@tapi-dev/sdk 0.1.36 → 0.1.39

package/dist/cli.js

@@ -12,6 +12,9 @@ import { emitKeypressEvents } from "node:readline";
 import { Readable, Transform } from "node:stream";
 import { pipeline } from "node:stream/promises";
 import { fileURLToPath, pathToFileURL } from "node:url";
+import { select } from "@inquirer/prompts";
+import { Presets, SingleBar } from "cli-progress";
+import pc from "yoctocolors";
 import { TapiClient } from "./index.js";
 import { loadWorkspace, normalizeProjectValue, writeWorkspaceConfig, } from "./workspace.js";
 const DEFAULT_DOWNLOADS_BASE_URL = "https://d4xaf52nfwiok.cloudfront.net";
@@ -117,6 +120,50 @@ async function withCliSpinner(message, work) {
         throw error;
     }
 }
+async function withSdkAuth(options) {
+    if (options.authToken?.trim()) {
+        return { ...options, authToken: options.authToken.trim() };
+    }
+    const envAuthToken = envString("TAPI_FIREBASE_ID_TOKEN");
+    if (envAuthToken) {
+        return { ...options, authToken: envAuthToken };
+    }
+    const credentials = await requireSdkFirebaseCredentials();
+    return { ...options, authToken: credentials.idToken };
+}
+async function requireSdkFirebaseCredentials() {
+    const credentials = await refreshCachedFirebaseCredentials();
+    if (!credentials) {
+        throw new Error(`Tapi sign-in is required. Run \`tapi login\`, then retry.`);
+    }
+    await writeStudioAuthCache(credentials);
+    return credentials;
+}
+async function runLogin() {
+    try {
+        const credentials = await withCliSpinner("Signing in to Tapi", () => authenticateSdkUser());
+        console.log(`Signed in to Tapi as ${credentials.uid}.`);
+        return 0;
+    }
+    catch (error) {
+        console.error(formatError(error));
+        return 1;
+    }
+}
+async function authenticateSdkUser() {
+    const cached = await refreshCachedFirebaseCredentials();
+    if (cached) {
+        await writeStudioAuthCache(cached);
+        return cached;
+    }
+    const browserAuth = await browserGoogleSignIn();
+    if (!browserAuth.idToken) {
+        throw new Error(browserAuth.error || browserAuth.detail || "Browser sign-in did not return a Google ID token.");
+    }
+    const credentials = await exchangeGoogleToFirebase(browserAuth.idToken, browserAuth.accessToken);
+    await writeStudioAuthCache(credentials);
+    return credentials;
+}
 export async function runCli(argv = process.argv.slice(2)) {
     const [command, subcommand, ...rest] = argv;
     if (!command || command === "help" || command === "--help" || command === "-h") {
@@ -127,6 +174,18 @@ export async function runCli(argv = process.argv.slice(2)) {
         console.log(sdkVersion);
         return 0;
     }
+    if (command === "login") {
+        if (hasHelpFlag([subcommand, ...rest])) {
+            printLoginHelp();
+            return 0;
+        }
+        if (subcommand) {
+            console.error(`Unexpected login argument: ${subcommand}`);
+            printLoginHelp();
+            return 1;
+        }
+        return runLogin();
+    }
     if (command === "doctor") {
         if (hasHelpFlag([subcommand, ...rest])) {
             printStudioHelp();
@@ -258,6 +317,9 @@ export async function runCli(argv = process.argv.slice(2)) {
     if (!subcommand) {
         return openStudio(parseStudioOptions([]));
     }
+    if (subcommand.startsWith("-")) {
+        return openStudio(parseStudioOptions([subcommand, ...rest]));
+    }
     if (subcommand === "help" || subcommand === "--help" || subcommand === "-h") {
         printStudioHelp();
         return 0;
@@ -284,6 +346,8 @@ export function parseStudioOptions(args) {
     const raw = {};
     let workspaceSearchRoot;
     let skipWorkspace = false;
+    let projectIdSource;
+    let tappSelectionMode = "auto";
     for (let index = 0; index < args.length; index += 1) {
         const arg = args[index];
         if (!arg) {
@@ -329,12 +393,40 @@ export function parseStudioOptions(args) {
             skipWorkspace = true;
             continue;
         }
+        if (arg === "--tapp") {
+            raw.projectId = normalizeProjectValue(requireOptionValue(args, ++index, "--tapp"), "tapp");
+            projectIdSource = "option";
+            tappSelectionMode = "none";
+            continue;
+        }
+        if (arg.startsWith("--tapp=")) {
+            raw.projectId = normalizeProjectValue(arg.slice("--tapp=".length), "tapp");
+            projectIdSource = "option";
+            tappSelectionMode = "none";
+            continue;
+        }
+        if (arg === "--select") {
+            tappSelectionMode = "select";
+            continue;
+        }
+        if (arg === "--last") {
+            tappSelectionMode = "last";
+            continue;
+        }
+        if (arg === "--no-select") {
+            tappSelectionMode = "none";
+            continue;
+        }
         if (arg === "--project") {
             raw.projectId = normalizeProjectValue(requireOptionValue(args, ++index, "--project"), "project");
+            projectIdSource = "option";
+            tappSelectionMode = "none";
             continue;
         }
         if (arg.startsWith("--project=")) {
             raw.projectId = normalizeProjectValue(arg.slice("--project=".length), "project");
+            projectIdSource = "option";
+            tappSelectionMode = "none";
             continue;
         }
         if (arg === "--project-slug") {
@@ -403,7 +495,11 @@ export function parseStudioOptions(args) {
     const manifestUrl = explicitManifestUrl
         ? normalizeHttpUrl(explicitManifestUrl, "Studio manifest URL")
         : `${downloadsBaseUrl.replace(/\/+$/, "")}/studio/channels/${channel}/latest.json`;
-    const projectId = raw.projectId ?? envString("TAPI_PROJECT_ID") ?? workspace?.projectId;
+    const envProjectId = envString("TAPI_PROJECT_ID");
+    const projectId = raw.projectId ?? envProjectId ?? workspace?.projectId;
+    if (!projectIdSource && projectId) {
+        projectIdSource = raw.projectId ? "option" : envProjectId ? "env" : "workspace";
+    }
     const projectSlug = raw.projectSlug ?? envString("TAPI_PROJECT_SLUG") ?? workspace?.projectSlug;
     const envInstallToken = envString("TAPI_STUDIO_INSTALL_TOKEN");
     const installToken = raw.installToken ?? envInstallToken;
@@ -423,14 +519,15 @@ export function parseStudioOptions(args) {
         workspaceRoot: workspace?.root,
         projectId,
         projectSlug,
+        projectIdSource,
         workspaceMode: Boolean(projectId || workspace),
+        tappSelectionMode,
     };
 }
 function parseServiceOptions(args) {
     let operation = "";
     const workspace = loadWorkspace();
     let apiBaseUrl = envString("TAPI_BASE_URL") || workspace?.apiBaseUrl || DEFAULT_STUDIO_API_BASE_URL;
-    let apiKey = envString("TAPI_API_KEY") || "";
     let projectId = envString("TAPI_PROJECT_ID") || workspace?.projectId || "";
     for (let index = 0; index < args.length; index += 1) {
         const arg = args[index];
@@ -448,14 +545,6 @@ function parseServiceOptions(args) {
             apiBaseUrl = arg.slice("--server=".length);
             continue;
         }
-        if (arg === "--api-key") {
-            apiKey = requireOptionValue(args, ++index, "--api-key");
-            continue;
-        }
-        if (arg.startsWith("--api-key=")) {
-            apiKey = arg.slice("--api-key=".length);
-            continue;
-        }
         if (arg === "--project") {
             projectId = normalizeProjectValue(requireOptionValue(args, ++index, "--project"), "project");
             continue;
@@ -476,9 +565,6 @@ function parseServiceOptions(args) {
     if (!operation) {
         throw new Error("services describe requires a service run like schwab.place_order.");
     }
-    if (!apiKey) {
-        throw new Error("services describe requires --api-key or TAPI_API_KEY.");
-    }
     if (!projectId) {
         throw new Error("services describe requires --project, TAPI_PROJECT_ID, or .tapi/project.json.");
     }
@@ -486,7 +572,6 @@ function parseServiceOptions(args) {
         operation,
         options: {
             apiBaseUrl: normalizeHttpUrl(apiBaseUrl, "Tapi API base URL"),
-            apiKey,
             projectId,
         },
     };
@@ -494,11 +579,12 @@ function parseServiceOptions(args) {
 async function describeServiceOperation(args) {
     try {
         const { operation, options } = parseServiceOptions(args);
+        const authenticated = await withSdkAuth(options);
         const client = new TapiClient({
-            baseUrl: options.apiBaseUrl,
-            apiKey: options.apiKey,
-            tappId: options.projectId,
-            projectId: options.projectId,
+            baseUrl: authenticated.apiBaseUrl,
+            authToken: authenticated.authToken,
