@neopress/cli 4.1.0 → 4.3.0

package/dist/bin.cjs

@@ -3387,6 +3387,7 @@ function fail(message, code = 1) {
 // src/utils/config.ts
 var import_node_fs2 = require("fs");
 var import_node_path2 = require("path");
+var import_node_os2 = require("os");
 
 // src/utils/token-store.ts
 var import_node_fs = require("fs");
@@ -3421,31 +3422,55 @@ function clearSession() {
 // src/utils/config.ts
 var PROJECT_CONFIG = ".neopressrc.json";
 var WORKSPACE_CONFIG = ".neopress/config.json";
-function readProjectConfig() {
-  let config2 = {};
-  for (const file2 of [PROJECT_CONFIG, WORKSPACE_CONFIG]) {
-    try {
-      const parsed = JSON.parse((0, import_node_fs2.readFileSync)(file2, "utf-8"));
-      config2 = {
-        ...config2,
-        ...typeof parsed.siteId === "number" ? { siteId: parsed.siteId } : {},
-        ...typeof parsed.baseUrl === "string" ? { baseUrl: parsed.baseUrl } : {}
-      };
-    } catch {
+function readConfigFileAt(path) {
+  try {
+    const parsed = JSON.parse((0, import_node_fs2.readFileSync)(path, "utf-8"));
+    return {
+      ...typeof parsed.siteId === "number" ? { siteId: parsed.siteId } : {},
+      ...typeof parsed.baseUrl === "string" ? { baseUrl: parsed.baseUrl } : {}
+    };
+  } catch {
+    return {};
+  }
+}
+function locateProjectConfig(startDir = process.cwd()) {
+  const home = (0, import_node_path2.resolve)((0, import_node_os2.homedir)());
+  let dir = (0, import_node_path2.resolve)(startDir);
+  while (true) {
+    let merged = {};
+    let foundPath;
+    for (const rel of [PROJECT_CONFIG, WORKSPACE_CONFIG]) {
+      const p = (0, import_node_path2.join)(dir, rel);
+      const cfg = readConfigFileAt(p);
+      if (Object.keys(cfg).length > 0) {
+        merged = { ...merged, ...cfg };
+        if (!foundPath) foundPath = p;
+      }
     }
+    if (Object.keys(merged).length > 0) return { config: merged, path: foundPath };
+    const parent = (0, import_node_path2.dirname)(dir);
+    if (dir === home || parent === dir) break;
+    dir = parent;
   }
-  return config2;
+  return { config: {} };
+}
+function readProjectConfig() {
+  return locateProjectConfig().config;
 }
 function writeWorkspaceConfig(next) {
   (0, import_node_fs2.mkdirSync)((0, import_node_path2.dirname)(WORKSPACE_CONFIG), { recursive: true });
   (0, import_node_fs2.writeFileSync)(WORKSPACE_CONFIG, JSON.stringify(next, null, 2) + "\n", "utf-8");
 }
-function getSiteId() {
-  const envSiteId = process.env.NEOPRESS_SITE_ID;
-  if (envSiteId) return parseInt(envSiteId, 10);
-  const projectConfig = readProjectConfig();
-  if (projectConfig.siteId) return projectConfig.siteId;
-  return loadSession().activeSiteId;
+function writeProjectSiteId(siteId) {
+  let raw = {};
+  try {
+    const parsed = JSON.parse((0, import_node_fs2.readFileSync)(PROJECT_CONFIG, "utf-8"));
+    if (parsed && typeof parsed === "object") raw = parsed;
+  } catch {
+  }
+  const next = { ...raw, siteId };
+  (0, import_node_fs2.writeFileSync)(PROJECT_CONFIG, JSON.stringify(next, null, 2) + "\n", "utf-8");
+  return (0, import_node_path2.resolve)(PROJECT_CONFIG);
 }
 function getBaseUrl() {
   return process.env.NEOPRESS_BASE_URL || readProjectConfig().baseUrl || "https://app.neopress.ai";
@@ -3461,12 +3486,24 @@ var siteOverride;
 function setSiteOverride(value) {
   siteOverride = value;
 }
-function getSiteTarget() {
+function resolveSiteTarget() {
   if (siteOverride) {
     const n = parseInt(siteOverride, 10);
-    return String(n) === siteOverride ? n : siteOverride;
+    const value = String(n) === siteOverride ? n : siteOverride;
+    return { value, source: "flag", detail: "--site" };
+  }
+  const envSiteId = process.env.NEOPRESS_SITE_ID;
+  if (envSiteId) return { value: parseInt(envSiteId, 10), source: "env", detail: "NEOPRESS_SITE_ID" };
+  const located = locateProjectConfig();
+  if (typeof located.config.siteId === "number") {
+    return { value: located.config.siteId, source: "project-config", detail: located.path };
   }
-  return getSiteId();
+  const active = loadSession().activeSiteId;
+  if (active) return { value: active, source: "global-active", detail: "sites use" };
+  return { value: void 0, source: "none" };
+}
+function getSiteTarget() {
+  return resolveSiteTarget().value;
 }
 
