@sequenceholdings/studio-cli 0.1.9 → 0.1.11

package/dist/functions/commands.js

@@ -7,7 +7,7 @@ import { createInterface } from 'node:readline';
 import { Writable } from 'node:stream';
 import { load as parseYaml } from 'js-yaml';
 import { getAccessToken } from '../auth.js';
-import { readConfig, resolveEnv } from '../config.js';
+import { resolveEnvWithDiscovery } from '../config.js';
 import { AtlasApiError, deleteJson, getJson, postJson } from '../atlas-client.js';
 import { clarifyApplyFailureReason, printCliError } from '../cli-errors.js';
 import { confirmYes } from '../prompt.js';
@@ -24,10 +24,9 @@ export function flagBool(flags, ...keys) {
     return keys.some((key) => flags[key] === true || flags[key] === 'true');
 }
 export async function buildContext(args) {
-    const config = await readConfig();
     const requested = (typeof args.flags.env === 'string' ? args.flags.env : undefined) ??
         (typeof args.flags.e === 'string' ? args.flags.e : undefined);
-    const env = resolveEnv({ config, requested });
+    const env = await resolveEnvWithDiscovery({ requested });
     const token = await getAccessToken();
     return { env, token };
 }
@@ -309,7 +308,7 @@ export async function functionsInitCommand(args) {
     console.log('                                       # public npm instead (the deploy worker re-resolves server-side).');
     console.log('  seq-studio functions build           # local pre-flight checks');
     console.log('  # Add secret names to managed-function.yml (secrets: [MY_SECRET]) and values to .env');
-    console.log('  seq-studio functions deploy -e staging  # upload, apply secrets, then deploy');
+    console.log('  seq-studio functions deploy -e <env>  # upload, apply secrets, then deploy');
     return 0;
 }
 // ---------------------------------------------------------------------------
@@ -544,7 +543,8 @@ async function deployFromResolvedSource({ args, spec, ctx: earlyCtx, source, })
         const problems = [];
         if (!existingShell) {
             problems.push(`function "${slug}" is not registered on ${ctx.env.name} — run ` +
-                `\`seq-studio functions deploy -e ${ctx.env.name}\` once with your own login (seqapi login) to register it`);
+                `\`seq-studio functions deploy -e ${ctx.env.name}\` once with your own login (` +
+                `\`seq-studio login\`) to register it`);
         }
         for (const c of classification?.secrets ?? []) {
             if (c.category === 'UPLOAD_NEW' || c.category === 'OVERWRITE') {
@@ -941,7 +941,7 @@ export const FUNCTIONS_USAGE = `usage:
   seq-studio functions delete [--yes]                 archive function + tear down GCP resources
                                                       (version history is retained)
 
-  Flags: -e/--env <local|staging|production|banksouth|preview:<slug>> · --fn <slug> · --dir <path>
+  Flags: -e/--env <env|preview:<slug>> (see: seq-studio envs list) · --fn <slug> · --dir <path>
          --from-env-file <path>  (default: .env) source file for secret values
          --no-wait · --yes
          --no-provision  (deploy) update-only: error instead of registering a new
@@ -957,7 +957,7 @@ export const FUNCTIONS_USAGE = `usage:
   --repo clones over smart-HTTP and REQUIRES a git PAT in ATLAS_GIT_PAT
   (repo:read scope — \`seq-studio auth pat create --scopes repo:read\`, or
   Atlas → Settings → Tokens). It's the same token you clone the repo with;
-  --env + seqapi login are still needed to resolve the repo and deploy.
+  --env + seq-studio login are still needed to resolve the repo and deploy.
 `;
 export async function runFunctionsCommand(sub, args) {
     try {

package/dist/login.d.ts

@@ -0,0 +1,12 @@
+interface LoginOptions {
+    port?: number;
+    timeoutMs?: number;
+    fetchImpl?: typeof fetch;
+    now?: () => number;
+    openBrowser?: (authorizationUrl: string) => void | Promise<void>;
+}
+export declare function openSystemBrowser(authorizationUrl: string): Promise<void>;
+export declare function loginWithPkce({ fetchImpl, now, openBrowser, port, timeoutMs, }: LoginOptions): Promise<void>;
+export declare function login(): Promise<void>;
+export declare function logout(): Promise<void>;
+export {};

