papermark 0.7.0 → 0.9.0

package/dist/index.js

@@ -269,6 +269,13 @@ var api = {
   createLink: (body) => request("/v1/links", { method: "POST", body }),
   updateLink: (id, body) => request(`/v1/links/${id}`, { method: "PATCH", body }),
   deleteLink: (id) => request(`/v1/links/${id}`, { method: "DELETE" }),
+  getLinkPermissions: (id) => request(`/v1/links/${id}/permissions`),
+  // Full-replace semantics: the payload is the complete desired state;
+  // items not listed lose their override.
+  setLinkPermissions: (id, body) => request(`/v1/links/${id}/permissions`, {
+    method: "PUT",
+    body
+  }),
   // Views
   listViews: (linkId, query) => request(`/v1/links/${linkId}/views`, { query }),
   // Datarooms
@@ -308,6 +315,44 @@ var api = {
     method: "POST",
     body
   }),
+  // Dataroom groups
+  listDataroomGroups: (id, query) => request(`/v1/datarooms/${id}/groups`, { query }),
+  createDataroomGroup: (id, body) => request(`/v1/datarooms/${id}/groups`, {
+    method: "POST",
+    body
+  }),
+  getDataroomGroup: (id, gid) => request(`/v1/datarooms/${id}/groups/${gid}`),
+  updateDataroomGroup: (id, gid, body) => request(`/v1/datarooms/${id}/groups/${gid}`, {
+    method: "PATCH",
+    body
+  }),
+  // Also deletes every share link pointing at the group (matching the
+  // dashboard).
+  deleteDataroomGroup: (id, gid) => request(`/v1/datarooms/${id}/groups/${gid}`, {
+    method: "DELETE"
+  }),
+  listDataroomGroupMembers: (id, gid, query) => request(
+    `/v1/datarooms/${id}/groups/${gid}/members`,
+    { query }
+  ),
+  addDataroomGroupMembers: (id, gid, body) => request(
+    `/v1/datarooms/${id}/groups/${gid}/members`,
+    { method: "POST", body }
+  ),
+  removeDataroomGroupMember: (id, gid, mid) => request(
+    `/v1/datarooms/${id}/groups/${gid}/members/${mid}`,
+    { method: "DELETE" }
+  ),
+  listDataroomGroupPermissions: (id, gid, query) => request(
+    `/v1/datarooms/${id}/groups/${gid}/permissions`,
+    { query }
+  ),
+  // Upsert-delta semantics: entries sent are upserted, entries omitted keep
+  // their current state; ancestor folders of visible items are auto-shown.
+  setDataroomGroupPermissions: (id, gid, body) => request(
+    `/v1/datarooms/${id}/groups/${gid}/permissions`,
+    { method: "PUT", body }
+  ),
   // Visitors
   listVisitors: (query) => request("/v1/visitors", { query }),
   getVisitor: (id) => request(`/v1/visitors/${id}`),
@@ -1073,6 +1118,92 @@ function registerConfigCommands(program2) {
 
 // src/commands/datarooms.ts
 import chalk5 from "chalk";
+
+// src/commands/permissions-input.ts
+import { readFileSync as readFileSync2 } from "fs";
+var ITEM_TYPES = {
+  document: "dataroom_document",
+  dataroom_document: "dataroom_document",
+  folder: "dataroom_folder",
+  dataroom_folder: "dataroom_folder"
+};
+function onOff(v, flag, fallback) {
+  if (v === void 0) return fallback;
+  const norm = v.toLowerCase();
+  if (norm === "on") return true;
+  if (norm === "off") return false;
+  throw new Error(
+    `Invalid value for ${flag}: ${JSON.stringify(v)} (expected "on" or "off").`
+  );
+}
+function parsePermissionEntries(opts) {
+  if (opts.file && opts.item) {
+    throw new Error("Pass either --file or --item, not both.");
+  }
+  if (opts.file) {
+    let raw;
+    try {
+      raw = readFileSync2(opts.file, "utf8");
+    } catch (err) {
+      throw new Error(
+        `Could not read ${opts.file}: ${err instanceof Error ? err.message : String(err)}`
+      );
+    }
+    let parsed;
+    try {
+      parsed = JSON.parse(raw);
+    } catch {
+      throw new Error(`${opts.file} is not valid JSON.`);
+    }
+    if (!Array.isArray(parsed)) {
+      throw new Error(
+        `${opts.file} must contain a JSON array of { item_id, item_type, can_view, can_download }.`
+      );
+    }
+    return parsed.map((entry, i) => {
+      const e = entry;
+      const itemType = ITEM_TYPES[String(e.item_type)];
+      if (typeof e.item_id !== "string" || !e.item_id) {
+        throw new Error(`Entry ${i}: missing or invalid item_id.`);
+      }
+      if (!itemType) {
