@orchestraworks/cli 0.5.5 → 0.5.7

package/dist/engine/gateway-key-reconcile.d.ts

@@ -1,6 +1,6 @@
 import type { InjectionRecipe } from "@orchestraworks/client";
 import type { PlanDocument, PlanResource } from "../core/plan.js";
-import { type ApplyOutcome, type PendingSecretWrite } from "./apply-core.js";
+import { type ApplyOutcome, type DesiredTeam, type PendingSecretWrite, type TeamResolver } from "./apply-core.js";
 import { type PlatformApis } from "./client.js";
 import { PreflightError } from "./preflight.js";
 /**
@@ -17,7 +17,7 @@ export { PENDING_GATEWAY_KEY_TOKEN_LABEL_KEY } from "./refusals.js";
 export declare const PENDING_GATEWAY_KEY_SECRET_PLACEHOLDER = "orchestra:pending-gateway-key-token";
 /**
  *   - `steady`      — key and Secret present without the marker: nothing to mint, though declared drift on
- *                     either still PATCHes. A project-stamp mismatch never reaches here.
+ *                     either still PATCHes. A team mismatch never reaches here.
  *   - `mint-adopt`  — key absent, Secret present without the marker — the normal state right after a
  *                     slug-rename rotation.
  *   - `mint-resume` — key absent, Secret present WITH the marker: a previous apply completed the pre-mint
@@ -28,7 +28,7 @@ export type GatewayKeyAction = "steady" | "mint-new" | "mint-adopt" | "mint-resu
 export interface LiveGatewayKey {
     id: string;
     slug?: string;
-    projectId?: string;
+    teamId?: string;
     displayName?: string;
     monthlyCreditCap?: number;
     labels?: Record<string, string>;
@@ -36,8 +36,9 @@ export interface LiveGatewayKey {
 /** Only the fields this lane compares; the pending marker rides `labels`. */
 export interface LiveSecretRow {
     id: string;
-    projectId?: string;
+    teamId?: string;
     injection?: InjectionRecipe;
+    hosts?: string[];
     labels?: Record<string, string>;
 }
 /** Value-free. */
@@ -50,6 +51,8 @@ export interface GatewayKeyDecision {
     readonly secretSlug: string;
     readonly liveKey?: LiveGatewayKey;
     readonly liveSecret?: LiveSecretRow;
+    /** The pair's one team, which a mint's two creates carry. */
+    readonly team?: DesiredTeam;
 }
 /**
  * For the unrecoverable states detected DURING the write; the pre-write ones come from the aggregate
@@ -63,12 +66,12 @@ export declare class GatewayKeyRotationError extends PreflightError {
  * Reads only, and runs BEFORE the consolidated credential confirmation, so an author is never asked to
  * approve a write that cannot work.
  *
- * It is also the ONE place this lane settles project identity, comparing BOTH readable pair members so
+ * It is also the ONE place this lane settles team identity, comparing BOTH readable pair members so
  * `steady`, `mint-adopt` and `mint-resume` are covered by one check rather than three per-branch ones —
- * `mint-resume` in particular is how a mint into project B while the marked Secret sits in project A would
- * otherwise slip through.
+ * `mint-resume` in particular is how a mint into team B while the marked Secret sits in team A would
+ * otherwise slip through. Synth places both members in one team, so the key's team is the pair's.
  */
-export declare function decideGatewayKeys(plan: PlanDocument, apis: PlatformApis, outcomes: ApplyOutcome[], projectId: string | undefined): Promise<GatewayKeyDecision[]>;
+export declare function decideGatewayKeys(plan: PlanDocument, apis: PlatformApis, outcomes: ApplyOutcome[], teams: TeamResolver): Promise<GatewayKeyDecision[]>;
 /** A `steady` pair writes no credential material and contributes no row. */
 export declare function gatewayKeyPendingWrites(decisions: GatewayKeyDecision[], organizationId: string | undefined): PendingSecretWrite[];
 /**
@@ -76,4 +79,4 @@ export declare function gatewayKeyPendingWrites(decisions: GatewayKeyDecision[],
  * `secret` outcomes and registers both ids, because `applySecrets` deliberately skips a gateway-key-backed
  * Secret: this lane owns its whole write.
