@orchestraworks/cli 0.5.5 → 0.5.7

package/dist/constructs/environment.js

@@ -1,46 +1,37 @@
-// Cross-references (secret ids in credential bindings, volume ids in mounts) serialize as `${ref:…}` tokens
+// Cross-references (volume ids in mounts, the pull credential's secret id) serialize as `${ref:…}` tokens
 // or verbatim import refs and resolve to canonical ids at apply. Server-default sub-fields are emitted
 // explicitly so the whole-object egress/ingress diff stays stable.
 import { Construct } from "../core/construct.js";
-import { refToken } from "../core/tokens.js";
+import { hostPatternCovers } from "../core/host-pattern.js";
+import { isRefToken, parseRefToken, refToken } from "../core/tokens.js";
 import { connectionLabel } from "./connection.js";
-import { AUTHORIZATION_TEMPLATE, CONNECTION_RULE_PRIORITY, CREDENTIAL_FREE_RULE_SUFFIX, CREDENTIAL_RULE_SUFFIX, connectionCredentialOf, } from "./egress-preset.js";
+import { CONNECTION_RULE_PRIORITY } from "./egress-preset.js";
 import { interpolateHost } from "./provider-types.js";
 import { registerImport, resolveManagedSlug, validateExplicitSlug, } from "./references.js";
-import { cloneInjectionRecipe, normalizeInjectionRecipe } from "./secret.js";
-/** Binding a recipe-carrying secret this way is a valid presentation choice — the binding determines
- *  application. */
+import { cloneInjectionRecipe, normalizeInjectionRecipe, Secret } from "./secret.js";
+// The four binders below survive only so a rule that still names a credential fails at synth with the exact
+// `injection` its Secret should declare: a rule carries no credential, and the binder is what knows the form.
+/** @deprecated A rule carries no credential: declare `hosts` and `injection` on the Secret instead. */
 export function bearer(header, secret) {
     const secretId = secret.secretId;
     return { _credentialBinding: () => ({ header, secretId, valueTemplate: "Bearer ${secret}" }) };
 }
+/** @deprecated A rule carries no credential: declare `hosts` and `injection` on the Secret instead. */
 export function basic(header, secret) {
     const secretId = secret.secretId;
     return { _credentialBinding: () => ({ header, secretId, valueTemplate: "Basic ${secret}" }) };
 }
-/**
- * Injects `<header>: <secret>` verbatim with no scheme prefix, for a provider-specific header whose value is
- * the secret as-is.
- */
+/** @deprecated A rule carries no credential: declare `hosts` and `injection` on the Secret instead. */
 export function header(name, secret) {
     const secretId = secret.secretId;
     return { _credentialBinding: () => ({ header: name, secretId, valueTemplate: "${secret}" }) };
 }
-/**
- * OVERRIDES the secret's own recipe wholesale at the broker — replace, never merge. The recipe is validated
- * and normalized once here and the producer hands out a deep copy each call, so a caller cannot mutate the
- * validated recipe after `allow()` to smuggle an unvalidated header past synth validation. There is
- * deliberately no recipe-presence check on `secret`: overriding a recipe-less secret is the whole point, since
- * the bare secret means "use the secret's own recipe" and `inject()` means "use THIS one".
- */
+/** @deprecated A rule carries no credential: declare `hosts` and `injection` on the Secret instead. */
 export function inject(secret, recipe) {
     const secretId = secret.secretId;
     const normalized = normalizeInjectionRecipe(recipe, `inject() binding for secret '${secretId}'`);
     return { _credentialBinding: () => ({ secretId, injection: cloneInjectionRecipe(normalized) }) };
 }
-function isConnectionRule(rule) {
-    return "connectionId" in rule;
-}
 /**
  * 300 is deliberately the same band `allow(connection)` defaults to, not a race won: priority only arbitrates
  * between rules matching the SAME host, and no connection provider declares the model gateway's host.
@@ -54,7 +45,7 @@ const DEFAULT_MODEL_GATEWAY_RULE_NAME = "model-gateway";
 export const DEFAULT_MODEL_GATEWAY_HOST = "models.orchestraworks.ai";
 /**
  * One DNS name and nothing else: `hosts` is matched as a host pattern, so a scheme, path or port would match
- * no request, and a `*` would send the gateway key to every host it covers.
+ * no request, and a `*` would open every host to the network.
