@orchestraworks/cli 0.5.5 → 0.5.7

package/dist/cli/factory/apply.js

@@ -14,7 +14,8 @@
 // is asking rather than printing, stay.
 import { resolve } from "node:path";
 import { makeApis } from "../../engine/client.js";
-import { resolveDesiredProject } from "../../engine/diff.js";
+import { previewTeamResolver } from "../../engine/diff.js";
+import { createTeamResolver } from "../../engine/apply-core.js";
 import { pendingCredentialWrite } from "../../engine/secrets-apply.js";
 import { AggregateRefusalError } from "../../engine/refusals.js";
 import { ApplyError, ConnectionResolutionContext, describeTargetOrganization, reconcile, resolveReferenceId, } from "../../engine/reconcile.js";
@@ -26,6 +27,9 @@ import { makeTriggersApi, pipelineResolver, reconcileTriggers, } from "../../eng
 import { loadConfig, runFactoryForPlan } from "./config.js";
 import { environmentsEstablishedByApply, platformReachNotices, platformWildcardWarnings, } from "./platform-reach.js";
 import { createDockerRunner, createLoginPrompts, imageBuildSpecs, ImageBuildError, runImageBuildPhase, } from "./docker.js";
+import { hostedImageName } from "../../constructs/references.js";
+import { hostedSpecs, ImageUploadError, pinHostedReferences, pinNewestReadyImages, prepareOciBuilder, uploadHostedImages, } from "./image-upload.js";
+import { hostedImageRefusals } from "./synth.js";
 import { buildApplyPreview, messageOf } from "./apply-preview.js";
 import { approvalPolicyBanner, computeProviderKeyLines, preflightRefusal, printApplyNotices, printApplySummary, printAuthorizationHandoffs, printTriggerSummary, printWorkflowSummary, renderApplyPreview, renderPendingWrites, } from "./apply-render.js";
 import { defaultIo, printOrgBanner, printWarnings, VERIFICATION_HINTS, writeResultJson, } from "../core/output.js";
@@ -115,9 +119,9 @@ export async function applyCommand(options = {}, deps = {}) {
     const workflows = result.plan.resources.filter((resource) => resource.kind === "workflow");
     // Threaded into the workflow phase, so each agent a rule names resolves through identical machinery.
     const applied = new Map();
-    // The plan phase exposes the resolved project id here, to stamp into the trigger phase: a synth project
-    // ref token cannot resolve before apply.
-    const projectResolution = {};
+    // One resolver over the plan phase's `applied` map, so a team the plan phase creates resolves in the
+    // trigger phase too.
+    const teams = createTeamResolver(apis, applied);
     const connectionResolution = new ConnectionResolutionContext(apis, result.plan.imports, applied, env);
     // Populated in place by the plan phase and printed either way, success or stop-at-first-error.
     const notices = [];
@@ -174,16 +178,40 @@ export async function applyCommand(options = {}, deps = {}) {
             return abortBeforeWrites(messageOf(error)); // no approval, no build, no write
         }
     }
-    // 3c-bis. Resolved ONCE per run, so the plan an operator approves and the rows apply refuses are judged
-    //     against one input rather than two independent resolutions. CLASSIFICATION data only — reconcile's
-    //     project write phase keeps its own read/create, because a descriptor cannot carry a post-create id.
-    let desiredProject;
+    // 3c-ter. A hosted image that cannot build or cannot be named is refused before any read that costs more.
+    //     The one `GET /images` follows: it decides whether hosted images upload at all, and it is what the
+    //     pre-flight compares and what `--no-docker-build` names.
+    const synthRefusals = hostedImageRefusals(result.plan, effective.cwd);
+    if (synthRefusals.length > 0) {
+        return abortBeforeWrites(...synthRefusals.map((refusal) => `cannot apply: ${refusal}`));
+    }
+    let pinned;
+    try {
+        pinned = await pinNewestReadyImages(result.plan, apis.images);
+    }
+    catch (error) {
+        return abortBeforeWrites(messageOf(error));
+    }
+    const { hosted } = pinned;
+    if (options.dockerBuild === false && hosted?.available === true) {
+        const unready = pinned.declared.filter((spec) => !pinned.pins.has(spec.ref));
+        if (unready.length > 0) {
+            return abortBeforeWrites(...unready.map((spec) => `cannot apply: --no-docker-build names the newest READY image of each declared image, and the ` +
+                `platform holds no READY image named '${hostedImageName(spec.ref)}'. Run apply without ` +
+                `--no-docker-build to build and upload it.`));
+        }
+    }
+    // The environments name the newest READY image of each hosted name until this run uploads a new one, so
+    // the pre-flight compares by name and an unchanged image is not a change.
