@everfir/az8-cli 0.4.0 → 0.5.0

package/dist/main.js

@@ -2387,7 +2387,7 @@ var require_websocket = __commonJS({
     var http = __require("http");
     var net2 = __require("net");
     var tls = __require("tls");
-    var { randomBytes: randomBytes2, createHash: createHash7 } = __require("crypto");
+    var { randomBytes: randomBytes2, createHash: createHash9 } = __require("crypto");
     var { Duplex, Readable } = __require("stream");
     var { URL: URL2 } = __require("url");
     var PerMessageDeflate2 = require_permessage_deflate();
@@ -3047,7 +3047,7 @@ var require_websocket = __commonJS({
           abortHandshake(websocket, socket, "Invalid Upgrade header");
           return;
         }
-        const digest = createHash7("sha1").update(key + GUID).digest("base64");
+        const digest = createHash9("sha1").update(key + GUID).digest("base64");
         if (res.headers["sec-websocket-accept"] !== digest) {
           abortHandshake(websocket, socket, "Invalid Sec-WebSocket-Accept header");
           return;
@@ -3414,7 +3414,7 @@ var require_websocket_server = __commonJS({
     var EventEmitter3 = __require("events");
     var http = __require("http");
     var { Duplex } = __require("stream");
-    var { createHash: createHash7 } = __require("crypto");
+    var { createHash: createHash9 } = __require("crypto");
     var extension2 = require_extension();
     var PerMessageDeflate2 = require_permessage_deflate();
     var subprotocol2 = require_subprotocol();
@@ -3715,7 +3715,7 @@ var require_websocket_server = __commonJS({
           );
         }
         if (this._state > RUNNING) return abortHandshake(socket, 503);
-        const digest = createHash7("sha1").update(key + GUID).digest("base64");
+        const digest = createHash9("sha1").update(key + GUID).digest("base64");
         const headers = [
           "HTTP/1.1 101 Switching Protocols",
           "Upgrade: websocket",
@@ -19224,7 +19224,7 @@ import { createHash, randomUUID } from "node:crypto";
 import { chmod, lstat, mkdir, readFile, rename, writeFile } from "node:fs/promises";
 import { homedir } from "node:os";
 import path from "node:path";
-var FORMAT = "az8.workflow-preference.v1";
+var FORMAT = "az8.workflow-preference.v2";
 function createNodeWorkflowPreferenceStore(options) {
   const accountId = options.accountId.trim();
   if (!accountId) throw new Error("Workflow preference scope requires an account id.");
@@ -19236,12 +19236,12 @@ function createNodeWorkflowPreferenceStore(options) {
   return {
     async read(contentType) {
       await ensurePrivateDirectory(directory);
-      const filePath = preferencePath(directory, options.environment, accountId, contentType);
+      const filePath = preferencePath(directory, options.targetKey, accountId, contentType);
       try {
         await assertPrivateRegularFile(filePath);
         return parseStoredPreference(
           JSON.parse(await readFile(filePath, "utf8")),
-          options.environment,
+          options.targetKey,
           accountId,
           contentType
         );
@@ -19256,19 +19256,19 @@ function createNodeWorkflowPreferenceStore(options) {
       const value = {
         accountId,
         contentType,
-        environment: options.environment,
         format: FORMAT,
-        preference: normalized
+        preference: normalized,
+        targetKey: options.targetKey
       };
       await writeJsonAtomic(
-        preferencePath(directory, options.environment, accountId, contentType),
+        preferencePath(directory, options.targetKey, accountId, contentType),
         value
       );
     }
   };
 }
-function parseStoredPreference(value, environment, accountId, contentType) {
-  if (!isRecord2(value) || value.format !== FORMAT || value.environment !== environment || value.accountId !== accountId || value.contentType !== contentType) {
+function parseStoredPreference(value, targetKey, accountId, contentType) {
+  if (!isRecord2(value) || value.format !== FORMAT || value.targetKey !== targetKey || value.accountId !== accountId || value.contentType !== contentType) {
     return null;
   }
   try {
@@ -19289,8 +19289,8 @@ function normalizePreference(value) {
   );
   return { config: config2, definitionId: value.definitionId.trim() };
 }
-function preferencePath(directory, environment, accountId, contentType) {
-  const digest = createHash("sha256").update(`${environment}\0${accountId}\0${contentType}`).digest("hex");
+function preferencePath(directory, targetKey, accountId, contentType) {
+  const digest = createHash("sha256").update(`${targetKey}\0${accountId}\0${contentType}`).digest("hex");
   return path.join(directory, `${digest}.json`);
 }
 async function ensurePrivateDirectory(directory) {
@@ -34079,7 +34079,6 @@ var accountSchema = external_exports.object({
 var createdAuthorizationSchema = external_exports.object({
   created_at: external_exports.number().int(),
   device_code: external_exports.string().min(1),
-  environment: external_exports.enum(["production", "test"]),
   expires_at: external_exports.number().int(),
   expires_in: external_exports.number().int().positive(),
   format: external_exports.literal("az8.cli-authorization.v1"),
@@ -39981,7 +39980,7 @@ var CanvasClient = class {
     this.session = session ?? new CanvasSession(config2, projectId, void 0, {
       workflowPreferences: (actor) => createNodeWorkflowPreferenceStore({
         accountId: actor.accountId,
-        environment: config2.environment
+        targetKey: config2.targetKey
       })
     });
   }
@@ -40157,15 +40156,17 @@ function readTimedOut(value) {
 }
 