 // src/utils/pkce.ts
@@ -3759,11 +3796,11 @@ function __rest(s, e) {
 }
 function __awaiter(thisArg, _arguments, P, generator) {
   function adopt(value) {
-    return value instanceof P ? value : new P(function(resolve) {
-      resolve(value);
+    return value instanceof P ? value : new P(function(resolve2) {
+      resolve2(value);
     });
   }
-  return new (P || (P = Promise))(function(resolve, reject) {
+  return new (P || (P = Promise))(function(resolve2, reject) {
     function fulfilled(value) {
       try {
         step(generator.next(value));
@@ -3779,7 +3816,7 @@ function __awaiter(thisArg, _arguments, P, generator) {
       }
     }
     function step(result) {
-      result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected);
+      result.done ? resolve2(result.value) : adopt(result.value).then(fulfilled, rejected);
     }
     step((generator = generator.apply(thisArg, _arguments || [])).next());
   });
@@ -4150,18 +4187,18 @@ var PostgrestError = class extends Error {
   }
 };
 function sleep(ms, signal) {
-  return new Promise((resolve) => {
+  return new Promise((resolve2) => {
     if (signal === null || signal === void 0 ? void 0 : signal.aborted) {
-      resolve();
+      resolve2();
       return;
     }
     const id = setTimeout(() => {
       signal === null || signal === void 0 || signal.removeEventListener("abort", onAbort);
-      resolve();
+      resolve2();
     }, ms);
     function onAbort() {
       clearTimeout(id);
-      resolve();
+      resolve2();
     }
     signal === null || signal === void 0 || signal.addEventListener("abort", onAbort);
   });
@@ -12110,15 +12147,15 @@ var RealtimeChannel = class _RealtimeChannel {
         }
       }
     } else {
-      return new Promise((resolve) => {
+      return new Promise((resolve2) => {
         var _a3, _b2, _c;
         const push = this.channelAdapter.push(args.type, args, opts.timeout || this.timeout);
         if (args.type === "broadcast" && !((_c = (_b2 = (_a3 = this.params) === null || _a3 === void 0 ? void 0 : _a3.config) === null || _b2 === void 0 ? void 0 : _b2.broadcast) === null || _c === void 0 ? void 0 : _c.ack)) {
-          resolve("ok");
+          resolve2("ok");
         }
-        push.receive("ok", () => resolve("ok"));
-        push.receive("error", () => resolve("error"));
-        push.receive("timeout", () => resolve("timed out"));
+        push.receive("ok", () => resolve2("ok"));
+        push.receive("error", () => resolve2("error"));
+        push.receive("timeout", () => resolve2("timed out"));
       });
     }
   }
@@ -12143,8 +12180,8 @@ var RealtimeChannel = class _RealtimeChannel {
    * @category Realtime
    */
   async unsubscribe(timeout = this.timeout) {
-    return new Promise((resolve) => {
-      this.channelAdapter.unsubscribe(timeout).receive("ok", () => resolve("ok")).receive("timeout", () => resolve("timed out")).receive("error", () => resolve("error"));
+    return new Promise((resolve2) => {
+      this.channelAdapter.unsubscribe(timeout).receive("ok", () => resolve2("ok")).receive("timeout", () => resolve2("timed out")).receive("error", () => resolve2("error"));
     });
   }
   /**
@@ -12225,8 +12262,8 @@ var RealtimeChannel = class _RealtimeChannel {
   }
   /** @internal */
   _notThisChannelEvent(event, ref) {
-    const { close, error: error48, leave, join: join2 } = CHANNEL_EVENTS;
-    const events = [close, error48, leave, join2];
+    const { close, error: error48, leave, join: join3 } = CHANNEL_EVENTS;
+    const events = [close, error48, leave, join3];
     return ref && events.includes(event) && ref !== this.joinPush.ref;
   }
   /** @internal */
@@ -12339,11 +12376,11 @@ var SocketAdapter = class {
     this.socket.connect();
   }
   disconnect(callback, code, reason, timeout = 1e4) {
-    return new Promise((resolve) => {
-      setTimeout(() => resolve("timeout"), timeout);
+    return new Promise((resolve2) => {
+      setTimeout(() => resolve2("timeout"), timeout);
       this.socket.disconnect(() => {
         callback();
-        resolve("ok");
+        resolve2("ok");
       }, code, reason);
     });
   }
@@ -13757,7 +13794,7 @@ var _getRequestParams = (method, options, parameters, body) => {
   return _objectSpread22(_objectSpread22({}, params), parameters);
 };
 async function _handleRequest(fetcher, method, url2, options, parameters, body, namespace) {
-  return new Promise((resolve, reject) => {
+  return new Promise((resolve2, reject) => {
     fetcher(url2, _getRequestParams(method, options, parameters, body)).then((result) => {
       if (!result.ok) throw result;
       if (options === null || options === void 0 ? void 0 : options.noResolveJson) return result;
@@ -13767,7 +13804,7 @@ async function _handleRequest(fetcher, method, url2, options, parameters, body,
         if (!contentType || !contentType.includes("application/json")) return {};
       }
       return result.json();
-    }).then((data) => resolve(data)).catch((error48) => handleError(error48, reject, options, namespace));
+    }).then((data) => resolve2(data)).catch((error48) => handleError(error48, reject, options, namespace));
   });
 }
 function createFetchApi(namespace = "storage") {
@@ -24012,11 +24049,11 @@ var DEFAULT_TRACE_PROPAGATION_OPTIONS = {
 };
 function __awaiter2(thisArg, _arguments, P, generator) {
   function adopt(value) {
-    return value instanceof P ? value : new P(function(resolve) {
-      resolve(value);
+    return value instanceof P ? value : new P(function(resolve2) {
+      resolve2(value);
     });
   }
-  return new (P || (P = Promise))(function(resolve, reject) {
+  return new (P || (P = Promise))(function(resolve2, reject) {
     function fulfilled(value) {
       try {
         step(generator.next(value));
@@ -24032,7 +24069,7 @@ function __awaiter2(thisArg, _arguments, P, generator) {
       }
     }
     function step(result) {
-      result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected);
+      result.done ? resolve2(result.value) : adopt(result.value).then(fulfilled, rejected);
     }
     step((generator = generator.apply(thisArg, _arguments || [])).next());
   });
@@ -24961,7 +24998,8 @@ var PagesEndpoint = class {
   }
   async list(params) {
     const { page, limit, offset } = this.client.resolvePagination(params);
-    let query = this.client.db.from("pages").select("*", { count: "exact" }).eq("site_id", this.client.siteIdNumber).is("draft_deleted_at", null).order("path");
+    let query = this.client.db.from("pages").select("*", { count: "exact" }).eq("site_id", this.client.siteIdNumber).is("draft_deleted_at", null);
+    query = params?.order ? query.order("created_at", { ascending: params.order === "asc" }) : query.order("path");
     if (params?.status)
       query = query.eq("status", params.status);
     const { data, error: error48, count } = await query.range(offset, offset + limit - 1);
@@ -39254,8 +39292,8 @@ var SiteHistoryService = class _SiteHistoryService {
     const previousLock = _SiteHistoryService.sessionLocks.get(key) ?? Promise.resolve();
     let releaseCurrentLock = () => {
     };
-    const currentLock = new Promise((resolve) => {
-      releaseCurrentLock = resolve;
+    const currentLock = new Promise((resolve2) => {
+      releaseCurrentLock = resolve2;
     });
     const queuedLock = previousLock.catch(() => {
     }).then(() => currentLock);
@@ -40015,8 +40053,10 @@ var CollectionsEndpoint = class {
   get basePath() {
     return `${this.client.siteBasePath}/collections`;
   }
-  async list() {
-    const { data, error: error48 } = await this.client.db.from("collections").select("*").eq("site_id", this.client.siteIdNumber).is("draft_deleted_at", null).order("name");
+  async list(params) {
+    let query = this.client.db.from("collections").select("*").eq("site_id", this.client.siteIdNumber).is("draft_deleted_at", null);
