@neopress/cli 4.2.0 → 4.3.0

package/dist/bin.cjs

@@ -24998,7 +24998,8 @@ var PagesEndpoint = class {
   }
   async list(params) {
     const { page, limit, offset } = this.client.resolvePagination(params);
-    let query = this.client.db.from("pages").select("*", { count: "exact" }).eq("site_id", this.client.siteIdNumber).is("draft_deleted_at", null).order("path");
+    let query = this.client.db.from("pages").select("*", { count: "exact" }).eq("site_id", this.client.siteIdNumber).is("draft_deleted_at", null);
+    query = params?.order ? query.order("created_at", { ascending: params.order === "asc" }) : query.order("path");
     if (params?.status)
       query = query.eq("status", params.status);
     const { data, error: error48, count } = await query.range(offset, offset + limit - 1);
@@ -40052,8 +40053,10 @@ var CollectionsEndpoint = class {
   get basePath() {
     return `${this.client.siteBasePath}/collections`;
   }
-  async list() {
-    const { data, error: error48 } = await this.client.db.from("collections").select("*").eq("site_id", this.client.siteIdNumber).is("draft_deleted_at", null).order("name");
+  async list(params) {
+    let query = this.client.db.from("collections").select("*").eq("site_id", this.client.siteIdNumber).is("draft_deleted_at", null);
+    query = params?.order ? query.order("created_at", { ascending: params.order === "asc" }) : query.order("name");
+    const { data, error: error48 } = await query;
     if (error48)
       throw new NeopressApiError("DB_ERROR", error48.message, 0, error48);
     return (data ?? []).map((r) => serializeCollection(r));
@@ -40126,7 +40129,7 @@ var EntriesEndpoint = class {
   }
   async list(collectionId, params) {
     const { page, limit, offset } = this.client.resolvePagination(params);
-    let query = this.client.db.from("entries").select("*", { count: "exact" }).eq("site_id", this.client.siteIdNumber).eq("collection_id", collectionId).is("deleted_at", null).order("created_at", { ascending: false });
+    let query = this.client.db.from("entries").select("*", { count: "exact" }).eq("site_id", this.client.siteIdNumber).eq("collection_id", collectionId).is("deleted_at", null).order("created_at", { ascending: params?.order === "asc" });
     if (params?.status)
       query = query.eq("status", params.status);
     if (params?.locale)
@@ -40217,8 +40220,10 @@ var FormsEndpoint = class {
   get basePath() {
     return `${this.client.siteBasePath}/forms`;
   }
-  async list() {
-    const { data, error: error48 } = await this.client.db.from("forms").select("*").eq("site_id", this.client.siteIdNumber).is("draft_deleted_at", null).order("name");
+  async list(params) {
+    let query = this.client.db.from("forms").select("*").eq("site_id", this.client.siteIdNumber).is("draft_deleted_at", null);
+    query = params?.order ? query.order("created_at", { ascending: params.order === "asc" }) : query.order("name");
+    const { data, error: error48 } = await query;
     if (error48)
       throw new NeopressApiError("DB_ERROR", error48.message, 0, error48);
     const rows = data ?? [];
@@ -40297,7 +40302,7 @@ var AssetsEndpoint = class {
   }
   async list(params) {
     const { page, limit, offset } = this.client.resolvePagination(params);
-    const { data, error: error48, count } = await this.client.db.from("assets").select("*", { count: "exact" }).eq("site_id", this.client.siteIdNumber).order("created_at", { ascending: false }).range(offset, offset + limit - 1);
