@displaydev/cli 0.2.1 → 0.4.0

package/README.md

@@ -18,6 +18,37 @@ dsp login
 export DISPLAYDEV_API_KEY=sk_live_...
 ```
 
+### Agent-native login
+
+`dsp login` is designed to be driven entirely by an AI agent that has inbox
+access (Gmail/IMAP via MCP, etc.) — no human-in-the-loop required.
+
+The command adapts to its environment:
+
+| Invocation | Behavior |
+|---|---|
+| `dsp login --email you@acme.com` **(TTY)** | Sends OTP, prompts for the code in the terminal. |
+| `dsp login --email you@acme.com` **(non-TTY)** | Sends OTP and exits 0. Caller reads the code (e.g. from inbox) and re-invokes. |
+| `dsp login --email you@acme.com --code 123456` | Verifies the code, persists the token, exits. |
+
+For structured output that doesn't rely on prose parsing:
+
+```bash
+dsp login --email you@acme.com --json
+# → {"status":"otp_sent","email":"you@acme.com",
+#    "next":{"command":"dsp login","args":["--email","you@acme.com","--code","<code>"]}}
+
+dsp login --email you@acme.com --code 123456 --json
+# → {"status":"authenticated","method":"otp","email":"you@acme.com"}
+```
+
+**OTP email format** is stable and regex-parseable:
+
+- Subject: `123456 is your display.dev sign-in code`
+- Body: `Your verification code is: 123456`
+
+Extraction pattern: `/Your verification code is: (\d{6})/`.
+
 ## Usage
 
 ```bash

package/dist/api-client.js

@@ -272,26 +272,44 @@ export var ApiClient = /*#__PURE__*/ function() {
             key: "find",
             value: function find(params) {
                 return _async_to_generator(function() {
-                    var searchParams, qs;
+                    var searchParams, qs, res;
                     return _ts_generator(this, function(_state) {
-                        searchParams = new URLSearchParams();
-                        if (params.query) {
-                            searchParams.set('q', params.query);
-                        }
-                        if (params.published_by) {
-                            searchParams.set('published_by', params.published_by);
-                        }
-                        if (params.since) {
-                            searchParams.set('since', params.since);
-                        }
-                        if (params.limit) {
-                            searchParams.set('limit', String(params.limit));
+                        switch(_state.label){
+                            case 0:
+                                searchParams = new URLSearchParams();
+                                if (params.query) {
+                                    searchParams.set('q', params.query);
+                                }
+                                if (params.mine) {
+                                    searchParams.append('author', 'me');
+                                }
+                                if (params.published_by) {
+                                    searchParams.set('published_by', params.published_by);
+                                }
+                                if (params.since) {
+                                    searchParams.set('since', params.since);
+                                }
+                                if (params.sort) {
+                                    searchParams.set('sort', params.sort);
+                                }
+                                if (params.dir) {
+                                    searchParams.set('dir', params.dir);
+                                }
+                                if (params.limit) {
+                                    searchParams.set('limit', String(params.limit));
+                                }
+                                qs = searchParams.toString();
+                                return [
+                                    4,
+                                    this.request('GET', "/v1/artifacts".concat(qs ? "?".concat(qs) : ''))
+                                ];
+                            case 1:
+                                res = _state.sent();
+                                return [
+                                    2,
+                                    res.data
+                                ];
                         }
-                        qs = searchParams.toString();
-                        return [
-                            2,
-                            this.request('GET', "/v1/artifacts".concat(qs ? "?".concat(qs) : ''))
-                        ];
                     });
                 }).call(this);
             }

