orchestra-cli 0.4.0__tar.gz → 0.5.1__tar.gz

{orchestra_cli-0.4.0 → orchestra_cli-0.5.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: orchestra-cli
-Version: 0.4.0
+Version: 0.5.1
 Summary: Orchestra CLI. Perform operations with Orchestra locally.
 Author-email: Orchestra Technologies <support@getorchestra.io>
 Requires-Python: >=3.10
@@ -34,12 +34,13 @@ pipx install orchestra-cli
 
 ## Environment variables
 
-- `ORCHESTRA_API_KEY`: Credential for actions that call the API (`pipeline import`, `pipeline new`, `pipeline update`, `pipeline migrate`, `pipeline get`, `pipeline list`, `pipeline delete`, `pipeline run`, `pipeline build`). Not needed once you have run `orchestra login`: a login takes precedence, and the key is used only when you are not logged in or your login has expired.
+- `ORCHESTRA_API_KEY`: Credential for actions that call the API (`pipeline import`, `pipeline new`, `pipeline update`, `pipeline migrate`, `pipeline get`, `pipeline list`, `pipeline delete`, `pipeline run`, `pipeline build`, `accounts list`). Not needed once you have run `orchestra login`: a login takes precedence, and the key is used only when you are not logged in or your login has expired.
+- `ORCHESTRA_ACCOUNT_ID`: Optional. The workspace to act in when your `orchestra login` covers several. Every `pipeline` and `task` command that calls the API also takes `--account-id`, which wins over the variable, and both win over the default saved by `orchestra accounts use`. API keys belong to one account and don't need it.
 - `BASE_URL`: Optional. Override the default Orchestra host (`https://app.getorchestra.io`) for non‑production/testing.
 
 ## Command structure
 
-Commands follow a `noun verb` shape. The current nouns are `pipeline` and `task`:
+Commands follow a `noun verb` shape. The current nouns are `pipeline`, `task` and `accounts`:
 
 | Command                              | Description                                                                                 |
 | ------------------------------------ | ------------------------------------------------------------------------------------------- |
@@ -55,6 +56,8 @@ Commands follow a `noun verb` shape. The current nouns are `pipeline` and `task`
 | `orchestra pipeline run`             | Start a pipeline run by selector, optionally pinning branch/commit and waiting.             |
 | `orchestra pipeline build`           | Validate local YAML, create or update a draft pipeline, and start that draft version.       |
 | `orchestra task logs`                | Fetch or follow logs for a single task run.                                                 |
+| `orchestra accounts list`            | List the workspaces your login or API key covers, with their ids, as JSON.                  |
+| `orchestra accounts use [id\|name]`   | Save the workspace later commands act in when no `--account-id` is given.                   |
 
 Commands that read a local pipeline file (`pipeline validate`, `import`, `new`, `update`, `build`, and `run --path` with `--task`) accept `.yaml`, `.yml` and `.oml` files; any other extension is rejected. `.oml` files are read as YAML, so only OML written in YAML or JSON syntax is supported. OML block terminators (`.`) and embeds (`%sql ... %%`) fail with an `Invalid YAML` error.
 
@@ -123,6 +126,8 @@ orchestra login
 
 Logins are per host: a login made with `BASE_URL` pointing at another environment is only used against that environment. CI and scripts, where nobody is logged in, keep using `ORCHESTRA_API_KEY`.
 
+After logging in it saves a default workspace, as `accounts use` does: the only one if your login covers one, or the one you pick from a list if it covers several. Esc skips the default, and without a terminal it prints a hint to run `orchestra accounts use` instead. If the accounts can't be listed, the login still succeeds with no default set.
+
 ---
 
