonnegative().nullable();
+var versionViewStatsSchema = z16.object({
   avgViewSeconds: avgViewSecondsSchema,
   // Views from inside the review shell's iframe vs. direct visits to
   // the render URL. views = embeddedViews + directViews.
-  directViews: z15.number().int().nonnegative(),
-  embeddedViews: z15.number().int().nonnegative(),
+  directViews: z16.number().int().nonnegative(),
+  embeddedViews: z16.number().int().nonnegative(),
   // Distinct hashed viewer IPs across the version's lifetime.
-  uniqueViewers: z15.number().int().nonnegative(),
-  versionNumber: z15.number().int().positive(),
-  views: z15.number().int().nonnegative()
+  uniqueViewers: z16.number().int().nonnegative(),
+  versionNumber: z16.number().int().positive(),
+  views: z16.number().int().nonnegative()
 });
-var dailyViewsSchema = z15.object({
+var dailyViewsSchema = z16.object({
   avgViewSeconds: avgViewSecondsSchema,
   // UTC day, YYYY-MM-DD.
-  day: z15.string(),
-  uniqueViewers: z15.number().int().nonnegative(),
-  views: z15.number().int().nonnegative()
+  day: z16.string(),
+  uniqueViewers: z16.number().int().nonnegative(),
+  views: z16.number().int().nonnegative()
 });
-var artifactStatsResponseSchema = z15.object({
+var artifactStatsResponseSchema = z16.object({
   avgViewSeconds: avgViewSecondsSchema,
-  daily: z15.array(dailyViewsSchema),
+  daily: z16.array(dailyViewsSchema),
   // Distinct hashed viewer IPs across all versions and days.
-  totalUniqueViewers: z15.number().int().nonnegative(),
-  totalViews: z15.number().int().nonnegative(),
-  versions: z15.array(versionViewStatsSchema)
+  totalUniqueViewers: z16.number().int().nonnegative(),
+  totalViews: z16.number().int().nonnegative(),
+  versions: z16.array(versionViewStatsSchema)
 });
 
 // ../shared/src/versions.ts
-import { z as z16 } from "zod";
-var versionSourceSchema = z16.object({
-  agentName: z16.string().nullable(),
-  type: z16.string()
+import { z as z17 } from "zod";
+var versionSourceSchema = z17.object({
+  agentName: z17.string().nullable(),
+  type: z17.string()
 });
-var versionChangesSchema = z16.object({
-  added: z16.array(z16.string()),
-  changed: z16.array(z16.string()),
-  removed: z16.array(z16.string())
+var versionChangesSchema = z17.object({
+  added: z17.array(z17.string()),
+  changed: z17.array(z17.string()),
+  removed: z17.array(z17.string())
 });
-var versionSummarySchema = z16.object({
+var versionSummarySchema = z17.object({
   // Absent for the first version — there is no previous version to diff against.
   changes: versionChangesSchema.nullable(),
-  createdAt: z16.string(),
-  entryUrl: z16.string().url(),
-  fileCount: z16.number().int().nonnegative(),
-  id: z16.string(),
-  isCurrent: z16.boolean(),
+  createdAt: z17.string(),
+  entryUrl: z17.string().url(),
+  fileCount: z17.number().int().nonnegative(),
+  id: z17.string(),
+  isCurrent: z17.boolean(),
   // Author-supplied bullet-point changelog; null when the publish omitted it.
-  notes: z16.string().nullable(),
+  notes: z17.string().nullable(),
   source: versionSourceSchema,
-  totalSizeBytes: z16.number().int().nonnegative(),
-  versionNumber: z16.number().int().positive()
+  totalSizeBytes: z17.number().int().nonnegative(),
+  versionNumber: z17.number().int().positive()
 });
-var versionListResponseSchema = z16.object({
-  versions: z16.array(versionSummarySchema)
+var versionListResponseSchema = z17.object({
+  versions: z17.array(versionSummarySchema)
 });
 
 // src/api.ts
@@ -933,6 +965,15 @@ function createApiClient(apiUrl2, publishToken) {
         (d) => agentHeartbeatResponseSchema.parse(d)
       );
     },
+    // SPEC-2 §6.3 — create a folder in a workspace. Account key required
+    // (owner/admin; in a personal workspace that's always the user).
+    async createFolder(workspaceId, body) {
+      return request(
+        `${base}/api/v1/workspaces/${workspaceId}/folders`,
+        { body: JSON.stringify(body), headers, method: "POST" },
+        (d) => folderSchema.parse(d)
+      );
+    },
     // SPEC-2 §6.6 — share an artifact with a person (email or user id).
