@sequenceholdings/studio-cli 0.1.21 → 0.1.24

package/dist/repos/commands.js

@@ -16,7 +16,8 @@ import { existsSync, readdirSync, rmSync } from 'node:fs';
 import { homedir } from 'node:os';
 import { resolve, sep } from 'node:path';
 import { materializeRepo, resolveCommitSha, resolveRepo, } from '@sequenceholdings/artifact-studio/git-service-client';
-import { deleteNoContent, getJson, postJson } from '../atlas-client.js';
+import { z } from 'zod';
+import { AtlasApiError, deleteNoContent, getJson, getJsonOr404, postJson, } from '../atlas-client.js';
 import { printCliError } from '../cli-errors.js';
 import { PREVIEW_DOMAIN } from '../preview.js';
 import { confirmYes } from '../prompt.js';
@@ -468,6 +469,257 @@ function defaultOutFromCloneTarget({ url, id, }) {
     const match = /\/repos\/([^/]+)\/git\/?$/.exec(new URL(url).pathname);
     return match?.[1] ?? 'repo';
 }
+/**
+ * Mirror of atlas `ci-discover` Zod contract so `repos ci show` fails closed
+ * on the same invalid `.seq/ci.json` shapes the runner rejects (`ci/config`).
+ * Keep in sync with `atlas/src/server/services/git-service/ci-discover.ts`.
+ */
+const CiPhaseSchema = z.enum(['check', 'test']);
+const CiJsonEntrySchema = z
+    .object({
+    phase: CiPhaseSchema,
+    name: z
+        .string()
+        .min(1)
+        .max(64)
+        .regex(/^[a-z][a-z0-9._/-]*$/)
+        .optional(),
+    script: z.string().min(1).max(128).optional(),
+    command: z.array(z.string().min(1).max(256)).min(1).max(32).optional(),
+})
+    .superRefine((entry, ctx) => {
+    const hasScript = entry.script != null;
+    const hasCommand = entry.command != null;
+    if (hasScript === hasCommand) {
+        ctx.addIssue({
+            code: z.ZodIssueCode.custom,
+            message: 'each check must specify exactly one of script or command',
+            path: hasScript ? ['command'] : ['script'],
+        });
+    }
+});
+const CiJsonSchema = z.object({
+    checks: z.array(CiJsonEntrySchema).max(16),
+});
+/** Match atlas `ci-discover` defaultNameForPhase (per-phase index, not array index). */
+function defaultNameForPhase(phase, indexInPhase) {
+    if (indexInPhase === 0)
+        return `ci/${phase}`;
+    return `ci/${phase}-${indexInPhase + 1}`;
+}
+/**
+ * Pure discovery shared by `repos ci show` / `import`. Mirrors atlas
+ * `discoverCiChecks` / `parseCiJson` so CLI preview matches execution.
+ */
+export function discoverCliChecks({ ciJson, packageScripts, }) {
+    if (ciJson !== undefined) {
+        const parsed = CiJsonSchema.safeParse(ciJson);
+        if (!parsed.success) {
+            const detail = parsed.error.issues
+                .map((i) => `${i.path.join('.') || '(root)'}: ${i.message}`)
+                .slice(0, 3)
+                .join('; ');
+            return { ok: false, error: `Invalid .seq/ci.json: ${detail}` };
+        }
+        const phaseCounts = new Map();
+        const seenNames = new Set();
+        const checks = [];
+        for (const entry of parsed.data.checks) {
+            const indexInPhase = phaseCounts.get(entry.phase) ?? 0;
+            phaseCounts.set(entry.phase, indexInPhase + 1);
+            const name = entry.name ?? defaultNameForPhase(entry.phase, indexInPhase);
+            if (seenNames.has(name)) {
+                return {
+                    ok: false,
+                    error: `Invalid .seq/ci.json: duplicate check name "${name}"`,
+                };
+            }
+            seenNames.add(name);
+            const check = {
+                name,
+                source: 'ci.json',
+            };
+            if (entry.script != null)
+                check.script = entry.script;
+            if (entry.command != null)
+                check.command = entry.command;
+            checks.push(check);
