@displaydev/cli 0.6.0 → 0.7.0

package/dist/main.js

@@ -1,4 +1,12 @@
 #!/usr/bin/env node
+function _array_like_to_array(arr, len) {
+    if (len == null || len > arr.length) len = arr.length;
+    for(var i = 0, arr2 = new Array(len); i < len; i++)arr2[i] = arr[i];
+    return arr2;
+}
+function _array_without_holes(arr) {
+    if (Array.isArray(arr)) return _array_like_to_array(arr);
+}
 function asyncGeneratorStep(gen, resolve, reject, _next, _throw, key, arg) {
     try {
         var info = gen[key](arg);
@@ -36,6 +44,23 @@ function _instanceof(left, right) {
         return left instanceof right;
     }
 }
+function _iterable_to_array(iter) {
+    if (typeof Symbol !== "undefined" && iter[Symbol.iterator] != null || iter["@@iterator"] != null) return Array.from(iter);
+}
+function _non_iterable_spread() {
+    throw new TypeError("Invalid attempt to spread non-iterable instance.\\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.");
+}
+function _to_consumable_array(arr) {
+    return _array_without_holes(arr) || _iterable_to_array(arr) || _unsupported_iterable_to_array(arr) || _non_iterable_spread();
+}
+function _unsupported_iterable_to_array(o, minLen) {
+    if (!o) return;
+    if (typeof o === "string") return _array_like_to_array(o, minLen);
+    var n = Object.prototype.toString.call(o).slice(8, -1);
+    if (n === "Object" && o.constructor) n = o.constructor.name;
+    if (n === "Map" || n === "Set") return Array.from(n);
+    if (n === "Arguments" || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(n)) return _array_like_to_array(o, minLen);
+}
 function _ts_generator(thisArg, body) {
     var f, y, t, _ = {
         label: 0,
@@ -135,49 +160,38 @@ function _ts_generator(thisArg, body) {
         };
     }
 }
-import { readFile, mkdir, writeFile, rename, chmod } from 'node:fs/promises';
+import { readFile } from 'node:fs/promises';
 import { createInterface } from 'node:readline/promises';
 import { createRequire } from 'node:module';
 import { execFileSync } from 'node:child_process';
-import { homedir, platform } from 'node:os';
-import { join, extname } from 'node:path';
+import { platform } from 'node:os';
 import { Command } from 'commander';
-import { ApiClient } from './api-client.js';
+import { ApiClient, ApiError } from './api-client.js';
+import { loadConfig, saveConfig } from './config.js';
 import { startMcpServer } from './mcp-server.js';
+import { DEFAULT_API_URL, DeviceCodeDeniedError, DeviceCodeExpiredError, DeviceCodeFailedError, InvalidFlagError, PublishArgsError, classifyBrandingError, parseShortIdAndVersion, parseShowBrandingFlag, pollDeviceToken, readApiKeyFromTty, readStreamToString, resolveAuth as resolveAuthFromEnvAndConfig, validatePublishArgs } from './main-helpers.js';
 var require = createRequire(import.meta.url);
 var version = require('../package.json').version;
-var DEFAULT_API_URL = 'https://api.display.dev';
-var CONFIG_DIR = join(homedir(), '.displaydev');
-var CONFIG_PATH = join(CONFIG_DIR, 'config.json');
-function loadConfig() {
+function resolveAuthOrConfig() {
     return _async_to_generator(function() {
-        var raw, unused;
+        var auth;
         return _ts_generator(this, function(_state) {
             switch(_state.label){
                 case 0:
-                    _state.trys.push([
-                        0,
-                        2,
-                        ,
-                        3
-                    ]);
                     return [
                         4,
-                        readFile(CONFIG_PATH, 'utf-8')
+                        resolveAuthOrConfigOptional()
                     ];
                 case 1:
-                    raw = _state.sent();
-                    return [
-                        2,
-                        JSON.parse(raw)
-                    ];
-                case 2:
-                    unused = _state.sent();
-                    return [
-                        2,
-                        null
-                    ];
-                case 3:
+                    auth = _state.sent();
+                    if (auth) {
+                        return [
+                            2,
+                            auth
+                        ];
+                    }
+                    console.error('Not authenticated. Set DISPLAYDEV_API_KEY or run: dsp login');
+                    process.exit(1);
                     return [
                         2
                     ];
@@ -185,97 +199,34 @@ function loadConfig() {
         });
     })();
 }
-function saveConfig(config) {
+/**
+ * Like `resolveAuthOrConfig()` but returns null instead of exiting when
+ * no credential is present. Used by flows that have a fallback (public
+ * publish) or a different behaviour without auth (MCP public-only tools).
