papermark 0.6.0 → 0.8.0

package/dist/index.js

@@ -269,6 +269,13 @@ var api = {
   createLink: (body) => request("/v1/links", { method: "POST", body }),
   updateLink: (id, body) => request(`/v1/links/${id}`, { method: "PATCH", body }),
   deleteLink: (id) => request(`/v1/links/${id}`, { method: "DELETE" }),
+  getLinkPermissions: (id) => request(`/v1/links/${id}/permissions`),
+  // Full-replace semantics: the payload is the complete desired state;
+  // items not listed lose their override.
+  setLinkPermissions: (id, body) => request(`/v1/links/${id}/permissions`, {
+    method: "PUT",
+    body
+  }),
   // Views
   listViews: (linkId, query) => request(`/v1/links/${linkId}/views`, { query }),
   // Datarooms
@@ -308,6 +315,44 @@ var api = {
     method: "POST",
     body
   }),
+  // Dataroom groups
+  listDataroomGroups: (id, query) => request(`/v1/datarooms/${id}/groups`, { query }),
+  createDataroomGroup: (id, body) => request(`/v1/datarooms/${id}/groups`, {
+    method: "POST",
+    body
+  }),
+  getDataroomGroup: (id, gid) => request(`/v1/datarooms/${id}/groups/${gid}`),
+  updateDataroomGroup: (id, gid, body) => request(`/v1/datarooms/${id}/groups/${gid}`, {
+    method: "PATCH",
+    body
+  }),
+  // Also deletes every share link pointing at the group (matching the
+  // dashboard).
+  deleteDataroomGroup: (id, gid) => request(`/v1/datarooms/${id}/groups/${gid}`, {
+    method: "DELETE"
+  }),
+  listDataroomGroupMembers: (id, gid, query) => request(
+    `/v1/datarooms/${id}/groups/${gid}/members`,
+    { query }
+  ),
+  addDataroomGroupMembers: (id, gid, body) => request(
+    `/v1/datarooms/${id}/groups/${gid}/members`,
+    { method: "POST", body }
+  ),
+  removeDataroomGroupMember: (id, gid, mid) => request(
+    `/v1/datarooms/${id}/groups/${gid}/members/${mid}`,
+    { method: "DELETE" }
+  ),
+  listDataroomGroupPermissions: (id, gid, query) => request(
+    `/v1/datarooms/${id}/groups/${gid}/permissions`,
+    { query }
+  ),
+  // Upsert-delta semantics: entries sent are upserted, entries omitted keep
+  // their current state; ancestor folders of visible items are auto-shown.
+  setDataroomGroupPermissions: (id, gid, body) => request(
+    `/v1/datarooms/${id}/groups/${gid}/permissions`,
+    { method: "PUT", body }
+  ),
   // Visitors
   listVisitors: (query) => request("/v1/visitors", { query }),
   getVisitor: (id) => request(`/v1/visitors/${id}`),
@@ -1073,6 +1118,92 @@ function registerConfigCommands(program2) {
 
 // src/commands/datarooms.ts
 import chalk5 from "chalk";
+
+// src/commands/permissions-input.ts
+import { readFileSync as readFileSync2 } from "fs";
+var ITEM_TYPES = {
+  document: "dataroom_document",
+  dataroom_document: "dataroom_document",
+  folder: "dataroom_folder",
+  dataroom_folder: "dataroom_folder"
+};
+function onOff(v, flag, fallback) {
+  if (v === void 0) return fallback;
+  const norm = v.toLowerCase();
+  if (norm === "on") return true;
+  if (norm === "off") return false;
+  throw new Error(
+    `Invalid value for ${flag}: ${JSON.stringify(v)} (expected "on" or "off").`
+  );
+}
+function parsePermissionEntries(opts) {
+  if (opts.file && opts.item) {
+    throw new Error("Pass either --file or --item, not both.");
+  }
+  if (opts.file) {
+    let raw;
+    try {
+      raw = readFileSync2(opts.file, "utf8");
+    } catch (err) {
+      throw new Error(
+        `Could not read ${opts.file}: ${err instanceof Error ? err.message : String(err)}`
+      );
+    }
+    let parsed;
+    try {
+      parsed = JSON.parse(raw);
+    } catch {
+      throw new Error(`${opts.file} is not valid JSON.`);
+    }
+    if (!Array.isArray(parsed)) {
+      throw new Error(
+        `${opts.file} must contain a JSON array of { item_id, item_type, can_view, can_download }.`
+      );
+    }
+    return parsed.map((entry, i) => {
+      const e = entry;
+      const itemType = ITEM_TYPES[String(e.item_type)];
+      if (typeof e.item_id !== "string" || !e.item_id) {
+        throw new Error(`Entry ${i}: missing or invalid item_id.`);
+      }
+      if (!itemType) {
