@sequenceholdings/studio-cli 0.1.22 → 0.1.25

package/dist/secrets/commands.js

@@ -41,6 +41,25 @@ function parseCommaList(value) {
         .map((part) => part.trim())
         .filter(Boolean);
 }
+function orgFlag(args) {
+    return typeof args.flags.org === 'string' ? args.flags.org.trim().toLowerCase() : undefined;
+}
+/** First-party Sequence Atlas envs — their Lakebase registry is org=sequence. */
+const SEQUENCE_OWNED_ENVS = new Set(['local', 'staging', 'production']);
+/** Refuse --org that would write a tenant row into the wrong deployment registry. */
+function orgDeploymentError(org, envName) {
+    if (SEQUENCE_OWNED_ENVS.has(envName) && org !== 'sequence') {
+        return `--org ${org} must be used with -e ${org} (${envName} only holds the sequence secret registry)`;
+    }
+    if (!SEQUENCE_OWNED_ENVS.has(envName) && org === 'sequence') {
+        return `--org sequence is not valid on -e ${envName} (that deployment does not own the Sequence registry)`;
+    }
+    return null;
+}
+/** Drop one trailing LF or CRLF so Windows-authored --from-file values match Unix. */
+export function stripOneTrailingNewline(value) {
+    return value.replace(/\r?\n$/, '');
+}
 async function listSecrets(ctx) {
     const { secrets } = await getJson({
         ...clientOptions(ctx),
@@ -48,11 +67,24 @@ async function listSecrets(ctx) {
     });
     return secrets;
 }
-async function resolveSecretByName({ ctx, name, }) {
+async function resolveSecretByName({ ctx, name, org, }) {
     const secrets = await listSecrets(ctx);
-    const secret = secrets.find((row) => row.name === name);
+    const matches = secrets.filter((row) => row.name === name);
+    const scoped = org ? matches.filter((row) => row.orgId === org) : matches;
+    if (scoped.length === 0) {
+        throw new Error(`Managed secret "${name}" not found on ${ctx.env.name}` +
+            (org ? ` org=${org}` : '') +
+            ` (or you don't have access).`);
+    }
+    if (scoped.length > 1) {
+        const orgs = scoped.map((row) => row.orgId).join(', ');
+        throw new Error(`Managed secret "${name}" exists in multiple orgs (${orgs}). Pass --org <slug>.`);
+    }
+    const [secret] = scoped;
     if (!secret) {
-        throw new Error(`Managed secret "${name}" not found on ${ctx.env.name} (or you don't have access).`);
+        throw new Error(`Managed secret "${name}" not found on ${ctx.env.name}` +
+            (org ? ` org=${org}` : '') +
+            ` (or you don't have access).`);
     }
     return secret;
 }
@@ -128,20 +160,29 @@ async function functionExistsBySlugEventually({ ctx, slug, attempts = 3, retryDe
 export async function secretsCreateCommand(args) {
     const name = args.positional[0];
     if (!name) {
-        console.error('usage: seq-studio secrets create <NAME> -e <env> [--description text]');
+        console.error('usage: seq-studio secrets create <NAME> -e <env> [--org <slug>] [--description text]');
         return 1;
     }
     const ctx = await buildContext(args);
     const description = typeof args.flags.description === 'string' ? args.flags.description : undefined;
+    const org = orgFlag(args);
+    if (org) {
+        const mismatch = orgDeploymentError(org, ctx.env.name);
+        if (mismatch) {
+            console.error(`${LOG} ${mismatch}`);
+            return 1;
+        }
+    }
     const secret = await postJson({
         ...clientOptions(ctx),
         path: '/api/managed-secrets',
         body: {
             name,
             description: description ?? null,
+            ...(org ? { orgId: org } : {}),
         },
     });
-    console.log(`${LOG} created managed secret "${secret.name}" (${secret.id}) on ${ctx.env.name}`);
+    console.log(`${LOG} created managed secret "${secret.name}" (${secret.id}) org=${secret.orgId} on ${ctx.env.name}`);
     return 0;
 }
 // ---------------------------------------------------------------------------
@@ -150,12 +191,24 @@ export async function secretsCreateCommand(args) {
 export async function secretsSetCommand(args) {