 ## pipeline import
@@ -413,6 +418,43 @@ Behavior
 
 ---
 
+## accounts list
+
+List the workspaces the current credential covers. An `orchestra login` token can cover several workspaces; an API key lists just its own.
+
+```bash
+orchestra accounts list
+```
+
+Behavior
+
+- Sends `GET /public/v1/accounts`, with no account header.
+- Prints the `[{id, name}]` response as pretty JSON, adding `default: true` to the account saved by `accounts use` and `false` to the rest.
+- Exit codes: `0` on success, `1` on failure.
+
+---
+
+## accounts use
+
+Save a default workspace for an `orchestra login` that covers several, so commands no longer need `--account-id`.
+
+```bash
+orchestra accounts use 'some great account'
+orchestra accounts use 00000000-0000-0000-0000-000000000000
+orchestra accounts use   # pick from a list
+```
+
+Behavior
+
+- Fetches the accounts as `accounts list` does, then matches an exact id first and a case-insensitive exact name second.
+- Exits `1`, listing the valid names, when nothing matches, and asks for the id when several workspaces share the name.
+- With no argument, lists the workspaces with the cursor on the current default: ↑/↓ moves, Enter saves, and Esc, Ctrl+C or Ctrl+D exits `1` leaving the default unchanged. Without a terminal (CI, piped input) it exits `1` and asks for an id or name instead.
+- Saves the account into the login's entry in `~/.orchestra/credentials.json`. It survives token refreshes; running `orchestra login` again resets it.
+- `--account-id` and `ORCHESTRA_ACCOUNT_ID` still override the default. It is never sent with an API key.
+- Exits `1` when you are using an API key rather than a login, since a key covers one account.
+
+---
+
 ## task logs
 
 Fetch or follow logs for a single task run.

{orchestra_cli-0.4.0 → orchestra_cli-0.5.1}/README.md

@@ -20,12 +20,13 @@ pipx install orchestra-cli
 
 ## Environment variables
 
-- `ORCHESTRA_API_KEY`: Credential for actions that call the API (`pipeline import`, `pipeline new`, `pipeline update`, `pipeline migrate`, `pipeline get`, `pipeline list`, `pipeline delete`, `pipeline run`, `pipeline build`). Not needed once you have run `orchestra login`: a login takes precedence, and the key is used only when you are not logged in or your login has expired.
+- `ORCHESTRA_API_KEY`: Credential for actions that call the API (`pipeline import`, `pipeline new`, `pipeline update`, `pipeline migrate`, `pipeline get`, `pipeline list`, `pipeline delete`, `pipeline run`, `pipeline build`, `accounts list`). Not needed once you have run `orchestra login`: a login takes precedence, and the key is used only when you are not logged in or your login has expired.
+- `ORCHESTRA_ACCOUNT_ID`: Optional. The workspace to act in when your `orchestra login` covers several. Every `pipeline` and `task` command that calls the API also takes `--account-id`, which wins over the variable, and both win over the default saved by `orchestra accounts use`. API keys belong to one account and don't need it.
 - `BASE_URL`: Optional. Override the default Orchestra host (`https://app.getorchestra.io`) for non‑production/testing.
 
 ## Command structure
 
-Commands follow a `noun verb` shape. The current nouns are `pipeline` and `task`:
+Commands follow a `noun verb` shape. The current nouns are `pipeline`, `task` and `accounts`:
 
 | Command                              | Description                                                                                 |
 | ------------------------------------ | ------------------------------------------------------------------------------------------- |
@@ -41,6 +42,8 @@ Commands follow a `noun verb` shape. The current nouns are `pipeline` and `task`
 | `orchestra pipeline run`             | Start a pipeline run by selector, optionally pinning branch/commit and waiting.             |
 | `orchestra pipeline build`           | Validate local YAML, create or update a draft pipeline, and start that draft version.       |
 | `orchestra task logs`                | Fetch or follow logs for a single task run.                                                 |
+| `orchestra accounts list`            | List the workspaces your login or API key covers, with their ids, as JSON.                  |
+| `orchestra accounts use [id\|name]`   | Save the workspace later commands act in when no `--account-id` is given.                   |
 
 Commands that read a local pipeline file (`pipeline validate`, `import`, `new`, `update`, `build`, and `run --path` with `--task`) accept `.yaml`, `.yml` and `.oml` files; any other extension is rejected. `.oml` files are read as YAML, so only OML written in YAML or JSON syntax is supported. OML block terminators (`.`) and embeds (`%sql ... %%`) fail with an `Invalid YAML` error.
 
