artifact-cafe 0.0.16 → 0.0.17

package/dist/index.js

@@ -7,24 +7,17 @@ import { defineCommand, runMain, showUsage } from "citty";
 var AMBER = "\x1B[38;2;214;138;57m";
 var BOLD = "\x1B[1m";
 var RESET = "\x1B[0m";
-var MUG = [
-  "        \u2596",
-  "      \u2598   \u259D",
-  "   \u256D\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u256E",
-  "   \u2502        \u251C\u2500\u256E",
-  "   \u2502        \u2502 \u2502",
-  "   \u2502        \u251C\u2500\u256F",
-  "   \u2570\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u256F",
-  "    \u203E\u203E\u203E\u203E\u203E\u203E\u203E\u203E"
-];
+var TICK_TOP = "   \u250C       \u2510";
+var GLYPH = "       \xE3";
+var TICK_BOTTOM = "   \u2514       \u2518";
 var WORDMARK = "   artifact.cafe";
 function printBanner() {
   const color = Boolean(process.stdout.isTTY) && !process.env.NO_COLOR;
   const paint = (line, codes) => color ? `${codes}${line}${RESET}` : line;
   console.log();
-  for (const line of MUG) {
-    console.log(paint(line, AMBER));
-  }
+  console.log(paint(TICK_TOP, AMBER));
+  console.log(paint(GLYPH, BOLD));
+  console.log(paint(TICK_BOTTOM, AMBER));
   console.log();
   console.log(paint(WORDMARK, AMBER + BOLD));
   console.log();
@@ -69,8 +62,10 @@ var meResponseSchema = z.object({
   userId: z.string()
 });
 var artifactListItemSchema = z.object({
+  autoDeleteAt: z.string().datetime().nullable().optional(),
   createdAt: z.string(),
   currentVersionNumber: z.number().int().positive().nullable(),
+  expiresAt: z.string().datetime().nullable().optional(),
   id: z.string(),
   openCommentCount: z.number().int().nonnegative(),
   slug: z.string(),
@@ -181,7 +176,7 @@ var workspaceAvatarResponseSchema = z3.object({
 });
 
 // ../shared/src/comments.ts
-import { z as z7 } from "zod";
+import { z as z8 } from "zod";
 
 // ../shared/src/emoji.ts
 import { z as z4 } from "zod";
@@ -193,15 +188,38 @@ function canonicalizeEmoji(s) {
 var iconEmojiSchema = z4.string().max(64).transform(canonicalizeEmoji).refine((s) => SINGLE_EMOJI.test(s), { message: "Must be a single emoji." }).nullable().describe("A single emoji shown as the icon, or null for the default.");
 
 // ../shared/src/publish.ts
-import { z as z6 } from "zod";
+import { z as z7 } from "zod";
 
-// ../shared/src/review-mode.ts
+// ../shared/src/expiration.ts
 import { z as z5 } from "zod";
-var reviewModeSchema = z5.enum(["open", "readonly", "off"]);
-var setReviewModeSchema = z5.object({
+var MAX_EXPIRATION_SECONDS = 2147483647;
+var expirationSecondsSchema = z5.number().int().positive().max(MAX_EXPIRATION_SECONDS);
+var setExpirationSchema = z5.object({
+  expiresInSeconds: expirationSecondsSchema.nullable()
+});
+var expirationResponseSchema = z5.object({
+  autoDeleteAt: z5.string().datetime().nullable(),
+  expiresAt: z5.string().datetime().nullable()
+});
+function parseArtifactDuration(value) {
+  const match = /^([1-9]\d*)([mhd])$/.exec(value);
+  const units = { d: 86400, h: 3600, m: 60 };
+  const seconds = match ? Number(match[1]) * (units[match[2]] ?? 0) : 0;
+  if (!expirationSecondsSchema.safeParse(seconds).success) {
+    throw new Error(
+      `Duration must be a positive whole number followed by m, h, or d (for example 30m, 1h, 7d), up to ${MAX_EXPIRATION_SECONDS} seconds.`
+    );
+  }
+  return seconds;
+}
+
+// ../shared/src/review-mode.ts
+import { z as z6 } from "zod";
+var reviewModeSchema = z6.enum(["open", "readonly", "off"]);
+var setReviewModeSchema = z6.object({
   mode: reviewModeSchema
 });
-var reviewModeResponseSchema = z5.object({
+var reviewModeResponseSchema = z6.object({
   mode: reviewModeSchema
 });
 
@@ -220,274 +238,300 @@ function isSafeArtifactPath(p) {
 }
 var CARD_DESCRIPTION_MAX = 300;
 var CARD_IMAGE_MAX_BYTES = 5 * 1024 * 1024;
-var manifestFileSchema = z6.object({
-  hash: z6.string().regex(/^sha256_[a-f0-9]{64}$/),
-  mimeType: z6.string().regex(/^[-\w.+]+\/[-\w.+]+$/, { message: "invalid MIME type" }),
-  path: z6.string().min(1).max(1024).refine(isSafeArtifactPath, {
+var manifestFileSchema = z7.object({
+  hash: z7.string().regex(/^sha256_[a-f0-9]{64}$/),
+  mimeType: z7.string().regex(/^[-\w.+]+\/[-\w.+]+$/, { message: "invalid MIME type" }),
+  path: z7.string().min(1).max(1024).refine(isSafeArtifactPath, {
     message: "path must be a safe relative path"
   }),
-  size: z6.number().int().positive()
+  size: z7.number().int().positive()
 });
-var publishSourceSchema = z6.object({
-  agent: z6.string().optional(),
-  runId: z6.string().optional(),
-  type: z6.literal("cli")
+var publishSourceSchema = z7.object({
+  agent: z7.string().optional(),
+  runId: z7.string().optional(),
+  type: z7.literal("cli")
 });
-var createPublishSessionSchema = z6.object({
-  artifactId: z6.string().nullable(),
+var createPublishSessionSchema = z7.object({
+  artifactId: z7.string().nullable(),
   // One-line share-card summary (`--description`). Overrides whatever the
   // entry HTML declares; leave it off and the API reads the document's own
   // `og:description`/`description` at finalize.
-  description: z6.string().max(CARD_DESCRIPTION_MAX).optional(),
-  entryPath: z6.string().optional(),
-  files: z6.array(manifestFileSchema).min(1).max(1e3),
+  description: z7.string().max(CARD_DESCRIPTION_MAX).optional(),
+  entryPath: z7.string().optional(),
+  expiresInSeconds: expirationSecondsSchema.optional(),
+  files: z7.array(manifestFileSchema).min(1).max(1e3),
   // SPEC-2 §6.4 — workspace placement is available only to authenticated
   // members; the API enforces membership and folder ownership. folderId
   // without workspaceId resolves against the account's personal workspace.
-  folderId: z6.string().min(1).optional(),
+  folderId: z7.string().min(1).optional(),
   // Bullet-point changelog for this version, authored by the publisher.
   // Optional on every publish (incl. v1); stored immutably on the version.
-  notes: z6.string().max(4e3).optional(),
+  notes: z7.string().max(4e3).optional(),
   source: publishSourceSchema,
-  title: z6.string().max(200).optional(),
-  workspaceId: z6.string().min(1).optional()
-});
-var publishSessionResponseSchema = z6.object({
-  artifactId: z6.string(),
-  expiresAt: z6.string(),
-  filesToUpload: z6.array(
-    z6.object({
-      method: z6.literal("PUT"),
-      path: z6.string(),
-      uploadUrl: z6.string().url()
+  title: z7.string().max(200).optional(),
+  workspaceId: z7.string().min(1).optional()
+});
+var publishSessionResponseSchema = z7.object({
+  artifactId: z7.string(),
+  expiresAt: z7.string(),
+  expiresInSeconds: expirationSecondsSchema.nullable().optional(),
+  filesToUpload: z7.array(
+    z7.object({
+      method: z7.literal("PUT"),
+      path: z7.string(),
+      uploadUrl: z7.string().url()
     })
   ),
-  publishSessionId: z6.string(),
-  skippedFiles: z6.array(z6.string()),
-  versionId: z6.string()
+  publishSessionId: z7.string(),
+  skippedFiles: z7.array(z7.string()),
+  versionId: z7.string()
 });
-var finalizeResponseSchema = z6.object({
-  artifactId: z6.string(),
+var finalizeResponseSchema = z7.object({
+  artifactId: z7.string(),
+  autoDeleteAt: z7.string().datetime().nullable().optional(),
   // API-key publishes create the artifact already claimed (SPEC §5.4) —
   // the CLI uses this to tell "claim URL pending" from "already yours".
-  claimed: z6.boolean(),
+  claimed: z7.boolean(),
   // Returned only on first publish of a new artifact (one-time).
-  claimUrl: z6.string().url().optional(),
-  publishToken: z6.string().optional(),
-  url: z6.string().url(),
-  versionId: z6.string(),
-  versionNumber: z6.number().int().positive(),
+  claimUrl: z7.string().url().optional(),
+  expiresAt: z7.string().datetime().nullable().optional(),
+  publishToken: z7.string().optional(),
+  url: z7.string().url(),
+  versionId: z7.string(),
+  versionNumber: z7.number().int().positive(),
   // SPEC-2 §5.2 — who can open the review URL. A publish into a folder
   // inherits that folder's visibility, so this is the only place the CLI
   // learns that a link it just printed is members-only. Optional so a new
   // CLI against an older API degrades to "unknown" instead of failing the
   // publish over a field that only shapes the closing message.
-  visibility: z6.enum(["public", "unlisted", "workspace", "private"]).optional(),
-  workspaceId: z6.string().nullable().optional()
-});
-var artifactResponseSchema = z6.object({
-  claimed: z6.boolean(),
-  currentVersion: z6.object({
-    entryUrl: z6.string().url(),
-    id: z6.string(),
-    versionNumber: z6.number().int().positive()
+  visibility: z7.enum(["public", "unlisted", "workspace", "private"]).optional(),
+  workspaceId: z7.string().nullable().optional()
+});
+var artifactResponseSchema = z7.object({
+  autoDeleteAt: z7.string().datetime().nullable().optional(),
+  claimed: z7.boolean(),
+  currentVersion: z7.object({
+    entryUrl: z7.string().url(),
+    id: z7.string(),
+    versionNumber: z7.number().int().positive()
   }).nullable(),
   // Custom icon, or null to render the default document glyph.
-  emoji: z6.string().nullable(),
+  emoji: z7.string().nullable(),
+  expiresAt: z7.string().datetime().nullable().optional(),
   // SPEC-2 §6.4 — placement + visibility surface on the artifact.
-  folderId: z6.string().nullable(),
-  id: z6.string(),
+  folderId: z7.string().nullable(),
+  id: z7.string(),
   // SPEC-2 §5.8 — what a viewer may do once in (open / readonly / off).
   reviewMode: reviewModeSchema,
-  slug: z6.string(),
-  title: z6.string(),
-  visibility: z6.enum(["public", "unlisted", "workspace", "private"]),
-  workspaceId: z6.string().nullable()
+  slug: z7.string(),
+  title: z7.string(),
+  visibility: z7.enum(["public", "unlisted", "workspace", "private"]),
+  workspaceId: z7.string().nullable()
 });
+function resolvePublishEntry(files, explicit) {
+  if (explicit !== void 0) {
+    if (!files.some((file) => file.path === explicit)) {
+      throw new Error(`Entry file "${explicit}" is not in the manifest.`);
+    }
+    return explicit;
+  }
+  const htmlFiles = files.filter(
+    (file) => file.mimeType === "text/html" && !file.path.includes("/")
+  );
+  if (htmlFiles.some((file) => file.path === "index.html")) {
+    return "index.html";
+  }
+  if (htmlFiles.length > 1) {
+    throw new Error(
+      `Multiple HTML files found (${htmlFiles.map((file) => file.path).join(", ")}). Specify an entry file.`
+    );
+  }
+  return htmlFiles[0]?.path;
+}
 
