artifact-cafe 0.0.3 → 0.0.5

package/dist/index.js

@@ -1,10 +1,37 @@
 #!/usr/bin/env node
 
 // src/index.ts
-import { defineCommand, runMain } from "citty";
+import { defineCommand, runMain, showUsage } from "citty";
+
+// src/banner.ts
+var AMBER = "\x1B[38;2;214;138;57m";
+var BOLD = "\x1B[1m";
+var RESET = "\x1B[0m";
+var MUG = [
+  "        \u2596",
+  "      \u2598   \u259D",
+  "   \u256D\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u256E",
+  "   \u2502        \u251C\u2500\u256E",
+  "   \u2502        \u2502 \u2502",
+  "   \u2502        \u251C\u2500\u256F",
+  "   \u2570\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u256F",
+  "    \u203E\u203E\u203E\u203E\u203E\u203E\u203E\u203E"
+];
+var WORDMARK = "   artifact.cafe";
+function printBanner() {
+  const color = Boolean(process.stdout.isTTY) && !process.env.NO_COLOR;
+  const paint = (line, codes) => color ? `${codes}${line}${RESET}` : line;
+  console.log();
+  for (const line of MUG) {
+    console.log(paint(line, AMBER));
+  }
+  console.log();
+  console.log(paint(WORDMARK, AMBER + BOLD));
+  console.log();
+}
 
 // src/comments.ts
-import path2 from "path";
+import path3 from "path";
 
 // ../shared/src/account.ts
 import { z } from "zod";
@@ -167,47 +194,82 @@ var apiErrorSchema = z3.object({
   retryAfter: z3.number().int().positive().optional()
 });
 
-// ../shared/src/owner.ts
+// ../shared/src/me.ts
 import { z as z4 } from "zod";
-var SLUG_PATTERN = /^[a-z0-9](?:[a-z0-9-]{1,61}[a-z0-9])$/;
-var claimResponseSchema = z4.object({
-  artifactId: z4.string(),
+var ownArtifactSchema = z4.object({
+  createdAt: z4.string(),
+  currentVersionNumber: z4.number().nullable(),
+  id: z4.string(),
+  openThreads: z4.number(),
+  protected: z4.boolean(),
   slug: z4.string(),
   title: z4.string(),
-  url: z4.string().url()
+  totalViews: z4.number(),
+  updatedAt: z4.string(),
+  url: z4.string(),
+  versionCount: z4.number()
+});
+var ownArtifactsResponseSchema = z4.object({
+  artifacts: z4.array(ownArtifactSchema)
 });
-var updateArtifactSchema = z4.object({
-  slug: z4.string().min(3).max(63).regex(SLUG_PATTERN, {
+
+// ../shared/src/owner.ts
+import { z as z5 } from "zod";
+var SLUG_PATTERN = /^[a-z0-9](?:[a-z0-9-]{1,61}[a-z0-9])$/;
+var claimResponseSchema = z5.object({
+  artifactId: z5.string(),
+  slug: z5.string(),
+  title: z5.string(),
+  url: z5.string().url()
+});
+var updateArtifactSchema = z5.object({
+  slug: z5.string().min(3).max(63).regex(SLUG_PATTERN, {
     message: "slug must be lowercase letters, digits, and hyphens, with no leading/trailing hyphen"
   }).optional(),
-  title: z4.string().min(1).max(200).optional()
+  title: z5.string().min(1).max(200).optional()
 }).refine((body) => body.title !== void 0 || body.slug !== void 0, {
   message: "provide at least one of title, slug"
 });
-var deleteArtifactResponseSchema = z4.object({
-  deleted: z4.literal(true)
+var deleteArtifactResponseSchema = z5.object({
+  deleted: z5.literal(true)
+});
+
+// ../shared/src/presence.ts
+import { z as z6 } from "zod";
+var AGENT_PRESENCE = {
+  heartbeatSeconds: 15,
+  shellPollSeconds: 15,
+  ttlSeconds: 45
+};
+var agentHeartbeatResponseSchema = z6.object({
+  listening: z6.literal(true),
+  ttlSeconds: z6.number().int().positive()
+});
+var agentPresenceSchema = z6.object({
+  listening: z6.boolean(),
+  versionNumber: z6.number().int().positive().nullable()
 });
 
 // ../shared/src/protection.ts
-import { z as z5 } from "zod";
+import { z as z7 } from "zod";
 var PASSWORD_MIN = 6;
 var PASSWORD_MAX = 128;
-var gatePasswordSchema = z5.string().min(PASSWORD_MIN, `Password must be at least ${PASSWORD_MIN} characters.`).max(PASSWORD_MAX, `Password must be at most ${PASSWORD_MAX} characters.`);
-var setProtectionSchema = z5.object({
+var gatePasswordSchema = z7.string().min(PASSWORD_MIN, `Password must be at least ${PASSWORD_MIN} characters.`).max(PASSWORD_MAX, `Password must be at most ${PASSWORD_MAX} characters.`);
+var setProtectionSchema = z7.object({
   password: gatePasswordSchema.nullable()
 });
-var protectionResponseSchema = z5.object({
-  protected: z5.boolean()
+var protectionResponseSchema = z7.object({
+  protected: z7.boolean()
 });
-var unlockSchema = z5.object({
-  password: z5.string().min(1).max(1024)
+var unlockSchema = z7.object({
+  password: z7.string().min(1).max(1024)
 });
-var unlockResponseSchema = z5.object({
-  unlocked: z5.literal(true)
+var unlockResponseSchema = z7.object({
+  unlocked: z7.literal(true)
 });
 