 // src/cli/config.ts
+import { createHash as createHash5 } from "node:crypto";
 import { readFile as readFile3 } from "node:fs/promises";
 import path4 from "node:path";
 
 // src/auth/local-credential-store.ts
-import { randomUUID as randomUUID2 } from "node:crypto";
-import { chmod as chmod2, lstat as lstat3, mkdir as mkdir2, readFile as readFile2, rename as rename2, unlink, writeFile as writeFile2 } from "node:fs/promises";
+import { createHash as createHash4, randomUUID as randomUUID2 } from "node:crypto";
+import { chmod as chmod2, lstat as lstat3, mkdir as mkdir2, readdir, readFile as readFile2, rename as rename2, unlink, writeFile as writeFile2 } from "node:fs/promises";
 import { homedir as homedir2 } from "node:os";
 import path3 from "node:path";
-var LOCAL_CREDENTIAL_FORMAT = "az8.local-credential.v1";
+var LOCAL_CREDENTIAL_FORMAT = "az8.local-credential.v2";
+var TARGET_KEY_PATTERN = /^[0-9a-f]{64}$/;
 var LocalCredentialStore = class {
   stateRoot;
   constructor(options = {}) {
@@ -40174,35 +40175,47 @@ var LocalCredentialStore = class {
       options.stateRoot ?? env.AZ8_CLI_STATE_DIR ?? path3.join(env.XDG_STATE_HOME ?? path3.join(homedir2(), ".local", "state"), "az8-cli")
     );
   }
-  async read(environment) {
+  async read(targetKey) {
     await this.initialize();
-    const filePath = this.filePath(environment);
+    const filePath = this.filePath(targetKey);
     try {
       await assertPrivateRegularFile2(filePath);
-      return parseCredential(JSON.parse(await readFile2(filePath, "utf8")), environment);
+      return parseCredential(JSON.parse(await readFile2(filePath, "utf8")), targetKey);
     } catch (error51) {
       if (error51.code === "ENOENT") return null;
       throw credentialError(
         "invalid-local-credential",
-        `Stored ${environment} credential is unavailable or invalid. Run az8 login --environment ${environment}.`
+        "The stored credential for the configured AZ8 service is unavailable or invalid. Run az8 login."
       );
     }
   }
   async write(credential) {
-    const normalized = parseCredential(credential, credential.environment);
+    const normalized = parseCredential(credential, credential.targetKey);
+    await this.initialize();
+    await writeJsonAtomic2(this.filePath(normalized.targetKey), normalized);
+  }
+  async list() {
     await this.initialize();
-    await writeJsonAtomic2(this.filePath(normalized.environment), normalized);
+    const entries = await readdir(path3.join(this.stateRoot, "credentials"));
+    const credentials = [];
+    for (const entry of entries.sort()) {
+      const targetKey = entry.endsWith(".json") ? entry.slice(0, -5) : "";
+      if (!TARGET_KEY_PATTERN.test(targetKey)) continue;
+      const credential = await this.read(targetKey);
+      if (credential) credentials.push(credential);
+    }
+    return credentials;
   }
-  async delete(environment) {
+  async delete(targetKey) {
     await this.initialize();
     try {
-      await unlink(this.filePath(environment));
+      await unlink(this.filePath(targetKey));
       return true;
     } catch (error51) {
       if (error51.code === "ENOENT") return false;
       throw credentialError(
         "local-credential-delete-failed",
-        `Unable to remove the stored ${environment} credential.`
+        "Unable to remove the stored credential for the configured AZ8 service."
       );
     }
   }
@@ -40210,12 +40223,15 @@ var LocalCredentialStore = class {
     await ensurePrivateDirectory2(this.stateRoot);
     await ensurePrivateDirectory2(path3.join(this.stateRoot, "credentials"));
   }
-  filePath(environment) {
-    return path3.join(this.stateRoot, "credentials", `${environment}.json`);
+  filePath(targetKey) {
+    if (!TARGET_KEY_PATTERN.test(targetKey)) {
+      throw credentialError("invalid-service-target", "AZ8 service target identity is invalid.");
+    }
+    return path3.join(this.stateRoot, "credentials", `${targetKey}.json`);
   }
 };
-function parseCredential(value, environment) {
-  if (!isRecord5(value) || value.format !== LOCAL_CREDENTIAL_FORMAT || value.environment !== environment || typeof value.token !== "string" || !isSafeToken(value.token) || typeof value.updatedAt !== "string" || !isRecord5(value.account) || typeof value.account.accountId !== "string" || !value.account.accountId.trim() || typeof value.account.email !== "string" || !value.account.email.trim() || value.account.nickname !== void 0 && typeof value.account.nickname !== "string" || value.account.subscriptionType !== void 0 && typeof value.account.subscriptionType !== "string" || value.tokenExpiresAt !== void 0 && (typeof value.tokenExpiresAt !== "number" || !Number.isInteger(value.tokenExpiresAt) || value.tokenExpiresAt <= 0)) {
+function parseCredential(value, targetKey) {
+  if (!isRecord5(value) || value.format !== LOCAL_CREDENTIAL_FORMAT || value.targetKey !== targetKey || !TARGET_KEY_PATTERN.test(targetKey) || typeof value.baseUrl !== "string" || !value.baseUrl || createHash4("sha256").update(value.baseUrl).digest("hex") !== targetKey || typeof value.token !== "string" || !isSafeToken(value.token) || typeof value.updatedAt !== "string" || !isRecord5(value.account) || typeof value.account.accountId !== "string" || !value.account.accountId.trim() || typeof value.account.email !== "string" || !value.account.email.trim() || value.account.nickname !== void 0 && typeof value.account.nickname !== "string" || value.account.subscriptionType !== void 0 && typeof value.account.subscriptionType !== "string" || value.tokenExpiresAt !== void 0 && (typeof value.tokenExpiresAt !== "number" || !Number.isInteger(value.tokenExpiresAt) || value.tokenExpiresAt <= 0)) {
     throw credentialError("invalid-local-credential", "Stored credential is invalid.");
   }
   return {
@@ -40225,8 +40241,9 @@ function parseCredential(value, environment) {
       ...value.account.nickname === void 0 ? {} : { nickname: value.account.nickname },
       ...value.account.subscriptionType === void 0 ? {} : { subscriptionType: value.account.subscriptionType }
     },
-    environment,
+    baseUrl: value.baseUrl,
     format: LOCAL_CREDENTIAL_FORMAT,
+    targetKey,
     token: value.token,
     ...value.tokenExpiresAt === void 0 ? {} : { tokenExpiresAt: value.tokenExpiresAt },
     updatedAt: value.updatedAt
@@ -40288,11 +40305,7 @@ function credentialError(code, message) {
 