     // Authorized by this client's credential: the publish token (an agent
     // sharing a private draft) or an account key/session. The invitation
@@ -1031,6 +1072,15 @@ function createApiClient(apiUrl2, publishToken) {
         (d) => grantListResponseSchema.parse(d)
       );
     },
+    // SPEC-2 §6.4 — every artifact in a workspace (members see all, with
+    // each artifact's folderId). The only folder-aware artifact listing.
+    async listWorkspaceArtifacts(workspaceId) {
+      return request(
+        `${base}/api/v1/workspaces/${workspaceId}/artifacts`,
+        { headers, method: "GET" },
+        (d) => workspaceArtifactListResponseSchema.parse(d)
+      );
+    },
     async listWorkspaces() {
       return request(
         `${base}/api/v1/workspaces`,
@@ -1091,6 +1141,26 @@ function createApiClient(apiUrl2, publishToken) {
         { body: JSON.stringify({ password }), headers, method: "PUT" },
         (d) => protectionResponseSchema.parse(d)
       );
+    },
+    // SPEC-2 §5.8 — what reviewers may do once they can open it. Same
+    // dual-auth as protection, so the publish token this client holds is
+    // enough (an agent can close review on its own artifact).
+    async setReviewMode(artifactId, mode) {
+      return request(
+        `${base}/api/v1/artifacts/${artifactId}/review-mode`,
+        { body: JSON.stringify({ mode }), headers, method: "PUT" },
+        (d) => reviewModeResponseSchema.parse(d)
+      );
+    },
+    // SPEC.md §6.11 / SPEC-2 §6.4 — update an artifact (folder placement,
+    // title, slug, visibility). Workspace-member action: account key only,
+    // a publish token can't re-file.
+    async updateArtifact(artifactId, body) {
+      return request(
+        `${base}/api/v1/artifacts/${artifactId}`,
+        { body: JSON.stringify(body), headers, method: "PATCH" },
+        (d) => artifactResponseSchema.parse(d)
+      );
     }
   };
 }
@@ -1119,17 +1189,17 @@ import {
   writeFileSync as writeFileSync2
 } from "fs";
 import path2 from "path";
-import { z as z18 } from "zod";
+import { z as z19 } from "zod";
 
 // src/credentials.ts
 import { existsSync, mkdirSync, readFileSync, writeFileSync } from "fs";
 import { homedir } from "os";
 import path from "path";
-import { z as z17 } from "zod";
+import { z as z18 } from "zod";
 var DEFAULT_API_URL = "https://artifact.cafe";
-var credentialsSchema = z17.object({
-  keys: z17.record(z17.string(), z17.string()),
-  version: z17.literal(1)
+var credentialsSchema = z18.object({
+  keys: z18.record(z18.string(), z18.string()),
+  version: z18.literal(1)
 });
 function credentialsPath() {
   return path.join(homedir(), ".artifactcafe", "credentials");
@@ -1179,24 +1249,24 @@ function resolveApiKey(apiUrl2, flag) {
 }
 
 // src/config.ts
-var configSchema = z18.object({
-  apiUrl: z18.string(),
-  artifactId: z18.string(),
-  folder: z18.string().optional(),
-  folderId: z18.string().optional(),
+var configSchema = z19.object({
+  apiUrl: z19.string(),
+  artifactId: z19.string(),
+  folder: z19.string().optional(),
+  folderId: z19.string().optional(),
   // Optional: a folder linked by `link` to an artifact you own carries no
   // token — owner actions authorize via your stored login instead. A first
   // publish still writes the anonymous-mode token here.