+    let plan = pinned.plan;
+    // 3c-bis. Resolved ONCE per run, so the plan an operator approves is judged against one set of team reads.
+    //     CLASSIFICATION data only — reconcile's team phase keeps its own read/create, because a preview cannot
+    //     carry a post-create id.
+    let previewTeams;
     try {
-        desiredProject = await resolveDesiredProject(result.plan, apis);
+        previewTeams = await previewTeamResolver(result.plan, apis);
     }
     catch (error) {
-        // Not a 404 — that is a legitimate pending state. With no descriptor there is nothing to classify
-        // against, so apply stops rather than building and writing on a comparison it could not make.
         return abortBeforeWrites(messageOf(error));
     }
     // 3d. The same read-only preview `orchestra fdk diff` composes, run before the image build and before reconcile,
@@ -191,11 +219,12 @@ export async function applyCommand(options = {}, deps = {}) {
     let preview;
     if (policy.level === "any-change") {
         try {
-            preview = await buildApplyPreview(result, apis, {
+            preview = await buildApplyPreview({ ...result, plan }, apis, {
                 dockerBuild: options.dockerBuild !== false,
                 env,
-                project: desiredProject,
+                teams: previewTeams,
                 makeTriggersApi: deps.makeTriggersApi ?? makeTriggersApi,
+                ...(hosted !== undefined ? { hostedImages: hosted } : {}),
             });
         }
         catch (error) {
@@ -244,24 +273,49 @@ export async function applyCommand(options = {}, deps = {}) {
     catch (error) {
         return abortBeforeWrites(`cannot apply: ${messageOf(error)}`);
     }
-    // 3e. Declared images build and push BEFORE any platform mutation, and AFTER the pre-flight, so a
-    // declined apply never leaves a pushed image behind. The specs come from the pre-flight when one ran:
-    // they are the very list the operator just approved, and re-deriving them here is where an "approved
-    // these images, built those" divergence could appear.
+    // 3e. Declared images build, push and upload AFTER the pre-flight, so a declined apply never leaves an
+    // image behind; the platform writes of this phase are Files and Images alone, before reconcile writes
+    // anything else. The specs come from the pre-flight when one ran: they are the very list the operator just
+    // approved, and re-deriving them here is where an "approved these images, built those" divergence could
+    // appear. A platform that keeps no images answers 501, and its hosted tags build into the local daemon
+    // exactly as before, so an environment names the local tag.
     const specs = options.dockerBuild === false ? [] : preview?.pendingImageBuilds ?? imageBuildSpecs(result.plan);
     if (specs.length > 0) {
+        const runner = deps.dockerRunner ?? createDockerRunner(io);
+        const uploads = hosted?.available === true ? hostedSpecs(specs) : [];
+        const builds = specs.filter((spec) => !uploads.includes(spec));
+        if (hosted?.available === false) {
+            io.out(`The platform keeps no images (${hosted.message}), so ${hostedSpecs(specs).map((spec) => `'${spec.ref}'`).join(", ")} ` +
+                `build into the local Docker daemon and environments name the local tag; nothing is uploaded.`);
+        }
         try {
-            await runImageBuildPhase(specs, effective.cwd, {
-                runner: deps.dockerRunner ?? createDockerRunner(io),
-                io,
-                prompts: deps.loginPrompts ?? createLoginPrompts(),
-                isTTY,
-            });
+            if (uploads.length > 0)
+                await prepareOciBuilder(uploads, runner);
+            if (builds.length > 0) {
+                await runImageBuildPhase(builds, effective.cwd, {
+                    runner,
+                    io,
+                    prompts: deps.loginPrompts ?? createLoginPrompts(),
+                    isTTY,
+                });
+            }
+            if (uploads.length > 0) {
+                const uploaded = await uploadHostedImages(uploads, effective.cwd, {
+                    runner,
+                    io,
+                    images: apis.images,
+                    files: apis.files,
+                    ...(deps.imageFetch !== undefined ? { fetchApi: deps.imageFetch } : {}),
+                    ...(deps.sleep !== undefined ? { sleep: deps.sleep } : {}),
+                    ...(deps.now !== undefined ? { now: deps.now } : {}),
+                });
+                plan = pinHostedReferences(result.plan, uploaded);
+            }
         }
         catch (error) {
-            if (error instanceof ImageBuildError) {
+            if (error instanceof ImageBuildError || error instanceof ImageUploadError) {
                 failApply(error.message);
-                return; // abort before reconcile — no platform mutation
+                return; // abort before reconcile — no write beyond the phase's own Files and Images
             }
             throw error;
         }
@@ -269,7 +323,7 @@ export async function applyCommand(options = {}, deps = {}) {
     // 4. Plan phase, stop-at-first-error: reconcile wraps a failure in an ApplyError carrying the outcomes
     // applied so far. A non-ApplyError propagates to the CLI wrapper.
