@orchestraworks/cli 0.5.5 → 0.5.8

package/README.md

@@ -20,7 +20,7 @@ The full guide to every construct, secrets, connections and troubleshooting is [
 ```bash
 npm install -g @orchestraworks/cli         # the CLI, on your path as `orchestra`
 npm install @orchestraworks/cli            # the current release
-npm install @orchestraworks/cli@0.5.5      # this exact release
+npm install @orchestraworks/cli@0.5.8      # this exact release
 ```
 
 Then `import { Factory, Agent, … } from "@orchestraworks/cli"` normally — the package `exports` entry resolves

package/dist/artifacts/prelude.js

@@ -260,8 +260,17 @@
   }
 
   function onKeyDown(event) {
-    if (event.key === "Escape" && commentMode) {
+    if (event.key !== "Escape") {
+      return;
+    }
+    if (commentMode) {
       setCommentMode(false);
+      return;
+    }
+    // A key pressed in this frame never reaches the console's document, so an Escape the page left
+    // unused is passed on: it is how a reader leaves the console's full-screen layer from inside a page.
+    if (!event.defaultPrevented) {
+      window.parent.postMessage({ sf: 1, event: "escape" }, consoleOrigin);
     }
   }
 

package/dist/cli/api/execute.js

@@ -327,8 +327,8 @@ async function storeDeclaredFile(row, invocation, body, apis, target, deps, io)
         fetchApi: (deps.fetchApi ?? fetch),
         io,
         organizationId: target.organizationId,
-        projectId: stringField(body, "projectId") ??
-            (await ownerProject(row, invocation, apis, target.organizationId)),
+        teamId: stringField(body, "teamId") ??
+            (await ownerTeam(row, invocation, apis, target.organizationId)),
         // The one create describes one file: what it says about the name and the type governs both calls, so
         // the upload cannot land as something the create did not ask for.
         filename: stringField(body, "filename"),
@@ -359,13 +359,13 @@ async function readStoredFile(row, invocation, apis, target, fileId) {
 }
 /**
  * Where a create that publishes UNDER an item puts its file: with that item. `artifacts create-version` has
- * no project field of its own, so without this the upload is declared in the organization commons — which a
- * `files:createFile` grant conditioned to the artifact's project refuses, and an unconditioned one accepts
- * into the wrong place for good, since a file's project is fixed when it is declared.
+ * no team field of its own, so without this the upload is declared in Shared — which a `files:createFile`
+ * grant at the artifact's team refuses, and a wider one accepts into the wrong place for good, since a
+ * file's team is fixed when it is declared.
  *
  * A failure is raised rather than swallowed: a placement that cannot be read must not be guessed.
  */
-async function ownerProject(row, invocation, apis, organizationId) {
+async function ownerTeam(row, invocation, apis, organizationId) {
     const owner = findCommand(row.noun, "get");
     if (owner === undefined || !sameItemPath(owner, row)) {
         return undefined;
@@ -379,7 +379,7 @@ async function ownerProject(row, invocation, apis, organizationId) {
     if (typeof read !== "object" || read === null || Array.isArray(read)) {
         return undefined;
     }
-    return stringField(read, "projectId");
+    return stringField(read, "teamId");
 }
 function stringField(body, field) {
     const value = body[field];

