orchestra-cli 0.3.4__tar.gz → 0.4.0__tar.gz

{orchestra_cli-0.3.4 → orchestra_cli-0.4.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: orchestra-cli
-Version: 0.3.4
+Version: 0.4.0
 Summary: Orchestra CLI. Perform operations with Orchestra locally.
 Author-email: Orchestra Technologies <support@getorchestra.io>
 Requires-Python: >=3.10
@@ -34,7 +34,7 @@ pipx install orchestra-cli
 
 ## Environment variables
 
-- `ORCHESTRA_API_KEY`: Required for actions that call the API (`pipeline import`, `pipeline new`, `pipeline update`, `pipeline migrate`, `pipeline get`, `pipeline list`, `pipeline delete`, `pipeline run`, `pipeline build`).
+- `ORCHESTRA_API_KEY`: Credential for actions that call the API (`pipeline import`, `pipeline new`, `pipeline update`, `pipeline migrate`, `pipeline get`, `pipeline list`, `pipeline delete`, `pipeline run`, `pipeline build`). Not needed once you have run `orchestra login`: a login takes precedence, and the key is used only when you are not logged in or your login has expired.
 - `BASE_URL`: Optional. Override the default Orchestra host (`https://app.getorchestra.io`) for non‑production/testing.
 
 ## Command structure
@@ -43,6 +43,7 @@ Commands follow a `noun verb` shape. The current nouns are `pipeline` and `task`
 
 | Command                              | Description                                                                                 |
 | ------------------------------------ | ------------------------------------------------------------------------------------------- |
+| `orchestra login`                    | Log in through your browser so later commands need no API key.                              |
 | `orchestra pipeline validate <file>` | Validate a pipeline YAML locally against the Orchestra API schema.                          |
 | `orchestra pipeline import`          | Register a pipeline YAML (from a git repo) with Orchestra under an alias.                   |
 | `orchestra pipeline get`             | Fetch one pipeline by path, alias, or pipeline ID.                                          |
@@ -55,6 +56,8 @@ Commands follow a `noun verb` shape. The current nouns are `pipeline` and `task`
 | `orchestra pipeline build`           | Validate local YAML, create or update a draft pipeline, and start that draft version.       |
 | `orchestra task logs`                | Fetch or follow logs for a single task run.                                                 |
 
+Commands that read a local pipeline file (`pipeline validate`, `import`, `new`, `update`, `build`, and `run --path` with `--task`) accept `.yaml`, `.yml` and `.oml` files; any other extension is rejected. `.oml` files are read as YAML, so only OML written in YAML or JSON syntax is supported. OML block terminators (`.`) and embeds (`%sql ... %%`) fail with an `Invalid YAML` error.
+
 Use `orchestra --help`, `orchestra <noun> --help`, or `orchestra <noun> <verb> --help` for built-in help.
 