+        throw new Error(
+          `Entry ${i}: invalid item_type ${JSON.stringify(e.item_type)} (expected dataroom_document or dataroom_folder).`
+        );
+      }
+      if (typeof e.can_view !== "boolean" || typeof e.can_download !== "boolean") {
+        throw new Error(`Entry ${i}: can_view and can_download must be booleans.`);
+      }
+      return {
+        item_id: e.item_id,
+        item_type: itemType,
+        can_view: e.can_view,
+        can_download: e.can_download
+      };
+    });
+  }
+  if (opts.item) {
+    const itemType = ITEM_TYPES[String(opts.type ?? "")];
+    if (!itemType) {
+      throw new Error(
+        "Pass --type document or --type folder together with --item."
+      );
+    }
+    return [
+      {
+        item_id: opts.item,
+        item_type: itemType,
+        can_view: onOff(opts.view, "--view", true),
+        can_download: onOff(opts.download, "--download", false)
+      }
+    ];
+  }
+  throw new Error(
+    "Pass --file <path> (JSON array) or --item <id> --type <document|folder> [--view on|off] [--download on|off]."
+  );
+}
+
+// src/commands/datarooms.ts
 function registerDataroomsCommands(program2) {
   const dr = program2.command("datarooms").alias("dr").description("Manage datarooms");
   dr.command("list").description("List datarooms").option("-l, --limit <n>", "max results (1-100)", "25").option("-c, --cursor <id>", "pagination cursor").option("-q, --query <substring>", "filter by dataroom name").option("--json", "output raw JSON (same as --json on the root command)").action(
@@ -1344,6 +1475,249 @@ More results: --cursor ${res.next_cursor}`) : out;
       }
     }
   );
+  const drGroups = dr.command("groups").description(
+    "Manage viewer groups: audiences with per-item permissions, shared via group links"
+  );
+  drGroups.command("list <id>").description("List viewer groups in a dataroom").option("-l, --limit <n>", "max results (1-100)", "25").option("-c, --cursor <id>", "pagination cursor").option("--json", "output raw JSON").action(
+    async (id, opts) => {
+      if (opts.json) setRuntime({ json: true });
+      try {
+        const res = await api.listDataroomGroups(id, {
+          limit: opts.limit ? Number(opts.limit) : void 0,
+          cursor: opts.cursor
+        });
+        emit(res, () => {
+          const rows = res.data.map((g) => ({
+            id: g.id,
+            name: truncate2(g.name, 30),
+            members: String(g.member_count),
+            links: String(g.link_count),
+            domains: truncate2(g.domains.join(","), 30),
+            allow_all: g.allow_all ? "yes" : ""
+          }));
+          const out = table(rows, [
+            "id",
+            "name",
+            "members",
+            "links",
+            "domains",
+            "allow_all"
+          ]);
+          return res.next_cursor ? out + chalk5.dim(`
+
+More results: --cursor ${res.next_cursor}`) : out;
+        });
+      } catch (err) {
+        die(err);
+      }
+    }
+  );
+  drGroups.command("get <id> <gid>").description("Fetch one viewer group").action(async (id, gid) => {
+    try {
+      const g = await api.getDataroomGroup(id, gid);
+      emit(g, () => json(g));
+    } catch (err) {
+      die(err);
+    }
+  });
+  drGroups.command("create <id>").description("Create a viewer group in a dataroom").requiredOption("-n, --name <name>", "group name").option(
+    "--domains <domains>",
+    "comma-separated email domains treated as members (e.g. 'acme.com')"
+  ).option(
+    "--allow-all",
+    "treat anyone passing the link's access gates as a member",
+    false
+  ).action(
+    async (id, opts) => {
+      try {
+        const g = await api.createDataroomGroup(id, {
+          name: opts.name,
+          allow_all: opts.allowAll || void 0,
+          domains: opts.domains ? opts.domains.split(",").map((s) => s.trim()).filter(Boolean) : void 0
+        });
+        emit(
+          g,
+          () => chalk5.green("\u2713") + ` Group created: ${chalk5.bold(g.id)}
+` + json(g)
+        );
+      } catch (err) {