 // ../shared/src/publish.ts
-import { z as z6 } from "zod";
+import { z as z8 } from "zod";
 function isSafeArtifactPath(p) {
   if (p.length === 0 || p.length > 1024) {
     return false;
@@ -220,128 +282,128 @@ function isSafeArtifactPath(p) {
   }
   return p.split("/").every((seg) => seg.length > 0 && seg !== "." && seg !== "..");
 }
-var manifestFileSchema = z6.object({
-  hash: z6.string().regex(/^sha256_[a-f0-9]{64}$/),
-  mimeType: z6.string().regex(/^[-\w.+]+\/[-\w.+]+$/, { message: "invalid MIME type" }),
-  path: z6.string().min(1).max(1024).refine(isSafeArtifactPath, {
+var manifestFileSchema = z8.object({
+  hash: z8.string().regex(/^sha256_[a-f0-9]{64}$/),
+  mimeType: z8.string().regex(/^[-\w.+]+\/[-\w.+]+$/, { message: "invalid MIME type" }),
+  path: z8.string().min(1).max(1024).refine(isSafeArtifactPath, {
     message: "path must be a safe relative path"
   }),
-  size: z6.number().int().positive()
+  size: z8.number().int().positive()
 });
-var publishSourceSchema = z6.object({
-  agent: z6.string().optional(),
-  runId: z6.string().optional(),
-  type: z6.literal("cli")
+var publishSourceSchema = z8.object({
+  agent: z8.string().optional(),
+  runId: z8.string().optional(),
+  type: z8.literal("cli")
 });
-var createPublishSessionSchema = z6.object({
-  artifactId: z6.string().nullable(),
-  entryPath: z6.string().optional(),
-  files: z6.array(manifestFileSchema).min(1).max(1e3),
+var createPublishSessionSchema = z8.object({
+  artifactId: z8.string().nullable(),
+  entryPath: z8.string().optional(),
+  files: z8.array(manifestFileSchema).min(1).max(1e3),
   source: publishSourceSchema,
-  title: z6.string().max(200).optional()
+  title: z8.string().max(200).optional()
 });
-var publishSessionResponseSchema = z6.object({
-  artifactId: z6.string(),
-  expiresAt: z6.string(),
-  filesToUpload: z6.array(
-    z6.object({
-      method: z6.literal("PUT"),
-      path: z6.string(),
-      uploadUrl: z6.string().url()
+var publishSessionResponseSchema = z8.object({
+  artifactId: z8.string(),
+  expiresAt: z8.string(),
+  filesToUpload: z8.array(
+    z8.object({
+      method: z8.literal("PUT"),
+      path: z8.string(),
+      uploadUrl: z8.string().url()
     })
   ),
-  publishSessionId: z6.string(),
-  skippedFiles: z6.array(z6.string()),
-  versionId: z6.string()
+  publishSessionId: z8.string(),
+  skippedFiles: z8.array(z8.string()),
+  versionId: z8.string()
 });
-var finalizeResponseSchema = z6.object({
-  artifactId: z6.string(),
+var finalizeResponseSchema = z8.object({
+  artifactId: z8.string(),
   // API-key publishes create the artifact already claimed (SPEC §5.4) —
   // the CLI uses this to tell "claim URL pending" from "already yours".
-  claimed: z6.boolean(),
+  claimed: z8.boolean(),
   // Returned only on first publish of a new artifact (one-time).
-  claimUrl: z6.string().url().optional(),
-  publishToken: z6.string().optional(),
-  url: z6.string().url(),
-  versionId: z6.string(),
-  versionNumber: z6.number().int().positive()
+  claimUrl: z8.string().url().optional(),
+  publishToken: z8.string().optional(),
+  url: z8.string().url(),
+  versionId: z8.string(),
+  versionNumber: z8.number().int().positive()
 });
-var artifactResponseSchema = z6.object({
-  claimed: z6.boolean(),
-  currentVersion: z6.object({
-    entryUrl: z6.string().url(),
-    id: z6.string(),
-    versionNumber: z6.number().int().positive()
+var artifactResponseSchema = z8.object({
+  claimed: z8.boolean(),
+  currentVersion: z8.object({
+    entryUrl: z8.string().url(),
+    id: z8.string(),
+    versionNumber: z8.number().int().positive()
   }).nullable(),
-  id: z6.string(),
-  slug: z6.string(),
-  title: z6.string()
+  id: z8.string(),
+  slug: z8.string(),
+  title: z8.string()
 });
 
 // ../shared/src/report.ts
-import { z as z7 } from "zod";
-var reportRequestSchema = z7.object({
-  reason: z7.string().max(1e3).optional()
+import { z as z9 } from "zod";
+var reportRequestSchema = z9.object({
+  reason: z9.string().max(1e3).optional()
 });
-var reportResponseSchema = z7.object({
-  reported: z7.literal(true)
+var reportResponseSchema = z9.object({
+  reported: z9.literal(true)
 });
 
 // ../shared/src/stats.ts
-import { z as z8 } from "zod";
-var avgViewSecondsSchema = z8.number().int().nonnegative().nullable();
-var versionViewStatsSchema = z8.object({
+import { z as z10 } from "zod";
+var avgViewSecondsSchema = z10.number().int().nonnegative().nullable();
+var versionViewStatsSchema = z10.object({
   avgViewSeconds: avgViewSecondsSchema,
   // Views from inside the review shell's iframe vs. direct visits to
   // the render URL. views = embeddedViews + directViews.
-  directViews: z8.number().int().nonnegative(),
-  embeddedViews: z8.number().int().nonnegative(),
+  directViews: z10.number().int().nonnegative(),
+  embeddedViews: z10.number().int().nonnegative(),
   // Distinct hashed viewer IPs across the version's lifetime.
-  uniqueViewers: z8.number().int().nonnegative(),
-  versionNumber: z8.number().int().positive(),
-  views: z8.number().int().nonnegative()
+  uniqueViewers: z10.number().int().nonnegative(),
+  versionNumber: z10.number().int().positive(),
+  views: z10.number().int().nonnegative()
 });
-var dailyViewsSchema = z8.object({
+var dailyViewsSchema = z10.object({
   avgViewSeconds: avgViewSecondsSchema,
   // UTC day, YYYY-MM-DD.
-  day: z8.string(),
-  uniqueViewers: z8.number().int().nonnegative(),
-  views: z8.number().int().nonnegative()
+  day: z10.string(),
+  uniqueViewers: z10.number().int().nonnegative(),
+  views: z10.number().int().nonnegative()
 });
-var artifactStatsResponseSchema = z8.object({
+var artifactStatsResponseSchema = z10.object({
   avgViewSeconds: avgViewSecondsSchema,
-  daily: z8.array(dailyViewsSchema),
+  daily: z10.array(dailyViewsSchema),
   // Distinct hashed viewer IPs across all versions and days.
-  totalUniqueViewers: z8.number().int().nonnegative(),
-  totalViews: z8.number().int().nonnegative(),
-  versions: z8.array(versionViewStatsSchema)
+  totalUniqueViewers: z10.number().int().nonnegative(),
+  totalViews: z10.number().int().nonnegative(),
+  versions: z10.array(versionViewStatsSchema)
 });
 
