@orchestraworks/cli 0.5.4 → 0.5.7

package/dist/constructs/egress-preset.js

@@ -1,36 +1,12 @@
-// A preset carries only anonymous rules: credentialed rules ride the connection (`connection.egressPolicy()`)
-// or a Secret-bound rule the author writes. A rule that declares no credential injects nothing AND strips
-// nothing at the edge, so the agent's own headers ride through byte-for-byte — which is what makes an OCI
-// bearer-challenge pull (Docker Hub, GHCR: the client fetches its own anonymous token and presents it) work
-// here with no special casing. Row names are contract, not decoration: a consumer may select against a bundle
-// by name with an ordinary array filter, so renaming a row breaks that consumer and the two move together.
-// `connection.egressPolicy()` returns the SAME bundle type an anonymous preset does, but some of its entries
-// must carry the connection's credential. That credential cannot be a field on `PresetRule`: TypeScript is
-// structural, so a public `connectionId` field would let any app write an object literal binding a
-// connection's credential to hosts of its choosing. So it rides a module-private class instead — unexported,
-// its constructor gated on a module-private token, and holding the credential in a `#private` field (a
-// Symbol-keyed property would survive `structuredClone`/spread and could be re-attached to a hand-built
-// object) with every own field frozen at mint. A lookalike is therefore not rejected: it simply is not one of
-// these, so `applyPreset` folds it as the ordinary anonymous rule its fields describe — the worst an author
-// can express by hand is a rule with no credential at all.
+// A rule is a network rule only: a credential is presented by its own `hosts`, never by a rule. Row names are
+// contract, not decoration: a consumer may select against a bundle by name with an ordinary array filter, so
+// renaming a row breaks that consumer and the two move together.
 /**
- * @internal — strictly above the preset's 100, so a connection's credentialed rule always wins a host an
- * anonymous preset row also opens, and equal to itself, so two connections' bundles tie deliberately
- * (attribution, not priority, arbitrates between them).
- *
- * It lives in this module, which imports nothing at runtime, because both `environment.ts` and `connection.ts`
- * read it and neither may import the other.
+ * @internal — strictly above the preset's 100, so a connection's rule wins a host an anonymous preset row
+ * also opens. It lives in this module, which imports nothing at runtime, because both `environment.ts` and
+ * `connection.ts` read it.
  */
 export const CONNECTION_RULE_PRIORITY = 300;
-/**
- * @internal — the two reserved suffixes of the credentialed/credential-free host split. The author-declared
- * split (`allow(connection, { credentialHosts })`) emits BOTH, because its base name is the author's own
- * `name:` and neither partition may quietly take it. The catalog-declared one (`connection.egressPolicy()`)
- * emits only `-credential-free`, because there the base name is derived and the bundle must claim it — that
- * ownership is the fence keeping a retained `allow(connection)` from coexisting with a bundle.
- */
-export const CREDENTIAL_RULE_SUFFIX = "-credential";
-export const CREDENTIAL_FREE_RULE_SUFFIX = "-credential-free";
 /**
  * @internal — declared here rather than inline at their one mint site because the whole set is a single
  * reserved vocabulary (see {@link CONNECTION_RULE_SUFFIXES}): a tail spelled in one file and reserved in
@@ -49,73 +25,13 @@ export const ARCHIVE_RULE_SUFFIX = "-archive";
  * second, and it reports a duplicate rule when the thing that can actually be changed is the connection's
  * slug. With it the derived names are collision-free by construction, because a collision between distinct
  * labels would require one suffix here to be a proper suffix of another, and none is (pinned by a test, so a
- * sixth tail cannot quietly break the argument).
+ * fourth tail cannot quietly break the argument).
  */
 export const CONNECTION_RULE_SUFFIXES = Object.freeze([
-    CREDENTIAL_RULE_SUFFIX,
-    CREDENTIAL_FREE_RULE_SUFFIX,
     GIT_READ_RULE_SUFFIX,
     GIT_WRITE_RULE_SUFFIX,
     ARCHIVE_RULE_SUFFIX,
 ]);
-/**
- * @internal — the platform's placeholder for the connection's fully-shaped `Authorization` value: at hydration
- * the broker derives the scheme from the connection's auth mode and the provider catalog's carriage
- * declaration, rather than from a scheme this SDK hardcoded.
