artifact-cafe 0.0.17 → 0.1.0

package/dist/index.js

@@ -11,7 +11,7 @@ var TICK_TOP = "   \u250C       \u2510";
 var GLYPH = "       \xE3";
 var TICK_BOTTOM = "   \u2514       \u2518";
 var WORDMARK = "   artifact.cafe";
-function printBanner() {
+var printBanner = () => {
   const color = Boolean(process.stdout.isTTY) && !process.env.NO_COLOR;
   const paint = (line, codes) => color ? `${codes}${line}${RESET}` : line;
   console.log();
@@ -21,10 +21,10 @@ function printBanner() {
   console.log();
   console.log(paint(WORDMARK, AMBER + BOLD));
   console.log();
-}
+};
 
 // src/comment.ts
-import path3 from "path";
+import path5 from "path";
 
 // ../shared/src/account.ts
 import { z } from "zod";
@@ -61,17 +61,37 @@ var meResponseSchema = z.object({
   keyName: z.string().optional(),
   userId: z.string()
 });
+var sessionSummarySchema = z.object({
+  createdAt: z.string(),
+  current: z.boolean(),
+  id: z.string(),
+  ipAddress: z.string().nullable(),
+  lastActiveAt: z.string(),
+  userAgent: z.string().nullable()
+});
+var sessionListResponseSchema = z.object({
+  sessions: z.array(sessionSummarySchema)
+});
+var revokeSessionsResponseSchema = z.object({
+  revoked: z.number().int().nonnegative()
+});
+var deleteAccountSchema = z.object({
+  confirmEmail: z.string().trim().min(1).max(320)
+});
+var deleteAccountResponseSchema = z.object({
+  deleted: z.literal(true)
+});
 var artifactListItemSchema = z.object({
-  autoDeleteAt: z.string().datetime().nullable().optional(),
+  autoDeleteAt: z.iso.datetime().nullable().optional(),
   createdAt: z.string(),
   currentVersionNumber: z.number().int().positive().nullable(),
-  expiresAt: z.string().datetime().nullable().optional(),
+  expiresAt: z.iso.datetime().nullable().optional(),
   id: z.string(),
   openCommentCount: z.number().int().nonnegative(),
   slug: z.string(),
   title: z.string(),
   updatedAt: z.string(),
-  url: z.string().url(),
+  url: z.url(),
   versionCount: z.number().int().nonnegative()
 });
 var artifactListResponseSchema = z.object({
@@ -86,7 +106,7 @@ var createAgentTokenSchema = z2.object({
   ttlSeconds: z2.number().int().positive().max(3600)
 });
 var agentTokenResponseSchema = z2.object({
-  expiresAt: z2.string().datetime(),
+  expiresAt: z2.iso.datetime(),
   token: z2.string(),
   workspaceId: z2.string()
 });
@@ -127,13 +147,13 @@ var AGENT_BRANDS = [
   },
   { id: "hermes", label: "Hermes", match: ["hermes"], short: "Hermes" }
 ];
-function normalizeAgent(raw) {
+var normalizeAgent = (raw) => {
   const value = raw?.trim().toLowerCase();
   if (!value) {
     return null;
   }
   return AGENT_BRANDS.find((brand) => brand.id === value) ?? AGENT_BRANDS.find((brand) => brand.match.some((m) => value.includes(m))) ?? null;
-}
+};
 var ENV_FINGERPRINTS = [
   { id: "claude-code", prefixes: ["CLAUDECODE", "CLAUDE_CODE_"] },
   { id: "codex", prefixes: ["CODEX_"] },
@@ -142,30 +162,24 @@ var ENV_FINGERPRINTS = [
   { id: "gemini-cli", prefixes: ["GEMINI_CLI", "GEMINI_SANDBOX"] },
   { id: "opencode", prefixes: ["OPENCODE"] }
 ];
-function detectAgentFromEnv(env) {
+var detectAgentFromEnv = (env) => {
   const explicit = env.ARTIFACT_CAFE_AGENT?.trim();
   if (explicit) {
     return explicit;
   }
   const keys = Object.keys(env).filter((key) => env[key]);
   for (const { id, prefixes } of ENV_FINGERPRINTS) {
-    const hit = keys.some(
-      (key) => prefixes.some((prefix) => key.startsWith(prefix))
-    );
+    const hit = keys.some((key) => prefixes.some((prefix) => key.startsWith(prefix)));
     if (hit) {
       return AGENT_BRANDS.find((brand) => brand.id === id)?.label;
     }
   }
   return normalizeAgent(env.AI_AGENT)?.label;
-}
+};
 
 // ../shared/src/avatars.ts
 import { z as z3 } from "zod";
-var AVATAR_CONTENT_TYPES = [
-  "image/png",
-  "image/jpeg",
-  "image/webp"
-];
+var AVATAR_CONTENT_TYPES = ["image/png", "image/jpeg", "image/webp"];
 var AVATAR_MAX_BYTES = 2 * 1024 * 1024;
 var avatarContentTypeSchema = z3.enum(AVATAR_CONTENT_TYPES);
 var userAvatarResponseSchema = z3.object({
@@ -181,10 +195,8 @@ import { z as z8 } from "zod";
 // ../shared/src/emoji.ts
 import { z as z4 } from "zod";
 var SINGLE_EMOJI = new RegExp("^\\p{RGI_Emoji}$", "v");
-var REDUNDANT_VS16 = new RegExp("(\\p{Emoji_Presentation})\\uFE0F", "gu");
-function canonicalizeEmoji(s) {
-  return s.replace(REDUNDANT_VS16, "$1");
-}
+var REDUNDANT_VS16 = new RegExp("(?<emoji>\\p{Emoji_Presentation})\\uFE0F", "gu");
+var canonicalizeEmoji = (s) => s.replace(REDUNDANT_VS16, "$1");
 var iconEmojiSchema = z4.string().max(64).transform(canonicalizeEmoji).refine((s) => SINGLE_EMOJI.test(s), { message: "Must be a single emoji." }).nullable().describe("A single emoji shown as the icon, or null for the default.");
 
 // ../shared/src/publish.ts
@@ -198,20 +210,24 @@ var setExpirationSchema = z5.object({
   expiresInSeconds: expirationSecondsSchema.nullable()
 });
 var expirationResponseSchema = z5.object({
-  autoDeleteAt: z5.string().datetime().nullable(),
-  expiresAt: z5.string().datetime().nullable()
-});
-function parseArtifactDuration(value) {
-  const match = /^([1-9]\d*)([mhd])$/.exec(value);
-  const units = { d: 86400, h: 3600, m: 60 };
-  const seconds = match ? Number(match[1]) * (units[match[2]] ?? 0) : 0;
+  autoDeleteAt: z5.iso.datetime().nullable(),
+  expiresAt: z5.iso.datetime().nullable()
+});
+var parseArtifactDuration = (value) => {
+  const match = /^(?<amount>[1-9]\d*)(?<unit>[mhd])$/u.exec(value);
+  const units = /* @__PURE__ */ new Map([
+    ["d", 86400],
+    ["h", 3600],
+    ["m", 60]
+  ]);
+  const seconds = match ? Number(match[1]) * (units.get(match[2] ?? "") ?? 0) : 0;
   if (!expirationSecondsSchema.safeParse(seconds).success) {
     throw new Error(
       `Duration must be a positive whole number followed by m, h, or d (for example 30m, 1h, 7d), up to ${MAX_EXPIRATION_SECONDS} seconds.`
     );
   }
   return seconds;
-}
+};
 
 // ../shared/src/review-mode.ts
 import { z as z6 } from "zod";
@@ -224,7 +240,7 @@ var reviewModeResponseSchema = z6.object({
 });
 
 // ../shared/src/publish.ts
-function isSafeArtifactPath(p) {
+var isSafeArtifactPath = (p) => {
   if (p.length === 0 || p.length > 1024) {
     return false;
   }
@@ -235,12 +251,12 @@ function isSafeArtifactPath(p) {
     return false;
   }
   return p.split("/").every((seg) => seg.length > 0 && seg !== "." && seg !== "..");
-}
+};
 var CARD_DESCRIPTION_MAX = 300;
 var CARD_IMAGE_MAX_BYTES = 5 * 1024 * 1024;
 var manifestFileSchema = z7.object({
-  hash: z7.string().regex(/^sha256_[a-f0-9]{64}$/),
-  mimeType: z7.string().regex(/^[-\w.+]+\/[-\w.+]+$/, { message: "invalid MIME type" }),
+  hash: z7.string().regex(/^sha256_[a-f0-9]{64}$/u),
+  mimeType: z7.string().regex(/^[-\w.+]+\/[-\w.+]+$/u, { message: "invalid MIME type" }),
   path: z7.string().min(1).max(1024).refine(isSafeArtifactPath, {
     message: "path must be a safe relative path"
   }),
@@ -253,6 +269,7 @@ var publishSourceSchema = z7.object({
 });
 var createPublishSessionSchema = z7.object({
   artifactId: z7.string().nullable(),
+  baseVersion: z7.number().int().positive().optional(),
   // One-line share-card summary (`--description`). Overrides whatever the
   // entry HTML declares; leave it off and the API reads the document's own
   // `og:description`/`description` at finalize.
@@ -264,6 +281,7 @@ var createPublishSessionSchema = z7.object({
   // members; the API enforces membership and folder ownership. folderId
   // without workspaceId resolves against the account's personal workspace.
   folderId: z7.string().min(1).optional(),
+  force: z7.boolean().optional(),
   // Bullet-point changelog for this version, authored by the publisher.
   // Optional on every publish (incl. v1); stored immutably on the version.
   notes: z7.string().max(4e3).optional(),
@@ -279,7 +297,7 @@ var publishSessionResponseSchema = z7.object({
     z7.object({
       method: z7.literal("PUT"),
       path: z7.string(),
-      uploadUrl: z7.string().url()
+      uploadUrl: z7.url()
     })
   ),
   publishSessionId: z7.string(),
@@ -288,15 +306,15 @@ var publishSessionResponseSchema = z7.object({
 });
 var finalizeResponseSchema = z7.object({
   artifactId: z7.string(),
-  autoDeleteAt: z7.string().datetime().nullable().optional(),
+  autoDeleteAt: z7.iso.datetime().nullable().optional(),
+  // Returned only on first publish of a new artifact (one-time).
+  claimUrl: z7.url().optional(),
   // API-key publishes create the artifact already claimed (SPEC §5.4) —
   // the CLI uses this to tell "claim URL pending" from "already yours".
   claimed: z7.boolean(),
-  // Returned only on first publish of a new artifact (one-time).
-  claimUrl: z7.string().url().optional(),
-  expiresAt: z7.string().datetime().nullable().optional(),
+  expiresAt: z7.iso.datetime().nullable().optional(),
   publishToken: z7.string().optional(),
-  url: z7.string().url(),
+  url: z7.url(),
   versionId: z7.string(),
   versionNumber: z7.number().int().positive(),
   // SPEC-2 §5.2 — who can open the review URL. A publish into a folder
@@ -308,16 +326,16 @@ var finalizeResponseSchema = z7.object({
   workspaceId: z7.string().nullable().optional()
 });
 var artifactResponseSchema = z7.object({
-  autoDeleteAt: z7.string().datetime().nullable().optional(),
+  autoDeleteAt: z7.iso.datetime().nullable().optional(),
   claimed: z7.boolean(),
   currentVersion: z7.object({
-    entryUrl: z7.string().url(),
+    entryUrl: z7.url(),
     id: z7.string(),
     versionNumber: z7.number().int().positive()
   }).nullable(),
   // Custom icon, or null to render the default document glyph.
   emoji: z7.string().nullable(),
-  expiresAt: z7.string().datetime().nullable().optional(),
+  expiresAt: z7.iso.datetime().nullable().optional(),
   // SPEC-2 §6.4 — placement + visibility surface on the artifact.
   folderId: z7.string().nullable(),
   id: z7.string(),
@@ -328,7 +346,7 @@ var artifactResponseSchema = z7.object({
   visibility: z7.enum(["public", "unlisted", "workspace", "private"]),
   workspaceId: z7.string().nullable()
 });
-function resolvePublishEntry(files, explicit) {
+var resolvePublishEntry = (files, explicit) => {
   if (explicit !== void 0) {
     if (!files.some((file) => file.path === explicit)) {
       throw new Error(`Entry file "${explicit}" is not in the manifest.`);
@@ -347,7 +365,7 @@ function resolvePublishEntry(files, explicit) {
     );
   }
   return htmlFiles[0]?.path;
-}
+};
 
 // ../shared/src/comments.ts
 var anchorPageSchema = z8.string().max(1024).refine(isSafeArtifactPath, {
@@ -533,17 +551,24 @@ var commentExportSchema = z8.object({
 var commentReadResponseSchema = z8.object({
   lastSeenAt: z8.string()
 });
-function elementLabel(el) {
+var elementLabel = (el) => {
   if (el.id) {
     return `<${el.tag}#${el.id}>`;
   }
   const classes = el.classes ? el.classes.split(" ").slice(0, 2) : [];
   return classes.length ? `<${el.tag}.${classes.join(".")}>` : `<${el.tag}>`;
-}
+};
 
 // ../shared/src/data.ts
+var canParseUrl = (value) => {
+  try {
+    return Boolean(new URL(value));
+  } catch {
+    return false;
+  }
+};
 var DATA_MANIFEST_PATH = ".artifact/data.json";
-var DATA_NAME_RE = /^[a-z][a-z0-9_]*$/;
+var DATA_NAME_RE = /^[a-z][a-z0-9_]*$/u;
 var DATA_NAME_MAX = 64;
 var DATA_RESERVED_FIELDS = /* @__PURE__ */ new Set([
   "id",
@@ -573,37 +598,53 @@ var DATA_ACCESS_DEFAULTS = {
   read: "public",
   update: "owner"
 };
-var DATA_RATE_LIMIT_RE = /^([1-9]\d{0,5})\/(hour|minute)\/ip$/;
+var DATA_RATE_LIMIT_RE = /^(?<count>[1-9]\d{0,5})\/(?<period>hour|minute)\/ip$/u;
 var isPlainObject = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
-function validateFieldValue(name, field, value, errors) {
+var validateStringField = (name, field, value, errors) => {
+  if (typeof value !== "string") {
+    errors.push(`${name}: expected a string`);
+    return value;
+  }
+  const s = field.trim ? value.trim() : value;
+  if (field.maxLength !== void 0 && s.length > field.maxLength) {
+    errors.push(`${name}: longer than maxLength ${field.maxLength}`);
+  }
+  return s;
+};
+var validateNumberField = (name, field, value, errors) => {
+  if (typeof value !== "number" || Number.isNaN(value) || !Number.isFinite(value)) {
+    errors.push(`${name}: expected a ${field.type}`);
+    return value;
+  }
+  if (field.type === "integer" && !Number.isInteger(value)) {
+    errors.push(`${name}: expected an integer`);
+  }
+  if (field.minimum !== void 0 && value < field.minimum) {
+    errors.push(`${name}: below minimum ${field.minimum}`);
+  }
+  if (field.maximum !== void 0 && value > field.maximum) {
+    errors.push(`${name}: above maximum ${field.maximum}`);
+  }
+  return value;
+};
+var validateArrayField = (name, field, value, errors) => {
+  if (!Array.isArray(value)) {
+    errors.push(`${name}: expected an array`);
+    return value;
+  }
+  if (field.maxLength !== void 0 && value.length > field.maxLength) {
+    errors.push(`${name}: more than maxLength ${field.maxLength} items`);
+  }
+  return value;
+};
+var validateFieldValue = (name, field, value, errors) => {
   switch (field.type) {
     case "string": {
-      if (typeof value !== "string") {
-        errors.push(`${name}: expected a string`);
-        return value;
-      }
-      const s = field.trim ? value.trim() : value;
-      if (field.maxLength !== void 0 && s.length > field.maxLength) {
-        errors.push(`${name}: longer than maxLength ${field.maxLength}`);
-      }
-      return s;
+      return validateStringField(name, field, value, errors);
     }
     case "number":
     case "integer": {
-      if (typeof value !== "number" || Number.isNaN(value) || !Number.isFinite(value)) {
-        errors.push(`${name}: expected a ${field.type}`);
-        return value;
-      }
-      if (field.type === "integer" && !Number.isInteger(value)) {
-        errors.push(`${name}: expected an integer`);
-      }
-      if (field.minimum !== void 0 && value < field.minimum) {
-        errors.push(`${name}: below minimum ${field.minimum}`);
-      }
-      if (field.maximum !== void 0 && value > field.maximum) {
-        errors.push(`${name}: above maximum ${field.maximum}`);
-      }
-      return value;
+      return validateNumberField(name, field, value, errors);
     }
     case "boolean": {
       if (typeof value !== "boolean") {
@@ -624,20 +665,13 @@ function validateFieldValue(name, field, value, errors) {
       return value;
     }
     case "email": {
-      if (typeof value !== "string" || !/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(value)) {
+      if (typeof value !== "string" || !/^[^\s@]+@[^\s@]+\.[^\s@]+$/u.test(value)) {
         errors.push(`${name}: expected an email address`);
       }
       return value;
     }
     case "array": {
-      if (!Array.isArray(value)) {
-        errors.push(`${name}: expected an array`);
-        return value;
-      }
-      if (field.maxLength !== void 0 && value.length > field.maxLength) {
-        errors.push(`${name}: more than maxLength ${field.maxLength} items`);
-      }
-      return value;
+      return validateArrayField(name, field, value, errors);
     }
     case "object": {
       if (!isPlainObject(value)) {
@@ -650,15 +684,8 @@ function validateFieldValue(name, field, value, errors) {
       return value;
     }
   }
-}
-function canParseUrl(value) {
-  try {
-    return Boolean(new URL(value));
-  } catch {
-    return false;
-  }
-}
-function validateRecordInput(collection, input, opts = {}) {
+};
+var validateRecordInput = (collection, input, opts = {}) => {
   if (!isPlainObject(input)) {
     return { errors: ["record body must be a JSON object"], ok: false };
   }
@@ -706,7 +733,7 @@ function validateRecordInput(collection, input, opts = {}) {
     return { errors, ok: false };
   }
   return { data: data2, ok: true };
-}
+};
 
 // ../shared/src/data-api.ts
 import { z as z9 } from "zod";
@@ -751,6 +778,18 @@ var dataClearResponseSchema = z9.object({
 
 // ../shared/src/data-manifest.ts
 import { z as z10 } from "zod";
+var defaultMatchesType = (field) => {
+  if (field.required && field.default === null) {
+    return false;
+  }
+  return validateRecordInput(
+    {
+      access: DATA_ACCESS_DEFAULTS,
+      fields: { value: { ...field, default: void 0 } }
+    },
+    { value: field.default }
+  ).ok;
+};
 var nameSchema = z10.string().max(DATA_NAME_MAX).regex(DATA_NAME_RE, "must match ^[a-z][a-z0-9_]*$");
 var fieldTypeSchema = z10.enum([
   "string",
@@ -765,8 +804,8 @@ var fieldTypeSchema = z10.enum([
 ]);
 var fieldSchema = z10.strictObject({
   default: z10.unknown().optional(),
-  maximum: z10.number().optional(),
   maxLength: z10.number().int().positive().optional(),
+  maximum: z10.number().optional(),
   minimum: z10.number().optional(),
   required: z10.boolean().optional(),
   trim: z10.boolean().optional(),
@@ -783,18 +822,6 @@ var fieldSchema = z10.strictObject({
     });
   }
 });
-function defaultMatchesType(field) {
-  if (field.required && field.default === null) {
-    return false;
-  }
-  return validateRecordInput(
-    {
-      access: DATA_ACCESS_DEFAULTS,
-      fields: { value: { ...field, default: void 0 } }
-    },
-    { value: field.default }
-  ).ok;
-}
 var accessLevelSchema = z10.enum(["public", "creator", "owner", "none"]);
 var accessSchema = z10.strictObject({
   delete: accessLevelSchema.default("owner"),
@@ -846,7 +873,7 @@ var dataManifestSchema = z10.strictObject({
     });
   }
 });
-function parseDataManifest(text) {
+var parseDataManifest = (text) => {
   if (new TextEncoder().encode(text).length > DATA_LIMITS.maxManifestBytes) {
     return {
       errors: [`manifest larger than ${DATA_LIMITS.maxManifestBytes} bytes`],
@@ -856,9 +883,9 @@ function parseDataManifest(text) {
   let raw;
   try {
     raw = JSON.parse(text);
-  } catch (err) {
+  } catch (error) {
     return {
-      errors: [`not valid JSON: ${err instanceof Error ? err.message : err}`],
+      errors: [`not valid JSON: ${error instanceof Error ? error.message : error}`],
       ok: false
     };
   }
@@ -872,13 +899,14 @@ function parseDataManifest(text) {
     };
   }
   return { config: parsed.data, ok: true };
-}
+};
 
 // ../shared/src/errors.ts
 import { z as z11 } from "zod";
 var apiErrorSchema = z11.object({
   code: z11.string(),
-  docsUrl: z11.string().url(),
+  currentVersion: z11.number().int().positive().nullable().optional(),
+  docsUrl: z11.url(),
   message: z11.string(),
   retryAfter: z11.number().int().positive().optional(),
   scope: z11.enum(["ip", "artifact"]).optional()
@@ -906,7 +934,7 @@ var createGrantSchema = z13.object({
 });
 var grantSchema = z13.object({
   createdAt: z13.string(),
-  email: z13.string().email().nullable(),
+  email: z13.email().nullable(),
   expiresAt: z13.string().nullable(),
   id: z13.string(),
   // The subject's avatar once they have an account; null otherwise.
@@ -923,7 +951,7 @@ var grantSchema = z13.object({
   userId: z13.string().nullable()
 });
 var createdGrantSchema = grantSchema.extend({
-  url: z13.string().url()
+  url: z13.url()
 });
 var grantListResponseSchema = z13.object({
   grants: z13.array(grantSchema),
@@ -948,7 +976,7 @@ var acceptGrantSchema = z13.object({
 var acceptGrantResponseSchema = z13.object({
   artifactId: z13.string(),
   // The review shell URL to land on, carrying ?invited=1 for the banner.
-  artifactUrl: z13.string().url(),
+  artifactUrl: z13.url(),
   slug: z13.string(),
   title: z13.string()
 });
@@ -974,7 +1002,7 @@ var sharedWithMeArtifactSchema = z13.object({
   artifactId: z13.string(),
   slug: z13.string(),
   title: z13.string(),
-  url: z13.string().url(),
+  url: z13.url(),
   // Who shared it, for the "Shared with me" list.
   workspaceName: z13.string()
 });
@@ -984,13 +1012,105 @@ var sharedWithMeListResponseSchema = z13.object({
 
 // ../shared/src/html-meta.ts
 var HEAD_SCAN_CHARS = 64 * 1024;
+var NAMED_ENTITIES = new Map(
+  Object.entries({
+    amp: "&",
+    apos: "'",
+    gt: ">",
+    lt: "<",
+    nbsp: " ",
+    quot: '"'
+  })
+);
 
 // ../shared/src/me.ts
 import { z as z15 } from "zod";
 
