@orchestraworks/cli 0.5.8 → 0.6.0

package/node_modules/@orchestraworks/client/dist/esm/models/index.d.ts

@@ -120,6 +120,7 @@ export * from './EmbeddedResourceResource';
 export * from './EntitlementPeriodUsage';
 export * from './EntitlementTeamUsage';
 export * from './Environment';
+export * from './EnvironmentCredential';
 export * from './EnvironmentDisk';
 export * from './EnvironmentDiskMount';
 export * from './EnvironmentEgressPolicy';

package/node_modules/@orchestraworks/client/dist/esm/models/index.js

@@ -122,6 +122,7 @@ export * from './EmbeddedResourceResource';
 export * from './EntitlementPeriodUsage';
 export * from './EntitlementTeamUsage';
 export * from './Environment';
+export * from './EnvironmentCredential';
 export * from './EnvironmentDisk';
 export * from './EnvironmentDiskMount';
 export * from './EnvironmentEgressPolicy';

package/node_modules/@orchestraworks/client/dist/models/ApiErrorDetail.d.ts

@@ -16,7 +16,7 @@
  */
 export interface ApiErrorDetail {
     /**
-     * Present only when `code` is CREDENTIAL_UNAVAILABLE, ORGANIZATION_AUTH_POLICY_UNSATISFIED or SSO_CALLER_SESSION_REQUIRED. Published as a plain value rather than a closed enum because the shapes that carry `reason` do not agree on one value set. When `code` is CREDENTIAL_UNAVAILABLE: Closed denial-reason class explaining why the credential chain refused — one of secret_missing, secret_expired, refresh_failed, recipe_field_missing, policy_denied, ambiguous_match, connection_needs_attention, user_subject_required, user_grant_unavailable, conversation_not_attested, path_not_permitted, forge_credential_stale, install_declaration_invalid, provider_unavailable, internal_error, credential_not_found, use_denied, host_not_covered, machine_in_setup, credential_needs_https, plan_feature_disabled. When `code` is ORGANIZATION_AUTH_POLICY_UNSATISFIED or SSO_CALLER_SESSION_REQUIRED: Closed reason class naming the first policy check the session failed — one of ORGANIZATION_NOT_ACTIVE, SSO_ENFORCED_WITHOUT_BINDING, WRONG_IDENTITY_PROVIDER, AUTHENTICATION_METHOD_NOT_ALLOWED, MFA_REQUIRED.
+     * Present only when `code` is CREDENTIAL_UNAVAILABLE, ORGANIZATION_AUTH_POLICY_UNSATISFIED or SSO_CALLER_SESSION_REQUIRED. Published as a plain value rather than a closed enum because the shapes that carry `reason` do not agree on one value set. When `code` is CREDENTIAL_UNAVAILABLE: Closed denial-reason class explaining why the credential chain refused — one of secret_missing, secret_expired, refresh_failed, recipe_field_missing, policy_denied, connection_needs_attention, user_subject_required, user_grant_unavailable, conversation_not_attested, path_not_permitted, forge_credential_stale, install_declaration_invalid, provider_unavailable, internal_error, credential_not_found, use_denied, host_not_covered, machine_in_setup, credential_needs_https, plan_feature_disabled. When `code` is ORGANIZATION_AUTH_POLICY_UNSATISFIED or SSO_CALLER_SESSION_REQUIRED: Closed reason class naming the first policy check the session failed — one of ORGANIZATION_NOT_ACTIVE, SSO_ENFORCED_WITHOUT_BINDING, WRONG_IDENTITY_PROVIDER, AUTHENTICATION_METHOD_NOT_ALLOWED, MFA_REQUIRED.
      * @type {string}
      * @memberof ApiErrorDetail
      */

package/node_modules/@orchestraworks/client/dist/models/CreateEnvironmentRequest.d.ts

@@ -10,6 +10,7 @@
  * Do not edit the class manually.
  */
 import type { EnvironmentIngressPolicy } from './EnvironmentIngressPolicy';
+import type { EnvironmentCredential } from './EnvironmentCredential';
 import type { EnvironmentHooks } from './EnvironmentHooks';
 import type { EnvironmentPlatformRequest } from './EnvironmentPlatformRequest';
 import type { EnvironmentEgressPolicy } from './EnvironmentEgressPolicy';
@@ -50,6 +51,12 @@ export interface CreateEnvironmentRequest {
      * @memberof CreateEnvironmentRequest
      */
     ingressPolicy?: EnvironmentIngressPolicy | null;
+    /**
+     * The credentials this environment's machines get on a request that names none, in order: the first one covering the request's host is added, whatever the agent. Each entry is a Secret or Connection of this organization by id, and adding one needs the caller's own use of it. A request naming a credential gets that one instead. Absent declares none.
+     * @type {Array<EnvironmentCredential>}
+     * @memberof CreateEnvironmentRequest
+     */
+    credentials?: Array<EnvironmentCredential>;
     /**
      * Whether the platform provisions this environment's machines (provisioned, the default) or a customer's own machine enrols into it (enrolled). Fixed at create.
      * @type {CreateEnvironmentRequestKindEnum}

package/node_modules/@orchestraworks/client/dist/models/CreateEnvironmentRequest.js