package/dist/login.js

@@ -0,0 +1,233 @@
+import { createHash, randomBytes } from 'node:crypto';
+import { rm } from 'node:fs/promises';
+import { createServer } from 'node:http';
+import { spawn } from 'node:child_process';
+import { homedir } from 'node:os';
+import { join } from 'node:path';
+import { AUTH0_AUDIENCE, AUTH0_CLIENT_ID, AUTH0_DOMAIN, saveTokens, seqapiTokenPath, } from './auth.js';
+import { clearCatalog, fetchCatalog } from './env-catalog.js';
+const DEFAULT_REDIRECT_PORT = 5099;
+const DEFAULT_LOGIN_TIMEOUT_MS = 300_000;
+function base64Url(input) {
+    return input.toString('base64url');
+}
+function configuredPort() {
+    const raw = process.env.SEQAPI_PORT?.trim();
+    if (!raw)
+        return DEFAULT_REDIRECT_PORT;
+    const port = Number(raw);
+    if (!Number.isInteger(port) || port < 1 || port > 65_535) {
+        throw new Error(`SEQAPI_PORT must be an integer from 1 to 65535 (got "${raw}").`);
+    }
+    return port;
+}
+function authorizationUrl({ challenge, redirectUri, state, }) {
+    const url = new URL(`https://${AUTH0_DOMAIN}/authorize`);
+    url.searchParams.set('response_type', 'code');
+    url.searchParams.set('client_id', AUTH0_CLIENT_ID);
+    url.searchParams.set('redirect_uri', redirectUri);
+    url.searchParams.set('scope', 'openid profile email offline_access');
+    url.searchParams.set('audience', AUTH0_AUDIENCE);
+    url.searchParams.set('code_challenge', challenge);
+    url.searchParams.set('code_challenge_method', 'S256');
+    url.searchParams.set('state', state);
+    return url.toString();
+}
+export async function openSystemBrowser(authorizationUrl) {
+    const windows = process.platform === 'win32';
+    const command = process.platform === 'darwin' ? 'open' : windows ? 'cmd' : 'xdg-open';
+    // On Windows the URL must be quoted manually (with verbatim arguments so
+    // Node does not re-escape): cmd otherwise splits the unquoted URL on `&`,
+    // truncating the query string and executing the tail as commands. The empty
+    // `""` is `start`'s window-title slot — without it, start would treat the
+    // quoted URL as the title.
+    const args = windows
+        ? ['/c', 'start', '""', `"${authorizationUrl}"`]
+        : [authorizationUrl];
+    const child = spawn(command, args, {
+        stdio: 'ignore',
+        detached: true,
+        ...(windows ? { windowsVerbatimArguments: true } : {}),
+    });
+    await new Promise((resolve, reject) => {
+        child.once('spawn', resolve);
+        child.once('error', reject);
+    });
+    child.unref();
+}
+function callbackPort(server) {
+    const address = server.address();
+    if (!address || typeof address === 'string') {
+        throw new Error('Auth0 callback server did not expose a TCP port.');
+    }
+    return address.port;
+}
+function sendHtml({ body, response, status, }) {
+    response.writeHead(status, { 'content-type': 'text/html; charset=utf-8' });
+    response.end(body);
+}
+function waitForAuthorizationCode({ expectedState, onListening, port, timeoutMs, }) {
+    return new Promise((resolve, reject) => {
+        let redirectUri = '';
+        let settled = false;
+        let timer;
+        const finish = ({ code, error }) => {
+            if (settled)
+                return;
+            settled = true;
+            clearTimeout(timer);
+            server.close();
+            if (error)
+                reject(error);
+            else if (code)
+                resolve({ code, redirectUri });
+            else
+                reject(new Error('Auth0 callback completed without an authorization code.'));
+        };
+        const server = createServer((request, response) => {
+            const url = new URL(request.url ?? '/', redirectUri);
+            const code = url.searchParams.get('code');
+            const authError = url.searchParams.get('error');
+            if (!code && !authError) {
+                response.writeHead(204);
+                response.end();
+                return;
+            }
+            if (url.searchParams.get('state') !== expectedState) {
+                sendHtml({
+                    body: '<h1>Sequence login failed</h1><p>Authorization state mismatch.</p>',
+                    response,
+                    status: 400,
+                });
+                finish({ error: new Error('Auth0 callback state mismatch.') });
+                return;
+            }
+            if (authError) {
+                const description = url.searchParams.get('error_description') ?? authError;
+                sendHtml({
+                    body: '<h1>Sequence login failed</h1><p>Return to the terminal for details.</p>',
+                    response,
+                    status: 400,
+                });
+                finish({ error: new Error(`Auth0 login failed: ${description}`) });
+                return;
+            }
+            sendHtml({
+                body: '<h1>Sequence login complete</h1><p>You may close this tab.</p>',
+                response,
+                status: 200,
+            });
+            finish({ code: code ?? undefined });