 // ../shared/src/comments.ts
-var anchorPageSchema = z7.string().max(1024).refine(isSafeArtifactPath, {
+var anchorPageSchema = z8.string().max(1024).refine(isSafeArtifactPath, {
   message: "page must be a safe relative path"
 }).optional();
-var elementSnapshotSchema = z7.object({
-  classes: z7.string().max(256).optional(),
-  id: z7.string().max(256).optional(),
-  tag: z7.string().min(1).max(128),
-  text: z7.string().max(200).optional()
+var elementSnapshotSchema = z8.object({
+  classes: z8.string().max(256).optional(),
+  id: z8.string().max(256).optional(),
+  tag: z8.string().min(1).max(128),
+  text: z8.string().max(200).optional()
 });
-var pointAnchorSchema = z7.object({
+var pointAnchorSchema = z8.object({
   element: elementSnapshotSchema.optional(),
   // elementPath is the primary anchor; x/y are offsets within the
   // element's box, normalized 0..1 (SPEC.md §8.1).
-  elementPath: z7.string().max(2048),
+  elementPath: z8.string().max(2048),
   page: anchorPageSchema,
-  type: z7.literal("point"),
-  viewportHeight: z7.number().int().positive().max(1e5),
-  viewportWidth: z7.number().int().positive().max(1e5),
-  x: z7.number().min(0).max(1),
-  y: z7.number().min(0).max(1)
-});
-var textAnchorSchema = z7.object({
-  elementPath: z7.string().max(2048),
-  endOffset: z7.number().int().nonnegative().max(1e8),
+  type: z8.literal("point"),
+  viewportHeight: z8.number().int().positive().max(1e5),
+  viewportWidth: z8.number().int().positive().max(1e5),
+  x: z8.number().min(0).max(1),
+  y: z8.number().min(0).max(1)
+});
+var textAnchorSchema = z8.object({
+  elementPath: z8.string().max(2048),
+  endOffset: z8.number().int().nonnegative().max(1e8),
   page: anchorPageSchema,
-  prefix: z7.string().max(200).optional(),
-  quote: z7.string().min(1).max(1e3),
-  startOffset: z7.number().int().nonnegative().max(1e8),
-  suffix: z7.string().max(200).optional(),
-  type: z7.literal("text")
+  prefix: z8.string().max(200).optional(),
+  quote: z8.string().min(1).max(1e3),
+  startOffset: z8.number().int().nonnegative().max(1e8),
+  suffix: z8.string().max(200).optional(),
+  type: z8.literal("text")
 });
-var pageAnchorSchema = z7.object({
+var pageAnchorSchema = z8.object({
   page: anchorPageSchema,
-  type: z7.literal("page")
+  type: z8.literal("page")
 });
-var anchorSchema = z7.discriminatedUnion("type", [
+var anchorSchema = z8.discriminatedUnion("type", [
   pointAnchorSchema,
   textAnchorSchema,
   pageAnchorSchema
 ]);
-var displayNameSchema = z7.string().trim().min(1).max(64);
-var guestSchema = z7.object({
+var displayNameSchema = z8.string().trim().min(1).max(64);
+var guestSchema = z8.object({
   displayName: displayNameSchema,
-  guestId: z7.string().min(16)
+  guestId: z8.string().min(16)
 });
-var viaLabelSchema = z7.string().trim().min(1).max(64);
-var createCommentThreadSchema = z7.object({
+var viaLabelSchema = z8.string().trim().min(1).max(64);
+var createCommentThreadSchema = z8.object({
   anchor: anchorSchema,
-  body: z7.string().min(1).max(1e4),
+  body: z8.string().min(1).max(1e4),
   guest: guestSchema.optional(),
-  versionId: z7.string(),
+  versionId: z8.string(),
   via: viaLabelSchema.optional()
 });
-var createCommentMessageSchema = z7.object({
-  body: z7.string().min(1).max(1e4),
+var createCommentMessageSchema = z8.object({
+  body: z8.string().min(1).max(1e4),
   guest: guestSchema.optional(),
   via: viaLabelSchema.optional()
 });
-var editCommentMessageSchema = z7.object({
-  body: z7.string().min(1).max(1e4),
+var editCommentMessageSchema = z8.object({
+  body: z8.string().min(1).max(1e4),
   guest: guestSchema.optional()
 });
-var threadActionSchema = z7.object({
+var threadActionSchema = z8.object({
   guest: guestSchema.optional()
 });
-var reactionEmojiSchema = z7.string().max(64).transform(canonicalizeEmoji).refine((s) => SINGLE_EMOJI.test(s), { message: "Must be a single emoji." }).describe("A single emoji, e.g. \u{1F44D}");
-var toggleReactionSchema = z7.object({
+var reactionEmojiSchema = z8.string().max(64).transform(canonicalizeEmoji).refine((s) => SINGLE_EMOJI.test(s), { message: "Must be a single emoji." }).describe("A single emoji, e.g. \u{1F44D}");
+var toggleReactionSchema = z8.object({
   emoji: reactionEmojiSchema,
   guest: guestSchema.optional()
 });
-var commentAgentSchema = z7.object({
-  id: z7.string().nullable(),
-  label: z7.string()
+var commentAgentSchema = z8.object({
+  id: z8.string().nullable(),
+  label: z8.string()
 });
-var commentAuthorSchema = z7.object({
+var commentAuthorSchema = z8.object({
   agent: commentAgentSchema.nullable().default(null),
-  avatarUrl: z7.string().nullable(),
-  displayName: z7.string(),
-  guestId: z7.string().nullable(),
-  isViewer: z7.boolean(),
-  kind: z7.enum(["member", "guest"]),
+  avatarUrl: z8.string().nullable(),
+  displayName: z8.string(),
+  guestId: z8.string().nullable(),
+  isViewer: z8.boolean(),
+  kind: z8.enum(["member", "guest"]),
   // Optional "via" attribution (§6.4). Null for plain comments; a bounded
   // label the shell appends after the display name. Defaulted for the same
   // reason as `agent`: a server predating §6.4 omits the key entirely.
-  via: z7.string().nullable().default(null)
+  via: z8.string().nullable().default(null)
 });
-var messageReactionSchema = z7.object({
-  emoji: z7.string(),
-  reactors: z7.array(commentAuthorSchema)
+var messageReactionSchema = z8.object({
+  emoji: z8.string(),
+  reactors: z8.array(commentAuthorSchema)
 });
-var commentMessageSchema = z7.object({
+var commentMessageSchema = z8.object({
   author: commentAuthorSchema,
   // Empty string for a deleted message — the body is stripped server-side
   // (§6.7.1 tombstone), never sent to the client and hidden there.
-  body: z7.string(),
-  createdAt: z7.string(),
+  body: z8.string(),
+  createdAt: z8.string(),
   // Soft-deleted (§6.7.1). A tombstone keeps thread structure and replies;
   // the shell renders "Comment deleted" instead of the (absent) body.
-  deleted: z7.boolean(),
+  deleted: z8.boolean(),
   // Last edit time (§6.7.1), or null if never edited — drives the "edited"
   // badge. No edit history is kept.
-  editedAt: z7.string().nullable(),
-  id: z7.string(),
+  editedAt: z8.string().nullable(),
+  id: z8.string(),
   // Defaulted, not required: a new CLI parsing an older server's
   // response must not fail on the missing key.
-  reactions: z7.array(messageReactionSchema).default([])
+  reactions: z8.array(messageReactionSchema).default([])
 });
-var threadActorSchema = z7.object({
-  displayName: z7.string(),
-  kind: z7.enum(["member", "guest", "agent"])
+var threadActorSchema = z8.object({
+  displayName: z8.string(),
+  kind: z8.enum(["member", "guest", "agent"])
 });
-var commentThreadSchema = z7.object({
+var commentThreadSchema = z8.object({
   // §6.6.1 — set while open to signal "seen, working on it"; cleared on
   // reopen, kept (but superseded in display) once resolved. Defaulted so
   // clients parsing an older server's response don't fail.
-  acknowledgedAt: z7.string().nullable().default(null),
+  acknowledgedAt: z8.string().nullable().default(null),
   acknowledgedBy: threadActorSchema.nullable().default(null),
   anchor: anchorSchema,
-  artifactId: z7.string(),
-  createdAt: z7.string(),
+  artifactId: z8.string(),
+  createdAt: z8.string(),
   createdBy: commentAuthorSchema,
-  id: z7.string(),
-  messages: z7.array(commentMessageSchema),
+  id: z8.string(),
+  messages: z8.array(commentMessageSchema),
   // Null on threads resolved before actor recording existed, and always
   // null while open.
   resolvedBy: threadActorSchema.nullable().default(null),
-  status: z7.enum(["open", "resolved"]),
-  versionId: z7.string()
+  status: z8.enum(["open", "resolved"]),
+  versionId: z8.string()
 });
-var commentThreadListSchema = z7.object({
-  threads: z7.array(commentThreadSchema)
+var commentThreadListSchema = z8.object({
+  threads: z8.array(commentThreadSchema)
 });
-var commentExportQuerySchema = z7.object({
-  status: z7.enum(["open", "resolved", "all"]).default("open"),
-  version: z7.enum(["current", "all"]).default("current")
+var commentExportQuerySchema = z8.object({
+  status: z8.enum(["open", "resolved", "all"]).default("open"),
+  version: z8.enum(["current", "all"]).default("current")
 });
-var exportReactionSchema = z7.object({
-  count: z7.number().int().positive(),
-  emoji: z7.string()
+var exportReactionSchema = z8.object({
+  count: z8.number().int().positive(),
+  emoji: z8.string()
 });
-var commentExportReplySchema = z7.object({
-  author: z7.string(),
-  authorKind: z7.enum(["member", "guest"]),
-  body: z7.string(),
-  createdAt: z7.string(),
+var commentExportReplySchema = z8.object({
+  author: z8.string(),
+  authorKind: z8.enum(["member", "guest"]),
+  body: z8.string(),
+  createdAt: z8.string(),
   // Soft-delete tombstone (§6.7.1): body is "" when true.
-  deleted: z7.boolean(),
-  editedAt: z7.string().nullable(),
+  deleted: z8.boolean(),
+  editedAt: z8.string().nullable(),
   // The message id — what `edit`/`delete` target (§5.1).
-  id: z7.string(),
-  reactions: z7.array(exportReactionSchema).optional()
+  id: z8.string(),
+  reactions: z8.array(exportReactionSchema).optional()
 });
-var commentExportThreadSchema = z7.object({
+var commentExportThreadSchema = z8.object({
   // §6.6.1 — lets a polling agent skip threads it already acknowledged
   // (acknowledged threads stay in status=open exports on purpose).
-  acknowledgedAt: z7.string().nullable().default(null),
+  acknowledgedAt: z8.string().nullable().default(null),
   anchor: anchorSchema,
-  author: z7.string(),
-  authorKind: z7.enum(["member", "guest"]),
-  body: z7.string(),
-  createdAt: z7.string(),
-  deleted: z7.boolean(),
-  editedAt: z7.string().nullable(),
-  id: z7.string(),
+  author: z8.string(),
+  authorKind: z8.enum(["member", "guest"]),
+  body: z8.string(),
+  createdAt: z8.string(),
+  deleted: z8.boolean(),
+  editedAt: z8.string().nullable(),
+  id: z8.string(),
   // The opening message's id (distinct from the thread `id`) — `edit`/
   // `delete` operate on messages, so the CLI needs it to target the first
   // comment, not just the replies.
-  messageId: z7.string(),
-  reactions: z7.array(exportReactionSchema).optional(),
-  replies: z7.array(commentExportReplySchema),
+  messageId: z8.string(),
+  reactions: z8.array(exportReactionSchema).optional(),
+  replies: z8.array(commentExportReplySchema),
   resolvedBy: threadActorSchema.nullable().default(null),
-  status: z7.enum(["open", "resolved"]),
-  versionNumber: z7.number().int().positive()
+  status: z8.enum(["open", "resolved"]),
+  versionNumber: z8.number().int().positive()
 });
-var commentExportSchema = z7.object({
-  artifactId: z7.string(),
-  comments: z7.array(commentExportThreadSchema),
+var commentExportSchema = z8.object({
+  artifactId: z8.string(),
+  comments: z8.array(commentExportThreadSchema),
   // The artifact's current version (null before the first finalize).
-  versionNumber: z7.number().int().positive().nullable()
+  versionNumber: z8.number().int().positive().nullable()
 });
-var commentReadResponseSchema = z7.object({
-  lastSeenAt: z7.string()
+var commentReadResponseSchema = z8.object({
+  lastSeenAt: z8.string()
 });
 function elementLabel(el) {
   if (el.id) {
@@ -516,6 +560,8 @@ var DATA_LIMITS = {
   defaultWriteRate: "10/minute/ip",
   maxCollections: 10,
   maxFieldsPerCollection: 50,
+  /** Owner-plane batch insert: records per request. */
+  maxInsertBatch: 100,
   maxListLimit: 200,
   maxManifestBytes: 64 * 1024,
   maxRecordBytes: 16 * 1024,
@@ -663,46 +709,50 @@ function validateRecordInput(collection, input, opts = {}) {
 }
 
