@orchestraworks/cli 0.5.5 → 0.5.8

package/dist/engine/reconcile.js

@@ -8,12 +8,13 @@ import { isEnvImportMarker, parseEnvImportMarker } from "../constructs/reference
 import { isGatewayKeyRecipe } from "../core/gateway-key-recipe.js";
 import { createLabels, labelsPatch, MANAGED_BY_LABEL_KEY, stampManagedBy } from "../core/labels.js";
 import { isRefToken, parseRefToken, refToken } from "../core/tokens.js";
-import { ApplyError, credentialValueWritten, defaultPrint, describeTargetOrganization, desiredProjectOf, failing, getBySlugOrUndefined, modelSettingsUnchanged, standbyCapacityUnchanged, subsetDeepEqual, } from "./apply-core.js";
+import { ApplyError, credentialValueWritten, defaultPrint, createTeamResolver, describeTargetOrganization, failing, getBySlugOrUndefined, modelSettingsUnchanged, stampTeam, standbyCapacityUnchanged, subsetDeepEqual, } from "./apply-core.js";
 import { preApprovalLevers, typedAtTerminalRemedy, } from "../cli/core/approval-policy.js";
-import { egressCredentialBindingLabel, refusalError, refusalOf, refuseIf, } from "./refusals.js";
+import { refuseIf, } from "./refusals.js";
 import { assertSecretTransport } from "../cli/core/auth.js";
 import { provenanceField } from "./provenance.js";
-import { applyPipeline, groupIdOf } from "./pipeline-reconcile.js";
+import { applyPipeline, teamIdOf } from "./pipeline-reconcile.js";
+import { applyRole, applyTeam, applyTeamMemberships } from "./role-membership-reconcile.js";
 import { decideGatewayKeys, gatewayKeyPendingWrites, writeGatewayKeys, } from "./gateway-key-reconcile.js";
 import { applyComputeProvider } from "./compute-provider-reconcile.js";
 import { decideModelProviderKeys, modelProviderKeyPendingWrites, writeModelProviderKeys, } from "./model-provider-key-reconcile.js";
@@ -21,7 +22,7 @@ import { applyCeremonyBackedConnection, isCeremonyBackedConnection, } from "./co
 import { assertManagedChatConnectionForDesired } from "./connection-readiness.js";
 import { removedConfigurationNotice } from "./connector-configuration.js";
 import { PreflightError, PreflightRefusalError, readConnection, RedactedRefError, reservedProviderSecretIds, resolveSecretRef, validateConnectionImport, validateRefShape, } from "./preflight.js";
-import { allRootSourceLabels, commandLineOccurrencesFor, containsCommandLineRecipe, decideSecretWrite, metadataInjectionChange, pendingSecretWrite, reconcileInjection, replacesLiveCredentialValue, resolveSecretValueSource, } from "./secrets-apply.js";
+import { allRootSourceLabels, commandLineOccurrencesFor, containsCommandLineRecipe, declaredSecretHosts, decideSecretWrite, metadataHostsChange, metadataInjectionChange, pendingSecretWrite, reconcileInjection, replacesLiveCredentialValue, resolveSecretValueSource, } from "./secrets-apply.js";
 import { collectCommandLineValues, } from "./command-line-values.js";
 // These live in the leaf module `engine/apply-core.ts` so the per-kind reconcile lanes can share them
 // without importing this monolith, which imports THEM — a cycle. Re-exported here so `engine/reconcile`
@@ -59,29 +60,10 @@ function resolveManagedToken(token, applied) {
     }
     return id;
 }
-/** Exported so the workflow phase resolves the same stamp through the identical seam. */
-export async function resolveProjectReference(apis, ref, applied) {
-    if (isRefToken(ref)) {
-        return resolveManagedToken(ref, applied);
-    }
-    const live = await getBySlugOrUndefined(() => apis.projects.getProject({ id: ref }));
-    if (live === undefined) {
-        throw new PreflightError(`project import '${ref}' was not found in this organization (import 404). Create it or fix the reference.`);
-    }
-    return live.id;
-}
-/** Synth already stamped every body symbolically, so this is a pure in-place resolve. */
-function stampBodyProject(body, projectId) {
-    if (projectId !== undefined) {
-        body.projectId = projectId;
-    }
-}
-/**
- * Carries NO `env`: the project-identity arm reads none, and supplying one would claim this lane holds
- * credential-source evidence it does not have.
- */
-function projectCtx(live, project) {
-    return { project, ...(live !== undefined ? { live } : {}) };
+/** Carries no `env`: the team arm reads none, and supplying one would claim evidence this lane does not hold. */
+async function teamCtx(teams, live, declared, resource, outcomes) {
+    const team = await teams.judged(declared, live, { kind: resource.kind, slug: resource.slug, op: "get" }, outcomes);
+    return { ...(team !== undefined ? { team } : {}), ...(live !== undefined ? { live } : {}) };
 }
 /**
  * Reads memoize by the EFFECTIVE id/slug value, so direct and env-backed handles resolving to the same value
@@ -146,24 +128,24 @@ export class ConnectionResolutionContext {
  * return shape, so every existing `ApplyOutcome[]`-returning caller is untouched; the workflow phase reuses
  * the map it fills to resolve each agent assignment through the identical machinery.