+            tappId: authenticated.projectId,
+            projectId: authenticated.projectId,
         });
         const description = await withCliSpinner(`Fetching Tapi service-run contract for ${operation}`, () => client.services.describe(operation));
         console.log(JSON.stringify(description, null, 2));
@@ -512,7 +598,6 @@ async function describeServiceOperation(args) {
 function parseApiWorkspaceOptions(args) {
     const workspace = loadWorkspace();
     let apiBaseUrl = envString("TAPI_BASE_URL") || workspace?.apiBaseUrl || DEFAULT_STUDIO_API_BASE_URL;
-    let apiKey = envString("TAPI_API_KEY") || "";
     let projectId = envString("TAPI_PROJECT_ID") || workspace?.projectId || "";
     let catalogPath = workspace?.config.services?.catalog || ".tapi/services/catalog.json";
     for (let index = 0; index < args.length; index += 1) {
@@ -531,14 +616,6 @@ function parseApiWorkspaceOptions(args) {
             apiBaseUrl = arg.slice("--server=".length);
             continue;
         }
-        if (arg === "--api-key") {
-            apiKey = requireOptionValue(args, ++index, "--api-key");
-            continue;
-        }
-        if (arg.startsWith("--api-key=")) {
-            apiKey = arg.slice("--api-key=".length);
-            continue;
-        }
         if (arg === "--project") {
             projectId = normalizeProjectValue(requireOptionValue(args, ++index, "--project"), "project");
             continue;
@@ -557,23 +634,19 @@ function parseApiWorkspaceOptions(args) {
         }
         throw new Error(`Unknown services option: ${arg}`);
     }
-    if (!apiKey) {
-        throw new Error("services command requires --api-key or TAPI_API_KEY.");
-    }
     if (!projectId) {
         throw new Error("services command requires --project, TAPI_PROJECT_ID, or .tapi/project.json.");
     }
     const root = workspace?.root || process.cwd();
     return {
         apiBaseUrl: normalizeHttpUrl(apiBaseUrl, "Tapi API base URL"),
-        apiKey,
         projectId,
         catalogPath: resolve(root, catalogPath),
     };
 }
 async function syncServiceCatalog(args) {
     try {
-        const options = parseApiWorkspaceOptions(args);
+        const options = await withSdkAuth(parseApiWorkspaceOptions(args));
         const catalog = await withCliSpinner("Fetching Tapi service-run catalog", () => fetchApiCatalog(options));
         await writeJsonFile(options.catalogPath, catalog);
         console.log(`Synced Tapi service-run catalog: ${options.catalogPath}`);
@@ -587,7 +660,6 @@ async function syncServiceCatalog(args) {
 function parseTappServiceAddOptions(args) {
     const workspace = loadWorkspace();
     let apiBaseUrl = envString("TAPI_BASE_URL") || workspace?.apiBaseUrl || DEFAULT_STUDIO_API_BASE_URL;
-    let apiKey = envString("TAPI_API_KEY") || "";
     let tappId = "";
     let serviceCall = "";
     let serviceMapId = "";
@@ -609,14 +681,6 @@ function parseTappServiceAddOptions(args) {
             apiBaseUrl = arg.slice("--server=".length);
             continue;
         }
-        if (arg === "--api-key") {
-            apiKey = requireOptionValue(args, ++index, "--api-key");
-            continue;
-        }
-        if (arg.startsWith("--api-key=")) {
-            apiKey = arg.slice("--api-key=".length);
-            continue;
-        }
         if (arg === "--service-map") {
             serviceMapId = requireOptionValue(args, ++index, "--service-map");
             continue;
@@ -654,9 +718,6 @@ function parseTappServiceAddOptions(args) {
         }
         throw new Error(`Unexpected tapp service add argument: ${arg}`);
     }
-    if (!apiKey) {
-        throw new Error("tapp service add requires --api-key or TAPI_API_KEY.");
-    }
     if (!tappId) {
         throw new Error("tapp service add requires a Tapp id.");
     }
@@ -671,7 +732,6 @@ function parseTappServiceAddOptions(args) {
     }
     return {
         apiBaseUrl: normalizeHttpUrl(apiBaseUrl, "Tapi API base URL"),
-        apiKey,
         tappId,
         serviceCall,
         serviceMapId,
@@ -682,7 +742,6 @@ function parseTappServiceAddOptions(args) {
 function parseTappCreateOptions(args) {
     const workspace = loadWorkspace();
     let apiBaseUrl = envString("TAPI_BASE_URL") || workspace?.apiBaseUrl || DEFAULT_STUDIO_API_BASE_URL;
-    let apiKey = envString("TAPI_API_KEY") || "";
     let tappId = envString("TAPI_PROJECT_ID") || workspace?.projectId || "";
     let name = "";
     for (let index = 0; index < args.length; index += 1) {
@@ -701,14 +760,6 @@ function parseTappCreateOptions(args) {
             apiBaseUrl = arg.slice("--server=".length);
             continue;
         }
-        if (arg === "--api-key") {
-            apiKey = requireOptionValue(args, ++index, "--api-key");
-            continue;
-        }
-        if (arg.startsWith("--api-key=")) {
-            apiKey = arg.slice("--api-key=".length);
-            continue;
-        }
         if (arg === "--tapp-id" || arg === "--project") {
             tappId = normalizeProjectValue(requireOptionValue(args, ++index, arg), "tapp");
             continue;
@@ -741,9 +792,6 @@ function parseTappCreateOptions(args) {
         }
         throw new Error(`Unexpected tapp create argument: ${arg}`);
     }
-    if (!apiKey) {
-        throw new Error("tapp create requires --api-key or TAPI_API_KEY.");
-    }
     if (!tappId) {
         throw new Error("tapp create requires a Tapp id or name.");
     }
@@ -752,14 +800,13 @@ function parseTappCreateOptions(args) {
     }
     return {
         apiBaseUrl: normalizeHttpUrl(apiBaseUrl, "Tapi API base URL"),
-        apiKey,
         tappId,
         name,
     };
 }
 async function createTapp(args) {
     try {
-        const options = parseTappCreateOptions(args);
+        const options = await withSdkAuth(parseTappCreateOptions(args));
         const tapp = await withCliSpinner(`Creating Tapi Tapp ${options.tappId}`, () => postTappCreate(options));
         console.log(JSON.stringify(tapp, null, 2));
         return 0;
@@ -772,11 +819,7 @@ async function createTapp(args) {
 async function postTappCreate(options, fetchImpl = fetch) {
     const response = await fetchImpl(`${options.apiBaseUrl.replace(/\/+$/, "")}/api/sdk/v1/tapps`, {
         method: "POST",
-        headers: {
-            "Content-Type": "application/json",
-            "X-API-Key": options.apiKey,
-            "X-Tapi-Project": options.tappId,
-        },
+        headers: sdkJsonHeaders(options.authToken, options.tappId),
         body: JSON.stringify({
             tappId: options.tappId,
             name: options.name,
@@ -791,7 +834,7 @@ async function postTappCreate(options, fetchImpl = fetch) {
 }
 async function addTappService(args) {
     try {
-        const options = parseTappServiceAddOptions(args);
+        const options = await withSdkAuth(parseTappServiceAddOptions(args));
         const operation = await withCliSpinner(`Adding Tapi service ${options.serviceCall} to ${options.tappId}`, () => postTappServiceAdd(options));
         console.log(JSON.stringify(operation, null, 2));
         return 0;
@@ -804,11 +847,7 @@ async function addTappService(args) {
 async function postTappServiceAdd(options) {
     const response = await fetch(`${options.apiBaseUrl.replace(/\/+$/, "")}/api/sdk/v1/tapps/${encodeURIComponent(options.tappId)}/services/${encodeURIComponent(options.serviceCall)}`, {
         method: "POST",
-        headers: {
-            "Content-Type": "application/json",
-            "X-API-Key": options.apiKey,
-            "X-Tapi-Project": options.tappId,
-        },
+        headers: sdkJsonHeaders(options.authToken, options.tappId),
         body: JSON.stringify({
             serviceMapId: options.serviceMapId,
             entry: options.entry,
@@ -825,7 +864,6 @@ async function postTappServiceAdd(options) {
 function parseQueueCreateOptions(args) {
     const workspace = loadWorkspace();
     let apiBaseUrl = envString("TAPI_BASE_URL") || workspace?.apiBaseUrl || DEFAULT_STUDIO_API_BASE_URL;
-    let apiKey = envString("TAPI_API_KEY") || "";
     let projectId = envString("TAPI_PROJECT_ID") || workspace?.projectId || "";
     let displayName = "";
     let maxSlots = 8;
@@ -845,14 +883,6 @@ function parseQueueCreateOptions(args) {
             apiBaseUrl = arg.slice("--server=".length);
             continue;
         }
-        if (arg === "--api-key") {
-            apiKey = requireOptionValue(args, ++index, "--api-key");
-            continue;
-        }
-        if (arg.startsWith("--api-key=")) {
-            apiKey = arg.slice("--api-key=".length);
-            continue;
-        }
         if (arg === "--project") {
             projectId = normalizeProjectValue(requireOptionValue(args, ++index, "--project"), "project");
             continue;
