artifacty 0.11.1 → 0.12.0

package/src/lib/render.js

@@ -37,7 +37,7 @@ export function renderDashboard({ artifacts, baseUrl, filters = {}, pagination,
           <a href="${view.href("/new")}">${view.text("nav.new")}</a>
           <a href="${view.href("/import")}">${view.text("nav.import")}</a>
           <a href="/api/artifacts">${view.text("nav.api")}</a>
-          ${authNav(user)}
+          ${authNav(user, view)}
           ${languageSwitcher(view)}
         </nav>
       </header>
@@ -379,7 +379,7 @@ export function renderAdminArtifactVersionsPage({ artifact, selectedVersion, con
         <nav>
           <a href="${view.href(artifactPath)}">Artifact</a>
           <a href="${view.href(`${artifactPath}/diff`)}">${view.text("nav.diff")}</a>
-          ${authNav(user)}
+          ${authNav(user, view)}
           ${languageSwitcher(view)}
         </nav>
       </header>
@@ -563,7 +563,7 @@ export function renderAccountPage({ baseUrl, user, tokens = [], createdToken = "
         </div>
         <nav>
           <a href="${view.href("/")}">${view.text("nav.index")}</a>
-          ${user.role === "admin" ? `<a href="/admin/users">Users</a><a href="/admin/backup">Backup</a>` : ""}
+          ${user.role === "admin" ? `<a href="/admin/users">Users</a><a href="/admin/backup">Backup</a><a href="${view.href("/admin/access")}">${view.text("access.title")}</a>` : ""}
           <a href="/account/password">Password</a>
           <form class="nav-form" method="post" action="/logout"><button type="submit">Sign out</button></form>
           ${languageSwitcher(view)}
@@ -682,7 +682,7 @@ export function renderAdminBackupPage({ baseUrl, integrity, importResult = null,
         </div>
         <nav>
           <a href="${view.href("/")}">${view.text("nav.index")}</a>
-          <a href="/admin/users">Users</a>
+          <a href="/admin/users">Users</a><a href="${view.href("/admin/access")}">${view.text("access.title")}</a>
           <a href="/admin/retention">${view.text("retention.navLabel")}</a>
           <a href="/account">Account</a>
           ${languageSwitcher(view)}
@@ -737,6 +737,116 @@ export function renderAdminBackupPage({ baseUrl, integrity, importResult = null,
   });
 }
 