 // ../shared/src/workspaces.ts
 import { z as z14 } from "zod";
-var WORKSPACE_HANDLE_PATTERN = /^[a-z0-9](?:[a-z0-9-]{1,30}[a-z0-9])$/;
+
+// ../shared/src/reserved.ts
+var VANITY_REDIRECTS = /* @__PURE__ */ new Map([
+  ["bharath", "https://bharath-sd6csg.artifactcafe.dev/"],
+  ["demo", "https://artifact-cafe-demo-vsuadu.artifactcafe.dev/"],
+  ["wilson", "https://wilson-nxzuc4.artifactcafe.dev/"],
+  ["yulong", "https://yulong-hoae20.artifactcafe.dev/"]
+]);
+var RESERVED_SLUGS = /* @__PURE__ */ new Set([
+  ...VANITY_REDIRECTS.keys(),
+  "www",
+  "api",
+  "render",
+  // Former auth-provider subdomains; kept reserved so a custom slug can't
+  // shadow a future auth host.
+  "clerk",
+  "accounts",
+  "claim",
+  // The CLI key-management page lives at /cli (SPEC §6.14).
+  "cli",
+  "docs",
+  "admin",
+  "app",
+  "auth",
+  "login",
+  "signin",
+  "signup",
+  "sign-in",
+  "sign-up",
+  "account",
+  "settings",
+  "dashboard",
+  "workspace",
+  "static",
+  "assets",
+  "cdn",
+  "mail",
+  "email",
+  "status",
+  "blog",
+  "help",
+  "support",
+  "about",
+  "pricing",
+  "terms",
+  "privacy",
+  "examples",
+  "new",
+  "artifact",
+  "artifacts",
+  // Mail and DNS labels: a workspace holding one of these could receive
+  // provider verification mail or shadow a record on the apex zone.
+  "abuse",
+  "autodiscover",
+  "autoconfig",
+  "ftp",
+  "imap",
+  "mx",
+  "ns",
+  "ns1",
+  "ns2",
+  "postmaster",
+  "smtp",
+  "webmail",
+  // Security and legal contacts people expect to reach us at.
+  "legal",
+  "security",
+  // Product routes and environment names a subdomain shouldn't shadow.
+  "billing",
+  "dev",
+  "invite",
+  "invites",
+  "preview",
+  "staging",
+  "team",
+  "teams",
+  "test",
+  "user",
+  "users"
+]);
+
+// ../shared/src/workspaces.ts
+var WORKSPACE_HANDLE_PATTERN = /^[a-z0-9](?:[a-z0-9-]{1,30}[a-z0-9])$/u;
 var workspaceHandleUnavailableReasonSchema = z14.enum([
   "held",
   "invalid",
@@ -1045,7 +1165,7 @@ var deleteWorkspaceResponseSchema = z14.object({
 });
 var workspaceMemberSchema = z14.object({
   createdAt: z14.string(),
-  email: z14.string().email(),
+  email: z14.email(),
   image: z14.string().nullable(),
   name: z14.string(),
   role: workspaceRoleSchema,
@@ -1062,13 +1182,13 @@ var removeWorkspaceMemberResponseSchema = z14.object({
 });
 var createWorkspaceInviteSchema = z14.object({
   email: z14.string().trim().toLowerCase().email().optional(),
-  expiresAt: z14.string().datetime(),
+  expiresAt: z14.iso.datetime(),
   maxUses: z14.number().int().positive().optional(),
   role: workspaceInviteRoleSchema
 });
 var workspaceInviteSchema = z14.object({
   createdAt: z14.string(),
-  email: z14.string().email().nullable(),
+  email: z14.email().nullable(),
   expiresAt: z14.string(),
   id: z14.string(),
   maxUses: z14.number().int().positive().nullable(),
@@ -1077,7 +1197,7 @@ var workspaceInviteSchema = z14.object({
   useCount: z14.number().int().nonnegative()
 });
 var createdWorkspaceInviteSchema = workspaceInviteSchema.extend({
-  url: z14.string().url()
+  url: z14.url()
 });
 var workspaceInviteListResponseSchema = z14.object({
   invites: z14.array(workspaceInviteSchema)
@@ -1093,12 +1213,7 @@ var acceptWorkspaceInviteResponseSchema = z14.object({
   workspace: workspaceSchema
 });
 var folderVisibilitySchema = z14.enum(["public", "workspace"]);
-var artifactVisibilitySchema = z14.enum([
-  "public",
-  "unlisted",
-  "workspace",
-  "private"
-]);
+var artifactVisibilitySchema = z14.enum(["public", "unlisted", "workspace", "private"]);
 var createFolderSchema = z14.object({
   // Optional custom icon; omitted (or null) leaves the default glyph.
   emoji: iconEmojiSchema.optional(),
@@ -1142,12 +1257,12 @@ var deleteFolderResponseSchema = z14.object({
   deleted: z14.literal(true)
 });
 var workspaceArtifactSchema = z14.object({
-  autoDeleteAt: z14.string().datetime().nullable().optional(),
+  autoDeleteAt: z14.iso.datetime().nullable().optional(),
   createdAt: z14.string(),
   currentVersionNumber: z14.number().int().nullable(),
   // Custom icon, or null to render the default document glyph.
   emoji: z14.string().nullable(),
-  expiresAt: z14.string().datetime().nullable().optional(),
+  expiresAt: z14.iso.datetime().nullable().optional(),
   folderId: z14.string().nullable(),
   id: z14.string(),
   openCommentCount: z14.number().int().nonnegative(),
@@ -1155,7 +1270,7 @@ var workspaceArtifactSchema = z14.object({
   slug: z14.string(),
   title: z14.string(),
   updatedAt: z14.string(),
-  url: z14.string().url(),
+  url: z14.url(),
   versionCount: z14.number().int().nonnegative(),
   visibility: artifactVisibilitySchema
 });
@@ -1177,7 +1292,7 @@ var personSchema = z15.object({
   name: z15.string()
 });
 var ownArtifactSchema = z15.object({
-  autoDeleteAt: z15.string().datetime().nullable().optional(),
+  autoDeleteAt: z15.iso.datetime().nullable().optional(),
   // Everyone else who has published a version, oldest first. Any member may
   // publish a new one (SPEC-2 §5.1), so an artifact's byline is often more
   // than one person and the card stacks their faces rather than crediting
@@ -1248,12 +1363,12 @@ var revokePublishTokenResponseSchema = z15.object({
 
 // ../shared/src/owner.ts
 import { z as z16 } from "zod";
-var SLUG_PATTERN = /^[a-z0-9](?:[a-z0-9-]{1,61}[a-z0-9])$/;
+var SLUG_PATTERN = /^[a-z0-9](?:[a-z0-9-]{1,61}[a-z0-9])$/u;
 var claimResponseSchema = z16.object({
   artifactId: z16.string(),
   slug: z16.string(),
   title: z16.string(),
-  url: z16.string().url()
+  url: z16.url()
 });
 var updateArtifactSchema = z16.object({
   // Custom icon; explicit null clears it back to the default glyph.
@@ -1385,6 +1500,11 @@ var artifactStatsResponseSchema = z21.object({
 
 // ../shared/src/versions.ts
 import { z as z22 } from "zod";
+var versionFilesResponseSchema = z22.object({
+  files: z22.array(manifestFileSchema.extend({ downloadUrl: z22.url() })),
+  slug: z22.string(),
+  versionNumber: z22.number().int().positive()
+});
 var versionSourceSchema = z22.object({
   agentName: z22.string().nullable(),
   type: z22.string()
@@ -1398,7 +1518,7 @@ var versionSummarySchema = z22.object({
   // Absent for the first version — there is no previous version to diff against.
   changes: versionChangesSchema.nullable(),
   createdAt: z22.string(),
-  entryUrl: z22.string().url(),
+  entryUrl: z22.url(),
   fileCount: z22.number().int().nonnegative(),
   id: z22.string(),
   isCurrent: z22.boolean(),
@@ -1419,34 +1539,237 @@ var versionListResponseSchema = z22.object({
 });
 
 // src/agent-identity.ts
-function agentLabel(explicit) {
+var agentLabel = (explicit) => {
   if (explicit !== void 0) {
     return explicit.trim() || void 0;
   }
   return detectAgentFromEnv(process.env);
-}
+};
+
+// src/install-id.ts
+import { randomUUID } from "crypto";
+import { mkdirSync, readFileSync, renameSync, unlinkSync, writeFileSync } from "fs";
+import { homedir } from "os";
+import path from "path";
+var UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/iu;
+var resetInstallId = (file = path.join(homedir(), ".artifactcafe", "install-id")) => {
+  const temporary = `${file}.${randomUUID()}`;
+  try {
+    mkdirSync(path.dirname(file), { mode: 448, recursive: true });
+    writeFileSync(temporary, `${randomUUID()}
+`, { flag: "wx", mode: 384 });
+    renameSync(temporary, file);
+  } catch {
+  } finally {
+    try {
+      unlinkSync(temporary);
+    } catch {
+    }
+  }
+};
+var readInstallId = (file = path.join(homedir(), ".artifactcafe", "install-id")) => {
+  try {
+    mkdirSync(path.dirname(file), { mode: 448, recursive: true });
+    try {
+      writeFileSync(file, `${randomUUID()}
+`, { flag: "wx", mode: 384 });
+    } catch (error) {
+      if (!(error instanceof Error && "code" in error && error.code === "EEXIST")) {
+        return null;
+      }
+    }
+    const id = readFileSync(file, "utf-8").trim();
+    return UUID.test(id) ? id.toLowerCase() : null;
+  } catch {
+    return null;
+  }
+};
+
+// src/update.ts
+import { existsSync, mkdirSync as mkdirSync2, readFileSync as readFileSync2, writeFileSync as writeFileSync2 } from "fs";
+import { createRequire } from "module";
+import { homedir as homedir2 } from "os";
+import path2 from "path";
+import { z as z23 } from "zod";
+var REGISTRY_LATEST_URL = "https://registry.npmjs.org/artifact-cafe/latest";
+var SKILL_SOURCE_URL = "https://raw.githubusercontent.com/Artifact-Cafe/skill/main/artifact-cafe/SKILL.md";
+var SKILL_UPDATE_COMMAND = "npx skills add artifact-cafe/skill --skill artifact-cafe -g";
+var CHECK_TTL_MS = 24 * 60 * 60 * 1e3;
+var FETCH_TIMEOUT_MS = 2e3;
+var SKILL_VERSION_PATTERN = /\*\*Skill version:\s*(?<version>\d+\.\d+\.\d+)\*\*/u;
+var cacheSchema = z23.object({
+  checkedAt: z23.number(),
+  cliLatest: z23.string().nullable(),
+  skillLatest: z23.string().nullable(),
+  version: z23.literal(1)
+});
+var cliVersion = () => {
+  const pkg = z23.object({ version: z23.string() }).parse(createRequire(import.meta.url)("../package.json"));
+  return pkg.version;
+};
+var cachePath = () => path2.join(homedir2(), ".artifactcafe", "update-check.json");
+var readCache = () => {
+  try {
+    return cacheSchema.parse(JSON.parse(readFileSync2(cachePath(), "utf-8")));
+  } catch {
+    return null;
+  }
+};
+var writeCache = (cache) => {
+  try {
+    mkdirSync2(path2.dirname(cachePath()), { mode: 448, recursive: true });
+    writeFileSync2(cachePath(), `${JSON.stringify(cache, null, 2)}
+`);
+  } catch {
+  }
+};
+var parse = (value) => value.split(".").map((part) => Number.parseInt(part, 10) || 0);
+var isNewerVersion = (candidate, current) => {
+  const a = parse(candidate);
+  const b = parse(current);
+  for (let i = 0; i < 3; i += 1) {
+    if ((a[i] ?? 0) !== (b[i] ?? 0)) {
+      return (a[i] ?? 0) > (b[i] ?? 0);
+    }
+  }
+  return false;
+};
+var fetchCliVersion = async () => {
+  const url = REGISTRY_LATEST_URL;
+  const res = await fetch(url, {
+    signal: AbortSignal.timeout(FETCH_TIMEOUT_MS)
+  });
+  if (!res.ok) {
+    throw new Error(`GET ${url} \u2192 ${res.status}`);
+  }
+  return z23.object({ version: z23.string() }).parse(await res.json()).version;
+};
+var fetchText = async (url) => {
+  const res = await fetch(url, {
+    signal: AbortSignal.timeout(FETCH_TIMEOUT_MS)
+  });
+  if (!res.ok) {
+    throw new Error(`GET ${url} \u2192 ${res.status}`);
+  }
+  return res.text();
+};
+var fetchLatestVersions = async (previous) => {
+  const [cli, skill] = await Promise.all([
+    fetchCliVersion().catch(() => null),
+    fetchText(SKILL_SOURCE_URL).then((body) => SKILL_VERSION_PATTERN.exec(body)?.[1] ?? null).catch(() => null)
+  ]);
+  return {
+    checkedAt: Date.now(),
+    cliLatest: cli ?? previous?.cliLatest ?? null,
+    skillLatest: skill ?? previous?.skillLatest ?? null,
+    version: 1
+  };
+};
+var installedSkillVersions = () => {
+  const roots = [homedir2(), process.cwd()];
+  const dirs = [".agents", ".claude"];
+  const versions = [];
+  for (const root of roots) {
+    for (const dir of dirs) {
+      const file = path2.join(root, dir, "skills", "artifact-cafe", "SKILL.md");
+      if (!existsSync(file)) {
+        continue;
+      }
+      try {
+        const found = SKILL_VERSION_PATTERN.exec(readFileSync2(file, "utf-8"));
+        if (found?.[1]) {
+          versions.push(found[1]);
+        }
+      } catch {
+      }
+    }
+  }
+  return versions;
+};
+var updateChecksDisabled = () => Boolean(
+  process.env.ARTIFACT_CAFE_NO_UPDATE_CHECK ?? process.env.NO_UPDATE_NOTIFIER ?? process.env.CI
+);
+var startUpdateCheck = () => {
+  if (updateChecksDisabled()) {
+    return () => Promise.resolve();
+  }
+  const pending = (async () => {
+    try {
+      const cached = readCache();
+      if (cached && Date.now() - cached.checkedAt < CHECK_TTL_MS) {
+        return cached;
+      }
+      const fresh = await fetchLatestVersions(cached);
+      writeCache(fresh);
+      return fresh;
+    } catch {
+      return null;
+    }
+  })();
+  return async () => {
+    const latest = await pending;
+    if (!latest) {
+      return;
+    }
+    const notices = [];
+    const current = cliVersion();
+    if (latest.cliLatest && isNewerVersion(latest.cliLatest, current)) {
+      notices.push(
+        `[artifact-cafe] CLI update available: ${current} \u2192 ${latest.cliLatest}. Run commands via \`npx artifact-cafe@latest\`; update a global install with \`npm i -g artifact-cafe@latest\`.`
+      );
+    }
+    const { skillLatest } = latest;
+    if (skillLatest) {
+      const stale = installedSkillVersions().filter((version) => isNewerVersion(skillLatest, version)).sort((a, b) => isNewerVersion(a, b) ? 1 : -1);
+      if (stale.length > 0) {
+        notices.push(
+          `[artifact-cafe] Skill update available: ${stale[0]} \u2192 ${latest.skillLatest}. Update: \`${SKILL_UPDATE_COMMAND}\` (drop -g for a repo-local copy), then re-read SKILL.md.`
+        );
+      }
+    }
+    if (notices.length > 0) {
+      console.error(`
+${notices.join("\n")}`);
+    }
+  };
+};
 
 // src/api.ts
 var ApiRequestError = class extends Error {
-  constructor(status2, code, message, retryAfter) {
+  status;
+  code;
+  retryAfter;
+  currentVersion;
+  docsUrl;
+  constructor(status2, code, message, retryAfter, details = void 0) {
     super(message);
     this.status = status2;
     this.code = code;
     this.retryAfter = retryAfter;
+    this.currentVersion = details?.currentVersion;
+    this.docsUrl = details?.docsUrl;
     this.name = "ApiRequestError";
   }
-  status;
-  code;
-  retryAfter;
 };
-async function request(url, init, parse) {
+var accessHeaders = (env = process.env) => {
+  const id = env.CF_ACCESS_CLIENT_ID;
+  const secret = env.CF_ACCESS_CLIENT_SECRET;
+  return id && secret ? { "cf-access-client-id": id, "cf-access-client-secret": secret } : {};
+};
+var request = async (url, init, parse2) => {
   let res;
   try {
-    res = await fetch(url, init);
-  } catch (err) {
+    res = await fetch(url, {
+      ...init,
+      headers: {
+        ...Object.fromEntries(new Headers(init.headers)),
+        ...accessHeaders()
+      }
+    });
+  } catch (error) {
     throw new Error(
-      `Could not reach ${new URL(url).origin} \u2014 is the API up? (${err instanceof Error ? err.message : err})`,
-      { cause: err }
+      `Could not reach ${new URL(url).origin} \u2014 is the API up? (${error instanceof Error ? error.message : error})`,
+      { cause: error }
     );
   }
   const body = await res.json().catch(() => null);
@@ -1457,24 +1780,26 @@ async function request(url, init, parse) {
         res.status,
         parsed.data.code,
         parsed.data.message,
-        parsed.data.retryAfter
+        parsed.data.retryAfter,
+        parsed.data
       );
     }
-    throw new ApiRequestError(
-      res.status,
-      "unknown_error",
-      `API returned ${res.status}`
-    );
+    throw new ApiRequestError(res.status, "unknown_error", `API returned ${res.status}`);
+  }
+  return parse2(body);
+};
+var createApiClient = (apiUrl2, publishToken) => {
+  const base = apiUrl2.replace(/\/$/u, "");
+  const headers = new Headers({
+    "content-type": "application/json",
+    "x-artifact-cafe-cli-version": cliVersion()
+  });
+  const installId = readInstallId();
+  if (installId) {
+    headers.set("x-artifact-cafe-install-id", installId);
   }
-  return parse(body);
-}
-function createApiClient(apiUrl2, publishToken) {
-  const base = apiUrl2.replace(/\/$/, "");
-  const headers = {
-    "content-type": "application/json"
-  };
   if (publishToken) {
-    headers.authorization = `Bearer ${publishToken}`;
+    headers.set("authorization", `Bearer ${publishToken}`);
   }
   return {
     // SPEC §6.19 — mark the agent as actively waiting for feedback.
@@ -1482,25 +1807,25 @@ function createApiClient(apiUrl2, publishToken) {
     // SPEC §6.6.1 — mark an open thread acknowledged ("seen, working on
     // it") without resolving it. Publish token or account key only —
     // the server rejects guests.
-    async acknowledgeThread(threadId) {
+    acknowledgeThread(threadId) {
       return request(
         `${base}/api/v1/comment-threads/${threadId}/acknowledge`,
         { body: "{}", headers, method: "POST" },
         (d) => commentThreadSchema.parse(d)
       );
     },
-    async agentHeartbeat(artifactId, state) {
+    agentHeartbeat(artifactId, state) {
       return request(
         `${base}/api/v1/artifacts/${artifactId}/agent-presence`,
         {
-          ...state ? { body: JSON.stringify({ state }) } : {},
+          ...state ? { body: JSON.stringify({ state }) } : void 0,
           headers,
           method: "POST"
         },
         (d) => agentHeartbeatResponseSchema.parse(d)
       );
     },
-    async clearData(artifactId, collection) {
+    clearData(artifactId, collection) {
       return request(
         `${base}/api/v1/artifacts/${artifactId}/data/${encodeURIComponent(collection)}`,
         { headers, method: "DELETE" },
@@ -1509,7 +1834,7 @@ function createApiClient(apiUrl2, publishToken) {
     },
     // SPEC-2 §6.3 — create a folder in a workspace. Account key required
     // (owner/admin; in a personal workspace that's always the user).
-    async createFolder(workspaceId, body) {
+    createFolder(workspaceId, body) {
       return request(
         `${base}/api/v1/workspaces/${workspaceId}/folders`,
         { body: JSON.stringify(body), headers, method: "POST" },
@@ -1520,14 +1845,14 @@ function createApiClient(apiUrl2, publishToken) {
     // Authorized by this client's credential: the publish token (an agent
     // sharing a private draft) or an account key/session. The invitation
     // URL is returned exactly once, here.
-    async createGrant(artifactId, body) {
+    createGrant(artifactId, body) {
       return request(
         `${base}/api/v1/artifacts/${artifactId}/grants`,
         { body: JSON.stringify(body), headers, method: "POST" },
         (d) => createdGrantSchema.parse(d)
       );
     },
-    async createSession(body) {
+    createSession(body) {
       return request(
         `${base}/api/v1/publish`,
         { body: JSON.stringify(body), headers, method: "POST" },
@@ -1538,7 +1863,7 @@ function createApiClient(apiUrl2, publishToken) {
     // key belongs to (agent-originated review, §5.1 `comment`). The create
     // route rejects a bare publish token (agents respond, accounts
     // originate), so this must carry an account credential.
-    async createThread(artifactId, body) {
+    createThread(artifactId, body) {
       return request(
         `${base}/api/v1/artifacts/${artifactId}/comments`,
         { body: JSON.stringify(body), headers, method: "POST" },
@@ -1552,51 +1877,56 @@ function createApiClient(apiUrl2, publishToken) {
       await request(
         `${base}/api/v1/comment-messages/${messageId}`,
         { body: "{}", headers, method: "DELETE" },
-        () => void 0
+        () => {
+        }
       );
     },
     // SPEC §6.7.1 — edit a message you authored (new body + "edited" badge).
     // Same credential rule as delete; returns the updated thread.
-    async editMessage(messageId, body) {
+    editMessage(messageId, body) {
       return request(
         `${base}/api/v1/comment-messages/${messageId}`,
         { body: JSON.stringify({ body }), headers, method: "PATCH" },
         (d) => commentThreadSchema.parse(d)
       );
     },
-    async exportComments(artifactId, query) {
+    exportComments(artifactId, query, { poll = false } = {}) {
       const params = new URLSearchParams({
         status: query.status,
         version: query.version
       });
+      const exportHeaders = new Headers(headers);
+      if (poll) {
+        exportHeaders.set("x-artifact-cafe-poll", "1");
+      }
       return request(
         `${base}/api/v1/artifacts/${artifactId}/comments/export?${params}`,
-        { headers, method: "GET" },
+        { headers: exportHeaders, method: "GET" },
         (d) => commentExportSchema.parse(d)
       );
     },
-    async finalize(publishSessionId) {
+    finalize(publishSessionId) {
       return request(
         `${base}/api/v1/publish/${publishSessionId}/finalize`,
         { headers, method: "POST" },
         (d) => finalizeResponseSchema.parse(d)
       );
     },
-    async getArtifact(artifactId) {
+    getArtifact(artifactId) {
       return request(
         `${base}/api/v1/artifacts/${artifactId}`,
         { headers, method: "GET" },
         (d) => artifactResponseSchema.parse(d)
       );
     },
-    async getDataSummary(artifactId) {
+    getDataSummary(artifactId) {
       return request(
         `${base}/api/v1/artifacts/${artifactId}/data`,
         { headers, method: "GET" },
         (d) => dataSummaryResponseSchema.parse(d)
       );
     },
-    async insertData(artifactId, collection, fields) {
+    insertData(artifactId, collection, fields) {
       return request(
         `${base}/api/v1/artifacts/${artifactId}/data/${encodeURIComponent(collection)}`,
         { body: JSON.stringify(fields), headers, method: "POST" },
@@ -1604,7 +1934,7 @@ function createApiClient(apiUrl2, publishToken) {
       );
     },
     /** Owner-plane batch: up to DATA_LIMITS.maxInsertBatch, all-or-nothing. */
-    async insertDataBatch(artifactId, collection, records) {
+    insertDataBatch(artifactId, collection, records) {
       return request(
         `${base}/api/v1/artifacts/${artifactId}/data/${encodeURIComponent(collection)}`,
         { body: JSON.stringify(records), headers, method: "POST" },
@@ -1613,14 +1943,14 @@ function createApiClient(apiUrl2, publishToken) {
     },
     // SPEC §6.18 — everything owned by the account this client's API
     // key (or session) belongs to.
-    async listArtifacts() {
+    listArtifacts() {
       return request(
         `${base}/api/v1/artifacts`,
         { headers, method: "GET" },
         (d) => artifactListResponseSchema.parse(d)
       );
     },
-    async listData(artifactId, collection, query = {}) {
+    listData(artifactId, collection, query = {}) {
       const params = new URLSearchParams();
       if (query.limit !== void 0) {
         params.set("limit", String(query.limit));
@@ -1635,7 +1965,7 @@ function createApiClient(apiUrl2, publishToken) {
         (d) => dataListResponseSchema.parse(d)
       );
     },
-    async listFolders(workspaceId) {
+    listFolders(workspaceId) {
       return request(
         `${base}/api/v1/workspaces/${workspaceId}/folders`,
         { headers, method: "GET" },
@@ -1644,7 +1974,7 @@ function createApiClient(apiUrl2, publishToken) {
     },
     // SPEC-2 §6.6 — the artifact's grants (no plaintext tokens). Used by
     // `share --list` and to resolve an email → grant id for `unshare`.
-    async listGrants(artifactId) {
+    listGrants(artifactId) {
       return request(
         `${base}/api/v1/artifacts/${artifactId}/grants`,
         { headers, method: "GET" },
@@ -1653,14 +1983,14 @@ function createApiClient(apiUrl2, publishToken) {
     },
     // SPEC-2 §6.4 — every artifact in a workspace (members see all, with
     // each artifact's folderId). The only folder-aware artifact listing.
-    async listWorkspaceArtifacts(workspaceId) {
+    listWorkspaceArtifacts(workspaceId) {
       return request(
         `${base}/api/v1/workspaces/${workspaceId}/artifacts`,
         { headers, method: "GET" },
         (d) => workspaceArtifactListResponseSchema.parse(d)
       );
     },
-    async listWorkspaces() {
+    listWorkspaces() {
       return request(
         `${base}/api/v1/workspaces`,
         { headers, method: "GET" },
@@ -1669,7 +1999,7 @@ function createApiClient(apiUrl2, publishToken) {
     },
     // SPEC §6.14 — who the presented credential belongs to. Used by
     // `login` to verify a pasted key and by `whoami`.
-    async me() {
+    me() {
       return request(
         `${base}/api/v1/me`,
         { headers, method: "GET" },
@@ -1677,7 +2007,7 @@ function createApiClient(apiUrl2, publishToken) {
       );
     },
     // SPEC §6.7 — reopen a resolved thread. Same auth as resolve.
-    async reopenThread(threadId) {
+    reopenThread(threadId) {
       return request(
         `${base}/api/v1/comment-threads/${threadId}/reopen`,
         { body: "{}", headers, method: "POST" },
@@ -1690,7 +2020,7 @@ function createApiClient(apiUrl2, publishToken) {
     // payload — the credential is the identity. `via` names the tool: it
     // becomes the agent's byline on a token reply, a "via" label on an
     // account one.
-    async replyThread(threadId, body, via) {
+    replyThread(threadId, body, via) {
       return request(
         `${base}/api/v1/comment-threads/${threadId}/messages`,
         { body: JSON.stringify({ body, via }), headers, method: "POST" },
@@ -1699,7 +2029,7 @@ function createApiClient(apiUrl2, publishToken) {
     },
     // SPEC §6.6 — mark a thread resolved. Authorized by this client's
     // credential: the artifact's publish token, or the owner's account key.
-    async resolveThread(threadId) {
+    resolveThread(threadId) {
       return request(
         `${base}/api/v1/comment-threads/${threadId}/resolve`,
         { body: "{}", headers, method: "POST" },
@@ -1711,10 +2041,11 @@ function createApiClient(apiUrl2, publishToken) {
       await request(
         `${base}/api/v1/artifacts/${artifactId}/grants/${grantId}`,
         { headers, method: "DELETE" },
-        () => void 0
+        () => {
+        }
       );
     },
-    async setExpiration(artifactId, expiresInSeconds) {
+    setExpiration(artifactId, expiresInSeconds) {
       return request(
         `${base}/api/v1/artifacts/${artifactId}/expiration`,
         { body: JSON.stringify({ expiresInSeconds }), headers, method: "PUT" },
@@ -1723,7 +2054,7 @@ function createApiClient(apiUrl2, publishToken) {
     },
     // SPEC §6.16 — set a password (string) or clear it (null). Authorized
     // by the publish token this client was created with.
-    async setProtection(artifactId, password) {
+    setProtection(artifactId, password) {
       return request(
         `${base}/api/v1/artifacts/${artifactId}/protection`,
         { body: JSON.stringify({ password }), headers, method: "PUT" },
@@ -1733,7 +2064,7 @@ function createApiClient(apiUrl2, publishToken) {
     // SPEC-2 §5.8 — what reviewers may do once they can open it. Same
     // dual-auth as protection, so the publish token this client holds is
     // enough (an agent can close review on its own artifact).
-    async setReviewMode(artifactId, mode) {
+    setReviewMode(artifactId, mode) {
       return request(
         `${base}/api/v1/artifacts/${artifactId}/review-mode`,
         { body: JSON.stringify({ mode }), headers, method: "PUT" },
@@ -1743,16 +2074,23 @@ function createApiClient(apiUrl2, publishToken) {
     // SPEC.md §6.11 / SPEC-2 §6.4 — update an artifact (folder placement,
     // title, slug, visibility). Workspace-member action: account key only,
     // a publish token can't re-file.
-    async updateArtifact(artifactId, body) {
+    updateArtifact(artifactId, body) {
       return request(
         `${base}/api/v1/artifacts/${artifactId}`,
         { body: JSON.stringify(body), headers, method: "PATCH" },
         (d) => artifactResponseSchema.parse(d)
       );
+    },
+    versionFiles(artifactId, version) {
+      return request(
+        `${base}/api/v1/artifacts/${encodeURIComponent(artifactId)}/versions/${version}/files`,
+        { headers, method: "GET" },
+        (data2) => versionFilesResponseSchema.parse(data2)
+      );
     }
   };
-}
-async function uploadFile(uploadUrl, content, mimeType) {
+};
+var uploadFile = async (uploadUrl, content, mimeType) => {
   const res = await fetch(uploadUrl, {
     body: new Uint8Array(content),
     headers: {
@@ -1762,190 +2100,166 @@ async function uploadFile(uploadUrl, content, mimeType) {
     method: "PUT"
   });
   if (!res.ok) {
-    throw new Error(
-      `Upload failed (${res.status}): ${(await res.text()).slice(0, 200)}`
-    );
+    const responseBody = await res.text();
+    throw new Error(`Upload failed (${res.status}): ${responseBody.slice(0, 200)}`);
   }
-}
+};
 
