@sequenceholdings/studio-cli 0.1.22 → 0.1.25

package/dist/pipeline/lifecycle.js

@@ -5,9 +5,35 @@
 import { getAccessToken, NotLoggedInError } from '../auth.js';
 import { AtlasApiError, getJson, postJson } from '../atlas-client.js';
 import { resolveEnvWithDiscovery } from '../config.js';
-import { isFullSha, requiresPinnedSha } from './pinning.js';
 const LOG = '[seq-studio]';
 const TERMINAL = new Set(['active', 'failed', 'retired']);
+const POLL_INTERVAL_MS = 2000;
+const HEARTBEAT_INTERVAL_MS = 20_000;
+const PLAN_TIMEOUT_MS = 30 * 60 * 1000;
+const FIRST_PARTY_TARGETS = [
+    { id: 'dev', label: 'Development', requiresApproval: false },
+    { id: 'staging', label: 'Staging', requiresApproval: false },
+    { id: 'production', label: 'Production', requiresApproval: true },
+    { id: 'banksouth', label: 'BankSouth', requiresApproval: true },
+];
+function formatElapsed(ms) {
+    const totalSec = Math.floor(ms / 1000);
+    if (totalSec < 60)
+        return `${totalSec}s`;
+    const min = Math.floor(totalSec / 60);
+    const sec = totalSec % 60;
+    return sec > 0 ? `${min}m ${sec}s` : `${min}m`;
+}
+function deploymentProgressSuffix(detail) {
+    if (detail.triggerRunId)
+        return ` (trigger ${detail.triggerRunId})`;
+    return '';
+}
+function deploymentStatusLabel(detail) {
+    if (detail.statusDetail)
+        return `${detail.status} — ${detail.statusDetail}`;
+    return detail.status;
+}
 async function envAndToken(args) {
     const requested = typeof args.flags.e === 'string' ? args.flags.e : typeof args.flags.env === 'string' ? args.flags.env : undefined;
     if (!requested) {
@@ -31,21 +57,35 @@ function flagString(flags, key) {
         throw new Error(`--${key} requires a value`);
     return value;
 }
-/**
- * The CLI's local dev-loop env is named `local` — chosen so `-e local` lines
- * up with `seqapi -e local` / `artifact-studio --env local` (see `config.ts`
- * `BUILT_IN_ENV_URLS`). There is no `local` in the server's deploy-lifecycle
- * enum (`DEPLOY_ENVIRONMENTS` in `atlas/src/server/services/data-pipelines/schema.ts`
- * is `dev | staging | production | banksouth`); the server's name for that
- * same developer-loop target is `dev` (`targetFactsForEnvironment` treats
- * `dev` as the one target exempt from a `lakebase_branch` binding). Map at
- * this one boundary — every lifecycle request body funnels through here —
- * so the CLI never sends the wire-invalid `local` and every other env name
- * passes through unchanged.
- */
+function flagOn(flags, key) {
+    return flags[key] === true || flags[key] === 'true';
+}
 export function deployEnvironmentForEnv(env) {
     return env.name === 'local' ? 'dev' : env.name;
 }
+async function resolvePipelineTarget({ args, env, token, }) {
+    const requested = flagString(args.flags, 'target');
+    const inferredId = requested ?? deployEnvironmentForEnv(env);
+    if (!requested) {
+        const firstPartyTarget = FIRST_PARTY_TARGETS.find((target) => target.id === inferredId);
+        if (firstPartyTarget)
+            return firstPartyTarget;
+    }
+    const response = await getJson({
+        baseUrl: env.url,
+        token,
+        path: '/api/data-pipelines/targets',
+    });
+    const targets = response.targets;
+    const matchingTarget = targets.find((target) => target.id === inferredId);
+    if (matchingTarget)
+        return matchingTarget;
+    if (!requested && targets.length === 1)
+        return targets[0];
+    const available = targets.map((target) => target.id).join(', ') || 'none';
+    throw new Error(`could not select a pipeline target for '${env.name}'; available targets: ${available}. ` +
+        'Pass --target <id> explicitly.');
+}