+    query = params?.order ? query.order("created_at", { ascending: params.order === "asc" }) : query.order("name");
+    const { data, error: error48 } = await query;
     if (error48)
       throw new NeopressApiError("DB_ERROR", error48.message, 0, error48);
     return (data ?? []).map((r) => serializeCollection(r));
@@ -40089,7 +40129,7 @@ var EntriesEndpoint = class {
   }
   async list(collectionId, params) {
     const { page, limit, offset } = this.client.resolvePagination(params);
-    let query = this.client.db.from("entries").select("*", { count: "exact" }).eq("site_id", this.client.siteIdNumber).eq("collection_id", collectionId).is("deleted_at", null).order("created_at", { ascending: false });
+    let query = this.client.db.from("entries").select("*", { count: "exact" }).eq("site_id", this.client.siteIdNumber).eq("collection_id", collectionId).is("deleted_at", null).order("created_at", { ascending: params?.order === "asc" });
     if (params?.status)
       query = query.eq("status", params.status);
     if (params?.locale)
@@ -40180,8 +40220,10 @@ var FormsEndpoint = class {
   get basePath() {
     return `${this.client.siteBasePath}/forms`;
   }
-  async list() {
-    const { data, error: error48 } = await this.client.db.from("forms").select("*").eq("site_id", this.client.siteIdNumber).is("draft_deleted_at", null).order("name");
+  async list(params) {
+    let query = this.client.db.from("forms").select("*").eq("site_id", this.client.siteIdNumber).is("draft_deleted_at", null);
+    query = params?.order ? query.order("created_at", { ascending: params.order === "asc" }) : query.order("name");
+    const { data, error: error48 } = await query;
     if (error48)
       throw new NeopressApiError("DB_ERROR", error48.message, 0, error48);
     const rows = data ?? [];
@@ -40260,7 +40302,7 @@ var AssetsEndpoint = class {
   }
   async list(params) {
     const { page, limit, offset } = this.client.resolvePagination(params);
-    const { data, error: error48, count } = await this.client.db.from("assets").select("*", { count: "exact" }).eq("site_id", this.client.siteIdNumber).order("created_at", { ascending: false }).range(offset, offset + limit - 1);
+    const { data, error: error48, count } = await this.client.db.from("assets").select("*", { count: "exact" }).eq("site_id", this.client.siteIdNumber).order("created_at", { ascending: params?.order === "asc" }).range(offset, offset + limit - 1);
     if (error48)
       throw new NeopressApiError("DB_ERROR", error48.message, 0, error48);
     const rows = data ?? [];
@@ -40326,7 +40368,7 @@ var SiteEndpoint = class {
   constructor(client) {
     this.client = client;
   }
-  async list() {
+  async list(params) {
     const profileId = this.client.authUserId;
     if (!profileId) {
       throw new NeopressApiError("NO_AUTH", "site.list requires an authenticated access token", 0);
@@ -40334,10 +40376,15 @@ var SiteEndpoint = class {
     const { data, error: error48 } = await this.client.db.from("sites_profiles").select("role, sites!inner(*)").eq("profile_id", profileId).eq("status", "active");
     if (error48)
       throw new NeopressApiError("DB_ERROR", error48.message, 0, error48);
-    return (data ?? []).map((m) => ({
+    const sites = (data ?? []).map((m) => ({
       ...serializeSite(m.sites),
       role: m.role
     }));
+    if (params?.order) {
+      const dir = params.order === "asc" ? 1 : -1;
+      sites.sort((a, b) => (a.createdAt ?? "") < (b.createdAt ?? "") ? -dir : (a.createdAt ?? "") > (b.createdAt ?? "") ? dir : 0);
+    }
+    return sites;
   }
   async get() {
     const { data, error: error48 } = await this.client.db.from("sites").select("*").eq("id", this.client.siteIdNumber).single();
@@ -40375,8 +40422,10 @@ var RedirectsEndpoint = class {
   constructor(client) {
     this.client = client;
   }
-  async list() {
-    const { data, error: error48 } = await this.client.db.from("redirect_rules").select("*").eq("site_id", this.client.siteIdNumber).order("priority", { ascending: true });
+  async list(params) {
+    let query = this.client.db.from("redirect_rules").select("*").eq("site_id", this.client.siteIdNumber);
+    query = params?.order ? query.order("created_at", { ascending: params.order === "asc" }) : query.order("priority", { ascending: true });
+    const { data, error: error48 } = await query;
     if (error48)
       throw new NeopressApiError("DB_ERROR", error48.message, 0, error48);
     return (data ?? []).map((r) => serializeRedirect(r));
@@ -40453,7 +40502,7 @@ var EntryReferencesEndpoint = class {
       query = query.eq("from_entry_id", params.fromEntryId);
     if (params?.toEntryId)
       query = query.eq("to_entry_id", params.toEntryId);
-    const { data, error: error48 } = await query.order("created_at", { ascending: false });
+    const { data, error: error48 } = await query.order("created_at", { ascending: params?.order === "asc" });
     if (error48)
       throw new NeopressApiError("DB_ERROR", error48.message, 0, error48);
     return (data ?? []).map((r) => serializeEntryReference(r));
@@ -40575,18 +40624,57 @@ var TemplatesEndpoint = class {
     const res = await this.client.delete(this.basePath);
     return res.data;
   }
+  /**
+   * List templates across the sites the caller can access.
+   *
+   * Direct-DB: `templates` is public-read and `sites` RLS scopes the visible set
+   * (own active memberships, or all sites for the super admin), so no server
+   * route is needed — the two RLS-scoped queries reproduce the old handler.
+   */
   async list(params) {
-    const qs = new URLSearchParams();
-    if (params?.namePrefix)
-      qs.set("namePrefix", params.namePrefix);
-    if (params?.industry)
-      qs.set("industry", params.industry);
-    if (params?.limit != null)
-      qs.set("limit", String(params.limit));
-    const query = qs.toString();
-    const path = query ? `/api/v1/templates?${query}` : "/api/v1/templates";
-    const res = await this.client.get(path);
-    return res.data;
+    const { data: sitesData, error: sitesError } = await this.client.db.from("sites").select("id, handle, name");
+    if (sitesError)
+      throw new NeopressApiError("DB_ERROR", sitesError.message, 0, sitesError);
+    const siteMeta = /* @__PURE__ */ new Map();
+    for (const site of sitesData ?? []) {
+      if (typeof site.id !== "number")
+        continue;
+      siteMeta.set(site.id, {
+        handle: site.handle ?? null,
+        name: site.name ?? null
+      });
+    }
+    const siteIds = [...siteMeta.keys()];
+    if (siteIds.length === 0)
+      return [];
+    const namePrefix = params?.namePrefix?.trim();
+    const industry = params?.industry?.trim();
+    const limit = Math.min(Math.max(params?.limit ?? 100, 1), 500);
+    let query = this.client.db.from("templates").select("id, name, industry, reference_url, preview_img_urls, description, created_at").in("id", siteIds);
+    if (namePrefix)
+      query = query.ilike("name", `${namePrefix}%`);
+    if (industry)
+      query = query.eq("industry", industry);
+    if (params?.order)
+      query = query.order("created_at", { ascending: params.order === "asc" });
+    query = query.limit(limit);
+    const { data, error: error48 } = await query;
+    if (error48)
+      throw new NeopressApiError("DB_ERROR", error48.message, 0, error48);
+    return (data ?? []).map((t) => {
+      const siteId = t.id;
+      return {
+        siteId,
+        handle: siteMeta.get(siteId)?.handle ?? null,
+        siteName: siteMeta.get(siteId)?.name ?? null,
+        name: t.name,
+        industry: t.industry,
+        referenceUrl: t.reference_url,
+        previewImgUrls: t.preview_img_urls ?? null,
+        description: t.description ?? null,
+        createdAt: t.created_at
+      };
+    });
   }
 };
 
