@sequenceholdings/studio-cli 0.1.9 → 0.1.10

package/README.md

@@ -43,16 +43,17 @@ releases install immediately.)
 
 ## Authenticate
 
-`seq-studio` is a **read-only consumer of seqapi tokens** — it does not
-have its own login flow. Run `seqapi login` once to mint tokens at
-`~/.config/sequence-api/tokens.json`; `seqapi`, `seq-studio process`, and
-`seq-studio artifact` all share that file.
+Run the built-in browser login once. `seq-studio` and `seqapi` share the
+resulting tokens at `~/.config/sequence-api/tokens.json`, so logging in with
+either CLI authenticates both.
 
 ```bash
-seqapi login
+seq-studio login
 seq-studio doctor   # confirms config + auth + authorization
 ```
 
+Use `seq-studio logout` to remove the shared cached tokens.
+
 ### Headless auth (CI) — M2M
 
 When there's no interactive login (CI, automation), set the service-account
@@ -206,12 +207,12 @@ seq-studio repos clone artifacts/ai-fluency -e staging
 You can also open **Repositories → Access tokens** / the clone popover’s
 **Manage tokens** link.
 
-### Sequence staff — CLI mint (optional)
+### CLI mint (optional)
 
-Requires `seqapi login` (Auth0). Same tokens as the UI:
+Requires Auth0 login. Same identity as the UI:
 
 ```bash
-seqapi login
+seq-studio login
 seq-studio auth pat create --name laptop --scopes repo:read,repo:write -e staging
 # optional: --expires 7d|30d|90d|1y|never  (default 30d)
 # optional: --store-credentials   # git credential approve for the env host

package/dist/artifact/delegate.js

@@ -48,9 +48,32 @@ const ARTIFACT_USAGE = `usage:
   Preview deploys sit behind a Cloudflare WAF gate. Off the company network/VPN,
   set PREVIEW_ACCESS_HEADER=<secret> and the CLI sends it as x-preview-access.
 
-  Authenticate with: seqapi login
+  Authenticate with: seq-studio login
 `;
 export async function runArtifactCommand(sub, rest) {
+    // Older artifact-studio versions exposed nested login/logout commands backed
+    // by a separate token file. Keep those commands working, but route them to
+    // seq-studio's shared token so every namespace uses the same identity.
+    if (sub === 'login' || sub === 'logout') {
+        if (rest.length > 0) {
+            if (sub === 'login' && rest.includes('--token')) {
+                // The legacy `artifact login --token <jwt>` persisted a bearer to
+                // artifact-studio's own token file — a store this unification retires.
+                console.error('seq-studio artifact login no longer stores a bearer token.\n' +
+                    'Scripted/headless options:\n' +
+                    '  - pass --token <jwt> directly to the artifact command (deploy/plan/whoami/...)\n' +
+                    '  - export ARTIFACT_STUDIO_TOKEN=<jwt> for the session\n' +
+                    '  - set AUTH0_M2M_CLIENT_SECRET for service-account (M2M) auth in CI');
+            }
+            else {
+                console.error(`seq-studio artifact ${sub} does not accept arguments.`);
+            }
+            return 1;
+        }
+        const auth = await import('../login.js');
+        await auth[sub]();
+        return 0;
+    }
     if (!sub || sub === 'help' || sub === '--help' || sub === '-h') {
         console.log(ARTIFACT_USAGE);
         return sub ? 0 : 1;
@@ -96,40 +119,49 @@ export async function runArtifactCommand(sub, rest) {
         if (isPreviewUrl(resolved.url))
             applyPreviewAccessHeader();
     }
-    // Share the seqapi token. `tryGetAccessToken` resolves an M2M
-    // service-account token when AUTH0_M2M_CLIENT_SECRET is set (headless /
-    // CI / cloud-agent path) and otherwise the cached `seqapi login` user
-    // token (see ../auth.ts). If neither is available, artifact-studio
-    // commands that need a token surface their own error — we don't force
-    // `seqapi login` here because some commands (init, validate, build) work
-    // offline. Manual escape hatch: pass `--token <jwt>` (artifact-studio's
-    // CLI accepts it and it wins over everything).
-    const token = await tryGetAccessToken({ failClosedForM2m: true });
-    if (token) {
-        process.env['ARTIFACT_STUDIO_TOKEN'] = token;
-    }
+    // An explicit `--token <jwt>` is the manual escape hatch and must win over
+    // everything, including a configured-but-failing M2M credential (which
+    // `tryGetAccessToken({ failClosedForM2m: true })` would otherwise turn into
+    // an abort before argv ever reaches artifact-studio). artifact-studio's
+    // `getOptionalToken` checks `flags.token` first, so when it's present we
+    // skip shared-token resolution entirely. Only the two-token `--token <jwt>`
+    // form counts: artifact-studio's parser does not split `--token=<jwt>`.
+    const hasExplicitToken = hasTokenFlag(argvForCli);
     // Lazy import so `process` / `doctor` commands don't pull in
     // artifact-studio's vite/react/tailwind dependency graph.
     const { runCli: runArtifactStudio, setTokenProvider } = await import('@sequenceholdings/artifact-studio/cli');
-    // The ARTIFACT_STUDIO_TOKEN env var above is captured once and never
-    // refreshes, so long-running commands (notably `artifact dev`) would start
-    // failing with "Authentication failed" once the initial token's TTL elapses.
-    // Hand artifact-studio a refreshing source — getAccessToken() mints a fresh
-    // access token via the Auth0 refresh grant when the cached one is near
-    // expiry — so a watch session survives indefinitely.
-    setTokenProvider(async () => {
-        if (process.env.AUTH0_M2M_CLIENT_SECRET?.trim()) {
-            // Fail closed for configured M2M failures so headless deploys never
-            // silently fall back to another cached identity.
-            return await getAccessToken();
-        }
-        try {
-            return await getAccessToken();
+    if (!hasExplicitToken) {
+        // Share the seqapi token. `tryGetAccessToken` resolves an M2M
+        // service-account token when AUTH0_M2M_CLIENT_SECRET is set (headless /
+        // CI / cloud-agent path) and otherwise the cached interactive user
+        // token (see ../auth.ts). If neither is available, artifact-studio
+        // commands that need a token surface their own error — we don't force
+        // `seq-studio login` here because some commands (init, validate, build)
+        // work offline.