 export async function pipelinePlanCommand(args) {
     const repo = flagString(args.flags, 'repo');
     const ref = flagString(args.flags, 'ref');
@@ -55,21 +95,27 @@ export async function pipelinePlanCommand(args) {
     }
     const { env, token } = await envAndToken(args);
     const json = args.flags.json === true || args.flags.json === 'true';
+    let target;
+    try {
+        target = await resolvePipelineTarget({ args, env, token });
+    }
+    catch (error) {
+        console.error(`${LOG} plan failed: ${error instanceof Error ? error.message : String(error)}`);
+        return 1;
+    }
     let response;
     try {
-        response = await postJson({
+        response = await enqueueAndWaitForPlan({
             baseUrl: env.url,
             token,
-            path: '/api/data-pipelines/pipelines/plan',
-            body: { repo, ref, environment: deployEnvironmentForEnv(env) },
+            repo,
+            ref,
+            environment: target.id,
         });
     }
     catch (error) {
-        if (error instanceof AtlasApiError) {
-            console.error(`${LOG} plan failed: ${error.message}`);
-            return 1;
-        }
-        throw error;
+        console.error(`${LOG} plan failed: ${error instanceof Error ? error.message : String(error)}`);
+        return 1;
     }
     if (json) {
         console.log(JSON.stringify(response, null, 2));
@@ -85,9 +131,14 @@ export async function pipelineDeployCommand(args) {
     const ref = flagString(args.flags, 'ref');
     const deploymentId = flagString(args.flags, 'deployment-id');
     const approvedBy = flagString(args.flags, 'approved-by');
+    const runNow = flagOn(args.flags, 'run-now');
     const { env, token } = await envAndToken(args);
-    if (requiresPinnedSha(env.name) && ref && !isFullSha(ref)) {
-        console.error(`${LOG} deploy to ${env.name} requires a pinned 40-hex commit SHA (got '${ref}')`);
+    let target;
+    try {
+        target = await resolvePipelineTarget({ args, env, token });
+    }
+    catch (error) {
+        console.error(`${LOG} deploy failed: ${error instanceof Error ? error.message : String(error)}`);
         return 1;
     }
     let enqueue;
@@ -96,27 +147,33 @@ export async function pipelineDeployCommand(args) {
             // Direct execute of a persisted plan.
             const stageId = flagString(args.flags, 'stage-id');
             if (!stageId) {
-                console.error('usage: seq-studio pipeline deploy --deployment-id <id> --stage-id <id> -e <env> [--approved-by <sub>] [--no-wait]');
+                console.error('usage: seq-studio pipeline deploy --deployment-id <id> --stage-id <id> -e <env> [--target <id>] [--approved-by <sub>] [--run-now] [--no-wait]');
                 return 1;
             }
             enqueue = await postJson({
                 baseUrl: env.url,
                 token,
                 path: `/api/data-pipelines/stages/${stageId}/deploy`,
-                body: { deploymentId, ...(approvedBy ? { approvedBy } : {}) },
+                body: {
+                    deploymentId,
+                    environment: target.id,
+                    ...(approvedBy ? { approvedBy } : {}),
+                    runNow,
+                },
             });
         }
         else {
             if (!repo || !ref) {
-                console.error('usage: seq-studio pipeline deploy --repo pipelines/<slug> --ref <sha> -e <env> [--approved-by <sub>] [--no-wait]');
+                console.error('usage: seq-studio pipeline deploy --repo pipelines/<slug> --ref <sha|branch> -e <env> [--target <id>] [--approved-by <sub>] [--run-now] [--no-wait]');
                 return 1;
             }
             // Plan then deploy the first planning deployment.
