@orchestraworks/cli 0.5.7 → 0.6.0

package/dist/generated/cli-commands.json

@@ -22819,6 +22819,26 @@
                             }
                         }
                     },
+                    "credentials": {
+                        "schema": {
+                            "kind": "array",
+                            "items": {
+                                "kind": "object",
+                                "fields": {
+                                    "credential": {
+                                        "schema": {
+                                            "kind": "scalar"
+                                        }
+                                    },
+                                    "replace": {
+                                        "schema": {
+                                            "kind": "scalar"
+                                        }
+                                    }
+                                }
+                            }
+                        }
+                    },
                     "kind": {
                         "schema": {
                             "kind": "scalar"
@@ -23188,6 +23208,26 @@
                             }
                         }
                     },
+                    "credentials": {
+                        "schema": {
+                            "kind": "array",
+                            "items": {
+                                "kind": "object",
+                                "fields": {
+                                    "credential": {
+                                        "schema": {
+                                            "kind": "scalar"
+                                        }
+                                    },
+                                    "replace": {
+                                        "schema": {
+                                            "kind": "scalar"
+                                        }
+                                    }
+                                }
+                            }
+                        }
+                    },
                     "kind": {
                         "schema": {
                             "kind": "scalar"
@@ -23614,6 +23654,26 @@
                             }
                         }
                     },
+                    "credentials": {
+                        "schema": {
+                            "kind": "array",
+                            "items": {
+                                "kind": "object",
+                                "fields": {
+                                    "credential": {
+                                        "schema": {
+                                            "kind": "scalar"
+                                        }
+                                    },
+                                    "replace": {
+                                        "schema": {
+                                            "kind": "scalar"
+                                        }
+                                    }
+                                }
+                            }
+                        }
+                    },
                     "kind": {
                         "schema": {
                             "kind": "scalar"
@@ -24075,6 +24135,26 @@
                                             }
                                         }
                                     },
+                                    "credentials": {
+                                        "schema": {
+                                            "kind": "array",
+                                            "items": {
+                                                "kind": "object",
+                                                "fields": {
+                                                    "credential": {
+                                                        "schema": {
+                                                            "kind": "scalar"
+                                                        }
+                                                    },
+                                                    "replace": {
+                                                        "schema": {
+                                                            "kind": "scalar"
+                                                        }
+                                                    }
+                                                }
+                                            }
+                                        }
+                                    },
                                     "kind": {
                                         "schema": {
                                             "kind": "scalar"
@@ -24503,6 +24583,26 @@
                             }
                         }
                     },
+                    "credentials": {
+                        "schema": {
+                            "kind": "array",
+                            "items": {
+                                "kind": "object",
+                                "fields": {
+                                    "credential": {
+                                        "schema": {
+                                            "kind": "scalar"
+                                        }
+                                    },
+                                    "replace": {
+                                        "schema": {
+                                            "kind": "scalar"
+                                        }
+                                    }
+                                }
+                            }
+                        }
+                    },
                     "provisionSpec": {
                         "schema": {
                             "kind": "object",
@@ -24862,6 +24962,26 @@
                             }
                         }
                     },
+                    "credentials": {
+                        "schema": {
+                            "kind": "array",
+                            "items": {
+                                "kind": "object",
+                                "fields": {
+                                    "credential": {
+                                        "schema": {
+                                            "kind": "scalar"
+                                        }
+                                    },
+                                    "replace": {
+                                        "schema": {
+                                            "kind": "scalar"
+                                        }
+                                    }
+                                }
+                            }
+                        }
+                    },
                     "kind": {
                         "schema": {
                             "kind": "scalar"
@@ -46431,7 +46551,7 @@
                     "required": true,
                     "repeatable": false,
                     "credential": true,
