artifact-cafe 0.0.5 → 0.0.7

package/dist/index.js

@@ -130,8 +130,11 @@ var threadActionSchema = z2.object({
   guest: guestSchema.optional()
 });
 var commentAuthorSchema = z2.object({
+  avatarUrl: z2.string().nullable(),
   displayName: z2.string(),
-  guestId: z2.string().nullable()
+  guestId: z2.string().nullable(),
+  isViewer: z2.boolean(),
+  kind: z2.enum(["member", "guest"])
 });
 var commentMessageSchema = z2.object({
   author: commentAuthorSchema,
@@ -158,12 +161,14 @@ var commentExportQuerySchema = z2.object({
 });
 var commentExportReplySchema = z2.object({
   author: z2.string(),
+  authorKind: z2.enum(["member", "guest"]),
   body: z2.string(),
   createdAt: z2.string()
 });
 var commentExportThreadSchema = z2.object({
   anchor: anchorSchema,
   author: z2.string(),
+  authorKind: z2.enum(["member", "guest"]),
   body: z2.string(),
   createdAt: z2.string(),
   id: z2.string(),
@@ -199,6 +204,15 @@ import { z as z4 } from "zod";
 var ownArtifactSchema = z4.object({
   createdAt: z4.string(),
   currentVersionNumber: z4.number().nullable(),
+  // Owned artifacts normally never expire; non-null only while an
+  // expiry is still set (e.g. an unclaimed publish surfaced here later).
+  expiresAt: z4.string().nullable(),
+  // SPEC-2 §8.4 — the containing folder's name for workspace-owned
+  // artifacts; always null for personal artifacts.
+  folderName: z4.string().nullable(),
+  // Whether a publish token is still active — revocable from the
+  // dashboard (§6.18); the token itself is never returned.
+  hasPublishToken: z4.boolean(),
   id: z4.string(),
   openThreads: z4.number(),
   protected: z4.boolean(),
@@ -212,64 +226,217 @@ var ownArtifactSchema = z4.object({
 var ownArtifactsResponseSchema = z4.object({
   artifacts: z4.array(ownArtifactSchema)
 });
+var revokePublishTokenResponseSchema = z4.object({
+  revoked: z4.boolean()
+});
 