+        const token = await tryGetAccessToken({ failClosedForM2m: true });
+        if (token) {
+            process.env['ARTIFACT_STUDIO_TOKEN'] = token;
         }
-        catch {
-            return null;
-        }
-    });
+        // The ARTIFACT_STUDIO_TOKEN env var above is captured once and never
+        // refreshes, so long-running commands (notably `artifact dev`) would start
+        // failing with "Authentication failed" once the initial token's TTL
+        // elapses. Hand artifact-studio a refreshing source — getAccessToken()
+        // mints a fresh access token via the Auth0 refresh grant when the cached
+        // one is near expiry — so a watch session survives indefinitely.
+        setTokenProvider(async () => {
+            if (process.env.AUTH0_M2M_CLIENT_SECRET?.trim()) {
+                // Fail closed for configured M2M failures so headless deploys never
+                // silently fall back to another cached identity.
+                return await getAccessToken();
+            }
+            try {
+                return await getAccessToken();
+            }
+            catch {
+                return null;
+            }
+        });
+    }
     return runArtifactStudio([sub, ...argvForCli]);
 }
 /**
@@ -167,6 +199,18 @@ export function extractPreviewFlags(argv) {
     }
     return { rest, prNumber, envUrl };
 }
+/**
+ * True when argv carries an explicit two-token `--token <jwt>` that
+ * artifact-studio's parser will bind to `flags.token`. `--token=<jwt>` is
+ * excluded because that parser stores it as a stray flag and never binds it.
+ */
+function hasTokenFlag(argv) {
+    const index = argv.indexOf('--token');
+    if (index === -1)
+        return false;
+    const value = argv[index + 1];
+    return value !== undefined && !value.startsWith('--');
+}
 function splitInlineValue(arg) {
     const eq = arg.indexOf('=');
     if (arg.startsWith('--') && eq !== -1)

package/dist/auth-cmds/commands.d.ts

@@ -1,7 +1,7 @@
 import type { ParsedArgs } from '../process/commands.js';
 declare const PAT_SCOPES: readonly ["repo:read", "repo:write", "repo:admin"];
 type PatScope = (typeof PAT_SCOPES)[number];
-export declare const AUTH_USAGE = "usage:\n  seq-studio auth pat create --name <n> [--scopes repo:read,repo:write] [-e env]\n                             [--expires 7d|30d|90d|1y|never] [--store-credentials]\n  seq-studio auth pat list [-e env]\n  seq-studio auth pat revoke <id> [-e env] [--yes]\n\n  Issue a personal access token for git clone / git push against the platform\n  git service.\n\n  Most users (no seqapi): open Atlas \u2192 Settings \u2192 Tokens, or:\n    https://<atlas-host>/settings/tokens\n  Sign in, create a token (repo:read / repo:write), copy once, then:\n    export ATLAS_GIT_PAT=<token>\n\n  Sequence staff: `seqapi login` then `auth pat create` (same Auth0 session\n  as the Atlas UI). The CLI cannot mint a PAT without that login.\n\n  On create the raw token is printed ONCE \u2014 store it; Atlas cannot re-show it.\n  Git Basic auth: any username (e.g. git), PAT as the password.\n\n  Flags: -e/--env <local|staging|production|banksouth>\n";
+export declare const AUTH_USAGE = "usage:\n  seq-studio auth pat create --name <n> [--scopes repo:read,repo:write] [-e env]\n                             [--expires 7d|30d|90d|1y|never] [--store-credentials]\n  seq-studio auth pat list [-e env]\n  seq-studio auth pat revoke <id> [-e env] [--yes]\n\n  Issue a personal access token for git clone / git push against the platform\n  git service.\n\n  Authenticate with `seq-studio login`, then run `auth pat create`.\n  Alternatively, open Atlas \u2192 Settings \u2192 Tokens:\n    https://<atlas-host>/settings/tokens\n  Sign in, create a token (repo:read / repo:write), copy once, then:\n    export ATLAS_GIT_PAT=<token>\n\n  On create the raw token is printed ONCE \u2014 store it; Atlas cannot re-show it.\n  Git Basic auth: any username (e.g. git), PAT as the password.\n\n  Flags: -e/--env <local|staging|production|banksouth>\n";
 export declare function parsePatScopes(raw: string | undefined): PatScope[];
 /**
  * Map UI-style duration choices to an absolute ISO-8601 expiresAt, or undefined

package/dist/auth-cmds/commands.js

@@ -1,10 +1,9 @@
 /**
  * `seq-studio auth <sub>` — PAT management for the platform git service.
  *
- * Issues / lists / revokes Personal Access Tokens via Auth0 bearer auth
- * (`seqapi login` — Sequence staff). Third-party / OpCo developers without
- * seqapi should mint tokens in the Atlas UI at `/settings/tokens` instead;
- * help text and error hints lead with that path.
+ * Issues / lists / revokes Personal Access Tokens via Auth0 bearer auth.
+ * Users authenticate with `seq-studio login`; the Atlas UI at
+ * `/settings/tokens` remains an alternative.
  *
  * The raw token is printed exactly once on create; use it as the Basic-auth
  * password for `git clone` / `git push` (username is ignored).
@@ -33,14 +32,12 @@ export const AUTH_USAGE = `usage:
   Issue a personal access token for git clone / git push against the platform
   git service.
 
-  Most users (no seqapi): open Atlas → Settings → Tokens, or:
+  Authenticate with \`seq-studio login\`, then run \`auth pat create\`.
+  Alternatively, open Atlas → Settings → Tokens:
     https://<atlas-host>/settings/tokens
   Sign in, create a token (repo:read / repo:write), copy once, then:
     export ATLAS_GIT_PAT=<token>
 
-  Sequence staff: \`seqapi login\` then \`auth pat create\` (same Auth0 session
-  as the Atlas UI). The CLI cannot mint a PAT without that login.
-
   On create the raw token is printed ONCE — store it; Atlas cannot re-show it.
   Git Basic auth: any username (e.g. git), PAT as the password.
 
@@ -55,15 +52,15 @@ async function authContext(args) {
     }
     catch (err) {
         const message = err instanceof Error ? err.message : String(err);
-        // Prefer the Atlas UI path — third-party / OpCo developers do not have seqapi.
-        // buildContext failed before we know the env URL; point at the common hosts.
