@orchestraworks/cli 0.5.4 → 0.5.7

package/dist/engine/diff.js

@@ -12,7 +12,7 @@ import { isEnvImportMarker, parseEnvImportMarker } from "../constructs/reference
 import { gatewayKeyRefOf } from "../core/gateway-key-recipe.js";
 import { labelsPatch, MANAGED_BY_LABEL_KEY } from "../core/labels.js";
 import { isRefToken, refToken } from "../core/tokens.js";
-import { modelSettingsUnchanged, standbyCapacityUnchanged, platformErrorMessage, } from "./apply-core.js";
+import { createTeamResolver, mapError, modelSettingsUnchanged, standbyCapacityUnchanged, platformErrorMessage, } from "./apply-core.js";
 import { httpStatusOf } from "./client.js";
 import { describeRefusal, describeStageEffects, leftoverRefusals, pipelineChange, pipelineUnchanged, previewPipelineChange, resolveGateReferences, workflowStagesAfterApply, } from "./pipeline-reconcile.js";
 import { describeEntryChange, describeOverlaps, entriesUnchanged, pipelineEntryChange, proposedWorkflows, } from "./pipeline-workflow-reconcile.js";
@@ -22,10 +22,10 @@ import { computeProviderPatch, } from "./compute-provider-reconcile.js";
 import { paginate } from "./pages.js";
 import { isCeremonyBackedConnection } from "./connection-install-link-reconcile.js";
 import { reservedProviderSecretIds } from "./preflight.js";
-import { egressCredentialBindingLabel, gatewayKeyPairRefusal, refusalOf, } from "./refusals.js";
-import { connectionUnchanged, credentialBindingArm, environmentUnchanged, getBySlugOrUndefined, subsetDeepEqual, } from "./reconcile.js";
+import { gatewayKeyPairRefusal, refusalOf, } from "./refusals.js";
+import { connectionUnchanged, environmentUnchanged, getBySlugOrUndefined, subsetDeepEqual, } from "./reconcile.js";
 import { removedConfigurationNotice } from "./connector-configuration.js";
-import { containsCommandLineRecipe, metadataInjectionChange, pendingCredentialWrite, replacesLiveCredentialValue, resolveSecretValueSource, rootEnvName, } from "./secrets-apply.js";
+import { containsCommandLineRecipe, declaredSecretHosts, metadataHostsChange, metadataInjectionChange, pendingCredentialWrite, replacesLiveCredentialValue, resolveSecretValueSource, rootEnvName, } from "./secrets-apply.js";
 /** Overridable for tests. */
 export const ORPHAN_SCAN_CAP = 5;
 /**
@@ -65,12 +65,15 @@ export async function diffResources(plan, apis, opts) {
     // build and a push for a write apply refuses the moment it reaches the same binding.
     let reservedCache;
     const reserved = () => (reservedCache ??= reservedProviderSecretIds(apis));
+    let rolesCache;
+    const roles = () => (rolesCache ??= paginate((page, limit) => apis.roles.listRoles({ page, limit })).then((read) => read.items));
     const pass = {
         apis,
         env: opts.env,
         planSlugByRef,
-        project: opts.project ?? (await resolveDesiredProject(plan, apis)),
+        teams: opts.teams ?? (await previewTeamResolver(plan, apis)),
         reserved,
+        roles,
         reads: opts.reads ?? createDiffReadCache(apis),
         triggers: opts.triggers ?? [],
     };
@@ -88,38 +91,54 @@ export async function diffPlan(plan, apis, opts) {
     return entries;
 }
 /**
- * A missing MANAGED project is `pending-managed` — nothing readable can equal a project that has not been
- * created — while a missing IMPORT ref stays lenient `none`, because a preview must not refuse against a
- * project it merely cannot read.
- *
- * This is the ONE resolver seam for the PREVIEW side, shared by apply's pre-flight and `orchestra fdk diff` so the
- * two cannot derive the descriptor differently. Reconcile is deliberately NOT a consumer and cannot be: its
- * phase 0 CREATES a managed project, so the id it holds is by definition fresher than any descriptor
- * resolved before the apply began.