 ### Legacy command names
@@ -77,7 +80,7 @@ New code and documentation should prefer the noun/verb form.
 
 ## pipeline validate
 
-Validate a YAML file against the Orchestra API schema.
+Validate a pipeline file against the Orchestra API schema.
 
 ```bash
 orchestra pipeline validate path/to/pipeline.yaml
@@ -87,7 +90,7 @@ orchestra-cli pipeline validate path/to/pipeline.yaml
 
 Options
 
-- `file` (positional): Path to the YAML file to validate.
+- `file` (positional): Path to the `.yaml`, `.yml` or `.oml` file to validate.
 
 Behavior
 
@@ -110,6 +113,18 @@ pipeline:
 
 ---
 
+## login
+
+Log in through your browser instead of pasting an API key. The token is cached in `~/.orchestra/credentials.json` (readable only by you) and refreshed automatically, so later commands need no `ORCHESTRA_API_KEY`.
+
+```bash
+orchestra login
+```
+
+Logins are per host: a login made with `BASE_URL` pointing at another environment is only used against that environment. CI and scripts, where nobody is logged in, keep using `ORCHESTRA_API_KEY`.
+
+---
+
 ## pipeline import
 
 Create (import) a pipeline in Orchestra by referencing a YAML file inside a git repository. The command infers your repository host/provider, default branch, and YAML path relative to the repo root.

{orchestra_cli-0.3.4 → orchestra_cli-0.4.0}/README.md

@@ -20,7 +20,7 @@ pipx install orchestra-cli
 
 ## Environment variables
 
-- `ORCHESTRA_API_KEY`: Required for actions that call the API (`pipeline import`, `pipeline new`, `pipeline update`, `pipeline migrate`, `pipeline get`, `pipeline list`, `pipeline delete`, `pipeline run`, `pipeline build`).
+- `ORCHESTRA_API_KEY`: Credential for actions that call the API (`pipeline import`, `pipeline new`, `pipeline update`, `pipeline migrate`, `pipeline get`, `pipeline list`, `pipeline delete`, `pipeline run`, `pipeline build`). Not needed once you have run `orchestra login`: a login takes precedence, and the key is used only when you are not logged in or your login has expired.
 - `BASE_URL`: Optional. Override the default Orchestra host (`https://app.getorchestra.io`) for non‑production/testing.
 
 ## Command structure
@@ -29,6 +29,7 @@ Commands follow a `noun verb` shape. The current nouns are `pipeline` and `task`
 
 | Command                              | Description                                                                                 |
 | ------------------------------------ | ------------------------------------------------------------------------------------------- |
+| `orchestra login`                    | Log in through your browser so later commands need no API key.                              |
 | `orchestra pipeline validate <file>` | Validate a pipeline YAML locally against the Orchestra API schema.                          |
 | `orchestra pipeline import`          | Register a pipeline YAML (from a git repo) with Orchestra under an alias.                   |
 | `orchestra pipeline get`             | Fetch one pipeline by path, alias, or pipeline ID.                                          |
@@ -41,6 +42,8 @@ Commands follow a `noun verb` shape. The current nouns are `pipeline` and `task`
 | `orchestra pipeline build`           | Validate local YAML, create or update a draft pipeline, and start that draft version.       |
 | `orchestra task logs`                | Fetch or follow logs for a single task run.                                                 |
 
+Commands that read a local pipeline file (`pipeline validate`, `import`, `new`, `update`, `build`, and `run --path` with `--task`) accept `.yaml`, `.yml` and `.oml` files; any other extension is rejected. `.oml` files are read as YAML, so only OML written in YAML or JSON syntax is supported. OML block terminators (`.`) and embeds (`%sql ... %%`) fail with an `Invalid YAML` error.
+
 Use `orchestra --help`, `orchestra <noun> --help`, or `orchestra <noun> <verb> --help` for built-in help.
 
 ### Legacy command names
@@ -63,7 +66,7 @@ New code and documentation should prefer the noun/verb form.
 
 ## pipeline validate
 
-Validate a YAML file against the Orchestra API schema.
+Validate a pipeline file against the Orchestra API schema.
 
 ```bash
 orchestra pipeline validate path/to/pipeline.yaml
@@ -73,7 +76,7 @@ orchestra-cli pipeline validate path/to/pipeline.yaml
 
 Options
 
-- `file` (positional): Path to the YAML file to validate.
+- `file` (positional): Path to the `.yaml`, `.yml` or `.oml` file to validate.
 
 Behavior
 
@@ -96,6 +99,18 @@ pipeline:
 
 ---
 
+## login
+
+Log in through your browser instead of pasting an API key. The token is cached in `~/.orchestra/credentials.json` (readable only by you) and refreshed automatically, so later commands need no `ORCHESTRA_API_KEY`.
+
+```bash
+orchestra login
+```
+
+Logins are per host: a login made with `BASE_URL` pointing at another environment is only used against that environment. CI and scripts, where nobody is logged in, keep using `ORCHESTRA_API_KEY`.
+
+---
+
 ## pipeline import
 
 Create (import) a pipeline in Orchestra by referencing a YAML file inside a git repository. The command infers your repository host/provider, default branch, and YAML path relative to the repo root.