-                    "description": "Secret value. This is write-only and is never returned by management APIs."
+                    "description": "Secret value. This is write-only and is never returned by management APIs. For git over HTTPS, store base64 of <user>:<token> as the value, such as the output of printf 'x-access-token:%s' \"$TOKEN\" | base64 | tr -d '\\n' for a GitHub token, and present it as Authorization: Basic ${secret}."
                 },
                 {
                     "name": "expires-at",
@@ -46531,6 +46651,14 @@
                                             "kind": "scalar"
                                         }
                                     }
+                                },
+                                "hosts": {
+                                    "schema": {
+                                        "kind": "array",
+                                        "items": {
+                                            "kind": "scalar"
+                                        }
+                                    }
                                 }
                             }
                         }
@@ -46640,18 +46768,18 @@
                                             "kind": "scalar"
                                         }
                                     }
+                                },
+                                "hosts": {
+                                    "schema": {
+                                        "kind": "array",
+                                        "items": {
+                                            "kind": "scalar"
+                                        }
+                                    }
                                 }
                             }
                         }
                     },
-                    "hosts": {
-                        "schema": {
-                            "kind": "array",
-                            "items": {
-                                "kind": "scalar"
-                            }
-                        }
-                    },
                     "usableBy": {
                         "schema": {
                             "kind": "array",
@@ -47095,18 +47223,18 @@
                                             "kind": "scalar"
                                         }
                                     }
+                                },
+                                "hosts": {
+                                    "schema": {
+                                        "kind": "array",
+                                        "items": {
+                                            "kind": "scalar"
+                                        }
+                                    }
                                 }
                             }
                         }
                     },
-                    "hosts": {
-                        "schema": {
-                            "kind": "array",
-                            "items": {
-                                "kind": "scalar"
-                            }
-                        }
-                    },
                     "usableBy": {
                         "schema": {
                             "kind": "array",
@@ -47571,18 +47699,18 @@
                                                             "kind": "scalar"
                                                         }
                                                     }
+                                                },
+                                                "hosts": {
+                                                    "schema": {
+                                                        "kind": "array",
+                                                        "items": {
+                                                            "kind": "scalar"
+                                                        }
+                                                    }
                                                 }
                                             }
                                         }
                                     },
-                                    "hosts": {
-                                        "schema": {
-                                            "kind": "array",
-                                            "items": {
-                                                "kind": "scalar"
-                                            }
-                                        }
-                                    },
                                     "usableBy": {
                                         "schema": {
                                             "kind": "array",
@@ -47968,7 +48096,7 @@
                     "required": false,
                     "repeatable": false,
                     "credential": true,
-                    "description": "Secret value. This is write-only and is never returned by management APIs."
+                    "description": "Secret value. This is write-only and is never returned by management APIs. For git over HTTPS, store base64 of <user>:<token> as the value, such as the output of printf 'x-access-token:%s' \"$TOKEN\" | base64 | tr -d '\\n' for a GitHub token, and present it as Authorization: Basic ${secret}."
                 },
                 {
                     "name": "expires-at",
@@ -48045,6 +48173,14 @@
                                             "kind": "scalar"
                                         }
                                     }
+                                },
+                                "hosts": {
+                                    "schema": {
+                                        "kind": "array",
+                                        "items": {
+                                            "kind": "scalar"
+                                        }
+                                    }
                                 }
                             }
                         }
@@ -48154,18 +48290,18 @@
                                             "kind": "scalar"
                                         }
                                     }
+                                },
+                                "hosts": {
+                                    "schema": {
+                                        "kind": "array",
+                                        "items": {
+                                            "kind": "scalar"
+                                        }
+                                    }
                                 }
                             }
                         }
                     },
-                    "hosts": {
-                        "schema": {
-                            "kind": "array",
-                            "items": {
-                                "kind": "scalar"
-                            }
-                        }
-                    },
                     "usableBy": {
                         "schema": {
                             "kind": "array",