+ * The ONE team resolver for the PREVIEW side, shared by apply's pre-flight and `orchestra fdk diff`. A managed
+ * team that exists live resolves to its id; one that does not, or that this key cannot read, is
+ * `pending-managed`, since no live row can sit in a team nothing has created. An imported team the key cannot
+ * read is left unjudged, because a preview must not refuse against a team it merely cannot read. Reconcile
+ * builds its own, because it creates the managed teams and holds fresher ids than any preview.
+ */
+export async function previewTeamResolver(plan, apis) {
+    const known = new Map();
+    const pendingManaged = new Map();
+    for (const resource of plan.resources) {
+        if (resource.kind !== "team")
+            continue;
+        const token = refToken("team", resource.path.split("/"));
+        const live = await getBySlugOrUndefined(() => apis.teams.getTeam({ id: resource.slug })).catch(() => undefined);
+        if (live !== undefined)
+            known.set(token, live.id);
+        else
+            pendingManaged.set(token, resource.slug);
+    }
+    return createTeamResolver(apis, known, { preview: { pendingManaged } });
+}
+/**
+ * A preview never fails on a team read: an unreadable one decides nothing. `lives` are the rows the team is
+ * judged against, so a row in Shared reads Shared's id only when one of them reports a team.
  */
-export async function resolveDesiredProject(plan, apis) {
-    const managedRef = plan.resources.find((r) => r.kind === "project")?.slug;
-    const ref = managedRef ?? plan.imports.find((i) => i.kind === "project")?.ref;
-    if (ref === undefined) {
-        return { state: "none" };
+async function teamOf(pass, resource, raw, ...lives) {
+    const ctx = { kind: resource.kind, slug: resource.slug, op: "get" };
+    try {
+        let team = await pass.teams.desired(raw, ctx, []);
+        for (const live of lives)
+            team = await pass.teams.judged(team, live, ctx, []);
+        return team;
     }
-    const live = await getBySlugOrUndefined(() => apis.projects.getProject({ id: ref }));
-    if (live !== undefined) {
-        return { state: "resolved", projectId: live.id };
+    catch {
+        return undefined;
     }
-    return managedRef !== undefined ? { state: "pending-managed", projectRef: managedRef } : { state: "none" };
 }
 /**
- * Overwrites the synth-time stamp with the resolved live id so the compare reflects the row apply selected,
- * or DROPS the unresolved symbolic ref so it never pollutes the subset compare. Safe because every body
- * compare runs after the identity check has already proved the live stamp and the declared project agree.
+ * Sets the resolved live team so the compare reflects the row apply selected, or drops the field for Shared
+ * and for a team not created yet. Safe because every body compare runs after the identity check has already
+ * proved the live team and the declared one agree.
  */
-function stampDiffBodyProject(body, projectStamp) {
-    if (projectStamp.state === "resolved") {
-        body.projectId = projectStamp.projectId;
+function stampDiffBodyTeam(body, team) {
+    if (team?.state === "resolved" && team.shared !== true) {
+        body.teamId = team.teamId;
     }
     else {
-        delete body.projectId;
+        delete body.teamId;
     }
 }
 /**
@@ -130,7 +149,7 @@ function stampDiffBodyProject(body, projectStamp) {
 function verdictFor(resource, live, evidence) {
     return refusalOf(resource.kind, resource, {
         env: evidence.env,
-        ...(evidence.project !== undefined ? { project: evidence.project } : {}),
+        ...(evidence.team !== undefined ? { team: evidence.team } : {}),
         ...(live !== undefined ? { live } : {}),
         ...(evidence.resolvedDesired !== undefined ? { resolvedDesired: evidence.resolvedDesired } : {}),
         ...(evidence.gatewayPair !== undefined ? { gatewayPair: evidence.gatewayPair } : {}),
@@ -144,17 +163,17 @@ function verdictFor(resource, live, evidence) {
  * are genuinely about both rows and pass through to both.
  */
 function addressedTo(resource, verdict) {
-    if (verdict?.code === "project-identity" && verdict.refusal.slug !== resource.slug) {
+    if (verdict?.code === "team-identity" && verdict.refusal.slug !== resource.slug) {
         return null;
     }
     return verdict;
 }
 /**
- * A project-identity conflict keeps its own `refused` state and typed payload; every other verdict rides an
+ * A team-identity conflict keeps its own `refused` state and typed payload; every other verdict rides an
  * ordinary state carrying {@link DiffEntry.blocked}.