- */
-export const AUTHORIZATION_TEMPLATE = "${authorization}";
-/**
- * Never exported and never written onto anything, so the only way to hold it is to be code in this file —
- * which is why `Reflect.construct(entry.constructor, [anything, …])` cannot produce a credentialed entry even
- * though an app can reach the constructor through an entry it legitimately holds.
- */
-const MINT_TOKEN = Symbol("orchestra.connectionEgressRule");
-function frozenCopy(values) {
-    return Object.freeze([...values]);
-}
-class ConnectionEgressRule {
-    name;
-    action = "allow";
-    hosts;
-    priority;
-    paths;
-    methods;
-    #credential;
-    constructor(token, fields) {
-        if (token !== MINT_TOKEN) {
-            throw new Error("a connection-credentialed egress rule is minted only by `connection.egressPolicy()`, from the " +
-                "provider catalog's own declaration. Build the bundle you want with `egressPreset.*()` (anonymous " +
-                "rules) or author the rule with `EgressPolicy.allow(...)`, which is where a credential you own is " +
-                "bound.");
-        }
-        this.name = fields.name;
-        this.hosts = frozenCopy(fields.hosts);
-        this.priority = fields.priority;
-        this.paths = frozenCopy(fields.paths);
-        this.methods = frozenCopy(fields.methods);
-        this.#credential = Object.freeze({ ...fields.credential });
-        Object.freeze(this);
-    }
-    /**
-     * The ONE reader, so nothing outside this file can pull a credential off an entry or decide what counts as
-     * one. `instanceof` alone is satisfied by `Object.create(Object.getPrototypeOf(entry))`, which never ran
-     * this constructor and carries no credential — reading `#credential` off it would throw a bare `TypeError`
-     * instead of degrading — so the private-field brand is checked too.
-     */
-    static credentialOf(entry) {
-        if (!(entry instanceof ConnectionEgressRule) || !(#credential in entry))
-            return undefined;
-        return { ...entry.#credential };
-    }
-}
-/** @internal — the single call site is `connection.egressPolicy()`, which composes every field from catalog data. */
-export function connectionCredentialedRule(fields) {
-    return new ConnectionEgressRule(MINT_TOKEN, fields);
-}
-/** @internal */
-export function connectionCredentialOf(entry) {
-    return ConnectionEgressRule.credentialOf(entry);
-}
 /** Deliberately below every band shipped policies use, so anything an app declares beside a preset wins the
  *  same host without the author reasoning about numbers. */
 const PRESET_PRIORITY = 100;

package/dist/constructs/environment.d.ts

@@ -2,24 +2,15 @@ import { Construct } from "../core/construct.js";
 import type { PlanResource } from "../core/plan.js";
 import { type Connection, type IConnection } from "./connection.js";
 import { type EgressRuleBundle } from "./egress-preset.js";
-import type { IComputeProvider, ICredentialBinding, IEnvironment, IImage, ISecret, IVolume } from "./interfaces.js";
+import type { IComputeProvider, ICredentialBinding, IEnvironment, IImage, ISecret, ITeam, IVolume } from "./interfaces.js";
 import { type InjectionRecipeProps } from "./secret.js";
-/** Binding a recipe-carrying secret this way is a valid presentation choice — the binding determines
- *  application. */
+/** @deprecated A rule carries no credential: declare `hosts` and `injection` on the Secret instead. */
 export declare function bearer(header: string, secret: ISecret): ICredentialBinding;
+/** @deprecated A rule carries no credential: declare `hosts` and `injection` on the Secret instead. */
 export declare function basic(header: string, secret: ISecret): ICredentialBinding;
-/**
- * Injects `<header>: <secret>` verbatim with no scheme prefix, for a provider-specific header whose value is
- * the secret as-is.