+        throw new Error(
+          `Entry ${i}: invalid item_type ${JSON.stringify(e.item_type)} (expected dataroom_document or dataroom_folder).`
+        );
+      }
+      if (typeof e.can_view !== "boolean" || typeof e.can_download !== "boolean") {
+        throw new Error(`Entry ${i}: can_view and can_download must be booleans.`);
+      }
+      return {
+        item_id: e.item_id,
+        item_type: itemType,
+        can_view: e.can_view,
+        can_download: e.can_download
+      };
+    });
+  }
+  if (opts.item) {
+    const itemType = ITEM_TYPES[String(opts.type ?? "")];
+    if (!itemType) {
+      throw new Error(
+        "Pass --type document or --type folder together with --item."
+      );
+    }
+    return [
+      {
+        item_id: opts.item,
+        item_type: itemType,
+        can_view: onOff(opts.view, "--view", true),
+        can_download: onOff(opts.download, "--download", false)
+      }
+    ];
+  }
+  throw new Error(
+    "Pass --file <path> (JSON array) or --item <id> --type <document|folder> [--view on|off] [--download on|off]."
+  );
+}
+
+// src/commands/datarooms.ts
 function registerDataroomsCommands(program2) {
   const dr = program2.command("datarooms").alias("dr").description("Manage datarooms");
   dr.command("list").description("List datarooms").option("-l, --limit <n>", "max results (1-100)", "25").option("-c, --cursor <id>", "pagination cursor").option("-q, --query <substring>", "filter by dataroom name").option("--json", "output raw JSON (same as --json on the root command)").action(
@@ -1344,6 +1475,249 @@ More results: --cursor ${res.next_cursor}`) : out;
       }
     }
   );
+  const drGroups = dr.command("groups").description(
+    "Manage viewer groups: audiences with per-item permissions, shared via group links"
+  );
+  drGroups.command("list <id>").description("List viewer groups in a dataroom").option("-l, --limit <n>", "max results (1-100)", "25").option("-c, --cursor <id>", "pagination cursor").option("--json", "output raw JSON").action(
+    async (id, opts) => {
+      if (opts.json) setRuntime({ json: true });
+      try {
+        const res = await api.listDataroomGroups(id, {
+          limit: opts.limit ? Number(opts.limit) : void 0,
+          cursor: opts.cursor
+        });
+        emit(res, () => {
+          const rows = res.data.map((g) => ({
+            id: g.id,
+            name: truncate2(g.name, 30),
+            members: String(g.member_count),
+            links: String(g.link_count),
+            domains: truncate2(g.domains.join(","), 30),
+            allow_all: g.allow_all ? "yes" : ""
+          }));
+          const out = table(rows, [
+            "id",
+            "name",
+            "members",
+            "links",
+            "domains",
+            "allow_all"
+          ]);
+          return res.next_cursor ? out + chalk5.dim(`
+
+More results: --cursor ${res.next_cursor}`) : out;
+        });
+      } catch (err) {
+        die(err);
+      }
+    }
+  );
+  drGroups.command("get <id> <gid>").description("Fetch one viewer group").action(async (id, gid) => {
+    try {
+      const g = await api.getDataroomGroup(id, gid);
+      emit(g, () => json(g));
+    } catch (err) {
+      die(err);
+    }
+  });
+  drGroups.command("create <id>").description("Create a viewer group in a dataroom").requiredOption("-n, --name <name>", "group name").option(
+    "--domains <domains>",
+    "comma-separated email domains treated as members (e.g. 'acme.com')"
+  ).option(
+    "--allow-all",
+    "treat anyone passing the link's access gates as a member",
+    false
+  ).action(
+    async (id, opts) => {
+      try {
+        const g = await api.createDataroomGroup(id, {
+          name: opts.name,
+          allow_all: opts.allowAll || void 0,
+          domains: opts.domains ? opts.domains.split(",").map((s) => s.trim()).filter(Boolean) : void 0
+        });
+        emit(
+          g,
+          () => chalk5.green("\u2713") + ` Group created: ${chalk5.bold(g.id)}
+` + json(g)
+        );
+      } catch (err) {
