@orchestraworks/cli 0.5.5 → 0.5.8

package/dist/engine/secrets-apply.d.ts

@@ -128,12 +128,22 @@ export declare function reconcileInjection(desired: InjectionRecipe | undefined,
 export declare function metadataInjectionChange(desired: InjectionRecipe | undefined, live: InjectionRecipe | undefined): {
     injection: InjectionRecipe | null;
 } | undefined;
+/**
+ * The hosts delta for the value-less PATCH path, compared EXACTLY rather than as a subset: a live row at `[]`
+ * after the platform added the column must take a declared list, and a declared `[]` must clear a live one.
+ * `undefined` when the plan states no hosts at all (a plan written before the field) or they already match.
+ */
+export declare function metadataHostsChange(desired: readonly string[] | undefined, live: readonly string[] | undefined): {
+    hosts: string[];
+} | undefined;
+/** A declared secret's hosts as the plan carries them; `undefined` for a plan written before the field. */
+export declare function declaredSecretHosts(payload: unknown): string[] | undefined;
 /**
  * The write kinds carry value-free identifiers for the confirmation prompt, never the value itself.
  *   - `overwrite`       — values are never readable, so any supplied value overwrites.
  *   - `noop-resolve`    — resolve the id and write nothing, which protects the live credential from an
  *                         empty overwrite.
- *   - `metadata-update` — a recipe edit changes no secret VALUE, so it must not be dropped as a noop.
+ *   - `metadata-update` — a recipe or hosts edit changes no secret VALUE, so it must not be dropped as a noop.
  *   - `skip-empty`      — the reconcile engine turns this into the named preflight error.
  */
 export type SecretDecision = {
@@ -148,13 +158,14 @@ export type SecretDecision = {
     kind: "noop-resolve";
 } | {
     kind: "metadata-update";
-    injection: InjectionRecipe | null;
+    injection?: InjectionRecipe | null;
+    hosts?: string[];
 } | {
     kind: "skip-empty";
 };
 /**
- * `meta.injectionChange` steers only the no-value-plus-exists branch, since a fresh value already writes the
- * recipe through the create/overwrite body.
+ * `meta.injectionChange` and `meta.hostsChange` steer only the no-value-plus-exists branch, since a fresh
+ * value already writes the recipe and the hosts through the create/overwrite body.
  *
  * `meta.commandLinePending` is the value-free branch, and it is load-bearing: a `cli:`-backed recipe has no
  * bytes yet when this runs, because the collection pass deliberately happens AFTER the confirmation this
@@ -168,5 +179,8 @@ export declare function decideSecretWrite(resolvedValue: string | undefined, exi
     injectionChange?: {
         injection: InjectionRecipe | null;
     };
+    hostsChange?: {
+        hosts: string[];
+    };
     commandLinePending?: boolean;
 }): SecretDecision;

package/dist/engine/secrets-apply.js

@@ -65,6 +65,8 @@ function stringLeaves(s) {
             ...stringLeaves(s.ecrCredential.secretAccessKeySource),
         ];
     }
+    if ("fields" in s)
+        return Object.values(s.fields).flatMap(stringLeaves);
     throw new Error("unreachable ValueFrom variant"); // exhaustiveness guard
 }
 /**
@@ -220,6 +222,20 @@ function resolveRecipe(s, env, occurrences, cursor) {
             return undefined; // both-or-neither
         return JSON.stringify({ type: "aws-ecr", accessKeyId, secretAccessKey });
     }
+    if ("fields" in s) {
+        // Every field is walked even after one is unresolved, for the same cursor alignment as `ecrCredential`;
+        // the platform renders `${secret.<name>}` from the JSON object this writes.
