@orchard-ai/cli

Public npm installer for the Orchard CLI native binary.

npm install -g @orchard-ai/cli
orchard --help

This package does not contain Orchard CLI source code. The npm tarball contains the prebuilt platform binaries and SHA256SUMS; during postinstall, it selects the current platform's binary, verifies it, and stores it under vendor/.

If a package was published without bundled binaries, postinstall falls back to downloading from a cli/v* GitHub release.

Configuration

• ORCHARD_CLI_RELEASE_REPO: GitHub repo that hosts fallback binary releases. Defaults to Orchard-Development/CLI.
• ORCHARD_CLI_RELEASES_URL: full GitHub-compatible releases API URL override.
• ORCHARD_CLI_RELEASE_TOKEN or GITHUB_TOKEN: optional token for non-public release assets.
• ORCHARD_CLI_SKIP_DOWNLOAD=1: skip download, useful for package inspection.

Source Privacy

The published package is intentionally limited to:

• bin/orchard.js
• scripts/install.js
• scripts/verify-package.js
• vendor/.gitkeep
• package metadata and this README

npm run test and npm pack --dry-run should be run before publishing to verify that no Python source, source maps, repository metadata, or build artifacts are included.

GitHub Actions Publishing

The cli/v* release workflow publishes this package when the GitHub Actions secret NPM_TOKEN is available.

Recommended setup:

1. Create an npm granular automation token with publish access to @orchard-ai/cli.
2. In GitHub, add an organization Actions secret: Orchard-Development -> Settings -> Secrets and variables -> Actions -> New organization secret.
3. Name the secret NPM_TOKEN.
4. Grant repository access to the private CLI repo, or set visibility to all private repositories if Orchard intentionally shares the token across release workflows.

CLI equivalent for an org admin:

gh secret set NPM_TOKEN \
  --org Orchard-Development \
  --app actions \
  --repos CLI

The package is public by design, but the npm tarball contains only this installer wrapper. Orchard CLI source remains private.