@@ -20,6 +20,7 @@ exports.CreateEnvironmentRequestFromJSONTyped = CreateEnvironmentRequestFromJSON
 exports.CreateEnvironmentRequestToJSON = CreateEnvironmentRequestToJSON;
 exports.CreateEnvironmentRequestToJSONTyped = CreateEnvironmentRequestToJSONTyped;
 const EnvironmentIngressPolicy_1 = require("./EnvironmentIngressPolicy");
+const EnvironmentCredential_1 = require("./EnvironmentCredential");
 const EnvironmentHooks_1 = require("./EnvironmentHooks");
 const EnvironmentPlatformRequest_1 = require("./EnvironmentPlatformRequest");
 const EnvironmentEgressPolicy_1 = require("./EnvironmentEgressPolicy");
@@ -52,6 +53,7 @@ function CreateEnvironmentRequestFromJSONTyped(json, ignoreDiscriminator) {
         'platform': json['platform'] == null ? undefined : (0, EnvironmentPlatformRequest_1.EnvironmentPlatformRequestFromJSON)(json['platform']),
         'egressPolicy': json['egressPolicy'] == null ? undefined : (0, EnvironmentEgressPolicy_1.EnvironmentEgressPolicyFromJSON)(json['egressPolicy']),
         'ingressPolicy': json['ingressPolicy'] == null ? undefined : (0, EnvironmentIngressPolicy_1.EnvironmentIngressPolicyFromJSON)(json['ingressPolicy']),
+        'credentials': json['credentials'] == null ? undefined : (json['credentials'].map(EnvironmentCredential_1.EnvironmentCredentialFromJSON)),
         'kind': json['kind'] == null ? undefined : json['kind'],
         'provisionSpec': json['provisionSpec'] == null ? undefined : (0, EnvironmentProvisionSpecRequest_1.EnvironmentProvisionSpecRequestFromJSON)(json['provisionSpec']),
         'teamId': json['teamId'] == null ? undefined : json['teamId'],
@@ -73,6 +75,7 @@ function CreateEnvironmentRequestToJSONTyped(value, ignoreDiscriminator = false)
         'platform': (0, EnvironmentPlatformRequest_1.EnvironmentPlatformRequestToJSON)(value['platform']),
         'egressPolicy': (0, EnvironmentEgressPolicy_1.EnvironmentEgressPolicyToJSON)(value['egressPolicy']),
         'ingressPolicy': (0, EnvironmentIngressPolicy_1.EnvironmentIngressPolicyToJSON)(value['ingressPolicy']),
+        'credentials': value['credentials'] == null ? undefined : (value['credentials'].map(EnvironmentCredential_1.EnvironmentCredentialToJSON)),
         'kind': value['kind'],
         'provisionSpec': (0, EnvironmentProvisionSpecRequest_1.EnvironmentProvisionSpecRequestToJSON)(value['provisionSpec']),
         'teamId': value['teamId'],

package/node_modules/@orchestraworks/client/dist/models/CreateSecretRequest.d.ts

@@ -35,7 +35,7 @@ export interface CreateSecretRequest {
      */
     description?: string;
     /**
-     * Secret value. This is write-only and is never returned by management APIs.
+     * Secret value. This is write-only and is never returned by management APIs. For git over HTTPS, store base64 of <user>:<token> as the value, such as the output of printf 'x-access-token:%s' "$TOKEN" | base64 | tr -d '\n' for a GitHub token, and present it as Authorization: Basic ${secret}.
      * @type {string}
      * @memberof CreateSecretRequest
      */
@@ -53,7 +53,7 @@ export interface CreateSecretRequest {
      */
     teamId?: string;
     /**
-     * Optional injection recipe describing the request mutations the broker applies from this secret
+     * Optional injection recipe: the request mutations the broker applies from this secret, and the hosts it applies them on. A secret without one is stored only: the broker presents it on no request. For git over HTTPS, store base64 of <user>:<token> as the value, such as the output of printf 'x-access-token:%s' "$TOKEN" | base64 | tr -d '\n' for a GitHub token, and present it as Authorization: Basic ${secret}.
      * @type {InjectionRecipe}
      * @memberof CreateSecretRequest
      */
@@ -67,9 +67,10 @@ export interface CreateSecretRequest {
         [key: string]: string;
     };
     /**
-     * Host patterns this secret is presented on, in egress rule host syntax (exact host, *.suffix, or *); empty or omitted covers no host. A non-empty list needs an injection recipe with a header, and no pattern may name the platform API host or the object store host.
+     * Deprecated: write injection.hosts instead. Accepted for one release and moved into the recipe's hosts; a request whose recipe names other hosts is refused.
      * @type {Array<string>}
      * @memberof CreateSecretRequest
+     * @deprecated
      */
     hosts?: Array<string>;
 }

package/node_modules/@orchestraworks/client/dist/models/Environment.d.ts

@@ -11,6 +11,7 @@
  */
 import type { EnvironmentIngressPolicy } from './EnvironmentIngressPolicy';
 import type { EnvironmentPlatformWithRuntime } from './EnvironmentPlatformWithRuntime';
+import type { EnvironmentCredential } from './EnvironmentCredential';
 import type { EnvironmentHooks } from './EnvironmentHooks';
 import type { EnvironmentEgressPolicy } from './EnvironmentEgressPolicy';
 import type { EnvironmentProvisionSpec } from './EnvironmentProvisionSpec';
@@ -68,6 +69,12 @@ export interface Environment {
      * @memberof Environment
      */
     ingressPolicy?: EnvironmentIngressPolicy;
+    /**
+     * The credentials this environment's machines get on a request that names none, in order: the first one covering the request's host is added, whatever the agent. Each entry is a Secret or Connection of this organization by id, and adding one needs the caller's own use of it. A request naming a credential gets that one instead.
+     * @type {Array<EnvironmentCredential>}
+     * @memberof Environment
+     */
+    credentials?: Array<EnvironmentCredential>;
     /**
      * Whether the platform provisions this environment's machines (provisioned) or a customer's own machine enrols into it (enrolled). Fixed when the environment is created.
      * @type {EnvironmentKindEnum}