  */
 const BARE_HOSTNAME = /^[A-Za-z0-9](?:[A-Za-z0-9-]*[A-Za-z0-9])?(?:\.[A-Za-z0-9](?:[A-Za-z0-9-]*[A-Za-z0-9])?)*$/;
 /**
@@ -140,69 +131,42 @@ function normalizePaths(ruleName, paths) {
     return [...paths];
 }
 /**
- * `credential` and `credentials` are mutually exclusive, an explicit `credentials` list must be non-empty, and
- * header names within it must be unique case-insensitively — broker hydration builds its header map with
- * `associate`, so a duplicate would silently drop a binding at runtime.
- *
- * Each entry's own `_credentialBinding()` produces its fresh wire literal here (a recipe-less local `Secret`
- * throws its synth error at this point); the produced literals are the rule's stored, snapshot-immutable
- * credential data — a caller mutating their array or inputs after `allow()` cannot reach them.
+ * A rule that still names a credential is an authored statement that can no longer apply, so it fails here
+ * with the Secret declaration that replaces it: the rule's hosts become the Secret's `hosts`, and the binder's
+ * form becomes its `injection`.
  */
-function normalizeCredentials(ruleName, options) {
-    if (options.credential !== undefined && options.credentials !== undefined) {
-        throw new Error(`egress rule '${ruleName}': set either 'credential' (one binding) or 'credentials' (a list), not both.`);
-    }
-    if (options.credential !== undefined) {
-        return [options.credential._credentialBinding()];
-    }
-    if (options.credentials === undefined) {
-        return [];
-    }
-    if (options.credentials.length === 0) {
-        throw new Error(`egress rule '${ruleName}': 'credentials' is empty. Omit it for a credential-free rule, or list at least one binding.`);
-    }
-    const bindings = options.credentials.map((entry) => entry._credentialBinding());
-    const seen = new Set();
-    for (const binding of bindings) {
-        // A recipe/injection binding names no header (its recipe does), so it has nothing to collide on and is
-        // skipped; uniqueness stays enforced across the single-header bindings beside it.
-        if (binding.header === undefined) {
-            continue;
-        }
-        const key = binding.header.toLowerCase();
-        if (seen.has(key)) {
-            throw new Error(`egress rule '${ruleName}': duplicate credential header '${binding.header}' (header names match ` +
-                `case-insensitively). Bind each header at most once.`);
-        }
-        seen.add(key);
-    }
-    return bindings;
+function refuseRuleCredential(ruleName, options, hosts) {
+    const declared = options.credentials !== undefined
+        ? Array.isArray(options.credentials)
+            ? options.credentials
+            : [options.credentials]
+        : options.credential !== undefined
+            ? [options.credential]
+            : [];
+    if (declared.length === 0 && options.credentials === undefined)
+        return;
+    const remedies = declared.map((entry) => secretRemedy(entry, hosts));
+    throw new Error(`egress rule '${ruleName}': a rule carries no credential, so 'credential'/'credentials' is not accepted. ` +
+        `A credential declares where and how it is presented on its own resource: ` +
+        `${remedies.length > 0 ? remedies.join("; ") : "give the Secret 'hosts' and an 'injection' recipe"}. ` +
+        `Then keep this rule as a network rule, with no credential.`);
 }
-/**
- * Three fail-at-synth shapes, each a certain misconfiguration rather than a warning: an empty list (the author
- * meant "omit the option"), a duplicate entry (an ambiguous declaration), and a host that is not one of the
- * connection's own — most commonly the uninterpolated `{param}` pattern, which would otherwise silently match
- * nothing and push the intended-credentialed host into the credential-free partition.
