@animaapp/cli 0.5.0 → 0.6.0

package/dist/index.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 
 // src/index.ts
-import { Command as Command13 } from "commander";
+import { Command as Command14 } from "commander";
 
 // src/commands/create.ts
 import { Command } from "commander";
@@ -13,29 +13,57 @@ import path from "path";
 import os from "os";
 var CONFIG_DIR = path.join(os.homedir(), ".config", "anima");
 var CREDENTIALS_FILE = path.join(CONFIG_DIR, "credentials.json");
-function readCredentials() {
+function classifyCredentials() {
+  let parsed;
   try {
-    if (!fs.existsSync(CREDENTIALS_FILE)) return null;
-    const content = fs.readFileSync(CREDENTIALS_FILE, "utf-8");
-    const parsed = JSON.parse(content);
-    if (!parsed.token) return null;
-    return parsed;
+    if (!fs.existsSync(CREDENTIALS_FILE)) return { kind: "absent" };
+    parsed = JSON.parse(fs.readFileSync(CREDENTIALS_FILE, "utf-8"));
   } catch {
-    return null;
+    return { kind: "malformed" };
+  }
+  const figmaToken = typeof parsed.figmaToken === "string" ? parsed.figmaToken : void 0;
+  if (typeof parsed.token !== "string") {
+    return figmaToken ? { kind: "figma-only", figmaToken } : { kind: "absent" };
+  }
+  if (parsed.tokenType === "agent") {
+    const required2 = ["teamId", "agentId", "expiresAt", "refreshToken", "refreshExpiresAt"];
+    if (required2.some((field) => typeof parsed[field] !== "string")) {
+      return { kind: "malformed" };
+    }
+    return { kind: "agent", credential: parsed, figmaToken };
   }
+  return {
+    kind: "account",
+    credential: {
+      tokenType: "account",
+      token: parsed.token,
+      teamId: typeof parsed.teamId === "string" ? parsed.teamId : void 0
+    },
+    figmaToken
+  };
+}
+function readCredentials() {
+  const stored = classifyCredentials();
+  if (stored.kind !== "agent" && stored.kind !== "account") return null;
+  return { ...stored.credential, ...stored.figmaToken ? { figmaToken: stored.figmaToken } : {} };
 }
-function writeCredentials(credentials) {
-  const existing = readCredentials() ?? {};
-  const merged = { ...existing, ...credentials };
+function saveCredential(credential) {
+  const figmaToken = readCredentials()?.figmaToken;
+  write({ ...credential, ...figmaToken ? { figmaToken } : {} });
+}
+function saveFigmaToken(figmaToken) {
+  const existing = readCredentials();
+  write({ ...existing ?? {}, figmaToken });
+}
+function write(credentials) {
+  const merged = { ...credentials };
   for (const key of Object.keys(merged)) {
     if (merged[key] === void 0) delete merged[key];
   }
   fs.mkdirSync(CONFIG_DIR, { recursive: true });
-  fs.writeFileSync(
-    CREDENTIALS_FILE,
-    JSON.stringify(merged, null, 2) + "\n",
-    { mode: 384 }
-  );
+  const tmp = `${CREDENTIALS_FILE}.${process.pid}.tmp`;
+  fs.writeFileSync(tmp, JSON.stringify(merged, null, 2) + "\n", { mode: 384 });
+  fs.renameSync(tmp, CREDENTIALS_FILE);
 }
 function deleteCredentials() {
   try {
@@ -74,6 +102,17 @@ function extractTeamIdFromJWT(token) {
   }
 }
 
+// src/auth/jwt.ts
+function decodeJwtPayload(token) {
+  try {
+    const parts = token.split(".");
+    if (parts.length !== 3) return void 0;
+    return JSON.parse(Buffer.from(parts[1], "base64url").toString("utf-8"));
+  } catch {
+    return void 0;
+  }
+}
+
 // src/api/errors.ts
 var EXIT_CODES = {
   SUCCESS: 0,
@@ -116,37 +155,39 @@ function timeoutError() {
   );
 }
 
-// src/auth/token.ts
-function resolveAuth() {
-  const creds = readCredentials();
-  const envToken = process.env.ANIMA_API_TOKEN;
-  if (envToken) {
-    return {
-      token: envToken,
-      teamId: process.env.ANIMA_TEAM_ID,
-      figmaToken: process.env.FIGMA_TOKEN || creds?.figmaToken,
-      source: "env"
-    };
-  }
-  if (creds) {
-    if (creds.tokenType === "agent" && creds.expiresAt && new Date(creds.expiresAt) <= /* @__PURE__ */ new Date()) {
-      throw authError("Your agent token has expired. Run: anima login");
-    }
-    return {
-      token: creds.token,
-      teamId: creds.teamId,
-      figmaToken: process.env.FIGMA_TOKEN || creds.figmaToken,
-      source: "file",
-      tokenType: creds.tokenType
-    };
+// src/auth/agentSession.ts
+function required(value, field) {
+  if (value === void 0) {
+    throw authError(
+      `The server's token response is missing \`${field}\`. Check --api-url points at an Anima API that issues agent credentials.`
+    );
   }
-  throw authError("No credentials found. Run: anima login\n(or set the ANIMA_API_TOKEN env var)");
+  return value;
+}
+function agentSessionFromTokenResponse(body, carriedOver) {
+  const token = typeof body.access_token === "string" ? body.access_token : void 0;
+  const claims = decodeJwtPayload(required(token, "access_token"));
+  return {
+    token,
+    teamId: required(typeof claims?.team_id === "string" ? claims.team_id : void 0, "team_id"),
+    agentId: required(typeof claims?.agent_id === "string" ? claims.agent_id : void 0, "agent_id"),
+    expiresAt: required(
+      typeof claims?.exp === "number" ? new Date(claims.exp * 1e3).toISOString() : void 0,
+      "exp"
+    ),
+    refreshToken: required(
+      typeof body.refresh_token === "string" ? body.refresh_token : carriedOver?.refreshToken,
+      "refresh_token"
+    ),
+    refreshExpiresAt: required(
+      typeof body.refresh_expires_in === "number" ? new Date(Date.now() + body.refresh_expires_in * 1e3).toISOString() : carriedOver?.refreshExpiresAt,
+      "refresh_expires_in"
+    )
+  };
+}
+function persistAgentSession(session) {
+  saveCredential({ tokenType: "agent", ...session });
 }
-
-// src/api/mcp.ts
-import { Client } from "@modelcontextprotocol/sdk/client/index.js";
-import { StreamableHTTPClientTransport } from "@modelcontextprotocol/sdk/client/streamableHttp.js";
-import { CallToolResultSchema, ErrorCode } from "@modelcontextprotocol/sdk/types.js";
 
 // src/output/log.ts
 import fs2 from "fs";
@@ -180,6 +221,173 @@ function redact(value) {
   return out;
 }
 