package/node_modules/@orchestraworks/client/dist/models/Environment.js

@@ -21,6 +21,7 @@ exports.EnvironmentToJSON = EnvironmentToJSON;
 exports.EnvironmentToJSONTyped = EnvironmentToJSONTyped;
 const EnvironmentIngressPolicy_1 = require("./EnvironmentIngressPolicy");
 const EnvironmentPlatformWithRuntime_1 = require("./EnvironmentPlatformWithRuntime");
+const EnvironmentCredential_1 = require("./EnvironmentCredential");
 const EnvironmentHooks_1 = require("./EnvironmentHooks");
 const EnvironmentEgressPolicy_1 = require("./EnvironmentEgressPolicy");
 const EnvironmentProvisionSpec_1 = require("./EnvironmentProvisionSpec");
@@ -73,6 +74,7 @@ function EnvironmentFromJSONTyped(json, ignoreDiscriminator) {
         'platform': (0, EnvironmentPlatformWithRuntime_1.EnvironmentPlatformWithRuntimeFromJSON)(json['platform']),
         'egressPolicy': (0, EnvironmentEgressPolicy_1.EnvironmentEgressPolicyFromJSON)(json['egressPolicy']),
         'ingressPolicy': json['ingressPolicy'] == null ? undefined : (0, EnvironmentIngressPolicy_1.EnvironmentIngressPolicyFromJSON)(json['ingressPolicy']),
+        'credentials': json['credentials'] == null ? undefined : (json['credentials'].map(EnvironmentCredential_1.EnvironmentCredentialFromJSON)),
         'kind': json['kind'],
         'provisionSpec': json['provisionSpec'] == null ? undefined : (0, EnvironmentProvisionSpec_1.EnvironmentProvisionSpecFromJSON)(json['provisionSpec']),
         'workingDirectory': json['workingDirectory'] == null ? undefined : json['workingDirectory'],
@@ -98,6 +100,7 @@ function EnvironmentToJSONTyped(value, ignoreDiscriminator = false) {
         'platform': (0, EnvironmentPlatformWithRuntime_1.EnvironmentPlatformWithRuntimeToJSON)(value['platform']),
         'egressPolicy': (0, EnvironmentEgressPolicy_1.EnvironmentEgressPolicyToJSON)(value['egressPolicy']),
         'ingressPolicy': (0, EnvironmentIngressPolicy_1.EnvironmentIngressPolicyToJSON)(value['ingressPolicy']),
+        'credentials': value['credentials'] == null ? undefined : (value['credentials'].map(EnvironmentCredential_1.EnvironmentCredentialToJSON)),
         'provisionSpec': (0, EnvironmentProvisionSpec_1.EnvironmentProvisionSpecToJSON)(value['provisionSpec']),
         'workingDirectory': value['workingDirectory'],
         'hooks': (0, EnvironmentHooks_1.EnvironmentHooksToJSON)(value['hooks']),

package/node_modules/@orchestraworks/client/dist/models/EnvironmentCredential.d.ts

@@ -0,0 +1,38 @@
+/**
+ * Orchestra platform API
+ * No description provided (generated by Openapi Generator https://github.com/openapitools/openapi-generator)
+ *
+ * The version of the OpenAPI document: 0.1.0
+ *
+ *
+ * NOTE: This class is auto generated by OpenAPI Generator (https://openapi-generator.tech).
+ * https://openapi-generator.tech
+ * Do not edit the class manually.
+ */
+/**
+ *
+ * @export
+ * @interface EnvironmentCredential
+ */
+export interface EnvironmentCredential {
+    /**
+     * The credential, as secret/<id> or connection/<id>
+     * @type {string}
+     * @memberof EnvironmentCredential
+     */
+    credential: string;
+    /**
+     * Whether the credential replaces a value the request already carries in a header the credential sets. False leaves such a request as it was sent. Absent means true.
+     * @type {boolean}
+     * @memberof EnvironmentCredential
+     */
+    replace?: boolean;
+}
+/**
+ * Check if a given object implements the EnvironmentCredential interface.
+ */
+export declare function instanceOfEnvironmentCredential(value: object): value is EnvironmentCredential;
+export declare function EnvironmentCredentialFromJSON(json: any): EnvironmentCredential;
+export declare function EnvironmentCredentialFromJSONTyped(json: any, ignoreDiscriminator: boolean): EnvironmentCredential;
+export declare function EnvironmentCredentialToJSON(json: any): EnvironmentCredential;
+export declare function EnvironmentCredentialToJSONTyped(value?: EnvironmentCredential | null, ignoreDiscriminator?: boolean): any;