 // src/cli/config.ts
 var DEFAULT_ENV_FILE = ".env.local";
-var DEFAULT_ENVIRONMENT = "production";
-var ENVIRONMENT_ORIGINS = {
-  production: "https://studio.az8.art",
-  test: "https://studio.az8.studio"
-};
+var DEFAULT_BASE_URL = "https://studio.az8.art";
 async function resolveCliConfig(options, dependencies) {
   const context = await resolveConfigContext(options, dependencies);
   const processToken = readToken(context.processEnvironment);
@@ -40300,7 +40313,7 @@ async function resolveCliConfig(options, dependencies) {
   if (processToken) {
     return {
       ...context.service,
-      credentials: createExternalCredentialProvider(processToken, "environment")
+      credentials: createExternalCredentialProvider(processToken, "process-env")
     };
   }
   if (fileToken) {
@@ -40310,10 +40323,10 @@ async function resolveCliConfig(options, dependencies) {
     };
   }
   const credentialStore = dependencies.credentialStore ?? new LocalCredentialStore({ env: context.processEnvironment });
-  const localCredential = await credentialStore.read(context.service.environment);
+  const localCredential = await credentialStore.read(context.service.targetKey);
   if (!localCredential) {
     throw new Error(
-      `Missing credentials for ${context.service.environment}. Run az8 login --environment ${context.service.environment}, or provide AZ8_TOKEN through the environment or an env file.`
+      "Missing credentials for the configured AZ8 service. Run az8 login, or provide AZ8_TOKEN through the process environment or an env file."
     );
   }
   let currentCredential = localCredential;
@@ -40331,8 +40344,9 @@ async function resolveCliConfig(options, dependencies) {
       async replaceToken(token) {
         currentCredential = {
           account: currentCredential.account,
-          environment: currentCredential.environment,
+          baseUrl: currentCredential.baseUrl,
           format: currentCredential.format,
+          targetKey: currentCredential.targetKey,
           token: requireSafeToken2(token),
           updatedAt: (/* @__PURE__ */ new Date()).toISOString()
         };
@@ -40352,29 +40366,39 @@ async function resolveConfigContext(options, dependencies) {
   const envFile = options.envFile;
   const fileEnvironment = envFile ? await readEnvironmentFile(path4.resolve(cwd, envFile)) : await readDefaultEnvironmentFile(cwd);
   const processEnvironment = dependencies.env ?? process.env;
-  const environment = readEnvironment(
-    options.environment ?? options.env ?? processEnvironment.AZ8_ENVIRONMENT ?? fileEnvironment.AZ8_ENVIRONMENT
+  const baseUrl = normalizeBaseUrl(
+    processEnvironment.AZ8_BASE_URL ?? fileEnvironment.AZ8_BASE_URL ?? DEFAULT_BASE_URL
   );
-  const origin = ENVIRONMENT_ORIGINS[environment];
   return {
     fileEnvironment,
     processEnvironment,
     service: {
-      backendUrl: normalizeUrl(
-        options.backendUrl ?? processEnvironment.AZ8_BACKEND_URL ?? fileEnvironment.AZ8_BACKEND_URL ?? `${origin}/api/backend`
-      ),
-      environment,
+      baseUrl,
+      backendUrl: `${baseUrl}/api/backend`,
       fetch: dependencies.fetch ?? globalThis.fetch,
-      serviceUrl: normalizeUrl(
-        options.serviceUrl ?? processEnvironment.AZ8_SERVICE_URL ?? fileEnvironment.AZ8_SERVICE_URL ?? `${origin}/api`
-      )
+      serviceUrl: `${baseUrl}/api`,
+      targetKey: createTargetKey(baseUrl)
     }
   };
 }
-function readEnvironment(value) {
-  const normalized = value ?? DEFAULT_ENVIRONMENT;
-  if (normalized === "production" || normalized === "test") return normalized;
-  throw new Error(`Unsupported environment: ${normalized}. Use test or production.`);
+function createTargetKey(baseUrl) {
+  return createHash5("sha256").update(normalizeBaseUrl(baseUrl)).digest("hex");
+}
+function normalizeBaseUrl(value) {
+  let url2;
+  try {
+    url2 = new URL(value);
+  } catch {
+    throw new Error("AZ8_BASE_URL must be a valid absolute URL.");
+  }
+  const isLocal = url2.hostname === "localhost" || url2.hostname === "127.0.0.1" || url2.hostname === "::1";
+  if (url2.protocol !== "https:" && !(url2.protocol === "http:" && isLocal)) {
+    throw new Error("AZ8_BASE_URL must use HTTPS, except for localhost development.");
+  }
+  if (url2.username || url2.password || url2.pathname !== "/" || url2.search || url2.hash) {
+    throw new Error("AZ8_BASE_URL must be an origin without credentials, path, query, or fragment.");
+  }
+  return url2.origin;
 }
 async function readEnvironmentFile(filePath) {
   try {
@@ -40396,18 +40420,15 @@ async function readEnvironmentFile(filePath) {
 async function readDefaultEnvironmentFile(cwd) {
   let directory = path4.resolve(cwd);
   while (true) {
-    const environment = await readEnvironmentFile(path4.join(directory, DEFAULT_ENV_FILE));
-    if (Object.keys(environment).length > 0) return environment;
+    const values = await readEnvironmentFile(path4.join(directory, DEFAULT_ENV_FILE));
+    if (Object.keys(values).length > 0) return values;
     const parent = path4.dirname(directory);
     if (parent === directory) return {};
     directory = parent;
   }
 }
-function normalizeUrl(value) {
-  return value.replace(/\/+$/g, "");
-}
-function readToken(environment) {
-  const value = environment.AZ8_TOKEN ?? environment.token;
+function readToken(values) {
+  const value = values.AZ8_TOKEN ?? values.token;
   return value ? requireSafeToken2(value) : void 0;
 }
 function requireSafeToken2(value) {
@@ -40590,12 +40611,12 @@ async function unlinkIfPresent(filePath) {
 }
 