+// src/auth/refresh.ts
+var REFRESH_GRANT_TYPE = "refresh_token";
+function readFailure(body) {
+  const raw = body.error;
+  const nested = typeof raw === "object" && raw !== null ? raw : null;
+  const code = typeof raw === "string" ? raw : typeof nested?.code === "string" ? nested.code : typeof nested?.error === "string" ? nested.error : null;
+  const described = typeof body.error_description === "string" ? body.error_description : null;
+  const message = described ?? (typeof raw === "string" ? raw : raw == null ? null : JSON.stringify(raw));
+  return { code, message };
+}
+async function refreshAccessToken(apiUrl, carriedOver, fetchFn = fetch) {
+  const base = apiUrl.replace(/\/$/, "");
+  const response = await fetchFn(`${base}/oauth/token`, {
+    method: "POST",
+    headers: { "Content-Type": "application/x-www-form-urlencoded" },
+    body: new URLSearchParams({
+      grant_type: REFRESH_GRANT_TYPE,
+      refresh_token: carriedOver.refreshToken
+    }).toString()
+  });
+  const body = await response.json().catch(() => ({}));
+  const failure = readFailure(body);
+  logEvent("refresh_token_response", { status: response.status, error: failure.code });
+  if (!response.ok || typeof body.access_token !== "string") {
+    if (failure.code === "invalid_grant") {
+      clearStorage();
+      throw authError(`${failure.message ?? "Your credentials are no longer valid"}
+Run: anima login`);
+    }
+    throw apiError(
+      `Could not refresh credentials (HTTP ${response.status})${failure.message ? `: ${failure.message}` : ""}`
+    );
+  }
+  const session = agentSessionFromTokenResponse(body, carriedOver);
+  saveCredential({ tokenType: "agent", ...session });
+  return session;
+}
+async function revokeStoredRefreshToken(apiUrl, fetchFn = fetch) {
+  const creds = readCredentials();
+  if (creds?.tokenType !== "agent") return false;
+  try {
+    const response = await fetchFn(`${apiUrl.replace(/\/$/, "")}/oauth/revoke`, {
+      method: "POST",
+      headers: { "Content-Type": "application/x-www-form-urlencoded" },
+      body: new URLSearchParams({ token: creds.refreshToken, token_type_hint: "refresh_token" }).toString()
+    });
+    logEvent("revoke_response", { status: response.status });
+    return response.ok;
+  } catch (err) {
+    logEvent("revoke_failed", { error: err instanceof Error ? err.message : String(err) });
+    return false;
+  }
+}
+
+// src/config/store.ts
+import fs3 from "fs";
+import path3 from "path";
+import os2 from "os";
+var CONFIG_DIR2 = path3.join(os2.homedir(), ".config", "anima");
+var CONFIG_FILE = path3.join(CONFIG_DIR2, "config.json");
+var DEFAULT_API_URL = "https://api.agentgrid.io";
+var CONFIG_KEYS = {
+  "api-url": "apiUrl"
+};
+function isConfigKey(key) {
+  return key in CONFIG_KEYS;
+}
+function configKeys() {
+  return Object.keys(CONFIG_KEYS);
+}
+function readConfig() {
+  try {
+    if (!fs3.existsSync(CONFIG_FILE)) return {};
+    const parsed = JSON.parse(fs3.readFileSync(CONFIG_FILE, "utf-8"));
+    return parsed && typeof parsed === "object" ? parsed : {};
+  } catch {
+    return {};
+  }
+}
+function setConfig(key, value) {
+  const merged = { ...readConfig(), [CONFIG_KEYS[key]]: value };
+  fs3.mkdirSync(CONFIG_DIR2, { recursive: true });
+  fs3.writeFileSync(CONFIG_FILE, JSON.stringify(merged, null, 2) + "\n");
+}
+function deleteConfig() {
+  try {
+    if (!fs3.existsSync(CONFIG_FILE)) return false;
+    fs3.unlinkSync(CONFIG_FILE);
+    return true;
+  } catch {
+    return false;
+  }
+}
+function unsetConfig(key) {
+  const config = readConfig();
+  const field = CONFIG_KEYS[key];
+  if (!(field in config)) return false;
+  delete config[field];
+  fs3.mkdirSync(CONFIG_DIR2, { recursive: true });
+  fs3.writeFileSync(CONFIG_FILE, JSON.stringify(config, null, 2) + "\n");
+  return true;
+}
+function getConfigPath() {
+  return CONFIG_FILE;
+}
+function resolveApiUrl(flagValue) {
+  return flagValue || process.env.ANIMA_API_URL || readConfig().apiUrl || DEFAULT_API_URL;
+}
+
+// src/auth/token.ts
+var RENEW_BEFORE_EXPIRY_MS = 6e4;
+function needsRenewal(expiresAt) {
+  if (!expiresAt) return false;
+  const expiry = new Date(expiresAt).getTime();
+  return Number.isNaN(expiry) || expiry - Date.now() <= RENEW_BEFORE_EXPIRY_MS;
+}
+async function resolveAuth(apiUrlOverride) {
+  const stored = classifyCredentials();
+  const envToken = process.env.ANIMA_API_TOKEN;
+  if (envToken) {
+    return {
+      token: envToken,
+      teamId: process.env.ANIMA_TEAM_ID,
+      figmaToken: process.env.FIGMA_TOKEN || ("figmaToken" in stored ? stored.figmaToken : void 0),
+      source: "env"
+    };
+  }
+  const figmaToken = process.env.FIGMA_TOKEN || ("figmaToken" in stored ? stored.figmaToken : void 0);
+  if (stored.kind === "agent") {
+    const { credential } = stored;
+    if (needsRenewal(credential.expiresAt)) {
+      const renewed = await refreshAccessToken(resolveApiUrl(apiUrlOverride), {
+        refreshToken: credential.refreshToken,
+        refreshExpiresAt: credential.refreshExpiresAt
+      });
+      return { token: renewed.token, teamId: renewed.teamId, figmaToken, source: "file", tokenType: "agent" };
+    }
+    return {
+      token: credential.token,
+      teamId: credential.teamId,
+      figmaToken,
+      source: "file",
+      tokenType: "agent"
+    };
+  }
+  if (stored.kind === "account") {
+    return {
+      token: stored.credential.token,
+      teamId: stored.credential.teamId,
+      figmaToken,
+      source: "file",
+      tokenType: "account"
+    };
+  }
+  if (stored.kind === "malformed") {
+    throw authError(
+      `Your credentials file is damaged or incomplete (${getCredentialsPath()}). Run: anima login`
+    );
+  }
+  throw authError("No credentials found. Run: anima login\n(or set the ANIMA_API_TOKEN env var)");
+}
+
+// src/api/mcp.ts
+import { Client } from "@modelcontextprotocol/sdk/client/index.js";
+import { StreamableHTTPClientTransport } from "@modelcontextprotocol/sdk/client/streamableHttp.js";
+import { CallToolResultSchema, ErrorCode } from "@modelcontextprotocol/sdk/types.js";
+
 // src/version.ts
 import { createRequire } from "module";
 var { version } = createRequire(import.meta.url)("../package.json");
@@ -367,10 +575,10 @@ function printKeyValue(key, value) {
 }
 function printSessionResult(result) {
   console.log();
-  printSuccess("Playground created successfully!");
+  printSuccess("Artifact created successfully!");
   printKeyValue("Session ID", result.sessionId);
   if (result.playgroundUrl) {
-    printKeyValue("Your playground", chalk.cyan.underline(result.playgroundUrl));
+    printKeyValue("Your artifact", chalk.cyan.underline(result.playgroundUrl));
   }
   if (result.tokenUsage) {
     printKeyValue("Token usage", result.tokenUsage.toLocaleString());
@@ -383,13 +591,6 @@ function printDeployResult(result) {
   if (result.url) {
     printKeyValue("Live URL", chalk.cyan.underline(result.url));
   }
-  if (result.packageName) {
-    printKeyValue("Package", result.packageName);
-    printKeyValue("Version", result.packageVersion ?? "");
-    if (result.packageUrl) {
-      printKeyValue("URL", chalk.cyan.underline(result.packageUrl));
-    }
-  }
   console.log();
 }
 function printFilesWritten(outputDir, count) {
@@ -533,78 +734,26 @@ function parsePlaygroundUrl(input) {
   }
 }
 
