@orchestraworks/cli 0.5.4 → 0.5.7

package/README.md

@@ -20,7 +20,7 @@ The full guide to every construct, secrets, connections and troubleshooting is [
 ```bash
 npm install -g @orchestraworks/cli         # the CLI, on your path as `orchestra`
 npm install @orchestraworks/cli            # the current release
-npm install @orchestraworks/cli@0.5.4      # this exact release
+npm install @orchestraworks/cli@0.5.7      # this exact release
 ```
 
 Then `import { Factory, Agent, … } from "@orchestraworks/cli"` normally — the package `exports` entry resolves

package/dist/artifacts/prelude.js

@@ -260,8 +260,17 @@
   }
 
   function onKeyDown(event) {
-    if (event.key === "Escape" && commentMode) {
+    if (event.key !== "Escape") {
+      return;
+    }
+    if (commentMode) {
       setCommentMode(false);
+      return;
+    }
+    // A key pressed in this frame never reaches the console's document, so an Escape the page left
+    // unused is passed on: it is how a reader leaves the console's full-screen layer from inside a page.
+    if (!event.defaultPrevented) {
+      window.parent.postMessage({ sf: 1, event: "escape" }, consoleOrigin);
     }
   }
 

package/dist/cli/api/execute.js

@@ -327,8 +327,8 @@ async function storeDeclaredFile(row, invocation, body, apis, target, deps, io)
         fetchApi: (deps.fetchApi ?? fetch),
         io,
         organizationId: target.organizationId,
-        projectId: stringField(body, "projectId") ??
-            (await ownerProject(row, invocation, apis, target.organizationId)),
+        teamId: stringField(body, "teamId") ??
+            (await ownerTeam(row, invocation, apis, target.organizationId)),
         // The one create describes one file: what it says about the name and the type governs both calls, so
         // the upload cannot land as something the create did not ask for.
         filename: stringField(body, "filename"),
@@ -359,13 +359,13 @@ async function readStoredFile(row, invocation, apis, target, fileId) {
 }
 /**
  * Where a create that publishes UNDER an item puts its file: with that item. `artifacts create-version` has
- * no project field of its own, so without this the upload is declared in the organization commons — which a
- * `files:createFile` grant conditioned to the artifact's project refuses, and an unconditioned one accepts
- * into the wrong place for good, since a file's project is fixed when it is declared.
+ * no team field of its own, so without this the upload is declared in Shared — which a `files:createFile`
+ * grant at the artifact's team refuses, and a wider one accepts into the wrong place for good, since a
+ * file's team is fixed when it is declared.
  *
  * A failure is raised rather than swallowed: a placement that cannot be read must not be guessed.
  */
-async function ownerProject(row, invocation, apis, organizationId) {
+async function ownerTeam(row, invocation, apis, organizationId) {
     const owner = findCommand(row.noun, "get");
     if (owner === undefined || !sameItemPath(owner, row)) {
         return undefined;
@@ -379,7 +379,7 @@ async function ownerProject(row, invocation, apis, organizationId) {
     if (typeof read !== "object" || read === null || Array.isArray(read)) {
         return undefined;
     }
-    return stringField(read, "projectId");
+    return stringField(read, "teamId");
 }
 function stringField(body, field) {
     const value = body[field];

package/dist/cli/core/profile.d.ts

@@ -15,9 +15,9 @@ export interface Profile {
     /**
      * The remaining three are the first-run interview's answers, kept beside the credential because they are
      * answers about this machine that nothing should ask twice. Absent means the question was never answered;
-     * an absent `projectId` in particular is an answer of its own — the organization's shared commons.
+     * an absent `teamId` in particular is an answer of its own: Shared.
      */
-    projectId?: string;
+    teamId?: string;
     role?: string;
     harnesses?: string[];
 }