-  publishToken: z18.string().optional(),
-  slug: z18.string(),
-  url: z18.string(),
-  workspace: z18.string().optional(),
-  workspaceId: z18.string().optional(),
-  workspaceKind: z18.enum(["personal", "workspace"]).optional()
-});
-var projectConfigSchema = z18.object({
-  folder: z18.string().trim().min(1).optional(),
-  workspace: z18.string().trim().min(1)
+  publishToken: z19.string().optional(),
+  slug: z19.string(),
+  url: z19.string(),
+  workspace: z19.string().optional(),
+  workspaceId: z19.string().optional(),
+  workspaceKind: z19.enum(["personal", "workspace"]).optional()
+});
+var projectConfigSchema = z19.object({
+  folder: z19.string().trim().min(1).optional(),
+  workspace: z19.string().trim().min(1)
 }).strict();
 var CONFIG_DIR = ".artifactcafe";
 var CONFIG_FILE = "config.json";
@@ -1232,7 +1302,7 @@ function readProjectConfig(dir) {
           JSON.parse(readFileSync2(file, "utf8"))
         );
       } catch (error) {
-        const message = error instanceof z18.ZodError ? error.issues[0]?.message ?? "invalid project target" : "invalid JSON";
+        const message = error instanceof z19.ZodError ? error.issues[0]?.message ?? "invalid project target" : "invalid JSON";
         throw new Error(`Invalid ${file}: ${message}.`);
       }
     }
@@ -1755,6 +1825,11 @@ function resolveEntry(files, explicit) {
 
 // src/publish.ts
 var UPLOAD_CONCURRENCY = 6;
+var REVIEW_LABEL = {
+  off: "off \u2014 plain artifact, no review tools",
+  open: "open \u2014 anyone with the link can comment",
+  readonly: "read-only \u2014 existing comments only"
+};
 async function publish(opts) {
   const dir = path6.resolve(opts.dir);
   const config = readConfig(dir);
@@ -1764,6 +1839,14 @@ async function publish(opts) {
       throw new Error(parsed.error.issues[0]?.message ?? "Invalid password.");
     }
   }
+  let reviewMode;
+  if (opts.review !== void 0) {
+    const parsed = reviewModeSchema.safeParse(opts.review);
+    if (!parsed.success) {
+      throw new Error("--review must be one of: open, readonly, off.");
+    }
+    reviewMode = parsed.data;
+  }
   const artifactId = opts.artifact ?? config?.artifactId ?? null;
   const token = (artifactId !== null && artifactId === config?.artifactId ? config.publishToken : void 0) ?? process.env.ARTIFACT_CAFE_TOKEN;
   const apiUrl2 = process.env.ARTIFACT_CAFE_URL ?? config?.apiUrl ?? DEFAULT_API_URL;
@@ -1867,6 +1950,13 @@ async function publish(opts) {
     );
     await protectClient.setProtection(result.artifactId, opts.password);
   }
+  if (reviewMode !== void 0) {
+    const reviewClient = createApiClient(
+      apiUrl2,
+      credential ?? result.publishToken
+    );
+    await reviewClient.setReviewMode(result.artifactId, reviewMode);
+  }
   if (opts.json) {
     console.log(
       JSON.stringify(
@@ -1879,10 +1969,12 @@ async function publish(opts) {
           folderId: placement.folderId ?? null,
           url: result.url,
           versionNumber: result.versionNumber,
+          visibility: result.visibility ?? null,
           workspace: placement.workspace ?? null,
           workspaceId: placement.workspaceId ?? null,
           ...result.claimUrl ? { claimUrl: result.claimUrl } : {},
           ...opts.password === void 0 ? {} : { protected: true },
+          ...reviewMode === void 0 ? {} : { reviewMode },
           filesUploaded: session.filesToUpload.map((f) => f.path),
           ignored: skipped,
           skippedFiles: session.skippedFiles
@@ -1902,6 +1994,11 @@ async function publish(opts) {
     console.log(`Review URL:
 ${result.url}
 `);
+    const access = accessNote(result.visibility);
+    if (access) {
+      console.log(`${access}
+`);
+    }
     if (result.claimUrl) {
       console.log(
         `Claim URL (shown once \u2014 claim to keep this artifact):
@@ -1914,6 +2011,10 @@ ${result.claimUrl}
     if (opts.password !== void 0) {
       console.log("Password protection: on\n");
     }
+    if (reviewMode !== void 0) {
+      console.log(`Review: ${REVIEW_LABEL[reviewMode]}
+`);
+    }
   } else {
     console.log(`
 \u2713 Published v${result.versionNumber}
@@ -1926,14 +2027,32 @@ ${result.claimUrl}
     }
     console.log(`${result.url}
 `);
+    const access = accessNote(result.visibility);
+    if (access) {
+      console.log(`${access}
+`);
+    }