+        die(err);
+      }
+    }
+  );
+  drGroups.command("update <id> <gid>").description("Update a viewer group").option("-n, --name <name>").option(
+    "--domains <domains>",
+    "comma-separated email domains (empty string to clear)"
+  ).option("--allow-all <on|off>", "toggle the allow-anyone flag").action(
+    async (id, gid, opts) => {
+      try {
+        const body = {};
+        if (opts.name !== void 0) body.name = opts.name;
+        if (opts.domains !== void 0)
+          body.domains = opts.domains === "" ? [] : opts.domains.split(",").map((s) => s.trim()).filter(Boolean);
+        if (opts.allowAll !== void 0) {
+          const norm = opts.allowAll.toLowerCase();
+          if (norm !== "on" && norm !== "off") {
+            throw new Error(
+              `Invalid value for --allow-all: ${JSON.stringify(opts.allowAll)} (expected "on" or "off").`
+            );
+          }
+          body.allow_all = norm === "on";
+        }
+        if (Object.keys(body).length === 0) {
+          throw new Error(
+            "Pass at least one of --name, --domains, --allow-all to update."
+          );
+        }
+        const g = await api.updateDataroomGroup(id, gid, body);
+        emit(
+          g,
+          () => chalk5.green("\u2713") + ` Group updated: ${chalk5.bold(g.id)}
+` + json(g)
+        );
+      } catch (err) {
+        die(err);
+      }
+    }
+  );
+  drGroups.command("delete <id> <gid>").description(
+    "Delete a viewer group. WARNING: also deletes every share link pointing at the group \u2014 active group links stop resolving immediately."
+  ).action(async (id, gid) => {
+    try {
+      const deleted = await api.deleteDataroomGroup(id, gid);
+      emit(
+        deleted,
+        () => chalk5.green("\u2713") + ` Group ${gid} deleted (including its share links).`
+      );
+    } catch (err) {
+      die(err);
+    }
+  });
+  const drGroupMembers = drGroups.command("members").description("Manage a group's email members");
+  drGroupMembers.command("list <id> <gid>").description(
+    "List a group's explicit email members (domain/allow-all admissions are not listed)"
+  ).option("-l, --limit <n>", "max results (1-100)", "50").option("-c, --cursor <id>", "pagination cursor").option("--json", "output raw JSON").action(
+    async (id, gid, opts) => {
+      if (opts.json) setRuntime({ json: true });
+      try {
+        const res = await api.listDataroomGroupMembers(id, gid, {
+          limit: opts.limit ? Number(opts.limit) : void 0,
+          cursor: opts.cursor
+        });
+        emit(res, () => {
+          const rows = res.data.map((m) => ({
+            id: m.id,
+            email: sanitizeForTerminal(m.email),
+            added: m.created.slice(0, 10)
+          }));
+          const out = table(rows, ["id", "email", "added"]);
+          return res.next_cursor ? out + chalk5.dim(`
+
+More results: --cursor ${res.next_cursor}`) : out;
+        });
+      } catch (err) {
+        die(err);
+      }
+    }
+  );
+  drGroupMembers.command("add <id> <gid>").description(
+    "Add members by email (idempotent; no invitation emails are sent)"
+  ).requiredOption(
+    "-e, --emails <emails>",
+    "comma-separated email addresses (max 500)"
+  ).action(async (id, gid, opts) => {
+    try {
+      const emails = opts.emails.split(",").map((s) => s.trim()).filter(Boolean);
+      if (emails.length === 0) {
+        throw new Error("Pass at least one email via --emails.");
+      }
+      const res = await api.addDataroomGroupMembers(id, gid, { emails });
+      emit(
+        res,
+        () => chalk5.green("\u2713") + ` ${res.data.length} member(s) in group after add:
+` + table(
+          res.data.map((m) => ({
+            id: m.id,
+            email: sanitizeForTerminal(m.email)
+          })),
+          ["id", "email"]
+        )
+      );
+    } catch (err) {
+      die(err);
+    }
+  });
+  drGroupMembers.command("remove <id> <gid> <mid>").description(
+    "Remove a member by membership id (from `members list`). The viewer itself is kept."