+        die(err);
+      }
+    }
+  );
+  drGroups.command("update <id> <gid>").description("Update a viewer group").option("-n, --name <name>").option(
+    "--domains <domains>",
+    "comma-separated email domains (empty string to clear)"
+  ).option("--allow-all <on|off>", "toggle the allow-anyone flag").action(
+    async (id, gid, opts) => {
+      try {
+        const body = {};
+        if (opts.name !== void 0) body.name = opts.name;
+        if (opts.domains !== void 0)
+          body.domains = opts.domains === "" ? [] : opts.domains.split(",").map((s) => s.trim()).filter(Boolean);
+        if (opts.allowAll !== void 0) {
+          const norm = opts.allowAll.toLowerCase();
+          if (norm !== "on" && norm !== "off") {
+            throw new Error(
+              `Invalid value for --allow-all: ${JSON.stringify(opts.allowAll)} (expected "on" or "off").`
+            );
+          }
+          body.allow_all = norm === "on";
+        }
+        if (Object.keys(body).length === 0) {
+          throw new Error(
+            "Pass at least one of --name, --domains, --allow-all to update."
+          );
+        }
+        const g = await api.updateDataroomGroup(id, gid, body);
+        emit(
+          g,
+          () => chalk5.green("\u2713") + ` Group updated: ${chalk5.bold(g.id)}
+` + json(g)
+        );
+      } catch (err) {
+        die(err);
+      }
+    }
+  );
+  drGroups.command("delete <id> <gid>").description(
+    "Delete a viewer group. WARNING: also deletes every share link pointing at the group \u2014 active group links stop resolving immediately."
+  ).action(async (id, gid) => {
+    try {
+      const deleted = await api.deleteDataroomGroup(id, gid);
+      emit(
+        deleted,
+        () => chalk5.green("\u2713") + ` Group ${gid} deleted (including its share links).`
+      );
+    } catch (err) {
+      die(err);
+    }
+  });
+  const drGroupMembers = drGroups.command("members").description("Manage a group's email members");
+  drGroupMembers.command("list <id> <gid>").description(
+    "List a group's explicit email members (domain/allow-all admissions are not listed)"
+  ).option("-l, --limit <n>", "max results (1-100)", "50").option("-c, --cursor <id>", "pagination cursor").option("--json", "output raw JSON").action(
+    async (id, gid, opts) => {
+      if (opts.json) setRuntime({ json: true });
+      try {
+        const res = await api.listDataroomGroupMembers(id, gid, {
+          limit: opts.limit ? Number(opts.limit) : void 0,
+          cursor: opts.cursor
+        });
+        emit(res, () => {
+          const rows = res.data.map((m) => ({
+            id: m.id,
+            email: sanitizeForTerminal(m.email),
+            added: m.created.slice(0, 10)
+          }));
+          const out = table(rows, ["id", "email", "added"]);
+          return res.next_cursor ? out + chalk5.dim(`
+
+More results: --cursor ${res.next_cursor}`) : out;
+        });
+      } catch (err) {
+        die(err);
+      }
+    }
+  );
+  drGroupMembers.command("add <id> <gid>").description(
+    "Add members by email (idempotent; no invitation emails are sent)"
+  ).requiredOption(
+    "-e, --emails <emails>",
+    "comma-separated email addresses (max 500)"
+  ).action(async (id, gid, opts) => {
+    try {
+      const emails = opts.emails.split(",").map((s) => s.trim()).filter(Boolean);
+      if (emails.length === 0) {
+        throw new Error("Pass at least one email via --emails.");
+      }
+      const res = await api.addDataroomGroupMembers(id, gid, { emails });
+      emit(
+        res,
+        () => chalk5.green("\u2713") + ` ${res.data.length} member(s) in group after add:
+` + table(
+          res.data.map((m) => ({
+            id: m.id,
+            email: sanitizeForTerminal(m.email)
+          })),
+          ["id", "email"]
+        )
+      );
+    } catch (err) {
+      die(err);
+    }
+  });
+  drGroupMembers.command("remove <id> <gid> <mid>").description(
+    "Remove a member by membership id (from `members list`). The viewer itself is kept."