 // src/agent-session/state-store.ts
-import { createHash as createHash4, randomUUID as randomUUID3 } from "node:crypto";
+import { createHash as createHash6, randomUUID as randomUUID3 } from "node:crypto";
 import {
   chmod as chmod4,
   lstat as lstat4,
   mkdir as mkdir3,
-  readdir,
+  readdir as readdir2,
   readFile as readFile4,
   realpath,
   rename as rename3,
@@ -40606,7 +40627,7 @@ import { homedir as homedir3 } from "node:os";
 import path5 from "node:path";
 
 // src/agent-session/types.ts
-var AGENT_SESSION_FORMAT = "az8.agent-session.v1";
+var AGENT_SESSION_FORMAT = "az8.agent-session.v2";
 
 // src/agent-session/state-store.ts
 var SESSION_ID_PATTERN = /^session_[0-9a-f-]{36}$/;
@@ -40641,7 +40662,7 @@ var AgentSessionStateStore = class {
     return path5.join(this.descriptorsDirectory(), `${requireSessionId(sessionId)}.json`);
   }
   socketPath(sessionId) {
-    const digest = createHash4("sha256").update(requireSessionId(sessionId)).digest("hex").slice(0, 24);
+    const digest = createHash6("sha256").update(requireSessionId(sessionId)).digest("hex").slice(0, 24);
     return path5.join(this.runtimeRoot, `${digest}.sock`);
   }
   async writeDescriptor(descriptor2) {
@@ -40659,7 +40680,7 @@ var AgentSessionStateStore = class {
   }
   async listDescriptors() {
     await this.initialize();
-    const entries = await readdir(this.descriptorsDirectory());
+    const entries = await readdir2(this.descriptorsDirectory());
     const descriptors = [];
     for (const entry of entries.sort()) {
       if (!entry.endsWith(".json")) continue;
@@ -40735,7 +40756,7 @@ var AgentSessionStateStore = class {
     }
   }
   contextPath(context) {
-    const digest = createHash4("sha256").update(context).digest("hex");
+    const digest = createHash6("sha256").update(context).digest("hex");
     return path5.join(this.contextsDirectory(), `${digest}.json`);
   }
 };
@@ -40778,7 +40799,7 @@ function assertLaunchSpec(value, launchPath) {
   if (path5.resolve(value.descriptorPath) !== expectedDescriptor) {
     throw sessionStateError("invalid-session-launch", "Session descriptor path is invalid.");
   }
-  const socketDigest = createHash4("sha256").update(sessionId).digest("hex").slice(0, 24);
+  const socketDigest = createHash6("sha256").update(sessionId).digest("hex").slice(0, 24);
   const expectedSocket = path5.join(
     path5.resolve(value.runtimeRoot),
     `${socketDigest}.sock`
@@ -40995,8 +41016,9 @@ async function startAgentSessionDaemon(spec, dependencies = {}) {
       ...await store.readDescriptor(spec.sessionId),
       ...client.credential ? {
         accountId: client.credential.accountId,
+        baseUrl: client.credential.baseUrl,
         credentialSource: client.credential.source,
-        environment: client.credential.environment
+        targetKey: client.credential.targetKey
       } : {},
       pid: process.pid,
       state: "ready"
@@ -41022,7 +41044,7 @@ async function createCanvasClient(spec, dependencies) {
   const session = new CanvasSession(config2, spec.projectId, void 0, {
     workflowPreferences: (actor) => createNodeWorkflowPreferenceStore({
       accountId: actor.accountId,
-      environment: config2.environment,
+      targetKey: config2.targetKey,
       stateRoot: spec.stateRoot
     })
   });
@@ -41033,8 +41055,9 @@ async function createCanvasClient(spec, dependencies) {
     ...config2.credentials.metadata ? {
       credential: {
         accountId: session.getCollaborationContext().actor.id,
-        environment: config2.environment,
-        source: config2.credentials.metadata.source
+        baseUrl: config2.baseUrl,
+        source: config2.credentials.metadata.source,
+        targetKey: config2.targetKey
       }
     } : {},
     executeOperation: (input) => client.executeOperation(input),
@@ -41053,7 +41076,6 @@ function openingDescriptor(spec, pid) {
   return {
     clientName: spec.clientName,
     createdAt: (/* @__PURE__ */ new Date()).toISOString(),
-    ...spec.config.environment || spec.config.env ? { environment: spec.config.environment ?? spec.config.env } : {},
     format: AGENT_SESSION_FORMAT,
     pid,
     projectId: spec.projectId,
@@ -41115,6 +41137,131 @@ function readErrorCode2(error51) {
   return typeof error51 === "object" && error51 !== null && "code" in error51 ? String(error51.code) : "session-daemon-failed";
 }
 