+    const { data, error: error48, count } = await this.client.db.from("assets").select("*", { count: "exact" }).eq("site_id", this.client.siteIdNumber).order("created_at", { ascending: params?.order === "asc" }).range(offset, offset + limit - 1);
     if (error48)
       throw new NeopressApiError("DB_ERROR", error48.message, 0, error48);
     const rows = data ?? [];
@@ -40363,7 +40368,7 @@ var SiteEndpoint = class {
   constructor(client) {
     this.client = client;
   }
-  async list() {
+  async list(params) {
     const profileId = this.client.authUserId;
     if (!profileId) {
       throw new NeopressApiError("NO_AUTH", "site.list requires an authenticated access token", 0);
@@ -40371,10 +40376,15 @@ var SiteEndpoint = class {
     const { data, error: error48 } = await this.client.db.from("sites_profiles").select("role, sites!inner(*)").eq("profile_id", profileId).eq("status", "active");
     if (error48)
       throw new NeopressApiError("DB_ERROR", error48.message, 0, error48);
-    return (data ?? []).map((m) => ({
+    const sites = (data ?? []).map((m) => ({
       ...serializeSite(m.sites),
       role: m.role
     }));
+    if (params?.order) {
+      const dir = params.order === "asc" ? 1 : -1;
+      sites.sort((a, b) => (a.createdAt ?? "") < (b.createdAt ?? "") ? -dir : (a.createdAt ?? "") > (b.createdAt ?? "") ? dir : 0);
+    }
+    return sites;
   }
   async get() {
     const { data, error: error48 } = await this.client.db.from("sites").select("*").eq("id", this.client.siteIdNumber).single();
@@ -40412,8 +40422,10 @@ var RedirectsEndpoint = class {
   constructor(client) {
     this.client = client;
   }
-  async list() {
-    const { data, error: error48 } = await this.client.db.from("redirect_rules").select("*").eq("site_id", this.client.siteIdNumber).order("priority", { ascending: true });
+  async list(params) {
+    let query = this.client.db.from("redirect_rules").select("*").eq("site_id", this.client.siteIdNumber);
+    query = params?.order ? query.order("created_at", { ascending: params.order === "asc" }) : query.order("priority", { ascending: true });
+    const { data, error: error48 } = await query;
     if (error48)
       throw new NeopressApiError("DB_ERROR", error48.message, 0, error48);
     return (data ?? []).map((r) => serializeRedirect(r));
@@ -40490,7 +40502,7 @@ var EntryReferencesEndpoint = class {
       query = query.eq("from_entry_id", params.fromEntryId);
     if (params?.toEntryId)
       query = query.eq("to_entry_id", params.toEntryId);
-    const { data, error: error48 } = await query.order("created_at", { ascending: false });
+    const { data, error: error48 } = await query.order("created_at", { ascending: params?.order === "asc" });
     if (error48)
       throw new NeopressApiError("DB_ERROR", error48.message, 0, error48);
     return (data ?? []).map((r) => serializeEntryReference(r));
@@ -40612,18 +40624,57 @@ var TemplatesEndpoint = class {
     const res = await this.client.delete(this.basePath);
     return res.data;
   }
+  /**
+   * List templates across the sites the caller can access.
+   *
+   * Direct-DB: `templates` is public-read and `sites` RLS scopes the visible set
+   * (own active memberships, or all sites for the super admin), so no server
+   * route is needed — the two RLS-scoped queries reproduce the old handler.