  */
 function refusedRow(resource, verdict) {
-    return verdict?.code === "project-identity" ? refused(resource, verdict.refusal, verdict.code) : undefined;
+    return verdict?.code === "team-identity" ? refused(resource, verdict.refusal, verdict.code) : undefined;
 }
 /**
  * Carrying the classifier's own MESSAGE as `details` is the point of the fragment: both renderers print
@@ -164,7 +183,7 @@ function refusedRow(resource, verdict) {
  * going to be applied, so why it will fail outranks what it would otherwise have written.
  */
 function blockedOf(verdict) {
-    return verdict === null || verdict.code === "project-identity"
+    return verdict === null || verdict.code === "team-identity"
         ? {}
         : { blocked: verdict.code, details: verdict.message };
 }
@@ -189,8 +208,12 @@ function sensitivityOf(valueFrom, exists, env) {
 }
 async function diffResource(resource, plan, pass) {
     switch (resource.kind) {
-        case "project":
-            return diffProject(resource, pass);
+        case "team":
+            return diffTeam(resource, pass);
+        case "role":
+            return diffRole(resource, pass);
+        case "team-membership":
+            return diffTeamMemberships(resource, pass);
         case "gateway-key":
             return diffGatewayKey(resource, plan, pass);
         case "model-provider-key":
@@ -233,17 +256,129 @@ async function diffComputeProvider(resource, pass) {
     const patch = computeProviderPatch(resource.payload, live);
     return entry(resource, patch === undefined ? "no-change" : "update");
 }
-/** `name` and the declared labels are the orchestra-managed fields, and a project is never itself moved. */
-async function diffProject(resource, pass) {
-    const live = await pass.reads.read("project", resource.slug);
+/**
+ * The platform's 403 on a read is this key saying it may not touch the row: the same `refused` apply records
+ * when its write is refused, so a weak key's preview names every row it cannot apply.
+ */
+async function forbiddenOr(resource, op, read) {
+    try {
+        return { value: await read() };
+    }
+    catch (error) {
+        if (httpStatusOf(error) !== 403)
+            throw error;
+        const details = await mapError(error, { kind: resource.kind, slug: resource.slug, op });
+        return { refused: entry(resource, "refused", undefined, { blocked: "forbidden", details }) };
+    }
+}
+/** Name, privacy, assignment method and the declared labels are the managed fields; the parent is fixed. */
+async function diffTeam(resource, pass) {
+    const read = await forbiddenOr(resource, "get", () => pass.reads.read("team", resource.slug));
+    if ("refused" in read)
+        return read.refused;
+    const live = read.value;
     if (live === undefined) {
         return entry(resource, "create");
     }
     const payload = resource.payload;
-    const unchanged = subsetDeepEqual({ name: payload.name }, live) &&
+    // Compared both ways, as apply compares it: a parent declared, changed or dropped is refused.
+    const declaredParent = payload.parentTeamId === undefined ? undefined : await teamOf(pass, resource, payload.parentTeamId);
+    const parentId = declaredParent?.state === "resolved" ? declaredParent.teamId : undefined;
+    const parentDeclared = payload.parentTeamId !== undefined;
+    const liveParent = live.parentTeamId ?? undefined;
+    if ((parentDeclared && parentId !== liveParent) || (!parentDeclared && liveParent !== undefined)) {
+        return entry(resource, "update", undefined, {
+            blocked: "team-parent-fixed",
+            details: `team '${resource.slug}': a team's parent is fixed when it is created, so apply cannot change it`,
+        });
+    }
+    const unchanged = live.name === payload.name &&
+        live._private === payload.private &&
+        (live.assignment ?? "AGENT_FIRST") === payload.assignment &&
+        labelsPatch(payload.labels, live.labels) === undefined;
+    return entry(resource, unchanged ? "no-change" : "update");
+}
+/** A custom role is found by its name, as apply finds it, and its policies compare as a set. */
+async function diffRole(resource, pass) {
+    const payload = resource.payload;
+    const read = await forbiddenOr(resource, "list", () => pass.roles());
+    if ("refused" in read)
+        return read.refused;
+    const live = read.value.find((role) => role.name === payload.name && role.organizationId !== "org_global");
+    if (live === undefined)
+        return entry(resource, "create");
+    const unchanged = [...live.policyIds].sort().join(" ") === payload.policyIds.join(" ") &&
+        (payload.description === undefined || payload.description === live.description) &&
         labelsPatch(payload.labels, live.labels) === undefined;
     return entry(resource, unchanged ? "no-change" : "update");
 }
+/**
+ * A principal's rows compare as one set, keyed by scope. An agent the plan has not created yet has the rows the
+ * platform writes at agent create, which apply then replaces, so its row previews as an update.
