artifact-cafe 0.0.15 → 0.0.16

package/dist/index.js

@@ -497,245 +497,573 @@ function elementLabel(el) {
   return classes.length ? `<${el.tag}.${classes.join(".")}>` : `<${el.tag}>`;
 }
 
-// ../shared/src/errors.ts
+// ../shared/src/data.ts
+var DATA_MANIFEST_PATH = ".artifact/data.json";
+var DATA_NAME_RE = /^[a-z][a-z0-9_]*$/;
+var DATA_NAME_MAX = 64;
+var DATA_RESERVED_FIELDS = /* @__PURE__ */ new Set([
+  "id",
+  "created_at",
+  "updated_at",
+  "created_by",
+  "mine"
+]);
+var DATA_LIMITS = {
+  artifactRateWindowSeconds: 3600,
+  artifactReadHourlyLimit: 1e4,
+  artifactWriteHourlyLimit: 1e3,
+  defaultReadRate: "120/minute/ip",
+  defaultWriteRate: "10/minute/ip",
+  maxCollections: 10,
+  maxFieldsPerCollection: 50,
+  maxListLimit: 200,
+  maxManifestBytes: 64 * 1024,
+  maxRecordBytes: 16 * 1024,
+  maxRecordsPerArtifact: 1e4
+};
+var DATA_ACCESS_DEFAULTS = {
+  delete: "owner",
+  insert: "owner",
+  read: "public",
+  update: "owner"
+};
+var DATA_RATE_LIMIT_RE = /^([1-9]\d{0,5})\/(hour|minute)\/ip$/;
+var isPlainObject = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
+function validateFieldValue(name, field, value, errors) {
+  switch (field.type) {
+    case "string": {
+      if (typeof value !== "string") {
+        errors.push(`${name}: expected a string`);
+        return value;
+      }
+      const s = field.trim ? value.trim() : value;
+      if (field.maxLength !== void 0 && s.length > field.maxLength) {
+        errors.push(`${name}: longer than maxLength ${field.maxLength}`);
+      }
+      return s;
+    }
+    case "number":
+    case "integer": {
+      if (typeof value !== "number" || Number.isNaN(value) || !Number.isFinite(value)) {
+        errors.push(`${name}: expected a ${field.type}`);
+        return value;
+      }
+      if (field.type === "integer" && !Number.isInteger(value)) {
+        errors.push(`${name}: expected an integer`);
+      }
+      if (field.minimum !== void 0 && value < field.minimum) {
+        errors.push(`${name}: below minimum ${field.minimum}`);
+      }
+      if (field.maximum !== void 0 && value > field.maximum) {
+        errors.push(`${name}: above maximum ${field.maximum}`);
+      }
+      return value;
+    }
+    case "boolean": {
+      if (typeof value !== "boolean") {
+        errors.push(`${name}: expected a boolean`);
+      }
+      return value;
+    }
+    case "datetime": {
+      if (typeof value !== "string" || Number.isNaN(Date.parse(value))) {
+        errors.push(`${name}: expected an ISO 8601 datetime string`);
+      }
+      return value;
+    }
+    case "url": {
+      if (typeof value !== "string" || !canParseUrl(value)) {
+        errors.push(`${name}: expected a valid URL`);
+      }
+      return value;
+    }
+    case "email": {
+      if (typeof value !== "string" || !/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(value)) {
+        errors.push(`${name}: expected an email address`);
+      }
+      return value;
+    }
+    case "array": {
+      if (!Array.isArray(value)) {
+        errors.push(`${name}: expected an array`);
+        return value;
+      }
+      if (field.maxLength !== void 0 && value.length > field.maxLength) {
+        errors.push(`${name}: more than maxLength ${field.maxLength} items`);
+      }
+      return value;
+    }
+    case "object": {
+      if (!isPlainObject(value)) {
+        errors.push(`${name}: expected an object`);
+      }
+      return value;
+    }
+    default: {
+      errors.push(`${name}: unknown field type`);
+      return value;
+    }
+  }
+}
+function canParseUrl(value) {
+  try {
+    return Boolean(new URL(value));
+  } catch {
+    return false;
+  }
+}
+function validateRecordInput(collection, input, opts = {}) {
+  if (!isPlainObject(input)) {
+    return { errors: ["record body must be a JSON object"], ok: false };
+  }
+  const errors = [];
+  const data2 = {};
+  for (const key of Object.keys(input)) {
+    if (DATA_RESERVED_FIELDS.has(key)) {
+      errors.push(`${key}: reserved field (server-stamped)`);
+      continue;
+    }
+    const field = collection.fields[key];
+    if (!(Object.hasOwn(collection.fields, key) && field)) {
+      errors.push(`${key}: not a declared field`);
+      continue;
+    }
+    const value = input[key];
+    if (value === null || value === void 0) {
+      if (!field.required) {
+        data2[key] = null;
+      } else if (opts.partial) {
+        errors.push(`${key}: required (cannot be null)`);
+      }
+      continue;
+    }
+    data2[key] = validateFieldValue(key, field, value, errors);
+  }
+  if (opts.partial) {
+    if (Object.keys(data2).length === 0 && errors.length === 0) {
+      errors.push("no fields to update");
+    }
+  } else {
+    for (const [name, field] of Object.entries(collection.fields)) {
+      const present = data2[name] !== void 0 && data2[name] !== null;
+      if (present) {
+        continue;
+      }
+      if (field.default !== void 0) {
+        data2[name] = field.default;
+      } else if (field.required) {
+        errors.push(`${name}: required`);
+      }
+    }
+  }
+  if (errors.length > 0) {
+    return { errors, ok: false };
+  }
+  return { data: data2, ok: true };
+}
+
+// ../shared/src/data-api.ts
 import { z as z8 } from "zod";
-var apiErrorSchema = z8.object({
-  code: z8.string(),
-  docsUrl: z8.string().url(),
-  message: z8.string(),
-  retryAfter: z8.number().int().positive().optional()
+var dataRecordSchema = z8.object({
+  created_at: z8.string(),
+  created_by: z8.string().nullable(),
+  id: z8.string(),
+  updated_at: z8.string()
+}).catchall(z8.unknown());
+var dataPublicRecordSchema = z8.object({
+  created_at: z8.string(),
+  created_by: z8.never().optional(),
+  id: z8.string(),
+  mine: z8.boolean(),
+  updated_at: z8.string()
+}).catchall(z8.unknown());
+var dataPublicListResponseSchema = z8.object({
+  nextCursor: z8.string().nullable(),
+  records: z8.array(dataPublicRecordSchema)
+});
+var dataListResponseSchema = z8.object({
+  nextCursor: z8.string().nullable(),
+  records: z8.array(dataRecordSchema)
+});
+var dataCollectionSummarySchema = z8.object({
+  access: z8.record(z8.string(), z8.string()).optional(),
+  count: z8.number().int().nonnegative().optional(),
+  name: z8.string(),
+  rateLimit: z8.string().optional()
+});
+var dataSummaryResponseSchema = z8.object({
+  collections: z8.array(dataCollectionSummarySchema),
+  enabled: z8.boolean()
+});
+var dataClearResponseSchema = z8.object({
+  cleared: z8.number().int().nonnegative()
 });
 
-// ../shared/src/feedback.ts
+// ../shared/src/data-manifest.ts
 import { z as z9 } from "zod";
-var feedbackRequestSchema = z9.object({
-  email: z9.string().trim().toLowerCase().email().optional().or(z9.literal("")),
-  message: z9.string().trim().min(1).max(4e3)
+var nameSchema = z9.string().max(DATA_NAME_MAX).regex(DATA_NAME_RE, "must match ^[a-z][a-z0-9_]*$");
+var fieldTypeSchema = z9.enum([
+  "string",
+  "number",
+  "integer",
+  "boolean",
+  "datetime",
+  "url",
+  "email",
+  "array",
+  "object"
+]);
+var fieldSchema = z9.strictObject({
+  default: z9.unknown().optional(),
+  maximum: z9.number().optional(),
+  maxLength: z9.number().int().positive().optional(),
+  minimum: z9.number().optional(),
+  required: z9.boolean().optional(),
+  trim: z9.boolean().optional(),
+  type: fieldTypeSchema
+}).superRefine((field, ctx) => {
+  if (field.default === void 0) {
+    return;
+  }
+  if (!defaultMatchesType(field)) {
+    ctx.addIssue({
+      code: "custom",
+      message: `default value does not match type "${field.type}"`,
+      path: ["default"]
+    });
+  }
+});
+function defaultMatchesType(field) {
+  if (field.required && field.default === null) {
+    return false;
+  }
+  return validateRecordInput(
+    {
+      access: DATA_ACCESS_DEFAULTS,
+      fields: { value: { ...field, default: void 0 } }
+    },
+    { value: field.default }
+  ).ok;
+}
+var accessLevelSchema = z9.enum(["public", "creator", "owner", "none"]);
+var accessSchema = z9.strictObject({
+  delete: accessLevelSchema.default("owner"),
+  insert: accessLevelSchema.default("owner"),
+  read: accessLevelSchema.default("public"),
+  update: accessLevelSchema.default("owner")
+}).prefault({});
+var collectionSchema = z9.strictObject({
+  access: accessSchema,
+  fields: z9.record(nameSchema, fieldSchema),
+  publicMutation: z9.literal("open").optional(),
+  rateLimit: z9.string().regex(DATA_RATE_LIMIT_RE, 'expected "N/hour/ip" or "N/minute/ip"').optional()
+}).superRefine((collection, ctx) => {
+  const fieldNames = Object.keys(collection.fields);
+  if (fieldNames.length > DATA_LIMITS.maxFieldsPerCollection) {
+    ctx.addIssue({
+      code: "custom",
+      message: `at most ${DATA_LIMITS.maxFieldsPerCollection} fields per collection`,
+      path: ["fields"]
+    });
+  }
+  for (const name of fieldNames) {
+    if (DATA_RESERVED_FIELDS.has(name)) {
+      ctx.addIssue({
+        code: "custom",
+        message: `"${name}" is reserved (server-stamped)`,
+        path: ["fields", name]
+      });
+    }
+  }
+  for (const action of ["update", "delete"]) {
+    if (collection.access[action] === "public" && collection.publicMutation !== "open") {
+      ctx.addIssue({
+        code: "custom",
+        message: `access.${action} may only be "public" alongside "publicMutation": "open"`,
+        path: ["access", action]
+      });
+    }
+  }
+});
+var dataManifestSchema = z9.strictObject({
+  collections: z9.record(nameSchema, collectionSchema)
+}).superRefine((manifest, ctx) => {
+  if (Object.keys(manifest.collections).length > DATA_LIMITS.maxCollections) {
+    ctx.addIssue({
+      code: "custom",
+      message: `at most ${DATA_LIMITS.maxCollections} collections`,
+      path: ["collections"]
+    });
+  }
+});
+function parseDataManifest(text) {
+  if (new TextEncoder().encode(text).length > DATA_LIMITS.maxManifestBytes) {
+    return {
+      errors: [`manifest larger than ${DATA_LIMITS.maxManifestBytes} bytes`],
+      ok: false
+    };
+  }
+  let raw;
+  try {
+    raw = JSON.parse(text);
+  } catch (err) {
+    return {
+      errors: [`not valid JSON: ${err instanceof Error ? err.message : err}`],
+      ok: false
+    };
+  }
+  const parsed = dataManifestSchema.safeParse(raw);
+  if (!parsed.success) {
+    return {
+      errors: parsed.error.issues.map(
+        (issue) => issue.path.length ? `${issue.path.join(".")}: ${issue.message}` : issue.message
+      ),
+      ok: false
+    };
+  }
+  return { config: parsed.data, ok: true };
+}
+
+// ../shared/src/errors.ts
+import { z as z10 } from "zod";
+var apiErrorSchema = z10.object({
+  code: z10.string(),
+  docsUrl: z10.string().url(),
+  message: z10.string(),
+  retryAfter: z10.number().int().positive().optional(),
+  scope: z10.enum(["ip", "artifact"]).optional()
+});
+
+// ../shared/src/feedback.ts
+import { z as z11 } from "zod";
+var feedbackRequestSchema = z11.object({
+  email: z11.string().trim().toLowerCase().email().optional().or(z11.literal("")),
+  message: z11.string().trim().min(1).max(4e3)
 });
-var feedbackResponseSchema = z9.object({
-  sent: z9.literal(true)
+var feedbackResponseSchema = z11.object({
+  sent: z11.literal(true)
 });
 