  */
-export declare function writeGatewayKeys(decisions: GatewayKeyDecision[], apis: PlatformApis, outcomes: ApplyOutcome[], applied: Map<string, string>, projectId: string | undefined, factory: string): Promise<void>;
+export declare function writeGatewayKeys(decisions: GatewayKeyDecision[], apis: PlatformApis, outcomes: ApplyOutcome[], applied: Map<string, string>, factory: string): Promise<void>;

package/dist/engine/gateway-key-reconcile.js

@@ -3,7 +3,7 @@
 //
 // The write order per key is fixed: (1) make the paired Secret DETECTABLY PENDING — a new one is POSTed with
 // a placeholder value and the reserved marker key, which also reserves the org-unique slug so a Secret hidden
-// behind a project fence surfaces as a 409 before anything irreversible happens, while an adopted one takes a
+// from this key surfaces as a 409 before anything irreversible happens, while an adopted one takes a
 // labels-only PATCH that leaves its value and every existing entry intact; (2) only once that succeeded,
 // mint; (3) one PATCH replaces the value with the token and removes the marker.
 //
@@ -12,12 +12,12 @@
 // named rotation error fires rather than trusting a Secret holding a placeholder or a stale token.
 import { gatewayKeyRefOf } from "../core/gateway-key-recipe.js";
 import { refToken } from "../core/tokens.js";
-import { credentialValueWritten, desiredProjectOf, driftedFields, failing, getBySlugOrUndefined, pushOutcome, } from "./apply-core.js";
+import { credentialValueWritten, driftedFields, failing, getBySlugOrUndefined, pushOutcome, stampTeam, } from "./apply-core.js";
 import { PENDING_GATEWAY_KEY_TOKEN_LABEL_KEY, refuseIf } from "./refusals.js";
 import { httpStatusOf } from "./client.js";
 import { PreflightError } from "./preflight.js";
 import { createLabels, labelsPatch, MANAGED_BY_LABEL_KEY } from "../core/labels.js";
-import { metadataInjectionChange, pendingSecretWrite, reconcileInjection } from "./secrets-apply.js";
+import { declaredSecretHosts, metadataHostsChange, metadataInjectionChange, pendingSecretWrite, reconcileInjection, } from "./secrets-apply.js";
 /**
  * The reserved marker rides the ordinary labels wire field — never smuggled into the write-only value or a
  * second column — and is removed by the final token PATCH. It lives in a leaf module because the aggregate
@@ -45,25 +45,25 @@ export class GatewayKeyRotationError extends PreflightError {
  * Reads only, and runs BEFORE the consolidated credential confirmation, so an author is never asked to
  * approve a write that cannot work.
  *
- * It is also the ONE place this lane settles project identity, comparing BOTH readable pair members so
+ * It is also the ONE place this lane settles team identity, comparing BOTH readable pair members so
  * `steady`, `mint-adopt` and `mint-resume` are covered by one check rather than three per-branch ones —
- * `mint-resume` in particular is how a mint into project B while the marked Secret sits in project A would
- * otherwise slip through.
+ * `mint-resume` in particular is how a mint into team B while the marked Secret sits in team A would
+ * otherwise slip through. Synth places both members in one team, so the key's team is the pair's.
  */
-export async function decideGatewayKeys(plan, apis, outcomes, projectId) {
-    // Apply only ever reaches the comparison with a resolved project (or none at all); `pending-managed` is
-    // the diff path's state.