 // ../shared/src/data-api.ts
-import { z as z8 } from "zod";
-var dataRecordSchema = z8.object({
-  created_at: z8.string(),
-  created_by: z8.string().nullable(),
-  id: z8.string(),
-  updated_at: z8.string()
-}).catchall(z8.unknown());
-var dataPublicRecordSchema = z8.object({
-  created_at: z8.string(),
-  created_by: z8.never().optional(),
-  id: z8.string(),
-  mine: z8.boolean(),
-  updated_at: z8.string()
-}).catchall(z8.unknown());
-var dataPublicListResponseSchema = z8.object({
-  nextCursor: z8.string().nullable(),
-  records: z8.array(dataPublicRecordSchema)
-});
-var dataListResponseSchema = z8.object({
-  nextCursor: z8.string().nullable(),
-  records: z8.array(dataRecordSchema)
-});
-var dataCollectionSummarySchema = z8.object({
-  access: z8.record(z8.string(), z8.string()).optional(),
-  count: z8.number().int().nonnegative().optional(),
-  name: z8.string(),
-  rateLimit: z8.string().optional()
-});
-var dataSummaryResponseSchema = z8.object({
-  collections: z8.array(dataCollectionSummarySchema),
-  enabled: z8.boolean()
-});
-var dataClearResponseSchema = z8.object({
-  cleared: z8.number().int().nonnegative()
+import { z as z9 } from "zod";
+var dataRecordSchema = z9.object({
+  created_at: z9.string(),
+  created_by: z9.string().nullable(),
+  id: z9.string(),
+  updated_at: z9.string()
+}).catchall(z9.unknown());
+var dataPublicRecordSchema = z9.object({
+  created_at: z9.string(),
+  created_by: z9.never().optional(),
+  id: z9.string(),
+  mine: z9.boolean(),
+  updated_at: z9.string()
+}).catchall(z9.unknown());
+var dataPublicListResponseSchema = z9.object({
+  nextCursor: z9.string().nullable(),
+  records: z9.array(dataPublicRecordSchema)
+});
+var dataListResponseSchema = z9.object({
+  nextCursor: z9.string().nullable(),
+  records: z9.array(dataRecordSchema)
+});
+var dataRecordResponseSchema = z9.object({ record: dataRecordSchema });
+var dataBatchInsertResponseSchema = z9.object({
+  records: z9.array(dataRecordSchema)
+});
+var dataCollectionSummarySchema = z9.object({
+  access: z9.record(z9.string(), z9.string()).optional(),
+  count: z9.number().int().nonnegative().optional(),
+  name: z9.string(),
+  rateLimit: z9.string().optional()
+});
+var dataSummaryResponseSchema = z9.object({
+  collections: z9.array(dataCollectionSummarySchema),
+  enabled: z9.boolean()
+});
+var dataClearResponseSchema = z9.object({
+  cleared: z9.number().int().nonnegative()
 });
 
 // ../shared/src/data-manifest.ts
-import { z as z9 } from "zod";
-var nameSchema = z9.string().max(DATA_NAME_MAX).regex(DATA_NAME_RE, "must match ^[a-z][a-z0-9_]*$");
-var fieldTypeSchema = z9.enum([
+import { z as z10 } from "zod";
+var nameSchema = z10.string().max(DATA_NAME_MAX).regex(DATA_NAME_RE, "must match ^[a-z][a-z0-9_]*$");
+var fieldTypeSchema = z10.enum([
   "string",
   "number",
   "integer",
@@ -713,13 +763,13 @@ var fieldTypeSchema = z9.enum([
   "array",
   "object"
 ]);
-var fieldSchema = z9.strictObject({
-  default: z9.unknown().optional(),
-  maximum: z9.number().optional(),
-  maxLength: z9.number().int().positive().optional(),
-  minimum: z9.number().optional(),
-  required: z9.boolean().optional(),
-  trim: z9.boolean().optional(),
+var fieldSchema = z10.strictObject({
+  default: z10.unknown().optional(),
+  maximum: z10.number().optional(),
+  maxLength: z10.number().int().positive().optional(),
+  minimum: z10.number().optional(),
+  required: z10.boolean().optional(),
+  trim: z10.boolean().optional(),
   type: fieldTypeSchema
 }).superRefine((field, ctx) => {
   if (field.default === void 0) {
@@ -745,18 +795,18 @@ function defaultMatchesType(field) {
     { value: field.default }
   ).ok;
 }
-var accessLevelSchema = z9.enum(["public", "creator", "owner", "none"]);
-var accessSchema = z9.strictObject({
+var accessLevelSchema = z10.enum(["public", "creator", "owner", "none"]);
+var accessSchema = z10.strictObject({
   delete: accessLevelSchema.default("owner"),
   insert: accessLevelSchema.default("owner"),
   read: accessLevelSchema.default("public"),
   update: accessLevelSchema.default("owner")
 }).prefault({});
-var collectionSchema = z9.strictObject({
+var collectionSchema = z10.strictObject({
   access: accessSchema,
-  fields: z9.record(nameSchema, fieldSchema),
-  publicMutation: z9.literal("open").optional(),
-  rateLimit: z9.string().regex(DATA_RATE_LIMIT_RE, 'expected "N/hour/ip" or "N/minute/ip"').optional()
+  fields: z10.record(nameSchema, fieldSchema),
+  publicMutation: z10.literal("open").optional(),
+  rateLimit: z10.string().regex(DATA_RATE_LIMIT_RE, 'expected "N/hour/ip" or "N/minute/ip"').optional()
 }).superRefine((collection, ctx) => {
   const fieldNames = Object.keys(collection.fields);
   if (fieldNames.length > DATA_LIMITS.maxFieldsPerCollection) {
@@ -785,8 +835,8 @@ var collectionSchema = z9.strictObject({
     }
   }
 });
-var dataManifestSchema = z9.strictObject({
-  collections: z9.record(nameSchema, collectionSchema)
+var dataManifestSchema = z10.strictObject({
+  collections: z10.record(nameSchema, collectionSchema)
 }).superRefine((manifest, ctx) => {
   if (Object.keys(manifest.collections).length > DATA_LIMITS.maxCollections) {
     ctx.addIssue({
@@ -825,245 +875,245 @@ function parseDataManifest(text) {
 }
 
 // ../shared/src/errors.ts
-import { z as z10 } from "zod";
-var apiErrorSchema = z10.object({
-  code: z10.string(),
-  docsUrl: z10.string().url(),
-  message: z10.string(),
-  retryAfter: z10.number().int().positive().optional(),
-  scope: z10.enum(["ip", "artifact"]).optional()
+import { z as z11 } from "zod";
+var apiErrorSchema = z11.object({
+  code: z11.string(),
+  docsUrl: z11.string().url(),
+  message: z11.string(),
+  retryAfter: z11.number().int().positive().optional(),
+  scope: z11.enum(["ip", "artifact"]).optional()
 });
 
 // ../shared/src/feedback.ts
-import { z as z11 } from "zod";
-var feedbackRequestSchema = z11.object({
-  email: z11.string().trim().toLowerCase().email().optional().or(z11.literal("")),
-  message: z11.string().trim().min(1).max(4e3)
+import { z as z12 } from "zod";
+var feedbackRequestSchema = z12.object({
+  email: z12.string().trim().toLowerCase().email().optional().or(z12.literal("")),
+  message: z12.string().trim().min(1).max(4e3)
 });
-var feedbackResponseSchema = z11.object({
-  sent: z11.literal(true)
+var feedbackResponseSchema = z12.object({
+  sent: z12.literal(true)
 });
 
 // ../shared/src/grants.ts
-import { z as z12 } from "zod";
-var grantRoleSchema = z12.enum(["viewer"]);
-var createGrantSchema = z12.object({
-  email: z12.string().trim().toLowerCase().email().optional(),
+import { z as z13 } from "zod";
+var grantRoleSchema = z13.enum(["viewer"]);
+var createGrantSchema = z13.object({
+  email: z13.string().trim().toLowerCase().email().optional(),
   role: grantRoleSchema.default("viewer"),
-  userId: z12.string().min(1).optional()
+  userId: z13.string().min(1).optional()
 }).refine((body) => Boolean(body.email) !== Boolean(body.userId), {
   message: "provide exactly one of email or userId"
 });
-var grantSchema = z12.object({
-  createdAt: z12.string(),
-  email: z12.string().email().nullable(),
-  expiresAt: z12.string().nullable(),
-  id: z12.string(),
+var grantSchema = z13.object({
+  createdAt: z13.string(),
+  email: z13.string().email().nullable(),
+  expiresAt: z13.string().nullable(),
+  id: z13.string(),
   // The subject's avatar once they have an account; null otherwise.
-  image: z12.string().nullable(),
+  image: z13.string().nullable(),
   // Present on the invited account after redemption / when granting an
   // existing user; null for a still-pending email invite.
-  name: z12.string().nullable(),
-  redeemedAt: z12.string().nullable(),
+  name: z13.string().nullable(),
+  redeemedAt: z13.string().nullable(),
   role: grantRoleSchema,
   // Shown as "· pending" beside the role until the link is redeemed.
-  status: z12.enum(["pending", "active"]),
+  status: z13.enum(["pending", "active"]),
   // Display fragment of the live invitation token, or null once redeemed.
-  tokenPrefix: z12.string().nullable(),
-  userId: z12.string().nullable()
+  tokenPrefix: z13.string().nullable(),
+  userId: z13.string().nullable()
 });
 var createdGrantSchema = grantSchema.extend({
-  url: z12.string().url()
+  url: z13.string().url()
 });
-var grantListResponseSchema = z12.object({
-  grants: z12.array(grantSchema),
+var grantListResponseSchema = z13.object({
+  grants: z13.array(grantSchema),
   // The artifact's current general-access value, so the share surface can
   // render the "General access" line without a second read.
-  visibility: z12.enum(["public", "unlisted", "workspace", "private"]),
+  visibility: z13.enum(["public", "unlisted", "workspace", "private"]),
   // The owning workspace's logo, so the share modal can draw the workspace
   // itself rather than a generic glyph. Null when none was uploaded.
-  workspaceLogo: z12.string().nullable().optional(),
+  workspaceLogo: z13.string().nullable().optional(),
   // The owning workspace's display name, so "People with access" can name the
   // audience `workspace` visibility actually admits ("All Acme members") rather
   // than leaving an empty list to imply nobody. Null for a workspace-less
   // artifact; optional so an older server still parses.
-  workspaceName: z12.string().nullable().optional()
+  workspaceName: z13.string().nullable().optional()
 });
-var revokeGrantResponseSchema = z12.object({
-  revoked: z12.literal(true)
+var revokeGrantResponseSchema = z13.object({
+  revoked: z13.literal(true)
 });
-var acceptGrantSchema = z12.object({
-  token: z12.string().min(1)
+var acceptGrantSchema = z13.object({
+  token: z13.string().min(1)
 });
-var acceptGrantResponseSchema = z12.object({
-  artifactId: z12.string(),
+var acceptGrantResponseSchema = z13.object({
+  artifactId: z13.string(),
   // The review shell URL to land on, carrying ?invited=1 for the banner.
-  artifactUrl: z12.string().url(),
-  slug: z12.string(),
-  title: z12.string()
-});
-var workspaceGuestSchema = z12.object({
-  artifacts: z12.array(
-    z12.object({
-      artifactId: z12.string(),
-      grantId: z12.string(),
-      slug: z12.string(),
-      status: z12.enum(["pending", "active"]),
-      title: z12.string()
+  artifactUrl: z13.string().url(),
+  slug: z13.string(),
+  title: z13.string()
+});
+var workspaceGuestSchema = z13.object({
+  artifacts: z13.array(
+    z13.object({
+      artifactId: z13.string(),
+      grantId: z13.string(),
+      slug: z13.string(),
+      status: z13.enum(["pending", "active"]),
+      title: z13.string()
     })
   ),
-  email: z12.string().nullable(),
-  image: z12.string().nullable(),
-  name: z12.string().nullable(),
-  userId: z12.string().nullable()
-});
-var workspaceGuestListResponseSchema = z12.object({
-  guests: z12.array(workspaceGuestSchema)
-});
-var sharedWithMeArtifactSchema = z12.object({
-  artifactId: z12.string(),
-  slug: z12.string(),
-  title: z12.string(),
-  url: z12.string().url(),
+  email: z13.string().nullable(),
+  image: z13.string().nullable(),
+  name: z13.string().nullable(),
+  userId: z13.string().nullable()
+});
+var workspaceGuestListResponseSchema = z13.object({
+  guests: z13.array(workspaceGuestSchema)
+});
+var sharedWithMeArtifactSchema = z13.object({
+  artifactId: z13.string(),
+  slug: z13.string(),
+  title: z13.string(),
+  url: z13.string().url(),
   // Who shared it, for the "Shared with me" list.
-  workspaceName: z12.string()
+  workspaceName: z13.string()
 });
-var sharedWithMeListResponseSchema = z12.object({
-  artifacts: z12.array(sharedWithMeArtifactSchema)
+var sharedWithMeListResponseSchema = z13.object({
+  artifacts: z13.array(sharedWithMeArtifactSchema)
 });
 