package/dist/cli/factory/apply-preview.d.ts

@@ -1,10 +1,11 @@
 import type { PlanImport, PlanResource, SynthResult } from "../../core/plan.js";
-import { type DesiredProject } from "../../engine/apply-core.js";
+import { type TeamResolver } from "../../engine/apply-core.js";
 import type { PlatformApis } from "../../engine/client.js";
 import { type DiffEntry, type DiffReadCache } from "../../engine/diff.js";
 import { type makeTriggersApi, type TriggerAction, type TriggerReconcileOutcome } from "../../engine/trigger-reconcile.js";
 import { type WorkflowAction, type WorkflowReconcileOutcome } from "../../engine/workflow-reconcile.js";
 import { type ImageBuildSpec } from "./docker.js";
+import { type HostedImages } from "./image-upload.js";
 /**
  * Taken off the module-level factory rather than restated: the preview needs the RAW adapter, because the
  * generated typed converter truncates the free-form `where`/`binding` subtrees, and a restated signature
@@ -38,9 +39,21 @@ export interface ApplyPreview {
     blockedImports: BlockedImport[];
     /** The image builds this run would perform (empty under `--no-docker-build`). */
     pendingImageBuilds: ImageBuildSpec[];
+    /**
+     * The builds among {@link pendingImageBuilds} that upload to the platform rather than push, each with the
+     * digest of its newest `READY` image. The new digest exists only after the build, so it is not shown.
+     */
+    hostedUploads?: HostedUpload[];
     /** True iff anything non-no-op and non-blocked would happen, or an image would be built. */
     firing: boolean;
 }
+export interface HostedUpload {
+    tag: string;
+    name: string;
+    dockerfile: string;
+    /** Absent when the platform holds no `READY` image of this name yet. */
+    readyDigest?: string;
+}
 /** What the workflow + trigger previews need — the half `orchestra fdk diff` shares with apply's pre-flight. */
 export interface PreviewCompositionOptions {
     /**
@@ -48,11 +61,14 @@ export interface PreviewCompositionOptions {
      * inputs rather than one of them reading `process.env` behind the other's back.
      */
     env: Record<string, string | undefined>;
-    /** The factory's project placement, resolved ONCE by the caller and shared with reconcile's classifiers. */
-    project: DesiredProject;
+    /**
+     * Each row's team, resolved over one set of team reads the caller shares with its other preview passes;
+     * absent, the preview builds its own.
+     */
+    teams?: TeamResolver;
     makeTriggersApi: MakeTriggersApi;
     /**
-     * Supplying the SAME cache the plan-resource pass uses is what stops the managed agent and project rows
+     * Supplying the SAME cache the plan-resource pass uses is what stops the managed agent and team rows
      * being GET twice per command.
      */
     reads: DiffReadCache;
@@ -63,6 +79,8 @@ export interface ApplyPreviewOptions extends Omit<PreviewCompositionOptions, "re
     dockerBuild: boolean;
     /** Optional: apply's pre-flight passes none and gets a fresh per-run memo (see {@link DiffReadCache}). */
     reads?: DiffReadCache;
+    /** Absent when the plan declares no hosted image; apply reads it once and shares it with the build phase. */
+    hostedImages?: HostedImages;
 }
 /**
  * Reads only — no POST, no PATCH, no docker. Unresolvable reachable imports short-circuit everything else:
@@ -96,8 +114,7 @@ export declare function isFiringAction(outcome: {
  * Two lanes, because a reference reaches this pass two ways. The VERBATIM connection slots are walked
  * unconditionally — they name a connection directly, so whether the plan registers an import for that slug
  * is beside the point, and the bare spelling registers none. Everything else is demand-driven from
- * `plan.imports`, mirroring apply's own lazy resolution, with the build-carrying image and the factory
- * project as inherent roots. The exemption that falls out is the one wanted: a handle the author registered
+ * `plan.imports`, mirroring apply's own lazy resolution, with the build-carrying image as an inherent root. The exemption that falls out is the one wanted: a handle the author registered
  * and then referenced from nothing must not abort a valid apply.
  */
 export declare function blockedImportsOf(synth: SynthResult, apis: PlatformApis, env: Record<string, string | undefined>): Promise<BlockedImport[]>;