-    const desired = desiredProjectOf(projectId);
+export async function decideGatewayKeys(plan, apis, outcomes, teams) {
     const decisions = [];
     for (const resource of plan.resources) {
         if (resource.kind !== "gateway-key")
             continue;
         const slug = resource.slug;
+        const declared = await teams.desired(resource.payload.teamId, { kind: "gateway-key", slug, op: "get" }, outcomes);
         const secretResource = pairedSecretResource(plan, resource);
         const secretSlug = secretResource.slug;
         const liveKey = await failing(() => getBySlugOrUndefined(() => apis.gatewayKeys.getGatewayKey({ id: slug })), { kind: "gateway-key", slug, op: "get" }, outcomes);
         const liveSecret = await failing(() => getBySlugOrUndefined(() => apis.secrets.getSecret({ id: secretSlug })), { kind: "secret", slug: secretSlug, op: "get" }, outcomes);
         const marked = liveSecret !== undefined && hasPendingMarker(liveSecret);
+        const surface = { kind: "gateway-key", slug, op: "get" };
+        const desired = await teams.judged(await teams.judged(declared, liveKey, surface, outcomes), liveSecret, surface, outcomes);
         // Every pre-write refusal goes through the ONE aggregate classifier, and an absent member has no
         // identity to conflict with, so a first mint is untouched. It raises the CONCRETE identity class rather
         // than a `PreflightError` saying the same thing: `reconcile()`'s outer catch passes an `ApplyError`
@@ -73,7 +73,7 @@ export async function decideGatewayKeys(plan, apis, outcomes, projectId) {
         // No `env` is supplied: a gateway key's value comes from the MINT and never the environment, so this
         // lane holds no source evidence and the classifier's source arms are gated off by that absence.
         refuseIf("gateway-key", resource, {
-            project: desired,
+            ...(desired !== undefined ? { team: desired } : {}),
             live: { key: liveKey, secret: liveSecret, secretMarked: marked },
             gatewayPair: { kind: "gateway-key-secret", gatewayKeySlug: slug, secretSlug },
         }, outcomes);
@@ -86,6 +86,7 @@ export async function decideGatewayKeys(plan, apis, outcomes, projectId) {
             secretSlug,
             ...(liveKey !== undefined ? { liveKey } : {}),
             ...(liveSecret !== undefined ? { liveSecret } : {}),
+            ...(desired !== undefined ? { team: desired } : {}),
         });
     }
     return decisions;
@@ -111,7 +112,7 @@ export function gatewayKeyPendingWrites(decisions, organizationId) {
  * `secret` outcomes and registers both ids, because `applySecrets` deliberately skips a gateway-key-backed
  * Secret: this lane owns its whole write.
  */
-export async function writeGatewayKeys(decisions, apis, outcomes, applied, projectId, factory) {
+export async function writeGatewayKeys(decisions, apis, outcomes, applied, factory) {
     // The ONE place a minted token exists, scoped to this call and cleared unconditionally.
     const tokens = new Map();
     try {
@@ -120,7 +121,7 @@ export async function writeGatewayKeys(decisions, apis, outcomes, applied, proje
                 await applySteadyGatewayKey(decision, apis, outcomes, applied);
                 continue;
             }
-            await mintGatewayKey(decision, apis, outcomes, applied, projectId, tokens, factory);
+            await mintGatewayKey(decision, apis, outcomes, applied, tokens, factory);
         }
     }
     finally {
@@ -128,9 +129,9 @@ export async function writeGatewayKeys(decisions, apis, outcomes, applied, proje
     }
 }
 /**
- * Nothing is minted; the only writes are ordinary drift reconciliation. Neither carries `projectId`, and
- * neither needs to: the decide phase refuses a placement mismatch on either pair member before this runs, so
- * a placement reaching here is by construction the declared one.
+ * Nothing is minted; the only writes are ordinary drift reconciliation. Neither carries a team, and neither
+ * needs to: the decide phase refuses a team mismatch on either pair member before this runs, so a team
+ * reaching here is by construction the declared one.
  */
 async function applySteadyGatewayKey(decision, apis, outcomes, applied) {
     const live = decision.liveKey;
@@ -148,30 +149,34 @@ async function applySteadyGatewayKey(decision, apis, outcomes, applied) {
         action = "updated";
     }
     pushOutcome(outcomes, applied, decision.resource, live.id, action);
-    // The paired Secret needs no value write in steady state, but an injection-recipe edit still reconciles
-    // through a recipe-only PATCH — exactly what `applySecrets` would have done had this lane not owned it.