+        });
+        server.once('error', (error) => {
+            const message = error.code === 'EADDRINUSE'
+                ? `Port ${port} is in use. Stop the process using it, or set SEQAPI_PORT to a registered Auth0 callback port.`
+                : `Could not start the Auth0 callback server: ${error.message}`;
+            finish({ error: new Error(message) });
+        });
+        server.listen(port, 'localhost', () => {
+            redirectUri = `http://localhost:${callbackPort(server)}`;
+            onListening(redirectUri);
+        });
+        timer = setTimeout(() => {
+            finish({
+                error: new Error(`Login timed out after ${Math.ceil(timeoutMs / 1_000)}s waiting for the browser callback.`),
+            });
+        }, timeoutMs);
+    });
+}
+function parseTokenResponse(value) {
+    if (!value || typeof value !== 'object') {
+        throw new Error('Auth0 token response was not an object.');
+    }
+    const accessToken = Reflect.get(value, 'access_token');
+    const refreshToken = Reflect.get(value, 'refresh_token');
+    const expiresIn = Reflect.get(value, 'expires_in');
+    if (typeof accessToken !== 'string' || !accessToken) {
+        throw new Error('Auth0 token response missing access_token.');
+    }
+    if (typeof refreshToken !== 'string' || !refreshToken) {
+        throw new Error('No refresh token returned. Ensure Auth0 offline access is enabled.');
+    }
+    return {
+        accessToken,
+        refreshToken,
+        expiresIn: typeof expiresIn === 'number' ? expiresIn : 86_400,
+    };
+}
+export async function loginWithPkce({ fetchImpl = fetch, now = Date.now, openBrowser = openSystemBrowser, port = configuredPort(), timeoutMs = DEFAULT_LOGIN_TIMEOUT_MS, }) {
+    const verifier = base64Url(randomBytes(32));
+    const challenge = base64Url(createHash('sha256').update(verifier).digest());
+    const state = base64Url(randomBytes(32));
+    const callback = await waitForAuthorizationCode({
+        expectedState: state,
+        port,
+        timeoutMs,
+        onListening: (redirectUri) => {
+            const url = authorizationUrl({ challenge, redirectUri, state });
+            console.error(`Opening browser for Sequence login. If it does not open, visit:\n${url}`);
+            void Promise.resolve(openBrowser(url)).catch((error) => {
+                const message = error instanceof Error ? error.message : String(error);
+                console.error(`Could not open a browser automatically: ${message}`);
+            });
+        },
+    });
+    const tokenResponse = await fetchImpl(`https://${AUTH0_DOMAIN}/oauth/token`, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({
+            grant_type: 'authorization_code',
+            client_id: AUTH0_CLIENT_ID,
+            code: callback.code,
+            redirect_uri: callback.redirectUri,
+            code_verifier: verifier,
+        }),
+    });
+    if (!tokenResponse.ok) {
+        throw new Error(`Auth0 token exchange failed (${tokenResponse.status}): ${await tokenResponse.text()}`);
+    }
+    const tokens = parseTokenResponse(await tokenResponse.json());
+    await saveTokens({
+        access_token: tokens.accessToken,
+        refresh_token: tokens.refreshToken,
+        expires_at: now() / 1_000 + tokens.expiresIn,
+    });
+}
+export async function login() {
+    await loginWithPkce({});
+    console.log(`Authenticated. Tokens saved to ${seqapiTokenPath()}.`);
+    // Refresh the environment catalog for the new identity immediately, so a
+    // previously cached catalog from another identity (or tier) never lingers
+    // past a login. Drop the old cache first — if the refresh below fails, the
+    // prior identity's catalog must not survive the login either.
+    // Best-effort: discovery being unreachable must not fail login.
+    await clearCatalog();
+    try {
+        const catalog = await fetchCatalog();
+        if (catalog) {
+            console.log(`Environment catalog refreshed (tier: ${catalog.tier}, ` +
+                `${catalog.environments.length} environment(s)).`);
+        }
+    }
+    catch {
+        console.log('Could not refresh the environment catalog — run: seq-studio envs refresh');
+    }
+}
+/**
+ * Pre-unification artifact-studio token file. `seq-studio artifact` commands
+ * still fall back to it (artifact-studio's `getAccessToken` →
+ * `readTokenConfig`, see shared/services/artifact-studio/src/config.ts), so
+ * logout must clear it too or artifact commands would stay authenticated
+ * after a successful logout.
+ */
+function legacyArtifactTokenPath() {
+    return join(homedir(), '.config', 'sequence-artifact-studio', 'tokens.json');
+}
+export async function logout() {
+    await rm(seqapiTokenPath(), { force: true });
+    await rm(legacyArtifactTokenPath(), { force: true });
+    // Drop the cached environment catalog so visibility downgrades with the
+    // identity — a logged-out terminal must not keep the old tier's env list.
+    await clearCatalog();
+    console.log('Logged out of seq-studio and seqapi.');
+}