package/node_modules/@orchestraworks/client/dist/models/EnvironmentCredential.js

@@ -0,0 +1,52 @@
+"use strict";
+/* tslint:disable */
+/* eslint-disable */
+/**
+ * Orchestra platform API
+ * No description provided (generated by Openapi Generator https://github.com/openapitools/openapi-generator)
+ *
+ * The version of the OpenAPI document: 0.1.0
+ *
+ *
+ * NOTE: This class is auto generated by OpenAPI Generator (https://openapi-generator.tech).
+ * https://openapi-generator.tech
+ * Do not edit the class manually.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.instanceOfEnvironmentCredential = instanceOfEnvironmentCredential;
+exports.EnvironmentCredentialFromJSON = EnvironmentCredentialFromJSON;
+exports.EnvironmentCredentialFromJSONTyped = EnvironmentCredentialFromJSONTyped;
+exports.EnvironmentCredentialToJSON = EnvironmentCredentialToJSON;
+exports.EnvironmentCredentialToJSONTyped = EnvironmentCredentialToJSONTyped;
+/**
+ * Check if a given object implements the EnvironmentCredential interface.
+ */
+function instanceOfEnvironmentCredential(value) {
+    if (!('credential' in value) || value['credential'] === undefined)
+        return false;
+    return true;
+}
+function EnvironmentCredentialFromJSON(json) {
+    return EnvironmentCredentialFromJSONTyped(json, false);
+}
+function EnvironmentCredentialFromJSONTyped(json, ignoreDiscriminator) {
+    if (json == null) {
+        return json;
+    }
+    return {
+        'credential': json['credential'],
+        'replace': json['replace'] == null ? undefined : json['replace'],
+    };
+}
+function EnvironmentCredentialToJSON(json) {
+    return EnvironmentCredentialToJSONTyped(json, false);
+}
+function EnvironmentCredentialToJSONTyped(value, ignoreDiscriminator = false) {
+    if (value == null) {
+        return value;
+    }
+    return {
+        'credential': value['credential'],
+        'replace': value['replace'],
+    };
+}

package/node_modules/@orchestraworks/client/dist/models/EnvironmentProvisionSpec.d.ts

@@ -42,7 +42,7 @@ export interface EnvironmentProvisionSpec {
      */
     volumeMounts: Array<EnvironmentMount>;
     /**
-     * Environment variables set on every machine created from this environment, and forwarded into the agent process itself. NOT A SECRET STORE: values are stored unencrypted on the environment row and returned verbatim by every read of it, so anyone who can read the environment can read them. Put credentials in a Secret referenced by an egress allow rule instead - the broker injects those into the outbound request at the egress edge and the agent process never holds them. Names beginning SFDK_ or ORCHESTRA_ are platform-owned and rejected, and the platform writes its own reserved variables last, overriding anything you declare. Names beginning ORCHESTRA_FDK_, the inputs of an agent-as-code kit, are accepted in exactly that spelling as ordinary variables of your own. The other exception is six worker settings, accepted in exactly this spelling: SFDK_WORKER_RESTART_AFTER_IDLE, SFDK_WORKER_RELEASE_FETCH_TIMEOUT and SFDK_WORKER_RELEASE_CHECK_INTERVAL, each a positive duration such as 30s or 5m; SFDK_WORKER_RELEASE_REGISTRY_URL, an http or https URL; and SFDK_WORKER_AUTO_UPGRADE and SFDK_WORKER_AUTO_RESTART, each exactly true or false, which turn the worker's move to a newer release and its restart into that release on or off. They reach the machine's worker, where each one set wins over the platform's release settings, and never an agent process. HOME and USERPROFILE are not among them: the platform sets neither, the account inside the image decides where the home directory is, and a HOME you declare here is passed to the harness to conform to or complain about. Declare a volume mount at /home if you want that home directory to be durable. On a Windows environment names are matched case-insensitively, the way Windows itself matches them - sfdk_x and orchestra_fdk_x are rejected reserved names there, and Home and HOME are one variable - while a POSIX environment matches names exactly. At most 64 entries; a key matches [A-Za-z_][A-Za-z0-9_]* and is at most 128 characters; a value is at most 4096 characters.
+     * Environment variables set on every machine created from this environment, and forwarded into the agent process itself. NOT A SECRET STORE: values are stored unencrypted on the environment row and returned verbatim by every read of it, so anyone who can read the environment can read them. Put credentials in a Secret referenced by an egress allow rule instead - the broker injects those into the outbound request at the egress edge and the agent process never holds them. Names beginning SFDK_ or ORCHESTRA_ are platform-owned and rejected, and the platform writes its own reserved variables last, overriding anything you declare. Names beginning ORCHESTRA_FDK_, the inputs of an agent-as-code kit, are accepted in exactly that spelling as ordinary variables of your own. The other exception is six worker settings, accepted in exactly this spelling: ORCHESTRA_WORKER_RESTART_AFTER_IDLE, ORCHESTRA_WORKER_RELEASE_FETCH_TIMEOUT and ORCHESTRA_WORKER_RELEASE_CHECK_INTERVAL, each a positive duration such as 30s or 5m; ORCHESTRA_WORKER_RELEASE_REGISTRY_URL, an http or https URL; and ORCHESTRA_WORKER_AUTO_UPGRADE and ORCHESTRA_WORKER_AUTO_RESTART, each exactly true or false, which turn the worker's move to a newer release and its restart into that release on or off. Their former spellings beginning SFDK_WORKER_ are refused. They reach the machine's worker, where each one set wins over the platform's release settings, and never an agent process. HOME and USERPROFILE are not among them: the platform sets neither, the account inside the image decides where the home directory is, and a HOME you declare here is passed to the harness to conform to or complain about. Declare a volume mount at /home if you want that home directory to be durable. On a Windows environment names are matched case-insensitively, the way Windows itself matches them - sfdk_x and orchestra_fdk_x are rejected reserved names there, and Home and HOME are one variable - while a POSIX environment matches names exactly. At most 64 entries; a key matches [A-Za-z_][A-Za-z0-9_]* and is at most 128 characters; a value is at most 4096 characters.
      * @type {{ [key: string]: string; }}
      * @memberof EnvironmentProvisionSpec
      */

package/node_modules/@orchestraworks/client/dist/models/EnvironmentProvisionSpecRequest.d.ts

