@animaapp/cli 0.5.1 → 0.7.0

package/dist/index.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 
 // src/index.ts
-import { Command as Command13 } from "commander";
+import { Command as Command14 } from "commander";
 
 // src/commands/create.ts
 import { Command } from "commander";
@@ -13,29 +13,61 @@ import path from "path";
 import os from "os";
 var CONFIG_DIR = path.join(os.homedir(), ".config", "anima");
 var CREDENTIALS_FILE = path.join(CONFIG_DIR, "credentials.json");
-function readCredentials() {
+var HANDOFF_FILE = path.join(CONFIG_DIR, "handoff.json");
+function classifyCredentials() {
+  let parsed;
   try {
-    if (!fs.existsSync(CREDENTIALS_FILE)) return null;
-    const content = fs.readFileSync(CREDENTIALS_FILE, "utf-8");
-    const parsed = JSON.parse(content);
-    if (!parsed.token) return null;
-    return parsed;
+    if (!fs.existsSync(CREDENTIALS_FILE)) return { kind: "absent" };
+    parsed = JSON.parse(fs.readFileSync(CREDENTIALS_FILE, "utf-8"));
   } catch {
-    return null;
+    return { kind: "malformed" };
+  }
+  const figmaToken = typeof parsed.figmaToken === "string" ? parsed.figmaToken : void 0;
+  if (typeof parsed.token !== "string") {
+    return figmaToken ? { kind: "figma-only", figmaToken } : { kind: "absent" };
+  }
+  if (parsed.tokenType === "agent") {
+    const required2 = ["teamId", "agentId", "expiresAt", "refreshToken", "refreshExpiresAt"];
+    if (required2.some((field) => typeof parsed[field] !== "string")) {
+      return { kind: "malformed" };
+    }
+    return { kind: "agent", credential: parsed, figmaToken };
   }
+  return {
+    kind: "account",
+    credential: {
+      tokenType: "account",
+      token: parsed.token,
+      teamId: typeof parsed.teamId === "string" ? parsed.teamId : void 0
+    },
+    figmaToken
+  };
+}
+function readCredentials() {
+  const stored = classifyCredentials();
+  if (stored.kind !== "agent" && stored.kind !== "account") return null;
+  return { ...stored.credential, ...stored.figmaToken ? { figmaToken: stored.figmaToken } : {} };
+}
+function saveCredential(credential) {
+  const figmaToken = readCredentials()?.figmaToken;
+  write({ ...credential, ...figmaToken ? { figmaToken } : {} });
+}
+function saveFigmaToken(figmaToken) {
+  const existing = readCredentials();
+  write({ ...existing ?? {}, figmaToken });
 }
-function writeCredentials(credentials) {
-  const existing = readCredentials() ?? {};
-  const merged = { ...existing, ...credentials };
+function write(credentials) {
+  writeSecretJson(CREDENTIALS_FILE, { ...credentials });
+}
+function writeSecretJson(file, data) {
+  const merged = { ...data };
   for (const key of Object.keys(merged)) {
     if (merged[key] === void 0) delete merged[key];
   }
   fs.mkdirSync(CONFIG_DIR, { recursive: true });
-  fs.writeFileSync(
-    CREDENTIALS_FILE,
-    JSON.stringify(merged, null, 2) + "\n",
-    { mode: 384 }
-  );
+  const tmp = `${file}.${process.pid}.tmp`;
+  fs.writeFileSync(tmp, JSON.stringify(merged, null, 2) + "\n", { mode: 384 });
+  fs.renameSync(tmp, file);
 }
 function deleteCredentials() {
   try {
@@ -48,8 +80,35 @@ function deleteCredentials() {
     return false;
   }
 }
+function savePendingHandoff(pending) {
+  writeSecretJson(HANDOFF_FILE, { ...pending });
+}
+function readPendingHandoff() {
+  try {
+    if (!fs.existsSync(HANDOFF_FILE)) return null;
+    const parsed = JSON.parse(fs.readFileSync(HANDOFF_FILE, "utf-8"));
+    const required2 = ["handoffToken", "sessionId", "claimUrl", "claimableUntil", "apiUrl"];
+    if (required2.some((field) => typeof parsed[field] !== "string")) return null;
+    return parsed;
+  } catch {
+    return null;
+  }
+}
+function clearPendingHandoff() {
+  try {
+    if (!fs.existsSync(HANDOFF_FILE)) return false;
+    fs.unlinkSync(HANDOFF_FILE);
+    return true;
+  } catch {
+    return false;
+  }
+}
+function getHandoffPath() {
+  return HANDOFF_FILE;
+}
 function clearStorage() {
   const had = deleteCredentials();
+  clearPendingHandoff();
   try {
     if (fs.existsSync(CONFIG_DIR) && fs.readdirSync(CONFIG_DIR).length === 0) {
       fs.rmdirSync(CONFIG_DIR);
@@ -74,6 +133,17 @@ function extractTeamIdFromJWT(token) {
   }
 }
 
+// src/auth/jwt.ts
+function decodeJwtPayload(token) {
+  try {
+    const parts = token.split(".");
+    if (parts.length !== 3) return void 0;
+    return JSON.parse(Buffer.from(parts[1], "base64url").toString("utf-8"));
+  } catch {
+    return void 0;
+  }
+}
+
 // src/api/errors.ts
 var EXIT_CODES = {
   SUCCESS: 0,
@@ -116,37 +186,39 @@ function timeoutError() {
   );
 }
 
-// src/auth/token.ts
-function resolveAuth() {
-  const creds = readCredentials();
-  const envToken = process.env.ANIMA_API_TOKEN;
-  if (envToken) {
-    return {
-      token: envToken,
-      teamId: process.env.ANIMA_TEAM_ID,
-      figmaToken: process.env.FIGMA_TOKEN || creds?.figmaToken,
-      source: "env"
-    };
-  }
-  if (creds) {
-    if (creds.tokenType === "agent" && creds.expiresAt && new Date(creds.expiresAt) <= /* @__PURE__ */ new Date()) {
-      throw authError("Your agent token has expired. Run: anima login");
-    }
-    return {
-      token: creds.token,
-      teamId: creds.teamId,
-      figmaToken: process.env.FIGMA_TOKEN || creds.figmaToken,
-      source: "file",
-      tokenType: creds.tokenType
-    };
+// src/auth/agentSession.ts
+function required(value, field) {
+  if (value === void 0) {
+    throw authError(
+      `The server's token response is missing \`${field}\`. Check --api-url points at an Anima API that issues agent credentials.`
+    );
   }
-  throw authError("No credentials found. Run: anima login\n(or set the ANIMA_API_TOKEN env var)");
+  return value;
+}
+function agentSessionFromTokenResponse(body, carriedOver) {
+  const token = typeof body.access_token === "string" ? body.access_token : void 0;
+  const claims = decodeJwtPayload(required(token, "access_token"));
+  return {
+    token,
+    teamId: required(typeof claims?.team_id === "string" ? claims.team_id : void 0, "team_id"),
+    agentId: required(typeof claims?.agent_id === "string" ? claims.agent_id : void 0, "agent_id"),
+    expiresAt: required(
+      typeof claims?.exp === "number" ? new Date(claims.exp * 1e3).toISOString() : void 0,
+      "exp"
+    ),
+    refreshToken: required(
+      typeof body.refresh_token === "string" ? body.refresh_token : carriedOver?.refreshToken,
+      "refresh_token"
+    ),
+    refreshExpiresAt: required(
+      typeof body.refresh_expires_in === "number" ? new Date(Date.now() + body.refresh_expires_in * 1e3).toISOString() : carriedOver?.refreshExpiresAt,
+      "refresh_expires_in"
+    )
+  };
+}
+function persistAgentSession(session) {
+  saveCredential({ tokenType: "agent", ...session });
 }
-
-// src/api/mcp.ts
-import { Client } from "@modelcontextprotocol/sdk/client/index.js";
-import { StreamableHTTPClientTransport } from "@modelcontextprotocol/sdk/client/streamableHttp.js";
-import { CallToolResultSchema, ErrorCode } from "@modelcontextprotocol/sdk/types.js";
 
 // src/output/log.ts
 import fs2 from "fs";
@@ -180,6 +252,173 @@ function redact(value) {
   return out;
 }
 