@@ -40609,7 +40697,12 @@ var HeadshotsEndpoint = class {
       query = query.eq("attire", params.attire);
     if (params?.isActive !== void 0)
       query = query.eq("is_active", params.isActive);
-    const { data, error: error48, count } = await query.order("age_band", { ascending: true }).order("gender", { ascending: true }).order("ethnicity", { ascending: true }).order("variation_index", { ascending: true }).range(offset, offset + limit - 1);
+    if (params?.order) {
+      query = query.order("created_at", { ascending: params.order === "asc" });
+    } else {
+      query = query.order("age_band", { ascending: true }).order("gender", { ascending: true }).order("ethnicity", { ascending: true }).order("variation_index", { ascending: true });
+    }
+    const { data, error: error48, count } = await query.range(offset, offset + limit - 1);
     if (error48)
       throw new NeopressApiError("DB_ERROR", error48.message, 0, error48);
     return {
@@ -40875,17 +40968,29 @@ async function getGlobalClientAsync() {
   return new NeopressClient({ accessToken: token, siteId: 0, baseUrl: getBaseUrl(), supabaseUrl: sb.url, supabaseAnonKey: sb.anonKey });
 }
 
+// src/utils/order.ts
+function parseOrder(value) {
+  if (value === void 0) return void 0;
+  if (value !== "asc" && value !== "desc") {
+    fail(`Invalid --order value "${value}". Use "asc" or "desc".`);
+  }
+  return value;
+}
+var ORDER_OPTION_DESC = "Sort by created_at (asc or desc)";
+
 // src/commands/sites.ts
 function registerSiteCommands(program3) {
   const sites = program3.command("sites").description("Manage sites").addHelpText("after", `
 Examples:
   $ neopress sites list
   $ neopress sites create --name "My Site" --handle my-site --use
+  $ neopress sites create --name "My Site" --handle my-site --pin
   $ neopress sites use my-site
-Run \`sites use <id|handle>\` to set the active site for all other commands.`);
-  sites.command("list").description("List accessible sites").action(async () => {
+  $ neopress sites current
+Run \`sites use <id|handle>\` to set the global active site, or \`sites create --pin\` to scope a site to the current directory. \`sites current\` shows which site commands will target and why.`);
+  sites.command("list").description("List accessible sites").option("--order <asc|desc>", ORDER_OPTION_DESC).action(async (options) => {
     const client = await getGlobalClientAsync();
-    const sitesList = await client.site.list();
+    const sitesList = await client.site.list({ order: parseOrder(options.order) });
     output(sitesList);
   });
   sites.command("use <siteIdOrHandle>").description("Set active site (ID or handle)").addHelpText("after", `
@@ -40913,10 +41018,14 @@ Examples:
   $ neopress sites create --name "My Site" --handle my-site
   $ neopress sites create --prompt "a portfolio for a freelance photographer" --use
   $ neopress sites create --name Acme --handle acme --language en
-Pass --prompt to auto-generate name/handle, or supply both --name and --handle. --language sets the default content locale (default en). --use sets the new site as active.`).option("--name <name>", "Site name").option("--handle <handle>", "Site handle").option("--prompt <prompt>", "Prompt to generate site name/handle").option("--language <locale>", "Default content locale", "en").option("--use", "Set the created site as active").action(async (options) => {
+Pass --prompt to auto-generate name/handle, or supply both --name and --handle. --language sets the default content locale (default en).
+--use sets the new site as the GLOBAL active site (shared across all directories). --pin instead writes ./.neopressrc.json for THIS directory only, leaving the global active site untouched \u2014 prefer it for parallel/automated runs so concurrent builds don't stomp each other's active site.`).option("--name <name>", "Site name").option("--handle <handle>", "Site handle").option("--prompt <prompt>", "Prompt to generate site name/handle").option("--language <locale>", "Default content locale", "en").option("--use", "Set the created site as the global active site").option("--pin", "Pin the created site to this directory via ./.neopressrc.json (no global state)").action(async (options) => {
     if (!options.prompt && !(options.name && options.handle)) {
       fail("Provide --prompt or both --name and --handle.");
     }
+    if (options.use && options.pin) {
+      fail("Pass only one of --use (global active site) or --pin (this directory only).");
+    }
     const client = await getGlobalClientAsync();
     const site = await client.site.create({
       siteName: options.name,
@@ -40924,17 +41033,26 @@ Pass --prompt to auto-generate name/handle, or supply both --name and --handle.
       prompt: options.prompt,
       language: options.language
     });
-    if (options.use) {
-      setActiveSiteId(site.id);
-    }
+    if (options.use) setActiveSiteId(site.id);
+    let pinnedPath;
+    if (options.pin) pinnedPath = writeProjectSiteId(site.id);
     output(site);
-    if (options.use && !isJsonMode()) ok(`Active site set to ${site.id}`);
+    if (!isJsonMode()) {
+      if (options.use) ok(`Active site set to ${site.id}`);
+      if (options.pin) ok(`Pinned site ${site.id} for this directory (${pinnedPath})`);
+    }
   });
   sites.command("get").description("Get current site info").action(async () => {
     const client = await getClientAsync();
     const site = await client.site.get();
     output(site);
   });
+  sites.command("current").description("Show which site commands will target, and where it resolved from").addHelpText("after", `
+Resolution order: --site flag > NEOPRESS_SITE_ID > .neopressrc.json/.neopress/config.json (cwd and up) > global active site (set by \`sites use\`).
+Local check only \u2014 it does not contact the server. Unlike \`whoami\` (which always reports the global active site), this reports the site your next command will actually hit.`).action(() => {
+    const { value, source, detail } = resolveSiteTarget();
+    output({ siteId: value ?? null, source, resolvedFrom: detail ?? null });
+  });
   sites.command("update").description("Update site settings").addHelpText("after", `
 Examples:
   $ neopress sites update --name "New Name"
@@ -40969,9 +41087,9 @@ Permanently deletes the site and all its content (workspace admin only) \u2014 t
       const { createInterface } = await import("readline");
       const rl = createInterface({ input: process.stdin, output: process.stdout });
       const answer = await new Promise(
-        (resolve) => rl.question(`Delete site "${siteIdOrHandle}" and ALL its content? Type the id/handle to confirm: `, (a) => {
+        (resolve2) => rl.question(`Delete site "${siteIdOrHandle}" and ALL its content? Type the id/handle to confirm: `, (a) => {
           rl.close();
-          resolve(a.trim());
+          resolve2(a.trim());
         })
       );
       if (answer !== siteIdOrHandle) {
@@ -41026,10 +41144,11 @@ Examples:
   $ neopress pages compile <pageId>
 
 Draft content fields (--tsx/--i18n/--draft-meta) need \`neopress publish\` to go live. \`pages delete\` is a soft delete.`);
-  pages.command("list").description("List pages").option("--status <status>", "Filter by status (draft/published)").option("--page <n>", "Page number", "1").option("--limit <n>", "Results per page", "20").action(async (options) => {
+  pages.command("list").description("List pages").option("--status <status>", "Filter by status (draft/published)").option("--order <asc|desc>", ORDER_OPTION_DESC).option("--page <n>", "Page number", "1").option("--limit <n>", "Results per page", "20").action(async (options) => {
     const client = await getClientAsync();
     const res = await client.pages.list({
       status: options.status,
+      order: parseOrder(options.order),
       page: parseInt(options.page, 10),
       limit: parseInt(options.limit, 10)
     });
@@ -41126,9 +41245,9 @@ Examples:
   $ neopress collections update 12 --schema @schema.json
 
 Collections are identified by numeric id, never name. delete is a soft delete \u2014 the collection is hidden from list/get but its row is retained.`);
-  collections.command("list").description("List collections").action(async () => {
+  collections.command("list").description("List collections").option("--order <asc|desc>", ORDER_OPTION_DESC).action(async (options) => {
     const client = await getClientAsync();
-    const data = await client.collections.list();
+    const data = await client.collections.list({ order: parseOrder(options.order) });
     output(data);
   });
   collections.command("get <collectionId>").description("Get collection details").action(async (collectionId) => {
@@ -41186,11 +41305,12 @@ Examples:
   $ neopress entries publish <entryId>
 