     const name = args.positional[0];
     if (!name) {
-        console.error('usage: seq-studio secrets set <NAME> -e <env>');
+        console.error('usage: seq-studio secrets set <NAME> -e <env> [--org <slug>] [--from-file <path>]');
         return 1;
     }
     const ctx = await buildContext(args);
-    const secret = await resolveSecretByName({ ctx, name });
-    const value = await promptHidden(`Default value for ${name} (input hidden): `);
+    const secret = await resolveSecretByName({ ctx, name, org: orgFlag(args) });
+    const fromFile = typeof args.flags['from-file'] === 'string' ? args.flags['from-file'] : undefined;
+    let value;
+    if (fromFile) {
+        const filePath = isAbsolute(fromFile) ? fromFile : resolve(workDir(args), fromFile);
+        if (!existsSync(filePath)) {
+            console.error(`${LOG} --from-file not found: ${filePath}`);
+            return 1;
+        }
+        value = stripOneTrailingNewline(await readFile(filePath, 'utf8'));
+    }
+    else {
+        value = await promptHidden(`Default value for ${name} (input hidden): `);
+    }
     if (!value) {
         console.error(`${LOG} empty value — aborted`);
         return 1;
@@ -183,7 +236,7 @@ export async function secretsListCommand(args) {
     for (const secret of secrets) {
         const defaultState = secret.hasDefaultValue ? 'default set' : 'no default';
         const access = secret.currentUserAccess ?? 'none';
-        console.log(`  ${secret.name}  [${defaultState}]  access=${access}  attachments=${secret.attachmentCount}`);
+        console.log(`  ${secret.name}  org=${secret.orgId}  [${defaultState}]  access=${access}  attachments=${secret.attachmentCount}`);
     }
     return 0;
 }
@@ -194,11 +247,11 @@ export async function secretsAttachCommand(args) {
     const name = args.positional[0];
     const fnSlug = typeof args.flags.fn === 'string' ? args.flags.fn : args.positional[1];
     if (!name || !fnSlug) {
-        console.error('usage: seq-studio secrets attach <NAME> --fn <slug> -e <env> [--env-var NAME]');
+        console.error('usage: seq-studio secrets attach <NAME> --fn <slug> -e <env> [--org <slug>] [--env-var NAME]');
         return 1;
     }
     const ctx = await buildContext(args);
-    const secret = await resolveSecretByName({ ctx, name });
+    const secret = await resolveSecretByName({ ctx, name, org: orgFlag(args) });
     const fn = await resolveFunctionBySlug({ ctx, slug: fnSlug });
     const envVarName = (typeof args.flags['env-var'] === 'string' ? args.flags['env-var'] : undefined) ?? name;
     if (secret.hasDefaultValue) {
@@ -229,11 +282,11 @@ export async function secretsDetachCommand(args) {
     const name = args.positional[0];
     const fnSlug = typeof args.flags.fn === 'string' ? args.flags.fn : args.positional[1];
     if (!name || !fnSlug) {
-        console.error('usage: seq-studio secrets detach <NAME> --fn <slug> -e <env>');
+        console.error('usage: seq-studio secrets detach <NAME> --fn <slug> -e <env> [--org <slug>]');
         return 1;
     }
     const ctx = await buildContext(args);
-    const secret = await resolveSecretByName({ ctx, name });
+    const secret = await resolveSecretByName({ ctx, name, org: orgFlag(args) });
     const fn = await resolveFunctionBySlug({ ctx, slug: fnSlug });
     await deleteJson({
         ...clientOptions(ctx),
@@ -464,11 +517,11 @@ async function attachedFunctionSlugs(ctx, secretId) {
 export async function secretsVersionsCommand(args) {
     const name = args.positional[0];
     if (!name) {
-        console.error('usage: seq-studio secrets versions <NAME> -e <env>');
+        console.error('usage: seq-studio secrets versions <NAME> -e <env> [--org <slug>]');
         return 1;
     }
     const ctx = await buildContext(args);
-    const secret = await resolveSecretByName({ ctx, name });
+    const secret = await resolveSecretByName({ ctx, name, org: orgFlag(args) });
     const versions = await listSecretVersions(ctx, secret.id);
     if (versions.length === 0) {