 // ../shared/src/grants.ts
-import { z as z10 } from "zod";
-var grantRoleSchema = z10.enum(["viewer"]);
-var createGrantSchema = z10.object({
-  email: z10.string().trim().toLowerCase().email().optional(),
+import { z as z12 } from "zod";
+var grantRoleSchema = z12.enum(["viewer"]);
+var createGrantSchema = z12.object({
+  email: z12.string().trim().toLowerCase().email().optional(),
   role: grantRoleSchema.default("viewer"),
-  userId: z10.string().min(1).optional()
+  userId: z12.string().min(1).optional()
 }).refine((body) => Boolean(body.email) !== Boolean(body.userId), {
   message: "provide exactly one of email or userId"
 });
-var grantSchema = z10.object({
-  createdAt: z10.string(),
-  email: z10.string().email().nullable(),
-  expiresAt: z10.string().nullable(),
-  id: z10.string(),
+var grantSchema = z12.object({
+  createdAt: z12.string(),
+  email: z12.string().email().nullable(),
+  expiresAt: z12.string().nullable(),
+  id: z12.string(),
   // The subject's avatar once they have an account; null otherwise.
-  image: z10.string().nullable(),
+  image: z12.string().nullable(),
   // Present on the invited account after redemption / when granting an
   // existing user; null for a still-pending email invite.
-  name: z10.string().nullable(),
-  redeemedAt: z10.string().nullable(),
+  name: z12.string().nullable(),
+  redeemedAt: z12.string().nullable(),
   role: grantRoleSchema,
   // Shown as "· pending" beside the role until the link is redeemed.
-  status: z10.enum(["pending", "active"]),
+  status: z12.enum(["pending", "active"]),
   // Display fragment of the live invitation token, or null once redeemed.
-  tokenPrefix: z10.string().nullable(),
-  userId: z10.string().nullable()
+  tokenPrefix: z12.string().nullable(),
+  userId: z12.string().nullable()
 });
 var createdGrantSchema = grantSchema.extend({
-  url: z10.string().url()
+  url: z12.string().url()
 });
-var grantListResponseSchema = z10.object({
-  grants: z10.array(grantSchema),
+var grantListResponseSchema = z12.object({
+  grants: z12.array(grantSchema),
   // The artifact's current general-access value, so the share surface can
   // render the "General access" line without a second read.
-  visibility: z10.enum(["public", "unlisted", "workspace", "private"]),
+  visibility: z12.enum(["public", "unlisted", "workspace", "private"]),
   // The owning workspace's logo, so the share modal can draw the workspace
   // itself rather than a generic glyph. Null when none was uploaded.
-  workspaceLogo: z10.string().nullable().optional(),
+  workspaceLogo: z12.string().nullable().optional(),
   // The owning workspace's display name, so "People with access" can name the
   // audience `workspace` visibility actually admits ("All Acme members") rather
   // than leaving an empty list to imply nobody. Null for a workspace-less
   // artifact; optional so an older server still parses.
-  workspaceName: z10.string().nullable().optional()
+  workspaceName: z12.string().nullable().optional()
 });
-var revokeGrantResponseSchema = z10.object({
-  revoked: z10.literal(true)
+var revokeGrantResponseSchema = z12.object({
+  revoked: z12.literal(true)
 });
-var acceptGrantSchema = z10.object({
-  token: z10.string().min(1)
+var acceptGrantSchema = z12.object({
+  token: z12.string().min(1)
 });
-var acceptGrantResponseSchema = z10.object({
-  artifactId: z10.string(),
+var acceptGrantResponseSchema = z12.object({
+  artifactId: z12.string(),
   // The review shell URL to land on, carrying ?invited=1 for the banner.
-  artifactUrl: z10.string().url(),
-  slug: z10.string(),
-  title: z10.string()
-});
-var workspaceGuestSchema = z10.object({
-  artifacts: z10.array(
-    z10.object({
-      artifactId: z10.string(),
-      grantId: z10.string(),
-      slug: z10.string(),
-      status: z10.enum(["pending", "active"]),
-      title: z10.string()
+  artifactUrl: z12.string().url(),
+  slug: z12.string(),
+  title: z12.string()
+});
+var workspaceGuestSchema = z12.object({
+  artifacts: z12.array(
+    z12.object({
+      artifactId: z12.string(),
+      grantId: z12.string(),
+      slug: z12.string(),
+      status: z12.enum(["pending", "active"]),
+      title: z12.string()
     })
   ),
-  email: z10.string().nullable(),
-  image: z10.string().nullable(),
-  name: z10.string().nullable(),
-  userId: z10.string().nullable()
-});
-var workspaceGuestListResponseSchema = z10.object({
-  guests: z10.array(workspaceGuestSchema)
-});
-var sharedWithMeArtifactSchema = z10.object({
-  artifactId: z10.string(),
-  slug: z10.string(),
-  title: z10.string(),
-  url: z10.string().url(),
+  email: z12.string().nullable(),
+  image: z12.string().nullable(),
+  name: z12.string().nullable(),
+  userId: z12.string().nullable()
+});
+var workspaceGuestListResponseSchema = z12.object({
+  guests: z12.array(workspaceGuestSchema)
+});
+var sharedWithMeArtifactSchema = z12.object({
+  artifactId: z12.string(),
+  slug: z12.string(),
+  title: z12.string(),
+  url: z12.string().url(),
   // Who shared it, for the "Shared with me" list.
-  workspaceName: z10.string()
+  workspaceName: z12.string()
 });
-var sharedWithMeListResponseSchema = z10.object({
-  artifacts: z10.array(sharedWithMeArtifactSchema)
+var sharedWithMeListResponseSchema = z12.object({
+  artifacts: z12.array(sharedWithMeArtifactSchema)
 });
 
 // ../shared/src/html-meta.ts
 var HEAD_SCAN_CHARS = 64 * 1024;
 
 // ../shared/src/me.ts
-import { z as z12 } from "zod";
+import { z as z14 } from "zod";
 