 // src/config.ts
-import {
-  appendFileSync,
-  existsSync as existsSync2,
-  mkdirSync as mkdirSync2,
-  readFileSync as readFileSync2,
-  writeFileSync as writeFileSync2
-} from "fs";
-import path2 from "path";
-import { z as z24 } from "zod";
+import { appendFileSync, existsSync as existsSync3, mkdirSync as mkdirSync4, readFileSync as readFileSync4, writeFileSync as writeFileSync4 } from "fs";
+import path4 from "path";
+import { z as z25 } from "zod";
 
 // src/credentials.ts
-import { existsSync, mkdirSync, readFileSync, writeFileSync } from "fs";
-import { homedir } from "os";
-import path from "path";
-import { z as z23 } from "zod";
+import { existsSync as existsSync2, mkdirSync as mkdirSync3, readFileSync as readFileSync3, writeFileSync as writeFileSync3 } from "fs";
+import { homedir as homedir3 } from "os";
+import path3 from "path";
+import { z as z24 } from "zod";
 var DEFAULT_API_URL = "https://artifact.cafe";
-var credentialsSchema = z23.object({
-  keys: z23.record(z23.string(), z23.string()),
-  version: z23.literal(1)
+var credentialsSchema = z24.object({
+  keys: z24.record(z24.string(), z24.string()),
+  version: z24.literal(1)
 });
-function credentialsPath() {
-  return path.join(homedir(), ".artifactcafe", "credentials");
-}
-function apiOrigin(apiUrl2) {
-  return new URL(apiUrl2).origin;
-}
-function readCredentials() {
+var credentialsPath = () => path3.join(homedir3(), ".artifactcafe", "credentials");
+var apiOrigin = (apiUrl2) => new URL(apiUrl2).origin;
+var readCredentials = () => {
   const file = credentialsPath();
-  if (!existsSync(file)) {
+  if (!existsSync2(file)) {
     return { keys: {}, version: 1 };
   }
   try {
-    return credentialsSchema.parse(JSON.parse(readFileSync(file, "utf8")));
+    return credentialsSchema.parse(JSON.parse(readFileSync3(file, "utf-8")));
   } catch {
     return { keys: {}, version: 1 };
   }
-}
-function writeCredentials(credentials) {
+};
+var writeCredentials = (credentials) => {
   const file = credentialsPath();
-  mkdirSync(path.dirname(file), { mode: 448, recursive: true });
-  writeFileSync(file, `${JSON.stringify(credentials, null, 2)}
+  mkdirSync3(path3.dirname(file), { mode: 448, recursive: true });
+  writeFileSync3(file, `${JSON.stringify(credentials, null, 2)}
 `, {
     mode: 384
   });
-}
-function storedApiKey(apiUrl2) {
-  return readCredentials().keys[apiOrigin(apiUrl2)] ?? null;
-}
-function storeApiKey(apiUrl2, key) {
+};
+var storedApiKey = (apiUrl2) => readCredentials().keys[apiOrigin(apiUrl2)] ?? null;
+var storeApiKey = (apiUrl2, key) => {
   const credentials = readCredentials();
   credentials.keys[apiOrigin(apiUrl2)] = key;
   writeCredentials(credentials);
-}
-function removeApiKey(apiUrl2) {
+};
+var removeApiKey = (apiUrl2) => {
   const credentials = readCredentials();
   const origin = apiOrigin(apiUrl2);
   if (!(origin in credentials.keys)) {
     return false;
   }
-  delete credentials.keys[origin];
+  credentials.keys = Object.fromEntries(
+    Object.entries(credentials.keys).filter(([key]) => key !== origin)
+  );
   writeCredentials(credentials);
   return true;
-}
-function resolveApiKey(apiUrl2, flag) {
-  return flag ?? process.env.ARTIFACT_CAFE_API_KEY ?? storedApiKey(apiUrl2) ?? void 0;
-}
+};
+var resolveApiKey = (apiUrl2, flag) => flag ?? process.env.ARTIFACT_CAFE_API_KEY ?? storedApiKey(apiUrl2) ?? void 0;
 
 // src/config.ts
-var configSchema = z24.object({
-  apiUrl: z24.string(),
-  artifactId: z24.string(),
-  folder: z24.string().optional(),
-  folderId: z24.string().optional(),
+var CONFIG_DIR = ".artifactcafe";
+var ensureGitignored = (dir) => {
+  const gitignore = path4.join(dir, ".gitignore");
+  if (!existsSync3(gitignore)) {
+    return;
+  }
+  const lines = readFileSync4(gitignore, "utf-8").split(/\r?\n/u);
+  const present = lines.some((l) => {
+    const t = l.trim();
+    return t === CONFIG_DIR || t === `${CONFIG_DIR}/` || t === `/${CONFIG_DIR}` || t === `/${CONFIG_DIR}/`;
+  });
+  if (!present) {
+    appendFileSync(gitignore, `
+# artifact.cafe publish token
+${CONFIG_DIR}/
+`);
+  }
+};
+var configSchema = z25.object({
+  apiUrl: z25.string(),
+  artifactId: z25.string(),
+  baseVersion: z25.number().int().positive().optional(),
+  folder: z25.string().optional(),
+  folderId: z25.string().optional(),
   // Optional: a folder linked by `link` to an artifact you own carries no
   // token — owner actions authorize via your stored login instead. A first
   // publish still writes the anonymous-mode token here.
-  publishToken: z24.string().optional(),
-  slug: z24.string(),
-  url: z24.string(),
-  workspace: z24.string().optional(),
-  workspaceId: z24.string().optional(),
-  workspaceKind: z24.enum(["personal", "workspace"]).optional()
-});
-var projectConfigSchema = z24.object({
-  folder: z24.string().trim().min(1).optional(),
-  workspace: z24.string().trim().min(1)
-}).strict();
-var CONFIG_DIR = ".artifactcafe";
+  publishToken: z25.string().optional(),
+  slug: z25.string(),
+  url: z25.string(),
+  workspace: z25.string().optional(),
+  workspaceId: z25.string().optional(),
+  workspaceKind: z25.enum(["personal", "workspace"]).optional()
+});
+var projectConfigSchema = z25.strictObject({
+  folder: z25.string().trim().min(1).optional(),
+  workspace: z25.string().trim().min(1)
+});
 var CONFIG_FILE = "config.json";
 var PROJECT_CONFIG_FILE = "artifact-cafe.json";
-function readConfig(dir) {
-  const file = path2.join(dir, CONFIG_DIR, CONFIG_FILE);
-  if (!existsSync2(file)) {
+var readConfig = (dir) => {
+  const file = path4.join(dir, CONFIG_DIR, CONFIG_FILE);
+  if (!existsSync3(file)) {
     return null;
   }
   try {
-    return configSchema.parse(JSON.parse(readFileSync2(file, "utf8")));
+    return configSchema.parse(JSON.parse(readFileSync4(file, "utf-8")));
   } catch {
     return null;
   }
-}
-function writeConfig(dir, config) {
-  mkdirSync2(path2.join(dir, CONFIG_DIR), { recursive: true });
-  writeFileSync2(
-    path2.join(dir, CONFIG_DIR, CONFIG_FILE),
-    `${JSON.stringify(config, null, 2)}
-`,
-    { mode: 384 }
-  );
+};
+var writeConfig = (dir, config) => {
+  mkdirSync4(path4.join(dir, CONFIG_DIR), { recursive: true });
+  writeFileSync4(path4.join(dir, CONFIG_DIR, CONFIG_FILE), `${JSON.stringify(config, null, 2)}
+`, {
+    mode: 384
+  });
   ensureGitignored(dir);
-}
-function readProjectConfig(dir) {
-  let current = path2.resolve(dir);
+};
+var readProjectConfig = (dir) => {
+  let current = path4.resolve(dir);
   while (true) {
-    const file = path2.join(current, PROJECT_CONFIG_FILE);
-    if (existsSync2(file)) {
+    const file = path4.join(current, PROJECT_CONFIG_FILE);
+    if (existsSync3(file)) {
       try {
-        return projectConfigSchema.parse(
-          JSON.parse(readFileSync2(file, "utf8"))
-        );
+        return projectConfigSchema.parse(JSON.parse(readFileSync4(file, "utf-8")));
       } catch (error) {
-        const message = error instanceof z24.ZodError ? error.issues[0]?.message ?? "invalid project target" : "invalid JSON";
-        throw new Error(`Invalid ${file}: ${message}.`);
+        const message = error instanceof z25.ZodError ? error.issues[0]?.message ?? "invalid project target" : "invalid JSON";
+        throw new Error(`Invalid ${file}: ${message}.`, { cause: error });
       }
     }
-    if (existsSync2(path2.join(current, ".git"))) {
+    if (existsSync3(path4.join(current, ".git"))) {
       return null;
     }
-    const parent = path2.dirname(current);
+    const parent = path4.dirname(current);
     if (parent === current) {
       return null;
     }
     current = parent;
   }
-}
-function writeProjectConfig(dir, config) {
-  let root = path2.resolve(dir);
-  while (!existsSync2(path2.join(root, ".git"))) {
-    const parent = path2.dirname(root);
+};
+var writeProjectConfig = (dir, config) => {
+  let root = path4.resolve(dir);
+  while (!existsSync3(path4.join(root, ".git"))) {
+    const parent = path4.dirname(root);
     if (parent === root) {
-      root = path2.resolve(dir);
+      root = path4.resolve(dir);
       break;
     }
     root = parent;
   }
-  const file = path2.join(root, PROJECT_CONFIG_FILE);
-  writeFileSync2(
-    file,
-    `${JSON.stringify(projectConfigSchema.parse(config), null, 2)}
-`
-  );
+  const file = path4.join(root, PROJECT_CONFIG_FILE);
+  writeFileSync4(file, `${JSON.stringify(projectConfigSchema.parse(config), null, 2)}
+`);
   return file;
-}
-function ensureGitignored(dir) {
-  const gitignore = path2.join(dir, ".gitignore");
-  if (!existsSync2(gitignore)) {
-    return;
-  }
-  const lines = readFileSync2(gitignore, "utf8").split(/\r?\n/);
-  const present = lines.some((l) => {
-    const t = l.trim();
-    return t === CONFIG_DIR || t === `${CONFIG_DIR}/` || t === `/${CONFIG_DIR}` || t === `/${CONFIG_DIR}/`;
-  });
-  if (!present) {
-    appendFileSync(
-      gitignore,
-      `
-# artifact.cafe publish token
-${CONFIG_DIR}/
-`
-    );
-  }
-}
-function reviewUrl(apiUrl2, slug) {
-  return `${apiUrl2.replace(/\/$/, "")}/a/${slug}`;
-}
-function resolveArtifactTarget(dir, opts = {}) {
+};
+var reviewUrl = (apiUrl2, slug) => `${apiUrl2.replace(/\/$/u, "")}/a/${slug}`;
+var resolveArtifactTarget = (dir, opts = {}) => {
   const config = readConfig(dir);
   const apiUrl2 = process.env.ARTIFACT_CAFE_URL ?? config?.apiUrl ?? DEFAULT_API_URL;
   const artifactId = opts.artifact ?? process.env.ARTIFACT_CAFE_ARTIFACT_ID ?? config?.artifactId ?? null;
@@ -1959,26 +2273,24 @@ function resolveArtifactTarget(dir, opts = {}) {
   const credential = (apiKey?.startsWith("aat_") ? apiKey : void 0) ?? folderToken ?? process.env.ARTIFACT_CAFE_TOKEN ?? apiKey;
   const url = artifactId === config?.artifactId ? config.url : void 0;
   return { apiUrl: apiUrl2, artifactId, credential, url };
-}
+};
 
 // src/comment.ts
-async function readStdin() {
+var readStdin = async () => {
   if (process.stdin.isTTY) {
     return "";
   }
   const chunks = [];
   for await (const chunk of process.stdin) {
-    chunks.push(chunk);
+    chunks.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk));
   }
-  return Buffer.concat(chunks).toString("utf8");
-}
-function buildAnchor(opts) {
+  return Buffer.concat(chunks).toString("utf-8");
+};
+var buildAnchor = (opts) => {
   if (opts.quote !== void 0) {
     const quote = opts.quote.trim();
     if (!quote) {
-      throw new Error(
-        "--quote can't be empty. Omit it entirely for a page-level comment."
-      );
+      throw new Error("--quote can't be empty. Omit it entirely for a page-level comment.");
     }
     const anchor2 = {
       elementPath: "body",
@@ -2002,16 +2314,14 @@ function buildAnchor(opts) {
     anchor.page = opts.page;
   }
   return anchor;
-}
-async function comment(opts) {
+};
+var comment = async (opts) => {
   const body = (opts.body ?? await readStdin()).trim();
   if (!body) {
-    throw new Error(
-      'Nothing to post. Pass the comment with --body "\u2026", or pipe it on stdin.'
-    );
+    throw new Error('Nothing to post. Pass the comment with --body "\u2026", or pipe it on stdin.');
   }
   const anchor = buildAnchor(opts);
-  const dir = path3.resolve(opts.dir);
+  const dir = path5.resolve(opts.dir);
   const target = resolveArtifactTarget(dir, {
     apiKey: opts.apiKey,
     artifact: opts.artifact
@@ -2020,9 +2330,7 @@ async function comment(opts) {
   const client = createApiClient(target.apiUrl, credential);
   const artifact = await client.getArtifact(target.artifactId);
   if (!artifact.currentVersion) {
-    throw new Error(
-      "This artifact has no published version yet \u2014 publish before commenting."
-    );
+    throw new Error("This artifact has no published version yet \u2014 publish before commenting.");
   }
   let thread;
   try {
@@ -2035,13 +2343,14 @@ async function comment(opts) {
       // commenting with your key still says which tool typed it.
       via: agentLabel(opts.as ?? opts.via)
     });
-  } catch (err) {
-    if (err instanceof ApiRequestError && err.status === 401) {
+  } catch (error) {
+    if (error instanceof ApiRequestError && error.status === 401) {
       throw new Error(
-        "Publish tokens can't open threads. Run `artifact-cafe login` to comment as your account."
+        "Publish tokens can't open threads. Run `artifact-cafe login` to comment as your account.",
+        { cause: error }
       );
     }
-    throw err;
+    throw error;
   }
   if (opts.json) {
     console.log(
@@ -2061,64 +2370,19 @@ async function comment(opts) {
   const url = target.url ?? reviewUrl(target.apiUrl, artifact.slug);
   const where = anchor.type === "text" ? ` on \u201C${anchor.quote}\u201D` : " on the page";
   console.log(`\u2713 Opened thread ${thread.id}${where} \u2014 ${url}`);
-}
+};
 