package/dist/cli/core/auth.d.ts

@@ -14,6 +14,8 @@ export declare const AUTH_ENV: {
     /** Read after `baseUrl`: the platform writes this name into every machine. */
     readonly machineBaseUrl: "PLATFORM_BASE_URL";
     readonly token: "ORCHESTRA_API_TOKEN";
+    /** Set by the worker on each harness and hook process; the file holds a token it renews. */
+    readonly tokenFile: "ORCHESTRA_API_TOKEN_FILE";
     readonly organizationId: "ORCHESTRA_ORGANIZATION_ID";
     /** Presence is the declaration. */
     readonly edgeInjected: "SFDK_AUTH_EDGE_INJECTED";
@@ -26,7 +28,7 @@ export declare function baseUrlFromEnv(env: NodeJS.ProcessEnv): {
     readonly variable: string;
 } | undefined;
 /** Which tier of the chain supplied the authorization. */
-export type AuthProvider = "env" | "profile" | "edge";
+export type AuthProvider = "env" | "file" | "profile" | "edge";
 /**
  * The conversation the command runs in, or undefined when the variable is absent, empty or whitespace only.
  * The only reader of the variable: auth resolution and `login` both call it.
@@ -36,6 +38,9 @@ export declare function sessionIdFrom(env: NodeJS.ProcessEnv): string | undefine
  * `session` rides along under the PROFILE provider only: `token` is the bearer as of this resolution, and
  * the session is what keeps a bearer valid over time. The env provider's token has nothing to refresh it
  * with and the edge provider holds no credential at all, so for both the field's absence is structural.
+ *
+ * Under the FILE provider the worker renews the token in place, so `token` reads the file again before each
+ * request, and the token names its own organization, so no organization is resolved.
  */
 export type AuthResolution = {
     readonly provider: "env" | "profile";
@@ -44,6 +49,11 @@ export type AuthResolution = {
     readonly organizationId?: string;
     readonly session?: CredentialSession;
     readonly sessionId?: string;
+} | {
+    readonly provider: "file";
+    readonly token: () => string;
+    readonly baseUrl: string;
+    readonly sessionId?: string;
 } | {
     readonly provider: "edge";
     readonly baseUrl: string;

package/dist/cli/core/auth.js

@@ -1,8 +1,9 @@
 // Every command resolves credentials through ONE ordered chain, with strict presence-is-selection
 // precedence: `ORCHESTRA_API_TOKEN` (one opaque slot holding ANY principal's bearer — the CLI never looks inside,
-// IAM judges server-side), then the `orchestra auth login` profile, then the sandbox flag the platform DECLARES and
-// never infers (the request goes out BARE and the egress stamps the per-request agent authorization, so no
-// credential material ever enters the sandbox), then a refusal.
+// IAM judges server-side), then the agent token file the worker names in `ORCHESTRA_API_TOKEN_FILE` and renews
+// while the agent is placed, then the `orchestra auth login` profile, then the sandbox flag the platform
+// DECLARES and never infers (the request goes out BARE and the egress stamps the per-request agent
+// authorization), then a refusal.
 //
 // The precedence is purely CLIENT-side. Inside a sandbox the egress stamp REPLACES whatever the request
 // carried, so an exported token is sent, then overwritten, and the call executes as the agent.
@@ -13,6 +14,7 @@
 // Resolution is ASYNC because the profile tier renews itself. The renewal lives in
 // `core/credentialSession.ts`: this module decides WHICH credential a command uses, and the session owns
 // what happens to it over time.
+import { readFileSync } from "node:fs";
 import { CredentialSession } from "./credentialSession.js";
 import { DEFAULT_PROFILE_NAME, loadProfile as loadProfileFromDisk, } from "./profile.js";
 /**
@@ -28,6 +30,8 @@ export const AUTH_ENV = {
     /** Read after `baseUrl`: the platform writes this name into every machine. */
     machineBaseUrl: "PLATFORM_BASE_URL",
     token: "ORCHESTRA_API_TOKEN",
+    /** Set by the worker on each harness and hook process; the file holds a token it renews. */
+    tokenFile: "ORCHESTRA_API_TOKEN_FILE",
     organizationId: "ORCHESTRA_ORGANIZATION_ID",
     /** Presence is the declaration. */
     edgeInjected: "SFDK_AUTH_EDGE_INJECTED",
@@ -80,6 +84,26 @@ export class MissingBaseUrlError extends Error {
         this.name = "MissingBaseUrlError";
     }
 }
+/** The trimmed content, or undefined when the file is missing, unreadable, empty or whitespace only. */
+function tokenFromFile(path) {
+    let content;
+    try {
+        content = readFileSync(path, "utf8");
+    }
+    catch {
+        return undefined;
+    }
+    const token = content.trim();
+    return token === "" ? undefined : token;
+}
+/** A failed read mid-command keeps the last token read rather than sending the request bare. */
+function fileTokenReader(path, first) {
+    let last = first;
+    return () => {
+        last = tokenFromFile(path) ?? last;
+        return last;
+    };
+}
 /** Loopback hosts reachable over plain HTTP — the local dev-stack contract. */
 const LOOPBACK_HOSTS = new Set(["127.0.0.1", "localhost", "::1"]);
 /**
@@ -132,12 +156,18 @@ export async function resolveAuthWithWarnings(env, flags, deps = {}) {
     const profile = (deps.loadProfile ?? loadProfileFromDisk)(flags.profile);
     const baseUrl = firstPresent(flags.baseUrl, baseUrlFromEnv(env)?.value, profile?.baseUrl);
     const envToken = firstPresent(env[AUTH_ENV.token]);
+    const tokenFilePath = firstPresent(env[AUTH_ENV.tokenFile]);
+    const fileToken = envToken === undefined && tokenFilePath !== undefined ? tokenFromFile(tokenFilePath) : undefined;
     const profileToken = firstPresent(profile?.token);
     const edgeDeclared = firstPresent(env[AUTH_ENV.edgeInjected]) !== undefined;
     // Read before the provider split: a person may export it by hand under any provider.
     const sessionId = sessionIdFrom(env);
     const withSessionId = sessionId !== undefined ? { sessionId } : {};
-    if (envToken === undefined && profileToken === undefined && !edgeDeclared) {
+    if (envToken === undefined && fileToken === undefined && profileToken === undefined && !edgeDeclared) {
+        if (tokenFilePath !== undefined) {
+            throw new MissingCredentialsError(`no auth provider resolved: ${AUTH_ENV.tokenFile} names ${tokenFilePath}, which the worker has not ` +
+                `written yet. The worker writes it once the agent is placed on this machine; try again shortly.`);
+        }
         throw new MissingCredentialsError(`no auth provider resolved: export ${AUTH_ENV.token}, run \`orchestra auth login\`, or run inside a host ` +
             `where the platform declares ${AUTH_ENV.edgeInjected}.`);
     }
@@ -146,6 +176,17 @@ export async function resolveAuthWithWarnings(env, flags, deps = {}) {
     }
     // Refuse before ANY network access, for every provider — the bare edge send included.
     assertSecretTransport(baseUrl);
+    if (fileToken !== undefined && tokenFilePath !== undefined) {
+        return {
+            auth: {
+                provider: "file",
+                token: fileTokenReader(tokenFilePath, fileToken),
+                baseUrl,
+                ...withSessionId,
+            },
+            warnings: [],
+        };
+    }
     if (envToken === undefined && profileToken === undefined) {
         // The egress stamps the authorization and the stamped identity carries the org.
         return { auth: { provider: "edge", baseUrl, ...withSessionId }, warnings: [] };
@@ -223,6 +264,9 @@ export function platformTargetFrom(auth) {
     if (auth.provider === "edge") {
         return { baseUrl: auth.baseUrl, ...sessionId };
     }
+    if (auth.provider === "file") {
+        return { baseUrl: auth.baseUrl, token: auth.token, ...sessionId };
+    }
     return {
         baseUrl: auth.baseUrl,
         token: auth.token,