+    // The paired Secret needs no value write in steady state, but a recipe or hosts edit still reconciles
+    // through a value-less PATCH — exactly what `applySecrets` would have done had this lane not owned it.
     const liveSecret = decision.liveSecret;
     const injectionChange = metadataInjectionChange(secretInjection(decision.secretResource), liveSecret.injection);
+    const hostsChange = metadataHostsChange(declaredSecretHosts(decision.secretResource.payload), liveSecret.hosts);
     let secretAction = "unchanged";
-    if (injectionChange !== undefined) {
-        const body = { injection: injectionChange.injection };
+    if (injectionChange !== undefined || hostsChange !== undefined) {
+        const body = { ...injectionChange, ...hostsChange };
         await failing(() => apis.secrets.updateSecret({ id: liveSecret.id, updateSecretRequest: body }), { kind: "secret", slug: decision.secretSlug, op: "update" }, outcomes);
         secretAction = "updated";
     }
     pushOutcome(outcomes, applied, decision.secretResource, liveSecret.id, secretAction);
 }
 /**
- * The three minting paths, sharing steps 2 and 3. Only the CREATE bodies carry `projectId`, because a create
- * is where a stamp is placed; neither PATCH carries one, and neither needs to, since the decide phase already
- * refused every readable member whose live stamp is not the declared project.
+ * The three minting paths, sharing steps 2 and 3. Only the CREATE bodies carry a team, because a create is
+ * where a team is chosen; neither PATCH carries one, and neither needs to, since the decide phase already
+ * refused every readable member whose live team is not the declared one.
  */
-async function mintGatewayKey(decision, apis, outcomes, applied, projectId, tokens, factory) {
+async function mintGatewayKey(decision, apis, outcomes, applied, tokens, factory) {
     const payload = decision.resource.payload;
+    const placement = {};
+    stampTeam(placement, decision.team);
     const refKey = refToken("gateway-key", decision.resource.path.split("/"));
     // The FINAL patch removes the pending marker and stamps ownership; the merge keeps every caller-authored entry
     // an adopted Secret carries.
     const finalLabels = { [MANAGED_BY_LABEL_KEY]: factory, [PENDING_GATEWAY_KEY_TOKEN_LABEL_KEY]: null };
     const declaredInjection = secretInjection(decision.secretResource);
+    const declaredHosts = declaredSecretHosts(decision.secretResource.payload);
     // (1) Make the paired Secret detectably pending BEFORE the mint.
     let secretId;
     if (decision.action === "mint-new") {
@@ -181,8 +186,9 @@ async function mintGatewayKey(decision, apis, outcomes, applied, projectId, toke
             description: decision.secretResource.payload.description,
             value: PENDING_GATEWAY_KEY_SECRET_PLACEHOLDER,
             labels: { [PENDING_GATEWAY_KEY_TOKEN_LABEL_KEY]: decision.slug },
-            ...(projectId !== undefined ? { projectId } : {}),
+            ...placement,
             ...(declaredInjection !== undefined ? { injection: declaredInjection } : {}),
+            ...(declaredHosts !== undefined ? { hosts: declaredHosts } : {}),
         };
         const created = await failing(() => apis.secrets.createSecret({ createSecretRequest: createBody }), { kind: "secret", slug: decision.secretSlug, op: "create" }, outcomes);
         secretId = created.id;
@@ -192,7 +198,7 @@ async function mintGatewayKey(decision, apis, outcomes, applied, projectId, toke
         secretId = liveSecret.id;
         if (decision.action === "mint-adopt") {
             // Labels ONLY: `value` is omitted so the live credential survives a failure here and no token can be
-            // stranded, and `projectId` is omitted because a placement is identity rather than drift.
