@sequenceholdings/studio-cli 0.1.22 → 0.1.24

package/dist/pipeline/lifecycle.js

@@ -5,9 +5,34 @@
 import { getAccessToken, NotLoggedInError } from '../auth.js';
 import { AtlasApiError, getJson, postJson } from '../atlas-client.js';
 import { resolveEnvWithDiscovery } from '../config.js';
-import { isFullSha, requiresPinnedSha } from './pinning.js';
 const LOG = '[seq-studio]';
 const TERMINAL = new Set(['active', 'failed', 'retired']);
+const POLL_INTERVAL_MS = 2000;
+const HEARTBEAT_INTERVAL_MS = 20_000;
+const FIRST_PARTY_TARGETS = [
+    { id: 'dev', label: 'Development', requiresApproval: false },
+    { id: 'staging', label: 'Staging', requiresApproval: false },
+    { id: 'production', label: 'Production', requiresApproval: true },
+    { id: 'banksouth', label: 'BankSouth', requiresApproval: true },
+];
+function formatElapsed(ms) {
+    const totalSec = Math.floor(ms / 1000);
+    if (totalSec < 60)
+        return `${totalSec}s`;
+    const min = Math.floor(totalSec / 60);
+    const sec = totalSec % 60;
+    return sec > 0 ? `${min}m ${sec}s` : `${min}m`;
+}
+function deploymentProgressSuffix(detail) {
+    if (detail.triggerRunId)
+        return ` (trigger ${detail.triggerRunId})`;
+    return '';
+}
+function deploymentStatusLabel(detail) {
+    if (detail.statusDetail)
+        return `${detail.status} — ${detail.statusDetail}`;
+    return detail.status;
+}
 async function envAndToken(args) {
     const requested = typeof args.flags.e === 'string' ? args.flags.e : typeof args.flags.env === 'string' ? args.flags.env : undefined;
     if (!requested) {
@@ -31,21 +56,32 @@ function flagString(flags, key) {
         throw new Error(`--${key} requires a value`);
     return value;
 }
-/**
- * The CLI's local dev-loop env is named `local` — chosen so `-e local` lines
- * up with `seqapi -e local` / `artifact-studio --env local` (see `config.ts`
- * `BUILT_IN_ENV_URLS`). There is no `local` in the server's deploy-lifecycle
- * enum (`DEPLOY_ENVIRONMENTS` in `atlas/src/server/services/data-pipelines/schema.ts`
- * is `dev | staging | production | banksouth`); the server's name for that
- * same developer-loop target is `dev` (`targetFactsForEnvironment` treats
- * `dev` as the one target exempt from a `lakebase_branch` binding). Map at
- * this one boundary — every lifecycle request body funnels through here —
- * so the CLI never sends the wire-invalid `local` and every other env name
- * passes through unchanged.
- */
 export function deployEnvironmentForEnv(env) {
     return env.name === 'local' ? 'dev' : env.name;
 }
+async function resolvePipelineTarget({ args, env, token, }) {
+    const requested = flagString(args.flags, 'target');
+    const inferredId = requested ?? deployEnvironmentForEnv(env);
+    if (!requested) {
+        const firstPartyTarget = FIRST_PARTY_TARGETS.find((target) => target.id === inferredId);
+        if (firstPartyTarget)
+            return firstPartyTarget;
+    }
+    const response = await getJson({
+        baseUrl: env.url,
+        token,
+        path: '/api/data-pipelines/targets',
+    });
+    const targets = response.targets;
+    const matchingTarget = targets.find((target) => target.id === inferredId);
+    if (matchingTarget)
+        return matchingTarget;
+    if (!requested && targets.length === 1)
+        return targets[0];
+    const available = targets.map((target) => target.id).join(', ') || 'none';
+    throw new Error(`could not select a pipeline target for '${env.name}'; available targets: ${available}. ` +
+        'Pass --target <id> explicitly.');
+}
 export async function pipelinePlanCommand(args) {
     const repo = flagString(args.flags, 'repo');
     const ref = flagString(args.flags, 'ref');
@@ -55,13 +91,21 @@ export async function pipelinePlanCommand(args) {
     }
     const { env, token } = await envAndToken(args);
     const json = args.flags.json === true || args.flags.json === 'true';
+    let target;
+    try {
+        target = await resolvePipelineTarget({ args, env, token });
+    }
+    catch (error) {
+        console.error(`${LOG} plan failed: ${error instanceof Error ? error.message : String(error)}`);
+        return 1;
+    }
     let response;
     try {
         response = await postJson({
             baseUrl: env.url,
             token,
             path: '/api/data-pipelines/pipelines/plan',
-            body: { repo, ref, environment: deployEnvironmentForEnv(env) },
+            body: { repo, ref, environment: target.id },
         });
     }
     catch (error) {
@@ -86,8 +130,12 @@ export async function pipelineDeployCommand(args) {
     const deploymentId = flagString(args.flags, 'deployment-id');
     const approvedBy = flagString(args.flags, 'approved-by');
     const { env, token } = await envAndToken(args);
-    if (requiresPinnedSha(env.name) && ref && !isFullSha(ref)) {
-        console.error(`${LOG} deploy to ${env.name} requires a pinned 40-hex commit SHA (got '${ref}')`);
+    let target;
+    try {
+        target = await resolvePipelineTarget({ args, env, token });
+    }
+    catch (error) {
+        console.error(`${LOG} deploy failed: ${error instanceof Error ? error.message : String(error)}`);
         return 1;
     }
     let enqueue;
@@ -96,19 +144,19 @@ export async function pipelineDeployCommand(args) {
             // Direct execute of a persisted plan.