-// src/config/store.ts
-import fs3 from "fs";
-import path3 from "path";
-import os2 from "os";
-var CONFIG_DIR2 = path3.join(os2.homedir(), ".config", "anima");
-var CONFIG_FILE = path3.join(CONFIG_DIR2, "config.json");
-var DEFAULT_API_URL = "https://api.agentgrid.io";
-var CONFIG_KEYS = {
-  "api-url": "apiUrl"
-};
-function isConfigKey(key) {
-  return key in CONFIG_KEYS;
-}
-function configKeys() {
-  return Object.keys(CONFIG_KEYS);
-}
-function readConfig() {
-  try {
-    if (!fs3.existsSync(CONFIG_FILE)) return {};
-    const parsed = JSON.parse(fs3.readFileSync(CONFIG_FILE, "utf-8"));
-    return parsed && typeof parsed === "object" ? parsed : {};
-  } catch {
-    return {};
-  }
-}
-function setConfig(key, value) {
-  const merged = { ...readConfig(), [CONFIG_KEYS[key]]: value };
-  fs3.mkdirSync(CONFIG_DIR2, { recursive: true });
-  fs3.writeFileSync(CONFIG_FILE, JSON.stringify(merged, null, 2) + "\n");
-}
-function deleteConfig() {
-  try {
-    if (!fs3.existsSync(CONFIG_FILE)) return false;
-    fs3.unlinkSync(CONFIG_FILE);
-    return true;
-  } catch {
-    return false;
-  }
-}
-function unsetConfig(key) {
-  const config = readConfig();
-  const field = CONFIG_KEYS[key];
-  if (!(field in config)) return false;
-  delete config[field];
-  fs3.mkdirSync(CONFIG_DIR2, { recursive: true });
-  fs3.writeFileSync(CONFIG_FILE, JSON.stringify(config, null, 2) + "\n");
-  return true;
-}
-function getConfigPath() {
-  return CONFIG_FILE;
-}
-function resolveApiUrl(flagValue) {
-  return flagValue || process.env.ANIMA_API_URL || readConfig().apiUrl || DEFAULT_API_URL;
-}
-
 // src/commands/create.ts
 var createCommand = new Command("create").description(
-  "Create a playground from your own code: empty for code you'll push (instant) or import your existing code (instant). Also supports AI generation: p2c/l2c/f2c (3-7 min)."
+  "Create an artifact from your own code: empty for code you'll push (instant) or import your existing code (instant). Also supports AI generation: p2c/l2c/f2c (3-7 min)."
 ).requiredOption(
   "-t, --type <type>",
   "empty (empty repo you push to), import (create FROM your code \u2014 use --from), or AI-generated: p2c, l2c, f2c"
 ).option("-p, --prompt <prompt>", "Text prompt (p2c)").option("-u, --url <url>", "Website URL (l2c)").option("--file-key <key>", "Figma file key or URL (f2c)").option("--nodes <nodes>", "Figma node IDs, comma-separated (f2c)").option("--figma-token <token>", "Figma personal access token (f2c)").option(
   "--framework <fw>",
   "html | react \u2014 the only supported frameworks. REQUIRED for empty (declare react if you will push React code); detected from package.json for import"
-).option("--styling <style>", "tailwind | css | plain_css | css_modules | inline_styles", "tailwind").option("--language <lang>", "typescript | javascript").option("--ui-library <lib>", "mui | antd | shadcn | clean_react").option("--guidelines <text>", "Additional constraints (p2c only)").option("--name <name>", "Project name (empty/import only)").option("--from <path>", "Folder or .zip with your project (import only) \u2014 becomes the first commit").option("--json", "Output as JSON").option("--timeout <ms>", "Timeout in milliseconds", "600000").option("--verbose", "Show progress on stderr").option("--api-url <url>", "API base URL (overrides config / ANIMA_API_URL)").option("--log-file <path>", "Append a JSON debug log of each step to this file").action(async (opts) => {
+).option("--styling <style>", "tailwind | css | plain_css | css_modules | inline_styles", "tailwind").option("--language <lang>", "typescript | javascript").option("--ui-library <lib>", "mui | antd | shadcn | clean_react").option("--guidelines <text>", "Additional constraints (p2c only)").option(
+  "--artifact-type <kind>",
+  "app | markdown \u2014 what the artifact IS. app (default) needs an index.html; markdown needs .md files"
+).option("--name <name>", "Project name (empty/import only)").option("--from <path>", "Folder or .zip with your project (import only) \u2014 becomes the first commit").option("--json", "Output as JSON").option("--timeout <ms>", "Timeout in milliseconds", "600000").option("--verbose", "Show progress on stderr").option("--api-url <url>", "API base URL (overrides config / ANIMA_API_URL)").option("--log-file <path>", "Append a JSON debug log of each step to this file").action(async (opts) => {
   const mode = detectOutputMode(opts);
   initLogger(opts.logFile);
   const progress = new ProgressReporter(mode, opts.verbose);
   try {
     const type = opts.type;
     validateCreateOptions(type, opts);
-    const auth = resolveAuth();
+    const auth = await resolveAuth(opts.apiUrl);
     const figmaToken = type === "f2c" ? resolveFigmaToken(opts, auth.figmaToken) : void 0;
     const args = buildCreateArgs(type, opts);
     const mcpConfig = { apiBaseUrl: resolveApiUrl(opts.apiUrl), token: auth.token, teamId: auth.teamId, figmaToken };
@@ -617,7 +766,7 @@ var createCommand = new Command("create").description(
         progress.update(`Uploading project zip (${source.reason})...`);
         const grant = await withMcp(
           mcpConfig,
-          (client) => client.callTool("playground-get_zip_upload_url", {})
+          (client) => client.callTool("artifact-get_zip_upload_url", {})
         );
         if (!grant.success || !grant.uploadUrl || !grant.zipUploadId) {
           const message = grant.reason || grant.error || "Could not get a zip upload URL";
@@ -635,11 +784,11 @@ ${grant.nextSteps}` : message, grant);
       }
     }
     progress.start(
-      type === "empty" ? "Creating empty playground..." : type === "import" ? "Importing your project..." : `Creating ${type.toUpperCase()} playground...`
+      type === "empty" ? "Creating empty artifact..." : type === "import" ? "Importing your project..." : `Creating ${type.toUpperCase()} artifact...`
     );
     const result = await withMcp(
       mcpConfig,
-      (client) => client.callTool("playground-create", args, {
+      (client) => client.callTool("artifact-create", args, {
         timeoutMs: parseInt(opts.timeout, 10),
         onProgress: (p) => progress.update(p.message ?? `Generating (${Math.round(p.progress)}%)...`)
       })
@@ -650,20 +799,20 @@ ${grant.nextSteps}` : message, grant);
 ${result.nextSteps}` : message, result);
     }
     const playgroundUrl = result.playgroundUrl || `${PLAYGROUND_BASE}/${result.sessionId}`;
-    progress.succeed("Playground created!");
+    progress.succeed("Artifact created!");
     if (mode === "pretty") {
       printSessionResult({ sessionId: result.sessionId, playgroundUrl });
       if (result.gitRemoteUrl) {
         console.log(`  ${chalk2.cyan(`git clone ${result.gitRemoteUrl}`)}`);
         console.log();
-        console.log("  Commit and push to update the live playground.");
+        console.log("  Commit and push to update the live artifact.");
         if (result.expiresAt) {
           console.log(
             `  The URL embeds a token that expires at ${result.expiresAt} and cannot be renewed;
   run ${chalk2.cyan(`anima get-git-token ${result.sessionId}`)} and ${chalk2.cyan("git remote set-url origin <new url>")} to keep pushing.`
           );
         }
-        console.log("  Treat the URL as a secret \u2014 it grants access to this playground.");
+        console.log("  Treat the URL as a secret \u2014 it grants access to this artifact.");
         console.log();
       } else if (type === "empty") {
         console.log(
@@ -751,9 +900,12 @@ function buildCreateArgs(type, opts) {
   }
   const framework = opts.framework ?? "html";
   const language = opts.language ?? (framework === "react" ? "typescript" : void 0);
+  const artifactType = opts.artifactType;
   const args = {
     type,
-    framework,
+    // framework describes how to build an app; a document has none.
+    ...artifactType === "markdown" ? {} : { framework },
+    ...artifactType ? { artifactType } : {},
     styling: opts.styling
   };
   if (language) args.language = language;
@@ -791,7 +943,7 @@ var listCommand = new Command2("list").aliases(["ls", "artifacts"]).description(
   const mode = detectOutputMode(opts);
   initLogger(opts.logFile);
   try {
-    const auth = resolveAuth();
+    const auth = await resolveAuth(opts.apiUrl);
     const result = await withMcp(
       { apiBaseUrl: resolveApiUrl(opts.apiUrl), token: auth.token, teamId: auth.teamId },
       (client) => client.callTool("workspace-list_artifacts", {})
@@ -861,30 +1013,16 @@ function formatUpdatedAt(iso) {
 