- */
-function validateCredentialHosts(declared, interpolatedHosts, ctx) {
-    if (declared.length === 0) {
-        throw new Error(`egress rule '${ctx.ruleName}': 'credentialHosts' is empty. Omit it to bind the connection credential ` +
-            `to every provider host, or list at least one of ${JSON.stringify(interpolatedHosts)}.`);
-    }
-    const known = new Set(interpolatedHosts);
-    const selected = new Set();
-    for (const host of declared) {
-        if (selected.has(host)) {
-            throw new Error(`egress rule '${ctx.ruleName}': duplicate host '${host}' in 'credentialHosts'.`);
-        }
-        if (!known.has(host)) {
-            throw new Error(`egress rule '${ctx.ruleName}': 'credentialHosts' host '${host}' is not one of connection provider ` +
-                `'${ctx.providerId}' hosts ${JSON.stringify(interpolatedHosts)}. Name the INTERPOLATED host (the ` +
-                `install values are already substituted), not the '{param}' pattern.`);
-        }
-        selected.add(host);
-    }
-    return selected;
+/** The Secret declaration one binder stands for, with no value: a recipe and host names only. */
+function secretRemedy(entry, hosts) {
+    const binding = entry !== null && typeof entry === "object" && "_credentialBinding" in entry
+        ? entry._credentialBinding()
+        : undefined;
+    if (binding === undefined)
+        return "give the Secret 'hosts' and an 'injection' recipe";
+    const name = isRefToken(binding.secretId)
+        ? `Secret '${parseRefToken(binding.secretId).path.join("/")}'`
+        : `secret '${binding.secretId}'`;
+    const injection = binding.injection !== undefined
+        ? JSON.stringify(binding.injection)
+        : binding.header !== undefined
+            ? JSON.stringify({ headers: [{ name: binding.header, value: binding.valueTemplate }] })
+            : "its own injection recipe";
+    return `${name} takes hosts: ${JSON.stringify(hosts)} and injection: ${injection}`;
 }
 /**
  * **The builder is mutating, and every chaining method returns `this`, not a copy.** `denyAll()` or
@@ -224,9 +188,9 @@ export class EgressPolicy {
         return new EgressPolicy("deny");
     }
     /**
-     * Allows every host no rule matches. Rules fold onto it exactly as onto {@link denyAll}: a credentialed
-     * allow rule still injects its credential at the edge, and a deny still refuses. It opens hosts, not
-     * ports: the ports the edge answers on are the same under either starting point.
+     * Allows every host no rule matches. Rules fold onto it exactly as onto {@link denyAll}, and a deny still
+     * refuses. It opens hosts, not ports: the ports the edge answers on are the same under either starting
+     * point.
      */
     static allowAll() {
         return new EgressPolicy("allow");
@@ -238,8 +202,7 @@ export class EgressPolicy {
      * step the first time a future mint site pushed a rule without claiming, leaving that rule on the wire and
      * invisible to the check. Deliberately order-blind, so applying one preset twice is an error too, and
      * checked BEFORE the rule's shape normalizers, because the name is the rule's identity — except where a
-     * mint site cannot know its names that early (the `credentialHosts` split) or has already refused the entry
-     * outright. `fix` is the one sentence that differs per mint site.
+     * mint site has already refused the entry outright. `fix` is the one sentence that differs per mint site.
      */
     claimRuleName(name, fix) {
         if (this.rules.some((rule) => rule.name === name)) {
@@ -252,16 +215,17 @@ export class EgressPolicy {
         if (typeof first === "string") {
             const rule = second;
             this.claimRuleName(first, "Rename one of them, or drop the duplicate declaration.");
+            // COPIED on intake by each normalizer: the stored rule is the policy's own snapshot, so a caller
+            // mutating their `hosts`/`paths` array after `allow()` cannot change what later synths emit.
+            const hosts = normalizeHosts(first, rule.hosts);
+            refuseRuleCredential(first, rule, hosts);
             this.rules.push({
                 name: first,
                 action: "allow",
-                // COPIED on intake by each normalizer: the stored rule is the policy's own snapshot, so a caller
-                // mutating their `hosts`/`paths` array after `allow()` cannot change what later synths emit.
-                hosts: normalizeHosts(first, rule.hosts),
+                hosts,
                 priority: rule.priority,
                 paths: normalizePaths(first, rule.paths),
                 methods: normalizeMethods(first, rule.methods),
-                credentials: normalizeCredentials(first, rule),
             });
             return this;
         }
@@ -269,59 +233,24 @@ export class EgressPolicy {
         const opts = second ?? {};
         const name = opts.name ?? `connection-${connectionLabel(connection)}`;
         const hosts = connection.provider.apiHosts.map((host) => interpolateHost(host, connection.installValues, { providerId: connection.provider.id, ruleName: name }));
-        const priority = opts.priority ?? CONNECTION_RULE_PRIORITY;
-        const paths = normalizePaths(name, opts.paths);
+        if (opts.credentialHosts !== undefined) {
+            throw new Error(`egress rule '${name}': 'credentialHosts' is not accepted, because a rule carries no credential. The ` +
+                `connection's own 'hosts' choose the catalog hosts its credential is presented on, such as ` +
+                `hosts: ${JSON.stringify(opts.credentialHosts)} on the Connection. Drop 'credentialHosts' from this ` +
+                `rule.`);
+        }
         // The derived name is what two grants for the SAME connection collide on — most often a second, narrower
         // `allow(connection, { paths })` beside the broad one. `name:` is the knob.