+  ).action(async (id, gid, mid) => {
+    try {
+      const deleted = await api.removeDataroomGroupMember(id, gid, mid);
+      emit(
+        deleted,
+        () => chalk5.green("\u2713") + ` Member ${mid} removed from group.`
+      );
+    } catch (err) {
+      die(err);
+    }
+  });
+  const drGroupPermissions = drGroups.command("permissions").description("Manage a group's per-item view/download permissions");
+  drGroupPermissions.command("get <id> <gid>").description(
+    "List the group's access controls. Items without an entry are invisible to the group."
+  ).option("-l, --limit <n>", "max results (1-100)", "100").option("-c, --cursor <id>", "pagination cursor").option("--json", "output raw JSON").action(
+    async (id, gid, opts) => {
+      if (opts.json) setRuntime({ json: true });
+      try {
+        const res = await api.listDataroomGroupPermissions(id, gid, {
+          limit: opts.limit ? Number(opts.limit) : void 0,
+          cursor: opts.cursor
+        });
+        emit(res, () => {
+          const rows = res.data.map((p) => ({
+            item_id: p.item_id,
+            type: p.item_type === "dataroom_document" ? "document" : "folder",
+            view: p.can_view ? "yes" : "",
+            download: p.can_download ? "yes" : ""
+          }));
+          const out = table(rows, ["item_id", "type", "view", "download"]);
+          return res.next_cursor ? out + chalk5.dim(`
+
+More results: --cursor ${res.next_cursor}`) : out;
+        });
+      } catch (err) {
+        die(err);
+      }
+    }
+  );
+  drGroupPermissions.command("set <id> <gid>").description(
+    "Upsert per-item permissions (delta: omitted items keep their state; ancestor folders of visible items are auto-shown). Item ids come from `datarooms documents` / `datarooms folders list`."
