@orchestraworks/cli 0.5.4 → 0.5.7

package/dist/engine/condition-references.d.ts

@@ -5,11 +5,11 @@ import type { FilterNode } from "../constructs/workflow-filter.js";
  */
 export interface ConditionResolvers {
     agent?(ref: string): Promise<string>;
-    group?(ref: string): Promise<string>;
+    team?(ref: string): Promise<string>;
     /** A stage of the node's own pipeline. */
     stage?(ref: string): string;
 }
-/** A copy of [node] with every agent, group and stage it names as its id. */
+/** A copy of [node] with every agent, team and stage it names as its id. */
 export declare function resolveConditionReferences(node: FilterNode, resolvers: ConditionResolvers): Promise<FilterNode>;
 /**
  * A field that names a stage in itself, `dependencies.notAtStage.<stage>` with or without `old.`, with that stage

package/dist/engine/condition-references.js

@@ -1,5 +1,5 @@
 // The references inside a condition node, resolved to the ids the platform stores. A stage gate and a rule both
-// name agents, groups and stages by slug in factory code, and the platform saves each as its id and reads it back
+// name agents, teams and stages by slug in factory code, and the platform saves each as its id and reads it back
 // that way, so a comparison over the slugs would report drift on every apply. This is the one walk both use.
 const OLD_PREFIX = "old.";
 const NOT_AT_STAGE = "dependencies.notAtStage.";
@@ -9,13 +9,13 @@ function kindOf(field) {
     const bare = field.startsWith(OLD_PREFIX) ? field.slice(OLD_PREFIX.length) : field;
     if (bare === "assigneeAgent" || /^checks\.[^.]+\.writer\.agent$/.test(bare))
         return "agent";
-    if (bare === "assigneeGroup")
-        return "group";
+    if (bare === "assigneeTeam")
+        return "team";
     if (bare === "stage")
         return "stage";
     return undefined;
 }
-/** A copy of [node] with every agent, group and stage it names as its id. */
+/** A copy of [node] with every agent, team and stage it names as its id. */
 export async function resolveConditionReferences(node, resolvers) {
     if ("all" in node)
         return { all: await Promise.all(node.all.map((child) => resolveConditionReferences(child, resolvers))) };
@@ -57,8 +57,8 @@ function resolverFor(kind, resolvers) {
     switch (kind) {
         case "agent":
             return resolvers.agent?.bind(resolvers);
-        case "group":
-            return resolvers.group?.bind(resolvers);
+        case "team":
+            return resolvers.team?.bind(resolvers);
         case "stage": {
             const stage = resolvers.stage;
             return stage === undefined ? undefined : async (ref) => stage(ref);

package/dist/engine/connection-install-link-reconcile.d.ts

@@ -1,5 +1,5 @@
 import type { PlanResource } from "../core/plan.js";
-import { type ApplyOutcome } from "./apply-core.js";
+import { type ApplyOutcome, type DesiredTeam } from "./apply-core.js";
 import type { PlatformApis } from "./client.js";
 /**
  * Auth modes whose connection the PLATFORM creates at the end of the ceremony rather than orchestra POSTing it.
@@ -51,6 +51,7 @@ export declare function isCeremonyBackedConnection(payload: Record<string, unkno
 /**
  * GET by declared slug FIRST: a connection already there is adopted, which is the re-apply, the out-of-band
  * install and the "installed after the last apply timed out" journeys alike, and none of them mints a second
- * link. `body` is the already-resolved, already-project-stamped payload clone the connection lane builds.
+ * link. `body` is the already-resolved payload clone the connection lane builds, carrying `teamId` unless the
+ * connection is in Shared; `team` is that lane's resolved team, which the identity check compares.
  */
-export declare function applyCeremonyBackedConnection(resource: PlanResource, body: Record<string, unknown>, apis: PlatformApis, outcomes: ApplyOutcome[], applied: Map<string, string>, options?: ConnectionInstallLinkOptions): Promise<void>;
+export declare function applyCeremonyBackedConnection(resource: PlanResource, body: Record<string, unknown>, apis: PlatformApis, outcomes: ApplyOutcome[], applied: Map<string, string>, options?: ConnectionInstallLinkOptions, team?: DesiredTeam): Promise<void>;

