artifact-cafe 0.0.7 → 0.0.9

package/dist/index.js

@@ -30,7 +30,7 @@ function printBanner() {
   console.log();
 }
 
-// src/comments.ts
+// src/comment.ts
 import path3 from "path";
 
 // ../shared/src/account.ts
@@ -58,6 +58,9 @@ var apiKeyListResponseSchema = z.object({
 var revokeApiKeyResponseSchema = z.object({
   revoked: z.literal(true)
 });
+var notificationPrefsSchema = z.object({
+  commentEmailsEnabled: z.boolean()
+});
 var meResponseSchema = z.object({
   // Best-effort profile field from our own user table; null when unknown.
   email: z.string().nullable(),
@@ -81,106 +84,260 @@ var artifactListResponseSchema = z.object({
 });
 
 // ../shared/src/comments.ts
+import { z as z3 } from "zod";
+
+// ../shared/src/publish.ts
 import { z as z2 } from "zod";
-var elementSnapshotSchema = z2.object({
-  classes: z2.string().max(256).optional(),
-  id: z2.string().max(256).optional(),
-  tag: z2.string().min(1).max(128),
-  text: z2.string().max(200).optional()
+function isSafeArtifactPath(p) {
+  if (p.length === 0 || p.length > 1024) {
+    return false;
+  }
+  if (p.includes("\\") || p.includes("\0")) {
+    return false;
+  }
+  if (p.startsWith("/") || p.startsWith("~")) {
+    return false;
+  }
+  return p.split("/").every((seg) => seg.length > 0 && seg !== "." && seg !== "..");
+}
+var manifestFileSchema = z2.object({
+  hash: z2.string().regex(/^sha256_[a-f0-9]{64}$/),
+  mimeType: z2.string().regex(/^[-\w.+]+\/[-\w.+]+$/, { message: "invalid MIME type" }),
+  path: z2.string().min(1).max(1024).refine(isSafeArtifactPath, {
+    message: "path must be a safe relative path"
+  }),
+  size: z2.number().int().positive()
+});
+var publishSourceSchema = z2.object({
+  agent: z2.string().optional(),
+  runId: z2.string().optional(),
+  type: z2.literal("cli")
+});
+var createPublishSessionSchema = z2.object({
+  artifactId: z2.string().nullable(),
+  entryPath: z2.string().optional(),
+  files: z2.array(manifestFileSchema).min(1).max(1e3),
+  // SPEC-2 §6.4 — workspace placement is available only to authenticated
+  // members; the API enforces membership and folder ownership. folderId
+  // without workspaceId resolves against the account's personal workspace.
+  folderId: z2.string().min(1).optional(),
+  source: publishSourceSchema,
+  title: z2.string().max(200).optional(),
+  workspaceId: z2.string().min(1).optional()
+});
+var publishSessionResponseSchema = z2.object({
+  artifactId: z2.string(),
+  expiresAt: z2.string(),
+  filesToUpload: z2.array(
+    z2.object({
+      method: z2.literal("PUT"),
+      path: z2.string(),
+      uploadUrl: z2.string().url()
+    })
+  ),
+  publishSessionId: z2.string(),
+  skippedFiles: z2.array(z2.string()),
+  versionId: z2.string()
+});
+var finalizeResponseSchema = z2.object({
+  artifactId: z2.string(),
+  // API-key publishes create the artifact already claimed (SPEC §5.4) —
+  // the CLI uses this to tell "claim URL pending" from "already yours".
+  claimed: z2.boolean(),
+  // Returned only on first publish of a new artifact (one-time).
+  claimUrl: z2.string().url().optional(),
+  publishToken: z2.string().optional(),
+  url: z2.string().url(),
+  versionId: z2.string(),
+  versionNumber: z2.number().int().positive()
+});
+var artifactResponseSchema = z2.object({
+  claimed: z2.boolean(),
+  currentVersion: z2.object({
+    entryUrl: z2.string().url(),
+    id: z2.string(),
+    versionNumber: z2.number().int().positive()
+  }).nullable(),
+  // SPEC-2 §6.4 — placement + visibility surface on the artifact.
+  folderId: z2.string().nullable(),
+  id: z2.string(),
+  slug: z2.string(),
+  title: z2.string(),
+  visibility: z2.enum(["public", "unlisted", "workspace"]),
+  workspaceId: z2.string().nullable()
 });
-var pointAnchorSchema = z2.object({
+
+// ../shared/src/comments.ts
+var anchorPageSchema = z3.string().max(1024).refine(isSafeArtifactPath, {
+  message: "page must be a safe relative path"
+}).optional();
+var elementSnapshotSchema = z3.object({
+  classes: z3.string().max(256).optional(),
+  id: z3.string().max(256).optional(),
+  tag: z3.string().min(1).max(128),
+  text: z3.string().max(200).optional()
+});
+var pointAnchorSchema = z3.object({
   element: elementSnapshotSchema.optional(),
   // elementPath is the primary anchor; x/y are offsets within the
   // element's box, normalized 0..1 (SPEC.md §8.1).
-  elementPath: z2.string().max(2048),
-  type: z2.literal("point"),
-  viewportHeight: z2.number().int().positive().max(1e5),
-  viewportWidth: z2.number().int().positive().max(1e5),
-  x: z2.number().min(0).max(1),
-  y: z2.number().min(0).max(1)
-});
-var textAnchorSchema = z2.object({
-  elementPath: z2.string().max(2048),
-  endOffset: z2.number().int().nonnegative().max(1e8),
-  prefix: z2.string().max(200).optional(),
-  quote: z2.string().min(1).max(1e3),
-  startOffset: z2.number().int().nonnegative().max(1e8),
-  suffix: z2.string().max(200).optional(),
-  type: z2.literal("text")
-});
-var anchorSchema = z2.discriminatedUnion("type", [
+  elementPath: z3.string().max(2048),
+  page: anchorPageSchema,
+  type: z3.literal("point"),
+  viewportHeight: z3.number().int().positive().max(1e5),
+  viewportWidth: z3.number().int().positive().max(1e5),
+  x: z3.number().min(0).max(1),
+  y: z3.number().min(0).max(1)
+});
+var textAnchorSchema = z3.object({
+  elementPath: z3.string().max(2048),
+  endOffset: z3.number().int().nonnegative().max(1e8),
+  page: anchorPageSchema,
+  prefix: z3.string().max(200).optional(),
+  quote: z3.string().min(1).max(1e3),
+  startOffset: z3.number().int().nonnegative().max(1e8),
+  suffix: z3.string().max(200).optional(),
+  type: z3.literal("text")
+});
+var pageAnchorSchema = z3.object({
+  page: anchorPageSchema,
+  type: z3.literal("page")
+});
+var anchorSchema = z3.discriminatedUnion("type", [
   pointAnchorSchema,
-  textAnchorSchema
+  textAnchorSchema,
+  pageAnchorSchema
 ]);
-var guestSchema = z2.object({
-  displayName: z2.string().min(1).max(64),
-  guestId: z2.string().min(16)
+var displayNameSchema = z3.string().trim().min(1).max(64);
+var guestSchema = z3.object({
+  displayName: displayNameSchema,
+  guestId: z3.string().min(16)
 });
-var createCommentThreadSchema = z2.object({
+var viaLabelSchema = z3.string().trim().min(1).max(64);
+var createCommentThreadSchema = z3.object({
   anchor: anchorSchema,
-  body: z2.string().min(1).max(1e4),
+  body: z3.string().min(1).max(1e4),
   guest: guestSchema.optional(),
-  versionId: z2.string()
+  versionId: z3.string(),
+  via: viaLabelSchema.optional()
+});
+var createCommentMessageSchema = z3.object({
+  body: z3.string().min(1).max(1e4),
+  guest: guestSchema.optional(),
+  via: viaLabelSchema.optional()
 });
-var createCommentMessageSchema = z2.object({
-  body: z2.string().min(1).max(1e4),
+var editCommentMessageSchema = z3.object({
+  body: z3.string().min(1).max(1e4),
   guest: guestSchema.optional()
 });
-var threadActionSchema = z2.object({
+var threadActionSchema = z3.object({
   guest: guestSchema.optional()
 });
-var commentAuthorSchema = z2.object({
-  avatarUrl: z2.string().nullable(),
-  displayName: z2.string(),
-  guestId: z2.string().nullable(),
-  isViewer: z2.boolean(),
-  kind: z2.enum(["member", "guest"])
+var REACTION_EMOJI = [
+  "\u{1F44D}",
+  "\u{1F44E}",
+  "\u2764\uFE0F",
+  "\u{1F389}",
+  "\u{1F4A1}",
+  "\u{1F440}",
+  "\u{1F680}",
+  "\u2615"
+];
+var reactionEmojiSchema = z3.enum(REACTION_EMOJI);
+var toggleReactionSchema = z3.object({
+  emoji: reactionEmojiSchema,
+  guest: guestSchema.optional()
 });
-var commentMessageSchema = z2.object({
+var commentAuthorSchema = z3.object({
+  avatarUrl: z3.string().nullable(),
+  displayName: z3.string(),
+  guestId: z3.string().nullable(),
+  isViewer: z3.boolean(),
+  kind: z3.enum(["member", "guest"]),
+  // Optional "via" attribution (§6.4). Null for plain comments; a bounded
+  // label the shell appends after the display name.
+  via: z3.string().nullable()
+});
+var messageReactionSchema = z3.object({
+  emoji: z3.string(),
+  reactors: z3.array(commentAuthorSchema)
+});
+var commentMessageSchema = z3.object({
   author: commentAuthorSchema,
-  body: z2.string(),
-  createdAt: z2.string(),
-  id: z2.string()
-});
-var commentThreadSchema = z2.object({
+  // Empty string for a deleted message — the body is stripped server-side
+  // (§6.7.1 tombstone), never sent to the client and hidden there.
+  body: z3.string(),
+  createdAt: z3.string(),
+  // Soft-deleted (§6.7.1). A tombstone keeps thread structure and replies;
+  // the shell renders "Comment deleted" instead of the (absent) body.
+  deleted: z3.boolean(),
+  // Last edit time (§6.7.1), or null if never edited — drives the "edited"
+  // badge. No edit history is kept.
+  editedAt: z3.string().nullable(),
+  id: z3.string(),
+  // Defaulted, not required: a new CLI parsing an older server's
+  // response must not fail on the missing key.
+  reactions: z3.array(messageReactionSchema).default([])
+});
+var commentThreadSchema = z3.object({
   anchor: anchorSchema,
-  artifactId: z2.string(),
-  createdAt: z2.string(),
+  artifactId: z3.string(),
+  createdAt: z3.string(),
   createdBy: commentAuthorSchema,
-  id: z2.string(),
-  messages: z2.array(commentMessageSchema),
-  status: z2.enum(["open", "resolved"]),
-  versionId: z2.string()
-});
-var commentThreadListSchema = z2.object({
-  threads: z2.array(commentThreadSchema)
-});
-var commentExportQuerySchema = z2.object({
-  status: z2.enum(["open", "resolved", "all"]).default("open"),
-  version: z2.enum(["current", "all"]).default("current")
-});
-var commentExportReplySchema = z2.object({
-  author: z2.string(),
-  authorKind: z2.enum(["member", "guest"]),
-  body: z2.string(),
-  createdAt: z2.string()
-});
-var commentExportThreadSchema = z2.object({
+  id: z3.string(),
+  messages: z3.array(commentMessageSchema),
+  status: z3.enum(["open", "resolved"]),
+  versionId: z3.string()
+});
+var commentThreadListSchema = z3.object({
+  threads: z3.array(commentThreadSchema)
+});
+var commentExportQuerySchema = z3.object({
+  status: z3.enum(["open", "resolved", "all"]).default("open"),
+  version: z3.enum(["current", "all"]).default("current")
+});
+var exportReactionSchema = z3.object({
+  count: z3.number().int().positive(),
+  emoji: z3.string()
+});
+var commentExportReplySchema = z3.object({
+  author: z3.string(),
+  authorKind: z3.enum(["member", "guest"]),
+  body: z3.string(),
+  createdAt: z3.string(),
+  // Soft-delete tombstone (§6.7.1): body is "" when true.
+  deleted: z3.boolean(),
+  editedAt: z3.string().nullable(),
+  // The message id — what `edit`/`delete` target (§5.1).
+  id: z3.string(),
+  reactions: z3.array(exportReactionSchema).optional()
+});
+var commentExportThreadSchema = z3.object({
   anchor: anchorSchema,
-  author: z2.string(),
-  authorKind: z2.enum(["member", "guest"]),
-  body: z2.string(),
-  createdAt: z2.string(),
-  id: z2.string(),
-  replies: z2.array(commentExportReplySchema),
-  status: z2.enum(["open", "resolved"]),
-  versionNumber: z2.number().int().positive()
-});
-var commentExportSchema = z2.object({
-  artifactId: z2.string(),
-  comments: z2.array(commentExportThreadSchema),
+  author: z3.string(),
+  authorKind: z3.enum(["member", "guest"]),
+  body: z3.string(),
+  createdAt: z3.string(),
+  deleted: z3.boolean(),
+  editedAt: z3.string().nullable(),
+  id: z3.string(),
+  // The opening message's id (distinct from the thread `id`) — `edit`/
+  // `delete` operate on messages, so the CLI needs it to target the first
+  // comment, not just the replies.
+  messageId: z3.string(),
+  reactions: z3.array(exportReactionSchema).optional(),
+  replies: z3.array(commentExportReplySchema),
+  status: z3.enum(["open", "resolved"]),
+  versionNumber: z3.number().int().positive()
+});
+var commentExportSchema = z3.object({
+  artifactId: z3.string(),
+  comments: z3.array(commentExportThreadSchema),
   // The artifact's current version (null before the first finalize).
-  versionNumber: z2.number().int().positive().nullable()
+  versionNumber: z3.number().int().positive().nullable()
+});
+var commentReadResponseSchema = z3.object({
+  lastSeenAt: z3.string()
 });
 function elementLabel(el) {
   if (el.id) {
@@ -191,145 +348,163 @@ function elementLabel(el) {
 }
 