+        // buildContext failed before we know the env URL; offer CLI login and point
+        // at the common Atlas hosts as an alternative.
         throw new Error(`${message}\n` +
-            `  No seqapi? Mint a PAT in the Atlas UI (Settings → Tokens), then:\n` +
+            `  Run \`seq-studio login\`, then retry \`auth pat create\`.\n` +
+            `  Or mint a PAT in the Atlas UI (Settings → Tokens), then:\n` +
             `    export ATLAS_GIT_PAT=<token>\n` +
             `  Staging: https://staging.atlas.seqholdings.com/settings/tokens\n` +
             `  Production: https://atlas.seqholdings.com/settings/tokens\n` +
-            `  BankSouth: https://banksouth.seqholdings.com/settings/tokens\n` +
-            `  Sequence staff: run \`seqapi login\`, then retry \`auth pat create\`.`);
+            `  BankSouth: https://banksouth.seqholdings.com/settings/tokens`);
     }
 }
 export function parsePatScopes(raw) {

package/dist/auth.d.ts

@@ -1,3 +1,31 @@
+/**
+ * seq-studio and seqapi share one token file and one Auth0 application:
+ * same tenant, client id, audience, and token shape. Either CLI can log in,
+ * and the resulting access token validates against every Atlas /api/* route.
+ *
+ * Two token sources, in the SAME precedence order as seqapi's
+ * `get_access_token` (`shared/seqapi/seqapi/auth.py`):
+ *   1. M2M service account — Auth0 client-credentials grant, used when
+ *      `AUTH0_M2M_CLIENT_SECRET` is set. This is the headless path: CI /
+ *      cloud agents with no interactive login can still push.
+ *      (M2M carries app scopes but NO user identity / workspace membership
+ *      — see the `atlas-test-access` rule.)
+ *   2. Cached user token — read from the seqapi token file and refreshed
+ *      via the Auth0 refresh-token grant when near expiry.
+ *
+ * Login and refresh both write the shared file. This mirrors
+ * `seqapi._save_tokens` exactly:
+ * same fields, same shape, same 0o600 permissions, atomic write via
+ * tmpfile + rename. The M2M token is in-memory only (never persisted).
+ */
+export declare const AUTH0_DOMAIN = "dev-n1t8ts403fp8oyxp.us.auth0.com";
+export declare const AUTH0_CLIENT_ID = "GD9riCDWocfc66odpWBjwBiX43qqAX8r";
+export declare const AUTH0_AUDIENCE = "https://api.studio.com";
+export interface SeqapiTokens {
+    refresh_token?: string;
+    access_token?: string;
+    expires_at?: number;
+}
 export declare function seqapiTokenDir(): string;
 export declare function seqapiTokenPath(): string;
 export declare class NotLoggedInError extends Error {
@@ -24,3 +52,4 @@ export declare function tryGetAccessToken(options?: {
      */
     failClosedForM2m?: boolean;
 }): Promise<string | null>;
+export declare function saveTokens(tokens: SeqapiTokens): Promise<void>;

package/dist/auth.js

@@ -1,36 +1,33 @@
-import { mkdir, readFile, writeFile } from 'node:fs/promises';
+import { chmod, mkdir, readFile, rename, writeFile } from 'node:fs/promises';
 import { existsSync } from 'node:fs';
 import { homedir } from 'node:os';
 import { dirname, join } from 'node:path';
 /**
- * seq-studio is a read-only consumer of the seqapi token file. Tokens
- * are written by `seqapi login` (Python, in `shared/seqapi/seqapi/auth.py`)
- * and shared between every Sequence CLI: same Auth0 tenant, same client
- * id, same audience — so the same access token validates against every
- * Atlas /api/* route.
+ * seq-studio and seqapi share one token file and one Auth0 application:
+ * same tenant, client id, audience, and token shape. Either CLI can log in,
+ * and the resulting access token validates against every Atlas /api/* route.
  *
  * Two token sources, in the SAME precedence order as seqapi's
  * `get_access_token` (`shared/seqapi/seqapi/auth.py`):
  *   1. M2M service account — Auth0 client-credentials grant, used when
  *      `AUTH0_M2M_CLIENT_SECRET` is set. This is the headless path: CI /
- *      cloud agents with no interactive `seqapi login` can still push.
+ *      cloud agents with no interactive login can still push.
  *      (M2M carries app scopes but NO user identity / workspace membership
  *      — see the `atlas-test-access` rule.)
  *   2. Cached user token — read from the seqapi token file and refreshed
  *      via the Auth0 refresh-token grant when near expiry.
  *
- * Refresh is the only write path: when the cached access token is
- * expired and we have a refresh token, we hit Auth0 and update the file
- * with the rotated tokens. This mirrors `seqapi._save_tokens` exactly:
+ * Login and refresh both write the shared file. This mirrors
+ * `seqapi._save_tokens` exactly:
  * same fields, same shape, same 0o600 permissions, atomic write via
  * tmpfile + rename. The M2M token is in-memory only (never persisted).
  */
 // Match `shared/seqapi/seqapi/config.py`. Hard-coded because the seqapi
 // CLI also hard-codes them — there's a single Sequence Auth0 tenant for
 // all Sequence CLIs.
-const AUTH0_DOMAIN = 'dev-n1t8ts403fp8oyxp.us.auth0.com';
-const AUTH0_CLIENT_ID = 'GD9riCDWocfc66odpWBjwBiX43qqAX8r';
-const AUTH0_AUDIENCE = 'https://api.studio.com';
+export const AUTH0_DOMAIN = 'dev-n1t8ts403fp8oyxp.us.auth0.com';
+export const AUTH0_CLIENT_ID = 'GD9riCDWocfc66odpWBjwBiX43qqAX8r';
+export const AUTH0_AUDIENCE = 'https://api.studio.com';
 const AUTH0_M2M_CLIENT_ID = '5TLffZqvLq4ztLDjZhwKVJCpB5VNrWj0';
 // In-memory cache for the M2M token (seconds-based, mirrors seqapi's
 // `_m2m_cache`). Reused while > 60s from expiry to avoid re-minting on every
@@ -81,8 +78,7 @@ export function seqapiTokenPath() {
 export class NotLoggedInError extends Error {
     name = 'NotLoggedInError';
     constructor() {
-        super('Not logged in. Run: seqapi login\n' +
-            'seq-studio does not have its own login flow — it shares tokens with seqapi.\n' +
+        super('Not logged in. Run: seq-studio login\n' +
             'For headless contexts (CI / cloud agents), set AUTH0_M2M_CLIENT_SECRET for ' +
             'service-account (M2M) access instead.');
     }
@@ -117,7 +113,7 @@ export async function getAccessToken() {
         }),
     });
     if (response.status === 401 || response.status === 403) {
-        throw new Error('Refresh token expired or revoked. Re-authenticate with: seqapi login');
+        throw new Error('Refresh token expired or revoked. Re-authenticate with: seq-studio login');
     }
     if (!response.ok) {
         throw new Error(`Auth0 token refresh failed (${response.status}): ${await response.text()}`);
@@ -161,11 +157,14 @@ async function loadTokens() {
         return null;
     }
 }
-async function saveTokens(tokens) {
+export async function saveTokens(tokens) {
     const path = seqapiTokenPath();
     await mkdir(dirname(path), { recursive: true });
     // Mirror seqapi's atomic-write pattern: write to tmpfile then rename.
     const tmp = path + '.tmp';
     await writeFile(tmp, JSON.stringify(tokens, null, 2), { encoding: 'utf8', mode: 0o600 });
-    await import('node:fs/promises').then((fs) => fs.rename(tmp, path));
+    // writeFile's mode only applies when creating a file. Reset it explicitly in
+    // case a prior interrupted login left a permissive tmp file behind.