package/dist/main.js

@@ -367,12 +367,26 @@ program.command('publish <path>').description('Publish an HTML or Markdown file'
     })();
 });
 // --- find ---
-program.command('find [query]').description('Search for artifacts').option('--by <email>', 'Filter by publisher email').option('--since <date>', 'Filter by date (ISO format)').action(function(query, opts) {
+program.command('find [query]').description('Search for artifacts').option('--by <email>', 'Filter by publisher email').option('--mine', 'Show only artifacts you published').option('--since <date>', 'Filter by date (ISO format)').option('--sort <col>', 'Sort column: updated_at, view_count, name', 'updated_at').option('--dir <direction>', 'Sort direction: asc or desc').option('--limit <n>', 'Max rows to fetch (1-100)', function(v) {
+    return parseInt(v, 10);
+}).action(function(query, opts) {
     return _async_to_generator(function() {
         var auth, client, results, _iteratorNormalCompletion, _didIteratorError, _iteratorError, _iterator, _step, a;
         return _ts_generator(this, function(_state) {
             switch(_state.label){
                 case 0:
+                    if (opts.sort && ![
+                        'updated_at',
+                        'view_count',
+                        'name'
+                    ].includes(opts.sort)) {
+                        console.error("Invalid --sort: ".concat(opts.sort, ". Use updated_at, view_count, or name."));
+                        process.exit(1);
+                    }
+                    if (opts.dir && opts.dir !== 'asc' && opts.dir !== 'desc') {
+                        console.error("Invalid --dir: ".concat(opts.dir, ". Use asc or desc."));
+                        process.exit(1);
+                    }
                     return [
                         4,
                         resolveAuthOrConfig()
@@ -385,7 +399,11 @@ program.command('find [query]').description('Search for artifacts').option('--by
                         client.find({
                             query: query,
                             published_by: opts.by,
-                            since: opts.since
+                            mine: opts.mine,
+                            since: opts.since,
+                            sort: opts.sort,
+                            dir: opts.dir,
+                            limit: opts.limit
                         })
                     ];
                 case 2:
@@ -513,12 +531,28 @@ function sleep(ms) {
     });
 }
 // --- login ---
-program.command('login').description('Authenticate with display.dev').option('--email <email>', 'Email address').option('--api-key [key]', 'Authenticate with an API key').action(function(opts) {
+program.command('login').description('Authenticate with display.dev').option('--email <email>', 'Email address').option('--code <code>', 'OTP code (verify step; pair with --email)').option('--api-key [key]', 'Authenticate with an API key').option('--json', 'Machine-readable output (structured status, no prose)').action(function(opts) {
     return _async_to_generator(function() {
-        var _process_env_DISPLAYDEV_API_URL, apiUrl, client, key, rl, validation, email, rl1, method, check, unused, err, msg, rl2, code, result, unused1, deviceResult, unused2, device_code, verification_uri_complete, initialInterval, interval, tokenResult, unused3, _$err;
+        var _process_env_DISPLAYDEV_API_URL, emit, emitErr, apiUrl, client, key, rl, validation, email, rl1, method, check, unused, err, msg, code, rl2, result, unused1, deviceResult, unused2, device_code, verification_uri_complete, initialInterval, interval, tokenResult, unused3, _$err;
         return _ts_generator(this, function(_state) {
             switch(_state.label){
                 case 0:
+                    // Small helper: emit either prose (default) or a JSON line. Agents use
+                    // --json to avoid string-matching against the prose hints.
+                    emit = function emit(prose, json) {
+                        if (opts.json) {
+                            console.log(JSON.stringify(json));
+                        } else {
+                            console.log(prose);
+                        }
+                    };
+                    emitErr = function emitErr(prose, json) {
+                        if (opts.json) {
+                            console.log(JSON.stringify(json));
+                        } else {
+                            console.error(prose);
+                        }
+                    };
                     apiUrl = (_process_env_DISPLAYDEV_API_URL = process.env.DISPLAYDEV_API_URL) !== null && _process_env_DISPLAYDEV_API_URL !== void 0 ? _process_env_DISPLAYDEV_API_URL : DEFAULT_API_URL;
                     client = new ApiClient({
                         baseUrl: apiUrl,
@@ -610,7 +644,10 @@ program.command('login').description('Authenticate with display.dev').option('--
                 case 6:
                     validation = _state.sent();
                     if (validation === 'invalid') {
-                        console.error('Invalid API key. Check the key and try again.');
+                        emitErr('Invalid API key. Check the key and try again.', {
+                            status: 'error',
+                            error: 'invalid_api_key'
+                        });
                         process.exit(1);
                     }
                     if (validation === 'network_error') {
@@ -625,7 +662,10 @@ program.command('login').description('Authenticate with display.dev').option('--
                     ];
                 case 7:
                     _state.sent();
-                    console.log('Authenticated.');
+                    emit('Authenticated.', {
+                        status: 'authenticated',
+                        method: 'api_key'
+                    });
                     return [
                         2
                     ];
@@ -684,7 +724,11 @@ program.command('login').description('Authenticate with display.dev').option('--
                 case 14:
                     if (!(method === 'otp')) return [
                         3,
-                        25
+                        27
+                    ];
+                    if (!!opts.code) return [
+                        3,
+                        19
                     ];
                     _state.label = 15;
                 case 15:
@@ -708,9 +752,15 @@ program.command('login').description('Authenticate with display.dev').option('--
                     err = _state.sent();
                     msg = _instanceof(err, Error) ? err.message : 'Something went wrong';
                     if (msg.includes('requires SSO')) {
-                        console.error('Your organization requires SSO. Run dsp login again.');
+                        emitErr('Your organization requires SSO. Run dsp login again.', {
+                            status: 'error',
+                            error: 'sso_required'
+                        });
                     } else {
-                        console.error('Something went wrong. Check your connection and try again.');
+                        emitErr('Something went wrong. Check your connection and try again.', {
+                            status: 'error',
+                            error: 'send_failed'
+                        });
                     }
                     process.exit(1);
                     return [
@@ -718,11 +768,47 @@ program.command('login').description('Authenticate with display.dev').option('--
                         18
                     ];
                 case 18:
-                    console.log("Code sent to ".concat(email));
                     if (!process.stdin.isTTY) {
-                        console.error('OTP code required. Use dsp login --api-key for non-interactive auth.');
-                        process.exit(1);
+                        // Non-interactive: exit after sending. The caller (typically an
+                        // agent) will collect the OTP from the user and re-invoke with --code.
+                        if (opts.json) {
+                            console.log(JSON.stringify({
+                                status: 'otp_sent',
+                                email: email,
+                                next: {
+                                    command: 'dsp login',
+                                    args: [
+                                        '--email',
+                                        email,
+                                        '--code',
+                                        '<code>'
+                                    ]
+                                }
+                            }));
+                        } else {