-        const connectionNameFix = `Give one of the two grants its own name (\`allow(connection, { name: "…" })\`), or fold them into ` +
-            `one rule.`;
-        if (opts.credentialHosts === undefined) {
-            this.claimRuleName(name, connectionNameFix);
-            this.rules.push({
-                name,
-                action: "allow",
-                hosts,
-                priority,
-                paths,
-                methods: ["*"],
-                connectionId: connection.connectionId,
-                valueTemplate: AUTHORIZATION_TEMPLATE,
-            });
-            return this;
-        }
-        // Both partitions preserve the provider's declaration order, and both names are derived (never
-        // author-supplied) so the pair is deterministic across synths.
-        const credentialed = validateCredentialHosts(opts.credentialHosts, hosts, {
-            providerId: connection.provider.id,
-            ruleName: name,
-        });
-        const remainder = hosts.filter((host) => !credentialed.has(host));
-        // Each partition name is claimed right before its own push: the pair is derived and mutually
-        // collision-safe, but the BASE name is the author's.
-        this.claimRuleName(`${name}${CREDENTIAL_RULE_SUFFIX}`, connectionNameFix);
+        this.claimRuleName(name, `Give one of the two grants its own name (\`allow(connection, { name: "…" })\`), or fold them into ` +
+            `one rule.`);
         this.rules.push({
-            name: `${name}${CREDENTIAL_RULE_SUFFIX}`,
+            name,
             action: "allow",
-            hosts: hosts.filter((host) => credentialed.has(host)),
-            priority,
-            paths: [...paths],
+            hosts,
+            priority: opts.priority ?? CONNECTION_RULE_PRIORITY,
+            paths: normalizePaths(name, opts.paths),
             methods: ["*"],
-            connectionId: connection.connectionId,
-            valueTemplate: AUTHORIZATION_TEMPLATE,
         });
-        // Omitted when the subset is every host: an empty-host rule would allow nothing.
-        if (remainder.length > 0) {
-            this.claimRuleName(`${name}${CREDENTIAL_FREE_RULE_SUFFIX}`, connectionNameFix);
-            this.rules.push({
-                name: `${name}${CREDENTIAL_FREE_RULE_SUFFIX}`,
-                action: "allow",
-                hosts: remainder,
-                priority,
-                paths: [...paths],
-                methods: ["*"],
-                credentials: [],
-            });
-        }
         return this;
     }
     /**
@@ -329,9 +258,8 @@ export class EgressPolicy {
      * host, everything on that host is open, and a deny carves a hole back out of it while the allow beside it
      * serves the rest. **Deny wins among equal-priority matches**, so it can never lose a tie, but it CAN lose
      * to a strictly higher-priority allow — which is why its default priority sits above the band the
-     * credentialed allow rules use. A denied request fails closed at the broker and the credential the allow
-     * would have injected is never resolved: a fence at the network edge, not a narrowing of what the agent may
-     * see or ask for. Both `paths` and `methods` default to `["*"]`, so `deny(name, { hosts })` is a total
+     * connection allow rules use. A denied request fails closed at the broker before any credential is
+     * resolved: a fence at the network edge, not a narrowing of what the agent may see or ask for. Both `paths` and `methods` default to `["*"]`, so `deny(name, { hosts })` is a total
      * revocation on a host an allow rule opens; narrow at least one when the intent is partial.
      */
     deny(name, rule) {
@@ -345,19 +273,18 @@ export class EgressPolicy {
             priority: rule.priority ?? DEFAULT_DENY_PRIORITY,
             paths: normalizePaths(name, rule.paths),
             methods: normalizeMethods(name, rule.methods),
-            credentials: [],
         });
         return this;
     }
     /**
-     * Routes this environment's model traffic through the model gateway with a gateway key: one ordinary allow
-     * rule named `model-gateway` on the gateway host, whose binding adds `Authorization: Bearer <key>`. The rule
-     * only adds the key; the harness learns the gateway address from the agent's
-     * `modelSettings.enableModelGateway`, which an app routing through the gateway sets as well.