@@ -109,6 +112,8 @@ orchestra login
 
 Logins are per host: a login made with `BASE_URL` pointing at another environment is only used against that environment. CI and scripts, where nobody is logged in, keep using `ORCHESTRA_API_KEY`.
 
+After logging in it saves a default workspace, as `accounts use` does: the only one if your login covers one, or the one you pick from a list if it covers several. Esc skips the default, and without a terminal it prints a hint to run `orchestra accounts use` instead. If the accounts can't be listed, the login still succeeds with no default set.
+
 ---
 
 ## pipeline import
@@ -399,6 +404,43 @@ Behavior
 
 ---
 
+## accounts list
+
+List the workspaces the current credential covers. An `orchestra login` token can cover several workspaces; an API key lists just its own.
+
+```bash
+orchestra accounts list
+```
+
+Behavior
+
+- Sends `GET /public/v1/accounts`, with no account header.
+- Prints the `[{id, name}]` response as pretty JSON, adding `default: true` to the account saved by `accounts use` and `false` to the rest.
+- Exit codes: `0` on success, `1` on failure.
+
+---
+
+## accounts use
+
+Save a default workspace for an `orchestra login` that covers several, so commands no longer need `--account-id`.
+
+```bash
+orchestra accounts use 'some great account'
+orchestra accounts use 00000000-0000-0000-0000-000000000000
+orchestra accounts use   # pick from a list
+```
+
+Behavior
+
+- Fetches the accounts as `accounts list` does, then matches an exact id first and a case-insensitive exact name second.
+- Exits `1`, listing the valid names, when nothing matches, and asks for the id when several workspaces share the name.
+- With no argument, lists the workspaces with the cursor on the current default: ↑/↓ moves, Enter saves, and Esc, Ctrl+C or Ctrl+D exits `1` leaving the default unchanged. Without a terminal (CI, piped input) it exits `1` and asks for an id or name instead.
+- Saves the account into the login's entry in `~/.orchestra/credentials.json`. It survives token refreshes; running `orchestra login` again resets it.
+- `--account-id` and `ORCHESTRA_ACCOUNT_ID` still override the default. It is never sent with an API key.
+- Exits `1` when you are using an API key rather than a login, since a key covers one account.
+
+---
+
 ## task logs
 
 Fetch or follow logs for a single task run.

{orchestra_cli-0.4.0 → orchestra_cli-0.5.1}/orchestra_cli/src/build_pipeline.py

@@ -3,7 +3,13 @@ from pathlib import Path
 import httpx
 import typer
 
-from ..utils.api import auth_headers, fail_with_response, request_or_exit, require_credential
+from ..utils.api import (
+    account_id_option,
+    api_client,
+    fail_with_response,
+    request_or_exit,
+    require_credential,
+)
 from ..utils.constants import get_create_pipeline_url, get_update_pipeline_url
 from ..utils.git import confirm_git_warnings_or_exit, prepare_git_backed_run_target
 from ..utils.pipeline_lookup import lookup_existing_pipeline
@@ -64,6 +70,7 @@ def _build_create_selector(
 
 
 def _create_draft_pipeline(
+    client: httpx.Client,
     path: Path,
     lookup_selector: PipelineSelector,
     pipeline_data: dict[str, object],
@@ -74,11 +81,9 @@ def _create_draft_pipeline(
 
     typer.echo(f"Creating draft pipeline ({create_selector.display()})")
     create_response = request_or_exit(
-        httpx.post,
+        client.post,
         get_create_pipeline_url(),
         json=payload,
-        timeout=30,
-        headers=auth_headers(),
     )
 
     if create_response.status_code == 201:
@@ -95,6 +100,7 @@ def _create_draft_pipeline(
 
 
 def _update_draft_pipeline(
+    client: httpx.Client,
     existing_pipeline: dict[str, object],
     pipeline_data: dict[str, object],
 ) -> tuple[PipelineSelector, int]:
@@ -103,11 +109,9 @@ def _update_draft_pipeline(
 