+// src/auth/refresh.ts
+var REFRESH_GRANT_TYPE = "refresh_token";
+function readFailure(body) {
+  const raw = body.error;
+  const nested = typeof raw === "object" && raw !== null ? raw : null;
+  const code = typeof raw === "string" ? raw : typeof nested?.code === "string" ? nested.code : typeof nested?.error === "string" ? nested.error : null;
+  const described = typeof body.error_description === "string" ? body.error_description : null;
+  const message = described ?? (typeof raw === "string" ? raw : raw == null ? null : JSON.stringify(raw));
+  return { code, message };
+}
+async function refreshAccessToken(apiUrl, carriedOver, fetchFn = fetch) {
+  const base = apiUrl.replace(/\/$/, "");
+  const response = await fetchFn(`${base}/oauth/token`, {
+    method: "POST",
+    headers: { "Content-Type": "application/x-www-form-urlencoded" },
+    body: new URLSearchParams({
+      grant_type: REFRESH_GRANT_TYPE,
+      refresh_token: carriedOver.refreshToken
+    }).toString()
+  });
+  const body = await response.json().catch(() => ({}));
+  const failure = readFailure(body);
+  logEvent("refresh_token_response", { status: response.status, error: failure.code });
+  if (!response.ok || typeof body.access_token !== "string") {
+    if (failure.code === "invalid_grant") {
+      clearStorage();
+      throw authError(`${failure.message ?? "Your credentials are no longer valid"}
+Run: anima login`);
+    }
+    throw apiError(
+      `Could not refresh credentials (HTTP ${response.status})${failure.message ? `: ${failure.message}` : ""}`
+    );
+  }
+  const session = agentSessionFromTokenResponse(body, carriedOver);
+  saveCredential({ tokenType: "agent", ...session });
+  return session;
+}
+async function revokeStoredRefreshToken(apiUrl, fetchFn = fetch) {
+  const creds = readCredentials();
+  if (creds?.tokenType !== "agent") return false;
+  try {
+    const response = await fetchFn(`${apiUrl.replace(/\/$/, "")}/oauth/revoke`, {
+      method: "POST",
+      headers: { "Content-Type": "application/x-www-form-urlencoded" },
+      body: new URLSearchParams({ token: creds.refreshToken, token_type_hint: "refresh_token" }).toString()
+    });
+    logEvent("revoke_response", { status: response.status });
+    return response.ok;
+  } catch (err) {
+    logEvent("revoke_failed", { error: err instanceof Error ? err.message : String(err) });
+    return false;
+  }
+}
+
+// src/config/store.ts
+import fs3 from "fs";
+import path3 from "path";
+import os2 from "os";
+var CONFIG_DIR2 = path3.join(os2.homedir(), ".config", "anima");
+var CONFIG_FILE = path3.join(CONFIG_DIR2, "config.json");
+var DEFAULT_API_URL = "https://api.agentgrid.io";
+var CONFIG_KEYS = {
+  "api-url": "apiUrl"
+};
+function isConfigKey(key) {
+  return key in CONFIG_KEYS;
+}
+function configKeys() {
+  return Object.keys(CONFIG_KEYS);
+}
+function readConfig() {
+  try {
+    if (!fs3.existsSync(CONFIG_FILE)) return {};
+    const parsed = JSON.parse(fs3.readFileSync(CONFIG_FILE, "utf-8"));
+    return parsed && typeof parsed === "object" ? parsed : {};
+  } catch {
+    return {};
+  }
+}
+function setConfig(key, value) {
+  const merged = { ...readConfig(), [CONFIG_KEYS[key]]: value };
+  fs3.mkdirSync(CONFIG_DIR2, { recursive: true });
+  fs3.writeFileSync(CONFIG_FILE, JSON.stringify(merged, null, 2) + "\n");
+}
+function deleteConfig() {
+  try {
+    if (!fs3.existsSync(CONFIG_FILE)) return false;
+    fs3.unlinkSync(CONFIG_FILE);
+    return true;
+  } catch {
+    return false;
+  }
+}
+function unsetConfig(key) {
+  const config = readConfig();
+  const field = CONFIG_KEYS[key];
+  if (!(field in config)) return false;
+  delete config[field];
+  fs3.mkdirSync(CONFIG_DIR2, { recursive: true });
+  fs3.writeFileSync(CONFIG_FILE, JSON.stringify(config, null, 2) + "\n");
+  return true;
+}
+function getConfigPath() {
+  return CONFIG_FILE;
+}
+function resolveApiUrl(flagValue) {
+  return flagValue || process.env.ANIMA_API_URL || readConfig().apiUrl || DEFAULT_API_URL;
+}
+
+// src/auth/token.ts
+var RENEW_BEFORE_EXPIRY_MS = 6e4;
+function needsRenewal(expiresAt) {
+  if (!expiresAt) return false;
+  const expiry = new Date(expiresAt).getTime();
+  return Number.isNaN(expiry) || expiry - Date.now() <= RENEW_BEFORE_EXPIRY_MS;
+}
+async function resolveAuth(apiUrlOverride) {
+  const stored = classifyCredentials();
+  const envToken = process.env.ANIMA_API_TOKEN;
+  if (envToken) {
+    return {
+      token: envToken,
+      teamId: process.env.ANIMA_TEAM_ID,
+      figmaToken: process.env.FIGMA_TOKEN || ("figmaToken" in stored ? stored.figmaToken : void 0),
+      source: "env"
+    };
+  }
+  const figmaToken = process.env.FIGMA_TOKEN || ("figmaToken" in stored ? stored.figmaToken : void 0);
+  if (stored.kind === "agent") {
+    const { credential } = stored;
+    if (needsRenewal(credential.expiresAt)) {
+      const renewed = await refreshAccessToken(resolveApiUrl(apiUrlOverride), {
+        refreshToken: credential.refreshToken,
+        refreshExpiresAt: credential.refreshExpiresAt
+      });
+      return { token: renewed.token, teamId: renewed.teamId, figmaToken, source: "file", tokenType: "agent" };
+    }
+    return {
+      token: credential.token,
+      teamId: credential.teamId,
+      figmaToken,
+      source: "file",
+      tokenType: "agent"
+    };
+  }
+  if (stored.kind === "account") {
+    return {
+      token: stored.credential.token,
+      teamId: stored.credential.teamId,
+      figmaToken,
+      source: "file",
+      tokenType: "account"
+    };
+  }
+  if (stored.kind === "malformed") {
+    throw authError(
+      `Your credentials file is damaged or incomplete (${getCredentialsPath()}). Run: anima login`
+    );
+  }
+  throw authError("No credentials found. Run: anima login\n(or set the ANIMA_API_TOKEN env var)");
+}
+
+// src/api/mcp.ts
+import { Client } from "@modelcontextprotocol/sdk/client/index.js";
+import { StreamableHTTPClientTransport } from "@modelcontextprotocol/sdk/client/streamableHttp.js";
+import { CallToolResultSchema, ErrorCode } from "@modelcontextprotocol/sdk/types.js";
+
 // src/version.ts
 import { createRequire } from "module";
 var { version } = createRequire(import.meta.url)("../package.json");
@@ -367,10 +606,10 @@ function printKeyValue(key, value) {
 }
 function printSessionResult(result) {
   console.log();
-  printSuccess("Playground created successfully!");
+  printSuccess("Artifact created successfully!");
   printKeyValue("Session ID", result.sessionId);
   if (result.playgroundUrl) {
-    printKeyValue("Your playground", chalk.cyan.underline(result.playgroundUrl));
+    printKeyValue("Your artifact", chalk.cyan.underline(result.playgroundUrl));
   }
   if (result.tokenUsage) {
     printKeyValue("Token usage", result.tokenUsage.toLocaleString());
@@ -383,13 +622,6 @@ function printDeployResult(result) {
   if (result.url) {
     printKeyValue("Live URL", chalk.cyan.underline(result.url));
   }
-  if (result.packageName) {
-    printKeyValue("Package", result.packageName);
-    printKeyValue("Version", result.packageVersion ?? "");
-    if (result.packageUrl) {
-      printKeyValue("URL", chalk.cyan.underline(result.packageUrl));
-    }
-  }
   console.log();
 }
 function printFilesWritten(outputDir, count) {
@@ -533,78 +765,81 @@ function parsePlaygroundUrl(input) {
   }
 }
 
-// src/config/store.ts
-import fs3 from "fs";
-import path3 from "path";
-import os2 from "os";
-var CONFIG_DIR2 = path3.join(os2.homedir(), ".config", "anima");
-var CONFIG_FILE = path3.join(CONFIG_DIR2, "config.json");
-var DEFAULT_API_URL = "https://api.agentgrid.io";
-var CONFIG_KEYS = {
-  "api-url": "apiUrl"
-};
-function isConfigKey(key) {
-  return key in CONFIG_KEYS;
-}
-function configKeys() {
-  return Object.keys(CONFIG_KEYS);
-}
-function readConfig() {
-  try {
-    if (!fs3.existsSync(CONFIG_FILE)) return {};
-    const parsed = JSON.parse(fs3.readFileSync(CONFIG_FILE, "utf-8"));
-    return parsed && typeof parsed === "object" ? parsed : {};
-  } catch {
-    return {};
+// src/api/anonymousCreate.ts
+async function createAnonymousArtifact(request, fetchFn = fetch) {
+  const url = `${request.apiUrl.replace(/\/$/, "")}/v1/generationSessions`;
+  const body = {
+    type: "import",
+    ...request.files ? { files: request.files } : {},
+    ...request.zipUploadId ? { zipUploadId: request.zipUploadId } : {},
+    ...request.framework ? { framework: request.framework } : {},
+    ...request.artifactType ? { artifactType: request.artifactType } : {},
+    ...request.name ? { name: request.name } : {},
+    ...request.handoffToken ? { handoffToken: request.handoffToken } : {},
+    ...request.clientName ? { clientName: request.clientName } : {}
+  };
+  logEvent("anonymous_create_request", { url, type: "import", artifactType: request.artifactType });
+  const response = await fetchFn(url, {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify(body)
+  });
+  const payload = await response.json().catch(() => ({}));
+  logEvent("anonymous_create_response", { url, status: response.status, error: payload.error });
+  if (!response.ok || payload.success !== true) {
+    const message = typeof payload.reason === "string" && payload.reason || typeof payload.error === "string" && payload.error || `Anonymous create failed (HTTP ${response.status})`;
+    const nextSteps = typeof payload.nextSteps === "string" ? payload.nextSteps : void 0;
+    throw apiError(nextSteps ? `${message}
+${nextSteps}` : message, payload);
   }
-}
-function setConfig(key, value) {
-  const merged = { ...readConfig(), [CONFIG_KEYS[key]]: value };
-  fs3.mkdirSync(CONFIG_DIR2, { recursive: true });
-  fs3.writeFileSync(CONFIG_FILE, JSON.stringify(merged, null, 2) + "\n");
-}
-function deleteConfig() {
-  try {
-    if (!fs3.existsSync(CONFIG_FILE)) return false;
-    fs3.unlinkSync(CONFIG_FILE);
-    return true;
-  } catch {
-    return false;
+  for (const field of ["sessionId", "handoffToken", "claimUrl", "claimableUntil"]) {
+    if (typeof payload[field] !== "string") {
+      throw apiError(`The API's create response is missing \`${field}\`.`, payload);
+    }
   }
+  return payload;
 }
-function unsetConfig(key) {
-  const config = readConfig();
-  const field = CONFIG_KEYS[key];
-  if (!(field in config)) return false;
-  delete config[field];
-  fs3.mkdirSync(CONFIG_DIR2, { recursive: true });
-  fs3.writeFileSync(CONFIG_FILE, JSON.stringify(config, null, 2) + "\n");
-  return true;
-}
-function getConfigPath() {
-  return CONFIG_FILE;
-}
-function resolveApiUrl(flagValue) {
-  return flagValue || process.env.ANIMA_API_URL || readConfig().apiUrl || DEFAULT_API_URL;
+async function getAnonymousZipUploadUrl(apiUrl, fetchFn = fetch) {
+  const url = `${apiUrl.replace(/\/$/, "")}/v1/generationSessions/zip-upload-url`;
+  const response = await fetchFn(url, { method: "POST" });
+  const payload = await response.json().catch(() => ({}));
+  if (!response.ok || payload.success !== true || typeof payload.uploadUrl !== "string") {
+    const message = typeof payload.reason === "string" && payload.reason || typeof payload.error === "string" && payload.error || `Could not get a zip upload URL (HTTP ${response.status})`;
+    throw apiError(message, payload);
+  }
+  return { zipUploadId: payload.zipUploadId, uploadUrl: payload.uploadUrl };
 }
 