 // src/commands/publish.ts
 import { Command as Command3 } from "commander";
-var publishCommand = new Command3("publish").description("Deploy playground to live URL or npm package (1-3 min)").argument("<sessionId>", "Session ID from create command").option("--mode <mode>", "webapp | designSystem", "webapp").option("--package-name <name>", "NPM package name (designSystem mode)").option("--package-version <version>", "NPM package version (designSystem mode)").option("--json", "Output as JSON").option("--verbose", "Show progress on stderr").option("--api-url <url>", "API base URL (overrides config / ANIMA_API_URL)").option("--log-file <path>", "Append a JSON debug log of each step to this file").action(async (sessionId, opts) => {
+var publishCommand = new Command3("publish").description("Deploy an artifact's app to a live public URL (1-3 min)").argument("<sessionId>", "Session ID from create command").option("--json", "Output as JSON").option("--verbose", "Show progress on stderr").option("--api-url <url>", "API base URL (overrides config / ANIMA_API_URL)").option("--log-file <path>", "Append a JSON debug log of each step to this file").action(async (sessionId, opts) => {
   const mode = detectOutputMode(opts);
   initLogger(opts.logFile);
   const progress = new ProgressReporter(mode, opts.verbose);
   try {
-    if (!["webapp", "designSystem"].includes(opts.mode)) {
-      throw validationError(
-        `Invalid mode "${opts.mode}". Must be webapp or designSystem.`
-      );
-    }
-    if (opts.mode === "designSystem" && !opts.packageName) {
-      throw validationError("--package-name is required for designSystem mode");
-    }
-    const auth = resolveAuth();
-    const args = {
-      sessionId,
-      mode: opts.mode
-    };
-    if (opts.packageName) args.packageName = opts.packageName;
-    if (opts.packageVersion) args.packageVersion = opts.packageVersion;
-    progress.start(`Publishing as ${opts.mode}...`);
+    const auth = await resolveAuth(opts.apiUrl);
+    progress.start("Publishing...");
     const result = await withMcp(
       { apiBaseUrl: resolveApiUrl(opts.apiUrl), token: auth.token, teamId: auth.teamId },
-      (client) => client.callTool("playground-publish", args, {
+      (client) => client.callTool("artifact-publish", { sessionId }, {
         onProgress: (p) => progress.update(p.message ?? "Publishing...")
       })
     );
@@ -898,22 +1036,12 @@ var publishCommand = new Command3("publish").description("Deploy playground to l
     }
     progress.succeed("Published!");
     if (mode === "pretty") {
-      printDeployResult({
-        url: result.liveUrl,
-        packageUrl: result.packageUrl,
-        packageName: result.packageName,
-        packageVersion: result.packageVersion
-      });
+      printDeployResult({ url: result.liveUrl });
     } else {
       outputResult(mode, {
         success: true,
         sessionId,
-        ...result.liveUrl ? { liveUrl: result.liveUrl, subdomain: result.subdomain } : {},
-        ...result.packageName ? {
-          packageName: result.packageName,
-          packageVersion: result.packageVersion,
-          packageUrl: result.packageUrl
-        } : {}
+        ...result.liveUrl ? { liveUrl: result.liveUrl, subdomain: result.subdomain } : {}
       });
     }
   } catch (err) {
@@ -959,7 +1087,7 @@ function writeFilesToDisk(files, outputDir) {
 }
 
 // src/commands/codegen.ts
-var codegenCommand = new Command4("codegen").description("Convert Figma design to code files (no playground)").requiredOption("--file-key <key>", "Figma file key or URL").option("--nodes <nodes>", "Figma node IDs, comma-separated").option("--figma-token <token>", "Figma personal access token (or set FIGMA_TOKEN env var)").option("-o, --output <dir>", "Output directory", "./generated").option("--framework <fw>", "react | html", "react").option("--styling <style>", "tailwind | plain_css", "tailwind").option("--language <lang>", "typescript | javascript").option("--ui-library <lib>", "mui | antd | shadcn | clean_react").option("--json", "Output as JSON").option("--timeout <ms>", "Timeout in milliseconds", "600000").option("--verbose", "Show progress on stderr").option("--api-url <url>", "API base URL (overrides config / ANIMA_API_URL)").option("--log-file <path>", "Append a JSON debug log of each step to this file").action(async (opts) => {
+var codegenCommand = new Command4("codegen").description("Convert Figma design to code files (no artifact)").requiredOption("--file-key <key>", "Figma file key or URL").option("--nodes <nodes>", "Figma node IDs, comma-separated").option("--figma-token <token>", "Figma personal access token (or set FIGMA_TOKEN env var)").option("-o, --output <dir>", "Output directory", "./generated").option("--framework <fw>", "react | html", "react").option("--styling <style>", "tailwind | plain_css", "tailwind").option("--language <lang>", "typescript | javascript").option("--ui-library <lib>", "mui | antd | shadcn | clean_react").option("--json", "Output as JSON").option("--timeout <ms>", "Timeout in milliseconds", "600000").option("--verbose", "Show progress on stderr").option("--api-url <url>", "API base URL (overrides config / ANIMA_API_URL)").option("--log-file <path>", "Append a JSON debug log of each step to this file").action(async (opts) => {
   const mode = detectOutputMode(opts);
   initLogger(opts.logFile);
   const progress = new ProgressReporter(mode, opts.verbose);
@@ -976,7 +1104,7 @@ var codegenCommand = new Command4("codegen").description("Convert Figma design t
         "No node IDs provided. Use --nodes or include node-id in the Figma URL."
       );
     }
-    const auth = resolveAuth();
+    const auth = await resolveAuth(opts.apiUrl);
     const figmaToken = opts.figmaToken || process.env.FIGMA_TOKEN || auth.figmaToken;
     if (!figmaToken) {
       throw validationError(
@@ -1045,18 +1173,18 @@ function parseGitTokenResponse(payload) {
     try {
       value = JSON.parse(value);
     } catch {
-      throw apiError(`Unexpected response from project-get_git_token: ${preview(payload)}`);
+      throw apiError(`Unexpected response from artifact-get_git_token: ${preview(payload)}`);
     }
   }
   if (value === null || typeof value !== "object") {
-    throw apiError(`Unexpected response from project-get_git_token: ${preview(payload)}`);
+    throw apiError(`Unexpected response from artifact-get_git_token: ${preview(payload)}`);
   }
   const body = value;
   if (body.success === false) {
     throw apiError(`Git access ${body.error ?? "denied"}: ${(body.reason ?? "").trim()}`);
   }
   if (!body.gitRemoteUrl) {
-    throw apiError(`Unexpected response from project-get_git_token: ${preview(payload)}`);
+    throw apiError(`Unexpected response from artifact-get_git_token: ${preview(payload)}`);
   }
   return {
     gitRemoteUrl: body.gitRemoteUrl,
@@ -1066,17 +1194,17 @@ function parseGitTokenResponse(payload) {
 }
 