@@ -878,12 +908,8 @@ function parseQueueCreateOptions(args) {
         }
         throw new Error(`Unexpected queue create argument: ${arg}`);
     }
-    if (!apiKey) {
-        throw new Error("queue create requires --api-key or TAPI_API_KEY.");
-    }
     return {
         apiBaseUrl: normalizeHttpUrl(apiBaseUrl, "Tapi API base URL"),
-        apiKey,
         projectId,
         displayName,
         maxSlots,
@@ -892,7 +918,6 @@ function parseQueueCreateOptions(args) {
 function parseTappQueueAddOptions(args) {
     const workspace = loadWorkspace();
     let apiBaseUrl = envString("TAPI_BASE_URL") || workspace?.apiBaseUrl || DEFAULT_STUDIO_API_BASE_URL;
-    let apiKey = envString("TAPI_API_KEY") || "";
     let tappId = "";
     let queueId = "";
     for (let index = 0; index < args.length; index += 1) {
@@ -911,14 +936,6 @@ function parseTappQueueAddOptions(args) {
             apiBaseUrl = arg.slice("--server=".length);
             continue;
         }
-        if (arg === "--api-key") {
-            apiKey = requireOptionValue(args, ++index, "--api-key");
-            continue;
-        }
-        if (arg.startsWith("--api-key=")) {
-            apiKey = arg.slice("--api-key=".length);
-            continue;
-        }
         if (arg.startsWith("--")) {
             throw new Error(`Unknown tapp queue add option: ${arg}`);
         }
@@ -932,9 +949,6 @@ function parseTappQueueAddOptions(args) {
         }
         throw new Error(`Unexpected tapp queue add argument: ${arg}`);
     }
-    if (!apiKey) {
-        throw new Error("tapp queue add requires --api-key or TAPI_API_KEY.");
-    }
     if (!tappId) {
         throw new Error("tapp queue add requires a Tapp id.");
     }
@@ -943,7 +957,6 @@ function parseTappQueueAddOptions(args) {
     }
     return {
         apiBaseUrl: normalizeHttpUrl(apiBaseUrl, "Tapi API base URL"),
-        apiKey,
         tappId,
         queueId,
     };
@@ -951,7 +964,6 @@ function parseTappQueueAddOptions(args) {
 function parseRunnerSlotSetOptions(args) {
     const workspace = loadWorkspace();
     let apiBaseUrl = envString("TAPI_BASE_URL") || workspace?.apiBaseUrl || DEFAULT_STUDIO_API_BASE_URL;
-    let apiKey = envString("TAPI_API_KEY") || "";
     let projectId = envString("TAPI_PROJECT_ID") || workspace?.projectId || "";
     let runnerId = "";
     let slotIndex = 0;
@@ -972,14 +984,6 @@ function parseRunnerSlotSetOptions(args) {
             apiBaseUrl = arg.slice("--server=".length);
             continue;
         }
-        if (arg === "--api-key") {
-            apiKey = requireOptionValue(args, ++index, "--api-key");
-            continue;
-        }
-        if (arg.startsWith("--api-key=")) {
-            apiKey = arg.slice("--api-key=".length);
-            continue;
-        }
         if (arg === "--project") {
             projectId = normalizeProjectValue(requireOptionValue(args, ++index, "--project"), "project");
             continue;
@@ -1005,9 +1009,6 @@ function parseRunnerSlotSetOptions(args) {
         }
         throw new Error(`Unexpected runner slot set argument: ${arg}`);
     }
-    if (!apiKey) {
-        throw new Error("runner slot set requires --api-key or TAPI_API_KEY.");
-    }
     if (!projectId) {
         throw new Error("runner slot set requires --project or TAPI_PROJECT_ID.");
     }
@@ -1022,7 +1023,6 @@ function parseRunnerSlotSetOptions(args) {
     }
     return {
         apiBaseUrl: normalizeHttpUrl(apiBaseUrl, "Tapi API base URL"),
-        apiKey,
         projectId,
         runnerId,
         slotIndex,
@@ -1031,7 +1031,7 @@ function parseRunnerSlotSetOptions(args) {
 }
 async function createQueue(args) {
     try {
-        const options = parseQueueCreateOptions(args);
+        const options = await withSdkAuth(parseQueueCreateOptions(args));
         const queue = await withCliSpinner(`Creating Tapi queue`, () => postQueueCreate(options));
         console.log(JSON.stringify(queue, null, 2));
         return 0;
@@ -1043,7 +1043,7 @@ async function createQueue(args) {
 }
 async function addTappQueue(args) {
     try {
-        const options = parseTappQueueAddOptions(args);
+        const options = await withSdkAuth(parseTappQueueAddOptions(args));
         const result = await withCliSpinner(`Attaching Tapi queue ${options.queueId} to ${options.tappId}`, () => postTappQueueAdd(options));
         console.log(JSON.stringify(result, null, 2));
         return 0;
@@ -1055,7 +1055,7 @@ async function addTappQueue(args) {
 }
 async function setRunnerSlot(args) {
     try {
-        const options = parseRunnerSlotSetOptions(args);
+        const options = await withSdkAuth(parseRunnerSlotSetOptions(args));
         const result = await withCliSpinner(`Assigning runner slot ${options.runnerId}/${options.slotIndex} to queue ${options.queueId}`, () => putRunnerSlot(options));
         console.log(JSON.stringify(result, null, 2));
         return 0;
@@ -1066,13 +1066,7 @@ async function setRunnerSlot(args) {
     }
 }
 async function postQueueCreate(options) {
-    const headers = {
-        "Content-Type": "application/json",
-        "X-API-Key": options.apiKey,
-    };
-    if (options.projectId) {
-        headers["X-Tapi-Project"] = options.projectId;
-    }
+    const headers = sdkJsonHeaders(options.authToken, options.projectId);
     const response = await fetch(`${options.apiBaseUrl.replace(/\/+$/, "")}/api/sdk/v1/queues`, {
         method: "POST",
         headers,
@@ -1091,11 +1085,7 @@ async function postQueueCreate(options) {
 async function postTappQueueAdd(options) {
     const response = await fetch(`${options.apiBaseUrl.replace(/\/+$/, "")}/api/sdk/v1/tapps/${encodeURIComponent(options.tappId)}/queues`, {
         method: "POST",
-        headers: {
-            "Content-Type": "application/json",
-            "X-API-Key": options.apiKey,
-            "X-Tapi-Project": options.tappId,
-        },
+        headers: sdkJsonHeaders(options.authToken, options.tappId),
         body: JSON.stringify({ queueId: options.queueId }),
     });
     const body = await readJsonBody(response);
@@ -1108,11 +1098,7 @@ async function postTappQueueAdd(options) {
 async function putRunnerSlot(options) {
     const response = await fetch(`${options.apiBaseUrl.replace(/\/+$/, "")}/api/sdk/v1/runners/${encodeURIComponent(options.runnerId)}/slots/${encodeURIComponent(String(options.slotIndex))}`, {
         method: "PUT",
-        headers: {
-            "Content-Type": "application/json",
-            "X-API-Key": options.apiKey,
-            "X-Tapi-Project": options.projectId,
-        },
+        headers: sdkJsonHeaders(options.authToken, options.projectId),
         body: JSON.stringify({ queueId: options.queueId }),
     });
     const body = await readJsonBody(response);
@@ -1125,7 +1111,6 @@ async function putRunnerSlot(options) {
 export function parseRunnerSetupOptions(args) {
     const workspace = loadWorkspace();
     let apiBaseUrl = envString("TAPI_BASE_URL") || workspace?.apiBaseUrl || DEFAULT_STUDIO_API_BASE_URL;
-    let apiKey = envString("TAPI_API_KEY") || "";
     let projectId = envString("TAPI_PROJECT_ID") || workspace?.projectId || "";
     let runnerId = envString("TAPI_RUNNER_ID") || "";
     let port = Number(envString("TAPI_RUNNER_SETUP_PORT") || "17687");
@@ -1146,14 +1131,6 @@ export function parseRunnerSetupOptions(args) {
             apiBaseUrl = arg.slice("--server=".length);
             continue;
         }
-        if (arg === "--api-key") {
-            apiKey = requireOptionValue(args, ++index, "--api-key");
-            continue;
-        }
-        if (arg.startsWith("--api-key=")) {
-            apiKey = arg.slice("--api-key=".length);
-            continue;
-        }
         if (arg === "--project") {
             projectId = normalizeProjectValue(requireOptionValue(args, ++index, "--project"), "project");
             continue;
@@ -1191,9 +1168,6 @@ export function parseRunnerSetupOptions(args) {
         }
         throw new Error(`Unexpected runner setup argument: ${arg}`);
     }
-    if (!apiKey) {
-        throw new Error("runner setup requires --api-key or TAPI_API_KEY.");
-    }
     if (!projectId) {
         throw new Error("runner setup requires --project or TAPI_PROJECT_ID.");
     }
@@ -1205,7 +1179,6 @@ export function parseRunnerSetupOptions(args) {
     }
     return {
         apiBaseUrl: normalizeHttpUrl(apiBaseUrl, "Tapi API base URL"),
-        apiKey,
         projectId,
         runnerId,
         port,
@@ -1214,7 +1187,7 @@ export function parseRunnerSetupOptions(args) {
 }
 async function runRunnerSetup(args) {
     try {
-        const options = parseRunnerSetupOptions(args);
+        const options = await withSdkAuth(parseRunnerSetupOptions(args));
         const handle = await startRunnerSetupServer(options);