package/dist/main.d.ts

@@ -8,6 +8,9 @@
  *   seq-studio secrets <sub>      manage org-owned Managed Secrets
  *   seq-studio repos <sub>        manage platform git-service repos
  *   seq-studio auth <sub>         manage git-service PATs
+ *   seq-studio envs <sub>         list/refresh discovered environments
+ *   seq-studio login              authenticate interactively with Auth0
+ *   seq-studio logout             remove cached user tokens
  *   seq-studio doctor             check token + env + writer gate
  *   seq-studio help               show usage
  */

package/dist/main.js

@@ -8,6 +8,9 @@
  *   seq-studio secrets <sub>      manage org-owned Managed Secrets
  *   seq-studio repos <sub>        manage platform git-service repos
  *   seq-studio auth <sub>         manage git-service PATs
+ *   seq-studio envs <sub>         list/refresh discovered environments
+ *   seq-studio login              authenticate interactively with Auth0
+ *   seq-studio logout             remove cached user tokens
  *   seq-studio doctor             check token + env + writer gate
  *   seq-studio help               show usage
  */
@@ -23,11 +26,15 @@ const TOP_LEVEL_USAGE = `usage:
   seq-studio repos <sub> [args]      list | namespaces | show | create | clone | pull | delete
   seq-studio auth <sub> [args]       pat create | pat list | pat revoke
   seq-studio orm <sub> [args]        init | validate | plan | apply
+  seq-studio envs <sub>              list | refresh — environments visible to your identity
+  seq-studio login                   authenticate in the browser
+  seq-studio logout                  remove cached user tokens
   seq-studio doctor [-e <env>]       diagnose config, auth, and writer gate
   seq-studio help                    show this message
 
-  Authenticate with: seqapi login
-  Env URLs come from ~/.config/lattice/config.toml (built-ins: local, staging, production, banksouth).
+  Authenticate with: seq-studio login
+  Built-in env: local. Authenticated identities discover more via
+  \`seq-studio envs refresh\`; custom entries live in ~/.config/lattice/config.toml.
 `;
 const PROCESS_USAGE = `usage:
   seq-studio process init <dir>
@@ -78,6 +85,13 @@ export async function run(argv = process.argv.slice(2)) {
             const { runOrmCommand } = await import('./orm/delegate.js');
             return runOrmCommand(sub, rest);
         }
+        case 'envs': {
+            const { runEnvsCommand } = await import('./envs/commands.js');
+            return runEnvsCommand(sub, rest);
+        }
+        case 'login':
+        case 'logout':
+            return runSessionCommand({ argument: sub, command: namespace });
         case 'doctor':
             return doctorCommand(parseArgs([sub, ...rest].filter(Boolean)));
         default:
@@ -86,6 +100,19 @@ export async function run(argv = process.argv.slice(2)) {
             return 1;
     }
 }
+async function runSessionCommand({ argument, command, }) {
+    if (argument === 'help' || argument === '--help' || argument === '-h') {
+        console.log(`usage: seq-studio ${command}`);
+        return 0;
+    }
+    if (argument) {
+        console.error(`seq-studio ${command} does not accept arguments.`);
+        return 1;
+    }
+    const auth = await import('./login.js');
+    await auth[command]();
+    return 0;
+}
 async function runProcessNamespace(sub, rest) {
     if (!sub) {
         console.error(PROCESS_USAGE);