-            const plan = await postJson({
+            const plan = await enqueueAndWaitForPlan({
                 baseUrl: env.url,
                 token,
-                path: '/api/data-pipelines/pipelines/plan',
-                body: { repo, ref, environment: deployEnvironmentForEnv(env) },
+                repo,
+                ref,
+                environment: target.id,
             });
             if (plan.plan.hasDestructive) {
                 console.error(`${LOG} plan has destructive findings — refusing to deploy`);
@@ -140,7 +197,9 @@ export async function pipelineDeployCommand(args) {
                 path: `/api/data-pipelines/stages/${stageId}/deploy`,
                 body: {
                     deploymentId: firstId,
+                    environment: target.id,
                     ...(approvedBy ? { approvedBy } : {}),
+                    runNow,
                 },
             });
         }
@@ -168,8 +227,16 @@ export async function pipelinePromoteCommand(args) {
         return 1;
     }
     const { env, token } = await envAndToken(args);
-    if (requiresPinnedSha(env.name) && !approvedBy) {
-        console.error(`${LOG} promote to ${env.name} requires --approved-by <your sub/email> (approvals are self-recorded)`);
+    let target;
+    try {
+        target = await resolvePipelineTarget({ args, env, token });
+    }
+    catch (error) {
+        console.error(`${LOG} promote failed: ${error instanceof Error ? error.message : String(error)}`);
+        return 1;
+    }
+    if (target.requiresApproval && !approvedBy) {
+        console.error(`${LOG} promote to ${target.id} requires --approved-by <your sub/email> (approvals are self-recorded)`);
         return 1;
     }
     const stageId = await resolveStageIdBySlug({ baseUrl: env.url, token, slug: stage, repo });
@@ -181,7 +248,7 @@ export async function pipelinePromoteCommand(args) {
             path: `/api/data-pipelines/stages/${stageId}/promote`,
             body: {
                 version,
-                environment: deployEnvironmentForEnv(env),
+                environment: target.id,
                 ...(approvedBy ? { approvedBy } : {}),
             },
         });
@@ -193,10 +260,20 @@ export async function pipelinePromoteCommand(args) {
         }
         throw error;
     }
-    console.log(`${LOG} enqueued promote ${enqueue.deploymentId}`);
+    console.log(`${LOG} enqueued promote plan ${enqueue.planRequestId} (trigger=${enqueue.triggerRunId ?? 'n/a'})`);
     if (args.flags['no-wait'] === true || args.flags['no-wait'] === 'true')
         return 0;
-    return pollDeployment({ baseUrl: env.url, token, deploymentId: enqueue.deploymentId });
+    const plan = await waitForPlanRequest({
+        baseUrl: env.url,
+        token,
+        planRequestId: enqueue.planRequestId,
+    });
+    const deploymentId = plan.deploymentIds[plan.stageIds.indexOf(stageId)] ?? plan.deploymentIds[0];
+    if (!deploymentId) {
+        console.error(`${LOG} promote plan completed without a deployment id`);
+        return 1;
+    }
+    return pollDeployment({ baseUrl: env.url, token, deploymentId });
 }
 export async function pipelineRunNowCommand(args) {
     const stage = flagString(args.flags, 'stage');
@@ -207,6 +284,14 @@ export async function pipelineRunNowCommand(args) {
     }
     const { env, token } = await envAndToken(args);
     const json = args.flags.json === true || args.flags.json === 'true';
+    let target;
+    try {
+        target = await resolvePipelineTarget({ args, env, token });
+    }
+    catch (error) {
+        console.error(`${LOG} run-now failed: ${error instanceof Error ? error.message : String(error)}`);
+        return 1;
+    }
     let stageId;
     try {
         stageId = await resolveStageIdBySlug({ baseUrl: env.url, token, slug: stage, repo });
@@ -221,7 +306,7 @@ export async function pipelineRunNowCommand(args) {
             baseUrl: env.url,
             token,
             path: `/api/data-pipelines/stages/${stageId}/run`,
-            body: { environment: deployEnvironmentForEnv(env) },
+            body: { environment: target.id },
         });
     }
     catch (error) {
@@ -235,7 +320,7 @@ export async function pipelineRunNowCommand(args) {
         console.log(JSON.stringify(response, null, 2));
     }
     else {
-        console.log(`${LOG} run-now ${stage} → ${deployEnvironmentForEnv(env)}`);
+        console.log(`${LOG} run-now ${stage} → ${target.id}`);
