artifact-cafe 0.0.13 → 0.0.15

package/dist/index.js

@@ -83,35 +83,125 @@ var artifactListResponseSchema = z.object({
   artifacts: z.array(artifactListItemSchema)
 });
 
-// ../shared/src/avatars.ts
+// ../shared/src/agent-tokens.ts
 import { z as z2 } from "zod";
+var createAgentTokenSchema = z2.object({
+  externalId: z2.string().min(1).max(1024),
+  name: z2.string().trim().min(1).max(100).optional(),
+  ttlSeconds: z2.number().int().positive().max(3600)
+});
+var agentTokenResponseSchema = z2.object({
+  expiresAt: z2.string().datetime(),
+  token: z2.string(),
+  workspaceId: z2.string()
+});
+
+// ../shared/src/agents.ts
+var AGENT_BRANDS = [
+  {
+    id: "claude-code",
+    label: "Claude Code",
+    match: ["claude"],
+    short: "Claude"
+  },
+  {
+    id: "codex",
+    label: "OpenAI Codex",
+    match: ["codex"],
+    short: "Codex"
+  },
+  { id: "cursor", label: "Cursor", match: ["cursor"], short: "Cursor" },
+  {
+    id: "copilot",
+    label: "GitHub Copilot",
+    match: ["copilot"],
+    short: "Copilot"
+  },
+  {
+    id: "gemini-cli",
+    label: "Gemini CLI",
+    match: ["gemini"],
+    short: "Gemini"
+  },
+  { id: "opencode", label: "opencode", match: ["opencode"], short: "opencode" },
+  {
+    id: "openclaw",
+    label: "OpenClaw",
+    match: ["openclaw"],
+    short: "OpenClaw"
+  },
+  { id: "hermes", label: "Hermes", match: ["hermes"], short: "Hermes" }
+];
+function normalizeAgent(raw) {
+  const value = raw?.trim().toLowerCase();
+  if (!value) {
+    return null;
+  }
+  return AGENT_BRANDS.find((brand) => brand.id === value) ?? AGENT_BRANDS.find((brand) => brand.match.some((m) => value.includes(m))) ?? null;
+}
+var ENV_FINGERPRINTS = [
+  { id: "claude-code", prefixes: ["CLAUDECODE", "CLAUDE_CODE_"] },
+  { id: "codex", prefixes: ["CODEX_"] },
+  { id: "cursor", prefixes: ["CURSOR_"] },
+  { id: "copilot", prefixes: ["COPILOT_", "GITHUB_COPILOT_"] },
+  { id: "gemini-cli", prefixes: ["GEMINI_CLI", "GEMINI_SANDBOX"] },
+  { id: "opencode", prefixes: ["OPENCODE"] }
+];
+function detectAgentFromEnv(env) {
+  const explicit = env.ARTIFACT_CAFE_AGENT?.trim();
+  if (explicit) {
+    return explicit;
+  }
+  const keys = Object.keys(env).filter((key) => env[key]);
+  for (const { id, prefixes } of ENV_FINGERPRINTS) {
+    const hit = keys.some(
+      (key) => prefixes.some((prefix) => key.startsWith(prefix))
+    );
+    if (hit) {
+      return AGENT_BRANDS.find((brand) => brand.id === id)?.label;
+    }
+  }
+  return normalizeAgent(env.AI_AGENT)?.label;
+}
+
+// ../shared/src/avatars.ts
+import { z as z3 } from "zod";
 var AVATAR_CONTENT_TYPES = [
   "image/png",
   "image/jpeg",
   "image/webp"
 ];
 var AVATAR_MAX_BYTES = 2 * 1024 * 1024;
-var avatarContentTypeSchema = z2.enum(AVATAR_CONTENT_TYPES);
-var userAvatarResponseSchema = z2.object({
-  image: z2.string().nullable()
+var avatarContentTypeSchema = z3.enum(AVATAR_CONTENT_TYPES);
+var userAvatarResponseSchema = z3.object({
+  image: z3.string().nullable()
 });
-var workspaceAvatarResponseSchema = z2.object({
-  logo: z2.string().nullable()
+var workspaceAvatarResponseSchema = z3.object({
+  logo: z3.string().nullable()
 });
 
 // ../shared/src/comments.ts
-import { z as z5 } from "zod";
+import { z as z7 } from "zod";
 
-// ../shared/src/publish.ts
+// ../shared/src/emoji.ts
 import { z as z4 } from "zod";
+var SINGLE_EMOJI = new RegExp("^\\p{RGI_Emoji}$", "v");
+var REDUNDANT_VS16 = new RegExp("(\\p{Emoji_Presentation})\\uFE0F", "gu");
+function canonicalizeEmoji(s) {
+  return s.replace(REDUNDANT_VS16, "$1");
+}
+var iconEmojiSchema = z4.string().max(64).transform(canonicalizeEmoji).refine((s) => SINGLE_EMOJI.test(s), { message: "Must be a single emoji." }).nullable().describe("A single emoji shown as the icon, or null for the default.");
+
+// ../shared/src/publish.ts
+import { z as z6 } from "zod";
 
 // ../shared/src/review-mode.ts
-import { z as z3 } from "zod";
-var reviewModeSchema = z3.enum(["open", "readonly", "off"]);
-var setReviewModeSchema = z3.object({
+import { z as z5 } from "zod";
+var reviewModeSchema = z5.enum(["open", "readonly", "off"]);
+var setReviewModeSchema = z5.object({
   mode: reviewModeSchema
 });
-var reviewModeResponseSchema = z3.object({
+var reviewModeResponseSchema = z5.object({
   mode: reviewModeSchema
 });
 
@@ -128,266 +218,276 @@ function isSafeArtifactPath(p) {
   }
   return p.split("/").every((seg) => seg.length > 0 && seg !== "." && seg !== "..");
 }
-var manifestFileSchema = z4.object({
-  hash: z4.string().regex(/^sha256_[a-f0-9]{64}$/),
-  mimeType: z4.string().regex(/^[-\w.+]+\/[-\w.+]+$/, { message: "invalid MIME type" }),
-  path: z4.string().min(1).max(1024).refine(isSafeArtifactPath, {
+var CARD_DESCRIPTION_MAX = 300;
+var CARD_IMAGE_MAX_BYTES = 5 * 1024 * 1024;
+var manifestFileSchema = z6.object({
+  hash: z6.string().regex(/^sha256_[a-f0-9]{64}$/),
+  mimeType: z6.string().regex(/^[-\w.+]+\/[-\w.+]+$/, { message: "invalid MIME type" }),
+  path: z6.string().min(1).max(1024).refine(isSafeArtifactPath, {
     message: "path must be a safe relative path"
   }),
-  size: z4.number().int().positive()
-});
-var publishSourceSchema = z4.object({
-  agent: z4.string().optional(),
-  runId: z4.string().optional(),
-  type: z4.literal("cli")
-});
-var createPublishSessionSchema = z4.object({
-  artifactId: z4.string().nullable(),
-  entryPath: z4.string().optional(),
-  files: z4.array(manifestFileSchema).min(1).max(1e3),
+  size: z6.number().int().positive()
+});
+var publishSourceSchema = z6.object({
+  agent: z6.string().optional(),
+  runId: z6.string().optional(),
+  type: z6.literal("cli")
+});
+var createPublishSessionSchema = z6.object({
+  artifactId: z6.string().nullable(),
+  // One-line share-card summary (`--description`). Overrides whatever the
+  // entry HTML declares; leave it off and the API reads the document's own
+  // `og:description`/`description` at finalize.
+  description: z6.string().max(CARD_DESCRIPTION_MAX).optional(),
+  entryPath: z6.string().optional(),
+  files: z6.array(manifestFileSchema).min(1).max(1e3),
   // SPEC-2 §6.4 — workspace placement is available only to authenticated
   // members; the API enforces membership and folder ownership. folderId
   // without workspaceId resolves against the account's personal workspace.
-  folderId: z4.string().min(1).optional(),
+  folderId: z6.string().min(1).optional(),
   // Bullet-point changelog for this version, authored by the publisher.
   // Optional on every publish (incl. v1); stored immutably on the version.
-  notes: z4.string().max(4e3).optional(),
+  notes: z6.string().max(4e3).optional(),
   source: publishSourceSchema,
-  title: z4.string().max(200).optional(),
-  workspaceId: z4.string().min(1).optional()
-});
-var publishSessionResponseSchema = z4.object({
-  artifactId: z4.string(),
-  expiresAt: z4.string(),
-  filesToUpload: z4.array(
-    z4.object({
-      method: z4.literal("PUT"),
-      path: z4.string(),
-      uploadUrl: z4.string().url()
+  title: z6.string().max(200).optional(),
+  workspaceId: z6.string().min(1).optional()
+});
+var publishSessionResponseSchema = z6.object({
+  artifactId: z6.string(),
+  expiresAt: z6.string(),
+  filesToUpload: z6.array(
+    z6.object({
+      method: z6.literal("PUT"),
+      path: z6.string(),
+      uploadUrl: z6.string().url()
     })
   ),
-  publishSessionId: z4.string(),
-  skippedFiles: z4.array(z4.string()),
-  versionId: z4.string()
+  publishSessionId: z6.string(),
+  skippedFiles: z6.array(z6.string()),
+  versionId: z6.string()
 });
-var finalizeResponseSchema = z4.object({
-  artifactId: z4.string(),
+var finalizeResponseSchema = z6.object({
+  artifactId: z6.string(),
   // API-key publishes create the artifact already claimed (SPEC §5.4) —
   // the CLI uses this to tell "claim URL pending" from "already yours".
-  claimed: z4.boolean(),
+  claimed: z6.boolean(),
   // Returned only on first publish of a new artifact (one-time).
-  claimUrl: z4.string().url().optional(),
-  publishToken: z4.string().optional(),
-  url: z4.string().url(),
-  versionId: z4.string(),
-  versionNumber: z4.number().int().positive(),
+  claimUrl: z6.string().url().optional(),
+  publishToken: z6.string().optional(),
+  url: z6.string().url(),
+  versionId: z6.string(),
+  versionNumber: z6.number().int().positive(),
   // SPEC-2 §5.2 — who can open the review URL. A publish into a folder
   // inherits that folder's visibility, so this is the only place the CLI
   // learns that a link it just printed is members-only. Optional so a new
   // CLI against an older API degrades to "unknown" instead of failing the
   // publish over a field that only shapes the closing message.
-  visibility: z4.enum(["public", "unlisted", "workspace", "private"]).optional()
-});
-var artifactResponseSchema = z4.object({
-  claimed: z4.boolean(),
-  currentVersion: z4.object({
-    entryUrl: z4.string().url(),
-    id: z4.string(),
-    versionNumber: z4.number().int().positive()
+  visibility: z6.enum(["public", "unlisted", "workspace", "private"]).optional(),
+  workspaceId: z6.string().nullable().optional()
+});
+var artifactResponseSchema = z6.object({
+  claimed: z6.boolean(),
+  currentVersion: z6.object({
+    entryUrl: z6.string().url(),
+    id: z6.string(),
+    versionNumber: z6.number().int().positive()
   }).nullable(),
+  // Custom icon, or null to render the default document glyph.
+  emoji: z6.string().nullable(),
   // SPEC-2 §6.4 — placement + visibility surface on the artifact.
-  folderId: z4.string().nullable(),
-  id: z4.string(),
+  folderId: z6.string().nullable(),
+  id: z6.string(),
   // SPEC-2 §5.8 — what a viewer may do once in (open / readonly / off).
   reviewMode: reviewModeSchema,
-  slug: z4.string(),
-  title: z4.string(),
-  visibility: z4.enum(["public", "unlisted", "workspace", "private"]),
-  workspaceId: z4.string().nullable()
+  slug: z6.string(),
+  title: z6.string(),
+  visibility: z6.enum(["public", "unlisted", "workspace", "private"]),
+  workspaceId: z6.string().nullable()
 });
 