package/dist/generated/providers.d.ts

@@ -547,6 +547,16 @@ export declare const Slack: {
         readonly SessionPerConversation: import("../constructs/provider-types.js").Binding<"slack::app_mention" | "slack::message" | "slack::message.im" | "slack::message.mpim">;
         readonly SessionPerThread: import("../constructs/provider-types.js").Binding<"slack::app_mention" | "slack::message" | "slack::message.im" | "slack::message.mpim">;
     };
+    readonly skill: {
+        /**
+         * Accepts a platform id or a slug interchangeably — one rule for every reference property, stated
+         * once on `IResource` (`constructs/interfaces.ts`). A catalog row is seeded with slug = id, so this
+         * one key is both at once.
+         */
+        readonly skillId: "skill_slack";
+        /** @internal — the reference this catalog skill contributes when passed (its `org_global` key). */
+        readonly _resourceId: () => string;
+    };
     readonly conversation: {
         readonly mention: import("../constructs/provider-types.js").ProviderEventHandle<"slack::app_mention">;
         readonly dm: import("../constructs/provider-types.js").ProviderEventHandle<"slack::message.im">;
@@ -605,6 +615,16 @@ export declare const Teams: {
         readonly SessionPerConversation: import("../constructs/provider-types.js").Binding<"teams::message">;
         readonly SessionPerThread: import("../constructs/provider-types.js").Binding<"teams::message">;
     };
+    readonly skill: {
+        /**
+         * Accepts a platform id or a slug interchangeably — one rule for every reference property, stated
+         * once on `IResource` (`constructs/interfaces.ts`). A catalog row is seeded with slug = id, so this
+         * one key is both at once.
+         */
+        readonly skillId: "skill_teams";
+        /** @internal — the reference this catalog skill contributes when passed (its `org_global` key). */
+        readonly _resourceId: () => string;
+    };
     readonly conversation: {
         readonly message: import("../constructs/provider-types.js").ProviderEventHandle<"teams::message">;
         readonly inChannel: () => ScopedCondition<"teams::message">;
@@ -1140,6 +1160,16 @@ export declare const Providers: {
             readonly SessionPerConversation: import("../constructs/provider-types.js").Binding<"slack::app_mention" | "slack::message" | "slack::message.im" | "slack::message.mpim">;
             readonly SessionPerThread: import("../constructs/provider-types.js").Binding<"slack::app_mention" | "slack::message" | "slack::message.im" | "slack::message.mpim">;
         };
+        readonly skill: {
+            /**
+             * Accepts a platform id or a slug interchangeably — one rule for every reference property, stated
+             * once on `IResource` (`constructs/interfaces.ts`). A catalog row is seeded with slug = id, so this
+             * one key is both at once.
+             */
+            readonly skillId: "skill_slack";
+            /** @internal — the reference this catalog skill contributes when passed (its `org_global` key). */
+            readonly _resourceId: () => string;
+        };
         readonly conversation: {
             readonly mention: import("../constructs/provider-types.js").ProviderEventHandle<"slack::app_mention">;
             readonly dm: import("../constructs/provider-types.js").ProviderEventHandle<"slack::message.im">;
@@ -1191,6 +1221,16 @@ export declare const Providers: {
             readonly SessionPerConversation: import("../constructs/provider-types.js").Binding<"teams::message">;
             readonly SessionPerThread: import("../constructs/provider-types.js").Binding<"teams::message">;
         };
+        readonly skill: {
+            /**
+             * Accepts a platform id or a slug interchangeably — one rule for every reference property, stated
+             * once on `IResource` (`constructs/interfaces.ts`). A catalog row is seeded with slug = id, so this
+             * one key is both at once.
+             */
+            readonly skillId: "skill_teams";
+            /** @internal — the reference this catalog skill contributes when passed (its `org_global` key). */
+            readonly _resourceId: () => string;
+        };
         readonly conversation: {
             readonly message: import("../constructs/provider-types.js").ProviderEventHandle<"teams::message">;
             readonly inChannel: () => ScopedCondition<"teams::message">;

package/dist/generated/providers.js

@@ -538,6 +538,20 @@ export const Slack = {
     conversational: true,
     events: slackEvents,
     bindings: slackBindings,
+    // The provider's catalog skill — attach it with `skills: [Slack.skill]`. A plain catalog literal
+    // satisfying `ISkill` rather than a registered plan import: a module-level constant has no construct
+    // scope to register one in. It skips synth-time plan-import registration only — at apply the ref still
+    // resolves through one idempotent getSkill, and boot validation guarantees the catalog row exists.
+    skill: {
+        /**
+         * Accepts a platform id or a slug interchangeably — one rule for every reference property, stated
+         * once on `IResource` (`constructs/interfaces.ts`). A catalog row is seeded with slug = id, so this
+         * one key is both at once.
+         */
+        skillId: "skill_slack",
+        /** @internal — the reference this catalog skill contributes when passed (its `org_global` key). */
+        _resourceId: () => "skill_slack",
+    },
     // The conversation authoring sugar, generated from the catalog conversation block.
     conversation: {
         mention: slackEvents.AppMention,
@@ -589,6 +603,20 @@ export const Teams = {
     conversational: true,
     events: teamsEvents,
     bindings: teamsBindings,
+    // The provider's catalog skill — attach it with `skills: [Teams.skill]`. A plain catalog literal
+    // satisfying `ISkill` rather than a registered plan import: a module-level constant has no construct
+    // scope to register one in. It skips synth-time plan-import registration only — at apply the ref still
+    // resolves through one idempotent getSkill, and boot validation guarantees the catalog row exists.
+    skill: {
+        /**
+         * Accepts a platform id or a slug interchangeably — one rule for every reference property, stated
+         * once on `IResource` (`constructs/interfaces.ts`). A catalog row is seeded with slug = id, so this
+         * one key is both at once.
+         */
+        skillId: "skill_teams",
+        /** @internal — the reference this catalog skill contributes when passed (its `org_global` key). */
+        _resourceId: () => "skill_teams",
+    },
     // The conversation authoring sugar, generated from the catalog conversation block.
     conversation: {
         message: teamsEvents.Message,
@@ -673,6 +701,8 @@ export const PROVIDER_SKILL_IDS = {
     "jira-classic": "skill_jira-classic",
     "linear": "skill_linear",
     "notion": "skill_notion",
+    "slack": "skill_slack",
+    "teams": "skill_teams",
     "zendesk": "skill_zendesk",
 };
 /**