+        }
+        return { ok: true, checks };
+    }
+    const checks = [];
+    if (packageScripts) {
+        for (const candidate of ['lint', 'typecheck', 'check']) {
+            if (packageScripts[candidate]?.trim()) {
+                checks.push({ name: 'ci/check', script: candidate, source: 'autodiscover' });
+                break;
+            }
+        }
+        if (packageScripts.test?.trim()) {
+            checks.push({ name: 'ci/test', script: 'test', source: 'autodiscover' });
+        }
+    }
+    return { ok: true, checks };
+}
+function decodeFileContent(file) {
+    return file.encoding === 'base64'
+        ? Buffer.from(file.content, 'base64').toString('utf8')
+        : file.content;
+}
+/**
+ * Load `.seq/ci.json` / `package.json` for CI preview.
+ *
+ * Matches the runner: only a true 404 means "file absent". Invalid JSON and
+ * non-404 API errors fail closed (no silent package.json fallback over a bad
+ * `.seq/ci.json`).
+ */
+export async function loadRemoteCiSources({ ctx, repoId, ref, }) {
+    let ciJson;
+    try {
+        const file = await getJsonOr404({
+            ...clientOptions(ctx),
+            path: `/api/git-service/repos/${repoId}/contents/.seq/ci.json?ref=${encodeURIComponent(ref)}`,
+        });
+        if (file != null) {
+            try {
+                ciJson = JSON.parse(decodeFileContent(file));
+            }
+            catch {
+                return { ok: false, error: 'invalid .seq/ci.json: not valid JSON' };
+            }
+        }
+    }
+    catch (err) {
+        if (err instanceof AtlasApiError) {
+            return { ok: false, error: `failed to fetch .seq/ci.json: ${err.message}` };
+        }
+        throw err;
+    }
+    // When ci.json is present (including empty checks), skip package.json —
+    // discovery never falls through to autodiscover in that case.
+    if (ciJson !== undefined) {
+        return { ok: true, ciJson };
+    }
+    let packageScripts;
+    try {
+        const file = await getJsonOr404({
+            ...clientOptions(ctx),
+            path: `/api/git-service/repos/${repoId}/contents/package.json?ref=${encodeURIComponent(ref)}`,
+        });
+        if (file != null) {
+            let pkg;
+            try {
+                pkg = JSON.parse(decodeFileContent(file));
+            }
+            catch {
+                return { ok: false, error: 'invalid package.json: not valid JSON' };
+            }
+            if (pkg.scripts && typeof pkg.scripts === 'object') {
+                packageScripts = {};
+                for (const [key, value] of Object.entries(pkg.scripts)) {
+                    if (typeof value === 'string')
+                        packageScripts[key] = value;
+                }
+            }
+        }
+    }
+    catch (err) {
+        if (err instanceof AtlasApiError) {
+            return { ok: false, error: `failed to fetch package.json: ${err.message}` };
+        }
+        throw err;
+    }
+    return { ok: true, packageScripts };
+}
+/**
+ * Discover CI checks from a remote repo tip (pure preview — no Settings write).
+ * Uses the same autodiscovery rules as the platform runner (PLA-378).
+ */
+export async function reposCiShowCommand(args) {
+    const { namespace, name } = parseRepoPath(args.positional[0]);
+    const ctx = await reposContext(args);
+    const resolved = await resolveRepo({ ...clientOptions(ctx), namespace, name });
+    const repo = await getJson({
+        ...clientOptions(ctx),
+        path: `/api/git-service/repos/${resolved.id}`,
+    });
+    const ref = stringFlag(args.flags, 'ref') ?? repo.defaultBranch;
+    const required = new Set(repo.reviewPolicy?.requiredChecks ?? []);
+    const sources = await loadRemoteCiSources({ ctx, repoId: resolved.id, ref });