package/dist/orm/delegate.js

@@ -6,17 +6,18 @@
  * SEQUENCE_ORM_BASE_URL, share the seqapi token, forward argv.
  */
 import { getAccessToken, tryGetAccessToken } from '../auth.js';
-import { readConfig, resolveEnv } from '../config.js';
+import { resolveEnvWithDiscovery } from '../config.js';
 import { normalizeShortEnvFlag, readEnvFromArgv } from '../env-flags.js';
 const ORM_USAGE = `usage:
   seq-studio orm init <dir>            scaffold a namespace directory
-  seq-studio orm validate [dir]        parse + validate definitions, print the content hash
+  seq-studio orm validate [dir]        parse + validate definitions and verify committed migrations are in sync
   seq-studio orm plan [dir] -e <env>   compile definitions and diff against the registry
-  seq-studio orm diff [dir]            write the next committed migration (--check verifies, --allow-destructive consents)
-  seq-studio orm apply [dir] -e <env>  register the definitions and apply them to the env
+  seq-studio orm apply [dir] -e <env>  author the migration, register, apply, and refresh types.gen.ts (the everyday command)
+  seq-studio orm diff [dir]            write/verify the committed migration standalone (--check is the offline CI gate; --allow-destructive consents)
 
-  Built-in envs: local, staging, production, banksouth.
-  Authenticate with: seqapi login
+  Environments: see \`seq-studio envs list\` (built-in: local; more are
+  discovered after you authenticate).
+  Authenticate with: seq-studio login
 `;
 export async function runOrmCommand(sub, rest) {
     if (!sub || sub === 'help' || sub === '--help' || sub === '-h') {
@@ -26,8 +27,7 @@ export async function runOrmCommand(sub, rest) {
     const normalized = normalizeShortEnvFlag(rest);
     const requested = readEnvFromArgv(normalized);
     if (requested) {
-        const config = await readConfig();
-        const resolved = resolveEnv({ config, requested });
+        const resolved = await resolveEnvWithDiscovery({ requested });
         process.env['SEQUENCE_ORM_BASE_URL'] = resolved.url;
     }
     const token = await tryGetAccessToken({ failClosedForM2m: true });

package/dist/pat-hints.d.ts

@@ -1,14 +1,12 @@
 /**
  * User-facing hints for minting a git-service PAT.
  *
- * Third-party / OpCo developers typically do not have `seqapi`. Their path is
- * the Atlas UI at `/settings/tokens`. Sequence staff can also use
- * `seq-studio auth pat create` after `seqapi login`.
+ * Users can mint a PAT with seq-studio after interactive login, or through
+ * the Atlas UI at `/settings/tokens`.
  */
 export declare function settingsTokensUrl(envUrl: string): string;
 /**
- * Multi-line setup instructions. Prefer the Atlas UI first (works for anyone
- * with Atlas access); mention the CLI mint path as a staff convenience.
+ * Multi-line setup instructions covering both the CLI and Atlas UI paths.
  */
 export declare function formatPatSetupHint({ envUrl, envName, indent, }: {
     envUrl: string;

package/dist/pat-hints.js

@@ -1,28 +1,27 @@
 /**
  * User-facing hints for minting a git-service PAT.
  *
- * Third-party / OpCo developers typically do not have `seqapi`. Their path is
- * the Atlas UI at `/settings/tokens`. Sequence staff can also use
- * `seq-studio auth pat create` after `seqapi login`.
+ * Users can mint a PAT with seq-studio after interactive login, or through
+ * the Atlas UI at `/settings/tokens`.
  */
 export function settingsTokensUrl(envUrl) {
     return `${envUrl.replace(/\/$/, '')}/settings/tokens`;
 }
 /**
- * Multi-line setup instructions. Prefer the Atlas UI first (works for anyone
- * with Atlas access); mention the CLI mint path as a staff convenience.
+ * Multi-line setup instructions covering both the CLI and Atlas UI paths.
  */
 export function formatPatSetupHint({ envUrl, envName, indent = '  ', }) {
     const tokensUrl = settingsTokensUrl(envUrl);
     return [
-        `${indent}Get a PAT (no seqapi required):`,
-        `${indent}  1. Open ${tokensUrl} and sign in to Atlas`,
+        `${indent}Get a PAT with seq-studio:`,
+        `${indent}  seq-studio login`,
+        `${indent}  seq-studio auth pat create --name laptop --scopes repo:read,repo:write -e ${envName}`,
+        `${indent}Or create one in Atlas:`,
+        `${indent}  1. Open ${tokensUrl} and sign in`,
         `${indent}  2. New token → scopes repo:read (add repo:write for push) → copy once`,
         `${indent}  3. export ATLAS_GIT_PAT=<token>`,
         `${indent}  4. Copy the clone URL from Repositories → Clone, then:`,
         `${indent}       ATLAS_GIT_PAT=<token> seq-studio repos clone --url <https://…/repos/<id>/git>`,
-        `${indent}     (or with seqapi: seq-studio repos clone <ns>/<name>)`,
-        `${indent}Sequence staff with seqapi can instead:`,
-        `${indent}  seqapi login && seq-studio auth pat create --name laptop --scopes repo:read,repo:write -e ${envName}`,
+        `${indent}     (or: seq-studio repos clone <ns>/<name>)`,
     ];
 }