{orchestra_cli-0.3.4 → orchestra_cli-0.4.0}/orchestra_cli/src/build_pipeline.py

@@ -3,7 +3,7 @@ from pathlib import Path
 import httpx
 import typer
 
-from ..utils.api import auth_headers, fail_with_response, request_or_exit, require_api_key
+from ..utils.api import auth_headers, fail_with_response, request_or_exit, require_credential
 from ..utils.constants import get_create_pipeline_url, get_update_pipeline_url
 from ..utils.git import confirm_git_warnings_or_exit, prepare_git_backed_run_target
 from ..utils.pipeline_lookup import lookup_existing_pipeline
@@ -68,7 +68,6 @@ def _create_draft_pipeline(
     lookup_selector: PipelineSelector,
     pipeline_data: dict[str, object],
     force: bool,
-    api_key: str,
 ) -> tuple[PipelineSelector, int]:
     create_selector = _build_create_selector(path, lookup_selector, force)
     payload = build_upsert_payload(pipeline_data, publish=False, selector=create_selector)
@@ -79,7 +78,7 @@ def _create_draft_pipeline(
         get_create_pipeline_url(),
         json=payload,
         timeout=30,
-        headers=auth_headers(api_key),
+        headers=auth_headers(),
     )
 
     if create_response.status_code == 201:
@@ -98,7 +97,6 @@ def _create_draft_pipeline(
 def _update_draft_pipeline(
     existing_pipeline: dict[str, object],
     pipeline_data: dict[str, object],
-    api_key: str,
 ) -> tuple[PipelineSelector, int]:
     update_selector = build_update_selector(existing_pipeline, "Build")
     payload = build_upsert_payload(pipeline_data, publish=False, selector=update_selector)
@@ -109,7 +107,7 @@ def _update_draft_pipeline(
         get_update_pipeline_url(),
         json=payload,
         timeout=30,
-        headers=auth_headers(api_key),
+        headers=auth_headers(),
     )
 
     if update_response.status_code == 200:
@@ -145,7 +143,7 @@ def build_pipeline(
     """
     Validate local YAML, create or update a draft pipeline, and start the draft version.
     """
-    api_key = require_api_key()
+    require_credential()
     if path is None:
         typer.echo(
             red("A pipeline YAML file path is required (use -p or --path with your YAML file)"),
@@ -155,7 +153,7 @@ def build_pipeline(
 
     confirm_git_warnings_or_exit(force, path)
     pipeline_data = load_validated_pipeline_data(path)
-    existing_pipeline = lookup_existing_pipeline(lookup_selector, api_key, "Build", allow_404=True)
+    existing_pipeline = lookup_existing_pipeline(lookup_selector, "Build", allow_404=True)
 
     if existing_pipeline is None:
         run_selector, version_number = _create_draft_pipeline(
@@ -163,11 +161,9 @@ def build_pipeline(
             lookup_selector=lookup_selector,
             pipeline_data=pipeline_data,
             force=force,
-            api_key=api_key,
         )
         start_pipeline_run(
             selector=run_selector,
-            api_key=api_key,
             payload=build_run_payload(
                 branch=branch,
                 commit=commit,
@@ -183,12 +179,10 @@ def build_pipeline(
         run_selector, version_number = _update_draft_pipeline(
             existing_pipeline=existing_pipeline,
             pipeline_data=pipeline_data,
-            api_key=api_key,
         )
 
         start_pipeline_run(
             selector=run_selector,
-            api_key=api_key,
             payload=build_run_payload(
                 branch=branch,
                 commit=commit,
@@ -222,7 +216,6 @@ def build_pipeline(
 
     start_pipeline_run(
         selector=run_selector,
-        api_key=api_key,
         payload=build_run_payload(
             branch=git_branch,
             commit=git_commit,

{orchestra_cli-0.3.4 → orchestra_cli-0.4.0}/orchestra_cli/src/cli.py

@@ -6,6 +6,7 @@ from .delete_pipeline import delete_pipeline
 from .fetch_pipelines import fetch_pipelines
 from .get_pipeline import get_pipeline
 from .import_pipeline import import_pipeline
+from .login import login
 from .migrate_pipeline import migrate_pipeline
 from .run_pipeline import run_pipeline
 from .task_logs import task_logs
@@ -18,6 +19,7 @@ pipeline_app = typer.Typer(help="Manage Orchestra pipelines (validate, import, r
 app.add_typer(pipeline_app, name="pipeline")
 task_app = typer.Typer(help="Inspect Orchestra task runs.")
 app.add_typer(task_app, name="task")
+app.command(name="login")(login)
 
 pipeline_app.command(name="validate")(validate)
 pipeline_app.command(name="import")(import_pipeline)