         if (options.openBrowser) {
             openUrlInBrowser(handle.url);
@@ -1252,7 +1225,7 @@ export async function executeRunnerSetupAction(options, action, fetchImpl = fetc
     if (!queueId) {
         queue = await sdkJsonRequest(fetchImpl, `${options.apiBaseUrl.replace(/\/+$/, "")}/api/sdk/v1/queues`, {
             method: "POST",
-            headers: sdkJsonHeaders(options.apiKey, options.projectId),
+            headers: sdkJsonHeaders(options.authToken, options.projectId),
             body: JSON.stringify({
                 displayName: String(action.displayName || `${options.projectId} queue`).trim(),
                 maxSlots,
@@ -1265,7 +1238,7 @@ export async function executeRunnerSetupAction(options, action, fetchImpl = fetc
     }
     const attachment = await sdkJsonRequest(fetchImpl, `${options.apiBaseUrl.replace(/\/+$/, "")}/api/sdk/v1/tapps/${encodeURIComponent(options.projectId)}/queues`, {
         method: "POST",
-        headers: sdkJsonHeaders(options.apiKey, options.projectId),
+        headers: sdkJsonHeaders(options.authToken, options.projectId),
         body: JSON.stringify({ queueId }),
     });
     const slots = [];
@@ -1273,7 +1246,7 @@ export async function executeRunnerSetupAction(options, action, fetchImpl = fetc
         const slotIndex = slotStart + offset;
         slots.push(await sdkJsonRequest(fetchImpl, `${options.apiBaseUrl.replace(/\/+$/, "")}/api/sdk/v1/runners/${encodeURIComponent(options.runnerId)}/slots/${encodeURIComponent(String(slotIndex))}`, {
             method: "PUT",
-            headers: sdkJsonHeaders(options.apiKey, options.projectId),
+            headers: sdkJsonHeaders(options.authToken, options.projectId),
             body: JSON.stringify({ queueId }),
         }));
     }
@@ -1416,12 +1389,22 @@ async function sdkJsonRequest(fetchImpl, url, init) {
     }
     return body ?? {};
 }
-function sdkJsonHeaders(apiKey, projectId) {
-    return {
+function sdkJsonHeaders(authToken, projectId) {
+    const headers = {
         "Content-Type": "application/json",
-        "X-API-Key": apiKey,
-        "X-Tapi-Project": projectId,
+        Authorization: `Bearer ${requireSdkAuthToken(authToken)}`,
     };
+    if (projectId) {
+        headers["X-Tapi-Project"] = projectId;
+    }
+    return headers;
+}
+function requireSdkAuthToken(authToken) {
+    const normalized = String(authToken || "").trim();
+    if (!normalized) {
+        throw new Error("Tapi sign-in is required. Run `tapi login`, then retry.");
+    }
+    return normalized;
 }
 function coercePositiveInteger(value, fallback, label) {
     const text = value === undefined || value === null || value === "" ? String(fallback) : String(value);
@@ -1444,7 +1427,6 @@ function parseNonNegativeInteger(value, label) {
 function parseTriggerSyncOptions(args) {
     const workspace = loadWorkspace();
     let apiBaseUrl = envString("TAPI_BASE_URL") || workspace?.apiBaseUrl || DEFAULT_STUDIO_API_BASE_URL;
-    let apiKey = envString("TAPI_API_KEY") || "";
     let projectId = envString("TAPI_PROJECT_ID") || workspace?.projectId || "";
     let configPath = "";
     const root = workspace?.root || process.cwd();
@@ -1464,14 +1446,6 @@ function parseTriggerSyncOptions(args) {
             apiBaseUrl = arg.slice("--server=".length);
             continue;
         }
-        if (arg === "--api-key") {
-            apiKey = requireOptionValue(args, ++index, "--api-key");
-            continue;
-        }
-        if (arg.startsWith("--api-key=")) {
-            apiKey = arg.slice("--api-key=".length);
-            continue;
-        }
         if (arg === "--project") {
             projectId = normalizeProjectValue(requireOptionValue(args, ++index, "--project"), "project");
             continue;
@@ -1490,29 +1464,25 @@ function parseTriggerSyncOptions(args) {
         }
         throw new Error(`Unknown triggers option: ${arg}`);
     }
-    if (!apiKey) {
-        throw new Error("triggers sync requires --api-key or TAPI_API_KEY.");
-    }
     if (!projectId) {
         throw new Error("triggers sync requires --project, TAPI_PROJECT_ID, or .tapi/project.json.");
     }
     return {
         apiBaseUrl: normalizeHttpUrl(apiBaseUrl, "Tapi API base URL"),
-        apiKey,
         projectId,
         configPath: configPath ? resolve(root, configPath) : defaultTriggerConfigPath(root),
     };
 }
 async function syncServiceTriggers(args) {
     try {
-        const options = parseTriggerSyncOptions(args);
+        const options = await withSdkAuth(parseTriggerSyncOptions(args));
         const triggers = await readServiceTriggerConfig(options.configPath);
         if (triggers.length === 0) {
             throw new Error(`No Tapi service triggers found in ${options.configPath}.`);
         }
         const client = new TapiClient({
             baseUrl: options.apiBaseUrl,
-            apiKey: options.apiKey,
+            authToken: options.authToken,
             tappId: options.projectId,
             projectId: options.projectId,
         });
@@ -1532,7 +1502,6 @@ async function syncServiceTriggers(args) {
 function parseSessionsOptions(args) {
     const workspace = loadWorkspace();
     let apiBaseUrl = envString("TAPI_BASE_URL") || workspace?.apiBaseUrl || DEFAULT_STUDIO_API_BASE_URL;
-    let apiKey = envString("TAPI_API_KEY") || "";
     let projectId = envString("TAPI_PROJECT_ID") || workspace?.projectId || "";
     let site = "";
     let sessionId = "";
@@ -1554,14 +1523,6 @@ function parseSessionsOptions(args) {
             apiBaseUrl = arg.slice("--server=".length);
             continue;
         }
-        if (arg === "--api-key") {
-            apiKey = requireOptionValue(args, ++index, "--api-key");
-            continue;
-        }
-        if (arg.startsWith("--api-key=")) {
-            apiKey = arg.slice("--api-key=".length);
-            continue;
-        }
         if (arg === "--project") {
             projectId = normalizeProjectValue(requireOptionValue(args, ++index, "--project"), "project");
             continue;
@@ -1596,9 +1557,6 @@ function parseSessionsOptions(args) {
         }
         throw new Error(`Unexpected sessions argument: ${arg}`);
     }
-    if (!apiKey) {
-        throw new Error("sessions command requires --api-key or TAPI_API_KEY.");
-    }
     if (!projectId) {
         throw new Error("sessions command requires --project, TAPI_PROJECT_ID, or .tapi/project.json.");
     }
@@ -1606,7 +1564,6 @@ function parseSessionsOptions(args) {
         sessionId,
         options: {
             apiBaseUrl: normalizeHttpUrl(apiBaseUrl, "Tapi API base URL"),
-            apiKey,
             projectId,
             site: site || undefined,
             json,
@@ -1617,18 +1574,19 @@ function parseSessionsOptions(args) {
 async function listDevSessions(args) {
     try {
         const { options } = parseSessionsOptions(args);
-        const sessions = await fetchDevSessions(options);
-        if (options.json) {
+        const authenticated = await withSdkAuth(options);
+        const sessions = await fetchDevSessions(authenticated);
+        if (authenticated.json) {
             console.log(JSON.stringify(sessions, null, 2));
             return 0;
         }
         const rows = flattenDevSessions(sessions);
         if (rows.length === 0) {
-            console.log(`No Tapi dev sessions found for project ${sessions.projectId || options.projectId}.`);
+            console.log(`No Tapi dev sessions found for project ${sessions.projectId || authenticated.projectId}.`);
             return 0;
         }
-        if (!options.noInteractive && process.stdin.isTTY && process.stdout.isTTY && rows.some((session) => session.openable)) {
-            return await runSessionsPicker(sessions, options);
+        if (!authenticated.noInteractive && process.stdin.isTTY && process.stdout.isTTY && rows.some((session) => session.openable)) {
+            return await runSessionsPicker(sessions, authenticated);
         }
         console.log(renderDevSessions(sessions));
         const openable = rows.find((session) => session.openable);
@@ -1645,15 +1603,16 @@ async function listDevSessions(args) {
 async function openDevSession(args) {
     try {
         const { sessionId, options } = parseSessionsOptions(args);
+        const authenticated = await withSdkAuth(options);
         if (!sessionId) {
             throw new Error("sessions open requires a session id.");
         }
-        const sessions = await fetchDevSessions(options);
+        const sessions = await fetchDevSessions(authenticated);
         const session = findDevSession(sessions, sessionId);
         if (!session) {
             throw new Error(`Tapi session not found: ${sessionId}`);
         }
-        return await openDevSessionInStudio(session, options);