  */
-export async function reconcile(plan, apis, opts, appliedOut, projectOut) {
+export async function reconcile(plan, apis, opts, appliedOut) {
     const outcomes = [];
     const applied = appliedOut ?? new Map();
+    const teams = opts.teams ?? createTeamResolver(apis, applied);
     const env = opts.env ?? process.env;
     const connections = opts.connectionResolution ?? new ConnectionResolutionContext(apis, plan.imports, applied, env);
     let reservedCache;
     const reserved = async () => (reservedCache ??= await reservedProviderSecretIds(apis));
     try {
         const secrets = plan.resources.filter((r) => r.kind === "secret");
-        // (0) Project FIRST: resolved to a canonical id BEFORE any stamped resource — secrets included — needs
-        //     it. `undefined` for a commons factory, in which case no body carries `projectId` at all.
-        const projectId = await resolveFactoryProjectId(plan, apis, outcomes, applied);
-        // Populated inside the try, before any downstream resource can fail.
-        if (projectOut !== undefined)
-            projectOut.projectId = projectId;
-        // The ONE descriptor every refusal classification below compares against, settled here so no lane
-        // derives its own: phase 0 IS the resolution, so a caller-supplied one could say nothing different.
-        const desiredProject = desiredProjectOf(projectId);
+        // (0) Teams and roles FIRST: every team-able row resolves its team against them, secrets included, and
+        //     a team-membership row names a custom role.
+        for (const resource of plan.resources) {
+            if (resource.kind === "team")
+                await applyTeam(resource, apis, outcomes, applied, teams);
+            if (resource.kind === "role")
+                await applyRole(resource, apis, outcomes, applied);
+        }
         // (1) Transport guard BEFORE any API call. A pending write is knowable from env alone; a `gateway-key`
         //     or `model-provider-key` resource is not, so the PRESENCE of either kind is the check — a
         //     credential-bearing exchange will happen and neither credential is visible in the environment.
@@ -176,15 +158,16 @@ export async function reconcile(plan, apis, opts, appliedOut, projectOut) {
         // (2a) The two credential kinds DECIDE: reads only, raising the named refusals for the states no write
         //      can fix. Both run before the secret phase so their value-free rows join the ONE consolidated
         //      confirmation below, and a refused pair is therefore never approved.
-        const gatewayKeys = await decideGatewayKeys(plan, apis, outcomes, projectId);
+        const gatewayKeys = await decideGatewayKeys(plan, apis, outcomes, teams);
         const modelProviderKeys = await decideModelProviderKeys(plan, apis, env, outcomes);
         // (2) Secrets: decide (reads only) → ONE confirm → the gated writes, so the consolidated prompt sees
         //     every pending write. The gateway-key and BYOK write phases run inside, right after that confirm.
-        await applySecrets(plan, apis, opts, env, outcomes, applied, projectId, desiredProject, gatewayKeys, modelProviderKeys);
+        await applySecrets(plan, apis, opts, env, outcomes, applied, teams, gatewayKeys, modelProviderKeys);
         // (3) The rest, in plan (topo) order.
         for (const resource of plan.resources) {
             switch (resource.kind) {
-                case "project":
+                case "team":
+                case "role":
                     break; // handled in (0)
                 case "gateway-key":
                     break; // handled in (2a)/(2)
@@ -193,33 +176,35 @@ export async function reconcile(plan, apis, opts, appliedOut, projectOut) {
                 case "secret":
                     break; // handled in (2)
                 case "connector":
-                    await applyConnector(resource, apis, outcomes, applied, projectId, desiredProject, opts.notices);
+                    await applyConnector(resource, apis, outcomes, applied, teams, opts.notices);
                     break;
                 case "connection":
-                    await applyConnection(resource, apis, outcomes, applied, connections, projectId, desiredProject, opts);
+                    await applyConnection(resource, apis, outcomes, applied, connections, teams, opts);
                     break;
                 case "compute-provider":
                     await applyComputeProvider(resource, apis, outcomes, applied, opts.onComputeProviderKey);
                     break;
                 case "environment":
-                    await applyEnvironment(resource, apis, outcomes, applied, reserved, connections, projectId, desiredProject);
+                    await applyEnvironment(resource, apis, outcomes, applied, reserved, teams);
                     break;
                 case "skill":
-                    await applySkill(resource, apis, outcomes, applied, projectId, desiredProject);
+                    await applySkill(resource, apis, outcomes, applied, teams);
                     break;
                 case "agent":
-                    await applyAgent(resource, apis, outcomes, applied, projectId, desiredProject, plan.factory, opts.provenance);
+                    await applyAgent(resource, apis, outcomes, applied, teams, plan.factory, opts.provenance);
                     break;
                 case "pipeline":