             const stageId = flagString(args.flags, 'stage-id');
             if (!stageId) {
-                console.error('usage: seq-studio pipeline deploy --deployment-id <id> --stage-id <id> -e <env> [--approved-by <sub>] [--no-wait]');
+                console.error('usage: seq-studio pipeline deploy --deployment-id <id> --stage-id <id> -e <env> [--target <id>] [--approved-by <sub>] [--no-wait]');
                 return 1;
             }
             enqueue = await postJson({
                 baseUrl: env.url,
                 token,
                 path: `/api/data-pipelines/stages/${stageId}/deploy`,
-                body: { deploymentId, ...(approvedBy ? { approvedBy } : {}) },
+                body: { deploymentId, environment: target.id, ...(approvedBy ? { approvedBy } : {}) },
             });
         }
         else {
             if (!repo || !ref) {
-                console.error('usage: seq-studio pipeline deploy --repo pipelines/<slug> --ref <sha> -e <env> [--approved-by <sub>] [--no-wait]');
+                console.error('usage: seq-studio pipeline deploy --repo pipelines/<slug> --ref <sha|branch> -e <env> [--target <id>] [--approved-by <sub>] [--no-wait]');
                 return 1;
             }
             // Plan then deploy the first planning deployment.
@@ -116,7 +164,7 @@ export async function pipelineDeployCommand(args) {
                 baseUrl: env.url,
                 token,
                 path: '/api/data-pipelines/pipelines/plan',
-                body: { repo, ref, environment: deployEnvironmentForEnv(env) },
+                body: { repo, ref, environment: target.id },
             });
             if (plan.plan.hasDestructive) {
                 console.error(`${LOG} plan has destructive findings — refusing to deploy`);
@@ -140,6 +188,7 @@ export async function pipelineDeployCommand(args) {
                 path: `/api/data-pipelines/stages/${stageId}/deploy`,
                 body: {
                     deploymentId: firstId,
+                    environment: target.id,
                     ...(approvedBy ? { approvedBy } : {}),
                 },
             });
@@ -168,8 +217,16 @@ export async function pipelinePromoteCommand(args) {
         return 1;
     }
     const { env, token } = await envAndToken(args);
-    if (requiresPinnedSha(env.name) && !approvedBy) {
-        console.error(`${LOG} promote to ${env.name} requires --approved-by <your sub/email> (approvals are self-recorded)`);
+    let target;
+    try {
+        target = await resolvePipelineTarget({ args, env, token });
+    }
+    catch (error) {
+        console.error(`${LOG} promote failed: ${error instanceof Error ? error.message : String(error)}`);
+        return 1;
+    }
+    if (target.requiresApproval && !approvedBy) {
+        console.error(`${LOG} promote to ${target.id} requires --approved-by <your sub/email> (approvals are self-recorded)`);
         return 1;
     }
     const stageId = await resolveStageIdBySlug({ baseUrl: env.url, token, slug: stage, repo });
@@ -181,7 +238,7 @@ export async function pipelinePromoteCommand(args) {
             path: `/api/data-pipelines/stages/${stageId}/promote`,
             body: {
                 version,
-                environment: deployEnvironmentForEnv(env),
+                environment: target.id,
                 ...(approvedBy ? { approvedBy } : {}),
             },
         });
@@ -207,6 +264,14 @@ export async function pipelineRunNowCommand(args) {
     }
     const { env, token } = await envAndToken(args);
     const json = args.flags.json === true || args.flags.json === 'true';
+    let target;
+    try {
+        target = await resolvePipelineTarget({ args, env, token });
+    }
+    catch (error) {
+        console.error(`${LOG} run-now failed: ${error instanceof Error ? error.message : String(error)}`);
+        return 1;
+    }
     let stageId;
     try {
         stageId = await resolveStageIdBySlug({ baseUrl: env.url, token, slug: stage, repo });