 // ../shared/src/html-meta.ts
 var HEAD_SCAN_CHARS = 64 * 1024;
 
 // ../shared/src/me.ts
-import { z as z14 } from "zod";
+import { z as z15 } from "zod";
 
 // ../shared/src/workspaces.ts
-import { z as z13 } from "zod";
+import { z as z14 } from "zod";
 var WORKSPACE_HANDLE_PATTERN = /^[a-z0-9](?:[a-z0-9-]{1,30}[a-z0-9])$/;
-var workspaceHandleUnavailableReasonSchema = z13.enum([
+var workspaceHandleUnavailableReasonSchema = z14.enum([
   "held",
   "invalid",
   "reserved",
   "taken"
 ]);
-var workspaceHandleAvailabilitySchema = z13.object({
-  available: z13.boolean(),
-  handle: z13.string(),
+var workspaceHandleAvailabilitySchema = z14.object({
+  available: z14.boolean(),
+  handle: z14.string(),
   // Human-readable sentence for the field hint; null when available.
-  message: z13.string().nullable(),
+  message: z14.string().nullable(),
   reason: workspaceHandleUnavailableReasonSchema.nullable()
 });
-var workspaceRoleSchema = z13.enum(["owner", "admin", "member"]);
-var workspaceInviteRoleSchema = z13.enum(["admin", "member"]);
-var workspaceHandleSchema = z13.string().min(3).max(32).regex(WORKSPACE_HANDLE_PATTERN, {
+var workspaceRoleSchema = z14.enum(["owner", "admin", "member"]);
+var workspaceInviteRoleSchema = z14.enum(["admin", "member"]);
+var workspaceHandleSchema = z14.string().min(3).max(32).regex(WORKSPACE_HANDLE_PATTERN, {
   message: "handle must be lowercase letters, digits, and hyphens, with no leading/trailing hyphen"
 });
-var createWorkspaceSchema = z13.object({
+var createWorkspaceSchema = z14.object({
   handle: workspaceHandleSchema.optional(),
-  name: z13.string().trim().min(1).max(100)
+  name: z14.string().trim().min(1).max(100)
 });
-var updateWorkspaceSchema = z13.object({
+var updateWorkspaceSchema = z14.object({
   handle: workspaceHandleSchema.optional(),
-  name: z13.string().trim().min(1).max(100).optional()
+  name: z14.string().trim().min(1).max(100).optional()
 }).refine((body) => body.handle !== void 0 || body.name !== void 0, {
   message: "provide at least one of name or handle"
 });
-var workspaceSchema = z13.object({
-  createdAt: z13.string(),
-  handle: z13.string(),
+var workspaceSchema = z14.object({
+  createdAt: z14.string(),
+  handle: z14.string(),
   // ISO timestamp when `{handle}.artifact.cafe` was provisioned, or null.
   // Set by the one-time, self-serve enable flow (§4.4); never auto at
   // create, and always null for personal workspaces.
-  hostnameProvisionedAt: z13.string().nullable(),
-  id: z13.string(),
+  hostnameProvisionedAt: z14.string().nullable(),
+  id: z14.string(),
   // Auto-provisioned solo workspace, one per user: non-deletable, takes
   // no members, renameable like any workspace.
-  isPersonal: z13.boolean(),
+  isPersonal: z14.boolean(),
   // Uploaded logo URL, or null for the initials fallback. Set through the
   // dedicated /workspaces/:id/avatar route, never the generic update.
-  logo: z13.string().nullable(),
-  name: z13.string(),
+  logo: z14.string().nullable(),
+  name: z14.string(),
   role: workspaceRoleSchema.nullable(),
-  updatedAt: z13.string()
+  updatedAt: z14.string()
 });
-var workspaceListResponseSchema = z13.object({
-  workspaces: z13.array(workspaceSchema)
+var workspaceListResponseSchema = z14.object({
+  workspaces: z14.array(workspaceSchema)
 });
-var deleteWorkspaceResponseSchema = z13.object({
-  deleted: z13.literal(true)
+var deleteWorkspaceResponseSchema = z14.object({
+  deleted: z14.literal(true)
 });
-var workspaceMemberSchema = z13.object({
-  createdAt: z13.string(),
-  email: z13.string().email(),
-  image: z13.string().nullable(),
-  name: z13.string(),
+var workspaceMemberSchema = z14.object({
+  createdAt: z14.string(),
+  email: z14.string().email(),
+  image: z14.string().nullable(),
+  name: z14.string(),
   role: workspaceRoleSchema,
-  userId: z13.string()
+  userId: z14.string()
 });
-var workspaceMemberListResponseSchema = z13.object({
-  members: z13.array(workspaceMemberSchema)
+var workspaceMemberListResponseSchema = z14.object({
+  members: z14.array(workspaceMemberSchema)
 });
-var updateWorkspaceMemberSchema = z13.object({
+var updateWorkspaceMemberSchema = z14.object({
   role: workspaceRoleSchema
 });
-var removeWorkspaceMemberResponseSchema = z13.object({
-  removed: z13.literal(true)
+var removeWorkspaceMemberResponseSchema = z14.object({
+  removed: z14.literal(true)
 });
-var createWorkspaceInviteSchema = z13.object({
-  email: z13.string().trim().toLowerCase().email().optional(),
-  expiresAt: z13.string().datetime(),
-  maxUses: z13.number().int().positive().optional(),
+var createWorkspaceInviteSchema = z14.object({
+  email: z14.string().trim().toLowerCase().email().optional(),
+  expiresAt: z14.string().datetime(),
+  maxUses: z14.number().int().positive().optional(),
   role: workspaceInviteRoleSchema
 });
-var workspaceInviteSchema = z13.object({
-  createdAt: z13.string(),
-  email: z13.string().email().nullable(),
-  expiresAt: z13.string(),
-  id: z13.string(),
-  maxUses: z13.number().int().positive().nullable(),
+var workspaceInviteSchema = z14.object({
+  createdAt: z14.string(),
+  email: z14.string().email().nullable(),
+  expiresAt: z14.string(),
+  id: z14.string(),
+  maxUses: z14.number().int().positive().nullable(),
   role: workspaceInviteRoleSchema,
-  tokenPrefix: z13.string(),
-  useCount: z13.number().int().nonnegative()
+  tokenPrefix: z14.string(),
+  useCount: z14.number().int().nonnegative()
 });
 var createdWorkspaceInviteSchema = workspaceInviteSchema.extend({
-  url: z13.string().url()
+  url: z14.string().url()
 });
-var workspaceInviteListResponseSchema = z13.object({
-  invites: z13.array(workspaceInviteSchema)
+var workspaceInviteListResponseSchema = z14.object({
+  invites: z14.array(workspaceInviteSchema)
 });
-var revokeWorkspaceInviteResponseSchema = z13.object({
-  revoked: z13.literal(true)
+var revokeWorkspaceInviteResponseSchema = z14.object({
+  revoked: z14.literal(true)
 });
-var acceptWorkspaceInviteSchema = z13.object({
-  token: z13.string().min(1)
+var acceptWorkspaceInviteSchema = z14.object({
+  token: z14.string().min(1)
 });
-var acceptWorkspaceInviteResponseSchema = z13.object({
+var acceptWorkspaceInviteResponseSchema = z14.object({
   role: workspaceRoleSchema,
   workspace: workspaceSchema
 });
-var folderVisibilitySchema = z13.enum(["public", "workspace"]);
-var artifactVisibilitySchema = z13.enum([
+var folderVisibilitySchema = z14.enum(["public", "workspace"]);
+var artifactVisibilitySchema = z14.enum([
   "public",
   "unlisted",
   "workspace",
   "private"
 ]);
-var createFolderSchema = z13.object({
+var createFolderSchema = z14.object({
   // Optional custom icon; omitted (or null) leaves the default glyph.
   emoji: iconEmojiSchema.optional(),
-  name: z13.string().trim().min(1).max(100),
+  name: z14.string().trim().min(1).max(100),
   visibility: folderVisibilitySchema
 });
-var updateFolderSchema = z13.object({
+var updateFolderSchema = z14.object({
   // With `visibility`: bulk-update the folder's artifacts to match
   // (SPEC-2 §3.4 "Changing a folder's visibility offers a bulk update").
-  cascade: z13.boolean().optional(),
+  cascade: z14.boolean().optional(),
   // Explicit null clears the icon back to the default glyph, so this is
   // a field where "sent as null" and "omitted" mean different things.
   emoji: iconEmojiSchema.optional(),
-  name: z13.string().trim().min(1).max(100).optional(),
-  sortOrder: z13.number().int().min(0).optional(),
+  name: z14.string().trim().min(1).max(100).optional(),
+  sortOrder: z14.number().int().min(0).optional(),
   visibility: folderVisibilitySchema.optional()
 }).refine(
   (body) => body.name !== void 0 || body.visibility !== void 0 || body.sortOrder !== void 0 || body.emoji !== void 0,
@@ -1071,93 +1121,95 @@ var updateFolderSchema = z13.object({
 ).refine((body) => !body.cascade || body.visibility !== void 0, {
   message: "cascade requires visibility"
 });
-var folderSchema = z13.object({
-  createdAt: z13.string(),
+var folderSchema = z14.object({
+  createdAt: z14.string(),
   // Custom icon, or null to render the default folder glyph.
-  emoji: z13.string().nullable(),
-  id: z13.string(),
-  name: z13.string(),
+  emoji: z14.string().nullable(),
+  id: z14.string(),
+  name: z14.string(),
   // Permalink segment for the public folder page (/w/{handle}/f/{slug}).
   // Server-derived from the name; renames regenerate it.
-  slug: z13.string(),
-  sortOrder: z13.number().int(),
-  updatedAt: z13.string(),
+  slug: z14.string(),
+  sortOrder: z14.number().int(),
+  updatedAt: z14.string(),
   visibility: folderVisibilitySchema,
-  workspaceId: z13.string()
+  workspaceId: z14.string()
 });
-var folderListResponseSchema = z13.object({
-  folders: z13.array(folderSchema)
+var folderListResponseSchema = z14.object({
+  folders: z14.array(folderSchema)
 });
-var deleteFolderResponseSchema = z13.object({
-  deleted: z13.literal(true)
+var deleteFolderResponseSchema = z14.object({
+  deleted: z14.literal(true)
 });
-var workspaceArtifactSchema = z13.object({
-  createdAt: z13.string(),
-  currentVersionNumber: z13.number().int().nullable(),
+var workspaceArtifactSchema = z14.object({
+  autoDeleteAt: z14.string().datetime().nullable().optional(),
+  createdAt: z14.string(),
+  currentVersionNumber: z14.number().int().nullable(),
   // Custom icon, or null to render the default document glyph.
-  emoji: z13.string().nullable(),
-  folderId: z13.string().nullable(),
-  id: z13.string(),
-  openCommentCount: z13.number().int().nonnegative(),
+  emoji: z14.string().nullable(),
+  expiresAt: z14.string().datetime().nullable().optional(),
+  folderId: z14.string().nullable(),
+  id: z14.string(),
+  openCommentCount: z14.number().int().nonnegative(),
   reviewMode: reviewModeSchema,
-  slug: z13.string(),
-  title: z13.string(),
-  updatedAt: z13.string(),
-  url: z13.string().url(),
-  versionCount: z13.number().int().nonnegative(),
+  slug: z14.string(),
+  title: z14.string(),
+  updatedAt: z14.string(),
+  url: z14.string().url(),
+  versionCount: z14.number().int().nonnegative(),
   visibility: artifactVisibilitySchema
 });
-var workspaceArtifactListResponseSchema = z13.object({
-  artifacts: z13.array(workspaceArtifactSchema)
+var workspaceArtifactListResponseSchema = z14.object({
+  artifacts: z14.array(workspaceArtifactSchema)
 });
-var workspaceArtifactSearchResultSchema = z13.object({
-  id: z13.string(),
-  slug: z13.string(),
-  title: z13.string()
+var workspaceArtifactSearchResultSchema = z14.object({
+  id: z14.string(),
+  slug: z14.string(),
+  title: z14.string()
 });
-var workspaceArtifactSearchResponseSchema = z13.object({
-  results: z13.array(workspaceArtifactSearchResultSchema)
+var workspaceArtifactSearchResponseSchema = z14.object({
+  results: z14.array(workspaceArtifactSearchResultSchema)
 });
 