 // src/comments.ts
-import path4 from "path";
-var STATUSES = ["open", "resolved", "all"];
-var VERSIONS = ["current", "all"];
-var pollSeconds = () => Number(process.env.AC_WAIT_POLL_SECONDS ?? 5);
-var settleSeconds = () => Number(process.env.AC_WAIT_SETTLE_SECONDS ?? 20);
-var WAIT_TIMEOUT_EXIT = 2;
-async function comments(opts) {
-  if (!STATUSES.includes(opts.status)) {
-    throw new Error(
-      `--status must be one of: ${STATUSES.join(", ")} (got "${opts.status}").`
-    );
-  }
-  if (!VERSIONS.includes(opts.version)) {
-    throw new Error(
-      `--version must be one of: ${VERSIONS.join(", ")} (got "${opts.version}").`
-    );
-  }
-  const status2 = opts.status;
-  const version = opts.version;
-  const dir = path4.resolve(opts.dir);
-  const target = resolveArtifactTarget(dir, {
-    apiKey: opts.apiKey,
-    artifact: opts.artifact
-  });
-  const client = createApiClient(target.apiUrl, target.credential);
-  const url = target.url ?? (opts.json ? "" : await deriveReviewUrl(client, target));
-  const ref = { artifactId: target.artifactId, url };
-  if (opts.wait) {
-    await waitForFeedback(client, ref, {
-      json: opts.json,
-      status: status2,
-      timeoutSeconds: opts.timeout,
-      version
-    });
-    return;
-  }
-  const data2 = await client.exportComments(target.artifactId, {
-    status: status2,
-    version
-  });
-  if (opts.json) {
-    console.log(JSON.stringify(data2, null, 2));
-    return;
-  }
-  printHuman(data2, url, status2, version);
-}
-async function deriveReviewUrl(client, target) {
+import path6 from "path";
+import { setTimeout as waitForTimeout } from "timers/promises";
+var deriveReviewUrl = async (client, target) => {
   const artifact = await client.getArtifact(target.artifactId);
   return reviewUrl(target.apiUrl, artifact.slug);
-}
-var sleep = (s) => new Promise((r) => setTimeout(r, s * 1e3));
-function messageCounts(data2) {
-  return new Map(data2.comments.map((t) => [t.id, 1 + t.replies.length]));
-}
-function diffThreads(baseline, data2) {
+};
+var messageCounts = (data2) => new Map(data2.comments.map((t) => [t.id, 1 + t.replies.length]));
+var sleep = (s) => waitForTimeout(s * 1e3);
+var pollSeconds = () => Number(process.env.AC_WAIT_POLL_SECONDS ?? 5);
+var diffThreads = (baseline, data2) => {
   const changed = [];
   for (const t of data2.comments) {
     const before = baseline.get(t.id);
@@ -2129,8 +2393,68 @@ function diffThreads(baseline, data2) {
     }
   }
   return changed;
-}
-async function waitForFeedback(client, config, opts) {
+};
+var settleSeconds = () => Number(process.env.AC_WAIT_SETTLE_SECONDS ?? 20);
+var indent = (text, pad) => text.split("\n").map((line) => pad + line).join("\n");
+var printThread = (t) => {
+  const marker = t.status === "resolved" ? "\u2713" : "\u25CF";
+  const date = t.createdAt.slice(0, 10);
+  const edited = t.editedAt && !t.deleted ? " \xB7 edited" : "";
+  let state = "";
+  if (t.status === "resolved" && t.resolvedBy) {
+    state = ` \xB7 resolved by ${t.resolvedBy.displayName}`;
+  } else if (t.status === "open" && t.acknowledgedAt) {
+    state = " \xB7 acknowledged";
+  }
+  console.log(`${marker} ${t.author} \xB7 v${t.versionNumber} \xB7 ${date} \xB7 ${t.id}${edited}${state}`);
+  if (t.anchor.type === "text") {
+    console.log(`  \u21B3 "${t.anchor.quote}"`);
+  } else if (t.anchor.type === "point") {
+    const el = t.anchor.element;
+    if (el) {
+      const text = el.text ? ` "${el.text}"` : "";
+      console.log(`  \u21B3 at ${elementLabel(el)}${text} \u2014 ${t.anchor.elementPath}`);
+    } else {
+      console.log(`  \u21B3 at ${t.anchor.elementPath}`);
+    }
+  } else {
+    console.log(t.anchor.page ? `  \u21B3 on ${t.anchor.page}` : "  \u21B3 page comment");
+  }
+  console.log(indent(t.deleted ? "[deleted]" : t.body, "  "));
+  for (const reply2 of t.replies) {
+    const replyEdited = reply2.editedAt && !reply2.deleted ? " (edited)" : "";
+    const replyBody = reply2.deleted ? "[deleted]" : reply2.body;
+    console.log(indent(`${reply2.author}: ${replyBody}${replyEdited}`, "    "));
+  }
+  console.log("");
+};
+var printWaitResult = (config, data2, changed, json) => {
+  if (json) {
+    console.log(
+      JSON.stringify(
+        {
+          artifactId: config.artifactId,
+          threads: changed,
+          timedOut: false,
+          versionNumber: data2.versionNumber
+        },
+        null,
+        2
+      )
+    );
+    return;
+  }
+  const plural = changed.length === 1 ? "" : "s";
+  console.log(`
+${changed.length} thread${plural} with new feedback \u2014 ${config.url}
+`);
+  for (const thread of changed) {
+    console.log(thread.change === "new" ? "NEW" : "UPDATED");
+    printThread(thread);
+  }
+};
+var WAIT_TIMEOUT_EXIT = 2;
+var waitForFeedback = async (client, config, opts) => {
   const query = { status: opts.status, version: opts.version };
   const baselineExport = await client.exportComments(config.artifactId, query);
   const baseline = messageCounts(baselineExport);
@@ -2150,11 +2474,11 @@ async function waitForFeedback(client, config, opts) {
     lastHeartbeat = Date.now();
     try {
       await client.agentHeartbeat(config.artifactId);
-    } catch (err) {
+    } catch (error) {
       if (!(opts.json || heartbeatWarned)) {
         heartbeatWarned = true;
         console.error(
-          `(presence heartbeat failed \u2014 reviewers won't see "Agent is listening": ${err instanceof Error ? err.message : err})`
+          `(presence heartbeat failed \u2014 reviewers won't see "Agent is listening": ${error instanceof Error ? error.message : error})`
         );
       }
     }
@@ -2163,7 +2487,7 @@ async function waitForFeedback(client, config, opts) {
   while (Date.now() < deadline) {
     await sleep(Math.min(pollSeconds(), (deadline - Date.now()) / 1e3));
     await heartbeat();
-    const data2 = await client.exportComments(config.artifactId, query);
+    const data2 = await client.exportComments(config.artifactId, query, { poll: true });
     if (diffThreads(baseline, data2).length === 0) {
       continue;
     }
@@ -2196,35 +2520,8 @@ async function waitForFeedback(client, config, opts) {
     );
   }
   process.exit(WAIT_TIMEOUT_EXIT);
-}
-function printWaitResult(config, data2, changed, json) {
-  if (json) {
-    console.log(
-      JSON.stringify(
-        {
-          artifactId: config.artifactId,
-          threads: changed,
-          timedOut: false,
-          versionNumber: data2.versionNumber
-        },
-        null,
-        2
-      )
-    );
-    return;
-  }
-  const plural = changed.length === 1 ? "" : "s";
-  console.log(
-    `
-${changed.length} thread${plural} with new feedback \u2014 ${config.url}
-`
-  );
-  for (const thread of changed) {
-    console.log(thread.change === "new" ? "NEW" : "UPDATED");
-    printThread(thread);
-  }
-}
-function printHuman(data2, url, status2, version) {
+};
+var printHuman = (data2, url, status2, version) => {
   const statusLabel = status2 === "all" ? "" : `${status2} `;
   let scope = "across all versions";
   if (version === "current") {
@@ -2235,73 +2532,68 @@ function printHuman(data2, url, status2, version) {
     return;
   }
   const plural = data2.comments.length === 1 ? "" : "s";
-  console.log(
-    `${data2.comments.length} ${statusLabel}thread${plural} ${scope} \u2014 ${url}
-`
-  );
+  console.log(`${data2.comments.length} ${statusLabel}thread${plural} ${scope} \u2014 ${url}
+`);
   for (const thread of data2.comments) {
     printThread(thread);
   }
-}
-function printThread(t) {
-  const marker = t.status === "resolved" ? "\u2713" : "\u25CF";
-  const date = t.createdAt.slice(0, 10);
-  const edited = t.editedAt && !t.deleted ? " \xB7 edited" : "";
-  let state = "";
-  if (t.status === "resolved" && t.resolvedBy) {
-    state = ` \xB7 resolved by ${t.resolvedBy.displayName}`;
-  } else if (t.status === "open" && t.acknowledgedAt) {
-    state = " \xB7 acknowledged";
+};
+var STATUSES = ["open", "resolved", "all"];
+var VERSIONS = ["current", "all"];
+var comments = async (opts) => {
+  const status2 = STATUSES.find((value) => value === opts.status);
+  if (!status2) {
+    throw new Error(`--status must be one of: ${STATUSES.join(", ")} (got "${opts.status}").`);
   }
-  console.log(
-    `${marker} ${t.author} \xB7 v${t.versionNumber} \xB7 ${date} \xB7 ${t.id}${edited}${state}`
-  );
-  if (t.anchor.type === "text") {
-    console.log(`  \u21B3 "${t.anchor.quote}"`);
-  } else if (t.anchor.type === "point") {
-    const el = t.anchor.element;
-    if (el) {
-      const text = el.text ? ` "${el.text}"` : "";
-      console.log(
-        `  \u21B3 at ${elementLabel(el)}${text} \u2014 ${t.anchor.elementPath}`
-      );
-    } else {
-      console.log(`  \u21B3 at ${t.anchor.elementPath}`);
-    }
-  } else {
-    console.log(t.anchor.page ? `  \u21B3 on ${t.anchor.page}` : "  \u21B3 page comment");
+  const version = VERSIONS.find((value) => value === opts.version);
+  if (!version) {
+    throw new Error(`--version must be one of: ${VERSIONS.join(", ")} (got "${opts.version}").`);
   }
-  console.log(indent(t.deleted ? "[deleted]" : t.body, "  "));
-  for (const reply2 of t.replies) {
-    const replyEdited = reply2.editedAt && !reply2.deleted ? " (edited)" : "";
-    const replyBody = reply2.deleted ? "[deleted]" : reply2.body;
-    console.log(indent(`${reply2.author}: ${replyBody}${replyEdited}`, "    "));
+  const dir = path6.resolve(opts.dir);
+  const target = resolveArtifactTarget(dir, {
+    apiKey: opts.apiKey,
+    artifact: opts.artifact
+  });
+  const client = createApiClient(target.apiUrl, target.credential);
+  const url = target.url ?? (opts.json ? "" : await deriveReviewUrl(client, target));
+  const ref = { artifactId: target.artifactId, url };
+  if (opts.wait) {
+    await waitForFeedback(client, ref, {
+      json: opts.json,
+      status: status2,
+      timeoutSeconds: opts.timeout,
+      version
+    });
+    return;
   }
-  console.log("");
-}
-function indent(text, pad) {
-  return text.split("\n").map((line) => pad + line).join("\n");
-}
+  const data2 = await client.exportComments(target.artifactId, {
+    status: status2,
+    version
+  });
+  if (opts.json) {
+    console.log(JSON.stringify(data2, null, 2));
+    return;
+  }
+  printHuman(data2, url, status2, version);
+};
 
 // src/dashboard.ts
-import path8 from "path";
+import path10 from "path";
 
 // src/publish.ts
 import { exec } from "child_process";
-import { readFileSync as readFileSync5, statSync as statSync2 } from "fs";
-import path7 from "path";
+import { readFileSync as readFileSync7, statSync as statSync2 } from "fs";
+import path9 from "path";
 import { createInterface } from "readline";
 
 // src/data.ts
-import { readFileSync as readFileSync3 } from "fs";
-import path5 from "path";
-function inspectDataManifest(files) {
+import { readFileSync as readFileSync5 } from "fs";
+import path7 from "path";
+var inspectDataManifest = (files) => {
   const info = { announcements: [] };
   const manifestFile = files.find((f) => f.path === DATA_MANIFEST_PATH);
   if (manifestFile) {
-    const parsed = parseDataManifest(
-      readFileSync3(manifestFile.absPath, "utf8")
-    );
+    const parsed = parseDataManifest(readFileSync5(manifestFile.absPath, "utf-8"));
     if (!parsed.ok) {
       throw new Error(
         `${DATA_MANIFEST_PATH} is invalid:
@@ -2309,13 +2601,8 @@ ${(parsed.errors ?? []).map((e) => `  - ${e}`).join("\n")}`
       );
     }
     info.config = parsed.config;
-    for (const [name, collection] of Object.entries(
-      parsed.config?.collections ?? {}
-    )) {
-      const bits = [
-        `read: ${collection.access.read}`,
-        `insert: ${collection.access.insert}`
-      ];
+    for (const [name, collection] of Object.entries(parsed.config?.collections ?? {})) {
+      const bits = [`read: ${collection.access.read}`, `insert: ${collection.access.insert}`];
       if (collection.access.update !== "owner") {
         bits.push(`update: ${collection.access.update}`);
       }
@@ -2328,15 +2615,13 @@ ${(parsed.errors ?? []).map((e) => `  - ${e}`).join("\n")}`
       info.announcements.push(`\u26C1 Data enabled: ${name} (${bits.join(", ")})`);
     }
     if (info.announcements.length === 0) {
-      info.announcements.push(
-        "\u26C1 Data disabled (empty collections in .artifact/data.json)"
-      );
+      info.announcements.push("\u26C1 Data disabled (empty collections in .artifact/data.json)");
     }
   }
   return info;
-}
-function requireLinkedArtifact(dir) {
-  const resolved = path5.resolve(dir);
+};
+var requireLinkedArtifact = (dir) => {
+  const resolved = path7.resolve(dir);
   const config = readConfig(resolved);
   if (!config) {
     throw new Error(
@@ -2349,8 +2634,8 @@ function requireLinkedArtifact(dir) {
     publishToken: resolveApiKey(process.env.ARTIFACT_CAFE_URL ?? config.apiUrl) ?? config.publishToken ?? process.env.ARTIFACT_CAFE_TOKEN,
     url: config.url
   };
-}
-async function dataLs(opts) {
+};
+var dataLs = async (opts) => {
   const linked = requireLinkedArtifact(opts.dir);
   const client = createApiClient(linked.apiUrl, linked.publishToken);
   const records = [];
@@ -2365,9 +2650,7 @@ async function dataLs(opts) {
   } while (cursor && (opts.limit === void 0 || records.length < opts.limit));
   const shown = opts.limit === void 0 ? records : records.slice(0, opts.limit);
   if (opts.json) {
-    console.log(
-      JSON.stringify({ collection: opts.collection, records: shown }, null, 2)
-    );
+    console.log(JSON.stringify({ collection: opts.collection, records: shown }, null, 2));
     return;
   }
   if (shown.length === 0) {
@@ -2375,40 +2658,40 @@ async function dataLs(opts) {
     return;
   }
   const plural = shown.length === 1 ? "" : "s";
-  console.log(
-    `${shown.length} record${plural} in "${opts.collection}" \u2014 ${linked.url}
-`
-  );
+  console.log(`${shown.length} record${plural} in "${opts.collection}" \u2014 ${linked.url}
+`);
   for (const record of shown) {
     const { created_at, created_by, id, updated_at: _u, ...fields } = record;
     const author = created_by ?? "anonymous";
     console.log(`\u25CF ${id} \xB7 ${String(created_at).slice(0, 10)} \xB7 ${author}`);
     console.log(`  ${JSON.stringify(fields)}`);
   }
-}
-var RECORD_SHAPE_HINT = `a JSON object or array of objects, e.g. '{"name":"Ada"}'`;
-function isRecord(value) {
-  return typeof value === "object" && value !== null && !Array.isArray(value);
-}
-async function dataInsert(opts) {
-  if (opts.record === void 0 === (opts.file === void 0)) {
-    throw new Error("Pass exactly one of --record '<json>' or --file <path>.");
+};
+var RECORD_INPUT_HINT = `a JSON object or array of objects, e.g. '{"name":"Ada"}'`;
+var isRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+var dataInsert = async (opts) => {
+  let text;
+  if (opts.record === void 0) {
+    if (opts.file === void 0) {
+      throw new Error("Pass exactly one of --record '<json>' or --file <path>.");
+    }
+    text = readFileSync5(opts.file, "utf-8");
+  } else {
+    if (opts.file !== void 0) {
+      throw new Error("Pass exactly one of --record '<json>' or --file <path>.");
+    }
+    text = opts.record;
   }
-  const text = opts.record ?? readFileSync3(opts.file, "utf8");
   let parsed;
   try {
     parsed = JSON.parse(text);
   } catch {
-    throw new Error(`Records must be ${RECORD_SHAPE_HINT}.`);
+    throw new Error(`Records must be ${RECORD_INPUT_HINT}.`);
   }
   const linked = requireLinkedArtifact(opts.dir);
   const client = createApiClient(linked.apiUrl, linked.publishToken);
   if (isRecord(parsed)) {
-    const record = await client.insertData(
-      linked.artifactId,
-      opts.collection,
-      parsed
-    );
+    const record = await client.insertData(linked.artifactId, opts.collection, parsed);
     if (opts.json) {
       console.log(JSON.stringify({ collection: opts.collection, record }));
       return;
@@ -2417,7 +2700,7 @@ async function dataInsert(opts) {
     return;
   }
   if (!(Array.isArray(parsed) && parsed.length > 0 && parsed.every(isRecord))) {
-    throw new Error(`Records must be ${RECORD_SHAPE_HINT}.`);
+    throw new Error(`Records must be ${RECORD_INPUT_HINT}.`);
   }
   const records = [];
   for (let i = 0; i < parsed.length; i += DATA_LIMITS.maxInsertBatch) {
@@ -2428,22 +2711,22 @@ async function dataInsert(opts) {
         parsed.slice(i, i + DATA_LIMITS.maxInsertBatch)
       );
       records.push(...page.records);
-    } catch (err) {
+    } catch (error) {
       if (records.length === 0) {
-        throw err;
+        throw error;
       }
       const note = ` (the first ${records.length} records were inserted; records ${i}+ may not have been)`;
-      if (err instanceof ApiRequestError) {
+      if (error instanceof ApiRequestError) {
         throw new ApiRequestError(
-          err.status,
-          err.code,
-          `${err.message}${note}`,
-          err.retryAfter
+          error.status,
+          error.code,
+          `${error.message}${note}`,
+          error.retryAfter
         );
       }
-      throw new Error(
-        `${err instanceof Error ? err.message : String(err)}${note}`
-      );
+      throw new Error(`${error instanceof Error ? error.message : String(error)}${note}`, {
+        cause: error
+      });
     }
   }
   if (opts.json) {
@@ -2451,11 +2734,9 @@ async function dataInsert(opts) {
     return;
   }
   const plural = records.length === 1 ? "" : "s";
-  console.log(
-    `Inserted ${records.length} record${plural} into "${opts.collection}".`
-  );
-}
-async function dataExport(opts) {
+  console.log(`Inserted ${records.length} record${plural} into "${opts.collection}".`);
+};
+var dataExport = async (opts) => {
   const linked = requireLinkedArtifact(opts.dir);
   const client = createApiClient(linked.apiUrl, linked.publishToken);
   const summary = await client.getDataSummary(linked.artifactId);
@@ -2485,8 +2766,8 @@ async function dataExport(opts) {
       2
     )
   );
-}
-async function dataClear(opts) {
+};
+var dataClear = async (opts) => {
   if (!opts.yes) {
     throw new Error(
       `Clearing "${opts.collection}" deletes every record in it. Re-run with --yes to confirm.`
@@ -2496,21 +2777,19 @@ async function dataClear(opts) {
   const client = createApiClient(linked.apiUrl, linked.publishToken);
   const result = await client.clearData(linked.artifactId, opts.collection);
   if (opts.json) {
-    console.log(
-      JSON.stringify({ cleared: result.cleared, collection: opts.collection })
-    );
+    console.log(JSON.stringify({ cleared: result.cleared, collection: opts.collection }));
     return;
   }
   console.log(`Cleared ${result.cleared} record(s) from "${opts.collection}".`);
-}
+};
 
 // src/manifest.ts
 import { createHash } from "crypto";
-import { lstatSync, readdirSync, readFileSync as readFileSync4, statSync } from "fs";
-import path6 from "path";
+import { lstatSync, readdirSync, readFileSync as readFileSync6, statSync } from "fs";
+import path8 from "path";
 var IGNORED_DIRS = /* @__PURE__ */ new Set([".git", "node_modules", ".artifactcafe"]);
 var IGNORED_FILES = /* @__PURE__ */ new Set([".DS_Store", "artifact-cafe.json"]);
-function isIgnoredFile(name) {
+var isIgnoredFile = (name) => {
   if (IGNORED_FILES.has(name)) {
     return true;
   }
@@ -2524,44 +2803,44 @@ function isIgnoredFile(name) {
     return true;
   }
   return false;
-}
-var MIME_TYPES = {
-  ".avif": "image/avif",
-  ".css": "text/css",
-  ".csv": "text/csv",
-  ".gif": "image/gif",
-  ".htm": "text/html",
-  ".html": "text/html",
-  ".ico": "image/x-icon",
-  ".jpeg": "image/jpeg",
-  ".jpg": "image/jpeg",
-  ".js": "text/javascript",
-  ".json": "application/json",
-  ".map": "application/json",
-  ".markdown": "text/markdown",
-  ".md": "text/markdown",
-  ".mjs": "text/javascript",
-  ".mp3": "audio/mpeg",
-  ".mp4": "video/mp4",
-  ".otf": "font/otf",
-  ".pdf": "application/pdf",
-  ".png": "image/png",
-  ".svg": "image/svg+xml",
-  ".ttf": "font/ttf",
-  ".txt": "text/plain",
-  ".wasm": "application/wasm",
-  ".wav": "audio/wav",
-  ".webm": "video/webm",
-  ".webp": "image/webp",
-  ".woff": "font/woff",
-  ".woff2": "font/woff2",
-  ".xml": "application/xml"
 };
-function mimeFor(filePath) {
-  return MIME_TYPES[path6.extname(filePath).toLowerCase()] ?? "application/octet-stream";
-}
-function localFile(absPath, rel) {
-  if (isIgnoredFile(path6.basename(rel)) || !isSafeArtifactPath(rel)) {
+var MIME_TYPES = new Map(
+  Object.entries({
+    ".avif": "image/avif",
+    ".css": "text/css",
+    ".csv": "text/csv",
+    ".gif": "image/gif",
+    ".htm": "text/html",
+    ".html": "text/html",
+    ".ico": "image/x-icon",
+    ".jpeg": "image/jpeg",
+    ".jpg": "image/jpeg",
+    ".js": "text/javascript",
+    ".json": "application/json",
+    ".map": "application/json",
+    ".markdown": "text/markdown",
+    ".md": "text/markdown",
+    ".mjs": "text/javascript",
+    ".mp3": "audio/mpeg",
+    ".mp4": "video/mp4",
+    ".otf": "font/otf",
+    ".pdf": "application/pdf",
+    ".png": "image/png",
+    ".svg": "image/svg+xml",
+    ".ttf": "font/ttf",
+    ".txt": "text/plain",
+    ".wasm": "application/wasm",
+    ".wav": "audio/wav",
+    ".webm": "video/webm",
+    ".webp": "image/webp",
+    ".woff": "font/woff",
+    ".woff2": "font/woff2",
+    ".xml": "application/xml"
+  })
+);
+var mimeFor = (filePath) => MIME_TYPES.get(path8.extname(filePath).toLowerCase()) ?? "application/octet-stream";
+var localFile = (absPath, rel) => {
+  if (isIgnoredFile(path8.basename(rel)) || !isSafeArtifactPath(rel)) {
     return null;
   }
   const { size } = statSync(absPath);
@@ -2570,28 +2849,19 @@ function localFile(absPath, rel) {
   }
   return {
     absPath,
-    hash: `sha256_${createHash("sha256").update(readFileSync4(absPath)).digest("hex")}`,
+    hash: `sha256_${createHash("sha256").update(readFileSync6(absPath)).digest("hex")}`,
     mimeType: mimeFor(rel),
     path: rel,
     size
   };
-}
-function scanPath(target) {
-  const stat = lstatSync(target);
-  if (stat.isDirectory()) {
-    return scanDirectory(target);
-  }
-  const rel = path6.basename(target);
-  const file = stat.isFile() ? localFile(target, rel) : null;
-  return file ? { files: [file], skipped: [] } : { files: [], skipped: [rel] };
-}
-function scanDirectory(dir) {
+};
+var scanDirectory = (dir) => {
   const files = [];
   const skipped = [];
-  function walk(current, relPrefix) {
+  const walk = (current, relPrefix) => {
     for (const entry of readdirSync(current, { withFileTypes: true })) {
       const rel = relPrefix ? `${relPrefix}/${entry.name}` : entry.name;
-      const abs = path6.join(current, entry.name);
+      const abs = path8.join(current, entry.name);
       if (entry.isSymbolicLink()) {
         skipped.push(rel);
         continue;
@@ -2614,14 +2884,21 @@ function scanDirectory(dir) {
       }
       files.push(file);
     }
-  }
+  };
   walk(dir, "");
   files.sort((a, b) => a.path.localeCompare(b.path));
   return { files, skipped };
-}
-function resolveEntry(files, explicit) {
-  return resolvePublishEntry(files, explicit);
-}
+};
+var scanPath = (target) => {
+  const stat = lstatSync(target);
+  if (stat.isDirectory()) {
+    return scanDirectory(target);
+  }
+  const rel = path8.basename(target);
+  const file = stat.isFile() ? localFile(target, rel) : null;
+  return file ? { files: [file], skipped: [] } : { files: [], skipped: [rel] };
+};
+var resolveEntry = (files, explicit) => resolvePublishEntry(files, explicit);
 
 // src/spinner.ts
 var FRAMES = ["\xE3", "\xE4", "\xE5"];
@@ -2629,18 +2906,19 @@ var INTERVAL_MS = 420;
 var AMBER2 = "\x1B[38;2;214;138;57m";
 var RESET2 = "\x1B[0m";
 var CLEAR_LINE = "\r\x1B[2K";
-function startBrewing(label, enabled) {
+var startBrewing = (label, enabled) => {
   const stream = process.stderr;
   if (!(enabled && stream.isTTY) || process.env.CI) {
-    return { stop: () => void 0 };
+    return {
+      stop: () => {
+      }
+    };
   }
   const color = !process.env.NO_COLOR;
   let frame = 0;
   const draw = () => {
     const glyph = FRAMES[frame % FRAMES.length];
-    stream.write(
-      `${CLEAR_LINE}  ${color ? `${AMBER2}${glyph}${RESET2}` : glyph} ${label}`
-    );
+    stream.write(`${CLEAR_LINE}  ${color ? `${AMBER2}${glyph}${RESET2}` : glyph} ${label}`);
     frame += 1;
   };
   draw();
@@ -2651,199 +2929,392 @@ function startBrewing(label, enabled) {
       stream.write(CLEAR_LINE);
     }
   };
-}
+};
 