     typer.echo(f"Updating draft pipeline ({update_selector.display()})")
     update_response = request_or_exit(
-        httpx.put,
+        client.put,
         get_update_pipeline_url(),
         json=payload,
-        timeout=30,
-        headers=auth_headers(),
     )
 
     if update_response.status_code == 200:
@@ -139,11 +143,13 @@ def build_pipeline(
         "--force/--no-force",
         help="Ignore any warnings and run the pipeline anyway",
     ),
+    account_id: str | None = account_id_option(),
 ) -> None:
     """
     Validate local YAML, create or update a draft pipeline, and start the draft version.
     """
     require_credential()
+    client = api_client(account_id)
     if path is None:
         typer.echo(
             red("A pipeline YAML file path is required (use -p or --path with your YAML file)"),
@@ -153,16 +159,18 @@ def build_pipeline(
 
     confirm_git_warnings_or_exit(force, path)
     pipeline_data = load_validated_pipeline_data(path)
-    existing_pipeline = lookup_existing_pipeline(lookup_selector, "Build", allow_404=True)
+    existing_pipeline = lookup_existing_pipeline(client, lookup_selector, "Build", allow_404=True)
 
     if existing_pipeline is None:
         run_selector, version_number = _create_draft_pipeline(
+            client=client,
             path=path,
             lookup_selector=lookup_selector,
             pipeline_data=pipeline_data,
             force=force,
         )
         start_pipeline_run(
+            client=client,
             selector=run_selector,
             payload=build_run_payload(
                 branch=branch,
@@ -177,11 +185,13 @@ def build_pipeline(
     pipeline_storage_provider = storage_provider(existing_pipeline)
     if pipeline_storage_provider is None or pipeline_storage_provider == "ORCHESTRA":
         run_selector, version_number = _update_draft_pipeline(
+            client=client,
             existing_pipeline=existing_pipeline,
             pipeline_data=pipeline_data,
         )
 
         start_pipeline_run(
+            client=client,
             selector=run_selector,
             payload=build_run_payload(
                 branch=branch,
@@ -215,6 +225,7 @@ def build_pipeline(
     )
 
     start_pipeline_run(
+        client=client,
         selector=run_selector,
         payload=build_run_payload(
             branch=git_branch,

{orchestra_cli-0.4.0 → orchestra_cli-0.5.1}/orchestra_cli/src/cli.py

@@ -6,11 +6,13 @@ from .delete_pipeline import delete_pipeline
 from .fetch_pipelines import fetch_pipelines
 from .get_pipeline import get_pipeline
 from .import_pipeline import import_pipeline
+from .list_accounts import list_accounts
 from .login import login
 from .migrate_pipeline import migrate_pipeline
 from .run_pipeline import run_pipeline
 from .task_logs import task_logs
 from .update_pipeline import update_pipeline
+from .use_account import use_account
 from .validate_pipeline import validate
 
 app = typer.Typer(help="Orchestra CLI – perform operations with Orchestra locally.")
@@ -20,6 +22,8 @@ app.add_typer(pipeline_app, name="pipeline")
 task_app = typer.Typer(help="Inspect Orchestra task runs.")
 app.add_typer(task_app, name="task")
 app.command(name="login")(login)
+accounts_app = typer.Typer(help="List and choose the workspaces your credential covers.")
+app.add_typer(accounts_app, name="accounts")
 
 pipeline_app.command(name="validate")(validate)
 pipeline_app.command(name="import")(import_pipeline)
@@ -32,6 +36,8 @@ pipeline_app.command(name="build")(build_pipeline)
 pipeline_app.command(name="delete")(delete_pipeline)
 pipeline_app.command(name="migrate")(migrate_pipeline)
 task_app.command(name="logs")(task_logs)
+accounts_app.command(name="list")(list_accounts)
+accounts_app.command(name="use")(use_account)
 
 # Legacy top-level aliases (hidden) - keep the old `orchestra <command>` syntax working
 # so existing scripts and CI pipelines do not break. Hidden from `--help` to keep the