+                            console.log("Code sent to ".concat(email));
+                            console.log("Re-run with --code <6-digit code> to complete login.");
+                        }
+                        return [
+                            2
+                        ];
+                    }
+                    // TTY path prints the same prose hint then prompts.
+                    if (!opts.json) {
+                        console.log("Code sent to ".concat(email));
                     }
+                    _state.label = 19;
+                case 19:
+                    if (!opts.code) return [
+                        3,
+                        20
+                    ];
+                    code = opts.code;
+                    return [
+                        3,
+                        22
+                    ];
+                case 20:
                     rl2 = createInterface({
                         input: process.stdin,
                         output: process.stdout
@@ -731,22 +817,22 @@ program.command('login').description('Authenticate with display.dev').option('--
                         4,
                         rl2.question('Enter the 6-digit code: ')
                     ];
-                case 19:
+                case 21:
                     code = _state.sent();
                     rl2.close();
-                    _state.label = 20;
-                case 20:
+                    _state.label = 22;
+                case 22:
                     _state.trys.push([
-                        20,
-                        23,
+                        22,
+                        25,
                         ,
-                        24
+                        26
                     ]);
                     return [
                         4,
                         client.verifyOtp(email, code.trim())
                     ];
-                case 21:
+                case 23:
                     result = _state.sent();
                     return [
                         4,
@@ -755,56 +841,63 @@ program.command('login').description('Authenticate with display.dev').option('--
                             apiUrl: apiUrl
                         })
                     ];
-                case 22:
+                case 24:
                     _state.sent();
-                    console.log("Logged in as ".concat(email));
+                    emit("Logged in as ".concat(email), {
+                        status: 'authenticated',
+                        method: 'otp',
+                        email: email
+                    });
                     return [
                         3,
-                        24
+                        26
                     ];
-                case 23:
+                case 25:
                     unused1 = _state.sent();
-                    console.error('Invalid or expired code. Try again.');
+                    emitErr('Invalid or expired code. Try again.', {
+                        status: 'error',
+                        error: 'invalid_or_expired_code'
+                    });
                     process.exit(1);
                     return [
                         3,
-                        24
+                        26
                     ];
-                case 24:
+                case 26:
                     return [
                         3,
-                        38
+                        40
                     ];
-                case 25:
+                case 27:
                     // --- Mode 2: SSO device flow ---
                     console.log('Your organization requires SSO. Opening browser...');
-                    _state.label = 26;
-                case 26:
+                    _state.label = 28;
+                case 28:
                     _state.trys.push([
-                        26,
                         28,
+                        30,
                         ,
-                        29
+                        31
                     ]);
                     return [
                         4,
                         client.requestDeviceCode('dsp-cli')
                     ];
-                case 27:
+                case 29:
                     deviceResult = _state.sent();
                     return [
                         3,
-                        29
+                        31
                     ];
-                case 28:
+                case 30:
                     unused2 = _state.sent();
                     console.error('Something went wrong. Check your connection and try again.');
                     process.exit(1);
                     return [
                         3,
-                        29
+                        31
                     ];
-                case 29:
+                case 31:
                     device_code = deviceResult.device_code, verification_uri_complete = deviceResult.verification_uri_complete, initialInterval = deviceResult.interval;
                     console.log();
                     console.log("  ".concat(verification_uri_complete));
@@ -813,48 +906,48 @@ program.command('login').description('Authenticate with display.dev').option('--
                     // Poll for token
                     interval = (initialInterval || 5) * 1000;
                     process.stdout.write('Waiting for authentication...');
-                    _state.label = 30;
-                case 30:
+                    _state.label = 32;
+                case 32:
                     if (!true) return [
                         3,
-                        38
+                        40
                     ];
                     return [
                         4,
                         sleep(interval)
                     ];
-                case 31:
+                case 33:
                     _state.sent();
                     tokenResult = void 0;
-                    _state.label = 32;
-                case 32:
+                    _state.label = 34;
+                case 34:
                     _state.trys.push([
-                        32,
                         34,
+                        36,
                         ,
-                        35
+                        37
                     ]);
                     return [
                         4,
                         client.pollDeviceToken(device_code, 'dsp-cli')
                     ];
-                case 33:
+                case 35:
                     tokenResult = _state.sent();
                     return [
                         3,
-                        35
+                        37
                     ];
-                case 34:
+                case 36:
                     unused3 = _state.sent();
                     // Transient network error — retry on next interval
                     return [
                         3,
-                        30
+                        32
                     ];
-                case 35:
+                case 37:
                     if (!('access_token' in tokenResult)) return [
                         3,
-                        37
+                        39
                     ];
                     console.log(' done');
                     return [
@@ -864,25 +957,25 @@ program.command('login').description('Authenticate with display.dev').option('--
                             apiUrl: apiUrl
                         })
                     ];
-                case 36:
+                case 38:
                     _state.sent();
                     console.log("Logged in as ".concat(email));
                     return [
                         2
                     ];
-                case 37:
+                case 39:
                     _$err = tokenResult;
                     if (_$err.error === 'authorization_pending') {
                         return [
                             3,
-                            30
+                            32
                         ];
                     }
                     if (_$err.error === 'slow_down') {
                         interval += 5000;
                         return [
                             3,
-                            30
+                            32
                         ];
                     }
                     if (_$err.error === 'access_denied') {
@@ -901,9 +994,9 @@ program.command('login').description('Authenticate with display.dev').option('--
                     process.exit(1);
                     return [
                         3,
-                        30
+                        32
                     ];
-                case 38:
+                case 40:
                     return [
                         2
                     ];