+        const resolved = {};
+        let complete = true;
+        for (const [name, field] of Object.entries(s.fields)) {
+            const value = resolveRecipe(field, env, occurrences, cursor);
+            if (value === undefined)
+                complete = false;
+            else
+                resolved[name] = value;
+        }
+        return complete ? JSON.stringify(resolved) : undefined;
+    }
     throw new Error("unreachable ValueFrom variant"); // exhaustiveness guard
 }
 /**
@@ -241,6 +257,8 @@ export function rootEnvName(s) {
         return rootEnvName(s.basicAuth.source);
     if ("registryCredential" in s)
         return rootEnvName(s.registryCredential.source);
+    if ("fields" in s)
+        return allRootSourceLabels(s)[0] ?? "";
     return rootEnvName(s.ecrCredential.accessKeyIdSource);
 }
 /**
@@ -288,8 +306,25 @@ export function metadataInjectionChange(desired, live) {
     return live !== undefined ? { injection: null } : undefined;
 }
 /**
- * `meta.injectionChange` steers only the no-value-plus-exists branch, since a fresh value already writes the
- * recipe through the create/overwrite body.
+ * The hosts delta for the value-less PATCH path, compared EXACTLY rather than as a subset: a live row at `[]`
+ * after the platform added the column must take a declared list, and a declared `[]` must clear a live one.
+ * `undefined` when the plan states no hosts at all (a plan written before the field) or they already match.
+ */
+export function metadataHostsChange(desired, live) {
+    if (desired === undefined)
+        return undefined;
+    const current = live ?? [];
+    const same = desired.length === current.length && desired.every((host, index) => host === current[index]);
+    return same ? undefined : { hosts: [...desired] };
+}
+/** A declared secret's hosts as the plan carries them; `undefined` for a plan written before the field. */
+export function declaredSecretHosts(payload) {
+    const hosts = payload.hosts;
+    return Array.isArray(hosts) ? hosts : undefined;
+}
+/**
+ * `meta.injectionChange` and `meta.hostsChange` steer only the no-value-plus-exists branch, since a fresh
+ * value already writes the recipe and the hosts through the create/overwrite body.
  *
  * `meta.commandLinePending` is the value-free branch, and it is load-bearing: a `cli:`-backed recipe has no
  * bytes yet when this runs, because the collection pass deliberately happens AFTER the confirmation this
@@ -311,8 +346,8 @@ export function decideSecretWrite(resolvedValue, exists, meta) {
     if (!exists) {
         return { kind: "skip-empty" };
     }
-    if (meta.injectionChange !== undefined) {
-        return { kind: "metadata-update", injection: meta.injectionChange.injection };
+    if (meta.injectionChange !== undefined || meta.hostsChange !== undefined) {
+        return { kind: "metadata-update", ...meta.injectionChange, ...meta.hostsChange };
     }
     return { kind: "noop-resolve" };
 }

package/dist/engine/trigger-reconcile.d.ts

@@ -1,6 +1,6 @@
 import type { TriggerDocument, TriggerTarget } from "../constructs/trigger.js";
 import type { ConnectionIdResolver } from "./connection-slots.js";
-import { type ProjectIdentityRefusal } from "./apply-core.js";
+import { type DesiredTeam, type TeamIdentityRefusal } from "./apply-core.js";
 import type { FetchAPI } from "@orchestraworks/client";
 import { type PlatformApis } from "./client.js";
 import type { PlatformTarget } from "../cli/core/platform-client.js";
@@ -12,11 +12,10 @@ export interface TriggerCreateBody {
     status?: WireTriggerStatus;
     expiresAt?: string;
     /**
-     * Resolved at apply, never at synth. Absent means the project field is UNMANAGED, never a declaration of
-     * commons. It stamps the CREATE only: on a live row a placement is identity, compared by the shared
-     * classifier and never patched.
+     * Resolved at apply, never at synth, and absent for a trigger in Shared. It rides the CREATE only: on a live
+     * row a team is identity, compared by the shared classifier and never patched.