@@ -55,7 +55,7 @@ export interface EnvironmentProvisionSpecRequest {
      */
     setup?: string;
     /**
-     * Declared environment variables; a supplied map replaces the stored one entirely, and an absent one leaves it unchanged. Environment variables set on every machine created from this environment, and forwarded into the agent process itself. NOT A SECRET STORE: values are stored unencrypted on the environment row and returned verbatim by every read of it, so anyone who can read the environment can read them. Put credentials in a Secret referenced by an egress allow rule instead - the broker injects those into the outbound request at the egress edge and the agent process never holds them. Names beginning SFDK_ or ORCHESTRA_ are platform-owned and rejected, and the platform writes its own reserved variables last, overriding anything you declare. Names beginning ORCHESTRA_FDK_, the inputs of an agent-as-code kit, are accepted in exactly that spelling as ordinary variables of your own. The other exception is six worker settings, accepted in exactly this spelling: SFDK_WORKER_RESTART_AFTER_IDLE, SFDK_WORKER_RELEASE_FETCH_TIMEOUT and SFDK_WORKER_RELEASE_CHECK_INTERVAL, each a positive duration such as 30s or 5m; SFDK_WORKER_RELEASE_REGISTRY_URL, an http or https URL; and SFDK_WORKER_AUTO_UPGRADE and SFDK_WORKER_AUTO_RESTART, each exactly true or false, which turn the worker's move to a newer release and its restart into that release on or off. They reach the machine's worker, where each one set wins over the platform's release settings, and never an agent process. HOME and USERPROFILE are not among them: the platform sets neither, the account inside the image decides where the home directory is, and a HOME you declare here is passed to the harness to conform to or complain about. Declare a volume mount at /home if you want that home directory to be durable. On a Windows environment names are matched case-insensitively, the way Windows itself matches them - sfdk_x and orchestra_fdk_x are rejected reserved names there, and Home and HOME are one variable - while a POSIX environment matches names exactly. At most 64 entries; a key matches [A-Za-z_][A-Za-z0-9_]* and is at most 128 characters; a value is at most 4096 characters.
+     * Declared environment variables; a supplied map replaces the stored one entirely, and an absent one leaves it unchanged. Environment variables set on every machine created from this environment, and forwarded into the agent process itself. NOT A SECRET STORE: values are stored unencrypted on the environment row and returned verbatim by every read of it, so anyone who can read the environment can read them. Put credentials in a Secret referenced by an egress allow rule instead - the broker injects those into the outbound request at the egress edge and the agent process never holds them. Names beginning SFDK_ or ORCHESTRA_ are platform-owned and rejected, and the platform writes its own reserved variables last, overriding anything you declare. Names beginning ORCHESTRA_FDK_, the inputs of an agent-as-code kit, are accepted in exactly that spelling as ordinary variables of your own. The other exception is six worker settings, accepted in exactly this spelling: ORCHESTRA_WORKER_RESTART_AFTER_IDLE, ORCHESTRA_WORKER_RELEASE_FETCH_TIMEOUT and ORCHESTRA_WORKER_RELEASE_CHECK_INTERVAL, each a positive duration such as 30s or 5m; ORCHESTRA_WORKER_RELEASE_REGISTRY_URL, an http or https URL; and ORCHESTRA_WORKER_AUTO_UPGRADE and ORCHESTRA_WORKER_AUTO_RESTART, each exactly true or false, which turn the worker's move to a newer release and its restart into that release on or off. Their former spellings beginning SFDK_WORKER_ are refused. They reach the machine's worker, where each one set wins over the platform's release settings, and never an agent process. HOME and USERPROFILE are not among them: the platform sets neither, the account inside the image decides where the home directory is, and a HOME you declare here is passed to the harness to conform to or complain about. Declare a volume mount at /home if you want that home directory to be durable. On a Windows environment names are matched case-insensitively, the way Windows itself matches them - sfdk_x and orchestra_fdk_x are rejected reserved names there, and Home and HOME are one variable - while a POSIX environment matches names exactly. At most 64 entries; a key matches [A-Za-z_][A-Za-z0-9_]* and is at most 128 characters; a value is at most 4096 characters.
      * @type {{ [key: string]: string; }}
      * @memberof EnvironmentProvisionSpecRequest
      */