package/dist/cli/factory/apply-preview.js

@@ -33,19 +33,22 @@ import { gatewayKeyRefOf } from "../../core/gateway-key-recipe.js";
 import { refToken } from "../../core/tokens.js";
 import { getBySlugOrUndefined } from "../../engine/apply-core.js";
 import { connectionIdResolver, connectionSlots, managedConnectionTokens, unmanagedConnectionSlotRefs, } from "../../engine/connection-slots.js";
-import { createDiffReadCache, diffResources } from "../../engine/diff.js";
+import { createDiffReadCache, diffResources, previewTeamResolver, } from "../../engine/diff.js";
 import { PreflightRefusalError, resolveSecretRef } from "../../engine/preflight.js";
 import { ConnectionResolutionContext, resolveReferenceId } from "../../engine/reconcile.js";
 import { declaredPipelinesOf } from "../../engine/pipeline-reconcile.js";
 import { pipelineResolver, reconcileTriggers, } from "../../engine/trigger-reconcile.js";
 import { reconcileWorkflows, workflowResolvers, } from "../../engine/workflow-reconcile.js";
 import { imageBuildSpecs } from "./docker.js";
+import { hostedImageName } from "../../constructs/references.js";
+import { hostedSpecs } from "./image-upload.js";
 /**
  * Reads only — no POST, no PATCH, no docker. Unresolvable reachable imports short-circuit everything else:
  * apply aborts on them, so spending the three preview phases' reads first would be discarded work.
  */
 export async function buildApplyPreview(synth, apis, opts) {
     const pendingImageBuilds = opts.dockerBuild ? imageBuildSpecs(synth.plan) : [];
+    const hostedUploads = hostedUploadsOf(pendingImageBuilds, opts.hostedImages);
     const blockedImports = await blockedImportsOf(synth, apis, opts.env);
     if (blockedImports.length > 0) {
         return {
@@ -57,17 +60,19 @@ export async function buildApplyPreview(synth, apis, opts) {
             firingTriggers: [],
             blockedImports,
             pendingImageBuilds,
+            ...hostedUploads,
             firing: false,
         };
     }
     const reads = opts.reads ?? createDiffReadCache(apis);
+    const teams = opts.teams ?? (await previewTeamResolver(synth.plan, apis));
     const rows = await diffResources(synth.plan, apis, {
         env: opts.env,
-        project: opts.project,
+        teams,
         reads,
         triggers: synth.triggers ?? [],
     });
-    const { workflowActions, triggerActions } = await composePreviews(synth, apis, { ...opts, reads });
+    const { workflowActions, triggerActions } = await composePreviews(synth, apis, { ...opts, reads, teams });
     const blockedOwners = await blockedReferenceOwnersOf(synth, blockedImports, rows);
     const blockedResourceKeys = new Set([...blockedOwners.resources].map((owner) => `${owner.kind}\u0000${owner.slug}`));
     const firingRows = rows.filter((row) => isFiringRow(row) && !blockedResourceKeys.has(`${row.kind}\u0000${row.slug}`));
@@ -82,9 +87,26 @@ export async function buildApplyPreview(synth, apis, opts) {
         firingTriggers,
         blockedImports,
         pendingImageBuilds,
+        ...hostedUploads,
         firing: firingRows.length + firingWorkflows.length + firingTriggers.length + pendingImageBuilds.length > 0,
     };
 }
+function hostedUploadsOf(builds, hosted) {
+    if (hosted === undefined || !hosted.available)
+        return {};
+    return {
+        hostedUploads: hostedSpecs(builds).map((spec) => {
+            const name = hostedImageName(spec.ref);
+            const ready = hosted.newestReady.get(name);
+            return {
+                tag: spec.ref,
+                name,
+                dockerfile: spec.dockerfile,
+                ...(ready !== undefined ? { readyDigest: ready.digest } : {}),
+            };
+        }),
+    };
+}
 /**
  * Composed once for BOTH commands, which are contractually required to agree: the pre-flight's whole claim
  * is that it shows what `orchestra fdk diff` shows, and two copies of a preview is two answers to that question
@@ -92,9 +114,10 @@ export async function buildApplyPreview(synth, apis, opts) {
  */
 export async function composePreviews(synth, apis, opts) {
     const liveRefs = await liveRefMap(synth, opts.reads);
+    const teams = opts.teams ?? (await previewTeamResolver(synth.plan, apis));
     return {
         workflowActions: await previewWorkflows(synth, apis, opts, liveRefs),
-        triggerActions: await previewTriggers(synth, apis, opts, liveRefs),
+        triggerActions: await previewTriggers(synth, apis, { ...opts, teams }, liveRefs),
     };
 }
 /** An EXECUTABLE pending write: not a no-op, and not something reconcile refuses. */
@@ -136,10 +159,17 @@ async function previewTriggers(synth, apis, opts, liveRefs) {
     const api = opts.makeTriggersApi(apis.target);
