orchestra-cli 0.3.5__tar.gz → 0.5.0__tar.gz

{orchestra_cli-0.3.5 → orchestra_cli-0.5.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: orchestra-cli
-Version: 0.3.5
+Version: 0.5.0
 Summary: Orchestra CLI. Perform operations with Orchestra locally.
 Author-email: Orchestra Technologies <support@getorchestra.io>
 Requires-Python: >=3.10
@@ -34,15 +34,17 @@ pipx install orchestra-cli
 
 ## Environment variables
 
-- `ORCHESTRA_API_KEY`: Required for actions that call the API (`pipeline import`, `pipeline new`, `pipeline update`, `pipeline migrate`, `pipeline get`, `pipeline list`, `pipeline delete`, `pipeline run`, `pipeline build`).
+- `ORCHESTRA_API_KEY`: Credential for actions that call the API (`pipeline import`, `pipeline new`, `pipeline update`, `pipeline migrate`, `pipeline get`, `pipeline list`, `pipeline delete`, `pipeline run`, `pipeline build`, `accounts list`). Not needed once you have run `orchestra login`: a login takes precedence, and the key is used only when you are not logged in or your login has expired.
+- `ORCHESTRA_ACCOUNT_ID`: Optional. The workspace to act in when your `orchestra login` covers several. Every `pipeline` and `task` command that calls the API also takes `--account-id`, which wins over the variable, and both win over the default saved by `orchestra accounts use`. API keys belong to one account and don't need it.
 - `BASE_URL`: Optional. Override the default Orchestra host (`https://app.getorchestra.io`) for non‑production/testing.
 
 ## Command structure
 
-Commands follow a `noun verb` shape. The current nouns are `pipeline` and `task`:
+Commands follow a `noun verb` shape. The current nouns are `pipeline`, `task` and `accounts`:
 
 | Command                              | Description                                                                                 |
 | ------------------------------------ | ------------------------------------------------------------------------------------------- |
+| `orchestra login`                    | Log in through your browser so later commands need no API key.                              |
 | `orchestra pipeline validate <file>` | Validate a pipeline YAML locally against the Orchestra API schema.                          |
 | `orchestra pipeline import`          | Register a pipeline YAML (from a git repo) with Orchestra under an alias.                   |
 | `orchestra pipeline get`             | Fetch one pipeline by path, alias, or pipeline ID.                                          |
@@ -54,6 +56,8 @@ Commands follow a `noun verb` shape. The current nouns are `pipeline` and `task`
 | `orchestra pipeline run`             | Start a pipeline run by selector, optionally pinning branch/commit and waiting.             |
 | `orchestra pipeline build`           | Validate local YAML, create or update a draft pipeline, and start that draft version.       |
 | `orchestra task logs`                | Fetch or follow logs for a single task run.                                                 |
+| `orchestra accounts list`            | List the workspaces your login or API key covers, with their ids, as JSON.                  |
+| `orchestra accounts use [id\|name]`   | Save the workspace later commands act in when no `--account-id` is given.                   |
 
 Commands that read a local pipeline file (`pipeline validate`, `import`, `new`, `update`, `build`, and `run --path` with `--task`) accept `.yaml`, `.yml` and `.oml` files; any other extension is rejected. `.oml` files are read as YAML, so only OML written in YAML or JSON syntax is supported. OML block terminators (`.`) and embeds (`%sql ... %%`) fail with an `Invalid YAML` error.
 
@@ -112,6 +116,20 @@ pipeline:
 
 ---
 
+## login
+
+Log in through your browser instead of pasting an API key. The token is cached in `~/.orchestra/credentials.json` (readable only by you) and refreshed automatically, so later commands need no `ORCHESTRA_API_KEY`.
+
+```bash
+orchestra login
+```
+
+Logins are per host: a login made with `BASE_URL` pointing at another environment is only used against that environment. CI and scripts, where nobody is logged in, keep using `ORCHESTRA_API_KEY`.
+
+After logging in it saves a default workspace, as `accounts use` does: the only one if your login covers one, or the one you pick from a list if it covers several. Esc skips the default, and without a terminal it prints a hint to run `orchestra accounts use` instead. If the accounts can't be listed, the login still succeeds with no default set.
+
+---
+
 ## pipeline import
 