 // ../shared/src/me.ts
-var personSchema = z14.object({
-  image: z14.string().nullable(),
-  name: z14.string()
+var personSchema = z15.object({
+  image: z15.string().nullable(),
+  name: z15.string()
 });
-var ownArtifactSchema = z14.object({
+var ownArtifactSchema = z15.object({
+  autoDeleteAt: z15.string().datetime().nullable().optional(),
   // Everyone else who has published a version, oldest first. Any member may
   // publish a new one (SPEC-2 §5.1), so an artifact's byline is often more
   // than one person and the card stacks their faces rather than crediting
   // whoever shipped last. Excludes `publishedBy`; empty on a solo artifact.
-  coPublishers: z14.array(personSchema),
-  createdAt: z14.string(),
+  coPublishers: z15.array(personSchema),
+  createdAt: z15.string(),
   // SPEC-2 §5.1 — who *made* the artifact: the author of its first
   // finalized version, the same row `viewerCanManage` is decided on. Not
   // the same person as `publishedBy` once an agent ships v2, which is why
   // the dashboard filters on both. Null for a token-only publish.
-  createdBy: z14.object({ image: z14.string().nullable(), name: z14.string() }).nullable(),
-  currentVersionNumber: z14.number().nullable(),
+  createdBy: z15.object({ image: z15.string().nullable(), name: z15.string() }).nullable(),
+  currentVersionNumber: z15.number().nullable(),
   // Custom icon, or null to render the default document glyph.
-  emoji: z14.string().nullable(),
-  // Owned artifacts normally never expire; non-null only while an
-  // expiry is still set (e.g. an unclaimed publish surfaced here later).
-  expiresAt: z14.string().nullable(),
+  emoji: z15.string().nullable(),
+  // Effective expiry: explicit temporary lifetime or anonymous retention.
+  expiresAt: z15.string().nullable(),
   // SPEC-2 §8.4 — the containing folder for workspace-owned artifacts;
   // both null for personal artifacts. `folderId` drives the dashboard's
   // move control and folder filter; `folderName` is the display label,
   // `folderEmoji` its icon (null = the default folder glyph).
-  folderEmoji: z14.string().nullable(),
-  folderId: z14.string().nullable(),
-  folderName: z14.string().nullable(),
+  folderEmoji: z15.string().nullable(),
+  folderId: z15.string().nullable(),
+  folderName: z15.string().nullable(),
   // Whether a publish token is still active — revocable from the
   // dashboard (§6.18); the token itself is never returned.
-  hasPublishToken: z14.boolean(),
+  hasPublishToken: z15.boolean(),
   // Owner preference: hide the version list from reviewers in the review
   // shell. Managers still see it.
-  hideVersions: z14.boolean(),
-  id: z14.string(),
-  openThreads: z14.number(),
-  protected: z14.boolean(),
+  hideVersions: z15.boolean(),
+  id: z15.string(),
+  openThreads: z15.number(),
+  protected: z15.boolean(),
   // Who published the current version (falling back to the claiming
   // owner) — the dashboard shows a name and avatar per artifact so a
   // shared workspace reads as people's work, not anonymous rows. Null
@@ -1166,44 +1218,44 @@ var ownArtifactSchema = z14.object({
   // SPEC-2 §5.8 — the review dial, so the dashboard's settings dialog can
   // render current state without a second fetch.
   reviewMode: reviewModeSchema,
-  slug: z14.string(),
-  title: z14.string(),
-  totalViews: z14.number(),
+  slug: z15.string(),
+  title: z15.string(),
+  totalViews: z15.number(),
   // SPEC §6.20 — messages by others newer than the viewer's last-seen
   // watermark. 0 for signed-out/API-key-less contexts.
-  unreadComments: z14.number(),
-  updatedAt: z14.string(),
-  url: z14.string(),
-  versionCount: z14.number(),
+  unreadComments: z15.number(),
+  updatedAt: z15.string(),
+  url: z15.string(),
+  versionCount: z15.number(),
   // SPEC-2 §5.1 — whether the caller clears the manage bar for this
   // artifact (workspace admin, or the person who first published it).
   // Only a manager's folder move inherits the folder's visibility, so the
   // dashboard warns exactly the people the change can actually affect, and
   // only a manager is offered the Share entry (§5.7).
-  viewerCanManage: z14.boolean(),
+  viewerCanManage: z15.boolean(),
   // SPEC-2 §5.2 — the artifact's own visibility, the single enforcement
   // source. The dashboard needs it to tell whether a folder move would
   // widen exposure before it sends the PATCH (§3.4), and to render the
   // audience glyph — one per level — on rows and cards (§5.7).
   visibility: artifactVisibilitySchema
 });
-var ownArtifactsResponseSchema = z14.object({
-  artifacts: z14.array(ownArtifactSchema)
+var ownArtifactsResponseSchema = z15.object({
+  artifacts: z15.array(ownArtifactSchema)
 });
-var revokePublishTokenResponseSchema = z14.object({
-  revoked: z14.boolean()
+var revokePublishTokenResponseSchema = z15.object({
+  revoked: z15.boolean()
 });
 
 // ../shared/src/owner.ts
-import { z as z15 } from "zod";
+import { z as z16 } from "zod";
 var SLUG_PATTERN = /^[a-z0-9](?:[a-z0-9-]{1,61}[a-z0-9])$/;
-var claimResponseSchema = z15.object({
-  artifactId: z15.string(),
-  slug: z15.string(),
-  title: z15.string(),
-  url: z15.string().url()
+var claimResponseSchema = z16.object({
+  artifactId: z16.string(),
+  slug: z16.string(),
+  title: z16.string(),
+  url: z16.string().url()
 });
-var updateArtifactSchema = z15.object({
+var updateArtifactSchema = z16.object({
   // Custom icon; explicit null clears it back to the default glyph.
   // Part of what the artifact *is* (like the title), so it takes the
   // same manage rights as title/slug — not the member-level folder move.
@@ -1211,159 +1263,159 @@ var updateArtifactSchema = z15.object({
   // SPEC-2 §6.4 — placement + visibility. `folderId: null` clears the
   // folder; `workspaceId: null` moves the artifact out of its workspace
   // (§5.5 ownership transfer).
-  folderId: z15.string().min(1).nullable().optional(),
+  folderId: z16.string().min(1).nullable().optional(),
   // Keep the version list out of the review shell. Presentation only:
   // versions stay immutable, and a `/vN/` URL still resolves.
-  hideVersions: z15.boolean().optional(),
-  slug: z15.string().min(3).max(63).regex(SLUG_PATTERN, {
+  hideVersions: z16.boolean().optional(),
+  slug: z16.string().min(3).max(63).regex(SLUG_PATTERN, {
     message: "slug must be lowercase letters, digits, and hyphens, with no leading/trailing hyphen"
   }).optional(),
-  title: z15.string().min(1).max(200).optional(),
+  title: z16.string().min(1).max(200).optional(),
   visibility: artifactVisibilitySchema.optional(),
-  workspaceId: z15.string().min(1).nullable().optional()
+  workspaceId: z16.string().min(1).nullable().optional()
 }).refine(
   (body) => body.title !== void 0 || body.slug !== void 0 || body.visibility !== void 0 || body.folderId !== void 0 || body.workspaceId !== void 0 || body.emoji !== void 0 || body.hideVersions !== void 0,
   {
     message: "provide at least one of title, slug, visibility, folderId, workspaceId, emoji, hideVersions"
   }
 );
-var deleteArtifactResponseSchema = z15.object({
-  deleted: z15.literal(true)
+var deleteArtifactResponseSchema = z16.object({
+  deleted: z16.literal(true)
 });
 
 // ../shared/src/presence.ts
-import { z as z16 } from "zod";
+import { z as z17 } from "zod";
 var AGENT_STATES = ["listening", "editing", "publishing"];
-var agentStateSchema = z16.enum(AGENT_STATES);
+var agentStateSchema = z17.enum(AGENT_STATES);
 var AGENT_PRESENCE = {
   editingTtlSeconds: 300,
   heartbeatSeconds: 15,
   shellPollSeconds: 15,
   ttlSeconds: 45
 };
-var agentHeartbeatBodySchema = z16.object({
+var agentHeartbeatBodySchema = z17.object({
   state: agentStateSchema.optional()
 });
-var agentHeartbeatResponseSchema = z16.object({
-  listening: z16.literal(true),
+var agentHeartbeatResponseSchema = z17.object({
+  listening: z17.literal(true),
   state: agentStateSchema.optional(),
-  ttlSeconds: z16.number().int().positive()
+  ttlSeconds: z17.number().int().positive()
 });
-var agentPresenceSchema = z16.object({
-  agent: z16.object({ id: z16.string().nullable(), label: z16.string() }).nullable().default(null),
-  listening: z16.boolean(),
+var agentPresenceSchema = z17.object({
+  agent: z17.object({ id: z17.string().nullable(), label: z17.string() }).nullable().default(null),
+  listening: z17.boolean(),
   state: agentStateSchema.nullable().optional(),
-  versionNumber: z16.number().int().positive().nullable()
+  versionNumber: z17.number().int().positive().nullable()
 });
 
 // ../shared/src/protection.ts
-import { z as z17 } from "zod";
+import { z as z18 } from "zod";
 var PASSWORD_MIN = 6;
 var PASSWORD_MAX = 128;
-var gatePasswordSchema = z17.string().min(PASSWORD_MIN, `Password must be at least ${PASSWORD_MIN} characters.`).max(PASSWORD_MAX, `Password must be at most ${PASSWORD_MAX} characters.`);
-var setProtectionSchema = z17.object({
+var gatePasswordSchema = z18.string().min(PASSWORD_MIN, `Password must be at least ${PASSWORD_MIN} characters.`).max(PASSWORD_MAX, `Password must be at most ${PASSWORD_MAX} characters.`);
+var setProtectionSchema = z18.object({
   password: gatePasswordSchema.nullable()
 });
-var protectionResponseSchema = z17.object({
-  protected: z17.boolean()
+var protectionResponseSchema = z18.object({
+  protected: z18.boolean()
 });
-var unlockSchema = z17.object({
-  password: z17.string().min(1).max(1024)
+var unlockSchema = z18.object({
+  password: z18.string().min(1).max(1024)
 });
-var unlockResponseSchema = z17.object({
-  unlocked: z17.literal(true)
+var unlockResponseSchema = z18.object({
+  unlocked: z18.literal(true)
 });
 
 // ../shared/src/report.ts
-import { z as z18 } from "zod";
-var reportRequestSchema = z18.object({
-  reason: z18.string().max(1e3).optional()
+import { z as z19 } from "zod";
+var reportRequestSchema = z19.object({
+  reason: z19.string().max(1e3).optional()
 });
-var reportResponseSchema = z18.object({
-  reported: z18.literal(true)
+var reportResponseSchema = z19.object({
+  reported: z19.literal(true)
 });
 
 // ../shared/src/reviewers.ts
-import { z as z19 } from "zod";
-var artifactReviewerSchema = z19.object({
-  avatarUrl: z19.string().nullable(),
-  displayName: z19.string(),
+import { z as z20 } from "zod";
+var artifactReviewerSchema = z20.object({
+  avatarUrl: z20.string().nullable(),
+  displayName: z20.string(),
   // Exactly one of userId/guestId is set, per `kind`.
-  guestId: z19.string().nullable(),
+  guestId: z20.string().nullable(),
   // "account", not commentAuthorSchema's "member" — the whole point here is
   // that these people need not be workspace members. A guest can be named in
   // a comment but never notified: guest_identities carries a display name and
   // no email, so there is nowhere to send anything.
-  kind: z19.enum(["account", "guest"]),
-  userId: z19.string().nullable()
+  kind: z20.enum(["account", "guest"]),
+  userId: z20.string().nullable()
 });
-var artifactReviewerListResponseSchema = z19.object({
-  reviewers: z19.array(artifactReviewerSchema)
+var artifactReviewerListResponseSchema = z20.object({
+  reviewers: z20.array(artifactReviewerSchema)
 });
 