package/docs/REFERENCE.md

@@ -131,29 +131,43 @@ export ORCHESTRA_API_TOKEN="…"            # any principal's bearer; the CLI ne
 export ORCHESTRA_ORGANIZATION_ID="org_…"
 ```
 
+Each `ORCHESTRA_` machine variable this page names also has a former `SFDK_` spelling. Until the rename's compatibility period ends ([D50](../../docs/specs/2026-10-03_2446_orchestra_rename_spec.md)), the platform and the worker still write the former spelling beside the new one, and every reader takes the new name first and the former one when the new one is absent.
+
 **The auth-provider chain** (one ordered chain for every command, presence is selection):
-`ORCHESTRA_API_TOKEN` → the `login` profile → the platform-injected machine edge flag
-(`SFDK_AUTH_EDGE_INJECTED`, which makes the CLI send the request **bare** so the egress edge
-stamps the agent's authorization — no credential ever enters the machine) → a named
-missing-credentials error. There is **no `--token` flag**: a token never appears in argv.
+`ORCHESTRA_API_TOKEN` → the file `ORCHESTRA_API_TOKEN_FILE` names → the `login` profile → the
+platform-injected machine edge flag (`ORCHESTRA_AUTH_EDGE_INJECTED`) → a named missing-credentials error.
+There is **no `--token` flag**: a token never appears in argv.
+
+- **The token file.** On an Orchestra machine, the worker writes the agent's own platform token to a
+  file and renews it before it expires. It sets `ORCHESTRA_API_TOKEN_FILE` to that file's path on each
+  agent process. The CLI reads the file again before each request, so a long `orchestra sessions wait`
+  always sends the current token. A missing, empty or unreadable file counts as absent. The worker sets
+  the path before it writes the file, so right after the agent starts, a command may report that the
+  file is not written yet.
+- **The edge flag.** On a machine behind the platform's network edge, the edge adds the agent's
+  authorization to each call to the platform. It replaces any token the request carried with a token for
+  the same agent. With the edge flag and no token, the CLI sends the request **bare**.
+- **A 401 under the token file.** The agent has nothing to renew. The token expired before the worker
+  renewed it, or the agent is no longer placed on the machine, the machine stopped, or the agent is not
+  active.
 
 **Resolved alongside the chain, per field:** the base URL (`--base-url` → `ORCHESTRA_BASE_URL`, then `PLATFORM_BASE_URL` → profile;
 `login` alone adds the built-in default as a fourth tier, because it is the command that has no profile
 to read yet — every other command needs one of the three, and says so if it has none)
-and the organization (`--org` → `ORCHESTRA_ORGANIZATION_ID` → profile; under the edge provider the organization
-rides the stamped identity server-side). Every authenticated request requires HTTPS or loopback — the
+and the organization (`--org` → `ORCHESTRA_ORGANIZATION_ID` → profile; under the token file and the edge flag
+the organization rides the agent's token server-side). Every authenticated request requires HTTPS or loopback — the
 bearer is itself a credential — with the unauthenticated `health` ping the one exemption. `diff`/`apply`
 print the resolved target org as a banner before any read/write, and warn when an exported
 `ORCHESTRA_ORGANIZATION_ID` diverges from the profile's org (so a stale export can't silently redirect writes).
 
-The conversation (`SFDK_SESSION_ID`, under every provider). The worker sets it on each harness process
+The conversation (`ORCHESTRA_SESSION_ID`, under every provider). The worker sets it on each harness process
 it starts, so a command an agent runs knows which conversation it is in. When it is set, `orchestra` adds
 `sessionId` to every JSON request body that has none: typed commands, `orchestra api`, `apply`, and the
 `login` and refresh token requests. A body that already names a `sessionId` is sent unchanged, so
 `artifacts create --session-id <id>` wins. Query strings, uploads and other non-JSON bodies are never
 changed, and an empty or whitespace-only value counts as unset. The platform checks a supplied session as
 usual. An artifact takes its project from the session, so a command that must publish into another project
-than its conversation's runs without the variable: `env -u SFDK_SESSION_ID orchestra artifacts create …`. A
+than its conversation's runs without the variable: `env -u ORCHESTRA_SESSION_ID orchestra artifacts create …`. A
 value you export by hand in your own shell applies the same way.
 
 ## 4. Author your first factory
@@ -807,7 +821,7 @@ subscription token rather than an API key:
 import { EgressPolicy, Secret, SecretValue } from "@orchestraworks/cli";
 
 new Secret(factory, "claude-sign-in", {
-  value: SecretValue.fromEnv("SFDK_CLAUDE_CODE_OAUTH_TOKEN"),
+  value: SecretValue.fromEnv("ORCHESTRA_FDK_CLAUDE_CODE_OAUTH_TOKEN"),
   hosts: ["api.anthropic.com"],
   injection: {
     headers: [{ name: "authorization", value: "Bearer ${secret}" }],
@@ -851,7 +865,7 @@ Agent.fromSlug(factory, "existing-agent");
 Environment.fromSlug(factory, "shared-runtime");
 Volume.fromSlug(factory, "cache-vol");
 Volume.fromId(factory, "volume_…");
-Connection.fromEnv(factory, "SFDK_ZENDESK_CONNECTION_ID", { provider: Providers.Zendesk });
+Connection.fromEnv(factory, "ORCHESTRA_FDK_ZENDESK_CONNECTION_ID", { provider: Providers.Zendesk });
 ```
 