 // ../shared/src/comments.ts
-var anchorPageSchema = z5.string().max(1024).refine(isSafeArtifactPath, {
+var anchorPageSchema = z7.string().max(1024).refine(isSafeArtifactPath, {
   message: "page must be a safe relative path"
 }).optional();
-var elementSnapshotSchema = z5.object({
-  classes: z5.string().max(256).optional(),
-  id: z5.string().max(256).optional(),
-  tag: z5.string().min(1).max(128),
-  text: z5.string().max(200).optional()
+var elementSnapshotSchema = z7.object({
+  classes: z7.string().max(256).optional(),
+  id: z7.string().max(256).optional(),
+  tag: z7.string().min(1).max(128),
+  text: z7.string().max(200).optional()
 });
-var pointAnchorSchema = z5.object({
+var pointAnchorSchema = z7.object({
   element: elementSnapshotSchema.optional(),
   // elementPath is the primary anchor; x/y are offsets within the
   // element's box, normalized 0..1 (SPEC.md §8.1).
-  elementPath: z5.string().max(2048),
+  elementPath: z7.string().max(2048),
   page: anchorPageSchema,
-  type: z5.literal("point"),
-  viewportHeight: z5.number().int().positive().max(1e5),
-  viewportWidth: z5.number().int().positive().max(1e5),
-  x: z5.number().min(0).max(1),
-  y: z5.number().min(0).max(1)
-});
-var textAnchorSchema = z5.object({
-  elementPath: z5.string().max(2048),
-  endOffset: z5.number().int().nonnegative().max(1e8),
+  type: z7.literal("point"),
+  viewportHeight: z7.number().int().positive().max(1e5),
+  viewportWidth: z7.number().int().positive().max(1e5),
+  x: z7.number().min(0).max(1),
+  y: z7.number().min(0).max(1)
+});
+var textAnchorSchema = z7.object({
+  elementPath: z7.string().max(2048),
+  endOffset: z7.number().int().nonnegative().max(1e8),
   page: anchorPageSchema,
-  prefix: z5.string().max(200).optional(),
-  quote: z5.string().min(1).max(1e3),
-  startOffset: z5.number().int().nonnegative().max(1e8),
-  suffix: z5.string().max(200).optional(),
-  type: z5.literal("text")
+  prefix: z7.string().max(200).optional(),
+  quote: z7.string().min(1).max(1e3),
+  startOffset: z7.number().int().nonnegative().max(1e8),
+  suffix: z7.string().max(200).optional(),
+  type: z7.literal("text")
 });
-var pageAnchorSchema = z5.object({
+var pageAnchorSchema = z7.object({
   page: anchorPageSchema,
-  type: z5.literal("page")
+  type: z7.literal("page")
 });
-var anchorSchema = z5.discriminatedUnion("type", [
+var anchorSchema = z7.discriminatedUnion("type", [
   pointAnchorSchema,
   textAnchorSchema,
   pageAnchorSchema
 ]);
-var displayNameSchema = z5.string().trim().min(1).max(64);
-var guestSchema = z5.object({
+var displayNameSchema = z7.string().trim().min(1).max(64);
+var guestSchema = z7.object({
   displayName: displayNameSchema,
-  guestId: z5.string().min(16)
+  guestId: z7.string().min(16)
 });
-var viaLabelSchema = z5.string().trim().min(1).max(64);
-var createCommentThreadSchema = z5.object({
+var viaLabelSchema = z7.string().trim().min(1).max(64);
+var createCommentThreadSchema = z7.object({
   anchor: anchorSchema,
-  body: z5.string().min(1).max(1e4),
+  body: z7.string().min(1).max(1e4),
   guest: guestSchema.optional(),
-  versionId: z5.string(),
+  versionId: z7.string(),
   via: viaLabelSchema.optional()
 });
-var createCommentMessageSchema = z5.object({
-  body: z5.string().min(1).max(1e4),
+var createCommentMessageSchema = z7.object({
+  body: z7.string().min(1).max(1e4),
   guest: guestSchema.optional(),
   via: viaLabelSchema.optional()
 });
-var editCommentMessageSchema = z5.object({
-  body: z5.string().min(1).max(1e4),
+var editCommentMessageSchema = z7.object({
+  body: z7.string().min(1).max(1e4),
   guest: guestSchema.optional()
 });
-var threadActionSchema = z5.object({
+var threadActionSchema = z7.object({
   guest: guestSchema.optional()
 });
-var SINGLE_EMOJI = new RegExp("^\\p{RGI_Emoji}$", "v");
-var REDUNDANT_VS16 = new RegExp("(\\p{Emoji_Presentation})\\uFE0F", "gu");
-function canonicalizeEmoji(s) {
-  return s.replace(REDUNDANT_VS16, "$1");
-}
-var reactionEmojiSchema = z5.string().max(64).transform(canonicalizeEmoji).refine((s) => SINGLE_EMOJI.test(s), { message: "Must be a single emoji." }).describe("A single emoji, e.g. \u{1F44D}");
-var toggleReactionSchema = z5.object({
+var reactionEmojiSchema = z7.string().max(64).transform(canonicalizeEmoji).refine((s) => SINGLE_EMOJI.test(s), { message: "Must be a single emoji." }).describe("A single emoji, e.g. \u{1F44D}");
+var toggleReactionSchema = z7.object({
   emoji: reactionEmojiSchema,
   guest: guestSchema.optional()
 });
-var commentAuthorSchema = z5.object({
-  avatarUrl: z5.string().nullable(),
-  displayName: z5.string(),
-  guestId: z5.string().nullable(),
-  isViewer: z5.boolean(),
-  kind: z5.enum(["member", "guest"]),
+var commentAgentSchema = z7.object({
+  id: z7.string().nullable(),
+  label: z7.string()
+});
+var commentAuthorSchema = z7.object({
+  agent: commentAgentSchema.nullable().default(null),
+  avatarUrl: z7.string().nullable(),
+  displayName: z7.string(),
+  guestId: z7.string().nullable(),
+  isViewer: z7.boolean(),
+  kind: z7.enum(["member", "guest"]),
   // Optional "via" attribution (§6.4). Null for plain comments; a bounded
-  // label the shell appends after the display name.
-  via: z5.string().nullable()
+  // label the shell appends after the display name. Defaulted for the same
+  // reason as `agent`: a server predating §6.4 omits the key entirely.
+  via: z7.string().nullable().default(null)
 });
-var messageReactionSchema = z5.object({
-  emoji: z5.string(),
-  reactors: z5.array(commentAuthorSchema)
+var messageReactionSchema = z7.object({
+  emoji: z7.string(),
+  reactors: z7.array(commentAuthorSchema)
 });
-var commentMessageSchema = z5.object({
+var commentMessageSchema = z7.object({
   author: commentAuthorSchema,
   // Empty string for a deleted message — the body is stripped server-side
   // (§6.7.1 tombstone), never sent to the client and hidden there.
-  body: z5.string(),
-  createdAt: z5.string(),
+  body: z7.string(),
+  createdAt: z7.string(),
   // Soft-deleted (§6.7.1). A tombstone keeps thread structure and replies;
   // the shell renders "Comment deleted" instead of the (absent) body.
-  deleted: z5.boolean(),
+  deleted: z7.boolean(),
   // Last edit time (§6.7.1), or null if never edited — drives the "edited"
   // badge. No edit history is kept.
-  editedAt: z5.string().nullable(),
-  id: z5.string(),
+  editedAt: z7.string().nullable(),
+  id: z7.string(),
   // Defaulted, not required: a new CLI parsing an older server's
   // response must not fail on the missing key.
-  reactions: z5.array(messageReactionSchema).default([])
+  reactions: z7.array(messageReactionSchema).default([])
 });
-var threadActorSchema = z5.object({
-  displayName: z5.string(),
-  kind: z5.enum(["member", "guest", "agent"])
+var threadActorSchema = z7.object({
+  displayName: z7.string(),
+  kind: z7.enum(["member", "guest", "agent"])
 });
-var commentThreadSchema = z5.object({
+var commentThreadSchema = z7.object({
   // §6.6.1 — set while open to signal "seen, working on it"; cleared on
   // reopen, kept (but superseded in display) once resolved. Defaulted so
   // clients parsing an older server's response don't fail.
-  acknowledgedAt: z5.string().nullable().default(null),
+  acknowledgedAt: z7.string().nullable().default(null),
   acknowledgedBy: threadActorSchema.nullable().default(null),
   anchor: anchorSchema,
-  artifactId: z5.string(),
-  createdAt: z5.string(),
+  artifactId: z7.string(),
+  createdAt: z7.string(),
   createdBy: commentAuthorSchema,
-  id: z5.string(),
-  messages: z5.array(commentMessageSchema),
+  id: z7.string(),
+  messages: z7.array(commentMessageSchema),
   // Null on threads resolved before actor recording existed, and always
   // null while open.
   resolvedBy: threadActorSchema.nullable().default(null),
-  status: z5.enum(["open", "resolved"]),
-  versionId: z5.string()
+  status: z7.enum(["open", "resolved"]),
+  versionId: z7.string()
 });
-var commentThreadListSchema = z5.object({
-  threads: z5.array(commentThreadSchema)
+var commentThreadListSchema = z7.object({
+  threads: z7.array(commentThreadSchema)
 });
-var commentExportQuerySchema = z5.object({
-  status: z5.enum(["open", "resolved", "all"]).default("open"),
-  version: z5.enum(["current", "all"]).default("current")
+var commentExportQuerySchema = z7.object({
+  status: z7.enum(["open", "resolved", "all"]).default("open"),
+  version: z7.enum(["current", "all"]).default("current")
 });
-var exportReactionSchema = z5.object({
-  count: z5.number().int().positive(),
-  emoji: z5.string()
+var exportReactionSchema = z7.object({
+  count: z7.number().int().positive(),
+  emoji: z7.string()
 });
-var commentExportReplySchema = z5.object({
-  author: z5.string(),
-  authorKind: z5.enum(["member", "guest"]),
-  body: z5.string(),
-  createdAt: z5.string(),
+var commentExportReplySchema = z7.object({
+  author: z7.string(),
+  authorKind: z7.enum(["member", "guest"]),
+  body: z7.string(),
+  createdAt: z7.string(),
   // Soft-delete tombstone (§6.7.1): body is "" when true.
-  deleted: z5.boolean(),
-  editedAt: z5.string().nullable(),
+  deleted: z7.boolean(),
+  editedAt: z7.string().nullable(),
   // The message id — what `edit`/`delete` target (§5.1).
-  id: z5.string(),
-  reactions: z5.array(exportReactionSchema).optional()
+  id: z7.string(),
+  reactions: z7.array(exportReactionSchema).optional()
 });
-var commentExportThreadSchema = z5.object({
+var commentExportThreadSchema = z7.object({
   // §6.6.1 — lets a polling agent skip threads it already acknowledged
   // (acknowledged threads stay in status=open exports on purpose).
-  acknowledgedAt: z5.string().nullable().default(null),
+  acknowledgedAt: z7.string().nullable().default(null),
   anchor: anchorSchema,
-  author: z5.string(),
-  authorKind: z5.enum(["member", "guest"]),
-  body: z5.string(),
-  createdAt: z5.string(),
-  deleted: z5.boolean(),
-  editedAt: z5.string().nullable(),
-  id: z5.string(),
+  author: z7.string(),
+  authorKind: z7.enum(["member", "guest"]),
+  body: z7.string(),
+  createdAt: z7.string(),
+  deleted: z7.boolean(),
+  editedAt: z7.string().nullable(),
+  id: z7.string(),
   // The opening message's id (distinct from the thread `id`) — `edit`/
   // `delete` operate on messages, so the CLI needs it to target the first
   // comment, not just the replies.
-  messageId: z5.string(),
-  reactions: z5.array(exportReactionSchema).optional(),
-  replies: z5.array(commentExportReplySchema),
+  messageId: z7.string(),
+  reactions: z7.array(exportReactionSchema).optional(),
+  replies: z7.array(commentExportReplySchema),
   resolvedBy: threadActorSchema.nullable().default(null),
-  status: z5.enum(["open", "resolved"]),
-  versionNumber: z5.number().int().positive()
+  status: z7.enum(["open", "resolved"]),
+  versionNumber: z7.number().int().positive()
 });
-var commentExportSchema = z5.object({
-  artifactId: z5.string(),
-  comments: z5.array(commentExportThreadSchema),
+var commentExportSchema = z7.object({
+  artifactId: z7.string(),
+  comments: z7.array(commentExportThreadSchema),
   // The artifact's current version (null before the first finalize).
-  versionNumber: z5.number().int().positive().nullable()
+  versionNumber: z7.number().int().positive().nullable()
 });
-var commentReadResponseSchema = z5.object({
-  lastSeenAt: z5.string()
+var commentReadResponseSchema = z7.object({
+  lastSeenAt: z7.string()
 });
 function elementLabel(el) {
   if (el.id) {
@@ -398,499 +498,554 @@ function elementLabel(el) {
 }
 