 // ../shared/src/versions.ts
-import { z as z9 } from "zod";
-var versionSourceSchema = z9.object({
-  agentName: z9.string().nullable(),
-  type: z9.string()
+import { z as z11 } from "zod";
+var versionSourceSchema = z11.object({
+  agentName: z11.string().nullable(),
+  type: z11.string()
 });
-var versionChangesSchema = z9.object({
-  added: z9.array(z9.string()),
-  changed: z9.array(z9.string()),
-  removed: z9.array(z9.string())
+var versionChangesSchema = z11.object({
+  added: z11.array(z11.string()),
+  changed: z11.array(z11.string()),
+  removed: z11.array(z11.string())
 });
-var versionSummarySchema = z9.object({
+var versionSummarySchema = z11.object({
   // Absent for the first version — there is no previous version to diff against.
   changes: versionChangesSchema.nullable(),
-  createdAt: z9.string(),
-  entryUrl: z9.string().url(),
-  fileCount: z9.number().int().nonnegative(),
-  id: z9.string(),
-  isCurrent: z9.boolean(),
+  createdAt: z11.string(),
+  entryUrl: z11.string().url(),
+  fileCount: z11.number().int().nonnegative(),
+  id: z11.string(),
+  isCurrent: z11.boolean(),
   source: versionSourceSchema,
-  totalSizeBytes: z9.number().int().nonnegative(),
-  versionNumber: z9.number().int().positive()
+  totalSizeBytes: z11.number().int().nonnegative(),
+  versionNumber: z11.number().int().positive()
 });
-var versionListResponseSchema = z9.object({
-  versions: z9.array(versionSummarySchema)
+var versionListResponseSchema = z11.object({
+  versions: z11.array(versionSummarySchema)
 });
 
 // src/api.ts
@@ -395,6 +457,15 @@ function createApiClient(apiUrl2, publishToken) {
     headers.authorization = `Bearer ${publishToken}`;
   }
   return {
+    // SPEC §6.19 — mark the agent as actively waiting for feedback.
+    // Authorized by the publish token this client was created with.
+    async agentHeartbeat(artifactId) {
+      return request(
+        `${base}/api/v1/artifacts/${artifactId}/agent-presence`,
+        { headers, method: "POST" },
+        (d) => agentHeartbeatResponseSchema.parse(d)
+      );
+    },
     async createSession(body) {
       return request(
         `${base}/api/v1/publish`,
@@ -475,37 +546,99 @@ async function uploadFile(uploadUrl, content, mimeType) {
 // src/config.ts
 import {
   appendFileSync,
-  existsSync,
-  mkdirSync,
-  readFileSync,
-  writeFileSync
+  existsSync as existsSync2,
+  mkdirSync as mkdirSync2,
+  readFileSync as readFileSync2,
+  writeFileSync as writeFileSync2
 } from "fs";
+import path2 from "path";
+import { z as z13 } from "zod";
+
+// src/credentials.ts
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from "fs";
+import { homedir } from "os";
 import path from "path";
-import { z as z10 } from "zod";
-var configSchema = z10.object({
-  apiUrl: z10.string(),
-  artifactId: z10.string(),
-  publishToken: z10.string(),
-  slug: z10.string(),
-  url: z10.string()
+import { z as z12 } from "zod";
+var DEFAULT_API_URL = "https://artifact.cafe";
+var credentialsSchema = z12.object({
+  keys: z12.record(z12.string(), z12.string()),
+  version: z12.literal(1)
+});
+function credentialsPath() {
+  return path.join(homedir(), ".artifactcafe", "credentials");
+}
+function apiOrigin(apiUrl2) {
+  return new URL(apiUrl2).origin;
+}
+function readCredentials() {
+  const file = credentialsPath();
+  if (!existsSync(file)) {
+    return { keys: {}, version: 1 };
+  }
+  try {
+    return credentialsSchema.parse(JSON.parse(readFileSync(file, "utf8")));
+  } catch {
+    return { keys: {}, version: 1 };
+  }
+}
+function writeCredentials(credentials) {
+  const file = credentialsPath();
+  mkdirSync(path.dirname(file), { mode: 448, recursive: true });
+  writeFileSync(file, `${JSON.stringify(credentials, null, 2)}
+`, {
+    mode: 384
+  });
+}
+function storedApiKey(apiUrl2) {
+  return readCredentials().keys[apiOrigin(apiUrl2)] ?? null;
+}
+function storeApiKey(apiUrl2, key) {
+  const credentials = readCredentials();
+  credentials.keys[apiOrigin(apiUrl2)] = key;
+  writeCredentials(credentials);
+}
+function removeApiKey(apiUrl2) {
+  const credentials = readCredentials();
+  const origin = apiOrigin(apiUrl2);
+  if (!(origin in credentials.keys)) {
+    return false;
+  }
+  delete credentials.keys[origin];
+  writeCredentials(credentials);
+  return true;
+}
+function resolveApiKey(apiUrl2, flag) {
+  return flag ?? process.env.ARTIFACT_CAFE_API_KEY ?? storedApiKey(apiUrl2) ?? void 0;
+}
+
+// src/config.ts
+var configSchema = z13.object({
+  apiUrl: z13.string(),
+  artifactId: z13.string(),
+  // Optional: a folder linked by `link` to an artifact you own carries no
+  // token — owner actions authorize via your stored login instead. A first
+  // publish still writes the anonymous-mode token here.
+  publishToken: z13.string().optional(),
+  slug: z13.string(),
+  url: z13.string()
 });
 var CONFIG_DIR = ".artifactcafe";
 var CONFIG_FILE = "config.json";
 function readConfig(dir) {
-  const file = path.join(dir, CONFIG_DIR, CONFIG_FILE);
-  if (!existsSync(file)) {
+  const file = path2.join(dir, CONFIG_DIR, CONFIG_FILE);
+  if (!existsSync2(file)) {
     return null;
   }
   try {
-    return configSchema.parse(JSON.parse(readFileSync(file, "utf8")));
+    return configSchema.parse(JSON.parse(readFileSync2(file, "utf8")));
   } catch {
     return null;
   }
 }
 function writeConfig(dir, config) {
-  mkdirSync(path.join(dir, CONFIG_DIR), { recursive: true });
-  writeFileSync(
-    path.join(dir, CONFIG_DIR, CONFIG_FILE),
+  mkdirSync2(path2.join(dir, CONFIG_DIR), { recursive: true });
+  writeFileSync2(
+    path2.join(dir, CONFIG_DIR, CONFIG_FILE),
     `${JSON.stringify(config, null, 2)}
 `,
     { mode: 384 }
@@ -513,11 +646,11 @@ function writeConfig(dir, config) {
   ensureGitignored(dir);
 }
 function ensureGitignored(dir) {
-  const gitignore = path.join(dir, ".gitignore");
-  if (!existsSync(gitignore)) {
+  const gitignore = path2.join(dir, ".gitignore");
+  if (!existsSync2(gitignore)) {
     return;
   }
-  const lines = readFileSync(gitignore, "utf8").split(/\r?\n/);
+  const lines = readFileSync2(gitignore, "utf8").split(/\r?\n/);
   const present = lines.some((l) => {
     const t = l.trim();
     return t === CONFIG_DIR || t === `${CONFIG_DIR}/` || t === `/${CONFIG_DIR}` || t === `/${CONFIG_DIR}/`;
@@ -532,10 +665,30 @@ ${CONFIG_DIR}/
     );
   }
 }
+function reviewUrl(apiUrl2, slug) {
+  return `${apiUrl2.replace(/\/$/, "")}/a/${slug}`;
+}
+function resolveArtifactTarget(dir, opts = {}) {
+  const config = readConfig(dir);
+  const apiUrl2 = process.env.ARTIFACT_CAFE_URL ?? config?.apiUrl ?? DEFAULT_API_URL;
+  const artifactId = opts.artifact ?? process.env.ARTIFACT_CAFE_ARTIFACT_ID ?? config?.artifactId ?? null;
+  if (!artifactId) {
+    throw new Error(
+      `No artifact linked in ${dir}. Run \`artifact-cafe publish\` here, \`artifact-cafe link\` to bind one you own, or pass --artifact <id> (or set ARTIFACT_CAFE_ARTIFACT_ID) to act on an artifact linked elsewhere.`
+    );
+  }
+  const folderToken = artifactId === config?.artifactId ? config.publishToken : void 0;
+  const credential = folderToken ?? process.env.ARTIFACT_CAFE_TOKEN ?? resolveApiKey(apiUrl2, opts.apiKey);
+  const url = artifactId === config?.artifactId ? config.url : void 0;
+  return { apiUrl: apiUrl2, artifactId, credential, url };
+}
 