package/node_modules/@orchestraworks/client/dist/models/EnvironmentSnapshot.d.ts

@@ -107,7 +107,7 @@ export interface EnvironmentSnapshot {
      */
     setup?: string;
     /**
-     * Environment variables set on every machine created from this environment, and forwarded into the agent process itself. NOT A SECRET STORE: values are stored unencrypted on the environment row and returned verbatim by every read of it, so anyone who can read the environment can read them. Put credentials in a Secret referenced by an egress allow rule instead - the broker injects those into the outbound request at the egress edge and the agent process never holds them. Names beginning SFDK_ or ORCHESTRA_ are platform-owned and rejected, and the platform writes its own reserved variables last, overriding anything you declare. Names beginning ORCHESTRA_FDK_, the inputs of an agent-as-code kit, are accepted in exactly that spelling as ordinary variables of your own. The other exception is six worker settings, accepted in exactly this spelling: SFDK_WORKER_RESTART_AFTER_IDLE, SFDK_WORKER_RELEASE_FETCH_TIMEOUT and SFDK_WORKER_RELEASE_CHECK_INTERVAL, each a positive duration such as 30s or 5m; SFDK_WORKER_RELEASE_REGISTRY_URL, an http or https URL; and SFDK_WORKER_AUTO_UPGRADE and SFDK_WORKER_AUTO_RESTART, each exactly true or false, which turn the worker's move to a newer release and its restart into that release on or off. They reach the machine's worker, where each one set wins over the platform's release settings, and never an agent process. HOME and USERPROFILE are not among them: the platform sets neither, the account inside the image decides where the home directory is, and a HOME you declare here is passed to the harness to conform to or complain about. Declare a volume mount at /home if you want that home directory to be durable. On a Windows environment names are matched case-insensitively, the way Windows itself matches them - sfdk_x and orchestra_fdk_x are rejected reserved names there, and Home and HOME are one variable - while a POSIX environment matches names exactly. At most 64 entries; a key matches [A-Za-z_][A-Za-z0-9_]* and is at most 128 characters; a value is at most 4096 characters.
+     * Environment variables set on every machine created from this environment, and forwarded into the agent process itself. NOT A SECRET STORE: values are stored unencrypted on the environment row and returned verbatim by every read of it, so anyone who can read the environment can read them. Put credentials in a Secret referenced by an egress allow rule instead - the broker injects those into the outbound request at the egress edge and the agent process never holds them. Names beginning SFDK_ or ORCHESTRA_ are platform-owned and rejected, and the platform writes its own reserved variables last, overriding anything you declare. Names beginning ORCHESTRA_FDK_, the inputs of an agent-as-code kit, are accepted in exactly that spelling as ordinary variables of your own. The other exception is six worker settings, accepted in exactly this spelling: ORCHESTRA_WORKER_RESTART_AFTER_IDLE, ORCHESTRA_WORKER_RELEASE_FETCH_TIMEOUT and ORCHESTRA_WORKER_RELEASE_CHECK_INTERVAL, each a positive duration such as 30s or 5m; ORCHESTRA_WORKER_RELEASE_REGISTRY_URL, an http or https URL; and ORCHESTRA_WORKER_AUTO_UPGRADE and ORCHESTRA_WORKER_AUTO_RESTART, each exactly true or false, which turn the worker's move to a newer release and its restart into that release on or off. Their former spellings beginning SFDK_WORKER_ are refused. They reach the machine's worker, where each one set wins over the platform's release settings, and never an agent process. HOME and USERPROFILE are not among them: the platform sets neither, the account inside the image decides where the home directory is, and a HOME you declare here is passed to the harness to conform to or complain about. Declare a volume mount at /home if you want that home directory to be durable. On a Windows environment names are matched case-insensitively, the way Windows itself matches them - sfdk_x and orchestra_fdk_x are rejected reserved names there, and Home and HOME are one variable - while a POSIX environment matches names exactly. At most 64 entries; a key matches [A-Za-z_][A-Za-z0-9_]* and is at most 128 characters; a value is at most 4096 characters.
      * @type {{ [key: string]: string; }}
      * @memberof EnvironmentSnapshot
      */

package/node_modules/@orchestraworks/client/dist/models/InjectionRecipe.d.ts

@@ -28,6 +28,12 @@ export interface InjectionRecipe {
      * @memberof InjectionRecipe
      */
     removeHeaders: Array<string>;
+    /**
+     * Host patterns this secret is presented on, in egress rule host syntax (exact host, *.suffix, or *); empty or omitted covers no host. A non-empty list needs at least one header, and no pattern may name the platform API host or the object store host.
+     * @type {Array<string>}
+     * @memberof InjectionRecipe
+     */
+    hosts?: Array<string>;
 }
 /**
  * Check if a given object implements the InjectionRecipe interface.

package/node_modules/@orchestraworks/client/dist/models/InjectionRecipe.js

@@ -37,6 +37,7 @@ function InjectionRecipeFromJSONTyped(json, ignoreDiscriminator) {
     return {
         'headers': json['headers'] == null ? undefined : (json['headers'].map(InjectionHeader_1.InjectionHeaderFromJSON)),
         'removeHeaders': json['removeHeaders'],
+        'hosts': json['hosts'] == null ? undefined : json['hosts'],
     };
 }
 function InjectionRecipeToJSON(json) {
@@ -49,5 +50,6 @@ function InjectionRecipeToJSONTyped(value, ignoreDiscriminator = false) {
     return {
         'headers': value['headers'] == null ? undefined : (value['headers'].map(InjectionHeader_1.InjectionHeaderToJSON)),
         'removeHeaders': value['removeHeaders'],
+        'hosts': value['hosts'],
     };
 }

package/node_modules/@orchestraworks/client/dist/models/OAuthTokenRequest.d.ts

@@ -46,7 +46,7 @@ export interface OAuthTokenRequest {
      */
     refreshToken?: string;
     /**
-     * Public client identifier; omit it or send sfdk-public
+     * Public client identifier; omit it or send orchestra-public
      * @type {string}
      * @memberof OAuthTokenRequest
      */