                     await applyPipeline(resource, apis, outcomes, applied, {
-                        projectId,
-                        desiredProject,
+                        teams,
                         resolveAgentId: (ref) => resolveReferenceId(ref, "agent", applied, apis),
-                        resolveGroupId: (ref) => groupIdOf(apis, ref),
+                        resolveTeamId: (ref) => teamIdOf(apis, ref),
                         ...(opts.notices !== undefined ? { notices: opts.notices } : {}),
                         pending: opts.pendingPipelineWrites ?? [],
                     });
                     break;
+                case "team-membership":
+                    await applyTeamMemberships(resource, apis, outcomes, applied, teams);
+                    break;
                 case "workflow":
                     break; // its own phase, after the plan kinds
                 default:
@@ -243,55 +228,6 @@ export async function reconcile(plan, apis, opts, appliedOut, projectOut) {
         throw new ApplyError(error?.message ?? String(error), [...outcomes], { cause: error });
     }
 }
-/** `undefined` for a commons factory — nothing is stamped, and every body omits `projectId` entirely. */
-async function resolveFactoryProjectId(plan, apis, outcomes, applied) {
-    const managed = plan.resources.find((r) => r.kind === "project");
-    if (managed !== undefined) {
-        return applyProject(managed, apis, outcomes, applied);
-    }
-    const imported = plan.imports.find((i) => i.kind === "project");
-    if (imported !== undefined) {
-        return resolveProjectReference(apis, imported.ref, applied);
-    }
-    return undefined;
-}
-/**
- * `name` and the declared labels are the orchestra-managed fields: a label key no apply declared, like the
- * console-owned description, is never touched. No ownership marker is stamped on a project.
- */
-async function applyProject(resource, apis, outcomes, applied) {
-    const payload = resource.payload;
-    const live = await failing(() => getBySlugOrUndefined(() => apis.projects.getProject({ id: resource.slug })), { kind: "project", slug: resource.slug, op: "get" }, outcomes);
-    let id;
-    let action;
-    if (live === undefined) {
-        const labels = createLabels(payload.labels);
-        const body = {
-            name: payload.name,
-            slug: resource.slug,
-            ...(Object.keys(labels).length > 0 ? { labels } : {}),
-        };
-        const created = await failing(() => apis.projects.createProject({ createProjectRequest: body }), { kind: "project", slug: resource.slug, op: "create" }, outcomes);
-        id = created.id;
-        action = "created";
-    }
-    else {
-        const labels = labelsPatch(payload.labels, live.labels);
-        if (subsetDeepEqual({ name: payload.name }, live) && labels === undefined) {
-            id = live.id;
-            action = "unchanged";
-        }
-        else {
-            const patch = { name: payload.name, ...(labels !== undefined ? { labels } : {}) };
-            const updated = await failing(() => apis.projects.updateProject({ id: live.id, updateProjectRequest: patch }), { kind: "project", slug: resource.slug, op: "update" }, outcomes);
-            id = updated.id;
-            action = "updated";
-        }
-    }
-    outcomes.push({ path: resource.path, kind: "project", slug: resource.slug, id, action });
-    applied.set(refToken("project", resource.path.split("/")), id);
-    return id;
-}
 // The remedy sentences a headless credential refusal offers come from the approval policy's own prose home,
 // which is where every other surface that recommends a lever reads them from too. This module used to keep a
 // second copy and the two had already drifted on word ORDER — a refusal recommending a lever spelled
@@ -398,7 +334,7 @@ function typedAtTerminalRows(modelProviderKeys, pendingSecrets) {
  * decision loop below — its whole write protocol belongs to the gateway lane — and a DECLINED confirmation
  * throws before any of the three write phases, leaving nothing stranded mid-protocol.
  */
-async function applySecrets(plan, apis, opts, env, outcomes, applied, projectId, desiredProject, gatewayKeys = [], modelProviderKeys = []) {
+async function applySecrets(plan, apis, opts, env, outcomes, applied, teams, gatewayKeys = [], modelProviderKeys = []) {
     const secretPlans = [];
     // Decision phase — reads only. No writes yet.
     for (const resource of plan.resources) {
@@ -417,18 +353,7 @@ async function applySecrets(plan, apis, opts, env, outcomes, applied, projectId,
         // collection pass deliberately runs after the confirmation this decision feeds. Resolving it here would
         // classify a real write as a no-op and it would never be collected.
         const commandLinePending = containsCommandLineRecipe(resource.valueFrom);
-        // A project-less Factory has NO verdict that could outrank the partial-recipe error, so it is raised
-        // locally with no network read at all: otherwise a transient 401/5xx/offline `getSecret` would replace
-        // an actionable "your recipe is half-supplied" message with a transport error, for a declaration that
-        // never opted into the project axis. The `unset-source` arm needs to know whether the row EXISTS, so it
-        // is deliberately left to the full call after the read below — acting on it here would read "absent" off
-        // a row nobody has looked at and refuse a clean no-op.