     if (opts.password !== void 0) {
       console.log("Password protection: on\n");
     }
+    if (reviewMode !== void 0) {
+      console.log(`Review: ${REVIEW_LABEL[reviewMode]}
+`);
+    }
   }
   if (opts.open && !opts.json && process.stdout.isTTY) {
     openInBrowser(result.url);
   }
 }
+function accessNote(visibility) {
+  if (visibility === "workspace") {
+    return "Access: workspace members only \u2014 anyone else needs `artifact-cafe share <email>` to open it.";
+  }
+  if (visibility === "private") {
+    return "Access: private \u2014 you, the workspace's admins, and anyone you `artifact-cafe share` it with.";
+  }
+  return null;
+}
 async function resolvePlacement(params) {
   const { apiKey, apiUrl: apiUrl2, config, isNewArtifact, opts } = params;
   const hasPlacementFlag = opts.workspace !== void 0 || opts.folder !== void 0;
@@ -2200,6 +2319,24 @@ function printCliError(err, json) {
 
 // src/folders.ts
 async function folders(opts) {
+  if (opts.action !== void 0 && opts.action !== "create") {
+    throw new Error(
+      `Unknown folders action "${opts.action}" \u2014 run \`folders\` to list, or \`folders create <name>\` to create one.`
+    );
+  }
+  if (opts.action === "create") {
+    if (!opts.name?.trim()) {
+      throw new Error(
+        `Pass the folder name \u2014 e.g. \`artifact-cafe folders create "Design specs" --workspace ${opts.workspace}\`.`
+      );
+    }
+    const visibility = opts.visibility ?? "workspace";
+    if (visibility !== "workspace" && visibility !== "public") {
+      throw new Error(
+        `--visibility must be "workspace" or "public" (got "${opts.visibility}").`
+      );
+    }
+  }
   const apiUrl2 = (process.env.ARTIFACT_CAFE_URL ?? DEFAULT_API_URL).replace(
     /\/$/,
     ""
@@ -2207,7 +2344,7 @@ async function folders(opts) {
   const key = resolveApiKey(apiUrl2, opts.apiKey);
   if (!key) {
     throw new Error(
-      `Listing folders needs an account \u2014 run \`artifact-cafe login\` first (no API key for ${apiOrigin(apiUrl2)}).`
+      `Folder commands need an account \u2014 run \`artifact-cafe login\` first (no API key for ${apiOrigin(apiUrl2)}).`
     );
   }
   const client = createApiClient(apiUrl2, key);
@@ -2220,6 +2357,10 @@ async function folders(opts) {
       `No workspace with handle "${opts.workspace}" belongs to this account.`
     );
   }
+  if (opts.action === "create") {
+    await createFolder(client, workspace, opts);
+    return;
+  }
   const data = await client.listFolders(workspace.id);
   if (opts.json) {
     console.log(JSON.stringify(data, null, 2));
@@ -2238,6 +2379,33 @@ async function folders(opts) {
     printFolder(folder);
   }
 }
+async function createFolder(client, workspace, opts) {
+  const name = opts.name.trim();
+  const visibility = opts.visibility ?? "workspace";
+  const existing = await client.listFolders(workspace.id);
+  const duplicate = existing.folders.find(
+    (candidate) => candidate.name.toLowerCase() === name.toLowerCase()
+  );
+  if (duplicate) {
+    throw new Error(
+      `A folder named "${duplicate.name}" already exists in ${workspace.handle} (${duplicate.id}) \u2014 publish into it with --folder, or pick a different name.`
+    );
+  }
+  const folder = await client.createFolder(workspace.id, { name, visibility });
+  if (opts.json) {
+    console.log(JSON.stringify(folder, null, 2));
+    return;
+  }
+  console.log(
+    `\u2713 Created folder "${folder.name}" (${folder.visibility}) in ${workspace.handle}`
+  );
+  console.log(`  ${folder.id}`);
+  if (folder.visibility === "public") {
+    console.log(
+      "  Artifacts placed in it default to public \u2014 visible to anyone."
+    );
+  }
+}
 function printFolder(folder) {
   console.log(`${folder.name} (${folder.visibility})`);
   console.log(`  ${folder.id}
@@ -2352,7 +2520,12 @@ async function list(opts) {
       `Listing your artifacts needs an account \u2014 run \`artifact-cafe login\` first (no API key for ${apiOrigin(apiUrl2)}).`
     );
   }
-  const data = await createApiClient(apiUrl2, key).listArtifacts();
+  const client = createApiClient(apiUrl2, key);
+  if (opts.workspace !== void 0) {
+    await listWorkspace(client, opts);
+    return;
+  }
+  const data = await client.listArtifacts();
   if (opts.json) {
     console.log(JSON.stringify(data, null, 2));
     return;