+ */ function resolveAuthOrConfigOptional() {
     return _async_to_generator(function() {
-        var tmpPath;
+        var config;
         return _ts_generator(this, function(_state) {
             switch(_state.label){
                 case 0:
-                    return [
-                        4,
-                        mkdir(CONFIG_DIR, {
-                            recursive: true
-                        })
-                    ];
-                case 1:
-                    _state.sent();
-                    tmpPath = "".concat(CONFIG_PATH, ".tmp");
-                    return [
-                        4,
-                        writeFile(tmpPath, "".concat(JSON.stringify(config, null, 2), "\n"), {
-                            mode: 384
-                        })
-                    ];
-                case 2:
-                    _state.sent();
-                    return [
-                        4,
-                        rename(tmpPath, CONFIG_PATH)
-                    ];
-                case 3:
-                    _state.sent();
-                    return [
-                        4,
-                        chmod(CONFIG_PATH, 384)
-                    ];
-                case 4:
-                    _state.sent();
-                    return [
-                        2
-                    ];
-            }
-        });
-    })();
-}
-function resolveAuth() {
-    var apiKey = process.env.DISPLAYDEV_API_KEY;
-    if (apiKey) {
-        var _process_env_DISPLAYDEV_API_URL;
-        return {
-            apiKey: apiKey,
-            apiUrl: (_process_env_DISPLAYDEV_API_URL = process.env.DISPLAYDEV_API_URL) !== null && _process_env_DISPLAYDEV_API_URL !== void 0 ? _process_env_DISPLAYDEV_API_URL : DEFAULT_API_URL
-        };
-    }
-    return null;
-}
-function resolveAuthOrConfig() {
-    return _async_to_generator(function() {
-        var env, config, _config_apiUrl;
-        return _ts_generator(this, function(_state) {
-            switch(_state.label){
-                case 0:
-                    env = resolveAuth();
-                    if (env) {
-                        return [
-                            2,
-                            env
-                        ];
-                    }
                     return [
                         4,
                         loadConfig()
                     ];
                 case 1:
                     config = _state.sent();
-                    if (config === null || config === void 0 ? void 0 : config.token) {
-                        ;
-                        return [
-                            2,
-                            {
-                                apiKey: config.token,
-                                apiUrl: (_config_apiUrl = config.apiUrl) !== null && _config_apiUrl !== void 0 ? _config_apiUrl : DEFAULT_API_URL
-                            }
-                        ];
-                    }
-                    console.error('Not authenticated. Set DISPLAYDEV_API_KEY or run: dsp login');
-                    process.exit(1);
                     return [
-                        2
+                        2,
+                        resolveAuthFromEnvAndConfig(process.env, config)
                     ];
             }
         });
     })();
 }
+function resolvePublicApiUrl() {
+    var _process_env_DISPLAYDEV_API_URL;
+    return (_process_env_DISPLAYDEV_API_URL = process.env.DISPLAYDEV_API_URL) !== null && _process_env_DISPLAYDEV_API_URL !== void 0 ? _process_env_DISPLAYDEV_API_URL : DEFAULT_API_URL;
+}
 function createClient(auth) {
     return new ApiClient({
         baseUrl: auth.apiUrl,
@@ -287,82 +238,225 @@ var program = new Command().name('dsp').description('display.dev CLI — publish
 function collectEmails(value, prev) {
     return prev.concat(value);
 }
-var SHOW_BRANDING_VALUES = new Set([
-    'show',
-    'hide',
-    'inherit'
-]);
-function parseShowBrandingFlag(raw) {
-    if (!raw) {
-        return undefined;
-    }
-    var normalized = raw.toLowerCase();
-    if (!SHOW_BRANDING_VALUES.has(normalized)) {
-        console.error("Invalid --show-branding: ".concat(raw, ". Use show, hide, or inherit."));
-        process.exit(1);
+function parseShowBrandingOrExit(raw) {
+    try {
+        return parseShowBrandingFlag(raw);
+    } catch (err) {
+        if (_instanceof(err, InvalidFlagError)) {
+            console.error("Invalid ".concat(err.flag, ": ").concat(err.value, ". Use show, hide, or inherit."));
+            process.exit(1);
+        }
+        throw err;
     }
-    return normalized;
 }
 // --- publish ---
-program.command('publish <path>').description('Publish an HTML or Markdown file').option('--name <name>', 'Artifact display name').option('--id <shortId>', 'Update existing artifact (new version)').option('--public', 'Make artifact publicly accessible').option('--company', 'Restrict artifact to company auth (default for new artifacts)').option('--share <email>', 'Share with guest email (repeatable)', collectEmails, []).option('--clear-shares', 'Remove all guest email shares (update only)').option('--theme <theme>', 'Markdown theme (default: github)').option('--show-branding <mode>', 'display.dev bar override: show, hide, or inherit (paid plans only)').action(function(filePath, opts) {
+program.command('publish <path>').description('Publish an HTML or Markdown file. Use "-" to read from stdin (requires --id).').option('--name <name>', 'Artifact display name').option('--id <shortId>', 'Update existing artifact (new version)').option('--public', 'Make artifact publicly accessible (alias for --visibility public)').option('--company', 'Restrict artifact to company auth (alias for --visibility company)').option('--visibility <level>', 'public | company | private. "private" requires the Teams plan.').option('--share <email>', 'Add an email to sharedWith (repeatable; alias for --share-with)', collectEmails, []).option('--share-with <emails>', 'Comma-separated email list for sharedWith', function(val) {
+    return val.split(',').map(function(e) {
+        return e.trim();
+    }).filter(Boolean);
+}).option('--clear-shares', 'Remove all sharedWith entries (update only)').option('--theme <theme>', 'Markdown theme (default: github)').option('--show-branding <mode>', 'display.dev bar override: show, hide, or inherit (paid plans only)').action(function(filePath, opts) {
     return _async_to_generator(function() {
-        var showBranding, auth, client, ext, content, format, visibility, share, result, err, msg, verb;
+        var _opts_shareWith, showBranding, auth, fromStdin, format, content, inferClient, detail, err, msg, publicClient, publicResult, err1, msg1, client, visibility, mergedShare, share, result, err2, msg2, verb;
         return _ts_generator(this, function(_state) {
             switch(_state.label){
                 case 0:
-                    if (!opts.id && !opts.name) {
-                        console.error('--name is required for new artifacts. Use --id to update an existing one.');
-                        process.exit(1);
+                    showBranding = parseShowBrandingOrExit(opts.showBranding);
+                    return [
+                        4,
+                        resolveAuthOrConfigOptional()
+                    ];
+                case 1:
+                    auth = _state.sent();
+                    fromStdin = filePath === '-';
+                    if (fromStdin) {
+                        // stdin path is for re-publishing existing artifacts (`dsp export | dsp
+                        // publish --id <id> -`). Path-specific gates run first so the user gets
+                        // a clear error before we touch the network or stdin.