 // src/commands/create.ts
 var createCommand = new Command("create").description(
-  "Create a playground from your own code: empty for code you'll push (instant) or import your existing code (instant). Also supports AI generation: p2c/l2c/f2c (3-7 min)."
+  "Create an artifact from your own code: empty for code you'll push (instant) or import your existing code (instant). Also supports AI generation: p2c/l2c/f2c (3-7 min)."
 ).requiredOption(
   "-t, --type <type>",
   "empty (empty repo you push to), import (create FROM your code \u2014 use --from), or AI-generated: p2c, l2c, f2c"
 ).option("-p, --prompt <prompt>", "Text prompt (p2c)").option("-u, --url <url>", "Website URL (l2c)").option("--file-key <key>", "Figma file key or URL (f2c)").option("--nodes <nodes>", "Figma node IDs, comma-separated (f2c)").option("--figma-token <token>", "Figma personal access token (f2c)").option(
   "--framework <fw>",
   "html | react \u2014 the only supported frameworks. REQUIRED for empty (declare react if you will push React code); detected from package.json for import"
-).option("--styling <style>", "tailwind | css | plain_css | css_modules | inline_styles", "tailwind").option("--language <lang>", "typescript | javascript").option("--ui-library <lib>", "mui | antd | shadcn | clean_react").option("--guidelines <text>", "Additional constraints (p2c only)").option("--name <name>", "Project name (empty/import only)").option("--from <path>", "Folder or .zip with your project (import only) \u2014 becomes the first commit").option("--json", "Output as JSON").option("--timeout <ms>", "Timeout in milliseconds", "600000").option("--verbose", "Show progress on stderr").option("--api-url <url>", "API base URL (overrides config / ANIMA_API_URL)").option("--log-file <path>", "Append a JSON debug log of each step to this file").action(async (opts) => {
+).option("--styling <style>", "tailwind | css | plain_css | css_modules | inline_styles", "tailwind").option("--language <lang>", "typescript | javascript").option("--ui-library <lib>", "mui | antd | shadcn | clean_react").option("--guidelines <text>", "Additional constraints (p2c only)").option(
+  "--artifact-type <kind>",
+  "app | markdown \u2014 what the artifact IS. app (default) needs an index.html; markdown needs .md files"
+).option("--name <name>", "Project name (empty/import only)").option("--from <path>", "Folder or .zip with your project (import only) \u2014 becomes the first commit").option(
+  "--anonymous",
+  "Create without an account (import only). Returns a claim link to send a human, and a handoff token to log in with once they claim it"
+).option(
+  "--handoff <token>",
+  "Add this artifact to an existing claim (--anonymous only), so one claim link covers them all. Defaults to the token from your last anonymous create"
+).option("--client-name <name>", "How this CLI is credited as the creator of an anonymous artifact", "AgentGrid CLI").option("--json", "Output as JSON").option("--timeout <ms>", "Timeout in milliseconds", "600000").option("--verbose", "Show progress on stderr").option("--api-url <url>", "API base URL (overrides config / ANIMA_API_URL)").option("--log-file <path>", "Append a JSON debug log of each step to this file").action(async (opts) => {
   const mode = detectOutputMode(opts);
   initLogger(opts.logFile);
   const progress = new ProgressReporter(mode, opts.verbose);
   try {
     const type = opts.type;
     validateCreateOptions(type, opts);
-    const auth = resolveAuth();
+    if (opts.anonymous) {
+      await runAnonymousCreate(opts, mode, progress);
+      return;
+    }
+    const auth = await resolveAuth(opts.apiUrl);
     const figmaToken = type === "f2c" ? resolveFigmaToken(opts, auth.figmaToken) : void 0;
     const args = buildCreateArgs(type, opts);
     const mcpConfig = { apiBaseUrl: resolveApiUrl(opts.apiUrl), token: auth.token, teamId: auth.teamId, figmaToken };
@@ -617,7 +852,7 @@ var createCommand = new Command("create").description(
         progress.update(`Uploading project zip (${source.reason})...`);
         const grant = await withMcp(
           mcpConfig,
-          (client) => client.callTool("playground-get_zip_upload_url", {})
+          (client) => client.callTool("artifact-get_zip_upload_url", {})
         );
         if (!grant.success || !grant.uploadUrl || !grant.zipUploadId) {
           const message = grant.reason || grant.error || "Could not get a zip upload URL";
@@ -635,11 +870,11 @@ ${grant.nextSteps}` : message, grant);
       }
     }
     progress.start(
-      type === "empty" ? "Creating empty playground..." : type === "import" ? "Importing your project..." : `Creating ${type.toUpperCase()} playground...`
+      type === "empty" ? "Creating empty artifact..." : type === "import" ? "Importing your project..." : `Creating ${type.toUpperCase()} artifact...`
     );
     const result = await withMcp(
       mcpConfig,
-      (client) => client.callTool("playground-create", args, {
+      (client) => client.callTool("artifact-create", args, {
         timeoutMs: parseInt(opts.timeout, 10),
         onProgress: (p) => progress.update(p.message ?? `Generating (${Math.round(p.progress)}%)...`)
       })
@@ -650,20 +885,20 @@ ${grant.nextSteps}` : message, grant);
 ${result.nextSteps}` : message, result);
     }
     const playgroundUrl = result.playgroundUrl || `${PLAYGROUND_BASE}/${result.sessionId}`;
-    progress.succeed("Playground created!");
+    progress.succeed("Artifact created!");
     if (mode === "pretty") {
       printSessionResult({ sessionId: result.sessionId, playgroundUrl });
       if (result.gitRemoteUrl) {
         console.log(`  ${chalk2.cyan(`git clone ${result.gitRemoteUrl}`)}`);
         console.log();
-        console.log("  Commit and push to update the live playground.");
+        console.log("  Commit and push to update the live artifact.");
         if (result.expiresAt) {
           console.log(
             `  The URL embeds a token that expires at ${result.expiresAt} and cannot be renewed;
   run ${chalk2.cyan(`anima get-git-token ${result.sessionId}`)} and ${chalk2.cyan("git remote set-url origin <new url>")} to keep pushing.`
           );
         }
-        console.log("  Treat the URL as a secret \u2014 it grants access to this playground.");
+        console.log("  Treat the URL as a secret \u2014 it grants access to this artifact.");
         console.log();
       } else if (type === "empty") {
         console.log(
@@ -707,6 +942,88 @@ ${result.nextSteps}` : message, result);
     throw err;
   }
 });
+async function runAnonymousCreate(opts, mode, progress) {
+  const apiUrl = resolveApiUrl(opts.apiUrl);
+  progress.start("Collecting project files...");
+  const source = collectProjectSource(opts.from);
+  let files;
+  let zipUploadId;
+  if (source.kind === "files") {
+    files = source.files;
+  } else {
+    progress.update(`Uploading project zip (${source.reason})...`);
+    const grant = await getAnonymousZipUploadUrl(apiUrl);
+    const putResponse = await fetch(grant.uploadUrl, {
+      method: "PUT",
+      body: new Uint8Array(source.buffer)
+    });
+    if (!putResponse.ok) {
+      throw apiError(`Zip upload failed: HTTP ${putResponse.status}`, { status: putResponse.status });
+    }
+    zipUploadId = grant.zipUploadId;
+  }
+  progress.start("Creating anonymous artifact...");
+  const request = {
+    apiUrl,
+    files,
+    zipUploadId,
+    ...opts.framework && opts.artifactType !== "markdown" ? { framework: opts.framework } : {},
+    ...opts.artifactType ? { artifactType: opts.artifactType } : {},
+    ...opts.name ? { name: opts.name } : {},
+    clientName: opts.clientName
+  };
+  const reusable = opts.handoff ? { handoffToken: opts.handoff } : livePendingHandoff();
+  const result = reusable ? await createAnonymousArtifact({ ...request, handoffToken: reusable.handoffToken }).catch((err) => {
+    if (!isHandoffTokenInvalid(err)) throw err;
+    clearPendingHandoff();
+    progress.update("Previous claim is no longer open \u2014 starting a new one...");
+    return createAnonymousArtifact(request);
+  }) : await createAnonymousArtifact(request);
+  const claimUrl = result.claimUrl;
+  savePendingHandoff({
+    handoffToken: result.handoffToken,
+    sessionId: result.sessionId,
+    claimUrl,
+    claimableUntil: result.claimableUntil,
+    apiUrl
+  });
+  progress.succeed("Artifact created!");
+  if (mode === "pretty") {
+    printSessionResult({ sessionId: result.sessionId, playgroundUrl: result.previewUrl });
+    console.log("  Send your human this link to claim it:");
+    console.log(`    ${chalk2.cyan.underline(claimUrl)}`);
+    console.log();
+    console.log(`  Claimable until ${result.claimableUntil}. Until then the artifact is read-only.`);
+    console.log(`  Then run ${chalk2.cyan("anima login --handoff")} to pick up your credentials.`);
+    if (result.notes) console.log(`  Note: ${result.notes}`);
+    console.log();
+  } else {
+    outputResult(mode, {
+      success: true,
+      sessionId: result.sessionId,
+      previewUrl: result.previewUrl,
+      claimUrl,
+      claimableUntil: result.claimableUntil,
+      // Returned, not just stored: it is delivered exactly once and can never
+      // be re-fetched, so a caller whose config does not outlive the process
+      // would otherwise lose the only route to a credential.
+      handoffToken: result.handoffToken,
+      handoffStored: getHandoffPath(),
+      ...result.fileCount !== void 0 ? { fileCount: result.fileCount } : {},
+      ...result.skippedFiles?.length ? { skippedFiles: result.skippedFiles } : {},
+      ...result.notes ? { notes: result.notes } : {},
+      nextSteps: `Send claimUrl to your human \u2014 that is the link that transfers the artifact to them. handoffToken is yours, never theirs: use it to log in (\`anima login --handoff\`, which waits until they claim and then stores your credentials), or to add more artifacts to the same claim (\`anima create --anonymous --handoff <token>\`). Run the login in the background if you have other work.`
+    });
+  }
+}
+function livePendingHandoff() {
+  const pending = readPendingHandoff();
+  if (!pending) return null;
+  return new Date(pending.claimableUntil).getTime() > Date.now() ? pending : null;
+}
+function isHandoffTokenInvalid(err) {
+  return err instanceof CliError && /handoff_token_invalid/.test(JSON.stringify(err.detail ?? ""));
+}
 function validateCreateOptions(type, opts) {
   if (!["empty", "import", "p2c", "l2c", "f2c"].includes(type)) {
     throw validationError(`Invalid type "${type}". Must be empty, import, p2c, l2c, or f2c.`);
@@ -720,11 +1037,27 @@ function validateCreateOptions(type, opts) {
   if (type === "f2c" && !opts.fileKey) {
     throw validationError("--file-key is required for f2c type");
   }
-  if (type === "empty" && !opts.framework) {
+  if (type === "empty" && !opts.framework && opts.artifactType !== "markdown") {
     throw validationError(
       "--framework is required for type empty \u2014 html for plain HTML/CSS/JS, react for React (declare react if you will push React code)"
     );
   }
+  if (opts.artifactType && !["app", "markdown"].includes(opts.artifactType)) {
+    throw validationError(
+      `Invalid --artifact-type "${opts.artifactType}". Must be app or markdown.`
+    );
+  }
+  if (opts.handoff && !opts.anonymous) {
+    throw validationError(
+      "--handoff only applies to --anonymous creates \u2014 it adds the new artifact to an existing claim. An authenticated create already belongs to your team."
+    );
+  }
+  if (opts.anonymous && type !== "import") {
+    throw validationError(
+      `--anonymous only works with -t import (got "${type}"). Anonymous artifacts are created FROM code you already have: there is no way to push to an empty one, and AI generation needs an account.
+Log in first for the other types: anima login`
+    );
+  }
   if (type === "import" && !opts.from) {
     throw validationError("--from <folder|zip> is required for type import \u2014 the path to the project to import");
   }
@@ -745,15 +1078,21 @@ function buildCreateArgs(type, opts) {
   if (type === "empty" || type === "import") {
     return {
       type,
-      ...opts.framework ? { framework: opts.framework } : {},
+      // A document has no framework to build with, and declaring one on an
+      // import is what made markdown artifacts render as empty apps.
+      ...opts.framework && opts.artifactType !== "markdown" ? { framework: opts.framework } : {},
+      ...opts.artifactType ? { artifactType: opts.artifactType } : {},
       ...opts.name ? { name: opts.name } : {}
     };
   }
   const framework = opts.framework ?? "html";
   const language = opts.language ?? (framework === "react" ? "typescript" : void 0);
+  const artifactType = opts.artifactType;
   const args = {
     type,
-    framework,
+    // framework describes how to build an app; a document has none.
+    ...artifactType === "markdown" ? {} : { framework },
+    ...artifactType ? { artifactType } : {},
     styling: opts.styling
   };
   if (language) args.language = language;
@@ -791,7 +1130,7 @@ var listCommand = new Command2("list").aliases(["ls", "artifacts"]).description(
   const mode = detectOutputMode(opts);
   initLogger(opts.logFile);
   try {
-    const auth = resolveAuth();
+    const auth = await resolveAuth(opts.apiUrl);
     const result = await withMcp(
       { apiBaseUrl: resolveApiUrl(opts.apiUrl), token: auth.token, teamId: auth.teamId },
       (client) => client.callTool("workspace-list_artifacts", {})
@@ -861,30 +1200,16 @@ function formatUpdatedAt(iso) {
 