 // src/comments.ts
 var STATUSES = ["open", "resolved", "all"];
 var VERSIONS = ["current", "all"];
+var pollSeconds = () => Number(process.env.AC_WAIT_POLL_SECONDS ?? 5);
+var settleSeconds = () => Number(process.env.AC_WAIT_SETTLE_SECONDS ?? 20);
+var WAIT_TIMEOUT_EXIT = 2;
 async function comments(opts) {
   if (!STATUSES.includes(opts.status)) {
     throw new Error(
@@ -549,16 +702,24 @@ async function comments(opts) {
   }
   const status = opts.status;
   const version = opts.version;
-  const dir = path2.resolve(opts.dir);
-  const config = readConfig(dir);
-  if (!config) {
-    throw new Error(
-      `No artifact linked in ${dir} \u2014 run \`artifact-cafe publish\` there first (.artifactcafe/config.json not found).`
-    );
+  const dir = path3.resolve(opts.dir);
+  const target = resolveArtifactTarget(dir, {
+    apiKey: opts.apiKey,
+    artifact: opts.artifact
+  });
+  const client = createApiClient(target.apiUrl, target.credential);
+  const url = target.url ?? (opts.json ? "" : await deriveReviewUrl(client, target));
+  const ref = { artifactId: target.artifactId, url };
+  if (opts.wait) {
+    await waitForFeedback(client, ref, {
+      json: opts.json,
+      status,
+      timeoutSeconds: opts.timeout,
+      version
+    });
+    return;
   }
-  const apiUrl2 = process.env.ARTIFACT_CAFE_URL ?? config.apiUrl;
-  const client = createApiClient(apiUrl2);
-  const data = await client.exportComments(config.artifactId, {
+  const data = await client.exportComments(target.artifactId, {
     status,
     version
   });
@@ -566,7 +727,117 @@ async function comments(opts) {
     console.log(JSON.stringify(data, null, 2));
     return;
   }
-  printHuman(data, config.url, status, version);
+  printHuman(data, url, status, version);
+}
+async function deriveReviewUrl(client, target) {
+  const artifact = await client.getArtifact(target.artifactId);
+  return reviewUrl(target.apiUrl, artifact.slug);
+}
+var sleep = (s) => new Promise((r) => setTimeout(r, s * 1e3));
+function messageCounts(data) {
+  return new Map(data.comments.map((t) => [t.id, 1 + t.replies.length]));
+}
+function diffThreads(baseline, data) {
+  const changed = [];
+  for (const t of data.comments) {
+    const before = baseline.get(t.id);
+    if (before === void 0) {
+      changed.push({ ...t, change: "new" });
+    } else if (1 + t.replies.length > before) {
+      changed.push({ ...t, change: "updated" });
+    }
+  }
+  return changed;
+}
+async function waitForFeedback(client, config, opts) {
+  const query = { status: opts.status, version: opts.version };
+  const baselineExport = await client.exportComments(config.artifactId, query);
+  const baseline = messageCounts(baselineExport);
+  if (!opts.json) {
+    const mins = Math.round(opts.timeoutSeconds / 60);
+    console.log(
+      `Waiting for feedback on ${config.url} \u2014 times out after ${mins}m. Ctrl-C to stop.`
+    );
+  }
+  const deadline = Date.now() + opts.timeoutSeconds * 1e3;
+  let heartbeatWarned = false;
+  let lastHeartbeat = 0;
+  const heartbeat = async () => {
+    if (Date.now() - lastHeartbeat < AGENT_PRESENCE.heartbeatSeconds * 1e3) {
+      return;
+    }
+    lastHeartbeat = Date.now();
+    try {
+      await client.agentHeartbeat(config.artifactId);
+    } catch (err) {
+      if (!(opts.json || heartbeatWarned)) {
+        heartbeatWarned = true;
+        console.error(
+          `(presence heartbeat failed \u2014 reviewers won't see "Agent is listening": ${err instanceof Error ? err.message : err})`
+        );
+      }
+    }
+  };
+  await heartbeat();
+  while (Date.now() < deadline) {
+    await sleep(Math.min(pollSeconds(), (deadline - Date.now()) / 1e3));
+    await heartbeat();
+    const data = await client.exportComments(config.artifactId, query);
+    if (diffThreads(baseline, data).length === 0) {
+      continue;
+    }
+    await sleep(settleSeconds());
+    const settled = await client.exportComments(config.artifactId, query);
+    const changed = diffThreads(baseline, settled);
+    printWaitResult(config, settled, changed, opts.json);
+    return;
+  }
+  if (opts.json) {
+    console.log(
+      JSON.stringify(
+        {
+          artifactId: config.artifactId,
+          threads: [],
+          timedOut: true,
+          versionNumber: baselineExport.versionNumber
+        },
+        null,
+        2
+      )
+    );
+  } else {
+    console.log(
+      `No new feedback after ${opts.timeoutSeconds}s. Run the command again to keep waiting.`
+    );
+  }
+  process.exit(WAIT_TIMEOUT_EXIT);
+}
+function printWaitResult(config, data, changed, json) {
+  if (json) {
+    console.log(
+      JSON.stringify(
+        {
+          artifactId: config.artifactId,
+          threads: changed,
+          timedOut: false,
+          versionNumber: data.versionNumber
+        },
+        null,
+        2
+      )
+    );
+    return;
+  }
+  const plural = changed.length === 1 ? "" : "s";
+  console.log(
+    `
+${changed.length} thread${plural} with new feedback \u2014 ${config.url}
+`
+  );
+  for (const thread of changed) {
+    console.log(thread.change === "new" ? "NEW" : "UPDATED");
+    printThread(thread);
+  }
 }
 function printHuman(data, url, status, version) {
   const statusLabel = status === "all" ? "" : `${status} `;
@@ -589,173 +860,31 @@ function printHuman(data, url, status, version) {
 }
 function printThread(t) {
   const marker = t.status === "resolved" ? "\u2713" : "\u25CF";
-  const date = t.createdAt.slice(0, 10);
-  console.log(
-    `${marker} ${t.author} \xB7 v${t.versionNumber} \xB7 ${date} \xB7 ${t.id}`
-  );
-  if (t.anchor.type === "text") {
-    console.log(`  \u21B3 "${t.anchor.quote}"`);