 // ../shared/src/owner.ts
+import { z as z6 } from "zod";
+
+// ../shared/src/workspaces.ts
 import { z as z5 } from "zod";
-var SLUG_PATTERN = /^[a-z0-9](?:[a-z0-9-]{1,61}[a-z0-9])$/;
-var claimResponseSchema = z5.object({
-  artifactId: z5.string(),
+var WORKSPACE_HANDLE_PATTERN = /^[a-z0-9](?:[a-z0-9-]{1,30}[a-z0-9])$/;
+var workspaceRoleSchema = z5.enum(["owner", "admin", "member"]);
+var workspaceInviteRoleSchema = z5.enum(["admin", "member"]);
+var workspaceHandleSchema = z5.string().min(3).max(32).regex(WORKSPACE_HANDLE_PATTERN, {
+  message: "handle must be lowercase letters, digits, and hyphens, with no leading/trailing hyphen"
+});
+var createWorkspaceSchema = z5.object({
+  handle: workspaceHandleSchema.optional(),
+  name: z5.string().trim().min(1).max(100)
+});
+var updateWorkspaceSchema = z5.object({
+  handle: workspaceHandleSchema.optional(),
+  name: z5.string().trim().min(1).max(100).optional()
+}).refine((body) => body.handle !== void 0 || body.name !== void 0, {
+  message: "provide at least one of name or handle"
+});
+var workspaceSchema = z5.object({
+  createdAt: z5.string(),
+  handle: z5.string(),
+  id: z5.string(),
+  name: z5.string(),
+  role: workspaceRoleSchema.nullable(),
+  updatedAt: z5.string()
+});
+var workspaceListResponseSchema = z5.object({
+  workspaces: z5.array(workspaceSchema)
+});
+var deleteWorkspaceResponseSchema = z5.object({
+  deleted: z5.literal(true)
+});
+var workspaceMemberSchema = z5.object({
+  createdAt: z5.string(),
+  email: z5.string().email(),
+  image: z5.string().nullable(),
+  name: z5.string(),
+  role: workspaceRoleSchema,
+  userId: z5.string()
+});
+var workspaceMemberListResponseSchema = z5.object({
+  members: z5.array(workspaceMemberSchema)
+});
+var updateWorkspaceMemberSchema = z5.object({
+  role: workspaceRoleSchema
+});
+var removeWorkspaceMemberResponseSchema = z5.object({
+  removed: z5.literal(true)
+});
+var createWorkspaceInviteSchema = z5.object({
+  email: z5.string().trim().toLowerCase().email().optional(),
+  expiresAt: z5.string().datetime(),
+  maxUses: z5.number().int().positive().optional(),
+  role: workspaceInviteRoleSchema
+});
+var workspaceInviteSchema = z5.object({
+  createdAt: z5.string(),
+  email: z5.string().email().nullable(),
+  expiresAt: z5.string(),
+  id: z5.string(),
+  maxUses: z5.number().int().positive().nullable(),
+  role: workspaceInviteRoleSchema,
+  tokenPrefix: z5.string(),
+  useCount: z5.number().int().nonnegative()
+});
+var createdWorkspaceInviteSchema = workspaceInviteSchema.extend({
+  url: z5.string().url()
+});
+var workspaceInviteListResponseSchema = z5.object({
+  invites: z5.array(workspaceInviteSchema)
+});
+var revokeWorkspaceInviteResponseSchema = z5.object({
+  revoked: z5.literal(true)
+});
+var acceptWorkspaceInviteSchema = z5.object({
+  token: z5.string().min(1)
+});
+var acceptWorkspaceInviteResponseSchema = z5.object({
+  role: workspaceRoleSchema,
+  workspace: workspaceSchema
+});
+var folderVisibilitySchema = z5.enum(["public", "workspace"]);
+var artifactVisibilitySchema = z5.enum([
+  "public",
+  "unlisted",
+  "workspace"
+]);
+var createFolderSchema = z5.object({
+  name: z5.string().trim().min(1).max(100),
+  visibility: folderVisibilitySchema
+});
+var updateFolderSchema = z5.object({
+  // With `visibility`: bulk-update the folder's artifacts to match
+  // (SPEC-2 §3.4 "Changing a folder's visibility offers a bulk update").
+  cascade: z5.boolean().optional(),
+  name: z5.string().trim().min(1).max(100).optional(),
+  sortOrder: z5.number().int().min(0).optional(),
+  visibility: folderVisibilitySchema.optional()
+}).refine(
+  (body) => body.name !== void 0 || body.visibility !== void 0 || body.sortOrder !== void 0,
+  { message: "provide at least one of name, visibility, sortOrder" }
+).refine((body) => !body.cascade || body.visibility !== void 0, {
+  message: "cascade requires visibility"
+});
+var folderSchema = z5.object({
+  createdAt: z5.string(),
+  id: z5.string(),
+  name: z5.string(),
+  // Permalink segment for the public folder page (/w/{handle}/f/{slug}).
+  // Server-derived from the name; renames regenerate it.
+  slug: z5.string(),
+  sortOrder: z5.number().int(),
+  updatedAt: z5.string(),
+  visibility: folderVisibilitySchema,
+  workspaceId: z5.string()
+});
+var folderListResponseSchema = z5.object({
+  folders: z5.array(folderSchema)
+});
+var deleteFolderResponseSchema = z5.object({
+  deleted: z5.literal(true)
+});
+var workspaceArtifactSchema = z5.object({
+  createdAt: z5.string(),
+  currentVersionNumber: z5.number().int().nullable(),
+  folderId: z5.string().nullable(),
+  id: z5.string(),
+  openCommentCount: z5.number().int().nonnegative(),
   slug: z5.string(),
   title: z5.string(),
-  url: z5.string().url()
+  updatedAt: z5.string(),
+  url: z5.string().url(),
+  versionCount: z5.number().int().nonnegative(),
+  visibility: artifactVisibilitySchema
+});
+var workspaceArtifactListResponseSchema = z5.object({
+  artifacts: z5.array(workspaceArtifactSchema)
+});
+
+// ../shared/src/owner.ts
+var SLUG_PATTERN = /^[a-z0-9](?:[a-z0-9-]{1,61}[a-z0-9])$/;
+var claimResponseSchema = z6.object({
+  artifactId: z6.string(),
+  slug: z6.string(),
+  title: z6.string(),
+  url: z6.string().url()
 });
-var updateArtifactSchema = z5.object({
-  slug: z5.string().min(3).max(63).regex(SLUG_PATTERN, {
+var updateArtifactSchema = z6.object({
+  // SPEC-2 §6.4 — placement + visibility. `folderId: null` clears the
+  // folder; `workspaceId: null` moves the artifact out of its workspace
+  // (§5.5 ownership transfer).
+  folderId: z6.string().min(1).nullable().optional(),
+  slug: z6.string().min(3).max(63).regex(SLUG_PATTERN, {
     message: "slug must be lowercase letters, digits, and hyphens, with no leading/trailing hyphen"
   }).optional(),
-  title: z5.string().min(1).max(200).optional()
-}).refine((body) => body.title !== void 0 || body.slug !== void 0, {
-  message: "provide at least one of title, slug"
-});
-var deleteArtifactResponseSchema = z5.object({
-  deleted: z5.literal(true)
+  title: z6.string().min(1).max(200).optional(),
+  visibility: artifactVisibilitySchema.optional(),
+  workspaceId: z6.string().min(1).nullable().optional()
+}).refine(
+  (body) => body.title !== void 0 || body.slug !== void 0 || body.visibility !== void 0 || body.folderId !== void 0 || body.workspaceId !== void 0,
+  {
+    message: "provide at least one of title, slug, visibility, folderId, workspaceId"
+  }
+);
+var deleteArtifactResponseSchema = z6.object({
+  deleted: z6.literal(true)
 });
 