 // ../shared/src/errors.ts
-import { z as z3 } from "zod";
-var apiErrorSchema = z3.object({
-  code: z3.string(),
-  docsUrl: z3.string().url(),
-  message: z3.string(),
-  retryAfter: z3.number().int().positive().optional()
+import { z as z4 } from "zod";
+var apiErrorSchema = z4.object({
+  code: z4.string(),
+  docsUrl: z4.string().url(),
+  message: z4.string(),
+  retryAfter: z4.number().int().positive().optional()
+});
+
+// ../shared/src/feedback.ts
+import { z as z5 } from "zod";
+var feedbackRequestSchema = z5.object({
+  email: z5.string().trim().toLowerCase().email().optional().or(z5.literal("")),
+  message: z5.string().trim().min(1).max(4e3)
+});
+var feedbackResponseSchema = z5.object({
+  sent: z5.literal(true)
 });
 
 // ../shared/src/me.ts
-import { z as z4 } from "zod";
-var ownArtifactSchema = z4.object({
-  createdAt: z4.string(),
-  currentVersionNumber: z4.number().nullable(),
+import { z as z6 } from "zod";
+var ownArtifactSchema = z6.object({
+  createdAt: z6.string(),
+  currentVersionNumber: z6.number().nullable(),
   // Owned artifacts normally never expire; non-null only while an
   // expiry is still set (e.g. an unclaimed publish surfaced here later).
-  expiresAt: z4.string().nullable(),
-  // SPEC-2 §8.4 — the containing folder's name for workspace-owned
-  // artifacts; always null for personal artifacts.
-  folderName: z4.string().nullable(),
+  expiresAt: z6.string().nullable(),
+  // SPEC-2 §8.4 — the containing folder for workspace-owned artifacts;
+  // both null for personal artifacts. `folderId` drives the dashboard's
+  // move control and folder filter; `folderName` is the display label.
+  folderId: z6.string().nullable(),
+  folderName: z6.string().nullable(),
   // Whether a publish token is still active — revocable from the
   // dashboard (§6.18); the token itself is never returned.
-  hasPublishToken: z4.boolean(),
-  id: z4.string(),
-  openThreads: z4.number(),
-  protected: z4.boolean(),
-  slug: z4.string(),
-  title: z4.string(),
-  totalViews: z4.number(),
-  updatedAt: z4.string(),
-  url: z4.string(),
-  versionCount: z4.number()
-});
-var ownArtifactsResponseSchema = z4.object({
-  artifacts: z4.array(ownArtifactSchema)
-});
-var revokePublishTokenResponseSchema = z4.object({
-  revoked: z4.boolean()
+  hasPublishToken: z6.boolean(),
+  id: z6.string(),
+  openThreads: z6.number(),
+  protected: z6.boolean(),
+  slug: z6.string(),
+  title: z6.string(),
+  totalViews: z6.number(),
+  // SPEC §6.20 — messages by others newer than the viewer's last-seen
+  // watermark. 0 for signed-out/API-key-less contexts.
+  unreadComments: z6.number(),
+  updatedAt: z6.string(),
+  url: z6.string(),
+  versionCount: z6.number()
+});
+var ownArtifactsResponseSchema = z6.object({
+  artifacts: z6.array(ownArtifactSchema)
+});
+var revokePublishTokenResponseSchema = z6.object({
+  revoked: z6.boolean()
 });
 
 // ../shared/src/owner.ts
-import { z as z6 } from "zod";
+import { z as z8 } from "zod";
 
 // ../shared/src/workspaces.ts
-import { z as z5 } from "zod";
+import { z as z7 } from "zod";
 var WORKSPACE_HANDLE_PATTERN = /^[a-z0-9](?:[a-z0-9-]{1,30}[a-z0-9])$/;
-var workspaceRoleSchema = z5.enum(["owner", "admin", "member"]);
-var workspaceInviteRoleSchema = z5.enum(["admin", "member"]);
-var workspaceHandleSchema = z5.string().min(3).max(32).regex(WORKSPACE_HANDLE_PATTERN, {
+var workspaceRoleSchema = z7.enum(["owner", "admin", "member"]);
+var workspaceInviteRoleSchema = z7.enum(["admin", "member"]);
+var workspaceHandleSchema = z7.string().min(3).max(32).regex(WORKSPACE_HANDLE_PATTERN, {
   message: "handle must be lowercase letters, digits, and hyphens, with no leading/trailing hyphen"
 });
-var createWorkspaceSchema = z5.object({
+var createWorkspaceSchema = z7.object({
   handle: workspaceHandleSchema.optional(),
-  name: z5.string().trim().min(1).max(100)
+  name: z7.string().trim().min(1).max(100)
 });
-var updateWorkspaceSchema = z5.object({
+var updateWorkspaceSchema = z7.object({
   handle: workspaceHandleSchema.optional(),
-  name: z5.string().trim().min(1).max(100).optional()
+  name: z7.string().trim().min(1).max(100).optional()
 }).refine((body) => body.handle !== void 0 || body.name !== void 0, {
   message: "provide at least one of name or handle"
 });
-var workspaceSchema = z5.object({
-  createdAt: z5.string(),
-  handle: z5.string(),
-  id: z5.string(),
-  name: z5.string(),
+var workspaceSchema = z7.object({
+  createdAt: z7.string(),
+  handle: z7.string(),
+  id: z7.string(),
+  // Auto-provisioned solo workspace, one per user: non-deletable, takes
+  // no members, renameable like any workspace.
+  isPersonal: z7.boolean(),
+  name: z7.string(),
   role: workspaceRoleSchema.nullable(),
-  updatedAt: z5.string()
+  updatedAt: z7.string()
 });
-var workspaceListResponseSchema = z5.object({
-  workspaces: z5.array(workspaceSchema)
+var workspaceListResponseSchema = z7.object({
+  workspaces: z7.array(workspaceSchema)
 });
-var deleteWorkspaceResponseSchema = z5.object({
-  deleted: z5.literal(true)
+var deleteWorkspaceResponseSchema = z7.object({
+  deleted: z7.literal(true)
 });
-var workspaceMemberSchema = z5.object({
-  createdAt: z5.string(),
-  email: z5.string().email(),
-  image: z5.string().nullable(),
-  name: z5.string(),
+var workspaceMemberSchema = z7.object({
+  createdAt: z7.string(),
+  email: z7.string().email(),
+  image: z7.string().nullable(),
+  name: z7.string(),
   role: workspaceRoleSchema,
-  userId: z5.string()
+  userId: z7.string()
 });
-var workspaceMemberListResponseSchema = z5.object({
-  members: z5.array(workspaceMemberSchema)
+var workspaceMemberListResponseSchema = z7.object({
+  members: z7.array(workspaceMemberSchema)
 });
-var updateWorkspaceMemberSchema = z5.object({
+var updateWorkspaceMemberSchema = z7.object({
   role: workspaceRoleSchema
 });
-var removeWorkspaceMemberResponseSchema = z5.object({
-  removed: z5.literal(true)
+var removeWorkspaceMemberResponseSchema = z7.object({
+  removed: z7.literal(true)
 });
-var createWorkspaceInviteSchema = z5.object({
-  email: z5.string().trim().toLowerCase().email().optional(),
-  expiresAt: z5.string().datetime(),
-  maxUses: z5.number().int().positive().optional(),
+var createWorkspaceInviteSchema = z7.object({
+  email: z7.string().trim().toLowerCase().email().optional(),
+  expiresAt: z7.string().datetime(),
+  maxUses: z7.number().int().positive().optional(),
   role: workspaceInviteRoleSchema
 });
-var workspaceInviteSchema = z5.object({
-  createdAt: z5.string(),
-  email: z5.string().email().nullable(),
-  expiresAt: z5.string(),
-  id: z5.string(),
-  maxUses: z5.number().int().positive().nullable(),
+var workspaceInviteSchema = z7.object({
+  createdAt: z7.string(),
+  email: z7.string().email().nullable(),
+  expiresAt: z7.string(),
+  id: z7.string(),
+  maxUses: z7.number().int().positive().nullable(),
   role: workspaceInviteRoleSchema,
-  tokenPrefix: z5.string(),
-  useCount: z5.number().int().nonnegative()
+  tokenPrefix: z7.string(),
+  useCount: z7.number().int().nonnegative()
 });
 var createdWorkspaceInviteSchema = workspaceInviteSchema.extend({
-  url: z5.string().url()
+  url: z7.string().url()
 });
-var workspaceInviteListResponseSchema = z5.object({
-  invites: z5.array(workspaceInviteSchema)
+var workspaceInviteListResponseSchema = z7.object({
+  invites: z7.array(workspaceInviteSchema)
 });
-var revokeWorkspaceInviteResponseSchema = z5.object({
-  revoked: z5.literal(true)
+var revokeWorkspaceInviteResponseSchema = z7.object({
+  revoked: z7.literal(true)
 });
-var acceptWorkspaceInviteSchema = z5.object({
-  token: z5.string().min(1)
+var acceptWorkspaceInviteSchema = z7.object({
+  token: z7.string().min(1)
 });
-var acceptWorkspaceInviteResponseSchema = z5.object({
+var acceptWorkspaceInviteResponseSchema = z7.object({
   role: workspaceRoleSchema,
   workspace: workspaceSchema
 });
-var folderVisibilitySchema = z5.enum(["public", "workspace"]);
-var artifactVisibilitySchema = z5.enum([
+var folderVisibilitySchema = z7.enum(["public", "workspace"]);
+var artifactVisibilitySchema = z7.enum([
   "public",
   "unlisted",
   "workspace"
 ]);
-var createFolderSchema = z5.object({
-  name: z5.string().trim().min(1).max(100),
+var createFolderSchema = z7.object({
+  name: z7.string().trim().min(1).max(100),
   visibility: folderVisibilitySchema
 });
-var updateFolderSchema = z5.object({
+var updateFolderSchema = z7.object({
   // With `visibility`: bulk-update the folder's artifacts to match
   // (SPEC-2 §3.4 "Changing a folder's visibility offers a bulk update").
-  cascade: z5.boolean().optional(),
-  name: z5.string().trim().min(1).max(100).optional(),
-  sortOrder: z5.number().int().min(0).optional(),
+  cascade: z7.boolean().optional(),
+  name: z7.string().trim().min(1).max(100).optional(),
+  sortOrder: z7.number().int().min(0).optional(),
   visibility: folderVisibilitySchema.optional()
 }).refine(
   (body) => body.name !== void 0 || body.visibility !== void 0 || body.sortOrder !== void 0,
@@ -337,248 +512,168 @@ var updateFolderSchema = z5.object({
 ).refine((body) => !body.cascade || body.visibility !== void 0, {
   message: "cascade requires visibility"
 });
-var folderSchema = z5.object({
-  createdAt: z5.string(),
-  id: z5.string(),
-  name: z5.string(),
+var folderSchema = z7.object({
+  createdAt: z7.string(),
+  id: z7.string(),
+  name: z7.string(),
   // Permalink segment for the public folder page (/w/{handle}/f/{slug}).
   // Server-derived from the name; renames regenerate it.
-  slug: z5.string(),
-  sortOrder: z5.number().int(),
-  updatedAt: z5.string(),
+  slug: z7.string(),
+  sortOrder: z7.number().int(),
+  updatedAt: z7.string(),
   visibility: folderVisibilitySchema,
-  workspaceId: z5.string()
-});
-var folderListResponseSchema = z5.object({
-  folders: z5.array(folderSchema)
-});
-var deleteFolderResponseSchema = z5.object({
-  deleted: z5.literal(true)
-});
-var workspaceArtifactSchema = z5.object({
-  createdAt: z5.string(),
-  currentVersionNumber: z5.number().int().nullable(),
-  folderId: z5.string().nullable(),
-  id: z5.string(),
-  openCommentCount: z5.number().int().nonnegative(),
-  slug: z5.string(),
-  title: z5.string(),
-  updatedAt: z5.string(),
-  url: z5.string().url(),
-  versionCount: z5.number().int().nonnegative(),
+  workspaceId: z7.string()
+});
+var folderListResponseSchema = z7.object({
+  folders: z7.array(folderSchema)
+});
+var deleteFolderResponseSchema = z7.object({
+  deleted: z7.literal(true)
+});
+var workspaceArtifactSchema = z7.object({
+  createdAt: z7.string(),
+  currentVersionNumber: z7.number().int().nullable(),
+  folderId: z7.string().nullable(),
+  id: z7.string(),
+  openCommentCount: z7.number().int().nonnegative(),
+  slug: z7.string(),
+  title: z7.string(),
+  updatedAt: z7.string(),
+  url: z7.string().url(),
+  versionCount: z7.number().int().nonnegative(),
   visibility: artifactVisibilitySchema
 });
-var workspaceArtifactListResponseSchema = z5.object({
-  artifacts: z5.array(workspaceArtifactSchema)
+var workspaceArtifactListResponseSchema = z7.object({
+  artifacts: z7.array(workspaceArtifactSchema)
 });
 