 // ../shared/src/errors.ts
-import { z as z6 } from "zod";
-var apiErrorSchema = z6.object({
-  code: z6.string(),
-  docsUrl: z6.string().url(),
-  message: z6.string(),
-  retryAfter: z6.number().int().positive().optional()
+import { z as z8 } from "zod";
+var apiErrorSchema = z8.object({
+  code: z8.string(),
+  docsUrl: z8.string().url(),
+  message: z8.string(),
+  retryAfter: z8.number().int().positive().optional()
 });
 
 // ../shared/src/feedback.ts
-import { z as z7 } from "zod";
-var feedbackRequestSchema = z7.object({
-  email: z7.string().trim().toLowerCase().email().optional().or(z7.literal("")),
-  message: z7.string().trim().min(1).max(4e3)
+import { z as z9 } from "zod";
+var feedbackRequestSchema = z9.object({
+  email: z9.string().trim().toLowerCase().email().optional().or(z9.literal("")),
+  message: z9.string().trim().min(1).max(4e3)
 });
-var feedbackResponseSchema = z7.object({
-  sent: z7.literal(true)
+var feedbackResponseSchema = z9.object({
+  sent: z9.literal(true)
 });
 
 // ../shared/src/grants.ts
-import { z as z8 } from "zod";
-var grantRoleSchema = z8.enum(["viewer"]);
-var createGrantSchema = z8.object({
-  email: z8.string().trim().toLowerCase().email().optional(),
+import { z as z10 } from "zod";
+var grantRoleSchema = z10.enum(["viewer"]);
+var createGrantSchema = z10.object({
+  email: z10.string().trim().toLowerCase().email().optional(),
   role: grantRoleSchema.default("viewer"),
-  userId: z8.string().min(1).optional()
+  userId: z10.string().min(1).optional()
 }).refine((body) => Boolean(body.email) !== Boolean(body.userId), {
   message: "provide exactly one of email or userId"
 });
-var grantSchema = z8.object({
-  createdAt: z8.string(),
-  email: z8.string().email().nullable(),
-  expiresAt: z8.string().nullable(),
-  id: z8.string(),
+var grantSchema = z10.object({
+  createdAt: z10.string(),
+  email: z10.string().email().nullable(),
+  expiresAt: z10.string().nullable(),
+  id: z10.string(),
   // The subject's avatar once they have an account; null otherwise.
-  image: z8.string().nullable(),
+  image: z10.string().nullable(),
   // Present on the invited account after redemption / when granting an
   // existing user; null for a still-pending email invite.
-  name: z8.string().nullable(),
-  redeemedAt: z8.string().nullable(),
+  name: z10.string().nullable(),
+  redeemedAt: z10.string().nullable(),
   role: grantRoleSchema,
   // Shown as "· pending" beside the role until the link is redeemed.
-  status: z8.enum(["pending", "active"]),
+  status: z10.enum(["pending", "active"]),
   // Display fragment of the live invitation token, or null once redeemed.
-  tokenPrefix: z8.string().nullable(),
-  userId: z8.string().nullable()
+  tokenPrefix: z10.string().nullable(),
+  userId: z10.string().nullable()
 });
 var createdGrantSchema = grantSchema.extend({
-  url: z8.string().url()
+  url: z10.string().url()
 });
-var grantListResponseSchema = z8.object({
-  grants: z8.array(grantSchema),
+var grantListResponseSchema = z10.object({
+  grants: z10.array(grantSchema),
   // The artifact's current general-access value, so the share surface can
   // render the "General access" line without a second read.
-  visibility: z8.enum(["public", "unlisted", "workspace", "private"]),
+  visibility: z10.enum(["public", "unlisted", "workspace", "private"]),
   // The owning workspace's logo, so the share modal can draw the workspace
   // itself rather than a generic glyph. Null when none was uploaded.
-  workspaceLogo: z8.string().nullable().optional(),
+  workspaceLogo: z10.string().nullable().optional(),
   // The owning workspace's display name, so "People with access" can name the
   // audience `workspace` visibility actually admits ("All Acme members") rather
   // than leaving an empty list to imply nobody. Null for a workspace-less
   // artifact; optional so an older server still parses.
-  workspaceName: z8.string().nullable().optional()
+  workspaceName: z10.string().nullable().optional()
 });
-var revokeGrantResponseSchema = z8.object({
-  revoked: z8.literal(true)
+var revokeGrantResponseSchema = z10.object({
+  revoked: z10.literal(true)
 });
-var acceptGrantSchema = z8.object({
-  token: z8.string().min(1)
+var acceptGrantSchema = z10.object({
+  token: z10.string().min(1)
 });
-var acceptGrantResponseSchema = z8.object({
-  artifactId: z8.string(),
+var acceptGrantResponseSchema = z10.object({
+  artifactId: z10.string(),
   // The review shell URL to land on, carrying ?invited=1 for the banner.
-  artifactUrl: z8.string().url(),
-  slug: z8.string(),
-  title: z8.string()
-});
-var workspaceGuestSchema = z8.object({
-  artifacts: z8.array(
-    z8.object({
-      artifactId: z8.string(),
-      grantId: z8.string(),
-      slug: z8.string(),
-      status: z8.enum(["pending", "active"]),
-      title: z8.string()
+  artifactUrl: z10.string().url(),
+  slug: z10.string(),
+  title: z10.string()
+});
+var workspaceGuestSchema = z10.object({
+  artifacts: z10.array(
+    z10.object({
+      artifactId: z10.string(),
+      grantId: z10.string(),
+      slug: z10.string(),
+      status: z10.enum(["pending", "active"]),
+      title: z10.string()
     })
   ),
-  email: z8.string().nullable(),
-  image: z8.string().nullable(),
-  name: z8.string().nullable(),
-  userId: z8.string().nullable()
-});
-var workspaceGuestListResponseSchema = z8.object({
-  guests: z8.array(workspaceGuestSchema)
-});
-var sharedWithMeArtifactSchema = z8.object({
-  artifactId: z8.string(),
-  slug: z8.string(),
-  title: z8.string(),
-  url: z8.string().url(),
+  email: z10.string().nullable(),
+  image: z10.string().nullable(),
+  name: z10.string().nullable(),
+  userId: z10.string().nullable()
+});
+var workspaceGuestListResponseSchema = z10.object({
+  guests: z10.array(workspaceGuestSchema)
+});
+var sharedWithMeArtifactSchema = z10.object({
+  artifactId: z10.string(),
+  slug: z10.string(),
+  title: z10.string(),
+  url: z10.string().url(),
   // Who shared it, for the "Shared with me" list.
-  workspaceName: z8.string()
+  workspaceName: z10.string()
 });
-var sharedWithMeListResponseSchema = z8.object({
-  artifacts: z8.array(sharedWithMeArtifactSchema)
+var sharedWithMeListResponseSchema = z10.object({
+  artifacts: z10.array(sharedWithMeArtifactSchema)
 });
 
+// ../shared/src/html-meta.ts
+var HEAD_SCAN_CHARS = 64 * 1024;
+
 // ../shared/src/me.ts
-import { z as z10 } from "zod";
+import { z as z12 } from "zod";
 