package/dist/engine/connection-install-link-reconcile.js

@@ -11,7 +11,7 @@
 import { wireNode } from "../constructs/workflow-filter.js";
 import { refToken } from "../core/tokens.js";
 import { Providers } from "../generated/providers.js";
-import { ApplyError, defaultPrint, desiredProjectOf, exactDeepEqual, failing, getBySlugOrUndefined, subsetDeepEqual, } from "./apply-core.js";
+import { ApplyError, defaultPrint, exactDeepEqual, failing, getBySlugOrUndefined, subsetDeepEqual, } from "./apply-core.js";
 import { paginate } from "./pages.js";
 import { refuseIf } from "./refusals.js";
 /**
@@ -64,14 +64,15 @@ export function isCeremonyBackedConnection(payload) {
 /**
  * GET by declared slug FIRST: a connection already there is adopted, which is the re-apply, the out-of-band
  * install and the "installed after the last apply timed out" journeys alike, and none of them mints a second
- * link. `body` is the already-resolved, already-project-stamped payload clone the connection lane builds.
+ * link. `body` is the already-resolved payload clone the connection lane builds, carrying `teamId` unless the
+ * connection is in Shared; `team` is that lane's resolved team, which the identity check compares.
  */
-export async function applyCeremonyBackedConnection(resource, body, apis, outcomes, applied, options = {}) {
+export async function applyCeremonyBackedConnection(resource, body, apis, outcomes, applied, options = {}, team) {
     const adopted = await readConnectionBySlug(resource.slug, apis, outcomes);
     const created = adopted === undefined;
     const live = adopted ??
-        (await establishThroughInstallLink(resource, body, apis, outcomes, options));
-    refuseUnadoptable(resource, body, live, outcomes);
+        (await establishThroughInstallLink(resource, body, apis, outcomes, options, team));
+    refuseUnadoptable(resource, body, live, outcomes, team);
     const patched = await reconcileEstablishedConnection(resource, body, live, apis, outcomes);
     const action = created
         ? "created"
@@ -93,12 +94,12 @@ export async function applyCeremonyBackedConnection(resource, body, apis, outcom
  * Finding a pending link it prints what it can, which deliberately cannot include the URL: only the token's
  * hash is stored, so no read surface anywhere can reconstruct it.
  */
-async function establishThroughInstallLink(resource, body, apis, outcomes, options) {
+async function establishThroughInstallLink(resource, body, apis, outcomes, options, team) {
     const print = options.print ?? defaultPrint;
     const timeoutMs = options.timeoutMs ?? DEFAULT_INSTALL_LINK_POLL_TIMEOUT_MS;
     const reusable = options.remintInstallLinks === true
         ? undefined
-        : await findReusableInstallLink(resource, body, apis, outcomes);
+        : await findReusableInstallLink(resource, body, apis, outcomes, team);
     const link = reusable ?? (await mintInstallLink(resource, body, apis, outcomes));
     if (reusable !== undefined) {
         printPendingLink(resource, reusable, timeoutMs, print);
@@ -114,8 +115,8 @@ async function establishThroughInstallLink(resource, body, apis, outcomes, optio
  * The one paginated walk both link readers share, because both need the same two properties. The list is
  * walked to EXHAUSTION, since concluding "no link exists" from page 1 alone would mint — and therefore
  * supersede — a link sitting on page 2 in someone's inbox. And the SCOPE is matched client-side by the
- * caller, because the standard `project` list filter cannot express "exactly the commons", so a server-side
- * filter alone would let a sibling project's same-slug link suppress a mint this scope needs.
+ * caller, because a team list filter alone would let another team's same-slug link suppress a mint this scope
+ * needs.
  *
  * `slug` and `status` are exactly expressible and do narrow server-side, but every caller re-checks what it
  * filtered on: a filter the server ignores must not become a link this apply adopts.
@@ -134,18 +135,26 @@ async function listScopeInstallLinks(resource, apis, outcomes, status) {
 }
 /**
  * The scope match is exact and happens here rather than on the server, over the four members the platform
- * itself keys supersede on: provider, resolved connector, declared slug, and project.
+ * itself keys supersede on: provider, resolved connector, declared slug, and team.
  */
-async function findReusableInstallLink(resource, body, apis, outcomes) {
+async function findReusableInstallLink(resource, body, apis, outcomes, team) {
     const links = await listScopeInstallLinks(resource, apis, outcomes, PENDING_STATUS);
-    return links.find((link) => inThisScope(link, resource, body));
+    return links.find((link) => inThisScope(link, resource, body, team));