+            // stranded, and the team is omitted because a team is identity rather than drift.
             await patchSecretPendingMarker(apis, outcomes, decision.secretSlug, secretId, {
                 [MANAGED_BY_LABEL_KEY]: factory,
                 [PENDING_GATEWAY_KEY_TOKEN_LABEL_KEY]: decision.slug,
@@ -209,13 +215,13 @@ async function mintGatewayKey(decision, apis, outcomes, applied, projectId, toke
                     displayName: payload.displayName,
                     labels: createLabels(payload.labels, { [MANAGED_BY_LABEL_KEY]: factory }),
                     ...(payload.monthlyCreditCap !== undefined ? { monthlyCreditCap: payload.monthlyCreditCap } : {}),
-                    ...(projectId !== undefined ? { projectId } : {}),
+                    ...placement,
                 },
             });
         }
         catch (error) {
             if (httpStatusOf(error) === 409)
-                throw projectFenceRefusal(decision.slug);
+                throw hiddenOrRevokedSlugRefusal(decision.slug);
             throw error;
         }
     }, { kind: "gateway-key", slug: decision.slug, op: "create" }, outcomes);
@@ -228,9 +234,11 @@ async function mintGatewayKey(decision, apis, outcomes, applied, projectId, toke
         updateSecretRequest: {
             value: tokens.get(refKey),
             labels: finalLabels,
-            // No `projectId`: a `mint-new` reservation already stamped the create, and an adopted or resumed
-            // Secret is only here because the decide phase found it already in the declared project.
+            // No team: a `mint-new` reservation already placed the create, and an adopted or resumed Secret is
+            // only here because the decide phase found it already in the declared team.
             ...(injection !== undefined ? { injection } : {}),
+            // A `mint-new` reservation already carried the hosts on its create.
+            ...(decision.action !== "mint-new" && declaredHosts !== undefined ? { hosts: declaredHosts } : {}),
         },
     }), { kind: "secret", slug: decision.secretSlug, op: "update" }, outcomes);
     // The pinned asymmetry between the pair's two rows: the `gateway-key` row is the MINT, whose sensitivity
@@ -244,15 +252,14 @@ async function mintGatewayKey(decision, apis, outcomes, applied, projectId, toke
  * Raised as a {@link GatewayKeyRotationError} so `failing`/`mapError` pass the message through verbatim,
  * a `PreflightError` being already-redacted named output.
  */
-function projectFenceRefusal(slug) {
-    return new GatewayKeyRotationError(`gateway key '${slug}': a gateway key with this slug already exists outside this project's ` +
-        `visibility, or was previously revoked (revoked slugs are permanently reserved); choose another ` +
-        `slug. \`UpdateGatewayKeyRequest\` carries no project move, so a key you cannot see cannot be ` +
-        `adopted into this project.`);
+function hiddenOrRevokedSlugRefusal(slug) {
+    return new GatewayKeyRotationError(`gateway key '${slug}': a gateway key with this slug already exists in a team this key cannot read, or ` +
+        `was previously revoked (revoked slugs are permanently reserved); choose another slug. A team is fixed ` +
+        `when a key is created, so a key you cannot see cannot be adopted into this team.`);
 }
 /**
  * The body is EXACTLY the labels map: `value` is deliberately absent, so the live credential survives a
- * crash here, and so is `projectId`.
+ * crash here, and so is the team.
  */
 async function patchSecretPendingMarker(apis, outcomes, slug, id, labels) {
     await failing(() => apis.secrets.updateSecret({ id, updateSecretRequest: { labels } }), { kind: "secret", slug, op: "update" }, outcomes);

package/dist/engine/model-provider-key-reconcile.js

@@ -66,8 +66,8 @@ export async function decideModelProviderKeys(plan, apis, env, outcomes) {
         const live = scanned.find((row) => row.modelProvider === modelProvider);
         // This lane's three pre-write refusals are one call to the ONE aggregate classifier, which `orchestra fdk diff`
         // stamps `DiffEntry.blocked` from identically, so a preview can never present as executable a
-        // declaration this phase is about to refuse. No `project` is supplied because a BYOK row is org-commons
-        // by construction, so there is no placement to compare and the classifier's identity arm stays off.
