@displaydev/cli 0.17.0 → 0.18.0

package/dist/api-client.js

@@ -549,44 +549,76 @@ export var ApiClient = /*#__PURE__*/ function() {
             key: "find",
             value: function find(params) {
                 return _async_to_generator(function() {
-                    var searchParams, qs, res;
+                    var searchParams, _iteratorNormalCompletion, _didIteratorError, _iteratorError, _iterator, _step, a, _iteratorNormalCompletion1, _didIteratorError1, _iteratorError1, _iterator1, _step1, v, qs;
                     return _ts_generator(this, function(_state) {
-                        switch(_state.label){
-                            case 0:
-                                searchParams = new URLSearchParams();
-                                if (params.query) {
-                                    searchParams.set('q', params.query);
-                                }
-                                if (params.mine) {
-                                    searchParams.append('author', 'me');
-                                }
-                                if (params.publishedBy) {
-                                    searchParams.set('publishedBy', params.publishedBy);
-                                }
-                                if (params.since) {
-                                    searchParams.set('since', params.since);
+                        searchParams = new URLSearchParams();
+                        if (params.query) {
+                            searchParams.set('q', params.query);
+                        }
+                        if (params.author) {
+                            _iteratorNormalCompletion = true, _didIteratorError = false, _iteratorError = undefined;
+                            try {
+                                for(_iterator = params.author[Symbol.iterator](); !(_iteratorNormalCompletion = (_step = _iterator.next()).done); _iteratorNormalCompletion = true){
+                                    a = _step.value;
+                                    searchParams.append('author', a);
                                 }
-                                if (params.sort) {
-                                    searchParams.set('sort', params.sort);
+                            } catch (err) {
+                                _didIteratorError = true;
+                                _iteratorError = err;
+                            } finally{
+                                try {
+                                    if (!_iteratorNormalCompletion && _iterator.return != null) {
+                                        _iterator.return();
+                                    }
+                                } finally{
+                                    if (_didIteratorError) {
+                                        throw _iteratorError;
+                                    }
                                 }
-                                if (params.dir) {
-                                    searchParams.set('dir', params.dir);
+                            }
+                        }
+                        if (params.visibility) {
+                            _iteratorNormalCompletion1 = true, _didIteratorError1 = false, _iteratorError1 = undefined;
+                            try {
+                                for(_iterator1 = params.visibility[Symbol.iterator](); !(_iteratorNormalCompletion1 = (_step1 = _iterator1.next()).done); _iteratorNormalCompletion1 = true){
+                                    v = _step1.value;
+                                    searchParams.append('visibility', v);
                                 }
-                                if (params.limit) {
-                                    searchParams.set('limit', String(params.limit));
+                            } catch (err) {
+                                _didIteratorError1 = true;
+                                _iteratorError1 = err;
+                            } finally{
+                                try {
+                                    if (!_iteratorNormalCompletion1 && _iterator1.return != null) {
+                                        _iterator1.return();
+                                    }
+                                } finally{
+                                    if (_didIteratorError1) {
+                                        throw _iteratorError1;
+                                    }
                                 }
-                                qs = searchParams.toString();
-                                return [
-                                    4,
-                                    this.request('GET', "/v1/artifacts".concat(qs ? "?".concat(qs) : ''))
-                                ];
-                            case 1:
-                                res = _state.sent();
-                                return [
-                                    2,
-                                    res.data
-                                ];
+                            }
+                        }
+                        if (params.since) {
+                            searchParams.set('since', params.since);
                         }
+                        if (params.sort) {
+                            searchParams.set('sort', params.sort);
+                        }
+                        if (params.dir) {
+                            searchParams.set('dir', params.dir);
+                        }
+                        if (params.cursor) {
+                            searchParams.set('cursor', params.cursor);
+                        }
+                        if (params.limit !== undefined) {
+                            searchParams.set('limit', String(params.limit));
+                        }
+                        qs = searchParams.toString();
+                        return [
+                            2,
+                            this.request('GET', "/v1/artifacts".concat(qs ? "?".concat(qs) : ''))
+                        ];
                     });
                 }).call(this);
             }

package/dist/main-helpers.js

@@ -287,6 +287,17 @@ function _ts_generator(thisArg, body) {
 }
 import { extname } from 'node:path';
 export var DEFAULT_API_URL = 'https://api.display.dev';
+export function classifyApiKey(apiKey) {
+    // BA mints keys with no separator after the prefix — `sk_live<body>`,
+    // not `sk_live_<body>`. Mirrors the live check at api/src/guards/auth.guard.ts.