+  ).action(async (id, gid, mid) => {
+    try {
+      const deleted = await api.removeDataroomGroupMember(id, gid, mid);
+      emit(
+        deleted,
+        () => chalk5.green("\u2713") + ` Member ${mid} removed from group.`
+      );
+    } catch (err) {
+      die(err);
+    }
+  });
+  const drGroupPermissions = drGroups.command("permissions").description("Manage a group's per-item view/download permissions");
+  drGroupPermissions.command("get <id> <gid>").description(
+    "List the group's access controls. Items without an entry are invisible to the group."
+  ).option("-l, --limit <n>", "max results (1-100)", "100").option("-c, --cursor <id>", "pagination cursor").option("--json", "output raw JSON").action(
+    async (id, gid, opts) => {
+      if (opts.json) setRuntime({ json: true });
+      try {
+        const res = await api.listDataroomGroupPermissions(id, gid, {
+          limit: opts.limit ? Number(opts.limit) : void 0,
+          cursor: opts.cursor
+        });
+        emit(res, () => {
+          const rows = res.data.map((p) => ({
+            item_id: p.item_id,
+            type: p.item_type === "dataroom_document" ? "document" : "folder",
+            view: p.can_view ? "yes" : "",
+            download: p.can_download ? "yes" : ""
+          }));
+          const out = table(rows, ["item_id", "type", "view", "download"]);
+          return res.next_cursor ? out + chalk5.dim(`
+
+More results: --cursor ${res.next_cursor}`) : out;
+        });
+      } catch (err) {
+        die(err);
+      }
+    }
+  );
+  drGroupPermissions.command("set <id> <gid>").description(
+    "Upsert per-item permissions (delta: omitted items keep their state; ancestor folders of visible items are auto-shown). Item ids come from `datarooms documents` / `datarooms folders list`."
+  ).option(
+    "--file <path>",
+    "JSON array of { item_id, item_type, can_view, can_download }"
+  ).option("--item <itemId>", "single item id (use with --type/--view/--download)").option("--type <document|folder>", "item type for --item").option("--view <on|off>", "allow viewing (default on)").option("--download <on|off>", "allow downloading (default off)").action(
+    async (id, gid, opts) => {
+      try {
+        const permissions = parsePermissionEntries(opts);
+        const res = await api.setDataroomGroupPermissions(id, gid, {
+          permissions
+        });
+        emit(
+          res,
+          () => chalk5.green("\u2713") + ` ${res.data.length} permission row(s) now effective:
+` + table(
+            res.data.map((p) => ({
+              item_id: p.item_id,
+              type: p.item_type === "dataroom_document" ? "document" : "folder",
+              view: p.can_view ? "yes" : "",
+              download: p.can_download ? "yes" : ""
+            })),
+            ["item_id", "type", "view", "download"]
+          )
+        );
+      } catch (err) {
+        die(err);
+      }
+    }
+  );
   const drFolders = dr.command("folders").description("Manage folders inside a dataroom");
   drFolders.command("list <id>").description("List folders in a dataroom").option(
     "--parent <fid>",
@@ -1736,40 +2110,49 @@ More results: --cursor ${res.next_cursor}`) : out;
           create_link: opts.link ?? false
         });
         spinner.succeed(`Document created: ${chalk7.bold(doc.id)}`);
-        let link = null;
-        let linkWarning = null;
-        if (opts.link) {
-          try {
-            const links = await api.listLinks({
-              document_id: doc.id,
-              limit: 1
-            });
-            link = links.data[0] ?? null;
-            if (!link) {
-              linkWarning = "--link was set but no link was returned. Try `papermark links list --document " + doc.id + "`.";
-            }
-          } catch (warnErr) {
-            linkWarning = `Document created, but listing the share link failed: ${warnErr instanceof Error ? warnErr.message : String(warnErr)}`;
-          }
-          if (linkWarning) {
-            process.stderr.write(chalk7.yellow("! ") + linkWarning + "\n");
-          }
-        }
-        emit({ document: doc, link }, () => {
-          const blocks = [json(doc)];
-          if (link) {
-            blocks.push(
-              chalk7.green("\u2713") + " Share link: " + chalk7.bold(link.url)
-            );
-          }
-          return blocks.join("\n");