 // src/publish.ts
-var UPLOAD_CONCURRENCY = 6;
-var REVIEW_LABEL = {
-  off: "off \u2014 plain artifact, no review tools",
-  open: "open \u2014 anyone with the link can comment",
-  readonly: "read-only \u2014 existing comments only"
+var accessNote = (visibility) => {
+  if (visibility === "workspace") {
+    return "Access: workspace members only \u2014 anyone else needs `artifact-cafe share <email>` to open it.";
+  }
+  if (visibility === "private") {
+    return "Access: private \u2014 you, the workspace's admins, and anyone you `artifact-cafe share` it with.";
+  }
+  return null;
 };
-async function publish(opts) {
-  const target = path7.resolve(opts.dir);
-  const dir = statSync2(target).isFile() ? path7.dirname(target) : target;
-  const config = readConfig(dir);
-  const expiresInSeconds = opts.expiresIn === void 0 ? void 0 : parseArtifactDuration(opts.expiresIn);
-  if (opts.password !== void 0) {
-    const parsed = gatePasswordSchema.safeParse(opts.password);
-    if (!parsed.success) {
-      throw new Error(parsed.error.issues[0]?.message ?? "Invalid password.");
+var shouldPromptForWorkspace = (opts) => {
+  if (opts.json || process.env.ARTIFACT_CAFE_AGENT) {
+    return false;
+  }
+  return Boolean(process.stdin.isTTY && process.stdout.isTTY);
+};
+var pickWorkspace = (workspaces3) => {
+  const choices = [...workspaces3].sort((a, b) => {
+    if (a.isPersonal !== b.isPersonal) {
+      return a.isPersonal ? -1 : 1;
     }
+    return a.name.localeCompare(b.name);
+  });
+  console.log("Where should this artifact live?\n");
+  for (const [index, workspace] of choices.entries()) {
+    const label = workspace.isPersonal ? "Personal" : workspace.name;
+    const handle = workspace.isPersonal ? "" : `  \xB7  ${workspace.handle}`;
+    console.log(`  ${String(index + 1).padStart(2)}. ${label}${handle}`);
   }
-  let reviewMode;
-  if (opts.review !== void 0) {
-    const parsed = reviewModeSchema.safeParse(opts.review);
-    if (!parsed.success) {
-      throw new Error("--review must be one of: open, readonly, off.");
+  const rl = createInterface({ input: process.stdin, output: process.stdout });
+  return new Promise((resolve2, reject) => {
+    rl.question(`
+Publish where? [1-${choices.length}]: `, (answer) => {
+      const index = Number(answer.trim()) - 1;
+      const workspace = choices[index];
+      if (!(Number.isInteger(index) && workspace)) {
+        rl.close();
+        reject(new Error(`Enter a number between 1 and ${choices.length}.`));
+        return;
+      }
+      if (workspace.isPersonal) {
+        rl.close();
+        resolve2({ remember: false, workspace });
+        return;
+      }
+      rl.question(
+        `Remember ${workspace.name} for new artifacts in this project? [y/N]: `,
+        (rememberAnswer) => {
+          rl.close();
+          resolve2({
+            remember: /^y(?:es)?$/iu.test(rememberAnswer.trim()),
+            workspace
+          });
+        }
+      );
+    });
+  });
+};
+var agentPlacement = (apiKey, opts) => {
+  if (apiKey?.startsWith("aat_")) {
+    if (opts.workspace !== void 0 || opts.folder !== void 0) {
+      throw new Error("An agent token selects its own workspace; omit --workspace and --folder.");
     }
-    reviewMode = parsed.data;
+    return {
+      destination: "workspace",
+      destinationLabel: "Agent token's workspace",
+      destinationSource: "agent-token"
+    };
+  }
+  return null;
+};
+var storedPlacement = (config, workspaceId, apiKey, apiUrl2) => {
+  const isPersonal = config.workspaceKind === "personal";
+  if (!(apiKey || isPersonal)) {
+    throw new Error(
+      `Publishing into workspace ${config.workspace ?? workspaceId} needs an account \u2014 run \`artifact-cafe login\` first (no API key for ${apiOrigin(apiUrl2)}).`
+    );
+  }
+  return {
+    destination: isPersonal ? "personal" : "workspace",
+    destinationLabel: isPersonal ? "Personal" : config.workspace ?? workspaceId,
+    destinationSource: "artifact-config",
+    ...config.folder ? { folder: config.folder } : void 0,
+    ...config.folderId ? { folderId: config.folderId } : void 0,
+    ...config.workspace ? { workspace: config.workspace } : void 0,
+    ...apiKey ? { publishWorkspaceId: workspaceId } : void 0,
+    workspaceId
+  };
+};
+var defaultPlacement = async (apiKey, apiUrl2, opts) => {
+  if (!apiKey) {
+    return {
+      destination: "anonymous",
+      destinationLabel: "Anonymous",
+      destinationSource: "anonymous-default"
+    };
+  }
+  if (shouldPromptForWorkspace(opts)) {
+    const data2 = await createApiClient(apiUrl2, apiKey).listWorkspaces();
+    if (data2.workspaces.length > 1) {
+      const choice = await pickWorkspace(data2.workspaces);
+      return {
+        destination: choice.workspace.isPersonal ? "personal" : "workspace",
+        destinationLabel: choice.workspace.isPersonal ? "Personal" : choice.workspace.name,
+        destinationSource: "interactive",
+        publishWorkspaceId: choice.workspace.id,
+        ...choice.remember ? {
+          rememberProjectDefault: {
+            workspace: choice.workspace.handle
+          }
+        } : void 0,
+        workspace: choice.workspace.handle,
+        workspaceId: choice.workspace.id
+      };
+    }
+  }
+  return {
+    destination: "personal",
+    destinationLabel: "Personal",
+    destinationSource: "personal-default"
+  };
+};
+var getPublishWorkspace = (workspaces3, opts, config, projectConfig) => {
+  const workspaceHandle = opts.workspace ?? config?.workspace ?? projectConfig?.workspace;
+  let workspace;
+  if (workspaceHandle) {
+    workspace = workspaces3.find((candidate) => candidate.handle === workspaceHandle);
+  } else if (config?.workspaceId) {
+    workspace = workspaces3.find((candidate) => candidate.id === config.workspaceId);
+  } else {
+    workspace = workspaces3.find((candidate) => candidate.isPersonal);
+  }
+  if (!workspace) {
+    const target = workspaceHandle ? `workspace with handle "${workspaceHandle}"` : "personal workspace";
+    throw new Error(`No ${target} belongs to this account.`);
   }
+  return workspace;
+};
+var publishingIdentity = (opts, config) => {
   const artifactId = opts.artifact ?? config?.artifactId ?? null;
   const token = (artifactId !== null && artifactId === config?.artifactId ? config.publishToken : void 0) ?? process.env.ARTIFACT_CAFE_TOKEN;
   const apiUrl2 = process.env.ARTIFACT_CAFE_URL ?? config?.apiUrl ?? DEFAULT_API_URL;
   const apiKey = resolveApiKey(apiUrl2, opts.apiKey);
   const usingAgentToken = apiKey?.startsWith("aat_") === true;
-  const placement = await resolvePlacement({
-    apiKey,
-    apiUrl: apiUrl2,
-    config,
-    isNewArtifact: artifactId === null,
-    opts: { ...opts, dir }
-  });
-  const { files, skipped } = scanPath(target);
-  if (files.length === 0) {
-    throw new Error(`Nothing to publish at ${target} (after ignore rules).`);
+  return { apiKey, apiUrl: apiUrl2, artifactId, token, usingAgentToken };
+};
+var resolveRequestedPlacement = async ({
+  apiKey,
+  apiUrl: apiUrl2,
+  config,
+  isNewArtifact,
+  opts,
+  projectConfig,
+  hasPlacementFlag
+}) => {
+  if (!isNewArtifact && opts.folder !== void 0 && opts.workspace === void 0 && !(config?.workspace || config?.workspaceId)) {
+    throw new Error("--folder requires --workspace or a stored workspace.");
   }
-  const entryPath = resolveEntry(files, opts.entry);
-  const dataInfo = inspectDataManifest(files);
-  const log = (msg) => {
-    if (!opts.json) {
-      console.log(msg);
-    }
+  const client = createApiClient(apiUrl2, apiKey);
+  const data2 = await client.listWorkspaces();
+  const workspace = getPublishWorkspace(data2.workspaces, opts, config, projectConfig);
+  const folderName = opts.workspace !== void 0 && opts.folder === void 0 ? void 0 : opts.folder ?? projectConfig?.folder;
+  const destinationSource = hasPlacementFlag ? "explicit" : "project-default";
+  const placement = {
+    destination: workspace.isPersonal ? "personal" : "workspace",
+    destinationLabel: workspace.isPersonal ? "Personal" : workspace.name,
+    destinationSource,
+    publishWorkspaceId: workspace.id,
+    workspace: workspace.handle,
+    workspaceId: workspace.id
   };
-  if (skipped.length) {
-    log(`  ignoring ${skipped.length} item(s): ${preview(skipped)}`);
+  if (!folderName) {
+    return placement;
   }
-  const sessionBody = {
-    artifactId,
-    ...expiresInSeconds === void 0 ? {} : { expiresInSeconds },
-    // Overrides the entry HTML's own meta description on the share card.
-    // Omitted entirely when absent, so the document keeps speaking for itself.
-    ...opts.description?.trim() ? { description: opts.description.trim() } : {},
-    entryPath,
-    files: files.map(({ absPath: _absPath, ...manifest }) => manifest),
-    ...placement.folderId ? { folderId: placement.folderId } : {},
-    // Agents often pass a double-quoted string where "\n" is a literal
-    // backslash-n; turn those back into real newlines so bullets survive.
-    ...opts.notes?.trim() ? { notes: opts.notes.replace(/\\n/g, "\n").trim() } : {},
-    source: {
-      // ARTIFACT_CAFE_AGENT if it's set, else whichever agent's environment
-      // we recognize — this is what names the agent on every reply to a
-      // thread opened against this version (§6.5).
-      agent: agentLabel(),
-      runId: process.env.ARTIFACT_CAFE_RUN_ID,
-      type: "cli"
-    },
-    title: opts.title,
-    ...placement.publishWorkspaceId ? { workspaceId: placement.publishWorkspaceId } : {}
-  };
-  let credential = apiKey ?? token;
-  let client = createApiClient(apiUrl2, credential);
-  let session;
-  try {
-    session = await client.createSession(sessionBody);
-  } catch (err) {
-    const keyRefused = apiKey !== void 0 && !usingAgentToken && token !== void 0 && apiKey !== token && artifactId !== null && err instanceof ApiRequestError && (err.status === 401 || err.status === 403);
-    if (!keyRefused) {
-      throw err;
-    }
-    credential = token;
-    client = createApiClient(apiUrl2, credential);
-    session = await client.createSession(sessionBody);
+  const folderData = await client.listFolders(workspace.id);
+  const matches = folderData.folders.filter(
+    (candidate) => candidate.name === folderName || candidate.id === folderName
+  );
+  if (matches.length === 0) {
+    throw new Error(`No folder named "${folderName}" exists in workspace ${workspace.handle}.`);
   }
-  if (expiresInSeconds !== void 0 && session.expiresInSeconds !== expiresInSeconds) {
+  if (matches.length > 1) {
     throw new Error(
-      "This API does not support temporary publishing. Nothing was uploaded or finalized; upgrade the API before using --expires-in."
+      `More than one folder is named "${folderName}" in workspace ${workspace.handle}; pass the folder id instead.`
     );
   }
-  const byPath = new Map(files.map((f) => [f.path, f]));
-  log(
-    `  uploading ${session.filesToUpload.length} file(s)` + (session.skippedFiles.length ? `, ${session.skippedFiles.length} unchanged` : "")
-  );
-  const presence = startPublishingPresence(client, session.artifactId);
-  const brewing = startBrewing("brewing\u2026", !opts.json);
-  try {
-    await inBatches(
-      session.filesToUpload,
-      UPLOAD_CONCURRENCY,
-      async (upload) => {
-        const file = byPath.get(upload.path);
-        if (!file) {
-          throw new Error(`Server asked for unknown file ${upload.path}`);
-        }
-        await uploadFile(
-          upload.uploadUrl,
-          readFileSync5(file.absPath),
-          file.mimeType
-        );
-      }
-    );
-  } catch (error) {
-    brewing.stop();
-    throw error;
-  } finally {
-    presence.stop();
+  const [folder] = matches;
+  if (!folder) {
+    throw new Error("The selected folder is unavailable.");
   }
-  let result;
-  try {
-    result = await client.finalize(session.publishSessionId);
-  } finally {
-    brewing.stop();
+  return { ...placement, folder: folder.name, folderId: folder.id };
+};
+var resolvePlacement = async (params) => {
+  const { apiKey, apiUrl: apiUrl2, config, isNewArtifact, opts } = params;
+  const agent = agentPlacement(apiKey, opts);
+  if (agent) {
+    return agent;
   }
-  if (usingAgentToken && result.workspaceId) {
-    placement.workspaceId = result.workspaceId;
+  const hasPlacementFlag = opts.workspace !== void 0 || opts.folder !== void 0;
+  if (!hasPlacementFlag && config?.workspaceId) {
+    return storedPlacement(config, config.workspaceId, apiKey, apiUrl2);
   }
-  const rememberedProjectFile = placement.rememberProjectDefault ? writeProjectConfig(dir, placement.rememberProjectDefault) : null;
-  const existingToken = !usingAgentToken && config?.artifactId === result.artifactId ? config.publishToken : void 0;
-  const shouldWriteConfig = usingAgentToken || result.publishToken !== void 0 || config?.artifactId === result.artifactId || opts.workspace !== void 0 || opts.folder !== void 0 || placement.workspaceId !== void 0;
-  if (shouldWriteConfig) {
-    writeConfig(dir, {
-      apiUrl: apiUrl2,
-      artifactId: result.artifactId,
-      ...placement.folder ? { folder: placement.folder } : {},
-      ...placement.folderId ? { folderId: placement.folderId } : {},
-      ...!usingAgentToken && (result.publishToken ?? existingToken) ? { publishToken: result.publishToken ?? existingToken } : {},
-      slug: slugFromUrl(result.url),
-      url: result.url,
-      ...placement.workspace ? { workspace: placement.workspace } : {},
-      ...placement.workspaceId ? { workspaceId: placement.workspaceId } : {},
-      ...placement.destination === "personal" || placement.destination === "workspace" ? { workspaceKind: placement.destination } : {}
-    });
+  if (!(hasPlacementFlag || isNewArtifact)) {
+    return {
+      destination: "existing-artifact",
+      destinationLabel: "Existing artifact",
+      destinationSource: "artifact-config"
+    };
   }
-  if (opts.password !== void 0) {
-    const protectClient = createApiClient(
-      apiUrl2,
-      credential ?? result.publishToken
+  const projectConfig = isNewArtifact ? readProjectConfig(opts.dir) : null;
+  const wantsWorkspace = opts.workspace !== void 0 || opts.folder !== void 0 || projectConfig !== null;
+  if (wantsWorkspace && !apiKey) {
+    throw new Error(
+      "Publishing into a workspace needs an account \u2014 run `artifact-cafe login` first."
     );
-    await protectClient.setProtection(result.artifactId, opts.password);
   }
-  if (reviewMode !== void 0) {
-    const reviewClient = createApiClient(
-      apiUrl2,
-      credential ?? result.publishToken
-    );
-    await reviewClient.setReviewMode(result.artifactId, reviewMode);
+  if (!(hasPlacementFlag || projectConfig)) {
+    return defaultPlacement(apiKey, apiUrl2, opts);
   }
-  if (opts.json) {
-    console.log(
-      JSON.stringify(
-        {
-          artifactId: result.artifactId,
-          autoDeleteAt: result.autoDeleteAt ?? null,
-          expiresAt: result.expiresAt ?? null,
-          ...dataInfo.config ? { data: dataInfo.config } : {},
-          claimed: result.claimed,
-          destination: placement.destination,
-          destinationSource: placement.destinationSource,
-          folder: placement.folder ?? null,
-          folderId: placement.folderId ?? null,
-          url: result.url,
-          versionNumber: result.versionNumber,
-          visibility: result.visibility ?? null,
-          workspace: placement.workspace ?? null,
-          workspaceId: placement.workspaceId ?? null,
-          ...result.claimUrl ? { claimUrl: result.claimUrl } : {},
-          ...opts.password === void 0 ? {} : { protected: true },
-          ...reviewMode === void 0 ? {} : { reviewMode },
-          filesUploaded: session.filesToUpload.map((f) => f.path),
-          ignored: skipped,
-          skippedFiles: session.skippedFiles
-        },
-        null,
-        2
-      )
-    );
+  return await resolveRequestedPlacement({ ...params, hasPlacementFlag, projectConfig });
+};
+var startPublishingPresence = (client, artifactId) => {
+  const beat = async () => {
+    try {
+      await client.agentHeartbeat(artifactId, "publishing");
+    } catch {
+    }
+  };
+  beat();
+  const timer = setInterval(beat, AGENT_PRESENCE.heartbeatSeconds * 1e3);
+  timer.unref();
+  return { stop: () => clearInterval(timer) };
+};
+var inBatches = async (items, concurrency, fn) => {
+  let next = 0;
+  const workers = Array.from({ length: Math.min(concurrency, items.length) }, async () => {
+    while (next < items.length) {
+      const item = items[next];
+      next += 1;
+      if (item === void 0) {
+        continue;
+      }
+      await fn(item);
+    }
+  });
+  await Promise.all(workers);
+};
+var slugFromUrl = (url) => url.split("/a/")[1] ?? "";
+var preview = (items) => items.slice(0, 5).join(", ") + (items.length > 5 ? ", \u2026" : "");
+var openInBrowser = (url) => {
+  let cmd = "xdg-open";
+  if (process.platform === "darwin") {
+    cmd = "open";
+  } else if (process.platform === "win32") {
+    cmd = "start";
+  }
+  exec(`${cmd} ${JSON.stringify(url)}`, () => {
+  });
+};
+var UPLOAD_CONCURRENCY = 6;
+var REVIEW_LABEL = {
+  off: "off \u2014 plain artifact, no review tools",
+  open: "open \u2014 anyone with the link can comment",
+  readonly: "read-only \u2014 existing comments only"
+};
+var createSessionBody = ({
+  artifactId,
+  baseVersion,
+  entryPath,
+  expiresInSeconds,
+  files,
+  opts,
+  placement
+}) => ({
+  artifactId,
+  ...baseVersion === void 0 ? void 0 : { baseVersion },
+  ...opts.force ? { force: true } : void 0,
+  ...expiresInSeconds === void 0 ? void 0 : { expiresInSeconds },
+  // Overrides the entry HTML's own meta description on the share card.
+  // Omitted entirely when absent, so the document keeps speaking for itself.
+  ...opts.description?.trim() ? { description: opts.description.trim() } : void 0,
+  entryPath,
+  files: files.map(({ absPath: _absPath, ...manifest }) => manifest),
+  ...placement.folderId ? { folderId: placement.folderId } : void 0,
+  // Agents often pass a double-quoted string where "\n" is a literal
+  // backslash-n; turn those back into real newlines so bullets survive.
+  ...opts.notes?.trim() ? { notes: opts.notes.replaceAll("\\n", "\n").trim() } : void 0,
+  source: {
+    // ARTIFACT_CAFE_AGENT if it's set, else whichever agent's environment
+    // we recognize — this is what names the agent on every reply to a
+    // thread opened against this version (§6.5).
+    agent: agentLabel(),
+    runId: process.env.ARTIFACT_CAFE_RUN_ID,
+    type: "cli"
+  },
+  title: opts.title,
+  ...placement.publishWorkspaceId ? { workspaceId: placement.publishWorkspaceId } : void 0
+});
+var savePublishedConfig = ({
+  apiUrl: apiUrl2,
+  config,
+  dir,
+  opts,
+  placement,
+  result,
+  usingAgentToken
+}) => {
+  const publishToken = usingAgentToken ? void 0 : result.publishToken ?? (config?.artifactId === result.artifactId ? config.publishToken : void 0);
+  const shouldWriteConfig = usingAgentToken || result.publishToken !== void 0 || config?.artifactId === result.artifactId || opts.workspace !== void 0 || opts.folder !== void 0 || placement.workspaceId !== void 0;
+  if (shouldWriteConfig) {
+    writeConfig(dir, {
+      apiUrl: apiUrl2,
+      artifactId: result.artifactId,
+      baseVersion: result.versionNumber,
+      ...placement.folder ? { folder: placement.folder } : void 0,
+      ...placement.folderId ? { folderId: placement.folderId } : void 0,
+      ...publishToken ? { publishToken } : void 0,
+      slug: slugFromUrl(result.url),
+      url: result.url,
+      ...placement.workspace ? { workspace: placement.workspace } : void 0,
+      ...placement.workspaceId ? { workspaceId: placement.workspaceId } : void 0,
+      ...placement.destination === "personal" || placement.destination === "workspace" ? { workspaceKind: placement.destination } : void 0
+    });
+  }
+};
+var printPublishJson = ({
+  reviewMode,
+  dataInfo,
+  opts,
+  placement,
+  result,
+  session,
+  skipped
+}) => {
+  console.log(
+    JSON.stringify(
+      {
+        artifactId: result.artifactId,
+        autoDeleteAt: result.autoDeleteAt ?? null,
+        expiresAt: result.expiresAt ?? null,
+        ...dataInfo.config ? { data: dataInfo.config } : void 0,
+        claimed: result.claimed,
+        destination: placement.destination,
+        destinationSource: placement.destinationSource,
+        folder: placement.folder ?? null,
+        folderId: placement.folderId ?? null,
+        url: result.url,
+        versionNumber: result.versionNumber,
+        visibility: result.visibility ?? null,
+        workspace: placement.workspace ?? null,
+        workspaceId: placement.workspaceId ?? null,
+        ...result.claimUrl ? { claimUrl: result.claimUrl } : void 0,
+        ...opts.password === void 0 ? void 0 : { protected: true },
+        ...reviewMode === void 0 ? void 0 : { reviewMode },
+        filesUploaded: session.filesToUpload.map((f) => f.path),
+        ignored: skipped,
+        skippedFiles: session.skippedFiles
+      },
+      null,
+      2
+    )
+  );
+};
+var printPublishResult = ({
+  reviewMode,
+  dataInfo,
+  opts,
+  placement,
+  rememberedProjectFile,
+  result,
+  session,
+  skipped
+}) => {
+  if (opts.json) {
+    printPublishJson({
+      dataInfo,
+      opts,
+      placement,
+      rememberedProjectFile,
+      result,
+      reviewMode,
+      session,
+      skipped
+    });
   } else if (result.versionNumber === 1) {
     console.log("\n\u2713 Published to artifact.cafe\n");
     console.log(`Destination: ${placement.destinationLabel}
@@ -2861,11 +3332,9 @@ ${result.url}
 `);
     }
     if (result.claimUrl) {
-      console.log(
-        `Claim URL (shown once \u2014 claim to keep this artifact):
+      console.log(`Claim URL (shown once \u2014 claim to keep this artifact):
 ${result.claimUrl}
-`
-      );
+`);
     } else if (result.claimed && !result.expiresAt) {
       console.log("Claimed by your account \u2014 no expiry.\n");
     }
@@ -2912,269 +3381,172 @@ ${result.claimUrl}
       console.log(announcement);
     }
   }
-  if (opts.open && !opts.json && process.stdout.isTTY) {
-    openInBrowser(result.url);
-  }
-}
-function accessNote(visibility) {
-  if (visibility === "workspace") {
-    return "Access: workspace members only \u2014 anyone else needs `artifact-cafe share <email>` to open it.";
-  }
-  if (visibility === "private") {
-    return "Access: private \u2014 you, the workspace's admins, and anyone you `artifact-cafe share` it with.";
-  }
-  return null;
-}
-async function resolvePlacement(params) {
-  const { apiKey, apiUrl: apiUrl2, config, isNewArtifact, opts } = params;
-  if (apiKey?.startsWith("aat_")) {
-    if (opts.workspace !== void 0 || opts.folder !== void 0) {
-      throw new Error(
-        "An agent token selects its own workspace; omit --workspace and --folder."
-      );
+};
+var openPublishSession = async ({
+  apiKey,
+  token,
+  apiUrl: apiUrl2,
+  usingAgentToken,
+  artifactId,
+  sessionBody
+}) => {
+  let credential = apiKey ?? token;
+  let client = createApiClient(apiUrl2, credential);
+  let session;
+  try {
+    session = await client.createSession(sessionBody);
+  } catch (error) {
+    const keyRefused = apiKey !== void 0 && !usingAgentToken && token !== void 0 && apiKey !== token && artifactId !== null && error instanceof ApiRequestError && (error.status === 401 || error.status === 403);
+    if (!keyRefused) {
+      throw error;
     }
-    return {
-      destination: "workspace",
-      destinationLabel: "Agent token's workspace",
-      destinationSource: "agent-token"
-    };
+    credential = token;
+    client = createApiClient(apiUrl2, credential);
+    session = await client.createSession(sessionBody);
   }
-  const hasPlacementFlag = opts.workspace !== void 0 || opts.folder !== void 0;
-  if (!hasPlacementFlag && config?.workspaceId) {
-    const isPersonal = config.workspaceKind === "personal";
-    if (!(apiKey || isPersonal)) {
-      throw new Error(
-        `Publishing into workspace ${config.workspace ?? config.workspaceId} needs an account \u2014 run \`artifact-cafe login\` first (no API key for ${apiOrigin(apiUrl2)}).`
-      );
+  return { client, credential, session };
+};
+var validatePublishOptions = (opts) => {
+  const expiresInSeconds = opts.expiresIn === void 0 ? void 0 : parseArtifactDuration(opts.expiresIn);
+  if (opts.password !== void 0) {
+    const parsed = gatePasswordSchema.safeParse(opts.password);
+    if (!parsed.success) {
+      throw new Error(parsed.error.issues[0]?.message ?? "Invalid password.");
     }
-    return {
-      destination: isPersonal ? "personal" : "workspace",
-      destinationLabel: isPersonal ? "Personal" : config.workspace ?? config.workspaceId,
-      destinationSource: "artifact-config",
-      ...config.folder ? { folder: config.folder } : {},
-      ...config.folderId ? { folderId: config.folderId } : {},
-      ...config.workspace ? { workspace: config.workspace } : {},
-      ...apiKey ? { publishWorkspaceId: config.workspaceId } : {},
-      workspaceId: config.workspaceId
-    };
   }
-  if (!(hasPlacementFlag || isNewArtifact)) {
-    return {
-      destination: "existing-artifact",
-      destinationLabel: "Existing artifact",
-      destinationSource: "artifact-config"
-    };
+  let reviewMode;
+  if (opts.review !== void 0) {
+    const parsed = reviewModeSchema.safeParse(opts.review);
+    if (!parsed.success) {
+      throw new Error("--review must be one of: open, readonly, off.");
+    }
+    reviewMode = parsed.data;
   }
-  const projectConfig = isNewArtifact ? readProjectConfig(opts.dir) : null;
-  const wantsWorkspace = opts.workspace !== void 0 || opts.folder !== void 0 || projectConfig !== null;
-  if (wantsWorkspace && !apiKey) {
-    throw new Error(
-      "Publishing into a workspace needs an account \u2014 run `artifact-cafe login` first."
-    );
+  return { expiresInSeconds, reviewMode };
+};
+var publish = async (opts) => {
+  const target = path9.resolve(opts.dir);
+  const dir = statSync2(target).isFile() ? path9.dirname(target) : target;
+  const config = readConfig(dir);
+  const { expiresInSeconds, reviewMode } = validatePublishOptions(opts);
+  const { artifactId, token, apiUrl: apiUrl2, apiKey, usingAgentToken } = publishingIdentity(opts, config);
+  const placement = await resolvePlacement({
+    apiKey,
+    apiUrl: apiUrl2,
+    config,
+    isNewArtifact: artifactId === null,
+    opts: { ...opts, dir }
+  });
+  const { files, skipped } = scanPath(target);
+  if (files.length === 0) {
+    throw new Error(`Nothing to publish at ${target} (after ignore rules).`);
   }
-  if (!(hasPlacementFlag || projectConfig)) {
-    if (!apiKey) {
-      return {
-        destination: "anonymous",
-        destinationLabel: "Anonymous",
-        destinationSource: "anonymous-default"
-      };
-    }
-    if (shouldPromptForWorkspace(opts)) {
-      const data3 = await createApiClient(apiUrl2, apiKey).listWorkspaces();
-      if (data3.workspaces.length > 1) {
-        const choice = await pickWorkspace(data3.workspaces);
-        return {
-          destination: choice.workspace.isPersonal ? "personal" : "workspace",
-          destinationLabel: choice.workspace.isPersonal ? "Personal" : choice.workspace.name,
-          destinationSource: "interactive",
-          publishWorkspaceId: choice.workspace.id,
-          ...choice.remember ? {
-            rememberProjectDefault: {
-              workspace: choice.workspace.handle
-            }
-          } : {},
-          workspace: choice.workspace.handle,
-          workspaceId: choice.workspace.id
-        };
-      }
+  const entryPath = resolveEntry(files, opts.entry);
+  const dataInfo = inspectDataManifest(files);
+  const log = (msg) => {
+    if (!opts.json) {
+      console.log(msg);
     }
-    return {
-      destination: "personal",
-      destinationLabel: "Personal",
-      destinationSource: "personal-default"
-    };
-  }
-  if (!isNewArtifact && opts.folder !== void 0 && opts.workspace === void 0 && !(config?.workspace || config?.workspaceId)) {
-    throw new Error("--folder requires --workspace or a stored workspace.");
+  };
+  if (skipped.length) {
+    log(`  ignoring ${skipped.length} item(s): ${preview(skipped)}`);
   }
-  const client = createApiClient(apiUrl2, apiKey);
-  const data2 = await client.listWorkspaces();
-  const workspaceHandle = opts.workspace ?? config?.workspace ?? projectConfig?.workspace;
-  let workspace;
-  if (workspaceHandle) {
-    workspace = data2.workspaces.find(
-      (candidate) => candidate.handle === workspaceHandle
-    );
-  } else if (config?.workspaceId) {
-    workspace = data2.workspaces.find(
-      (candidate) => candidate.id === config.workspaceId
+  const sessionBody = createSessionBody({
+    artifactId,
+    baseVersion: artifactId === config?.artifactId ? config.baseVersion : void 0,
+    entryPath,
+    expiresInSeconds,
+    files,
+    opts,
+    placement
+  });
+  const { client, credential, session } = await openPublishSession({
+    apiKey,
+    apiUrl: apiUrl2,
+    artifactId,
+    sessionBody,
+    token,
+    usingAgentToken
+  });
+  if (expiresInSeconds !== void 0 && session.expiresInSeconds !== expiresInSeconds) {
+    throw new Error(
+      "This API does not support temporary publishing. Nothing was uploaded or finalized; upgrade the API before using --expires-in."
     );
-  } else {
-    workspace = data2.workspaces.find((candidate) => candidate.isPersonal);
   }
-  if (!workspace) {
-    const target = workspaceHandle ? `workspace with handle "${workspaceHandle}"` : "personal workspace";
-    throw new Error(`No ${target} belongs to this account.`);
+  const byPath = new Map(files.map((f) => [f.path, f]));
+  log(
+    `  uploading ${session.filesToUpload.length} file(s)${session.skippedFiles.length ? `, ${session.skippedFiles.length} unchanged` : ""}`
+  );
+  const presence = startPublishingPresence(client, session.artifactId);
+  const brewing = startBrewing("brewing\u2026", !opts.json);
+  try {
+    await inBatches(session.filesToUpload, UPLOAD_CONCURRENCY, async (upload) => {
+      const file = byPath.get(upload.path);
+      if (!file) {
+        throw new Error(`Server asked for unknown file ${upload.path}`);
+      }
+      await uploadFile(upload.uploadUrl, readFileSync7(file.absPath), file.mimeType);
+    });
+  } catch (error) {
+    brewing.stop();
+    throw error;
+  } finally {
+    presence.stop();
   }
-  const folderName = opts.workspace !== void 0 && opts.folder === void 0 ? void 0 : opts.folder ?? projectConfig?.folder;
-  const destinationSource = hasPlacementFlag ? "explicit" : "project-default";
-  if (!folderName) {
-    return {
-      destination: workspace.isPersonal ? "personal" : "workspace",
-      destinationLabel: workspace.isPersonal ? "Personal" : workspace.name,
-      destinationSource,
-      publishWorkspaceId: workspace.id,
-      workspace: workspace.handle,
-      workspaceId: workspace.id
-    };
+  let result;
+  try {
+    result = await client.finalize(session.publishSessionId);
+  } finally {
+    brewing.stop();
   }
-  const folderData = await client.listFolders(workspace.id);
-  const matches = folderData.folders.filter(
-    (candidate) => candidate.name === folderName || candidate.id === folderName
-  );
-  if (matches.length === 0) {
-    throw new Error(
-      `No folder named "${folderName}" exists in workspace ${workspace.handle}.`
-    );
+  if (usingAgentToken && result.workspaceId) {
+    placement.workspaceId = result.workspaceId;
   }
-  if (matches.length > 1) {
-    throw new Error(
-      `More than one folder is named "${folderName}" in workspace ${workspace.handle}; pass the folder id instead.`
-    );
+  const rememberedProjectFile = placement.rememberProjectDefault ? writeProjectConfig(dir, placement.rememberProjectDefault) : null;
+  savePublishedConfig({ apiUrl: apiUrl2, config, dir, opts, placement, result, usingAgentToken });
+  if (opts.password !== void 0) {
+    const protectClient = createApiClient(apiUrl2, credential ?? result.publishToken);
+    await protectClient.setProtection(result.artifactId, opts.password);
   }
-  const folder = matches[0];
-  return {
-    destination: workspace.isPersonal ? "personal" : "workspace",
-    destinationLabel: workspace.isPersonal ? "Personal" : workspace.name,
-    destinationSource,
-    folder: folder.name,
-    folderId: folder.id,
-    publishWorkspaceId: workspace.id,
-    workspace: workspace.handle,
-    workspaceId: workspace.id
-  };
-}
-function shouldPromptForWorkspace(opts) {
-  if (opts.json || process.env.ARTIFACT_CAFE_AGENT) {
-    return false;
+  if (reviewMode !== void 0) {
+    const reviewClient = createApiClient(apiUrl2, credential ?? result.publishToken);
+    await reviewClient.setReviewMode(result.artifactId, reviewMode);
   }
-  return Boolean(process.stdin.isTTY && process.stdout.isTTY);
-}
-function pickWorkspace(workspaces3) {
-  const choices = [...workspaces3].sort((a, b) => {
-    if (a.isPersonal !== b.isPersonal) {
-      return a.isPersonal ? -1 : 1;
-    }
-    return a.name.localeCompare(b.name);
-  });
-  console.log("Where should this artifact live?\n");
-  choices.forEach((workspace, index) => {
-    const label = workspace.isPersonal ? "Personal" : workspace.name;
-    const handle = workspace.isPersonal ? "" : `  \xB7  ${workspace.handle}`;
-    console.log(`  ${String(index + 1).padStart(2)}. ${label}${handle}`);
+  printPublishResult({
+    dataInfo,
+    opts,
+    placement,
+    rememberedProjectFile,
+    result,
+    reviewMode,
+    session,
+    skipped
   });
-  const rl = createInterface({ input: process.stdin, output: process.stdout });
-  return new Promise((resolve2, reject) => {
-    rl.question(`
-Publish where? [1-${choices.length}]: `, (answer) => {
-      const index = Number(answer.trim()) - 1;
-      const workspace = choices[index];
-      if (!(Number.isInteger(index) && workspace)) {
-        rl.close();
-        reject(new Error(`Enter a number between 1 and ${choices.length}.`));
-        return;
-      }
-      if (workspace.isPersonal) {
-        rl.close();
-        resolve2({ remember: false, workspace });
-        return;
-      }
-      rl.question(
-        `Remember ${workspace.name} for new artifacts in this project? [y/N]: `,
-        (rememberAnswer) => {
-          rl.close();
-          resolve2({
-            remember: /^y(?:es)?$/i.test(rememberAnswer.trim()),
-            workspace
-          });
-        }
-      );
-    });
-  });
-}
-function startPublishingPresence(client, artifactId) {
-  const beat = () => {
-    client.agentHeartbeat(artifactId, "publishing").catch(() => {
-    });
-  };
-  beat();
-  const timer = setInterval(beat, AGENT_PRESENCE.heartbeatSeconds * 1e3);
-  timer.unref();
-  return { stop: () => clearInterval(timer) };
-}
-async function inBatches(items, concurrency, fn) {
-  let next = 0;
-  const workers = Array.from(
-    { length: Math.min(concurrency, items.length) },
-    async () => {
-      while (next < items.length) {
-        const item = items[next];
-        next += 1;
-        if (item === void 0) {
-          continue;
-        }
-        await fn(item);
-      }
-    }
-  );
-  await Promise.all(workers);
-}
-function slugFromUrl(url) {
-  return url.split("/a/")[1] ?? "";
-}
-function preview(items) {
-  return items.slice(0, 5).join(", ") + (items.length > 5 ? ", \u2026" : "");
-}
-function openInBrowser(url) {
-  let cmd = "xdg-open";
-  if (process.platform === "darwin") {
-    cmd = "open";
-  } else if (process.platform === "win32") {
-    cmd = "start";
+  if (opts.open && !opts.json && process.stdout.isTTY) {
+    openInBrowser(result.url);
   }
-  exec(`${cmd} ${JSON.stringify(url)}`, () => {
-  });
-}
+};
 
