@displaydev/cli 0.17.0 → 0.19.0

package/dist/main.js

@@ -726,11 +726,24 @@ program.command('rename <shortId>').description('Rename a published artifact. Sl
     })();
 });
 // --- find ---
-program.command('find [query]').description('Search for artifacts').option('--by <email>', 'Filter by publisher email').option('--mine', 'Show only artifacts you published').option('--since <date>', 'Filter by date (ISO format)').option('--sort <col>', 'Sort column: updated_at, view_count, name', 'updated_at').option('--dir <direction>', 'Sort direction: asc or desc').option('--limit <n>', 'Max rows to fetch (1-100)', function(v) {
+function collectAuthor(value, prev) {
+    return prev.concat(value);
+}
+function parseVisibilityCsv(raw) {
+    return raw.split(',').map(function(v) {
+        return v.trim();
+    }).filter(Boolean);
+}
+var VISIBILITY_VALUES = new Set([
+    'public',
+    'company',
+    'private'
+]);
+program.command('find [query]').alias('list').description('List or search artifacts. Omit [query] to list every artifact (paginated).').option('--author <a>', 'Filter by author (repeatable). Each value: email, userId, or "me".', collectAuthor, []).option('--visibility <list>', 'CSV of visibility levels: public, company, private. "private" returns only your own.').option('--since <date>', 'Filter by updated since ISO date').option('--sort <col>', 'Sort column: updated_at, view_count, name').option('--dir <direction>', 'Sort direction: asc or desc').option('--cursor <token>', 'Opaque pagination token from a prior response. Drop the cursor when filters change — the wire only validates it against sort/dir, so reusing it after changing --author / --visibility / --since / [query] silently skews results.').option('--limit <n>', 'Max rows to fetch (1-100)', function(v) {
     return parseInt(v, 10);
 }).action(function(query, opts) {
     return _async_to_generator(function() {
-        var auth, client, results, _iteratorNormalCompletion, _didIteratorError, _iteratorError, _iterator, _step, a;
+        var visibility, tokens, _iteratorNormalCompletion, _didIteratorError, _iteratorError, _iterator, _step, v, auth, client, response, err, msg, data, nextCursor, totalCount, _iteratorNormalCompletion1, _didIteratorError1, _iteratorError1, _iterator1, _step1, a;
         return _ts_generator(this, function(_state) {
             switch(_state.label){
                 case 0:
@@ -746,53 +759,126 @@ program.command('find [query]').description('Search for artifacts').option('--by
                         console.error("Invalid --dir: ".concat(opts.dir, ". Use asc or desc."));
                         process.exit(1);
                     }
+                    if (opts.visibility) {
+                        tokens = parseVisibilityCsv(opts.visibility);
+                        _iteratorNormalCompletion = true, _didIteratorError = false, _iteratorError = undefined;
+                        try {
+                            for(_iterator = tokens[Symbol.iterator](); !(_iteratorNormalCompletion = (_step = _iterator.next()).done); _iteratorNormalCompletion = true){
+                                v = _step.value;
+                                if (!VISIBILITY_VALUES.has(v)) {
+                                    console.error("Invalid --visibility: ".concat(v, ". Use public, company, or private."));
+                                    process.exit(1);
+                                }
+                            }
+                        } catch (err) {
+                            _didIteratorError = true;
+                            _iteratorError = err;
+                        } finally{
+                            try {
+                                if (!_iteratorNormalCompletion && _iterator.return != null) {
+                                    _iterator.return();
+                                }
+                            } finally{
+                                if (_didIteratorError) {
+                                    throw _iteratorError;
+                                }
+                            }
+                        }
+                        visibility = tokens;
+                    }
                     return [
                         4,
                         resolveAuthOrConfig()
                     ];
                 case 1:
                     auth = _state.sent();
+                    // The wire silently drops `me` when authenticated with an org API key (no
+                    // session user → caller id is null in resolveAuthorIds). Catch that at the
+                    // command layer so the user gets an explicit failure rather than an
+                    // unfiltered list. Trim each value to mirror the wire — it trims tokens
+                    // before resolving `me`, so `--author ' me '` would otherwise bypass the
+                    // guard and re-introduce the silent-broaden bug.