+    if (!sources.ok) {
+        console.error(`${LOG} ${sources.error} on ${namespace}/${name}@${ref}`);
+        return 1;
+    }
+    const discovered = discoverCliChecks(sources);
+    if (!discovered.ok) {
+        console.error(`${LOG} ${discovered.error} on ${namespace}/${name}@${ref}`);
+        return 1;
+    }
+    console.log(`${LOG} CI for ${namespace}/${name}@${ref} on ${ctx.env.name}:`);
+    if (discovered.checks.length === 0) {
+        console.log('  (no checks discovered)');
+        return 0;
+    }
+    for (const check of discovered.checks) {
+        const how = check.script != null
+            ? `script=${check.script}`
+            : check.command != null
+                ? `command=${JSON.stringify(check.command)}`
+                : '';
+        console.log(`  ${check.name}  ${how}  source=${check.source}  required=${required.has(check.name)}`);
+    }
+    return 0;
+}
+const REQUIRED_CHECKS_WRITE_DISABLED = `${LOG} writing requiredChecks is disabled until the sandboxed CI runner is live ` +
+    `(discovery posts neutral check-runs that cannot satisfy the merge gate). ` +
+    `Use \`seq-studio repos ci show\` to preview discovered names.`;
+/** Add a check-run name to Settings `requiredChecks` (merge-blocking). */
+export async function reposCiRequireCommand(args) {
+    const check = stringFlag(args.flags, 'check');
+    if (!check) {
+        console.error('usage: seq-studio repos ci require <ns>/<name> --check <name> -e <env>');
+        return 1;
+    }
+    console.error(REQUIRED_CHECKS_WRITE_DISABLED);
+    return 1;
+}
+/**
+ * Set requiredChecks to every check discovered on the tip (opt-in bulk require).
+ */
+export async function reposCiImportCommand(args) {
+    // Still run show so authors can preview names, then refuse the write.
+    const code = await reposCiShowCommand(args);
+    if (code !== 0)
+        return code;
+    console.error(REQUIRED_CHECKS_WRITE_DISABLED);
+    return 1;
+}
+export async function reposCiCommand(args) {
+    const [action] = args.positional;
+    const rest = {
+        ...args,
+        positional: args.positional.slice(1),
+    };
+    switch (action) {
+        case 'show':
+            return reposCiShowCommand(rest);
+        case 'require':
+            return reposCiRequireCommand(rest);
+        case 'import':
+            return reposCiImportCommand(rest);
+        case 'help':
+        case undefined:
+            console.log(`usage:
+  seq-studio repos ci show <ns>/<name> -e <env> [--ref r]           preview discovered CI checks
+  seq-studio repos ci require <ns>/<name> --check <name> -e <env>   reserved (refuses write until sandboxed runner)
+  seq-studio repos ci import <ns>/<name> -e <env> [--ref r]         reserved (refuses write until sandboxed runner)
+`);
+            return action ? 0 : 1;
+        default:
+            console.error(`unknown repos ci command: ${action}`);
+            return 1;
+    }
+}
 export async function reposDeleteCommand(args) {
     const { namespace, name } = parseRepoPath(args.positional[0]);
     const ctx = await reposContext(args);
@@ -505,6 +757,9 @@ export const REPOS_USAGE = `usage:
   seq-studio repos pull <ns>/<name> -e <env> [--ref r] [--out dir] [--force]
                                                                     materialize the tree at a ref (JSON API)
   seq-studio repos delete <ns>/<name> -e <env> [--yes]              delete a repo (confirm prompt)
+  seq-studio repos ci show <ns>/<name> -e <env> [--ref r]           preview discovered CI checks
+  seq-studio repos ci require <ns>/<name> --check <name> -e <env>   reserved (refuses write until sandboxed runner)
+  seq-studio repos ci import <ns>/<name> -e <env> [--ref r]         reserved (refuses write until sandboxed runner)
 
