@displaydev/cli 0.1.0 → 0.2.0

package/README.md

@@ -0,0 +1,60 @@
+# @displaydev/cli
+
+CLI for [display.dev](https://display.dev) — publish HTML and Markdown behind company auth.
+
+## Install
+
+```bash
+npm install -g @displaydev/cli
+```
+
+## Authenticate
+
+```bash
+# Interactive login via email OTP
+dsp login
+
+# Or set an API key (from the dashboard)
+export DISPLAYDEV_API_KEY=sk_live_...
+```
+
+## Usage
+
+```bash
+# Publish a file
+dsp publish ./report.html --name "Q1 Report"
+
+# Update an existing artifact
+dsp publish ./report.html --id abc123
+
+# Search artifacts
+dsp find
+dsp find "quarterly" --by alice@acme.com
+
+# Get artifact details
+dsp get abc123
+
+# Delete an artifact
+dsp delete abc123 --confirm
+
+# Start MCP server (for Claude Desktop / Claude Code)
+dsp mcp
+```
+
+## MCP
+
+The CLI doubles as an MCP server over stdio. Add to your MCP client config:
+
+```json
+{
+  "mcpServers": {
+    "display": {
+      "command": "dsp",
+      "args": ["mcp"],
+      "env": {
+        "DISPLAYDEV_API_KEY": "sk_live_..."
+      }
+    }
+  }
+}
+```

package/dist/api-client.js

@@ -356,6 +356,113 @@ export var ApiClient = /*#__PURE__*/ function() {
                 }).call(this);
             }
         },
+        {
+            key: "authCheck",
+            value: function authCheck(email) {
+                return _async_to_generator(function() {
+                    return _ts_generator(this, function(_state) {
+                        return [
+                            2,
+                            this.requestNoAuth('POST', '/cli/auth-check', {
+                                email: email
+                            })
+                        ];
+                    });
+                }).call(this);
+            }
+        },
+        {
+            key: "requestDeviceCode",
+            value: function requestDeviceCode(clientId) {
+                return _async_to_generator(function() {
+                    return _ts_generator(this, function(_state) {
+                        return [
+                            2,
+                            this.requestNoAuth('POST', '/api/auth/device/code', {
+                                client_id: clientId
+                            })
+                        ];
+                    });
+                }).call(this);
+            }
+        },
+        {
+            key: "pollDeviceToken",
+            value: function pollDeviceToken(deviceCode, clientId) {
+                return _async_to_generator(function() {
+                    return _ts_generator(this, function(_state) {
+                        return [
+                            2,
+                            this.requestNoAuthRaw('POST', '/api/auth/device/token', {
+                                device_code: deviceCode,
+                                client_id: clientId,
+                                grant_type: 'urn:ietf:params:oauth:grant-type:device_code'
+                            })
+                        ];
+                    });
+                }).call(this);
+            }
+        },
+        {
+            key: "validateApiKey",
+            value: /**
+   * Validate an API key against the API.
+   * Returns 'valid', 'invalid' (401/403), or 'network_error'.