+    await chmod(tmp, 0o600);
+    await rename(tmp, path);
 }

package/dist/cli-errors.js

@@ -37,7 +37,7 @@ export function clarifyApplyFailureReason(reason) {
 function nextStepForAtlasError(error) {
     const msg = error.message.toLowerCase();
     if (error.status === 401) {
-        return 'Next step: run `seqapi login` and retry.';
+        return 'Next step: run `seq-studio login` and retry.';
     }
     if (error.status === 403) {
         return 'Next step: confirm `-e` targets the right environment and you have the required access grant.';

package/dist/functions/commands.d.ts

@@ -82,5 +82,5 @@ export declare function functionsRollbackCommand(args: ParsedArgs): Promise<numb
 /** Minimal dotenv parser — KEY=VALUE lines, quotes stripped, comments skipped. */
 export declare function parseDotenv(content: string): Record<string, string>;
 export declare function functionsDeleteCommand(args: ParsedArgs): Promise<number>;
-export declare const FUNCTIONS_USAGE = "usage:\n  seq-studio functions init <dir>                     scaffold manifest + TypeScript hello-world handler\n  seq-studio functions build [--dir d]                local pre-flight (manifest, lockfile, size)\n  seq-studio functions deploy [-e env] [-m msg]       preview + confirm secrets + upload and deploy\n  seq-studio functions list [-e env] [--match-local]  functions visible on the environment\n  seq-studio functions show [-e env] [--fn slug]      detail for one function (versions, secrets)\n  seq-studio functions logs [-e env] [--limit N] [--since t]  Cloud Logging snapshot (reader-gated)\n  seq-studio functions promote <version> [-e env]     make a version live\n  seq-studio functions rollback [<version>] [-e env]  redeploy a prior version\n  seq-studio functions delete [--yes]                 archive function + tear down GCP resources\n                                                      (version history is retained)\n\n  Flags: -e/--env <local|staging|production|banksouth|preview:<slug>> \u00B7 --fn <slug> \u00B7 --dir <path>\n         --from-env-file <path>  (default: .env) source file for secret values\n         --no-wait \u00B7 --yes\n         --no-provision  (deploy) update-only: error instead of registering a new\n                         shell, writing secret values, or attaching secrets (CI sweep)\n\n  Source for build/deploy: a local --dir (default .), a platform git-service\n  repo (--repo <ns>/<name>), or any git URL (--git-url <url>). --ref selects a\n  branch/tag/commit (default: the repo's default branch). Remote sources record\n  the pinned commit as provenance (never dirty) and NEVER read a repo-committed\n  .env for secret values \u2014 provision secrets server-side or pass a local\n  --from-env-file (resolved against your cwd).\n\n  --repo clones over smart-HTTP and REQUIRES a git PAT in ATLAS_GIT_PAT\n  (repo:read scope \u2014 `seq-studio auth pat create --scopes repo:read`, or\n  Atlas \u2192 Settings \u2192 Tokens). It's the same token you clone the repo with;\n  --env + seqapi login are still needed to resolve the repo and deploy.\n";
+export declare const FUNCTIONS_USAGE = "usage:\n  seq-studio functions init <dir>                     scaffold manifest + TypeScript hello-world handler\n  seq-studio functions build [--dir d]                local pre-flight (manifest, lockfile, size)\n  seq-studio functions deploy [-e env] [-m msg]       preview + confirm secrets + upload and deploy\n  seq-studio functions list [-e env] [--match-local]  functions visible on the environment\n  seq-studio functions show [-e env] [--fn slug]      detail for one function (versions, secrets)\n  seq-studio functions logs [-e env] [--limit N] [--since t]  Cloud Logging snapshot (reader-gated)\n  seq-studio functions promote <version> [-e env]     make a version live\n  seq-studio functions rollback [<version>] [-e env]  redeploy a prior version\n  seq-studio functions delete [--yes]                 archive function + tear down GCP resources\n                                                      (version history is retained)\n\n  Flags: -e/--env <local|staging|production|banksouth|preview:<slug>> \u00B7 --fn <slug> \u00B7 --dir <path>\n         --from-env-file <path>  (default: .env) source file for secret values\n         --no-wait \u00B7 --yes\n         --no-provision  (deploy) update-only: error instead of registering a new\n                         shell, writing secret values, or attaching secrets (CI sweep)\n\n  Source for build/deploy: a local --dir (default .), a platform git-service\n  repo (--repo <ns>/<name>), or any git URL (--git-url <url>). --ref selects a\n  branch/tag/commit (default: the repo's default branch). Remote sources record\n  the pinned commit as provenance (never dirty) and NEVER read a repo-committed\n  .env for secret values \u2014 provision secrets server-side or pass a local\n  --from-env-file (resolved against your cwd).\n\n  --repo clones over smart-HTTP and REQUIRES a git PAT in ATLAS_GIT_PAT\n  (repo:read scope \u2014 `seq-studio auth pat create --scopes repo:read`, or\n  Atlas \u2192 Settings \u2192 Tokens). It's the same token you clone the repo with;\n  --env + seq-studio login are still needed to resolve the repo and deploy.\n";
 export declare function runFunctionsCommand(sub: string | undefined, args: ParsedArgs): Promise<number>;

package/dist/functions/commands.js

@@ -544,7 +544,8 @@ async function deployFromResolvedSource({ args, spec, ctx: earlyCtx, source, })
         const problems = [];
         if (!existingShell) {
             problems.push(`function "${slug}" is not registered on ${ctx.env.name} — run ` +
-                `\`seq-studio functions deploy -e ${ctx.env.name}\` once with your own login (seqapi login) to register it`);
+                `\`seq-studio functions deploy -e ${ctx.env.name}\` once with your own login (` +
+                `\`seq-studio login\`) to register it`);
         }
         for (const c of classification?.secrets ?? []) {
             if (c.category === 'UPLOAD_NEW' || c.category === 'OVERWRITE') {
@@ -957,7 +958,7 @@ export const FUNCTIONS_USAGE = `usage:
   --repo clones over smart-HTTP and REQUIRES a git PAT in ATLAS_GIT_PAT
   (repo:read scope — \`seq-studio auth pat create --scopes repo:read\`, or
   Atlas → Settings → Tokens). It's the same token you clone the repo with;
-  --env + seqapi login are still needed to resolve the repo and deploy.