-     *
-     * `inject()` rather than `bearer()` because the runtime image bakes an `ANTHROPIC_API_KEY` placeholder the
-     * claude harness sends as `x-api-key`, and the gateway refuses a request whose two key headers disagree.
-     * `removeHeaders` strips the placeholder before injection; the other harnesses never send it.
+     * Routes this environment's model traffic through the model gateway: one ordinary allow rule named
+     * `model-gateway` on the gateway host. The key is presented by its own Secret, which declares the gateway
+     * host in its `hosts` and an `injection` recipe — `Authorization: Bearer ${secret}`, removing `x-api-key`,
+     * because the runtime image bakes an `ANTHROPIC_API_KEY` placeholder the claude harness sends as `x-api-key`
+     * and the gateway refuses a request whose two key headers disagree. A declared key is checked for both at
+     * synth; an imported one cannot be read here and is the platform's to check. The harness learns the gateway
+     * address from the agent's `modelSettings.enableModelGateway`, which an app routing through the gateway sets
+     * as well.
      */
     routeModelsViaGateway(opts) {
         // Read through an optional chain: an untyped `npx tsx` caller can omit the options bag entirely.
@@ -371,14 +298,20 @@ export class EgressPolicy {
             throw new Error(`routeModelsViaGateway(): 'host' must be a bare hostname such as "${DEFAULT_MODEL_GATEWAY_HOST}", ` +
                 `but got ${JSON.stringify(host)}. Drop any scheme, path, port or '*'.`);
         }
-        return this.allow(DEFAULT_MODEL_GATEWAY_RULE_NAME, {
-            hosts: [host],
-            priority: DEFAULT_MODEL_GATEWAY_PRIORITY,
-            credential: inject(key, {
-                headers: [{ name: "Authorization", value: "Bearer ${secret}" }],
-                removeHeaders: ["x-api-key"],
-            }),
-        });
+        if (key instanceof Secret) {
+            const remedy = `Declare it as new Secret(scope, id, { value: SecretValue.fromGatewayKey(gatewayKey), ` +
+                `hosts: ["${host}"], injection: { headers: [{ name: "Authorization", value: "Bearer \${secret}" }], ` +
+                `removeHeaders: ["x-api-key"] } }).`;
+            if (!key._presentsHeader()) {
+                throw new Error(`routeModelsViaGateway(): key Secret '${key.node.path.join("/")}' has no 'injection' header, so the ` +
+                    `gateway key is never presented. ${remedy}`);
+            }
+            if (!key._hosts().some((pattern) => hostPatternCovers(pattern, host))) {
+                throw new Error(`routeModelsViaGateway(): key Secret '${key.node.path.join("/")}' does not cover '${host}' in its ` +
+                    `'hosts' ${JSON.stringify(key._hosts())}, so model calls would leave with no key. ${remedy}`);
+            }
+        }
+        return this.allow(DEFAULT_MODEL_GATEWAY_RULE_NAME, { hosts: [host], priority: DEFAULT_MODEL_GATEWAY_PRIORITY });
     }
     /**
      * Each entry lands as an ordinary allow rule — the same wire shape, in the same `rules` array, in the same
@@ -386,18 +319,12 @@ export class EgressPolicy {
      * hand: there is nothing to learn about presets when reading a plan, a diff, or the live environment.
      *
      * Rules are appended where the call sits in the chain, and the matcher arbitrates by priority first (preset
-     * rows sit below every band shipped policies use) and by declaration order only among equal-priority ties,
-     * where a credentialed rule outranks a zero-binding one — so a preset's anonymous row can never shadow an
-     * author's credentialed rule for the same host. A name collision is a synth error, so applying a preset over
-     * a rule you already named fails, and so does applying the same preset twice.
+     * rows sit below every band shipped policies use) and by declaration order only among equal-priority ties.
+     * A name collision is a synth error, so applying a preset over a rule you already named fails, and so does
+     * applying the same preset twice.
      */
     applyPreset(bundle) {
         for (const rule of bundle) {
-            // This is the ONE place a bundle entry's credential is read, and recognition is by instance identity,
-            // never by property shape: a hand-built object with the same fields — or a `structuredClone` of a real
-            // entry — is simply not one, so it folds as the ordinary anonymous allow rule its fields describe. That
-            // degradation is the safety property: the worst an author can express by hand is a credential-free rule.