-  } else if (t.anchor.element) {
-    const el = t.anchor.element;
-    const text = el.text ? ` "${el.text}"` : "";
-    console.log(`  \u21B3 at ${elementLabel(el)}${text} \u2014 ${t.anchor.elementPath}`);
-  } else {
-    console.log(`  \u21B3 at ${t.anchor.elementPath}`);
-  }
-  console.log(indent(t.body, "  "));
-  for (const reply of t.replies) {
-    console.log(indent(`${reply.author}: ${reply.body}`, "    "));
-  }
-  console.log("");
-}
-function indent(text, pad) {
-  return text.split("\n").map((line) => pad + line).join("\n");
-}
-
-// src/errors.ts
-function printCliError(err, json) {
-  if (err instanceof ApiRequestError) {
-    if (json) {
-      console.log(
-        JSON.stringify({
-          error: {
-            code: err.code,
-            message: err.message,
-            retryAfter: err.retryAfter
-          }
-        })
-      );
-    } else {
-      console.error(`\u2717 ${err.message} (${err.code})`);
-      if (err.retryAfter) {
-        console.error(`  Retry in ${err.retryAfter}s.`);
-      }
-    }
-    return;
-  }
-  const message = err instanceof Error ? err.message : String(err);
-  if (json) {
-    console.log(JSON.stringify({ error: { code: "cli_error", message } }));
-  } else {
-    console.error(`\u2717 ${message}`);
-  }
-}
-
-// src/credentials.ts
-import { existsSync as existsSync2, mkdirSync as mkdirSync2, readFileSync as readFileSync2, writeFileSync as writeFileSync2 } from "fs";
-import { homedir } from "os";
-import path3 from "path";
-import { z as z11 } from "zod";
-var DEFAULT_API_URL = "https://artifact.cafe";
-var credentialsSchema = z11.object({
-  keys: z11.record(z11.string(), z11.string()),
-  version: z11.literal(1)
-});
-function credentialsPath() {
-  return path3.join(homedir(), ".artifactcafe", "credentials");
-}
-function apiOrigin(apiUrl2) {
-  return new URL(apiUrl2).origin;
-}
-function readCredentials() {
-  const file = credentialsPath();
-  if (!existsSync2(file)) {
-    return { keys: {}, version: 1 };
-  }
-  try {
-    return credentialsSchema.parse(JSON.parse(readFileSync2(file, "utf8")));
-  } catch {
-    return { keys: {}, version: 1 };
-  }
-}
-function writeCredentials(credentials) {
-  const file = credentialsPath();
-  mkdirSync2(path3.dirname(file), { mode: 448, recursive: true });
-  writeFileSync2(file, `${JSON.stringify(credentials, null, 2)}
-`, {
-    mode: 384
-  });
-}
-function storedApiKey(apiUrl2) {
-  return readCredentials().keys[apiOrigin(apiUrl2)] ?? null;
-}
-function storeApiKey(apiUrl2, key) {
-  const credentials = readCredentials();
-  credentials.keys[apiOrigin(apiUrl2)] = key;
-  writeCredentials(credentials);
-}
-function removeApiKey(apiUrl2) {
-  const credentials = readCredentials();
-  const origin = apiOrigin(apiUrl2);
-  if (!(origin in credentials.keys)) {
-    return false;
-  }
-  delete credentials.keys[origin];
-  writeCredentials(credentials);
-  return true;
-}
-function resolveApiKey(apiUrl2, flag) {
-  return flag ?? process.env.ARTIFACT_CAFE_API_KEY ?? storedApiKey(apiUrl2) ?? void 0;
-}
-
-// src/list.ts
-async function list(opts) {
-  const apiUrl2 = (process.env.ARTIFACT_CAFE_URL ?? DEFAULT_API_URL).replace(
-    /\/$/,
-    ""
-  );
-  const key = resolveApiKey(apiUrl2, opts.apiKey);
-  if (!key) {
-    throw new Error(
-      `Listing your artifacts needs an account \u2014 run \`artifact-cafe login\` first (no API key for ${apiOrigin(apiUrl2)}).`
-    );
-  }
-  const data = await createApiClient(apiUrl2, key).listArtifacts();
-  if (opts.json) {
-    console.log(JSON.stringify(data, null, 2));
-    return;
-  }
-  if (data.artifacts.length === 0) {
-    console.log(
-      "No artifacts in your account yet \u2014 publish while logged in, or claim one via its claim link."
-    );
-    return;
-  }
-  const plural = data.artifacts.length === 1 ? "" : "s";
-  console.log(`${data.artifacts.length} artifact${plural}
-`);
-  for (const artifact of data.artifacts) {
-    printArtifact(artifact);
-  }
-}
-function printArtifact(a) {
-  const version = a.currentVersionNumber === null ? "no version" : `v${a.currentVersionNumber}`;
-  const open2 = a.openCommentCount === 0 ? "no open comments" : `${a.openCommentCount} open comment${a.openCommentCount === 1 ? "" : "s"}`;
-  const marker = a.openCommentCount > 0 ? "\u25CF" : "\u25CB";
-  console.log(`${marker} ${a.title}`);
-  console.log(`  ${version} \xB7 ${open2} \xB7 updated ${relativeTime(a.updatedAt)}`);
-  console.log(`  ${a.url}
-`);
-}
-function relativeTime(iso) {
-  const seconds = Math.max(0, (Date.now() - new Date(iso).getTime()) / 1e3);
-  if (seconds < 60) {
-    return "just now";
-  }
-  if (seconds < 3600) {
-    return `${Math.floor(seconds / 60)}m ago`;
-  }
-  if (seconds < 86400) {
-    return `${Math.floor(seconds / 3600)}h ago`;
+  const date = t.createdAt.slice(0, 10);
+  console.log(
+    `${marker} ${t.author} \xB7 v${t.versionNumber} \xB7 ${date} \xB7 ${t.id}`
+  );
+  if (t.anchor.type === "text") {
+    console.log(`  \u21B3 "${t.anchor.quote}"`);
+  } else if (t.anchor.element) {
+    const el = t.anchor.element;
+    const text = el.text ? ` "${el.text}"` : "";
+    console.log(`  \u21B3 at ${elementLabel(el)}${text} \u2014 ${t.anchor.elementPath}`);
+  } else {
+    console.log(`  \u21B3 at ${t.anchor.elementPath}`);
   }
-  if (seconds < 30 * 86400) {
-    return `${Math.floor(seconds / 86400)}d ago`;
+  console.log(indent(t.body, "  "));
+  for (const reply of t.replies) {
+    console.log(indent(`${reply.author}: ${reply.body}`, "    "));
   }
-  return iso.slice(0, 10);
+  console.log("");
+}
+function indent(text, pad) {
+  return text.split("\n").map((line) => pad + line).join("\n");
 }
 