package/dist/cli/core/errors.js

@@ -182,6 +182,10 @@ function guidance(status, api, ctx) {
             case "env":
                 return (`The token in ${AUTH_ENV.token} is not accepted. Renew that token and re-export ` +
                     `${AUTH_ENV.token}; a stored login profile is not what this command used.`);
+            case "file":
+                return (`The agent token in the file ${AUTH_ENV.tokenFile} names is not accepted. The worker renews that ` +
+                    `file, so there is nothing to renew here: the token expired before the worker renewed it, or the ` +
+                    `agent's placement on this machine, the machine's state or the agent's status refused it.`);
             case "edge":
                 return (`Authorization is stamped at the egress edge (${AUTH_ENV.edgeInjected} is declared), so there is ` +
                     `no credential here to renew — the stamping path itself failed. Check the egress/identity plane.`);

package/dist/cli/core/platform-client.d.ts

@@ -50,7 +50,8 @@ export declare function withRefreshRetry(fetchApi: FetchAPI, session: Credential
  */
 export interface PlatformTarget {
     readonly baseUrl: string;
-    readonly token?: string;
+    /** The bearer, or under the file provider a reader of the worker's renewed token, called before each request. */
+    readonly token?: string | (() => string);
     readonly organizationId?: string;
     /**
      * `token` above is the bearer as of auth resolution; the session is what keeps a bearer valid, and every
@@ -73,7 +74,7 @@ export declare function createPlatformApis(target: PlatformTarget, fetchApi: Fet
 export interface RawPlatformRequest {
     baseUrl: string;
     /** Absent for the bare edge send, exactly as for a typed command. */
-    token?: string;
+    token?: string | (() => string);
     organizationId?: string;
     /** The live credentials behind `token`, when the resolution carried one. */
     session?: CredentialSession;