      */
-    projectId?: string;
+    teamId?: string;
 }
 /**
  * The MUTABLE fields only. `target` is re-sent so the policy verbs can be patched, and its anchor and binding
@@ -37,8 +36,8 @@ export interface LiveTrigger {
     target?: TriggerTarget;
     on?: TriggerDocument["on"];
     where?: TriggerDocument["where"];
-    /** Null for a commons row. */
-    projectId?: string | null;
+    /** Null for a row that reports no team, which the platform reads as Shared. */
+    teamId?: string | null;
 }
 /** The subset of the generated `TriggersApi` this reconcile drives. */
 export interface TriggersApiLike {
@@ -54,7 +53,7 @@ export interface TriggersApiLike {
     }): Promise<LiveTrigger>;
 }
 /**
- * `refused` is a PREVIEW-ONLY verdict for a live row whose project placement is not the declared one: apply
+ * `refused` is a PREVIEW-ONLY verdict for a live row whose team is not the declared one: apply
  * throws that conflict, while the preview reports it as a row so one conflict still leaves the rest classified.
  */
 export type TriggerAction = "created" | "updated" | "unchanged" | "refused";
@@ -69,20 +68,24 @@ export interface TriggerReconcileOutcome {
      */
     predicted?: boolean;
     /** Set only on a `refused` outcome — the same payload apply's thrown conflict carries. */
-    refusal?: ProjectIdentityRefusal;
+    refusal?: TeamIdentityRefusal;
 }
+/**
+ * A trigger document's team, resolved the way every other row's is; `undefined` decides nothing. `live` is the
+ * row the team is judged against, which a trigger in Shared needs before Shared's id is read.
+ */
+export type TriggerTeamResolver = (raw: string | undefined, live?: LiveTrigger) => Promise<DesiredTeam | undefined>;
 export interface TriggerDecision {
     action: TriggerAction;
 }
 /**
  * A drifted IMMUTABLE field fails loudly rather than reporting a false `unchanged`.
  *
- * The PROJECT stamp is checked FIRST and through the shared classifier rather than this lane's own
- * immutable-field wording, because a placement conflict outranks every other verdict and must read
- * identically in apply and in preview. A Factory declaring NO project does not fail at all — an unmanaged
- * project field is inert, so a row someone moved in the console cannot break a project-less app's apply.
+ * The team is checked FIRST and through the shared classifier rather than this lane's own immutable-field
+ * wording, because a team conflict outranks every other verdict and must read identically in apply and in
+ * preview.
  */
-export declare function reconcileTrigger(desired: TriggerCreateBody, live: LiveTrigger | undefined): TriggerDecision;
+export declare function reconcileTrigger(desired: TriggerCreateBody, live: LiveTrigger | undefined, team?: DesiredTeam): TriggerDecision;
 /** Built once per apply. */
 /** Built once per apply over the plan-phase `applied` map plus the agents API. */
 export type AgentRefResolver = (ref: string) => Promise<string>;
@@ -109,20 +112,16 @@ export declare function pipelineResolver(apis: PlatformApis, declared: ReadonlyM
  * A create-race 409 on the POST recovers by re-reading and PATCHing, so the create degrades to an update
  * against the winner's row.
  */
-export declare function reconcileTriggerLive(api: TriggersApiLike, doc: TriggerDocument, resolveAgentRef?: AgentRefResolver, projectId?: string, dryRun?: boolean, resolveConnectionId?: ConnectionIdResolver, resolvePipeline?: PipelineResolver): Promise<TriggerReconcileOutcome>;
+export declare function reconcileTriggerLive(api: TriggersApiLike, doc: TriggerDocument, resolveAgentRef?: AgentRefResolver, resolveTeam?: TriggerTeamResolver, dryRun?: boolean, resolveConnectionId?: ConnectionIdResolver, resolvePipeline?: PipelineResolver): Promise<TriggerReconcileOutcome>;
 /**
  * Outcomes accumulate in place, so a mid-batch failure still surfaces the progress made.
  *
- * `options.projectPending` is set ONLY by the dry-run when the factory declares a MANAGED project that does
- * not exist live yet: no live stamp can equal a project nothing has created, so a PRESENT row is `refused`
- * and an ABSENT one is still an exact `created`. The refusal names the project by its declared plan slug,
- * which only a caller holding the plan can supply; without it this call knows the project as an unresolvable
- * token alone, so it keeps the pending verdict rather than naming what it cannot name.