+  --env + seq-studio login are still needed to resolve the repo and deploy.
 `;
 export async function runFunctionsCommand(sub, args) {
     try {

package/dist/login.d.ts

@@ -0,0 +1,12 @@
+interface LoginOptions {
+    port?: number;
+    timeoutMs?: number;
+    fetchImpl?: typeof fetch;
+    now?: () => number;
+    openBrowser?: (authorizationUrl: string) => void | Promise<void>;
+}
+export declare function openSystemBrowser(authorizationUrl: string): Promise<void>;
+export declare function loginWithPkce({ fetchImpl, now, openBrowser, port, timeoutMs, }: LoginOptions): Promise<void>;
+export declare function login(): Promise<void>;
+export declare function logout(): Promise<void>;
+export {};

package/dist/login.js

@@ -0,0 +1,213 @@
+import { createHash, randomBytes } from 'node:crypto';
+import { rm } from 'node:fs/promises';
+import { createServer } from 'node:http';
+import { spawn } from 'node:child_process';
+import { homedir } from 'node:os';
+import { join } from 'node:path';
+import { AUTH0_AUDIENCE, AUTH0_CLIENT_ID, AUTH0_DOMAIN, saveTokens, seqapiTokenPath, } from './auth.js';
+const DEFAULT_REDIRECT_PORT = 5099;
+const DEFAULT_LOGIN_TIMEOUT_MS = 300_000;
+function base64Url(input) {
+    return input.toString('base64url');
+}
+function configuredPort() {
+    const raw = process.env.SEQAPI_PORT?.trim();
+    if (!raw)
+        return DEFAULT_REDIRECT_PORT;
+    const port = Number(raw);
+    if (!Number.isInteger(port) || port < 1 || port > 65_535) {
+        throw new Error(`SEQAPI_PORT must be an integer from 1 to 65535 (got "${raw}").`);
+    }
+    return port;
+}
+function authorizationUrl({ challenge, redirectUri, state, }) {
+    const url = new URL(`https://${AUTH0_DOMAIN}/authorize`);
+    url.searchParams.set('response_type', 'code');
+    url.searchParams.set('client_id', AUTH0_CLIENT_ID);
+    url.searchParams.set('redirect_uri', redirectUri);
+    url.searchParams.set('scope', 'openid profile email offline_access');
+    url.searchParams.set('audience', AUTH0_AUDIENCE);
+    url.searchParams.set('code_challenge', challenge);
+    url.searchParams.set('code_challenge_method', 'S256');
+    url.searchParams.set('state', state);
+    return url.toString();
+}
+export async function openSystemBrowser(authorizationUrl) {
+    const windows = process.platform === 'win32';
+    const command = process.platform === 'darwin' ? 'open' : windows ? 'cmd' : 'xdg-open';
+    // On Windows the URL must be quoted manually (with verbatim arguments so
+    // Node does not re-escape): cmd otherwise splits the unquoted URL on `&`,
+    // truncating the query string and executing the tail as commands. The empty
+    // `""` is `start`'s window-title slot — without it, start would treat the
+    // quoted URL as the title.
+    const args = windows
+        ? ['/c', 'start', '""', `"${authorizationUrl}"`]
+        : [authorizationUrl];
+    const child = spawn(command, args, {
+        stdio: 'ignore',
+        detached: true,
+        ...(windows ? { windowsVerbatimArguments: true } : {}),
+    });
+    await new Promise((resolve, reject) => {
+        child.once('spawn', resolve);
+        child.once('error', reject);
+    });
+    child.unref();
+}
+function callbackPort(server) {
+    const address = server.address();
+    if (!address || typeof address === 'string') {
+        throw new Error('Auth0 callback server did not expose a TCP port.');
+    }
+    return address.port;
+}
+function sendHtml({ body, response, status, }) {
+    response.writeHead(status, { 'content-type': 'text/html; charset=utf-8' });
+    response.end(body);
+}
+function waitForAuthorizationCode({ expectedState, onListening, port, timeoutMs, }) {
+    return new Promise((resolve, reject) => {
+        let redirectUri = '';
+        let settled = false;
+        let timer;
+        const finish = ({ code, error }) => {
+            if (settled)
+                return;
+            settled = true;
+            clearTimeout(timer);
+            server.close();
+            if (error)
+                reject(error);
+            else if (code)
+                resolve({ code, redirectUri });
+            else
+                reject(new Error('Auth0 callback completed without an authorization code.'));
+        };
+        const server = createServer((request, response) => {
+            const url = new URL(request.url ?? '/', redirectUri);
+            const code = url.searchParams.get('code');
+            const authError = url.searchParams.get('error');
+            if (!code && !authError) {
+                response.writeHead(204);
+                response.end();
+                return;
+            }
+            if (url.searchParams.get('state') !== expectedState) {
+                sendHtml({
+                    body: '<h1>Sequence login failed</h1><p>Authorization state mismatch.</p>',
+                    response,
+                    status: 400,
+                });
+                finish({ error: new Error('Auth0 callback state mismatch.') });
+                return;
+            }
+            if (authError) {
+                const description = url.searchParams.get('error_description') ?? authError;
+                sendHtml({
+                    body: '<h1>Sequence login failed</h1><p>Return to the terminal for details.</p>',
+                    response,
+                    status: 400,
+                });
+                finish({ error: new Error(`Auth0 login failed: ${description}`) });
+                return;
+            }
+            sendHtml({
+                body: '<h1>Sequence login complete</h1><p>You may close this tab.</p>',
+                response,
+                status: 200,
+            });
+            finish({ code: code ?? undefined });
+        });
+        server.once('error', (error) => {
+            const message = error.code === 'EADDRINUSE'
+                ? `Port ${port} is in use. Stop the process using it, or set SEQAPI_PORT to a registered Auth0 callback port.`
+                : `Could not start the Auth0 callback server: ${error.message}`;
+            finish({ error: new Error(message) });
+        });
+        server.listen(port, 'localhost', () => {
+            redirectUri = `http://localhost:${callbackPort(server)}`;
+            onListening(redirectUri);
+        });
+        timer = setTimeout(() => {
+            finish({
+                error: new Error(`Login timed out after ${Math.ceil(timeoutMs / 1_000)}s waiting for the browser callback.`),
+            });
+        }, timeoutMs);
+    });
+}
+function parseTokenResponse(value) {
+    if (!value || typeof value !== 'object') {