package/dist/cli/core/profile.d.ts

@@ -15,9 +15,9 @@ export interface Profile {
     /**
      * The remaining three are the first-run interview's answers, kept beside the credential because they are
      * answers about this machine that nothing should ask twice. Absent means the question was never answered;
-     * an absent `projectId` in particular is an answer of its own — the organization's shared commons.
+     * an absent `teamId` in particular is an answer of its own: Shared.
      */
-    projectId?: string;
+    teamId?: string;
     role?: string;
     harnesses?: string[];
 }

package/dist/cli/factory/apply-preview.d.ts

@@ -1,10 +1,11 @@
 import type { PlanImport, PlanResource, SynthResult } from "../../core/plan.js";
-import { type DesiredProject } from "../../engine/apply-core.js";
+import { type TeamResolver } from "../../engine/apply-core.js";
 import type { PlatformApis } from "../../engine/client.js";
 import { type DiffEntry, type DiffReadCache } from "../../engine/diff.js";
 import { type makeTriggersApi, type TriggerAction, type TriggerReconcileOutcome } from "../../engine/trigger-reconcile.js";
 import { type WorkflowAction, type WorkflowReconcileOutcome } from "../../engine/workflow-reconcile.js";
 import { type ImageBuildSpec } from "./docker.js";
+import { type HostedImages } from "./image-upload.js";
 /**
  * Taken off the module-level factory rather than restated: the preview needs the RAW adapter, because the
  * generated typed converter truncates the free-form `where`/`binding` subtrees, and a restated signature
@@ -38,9 +39,21 @@ export interface ApplyPreview {
     blockedImports: BlockedImport[];
     /** The image builds this run would perform (empty under `--no-docker-build`). */
     pendingImageBuilds: ImageBuildSpec[];
+    /**
+     * The builds among {@link pendingImageBuilds} that upload to the platform rather than push, each with the
+     * digest of its newest `READY` image. The new digest exists only after the build, so it is not shown.
+     */
+    hostedUploads?: HostedUpload[];
     /** True iff anything non-no-op and non-blocked would happen, or an image would be built. */
     firing: boolean;
 }
+export interface HostedUpload {
+    tag: string;
+    name: string;
+    dockerfile: string;
+    /** Absent when the platform holds no `READY` image of this name yet. */
+    readyDigest?: string;
+}
 /** What the workflow + trigger previews need — the half `orchestra fdk diff` shares with apply's pre-flight. */
 export interface PreviewCompositionOptions {
     /**
@@ -48,11 +61,14 @@ export interface PreviewCompositionOptions {
      * inputs rather than one of them reading `process.env` behind the other's back.
      */
     env: Record<string, string | undefined>;
-    /** The factory's project placement, resolved ONCE by the caller and shared with reconcile's classifiers. */
-    project: DesiredProject;
+    /**
+     * Each row's team, resolved over one set of team reads the caller shares with its other preview passes;
+     * absent, the preview builds its own.
+     */
+    teams?: TeamResolver;
     makeTriggersApi: MakeTriggersApi;
     /**
-     * Supplying the SAME cache the plan-resource pass uses is what stops the managed agent and project rows
+     * Supplying the SAME cache the plan-resource pass uses is what stops the managed agent and team rows
      * being GET twice per command.
      */
     reads: DiffReadCache;
@@ -63,6 +79,8 @@ export interface ApplyPreviewOptions extends Omit<PreviewCompositionOptions, "re
     dockerBuild: boolean;
     /** Optional: apply's pre-flight passes none and gets a fresh per-run memo (see {@link DiffReadCache}). */
     reads?: DiffReadCache;
+    /** Absent when the plan declares no hosted image; apply reads it once and shares it with the build phase. */
+    hostedImages?: HostedImages;
 }
 /**
  * Reads only — no POST, no PATCH, no docker. Unresolvable reachable imports short-circuit everything else:
@@ -96,8 +114,7 @@ export declare function isFiringAction(outcome: {
  * Two lanes, because a reference reaches this pass two ways. The VERBATIM connection slots are walked
  * unconditionally — they name a connection directly, so whether the plan registers an import for that slug
  * is beside the point, and the bare spelling registers none. Everything else is demand-driven from
- * `plan.imports`, mirroring apply's own lazy resolution, with the build-carrying image and the factory
- * project as inherent roots. The exemption that falls out is the one wanted: a handle the author registered
+ * `plan.imports`, mirroring apply's own lazy resolution, with the build-carrying image as an inherent root. The exemption that falls out is the one wanted: a handle the author registered
  * and then referenced from nothing must not abort a valid apply.
  */
 export declare function blockedImportsOf(synth: SynthResult, apis: PlatformApis, env: Record<string, string | undefined>): Promise<BlockedImport[]>;