+    if (apiKey.startsWith('sk_live')) {
+        return 'user';
+    }
+    if (apiKey.startsWith('org_live')) {
+        return 'org';
+    }
+    return 'session';
+}
 export var InvalidFlagError = /*#__PURE__*/ function(Error1) {
     "use strict";
     _inherits(InvalidFlagError, Error1);
@@ -399,7 +410,8 @@ export function resolveAuth(env, config) {
     var apiUrl = (_ref = (_env_DISPLAYDEV_API_URL = env.DISPLAYDEV_API_URL) !== null && _env_DISPLAYDEV_API_URL !== void 0 ? _env_DISPLAYDEV_API_URL : config === null || config === void 0 ? void 0 : config.apiUrl) !== null && _ref !== void 0 ? _ref : DEFAULT_API_URL;
     return {
         apiKey: apiKey,
-        apiUrl: apiUrl
+        apiUrl: apiUrl,
+        keyType: classifyApiKey(apiKey)
     };
 }
 export function classifyBrandingError(message) {

package/dist/main.js

@@ -726,11 +726,24 @@ program.command('rename <shortId>').description('Rename a published artifact. Sl
     })();
 });
 // --- find ---
-program.command('find [query]').description('Search for artifacts').option('--by <email>', 'Filter by publisher email').option('--mine', 'Show only artifacts you published').option('--since <date>', 'Filter by date (ISO format)').option('--sort <col>', 'Sort column: updated_at, view_count, name', 'updated_at').option('--dir <direction>', 'Sort direction: asc or desc').option('--limit <n>', 'Max rows to fetch (1-100)', function(v) {
+function collectAuthor(value, prev) {
+    return prev.concat(value);
+}
+function parseVisibilityCsv(raw) {
+    return raw.split(',').map(function(v) {
+        return v.trim();
+    }).filter(Boolean);
+}
+var VISIBILITY_VALUES = new Set([
+    'public',
+    'company',
+    'private'
+]);
+program.command('find [query]').alias('list').description('List or search artifacts. Omit [query] to list every artifact (paginated).').option('--author <a>', 'Filter by author (repeatable). Each value: email, userId, or "me".', collectAuthor, []).option('--visibility <list>', 'CSV of visibility levels: public, company, private. "private" returns only your own.').option('--since <date>', 'Filter by updated since ISO date').option('--sort <col>', 'Sort column: updated_at, view_count, name').option('--dir <direction>', 'Sort direction: asc or desc').option('--cursor <token>', 'Opaque pagination token from a prior response. Drop the cursor when filters change — the wire only validates it against sort/dir, so reusing it after changing --author / --visibility / --since / [query] silently skews results.').option('--limit <n>', 'Max rows to fetch (1-100)', function(v) {
     return parseInt(v, 10);
 }).action(function(query, opts) {
     return _async_to_generator(function() {
-        var auth, client, results, _iteratorNormalCompletion, _didIteratorError, _iteratorError, _iterator, _step, a;
+        var visibility, tokens, _iteratorNormalCompletion, _didIteratorError, _iteratorError, _iterator, _step, v, auth, client, response, err, msg, data, nextCursor, totalCount, _iteratorNormalCompletion1, _didIteratorError1, _iteratorError1, _iterator1, _step1, a;
         return _ts_generator(this, function(_state) {
             switch(_state.label){
                 case 0:
@@ -746,53 +759,126 @@ program.command('find [query]').description('Search for artifacts').option('--by
                         console.error("Invalid --dir: ".concat(opts.dir, ". Use asc or desc."));
                         process.exit(1);
                     }
+                    if (opts.visibility) {
+                        tokens = parseVisibilityCsv(opts.visibility);
+                        _iteratorNormalCompletion = true, _didIteratorError = false, _iteratorError = undefined;
+                        try {
+                            for(_iterator = tokens[Symbol.iterator](); !(_iteratorNormalCompletion = (_step = _iterator.next()).done); _iteratorNormalCompletion = true){
+                                v = _step.value;
+                                if (!VISIBILITY_VALUES.has(v)) {
+                                    console.error("Invalid --visibility: ".concat(v, ". Use public, company, or private."));
+                                    process.exit(1);
+                                }
+                            }
+                        } catch (err) {
+                            _didIteratorError = true;
+                            _iteratorError = err;
+                        } finally{
+                            try {
+                                if (!_iteratorNormalCompletion && _iterator.return != null) {
+                                    _iterator.return();
+                                }
+                            } finally{
+                                if (_didIteratorError) {
+                                    throw _iteratorError;
+                                }
+                            }
+                        }
+                        visibility = tokens;
+                    }
                     return [