@@ -2370,6 +2543,70 @@ async function list(opts) {
     printArtifact(artifact);
   }
 }
+async function listWorkspace(client, opts) {
+  const workspaceData = await client.listWorkspaces();
+  const workspace = workspaceData.workspaces.find(
+    (candidate) => candidate.handle === opts.workspace
+  );
+  if (!workspace) {
+    throw new Error(
+      `No workspace with handle "${opts.workspace}" belongs to this account.`
+    );
+  }
+  const [artifactData, folderData] = await Promise.all([
+    client.listWorkspaceArtifacts(workspace.id),
+    client.listFolders(workspace.id)
+  ]);
+  if (opts.json) {
+    console.log(
+      JSON.stringify(
+        { artifacts: artifactData.artifacts, folders: folderData.folders },
+        null,
+        2
+      )
+    );
+    return;
+  }
+  if (artifactData.artifacts.length === 0) {
+    console.log(`No artifacts in workspace ${workspace.handle}.`);
+    return;
+  }
+  const plural = artifactData.artifacts.length === 1 ? "" : "s";
+  console.log(
+    `${artifactData.artifacts.length} artifact${plural} in ${workspace.handle}
+`
+  );
+  for (const folder of folderData.folders) {
+    const inFolder = artifactData.artifacts.filter(
+      (artifact) => artifact.folderId === folder.id
+    );
+    if (inFolder.length === 0) {
+      continue;
+    }
+    console.log(`${folder.name} (${folder.visibility})`);
+    for (const artifact of inFolder) {
+      printWorkspaceArtifact(artifact);
+    }
+  }
+  const unfiled = artifactData.artifacts.filter(
+    (artifact) => artifact.folderId === null
+  );
+  if (unfiled.length > 0) {
+    console.log("Unfiled");
+    for (const artifact of unfiled) {
+      printWorkspaceArtifact(artifact);
+    }
+  }
+}
+function printWorkspaceArtifact(a) {
+  const version = a.currentVersionNumber === null ? "no version" : `v${a.currentVersionNumber}`;
+  const open2 = a.openCommentCount === 0 ? "no open comments" : `${a.openCommentCount} open comment${a.openCommentCount === 1 ? "" : "s"}`;
+  const marker = a.openCommentCount > 0 ? "\u25CF" : "\u25CB";
+  console.log(
+    `  ${marker} ${a.title} \u2014 ${version} \xB7 ${open2} \xB7 ${a.visibility}`
+  );
+  console.log(`    ${a.url}`);
+}
 function printArtifact(a) {
   const version = a.currentVersionNumber === null ? "no version" : `v${a.currentVersionNumber}`;
   const open2 = a.openCommentCount === 0 ? "no open comments" : `${a.openCommentCount} open comment${a.openCommentCount === 1 ? "" : "s"}`;
@@ -2569,14 +2806,109 @@ async function deleteMessage(opts) {
   console.log(`\u2713 Deleted ${messageId}.`);
 }
 
-// src/open.ts
+// src/move.ts
 import path10 from "path";
-async function openArtifact(opts) {
+async function move(opts) {
+  if (Boolean(opts.folder) === Boolean(opts.unfiled)) {
+    throw new Error("Pass exactly one of --folder <name-or-id> or --unfiled.");
+  }
   const dir = path10.resolve(opts.dir);
   const target = resolveArtifactTarget(dir, {
     apiKey: opts.apiKey,
     artifact: opts.artifact
   });
+  const key = resolveApiKey(target.apiUrl, opts.apiKey);
+  if (!key) {
+    throw new Error(
+      `Moving an artifact needs an account \u2014 run \`artifact-cafe login\` first (no API key for ${apiOrigin(target.apiUrl)}).`
+    );
+  }
+  const client = createApiClient(target.apiUrl, key);
+  const artifact = await client.getArtifact(target.artifactId);
+  if (!artifact.workspaceId) {
+    throw new Error(
+      "This artifact isn't in a workspace \u2014 folders live in workspaces. Claim it (or publish it while logged in) first."
+    );
+  }
+  let folderId = null;
+  let folderName = null;
+  if (opts.folder) {
+    const data = await client.listFolders(artifact.workspaceId);
+    const matches = data.folders.filter(
+      (candidate) => candidate.name === opts.folder || candidate.id === opts.folder
+    );
+    if (matches.length === 0) {
+      throw new Error(
+        `No folder named "${opts.folder}" exists in this workspace \u2014 list them with \`artifact-cafe folders --workspace <handle>\`, or create it with \`folders create\`.`
+      );
+    }
+    if (matches.length > 1) {
+      throw new Error(
+        `More than one folder is named "${opts.folder}"; pass the folder id instead.`
+      );
+    }
+    folderId = matches[0].id;
+    folderName = matches[0].name;
+  }
+  if (artifact.folderId === folderId) {