@@ -221,7 +286,7 @@ export async function pipelineRunNowCommand(args) {
             baseUrl: env.url,
             token,
             path: `/api/data-pipelines/stages/${stageId}/run`,
-            body: { environment: deployEnvironmentForEnv(env) },
+            body: { environment: target.id },
         });
     }
     catch (error) {
@@ -235,7 +300,7 @@ export async function pipelineRunNowCommand(args) {
         console.log(JSON.stringify(response, null, 2));
     }
     else {
-        console.log(`${LOG} run-now ${stage} → ${deployEnvironmentForEnv(env)}`);
+        console.log(`${LOG} run-now ${stage} → ${target.id}`);
         console.log(`${LOG} invocation ${response.invocationId} (${response.status})`);
         console.log(`${LOG} ${response.databricks_url}`);
     }
@@ -250,8 +315,16 @@ export async function pipelineRollbackCommand(args) {
         return 1;
     }
     const { env, token } = await envAndToken(args);
-    if (requiresPinnedSha(env.name) && !approvedBy) {
-        console.error(`${LOG} rollback in ${env.name} requires --approved-by <your sub/email> (approvals are explicit even for rollbacks)`);
+    let target;
+    try {
+        target = await resolvePipelineTarget({ args, env, token });
+    }
+    catch (error) {
+        console.error(`${LOG} rollback failed: ${error instanceof Error ? error.message : String(error)}`);
+        return 1;
+    }
+    if (target.requiresApproval && !approvedBy) {
+        console.error(`${LOG} rollback in ${target.id} requires --approved-by <your sub/email> (approvals are explicit even for rollbacks)`);
         return 1;
     }
     const stageId = await resolveStageIdBySlug({ baseUrl: env.url, token, slug: stage, repo });
@@ -262,7 +335,7 @@ export async function pipelineRollbackCommand(args) {
             token,
             path: `/api/data-pipelines/stages/${stageId}/rollback`,
             body: {
-                environment: deployEnvironmentForEnv(env),
+                environment: target.id,
                 ...(approvedBy ? { approvedBy } : {}),
             },
         });
@@ -295,24 +368,40 @@ function printFindingsTable(findings) {
 async function pollDeployment({ baseUrl, token, deploymentId, }) {
     const started = Date.now();
     const timeoutMs = 15 * 60 * 1000;
+    let lastLoggedLabel = null;
+    let lastLogAt = started;
     while (Date.now() - started < timeoutMs) {
         const detail = await getJson({
             baseUrl,
             token,
             path: `/api/data-pipelines/deployments/${deploymentId}`,
         });
-        console.log(`${LOG} deployment ${deploymentId}: ${detail.status}`);
+        const elapsedMs = Date.now() - started;
         if (TERMINAL.has(detail.status)) {
+            const elapsed = formatElapsed(elapsedMs);
+            const progressSuffix = deploymentProgressSuffix(detail);
             if (detail.status === 'active') {
-                console.log(`${LOG} deploy succeeded`);
+                console.log(`${LOG} deployment ${deploymentId} succeeded (${elapsed})${progressSuffix}`);
                 return 0;
             }
-            console.error(`${LOG} deploy ended '${detail.status}': ${detail.statusDetail ?? ''}`);
+            const detailText = detail.statusDetail ? `: ${detail.statusDetail}` : '';
+            console.error(`${LOG} deployment ${deploymentId} ended ${detail.status} (${elapsed})${detailText}${progressSuffix}`);
             return 1;
         }
-        await new Promise((r) => setTimeout(r, 2000));
+        const progressSuffix = deploymentProgressSuffix(detail);
+        const statusLabel = deploymentStatusLabel(detail);
+        if (statusLabel !== lastLoggedLabel) {
+            console.log(`${LOG} deployment ${deploymentId}: ${statusLabel} (${formatElapsed(elapsedMs)})${progressSuffix}`);
+            lastLoggedLabel = statusLabel;
+            lastLogAt = Date.now();
+        }
+        else if (Date.now() - lastLogAt >= HEARTBEAT_INTERVAL_MS) {