 // ../shared/src/workspaces.ts
-import { z as z9 } from "zod";
+import { z as z11 } from "zod";
 var WORKSPACE_HANDLE_PATTERN = /^[a-z0-9](?:[a-z0-9-]{1,30}[a-z0-9])$/;
-var workspaceHandleUnavailableReasonSchema = z9.enum([
+var workspaceHandleUnavailableReasonSchema = z11.enum([
   "held",
   "invalid",
   "reserved",
   "taken"
 ]);
-var workspaceHandleAvailabilitySchema = z9.object({
-  available: z9.boolean(),
-  handle: z9.string(),
+var workspaceHandleAvailabilitySchema = z11.object({
+  available: z11.boolean(),
+  handle: z11.string(),
   // Human-readable sentence for the field hint; null when available.
-  message: z9.string().nullable(),
+  message: z11.string().nullable(),
   reason: workspaceHandleUnavailableReasonSchema.nullable()
 });
-var workspaceRoleSchema = z9.enum(["owner", "admin", "member"]);
-var workspaceInviteRoleSchema = z9.enum(["admin", "member"]);
-var workspaceHandleSchema = z9.string().min(3).max(32).regex(WORKSPACE_HANDLE_PATTERN, {
+var workspaceRoleSchema = z11.enum(["owner", "admin", "member"]);
+var workspaceInviteRoleSchema = z11.enum(["admin", "member"]);
+var workspaceHandleSchema = z11.string().min(3).max(32).regex(WORKSPACE_HANDLE_PATTERN, {
   message: "handle must be lowercase letters, digits, and hyphens, with no leading/trailing hyphen"
 });
-var createWorkspaceSchema = z9.object({
+var createWorkspaceSchema = z11.object({
   handle: workspaceHandleSchema.optional(),
-  name: z9.string().trim().min(1).max(100)
+  name: z11.string().trim().min(1).max(100)
 });
-var updateWorkspaceSchema = z9.object({
+var updateWorkspaceSchema = z11.object({
   handle: workspaceHandleSchema.optional(),
-  name: z9.string().trim().min(1).max(100).optional()
+  name: z11.string().trim().min(1).max(100).optional()
 }).refine((body) => body.handle !== void 0 || body.name !== void 0, {
   message: "provide at least one of name or handle"
 });
-var workspaceSchema = z9.object({
-  createdAt: z9.string(),
-  handle: z9.string(),
+var workspaceSchema = z11.object({
+  createdAt: z11.string(),
+  handle: z11.string(),
   // ISO timestamp when `{handle}.artifact.cafe` was provisioned, or null.
   // Set by the one-time, self-serve enable flow (§4.4); never auto at
   // create, and always null for personal workspaces.
-  hostnameProvisionedAt: z9.string().nullable(),
-  id: z9.string(),
+  hostnameProvisionedAt: z11.string().nullable(),
+  id: z11.string(),
   // Auto-provisioned solo workspace, one per user: non-deletable, takes
   // no members, renameable like any workspace.
-  isPersonal: z9.boolean(),
+  isPersonal: z11.boolean(),
   // Uploaded logo URL, or null for the initials fallback. Set through the
   // dedicated /workspaces/:id/avatar route, never the generic update.
-  logo: z9.string().nullable(),
-  name: z9.string(),
+  logo: z11.string().nullable(),
+  name: z11.string(),
   role: workspaceRoleSchema.nullable(),
-  updatedAt: z9.string()
+  updatedAt: z11.string()
 });
-var workspaceListResponseSchema = z9.object({
-  workspaces: z9.array(workspaceSchema)
+var workspaceListResponseSchema = z11.object({
+  workspaces: z11.array(workspaceSchema)
 });
-var deleteWorkspaceResponseSchema = z9.object({
-  deleted: z9.literal(true)
+var deleteWorkspaceResponseSchema = z11.object({
+  deleted: z11.literal(true)
 });
-var workspaceMemberSchema = z9.object({
-  createdAt: z9.string(),
-  email: z9.string().email(),
-  image: z9.string().nullable(),
-  name: z9.string(),
+var workspaceMemberSchema = z11.object({
+  createdAt: z11.string(),
+  email: z11.string().email(),
+  image: z11.string().nullable(),
+  name: z11.string(),
   role: workspaceRoleSchema,
-  userId: z9.string()
+  userId: z11.string()
 });
-var workspaceMemberListResponseSchema = z9.object({
-  members: z9.array(workspaceMemberSchema)
+var workspaceMemberListResponseSchema = z11.object({
+  members: z11.array(workspaceMemberSchema)
 });
-var updateWorkspaceMemberSchema = z9.object({
+var updateWorkspaceMemberSchema = z11.object({
   role: workspaceRoleSchema
 });
-var removeWorkspaceMemberResponseSchema = z9.object({
-  removed: z9.literal(true)
+var removeWorkspaceMemberResponseSchema = z11.object({
+  removed: z11.literal(true)
 });
-var createWorkspaceInviteSchema = z9.object({
-  email: z9.string().trim().toLowerCase().email().optional(),
-  expiresAt: z9.string().datetime(),
-  maxUses: z9.number().int().positive().optional(),
+var createWorkspaceInviteSchema = z11.object({
+  email: z11.string().trim().toLowerCase().email().optional(),
+  expiresAt: z11.string().datetime(),
+  maxUses: z11.number().int().positive().optional(),
   role: workspaceInviteRoleSchema
 });
-var workspaceInviteSchema = z9.object({
-  createdAt: z9.string(),
-  email: z9.string().email().nullable(),
-  expiresAt: z9.string(),
-  id: z9.string(),
-  maxUses: z9.number().int().positive().nullable(),
+var workspaceInviteSchema = z11.object({
+  createdAt: z11.string(),
+  email: z11.string().email().nullable(),
+  expiresAt: z11.string(),
+  id: z11.string(),
+  maxUses: z11.number().int().positive().nullable(),
   role: workspaceInviteRoleSchema,
-  tokenPrefix: z9.string(),
-  useCount: z9.number().int().nonnegative()
+  tokenPrefix: z11.string(),
+  useCount: z11.number().int().nonnegative()
 });
 var createdWorkspaceInviteSchema = workspaceInviteSchema.extend({
-  url: z9.string().url()
+  url: z11.string().url()
 });
-var workspaceInviteListResponseSchema = z9.object({
-  invites: z9.array(workspaceInviteSchema)
+var workspaceInviteListResponseSchema = z11.object({
+  invites: z11.array(workspaceInviteSchema)
 });
-var revokeWorkspaceInviteResponseSchema = z9.object({
-  revoked: z9.literal(true)
+var revokeWorkspaceInviteResponseSchema = z11.object({
+  revoked: z11.literal(true)
 });
-var acceptWorkspaceInviteSchema = z9.object({
-  token: z9.string().min(1)
+var acceptWorkspaceInviteSchema = z11.object({
+  token: z11.string().min(1)
 });
-var acceptWorkspaceInviteResponseSchema = z9.object({
+var acceptWorkspaceInviteResponseSchema = z11.object({
   role: workspaceRoleSchema,
   workspace: workspaceSchema
 });
-var folderVisibilitySchema = z9.enum(["public", "workspace"]);
-var artifactVisibilitySchema = z9.enum([
+var folderVisibilitySchema = z11.enum(["public", "workspace"]);
+var artifactVisibilitySchema = z11.enum([
   "public",
   "unlisted",
   "workspace",
   "private"
 ]);
-var createFolderSchema = z9.object({
-  name: z9.string().trim().min(1).max(100),
+var createFolderSchema = z11.object({
+  // Optional custom icon; omitted (or null) leaves the default glyph.
+  emoji: iconEmojiSchema.optional(),
+  name: z11.string().trim().min(1).max(100),
   visibility: folderVisibilitySchema
 });
-var updateFolderSchema = z9.object({
+var updateFolderSchema = z11.object({
   // With `visibility`: bulk-update the folder's artifacts to match
   // (SPEC-2 §3.4 "Changing a folder's visibility offers a bulk update").
-  cascade: z9.boolean().optional(),
-  name: z9.string().trim().min(1).max(100).optional(),
-  sortOrder: z9.number().int().min(0).optional(),
+  cascade: z11.boolean().optional(),
+  // Explicit null clears the icon back to the default glyph, so this is
+  // a field where "sent as null" and "omitted" mean different things.
+  emoji: iconEmojiSchema.optional(),
+  name: z11.string().trim().min(1).max(100).optional(),
+  sortOrder: z11.number().int().min(0).optional(),
   visibility: folderVisibilitySchema.optional()
 }).refine(
-  (body) => body.name !== void 0 || body.visibility !== void 0 || body.sortOrder !== void 0,
-  { message: "provide at least one of name, visibility, sortOrder" }
+  (body) => body.name !== void 0 || body.visibility !== void 0 || body.sortOrder !== void 0 || body.emoji !== void 0,
+  { message: "provide at least one of name, visibility, sortOrder, emoji" }
 ).refine((body) => !body.cascade || body.visibility !== void 0, {
   message: "cascade requires visibility"
 });
-var folderSchema = z9.object({
-  createdAt: z9.string(),
-  id: z9.string(),
-  name: z9.string(),
+var folderSchema = z11.object({
+  createdAt: z11.string(),
+  // Custom icon, or null to render the default folder glyph.
+  emoji: z11.string().nullable(),
+  id: z11.string(),
+  name: z11.string(),
   // Permalink segment for the public folder page (/w/{handle}/f/{slug}).
   // Server-derived from the name; renames regenerate it.
-  slug: z9.string(),
-  sortOrder: z9.number().int(),
-  updatedAt: z9.string(),
+  slug: z11.string(),
+  sortOrder: z11.number().int(),
+  updatedAt: z11.string(),
   visibility: folderVisibilitySchema,
-  workspaceId: z9.string()
+  workspaceId: z11.string()
 });
-var folderListResponseSchema = z9.object({
-  folders: z9.array(folderSchema)
+var folderListResponseSchema = z11.object({
+  folders: z11.array(folderSchema)
 });
-var deleteFolderResponseSchema = z9.object({
-  deleted: z9.literal(true)
+var deleteFolderResponseSchema = z11.object({
+  deleted: z11.literal(true)
 });
-var workspaceArtifactSchema = z9.object({
-  createdAt: z9.string(),
-  currentVersionNumber: z9.number().int().nullable(),
-  folderId: z9.string().nullable(),
-  id: z9.string(),
-  openCommentCount: z9.number().int().nonnegative(),
+var workspaceArtifactSchema = z11.object({
+  createdAt: z11.string(),
+  currentVersionNumber: z11.number().int().nullable(),
+  // Custom icon, or null to render the default document glyph.
+  emoji: z11.string().nullable(),
+  folderId: z11.string().nullable(),
+  id: z11.string(),
+  openCommentCount: z11.number().int().nonnegative(),
   reviewMode: reviewModeSchema,
-  slug: z9.string(),
-  title: z9.string(),
-  updatedAt: z9.string(),
-  url: z9.string().url(),
-  versionCount: z9.number().int().nonnegative(),
+  slug: z11.string(),
+  title: z11.string(),
+  updatedAt: z11.string(),
+  url: z11.string().url(),
+  versionCount: z11.number().int().nonnegative(),
   visibility: artifactVisibilitySchema
 });
-var workspaceArtifactListResponseSchema = z9.object({
-  artifacts: z9.array(workspaceArtifactSchema)
+var workspaceArtifactListResponseSchema = z11.object({
+  artifacts: z11.array(workspaceArtifactSchema)
 });
-var workspaceArtifactSearchResultSchema = z9.object({
-  id: z9.string(),
-  slug: z9.string(),
-  title: z9.string()
+var workspaceArtifactSearchResultSchema = z11.object({
+  id: z11.string(),
+  slug: z11.string(),
+  title: z11.string()
 });
-var workspaceArtifactSearchResponseSchema = z9.object({
-  results: z9.array(workspaceArtifactSearchResultSchema)
+var workspaceArtifactSearchResponseSchema = z11.object({
+  results: z11.array(workspaceArtifactSearchResultSchema)
 });
 
