refactor: rename Aidbox creds to AIDBOX_CLIENT_ID / AIDBOX_CLIENT_SECRET

.env.example

@@ -15,8 +15,11 @@ INTERBOX_LICENSE=
 # value so Aidbox starts in activation mode instead of crashing. Or paste a free
 # dev license JWT from the Aidbox portal here to skip the in-dashboard step.
 AIDBOX_LICENSE=
-# Shared secret for the root client (any value; keep it consistent).
-AIDBOX_SECRET=secret
+# The Aidbox Client interbox authenticates as. CLIENT_ID is optional — the sender
+# defaults to `root`; set a scoped client for least privilege. SECRET must match the
+# Client's secret in Aidbox (BOX_ROOT_CLIENT_SECRET for the default root client).
+# AIDBOX_CLIENT_ID=root
+AIDBOX_CLIENT_SECRET=secret
 
 # ── Dashboard assistant (Claude Code over ACP) ───────────────────────────────
 # Optional — leave blank and the dashboard still works, the assistant just can't

docker-compose.yaml

@@ -74,7 +74,9 @@ services:
       INTERBOX_WORKSPACE_POLL_MS: "2000" # snappy hot reload in dev
       # Pipeline sender target.
       AIDBOX_URL: http://aidbox:8080
-      AIDBOX_SECRET: ${AIDBOX_SECRET:-secret}
+      # Client interbox authenticates as — id defaults to root; set a scoped one for least privilege.
+      AIDBOX_CLIENT_ID: ${AIDBOX_CLIENT_ID:-root}
+      AIDBOX_CLIENT_SECRET: ${AIDBOX_CLIENT_SECRET:-secret}
       # License: env activation (or use the dashboard's activation screen instead).
       INTERBOX_LICENSE: ${INTERBOX_LICENSE:-}
       # Dashboard assistant (Claude Code over ACP) auth — pick ONE (all blank = the
@@ -123,7 +125,7 @@ services:
     environment:
       AIDBOX_LICENSE: ${AIDBOX_LICENSE}
       BOX_ADMIN_PASSWORD: admin
-      BOX_ROOT_CLIENT_SECRET: ${AIDBOX_SECRET:-secret}
+      BOX_ROOT_CLIENT_SECRET: ${AIDBOX_CLIENT_SECRET:-secret}
       BOX_BOOTSTRAP_FHIR_PACKAGES: hl7.fhir.r4.core#4.0.1
       BOX_FHIR_SCHEMA_VALIDATION: "true"
       BOX_FHIR_COMPLIANT_MODE: "true"

src/pipelines/hl7-to-aidbox/index.ts

@@ -20,6 +20,6 @@ pipeline("hl7-to-aidbox")
   .sender(
     aidboxSender({
       url: env("AIDBOX_URL"),
-      auth: { kind: "basic", user: "root", password: env("AIDBOX_SECRET") },
+      auth: { kind: "basic", user: env("AIDBOX_CLIENT_ID", "root"), password: env("AIDBOX_CLIENT_SECRET") },
     }),
   );