 // ../shared/src/workspaces.ts
-import { z as z11 } from "zod";
+import { z as z13 } from "zod";
 var WORKSPACE_HANDLE_PATTERN = /^[a-z0-9](?:[a-z0-9-]{1,30}[a-z0-9])$/;
-var workspaceHandleUnavailableReasonSchema = z11.enum([
+var workspaceHandleUnavailableReasonSchema = z13.enum([
   "held",
   "invalid",
   "reserved",
   "taken"
 ]);
-var workspaceHandleAvailabilitySchema = z11.object({
-  available: z11.boolean(),
-  handle: z11.string(),
+var workspaceHandleAvailabilitySchema = z13.object({
+  available: z13.boolean(),
+  handle: z13.string(),
   // Human-readable sentence for the field hint; null when available.
-  message: z11.string().nullable(),
+  message: z13.string().nullable(),
   reason: workspaceHandleUnavailableReasonSchema.nullable()
 });
-var workspaceRoleSchema = z11.enum(["owner", "admin", "member"]);
-var workspaceInviteRoleSchema = z11.enum(["admin", "member"]);
-var workspaceHandleSchema = z11.string().min(3).max(32).regex(WORKSPACE_HANDLE_PATTERN, {
+var workspaceRoleSchema = z13.enum(["owner", "admin", "member"]);
+var workspaceInviteRoleSchema = z13.enum(["admin", "member"]);
+var workspaceHandleSchema = z13.string().min(3).max(32).regex(WORKSPACE_HANDLE_PATTERN, {
   message: "handle must be lowercase letters, digits, and hyphens, with no leading/trailing hyphen"
 });
-var createWorkspaceSchema = z11.object({
+var createWorkspaceSchema = z13.object({
   handle: workspaceHandleSchema.optional(),
-  name: z11.string().trim().min(1).max(100)
+  name: z13.string().trim().min(1).max(100)
 });
-var updateWorkspaceSchema = z11.object({
+var updateWorkspaceSchema = z13.object({
   handle: workspaceHandleSchema.optional(),
-  name: z11.string().trim().min(1).max(100).optional()
+  name: z13.string().trim().min(1).max(100).optional()
 }).refine((body) => body.handle !== void 0 || body.name !== void 0, {
   message: "provide at least one of name or handle"
 });
-var workspaceSchema = z11.object({
-  createdAt: z11.string(),
-  handle: z11.string(),
+var workspaceSchema = z13.object({
+  createdAt: z13.string(),
+  handle: z13.string(),
   // ISO timestamp when `{handle}.artifact.cafe` was provisioned, or null.
   // Set by the one-time, self-serve enable flow (§4.4); never auto at
   // create, and always null for personal workspaces.
-  hostnameProvisionedAt: z11.string().nullable(),
-  id: z11.string(),
+  hostnameProvisionedAt: z13.string().nullable(),
+  id: z13.string(),
   // Auto-provisioned solo workspace, one per user: non-deletable, takes
   // no members, renameable like any workspace.
-  isPersonal: z11.boolean(),
+  isPersonal: z13.boolean(),
   // Uploaded logo URL, or null for the initials fallback. Set through the
   // dedicated /workspaces/:id/avatar route, never the generic update.
-  logo: z11.string().nullable(),
-  name: z11.string(),
+  logo: z13.string().nullable(),
+  name: z13.string(),
   role: workspaceRoleSchema.nullable(),
-  updatedAt: z11.string()
+  updatedAt: z13.string()
 });
-var workspaceListResponseSchema = z11.object({
-  workspaces: z11.array(workspaceSchema)
+var workspaceListResponseSchema = z13.object({
+  workspaces: z13.array(workspaceSchema)
 });
-var deleteWorkspaceResponseSchema = z11.object({
-  deleted: z11.literal(true)
+var deleteWorkspaceResponseSchema = z13.object({
+  deleted: z13.literal(true)
 });
-var workspaceMemberSchema = z11.object({
-  createdAt: z11.string(),
-  email: z11.string().email(),
-  image: z11.string().nullable(),
-  name: z11.string(),
+var workspaceMemberSchema = z13.object({
+  createdAt: z13.string(),
+  email: z13.string().email(),
+  image: z13.string().nullable(),
+  name: z13.string(),
   role: workspaceRoleSchema,
-  userId: z11.string()
+  userId: z13.string()
 });
-var workspaceMemberListResponseSchema = z11.object({
-  members: z11.array(workspaceMemberSchema)
+var workspaceMemberListResponseSchema = z13.object({
+  members: z13.array(workspaceMemberSchema)
 });
-var updateWorkspaceMemberSchema = z11.object({
+var updateWorkspaceMemberSchema = z13.object({
   role: workspaceRoleSchema
 });
-var removeWorkspaceMemberResponseSchema = z11.object({
-  removed: z11.literal(true)
+var removeWorkspaceMemberResponseSchema = z13.object({
+  removed: z13.literal(true)
 });
-var createWorkspaceInviteSchema = z11.object({
-  email: z11.string().trim().toLowerCase().email().optional(),
-  expiresAt: z11.string().datetime(),
-  maxUses: z11.number().int().positive().optional(),
+var createWorkspaceInviteSchema = z13.object({
+  email: z13.string().trim().toLowerCase().email().optional(),
+  expiresAt: z13.string().datetime(),
+  maxUses: z13.number().int().positive().optional(),
   role: workspaceInviteRoleSchema
 });
-var workspaceInviteSchema = z11.object({
-  createdAt: z11.string(),
-  email: z11.string().email().nullable(),
-  expiresAt: z11.string(),
-  id: z11.string(),
-  maxUses: z11.number().int().positive().nullable(),
+var workspaceInviteSchema = z13.object({
+  createdAt: z13.string(),
+  email: z13.string().email().nullable(),
+  expiresAt: z13.string(),
+  id: z13.string(),
+  maxUses: z13.number().int().positive().nullable(),
   role: workspaceInviteRoleSchema,
-  tokenPrefix: z11.string(),
-  useCount: z11.number().int().nonnegative()
+  tokenPrefix: z13.string(),
+  useCount: z13.number().int().nonnegative()
 });
 var createdWorkspaceInviteSchema = workspaceInviteSchema.extend({
-  url: z11.string().url()
+  url: z13.string().url()
 });
-var workspaceInviteListResponseSchema = z11.object({
-  invites: z11.array(workspaceInviteSchema)
+var workspaceInviteListResponseSchema = z13.object({
+  invites: z13.array(workspaceInviteSchema)
 });
-var revokeWorkspaceInviteResponseSchema = z11.object({
-  revoked: z11.literal(true)
+var revokeWorkspaceInviteResponseSchema = z13.object({
+  revoked: z13.literal(true)
 });
-var acceptWorkspaceInviteSchema = z11.object({
-  token: z11.string().min(1)
+var acceptWorkspaceInviteSchema = z13.object({
+  token: z13.string().min(1)
 });
-var acceptWorkspaceInviteResponseSchema = z11.object({
+var acceptWorkspaceInviteResponseSchema = z13.object({
   role: workspaceRoleSchema,
   workspace: workspaceSchema
 });
-var folderVisibilitySchema = z11.enum(["public", "workspace"]);
-var artifactVisibilitySchema = z11.enum([
+var folderVisibilitySchema = z13.enum(["public", "workspace"]);
+var artifactVisibilitySchema = z13.enum([
   "public",
   "unlisted",
   "workspace",
   "private"
 ]);
-var createFolderSchema = z11.object({
+var createFolderSchema = z13.object({
   // Optional custom icon; omitted (or null) leaves the default glyph.
   emoji: iconEmojiSchema.optional(),
-  name: z11.string().trim().min(1).max(100),
+  name: z13.string().trim().min(1).max(100),
   visibility: folderVisibilitySchema
 });
-var updateFolderSchema = z11.object({
+var updateFolderSchema = z13.object({
   // With `visibility`: bulk-update the folder's artifacts to match
   // (SPEC-2 §3.4 "Changing a folder's visibility offers a bulk update").
-  cascade: z11.boolean().optional(),
+  cascade: z13.boolean().optional(),
   // Explicit null clears the icon back to the default glyph, so this is
   // a field where "sent as null" and "omitted" mean different things.
   emoji: iconEmojiSchema.optional(),
-  name: z11.string().trim().min(1).max(100).optional(),
-  sortOrder: z11.number().int().min(0).optional(),
+  name: z13.string().trim().min(1).max(100).optional(),
+  sortOrder: z13.number().int().min(0).optional(),
   visibility: folderVisibilitySchema.optional()
 }).refine(
   (body) => body.name !== void 0 || body.visibility !== void 0 || body.sortOrder !== void 0 || body.emoji !== void 0,
@@ -743,93 +1071,93 @@ var updateFolderSchema = z11.object({
 ).refine((body) => !body.cascade || body.visibility !== void 0, {
   message: "cascade requires visibility"
 });
-var folderSchema = z11.object({
-  createdAt: z11.string(),
+var folderSchema = z13.object({
+  createdAt: z13.string(),
   // Custom icon, or null to render the default folder glyph.
-  emoji: z11.string().nullable(),
-  id: z11.string(),
-  name: z11.string(),
+  emoji: z13.string().nullable(),
+  id: z13.string(),
+  name: z13.string(),
   // Permalink segment for the public folder page (/w/{handle}/f/{slug}).
   // Server-derived from the name; renames regenerate it.
-  slug: z11.string(),
-  sortOrder: z11.number().int(),
-  updatedAt: z11.string(),
+  slug: z13.string(),
+  sortOrder: z13.number().int(),
+  updatedAt: z13.string(),
   visibility: folderVisibilitySchema,
-  workspaceId: z11.string()
+  workspaceId: z13.string()
 });
-var folderListResponseSchema = z11.object({
-  folders: z11.array(folderSchema)
+var folderListResponseSchema = z13.object({
+  folders: z13.array(folderSchema)
 });
-var deleteFolderResponseSchema = z11.object({
-  deleted: z11.literal(true)
+var deleteFolderResponseSchema = z13.object({
+  deleted: z13.literal(true)
 });
-var workspaceArtifactSchema = z11.object({
-  createdAt: z11.string(),
-  currentVersionNumber: z11.number().int().nullable(),
+var workspaceArtifactSchema = z13.object({
+  createdAt: z13.string(),
+  currentVersionNumber: z13.number().int().nullable(),
   // Custom icon, or null to render the default document glyph.
-  emoji: z11.string().nullable(),
-  folderId: z11.string().nullable(),
-  id: z11.string(),
-  openCommentCount: z11.number().int().nonnegative(),
+  emoji: z13.string().nullable(),
+  folderId: z13.string().nullable(),
+  id: z13.string(),
+  openCommentCount: z13.number().int().nonnegative(),
   reviewMode: reviewModeSchema,
-  slug: z11.string(),
-  title: z11.string(),
-  updatedAt: z11.string(),
-  url: z11.string().url(),
-  versionCount: z11.number().int().nonnegative(),
+  slug: z13.string(),
+  title: z13.string(),
+  updatedAt: z13.string(),
+  url: z13.string().url(),
+  versionCount: z13.number().int().nonnegative(),
   visibility: artifactVisibilitySchema
 });
-var workspaceArtifactListResponseSchema = z11.object({
-  artifacts: z11.array(workspaceArtifactSchema)
+var workspaceArtifactListResponseSchema = z13.object({
+  artifacts: z13.array(workspaceArtifactSchema)
 });
-var workspaceArtifactSearchResultSchema = z11.object({
-  id: z11.string(),
-  slug: z11.string(),
-  title: z11.string()
+var workspaceArtifactSearchResultSchema = z13.object({
+  id: z13.string(),
+  slug: z13.string(),
+  title: z13.string()
 });
-var workspaceArtifactSearchResponseSchema = z11.object({
-  results: z11.array(workspaceArtifactSearchResultSchema)
+var workspaceArtifactSearchResponseSchema = z13.object({
+  results: z13.array(workspaceArtifactSearchResultSchema)
 });
 