-        if (projectId === undefined) {
-            const early = refusalOf("secret", resource, { env, project: desiredProject });
-            if (early?.code === "partially-supplied") {
-                throw refusalError(early, outcomes);
-            }
-        }
+        const team = await teams.desired(resource.payload.teamId, { kind: "secret", slug, op: "get" }, outcomes);
         const live = await failing(() => getBySlugOrUndefined(() => apis.secrets.getSecret({ id: slug })), {
             kind: "secret",
             slug,
@@ -440,23 +365,25 @@ async function applySecrets(plan, apis, opts, env, outcomes, applied, projectId,
         // outranks every other verdict, and `diff` reads the row unconditionally, so ordering it the other way
         // made apply raise a bare `ApplyError` where `diff` reported `refused`.
         //
-        // The classifier decides all three of this phase's refusals in one call, in that order: the cross-project
-        // row, then a composed recipe whose leaves are only PARTLY available (letting that fall through would
+        // The classifier decides all three of this phase's refusals in one call, in that order: the row in another
+        // team, then a composed recipe whose leaves are only PARTLY available (letting that fall through would
         // resolve to `undefined`, read as "nothing supplied", and silently retain the stale live value), then a
         // declared secret that is absent with nothing to write. Every leaf unset on an EXISTING secret is a clean
         // no-op, none of the three. This lane DOES supply `env`, because two of those arms judge the credential
         // SOURCE and the classifier gates them on holding an environment to judge against.
-        refuseIf(resource.kind, resource, { ...projectCtx(live, desiredProject), env }, outcomes);
+        refuseIf(resource.kind, resource, { ...(await teamCtx(teams, live, team, resource, outcomes)), env }, outcomes);
         const resolvedValue = commandLinePending
             ? undefined
             : resolveSecretValueSource(resource.valueFrom, env);
         // Diffed against the live recipe so a value-less recipe edit still PATCHes instead of silently no-oping.
         const desiredInjection = resource.payload.injection;
         const injectionChange = metadataInjectionChange(desiredInjection, live?.injection);
+        const hostsChange = metadataHostsChange(declaredSecretHosts(resource.payload), live?.hosts);
         const decision = decideSecretWrite(resolvedValue, live !== undefined, {
             slug,
             envName,
             injectionChange,
+            hostsChange,
             commandLinePending,
         });
         if (decision.kind === "skip-empty") {
@@ -468,6 +395,7 @@ async function applySecrets(plan, apis, opts, env, outcomes, applied, projectId,
             resource,
             slug,
             decision,
+            team,
             value: resolvedValue,
             id: live?.id,
             liveInjection: live?.injection,
@@ -545,16 +473,19 @@ async function applySecrets(plan, apis, opts, env, outcomes, applied, projectId,
     // writes, because its paired Secret is a secret write the author just approved, and because a declined
     // confirmation must strand nothing — no mint has happened at this point.
     if (gatewayKeys.length > 0) {
-        await writeGatewayKeys(gatewayKeys, apis, outcomes, applied, projectId, plan.factory);
+        await writeGatewayKeys(gatewayKeys, apis, outcomes, applied, plan.factory);
     }
-    // No `projectId` is threaded: a BYOK row is org-commons by construction and exempt from project stamping.
+    // No team is threaded: a BYOK row is organization-wide and has none.
     if (modelProviderKeys.length > 0) {
         await writeModelProviderKeys(modelProviderKeys, apis, env, outcomes, applied, commandLineValues, plan.factory);
     }
     // Write phase — creates and overwrites, in plan order.
     for (const p of secretPlans) {
         const desiredInjection = p.resource.payload.injection;
+        const desiredHosts = declaredSecretHosts(p.resource.payload);
         if (p.decision.kind === "create") {
+            const placement = {};
+            stampTeam(placement, p.team);
             const body = {
                 name: p.resource.payload.name,
                 slug: p.slug,
@@ -562,11 +493,12 @@ async function applySecrets(plan, apis, opts, env, outcomes, applied, projectId,
                 value: p.value,
                 // The ordinary `Secret` construct declares no labels, so the map holds exactly the ownership marker.
                 labels: stampManagedBy(undefined, plan.factory),
-                // CREATE is the one moment a placement is chosen. No update body carries it: once this row exists,
-                // its placement is its identity.
-                ...(projectId !== undefined ? { projectId } : {}),
+                // CREATE is the one moment a team is chosen. No update body carries it: once this row exists, its
+                // team is its identity.
+                ...placement,
                 // Live is absent, so never a `null` clear here.
                 ...(desiredInjection !== undefined ? { injection: desiredInjection } : {}),
+                ...(desiredHosts !== undefined ? { hosts: desiredHosts } : {}),
             };
             const created = await failing(() => apis.secrets.createSecret({ createSecretRequest: body }), { kind: "secret", slug: p.slug, op: "create" }, outcomes);
             p.id = created.id;
@@ -574,23 +506,27 @@ async function applySecrets(plan, apis, opts, env, outcomes, applied, projectId,
         else if (p.decision.kind === "overwrite") {
             // An explicit `null` clears a live recipe the construct dropped while rotating the value.
             const injection = reconcileInjection(desiredInjection, p.liveInjection);
-            // No `projectId`: the decision phase proved the live placement equals the declared one, so re-sending
-            // it would say nothing — and sending a DIFFERENT one would be a silent move.