 // src/commands/publish.ts
 import { Command as Command3 } from "commander";
-var publishCommand = new Command3("publish").description("Deploy playground to live URL or npm package (1-3 min)").argument("<sessionId>", "Session ID from create command").option("--mode <mode>", "webapp | designSystem", "webapp").option("--package-name <name>", "NPM package name (designSystem mode)").option("--package-version <version>", "NPM package version (designSystem mode)").option("--json", "Output as JSON").option("--verbose", "Show progress on stderr").option("--api-url <url>", "API base URL (overrides config / ANIMA_API_URL)").option("--log-file <path>", "Append a JSON debug log of each step to this file").action(async (sessionId, opts) => {
+var publishCommand = new Command3("publish").description("Deploy an artifact's app to a live public URL (1-3 min)").argument("<sessionId>", "Session ID from create command").option("--json", "Output as JSON").option("--verbose", "Show progress on stderr").option("--api-url <url>", "API base URL (overrides config / ANIMA_API_URL)").option("--log-file <path>", "Append a JSON debug log of each step to this file").action(async (sessionId, opts) => {
   const mode = detectOutputMode(opts);
   initLogger(opts.logFile);
   const progress = new ProgressReporter(mode, opts.verbose);
   try {
-    if (!["webapp", "designSystem"].includes(opts.mode)) {
-      throw validationError(
-        `Invalid mode "${opts.mode}". Must be webapp or designSystem.`
-      );
-    }
-    if (opts.mode === "designSystem" && !opts.packageName) {
-      throw validationError("--package-name is required for designSystem mode");
-    }
-    const auth = resolveAuth();
-    const args = {
-      sessionId,
-      mode: opts.mode
-    };
-    if (opts.packageName) args.packageName = opts.packageName;
-    if (opts.packageVersion) args.packageVersion = opts.packageVersion;
-    progress.start(`Publishing as ${opts.mode}...`);
+    const auth = await resolveAuth(opts.apiUrl);
+    progress.start("Publishing...");
     const result = await withMcp(
       { apiBaseUrl: resolveApiUrl(opts.apiUrl), token: auth.token, teamId: auth.teamId },
-      (client) => client.callTool("playground-publish", args, {
+      (client) => client.callTool("artifact-publish", { sessionId }, {
         onProgress: (p) => progress.update(p.message ?? "Publishing...")
       })
     );
@@ -898,22 +1223,12 @@ var publishCommand = new Command3("publish").description("Deploy playground to l
     }
     progress.succeed("Published!");
     if (mode === "pretty") {
-      printDeployResult({
-        url: result.liveUrl,
-        packageUrl: result.packageUrl,
-        packageName: result.packageName,
-        packageVersion: result.packageVersion
-      });
+      printDeployResult({ url: result.liveUrl });
     } else {
       outputResult(mode, {
         success: true,
         sessionId,
-        ...result.liveUrl ? { liveUrl: result.liveUrl, subdomain: result.subdomain } : {},
-        ...result.packageName ? {
-          packageName: result.packageName,
-          packageVersion: result.packageVersion,
-          packageUrl: result.packageUrl
-        } : {}
+        ...result.liveUrl ? { liveUrl: result.liveUrl, subdomain: result.subdomain } : {}
       });
     }
   } catch (err) {
@@ -959,7 +1274,7 @@ function writeFilesToDisk(files, outputDir) {
 }
 
 // src/commands/codegen.ts
-var codegenCommand = new Command4("codegen").description("Convert Figma design to code files (no playground)").requiredOption("--file-key <key>", "Figma file key or URL").option("--nodes <nodes>", "Figma node IDs, comma-separated").option("--figma-token <token>", "Figma personal access token (or set FIGMA_TOKEN env var)").option("-o, --output <dir>", "Output directory", "./generated").option("--framework <fw>", "react | html", "react").option("--styling <style>", "tailwind | plain_css", "tailwind").option("--language <lang>", "typescript | javascript").option("--ui-library <lib>", "mui | antd | shadcn | clean_react").option("--json", "Output as JSON").option("--timeout <ms>", "Timeout in milliseconds", "600000").option("--verbose", "Show progress on stderr").option("--api-url <url>", "API base URL (overrides config / ANIMA_API_URL)").option("--log-file <path>", "Append a JSON debug log of each step to this file").action(async (opts) => {
+var codegenCommand = new Command4("codegen").description("Convert Figma design to code files (no artifact)").requiredOption("--file-key <key>", "Figma file key or URL").option("--nodes <nodes>", "Figma node IDs, comma-separated").option("--figma-token <token>", "Figma personal access token (or set FIGMA_TOKEN env var)").option("-o, --output <dir>", "Output directory", "./generated").option("--framework <fw>", "react | html", "react").option("--styling <style>", "tailwind | plain_css", "tailwind").option("--language <lang>", "typescript | javascript").option("--ui-library <lib>", "mui | antd | shadcn | clean_react").option("--json", "Output as JSON").option("--timeout <ms>", "Timeout in milliseconds", "600000").option("--verbose", "Show progress on stderr").option("--api-url <url>", "API base URL (overrides config / ANIMA_API_URL)").option("--log-file <path>", "Append a JSON debug log of each step to this file").action(async (opts) => {
   const mode = detectOutputMode(opts);
   initLogger(opts.logFile);
   const progress = new ProgressReporter(mode, opts.verbose);
@@ -976,7 +1291,7 @@ var codegenCommand = new Command4("codegen").description("Convert Figma design t
         "No node IDs provided. Use --nodes or include node-id in the Figma URL."
       );
     }
-    const auth = resolveAuth();
+    const auth = await resolveAuth(opts.apiUrl);
     const figmaToken = opts.figmaToken || process.env.FIGMA_TOKEN || auth.figmaToken;
     if (!figmaToken) {
       throw validationError(
@@ -1045,18 +1360,18 @@ function parseGitTokenResponse(payload) {
     try {
       value = JSON.parse(value);
     } catch {
-      throw apiError(`Unexpected response from project-get_git_token: ${preview(payload)}`);
+      throw apiError(`Unexpected response from artifact-get_git_token: ${preview(payload)}`);
     }
   }
   if (value === null || typeof value !== "object") {
-    throw apiError(`Unexpected response from project-get_git_token: ${preview(payload)}`);
+    throw apiError(`Unexpected response from artifact-get_git_token: ${preview(payload)}`);
   }
   const body = value;
   if (body.success === false) {
     throw apiError(`Git access ${body.error ?? "denied"}: ${(body.reason ?? "").trim()}`);
   }
   if (!body.gitRemoteUrl) {
-    throw apiError(`Unexpected response from project-get_git_token: ${preview(payload)}`);
+    throw apiError(`Unexpected response from artifact-get_git_token: ${preview(payload)}`);
   }
   return {
     gitRemoteUrl: body.gitRemoteUrl,
@@ -1066,17 +1381,17 @@ function parseGitTokenResponse(payload) {
 }
 