 // ../shared/src/owner.ts
 var SLUG_PATTERN = /^[a-z0-9](?:[a-z0-9-]{1,61}[a-z0-9])$/;
-var claimResponseSchema = z6.object({
-  artifactId: z6.string(),
-  slug: z6.string(),
-  title: z6.string(),
-  url: z6.string().url()
+var claimResponseSchema = z8.object({
+  artifactId: z8.string(),
+  slug: z8.string(),
+  title: z8.string(),
+  url: z8.string().url()
 });
-var updateArtifactSchema = z6.object({
+var updateArtifactSchema = z8.object({
   // SPEC-2 §6.4 — placement + visibility. `folderId: null` clears the
   // folder; `workspaceId: null` moves the artifact out of its workspace
   // (§5.5 ownership transfer).
-  folderId: z6.string().min(1).nullable().optional(),
-  slug: z6.string().min(3).max(63).regex(SLUG_PATTERN, {
+  folderId: z8.string().min(1).nullable().optional(),
+  slug: z8.string().min(3).max(63).regex(SLUG_PATTERN, {
     message: "slug must be lowercase letters, digits, and hyphens, with no leading/trailing hyphen"
   }).optional(),
-  title: z6.string().min(1).max(200).optional(),
+  title: z8.string().min(1).max(200).optional(),
   visibility: artifactVisibilitySchema.optional(),
-  workspaceId: z6.string().min(1).nullable().optional()
+  workspaceId: z8.string().min(1).nullable().optional()
 }).refine(
   (body) => body.title !== void 0 || body.slug !== void 0 || body.visibility !== void 0 || body.folderId !== void 0 || body.workspaceId !== void 0,
   {
     message: "provide at least one of title, slug, visibility, folderId, workspaceId"
   }
 );
-var deleteArtifactResponseSchema = z6.object({
-  deleted: z6.literal(true)
+var deleteArtifactResponseSchema = z8.object({
+  deleted: z8.literal(true)
 });
 
 // ../shared/src/presence.ts
-import { z as z7 } from "zod";
+import { z as z9 } from "zod";
 var AGENT_PRESENCE = {
   heartbeatSeconds: 15,
   shellPollSeconds: 15,
   ttlSeconds: 45
 };
-var agentHeartbeatResponseSchema = z7.object({
-  listening: z7.literal(true),
-  ttlSeconds: z7.number().int().positive()
+var agentHeartbeatResponseSchema = z9.object({
+  listening: z9.literal(true),
+  ttlSeconds: z9.number().int().positive()
 });
-var agentPresenceSchema = z7.object({
-  listening: z7.boolean(),
-  versionNumber: z7.number().int().positive().nullable()
+var agentPresenceSchema = z9.object({
+  listening: z9.boolean(),
+  versionNumber: z9.number().int().positive().nullable()
 });
 
 // ../shared/src/protection.ts
-import { z as z8 } from "zod";
+import { z as z10 } from "zod";
 var PASSWORD_MIN = 6;
 var PASSWORD_MAX = 128;
-var gatePasswordSchema = z8.string().min(PASSWORD_MIN, `Password must be at least ${PASSWORD_MIN} characters.`).max(PASSWORD_MAX, `Password must be at most ${PASSWORD_MAX} characters.`);
-var setProtectionSchema = z8.object({
+var gatePasswordSchema = z10.string().min(PASSWORD_MIN, `Password must be at least ${PASSWORD_MIN} characters.`).max(PASSWORD_MAX, `Password must be at most ${PASSWORD_MAX} characters.`);
+var setProtectionSchema = z10.object({
   password: gatePasswordSchema.nullable()
 });
-var protectionResponseSchema = z8.object({
-  protected: z8.boolean()
-});
-var unlockSchema = z8.object({
-  password: z8.string().min(1).max(1024)
-});
-var unlockResponseSchema = z8.object({
-  unlocked: z8.literal(true)
-});
-
-// ../shared/src/publish.ts
-import { z as z9 } from "zod";
-function isSafeArtifactPath(p) {
-  if (p.length === 0 || p.length > 1024) {
-    return false;
-  }
-  if (p.includes("\\") || p.includes("\0")) {
-    return false;
-  }
-  if (p.startsWith("/") || p.startsWith("~")) {
-    return false;
-  }
-  return p.split("/").every((seg) => seg.length > 0 && seg !== "." && seg !== "..");
-}
-var manifestFileSchema = z9.object({
-  hash: z9.string().regex(/^sha256_[a-f0-9]{64}$/),
-  mimeType: z9.string().regex(/^[-\w.+]+\/[-\w.+]+$/, { message: "invalid MIME type" }),
-  path: z9.string().min(1).max(1024).refine(isSafeArtifactPath, {
-    message: "path must be a safe relative path"
-  }),
-  size: z9.number().int().positive()
-});
-var publishSourceSchema = z9.object({
-  agent: z9.string().optional(),
-  runId: z9.string().optional(),
-  type: z9.literal("cli")
+var protectionResponseSchema = z10.object({
+  protected: z10.boolean()
 });
-var createPublishSessionSchema = z9.object({
-  artifactId: z9.string().nullable(),
-  entryPath: z9.string().optional(),
-  files: z9.array(manifestFileSchema).min(1).max(1e3),
-  // SPEC-2 §6.4 — workspace placement is available only to authenticated
-  // members; the API enforces membership and folder ownership.
-  folderId: z9.string().min(1).optional(),
-  source: publishSourceSchema,
-  title: z9.string().max(200).optional(),
-  workspaceId: z9.string().min(1).optional()
-});
-var publishSessionResponseSchema = z9.object({
-  artifactId: z9.string(),
-  expiresAt: z9.string(),
-  filesToUpload: z9.array(
-    z9.object({
-      method: z9.literal("PUT"),
-      path: z9.string(),
-      uploadUrl: z9.string().url()
-    })
-  ),
-  publishSessionId: z9.string(),
-  skippedFiles: z9.array(z9.string()),
-  versionId: z9.string()
+var unlockSchema = z10.object({
+  password: z10.string().min(1).max(1024)
 });
-var finalizeResponseSchema = z9.object({
-  artifactId: z9.string(),
-  // API-key publishes create the artifact already claimed (SPEC §5.4) —
-  // the CLI uses this to tell "claim URL pending" from "already yours".
-  claimed: z9.boolean(),
-  // Returned only on first publish of a new artifact (one-time).
-  claimUrl: z9.string().url().optional(),
-  publishToken: z9.string().optional(),
-  url: z9.string().url(),
-  versionId: z9.string(),
-  versionNumber: z9.number().int().positive()
-});
-var artifactResponseSchema = z9.object({
-  claimed: z9.boolean(),
-  currentVersion: z9.object({
-    entryUrl: z9.string().url(),
-    id: z9.string(),
-    versionNumber: z9.number().int().positive()
-  }).nullable(),
-  // SPEC-2 §6.4 — placement + visibility surface on the artifact.
-  folderId: z9.string().nullable(),
-  id: z9.string(),
-  slug: z9.string(),
-  title: z9.string(),
-  visibility: z9.enum(["public", "unlisted", "workspace"]),
-  workspaceId: z9.string().nullable()
+var unlockResponseSchema = z10.object({
+  unlocked: z10.literal(true)
 });
 