+            // No team: the decision phase proved the live team equals the declared one, so re-sending it would say
+            // nothing — and sending a different one would be a silent move.
             const body = {
                 name: p.resource.payload.name,
                 description: p.resource.payload.description,
                 value: p.value,
                 ...(injection !== undefined ? { injection } : {}),
+                ...(desiredHosts !== undefined ? { hosts: desiredHosts } : {}),
             };
             await failing(() => apis.secrets.updateSecret({ id: p.id, updateSecretRequest: body }), { kind: "secret", slug: p.slug, op: "update" }, outcomes);
         }
         else if (p.decision.kind === "metadata-update") {
-            // The secret exists with no fresh value but its recipe changed: a value-less PATCH carrying `injection`
-            // and nothing else.
-            const body = { injection: p.decision.injection };
+            // The secret exists with no fresh value but its recipe or hosts changed: a value-less PATCH carrying
+            // only the changed fields.
+            const body = {
+                ...(p.decision.injection !== undefined ? { injection: p.decision.injection } : {}),
+                ...(p.decision.hosts !== undefined ? { hosts: p.decision.hosts } : {}),
+            };
             await failing(() => apis.secrets.updateSecret({ id: p.id, updateSecretRequest: body }), { kind: "secret", slug: p.slug, op: "update" }, outcomes);
         }
-        // There is deliberately no fourth branch: `noop-resolve` writes nothing, because a placement mismatch is
+        // There is deliberately no fourth branch: `noop-resolve` writes nothing, because a team mismatch is
         // refused in the decision phase and moving the row was the only job its PATCH ever had.
     }
     for (const p of secretPlans) {
@@ -621,9 +557,10 @@ async function applySecrets(plan, apis, opts, env, outcomes, applied, projectId,
  * REQUIRED one that notice would be a dead end — the platform rejects a create missing a required field — so
  * apply refuses by name and asks for the field to be declared.
  */
-async function applyConnector(resource, apis, outcomes, applied, projectId, desiredProject, notices) {
+async function applyConnector(resource, apis, outcomes, applied, teams, notices) {
     const body = clonePayload(resource.payload);
-    stampBodyProject(body, projectId);
+    const team = await teams.desired(body.teamId, { kind: "connector", slug: resource.slug, op: "get" }, outcomes);
+    stampTeam(body, team);
     for (const field of CONNECTOR_SECRET_WIRE_FIELDS) {
         const ref = body[field];
         if (typeof ref === "string" && ref !== "") {
@@ -641,8 +578,8 @@ async function applyConnector(resource, apis, outcomes, applied, projectId, desi
     else {
         const liveRecord = live;
         // Nothing may classify or write a newly readable row until the ONE aggregate classifier has cleared it:
-        // project identity first, then immutable-field drift.
-        refuseIf(resource.kind, resource, { ...projectCtx(live, desiredProject), resolvedDesired: body }, outcomes);
+        // team identity first, then immutable-field drift.
+        refuseIf(resource.kind, resource, { ...(await teamCtx(teams, live, team, resource, outcomes)), resolvedDesired: body }, outcomes);
         // Set-only updates cannot clear a stored override, so a removed optional CONFIGURATION prop is a printed
         // human step — recorded BEFORE the unchanged/patch fork, because it applies to both.
         const notice = removedConfigurationNotice(body, liveRecord, resource);
@@ -653,12 +590,12 @@ async function applyConnector(resource, apis, outcomes, applied, projectId, desi
             action = "unchanged";
         }
         else {
-            // `slug` is the reconcile key, the immutable fields were just proven equal, and `projectId` is
-            // identity the guard above already proved equal — so the create-stamped body sheds it rather than
-            // carrying a stamp that could only restate the placement or silently move the row.
+            // `slug` is the reconcile key, the immutable fields were just proven equal, and `teamId` is identity
+            // the guard above already proved equal — so the create body sheds it rather than carrying a field that
+            // could only restate the team or silently move the row.
             const patch = stripKeys(body, [
                 "slug",
-                "projectId",
+                "teamId",
                 ...connectorImmutableFields(body.providerKey),
             ]);
             const updated = await failing(() => apis.connectors.updateConnector({ id: live.id, updateConnectorRequest: patch }), { kind: "connector", slug: resource.slug, op: "update" }, outcomes);
@@ -704,9 +641,10 @@ async function resolveConnectorReference(ref, applied, apis, resource, outcomes)
  * not exist until a human installs the App. Every other connection — a GitHub App declaration supplying a
  * real `installationId` included — keeps the direct GET → POST/PATCH path below, byte for byte.