+// src/auth/browser-authorization.ts
+import { spawn } from "node:child_process";
+import { createHash as createHash7, randomBytes } from "node:crypto";
+async function runBrowserAuthorization(config2, options, dependencies = {}) {
+  const platform = dependencies.platform ?? process.platform;
+  if (!["darwin", "linux", "win32"].includes(platform)) {
+    throw authorizationError(
+      "unsupported-login-platform",
+      `Browser login is not supported on ${platform}.`
+    );
+  }
+  const pair = createPkcePair();
+  const created = await createCliAuthorization(config2, {
+    clientName: options.clientName,
+    clientVersion: options.clientVersion,
+    codeChallenge: pair.challenge,
+    platform
+  });
+  if (new URL(created.verification_uri).origin !== config2.baseUrl || new URL(created.verification_uri_complete).origin !== config2.baseUrl) {
+    throw authorizationError(
+      "authorization-service-mismatch",
+      "Account service created the authorization for a different AZ8 service."
+    );
+  }
+  let browserOpened = false;
+  if (!options.noOpen && dependencies.openUrl) {
+    try {
+      await dependencies.openUrl(created.verification_uri_complete);
+      browserOpened = true;
+    } catch {
+      browserOpened = false;
+    }
+  }
+  dependencies.onProgress?.({
+    baseUrl: config2.baseUrl,
+    browserOpened,
+    expiresAt: created.expires_at,
+    format: "az8.auth.login-progress.v2",
+    status: "verification_required",
+    userCode: created.user_code,
+    verificationUriComplete: created.verification_uri_complete
+  });
+  const now = dependencies.now ?? Date.now;
+  const sleep = dependencies.sleep ?? abortableSleep;
+  let interval = created.interval;
+  while (Math.floor(now() / 1e3) < created.expires_at) {
+    await sleep(interval * 1e3, dependencies.signal);
+    assertNotAborted(dependencies.signal);
+    const exchange = await exchangeCliAuthorization(config2, {
+      codeVerifier: pair.verifier,
+      deviceCode: created.device_code
+    });
+    if (exchange.status === "completed") {
+      return {
+        token: exchange.token,
+        tokenExpiresAt: exchange.token_expires_at
+      };
+    }
+    if (exchange.status === "access_denied") {
+      throw authorizationError("authorization-denied", "Browser authorization was denied.");
+    }
+    if (exchange.status === "expired_token") {
+      throw authorizationError(
+        "authorization-expired",
+        "Browser authorization expired or was already consumed. Start a new login attempt."
+      );
+    }
+    interval = exchange.interval;
+    dependencies.onProgress?.({
+      baseUrl: config2.baseUrl,
+      expiresAt: exchange.expires_at,
+      format: "az8.auth.login-progress.v2",
+      interval,
+      status: exchange.status
+    });
+  }
+  throw authorizationError(
+    "authorization-expired",
+    "Browser authorization expired. Start a new login attempt."
+  );
+}
+function createPkcePair() {
+  const verifier = randomBytes(32).toString("base64url");
+  return {
+    challenge: createHash7("sha256").update(verifier).digest("base64url"),
+    verifier
+  };
+}
+async function openSystemBrowser(url2) {
+  const [command, args2] = process.platform === "darwin" ? ["open", [url2]] : process.platform === "win32" ? ["rundll32", ["url.dll,FileProtocolHandler", url2]] : ["xdg-open", [url2]];
+  await new Promise((resolve, reject) => {
+    const child = spawn(command, args2, { detached: true, stdio: "ignore" });
+    child.once("error", reject);
+    child.once("spawn", () => {
+      child.unref();
+      resolve();
+    });
+  });
+}
+function abortableSleep(milliseconds, signal) {
+  return new Promise((resolve, reject) => {
+    if (signal?.aborted) {
+      reject(authorizationError("login-cancelled", "Browser login was cancelled."));
+      return;
+    }
+    const handleAbort = () => {
+      clearTimeout(timer);
+      reject(authorizationError("login-cancelled", "Browser login was cancelled."));
+    };
+    const timer = setTimeout(() => {
+      signal?.removeEventListener("abort", handleAbort);
+      resolve();
+    }, milliseconds);
+    signal?.addEventListener("abort", handleAbort, { once: true });
+  });
+}
+function assertNotAborted(signal) {
+  if (signal?.aborted) {
+    throw authorizationError("login-cancelled", "Browser login was cancelled.");
+  }
+}
+function authorizationError(code, message) {
+  return Object.assign(new Error(message), { code });
+}
+
 // src/canvas/protocol.ts
 var AZ8_PROTOCOL_VERSION = "1.1";
 var ProtocolInputError = class extends Error {
@@ -45249,7 +45396,7 @@ function formatZodError(error51) {
 }
 