 Create (import) a pipeline in Orchestra by referencing a YAML file inside a git repository. The command infers your repository host/provider, default branch, and YAML path relative to the repo root.
@@ -400,6 +418,43 @@ Behavior
 
 ---
 
+## accounts list
+
+List the workspaces the current credential covers. An `orchestra login` token can cover several workspaces; an API key lists just its own.
+
+```bash
+orchestra accounts list
+```
+
+Behavior
+
+- Sends `GET /public/v1/accounts`, with no account header.
+- Prints the `[{id, name}]` response as pretty JSON, adding `default: true` to the account saved by `accounts use` and `false` to the rest.
+- Exit codes: `0` on success, `1` on failure.
+
+---
+
+## accounts use
+
+Save a default workspace for an `orchestra login` that covers several, so commands no longer need `--account-id`.
+
+```bash
+orchestra accounts use 'some great account'
+orchestra accounts use 00000000-0000-0000-0000-000000000000
+orchestra accounts use   # pick from a list
+```
+
+Behavior
+
+- Fetches the accounts as `accounts list` does, then matches an exact id first and a case-insensitive exact name second.
+- Exits `1`, listing the valid names, when nothing matches, and asks for the id when several workspaces share the name.
+- With no argument, lists the workspaces with the cursor on the current default: ↑/↓ moves, Enter saves, and Esc, Ctrl+C or Ctrl+D exits `1` leaving the default unchanged. Without a terminal (CI, piped input) it exits `1` and asks for an id or name instead.
+- Saves the account into the login's entry in `~/.orchestra/credentials.json`. It survives token refreshes; running `orchestra login` again resets it.
+- `--account-id` and `ORCHESTRA_ACCOUNT_ID` still override the default. It is never sent with an API key.
+- Exits `1` when you are using an API key rather than a login, since a key covers one account.
+
+---
+
 ## task logs
 
 Fetch or follow logs for a single task run.

{orchestra_cli-0.3.5 → orchestra_cli-0.5.0}/README.md

@@ -20,15 +20,17 @@ pipx install orchestra-cli
 
 ## Environment variables
 
-- `ORCHESTRA_API_KEY`: Required for actions that call the API (`pipeline import`, `pipeline new`, `pipeline update`, `pipeline migrate`, `pipeline get`, `pipeline list`, `pipeline delete`, `pipeline run`, `pipeline build`).
+- `ORCHESTRA_API_KEY`: Credential for actions that call the API (`pipeline import`, `pipeline new`, `pipeline update`, `pipeline migrate`, `pipeline get`, `pipeline list`, `pipeline delete`, `pipeline run`, `pipeline build`, `accounts list`). Not needed once you have run `orchestra login`: a login takes precedence, and the key is used only when you are not logged in or your login has expired.
+- `ORCHESTRA_ACCOUNT_ID`: Optional. The workspace to act in when your `orchestra login` covers several. Every `pipeline` and `task` command that calls the API also takes `--account-id`, which wins over the variable, and both win over the default saved by `orchestra accounts use`. API keys belong to one account and don't need it.
 - `BASE_URL`: Optional. Override the default Orchestra host (`https://app.getorchestra.io`) for non‑production/testing.
 
 ## Command structure
 
-Commands follow a `noun verb` shape. The current nouns are `pipeline` and `task`:
+Commands follow a `noun verb` shape. The current nouns are `pipeline`, `task` and `accounts`:
 
 | Command                              | Description                                                                                 |
 | ------------------------------------ | ------------------------------------------------------------------------------------------- |
+| `orchestra login`                    | Log in through your browser so later commands need no API key.                              |
 | `orchestra pipeline validate <file>` | Validate a pipeline YAML locally against the Orchestra API schema.                          |
 | `orchestra pipeline import`          | Register a pipeline YAML (from a git repo) with Orchestra under an alias.                   |
 | `orchestra pipeline get`             | Fetch one pipeline by path, alias, or pipeline ID.                                          |
@@ -40,6 +42,8 @@ Commands follow a `noun verb` shape. The current nouns are `pipeline` and `task`
 | `orchestra pipeline run`             | Start a pipeline run by selector, optionally pinning branch/commit and waiting.             |
 | `orchestra pipeline build`           | Validate local YAML, create or update a draft pipeline, and start that draft version.       |
 | `orchestra task logs`                | Fetch or follow logs for a single task run.                                                 |
+| `orchestra accounts list`            | List the workspaces your login or API key covers, with their ids, as JSON.                  |
+| `orchestra accounts use [id\|name]`   | Save the workspace later commands act in when no `--account-id` is given.                   |
 