+            console.log(`${LOG} deployment ${deploymentId}: still ${statusLabel} (${formatElapsed(elapsedMs)})${progressSuffix}`);
+            lastLogAt = Date.now();
+        }
+        await new Promise((r) => setTimeout(r, POLL_INTERVAL_MS));
     }
-    console.error(`${LOG} timed out waiting for deployment ${deploymentId}`);
+    console.error(`${LOG} timed out waiting for deployment ${deploymentId} (${formatElapsed(Date.now() - started)})`);
     return 1;
 }
 export async function pipelineAdoptCommand(args) {
@@ -328,6 +417,14 @@ export async function pipelineAdoptCommand(args) {
     }
     const { env, token } = await envAndToken(args);
     const json = args.flags.json === true || args.flags.json === 'true';
+    let target;
+    try {
+        target = await resolvePipelineTarget({ args, env, token });
+    }
+    catch (error) {
+        console.error(`${LOG} adopt failed: ${error instanceof Error ? error.message : String(error)}`);
+        return 1;
+    }
     const repo = flagString(args.flags, 'repo');
     const resourceKey = flagString(args.flags, 'resource-key') ?? stage.replace(/-/g, '_');
     const kind = flagString(args.flags, 'kind') ?? 'job';
@@ -348,7 +445,7 @@ export async function pipelineAdoptCommand(args) {
             token,
             path: `/api/data-pipelines/stages/${stageId}/adopt`,
             body: {
-                environment: deployEnvironmentForEnv(env),
+                environment: target.id,
                 ref,
                 bindings: [{ resourceKey, nativeId, kind }],
                 approvedBy,
@@ -384,6 +481,14 @@ export async function pipelineUnbindCommand(args) {
     }
     const { env, token } = await envAndToken(args);
     const json = args.flags.json === true || args.flags.json === 'true';
+    let target;
+    try {
+        target = await resolvePipelineTarget({ args, env, token });
+    }
+    catch (error) {
+        console.error(`${LOG} unbind failed: ${error instanceof Error ? error.message : String(error)}`);
+        return 1;
+    }
     const repo = flagString(args.flags, 'repo');
     const resourceKey = flagString(args.flags, 'resource-key');
     const stageId = await resolveStageIdBySlug({
@@ -398,7 +503,7 @@ export async function pipelineUnbindCommand(args) {
             token,
             path: `/api/data-pipelines/stages/${stageId}/unbind`,
             body: {
-                environment: deployEnvironmentForEnv(env),
+                environment: target.id,
                 ref,
                 approvedBy,
                 ...(resourceKey ? { resourceKeys: [resourceKey] } : {}),

package/dist/pipeline/templates.js

@@ -116,6 +116,7 @@ const SERVING_BODY = `
 source:
   stage: my-gold-stage
   output: gold.my_table
+  # catalog: src_example   # optional; omit to use the deploy catalog
 projection:
   # The served contract (inline columns or schema_ref):
   columns:
@@ -139,7 +140,8 @@ expose:
 #   table: my_table
 #   mode: referenced
 `;
-const ENTRYPOINT_STUB = `"""Entrypoint stub for the {{name}} stage.
+const ENTRYPOINT_STUB = `# Databricks notebook source
+"""Entrypoint stub for the {{name}} stage.
 
 The platform invokes this per the stage spec ({{name}}.stage.yml).
 Decoders and transforms stay pure — bronze materialization, envelope

package/dist/secrets/commands.d.ts

@@ -1,5 +1,7 @@
 import type { ParsedArgs } from '../process/commands.js';
 export declare const LOG = "[seq-studio]";
+/** Drop one trailing LF or CRLF so Windows-authored --from-file values match Unix. */
+export declare function stripOneTrailingNewline(value: string): string;
 export declare function secretsCreateCommand(args: ParsedArgs): Promise<number>;
 export declare function secretsSetCommand(args: ParsedArgs): Promise<number>;
 export declare function secretsListCommand(args: ParsedArgs): Promise<number>;
@@ -20,5 +22,5 @@ export declare function secretsSetDefaultCommand(args: ParsedArgs): Promise<numb
  * UI: pin + redeploy the function's active version / pin only / cancel.