{orchestra_cli-0.3.4 → orchestra_cli-0.4.0}/orchestra_cli/src/create_pipeline.py

@@ -7,7 +7,7 @@ from ..utils.api import (
     auth_headers,
     fail_with_response,
     request_or_exit,
-    require_api_key,
+    require_credential,
 )
 from ..utils.constants import get_create_pipeline_url
 from ..utils.pipeline_selector import (
@@ -36,7 +36,7 @@ def create_pipeline(
     """
     Create an Orchestra-backed pipeline from a local YAML file.
     """
-    api_key = require_api_key()
+    require_credential()
     if path is None:
         typer.echo(red("Provide --path to create a pipeline from YAML"))
         raise typer.Exit(code=1)
@@ -54,7 +54,7 @@ def create_pipeline(
         get_create_pipeline_url(),
         json=payload,
         timeout=30,
-        headers=auth_headers(api_key),
+        headers=auth_headers(),
     )
 
     if response.status_code == 201:

{orchestra_cli-0.3.4 → orchestra_cli-0.4.0}/orchestra_cli/src/delete_pipeline.py

@@ -7,7 +7,7 @@ from ..utils.api import (
     auth_headers,
     fail_with_response,
     request_or_exit,
-    require_api_key,
+    require_credential,
 )
 from ..utils.constants import get_delete_pipeline_url
 from ..utils.pipeline_selector import (
@@ -27,7 +27,7 @@ def delete_pipeline(
     """
     Delete a pipeline by selector.
     """
-    api_key = require_api_key()
+    require_credential()
     selector = resolve_pipeline_selector(alias, pipeline_id, path)
 
     if not typer.confirm(f"Delete pipeline ({selector.display()})?"):
@@ -39,7 +39,7 @@ def delete_pipeline(
         get_delete_pipeline_url(),
         params=selector.to_payload(),
         timeout=30,
-        headers=auth_headers(api_key),
+        headers=auth_headers(),
     )
 
     if response.status_code == 204:

{orchestra_cli-0.3.4 → orchestra_cli-0.4.0}/orchestra_cli/src/fetch_pipelines.py

@@ -7,7 +7,7 @@ from ..utils.api import (
     auth_headers,
     fail_with_response,
     request_or_exit,
-    require_api_key,
+    require_credential,
 )
 from ..utils.constants import get_api_url
 from ..utils.styling import indent_message, red, yellow
@@ -19,13 +19,13 @@ def fetch_pipelines():
 
     The API always includes each pipeline's latest run metadata.
     """
-    api_key = require_api_key()
+    require_credential()
 
     response = request_or_exit(
         httpx.get,
         get_api_url("pipelines"),
         timeout=30,
-        headers=auth_headers(api_key),
+        headers=auth_headers(),
     )
 
     if response.status_code == 200:

{orchestra_cli-0.3.4 → orchestra_cli-0.4.0}/orchestra_cli/src/get_pipeline.py

@@ -10,7 +10,7 @@ from ..utils.api import (
     auth_headers,
     fail_with_response,
     request_or_exit,
-    require_api_key,
+    require_credential,
 )
 from ..utils.constants import get_pipeline_url
 from ..utils.pipeline_selector import (
@@ -50,7 +50,7 @@ def get_pipeline(
     """
     Fetch one pipeline using the shared selector model.
     """
-    api_key = require_api_key()
+    require_credential()
     selector = resolve_pipeline_selector(alias, pipeline_id, path)
 
     response = request_or_exit(
@@ -58,7 +58,7 @@ def get_pipeline(
         get_pipeline_url(),
         params=selector.to_payload(),
         timeout=30,
-        headers=auth_headers(api_key),
+        headers=auth_headers(),
     )
 
     if response.status_code == 200:

{orchestra_cli-0.3.4 → orchestra_cli-0.4.0}/orchestra_cli/src/import_pipeline.py

@@ -8,7 +8,7 @@ from ..utils.api import (
     auth_headers,
     fail_with_response,
     request_or_exit,
-    require_api_key,
+    require_credential,
 )
 from ..utils.constants import get_api_url
 from ..utils.git import (
@@ -43,7 +43,7 @@ def import_pipeline(
     """
     Create a pipeline in Orchestra by referencing a YAML file in your git repository.
     """
-    api_key = require_api_key()
+    require_credential()
     if path is None:
         typer.echo(red("Provide --path to import a pipeline from git"))
         raise typer.Exit(code=1)
@@ -102,7 +102,7 @@ def import_pipeline(
         get_api_url("pipelines/import"),
         json=payload,
         timeout=30,
-        headers=auth_headers(api_key),
+        headers=auth_headers(),
     )
 