 // ../shared/src/presence.ts
-import { z as z6 } from "zod";
+import { z as z7 } from "zod";
 var AGENT_PRESENCE = {
   heartbeatSeconds: 15,
   shellPollSeconds: 15,
   ttlSeconds: 45
 };
-var agentHeartbeatResponseSchema = z6.object({
-  listening: z6.literal(true),
-  ttlSeconds: z6.number().int().positive()
+var agentHeartbeatResponseSchema = z7.object({
+  listening: z7.literal(true),
+  ttlSeconds: z7.number().int().positive()
 });
-var agentPresenceSchema = z6.object({
-  listening: z6.boolean(),
-  versionNumber: z6.number().int().positive().nullable()
+var agentPresenceSchema = z7.object({
+  listening: z7.boolean(),
+  versionNumber: z7.number().int().positive().nullable()
 });
 
 // ../shared/src/protection.ts
-import { z as z7 } from "zod";
+import { z as z8 } from "zod";
 var PASSWORD_MIN = 6;
 var PASSWORD_MAX = 128;
-var gatePasswordSchema = z7.string().min(PASSWORD_MIN, `Password must be at least ${PASSWORD_MIN} characters.`).max(PASSWORD_MAX, `Password must be at most ${PASSWORD_MAX} characters.`);
-var setProtectionSchema = z7.object({
+var gatePasswordSchema = z8.string().min(PASSWORD_MIN, `Password must be at least ${PASSWORD_MIN} characters.`).max(PASSWORD_MAX, `Password must be at most ${PASSWORD_MAX} characters.`);
+var setProtectionSchema = z8.object({
   password: gatePasswordSchema.nullable()
 });
-var protectionResponseSchema = z7.object({
-  protected: z7.boolean()
+var protectionResponseSchema = z8.object({
+  protected: z8.boolean()
 });
-var unlockSchema = z7.object({
-  password: z7.string().min(1).max(1024)
+var unlockSchema = z8.object({
+  password: z8.string().min(1).max(1024)
 });
-var unlockResponseSchema = z7.object({
-  unlocked: z7.literal(true)
+var unlockResponseSchema = z8.object({
+  unlocked: z8.literal(true)
 });
 
 // ../shared/src/publish.ts
-import { z as z8 } from "zod";
+import { z as z9 } from "zod";
 function isSafeArtifactPath(p) {
   if (p.length === 0 || p.length > 1024) {
     return false;
@@ -282,128 +449,136 @@ function isSafeArtifactPath(p) {
   }
   return p.split("/").every((seg) => seg.length > 0 && seg !== "." && seg !== "..");
 }
-var manifestFileSchema = z8.object({
-  hash: z8.string().regex(/^sha256_[a-f0-9]{64}$/),
-  mimeType: z8.string().regex(/^[-\w.+]+\/[-\w.+]+$/, { message: "invalid MIME type" }),
-  path: z8.string().min(1).max(1024).refine(isSafeArtifactPath, {
+var manifestFileSchema = z9.object({
+  hash: z9.string().regex(/^sha256_[a-f0-9]{64}$/),
+  mimeType: z9.string().regex(/^[-\w.+]+\/[-\w.+]+$/, { message: "invalid MIME type" }),
+  path: z9.string().min(1).max(1024).refine(isSafeArtifactPath, {
     message: "path must be a safe relative path"
   }),
-  size: z8.number().int().positive()
+  size: z9.number().int().positive()
 });
-var publishSourceSchema = z8.object({
-  agent: z8.string().optional(),
-  runId: z8.string().optional(),
-  type: z8.literal("cli")
+var publishSourceSchema = z9.object({
+  agent: z9.string().optional(),
+  runId: z9.string().optional(),
+  type: z9.literal("cli")
 });
-var createPublishSessionSchema = z8.object({
-  artifactId: z8.string().nullable(),
-  entryPath: z8.string().optional(),
-  files: z8.array(manifestFileSchema).min(1).max(1e3),
+var createPublishSessionSchema = z9.object({
+  artifactId: z9.string().nullable(),
+  entryPath: z9.string().optional(),
+  files: z9.array(manifestFileSchema).min(1).max(1e3),
+  // SPEC-2 §6.4 — workspace placement is available only to authenticated
+  // members; the API enforces membership and folder ownership.
+  folderId: z9.string().min(1).optional(),
   source: publishSourceSchema,
-  title: z8.string().max(200).optional()
-});
-var publishSessionResponseSchema = z8.object({
-  artifactId: z8.string(),
-  expiresAt: z8.string(),
-  filesToUpload: z8.array(
-    z8.object({
-      method: z8.literal("PUT"),
-      path: z8.string(),
-      uploadUrl: z8.string().url()
+  title: z9.string().max(200).optional(),
+  workspaceId: z9.string().min(1).optional()
+});
+var publishSessionResponseSchema = z9.object({
+  artifactId: z9.string(),
+  expiresAt: z9.string(),
+  filesToUpload: z9.array(
+    z9.object({
+      method: z9.literal("PUT"),
+      path: z9.string(),
+      uploadUrl: z9.string().url()
     })
   ),
-  publishSessionId: z8.string(),
-  skippedFiles: z8.array(z8.string()),
-  versionId: z8.string()
+  publishSessionId: z9.string(),
+  skippedFiles: z9.array(z9.string()),
+  versionId: z9.string()
 });
-var finalizeResponseSchema = z8.object({
-  artifactId: z8.string(),
+var finalizeResponseSchema = z9.object({
+  artifactId: z9.string(),
   // API-key publishes create the artifact already claimed (SPEC §5.4) —
   // the CLI uses this to tell "claim URL pending" from "already yours".
-  claimed: z8.boolean(),
+  claimed: z9.boolean(),
   // Returned only on first publish of a new artifact (one-time).
-  claimUrl: z8.string().url().optional(),
-  publishToken: z8.string().optional(),
-  url: z8.string().url(),
-  versionId: z8.string(),
-  versionNumber: z8.number().int().positive()
-});
-var artifactResponseSchema = z8.object({
-  claimed: z8.boolean(),
-  currentVersion: z8.object({
-    entryUrl: z8.string().url(),
-    id: z8.string(),
-    versionNumber: z8.number().int().positive()
+  claimUrl: z9.string().url().optional(),
+  publishToken: z9.string().optional(),
+  url: z9.string().url(),
+  versionId: z9.string(),
+  versionNumber: z9.number().int().positive()
+});
+var artifactResponseSchema = z9.object({
+  claimed: z9.boolean(),
+  currentVersion: z9.object({
+    entryUrl: z9.string().url(),
+    id: z9.string(),
+    versionNumber: z9.number().int().positive()
   }).nullable(),
-  id: z8.string(),
-  slug: z8.string(),
-  title: z8.string()
+  // SPEC-2 §6.4 — placement + visibility surface on the artifact.
+  folderId: z9.string().nullable(),
+  id: z9.string(),
+  slug: z9.string(),
+  title: z9.string(),
+  visibility: z9.enum(["public", "unlisted", "workspace"]),
+  workspaceId: z9.string().nullable()
 });
 
