artifact-site 0.3.0

Comments become a working review loop: comment on a selection, reply with images and mentions,
search discussions, and record which version addressed the feedback — with a personal inbox that
tells you when someone replies. Authorization moves onto database role bindings, the browser can
upload a new version of an existing artifact, and list and preview loading gets substantially
faster.

Upgrading. Stop every instance sharing the database, then deploy this release; 0.2.0 binaries
cannot run against the cleaned authorization schema, and old and new authorization writers must not
run together. See RBAC for the deployment and backup requirements. Migrations run at
startup. No configuration changes are required; two new optional settings are listed below.

Added

• Comment on a selection. Select text in an HTML artifact or a selectable PDF and comment on it,
  with verified citations and file/page labels. Managers composing from the main artifact can choose
  a live, version-compatible share discussion; each destination keeps its own draft, and share
  management links directly to the independent discussion.
• Rich comments. Lightweight links and inline code with a safe preview, plus pasted or uploaded
  image attachments on comments and replies. Image drafts survive reloads, uploads can be retried or
  cancelled individually and show progress, oversized rasters are re-encoded proportionally, and
  image reads are protected by the discussion's own permissions. Abandoned drafts expire after seven
  days and removed attachments are cleaned up.
• Mentions. Permission-checked @mentions in comments, replies and edits, with a
  keyboard-accessible searchable picker, an extensible candidate policy, and mention identities that
  survive drafts and text edits.
• Discussion search and version results. Search comment text and replies within your authorized
  discussions, filter discussions you took part in, and record the version that addressed a
  discussion without moving or auto-resolving the original feedback. Result associations keep
  actor/time audit records and hide inaccessible target versions.
• Notification inbox. Follow discussions — authors and first-time repliers follow automatically,
  explicit unfollows persist — and get a personal in-app inbox for replies and mentions, with
  permission-checked deep links and revocable version-scoped share receipts. Retention is
  configurable (ARTIFACT_NOTIFICATION_RETENTION_DAYS, console-overridable).
• Comments for agents. Read-only comment listing, discussion and context tools in MCP and CLI,
  historical source reads and exports, and an Agent feedback-to-update workflow that revises a site
  in place while preserving its address.
• Authorization on database role bindings. Role catalogs and grants move to permissions,
  roles, role_permissions and role_bindings. Existing tenant administrators and site roles
  migrate at startup. Administration → Authorization and scoped grant editors in Sharing and
  Workspaces offer viewer/commenter/editor/admin roles for named members, own-workspace members and
  global everyone. Disabled accounts are revocable, administrative authorization reads are audited,
  and share-link scope, CLI/MCP identity and immediate revocation are unchanged.
• New version from the browser. One upload panel in the library, the viewer's More menu and
  version history replaces an existing site's contents — HTML, folder/ZIP or document — with
  conflict acknowledgement, and localized quota guidance for new sites and new versions.
• Public page metadata. Open Graph and Twitter cards for the home, Explore and agent-guide
  pages, crawler rules and a marketing-only sitemap. Artifact pages keep their policy-aware share
  cards and stay out of search results.
• CLI and MCP. Personal-folder listing and moves, explicit public-catalog lookup, operator
  identity reporting, and search ownership labelled independently.
• Slow-read diagnostics can be enabled per deployment (ARTIFACT_PERF_LOG_MS); no SQL or
  credentials are logged.

Changed

• Faster lists and previews. Navigation loading states stream in a persistent shell and recent
  routes are reused for 30 seconds; personal lists are paginated with permissions and folder data in
  one response, and the public directory paginates and searches in SQL. Live list thumbnails are
  replaced by metadata covers, with sandboxed previews loading progressively once visible cards stay
  on screen. Permission lookups are deduplicated and abandoned requests are cancelled. The agent
  reference loads on demand with cached rendering. Bundled-proxy response buffering is disabled.
• Sharing settings. New share-link creation sits at the top of both the drawer and the expanded
  view, the editor opens by default, external visit data moves to its own tab beside share links and
  people, and the external-traffic counting rule is explained in an accessible tooltip. Share URLs
  render as single-line truncated links with a separate copy button. Quick audience links, mobile
  quick sharing as a bottom sheet, and account-and-site-scoped private-site guidance replace the
  persistent private-link warning.
• Viewer and header. A compact viewer header around logo, title and version; adaptive collapsed
  controls that blend with the artifact background; header pinning that survives storage failures;
  unified product branding across readers, owners, editors and notification viewers.
• Account menu. Language selection becomes a compact checked submenu, notification-center and
  language entries are added, and the signed-in identity animates into place instead of flashing a
  login entry.
• Comment polling drops from 10 seconds to at most 30, suspends background timers and coalesces
  foreground refreshes.
• CLI JSON compatibility. whoami.tokenStatus now reports unidentified rather than rejected
  for credentials without an identified account, and gains an operator field.
• Site deletion replaces the browser prompt with an accessible confirmation and retryable errors.
• The READMEs present the hosted service as the cloud version hosted by Lexmount alongside
  self-hosting, in all six languages, keeping the anonymous upload and expiry details.
• Retired authorization tables, columns, the old collaborators API and edit-policy controls are
  removed; grant management is /api/authorization/*. Visibility, share links, ownership and
  anonymous management are unchanged.

Fixed

• Parallel uploads and re-uploads preserve file metadata and SHA-256 receipts, keeping entry-page
  detection stable; aggregate limits are enforced against the merged state and retryable contention
  is reported as upload_conflict.
• Pure #fragment links inside hosted artifacts stay same-document: native anchor activation is
  preserved, including event cancellation, stopped propagation, repeated named anchors, keyboard
  focus, nested SVG links and image-map areas. Authored href values are restored before preview
  history handlers run so table-of-contents highlighting still matches.
• Accounts, sites and permissions survive an OIDC subject change for the same verified email
  address; historical duplicates resolve to the earliest account, with migration logging.
• Site action menus stay inside the viewport — flipping above the trigger when needed, scrolling on
  short screens, respecting mobile zoom and the soft keyboard, and restoring keyboard focus on
  dismissal — so bottom-row actions including Delete remain reachable.
• Comment previews, posting and image uploads work on LAN HTTP origins where crypto.randomUUID is
  unavailable.
• Comment result associations made with personal API tokens are attributed to agents, matching OAuth
  attribution and audit records.
• Bundled PDF links open in the sandboxed PDF.js reader while raw downloads and range reads keep
  working.
• Search drafts and view selections survive delayed navigation; directories refresh after publishing
  or copying; pagination keeps working alongside search.
• Keyboard focus returns correctly when closing account menus and leaving discussions; closed visit
  explanations are hidden from assistive technology; aborted view-history and stale identity
  responses are ignored.

Image: ghcr.io/lexmount/artifact-site:0.3.0 (linux/amd64, linux/arm64)
CLI: npm install -g @artifact-site/cli@0.3.0
Upgrade: stop every instance sharing the database first, then git pull --ff-only && make upgrade (or make pull && make up with ARTIFACT_IMAGE=ghcr.io/lexmount/artifact-site:0.3.0).