 // src/commands/getGitToken.ts
-var getGitTokenCommand = new Command5("get-git-token").description("Mint a short-lived git remote URL for a playground (clone/push with git)").argument("<playgroundUrl>", "Playground URL or session ID").option("--json", "Output as JSON").option("--verbose", "Show progress on stderr").option("--api-url <url>", "API base URL (overrides config / ANIMA_API_URL)").option("--log-file <path>", "Append a JSON debug log of each step to this file").action(async (playgroundUrl, opts) => {
+var getGitTokenCommand = new Command5("get-git-token").description("Mint a short-lived git remote URL for an artifact (clone/push with git)").argument("<artifactUrl>", "Artifact URL or session ID").option("--json", "Output as JSON").option("--verbose", "Show progress on stderr").option("--api-url <url>", "API base URL (overrides config / ANIMA_API_URL)").option("--log-file <path>", "Append a JSON debug log of each step to this file").action(async (artifactUrl, opts) => {
   const mode = detectOutputMode(opts);
   initLogger(opts.logFile);
   const progress = new ProgressReporter(mode, opts.verbose);
   try {
-    const sessionId = parsePlaygroundUrl(playgroundUrl);
-    const auth = resolveAuth();
+    const sessionId = parsePlaygroundUrl(artifactUrl);
+    const auth = await resolveAuth(opts.apiUrl);
     progress.start("Requesting git access...");
     const response = await withMcp(
       { apiBaseUrl: resolveApiUrl(opts.apiUrl), token: auth.token, teamId: auth.teamId },
-      (client) => client.callTool("project-get_git_token", { sessionId })
+      (client) => client.callTool("artifact-get_git_token", { sessionId })
     );
     const grant = parseGitTokenResponse(response);
     logEvent("git_token_granted", { sessionId, access: grant.access, expiresAt: grant.expiresAt });
@@ -1086,7 +1401,7 @@ var getGitTokenCommand = new Command5("get-git-token").description("Mint a short
       console.log(`  ${chalk4.cyan(`git clone ${grant.gitRemoteUrl}`)}`);
       console.log();
       if (grant.access === "rw") {
-        console.log("  Commit and push to update the live playground.");
+        console.log("  Commit and push to update the live artifact.");
       } else {
         console.log("  Read-only: cloning works, pushing will be rejected.");
       }
@@ -1096,7 +1411,7 @@ var getGitTokenCommand = new Command5("get-git-token").description("Mint a short
   re-run this command and ${chalk4.cyan("git remote set-url origin <new url>")} to keep pushing.`
         );
       }
-      console.log("  Treat the URL as a secret \u2014 it grants access to this playground.");
+      console.log("  Treat the URL as a secret \u2014 it grants access to this artifact.");
       console.log();
     } else {
       outputResult(mode, {
@@ -1133,15 +1448,6 @@ import open from "open";
 var DEVICE_GRANT_TYPE = "urn:ietf:params:oauth:grant-type:device_code";
 var DEFAULT_CLIENT_NAME = "AgentGrid CLI";
 var defaultSleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
-function decodeJwtPayload(token) {
-  try {
-    const parts = token.split(".");
-    if (parts.length !== 3) return void 0;
-    return JSON.parse(Buffer.from(parts[1], "base64url").toString("utf-8"));
-  } catch {
-    return void 0;
-  }
-}
 async function loginWithDeviceFlow(options) {
   const fetchFn = options.fetchFn ?? fetch;
   const sleep = options.sleepFn ?? defaultSleep;
@@ -1186,22 +1492,9 @@ async function loginWithDeviceFlow(options) {
     const body = await pollResponse.json();
     logEvent("device_token_poll", { status: pollResponse.status, error: body.error });
     if (pollResponse.ok && typeof body.access_token === "string") {
-      const token = body.access_token;
-      const claims = decodeJwtPayload(token);
-      const result = {
-        token,
-        teamId: typeof claims?.team_id === "string" ? claims.team_id : void 0,
-        agentId: typeof claims?.agent_id === "string" ? claims.agent_id : void 0,
-        expiresAt: typeof claims?.exp === "number" ? new Date(claims.exp * 1e3).toISOString() : void 0
-      };
-      writeCredentials({
-        token: result.token,
-        teamId: result.teamId,
-        tokenType: "agent",
-        agentId: result.agentId,
-        expiresAt: result.expiresAt
-      });
-      return result;
+      const session = agentSessionFromTokenResponse(body);
+      persistAgentSession(session);
+      return session;
     }
     switch (body.error) {
       case "authorization_pending":
@@ -1248,15 +1541,6 @@ function parseInvite(input) {
   }
   return { code: trimmed.replace(/\.md$/, "") };
 }
-function decodeJwtPayload2(token) {
-  try {
-    const parts = token.split(".");
-    if (parts.length !== 3) return void 0;
-    return JSON.parse(Buffer.from(parts[1], "base64url").toString("utf-8"));
-  } catch {
-    return void 0;
-  }
-}
 async function loginWithInvite(options) {
   const fetchFn = options.fetchFn ?? fetch;
   const { code } = parseInvite(options.invite);
@@ -1277,31 +1561,89 @@ async function loginWithInvite(options) {
     const description = typeof body.error_description === "string" ? body.error_description : `Invite redemption failed (HTTP ${response.status})`;
     throw new CliError("AUTH_INVALID", description, EXIT_CODES.AUTH_ERROR);
   }
-  const token = body.access_token;
-  const claims = decodeJwtPayload2(token);
-  const result = {
-    token,
-    teamId: typeof claims?.team_id === "string" ? claims.team_id : void 0,
-    agentId: typeof claims?.agent_id === "string" ? claims.agent_id : void 0,
-    expiresAt: typeof claims?.exp === "number" ? new Date(claims.exp * 1e3).toISOString() : void 0
-  };
-  writeCredentials({
-    token: result.token,
-    teamId: result.teamId,
-    tokenType: "agent",
-    agentId: result.agentId,
-    expiresAt: result.expiresAt
-  });
-  return result;
+  const session = agentSessionFromTokenResponse(body);
+  persistAgentSession(session);
+  return session;
+}
+
+// src/auth/handoff.ts
+var HANDOFF_GRANT_TYPE = "urn:animaapp:params:oauth:grant-type:handoff_token";
+var POLL_INTERVAL_SECONDS = 30;
+var defaultSleep2 = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
+async function loginWithHandoff(options) {
+  const fetchFn = options.fetchFn ?? fetch;
+  const sleep = options.sleepFn ?? defaultSleep2;
+  const now = options.nowFn ?? Date.now;
+  const base = options.apiUrl.replace(/\/$/, "");
+  const tokenUrl = `${base}/oauth/token`;
+  const deadline = resolveDeadline(options.claimableUntil, now);
+  let intervalMs = POLL_INTERVAL_SECONDS * 1e3;
+  for (; ; ) {
+    const response = await fetchFn(tokenUrl, {
+      method: "POST",
+      headers: { "Content-Type": "application/x-www-form-urlencoded" },
+      body: new URLSearchParams({
+        grant_type: HANDOFF_GRANT_TYPE,
+        handoff_token: options.handoffToken
+      }).toString()
+    });
+    const body = await response.json().catch(() => ({}));
+    logEvent("handoff_token_poll", { status: response.status, error: body.error });
+    if (response.ok && typeof body.access_token === "string") {
+      const session = agentSessionFromTokenResponse(body);
+      persistAgentSession(session);
+      clearPendingHandoff();
+      return session;
+    }
+    switch (body.error) {
+      case "authorization_pending":
+        break;
+      case "slow_down":
+        intervalMs += 5e3;
+        break;
+      case "expired_token":
+        clearPendingHandoff();
+        throw authError(
+          "This handoff token can no longer be redeemed \u2014 the claim window closed unclaimed, the token was already redeemed, or the human claimed the artifact without granting agent access. Share again with a new `anima create --anonymous` \u2014 or, if they claimed it and want you to keep editing, have them grant your agent from the artifact page."
+        );
+      default:
+        throw new CliError(
+          "API_ERROR",
+          `Unexpected token response: ${body.error ?? `HTTP ${response.status}`}`,
+          EXIT_CODES.API_ERROR
+        );
+    }
+    const remainingMs = deadline.getTime() - now();
+    if (remainingMs <= 0) break;
+    const waitMs = Math.min(intervalMs, remainingMs);
+    options.onPending?.({ nextPollInSeconds: Math.round(waitMs / 1e3), deadline });
+    await sleep(waitMs);
+  }
+  throw authError(
+    "The claim window closed before anyone claimed the artifact. Share again with a new `anima create --anonymous` \u2014 the previous one has expired and can no longer be claimed."
+  );
+}
+var FALLBACK_POLL_WINDOW_MS = 24 * 60 * 60 * 1e3;
+function resolveDeadline(claimableUntil, now) {
+  const parsed = claimableUntil ? new Date(claimableUntil) : null;
+  if (parsed && !Number.isNaN(parsed.getTime())) return parsed;
+  return new Date(now() + FALLBACK_POLL_WINDOW_MS);
 }
 