 // ../shared/src/me.ts
-var ownArtifactSchema = z10.object({
-  createdAt: z10.string(),
-  currentVersionNumber: z10.number().nullable(),
+var personSchema = z12.object({
+  image: z12.string().nullable(),
+  name: z12.string()
+});
+var ownArtifactSchema = z12.object({
+  // Everyone else who has published a version, oldest first. Any member may
+  // publish a new one (SPEC-2 §5.1), so an artifact's byline is often more
+  // than one person and the card stacks their faces rather than crediting
+  // whoever shipped last. Excludes `publishedBy`; empty on a solo artifact.
+  coPublishers: z12.array(personSchema),
+  createdAt: z12.string(),
+  // SPEC-2 §5.1 — who *made* the artifact: the author of its first
+  // finalized version, the same row `viewerCanManage` is decided on. Not
+  // the same person as `publishedBy` once an agent ships v2, which is why
+  // the dashboard filters on both. Null for a token-only publish.
+  createdBy: z12.object({ image: z12.string().nullable(), name: z12.string() }).nullable(),
+  currentVersionNumber: z12.number().nullable(),
+  // Custom icon, or null to render the default document glyph.
+  emoji: z12.string().nullable(),
   // Owned artifacts normally never expire; non-null only while an
   // expiry is still set (e.g. an unclaimed publish surfaced here later).
-  expiresAt: z10.string().nullable(),
+  expiresAt: z12.string().nullable(),
   // SPEC-2 §8.4 — the containing folder for workspace-owned artifacts;
   // both null for personal artifacts. `folderId` drives the dashboard's
-  // move control and folder filter; `folderName` is the display label.
-  folderId: z10.string().nullable(),
-  folderName: z10.string().nullable(),
+  // move control and folder filter; `folderName` is the display label,
+  // `folderEmoji` its icon (null = the default folder glyph).
+  folderEmoji: z12.string().nullable(),
+  folderId: z12.string().nullable(),
+  folderName: z12.string().nullable(),
   // Whether a publish token is still active — revocable from the
   // dashboard (§6.18); the token itself is never returned.
-  hasPublishToken: z10.boolean(),
-  id: z10.string(),
-  openThreads: z10.number(),
-  protected: z10.boolean(),
+  hasPublishToken: z12.boolean(),
+  // Owner preference: hide the version list from reviewers in the review
+  // shell. Managers still see it.
+  hideVersions: z12.boolean(),
+  id: z12.string(),
+  openThreads: z12.number(),
+  protected: z12.boolean(),
   // Who published the current version (falling back to the claiming
   // owner) — the dashboard shows a name and avatar per artifact so a
   // shared workspace reads as people's work, not anonymous rows. Null
   // when the publish was token-only and the artifact is unclaimed.
-  publishedBy: z10.object({ image: z10.string().nullable(), name: z10.string() }).nullable(),
+  publishedBy: personSchema.nullable(),
   // SPEC-2 §5.8 — the review dial, so the dashboard's settings dialog can
   // render current state without a second fetch.
   reviewMode: reviewModeSchema,
-  slug: z10.string(),
-  title: z10.string(),
-  totalViews: z10.number(),
+  slug: z12.string(),
+  title: z12.string(),
+  totalViews: z12.number(),
   // SPEC §6.20 — messages by others newer than the viewer's last-seen
   // watermark. 0 for signed-out/API-key-less contexts.
-  unreadComments: z10.number(),
-  updatedAt: z10.string(),
-  url: z10.string(),
-  versionCount: z10.number(),
+  unreadComments: z12.number(),
+  updatedAt: z12.string(),
+  url: z12.string(),
+  versionCount: z12.number(),
   // SPEC-2 §5.1 — whether the caller clears the manage bar for this
   // artifact (workspace admin, or the person who first published it).
   // Only a manager's folder move inherits the folder's visibility, so the
   // dashboard warns exactly the people the change can actually affect, and
   // only a manager is offered the Share entry (§5.7).
-  viewerCanManage: z10.boolean(),
+  viewerCanManage: z12.boolean(),
   // SPEC-2 §5.2 — the artifact's own visibility, the single enforcement
   // source. The dashboard needs it to tell whether a folder move would
-  // widen exposure before it sends the PATCH (§3.4), and to render the lock
-  // glyph on `private` rows and cards (§5.7).
+  // widen exposure before it sends the PATCH (§3.4), and to render the
+  // audience glyph — one per level — on rows and cards (§5.7).
   visibility: artifactVisibilitySchema
 });
-var ownArtifactsResponseSchema = z10.object({
-  artifacts: z10.array(ownArtifactSchema)
+var ownArtifactsResponseSchema = z12.object({
+  artifacts: z12.array(ownArtifactSchema)
 });
-var revokePublishTokenResponseSchema = z10.object({
-  revoked: z10.boolean()
+var revokePublishTokenResponseSchema = z12.object({
+  revoked: z12.boolean()
 });
 
 // ../shared/src/owner.ts
-import { z as z11 } from "zod";
+import { z as z13 } from "zod";
 var SLUG_PATTERN = /^[a-z0-9](?:[a-z0-9-]{1,61}[a-z0-9])$/;
-var claimResponseSchema = z11.object({
-  artifactId: z11.string(),
-  slug: z11.string(),
-  title: z11.string(),
-  url: z11.string().url()
-});
-var updateArtifactSchema = z11.object({
+var claimResponseSchema = z13.object({
+  artifactId: z13.string(),
+  slug: z13.string(),
+  title: z13.string(),
+  url: z13.string().url()
+});
+var updateArtifactSchema = z13.object({
+  // Custom icon; explicit null clears it back to the default glyph.
+  // Part of what the artifact *is* (like the title), so it takes the
+  // same manage rights as title/slug — not the member-level folder move.
+  emoji: iconEmojiSchema.optional(),
   // SPEC-2 §6.4 — placement + visibility. `folderId: null` clears the
   // folder; `workspaceId: null` moves the artifact out of its workspace
   // (§5.5 ownership transfer).
-  folderId: z11.string().min(1).nullable().optional(),
-  slug: z11.string().min(3).max(63).regex(SLUG_PATTERN, {
+  folderId: z13.string().min(1).nullable().optional(),
+  // Keep the version list out of the review shell. Presentation only:
+  // versions stay immutable, and a `/vN/` URL still resolves.
+  hideVersions: z13.boolean().optional(),
+  slug: z13.string().min(3).max(63).regex(SLUG_PATTERN, {
     message: "slug must be lowercase letters, digits, and hyphens, with no leading/trailing hyphen"
   }).optional(),
-  title: z11.string().min(1).max(200).optional(),
+  title: z13.string().min(1).max(200).optional(),
   visibility: artifactVisibilitySchema.optional(),
-  workspaceId: z11.string().min(1).nullable().optional()
+  workspaceId: z13.string().min(1).nullable().optional()
 }).refine(
-  (body) => body.title !== void 0 || body.slug !== void 0 || body.visibility !== void 0 || body.folderId !== void 0 || body.workspaceId !== void 0,
+  (body) => body.title !== void 0 || body.slug !== void 0 || body.visibility !== void 0 || body.folderId !== void 0 || body.workspaceId !== void 0 || body.emoji !== void 0 || body.hideVersions !== void 0,
   {
-    message: "provide at least one of title, slug, visibility, folderId, workspaceId"
+    message: "provide at least one of title, slug, visibility, folderId, workspaceId, emoji, hideVersions"
   }
 );
-var deleteArtifactResponseSchema = z11.object({
-  deleted: z11.literal(true)
+var deleteArtifactResponseSchema = z13.object({
+  deleted: z13.literal(true)
 });
 
 // ../shared/src/presence.ts
-import { z as z12 } from "zod";
+import { z as z14 } from "zod";
 var AGENT_STATES = ["listening", "editing", "publishing"];
-var agentStateSchema = z12.enum(AGENT_STATES);
+var agentStateSchema = z14.enum(AGENT_STATES);
 var AGENT_PRESENCE = {
   editingTtlSeconds: 300,
   heartbeatSeconds: 15,
   shellPollSeconds: 15,
   ttlSeconds: 45
 };
-var agentHeartbeatBodySchema = z12.object({
+var agentHeartbeatBodySchema = z14.object({
   state: agentStateSchema.optional()
 });
-var agentHeartbeatResponseSchema = z12.object({
-  listening: z12.literal(true),
+var agentHeartbeatResponseSchema = z14.object({
+  listening: z14.literal(true),
   state: agentStateSchema.optional(),
-  ttlSeconds: z12.number().int().positive()
+  ttlSeconds: z14.number().int().positive()
 });
-var agentPresenceSchema = z12.object({
-  listening: z12.boolean(),
+var agentPresenceSchema = z14.object({
+  agent: z14.object({ id: z14.string().nullable(), label: z14.string() }).nullable().default(null),
+  listening: z14.boolean(),
   state: agentStateSchema.nullable().optional(),
-  versionNumber: z12.number().int().positive().nullable()
+  versionNumber: z14.number().int().positive().nullable()
 });
 
 // ../shared/src/protection.ts
-import { z as z13 } from "zod";
+import { z as z15 } from "zod";
 var PASSWORD_MIN = 6;
 var PASSWORD_MAX = 128;
-var gatePasswordSchema = z13.string().min(PASSWORD_MIN, `Password must be at least ${PASSWORD_MIN} characters.`).max(PASSWORD_MAX, `Password must be at most ${PASSWORD_MAX} characters.`);
-var setProtectionSchema = z13.object({
+var gatePasswordSchema = z15.string().min(PASSWORD_MIN, `Password must be at least ${PASSWORD_MIN} characters.`).max(PASSWORD_MAX, `Password must be at most ${PASSWORD_MAX} characters.`);
+var setProtectionSchema = z15.object({
   password: gatePasswordSchema.nullable()
 });
-var protectionResponseSchema = z13.object({
-  protected: z13.boolean()
+var protectionResponseSchema = z15.object({
+  protected: z15.boolean()
 });
-var unlockSchema = z13.object({
-  password: z13.string().min(1).max(1024)
+var unlockSchema = z15.object({
+  password: z15.string().min(1).max(1024)
 });
-var unlockResponseSchema = z13.object({
-  unlocked: z13.literal(true)
+var unlockResponseSchema = z15.object({
+  unlocked: z15.literal(true)
 });
 
 // ../shared/src/report.ts
-import { z as z14 } from "zod";
-var reportRequestSchema = z14.object({
-  reason: z14.string().max(1e3).optional()
+import { z as z16 } from "zod";
+var reportRequestSchema = z16.object({
+  reason: z16.string().max(1e3).optional()
 });
-var reportResponseSchema = z14.object({
-  reported: z14.literal(true)
+var reportResponseSchema = z16.object({
+  reported: z16.literal(true)
 });
 
 // ../shared/src/reviewers.ts
-import { z as z15 } from "zod";
-var artifactReviewerSchema = z15.object({
-  avatarUrl: z15.string().nullable(),
-  displayName: z15.string(),
+import { z as z17 } from "zod";
+var artifactReviewerSchema = z17.object({
+  avatarUrl: z17.string().nullable(),
+  displayName: z17.string(),
   // Exactly one of userId/guestId is set, per `kind`.
-  guestId: z15.string().nullable(),
+  guestId: z17.string().nullable(),
   // "account", not commentAuthorSchema's "member" — the whole point here is
   // that these people need not be workspace members. A guest can be named in
   // a comment but never notified: guest_identities carries a display name and
   // no email, so there is nowhere to send anything.
-  kind: z15.enum(["account", "guest"]),
-  userId: z15.string().nullable()
+  kind: z17.enum(["account", "guest"]),
+  userId: z17.string().nullable()
 });
-var artifactReviewerListResponseSchema = z15.object({
-  reviewers: z15.array(artifactReviewerSchema)
+var artifactReviewerListResponseSchema = z17.object({
+  reviewers: z17.array(artifactReviewerSchema)
 });
 