+        return await openDevSessionInStudio(session, authenticated);
     }
     catch (error) {
         console.error(formatError(error));
@@ -1663,7 +1622,7 @@ async function openDevSession(args) {
 async function fetchDevSessions(options) {
     const client = new TapiClient({
         baseUrl: options.apiBaseUrl,
-        apiKey: options.apiKey,
+        authToken: options.authToken,
         tappId: options.projectId,
         projectId: options.projectId,
     });
@@ -2103,7 +2062,7 @@ function rejectNonPolicyTriggerRuntimeOwner(runtime, fieldName) {
 async function fetchApiCatalog(options) {
     const client = new TapiClient({
         baseUrl: options.apiBaseUrl,
-        apiKey: options.apiKey,
+        authToken: options.authToken,
         tappId: options.projectId,
         projectId: options.projectId,
     });
@@ -2425,7 +2384,7 @@ async function installService(options) {
                 destination: zipPath,
                 expectedSha256: manifest.sha256,
             });
-            await withCliSpinner(`Downloading Tapi Service ${manifest.version}`, () => downloadAndVerify(manifest.url, zipPath, manifest.sha256, "Tapi Service artifact"));
+            await downloadAndVerify(manifest.url, zipPath, manifest.sha256, "Tapi Service artifact");
             await event.phase("download.verified", {
                 zipPath,
                 expectedSha256: manifest.sha256,
@@ -2880,7 +2839,7 @@ async function installStudio(options) {
                 destination: installerPath,
                 expectedSha256: manifest.sha256,
             });
-            await withCliSpinner(`Downloading Tapi Studio ${manifest.version}`, () => downloadAndVerify(manifest.url, installerPath, manifest.sha256));
+            await downloadAndVerify(manifest.url, installerPath, manifest.sha256);
             await event.phase("download.verified", {
                 installerPath,
                 expectedSha256: manifest.sha256,
@@ -3033,23 +2992,24 @@ async function openStudio(options) {
     if (options.downloadOnly) {
         throw new Error("--download-only is only supported with `tapi studio install`.");
     }
-    await ensureServiceReadyForStudio(options);
+    const launchOptions = await resolveStudioTappSelection(options);
+    await ensureServiceReadyForStudio(launchOptions);
     await closeExistingPortableStudioServersForFreshLaunch();
-    if (!options.exePath) {
-        const portable = await ensurePortableStudioServer(options);
+    if (!launchOptions.exePath) {
+        const portable = await ensurePortableStudioServer(launchOptions);
         if (portable) {
-            await launchPortableStudioServer(portable.exePath, options, portable.manifest);
+            await launchPortableStudioServer(portable.exePath, launchOptions, portable.manifest);
             return 0;
         }
     }
-    let exePath = findStudioExecutable(options);
-    if (!exePath && !options.exePath) {
+    let exePath = findStudioExecutable(launchOptions);
+    if (!exePath && !launchOptions.exePath) {
         console.log("Tapi Studio executable was not found. Installing Tapi Studio now...");
-        const installCode = await installStudio(options);
+        const installCode = await installStudio(launchOptions);
         if (installCode !== 0) {
             return installCode;
         }
-        exePath = findStudioExecutable(options);
+        exePath = findStudioExecutable(launchOptions);
     }
     if (!exePath || !existsSync(exePath)) {
         console.error("Tapi Studio executable was not found.");
@@ -3058,7 +3018,7 @@ async function openStudio(options) {
     }
     const child = spawn(exePath, [], {
         detached: true,
-        env: buildStudioLaunchEnv(options),
+        env: buildStudioLaunchEnv(launchOptions),
         stdio: "ignore",
         windowsHide: false,
     });
@@ -3066,6 +3026,177 @@ async function openStudio(options) {
     console.log(`Opened Tapi Studio: ${exePath}`);
     return 0;
 }
+async function resolveStudioTappSelection(options) {
+    if (options.tappSelectionMode === "none") {
+        return options.projectId ? await rememberSelectedStudioTapp(options, options.projectId) : options;
+    }
+    if (options.tappSelectionMode === "auto" && options.projectIdSource === "env" && options.projectId) {
+        return await rememberSelectedStudioTapp(options, options.projectId);
+    }
+    const lastSelection = await readStudioSelectionRecord();
+    if (options.tappSelectionMode === "last") {
+        if (!lastSelection?.lastTappId) {
+            throw new Error("No previous Studio Tapp selection exists. Run `tapi studio --select` or `tapi studio --tapp <tapp>`.");
+        }
+        return await rememberSelectedStudioTapp(options, lastSelection.lastTappId);
+    }
+    let tapps = [];
+    try {
+        const authenticated = await withSdkAuth({ authToken: undefined });
+        tapps = await fetchAvailableTappsForStudio(options, authenticated.authToken);
+    }
+    catch (error) {
+        if (options.projectId) {
+            console.warn(`Could not load Tapp list (${formatError(error)}). Opening Studio with ${options.projectId}.`);
+            return await rememberSelectedStudioTapp(options, options.projectId);
+        }
+        throw error;
+    }
+    if (!tapps.length) {
+        if (options.projectId) {
+            return await rememberSelectedStudioTapp(options, options.projectId);
+        }
+        throw new Error("No Tapps found for this account. Create one with `tapi tapp create <name>`, then run `tapi studio`.");
+    }
+    const preferred = preferredStudioTappId(options, lastSelection, tapps);
+    if (!studioTappPickerEnabled()) {
+        const selected = options.projectId
+            || lastSelection?.lastTappId
+            || (tapps.length === 1 ? tapps[0]?.tappId : "");
+        if (!selected) {
+            throw new Error("Multiple Tapps are available. Use `tapi studio --tapp <tapp>` or run in an interactive terminal.");
+        }
+        return await rememberSelectedStudioTapp(options, selected);
+    }
+    const selected = await select({
+        message: "Select Tapp",
+        choices: tapps.map((tapp) => ({
+            name: formatTappChoice(tapp),
+            value: tapp.tappId,
+        })),
+        default: preferred || tapps[0]?.tappId,
+    });
+    return await rememberSelectedStudioTapp(options, selected);
+}
+async function fetchAvailableTappsForStudio(options, authToken, fetchImpl = fetch) {
+    const response = await fetchImpl(`${options.apiBaseUrl.replace(/\/+$/, "")}/api/sdk/v1/tapps`, {
+        method: "GET",
+        headers: sdkJsonHeaders(authToken, options.projectId),
+    });
+    const body = await readJsonBody(response);
+    if (!response.ok) {
+        throw new Error(`Failed to list Tapps: HTTP ${response.status}`);
+    }
+    return normalizeTappList(body);
+}
+function normalizeTappList(body) {
+    const raw = isRecord(body) && Array.isArray(body.tapps) ? body.tapps : [];
+    const seen = new Set();
+    const tapps = [];
+    for (const item of raw) {
+        if (!isRecord(item)) {
+            continue;
+        }
+        const tappId = typeof item.tappId === "string" ? item.tappId.trim() : "";
+        if (!tappId || seen.has(tappId)) {
+            continue;
+        }
+        seen.add(tappId);
+        tapps.push({
+            tappId,
+            name: typeof item.name === "string" && item.name.trim() ? item.name.trim() : tappId,
+            serviceCount: normalizeNonnegativeInteger(item.serviceCount),
+            queueCount: normalizeNonnegativeInteger(item.queueCount),
+        });
+    }
+    return tapps;
+}
+function normalizeNonnegativeInteger(value) {
+    const number = typeof value === "number" ? value : Number(value);
+    return Number.isFinite(number) && number > 0 ? Math.floor(number) : 0;
+}
+function preferredStudioTappId(options, lastSelection, tapps) {
+    const candidates = [
+        options.projectId,
+        lastSelection?.lastTappId,
+        tapps[0]?.tappId,
+    ].map((value) => String(value || "").trim()).filter(Boolean);
+    const available = new Set(tapps.map((tapp) => tapp.tappId));
+    return candidates.find((candidate) => available.has(candidate)) || "";
+}
+function formatTappChoice(tapp) {
+    const details = [
+        `${tapp.serviceCount} service${tapp.serviceCount === 1 ? "" : "s"}`,
+        `${tapp.queueCount} queue${tapp.queueCount === 1 ? "" : "s"}`,
+    ].join(", ");
+    return tapp.name === tapp.tappId
+        ? `${tapp.tappId} ${pc.dim(`(${details})`)}`
+        : `${tapp.name} ${pc.dim(`${tapp.tappId} (${details})`)}`;
+}
+function studioTappPickerEnabled() {
+    if (!process.stdin.isTTY || !process.stdout.isTTY) {
+        return false;
+    }
+    const raw = String(process.env.TAPI_STUDIO_TAPP_PICKER || "").trim().toLowerCase();