   Flags: -e/--env <env> (required; see: seq-studio envs list)
 
@@ -534,6 +789,8 @@ export async function runReposCommand(sub, args) {
                 return await reposPullCommand(args);
             case 'delete':
                 return await reposDeleteCommand(args);
+            case 'ci':
+                return await reposCiCommand(args);
             case 'help':
             case '--help':
             case '-h':

package/dist/secrets/commands.d.ts

@@ -1,5 +1,7 @@
 import type { ParsedArgs } from '../process/commands.js';
 export declare const LOG = "[seq-studio]";
+/** Drop one trailing LF or CRLF so Windows-authored --from-file values match Unix. */
+export declare function stripOneTrailingNewline(value: string): string;
 export declare function secretsCreateCommand(args: ParsedArgs): Promise<number>;
 export declare function secretsSetCommand(args: ParsedArgs): Promise<number>;
 export declare function secretsListCommand(args: ParsedArgs): Promise<number>;
@@ -20,5 +22,5 @@ export declare function secretsSetDefaultCommand(args: ParsedArgs): Promise<numb
  * UI: pin + redeploy the function's active version / pin only / cancel.
  */
 export declare function secretsPinCommand(args: ParsedArgs): Promise<number>;
-export declare const SECRETS_USAGE = "usage:\n  seq-studio secrets create <NAME> -e <env> [--description text]   register an org-owned secret\n  seq-studio secrets set <NAME> -e <env>                             set the shared default value (write-only)\n  seq-studio secrets list -e <env>                                   secrets you can see (never values)\n  seq-studio secrets attach <NAME> --fn <slug> -e <env>              mount default on a function env var\n  seq-studio secrets detach <NAME> --fn <slug> -e <env>              remove attachment\n  seq-studio secrets apply --from-env-file .env -e <env>             push defaults + attach (keys default from manifest)\n  seq-studio secrets versions <NAME> -e <env>                        value version history (never values)\n  seq-studio secrets set-default <NAME> [version] -e <env>           point the default at a prior version (editor)\n  seq-studio secrets pin <NAME> --fn <slug> [version] -e <env>       pin one function to a version (sticky; --unpin clears)\n\n  Note: for the common deploy loop, secrets declared in managed-function.yml are\n  reconciled automatically by `seq-studio functions deploy` using a local .env.\n  Use `secrets` commands for CI (no .env), bulk/multi-function ops, or write-only\n  value changes without a redeploy.\n\n  Flags: -e/--env <env> (required; see: seq-studio envs list)\n         --fn <slug> \u00B7 --env-var <NAME> \u00B7 --yes\n         --functions <f1,f2> \u00B7 --keys <K1,K2> \u00B7 --all (override key selection)\n         set-default: [version|version-row-id] (defaults to the most recent non-default) \u00B7 --yes\n         pin: [version|version-row-id] (defaults to the current default) \u00B7 --unpin \u00B7 --yes (redeploy) \u00B7 --yes --no-redeploy\n";
+export declare const SECRETS_USAGE = "usage:\n  seq-studio secrets create <NAME> -e <env> [--org <slug>] [--description text]\n                                                                     register an org-owned secret\n  seq-studio secrets set <NAME> -e <env> [--org <slug>] [--from-file <path>]\n                                                                     set the shared default value (write-only)\n  seq-studio secrets list -e <env>                                   secrets you can see (never values)\n  seq-studio secrets attach <NAME> --fn <slug> -e <env> [--org <slug>]\n                                                                     mount default on a function env var\n  seq-studio secrets detach <NAME> --fn <slug> -e <env> [--org <slug>]\n                                                                     remove attachment\n  seq-studio secrets apply --from-env-file .env -e <env>             push defaults + attach (keys default from manifest)\n  seq-studio secrets versions <NAME> -e <env> [--org <slug>]         value version history (never values)\n  seq-studio secrets set-default <NAME> [version] -e <env> [--org <slug>]\n                                                                     point the default at a prior version (editor)\n  seq-studio secrets pin <NAME> --fn <slug> [version] -e <env> [--org <slug>]\n                                                                     pin one function to a version (sticky; --unpin clears)\n\n  Note: for the common deploy loop, secrets declared in managed-function.yml are\n  reconciled automatically by `seq-studio functions deploy` using a local .env.\n  Use `secrets` commands for CI (no .env), bulk/multi-function ops, or write-only\n  value changes without a redeploy.\n\n  Flags: -e/--env <env> (required; see: seq-studio envs list)\n         --org <slug> (target/select managed-scope org; required when a name exists in multiple orgs)\n         set: --from-file <path> (non-interactive; file is not echoed)\n         --fn <slug> \u00B7 --env-var <NAME> \u00B7 --yes\n         --functions <f1,f2> \u00B7 --keys <K1,K2> \u00B7 --all (override key selection)\n         set-default: [version|version-row-id] (defaults to the most recent non-default) \u00B7 --yes\n         pin: [version|version-row-id] (defaults to the current default) \u00B7 --unpin \u00B7 --yes (redeploy) \u00B7 --yes --no-redeploy\n";
 export declare function runSecretsCommand(sub: string | undefined, args: ParsedArgs): Promise<number>;