 // ../shared/src/stats.ts
-import { z as z16 } from "zod";
-var avgViewSecondsSchema = z16.number().int().nonnegative().nullable();
-var versionViewStatsSchema = z16.object({
+import { z as z18 } from "zod";
+var avgViewSecondsSchema = z18.number().int().nonnegative().nullable();
+var versionViewStatsSchema = z18.object({
   avgViewSeconds: avgViewSecondsSchema,
   // Views from inside the review shell's iframe vs. direct visits to
   // the render URL. views = embeddedViews + directViews.
-  directViews: z16.number().int().nonnegative(),
-  embeddedViews: z16.number().int().nonnegative(),
+  directViews: z18.number().int().nonnegative(),
+  embeddedViews: z18.number().int().nonnegative(),
   // Distinct hashed viewer IPs across the version's lifetime.
-  uniqueViewers: z16.number().int().nonnegative(),
-  versionNumber: z16.number().int().positive(),
-  views: z16.number().int().nonnegative()
+  uniqueViewers: z18.number().int().nonnegative(),
+  versionNumber: z18.number().int().positive(),
+  views: z18.number().int().nonnegative()
 });
-var dailyViewsSchema = z16.object({
+var dailyViewsSchema = z18.object({
   avgViewSeconds: avgViewSecondsSchema,
   // UTC day, YYYY-MM-DD.
-  day: z16.string(),
-  uniqueViewers: z16.number().int().nonnegative(),
-  views: z16.number().int().nonnegative()
+  day: z18.string(),
+  uniqueViewers: z18.number().int().nonnegative(),
+  views: z18.number().int().nonnegative()
 });
-var artifactStatsResponseSchema = z16.object({
+var artifactStatsResponseSchema = z18.object({
   avgViewSeconds: avgViewSecondsSchema,
-  daily: z16.array(dailyViewsSchema),
+  daily: z18.array(dailyViewsSchema),
   // Distinct hashed viewer IPs across all versions and days.
-  totalUniqueViewers: z16.number().int().nonnegative(),
-  totalViews: z16.number().int().nonnegative(),
-  versions: z16.array(versionViewStatsSchema)
+  totalUniqueViewers: z18.number().int().nonnegative(),
+  totalViews: z18.number().int().nonnegative(),
+  versions: z18.array(versionViewStatsSchema)
 });
 
 // ../shared/src/versions.ts
-import { z as z17 } from "zod";
-var versionSourceSchema = z17.object({
-  agentName: z17.string().nullable(),
-  type: z17.string()
+import { z as z19 } from "zod";
+var versionSourceSchema = z19.object({
+  agentName: z19.string().nullable(),
+  type: z19.string()
 });
-var versionChangesSchema = z17.object({
-  added: z17.array(z17.string()),
-  changed: z17.array(z17.string()),
-  removed: z17.array(z17.string())
+var versionChangesSchema = z19.object({
+  added: z19.array(z19.string()),
+  changed: z19.array(z19.string()),
+  removed: z19.array(z19.string())
 });
-var versionSummarySchema = z17.object({
+var versionSummarySchema = z19.object({
   // Absent for the first version — there is no previous version to diff against.
   changes: versionChangesSchema.nullable(),
-  createdAt: z17.string(),
-  entryUrl: z17.string().url(),
-  fileCount: z17.number().int().nonnegative(),
-  id: z17.string(),
-  isCurrent: z17.boolean(),
+  createdAt: z19.string(),
+  entryUrl: z19.string().url(),
+  fileCount: z19.number().int().nonnegative(),
+  id: z19.string(),
+  isCurrent: z19.boolean(),
   // Author-supplied bullet-point changelog; null when the publish omitted it.
-  notes: z17.string().nullable(),
+  notes: z19.string().nullable(),
+  // The account that published this version, with their own avatar where
+  // they've set one. Any workspace member can publish a new version
+  // (SPEC-2 §5.1), so "which teammate" outranks "which agent" — the agent
+  // is the tool, this is the person. Null for token-only publishes, which
+  // carry no account.
+  publishedBy: z19.object({ image: z19.string().nullable(), name: z19.string() }).nullable(),
   source: versionSourceSchema,
-  totalSizeBytes: z17.number().int().nonnegative(),
-  versionNumber: z17.number().int().positive()
+  totalSizeBytes: z19.number().int().nonnegative(),
+  versionNumber: z19.number().int().positive()
 });
-var versionListResponseSchema = z17.object({
-  versions: z17.array(versionSummarySchema)
+var versionListResponseSchema = z19.object({
+  versions: z19.array(versionSummarySchema)
 });
 
+// src/agent-identity.ts
+function agentLabel(explicit) {
+  if (explicit !== void 0) {
+    return explicit.trim() || void 0;
+  }
+  return detectAgentFromEnv(process.env);
+}
+
 // src/api.ts
 var ApiRequestError = class extends Error {
   constructor(status2, code, message, retryAfter) {
@@ -1108,11 +1263,13 @@ function createApiClient(apiUrl2, publishToken) {
     // SPEC §6.5 — post a reply into a thread. Authorized by this client's
     // credential: the artifact's publish token (the reply renders as the
     // agent) or the owner's account key (renders as the owner). No guest
-    // payload — the credential is the identity.
-    async replyThread(threadId, body) {
+    // payload — the credential is the identity. `via` names the tool: it
+    // becomes the agent's byline on a token reply, a "via" label on an
+    // account one.
+    async replyThread(threadId, body, via) {
       return request(
         `${base}/api/v1/comment-threads/${threadId}/messages`,
-        { body: JSON.stringify({ body }), headers, method: "POST" },
+        { body: JSON.stringify({ body, via }), headers, method: "POST" },
         (d) => commentThreadSchema.parse(d)
       );
     },
@@ -1189,17 +1346,17 @@ import {
   writeFileSync as writeFileSync2
 } from "fs";
 import path2 from "path";
-import { z as z19 } from "zod";
+import { z as z21 } from "zod";
 
 // src/credentials.ts
 import { existsSync, mkdirSync, readFileSync, writeFileSync } from "fs";
 import { homedir } from "os";
 import path from "path";
-import { z as z18 } from "zod";
+import { z as z20 } from "zod";
 var DEFAULT_API_URL = "https://artifact.cafe";
-var credentialsSchema = z18.object({
-  keys: z18.record(z18.string(), z18.string()),
-  version: z18.literal(1)
+var credentialsSchema = z20.object({
+  keys: z20.record(z20.string(), z20.string()),
+  version: z20.literal(1)
 });
 function credentialsPath() {
   return path.join(homedir(), ".artifactcafe", "credentials");
@@ -1249,24 +1406,24 @@ function resolveApiKey(apiUrl2, flag) {
 }
 