+   */
   async list(params) {
-    const qs = new URLSearchParams();
-    if (params?.namePrefix)
-      qs.set("namePrefix", params.namePrefix);
-    if (params?.industry)
-      qs.set("industry", params.industry);
-    if (params?.limit != null)
-      qs.set("limit", String(params.limit));
-    const query = qs.toString();
-    const path = query ? `/api/v1/templates?${query}` : "/api/v1/templates";
-    const res = await this.client.get(path);
-    return res.data;
+    const { data: sitesData, error: sitesError } = await this.client.db.from("sites").select("id, handle, name");
+    if (sitesError)
+      throw new NeopressApiError("DB_ERROR", sitesError.message, 0, sitesError);
+    const siteMeta = /* @__PURE__ */ new Map();
+    for (const site of sitesData ?? []) {
+      if (typeof site.id !== "number")
+        continue;
+      siteMeta.set(site.id, {
+        handle: site.handle ?? null,
+        name: site.name ?? null
+      });
+    }
+    const siteIds = [...siteMeta.keys()];
+    if (siteIds.length === 0)
+      return [];
+    const namePrefix = params?.namePrefix?.trim();
+    const industry = params?.industry?.trim();
+    const limit = Math.min(Math.max(params?.limit ?? 100, 1), 500);
+    let query = this.client.db.from("templates").select("id, name, industry, reference_url, preview_img_urls, description, created_at").in("id", siteIds);
+    if (namePrefix)
+      query = query.ilike("name", `${namePrefix}%`);
+    if (industry)
+      query = query.eq("industry", industry);
+    if (params?.order)
+      query = query.order("created_at", { ascending: params.order === "asc" });
+    query = query.limit(limit);
+    const { data, error: error48 } = await query;
+    if (error48)
+      throw new NeopressApiError("DB_ERROR", error48.message, 0, error48);
+    return (data ?? []).map((t) => {
+      const siteId = t.id;
+      return {
+        siteId,
+        handle: siteMeta.get(siteId)?.handle ?? null,
+        siteName: siteMeta.get(siteId)?.name ?? null,
+        name: t.name,
+        industry: t.industry,
+        referenceUrl: t.reference_url,
+        previewImgUrls: t.preview_img_urls ?? null,
+        description: t.description ?? null,
+        createdAt: t.created_at
+      };
+    });
   }
 };
 
@@ -40646,7 +40697,12 @@ var HeadshotsEndpoint = class {
       query = query.eq("attire", params.attire);
     if (params?.isActive !== void 0)
       query = query.eq("is_active", params.isActive);
-    const { data, error: error48, count } = await query.order("age_band", { ascending: true }).order("gender", { ascending: true }).order("ethnicity", { ascending: true }).order("variation_index", { ascending: true }).range(offset, offset + limit - 1);
+    if (params?.order) {
+      query = query.order("created_at", { ascending: params.order === "asc" });
+    } else {
+      query = query.order("age_band", { ascending: true }).order("gender", { ascending: true }).order("ethnicity", { ascending: true }).order("variation_index", { ascending: true });
+    }
+    const { data, error: error48, count } = await query.range(offset, offset + limit - 1);
     if (error48)
       throw new NeopressApiError("DB_ERROR", error48.message, 0, error48);
     return {
@@ -40912,6 +40968,16 @@ async function getGlobalClientAsync() {
   return new NeopressClient({ accessToken: token, siteId: 0, baseUrl: getBaseUrl(), supabaseUrl: sb.url, supabaseAnonKey: sb.anonKey });
 }
 
+// src/utils/order.ts
+function parseOrder(value) {
+  if (value === void 0) return void 0;
+  if (value !== "asc" && value !== "desc") {
+    fail(`Invalid --order value "${value}". Use "asc" or "desc".`);
+  }
+  return value;
+}
+var ORDER_OPTION_DESC = "Sort by created_at (asc or desc)";
+
 // src/commands/sites.ts
 function registerSiteCommands(program3) {
   const sites = program3.command("sites").description("Manage sites").addHelpText("after", `
@@ -40922,9 +40988,9 @@ Examples:
   $ neopress sites use my-site
   $ neopress sites current
 Run \`sites use <id|handle>\` to set the global active site, or \`sites create --pin\` to scope a site to the current directory. \`sites current\` shows which site commands will target and why.`);
-  sites.command("list").description("List accessible sites").action(async () => {
+  sites.command("list").description("List accessible sites").option("--order <asc|desc>", ORDER_OPTION_DESC).action(async (options) => {
     const client = await getGlobalClientAsync();