+   */ function validateApiKey(apiKey) {
+                return _async_to_generator(function() {
+                    var res, unused;
+                    return _ts_generator(this, function(_state) {
+                        switch(_state.label){
+                            case 0:
+                                _state.trys.push([
+                                    0,
+                                    2,
+                                    ,
+                                    3
+                                ]);
+                                return [
+                                    4,
+                                    fetch("".concat(this.baseUrl, "/v1/artifacts?limit=1"), {
+                                        headers: {
+                                            'Authorization': "Bearer ".concat(apiKey),
+                                            'X-Client-Type': this.clientType
+                                        }
+                                    })
+                                ];
+                            case 1:
+                                res = _state.sent();
+                                return [
+                                    3,
+                                    3
+                                ];
+                            case 2:
+                                unused = _state.sent();
+                                return [
+                                    2,
+                                    'network_error'
+                                ];
+                            case 3:
+                                if (res.ok) {
+                                    return [
+                                        2,
+                                        'valid'
+                                    ];
+                                }
+                                if (res.status === 401 || res.status === 403) {
+                                    return [
+                                        2,
+                                        'invalid'
+                                    ];
+                                }
+                                return [
+                                    2,
+                                    'network_error'
+                                ];
+                        }
+                    });
+                }).call(this);
+            }
+        },
         {
             key: "request",
             value: function request(method, path, body) {
@@ -387,6 +494,37 @@ export var ApiClient = /*#__PURE__*/ function() {
                 }).call(this);
             }
         },
+        {
+            key: "requestNoAuthRaw",
+            value: /** Like requestNoAuth but returns parsed JSON without throwing on non-2xx (for polling endpoints). */ function requestNoAuthRaw(method, path, body) {
+                return _async_to_generator(function() {
+                    var url, res;
+                    return _ts_generator(this, function(_state) {
+                        switch(_state.label){
+                            case 0:
+                                url = "".concat(this.baseUrl).concat(path);
+                                return [
+                                    4,
+                                    fetch(url, {
+                                        method: method,
+                                        headers: {
+                                            'Content-Type': 'application/json',
+                                            'X-Client-Type': this.clientType
+                                        },
+                                        body: body ? JSON.stringify(body) : undefined
+                                    })
+                                ];
+                            case 1:
+                                res = _state.sent();
+                                return [
+                                    2,
+                                    res.json()
+                                ];
+                        }
+                    });
+                }).call(this);
+            }
+        },
         {
             key: "doFetch",
             value: function doFetch(method, path, body, headers) {

package/dist/main.js

@@ -28,6 +28,14 @@ function _async_to_generator(fn) {
         });
     };
 }
+function _instanceof(left, right) {
+    "@swc/helpers - instanceof";
+    if (right != null && typeof Symbol !== "undefined" && right[Symbol.hasInstance]) {
+        return !!right[Symbol.hasInstance](left);
+    } else {
+        return left instanceof right;
+    }
+}
 function _ts_generator(thisArg, body) {
     var f, y, t, _ = {
         label: 0,
@@ -129,13 +137,14 @@ function _ts_generator(thisArg, body) {
 }
 import { readFile, mkdir, writeFile, rename, chmod } from 'node:fs/promises';
 import { createInterface } from 'node:readline/promises';
-import { homedir } from 'node:os';
+import { execFileSync } from 'node:child_process';
+import { homedir, platform } from 'node:os';
 import { join, extname } from 'node:path';
 import { Command } from 'commander';
 import { ApiClient } from './api-client.js';
 import { startMcpServer } from './mcp-server.js';
 var DEFAULT_API_URL = 'https://api.display.dev';
-var CONFIG_DIR = join(homedir(), '.display');
+var CONFIG_DIR = join(homedir(), '.displaydev');
 var CONFIG_PATH = join(CONFIG_DIR, 'config.json');
 function loadConfig() {
     return _async_to_generator(function() {
@@ -216,12 +225,12 @@ function saveConfig(config) {
     })();
 }
 function resolveAuth() {
-    var apiKey = process.env.DISPLAY_API_KEY;
+    var apiKey = process.env.DISPLAYDEV_API_KEY;
     if (apiKey) {
-        var _process_env_DISPLAY_API_URL;
+        var _process_env_DISPLAYDEV_API_URL;
         return {
             apiKey: apiKey,
-            apiUrl: (_process_env_DISPLAY_API_URL = process.env.DISPLAY_API_URL) !== null && _process_env_DISPLAY_API_URL !== void 0 ? _process_env_DISPLAY_API_URL : DEFAULT_API_URL
+            apiUrl: (_process_env_DISPLAYDEV_API_URL = process.env.DISPLAYDEV_API_URL) !== null && _process_env_DISPLAYDEV_API_URL !== void 0 ? _process_env_DISPLAYDEV_API_URL : DEFAULT_API_URL
         };
     }
     return null;
@@ -255,7 +264,7 @@ function resolveAuthOrConfig() {
                             }
                         ];
                     }
-                    console.error('Not authenticated. Set DISPLAY_API_KEY or run: dsp login');
+                    console.error('Not authenticated. Set DISPLAYDEV_API_KEY or run: dsp login');
                     process.exit(1);
                     return [
                         2
@@ -471,55 +480,258 @@ program.command('delete <shortId>').description('Delete an artifact permanently'
         });
     })();
 });
+function openBrowser(url) {
+    try {
+        var os = platform();
+        if (os === 'darwin') {
+            execFileSync('open', [
+                url
+            ]);
+        } else if (os === 'win32') {
+            execFileSync('cmd', [
+                '/c',
+                'start',
+                '',
+                url
+            ]);
+        } else {
+            execFileSync('xdg-open', [
+                url
+            ]);
+        }
+    } catch (unused) {
+    // Browser opening failed (no display, SSH session, etc.)