+        throw new Error('Auth0 token response was not an object.');
+    }
+    const accessToken = Reflect.get(value, 'access_token');
+    const refreshToken = Reflect.get(value, 'refresh_token');
+    const expiresIn = Reflect.get(value, 'expires_in');
+    if (typeof accessToken !== 'string' || !accessToken) {
+        throw new Error('Auth0 token response missing access_token.');
+    }
+    if (typeof refreshToken !== 'string' || !refreshToken) {
+        throw new Error('No refresh token returned. Ensure Auth0 offline access is enabled.');
+    }
+    return {
+        accessToken,
+        refreshToken,
+        expiresIn: typeof expiresIn === 'number' ? expiresIn : 86_400,
+    };
+}
+export async function loginWithPkce({ fetchImpl = fetch, now = Date.now, openBrowser = openSystemBrowser, port = configuredPort(), timeoutMs = DEFAULT_LOGIN_TIMEOUT_MS, }) {
+    const verifier = base64Url(randomBytes(32));
+    const challenge = base64Url(createHash('sha256').update(verifier).digest());
+    const state = base64Url(randomBytes(32));
+    const callback = await waitForAuthorizationCode({
+        expectedState: state,
+        port,
+        timeoutMs,
+        onListening: (redirectUri) => {
+            const url = authorizationUrl({ challenge, redirectUri, state });
+            console.error(`Opening browser for Sequence login. If it does not open, visit:\n${url}`);
+            void Promise.resolve(openBrowser(url)).catch((error) => {
+                const message = error instanceof Error ? error.message : String(error);
+                console.error(`Could not open a browser automatically: ${message}`);
+            });
+        },
+    });
+    const tokenResponse = await fetchImpl(`https://${AUTH0_DOMAIN}/oauth/token`, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({
+            grant_type: 'authorization_code',
+            client_id: AUTH0_CLIENT_ID,
+            code: callback.code,
+            redirect_uri: callback.redirectUri,
+            code_verifier: verifier,
+        }),
+    });
+    if (!tokenResponse.ok) {
+        throw new Error(`Auth0 token exchange failed (${tokenResponse.status}): ${await tokenResponse.text()}`);
+    }
+    const tokens = parseTokenResponse(await tokenResponse.json());
+    await saveTokens({
+        access_token: tokens.accessToken,
+        refresh_token: tokens.refreshToken,
+        expires_at: now() / 1_000 + tokens.expiresIn,
+    });
+}
+export async function login() {
+    await loginWithPkce({});
+    console.log(`Authenticated. Tokens saved to ${seqapiTokenPath()}.`);
+}
+/**
+ * Pre-unification artifact-studio token file. `seq-studio artifact` commands
+ * still fall back to it (artifact-studio's `getAccessToken` →
+ * `readTokenConfig`, see shared/services/artifact-studio/src/config.ts), so
+ * logout must clear it too or artifact commands would stay authenticated
+ * after a successful logout.
+ */
+function legacyArtifactTokenPath() {
+    return join(homedir(), '.config', 'sequence-artifact-studio', 'tokens.json');
+}
+export async function logout() {
+    await rm(seqapiTokenPath(), { force: true });
+    await rm(legacyArtifactTokenPath(), { force: true });
+    console.log('Logged out of seq-studio and seqapi.');
+}

package/dist/main.d.ts

@@ -8,6 +8,8 @@
  *   seq-studio secrets <sub>      manage org-owned Managed Secrets
  *   seq-studio repos <sub>        manage platform git-service repos
  *   seq-studio auth <sub>         manage git-service PATs
+ *   seq-studio login              authenticate interactively with Auth0
+ *   seq-studio logout             remove cached user tokens
  *   seq-studio doctor             check token + env + writer gate
  *   seq-studio help               show usage
  */

package/dist/main.js

@@ -8,6 +8,8 @@
  *   seq-studio secrets <sub>      manage org-owned Managed Secrets
  *   seq-studio repos <sub>        manage platform git-service repos
  *   seq-studio auth <sub>         manage git-service PATs
+ *   seq-studio login              authenticate interactively with Auth0
+ *   seq-studio logout             remove cached user tokens
  *   seq-studio doctor             check token + env + writer gate
  *   seq-studio help               show usage
  */
@@ -23,10 +25,12 @@ const TOP_LEVEL_USAGE = `usage:
   seq-studio repos <sub> [args]      list | namespaces | show | create | clone | pull | delete
   seq-studio auth <sub> [args]       pat create | pat list | pat revoke
   seq-studio orm <sub> [args]        init | validate | plan | apply
+  seq-studio login                   authenticate in the browser
+  seq-studio logout                  remove cached user tokens
   seq-studio doctor [-e <env>]       diagnose config, auth, and writer gate
   seq-studio help                    show this message
 
-  Authenticate with: seqapi login
+  Authenticate with: seq-studio login
   Env URLs come from ~/.config/lattice/config.toml (built-ins: local, staging, production, banksouth).
 `;
 const PROCESS_USAGE = `usage:
@@ -78,6 +82,9 @@ export async function run(argv = process.argv.slice(2)) {
             const { runOrmCommand } = await import('./orm/delegate.js');
             return runOrmCommand(sub, rest);
         }
+        case 'login':
+        case 'logout':
+            return runSessionCommand({ argument: sub, command: namespace });
         case 'doctor':
             return doctorCommand(parseArgs([sub, ...rest].filter(Boolean)));
         default:
@@ -86,6 +93,19 @@ export async function run(argv = process.argv.slice(2)) {
             return 1;
     }
 }
+async function runSessionCommand({ argument, command, }) {
+    if (argument === 'help' || argument === '--help' || argument === '-h') {
+        console.log(`usage: seq-studio ${command}`);
+        return 0;
+    }
+    if (argument) {
+        console.error(`seq-studio ${command} does not accept arguments.`);
+        return 1;
+    }
+    const auth = await import('./login.js');
+    await auth[command]();
+    return 0;
+}
 async function runProcessNamespace(sub, rest) {
     if (!sub) {
         console.error(PROCESS_USAGE);

package/dist/orm/delegate.js

@@ -16,7 +16,7 @@ const ORM_USAGE = `usage:
   seq-studio orm apply [dir] -e <env>  register the definitions and apply them to the env
 
   Built-in envs: local, staging, production, banksouth.
-  Authenticate with: seqapi login
+  Authenticate with: seq-studio login
 `;
 export async function runOrmCommand(sub, rest) {
     if (!sub || sub === 'help' || sub === '--help' || sub === '-h') {

package/dist/pat-hints.d.ts

@@ -1,14 +1,12 @@
 /**
  * User-facing hints for minting a git-service PAT.
