@orchestraworks/cli 0.5.5 → 0.5.8

package/dist/cli/main.d.ts

@@ -34,7 +34,7 @@ import { type SynthCommandOptions } from "./factory/synth.js";
  *
  * {@link topLevelHelpText} is what `orchestra --help` actually prints — this body plus a runtime epilogue.
  */
-export declare const TOP_LEVEL_HELP = "orchestra \u2014 the Orchestra command line.\n\norchestra fdk is the software factory as code. A software factory \u2014\nagents, environments, workflows, and the credentials that power them \u2014 is\ndefined in code: versioned, reviewed, type-checked. fdk apply reconciles\nthe platform to it, like cdk or terraform.\n\nUSAGE\n  orchestra <command> [flags]\n\nThe orchestra CLI does two jobs:\n\n  1  Factory as code \u2014 where change happens.\n     Declare the factory in code; fdk synth renders the plan, fdk diff\n     previews it, fdk apply makes the platform match. Code is the source of\n     truth, so every change is version-controlled, reviewed, and type-guarded.\n\n  2  Platform commands \u2014 probe the live factory.\n     Read state, reason about what exists, trial an idea before codifying\n     it, or fall back for a one-off: orchestra <noun> <verb>.\n\n  Rule of thumb: observe with commands. Change in code.\n\nSIGN IN\n  auth login   Authenticate and save a profile (both jobs use it)\n\nFACTORY AS CODE\n  fdk init     Write a starter factory into this folder\n  fdk synth    Render the factory to a plan\n  fdk diff     Preview what apply would change\n  fdk apply    Make the platform match the code\n\nPLATFORM COMMANDS   orchestra <noun> <verb> \u2014 nouns match API paths exactly\n  Build & run      agents  environments  sessions  machines  compute-enrollments\n                   pipelines  work-items  workflows  decisions  skills\n                   files  artifacts  volumes  projects  room-tokens\n                   compute-providers\n  Events & wiring  triggers  events  deliveries  connections\n                   connection-intents  install-links  connectors  providers\n  Models           models  model-aliases  model-configs  model-providers\n                   model-provider-keys  gateway-keys\n  Credentials      secrets  api-keys\n  Organization     organizations  organization-memberships  organization-invitations\n                   users  groups  user-grants  service-accounts  roles  policies  me\n  Observability    metrics  dashboards  health\n\n  Standard verbs: list \u00B7 get \u00B7 create \u00B7 update \u00B7 delete.\n  Command endpoints keep their own verb: sessions interrupt, work-items move,\n  workflows revert.\n  Typed flows: user-grants grant (mint a user-grant and walk its consent flow) \u00B7\n               sessions wait (poll a session until it settles) \u00B7\n               sessions tail (print a session's items as they are saved) \u00B7\n               compute-providers check (show why a Launcher fails) \u00B7\n               artifacts preview (serve an HTML page locally).\n  Write verbs exist for trial and fallback; durable change belongs in code.\n  Writing to a factory-managed resource warns: the next apply reverts it.\n  orchestra <noun> --help lists a noun's verbs and flags.\n\nBACKUP\n  api <METHOD> </path>   Raw authenticated call (like gh api). For when a typed\n                         command is missing or wrong \u2014 needing it is a bug; file it.\n\nYOUR CODING AGENT\n  skills install         Link the two bundled skills, orchestra and orchestra-fdk,\n                         into Claude Code or Codex. Both flags are required:\n                         --harness claude|codex|both|other --scope user|project.\n\nTHIS MACHINE\n  install                Install the CLI globally, ask what this machine is, then\n                         install the worker and the harness families you choose.\n  worker run             Serve this machine: claim its identity, then register.\n  worker install         Install the worker here, taking every answer from flags.\n  worker enroll          Redeem an enrollment token, then serve this machine.\n\nRUN YOUR AGENT HERE    The local environment on this machine, and the machines it runs.\n  local up               Start it, and print the two lines a shell needs to reach it.