+ */
+async function diffTeamMemberships(resource, pass) {
+    const payload = resource.payload;
+    const principal = payload.principal;
+    let membershipId;
+    if ("agentId" in principal) {
+        const live = await pass.reads.read("agent", resource.slug).catch(() => undefined);
+        if (live === undefined)
+            return entry(resource, "update", "rows written after the agent is created");
+        membershipId = live.membershipId;
+    }
+    else {
+        const account = await getBySlugOrUndefined(() => pass.apis.serviceAccounts.getServiceAccount({ id: principal.serviceAccountId }));
+        if (account === undefined) {
+            return entry(resource, "update", undefined, {
+                blocked: "service-account-missing",
+                details: `service account '${principal.serviceAccountId}' was not found; the kit never creates one`,
+            });
+        }
+        membershipId = account.membershipId;
+    }
+    if (membershipId === undefined)
+        return entry(resource, "update");
+    const read = await forbiddenOr(resource, "list", async () => {
+        const rows = await paginate(async (page, limit) => {
+            const result = await pass.apis.teamMemberships.listTeamMemberships({ membershipId, page, limit });
+            return { data: result.data, page, limit, total: result.total ?? result.data.length };
+        });
+        return rows.items;
+    });
+    if ("refused" in read)
+        return read.refused;
+    if (read.value === undefined)
+        return entry(resource, "update");
+    const live = new Map(read.value.map((row) => [row.allTeams === true ? "*" : `team:${row.teamId ?? ""}`, row.roleId]));
+    if (live.size !== payload.rows.length)
+        return entry(resource, "update");
+    for (const row of payload.rows) {
+        let scope = "*";
+        if ("teamId" in row) {
+            const team = await teamOf(pass, resource, row.teamId);
+            if (team?.state !== "resolved")
+                return entry(resource, "update");
+            scope = `team:${team.teamId}`;
+        }
+        const roleId = await roleIdOf(pass, row.roleId);
+        if (roleId === undefined || live.get(scope) !== roleId)
+            return entry(resource, "update");
+    }
+    return entry(resource, "no-change");
+}
+/**
+ * A row's role id: a managed role's slug as written, or a custom role this program declares, found by its name
+ * as apply finds it. A custom role that does not exist yet answers undefined, so its rows preview as an update.
+ */
+async function roleIdOf(pass, ref) {
+    if (!isRefToken(ref))
+        return ref;
+    const declared = pass.planSlugByRef.get(ref);
+    if (declared?.kind !== "role")
+        return undefined;
+    const roles = await pass.roles().catch(() => undefined);
+    return roles?.find((role) => role.name === declared.slug && role.organizationId !== "org_global")?.id;
+}
 async function diffSecret(resource, pass) {
     // A gateway-key-backed secret has no env source at all: whether apply writes it is decided by whether the
     // paired KEY exists, so it needs its own classification.
@@ -263,9 +398,10 @@ async function diffSecret(resource, pass) {
     // it as an optimization made an overwrite of a live credential preview exactly like a first write, so the
     // operator never saw the unrecoverable-replacement warning.
     const live = await readSecret(pass, resource.slug);
-    // A readable cross-project row outranks every write verdict — apply refuses it in its read-only decision
+    // A readable row in another team outranks every write verdict — apply refuses it in its read-only decision
     // phase, ahead of the write and ahead of the confirmation.
-    const verdict = verdictFor(resource, live, { env, project: pass.project });
+    const team = await teamOf(pass, resource, resource.payload.teamId, live);
+    const verdict = verdictFor(resource, live, { env, ...(team !== undefined ? { team } : {}) });
     const identity = refusedRow(resource, verdict);
     if (identity !== undefined)
         return identity;
@@ -283,17 +419,27 @@ async function diffSecret(resource, pass) {
     if (live === undefined) {
         return entry(resource, "create", unsetNote, marks);
     }
-    // Nothing to write, but the declared INJECTION RECIPE may still differ, and reconcile answers that with a
-    // real value-less PATCH. Reading only the value source here reported `no-change` for that edit, so a
-    // recipe-only change sailed past the `any-change` gate unapproved. Same comparator as reconcile's.