package/dist/cli/factory/apply-preview.js

@@ -33,19 +33,22 @@ import { gatewayKeyRefOf } from "../../core/gateway-key-recipe.js";
 import { refToken } from "../../core/tokens.js";
 import { getBySlugOrUndefined } from "../../engine/apply-core.js";
 import { connectionIdResolver, connectionSlots, managedConnectionTokens, unmanagedConnectionSlotRefs, } from "../../engine/connection-slots.js";
-import { createDiffReadCache, diffResources } from "../../engine/diff.js";
+import { createDiffReadCache, diffResources, previewTeamResolver, } from "../../engine/diff.js";
 import { PreflightRefusalError, resolveSecretRef } from "../../engine/preflight.js";
 import { ConnectionResolutionContext, resolveReferenceId } from "../../engine/reconcile.js";
 import { declaredPipelinesOf } from "../../engine/pipeline-reconcile.js";
 import { pipelineResolver, reconcileTriggers, } from "../../engine/trigger-reconcile.js";
 import { reconcileWorkflows, workflowResolvers, } from "../../engine/workflow-reconcile.js";
 import { imageBuildSpecs } from "./docker.js";
+import { hostedImageName } from "../../constructs/references.js";
+import { hostedSpecs } from "./image-upload.js";
 /**
  * Reads only — no POST, no PATCH, no docker. Unresolvable reachable imports short-circuit everything else:
  * apply aborts on them, so spending the three preview phases' reads first would be discarded work.
  */
 export async function buildApplyPreview(synth, apis, opts) {
     const pendingImageBuilds = opts.dockerBuild ? imageBuildSpecs(synth.plan) : [];
+    const hostedUploads = hostedUploadsOf(pendingImageBuilds, opts.hostedImages);
     const blockedImports = await blockedImportsOf(synth, apis, opts.env);
     if (blockedImports.length > 0) {
         return {
@@ -57,17 +60,19 @@ export async function buildApplyPreview(synth, apis, opts) {
             firingTriggers: [],
             blockedImports,
             pendingImageBuilds,
+            ...hostedUploads,
             firing: false,
         };
     }
     const reads = opts.reads ?? createDiffReadCache(apis);
+    const teams = opts.teams ?? (await previewTeamResolver(synth.plan, apis));
     const rows = await diffResources(synth.plan, apis, {
         env: opts.env,
-        project: opts.project,
+        teams,
         reads,
         triggers: synth.triggers ?? [],
     });
-    const { workflowActions, triggerActions } = await composePreviews(synth, apis, { ...opts, reads });
+    const { workflowActions, triggerActions } = await composePreviews(synth, apis, { ...opts, reads, teams });
     const blockedOwners = await blockedReferenceOwnersOf(synth, blockedImports, rows);
     const blockedResourceKeys = new Set([...blockedOwners.resources].map((owner) => `${owner.kind}\u0000${owner.slug}`));
     const firingRows = rows.filter((row) => isFiringRow(row) && !blockedResourceKeys.has(`${row.kind}\u0000${row.slug}`));
@@ -82,9 +87,26 @@ export async function buildApplyPreview(synth, apis, opts) {
         firingTriggers,
         blockedImports,
         pendingImageBuilds,
+        ...hostedUploads,
         firing: firingRows.length + firingWorkflows.length + firingTriggers.length + pendingImageBuilds.length > 0,
     };
 }
+function hostedUploadsOf(builds, hosted) {
+    if (hosted === undefined || !hosted.available)
+        return {};
+    return {
+        hostedUploads: hostedSpecs(builds).map((spec) => {
+            const name = hostedImageName(spec.ref);
+            const ready = hosted.newestReady.get(name);
+            return {
+                tag: spec.ref,
+                name,
+                dockerfile: spec.dockerfile,
+                ...(ready !== undefined ? { readyDigest: ready.digest } : {}),
+            };
+        }),
+    };
+}
 /**
  * Composed once for BOTH commands, which are contractually required to agree: the pre-flight's whole claim
  * is that it shows what `orchestra fdk diff` shows, and two copies of a preview is two answers to that question
@@ -92,9 +114,10 @@ export async function buildApplyPreview(synth, apis, opts) {
  */
 export async function composePreviews(synth, apis, opts) {
     const liveRefs = await liveRefMap(synth, opts.reads);
+    const teams = opts.teams ?? (await previewTeamResolver(synth.plan, apis));
     return {
         workflowActions: await previewWorkflows(synth, apis, opts, liveRefs),
-        triggerActions: await previewTriggers(synth, apis, opts, liveRefs),
+        triggerActions: await previewTriggers(synth, apis, { ...opts, teams }, liveRefs),
     };
 }
 /** An EXECUTABLE pending write: not a no-op, and not something reconcile refuses. */
@@ -136,10 +159,17 @@ async function previewTriggers(synth, apis, opts, liveRefs) {
     const api = opts.makeTriggersApi(apis.target);