+        // declaration this phase is about to refuse. No team is supplied because a BYOK row is organization-wide
+        // by construction, so there is no team to compare and the classifier's identity arm stays off.
         refuseIf("model-provider-key", resource, { env, ...(live !== undefined ? { live } : {}) }, outcomes);
         const credentialSource = allRootSourceLabels(credential).join(", ");
         // Credential PRESENCE only, never the bytes, through the same predicate `orchestra fdk diff` marks sensitivity

package/dist/engine/pipeline-reconcile.d.ts

@@ -3,7 +3,7 @@ import { type PipelinePayload } from "../constructs/pipeline.js";
 import { type ConditionResolvers } from "./condition-references.js";
 import type { TriggerDocument } from "../constructs/trigger.js";
 import type { PlanResource } from "../core/plan.js";
-import { type ApplyOutcome, type DesiredProject } from "./apply-core.js";
+import { type ApplyOutcome, type TeamResolver } from "./apply-core.js";
 import type { PlatformApis } from "./client.js";
 /** What one apply does to one pipeline, computed from the declaration and the live read. */
 export interface PipelineChange {
@@ -34,10 +34,10 @@ export interface PendingPipelineWrite {
 }
 /** Resolves an agent reference, a managed token or an id or slug, to its id. */
 export type AgentIdResolver = (ref: string) => Promise<string>;
-/** A group by id or slug; orchestra declares no group, so a missing one is always the author's to fix. */
-export declare function groupIdOf(apis: PlatformApis, ref: string): Promise<string>;
-/** The declaration with every agent and group its stage gates name as the id the platform stores. */
-export declare function resolveGateReferences(payload: PipelinePayload, resolvers: Pick<ConditionResolvers, "agent" | "group">): Promise<PipelinePayload>;
+/** A team a gate or a rule names, by id or slug, as the id the platform stores. */
+export declare function teamIdOf(apis: PlatformApis, ref: string): Promise<string>;
+/** The declaration with every agent and team its stage gates name as the id the platform stores. */
+export declare function resolveGateReferences(payload: PipelinePayload, resolvers: Pick<ConditionResolvers, "agent" | "team">): Promise<PipelinePayload>;
 export declare function pipelineChange(payload: PipelinePayload, live: Pipeline | undefined): Promise<PipelineChange>;
 /** Name, description, labels and stages all agree, and no stage is to be removed. */
 export declare function pipelineUnchanged(payload: PipelinePayload, live: Pipeline): Promise<boolean>;
@@ -46,11 +46,10 @@ export declare function pipelineUnchanged(payload: PipelinePayload, live: Pipeli
  * every live stage, and holds the removals, gates and closes for {@link finishPipelineWrites}.
  */
 export declare function applyPipeline(resource: PlanResource, apis: PlatformApis, outcomes: ApplyOutcome[], applied: Map<string, string>, context: {
-    projectId: string | undefined;
-    desiredProject: DesiredProject;
+    teams: TeamResolver;
     resolveAgentId: AgentIdResolver;
-    /** Resolves a group reference, an id or slug, to its id. */
-    resolveGroupId: (ref: string) => Promise<string>;
+    /** Resolves a team reference, an id or slug, to its id. */
+    resolveTeamId: (ref: string) => Promise<string>;
     notices?: string[];
     pending: PendingPipelineWrite[];
 }): Promise<void>;

package/dist/engine/pipeline-reconcile.js

@@ -6,25 +6,25 @@
 // by its live id, so its items stay where they are. The workflow entries are written after the workflow phase
 // (`pipeline-workflow-reconcile.ts`).