package/dist/secrets/commands.js

@@ -41,6 +41,25 @@ function parseCommaList(value) {
         .map((part) => part.trim())
         .filter(Boolean);
 }
+function orgFlag(args) {
+    return typeof args.flags.org === 'string' ? args.flags.org.trim().toLowerCase() : undefined;
+}
+/** First-party Sequence Atlas envs — their Lakebase registry is org=sequence. */
+const SEQUENCE_OWNED_ENVS = new Set(['local', 'staging', 'production']);
+/** Refuse --org that would write a tenant row into the wrong deployment registry. */
+function orgDeploymentError(org, envName) {
+    if (SEQUENCE_OWNED_ENVS.has(envName) && org !== 'sequence') {
+        return `--org ${org} must be used with -e ${org} (${envName} only holds the sequence secret registry)`;
+    }
+    if (!SEQUENCE_OWNED_ENVS.has(envName) && org === 'sequence') {
+        return `--org sequence is not valid on -e ${envName} (that deployment does not own the Sequence registry)`;
+    }
+    return null;
+}
+/** Drop one trailing LF or CRLF so Windows-authored --from-file values match Unix. */
+export function stripOneTrailingNewline(value) {
+    return value.replace(/\r?\n$/, '');
+}
 async function listSecrets(ctx) {
     const { secrets } = await getJson({
         ...clientOptions(ctx),
@@ -48,11 +67,24 @@ async function listSecrets(ctx) {
     });
     return secrets;
 }
-async function resolveSecretByName({ ctx, name, }) {
+async function resolveSecretByName({ ctx, name, org, }) {
     const secrets = await listSecrets(ctx);
-    const secret = secrets.find((row) => row.name === name);
+    const matches = secrets.filter((row) => row.name === name);
+    const scoped = org ? matches.filter((row) => row.orgId === org) : matches;
+    if (scoped.length === 0) {
+        throw new Error(`Managed secret "${name}" not found on ${ctx.env.name}` +
+            (org ? ` org=${org}` : '') +
+            ` (or you don't have access).`);
+    }
+    if (scoped.length > 1) {
+        const orgs = scoped.map((row) => row.orgId).join(', ');
+        throw new Error(`Managed secret "${name}" exists in multiple orgs (${orgs}). Pass --org <slug>.`);
+    }
+    const [secret] = scoped;
     if (!secret) {
-        throw new Error(`Managed secret "${name}" not found on ${ctx.env.name} (or you don't have access).`);
+        throw new Error(`Managed secret "${name}" not found on ${ctx.env.name}` +
+            (org ? ` org=${org}` : '') +
+            ` (or you don't have access).`);
     }
     return secret;
 }
@@ -128,20 +160,29 @@ async function functionExistsBySlugEventually({ ctx, slug, attempts = 3, retryDe
 export async function secretsCreateCommand(args) {
     const name = args.positional[0];
     if (!name) {
-        console.error('usage: seq-studio secrets create <NAME> -e <env> [--description text]');
+        console.error('usage: seq-studio secrets create <NAME> -e <env> [--org <slug>] [--description text]');
         return 1;
     }
     const ctx = await buildContext(args);
     const description = typeof args.flags.description === 'string' ? args.flags.description : undefined;
+    const org = orgFlag(args);
+    if (org) {
+        const mismatch = orgDeploymentError(org, ctx.env.name);
+        if (mismatch) {
+            console.error(`${LOG} ${mismatch}`);
+            return 1;
+        }
+    }
     const secret = await postJson({
         ...clientOptions(ctx),
         path: '/api/managed-secrets',
         body: {
             name,
             description: description ?? null,
+            ...(org ? { orgId: org } : {}),
         },
     });
-    console.log(`${LOG} created managed secret "${secret.name}" (${secret.id}) on ${ctx.env.name}`);
+    console.log(`${LOG} created managed secret "${secret.name}" (${secret.id}) org=${secret.orgId} on ${ctx.env.name}`);
     return 0;
 }
 // ---------------------------------------------------------------------------
@@ -150,12 +191,24 @@ export async function secretsCreateCommand(args) {
 export async function secretsSetCommand(args) {
     const name = args.positional[0];