         console.log(`${LOG} invocation ${response.invocationId} (${response.status})`);
         console.log(`${LOG} ${response.databricks_url}`);
     }
@@ -250,8 +335,16 @@ export async function pipelineRollbackCommand(args) {
         return 1;
     }
     const { env, token } = await envAndToken(args);
-    if (requiresPinnedSha(env.name) && !approvedBy) {
-        console.error(`${LOG} rollback in ${env.name} requires --approved-by <your sub/email> (approvals are explicit even for rollbacks)`);
+    let target;
+    try {
+        target = await resolvePipelineTarget({ args, env, token });
+    }
+    catch (error) {
+        console.error(`${LOG} rollback failed: ${error instanceof Error ? error.message : String(error)}`);
+        return 1;
+    }
+    if (target.requiresApproval && !approvedBy) {
+        console.error(`${LOG} rollback in ${target.id} requires --approved-by <your sub/email> (approvals are explicit even for rollbacks)`);
         return 1;
     }
     const stageId = await resolveStageIdBySlug({ baseUrl: env.url, token, slug: stage, repo });
@@ -262,7 +355,7 @@ export async function pipelineRollbackCommand(args) {
             token,
             path: `/api/data-pipelines/stages/${stageId}/rollback`,
             body: {
-                environment: deployEnvironmentForEnv(env),
+                environment: target.id,
                 ...(approvedBy ? { approvedBy } : {}),
             },
         });
@@ -295,26 +388,99 @@ function printFindingsTable(findings) {
 async function pollDeployment({ baseUrl, token, deploymentId, }) {
     const started = Date.now();
     const timeoutMs = 15 * 60 * 1000;
+    let lastLoggedLabel = null;
+    let lastLogAt = started;
     while (Date.now() - started < timeoutMs) {
         const detail = await getJson({
             baseUrl,
             token,
             path: `/api/data-pipelines/deployments/${deploymentId}`,
         });
-        console.log(`${LOG} deployment ${deploymentId}: ${detail.status}`);
+        const elapsedMs = Date.now() - started;
         if (TERMINAL.has(detail.status)) {
+            const elapsed = formatElapsed(elapsedMs);
+            const progressSuffix = deploymentProgressSuffix(detail);
             if (detail.status === 'active') {
-                console.log(`${LOG} deploy succeeded`);
+                console.log(`${LOG} deployment ${deploymentId} succeeded (${elapsed})${progressSuffix}`);
                 return 0;
             }
-            console.error(`${LOG} deploy ended '${detail.status}': ${detail.statusDetail ?? ''}`);
+            const detailText = detail.statusDetail ? `: ${detail.statusDetail}` : '';
+            console.error(`${LOG} deployment ${deploymentId} ended ${detail.status} (${elapsed})${detailText}${progressSuffix}`);
             return 1;
         }
-        await new Promise((r) => setTimeout(r, 2000));
+        const progressSuffix = deploymentProgressSuffix(detail);
+        const statusLabel = deploymentStatusLabel(detail);
+        if (statusLabel !== lastLoggedLabel) {
+            console.log(`${LOG} deployment ${deploymentId}: ${statusLabel} (${formatElapsed(elapsedMs)})${progressSuffix}`);
+            lastLoggedLabel = statusLabel;
+            lastLogAt = Date.now();
+        }
+        else if (Date.now() - lastLogAt >= HEARTBEAT_INTERVAL_MS) {
+            console.log(`${LOG} deployment ${deploymentId}: still ${statusLabel} (${formatElapsed(elapsedMs)})${progressSuffix}`);
+            lastLogAt = Date.now();
+        }
+        await new Promise((r) => setTimeout(r, POLL_INTERVAL_MS));
     }
-    console.error(`${LOG} timed out waiting for deployment ${deploymentId}`);
+    console.error(`${LOG} timed out waiting for deployment ${deploymentId} (${formatElapsed(Date.now() - started)})`);
     return 1;
 }
+async function enqueueAndWaitForPlan({ baseUrl, token, repo, ref, environment, }) {
+    const enqueue = await postJson({
+        baseUrl,
+        token,
+        path: '/api/data-pipelines/pipelines/plan',
+        body: { repo, ref, environment },
+    });
+    console.log(`${LOG} enqueued plan ${enqueue.planRequestId} (trigger=${enqueue.triggerRunId ?? 'n/a'})`);
+    const detail = await waitForPlanRequest({
+        baseUrl,
+        token,
+        planRequestId: enqueue.planRequestId,
+    });
+    if (!detail.plan || !detail.text) {
+        throw new Error(`plan request ${detail.planRequestId} succeeded without a plan result`);