     // Preview-local, like the pre-flight's own: a handoff a preview collects is never printed.
     const connections = new ConnectionResolutionContext(apis, synth.plan.imports, liveRefs, opts.env);
-    return reconcileTriggers(api, docs, async (ref) => resolveReferenceId(ref, "agent", liveRefs, apis), opts.project.state === "resolved" ? opts.project.projectId : undefined, [], {
+    return reconcileTriggers(api, docs, async (ref) => resolveReferenceId(ref, "agent", liveRefs, apis), async (raw, live) => {
+        const teams = opts.teams;
+        if (teams === undefined)
+            return undefined;
+        const surface = { kind: "team", slug: raw ?? "shared", op: "get" };
+        return teams
+            .desired(raw, surface, [])
+            .then((team) => teams.judged(team, live, surface, []))
+            .catch(() => undefined);
+    }, [], {
         dryRun: true,
-        projectPending: opts.project.state === "pending-managed",
-        projectRef: managedProjectSlug(synth.plan),
         resolveConnectionId: connectionIdResolver(managedConnectionTokens(synth.plan), connections),
         resolvePipeline: pipelineResolver(apis, declaredPipelinesOf(synth.plan.resources)),
     });
@@ -156,8 +186,8 @@ async function liveRefMap(synth, reads) {
         return applied;
     }
     for (const resource of synth.plan.resources) {
-        if (resource.kind !== "agent" && resource.kind !== "project" && resource.kind !== "connection") {
-            continue; // only agent, project and connection refs flow through the `applied` map in the previews
+        if (resource.kind !== "agent" && resource.kind !== "team" && resource.kind !== "connection") {
+            continue; // only agent, team and connection refs flow through the `applied` map in the previews
         }
         const live = await reads.read(resource.kind, resource.slug);
         if (live !== undefined) {
@@ -166,10 +196,6 @@ async function liveRefMap(synth, reads) {
     }
     return applied;
 }
-/** By its PLAN SLUG — the one canonical public name of a pending project. */
-function managedProjectSlug(plan) {
-    return plan.resources.find((resource) => resource.kind === "project")?.slug;
-}
 /**
  * Shared by BOTH commands, which are contractually required to agree; they differ only in what they DO with
  * the answer. The resolver is created per call and dropped with it, so a diff run contributes no
@@ -178,8 +204,7 @@ function managedProjectSlug(plan) {
  * Two lanes, because a reference reaches this pass two ways. The VERBATIM connection slots are walked
  * unconditionally — they name a connection directly, so whether the plan registers an import for that slug
  * is beside the point, and the bare spelling registers none. Everything else is demand-driven from
- * `plan.imports`, mirroring apply's own lazy resolution, with the build-carrying image and the factory
- * project as inherent roots. The exemption that falls out is the one wanted: a handle the author registered
+ * `plan.imports`, mirroring apply's own lazy resolution, with the build-carrying image as an inherent root. The exemption that falls out is the one wanted: a handle the author registered
  * and then referenced from nothing must not abort a valid apply.
  */
 export async function blockedImportsOf(synth, apis, env) {
@@ -189,7 +214,6 @@ export async function blockedImportsOf(synth, apis, env) {
         return [];
     }
     const referenced = referencedRefs(synth);
-    const managesProject = synth.plan.resources.some((resource) => resource.kind === "project");
     // ONE resolver for the whole pass, so a connection several slots reference is READ once. A preview is a
     // snapshot, so the memo lives exactly as long as the pass and never answers a later question. It is
     // preview-LOCAL rather than shared with apply's own resolver, which reads at its own time.
@@ -211,7 +235,6 @@ export async function blockedImportsOf(synth, apis, env) {
     const resolvedSlots = new Set(slotRefs);
     for (const imported of synth.plan.imports) {
         const reachable = imported.build !== undefined ||
-            (imported.kind === "project" && !managesProject) ||
             names(referenced, imported.kind, imported.ref);
         if (!reachable) {
             continue;
@@ -326,8 +349,10 @@ export function messageOf(error) {
  */
 function readImport(apis, kind, ref) {
     switch (kind) {
-        case "project":
-            return () => apis.projects.getProject({ id: ref });
+        case "team":
+            return () => apis.teams.getTeam({ id: ref });
+        case "policy":
+            return () => apis.policies.getPolicy({ id: ref });
         case "environment":
             return () => apis.environments.getEnvironment({ id: ref });