+export function renderAdminAccessPage({ baseUrl, user, mode, teams = [], users = [], networkPolicy = { allowedCidrs: [] }, currentIp = "", preview = null, pendingNetworkPolicy = null, shareLinkPolicy = {}, locale = DEFAULT_LOCALE, currentPath = "/admin/access" }) {
+  const view = viewContext(locale, currentPath);
+  return pageShell({
+    title: view.text("access.title"),
+    locale: view.locale,
+    body: `<header class="topbar"><div><h1>${view.text("access.title")}</h1><p>${escapeHtml(baseUrl)}</p></div>
+      <nav><a href="${view.href("/")}">${view.text("nav.index")}</a>${authNav(user, view)}${languageSwitcher(view)}</nav></header>
+      <main class="artifact-view">
+        <section class="meta-card"><h2>${view.text("access.mode")}</h2>
+          <form class="editor-form" method="post" action="/admin/access/preview">${localeInput(view.locale)}
+            <label><input type="radio" name="mode" value="public"${mode === "public" ? " checked" : ""}> ${view.text("access.public")}</label>
+            <p class="muted">${view.text("access.publicHelp")}</p>
+            <label><input type="radio" name="mode" value="private"${mode === "private" ? " checked" : ""}> ${view.text("access.private")}</label>
+            <p class="muted">${view.text("access.privateHelp")}</p>
+            <button type="submit">${view.text("access.preview")}</button>
+          </form>
+        </section>
+        ${preview ? `<section class="meta-card"><h2>${view.text("access.preview")}</h2><p>${view.text("access.previewCount", { count: preview.anonymousArtifactCount, mode: preview.mode })}</p>
+          <form method="post" action="/admin/access">${localeInput(view.locale)}<input type="hidden" name="mode" value="${escapeAttribute(preview.mode)}"><button type="submit">${view.text("access.save")}</button></form></section>` : ""}
+        <section class="meta-card"><h2>${view.text("sharing.links")}</h2><form method="post" action="/admin/access/share-links">${localeInput(view.locale)}
+          <label><input type="checkbox" name="enabledInPrivate" value="true"${shareLinkPolicy.enabledInPrivate ? " checked" : ""}> ${view.text("sharing.enablePrivate")}</label><button type="submit">${view.text("access.save")}</button></form></section>
+        ${pendingNetworkPolicy ? `<section class="meta-card"><h2>${view.text("access.pendingNetwork")}</h2><p>${view.text("access.pendingHelp", { expiresAt: pendingNetworkPolicy.expiresAt })}</p>
+          ${["confirm", "rollback"].map((action) => `<form method="post" action="/admin/access/network/${action}">${localeInput(view.locale)}<input type="hidden" name="id" value="${escapeAttribute(pendingNetworkPolicy.id)}"><button type="submit">${view.text(`access.${action}`)}</button></form>`).join("")}</section>` : ""}
+        <section class="meta-card"><h2>${view.text("access.network")}</h2>
+          <p class="muted">${view.text("access.networkHelp")}</p>
+          <p>${view.text("access.currentIp")}: <code>${escapeHtml(currentIp)}</code></p>
+          <form class="editor-form" method="post" action="/admin/access/network">${localeInput(view.locale)}
+            <label class="field"><span>${view.text("access.allowedCidrs")}</span><textarea name="allowedCidrs" rows="5">${escapeHtml((networkPolicy.allowedCidrs || []).join("\n"))}</textarea></label>
+            <button type="submit">${view.text("access.saveNetwork")}</button>
+          </form>
+        </section>
+        <section class="meta-card"><h2>${view.text("access.samples")}</h2><p>${view.text("access.samplesHelp")}</p>
+          ${["install", "remove"].map((action) => `<form method="post" action="/admin/samples/${action}">${localeInput(view.locale)}<button type="submit">${view.text(`access.samples.${action}`)}</button></form>`).join("")}</section>
+        <section class="meta-card"><h2>${view.text("access.teams")}</h2>
+          <form class="editor-form auth-form" method="post" action="/admin/teams">${localeInput(view.locale)}
+            <label class="field"><span>${view.text("access.teamName")}</span><input name="name" required></label>
+            <button type="submit">${view.text("access.createTeam")}</button>
+          </form>
+          ${teams.length ? teams.map((team) => `<section><h3>${escapeHtml(team.name)}</h3>
+            <form class="editor-form" method="post" action="/admin/teams/${encodeURIComponent(team.id)}/members">${localeInput(view.locale)}
+              <fieldset><legend>${view.text("access.members")}</legend>${accessCheckboxes(users, "userIds", team.memberIds || [], view)}</fieldset>
+              <button type="submit">${view.text("access.saveMembers")}</button>
+            </form></section>`).join("") : `<p class="muted">${view.text("access.noTeams")}</p>`}
+        </section>
+      </main>`
+  });
+}
+
+export function renderArtifactSharingPage({ baseUrl, user, artifact, sharing = { userIds: [], teamIds: [] }, users = [], teams = [], accessReport = null, shareLinks = [], createdShareLink = null, networkPolicy = { allowedCidrs: [] }, locale = DEFAULT_LOCALE, currentPath = "/" }) {
+  const view = viewContext(locale, currentPath);
+  return pageShell({
+    title: view.text("sharing.title"),
+    locale: view.locale,
+    body: `<header class="topbar"><div><h1>${view.text("sharing.title")}: ${escapeHtml(artifact.title)}</h1><p>${escapeHtml(baseUrl)}</p></div>
+      <nav><a href="${view.href(`/artifacts/${encodeURIComponent(artifact.id)}`)}">${view.text("nav.artifact")}</a>${authNav(user, view)}${languageSwitcher(view)}</nav></header>
+      <main class="artifact-view"><section class="meta-card">
+        <p>${view.text("sharing.help")}</p>
+        <form class="editor-form" method="post" action="/artifacts/${encodeURIComponent(artifact.id)}/sharing">${localeInput(view.locale)}
+          <fieldset><legend>${view.text("sharing.users")}</legend>${accessCheckboxes(users, "userIds", sharing.userIds || [], view, sharing.userPermissions || {})}</fieldset>
+          <fieldset><legend>${view.text("sharing.teams")}</legend>${accessCheckboxes(teams, "teamIds", sharing.teamIds || [], view, sharing.teamPermissions || {})}</fieldset>
+          <button type="submit">${view.text("sharing.save")}</button>
+        </form>
+      </section>
+      ${accessReport && (user?.role === "admin" || user?.id === artifact.ownerUserId) ? `<section class="meta-card"><h2>${view.text("sharing.effective")}</h2><p>${view.text("sharing.networkCondition")}: ${escapeHtml(networkPolicy.allowedCidrs?.length ? networkPolicy.allowedCidrs.join(", ") : view.text("sharing.unrestricted"))}</p><p>${view.text("sharing.anonymous")}: ${view.text(accessReport.anonymousRead ? "sharing.allowed" : "sharing.denied")}</p>
+        <table><thead><tr><th>${view.text("sharing.users")}</th><th>${view.text("sharing.permission")}</th><th>${view.text("sharing.reason")}</th></tr></thead><tbody>${accessReport.users.map((item) => `<tr><td>${escapeHtml(item.name || item.email || item.id)}</td><td>${view.text(`sharing.permission.${item.permission}`)}</td><td>${escapeHtml(item.reasons.join(", "))}</td></tr>`).join("")}</tbody></table></section>` : ""}
+      <section class="meta-card"><h2>${view.text("sharing.links")}</h2><p>${view.text("sharing.linksHelp")}</p>