 // ../shared/src/me.ts
-var personSchema = z12.object({
-  image: z12.string().nullable(),
-  name: z12.string()
+var personSchema = z14.object({
+  image: z14.string().nullable(),
+  name: z14.string()
 });
-var ownArtifactSchema = z12.object({
+var ownArtifactSchema = z14.object({
   // Everyone else who has published a version, oldest first. Any member may
   // publish a new one (SPEC-2 §5.1), so an artifact's byline is often more
   // than one person and the card stacks their faces rather than crediting
   // whoever shipped last. Excludes `publishedBy`; empty on a solo artifact.
-  coPublishers: z12.array(personSchema),
-  createdAt: z12.string(),
+  coPublishers: z14.array(personSchema),
+  createdAt: z14.string(),
   // SPEC-2 §5.1 — who *made* the artifact: the author of its first
   // finalized version, the same row `viewerCanManage` is decided on. Not
   // the same person as `publishedBy` once an agent ships v2, which is why
   // the dashboard filters on both. Null for a token-only publish.
-  createdBy: z12.object({ image: z12.string().nullable(), name: z12.string() }).nullable(),
-  currentVersionNumber: z12.number().nullable(),
+  createdBy: z14.object({ image: z14.string().nullable(), name: z14.string() }).nullable(),
+  currentVersionNumber: z14.number().nullable(),
   // Custom icon, or null to render the default document glyph.
-  emoji: z12.string().nullable(),
+  emoji: z14.string().nullable(),
   // Owned artifacts normally never expire; non-null only while an
   // expiry is still set (e.g. an unclaimed publish surfaced here later).
-  expiresAt: z12.string().nullable(),
+  expiresAt: z14.string().nullable(),
   // SPEC-2 §8.4 — the containing folder for workspace-owned artifacts;
   // both null for personal artifacts. `folderId` drives the dashboard's
   // move control and folder filter; `folderName` is the display label,
   // `folderEmoji` its icon (null = the default folder glyph).
-  folderEmoji: z12.string().nullable(),
-  folderId: z12.string().nullable(),
-  folderName: z12.string().nullable(),
+  folderEmoji: z14.string().nullable(),
+  folderId: z14.string().nullable(),
+  folderName: z14.string().nullable(),
   // Whether a publish token is still active — revocable from the
   // dashboard (§6.18); the token itself is never returned.
-  hasPublishToken: z12.boolean(),
+  hasPublishToken: z14.boolean(),
   // Owner preference: hide the version list from reviewers in the review
   // shell. Managers still see it.
-  hideVersions: z12.boolean(),
-  id: z12.string(),
-  openThreads: z12.number(),
-  protected: z12.boolean(),
+  hideVersions: z14.boolean(),
+  id: z14.string(),
+  openThreads: z14.number(),
+  protected: z14.boolean(),
   // Who published the current version (falling back to the claiming
   // owner) — the dashboard shows a name and avatar per artifact so a
   // shared workspace reads as people's work, not anonymous rows. Null
@@ -838,44 +1166,44 @@ var ownArtifactSchema = z12.object({
   // SPEC-2 §5.8 — the review dial, so the dashboard's settings dialog can
   // render current state without a second fetch.
   reviewMode: reviewModeSchema,
-  slug: z12.string(),
-  title: z12.string(),
-  totalViews: z12.number(),
+  slug: z14.string(),
+  title: z14.string(),
+  totalViews: z14.number(),
   // SPEC §6.20 — messages by others newer than the viewer's last-seen
   // watermark. 0 for signed-out/API-key-less contexts.
-  unreadComments: z12.number(),
-  updatedAt: z12.string(),
-  url: z12.string(),
-  versionCount: z12.number(),
+  unreadComments: z14.number(),
+  updatedAt: z14.string(),
+  url: z14.string(),
+  versionCount: z14.number(),
   // SPEC-2 §5.1 — whether the caller clears the manage bar for this
   // artifact (workspace admin, or the person who first published it).
   // Only a manager's folder move inherits the folder's visibility, so the
   // dashboard warns exactly the people the change can actually affect, and
   // only a manager is offered the Share entry (§5.7).
-  viewerCanManage: z12.boolean(),
+  viewerCanManage: z14.boolean(),
   // SPEC-2 §5.2 — the artifact's own visibility, the single enforcement
   // source. The dashboard needs it to tell whether a folder move would
   // widen exposure before it sends the PATCH (§3.4), and to render the
   // audience glyph — one per level — on rows and cards (§5.7).
   visibility: artifactVisibilitySchema
 });
-var ownArtifactsResponseSchema = z12.object({
-  artifacts: z12.array(ownArtifactSchema)
+var ownArtifactsResponseSchema = z14.object({
+  artifacts: z14.array(ownArtifactSchema)
 });
-var revokePublishTokenResponseSchema = z12.object({
-  revoked: z12.boolean()
+var revokePublishTokenResponseSchema = z14.object({
+  revoked: z14.boolean()
 });
 
 // ../shared/src/owner.ts
-import { z as z13 } from "zod";
+import { z as z15 } from "zod";
 var SLUG_PATTERN = /^[a-z0-9](?:[a-z0-9-]{1,61}[a-z0-9])$/;
-var claimResponseSchema = z13.object({
-  artifactId: z13.string(),
-  slug: z13.string(),
-  title: z13.string(),
-  url: z13.string().url()
+var claimResponseSchema = z15.object({
+  artifactId: z15.string(),
+  slug: z15.string(),
+  title: z15.string(),
+  url: z15.string().url()
 });
-var updateArtifactSchema = z13.object({
+var updateArtifactSchema = z15.object({
   // Custom icon; explicit null clears it back to the default glyph.
   // Part of what the artifact *is* (like the title), so it takes the
   // same manage rights as title/slug — not the member-level folder move.
@@ -883,159 +1211,159 @@ var updateArtifactSchema = z13.object({
   // SPEC-2 §6.4 — placement + visibility. `folderId: null` clears the
   // folder; `workspaceId: null` moves the artifact out of its workspace
   // (§5.5 ownership transfer).
-  folderId: z13.string().min(1).nullable().optional(),
+  folderId: z15.string().min(1).nullable().optional(),
   // Keep the version list out of the review shell. Presentation only:
   // versions stay immutable, and a `/vN/` URL still resolves.
-  hideVersions: z13.boolean().optional(),
-  slug: z13.string().min(3).max(63).regex(SLUG_PATTERN, {
+  hideVersions: z15.boolean().optional(),
+  slug: z15.string().min(3).max(63).regex(SLUG_PATTERN, {
     message: "slug must be lowercase letters, digits, and hyphens, with no leading/trailing hyphen"
   }).optional(),
-  title: z13.string().min(1).max(200).optional(),
+  title: z15.string().min(1).max(200).optional(),
   visibility: artifactVisibilitySchema.optional(),
-  workspaceId: z13.string().min(1).nullable().optional()
+  workspaceId: z15.string().min(1).nullable().optional()
 }).refine(
   (body) => body.title !== void 0 || body.slug !== void 0 || body.visibility !== void 0 || body.folderId !== void 0 || body.workspaceId !== void 0 || body.emoji !== void 0 || body.hideVersions !== void 0,
   {
     message: "provide at least one of title, slug, visibility, folderId, workspaceId, emoji, hideVersions"
   }
 );
-var deleteArtifactResponseSchema = z13.object({
-  deleted: z13.literal(true)
+var deleteArtifactResponseSchema = z15.object({
+  deleted: z15.literal(true)
 });
 
 // ../shared/src/presence.ts
-import { z as z14 } from "zod";
+import { z as z16 } from "zod";
 var AGENT_STATES = ["listening", "editing", "publishing"];
-var agentStateSchema = z14.enum(AGENT_STATES);
+var agentStateSchema = z16.enum(AGENT_STATES);
 var AGENT_PRESENCE = {
   editingTtlSeconds: 300,
   heartbeatSeconds: 15,
   shellPollSeconds: 15,
   ttlSeconds: 45
 };
-var agentHeartbeatBodySchema = z14.object({
+var agentHeartbeatBodySchema = z16.object({
   state: agentStateSchema.optional()
 });
-var agentHeartbeatResponseSchema = z14.object({
-  listening: z14.literal(true),
+var agentHeartbeatResponseSchema = z16.object({
+  listening: z16.literal(true),
   state: agentStateSchema.optional(),
-  ttlSeconds: z14.number().int().positive()
+  ttlSeconds: z16.number().int().positive()
 });
-var agentPresenceSchema = z14.object({
-  agent: z14.object({ id: z14.string().nullable(), label: z14.string() }).nullable().default(null),
-  listening: z14.boolean(),
+var agentPresenceSchema = z16.object({
+  agent: z16.object({ id: z16.string().nullable(), label: z16.string() }).nullable().default(null),
+  listening: z16.boolean(),
   state: agentStateSchema.nullable().optional(),
-  versionNumber: z14.number().int().positive().nullable()
+  versionNumber: z16.number().int().positive().nullable()
 });
 
 // ../shared/src/protection.ts
-import { z as z15 } from "zod";
+import { z as z17 } from "zod";
 var PASSWORD_MIN = 6;
 var PASSWORD_MAX = 128;
-var gatePasswordSchema = z15.string().min(PASSWORD_MIN, `Password must be at least ${PASSWORD_MIN} characters.`).max(PASSWORD_MAX, `Password must be at most ${PASSWORD_MAX} characters.`);
-var setProtectionSchema = z15.object({
+var gatePasswordSchema = z17.string().min(PASSWORD_MIN, `Password must be at least ${PASSWORD_MIN} characters.`).max(PASSWORD_MAX, `Password must be at most ${PASSWORD_MAX} characters.`);
+var setProtectionSchema = z17.object({
   password: gatePasswordSchema.nullable()
 });
-var protectionResponseSchema = z15.object({
-  protected: z15.boolean()
+var protectionResponseSchema = z17.object({
+  protected: z17.boolean()
 });
-var unlockSchema = z15.object({
-  password: z15.string().min(1).max(1024)
+var unlockSchema = z17.object({
+  password: z17.string().min(1).max(1024)
 });
-var unlockResponseSchema = z15.object({
-  unlocked: z15.literal(true)
+var unlockResponseSchema = z17.object({
+  unlocked: z17.literal(true)
 });
 
 // ../shared/src/report.ts
-import { z as z16 } from "zod";
-var reportRequestSchema = z16.object({
-  reason: z16.string().max(1e3).optional()
+import { z as z18 } from "zod";
+var reportRequestSchema = z18.object({
+  reason: z18.string().max(1e3).optional()
 });
-var reportResponseSchema = z16.object({
-  reported: z16.literal(true)
+var reportResponseSchema = z18.object({
+  reported: z18.literal(true)
 });
 
 // ../shared/src/reviewers.ts
-import { z as z17 } from "zod";
-var artifactReviewerSchema = z17.object({
-  avatarUrl: z17.string().nullable(),
-  displayName: z17.string(),
+import { z as z19 } from "zod";
+var artifactReviewerSchema = z19.object({
+  avatarUrl: z19.string().nullable(),
+  displayName: z19.string(),
   // Exactly one of userId/guestId is set, per `kind`.
-  guestId: z17.string().nullable(),
+  guestId: z19.string().nullable(),
   // "account", not commentAuthorSchema's "member" — the whole point here is
   // that these people need not be workspace members. A guest can be named in
   // a comment but never notified: guest_identities carries a display name and
   // no email, so there is nowhere to send anything.
-  kind: z17.enum(["account", "guest"]),
-  userId: z17.string().nullable()
+  kind: z19.enum(["account", "guest"]),
+  userId: z19.string().nullable()
 });
-var artifactReviewerListResponseSchema = z17.object({
-  reviewers: z17.array(artifactReviewerSchema)
+var artifactReviewerListResponseSchema = z19.object({
+  reviewers: z19.array(artifactReviewerSchema)
 });
 