     try {
-        planOutcomes = await (deps.reconcile ?? reconcile)(result.plan, apis, {
+        planOutcomes = await (deps.reconcile ?? reconcile)(plan, apis, {
             // The resolved LEVEL, passed explicitly so the engine never has to guess. The legacy boolean rides
             // alongside as the same statement in the old vocabulary; both derive from ONE resolved policy, so
             // they cannot disagree here, and the engine's rule if they ever did is "the level wins".
@@ -313,7 +367,8 @@ export async function applyCommand(options = {}, deps = {}) {
             // Rides the agent create/update bodies only, never the unchanged comparison.
             provenance,
             pendingPipelineWrites,
-        }, applied, projectResolution);
+            teams,
+        }, applied);
     }
     catch (error) {
         if (error instanceof ApplyError) {
@@ -364,8 +419,10 @@ export async function applyCommand(options = {}, deps = {}) {
                 agentIdCache.set(ref, id);
                 return id;
             };
-            await reconcileTriggers((deps.makeTriggersApi ?? makeTriggersApi)(apis.target), result.triggers, resolveTriggerAgentRef, projectResolution.projectId, // stamp the resolved factory project on every trigger create
-            triggerOutcomes, {
+            await reconcileTriggers((deps.makeTriggersApi ?? makeTriggersApi)(apis.target), result.triggers, resolveTriggerAgentRef, async (raw, live) => {
+                const surface = { kind: "team", slug: raw ?? "shared", op: "get" };
+                return teams.judged(await teams.desired(raw, surface, planOutcomes), live, surface, planOutcomes);
+            }, triggerOutcomes, {
                 resolveConnectionId: connectionIdResolver(managedConnectionTokens(result.plan), connectionResolution),
                 resolvePipeline: pipelineResolver(apis, declaredPipelinesOf(result.plan.resources)),
             });

package/dist/cli/factory/diff.js

@@ -11,10 +11,11 @@
 // declaration whose slot named a blocked connection stops being listed as an executable change.
 import { resolve } from "node:path";
 import { makeApis } from "../../engine/client.js";
-import { describeProjectIdentityRefusal } from "../../engine/apply-core.js";
-import { createDiffReadCache, diffPlan, resolveDesiredProject, } from "../../engine/diff.js";
+import { describeTeamIdentityRefusal } from "../../engine/apply-core.js";
+import { createDiffReadCache, diffPlan, previewTeamResolver, } from "../../engine/diff.js";
 import { makeTriggersApi, } from "../../engine/trigger-reconcile.js";
 import { loadConfig, runFactoryForPlan } from "./config.js";
+import { pinNewestReadyImages } from "./image-upload.js";
 import { blockedReferenceOwnersOf, blockedImportsOf, composePreviews, isFiringAction, isFiringRow, } from "./apply-preview.js";
 import { changesDetail, detailsOf, printApplyNotices, renderSensitiveRows, } from "./apply-render.js";
 import { environmentsEstablishedByDiff, platformReachNotices, platformWildcardWarnings, } from "./platform-reach.js";
@@ -36,21 +37,28 @@ export async function diffCommand(options = {}, deps = {}) {
     // 3. Fresh synth from code, never the on-disk plan.