+                        if (!auth) {
+                            console.error('Reading from stdin (-) requires auth. Run: dsp login');
+                            process.exit(1);
+                        }
+                        if (!opts.id) {
+                            console.error('Reading from stdin (-) requires --id <shortId>.');
+                            process.exit(2);
+                        }
+                        if (process.stdin.isTTY) {
+                            console.error('cannot read source from a TTY; pipe a file or use a path');
+                            process.exit(2);
+                        }
                     }
-                    if (opts.public && opts.company) {
-                        console.error('Use --public or --company, not both.');
-                        process.exit(1);
+                    try {
+                        validatePublishArgs({
+                            name: opts.name,
+                            id: opts.id,
+                            public: opts.public,
+                            company: opts.company,
+                            visibility: opts.visibility,
+                            share: opts.share,
+                            shareWith: opts.shareWith,
+                            clearShares: opts.clearShares,
+                            showBranding: opts.showBranding,
+                            filePath: filePath,
+                            authenticated: auth !== null,
+                            fromStdin: fromStdin
+                        });
+                    } catch (err) {
+                        if (_instanceof(err, PublishArgsError)) {
+                            console.error(err.message);
+                            process.exit(1);
+                        }
+                        throw err;
                     }
-                    if (opts.clearShares && opts.share.length > 0) {
-                        console.error('Use --share or --clear-shares, not both.');
+                    if (!fromStdin) return [
+                        3,
+                        7
+                    ];
+                    // The artifact's format is fixed at create — infer it via GET so the
+                    // round-trip preserves it without making the caller pass --format.
+                    inferClient = createClient(auth);
+                    _state.label = 2;
+                case 2:
+                    _state.trys.push([
+                        2,
+                        4,
+                        ,
+                        5
+                    ]);
+                    return [
+                        4,
+                        inferClient.get(opts.id)
+                    ];
+                case 3:
+                    detail = _state.sent();
+                    format = detail.format === 'md' ? 'md' : 'html';
+                    return [
+                        3,
+                        5
+                    ];
+                case 4:
+                    err = _state.sent();
+                    if (_instanceof(err, ApiError) && (err.status === 401 || err.status === 403)) {
+                        console.error('Your credential is no longer valid. Run: dsp login (or rotate DISPLAYDEV_API_KEY).');
                         process.exit(1);
                     }
-                    if (opts.clearShares && !opts.id) {
-                        console.error('--clear-shares only applies when updating (--id).');
-                        process.exit(1);
+                    if (_instanceof(err, ApiError) && err.status === 404) {
+                        console.error("Artifact not found: ".concat(opts.id));
+                        process.exit(4);
                     }
-                    showBranding = parseShowBrandingFlag(opts.showBranding);
+                    msg = _instanceof(err, Error) ? err.message : String(err);
+                    console.error(msg);
+                    process.exit(1);
+                    return [
+                        3,
+                        5
+                    ];
+                case 5:
                     return [
                         4,
-                        resolveAuthOrConfig()
+                        readStreamToString(process.stdin)
                     ];
-                case 1:
-                    auth = _state.sent();
-                    client = createClient(auth);
-                    ext = extname(filePath).toLowerCase();
-                    if (ext !== '.html' && ext !== '.md') {
-                        console.error("Unsupported file type: ".concat(ext, " (expected .html or .md)"));
-                        process.exit(1);
-                    }
+                case 6:
+                    content = _state.sent();
+                    return [
+                        3,
+                        9
+                    ];
+                case 7:
+                    format = filePath.toLowerCase().endsWith('.md') ? 'md' : 'html';
                     return [
                         4,
                         readFile(filePath, 'utf-8')
                     ];
-                case 2:
+                case 8:
                     content = _state.sent();
-                    format = ext === '.md' ? 'md' : 'html';
-                    if (opts.public) {
+                    _state.label = 9;
+                case 9:
+                    if (!!auth) return [
+                        3,
+                        14
+                    ];
+                    publicClient = new ApiClient({
+                        baseUrl: resolvePublicApiUrl(),
+                        apiKey: '',
+                        clientType: 'cli'
+                    });
+                    _state.label = 10;
+                case 10:
+                    _state.trys.push([
+                        10,
+                        12,
+                        ,
+                        13
+                    ]);
+                    return [
+                        4,
+                        publicClient.publishPublic({
+                            content: content,
+                            name: opts.name,
+                            format: format
+                        })
+                    ];
+                case 11:
+                    publicResult = _state.sent();
+                    return [
+                        3,
+                        13
+                    ];
+                case 12:
+                    err1 = _state.sent();
+                    msg1 = _instanceof(err1, Error) ? err1.message : String(err1);
+                    console.error(msg1);
+                    process.exit(1);
+                    return [
+                        3,
+                        13
+                    ];
+                case 13:
+                    // Full response as JSON on stdout so `dsp publish … | jq -r .previewUrl`
+                    // works alongside the human-readable block on stderr.