 // src/media/download.ts
-import { createHash as createHash5 } from "node:crypto";
+import { createHash as createHash8 } from "node:crypto";
 import { link, lstat as lstat5, open as open2, rename as rename4, stat, unlink as unlink4 } from "node:fs/promises";
 import path8 from "node:path";
 
@@ -45699,7 +45846,7 @@ async function streamResponseToFile(response, handle, deadline, expectedBytes) {
     );
   }
   const reader = response.body.getReader();
-  const hash2 = createHash5("sha256");
+  const hash2 = createHash8("sha256");
   let bytes = 0;
   try {
     while (true) {
@@ -45943,10 +46090,10 @@ async function waitForDownloadRetry(delayMs, deadlineAt, dependencies) {
       phase: "retry-wait"
     });
   }
-  await (dependencies.sleep ?? abortableSleep)(delayMs, dependencies.signal);
+  await (dependencies.sleep ?? abortableSleep2)(delayMs, dependencies.signal);
   throwIfCancelled(dependencies.signal);
 }
-async function abortableSleep(delayMs, signal) {
+async function abortableSleep2(delayMs, signal) {
   if (signal?.aborted) return;
   await new Promise((resolve) => {
     const timeout = setTimeout(done, delayMs);
@@ -46056,7 +46203,7 @@ function canvasOneShotSetupError(kind, projectId, capability, error51) {
 }
 
 // src/agent-session/manager.ts
-import { spawn } from "node:child_process";
+import { spawn as spawn2 } from "node:child_process";
 import path9 from "node:path";
 var AgentSessionManager = class {
   constructor(options = {}) {
@@ -46064,7 +46211,7 @@ var AgentSessionManager = class {
     this.store = options.stateStore ?? new AgentSessionStateStore({ cwd: options.cwd, env: options.env });
     this.entrypoint = options.entrypoint ?? process.argv[1] ?? "";
     this.requestImplementation = options.request ?? requestAgentSession;
-    this.spawnProcess = options.spawnProcess ?? ((command, args2, spawnOptions) => spawn(command, args2, spawnOptions));
+    this.spawnProcess = options.spawnProcess ?? ((command, args2, spawnOptions) => spawn2(command, args2, spawnOptions));
   }
   options;
   store;
@@ -46090,7 +46237,6 @@ var AgentSessionManager = class {
     const descriptor2 = {
       clientName,
       createdAt: (/* @__PURE__ */ new Date()).toISOString(),
-      ...config2.environment || config2.env ? { environment: config2.environment ?? config2.env } : {},
       format: AGENT_SESSION_FORMAT,
       pid: 0,
       projectId: input.projectId,
@@ -46262,7 +46408,7 @@ var AgentSessionManager = class {
   }
   async closeLocalCredentialSessions(input) {
     const descriptors = (await this.store.listDescriptors()).filter(
-      (descriptor2) => descriptor2.credentialSource === "local" && descriptor2.environment === input.environment
+      (descriptor2) => descriptor2.credentialSource === "local" && descriptor2.targetKey === input.targetKey
     );
     const closed = [];
     for (const descriptor2 of descriptors) {
@@ -46346,143 +46492,16 @@ function managerError(code, message) {
   return Object.assign(new Error(message), { code });
 }
 