 // ../shared/src/report.ts
-import { z as z10 } from "zod";
-var reportRequestSchema = z10.object({
-  reason: z10.string().max(1e3).optional()
+import { z as z11 } from "zod";
+var reportRequestSchema = z11.object({
+  reason: z11.string().max(1e3).optional()
 });
-var reportResponseSchema = z10.object({
-  reported: z10.literal(true)
+var reportResponseSchema = z11.object({
+  reported: z11.literal(true)
 });
 
 // ../shared/src/stats.ts
-import { z as z11 } from "zod";
-var avgViewSecondsSchema = z11.number().int().nonnegative().nullable();
-var versionViewStatsSchema = z11.object({
+import { z as z12 } from "zod";
+var avgViewSecondsSchema = z12.number().int().nonnegative().nullable();
+var versionViewStatsSchema = z12.object({
   avgViewSeconds: avgViewSecondsSchema,
   // Views from inside the review shell's iframe vs. direct visits to
   // the render URL. views = embeddedViews + directViews.
-  directViews: z11.number().int().nonnegative(),
-  embeddedViews: z11.number().int().nonnegative(),
+  directViews: z12.number().int().nonnegative(),
+  embeddedViews: z12.number().int().nonnegative(),
   // Distinct hashed viewer IPs across the version's lifetime.
-  uniqueViewers: z11.number().int().nonnegative(),
-  versionNumber: z11.number().int().positive(),
-  views: z11.number().int().nonnegative()
+  uniqueViewers: z12.number().int().nonnegative(),
+  versionNumber: z12.number().int().positive(),
+  views: z12.number().int().nonnegative()
 });
-var dailyViewsSchema = z11.object({
+var dailyViewsSchema = z12.object({
   avgViewSeconds: avgViewSecondsSchema,
   // UTC day, YYYY-MM-DD.
-  day: z11.string(),
-  uniqueViewers: z11.number().int().nonnegative(),
-  views: z11.number().int().nonnegative()
+  day: z12.string(),
+  uniqueViewers: z12.number().int().nonnegative(),
+  views: z12.number().int().nonnegative()
 });
-var artifactStatsResponseSchema = z11.object({
+var artifactStatsResponseSchema = z12.object({
   avgViewSeconds: avgViewSecondsSchema,
-  daily: z11.array(dailyViewsSchema),
+  daily: z12.array(dailyViewsSchema),
   // Distinct hashed viewer IPs across all versions and days.
-  totalUniqueViewers: z11.number().int().nonnegative(),
-  totalViews: z11.number().int().nonnegative(),
-  versions: z11.array(versionViewStatsSchema)
+  totalUniqueViewers: z12.number().int().nonnegative(),
+  totalViews: z12.number().int().nonnegative(),
+  versions: z12.array(versionViewStatsSchema)
 });
 
 // ../shared/src/versions.ts
-import { z as z12 } from "zod";
-var versionSourceSchema = z12.object({
-  agentName: z12.string().nullable(),
-  type: z12.string()
+import { z as z13 } from "zod";
+var versionSourceSchema = z13.object({
+  agentName: z13.string().nullable(),
+  type: z13.string()
 });
-var versionChangesSchema = z12.object({
-  added: z12.array(z12.string()),
-  changed: z12.array(z12.string()),
-  removed: z12.array(z12.string())
+var versionChangesSchema = z13.object({
+  added: z13.array(z13.string()),
+  changed: z13.array(z13.string()),
+  removed: z13.array(z13.string())
 });
-var versionSummarySchema = z12.object({
+var versionSummarySchema = z13.object({
   // Absent for the first version — there is no previous version to diff against.
   changes: versionChangesSchema.nullable(),
-  createdAt: z12.string(),
-  entryUrl: z12.string().url(),
-  fileCount: z12.number().int().nonnegative(),
-  id: z12.string(),
-  isCurrent: z12.boolean(),
+  createdAt: z13.string(),
+  entryUrl: z13.string().url(),
+  fileCount: z13.number().int().nonnegative(),
+  id: z13.string(),
+  isCurrent: z13.boolean(),
   source: versionSourceSchema,
-  totalSizeBytes: z12.number().int().nonnegative(),
-  versionNumber: z12.number().int().positive()
+  totalSizeBytes: z13.number().int().nonnegative(),
+  versionNumber: z13.number().int().positive()
 });
-var versionListResponseSchema = z12.object({
-  versions: z12.array(versionSummarySchema)
+var versionListResponseSchema = z13.object({
+  versions: z13.array(versionSummarySchema)
 });
 
 // src/api.ts
@@ -648,6 +743,36 @@ function createApiClient(apiUrl2, publishToken) {
         (d) => publishSessionResponseSchema.parse(d)
       );
     },
+    // SPEC §6.4 — open a new comment thread as the account this client's
+    // key belongs to (agent-originated review, §5.1 `comment`). The create
+    // route rejects a bare publish token (agents respond, accounts
+    // originate), so this must carry an account credential.
+    async createThread(artifactId, body) {
+      return request(
+        `${base}/api/v1/artifacts/${artifactId}/comments`,
+        { body: JSON.stringify(body), headers, method: "POST" },
+        (d) => commentThreadSchema.parse(d)
+      );
+    },
+    // SPEC §6.7.1 — soft-delete a message you authored. Authorized by this
+    // client's credential (account key, or the publish token for an agent
+    // message); a guest deletes from the browser, not the CLI.
+    async deleteMessage(messageId) {
+      await request(
+        `${base}/api/v1/comment-messages/${messageId}`,
+        { body: "{}", headers, method: "DELETE" },
+        () => void 0
+      );
+    },
+    // SPEC §6.7.1 — edit a message you authored (new body + "edited" badge).
+    // Same credential rule as delete; returns the updated thread.
+    async editMessage(messageId, body) {
+      return request(
+        `${base}/api/v1/comment-messages/${messageId}`,
+        { body: JSON.stringify({ body }), headers, method: "PATCH" },
+        (d) => commentThreadSchema.parse(d)
+      );
+    },
     async exportComments(artifactId, query) {
       const params = new URLSearchParams({
         status: query.status,
@@ -655,7 +780,7 @@ function createApiClient(apiUrl2, publishToken) {
       });
       return request(
         `${base}/api/v1/artifacts/${artifactId}/comments/export?${params}`,
-        { method: "GET" },
+        { headers, method: "GET" },
         (d) => commentExportSchema.parse(d)
       );
     },
@@ -669,7 +794,7 @@ function createApiClient(apiUrl2, publishToken) {
     async getArtifact(artifactId) {
       return request(
         `${base}/api/v1/artifacts/${artifactId}`,
-        { method: "GET" },
+        { headers, method: "GET" },
         (d) => artifactResponseSchema.parse(d)
       );
     },
@@ -705,6 +830,34 @@ function createApiClient(apiUrl2, publishToken) {
         (d) => meResponseSchema.parse(d)
       );
     },
+    // SPEC §6.7 — reopen a resolved thread. Same auth as resolve.
+    async reopenThread(threadId) {
+      return request(
+        `${base}/api/v1/comment-threads/${threadId}/reopen`,
+        { body: "{}", headers, method: "POST" },
+        (d) => commentThreadSchema.parse(d)
+      );
+    },
+    // SPEC §6.5 — post a reply into a thread. Authorized by this client's
+    // credential: the artifact's publish token (the reply renders as the
+    // agent) or the owner's account key (renders as the owner). No guest
+    // payload — the credential is the identity.
+    async replyThread(threadId, body) {
+      return request(
+        `${base}/api/v1/comment-threads/${threadId}/messages`,
+        { body: JSON.stringify({ body }), headers, method: "POST" },
+        (d) => commentThreadSchema.parse(d)
+      );
+    },
+    // SPEC §6.6 — mark a thread resolved. Authorized by this client's
+    // credential: the artifact's publish token, or the owner's account key.
+    async resolveThread(threadId) {
+      return request(
+        `${base}/api/v1/comment-threads/${threadId}/resolve`,
+        { body: "{}", headers, method: "POST" },
+        (d) => commentThreadSchema.parse(d)
+      );
+    },
     // SPEC §6.16 — set a password (string) or clear it (null). Authorized
     // by the publish token this client was created with.
     async setProtection(artifactId, password) {
@@ -741,17 +894,17 @@ import {
   writeFileSync as writeFileSync2
 } from "fs";
 import path2 from "path";
-import { z as z14 } from "zod";
+import { z as z15 } from "zod";
 
 // src/credentials.ts
 import { existsSync, mkdirSync, readFileSync, writeFileSync } from "fs";
 import { homedir } from "os";
 import path from "path";
-import { z as z13 } from "zod";
+import { z as z14 } from "zod";
 var DEFAULT_API_URL = "https://artifact.cafe";
-var credentialsSchema = z13.object({
-  keys: z13.record(z13.string(), z13.string()),
-  version: z13.literal(1)
+var credentialsSchema = z14.object({
+  keys: z14.record(z14.string(), z14.string()),
+  version: z14.literal(1)
 });
 function credentialsPath() {
   return path.join(homedir(), ".artifactcafe", "credentials");
@@ -801,22 +954,28 @@ function resolveApiKey(apiUrl2, flag) {
 }
 