 `Connection.fromEnv` resolves the connection id from `process.env` at apply, so **no tenant id
@@ -1057,8 +1071,8 @@ const ourSlackApp = new Connector(factory, "our-slack-app", {
   provider: Providers.Slack,
   clientId: "1234.5678",
   appId: "A0ACME",
-  clientSecret: new Secret(factory, "slack-client-secret", { value: SecretValue.fromEnv("SFDK_SLACK_CLIENT_SECRET") }),
-  signingSecret: new Secret(factory, "slack-signing-secret", { value: SecretValue.fromEnv("SFDK_SLACK_SIGNING_SECRET") }),
+  clientSecret: new Secret(factory, "slack-client-secret", { value: SecretValue.fromEnv("ORCHESTRA_FDK_SLACK_CLIENT_SECRET") }),
+  signingSecret: new Secret(factory, "slack-signing-secret", { value: SecretValue.fromEnv("ORCHESTRA_FDK_SLACK_SIGNING_SECRET") }),
 });
 
 const workspace = new Connection(factory, "workspace", {

package/node_modules/@orchestraworks/client/dist/esm/models/ApiErrorDetail.d.ts

@@ -16,7 +16,7 @@
  */
 export interface ApiErrorDetail {
     /**
-     * Present only when `code` is CREDENTIAL_UNAVAILABLE, ORGANIZATION_AUTH_POLICY_UNSATISFIED or SSO_CALLER_SESSION_REQUIRED. Published as a plain value rather than a closed enum because the shapes that carry `reason` do not agree on one value set. When `code` is CREDENTIAL_UNAVAILABLE: Closed denial-reason class explaining why the credential chain refused — one of secret_missing, secret_expired, refresh_failed, recipe_field_missing, policy_denied, ambiguous_match, connection_needs_attention, user_subject_required, user_grant_unavailable, conversation_not_attested, path_not_permitted, forge_credential_stale, install_declaration_invalid, provider_unavailable, internal_error, credential_not_found, use_denied, host_not_covered, machine_in_setup, credential_needs_https, plan_feature_disabled. When `code` is ORGANIZATION_AUTH_POLICY_UNSATISFIED or SSO_CALLER_SESSION_REQUIRED: Closed reason class naming the first policy check the session failed — one of ORGANIZATION_NOT_ACTIVE, SSO_ENFORCED_WITHOUT_BINDING, WRONG_IDENTITY_PROVIDER, AUTHENTICATION_METHOD_NOT_ALLOWED, MFA_REQUIRED.
+     * Present only when `code` is CREDENTIAL_UNAVAILABLE, ORGANIZATION_AUTH_POLICY_UNSATISFIED or SSO_CALLER_SESSION_REQUIRED. Published as a plain value rather than a closed enum because the shapes that carry `reason` do not agree on one value set. When `code` is CREDENTIAL_UNAVAILABLE: Closed denial-reason class explaining why the credential chain refused — one of secret_missing, secret_expired, refresh_failed, recipe_field_missing, policy_denied, connection_needs_attention, user_subject_required, user_grant_unavailable, conversation_not_attested, path_not_permitted, forge_credential_stale, install_declaration_invalid, provider_unavailable, internal_error, credential_not_found, use_denied, host_not_covered, machine_in_setup, credential_needs_https, plan_feature_disabled. When `code` is ORGANIZATION_AUTH_POLICY_UNSATISFIED or SSO_CALLER_SESSION_REQUIRED: Closed reason class naming the first policy check the session failed — one of ORGANIZATION_NOT_ACTIVE, SSO_ENFORCED_WITHOUT_BINDING, WRONG_IDENTITY_PROVIDER, AUTHENTICATION_METHOD_NOT_ALLOWED, MFA_REQUIRED.
      * @type {string}
      * @memberof ApiErrorDetail
      */

package/node_modules/@orchestraworks/client/dist/esm/models/CreateEnvironmentRequest.d.ts

@@ -10,6 +10,7 @@
  * Do not edit the class manually.
  */