-        });
+        await finalizeDocumentCreation(doc, opts.link ?? false);
       } catch (err) {
         spinner.fail();
         die(err);
       }
     }
   );
+  docs.command("create-link <url>").description(
+    "Create a document that points to an external URL (no file upload)"
+  ).requiredOption("-n, --name <name>", "document name").option("--link", "also create a default share link for this document").option("--folder-id <id>", "place in folder by id").action(
+    async (url, opts) => {
+      try {
+        const doc = await api.createDocument({
+          name: opts.name,
+          type: "link",
+          external_url: url,
+          folder_id: opts.folderId,
+          create_link: opts.link ?? false
+        });
+        await finalizeDocumentCreation(doc, opts.link ?? false);
+      } catch (err) {
+        die(err);
+      }
+    }
+  );
+  docs.command("create-notion <url>").description(
+    "Create a document from a public Notion page URL (no file upload)"
+  ).requiredOption("-n, --name <name>", "document name").option("--link", "also create a default share link for this document").option("--folder-id <id>", "place in folder by id").action(
+    async (url, opts) => {
+      try {
+        const doc = await api.createDocument({
+          name: opts.name,
+          type: "notion",
+          external_url: url,
+          folder_id: opts.folderId,
+          create_link: opts.link ?? false
+        });
+        await finalizeDocumentCreation(doc, opts.link ?? false);
+      } catch (err) {
+        die(err);
+      }
+    }
+  );
   const versions = docs.command("versions").description("Manage document versions");
   versions.command("list <id>").description("List versions of a document, primary first").option("--json", "output raw JSON").action(async (id, opts) => {
     if (opts.json) setRuntime({ json: true });
@@ -1848,6 +2231,32 @@ More results: --cursor ${res.next_cursor}`) : out;
       die(err);
     }
   });
+  versions.command("add-link <id> <url>").description("Repoint a link document at a new URL (adds a new version)").action(async (id, url) => {
+    try {
+      const v = await api.addDocumentVersion(id, { external_url: url });
+      emit(
+        v,
+        () => chalk7.green("\u2713") + ` Version ${v.version_number} added: ${chalk7.bold(v.id)}
+` + json(v)
+      );
+    } catch (err) {
+      die(err);
+    }
+  });
+  versions.command("add-notion <id> <url>").description(
+    "Repoint a notion document at a new Notion page URL (adds a new version)"
+  ).action(async (id, url) => {
+    try {
+      const v = await api.addDocumentVersion(id, { external_url: url });
+      emit(
+        v,
+        () => chalk7.green("\u2713") + ` Version ${v.version_number} added: ${chalk7.bold(v.id)}
+` + json(v)
+      );
+    } catch (err) {
+      die(err);
+    }
+  });
   versions.command("promote <id> <vid>").description("Promote a version to primary").action(async (id, vid) => {
     try {
       const v = await api.promoteDocumentVersion(id, vid);
@@ -1861,6 +2270,31 @@ More results: --cursor ${res.next_cursor}`) : out;
     }
   });
 }
+async function finalizeDocumentCreation(doc, wantLink) {
+  let link = null;
+  let linkWarning = null;
+  if (wantLink) {
+    try {
+      const links = await api.listLinks({ document_id: doc.id, limit: 1 });
+      link = links.data[0] ?? null;
+      if (!link) {
+        linkWarning = "--link was set but no link was returned. Try `papermark links list --document " + doc.id + "`.";
+      }
+    } catch (warnErr) {
+      linkWarning = `Document created, but listing the share link failed: ${warnErr instanceof Error ? warnErr.message : String(warnErr)}`;
+    }
+    if (linkWarning) {
+      process.stderr.write(chalk7.yellow("! ") + linkWarning + "\n");
+    }
+  }
+  emit({ document: doc, link }, () => {
+    const blocks = [json(doc)];
+    if (link) {
+      blocks.push(chalk7.green("\u2713") + " Share link: " + chalk7.bold(link.url));
+    }
+    return blocks.join("\n");
+  });
+}
 function truncate3(s, n) {
   const clean = sanitizeForTerminal(s);
   return clean.length > n ? clean.slice(0, n - 1) + "\u2026" : clean;
@@ -2104,7 +2538,7 @@ function addWatermarkOptions(cmd) {
 }
 function registerLinksCommands(program2) {
   const links = program2.command("links").description("Manage share links");