     const config = (deps.loadConfig ?? loadConfig)(options.dir ?? process.cwd());
     const effective = options.out !== undefined ? { ...config, outDir: options.out } : config;
-    const result = await (deps.runFactoryForPlan ?? runFactoryForPlan)(effective);
-    printWarnings(result.warnings, io);
+    const synthesized = await (deps.runFactoryForPlan ?? runFactoryForPlan)(effective);
+    printWarnings(synthesized.warnings, io);
+    // Environments name the newest READY image of each hosted tag, as in apply's pre-flight, so an image the
+    // platform already holds is not a change. A platform that keeps no images answers 501 and the local tag
+    // is compared as it is.
+    const result = {
+        ...synthesized,
+        plan: (await pinNewestReadyImages(synthesized.plan, apis.images)).plan,
+    };
     // The same warning apply prints, from the same fresh plan and base URL, so the author reads it while
     // previewing rather than only after the change has landed. Not gated on change state; the note below is.
     printWarnings(platformWildcardWarnings(result.plan, apis.target.baseUrl), io);
     // 4. `diffPlan` NEVER writes and never runs the writeful plan reconcile, so no `applied` map is
     //    populated for the workflow and trigger phases below.
     //
-    //    The project descriptor and the read memo are resolved HERE, once, and threaded through both the plan
-    //    pass and the previews, so one command never answers "where does this factory live?" twice.
+    //    The team reads and the read memo are resolved HERE, once, and threaded through both the plan pass and
+    //    the previews, so one command never answers "which team is this row in?" twice.
     const reads = createDiffReadCache(apis);
-    const project = await resolveDesiredProject(result.plan, apis);
+    const teams = await previewTeamResolver(result.plan, apis);
     const entries = await (deps.diffPlan ?? diffPlan)(result.plan, apis, {
         env,
-        project,
+        teams,
         reads,
         triggers: result.triggers ?? [],
     });
@@ -67,7 +75,7 @@ export async function diffCommand(options = {}, deps = {}) {
     printApplyNotices(platformReachNotices(result.plan, apis.target.baseUrl, environmentsEstablishedByDiff(visibleEntries)), io);
     // 6. The SAME reconcile engines with their write call sites fenced. The plan-resource phase never ran, so
     //    the composition builds a read-only live ref map instead of an EMPTY `applied` map — which would
-    //    misreport EVERY managed agent/project ref as pending on a repeat diff.
+    //    misreport EVERY managed agent or team ref as pending on a repeat diff.
     const previewable = {
         ...result,
         plan: {
@@ -78,7 +86,7 @@ export async function diffCommand(options = {}, deps = {}) {
     };
     const { workflowActions, triggerActions } = await composePreviews(previewable, apis, {
         env,
-        project,
+        teams,
         makeTriggersApi: deps.makeTriggersApi ?? makeTriggersApi,
         reads,
     });
@@ -121,7 +129,7 @@ export function renderDiff(entries, io, outDir) {
             if (entry.refusal !== undefined) {
                 // The ONE shared formatter, the same call the error makes, so preview and apply print byte-identical
                 // text for one conflict and the raw ref token never reaches an author.
-                io.out(`  ${state.padEnd(19)} ${describeProjectIdentityRefusal(entry.refusal)}`);
+                io.out(`  ${state.padEnd(19)} ${describeTeamIdentityRefusal(entry.refusal)}`);
                 continue;
             }
             const details = detailsOf(entry); // the ONE builder apply's renderer uses, so both surfaces match
@@ -185,7 +193,7 @@ export function renderTriggerDiff(outcomes, io) {
     io.out("Triggers:");
     for (const outcome of outcomes) {
         if (outcome.refusal !== undefined) {
-            io.out(`  ${outcome.action.padEnd(19)} ${describeProjectIdentityRefusal(outcome.refusal)}`);
+            io.out(`  ${outcome.action.padEnd(19)} ${describeTeamIdentityRefusal(outcome.refusal)}`);
             continue;
         }
         const predicted = outcome.predicted === true ? " [predicted]" : "";

package/dist/cli/factory/image-upload.d.ts

@@ -0,0 +1,90 @@
+import type { FilesApi, Image as PlatformImage, ImagesApi } from "@orchestraworks/client";
+import type { PlanDocument } from "../../core/plan.js";
+import type { CliIo } from "../core/output.js";
+import { type DockerRunner, type ImageBuildSpec } from "./docker.js";
+export declare const OCI_BUILDER = "orchestra-oci";
+export declare const HOSTED_PLATFORM = "linux/amd64";
+export declare const POLL_INTERVAL_MS = 5000;
+export declare const POLL_TIMEOUT_MS: number;
+/** Carries the images already `READY`, so the abort message says what landed. */
+export declare class ImageUploadError extends Error {
+    readonly ready: string[];
+    constructor(message: string, ready?: string[]);
+}
+export type ImagesClient = Pick<ImagesApi, "listImages" | "createImage" | "getImage">;
+/**
+ * What one `GET /images` says: a platform that keeps no images answers 501, and the newest `READY` image of
+ * each declared name that is not marked for deletion is what the pre-flight compares and what
+ * `--no-docker-build` names.