+    if (["0", "false", "no", "off"].includes(raw)) {
+        return false;
+    }
+    return true;
+}
+async function rememberSelectedStudioTapp(options, tappId) {
+    const selected = normalizeProjectValue(tappId, "tapp");
+    const projectSlug = options.projectId === selected && options.projectSlug
+        ? options.projectSlug
+        : selected;
+    await writeStudioSelectionRecord(selected);
+    return {
+        ...options,
+        projectId: selected,
+        projectSlug,
+        projectIdSource: "selection",
+        workspaceMode: true,
+        launchUrlQuery: studioLaunchQueryWithProject(options.launchUrlQuery, selected),
+    };
+}
+function studioLaunchQueryWithProject(query, projectId) {
+    const params = new URLSearchParams(String(query || "").replace(/^\?+/, ""));
+    params.set("project", projectId);
+    return params.toString();
+}
+async function readStudioSelectionRecord() {
+    try {
+        const payload = JSON.parse(await readFile(studioSelectionRecordPath(), "utf8"));
+        if (!isRecord(payload) || payload.version !== 1) {
+            return null;
+        }
+        const lastTappId = typeof payload.lastTappId === "string" ? payload.lastTappId.trim() : "";
+        if (!lastTappId) {
+            return null;
+        }
+        return {
+            version: 1,
+            lastTappId,
+            updatedAt: typeof payload.updatedAt === "string" ? payload.updatedAt : "",
+        };
+    }
+    catch (error) {
+        if (error.code === "ENOENT") {
+            return null;
+        }
+        return null;
+    }
+}
+async function writeStudioSelectionRecord(tappId) {
+    await mkdir(getDefaultTapiDataDir(), { recursive: true });
+    await writeJsonFile(studioSelectionRecordPath(), {
+        version: 1,
+        lastTappId: tappId,
+        updatedAt: new Date().toISOString(),
+    });
+}
+function studioSelectionRecordPath() {
+    return join(getDefaultTapiDataDir(), "studio-selection.json");
+}
 function findStudioExecutable(options) {
     if (options.exePath) {
         return existsSync(options.exePath) ? options.exePath : undefined;
@@ -3136,7 +3267,7 @@ async function installPortableStudioServer(options, manifest, event) {
             destination: artifactPath,
             expectedSha256: manifest.sha256,
         });
-        await withCliSpinner(`Downloading Tapi Studio server ${manifest.version}`, () => downloadAndVerify(manifest.url, artifactPath, manifest.sha256, "Tapi Studio server artifact"));
+        await downloadAndVerify(manifest.url, artifactPath, manifest.sha256, "Tapi Studio server artifact");
         await event.phase("download.verified", {
             artifactPath,
             expectedSha256: manifest.sha256,
@@ -3198,6 +3329,7 @@ async function launchPortableStudioServer(exePath, options, manifest) {
         pid: childPid || undefined,
         apiBaseUrl: options.apiBaseUrl,
         projectId: options.projectId,
+        tappId: options.projectId,
         workspaceRoot: options.workspaceRoot,
         workspaceConfig: options.workspace?.configPath,
         manifestVersion: manifest.version,
@@ -3503,6 +3635,8 @@ async function downloadFile(url, destination, label = "download", options = {})
     let destinationStream;
     let receivedBytes = 0;
     let nextProgressLogBytes = DOWNLOAD_PROGRESS_LOG_BYTES;
+    let progressBar;
+    let expectedBytes = 0;
     const failIfStalled = (phase) => {
         if (stallTimer) {
             clearTimeout(stallTimer);
@@ -3516,7 +3650,6 @@ async function downloadFile(url, destination, label = "download", options = {})
         }, stallTimeoutMs);
     };
     try {
-        console.log(`Downloading ${label}...`);
         failIfStalled("connecting");
         const response = await fetch(url, { signal: controller.signal });
         if (!response.ok) {
@@ -3526,12 +3659,29 @@ async function downloadFile(url, destination, label = "download", options = {})
             throw new Error(`${label} response did not include a body.`);
         }
         failIfStalled("receiving data");
+        expectedBytes = parseContentLength(typeof response.headers?.get === "function" ? response.headers.get("content-length") : null);
+        progressBar = createDownloadProgressBar(label, expectedBytes);
+        if (progressBar) {
+            progressBar.start(expectedBytes, 0, {
+                value: formatBytes(0),
+                total: formatBytes(expectedBytes),
+            });
+        }
+        else {
+            console.log(`Downloading ${label}...`);
+        }
         source = Readable.fromWeb(response.body);
         progressStream = new Transform({
             transform(chunk, _encoding, callback) {
                 receivedBytes += downloadChunkByteLength(chunk);
                 failIfStalled("receiving data");
-                if (receivedBytes >= nextProgressLogBytes) {
+                if (progressBar) {
+                    progressBar.update(Math.min(receivedBytes, expectedBytes), {
+                        value: formatBytes(receivedBytes),
+                        total: formatBytes(expectedBytes),
+                    });
+                }
+                else if (receivedBytes >= nextProgressLogBytes) {
                     console.log(`Downloaded ${label}: ${formatBytes(receivedBytes)}...`);
                     while (receivedBytes >= nextProgressLogBytes) {
                         nextProgressLogBytes += DOWNLOAD_PROGRESS_LOG_BYTES;
@@ -3542,9 +3692,23 @@ async function downloadFile(url, destination, label = "download", options = {})
         });
         destinationStream = createWriteStream(destination);
         await pipeline(source, progressStream, destinationStream);
-        console.log(`Downloaded ${label}: ${formatBytes(receivedBytes)}.`);
+        if (progressBar) {
+            progressBar.update(expectedBytes, {
+                value: formatBytes(receivedBytes),
+                total: formatBytes(expectedBytes),
+            });
+            progressBar.stop();
+            progressBar = undefined;
+        }
+        else {
+            console.log(`Downloaded ${label}: ${formatBytes(receivedBytes)}.`);
+        }
     }
     catch (error) {
+        if (progressBar) {
+            progressBar.stop();
+            progressBar = undefined;
+        }
         if (stallError) {
             throw stallError;
         }
@@ -3800,6 +3964,7 @@ async function readStudioInstanceRecord(options) {
             pid: typeof parsed.pid === "number" && Number.isFinite(parsed.pid) ? parsed.pid : undefined,
             apiBaseUrl: typeof parsed.apiBaseUrl === "string" ? parsed.apiBaseUrl : "",
             projectId: typeof parsed.projectId === "string" ? parsed.projectId : undefined,
+            tappId: typeof parsed.tappId === "string" ? parsed.tappId : undefined,
             workspaceRoot: typeof parsed.workspaceRoot === "string" ? parsed.workspaceRoot : undefined,
             workspaceConfig: typeof parsed.workspaceConfig === "string" ? parsed.workspaceConfig : undefined,
             manifestVersion: typeof parsed.manifestVersion === "string" ? parsed.manifestVersion : undefined,
@@ -3925,6 +4090,31 @@ async function readJsonBody(response) {
         return null;
     }
 }
+function createDownloadProgressBar(label, totalBytes) {
+    if (!downloadProgressEnabled() || totalBytes <= 0) {
+        return undefined;
+    }
+    return new SingleBar({
+        format: `${label} |{bar}| {percentage}% | {value}/{total}`,
+        stream: process.stderr,
+        clearOnComplete: false,
+        hideCursor: true,
+        barsize: 32,
+        barCompleteChar: "#",
+        barIncompleteChar: "-",
+    }, Presets.shades_classic);
+}
+function downloadProgressEnabled() {
+    const raw = String(process.env.TAPI_CLI_PROGRESS || "").trim().toLowerCase();
+    if (["0", "false", "no", "off"].includes(raw)) {
+        return false;
+    }
+    return Boolean(process.stderr.isTTY);
+}
+function parseContentLength(value) {
+    const parsed = Number(value || "");
+    return Number.isFinite(parsed) && parsed > 0 ? Math.floor(parsed) : 0;
+}
 async function readRequestJson(request) {
     let body = "";
     for await (const chunk of request) {
@@ -4382,6 +4572,9 @@ function installEventOptions(options) {
         downloadOnly: options.downloadOnly,
         silent: options.silent,
         exePath: options.exePath,
+        projectId: options.projectId,
+        projectIdSource: options.projectIdSource,
+        tappSelectionMode: options.tappSelectionMode,
         installTokenProvided: Boolean(options.installToken),
         installTokenSource: options.installTokenSource,
     };
@@ -4508,11 +4701,14 @@ function readSdkVersion() {
 function printHelp() {
     console.log(`Tapi CLI
 