 // src/config.ts
-var configSchema = z14.object({
-  apiUrl: z14.string(),
-  artifactId: z14.string(),
-  folder: z14.string().optional(),
-  folderId: z14.string().optional(),
+var configSchema = z15.object({
+  apiUrl: z15.string(),
+  artifactId: z15.string(),
+  folder: z15.string().optional(),
+  folderId: z15.string().optional(),
   // Optional: a folder linked by `link` to an artifact you own carries no
   // token — owner actions authorize via your stored login instead. A first
   // publish still writes the anonymous-mode token here.
-  publishToken: z14.string().optional(),
-  slug: z14.string(),
-  url: z14.string(),
-  workspace: z14.string().optional(),
-  workspaceId: z14.string().optional()
-});
+  publishToken: z15.string().optional(),
+  slug: z15.string(),
+  url: z15.string(),
+  workspace: z15.string().optional(),
+  workspaceId: z15.string().optional(),
+  workspaceKind: z15.enum(["personal", "workspace"]).optional()
+});
+var projectConfigSchema = z15.object({
+  folder: z15.string().trim().min(1).optional(),
+  workspace: z15.string().trim().min(1)
+}).strict();
 var CONFIG_DIR = ".artifactcafe";
 var CONFIG_FILE = "config.json";
+var PROJECT_CONFIG_FILE = "artifact-cafe.json";
 function readConfig(dir) {
   const file = path2.join(dir, CONFIG_DIR, CONFIG_FILE);
   if (!existsSync2(file)) {
@@ -838,6 +997,48 @@ function writeConfig(dir, config) {
   );
   ensureGitignored(dir);
 }
+function readProjectConfig(dir) {
+  let current = path2.resolve(dir);
+  while (true) {
+    const file = path2.join(current, PROJECT_CONFIG_FILE);
+    if (existsSync2(file)) {
+      try {
+        return projectConfigSchema.parse(
+          JSON.parse(readFileSync2(file, "utf8"))
+        );
+      } catch (error) {
+        const message = error instanceof z15.ZodError ? error.issues[0]?.message ?? "invalid project target" : "invalid JSON";
+        throw new Error(`Invalid ${file}: ${message}.`);
+      }
+    }
+    if (existsSync2(path2.join(current, ".git"))) {
+      return null;
+    }
+    const parent = path2.dirname(current);
+    if (parent === current) {
+      return null;
+    }
+    current = parent;
+  }
+}
+function writeProjectConfig(dir, config) {
+  let root = path2.resolve(dir);
+  while (!existsSync2(path2.join(root, ".git"))) {
+    const parent = path2.dirname(root);
+    if (parent === root) {
+      root = path2.resolve(dir);
+      break;
+    }
+    root = parent;
+  }
+  const file = path2.join(root, PROJECT_CONFIG_FILE);
+  writeFileSync2(
+    file,
+    `${JSON.stringify(projectConfigSchema.parse(config), null, 2)}
+`
+  );
+  return file;
+}
 function ensureGitignored(dir) {
   const gitignore = path2.join(dir, ".gitignore");
   if (!existsSync2(gitignore)) {
@@ -876,7 +1077,107 @@ function resolveArtifactTarget(dir, opts = {}) {
   return { apiUrl: apiUrl2, artifactId, credential, url };
 }
 
+// src/comment.ts
+async function readStdin() {
+  if (process.stdin.isTTY) {
+    return "";
+  }
+  const chunks = [];
+  for await (const chunk of process.stdin) {
+    chunks.push(chunk);
+  }
+  return Buffer.concat(chunks).toString("utf8");
+}
+function buildAnchor(opts) {
+  if (opts.quote !== void 0) {
+    const quote = opts.quote.trim();
+    if (!quote) {
+      throw new Error(
+        "--quote can't be empty. Omit it entirely for a page-level comment."
+      );
+    }
+    const anchor2 = {
+      elementPath: "body",
+      endOffset: 0,
+      prefix: opts.prefix ?? "",
+      quote,
+      startOffset: 0,
+      suffix: opts.suffix ?? "",
+      type: "text"
+    };
+    if (opts.page) {
+      anchor2.page = opts.page;
+    }
+    return anchor2;
+  }
+  if (opts.prefix || opts.suffix) {
+    throw new Error("--prefix and --suffix only apply together with --quote.");
+  }
+  const anchor = { type: "page" };
+  if (opts.page) {
+    anchor.page = opts.page;
+  }
+  return anchor;
+}
+async function comment(opts) {
+  const body = (opts.body ?? await readStdin()).trim();
+  if (!body) {
+    throw new Error(
+      'Nothing to post. Pass the comment with --body "\u2026", or pipe it on stdin.'
+    );
+  }
+  const anchor = buildAnchor(opts);
+  const dir = path3.resolve(opts.dir);
+  const target = resolveArtifactTarget(dir, {
+    apiKey: opts.apiKey,
+    artifact: opts.artifact
+  });
+  const credential = resolveApiKey(target.apiUrl, opts.apiKey) ?? target.credential;
+  const client = createApiClient(target.apiUrl, credential);
+  const artifact = await client.getArtifact(target.artifactId);
+  if (!artifact.currentVersion) {
+    throw new Error(
+      "This artifact has no published version yet \u2014 publish before commenting."
+    );
+  }
+  let thread;
+  try {
+    thread = await client.createThread(target.artifactId, {
+      anchor,
+      body,
+      versionId: artifact.currentVersion.id,
+      via: opts.via
+    });
+  } catch (err) {
+    if (err instanceof ApiRequestError && err.status === 401) {
+      throw new Error(
+        "Publish tokens can't open threads. Run `artifact-cafe login` to comment as your account."
+      );
+    }
+    throw err;
+  }
+  if (opts.json) {
+    console.log(
+      JSON.stringify(
+        {
+          anchorType: thread.anchor.type,
+          id: thread.id,
+          messageId: thread.messages[0]?.id,
+          versionId: thread.versionId
+        },
+        null,
+        2
+      )
+    );
+    return;
+  }
+  const url = target.url ?? reviewUrl(target.apiUrl, artifact.slug);
+  const where = anchor.type === "text" ? ` on \u201C${anchor.quote}\u201D` : " on the page";
+  console.log(`\u2713 Opened thread ${thread.id}${where} \u2014 ${url}`);
+}
+
 // src/comments.ts
+import path4 from "path";
 var STATUSES = ["open", "resolved", "all"];
 var VERSIONS = ["current", "all"];
 var pollSeconds = () => Number(process.env.AC_WAIT_POLL_SECONDS ?? 5);
@@ -895,7 +1196,7 @@ async function comments(opts) {
   }
   const status = opts.status;
   const version = opts.version;
-  const dir = path3.resolve(opts.dir);
+  const dir = path4.resolve(opts.dir);
   const target = resolveArtifactTarget(dir, {
     apiKey: opts.apiKey,
     artifact: opts.artifact
@@ -1054,21 +1355,30 @@ function printHuman(data, url, status, version) {
 function printThread(t) {
   const marker = t.status === "resolved" ? "\u2713" : "\u25CF";
   const date = t.createdAt.slice(0, 10);
+  const edited = t.editedAt && !t.deleted ? " \xB7 edited" : "";
   console.log(
-    `${marker} ${t.author} \xB7 v${t.versionNumber} \xB7 ${date} \xB7 ${t.id}`
+    `${marker} ${t.author} \xB7 v${t.versionNumber} \xB7 ${date} \xB7 ${t.id}${edited}`
   );
   if (t.anchor.type === "text") {
     console.log(`  \u21B3 "${t.anchor.quote}"`);
-  } else if (t.anchor.element) {
+  } else if (t.anchor.type === "point") {
     const el = t.anchor.element;
-    const text = el.text ? ` "${el.text}"` : "";
-    console.log(`  \u21B3 at ${elementLabel(el)}${text} \u2014 ${t.anchor.elementPath}`);
+    if (el) {
+      const text = el.text ? ` "${el.text}"` : "";
+      console.log(
+        `  \u21B3 at ${elementLabel(el)}${text} \u2014 ${t.anchor.elementPath}`
+      );
+    } else {
+      console.log(`  \u21B3 at ${t.anchor.elementPath}`);
+    }
   } else {
-    console.log(`  \u21B3 at ${t.anchor.elementPath}`);
+    console.log(t.anchor.page ? `  \u21B3 on ${t.anchor.page}` : "  \u21B3 page comment");
   }
-  console.log(indent(t.body, "  "));
-  for (const reply of t.replies) {
-    console.log(indent(`${reply.author}: ${reply.body}`, "    "));
+  console.log(indent(t.deleted ? "[deleted]" : t.body, "  "));
+  for (const reply2 of t.replies) {
+    const replyEdited = reply2.editedAt && !reply2.deleted ? " (edited)" : "";
+    const replyBody = reply2.deleted ? "[deleted]" : reply2.body;
+    console.log(indent(`${reply2.author}: ${replyBody}${replyEdited}`, "    "));
   }
   console.log("");
 }
@@ -1077,19 +1387,20 @@ function indent(text, pad) {
 }
 
 // src/dashboard.ts
-import path6 from "path";
+import path7 from "path";
 
 // src/publish.ts
 import { exec } from "child_process";
 import { readFileSync as readFileSync4 } from "fs";
-import path5 from "path";
+import path6 from "path";
+import { createInterface } from "readline";
 