-    const sitesList = await client.site.list();
+    const sitesList = await client.site.list({ order: parseOrder(options.order) });
     output(sitesList);
   });
   sites.command("use <siteIdOrHandle>").description("Set active site (ID or handle)").addHelpText("after", `
@@ -41078,10 +41144,11 @@ Examples:
   $ neopress pages compile <pageId>
 
 Draft content fields (--tsx/--i18n/--draft-meta) need \`neopress publish\` to go live. \`pages delete\` is a soft delete.`);
-  pages.command("list").description("List pages").option("--status <status>", "Filter by status (draft/published)").option("--page <n>", "Page number", "1").option("--limit <n>", "Results per page", "20").action(async (options) => {
+  pages.command("list").description("List pages").option("--status <status>", "Filter by status (draft/published)").option("--order <asc|desc>", ORDER_OPTION_DESC).option("--page <n>", "Page number", "1").option("--limit <n>", "Results per page", "20").action(async (options) => {
     const client = await getClientAsync();
     const res = await client.pages.list({
       status: options.status,
+      order: parseOrder(options.order),
       page: parseInt(options.page, 10),
       limit: parseInt(options.limit, 10)
     });
@@ -41178,9 +41245,9 @@ Examples:
   $ neopress collections update 12 --schema @schema.json
 
 Collections are identified by numeric id, never name. delete is a soft delete \u2014 the collection is hidden from list/get but its row is retained.`);
-  collections.command("list").description("List collections").action(async () => {
+  collections.command("list").description("List collections").option("--order <asc|desc>", ORDER_OPTION_DESC).action(async (options) => {
     const client = await getClientAsync();
-    const data = await client.collections.list();
+    const data = await client.collections.list({ order: parseOrder(options.order) });
     output(data);
   });
   collections.command("get <collectionId>").description("Get collection details").action(async (collectionId) => {
@@ -41238,11 +41305,12 @@ Examples:
   $ neopress entries publish <entryId>
 
 Entries are created as drafts \u2014 run \`neopress entries publish <entryId>\` to make them live. create/update/delete revalidate the reader cache; delete is a soft delete.`);
-  entries.command("list").description("List entries in a collection").requiredOption("--collection <id>", "Collection ID").option("--status <status>", "Filter by status").option("--locale <locale>", "Filter by locale").option("--page <n>", "Page number", "1").option("--limit <n>", "Results per page", "20").action(async (options) => {
+  entries.command("list").description("List entries in a collection").requiredOption("--collection <id>", "Collection ID").option("--status <status>", "Filter by status").option("--locale <locale>", "Filter by locale").option("--order <asc|desc>", ORDER_OPTION_DESC).option("--page <n>", "Page number", "1").option("--limit <n>", "Results per page", "20").action(async (options) => {
     const client = await getClientAsync();
     const res = await client.entries.list(parseInt(options.collection, 10), {
       status: options.status,
       locale: options.locale,
+      order: parseOrder(options.order),
       page: parseInt(options.page, 10),
       limit: parseInt(options.limit, 10)
     });
@@ -41332,9 +41400,9 @@ Examples:
   $ neopress forms publish <formId>
   $ neopress forms responses <formId> --limit 50
 Forms are created as drafts \u2014 run \`neopress forms publish <formId>\` to make them live. JSON options take inline JSON or @file.`);
-  forms.command("list").description("List forms").action(async () => {
+  forms.command("list").description("List forms").option("--order <asc|desc>", ORDER_OPTION_DESC).action(async (options) => {
     const client = await getClientAsync();
-    const data = await client.forms.list();
+    const data = await client.forms.list({ order: parseOrder(options.order) });
     output(data);
   });
   forms.command("get <formId>").description("Get form details").action(async (formId) => {
@@ -41414,9 +41482,10 @@ Examples:
   $ neopress assets upload ./hero.png --folder images
   $ neopress assets list --limit 50
 Upload runs presign \u2192 PUT to storage \u2192 register in one step; content type is inferred from the file extension.`);
-  assets.command("list").description("List assets").option("--page <n>", "Page number", "1").option("--limit <n>", "Results per page", "20").action(async (options) => {