-    const injectionChange = metadataInjectionChange(declaredInjection(resource), live.injection);
-    if (injectionChange !== undefined) {
-        return entry(resource, "update", withDetail(unsetNote, INJECTION_RECIPE_CHANGE), marks);
+    // Nothing to write, but the declared INJECTION RECIPE or HOSTS may still differ, and reconcile answers that
+    // with a real value-less PATCH. Reading only the value source here reported `no-change` for that edit, so a
+    // recipe-only change sailed past the `any-change` gate unapproved. Same comparators as reconcile's.
+    const metadata = secretMetadataDetail(resource, live);
+    if (metadata !== undefined) {
+        return entry(resource, "update", withDetail(unsetNote, metadata), marks);
     }
     return entry(resource, "no-change", unsetNote, marks);
 }
-/** Value-free: a recipe is shape, never credential material. */
+/** Value-free: a recipe and a host list are shape, never credential material. */
 const INJECTION_RECIPE_CHANGE = "injection recipe changes";
+const HOSTS_CHANGE = "hosts change";
+function secretMetadataDetail(resource, live) {
+    const details = [
+        ...(metadataInjectionChange(declaredInjection(resource), live.injection) !== undefined
+            ? [INJECTION_RECIPE_CHANGE]
+            : []),
+        ...(metadataHostsChange(declaredSecretHosts(resource.payload), live.hosts) !== undefined ? [HOSTS_CHANGE] : []),
+    ];
+    return details.length > 0 ? details.join("; ") : undefined;
+}
 function declaredInjection(resource) {
     return resource.payload.injection;
 }
@@ -314,9 +460,10 @@ async function diffGatewayKey(resource, plan, pass) {
     // whose paired Secret is gone, and a live key beside a Secret still carrying the mid-protocol marker — are
     // properties of the pair, so the key is stamped `blocked` rather than presenting as an executable update.
     const liveSecret = pairContext === undefined ? undefined : await readSecret(pass, pairContext.secretSlug);
+    const team = await teamOf(pass, resource, resource.payload.teamId, live, liveSecret);
     const verdict = addressedTo(resource, verdictFor(resource, { key: live, secret: liveSecret, secretMarked: hasPendingMarker(liveSecret) }, {
         env: pass.env,
-        project: pass.project,
+        ...(team !== undefined ? { team } : {}),
         ...(pairContext !== undefined ? { gatewayPair: pairContext } : {}),
     }));
     const identity = refusedRow(resource, verdict);
@@ -327,9 +474,9 @@ async function diffGatewayKey(resource, plan, pass) {
         return entry(resource, "create", "mints a new gateway key and writes its paired secret", marks);
     }
     const body = structuredClone(resource.payload);
-    // `slug` is create-only identity and `projectId` has no update seam, so neither participates in the compare.
+    // `slug` is create-only identity and `teamId` has no update seam, so neither participates in the compare.
     delete body.slug;
-    delete body.projectId;
+    delete body.teamId;
     return entry(resource, keyUnchanged(body, live) ? "no-change" : "update", undefined, marks);
 }
 function hasPendingMarker(secret) {
@@ -357,7 +504,7 @@ async function diffModelProviderKey(resource, pass) {
     const env = pass.env;
     const payload = resource.payload;
     const live = (await scanModelProviderKeys(pass.apis)).find((row) => row.modelProvider === payload.modelProvider);
-    // No `project`: org-commons by construction, so there is no placement to compare and no `refused` arm.
+    // No team: organization-wide by construction, so there is no team to compare and no `refused` arm.
     const verdict = verdictFor(resource, live, { env });
     const marks = {
         ...blockedOf(verdict),
@@ -414,9 +561,10 @@ async function diffGatewayKeyBackedSecret(resource, gatewayKeyRef, pass) {
     // Read UNCONDITIONALLY: both the sensitivity classification of the pending mint write and the pair verdict
     // need to know whether the row exists.
     const live = await readSecret(pass, resource.slug);
+    const team = await teamOf(pass, resource, resource.payload.teamId, liveKey, live);
     // The PAIR's verdict: identity on either member first, then the two states in which the minted token is
     // already unrecoverable.