+        ${createdShareLink?.token ? `<p>${view.text("sharing.copyNow")}</p><a href="${escapeAttribute(`${baseUrl.replace(/\/$/, "")}/s/${encodeURIComponent(createdShareLink.token)}`)}">${escapeHtml(`${baseUrl.replace(/\/$/, "")}/s/${encodeURIComponent(createdShareLink.token)}`)}</a>` : ""}
+        <form class="editor-form" method="post" action="/artifacts/${encodeURIComponent(artifact.id)}/share-links">${localeInput(view.locale)}
+          <label class="field"><span>${view.text("sharing.version")}</span><select name="version"><option value="latest">${view.text("sharing.latest")}</option>${(artifact.versions || []).map((item) => `<option value="${Number(item.version)}">v${Number(item.version)}</option>`).join("")}</select></label>
+          <label class="field"><span>${view.text("sharing.days")}</span><input type="number" name="days" min="1" max="365" value="7" required></label><button type="submit">${view.text("sharing.createLink")}</button></form>
+        ${shareLinks.map((link) => `<section><p>${escapeHtml(link.id)} · ${link.version == null ? view.text("sharing.latest") : `v${Number(link.version)}`} · ${view.text("sharing.expires")}: ${escapeHtml(link.expiresAt)}</p>
+          ${link.revokedAt ? `<p>${view.text("sharing.revoked")}</p>` : `<form method="post" action="/artifacts/${encodeURIComponent(artifact.id)}/share-links/${encodeURIComponent(link.id)}/revoke">${localeInput(view.locale)}<button type="submit">${view.text("sharing.revoke")}</button></form>`}</section>`).join("")}
+      </section></main>`
+  });
+}
+
+function accessCheckboxes(items, name, selectedIds, view, permissions = null) {
+  if (!items.length) return `<p class="muted">${view.text(name === "userIds" ? "access.noUsers" : "access.noTeams")}</p>`;
+  return items.filter((item) => item.active !== false).map((item) => `<label><input type="checkbox" name="${name}" value="${escapeAttribute(item.id)}"${selectedIds.includes(item.id) ? " checked" : ""}> ${escapeHtml(item.name || item.email || item.id)}${item.email && item.name ? ` (${escapeHtml(item.email)})` : ""}</label>${permissions ? `<label>${view.text("sharing.permission")}<select name="${name === "userIds" ? "userPermission" : "teamPermission"}:${escapeAttribute(item.id)}">${["read", "comment", "edit"].map((permission) => `<option value="${permission}"${(permissions[item.id] || "read") === permission ? " selected" : ""}>${view.text(`sharing.permission.${permission}`)}</option>`).join("")}</select></label>` : ""}`).join("");
+}
+
+export function renderInboxPage({ baseUrl, user, notifications = [], unreadCount = 0, locale = DEFAULT_LOCALE, currentPath = "/inbox" }) {
+  const view = viewContext(locale, currentPath);
+  return pageShell({ title: view.text("inbox.title"), locale: view.locale,
+    body: `<header class="topbar"><div><h1>${view.text("inbox.title")}</h1><p>${escapeHtml(baseUrl)}</p></div><nav><a href="${view.href("/")}">${view.text("nav.index")}</a>${authNav(user, view)}${languageSwitcher(view)}</nav></header>
+      <main class="artifact-view"><section class="meta-card"><p>${view.text("inbox.unread", { count: unreadCount })}</p>
+        <form method="post" action="/inbox/read-all">${localeInput(view.locale)}<button type="submit">${view.text("inbox.readAll")}</button></form>
+        ${notifications.length ? notifications.map((item) => `<section><h2><a href="${view.href(`/artifacts/${encodeURIComponent(item.artifactId)}`)}">${escapeHtml(item.title)}</a></h2><p>${escapeHtml(item.type)} · ${escapeHtml(item.createdAt)}</p>
+          ${item.readAt ? `<p>${view.text("inbox.read")}</p>` : `<form method="post" action="/inbox/${encodeURIComponent(item.id)}/read">${localeInput(view.locale)}<button type="submit">${view.text("inbox.markRead")}</button></form>`}</section>`).join("") : `<p>${view.text("inbox.empty")}</p>`}
+      </section></main>` });
+}
+
+export function renderSharedArtifactPage({ artifact, version, content, locale = DEFAULT_LOCALE, sharePath }) {
+  const view = viewContext(locale, sharePath);
+  const rendered = version.format === "html"
+    ? `<p>${view.text("sharing.staticPreview")}</p><iframe class="artifact-frame" sandbox="" referrerpolicy="no-referrer" src="${escapeAttribute(`${sharePath}/raw`)}"></iframe>`
+    : ["react", "notebook", "svg", "mermaid"].includes(version.format)
+    ? `<p>${view.text("sharing.safeSource")}</p><pre class="artifact-code"><code>${escapeHtml(content)}</code></pre>`
+    : renderContent(version.format, content, version.metadata || {}, {
+      view, artifactType: artifact.artifactType,
+      rawUrl: `${sharePath}/raw`,
+      bundleFileUrl: (fileName) => `${sharePath}/raw?file=${encodeURIComponent(fileName)}`
+    });
+  const needsViewer = ["code", "markdown", "notebook", "sarif", "csv"].includes(version.format);
+  return pageShell({ title: artifact.title, locale: view.locale,
+    body: `<header class="topbar"><div><h1>${escapeHtml(artifact.title)}</h1><p>${view.text("sharing.readOnly")} · v${Number(version.version)}</p></div></header><main class="artifact-view">${rendered}</main>`,
+    head: needsViewer ? editorHead() : "",
+    afterBody: `${frameResizeScript()}${needsViewer ? viewerScript() : ""}` });
+}
+
 export function renderAdminUsersPage({ baseUrl, user, users = [], importResult = null, importError = "", locale = DEFAULT_LOCALE, currentPath = "/admin/users" }) {
   const view = viewContext(locale, currentPath);
   const rows = users.map((item) => `
@@ -796,7 +906,7 @@ export function renderAdminUsersPage({ baseUrl, user, users = [], importResult =
         </div>
         <nav>
           <a href="${view.href("/")}">${view.text("nav.index")}</a>
-          <a href="/admin/backup">Backup</a>
+          <a href="/admin/backup">Backup</a><a href="${view.href("/admin/access")}">${view.text("access.title")}</a>
           <a href="/admin/retention">${view.text("retention.navLabel")}</a>
           <a href="/account">Account</a>
           ${languageSwitcher(view)}
@@ -878,7 +988,7 @@ export function renderAdminWebhooksPage({ baseUrl, webhooks = [], createdSecret
         </div>
         <nav>
           <a href="${view.href("/")}">${view.text("nav.index")}</a>
-          <a href="/admin/backup">Backup</a>
+          <a href="/admin/backup">Backup</a><a href="${view.href("/admin/access")}">${view.text("access.title")}</a>
           <a href="/admin/users">Users</a>
           <a href="/admin/retention">${view.text("retention.navLabel")}</a>
           <a href="/account">Account</a>
@@ -967,8 +1077,8 @@ export function renderAdminRetentionPage({ baseUrl, policy, lastSweep = null, re
         </div>
         <nav>
           <a href="${view.href("/")}">${view.text("nav.index")}</a>
-          <a href="/admin/backup">Backup</a>
-          <a href="/admin/users">Users</a>
+          <a href="/admin/backup">Backup</a><a href="${view.href("/admin/access")}">${view.text("access.title")}</a>
+          <a href="/admin/users">Users</a><a href="${view.href("/admin/access")}">${view.text("access.title")}</a>
           <a href="/account">Account</a>
           ${languageSwitcher(view)}
         </nav>
@@ -1005,8 +1115,11 @@ export function renderAdminRetentionPage({ baseUrl, policy, lastSweep = null, re
   });
 }
 