 // src/commands/login.ts
-var loginCommand = new Command6("login").description("Log in via the device flow, or redeem a pre-approved invite with --invite").option("--invite <url-or-code>", "Redeem an invite link (\u2026/invite/<code>.md) or bare code \u2014 no approval step").option("--client-name <name>", "How this CLI appears on the consent screen", "AgentGrid CLI").option("--no-open", "Do not try to open the verification page in a browser").option("--json", "Output as JSON").option("--api-url <url>", "API base URL (overrides config / ANIMA_API_URL)").option("--log-file <path>", "Append a JSON debug log of each step to this file").option(
+var loginCommand = new Command6("login").description("Log in via the device flow, redeem an invite with --invite, or finish an anonymous create with --handoff").option("--invite <url-or-code>", "Redeem an invite link (\u2026/invite/<code>.md) or bare code \u2014 no approval step").option(
+  "--handoff [token]",
+  "Log in with the handoff token from an anonymous create. Waits until a human claims the artifact. Defaults to your last one"
+).option("--client-name <name>", "How this CLI appears on the consent screen", "AgentGrid CLI").option("--no-open", "Do not try to open the verification page in a browser").option("--json", "Output as JSON").option("--api-url <url>", "API base URL (overrides config / ANIMA_API_URL)").option("--log-file <path>", "Append a JSON debug log of each step to this file").option(
   "--print-mcp-config",
-  "After login, also print an MCP server config (includes the token) to paste into an MCP-capable agent"
+  "After login, also print an MCP server config (URL only \u2014 the client authorizes itself) to paste into an MCP-capable agent"
 ).action(async (opts) => {
   const mode = detectOutputMode(opts);
   initLogger(opts.logFile);
+  if (opts.handoff) {
+    await runHandoffLogin(opts, mode);
+    return;
+  }
   if (opts.invite) {
     const inviteOrigin = parseInvite(opts.invite).origin;
     const apiUrl2 = opts.apiUrl ? resolveApiUrl(opts.apiUrl) : inviteOrigin ?? resolveApiUrl();
@@ -1310,17 +1652,17 @@ var loginCommand = new Command6("login").description("Log in via the device flow
       if (inviteOrigin && readConfig().apiUrl !== apiUrl2) {
         setConfig("api-url", apiUrl2);
       }
-      const mcpConfig = opts.printMcpConfig ? buildMcpConfig(apiUrl2, result.token) : void 0;
+      const mcpConfig = opts.printMcpConfig ? buildMcpConfig(apiUrl2) : void 0;
       if (mode === "pretty") {
         printSuccess("Connected!");
         printKeyValue("Credentials", getCredentialsPath());
-        if (result.agentId) printKeyValue("Agent", result.agentId);
-        if (result.teamId) printKeyValue("Team ID", result.teamId);
-        if (result.expiresAt) printKeyValue("Token expires", result.expiresAt);
+        printKeyValue("Agent", result.agentId);
+        printKeyValue("Team ID", result.teamId);
+        printKeyValue("Token expires", result.expiresAt);
         printInfo("This is a scoped agent token \u2014 it acts within what was approved, and the team can revoke it.");
         if (mcpConfig) {
           console.log();
-          printInfo("MCP server config (token expires ~7 days \u2014 a fresh invite renews it):");
+          printInfo("MCP server config \u2014 your client will prompt to authorize on first use:");
           console.log();
           console.log(JSON.stringify(mcpConfig, null, 2));
         }
@@ -1381,17 +1723,17 @@ var loginCommand = new Command6("login").description("Log in via the device flow
         }
       }
     });
-    const mcpConfig = opts.printMcpConfig ? buildMcpConfig(apiUrl, result.token) : void 0;
+    const mcpConfig = opts.printMcpConfig ? buildMcpConfig(apiUrl) : void 0;
     if (mode === "pretty") {
       printSuccess("Connected!");
       printKeyValue("Credentials", getCredentialsPath());
-      if (result.agentId) printKeyValue("Agent", result.agentId);
-      if (result.teamId) printKeyValue("Team ID", result.teamId);
-      if (result.expiresAt) printKeyValue("Token expires", result.expiresAt);
+      printKeyValue("Agent", result.agentId);
+      printKeyValue("Team ID", result.teamId);
+      printKeyValue("Token expires", result.expiresAt);
       printInfo("This is a scoped agent token \u2014 it acts within what you approved, and your team can revoke it.");
       if (mcpConfig) {
         console.log();
-        printInfo("MCP server config (token expires ~7 days \u2014 re-run `anima login` to refresh):");
+        printInfo("MCP server config \u2014 your client will prompt to authorize on first use:");
         console.log();
         console.log(JSON.stringify(mcpConfig, null, 2));
       }
@@ -1418,41 +1760,113 @@ var loginCommand = new Command6("login").description("Log in via the device flow
     throw err;
   }
 });
-function buildMcpConfig(apiUrl, token) {
+async function runHandoffLogin(opts, mode) {
+  const explicitToken = typeof opts.handoff === "string" ? opts.handoff : void 0;
+  const stored = readPendingHandoff();
+  const pending = stored && (!explicitToken || stored.handoffToken === explicitToken) ? stored : explicitToken ? { handoffToken: explicitToken, sessionId: "", claimUrl: "", claimableUntil: "", apiUrl: resolveApiUrl() } : null;
+  if (!pending) {
+    const message = "No handoff token. Pass one (`anima login --handoff <token>`), or run `anima create --anonymous -t import --from <path>` to get one. (Already logged in another way? `anima auth --status`.)";
+    if (mode === "pretty") {
+      printError(message);
+    } else {
+      outputError(mode, { code: "VALIDATION_ERROR", message });
+    }
+    process.exit(1);
+  }
+  const apiUrl = opts.apiUrl ? resolveApiUrl(opts.apiUrl) : pending.apiUrl;
+  try {
+    if (mode === "pretty") {
+      console.log();
+      printInfo("Waiting for a human to claim the artifact:");
+      if (pending.claimUrl) {
+        console.log();
+        console.log(`    ${chalk5.cyan.underline(pending.claimUrl)}`);
+      }
+      console.log();
+      printInfo(
+        pending.claimableUntil ? `Claimable until ${pending.claimableUntil}. Ctrl-C to stop \u2014 this does not cancel the claim.` : "Ctrl-C to stop \u2014 this does not cancel the claim."
+      );
+    } else {
+      process.stderr.write(
+        JSON.stringify({
+          event: "claim_required",
+          ...pending.claimUrl ? { claimUrl: pending.claimUrl } : {},
+          ...pending.sessionId ? { sessionId: pending.sessionId } : {},
+          ...pending.claimableUntil ? { claimableUntil: pending.claimableUntil } : {}
+        }) + "\n"
+      );
+    }
+    const result = await loginWithHandoff({
+      apiUrl,
+      handoffToken: pending.handoffToken,
+      claimableUntil: pending.claimableUntil || void 0
+    });
+    if (readConfig().apiUrl !== apiUrl) {
+      setConfig("api-url", apiUrl);
+    }
+    const mcpConfig = opts.printMcpConfig ? buildMcpConfig(apiUrl) : void 0;
+    if (mode === "pretty") {
+      printSuccess("Claimed \u2014 you're connected!");
+      printKeyValue("Credentials", getCredentialsPath());
+      printKeyValue("Agent", result.agentId);
+      printKeyValue("Team ID", result.teamId);
+      printKeyValue("Token expires", result.expiresAt);
+      printInfo("The artifact is now editable: anima get-git-token " + pending.sessionId);
+      if (mcpConfig) {
+        console.log();
+        printInfo("MCP server config \u2014 your client will prompt to authorize on first use:");
+        console.log();
+        console.log(JSON.stringify(mcpConfig, null, 2));
+      }
+    } else {
+      outputResult(mode, {
+        success: true,
+        action: "logged_in",
+        via: "handoff",
+        tokenType: "agent",
+        agentId: result.agentId,
+        teamId: result.teamId,
+        expiresAt: result.expiresAt,
+        sessionId: pending.sessionId,
+        ...mcpConfig ? { mcpConfig } : {}
+      });
+    }
+  } catch (err) {
+    if (err instanceof CliError) {
+      if (mode === "pretty") {
+        printError(err.message);
+      } else {
+        outputError(mode, { code: err.code, message: err.message });
+      }
+      process.exit(err.exitCode);
+    }
+    throw err;
+  }
+}
+function buildMcpConfig(apiUrl) {
   return {
     mcpServers: {
       anima: {
         type: "http",
-        url: `${apiUrl.replace(/\/$/, "")}/v1/mcp`,
-        headers: { Authorization: `Bearer ${token}` }
+        url: `${apiUrl.replace(/\/$/, "")}/v1/mcp`
       }
     }
   };
 }
 