+    const where = folderName ? `folder "${folderName}"` : "no folder";
+    if (opts.json) {
+      console.log(
+        JSON.stringify(
+          {
+            artifactId: artifact.id,
+            folder: folderName ? { id: folderId, name: folderName } : null,
+            moved: false,
+            title: artifact.title,
+            visibility: artifact.visibility
+          },
+          null,
+          2
+        )
+      );
+      return;
+    }
+    console.log(`"${artifact.title}" is already in ${where} \u2014 nothing to do.`);
+    return;
+  }
+  const updated = await client.updateArtifact(artifact.id, { folderId });
+  if (opts.json) {
+    console.log(
+      JSON.stringify(
+        {
+          artifactId: updated.id,
+          folder: folderName ? { id: folderId, name: folderName } : null,
+          moved: true,
+          previousVisibility: artifact.visibility,
+          title: updated.title,
+          visibility: updated.visibility
+        },
+        null,
+        2
+      )
+    );
+    return;
+  }
+  const destination = folderName ? `"${folderName}"` : "Unfiled";
+  console.log(`\u2713 Moved "${updated.title}" \u2192 ${destination}`);
+  if (updated.visibility !== artifact.visibility) {
+    console.log(
+      `  Visibility: ${artifact.visibility} \u2192 ${updated.visibility} (folder default)`
+    );
+    if (updated.visibility === "public") {
+      console.log("  Now public \u2014 visible to anyone.");
+    }
+  }
+}
+
+// src/open.ts
+import path11 from "path";
+async function openArtifact(opts) {
+  const dir = path11.resolve(opts.dir);
+  const target = resolveArtifactTarget(dir, {
+    apiKey: opts.apiKey,
+    artifact: opts.artifact
+  });
   const url = target.url ?? reviewUrl(
     target.apiUrl,
     (await createApiClient(target.apiUrl, target.credential).getArtifact(
@@ -2590,7 +2922,7 @@ async function openArtifact(opts) {
 }
 
 // src/protect.ts
-import path11 from "path";
+import path12 from "path";
 async function protect(opts) {
   if (opts.off && opts.password !== void 0) {
     throw new Error("Pass either --password or --off, not both.");
@@ -2607,7 +2939,7 @@ async function protect(opts) {
       throw new Error(parsed.error.issues[0]?.message ?? "Invalid password.");
     }
   }
-  const dir = path11.resolve(opts.dir);
+  const dir = path12.resolve(opts.dir);
   const target = resolveArtifactTarget(dir, {
     apiKey: opts.apiKey,
     artifact: opts.artifact
@@ -2632,7 +2964,7 @@ async function protect(opts) {
 }
 
 // src/reply.ts
-import path12 from "path";
+import path13 from "path";
 async function readStdin3() {
   if (process.stdin.isTTY) {
     return "";
@@ -2656,7 +2988,7 @@ async function replyToThread(opts) {
       'Nothing to post. Pass the reply with --body "\u2026", or pipe it on stdin.'
     );
   }
-  const dir = path12.resolve(opts.dir);
+  const dir = path13.resolve(opts.dir);
   const target = resolveArtifactTarget(dir, {
     apiKey: opts.apiKey,
     artifact: opts.artifact
@@ -2685,7 +3017,7 @@ async function replyToThread(opts) {
 }
 
 // src/resolve.ts
-import path13 from "path";
+import path14 from "path";
 async function changeThreadStatus(opts) {
   const threadId = opts.thread?.trim();
   if (!threadId) {
@@ -2693,7 +3025,7 @@ async function changeThreadStatus(opts) {
       `Pass the thread id to ${opts.action} \u2014 get it from \`artifact-cafe comments --json\`.`
     );
   }
-  const dir = path13.resolve(opts.dir);
+  const dir = path14.resolve(opts.dir);
   const target = resolveArtifactTarget(dir, {
     apiKey: opts.apiKey,
     artifact: opts.artifact
@@ -2729,11 +3061,47 @@ async function changeThreadStatus(opts) {
   console.log(`\u2713 ${verb} ${thread.id} \u2014 now ${thread.status}.`);
 }
 
+// src/review.ts
+import path15 from "path";
+var OUTCOME = {
+  off: "Plain artifact \u2014 the review tools are hidden entirely",
+  open: "Open for review \u2014 anyone who can open it can comment",
+  readonly: "Read-only \u2014 earlier comments stay visible, no new ones"
+};
+async function review(opts) {
+  const parsed = reviewModeSchema.safeParse(opts.mode);
+  if (!parsed.success) {
+    throw new Error(
+      "Provide a mode: open, readonly, or off. `readonly` keeps existing comments readable and refuses new ones; `off` hides the review layer entirely."