 // src/config.ts
-var configSchema = z19.object({
-  apiUrl: z19.string(),
-  artifactId: z19.string(),
-  folder: z19.string().optional(),
-  folderId: z19.string().optional(),
+var configSchema = z21.object({
+  apiUrl: z21.string(),
+  artifactId: z21.string(),
+  folder: z21.string().optional(),
+  folderId: z21.string().optional(),
   // Optional: a folder linked by `link` to an artifact you own carries no
   // token — owner actions authorize via your stored login instead. A first
   // publish still writes the anonymous-mode token here.
-  publishToken: z19.string().optional(),
-  slug: z19.string(),
-  url: z19.string(),
-  workspace: z19.string().optional(),
-  workspaceId: z19.string().optional(),
-  workspaceKind: z19.enum(["personal", "workspace"]).optional()
-});
-var projectConfigSchema = z19.object({
-  folder: z19.string().trim().min(1).optional(),
-  workspace: z19.string().trim().min(1)
+  publishToken: z21.string().optional(),
+  slug: z21.string(),
+  url: z21.string(),
+  workspace: z21.string().optional(),
+  workspaceId: z21.string().optional(),
+  workspaceKind: z21.enum(["personal", "workspace"]).optional()
+});
+var projectConfigSchema = z21.object({
+  folder: z21.string().trim().min(1).optional(),
+  workspace: z21.string().trim().min(1)
 }).strict();
 var CONFIG_DIR = ".artifactcafe";
 var CONFIG_FILE = "config.json";
@@ -1302,7 +1459,7 @@ function readProjectConfig(dir) {
           JSON.parse(readFileSync2(file, "utf8"))
         );
       } catch (error) {
-        const message = error instanceof z19.ZodError ? error.issues[0]?.message ?? "invalid project target" : "invalid JSON";
+        const message = error instanceof z21.ZodError ? error.issues[0]?.message ?? "invalid project target" : "invalid JSON";
         throw new Error(`Invalid ${file}: ${message}.`);
       }
     }
@@ -1367,7 +1524,8 @@ function resolveArtifactTarget(dir, opts = {}) {
     );
   }
   const folderToken = artifactId === config?.artifactId ? config.publishToken : void 0;
-  const credential = folderToken ?? process.env.ARTIFACT_CAFE_TOKEN ?? resolveApiKey(apiUrl2, opts.apiKey);
+  const apiKey = resolveApiKey(apiUrl2, opts.apiKey);
+  const credential = (apiKey?.startsWith("aat_") ? apiKey : void 0) ?? folderToken ?? process.env.ARTIFACT_CAFE_TOKEN ?? apiKey;
   const url = artifactId === config?.artifactId ? config.url : void 0;
   return { apiUrl: apiUrl2, artifactId, credential, url };
 }
@@ -1441,7 +1599,10 @@ async function comment(opts) {
       anchor,
       body,
       versionId: artifact.currentVersion.id,
-      via: opts.via
+      // An account comment keeps its own name and takes the tool as a "via"
+      // label (§6.4) — detected when neither flag is given, so an agent
+      // commenting with your key still says which tool typed it.
+      via: agentLabel(opts.as ?? opts.via)
     });
   } catch (err) {
     if (err instanceof ApiRequestError && err.status === 401) {
@@ -1851,6 +2012,7 @@ async function publish(opts) {
   const token = (artifactId !== null && artifactId === config?.artifactId ? config.publishToken : void 0) ?? process.env.ARTIFACT_CAFE_TOKEN;
   const apiUrl2 = process.env.ARTIFACT_CAFE_URL ?? config?.apiUrl ?? DEFAULT_API_URL;
   const apiKey = resolveApiKey(apiUrl2, opts.apiKey);
+  const usingAgentToken = apiKey?.startsWith("aat_") === true;
   const placement = await resolvePlacement({
     apiKey,
     apiUrl: apiUrl2,
@@ -1873,6 +2035,9 @@ async function publish(opts) {
   }
   const sessionBody = {
     artifactId,
+    // Overrides the entry HTML's own meta description on the share card.
+    // Omitted entirely when absent, so the document keeps speaking for itself.
+    ...opts.description?.trim() ? { description: opts.description.trim() } : {},
     entryPath,
     files: files.map(({ absPath: _absPath, ...manifest }) => manifest),
     ...placement.folderId ? { folderId: placement.folderId } : {},
@@ -1880,7 +2045,10 @@ async function publish(opts) {
     // backslash-n; turn those back into real newlines so bullets survive.
     ...opts.notes?.trim() ? { notes: opts.notes.replace(/\\n/g, "\n").trim() } : {},
     source: {
-      agent: process.env.ARTIFACT_CAFE_AGENT,
+      // ARTIFACT_CAFE_AGENT if it's set, else whichever agent's environment
+      // we recognize — this is what names the agent on every reply to a
+      // thread opened against this version (§6.5).
+      agent: agentLabel(),
       runId: process.env.ARTIFACT_CAFE_RUN_ID,
       type: "cli"
     },
@@ -1893,7 +2061,7 @@ async function publish(opts) {
   try {
     session = await client.createSession(sessionBody);
   } catch (err) {
-    const keyRefused = apiKey !== void 0 && token !== void 0 && apiKey !== token && artifactId !== null && err instanceof ApiRequestError && (err.status === 401 || err.status === 403);
+    const keyRefused = apiKey !== void 0 && !usingAgentToken && token !== void 0 && apiKey !== token && artifactId !== null && err instanceof ApiRequestError && (err.status === 401 || err.status === 403);
     if (!keyRefused) {
       throw err;
     }
@@ -1926,16 +2094,19 @@ async function publish(opts) {
     presence.stop();
   }
   const result = await client.finalize(session.publishSessionId);
+  if (usingAgentToken && result.workspaceId) {
+    placement.workspaceId = result.workspaceId;
+  }
   const rememberedProjectFile = placement.rememberProjectDefault ? writeProjectConfig(dir, placement.rememberProjectDefault) : null;
-  const existingToken = config?.artifactId === result.artifactId ? config.publishToken : void 0;
-  const shouldWriteConfig = result.publishToken !== void 0 || config?.artifactId === result.artifactId || opts.workspace !== void 0 || opts.folder !== void 0 || placement.workspaceId !== void 0;
+  const existingToken = !usingAgentToken && config?.artifactId === result.artifactId ? config.publishToken : void 0;
+  const shouldWriteConfig = usingAgentToken || result.publishToken !== void 0 || config?.artifactId === result.artifactId || opts.workspace !== void 0 || opts.folder !== void 0 || placement.workspaceId !== void 0;
   if (shouldWriteConfig) {
     writeConfig(dir, {
       apiUrl: apiUrl2,
       artifactId: result.artifactId,
       ...placement.folder ? { folder: placement.folder } : {},
       ...placement.folderId ? { folderId: placement.folderId } : {},
-      ...result.publishToken ?? existingToken ? { publishToken: result.publishToken ?? existingToken } : {},
+      ...!usingAgentToken && (result.publishToken ?? existingToken) ? { publishToken: result.publishToken ?? existingToken } : {},
       slug: slugFromUrl(result.url),
       url: result.url,
       ...placement.workspace ? { workspace: placement.workspace } : {},
@@ -2055,6 +2226,18 @@ function accessNote(visibility) {
 }
 async function resolvePlacement(params) {
   const { apiKey, apiUrl: apiUrl2, config, isNewArtifact, opts } = params;
+  if (apiKey?.startsWith("aat_")) {
+    if (opts.workspace !== void 0 || opts.folder !== void 0) {
+      throw new Error(
+        "An agent token selects its own workspace; omit --workspace and --folder."
+      );
+    }
+    return {
+      destination: "workspace",
+      destinationLabel: "Agent token's workspace",
+      destinationSource: "agent-token"
+    };
+  }
   const hasPlacementFlag = opts.workspace !== void 0 || opts.folder !== void 0;
   if (!hasPlacementFlag && config?.workspaceId) {
     const isPersonal = config.workspaceKind === "personal";
@@ -2415,100 +2598,45 @@ function printFolder(folder) {
 // src/link.ts
 import path8 from "path";
 import { createInterface as createInterface2 } from "readline";
-async function link(opts) {
-  const apiUrl2 = (process.env.ARTIFACT_CAFE_URL ?? DEFAULT_API_URL).replace(
-    /\/$/,
-    ""
-  );
-  const key = resolveApiKey(apiUrl2, opts.apiKey);
-  if (!key) {
-    throw new Error(
-      `Linking needs an account \u2014 run \`artifact-cafe login\` first (no API key for ${apiOrigin(apiUrl2)}).`
-    );
-  }
-  const { artifacts } = await createApiClient(apiUrl2, key).listArtifacts();
-  if (artifacts.length === 0) {
-    throw new Error(
-      "No artifacts in your account yet \u2014 publish one first, or claim one via its claim link."
-    );
-  }
-  const selector = opts.artifact ?? opts.slug;
-  let chosen;
-  if (opts.artifact) {
-    chosen = artifacts.find((a) => a.id === opts.artifact);
-  } else if (opts.slug) {
-    chosen = artifacts.find((a) => a.slug === opts.slug);
-  }
-  if (selector && !chosen) {
-    throw new Error(
-      `No artifact "${selector}" in your account \u2014 run \`artifact-cafe list\` to see them.`
-    );
-  }
-  if (opts.json && !chosen) {
-    console.log(JSON.stringify({ artifacts }, null, 2));
-    return;
-  }
-  if (!chosen) {
-    if (!process.stdin.isTTY) {
-      throw new Error(
-        "Pick an artifact with --artifact <id> or --slug <slug> (or --json to list them). Interactive selection needs a terminal."
-      );
-    }
-    chosen = await pickArtifact(artifacts);
-  }
-  const dir = path8.resolve(opts.dir);
-  writeConfig(dir, {
-    apiUrl: apiUrl2,
-    artifactId: chosen.id,
-    slug: chosen.slug,
-    url: chosen.url
-    // No publishToken — this folder authorizes via your login, not a secret.
-  });
-  if (opts.json) {
-    console.log(
-      JSON.stringify(
-        {
-          artifactId: chosen.id,
-          linked: true,
-          slug: chosen.slug,
-          url: chosen.url
-        },
-        null,
-        2
-      )
-    );
-    return;
-  }
-  console.log(`
-\u2713 Linked ${dir} \u2192 "${chosen.title}"  \u2014  ${chosen.url}`);
-  console.log(
-    "  Owner actions (publish, comments --wait, protect) use your login.\n"
+
+// src/list.ts
+async function teamGroups(client) {
+  const { workspaces: workspaces3 } = await client.listWorkspaces();
+  return await Promise.all(
+    workspaces3.filter((workspace) => !workspace.isPersonal).map(async (workspace) => ({
+      artifacts: (await client.listWorkspaceArtifacts(workspace.id)).artifacts,
+      handle: workspace.handle,
+      id: workspace.id,
+      name: workspace.name
+    }))
   );
 }
-function pickArtifact(artifacts) {
-  console.log("Your artifacts:\n");
-  artifacts.forEach((a, i) => {
-    const v = a.currentVersionNumber ? `v${a.currentVersionNumber}` : "\u2014";
-    console.log(
-      `  ${String(i + 1).padStart(2)}. ${a.title}  \xB7  ${v}  \xB7  ${a.url}`
-    );
-  });
-  const rl = createInterface2({ input: process.stdin, output: process.stdout });
-  return new Promise((resolve2, reject) => {
-    rl.question(`
-Link which? [1-${artifacts.length}]: `, (answer) => {
-      rl.close();
-      const n = Number(answer.trim());
-      if (!(Number.isInteger(n) && n >= 1 && n <= artifacts.length)) {
-        reject(new Error(`Enter a number between 1 and ${artifacts.length}.`));
-        return;
-      }
-      resolve2(artifacts[n - 1]);
-    });
-  });
+async function reachableArtifacts(client) {
+  const [own, groups] = await Promise.all([
+    client.listArtifacts(),
+    teamGroups(client)
+  ]);
+  return [
+    ...own.artifacts.map((artifact) => ({
+      currentVersionNumber: artifact.currentVersionNumber,
+      id: artifact.id,
+      slug: artifact.slug,
+      title: artifact.title,
+      url: artifact.url,
+      workspaceHandle: null
+    })),
+    ...groups.flatMap(
+      (group) => group.artifacts.map((artifact) => ({
+        currentVersionNumber: artifact.currentVersionNumber,
+        id: artifact.id,
+        slug: artifact.slug,
+        title: artifact.title,
+        url: artifact.url,
+        workspaceHandle: group.handle
+      }))
+    )
+  ];
 }
-
-// src/list.ts
 async function list(opts) {
   const apiUrl2 = (process.env.ARTIFACT_CAFE_URL ?? DEFAULT_API_URL).replace(
     /\/$/,
@@ -2525,22 +2653,44 @@ async function list(opts) {
     await listWorkspace(client, opts);
     return;
   }
-  const data = await client.listArtifacts();
+  const [data, groups] = await Promise.all([
+    client.listArtifacts(),
+    teamGroups(client)
+  ]);
   if (opts.json) {
-    console.log(JSON.stringify(data, null, 2));
+    console.log(
+      JSON.stringify({ artifacts: data.artifacts, workspaces: groups }, null, 2)
+    );
     return;
   }
-  if (data.artifacts.length === 0) {
+  const total = data.artifacts.length + groups.reduce((sum, group) => sum + group.artifacts.length, 0);
+  if (total === 0) {
     console.log(
-      "No artifacts in your account yet \u2014 publish while logged in, or claim one via its claim link."
+      "No artifacts you can publish to yet \u2014 publish while logged in, or claim one via its claim link."
     );
     return;
   }
-  const plural = data.artifacts.length === 1 ? "" : "s";
-  console.log(`${data.artifacts.length} artifact${plural}
+  if (data.artifacts.length > 0) {
+    const plural = data.artifacts.length === 1 ? "" : "s";
+    console.log(`${data.artifacts.length} artifact${plural}
 `);
-  for (const artifact of data.artifacts) {
-    printArtifact(artifact);
+    for (const artifact of data.artifacts) {
+      printArtifact(artifact);
+    }
+  }
+  for (const group of groups) {
+    if (group.artifacts.length === 0) {
+      continue;
+    }
+    const plural = group.artifacts.length === 1 ? "" : "s";
+    console.log(
+      `${group.artifacts.length} artifact${plural} in ${group.handle}
+`
+    );
+    for (const artifact of group.artifacts) {
+      printWorkspaceArtifact(artifact);
+    }
+    console.log("");
   }
 }
 async function listWorkspace(client, opts) {
@@ -2633,6 +2783,101 @@ function relativeTime(iso) {
   return iso.slice(0, 10);
 }
 