 // ../shared/src/stats.ts
-import { z as z18 } from "zod";
-var avgViewSecondsSchema = z18.number().int().nonnegative().nullable();
-var versionViewStatsSchema = z18.object({
+import { z as z20 } from "zod";
+var avgViewSecondsSchema = z20.number().int().nonnegative().nullable();
+var versionViewStatsSchema = z20.object({
   avgViewSeconds: avgViewSecondsSchema,
   // Views from inside the review shell's iframe vs. direct visits to
   // the render URL. views = embeddedViews + directViews.
-  directViews: z18.number().int().nonnegative(),
-  embeddedViews: z18.number().int().nonnegative(),
+  directViews: z20.number().int().nonnegative(),
+  embeddedViews: z20.number().int().nonnegative(),
   // Distinct hashed viewer IPs across the version's lifetime.
-  uniqueViewers: z18.number().int().nonnegative(),
-  versionNumber: z18.number().int().positive(),
-  views: z18.number().int().nonnegative()
+  uniqueViewers: z20.number().int().nonnegative(),
+  versionNumber: z20.number().int().positive(),
+  views: z20.number().int().nonnegative()
 });
-var dailyViewsSchema = z18.object({
+var dailyViewsSchema = z20.object({
   avgViewSeconds: avgViewSecondsSchema,
   // UTC day, YYYY-MM-DD.
-  day: z18.string(),
-  uniqueViewers: z18.number().int().nonnegative(),
-  views: z18.number().int().nonnegative()
+  day: z20.string(),
+  uniqueViewers: z20.number().int().nonnegative(),
+  views: z20.number().int().nonnegative()
 });
-var artifactStatsResponseSchema = z18.object({
+var artifactStatsResponseSchema = z20.object({
   avgViewSeconds: avgViewSecondsSchema,
-  daily: z18.array(dailyViewsSchema),
+  daily: z20.array(dailyViewsSchema),
   // Distinct hashed viewer IPs across all versions and days.
-  totalUniqueViewers: z18.number().int().nonnegative(),
-  totalViews: z18.number().int().nonnegative(),
-  versions: z18.array(versionViewStatsSchema)
+  totalUniqueViewers: z20.number().int().nonnegative(),
+  totalViews: z20.number().int().nonnegative(),
+  versions: z20.array(versionViewStatsSchema)
 });
 
 // ../shared/src/versions.ts
-import { z as z19 } from "zod";
-var versionSourceSchema = z19.object({
-  agentName: z19.string().nullable(),
-  type: z19.string()
+import { z as z21 } from "zod";
+var versionSourceSchema = z21.object({
+  agentName: z21.string().nullable(),
+  type: z21.string()
 });
-var versionChangesSchema = z19.object({
-  added: z19.array(z19.string()),
-  changed: z19.array(z19.string()),
-  removed: z19.array(z19.string())
+var versionChangesSchema = z21.object({
+  added: z21.array(z21.string()),
+  changed: z21.array(z21.string()),
+  removed: z21.array(z21.string())
 });
-var versionSummarySchema = z19.object({
+var versionSummarySchema = z21.object({
   // Absent for the first version — there is no previous version to diff against.
   changes: versionChangesSchema.nullable(),
-  createdAt: z19.string(),
-  entryUrl: z19.string().url(),
-  fileCount: z19.number().int().nonnegative(),
-  id: z19.string(),
-  isCurrent: z19.boolean(),
+  createdAt: z21.string(),
+  entryUrl: z21.string().url(),
+  fileCount: z21.number().int().nonnegative(),
+  id: z21.string(),
+  isCurrent: z21.boolean(),
   // Author-supplied bullet-point changelog; null when the publish omitted it.
-  notes: z19.string().nullable(),
+  notes: z21.string().nullable(),
   // The account that published this version, with their own avatar where
   // they've set one. Any workspace member can publish a new version
   // (SPEC-2 §5.1), so "which teammate" outranks "which agent" — the agent
   // is the tool, this is the person. Null for token-only publishes, which
   // carry no account.
-  publishedBy: z19.object({ image: z19.string().nullable(), name: z19.string() }).nullable(),
+  publishedBy: z21.object({ image: z21.string().nullable(), name: z21.string() }).nullable(),
   source: versionSourceSchema,
-  totalSizeBytes: z19.number().int().nonnegative(),
-  versionNumber: z19.number().int().positive()
+  totalSizeBytes: z21.number().int().nonnegative(),
+  versionNumber: z21.number().int().positive()
 });
-var versionListResponseSchema = z19.object({
-  versions: z19.array(versionSummarySchema)
+var versionListResponseSchema = z21.object({
+  versions: z21.array(versionSummarySchema)
 });
 
 // src/agent-identity.ts
@@ -1120,6 +1448,13 @@ function createApiClient(apiUrl2, publishToken) {
         (d) => agentHeartbeatResponseSchema.parse(d)
       );
     },
+    async clearData(artifactId, collection) {
+      return request(
+        `${base}/api/v1/artifacts/${artifactId}/data/${encodeURIComponent(collection)}`,
+        { headers, method: "DELETE" },
+        (d) => dataClearResponseSchema.parse(d)
+      );
+    },
     // SPEC-2 §6.3 — create a folder in a workspace. Account key required
     // (owner/admin; in a personal workspace that's always the user).
     async createFolder(workspaceId, body) {
@@ -1202,6 +1537,13 @@ function createApiClient(apiUrl2, publishToken) {
         (d) => artifactResponseSchema.parse(d)
       );
     },
+    async getDataSummary(artifactId) {
+      return request(
+        `${base}/api/v1/artifacts/${artifactId}/data`,
+        { headers, method: "GET" },
+        (d) => dataSummaryResponseSchema.parse(d)
+      );
+    },
     // SPEC §6.18 — everything owned by the account this client's API
     // key (or session) belongs to.
     async listArtifacts() {
@@ -1211,6 +1553,21 @@ function createApiClient(apiUrl2, publishToken) {
         (d) => artifactListResponseSchema.parse(d)
       );
     },
+    async listData(artifactId, collection, query = {}) {
+      const params = new URLSearchParams();
+      if (query.limit !== void 0) {
+        params.set("limit", String(query.limit));
+      }
+      if (query.cursor !== void 0) {
+        params.set("cursor", query.cursor);
+      }
+      const qs = params.toString();
+      return request(
+        `${base}/api/v1/artifacts/${artifactId}/data/${encodeURIComponent(collection)}${qs ? `?${qs}` : ""}`,
+        { headers, method: "GET" },
+        (d) => dataListResponseSchema.parse(d)
+      );
+    },
     async listFolders(workspaceId) {
       return request(
         `${base}/api/v1/workspaces/${workspaceId}/folders`,
@@ -1346,17 +1703,17 @@ import {
   writeFileSync as writeFileSync2
 } from "fs";
 import path2 from "path";
-import { z as z21 } from "zod";
+import { z as z23 } from "zod";
 
 // src/credentials.ts
 import { existsSync, mkdirSync, readFileSync, writeFileSync } from "fs";
 import { homedir } from "os";
 import path from "path";
-import { z as z20 } from "zod";
+import { z as z22 } from "zod";
 var DEFAULT_API_URL = "https://artifact.cafe";
-var credentialsSchema = z20.object({
-  keys: z20.record(z20.string(), z20.string()),
-  version: z20.literal(1)
+var credentialsSchema = z22.object({
+  keys: z22.record(z22.string(), z22.string()),
+  version: z22.literal(1)
 });
 function credentialsPath() {
   return path.join(homedir(), ".artifactcafe", "credentials");
@@ -1406,24 +1763,24 @@ function resolveApiKey(apiUrl2, flag) {
 }
 