 // ../shared/src/stats.ts
-import { z as z20 } from "zod";
-var avgViewSecondsSchema = z20.number().int().nonnegative().nullable();
-var versionViewStatsSchema = z20.object({
+import { z as z21 } from "zod";
+var avgViewSecondsSchema = z21.number().int().nonnegative().nullable();
+var versionViewStatsSchema = z21.object({
   avgViewSeconds: avgViewSecondsSchema,
   // Views from inside the review shell's iframe vs. direct visits to
   // the render URL. views = embeddedViews + directViews.
-  directViews: z20.number().int().nonnegative(),
-  embeddedViews: z20.number().int().nonnegative(),
+  directViews: z21.number().int().nonnegative(),
+  embeddedViews: z21.number().int().nonnegative(),
   // Distinct hashed viewer IPs across the version's lifetime.
-  uniqueViewers: z20.number().int().nonnegative(),
-  versionNumber: z20.number().int().positive(),
-  views: z20.number().int().nonnegative()
+  uniqueViewers: z21.number().int().nonnegative(),
+  versionNumber: z21.number().int().positive(),
+  views: z21.number().int().nonnegative()
 });
-var dailyViewsSchema = z20.object({
+var dailyViewsSchema = z21.object({
   avgViewSeconds: avgViewSecondsSchema,
   // UTC day, YYYY-MM-DD.
-  day: z20.string(),
-  uniqueViewers: z20.number().int().nonnegative(),
-  views: z20.number().int().nonnegative()
+  day: z21.string(),
+  uniqueViewers: z21.number().int().nonnegative(),
+  views: z21.number().int().nonnegative()
 });
-var artifactStatsResponseSchema = z20.object({
+var artifactStatsResponseSchema = z21.object({
   avgViewSeconds: avgViewSecondsSchema,
-  daily: z20.array(dailyViewsSchema),
+  daily: z21.array(dailyViewsSchema),
   // Distinct hashed viewer IPs across all versions and days.
-  totalUniqueViewers: z20.number().int().nonnegative(),
-  totalViews: z20.number().int().nonnegative(),
-  versions: z20.array(versionViewStatsSchema)
+  totalUniqueViewers: z21.number().int().nonnegative(),
+  totalViews: z21.number().int().nonnegative(),
+  versions: z21.array(versionViewStatsSchema)
 });
 
 // ../shared/src/versions.ts
-import { z as z21 } from "zod";
-var versionSourceSchema = z21.object({
-  agentName: z21.string().nullable(),
-  type: z21.string()
+import { z as z22 } from "zod";
+var versionSourceSchema = z22.object({
+  agentName: z22.string().nullable(),
+  type: z22.string()
 });
-var versionChangesSchema = z21.object({
-  added: z21.array(z21.string()),
-  changed: z21.array(z21.string()),
-  removed: z21.array(z21.string())
+var versionChangesSchema = z22.object({
+  added: z22.array(z22.string()),
+  changed: z22.array(z22.string()),
+  removed: z22.array(z22.string())
 });
-var versionSummarySchema = z21.object({
+var versionSummarySchema = z22.object({
   // Absent for the first version — there is no previous version to diff against.
   changes: versionChangesSchema.nullable(),
-  createdAt: z21.string(),
-  entryUrl: z21.string().url(),
-  fileCount: z21.number().int().nonnegative(),
-  id: z21.string(),
-  isCurrent: z21.boolean(),
+  createdAt: z22.string(),
+  entryUrl: z22.string().url(),
+  fileCount: z22.number().int().nonnegative(),
+  id: z22.string(),
+  isCurrent: z22.boolean(),
   // Author-supplied bullet-point changelog; null when the publish omitted it.
-  notes: z21.string().nullable(),
+  notes: z22.string().nullable(),
   // The account that published this version, with their own avatar where
   // they've set one. Any workspace member can publish a new version
   // (SPEC-2 §5.1), so "which teammate" outranks "which agent" — the agent
   // is the tool, this is the person. Null for token-only publishes, which
   // carry no account.
-  publishedBy: z21.object({ image: z21.string().nullable(), name: z21.string() }).nullable(),
+  publishedBy: z22.object({ image: z22.string().nullable(), name: z22.string() }).nullable(),
   source: versionSourceSchema,
-  totalSizeBytes: z21.number().int().nonnegative(),
-  versionNumber: z21.number().int().positive()
+  totalSizeBytes: z22.number().int().nonnegative(),
+  versionNumber: z22.number().int().positive()
 });
-var versionListResponseSchema = z21.object({
-  versions: z21.array(versionSummarySchema)
+var versionListResponseSchema = z22.object({
+  versions: z22.array(versionSummarySchema)
 });
 
 // src/agent-identity.ts
@@ -1544,6 +1596,21 @@ function createApiClient(apiUrl2, publishToken) {
         (d) => dataSummaryResponseSchema.parse(d)
       );
     },
+    async insertData(artifactId, collection, fields) {
+      return request(
+        `${base}/api/v1/artifacts/${artifactId}/data/${encodeURIComponent(collection)}`,
+        { body: JSON.stringify(fields), headers, method: "POST" },
+        (d) => dataRecordResponseSchema.parse(d).record
+      );
+    },
+    /** Owner-plane batch: up to DATA_LIMITS.maxInsertBatch, all-or-nothing. */
+    async insertDataBatch(artifactId, collection, records) {
+      return request(
+        `${base}/api/v1/artifacts/${artifactId}/data/${encodeURIComponent(collection)}`,
+        { body: JSON.stringify(records), headers, method: "POST" },
+        (d) => dataBatchInsertResponseSchema.parse(d)
+      );
+    },
     // SPEC §6.18 — everything owned by the account this client's API
     // key (or session) belongs to.
     async listArtifacts() {
@@ -1647,6 +1714,13 @@ function createApiClient(apiUrl2, publishToken) {
         () => void 0
       );
     },
+    async setExpiration(artifactId, expiresInSeconds) {
+      return request(
+        `${base}/api/v1/artifacts/${artifactId}/expiration`,
+        { body: JSON.stringify({ expiresInSeconds }), headers, method: "PUT" },
+        (d) => expirationResponseSchema.parse(d)
+      );
+    },
     // SPEC §6.16 — set a password (string) or clear it (null). Authorized
     // by the publish token this client was created with.
     async setProtection(artifactId, password) {
@@ -1703,17 +1777,17 @@ import {
   writeFileSync as writeFileSync2
 } from "fs";
 import path2 from "path";
-import { z as z23 } from "zod";
+import { z as z24 } from "zod";
 
 // src/credentials.ts
 import { existsSync, mkdirSync, readFileSync, writeFileSync } from "fs";
 import { homedir } from "os";
 import path from "path";
-import { z as z22 } from "zod";
+import { z as z23 } from "zod";
 var DEFAULT_API_URL = "https://artifact.cafe";
-var credentialsSchema = z22.object({
-  keys: z22.record(z22.string(), z22.string()),
-  version: z22.literal(1)
+var credentialsSchema = z23.object({
+  keys: z23.record(z23.string(), z23.string()),
+  version: z23.literal(1)
 });
 function credentialsPath() {
   return path.join(homedir(), ".artifactcafe", "credentials");
@@ -1763,24 +1837,24 @@ function resolveApiKey(apiUrl2, flag) {
 }
 
 // src/config.ts
-var configSchema = z23.object({
-  apiUrl: z23.string(),
-  artifactId: z23.string(),
-  folder: z23.string().optional(),
-  folderId: z23.string().optional(),
+var configSchema = z24.object({
+  apiUrl: z24.string(),
+  artifactId: z24.string(),
+  folder: z24.string().optional(),
+  folderId: z24.string().optional(),
   // Optional: a folder linked by `link` to an artifact you own carries no
   // token — owner actions authorize via your stored login instead. A first
   // publish still writes the anonymous-mode token here.
-  publishToken: z23.string().optional(),
-  slug: z23.string(),
-  url: z23.string(),
-  workspace: z23.string().optional(),
-  workspaceId: z23.string().optional(),
-  workspaceKind: z23.enum(["personal", "workspace"]).optional()
-});
-var projectConfigSchema = z23.object({
-  folder: z23.string().trim().min(1).optional(),
-  workspace: z23.string().trim().min(1)
+  publishToken: z24.string().optional(),
+  slug: z24.string(),
+  url: z24.string(),
+  workspace: z24.string().optional(),
+  workspaceId: z24.string().optional(),
+  workspaceKind: z24.enum(["personal", "workspace"]).optional()
+});
+var projectConfigSchema = z24.object({
+  folder: z24.string().trim().min(1).optional(),
+  workspace: z24.string().trim().min(1)
 }).strict();
 var CONFIG_DIR = ".artifactcafe";
 var CONFIG_FILE = "config.json";
@@ -1816,7 +1890,7 @@ function readProjectConfig(dir) {
           JSON.parse(readFileSync2(file, "utf8"))
         );
       } catch (error) {
-        const message = error instanceof z23.ZodError ? error.issues[0]?.message ?? "invalid project target" : "invalid JSON";
+        const message = error instanceof z24.ZodError ? error.issues[0]?.message ?? "invalid project target" : "invalid JSON";
         throw new Error(`Invalid ${file}: ${message}.`);
       }
     }
@@ -2214,7 +2288,7 @@ import path8 from "path";
 
 // src/publish.ts
 import { exec } from "child_process";
-import { readFileSync as readFileSync5 } from "fs";
+import { readFileSync as readFileSync5, statSync as statSync2 } from "fs";
 import path7 from "path";
 import { createInterface } from "readline";
 
@@ -2312,6 +2386,75 @@ async function dataLs(opts) {
     console.log(`  ${JSON.stringify(fields)}`);
   }
 }
+var RECORD_SHAPE_HINT = `a JSON object or array of objects, e.g. '{"name":"Ada"}'`;
+function isRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+async function dataInsert(opts) {
+  if (opts.record === void 0 === (opts.file === void 0)) {
+    throw new Error("Pass exactly one of --record '<json>' or --file <path>.");
+  }
+  const text = opts.record ?? readFileSync3(opts.file, "utf8");
+  let parsed;
+  try {
+    parsed = JSON.parse(text);
+  } catch {
+    throw new Error(`Records must be ${RECORD_SHAPE_HINT}.`);
+  }
+  const linked = requireLinkedArtifact(opts.dir);
+  const client = createApiClient(linked.apiUrl, linked.publishToken);
+  if (isRecord(parsed)) {
+    const record = await client.insertData(
+      linked.artifactId,
+      opts.collection,
+      parsed
+    );
+    if (opts.json) {
+      console.log(JSON.stringify({ collection: opts.collection, record }));
+      return;
+    }
+    console.log(`Inserted ${record.id} into "${opts.collection}".`);
+    return;
+  }
+  if (!(Array.isArray(parsed) && parsed.length > 0 && parsed.every(isRecord))) {
+    throw new Error(`Records must be ${RECORD_SHAPE_HINT}.`);
+  }
+  const records = [];
+  for (let i = 0; i < parsed.length; i += DATA_LIMITS.maxInsertBatch) {
+    try {
+      const page = await client.insertDataBatch(
+        linked.artifactId,
+        opts.collection,
+        parsed.slice(i, i + DATA_LIMITS.maxInsertBatch)
+      );
+      records.push(...page.records);
+    } catch (err) {
+      if (records.length === 0) {
+        throw err;
+      }
+      const note = ` (the first ${records.length} records were inserted; records ${i}+ may not have been)`;
+      if (err instanceof ApiRequestError) {
+        throw new ApiRequestError(
+          err.status,
+          err.code,
+          `${err.message}${note}`,
+          err.retryAfter
+        );
+      }
+      throw new Error(
+        `${err instanceof Error ? err.message : String(err)}${note}`
+      );
+    }
+  }
+  if (opts.json) {
+    console.log(JSON.stringify({ collection: opts.collection, records }));
+    return;
+  }
+  const plural = records.length === 1 ? "" : "s";
+  console.log(
+    `Inserted ${records.length} record${plural} into "${opts.collection}".`
+  );
+}
 async function dataExport(opts) {
   const linked = requireLinkedArtifact(opts.dir);
   const client = createApiClient(linked.apiUrl, linked.publishToken);
@@ -2363,7 +2506,7 @@ async function dataClear(opts) {
 