     // Preview-local, like the pre-flight's own: a handoff a preview collects is never printed.
     const connections = new ConnectionResolutionContext(apis, synth.plan.imports, liveRefs, opts.env);
-    return reconcileTriggers(api, docs, async (ref) => resolveReferenceId(ref, "agent", liveRefs, apis), opts.project.state === "resolved" ? opts.project.projectId : undefined, [], {
+    return reconcileTriggers(api, docs, async (ref) => resolveReferenceId(ref, "agent", liveRefs, apis), async (raw, live) => {
+        const teams = opts.teams;
+        if (teams === undefined)
+            return undefined;
+        const surface = { kind: "team", slug: raw ?? "shared", op: "get" };
+        return teams
+            .desired(raw, surface, [])
+            .then((team) => teams.judged(team, live, surface, []))
+            .catch(() => undefined);
+    }, [], {
         dryRun: true,
-        projectPending: opts.project.state === "pending-managed",
-        projectRef: managedProjectSlug(synth.plan),
         resolveConnectionId: connectionIdResolver(managedConnectionTokens(synth.plan), connections),
         resolvePipeline: pipelineResolver(apis, declaredPipelinesOf(synth.plan.resources)),
     });
@@ -156,8 +186,8 @@ async function liveRefMap(synth, reads) {
         return applied;
     }
     for (const resource of synth.plan.resources) {
-        if (resource.kind !== "agent" && resource.kind !== "project" && resource.kind !== "connection") {
-            continue; // only agent, project and connection refs flow through the `applied` map in the previews
+        if (resource.kind !== "agent" && resource.kind !== "team" && resource.kind !== "connection") {
+            continue; // only agent, team and connection refs flow through the `applied` map in the previews
         }
         const live = await reads.read(resource.kind, resource.slug);
         if (live !== undefined) {
@@ -166,10 +196,6 @@ async function liveRefMap(synth, reads) {
     }
     return applied;
 }
-/** By its PLAN SLUG — the one canonical public name of a pending project. */
-function managedProjectSlug(plan) {
-    return plan.resources.find((resource) => resource.kind === "project")?.slug;
-}
 /**
  * Shared by BOTH commands, which are contractually required to agree; they differ only in what they DO with
  * the answer. The resolver is created per call and dropped with it, so a diff run contributes no
@@ -178,8 +204,7 @@ function managedProjectSlug(plan) {
  * Two lanes, because a reference reaches this pass two ways. The VERBATIM connection slots are walked
  * unconditionally — they name a connection directly, so whether the plan registers an import for that slug
  * is beside the point, and the bare spelling registers none. Everything else is demand-driven from
- * `plan.imports`, mirroring apply's own lazy resolution, with the build-carrying image and the factory
- * project as inherent roots. The exemption that falls out is the one wanted: a handle the author registered
+ * `plan.imports`, mirroring apply's own lazy resolution, with the build-carrying image as an inherent root. The exemption that falls out is the one wanted: a handle the author registered
  * and then referenced from nothing must not abort a valid apply.
  */
 export async function blockedImportsOf(synth, apis, env) {
@@ -189,7 +214,6 @@ export async function blockedImportsOf(synth, apis, env) {
         return [];
     }
     const referenced = referencedRefs(synth);
-    const managesProject = synth.plan.resources.some((resource) => resource.kind === "project");
     // ONE resolver for the whole pass, so a connection several slots reference is READ once. A preview is a
     // snapshot, so the memo lives exactly as long as the pass and never answers a later question. It is
     // preview-LOCAL rather than shared with apply's own resolver, which reads at its own time.
@@ -211,7 +235,6 @@ export async function blockedImportsOf(synth, apis, env) {
     const resolvedSlots = new Set(slotRefs);
     for (const imported of synth.plan.imports) {
         const reachable = imported.build !== undefined ||
-            (imported.kind === "project" && !managesProject) ||
             names(referenced, imported.kind, imported.ref);
         if (!reachable) {
             continue;
@@ -326,8 +349,10 @@ export function messageOf(error) {
  */
 function readImport(apis, kind, ref) {
     switch (kind) {
-        case "project":
-            return () => apis.projects.getProject({ id: ref });
+        case "team":
+            return () => apis.teams.getTeam({ id: ref });
+        case "policy":
+            return () => apis.policies.getPolicy({ id: ref });
         case "environment":
             return () => apis.environments.getEnvironment({ id: ref });