     if response.status_code == 201:

orchestra_cli-0.4.0/orchestra_cli/src/login.py

@@ -0,0 +1,162 @@
+import base64
+import hashlib
+import secrets
+import time
+import webbrowser
+from http.server import BaseHTTPRequestHandler, HTTPServer
+from importlib.resources import files
+from urllib.parse import parse_qs, urlencode, urlparse
+
+import httpx
+import typer
+
+from ..utils.api import fail_with_response, request_or_exit, token_response_to_credentials
+from ..utils.constants import get_base_url
+from ..utils.credentials import save_credentials
+from ..utils.styling import green, red, yellow
+
+SCOPES = "orchestra:read orchestra:write offline_access"
+CALLBACK_PATH = "/callback"
+LOGIN_TIMEOUT_SECONDS = 300
+
+
+class _CallbackHandler(BaseHTTPRequestHandler):
+    params: dict[str, str] | None = None
+    # Bounds reads on connections a browser opens speculatively and never uses, which
+    # would otherwise block the single-threaded server past the login deadline.
+    timeout = 5
+
+    def do_GET(self):  # noqa: N802
+        url = urlparse(self.path)
+        if url.path != CALLBACK_PATH:
+            self.send_response(404)
+            self.end_headers()
+            return
+        _CallbackHandler.params = {k: v[0] for k, v in parse_qs(url.query).items()}
+        self.send_response(200)
+        self.send_header("Content-Type", "text/html; charset=utf-8")
+        self.end_headers()
+        self.wfile.write(files(__package__).joinpath("login_page.html").read_bytes())
+
+    def log_message(self, format, *args):  # noqa: ARG002
+        pass
+
+
+def _pkce_pair() -> tuple[str, str]:
+    verifier = secrets.token_urlsafe(64)
+    digest = hashlib.sha256(verifier.encode()).digest()
+    challenge = base64.urlsafe_b64encode(digest).rstrip(b"=").decode()
+    return verifier, challenge
+
+
+def _wait_for_callback(server: HTTPServer, state: str) -> dict[str, str]:
+    """Wait for the redirect carrying this login's ``state``.
+
+    Any other request to the callback (a prefetch, a stale tab, another local
+    process) is ignored rather than ending the login.
+    """
+    deadline = time.monotonic() + LOGIN_TIMEOUT_SECONDS
+    server.timeout = 1
+    while True:
+        _CallbackHandler.params = None
+        if time.monotonic() > deadline:
+            typer.echo(red("Timed out waiting for the browser to complete login"))
+            raise typer.Exit(code=1)
+        server.handle_request()
+        params = _CallbackHandler.params
+        if params is not None and params.get("state") == state:
+            return params
+
+
+def login():
+    """
+    Log in to Orchestra in your browser and cache the token for later commands.
+    """
+    base_url = get_base_url()
+    response = request_or_exit(
+        httpx.get,
+        f"{base_url}/.well-known/oauth-authorization-server",
+        timeout=30,
+    )
+    if response.status_code != 200:
+        raise fail_with_response("Discovery", response)
+    # The web app answers unknown paths with a 200 HTML page, so a host without an
+    # authorization server behind it still reaches this point.
+    try:
+        metadata = response.json()
+    except ValueError:
+        metadata = None
+    required = ("authorization_endpoint", "token_endpoint", "registration_endpoint")
+    if not isinstance(metadata, dict) or not all(k in metadata for k in required):
+        typer.echo(red(f"{base_url} does not support `orchestra login`"))
+        raise typer.Exit(code=1)
+
+    with HTTPServer(("127.0.0.1", 0), _CallbackHandler) as server:
+        redirect_uri = f"http://127.0.0.1:{server.server_port}{CALLBACK_PATH}"
+
+        response = request_or_exit(
+            httpx.post,
+            metadata["registration_endpoint"],
+            json={
+                "client_name": "Orchestra CLI",
+                "redirect_uris": [redirect_uri],
+                "grant_types": ["authorization_code", "refresh_token"],
+                "response_types": ["code"],
+                "token_endpoint_auth_method": "none",
+            },
+            timeout=30,
+        )
+        if response.status_code not in (200, 201):
+            raise fail_with_response("Client registration", response)
+        client_id = response.json()["client_id"]
+
+        verifier, challenge = _pkce_pair()
+        state = secrets.token_urlsafe(32)
+        authorize_url = f"{metadata['authorization_endpoint']}?" + urlencode(
+            {
+                "response_type": "code",
+                "client_id": client_id,
+                "redirect_uri": redirect_uri,
+                "scope": SCOPES,
+                "state": state,
+                "code_challenge": challenge,
+                "code_challenge_method": "S256",
+            },
+        )
+
+        typer.echo(yellow("Opening your browser to log in. If it does not open, visit:"))
+        typer.echo(authorize_url)
+        webbrowser.open(authorize_url)
+        params = _wait_for_callback(server, state)
+
+    if "error" in params:
+        detail = params.get("error_description", params["error"])
+        typer.echo(red(f"Login failed: {detail}"))
+        raise typer.Exit(code=1)
+
+    response = request_or_exit(
+        httpx.post,
+        metadata["token_endpoint"],
+        data={
+            "grant_type": "authorization_code",
+            "code": params.get("code", ""),
+            "redirect_uri": redirect_uri,
+            "client_id": client_id,
+            "code_verifier": verifier,
+        },
+        timeout=30,
+    )
+    if response.status_code != 200:
+        raise fail_with_response("Token exchange", response)
+    token = response.json()
+    if "refresh_token" not in token:
+        typer.echo(red("Login failed: no refresh token was granted, so the login cannot be kept"))
+        raise typer.Exit(code=1)
+
+    save_credentials(
+        token_response_to_credentials(
+            token,
+            {"client_id": client_id, "token_endpoint": metadata["token_endpoint"]},
+        ),
+    )
+    typer.echo(green(f"✅ Logged in to {base_url}"))