-Usage:
-  tapi init --project PROJECT
+Usage:
+  tapi login
+  tapi init --project PROJECT
   tapi link --project PROJECT
-  tapi studio install [--channel pilot] [--api-base-url URL]
-  tapi studio
+  tapi studio install [--channel pilot] [--api-base-url URL]
+  tapi studio
+  tapi studio --tapp <tapp>
+  tapi studio --select
   tapi studio open
   tapi studio doctor
   tapi tapp create <tapp>
@@ -4528,12 +4724,13 @@ Usage:
   tapi service status
   tapi doctor
 
-Commands:
-  init            Create .tapi/project.json for this repo
+Commands:
+  login           Sign in with Firebase credentials for SDK commands
+  init            Create .tapi/project.json for this repo
   link            Rebind this repo to an existing Tapi project
   studio install  Download, verify, and run the Tapi Studio installer
-  studio          Open Tapi Studio for this repo
-  studio open     Open Tapi Studio for this repo
+  studio          Open Tapi Studio for a selected Tapp
+  studio open     Open Tapi Studio for a selected Tapp
   studio doctor   Check local SDK and Studio release configuration
   tapp create     Create a Tapp
   queue create    Create a queue for service-run routing
@@ -4551,18 +4748,26 @@ Commands:
   doctor          Alias for studio doctor
 `);
 }
+function printLoginHelp() {
+    console.log(`Tapi login
+
+Usage:
+  tapi login
+
+Signs in with the browser and caches Firebase credentials for SDK commands.
+`);
+}
 function printTappHelp() {
     console.log(`Tapi Tapp commands
 