 // src/manifest.ts
 import { createHash } from "crypto";
-import { readdirSync, readFileSync as readFileSync4, statSync } from "fs";
+import { lstatSync, readdirSync, readFileSync as readFileSync4, statSync } from "fs";
 import path6 from "path";
 var IGNORED_DIRS = /* @__PURE__ */ new Set([".git", "node_modules", ".artifactcafe"]);
 var IGNORED_FILES = /* @__PURE__ */ new Set([".DS_Store", "artifact-cafe.json"]);
@@ -2385,6 +2528,7 @@ function isIgnoredFile(name) {
 var MIME_TYPES = {
   ".avif": "image/avif",
   ".css": "text/css",
+  ".csv": "text/csv",
   ".gif": "image/gif",
   ".htm": "text/html",
   ".html": "text/html",
@@ -2394,6 +2538,7 @@ var MIME_TYPES = {
   ".js": "text/javascript",
   ".json": "application/json",
   ".map": "application/json",
+  ".markdown": "text/markdown",
   ".md": "text/markdown",
   ".mjs": "text/javascript",
   ".mp3": "audio/mpeg",
@@ -2415,6 +2560,31 @@ var MIME_TYPES = {
 function mimeFor(filePath) {
   return MIME_TYPES[path6.extname(filePath).toLowerCase()] ?? "application/octet-stream";
 }
+function localFile(absPath, rel) {
+  if (isIgnoredFile(path6.basename(rel)) || !isSafeArtifactPath(rel)) {
+    return null;
+  }
+  const { size } = statSync(absPath);
+  if (size === 0) {
+    return null;
+  }
+  return {
+    absPath,
+    hash: `sha256_${createHash("sha256").update(readFileSync4(absPath)).digest("hex")}`,
+    mimeType: mimeFor(rel),
+    path: rel,
+    size
+  };
+}
+function scanPath(target) {
+  const stat = lstatSync(target);
+  if (stat.isDirectory()) {
+    return scanDirectory(target);
+  }
+  const rel = path6.basename(target);
+  const file = stat.isFile() ? localFile(target, rel) : null;
+  return file ? { files: [file], skipped: [] } : { files: [], skipped: [rel] };
+}
 function scanDirectory(dir) {
   const files = [];
   const skipped = [];
@@ -2437,23 +2607,12 @@ function scanDirectory(dir) {
       if (!entry.isFile()) {
         continue;
       }
-      if (isIgnoredFile(entry.name) || !isSafeArtifactPath(rel)) {
+      const file = localFile(abs, rel);
+      if (!file) {
         skipped.push(rel);
         continue;
       }
-      const { size } = statSync(abs);
-      if (size === 0) {
-        skipped.push(rel);
-        continue;
-      }
-      const content = readFileSync4(abs);
-      files.push({
-        absPath: abs,
-        hash: `sha256_${createHash("sha256").update(content).digest("hex")}`,
-        mimeType: mimeFor(rel),
-        path: rel,
-        size
-      });
+      files.push(file);
     }
   }
   walk(dir, "");
@@ -2461,27 +2620,37 @@ function scanDirectory(dir) {
   return { files, skipped };
 }
 function resolveEntry(files, explicit) {
-  if (explicit) {
-    if (!files.some((f) => f.path === explicit)) {
-      throw new Error(
-        `Entry file "${explicit}" not found in the publish folder.`
-      );
+  return resolvePublishEntry(files, explicit);
+}
+
+// src/spinner.ts
+var FRAMES = ["\xE3", "\xE4", "\xE5"];
+var INTERVAL_MS = 420;
+var AMBER2 = "\x1B[38;2;214;138;57m";
+var RESET2 = "\x1B[0m";
+var CLEAR_LINE = "\r\x1B[2K";
+function startBrewing(label, enabled) {
+  const stream = process.stderr;
+  if (!(enabled && stream.isTTY) || process.env.CI) {
+    return { stop: () => void 0 };
+  }
+  const color = !process.env.NO_COLOR;
+  let frame = 0;
+  const draw = () => {
+    const glyph = FRAMES[frame % FRAMES.length];
+    stream.write(
+      `${CLEAR_LINE}  ${color ? `${AMBER2}${glyph}${RESET2}` : glyph} ${label}`
+    );
+    frame += 1;
+  };
+  draw();
+  const timer = setInterval(draw, INTERVAL_MS);
+  return {
+    stop() {
+      clearInterval(timer);
+      stream.write(CLEAR_LINE);
     }
-    return explicit;
-  }
-  if (files.some((f) => f.path === "index.html")) {
-    return "index.html";
-  }
-  const htmlFiles = files.filter(
-    (f) => f.path.endsWith(".html") && !f.path.includes("/")
-  );
-  const [onlyHtmlFile] = htmlFiles;
-  if (onlyHtmlFile && htmlFiles.length === 1) {
-    return onlyHtmlFile.path;
-  }
-  throw new Error(
-    htmlFiles.length === 0 ? "No entry file found. Add an index.html or pass --entry <file>." : `Multiple HTML files found (${htmlFiles.map((f) => f.path).join(", ")}). Pass --entry <file>.`
-  );
+  };
 }
 
 // src/publish.ts
@@ -2492,8 +2661,10 @@ var REVIEW_LABEL = {
   readonly: "read-only \u2014 existing comments only"
 };
 async function publish(opts) {
-  const dir = path7.resolve(opts.dir);
+  const target = path7.resolve(opts.dir);
+  const dir = statSync2(target).isFile() ? path7.dirname(target) : target;
   const config = readConfig(dir);
+  const expiresInSeconds = opts.expiresIn === void 0 ? void 0 : parseArtifactDuration(opts.expiresIn);
   if (opts.password !== void 0) {
     const parsed = gatePasswordSchema.safeParse(opts.password);
     if (!parsed.success) {
@@ -2518,11 +2689,11 @@ async function publish(opts) {
     apiUrl: apiUrl2,
     config,
     isNewArtifact: artifactId === null,
-    opts
+    opts: { ...opts, dir }
   });
-  const { files, skipped } = scanDirectory(dir);
+  const { files, skipped } = scanPath(target);
   if (files.length === 0) {
-    throw new Error(`Nothing to publish in ${dir} (after ignore rules).`);
+    throw new Error(`Nothing to publish at ${target} (after ignore rules).`);
   }
   const entryPath = resolveEntry(files, opts.entry);
   const dataInfo = inspectDataManifest(files);
@@ -2536,6 +2707,7 @@ async function publish(opts) {
   }
   const sessionBody = {
     artifactId,
+    ...expiresInSeconds === void 0 ? {} : { expiresInSeconds },
     // Overrides the entry HTML's own meta description on the share card.
     // Omitted entirely when absent, so the document keeps speaking for itself.
     ...opts.description?.trim() ? { description: opts.description.trim() } : {},
@@ -2570,11 +2742,17 @@ async function publish(opts) {
     client = createApiClient(apiUrl2, credential);
     session = await client.createSession(sessionBody);
   }
+  if (expiresInSeconds !== void 0 && session.expiresInSeconds !== expiresInSeconds) {
+    throw new Error(
+      "This API does not support temporary publishing. Nothing was uploaded or finalized; upgrade the API before using --expires-in."
+    );
+  }
   const byPath = new Map(files.map((f) => [f.path, f]));
   log(
     `  uploading ${session.filesToUpload.length} file(s)` + (session.skippedFiles.length ? `, ${session.skippedFiles.length} unchanged` : "")
   );
   const presence = startPublishingPresence(client, session.artifactId);
+  const brewing = startBrewing("brewing\u2026", !opts.json);
   try {
     await inBatches(
       session.filesToUpload,
@@ -2591,10 +2769,18 @@ async function publish(opts) {
         );
       }
     );
+  } catch (error) {
+    brewing.stop();
+    throw error;
   } finally {
     presence.stop();
   }
-  const result = await client.finalize(session.publishSessionId);
+  let result;
+  try {
+    result = await client.finalize(session.publishSessionId);
+  } finally {
+    brewing.stop();
+  }
   if (usingAgentToken && result.workspaceId) {
     placement.workspaceId = result.workspaceId;
   }
@@ -2634,6 +2820,8 @@ async function publish(opts) {
       JSON.stringify(
         {
           artifactId: result.artifactId,
+          autoDeleteAt: result.autoDeleteAt ?? null,
+          expiresAt: result.expiresAt ?? null,
           ...dataInfo.config ? { data: dataInfo.config } : {},
           claimed: result.claimed,
           destination: placement.destination,
@@ -2678,7 +2866,7 @@ ${result.url}
 ${result.claimUrl}
 `
       );
-    } else if (result.claimed) {
+    } else if (result.claimed && !result.expiresAt) {
       console.log("Claimed by your account \u2014 no expiry.\n");
     }
     if (opts.password !== void 0) {
@@ -2714,6 +2902,12 @@ ${result.claimUrl}
     }
   }
   if (!opts.json) {
+    if (result.expiresAt) {
+      console.log(
+        `${result.autoDeleteAt ? "Temporary artifact" : "Anonymous artifact"} \u2014 expires at ${result.expiresAt}. All versions, comments, files, and artifact data will be automatically deleted.
+`
+      );
+    }
     for (const announcement of dataInfo.announcements) {
       console.log(announcement);
     }
@@ -3007,6 +3201,35 @@ function printCliError(err, json) {
   }
 }
 
+// src/expiration.ts
+import path9 from "path";
+async function expiration(opts) {
+  if (opts.duration !== void 0 === opts.keep) {
+    throw new Error("Provide exactly one of --in <duration> or --keep.");
+  }
+  const seconds = opts.keep ? null : parseArtifactDuration(opts.duration);
+  const target = resolveArtifactTarget(path9.resolve(opts.dir), opts);
+  const result = await createApiClient(
+    target.apiUrl,
+    target.credential
+  ).setExpiration(target.artifactId, seconds);
+  if (opts.json) {
+    console.log(JSON.stringify(result, null, 2));
+    return;
+  }
+  if (result.autoDeleteAt) {
+    console.log(`Temporary artifact \u2014 expires at ${result.expiresAt}.`);
+  } else if (result.expiresAt) {
+    console.log(
+      `Temporary deadline cleared. Anonymous retention still expires at ${result.expiresAt}; claim the artifact to keep it.`
+    );
+  } else {
+    console.log(
+      "Artifact kept \u2014 no automatic expiry. Its link, versions, and comments are preserved."
+    );
+  }
+}
+
 // src/folders.ts
 async function folders(opts) {
   if (opts.action !== void 0 && opts.action !== "create") {
@@ -3103,7 +3326,7 @@ function printFolder(folder) {
 }
 
 // src/link.ts
-import path9 from "path";
+import path10 from "path";
 import { createInterface as createInterface2 } from "readline";
 
 // src/list.ts
@@ -3332,7 +3555,7 @@ async function link(opts) {
     }
     chosen = await pickArtifact(artifacts);
   }
-  const dir = path9.resolve(opts.dir);
+  const dir = path10.resolve(opts.dir);
   writeConfig(dir, {
     apiUrl: apiUrl2,
     artifactId: chosen.id,
@@ -3500,7 +3723,7 @@ function logout(opts) {
 }
 
 // src/message.ts
-import path10 from "path";
+import path11 from "path";
 async function readStdin2() {
   if (process.stdin.isTTY) {
     return "";
@@ -3524,7 +3747,7 @@ async function editMessage(opts) {
       'Nothing to save. Pass the new text with --body "\u2026", or pipe it on stdin.'
     );
   }
-  const dir = path10.resolve(opts.dir);
+  const dir = path11.resolve(opts.dir);
   const target = resolveArtifactTarget(dir, {
     apiKey: opts.apiKey,
     artifact: opts.artifact
@@ -3544,7 +3767,7 @@ async function deleteMessage(opts) {
       "Pass the message id to delete \u2014 get it from `artifact-cafe comments --json`."
     );
   }
-  const dir = path10.resolve(opts.dir);
+  const dir = path11.resolve(opts.dir);
   const target = resolveArtifactTarget(dir, {
     apiKey: opts.apiKey,
     artifact: opts.artifact
@@ -3559,12 +3782,12 @@ async function deleteMessage(opts) {
 }
 