-export function renderArtifactPage({ artifact, version, content, comments = [], baseUrl, authToken = "", locale = DEFAULT_LOCALE, currentPath = "/", user = null }) {
+export function renderArtifactPage({ artifact, version, content, comments = [], baseUrl, authToken = "", locale = DEFAULT_LOCALE, currentPath = "/", user = null, permission = null }) {
   const view = viewContext(locale, currentPath);
+  const canEdit = permission == null || ["edit", "owner", "admin"].includes(permission);
+  const canComment = canEdit || permission === "comment";
+  const canArchive = permission == null || ["owner", "admin"].includes(permission);
   const versionLinks = artifact.versions
     .map((item) => {
       const active = item.version === version.version ? " active" : "";
@@ -1062,11 +1175,12 @@ export function renderArtifactPage({ artifact, version, content, comments = [],
         </div>
         <nav>
           <a href="${view.href("/")}">${view.text("nav.index")}</a>
-          <a href="${view.href(`/artifacts/${encodeURIComponent(artifact.id)}/edit`)}">${view.text("nav.edit")}</a>
+          ${canEdit ? `<a href="${view.href(`/artifacts/${encodeURIComponent(artifact.id)}/edit`)}">${view.text("nav.edit")}</a>` : ""}
           <a href="${view.href(`/artifacts/${encodeURIComponent(artifact.id)}/diff`)}">${view.text("nav.diff")}</a>
           ${user?.role === "admin" ? `<a href="${view.href(`/admin/artifacts/${encodeURIComponent(artifact.id)}/versions`)}">Versions</a>` : ""}
           <a href="${view.href(rawUrl)}">${view.text("nav.raw")}</a>
-          ${authNav(user)}
+          ${user && canManageVisibility ? `<a href="${view.href(`/artifacts/${encodeURIComponent(artifact.id)}/sharing`)}">${view.text("sharing.title")}</a>` : ""}
+          ${authNav(user, view)}
           ${languageSwitcher(view)}
         </nav>
       </header>
@@ -1082,16 +1196,16 @@ export function renderArtifactPage({ artifact, version, content, comments = [],
           <span>${escapeHtml(version.createdAt)}</span>
           <span>${escapeHtml(version.sha256.slice(0, 12))}</span>
         </section>
-        <form class="inline-action" method="post" action="/artifacts/${encodeURIComponent(artifact.id)}/${archiveAction}">
+        ${canArchive ? `<form class="inline-action" method="post" action="/artifacts/${encodeURIComponent(artifact.id)}/${archiveAction}">
           ${hiddenToken(authToken)}
           ${localeInput(view.locale)}
           <button type="submit">${archiveLabel}</button>
-        </form>
+        </form>` : ""}
         ${visibilityForm}
         <section class="version-strip">${versionLinks}</section>
         ${rendered}
         ${renderRelationsSection(artifact, view)}
-        ${renderCommentsSection(artifact, comments, view, { version: version.version, authToken, canModerate: canManageVisibility })}
+        ${renderCommentsSection(artifact, comments, view, { version: version.version, authToken, canModerate: canManageVisibility, canComment })}
       </main>
     `,
     head: needsViewerScript ? editorHead() : "",
@@ -1102,7 +1216,7 @@ export function renderArtifactPage({ artifact, version, content, comments = [],
 