+  assets.command("list").description("List assets").option("--order <asc|desc>", ORDER_OPTION_DESC).option("--page <n>", "Page number", "1").option("--limit <n>", "Results per page", "20").action(async (options) => {
     const client = await getClientAsync();
     const res = await client.assets.list({
+      order: parseOrder(options.order),
       page: parseInt(options.page, 10),
       limit: parseInt(options.limit, 10)
     });
@@ -41499,9 +41568,9 @@ Examples:
   $ neopress redirects create --source /docs --dest /guide --type 308
   $ neopress redirects list
 Rules are created enabled. delete <ruleId> removes a rule permanently.`);
-  redirects.command("list").description("List redirect rules").action(async () => {
+  redirects.command("list").description("List redirect rules").option("--order <asc|desc>", `${ORDER_OPTION_DESC} (default sort: priority)`).action(async (options) => {
     const client = await getClientAsync();
-    const data = await client.redirects.list();
+    const data = await client.redirects.list({ order: parseOrder(options.order) });
     output(data);
   });
   redirects.command("create").description("Create a redirect rule").addHelpText("after", `
@@ -41564,11 +41633,12 @@ Examples:
   $ neopress entry-references list --from-entry 12
   $ neopress entry-references delete <referenceId>
 --field is a reference field key from the source entry's collection schema. delete is a hard delete and removes the relation immediately.`);
-  refs.command("list").description("List entry references").option("--from-entry <id>", "Filter by source entry ID").option("--to-entry <id>", "Filter by target entry ID").action(async (options) => {
+  refs.command("list").description("List entry references").option("--from-entry <id>", "Filter by source entry ID").option("--to-entry <id>", "Filter by target entry ID").option("--order <asc|desc>", ORDER_OPTION_DESC).action(async (options) => {
     const client = await getClientAsync();
     const data = await client.entryReferences.list({
       fromEntryId: options.fromEntry ? parseInt(options.fromEntry, 10) : void 0,
-      toEntryId: options.toEntry ? parseInt(options.toEntry, 10) : void 0
+      toEntryId: options.toEntry ? parseInt(options.toEntry, 10) : void 0,
+      order: parseOrder(options.order)
     });
     output(data);
   });
@@ -41730,15 +41800,12 @@ Examples:
   $ neopress templates list --industry saas --limit 50
   $ neopress templates delete
 \`templates mark\` operates on the active site. \`templates delete\` permanently removes the template metadata AND the connected site \u2014 it is destructive and not recoverable.`);
-  templates.command("list").description("List templates across sites you can access").option("--name-prefix <prefix>", "Filter by template name prefix").option("--industry <industry>", "Filter by industry key").option("--limit <n>", "Max results (default 100, max 500)").action(async (options) => {
-    const token = process.env.NEOPRESS_ACCESS_TOKEN || await getValidAccessToken() || void 0;
-    if (!token) {
-      fail("Not authenticated. Run `neopress login`.");
-    }
-    const client = new NeopressClient({ accessToken: token, siteId: 0, baseUrl: getBaseUrl() });
+  templates.command("list").description("List templates across sites you can access").option("--name-prefix <prefix>", "Filter by template name prefix").option("--industry <industry>", "Filter by industry key").option("--order <asc|desc>", ORDER_OPTION_DESC).option("--limit <n>", "Max results (default 100, max 500)").action(async (options) => {
+    const client = await getGlobalClientAsync();
     const templates2 = await client.templates.list({
       namePrefix: options.namePrefix,
       industry: options.industry,
+      order: parseOrder(options.order),
       limit: options.limit ? parseInt(options.limit, 10) : void 0
     });
     output(templates2);
@@ -41803,7 +41870,7 @@ Examples:
   $ neopress headshots create --image-url https://cdn/x.webp --age-band young --gender male --ethnicity white --variation-index 0
   $ neopress headshots update 12 --inactive
 The pool is global and RLS-gated: only the super-admin account can read or write it. No active site is needed.`);