+ * In a dry-run, a trigger placed in a MANAGED team that does not exist live yet resolves `pending-managed`:
+ * no live row can sit in a team nothing has created, so a PRESENT row is `refused` and an ABSENT one is still
+ * an exact `created`.
  */
-export declare function reconcileTriggers(api: TriggersApiLike, docs: TriggerDocument[], resolveAgentRef?: AgentRefResolver, projectId?: string, outcomes?: TriggerReconcileOutcome[], options?: {
+export declare function reconcileTriggers(api: TriggersApiLike, docs: TriggerDocument[], resolveAgentRef?: AgentRefResolver, resolveTeam?: TriggerTeamResolver, outcomes?: TriggerReconcileOutcome[], options?: {
     dryRun?: boolean;
-    projectPending?: boolean;
-    projectRef?: string;
     resolveConnectionId?: ConnectionIdResolver;
     resolvePipeline?: PipelineResolver;
 }): Promise<TriggerReconcileOutcome[]>;

package/dist/engine/trigger-reconcile.js

@@ -8,7 +8,7 @@
 // ids and reads them back, so the immutable compare runs over ids.
 import { wireNode } from "../constructs/workflow-filter.js";
 import { ApplyError, getBySlugOrUndefined, UnresolvedManagedRefError, } from "./reconcile.js";
-import { classifyProjectIdentity, desiredProjectOf, exactDeepEqual, pendingDesiredProject, platformErrorBody, projectIdentityConflict, } from "./apply-core.js";
+import { classifyTeamIdentity, exactDeepEqual, platformErrorBody, teamIdentityConflict, } from "./apply-core.js";
 import { httpStatusOf, makeApis } from "./client.js";
 import { PreflightError } from "./preflight-errors.js";
 import { rawJsonBody, toWireValue } from "./raw-json-request.js";
@@ -59,24 +59,18 @@ function targetVerbs(target) {
 /**
  * A drifted IMMUTABLE field fails loudly rather than reporting a false `unchanged`.
  *
- * The PROJECT stamp is checked FIRST and through the shared classifier rather than this lane's own
- * immutable-field wording, because a placement conflict outranks every other verdict and must read
- * identically in apply and in preview. A Factory declaring NO project does not fail at all — an unmanaged
- * project field is inert, so a row someone moved in the console cannot break a project-less app's apply.
+ * The team is checked FIRST and through the shared classifier rather than this lane's own immutable-field
+ * wording, because a team conflict outranks every other verdict and must read identically in apply and in
+ * preview.
  */
-export function reconcileTrigger(desired, live) {
+export function reconcileTrigger(desired, live, team) {
     if (live === undefined) {
         return { action: "created" };
     }
-    const conflict = classifyProjectIdentity({
-        resourceKind: "trigger",
-        slug: desired.slug,
-        live,
-        desired: desiredProjectOf(desired.projectId),
-    });
+    const conflict = team === undefined ? undefined : classifyTeamIdentity({ resourceKind: "trigger", slug: desired.slug, live, desired: team });
     if (conflict !== undefined) {
         // This lane accumulates outcomes in the caller's batch, so the error carries none of its own.
-        throw projectIdentityConflict(conflict, []);
+        throw teamIdentityConflict(conflict, []);
     }
     const drifted = changedImmutableField(desired, live);
     if (drifted !== undefined) {
@@ -102,8 +96,8 @@ function changedImmutableField(desired, live) {
         return "where";
     if (identityDrifts(targetIdentity(desired.target), targetIdentity(live.target)))
         return "target anchor/binding";
-    // `projectId` is deliberately absent: it is still identity, but the shared classifier compares it before
-    // this runs and words the refusal the way every other lane and every diff renderer words it.
+    // `teamId` is deliberately absent: it is still identity, but the shared classifier compares it before this
+    // runs and words the refusal the way every other lane and every diff renderer words it.
     return undefined;
 }
 /** Unset = absent on the wire: `undefined`, or an explicit `null` clear the platform never echoes for these. */
@@ -248,7 +242,15 @@ async function readPipeline(apis, ref, declared) {
  * A create-race 409 on the POST recovers by re-reading and PATCHing, so the create degrades to an update
  * against the winner's row.