 // --- Comments and review status (roadmap section 5) -----------------------
 
-function renderCommentsSection(artifact, comments, view, { version, authToken, canModerate }) {
+function renderCommentsSection(artifact, comments, view, { version, authToken, canModerate, canComment = true }) {
   const grouped = new Map();
   for (const comment of comments) {
     if (!grouped.has(comment.version)) {
@@ -1119,7 +1233,7 @@ function renderCommentsSection(artifact, comments, view, { version, authToken, c
   // with diagrams could still embed N * cap base64 srcdoc payloads.
   const diagramState = createMermaidDiagramState();
   const groups = versions
-    .map((groupVersion) => renderCommentVersionGroup(artifact, grouped.get(groupVersion), groupVersion, view, { activeVersion: version, authToken, canModerate, diagramState }))
+    .map((groupVersion) => renderCommentVersionGroup(artifact, grouped.get(groupVersion), groupVersion, view, { activeVersion: version, authToken, canModerate, canComment, diagramState }))
     .join("");
 
   return `
@@ -1130,12 +1244,12 @@ function renderCommentsSection(artifact, comments, view, { version, authToken, c
         ${canModerate ? renderReviewStatusForm(artifact, view, authToken) : ""}
       </div>
       ${comments.length === 0 ? `<p class="comments-empty">${view.text("comments.empty")}</p>` : groups}
-      ${versions.includes(version) ? "" : renderCommentForm(artifact, view, { version, authToken })}
+      ${!canComment || versions.includes(version) ? "" : renderCommentForm(artifact, view, { version, authToken })}
     </section>
   `;
 }
 