-  headshots.command("list").description("List headshot pool entries").option("--age-band <band>", `Filter by age band (${AGE_BANDS.join("/")})`).option("--gender <gender>", `Filter by gender (${GENDERS.join("/")})`).option("--ethnicity <ethnicity>", `Filter by ethnicity (${ETHNICITIES.join("/")})`).option("--attire <attire>", `Filter by attire (${ATTIRES.join("/")})`).option("--active", "Only active entries").option("--inactive", "Only inactive entries").option("--page <n>", "Page number", "1").option("--limit <n>", "Results per page", "20").addHelpText("after", `
+  headshots.command("list").description("List headshot pool entries").option("--age-band <band>", `Filter by age band (${AGE_BANDS.join("/")})`).option("--gender <gender>", `Filter by gender (${GENDERS.join("/")})`).option("--ethnicity <ethnicity>", `Filter by ethnicity (${ETHNICITIES.join("/")})`).option("--attire <attire>", `Filter by attire (${ATTIRES.join("/")})`).option("--active", "Only active entries").option("--inactive", "Only inactive entries").option("--order <asc|desc>", ORDER_OPTION_DESC).option("--page <n>", "Page number", "1").option("--limit <n>", "Results per page", "20").addHelpText("after", `
 Examples:
   $ neopress headshots list
   $ neopress headshots list --gender female --age-band middle --active
@@ -41818,6 +41885,7 @@ Filters are equality matches on the pool's demographic columns; results are pagi
     const params = {
       page: parseInt(options.page, 10),
       limit: parseInt(options.limit, 10),
+      order: parseOrder(options.order),
       ageBand: options.ageBand,
       gender: options.gender,
       ethnicity: options.ethnicity,
@@ -41997,7 +42065,7 @@ function registerGuideCommands(program3) {
 
 // src/bin.ts
 var program2 = new Command();
-program2.name("neopress").description("Neopress CLI \u2014 manage your site from the terminal").version("4.2.0").option("--json", "Output in JSON format (for AI tools and pipes)").option("--site <idOrHandle>", "Target a specific site (overrides active site; not persisted)").option("--no-input", "Non-interactive mode").hook("preAction", (thisCommand) => {
+program2.name("neopress").description("Neopress CLI \u2014 manage your site from the terminal").version("4.3.0").option("--json", "Output in JSON format (for AI tools and pipes)").option("--site <idOrHandle>", "Target a specific site (overrides active site; not persisted)").option("--no-input", "Non-interactive mode").hook("preAction", (thisCommand) => {
   const opts = thisCommand.optsWithGlobals();
   if (opts.site) setSiteOverride(String(opts.site));
   if (opts.json || !process.stdout.isTTY) setJsonMode(true);

package/dist/index.js

@@ -21220,7 +21220,8 @@ var PagesEndpoint = class {
   }
   async list(params) {
     const { page, limit, offset } = this.client.resolvePagination(params);
-    let query = this.client.db.from("pages").select("*", { count: "exact" }).eq("site_id", this.client.siteIdNumber).is("draft_deleted_at", null).order("path");
+    let query = this.client.db.from("pages").select("*", { count: "exact" }).eq("site_id", this.client.siteIdNumber).is("draft_deleted_at", null);
+    query = params?.order ? query.order("created_at", { ascending: params.order === "asc" }) : query.order("path");
     if (params?.status)
       query = query.eq("status", params.status);
     const { data, error: error48, count } = await query.range(offset, offset + limit - 1);
@@ -36274,8 +36275,10 @@ var CollectionsEndpoint = class {
   get basePath() {
     return `${this.client.siteBasePath}/collections`;
   }
-  async list() {
-    const { data, error: error48 } = await this.client.db.from("collections").select("*").eq("site_id", this.client.siteIdNumber).is("draft_deleted_at", null).order("name");
+  async list(params) {
+    let query = this.client.db.from("collections").select("*").eq("site_id", this.client.siteIdNumber).is("draft_deleted_at", null);
+    query = params?.order ? query.order("created_at", { ascending: params.order === "asc" }) : query.order("name");
+    const { data, error: error48 } = await query;
     if (error48)
       throw new NeopressApiError("DB_ERROR", error48.message, 0, error48);
     return (data ?? []).map((r) => serializeCollection(r));
@@ -36348,7 +36351,7 @@ var EntriesEndpoint = class {
   }
   async list(collectionId, params) {
     const { page, limit, offset } = this.client.resolvePagination(params);
-    let query = this.client.db.from("entries").select("*", { count: "exact" }).eq("site_id", this.client.siteIdNumber).eq("collection_id", collectionId).is("deleted_at", null).order("created_at", { ascending: false });