  */
-export async function reconcileTriggerLive(api, doc, resolveAgentRef = async (ref) => ref, projectId, dryRun = false, resolveConnectionId = async (ref) => ref, resolvePipeline) {
+export async function reconcileTriggerLive(api, doc, resolveAgentRef = async (ref) => ref, resolveTeam, dryRun = false, resolveConnectionId = async (ref) => ref, resolvePipeline) {
+    const team = resolveTeam === undefined ? undefined : await resolveTeam(doc.teamId);
+    const judgedAgainst = async (live) => resolveTeam === undefined ? undefined : resolveTeam(doc.teamId, live);
+    const refusalAgainst = async (live) => {
+        const judged = await judgedAgainst(live);
+        return judged === undefined
+            ? undefined
+            : classifyTeamIdentity({ resourceKind: "trigger", slug: doc.slug, live, desired: judged });
+    };
     // An agent anchor may be a managed token that cannot resolve in a read-only preview, because the
     // plan-resource phase has not run. Apply fails hard on that; the dry-run previews it as pending.
     let resolved;
@@ -271,13 +273,8 @@ export async function reconcileTriggerLive(api, doc, resolveAgentRef = async (re
             };
         }
         // A READABLE conflict outranks even this pending-dependency prediction: an unresolvable target anchor
-        // says nothing about where the live row sits, and apply would refuse on the placement regardless.
-        const pendingRefusal = classifyProjectIdentity({
-            resourceKind: "trigger",
-            slug: doc.slug,
-            live,
-            desired: desiredProjectOf(projectId),
-        });
+        // says nothing about which team the live row sits in, and apply would refuse on the team regardless.
+        const pendingRefusal = await refusalAgainst(live);
         return pendingRefusal !== undefined
             ? {
                 slug: doc.slug,
@@ -288,7 +285,7 @@ export async function reconcileTriggerLive(api, doc, resolveAgentRef = async (re
             }
             : { slug: doc.slug, id: live.id, action: "updated", predicted: true };
     }
-    const body = createBodyOf(resolved, projectId);
+    const body = createBodyOf(resolved, team);
     const live = await getBySlugOrUndefined(() => api.getTrigger({ id: resolved.slug }));
     if (live === undefined) {
         // The action is already decided, so the preview fences the POST and leaves the server-derived id
@@ -313,15 +310,10 @@ export async function reconcileTriggerLive(api, doc, resolveAgentRef = async (re
         }
     }
     const current = live ?? (await api.getTrigger({ id: resolved.slug }));
-    // Apply throws the project verdict from the pure decision below; the preview must RETURN it instead,
-    // because a throw here would abort the whole preview at the first conflicted trigger.
+    // Apply throws the team verdict from the pure decision below; the preview must RETURN it instead, because a
+    // throw here would abort the whole preview at the first conflicted trigger.
     if (dryRun) {
-        const refusal = classifyProjectIdentity({
-            resourceKind: "trigger",
-            slug: resolved.slug,
-            live: current,
-            desired: desiredProjectOf(projectId),
-        });
+        const refusal = await refusalAgainst(current);
         if (refusal !== undefined) {
             return {
                 slug: resolved.slug,
@@ -332,7 +324,7 @@ export async function reconcileTriggerLive(api, doc, resolveAgentRef = async (re
             };
         }
     }
-    const decision = reconcileTrigger(body, current);
+    const decision = reconcileTrigger(body, current, await judgedAgainst(current));
     if (decision.action === "unchanged") {
         return {
             slug: resolved.slug,
@@ -362,22 +354,21 @@ export async function reconcileTriggerLive(api, doc, resolveAgentRef = async (re
 /**
  * Outcomes accumulate in place, so a mid-batch failure still surfaces the progress made.
  *
- * `options.projectPending` is set ONLY by the dry-run when the factory declares a MANAGED project that does
- * not exist live yet: no live stamp can equal a project nothing has created, so a PRESENT row is `refused`
- * and an ABSENT one is still an exact `created`. The refusal names the project by its declared plan slug,
- * which only a caller holding the plan can supply; without it this call knows the project as an unresolvable
- * token alone, so it keeps the pending verdict rather than naming what it cannot name.