 //
-// A stage gate names agents and groups by slug in factory code, and the platform stores and reads back their
+// A stage gate names agents and teams by slug in factory code, and the platform stores and reads back their
 // ids, so the declaration is resolved to ids before any comparison or write.
 import { OPEN_CATEGORIES } from "../constructs/pipeline.js";
 import { resolveConditionReferences, resolveStageInField } from "./condition-references.js";
 import { wireNode } from "../constructs/workflow-filter.js";
 import { createLabels, labelsPatch, MANAGED_BY_LABEL_KEY } from "../core/labels.js";
 import { refToken } from "../core/tokens.js";
-import { exactDeepEqual, failing, getBySlugOrUndefined, } from "./apply-core.js";
+import { exactDeepEqual, failing, getBySlugOrUndefined, stampTeam, } from "./apply-core.js";
 import { PreflightError } from "./preflight-errors.js";
 import { refuseIf } from "./refusals.js";
-/** A group by id or slug; orchestra declares no group, so a missing one is always the author's to fix. */
-export async function groupIdOf(apis, ref) {
-    const live = await getBySlugOrUndefined(() => apis.groups.getGroup({ id: ref }));
+/** A team a gate or a rule names, by id or slug, as the id the platform stores. */
+export async function teamIdOf(apis, ref) {
+    const live = await getBySlugOrUndefined(() => apis.teams.getTeam({ id: ref }));
     if (live === undefined) {
-        throw new PreflightError(`group '${ref}' was not found in this organization. Create it or fix the reference.`);
+        throw new PreflightError(`team '${ref}' was not found in this organization. Create it or fix the reference.`);
     }
     return live.id;
 }
-/** The declaration with every agent and group its stage gates name as the id the platform stores. */
+/** The declaration with every agent and team its stage gates name as the id the platform stores. */
 export async function resolveGateReferences(payload, resolvers) {
     const stages = await Promise.all(payload.stages.map(async (stage) => ({
         ...stage,
@@ -103,14 +103,18 @@ export async function applyPipeline(resource, apis, outcomes, applied, context)
     const surface = { kind: "pipeline", slug: resource.slug };
     const payload = await failing(() => resolveGateReferences(resource.payload, {
         agent: context.resolveAgentId,
-        group: context.resolveGroupId,
+        team: context.resolveTeamId,
     }), { ...surface, op: "get" }, outcomes);
+    const declared = await context.teams.desired(payload.teamId, { ...surface, op: "get" }, outcomes);
     const live = await failing(() => getBySlugOrUndefined(() => apis.pipelines.getPipeline({ id: resource.slug })), { ...surface, op: "get" }, outcomes);
-    refuseIf("pipeline", resource, { project: context.desiredProject, ...(live !== undefined ? { live } : {}) }, outcomes);
+    const team = await context.teams.judged(declared, live, { ...surface, op: "get" }, outcomes);
+    refuseIf("pipeline", resource, { ...(team !== undefined ? { team } : {}), ...(live !== undefined ? { live } : {}) }, outcomes);
     let id;
     let action;
     if (live === undefined) {
         const labels = createLabels(payload.labels);
+        const placement = {};
+        stampTeam(placement, team);
         const body = {
             slug: resource.slug,
             name: payload.name,
@@ -118,7 +122,7 @@ export async function applyPipeline(resource, apis, outcomes, applied, context)
             itemSlugPrefix: payload.itemSlugPrefix,
             labels,
             stages: (await pipelineChange(payload, undefined)).finalStages,
-            ...(context.projectId !== undefined ? { projectId: context.projectId } : {}),
+            ...placement,
         };
         const created = await failing(() => apis.pipelines.createPipeline({ createPipelineRequest: body }), { ...surface, op: "create" }, outcomes);
         id = created.id;

package/dist/engine/reconcile.d.ts

@@ -1,6 +1,6 @@
 import type { Connection } from "@orchestraworks/client";
 import type { PlanDocument, PlanImport } from "../core/plan.js";
-import { type ApplyOutcome, type PendingSecretWrite } from "./apply-core.js";
+import { type ApplyOutcome, type PendingSecretWrite, type TeamResolver } from "./apply-core.js";
 import { type ApprovalLevel } from "../cli/core/approval-policy.js";
 import { type PlatformApis } from "./client.js";
 import { type Provenance } from "./provenance.js";
@@ -12,14 +12,6 @@ export { ApplyError, describeTargetOrganization, getBySlugOrUndefined, platformE
 export type { Action, ApplyOutcome, PendingSecretWrite } from "./apply-core.js";
 /** Given every pending write, resolve `true` to proceed. */
 export type ConfirmFn = (writes: PendingSecretWrite[]) => Promise<boolean>;
-/**
- * Carries the factory's resolved project id out of the plan phase, for both a managed project and a
- * `fromSlug` import. The trigger phase needs it because a synth `${ref:project:…}` token cannot be resolved
- * any earlier. An out-param rather than a new return shape, so existing callers are untouched.