+                    if (auth.keyType === 'org' && opts.author.some(function(a) {
+                        return a.trim() === 'me';
+                    })) {
+                        console.error('--author me requires a user-scoped credential. Use a user API key or sign in via dashboard.');
+                        process.exit(1);
+                    }
                     client = createClient(auth);
+                    _state.label = 2;
+                case 2:
+                    _state.trys.push([
+                        2,
+                        4,
+                        ,
+                        5
+                    ]);
                     return [
                         4,
                         client.find({
                             query: query,
-                            publishedBy: opts.by,
-                            mine: opts.mine,
+                            author: opts.author.length > 0 ? opts.author : undefined,
+                            visibility: visibility,
                             since: opts.since,
                             sort: opts.sort,
                             dir: opts.dir,
+                            cursor: opts.cursor,
                             limit: opts.limit
                         })
                     ];
-                case 2:
-                    results = _state.sent();
-                    if (results.length === 0) {
+                case 3:
+                    response = _state.sent();
+                    return [
+                        3,
+                        5
+                    ];
+                case 4:
+                    err = _state.sent();
+                    msg = _instanceof(err, Error) ? err.message : String(err);
+                    console.error(msg);
+                    process.exit(1);
+                    return [
+                        3,
+                        5
+                    ];
+                case 5:
+                    data = response.data, nextCursor = response.nextCursor, totalCount = response.totalCount;
+                    if (data.length === 0) {
                         console.log('No artifacts found.');
                         return [
                             2
                         ];
                     }
-                    _iteratorNormalCompletion = true, _didIteratorError = false, _iteratorError = undefined;
+                    _iteratorNormalCompletion1 = true, _didIteratorError1 = false, _iteratorError1 = undefined;
                     try {
-                        for(_iterator = results[Symbol.iterator](); !(_iteratorNormalCompletion = (_step = _iterator.next()).done); _iteratorNormalCompletion = true){
-                            a = _step.value;
+                        for(_iterator1 = data[Symbol.iterator](); !(_iteratorNormalCompletion1 = (_step1 = _iterator1.next()).done); _iteratorNormalCompletion1 = true){
+                            a = _step1.value;
                             console.log("".concat(a.shortId, "  v").concat(a.currentVersion, "  ").concat(a.name, "  ").concat(a.url));
                         }
                     } catch (err) {
-                        _didIteratorError = true;
-                        _iteratorError = err;
+                        _didIteratorError1 = true;
+                        _iteratorError1 = err;
                     } finally{
                         try {
-                            if (!_iteratorNormalCompletion && _iterator.return != null) {
-                                _iterator.return();
+                            if (!_iteratorNormalCompletion1 && _iterator1.return != null) {
+                                _iterator1.return();
                             }
                         } finally{
-                            if (_didIteratorError) {
-                                throw _iteratorError;
+                            if (_didIteratorError1) {
+                                throw _iteratorError1;
                             }
                         }
                     }
+                    // Footer on stderr so pipe consumers (`dsp find | xargs ...`) get clean
+                    // stdout. Order: count line first, then the next-page hint.
+                    if (totalCount === -1) {
+                        process.stderr.write("Showing ".concat(data.length, " matching artifacts (count exceeded the budget; rerun with a tighter filter to get an exact total).\n"));
+                    } else if (totalCount >= 0) {
+                        process.stderr.write("Showing ".concat(data.length, "/").concat(totalCount, " matching artifacts.\n"));
+                    }
+                    if (nextCursor !== null) {
+                        process.stderr.write("More results available. Re-run with --cursor ".concat(nextCursor, " to fetch the next page.\n"));
+                    }
                     return [
                         2
                     ];
@@ -1617,6 +1703,537 @@ program.command('clear-logo').description('Remove the org logo (idempotent — s
         });
     })();
 });
+// --- comment add ---
+// `dsp comment add --artifact <shortId> --body "..." --anchor-json '<json>' [--parent <id>]`
+// Spec §3 maps to POST /v1/artifacts/:shortId/comments. Root posts
+// require a full anchor descriptor (textQuote prefix + exact + suffix
+// plus cssPath); replies inherit the root's anchor and must omit it.