{orchestra_cli-0.4.0 → orchestra_cli-0.5.1}/orchestra_cli/src/create_pipeline.py

@@ -1,10 +1,10 @@
 from pathlib import Path
 
-import httpx
 import typer
 
 from ..utils.api import (
-    auth_headers,
+    account_id_option,
+    api_client,
     fail_with_response,
     request_or_exit,
     require_credential,
@@ -32,11 +32,13 @@ def create_pipeline(
         "--publish/--no-publish",
         help="Whether the pipeline is published and can be triggered",
     ),
+    account_id: str | None = account_id_option(),
 ):
     """
     Create an Orchestra-backed pipeline from a local YAML file.
     """
     require_credential()
+    client = api_client(account_id)
     if path is None:
         typer.echo(red("Provide --path to create a pipeline from YAML"))
         raise typer.Exit(code=1)
@@ -50,11 +52,9 @@ def create_pipeline(
     payload = build_upsert_payload(data, publish, selector)
 
     response = request_or_exit(
-        httpx.post,
+        client.post,
         get_create_pipeline_url(),
         json=payload,
-        timeout=30,
-        headers=auth_headers(),
     )
 
     if response.status_code == 201:

{orchestra_cli-0.4.0 → orchestra_cli-0.5.1}/orchestra_cli/src/delete_pipeline.py

@@ -1,10 +1,10 @@
 from pathlib import Path
 
-import httpx
 import typer
 
 from ..utils.api import (
-    auth_headers,
+    account_id_option,
+    api_client,
     fail_with_response,
     request_or_exit,
     require_credential,
@@ -23,11 +23,13 @@ def delete_pipeline(
     path: Path | None = pipeline_path_option(),
     alias: str | None = pipeline_alias_option(),
     pipeline_id: str | None = pipeline_id_option(),
+    account_id: str | None = account_id_option(),
 ):
     """
     Delete a pipeline by selector.
     """
     require_credential()
+    client = api_client(account_id)
     selector = resolve_pipeline_selector(alias, pipeline_id, path)
 
     if not typer.confirm(f"Delete pipeline ({selector.display()})?"):
@@ -35,11 +37,9 @@ def delete_pipeline(
         raise typer.Exit(code=1)
 
     response = request_or_exit(
-        httpx.delete,
+        client.delete,
         get_delete_pipeline_url(),
         params=selector.to_payload(),
-        timeout=30,
-        headers=auth_headers(),
     )
 
     if response.status_code == 204:

{orchestra_cli-0.4.0 → orchestra_cli-0.5.1}/orchestra_cli/src/fetch_pipelines.py

@@ -1,10 +1,10 @@
 import json
 
-import httpx
 import typer
 
 from ..utils.api import (
-    auth_headers,
+    account_id_option,
+    api_client,
     fail_with_response,
     request_or_exit,
     require_credential,
@@ -13,19 +13,18 @@ from ..utils.constants import get_api_url
 from ..utils.styling import indent_message, red, yellow
 
 
-def fetch_pipelines():
+def fetch_pipelines(account_id: str | None = account_id_option()):
     """
     Fetch pipelines available to the current Orchestra API key.
 
     The API always includes each pipeline's latest run metadata.
     """
     require_credential()
+    client = api_client(account_id)
 
     response = request_or_exit(
-        httpx.get,
+        client.get,
         get_api_url("pipelines"),
-        timeout=30,
-        headers=auth_headers(),
     )
 
     if response.status_code == 200:

{orchestra_cli-0.4.0 → orchestra_cli-0.5.1}/orchestra_cli/src/get_pipeline.py

@@ -3,11 +3,11 @@ import re
 from pathlib import Path
 from typing import cast
 
-import httpx
 import typer
 
 from ..utils.api import (
-    auth_headers,
+    account_id_option,
+    api_client,
     fail_with_response,
     request_or_exit,
     require_credential,
@@ -46,19 +46,19 @@ def get_pipeline(
     path: Path | None = pipeline_path_option(),
     alias: str | None = pipeline_alias_option(),
     pipeline_id: str | None = pipeline_id_option(),
+    account_id: str | None = account_id_option(),
 ):
     """
     Fetch one pipeline using the shared selector model.
     """
     require_credential()
+    client = api_client(account_id)
     selector = resolve_pipeline_selector(alias, pipeline_id, path)
 
     response = request_or_exit(
-        httpx.get,
+        client.get,
         get_pipeline_url(),
         params=selector.to_payload(),
-        timeout=30,
-        headers=auth_headers(),
     )
 
     if response.status_code == 200:

{orchestra_cli-0.4.0 → orchestra_cli-0.5.1}/orchestra_cli/src/import_pipeline.py

@@ -1,11 +1,11 @@
 import json
 from pathlib import Path
 
-import httpx
 import typer
 
 from ..utils.api import (
-    auth_headers,
+    account_id_option,
+    api_client,
     fail_with_response,
     request_or_exit,
     require_credential,
@@ -39,11 +39,13 @@ def import_pipeline(
         "-w",
         help="Git branch to use for the imported pipeline (defaults to current local branch)",
     ),
+    account_id: str | None = account_id_option(),
 ):
     """
     Create a pipeline in Orchestra by referencing a YAML file in your git repository.
     """
     require_credential()
+    client = api_client(account_id)
     if path is None:
         typer.echo(red("Provide --path to import a pipeline from git"))
         raise typer.Exit(code=1)
@@ -98,11 +100,9 @@ def import_pipeline(
         payload["alias"] = alias
 
     response = request_or_exit(
-        httpx.post,
+        client.post,
         get_api_url("pipelines/import"),
         json=payload,
-        timeout=30,
-        headers=auth_headers(),
     )
 
     if response.status_code == 201:

orchestra_cli-0.5.1/orchestra_cli/src/list_accounts.py

@@ -0,0 +1,16 @@
+import json
+
+import typer
+
+from ..utils.accounts import fetch_accounts
+from ..utils.api import api_client
+from ..utils.credentials import load_credentials
+
+
+def list_accounts():
+    """List the Orchestra workspaces the current login or API key covers."""
+    accounts = fetch_accounts(api_client(scoped=False))
+    # Read after fetching, which forgets a dead login whose default no longer applies.
+    default_id = (load_credentials() or {}).get("account_id")
+    accounts = [{**account, "default": account["id"] == default_id} for account in accounts]
+    typer.echo(json.dumps(accounts, indent=2))

{orchestra_cli-0.4.0 → orchestra_cli-0.5.1}/orchestra_cli/src/login.py

@@ -10,9 +10,16 @@ from urllib.parse import parse_qs, urlencode, urlparse
 import httpx
 import typer
 
-from ..utils.api import fail_with_response, request_or_exit, token_response_to_credentials
+from ..utils.accounts import fetch_accounts, pick_account
+from ..utils.api import (
+    api_client,
+    fail_with_response,
+    request_or_exit,
+    token_response_to_credentials,
+)
 from ..utils.constants import get_base_url
-from ..utils.credentials import save_credentials
+from ..utils.credentials import load_credentials, save_credentials
+from ..utils.picker import can_pick
 from ..utils.styling import green, red, yellow
 
 SCOPES = "orchestra:read orchestra:write offline_access"
@@ -159,4 +166,43 @@ def login():
             {"client_id": client_id, "token_endpoint": metadata["token_endpoint"]},
         ),
     )
-    typer.echo(green(f"✅ Logged in to {base_url}"))
+    _choose_default_account(f"✅ Logged in to {base_url}")
+
+
+def _choose_default_account(logged_in: str) -> None:
+    """Save the workspace later commands act in, so a multi-account login works from the start.
+
+    The login is already saved, so nothing here can fail it.
+    """
+    try:
+        accounts = fetch_accounts(api_client(scoped=False))
+    except typer.Exit:
+        typer.echo(green(logged_in))
+        typer.echo(yellow("Could not list your accounts, so no default account is set."))
+        return
+    if len(accounts) == 1:
+        _save_default_account(accounts[0])
+        typer.echo(green(f"{logged_in} ({accounts[0]['name']})"))
+        return
+    typer.echo(green(logged_in))
+    if not accounts:
+        return
+    if not can_pick():
+        typer.echo(yellow("Your login covers several accounts; run `orchestra accounts use`."))
+        return
+    typer.echo("Pick a default account:")
+    account = pick_account(accounts)
+    if account is None:
+        typer.echo(yellow("No default account set; run `orchestra accounts use` to pick one."))
+        return
+    _save_default_account(account)
+    typer.echo(green(f"Default account: {account['name']}"))
+
+
+def _save_default_account(account: dict) -> None:
+    # Read again after fetching, which may have refreshed and rotated the saved tokens.
+    credentials = load_credentials()
+    if credentials is not None:
+        save_credentials(
+            {**credentials, "account_id": account["id"], "account_name": account["name"]},
+        )