     if (!name) {
-        console.error('usage: seq-studio secrets set <NAME> -e <env>');
+        console.error('usage: seq-studio secrets set <NAME> -e <env> [--org <slug>] [--from-file <path>]');
         return 1;
     }
     const ctx = await buildContext(args);
-    const secret = await resolveSecretByName({ ctx, name });
-    const value = await promptHidden(`Default value for ${name} (input hidden): `);
+    const secret = await resolveSecretByName({ ctx, name, org: orgFlag(args) });
+    const fromFile = typeof args.flags['from-file'] === 'string' ? args.flags['from-file'] : undefined;
+    let value;
+    if (fromFile) {
+        const filePath = isAbsolute(fromFile) ? fromFile : resolve(workDir(args), fromFile);
+        if (!existsSync(filePath)) {
+            console.error(`${LOG} --from-file not found: ${filePath}`);
+            return 1;
+        }
+        value = stripOneTrailingNewline(await readFile(filePath, 'utf8'));
+    }
+    else {
+        value = await promptHidden(`Default value for ${name} (input hidden): `);
+    }
     if (!value) {
         console.error(`${LOG} empty value — aborted`);
         return 1;
@@ -183,7 +236,7 @@ export async function secretsListCommand(args) {
     for (const secret of secrets) {
         const defaultState = secret.hasDefaultValue ? 'default set' : 'no default';
         const access = secret.currentUserAccess ?? 'none';
-        console.log(`  ${secret.name}  [${defaultState}]  access=${access}  attachments=${secret.attachmentCount}`);
+        console.log(`  ${secret.name}  org=${secret.orgId}  [${defaultState}]  access=${access}  attachments=${secret.attachmentCount}`);
     }
     return 0;
 }
@@ -194,11 +247,11 @@ export async function secretsAttachCommand(args) {
     const name = args.positional[0];
     const fnSlug = typeof args.flags.fn === 'string' ? args.flags.fn : args.positional[1];
     if (!name || !fnSlug) {
-        console.error('usage: seq-studio secrets attach <NAME> --fn <slug> -e <env> [--env-var NAME]');
+        console.error('usage: seq-studio secrets attach <NAME> --fn <slug> -e <env> [--org <slug>] [--env-var NAME]');
         return 1;
     }
     const ctx = await buildContext(args);
-    const secret = await resolveSecretByName({ ctx, name });
+    const secret = await resolveSecretByName({ ctx, name, org: orgFlag(args) });
     const fn = await resolveFunctionBySlug({ ctx, slug: fnSlug });
     const envVarName = (typeof args.flags['env-var'] === 'string' ? args.flags['env-var'] : undefined) ?? name;
     if (secret.hasDefaultValue) {
@@ -229,11 +282,11 @@ export async function secretsDetachCommand(args) {
     const name = args.positional[0];
     const fnSlug = typeof args.flags.fn === 'string' ? args.flags.fn : args.positional[1];
     if (!name || !fnSlug) {
-        console.error('usage: seq-studio secrets detach <NAME> --fn <slug> -e <env>');
+        console.error('usage: seq-studio secrets detach <NAME> --fn <slug> -e <env> [--org <slug>]');
         return 1;
     }
     const ctx = await buildContext(args);
-    const secret = await resolveSecretByName({ ctx, name });
+    const secret = await resolveSecretByName({ ctx, name, org: orgFlag(args) });
     const fn = await resolveFunctionBySlug({ ctx, slug: fnSlug });
     await deleteJson({
         ...clientOptions(ctx),
@@ -464,11 +517,11 @@ async function attachedFunctionSlugs(ctx, secretId) {
 export async function secretsVersionsCommand(args) {
     const name = args.positional[0];
     if (!name) {
-        console.error('usage: seq-studio secrets versions <NAME> -e <env>');
+        console.error('usage: seq-studio secrets versions <NAME> -e <env> [--org <slug>]');
         return 1;
     }
     const ctx = await buildContext(args);
-    const secret = await resolveSecretByName({ ctx, name });
+    const secret = await resolveSecretByName({ ctx, name, org: orgFlag(args) });
     const versions = await listSecretVersions(ctx, secret.id);
     if (versions.length === 0) {
         console.log(`${LOG} no versions recorded for "${name}" on ${ctx.env.name}`);