 // src/config.ts
-var configSchema = z21.object({
-  apiUrl: z21.string(),
-  artifactId: z21.string(),
-  folder: z21.string().optional(),
-  folderId: z21.string().optional(),
+var configSchema = z23.object({
+  apiUrl: z23.string(),
+  artifactId: z23.string(),
+  folder: z23.string().optional(),
+  folderId: z23.string().optional(),
   // Optional: a folder linked by `link` to an artifact you own carries no
   // token — owner actions authorize via your stored login instead. A first
   // publish still writes the anonymous-mode token here.
-  publishToken: z21.string().optional(),
-  slug: z21.string(),
-  url: z21.string(),
-  workspace: z21.string().optional(),
-  workspaceId: z21.string().optional(),
-  workspaceKind: z21.enum(["personal", "workspace"]).optional()
-});
-var projectConfigSchema = z21.object({
-  folder: z21.string().trim().min(1).optional(),
-  workspace: z21.string().trim().min(1)
+  publishToken: z23.string().optional(),
+  slug: z23.string(),
+  url: z23.string(),
+  workspace: z23.string().optional(),
+  workspaceId: z23.string().optional(),
+  workspaceKind: z23.enum(["personal", "workspace"]).optional()
+});
+var projectConfigSchema = z23.object({
+  folder: z23.string().trim().min(1).optional(),
+  workspace: z23.string().trim().min(1)
 }).strict();
 var CONFIG_DIR = ".artifactcafe";
 var CONFIG_FILE = "config.json";
@@ -1459,7 +1816,7 @@ function readProjectConfig(dir) {
           JSON.parse(readFileSync2(file, "utf8"))
         );
       } catch (error) {
-        const message = error instanceof z21.ZodError ? error.issues[0]?.message ?? "invalid project target" : "invalid JSON";
+        const message = error instanceof z23.ZodError ? error.issues[0]?.message ?? "invalid project target" : "invalid JSON";
         throw new Error(`Invalid ${file}: ${message}.`);
       }
     }
@@ -1669,27 +2026,27 @@ async function comments(opts) {
     });
     return;
   }
-  const data = await client.exportComments(target.artifactId, {
+  const data2 = await client.exportComments(target.artifactId, {
     status: status2,
     version
   });
   if (opts.json) {
-    console.log(JSON.stringify(data, null, 2));
+    console.log(JSON.stringify(data2, null, 2));
     return;
   }
-  printHuman(data, url, status2, version);
+  printHuman(data2, url, status2, version);
 }
 async function deriveReviewUrl(client, target) {
   const artifact = await client.getArtifact(target.artifactId);
   return reviewUrl(target.apiUrl, artifact.slug);
 }
 var sleep = (s) => new Promise((r) => setTimeout(r, s * 1e3));
-function messageCounts(data) {
-  return new Map(data.comments.map((t) => [t.id, 1 + t.replies.length]));
+function messageCounts(data2) {
+  return new Map(data2.comments.map((t) => [t.id, 1 + t.replies.length]));
 }
-function diffThreads(baseline, data) {
+function diffThreads(baseline, data2) {
   const changed = [];
-  for (const t of data.comments) {
+  for (const t of data2.comments) {
     const before = baseline.get(t.id);
     if (before === void 0) {
       changed.push({ ...t, change: "new" });
@@ -1732,8 +2089,8 @@ async function waitForFeedback(client, config, opts) {
   while (Date.now() < deadline) {
     await sleep(Math.min(pollSeconds(), (deadline - Date.now()) / 1e3));
     await heartbeat();
-    const data = await client.exportComments(config.artifactId, query);
-    if (diffThreads(baseline, data).length === 0) {
+    const data2 = await client.exportComments(config.artifactId, query);
+    if (diffThreads(baseline, data2).length === 0) {
       continue;
     }
     await sleep(settleSeconds());
@@ -1766,7 +2123,7 @@ async function waitForFeedback(client, config, opts) {
   }
   process.exit(WAIT_TIMEOUT_EXIT);
 }
-function printWaitResult(config, data, changed, json) {
+function printWaitResult(config, data2, changed, json) {
   if (json) {
     console.log(
       JSON.stringify(
@@ -1774,7 +2131,7 @@ function printWaitResult(config, data, changed, json) {
           artifactId: config.artifactId,
           threads: changed,
           timedOut: false,
-          versionNumber: data.versionNumber
+          versionNumber: data2.versionNumber
         },
         null,
         2
@@ -1793,22 +2150,22 @@ ${changed.length} thread${plural} with new feedback \u2014 ${config.url}
     printThread(thread);
   }
 }
-function printHuman(data, url, status2, version) {
+function printHuman(data2, url, status2, version) {
   const statusLabel = status2 === "all" ? "" : `${status2} `;
   let scope = "across all versions";
   if (version === "current") {
-    scope = data.versionNumber === null ? "on the current version" : `on v${data.versionNumber}`;
+    scope = data2.versionNumber === null ? "on the current version" : `on v${data2.versionNumber}`;
   }
-  if (data.comments.length === 0) {
+  if (data2.comments.length === 0) {
     console.log(`No ${statusLabel}comments ${scope}.`);
     return;
   }
-  const plural = data.comments.length === 1 ? "" : "s";
+  const plural = data2.comments.length === 1 ? "" : "s";
   console.log(
-    `${data.comments.length} ${statusLabel}thread${plural} ${scope} \u2014 ${url}
+    `${data2.comments.length} ${statusLabel}thread${plural} ${scope} \u2014 ${url}
 `
   );
-  for (const thread of data.comments) {
+  for (const thread of data2.comments) {
     printThread(thread);
   }
 }
@@ -1853,18 +2210,161 @@ function indent(text, pad) {
 }
 
 // src/dashboard.ts
-import path7 from "path";
+import path8 from "path";
 
 // src/publish.ts
 import { exec } from "child_process";
-import { readFileSync as readFileSync4 } from "fs";
-import path6 from "path";
+import { readFileSync as readFileSync5 } from "fs";
+import path7 from "path";
 import { createInterface } from "readline";
 
+// src/data.ts
+import { readFileSync as readFileSync3 } from "fs";
+import path5 from "path";
+function inspectDataManifest(files) {
+  const info = { announcements: [] };
+  const manifestFile = files.find((f) => f.path === DATA_MANIFEST_PATH);
+  if (manifestFile) {
+    const parsed = parseDataManifest(
+      readFileSync3(manifestFile.absPath, "utf8")
+    );
+    if (!parsed.ok) {
+      throw new Error(
+        `${DATA_MANIFEST_PATH} is invalid:
+${(parsed.errors ?? []).map((e) => `  - ${e}`).join("\n")}`
+      );
+    }
+    info.config = parsed.config;
+    for (const [name, collection] of Object.entries(
+      parsed.config?.collections ?? {}
+    )) {
+      const bits = [
+        `read: ${collection.access.read}`,
+        `insert: ${collection.access.insert}`
+      ];
+      if (collection.access.update !== "owner") {
+        bits.push(`update: ${collection.access.update}`);
+      }
+      if (collection.access.delete !== "owner") {
+        bits.push(`delete: ${collection.access.delete}`);
+      }
+      if (collection.rateLimit) {
+        bits.push(collection.rateLimit);
+      }
+      info.announcements.push(`\u26C1 Data enabled: ${name} (${bits.join(", ")})`);
+    }
+    if (info.announcements.length === 0) {
+      info.announcements.push(
+        "\u26C1 Data disabled (empty collections in .artifact/data.json)"
+      );
+    }
+  }
+  return info;
+}
+function requireLinkedArtifact(dir) {
+  const resolved = path5.resolve(dir);
+  const config = readConfig(resolved);
+  if (!config) {
+    throw new Error(
+      `No artifact linked in ${resolved} \u2014 run \`artifact-cafe publish\` there first (.artifactcafe/config.json not found).`
+    );
+  }
+  return {
+    apiUrl: process.env.ARTIFACT_CAFE_URL ?? config.apiUrl,
+    artifactId: config.artifactId,
+    publishToken: resolveApiKey(process.env.ARTIFACT_CAFE_URL ?? config.apiUrl) ?? config.publishToken ?? process.env.ARTIFACT_CAFE_TOKEN,
+    url: config.url
+  };
+}
+async function dataLs(opts) {
+  const linked = requireLinkedArtifact(opts.dir);
+  const client = createApiClient(linked.apiUrl, linked.publishToken);
+  const records = [];
+  let cursor;
+  do {
+    const page = await client.listData(linked.artifactId, opts.collection, {
+      cursor,
+      limit: 200
+    });
+    records.push(...page.records);
+    cursor = page.nextCursor ?? void 0;
+  } while (cursor && (opts.limit === void 0 || records.length < opts.limit));
+  const shown = opts.limit === void 0 ? records : records.slice(0, opts.limit);
+  if (opts.json) {
+    console.log(
+      JSON.stringify({ collection: opts.collection, records: shown }, null, 2)
+    );
+    return;
+  }
+  if (shown.length === 0) {
+    console.log(`No records in "${opts.collection}".`);
+    return;
+  }
+  const plural = shown.length === 1 ? "" : "s";
+  console.log(
+    `${shown.length} record${plural} in "${opts.collection}" \u2014 ${linked.url}
+`
+  );
+  for (const record of shown) {
+    const { created_at, created_by, id, updated_at: _u, ...fields } = record;
+    const author = created_by ?? "anonymous";
+    console.log(`\u25CF ${id} \xB7 ${String(created_at).slice(0, 10)} \xB7 ${author}`);
+    console.log(`  ${JSON.stringify(fields)}`);
+  }
+}
+async function dataExport(opts) {
+  const linked = requireLinkedArtifact(opts.dir);
+  const client = createApiClient(linked.apiUrl, linked.publishToken);
+  const summary = await client.getDataSummary(linked.artifactId);
+  const collections = {};
+  for (const { name } of summary.collections) {
+    const records = [];
+    let cursor;
+    do {
+      const page = await client.listData(linked.artifactId, name, {
+        cursor,
+        limit: 200
+      });
+      records.push(...page.records);
+      cursor = page.nextCursor ?? void 0;
+    } while (cursor);
+    collections[name] = records;
+  }
+  console.log(
+    JSON.stringify(
+      {
+        artifactId: linked.artifactId,
+        collections,
+        enabled: summary.enabled,
+        url: linked.url
+      },
+      null,
+      2
+    )
+  );
+}
+async function dataClear(opts) {
+  if (!opts.yes) {
+    throw new Error(
+      `Clearing "${opts.collection}" deletes every record in it. Re-run with --yes to confirm.`
+    );
+  }
+  const linked = requireLinkedArtifact(opts.dir);
+  const client = createApiClient(linked.apiUrl, linked.publishToken);
+  const result = await client.clearData(linked.artifactId, opts.collection);
+  if (opts.json) {
+    console.log(
+      JSON.stringify({ cleared: result.cleared, collection: opts.collection })
+    );
+    return;
+  }
+  console.log(`Cleared ${result.cleared} record(s) from "${opts.collection}".`);
+}
+
 // src/manifest.ts
 import { createHash } from "crypto";
-import { readdirSync, readFileSync as readFileSync3, statSync } from "fs";
-import path5 from "path";
+import { readdirSync, readFileSync as readFileSync4, statSync } from "fs";
+import path6 from "path";
 var IGNORED_DIRS = /* @__PURE__ */ new Set([".git", "node_modules", ".artifactcafe"]);
 var IGNORED_FILES = /* @__PURE__ */ new Set([".DS_Store", "artifact-cafe.json"]);
 function isIgnoredFile(name) {
@@ -1913,7 +2413,7 @@ var MIME_TYPES = {
   ".xml": "application/xml"
 };
 function mimeFor(filePath) {
-  return MIME_TYPES[path5.extname(filePath).toLowerCase()] ?? "application/octet-stream";
+  return MIME_TYPES[path6.extname(filePath).toLowerCase()] ?? "application/octet-stream";
 }
 function scanDirectory(dir) {
   const files = [];
@@ -1921,7 +2421,7 @@ function scanDirectory(dir) {
   function walk(current, relPrefix) {
     for (const entry of readdirSync(current, { withFileTypes: true })) {
       const rel = relPrefix ? `${relPrefix}/${entry.name}` : entry.name;
-      const abs = path5.join(current, entry.name);
+      const abs = path6.join(current, entry.name);
       if (entry.isSymbolicLink()) {
         skipped.push(rel);
         continue;
@@ -1946,7 +2446,7 @@ function scanDirectory(dir) {
         skipped.push(rel);
         continue;
       }
-      const content = readFileSync3(abs);
+      const content = readFileSync4(abs);
       files.push({
         absPath: abs,
         hash: `sha256_${createHash("sha256").update(content).digest("hex")}`,
@@ -1992,7 +2492,7 @@ var REVIEW_LABEL = {
   readonly: "read-only \u2014 existing comments only"
 };
 async function publish(opts) {
-  const dir = path6.resolve(opts.dir);
+  const dir = path7.resolve(opts.dir);
   const config = readConfig(dir);
   if (opts.password !== void 0) {
     const parsed = gatePasswordSchema.safeParse(opts.password);
@@ -2025,6 +2525,7 @@ async function publish(opts) {
     throw new Error(`Nothing to publish in ${dir} (after ignore rules).`);
   }
   const entryPath = resolveEntry(files, opts.entry);
+  const dataInfo = inspectDataManifest(files);
   const log = (msg) => {
     if (!opts.json) {
       console.log(msg);
@@ -2085,7 +2586,7 @@ async function publish(opts) {
         }
         await uploadFile(
           upload.uploadUrl,
-          readFileSync4(file.absPath),
+          readFileSync5(file.absPath),
           file.mimeType
         );
       }
@@ -2133,6 +2634,7 @@ async function publish(opts) {
       JSON.stringify(
         {
           artifactId: result.artifactId,
+          ...dataInfo.config ? { data: dataInfo.config } : {},
           claimed: result.claimed,
           destination: placement.destination,
           destinationSource: placement.destinationSource,
@@ -2211,6 +2713,11 @@ ${result.claimUrl}
 `);
     }
   }
+  if (!opts.json) {
+    for (const announcement of dataInfo.announcements) {
+      console.log(announcement);
+    }
+  }
   if (opts.open && !opts.json && process.stdout.isTTY) {
     openInBrowser(result.url);
   }
@@ -2280,9 +2787,9 @@ async function resolvePlacement(params) {
       };
     }
     if (shouldPromptForWorkspace(opts)) {
-      const data2 = await createApiClient(apiUrl2, apiKey).listWorkspaces();
-      if (data2.workspaces.length > 1) {
-        const choice = await pickWorkspace(data2.workspaces);
+      const data3 = await createApiClient(apiUrl2, apiKey).listWorkspaces();
+      if (data3.workspaces.length > 1) {
+        const choice = await pickWorkspace(data3.workspaces);
         return {
           destination: choice.workspace.isPersonal ? "personal" : "workspace",
           destinationLabel: choice.workspace.isPersonal ? "Personal" : choice.workspace.name,
@@ -2308,19 +2815,19 @@ async function resolvePlacement(params) {
     throw new Error("--folder requires --workspace or a stored workspace.");
   }
   const client = createApiClient(apiUrl2, apiKey);
-  const data = await client.listWorkspaces();
+  const data2 = await client.listWorkspaces();
   const workspaceHandle = opts.workspace ?? config?.workspace ?? projectConfig?.workspace;
   let workspace;
   if (workspaceHandle) {
-    workspace = data.workspaces.find(
+    workspace = data2.workspaces.find(
       (candidate) => candidate.handle === workspaceHandle
     );
   } else if (config?.workspaceId) {
-    workspace = data.workspaces.find(
+    workspace = data2.workspaces.find(
       (candidate) => candidate.id === config.workspaceId
     );
   } else {
-    workspace = data.workspaces.find((candidate) => candidate.isPersonal);
+    workspace = data2.workspaces.find((candidate) => candidate.isPersonal);
   }
   if (!workspace) {
     const target = workspaceHandle ? `workspace with handle "${workspaceHandle}"` : "personal workspace";
@@ -2458,7 +2965,7 @@ function openInBrowser(url) {
 