+ * In a dry-run, a trigger placed in a MANAGED team that does not exist live yet resolves `pending-managed`:
+ * no live row can sit in a team nothing has created, so a PRESENT row is `refused` and an ABSENT one is still
+ * an exact `created`.
  */
-export async function reconcileTriggers(api, docs, resolveAgentRef = async (ref) => ref, projectId, outcomes = [], options = {}) {
+export async function reconcileTriggers(api, docs, resolveAgentRef = async (ref) => ref, resolveTeam, outcomes = [], options = {}) {
     const dryRun = options.dryRun === true;
     const resolveConnectionId = options.resolveConnectionId ?? (async (ref) => ref);
     for (const doc of docs) {
-        if (dryRun && options.projectPending === true) {
+        const team = resolveTeam === undefined ? undefined : await resolveTeam(doc.teamId);
+        if (dryRun && team?.state === "pending-managed") {
             // The slug is authoritative, so a GET-by-slug decides absent-vs-present with no write, and the refusal
             // is a VERDICT rather than a throw so one conflict does not abort the batch. The trigger's OTHER refs
-            // must still be validated read-only, or a missing imported agent hides behind the pending-project
-            // verdict though apply would fail; an unresolvable MANAGED ref is itself a pending dependency, and any
-            // other resolution failure propagates.
+            // must still be validated read-only, or a missing imported agent hides behind the pending-team verdict
+            // though apply would fail; an unresolvable MANAGED ref is itself a pending dependency, and any other
+            // resolution failure propagates.
             try {
                 await resolveTriggerRefs(doc, resolveAgentRef, resolveConnectionId, options.resolvePipeline);
             }
@@ -387,12 +378,7 @@ export async function reconcileTriggers(api, docs, resolveAgentRef = async (ref)
                 }
             }
             const live = await getBySlugOrUndefined(() => api.getTrigger({ id: doc.slug }));
-            const refusal = classifyProjectIdentity({
-                resourceKind: "trigger",
-                slug: doc.slug,
-                live,
-                desired: pendingDesiredProject(options.projectRef),
-            });
+            const refusal = classifyTeamIdentity({ resourceKind: "trigger", slug: doc.slug, live, desired: team });
             if (live === undefined) {
                 outcomes.push({
                     slug: doc.slug,
@@ -410,24 +396,16 @@ export async function reconcileTriggers(api, docs, resolveAgentRef = async (ref)
                     refusal,
                 });
             }
-            else {
-                // Reachable only when the caller supplied no declared slug: the row is live, the project is pending,
-                // and the engine cannot name it, so the pending verdict stands.
-                outcomes.push({
-                    slug: doc.slug,
-                    id: live.id,
-                    action: "updated",
-                    predicted: true,
-                });
-            }
             continue;
         }
-        outcomes.push(await reconcileTriggerLive(api, doc, resolveAgentRef, projectId, dryRun, resolveConnectionId, options.resolvePipeline));
+        outcomes.push(await reconcileTriggerLive(api, doc, resolveAgentRef, 
+        // The live row goes through, so a trigger in Shared is judged against Shared's id once a read reports it.
+        async (raw, live) => (resolveTeam === undefined || live === undefined ? team : resolveTeam(raw, live)), dryRun, resolveConnectionId, options.resolvePipeline));
     }
     return outcomes;
 }
-/** A project-less factory omits `projectId` entirely, keeping such a body byte-identical. */
-function createBodyOf(doc, projectId) {
+/** A trigger in Shared carries no team, keeping its body the one the platform has always taken. */
+function createBodyOf(doc, team) {
     const body = {
         slug: doc.slug,
         on: doc.on,
@@ -439,8 +417,8 @@ function createBodyOf(doc, projectId) {
         body.status = wireStatus(doc.status);
     if (doc.expiresAt !== undefined)
         body.expiresAt = doc.expiresAt;
-    if (projectId !== undefined)
-        body.projectId = projectId;
+    if (team?.state === "resolved" && team.shared !== true)
+        body.teamId = team.teamId;
     return body;
 }
 async function failing(slug, op) {
@@ -485,7 +463,7 @@ function toLiveTrigger(json) {
         // The immutable identity fields, read back so the reconcile can FAIL a re-point drift.