 Commands that read a local pipeline file (`pipeline validate`, `import`, `new`, `update`, `build`, and `run --path` with `--task`) accept `.yaml`, `.yml` and `.oml` files; any other extension is rejected. `.oml` files are read as YAML, so only OML written in YAML or JSON syntax is supported. OML block terminators (`.`) and embeds (`%sql ... %%`) fail with an `Invalid YAML` error.
 
@@ -98,6 +102,20 @@ pipeline:
 
 ---
 
+## login
+
+Log in through your browser instead of pasting an API key. The token is cached in `~/.orchestra/credentials.json` (readable only by you) and refreshed automatically, so later commands need no `ORCHESTRA_API_KEY`.
+
+```bash
+orchestra login
+```
+
+Logins are per host: a login made with `BASE_URL` pointing at another environment is only used against that environment. CI and scripts, where nobody is logged in, keep using `ORCHESTRA_API_KEY`.
+
+After logging in it saves a default workspace, as `accounts use` does: the only one if your login covers one, or the one you pick from a list if it covers several. Esc skips the default, and without a terminal it prints a hint to run `orchestra accounts use` instead. If the accounts can't be listed, the login still succeeds with no default set.
+
+---
+
 ## pipeline import
 
 Create (import) a pipeline in Orchestra by referencing a YAML file inside a git repository. The command infers your repository host/provider, default branch, and YAML path relative to the repo root.
@@ -386,6 +404,43 @@ Behavior
 
 ---
 
+## accounts list
+
+List the workspaces the current credential covers. An `orchestra login` token can cover several workspaces; an API key lists just its own.
+
+```bash
+orchestra accounts list
+```
+
+Behavior
+
+- Sends `GET /public/v1/accounts`, with no account header.
+- Prints the `[{id, name}]` response as pretty JSON, adding `default: true` to the account saved by `accounts use` and `false` to the rest.
+- Exit codes: `0` on success, `1` on failure.
+
+---
+
+## accounts use
+
+Save a default workspace for an `orchestra login` that covers several, so commands no longer need `--account-id`.
+
+```bash
+orchestra accounts use 'some great account'
+orchestra accounts use 00000000-0000-0000-0000-000000000000
+orchestra accounts use   # pick from a list
+```
+
+Behavior
+
+- Fetches the accounts as `accounts list` does, then matches an exact id first and a case-insensitive exact name second.
+- Exits `1`, listing the valid names, when nothing matches, and asks for the id when several workspaces share the name.
+- With no argument, lists the workspaces with the cursor on the current default: ↑/↓ moves, Enter saves, and Esc, Ctrl+C or Ctrl+D exits `1` leaving the default unchanged. Without a terminal (CI, piped input) it exits `1` and asks for an id or name instead.
+- Saves the account into the login's entry in `~/.orchestra/credentials.json`. It survives token refreshes; running `orchestra login` again resets it.
+- `--account-id` and `ORCHESTRA_ACCOUNT_ID` still override the default. It is never sent with an API key.
+- Exits `1` when you are using an API key rather than a login, since a key covers one account.
+
+---
+
 ## task logs
 
 Fetch or follow logs for a single task run.

{orchestra_cli-0.3.5 → orchestra_cli-0.5.0}/orchestra_cli/src/build_pipeline.py

@@ -3,7 +3,13 @@ from pathlib import Path
 import httpx
 import typer
 
-from ..utils.api import auth_headers, fail_with_response, request_or_exit, require_api_key
+from ..utils.api import (
+    account_id_option,
+    api_client,
+    fail_with_response,
+    request_or_exit,
+    require_credential,
+)
 from ..utils.constants import get_create_pipeline_url, get_update_pipeline_url
 from ..utils.git import confirm_git_warnings_or_exit, prepare_git_backed_run_target
 from ..utils.pipeline_lookup import lookup_existing_pipeline
@@ -64,22 +70,20 @@ def _build_create_selector(
 