 // src/dashboard.ts
 function openDashboard(opts) {
-  const base = process.env.ARTIFACT_CAFE_URL ?? readConfig(path7.resolve(opts.dir))?.apiUrl ?? DEFAULT_API_URL;
+  const base = process.env.ARTIFACT_CAFE_URL ?? readConfig(path8.resolve(opts.dir))?.apiUrl ?? DEFAULT_API_URL;
   const url = `${base.replace(/\/$/, "")}/dashboard`;
   console.log(url);
   if (process.stdout.isTTY) {
@@ -2544,21 +3051,21 @@ async function folders(opts) {
     await createFolder(client, workspace, opts);
     return;
   }
-  const data = await client.listFolders(workspace.id);
+  const data2 = await client.listFolders(workspace.id);
   if (opts.json) {
-    console.log(JSON.stringify(data, null, 2));
+    console.log(JSON.stringify(data2, null, 2));
     return;
   }
-  if (data.folders.length === 0) {
+  if (data2.folders.length === 0) {
     console.log(`No folders in workspace ${workspace.handle}.`);
     return;
   }
-  const plural = data.folders.length === 1 ? "" : "s";
+  const plural = data2.folders.length === 1 ? "" : "s";
   console.log(
-    `${data.folders.length} folder${plural} in ${workspace.handle}
+    `${data2.folders.length} folder${plural} in ${workspace.handle}
 `
   );
-  for (const folder of data.folders) {
+  for (const folder of data2.folders) {
     printFolder(folder);
   }
 }
@@ -2596,7 +3103,7 @@ function printFolder(folder) {
 }
 
 // src/link.ts
-import path8 from "path";
+import path9 from "path";
 import { createInterface as createInterface2 } from "readline";
 
 // src/list.ts
@@ -2653,28 +3160,28 @@ async function list(opts) {
     await listWorkspace(client, opts);
     return;
   }
-  const [data, groups] = await Promise.all([
+  const [data2, groups] = await Promise.all([
     client.listArtifacts(),
     teamGroups(client)
   ]);
   if (opts.json) {
     console.log(
-      JSON.stringify({ artifacts: data.artifacts, workspaces: groups }, null, 2)
+      JSON.stringify({ artifacts: data2.artifacts, workspaces: groups }, null, 2)
     );
     return;
   }
-  const total = data.artifacts.length + groups.reduce((sum, group) => sum + group.artifacts.length, 0);
+  const total = data2.artifacts.length + groups.reduce((sum, group) => sum + group.artifacts.length, 0);
   if (total === 0) {
     console.log(
       "No artifacts you can publish to yet \u2014 publish while logged in, or claim one via its claim link."
     );
     return;
   }
-  if (data.artifacts.length > 0) {
-    const plural = data.artifacts.length === 1 ? "" : "s";
-    console.log(`${data.artifacts.length} artifact${plural}
+  if (data2.artifacts.length > 0) {
+    const plural = data2.artifacts.length === 1 ? "" : "s";
+    console.log(`${data2.artifacts.length} artifact${plural}
 `);
-    for (const artifact of data.artifacts) {
+    for (const artifact of data2.artifacts) {
       printArtifact(artifact);
     }
   }
@@ -2825,7 +3332,7 @@ async function link(opts) {
     }
     chosen = await pickArtifact(artifacts);
   }
-  const dir = path8.resolve(opts.dir);
+  const dir = path9.resolve(opts.dir);
   writeConfig(dir, {
     apiUrl: apiUrl2,
     artifactId: chosen.id,
@@ -2993,7 +3500,7 @@ function logout(opts) {
 }
 
 // src/message.ts
-import path9 from "path";
+import path10 from "path";
 async function readStdin2() {
   if (process.stdin.isTTY) {
     return "";
@@ -3017,7 +3524,7 @@ async function editMessage(opts) {
       'Nothing to save. Pass the new text with --body "\u2026", or pipe it on stdin.'
     );
   }
-  const dir = path9.resolve(opts.dir);
+  const dir = path10.resolve(opts.dir);
   const target = resolveArtifactTarget(dir, {
     apiKey: opts.apiKey,
     artifact: opts.artifact
@@ -3037,7 +3544,7 @@ async function deleteMessage(opts) {
       "Pass the message id to delete \u2014 get it from `artifact-cafe comments --json`."
     );
   }
-  const dir = path9.resolve(opts.dir);
+  const dir = path10.resolve(opts.dir);
   const target = resolveArtifactTarget(dir, {
     apiKey: opts.apiKey,
     artifact: opts.artifact
@@ -3052,12 +3559,12 @@ async function deleteMessage(opts) {
 }
 
 // src/move.ts
-import path10 from "path";
+import path11 from "path";
 async function move(opts) {
   if (Boolean(opts.folder) === Boolean(opts.unfiled)) {
     throw new Error("Pass exactly one of --folder <name-or-id> or --unfiled.");
   }
-  const dir = path10.resolve(opts.dir);
+  const dir = path11.resolve(opts.dir);
   const target = resolveArtifactTarget(dir, {
     apiKey: opts.apiKey,
     artifact: opts.artifact
@@ -3078,8 +3585,8 @@ async function move(opts) {
   let folderId = null;
   let folderName = null;
   if (opts.folder) {
-    const data = await client.listFolders(artifact.workspaceId);
-    const matches = data.folders.filter(
+    const data2 = await client.listFolders(artifact.workspaceId);
+    const matches = data2.folders.filter(
       (candidate) => candidate.name === opts.folder || candidate.id === opts.folder
     );
     if (matches.length === 0) {
@@ -3147,9 +3654,9 @@ async function move(opts) {
 }
 
 // src/open.ts
-import path11 from "path";
+import path12 from "path";
 async function openArtifact(opts) {
-  const dir = path11.resolve(opts.dir);
+  const dir = path12.resolve(opts.dir);
   const target = resolveArtifactTarget(dir, {
     apiKey: opts.apiKey,
     artifact: opts.artifact
@@ -3167,7 +3674,7 @@ async function openArtifact(opts) {
 }
 
 // src/protect.ts
-import path12 from "path";
+import path13 from "path";
 async function protect(opts) {
   if (opts.off && opts.password !== void 0) {
     throw new Error("Pass either --password or --off, not both.");
@@ -3184,7 +3691,7 @@ async function protect(opts) {
       throw new Error(parsed.error.issues[0]?.message ?? "Invalid password.");
     }
   }
-  const dir = path12.resolve(opts.dir);
+  const dir = path13.resolve(opts.dir);
   const target = resolveArtifactTarget(dir, {
     apiKey: opts.apiKey,
     artifact: opts.artifact
@@ -3209,7 +3716,7 @@ async function protect(opts) {
 }
 
 // src/reply.ts
-import path13 from "path";
+import path14 from "path";
 async function readStdin3() {
   if (process.stdin.isTTY) {
     return "";
@@ -3233,7 +3740,7 @@ async function replyToThread(opts) {
       'Nothing to post. Pass the reply with --body "\u2026", or pipe it on stdin.'
     );
   }
-  const dir = path13.resolve(opts.dir);
+  const dir = path14.resolve(opts.dir);
   const target = resolveArtifactTarget(dir, {
     apiKey: opts.apiKey,
     artifact: opts.artifact
@@ -3262,7 +3769,7 @@ async function replyToThread(opts) {
 }
 