+//
+// `--anchor-json` is intentionally the only anchor input. A bare-text
+// shortcut would have to fabricate prefix/suffix/cssPath, and the
+// underlying `dom-anchor-text-quote` resolver binds to the FIRST exact
+// match in the scope. Without prefix/suffix the resolver cannot
+// disambiguate duplicates and the comment can silently attach to the
+// wrong occurrence — see widget's anchor algorithm at
+// webapp/src/components/comments/anchor.ts:54. Forcing the caller to
+// supply the full descriptor (the agent has the source content; humans
+// can copy from the widget's selection JSON) keeps the bind reliable.
+program.command('comment').description('Comment-related subcommands. Run `dsp comment <cmd> --help` for each.').command('add').description('Post a root comment or reply on an artifact.').option('--artifact <shortId>', 'Artifact shortId (subject_type=artifact)').option('--kb-page <kbName...>', 'KB-page subject — pass two values: kb name then file path (subject_type=kb_page; not yet supported). Variadic (commander) — anything after `--kb-page` up to the next flag is consumed as the (kbName, filePath) tuple.').requiredOption('--body <text>', 'Comment body (≤10k chars)').option('--anchor-json <json>', 'Full anchor object as JSON: {"textQuote":{"prefix":"","exact":"...","suffix":""},"cssPath":"..."}. Required for root posts; omit for replies.').option('--parent <commentId>', 'Reply to this root comment id; omit for a root post').action(function(opts) {
+    return _async_to_generator(function() {
+        var subject, anchor, auth, client, result, err;
+        return _ts_generator(this, function(_state) {
+            switch(_state.label){
+                case 0:
+                    subject = resolveSubjectFlags(opts);
+                    if (subject.kind === 'invalid') {
+                        console.error(subject.error);
+                        process.exit(1);
+                    }
+                    if (subject.kind === 'kb_page') {
+                        console.error('subject_type_not_implemented: KB-page subjects are not yet supported.');
+                        process.exit(1);
+                    }
+                    if (!opts.parent && !opts.anchorJson) {
+                        console.error('Root comments require --anchor-json. Use --parent <commentId> for a reply.');
+                        process.exit(1);
+                    }
+                    if (opts.parent && opts.anchorJson) {
+                        console.error('Replies inherit the root anchor — omit --anchor-json when --parent is set.');
+                        process.exit(1);
+                    }
+                    if (opts.anchorJson) {
+                        try {
+                            anchor = JSON.parse(opts.anchorJson);
+                        } catch (unused) {
+                            console.error('--anchor-json is not valid JSON.');
+                            process.exit(1);
+                        }
+                    }
+                    return [
+                        4,
+                        resolveAuthOrConfig()
+                    ];
+                case 1:
+                    auth = _state.sent();
+                    client = createClient(auth);
+                    _state.label = 2;
+                case 2:
+                    _state.trys.push([
+                        2,
+                        4,
+                        ,
+                        5
+                    ]);
+                    return [
+                        4,
+                        client.addComment(subject.shortId, {
+                            body: opts.body,
+                            anchor: anchor,
+                            parentId: opts.parent
+                        })
+                    ];
+                case 3:
+                    result = _state.sent();
+                    console.log(JSON.stringify(result, null, 2));
+                    return [
+                        3,
+                        5
+                    ];
+                case 4:
+                    err = _state.sent();
+                    handleCommentApiError(err);
+                    return [
+                        3,
+                        5
+                    ];
+                case 5:
+                    return [
+                        2
+                    ];
+            }
+        });
+    })();
+});
+// --- comment list ---
+program.commands.find(function(c) {
+    return c.name() === 'comment';
+}).command('list').description('List comment threads on a subject.').option('--artifact <shortId>', 'Artifact shortId (subject_type=artifact)').option('--kb-page <kbName...>', 'KB-page subject — pass two values: kb name then file path (subject_type=kb_page; not yet supported). Variadic (commander) — anything after `--kb-page` up to the next flag is consumed as the (kbName, filePath) tuple.').option('--status <state>', 'open | resolved | all (default: open)').option('--since <iso>', 'ISO-8601 timestamp — filter to threads with activity at or after this point').action(function(opts) {
+    return _async_to_generator(function() {
+        var subject, auth, client, result, err;
+        return _ts_generator(this, function(_state) {
+            switch(_state.label){