-    const verdict = addressedTo(resource, gatewayKeyPairRefusal(keySlug ?? "", resource.slug, { key: liveKey, secret: live, secretMarked: hasPendingMarker(live) }, pass.project, pairContext));
+    const verdict = addressedTo(resource, gatewayKeyPairRefusal(keySlug ?? "", resource.slug, { key: liveKey, secret: live, secretMarked: hasPendingMarker(live) }, team, pairContext));
     const identity = refusedRow(resource, verdict);
     if (identity !== undefined)
         return identity;
@@ -440,50 +588,26 @@ async function diffGatewayKeyBackedSecret(resource, gatewayKeyRef, pass) {
         return entry(resource, "update", details, blocked);
     }
     // Steady state writes no token, but the gateway lane still reconciles this Secret's declared INJECTION
-    // RECIPE with a value-less PATCH — same comparator as the ordinary secret arm, so the two cannot drift.
-    if (metadataInjectionChange(declaredInjection(resource), live.injection) !== undefined) {
-        return entry(resource, "update", withDetail(details, INJECTION_RECIPE_CHANGE), blocked);
+    // RECIPE and HOSTS with a value-less PATCH — same comparators as the ordinary secret arm.
+    const metadata = secretMetadataDetail(resource, live);
+    if (metadata !== undefined) {
+        return entry(resource, "update", withDetail(details, metadata), blocked);
     }
     return entry(resource, "no-change", details, blocked);
 }
 async function diffEnvironment(resource, pass) {
     const live = await pass.reads.read("environment", resource.slug);
-    const identity = refusedRow(resource, verdictFor(resource, live, {
-        env: pass.env,
-        project: pass.project,
-    }));
-    // Placement is identity, checked the moment the row is readable.
+    const team = await teamOf(pass, resource, resource.payload.teamId, live);
+    const identity = refusedRow(resource, verdictFor(resource, live, { env: pass.env, ...(team !== undefined ? { team } : {}) }));
+    // A team is identity, checked the moment the row is readable.
     if (identity !== undefined)
         return identity;
     const body = structuredClone(resource.payload);
-    // The secret groups this environment binds are resolved and classified BEFORE the absent-row branch below,
-    // because both binding rules are properties of the DECLARATION, not of whether a live row happens to exist.
-    // Returning `create` the moment the read 404'd made a brand-new environment binding a connection-owned
-    // secret (or binding one secret twice) preview as an ordinary executable create — so apply's pre-flight
-    // solicited an approval, and possibly a docker build and push, for a write reconcile refuses every time.
-    const boundSecrets = [];
+    // The pull credential is resolved and classified BEFORE the absent-row branch below, because the refusal
+    // is a property of the DECLARATION, not of whether a live row happens to exist: a brand-new environment
+    // naming a connection-owned secret must not preview as an ordinary executable create.
     const pullSecrets = [];
-    stampDiffBodyProject(body, pass.project);
-    const egress = body.egressPolicy;
-    for (const rule of egress?.rules ?? []) {
-        for (const binding of rule.credentialBindings ?? []) {
-            if (credentialBindingArm(binding) === "connection") {
-                binding.connectionId = await resolveIdForDiff(binding.connectionId, "connection", pass);
-            }
-            else {
-                // Built from the ref AS AUTHORED, before the resolved id overwrites it, through the ONE helper apply
-                // names the same binding with. Two mirrored builders is how this row came to print
-                // `credential 'Authorization'` for a binding apply refused as `→ secret 'openai'`.
-                const ref = binding.secretId;
-                const secretId = await resolveIdForDiff(ref, "secret", pass);
-                binding.secretId = secretId;
-                boundSecrets.push({
-                    id: secretId,
-                    label: egressCredentialBindingLabel(resource.path, rule.name, ref, binding.header),
-                });
-            }
-        }
-    }
+    stampDiffBodyTeam(body, team);
     // Canonicalize every mount reference for the same reason apply does: apply stores the resolved id, so
     // comparing a slug-authored reference against the stored id would report a swap apply never performs.
     // The durable home is an ordinary `/home` entry, so it is covered here with every other mount.