-// src/login.ts
-import { createInterface } from "readline";
+// src/dashboard.ts
+import path6 from "path";
 
 // src/publish.ts
 import { exec } from "child_process";
@@ -1053,13 +1182,205 @@ function openInBrowser(url) {
   });
 }
 
+// src/dashboard.ts
+function openDashboard(opts) {
+  const base = process.env.ARTIFACT_CAFE_URL ?? readConfig(path6.resolve(opts.dir))?.apiUrl ?? DEFAULT_API_URL;
+  const url = `${base.replace(/\/$/, "")}/dashboard`;
+  console.log(url);
+  if (process.stdout.isTTY) {
+    openInBrowser(url);
+  }
+}
+
+// src/errors.ts
+function printCliError(err, json) {
+  if (err instanceof ApiRequestError) {
+    if (json) {
+      console.log(
+        JSON.stringify({
+          error: {
+            code: err.code,
+            message: err.message,
+            retryAfter: err.retryAfter
+          }
+        })
+      );
+    } else {
+      console.error(`\u2717 ${err.message} (${err.code})`);
+      if (err.retryAfter) {
+        console.error(`  Retry in ${err.retryAfter}s.`);
+      }
+    }
+    return;
+  }
+  const message = err instanceof Error ? err.message : String(err);
+  if (json) {
+    console.log(JSON.stringify({ error: { code: "cli_error", message } }));
+  } else {
+    console.error(`\u2717 ${message}`);
+  }
+}
+
+// src/link.ts
+import path7 from "path";
+import { createInterface } from "readline";
+async function link(opts) {
+  const apiUrl2 = (process.env.ARTIFACT_CAFE_URL ?? DEFAULT_API_URL).replace(
+    /\/$/,
+    ""
+  );
+  const key = resolveApiKey(apiUrl2, opts.apiKey);
+  if (!key) {
+    throw new Error(
+      `Linking needs an account \u2014 run \`artifact-cafe login\` first (no API key for ${apiOrigin(apiUrl2)}).`
+    );
+  }
+  const { artifacts } = await createApiClient(apiUrl2, key).listArtifacts();
+  if (artifacts.length === 0) {
+    throw new Error(
+      "No artifacts in your account yet \u2014 publish one first, or claim one via its claim link."
+    );
+  }
+  const selector = opts.artifact ?? opts.slug;
+  let chosen;
+  if (opts.artifact) {
+    chosen = artifacts.find((a) => a.id === opts.artifact);
+  } else if (opts.slug) {
+    chosen = artifacts.find((a) => a.slug === opts.slug);
+  }
+  if (selector && !chosen) {
+    throw new Error(
+      `No artifact "${selector}" in your account \u2014 run \`artifact-cafe list\` to see them.`
+    );
+  }
+  if (opts.json && !chosen) {
+    console.log(JSON.stringify({ artifacts }, null, 2));
+    return;
+  }
+  if (!chosen) {
+    if (!process.stdin.isTTY) {
+      throw new Error(
+        "Pick an artifact with --artifact <id> or --slug <slug> (or --json to list them). Interactive selection needs a terminal."
+      );
+    }
+    chosen = await pickArtifact(artifacts);
+  }
+  const dir = path7.resolve(opts.dir);
+  writeConfig(dir, {
+    apiUrl: apiUrl2,
+    artifactId: chosen.id,
+    slug: chosen.slug,
+    url: chosen.url
+    // No publishToken — this folder authorizes via your login, not a secret.
+  });
+  if (opts.json) {
+    console.log(
+      JSON.stringify(
+        {
+          artifactId: chosen.id,
+          linked: true,
+          slug: chosen.slug,
+          url: chosen.url
+        },
+        null,
+        2
+      )
+    );
+    return;
+  }
+  console.log(`
+\u2713 Linked ${dir} \u2192 "${chosen.title}"  \u2014  ${chosen.url}`);
+  console.log(
+    "  Owner actions (publish, comments --wait, protect) use your login.\n"
+  );
+}
+function pickArtifact(artifacts) {
+  console.log("Your artifacts:\n");
+  artifacts.forEach((a, i) => {
+    const v = a.currentVersionNumber ? `v${a.currentVersionNumber}` : "\u2014";
+    console.log(
+      `  ${String(i + 1).padStart(2)}. ${a.title}  \xB7  ${v}  \xB7  ${a.url}`
+    );
+  });
+  const rl = createInterface({ input: process.stdin, output: process.stdout });
+  return new Promise((resolve, reject) => {
+    rl.question(`
+Link which? [1-${artifacts.length}]: `, (answer) => {
+      rl.close();
+      const n = Number(answer.trim());
+      if (!(Number.isInteger(n) && n >= 1 && n <= artifacts.length)) {
+        reject(new Error(`Enter a number between 1 and ${artifacts.length}.`));
+        return;
+      }
+      resolve(artifacts[n - 1]);
+    });
+  });
+}
+
+// src/list.ts
+async function list(opts) {
+  const apiUrl2 = (process.env.ARTIFACT_CAFE_URL ?? DEFAULT_API_URL).replace(
+    /\/$/,
+    ""
+  );
+  const key = resolveApiKey(apiUrl2, opts.apiKey);
+  if (!key) {
+    throw new Error(
+      `Listing your artifacts needs an account \u2014 run \`artifact-cafe login\` first (no API key for ${apiOrigin(apiUrl2)}).`
+    );
+  }
+  const data = await createApiClient(apiUrl2, key).listArtifacts();
+  if (opts.json) {
+    console.log(JSON.stringify(data, null, 2));
+    return;
+  }
+  if (data.artifacts.length === 0) {
+    console.log(
+      "No artifacts in your account yet \u2014 publish while logged in, or claim one via its claim link."
+    );
+    return;
+  }
+  const plural = data.artifacts.length === 1 ? "" : "s";
+  console.log(`${data.artifacts.length} artifact${plural}
+`);
+  for (const artifact of data.artifacts) {
+    printArtifact(artifact);
+  }
+}
+function printArtifact(a) {
+  const version = a.currentVersionNumber === null ? "no version" : `v${a.currentVersionNumber}`;
+  const open2 = a.openCommentCount === 0 ? "no open comments" : `${a.openCommentCount} open comment${a.openCommentCount === 1 ? "" : "s"}`;
+  const marker = a.openCommentCount > 0 ? "\u25CF" : "\u25CB";
+  console.log(`${marker} ${a.title}`);
+  console.log(`  ${version} \xB7 ${open2} \xB7 updated ${relativeTime(a.updatedAt)}`);
+  console.log(`  ${a.url}
+`);
+}
+function relativeTime(iso) {
+  const seconds = Math.max(0, (Date.now() - new Date(iso).getTime()) / 1e3);
+  if (seconds < 60) {
+    return "just now";
+  }
+  if (seconds < 3600) {
+    return `${Math.floor(seconds / 60)}m ago`;
+  }
+  if (seconds < 86400) {
+    return `${Math.floor(seconds / 3600)}h ago`;
+  }
+  if (seconds < 30 * 86400) {
+    return `${Math.floor(seconds / 86400)}d ago`;
+  }
+  return iso.slice(0, 10);
+}
+
 // src/login.ts
+import { createInterface as createInterface2 } from "readline";
 function apiUrl() {
   return (process.env.ARTIFACT_CAFE_URL ?? DEFAULT_API_URL).replace(/\/$/, "");
 }
 function promptSecret(question) {
   return new Promise((resolve) => {
-    const rl = createInterface({
+    const rl = createInterface2({
       input: process.stdin,
       output: process.stdout
     });
@@ -1167,23 +1488,27 @@ function logout(opts) {
 }
 