- */
-export interface ProjectResolution {
-    projectId?: string;
-}
 export interface ReconcileOptions {
     approveSecrets: boolean;
     confirm: ConfirmFn;
@@ -111,6 +103,11 @@ export interface ReconcileOptions {
      * key is dropped. The engine never logs, stores or throws it.
      */
     onComputeProviderKey?: (step: ComputeProviderKeyStep) => void;
+    /**
+     * Resolves each row's team. The CLI passes the one it also hands the trigger phase, so a managed team
+     * created here resolves there; absent, apply builds its own over the run's `applied` map.
+     */
+    teams?: TeamResolver;
 }
 /** One expression, called at the one place a gate decision is made, so the derivation cannot drift. */
 export declare function effectiveApprovalLevel(opts: Pick<ReconcileOptions, "requireApproval" | "approveSecrets">): ApprovalLevel;
@@ -123,8 +120,6 @@ export declare function effectiveApprovalLevel(opts: Pick<ReconcileOptions, "req
 export declare class UnresolvedManagedRefError extends PreflightError {
     constructor(message: string);
 }
-/** Exported so the workflow phase resolves the same stamp through the identical seam. */
-export declare function resolveProjectReference(apis: PlatformApis, ref: string, applied: Map<string, string>): Promise<string>;
 /** A stable, non-secret authorization action surfaced only after the complete apply graph succeeds. */
 export interface AuthorizationHandoff {
     connectionId: string;
@@ -153,7 +148,7 @@ export declare class ConnectionResolutionContext {
  * return shape, so every existing `ApplyOutcome[]`-returning caller is untouched; the workflow phase reuses
  * the map it fills to resolve each agent assignment through the identical machinery.
  */
-export declare function reconcile(plan: PlanDocument, apis: PlatformApis, opts: ReconcileOptions, appliedOut?: Map<string, string>, projectOut?: ProjectResolution): Promise<ApplyOutcome[]>;
+export declare function reconcile(plan: PlanDocument, apis: PlatformApis, opts: ReconcileOptions, appliedOut?: Map<string, string>): Promise<ApplyOutcome[]>;
 /**
  * `status` is server-owned and excluded. `autoRespond` is compared EXACTLY rather than by the subset rule,
  * because its PATCH replaces the whole block — under the subset rule, dropping an authored knob would read as
@@ -165,15 +160,6 @@ export declare function connectionUnchanged(desired: Record<string, unknown>, li
  * re-run. Env-markers pre-resolve fail-fast, so an unset variable never surfaces mid-apply.
  */
 export declare function resolveConnectionReference(apis: PlatformApis, ref: string, imports: PlanImport[], applied: Map<string, string>, env: NodeJS.ProcessEnv): Promise<string>;
-/**
- * Apply and preview must classify a binding identically or the two paths drift, so the discrimination lives
- * here once. `connection` is not a secret, so it stands outside the reserved-secret guard and the
- * pairwise-distinct check: one connection may back several rules. `secret` is the DEFAULT arm on purpose — no
- * `connectionId`, so a secret.
- */
-export type CredentialBindingArm = "connection" | "secret";
-/** Decides an egress credential binding's arm — see {@link CredentialBindingArm} for what each one means. */
-export declare function credentialBindingArm(binding: Record<string, unknown>): CredentialBindingArm;
 /**
  * `policyVersion` is server-managed, so it is excluded. The platform leaves an empty `image`, `command` or
  * `setup` out of a read, so the empty value orchestra sends for an undeclared one matches an absent live one.