-function renderCommentVersionGroup(artifact, versionComments, groupVersion, view, { activeVersion, authToken, canModerate, diagramState }) {
+function renderCommentVersionGroup(artifact, versionComments, groupVersion, view, { activeVersion, authToken, canModerate, canComment, diagramState }) {
   const roots = versionComments.filter((comment) => !comment.parentId);
   const repliesByParent = new Map();
   for (const comment of versionComments) {
@@ -1148,21 +1262,21 @@ function renderCommentVersionGroup(artifact, versionComments, groupVersion, view
   }
   const isActiveVersion = groupVersion === activeVersion;
   const items = roots
-    .map((root) => renderCommentThread(artifact, root, repliesByParent.get(root.id) || [], view, { authToken, canModerate, allowReply: isActiveVersion, diagramState }))
+    .map((root) => renderCommentThread(artifact, root, repliesByParent.get(root.id) || [], view, { authToken, canModerate, allowReply: isActiveVersion && canComment, canComment, diagramState }))
     .join("");
 
   return `
     <div class="comment-version-group">
       <h3>${view.text("comments.version", { version: groupVersion })}</h3>
       <ul class="comment-list">${items}</ul>
-      ${isActiveVersion ? renderCommentForm(artifact, view, { version: groupVersion, authToken }) : ""}
+      ${isActiveVersion && canComment ? renderCommentForm(artifact, view, { version: groupVersion, authToken }) : ""}
     </div>
   `;
 }
 
-function renderCommentThread(artifact, root, replies, view, { authToken, canModerate, allowReply, diagramState }) {
+function renderCommentThread(artifact, root, replies, view, { authToken, canModerate, allowReply, canComment, diagramState }) {
   const replyItems = replies
-    .map((reply) => renderCommentEntry(artifact, reply, view, { authToken, canModerate, isReply: true, diagramState }))
+    .map((reply) => renderCommentEntry(artifact, reply, view, { authToken, canModerate, canComment, isReply: true, diagramState }))
     .join("");
   const replyForm = allowReply
     ? renderCommentForm(artifact, view, { version: root.version, authToken, parentId: root.id, compact: true })
@@ -1170,17 +1284,17 @@ function renderCommentThread(artifact, root, replies, view, { authToken, canMode
 
   return `
     <li class="comment-thread">
-      ${renderCommentEntry(artifact, root, view, { authToken, canModerate, isReply: false, diagramState })}
+      ${renderCommentEntry(artifact, root, view, { authToken, canModerate, canComment, isReply: false, diagramState })}
       ${replyItems ? `<ul class="comment-replies">${replyItems}</ul>` : ""}
       ${replyForm}
     </li>
   `;
 }
 
-function renderCommentEntry(artifact, comment, view, { authToken, canModerate, isReply, diagramState }) {
+function renderCommentEntry(artifact, comment, view, { authToken, canModerate, canComment, isReply, diagramState }) {
   const anchorLabel = commentAnchorLabel(comment.anchor, view);
   const resolved = comment.status === "resolved";
-  const resolveForm = !resolved
+  const resolveForm = !resolved && canComment
     ? `<form class="inline-action" method="post" action="/artifacts/${encodeURIComponent(artifact.id)}/comments/${encodeURIComponent(comment.id)}/resolve">
         ${hiddenToken(authToken)}
         ${localeInput(view.locale)}
@@ -3300,11 +3414,11 @@ function languageSwitcher(view) {
   return `<span class="language-switcher">${english}${korean}</span>`;
 }
 
-function authNav(user) {
+function authNav(user, view) {
   if (!user) {
     return `<a href="/login">Sign in</a>`;
   }
-  return `${user.role === "admin" ? `<a href="/admin/users">Users</a><a href="/admin/backup">Backup</a>` : ""}<a href="/account">Account</a>`;
+  return `${user.role === "admin" ? `<a href="/admin/users">Users</a><a href="/admin/backup">Backup</a><a href="${view.href("/admin/access")}">${view.text("access.title")}</a>` : ""}<a href="/account">Account</a><a href="${view.href("/inbox")}">${view.text("inbox.title")}</a>`;
 }
 