                         4,
                         resolveAuthOrConfig()
                     ];
                 case 1:
                     auth = _state.sent();
+                    // The wire silently drops `me` when authenticated with an org API key (no
+                    // session user → caller id is null in resolveAuthorIds). Catch that at the
+                    // command layer so the user gets an explicit failure rather than an
+                    // unfiltered list. Trim each value to mirror the wire — it trims tokens
+                    // before resolving `me`, so `--author ' me '` would otherwise bypass the
+                    // guard and re-introduce the silent-broaden bug.
+                    if (auth.keyType === 'org' && opts.author.some(function(a) {
+                        return a.trim() === 'me';
+                    })) {
+                        console.error('--author me requires a user-scoped credential. Use a user API key or sign in via dashboard.');
+                        process.exit(1);
+                    }
                     client = createClient(auth);
+                    _state.label = 2;
+                case 2:
+                    _state.trys.push([
+                        2,
+                        4,
+                        ,
+                        5
+                    ]);
                     return [
                         4,
                         client.find({
                             query: query,
-                            publishedBy: opts.by,
-                            mine: opts.mine,
+                            author: opts.author.length > 0 ? opts.author : undefined,
+                            visibility: visibility,
                             since: opts.since,
                             sort: opts.sort,
                             dir: opts.dir,
+                            cursor: opts.cursor,
                             limit: opts.limit
                         })
                     ];
-                case 2:
-                    results = _state.sent();
-                    if (results.length === 0) {
+                case 3:
+                    response = _state.sent();
+                    return [
+                        3,
+                        5
+                    ];
+                case 4:
+                    err = _state.sent();
+                    msg = _instanceof(err, Error) ? err.message : String(err);
+                    console.error(msg);
+                    process.exit(1);
+                    return [
+                        3,
+                        5
+                    ];
+                case 5:
+                    data = response.data, nextCursor = response.nextCursor, totalCount = response.totalCount;
+                    if (data.length === 0) {
                         console.log('No artifacts found.');
                         return [
                             2
                         ];
                     }
-                    _iteratorNormalCompletion = true, _didIteratorError = false, _iteratorError = undefined;
+                    _iteratorNormalCompletion1 = true, _didIteratorError1 = false, _iteratorError1 = undefined;
                     try {
-                        for(_iterator = results[Symbol.iterator](); !(_iteratorNormalCompletion = (_step = _iterator.next()).done); _iteratorNormalCompletion = true){
-                            a = _step.value;
+                        for(_iterator1 = data[Symbol.iterator](); !(_iteratorNormalCompletion1 = (_step1 = _iterator1.next()).done); _iteratorNormalCompletion1 = true){
+                            a = _step1.value;
                             console.log("".concat(a.shortId, "  v").concat(a.currentVersion, "  ").concat(a.name, "  ").concat(a.url));
                         }
                     } catch (err) {
-                        _didIteratorError = true;
-                        _iteratorError = err;
+                        _didIteratorError1 = true;
+                        _iteratorError1 = err;
                     } finally{
                         try {
-                            if (!_iteratorNormalCompletion && _iterator.return != null) {
-                                _iterator.return();
+                            if (!_iteratorNormalCompletion1 && _iterator1.return != null) {
+                                _iterator1.return();
                             }
                         } finally{
-                            if (_didIteratorError) {
-                                throw _iteratorError;
+                            if (_didIteratorError1) {
+                                throw _iteratorError1;
                             }
                         }
                     }
+                    // Footer on stderr so pipe consumers (`dsp find | xargs ...`) get clean
+                    // stdout. Order: count line first, then the next-page hint.