+                    console.log(JSON.stringify(publicResult));
+                    process.stderr.write([
+                        '',
+                        "Published anonymously — nobody owns this artifact yet.",
+                        "  Preview: ".concat(publicResult.previewUrl),
+                        "  Claim:   ".concat(publicResult.claimUrl),
+                        "  Expires: ".concat(publicResult.expiresAt),
+                        "Sign in at the claim URL to move it into your display.dev organization.",
+                        ''
+                    ].join('\n'));
+                    return [
+                        2
+                    ];
+                case 14:
+                    // --- Authenticated path — `--id` is update, otherwise create. ---
+                    client = createClient(auth);
+                    if (opts.visibility) {
+                        if (opts.visibility !== 'public' && opts.visibility !== 'company' && opts.visibility !== 'private') {
+                            console.error("Invalid --visibility: ".concat(opts.visibility, ". Use public, company, or private."));
+                            process.exit(1);
+                        }
+                        visibility = opts.visibility;
+                    } else if (opts.public) {
                         visibility = 'public';
                     } else if (opts.company) {
                         visibility = 'company';
                     }
-                    share = opts.share.length > 0 ? opts.share : undefined;
-                    _state.label = 3;
-                case 3:
+                    // --share-with (csv) and --share (repeatable) both contribute to the
+                    // sharedWith list. Concatenating rather than making them mutually
+                    // exclusive keeps CLI composition simple for scripts that want to mix.
+                    mergedShare = _to_consumable_array((_opts_shareWith = opts.shareWith) !== null && _opts_shareWith !== void 0 ? _opts_shareWith : []).concat(_to_consumable_array(opts.share));
+                    share = mergedShare.length > 0 ? mergedShare : undefined;
+                    _state.label = 15;
+                case 15:
                     _state.trys.push([
-                        3,
-                        8,
+                        15,
+                        20,
                         ,
-                        9
+                        21
                     ]);
                     if (!opts.id) return [
                         3,
-                        5
+                        17
                     ];
                     return [
                         4,
@@ -377,13 +471,13 @@ program.command('publish <path>').description('Publish an HTML or Markdown file'
                             showBranding: showBranding
                         })
                     ];
-                case 4:
+                case 16:
                     result = _state.sent();
                     return [
                         3,
-                        7
+                        19
                     ];
-                case 5:
+                case 17:
                     return [
                         4,
                         client.publish({
@@ -396,28 +490,34 @@ program.command('publish <path>').description('Publish an HTML or Markdown file'
                             showBranding: showBranding
                         })
                     ];
-                case 6:
+                case 18:
                     result = _state.sent();
-                    _state.label = 7;
-                case 7:
+                    _state.label = 19;
+                case 19:
                     return [
                         3,
-                        9
+                        21
                     ];
-                case 8:
-                    err = _state.sent();
-                    msg = _instanceof(err, Error) ? err.message : String(err);
-                    if (/paid plan|upgrade/i.test(msg)) {
+                case 20:
+                    err2 = _state.sent();
+                    // Fail closed on an expired / revoked credential: do NOT fall through
+                    // to the public endpoint, since the user intended a workspace publish.
+                    if (_instanceof(err2, ApiError) && (err2.status === 401 || err2.status === 403)) {
+                        console.error('Your credential is no longer valid. Run: dsp login (or rotate DISPLAYDEV_API_KEY).');
+                        process.exit(1);
+                    }
+                    msg2 = _instanceof(err2, Error) ? err2.message : String(err2);
+                    if (classifyBrandingError(msg2) === 'paid-plan') {
                         console.error('Error: Hiding display.dev branding requires a paid plan. See https://display.dev/billing');
                     } else {
-                        console.error(msg);
+                        console.error(msg2);
                     }
                     process.exit(1);
                     return [
                         3,
-                        9
+                        21
                     ];
-                case 9:
+                case 21:
                     console.log(result.url);
                     verb = opts.id ? 'Updated' : 'Published';
                     console.log("".concat(verb, " ").concat(result.name, " (").concat(result.shortId, ") v").concat(result.version));
@@ -428,6 +528,96 @@ program.command('publish <path>').description('Publish an HTML or Markdown file'
         });
     })();
 });
+// --- share ---
+program.command('share <shortId>').description('Change an artifact\'s visibility and/or add/remove shared-with emails.').option('--visibility <level>', 'public | company | private. "private" requires the Teams plan.').option('--add-users <emails>', 'Comma-separated emails to add to sharedWith', function(val) {
+    return val.split(',').map(function(e) {
+        return e.trim();
+    }).filter(Boolean);
+}).option('--remove-users <emails>', 'Comma-separated emails to remove from sharedWith', function(val) {
+    return val.split(',').map(function(e) {
+        return e.trim();
+    }).filter(Boolean);
+}).action(function(shortId, opts) {
+    return _async_to_generator(function() {
+        var auth, client, result, err, msg;
+        return _ts_generator(this, function(_state) {
+            switch(_state.label){
+                case 0:
+                    if (opts.visibility === undefined && (!opts.addUsers || opts.addUsers.length === 0) && (!opts.removeUsers || opts.removeUsers.length === 0)) {
+                        console.error('Provide at least one of --visibility, --add-users, --remove-users.');
+                        process.exit(1);
+                    }
+                    if (opts.visibility !== undefined && opts.visibility !== 'public' && opts.visibility !== 'company' && opts.visibility !== 'private') {
+                        console.error("Invalid --visibility: ".concat(opts.visibility, ". Use public, company, or private."));
+                        process.exit(1);
+                    }
+                    return [
+                        4,
+                        resolveAuthOrConfig()
+                    ];
+                case 1:
+                    auth = _state.sent();
+                    client = createClient(auth);
+                    _state.label = 2;
+                case 2:
+                    _state.trys.push([
+                        2,
+                        4,
+                        ,
+                        5
+                    ]);
+                    return [
+                        4,
+                        client.share(shortId, {
+                            visibility: opts.visibility,
+                            addUsers: opts.addUsers,
+                            removeUsers: opts.removeUsers
+                        })
+                    ];
+                case 3:
+                    result = _state.sent();
+                    console.log(JSON.stringify(result, null, 2));
+                    return [
+                        3,
+                        5
+                    ];
+                case 4:
+                    err = _state.sent();
+                    if (_instanceof(err, ApiError) && err.status === 402) {
+                        console.error('Error: Private visibility requires the Teams plan. Upgrade at https://display.dev/pricing');
+                        process.exit(1);
+                    }
+                    if (_instanceof(err, ApiError) && err.status === 404) {
+                        console.error("Artifact not found: ".concat(shortId));
+                        process.exit(4);
+                    }
+                    if (_instanceof(err, ApiError) && err.status === 401) {
+                        // 401 is always "credential expired / revoked" — sessions + api keys
+                        // both return it on an invalid secret. 403 is authorization ("you're
+                        // signed in but not allowed"), which we surface with the API's own
+                        // message below.