         case "agent":
@@ -428,9 +453,6 @@ function asArray(value) {
  */
 function referencedRefs(synth) {
     const index = { refs: new Map(), owners: new Map(), compositionAnchors: new Map() };
-    const implicitTriggerProjectRef = synth.plan.resources.some((resource) => resource.kind === "project")
-        ? undefined
-        : synth.plan.imports.find((imported) => imported.kind === "project")?.ref;
     const managedResources = new Map(synth.plan.resources.map((resource) => [refToken(resource.kind, resource.path.split("/")), resource]));
     for (const resource of synth.plan.resources) {
         if (resource.kind === "workflow")
@@ -452,7 +474,7 @@ function referencedRefs(synth) {
         collectWorkflowRefs(resource.payload, index, { type: "workflow", slug: resource.slug });
     }
     for (const doc of synth.triggers ?? []) {
-        collectTriggerRefs(doc, index, { type: "trigger", slug: doc.slug }, implicitTriggerProjectRef);
+        collectTriggerRefs(doc, index, { type: "trigger", slug: doc.slug });
     }
     return index;
 }
@@ -577,12 +599,12 @@ function collectResourceRefs(resource, index, owner) {
     if (payload === undefined) {
         return;
     }
-    // Every stamped kind carries the factory's project placement; `model-provider-key` is exempt.
-    addRef(index, "project", payload.projectId, owner);
+    // Every team-able kind may name its team; a row in Shared names none.
+    addRef(index, "team", payload.teamId, owner);
     switch (resource.kind) {
         case "environment": {
-            // The image, its pull credential and the mounts live inside `provisionSpec`; the egress policy below
-            // stays at the top level.
+            // The image, its pull credential and the mounts live inside `provisionSpec`; the egress rules name no
+            // other resource.
             const launchSpec = asRecord(payload.provisionSpec);
             addRef(index, "image", launchSpec?.image, owner);
             addRef(index, "secret", launchSpec?.imagePullSecretId, owner);
@@ -592,13 +614,6 @@ function collectResourceRefs(resource, index, owner) {
             for (const mount of asArray(launchSpec?.volumeMounts)) {
                 addRef(index, "volume", asRecord(mount)?.volumeId, owner);
             }
-            for (const rule of asArray(asRecord(payload.egressPolicy)?.rules)) {
-                for (const binding of asArray(asRecord(rule)?.credentialBindings)) {
-                    // Exactly one of the two per binding, so recording both records whichever is set.
-                    addRef(index, "secret", asRecord(binding)?.secretId, owner);
-                    addRef(index, "connection", asRecord(binding)?.connectionId, owner);
-                }
-            }
             return;
         }
         case "connection": {
@@ -632,9 +647,25 @@ function collectResourceRefs(resource, index, owner) {
             }
             return;
         }
+        case "team": {
+            addRef(index, "team", payload.parentTeamId, owner);
+            return;
+        }
+        case "role": {
+            for (const policyId of asArray(payload.policyIds)) {
+                addRef(index, "policy", policyId, owner);
+            }
+            return;
+        }
+        case "team-membership": {
+            for (const row of asArray(payload.rows)) {
+                addRef(index, "team", asRecord(row)?.teamId, owner);
+            }
+            return;
+        }
         default:
-            // These kinds carry no payload reference beyond the project stamp above; the gateway-key pair's
-            // reverse ownership-only edge is added by the caller.
+            // These kinds carry no payload reference beyond the team above; the gateway-key pair's reverse
+            // ownership-only edge is added by the caller.
             return;
     }
 }
@@ -654,16 +685,12 @@ function collectWorkflowRefs(workflow, index, owner) {
         }
     }
 }
-/**
- * `on.connection` is a verbatim slot resolved elsewhere. The factory project is an IMPLICIT edge — reconcile
- * stamps it on every trigger though the document has no project field — and not a composition anchor, because
- * the preview receives the descriptor out of band rather than re-resolving this import.
- */
-function collectTriggerRefs(doc, index, owner, implicitProjectRef) {
+/** `on.connection` is a verbatim slot resolved elsewhere. */
+function collectTriggerRefs(doc, index, owner) {
     const trigger = asRecord(doc);
     if (trigger === undefined) {
         return;
     }
-    addRef(index, "project", implicitProjectRef, owner);
+    addRef(index, "team", trigger.teamId, owner);
     addRef(index, "agent", asRecord(trigger.target)?.agent, owner, true);
 }