 import type { EnvironmentIngressPolicy } from './EnvironmentIngressPolicy';
+import type { EnvironmentCredential } from './EnvironmentCredential';
 import type { EnvironmentHooks } from './EnvironmentHooks';
 import type { EnvironmentPlatformRequest } from './EnvironmentPlatformRequest';
 import type { EnvironmentEgressPolicy } from './EnvironmentEgressPolicy';
@@ -50,6 +51,12 @@ export interface CreateEnvironmentRequest {
      * @memberof CreateEnvironmentRequest
      */
     ingressPolicy?: EnvironmentIngressPolicy | null;
+    /**
+     * The credentials this environment's machines get on a request that names none, in order: the first one covering the request's host is added, whatever the agent. Each entry is a Secret or Connection of this organization by id, and adding one needs the caller's own use of it. A request naming a credential gets that one instead. Absent declares none.
+     * @type {Array<EnvironmentCredential>}
+     * @memberof CreateEnvironmentRequest
+     */
+    credentials?: Array<EnvironmentCredential>;
     /**
      * Whether the platform provisions this environment's machines (provisioned, the default) or a customer's own machine enrols into it (enrolled). Fixed at create.
      * @type {CreateEnvironmentRequestKindEnum}

package/node_modules/@orchestraworks/client/dist/esm/models/CreateEnvironmentRequest.js

@@ -12,6 +12,7 @@
  * Do not edit the class manually.
  */
 import { EnvironmentIngressPolicyFromJSON, EnvironmentIngressPolicyToJSON, } from './EnvironmentIngressPolicy';
+import { EnvironmentCredentialFromJSON, EnvironmentCredentialToJSON, } from './EnvironmentCredential';
 import { EnvironmentHooksFromJSON, EnvironmentHooksToJSON, } from './EnvironmentHooks';
 import { EnvironmentPlatformRequestFromJSON, EnvironmentPlatformRequestToJSON, } from './EnvironmentPlatformRequest';
 import { EnvironmentEgressPolicyFromJSON, EnvironmentEgressPolicyToJSON, } from './EnvironmentEgressPolicy';
@@ -44,6 +45,7 @@ export function CreateEnvironmentRequestFromJSONTyped(json, ignoreDiscriminator)
         'platform': json['platform'] == null ? undefined : EnvironmentPlatformRequestFromJSON(json['platform']),
         'egressPolicy': json['egressPolicy'] == null ? undefined : EnvironmentEgressPolicyFromJSON(json['egressPolicy']),
         'ingressPolicy': json['ingressPolicy'] == null ? undefined : EnvironmentIngressPolicyFromJSON(json['ingressPolicy']),
+        'credentials': json['credentials'] == null ? undefined : (json['credentials'].map(EnvironmentCredentialFromJSON)),
         'kind': json['kind'] == null ? undefined : json['kind'],
         'provisionSpec': json['provisionSpec'] == null ? undefined : EnvironmentProvisionSpecRequestFromJSON(json['provisionSpec']),
         'teamId': json['teamId'] == null ? undefined : json['teamId'],
@@ -65,6 +67,7 @@ export function CreateEnvironmentRequestToJSONTyped(value, ignoreDiscriminator =
         'platform': EnvironmentPlatformRequestToJSON(value['platform']),
         'egressPolicy': EnvironmentEgressPolicyToJSON(value['egressPolicy']),
         'ingressPolicy': EnvironmentIngressPolicyToJSON(value['ingressPolicy']),
+        'credentials': value['credentials'] == null ? undefined : (value['credentials'].map(EnvironmentCredentialToJSON)),
         'kind': value['kind'],
         'provisionSpec': EnvironmentProvisionSpecRequestToJSON(value['provisionSpec']),
         'teamId': value['teamId'],