 // src/dashboard.ts
-function openDashboard(opts) {
-  const base = process.env.ARTIFACT_CAFE_URL ?? readConfig(path8.resolve(opts.dir))?.apiUrl ?? DEFAULT_API_URL;
-  const url = `${base.replace(/\/$/, "")}/dashboard`;
+var openDashboard = (opts) => {
+  const base = process.env.ARTIFACT_CAFE_URL ?? readConfig(path10.resolve(opts.dir))?.apiUrl ?? DEFAULT_API_URL;
+  const url = `${base.replace(/\/$/u, "")}/dashboard`;
   console.log(url);
   if (process.stdout.isTTY) {
     openInBrowser(url);
   }
-}
+};
 
 // src/errors.ts
-function printCliError(err, json) {
+var printCliError = (err, json) => {
   if (err instanceof ApiRequestError) {
     if (json) {
       console.log(
         JSON.stringify({
           error: {
             code: err.code,
+            currentVersion: err.currentVersion,
+            docsUrl: err.docsUrl,
             message: err.message,
             retryAfter: err.retryAfter
           }
@@ -3199,20 +3571,20 @@ function printCliError(err, json) {
   } else {
     console.error(`\u2717 ${message}`);
   }
-}
+};
 
 // src/expiration.ts
-import path9 from "path";
-async function expiration(opts) {
+import path11 from "path";
+var expiration = async (opts) => {
   if (opts.duration !== void 0 === opts.keep) {
     throw new Error("Provide exactly one of --in <duration> or --keep.");
   }
-  const seconds = opts.keep ? null : parseArtifactDuration(opts.duration);
-  const target = resolveArtifactTarget(path9.resolve(opts.dir), opts);
-  const result = await createApiClient(
-    target.apiUrl,
-    target.credential
-  ).setExpiration(target.artifactId, seconds);
+  const seconds = opts.duration === void 0 ? null : parseArtifactDuration(opts.duration);
+  const target = resolveArtifactTarget(path11.resolve(opts.dir), opts);
+  const result = await createApiClient(target.apiUrl, target.credential).setExpiration(
+    target.artifactId,
+    seconds
+  );
   if (opts.json) {
     console.log(JSON.stringify(result, null, 2));
     return;
@@ -3228,10 +3600,41 @@ async function expiration(opts) {
       "Artifact kept \u2014 no automatic expiry. Its link, versions, and comments are preserved."
     );
   }
-}
+};
 
 // src/folders.ts
-async function folders(opts) {
+var createFolder = async (client, workspace, opts) => {
+  const name = opts.name?.trim();
+  if (!name) {
+    throw new Error("--name is required when creating a folder.");
+  }
+  const visibility = folderVisibilitySchema.parse(opts.visibility ?? "workspace");
+  const existing = await client.listFolders(workspace.id);
+  const duplicate = existing.folders.find(
+    (candidate) => candidate.name.toLowerCase() === name.toLowerCase()
+  );
+  if (duplicate) {
+    throw new Error(
+      `A folder named "${duplicate.name}" already exists in ${workspace.handle} (${duplicate.id}) \u2014 publish into it with --folder, or pick a different name.`
+    );
+  }
+  const folder = await client.createFolder(workspace.id, { name, visibility });
+  if (opts.json) {
+    console.log(JSON.stringify(folder, null, 2));
+    return;
+  }
+  console.log(`\u2713 Created folder "${folder.name}" (${folder.visibility}) in ${workspace.handle}`);
+  console.log(`  ${folder.id}`);
+  if (folder.visibility === "public") {
+    console.log("  Artifacts placed in it default to public \u2014 visible to anyone.");
+  }
+};
+var printFolder = (folder) => {
+  console.log(`${folder.name} (${folder.visibility})`);
+  console.log(`  ${folder.id}
+`);
+};
+var folders = async (opts) => {
   if (opts.action !== void 0 && opts.action !== "create") {
     throw new Error(
       `Unknown folders action "${opts.action}" \u2014 run \`folders\` to list, or \`folders create <name>\` to create one.`
@@ -3245,15 +3648,10 @@ async function folders(opts) {
     }
     const visibility = opts.visibility ?? "workspace";
     if (visibility !== "workspace" && visibility !== "public") {
-      throw new Error(
-        `--visibility must be "workspace" or "public" (got "${opts.visibility}").`
-      );
+      throw new Error(`--visibility must be "workspace" or "public" (got "${opts.visibility}").`);
     }
   }
-  const apiUrl2 = (process.env.ARTIFACT_CAFE_URL ?? DEFAULT_API_URL).replace(
-    /\/$/,
-    ""
-  );
+  const apiUrl2 = (process.env.ARTIFACT_CAFE_URL ?? DEFAULT_API_URL).replace(/\/$/u, "");
   const key = resolveApiKey(apiUrl2, opts.apiKey);
   if (!key) {
     throw new Error(
@@ -3266,9 +3664,7 @@ async function folders(opts) {
     (candidate) => candidate.handle === opts.workspace
   );
   if (!workspace) {
-    throw new Error(
-      `No workspace with handle "${opts.workspace}" belongs to this account.`
-    );
+    throw new Error(`No workspace with handle "${opts.workspace}" belongs to this account.`);
   }
   if (opts.action === "create") {
     await createFolder(client, workspace, opts);
@@ -3284,68 +3680,107 @@ async function folders(opts) {
     return;
   }
   const plural = data2.folders.length === 1 ? "" : "s";
-  console.log(
-    `${data2.folders.length} folder${plural} in ${workspace.handle}
-`
-  );
+  console.log(`${data2.folders.length} folder${plural} in ${workspace.handle}
+`);
   for (const folder of data2.folders) {
     printFolder(folder);
   }
-}
-async function createFolder(client, workspace, opts) {
-  const name = opts.name.trim();
-  const visibility = opts.visibility ?? "workspace";
-  const existing = await client.listFolders(workspace.id);
-  const duplicate = existing.folders.find(
-    (candidate) => candidate.name.toLowerCase() === name.toLowerCase()
+};
+
+// src/link.ts
+import path12 from "path";
+import { createInterface as createInterface2 } from "readline";
+
+// src/list.ts
+var printWorkspaceArtifact = (a) => {
+  const version = a.currentVersionNumber === null ? "no version" : `v${a.currentVersionNumber}`;
+  const open2 = a.openCommentCount === 0 ? "no open comments" : `${a.openCommentCount} open comment${a.openCommentCount === 1 ? "" : "s"}`;
+  const marker = a.openCommentCount > 0 ? "\u25CF" : "\u25CB";
+  console.log(`  ${marker} ${a.title} \u2014 ${version} \xB7 ${open2} \xB7 ${a.visibility}`);
+  console.log(`    ${a.url}`);
+};
+var listWorkspace = async (client, opts) => {
+  const workspaceData = await client.listWorkspaces();
+  const workspace = workspaceData.workspaces.find(
+    (candidate) => candidate.handle === opts.workspace
   );
-  if (duplicate) {
-    throw new Error(
-      `A folder named "${duplicate.name}" already exists in ${workspace.handle} (${duplicate.id}) \u2014 publish into it with --folder, or pick a different name.`
-    );
+  if (!workspace) {
+    throw new Error(`No workspace with handle "${opts.workspace}" belongs to this account.`);
   }
-  const folder = await client.createFolder(workspace.id, { name, visibility });
+  const [artifactData, folderData] = await Promise.all([
+    client.listWorkspaceArtifacts(workspace.id),
+    client.listFolders(workspace.id)
+  ]);
   if (opts.json) {
-    console.log(JSON.stringify(folder, null, 2));
-    return;
-  }
-  console.log(
-    `\u2713 Created folder "${folder.name}" (${folder.visibility}) in ${workspace.handle}`
-  );
-  console.log(`  ${folder.id}`);
-  if (folder.visibility === "public") {
     console.log(
-      "  Artifacts placed in it default to public \u2014 visible to anyone."
+      JSON.stringify({ artifacts: artifactData.artifacts, folders: folderData.folders }, null, 2)
     );
+    return;
   }
-}
-function printFolder(folder) {
-  console.log(`${folder.name} (${folder.visibility})`);
-  console.log(`  ${folder.id}
+  if (artifactData.artifacts.length === 0) {
+    console.log(`No artifacts in workspace ${workspace.handle}.`);
+    return;
+  }
+  const plural = artifactData.artifacts.length === 1 ? "" : "s";
+  console.log(`${artifactData.artifacts.length} artifact${plural} in ${workspace.handle}
 `);
-}
-
-// src/link.ts
-import path10 from "path";
-import { createInterface as createInterface2 } from "readline";
-
-// src/list.ts
-async function teamGroups(client) {
+  for (const folder of folderData.folders) {
+    const inFolder = artifactData.artifacts.filter((artifact) => artifact.folderId === folder.id);
+    if (inFolder.length === 0) {
+      continue;
+    }
+    console.log(`${folder.name} (${folder.visibility})`);
+    for (const artifact of inFolder) {
+      printWorkspaceArtifact(artifact);
+    }
+  }
+  const unfiled = artifactData.artifacts.filter((artifact) => artifact.folderId === null);
+  if (unfiled.length > 0) {
+    console.log("Unfiled");
+    for (const artifact of unfiled) {
+      printWorkspaceArtifact(artifact);
+    }
+  }
+};
+var relativeTime = (iso) => {
+  const seconds = Math.max(0, (Date.now() - new Date(iso).getTime()) / 1e3);
+  if (seconds < 60) {
+    return "just now";
+  }
+  if (seconds < 3600) {
+    return `${Math.floor(seconds / 60)}m ago`;
+  }
+  if (seconds < 86400) {
+    return `${Math.floor(seconds / 3600)}h ago`;
+  }
+  if (seconds < 30 * 86400) {
+    return `${Math.floor(seconds / 86400)}d ago`;
+  }
+  return iso.slice(0, 10);
+};
+var printArtifact = (a) => {
+  const version = a.currentVersionNumber === null ? "no version" : `v${a.currentVersionNumber}`;
+  const open2 = a.openCommentCount === 0 ? "no open comments" : `${a.openCommentCount} open comment${a.openCommentCount === 1 ? "" : "s"}`;
+  const marker = a.openCommentCount > 0 ? "\u25CF" : "\u25CB";
+  console.log(`${marker} ${a.title}`);
+  console.log(`  ${version} \xB7 ${open2} \xB7 updated ${relativeTime(a.updatedAt)}`);
+  console.log(`  ${a.url}
+`);
+};
+var getWorkspaceGroup = async (client, workspace) => {
+  const { artifacts } = await client.listWorkspaceArtifacts(workspace.id);
+  return { artifacts, handle: workspace.handle, id: workspace.id, name: workspace.name };
+};
+var teamGroups = async (client) => {
   const { workspaces: workspaces3 } = await client.listWorkspaces();
   return await Promise.all(
-    workspaces3.filter((workspace) => !workspace.isPersonal).map(async (workspace) => ({
-      artifacts: (await client.listWorkspaceArtifacts(workspace.id)).artifacts,
-      handle: workspace.handle,
-      id: workspace.id,
-      name: workspace.name
-    }))
+    workspaces3.flatMap(
+      (workspace) => workspace.isPersonal ? [] : [getWorkspaceGroup(client, workspace)]
+    )
   );
-}
-async function reachableArtifacts(client) {
-  const [own, groups] = await Promise.all([
-    client.listArtifacts(),
-    teamGroups(client)
-  ]);
+};
+var reachableArtifacts = async (client) => {
+  const [own, groups] = await Promise.all([client.listArtifacts(), teamGroups(client)]);
   return [
     ...own.artifacts.map((artifact) => ({
       currentVersionNumber: artifact.currentVersionNumber,
@@ -3366,12 +3801,9 @@ async function reachableArtifacts(client) {
       }))
     )
   ];
-}
-async function list(opts) {
-  const apiUrl2 = (process.env.ARTIFACT_CAFE_URL ?? DEFAULT_API_URL).replace(
-    /\/$/,
-    ""
-  );
+};
+var list = async (opts) => {
+  const apiUrl2 = (process.env.ARTIFACT_CAFE_URL ?? DEFAULT_API_URL).replace(/\/$/u, "");
   const key = resolveApiKey(apiUrl2, opts.apiKey);
   if (!key) {
     throw new Error(
@@ -3383,14 +3815,9 @@ async function list(opts) {
     await listWorkspace(client, opts);
     return;
   }
-  const [data2, groups] = await Promise.all([
-    client.listArtifacts(),
-    teamGroups(client)
-  ]);
+  const [data2, groups] = await Promise.all([client.listArtifacts(), teamGroups(client)]);
   if (opts.json) {
-    console.log(
-      JSON.stringify({ artifacts: data2.artifacts, workspaces: groups }, null, 2)
-    );
+    console.log(JSON.stringify({ artifacts: data2.artifacts, workspaces: groups }, null, 2));
     return;
   }
   const total = data2.artifacts.length + groups.reduce((sum, group) => sum + group.artifacts.length, 0);
@@ -3413,112 +3840,44 @@ async function list(opts) {
       continue;
     }
     const plural = group.artifacts.length === 1 ? "" : "s";
-    console.log(
-      `${group.artifacts.length} artifact${plural} in ${group.handle}
-`
-    );
+    console.log(`${group.artifacts.length} artifact${plural} in ${group.handle}
+`);
     for (const artifact of group.artifacts) {
       printWorkspaceArtifact(artifact);
     }
     console.log("");
   }
-}
-async function listWorkspace(client, opts) {
-  const workspaceData = await client.listWorkspaces();
-  const workspace = workspaceData.workspaces.find(
-    (candidate) => candidate.handle === opts.workspace
-  );
-  if (!workspace) {
-    throw new Error(
-      `No workspace with handle "${opts.workspace}" belongs to this account.`
-    );
-  }
-  const [artifactData, folderData] = await Promise.all([
-    client.listWorkspaceArtifacts(workspace.id),
-    client.listFolders(workspace.id)
-  ]);
-  if (opts.json) {
-    console.log(
-      JSON.stringify(
-        { artifacts: artifactData.artifacts, folders: folderData.folders },
-        null,
-        2
-      )
-    );
-    return;
-  }
-  if (artifactData.artifacts.length === 0) {
-    console.log(`No artifacts in workspace ${workspace.handle}.`);
-    return;
-  }
-  const plural = artifactData.artifacts.length === 1 ? "" : "s";
-  console.log(
-    `${artifactData.artifacts.length} artifact${plural} in ${workspace.handle}
-`
-  );
-  for (const folder of folderData.folders) {
-    const inFolder = artifactData.artifacts.filter(
-      (artifact) => artifact.folderId === folder.id
-    );
-    if (inFolder.length === 0) {
-      continue;
-    }
-    console.log(`${folder.name} (${folder.visibility})`);
-    for (const artifact of inFolder) {
-      printWorkspaceArtifact(artifact);
-    }
-  }
-  const unfiled = artifactData.artifacts.filter(
-    (artifact) => artifact.folderId === null
-  );
-  if (unfiled.length > 0) {
-    console.log("Unfiled");
-    for (const artifact of unfiled) {
-      printWorkspaceArtifact(artifact);
-    }
-  }
-}
-function printWorkspaceArtifact(a) {
-  const version = a.currentVersionNumber === null ? "no version" : `v${a.currentVersionNumber}`;
-  const open2 = a.openCommentCount === 0 ? "no open comments" : `${a.openCommentCount} open comment${a.openCommentCount === 1 ? "" : "s"}`;
-  const marker = a.openCommentCount > 0 ? "\u25CF" : "\u25CB";
-  console.log(
-    `  ${marker} ${a.title} \u2014 ${version} \xB7 ${open2} \xB7 ${a.visibility}`
-  );
-  console.log(`    ${a.url}`);
-}
-function printArtifact(a) {
-  const version = a.currentVersionNumber === null ? "no version" : `v${a.currentVersionNumber}`;
-  const open2 = a.openCommentCount === 0 ? "no open comments" : `${a.openCommentCount} open comment${a.openCommentCount === 1 ? "" : "s"}`;
-  const marker = a.openCommentCount > 0 ? "\u25CF" : "\u25CB";
-  console.log(`${marker} ${a.title}`);
-  console.log(`  ${version} \xB7 ${open2} \xB7 updated ${relativeTime(a.updatedAt)}`);
-  console.log(`  ${a.url}
-`);
-}
-function relativeTime(iso) {
-  const seconds = Math.max(0, (Date.now() - new Date(iso).getTime()) / 1e3);
-  if (seconds < 60) {
-    return "just now";
-  }
-  if (seconds < 3600) {
-    return `${Math.floor(seconds / 60)}m ago`;
-  }
-  if (seconds < 86400) {
-    return `${Math.floor(seconds / 3600)}h ago`;
-  }
-  if (seconds < 30 * 86400) {
-    return `${Math.floor(seconds / 86400)}d ago`;
-  }
-  return iso.slice(0, 10);
-}
+};
 