  *
- * Third-party / OpCo developers typically do not have `seqapi`. Their path is
- * the Atlas UI at `/settings/tokens`. Sequence staff can also use
- * `seq-studio auth pat create` after `seqapi login`.
+ * Users can mint a PAT with seq-studio after interactive login, or through
+ * the Atlas UI at `/settings/tokens`.
  */
 export declare function settingsTokensUrl(envUrl: string): string;
 /**
- * Multi-line setup instructions. Prefer the Atlas UI first (works for anyone
- * with Atlas access); mention the CLI mint path as a staff convenience.
+ * Multi-line setup instructions covering both the CLI and Atlas UI paths.
  */
 export declare function formatPatSetupHint({ envUrl, envName, indent, }: {
     envUrl: string;

package/dist/pat-hints.js

@@ -1,28 +1,27 @@
 /**
  * User-facing hints for minting a git-service PAT.
  *
- * Third-party / OpCo developers typically do not have `seqapi`. Their path is
- * the Atlas UI at `/settings/tokens`. Sequence staff can also use
- * `seq-studio auth pat create` after `seqapi login`.
+ * Users can mint a PAT with seq-studio after interactive login, or through
+ * the Atlas UI at `/settings/tokens`.
  */
 export function settingsTokensUrl(envUrl) {
     return `${envUrl.replace(/\/$/, '')}/settings/tokens`;
 }
 /**
- * Multi-line setup instructions. Prefer the Atlas UI first (works for anyone
- * with Atlas access); mention the CLI mint path as a staff convenience.
+ * Multi-line setup instructions covering both the CLI and Atlas UI paths.
  */
 export function formatPatSetupHint({ envUrl, envName, indent = '  ', }) {
     const tokensUrl = settingsTokensUrl(envUrl);
     return [
-        `${indent}Get a PAT (no seqapi required):`,
-        `${indent}  1. Open ${tokensUrl} and sign in to Atlas`,
+        `${indent}Get a PAT with seq-studio:`,
+        `${indent}  seq-studio login`,
+        `${indent}  seq-studio auth pat create --name laptop --scopes repo:read,repo:write -e ${envName}`,
+        `${indent}Or create one in Atlas:`,
+        `${indent}  1. Open ${tokensUrl} and sign in`,
         `${indent}  2. New token → scopes repo:read (add repo:write for push) → copy once`,
         `${indent}  3. export ATLAS_GIT_PAT=<token>`,
         `${indent}  4. Copy the clone URL from Repositories → Clone, then:`,
         `${indent}       ATLAS_GIT_PAT=<token> seq-studio repos clone --url <https://…/repos/<id>/git>`,
-        `${indent}     (or with seqapi: seq-studio repos clone <ns>/<name>)`,
-        `${indent}Sequence staff with seqapi can instead:`,
-        `${indent}  seqapi login && seq-studio auth pat create --name laptop --scopes repo:read,repo:write -e ${envName}`,
+        `${indent}     (or: seq-studio repos clone <ns>/<name>)`,
     ];
 }

package/dist/process/commands.js

@@ -161,7 +161,7 @@ export async function initCommand(args) {
     // pnpm-workspace.yaml's `minimumReleaseAge: 10080` supply-chain
     // gate actually takes effect (npm has no equivalent setting).
     console.log(`  cd ${relative(process.cwd(), dir) || '.'} && pnpm install`);
-    console.log('  seqapi login');
+    console.log('  seq-studio login');
     console.log('  seq-studio process plan -e local');
     return 0;
 }
@@ -209,7 +209,7 @@ async function buildBundleForPublish(args, defs) {
     }
     catch (err) {
         if (hasSubprocess) {
-            throw new Error('subprocess nodes require -e <env> and `seqapi login` to resolve child process versions', { cause: err });
+            throw new Error('subprocess nodes require -e <env> and `seq-studio login` to resolve child process versions', { cause: err });
         }
         return await buildBundleFromProcesses(defs);
     }
@@ -221,7 +221,7 @@ export async function planCommand(args) {
     console.log(JSON.stringify(summary, null, 2));
     const loadActiveProcess = await tryBuildActiveProcessLoader(args);
     if (!loadActiveProcess) {
-        console.log('\n(no diff — env or auth unavailable; pass --env <name> and run `seqapi login`)');
+        console.log('\n(no diff — env or auth unavailable; pass --env <name> and run `seq-studio login`)');
         return 0;
     }
     const diff = await diffBundleAgainstActive({ newBundle: bundle, loadActiveProcess });
@@ -727,7 +727,7 @@ export async function doctorCommand(args) {
                     ok = false;
                 }
                 else if (err.status === 401) {
-                    lines.push('writer gate: FAIL — 401. Token is rejected by Atlas — run `seqapi login`.');
+                    lines.push('writer gate: FAIL — 401. Token is rejected by Atlas — run `seq-studio login`.');
                     ok = false;
                 }
                 else {

package/dist/repos/commands.d.ts

@@ -45,5 +45,5 @@ export declare function reposCloneCommand(args: ParsedArgs, deps?: {
  */
 export declare function normalizeCloneUrl(raw: string, env: ResolvedEnv): string;
 export declare function reposDeleteCommand(args: ParsedArgs): Promise<number>;
-export declare const REPOS_USAGE = "usage:\n  seq-studio repos list [-e env] [--namespace <slug>] [--mine]      repos visible on the environment\n  seq-studio repos namespaces [create <slug>] [-e env]              list or create namespaces\n  seq-studio repos show <ns>/<name> [-e env]                        repo detail (branches, clone URL)\n  seq-studio repos create <ns>/<name> [-e env] [--default-branch b] create an empty repo\n  seq-studio repos clone <ns>/<name> [-e env] [--ref r] [--out dir] [--force]\n  seq-studio repos clone --url <https://\u2026/repos/<id>/git> [-e env] [--ref r] [--out dir]\n  seq-studio repos clone --id <uuid> [-e env] [--ref r] [--out dir]\n                                                                    smart-HTTP when ATLAS_GIT_PAT is set;\n                                                                    otherwise JSON materialize (<ns>/<name>)\n  seq-studio repos pull <ns>/<name> [-e env] [--ref r] [--out dir] [--force]\n                                                                    materialize the tree at a ref (JSON API)\n  seq-studio repos delete <ns>/<name> [-e env] [--yes]              delete a repo (confirm prompt)\n\n  Flags: -e/--env <local|staging|production|banksouth>\n\n  clone prefers real git clone (PAT via askpass \u2014 never written into the remote\n  URL). Without ATLAS_GIT_PAT, <ns>/<name> falls back to the JSON API and prints\n  how to get a PAT (Atlas UI /settings/tokens \u2014 no seqapi required).\n  No seqapi + PAT: use --url from Repositories \u2192 Clone (or --id <uuid>).\n  --ref accepts a branch, tag, or commit SHA (SHA \u2192 clone then checkout).\n\n  Authenticate JSON API calls with: seqapi login\n  Authenticate git clone/push with: ATLAS_GIT_PAT (from Atlas Settings \u2192 Tokens)\n";