  */
-async function applyConnection(resource, apis, outcomes, applied, connections, projectId, desiredProject, opts) {
+async function applyConnection(resource, apis, outcomes, applied, connections, teams, opts) {
     const body = clonePayload(resource.payload);
-    stampBodyProject(body, projectId);
+    const team = await teams.desired(body.teamId, { kind: "connection", slug: resource.slug, op: "get" }, outcomes);
+    stampTeam(body, team);
     // OAuth / webhook-secret connections carry no `secretId`, so there is nothing to resolve.
     const auth = body.auth;
     if (auth !== undefined && typeof auth.secretId === "string" && auth.secretId !== "") {
@@ -715,10 +653,18 @@ async function applyConnection(resource, apis, outcomes, applied, connections, p
     if (auth !== undefined && typeof auth.connectorId === "string" && auth.connectorId !== "") {
         auth.connectorId = await resolveConnectorReference(auth.connectorId, applied, apis, resource, outcomes);
     }
-    // Taken AFTER ref resolution and project stamping, so the lane receives exactly the body this function
+    // Taken AFTER ref resolution and team stamping, so the lane receives exactly the body this function
     // would otherwise have sent. It records its own outcome and `applied` entry.
     if (isCeremonyBackedConnection(body)) {
-        await applyCeremonyBackedConnection(resource, body, apis, outcomes, applied, installLinkOptions(opts));
+        // An install link reports Shared's id, so the ceremony lane matches links against Shared read.
+        const ceremonyTeam = team?.state === "shared"
+            ? {
+                state: "resolved",
+                teamId: (await teams.shared({ kind: "connection", slug: resource.slug, op: "get" }, outcomes)).id,
+                shared: true,
+            }
+            : team;
+        await applyCeremonyBackedConnection(resource, body, apis, outcomes, applied, installLinkOptions(opts), ceremonyTeam);
         return;
     }
     const live = await failing(() => getBySlugOrUndefined(() => apis.connections.getConnection({ id: resource.slug })), { kind: "connection", slug: resource.slug, op: "get" }, outcomes);
@@ -726,7 +672,7 @@ async function applyConnection(resource, apis, outcomes, applied, connections, p
     // then the create-only OAuth app selection. Both compare CANONICAL ids — the resolution above already
     // turned a managed token or an imported slug into one — so a valid repeat apply is never falsely refused.
     refuseIf(resource.kind, resource, {
-        ...projectCtx(live, desiredProject),
+        ...(await teamCtx(teams, live, team, resource, outcomes)),
         resolvedDesired: { body, ceremonyBacked: false },
     }, outcomes);
     let id;
@@ -766,13 +712,13 @@ async function applyConnection(resource, apis, outcomes, applied, connections, p
             observed = live;
         }
         else {
-            // `provider`/`slug` are create-only, `status` is server-owned, and `projectId` is identity the guard
+            // `provider`/`slug` are create-only, `status` is server-owned, and `teamId` is identity the guard
             // above already proved equal — none of the four is sent on PATCH.
             const patch = stripKeys(body, [
                 "slug",
                 "provider",
                 "status",
-                "projectId",
+                "teamId",
             ]);
             observed = await failing(() => apis.connections.updateConnection({ id: live.id, updateConnectionRequest: patch }), { kind: "connection", slug: resource.slug, op: "update" }, outcomes);
             id = observed.id;
@@ -861,7 +807,7 @@ export function connectionUnchanged(desired, live) {
     }
     return subsetDeepEqual(compare, live);
 }
-/** The connection OWNS this credential, so — unlike an egress binding — it is not checked as reserved. */
+/** The connection OWNS this credential, so — unlike a pull credential — it is not checked as reserved. */
 async function resolveConnectionSecret(ref, applied, apis, resource, outcomes) {
     if (isRefToken(ref)) {
         return resolveManagedToken(ref, applied);
@@ -893,64 +839,11 @@ function connectionExpectFor(imports, ref) {
     }
     return { provider, install: Object.keys(install).length > 0 ? install : undefined };
 }
-/** Decides an egress credential binding's arm — see {@link CredentialBindingArm} for what each one means. */
-export function credentialBindingArm(binding) {
-    if (typeof binding.connectionId === "string" && binding.connectionId !== "") {
-        return "connection";
-    }
-    return "secret";
-}
-async function applyEnvironment(resource, apis, outcomes, applied, reserved, connections, projectId, desiredProject) {
+async function applyEnvironment(resource, apis, outcomes, applied, reserved, teams) {
     const body = clonePayload(resource.payload);
-    stampBodyProject(body, projectId);
+    const team = await teams.desired(body.teamId, { kind: "environment", slug: resource.slug, op: "get" }, outcomes);
+    stampTeam(body, team);
     const envPath = resource.path;
-    /**
-     * BOTH binding rules — pairwise-distinct, then connection-owned — are rules over ONE GROUP in the
-     * aggregate classifier, rather than checks repeated inline wherever a secret ref can appear. The two
-     * groups stay SEPARATE: pairwise-distinct is about the egress bindings, and folding the pull credential
-     * into the same group would refuse an environment that legally binds one secret both ways.
-     */
-    const refuseBoundSecrets = async (secretRefs) => {
-        if (secretRefs.length === 0)
-            return; // the scan is lazy: no binding, no read
-        refuseIf(resource.kind, resource, {
-            project: desiredProject,
-            resolvedDesired: { secretRefs },
-            reservedProviderSecretIds: await reserved(),
-        }, outcomes);
-    };
-    // Construct paths and rule labels are named on failure — never the reference value.