 // src/link.ts
-async function link(opts) {
-  const apiUrl2 = (process.env.ARTIFACT_CAFE_URL ?? DEFAULT_API_URL).replace(
-    /\/$/,
-    ""
-  );
+var pickArtifact = (artifacts) => {
+  console.log("Artifacts you can publish to:\n");
+  for (const [i, a] of artifacts.entries()) {
+    const v = a.currentVersionNumber ? `v${a.currentVersionNumber}` : "\u2014";
+    const where = a.workspaceHandle ? `  \xB7  ${a.workspaceHandle}` : "";
+    console.log(`  ${String(i + 1).padStart(2)}. ${a.title}  \xB7  ${v}${where}  \xB7  ${a.url}`);
+  }
+  const rl = createInterface2({ input: process.stdin, output: process.stdout });
+  return new Promise((resolve2, reject) => {
+    rl.question(`
+Link which? [1-${artifacts.length}]: `, (answer) => {
+      rl.close();
+      const n = Number(answer.trim());
+      if (!(Number.isInteger(n) && n >= 1 && n <= artifacts.length)) {
+        reject(new Error(`Enter a number between 1 and ${artifacts.length}.`));
+        return;
+      }
+      const artifact = artifacts[n - 1];
+      if (!artifact) {
+        reject(new Error("No artifact at that selection."));
+        return;
+      }
+      resolve2(artifact);
+    });
+  });
+};
+var link = async (opts) => {
+  const apiUrl2 = (process.env.ARTIFACT_CAFE_URL ?? DEFAULT_API_URL).replace(/\/$/u, "");
   const key = resolveApiKey(apiUrl2, opts.apiKey);
   if (!key) {
     throw new Error(
@@ -3555,10 +3914,11 @@ async function link(opts) {
     }
     chosen = await pickArtifact(artifacts);
   }
-  const dir = path10.resolve(opts.dir);
+  const dir = path12.resolve(opts.dir);
   writeConfig(dir, {
     apiUrl: apiUrl2,
     artifactId: chosen.id,
+    baseVersion: chosen.currentVersionNumber ?? void 0,
     slug: chosen.slug,
     url: chosen.url
     // No publishToken — this folder authorizes via your login, not a secret.
@@ -3573,68 +3933,43 @@ async function link(opts) {
           url: chosen.url
         },
         null,
-        2
-      )
-    );
-    return;
-  }
-  console.log(`
-\u2713 Linked ${dir} \u2192 "${chosen.title}"  \u2014  ${chosen.url}`);
-  console.log(
-    "  Owner actions (publish, comments --wait, protect) use your login.\n"
-  );
-}
-function pickArtifact(artifacts) {
-  console.log("Artifacts you can publish to:\n");
-  artifacts.forEach((a, i) => {
-    const v = a.currentVersionNumber ? `v${a.currentVersionNumber}` : "\u2014";
-    const where = a.workspaceHandle ? `  \xB7  ${a.workspaceHandle}` : "";
-    console.log(
-      `  ${String(i + 1).padStart(2)}. ${a.title}  \xB7  ${v}${where}  \xB7  ${a.url}`
-    );
-  });
-  const rl = createInterface2({ input: process.stdin, output: process.stdout });
-  return new Promise((resolve2, reject) => {
-    rl.question(`
-Link which? [1-${artifacts.length}]: `, (answer) => {
-      rl.close();
-      const n = Number(answer.trim());
-      if (!(Number.isInteger(n) && n >= 1 && n <= artifacts.length)) {
-        reject(new Error(`Enter a number between 1 and ${artifacts.length}.`));
-        return;
-      }
-      resolve2(artifacts[n - 1]);
-    });
-  });
-}
+        2
+      )
+    );
+    return;
+  }
+  console.log(`
+\u2713 Linked ${dir} \u2192 "${chosen.title}"  \u2014  ${chosen.url}`);
+  console.log("  Owner actions (publish, comments --wait, protect) use your login.\n");
+};
 
 // src/login.ts
 import { createInterface as createInterface3 } from "readline";
-function apiUrl() {
-  return (process.env.ARTIFACT_CAFE_URL ?? DEFAULT_API_URL).replace(/\/$/, "");
-}
-function promptSecret(question) {
-  return new Promise((resolve2) => {
+var apiUrl = () => (process.env.ARTIFACT_CAFE_URL ?? DEFAULT_API_URL).replace(/\/$/u, "");
+var promptSecret = (question) => (
+  // oxlint-disable-next-line promise/avoid-new -- The readline callback owns terminal cleanup and cancellation.
+  new Promise((resolve2) => {
     const rl = createInterface3({
       input: process.stdin,
       output: process.stdout
     });
     let muted = false;
-    const raw = rl;
-    raw._writeToOutput = (s) => {
-      if (!muted) {
-        process.stdout.write(s);
+    Object.defineProperty(rl, "_writeToOutput", {
+      value: (s) => {
+        if (!muted) {
+          process.stdout.write(s);
+        }
       }
-    };
+    });
     rl.question(question, (answer) => {
       rl.close();
       process.stdout.write("\n");
       resolve2(answer);
     });
     muted = true;
-  });
-}
-async function login(opts) {
+  })
+);
+var login = async (opts) => {
   const base = apiUrl();
   const keysUrl = `${base}/dashboard?view=api-keys`;
   let key = opts.apiKey?.trim();
@@ -3647,26 +3982,25 @@ Opening ${keysUrl}`);
     if (process.stdout.isTTY) {
       openInBrowser(keysUrl);
     }
-    key = (await promptSecret("API key: ")).trim();
+    const enteredKey = await promptSecret("API key: ");
+    key = enteredKey.trim();
   }
   if (!key) {
     throw new Error("No key entered \u2014 nothing was saved.");
   }
   if (!key.startsWith("ack_")) {
-    throw new Error(
-      `That doesn't look like an artifact.cafe API key (they start with "ack_").`
-    );
+    throw new Error(`That doesn't look like an artifact.cafe API key (they start with "ack_").`);
+  }
+  const previous = resolveApiKey(base);
+  if (previous && previous !== key) {
+    resetInstallId();
   }
   const me = await createApiClient(base, key).me();
   storeApiKey(base, key);
   const who = me.email ?? me.userId;
   if (opts.json) {
     console.log(
-      JSON.stringify(
-        { apiUrl: base, email: me.email, loggedIn: true, userId: me.userId },
-        null,
-        2
-      )
+      JSON.stringify({ apiUrl: base, email: me.email, loggedIn: true, userId: me.userId }, null, 2)
     );
     return;
   }
@@ -3675,14 +4009,12 @@ Opening ${keysUrl}`);
   console.log(
     "New publishes are claimed by your account automatically. Try `artifact-cafe list`.\n"
   );
-}
-async function whoami(opts) {
+};
+var whoami = async (opts) => {
   const base = apiUrl();
   const key = resolveApiKey(base);
   if (!key) {
-    throw new Error(
-      `Not logged in to ${apiOrigin(base)} \u2014 run \`artifact-cafe login\` first.`
-    );
+    throw new Error(`Not logged in to ${apiOrigin(base)} \u2014 run \`artifact-cafe login\` first.`);
   }
   const me = await createApiClient(base, key).me();
   if (opts.json) {
@@ -3701,13 +4033,14 @@ async function whoami(opts) {
     return;
   }
   const keyLabel = me.keyName ? ` (key: ${me.keyName})` : "";
-  console.log(
-    `Logged in to ${apiOrigin(base)} as ${me.email ?? me.userId}${keyLabel}`
-  );
-}
-function logout(opts) {
+  console.log(`Logged in to ${apiOrigin(base)} as ${me.email ?? me.userId}${keyLabel}`);
+};
+var logout = (opts) => {
   const base = apiUrl();
   const removed = removeApiKey(base);
+  if (removed) {
+    resetInstallId();
+  }
   if (opts.json) {
     console.log(JSON.stringify({ apiUrl: base, loggedOut: removed }, null, 2));
     return;
@@ -3720,34 +4053,30 @@ function logout(opts) {
   console.log(
     `The key itself is still active \u2014 revoke it at ${base}/dashboard?view=api-keys if this machine is shared.`
   );
-}
+};
 
 // src/message.ts
-import path11 from "path";
-async function readStdin2() {
+import path13 from "path";
+var readStdin2 = async () => {
   if (process.stdin.isTTY) {
     return "";
   }
   const chunks = [];
   for await (const chunk of process.stdin) {
-    chunks.push(chunk);
+    chunks.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk));
   }
-  return Buffer.concat(chunks).toString("utf8");
-}
-async function editMessage(opts) {
+  return Buffer.concat(chunks).toString("utf-8");
+};
+var editMessage = async (opts) => {
   const messageId = opts.message?.trim();
   if (!messageId) {
-    throw new Error(
-      "Pass the message id to edit \u2014 get it from `artifact-cafe comments --json`."
-    );
+    throw new Error("Pass the message id to edit \u2014 get it from `artifact-cafe comments --json`.");
   }
   const body = (opts.body ?? await readStdin2()).trim();
   if (!body) {
-    throw new Error(
-      'Nothing to save. Pass the new text with --body "\u2026", or pipe it on stdin.'
-    );
+    throw new Error('Nothing to save. Pass the new text with --body "\u2026", or pipe it on stdin.');
   }
-  const dir = path11.resolve(opts.dir);
+  const dir = path13.resolve(opts.dir);
   const target = resolveArtifactTarget(dir, {
     apiKey: opts.apiKey,
     artifact: opts.artifact
@@ -3759,15 +4088,13 @@ async function editMessage(opts) {
     return;
   }
   console.log(`\u2713 Edited ${messageId}.`);
-}
-async function deleteMessage(opts) {
+};
+var deleteMessage = async (opts) => {
   const messageId = opts.message?.trim();
   if (!messageId) {
-    throw new Error(
-      "Pass the message id to delete \u2014 get it from `artifact-cafe comments --json`."
-    );
+    throw new Error("Pass the message id to delete \u2014 get it from `artifact-cafe comments --json`.");
   }
-  const dir = path11.resolve(opts.dir);
+  const dir = path13.resolve(opts.dir);
   const target = resolveArtifactTarget(dir, {
     apiKey: opts.apiKey,
     artifact: opts.artifact
@@ -3779,15 +4106,15 @@ async function deleteMessage(opts) {
     return;
   }
   console.log(`\u2713 Deleted ${messageId}.`);
-}
+};
 
 // src/move.ts
-import path12 from "path";
-async function move(opts) {
+import path14 from "path";
+var move = async (opts) => {
   if (Boolean(opts.folder) === Boolean(opts.unfiled)) {
     throw new Error("Pass exactly one of --folder <name-or-id> or --unfiled.");
   }
-  const dir = path12.resolve(opts.dir);
+  const dir = path14.resolve(opts.dir);
   const target = resolveArtifactTarget(dir, {
     apiKey: opts.apiKey,
     artifact: opts.artifact
@@ -3822,6 +4149,9 @@ async function move(opts) {
         `More than one folder is named "${opts.folder}"; pass the folder id instead.`
       );
     }
+    if (matches[0] === null || matches[0] === void 0) {
+      throw new Error("Expected matches[0] to be present.");
+    }
     folderId = matches[0].id;
     folderName = matches[0].name;
   }
@@ -3867,54 +4197,51 @@ async function move(opts) {
   const destination = folderName ? `"${folderName}"` : "Unfiled";
   console.log(`\u2713 Moved "${updated.title}" \u2192 ${destination}`);
   if (updated.visibility !== artifact.visibility) {
-    console.log(
-      `  Visibility: ${artifact.visibility} \u2192 ${updated.visibility} (folder default)`
-    );
+    console.log(`  Visibility: ${artifact.visibility} \u2192 ${updated.visibility} (folder default)`);
     if (updated.visibility === "public") {
       console.log("  Now public \u2014 visible to anyone.");
     }
   }
-}
+};
 
 // src/open.ts
-import path13 from "path";
-async function openArtifact(opts) {
-  const dir = path13.resolve(opts.dir);
+import path15 from "path";
+var openArtifact = async (opts) => {
+  const dir = path15.resolve(opts.dir);
   const target = resolveArtifactTarget(dir, {
     apiKey: opts.apiKey,
     artifact: opts.artifact
   });
-  const url = target.url ?? reviewUrl(
-    target.apiUrl,
-    (await createApiClient(target.apiUrl, target.credential).getArtifact(
+  let { url } = target;
+  if (!url) {
+    const artifact = await createApiClient(target.apiUrl, target.credential).getArtifact(
       target.artifactId
-    )).slug
-  );
+    );
+    url = reviewUrl(target.apiUrl, artifact.slug);
+  }
   console.log(url);
   if (process.stdout.isTTY) {
     openInBrowser(url);
   }
-}
+};
 
 // src/protect.ts
-import path14 from "path";
-async function protect(opts) {
+import path16 from "path";
+var protect = async (opts) => {
   if (opts.off && opts.password !== void 0) {
     throw new Error("Pass either --password or --off, not both.");
   }
   if (!opts.off && opts.password === void 0) {
-    throw new Error(
-      "Provide --password <password> to set a gate, or --off to remove it."
-    );
+    throw new Error("Provide --password <password> to set a gate, or --off to remove it.");
   }
-  const password = opts.off ? null : opts.password;
+  const password = opts.password === void 0 ? null : opts.password;
   if (password !== null) {
     const parsed = gatePasswordSchema.safeParse(password);
     if (!parsed.success) {
       throw new Error(parsed.error.issues[0]?.message ?? "Invalid password.");
     }
   }
-  const dir = path14.resolve(opts.dir);
+  const dir = path16.resolve(opts.dir);
   const target = resolveArtifactTarget(dir, {
     apiKey: opts.apiKey,
     artifact: opts.artifact
@@ -3925,10 +4252,11 @@ async function protect(opts) {
     console.log(JSON.stringify({ protected: res.protected }, null, 2));
     return;
   }
-  const url = target.url ?? reviewUrl(
-    target.apiUrl,
-    (await client.getArtifact(target.artifactId)).slug
-  );
+  let { url } = target;
+  if (!url) {
+    const artifact = await client.getArtifact(target.artifactId);
+    url = reviewUrl(target.apiUrl, artifact.slug);
+  }
   console.log(
     res.protected ? `
 \u2713 Password protection on \u2014 ${url}
@@ -3936,21 +4264,119 @@ async function protect(opts) {
 \u2713 Password protection removed \u2014 ${url}
 `
   );
-}
+};
+
+// src/pull.ts
+import { createHash as createHash2 } from "crypto";
+import { existsSync as existsSync4, lstatSync as lstatSync2, mkdirSync as mkdirSync5, readdirSync as readdirSync2, writeFileSync as writeFileSync5 } from "fs";
+import path17 from "path";
+var rejectSymlinks = (dir, relative) => {
+  let current = dir;
+  for (const segment of ["", ...relative.split("/")]) {
+    current = path17.join(current, segment);
+    try {
+      if (lstatSync2(current).isSymbolicLink()) {
+        throw new Error(`Refusing to pull through a symbolic link: ${relative}`);
+      }
+    } catch (error) {
+      if (!(error instanceof Error && "code" in error && error.code === "ENOENT")) {
+        throw error;
+      }
+    }
+  }
+};
+var warnExtraFiles = (extraFiles, versionNumber) => {
+  if (extraFiles.length > 0) {
+    console.warn(
+      `Warning: Local files not in v${versionNumber} will be published unless removed: ${extraFiles.join(", ")}`
+    );
+  }
+};
+var pull = async (opts) => {
+  const dir = path17.resolve(opts.dir);
+  rejectSymlinks(dir, ".artifactcafe/config.json");
+  const config = readConfig(dir);
+  const target = resolveArtifactTarget(dir, opts);
+  if (config && config.artifactId !== target.artifactId) {
+    throw new Error("This directory is linked to another artifact. Pull into another directory.");
+  }
+  if (existsSync4(dir) && readdirSync2(dir).length > 0 && !opts.force) {
+    throw new Error("Pull requires an empty directory. Use --force to overwrite matching files.");
+  }
+  let version = "current";
+  if (opts.version !== void 0 && opts.version !== "current") {
+    if (!/^[1-9]\d*$/u.test(opts.version) || !Number.isSafeInteger(Number(opts.version))) {
+      throw new Error("--version must be a positive integer or current.");
+    }
+    version = Number(opts.version);
+  }
+  const result = await createApiClient(target.apiUrl, target.credential).versionFiles(
+    target.artifactId,
+    version
+  );
+  for (const file of result.files) {
+    if (!isSafeArtifactPath(file.path) || path17.win32.isAbsolute(file.path) || file.path.split("/")[0] === ".artifactcafe") {
+      throw new Error(`Unsafe download path: ${file.path}`);
+    }
+    rejectSymlinks(dir, file.path);
+  }
+  for (const file of result.files) {
+    const response = await fetch(file.downloadUrl);
+    if (!response.ok) {
+      throw new Error(`Download failed for ${file.path} (HTTP ${response.status}).`);
+    }
+    const bytes = Buffer.from(await response.arrayBuffer());
+    const hash = `sha256_${createHash2("sha256").update(bytes).digest("hex")}`;
+    if (hash !== file.hash) {
+      throw new Error(`Hash mismatch for ${file.path}.`);
+    }
+    if (bytes.length !== file.size) {
+      throw new Error(`Size mismatch for ${file.path}.`);
+    }
+    const destination = path17.join(dir, file.path);
+    mkdirSync5(path17.dirname(destination), { recursive: true });
+    writeFileSync5(destination, bytes);
+  }
+  writeConfig(dir, {
+    ...config ?? { apiUrl: target.apiUrl, artifactId: target.artifactId },
+    baseVersion: result.versionNumber,
+    slug: result.slug,
+    url: reviewUrl(target.apiUrl, result.slug)
+  });
+  const files = result.files.map(({ downloadUrl: _downloadUrl, ...file }) => file);
+  const pulledPaths = new Set(files.map((file) => file.path));
+  const extraFiles = scanDirectory(dir).files.flatMap(
+    (file) => pulledPaths.has(file.path) ? [] : [file.path]
+  );
+  if (opts.json) {
+    console.log(
+      JSON.stringify({
+        artifactId: target.artifactId,
+        dir,
+        extraFiles,
+        files,
+        versionNumber: result.versionNumber
+      })
+    );
+    return;
+  }
+  console.log(`\u2713 Pulled v${result.versionNumber} to ${dir} (${files.length} files).`);
+  warnExtraFiles(extraFiles, result.versionNumber);
+};
 
 // src/reply.ts
-import path15 from "path";
-async function readStdin3() {
+import path18 from "path";
+var readStdin3 = async () => {
   if (process.stdin.isTTY) {
     return "";
   }
   const chunks = [];
   for await (const chunk of process.stdin) {
-    chunks.push(chunk);
+    chunks.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk));
   }
-  return Buffer.concat(chunks).toString("utf8");
-}
-async function replyToThread(opts) {
+  return Buffer.concat(chunks).toString("utf-8");
+};
+var replyToThread = async (opts) => {
   const threadId = opts.thread?.trim();
   if (!threadId) {
     throw new Error(
@@ -3959,11 +4385,9 @@ async function replyToThread(opts) {
   }
   const body = (opts.body ?? await readStdin3()).trim();
   if (!body) {
-    throw new Error(
-      'Nothing to post. Pass the reply with --body "\u2026", or pipe it on stdin.'
-    );
+    throw new Error('Nothing to post. Pass the reply with --body "\u2026", or pipe it on stdin.');
   }
-  const dir = path15.resolve(opts.dir);
+  const dir = path18.resolve(opts.dir);
   const target = resolveArtifactTarget(dir, {
     apiKey: opts.apiKey,
     artifact: opts.artifact
@@ -3989,18 +4413,18 @@ async function replyToThread(opts) {
   }
   const closed = opts.resolve ? " and resolved it" : "";
   console.log(`\u2713 Replied to ${thread.id}${closed} \u2014 now ${thread.status}.`);
-}
+};
 