+                case 0:
+                    subject = resolveSubjectFlags(opts);
+                    if (subject.kind === 'invalid') {
+                        console.error(subject.error);
+                        process.exit(1);
+                    }
+                    if (subject.kind === 'kb_page') {
+                        console.error('subject_type_not_implemented: KB-page subjects are not yet supported.');
+                        process.exit(1);
+                    }
+                    if (opts.status && ![
+                        'open',
+                        'resolved',
+                        'all'
+                    ].includes(opts.status)) {
+                        console.error("Invalid --status: ".concat(opts.status, ". Use open, resolved, or all."));
+                        process.exit(1);
+                    }
+                    return [
+                        4,
+                        resolveAuthOrConfig()
+                    ];
+                case 1:
+                    auth = _state.sent();
+                    client = createClient(auth);
+                    _state.label = 2;
+                case 2:
+                    _state.trys.push([
+                        2,
+                        4,
+                        ,
+                        5
+                    ]);
+                    return [
+                        4,
+                        client.listComments(subject.shortId, {
+                            status: opts.status,
+                            since: opts.since
+                        })
+                    ];
+                case 3:
+                    result = _state.sent();
+                    console.log(JSON.stringify(result, null, 2));
+                    return [
+                        3,
+                        5
+                    ];
+                case 4:
+                    err = _state.sent();
+                    handleCommentApiError(err);
+                    return [
+                        3,
+                        5
+                    ];
+                case 5:
+                    return [
+                        2
+                    ];
+            }
+        });
+    })();
+});
+// --- comment edit ---
+program.commands.find(function(c) {
+    return c.name() === 'comment';
+}).command('edit <commentId>').description('Edit your own comment within the 5-minute author window.').requiredOption('--body <text>', 'New comment body').action(function(commentId, opts) {
+    return _async_to_generator(function() {
+        var auth, client, result, err;
+        return _ts_generator(this, function(_state) {
+            switch(_state.label){
+                case 0:
+                    return [
+                        4,
+                        resolveAuthOrConfig()
+                    ];
+                case 1:
+                    auth = _state.sent();
+                    client = createClient(auth);
+                    _state.label = 2;
+                case 2:
+                    _state.trys.push([
+                        2,
+                        4,
+                        ,
+                        5
+                    ]);
+                    return [
+                        4,
+                        client.editComment(commentId, opts.body)
+                    ];
+                case 3:
+                    result = _state.sent();
+                    console.log(JSON.stringify(result, null, 2));
+                    return [
+                        3,
+                        5
+                    ];
+                case 4:
+                    err = _state.sent();
+                    handleCommentApiError(err);
+                    return [
+                        3,
+                        5
+                    ];
+                case 5:
+                    return [
+                        2
+                    ];
+            }
+        });
+    })();
+});
+// --- comment delete ---
+program.commands.find(function(c) {
+    return c.name() === 'comment';
+}).command('delete <commentId>').description('Soft-delete a comment. Author / artifact creator / org admin.').action(function(commentId) {
+    return _async_to_generator(function() {
+        var auth, client, err;
+        return _ts_generator(this, function(_state) {
+            switch(_state.label){
+                case 0:
+                    return [
+                        4,
+                        resolveAuthOrConfig()
+                    ];
+                case 1:
+                    auth = _state.sent();
+                    client = createClient(auth);
+                    _state.label = 2;
+                case 2:
+                    _state.trys.push([
+                        2,
+                        4,
+                        ,
+                        5
+                    ]);
+                    return [
+                        4,
+                        client.deleteComment(commentId)
+                    ];
+                case 3:
+                    _state.sent();
+                    console.log('Comment deleted.');
+                    return [
+                        3,
+                        5
+                    ];
+                case 4:
+                    err = _state.sent();
+                    handleCommentApiError(err);
+                    return [
+                        3,
+                        5
+                    ];
+                case 5:
+                    return [
+                        2
+                    ];
+            }
+        });
+    })();
+});
+// --- thread resolve / reopen ---
+var threadCmd = program.command('thread').description('Thread-level operations (resolve, reopen).');
+threadCmd.command('resolve <rootCommentId>').description('Mark a thread resolved. Thread participant / artifact creator / org admin.').action(function(commentId) {
+    return _async_to_generator(function() {
+        var auth, client, result, err;
+        return _ts_generator(this, function(_state) {
+            switch(_state.label){
+                case 0:
+                    return [
+                        4,
+                        resolveAuthOrConfig()
+                    ];
+                case 1:
+                    auth = _state.sent();
+                    client = createClient(auth);
+                    _state.label = 2;
+                case 2:
+                    _state.trys.push([
+                        2,
+                        4,
+                        ,
+                        5
+                    ]);
+                    return [
+                        4,
+                        client.resolveThread(commentId)
+                    ];
+                case 3:
+                    result = _state.sent();
+                    console.log(JSON.stringify(result, null, 2));
+                    return [
+                        3,
+                        5
+                    ];
+                case 4:
+                    err = _state.sent();
+                    handleCommentApiError(err);
+                    return [
+                        3,
+                        5
+                    ];
+                case 5:
+                    return [
+                        2
+                    ];
+            }
+        });
+    })();
+});
+threadCmd.command('reopen <rootCommentId>').description('Reopen a resolved thread. Any authenticated user with view access.').action(function(commentId) {
+    return _async_to_generator(function() {
+        var auth, client, result, err;
+        return _ts_generator(this, function(_state) {
+            switch(_state.label){
+                case 0:
+                    return [
+                        4,
+                        resolveAuthOrConfig()
+                    ];
+                case 1:
+                    auth = _state.sent();
+                    client = createClient(auth);
+                    _state.label = 2;
+                case 2:
+                    _state.trys.push([
+                        2,
+                        4,
+                        ,
+                        5
+                    ]);
+                    return [
+                        4,
+                        client.reopenThread(commentId)
+                    ];
+                case 3:
+                    result = _state.sent();
+                    console.log(JSON.stringify(result, null, 2));
+                    return [
+                        3,
+                        5
+                    ];
+                case 4:
+                    err = _state.sent();
+                    handleCommentApiError(err);
+                    return [
+                        3,
+                        5
+                    ];
+                case 5:
+                    return [
+                        2
+                    ];
+            }
+        });
+    })();
+});
+// --- watch / unwatch ---
+program.command('watch').description('Watch a subject for comment notifications.').option('--artifact <shortId>', 'Artifact shortId (subject_type=artifact)').option('--kb-page <kbName...>', 'KB-page subject — pass two values: kb name then file path (subject_type=kb_page; not yet supported). Variadic (commander) — anything after `--kb-page` up to the next flag is consumed as the (kbName, filePath) tuple.').action(function(opts) {
+    return _async_to_generator(function() {
+        var subject, auth, client, result, err;
+        return _ts_generator(this, function(_state) {
+            switch(_state.label){
+                case 0:
+                    subject = resolveSubjectFlags(opts);
+                    if (subject.kind === 'invalid') {
+                        console.error(subject.error);
+                        process.exit(1);
+                    }
+                    if (subject.kind === 'kb_page') {
+                        console.error('subject_type_not_implemented: KB-page subjects are not yet supported.');
+                        process.exit(1);
+                    }
+                    return [
+                        4,
+                        resolveAuthOrConfig()
+                    ];
+                case 1:
+                    auth = _state.sent();
+                    client = createClient(auth);
+                    _state.label = 2;
+                case 2:
+                    _state.trys.push([
+                        2,
+                        4,
+                        ,
+                        5