 // ../shared/src/report.ts
-import { z as z9 } from "zod";
-var reportRequestSchema = z9.object({
-  reason: z9.string().max(1e3).optional()
+import { z as z10 } from "zod";
+var reportRequestSchema = z10.object({
+  reason: z10.string().max(1e3).optional()
 });
-var reportResponseSchema = z9.object({
-  reported: z9.literal(true)
+var reportResponseSchema = z10.object({
+  reported: z10.literal(true)
 });
 
 // ../shared/src/stats.ts
-import { z as z10 } from "zod";
-var avgViewSecondsSchema = z10.number().int().nonnegative().nullable();
-var versionViewStatsSchema = z10.object({
+import { z as z11 } from "zod";
+var avgViewSecondsSchema = z11.number().int().nonnegative().nullable();
+var versionViewStatsSchema = z11.object({
   avgViewSeconds: avgViewSecondsSchema,
   // Views from inside the review shell's iframe vs. direct visits to
   // the render URL. views = embeddedViews + directViews.
-  directViews: z10.number().int().nonnegative(),
-  embeddedViews: z10.number().int().nonnegative(),
+  directViews: z11.number().int().nonnegative(),
+  embeddedViews: z11.number().int().nonnegative(),
   // Distinct hashed viewer IPs across the version's lifetime.
-  uniqueViewers: z10.number().int().nonnegative(),
-  versionNumber: z10.number().int().positive(),
-  views: z10.number().int().nonnegative()
+  uniqueViewers: z11.number().int().nonnegative(),
+  versionNumber: z11.number().int().positive(),
+  views: z11.number().int().nonnegative()
 });
-var dailyViewsSchema = z10.object({
+var dailyViewsSchema = z11.object({
   avgViewSeconds: avgViewSecondsSchema,
   // UTC day, YYYY-MM-DD.
-  day: z10.string(),
-  uniqueViewers: z10.number().int().nonnegative(),
-  views: z10.number().int().nonnegative()
+  day: z11.string(),
+  uniqueViewers: z11.number().int().nonnegative(),
+  views: z11.number().int().nonnegative()
 });
-var artifactStatsResponseSchema = z10.object({
+var artifactStatsResponseSchema = z11.object({
   avgViewSeconds: avgViewSecondsSchema,
-  daily: z10.array(dailyViewsSchema),
+  daily: z11.array(dailyViewsSchema),
   // Distinct hashed viewer IPs across all versions and days.
-  totalUniqueViewers: z10.number().int().nonnegative(),
-  totalViews: z10.number().int().nonnegative(),
-  versions: z10.array(versionViewStatsSchema)
+  totalUniqueViewers: z11.number().int().nonnegative(),
+  totalViews: z11.number().int().nonnegative(),
+  versions: z11.array(versionViewStatsSchema)
 });
 