{orchestra_cli-0.4.0 → orchestra_cli-0.5.1}/orchestra_cli/src/migrate_pipeline.py

@@ -5,7 +5,13 @@ from typing import Any
 import httpx
 import typer
 
-from ..utils.api import auth_headers, fail_with_response, request_or_exit, require_credential
+from ..utils.api import (
+    account_id_option,
+    api_client,
+    fail_with_response,
+    request_or_exit,
+    require_credential,
+)
 from ..utils.constants import get_api_url
 from ..utils.git import (
     GitAction,
@@ -121,17 +127,19 @@ def _choose_migration_version(existing_pipeline: dict[str, object], force: bool)
     raise typer.Exit(code=1)
 
 
-def _download_pipeline_yaml(selector: PipelineSelector, version: int | None) -> str:
+def _download_pipeline_yaml(
+    client: httpx.Client,
+    selector: PipelineSelector,
+    version: int | None,
+) -> str:
     params = selector.to_payload()
     if version is not None:
         params["version"] = str(version)
 
     response = request_or_exit(
-        httpx.get,
+        client.get,
         get_api_url("pipeline/data"),
         params=params,
-        timeout=30,
-        headers=auth_headers(),
     )
     if response.status_code != 200:
         raise fail_with_response("Migrate", response)
@@ -340,11 +348,13 @@ def migrate_pipeline(
         "--force/--no-force",
         help="Skip interactive prompts and continue with inferred migration choices",
     ),
+    account_id: str | None = account_id_option(),
 ) -> None:
     """
     Migrate an Orchestra-backed pipeline to git-backed storage.
     """
     require_credential()
+    client = api_client(account_id)
     selector = _resolve_migrate_selector(alias, pipeline_id)
 
     repo_root = require_repo_root(path, GitAction.MIGRATE)
@@ -370,7 +380,7 @@ def migrate_pipeline(
         typer.echo(red("Could not detect current branch from git"))
         raise typer.Exit(code=1)
 
-    existing_pipeline = lookup_existing_pipeline(selector, "Migrate")
+    existing_pipeline = lookup_existing_pipeline(client, selector, "Migrate")
     if existing_pipeline is None:
         typer.echo(red("❌ Migrate failed: pipeline lookup returned no pipeline"))
         raise typer.Exit(code=1)
@@ -382,7 +392,7 @@ def migrate_pipeline(
         raise typer.Exit(code=1)
 
     target_version = _choose_migration_version(existing_pipeline, force)
-    downloaded_yaml = _download_pipeline_yaml(selector, target_version)
+    downloaded_yaml = _download_pipeline_yaml(client, selector, target_version)
     target_path, selected_yaml = _resolve_target_path_and_yaml(path, downloaded_yaml, force)
     relative_path = ensure_repo_relative_path(target_path, repo_root, GitAction.MIGRATE)
     _write_yaml(target_path, selected_yaml)
@@ -406,12 +416,10 @@ def migrate_pipeline(
         payload["working_branch"] = effective_working_branch
 
     response = request_or_exit(
-        httpx.patch,
+        client.patch,
         get_api_url("pipelines/storage-settings"),
         params=selector.to_payload(),
         json=payload,
-        timeout=30,
-        headers=auth_headers(),
     )
     if not (200 <= response.status_code < 300):
         raise fail_with_response("Migrate", response)