v1.3.0 — Private-doc feedback + teammate commands

Added

Feedback on password-protected docs — push --feedback --password <pw> now injects the annotation widget before encryption, so a private (AES-encrypted) doc shows the widget once the viewer decrypts. The Worker never receives the plaintext; the review link is the password-gated URL.

Agent-native teammate commands (no document ownership needed — for teammates and their Claude/Codex sessions):

• htmldrop feedback read <docId|url> [--json] — read feedback for any doc by id or link (public; no author key, no manifest)
• htmldrop feedback add [file] --doc-id <id|url> — comment on a doc you didn't publish
• htmldrop fetch <url> [--password <pw>] [--out <file>] — fetch + decrypt a doc so an agent can read/analyze the content

Roles

Formalizes the two-role model: reviewers (anyone with the link) read + comment via public endpoints; owners (author-key holder) also converge and clear. No Worker change required — endpoints already supported public read/comment. auth.md remains the forward path for cross-machine identity/roles.

Install

npm install -g @yeefeiooi/htmldrop@latest

See CHANGELOG.md.