-            const credential = connectionCredentialOf(rule);
             // `action` is typed `"allow"` and nothing else, but a bundle assembled by hand in an untyped `npx tsx`
             // app carries whatever it carries, and an entry spelling `action: "deny"` folded on as an ALLOW rule
             // would invert the author's stated prohibition into a grant with no error anywhere. Checked before the
@@ -407,11 +334,10 @@ export class EgressPolicy {
                     `${JSON.stringify(rule.action)}. A bundle opens reachability; a prohibition is the app's own ` +
                     `\`deny(...)\` rule, stated where a reader looks for it and at a priority that wins.`);
             }
-            this.claimRuleName(rule.name, credential !== undefined
-                ? `A connection's bundle supersedes a separate \`allow(connection)\` grant — apply one of them, ` +
-                    `and apply each connection's bundle once.`
-                : `Rename the rule you authored, drop it in favor of the preset's, or apply the preset once.`);
-            const common = {
+            this.claimRuleName(rule.name, `Rename the rule you authored, drop it in favor of the preset's, or apply the preset once. A ` +
+                `connection's bundle supersedes a separate \`allow(connection)\` grant — apply one of them, and ` +
+                `apply each connection's bundle once.`);
+            this.rules.push({
                 name: rule.name,
                 // Narrowed, not assumed: the guard above has already refused every other spelling.
                 action: "allow",
@@ -419,20 +345,14 @@ export class EgressPolicy {
                 priority: rule.priority,
                 paths: normalizePaths(rule.name, rule.paths),
                 methods: normalizeMethods(rule.name, rule.methods),
-            };
-            this.rules.push(credential !== undefined
-                ? // The SAME `ConnectionAllowRule` shape `allow(connection)` stores, so the wire is one shape from
-                    // one place, carrying whichever carriage the entry declared.
-                    { ...common, connectionId: credential.connectionId, valueTemplate: credential.valueTemplate }
-                : { ...common, credentials: [] });
+            });
         }
         return this;
     }
     /**
-     * Every emitted array is FRESH — `hosts`/`paths` are copied out of the stored rule and
-     * `credentialBindingsFor` builds new literals — so the payload shares no mutable structure with the policy.
-     * Without the copy, mutating one synthesized plan's `rules[i].hosts` would mutate the stored rule and every
-     * later synth would emit the mutation.
+     * Every emitted array is FRESH — `hosts`/`paths`/`methods` are copied out of the stored rule — so the payload
+     * shares no mutable structure with the policy. Without the copy, mutating one synthesized plan's
+     * `rules[i].hosts` would mutate the stored rule and every later synth would emit the mutation.
      */
     _toPayload() {
         return {
@@ -445,41 +365,10 @@ export class EgressPolicy {
                 hosts: [...rule.hosts],
                 paths: [...rule.paths],
                 methods: [...rule.methods],
-                agentIds: [],
-                credentialBindings: credentialBindingsFor(rule),
             })),
         };
     }
 }
-/**
- * The omitted keys on each arm are deliberate, not defaults-elided: the platform classifies a binding as
- * "recipe" from the BLANK `header` and rejects an omitted header paired with a meaningful `valueTemplate`, or
- * a `header` beside an `injection`. Omission is safe against both the whole-object PATCH (the server
- * re-applies its own defaults, which is exactly the recipe shape) and the no-change diff, which walks the
- * DESIRED keys only.
- */
-function credentialBindingsFor(rule) {
-    if (isConnectionRule(rule)) {
-        // `valueTemplate` is the rule's own stored carriage, a platform placeholder naming a RENDERING rather than
-        // a credential value.
-        return [
-            { header: "Authorization", connectionId: rule.connectionId, valueTemplate: rule.valueTemplate },
-        ];
-    }
-    // Each arm's exact wire keys are projected again here, never spread, so the plan payload can never carry a
-    // stray key or an object by reference. The `injection` recipe is the one nested mutable structure, and it is
-    // DEEP-COPIED because the stored one is shared across synths: without that, a caller mutating one returned
-    // plan's recipe would corrupt the stored policy and every later synth would emit the mutation unvalidated.