 // src/open.ts
-import path6 from "path";
-function openArtifact(opts) {
-  const dir = path6.resolve(opts.dir);
-  const config = readConfig(dir);
-  if (!config) {
-    throw new Error(
-      `No artifact linked in ${dir} \u2014 run \`artifact-cafe publish\` there first (.artifactcafe/config.json not found).`
-    );
-  }
-  console.log(config.url);
+import path8 from "path";
+async function openArtifact(opts) {
+  const dir = path8.resolve(opts.dir);
+  const target = resolveArtifactTarget(dir, {
+    apiKey: opts.apiKey,
+    artifact: opts.artifact
+  });
+  const url = target.url ?? reviewUrl(
+    target.apiUrl,
+    (await createApiClient(target.apiUrl, target.credential).getArtifact(
+      target.artifactId
+    )).slug
+  );
+  console.log(url);
   if (process.stdout.isTTY) {
-    openInBrowser(config.url);
+    openInBrowser(url);
   }
 }
 
 // src/protect.ts
-import path7 from "path";
+import path9 from "path";
 async function protect(opts) {
   if (opts.off && opts.password !== void 0) {
     throw new Error("Pass either --password or --off, not both.");
@@ -1200,26 +1525,26 @@ async function protect(opts) {
       throw new Error(parsed.error.issues[0]?.message ?? "Invalid password.");
     }
   }
-  const dir = path7.resolve(opts.dir);
-  const config = readConfig(dir);
-  if (!config) {
-    throw new Error(
-      `No artifact linked in ${dir} \u2014 run \`artifact-cafe publish\` there first (.artifactcafe/config.json not found).`
-    );
-  }
-  const apiUrl2 = process.env.ARTIFACT_CAFE_URL ?? config.apiUrl;
-  const token = config.publishToken ?? process.env.ARTIFACT_CAFE_TOKEN;
-  const client = createApiClient(apiUrl2, token);
-  const res = await client.setProtection(config.artifactId, password);
+  const dir = path9.resolve(opts.dir);
+  const target = resolveArtifactTarget(dir, {
+    apiKey: opts.apiKey,
+    artifact: opts.artifact
+  });
+  const client = createApiClient(target.apiUrl, target.credential);
+  const res = await client.setProtection(target.artifactId, password);
   if (opts.json) {
     console.log(JSON.stringify({ protected: res.protected }, null, 2));
     return;
   }
+  const url = target.url ?? reviewUrl(
+    target.apiUrl,
+    (await client.getArtifact(target.artifactId)).slug
+  );
   console.log(
     res.protected ? `
-\u2713 Password protection on \u2014 ${config.url}
+\u2713 Password protection on \u2014 ${url}
 ` : `
-\u2713 Password protection removed \u2014 ${config.url}
+\u2713 Password protection removed \u2014 ${url}
 `
   );
 }
@@ -1344,8 +1669,56 @@ var list2 = defineCommand({
     }
   }
 });
+var link2 = defineCommand({
+  args: {
+    "api-key": {
+      description: "Link with this API key (default: stored login)",
+      type: "string"
+    },
+    artifact: {
+      description: "Link this artifact id (skip the picker)",
+      type: "string"
+    },
+    dir: {
+      default: ".",
+      description: "Directory to link",
+      type: "positional"
+    },
+    json: { description: "Machine-readable output", type: "boolean" },
+    slug: {
+      description: "Link this artifact slug (skip the picker)",
+      type: "string"
+    }
+  },
+  meta: {
+    description: "Link a folder to one of your artifacts (pick from your account)",
+    name: "link"
+  },
+  async run({ args }) {
+    try {
+      await link({
+        apiKey: args["api-key"],
+        artifact: args.artifact,
+        dir: args.dir,
+        json: Boolean(args.json),
+        slug: args.slug
+      });
+    } catch (err) {
+      printCliError(err, Boolean(args.json));
+      process.exit(1);
+    }
+  }
+});
 var comments2 = defineCommand({
   args: {
+    "api-key": {
+      description: "Authorize with an account API key (default: stored login)",
+      type: "string"
+    },
+    artifact: {
+      description: "Act on an artifact ID instead of the linked folder",
+      type: "string"
+    },
     dir: {
       default: ".",
       description: "Published directory",
@@ -1357,10 +1730,19 @@ var comments2 = defineCommand({
       description: "Filter: open | resolved | all",
       type: "string"
     },
+    timeout: {
+      default: "900",
+      description: "With --wait: give up after this many seconds (exit 2)",
+      type: "string"
+    },
     version: {
       default: "current",
       description: "Filter: current | all",
       type: "string"
+    },
+    wait: {