 export function escapeHtml(value) {

package/src/lib/sample-content.js

@@ -0,0 +1,185 @@
+// Stable keys identify installed manuals independently of titles and edits.
+export const sampleCatalog = [
+  {
+    key: "start-here",
+    title: "Artifacty — Start here",
+    artifactType: "document",
+    format: "markdown",
+    tags: ["sample", "manual", "getting-started"],
+    content: `# Welcome to Artifacty
+
+Artifacty keeps agent outputs in one versioned store. You can use the store through a browser, CLI, JSON API, or MCP. Open the **Feature guide** to see all features. Open **Architecture** to see the system map. Use the **Handoff exercise** to practice a review cycle.
+
+## Start locally
+
+Use Node.js 22.5 or newer. From the repository, run:
+
+\`\`\`sh
+npm install
+npm start
+\`\`\`
+
+Open http://127.0.0.1:8787. The server binds to localhost by default. To start a background server, run \`node src/cli.js serve\`. To keep the server in the terminal, add \`--foreground\`. Use \`node src/cli.js status\`, \`stop\`, and \`doctor\` to inspect it.
+
+## Publish and improve an artifact
+
+1. Create a Markdown artifact in the browser, or run \`node src/cli.js publish --title "My first note" --content "Hello Artifacty" --format markdown\`.
+2. Open the artifact.
+3. Edit its content.
+4. Save a new version. Earlier versions remain available.
+5. Inspect the version history.
+6. Compare the versions with a diff.
+7. Add tags.
+8. Use search, filters, or saved views to find the artifact again.
+9. Add a comment.
+10. Request a review.
+11. As the owner or administrator, record an approved or changes-requested status.
+12. Create the initial administrator at **/login**.
+13. Sign in as the administrator.
+14. Open **Sharing** on the artifact. Anonymous single-user browsing does not expose Sharing.
+15. Inspect the effective permissions.
+16. Grant read, comment, or edit access as needed.
+
+## Choose your access model
+
+Before accounts exist, Artifacty operates as a local single-user store. Once accounts exist, use personal accounts and tokens. Create the initial administrator at **/login**. Administrators manage accounts at **/admin/users**. The Access page links to that page. Administrators manage teams, access mode, and network rules at **/admin/access**. In private mode, use personal authentication for ordinary artifact reads and creation. Server-wide tokens do not authorize those operations. Local CLI operations remain trusted store administration.
+
+A share link is a separate read-only capability with an expiry time. It does not grant account membership. Default expiry is seven days. Owners can share the latest version or pin one version. Share links while the server is in private mode require explicit administrator opt-in. In public mode, an owner can link a private-visibility artifact without that site toggle. When you no longer need a link, revoke it. An owner change invalidates existing links.
+
+## Keep the manuals safely
+
+\`node src/cli.js samples install\` installs these four manuals once per installation scope. Repeating installation skips active manuals. \`samples remove\` archives managed samples. It preserves their content and versions. Installing again restores them without replacing your edits. Matching titles or tags do not make your own artifacts managed samples.
+
+Back up before maintenance. This build uses store schema 10. Older builds refuse newer stores. This manual describes the implemented repository behavior, not a package release announcement.`
+  },
+  {
+    key: "feature-guide",
+    title: "Artifacty — Feature guide",
+    artifactType: "html-page",
+    format: "html",
+    tags: ["sample", "manual", "reference"],
+    content: `<!doctype html>
+<html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>Artifacty feature guide</title>
+<style>body{font-family:system-ui,sans-serif;line-height:1.65;color:#172b3a;background:#f5f7fa;margin:0}main{max-width:900px;margin:auto;padding:40px 24px}h1,h2{line-height:1.2}h1{font-size:2.4rem}section{background:white;border:1px solid #dce4ec;border-radius:12px;padding:24px;margin:20px 0}code{background:#edf2f7;padding:2px 5px;border-radius:4px}li{margin:6px 0}a{color:#175aa3}footer{color:#526475}</style></head><body><main>
+<header><p>ARTIFACTY / REFERENCE</p><h1>From an agent output to a shared record</h1><p>Use this inventory to choose the right publishing, review, access, and maintenance workflow. Use Node.js 22.5 or newer. The current store schema is 10.</p></header>
+<nav aria-label="Guide sections"><a href="#formats">Formats</a> · <a href="#history">History and discovery</a> · <a href="#collaboration">Collaboration</a> · <a href="#access">Access</a> · <a href="#operations">Operations</a></nav>
+<section id="formats"><h2>Formats and imports</h2><p>The 13 formats are HTML, Markdown, text, JSON, code, SVG, Mermaid, React, SARIF, CSV, image, video, and notebook. Choose an artifact type separately: a document, handoff, code review, test report, dashboard, diagram, component, table, or another supported type.</p><p>Bundles group multiple files under one artifact. Supported binary bundle assets include PDF, DOCX, XLSX, and ZIP. Importers normalize outputs from Claude, Codex, Gemini, GitHub Copilot, Cursor, and generic inputs. Use the browser import screen or <code>artifacty import --agent codex --file handoff.md</code>.</p><p>Artifact content is untrusted. Browser previews use constrained rendering. A public HTML share preview is static. It blocks scripts and external resource loading. Share links show other active formats as source. Do not expect those previews to preserve interactive application behavior.</p></section>
+<section id="history"><h2>Versions, discovery, and retrieval</h2><ul><li>Updates create versions with immutable content files. You can read a historical version and compare versions with a diff. To avoid overwriting a concurrent edit, use an expected-version check.</li><li>Archive and restore artifacts instead of losing their history. Integrity checks verify stored files, hashes, and orphaned files.</li><li>Search by keyword and filter by tags, source agent, artifact type, publisher, dates, review status, relationships, and archive state. Pagination and grouping help you use large lists. To reuse a set of filters, save it as a view.</li><li>When available, SQLite FTS5 accelerates keyword search. Otherwise, search uses metadata. Optional embeddings enable semantic and hybrid search. Without a configured provider, those modes use keyword search. Rebuild search or embedding indexes after configuration changes.</li></ul></section>
+<section id="collaboration"><h2>Relationships, comments, review, and notifications</h2><p>Connect artifacts using derived-from, supersedes, reviews, references, or part-of relations. Comments support threads and anchors. After you address a thread, resolve it. Review status progresses among none, pending, changes-requested, and approved.</p><p>The inbox at <code>/inbox</code> collects relevant shares, comments, review activity, and new versions. Notifications depend on the user and current artifact access. You can mark items read individually or together. A notification does not grant access.</p><p>Audit records support investigation. Event polling and server-sent events expose authorized activity streams. Webhooks deliver configured events to validated destinations. Use event filters, replay cursors, and webhook administration for integrations.</p></section>
+<section id="access"><h2>Accounts, permissions, share links, and network rules</h2><p>Create the initial administrator at <code>/login</code>. Administrators manage accounts at <code>/admin/users</code>. The Access page links to that page. Administrators manage teams, access mode, and network rules at <code>/admin/access</code>. The artifact <strong>Sharing</strong> panel shows effective access and its sources. Direct-user and team grants support read, comment, and edit. Where grants overlap, the strongest permission wins. Ownership and administrator management are separate from grants. Token scopes limit token actions. They do not grant artifact access.</p><p>Private mode requires an active personal account. Server-wide tokens do not authorize ordinary artifact reads or creation in private mode. Administrator APIs have their own authorization rules. Personal tokens remain constrained by both their scopes and the user's artifact permissions. Trusted local CLI operations can administer the local store directly.</p><p>Read-only share links default to seven days and can target the latest version or a pinned version. Share links while the server is in private mode require explicit administrator opt-in. In public mode, owners may link private-visibility artifacts without that site toggle. Links can be revoked, and owner changes invalidate them. A valid capability permits only its read-only shared surface.</p><p>Network allow rules accept IP addresses and CIDRs. First, stage a change. Next, verify access from the intended peer. Then confirm the change within 120 seconds or roll it back. Pending state survives a restart. Before the next access, the server checks for expiry. If the change has expired, the server restores the previous rules. Rules use the socket peer address, not forwarded proxy headers.</p></section>
+<section id="operations"><h2>Interfaces and maintenance</h2><ul><li>The browser supports creation, import, viewing, editing, discovery, review, inbox, and administration.</li><li>The CLI supports serve/start/stop/status, publish/import/update/read/list, history and diff, relations/comments/review, saved views, event watching, account import, backup, retention, indexes, integrity, and diagnostics. Run <code>artifacty help</code> for exact flags.</li><li>The JSON API exposes artifacts and operational endpoints under <code>/api/</code>. MCP exposes agent tools through stdio and optional HTTP transport. Use <code>artifacty install claude --dry-run</code> to inspect integration configuration and <code>artifacty check</code> to verify tool discovery.</li><li>Export and import backups to move or recover a store. Retention supports archive rules, archived-item purge, audit/event history limits, and protected tags. Before an intentional purge, inspect a dry run.</li><li><code>artifacty samples install</code> installs these manuals idempotently. <code>artifacty samples remove</code> archives only managed samples in the current scope. Reinstallation restores existing versions and user edits.</li></ul><p>Keep ARTIFACTY_HOME private. Older builds refuse schema-10 stores. Before changing builds, preserve a backup. Consult repository integration documentation for concrete agent and API examples.</p></section>
+<footer><p>This guide is a managed sample artifact. Editing it creates your own version. Reinstalling samples preserves that work.</p></footer>
+</main></body></html>`
+  },
+  {
+    key: "architecture",
+    title: "Artifacty — Architecture",
+    artifactType: "diagram",
+    format: "mermaid",
+    tags: ["sample", "manual", "architecture"],
+    content: `flowchart TD
+  Browser[Browser dashboard and admin] --> HTTP[Local HTTP server and JSON API]
+  Agents[Agent clients] --> MCP[MCP stdio and optional HTTP]
+  Operator[Trusted local operator] --> CLI[Artifacty CLI]
+  HTTP --> Peer[Socket peer network policy]
+  Peer --> Auth[Personal accounts and token scopes]
+  Auth --> Access[Private mode and effective permissions]
+  Access --> Store[Shared storage operations]
+  MCP --> Store
+  CLI --> Store
+  Store --> DB[(SQLite schema 10 metadata)]
+  Store --> Files[Immutable version files and bundle assets]
+  Store --> Search[FTS5 and optional embeddings]
+  Store --> History[Version history and diff]
+  Store --> Collaboration[Relations comments and review]
+  Collaboration --> Inbox[Access scoped inbox]
+  Store --> Events[Audit events SSE and webhooks]
+  HTTP --> Links[Read only expiring latest or pinned share links]
+  Links --> Preview[Static HTML or active format source]
+  Links --> Store
+  Admin[Active administrator] --> Policy[Stage network rules for 120 seconds]
+  Policy --> Confirm[Confirm or explicit rollback]
+  Policy --> Expiry[Durable lazy expiry rollback]
+  Confirm --> Peer
+  Expiry --> Peer
+  CLI --> Maintenance[Backup retention integrity and indexes]
+  CLI --> Samples[Install restore or archive managed manuals]
+  Samples --> Store`
+  },
+  {
+    key: "handoff-exercise",
+    title: "Artifacty — Handoff exercise",
+    artifactType: "handoff",
+    format: "markdown",
+    tags: ["sample", "manual", "handoff", "exercise"],
+    content: `# Handoff exercise: review a versioned decision
+
+## Goal
+
+Practice passing an artifact from an author to a reviewer while preserving evidence, access, and the next action. Use a disposable artifact of your own. Keep this manual as a reference.
+
+## Current state
+
+The four sample manuals are installed. You can open the browser dashboard. To practice multi-user access, first ask an administrator to create the author and reviewer accounts. Local single-user mode does not demonstrate account isolation.
+
+## Exercise
+
+1. Publish a Markdown artifact titled **Exercise: launch checklist**, type **handoff**. Include a goal, current state, evidence, decisions, blockers, and next actions.
+2. Add an exercise tag.
+3. Save the artifact ID and initial version number.
+4. Edit one next action. If you use an agent, include the expected version in the update.
+5. Save a second version.
+6. Inspect both versions.
+7. Compare the versions with a diff.
+8. Create a separate test-report artifact.
+9. Add a **references** relation from the handoff to the test report.
+10. Open the relation from each side.
+11. In **Sharing**, give the reviewer **comment** permission.
+12. Inspect the effective permission and its source. If the reviewer has team edit access, that stronger grant wins. Token scopes do not grant artifact access.
+13. To demonstrate comment-only access, remove any stronger grant.
+14. Ask the reviewer to add an anchored comment recommending **changes-requested**.
+15. As the owner or administrator, record that review status.
+16. Address the comment in a new version.
+17. Resolve the comment thread.
+18. When the reviewer agrees that the evidence supports approval, record **approved** as the owner or administrator.
+19. Check each participant's inbox for relevant sharing, comment, review, and new-version activity.
+20. Mark notifications read. Notifications remain scoped to current access.
+21. If the server is in private mode, ask an administrator to enable share links explicitly.
+22. Create a seven-day read-only share link pinned to the reviewed version.
+23. Inspect the link preview.
+24. Edit the artifact again.
+25. Verify that the pinned link still shows the selected version. A latest-version link follows new versions. An owner change invalidates existing links.
+26. When the exercise is over, revoke the link.
+27. Archive your exercise artifact.
+28. Restore the artifact.
+29. Reopen its history to confirm that earlier versions remain available.
+
+## Handoff template
+
+- **Goal:** the outcome the next person should achieve.
+- **Current state:** what works and which version is being handed off.
+- **Evidence:** test report IDs, related artifacts, commands, and observed results.
+- **Decisions:** why the approach was chosen and relevant constraints.
+- **Blockers:** known problems with concrete reproduction steps.
+- **Next action:** one bounded task, its owner, and its completion check.
+
+## Administration practice
+
+As an administrator, open **/admin/access** to inspect access mode and network rules. You can switch access mode or stage a network change.
+
+1. Before you stage a network change, keep your actual socket peer address in the allowed rules.
+2. Stage the change.
+3. Test the new route.
+4. Within 120 seconds, confirm the change or roll it back.
+
+Unconfirmed changes remain pending across a restart. Before the next access, the server checks for expiry and rolls back an expired change. Proxy forwarding headers do not change the peer address used by the rule.
+
+In private mode, use personal authentication for ordinary artifact reads and creation. Server-wide tokens do not authorize those operations. Administrator APIs have their own authorization rules. The local CLI is trusted administration. Before testing backup or retention, export a backup. Before a purge, review the purge plan.
+
+## Completion check
+
+You can identify the approved version, read its evidence relation, explain the reviewer's effective permission, and prove the revoked link no longer opens. Record any remaining gap in the handoff.
+
+Removing samples archives only the managed manuals. Reinstalling restores your edited manual versions without replacing them. Your separately created exercise artifacts remain yours.`
+  }
+];