- */
+/** @deprecated A rule carries no credential: declare `hosts` and `injection` on the Secret instead. */
 export declare function header(name: string, secret: ISecret): ICredentialBinding;
-/**
- * OVERRIDES the secret's own recipe wholesale at the broker — replace, never merge. The recipe is validated
- * and normalized once here and the producer hands out a deep copy each call, so a caller cannot mutate the
- * validated recipe after `allow()` to smuggle an unvalidated header past synth validation. There is
- * deliberately no recipe-presence check on `secret`: overriding a recipe-less secret is the whole point, since
- * the bare secret means "use the secret's own recipe" and `inject()` means "use THIS one".
- */
+/** @deprecated A rule carries no credential: declare `hosts` and `injection` on the Secret instead. */
 export declare function inject(secret: ISecret, recipe: InjectionRecipeProps): ICredentialBinding;
 /**
  * The hosted platform's gateway. It lives here rather than beside the CLI's platform address so the construct
@@ -29,33 +20,14 @@ export declare const DEFAULT_MODEL_GATEWAY_HOST = "models.orchestraworks.ai";
 export interface AllowConnectionOptions {
     priority?: number;
     name?: string;
-    /**
-     * Path globs the credentialed grant is scoped to (default `["*"]`) — the same field and the same matching as
-     * {@link AllowRuleOptions.paths}. It expresses what no combination of `credentialHosts` and a deny can: that
-     * split is per-HOST, and "every repository except this one" is not a path prefix. When the split option is
-     * also given, BOTH emitted rules carry these paths — one grant, one path scope, partitioned by host.
-     */
+    /** Path globs the grant is scoped to (default `["*"]`), matched as {@link AllowRuleOptions.paths} are. */
     paths?: string[];
     /**
-     * Splits the provider's hosts into a credentialed subset and a credential-free remainder, for a provider
-     * that publishes an api host needing the connection credential beside one that must be reached WITHOUT it
-     * (Jira Forge's site host serves an unauthenticated cloudId hop, and injecting the captured app token there
-     * would push a live credential at a host that never asks for one).
-     *
-     * Entries are matched against the connection's **fully interpolated** `provider.apiHosts`, so name
-     * `team.acme.net`, never the `{siteUrl}` pattern. The builder emits `${name}-credential` over exactly that
-     * subset and `${name}-credential-free` over the rest (omitted when the remainder is empty), preserving
-     * declaration order in both; omitting the option is one rule, the unsuffixed name, every host credentialed.
+     * @deprecated A synth error: a rule carries no credential. The connection's own `hosts` choose the catalog
+     * hosts its credential is presented on.
      */
-    credentialHosts?: string[];
+    credentialHosts?: unknown;
 }
-/**
- * Bind injected credentials with exactly one of `credential` (a single entry) or `credentials` (a non-empty
- * list, for a rule that must inject more than one header on the same request); omit both for a
- * credential-free allow rule. Each entry is an {@link ICredentialBinding} — a bare `Secret` whose own
- * `injection` recipe supplies the headers, or a `bearer`/`basic`/`header`/`inject` factory result. The
- * interface is the contract: a plain object literal is not a binding.
- */
 export interface AllowRuleOptions {
     hosts: string[];
     priority: number;
@@ -66,14 +38,18 @@ export interface AllowRuleOptions {
      * broader allow rule being added beside it.
      */
     methods?: string[];
-    credential?: ICredentialBinding;
-    credentials?: ICredentialBinding[];
+    /**
+     * @deprecated A synth error: a rule carries no credential. The Secret declares the hosts it is presented on
+     * and its `injection` recipe; the error names both.
+     */
+    credential?: unknown;
+    /** @deprecated A synth error, as {@link AllowRuleOptions.credential} is. */
+    credentials?: unknown;
 }
 /**
  * A deny rule is host-scoped like an allow rule and additionally narrowed by `paths` and `methods`, which is
  * what makes a *partial* prohibition expressible: deny the mutating methods on one provider path family while
- * the allow rule beside it keeps serving every other request to the same host. It binds no credential, and
- * there is deliberately no spelling for one — a denied request never leaves, so there is nothing to inject.