 // src/manifest.ts
 import { createHash } from "crypto";
 import { readdirSync, readFileSync as readFileSync3, statSync } from "fs";
-import path4 from "path";
+import path5 from "path";
 var IGNORED_DIRS = /* @__PURE__ */ new Set([".git", "node_modules", ".artifactcafe"]);
-var IGNORED_FILES = /* @__PURE__ */ new Set([".DS_Store"]);
+var IGNORED_FILES = /* @__PURE__ */ new Set([".DS_Store", "artifact-cafe.json"]);
 function isIgnoredFile(name) {
   if (IGNORED_FILES.has(name)) {
     return true;
@@ -1136,7 +1447,7 @@ var MIME_TYPES = {
   ".xml": "application/xml"
 };
 function mimeFor(filePath) {
-  return MIME_TYPES[path4.extname(filePath).toLowerCase()] ?? "application/octet-stream";
+  return MIME_TYPES[path5.extname(filePath).toLowerCase()] ?? "application/octet-stream";
 }
 function scanDirectory(dir) {
   const files = [];
@@ -1144,7 +1455,7 @@ function scanDirectory(dir) {
   function walk(current, relPrefix) {
     for (const entry of readdirSync(current, { withFileTypes: true })) {
       const rel = relPrefix ? `${relPrefix}/${entry.name}` : entry.name;
-      const abs = path4.join(current, entry.name);
+      const abs = path5.join(current, entry.name);
       if (entry.isSymbolicLink()) {
         skipped.push(rel);
         continue;
@@ -1210,7 +1521,7 @@ function resolveEntry(files, explicit) {
 // src/publish.ts
 var UPLOAD_CONCURRENCY = 6;
 async function publish(opts) {
-  const dir = path5.resolve(opts.dir);
+  const dir = path6.resolve(opts.dir);
   const config = readConfig(dir);
   if (opts.password !== void 0) {
     const parsed = gatePasswordSchema.safeParse(opts.password);
@@ -1222,7 +1533,13 @@ async function publish(opts) {
   const token = (artifactId !== null && artifactId === config?.artifactId ? config.publishToken : void 0) ?? process.env.ARTIFACT_CAFE_TOKEN;
   const apiUrl2 = process.env.ARTIFACT_CAFE_URL ?? config?.apiUrl ?? DEFAULT_API_URL;
   const apiKey = resolveApiKey(apiUrl2, opts.apiKey);
-  const placement = await resolvePlacement({ apiKey, apiUrl: apiUrl2, config, opts });
+  const placement = await resolvePlacement({
+    apiKey,
+    apiUrl: apiUrl2,
+    config,
+    isNewArtifact: artifactId === null,
+    opts
+  });
   const { files, skipped } = scanDirectory(dir);
   if (files.length === 0) {
     throw new Error(`Nothing to publish in ${dir} (after ignore rules).`);
@@ -1247,7 +1564,7 @@ async function publish(opts) {
       type: "cli"
     },
     title: opts.title,
-    ...placement.workspaceId ? { workspaceId: placement.workspaceId } : {}
+    ...placement.publishWorkspaceId ? { workspaceId: placement.publishWorkspaceId } : {}
   };
   let credential = apiKey ?? token;
   let client = createApiClient(apiUrl2, credential);
@@ -1279,8 +1596,9 @@ async function publish(opts) {
     );
   });
   const result = await client.finalize(session.publishSessionId);
+  const rememberedProjectFile = placement.rememberProjectDefault ? writeProjectConfig(dir, placement.rememberProjectDefault) : null;
   const existingToken = config?.artifactId === result.artifactId ? config.publishToken : void 0;
-  const shouldWriteConfig = result.publishToken !== void 0 || config?.artifactId === result.artifactId || opts.workspace !== void 0 || opts.folder !== void 0;
+  const shouldWriteConfig = result.publishToken !== void 0 || config?.artifactId === result.artifactId || opts.workspace !== void 0 || opts.folder !== void 0 || placement.workspaceId !== void 0;
   if (shouldWriteConfig) {
     writeConfig(dir, {
       apiUrl: apiUrl2,
@@ -1291,7 +1609,8 @@ async function publish(opts) {
       slug: slugFromUrl(result.url),
       url: result.url,
       ...placement.workspace ? { workspace: placement.workspace } : {},
-      ...placement.workspaceId ? { workspaceId: placement.workspaceId } : {}
+      ...placement.workspaceId ? { workspaceId: placement.workspaceId } : {},
+      ...placement.destination === "personal" || placement.destination === "workspace" ? { workspaceKind: placement.destination } : {}
     });
   }
   if (opts.password !== void 0) {
@@ -1307,6 +1626,8 @@ async function publish(opts) {
         {
           artifactId: result.artifactId,
           claimed: result.claimed,
+          destination: placement.destination,
+          destinationSource: placement.destinationSource,
           folder: placement.folder ?? null,
           folderId: placement.folderId ?? null,
           url: result.url,
@@ -1325,6 +1646,12 @@ async function publish(opts) {
     );
   } else if (result.versionNumber === 1) {
     console.log("\n\u2713 Published to artifact.cafe\n");
+    console.log(`Destination: ${placement.destinationLabel}
+`);
+    if (rememberedProjectFile) {
+      console.log(`Project default: ${rememberedProjectFile}
+`);
+    }
     console.log(`Review URL:
 ${result.url}
 `);
@@ -1344,6 +1671,12 @@ ${result.claimUrl}
     console.log(`
 \u2713 Published v${result.versionNumber}
 `);
+    console.log(`Destination: ${placement.destinationLabel}
+`);
+    if (rememberedProjectFile) {
+      console.log(`Project default: ${rememberedProjectFile}
+`);
+    }
     console.log(`${result.url}
 `);
     if (opts.password !== void 0) {
@@ -1355,75 +1688,181 @@ ${result.claimUrl}
   }
 }
 async function resolvePlacement(params) {
-  const { apiKey, apiUrl: apiUrl2, config, opts } = params;
+  const { apiKey, apiUrl: apiUrl2, config, isNewArtifact, opts } = params;
   const hasPlacementFlag = opts.workspace !== void 0 || opts.folder !== void 0;
   if (!hasPlacementFlag && config?.workspaceId) {
-    if (!apiKey) {
+    const isPersonal = config.workspaceKind === "personal";
+    if (!(apiKey || isPersonal)) {
       throw new Error(
         `Publishing into workspace ${config.workspace ?? config.workspaceId} needs an account \u2014 run \`artifact-cafe login\` first (no API key for ${apiOrigin(apiUrl2)}).`
       );
     }
     return {
+      destination: isPersonal ? "personal" : "workspace",
+      destinationLabel: isPersonal ? "Personal" : config.workspace ?? config.workspaceId,
+      destinationSource: "artifact-config",
       ...config.folder ? { folder: config.folder } : {},
       ...config.folderId ? { folderId: config.folderId } : {},
       ...config.workspace ? { workspace: config.workspace } : {},
+      ...apiKey ? { publishWorkspaceId: config.workspaceId } : {},
       workspaceId: config.workspaceId
     };
   }
-  if (!hasPlacementFlag) {
-    return {};
+  if (!(hasPlacementFlag || isNewArtifact)) {
+    return {
+      destination: "existing-artifact",
+      destinationLabel: "Existing artifact",
+      destinationSource: "artifact-config"
+    };
   }
-  if (!apiKey) {
+  const projectConfig = isNewArtifact ? readProjectConfig(opts.dir) : null;
+  const wantsWorkspace = opts.workspace !== void 0 || opts.folder !== void 0 || projectConfig !== null;
+  if (wantsWorkspace && !apiKey) {
     throw new Error(
       "Publishing into a workspace needs an account \u2014 run `artifact-cafe login` first."
     );
   }
-  const workspaceHandle = opts.workspace ?? config?.workspace;
-  if (!workspaceHandle) {
+  if (!(hasPlacementFlag || projectConfig)) {
+    if (!apiKey) {
+      return {
+        destination: "anonymous",
+        destinationLabel: "Anonymous",
+        destinationSource: "anonymous-default"
+      };
+    }
+    if (shouldPromptForWorkspace(opts)) {
+      const data2 = await createApiClient(apiUrl2, apiKey).listWorkspaces();
+      if (data2.workspaces.length > 1) {
+        const choice = await pickWorkspace(data2.workspaces);
+        return {
+          destination: choice.workspace.isPersonal ? "personal" : "workspace",
+          destinationLabel: choice.workspace.isPersonal ? "Personal" : choice.workspace.name,
+          destinationSource: "interactive",
+          publishWorkspaceId: choice.workspace.id,
+          ...choice.remember ? {
+            rememberProjectDefault: {
+              workspace: choice.workspace.handle
+            }
+          } : {},
+          workspace: choice.workspace.handle,
+          workspaceId: choice.workspace.id
+        };
+      }
+    }
+    return {
+      destination: "personal",
+      destinationLabel: "Personal",
+      destinationSource: "personal-default"
+    };
+  }
+  if (!isNewArtifact && opts.folder !== void 0 && opts.workspace === void 0 && !(config?.workspace || config?.workspaceId)) {
     throw new Error("--folder requires --workspace or a stored workspace.");
   }
   const client = createApiClient(apiUrl2, apiKey);
-  let workspaceId;
-  if (opts.workspace === void 0 && config?.workspaceId) {
-    ({ workspaceId } = config);
-  } else {
-    const data2 = await client.listWorkspaces();
-    const workspace = data2.workspaces.find(
+  const data = await client.listWorkspaces();
+  const workspaceHandle = opts.workspace ?? config?.workspace ?? projectConfig?.workspace;
+  let workspace;
+  if (workspaceHandle) {
+    workspace = data.workspaces.find(
       (candidate) => candidate.handle === workspaceHandle
     );
-    if (!workspace) {
-      throw new Error(
-        `No workspace with handle "${workspaceHandle}" belongs to this account.`
-      );
-    }
-    workspaceId = workspace.id;
+  } else if (config?.workspaceId) {
+    workspace = data.workspaces.find(
+      (candidate) => candidate.id === config.workspaceId
+    );
+  } else {
+    workspace = data.workspaces.find((candidate) => candidate.isPersonal);
+  }
+  if (!workspace) {
+    const target = workspaceHandle ? `workspace with handle "${workspaceHandle}"` : "personal workspace";
+    throw new Error(`No ${target} belongs to this account.`);
   }
-  const folderName = opts.workspace !== void 0 && opts.folder === void 0 ? void 0 : opts.folder ?? config?.folder;
+  const folderName = opts.workspace !== void 0 && opts.folder === void 0 ? void 0 : opts.folder ?? projectConfig?.folder;
+  const destinationSource = hasPlacementFlag ? "explicit" : "project-default";
   if (!folderName) {
-    return { workspace: workspaceHandle, workspaceId };
+    return {
+      destination: workspace.isPersonal ? "personal" : "workspace",
+      destinationLabel: workspace.isPersonal ? "Personal" : workspace.name,
+      destinationSource,
+      publishWorkspaceId: workspace.id,
+      workspace: workspace.handle,
+      workspaceId: workspace.id
+    };
   }
-  const data = await client.listFolders(workspaceId);
-  const matches = data.folders.filter(
+  const folderData = await client.listFolders(workspace.id);
+  const matches = folderData.folders.filter(
     (candidate) => candidate.name === folderName || candidate.id === folderName
   );
   if (matches.length === 0) {
     throw new Error(
-      `No folder named "${folderName}" exists in workspace ${workspaceHandle}.`
+      `No folder named "${folderName}" exists in workspace ${workspace.handle}.`
     );
   }
   if (matches.length > 1) {
     throw new Error(
-      `More than one folder is named "${folderName}" in workspace ${workspaceHandle}; pass the folder id instead.`
+      `More than one folder is named "${folderName}" in workspace ${workspace.handle}; pass the folder id instead.`
     );
   }
   const folder = matches[0];
   return {
+    destination: workspace.isPersonal ? "personal" : "workspace",
+    destinationLabel: workspace.isPersonal ? "Personal" : workspace.name,
+    destinationSource,
     folder: folder.name,
     folderId: folder.id,
-    workspace: workspaceHandle,
-    workspaceId
+    publishWorkspaceId: workspace.id,
+    workspace: workspace.handle,
+    workspaceId: workspace.id
   };
 }
+function shouldPromptForWorkspace(opts) {
+  if (opts.json || process.env.ARTIFACT_CAFE_AGENT) {
+    return false;
+  }
+  return Boolean(process.stdin.isTTY && process.stdout.isTTY);
+}
+function pickWorkspace(workspaces3) {
+  const choices = [...workspaces3].sort((a, b) => {
+    if (a.isPersonal !== b.isPersonal) {
+      return a.isPersonal ? -1 : 1;
+    }
+    return a.name.localeCompare(b.name);
+  });
+  console.log("Where should this artifact live?\n");
+  choices.forEach((workspace, index) => {
+    const label = workspace.isPersonal ? "Personal" : workspace.name;
+    const handle = workspace.isPersonal ? "" : `  \xB7  ${workspace.handle}`;
+    console.log(`  ${String(index + 1).padStart(2)}. ${label}${handle}`);
+  });
+  const rl = createInterface({ input: process.stdin, output: process.stdout });
+  return new Promise((resolve2, reject) => {
+    rl.question(`
+Publish where? [1-${choices.length}]: `, (answer) => {
+      const index = Number(answer.trim()) - 1;
+      const workspace = choices[index];
+      if (!(Number.isInteger(index) && workspace)) {
+        rl.close();
+        reject(new Error(`Enter a number between 1 and ${choices.length}.`));
+        return;
+      }
+      if (workspace.isPersonal) {
+        rl.close();
+        resolve2({ remember: false, workspace });
+        return;
+      }
+      rl.question(
+        `Remember ${workspace.name} for new artifacts in this project? [y/N]: `,
+        (rememberAnswer) => {
+          rl.close();
+          resolve2({
+            remember: /^y(?:es)?$/i.test(rememberAnswer.trim()),
+            workspace
+          });
+        }
+      );
+    });
+  });
+}
 async function inBatches(items, concurrency, fn) {
   let next = 0;
   const workers = Array.from(
@@ -1460,7 +1899,7 @@ function openInBrowser(url) {
 