 
 def _create_draft_pipeline(
+    client: httpx.Client,
     path: Path,
     lookup_selector: PipelineSelector,
     pipeline_data: dict[str, object],
     force: bool,
-    api_key: str,
 ) -> tuple[PipelineSelector, int]:
     create_selector = _build_create_selector(path, lookup_selector, force)
     payload = build_upsert_payload(pipeline_data, publish=False, selector=create_selector)
 
     typer.echo(f"Creating draft pipeline ({create_selector.display()})")
     create_response = request_or_exit(
-        httpx.post,
+        client.post,
         get_create_pipeline_url(),
         json=payload,
-        timeout=30,
-        headers=auth_headers(api_key),
     )
 
     if create_response.status_code == 201:
@@ -96,20 +100,18 @@ def _create_draft_pipeline(
 
 
 def _update_draft_pipeline(
+    client: httpx.Client,
     existing_pipeline: dict[str, object],
     pipeline_data: dict[str, object],
-    api_key: str,
 ) -> tuple[PipelineSelector, int]:
     update_selector = build_update_selector(existing_pipeline, "Build")
     payload = build_upsert_payload(pipeline_data, publish=False, selector=update_selector)
 
     typer.echo(f"Updating draft pipeline ({update_selector.display()})")
     update_response = request_or_exit(
-        httpx.put,
+        client.put,
         get_update_pipeline_url(),
         json=payload,
-        timeout=30,
-        headers=auth_headers(api_key),
     )
 
     if update_response.status_code == 200:
@@ -141,11 +143,13 @@ def build_pipeline(
         "--force/--no-force",
         help="Ignore any warnings and run the pipeline anyway",
     ),
+    account_id: str | None = account_id_option(),
 ) -> None:
     """
     Validate local YAML, create or update a draft pipeline, and start the draft version.
     """
-    api_key = require_api_key()
+    require_credential()
+    client = api_client(account_id)
     if path is None:
         typer.echo(
             red("A pipeline YAML file path is required (use -p or --path with your YAML file)"),
@@ -155,19 +159,19 @@ def build_pipeline(
 
     confirm_git_warnings_or_exit(force, path)
     pipeline_data = load_validated_pipeline_data(path)
-    existing_pipeline = lookup_existing_pipeline(lookup_selector, api_key, "Build", allow_404=True)
+    existing_pipeline = lookup_existing_pipeline(client, lookup_selector, "Build", allow_404=True)
 
     if existing_pipeline is None:
         run_selector, version_number = _create_draft_pipeline(
+            client=client,
             path=path,
             lookup_selector=lookup_selector,
             pipeline_data=pipeline_data,
             force=force,
-            api_key=api_key,
         )
         start_pipeline_run(
+            client=client,
             selector=run_selector,
-            api_key=api_key,
             payload=build_run_payload(
                 branch=branch,
                 commit=commit,
@@ -181,14 +185,14 @@ def build_pipeline(
     pipeline_storage_provider = storage_provider(existing_pipeline)
     if pipeline_storage_provider is None or pipeline_storage_provider == "ORCHESTRA":
         run_selector, version_number = _update_draft_pipeline(
+            client=client,
             existing_pipeline=existing_pipeline,
             pipeline_data=pipeline_data,
-            api_key=api_key,
         )
 
         start_pipeline_run(
+            client=client,
             selector=run_selector,
-            api_key=api_key,
             payload=build_run_payload(
                 branch=branch,
                 commit=commit,
@@ -221,8 +225,8 @@ def build_pipeline(
     )
 
     start_pipeline_run(
+        client=client,
         selector=run_selector,
-        api_key=api_key,
         payload=build_run_payload(
             branch=git_branch,
             commit=git_commit,