 // src/move.ts
-import path11 from "path";
+import path12 from "path";
 async function move(opts) {
   if (Boolean(opts.folder) === Boolean(opts.unfiled)) {
     throw new Error("Pass exactly one of --folder <name-or-id> or --unfiled.");
   }
-  const dir = path11.resolve(opts.dir);
+  const dir = path12.resolve(opts.dir);
   const target = resolveArtifactTarget(dir, {
     apiKey: opts.apiKey,
     artifact: opts.artifact
@@ -3654,9 +3877,9 @@ async function move(opts) {
 }
 
 // src/open.ts
-import path12 from "path";
+import path13 from "path";
 async function openArtifact(opts) {
-  const dir = path12.resolve(opts.dir);
+  const dir = path13.resolve(opts.dir);
   const target = resolveArtifactTarget(dir, {
     apiKey: opts.apiKey,
     artifact: opts.artifact
@@ -3674,7 +3897,7 @@ async function openArtifact(opts) {
 }
 
 // src/protect.ts
-import path13 from "path";
+import path14 from "path";
 async function protect(opts) {
   if (opts.off && opts.password !== void 0) {
     throw new Error("Pass either --password or --off, not both.");
@@ -3691,7 +3914,7 @@ async function protect(opts) {
       throw new Error(parsed.error.issues[0]?.message ?? "Invalid password.");
     }
   }
-  const dir = path13.resolve(opts.dir);
+  const dir = path14.resolve(opts.dir);
   const target = resolveArtifactTarget(dir, {
     apiKey: opts.apiKey,
     artifact: opts.artifact
@@ -3716,7 +3939,7 @@ async function protect(opts) {
 }
 
 // src/reply.ts
-import path14 from "path";
+import path15 from "path";
 async function readStdin3() {
   if (process.stdin.isTTY) {
     return "";
@@ -3740,7 +3963,7 @@ async function replyToThread(opts) {
       'Nothing to post. Pass the reply with --body "\u2026", or pipe it on stdin.'
     );
   }
-  const dir = path14.resolve(opts.dir);
+  const dir = path15.resolve(opts.dir);
   const target = resolveArtifactTarget(dir, {
     apiKey: opts.apiKey,
     artifact: opts.artifact
@@ -3769,7 +3992,7 @@ async function replyToThread(opts) {
 }
 
 // src/resolve.ts
-import path15 from "path";
+import path16 from "path";
 async function changeThreadStatus(opts) {
   const threadId = opts.thread?.trim();
   if (!threadId) {
@@ -3777,7 +4000,7 @@ async function changeThreadStatus(opts) {
       `Pass the thread id to ${opts.action} \u2014 get it from \`artifact-cafe comments --json\`.`
     );
   }
-  const dir = path15.resolve(opts.dir);
+  const dir = path16.resolve(opts.dir);
   const target = resolveArtifactTarget(dir, {
     apiKey: opts.apiKey,
     artifact: opts.artifact
@@ -3814,7 +4037,7 @@ async function changeThreadStatus(opts) {
 }
 
 // src/review.ts
-import path16 from "path";
+import path17 from "path";
 var OUTCOME = {
   off: "Plain artifact \u2014 the review tools are hidden entirely",
   open: "Open for review \u2014 anyone who can open it can comment",
@@ -3828,7 +4051,7 @@ async function review(opts) {
     );
   }
   const mode = parsed.data;
-  const dir = path16.resolve(opts.dir);
+  const dir = path17.resolve(opts.dir);
   const target = resolveArtifactTarget(dir, {
     apiKey: opts.apiKey,
     artifact: opts.artifact
@@ -3850,10 +4073,10 @@ async function review(opts) {
 }
 
 // src/share.ts
-import path17 from "path";
+import path18 from "path";
 var EMAIL_RE = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
 async function share(opts) {
-  const dir = path17.resolve(opts.dir);
+  const dir = path18.resolve(opts.dir);
   const target = resolveArtifactTarget(dir, {
     apiKey: opts.apiKey,
     artifact: opts.artifact
@@ -3908,7 +4131,7 @@ General access: ${visibility}`);
   console.log("");
 }
 async function unshare(opts) {
-  const dir = path17.resolve(opts.dir);
+  const dir = path18.resolve(opts.dir);
   const target = resolveArtifactTarget(dir, {
     apiKey: opts.apiKey,
     artifact: opts.artifact
@@ -3931,7 +4154,7 @@ async function unshare(opts) {
 }
 
 // src/status.ts
-import path18 from "path";
+import path19 from "path";
 async function status(opts) {
   if (!AGENT_STATES.includes(opts.state)) {
     throw new Error(
@@ -3939,7 +4162,7 @@ async function status(opts) {
     );
   }
   const state = opts.state;
-  const dir = path18.resolve(opts.dir);
+  const dir = path19.resolve(opts.dir);
   const target = resolveArtifactTarget(dir, {
     apiKey: opts.apiKey,
     artifact: opts.artifact
@@ -3968,26 +4191,26 @@ async function status(opts) {
 import { existsSync as existsSync3, mkdirSync as mkdirSync3, readFileSync as readFileSync6, writeFileSync as writeFileSync3 } from "fs";
 import { createRequire } from "module";
 import { homedir as homedir2 } from "os";
-import path19 from "path";
-import { z as z24 } from "zod";
+import path20 from "path";
+import { z as z25 } from "zod";
 var REGISTRY_LATEST_URL = "https://registry.npmjs.org/artifact-cafe/latest";
 var SKILL_SOURCE_URL = "https://raw.githubusercontent.com/Artifact-Cafe/skill/main/artifact-cafe/SKILL.md";
 var SKILL_UPDATE_COMMAND = "npx skills add artifact-cafe/skill --skill artifact-cafe -g";
 var CHECK_TTL_MS = 24 * 60 * 60 * 1e3;
 var FETCH_TIMEOUT_MS = 2e3;
 var SKILL_VERSION_PATTERN = /\*\*Skill version:\s*(\d+\.\d+\.\d+)\*\*/;
-var cacheSchema = z24.object({
-  checkedAt: z24.number(),
-  cliLatest: z24.string().nullable(),
-  skillLatest: z24.string().nullable(),
-  version: z24.literal(1)
+var cacheSchema = z25.object({
+  checkedAt: z25.number(),
+  cliLatest: z25.string().nullable(),
+  skillLatest: z25.string().nullable(),
+  version: z25.literal(1)
 });
 function cliVersion() {
   const pkg = createRequire(import.meta.url)("../package.json");
   return pkg.version;
 }
 function cachePath() {
-  return path19.join(homedir2(), ".artifactcafe", "update-check.json");
+  return path20.join(homedir2(), ".artifactcafe", "update-check.json");
 }
 function readCache() {
   try {
@@ -3998,7 +4221,7 @@ function readCache() {
 }
 function writeCache(cache) {
   try {
-    mkdirSync3(path19.dirname(cachePath()), { mode: 448, recursive: true });
+    mkdirSync3(path20.dirname(cachePath()), { mode: 448, recursive: true });
     writeFileSync3(cachePath(), `${JSON.stringify(cache, null, 2)}
 `);
   } catch {
@@ -4035,7 +4258,7 @@ async function fetchText(url) {
 }
 async function fetchLatestVersions(previous) {
   const [cli, skill] = await Promise.all([
-    fetchJson(REGISTRY_LATEST_URL).then((body) => z24.object({ version: z24.string() }).parse(body).version).catch(() => null),
+    fetchJson(REGISTRY_LATEST_URL).then((body) => z25.object({ version: z25.string() }).parse(body).version).catch(() => null),
     fetchText(SKILL_SOURCE_URL).then((body) => SKILL_VERSION_PATTERN.exec(body)?.[1] ?? null).catch(() => null)
   ]);
   return {
@@ -4051,7 +4274,7 @@ function installedSkillVersions() {
   const versions = [];
   for (const root of roots) {
     for (const dir of dirs) {
-      const file = path19.join(root, dir, "skills", "artifact-cafe", "SKILL.md");
+      const file = path20.join(root, dir, "skills", "artifact-cafe", "SKILL.md");
       if (!existsSync3(file)) {
         continue;
       }
@@ -4179,10 +4402,14 @@ var publish2 = defineCommand({
     },
     dir: {
       default: ".",
-      description: "Directory to publish",
+      description: "File or directory to publish",
       type: "positional"
     },
     entry: { description: "Entry file (default: auto-detect)", type: "string" },
+    "expires-in": {
+      description: "Temporary lifetime: 30m, 1h, 7d (ordinary republishes preserve it)",
+      type: "string"
+    },
     folder: {
       description: "Publish into this workspace folder name (or id)",
       type: "string"
@@ -4207,7 +4434,10 @@ var publish2 = defineCommand({
       type: "string"
     }
   },
-  meta: { description: "Publish a folder as an artifact", name: "publish" },
+  meta: {
+    description: "Publish a file or folder as an artifact",
+    name: "publish"
+  },
   async run({ args }) {
     try {
       await publish({
@@ -4216,6 +4446,7 @@ var publish2 = defineCommand({
         description: readStringArg(process.argv.slice(2), "--description"),
         dir: args.dir,
         entry: args.entry,
+        expiresIn: args["expires-in"],
         folder: args.folder,
         json: Boolean(args.json),
         notes: readStringArg(process.argv.slice(2), "--notes"),
@@ -4471,6 +4702,48 @@ var link2 = defineCommand({
     }
   }
 });
+var expiration2 = defineCommand({
+  args: {
+    "api-key": {
+      description: "Account or agent token (default: env or login)",
+      type: "string"
+    },
+    artifact: {
+      description: "Artifact ID instead of the linked folder",
+      type: "string"
+    },
+    dir: {
+      default: ".",
+      description: "Published directory",
+      type: "positional"
+    },
+    in: { description: "Reset lifetime from now: 30m, 1h, 7d", type: "string" },
+    json: { description: "Machine-readable output", type: "boolean" },
+    keep: {
+      description: "Clear the explicit temporary deadline",
+      type: "boolean"
+    }
+  },
+  meta: {
+    description: "Extend a temporary artifact or keep it",
+    name: "expiration"
+  },
+  async run({ args }) {
+    try {
+      await expiration({
+        apiKey: args["api-key"],
+        artifact: args.artifact,
+        dir: args.dir,
+        duration: args.in,
+        json: Boolean(args.json),
+        keep: Boolean(args.keep)
+      });
+    } catch (err) {
+      printCliError(err, Boolean(args.json));
+      process.exitCode = 1;
+    }
+  }
+});
 var comments2 = defineCommand({
   args: {
     "api-key": {
@@ -5139,6 +5412,47 @@ var dataLsCommand = defineCommand({
     }
   }
 });
+var dataInsertCommand = defineCommand({
+  args: {
+    collection: {
+      description: "Collection name",
+      required: true,
+      type: "positional"
+    },
+    dir: {
+      default: ".",
+      description: "Published directory",
+      type: "positional"
+    },
+    file: {
+      description: "Read the record(s) from a JSON file instead of --record",
+      type: "string"
+    },
+    json: { description: "Machine-readable output", type: "boolean" },
+    record: {
+      description: "A JSON object, or an array of objects for a batch",
+      type: "string"
+    }
+  },
+  meta: {
+    description: "Insert one or many records into a collection",
+    name: "insert"
+  },
+  async run({ args }) {
+    try {
+      await dataInsert({
+        collection: args.collection,
+        dir: args.dir,
+        file: args.file,
+        json: Boolean(args.json),
+        record: args.record
+      });
+    } catch (err) {
+      printCliError(err, Boolean(args.json));
+      process.exit(1);
+    }
+  }
+});
 var dataExportCommand = defineCommand({
   args: {
     dir: {
@@ -5201,12 +5515,13 @@ var dataClearCommand = defineCommand({
 });
 var data = defineCommand({
   meta: {
-    description: "Read or clear the artifact's shared records",
+    description: "Read, insert, or clear the artifact's shared records",
     name: "data"
   },
   subCommands: {
     clear: dataClearCommand,
     export: dataExportCommand,
+    insert: dataInsertCommand,
     ls: dataLsCommand
   }
 });
@@ -5235,6 +5550,7 @@ var main = defineCommand({
     data,
     delete: del,
     edit,
+    expiration: expiration2,
     folders: folders2,
     link: link2,
     list: list2,