 // src/dashboard.ts
 function openDashboard(opts) {
-  const base = process.env.ARTIFACT_CAFE_URL ?? readConfig(path6.resolve(opts.dir))?.apiUrl ?? DEFAULT_API_URL;
+  const base = process.env.ARTIFACT_CAFE_URL ?? readConfig(path7.resolve(opts.dir))?.apiUrl ?? DEFAULT_API_URL;
   const url = `${base.replace(/\/$/, "")}/dashboard`;
   console.log(url);
   if (process.stdout.isTTY) {
@@ -1486,7 +1925,12 @@ function printCliError(err, json) {
       if (err.retryAfter) {
         console.error(`  Retry in ${err.retryAfter}s.`);
       }
-    }
+      if (err.code === "password_required") {
+        console.error(
+          "  Run `artifact-cafe login` as the owner, or run from the published folder (its publish token unlocks it)."
+        );
+      }
+    }
     return;
   }
   const message = err instanceof Error ? err.message : String(err);
@@ -1544,8 +1988,8 @@ function printFolder(folder) {
 }
 
 // src/link.ts
-import path7 from "path";
-import { createInterface } from "readline";
+import path8 from "path";
+import { createInterface as createInterface2 } from "readline";
 async function link(opts) {
   const apiUrl2 = (process.env.ARTIFACT_CAFE_URL ?? DEFAULT_API_URL).replace(
     /\/$/,
@@ -1587,7 +2031,7 @@ async function link(opts) {
     }
     chosen = await pickArtifact(artifacts);
   }
-  const dir = path7.resolve(opts.dir);
+  const dir = path8.resolve(opts.dir);
   writeConfig(dir, {
     apiUrl: apiUrl2,
     artifactId: chosen.id,
@@ -1624,8 +2068,8 @@ function pickArtifact(artifacts) {
       `  ${String(i + 1).padStart(2)}. ${a.title}  \xB7  ${v}  \xB7  ${a.url}`
     );
   });
-  const rl = createInterface({ input: process.stdin, output: process.stdout });
-  return new Promise((resolve, reject) => {
+  const rl = createInterface2({ input: process.stdin, output: process.stdout });
+  return new Promise((resolve2, reject) => {
     rl.question(`
 Link which? [1-${artifacts.length}]: `, (answer) => {
       rl.close();
@@ -1634,7 +2078,7 @@ Link which? [1-${artifacts.length}]: `, (answer) => {
         reject(new Error(`Enter a number between 1 and ${artifacts.length}.`));
         return;
       }
-      resolve(artifacts[n - 1]);
+      resolve2(artifacts[n - 1]);
     });
   });
 }
@@ -1696,13 +2140,13 @@ function relativeTime(iso) {
 }
 
 // src/login.ts
-import { createInterface as createInterface2 } from "readline";
+import { createInterface as createInterface3 } from "readline";
 function apiUrl() {
   return (process.env.ARTIFACT_CAFE_URL ?? DEFAULT_API_URL).replace(/\/$/, "");
 }
 function promptSecret(question) {
-  return new Promise((resolve) => {
-    const rl = createInterface2({
+  return new Promise((resolve2) => {
+    const rl = createInterface3({
       input: process.stdin,
       output: process.stdout
     });
@@ -1716,7 +2160,7 @@ function promptSecret(question) {
     rl.question(question, (answer) => {
       rl.close();
       process.stdout.write("\n");
-      resolve(answer);
+      resolve2(answer);
     });
     muted = true;
   });
@@ -1809,10 +2253,69 @@ function logout(opts) {
   );
 }
 
+// src/message.ts
+import path9 from "path";
+async function readStdin2() {
+  if (process.stdin.isTTY) {
+    return "";
+  }
+  const chunks = [];
+  for await (const chunk of process.stdin) {
+    chunks.push(chunk);
+  }
+  return Buffer.concat(chunks).toString("utf8");
+}
+async function editMessage(opts) {
+  const messageId = opts.message?.trim();
+  if (!messageId) {
+    throw new Error(
+      "Pass the message id to edit \u2014 get it from `artifact-cafe comments --json`."
+    );
+  }
+  const body = (opts.body ?? await readStdin2()).trim();
+  if (!body) {
+    throw new Error(
+      'Nothing to save. Pass the new text with --body "\u2026", or pipe it on stdin.'
+    );
+  }
+  const dir = path9.resolve(opts.dir);
+  const target = resolveArtifactTarget(dir, {
+    apiKey: opts.apiKey,
+    artifact: opts.artifact
+  });
+  const client = createApiClient(target.apiUrl, target.credential);
+  const thread = await client.editMessage(messageId, body);
+  if (opts.json) {
+    console.log(JSON.stringify({ id: thread.id, messageId }, null, 2));
+    return;
+  }
+  console.log(`\u2713 Edited ${messageId}.`);
+}
+async function deleteMessage(opts) {
+  const messageId = opts.message?.trim();
+  if (!messageId) {
+    throw new Error(
+      "Pass the message id to delete \u2014 get it from `artifact-cafe comments --json`."
+    );
+  }
+  const dir = path9.resolve(opts.dir);
+  const target = resolveArtifactTarget(dir, {
+    apiKey: opts.apiKey,
+    artifact: opts.artifact
+  });
+  const client = createApiClient(target.apiUrl, target.credential);
+  await client.deleteMessage(messageId);
+  if (opts.json) {
+    console.log(JSON.stringify({ deleted: true, messageId }, null, 2));
+    return;
+  }
+  console.log(`\u2713 Deleted ${messageId}.`);
+}
+
 // src/open.ts
-import path8 from "path";
+import path10 from "path";
 async function openArtifact(opts) {
-  const dir = path8.resolve(opts.dir);
+  const dir = path10.resolve(opts.dir);
   const target = resolveArtifactTarget(dir, {
     apiKey: opts.apiKey,
     artifact: opts.artifact
@@ -1830,7 +2333,7 @@ async function openArtifact(opts) {
 }
 
 // src/protect.ts
-import path9 from "path";
+import path11 from "path";
 async function protect(opts) {
   if (opts.off && opts.password !== void 0) {
     throw new Error("Pass either --password or --off, not both.");
@@ -1847,7 +2350,7 @@ async function protect(opts) {
       throw new Error(parsed.error.issues[0]?.message ?? "Invalid password.");
     }
   }
-  const dir = path9.resolve(opts.dir);
+  const dir = path11.resolve(opts.dir);
   const target = resolveArtifactTarget(dir, {
     apiKey: opts.apiKey,
     artifact: opts.artifact
@@ -1871,6 +2374,234 @@ async function protect(opts) {
   );
 }
 