+                    if (totalCount === -1) {
+                        process.stderr.write("Showing ".concat(data.length, " matching artifacts (count exceeded the budget; rerun with a tighter filter to get an exact total).\n"));
+                    } else if (totalCount >= 0) {
+                        process.stderr.write("Showing ".concat(data.length, "/").concat(totalCount, " matching artifacts.\n"));
+                    }
+                    if (nextCursor !== null) {
+                        process.stderr.write("More results available. Re-run with --cursor ".concat(nextCursor, " to fetch the next page.\n"));
+                    }
                     return [
                         2
                     ];

package/dist/mcp-server.js

@@ -27,19 +27,6 @@ function _async_to_generator(fn) {
         });
     };
 }
-function _define_property(obj, key, value) {
-    if (key in obj) {
-        Object.defineProperty(obj, key, {
-            value: value,
-            enumerable: true,
-            configurable: true,
-            writable: true
-        });
-    } else {
-        obj[key] = value;
-    }
-    return obj;
-}
 function _instanceof(left, right) {
     "@swc/helpers - instanceof";
     if (right != null && typeof Symbol !== "undefined" && right[Symbol.hasInstance]) {
@@ -48,57 +35,6 @@ function _instanceof(left, right) {
         return left instanceof right;
     }
 }
-function _object_spread(target) {
-    for(var i = 1; i < arguments.length; i++){
-        var source = arguments[i] != null ? arguments[i] : {};
-        var ownKeys = Object.keys(source);
-        if (typeof Object.getOwnPropertySymbols === "function") {
-            ownKeys = ownKeys.concat(Object.getOwnPropertySymbols(source).filter(function(sym) {
-                return Object.getOwnPropertyDescriptor(source, sym).enumerable;
-            }));
-        }
-        ownKeys.forEach(function(key) {
-            _define_property(target, key, source[key]);
-        });
-    }
-    return target;
-}
-function _object_without_properties(source, excluded) {
-    if (source == null) return {};
-    var target = {}, sourceKeys, key, i;
-    if (typeof Reflect !== "undefined" && Reflect.ownKeys) {
-        sourceKeys = Reflect.ownKeys(Object(source));
-        for(i = 0; i < sourceKeys.length; i++){
-            key = sourceKeys[i];
-            if (excluded.indexOf(key) >= 0) continue;
-            if (!Object.prototype.propertyIsEnumerable.call(source, key)) continue;
-            target[key] = source[key];
-        }
-        return target;
-    }
-    target = _object_without_properties_loose(source, excluded);
-    if (Object.getOwnPropertySymbols) {
-        sourceKeys = Object.getOwnPropertySymbols(source);
-        for(i = 0; i < sourceKeys.length; i++){
-            key = sourceKeys[i];
-            if (excluded.indexOf(key) >= 0) continue;
-            if (!Object.prototype.propertyIsEnumerable.call(source, key)) continue;
-            target[key] = source[key];
-        }
-    }
-    return target;
-}
-function _object_without_properties_loose(source, excluded) {
-    if (source == null) return {};
-    var target = {}, sourceKeys = Object.getOwnPropertyNames(source), key, i;
-    for(i = 0; i < sourceKeys.length; i++){
-        key = sourceKeys[i];
-        if (excluded.indexOf(key) >= 0) continue;
-        if (!Object.prototype.propertyIsEnumerable.call(source, key)) continue;
-        target[key] = source[key];
-    }
-    return target;
-}
 function _ts_generator(thisArg, body) {
     var f, y, t, _ = {
         label: 0,
@@ -624,24 +560,29 @@ export function registerTools(server, api) {
             });
         })();
     });
-    server.tool('find', 'Search for artifacts in the organization', {
-        query: z.string().optional().describe('Search by artifact name'),
-        published_by: z.string().optional().describe('Filter by publisher email'),
-        mine: z.boolean().optional().describe('Limit results to your own artifacts'),
-        since: z.string().optional().describe('Filter by updated since ISO date'),
