replicas-engine 0.1.582 → 0.1.583

package/dist/src/index.js

@@ -2110,7 +2110,7 @@ Use public access only when the media must render without Replicas authenticatio
 replicas media upload screenshot.png --name "Login page" --access public
 \`\`\`
 
-\`--share\` remains an alias for \`--access public\`. Public access prints an additional \`Forge embed\` for media or \`Forge link\` for HTML, backed by an opt-in bearer URL. Anyone with that unguessable URL can view the asset until it is rotated or revoked. Use \`replicas media share <media-id>\` to rotate it and \`replicas media revoke <media-id>\` to revoke it.
+\`--share\` remains an alias for \`--access public\`. Public access prints an additional \`Forge embed\` for image, video, or audio media, backed by an opt-in bearer URL. Anyone with that unguessable URL can view the asset until it is rotated or revoked. HTML pages only support organization access. Use \`replicas media share <media-id>\` to rotate a public media URL and \`replicas media revoke <media-id>\` to revoke it.
 
 ## The URLs the CLI gives you \u2014 and where each one is allowed
 
@@ -2118,7 +2118,7 @@ replicas media upload screenshot.png --name "Login page" --access public
 |---|---|---|
 | \`https://api.tryreplicas.com/v1/media/<id>\` (inside \`![\u2026](\u2026)\`) | Authenticated API redirect to a presigned blob \u2014 requires the Replicas chat session | **Only** in the Replicas chat reply. Nowhere else. |
 | \`https://tryreplicas.com/organizations/<organization-id>/media/<media-id>\` | Organization-only page printed by \`--access organization\` | Pull requests and other places where every viewer belongs to the Replicas organization. |
-| \`https://api.tryreplicas.com/v1/media/public/<id>/<token>\` | Opt-in public bearer URL printed by \`--access public\` or \`--share\` | GitHub image embeds and intentionally public HTML page links. |
+| \`https://api.tryreplicas.com/v1/media/public/<id>/<token>\` | Opt-in public bearer URL printed by \`--access public\` or \`--share\` | GitHub embeds for image, video, or audio media. |
 | \`https://tryreplicas.com/workspaces/<workspace-id>?media=<media-id>\` | Authenticated dashboard deep link that opens the media file in the workspace | Everywhere external \u2014 Slack, GitHub, Linear, PR bodies, comments, emails. |
 
 ### NEVER link the API redirect URL outside the Replicas chat reply
@@ -2294,7 +2294,7 @@ GitHub does not reliably render arbitrary external videos as inline players. For
 
 Public forge shares are bearer capabilities. For private repositories, create one only when the user asked for inline PR media. Revoke with \`replicas media revoke <media-id>\` **only** when the user asks or the media should intentionally stop rendering \u2014 never as routine post-task cleanup, since revoking breaks every embed already posted on the PR.
 
-For a self-contained HTML report, upload it with \`--access organization\` and put the printed \`Forge link\` Markdown in the PR body or comment. GitHub cannot render the page inline, so use the normal link rather than image syntax. Use \`--access public\` only when the user explicitly wants unauthenticated access.
+For a self-contained HTML report, upload it with \`--access organization\` and put the printed \`Forge link\` Markdown in the PR body or comment. GitHub cannot render the page inline, so use the normal link rather than image syntax. HTML pages cannot be shared publicly.
 
 Do **not** commit screenshots to the repo, use placeholder URLs, expose the authenticated \`/v1/media/<id>\` URL, or automate GitHub's undocumented browser upload flow.
 
@@ -2344,8 +2344,8 @@ replicas media upload chart-a.svg chart-b.svg --name "Latency chart" --name "Err
 - \`--kind <image|video|audio|html>\` \u2014 override auto-detection
 - \`--name <name>\`: required display name shown in the dashboard, one per file in order
 - \`--session-id <id>\` \u2014 associate the upload with a specific session
-- \`--access organization|public\`: create an organization-only page link or a public bearer URL
-- \`--share\`: alias for \`--access public\`
+- \`--access organization|public\`: create an organization-only link, or a public bearer URL for non-HTML media
+- \`--share\`: alias for \`--access public\`; not supported for HTML
 `;
 var MEDIA_ABILITY = {
   label: "Media",
@@ -5588,6 +5588,7 @@ var MEDIA_KIND = {
   HTML: "html"
 };
 var MEDIA_KINDS = [MEDIA_KIND.IMAGE, MEDIA_KIND.VIDEO, MEDIA_KIND.AUDIO, MEDIA_KIND.HTML];
+var PUBLIC_MEDIA_KINDS = [MEDIA_KIND.IMAGE, MEDIA_KIND.VIDEO, MEDIA_KIND.AUDIO];
 var MAX_ENGINE_LOG_BYTES = 50 * 1024 * 1024;
 
 // ../shared/src/skill-registry.ts
@@ -11006,7 +11007,7 @@ var DEFAULT_CODEX_ARGS = ["app-server", "--listen", "stdio://"];
 var MIN_CODEX_CLI_VERSION = "0.144.6";
 var CODEX_UPGRADE_TIMEOUT_MS = 12e4;
 var codexCliVersionEnsured = null;
-var ENGINE_PACKAGE_VERSION = "0.1.582";
+var ENGINE_PACKAGE_VERSION = "0.1.583";
 var INITIALIZE_METHOD = "initialize";
 var INITIALIZED_NOTIFICATION = "initialized";
 var ACCOUNT_LOGIN_START_METHOD = "account/login/start";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "replicas-engine",
-  "version": "0.1.582",
+  "version": "0.1.583",
   "description": "Lightweight API server for Replicas workspaces",
   "type": "module",
   "main": "dist/src/index.js",