+                        console.error('Your credential is no longer valid. Run: dsp login (or rotate DISPLAYDEV_API_KEY).');
+                        process.exit(1);
+                    }
+                    if (_instanceof(err, ApiError) && (err.status === 400 || err.status === 403)) {
+                        console.error(err.message);
+                        process.exit(1);
+                    }
+                    msg = _instanceof(err, Error) ? err.message : String(err);
+                    console.error(msg);
+                    process.exit(1);
+                    return [
+                        3,
+                        5
+                    ];
+                case 5:
+                    return [
+                        2
+                    ];
+            }
+        });
+    })();
+});
 // --- find ---
 program.command('find [query]').description('Search for artifacts').option('--by <email>', 'Filter by publisher email').option('--mine', 'Show only artifacts you published').option('--since <date>', 'Filter by date (ISO format)').option('--sort <col>', 'Sort column: updated_at, view_count, name', 'updated_at').option('--dir <direction>', 'Sort direction: asc or desc').option('--limit <n>', 'Max rows to fetch (1-100)', function(v) {
     return parseInt(v, 10);
@@ -531,6 +721,76 @@ program.command('get <shortId>').description('Get artifact details').option('--i
         });
     })();
 });
+// --- export ---
+program.command('export <shortId>').description('Print the published source bytes to stdout. Pin a version with @<n>.').action(function(shortIdArg) {
+    return _async_to_generator(function() {
+        var parsed, auth, client, result, err, msg;
+        return _ts_generator(this, function(_state) {
+            switch(_state.label){
+                case 0:
+                    parsed = parseShortIdAndVersion(shortIdArg);
+                    if (!parsed) {
+                        console.error('Invalid argument. Expected <shortId> or <shortId>@<version> (version must be a positive integer).');
+                        process.exit(2);
+                    }
+                    return [
+                        4,
+                        resolveAuthOrConfig()
+                    ];
+                case 1:
+                    auth = _state.sent();
+                    client = createClient(auth);
+                    _state.label = 2;
+                case 2:
+                    _state.trys.push([
+                        2,
+                        4,
+                        ,
+                        5
+                    ]);
+                    return [
+                        4,
+                        client.exportSource(parsed.shortId, parsed.version)
+                    ];
+                case 3:
+                    result = _state.sent();
+                    return [
+                        3,
+                        5
+                    ];
+                case 4:
+                    err = _state.sent();
+                    if (_instanceof(err, ApiError)) {
+                        if (err.status === 404) {
+                            console.error('Artifact not found');
+                            process.exit(4);
+                        }
+                        if (err.status === 403) {
+                            console.error('Forbidden');
+                            process.exit(4);
+                        }
+                        if (err.status === 401) {
+                            console.error('Your credential is no longer valid. Run: dsp login (or rotate DISPLAYDEV_API_KEY).');
+                            process.exit(1);
+                        }
+                    }
+                    msg = _instanceof(err, Error) ? err.message : String(err);
+                    console.error(msg);
+                    process.exit(1);
+                    return [
+                        3,
+                        5
+                    ];
+                case 5:
+                    // Binary-clean: write Buffer directly, no console.log (which appends \n).