         case "agent":
@@ -428,9 +453,6 @@ function asArray(value) {
  */
 function referencedRefs(synth) {
     const index = { refs: new Map(), owners: new Map(), compositionAnchors: new Map() };
-    const implicitTriggerProjectRef = synth.plan.resources.some((resource) => resource.kind === "project")
-        ? undefined
-        : synth.plan.imports.find((imported) => imported.kind === "project")?.ref;
     const managedResources = new Map(synth.plan.resources.map((resource) => [refToken(resource.kind, resource.path.split("/")), resource]));
     for (const resource of synth.plan.resources) {
         if (resource.kind === "workflow")
@@ -452,7 +474,7 @@ function referencedRefs(synth) {
         collectWorkflowRefs(resource.payload, index, { type: "workflow", slug: resource.slug });
     }
     for (const doc of synth.triggers ?? []) {
-        collectTriggerRefs(doc, index, { type: "trigger", slug: doc.slug }, implicitTriggerProjectRef);
+        collectTriggerRefs(doc, index, { type: "trigger", slug: doc.slug });
     }
     return index;
 }
@@ -577,12 +599,12 @@ function collectResourceRefs(resource, index, owner) {
     if (payload === undefined) {
         return;
     }
-    // Every stamped kind carries the factory's project placement; `model-provider-key` is exempt.
-    addRef(index, "project", payload.projectId, owner);
+    // Every team-able kind may name its team; a row in Shared names none.
+    addRef(index, "team", payload.teamId, owner);
     switch (resource.kind) {
         case "environment": {
-            // The image, its pull credential and the mounts live inside `provisionSpec`; the egress policy below
-            // stays at the top level.
+            // The image, its pull credential and the mounts live inside `provisionSpec`; the egress rules name no
+            // other resource.
             const launchSpec = asRecord(payload.provisionSpec);
             addRef(index, "image", launchSpec?.image, owner);
             addRef(index, "secret", launchSpec?.imagePullSecretId, owner);
@@ -592,13 +614,6 @@ function collectResourceRefs(resource, index, owner) {
             for (const mount of asArray(launchSpec?.volumeMounts)) {
                 addRef(index, "volume", asRecord(mount)?.volumeId, owner);
             }
-            for (const rule of asArray(asRecord(payload.egressPolicy)?.rules)) {
-                for (const binding of asArray(asRecord(rule)?.credentialBindings)) {
-                    // Exactly one of the two per binding, so recording both records whichever is set.
-                    addRef(index, "secret", asRecord(binding)?.secretId, owner);
-                    addRef(index, "connection", asRecord(binding)?.connectionId, owner);
-                }
-            }
             return;
         }
         case "connection": {
@@ -632,9 +647,25 @@ function collectResourceRefs(resource, index, owner) {
             }
             return;
         }
+        case "team": {
+            addRef(index, "team", payload.parentTeamId, owner);
+            return;
+        }
+        case "role": {
+            for (const policyId of asArray(payload.policyIds)) {
+                addRef(index, "policy", policyId, owner);
+            }
+            return;
+        }
+        case "team-membership": {
+            for (const row of asArray(payload.rows)) {
+                addRef(index, "team", asRecord(row)?.teamId, owner);
+            }
+            return;
+        }
         default:
-            // These kinds carry no payload reference beyond the project stamp above; the gateway-key pair's
-            // reverse ownership-only edge is added by the caller.
+            // These kinds carry no payload reference beyond the team above; the gateway-key pair's reverse
+            // ownership-only edge is added by the caller.
             return;
     }
 }
@@ -654,16 +685,12 @@ function collectWorkflowRefs(workflow, index, owner) {
         }
     }
 }
-/**
- * `on.connection` is a verbatim slot resolved elsewhere. The factory project is an IMPLICIT edge — reconcile
- * stamps it on every trigger though the document has no project field — and not a composition anchor, because
- * the preview receives the descriptor out of band rather than re-resolving this import.
- */
-function collectTriggerRefs(doc, index, owner, implicitProjectRef) {
+/** `on.connection` is a verbatim slot resolved elsewhere. */
+function collectTriggerRefs(doc, index, owner) {
     const trigger = asRecord(doc);
     if (trigger === undefined) {
         return;
     }
-    addRef(index, "project", implicitProjectRef, owner);
+    addRef(index, "team", trigger.teamId, owner);
     addRef(index, "agent", asRecord(trigger.target)?.agent, owner, true);
 }