+  ).option(
+    "--file <path>",
+    "JSON array of { item_id, item_type, can_view, can_download }"
+  ).option("--item <itemId>", "single item id (use with --type/--view/--download)").option("--type <document|folder>", "item type for --item").option("--view <on|off>", "allow viewing (default on)").option("--download <on|off>", "allow downloading (default off)").action(
+    async (id, gid, opts) => {
+      try {
+        const permissions = parsePermissionEntries(opts);
+        const res = await api.setDataroomGroupPermissions(id, gid, {
+          permissions
+        });
+        emit(
+          res,
+          () => chalk5.green("\u2713") + ` ${res.data.length} permission row(s) now effective:
+` + table(
+            res.data.map((p) => ({
+              item_id: p.item_id,
+              type: p.item_type === "dataroom_document" ? "document" : "folder",
+              view: p.can_view ? "yes" : "",
+              download: p.can_download ? "yes" : ""
+            })),
+            ["item_id", "type", "view", "download"]
+          )
+        );
+      } catch (err) {
+        die(err);
+      }
+    }
+  );
   const drFolders = dr.command("folders").description("Manage folders inside a dataroom");
   drFolders.command("list <id>").description("List folders in a dataroom").option(
     "--parent <fid>",
@@ -2164,7 +2538,7 @@ function addWatermarkOptions(cmd) {
 }
 function registerLinksCommands(program2) {
   const links = program2.command("links").description("Manage share links");
-  links.command("list").description("List share links").option("-l, --limit <n>", "max results (1-100)", "25").option("-c, --cursor <id>", "pagination cursor").option("--document <id>", "filter by document id").option("--dataroom <id>", "filter by dataroom id").option("--json", "output raw JSON (same as --json on the root command)").action(
+  links.command("list").description("List share links").option("-l, --limit <n>", "max results (1-100)", "25").option("-c, --cursor <id>", "pagination cursor").option("--document <id>", "filter by document id").option("--dataroom <id>", "filter by dataroom id").option("--group <gid>", "filter by dataroom group id (group links only)").option("--json", "output raw JSON (same as --json on the root command)").action(
     async (opts) => {
       if (opts.json) setRuntime({ json: true });
       try {
@@ -2172,7 +2546,8 @@ function registerLinksCommands(program2) {
           limit: opts.limit ? Number(opts.limit) : void 0,
           cursor: opts.cursor,
           document_id: opts.document,
-          dataroom_id: opts.dataroom
+          dataroom_id: opts.dataroom,
+          group_id: opts.group
         });
         emit(res, () => {
           const rows = res.data.map((l) => ({
@@ -2201,30 +2576,69 @@ More results: --cursor ${res.next_cursor}`) : out;
     }
   });
   addWatermarkOptions(
-    links.command("create").description("Create a share link for a document or dataroom").option("--document <id>", "document id").option("--dataroom <id>", "dataroom id").option("-n, --name <name>", "link name").option("--expires <iso-date>", "expiration date (ISO 8601)").option("--password <pw>", "require a password to view").option("--email-protected", "require email before viewing", false).option("--allow-download", "allow viewer to download the file", false).option(
+    links.command("create").description("Create a share link for a document or dataroom").option("--document <id>", "document id").option("--dataroom <id>", "dataroom id").option(
+      "--group <gid>",
+      "scope to a dataroom group (dataroom links only; forces email protection)"
+    ).option("-n, --name <name>", "link name").option("--expires <iso-date>", "expiration date (ISO 8601)").option("--password <pw>", "require a password to view").option("--email-protected", "require email before viewing", false).option(
+      "--email-authenticated",
+      "require viewers to verify their email via a one-time code",
+      false
+    ).option("--allow-download", "allow viewer to download the file", false).option(
+      "--allow-list <items>",
+      "comma-separated email/domain allow list (e.g. '@acme.com,bob@x.com')"
+    ).option("--deny-list <items>", "comma-separated email/domain deny list").option(
       "--confidential-view",
       "reveal only a narrow band of each page at a time; blurs the rest to prevent full-page screenshots",
       false
-    ).option("--watermark", "enable watermark overlay (use with --watermark-*)", false)
+    ).option("--watermark", "enable watermark overlay (use with --watermark-*)", false).option(
+      "--screenshot-protection",
+      "block common screenshot/screen-recording shortcuts",
+      false
+    ).option(
+      "--agreement <id>",
+      "require viewers to accept this agreement (NDA) before viewing"
+    ).option(
+      "--domain <domain>",
+      "verified custom domain to host the link on (requires --slug and a plan that supports custom domains)"
+    ).option(
+      "--slug <slug>",
+      "path segment on the custom domain (requires --domain)"
+    )
   ).action(
     async (opts) => {
       try {
         if (!opts.document && !opts.dataroom) {
           throw new Error("Either --document <id> or --dataroom <id> is required.");
         }
+        if (opts.group && !opts.dataroom) {
+          throw new Error("--group requires --dataroom <id>.");
+        }
+        const list = (v) => v === void 0 ? void 0 : v === "" ? [] : v.split(",").map((s) => s.trim()).filter(Boolean);
         const watermarkConfig = parseWatermarkConfig(opts);
         const enableWatermark = opts.watermark || watermarkConfig !== void 0;
         const link = await api.createLink({
           document_id: opts.document,
           dataroom_id: opts.dataroom,
+          audience_type: opts.group ? "group" : void 0,
+          group_id: opts.group,
           name: opts.name,
           expires_at: opts.expires,
           password: opts.password,
           email_protected: opts.emailProtected,
+          email_authenticated: opts.emailAuthenticated,
           allow_download: opts.allowDownload,
+          allow_list: list(opts.allowList),
+          deny_list: list(opts.denyList),
           enable_confidential_view: opts.confidentialView,
           enable_watermark: enableWatermark || void 0,
-          watermark_config: watermarkConfig
+          watermark_config: watermarkConfig,
+          enable_screenshot_protection: opts.screenshotProtection,
+          // A single --agreement <id> both enables the gate and sets the id,
+          // mirroring how --group implies audience_type=group.