+ * the allow rule beside it keeps serving every other request to the same host.
  */
 export interface DenyRuleOptions {
     hosts: string[];
@@ -84,7 +60,7 @@ export interface DenyRuleOptions {
     paths?: string[];
     methods?: string[];
     /**
-     * Defaults to {@link DEFAULT_DENY_PRIORITY}, above the band the credentialed allow rules use, so a deny
+     * Defaults to {@link DEFAULT_DENY_PRIORITY}, above the band the connection allow rules use, so a deny
      * authored without a priority actually denies rather than losing to the allow it was written to fence. Ties
      * are safe either way — the matcher picks the deny among equal-priority matches — but a deny that must
      * *lose* to a specific allow is an ordering the author states explicitly.
@@ -92,7 +68,10 @@ export interface DenyRuleOptions {
     priority?: number;
 }
 export interface RouteModelsViaGatewayOptions {
-    /** The Secret whose value is `SecretValue.fromGatewayKey(<GatewayKey>)`, declared or imported. */
+    /**
+     * The Secret whose value is `SecretValue.fromGatewayKey(<GatewayKey>)`, declared or imported. A declared one
+     * must cover `host` in its `hosts` and carry an `injection` header.
+     */
     key: ISecret;
     /**
      * Defaults to {@link DEFAULT_MODEL_GATEWAY_HOST}. A customer-run install passes the host of its own
@@ -117,9 +96,9 @@ export declare class EgressPolicy {
     private constructor();
     static denyAll(): EgressPolicy;
     /**
-     * Allows every host no rule matches. Rules fold onto it exactly as onto {@link denyAll}: a credentialed
-     * allow rule still injects its credential at the edge, and a deny still refuses. It opens hosts, not
-     * ports: the ports the edge answers on are the same under either starting point.
+     * Allows every host no rule matches. Rules fold onto it exactly as onto {@link denyAll}, and a deny still
+     * refuses. It opens hosts, not ports: the ports the edge answers on are the same under either starting
+     * point.
      */
     static allowAll(): EgressPolicy;
     /**
@@ -129,16 +108,15 @@ export declare class EgressPolicy {
      * step the first time a future mint site pushed a rule without claiming, leaving that rule on the wire and
      * invisible to the check. Deliberately order-blind, so applying one preset twice is an error too, and
      * checked BEFORE the rule's shape normalizers, because the name is the rule's identity — except where a
-     * mint site cannot know its names that early (the `credentialHosts` split) or has already refused the entry
-     * outright. `fix` is the one sentence that differs per mint site.
+     * mint site has already refused the entry outright. `fix` is the one sentence that differs per mint site.
      */
     private claimRuleName;
     allow(name: string, rule: AllowRuleOptions): EgressPolicy;
     /**
      * Grants outbound access to a {@link Connection}'s provider: the provider descriptor's `apiHosts`, each
-     * `{param}` interpolated from the connection's install block, with an `Authorization` binding carrying the
-     * connection's broker-resolved credential. The rule name defaults to `connection-<slug-or-id>`, which is
-     * deterministic for unchanged-apply stability.
+     * `{param}` interpolated from the connection's install block. The rule carries no credential; the connection
+     * is presented on the catalog hosts its own `hosts` cover. The rule name defaults to
+     * `connection-<slug-or-id>`, which is deterministic for unchanged-apply stability.
      */
     allow(connection: Connection | IConnection, opts?: AllowConnectionOptions): EgressPolicy;
     /**
@@ -146,21 +124,20 @@ export declare class EgressPolicy {
      * host, everything on that host is open, and a deny carves a hole back out of it while the allow beside it
      * serves the rest. **Deny wins among equal-priority matches**, so it can never lose a tie, but it CAN lose
      * to a strictly higher-priority allow — which is why its default priority sits above the band the
-     * credentialed allow rules use. A denied request fails closed at the broker and the credential the allow
-     * would have injected is never resolved: a fence at the network edge, not a narrowing of what the agent may
-     * see or ask for. Both `paths` and `methods` default to `["*"]`, so `deny(name, { hosts })` is a total
+     * connection allow rules use. A denied request fails closed at the broker before any credential is
+     * resolved: a fence at the network edge, not a narrowing of what the agent may see or ask for. Both `paths` and `methods` default to `["*"]`, so `deny(name, { hosts })` is a total
      * revocation on a host an allow rule opens; narrow at least one when the intent is partial.