package/dist/cli/factory/apply-render.js

@@ -9,7 +9,7 @@
 // terminal.
 import { describeSource, preApprovalLevers, REQUIRE_APPROVAL_ENV, typedAtTerminalRemedy, } from "../core/approval-policy.js";
 import { NOTHING_WAS_WRITTEN } from "../core/prompts.js";
-import { describeProjectIdentityRefusal } from "../../engine/apply-core.js";
+import { describeTeamIdentityRefusal } from "../../engine/apply-core.js";
 import { containsCommandLineRecipe, pendingCredentialWrite } from "../../engine/secrets-apply.js";
 import { describeTargetOrganization, } from "../../engine/reconcile.js";
 import { isFiringRow } from "./apply-preview.js";
@@ -37,8 +37,16 @@ export function renderApplyPreview(preview, io) {
     for (const outcome of preview.firingTriggers) {
         io.out(`  ${outcome.action.padEnd(19)} trigger ${outcome.slug}`);
     }
+    const uploads = new Map((preview.hostedUploads ?? []).map((upload) => [upload.tag, upload]));
     for (const spec of preview.pendingImageBuilds) {
-        io.out(`  ${"image build".padEnd(19)} ${spec.ref} (${spec.dockerfile})`);
+        const upload = uploads.get(spec.ref);
+        if (upload === undefined) {
+            io.out(`  ${"image build".padEnd(19)} ${spec.ref} (${spec.dockerfile})`);
+            continue;
+        }
+        const now = upload.readyDigest !== undefined ? `newest READY ${upload.readyDigest}` : "no READY image of this name yet";
+        io.out(`  ${"image upload".padEnd(19)} ${upload.name} from ${upload.tag} (${upload.dockerfile}); ${now}; ` +
+            `the new digest is known only after the build`);
     }
     for (const line of renderSensitiveRows(preview.rows, "will")) {
         io.out(line);
@@ -61,7 +69,7 @@ export function renderApplyPreview(preview, io) {
     }
 }
 /**
- * A project-identity row goes through the shared formatter, and every other blocked row keeps its `details`
+ * A team-identity row goes through the shared formatter, and every other blocked row keeps its `details`
  * — the classifier's own value-free note, which is the difference between "will fail — unset-source" and a
  * sentence that says which variable to export. The surface standing in front of the write must not say less
  * than the read-only preview.
@@ -69,7 +77,7 @@ export function renderApplyPreview(preview, io) {
 function blockedRowText(entry) {
     if (entry.refusal !== undefined) {
         // The same call the error and `renderDiff` make, so all three word one conflict exactly one way.
-        return `will fail — ${describeProjectIdentityRefusal(entry.refusal)}`;
+        return `will fail — ${describeTeamIdentityRefusal(entry.refusal)}`;
     }
     return `will fail — ${entry.blocked}: ${entry.kind} ${entry.slug}${detailsOf(entry)}`;
 }