@@ -492,11 +545,11 @@ export async function secretsVersionsCommand(args) {
 export async function secretsSetDefaultCommand(args) {
     const name = args.positional[0];
     if (!name) {
-        console.error('usage: seq-studio secrets set-default <NAME> [version] -e <env> [--yes]');
+        console.error('usage: seq-studio secrets set-default <NAME> [version] -e <env> [--org <slug>] [--yes]');
         return 1;
     }
     const ctx = await buildContext(args);
-    const secret = await resolveSecretByName({ ctx, name });
+    const secret = await resolveSecretByName({ ctx, name, org: orgFlag(args) });
     const versions = await listSecretVersions(ctx, secret.id);
     if (versions.length === 0) {
         console.error(`${LOG} "${name}" has no recorded versions`);
@@ -558,11 +611,11 @@ export async function secretsPinCommand(args) {
     const name = args.positional[0];
     const fnSlug = typeof args.flags.fn === 'string' ? args.flags.fn : undefined;
     if (!name || !fnSlug) {
-        console.error('usage: seq-studio secrets pin <NAME> --fn <slug> [version] [--unpin] -e <env> [--yes] [--no-redeploy]');
+        console.error('usage: seq-studio secrets pin <NAME> --fn <slug> [version] [--unpin] -e <env> [--org <slug>] [--yes] [--no-redeploy]');
         return 1;
     }
     const ctx = await buildContext(args);
-    const secret = await resolveSecretByName({ ctx, name });
+    const secret = await resolveSecretByName({ ctx, name, org: orgFlag(args) });
     const fn = await resolveFunctionBySlug({ ctx, slug: fnSlug });
     if (flagBool(args.flags, 'unpin')) {
         const preview = [
@@ -643,15 +696,21 @@ export async function secretsPinCommand(args) {
 // dispatcher
 // ---------------------------------------------------------------------------
 export const SECRETS_USAGE = `usage:
-  seq-studio secrets create <NAME> -e <env> [--description text]   register an org-owned secret
-  seq-studio secrets set <NAME> -e <env>                             set the shared default value (write-only)
+  seq-studio secrets create <NAME> -e <env> [--org <slug>] [--description text]
+                                                                     register an org-owned secret
+  seq-studio secrets set <NAME> -e <env> [--org <slug>] [--from-file <path>]
+                                                                     set the shared default value (write-only)
   seq-studio secrets list -e <env>                                   secrets you can see (never values)
-  seq-studio secrets attach <NAME> --fn <slug> -e <env>              mount default on a function env var
-  seq-studio secrets detach <NAME> --fn <slug> -e <env>              remove attachment
+  seq-studio secrets attach <NAME> --fn <slug> -e <env> [--org <slug>]
+                                                                     mount default on a function env var
+  seq-studio secrets detach <NAME> --fn <slug> -e <env> [--org <slug>]
+                                                                     remove attachment
   seq-studio secrets apply --from-env-file .env -e <env>             push defaults + attach (keys default from manifest)
-  seq-studio secrets versions <NAME> -e <env>                        value version history (never values)
-  seq-studio secrets set-default <NAME> [version] -e <env>           point the default at a prior version (editor)
-  seq-studio secrets pin <NAME> --fn <slug> [version] -e <env>       pin one function to a version (sticky; --unpin clears)
+  seq-studio secrets versions <NAME> -e <env> [--org <slug>]         value version history (never values)
+  seq-studio secrets set-default <NAME> [version] -e <env> [--org <slug>]
+                                                                     point the default at a prior version (editor)
+  seq-studio secrets pin <NAME> --fn <slug> [version] -e <env> [--org <slug>]
+                                                                     pin one function to a version (sticky; --unpin clears)
 