-    const boundSecrets = [];
-    const egress = body.egressPolicy;
-    for (const rule of egress?.rules ?? []) {
-        const bindings = rule.credentialBindings ?? [];
-        for (const binding of bindings) {
-            const arm = credentialBindingArm(binding);
-            if (arm === "connection") {
-                // Not a secret, so it contributes to neither distinctness rule: one connection may back many rules.
-                binding.connectionId = await connections.resolve(binding.connectionId);
-                continue;
-            }
-            const ref = binding.secretId;
-            // Derived by the ONE helper `diff` names the same binding with, so preview and apply cannot word one
-            // refusal two ways — which they did, preview building only the imported-literal shape.
-            const label = egressCredentialBindingLabel(envPath, rule.name, ref, binding.header);
-            let id;
-            if (isRefToken(ref)) {
-                id = resolveManagedToken(ref, applied);
-            }
-            else {
-                validateRefShape(ref, label);
-                // The connection-owned check is the classifier's (below), not this resolver's: one rule, one
-                // wording, reachable from `orchestra fdk diff` too. The 404/expiry live checks stay here.
-                id = (await resolveSecretRef(apis, { value: ref, sourceLabel: label })).id;
-            }
-            binding.secretId = id;
-            boundSecrets.push({ id, label });
-        }
-    }
-    // A connection-owned secret can back no egress credential binding, on either resolution path.
-    await refuseBoundSecrets(boundSecrets);
     // A slug the platform stores canonically must be canonical BEFORE it is compared against the live row, or
     // every apply of a slug-authored reference would read as a swap. The durable home is an ordinary `/home`
     // entry in this same list, so it needs no second resolution path of its own.
@@ -983,10 +876,13 @@ async function applyEnvironment(resource, apis, outcomes, applied, reserved, con
             validateRefShape(pullRef, label);
             launchSpec.imagePullSecretId = (await resolveSecretRef(apis, { value: pullRef, sourceLabel: label })).id;
         }
-        // The SAME classifier as the egress bindings: a connection's own credential is no more usable as a
-        // registry pull credential than as an egress one. Its OWN group of one, since a single ref cannot
-        // duplicate anything.
-        await refuseBoundSecrets([{ id: launchSpec.imagePullSecretId, label }]);
+        // A connection's own credential is not usable as a registry pull credential.
+        const secretRefs = [{ id: launchSpec.imagePullSecretId, label }];
+        refuseIf(resource.kind, resource, {
+            ...(await teamCtx(teams, undefined, team, resource, outcomes)),
+            resolvedDesired: { secretRefs },
+            reservedProviderSecretIds: await reserved(),
+        }, outcomes);
     }
     // A declared record's token, or an imported slug, becomes the record's id; `null` stays, naming hosted
     // compute.
@@ -995,8 +891,8 @@ async function applyEnvironment(resource, apis, outcomes, applied, reserved, con
         launchSpec.computeProviderId = await resolveReferenceId(providerRef, "compute-provider", applied, apis);
     }
     const live = await failing(() => getBySlugOrUndefined(() => apis.environments.getEnvironment({ id: resource.slug })), { kind: "environment", slug: resource.slug, op: "get" }, outcomes);
-    // Placement is identity: settle it before the no-change compare or the PATCH.
-    refuseIf(resource.kind, resource, projectCtx(live, desiredProject), outcomes);
+    // A team is identity: settle it before the no-change compare or the PATCH.
+    refuseIf(resource.kind, resource, await teamCtx(teams, live, team, resource, outcomes), outcomes);
     let id;
     let action;
     if (live === undefined) {
@@ -1009,10 +905,10 @@ async function applyEnvironment(resource, apis, outcomes, applied, reserved, con
         action = "unchanged";
     }
     else {
-        // `slug` is the reconcile key; `projectId` is identity, proven equal above — neither is sent. The
+        // `slug` is the reconcile key; `teamId` is identity, proven equal above — neither is sent. The
         // platform refuses any update carrying `platform.runtime`, and the refusal above has proven a declared
         // one equal to the live one.
-        const patch = stripKeys(body, ["slug", "projectId"]);
+        const patch = stripKeys(body, ["slug", "teamId"]);
         if (typeof patch.platform === "object" && patch.platform !== null) {
             patch.platform = stripKeys(patch.platform, ["runtime"]);
         }
@@ -1082,7 +978,7 @@ function sortByPath(refs) {
     return [...refs].sort((a, b) => (a.path < b.path ? -1 : a.path > b.path ? 1 : 0));
 }
 /**
- * `projectId` is deliberately NOT part of this compare: the refusal classifier already proved the live stamp
+ * `teamId` is deliberately NOT part of this compare: the refusal classifier already proved the live team
  * equals the declared one, so comparing it again could only produce a second, divergent opinion.