 // src/commands/mcpConfig.ts
-var mcpConfigCommand = new Command7("mcp-config").description("Print an MCP server config from your stored credentials (run `login` first)").option("--json", "Output as JSON").option("--api-url <url>", "API base URL (overrides config / ANIMA_API_URL)").action(async (opts) => {
+var mcpConfigCommand = new Command7("mcp-config").description("Print an MCP server config for your MCP client").option("--json", "Output as JSON").option("--api-url <url>", "API base URL (overrides config / ANIMA_API_URL)").action(async (opts) => {
   const mode = detectOutputMode(opts);
   try {
-    const auth = resolveAuth();
-    const creds = readCredentials();
-    const expiresAt = auth.source === "env" ? void 0 : creds?.expiresAt;
-    const mcpConfig = buildMcpConfig(resolveApiUrl(opts.apiUrl), auth.token);
+    const mcpConfig = buildMcpConfig(resolveApiUrl(opts.apiUrl));
     if (mode === "pretty") {
-      printInfo("MCP server config (add to your MCP client; the token is a secret):");
+      printInfo("MCP server config (add to your MCP client):");
       console.log();
       console.log(JSON.stringify(mcpConfig, null, 2));
       console.log();
-      if (expiresAt) {
-        printInfo(`Token expires ${expiresAt} \u2014 run \`anima login\` then \`anima mcp-config\` to refresh.`);
-      }
+      printInfo("Your client will prompt you to authorize on first use.");
     } else {
-      outputResult(mode, {
-        success: true,
-        mcpConfig,
-        ...expiresAt ? { expiresAt } : {},
-        ...creds?.agentId && auth.source !== "env" ? { agentId: creds.agentId } : {}
-      });
+      outputResult(mode, { success: true, mcpConfig });
     }
   } catch (err) {
     if (err instanceof CliError) {
@@ -1471,19 +1885,37 @@ var mcpConfigCommand = new Command7("mcp-config").description("Print an MCP serv
 import { Command as Command8 } from "commander";
 import chalk6 from "chalk";
 var DEFAULT_API_URL2 = "https://api.agentgrid.io";
+function describePendingHandoff(pending, state) {
+  return {
+    state,
+    sessionId: pending.sessionId,
+    claimUrl: pending.claimUrl,
+    claimableUntil: pending.claimableUntil,
+    nextSteps: state === "expired" ? "The claim window closed. Create another artifact, or ask your human for an agent invite: anima login --invite <url-or-code>" : "Send claimUrl to your human, then run `anima login --handoff` to wait for the credentials their claim grants."
+  };
+}
+function printPendingHandoff(pending, state) {
+  console.log();
+  if (state === "expired") {
+    printInfo(`Anonymous artifact ${pending.sessionId} was never claimed \u2014 its window closed at ${pending.claimableUntil}.`);
+    return;
+  }
+  printInfo(`Anonymous artifact ${pending.sessionId} is awaiting a claim (until ${pending.claimableUntil}):`);
+  console.log(`    ${chalk6.cyan.underline(pending.claimUrl)}`);
+  console.log(`  Run ${chalk6.cyan("anima login --handoff")} to wait for it.`);
+}
 var authCommand = new Command8("auth").description("Manage authentication").option("--token <token>", "Store AgentGrid API token").option("--figma-token <token>", "Store Figma personal access token").option("--team-id <teamId>", "Team ID to associate with token").option("--status", "Show current auth status").option("--logout", "Clear stored credentials (alias for `anima logout`)").option("--json", "Output as JSON").option("--api-url <url>", "API base URL", DEFAULT_API_URL2).action(async (opts) => {
   const mode = detectOutputMode(opts);
   try {
     if (opts.token || opts.figmaToken) {
       const toSave = {};
       if (opts.token) {
-        toSave.token = opts.token;
-        toSave.teamId = opts.teamId ?? extractTeamIdFromJWT(opts.token) ?? "";
+        toSave.teamId = opts.teamId ?? extractTeamIdFromJWT(opts.token);
+        saveCredential({ tokenType: "account", token: opts.token, teamId: toSave.teamId });
       }
       if (opts.figmaToken) {
-        toSave.figmaToken = opts.figmaToken;
+        saveFigmaToken(opts.figmaToken);
       }
-      writeCredentials(toSave);
       if (mode === "pretty") {
         printSuccess("Credentials saved to " + getCredentialsPath());
         if (opts.token) {
@@ -1505,6 +1937,7 @@ var authCommand = new Command8("auth").description("Manage authentication").opti
       return;
     }
     if (opts.logout) {
+      const revoked = await revokeStoredRefreshToken(resolveApiUrl(opts.apiUrl));
       const deleted = clearStorage();
       if (mode === "pretty") {
         if (deleted) {
@@ -1513,13 +1946,15 @@ var authCommand = new Command8("auth").description("Manage authentication").opti
           printInfo("No stored credentials found");
         }
       } else {
-        outputResult(mode, { success: true, action: "logged_out", hadCredentials: deleted });
+        outputResult(mode, { success: true, action: "logged_out", hadCredentials: deleted, revoked });
       }
       return;
     }
     if (opts.status) {
+      const pending = readPendingHandoff();
+      const pendingState = !pending ? void 0 : new Date(pending.claimableUntil).getTime() <= Date.now() ? "expired" : "awaiting_claim";
       try {
-        const auth = resolveAuth();
+        const auth = await resolveAuth(opts.apiUrl);
         const creds = readCredentials();
         const sourceName = auth.source === "env" ? "ANIMA_API_TOKEN env var" : getCredentialsPath();
         const hasFigma = !!(process.env.FIGMA_TOKEN || creds?.figmaToken);
@@ -1527,24 +1962,35 @@ var authCommand = new Command8("auth").description("Manage authentication").opti
           printSuccess("Token configured");
           printKeyValue("Source", sourceName);
           printKeyValue("AgentGrid token", auth.token.slice(0, 12) + "..." + auth.token.slice(-4));
-          printKeyValue("Token type", auth.tokenType === "agent" ? "agent (scoped, revocable)" : "personal/API");
+          printKeyValue("Token type", auth.tokenType === "agent" ? "agent (scoped, revocable)" : "account (personal API token)");
           if (creds?.tokenType === "agent" && creds.expiresAt) printKeyValue("Expires", creds.expiresAt);
           if (auth.teamId) printKeyValue("Team ID", auth.teamId);
           printKeyValue("Figma token", hasFigma ? "configured" : "not set (needed for codegen/f2c)");
+          if (pending) printPendingHandoff(pending, pendingState);
         } else {
           outputResult(mode, {
             success: true,
             source: auth.source,
-            tokenType: auth.tokenType ?? "personal",
+            tokenType: auth.tokenType ?? "account",
             tokenPreview: auth.token.slice(0, 12) + "..." + auth.token.slice(-4),
             teamId: auth.teamId,
             expiresAt: creds?.tokenType === "agent" ? creds.expiresAt : void 0,
-            figmaToken: hasFigma
+            figmaToken: hasFigma,
+            ...pending ? { pendingHandoff: describePendingHandoff(pending, pendingState) } : {}
           });
         }
       } catch (err) {
         if (err instanceof CliError) {
-          if (mode === "pretty") {
+          if (pending && mode === "pretty") {
+            printInfo("Not connected yet.");
+            printPendingHandoff(pending, pendingState);
+          } else if (pending) {
+            outputResult(mode, {
+              success: true,
+              tokenType: null,
+              pendingHandoff: describePendingHandoff(pending, pendingState)
+            });
+          } else if (mode === "pretty") {
             printError(err.message);
           } else {
             outputError(mode, { code: err.code, message: err.message });
@@ -1559,6 +2005,7 @@ var authCommand = new Command8("auth").description("Manage authentication").opti
       console.log();
       printInfo("Auth commands:");
       console.log(`  ${chalk6.cyan("anima login")}                    Log in (device flow \u2014 approve on any browser)`);
+      console.log(`  ${chalk6.cyan("anima login --handoff")}          Wait for a human to claim your anonymous artifact`);
       console.log(`  ${chalk6.cyan("anima logout")}                   Clear all credentials`);
       console.log(`  ${chalk6.cyan("anima auth --status")}            Check auth status`);
       console.log(`  ${chalk6.cyan("anima auth --figma-token <T>")}   Save Figma token (needed for codegen/f2c)`);
@@ -1586,40 +2033,42 @@ var authCommand = new Command8("auth").description("Manage authentication").opti
 
 // src/commands/logout.ts
 import { Command as Command9 } from "commander";
-var logoutCommand = new Command9("logout").description("Clear all stored credentials (AgentGrid + Figma tokens) from this machine").option("--json", "Output as JSON").action((opts) => {
+var logoutCommand = new Command9("logout").description("Clear all stored credentials (AgentGrid + Figma tokens) from this machine").option("--json", "Output as JSON").option("--api-url <url>", "API base URL (overrides config / ANIMA_API_URL)").action(async (opts) => {
   const mode = detectOutputMode(opts);
+  const revoked = await revokeStoredRefreshToken(resolveApiUrl(opts.apiUrl));
   const hadCredentials = clearStorage();
   deleteConfig();
   if (mode === "pretty") {
     if (hadCredentials) {
       printSuccess("Logged out \u2014 all credentials cleared from " + getCredentialsPath());
+      if (revoked) printInfo("Agent credentials revoked server-side");
     } else {
       printInfo("No stored credentials found");
     }
   } else {
-    outputResult(mode, { success: true, action: "logged_out", hadCredentials });
+    outputResult(mode, { success: true, action: "logged_out", hadCredentials, revoked });
   }
 });
 
 // src/commands/unpublish.ts
 import { Command as Command10 } from "commander";
-var unpublishCommand = new Command10("unpublish").description("Take a published playground offline (clears its live URL; code and playground stay intact)").argument("<sessionId>", "Session ID of the published playground").option("--json", "Output as JSON").option("--verbose", "Show progress on stderr").option("--api-url <url>", "API base URL (overrides config / ANIMA_API_URL)").option("--log-file <path>", "Append a JSON debug log of each step to this file").action(async (sessionId, opts) => {
+var unpublishCommand = new Command10("unpublish").description("Take a published artifact offline (clears its live URL; code and artifact stay intact)").argument("<sessionId>", "Session ID of the published artifact").option("--json", "Output as JSON").option("--verbose", "Show progress on stderr").option("--api-url <url>", "API base URL (overrides config / ANIMA_API_URL)").option("--log-file <path>", "Append a JSON debug log of each step to this file").action(async (sessionId, opts) => {
   const mode = detectOutputMode(opts);
   initLogger(opts.logFile);
   const progress = new ProgressReporter(mode, opts.verbose);
   try {
-    const auth = resolveAuth();
+    const auth = await resolveAuth(opts.apiUrl);
     progress.start("Unpublishing...");
     const result = await withMcp(
       { apiBaseUrl: resolveApiUrl(opts.apiUrl), token: auth.token, teamId: auth.teamId },
-      (client) => client.callTool("playground-unpublish", { sessionId })
+      (client) => client.callTool("artifact-unpublish", { sessionId })
     );
     if (!result.success) {
       throw apiError(result.reason || result.error || "Unpublish failed", result);
     }
     progress.succeed("Unpublished");
     if (mode === "pretty") {
-      printSuccess(result.message || `Playground ${sessionId} is no longer publicly reachable.`);
+      printSuccess(result.message || `Artifact ${sessionId} is no longer publicly reachable.`);
     } else {
       outputResult(mode, { success: true, sessionId, ...result.message ? { message: result.message } : {} });
     }
@@ -1639,7 +2088,7 @@ var unpublishCommand = new Command10("unpublish").description("Take a published
 