   Note: for the common deploy loop, secrets declared in managed-function.yml are
   reconciled automatically by \`seq-studio functions deploy\` using a local .env.
@@ -659,6 +718,8 @@ export const SECRETS_USAGE = `usage:
   value changes without a redeploy.
 
   Flags: -e/--env <env> (required; see: seq-studio envs list)
+         --org <slug> (target/select managed-scope org; required when a name exists in multiple orgs)
+         set: --from-file <path> (non-interactive; file is not echoed)
          --fn <slug> · --env-var <NAME> · --yes
          --functions <f1,f2> · --keys <K1,K2> · --all (override key selection)
          set-default: [version|version-row-id] (defaults to the most recent non-default) · --yes

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@sequenceholdings/studio-cli",
-  "version": "0.1.21",
-  "description": "Unified Sequence Studio CLI — `seq-studio agents` (typed agent definitions), `seq-studio process` (Lattice), `seq-studio artifact` (Artifact Studio), `seq-studio functions` / `secrets`, `seq-studio repos` (platform git-service), and `seq-studio auth pat` (git-service PATs). Includes Auth0 browser login shared with seqapi.",
+  "version": "0.1.24",
+  "description": "Unified Sequence Studio CLI — `seq-studio init` / `add` / `deploy` (app monorepos), `seq-studio agents`, `seq-studio process` (Lattice), `seq-studio artifact`, `seq-studio functions` / `secrets`, `seq-studio repos`, and `seq-studio auth pat`. Includes Auth0 browser login shared with seqapi.",
   "license": "UNLICENSED",
   "repository": {
     "type": "git",
@@ -40,12 +40,12 @@
     "smol-toml": "^1.4.2",
     "tsx": "^4.20.3",
     "zod": "^4.1.13",
-    "@sequenceholdings/agent-spec": "0.1.0",
-    "@sequenceholdings/artifact-studio": "0.2.0",
-    "@sequenceholdings/lattice": "0.1.2"
+    "@sequenceholdings/artifact-studio": "0.2.1",
+    "@sequenceholdings/lattice": "0.1.2",
+    "@sequenceholdings/agent-spec": "0.1.1"
   },
   "peerDependencies": {
-    "@sequenceholdings/orm": "0.1.2",
+    "@sequenceholdings/orm": "0.1.3",
     "@sequenceholdings/pipeline-spec": "0.1.0"
   },
   "peerDependenciesMeta": {
@@ -61,8 +61,8 @@
     "@types/node": "^22.0.0",
     "typescript": "^5.6.0",
     "vitest": "^4.1.5",
-    "@sequenceholdings/orm": "0.1.2",
-    "@sequenceholdings/pipeline-spec": "0.1.0"
+    "@sequenceholdings/pipeline-spec": "0.1.0",
+    "@sequenceholdings/orm": "0.1.3"
   },
   "engines": {
     "node": ">=20"

package/dist/pipeline/pinning.d.ts

@@ -1,5 +0,0 @@
-/** Client-side pin rules mirrored from the server deploy adapter (SEQ-2450). */
-export declare const FULL_SHA_PATTERN: RegExp;
-export declare const PINNED_ENVIRONMENTS: Set<string>;
-export declare function isFullSha(ref: string): boolean;
-export declare function requiresPinnedSha(environment: string): boolean;

package/dist/pipeline/pinning.js

@@ -1,9 +0,0 @@
-/** Client-side pin rules mirrored from the server deploy adapter (SEQ-2450). */
-export const FULL_SHA_PATTERN = /^[0-9a-f]{40}$/i;
-export const PINNED_ENVIRONMENTS = new Set(['production', 'banksouth']);
-export function isFullSha(ref) {
-    return FULL_SHA_PATTERN.test(ref);
-}
-export function requiresPinnedSha(environment) {
-    return PINNED_ENVIRONMENTS.has(environment);
-}