+    server.tool('find', 'List or search artifacts in the caller\'s organization. Omit `query` to list every artifact (paginated). Filter by name, one-or-more authors, one-or-more visibilities, or update time. Sort by `updated_at` (default), `view_count`, or `name`. Paginate via `cursor` — if the result includes a non-null `nextCursor`, pass it back to fetch the next page; if filters change between calls, drop the cursor. The response also carries `totalCount` (`-1` means the count query exceeded its budget — treat as "many"). `visibility: ["private"]` returns only your own private artifacts, not org-wide.', {
+        query: z.string().optional().describe('Search by artifact name (case-insensitive substring). Omit to list all artifacts.'),
+        author: z.array(z.string()).optional().describe('Filter by one or more authors. Each value: email, userId, or the literal "me". Multiple values are ORed. "me" requires a user-scoped credential — with an org API key the wire drops it.'),
+        visibility: z.array(z.enum([
+            'public',
+            'company',
+            'private'
+        ])).optional().describe('Filter by one or more visibility levels. NOTE: "private" is creator-scoped — only your own private artifacts are returned, not org-wide.'),
+        since: z.string().optional().describe('ISO timestamp; only artifacts updated on or after this point.'),
         sort: z.enum([
             'updated_at',
             'view_count',
             'name'
-        ]).optional().describe('Sort column'),
+        ]).optional().describe('Sort column. Defaults to updated_at.'),
         dir: z.enum([
             'asc',
             'desc'
-        ]).optional().describe('Sort direction'),
-        limit: z.number().optional().describe('Max results to return (1-100)')
+        ]).optional().describe('Sort direction. Defaults: desc for updated_at and view_count, asc for name.'),
+        cursor: z.string().optional().describe('Opaque pagination token from a prior response. Pass it back to fetch the next page. WARNING: only valid for the same `sort`/`dir`/filter set that issued it — change a filter and drop the cursor, or results will be skewed without an error.'),
+        limit: z.number().int().min(1).max(100).optional().describe('Max results per page (1–100, default 50).')
     }, function(args) {
         return _async_to_generator(function() {
-            var publishedBy, rest, results, err;
+            var result, err;
             return _ts_generator(this, function(_state) {
                 switch(_state.label){
                     case 0:
@@ -651,25 +592,15 @@ export function registerTools(server, api) {
                             ,
                             3
                         ]);
-                        // Translate the snake_case MCP arg to the camelCase wire shape that
-                        // ApiClient.find() forwards to GET /v1/artifacts. MCP convention
-                        // prefers snake_case in tool schemas; the wire is camelCase
-                        // (api-conventions §1.2). Without this map, `published_by` was
-                        // silently dropped on the floor and the filter went unfiltered.
-                        publishedBy = args.published_by, rest = _object_without_properties(args, [
-                            "published_by"
-                        ]);
                         return [
                             4,
-                            api.find(_object_spread({}, rest, publishedBy !== undefined ? {
-                                publishedBy: publishedBy
-                            } : {}))
+                            api.find(args)
                         ];
                     case 1:
-                        results = _state.sent();
+                        result = _state.sent();
                         return [
                             2,
-                            okResponse(results)
+                            okResponse(result)
                         ];
                     case 2:
                         err = _state.sent();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@displaydev/cli",
-  "version": "0.17.0",
+  "version": "0.18.0",
   "type": "module",
   "bin": {
     "dsp": "dist/main.js"