  */
 export declare function secretsPinCommand(args: ParsedArgs): Promise<number>;
-export declare const SECRETS_USAGE = "usage:\n  seq-studio secrets create <NAME> -e <env> [--description text]   register an org-owned secret\n  seq-studio secrets set <NAME> -e <env>                             set the shared default value (write-only)\n  seq-studio secrets list -e <env>                                   secrets you can see (never values)\n  seq-studio secrets attach <NAME> --fn <slug> -e <env>              mount default on a function env var\n  seq-studio secrets detach <NAME> --fn <slug> -e <env>              remove attachment\n  seq-studio secrets apply --from-env-file .env -e <env>             push defaults + attach (keys default from manifest)\n  seq-studio secrets versions <NAME> -e <env>                        value version history (never values)\n  seq-studio secrets set-default <NAME> [version] -e <env>           point the default at a prior version (editor)\n  seq-studio secrets pin <NAME> --fn <slug> [version] -e <env>       pin one function to a version (sticky; --unpin clears)\n\n  Note: for the common deploy loop, secrets declared in managed-function.yml are\n  reconciled automatically by `seq-studio functions deploy` using a local .env.\n  Use `secrets` commands for CI (no .env), bulk/multi-function ops, or write-only\n  value changes without a redeploy.\n\n  Flags: -e/--env <env> (required; see: seq-studio envs list)\n         --fn <slug> \u00B7 --env-var <NAME> \u00B7 --yes\n         --functions <f1,f2> \u00B7 --keys <K1,K2> \u00B7 --all (override key selection)\n         set-default: [version|version-row-id] (defaults to the most recent non-default) \u00B7 --yes\n         pin: [version|version-row-id] (defaults to the current default) \u00B7 --unpin \u00B7 --yes (redeploy) \u00B7 --yes --no-redeploy\n";
+export declare const SECRETS_USAGE = "usage:\n  seq-studio secrets create <NAME> -e <env> [--org <slug>] [--description text]\n                                                                     register an org-owned secret\n  seq-studio secrets set <NAME> -e <env> [--org <slug>] [--from-file <path>]\n                                                                     set the shared default value (write-only)\n  seq-studio secrets list -e <env>                                   secrets you can see (never values)\n  seq-studio secrets attach <NAME> --fn <slug> -e <env> [--org <slug>]\n                                                                     mount default on a function env var\n  seq-studio secrets detach <NAME> --fn <slug> -e <env> [--org <slug>]\n                                                                     remove attachment\n  seq-studio secrets apply --from-env-file .env -e <env>             push defaults + attach (keys default from manifest)\n  seq-studio secrets versions <NAME> -e <env> [--org <slug>]         value version history (never values)\n  seq-studio secrets set-default <NAME> [version] -e <env> [--org <slug>]\n                                                                     point the default at a prior version (editor)\n  seq-studio secrets pin <NAME> --fn <slug> [version] -e <env> [--org <slug>]\n                                                                     pin one function to a version (sticky; --unpin clears)\n\n  Note: for the common deploy loop, secrets declared in managed-function.yml are\n  reconciled automatically by `seq-studio functions deploy` using a local .env.\n  Use `secrets` commands for CI (no .env), bulk/multi-function ops, or write-only\n  value changes without a redeploy.\n\n  Flags: -e/--env <env> (required; see: seq-studio envs list)\n         --org <slug> (target/select managed-scope org; required when a name exists in multiple orgs)\n         set: --from-file <path> (non-interactive; file is not echoed)\n         --fn <slug> \u00B7 --env-var <NAME> \u00B7 --yes\n         --functions <f1,f2> \u00B7 --keys <K1,K2> \u00B7 --all (override key selection)\n         set-default: [version|version-row-id] (defaults to the most recent non-default) \u00B7 --yes\n         pin: [version|version-row-id] (defaults to the current default) \u00B7 --unpin \u00B7 --yes (redeploy) \u00B7 --yes --no-redeploy\n";
 export declare function runSecretsCommand(sub: string | undefined, args: ParsedArgs): Promise<number>;

package/dist/secrets/commands.js

@@ -41,6 +41,25 @@ function parseCommaList(value) {
         .map((part) => part.trim())
         .filter(Boolean);
 }
+function orgFlag(args) {
+    return typeof args.flags.org === 'string' ? args.flags.org.trim().toLowerCase() : undefined;
+}
+/** First-party Sequence Atlas envs — their Lakebase registry is org=sequence. */
+const SEQUENCE_OWNED_ENVS = new Set(['local', 'staging', 'production']);