package/dist/process/commands.js

@@ -12,7 +12,7 @@ import { forEachSerializedNode, } from '@sequenceholdings/lattice/bundle';
 import { getJson, getJsonOr404, postJson, AtlasApiError } from '../atlas-client.js';
 import { generateProcessFiles } from './codegen.js';
 import { getAccessToken, NotLoggedInError } from '../auth.js';
-import { ENV_NAMES, readConfig, resolveEnv } from '../config.js';
+import { readConfig, resolveEnvWithDiscovery } from '../config.js';
 import { buildBundleFromProcesses, summarizeBundle } from './build.js';
 import { buildResolveProcessPinFromEnv } from './resolve-process-pin.js';
 import { loadBundleForPublish } from './local-bundle.js';
@@ -92,9 +92,8 @@ const SHORT_FLAG_ALIASES = {
     '-o': 'out',
 };
 async function getEnvAndToken(args) {
-    const config = await readConfig();
     const requested = typeof args.flags.env === 'string' ? args.flags.env : undefined;
-    const env = resolveEnv({ config, requested });
+    const env = await resolveEnvWithDiscovery({ requested });
     let token;
     try {
         token = await getAccessToken();
@@ -161,7 +160,7 @@ export async function initCommand(args) {
     // pnpm-workspace.yaml's `minimumReleaseAge: 10080` supply-chain
     // gate actually takes effect (npm has no equivalent setting).
     console.log(`  cd ${relative(process.cwd(), dir) || '.'} && pnpm install`);
-    console.log('  seqapi login');
+    console.log('  seq-studio login');
     console.log('  seq-studio process plan -e local');
     return 0;
 }
@@ -209,7 +208,7 @@ async function buildBundleForPublish(args, defs) {
     }
     catch (err) {
         if (hasSubprocess) {
-            throw new Error('subprocess nodes require -e <env> and `seqapi login` to resolve child process versions', { cause: err });
+            throw new Error('subprocess nodes require -e <env> and `seq-studio login` to resolve child process versions', { cause: err });
         }
         return await buildBundleFromProcesses(defs);
     }
@@ -221,7 +220,7 @@ export async function planCommand(args) {
     console.log(JSON.stringify(summary, null, 2));
     const loadActiveProcess = await tryBuildActiveProcessLoader(args);
     if (!loadActiveProcess) {
-        console.log('\n(no diff — env or auth unavailable; pass --env <name> and run `seqapi login`)');
+        console.log('\n(no diff — env or auth unavailable; pass --env <name> and run `seq-studio login`)');
         return 0;
     }
     const diff = await diffBundleAgainstActive({ newBundle: bundle, loadActiveProcess });
@@ -667,16 +666,16 @@ export async function doctorCommand(args) {
     }
     else {
         lines.push(`config: ok — default_env=${config.defaultEnv}, envs=${Object.keys(config.envs).join(',')}`);
+        lines.push(`tier: ${config.tier}` +
+            (config.tier === 'anonymous'
+                ? ' — authenticate and run `seq-studio envs refresh` to discover more environments'
+                : ''));
     }
     const requested = typeof args.flags.env === 'string' ? args.flags.env : undefined;
-    if (requested && !ENV_NAMES.includes(requested) && config && !(requested in config.envs)) {
-        lines.push(`env "${requested}": FAIL — not in built-ins (${ENV_NAMES.join(',')}) or config`);
-        ok = false;
-    }
     let env = null;
     if (config) {
         try {
-            env = resolveEnv({ config, requested });
+            env = await resolveEnvWithDiscovery({ requested });
             lines.push(`env: ok — ${env.name} (${env.url})`);
         }
         catch (err) {
@@ -727,7 +726,7 @@ export async function doctorCommand(args) {
                     ok = false;
                 }
                 else if (err.status === 401) {
-                    lines.push('writer gate: FAIL — 401. Token is rejected by Atlas — run `seqapi login`.');
+                    lines.push('writer gate: FAIL — 401. Token is rejected by Atlas — run `seq-studio login`.');
                     ok = false;
                 }
                 else {