 }
-function inThisScope(link, resource, body) {
+function inThisScope(link, resource, body, team) {
     return (link.status === PENDING_STATUS &&
         link.provider === providerIdOf(body) &&
         blankToUndefined(link.connectorId) === connectorIdOf(body) &&
         link.slug === resource.slug &&
-        blankToUndefined(link.projectId) === projectIdOf(body));
+        sameTeam(blankToUndefined(link.teamId), teamIdOf(body), team));
+}
+/** A body in Shared carries no team, while a link may report Shared's id or none. */
+function sameTeam(linkTeam, declared, team) {
+    if (declared !== undefined)
+        return linkTeam === declared;
+    if (linkTeam === undefined)
+        return true;
+    return team?.state === "resolved" && team.shared === true && linkTeam === team.teamId;
 }
 /**
  * The request carries the RESOLVED CONNECTOR ID: without it, a BYO ceremony on a connection naming the
@@ -154,7 +163,7 @@ function inThisScope(link, resource, body) {
  * registration, because absent means the platform's own App.
  */
 async function mintInstallLink(resource, body, apis, outcomes) {
-    const projectId = projectIdOf(body);
+    const teamId = teamIdOf(body);
     const connectorId = connectorIdOf(body);
     // `slug` is the declared identity the completion must land on; `_configuration` is the generator's spelling
     // of the `configuration` map.
@@ -165,7 +174,7 @@ async function mintInstallLink(resource, body, apis, outcomes) {
             : resource.slug,
         slug: resource.slug,
         _configuration: intentConfiguration(providerIdOf(body), authoredInstall(body)),
-        ...(projectId !== undefined ? { projectId } : {}),
+        ...(teamId !== undefined ? { teamId } : {}),
         ...(connectorId !== undefined ? { connectorId } : {}),
     };
     const minted = await failing(() => apis.connectionInstallLinks.createConnectionInstallLink({
@@ -268,12 +277,13 @@ async function readConsumedConnection(resource, apis, outcomes) {
 }
 /**
  * `install` is deliberately absent — {@link installDrift} is the only thing allowed to write that block.
- * `slug`/`provider` are create-only and `status` is server-owned. `projectId` is absent because a placement
- * is identity, not authored state: a readable connection whose project differs is already refused before this
- * runs, so by the time a PATCH is assembled the stamps agree. `auth.mode` is reconciled separately, because a
+ * `slug`/`provider` are create-only and `status` is server-owned. `teamId` is absent because a team is
+ * identity, not authored state: a readable connection whose team differs is already refused before this
+ * runs, so by the time a PATCH is assembled the teams agree. `auth.mode` is reconciled separately, because a
  * connection created before the mode was stamped must converge through the catalog-validated update door.
+ * `hosts` compares as an ordered list, so a connection adopted at `[]` takes the declared or default `["*"]`.
  */
-const AUTHORED_TOP_LEVEL_KEYS = ["name", "where", "autoRespond"];
+const AUTHORED_TOP_LEVEL_KEYS = ["name", "where", "autoRespond", "hosts"];
 async function reconcileEstablishedConnection(resource, body, live, apis, outcomes) {
     const liveRecord = live;
     const patch = {};
@@ -355,14 +365,11 @@ function timeoutError(resource, status, waitedMs, outcomes) {
  * initially-present row and every post-wait row converge, so no arrival path reaches the authored-state
  * compare or the PATCH without passing through it, and none writes to the connection in between.
  */
-function refuseUnadoptable(resource, body, live, outcomes) {
-    const declaredProject = body.projectId;
+function refuseUnadoptable(resource, body, live, outcomes, team) {
     refuseIf("connection", resource, {
         // No `env`: a ceremony-backed adoption reads no environment source, and absent evidence is how this
         // classifier is told so.
-        project: desiredProjectOf(typeof declaredProject === "string" && declaredProject !== ""
-            ? declaredProject
-            : undefined),
+        ...(team !== undefined ? { team } : {}),
         live: live,
         resolvedDesired: {
             body,
@@ -384,9 +391,9 @@ function providerIdOf(payload) {
 function connectorIdOf(payload) {
     return blankToUndefined(payload.auth?.connectorId);
 }
-/** `undefined` = the organization commons. */
-function projectIdOf(payload) {
-    return blankToUndefined(payload.projectId);
+/** `undefined` = Shared. */
+function teamIdOf(payload) {
+    return blankToUndefined(payload.teamId);
 }
 /** One spelling for "absent": `undefined`, `null`, a non-string, and blank text all mean the same thing. */
 function blankToUndefined(value) {