package/node_modules/@orchestraworks/client/dist/models/Secret.d.ts

@@ -80,17 +80,11 @@ export interface Secret {
      */
     expiresAt?: Date;
     /**
-     * Optional injection recipe describing the request mutations the broker applies from this secret
+     * Optional injection recipe: the request mutations the broker applies from this secret, and the hosts it applies them on. A secret without one is stored only: the broker presents it on no request. For git over HTTPS, store base64 of <user>:<token> as the value, such as the output of printf 'x-access-token:%s' "$TOKEN" | base64 | tr -d '\n' for a GitHub token, and present it as Authorization: Basic ${secret}.
      * @type {InjectionRecipe}
      * @memberof Secret
      */
     injection?: InjectionRecipe;
-    /**
-     * Host patterns this secret is presented on, in egress rule host syntax (exact host, *.suffix, or *); empty covers no host
-     * @type {Array<string>}
-     * @memberof Secret
-     */
-    hosts: Array<string>;
     /**
      * The agents you can see that may use this secret, as IAM decides at this read. Present on the singular read only; a list row leaves it out.
      * @type {Array<Agent>}

package/node_modules/@orchestraworks/client/dist/models/Secret.js

@@ -40,8 +40,6 @@ function instanceOfSecret(value) {
         return false;
     if (!('updatedAt' in value) || value['updatedAt'] === undefined)
         return false;
-    if (!('hosts' in value) || value['hosts'] === undefined)
-        return false;
     return true;
 }
 function SecretFromJSON(json) {
@@ -63,7 +61,6 @@ function SecretFromJSONTyped(json, ignoreDiscriminator) {
         'updatedAt': (new Date(json['updatedAt'])),
         'expiresAt': json['expiresAt'] == null ? undefined : (new Date(json['expiresAt'])),
         'injection': json['injection'] == null ? undefined : (0, InjectionRecipe_1.InjectionRecipeFromJSON)(json['injection']),
-        'hosts': json['hosts'],
         'usableBy': json['usableBy'] == null ? undefined : (json['usableBy'].map(Agent_1.AgentFromJSON)),
     };
 }
@@ -86,6 +83,5 @@ function SecretToJSONTyped(value, ignoreDiscriminator = false) {
         'updatedAt': value['updatedAt'].toISOString(),
         'expiresAt': value['expiresAt'] == null ? value['expiresAt'] : value['expiresAt'].toISOString(),
         'injection': (0, InjectionRecipe_1.InjectionRecipeToJSON)(value['injection']),
-        'hosts': value['hosts'],
     };
 }

package/node_modules/@orchestraworks/client/dist/models/UpdateEnvironmentRequest.d.ts

@@ -10,6 +10,7 @@
  * Do not edit the class manually.
  */
 import type { EnvironmentIngressPolicy } from './EnvironmentIngressPolicy';
+import type { EnvironmentCredential } from './EnvironmentCredential';
 import type { EnvironmentPlatformRequest } from './EnvironmentPlatformRequest';
 import type { EnvironmentEgressPolicy } from './EnvironmentEgressPolicy';
 import type { EnvironmentProvisionSpecRequest } from './EnvironmentProvisionSpecRequest';
@@ -44,6 +45,12 @@ export interface UpdateEnvironmentRequest {
      * @memberof UpdateEnvironmentRequest
      */
     ingressPolicy?: EnvironmentIngressPolicy | null;
+    /**
+     * The credentials this environment's machines get on a request that names none, in order: the first one covering the request's host is added, whatever the agent. Each entry is a Secret or Connection of this organization by id, and adding one needs the caller's own use of it. A request naming a credential gets that one instead. A provided list replaces the stored one, and absent leaves it.
+     * @type {Array<EnvironmentCredential>}
+     * @memberof UpdateEnvironmentRequest
+     */
+    credentials?: Array<EnvironmentCredential>;
     /**
      * The launch spec — every fact that applies only when the platform controls the machine. Rejected on an enrolled environment, whose machine the platform never launches.
      * @type {EnvironmentProvisionSpecRequest}

package/node_modules/@orchestraworks/client/dist/models/UpdateEnvironmentRequest.js

@@ -19,6 +19,7 @@ exports.UpdateEnvironmentRequestFromJSONTyped = UpdateEnvironmentRequestFromJSON
 exports.UpdateEnvironmentRequestToJSON = UpdateEnvironmentRequestToJSON;
 exports.UpdateEnvironmentRequestToJSONTyped = UpdateEnvironmentRequestToJSONTyped;
 const EnvironmentIngressPolicy_1 = require("./EnvironmentIngressPolicy");
+const EnvironmentCredential_1 = require("./EnvironmentCredential");
 const EnvironmentPlatformRequest_1 = require("./EnvironmentPlatformRequest");
 const EnvironmentEgressPolicy_1 = require("./EnvironmentEgressPolicy");
 const EnvironmentProvisionSpecRequest_1 = require("./EnvironmentProvisionSpecRequest");
@@ -41,6 +42,7 @@ function UpdateEnvironmentRequestFromJSONTyped(json, ignoreDiscriminator) {
         'platform': json['platform'] == null ? undefined : (0, EnvironmentPlatformRequest_1.EnvironmentPlatformRequestFromJSON)(json['platform']),
         'egressPolicy': json['egressPolicy'] == null ? undefined : (0, EnvironmentEgressPolicy_1.EnvironmentEgressPolicyFromJSON)(json['egressPolicy']),
         'ingressPolicy': json['ingressPolicy'] == null ? undefined : (0, EnvironmentIngressPolicy_1.EnvironmentIngressPolicyFromJSON)(json['ingressPolicy']),
+        'credentials': json['credentials'] == null ? undefined : (json['credentials'].map(EnvironmentCredential_1.EnvironmentCredentialFromJSON)),
         'provisionSpec': json['provisionSpec'] == null ? undefined : (0, EnvironmentProvisionSpecRequest_1.EnvironmentProvisionSpecRequestFromJSON)(json['provisionSpec']),
         'workingDirectory': json['workingDirectory'] == null ? undefined : json['workingDirectory'],
         'hooks': json['hooks'] == null ? undefined : (0, EnvironmentHooksRequest_1.EnvironmentHooksRequestFromJSON)(json['hooks']),
@@ -59,6 +61,7 @@ function UpdateEnvironmentRequestToJSONTyped(value, ignoreDiscriminator = false)
         'platform': (0, EnvironmentPlatformRequest_1.EnvironmentPlatformRequestToJSON)(value['platform']),
         'egressPolicy': (0, EnvironmentEgressPolicy_1.EnvironmentEgressPolicyToJSON)(value['egressPolicy']),
         'ingressPolicy': (0, EnvironmentIngressPolicy_1.EnvironmentIngressPolicyToJSON)(value['ingressPolicy']),
+        'credentials': value['credentials'] == null ? undefined : (value['credentials'].map(EnvironmentCredential_1.EnvironmentCredentialToJSON)),
         'provisionSpec': (0, EnvironmentProvisionSpecRequest_1.EnvironmentProvisionSpecRequestToJSON)(value['provisionSpec']),
         'workingDirectory': value['workingDirectory'],
         'hooks': (0, EnvironmentHooksRequest_1.EnvironmentHooksRequestToJSON)(value['hooks']),