 // src/commands/getGitToken.ts
-var getGitTokenCommand = new Command5("get-git-token").description("Mint a short-lived git remote URL for a playground (clone/push with git)").argument("<playgroundUrl>", "Playground URL or session ID").option("--json", "Output as JSON").option("--verbose", "Show progress on stderr").option("--api-url <url>", "API base URL (overrides config / ANIMA_API_URL)").option("--log-file <path>", "Append a JSON debug log of each step to this file").action(async (playgroundUrl, opts) => {
+var getGitTokenCommand = new Command5("get-git-token").description("Mint a short-lived git remote URL for an artifact (clone/push with git)").argument("<artifactUrl>", "Artifact URL or session ID").option("--json", "Output as JSON").option("--verbose", "Show progress on stderr").option("--api-url <url>", "API base URL (overrides config / ANIMA_API_URL)").option("--log-file <path>", "Append a JSON debug log of each step to this file").action(async (artifactUrl, opts) => {
   const mode = detectOutputMode(opts);
   initLogger(opts.logFile);
   const progress = new ProgressReporter(mode, opts.verbose);
   try {
-    const sessionId = parsePlaygroundUrl(playgroundUrl);
-    const auth = resolveAuth();
+    const sessionId = parsePlaygroundUrl(artifactUrl);
+    const auth = await resolveAuth(opts.apiUrl);
     progress.start("Requesting git access...");
     const response = await withMcp(
       { apiBaseUrl: resolveApiUrl(opts.apiUrl), token: auth.token, teamId: auth.teamId },
-      (client) => client.callTool("project-get_git_token", { sessionId })
+      (client) => client.callTool("artifact-get_git_token", { sessionId })
     );
     const grant = parseGitTokenResponse(response);
     logEvent("git_token_granted", { sessionId, access: grant.access, expiresAt: grant.expiresAt });
@@ -1086,7 +1214,7 @@ var getGitTokenCommand = new Command5("get-git-token").description("Mint a short
       console.log(`  ${chalk4.cyan(`git clone ${grant.gitRemoteUrl}`)}`);
       console.log();
       if (grant.access === "rw") {
-        console.log("  Commit and push to update the live playground.");
+        console.log("  Commit and push to update the live artifact.");
       } else {
         console.log("  Read-only: cloning works, pushing will be rejected.");
       }
@@ -1096,7 +1224,7 @@ var getGitTokenCommand = new Command5("get-git-token").description("Mint a short
   re-run this command and ${chalk4.cyan("git remote set-url origin <new url>")} to keep pushing.`
         );
       }
-      console.log("  Treat the URL as a secret \u2014 it grants access to this playground.");
+      console.log("  Treat the URL as a secret \u2014 it grants access to this artifact.");
       console.log();
     } else {
       outputResult(mode, {
@@ -1133,15 +1261,6 @@ import open from "open";
 var DEVICE_GRANT_TYPE = "urn:ietf:params:oauth:grant-type:device_code";
 var DEFAULT_CLIENT_NAME = "AgentGrid CLI";
 var defaultSleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
-function decodeJwtPayload(token) {
-  try {
-    const parts = token.split(".");
-    if (parts.length !== 3) return void 0;
-    return JSON.parse(Buffer.from(parts[1], "base64url").toString("utf-8"));
-  } catch {
-    return void 0;
-  }
-}
 async function loginWithDeviceFlow(options) {
   const fetchFn = options.fetchFn ?? fetch;
   const sleep = options.sleepFn ?? defaultSleep;
@@ -1186,22 +1305,9 @@ async function loginWithDeviceFlow(options) {
     const body = await pollResponse.json();
     logEvent("device_token_poll", { status: pollResponse.status, error: body.error });
     if (pollResponse.ok && typeof body.access_token === "string") {
-      const token = body.access_token;
-      const claims = decodeJwtPayload(token);
-      const result = {
-        token,
-        teamId: typeof claims?.team_id === "string" ? claims.team_id : void 0,
-        agentId: typeof claims?.agent_id === "string" ? claims.agent_id : void 0,
-        expiresAt: typeof claims?.exp === "number" ? new Date(claims.exp * 1e3).toISOString() : void 0
-      };
-      writeCredentials({
-        token: result.token,
-        teamId: result.teamId,
-        tokenType: "agent",
-        agentId: result.agentId,
-        expiresAt: result.expiresAt
-      });
-      return result;
+      const session = agentSessionFromTokenResponse(body);
+      persistAgentSession(session);
+      return session;
     }
     switch (body.error) {
       case "authorization_pending":
@@ -1248,15 +1354,6 @@ function parseInvite(input) {
   }
   return { code: trimmed.replace(/\.md$/, "") };
 }
-function decodeJwtPayload2(token) {
-  try {
-    const parts = token.split(".");
-    if (parts.length !== 3) return void 0;
-    return JSON.parse(Buffer.from(parts[1], "base64url").toString("utf-8"));
-  } catch {
-    return void 0;
-  }
-}
 async function loginWithInvite(options) {
   const fetchFn = options.fetchFn ?? fetch;
   const { code } = parseInvite(options.invite);
@@ -1277,28 +1374,15 @@ async function loginWithInvite(options) {
     const description = typeof body.error_description === "string" ? body.error_description : `Invite redemption failed (HTTP ${response.status})`;
     throw new CliError("AUTH_INVALID", description, EXIT_CODES.AUTH_ERROR);
   }
-  const token = body.access_token;
-  const claims = decodeJwtPayload2(token);
-  const result = {
-    token,
-    teamId: typeof claims?.team_id === "string" ? claims.team_id : void 0,
-    agentId: typeof claims?.agent_id === "string" ? claims.agent_id : void 0,
-    expiresAt: typeof claims?.exp === "number" ? new Date(claims.exp * 1e3).toISOString() : void 0
-  };
-  writeCredentials({
-    token: result.token,
-    teamId: result.teamId,
-    tokenType: "agent",
-    agentId: result.agentId,
-    expiresAt: result.expiresAt
-  });
-  return result;
+  const session = agentSessionFromTokenResponse(body);
+  persistAgentSession(session);
+  return session;
 }
 