+    let query = this.client.db.from("entries").select("*", { count: "exact" }).eq("site_id", this.client.siteIdNumber).eq("collection_id", collectionId).is("deleted_at", null).order("created_at", { ascending: params?.order === "asc" });
     if (params?.status)
       query = query.eq("status", params.status);
     if (params?.locale)
@@ -36439,8 +36442,10 @@ var FormsEndpoint = class {
   get basePath() {
     return `${this.client.siteBasePath}/forms`;
   }
-  async list() {
-    const { data, error: error48 } = await this.client.db.from("forms").select("*").eq("site_id", this.client.siteIdNumber).is("draft_deleted_at", null).order("name");
+  async list(params) {
+    let query = this.client.db.from("forms").select("*").eq("site_id", this.client.siteIdNumber).is("draft_deleted_at", null);
+    query = params?.order ? query.order("created_at", { ascending: params.order === "asc" }) : query.order("name");
+    const { data, error: error48 } = await query;
     if (error48)
       throw new NeopressApiError("DB_ERROR", error48.message, 0, error48);
     const rows = data ?? [];
@@ -36519,7 +36524,7 @@ var AssetsEndpoint = class {
   }
   async list(params) {
     const { page, limit, offset } = this.client.resolvePagination(params);
-    const { data, error: error48, count } = await this.client.db.from("assets").select("*", { count: "exact" }).eq("site_id", this.client.siteIdNumber).order("created_at", { ascending: false }).range(offset, offset + limit - 1);
+    const { data, error: error48, count } = await this.client.db.from("assets").select("*", { count: "exact" }).eq("site_id", this.client.siteIdNumber).order("created_at", { ascending: params?.order === "asc" }).range(offset, offset + limit - 1);
     if (error48)
       throw new NeopressApiError("DB_ERROR", error48.message, 0, error48);
     const rows = data ?? [];
@@ -36585,7 +36590,7 @@ var SiteEndpoint = class {
   constructor(client) {
     this.client = client;
   }
-  async list() {
+  async list(params) {
     const profileId = this.client.authUserId;
     if (!profileId) {
       throw new NeopressApiError("NO_AUTH", "site.list requires an authenticated access token", 0);
@@ -36593,10 +36598,15 @@ var SiteEndpoint = class {
     const { data, error: error48 } = await this.client.db.from("sites_profiles").select("role, sites!inner(*)").eq("profile_id", profileId).eq("status", "active");
     if (error48)
       throw new NeopressApiError("DB_ERROR", error48.message, 0, error48);
-    return (data ?? []).map((m) => ({
+    const sites = (data ?? []).map((m) => ({
       ...serializeSite(m.sites),
       role: m.role
     }));
+    if (params?.order) {
+      const dir = params.order === "asc" ? 1 : -1;
+      sites.sort((a, b) => (a.createdAt ?? "") < (b.createdAt ?? "") ? -dir : (a.createdAt ?? "") > (b.createdAt ?? "") ? dir : 0);
+    }
+    return sites;
   }
   async get() {
     const { data, error: error48 } = await this.client.db.from("sites").select("*").eq("id", this.client.siteIdNumber).single();
@@ -36634,8 +36644,10 @@ var RedirectsEndpoint = class {
   constructor(client) {
     this.client = client;
   }
-  async list() {
-    const { data, error: error48 } = await this.client.db.from("redirect_rules").select("*").eq("site_id", this.client.siteIdNumber).order("priority", { ascending: true });
+  async list(params) {
+    let query = this.client.db.from("redirect_rules").select("*").eq("site_id", this.client.siteIdNumber);
+    query = params?.order ? query.order("created_at", { ascending: params.order === "asc" }) : query.order("priority", { ascending: true });
+    const { data, error: error48 } = await query;
     if (error48)
       throw new NeopressApiError("DB_ERROR", error48.message, 0, error48);
     return (data ?? []).map((r) => serializeRedirect(r));
@@ -36712,7 +36724,7 @@ var EntryReferencesEndpoint = class {
       query = query.eq("from_entry_id", params.fromEntryId);
     if (params?.toEntryId)
       query = query.eq("to_entry_id", params.toEntryId);
-    const { data, error: error48 } = await query.order("created_at", { ascending: false });
+    const { data, error: error48 } = await query.order("created_at", { ascending: params?.order === "asc" });
     if (error48)
       throw new NeopressApiError("DB_ERROR", error48.message, 0, error48);
     return (data ?? []).map((r) => serializeEntryReference(r));
@@ -36834,18 +36846,57 @@ var TemplatesEndpoint = class {
     const res = await this.client.delete(this.basePath);
     return res.data;
   }
+  /**
+   * List templates across the sites the caller can access.