-    return rule.credentials.map((binding) => {
-        if (binding.injection !== undefined) {
-            return { secretId: binding.secretId, injection: cloneInjectionRecipe(binding.injection) };
-        }
-        if (binding.header === undefined) {
-            return { secretId: binding.secretId };
-        }
-        return { header: binding.header, secretId: binding.secretId, valueTemplate: binding.valueTemplate };
-    });
-}
 /**
  * Used for exactly one thing: deriving an OMITTED memory from the selected cpu, the same way the platform
  * derives it. A flat `"4G"` fill would make `{ cpu: "8" }` synthesize `8 : 4G` — half a gigabyte per core — so
@@ -642,6 +531,7 @@ export class Environment extends Construct {
                     ? { computeProviderId: this.props.computeProvider?.computeProviderId ?? null }
                     : {}),
             },
+            ...(this.props.team !== undefined ? { teamId: this.props.team.teamId } : {}),
         };
         return { kind: "environment", path: this.node.path.join("/"), slug, managed: true, payload };
     }

package/dist/constructs/gateway-key.d.ts

@@ -1,6 +1,6 @@
 import { Construct } from "../core/construct.js";
 import type { PlanResource } from "../core/plan.js";
-import type { IGatewayKey } from "./interfaces.js";
+import type { IGatewayKey, ITeam } from "./interfaces.js";
 export interface GatewayKeyProps {
     readonly slug?: string;
     readonly displayName?: string;
@@ -10,6 +10,8 @@ export interface GatewayKeyProps {
      */
     readonly monthlyCreditCap?: number;
     readonly labels?: Record<string, string>;
+    /** Fixed at create, and the same as its paired Secret's; undeclared, the key is created in Shared. */
+    readonly team?: ITeam;
 }
 export declare class GatewayKey extends Construct implements IGatewayKey {
     /** Accepts a platform id or a slug interchangeably — one rule, stated on `IResource`. */
@@ -18,6 +20,7 @@ export declare class GatewayKey extends Construct implements IGatewayKey {
     private readonly displayName;
     private readonly monthlyCreditCap;
     private readonly labels;
+    private readonly team;
     constructor(scope: Construct, id: string, props?: GatewayKeyProps);
     get slug(): string;
     /** @internal */

package/dist/constructs/gateway-key.js

@@ -16,6 +16,7 @@ export class GatewayKey extends Construct {
     displayName;
     monthlyCreditCap;
     labels;
+    team;
     constructor(scope, id, props = {}) {
         super(scope, id);
         validateExplicitSlug(this, props.slug, "gateway-key");
@@ -28,6 +29,7 @@ export class GatewayKey extends Construct {
         this.displayName = props.displayName ?? id;
         this.monthlyCreditCap = props.monthlyCreditCap;
         this.labels = { ...(props.labels ?? {}) };
+        this.team = props.team;
         this.gatewayKeyId = refToken("gateway-key", this.node.path);
     }
     get slug() {
@@ -46,9 +48,7 @@ export class GatewayKey extends Construct {
     }
     _toPlanResource() {
         const slug = this.slug;
-        // `projectId` is stamped by `Factory.synth()` for a project-backed factory — a gateway key keeps the
-        // project stamp, unlike the org-commons `model-provider-key`. `labels` is always emitted because the
-        // create wire requires it; that is safe on UPDATE because `engine/gateway-key-reconcile.ts` assembles the
+        // `labels` is always emitted because the create wire requires it; that is safe on UPDATE because `engine/gateway-key-reconcile.ts` assembles the
         // PATCH one declared field at a time from actual drift, so an empty declared map is never sent and a
         // PATCH of some other field cannot clear labels a sibling app or the console set on a shared key.