+/** Refuse --org that would write a tenant row into the wrong deployment registry. */
+function orgDeploymentError(org, envName) {
+    if (SEQUENCE_OWNED_ENVS.has(envName) && org !== 'sequence') {
+        return `--org ${org} must be used with -e ${org} (${envName} only holds the sequence secret registry)`;
+    }
+    if (!SEQUENCE_OWNED_ENVS.has(envName) && org === 'sequence') {
+        return `--org sequence is not valid on -e ${envName} (that deployment does not own the Sequence registry)`;
+    }
+    return null;
+}
+/** Drop one trailing LF or CRLF so Windows-authored --from-file values match Unix. */
+export function stripOneTrailingNewline(value) {
+    return value.replace(/\r?\n$/, '');
+}
 async function listSecrets(ctx) {
     const { secrets } = await getJson({
         ...clientOptions(ctx),
@@ -48,11 +67,24 @@ async function listSecrets(ctx) {
     });
     return secrets;
 }
-async function resolveSecretByName({ ctx, name, }) {
+async function resolveSecretByName({ ctx, name, org, }) {
     const secrets = await listSecrets(ctx);
-    const secret = secrets.find((row) => row.name === name);
+    const matches = secrets.filter((row) => row.name === name);
+    const scoped = org ? matches.filter((row) => row.orgId === org) : matches;
+    if (scoped.length === 0) {
+        throw new Error(`Managed secret "${name}" not found on ${ctx.env.name}` +
+            (org ? ` org=${org}` : '') +
+            ` (or you don't have access).`);
+    }
+    if (scoped.length > 1) {
+        const orgs = scoped.map((row) => row.orgId).join(', ');
+        throw new Error(`Managed secret "${name}" exists in multiple orgs (${orgs}). Pass --org <slug>.`);
+    }
+    const [secret] = scoped;
     if (!secret) {
-        throw new Error(`Managed secret "${name}" not found on ${ctx.env.name} (or you don't have access).`);
+        throw new Error(`Managed secret "${name}" not found on ${ctx.env.name}` +
+            (org ? ` org=${org}` : '') +
+            ` (or you don't have access).`);
     }
     return secret;
 }
@@ -128,20 +160,29 @@ async function functionExistsBySlugEventually({ ctx, slug, attempts = 3, retryDe
 export async function secretsCreateCommand(args) {
     const name = args.positional[0];
     if (!name) {
-        console.error('usage: seq-studio secrets create <NAME> -e <env> [--description text]');
+        console.error('usage: seq-studio secrets create <NAME> -e <env> [--org <slug>] [--description text]');
         return 1;
     }
     const ctx = await buildContext(args);
     const description = typeof args.flags.description === 'string' ? args.flags.description : undefined;
+    const org = orgFlag(args);
+    if (org) {
+        const mismatch = orgDeploymentError(org, ctx.env.name);
+        if (mismatch) {
+            console.error(`${LOG} ${mismatch}`);
+            return 1;
+        }
+    }
     const secret = await postJson({
         ...clientOptions(ctx),
         path: '/api/managed-secrets',
         body: {
             name,
             description: description ?? null,
+            ...(org ? { orgId: org } : {}),
         },
     });
-    console.log(`${LOG} created managed secret "${secret.name}" (${secret.id}) on ${ctx.env.name}`);
+    console.log(`${LOG} created managed secret "${secret.name}" (${secret.id}) org=${secret.orgId} on ${ctx.env.name}`);
     return 0;
 }
 // ---------------------------------------------------------------------------
@@ -150,12 +191,24 @@ export async function secretsCreateCommand(args) {
 export async function secretsSetCommand(args) {
     const name = args.positional[0];
     if (!name) {
-        console.error('usage: seq-studio secrets set <NAME> -e <env>');
+        console.error('usage: seq-studio secrets set <NAME> -e <env> [--org <slug>] [--from-file <path>]');
         return 1;
     }
     const ctx = await buildContext(args);
-    const secret = await resolveSecretByName({ ctx, name });
-    const value = await promptHidden(`Default value for ${name} (input hidden): `);
+    const secret = await resolveSecretByName({ ctx, name, org: orgFlag(args) });
+    const fromFile = typeof args.flags['from-file'] === 'string' ? args.flags['from-file'] : undefined;
+    let value;
+    if (fromFile) {
+        const filePath = isAbsolute(fromFile) ? fromFile : resolve(workDir(args), fromFile);
+        if (!existsSync(filePath)) {
+            console.error(`${LOG} --from-file not found: ${filePath}`);
+            return 1;
+        }
+        value = stripOneTrailingNewline(await readFile(filePath, 'utf8'));
+    }
+    else {
+        value = await promptHidden(`Default value for ${name} (input hidden): `);
+    }
     if (!value) {
         console.error(`${LOG} empty value — aborted`);
         return 1;
@@ -183,7 +236,7 @@ export async function secretsListCommand(args) {
     for (const secret of secrets) {