+   *
+   * Direct-DB: `templates` is public-read and `sites` RLS scopes the visible set
+   * (own active memberships, or all sites for the super admin), so no server
+   * route is needed — the two RLS-scoped queries reproduce the old handler.
+   */
   async list(params) {
-    const qs = new URLSearchParams();
-    if (params?.namePrefix)
-      qs.set("namePrefix", params.namePrefix);
-    if (params?.industry)
-      qs.set("industry", params.industry);
-    if (params?.limit != null)
-      qs.set("limit", String(params.limit));
-    const query = qs.toString();
-    const path = query ? `/api/v1/templates?${query}` : "/api/v1/templates";
-    const res = await this.client.get(path);
-    return res.data;
+    const { data: sitesData, error: sitesError } = await this.client.db.from("sites").select("id, handle, name");
+    if (sitesError)
+      throw new NeopressApiError("DB_ERROR", sitesError.message, 0, sitesError);
+    const siteMeta = /* @__PURE__ */ new Map();
+    for (const site of sitesData ?? []) {
+      if (typeof site.id !== "number")
+        continue;
+      siteMeta.set(site.id, {
+        handle: site.handle ?? null,
+        name: site.name ?? null
+      });
+    }
+    const siteIds = [...siteMeta.keys()];
+    if (siteIds.length === 0)
+      return [];
+    const namePrefix = params?.namePrefix?.trim();
+    const industry = params?.industry?.trim();
+    const limit = Math.min(Math.max(params?.limit ?? 100, 1), 500);
+    let query = this.client.db.from("templates").select("id, name, industry, reference_url, preview_img_urls, description, created_at").in("id", siteIds);
+    if (namePrefix)
+      query = query.ilike("name", `${namePrefix}%`);
+    if (industry)
+      query = query.eq("industry", industry);
+    if (params?.order)
+      query = query.order("created_at", { ascending: params.order === "asc" });
+    query = query.limit(limit);
+    const { data, error: error48 } = await query;
+    if (error48)
+      throw new NeopressApiError("DB_ERROR", error48.message, 0, error48);
+    return (data ?? []).map((t) => {
+      const siteId = t.id;
+      return {
+        siteId,
+        handle: siteMeta.get(siteId)?.handle ?? null,
+        siteName: siteMeta.get(siteId)?.name ?? null,
+        name: t.name,
+        industry: t.industry,
+        referenceUrl: t.reference_url,
+        previewImgUrls: t.preview_img_urls ?? null,
+        description: t.description ?? null,
+        createdAt: t.created_at
+      };
+    });
   }
 };
 
@@ -36868,7 +36919,12 @@ var HeadshotsEndpoint = class {
       query = query.eq("attire", params.attire);
     if (params?.isActive !== void 0)
       query = query.eq("is_active", params.isActive);
-    const { data, error: error48, count } = await query.order("age_band", { ascending: true }).order("gender", { ascending: true }).order("ethnicity", { ascending: true }).order("variation_index", { ascending: true }).range(offset, offset + limit - 1);
+    if (params?.order) {
+      query = query.order("created_at", { ascending: params.order === "asc" });
+    } else {
+      query = query.order("age_band", { ascending: true }).order("gender", { ascending: true }).order("ethnicity", { ascending: true }).order("variation_index", { ascending: true });
+    }
+    const { data, error: error48, count } = await query.range(offset, offset + limit - 1);
     if (error48)
       throw new NeopressApiError("DB_ERROR", error48.message, 0, error48);
     return {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@neopress/cli",
-  "version": "4.2.0",
+  "version": "4.3.0",
   "description": "Neopress CLI — manage your Neopress site from the terminal",
   "type": "module",
   "keywords": [