 Entries are created as drafts \u2014 run \`neopress entries publish <entryId>\` to make them live. create/update/delete revalidate the reader cache; delete is a soft delete.`);
-  entries.command("list").description("List entries in a collection").requiredOption("--collection <id>", "Collection ID").option("--status <status>", "Filter by status").option("--locale <locale>", "Filter by locale").option("--page <n>", "Page number", "1").option("--limit <n>", "Results per page", "20").action(async (options) => {
+  entries.command("list").description("List entries in a collection").requiredOption("--collection <id>", "Collection ID").option("--status <status>", "Filter by status").option("--locale <locale>", "Filter by locale").option("--order <asc|desc>", ORDER_OPTION_DESC).option("--page <n>", "Page number", "1").option("--limit <n>", "Results per page", "20").action(async (options) => {
     const client = await getClientAsync();
     const res = await client.entries.list(parseInt(options.collection, 10), {
       status: options.status,
       locale: options.locale,
+      order: parseOrder(options.order),
       page: parseInt(options.page, 10),
       limit: parseInt(options.limit, 10)
     });
@@ -41280,9 +41400,9 @@ Examples:
   $ neopress forms publish <formId>
   $ neopress forms responses <formId> --limit 50
 Forms are created as drafts \u2014 run \`neopress forms publish <formId>\` to make them live. JSON options take inline JSON or @file.`);
-  forms.command("list").description("List forms").action(async () => {
+  forms.command("list").description("List forms").option("--order <asc|desc>", ORDER_OPTION_DESC).action(async (options) => {
     const client = await getClientAsync();
-    const data = await client.forms.list();
+    const data = await client.forms.list({ order: parseOrder(options.order) });
     output(data);
   });
   forms.command("get <formId>").description("Get form details").action(async (formId) => {
@@ -41362,9 +41482,10 @@ Examples:
   $ neopress assets upload ./hero.png --folder images
   $ neopress assets list --limit 50
 Upload runs presign \u2192 PUT to storage \u2192 register in one step; content type is inferred from the file extension.`);
-  assets.command("list").description("List assets").option("--page <n>", "Page number", "1").option("--limit <n>", "Results per page", "20").action(async (options) => {
+  assets.command("list").description("List assets").option("--order <asc|desc>", ORDER_OPTION_DESC).option("--page <n>", "Page number", "1").option("--limit <n>", "Results per page", "20").action(async (options) => {
     const client = await getClientAsync();
     const res = await client.assets.list({
+      order: parseOrder(options.order),
       page: parseInt(options.page, 10),
       limit: parseInt(options.limit, 10)
     });
@@ -41447,9 +41568,9 @@ Examples:
   $ neopress redirects create --source /docs --dest /guide --type 308
   $ neopress redirects list
 Rules are created enabled. delete <ruleId> removes a rule permanently.`);
-  redirects.command("list").description("List redirect rules").action(async () => {
+  redirects.command("list").description("List redirect rules").option("--order <asc|desc>", `${ORDER_OPTION_DESC} (default sort: priority)`).action(async (options) => {
     const client = await getClientAsync();
-    const data = await client.redirects.list();
+    const data = await client.redirects.list({ order: parseOrder(options.order) });
     output(data);
   });
   redirects.command("create").description("Create a redirect rule").addHelpText("after", `
@@ -41512,11 +41633,12 @@ Examples:
   $ neopress entry-references list --from-entry 12
   $ neopress entry-references delete <referenceId>
 --field is a reference field key from the source entry's collection schema. delete is a hard delete and removes the relation immediately.`);
-  refs.command("list").description("List entry references").option("--from-entry <id>", "Filter by source entry ID").option("--to-entry <id>", "Filter by target entry ID").action(async (options) => {
+  refs.command("list").description("List entry references").option("--from-entry <id>", "Filter by source entry ID").option("--to-entry <id>", "Filter by target entry ID").option("--order <asc|desc>", ORDER_OPTION_DESC).action(async (options) => {
     const client = await getClientAsync();
     const data = await client.entryReferences.list({
       fromEntryId: options.fromEntry ? parseInt(options.fromEntry, 10) : void 0,
-      toEntryId: options.toEntry ? parseInt(options.toEntry, 10) : void 0
+      toEntryId: options.toEntry ? parseInt(options.toEntry, 10) : void 0,
+      order: parseOrder(options.order)
     });
     output(data);
   });
@@ -41678,15 +41800,12 @@ Examples:
   $ neopress templates list --industry saas --limit 50
   $ neopress templates delete
 \`templates mark\` operates on the active site. \`templates delete\` permanently removes the template metadata AND the connected site \u2014 it is destructive and not recoverable.`);
-  templates.command("list").description("List templates across sites you can access").option("--name-prefix <prefix>", "Filter by template name prefix").option("--industry <industry>", "Filter by industry key").option("--limit <n>", "Max results (default 100, max 500)").action(async (options) => {
-    const token = process.env.NEOPRESS_ACCESS_TOKEN || await getValidAccessToken() || void 0;
-    if (!token) {
-      fail("Not authenticated. Run `neopress login`.");
-    }
-    const client = new NeopressClient({ accessToken: token, siteId: 0, baseUrl: getBaseUrl() });
+  templates.command("list").description("List templates across sites you can access").option("--name-prefix <prefix>", "Filter by template name prefix").option("--industry <industry>", "Filter by industry key").option("--order <asc|desc>", ORDER_OPTION_DESC).option("--limit <n>", "Max results (default 100, max 500)").action(async (options) => {
+    const client = await getGlobalClientAsync();
     const templates2 = await client.templates.list({
       namePrefix: options.namePrefix,
       industry: options.industry,
+      order: parseOrder(options.order),
       limit: options.limit ? parseInt(options.limit, 10) : void 0
     });
     output(templates2);
@@ -41751,7 +41870,7 @@ Examples:
   $ neopress headshots create --image-url https://cdn/x.webp --age-band young --gender male --ethnicity white --variation-index 0
   $ neopress headshots update 12 --inactive
 The pool is global and RLS-gated: only the super-admin account can read or write it. No active site is needed.`);
-  headshots.command("list").description("List headshot pool entries").option("--age-band <band>", `Filter by age band (${AGE_BANDS.join("/")})`).option("--gender <gender>", `Filter by gender (${GENDERS.join("/")})`).option("--ethnicity <ethnicity>", `Filter by ethnicity (${ETHNICITIES.join("/")})`).option("--attire <attire>", `Filter by attire (${ATTIRES.join("/")})`).option("--active", "Only active entries").option("--inactive", "Only inactive entries").option("--page <n>", "Page number", "1").option("--limit <n>", "Results per page", "20").addHelpText("after", `
+  headshots.command("list").description("List headshot pool entries").option("--age-band <band>", `Filter by age band (${AGE_BANDS.join("/")})`).option("--gender <gender>", `Filter by gender (${GENDERS.join("/")})`).option("--ethnicity <ethnicity>", `Filter by ethnicity (${ETHNICITIES.join("/")})`).option("--attire <attire>", `Filter by attire (${ATTIRES.join("/")})`).option("--active", "Only active entries").option("--inactive", "Only inactive entries").option("--order <asc|desc>", ORDER_OPTION_DESC).option("--page <n>", "Page number", "1").option("--limit <n>", "Results per page", "20").addHelpText("after", `
 Examples:
   $ neopress headshots list
   $ neopress headshots list --gender female --age-band middle --active
@@ -41766,6 +41885,7 @@ Filters are equality matches on the pool's demographic columns; results are pagi
     const params = {
       page: parseInt(options.page, 10),
       limit: parseInt(options.limit, 10),
+      order: parseOrder(options.order),
       ageBand: options.ageBand,
       gender: options.gender,
       ethnicity: options.ethnicity,
@@ -41945,7 +42065,7 @@ function registerGuideCommands(program3) {
 