         const defaultState = secret.hasDefaultValue ? 'default set' : 'no default';
         const access = secret.currentUserAccess ?? 'none';
-        console.log(`  ${secret.name}  [${defaultState}]  access=${access}  attachments=${secret.attachmentCount}`);
+        console.log(`  ${secret.name}  org=${secret.orgId}  [${defaultState}]  access=${access}  attachments=${secret.attachmentCount}`);
     }
     return 0;
 }
@@ -194,11 +247,11 @@ export async function secretsAttachCommand(args) {
     const name = args.positional[0];
     const fnSlug = typeof args.flags.fn === 'string' ? args.flags.fn : args.positional[1];
     if (!name || !fnSlug) {
-        console.error('usage: seq-studio secrets attach <NAME> --fn <slug> -e <env> [--env-var NAME]');
+        console.error('usage: seq-studio secrets attach <NAME> --fn <slug> -e <env> [--org <slug>] [--env-var NAME]');
         return 1;
     }
     const ctx = await buildContext(args);
-    const secret = await resolveSecretByName({ ctx, name });
+    const secret = await resolveSecretByName({ ctx, name, org: orgFlag(args) });
     const fn = await resolveFunctionBySlug({ ctx, slug: fnSlug });
     const envVarName = (typeof args.flags['env-var'] === 'string' ? args.flags['env-var'] : undefined) ?? name;
     if (secret.hasDefaultValue) {
@@ -229,11 +282,11 @@ export async function secretsDetachCommand(args) {
     const name = args.positional[0];
     const fnSlug = typeof args.flags.fn === 'string' ? args.flags.fn : args.positional[1];
     if (!name || !fnSlug) {
-        console.error('usage: seq-studio secrets detach <NAME> --fn <slug> -e <env>');
+        console.error('usage: seq-studio secrets detach <NAME> --fn <slug> -e <env> [--org <slug>]');
         return 1;
     }
     const ctx = await buildContext(args);
-    const secret = await resolveSecretByName({ ctx, name });
+    const secret = await resolveSecretByName({ ctx, name, org: orgFlag(args) });
     const fn = await resolveFunctionBySlug({ ctx, slug: fnSlug });
     await deleteJson({
         ...clientOptions(ctx),
@@ -464,11 +517,11 @@ async function attachedFunctionSlugs(ctx, secretId) {
 export async function secretsVersionsCommand(args) {
     const name = args.positional[0];
     if (!name) {
-        console.error('usage: seq-studio secrets versions <NAME> -e <env>');
+        console.error('usage: seq-studio secrets versions <NAME> -e <env> [--org <slug>]');
         return 1;
     }
     const ctx = await buildContext(args);
-    const secret = await resolveSecretByName({ ctx, name });
+    const secret = await resolveSecretByName({ ctx, name, org: orgFlag(args) });
     const versions = await listSecretVersions(ctx, secret.id);
     if (versions.length === 0) {
         console.log(`${LOG} no versions recorded for "${name}" on ${ctx.env.name}`);
@@ -492,11 +545,11 @@ export async function secretsVersionsCommand(args) {
 export async function secretsSetDefaultCommand(args) {
     const name = args.positional[0];
     if (!name) {
-        console.error('usage: seq-studio secrets set-default <NAME> [version] -e <env> [--yes]');
+        console.error('usage: seq-studio secrets set-default <NAME> [version] -e <env> [--org <slug>] [--yes]');
         return 1;
     }
     const ctx = await buildContext(args);
-    const secret = await resolveSecretByName({ ctx, name });
+    const secret = await resolveSecretByName({ ctx, name, org: orgFlag(args) });
     const versions = await listSecretVersions(ctx, secret.id);
     if (versions.length === 0) {
         console.error(`${LOG} "${name}" has no recorded versions`);
@@ -558,11 +611,11 @@ export async function secretsPinCommand(args) {
     const name = args.positional[0];
     const fnSlug = typeof args.flags.fn === 'string' ? args.flags.fn : undefined;
     if (!name || !fnSlug) {
-        console.error('usage: seq-studio secrets pin <NAME> --fn <slug> [version] [--unpin] -e <env> [--yes] [--no-redeploy]');
+        console.error('usage: seq-studio secrets pin <NAME> --fn <slug> [version] [--unpin] -e <env> [--org <slug>] [--yes] [--no-redeploy]');
         return 1;
     }
     const ctx = await buildContext(args);
-    const secret = await resolveSecretByName({ ctx, name });
+    const secret = await resolveSecretByName({ ctx, name, org: orgFlag(args) });
     const fn = await resolveFunctionBySlug({ ctx, slug: fnSlug });
     if (flagBool(args.flags, 'unpin')) {
         const preview = [
@@ -643,15 +696,21 @@ export async function secretsPinCommand(args) {
 // dispatcher
 // ---------------------------------------------------------------------------
 export const SECRETS_USAGE = `usage:
-  seq-studio secrets create <NAME> -e <env> [--description text]   register an org-owned secret
-  seq-studio secrets set <NAME> -e <env>                             set the shared default value (write-only)