 // src/commands/login.ts
 var loginCommand = new Command6("login").description("Log in via the device flow, or redeem a pre-approved invite with --invite").option("--invite <url-or-code>", "Redeem an invite link (\u2026/invite/<code>.md) or bare code \u2014 no approval step").option("--client-name <name>", "How this CLI appears on the consent screen", "AgentGrid CLI").option("--no-open", "Do not try to open the verification page in a browser").option("--json", "Output as JSON").option("--api-url <url>", "API base URL (overrides config / ANIMA_API_URL)").option("--log-file <path>", "Append a JSON debug log of each step to this file").option(
   "--print-mcp-config",
-  "After login, also print an MCP server config (includes the token) to paste into an MCP-capable agent"
+  "After login, also print an MCP server config (URL only \u2014 the client authorizes itself) to paste into an MCP-capable agent"
 ).action(async (opts) => {
   const mode = detectOutputMode(opts);
   initLogger(opts.logFile);
@@ -1310,17 +1394,17 @@ var loginCommand = new Command6("login").description("Log in via the device flow
       if (inviteOrigin && readConfig().apiUrl !== apiUrl2) {
         setConfig("api-url", apiUrl2);
       }
-      const mcpConfig = opts.printMcpConfig ? buildMcpConfig(apiUrl2, result.token) : void 0;
+      const mcpConfig = opts.printMcpConfig ? buildMcpConfig(apiUrl2) : void 0;
       if (mode === "pretty") {
         printSuccess("Connected!");
         printKeyValue("Credentials", getCredentialsPath());
-        if (result.agentId) printKeyValue("Agent", result.agentId);
-        if (result.teamId) printKeyValue("Team ID", result.teamId);
-        if (result.expiresAt) printKeyValue("Token expires", result.expiresAt);
+        printKeyValue("Agent", result.agentId);
+        printKeyValue("Team ID", result.teamId);
+        printKeyValue("Token expires", result.expiresAt);
         printInfo("This is a scoped agent token \u2014 it acts within what was approved, and the team can revoke it.");
         if (mcpConfig) {
           console.log();
-          printInfo("MCP server config (token expires ~7 days \u2014 a fresh invite renews it):");
+          printInfo("MCP server config \u2014 your client will prompt to authorize on first use:");
           console.log();
           console.log(JSON.stringify(mcpConfig, null, 2));
         }
@@ -1381,17 +1465,17 @@ var loginCommand = new Command6("login").description("Log in via the device flow
         }
       }
     });
-    const mcpConfig = opts.printMcpConfig ? buildMcpConfig(apiUrl, result.token) : void 0;
+    const mcpConfig = opts.printMcpConfig ? buildMcpConfig(apiUrl) : void 0;
     if (mode === "pretty") {
       printSuccess("Connected!");
       printKeyValue("Credentials", getCredentialsPath());
-      if (result.agentId) printKeyValue("Agent", result.agentId);
-      if (result.teamId) printKeyValue("Team ID", result.teamId);
-      if (result.expiresAt) printKeyValue("Token expires", result.expiresAt);
+      printKeyValue("Agent", result.agentId);
+      printKeyValue("Team ID", result.teamId);
+      printKeyValue("Token expires", result.expiresAt);
       printInfo("This is a scoped agent token \u2014 it acts within what you approved, and your team can revoke it.");
       if (mcpConfig) {
         console.log();
-        printInfo("MCP server config (token expires ~7 days \u2014 re-run `anima login` to refresh):");
+        printInfo("MCP server config \u2014 your client will prompt to authorize on first use:");
         console.log();
         console.log(JSON.stringify(mcpConfig, null, 2));
       }
@@ -1418,41 +1502,30 @@ var loginCommand = new Command6("login").description("Log in via the device flow
     throw err;
   }
 });
-function buildMcpConfig(apiUrl, token) {
+function buildMcpConfig(apiUrl) {
   return {
     mcpServers: {
       anima: {
         type: "http",
-        url: `${apiUrl.replace(/\/$/, "")}/v1/mcp`,
-        headers: { Authorization: `Bearer ${token}` }
+        url: `${apiUrl.replace(/\/$/, "")}/v1/mcp`
       }
     }
   };
 }
 
 // src/commands/mcpConfig.ts
-var mcpConfigCommand = new Command7("mcp-config").description("Print an MCP server config from your stored credentials (run `login` first)").option("--json", "Output as JSON").option("--api-url <url>", "API base URL (overrides config / ANIMA_API_URL)").action(async (opts) => {
+var mcpConfigCommand = new Command7("mcp-config").description("Print an MCP server config for your MCP client").option("--json", "Output as JSON").option("--api-url <url>", "API base URL (overrides config / ANIMA_API_URL)").action(async (opts) => {
   const mode = detectOutputMode(opts);
   try {
-    const auth = resolveAuth();
-    const creds = readCredentials();
-    const expiresAt = auth.source === "env" ? void 0 : creds?.expiresAt;
-    const mcpConfig = buildMcpConfig(resolveApiUrl(opts.apiUrl), auth.token);
+    const mcpConfig = buildMcpConfig(resolveApiUrl(opts.apiUrl));
     if (mode === "pretty") {
-      printInfo("MCP server config (add to your MCP client; the token is a secret):");
+      printInfo("MCP server config (add to your MCP client):");
       console.log();
       console.log(JSON.stringify(mcpConfig, null, 2));
       console.log();
-      if (expiresAt) {
-        printInfo(`Token expires ${expiresAt} \u2014 run \`anima login\` then \`anima mcp-config\` to refresh.`);
-      }
+      printInfo("Your client will prompt you to authorize on first use.");
     } else {
-      outputResult(mode, {
-        success: true,
-        mcpConfig,
-        ...expiresAt ? { expiresAt } : {},
-        ...creds?.agentId && auth.source !== "env" ? { agentId: creds.agentId } : {}
-      });
+      outputResult(mode, { success: true, mcpConfig });
     }
   } catch (err) {
     if (err instanceof CliError) {
@@ -1477,13 +1550,12 @@ var authCommand = new Command8("auth").description("Manage authentication").opti
     if (opts.token || opts.figmaToken) {
       const toSave = {};
       if (opts.token) {
-        toSave.token = opts.token;
-        toSave.teamId = opts.teamId ?? extractTeamIdFromJWT(opts.token) ?? "";
+        toSave.teamId = opts.teamId ?? extractTeamIdFromJWT(opts.token);
+        saveCredential({ tokenType: "account", token: opts.token, teamId: toSave.teamId });
       }
       if (opts.figmaToken) {
-        toSave.figmaToken = opts.figmaToken;
+        saveFigmaToken(opts.figmaToken);
       }
-      writeCredentials(toSave);
       if (mode === "pretty") {
         printSuccess("Credentials saved to " + getCredentialsPath());
         if (opts.token) {
@@ -1505,6 +1577,7 @@ var authCommand = new Command8("auth").description("Manage authentication").opti
       return;
     }
     if (opts.logout) {
+      const revoked = await revokeStoredRefreshToken(resolveApiUrl(opts.apiUrl));
       const deleted = clearStorage();
       if (mode === "pretty") {
         if (deleted) {
@@ -1513,13 +1586,13 @@ var authCommand = new Command8("auth").description("Manage authentication").opti
           printInfo("No stored credentials found");
         }
       } else {
-        outputResult(mode, { success: true, action: "logged_out", hadCredentials: deleted });
+        outputResult(mode, { success: true, action: "logged_out", hadCredentials: deleted, revoked });
       }
       return;
     }
     if (opts.status) {
       try {
-        const auth = resolveAuth();
+        const auth = await resolveAuth(opts.apiUrl);
         const creds = readCredentials();
         const sourceName = auth.source === "env" ? "ANIMA_API_TOKEN env var" : getCredentialsPath();
         const hasFigma = !!(process.env.FIGMA_TOKEN || creds?.figmaToken);
@@ -1527,7 +1600,7 @@ var authCommand = new Command8("auth").description("Manage authentication").opti
           printSuccess("Token configured");
           printKeyValue("Source", sourceName);
           printKeyValue("AgentGrid token", auth.token.slice(0, 12) + "..." + auth.token.slice(-4));
-          printKeyValue("Token type", auth.tokenType === "agent" ? "agent (scoped, revocable)" : "personal/API");
+          printKeyValue("Token type", auth.tokenType === "agent" ? "agent (scoped, revocable)" : "account (personal API token)");
           if (creds?.tokenType === "agent" && creds.expiresAt) printKeyValue("Expires", creds.expiresAt);
           if (auth.teamId) printKeyValue("Team ID", auth.teamId);
           printKeyValue("Figma token", hasFigma ? "configured" : "not set (needed for codegen/f2c)");
@@ -1535,7 +1608,7 @@ var authCommand = new Command8("auth").description("Manage authentication").opti
           outputResult(mode, {
             success: true,
             source: auth.source,
-            tokenType: auth.tokenType ?? "personal",
+            tokenType: auth.tokenType ?? "account",
             tokenPreview: auth.token.slice(0, 12) + "..." + auth.token.slice(-4),
             teamId: auth.teamId,
             expiresAt: creds?.tokenType === "agent" ? creds.expiresAt : void 0,
@@ -1586,40 +1659,42 @@ var authCommand = new Command8("auth").description("Manage authentication").opti
 