-// src/auth/browser-authorization.ts
-import { spawn as spawn2 } from "node:child_process";
-import { createHash as createHash6, randomBytes } from "node:crypto";
-async function runBrowserAuthorization(config2, options, dependencies = {}) {
-  const platform = dependencies.platform ?? process.platform;
-  if (!["darwin", "linux", "win32"].includes(platform)) {
-    throw authorizationError(
-      "unsupported-login-platform",
-      `Browser login is not supported on ${platform}.`
-    );
-  }
-  const pair = createPkcePair();
-  const created = await createCliAuthorization(config2, {
-    clientName: options.clientName,
-    clientVersion: options.clientVersion,
-    codeChallenge: pair.challenge,
-    platform
-  });
-  if (created.environment !== config2.environment) {
-    throw authorizationError(
-      "authorization-environment-mismatch",
-      "Account service created the authorization in a different environment."
-    );
-  }
-  let browserOpened = false;
-  if (!options.noOpen) {
-    try {
-      await (dependencies.openUrl ?? openBrowser)(created.verification_uri_complete);
-      browserOpened = true;
-    } catch {
-      browserOpened = false;
-    }
-  }
-  dependencies.onProgress?.({
-    browserOpened,
-    environment: config2.environment,
-    expiresAt: created.expires_at,
-    format: "az8.auth.login-progress.v1",
-    status: "verification_required",
-    userCode: created.user_code,
-    verificationUriComplete: created.verification_uri_complete
-  });
-  const now = dependencies.now ?? Date.now;
-  const sleep = dependencies.sleep ?? abortableSleep2;
-  let interval = created.interval;
-  while (Math.floor(now() / 1e3) < created.expires_at) {
-    await sleep(interval * 1e3, dependencies.signal);
-    assertNotAborted(dependencies.signal);
-    const exchange = await exchangeCliAuthorization(config2, {
-      codeVerifier: pair.verifier,
-      deviceCode: created.device_code
-    });
-    if (exchange.status === "completed") {
-      return {
-        token: exchange.token,
-        tokenExpiresAt: exchange.token_expires_at
-      };
-    }
-    if (exchange.status === "access_denied") {
-      throw authorizationError("authorization-denied", "Browser authorization was denied.");
-    }
-    if (exchange.status === "expired_token") {
-      throw authorizationError(
-        "authorization-expired",
-        "Browser authorization expired or was already consumed. Start a new login attempt."
-      );
-    }
-    interval = exchange.interval;
-    dependencies.onProgress?.({
-      environment: config2.environment,
-      expiresAt: exchange.expires_at,
-      format: "az8.auth.login-progress.v1",
-      interval,
-      status: exchange.status
-    });
-  }
-  throw authorizationError(
-    "authorization-expired",
-    "Browser authorization expired. Start a new login attempt."
-  );
-}
-function createPkcePair() {
-  const verifier = randomBytes(32).toString("base64url");
-  return {
-    challenge: createHash6("sha256").update(verifier).digest("base64url"),
-    verifier
-  };
-}
-async function openBrowser(url2) {
-  const [command, args2] = process.platform === "darwin" ? ["open", [url2]] : process.platform === "win32" ? ["rundll32", ["url.dll,FileProtocolHandler", url2]] : ["xdg-open", [url2]];
-  await new Promise((resolve, reject) => {
-    const child = spawn2(command, args2, { detached: true, stdio: "ignore" });
-    child.once("error", reject);
-    child.once("spawn", () => {
-      child.unref();
-      resolve();
-    });
-  });
-}
-function abortableSleep2(milliseconds, signal) {
-  return new Promise((resolve, reject) => {
-    if (signal?.aborted) {
-      reject(authorizationError("login-cancelled", "Browser login was cancelled."));
-      return;
-    }
-    const handleAbort = () => {
-      clearTimeout(timer);
-      reject(authorizationError("login-cancelled", "Browser login was cancelled."));
-    };
-    const timer = setTimeout(() => {
-      signal?.removeEventListener("abort", handleAbort);
-      resolve();
-    }, milliseconds);
-    signal?.addEventListener("abort", handleAbort, { once: true });
-  });
-}
-function assertNotAborted(signal) {
-  if (signal?.aborted) {
-    throw authorizationError("login-cancelled", "Browser login was cancelled.");
-  }
-}
-function authorizationError(code, message) {
-  return Object.assign(new Error(message), { code });
-}
-
 // package.json
 var package_default = {
   name: "@everfir/az8-cli",
-  version: "0.4.0",
+  version: "0.5.0",
   description: "Semantic Project Canvas client for AZ8 Studio agents.",
   license: "UNLICENSED",
   type: "module",
   files: [
     "dist",
-    "skills",
-    "CHANGELOG.md",
-    "RELEASE.md"
+    "skills"
   ],
   bin: {
     az8: "dist/main.js"
@@ -46546,13 +46565,7 @@ var optionalPositiveInteger = (name) => external_exports.string().regex(/^\d+$/,
 var optionalWorkflowCatalogPageSize = external_exports.string().regex(/^\d+$/, "--page-size must be an integer.").transform(Number).refine((value) => value >= 1 && value <= 50, "--page-size must be between 1 and 50.").optional();
 var optionalFiniteNumber = (name) => external_exports.string().transform(Number).refine(Number.isFinite, `${name} must be finite.`).optional();
 var configOptionsSchema = external_exports.object({
-  backendUrl: external_exports.string().optional(),
-  env: external_exports.enum(["test", "production"], { error: "--env must be test or production." }).optional(),
-  envFile: external_exports.string().optional(),
-  environment: external_exports.enum(["test", "production"], {
-    error: "--environment must be test or production."
-  }).optional(),
-  serviceUrl: external_exports.string().optional()
+  envFile: external_exports.string().optional()
 });
 var guideOptionsSchema = external_exports.object({
   format: external_exports.enum(["markdown", "json"], { error: "Unknown guide format. Expected markdown or json." }).default("markdown"),
@@ -46668,11 +46681,7 @@ var agentSessionInputOptionsSchema = inputSourceOptionsSchema.and(
 function readConfigOptions(command) {
   const options = command.optsWithGlobals();
   return parseCliOptions(configOptionsSchema, {
-    backendUrl: options.backendUrl,
-    env: options.env,
-    envFile: options.envFile,
-    environment: options.environment,
-    serviceUrl: options.serviceUrl
+    envFile: options.envFile
   });
 }
 