@@ -506,20 +630,14 @@ async function diffEnvironment(resource, pass) {
     if (typeof providerRef === "string" && providerRef.length > 0) {
         launchSpec.computeProviderId = await resolveIdForDiff(providerRef, "compute-provider", pass);
     }
-    /**
-     * The two groups are classified SEPARATELY, in apply's own order, because the pairwise-distinct rule is
-     * about the egress group alone: merging them would invent a refusal for an environment that legally binds
-     * one secret both as an egress credential and as its registry pull credential.
-     */
-    const classifyBoundSecrets = async (secretRefs) => secretRefs.length === 0
+    const bound = pullSecrets.length === 0
         ? null
         : verdictFor(resource, live, {
             env: pass.env,
-            project: pass.project,
-            resolvedDesired: { secretRefs },
+            ...(team !== undefined ? { team } : {}),
+            resolvedDesired: { secretRefs: pullSecrets },
             reserved: await pass.reserved(),
         });
-    const bound = (await classifyBoundSecrets(boundSecrets)) ?? (await classifyBoundSecrets(pullSecrets));
     if (live === undefined) {
         // A create is still a create — the classification only decides whether it is EXECUTABLE.
         return entry(resource, "create", undefined, blockedOf(bound));
@@ -545,7 +663,8 @@ async function diffConnector(resource, pass) {
         return entry(resource, "create");
     }
     const body = structuredClone(resource.payload);
-    stampDiffBodyProject(body, pass.project);
+    const team = await teamOf(pass, resource, body.teamId, live);
+    stampDiffBodyTeam(body, team);
     for (const field of CONNECTOR_SECRET_WIRE_FIELDS) {
         const ref = body[field];
         if (typeof ref === "string" && ref !== "") {
@@ -556,7 +675,7 @@ async function diffConnector(resource, pass) {
     // After the reference resolution above, so the immutable-field comparison is id-against-id.
     const verdict = verdictFor(resource, liveRecord, {
         env: pass.env,
-        project: pass.project,
+        ...(team !== undefined ? { team } : {}),
         resolvedDesired: body,
     });
     const identity = refusedRow(resource, verdict);
@@ -573,7 +692,8 @@ async function diffConnection(resource, pass) {
         return entry(resource, "create"); // nothing readable ⇒ nothing for the classifier to say (see connector)
     }
     const body = structuredClone(resource.payload);
-    stampDiffBodyProject(body, pass.project);
+    const team = await teamOf(pass, resource, body.teamId, live);
+    stampDiffBodyTeam(body, team);
     const auth = body.auth;
     if (auth !== undefined && typeof auth.secretId === "string" && auth.secretId !== "") {
         auth.secretId = await resolveIdForDiff(auth.secretId, "secret", pass);
@@ -588,7 +708,7 @@ async function diffConnection(resource, pass) {
     // adoption guard, and only the ceremony lane adopts a row it did not create.
     const verdict = verdictFor(resource, liveRecord, {
         env: pass.env,
-        project: pass.project,
+        ...(team !== undefined ? { team } : {}),
         resolvedDesired: { body, ceremonyBacked: isCeremonyBackedConnection(body) },
     });
     const identity = refusedRow(resource, verdict);
@@ -602,7 +722,8 @@ async function diffConnection(resource, pass) {
  */
 async function diffSkill(resource, pass) {
     const liveSkill = await pass.reads.read("skill", resource.slug);
-    const identity = refusedRow(resource, verdictFor(resource, liveSkill, { env: pass.env, project: pass.project }));
+    const team = await teamOf(pass, resource, resource.payload.teamId, liveSkill);
+    const identity = refusedRow(resource, verdictFor(resource, liveSkill, { env: pass.env, ...(team !== undefined ? { team } : {}) }));
     if (identity !== undefined) {
         // Before the file reads, mirroring apply, which classifies before any `POST /files`.
         return identity;
@@ -617,7 +738,8 @@ async function diffSkill(resource, pass) {
 }
 async function diffAgent(resource, pass, factory) {
     const live = await pass.reads.read("agent", resource.slug);
-    const verdict = verdictFor(resource, live, { env: pass.env, project: pass.project });
+    const team = await teamOf(pass, resource, resource.payload.teamId, live);
+    const verdict = verdictFor(resource, live, { env: pass.env, ...(team !== undefined ? { team } : {}) });
     const identity = refusedRow(resource, verdict);
     if (identity !== undefined) {
         // Before the memory-file reads, mirroring apply's classify-before-`POST /files` ordering.