 // src/resolve.ts
-import path16 from "path";
-async function changeThreadStatus(opts) {
+import path19 from "path";
+var changeThreadStatus = async (opts) => {
   const threadId = opts.thread?.trim();
   if (!threadId) {
     throw new Error(
       `Pass the thread id to ${opts.action} \u2014 get it from \`artifact-cafe comments --json\`.`
     );
   }
-  const dir = path16.resolve(opts.dir);
+  const dir = path19.resolve(opts.dir);
   const target = resolveArtifactTarget(dir, {
     apiKey: opts.apiKey,
     artifact: opts.artifact
@@ -4027,23 +4451,21 @@ async function changeThreadStatus(opts) {
     return;
   }
   if (opts.action === "ack") {
-    console.log(
-      `\u2713 Acknowledged ${thread.id} \u2014 reviewers now see it as being handled.`
-    );
+    console.log(`\u2713 Acknowledged ${thread.id} \u2014 reviewers now see it as being handled.`);
     return;
   }
   const verb = opts.action === "resolve" ? "Resolved" : "Reopened";
   console.log(`\u2713 ${verb} ${thread.id} \u2014 now ${thread.status}.`);
-}
+};
 
 // src/review.ts
-import path17 from "path";
+import path20 from "path";
 var OUTCOME = {
   off: "Plain artifact \u2014 the review tools are hidden entirely",
   open: "Open for review \u2014 anyone who can open it can comment",
   readonly: "Read-only \u2014 earlier comments stay visible, no new ones"
 };
-async function review(opts) {
+var review = async (opts) => {
   const parsed = reviewModeSchema.safeParse(opts.mode);
   if (!parsed.success) {
     throw new Error(
@@ -4051,7 +4473,7 @@ async function review(opts) {
     );
   }
   const mode = parsed.data;
-  const dir = path17.resolve(opts.dir);
+  const dir = path20.resolve(opts.dir);
   const target = resolveArtifactTarget(dir, {
     apiKey: opts.apiKey,
     artifact: opts.artifact
@@ -4062,21 +4484,22 @@ async function review(opts) {
     console.log(JSON.stringify({ reviewMode: res.mode }, null, 2));
     return;
   }
-  const url = target.url ?? reviewUrl(
-    target.apiUrl,
-    (await client.getArtifact(target.artifactId)).slug
-  );
+  let { url } = target;
+  if (!url) {
+    const artifact = await client.getArtifact(target.artifactId);
+    url = reviewUrl(target.apiUrl, artifact.slug);
+  }
   console.log(`
 \u2713 ${OUTCOME[res.mode]}
   ${url}
 `);
-}
+};
 
 // src/share.ts
-import path18 from "path";
-var EMAIL_RE = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
-async function share(opts) {
-  const dir = path18.resolve(opts.dir);
+import path21 from "path";
+var EMAIL_RE = /^[^\s@]+@[^\s@]+\.[^\s@]+$/u;
+var share = async (opts) => {
+  const dir = path21.resolve(opts.dir);
   const target = resolveArtifactTarget(dir, {
     apiKey: opts.apiKey,
     artifact: opts.artifact
@@ -4105,9 +4528,7 @@ General access: ${visibility}`);
     return;
   }
   if (opts.emails.length === 0) {
-    throw new Error(
-      "Provide at least one email to invite, or --list to see current grants."
-    );
+    throw new Error("Provide at least one email to invite, or --list to see current grants.");
   }
   for (const email of opts.emails) {
     if (!EMAIL_RE.test(email)) {
@@ -4129,9 +4550,9 @@ General access: ${visibility}`);
     console.log(`  ${url}`);
   }
   console.log("");
-}
-async function unshare(opts) {
-  const dir = path18.resolve(opts.dir);
+};
+var unshare = async (opts) => {
+  const dir = path21.resolve(opts.dir);
   const target = resolveArtifactTarget(dir, {
     apiKey: opts.apiKey,
     artifact: opts.artifact
@@ -4151,18 +4572,16 @@ async function unshare(opts) {
   console.log(`
 \u2713 Revoked access for ${opts.email}
 `);
-}
+};
 
 // src/status.ts
-import path19 from "path";
-async function status(opts) {
-  if (!AGENT_STATES.includes(opts.state)) {
-    throw new Error(
-      `State must be one of: ${AGENT_STATES.join(", ")} (got "${opts.state}").`
-    );
+import path22 from "path";
+var status = async (opts) => {
+  const state = AGENT_STATES.find((candidate) => candidate === opts.state);
+  if (!state) {
+    throw new Error(`State must be one of: ${AGENT_STATES.join(", ")} (got "${opts.state}").`);
   }
-  const state = opts.state;
-  const dir = path19.resolve(opts.dir);
+  const dir = path22.resolve(opts.dir);
   const target = resolveArtifactTarget(dir, {
     apiKey: opts.apiKey,
     artifact: opts.artifact
@@ -4185,163 +4604,16 @@ async function status(opts) {
   }
   const visible = res.ttlSeconds >= 120 ? `~${Math.round(res.ttlSeconds / 60)}m` : `~${res.ttlSeconds}s`;
   console.log(`\u2713 Presence: ${state} (visible ${visible})`);
-}
-
-// src/update.ts
-import { existsSync as existsSync3, mkdirSync as mkdirSync3, readFileSync as readFileSync6, writeFileSync as writeFileSync3 } from "fs";
-import { createRequire } from "module";
-import { homedir as homedir2 } from "os";
-import path20 from "path";
-import { z as z25 } from "zod";
-var REGISTRY_LATEST_URL = "https://registry.npmjs.org/artifact-cafe/latest";
-var SKILL_SOURCE_URL = "https://raw.githubusercontent.com/Artifact-Cafe/skill/main/artifact-cafe/SKILL.md";
-var SKILL_UPDATE_COMMAND = "npx skills add artifact-cafe/skill --skill artifact-cafe -g";
-var CHECK_TTL_MS = 24 * 60 * 60 * 1e3;
-var FETCH_TIMEOUT_MS = 2e3;
-var SKILL_VERSION_PATTERN = /\*\*Skill version:\s*(\d+\.\d+\.\d+)\*\*/;
-var cacheSchema = z25.object({
-  checkedAt: z25.number(),
-  cliLatest: z25.string().nullable(),
-  skillLatest: z25.string().nullable(),
-  version: z25.literal(1)
-});
-function cliVersion() {
-  const pkg = createRequire(import.meta.url)("../package.json");
-  return pkg.version;
-}
-function cachePath() {
-  return path20.join(homedir2(), ".artifactcafe", "update-check.json");
-}
-function readCache() {
-  try {
-    return cacheSchema.parse(JSON.parse(readFileSync6(cachePath(), "utf8")));
-  } catch {
-    return null;
-  }
-}
-function writeCache(cache) {
-  try {
-    mkdirSync3(path20.dirname(cachePath()), { mode: 448, recursive: true });
-    writeFileSync3(cachePath(), `${JSON.stringify(cache, null, 2)}
-`);
-  } catch {
-  }
-}
-function isNewerVersion(candidate, current) {
-  const parse = (value) => value.split(".").map((part) => Number.parseInt(part, 10) || 0);
-  const a = parse(candidate);
-  const b = parse(current);
-  for (let i = 0; i < 3; i++) {
-    if ((a[i] ?? 0) !== (b[i] ?? 0)) {
-      return (a[i] ?? 0) > (b[i] ?? 0);
-    }
-  }
-  return false;
-}
-async function fetchJson(url) {
-  const res = await fetch(url, {
-    signal: AbortSignal.timeout(FETCH_TIMEOUT_MS)
-  });
-  if (!res.ok) {
-    throw new Error(`GET ${url} \u2192 ${res.status}`);
-  }
-  return res.json();
-}
-async function fetchText(url) {
-  const res = await fetch(url, {
-    signal: AbortSignal.timeout(FETCH_TIMEOUT_MS)
-  });
-  if (!res.ok) {
-    throw new Error(`GET ${url} \u2192 ${res.status}`);
-  }
-  return res.text();
-}
-async function fetchLatestVersions(previous) {
-  const [cli, skill] = await Promise.all([
-    fetchJson(REGISTRY_LATEST_URL).then((body) => z25.object({ version: z25.string() }).parse(body).version).catch(() => null),
-    fetchText(SKILL_SOURCE_URL).then((body) => SKILL_VERSION_PATTERN.exec(body)?.[1] ?? null).catch(() => null)
-  ]);
-  return {
-    checkedAt: Date.now(),
-    cliLatest: cli ?? previous?.cliLatest ?? null,
-    skillLatest: skill ?? previous?.skillLatest ?? null,
-    version: 1
-  };
-}
-function installedSkillVersions() {
-  const roots = [homedir2(), process.cwd()];
-  const dirs = [".agents", ".claude"];
-  const versions = [];
-  for (const root of roots) {
-    for (const dir of dirs) {
-      const file = path20.join(root, dir, "skills", "artifact-cafe", "SKILL.md");
-      if (!existsSync3(file)) {
-        continue;
-      }
-      try {
-        const found = SKILL_VERSION_PATTERN.exec(readFileSync6(file, "utf8"));
-        if (found?.[1]) {
-          versions.push(found[1]);
-        }
-      } catch {
-      }
-    }
-  }
-  return versions;
-}
-function updateChecksDisabled() {
-  return Boolean(
-    process.env.ARTIFACT_CAFE_NO_UPDATE_CHECK ?? process.env.NO_UPDATE_NOTIFIER ?? process.env.CI
-  );
-}
-function startUpdateCheck() {
-  if (updateChecksDisabled()) {
-    return () => Promise.resolve();
-  }
-  const pending = (async () => {
-    const cached = readCache();
-    if (cached && Date.now() - cached.checkedAt < CHECK_TTL_MS) {
-      return cached;
-    }
-    const fresh = await fetchLatestVersions(cached);
-    writeCache(fresh);
-    return fresh;
-  })().catch(() => null);
-  return async () => {
-    const latest = await pending;
-    if (!latest) {
-      return;
-    }
-    const notices = [];
-    const current = cliVersion();
-    if (latest.cliLatest && isNewerVersion(latest.cliLatest, current)) {
-      notices.push(
-        `[artifact-cafe] CLI update available: ${current} \u2192 ${latest.cliLatest}. Run commands via \`npx artifact-cafe@latest\`; update a global install with \`npm i -g artifact-cafe@latest\`.`
-      );
-    }
-    if (latest.skillLatest) {
-      const stale = installedSkillVersions().filter(
-        (version) => isNewerVersion(latest.skillLatest, version)
-      ).sort((a, b) => isNewerVersion(a, b) ? 1 : -1);
-      if (stale.length > 0) {
-        notices.push(
-          `[artifact-cafe] Skill update available: ${stale[0]} \u2192 ${latest.skillLatest}. Update: \`${SKILL_UPDATE_COMMAND}\` (drop -g for a repo-local copy), then re-read SKILL.md.`
-        );
-      }
-    }
-    if (notices.length > 0) {
-      console.error(`
-${notices.join("\n")}`);
-    }
-  };
-}
+};
 
 // src/workspaces.ts
-async function workspaces(opts) {
-  const apiUrl2 = (process.env.ARTIFACT_CAFE_URL ?? DEFAULT_API_URL).replace(
-    /\/$/,
-    ""
-  );
+var printWorkspace = (workspace) => {
+  console.log(`${workspace.name} (${workspace.role ?? "non-member"})`);
+  console.log(`  ${workspace.handle} \xB7 ${workspace.id}
+`);
+};
+var workspaces = async (opts) => {
+  const apiUrl2 = (process.env.ARTIFACT_CAFE_URL ?? DEFAULT_API_URL).replace(/\/$/u, "");
   const key = resolveApiKey(apiUrl2, opts.apiKey);
   if (!key) {
     throw new Error(
@@ -4363,17 +4635,12 @@ async function workspaces(opts) {
   for (const workspace of data2.workspaces) {
     printWorkspace(workspace);
   }
-}
-function printWorkspace(workspace) {
-  console.log(`${workspace.name} (${workspace.role ?? "non-member"})`);
-  console.log(`  ${workspace.handle} \xB7 ${workspace.id}
-`);
-}
+};
 
 // src/index.ts
-function readStringArg(argv, flag) {
+var readStringArg = (argv, flag) => {
   const prefix = `${flag}=`;
-  for (let i = 0; i < argv.length; i++) {
+  for (let i = 0; i < argv.length; i += 1) {
     const token = argv[i];
     if (token === void 0) {
       continue;
@@ -4385,7 +4652,36 @@ function readStringArg(argv, flag) {
       return token.slice(prefix.length);
     }
   }
-}
+};
+var pull2 = defineCommand({
+  args: {
+    "api-key": {
+      description: "Authorize with an account key or agent token (default: env or login)",
+      type: "string"
+    },
+    artifact: { description: "Artifact ID (default: env or folder config)", type: "string" },
+    dir: { default: ".", description: "Directory to download into", type: "positional" },
+    force: { description: "Overwrite matching files in a non-empty directory", type: "boolean" },
+    json: { description: "Machine-readable output", type: "boolean" },
+    version: { description: "Version number (default: current)", type: "string" }
+  },
+  meta: { description: "Download all files of an artifact version", name: "pull" },
+  async run({ args }) {
+    try {
+      await pull({
+        apiKey: args["api-key"],
+        artifact: args.artifact,
+        dir: args.dir,
+        force: Boolean(args.force),
+        json: Boolean(args.json),
+        version: args.version
+      });
+    } catch (error) {
+      printCliError(error, Boolean(args.json));
+      process.exit(1);
+    }
+  }
+});
 var publish2 = defineCommand({
   args: {
     "api-key": {
@@ -4414,6 +4710,7 @@ var publish2 = defineCommand({
       description: "Publish into this workspace folder name (or id)",
       type: "string"
     },
+    force: { description: "Publish even if a newer version exists", type: "boolean" },
     json: { description: "Machine-readable output", type: "boolean" },
     "no-open": { description: "Don't open the review URL", type: "boolean" },
     notes: {
@@ -4448,6 +4745,7 @@ var publish2 = defineCommand({
         entry: args.entry,
         expiresIn: args["expires-in"],
         folder: args.folder,
+        force: Boolean(args.force),
         json: Boolean(args.json),
         notes: readStringArg(process.argv.slice(2), "--notes"),
         open: !args["no-open"],
@@ -4456,8 +4754,8 @@ var publish2 = defineCommand({
         title: args.title,
         workspace: args.workspace
       });
-    } catch (err) {
-      printCliError(err, Boolean(args.json));
+    } catch (error) {
+      printCliError(error, Boolean(args.json));
       process.exit(1);
     }
   }
@@ -4477,8 +4775,8 @@ var login2 = defineCommand({
   async run({ args }) {
     try {
       await login({ apiKey: args["api-key"], json: Boolean(args.json) });
-    } catch (err) {
-      printCliError(err, Boolean(args.json));
+    } catch (error) {
+      printCliError(error, Boolean(args.json));
       process.exit(1);
     }
   }
@@ -4494,8 +4792,8 @@ var logout2 = defineCommand({
   run({ args }) {
     try {
       logout({ json: Boolean(args.json) });
-    } catch (err) {
-      printCliError(err, Boolean(args.json));
+    } catch (error) {
+      printCliError(error, Boolean(args.json));
       process.exit(1);
     }
   }
@@ -4511,8 +4809,8 @@ var whoami2 = defineCommand({
   async run({ args }) {
     try {
       await whoami({ json: Boolean(args.json) });
-    } catch (err) {
-      printCliError(err, Boolean(args.json));
+    } catch (error) {
+      printCliError(error, Boolean(args.json));
       process.exit(1);
     }
   }
@@ -4540,8 +4838,8 @@ var list2 = defineCommand({
         json: Boolean(args.json),
         workspace: args.workspace
       });
-    } catch (err) {
-      printCliError(err, Boolean(args.json));
+    } catch (error) {
+      printCliError(error, Boolean(args.json));
       process.exit(1);
     }
   }
@@ -4587,8 +4885,8 @@ var folders2 = defineCommand({
         visibility: args.visibility,
         workspace: args.workspace
       });
-    } catch (err) {
-      printCliError(err, Boolean(args.json));
+    } catch (error) {
+      printCliError(error, Boolean(args.json));
       process.exit(1);
     }
   }
@@ -4632,8 +4930,8 @@ var move2 = defineCommand({
         json: Boolean(args.json),
         unfiled: Boolean(args.unfiled)
       });
-    } catch (err) {
-      printCliError(err, Boolean(args.json));
+    } catch (error) {
+      printCliError(error, Boolean(args.json));
       process.exit(1);
     }
   }
@@ -4656,8 +4954,8 @@ var workspaces2 = defineCommand({
         apiKey: args["api-key"],
         json: Boolean(args.json)
       });
-    } catch (err) {
-      printCliError(err, Boolean(args.json));
+    } catch (error) {
+      printCliError(error, Boolean(args.json));
       process.exit(1);
     }
   }
@@ -4696,8 +4994,8 @@ var link2 = defineCommand({
         json: Boolean(args.json),
         slug: args.slug
       });
-    } catch (err) {
-      printCliError(err, Boolean(args.json));
+    } catch (error) {
+      printCliError(error, Boolean(args.json));
       process.exit(1);
     }
   }
@@ -4738,8 +5036,8 @@ var expiration2 = defineCommand({
         json: Boolean(args.json),
         keep: Boolean(args.keep)
       });
-    } catch (err) {
-      printCliError(err, Boolean(args.json));
+    } catch (error) {
+      printCliError(error, Boolean(args.json));
       process.exitCode = 1;
     }
   }
@@ -4788,9 +5086,7 @@ var comments2 = defineCommand({
     try {
       const timeout = Number(args.timeout);
       if (!Number.isFinite(timeout) || timeout <= 0) {
-        throw new Error(
-          `--timeout must be a positive number of seconds (got "${args.timeout}").`
-        );
+        throw new Error(`--timeout must be a positive number of seconds (got "${args.timeout}").`);
       }
       await comments({
         apiKey: args["api-key"],
@@ -4802,8 +5098,8 @@ var comments2 = defineCommand({
         version: args.version,
         wait: Boolean(args.wait)
       });
-    } catch (err) {
-      printCliError(err, Boolean(args.json));
+    } catch (error) {
+      printCliError(error, Boolean(args.json));
       process.exit(1);
     }
   }
@@ -4848,9 +5144,7 @@ var listen = defineCommand({
     try {
       const timeout = Number(args.timeout);
       if (!Number.isFinite(timeout) || timeout <= 0) {
-        throw new Error(
-          `--timeout must be a positive number of seconds (got "${args.timeout}").`
-        );
+        throw new Error(`--timeout must be a positive number of seconds (got "${args.timeout}").`);
       }
       await comments({
         apiKey: args["api-key"],
@@ -4862,8 +5156,8 @@ var listen = defineCommand({
         version: args.version,
         wait: true
       });
-    } catch (err) {
-      printCliError(err, Boolean(args.json));
+    } catch (error) {
+      printCliError(error, Boolean(args.json));
       process.exit(1);
     }
   }
@@ -4903,8 +5197,8 @@ var statusCmd = defineCommand({
         json: Boolean(args.json),
         state: args.state
       });
-    } catch (err) {
-      printCliError(err, Boolean(args.json));
+    } catch (error) {
+      printCliError(error, Boolean(args.json));
       process.exit(1);
     }
   }
@@ -4942,8 +5236,8 @@ var protect2 = defineCommand({
         off: Boolean(args.off),
         password: args.password
       });
-    } catch (err) {
-      printCliError(err, Boolean(args.json));
+    } catch (error) {
+      printCliError(error, Boolean(args.json));
       process.exit(1);
     }
   }
@@ -4983,8 +5277,8 @@ var review2 = defineCommand({
         json: Boolean(args.json),
         mode: args.mode
       });
-    } catch (err) {
-      printCliError(err, Boolean(args.json));
+    } catch (error) {
+      printCliError(error, Boolean(args.json));
       process.exit(1);
     }
   }
@@ -5029,8 +5323,8 @@ var threadStatusCommand = (action) => defineCommand({
         json: Boolean(args.json),
         thread: args.thread
       });
-    } catch (err) {
-      printCliError(err, Boolean(args.json));
+    } catch (error) {
+      printCliError(error, Boolean(args.json));
       process.exit(1);
     }
   }
@@ -5088,8 +5382,8 @@ var reply = defineCommand({
         resolve: Boolean(args.resolve),
         thread: args.thread
       });
-    } catch (err) {
-      printCliError(err, Boolean(args.json));
+    } catch (error) {
+      printCliError(error, Boolean(args.json));
       process.exit(1);
     }
   }
@@ -5158,8 +5452,8 @@ var comment2 = defineCommand({
         suffix: args.suffix,
         via: args.via
       });
-    } catch (err) {
-      printCliError(err, Boolean(args.json));
+    } catch (error) {
+      printCliError(error, Boolean(args.json));
       process.exit(1);
     }
   }
@@ -5201,8 +5495,8 @@ var edit = defineCommand({
         json: Boolean(args.json),
         message: args.message
       });
-    } catch (err) {
-      printCliError(err, Boolean(args.json));
+    } catch (error) {
+      printCliError(error, Boolean(args.json));
       process.exit(1);
     }
   }
@@ -5239,8 +5533,8 @@ var del = defineCommand({
         json: Boolean(args.json),
         message: args.message
       });
-    } catch (err) {
-      printCliError(err, Boolean(args.json));
+    } catch (error) {
+      printCliError(error, Boolean(args.json));
       process.exit(1);
     }
   }
@@ -5281,8 +5575,8 @@ var share2 = defineCommand({
         json: Boolean(args.json),
         list: Boolean(args.list)
       });
-    } catch (err) {
-      printCliError(err, Boolean(args.json));
+    } catch (error) {
+      printCliError(error, Boolean(args.json));
       process.exit(1);
     }
   }
@@ -5322,8 +5616,8 @@ var unshare2 = defineCommand({
         email: args.email,
         json: Boolean(args.json)
       });
-    } catch (err) {
-      printCliError(err, Boolean(args.json));
+    } catch (error) {
+      printCliError(error, Boolean(args.json));
       process.exit(1);
     }
   }
@@ -5352,8 +5646,8 @@ var open = defineCommand({
         artifact: args.artifact,
         dir: args.dir
       });
-    } catch (err) {
-      printCliError(err, false);
+    } catch (error) {
+      printCliError(error, false);
       process.exit(1);
     }
   }
@@ -5373,8 +5667,8 @@ var dashboard = defineCommand({
   run({ args }) {
     try {
       openDashboard({ dir: args.dir });
-    } catch (err) {
-      printCliError(err, false);
+    } catch (error) {
+      printCliError(error, false);
       process.exit(1);
     }
   }
@@ -5406,8 +5700,8 @@ var dataLsCommand = defineCommand({
         json: Boolean(args.json),
         limit: args.limit === void 0 ? void 0 : Number(args.limit)
       });
-    } catch (err) {
-      printCliError(err, Boolean(args.json));
+    } catch (error) {
+      printCliError(error, Boolean(args.json));
       process.exit(1);
     }
   }
@@ -5447,8 +5741,8 @@ var dataInsertCommand = defineCommand({
         json: Boolean(args.json),
         record: args.record
       });
-    } catch (err) {
-      printCliError(err, Boolean(args.json));
+    } catch (error) {
+      printCliError(error, Boolean(args.json));
       process.exit(1);
     }
   }
@@ -5474,8 +5768,8 @@ var dataExportCommand = defineCommand({
   async run({ args }) {
     try {
       await dataExport({ dir: args.dir });
-    } catch (err) {
-      printCliError(err, true);
+    } catch (error) {
+      printCliError(error, true);
       process.exit(1);
     }
   }
@@ -5507,8 +5801,8 @@ var dataClearCommand = defineCommand({
         json: Boolean(args.json),
         yes: Boolean(args.yes)
       });
-    } catch (err) {
-      printCliError(err, Boolean(args.json));
+    } catch (error) {
+      printCliError(error, Boolean(args.json));
       process.exit(1);
     }
   }
@@ -5561,6 +5855,7 @@ var main = defineCommand({
     open,
     protect: protect2,
     publish: publish2,
+    pull: pull2,
     reopen,
     reply,
     resolve,