 // ../shared/src/versions.ts
-import { z as z11 } from "zod";
-var versionSourceSchema = z11.object({
-  agentName: z11.string().nullable(),
-  type: z11.string()
+import { z as z12 } from "zod";
+var versionSourceSchema = z12.object({
+  agentName: z12.string().nullable(),
+  type: z12.string()
 });
-var versionChangesSchema = z11.object({
-  added: z11.array(z11.string()),
-  changed: z11.array(z11.string()),
-  removed: z11.array(z11.string())
+var versionChangesSchema = z12.object({
+  added: z12.array(z12.string()),
+  changed: z12.array(z12.string()),
+  removed: z12.array(z12.string())
 });
-var versionSummarySchema = z11.object({
+var versionSummarySchema = z12.object({
   // Absent for the first version — there is no previous version to diff against.
   changes: versionChangesSchema.nullable(),
-  createdAt: z11.string(),
-  entryUrl: z11.string().url(),
-  fileCount: z11.number().int().nonnegative(),
-  id: z11.string(),
-  isCurrent: z11.boolean(),
+  createdAt: z12.string(),
+  entryUrl: z12.string().url(),
+  fileCount: z12.number().int().nonnegative(),
+  id: z12.string(),
+  isCurrent: z12.boolean(),
   source: versionSourceSchema,
-  totalSizeBytes: z11.number().int().nonnegative(),
-  versionNumber: z11.number().int().positive()
+  totalSizeBytes: z12.number().int().nonnegative(),
+  versionNumber: z12.number().int().positive()
 });
-var versionListResponseSchema = z11.object({
-  versions: z11.array(versionSummarySchema)
+var versionListResponseSchema = z12.object({
+  versions: z12.array(versionSummarySchema)
 });
 
 // src/api.ts
@@ -507,6 +682,20 @@ function createApiClient(apiUrl2, publishToken) {
         (d) => artifactListResponseSchema.parse(d)
       );
     },
+    async listFolders(workspaceId) {
+      return request(
+        `${base}/api/v1/workspaces/${workspaceId}/folders`,
+        { headers, method: "GET" },
+        (d) => folderListResponseSchema.parse(d)
+      );
+    },
+    async listWorkspaces() {
+      return request(
+        `${base}/api/v1/workspaces`,
+        { headers, method: "GET" },
+        (d) => workspaceListResponseSchema.parse(d)
+      );
+    },
     // SPEC §6.14 — who the presented credential belongs to. Used by
     // `login` to verify a pasted key and by `whoami`.
     async me() {
@@ -552,17 +741,17 @@ import {
   writeFileSync as writeFileSync2
 } from "fs";
 import path2 from "path";
-import { z as z13 } from "zod";
+import { z as z14 } from "zod";
 
 // src/credentials.ts
 import { existsSync, mkdirSync, readFileSync, writeFileSync } from "fs";
 import { homedir } from "os";
 import path from "path";
-import { z as z12 } from "zod";
+import { z as z13 } from "zod";
 var DEFAULT_API_URL = "https://artifact.cafe";
-var credentialsSchema = z12.object({
-  keys: z12.record(z12.string(), z12.string()),
-  version: z12.literal(1)
+var credentialsSchema = z13.object({
+  keys: z13.record(z13.string(), z13.string()),
+  version: z13.literal(1)
 });
 function credentialsPath() {
   return path.join(homedir(), ".artifactcafe", "credentials");
@@ -612,15 +801,19 @@ function resolveApiKey(apiUrl2, flag) {
 }
 