 Usage:
-  tapi tapp create <tapp> [--name NAME] [--api-base-url URL] [--api-key KEY]
-  tapi tapp service add <tapp> <service.call> --service-map ID --entry ENTRY [--api-base-url URL] [--api-key KEY]
-  tapi tapp queue add <tapp> <queue-id> [--api-base-url URL] [--api-key KEY]
+  tapi tapp create <tapp> [--name NAME] [--api-base-url URL]
+  tapi tapp service add <tapp> <service.call> --service-map ID --entry ENTRY [--api-base-url URL]
+  tapi tapp queue add <tapp> <queue-id> [--api-base-url URL]
 
 Options:
   --api-base-url <url>     Tapi API base URL
   --server <url>           Alias for --api-base-url
-  --api-key <key>          Tapi API key; defaults to TAPI_API_KEY
   --tapp-id <id>           Explicit Tapp id for tapp create
   --name <name>            Display name for tapp create
   --service-map <id>       Backing ServiceMap id
@@ -4574,12 +4779,11 @@ function printQueueHelp() {
     console.log(`Tapi queue commands
 
 Usage:
-  tapi queue create [display-name] [--max-slots N] [--project TAPP] [--api-base-url URL] [--api-key KEY]
+  tapi queue create [display-name] [--max-slots N] [--project TAPP] [--api-base-url URL]
 
 Options:
   --api-base-url <url>  Tapi API base URL
   --server <url>        Alias for --api-base-url
-  --api-key <key>       Tapi API key; defaults to TAPI_API_KEY
   --project <id>        Optional project scope for the queue request
   --max-slots <n>       Maximum runner slots this queue may use
 `);
@@ -4588,13 +4792,12 @@ function printRunnerHelp() {
     console.log(`Tapi runner commands
 
 Usage:
-  tapi runner setup --runner-id RUNNER --project TAPP [--port PORT] [--no-open] [--api-base-url URL] [--api-key KEY]
-  tapi runner slot set <runner-id> <slot-index> <queue-id> [--project TAPP] [--api-base-url URL] [--api-key KEY]
+  tapi runner setup --runner-id RUNNER --project TAPP [--port PORT] [--no-open] [--api-base-url URL]
+  tapi runner slot set <runner-id> <slot-index> <queue-id> [--project TAPP] [--api-base-url URL]
 
 Options:
   --api-base-url <url>  Tapi API base URL
   --server <url>        Alias for --api-base-url
-  --api-key <key>       Tapi API key; defaults to TAPI_API_KEY
   --project <id>        Tapi project id; defaults to TAPI_PROJECT_ID or .tapi/project.json
   --runner-id <id>      Runner id for setup; defaults to TAPI_RUNNER_ID
   --port <n>            Local setup UI port; defaults to 17687
@@ -4604,16 +4807,15 @@ Options:
 function printSessionsHelp() {
     console.log(`Tapi dev session commands
 
-Usage:
-  tapi sessions [--api-base-url URL] [--api-key KEY] [--project PROJECT]
-  tapi sessions list [--json] [--site SITE]
-  tapi sessions open <session-id> [--api-base-url URL] [--api-key KEY] [--project PROJECT]
-
-Options:
-  --api-base-url <url>   Tapi API base URL
-  --server <url>         Alias for --api-base-url
-  --api-key <key>        Tapi API key; defaults to TAPI_API_KEY
-  --project <id>         Tapi project id; defaults to TAPI_PROJECT_ID or .tapi/project.json
+Usage:
+  tapi sessions [--api-base-url URL] [--project PROJECT]
+  tapi sessions list [--json] [--site SITE]
+  tapi sessions open <session-id> [--api-base-url URL] [--project PROJECT]
+
+Options:
+  --api-base-url <url>   Tapi API base URL
+  --server <url>         Alias for --api-base-url
+  --project <id>         Tapi project id; defaults to TAPI_PROJECT_ID or .tapi/project.json
   --site <name>          Limit sessions to one sitemap/site
   --json                 Print raw grouped session JSON
   --no-interactive       Print the grouped list without the arrow-key picker
@@ -4622,30 +4824,28 @@ Options:
 function printServicesHelp() {
     console.log(`Tapi ServiceMap service-run commands
 
-Usage:
-  tapi services describe <servicemap.run> [--api-base-url URL] [--api-key KEY] [--project PROJECT]
-  tapi services sync [--api-base-url URL] [--api-key KEY] [--project PROJECT]
-
-Options:
-  --api-base-url <url>   Tapi API base URL
-  --server <url>         Alias for --api-base-url
-  --api-key <key>        Tapi API key; defaults to TAPI_API_KEY
-  --project <id>         Tapi project id; defaults to TAPI_PROJECT_ID or .tapi/project.json
+Usage:
+  tapi services describe <servicemap.run> [--api-base-url URL] [--project PROJECT]
+  tapi services sync [--api-base-url URL] [--project PROJECT]
+
+Options:
+  --api-base-url <url>   Tapi API base URL
+  --server <url>         Alias for --api-base-url
+  --project <id>         Tapi project id; defaults to TAPI_PROJECT_ID or .tapi/project.json
   --catalog <path>       Catalog JSON output path
 `);
 }
 function printTriggersHelp() {
     console.log(`Tapi service trigger commands
 
-Usage:
-  tapi triggers sync [--config FILE] [--api-base-url URL] [--api-key KEY] [--project PROJECT]
-
-Options:
-  --config <path>        Trigger config path; defaults to tapi.config.ts/js/json in the workspace root
-  --api-base-url <url>   Tapi API base URL
-  --server <url>         Alias for --api-base-url
-  --api-key <key>        Tapi API key; defaults to TAPI_API_KEY
-  --project <id>         Tapi project id; defaults to TAPI_PROJECT_ID or .tapi/project.json
+Usage:
+  tapi triggers sync [--config FILE] [--api-base-url URL] [--project PROJECT]
+
+Options:
+  --config <path>        Trigger config path; defaults to tapi.config.ts/js/json in the workspace root
+  --api-base-url <url>   Tapi API base URL
+  --server <url>         Alias for --api-base-url
+  --project <id>         Tapi project id; defaults to TAPI_PROJECT_ID or .tapi/project.json
 
 Config:
   export default {
@@ -4669,14 +4869,18 @@ Usage:
   tapi studio open [options]
   tapi studio doctor [options]
 
-Options:
-  --channel <name>       Release channel: pilot, stable, or nightly
-  --api-base-url <url>   Tapi API base URL for install authorization and protected downloads
-  --server <url>         Alias for --api-base-url
-  --workspace <path>     Search this directory for .tapi/project.json
-  --no-workspace         Do not load .tapi/project.json
-  --project <id>         Tapi project id for workspace-bound Studio
-  --project-slug <slug>  Optional display slug for the bound project
+Options:
+  --channel <name>       Release channel: pilot, stable, or nightly
+  --api-base-url <url>   Tapi API base URL for install authorization and protected downloads
+  --server <url>         Alias for --api-base-url
+  --tapp <id>            Open this Tapp directly
+  --select               Force the account Tapp picker
+  --last                 Reuse the last selected Tapp
+  --no-select            Skip the picker and use env/workspace/default context
+  --workspace <path>     Search this directory for .tapi/project.json
+  --no-workspace         Do not load .tapi/project.json
+  --project <id>         Alias for --tapp
+  --project-slug <slug>  Optional display slug for the bound project
   --install-token <tok>  Preissued Studio install token (skips browser sign-in)
   --manifest <url>       Exact release manifest URL for doctor only
   --cache-dir <path>     Installer download cache directory