orchestra_cli-0.4.0/orchestra_cli/src/login_page.html

@@ -0,0 +1,42 @@
+<!DOCTYPE html>
+<html lang="en">
+<head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initial-scale=1">
+<title>Orchestra CLI login</title>
+<style>
+  html, body { height: 100%; margin: 0; }
+  body {
+    display: flex;
+    align-items: center;
+    justify-content: center;
+    padding: 0 16px;
+    background: linear-gradient(to bottom, #3754BF, #253B8E 45%, #0D1431);
+    color: #FFFFFF;
+    font-family: "DM Sans", system-ui, -apple-system, "Segoe UI", sans-serif;
+    text-align: center;
+  }
+  .logo { height: 34px; width: auto; margin-bottom: 40px; }
+  h1 { margin: 0 0 12px; font-size: 28px; font-weight: 500; }
+  p { margin: 0; font-size: 16px; color: #BAC7F4; }
+</style>
+</head>
+<body>
+<main>
+<svg class="logo" role="img" aria-label="Orchestra" width="210" height="34" viewBox="0 0 210 34" fill="none" xmlns="http://www.w3.org/2000/svg">
+<path d="M46.4619 16.8629C46.4619 8.8581 51.4514 3.26221 59.249 3.26221C67.0467 3.26221 72.073 8.8581 72.073 16.8629C72.073 24.8677 67.0467 30.4636 59.249 30.4636C51.4514 30.4636 46.4619 24.8677 46.4619 16.8629ZM66.8626 16.8629C66.8626 11.4525 64.0903 7.59826 59.249 7.59826C54.4077 7.59826 51.6732 11.4525 51.6732 16.8629C51.6732 22.2733 54.4445 26.1276 59.249 26.1276C64.0535 26.1276 66.8626 22.2733 66.8626 16.8629Z" fill="white"/>
+<path d="M86.1213 11.1182V15.3426H84.3108C81.1695 15.3426 79.4695 16.5655 79.4327 20.4197V30.0185H74.7764V11.1182H79.3223V14.6392C80.0245 12.749 81.7981 11.1182 84.829 11.1182H86.1222H86.1213Z" fill="white"/>
+<path d="M96.4644 30.4638C90.7727 30.4638 86.8923 26.2764 86.8923 20.5688C86.8923 14.8613 90.7359 10.7485 96.4276 10.7485C101.047 10.7485 104.337 13.2682 105.186 17.6043H100.493C100.013 15.4547 98.6826 14.1579 96.5013 14.1579C93.5081 14.1579 91.8449 16.7893 91.8449 20.5688C91.8449 24.3483 93.5081 27.0544 96.5013 27.0544C98.8667 27.0544 100.013 25.646 100.493 23.5712H105.186C104.337 28.018 101.047 30.4638 96.4644 30.4638Z" fill="white"/>
+<path d="M112.572 3.82422V14.1938C113.57 12.3775 115.418 10.7475 118.633 10.7475C122.698 10.7475 124.842 13.2303 124.842 17.0845V30.0179H120.149V18.1219C120.149 15.8247 119.224 14.4163 116.712 14.4163C114.199 14.4163 112.573 16.3065 112.573 19.271V30.0179H107.916V3.82422H112.573H112.572Z" fill="white"/>
+<path d="M137.074 10.7485C142.988 10.7485 146.646 15.3809 146.425 21.6071H132.308C132.493 25.0535 134.266 27.1292 137.186 27.1292C139.514 27.1292 140.807 25.7577 141.398 24.0161H146.055C145.02 27.6848 141.952 30.4647 137.148 30.4647C131.383 30.4647 127.502 26.2773 127.502 20.5697C127.502 14.8622 131.309 10.7494 137.074 10.7494V10.7485ZM137.074 14.0463C134.487 14.0463 132.862 15.8626 132.455 18.6786H141.694C141.25 15.8987 139.662 14.0463 137.074 14.0463Z" fill="white"/>