+// src/link.ts
+async function link(opts) {
+  const apiUrl2 = (process.env.ARTIFACT_CAFE_URL ?? DEFAULT_API_URL).replace(
+    /\/$/,
+    ""
+  );
+  const key = resolveApiKey(apiUrl2, opts.apiKey);
+  if (!key) {
+    throw new Error(
+      `Linking needs an account \u2014 run \`artifact-cafe login\` first (no API key for ${apiOrigin(apiUrl2)}).`
+    );
+  }
+  const artifacts = await reachableArtifacts(createApiClient(apiUrl2, key));
+  if (artifacts.length === 0) {
+    throw new Error(
+      "No artifacts you can publish to yet \u2014 publish one first, or claim one via its claim link."
+    );
+  }
+  const selector = opts.artifact ?? opts.slug;
+  let chosen;
+  if (opts.artifact) {
+    chosen = artifacts.find((a) => a.id === opts.artifact);
+  } else if (opts.slug) {
+    chosen = artifacts.find((a) => a.slug === opts.slug);
+  }
+  if (selector && !chosen) {
+    throw new Error(
+      `No artifact "${selector}" you can publish to \u2014 run \`artifact-cafe list\` to see them.`
+    );
+  }
+  if (opts.json && !chosen) {
+    console.log(JSON.stringify({ artifacts }, null, 2));
+    return;
+  }
+  if (!chosen) {
+    if (!process.stdin.isTTY) {
+      throw new Error(
+        "Pick an artifact with --artifact <id> or --slug <slug> (or --json to list them). Interactive selection needs a terminal."
+      );
+    }
+    chosen = await pickArtifact(artifacts);
+  }
+  const dir = path8.resolve(opts.dir);
+  writeConfig(dir, {
+    apiUrl: apiUrl2,
+    artifactId: chosen.id,
+    slug: chosen.slug,
+    url: chosen.url
+    // No publishToken — this folder authorizes via your login, not a secret.
+  });
+  if (opts.json) {
+    console.log(
+      JSON.stringify(
+        {
+          artifactId: chosen.id,
+          linked: true,
+          slug: chosen.slug,
+          url: chosen.url
+        },
+        null,
+        2
+      )
+    );
+    return;
+  }
+  console.log(`
+\u2713 Linked ${dir} \u2192 "${chosen.title}"  \u2014  ${chosen.url}`);
+  console.log(
+    "  Owner actions (publish, comments --wait, protect) use your login.\n"
+  );
+}
+function pickArtifact(artifacts) {
+  console.log("Artifacts you can publish to:\n");
+  artifacts.forEach((a, i) => {
+    const v = a.currentVersionNumber ? `v${a.currentVersionNumber}` : "\u2014";
+    const where = a.workspaceHandle ? `  \xB7  ${a.workspaceHandle}` : "";
+    console.log(
+      `  ${String(i + 1).padStart(2)}. ${a.title}  \xB7  ${v}${where}  \xB7  ${a.url}`
+    );
+  });
+  const rl = createInterface2({ input: process.stdin, output: process.stdout });
+  return new Promise((resolve2, reject) => {
+    rl.question(`
+Link which? [1-${artifacts.length}]: `, (answer) => {
+      rl.close();
+      const n = Number(answer.trim());
+      if (!(Number.isInteger(n) && n >= 1 && n <= artifacts.length)) {
+        reject(new Error(`Enter a number between 1 and ${artifacts.length}.`));
+        return;
+      }
+      resolve2(artifacts[n - 1]);
+    });
+  });
+}
+
 // src/login.ts
 import { createInterface as createInterface3 } from "readline";
 function apiUrl() {
@@ -2994,7 +3239,7 @@ async function replyToThread(opts) {
     artifact: opts.artifact
   });
   const client = createApiClient(target.apiUrl, target.credential);
-  let thread = await client.replyThread(threadId, body);
+  let thread = await client.replyThread(threadId, body, agentLabel(opts.as));
   if (opts.resolve) {
     thread = await client.resolveThread(threadId);
   }
@@ -3217,18 +3462,18 @@ import { existsSync as existsSync3, mkdirSync as mkdirSync3, readFileSync as rea
 import { createRequire } from "module";
 import { homedir as homedir2 } from "os";
 import path18 from "path";
-import { z as z20 } from "zod";
+import { z as z22 } from "zod";
 var REGISTRY_LATEST_URL = "https://registry.npmjs.org/artifact-cafe/latest";
 var SKILL_SOURCE_URL = "https://raw.githubusercontent.com/Artifact-Cafe/skill/main/artifact-cafe/SKILL.md";
 var SKILL_UPDATE_COMMAND = "npx skills add artifact-cafe/skill --skill artifact-cafe -g";
 var CHECK_TTL_MS = 24 * 60 * 60 * 1e3;
 var FETCH_TIMEOUT_MS = 2e3;
 var SKILL_VERSION_PATTERN = /\*\*Skill version:\s*(\d+\.\d+\.\d+)\*\*/;
-var cacheSchema = z20.object({
-  checkedAt: z20.number(),
-  cliLatest: z20.string().nullable(),
-  skillLatest: z20.string().nullable(),
-  version: z20.literal(1)
+var cacheSchema = z22.object({
+  checkedAt: z22.number(),
+  cliLatest: z22.string().nullable(),
+  skillLatest: z22.string().nullable(),
+  version: z22.literal(1)
 });
 function cliVersion() {
   const pkg = createRequire(import.meta.url)("../package.json");
@@ -3283,7 +3528,7 @@ async function fetchText(url) {
 }
 async function fetchLatestVersions(previous) {
   const [cli, skill] = await Promise.all([
-    fetchJson(REGISTRY_LATEST_URL).then((body) => z20.object({ version: z20.string() }).parse(body).version).catch(() => null),
+    fetchJson(REGISTRY_LATEST_URL).then((body) => z22.object({ version: z22.string() }).parse(body).version).catch(() => null),
     fetchText(SKILL_SOURCE_URL).then((body) => SKILL_VERSION_PATTERN.exec(body)?.[1] ?? null).catch(() => null)
   ]);
   return {
@@ -3396,30 +3641,35 @@ function printWorkspace(workspace) {
 }
 
 // src/index.ts
-function readNotesArg(argv) {
+function readStringArg(argv, flag) {
+  const prefix = `${flag}=`;
   for (let i = 0; i < argv.length; i++) {
     const token = argv[i];
     if (token === void 0) {
       continue;
     }
-    if (token === "--notes") {
+    if (token === flag) {
       return argv[i + 1];
     }
-    if (token.startsWith("--notes=")) {
-      return token.slice("--notes=".length);
+    if (token.startsWith(prefix)) {
+      return token.slice(prefix.length);
     }
   }
 }
 var publish2 = defineCommand({
   args: {
     "api-key": {
-      description: "Publish with an account API key (default: stored login)",
+      description: "Publish with an account key or agent token (default: env or login)",
       type: "string"
     },
     artifact: {
       description: "Publish to an existing artifact ID",
       type: "string"
     },
+    description: {
+      description: "One-line share-card summary (default: the entry HTML's own meta description)",
+      type: "string"
+    },
     dir: {
       default: ".",
       description: "Directory to publish",
@@ -3456,11 +3706,12 @@ var publish2 = defineCommand({
       await publish({
         apiKey: args["api-key"],
         artifact: args.artifact,
+        description: readStringArg(process.argv.slice(2), "--description"),
         dir: args.dir,
         entry: args.entry,
         folder: args.folder,
         json: Boolean(args.json),
-        notes: readNotesArg(process.argv.slice(2)),
+        notes: readStringArg(process.argv.slice(2), "--notes"),
         open: !args["no-open"],
         password: args.password,
         review: args.review,
@@ -3541,7 +3792,7 @@ var list2 = defineCommand({
     }
   },
   meta: {
-    description: "List the artifacts your account owns",
+    description: "List the artifacts your account can publish to",
     name: "list"
   },
   async run({ args }) {
@@ -3695,7 +3946,7 @@ var link2 = defineCommand({
     }
   },
   meta: {
-    description: "Link a folder to one of your artifacts (pick from your account)",
+    description: "Link a folder to an artifact you can publish to (yours or a teammate's)",
     name: "link"
   },
   async run({ args }) {
@@ -3716,7 +3967,7 @@ var link2 = defineCommand({
 var comments2 = defineCommand({
   args: {
     "api-key": {
-      description: "Authorize with an account API key (default: stored login)",
+      description: "Authorize with an account key or agent token (default: env or login)",
       type: "string"
     },
     artifact: {
@@ -3780,7 +4031,7 @@ var comments2 = defineCommand({
 var listen = defineCommand({
   args: {
     "api-key": {
-      description: "Authorize with an account API key (default: stored login)",
+      description: "Authorize with an account key or agent token (default: env or login)",
       type: "string"
     },
     artifact: {
@@ -3840,7 +4091,7 @@ var listen = defineCommand({
 var statusCmd = defineCommand({
   args: {
     "api-key": {
-      description: "Authorize with an account API key (default: stored login)",
+      description: "Authorize with an account key or agent token (default: env or login)",
       type: "string"
     },
     artifact: {
@@ -3881,7 +4132,7 @@ var statusCmd = defineCommand({
 var protect2 = defineCommand({
   args: {
     "api-key": {
-      description: "Authorize with an account API key (default: stored login)",
+      description: "Authorize with an account key or agent token (default: env or login)",
       type: "string"
     },
     artifact: {
@@ -3920,7 +4171,7 @@ var protect2 = defineCommand({
 var review2 = defineCommand({
   args: {
     "api-key": {
-      description: "Authorize with an account API key (default: stored login)",
+      description: "Authorize with an account key or agent token (default: env or login)",
       type: "string"
     },
     artifact: {
@@ -3961,7 +4212,7 @@ var review2 = defineCommand({
 var threadStatusCommand = (action) => defineCommand({
   args: {
     "api-key": {
-      description: "Authorize with an account API key (default: stored login)",
+      description: "Authorize with an account key or agent token (default: env or login)",
       type: "string"
     },
     artifact: {
@@ -4010,13 +4261,17 @@ var ack = threadStatusCommand("ack");
 var reply = defineCommand({
   args: {
     "api-key": {
-      description: "Authorize with an account API key (default: stored login)",
+      description: "Authorize with an account key or agent token (default: env or login)",
       type: "string"
     },
     artifact: {
       description: "Act on an artifact ID instead of the linked folder",
       type: "string"
     },
+    as: {
+      description: 'Who is replying, e.g. "Claude Code" (default: detected; "" to opt out)',
+      type: "string"
+    },
     body: {
       description: "Reply text (omit to read from stdin)",
       type: "string"
@@ -4046,6 +4301,7 @@ var reply = defineCommand({
       await replyToThread({
         apiKey: args["api-key"],
         artifact: args.artifact,
+        as: args.as,
         body: args.body,
         dir: args.dir,
         json: Boolean(args.json),
@@ -4068,6 +4324,10 @@ var comment2 = defineCommand({
       description: "Act on an artifact ID instead of the linked folder",
       type: "string"
     },
+    as: {
+      description: 'Tool posting on your behalf, e.g. "Claude Code" (default: detected)',
+      type: "string"
+    },
     body: {
       description: "Comment text (omit to read from stdin)",
       type: "string"
@@ -4095,7 +4355,7 @@ var comment2 = defineCommand({
       type: "string"
     },
     via: {
-      description: 'Attribution label, e.g. "Claude Code"',
+      description: "Older name for --as",
       type: "string"
     }
   },
@@ -4108,6 +4368,7 @@ var comment2 = defineCommand({
       await comment({
         apiKey: args["api-key"],
         artifact: args.artifact,
+        as: args.as,
         body: args.body,
         dir: args.dir,
         json: Boolean(args.json),
@@ -4126,7 +4387,7 @@ var comment2 = defineCommand({
 var edit = defineCommand({
   args: {
     "api-key": {
-      description: "Authorize with an account API key (default: stored login)",
+      description: "Authorize with an account key or agent token (default: env or login)",
       type: "string"
     },
     artifact: {
@@ -4169,7 +4430,7 @@ var edit = defineCommand({
 var del = defineCommand({
   args: {
     "api-key": {
-      description: "Authorize with an account API key (default: stored login)",
+      description: "Authorize with an account key or agent token (default: env or login)",
       type: "string"
     },
     artifact: {