+                    process.stdout.write(result.data);
+                    return [
+                        2
+                    ];
+            }
+        });
+    })();
+});
 // --- delete ---
 program.command('delete <shortId>').description('Delete an artifact permanently').option('--confirm', 'Confirm deletion').action(function(shortId, opts) {
     return _async_to_generator(function() {
@@ -564,6 +824,9 @@ program.command('delete <shortId>').description('Delete an artifact permanently'
     })();
 });
 function openBrowser(url) {
+    if (process.env.DISPLAYDEV_SKIP_BROWSER) {
+        return;
+    }
     try {
         var os = platform();
         if (os === 'darwin') {
@@ -587,15 +850,10 @@ function openBrowser(url) {
     // URL is already printed — user can open it manually
     }
 }
-function sleep(ms) {
-    return new Promise(function(resolve) {
-        return setTimeout(resolve, ms);
-    });
-}
 // --- login ---
 program.command('login').description('Authenticate with display.dev').option('--email <email>', 'Email address').option('--code <code>', 'OTP code (verify step; pair with --email)').option('--api-key [key]', 'Authenticate with an API key').option('--json', 'Machine-readable output (structured status, no prose)').action(function(opts) {
     return _async_to_generator(function() {
-        var _process_env_DISPLAYDEV_API_URL, emit, emitErr, apiUrl, client, key, rl, validation, email, rl1, method, check, unused, err, msg, code, rl2, result, unused1, deviceResult, unused2, device_code, verification_uri_complete, initialInterval, interval, tokenResult, unused3, _$err;
+        var _process_env_DISPLAYDEV_API_URL, emit, emitErr, apiUrl, client, key, unused, rl, validation, email, rl1, method, check, unused1, err, msg, code, rl2, result, unused2, deviceResult, unused3, device_code, verification_uri_complete, initialInterval, expires_in, token, err1;
         return _ts_generator(this, function(_state) {
             switch(_state.label){
                 case 0:
@@ -623,7 +881,7 @@ program.command('login').description('Authenticate with display.dev').option('--
                     });
                     if (!(opts.apiKey !== undefined)) return [
                         3,
-                        8
+                        11
                     ];
                     if (!(typeof opts.apiKey === 'string')) return [
                         3,
@@ -632,54 +890,46 @@ program.command('login').description('Authenticate with display.dev').option('--
                     key = opts.apiKey;
                     return [
                         3,
-                        5
+                        8
                     ];
                 case 1:
                     if (!process.stdin.isTTY) return [
                         3,
-                        3
+                        6
                     ];
-                    // Mask input for interactive API key entry
+                    // Raw-mode input suppresses terminal echo.
                     process.stdout.write('API key: ');
+                    _state.label = 2;
+                case 2:
+                    _state.trys.push([
+                        2,
+                        4,
+                        ,
+                        5
+                    ]);
                     return [
                         4,
-                        new Promise(function(resolve) {
-                            var input = '';
-                            process.stdin.setRawMode(true);
-                            process.stdin.resume();
-                            process.stdin.setEncoding('utf8');
-                            var cleanup = function cleanup() {
-                                process.stdin.setRawMode(false);
-                                process.stdin.pause();
-                                process.stdin.removeListener('data', onData);
-                            };
-                            var onData = function onData(ch) {
-                                if (ch === '\r' || ch === '\n') {
-                                    cleanup();
-                                    process.stdout.write('\n');
-                                    resolve(input);
-                                } else if (ch === '\u0003') {
-                                    cleanup();
-                                    process.stdout.write('\n');
-                                    process.exit(1);
-                                } else if (ch === '\u007F' || ch === '\b') {
-                                    if (input.length > 0) {
-                                        input = input.slice(0, -1);
-                                    }
-                                } else {
-                                    input += ch;
-                                }
-                            };
-                            process.stdin.on('data', onData);
-                        })
+                        readApiKeyFromTty(process.stdin, process.stdout)
                     ];
-                case 2:
+                case 3:
                     key = _state.sent();
                     return [
                         3,
                         5
                     ];
-                case 3:
+                case 4:
+                    unused = _state.sent();
+                    process.exit(1);
+                    return [
+                        3,
+                        5
+                    ];
+                case 5:
+                    return [
+                        3,
+                        8
+                    ];
+                case 6:
                     // Non-TTY: read from stdin (piped input)
                     rl = createInterface({
                         input: process.stdin,
@@ -689,11 +939,11 @@ program.command('login').description('Authenticate with display.dev').option('--
                         4,
                         rl.question('API key: ')
                     ];
-                case 4:
+                case 7:
                     key = _state.sent();
                     rl.close();
-                    _state.label = 5;
-                case 5:
+                    _state.label = 8;
+                case 8:
                     key = key.trim();
                     if (!key) {
                         console.error('API key cannot be empty.');
@@ -703,7 +953,7 @@ program.command('login').description('Authenticate with display.dev').option('--
                         4,
                         client.validateApiKey(key)
                     ];
-                case 6:
+                case 9:
                     validation = _state.sent();
                     if (validation === 'invalid') {
                         emitErr('Invalid API key. Check the key and try again.', {
@@ -722,7 +972,7 @@ program.command('login').description('Authenticate with display.dev').option('--
                             apiUrl: apiUrl
                         })
                     ];
-                case 7:
+                case 10:
                     _state.sent();
                     emit('Authenticated.', {
                         status: 'authenticated',
@@ -731,12 +981,12 @@ program.command('login').description('Authenticate with display.dev').option('--
                     return [
                         2
                     ];
-                case 8:
+                case 11:
                     // --- Mode 1 & 2: Email-based login ---
                     email = opts.email;
                     if (!!email) return [
                         3,
-                        10
+                        13
                     ];
                     if (!process.stdin.isTTY) {
                         console.error('Email is required. Use --email <email> for non-interactive mode.');
@@ -750,67 +1000,67 @@ program.command('login').description('Authenticate with display.dev').option('--
                         4,
                         rl1.question('Email: ')
                     ];
-                case 9:
+                case 12:
                     email = _state.sent();
                     rl1.close();
-                    _state.label = 10;
-                case 10:
+                    _state.label = 13;
+                case 13:
                     email = email.trim();
                     // Check auth method
                     method = 'otp';
-                    _state.label = 11;
-                case 11:
+                    _state.label = 14;
+                case 14:
                     _state.trys.push([
-                        11,
-                        13,
+                        14,
+                        16,
                         ,
-                        14
+                        17
                     ]);
                     return [
                         4,
                         client.authCheck(email)
                     ];
-                case 12:
+                case 15:
                     check = _state.sent();
                     method = check.method;
                     return [
                         3,
-                        14
+                        17
                     ];
-                case 13:
-                    unused = _state.sent();
+                case 16:
+                    unused1 = _state.sent();
                     return [
                         3,
-                        14
+                        17
                     ];
-                case 14:
+                case 17:
                     if (!(method === 'otp')) return [
                         3,
-                        27
+                        30
                     ];
                     if (!!opts.code) return [
                         3,
-                        19
+                        22
                     ];
-                    _state.label = 15;
-                case 15:
+                    _state.label = 18;
+                case 18:
                     _state.trys.push([
-                        15,
-                        17,
+                        18,
+                        20,
                         ,
-                        18
+                        21
                     ]);
                     return [
                         4,
                         client.sendOtp(email)
                     ];
-                case 16:
+                case 19:
                     _state.sent();
                     return [
                         3,
-                        18
+                        21
                     ];
-                case 17:
+                case 20:
                     err = _state.sent();
                     msg = _instanceof(err, Error) ? err.message : 'Something went wrong';
                     if (msg.includes('requires SSO')) {
@@ -827,9 +1077,9 @@ program.command('login').description('Authenticate with display.dev').option('--
                     process.exit(1);
                     return [
                         3,
-                        18
+                        21
                     ];
-                case 18:
+                case 21:
                     if (!process.stdin.isTTY) {
                         // Non-interactive: exit after sending. The caller (typically an
                         // agent) will collect the OTP from the user and re-invoke with --code.
@@ -859,18 +1109,18 @@ program.command('login').description('Authenticate with display.dev').option('--
                     if (!opts.json) {
                         console.log("Code sent to ".concat(email));
                     }
-                    _state.label = 19;
-                case 19:
+                    _state.label = 22;
+                case 22:
                     if (!opts.code) return [
                         3,
-                        20
+                        23
                     ];
                     code = opts.code;
                     return [
                         3,
-                        22
+                        25
                     ];
-                case 20:
+                case 23:
                     rl2 = createInterface({
                         input: process.stdin,
                         output: process.stdout
@@ -879,22 +1129,22 @@ program.command('login').description('Authenticate with display.dev').option('--
                         4,
                         rl2.question('Enter the 6-digit code: ')
                     ];
-                case 21:
+                case 24:
                     code = _state.sent();
                     rl2.close();
-                    _state.label = 22;
-                case 22:
+                    _state.label = 25;
+                case 25:
                     _state.trys.push([
-                        22,
                         25,
+                        28,
                         ,
-                        26
+                        29
                     ]);
                     return [
                         4,
                         client.verifyOtp(email, code.trim())
                     ];
-                case 23:
+                case 26:
                     result = _state.sent();
                     return [
                         4,
@@ -903,7 +1153,7 @@ program.command('login').description('Authenticate with display.dev').option('--
                             apiUrl: apiUrl
                         })
                     ];
-                case 24:
+                case 27:
                     _state.sent();
                     emit("Logged in as ".concat(email), {
                         status: 'authenticated',
@@ -912,10 +1162,10 @@ program.command('login').description('Authenticate with display.dev').option('--
                     });
                     return [
                         3,
-                        26
+                        29
                     ];
-                case 25:
-                    unused1 = _state.sent();
+                case 28:
+                    unused2 = _state.sent();
                     emitErr('Invalid or expired code. Try again.', {
                         status: 'error',
                         error: 'invalid_or_expired_code'
@@ -923,142 +1173,98 @@ program.command('login').description('Authenticate with display.dev').option('--
                     process.exit(1);
                     return [
                         3,
-                        26
+                        29
                     ];
-                case 26:
+                case 29:
                     return [
                         3,
-                        40
+                        39
                     ];
-                case 27:
+                case 30:
                     // --- Mode 2: SSO device flow ---
                     console.log('Your organization requires SSO. Opening browser...');
-                    _state.label = 28;
-                case 28:
+                    _state.label = 31;
+                case 31:
                     _state.trys.push([
-                        28,
-                        30,
+                        31,
+                        33,
                         ,
-                        31
+                        34
                     ]);
                     return [
                         4,
                         client.requestDeviceCode('dsp-cli')
                     ];
-                case 29:
+                case 32:
                     deviceResult = _state.sent();
                     return [
                         3,
-                        31
+                        34
                     ];
-                case 30:
-                    unused2 = _state.sent();
+                case 33:
+                    unused3 = _state.sent();
                     console.error('Something went wrong. Check your connection and try again.');
                     process.exit(1);
                     return [
                         3,
-                        31
+                        34
                     ];
-                case 31:
-                    device_code = deviceResult.device_code, verification_uri_complete = deviceResult.verification_uri_complete, initialInterval = deviceResult.interval;
+                case 34:
+                    device_code = deviceResult.device_code, verification_uri_complete = deviceResult.verification_uri_complete, initialInterval = deviceResult.interval, expires_in = deviceResult.expires_in;