+<path d="M147.76 23.9041H152.528C152.787 26.2761 154.523 27.2766 156.852 27.2766C159.181 27.2766 160.178 26.0906 160.178 24.6822C160.178 22.9775 158.922 22.6074 155.817 21.8653C151.605 20.8648 148.389 19.8274 148.389 16.1956C148.389 12.9348 151.567 10.7104 156.408 10.7104C161.25 10.7104 164.206 13.1194 164.686 16.418H159.993C159.772 14.7872 158.478 13.8236 156.372 13.8236C154.265 13.8236 153.12 14.7502 153.12 15.8615C153.12 17.3807 154.672 17.7148 157.444 18.3812C161.657 19.3817 165.021 20.3821 165.021 24.385C165.021 28.3879 161.731 30.4627 156.853 30.4627C151.494 30.4627 148.168 28.0538 147.761 23.9032L147.76 23.9041Z" fill="white"/>
+<path d="M173.555 14.3419V24.5702C173.555 26.201 173.962 26.6459 175.477 26.6459H177.694V30.0184H173.962C170.118 30.0184 168.898 28.3875 168.898 24.9043V14.3419H166.089V11.118H168.898V5.80762H173.555V11.118H177.694V14.3419H173.555Z" fill="white"/>
+<path d="M191.738 11.1182V15.3426H189.928C186.786 15.3426 185.086 16.5655 185.049 20.4197V30.0185H180.393V11.1182H184.939V14.6392C185.641 12.749 187.415 11.1182 190.446 11.1182H191.739H191.738Z" fill="white"/>
+<path d="M192.419 24.6824C192.419 20.902 195.264 19.7169 199.699 18.5678C202.655 17.7898 204.614 17.4557 204.614 16.0112C204.614 14.7883 203.394 13.9355 201.288 13.9355C199.181 13.9355 197.703 14.8991 197.555 16.6776H192.936C193.38 13.3421 196.262 10.7485 201.436 10.7485C206.609 10.7485 209.418 12.8612 209.418 16.8262V30.019H204.984V26.7951C204.282 28.7591 202.471 30.4638 198.923 30.4638C195.375 30.4638 192.419 28.3512 192.419 24.6824ZM204.8 22.1249V18.8263C204.393 19.8268 203.247 20.3455 201.326 20.9389C198.814 21.6801 197.224 22.4581 197.224 24.4222C197.224 26.1638 198.592 27.2012 200.476 27.2012C203.21 27.2012 204.8 24.904 204.8 22.124V22.1249Z" fill="white"/>
+<path d="M25.7719 10.3911L30.0232 6.143C32.1819 8.74145 33.5794 11.9935 33.8765 15.5586H27.8726C27.6236 13.6369 26.8803 11.8705 25.7719 10.3911ZM10.2383 8.23585C12.0953 6.81357 14.4182 5.96822 16.9383 5.96822C19.4583 5.96822 21.7812 6.81357 23.6383 8.23585L27.8851 3.99219C24.9277 1.50164 21.1084 0 16.9383 0C12.7682 0 8.94879 1.50164 5.99144 3.99219L10.2383 8.23585ZM6.00393 15.5586C6.25291 13.6369 6.99626 11.8705 8.1046 10.3911L3.8533 6.143C1.69463 8.74234 0.297163 11.9944 0 15.5586H6.00393ZM27.8476 18.5904C27.0695 23.9148 22.4826 28.0033 16.9383 28.0033C11.3939 28.0033 6.80707 23.9148 6.02892 18.5904H0.0160628C0.825451 27.2186 8.0921 33.9706 16.9383 33.9706C25.7844 33.9706 33.0511 27.2177 33.8605 18.5904H27.8476ZM16.9383 10.5641C13.3893 10.5641 10.5113 13.439 10.5113 16.9862C10.5113 20.5334 13.3884 23.4083 16.9383 23.4083C20.4882 23.4083 23.3652 20.5334 23.3652 16.9862C23.3652 13.439 20.4882 10.5641 16.9383 10.5641Z" fill="white"/>
+</svg>
+<h1>Return to your terminal</h1>
+<p>to finish logging in to Orchestra. You can close this tab.</p>
+</main>
+</body>
+</html>