package/dist/engine/diff.d.ts

@@ -1,6 +1,6 @@
 import type { TriggerDocument } from "../constructs/trigger.js";
 import type { PlanDocument, PlanKind } from "../core/plan.js";
-import { type DesiredProject, type ProjectIdentityRefusal } from "./apply-core.js";
+import { type TeamIdentityRefusal, type TeamResolver } from "./apply-core.js";
 import { type PlatformApis } from "./client.js";
 /**
  * `value-write-pending` covers any write-only credential apply will write over — unreadable here, but the
@@ -11,7 +11,7 @@ import { type PlatformApis } from "./client.js";
 export type DiffState = "create" | "update" | "refused" | "no-change" | "value-write-pending";
 /**
  * `details` is a value-free human note. `refusal` is set on — and only on — a `refused` row, and carries the
- * SAME payload apply's `ProjectIdentityConflictError` does, rendered through the one shared formatter, so
+ * SAME payload apply's `TeamIdentityConflictError` does, rendered through the one shared formatter, so
  * preview and apply cannot word one conflict two ways.
  */
 export interface DiffEntry {
@@ -20,7 +20,7 @@ export interface DiffEntry {
     slug: string;
     state: DiffState;
     details?: string;
-    refusal?: ProjectIdentityRefusal;
+    refusal?: TeamIdentityRefusal;
     orphan?: boolean;
     truncated?: boolean;
     /**
@@ -45,7 +45,7 @@ export interface DiffEntry {
     /**
      * The reason reconcile would REFUSE this row without writing. A blocked row is not an executable
      * create/update: diff renders it as "will fail — <reason>" and apply's pre-flight excludes it from the
-     * approval set rather than asking about a write that cannot happen. `project-identity` keeps its own
+     * approval set rather than asking about a write that cannot happen. `team-identity` keeps its own
      * `refused` state and its typed {@link refusal} payload.
      */
     blocked?: string;
@@ -58,7 +58,8 @@ export declare const ORPHAN_SCAN_CAP = 5;
  */
 export interface DiffResourcesOptions {
     env: Record<string, string | undefined>;
-    project?: DesiredProject;
+    /** Shared with the caller's other preview passes; absent, this pass builds its own over live reads. */
+    teams?: TeamResolver;
     /**
      * Optional: a caller that supplies none gets a fresh memo for its own pass. A caller that performs OTHER
      * reads of the same rows around the pass — apply's pre-flight — passes its own so the whole pre-flight
@@ -99,13 +100,10 @@ export interface DiffPlanOptions extends DiffResourcesOptions {
 export declare function diffResources(plan: PlanDocument, apis: PlatformApis, opts: DiffResourcesOptions): Promise<DiffEntry[]>;
 export declare function diffPlan(plan: PlanDocument, apis: PlatformApis, opts: DiffPlanOptions): Promise<DiffEntry[]>;
 /**
- * A missing MANAGED project is `pending-managed` — nothing readable can equal a project that has not been
- * created — while a missing IMPORT ref stays lenient `none`, because a preview must not refuse against a
- * project it merely cannot read.
- *
- * This is the ONE resolver seam for the PREVIEW side, shared by apply's pre-flight and `orchestra fdk diff` so the
- * two cannot derive the descriptor differently. Reconcile is deliberately NOT a consumer and cannot be: its
- * phase 0 CREATES a managed project, so the id it holds is by definition fresher than any descriptor
- * resolved before the apply began.
+ * The ONE team resolver for the PREVIEW side, shared by apply's pre-flight and `orchestra fdk diff`. A managed
+ * team that exists live resolves to its id; one that does not, or that this key cannot read, is
+ * `pending-managed`, since no live row can sit in a team nothing has created. An imported team the key cannot
+ * read is left unjudged, because a preview must not refuse against a team it merely cannot read. Reconcile
+ * builds its own, because it creates the managed teams and holds fresher ids than any preview.
  */
-export declare function resolveDesiredProject(plan: PlanDocument, apis: PlatformApis): Promise<DesiredProject>;
+export declare function previewTeamResolver(plan: PlanDocument, apis: PlatformApis): Promise<TeamResolver>;