+    );
+  }
+  const mode = parsed.data;
+  const dir = path15.resolve(opts.dir);
+  const target = resolveArtifactTarget(dir, {
+    apiKey: opts.apiKey,
+    artifact: opts.artifact
+  });
+  const client = createApiClient(target.apiUrl, target.credential);
+  const res = await client.setReviewMode(target.artifactId, mode);
+  if (opts.json) {
+    console.log(JSON.stringify({ reviewMode: res.mode }, null, 2));
+    return;
+  }
+  const url = target.url ?? reviewUrl(
+    target.apiUrl,
+    (await client.getArtifact(target.artifactId)).slug
+  );
+  console.log(`
+\u2713 ${OUTCOME[res.mode]}
+  ${url}
+`);
+}
+
 // src/share.ts
-import path14 from "path";
+import path16 from "path";
 var EMAIL_RE = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
 async function share(opts) {
-  const dir = path14.resolve(opts.dir);
+  const dir = path16.resolve(opts.dir);
   const target = resolveArtifactTarget(dir, {
     apiKey: opts.apiKey,
     artifact: opts.artifact
@@ -2788,7 +3156,7 @@ General access: ${visibility}`);
   console.log("");
 }
 async function unshare(opts) {
-  const dir = path14.resolve(opts.dir);
+  const dir = path16.resolve(opts.dir);
   const target = resolveArtifactTarget(dir, {
     apiKey: opts.apiKey,
     artifact: opts.artifact
@@ -2811,7 +3179,7 @@ async function unshare(opts) {
 }
 
 // src/status.ts
-import path15 from "path";
+import path17 from "path";
 async function status(opts) {
   if (!AGENT_STATES.includes(opts.state)) {
     throw new Error(
@@ -2819,7 +3187,7 @@ async function status(opts) {
     );
   }
   const state = opts.state;
-  const dir = path15.resolve(opts.dir);
+  const dir = path17.resolve(opts.dir);
   const target = resolveArtifactTarget(dir, {
     apiKey: opts.apiKey,
     artifact: opts.artifact
@@ -2848,26 +3216,26 @@ async function status(opts) {
 import { existsSync as existsSync3, mkdirSync as mkdirSync3, readFileSync as readFileSync5, writeFileSync as writeFileSync3 } from "fs";
 import { createRequire } from "module";
 import { homedir as homedir2 } from "os";
-import path16 from "path";
-import { z as z19 } from "zod";
+import path18 from "path";
+import { z as z20 } from "zod";
 var REGISTRY_LATEST_URL = "https://registry.npmjs.org/artifact-cafe/latest";
 var SKILL_SOURCE_URL = "https://raw.githubusercontent.com/Artifact-Cafe/skill/main/artifact-cafe/SKILL.md";
 var SKILL_UPDATE_COMMAND = "npx skills add artifact-cafe/skill --skill artifact-cafe -g";
 var CHECK_TTL_MS = 24 * 60 * 60 * 1e3;
 var FETCH_TIMEOUT_MS = 2e3;
 var SKILL_VERSION_PATTERN = /\*\*Skill version:\s*(\d+\.\d+\.\d+)\*\*/;
-var cacheSchema = z19.object({
-  checkedAt: z19.number(),
-  cliLatest: z19.string().nullable(),
-  skillLatest: z19.string().nullable(),
-  version: z19.literal(1)
+var cacheSchema = z20.object({
+  checkedAt: z20.number(),
+  cliLatest: z20.string().nullable(),
+  skillLatest: z20.string().nullable(),
+  version: z20.literal(1)
 });
 function cliVersion() {
   const pkg = createRequire(import.meta.url)("../package.json");
   return pkg.version;
 }
 function cachePath() {
-  return path16.join(homedir2(), ".artifactcafe", "update-check.json");
+  return path18.join(homedir2(), ".artifactcafe", "update-check.json");
 }
 function readCache() {
   try {
@@ -2878,7 +3246,7 @@ function readCache() {
 }
 function writeCache(cache) {
   try {
-    mkdirSync3(path16.dirname(cachePath()), { mode: 448, recursive: true });
+    mkdirSync3(path18.dirname(cachePath()), { mode: 448, recursive: true });
     writeFileSync3(cachePath(), `${JSON.stringify(cache, null, 2)}
 `);
   } catch {
@@ -2915,7 +3283,7 @@ async function fetchText(url) {
 }
 async function fetchLatestVersions(previous) {
   const [cli, skill] = await Promise.all([
-    fetchJson(REGISTRY_LATEST_URL).then((body) => z19.object({ version: z19.string() }).parse(body).version).catch(() => null),
+    fetchJson(REGISTRY_LATEST_URL).then((body) => z20.object({ version: z20.string() }).parse(body).version).catch(() => null),
     fetchText(SKILL_SOURCE_URL).then((body) => SKILL_VERSION_PATTERN.exec(body)?.[1] ?? null).catch(() => null)
   ]);
   return {
@@ -2931,7 +3299,7 @@ function installedSkillVersions() {
   const versions = [];
   for (const root of roots) {
     for (const dir of dirs) {
-      const file = path16.join(root, dir, "skills", "artifact-cafe", "SKILL.md");
+      const file = path18.join(root, dir, "skills", "artifact-cafe", "SKILL.md");
       if (!existsSync3(file)) {
         continue;
       }
@@ -3072,6 +3440,10 @@ var publish2 = defineCommand({
       description: "Password-protect the artifact (min 6 chars)",
       type: "string"
     },
+    review: {
+      description: "Review mode: open (default), readonly, or off (plain artifact)",
+      type: "string"
+    },
     title: { description: "Artifact title", type: "string" },
     workspace: {
       description: "Publish into this workspace handle",
@@ -3091,6 +3463,7 @@ var publish2 = defineCommand({
         notes: readNotesArg(process.argv.slice(2)),
         open: !args["no-open"],
         password: args.password,
+        review: args.review,
         title: args.title,
         workspace: args.workspace