{orchestra_cli-0.3.4 → orchestra_cli-0.4.0}/orchestra_cli/src/migrate_pipeline.py

@@ -5,7 +5,7 @@ from typing import Any
 import httpx
 import typer
 
-from ..utils.api import auth_headers, fail_with_response, request_or_exit, require_api_key
+from ..utils.api import auth_headers, fail_with_response, request_or_exit, require_credential
 from ..utils.constants import get_api_url
 from ..utils.git import (
     GitAction,
@@ -121,7 +121,7 @@ def _choose_migration_version(existing_pipeline: dict[str, object], force: bool)
     raise typer.Exit(code=1)
 
 
-def _download_pipeline_yaml(selector: PipelineSelector, version: int | None, api_key: str) -> str:
+def _download_pipeline_yaml(selector: PipelineSelector, version: int | None) -> str:
     params = selector.to_payload()
     if version is not None:
         params["version"] = str(version)
@@ -131,7 +131,7 @@ def _download_pipeline_yaml(selector: PipelineSelector, version: int | None, api
         get_api_url("pipeline/data"),
         params=params,
         timeout=30,
-        headers=auth_headers(api_key),
+        headers=auth_headers(),
     )
     if response.status_code != 200:
         raise fail_with_response("Migrate", response)
@@ -344,7 +344,7 @@ def migrate_pipeline(
     """
     Migrate an Orchestra-backed pipeline to git-backed storage.
     """
-    api_key = require_api_key()
+    require_credential()
     selector = _resolve_migrate_selector(alias, pipeline_id)
 
     repo_root = require_repo_root(path, GitAction.MIGRATE)
@@ -370,7 +370,7 @@ def migrate_pipeline(
         typer.echo(red("Could not detect current branch from git"))
         raise typer.Exit(code=1)
 
-    existing_pipeline = lookup_existing_pipeline(selector, api_key, "Migrate")
+    existing_pipeline = lookup_existing_pipeline(selector, "Migrate")
     if existing_pipeline is None:
         typer.echo(red("❌ Migrate failed: pipeline lookup returned no pipeline"))
         raise typer.Exit(code=1)
@@ -382,7 +382,7 @@ def migrate_pipeline(
         raise typer.Exit(code=1)
 
     target_version = _choose_migration_version(existing_pipeline, force)
-    downloaded_yaml = _download_pipeline_yaml(selector, target_version, api_key)
+    downloaded_yaml = _download_pipeline_yaml(selector, target_version)
     target_path, selected_yaml = _resolve_target_path_and_yaml(path, downloaded_yaml, force)
     relative_path = ensure_repo_relative_path(target_path, repo_root, GitAction.MIGRATE)
     _write_yaml(target_path, selected_yaml)
@@ -411,7 +411,7 @@ def migrate_pipeline(
         params=selector.to_payload(),
         json=payload,
         timeout=30,
-        headers=auth_headers(api_key),
+        headers=auth_headers(),
     )
     if not (200 <= response.status_code < 300):
         raise fail_with_response("Migrate", response)