         const payload = {
@@ -56,6 +56,7 @@ export class GatewayKey extends Construct {
             displayName: this.displayName,
             labels: { ...this.labels },
             ...(this.monthlyCreditCap !== undefined ? { monthlyCreditCap: this.monthlyCreditCap } : {}),
+            ...(this.team !== undefined ? { teamId: this.team.teamId } : {}),
         };
         return { kind: "gateway-key", path: this.node.path.join("/"), slug, managed: true, payload };
     }

package/dist/constructs/interfaces.d.ts

@@ -17,9 +17,17 @@ export interface IResource {
      */
     _resourceId(): string;
 }
-export interface IProject extends IResource {
+export interface ITeam extends IResource {
     /** Accepts a platform id or a slug interchangeably — one rule, stated on {@link IResource}. */
-    readonly projectId: string;
+    readonly teamId: string;
+}
+/** A managed role's slug is its id, so `roleId` holds either a managed slug or a custom role's reference. */
+export interface IRole extends IResource {
+    readonly roleId: string;
+}
+/** A policy has no slug, so it is named by its id alone. */
+export interface IPolicy extends IResource {
+    readonly policyId: string;
 }
 /**
  * The exactly-emitted plan literal for one egress credential binding: a legacy single-header binding

package/dist/constructs/model-provider-key.js

@@ -3,9 +3,8 @@
 // error (`engine/model-provider-key-reconcile.ts`). The credential is write-only and is not a platform
 // `Secret`: it has no id to bind, cannot be injected at egress, and leaves only through the gateway, so this
 // construct reuses the `SecretValue` recipe machinery without minting a Secret, and a `fromGatewayKey` recipe
-// — whose write protocol is defined for a paired Secret alone — is rejected at synth. The row is org-commons
-// with no project axis (exempt from `Factory.stampResourceProject`), and nothing in an orchestra app can reference
-// a BYOK key, which is why there is no reference interface, no `*Id` property and no importer.
+// — whose write protocol is defined for a paired Secret alone — is rejected at synth. The row is
+// organization-wide with no team, and nothing in an orchestra app can reference a BYOK key, which is why there is no reference interface, no `*Id` property and no importer.
 import { Construct } from "../core/construct.js";
 import { containsGatewayKeyRecipe, gatewayKeyNestingError } from "../core/gateway-key-recipe.js";
 import { validateDeclaredLabels } from "../core/labels.js";

package/dist/constructs/pipeline.d.ts

@@ -1,6 +1,6 @@
 import { Construct } from "../core/construct.js";
 import type { PlanResource } from "../core/plan.js";
-import type { IAgent, IResource } from "./interfaces.js";
+import type { IAgent, IResource, ITeam } from "./interfaces.js";
 import { type FilterInput, type FilterNode } from "./workflow-filter.js";
 /** The platform reads only open (`TODO`, `IN_PROGRESS`) or closed (`DONE`, `CANCELED`). */
 export type StageCategory = "TODO" | "IN_PROGRESS" | "DONE" | "CANCELED";
@@ -79,6 +79,8 @@ export interface PipelineProps {
      * someone deletes it.
      */
     workflows?: readonly PipelineWorkflowProps[];
+    /** Fixed at create; undeclared, the pipeline is created in Shared. Its workflows take its team. */
+    team?: ITeam;
 }
 export interface IPipeline extends IResource {
     /** Accepts a platform id or a slug interchangeably — one rule, stated on `IResource`. */
@@ -122,7 +124,7 @@ export interface PipelinePayload {
     overrideGate?: boolean;
     checkGrants?: CheckGrantDocument[];
     workflows?: PipelineEntryDocument[];
-    projectId?: string;
+    teamId?: string;
 }
 export declare const OPEN_CATEGORIES: ReadonlySet<StageCategory>;
 export declare const SET_CHECK_ACTION = "work-items:setWorkItemCheck";
@@ -142,6 +144,7 @@ export declare class Pipeline extends Construct implements IPipeline {
     private readonly listed;
     private readonly running;
     private readonly grants;
+    private readonly team;
     constructor(scope: Construct, id: string, props: PipelineProps);
     /** @internal */
     _resourceId(): string;

package/dist/constructs/pipeline.js

@@ -33,6 +33,7 @@ export class Pipeline extends Construct {
     listed;
     running = [];
     grants = [];
+    team;
     constructor(scope, id, props) {
         super(scope, id);
         const where = `pipeline '${this.node.path.join("/")}'`;
@@ -56,6 +57,7 @@ export class Pipeline extends Construct {
         // Checked here, where the author wrote them, and built again at synth beside the running workflows.
         for (const listed of this.listed)
             entryDocuments(listed, where);
+        this.team = props.team;
         this.pipelineId = refToken("pipeline", this.node.path);
     }
     /** @internal */
@@ -106,6 +108,8 @@ export class Pipeline extends Construct {
                 statement: { effect: "allow", actions: [SET_CHECK_ACTION], resources: [checkResource(key)] },
             }));
         }
+        if (this.team !== undefined)
+            payload.teamId = this.team.teamId;
         return { kind: "pipeline", path: this.node.path.join("/"), slug, managed: true, payload };
     }
     /** The listed entries, then one following the newest version for each running workflow the list leaves out. */