+export declare const REPOS_USAGE = "usage:\n  seq-studio repos list [-e env] [--namespace <slug>] [--mine]      repos visible on the environment\n  seq-studio repos namespaces [create <slug>] [-e env]              list or create namespaces\n  seq-studio repos show <ns>/<name> [-e env]                        repo detail (branches, clone URL)\n  seq-studio repos create <ns>/<name> [-e env] [--default-branch b] create an empty repo\n  seq-studio repos clone <ns>/<name> [-e env] [--ref r] [--out dir] [--force]\n  seq-studio repos clone --url <https://\u2026/repos/<id>/git> [-e env] [--ref r] [--out dir]\n  seq-studio repos clone --id <uuid> [-e env] [--ref r] [--out dir]\n                                                                    smart-HTTP when ATLAS_GIT_PAT is set;\n                                                                    otherwise JSON materialize (<ns>/<name>)\n  seq-studio repos pull <ns>/<name> [-e env] [--ref r] [--out dir] [--force]\n                                                                    materialize the tree at a ref (JSON API)\n  seq-studio repos delete <ns>/<name> [-e env] [--yes]              delete a repo (confirm prompt)\n\n  Flags: -e/--env <local|staging|production|banksouth>\n\n  clone prefers real git clone (PAT via askpass \u2014 never written into the remote\n  URL). Without ATLAS_GIT_PAT, <ns>/<name> falls back to the JSON API and prints\n  how to get a PAT (seq-studio or Atlas UI /settings/tokens).\n  PAT without Auth0 login: use --url from Repositories \u2192 Clone (or --id <uuid>).\n  --ref accepts a branch, tag, or commit SHA (SHA \u2192 clone then checkout).\n\n  Authenticate JSON API calls with: seq-studio login\n  Authenticate git clone/push with: ATLAS_GIT_PAT (from Atlas Settings \u2192 Tokens)\n";
 export declare function runReposCommand(sub: string | undefined, args: ParsedArgs): Promise<number>;

package/dist/repos/commands.js

@@ -2,7 +2,7 @@
  * `seq-studio repos <sub>` — basic management of platform git-service repos
  * over the JSON API.
  *
- * Everything here is API-driven (Auth0 bearer via seqapi login), matching the
+ * Everything here is API-driven (Auth0 bearer via seq-studio login), matching the
  * rest of seq-studio. `pull` materializes a tree over the JSON API; `clone`
  * prefers a real `git clone` when `ATLAS_GIT_PAT` is set (smart-HTTP URL from
  * `show`), otherwise falls back to the same JSON materialize path and hints
@@ -367,14 +367,15 @@ export async function reposCloneCommand(args, deps = {}) {
         const env = await resolveEnvOnly(args);
         const lines = pat
             ? [
-                `ATLAS_GIT_PAT is set, but resolving ${namespace}/${name} needs Auth0 (seqapi login).`,
-                `  No seqapi? Copy the clone URL from Repositories → Clone, then:`,
+                `ATLAS_GIT_PAT is set, but resolving ${namespace}/${name} needs Auth0 (` +
+                    `seq-studio login).`,
+                `  Or copy the clone URL from Repositories → Clone, then:`,
                 `    ATLAS_GIT_PAT=<token> seq-studio repos clone --url <https://…/repos/<id>/git> -e ${env.name}`,
             ]
             : [
-                `${LOG} no ATLAS_GIT_PAT and not logged in (seqapi).`,
+                `${LOG} no ATLAS_GIT_PAT and not logged in.`,
                 ...formatPatSetupHint({ envUrl: env.url, envName: env.name }),
-                `  Or: seqapi login && seq-studio repos clone ${namespace}/${name} -e ${env.name}`,
+                `  Then: seq-studio repos clone ${namespace}/${name} -e ${env.name}`,
             ];
         throw new Error(lines.join('\n'));
     }
@@ -505,11 +506,11 @@ export const REPOS_USAGE = `usage:
 
   clone prefers real git clone (PAT via askpass — never written into the remote
   URL). Without ATLAS_GIT_PAT, <ns>/<name> falls back to the JSON API and prints
-  how to get a PAT (Atlas UI /settings/tokens — no seqapi required).
-  No seqapi + PAT: use --url from Repositories → Clone (or --id <uuid>).
+  how to get a PAT (seq-studio or Atlas UI /settings/tokens).
+  PAT without Auth0 login: use --url from Repositories → Clone (or --id <uuid>).
   --ref accepts a branch, tag, or commit SHA (SHA → clone then checkout).
 
-  Authenticate JSON API calls with: seqapi login
+  Authenticate JSON API calls with: seq-studio login
   Authenticate git clone/push with: ATLAS_GIT_PAT (from Atlas Settings → Tokens)
 `;
 export async function runReposCommand(sub, args) {

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@sequenceholdings/studio-cli",
-  "version": "0.1.9",
-  "description": "Unified Sequence Studio CLI — `seq-studio process` (Lattice), `seq-studio artifact` (Artifact Studio), `seq-studio functions` / `secrets`, `seq-studio repos` (platform git-service), and `seq-studio auth pat` (git-service PATs). Reuses ~/.config/sequence-api/tokens.json for Auth0.",
+  "version": "0.1.10",
+  "description": "Unified Sequence Studio CLI — `seq-studio process` (Lattice), `seq-studio artifact` (Artifact Studio), `seq-studio functions` / `secrets`, `seq-studio repos` (platform git-service), and `seq-studio auth pat` (git-service PATs). Includes Auth0 browser login shared with seqapi.",
   "license": "UNLICENSED",
   "repository": {
     "type": "git",
@@ -40,8 +40,8 @@
     "smol-toml": "^1.4.2",
     "tsx": "^4.20.3",
     "zod": "^4.1.13",
-    "@sequenceholdings/lattice": "0.1.0",
-    "@sequenceholdings/artifact-studio": "0.1.9"
+    "@sequenceholdings/artifact-studio": "0.1.10",
+    "@sequenceholdings/lattice": "0.1.0"
   },
   "peerDependencies": {
     "@sequenceholdings/orm": "0.1.0"