 // src/bin.ts
 var program2 = new Command();
-program2.name("neopress").description("Neopress CLI \u2014 manage your site from the terminal").version("4.1.0").option("--json", "Output in JSON format (for AI tools and pipes)").option("--site <idOrHandle>", "Target a specific site (overrides active site; not persisted)").option("--no-input", "Non-interactive mode").hook("preAction", (thisCommand) => {
+program2.name("neopress").description("Neopress CLI \u2014 manage your site from the terminal").version("4.3.0").option("--json", "Output in JSON format (for AI tools and pipes)").option("--site <idOrHandle>", "Target a specific site (overrides active site; not persisted)").option("--no-input", "Non-interactive mode").hook("preAction", (thisCommand) => {
   const opts = thisCommand.optsWithGlobals();
   if (opts.site) setSiteOverride(String(opts.site));
   if (opts.json || !process.stdout.isTTY) setJsonMode(true);

package/dist/index.js

@@ -18,11 +18,11 @@ function __rest(s, e) {
 }
 function __awaiter(thisArg, _arguments, P, generator) {
   function adopt(value) {
-    return value instanceof P ? value : new P(function(resolve) {
-      resolve(value);
+    return value instanceof P ? value : new P(function(resolve2) {
+      resolve2(value);
     });
   }
-  return new (P || (P = Promise))(function(resolve, reject) {
+  return new (P || (P = Promise))(function(resolve2, reject) {
     function fulfilled(value) {
       try {
         step(generator.next(value));
@@ -38,7 +38,7 @@ function __awaiter(thisArg, _arguments, P, generator) {
       }
     }
     function step(result) {
-      result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected);
+      result.done ? resolve2(result.value) : adopt(result.value).then(fulfilled, rejected);
     }
     step((generator = generator.apply(thisArg, _arguments || [])).next());
   });
@@ -409,18 +409,18 @@ var PostgrestError = class extends Error {
   }
 };
 function sleep(ms, signal) {
-  return new Promise((resolve) => {
+  return new Promise((resolve2) => {
     if (signal === null || signal === void 0 ? void 0 : signal.aborted) {
-      resolve();
+      resolve2();
       return;
     }
     const id = setTimeout(() => {
       signal === null || signal === void 0 || signal.removeEventListener("abort", onAbort);
-      resolve();
+      resolve2();
     }, ms);
     function onAbort() {
       clearTimeout(id);
-      resolve();
+      resolve2();
     }
     signal === null || signal === void 0 || signal.addEventListener("abort", onAbort);
   });
@@ -8369,15 +8369,15 @@ var RealtimeChannel = class _RealtimeChannel {
         }
       }
     } else {
-      return new Promise((resolve) => {
+      return new Promise((resolve2) => {
         var _a3, _b2, _c;
         const push = this.channelAdapter.push(args.type, args, opts.timeout || this.timeout);
         if (args.type === "broadcast" && !((_c = (_b2 = (_a3 = this.params) === null || _a3 === void 0 ? void 0 : _a3.config) === null || _b2 === void 0 ? void 0 : _b2.broadcast) === null || _c === void 0 ? void 0 : _c.ack)) {
-          resolve("ok");
+          resolve2("ok");
         }
-        push.receive("ok", () => resolve("ok"));
-        push.receive("error", () => resolve("error"));
-        push.receive("timeout", () => resolve("timed out"));
+        push.receive("ok", () => resolve2("ok"));
+        push.receive("error", () => resolve2("error"));
+        push.receive("timeout", () => resolve2("timed out"));
       });
     }
   }
@@ -8402,8 +8402,8 @@ var RealtimeChannel = class _RealtimeChannel {
    * @category Realtime
    */
   async unsubscribe(timeout = this.timeout) {
-    return new Promise((resolve) => {
-      this.channelAdapter.unsubscribe(timeout).receive("ok", () => resolve("ok")).receive("timeout", () => resolve("timed out")).receive("error", () => resolve("error"));
+    return new Promise((resolve2) => {
+      this.channelAdapter.unsubscribe(timeout).receive("ok", () => resolve2("ok")).receive("timeout", () => resolve2("timed out")).receive("error", () => resolve2("error"));
     });
   }
   /**
@@ -8484,8 +8484,8 @@ var RealtimeChannel = class _RealtimeChannel {
   }
   /** @internal */
   _notThisChannelEvent(event, ref) {
-    const { close, error: error48, leave, join: join2 } = CHANNEL_EVENTS;
-    const events = [close, error48, leave, join2];
+    const { close, error: error48, leave, join: join3 } = CHANNEL_EVENTS;
+    const events = [close, error48, leave, join3];
     return ref && events.includes(event) && ref !== this.joinPush.ref;
   }
   /** @internal */
@@ -8598,11 +8598,11 @@ var SocketAdapter = class {
     this.socket.connect();
   }
   disconnect(callback, code, reason, timeout = 1e4) {
-    return new Promise((resolve) => {
-      setTimeout(() => resolve("timeout"), timeout);
+    return new Promise((resolve2) => {
+      setTimeout(() => resolve2("timeout"), timeout);
       this.socket.disconnect(() => {
         callback();
-        resolve("ok");
+        resolve2("ok");
       }, code, reason);
     });
   }
@@ -10016,7 +10016,7 @@ var _getRequestParams = (method, options, parameters, body) => {
   return _objectSpread22(_objectSpread22({}, params), parameters);
 };
 async function _handleRequest(fetcher, method, url2, options, parameters, body, namespace) {
-  return new Promise((resolve, reject) => {
+  return new Promise((resolve2, reject) => {
     fetcher(url2, _getRequestParams(method, options, parameters, body)).then((result) => {
       if (!result.ok) throw result;
       if (options === null || options === void 0 ? void 0 : options.noResolveJson) return result;
@@ -10026,7 +10026,7 @@ async function _handleRequest(fetcher, method, url2, options, parameters, body,
         if (!contentType || !contentType.includes("application/json")) return {};
       }
       return result.json();
-    }).then((data) => resolve(data)).catch((error48) => handleError(error48, reject, options, namespace));
+    }).then((data) => resolve2(data)).catch((error48) => handleError(error48, reject, options, namespace));
   });
 }
 function createFetchApi(namespace = "storage") {
@@ -20271,11 +20271,11 @@ var DEFAULT_TRACE_PROPAGATION_OPTIONS = {
 };
 function __awaiter2(thisArg, _arguments, P, generator) {
   function adopt(value) {
-    return value instanceof P ? value : new P(function(resolve) {
-      resolve(value);
+    return value instanceof P ? value : new P(function(resolve2) {
+      resolve2(value);
     });
   }
-  return new (P || (P = Promise))(function(resolve, reject) {
+  return new (P || (P = Promise))(function(resolve2, reject) {
     function fulfilled(value) {
       try {
         step(generator.next(value));
@@ -20291,7 +20291,7 @@ function __awaiter2(thisArg, _arguments, P, generator) {
       }
     }
     function step(result) {
-      result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected);
+      result.done ? resolve2(result.value) : adopt(result.value).then(fulfilled, rejected);
     }
     step((generator = generator.apply(thisArg, _arguments || [])).next());
   });
@@ -21220,7 +21220,8 @@ var PagesEndpoint = class {
   }
   async list(params) {
     const { page, limit, offset } = this.client.resolvePagination(params);
-    let query = this.client.db.from("pages").select("*", { count: "exact" }).eq("site_id", this.client.siteIdNumber).is("draft_deleted_at", null).order("path");
+    let query = this.client.db.from("pages").select("*", { count: "exact" }).eq("site_id", this.client.siteIdNumber).is("draft_deleted_at", null);
+    query = params?.order ? query.order("created_at", { ascending: params.order === "asc" }) : query.order("path");
     if (params?.status)
       query = query.eq("status", params.status);
     const { data, error: error48, count } = await query.range(offset, offset + limit - 1);
@@ -35513,8 +35514,8 @@ var SiteHistoryService = class _SiteHistoryService {
     const previousLock = _SiteHistoryService.sessionLocks.get(key) ?? Promise.resolve();
     let releaseCurrentLock = () => {
     };
-    const currentLock = new Promise((resolve) => {
-      releaseCurrentLock = resolve;
+    const currentLock = new Promise((resolve2) => {
+      releaseCurrentLock = resolve2;
     });
     const queuedLock = previousLock.catch(() => {
     }).then(() => currentLock);