-  links.command("list").description("List share links").option("-l, --limit <n>", "max results (1-100)", "25").option("-c, --cursor <id>", "pagination cursor").option("--document <id>", "filter by document id").option("--dataroom <id>", "filter by dataroom id").option("--json", "output raw JSON (same as --json on the root command)").action(
+  links.command("list").description("List share links").option("-l, --limit <n>", "max results (1-100)", "25").option("-c, --cursor <id>", "pagination cursor").option("--document <id>", "filter by document id").option("--dataroom <id>", "filter by dataroom id").option("--group <gid>", "filter by dataroom group id (group links only)").option("--json", "output raw JSON (same as --json on the root command)").action(
     async (opts) => {
       if (opts.json) setRuntime({ json: true });
       try {
@@ -2112,7 +2546,8 @@ function registerLinksCommands(program2) {
           limit: opts.limit ? Number(opts.limit) : void 0,
           cursor: opts.cursor,
           document_id: opts.document,
-          dataroom_id: opts.dataroom
+          dataroom_id: opts.dataroom,
+          group_id: opts.group
         });
         emit(res, () => {
           const rows = res.data.map((l) => ({
@@ -2141,7 +2576,10 @@ More results: --cursor ${res.next_cursor}`) : out;
     }
   });
   addWatermarkOptions(
-    links.command("create").description("Create a share link for a document or dataroom").option("--document <id>", "document id").option("--dataroom <id>", "dataroom id").option("-n, --name <name>", "link name").option("--expires <iso-date>", "expiration date (ISO 8601)").option("--password <pw>", "require a password to view").option("--email-protected", "require email before viewing", false).option("--allow-download", "allow viewer to download the file", false).option(
+    links.command("create").description("Create a share link for a document or dataroom").option("--document <id>", "document id").option("--dataroom <id>", "dataroom id").option(
+      "--group <gid>",
+      "scope to a dataroom group (dataroom links only; forces email protection)"
+    ).option("-n, --name <name>", "link name").option("--expires <iso-date>", "expiration date (ISO 8601)").option("--password <pw>", "require a password to view").option("--email-protected", "require email before viewing", false).option("--allow-download", "allow viewer to download the file", false).option(
       "--confidential-view",
       "reveal only a narrow band of each page at a time; blurs the rest to prevent full-page screenshots",
       false
@@ -2152,11 +2590,16 @@ More results: --cursor ${res.next_cursor}`) : out;
         if (!opts.document && !opts.dataroom) {
           throw new Error("Either --document <id> or --dataroom <id> is required.");
         }
+        if (opts.group && !opts.dataroom) {
+          throw new Error("--group requires --dataroom <id>.");
+        }
         const watermarkConfig = parseWatermarkConfig(opts);
         const enableWatermark = opts.watermark || watermarkConfig !== void 0;
         const link = await api.createLink({
           document_id: opts.document,
           dataroom_id: opts.dataroom,
+          audience_type: opts.group ? "group" : void 0,
+          group_id: opts.group,
           name: opts.name,
           expires_at: opts.expires,
           password: opts.password,
@@ -2176,7 +2619,13 @@ More results: --cursor ${res.next_cursor}`) : out;
     }
   );
   addWatermarkOptions(
-    links.command("update <id>").description("Update an existing share link").option("-n, --name <name>").option("--expires <iso-date>", "expiration date (ISO 8601), or empty string to clear").option("--password <pw>", "set a password (empty string to clear)").option("--email-protected <on|off>").option("--email-authenticated <on|off>").option("--allow-download <on|off>").option(
+    links.command("update <id>").description("Update an existing share link").option(
+      "--audience <general|group>",
+      "switch the link's audience (group links need --group or an existing group)"
+    ).option(
+      "--group <gid>",
+      "dataroom group id (with --audience group, or alone to swap the group of a group link)"
+    ).option("-n, --name <name>").option("--expires <iso-date>", "expiration date (ISO 8601), or empty string to clear").option("--password <pw>", "set a password (empty string to clear)").option("--email-protected <on|off>").option("--email-authenticated <on|off>").option("--allow-download <on|off>").option(