 // src/config.ts
-var configSchema = z13.object({
-  apiUrl: z13.string(),
-  artifactId: z13.string(),
+var configSchema = z14.object({
+  apiUrl: z14.string(),
+  artifactId: z14.string(),
+  folder: z14.string().optional(),
+  folderId: z14.string().optional(),
   // Optional: a folder linked by `link` to an artifact you own carries no
   // token — owner actions authorize via your stored login instead. A first
   // publish still writes the anonymous-mode token here.
-  publishToken: z13.string().optional(),
-  slug: z13.string(),
-  url: z13.string()
+  publishToken: z14.string().optional(),
+  slug: z14.string(),
+  url: z14.string(),
+  workspace: z14.string().optional(),
+  workspaceId: z14.string().optional()
 });
 var CONFIG_DIR = ".artifactcafe";
 var CONFIG_FILE = "config.json";
@@ -1029,6 +1222,7 @@ async function publish(opts) {
   const token = (artifactId !== null && artifactId === config?.artifactId ? config.publishToken : void 0) ?? process.env.ARTIFACT_CAFE_TOKEN;
   const apiUrl2 = process.env.ARTIFACT_CAFE_URL ?? config?.apiUrl ?? DEFAULT_API_URL;
   const apiKey = resolveApiKey(apiUrl2, opts.apiKey);
+  const placement = await resolvePlacement({ apiKey, apiUrl: apiUrl2, config, opts });
   const { files, skipped } = scanDirectory(dir);
   if (files.length === 0) {
     throw new Error(`Nothing to publish in ${dir} (after ignore rules).`);
@@ -1046,12 +1240,14 @@ async function publish(opts) {
     artifactId,
     entryPath,
     files: files.map(({ absPath: _absPath, ...manifest }) => manifest),
+    ...placement.folderId ? { folderId: placement.folderId } : {},
     source: {
       agent: process.env.ARTIFACT_CAFE_AGENT,
       runId: process.env.ARTIFACT_CAFE_RUN_ID,
       type: "cli"
     },
-    title: opts.title
+    title: opts.title,
+    ...placement.workspaceId ? { workspaceId: placement.workspaceId } : {}
   };
   let credential = apiKey ?? token;
   let client = createApiClient(apiUrl2, credential);
@@ -1083,13 +1279,19 @@ async function publish(opts) {
     );
   });
   const result = await client.finalize(session.publishSessionId);
-  if (result.publishToken) {
+  const existingToken = config?.artifactId === result.artifactId ? config.publishToken : void 0;
+  const shouldWriteConfig = result.publishToken !== void 0 || config?.artifactId === result.artifactId || opts.workspace !== void 0 || opts.folder !== void 0;
+  if (shouldWriteConfig) {
     writeConfig(dir, {
       apiUrl: apiUrl2,
       artifactId: result.artifactId,
-      publishToken: result.publishToken,
+      ...placement.folder ? { folder: placement.folder } : {},
+      ...placement.folderId ? { folderId: placement.folderId } : {},
+      ...result.publishToken ?? existingToken ? { publishToken: result.publishToken ?? existingToken } : {},
       slug: slugFromUrl(result.url),
-      url: result.url
+      url: result.url,
+      ...placement.workspace ? { workspace: placement.workspace } : {},
+      ...placement.workspaceId ? { workspaceId: placement.workspaceId } : {}
     });
   }
   if (opts.password !== void 0) {
@@ -1105,8 +1307,12 @@ async function publish(opts) {
         {
           artifactId: result.artifactId,
           claimed: result.claimed,
+          folder: placement.folder ?? null,
+          folderId: placement.folderId ?? null,
           url: result.url,
           versionNumber: result.versionNumber,
+          workspace: placement.workspace ?? null,
+          workspaceId: placement.workspaceId ?? null,
           ...result.claimUrl ? { claimUrl: result.claimUrl } : {},
           ...opts.password === void 0 ? {} : { protected: true },
           filesUploaded: session.filesToUpload.map((f) => f.path),
@@ -1148,6 +1354,76 @@ ${result.claimUrl}
     openInBrowser(result.url);
   }
 }
+async function resolvePlacement(params) {
+  const { apiKey, apiUrl: apiUrl2, config, opts } = params;
+  const hasPlacementFlag = opts.workspace !== void 0 || opts.folder !== void 0;
+  if (!hasPlacementFlag && config?.workspaceId) {
+    if (!apiKey) {
+      throw new Error(
+        `Publishing into workspace ${config.workspace ?? config.workspaceId} needs an account \u2014 run \`artifact-cafe login\` first (no API key for ${apiOrigin(apiUrl2)}).`
+      );
+    }
+    return {
+      ...config.folder ? { folder: config.folder } : {},
+      ...config.folderId ? { folderId: config.folderId } : {},
+      ...config.workspace ? { workspace: config.workspace } : {},
+      workspaceId: config.workspaceId
+    };
+  }
+  if (!hasPlacementFlag) {
+    return {};
+  }
+  if (!apiKey) {
+    throw new Error(
+      "Publishing into a workspace needs an account \u2014 run `artifact-cafe login` first."
+    );
+  }
+  const workspaceHandle = opts.workspace ?? config?.workspace;
+  if (!workspaceHandle) {
+    throw new Error("--folder requires --workspace or a stored workspace.");
+  }
+  const client = createApiClient(apiUrl2, apiKey);
+  let workspaceId;
+  if (opts.workspace === void 0 && config?.workspaceId) {
+    ({ workspaceId } = config);
+  } else {
+    const data2 = await client.listWorkspaces();
+    const workspace = data2.workspaces.find(
+      (candidate) => candidate.handle === workspaceHandle
+    );
+    if (!workspace) {
+      throw new Error(
+        `No workspace with handle "${workspaceHandle}" belongs to this account.`
+      );
+    }
+    workspaceId = workspace.id;
+  }
+  const folderName = opts.workspace !== void 0 && opts.folder === void 0 ? void 0 : opts.folder ?? config?.folder;
+  if (!folderName) {
+    return { workspace: workspaceHandle, workspaceId };
+  }
+  const data = await client.listFolders(workspaceId);
+  const matches = data.folders.filter(
+    (candidate) => candidate.name === folderName || candidate.id === folderName
+  );
+  if (matches.length === 0) {
+    throw new Error(
+      `No folder named "${folderName}" exists in workspace ${workspaceHandle}.`
+    );
+  }
+  if (matches.length > 1) {
+    throw new Error(
+      `More than one folder is named "${folderName}" in workspace ${workspaceHandle}; pass the folder id instead.`
+    );
+  }
+  const folder = matches[0];
+  return {
+    folder: folder.name,
+    folderId: folder.id,
+    workspace: workspaceHandle,
+    workspaceId
+  };
+}
 async function inBatches(items, concurrency, fn) {
   let next = 0;
   const workers = Array.from(
@@ -1221,6 +1497,52 @@ function printCliError(err, json) {
   }
 }
 