                     console.log();
                     console.log("  ".concat(verification_uri_complete));
                     console.log();
                     openBrowser(verification_uri_complete);
-                    // Poll for token
-                    interval = (initialInterval || 5) * 1000;
                     process.stdout.write('Waiting for authentication...');
-                    _state.label = 32;
-                case 32:
-                    if (!true) return [
-                        3,
-                        40
-                    ];
-                    return [
-                        4,
-                        sleep(interval)
-                    ];
-                case 33:
-                    _state.sent();
-                    tokenResult = void 0;
-                    _state.label = 34;
-                case 34:
+                    _state.label = 35;
+                case 35:
                     _state.trys.push([
-                        34,
-                        36,
+                        35,
+                        38,
                         ,
-                        37
+                        39
                     ]);
                     return [
                         4,
-                        client.pollDeviceToken(device_code, 'dsp-cli')
-                    ];
-                case 35:
-                    tokenResult = _state.sent();
-                    return [
-                        3,
-                        37
+                        pollDeviceToken(client, device_code, 'dsp-cli', {
+                            intervalMs: (initialInterval || 5) * 1000,
+                            expiresAt: Date.now() + (expires_in || 600) * 1000
+                        })
                     ];
                 case 36:
-                    unused3 = _state.sent();
-                    // Transient network error — retry on next interval
-                    return [
-                        3,
-                        32
-                    ];
-                case 37:
-                    if (!('access_token' in tokenResult)) return [
-                        3,
-                        39
-                    ];
+                    token = _state.sent();
                     console.log(' done');
                     return [
                         4,
                         saveConfig({
-                            token: tokenResult.access_token,
+                            token: token,
                             apiUrl: apiUrl
                         })
                     ];
-                case 38:
+                case 37:
                     _state.sent();
                     console.log("Logged in as ".concat(email));
                     return [
                         2
                     ];
-                case 39:
-                    _$err = tokenResult;
-                    if (_$err.error === 'authorization_pending') {
-                        return [
-                            3,
-                            32
-                        ];
-                    }
-                    if (_$err.error === 'slow_down') {
-                        interval += 5000;
-                        return [
-                            3,
-                            32
-                        ];
-                    }
-                    if (_$err.error === 'access_denied') {
-                        console.log();
+                case 38:
+                    err1 = _state.sent();
+                    console.log();
+                    if (_instanceof(err1, DeviceCodeDeniedError)) {
                         console.error('Authentication denied. Run dsp login to try again.');
-                        process.exit(1);
-                    }
-                    if (_$err.error === 'expired_token') {
-                        console.log();
+                    } else if (_instanceof(err1, DeviceCodeExpiredError)) {
                         console.error('Code expired. Run dsp login to try again.');
-                        process.exit(1);
+                    } else if (_instanceof(err1, DeviceCodeFailedError)) {
+                        console.error(err1.message || 'Authentication failed. Run dsp login to try again.');
+                    } else {
+                        console.error('Authentication failed. Run dsp login to try again.');
                     }
-                    // Unknown error
-                    console.log();
-                    console.error(_$err.error_description || 'Authentication failed. Run dsp login to try again.');
                     process.exit(1);
                     return [
                         3,
-                        32
+                        39
                     ];
-                case 40:
+                case 39:
                     return [
                         2
                     ];
@@ -1073,7 +1279,7 @@ program.command('branding <shortId> <mode>').description('Override display.dev b
         return _ts_generator(this, function(_state) {
             switch(_state.label){
                 case 0:
-                    mode = parseShowBrandingFlag(modeRaw);
+                    mode = parseShowBrandingOrExit(modeRaw);
                     if (!mode) {
                         console.error('mode is required');
                         process.exit(1);
@@ -1107,7 +1313,7 @@ program.command('branding <shortId> <mode>').description('Override display.dev b
                 case 4:
                     err = _state.sent();
                     msg = _instanceof(err, Error) ? err.message : String(err);
-                    if (/paid plan|upgrade/i.test(msg)) {
+                    if (classifyBrandingError(msg) === 'paid-plan') {
                         console.error('Error: Hiding display.dev branding requires a paid plan. See https://display.dev/billing');
                     } else {
                         console.error(msg);
@@ -1128,16 +1334,20 @@ program.command('branding <shortId> <mode>').description('Override display.dev b
 // --- mcp ---
 program.command('mcp').description('Start MCP server over stdin/stdout').action(function() {
     return _async_to_generator(function() {
-        var auth, client;
+        var auth, client, publicClient;
         return _ts_generator(this, function(_state) {
             switch(_state.label){
                 case 0:
                     return [
                         4,
-                        resolveAuthOrConfig()
+                        resolveAuthOrConfigOptional()
                     ];
                 case 1:
                     auth = _state.sent();
+                    if (!auth) return [
+                        3,
+                        3
+                    ];
                     client = new ApiClient({
                         baseUrl: auth.apiUrl,
                         apiKey: auth.apiKey,
@@ -1152,6 +1362,28 @@ program.command('mcp').description('Start MCP server over stdin/stdout').action(
                     return [
                         2
                     ];
+                case 3:
+                    // Unauthenticated: expose only `publish`, which maps to the public
+                    // claimable endpoint and returns a claim URL the user visits to own
+                    // the artifact. Workspace-bound tools are not registered — they have
+                    // no meaningful behaviour without auth and listing them would invite
+                    // agents to call them and error out.
+                    publicClient = new ApiClient({
+                        baseUrl: resolvePublicApiUrl(),
+                        apiKey: '',
+                        clientType: 'mcp-stdio'
+                    });
+                    return [
+                        4,
+                        startMcpServer(publicClient, {
+                            mode: 'public'
+                        })
+                    ];
+                case 4:
+                    _state.sent();
+                    return [
+                        2
+                    ];
             }
         });
     })();