@@ -36274,8 +36275,10 @@ var CollectionsEndpoint = class {
   get basePath() {
     return `${this.client.siteBasePath}/collections`;
   }
-  async list() {
-    const { data, error: error48 } = await this.client.db.from("collections").select("*").eq("site_id", this.client.siteIdNumber).is("draft_deleted_at", null).order("name");
+  async list(params) {
+    let query = this.client.db.from("collections").select("*").eq("site_id", this.client.siteIdNumber).is("draft_deleted_at", null);
+    query = params?.order ? query.order("created_at", { ascending: params.order === "asc" }) : query.order("name");
+    const { data, error: error48 } = await query;
     if (error48)
       throw new NeopressApiError("DB_ERROR", error48.message, 0, error48);
     return (data ?? []).map((r) => serializeCollection(r));
@@ -36348,7 +36351,7 @@ var EntriesEndpoint = class {
   }
   async list(collectionId, params) {
     const { page, limit, offset } = this.client.resolvePagination(params);
-    let query = this.client.db.from("entries").select("*", { count: "exact" }).eq("site_id", this.client.siteIdNumber).eq("collection_id", collectionId).is("deleted_at", null).order("created_at", { ascending: false });
+    let query = this.client.db.from("entries").select("*", { count: "exact" }).eq("site_id", this.client.siteIdNumber).eq("collection_id", collectionId).is("deleted_at", null).order("created_at", { ascending: params?.order === "asc" });
     if (params?.status)
       query = query.eq("status", params.status);
     if (params?.locale)
@@ -36439,8 +36442,10 @@ var FormsEndpoint = class {
   get basePath() {
     return `${this.client.siteBasePath}/forms`;
   }
-  async list() {
-    const { data, error: error48 } = await this.client.db.from("forms").select("*").eq("site_id", this.client.siteIdNumber).is("draft_deleted_at", null).order("name");
+  async list(params) {
+    let query = this.client.db.from("forms").select("*").eq("site_id", this.client.siteIdNumber).is("draft_deleted_at", null);
+    query = params?.order ? query.order("created_at", { ascending: params.order === "asc" }) : query.order("name");
+    const { data, error: error48 } = await query;
     if (error48)
       throw new NeopressApiError("DB_ERROR", error48.message, 0, error48);
     const rows = data ?? [];
@@ -36519,7 +36524,7 @@ var AssetsEndpoint = class {
   }
   async list(params) {
     const { page, limit, offset } = this.client.resolvePagination(params);
-    const { data, error: error48, count } = await this.client.db.from("assets").select("*", { count: "exact" }).eq("site_id", this.client.siteIdNumber).order("created_at", { ascending: false }).range(offset, offset + limit - 1);
+    const { data, error: error48, count } = await this.client.db.from("assets").select("*", { count: "exact" }).eq("site_id", this.client.siteIdNumber).order("created_at", { ascending: params?.order === "asc" }).range(offset, offset + limit - 1);
     if (error48)
       throw new NeopressApiError("DB_ERROR", error48.message, 0, error48);
     const rows = data ?? [];
@@ -36585,7 +36590,7 @@ var SiteEndpoint = class {
   constructor(client) {
     this.client = client;
   }
-  async list() {
+  async list(params) {
     const profileId = this.client.authUserId;
     if (!profileId) {
       throw new NeopressApiError("NO_AUTH", "site.list requires an authenticated access token", 0);
@@ -36593,10 +36598,15 @@ var SiteEndpoint = class {
     const { data, error: error48 } = await this.client.db.from("sites_profiles").select("role, sites!inner(*)").eq("profile_id", profileId).eq("status", "active");
     if (error48)
       throw new NeopressApiError("DB_ERROR", error48.message, 0, error48);
-    return (data ?? []).map((m) => ({
+    const sites = (data ?? []).map((m) => ({
       ...serializeSite(m.sites),
       role: m.role
     }));
+    if (params?.order) {
+      const dir = params.order === "asc" ? 1 : -1;
+      sites.sort((a, b) => (a.createdAt ?? "") < (b.createdAt ?? "") ? -dir : (a.createdAt ?? "") > (b.createdAt ?? "") ? dir : 0);
+    }
+    return sites;
   }
   async get() {
     const { data, error: error48 } = await this.client.db.from("sites").select("*").eq("id", this.client.siteIdNumber).single();
@@ -36634,8 +36644,10 @@ var RedirectsEndpoint = class {
   constructor(client) {
     this.client = client;
   }
-  async list() {
-    const { data, error: error48 } = await this.client.db.from("redirect_rules").select("*").eq("site_id", this.client.siteIdNumber).order("priority", { ascending: true });
+  async list(params) {
+    let query = this.client.db.from("redirect_rules").select("*").eq("site_id", this.client.siteIdNumber);
+    query = params?.order ? query.order("created_at", { ascending: params.order === "asc" }) : query.order("priority", { ascending: true });
+    const { data, error: error48 } = await query;
     if (error48)
       throw new NeopressApiError("DB_ERROR", error48.message, 0, error48);
     return (data ?? []).map((r) => serializeRedirect(r));
@@ -36712,7 +36724,7 @@ var EntryReferencesEndpoint = class {
       query = query.eq("from_entry_id", params.fromEntryId);
     if (params?.toEntryId)
       query = query.eq("to_entry_id", params.toEntryId);
-    const { data, error: error48 } = await query.order("created_at", { ascending: false });
+    const { data, error: error48 } = await query.order("created_at", { ascending: params?.order === "asc" });
     if (error48)
       throw new NeopressApiError("DB_ERROR", error48.message, 0, error48);
     return (data ?? []).map((r) => serializeEntryReference(r));
@@ -36834,18 +36846,57 @@ var TemplatesEndpoint = class {
     const res = await this.client.delete(this.basePath);
     return res.data;
   }
+  /**
+   * List templates across the sites the caller can access.
+   *
+   * Direct-DB: `templates` is public-read and `sites` RLS scopes the visible set
+   * (own active memberships, or all sites for the super admin), so no server
+   * route is needed — the two RLS-scoped queries reproduce the old handler.
+   */
   async list(params) {
-    const qs = new URLSearchParams();
-    if (params?.namePrefix)
-      qs.set("namePrefix", params.namePrefix);
-    if (params?.industry)
-      qs.set("industry", params.industry);
-    if (params?.limit != null)
-      qs.set("limit", String(params.limit));
-    const query = qs.toString();
-    const path = query ? `/api/v1/templates?${query}` : "/api/v1/templates";
-    const res = await this.client.get(path);
-    return res.data;
+    const { data: sitesData, error: sitesError } = await this.client.db.from("sites").select("id, handle, name");
+    if (sitesError)
+      throw new NeopressApiError("DB_ERROR", sitesError.message, 0, sitesError);
+    const siteMeta = /* @__PURE__ */ new Map();
+    for (const site of sitesData ?? []) {
+      if (typeof site.id !== "number")
+        continue;
+      siteMeta.set(site.id, {
+        handle: site.handle ?? null,
+        name: site.name ?? null
+      });
+    }
+    const siteIds = [...siteMeta.keys()];
+    if (siteIds.length === 0)
+      return [];
+    const namePrefix = params?.namePrefix?.trim();
+    const industry = params?.industry?.trim();
+    const limit = Math.min(Math.max(params?.limit ?? 100, 1), 500);
+    let query = this.client.db.from("templates").select("id, name, industry, reference_url, preview_img_urls, description, created_at").in("id", siteIds);
+    if (namePrefix)
+      query = query.ilike("name", `${namePrefix}%`);
+    if (industry)
+      query = query.eq("industry", industry);
+    if (params?.order)
+      query = query.order("created_at", { ascending: params.order === "asc" });
+    query = query.limit(limit);
+    const { data, error: error48 } = await query;
+    if (error48)
+      throw new NeopressApiError("DB_ERROR", error48.message, 0, error48);
+    return (data ?? []).map((t) => {
+      const siteId = t.id;
+      return {
+        siteId,
+        handle: siteMeta.get(siteId)?.handle ?? null,
+        siteName: siteMeta.get(siteId)?.name ?? null,
+        name: t.name,
+        industry: t.industry,
+        referenceUrl: t.reference_url,
+        previewImgUrls: t.preview_img_urls ?? null,
+        description: t.description ?? null,
+        createdAt: t.created_at
+      };
+    });
   }
 };
 