+                    ]);
+                    return [
+                        4,
+                        client.watchArtifact(subject.shortId)
+                    ];
+                case 3:
+                    result = _state.sent();
+                    console.log(JSON.stringify(result, null, 2));
+                    return [
+                        3,
+                        5
+                    ];
+                case 4:
+                    err = _state.sent();
+                    handleCommentApiError(err);
+                    return [
+                        3,
+                        5
+                    ];
+                case 5:
+                    return [
+                        2
+                    ];
+            }
+        });
+    })();
+});
+program.command('unwatch').description('Unwatch a subject.').option('--artifact <shortId>', 'Artifact shortId (subject_type=artifact)').option('--kb-page <kbName...>', 'KB-page subject — pass two values: kb name then file path (subject_type=kb_page; not yet supported). Variadic (commander) — anything after `--kb-page` up to the next flag is consumed as the (kbName, filePath) tuple.').action(function(opts) {
+    return _async_to_generator(function() {
+        var subject, auth, client, err;
+        return _ts_generator(this, function(_state) {
+            switch(_state.label){
+                case 0:
+                    subject = resolveSubjectFlags(opts);
+                    if (subject.kind === 'invalid') {
+                        console.error(subject.error);
+                        process.exit(1);
+                    }
+                    if (subject.kind === 'kb_page') {
+                        console.error('subject_type_not_implemented: KB-page subjects are not yet supported.');
+                        process.exit(1);
+                    }
+                    return [
+                        4,
+                        resolveAuthOrConfig()
+                    ];
+                case 1:
+                    auth = _state.sent();
+                    client = createClient(auth);
+                    _state.label = 2;
+                case 2:
+                    _state.trys.push([
+                        2,
+                        4,
+                        ,
+                        5
+                    ]);
+                    return [
+                        4,
+                        client.unwatchArtifact(subject.shortId)
+                    ];
+                case 3:
+                    _state.sent();
+                    console.log('Unwatched.');
+                    return [
+                        3,
+                        5
+                    ];
+                case 4:
+                    err = _state.sent();
+                    handleCommentApiError(err);
+                    return [
+                        3,
+                        5
+                    ];
+                case 5:
+                    return [
+                        2
+                    ];
+            }
+        });
+    })();
+});
+function resolveSubjectFlags(opts) {
+    var hasArtifact = Boolean(opts.artifact);
+    var kbPage = opts.kbPage;
+    var hasKbPage = Array.isArray(kbPage) && kbPage.length > 0;
+    if (hasArtifact && hasKbPage) {
+        return {
+            kind: 'invalid',
+            error: 'Pass either --artifact or --kb-page, not both.'
+        };
+    }
+    if (!hasArtifact && !hasKbPage) {
+        return {
+            kind: 'invalid',
+            error: 'Pass --artifact <shortId> or --kb-page <kbName> <filePath>.'
+        };
+    }
+    if (hasArtifact) {
+        return {
+            kind: 'artifact',
+            shortId: opts.artifact
+        };
+    }
+    if (kbPage.length !== 2) {
+        return {
+            kind: 'invalid',
+            error: '--kb-page requires exactly two values: <kbName> <filePath>.'
+        };
+    }
+    return {
+        kind: 'kb_page',
+        kbName: kbPage[0],
+        filePath: kbPage[1],
+        shortId: ''
+    };
+}
+/**
+ * Common error mapper for the comment / watch / thread subcommands.
+ * Mirrors the ApiError handling on share/rename so 401 prompts a
+ * re-login, 403 surfaces the API's reason verbatim, 404 shows a
+ * concrete "not found", and 410 (signed-token failures from the
+ * email-link routes) prints the API's message. Other errors fall
+ * through to a generic stringify.
+ */ function handleCommentApiError(err) {
+    if (_instanceof(err, ApiError)) {
+        if (err.status === 401) {
+            console.error('Your credential is no longer valid. Run: dsp login (or rotate DISPLAYDEV_API_KEY).');
+            process.exit(1);
+        }
+        if (err.status === 404) {
+            console.error(err.message);
+            process.exit(4);
+        }
+        if (err.status === 403 || err.status === 400 || err.status === 410 || err.status === 429) {
+            console.error(err.message);
+            process.exit(1);
+        }
+    }
+    var msg = _instanceof(err, Error) ? err.message : String(err);
+    console.error(msg);
+    process.exit(1);
+}
 // --- mcp ---
 program.command('mcp').description('Start MCP server over stdin/stdout').action(function() {
     return _async_to_generator(function() {