{orchestra_cli-0.3.5 → orchestra_cli-0.5.0}/orchestra_cli/src/cli.py

@@ -6,10 +6,13 @@ from .delete_pipeline import delete_pipeline
 from .fetch_pipelines import fetch_pipelines
 from .get_pipeline import get_pipeline
 from .import_pipeline import import_pipeline
+from .list_accounts import list_accounts
+from .login import login
 from .migrate_pipeline import migrate_pipeline
 from .run_pipeline import run_pipeline
 from .task_logs import task_logs
 from .update_pipeline import update_pipeline
+from .use_account import use_account
 from .validate_pipeline import validate
 
 app = typer.Typer(help="Orchestra CLI – perform operations with Orchestra locally.")
@@ -18,6 +21,9 @@ pipeline_app = typer.Typer(help="Manage Orchestra pipelines (validate, import, r
 app.add_typer(pipeline_app, name="pipeline")
 task_app = typer.Typer(help="Inspect Orchestra task runs.")
 app.add_typer(task_app, name="task")
+app.command(name="login")(login)
+accounts_app = typer.Typer(help="List and choose the workspaces your credential covers.")
+app.add_typer(accounts_app, name="accounts")
 
 pipeline_app.command(name="validate")(validate)
 pipeline_app.command(name="import")(import_pipeline)
@@ -30,6 +36,8 @@ pipeline_app.command(name="build")(build_pipeline)
 pipeline_app.command(name="delete")(delete_pipeline)
 pipeline_app.command(name="migrate")(migrate_pipeline)
 task_app.command(name="logs")(task_logs)
+accounts_app.command(name="list")(list_accounts)
+accounts_app.command(name="use")(use_account)
 
 # Legacy top-level aliases (hidden) - keep the old `orchestra <command>` syntax working
 # so existing scripts and CI pipelines do not break. Hidden from `--help` to keep the

{orchestra_cli-0.3.5 → orchestra_cli-0.5.0}/orchestra_cli/src/create_pipeline.py

@@ -1,13 +1,13 @@
 from pathlib import Path
 
-import httpx
 import typer
 
 from ..utils.api import (
-    auth_headers,
+    account_id_option,
+    api_client,
     fail_with_response,
     request_or_exit,
-    require_api_key,
+    require_credential,
 )
 from ..utils.constants import get_create_pipeline_url
 from ..utils.pipeline_selector import (
@@ -32,11 +32,13 @@ def create_pipeline(
         "--publish/--no-publish",
         help="Whether the pipeline is published and can be triggered",
     ),
+    account_id: str | None = account_id_option(),
 ):
     """
     Create an Orchestra-backed pipeline from a local YAML file.
     """
-    api_key = require_api_key()
+    require_credential()
+    client = api_client(account_id)
     if path is None:
         typer.echo(red("Provide --path to create a pipeline from YAML"))
         raise typer.Exit(code=1)
@@ -50,11 +52,9 @@ def create_pipeline(
     payload = build_upsert_payload(data, publish, selector)
 
     response = request_or_exit(
-        httpx.post,
+        client.post,
         get_create_pipeline_url(),
         json=payload,
-        timeout=30,
-        headers=auth_headers(api_key),
     )
 
     if response.status_code == 201:

{orchestra_cli-0.3.5 → orchestra_cli-0.5.0}/orchestra_cli/src/delete_pipeline.py

@@ -1,13 +1,13 @@
 from pathlib import Path
 
-import httpx
 import typer
 
 from ..utils.api import (
-    auth_headers,
+    account_id_option,
+    api_client,
     fail_with_response,
     request_or_exit,
-    require_api_key,
+    require_credential,
 )
 from ..utils.constants import get_delete_pipeline_url
 from ..utils.pipeline_selector import (
@@ -23,11 +23,13 @@ def delete_pipeline(
     path: Path | None = pipeline_path_option(),
     alias: str | None = pipeline_alias_option(),
     pipeline_id: str | None = pipeline_id_option(),
+    account_id: str | None = account_id_option(),
 ):
     """
     Delete a pipeline by selector.
     """
-    api_key = require_api_key()
+    require_credential()
+    client = api_client(account_id)
     selector = resolve_pipeline_selector(alias, pipeline_id, path)
 
     if not typer.confirm(f"Delete pipeline ({selector.display()})?"):
@@ -35,11 +37,9 @@ def delete_pipeline(
         raise typer.Exit(code=1)
 
     response = request_or_exit(
-        httpx.delete,
+        client.delete,
         get_delete_pipeline_url(),
         params=selector.to_payload(),
-        timeout=30,
-        headers=auth_headers(api_key),
     )
 
     if response.status_code == 204:

{orchestra_cli-0.3.5 → orchestra_cli-0.5.0}/orchestra_cli/src/fetch_pipelines.py

@@ -1,31 +1,30 @@
 import json
 
-import httpx
 import typer
 
 from ..utils.api import (
-    auth_headers,
+    account_id_option,
+    api_client,
     fail_with_response,
     request_or_exit,
-    require_api_key,
+    require_credential,
 )
 from ..utils.constants import get_api_url
 from ..utils.styling import indent_message, red, yellow
 
 
-def fetch_pipelines():
+def fetch_pipelines(account_id: str | None = account_id_option()):
     """
     Fetch pipelines available to the current Orchestra API key.
 