         console.log(`${LOG} no versions recorded for "${name}" on ${ctx.env.name}`);
@@ -492,11 +545,11 @@ export async function secretsVersionsCommand(args) {
 export async function secretsSetDefaultCommand(args) {
     const name = args.positional[0];
     if (!name) {
-        console.error('usage: seq-studio secrets set-default <NAME> [version] -e <env> [--yes]');
+        console.error('usage: seq-studio secrets set-default <NAME> [version] -e <env> [--org <slug>] [--yes]');
         return 1;
     }
     const ctx = await buildContext(args);
-    const secret = await resolveSecretByName({ ctx, name });
+    const secret = await resolveSecretByName({ ctx, name, org: orgFlag(args) });
     const versions = await listSecretVersions(ctx, secret.id);
     if (versions.length === 0) {
         console.error(`${LOG} "${name}" has no recorded versions`);
@@ -558,11 +611,11 @@ export async function secretsPinCommand(args) {
     const name = args.positional[0];
     const fnSlug = typeof args.flags.fn === 'string' ? args.flags.fn : undefined;
     if (!name || !fnSlug) {
-        console.error('usage: seq-studio secrets pin <NAME> --fn <slug> [version] [--unpin] -e <env> [--yes] [--no-redeploy]');
+        console.error('usage: seq-studio secrets pin <NAME> --fn <slug> [version] [--unpin] -e <env> [--org <slug>] [--yes] [--no-redeploy]');
         return 1;
     }
     const ctx = await buildContext(args);
-    const secret = await resolveSecretByName({ ctx, name });
+    const secret = await resolveSecretByName({ ctx, name, org: orgFlag(args) });
     const fn = await resolveFunctionBySlug({ ctx, slug: fnSlug });
     if (flagBool(args.flags, 'unpin')) {
         const preview = [
@@ -643,15 +696,21 @@ export async function secretsPinCommand(args) {
 // dispatcher
 // ---------------------------------------------------------------------------
 export const SECRETS_USAGE = `usage:
-  seq-studio secrets create <NAME> -e <env> [--description text]   register an org-owned secret
-  seq-studio secrets set <NAME> -e <env>                             set the shared default value (write-only)
+  seq-studio secrets create <NAME> -e <env> [--org <slug>] [--description text]
+                                                                     register an org-owned secret
+  seq-studio secrets set <NAME> -e <env> [--org <slug>] [--from-file <path>]
+                                                                     set the shared default value (write-only)
   seq-studio secrets list -e <env>                                   secrets you can see (never values)
-  seq-studio secrets attach <NAME> --fn <slug> -e <env>              mount default on a function env var
-  seq-studio secrets detach <NAME> --fn <slug> -e <env>              remove attachment
+  seq-studio secrets attach <NAME> --fn <slug> -e <env> [--org <slug>]
+                                                                     mount default on a function env var
+  seq-studio secrets detach <NAME> --fn <slug> -e <env> [--org <slug>]
+                                                                     remove attachment
   seq-studio secrets apply --from-env-file .env -e <env>             push defaults + attach (keys default from manifest)
-  seq-studio secrets versions <NAME> -e <env>                        value version history (never values)
-  seq-studio secrets set-default <NAME> [version] -e <env>           point the default at a prior version (editor)
-  seq-studio secrets pin <NAME> --fn <slug> [version] -e <env>       pin one function to a version (sticky; --unpin clears)
+  seq-studio secrets versions <NAME> -e <env> [--org <slug>]         value version history (never values)
+  seq-studio secrets set-default <NAME> [version] -e <env> [--org <slug>]
+                                                                     point the default at a prior version (editor)
+  seq-studio secrets pin <NAME> --fn <slug> [version] -e <env> [--org <slug>]
+                                                                     pin one function to a version (sticky; --unpin clears)
 