package/dist/repos/commands.d.ts

@@ -45,5 +45,5 @@ export declare function reposCloneCommand(args: ParsedArgs, deps?: {
  */
 export declare function normalizeCloneUrl(raw: string, env: ResolvedEnv): string;
 export declare function reposDeleteCommand(args: ParsedArgs): Promise<number>;
-export declare const REPOS_USAGE = "usage:\n  seq-studio repos list [-e env] [--namespace <slug>] [--mine]      repos visible on the environment\n  seq-studio repos namespaces [create <slug>] [-e env]              list or create namespaces\n  seq-studio repos show <ns>/<name> [-e env]                        repo detail (branches, clone URL)\n  seq-studio repos create <ns>/<name> [-e env] [--default-branch b] create an empty repo\n  seq-studio repos clone <ns>/<name> [-e env] [--ref r] [--out dir] [--force]\n  seq-studio repos clone --url <https://\u2026/repos/<id>/git> [-e env] [--ref r] [--out dir]\n  seq-studio repos clone --id <uuid> [-e env] [--ref r] [--out dir]\n                                                                    smart-HTTP when ATLAS_GIT_PAT is set;\n                                                                    otherwise JSON materialize (<ns>/<name>)\n  seq-studio repos pull <ns>/<name> [-e env] [--ref r] [--out dir] [--force]\n                                                                    materialize the tree at a ref (JSON API)\n  seq-studio repos delete <ns>/<name> [-e env] [--yes]              delete a repo (confirm prompt)\n\n  Flags: -e/--env <local|staging|production|banksouth>\n\n  clone prefers real git clone (PAT via askpass \u2014 never written into the remote\n  URL). Without ATLAS_GIT_PAT, <ns>/<name> falls back to the JSON API and prints\n  how to get a PAT (Atlas UI /settings/tokens \u2014 no seqapi required).\n  No seqapi + PAT: use --url from Repositories \u2192 Clone (or --id <uuid>).\n  --ref accepts a branch, tag, or commit SHA (SHA \u2192 clone then checkout).\n\n  Authenticate JSON API calls with: seqapi login\n  Authenticate git clone/push with: ATLAS_GIT_PAT (from Atlas Settings \u2192 Tokens)\n";
+export declare const REPOS_USAGE = "usage:\n  seq-studio repos list [-e env] [--namespace <slug>] [--mine]      repos visible on the environment\n  seq-studio repos namespaces [create <slug>] [-e env]              list or create namespaces\n  seq-studio repos show <ns>/<name> [-e env]                        repo detail (branches, clone URL)\n  seq-studio repos create <ns>/<name> [-e env] [--default-branch b] create an empty repo\n  seq-studio repos clone <ns>/<name> [-e env] [--ref r] [--out dir] [--force]\n  seq-studio repos clone --url <https://\u2026/repos/<id>/git> [-e env] [--ref r] [--out dir]\n  seq-studio repos clone --id <uuid> [-e env] [--ref r] [--out dir]\n                                                                    smart-HTTP when ATLAS_GIT_PAT is set;\n                                                                    otherwise JSON materialize (<ns>/<name>)\n  seq-studio repos pull <ns>/<name> [-e env] [--ref r] [--out dir] [--force]\n                                                                    materialize the tree at a ref (JSON API)\n  seq-studio repos delete <ns>/<name> [-e env] [--yes]              delete a repo (confirm prompt)\n\n  Flags: -e/--env <env>  (see: seq-studio envs list)\n\n  clone prefers real git clone (PAT via askpass \u2014 never written into the remote\n  URL). Without ATLAS_GIT_PAT, <ns>/<name> falls back to the JSON API and prints\n  how to get a PAT (seq-studio or Atlas UI /settings/tokens).\n  PAT without Auth0 login: use --url from Repositories \u2192 Clone (or --id <uuid>).\n  --ref accepts a branch, tag, or commit SHA (SHA \u2192 clone then checkout).\n\n  Authenticate JSON API calls with: seq-studio login\n  Authenticate git clone/push with: ATLAS_GIT_PAT (from Atlas Settings \u2192 Tokens)\n";
 export declare function runReposCommand(sub: string | undefined, args: ParsedArgs): Promise<number>;