+          enable_agreement: opts.agreement ? true : void 0,
+          agreement_id: opts.agreement,
+          domain: opts.domain,
+          slug: opts.slug
         });
         emit(
           link,
@@ -2236,13 +2650,25 @@ More results: --cursor ${res.next_cursor}`) : out;
     }
   );
   addWatermarkOptions(
-    links.command("update <id>").description("Update an existing share link").option("-n, --name <name>").option("--expires <iso-date>", "expiration date (ISO 8601), or empty string to clear").option("--password <pw>", "set a password (empty string to clear)").option("--email-protected <on|off>").option("--email-authenticated <on|off>").option("--allow-download <on|off>").option(
+    links.command("update <id>").description("Update an existing share link").option(
+      "--audience <general|group>",
+      "switch the link's audience (group links need --group or an existing group)"
+    ).option(
+      "--group <gid>",
+      "dataroom group id (with --audience group, or alone to swap the group of a group link)"
+    ).option("-n, --name <name>").option("--expires <iso-date>", "expiration date (ISO 8601), or empty string to clear").option("--password <pw>", "set a password (empty string to clear)").option("--email-protected <on|off>").option("--email-authenticated <on|off>").option("--allow-download <on|off>").option(
       "--allow-list <items>",
       "comma-separated email/domain allow list (e.g. '@acme.com,bob@x.com')"
     ).option("--deny-list <items>", "comma-separated email/domain deny list").option("--watermark <on|off>", "enable watermark overlay").option("--watermark-clear", "clear the existing watermark config", false).option("--screenshot-protection <on|off>", "blur on screenshot").option(
       "--confidential-view <on|off>",
       "reveal only a narrow band of each page at a time; blurs the rest to prevent full-page screenshots"
-    )
+    ).option("--enable-agreement <on|off>", "require viewers to accept an agreement (NDA)").option(
+      "--agreement-id <id>",
+      "agreement (NDA) id viewers must accept, or empty string to clear"
+    ).option(
+      "--domain <domain>",
+      "verified custom domain to host the link on (with --slug); pass 'papermark.com' to reset to the default domain"
+    ).option("--slug <slug>", "path segment on the custom domain (with --domain)")
   ).action(
     async (id, opts) => {
       try {
@@ -2257,6 +2683,16 @@ More results: --cursor ${res.next_cursor}`) : out;
         };
         const list = (v) => v === void 0 ? void 0 : v === "" ? [] : v.split(",").map((s) => s.trim()).filter(Boolean);
         const body = {};
+        if (opts.audience !== void 0) {
+          const norm = opts.audience.toLowerCase();
+          if (norm !== "general" && norm !== "group") {
+            throw new Error(
+              `Invalid value for --audience: ${JSON.stringify(opts.audience)} (expected "general" or "group").`
+            );
+          }
+          body.audience_type = norm;
+        }
+        if (opts.group !== void 0) body.group_id = opts.group;
         if (opts.name !== void 0) body.name = opts.name;
         if (opts.expires !== void 0)
           body.expires_at = opts.expires === "" ? null : opts.expires;
@@ -2290,6 +2726,12 @@ More results: --cursor ${res.next_cursor}`) : out;
         if (sp !== void 0) body.enable_screenshot_protection = sp;
         const cv = tri(opts.confidentialView, "--confidential-view");
         if (cv !== void 0) body.enable_confidential_view = cv;
+        const ag = tri(opts.enableAgreement, "--enable-agreement");
+        if (ag !== void 0) body.enable_agreement = ag;
+        if (opts.agreementId !== void 0)
+          body.agreement_id = opts.agreementId === "" ? null : opts.agreementId;
+        if (opts.domain !== void 0) body.domain = opts.domain;
+        if (opts.slug !== void 0) body.slug = opts.slug;
         if (Object.keys(body).length === 0) {
           throw new Error(
             "Pass at least one field to update (e.g. --name, --expires, --password)."