+    }
+    return {
+        plan: detail.plan,
+        deploymentIds: detail.deploymentIds,
+        stageIds: detail.stageIds,
+        text: detail.text,
+    };
+}
+async function waitForPlanRequest({ baseUrl, token, planRequestId, }) {
+    const started = Date.now();
+    let lastStatus = null;
+    let lastLoggedAt = started;
+    while (Date.now() - started < PLAN_TIMEOUT_MS) {
+        const detail = await getJson({
+            baseUrl,
+            token,
+            path: `/api/data-pipelines/plan-requests/${planRequestId}`,
+        });
+        const elapsed = Date.now() - started;
+        const statusLabel = detail.statusDetail
+            ? `${detail.status} — ${detail.statusDetail}`
+            : detail.status;
+        if (detail.status === 'failed') {
+            throw new Error(`plan request ${detail.planRequestId} failed after ${formatElapsed(elapsed)}: ` +
+                `${detail.statusDetail ?? 'unknown error'}`);
+        }
+        if (detail.status === 'succeeded')
+            return detail;
+        if (statusLabel !== lastStatus) {
+            console.log(`${LOG} plan ${detail.planRequestId}: ${statusLabel} (${formatElapsed(elapsed)})`);
+            lastStatus = statusLabel;
+            lastLoggedAt = Date.now();
+        }
+        else if (Date.now() - lastLoggedAt >= HEARTBEAT_INTERVAL_MS) {
+            console.log(`${LOG} plan ${detail.planRequestId}: still ${statusLabel} (${formatElapsed(elapsed)})`);
+            lastLoggedAt = Date.now();
+        }
+        await new Promise((resolve) => setTimeout(resolve, POLL_INTERVAL_MS));
+    }
+    throw new Error(`timed out waiting for plan request ${planRequestId} ` +
+        `(${formatElapsed(Date.now() - started)})`);
+}
 export async function pipelineAdoptCommand(args) {
     const stage = flagString(args.flags, 'stage');
     const ref = flagString(args.flags, 'ref');
@@ -328,6 +494,14 @@ export async function pipelineAdoptCommand(args) {
     }
     const { env, token } = await envAndToken(args);
     const json = args.flags.json === true || args.flags.json === 'true';
+    let target;
+    try {
+        target = await resolvePipelineTarget({ args, env, token });
+    }
+    catch (error) {
+        console.error(`${LOG} adopt failed: ${error instanceof Error ? error.message : String(error)}`);
+        return 1;
+    }
     const repo = flagString(args.flags, 'repo');
     const resourceKey = flagString(args.flags, 'resource-key') ?? stage.replace(/-/g, '_');
     const kind = flagString(args.flags, 'kind') ?? 'job';
@@ -348,7 +522,7 @@ export async function pipelineAdoptCommand(args) {
             token,
             path: `/api/data-pipelines/stages/${stageId}/adopt`,
             body: {
-                environment: deployEnvironmentForEnv(env),
+                environment: target.id,
                 ref,
                 bindings: [{ resourceKey, nativeId, kind }],
                 approvedBy,
@@ -384,6 +558,14 @@ export async function pipelineUnbindCommand(args) {
     }
     const { env, token } = await envAndToken(args);
     const json = args.flags.json === true || args.flags.json === 'true';
+    let target;
+    try {
+        target = await resolvePipelineTarget({ args, env, token });
+    }
+    catch (error) {
+        console.error(`${LOG} unbind failed: ${error instanceof Error ? error.message : String(error)}`);
+        return 1;
+    }
     const repo = flagString(args.flags, 'repo');
     const resourceKey = flagString(args.flags, 'resource-key');
     const stageId = await resolveStageIdBySlug({
@@ -398,7 +580,7 @@ export async function pipelineUnbindCommand(args) {
             token,
             path: `/api/data-pipelines/stages/${stageId}/unbind`,
             body: {
-                environment: deployEnvironmentForEnv(env),
+                environment: target.id,
                 ref,
                 approvedBy,
                 ...(resourceKey ? { resourceKeys: [resourceKey] } : {}),

package/dist/pipeline/templates.js

@@ -116,6 +116,7 @@ const SERVING_BODY = `
 source:
   stage: my-gold-stage
   output: gold.my_table
+  # catalog: src_example   # optional; omit to use the deploy catalog
 projection:
   # The served contract (inline columns or schema_ref):
   columns:
@@ -139,7 +140,8 @@ expose:
 #   table: my_table
 #   mode: referenced
 `;
-const ENTRYPOINT_STUB = `"""Entrypoint stub for the {{name}} stage.