   Note: for the common deploy loop, secrets declared in managed-function.yml are
   reconciled automatically by \`seq-studio functions deploy\` using a local .env.
@@ -659,6 +718,8 @@ export const SECRETS_USAGE = `usage:
   value changes without a redeploy.
 
   Flags: -e/--env <env> (required; see: seq-studio envs list)
+         --org <slug> (target/select managed-scope org; required when a name exists in multiple orgs)
+         set: --from-file <path> (non-interactive; file is not echoed)
          --fn <slug> · --env-var <NAME> · --yes
          --functions <f1,f2> · --keys <K1,K2> · --all (override key selection)
          set-default: [version|version-row-id] (defaults to the most recent non-default) · --yes

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@sequenceholdings/studio-cli",
-  "version": "0.1.22",
-  "description": "Unified Sequence Studio CLI — `seq-studio agents` (typed agent definitions), `seq-studio process` (Lattice), `seq-studio artifact` (Artifact Studio), `seq-studio functions` / `secrets`, `seq-studio repos` (platform git-service), and `seq-studio auth pat` (git-service PATs). Includes Auth0 browser login shared with seqapi.",
+  "version": "0.1.25",
+  "description": "Unified Sequence Studio CLI — `seq-studio init` / `add` / `deploy` (app monorepos), `seq-studio agents`, `seq-studio process` (Lattice), `seq-studio artifact`, `seq-studio functions` / `secrets`, `seq-studio repos`, and `seq-studio auth pat`. Includes Auth0 browser login shared with seqapi.",
   "license": "UNLICENSED",
   "repository": {
     "type": "git",
@@ -36,16 +36,16 @@
     "README.md"
   ],
   "dependencies": {
-    "js-yaml": "^4.1.1",
+    "js-yaml": "^4.3.1",
     "smol-toml": "^1.4.2",
     "tsx": "^4.20.3",
     "zod": "^4.1.13",
-    "@sequenceholdings/agent-spec": "0.1.0",
-    "@sequenceholdings/artifact-studio": "0.2.0",
+    "@sequenceholdings/agent-spec": "0.1.1",
+    "@sequenceholdings/artifact-studio": "0.2.2",
     "@sequenceholdings/lattice": "0.1.2"
   },
   "peerDependencies": {
-    "@sequenceholdings/orm": "0.1.2",
+    "@sequenceholdings/orm": "0.1.3",
     "@sequenceholdings/pipeline-spec": "0.1.0"
   },
   "peerDependenciesMeta": {
@@ -61,7 +61,7 @@
     "@types/node": "^22.0.0",
     "typescript": "^5.6.0",
     "vitest": "^4.1.5",
-    "@sequenceholdings/orm": "0.1.2",
+    "@sequenceholdings/orm": "0.1.3",
     "@sequenceholdings/pipeline-spec": "0.1.0"
   },
   "engines": {

package/dist/pipeline/pinning.d.ts

@@ -1,5 +0,0 @@
-/** Client-side pin rules mirrored from the server deploy adapter (SEQ-2450). */
-export declare const FULL_SHA_PATTERN: RegExp;
-export declare const PINNED_ENVIRONMENTS: Set<string>;
-export declare function isFullSha(ref: string): boolean;
-export declare function requiresPinnedSha(environment: string): boolean;

package/dist/pipeline/pinning.js

@@ -1,9 +0,0 @@
-/** Client-side pin rules mirrored from the server deploy adapter (SEQ-2450). */
-export const FULL_SHA_PATTERN = /^[0-9a-f]{40}$/i;
-export const PINNED_ENVIRONMENTS = new Set(['production', 'banksouth']);
-export function isFullSha(ref) {
-    return FULL_SHA_PATTERN.test(ref);
-}
-export function requiresPinnedSha(environment) {
-    return PINNED_ENVIRONMENTS.has(environment);
-}