package/dist/cli/factory/apply-render.js

@@ -9,7 +9,7 @@
 // terminal.
 import { describeSource, preApprovalLevers, REQUIRE_APPROVAL_ENV, typedAtTerminalRemedy, } from "../core/approval-policy.js";
 import { NOTHING_WAS_WRITTEN } from "../core/prompts.js";
-import { describeProjectIdentityRefusal } from "../../engine/apply-core.js";
+import { describeTeamIdentityRefusal } from "../../engine/apply-core.js";
 import { containsCommandLineRecipe, pendingCredentialWrite } from "../../engine/secrets-apply.js";
 import { describeTargetOrganization, } from "../../engine/reconcile.js";
 import { isFiringRow } from "./apply-preview.js";
@@ -37,8 +37,16 @@ export function renderApplyPreview(preview, io) {
     for (const outcome of preview.firingTriggers) {
         io.out(`  ${outcome.action.padEnd(19)} trigger ${outcome.slug}`);
     }
+    const uploads = new Map((preview.hostedUploads ?? []).map((upload) => [upload.tag, upload]));
     for (const spec of preview.pendingImageBuilds) {
-        io.out(`  ${"image build".padEnd(19)} ${spec.ref} (${spec.dockerfile})`);
+        const upload = uploads.get(spec.ref);
+        if (upload === undefined) {
+            io.out(`  ${"image build".padEnd(19)} ${spec.ref} (${spec.dockerfile})`);
+            continue;
+        }
+        const now = upload.readyDigest !== undefined ? `newest READY ${upload.readyDigest}` : "no READY image of this name yet";
+        io.out(`  ${"image upload".padEnd(19)} ${upload.name} from ${upload.tag} (${upload.dockerfile}); ${now}; ` +
+            `the new digest is known only after the build`);
     }
     for (const line of renderSensitiveRows(preview.rows, "will")) {
         io.out(line);
@@ -61,7 +69,7 @@ export function renderApplyPreview(preview, io) {
     }
 }
 /**
- * A project-identity row goes through the shared formatter, and every other blocked row keeps its `details`
+ * A team-identity row goes through the shared formatter, and every other blocked row keeps its `details`
  * — the classifier's own value-free note, which is the difference between "will fail — unset-source" and a
  * sentence that says which variable to export. The surface standing in front of the write must not say less
  * than the read-only preview.
@@ -69,7 +77,7 @@ export function renderApplyPreview(preview, io) {
 function blockedRowText(entry) {
     if (entry.refusal !== undefined) {
         // The same call the error and `renderDiff` make, so all three word one conflict exactly one way.
-        return `will fail — ${describeProjectIdentityRefusal(entry.refusal)}`;
+        return `will fail — ${describeTeamIdentityRefusal(entry.refusal)}`;
     }
     return `will fail — ${entry.blocked}: ${entry.kind} ${entry.slug}${detailsOf(entry)}`;
 }

package/dist/cli/factory/apply.d.ts

@@ -1,6 +1,6 @@
 import type { SynthResult } from "../../core/plan.js";
 import { type PlatformApis } from "../../engine/client.js";
-import { type ApplyOutcome, type ConfirmFn, type ProjectResolution, type ReconcileOptions } from "../../engine/reconcile.js";
+import { type ApplyOutcome, type ConfirmFn, type ReconcileOptions } from "../../engine/reconcile.js";
 import { type FactoryConfig } from "./config.js";
 import { type DockerRunner, type PushLoginPrompts } from "./docker.js";
 import { type ApplyPreview, type MakeTriggersApi } from "./apply-preview.js";
@@ -45,7 +45,7 @@ export interface ApplyDeps {
     makeApis?: (target: PlatformTarget) => PlatformApis;
     loadConfig?: (dir: string) => FactoryConfig;
     runFactoryForPlan?: (cfg: FactoryConfig) => Promise<SynthResult>;
-    reconcile?: (plan: SynthResult["plan"], apis: PlatformApis, opts: ReconcileOptions, appliedOut?: Map<string, string>, projectOut?: ProjectResolution) => Promise<ApplyOutcome[]>;
+    reconcile?: (plan: SynthResult["plan"], apis: PlatformApis, opts: ReconcileOptions, appliedOut?: Map<string, string>) => Promise<ApplyOutcome[]>;
     confirm?: ConfirmFn;
     /**
      * Deliberately its own seam rather than a second job for {@link confirm}: this one approves the whole
@@ -65,6 +65,11 @@ export interface ApplyDeps {
     readCommandLineValue?: ReconcileOptions["readCommandLineValue"];
     dockerRunner?: DockerRunner;
     loginPrompts?: PushLoginPrompts;
+    /** The presigned pushes of an image's blobs; production leaves it to the global `fetch`. */
+    imageFetch?: typeof fetch;
+    /** The wait between two reads of an image the platform is still copying. */
+    sleep?: (ms: number) => Promise<void>;
+    now?: () => number;
     isTTY?: boolean;
     /**
      * A non-git directory, or any git failure, yields NO provenance and leaves the write bodies unchanged.