 // src/commands/logout.ts
 import { Command as Command9 } from "commander";
-var logoutCommand = new Command9("logout").description("Clear all stored credentials (AgentGrid + Figma tokens) from this machine").option("--json", "Output as JSON").action((opts) => {
+var logoutCommand = new Command9("logout").description("Clear all stored credentials (AgentGrid + Figma tokens) from this machine").option("--json", "Output as JSON").option("--api-url <url>", "API base URL (overrides config / ANIMA_API_URL)").action(async (opts) => {
   const mode = detectOutputMode(opts);
+  const revoked = await revokeStoredRefreshToken(resolveApiUrl(opts.apiUrl));
   const hadCredentials = clearStorage();
   deleteConfig();
   if (mode === "pretty") {
     if (hadCredentials) {
       printSuccess("Logged out \u2014 all credentials cleared from " + getCredentialsPath());
+      if (revoked) printInfo("Agent credentials revoked server-side");
     } else {
       printInfo("No stored credentials found");
     }
   } else {
-    outputResult(mode, { success: true, action: "logged_out", hadCredentials });
+    outputResult(mode, { success: true, action: "logged_out", hadCredentials, revoked });
   }
 });
 
 // src/commands/unpublish.ts
 import { Command as Command10 } from "commander";
-var unpublishCommand = new Command10("unpublish").description("Take a published playground offline (clears its live URL; code and playground stay intact)").argument("<sessionId>", "Session ID of the published playground").option("--json", "Output as JSON").option("--verbose", "Show progress on stderr").option("--api-url <url>", "API base URL (overrides config / ANIMA_API_URL)").option("--log-file <path>", "Append a JSON debug log of each step to this file").action(async (sessionId, opts) => {
+var unpublishCommand = new Command10("unpublish").description("Take a published artifact offline (clears its live URL; code and artifact stay intact)").argument("<sessionId>", "Session ID of the published artifact").option("--json", "Output as JSON").option("--verbose", "Show progress on stderr").option("--api-url <url>", "API base URL (overrides config / ANIMA_API_URL)").option("--log-file <path>", "Append a JSON debug log of each step to this file").action(async (sessionId, opts) => {
   const mode = detectOutputMode(opts);
   initLogger(opts.logFile);
   const progress = new ProgressReporter(mode, opts.verbose);
   try {
-    const auth = resolveAuth();
+    const auth = await resolveAuth(opts.apiUrl);
     progress.start("Unpublishing...");
     const result = await withMcp(
       { apiBaseUrl: resolveApiUrl(opts.apiUrl), token: auth.token, teamId: auth.teamId },
-      (client) => client.callTool("playground-unpublish", { sessionId })
+      (client) => client.callTool("artifact-unpublish", { sessionId })
     );
     if (!result.success) {
       throw apiError(result.reason || result.error || "Unpublish failed", result);
     }
     progress.succeed("Unpublished");
     if (mode === "pretty") {
-      printSuccess(result.message || `Playground ${sessionId} is no longer publicly reachable.`);
+      printSuccess(result.message || `Artifact ${sessionId} is no longer publicly reachable.`);
     } else {
       outputResult(mode, { success: true, sessionId, ...result.message ? { message: result.message } : {} });
     }
@@ -1639,7 +1714,7 @@ var unpublishCommand = new Command10("unpublish").description("Take a published
 
 // src/commands/update.ts
 import { Command as Command11 } from "commander";
-var updateCommand = new Command11("update").description("Update a playground's metadata: display name and/or visibility (never touches code)").argument("<sessionId>", "Session ID of the playground").option("--name <name>", "New display name").option("--privacy <privacy>", "public (anyone with the link) | private (team only)").option("--json", "Output as JSON").option("--verbose", "Show progress on stderr").option("--api-url <url>", "API base URL (overrides config / ANIMA_API_URL)").option("--log-file <path>", "Append a JSON debug log of each step to this file").action(async (sessionId, opts) => {
+var updateCommand = new Command11("update").description("Update an artifact's metadata: display name and/or visibility (never touches code)").argument("<sessionId>", "Session ID of the artifact").option("--name <name>", "New display name").option("--privacy <privacy>", "public (anyone with the link) | private (team only)").option("--json", "Output as JSON").option("--verbose", "Show progress on stderr").option("--api-url <url>", "API base URL (overrides config / ANIMA_API_URL)").option("--log-file <path>", "Append a JSON debug log of each step to this file").action(async (sessionId, opts) => {
   const mode = detectOutputMode(opts);
   initLogger(opts.logFile);
   const progress = new ProgressReporter(mode, opts.verbose);
@@ -1650,11 +1725,11 @@ var updateCommand = new Command11("update").description("Update a playground's m
     if (opts.privacy && !["public", "private"].includes(opts.privacy)) {
       throw validationError(`Invalid privacy "${opts.privacy}". Must be public or private.`);
     }
-    const auth = resolveAuth();
+    const auth = await resolveAuth(opts.apiUrl);
     progress.start("Updating...");
     const result = await withMcp(
       { apiBaseUrl: resolveApiUrl(opts.apiUrl), token: auth.token, teamId: auth.teamId },
-      (client) => client.callTool("playground-metadata-update", {
+      (client) => client.callTool("artifact-update_metadata", {
         sessionId,
         ...opts.name ? { name: opts.name } : {},
         ...opts.privacy ? { privacy: opts.privacy } : {}
@@ -1665,7 +1740,7 @@ var updateCommand = new Command11("update").description("Update a playground's m
     }
     progress.succeed("Updated");
     if (mode === "pretty") {
-      printSuccess(result.message || `Playground ${sessionId} updated.`);
+      printSuccess(result.message || `Artifact ${sessionId} updated.`);
     } else {
       outputResult(mode, { success: true, sessionId, ...result.message ? { message: result.message } : {} });
     }
@@ -1750,18 +1825,79 @@ function assertUrl(value) {
   }
 }
 