+const ENTRYPOINT_STUB = `# Databricks notebook source
+"""Entrypoint stub for the {{name}} stage.
 
 The platform invokes this per the stage spec ({{name}}.stage.yml).
 Decoders and transforms stay pure — bronze materialization, envelope

package/dist/preview.d.ts

@@ -6,10 +6,11 @@
  * hand-editing `~/.config/lattice/config.toml`. See
  * `docs/preview-environments.md` for the full lifecycle.
  *
- * SLUG ALGORITHM — must stay byte-for-byte in sync with the three other
+ * SLUG ALGORITHM — must stay byte-for-byte in sync with the other
  * places that compute the same slug from a branch name:
- *   - `.github/workflows/preview-deploy.yml`  (`sed 's/[^a-zA-Z0-9-]/-/g' | tr '[:upper:]' '[:lower:]'`)
- *   - `atlas/src/server/db.ts:sanitize`        (`replace(/[^a-zA-Z0-9-]/g, '-').toLowerCase()`)
+ *   - `.github/workflows/preview-deploy.yml`  (replace non-alnum, lowercase, trim hyphens)
+ *   - `.github/workflows/trigger-preview.yml` (same bash pipeline)
+ *   - `atlas/src/server/db.ts:sanitize`        (`.replace(/[^a-zA-Z0-9-]/g, '-').toLowerCase().replace(/^-+|-+$/g, '')`)
  *   - `databricks/lakebase/atlas-db/pr-lifecycle.ts:sanitize`
  * Changing it here without changing those produces a host that does NOT
  * match what `preview-deploy.yml` actually deployed.

package/dist/preview.js

@@ -8,10 +8,11 @@ import { promisify } from 'node:util';
  * hand-editing `~/.config/lattice/config.toml`. See
  * `docs/preview-environments.md` for the full lifecycle.
  *
- * SLUG ALGORITHM — must stay byte-for-byte in sync with the three other
+ * SLUG ALGORITHM — must stay byte-for-byte in sync with the other
  * places that compute the same slug from a branch name:
- *   - `.github/workflows/preview-deploy.yml`  (`sed 's/[^a-zA-Z0-9-]/-/g' | tr '[:upper:]' '[:lower:]'`)
- *   - `atlas/src/server/db.ts:sanitize`        (`replace(/[^a-zA-Z0-9-]/g, '-').toLowerCase()`)
+ *   - `.github/workflows/preview-deploy.yml`  (replace non-alnum, lowercase, trim hyphens)
+ *   - `.github/workflows/trigger-preview.yml` (same bash pipeline)
+ *   - `atlas/src/server/db.ts:sanitize`        (`.replace(/[^a-zA-Z0-9-]/g, '-').toLowerCase().replace(/^-+|-+$/g, '')`)
  *   - `databricks/lakebase/atlas-db/pr-lifecycle.ts:sanitize`
  * Changing it here without changing those produces a host that does NOT
  * match what `preview-deploy.yml` actually deployed.
@@ -45,7 +46,7 @@ export const PREVIEW_PROTECTED_SLUGS = [
 export const MAX_LABEL_LENGTH = 63;
 /** Apply the canonical branch → slug transform. */
 export function previewSlug(branchOrSlug) {
-    return branchOrSlug.replace(/[^a-zA-Z0-9-]/g, '-').toLowerCase();
+    return branchOrSlug.replace(/[^a-zA-Z0-9-]/g, '-').toLowerCase().replace(/^-+|-+$/g, '');
 }
 /** The `studio-atlas-git-<slug>` DNS label Vercel assigns the preview. */
 export function previewLabel(slug) {

package/dist/secrets/commands.d.ts

@@ -1,5 +1,7 @@
 import type { ParsedArgs } from '../process/commands.js';
 export declare const LOG = "[seq-studio]";
+/** Drop one trailing LF or CRLF so Windows-authored --from-file values match Unix. */
+export declare function stripOneTrailingNewline(value: string): string;
 export declare function secretsCreateCommand(args: ParsedArgs): Promise<number>;
 export declare function secretsSetCommand(args: ParsedArgs): Promise<number>;
 export declare function secretsListCommand(args: ParsedArgs): Promise<number>;
@@ -20,5 +22,5 @@ export declare function secretsSetDefaultCommand(args: ParsedArgs): Promise<numb
  * UI: pin + redeploy the function's active version / pin only / cancel.