package/node_modules/@orchestraworks/client/dist/models/UpdateSecretRequest.d.ts

@@ -29,7 +29,7 @@ export interface UpdateSecretRequest {
      */
     description?: string;
     /**
-     * Secret value. This is write-only and is never returned by management APIs.
+     * Secret value. This is write-only and is never returned by management APIs. For git over HTTPS, store base64 of <user>:<token> as the value, such as the output of printf 'x-access-token:%s' "$TOKEN" | base64 | tr -d '\n' for a GitHub token, and present it as Authorization: Basic ${secret}.
      * @type {string}
      * @memberof UpdateSecretRequest
      */
@@ -41,7 +41,7 @@ export interface UpdateSecretRequest {
      */
     expiresAt?: Date;
     /**
-     * Injection recipe update: absent = unchanged, null = clear the recipe, value = replace it
+     * Injection recipe update: absent = unchanged, null = clear the recipe and its hosts, leaving the secret stored only, value = replace the recipe and its hosts. Optional injection recipe: the request mutations the broker applies from this secret, and the hosts it applies them on. A secret without one is stored only: the broker presents it on no request. For git over HTTPS, store base64 of <user>:<token> as the value, such as the output of printf 'x-access-token:%s' "$TOKEN" | base64 | tr -d '\n' for a GitHub token, and present it as Authorization: Basic ${secret}.
      * @type {InjectionRecipe}
      * @memberof UpdateSecretRequest
      */
@@ -55,9 +55,10 @@ export interface UpdateSecretRequest {
         [key: string]: string | null;
     };
     /**
-     * Whole-list replacement of the host patterns this secret is presented on; absent = unchanged, [] covers no host. A non-empty list needs an injection recipe with a header, and no pattern may name the platform API host or the object store host.
+     * Deprecated: write injection.hosts instead. Accepted for one release and moved into the recipe's hosts; a request whose recipe names other hosts is refused. Absent leaves the recipe's hosts unchanged; a list replaces them.
      * @type {Array<string>}
      * @memberof UpdateSecretRequest
+     * @deprecated
      */
     hosts?: Array<string>;
 }

package/node_modules/@orchestraworks/client/dist/models/index.d.ts

@@ -120,6 +120,7 @@ export * from './EmbeddedResourceResource';
 export * from './EntitlementPeriodUsage';
 export * from './EntitlementTeamUsage';
 export * from './Environment';
+export * from './EnvironmentCredential';
 export * from './EnvironmentDisk';
 export * from './EnvironmentDiskMount';
 export * from './EnvironmentEgressPolicy';

package/node_modules/@orchestraworks/client/dist/models/index.js

@@ -138,6 +138,7 @@ __exportStar(require("./EmbeddedResourceResource"), exports);
 __exportStar(require("./EntitlementPeriodUsage"), exports);
 __exportStar(require("./EntitlementTeamUsage"), exports);
 __exportStar(require("./Environment"), exports);
+__exportStar(require("./EnvironmentCredential"), exports);
 __exportStar(require("./EnvironmentDisk"), exports);
 __exportStar(require("./EnvironmentDiskMount"), exports);
 __exportStar(require("./EnvironmentEgressPolicy"), exports);

package/node_modules/@orchestraworks/client/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@orchestraworks/client",
-  "version": "0.5.8",
+  "version": "0.6.0",
   "description": "Orchestra public API TypeScript client",
   "author": "Living Computers",
   "repository": {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@orchestraworks/cli",
-  "version": "0.5.8",
+  "version": "0.6.0",
   "type": "module",
   "description": "The Orchestra command line.",
   "license": "Apache-2.0",
@@ -109,13 +109,13 @@
   },
   "dependencies": {
     "@agentclientprotocol/sdk": "1.3.0",
-    "@orchestraworks/client": "0.5.8",
-    "@orchestraworks/worker": "0.0.141",
+    "@orchestraworks/client": "0.6.0",
+    "@orchestraworks/worker": "0.0.142",
     "commander": "^14.0.0",
     "liquidjs": "^10.28.0"
   },
   "optionalDependencies": {
-    "@orchestraworks/local": "0.0.141"
+    "@orchestraworks/local": "0.0.142"
   },
   "bundleDependencies": [
     "@orchestraworks/client"