+      description: "Block until a reviewer leaves new feedback",
+      type: "boolean"
     }
   },
   meta: {
@@ -1369,11 +1751,21 @@ var comments2 = defineCommand({
   },
   async run({ args }) {
     try {
+      const timeout = Number(args.timeout);
+      if (!Number.isFinite(timeout) || timeout <= 0) {
+        throw new Error(
+          `--timeout must be a positive number of seconds (got "${args.timeout}").`
+        );
+      }
       await comments({
+        apiKey: args["api-key"],
+        artifact: args.artifact,
         dir: args.dir,
         json: Boolean(args.json),
         status: args.status,
-        version: args.version
+        timeout,
+        version: args.version,
+        wait: Boolean(args.wait)
       });
     } catch (err) {
       printCliError(err, Boolean(args.json));
@@ -1383,6 +1775,14 @@ var comments2 = defineCommand({
 });
 var protect2 = defineCommand({
   args: {
+    "api-key": {
+      description: "Authorize with an account API key (default: stored login)",
+      type: "string"
+    },
+    artifact: {
+      description: "Act on an artifact ID instead of the linked folder",
+      type: "string"
+    },
     dir: {
       default: ".",
       description: "Published directory",
@@ -1399,6 +1799,8 @@ var protect2 = defineCommand({
   async run({ args }) {
     try {
       await protect({
+        apiKey: args["api-key"],
+        artifact: args.artifact,
         dir: args.dir,
         json: Boolean(args.json),
         off: Boolean(args.off),
@@ -1412,6 +1814,14 @@ var protect2 = defineCommand({
 });
 var open = defineCommand({
   args: {
+    "api-key": {
+      description: "Authorize with an account API key (default: stored login)",
+      type: "string"
+    },
+    artifact: {
+      description: "Open an artifact ID instead of the linked folder",
+      type: "string"
+    },
     dir: {
       default: ".",
       description: "Published directory",
@@ -1419,9 +1829,34 @@ var open = defineCommand({
     }
   },
   meta: { description: "Open the linked artifact's review URL", name: "open" },
+  async run({ args }) {
+    try {
+      await openArtifact({
+        apiKey: args["api-key"],
+        artifact: args.artifact,
+        dir: args.dir
+      });
+    } catch (err) {
+      printCliError(err, false);
+      process.exit(1);
+    }
+  }
+});
+var dashboard = defineCommand({
+  args: {
+    dir: {
+      default: ".",
+      description: "Directory whose linked instance to open (optional)",
+      type: "positional"
+    }
+  },
+  meta: {
+    description: "Open your personal dashboard in the browser",
+    name: "dashboard"
+  },
   run({ args }) {
     try {
-      openArtifact({ dir: args.dir });
+      openDashboard({ dir: args.dir });
     } catch (err) {
       printCliError(err, false);
       process.exit(1);
@@ -1433,8 +1868,21 @@ var main = defineCommand({
     description: "Publish AI-generated artifacts for review \u2014 https://artifact.cafe",
     name: "artifact-cafe"
   },
+  // Bare `artifact-cafe` (no subcommand) → brand banner + usage. citty
+  // still calls this parent run *after* a matched subcommand, so bail when
+  // a subcommand token is present (any non-flag arg; citty has already
+  // rejected unknown ones with E_UNKNOWN_COMMAND before we get here).
+  async run({ cmd, rawArgs }) {
+    if (rawArgs.some((arg) => !arg.startsWith("-"))) {
+      return;
+    }
+    printBanner();
+    await showUsage(cmd);
+  },
   subCommands: {
     comments: comments2,
+    dashboard,
+    link: link2,
     list: list2,
     login: login2,
     logout: logout2,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "artifact-cafe",
-  "version": "0.0.3",
+  "version": "0.0.5",
   "description": "Publish AI-generated artifacts for review on artifact.cafe",
   "type": "module",
   "bin": {
@@ -9,19 +9,19 @@
   "files": [
     "dist"
   ],
-  "scripts": {
-    "build": "tsup",
-    "typecheck": "tsc --noEmit",
-    "dev": "tsup --watch"
-  },
   "dependencies": {
     "citty": "^0.1.6",
     "zod": "^4.1.0"
   },
   "devDependencies": {
-    "@artifact-cafe/shared": "workspace:*",
     "@types/node": "^24.0.0",
     "tsup": "^8.5.0",
-    "typescript": "^5.9.0"
+    "typescript": "^5.9.0",
+    "@artifact-cafe/shared": "0.1.0"
+  },
+  "scripts": {
+    "build": "tsup",
+    "typecheck": "tsc --noEmit",
+    "dev": "tsup --watch"
   }
-}
+}