 // src/commands/update.ts
 import { Command as Command11 } from "commander";
-var updateCommand = new Command11("update").description("Update a playground's metadata: display name and/or visibility (never touches code)").argument("<sessionId>", "Session ID of the playground").option("--name <name>", "New display name").option("--privacy <privacy>", "public (anyone with the link) | private (team only)").option("--json", "Output as JSON").option("--verbose", "Show progress on stderr").option("--api-url <url>", "API base URL (overrides config / ANIMA_API_URL)").option("--log-file <path>", "Append a JSON debug log of each step to this file").action(async (sessionId, opts) => {
+var updateCommand = new Command11("update").description("Update an artifact's metadata: display name and/or visibility (never touches code)").argument("<sessionId>", "Session ID of the artifact").option("--name <name>", "New display name").option("--privacy <privacy>", "public (anyone with the link) | private (team only)").option("--json", "Output as JSON").option("--verbose", "Show progress on stderr").option("--api-url <url>", "API base URL (overrides config / ANIMA_API_URL)").option("--log-file <path>", "Append a JSON debug log of each step to this file").action(async (sessionId, opts) => {
   const mode = detectOutputMode(opts);
   initLogger(opts.logFile);
   const progress = new ProgressReporter(mode, opts.verbose);
@@ -1650,11 +2099,11 @@ var updateCommand = new Command11("update").description("Update a playground's m
     if (opts.privacy && !["public", "private"].includes(opts.privacy)) {
       throw validationError(`Invalid privacy "${opts.privacy}". Must be public or private.`);
     }
-    const auth = resolveAuth();
+    const auth = await resolveAuth(opts.apiUrl);
     progress.start("Updating...");
     const result = await withMcp(
       { apiBaseUrl: resolveApiUrl(opts.apiUrl), token: auth.token, teamId: auth.teamId },
-      (client) => client.callTool("playground-metadata-update", {
+      (client) => client.callTool("artifact-update_metadata", {
         sessionId,
         ...opts.name ? { name: opts.name } : {},
         ...opts.privacy ? { privacy: opts.privacy } : {}
@@ -1665,7 +2114,7 @@ var updateCommand = new Command11("update").description("Update a playground's m
     }
     progress.succeed("Updated");
     if (mode === "pretty") {
-      printSuccess(result.message || `Playground ${sessionId} updated.`);
+      printSuccess(result.message || `Artifact ${sessionId} updated.`);
     } else {
       outputResult(mode, { success: true, sessionId, ...result.message ? { message: result.message } : {} });
     }
@@ -1750,18 +2199,79 @@ function assertUrl(value) {
   }
 }
 
+// src/commands/duplicate.ts
+import { Command as Command13 } from "commander";
+import chalk7 from "chalk";
+function buildDuplicateArgs(artifactUrl, name) {
+  const sessionId = parsePlaygroundUrl(artifactUrl);
+  if (!sessionId) {
+    throw validationError("A source artifact URL or session ID is required");
+  }
+  if (name !== void 0 && (name.length === 0 || name.length > 120)) {
+    throw validationError("--name must be between 1 and 120 characters");
+  }
+  return { sessionId, ...name !== void 0 ? { name } : {} };
+}
+function createDuplicateCommand() {
+  return new Command13("duplicate").description(
+    "Duplicate an artifact into a new, independent artifact. Copies code, assets, and supported database content; chat and custom domains are not copied. Duplication is non-idempotent: if a request times out or its response is lost, list recent artifacts before retrying because the first request may already have created the copy."
+  ).argument("<artifactUrl>", "Source artifact URL or session ID").option("--name <name>", "Display name for the duplicate (defaults to '<source name> (Copy)')").option("--json", "Output as JSON").option("--verbose", "Show progress on stderr").option("--api-url <url>", "API base URL (overrides config / ANIMA_API_URL)").option("--log-file <path>", "Append a JSON debug log of each step to this file").action(async (artifactUrl, opts) => {
+    const mode = detectOutputMode(opts);
+    initLogger(opts.logFile);
+    const progress = new ProgressReporter(mode, opts.verbose);
+    try {
+      const args = buildDuplicateArgs(artifactUrl, opts.name);
+      const auth = await resolveAuth(opts.apiUrl);
+      progress.start("Duplicating artifact...");
+      const result = await withMcp(
+        { apiBaseUrl: resolveApiUrl(opts.apiUrl), token: auth.token, teamId: auth.teamId },
+        (client) => client.callTool("artifact-duplicate", args)
+      );
+      if (!result.success) {
+        throw apiError(result.reason || result.error || "Artifact duplication failed", result);
+      }
+      progress.succeed("Artifact duplicated");
+      if (mode === "pretty") {
+        console.log();
+        printSuccess("Artifact duplicated successfully!");
+        printKeyValue("Name", result.name);
+        printKeyValue("Session ID", result.sessionId);
+        printKeyValue("Source session", result.sourceSessionId);
+        printKeyValue("Artifact", chalk7.cyan.underline(result.playgroundUrl));
+        printKeyValue("Preview", chalk7.cyan.underline(result.previewUrl));
+        printKeyValue("Next steps", result.nextSteps);
+        console.log();
+      } else {
+        outputResult(mode, result);
+      }
+    } catch (err) {
+      progress.fail("Failed");
+      if (err instanceof CliError) {
+        if (mode === "pretty") {
+          printError(err.message);
+        } else {
+          outputError(mode, { code: err.code, message: err.message });
+        }
+        process.exit(err.exitCode);
+      }
+      throw err;
+    }
+  });
+}
+var duplicateCommand = createDuplicateCommand();
+
 // src/index.ts
-var program = new Command13().name("anima").description(
-  `AgentGrid CLI \u2014 host, edit, and publish your work on AgentGrid. Every playground is a
+var program = new Command14().name("anima").description(
+  `AgentGrid CLI \u2014 host, edit, and publish your work on AgentGrid. Every artifact is a
 real git repository; each command runs an AgentGrid tool for you.
 
 THE MAIN FLOW (build something and put it on AgentGrid):
   1. npx @animaapp/cli login                                   # once; a human approves
-  2. npx @animaapp/cli create -t import --from ./my-project    # your code \u2192 a live playground
+  2. npx @animaapp/cli create -t import --from ./my-project    # your code \u2192 a live app
      (or: create -t empty --framework html \u2014 an empty repo you push to)
   3. The response includes a rw gitRemoteUrl \u2014 git clone, edit, commit, push:
-     every push updates the live playground.
-  4. Share the playgroundUrl with your human. That IS sharing \u2014 the playground
+     every push updates the live artifact.
+  4. Share the playgroundUrl with your human. That IS sharing \u2014 the artifact
      is visible at its URL. Do NOT run publish unless the human explicitly
      asked for a public site; offer it as a follow-up question instead.
 
@@ -1774,19 +2284,20 @@ TIMING (important for AI agents):
   create -t empty|import \u2192 seconds
   create -t p2c|l2c|f2c  \u2192 3-7 minutes AI generation (keep the default 600000ms timeout)
   publish/unpublish      \u2192 1-3 minutes
-  get-git-token / update \u2192 seconds
+  duplicate / get-git-token / update \u2192 seconds
 
 COMMANDS:
   login          Connect (device flow, or --invite to redeem an invite link)
   logout         Full local reset \u2014 clears credentials and CLI config
   list           List your team's artifacts (most-recently-updated first) to resume work
-  create         Make a playground: import your code, empty repo, or AI-generated (p2c/l2c/f2c)
-  get-git-token  Fresh git access to an existing playground (or after token expiry)
-  update         Rename a playground or set visibility public/private (metadata only)
+  create         Make an artifact: import your code, empty repo, or AI-generated (p2c/l2c/f2c)
+  duplicate      Copy an artifact into a new, independent artifact
+  get-git-token  Fresh git access to an existing artifact (or after token expiry)
+  update         Rename an artifact or set visibility public/private (metadata only)
   publish        Deploy to a public live URL \u2014 ONLY when the human asked for it
-  unpublish      Take a published playground offline (inverse of publish)
+  unpublish      Take a published artifact offline (inverse of publish)
   mcp-config     Print an MCP server config from stored credentials (no new login)
-  codegen        Convert Figma design to local code files (no playground)
+  codegen        Convert Figma design to local code files (no artifact)
   config         Store CLI preferences (e.g. a default API URL)
   auth           Inspect or manage credentials (status / figma token)
 
@@ -1794,6 +2305,7 @@ EXAMPLES (headless flow):
   npx @animaapp/cli login --invite https://api.agentgrid.io/invite/<code>.md
   npx @animaapp/cli create -t import --from ./my-project
   npx @animaapp/cli create -t empty --framework react --name "My app"
+  npx @animaapp/cli duplicate <artifactUrl> --name "My copy"
   npx @animaapp/cli get-git-token <sessionId>
   npx @animaapp/cli update <sessionId> --privacy public
   npx @animaapp/cli publish <sessionId>        # only on explicit request
@@ -1806,6 +2318,7 @@ program.addCommand(loginCommand);
 program.addCommand(logoutCommand);
 program.addCommand(listCommand);
 program.addCommand(createCommand);
+program.addCommand(duplicateCommand);
 program.addCommand(publishCommand);
 program.addCommand(unpublishCommand);
 program.addCommand(updateCommand);