     The API always includes each pipeline's latest run metadata.
     """
-    api_key = require_api_key()
+    require_credential()
+    client = api_client(account_id)
 
     response = request_or_exit(
-        httpx.get,
+        client.get,
         get_api_url("pipelines"),
-        timeout=30,
-        headers=auth_headers(api_key),
     )
 
     if response.status_code == 200:

{orchestra_cli-0.3.5 → orchestra_cli-0.5.0}/orchestra_cli/src/get_pipeline.py

@@ -3,14 +3,14 @@ import re
 from pathlib import Path
 from typing import cast
 
-import httpx
 import typer
 
 from ..utils.api import (
-    auth_headers,
+    account_id_option,
+    api_client,
     fail_with_response,
     request_or_exit,
-    require_api_key,
+    require_credential,
 )
 from ..utils.constants import get_pipeline_url
 from ..utils.pipeline_selector import (
@@ -46,19 +46,19 @@ def get_pipeline(
     path: Path | None = pipeline_path_option(),
     alias: str | None = pipeline_alias_option(),
     pipeline_id: str | None = pipeline_id_option(),
+    account_id: str | None = account_id_option(),
 ):
     """
     Fetch one pipeline using the shared selector model.
     """
-    api_key = require_api_key()
+    require_credential()
+    client = api_client(account_id)
     selector = resolve_pipeline_selector(alias, pipeline_id, path)
 
     response = request_or_exit(
-        httpx.get,
+        client.get,
         get_pipeline_url(),
         params=selector.to_payload(),
-        timeout=30,
-        headers=auth_headers(api_key),
     )
 
     if response.status_code == 200:

{orchestra_cli-0.3.5 → orchestra_cli-0.5.0}/orchestra_cli/src/import_pipeline.py

@@ -1,14 +1,14 @@
 import json
 from pathlib import Path
 
-import httpx
 import typer
 
 from ..utils.api import (
-    auth_headers,
+    account_id_option,
+    api_client,
     fail_with_response,
     request_or_exit,
-    require_api_key,
+    require_credential,
 )
 from ..utils.constants import get_api_url
 from ..utils.git import (
@@ -39,11 +39,13 @@ def import_pipeline(
         "-w",
         help="Git branch to use for the imported pipeline (defaults to current local branch)",
     ),
+    account_id: str | None = account_id_option(),
 ):
     """
     Create a pipeline in Orchestra by referencing a YAML file in your git repository.
     """
-    api_key = require_api_key()
+    require_credential()
+    client = api_client(account_id)
     if path is None:
         typer.echo(red("Provide --path to import a pipeline from git"))
         raise typer.Exit(code=1)
@@ -98,11 +100,9 @@ def import_pipeline(
         payload["alias"] = alias
 
     response = request_or_exit(
-        httpx.post,
+        client.post,
         get_api_url("pipelines/import"),
         json=payload,
-        timeout=30,
-        headers=auth_headers(api_key),
     )
 
     if response.status_code == 201:

orchestra_cli-0.5.0/orchestra_cli/src/list_accounts.py

@@ -0,0 +1,16 @@
+import json
+
+import typer
+
+from ..utils.accounts import fetch_accounts
+from ..utils.api import api_client
+from ..utils.credentials import load_credentials
+
+
+def list_accounts():
+    """List the Orchestra workspaces the current login or API key covers."""
+    accounts = fetch_accounts(api_client(scoped=False))
+    # Read after fetching, which forgets a dead login whose default no longer applies.
+    default_id = (load_credentials() or {}).get("account_id")
+    accounts = [{**account, "default": account["id"] == default_id} for account in accounts]
+    typer.echo(json.dumps(accounts, indent=2))