@@ -46714,17 +46723,18 @@ function registerAuthCommands(program2, dependencies, setResult) {
         }
       });
       const store = createLocalCredentialStore(dependencies);
-      const previous = await store.read(service.environment);
+      const previous = await store.read(service.targetKey);
       const account = storedAccount(profile);
       let closedSessions = 0;
       if (!previous || previous.account.accountId !== account.accountId) {
         const manager = dependencies.sessionManager ?? new AgentSessionManager({ cwd: dependencies.cwd, env: dependencies.env });
-        closedSessions = (await manager.closeLocalCredentialSessions({ environment: service.environment })).length;
+        closedSessions = (await manager.closeLocalCredentialSessions({ targetKey: service.targetKey })).length;
       }
       await store.write({
         account,
-        environment: service.environment,
+        baseUrl: service.baseUrl,
         format: LOCAL_CREDENTIAL_FORMAT,
+        targetKey: service.targetKey,
         token: issuedToken,
         ...issuedTokenExpiresAt === void 0 ? {} : { tokenExpiresAt: issuedTokenExpiresAt },
         updatedAt: new Date((dependencies.now ?? Date.now)()).toISOString()
@@ -46738,9 +46748,9 @@ function registerAuthCommands(program2, dependencies, setResult) {
             persisted: true,
             source: "local"
           },
-          environment: service.environment,
-          format: "az8.auth.login.v1",
+          format: "az8.auth.login.v2",
           operation: "login",
+          service: { baseUrl: service.baseUrl },
           sessionsClosed: closedSessions
         })
       );
@@ -46762,37 +46772,44 @@ function registerAuthCommands(program2, dependencies, setResult) {
             persisted: config2.credentials.metadata?.persisted ?? false,
             source: config2.credentials.metadata?.source ?? "unknown"
           },
-          environment: config2.environment,
-          format: "az8.auth.whoami.v1",
-          operation: "whoami"
+          format: "az8.auth.whoami.v2",
+          operation: "whoami",
+          service: { baseUrl: config2.baseUrl }
         })
       );
     } catch (error51) {
       setResult(errorResult(safeErrorMessage(error51)));
     }
   });
-  program2.command("logout").description("Remove locally stored account credentials").option("--all", "Remove test and production local credentials").action(async (rawOptions, command) => {
+  program2.command("logout").description("Remove locally stored account credentials").option("--all", "Remove all locally stored account credentials").action(async (rawOptions, command) => {
     try {
       const options = parseCliOptions(logoutOptionsSchema, rawOptions);
       const configOptions = readConfigOptions(command);
-      const selected = (await resolveCliServiceConfig(configOptions, dependencies)).environment;
-      const environments = options.all ? ["test", "production"] : [selected];
+      const selected = await resolveCliServiceConfig(configOptions, dependencies);
       const store = createLocalCredentialStore(dependencies);
       const manager = dependencies.sessionManager ?? new AgentSessionManager({ cwd: dependencies.cwd, env: dependencies.env });
+      const targets = options.all ? await store.list() : [
+        {
+          baseUrl: selected.baseUrl,
+          targetKey: selected.targetKey
+        }
+      ];
       const results = [];
-      for (const environment of environments) {
-        const sessions = await manager.closeLocalCredentialSessions({ environment });
+      for (const target of targets) {
+        const sessions = await manager.closeLocalCredentialSessions({
+          targetKey: target.targetKey
+        });
         results.push({
-          environment,
-          removed: await store.delete(environment),
+          removed: await store.delete(target.targetKey),
+          service: { baseUrl: target.baseUrl },
           sessionsClosed: sessions.length
         });
       }
       setResult(
         jsonResult({
-          environments: results,
-          format: "az8.auth.logout.v1",
-          operation: "logout"
+          format: "az8.auth.logout.v2",
+          operation: "logout",
+          targets: results
         })
       );
     } catch (error51) {
@@ -46802,7 +46819,7 @@ function registerAuthCommands(program2, dependencies, setResult) {
 }
 async function updateStoredProfile(config2, profile, dependencies) {
   const store = createLocalCredentialStore(dependencies);
-  const current = await store.read(config2.environment);
+  const current = await store.read(config2.targetKey);
   if (!current) return;
   const next = {
     ...current,
@@ -47478,7 +47495,7 @@ function readSessionOption(command) {
 }
 function sessionDocument(operation, descriptor2) {
   return {
-    format: "az8.agent-session.lifecycle.v1",
+    format: "az8.agent-session.lifecycle.v2",
     operation,
     session: publicDescriptor(descriptor2)
   };
@@ -47487,11 +47504,11 @@ function publicDescriptor(descriptor2) {
   return {
     clientName: descriptor2.clientName,
     createdAt: descriptor2.createdAt,
-    ...descriptor2.environment ? { environment: descriptor2.environment } : {},
     ...descriptor2.error ? { error: descriptor2.error } : {},
     pid: descriptor2.pid,
     projectId: descriptor2.projectId,
     sessionId: descriptor2.sessionId,
+    ...descriptor2.baseUrl ? { service: { baseUrl: descriptor2.baseUrl } } : {},
     state: descriptor2.state
   };
 }
@@ -47571,12 +47588,7 @@ function findCommand(program2, commandNames) {
   return current;
 }
 function addCommonOptions(program2) {
-  program2.addOption(
-    new Option(
-      "--environment <environment>",
-      "Select test or production API environment"
-    ).helpGroup("Global options:")
-  ).addOption(new Option("--env <environment>", "Alias for --environment").hideHelp()).option("--backend-url <url>", "Override the backend API base URL").option("--service-url <url>", "Override the account service API base URL").option("--env-file <path>", "Load credentials and environment from a file");
+  program2.option("--env-file <path>", "Load credentials from a file");
 }
 
 // src/cli/run.ts
@@ -47634,6 +47646,7 @@ process.once("SIGINT", abortOnSignal);
 process.once("SIGTERM", abortOnSignal);
 try {
   const result3 = await runAz8Cli(process.argv.slice(2), {
+    openUrl: openSystemBrowser,
     onAuthProgress(progress) {
       process.stderr.write(`${JSON.stringify(progress)}
 `);