@@ -627,7 +749,7 @@ async function diffAgent(resource, pass, factory) {
         return entry(resource, "create");
     }
     const body = structuredClone(resource.payload);
-    stampDiffBodyProject(body, pass.project);
+    stampDiffBodyTeam(body, team);
     // Mirror apply's label compare and ownership stamp, so an unstamped live agent previews the `update` apply does.
     const labelsMatch = labelsPatch(body.labels, live.labels, { [MANAGED_BY_LABEL_KEY]: factory }) === undefined;
     delete body.labels;
@@ -644,8 +766,8 @@ async function diffAgent(resource, pass, factory) {
     delete body.turnTimeout;
     const standbyCapacityMatch = standbyCapacityUnchanged(body.standbyCapacity, live.standbyCapacity);
     delete body.standbyCapacity;
-    // `projectId` rides this compare harmlessly: the classifier already proved the live stamp IS the declared
-    // project, so it can only ever match here.
+    // `teamId` rides this compare harmlessly: the classifier already proved the live team IS the declared one,
+    // so it can only ever match here.
     delete body.skillIds;
     delete body.memoryFiles;
     const scalarMatch = subsetDeepEqual(body, live);
@@ -668,17 +790,18 @@ async function diffAgent(resource, pass, factory) {
  */
 async function diffPipeline(resource, pass, plan) {
     const live = await pass.reads.read("pipeline", resource.slug);
-    const verdict = verdictFor(resource, live, { env: pass.env, project: pass.project });
+    const team = await teamOf(pass, resource, resource.payload.teamId, live);
+    const verdict = verdictFor(resource, live, { env: pass.env, ...(team !== undefined ? { team } : {}) });
     const identity = refusedRow(resource, verdict);
     if (identity !== undefined)
         return identity;
     if (live === undefined)
         return entry(resource, "create");
-    // An agent or group a gate names is compared as the id the platform stores; one that does not resolve stays
+    // An agent or team a gate names is compared as the id the platform stores; one that does not resolve stays
     // as written and so reads as a change, which apply then refuses by name.
     const payload = await resolveGateReferences(resource.payload, {
         agent: (ref) => resolveIdForDiff(ref, "agent", pass),
-        group: async (ref) => (await getBySlugOrUndefined(() => pass.apis.groups.getGroup({ id: ref })))?.id ?? ref,
+        team: async (ref) => (await getBySlugOrUndefined(() => pass.apis.teams.getTeam({ id: ref })))?.id ?? ref,
     });
     const entries = pipelineEntryChange(payload, live, plan.factory);
     const listsWorkflows = (payload.workflows ?? []).length > 0 || !entriesUnchanged(entries);
@@ -748,7 +871,13 @@ async function contentRefsUnchanged(desired, liveRefs, apis) {
 async function orphanReport(plan, apis, cap) {
     const prefix = `${plan.factory}-`;
     const kinds = [
-        { kind: "project", list: (page, limit) => apis.projects.listProjects({ page, limit }) },
+        {
+            kind: "team",
+            list: async (page, limit) => {
+                const result = await apis.teams.listTeams({ page, limit });
+                return { data: result.data, page, limit, total: result.total ?? result.data.length };
+            },
+        },
         { kind: "gateway-key", list: (page, limit) => apis.gatewayKeys.listGatewayKeys({ page, limit }) },
         {
             kind: "model-provider-key",
@@ -840,8 +969,13 @@ async function getModelByKind(pass, kind, id) {
  */
 async function readByKind(apis, kind, id) {
     switch (kind) {
-        case "project":
-            return getBySlugOrUndefined(() => apis.projects.getProject({ id }));
+        case "team":
+            return getBySlugOrUndefined(() => apis.teams.getTeam({ id }));
+        case "role":
+            return getBySlugOrUndefined(() => apis.roles.getRole({ id }));
+        // A principal's rows are read through its membership, never by id.
+        case "team-membership":
+            return undefined;
         case "secret":
             return getBySlugOrUndefined(() => apis.secrets.getSecret({ id }));
         case "environment":