+  seq-studio secrets create <NAME> -e <env> [--org <slug>] [--description text]
+                                                                     register an org-owned secret
+  seq-studio secrets set <NAME> -e <env> [--org <slug>] [--from-file <path>]
+                                                                     set the shared default value (write-only)
   seq-studio secrets list -e <env>                                   secrets you can see (never values)
-  seq-studio secrets attach <NAME> --fn <slug> -e <env>              mount default on a function env var
-  seq-studio secrets detach <NAME> --fn <slug> -e <env>              remove attachment
+  seq-studio secrets attach <NAME> --fn <slug> -e <env> [--org <slug>]
+                                                                     mount default on a function env var
+  seq-studio secrets detach <NAME> --fn <slug> -e <env> [--org <slug>]
+                                                                     remove attachment
   seq-studio secrets apply --from-env-file .env -e <env>             push defaults + attach (keys default from manifest)
-  seq-studio secrets versions <NAME> -e <env>                        value version history (never values)
-  seq-studio secrets set-default <NAME> [version] -e <env>           point the default at a prior version (editor)
-  seq-studio secrets pin <NAME> --fn <slug> [version] -e <env>       pin one function to a version (sticky; --unpin clears)
+  seq-studio secrets versions <NAME> -e <env> [--org <slug>]         value version history (never values)
+  seq-studio secrets set-default <NAME> [version] -e <env> [--org <slug>]
+                                                                     point the default at a prior version (editor)
+  seq-studio secrets pin <NAME> --fn <slug> [version] -e <env> [--org <slug>]
+                                                                     pin one function to a version (sticky; --unpin clears)
 
   Note: for the common deploy loop, secrets declared in managed-function.yml are
   reconciled automatically by \`seq-studio functions deploy\` using a local .env.
@@ -659,6 +718,8 @@ export const SECRETS_USAGE = `usage:
   value changes without a redeploy.
 
   Flags: -e/--env <env> (required; see: seq-studio envs list)
+         --org <slug> (target/select managed-scope org; required when a name exists in multiple orgs)
+         set: --from-file <path> (non-interactive; file is not echoed)
          --fn <slug> · --env-var <NAME> · --yes
          --functions <f1,f2> · --keys <K1,K2> · --all (override key selection)
          set-default: [version|version-row-id] (defaults to the most recent non-default) · --yes

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@sequenceholdings/studio-cli",
-  "version": "0.1.22",
-  "description": "Unified Sequence Studio CLI — `seq-studio agents` (typed agent definitions), `seq-studio process` (Lattice), `seq-studio artifact` (Artifact Studio), `seq-studio functions` / `secrets`, `seq-studio repos` (platform git-service), and `seq-studio auth pat` (git-service PATs). Includes Auth0 browser login shared with seqapi.",
+  "version": "0.1.24",
+  "description": "Unified Sequence Studio CLI — `seq-studio init` / `add` / `deploy` (app monorepos), `seq-studio agents`, `seq-studio process` (Lattice), `seq-studio artifact`, `seq-studio functions` / `secrets`, `seq-studio repos`, and `seq-studio auth pat`. Includes Auth0 browser login shared with seqapi.",
   "license": "UNLICENSED",
   "repository": {
     "type": "git",
@@ -40,12 +40,12 @@
     "smol-toml": "^1.4.2",
     "tsx": "^4.20.3",
     "zod": "^4.1.13",
-    "@sequenceholdings/agent-spec": "0.1.0",
-    "@sequenceholdings/artifact-studio": "0.2.0",
-    "@sequenceholdings/lattice": "0.1.2"
+    "@sequenceholdings/artifact-studio": "0.2.1",
+    "@sequenceholdings/lattice": "0.1.2",
+    "@sequenceholdings/agent-spec": "0.1.1"
   },
   "peerDependencies": {
-    "@sequenceholdings/orm": "0.1.2",
+    "@sequenceholdings/orm": "0.1.3",
     "@sequenceholdings/pipeline-spec": "0.1.0"
   },
   "peerDependenciesMeta": {
@@ -61,8 +61,8 @@
     "@types/node": "^22.0.0",
     "typescript": "^5.6.0",
     "vitest": "^4.1.5",
-    "@sequenceholdings/orm": "0.1.2",
-    "@sequenceholdings/pipeline-spec": "0.1.0"
+    "@sequenceholdings/pipeline-spec": "0.1.0",
+    "@sequenceholdings/orm": "0.1.3"
   },
   "engines": {
     "node": ">=20"

package/dist/pipeline/pinning.d.ts

@@ -1,5 +0,0 @@
-/** Client-side pin rules mirrored from the server deploy adapter (SEQ-2450). */
-export declare const FULL_SHA_PATTERN: RegExp;
-export declare const PINNED_ENVIRONMENTS: Set<string>;
-export declare function isFullSha(ref: string): boolean;
-export declare function requiresPinnedSha(environment: string): boolean;