       "--allow-list <items>",
       "comma-separated email/domain allow list (e.g. '@acme.com,bob@x.com')"
     ).option("--deny-list <items>", "comma-separated email/domain deny list").option("--watermark <on|off>", "enable watermark overlay").option("--watermark-clear", "clear the existing watermark config", false).option("--screenshot-protection <on|off>", "blur on screenshot").option(
@@ -2197,6 +2646,16 @@ More results: --cursor ${res.next_cursor}`) : out;
         };
         const list = (v) => v === void 0 ? void 0 : v === "" ? [] : v.split(",").map((s) => s.trim()).filter(Boolean);
         const body = {};
+        if (opts.audience !== void 0) {
+          const norm = opts.audience.toLowerCase();
+          if (norm !== "general" && norm !== "group") {
+            throw new Error(
+              `Invalid value for --audience: ${JSON.stringify(opts.audience)} (expected "general" or "group").`
+            );
+          }
+          body.audience_type = norm;
+        }
+        if (opts.group !== void 0) body.group_id = opts.group;
         if (opts.name !== void 0) body.name = opts.name;
         if (opts.expires !== void 0)
           body.expires_at = opts.expires === "" ? null : opts.expires;
@@ -2257,6 +2716,64 @@ More results: --cursor ${res.next_cursor}`) : out;
       die(err);
     }
   });
+  const linkPermissions = links.command("permissions").description(
+    "Per-item file permissions for dataroom links (ignored on group-audience links \u2014 the group's permissions win)"
+  );
+  linkPermissions.command("get <id>").description("List a dataroom link's per-item permission overrides").option("--json", "output raw JSON").action(async (id, opts) => {
+    if (opts.json) setRuntime({ json: true });
+    try {
+      const res = await api.getLinkPermissions(id);
+      emit(res, () => {
+        if (res.data.length === 0) {
+          return chalk9.dim(
+            "No per-link overrides \u2014 viewers see the full dataroom."
+          );
+        }
+        const rows = res.data.map((p) => ({
+          item_id: p.item_id,
+          type: p.item_type === "dataroom_document" ? "document" : "folder",
+          view: p.can_view ? "yes" : "",
+          download: p.can_download ? "yes" : ""
+        }));
+        return table(rows, ["item_id", "type", "view", "download"]);
+      });
+    } catch (err) {
+      die(err);
+    }
+  });
+  linkPermissions.command("set <id>").description(
+    "Replace a dataroom link's per-item permissions (full replace: items not listed lose their override; --clear removes all overrides and hides every item). Item ids come from `datarooms documents` / `datarooms folders list`."
+  ).option(
+    "--file <path>",
+    "JSON array of { item_id, item_type, can_view, can_download }"
+  ).option("--item <itemId>", "single item id (use with --type/--view/--download)").option("--type <document|folder>", "item type for --item").option("--view <on|off>", "allow viewing (default on)").option("--download <on|off>", "allow downloading (default off)").option("--clear", "remove all overrides (hides every item on this link)", false).action(
+    async (id, opts) => {
+      try {
+        if (opts.clear && (opts.file || opts.item)) {
+          throw new Error("Pass either --clear or permission input, not both.");
+        }
+        const permissions = opts.clear ? [] : parsePermissionEntries(opts);
+        const res = await api.setLinkPermissions(id, { permissions });
+        emit(res, () => {
+          if (res.data.length === 0) {
+            return chalk9.green("\u2713") + " All overrides cleared \u2014 every item on this link is now hidden.";
+          }
+          return chalk9.green("\u2713") + ` ${res.data.length} permission row(s) now effective:
+` + table(
+            res.data.map((p) => ({
+              item_id: p.item_id,
+              type: p.item_type === "dataroom_document" ? "document" : "folder",
+              view: p.can_view ? "yes" : "",
+              download: p.can_download ? "yes" : ""
+            })),
+            ["item_id", "type", "view", "download"]
+          );
+        });
+      } catch (err) {
+        die(err);
+      }
+    }
+  );
 }
 function truncate5(s, n) {
   const clean = sanitizeForTerminal(s);