package/dist/mcp-server.js

@@ -309,8 +309,18 @@ function registerTools(server, api) {
     server.tool('find', 'Search for artifacts in the organization', {
         query: z.string().optional().describe('Search by artifact name'),
         published_by: z.string().optional().describe('Filter by publisher email'),
+        mine: z.boolean().optional().describe('Limit results to your own artifacts'),
         since: z.string().optional().describe('Filter by updated since ISO date'),
-        limit: z.number().optional().describe('Max results to return')
+        sort: z.enum([
+            'updated_at',
+            'view_count',
+            'name'
+        ]).optional().describe('Sort column'),
+        dir: z.enum([
+            'asc',
+            'desc'
+        ]).optional().describe('Sort direction'),
+        limit: z.number().optional().describe('Max results to return (1-100)')
     }, function(args) {
         return _async_to_generator(function() {
             var results;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@displaydev/cli",
-  "version": "0.2.1",
+  "version": "0.4.0",
   "type": "module",
   "bin": {
     "dsp": "dist/main.js"
@@ -12,6 +12,7 @@
   "scripts": {
     "build": "swc src -d dist --strip-leading-paths",
     "typecheck": "tsgo --project tsconfig.json --noEmit",
+    "lint": "oxlint --deny-warnings .",
     "test": "vitest run"
   },
   "dependencies": {