@@ -36868,7 +36919,12 @@ var HeadshotsEndpoint = class {
       query = query.eq("attire", params.attire);
     if (params?.isActive !== void 0)
       query = query.eq("is_active", params.isActive);
-    const { data, error: error48, count } = await query.order("age_band", { ascending: true }).order("gender", { ascending: true }).order("ethnicity", { ascending: true }).order("variation_index", { ascending: true }).range(offset, offset + limit - 1);
+    if (params?.order) {
+      query = query.order("created_at", { ascending: params.order === "asc" });
+    } else {
+      query = query.order("age_band", { ascending: true }).order("gender", { ascending: true }).order("ethnicity", { ascending: true }).order("variation_index", { ascending: true });
+    }
+    const { data, error: error48, count } = await query.range(offset, offset + limit - 1);
     if (error48)
       throw new NeopressApiError("DB_ERROR", error48.message, 0, error48);
     return {
@@ -37201,23 +37257,44 @@ function fail(message, code = 1) {
 
 // src/utils/config.ts
 import { existsSync as existsSync2, mkdirSync as mkdirSync2, readFileSync as readFileSync2, writeFileSync as writeFileSync2 } from "fs";
-import { dirname } from "path";
+import { dirname, join as join2, resolve } from "path";
+import { homedir as homedir2 } from "os";
 var PROJECT_CONFIG = ".neopressrc.json";
 var WORKSPACE_CONFIG = ".neopress/config.json";
-function readProjectConfig() {
-  let config2 = {};
-  for (const file2 of [PROJECT_CONFIG, WORKSPACE_CONFIG]) {
-    try {
-      const parsed = JSON.parse(readFileSync2(file2, "utf-8"));
-      config2 = {
-        ...config2,
-        ...typeof parsed.siteId === "number" ? { siteId: parsed.siteId } : {},
-        ...typeof parsed.baseUrl === "string" ? { baseUrl: parsed.baseUrl } : {}
-      };
-    } catch {
+function readConfigFileAt(path) {
+  try {
+    const parsed = JSON.parse(readFileSync2(path, "utf-8"));
+    return {
+      ...typeof parsed.siteId === "number" ? { siteId: parsed.siteId } : {},
+      ...typeof parsed.baseUrl === "string" ? { baseUrl: parsed.baseUrl } : {}
+    };
+  } catch {
+    return {};
+  }
+}
+function locateProjectConfig(startDir = process.cwd()) {
+  const home = resolve(homedir2());
+  let dir = resolve(startDir);
+  while (true) {
+    let merged = {};
+    let foundPath;
+    for (const rel of [PROJECT_CONFIG, WORKSPACE_CONFIG]) {
+      const p = join2(dir, rel);
+      const cfg = readConfigFileAt(p);
+      if (Object.keys(cfg).length > 0) {
+        merged = { ...merged, ...cfg };
+        if (!foundPath) foundPath = p;
+      }
     }
+    if (Object.keys(merged).length > 0) return { config: merged, path: foundPath };
+    const parent = dirname(dir);
+    if (dir === home || parent === dir) break;
+    dir = parent;
   }
-  return config2;
+  return { config: {} };
+}
+function readProjectConfig() {
+  return locateProjectConfig().config;
 }
 function writeWorkspaceConfig(next) {
   mkdirSync2(dirname(WORKSPACE_CONFIG), { recursive: true });
@@ -37244,12 +37321,24 @@ function setActiveSiteId(siteId) {
   }
 }
 var siteOverride;
-function getSiteTarget() {
+function resolveSiteTarget() {
   if (siteOverride) {
     const n = parseInt(siteOverride, 10);
-    return String(n) === siteOverride ? n : siteOverride;
+    const value = String(n) === siteOverride ? n : siteOverride;
+    return { value, source: "flag", detail: "--site" };
+  }
+  const envSiteId = process.env.NEOPRESS_SITE_ID;
+  if (envSiteId) return { value: parseInt(envSiteId, 10), source: "env", detail: "NEOPRESS_SITE_ID" };
+  const located = locateProjectConfig();
+  if (typeof located.config.siteId === "number") {
+    return { value: located.config.siteId, source: "project-config", detail: located.path };
   }
-  return getSiteId();
+  const active = loadSession().activeSiteId;
+  if (active) return { value: active, source: "global-active", detail: "sites use" };
+  return { value: void 0, source: "none" };
+}
+function getSiteTarget() {
+  return resolveSiteTarget().value;
 }
 
 // src/utils/client.ts

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@neopress/cli",
-  "version": "4.1.0",
+  "version": "4.3.0",
   "description": "Neopress CLI — manage your Neopress site from the terminal",
   "type": "module",
   "keywords": [