  */
 function skillUnchanged(displayName, fileRefs, live) {
@@ -1092,12 +988,15 @@ function skillUnchanged(displayName, fileRefs, live) {
     }
     return subsetDeepEqual(desired, live);
 }
-async function applySkill(resource, apis, outcomes, applied, projectId, desiredProject) {
+async function applySkill(resource, apis, outcomes, applied, teams) {
     const payload = resource.payload;
+    const team = await teams.desired(payload.teamId, { kind: "skill", slug: resource.slug, op: "get" }, outcomes);
+    const placement = {};
+    stampTeam(placement, team);
     // READ AND CLASSIFY BEFORE ANY FILE POST: the uploads below mint immutable `files` rows, so running them
     // first would leave orphaned rows behind every refusal, for a declaration that never owned this skill.
     const live = await failing(() => getBySlugOrUndefined(() => apis.skills.getSkill({ id: resource.slug })), { kind: "skill", slug: resource.slug, op: "get" }, outcomes);
-    refuseIf(resource.kind, resource, projectCtx(live, desiredProject), outcomes);
+    refuseIf(resource.kind, resource, await teamCtx(teams, live, team, resource, outcomes), outcomes);
     const fileRefs = await uploadContentFiles(payload.files, apis, { kind: "skill", slug: resource.slug }, outcomes);
     let id;
     let action;
@@ -1106,7 +1005,7 @@ async function applySkill(resource, apis, outcomes, applied, projectId, desiredP
             slug: resource.slug,
             files: fileRefs,
             ...(payload.displayName !== undefined ? { displayName: payload.displayName } : {}),
-            ...(projectId !== undefined ? { projectId } : {}),
+            ...placement,
         };
         const created = await failing(() => apis.skills.createSkill({ createSkillRequest: createBody }), { kind: "skill", slug: resource.slug, op: "create" }, outcomes);
         id = created.id;
@@ -1117,8 +1016,8 @@ async function applySkill(resource, apis, outcomes, applied, projectId, desiredP
         action = "unchanged";
     }
     else {
-        // Whole-list `files` replacement plus the optional cosmetic `displayName`; no `projectId`, because
-        // placement is identity and never a move. A live displayName cannot be CLEARED by omission — the subset
+        // Whole-list `files` replacement plus the optional cosmetic `displayName`; no `teamId`, because a
+        // team is identity and never a move. A live displayName cannot be CLEARED by omission — the subset
         // compare ignores live-only keys — an accepted cosmetic residual.
         const patch = {
             files: fileRefs,
@@ -1147,9 +1046,10 @@ export function agentUnchanged(desired, live) {
         standbyCapacityUnchanged(desiredStandby, liveStandby) &&
         subsetDeepEqual(desiredRest, { ...liveRest, skillIds: liveSkillIds }));
 }
-async function applyAgent(resource, apis, outcomes, applied, projectId, desiredProject, factory, provenance) {
+async function applyAgent(resource, apis, outcomes, applied, teams, factory, provenance) {
     const body = clonePayload(resource.payload);
-    stampBodyProject(body, projectId);
+    const team = await teams.desired(body.teamId, { kind: "agent", slug: resource.slug, op: "get" }, outcomes);
+    stampTeam(body, team);
     // Compared and written apart from the body, because an update merges them into the live map: the stamp rides
     // the patch too, which is what makes an ADOPTED agent missing the marker read as drift and get stamped.
     const declaredLabels = body.labels;
@@ -1162,7 +1062,7 @@ async function applyAgent(resource, apis, outcomes, applied, projectId, desiredP
     // READ AND CLASSIFY BEFORE ANY FILE POST, as the skill lane does: a refusal must leave no `files` rows
     // behind. The reference resolution above is reads only, so it may stay where it is.
     const live = await failing(() => getBySlugOrUndefined(() => apis.agents.getAgent({ id: resource.slug })), { kind: "agent", slug: resource.slug, op: "get" }, outcomes);
-    refuseIf(resource.kind, resource, projectCtx(live, desiredProject), outcomes);
+    refuseIf(resource.kind, resource, await teamCtx(teams, live, team, resource, outcomes), outcomes);
     body.memoryFiles = await uploadContentFiles(body.memoryFiles ?? [], apis, { kind: "agent", slug: resource.slug }, outcomes);
     let id;
     let action;
@@ -1186,11 +1086,11 @@ async function applyAgent(resource, apis, outcomes, applied, projectId, desiredP
     }
     else {
         const labels = labelsPatch(declaredLabels, live.labels, managed);
-        // `slug` and `harness` are create-only and `projectId` is identity the guard above proved equal.
+        // `slug` and `harness` are create-only and `teamId` is identity the guard above proved equal.
         // `UpdateAgentRequest` carries no `harness`, so the refusal above is what stops a declaration that moved
         // it from silently reconciling forever.
         const patch = {
-            ...stripKeys(body, ["slug", "projectId", "harness"]),
+            ...stripKeys(body, ["slug", "teamId", "harness"]),
             ...(labels !== undefined ? { labels } : {}),
             ...provenanceField(provenance),
         };