+// src/folders.ts
+async function folders(opts) {
+  const apiUrl2 = (process.env.ARTIFACT_CAFE_URL ?? DEFAULT_API_URL).replace(
+    /\/$/,
+    ""
+  );
+  const key = resolveApiKey(apiUrl2, opts.apiKey);
+  if (!key) {
+    throw new Error(
+      `Listing folders needs an account \u2014 run \`artifact-cafe login\` first (no API key for ${apiOrigin(apiUrl2)}).`
+    );
+  }
+  const client = createApiClient(apiUrl2, key);
+  const workspaceData = await client.listWorkspaces();
+  const workspace = workspaceData.workspaces.find(
+    (candidate) => candidate.handle === opts.workspace
+  );
+  if (!workspace) {
+    throw new Error(
+      `No workspace with handle "${opts.workspace}" belongs to this account.`
+    );
+  }
+  const data = await client.listFolders(workspace.id);
+  if (opts.json) {
+    console.log(JSON.stringify(data, null, 2));
+    return;
+  }
+  if (data.folders.length === 0) {
+    console.log(`No folders in workspace ${workspace.handle}.`);
+    return;
+  }
+  const plural = data.folders.length === 1 ? "" : "s";
+  console.log(
+    `${data.folders.length} folder${plural} in ${workspace.handle}
+`
+  );
+  for (const folder of data.folders) {
+    printFolder(folder);
+  }
+}
+function printFolder(folder) {
+  console.log(`${folder.name} (${folder.visibility})`);
+  console.log(`  ${folder.id}
+`);
+}
+
 // src/link.ts
 import path7 from "path";
 import { createInterface } from "readline";
@@ -1401,7 +1723,7 @@ function promptSecret(question) {
 }
 async function login(opts) {
   const base = apiUrl();
-  const keysUrl = `${base}/cli`;
+  const keysUrl = `${base}/dashboard?view=api-keys`;
   let key = opts.apiKey?.trim();
   if (!key) {
     if (!opts.json) {
@@ -1483,7 +1805,7 @@ function logout(opts) {
   }
   console.log(`\u2713 Logged out of ${apiOrigin(base)} on this machine.`);
   console.log(
-    `The key itself is still active \u2014 revoke it at ${base}/cli if this machine is shared.`
+    `The key itself is still active \u2014 revoke it at ${base}/dashboard?view=api-keys if this machine is shared.`
   );
 }
 