  */
 export declare function secretsPinCommand(args: ParsedArgs): Promise<number>;
-export declare const SECRETS_USAGE = "usage:\n  seq-studio secrets create <NAME> -e <env> [--description text]   register an org-owned secret\n  seq-studio secrets set <NAME> -e <env>                             set the shared default value (write-only)\n  seq-studio secrets list -e <env>                                   secrets you can see (never values)\n  seq-studio secrets attach <NAME> --fn <slug> -e <env>              mount default on a function env var\n  seq-studio secrets detach <NAME> --fn <slug> -e <env>              remove attachment\n  seq-studio secrets apply --from-env-file .env -e <env>             push defaults + attach (keys default from manifest)\n  seq-studio secrets versions <NAME> -e <env>                        value version history (never values)\n  seq-studio secrets set-default <NAME> [version] -e <env>           point the default at a prior version (editor)\n  seq-studio secrets pin <NAME> --fn <slug> [version] -e <env>       pin one function to a version (sticky; --unpin clears)\n\n  Note: for the common deploy loop, secrets declared in managed-function.yml are\n  reconciled automatically by `seq-studio functions deploy` using a local .env.\n  Use `secrets` commands for CI (no .env), bulk/multi-function ops, or write-only\n  value changes without a redeploy.\n\n  Flags: -e/--env <env> (required; see: seq-studio envs list)\n         --fn <slug> \u00B7 --env-var <NAME> \u00B7 --yes\n         --functions <f1,f2> \u00B7 --keys <K1,K2> \u00B7 --all (override key selection)\n         set-default: [version|version-row-id] (defaults to the most recent non-default) \u00B7 --yes\n         pin: [version|version-row-id] (defaults to the current default) \u00B7 --unpin \u00B7 --yes (redeploy) \u00B7 --yes --no-redeploy\n";
+export declare const SECRETS_USAGE = "usage:\n  seq-studio secrets create <NAME> -e <env> [--org <slug>] [--description text]\n                                                                     register an org-owned secret\n  seq-studio secrets set <NAME> -e <env> [--org <slug>] [--from-file <path>]\n                                                                     set the shared default value (write-only)\n  seq-studio secrets list -e <env>                                   secrets you can see (never values)\n  seq-studio secrets attach <NAME> --fn <slug> -e <env> [--org <slug>]\n                                                                     mount default on a function env var\n  seq-studio secrets detach <NAME> --fn <slug> -e <env> [--org <slug>]\n                                                                     remove attachment\n  seq-studio secrets apply --from-env-file .env -e <env>             push defaults + attach (keys default from manifest)\n  seq-studio secrets versions <NAME> -e <env> [--org <slug>]         value version history (never values)\n  seq-studio secrets set-default <NAME> [version] -e <env> [--org <slug>]\n                                                                     point the default at a prior version (editor)\n  seq-studio secrets pin <NAME> --fn <slug> [version] -e <env> [--org <slug>]\n                                                                     pin one function to a version (sticky; --unpin clears)\n\n  Note: for the common deploy loop, secrets declared in managed-function.yml are\n  reconciled automatically by `seq-studio functions deploy` using a local .env.\n  Use `secrets` commands for CI (no .env), bulk/multi-function ops, or write-only\n  value changes without a redeploy.\n\n  Flags: -e/--env <env> (required; see: seq-studio envs list)\n         --org <slug> (target/select managed-scope org; required when a name exists in multiple orgs)\n         set: --from-file <path> (non-interactive; file is not echoed)\n         --fn <slug> \u00B7 --env-var <NAME> \u00B7 --yes\n         --functions <f1,f2> \u00B7 --keys <K1,K2> \u00B7 --all (override key selection)\n         set-default: [version|version-row-id] (defaults to the most recent non-default) \u00B7 --yes\n         pin: [version|version-row-id] (defaults to the current default) \u00B7 --unpin \u00B7 --yes (redeploy) \u00B7 --yes --no-redeploy\n";
 export declare function runSecretsCommand(sub: string | undefined, args: ParsedArgs): Promise<number>;