+// src/commands/duplicate.ts
+import { Command as Command13 } from "commander";
+import chalk7 from "chalk";
+function buildDuplicateArgs(artifactUrl, name) {
+  const sessionId = parsePlaygroundUrl(artifactUrl);
+  if (!sessionId) {
+    throw validationError("A source artifact URL or session ID is required");
+  }
+  if (name !== void 0 && (name.length === 0 || name.length > 120)) {
+    throw validationError("--name must be between 1 and 120 characters");
+  }
+  return { sessionId, ...name !== void 0 ? { name } : {} };
+}
+function createDuplicateCommand() {
+  return new Command13("duplicate").description(
+    "Duplicate an artifact into a new, independent artifact. Copies code, assets, and supported database content; chat and custom domains are not copied. Duplication is non-idempotent: if a request times out or its response is lost, list recent artifacts before retrying because the first request may already have created the copy."
+  ).argument("<artifactUrl>", "Source artifact URL or session ID").option("--name <name>", "Display name for the duplicate (defaults to '<source name> (Copy)')").option("--json", "Output as JSON").option("--verbose", "Show progress on stderr").option("--api-url <url>", "API base URL (overrides config / ANIMA_API_URL)").option("--log-file <path>", "Append a JSON debug log of each step to this file").action(async (artifactUrl, opts) => {
+    const mode = detectOutputMode(opts);
+    initLogger(opts.logFile);
+    const progress = new ProgressReporter(mode, opts.verbose);
+    try {
+      const args = buildDuplicateArgs(artifactUrl, opts.name);
+      const auth = await resolveAuth(opts.apiUrl);
+      progress.start("Duplicating artifact...");
+      const result = await withMcp(
+        { apiBaseUrl: resolveApiUrl(opts.apiUrl), token: auth.token, teamId: auth.teamId },
+        (client) => client.callTool("artifact-duplicate", args)
+      );
+      if (!result.success) {
+        throw apiError(result.reason || result.error || "Artifact duplication failed", result);
+      }
+      progress.succeed("Artifact duplicated");
+      if (mode === "pretty") {
+        console.log();
+        printSuccess("Artifact duplicated successfully!");
+        printKeyValue("Name", result.name);
+        printKeyValue("Session ID", result.sessionId);
+        printKeyValue("Source session", result.sourceSessionId);
+        printKeyValue("Artifact", chalk7.cyan.underline(result.playgroundUrl));
+        printKeyValue("Preview", chalk7.cyan.underline(result.previewUrl));
+        printKeyValue("Next steps", result.nextSteps);
+        console.log();
+      } else {
+        outputResult(mode, result);
+      }
+    } catch (err) {
+      progress.fail("Failed");
+      if (err instanceof CliError) {
+        if (mode === "pretty") {
+          printError(err.message);
+        } else {
+          outputError(mode, { code: err.code, message: err.message });
+        }
+        process.exit(err.exitCode);
+      }
+      throw err;
+    }
+  });
+}
+var duplicateCommand = createDuplicateCommand();
+
 // src/index.ts
-var program = new Command13().name("anima").description(
-  `AgentGrid CLI \u2014 host, edit, and publish your work on AgentGrid. Every playground is a
+var program = new Command14().name("anima").description(
+  `AgentGrid CLI \u2014 host, edit, and publish your work on AgentGrid. Every artifact is a
 real git repository; each command runs an AgentGrid tool for you.
 
 THE MAIN FLOW (build something and put it on AgentGrid):
   1. npx @animaapp/cli login                                   # once; a human approves
-  2. npx @animaapp/cli create -t import --from ./my-project    # your code \u2192 a live playground
+  2. npx @animaapp/cli create -t import --from ./my-project    # your code \u2192 a live app
      (or: create -t empty --framework html \u2014 an empty repo you push to)
   3. The response includes a rw gitRemoteUrl \u2014 git clone, edit, commit, push:
-     every push updates the live playground.
-  4. Share the playgroundUrl with your human. That IS sharing \u2014 the playground
+     every push updates the live artifact.
+  4. Share the playgroundUrl with your human. That IS sharing \u2014 the artifact
      is visible at its URL. Do NOT run publish unless the human explicitly
      asked for a public site; offer it as a follow-up question instead.
 
@@ -1774,19 +1910,20 @@ TIMING (important for AI agents):
   create -t empty|import \u2192 seconds
   create -t p2c|l2c|f2c  \u2192 3-7 minutes AI generation (keep the default 600000ms timeout)
   publish/unpublish      \u2192 1-3 minutes
-  get-git-token / update \u2192 seconds
+  duplicate / get-git-token / update \u2192 seconds
 
 COMMANDS:
   login          Connect (device flow, or --invite to redeem an invite link)
   logout         Full local reset \u2014 clears credentials and CLI config
   list           List your team's artifacts (most-recently-updated first) to resume work
-  create         Make a playground: import your code, empty repo, or AI-generated (p2c/l2c/f2c)
-  get-git-token  Fresh git access to an existing playground (or after token expiry)
-  update         Rename a playground or set visibility public/private (metadata only)
+  create         Make an artifact: import your code, empty repo, or AI-generated (p2c/l2c/f2c)
+  duplicate      Copy an artifact into a new, independent artifact
+  get-git-token  Fresh git access to an existing artifact (or after token expiry)
+  update         Rename an artifact or set visibility public/private (metadata only)
   publish        Deploy to a public live URL \u2014 ONLY when the human asked for it
-  unpublish      Take a published playground offline (inverse of publish)
+  unpublish      Take a published artifact offline (inverse of publish)
   mcp-config     Print an MCP server config from stored credentials (no new login)
-  codegen        Convert Figma design to local code files (no playground)
+  codegen        Convert Figma design to local code files (no artifact)
   config         Store CLI preferences (e.g. a default API URL)
   auth           Inspect or manage credentials (status / figma token)
 
@@ -1794,6 +1931,7 @@ EXAMPLES (headless flow):
   npx @animaapp/cli login --invite https://api.agentgrid.io/invite/<code>.md
   npx @animaapp/cli create -t import --from ./my-project
   npx @animaapp/cli create -t empty --framework react --name "My app"
+  npx @animaapp/cli duplicate <artifactUrl> --name "My copy"
   npx @animaapp/cli get-git-token <sessionId>
   npx @animaapp/cli update <sessionId> --privacy public
   npx @animaapp/cli publish <sessionId>        # only on explicit request
@@ -1806,6 +1944,7 @@ program.addCommand(loginCommand);
 program.addCommand(logoutCommand);
 program.addCommand(listCommand);
 program.addCommand(createCommand);
+program.addCommand(duplicateCommand);
 program.addCommand(publishCommand);
 program.addCommand(unpublishCommand);
 program.addCommand(updateCommand);