+// src/reply.ts
+import path12 from "path";
+async function readStdin3() {
+  if (process.stdin.isTTY) {
+    return "";
+  }
+  const chunks = [];
+  for await (const chunk of process.stdin) {
+    chunks.push(chunk);
+  }
+  return Buffer.concat(chunks).toString("utf8");
+}
+async function replyToThread(opts) {
+  const threadId = opts.thread?.trim();
+  if (!threadId) {
+    throw new Error(
+      "Pass the thread id to reply to \u2014 get it from `artifact-cafe comments --json`."
+    );
+  }
+  const body = (opts.body ?? await readStdin3()).trim();
+  if (!body) {
+    throw new Error(
+      'Nothing to post. Pass the reply with --body "\u2026", or pipe it on stdin.'
+    );
+  }
+  const dir = path12.resolve(opts.dir);
+  const target = resolveArtifactTarget(dir, {
+    apiKey: opts.apiKey,
+    artifact: opts.artifact
+  });
+  const client = createApiClient(target.apiUrl, target.credential);
+  let thread = await client.replyThread(threadId, body);
+  if (opts.resolve) {
+    thread = await client.resolveThread(threadId);
+  }
+  if (opts.json) {
+    console.log(
+      JSON.stringify(
+        {
+          id: thread.id,
+          messageCount: thread.messages.length,
+          status: thread.status
+        },
+        null,
+        2
+      )
+    );
+    return;
+  }
+  const closed = opts.resolve ? " and resolved it" : "";
+  console.log(`\u2713 Replied to ${thread.id}${closed} \u2014 now ${thread.status}.`);
+}
+
+// src/resolve.ts
+import path13 from "path";
+async function changeThreadStatus(opts) {
+  const threadId = opts.thread?.trim();
+  if (!threadId) {
+    throw new Error(
+      `Pass the thread id to ${opts.action} \u2014 get it from \`artifact-cafe comments --json\`.`
+    );
+  }
+  const dir = path13.resolve(opts.dir);
+  const target = resolveArtifactTarget(dir, {
+    apiKey: opts.apiKey,
+    artifact: opts.artifact
+  });
+  const client = createApiClient(target.apiUrl, target.credential);
+  const thread = opts.action === "resolve" ? await client.resolveThread(threadId) : await client.reopenThread(threadId);
+  if (opts.json) {
+    console.log(
+      JSON.stringify({ id: thread.id, status: thread.status }, null, 2)
+    );
+    return;
+  }
+  const verb = opts.action === "resolve" ? "Resolved" : "Reopened";
+  console.log(`\u2713 ${verb} ${thread.id} \u2014 now ${thread.status}.`);
+}
+
+// src/update.ts
+import { existsSync as existsSync3, mkdirSync as mkdirSync3, readFileSync as readFileSync5, writeFileSync as writeFileSync3 } from "fs";
+import { createRequire } from "module";
+import { homedir as homedir2 } from "os";
+import path14 from "path";
+import { z as z16 } from "zod";
+var REGISTRY_LATEST_URL = "https://registry.npmjs.org/artifact-cafe/latest";
+var SKILL_SOURCE_URL = "https://raw.githubusercontent.com/Artifact-Cafe/skill/main/artifact-cafe/SKILL.md";
+var SKILL_UPDATE_COMMAND = "npx skills add artifact-cafe/skill --skill artifact-cafe -g";
+var CHECK_TTL_MS = 24 * 60 * 60 * 1e3;
+var FETCH_TIMEOUT_MS = 2e3;
+var SKILL_VERSION_PATTERN = /\*\*Skill version:\s*(\d+\.\d+\.\d+)\*\*/;
+var cacheSchema = z16.object({
+  checkedAt: z16.number(),
+  cliLatest: z16.string().nullable(),
+  skillLatest: z16.string().nullable(),
+  version: z16.literal(1)
+});
+function cliVersion() {
+  const pkg = createRequire(import.meta.url)("../package.json");
+  return pkg.version;
+}
+function cachePath() {
+  return path14.join(homedir2(), ".artifactcafe", "update-check.json");
+}
+function readCache() {
+  try {
+    return cacheSchema.parse(JSON.parse(readFileSync5(cachePath(), "utf8")));
+  } catch {
+    return null;
+  }
+}
+function writeCache(cache) {
+  try {
+    mkdirSync3(path14.dirname(cachePath()), { mode: 448, recursive: true });
+    writeFileSync3(cachePath(), `${JSON.stringify(cache, null, 2)}
+`);
+  } catch {
+  }
+}
+function isNewerVersion(candidate, current) {
+  const parse = (value) => value.split(".").map((part) => Number.parseInt(part, 10) || 0);
+  const a = parse(candidate);
+  const b = parse(current);
+  for (let i = 0; i < 3; i++) {
+    if ((a[i] ?? 0) !== (b[i] ?? 0)) {
+      return (a[i] ?? 0) > (b[i] ?? 0);
+    }
+  }
+  return false;
+}
+async function fetchJson(url) {
+  const res = await fetch(url, {
+    signal: AbortSignal.timeout(FETCH_TIMEOUT_MS)
+  });
+  if (!res.ok) {
+    throw new Error(`GET ${url} \u2192 ${res.status}`);
+  }
+  return res.json();
+}
+async function fetchText(url) {
+  const res = await fetch(url, {
+    signal: AbortSignal.timeout(FETCH_TIMEOUT_MS)
+  });
+  if (!res.ok) {
+    throw new Error(`GET ${url} \u2192 ${res.status}`);
+  }
+  return res.text();
+}
+async function fetchLatestVersions(previous) {
+  const [cli, skill] = await Promise.all([
+    fetchJson(REGISTRY_LATEST_URL).then((body) => z16.object({ version: z16.string() }).parse(body).version).catch(() => null),
+    fetchText(SKILL_SOURCE_URL).then((body) => SKILL_VERSION_PATTERN.exec(body)?.[1] ?? null).catch(() => null)
+  ]);
+  return {
+    checkedAt: Date.now(),
+    cliLatest: cli ?? previous?.cliLatest ?? null,
+    skillLatest: skill ?? previous?.skillLatest ?? null,
+    version: 1
+  };
+}
+function installedSkillVersions() {
+  const roots = [homedir2(), process.cwd()];
+  const dirs = [".agents", ".claude"];
+  const versions = [];
+  for (const root of roots) {
+    for (const dir of dirs) {
+      const file = path14.join(root, dir, "skills", "artifact-cafe", "SKILL.md");
+      if (!existsSync3(file)) {
+        continue;
+      }
+      try {
+        const found = SKILL_VERSION_PATTERN.exec(readFileSync5(file, "utf8"));
+        if (found?.[1]) {
+          versions.push(found[1]);
+        }
+      } catch {
+      }
+    }
+  }
+  return versions;
+}
+function updateChecksDisabled() {
+  return Boolean(
+    process.env.ARTIFACT_CAFE_NO_UPDATE_CHECK ?? process.env.NO_UPDATE_NOTIFIER ?? process.env.CI
+  );
+}
+function startUpdateCheck() {
+  if (updateChecksDisabled()) {
+    return () => Promise.resolve();
+  }
+  const pending = (async () => {
+    const cached = readCache();
+    if (cached && Date.now() - cached.checkedAt < CHECK_TTL_MS) {
+      return cached;
+    }
+    const fresh = await fetchLatestVersions(cached);
+    writeCache(fresh);
+    return fresh;
+  })().catch(() => null);
+  return async () => {
+    const latest = await pending;
+    if (!latest) {
+      return;
+    }
+    const notices = [];
+    const current = cliVersion();
+    if (latest.cliLatest && isNewerVersion(latest.cliLatest, current)) {
+      notices.push(
+        `[artifact-cafe] CLI update available: ${current} \u2192 ${latest.cliLatest}. Run commands via \`npx artifact-cafe@latest\`; update a global install with \`npm i -g artifact-cafe@latest\`.`
+      );
+    }
+    if (latest.skillLatest) {
+      const stale = installedSkillVersions().filter(
+        (version) => isNewerVersion(latest.skillLatest, version)
+      ).sort((a, b) => isNewerVersion(a, b) ? 1 : -1);
+      if (stale.length > 0) {
+        notices.push(
+          `[artifact-cafe] Skill update available: ${stale[0]} \u2192 ${latest.skillLatest}. Update: \`${SKILL_UPDATE_COMMAND}\` (drop -g for a repo-local copy), then re-read SKILL.md.`
+        );
+      }
+    }
+    if (notices.length > 0) {
+      console.error(`
+${notices.join("\n")}`);
+    }
+  };
+}
+
 // src/workspaces.ts
 async function workspaces(opts) {
   const apiUrl2 = (process.env.ARTIFACT_CAFE_URL ?? DEFAULT_API_URL).replace(
@@ -2292,6 +3023,247 @@ var protect2 = defineCommand({
     }
   }
 });
+var threadStatusCommand = (action) => defineCommand({
+  args: {
+    "api-key": {
+      description: "Authorize with an account API key (default: stored login)",
+      type: "string"
+    },
+    artifact: {
+      description: "Act on an artifact ID instead of the linked folder",
+      type: "string"
+    },
+    dir: {
+      default: ".",
+      description: "Linked directory to authorize from (default: .)",
+      type: "string"
+    },
+    json: { description: "Machine-readable output", type: "boolean" },
+    thread: {
+      description: "Thread id (from `comments --json`)",
+      required: true,
+      type: "positional"
+    }
+  },
+  meta: {
+    description: action === "resolve" ? "Mark a comment thread resolved" : "Reopen a resolved comment thread",
+    name: action
+  },
+  async run({ args }) {
+    try {
+      await changeThreadStatus({
+        action,
+        apiKey: args["api-key"],
+        artifact: args.artifact,
+        dir: args.dir,
+        json: Boolean(args.json),
+        thread: args.thread
+      });
+    } catch (err) {
+      printCliError(err, Boolean(args.json));
+      process.exit(1);
+    }
+  }
+});
+var resolve = threadStatusCommand("resolve");
+var reopen = threadStatusCommand("reopen");
+var reply = defineCommand({
+  args: {
+    "api-key": {
+      description: "Authorize with an account API key (default: stored login)",
+      type: "string"
+    },
+    artifact: {
+      description: "Act on an artifact ID instead of the linked folder",
+      type: "string"
+    },
+    body: {
+      description: "Reply text (omit to read from stdin)",
+      type: "string"
+    },
+    dir: {
+      default: ".",
+      description: "Linked directory to authorize from (default: .)",
+      type: "string"
+    },
+    json: { description: "Machine-readable output", type: "boolean" },
+    resolve: {
+      description: "Resolve the thread after replying",
+      type: "boolean"
+    },
+    thread: {
+      description: "Thread id (from `comments --json`)",
+      required: true,
+      type: "positional"
+    }
+  },
+  meta: {
+    description: "Reply to a comment thread (as the agent or owner)",
+    name: "reply"
+  },
+  async run({ args }) {
+    try {
+      await replyToThread({
+        apiKey: args["api-key"],
+        artifact: args.artifact,
+        body: args.body,
+        dir: args.dir,
+        json: Boolean(args.json),
+        resolve: Boolean(args.resolve),
+        thread: args.thread
+      });
+    } catch (err) {
+      printCliError(err, Boolean(args.json));
+      process.exit(1);
+    }
+  }
+});
+var comment2 = defineCommand({
+  args: {
+    "api-key": {
+      description: "Authorize with an account API key (default: stored login)",
+      type: "string"
+    },
+    artifact: {
+      description: "Act on an artifact ID instead of the linked folder",
+      type: "string"
+    },
+    body: {
+      description: "Comment text (omit to read from stdin)",
+      type: "string"
+    },
+    dir: {
+      default: ".",
+      description: "Published/linked directory",
+      type: "positional"
+    },
+    json: { description: "Machine-readable output", type: "boolean" },
+    page: {
+      description: "Scope to one document (e.g. pages/notes.html)",
+      type: "string"
+    },
+    prefix: {
+      description: "Text just before --quote (disambiguates repeats)",
+      type: "string"
+    },
+    quote: {
+      description: "Anchor to this text (omit for a page-level comment)",
+      type: "string"
+    },
+    suffix: {
+      description: "Text just after --quote (disambiguates repeats)",
+      type: "string"
+    },
+    via: {
+      description: 'Attribution label, e.g. "Claude Code"',
+      type: "string"
+    }
+  },
+  meta: {
+    description: "Open a comment thread (as your account)",
+    name: "comment"
+  },
+  async run({ args }) {
+    try {
+      await comment({
+        apiKey: args["api-key"],
+        artifact: args.artifact,
+        body: args.body,
+        dir: args.dir,
+        json: Boolean(args.json),
+        page: args.page,
+        prefix: args.prefix,
+        quote: args.quote,
+        suffix: args.suffix,
+        via: args.via
+      });
+    } catch (err) {
+      printCliError(err, Boolean(args.json));
+      process.exit(1);
+    }
+  }
+});
+var edit = defineCommand({
+  args: {
+    "api-key": {
+      description: "Authorize with an account API key (default: stored login)",
+      type: "string"
+    },
+    artifact: {
+      description: "Act on an artifact ID instead of the linked folder",
+      type: "string"
+    },
+    body: {
+      description: "New comment text (omit to read from stdin)",
+      type: "string"
+    },
+    dir: {
+      default: ".",
+      description: "Linked directory to authorize from (default: .)",
+      type: "string"
+    },
+    json: { description: "Machine-readable output", type: "boolean" },
+    message: {
+      description: "Message id (from `comments --json`)",
+      required: true,
+      type: "positional"
+    }
+  },
+  meta: { description: "Edit a comment you authored", name: "edit" },
+  async run({ args }) {
+    try {
+      await editMessage({
+        apiKey: args["api-key"],
+        artifact: args.artifact,
+        body: args.body,
+        dir: args.dir,
+        json: Boolean(args.json),
+        message: args.message
+      });
+    } catch (err) {
+      printCliError(err, Boolean(args.json));
+      process.exit(1);
+    }
+  }
+});
+var del = defineCommand({
+  args: {
+    "api-key": {
+      description: "Authorize with an account API key (default: stored login)",
+      type: "string"
+    },
+    artifact: {
+      description: "Act on an artifact ID instead of the linked folder",
+      type: "string"
+    },
+    dir: {
+      default: ".",
+      description: "Linked directory to authorize from (default: .)",
+      type: "string"
+    },
+    json: { description: "Machine-readable output", type: "boolean" },
+    message: {
+      description: "Message id (from `comments --json`)",
+      required: true,
+      type: "positional"
+    }
+  },
+  meta: { description: "Delete a comment you authored", name: "delete" },
+  async run({ args }) {
+    try {
+      await deleteMessage({
+        apiKey: args["api-key"],
+        artifact: args.artifact,
+        dir: args.dir,
+        json: Boolean(args.json),
+        message: args.message
+      });
+    } catch (err) {
+      printCliError(err, Boolean(args.json));
+      process.exit(1);
+    }
+  }
+});
 var open = defineCommand({
   args: {
     "api-key": {
@@ -2346,7 +3318,8 @@ var dashboard = defineCommand({
 var main = defineCommand({
   meta: {
     description: "Publish AI-generated artifacts for review \u2014 https://artifact.cafe",
-    name: "artifact-cafe"
+    name: "artifact-cafe",
+    version: cliVersion()
   },
   // Bare `artifact-cafe` (no subcommand) → brand banner + usage. citty
   // still calls this parent run *after* a matched subcommand, so bail when
@@ -2360,8 +3333,11 @@ var main = defineCommand({
     await showUsage(cmd);
   },
   subCommands: {
+    comment: comment2,
     comments: comments2,
     dashboard,
+    delete: del,
+    edit,
     folders: folders2,
     link: link2,
     list: list2,
@@ -2371,8 +3347,13 @@ var main = defineCommand({
     open,
     protect: protect2,
     publish: publish2,
+    reopen,
+    reply,
+    resolve,
     whoami: whoami2,
     workspaces: workspaces2
   }
 });
-runMain(main);
+var finishUpdateCheck = startUpdateCheck();
+await runMain(main);
+await finishUpdateCheck();