@@ -2317,6 +2759,64 @@ More results: --cursor ${res.next_cursor}`) : out;
       die(err);
     }
   });
+  const linkPermissions = links.command("permissions").description(
+    "Per-item file permissions for dataroom links (ignored on group-audience links \u2014 the group's permissions win)"
+  );
+  linkPermissions.command("get <id>").description("List a dataroom link's per-item permission overrides").option("--json", "output raw JSON").action(async (id, opts) => {
+    if (opts.json) setRuntime({ json: true });
+    try {
+      const res = await api.getLinkPermissions(id);
+      emit(res, () => {
+        if (res.data.length === 0) {
+          return chalk9.dim(
+            "No per-link overrides \u2014 viewers see the full dataroom."
+          );
+        }
+        const rows = res.data.map((p) => ({
+          item_id: p.item_id,
+          type: p.item_type === "dataroom_document" ? "document" : "folder",
+          view: p.can_view ? "yes" : "",
+          download: p.can_download ? "yes" : ""
+        }));
+        return table(rows, ["item_id", "type", "view", "download"]);
+      });
+    } catch (err) {
+      die(err);
+    }
+  });
+  linkPermissions.command("set <id>").description(
+    "Replace a dataroom link's per-item permissions (full replace: items not listed lose their override; --clear removes all overrides and hides every item). Item ids come from `datarooms documents` / `datarooms folders list`."
+  ).option(
+    "--file <path>",
+    "JSON array of { item_id, item_type, can_view, can_download }"
+  ).option("--item <itemId>", "single item id (use with --type/--view/--download)").option("--type <document|folder>", "item type for --item").option("--view <on|off>", "allow viewing (default on)").option("--download <on|off>", "allow downloading (default off)").option("--clear", "remove all overrides (hides every item on this link)", false).action(
+    async (id, opts) => {
+      try {
+        if (opts.clear && (opts.file || opts.item)) {
+          throw new Error("Pass either --clear or permission input, not both.");
+        }
+        const permissions = opts.clear ? [] : parsePermissionEntries(opts);
+        const res = await api.setLinkPermissions(id, { permissions });
+        emit(res, () => {
+          if (res.data.length === 0) {
+            return chalk9.green("\u2713") + " All overrides cleared \u2014 every item on this link is now hidden.";
+          }
+          return chalk9.green("\u2713") + ` ${res.data.length} permission row(s) now effective:
+` + table(
+            res.data.map((p) => ({
+              item_id: p.item_id,
+              type: p.item_type === "dataroom_document" ? "document" : "folder",
+              view: p.can_view ? "yes" : "",
+              download: p.can_download ? "yes" : ""
+            })),
+            ["item_id", "type", "view", "download"]
+          );
+        });
+      } catch (err) {
+        die(err);
+      }
+    }
+  );
 }
 function truncate5(s, n) {
   const clean = sanitizeForTerminal(s);