         on: json.on,
         where: json.where,
-        projectId: json.projectId ?? null,
+        teamId: json.teamId ?? null,
     };
 }
 /**

package/dist/engine/workflow-reconcile.d.ts

@@ -29,7 +29,7 @@ export interface LiveWorkflow {
     id: string;
     slug: string;
     name: string;
-    projectId?: string;
+    teamId?: string;
     pipeline: {
         id: string;
         slug: string;
@@ -51,7 +51,7 @@ export interface ResolvedWorkflow {
 /** Each resolves one reference to its id, or throws the refusal for one that names nothing. */
 export interface WorkflowResolvers {
     agent(ref: string): Promise<string>;
-    group(ref: string): Promise<string>;
+    team(ref: string): Promise<string>;
     connection(ref: string): Promise<string>;
     pipeline(ref: string): Promise<ResolvedPipeline>;
 }

package/dist/engine/workflow-reconcile.js

@@ -12,7 +12,7 @@ import { exactDeepEqual, getBySlugOrUndefined, mapError, platformErrorMessage }
 import { httpStatusOf } from "./client.js";
 import { resolveConditionReferences, resolveStageInField } from "./condition-references.js";
 import { connectionIdResolver, managedConnectionTokens } from "./connection-slots.js";
-import { declaredPipelinesOf, groupIdOf } from "./pipeline-reconcile.js";
+import { declaredPipelinesOf, teamIdOf } from "./pipeline-reconcile.js";
 import { pinFollowingEntries } from "./pipeline-workflow-reconcile.js";
 import { PreflightError } from "./preflight-errors.js";
 import { rawJsonBody, toWireValue } from "./raw-json-request.js";
@@ -30,11 +30,11 @@ export function workflowResolvers(apis, plan, applied, connections) {
             agents.set(resource.slug, refToken("agent", resource.path.split("/")));
     }
     const agentIds = new Map();
-    const groupIds = new Map();
+    const teamIds = new Map();
     const connection = connectionIdResolver(managedConnectionTokens(plan), connections);
     return {
         agent: (ref) => memo(agentIds, ref, () => resolveReferenceId(agents.get(ref) ?? ref, "agent", applied, apis)),
-        group: (ref) => memo(groupIds, ref, () => groupIdOf(apis, ref)),
+        team: (ref) => memo(teamIds, ref, () => teamIdOf(apis, ref)),
         connection,
         pipeline: pipelineResolver(apis, declaredPipelinesOf(plan.resources)),
     };
@@ -62,7 +62,7 @@ export async function resolveWorkflow(payload, resolvers, options = {}) {
         throw options.dryRun === true && target.managed ? new UnresolvedManagedRefError(message) : new PreflightError(message);
     };
     const own = (ref) => stageIn(pipeline, ref);
-    const conditions = { agent: resolvers.agent, group: resolvers.group, stage: own };
+    const conditions = { agent: resolvers.agent, team: resolvers.team, stage: own };
     const node = async (value) => value === undefined ? undefined : wireNode(await resolveConditionReferences(value, conditions));
     const rules = [];
     for (const rule of payload.rules) {
@@ -96,7 +96,7 @@ async function resolveAction(action, resolvers, own, stageIn) {
     const assign = async (body) => ({
         ...body,
         ...(body.assigneeAgent !== undefined ? { assigneeAgent: await resolvers.agent(body.assigneeAgent) } : {}),
-        ...(body.assigneeGroup !== undefined ? { assigneeGroup: await resolvers.group(body.assigneeGroup) } : {}),
+        ...(body.assigneeTeam !== undefined ? { assigneeTeam: await resolvers.team(body.assigneeTeam) } : {}),
     });
     if ("assign" in action)
         return { assign: await assign(action.assign) };