package/src/lib/samples.js

@@ -0,0 +1,74 @@
+import { archiveArtifact, createArtifact, ForbiddenError, openDatabase, restoreArtifact } from "./storage.js";
+import { sampleCatalog } from "./sample-content.js";
+
+const SAMPLE_NAMESPACE = "artifacty-manuals-v1";
+
+function managedSamples(store, access) {
+  const db = openDatabase(store);
+  try {
+    const accountCount = db.prepare("SELECT COUNT(*) AS count FROM users").get().count;
+    if (access && accountCount) {
+      const user = db.prepare("SELECT role, active FROM users WHERE id = ?").get(access.userId || "");
+      if (!user?.active || user.role !== "admin") {
+        throw new ForbiddenError("Only active administrators may manage sample artifacts");
+      }
+    }
+    const scope = access?.userId || "local";
+    // The installation marker lives in the first immutable version: editing a
+    // manual must neither lose its managed identity nor overwrite user work.
+    const rows = db.prepare(`
+      SELECT artifacts.id, artifacts.archived_at, artifact_versions.metadata_json
+      FROM artifacts JOIN artifact_versions ON artifact_versions.artifact_id = artifacts.id
+      WHERE artifact_versions.version = 1
+    `).all();
+    const samples = rows.flatMap((row) => {
+      const marker = JSON.parse(row.metadata_json).artifactySample;
+      return marker?.namespace === SAMPLE_NAMESPACE && marker.scope === scope
+        ? [{ id: row.id, archivedAt: row.archived_at, key: marker.key }] : [];
+    });
+    return { samples, scope };
+  } finally {
+    db.close();
+  }
+}
+
+export async function installSamples(store, { access, audit, catalog = sampleCatalog } = {}) {
+  const { samples, scope } = managedSamples(store, access);
+  const result = { installed: 0, restored: 0, skipped: 0, artifactIds: [] };
+  for (const entry of catalog) {
+    const existing = samples.find((sample) => sample.key === entry.key);
+    if (existing) {
+      if (existing.archivedAt) {
+        await restoreArtifact(store, existing.id, { access, audit });
+        result.restored += 1;
+      } else {
+        result.skipped += 1;
+      }
+      result.artifactIds.push(existing.id);
+      continue;
+    }
+    const artifact = await createArtifact(store, {
+      ...entry,
+      sourceAgent: "generic",
+      access,
+      audit,
+      metadata: { ...entry.metadata, artifactySample: { namespace: SAMPLE_NAMESPACE, scope, key: entry.key } }
+    });
+    samples.push({ id: artifact.id, key: entry.key, archivedAt: null });
+    result.installed += 1;
+    result.artifactIds.push(artifact.id);
+  }
+  return result;
+}
+
+export async function removeSamples(store, { access, audit } = {}) {
+  const { samples } = managedSamples(store, access);
+  const result = { archived: 0, artifactIds: [] };
+  for (const sample of samples) {
+    if (sample.archivedAt) continue;
+    await archiveArtifact(store, sample.id, { access, audit, action: "samples-remove" });
+    result.archived += 1;
+    result.artifactIds.push(sample.id);
+  }
+  return result;
+}