 // src/resolve.ts
-import path14 from "path";
+import path15 from "path";
 async function changeThreadStatus(opts) {
   const threadId = opts.thread?.trim();
   if (!threadId) {
@@ -3270,7 +3777,7 @@ async function changeThreadStatus(opts) {
       `Pass the thread id to ${opts.action} \u2014 get it from \`artifact-cafe comments --json\`.`
     );
   }
-  const dir = path14.resolve(opts.dir);
+  const dir = path15.resolve(opts.dir);
   const target = resolveArtifactTarget(dir, {
     apiKey: opts.apiKey,
     artifact: opts.artifact
@@ -3307,7 +3814,7 @@ async function changeThreadStatus(opts) {
 }
 
 // src/review.ts
-import path15 from "path";
+import path16 from "path";
 var OUTCOME = {
   off: "Plain artifact \u2014 the review tools are hidden entirely",
   open: "Open for review \u2014 anyone who can open it can comment",
@@ -3321,7 +3828,7 @@ async function review(opts) {
     );
   }
   const mode = parsed.data;
-  const dir = path15.resolve(opts.dir);
+  const dir = path16.resolve(opts.dir);
   const target = resolveArtifactTarget(dir, {
     apiKey: opts.apiKey,
     artifact: opts.artifact
@@ -3343,10 +3850,10 @@ async function review(opts) {
 }
 
 // src/share.ts
-import path16 from "path";
+import path17 from "path";
 var EMAIL_RE = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
 async function share(opts) {
-  const dir = path16.resolve(opts.dir);
+  const dir = path17.resolve(opts.dir);
   const target = resolveArtifactTarget(dir, {
     apiKey: opts.apiKey,
     artifact: opts.artifact
@@ -3401,7 +3908,7 @@ General access: ${visibility}`);
   console.log("");
 }
 async function unshare(opts) {
-  const dir = path16.resolve(opts.dir);
+  const dir = path17.resolve(opts.dir);
   const target = resolveArtifactTarget(dir, {
     apiKey: opts.apiKey,
     artifact: opts.artifact
@@ -3424,7 +3931,7 @@ async function unshare(opts) {
 }
 
 // src/status.ts
-import path17 from "path";
+import path18 from "path";
 async function status(opts) {
   if (!AGENT_STATES.includes(opts.state)) {
     throw new Error(
@@ -3432,7 +3939,7 @@ async function status(opts) {
     );
   }
   const state = opts.state;
-  const dir = path17.resolve(opts.dir);
+  const dir = path18.resolve(opts.dir);
   const target = resolveArtifactTarget(dir, {
     apiKey: opts.apiKey,
     artifact: opts.artifact
@@ -3458,40 +3965,40 @@ async function status(opts) {
 }
 
 // src/update.ts
-import { existsSync as existsSync3, mkdirSync as mkdirSync3, readFileSync as readFileSync5, writeFileSync as writeFileSync3 } from "fs";
+import { existsSync as existsSync3, mkdirSync as mkdirSync3, readFileSync as readFileSync6, writeFileSync as writeFileSync3 } from "fs";
 import { createRequire } from "module";
 import { homedir as homedir2 } from "os";
-import path18 from "path";
-import { z as z22 } from "zod";
+import path19 from "path";
+import { z as z24 } from "zod";
 var REGISTRY_LATEST_URL = "https://registry.npmjs.org/artifact-cafe/latest";
 var SKILL_SOURCE_URL = "https://raw.githubusercontent.com/Artifact-Cafe/skill/main/artifact-cafe/SKILL.md";
 var SKILL_UPDATE_COMMAND = "npx skills add artifact-cafe/skill --skill artifact-cafe -g";
 var CHECK_TTL_MS = 24 * 60 * 60 * 1e3;
 var FETCH_TIMEOUT_MS = 2e3;
 var SKILL_VERSION_PATTERN = /\*\*Skill version:\s*(\d+\.\d+\.\d+)\*\*/;
-var cacheSchema = z22.object({
-  checkedAt: z22.number(),
-  cliLatest: z22.string().nullable(),
-  skillLatest: z22.string().nullable(),
-  version: z22.literal(1)
+var cacheSchema = z24.object({
+  checkedAt: z24.number(),
+  cliLatest: z24.string().nullable(),
+  skillLatest: z24.string().nullable(),
+  version: z24.literal(1)
 });
 function cliVersion() {
   const pkg = createRequire(import.meta.url)("../package.json");
   return pkg.version;
 }
 function cachePath() {
-  return path18.join(homedir2(), ".artifactcafe", "update-check.json");
+  return path19.join(homedir2(), ".artifactcafe", "update-check.json");
 }
 function readCache() {
   try {
-    return cacheSchema.parse(JSON.parse(readFileSync5(cachePath(), "utf8")));
+    return cacheSchema.parse(JSON.parse(readFileSync6(cachePath(), "utf8")));
   } catch {
     return null;
   }
 }
 function writeCache(cache) {
   try {
-    mkdirSync3(path18.dirname(cachePath()), { mode: 448, recursive: true });
+    mkdirSync3(path19.dirname(cachePath()), { mode: 448, recursive: true });
     writeFileSync3(cachePath(), `${JSON.stringify(cache, null, 2)}
 `);
   } catch {
@@ -3528,7 +4035,7 @@ async function fetchText(url) {
 }
 async function fetchLatestVersions(previous) {
   const [cli, skill] = await Promise.all([
-    fetchJson(REGISTRY_LATEST_URL).then((body) => z22.object({ version: z22.string() }).parse(body).version).catch(() => null),
+    fetchJson(REGISTRY_LATEST_URL).then((body) => z24.object({ version: z24.string() }).parse(body).version).catch(() => null),
     fetchText(SKILL_SOURCE_URL).then((body) => SKILL_VERSION_PATTERN.exec(body)?.[1] ?? null).catch(() => null)
   ]);
   return {
@@ -3544,12 +4051,12 @@ function installedSkillVersions() {
   const versions = [];
   for (const root of roots) {
     for (const dir of dirs) {
-      const file = path18.join(root, dir, "skills", "artifact-cafe", "SKILL.md");
+      const file = path19.join(root, dir, "skills", "artifact-cafe", "SKILL.md");
       if (!existsSync3(file)) {
         continue;
       }
       try {
-        const found = SKILL_VERSION_PATTERN.exec(readFileSync5(file, "utf8"));
+        const found = SKILL_VERSION_PATTERN.exec(readFileSync6(file, "utf8"));
         if (found?.[1]) {
           versions.push(found[1]);
         }
@@ -3618,19 +4125,19 @@ async function workspaces(opts) {
       `Listing workspaces needs an account \u2014 run \`artifact-cafe login\` first (no API key for ${apiOrigin(apiUrl2)}).`
     );
   }
-  const data = await createApiClient(apiUrl2, key).listWorkspaces();
+  const data2 = await createApiClient(apiUrl2, key).listWorkspaces();
   if (opts.json) {
-    console.log(JSON.stringify(data, null, 2));
+    console.log(JSON.stringify(data2, null, 2));
     return;
   }
-  if (data.workspaces.length === 0) {
+  if (data2.workspaces.length === 0) {
     console.log("No workspaces yet \u2014 create one from the dashboard.");
     return;
   }
-  const plural = data.workspaces.length === 1 ? "" : "s";
-  console.log(`${data.workspaces.length} workspace${plural}
+  const plural = data2.workspaces.length === 1 ? "" : "s";
+  console.log(`${data2.workspaces.length} workspace${plural}
 `);
-  for (const workspace of data.workspaces) {
+  for (const workspace of data2.workspaces) {
     printWorkspace(workspace);
   }
 }
@@ -4599,6 +5106,110 @@ var dashboard = defineCommand({
     }
   }
 });
+var dataLsCommand = defineCommand({
+  args: {
+    collection: {
+      description: "Collection name",
+      required: true,
+      type: "positional"
+    },
+    dir: {
+      default: ".",
+      description: "Published directory",
+      type: "positional"
+    },
+    json: { description: "Machine-readable output", type: "boolean" },
+    limit: { description: "Max records to show", type: "string" }
+  },
+  meta: {
+    description: "List records in a collection",
+    name: "ls"
+  },
+  async run({ args }) {
+    try {
+      await dataLs({
+        collection: args.collection,
+        dir: args.dir,
+        json: Boolean(args.json),
+        limit: args.limit === void 0 ? void 0 : Number(args.limit)
+      });
+    } catch (err) {
+      printCliError(err, Boolean(args.json));
+      process.exit(1);
+    }
+  }
+});
+var dataExportCommand = defineCommand({
+  args: {
+    dir: {
+      default: ".",
+      description: "Published directory",
+      type: "positional"
+    },
+    // Output is always JSON; accepted so --json works uniformly across
+    // every command (SPEC-2 milestone 20 → CLI integration).
+    json: {
+      description: "Machine-readable output (always on)",
+      type: "boolean"
+    }
+  },
+  meta: {
+    description: "Export every collection's records as JSON",
+    name: "export"
+  },
+  async run({ args }) {
+    try {
+      await dataExport({ dir: args.dir });
+    } catch (err) {
+      printCliError(err, true);
+      process.exit(1);
+    }
+  }
+});
+var dataClearCommand = defineCommand({
+  args: {
+    collection: {
+      description: "Collection name",
+      required: true,
+      type: "positional"
+    },
+    dir: {
+      default: ".",
+      description: "Published directory",
+      type: "positional"
+    },
+    json: { description: "Machine-readable output", type: "boolean" },
+    yes: { description: "Confirm deleting every record", type: "boolean" }
+  },
+  meta: {
+    description: "Delete every record in a collection",
+    name: "clear"
+  },
+  async run({ args }) {
+    try {
+      await dataClear({
+        collection: args.collection,
+        dir: args.dir,
+        json: Boolean(args.json),
+        yes: Boolean(args.yes)
+      });
+    } catch (err) {
+      printCliError(err, Boolean(args.json));
+      process.exit(1);
+    }
+  }
+});
+var data = defineCommand({
+  meta: {
+    description: "Read or clear the artifact's shared records",
+    name: "data"
+  },
+  subCommands: {
+    clear: dataClearCommand,
+    export: dataExportCommand,
+    ls: dataLsCommand
+  }
+});
 var main = defineCommand({
   meta: {
     description: "Publish AI-generated artifacts for review \u2014 https://artifact.cafe",
@@ -4621,6 +5232,7 @@ var main = defineCommand({
     comment: comment2,
     comments: comments2,
     dashboard,
+    data,
     delete: del,
     edit,
     folders: folders2,