       });
@@ -3161,7 +3534,11 @@ var list2 = defineCommand({
       description: "List with this API key (default: stored login)",
       type: "string"
     },
-    json: { description: "Machine-readable output", type: "boolean" }
+    json: { description: "Machine-readable output", type: "boolean" },
+    workspace: {
+      description: "List this workspace's artifacts, grouped by folder",
+      type: "string"
+    }
   },
   meta: {
     description: "List the artifacts your account owns",
@@ -3169,7 +3546,11 @@ var list2 = defineCommand({
   },
   async run({ args }) {
     try {
-      await list({ apiKey: args["api-key"], json: Boolean(args.json) });
+      await list({
+        apiKey: args["api-key"],
+        json: Boolean(args.json),
+        workspace: args.workspace
+      });
     } catch (err) {
       printCliError(err, Boolean(args.json));
       process.exit(1);
@@ -3178,26 +3559,43 @@ var list2 = defineCommand({
 });
 var folders2 = defineCommand({
   args: {
+    action: {
+      description: 'Optional action: "create"',
+      required: false,
+      type: "positional"
+    },
     "api-key": {
-      description: "List with this API key (default: stored login)",
+      description: "Authorize with an account API key (default: stored login)",
       type: "string"
     },
     json: { description: "Machine-readable output", type: "boolean" },
+    name: {
+      description: "Folder name (with create)",
+      required: false,
+      type: "positional"
+    },
+    visibility: {
+      description: "With create: workspace (default) | public",
+      type: "string"
+    },
     workspace: {
-      description: "Workspace handle whose folders to list",
+      description: "Workspace handle to list or create in",
       required: true,
       type: "string"
     }
   },
   meta: {
-    description: "List folders in a workspace",
+    description: "List a workspace's folders, or create one (folders create)",
     name: "folders"
   },
   async run({ args }) {
     try {
       await folders({
+        action: args.action,
         apiKey: args["api-key"],
         json: Boolean(args.json),
+        name: args.name,
+        visibility: args.visibility,
         workspace: args.workspace
       });
     } catch (err) {
@@ -3206,6 +3604,51 @@ var folders2 = defineCommand({
     }
   }
 });
+var move2 = defineCommand({
+  args: {
+    "api-key": {
+      description: "Authorize with an account API key (default: stored login)",
+      type: "string"
+    },
+    artifact: {
+      description: "Move this artifact ID instead of the linked folder",
+      type: "string"
+    },
+    dir: {
+      default: ".",
+      description: "Linked directory to resolve the artifact from (default: .)",
+      type: "string"
+    },
+    folder: {
+      description: "Target folder name (or id) in the artifact's workspace",
+      type: "string"
+    },
+    json: { description: "Machine-readable output", type: "boolean" },
+    unfiled: {
+      description: "Move out of its folder (workspace root)",
+      type: "boolean"
+    }
+  },
+  meta: {
+    description: "Move an artifact into a workspace folder (or --unfiled)",
+    name: "move"
+  },
+  async run({ args }) {
+    try {
+      await move({
+        apiKey: args["api-key"],
+        artifact: args.artifact,
+        dir: args.dir,
+        folder: args.folder,
+        json: Boolean(args.json),
+        unfiled: Boolean(args.unfiled)
+      });
+    } catch (err) {
+      printCliError(err, Boolean(args.json));
+      process.exit(1);
+    }
+  }
+});
 var workspaces2 = defineCommand({
   args: {
     "api-key": {
@@ -3474,6 +3917,47 @@ var protect2 = defineCommand({
     }
   }
 });
+var review2 = defineCommand({
+  args: {
+    "api-key": {
+      description: "Authorize with an account API key (default: stored login)",
+      type: "string"
+    },
+    artifact: {
+      description: "Act on an artifact ID instead of the linked folder",
+      type: "string"
+    },
+    dir: {
+      default: ".",
+      description: "Published directory",
+      type: "string"
+    },
+    json: { description: "Machine-readable output", type: "boolean" },
+    mode: {
+      description: "open, readonly, or off (plain artifact)",
+      required: true,
+      type: "positional"
+    }
+  },
+  meta: {
+    description: "Open, close, or freeze review on the linked artifact",
+    name: "review"
+  },
+  async run({ args }) {
+    try {
+      await review({
+        apiKey: args["api-key"],
+        artifact: args.artifact,
+        dir: args.dir,
+        json: Boolean(args.json),
+        mode: args.mode
+      });
+    } catch (err) {
+      printCliError(err, Boolean(args.json));
+      process.exit(1);
+    }
+  }
+});
 var threadStatusCommand = (action) => defineCommand({
   args: {
     "api-key": {
@@ -3884,12 +4368,14 @@ var main = defineCommand({
     listen,
     login: login2,
     logout: logout2,
+    move: move2,
     open,
     protect: protect2,
     publish: publish2,
     reopen,
     reply,
     resolve,
+    review: review2,
     share: share2,
     status: statusCmd,
     unshare: unshare2,