@@ -1549,6 +1871,40 @@ async function protect(opts) {
   );
 }
 
+// src/workspaces.ts
+async function workspaces(opts) {
+  const apiUrl2 = (process.env.ARTIFACT_CAFE_URL ?? DEFAULT_API_URL).replace(
+    /\/$/,
+    ""
+  );
+  const key = resolveApiKey(apiUrl2, opts.apiKey);
+  if (!key) {
+    throw new Error(
+      `Listing workspaces needs an account \u2014 run \`artifact-cafe login\` first (no API key for ${apiOrigin(apiUrl2)}).`
+    );
+  }
+  const data = await createApiClient(apiUrl2, key).listWorkspaces();
+  if (opts.json) {
+    console.log(JSON.stringify(data, null, 2));
+    return;
+  }
+  if (data.workspaces.length === 0) {
+    console.log("No workspaces yet \u2014 create one from the dashboard.");
+    return;
+  }
+  const plural = data.workspaces.length === 1 ? "" : "s";
+  console.log(`${data.workspaces.length} workspace${plural}
+`);
+  for (const workspace of data.workspaces) {
+    printWorkspace(workspace);
+  }
+}
+function printWorkspace(workspace) {
+  console.log(`${workspace.name} (${workspace.role ?? "non-member"})`);
+  console.log(`  ${workspace.handle} \xB7 ${workspace.id}
+`);
+}
+
 // src/index.ts
 var publish2 = defineCommand({
   args: {
@@ -1566,13 +1922,21 @@ var publish2 = defineCommand({
       type: "positional"
     },
     entry: { description: "Entry file (default: auto-detect)", type: "string" },
+    folder: {
+      description: "Publish into this workspace folder name (or id)",
+      type: "string"
+    },
     json: { description: "Machine-readable output", type: "boolean" },
     "no-open": { description: "Don't open the review URL", type: "boolean" },
     password: {
       description: "Password-protect the artifact (min 6 chars)",
       type: "string"
     },
-    title: { description: "Artifact title", type: "string" }
+    title: { description: "Artifact title", type: "string" },
+    workspace: {
+      description: "Publish into this workspace handle",
+      type: "string"
+    }
   },
   meta: { description: "Publish a folder as an artifact", name: "publish" },
   async run({ args }) {
@@ -1582,10 +1946,12 @@ var publish2 = defineCommand({
         artifact: args.artifact,
         dir: args.dir,
         entry: args.entry,
+        folder: args.folder,
         json: Boolean(args.json),
         open: !args["no-open"],
         password: args.password,
-        title: args.title
+        title: args.title,
+        workspace: args.workspace
       });
     } catch (err) {
       printCliError(err, Boolean(args.json));
@@ -1669,6 +2035,60 @@ var list2 = defineCommand({
     }
   }
 });
+var folders2 = defineCommand({
+  args: {
+    "api-key": {
+      description: "List with this API key (default: stored login)",
+      type: "string"
+    },
+    json: { description: "Machine-readable output", type: "boolean" },
+    workspace: {
+      description: "Workspace handle whose folders to list",
+      required: true,
+      type: "string"
+    }
+  },
+  meta: {
+    description: "List folders in a workspace",
+    name: "folders"
+  },
+  async run({ args }) {
+    try {
+      await folders({
+        apiKey: args["api-key"],
+        json: Boolean(args.json),
+        workspace: args.workspace
+      });
+    } catch (err) {
+      printCliError(err, Boolean(args.json));
+      process.exit(1);
+    }
+  }
+});
+var workspaces2 = defineCommand({
+  args: {
+    "api-key": {
+      description: "List with this API key (default: stored login)",
+      type: "string"
+    },
+    json: { description: "Machine-readable output", type: "boolean" }
+  },
+  meta: {
+    description: "List the workspaces your account belongs to",
+    name: "workspaces"
+  },
+  async run({ args }) {
+    try {
+      await workspaces({
+        apiKey: args["api-key"],
+        json: Boolean(args.json)
+      });
+    } catch (err) {
+      printCliError(err, Boolean(args.json));
+      process.exit(1);
+    }
+  }
+});
 var link2 = defineCommand({
   args: {
     "api-key": {
@@ -1773,6 +2193,66 @@ var comments2 = defineCommand({
     }
   }
 });
+var listen = defineCommand({
+  args: {
+    "api-key": {
+      description: "Authorize with an account API key (default: stored login)",
+      type: "string"
+    },
+    artifact: {
+      description: "Act on an artifact ID instead of the linked folder",
+      type: "string"
+    },
+    dir: {
+      default: ".",
+      description: "Published directory",
+      type: "positional"
+    },
+    json: { description: "Machine-readable output", type: "boolean" },
+    status: {
+      default: "open",
+      description: "Filter: open | resolved | all",
+      type: "string"
+    },
+    timeout: {
+      default: "900",
+      description: "Give up after this many seconds (exit 2)",
+      type: "string"
+    },
+    version: {
+      default: "current",
+      description: "Filter: current | all",
+      type: "string"
+    }
+  },
+  meta: {
+    description: "Wait for new reviewer feedback (alias for comments --wait)",
+    name: "listen"
+  },
+  async run({ args }) {
+    try {
+      const timeout = Number(args.timeout);
+      if (!Number.isFinite(timeout) || timeout <= 0) {
+        throw new Error(
+          `--timeout must be a positive number of seconds (got "${args.timeout}").`
+        );
+      }
+      await comments({
+        apiKey: args["api-key"],
+        artifact: args.artifact,
+        dir: args.dir,
+        json: Boolean(args.json),
+        status: args.status,
+        timeout,
+        version: args.version,
+        wait: true
+      });
+    } catch (err) {
+      printCliError(err, Boolean(args.json));
+      process.exit(1);
+    }
+  }
+});
 var protect2 = defineCommand({
   args: {
     "api-key": {
@@ -1882,14 +2362,17 @@ var main = defineCommand({
   subCommands: {
     comments: comments2,
     dashboard,
+    folders: folders2,
     link: link2,
     list: list2,
+    listen,
     login: login2,
     logout: logout2,
     open,
     protect: protect2,
     publish: publish2,
-    whoami: whoami2
+    whoami: whoami2,
+    workspaces: workspaces2
   }
 });
 runMain(main);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "artifact-cafe",
-  "version": "0.0.5",
+  "version": "0.0.7",
   "description": "Publish AI-generated artifacts for review on artifact.cafe",
   "type": "module",
   "bin": {