+    // URL is already printed — user can open it manually
+    }
+}
+function sleep(ms) {
+    return new Promise(function(resolve) {
+        return setTimeout(resolve, ms);
+    });
+}
 // --- login ---
-program.command('login').description('Authenticate with display.dev via email OTP').option('--email <email>', 'Email address').action(function(opts) {
+program.command('login').description('Authenticate with display.dev').option('--email <email>', 'Email address').option('--api-key [key]', 'Authenticate with an API key').action(function(opts) {
     return _async_to_generator(function() {
-        var _process_env_DISPLAY_API_URL, apiUrl, client, rl, email, code, result;
+        var _process_env_DISPLAYDEV_API_URL, apiUrl, client, key, rl, validation, rl1, email, method, check, unused, err, msg, code, result, unused1, deviceResult, unused2, device_code, verification_uri_complete, initialInterval, interval, tokenResult, unused3, _$err;
         return _ts_generator(this, function(_state) {
             switch(_state.label){
                 case 0:
-                    apiUrl = (_process_env_DISPLAY_API_URL = process.env.DISPLAY_API_URL) !== null && _process_env_DISPLAY_API_URL !== void 0 ? _process_env_DISPLAY_API_URL : DEFAULT_API_URL;
+                    apiUrl = (_process_env_DISPLAYDEV_API_URL = process.env.DISPLAYDEV_API_URL) !== null && _process_env_DISPLAYDEV_API_URL !== void 0 ? _process_env_DISPLAYDEV_API_URL : DEFAULT_API_URL;
                     client = new ApiClient({
                         baseUrl: apiUrl,
                         apiKey: '',
                         clientType: 'cli'
                     });
+                    if (!(opts.apiKey !== undefined)) return [
+                        3,
+                        8
+                    ];
+                    if (!(typeof opts.apiKey === 'string')) return [
+                        3,
+                        1
+                    ];
+                    key = opts.apiKey;
+                    return [
+                        3,
+                        5
+                    ];
+                case 1:
+                    if (!process.stdin.isTTY) return [
+                        3,
+                        3
+                    ];
+                    // Mask input for interactive API key entry
+                    process.stdout.write('API key: ');
+                    return [
+                        4,
+                        new Promise(function(resolve) {
+                            var input = '';
+                            process.stdin.setRawMode(true);
+                            process.stdin.resume();
+                            process.stdin.setEncoding('utf8');
+                            var cleanup = function cleanup() {
+                                process.stdin.setRawMode(false);
+                                process.stdin.pause();
+                                process.stdin.removeListener('data', onData);
+                            };
+                            var onData = function onData(ch) {
+                                if (ch === '\r' || ch === '\n') {
+                                    cleanup();
+                                    process.stdout.write('\n');
+                                    resolve(input);
+                                } else if (ch === '\u0003') {
+                                    cleanup();
+                                    process.stdout.write('\n');
+                                    process.exit(1);
+                                } else if (ch === '\u007F' || ch === '\b') {
+                                    if (input.length > 0) {
+                                        input = input.slice(0, -1);
+                                    }
+                                } else {
+                                    input += ch;
+                                }
+                            };
+                            process.stdin.on('data', onData);
+                        })
+                    ];
+                case 2:
+                    key = _state.sent();
+                    return [
+                        3,
+                        5
+                    ];
+                case 3:
+                    // Non-TTY: read from stdin (piped input)
                     rl = createInterface({
                         input: process.stdin,
                         output: process.stdout
                     });
+                    return [
+                        4,
+                        rl.question('API key: ')
+                    ];
+                case 4:
+                    key = _state.sent();
+                    rl.close();
+                    _state.label = 5;
+                case 5:
+                    key = key.trim();
+                    if (!key) {
+                        console.error('API key cannot be empty.');
+                        process.exit(1);
+                    }
+                    return [
+                        4,
+                        client.validateApiKey(key)
+                    ];
+                case 6:
+                    validation = _state.sent();
+                    if (validation === 'invalid') {
+                        console.error('Invalid API key. Check the key and try again.');
+                        process.exit(1);
+                    }
+                    if (validation === 'network_error') {