package/dist/repos/commands.js

@@ -2,7 +2,7 @@
  * `seq-studio repos <sub>` — basic management of platform git-service repos
  * over the JSON API.
  *
- * Everything here is API-driven (Auth0 bearer via seqapi login), matching the
+ * Everything here is API-driven (Auth0 bearer via seq-studio login), matching the
  * rest of seq-studio. `pull` materializes a tree over the JSON API; `clone`
  * prefers a real `git clone` when `ATLAS_GIT_PAT` is set (smart-HTTP URL from
  * `show`), otherwise falls back to the same JSON materialize path and hints
@@ -24,7 +24,7 @@ import { buildContext, clientOptions, flagBool, LOG, } from '../functions/comman
 import { resolveGitPatFromEnv, runGitClone, } from './git-clone.js';
 import { formatPatSetupHint } from '../pat-hints.js';
 import { tryGetAccessToken } from '../auth.js';
-import { readConfig, resolveEnv } from '../config.js';
+import { resolveEnvWithDiscovery } from '../config.js';
 const PAGE_SIZE = 200;
 // ---------------------------------------------------------------------------
 // Helpers
@@ -60,7 +60,7 @@ export function stringFlag(flags, key) {
  */
 async function reposContext(args) {
     if (args.flags.env === true || args.flags.e === true) {
-        throw new Error('-e/--env requires a value (local|staging|production|banksouth|preview:<slug>).');
+        throw new Error('-e/--env requires a value — see: seq-studio envs list.');
     }
     const ctx = await buildContext(args);
     const secret = process.env.PREVIEW_ACCESS_HEADER?.trim();
@@ -367,14 +367,15 @@ export async function reposCloneCommand(args, deps = {}) {
         const env = await resolveEnvOnly(args);
         const lines = pat
             ? [
-                `ATLAS_GIT_PAT is set, but resolving ${namespace}/${name} needs Auth0 (seqapi login).`,
-                `  No seqapi? Copy the clone URL from Repositories → Clone, then:`,
+                `ATLAS_GIT_PAT is set, but resolving ${namespace}/${name} needs Auth0 (` +
+                    `seq-studio login).`,
+                `  Or copy the clone URL from Repositories → Clone, then:`,
                 `    ATLAS_GIT_PAT=<token> seq-studio repos clone --url <https://…/repos/<id>/git> -e ${env.name}`,
             ]
             : [
-                `${LOG} no ATLAS_GIT_PAT and not logged in (seqapi).`,
+                `${LOG} no ATLAS_GIT_PAT and not logged in.`,
                 ...formatPatSetupHint({ envUrl: env.url, envName: env.name }),
-                `  Or: seqapi login && seq-studio repos clone ${namespace}/${name} -e ${env.name}`,
+                `  Then: seq-studio repos clone ${namespace}/${name} -e ${env.name}`,
             ];
         throw new Error(lines.join('\n'));
     }
@@ -413,12 +414,11 @@ export async function reposCloneCommand(args, deps = {}) {
 /** Resolve -e/--env without requiring Auth0 (for PAT-only --url/--id clones). */
 async function resolveEnvOnly(args) {
     if (args.flags.env === true || args.flags.e === true) {
-        throw new Error('-e/--env requires a value (local|staging|production|banksouth|preview:<slug>).');
+        throw new Error('-e/--env requires a value — see: seq-studio envs list.');
     }
-    const config = await readConfig();
     const requested = (typeof args.flags.env === 'string' ? args.flags.env : undefined) ??
         (typeof args.flags.e === 'string' ? args.flags.e : undefined);
-    return resolveEnv({ config, requested });
+    return resolveEnvWithDiscovery({ requested });
 }
 /**
  * Validate clone URL shape and that the origin matches the resolved Atlas env
@@ -501,15 +501,15 @@ export const REPOS_USAGE = `usage:
                                                                     materialize the tree at a ref (JSON API)
   seq-studio repos delete <ns>/<name> [-e env] [--yes]              delete a repo (confirm prompt)
 
-  Flags: -e/--env <local|staging|production|banksouth>
+  Flags: -e/--env <env>  (see: seq-studio envs list)
 
   clone prefers real git clone (PAT via askpass — never written into the remote
   URL). Without ATLAS_GIT_PAT, <ns>/<name> falls back to the JSON API and prints
-  how to get a PAT (Atlas UI /settings/tokens — no seqapi required).
-  No seqapi + PAT: use --url from Repositories → Clone (or --id <uuid>).
+  how to get a PAT (seq-studio or Atlas UI /settings/tokens).
+  PAT without Auth0 login: use --url from Repositories → Clone (or --id <uuid>).
   --ref accepts a branch, tag, or commit SHA (SHA → clone then checkout).
 
-  Authenticate JSON API calls with: seqapi login
+  Authenticate JSON API calls with: seq-studio login
   Authenticate git clone/push with: ATLAS_GIT_PAT (from Atlas Settings → Tokens)
 `;
 export async function runReposCommand(sub, args) {