      */
     deny(name: string, rule: DenyRuleOptions): EgressPolicy;
     /**
-     * Routes this environment's model traffic through the model gateway with a gateway key: one ordinary allow
-     * rule named `model-gateway` on the gateway host, whose binding adds `Authorization: Bearer <key>`. The rule
-     * only adds the key; the harness learns the gateway address from the agent's
-     * `modelSettings.enableModelGateway`, which an app routing through the gateway sets as well.
-     *
-     * `inject()` rather than `bearer()` because the runtime image bakes an `ANTHROPIC_API_KEY` placeholder the
-     * claude harness sends as `x-api-key`, and the gateway refuses a request whose two key headers disagree.
-     * `removeHeaders` strips the placeholder before injection; the other harnesses never send it.
+     * Routes this environment's model traffic through the model gateway: one ordinary allow rule named
+     * `model-gateway` on the gateway host. The key is presented by its own Secret, which declares the gateway
+     * host in its `hosts` and an `injection` recipe — `Authorization: Bearer ${secret}`, removing `x-api-key`,
+     * because the runtime image bakes an `ANTHROPIC_API_KEY` placeholder the claude harness sends as `x-api-key`
+     * and the gateway refuses a request whose two key headers disagree. A declared key is checked for both at
+     * synth; an imported one cannot be read here and is the platform's to check. The harness learns the gateway
+     * address from the agent's `modelSettings.enableModelGateway`, which an app routing through the gateway sets
+     * as well.
      */
     routeModelsViaGateway(opts: RouteModelsViaGatewayOptions): EgressPolicy;
     /**
@@ -169,17 +146,15 @@ export declare class EgressPolicy {
      * hand: there is nothing to learn about presets when reading a plan, a diff, or the live environment.
      *
      * Rules are appended where the call sits in the chain, and the matcher arbitrates by priority first (preset
-     * rows sit below every band shipped policies use) and by declaration order only among equal-priority ties,
-     * where a credentialed rule outranks a zero-binding one — so a preset's anonymous row can never shadow an
-     * author's credentialed rule for the same host. A name collision is a synth error, so applying a preset over
-     * a rule you already named fails, and so does applying the same preset twice.
+     * rows sit below every band shipped policies use) and by declaration order only among equal-priority ties.
+     * A name collision is a synth error, so applying a preset over a rule you already named fails, and so does
+     * applying the same preset twice.
      */
     applyPreset(bundle: EgressRuleBundle): EgressPolicy;
     /**
-     * Every emitted array is FRESH — `hosts`/`paths` are copied out of the stored rule and
-     * `credentialBindingsFor` builds new literals — so the payload shares no mutable structure with the policy.
-     * Without the copy, mutating one synthesized plan's `rules[i].hosts` would mutate the stored rule and every
-     * later synth would emit the mutation.
+     * Every emitted array is FRESH — `hosts`/`paths`/`methods` are copied out of the stored rule — so the payload
+     * shares no mutable structure with the policy. Without the copy, mutating one synthesized plan's
+     * `rules[i].hosts` would mutate the stored rule and every later synth would emit the mutation.
      */
     _toPayload(): unknown;
 }
@@ -326,6 +301,8 @@ export interface EnvironmentProps {
     computeProvider?: IComputeProvider | null;
     slug?: string;
     name?: string;
+    /** Fixed at create; undeclared, the environment is created in Shared. */
+    team?: ITeam;
 }
 export declare class Environment extends Construct implements IEnvironment {
     /** Accepts a platform id or a slug interchangeably — one rule, stated on `IResource`. */