+ */
+export type HostedImages = {
+    available: false;
+    message: string;
+} | {
+    available: true;
+    newestReady: Map<string, PlatformImage>;
+};
+export declare function hostedSpecs(specs: readonly ImageBuildSpec[]): ImageBuildSpec[];
+export declare function readHostedImages(images: ImagesClient, names: readonly string[]): Promise<HostedImages>;
+/** A copy of the plan whose environments name the image reference in place of each pinned tag. */
+export declare function pinHostedReferences(plan: PlanDocument, pins: ReadonlyMap<string, string>): PlanDocument;
+/** What `diff` and `apply` both need from the one `GET /images` of a run. */
+export interface PinnedHostedPlan {
+    /** The declared images that upload to the platform rather than push. */
+    declared: ImageBuildSpec[];
+    /** Absent when the plan declares no hosted image, so nothing was read. */
+    hosted?: HostedImages;
+    /** The newest `READY` reference of each declared tag that has one, keyed by tag. */
+    pins: Map<string, string>;
+    /** The plan with each pinned tag replaced by its reference. */
+    plan: PlanDocument;
+}
+/** Reads `/images` once when the plan declares a hosted image, and pins each tag to its newest READY image. */
+export declare function pinNewestReadyImages(plan: PlanDocument, images: ImagesClient): Promise<PinnedHostedPlan>;
+/** Every refusal that needs no write: the declared platform, buildx, and a builder that starts. */
+export declare function prepareOciBuilder(specs: readonly ImageBuildSpec[], runner: DockerRunner): Promise<void>;
+/** Paths resolve against the factory directory; values are data, never shell. */
+export declare function ociBuildArgv(spec: ImageBuildSpec, appDir: string, layoutDir: string): string[];
+export interface ImageUploadDeps {
+    runner: DockerRunner;
+    io: CliIo;
+    images: ImagesClient;
+    files: FilesApi;
+    /** The presigned pushes; never the platform client. */
+    fetchApi?: typeof fetch;
+    sleep?: (ms: number) => Promise<void>;
+    now?: () => number;
+    /** Where each image's OCI layout is written and deleted again. */
+    tempDir?: string;
+}
+/**
+ * Builds, uploads and waits for each image in order; answers each tag's image reference. The Files uploaded
+ * for the `READY` images are deleted once, after the last image, so a later image may still use an earlier
+ * one's File as a held blob; they are deleted when a later image stops the run too.
+ */
+export declare function uploadHostedImages(specs: readonly ImageBuildSpec[], appDir: string, deps: ImageUploadDeps): Promise<Map<string, string>>;
+export interface NamedImage {
+    ref: string;
+    how: string;
+}
+/** The images a hosted build names: each build argument's value, and each `FROM` that is not an earlier stage. */
+export declare function imagesNamedBy(spec: ImageBuildSpec, appDir: string): NamedImage[];
+interface Descriptor {
+    mediaType?: string;
+    digest: string;
+    size: number;
+    platform?: {
+        os?: string;
+        architecture?: string;
+    };
+    annotations?: Record<string, string>;
+}
+interface OciLayout {
+    dir: string;
+    manifest: string;
+    digest: string;
+    /** The config and the layers, by digest. */
+    blobs: Map<string, Descriptor>;
+}
+export declare function readOciLayout(dir: string): OciLayout;
+export {};