package/node_modules/@orchestraworks/client/dist/esm/models/CreateSecretRequest.d.ts

@@ -35,7 +35,7 @@ export interface CreateSecretRequest {
      */
     description?: string;
     /**
-     * Secret value. This is write-only and is never returned by management APIs.
+     * Secret value. This is write-only and is never returned by management APIs. For git over HTTPS, store base64 of <user>:<token> as the value, such as the output of printf 'x-access-token:%s' "$TOKEN" | base64 | tr -d '\n' for a GitHub token, and present it as Authorization: Basic ${secret}.
      * @type {string}
      * @memberof CreateSecretRequest
      */
@@ -53,7 +53,7 @@ export interface CreateSecretRequest {
      */
     teamId?: string;
     /**
-     * Optional injection recipe describing the request mutations the broker applies from this secret
+     * Optional injection recipe: the request mutations the broker applies from this secret, and the hosts it applies them on. A secret without one is stored only: the broker presents it on no request. For git over HTTPS, store base64 of <user>:<token> as the value, such as the output of printf 'x-access-token:%s' "$TOKEN" | base64 | tr -d '\n' for a GitHub token, and present it as Authorization: Basic ${secret}.
      * @type {InjectionRecipe}
      * @memberof CreateSecretRequest
      */
@@ -67,9 +67,10 @@ export interface CreateSecretRequest {
         [key: string]: string;
     };
     /**
-     * Host patterns this secret is presented on, in egress rule host syntax (exact host, *.suffix, or *); empty or omitted covers no host. A non-empty list needs an injection recipe with a header, and no pattern may name the platform API host or the object store host.
+     * Deprecated: write injection.hosts instead. Accepted for one release and moved into the recipe's hosts; a request whose recipe names other hosts is refused.
      * @type {Array<string>}
      * @memberof CreateSecretRequest
+     * @deprecated
      */
     hosts?: Array<string>;
 }

package/node_modules/@orchestraworks/client/dist/esm/models/Environment.d.ts

@@ -11,6 +11,7 @@
  */
 import type { EnvironmentIngressPolicy } from './EnvironmentIngressPolicy';
 import type { EnvironmentPlatformWithRuntime } from './EnvironmentPlatformWithRuntime';
+import type { EnvironmentCredential } from './EnvironmentCredential';
 import type { EnvironmentHooks } from './EnvironmentHooks';
 import type { EnvironmentEgressPolicy } from './EnvironmentEgressPolicy';
 import type { EnvironmentProvisionSpec } from './EnvironmentProvisionSpec';
@@ -68,6 +69,12 @@ export interface Environment {
      * @memberof Environment
      */
     ingressPolicy?: EnvironmentIngressPolicy;
+    /**
+     * The credentials this environment's machines get on a request that names none, in order: the first one covering the request's host is added, whatever the agent. Each entry is a Secret or Connection of this organization by id, and adding one needs the caller's own use of it. A request naming a credential gets that one instead.
+     * @type {Array<EnvironmentCredential>}
+     * @memberof Environment
+     */
+    credentials?: Array<EnvironmentCredential>;
     /**
      * Whether the platform provisions this environment's machines (provisioned) or a customer's own machine enrols into it (enrolled). Fixed when the environment is created.
      * @type {EnvironmentKindEnum}