+                    // Network issue — save anyway, validate on first use
+                    }
+                    return [
+                        4,
+                        saveConfig({
+                            token: key,
+                            apiUrl: apiUrl
+                        })
+                    ];
+                case 7:
+                    _state.sent();
+                    console.log('Authenticated.');
+                    return [
+                        2
+                    ];
+                case 8:
+                    // --- Mode 1 & 2: Email-based login ---
+                    rl1 = createInterface({
+                        input: process.stdin,
+                        output: process.stdout
+                    });
                     email = opts.email;
                     if (!!email) return [
                         3,
-                        2
+                        10
                     ];
                     return [
                         4,
-                        rl.question('Email: ')
+                        rl1.question('Email: ')
                     ];
-                case 1:
+                case 9:
                     email = _state.sent();
-                    _state.label = 2;
-                case 2:
+                    _state.label = 10;
+                case 10:
+                    email = email.trim();
+                    // Check auth method
+                    method = 'otp';
+                    _state.label = 11;
+                case 11:
+                    _state.trys.push([
+                        11,
+                        13,
+                        ,
+                        14
+                    ]);
+                    return [
+                        4,
+                        client.authCheck(email)
+                    ];
+                case 12:
+                    check = _state.sent();
+                    method = check.method;
+                    return [
+                        3,
+                        14
+                    ];
+                case 13:
+                    unused = _state.sent();
+                    return [
+                        3,
+                        14
+                    ];
+                case 14:
+                    if (!(method === 'otp')) return [
+                        3,
+                        25
+                    ];
+                    _state.label = 15;
+                case 15:
+                    _state.trys.push([
+                        15,
+                        17,
+                        ,
+                        18
+                    ]);
                     return [
                         4,
                         client.sendOtp(email)
                     ];
-                case 3:
+                case 16:
                     _state.sent();
+                    return [
+                        3,
+                        18
+                    ];
+                case 17:
+                    err = _state.sent();
+                    rl1.close();
+                    msg = _instanceof(err, Error) ? err.message : 'Something went wrong';
+                    if (msg.includes('requires SSO')) {
+                        console.error('Your organization requires SSO. Run dsp login again.');
+                    } else {
+                        console.error("Something went wrong. Check your connection and try again.");
+                    }
+                    process.exit(1);
+                    return [
+                        3,
+                        18
+                    ];
+                case 18:
                     console.log("Code sent to ".concat(email));
                     return [
                         4,
-                        rl.question('Enter the 6-digit code: ')
+                        rl1.question('Enter the 6-digit code: ')
                     ];
-                case 4:
+                case 19:
                     code = _state.sent();
-                    rl.close();
+                    rl1.close();
+                    _state.label = 20;
+                case 20:
+                    _state.trys.push([
+                        20,
+                        23,
+                        ,
+                        24
+                    ]);
                     return [
                         4,
                         client.verifyOtp(email, code.trim())
                     ];
-                case 5:
+                case 21:
                     result = _state.sent();
                     return [
                         4,
@@ -528,9 +740,156 @@ program.command('login').description('Authenticate with display.dev via email OT
                             apiUrl: apiUrl
                         })
                     ];
-                case 6:
+                case 22:
                     _state.sent();
                     console.log("Logged in as ".concat(email));
+                    return [
+                        3,
+                        24
+                    ];
+                case 23:
+                    unused1 = _state.sent();
+                    console.error('Invalid or expired code. Try again.');
+                    process.exit(1);
+                    return [
+                        3,
+                        24
+                    ];
+                case 24:
+                    return [
+                        3,
+                        38
+                    ];
+                case 25:
+                    // --- Mode 2: SSO device flow ---
+                    rl1.close();
+                    console.log('Your organization requires SSO. Opening browser...');
+                    _state.label = 26;
+                case 26:
+                    _state.trys.push([
+                        26,
+                        28,
+                        ,
+                        29
+                    ]);
+                    return [
+                        4,
+                        client.requestDeviceCode('dsp-cli')
+                    ];
+                case 27:
+                    deviceResult = _state.sent();
+                    return [
+                        3,
+                        29
+                    ];
+                case 28:
+                    unused2 = _state.sent();
+                    console.error('Something went wrong. Check your connection and try again.');
+                    process.exit(1);
+                    return [
+                        3,
+                        29
+                    ];
+                case 29:
+                    device_code = deviceResult.device_code, verification_uri_complete = deviceResult.verification_uri_complete, initialInterval = deviceResult.interval;
+                    console.log();
+                    console.log("  ".concat(verification_uri_complete));
+                    console.log();
+                    openBrowser(verification_uri_complete);
+                    // Poll for token
+                    interval = (initialInterval || 5) * 1000;
+                    process.stdout.write('Waiting for authentication...');
+                    _state.label = 30;
+                case 30:
+                    if (!true) return [
+                        3,
+                        38
+                    ];
+                    return [
+                        4,
+                        sleep(interval)
+                    ];
+                case 31:
+                    _state.sent();
+                    tokenResult = void 0;
+                    _state.label = 32;
+                case 32:
+                    _state.trys.push([
+                        32,
+                        34,
+                        ,
+                        35
+                    ]);
+                    return [
+                        4,
+                        client.pollDeviceToken(device_code, 'dsp-cli')
+                    ];
+                case 33:
+                    tokenResult = _state.sent();
+                    return [
+                        3,
+                        35
+                    ];
+                case 34:
+                    unused3 = _state.sent();
+                    // Transient network error — retry on next interval
+                    return [
+                        3,
+                        30
+                    ];
+                case 35:
+                    if (!('access_token' in tokenResult)) return [
+                        3,
+                        37
+                    ];
+                    console.log(' done');
+                    return [
+                        4,
+                        saveConfig({
+                            token: tokenResult.access_token,
+                            apiUrl: apiUrl
+                        })
+                    ];
+                case 36:
+                    _state.sent();
+                    console.log("Logged in as ".concat(email));
+                    return [
+                        2
+                    ];
+                case 37:
+                    _$err = tokenResult;
+                    if (_$err.error === 'authorization_pending') {
+                        return [
+                            3,
+                            30
+                        ];
+                    }
+                    if (_$err.error === 'slow_down') {
+                        interval += 5000;
+                        return [
+                            3,
+                            30
+                        ];
+                    }
+                    if (_$err.error === 'access_denied') {
+                        console.log();
+                        console.error('Authentication denied. Run dsp login to try again.');
+                        process.exit(1);
+                    }
+                    if (_$err.error === 'expired_token') {
+                        console.log();
+                        console.error('Code expired. Run dsp login to try again.');
+                        process.exit(1);
+                    }
+                    // Unknown error
+                    console.log();
+                    console.error(_$err.error_description || 'Authentication failed. Run dsp login to try again.');
+                    process.exit(1);
+                    return [
+                        3,
+                        30
+                    ];
+                case 38:
                     return [
                         2
                     ];

package/package.json

@@ -1,9 +1,9 @@
 {
   "name": "@displaydev/cli",
-  "version": "0.1.0",
+  "version": "0.2.0",
   "type": "module",
   "bin": {
-    "dsp": "./dist/main.js"
+    "dsp": "dist/main.js"
   },
   "files": [
     "dist",