\n  local status           Read its four checks: boot, content, turns, environment.\n  local down             Stop it, and the machines it launched.\n  outpost token          Mint an offer for a machine you already own.\n  outpost up             Enrol this machine, or this container, and hold its worker.\n  outpost down           Stop that worker and revoke its enrollment.\n  Every other command reaches it the ordinary way, by base URL.\n\nCONVENTIONS\n  --output json          On every platform command; the default is a human table.\n  --body @file.json      Full request body where flags are too coarse.\n  --file <path>          On files create and artifacts create / create-version:\n                         store the bytes at <path> and let the create name them.\n  Credential values in responses print masked; --reveal or --output-file is the\n  deliberate path.\n  fdk apply defaults to any-change: it confirms the whole pre-flight preview\n  before any write, and stays silent when nothing changes. A single platform\n  command defaults to sensitive-only \u2014 it asks for credential values and IAM only.\n  Override with --require-approval never | sensitive-only | any-change or with\n  ORCHESTRA_REQUIRE_APPROVAL; the legacy --approve-secrets is exactly never.\n  Prompts and bindings are written as prompt`\u2026` / binding`\u2026` tagged templates\n  over the typed context handle \u2014 never hand-spelled {{\u2026}} strings.\n\nEXAMPLES\n  orchestra fdk apply                                    # reconcile the factory in ./\n  orchestra secrets create --name deepseek --value-from-command-line\n  orchestra sessions list --status RUNNING --output json\n  orchestra work-items move bug-12 --stage review\n  orchestra gateway-keys create --slug ci-smoke --output-file key.json\n\nLEARN MORE\n  orchestra <command> --help \u00B7 orchestra skills install --harness <name>\n  --scope user (links the reference and setup skills into your coding agent \u2014\n  the same documents AI agents use)\n";
+export declare const TOP_LEVEL_HELP = "orchestra \u2014 the Orchestra command line.\n\norchestra fdk is the software factory as code. A software factory \u2014\nagents, environments, workflows, and the credentials that power them \u2014 is\ndefined in code: versioned, reviewed, type-checked. fdk apply reconciles\nthe platform to it, like cdk or terraform.\n\nUSAGE\n  orchestra <command> [flags]\n\nThe orchestra CLI does two jobs:\n\n  1  Factory as code \u2014 where change happens.\n     Declare the factory in code; fdk synth renders the plan, fdk diff\n     previews it, fdk apply makes the platform match. Code is the source of\n     truth, so every change is version-controlled, reviewed, and type-guarded.\n\n  2  Platform commands \u2014 probe the live factory.\n     Read state, reason about what exists, trial an idea before codifying\n     it, or fall back for a one-off: orchestra <noun> <verb>.\n\n  Rule of thumb: observe with commands. Change in code.\n\nSIGN IN\n  auth login   Authenticate and save a profile (both jobs use it)\n\nFACTORY AS CODE\n  fdk init     Write a starter factory into this folder\n  fdk synth    Render the factory to a plan\n  fdk diff     Preview what apply would change\n  fdk apply    Make the platform match the code\n\nPLATFORM COMMANDS   orchestra <noun> <verb> \u2014 nouns match API paths exactly\n  Build & run      agents  environments  sessions  machines  compute-enrollments\n                   pipelines  work-items  workflows  decisions  skills\n                   files  images  artifacts  volumes  room-tokens\n                   compute-providers\n  Events & wiring  triggers  events  deliveries  connections\n                   connection-intents  install-links  connectors  providers\n  Models           models  model-aliases  model-configs  model-providers\n                   model-provider-keys  gateway-keys\n  Credentials      secrets  api-keys\n  Organization     organizations  organization-memberships  organization-invitations\n                   users  teams  team-memberships  user-grants  service-accounts\n                   roles  policies  me\n  Observability    metrics  dashboards  health\n\n  Standard verbs: list \u00B7 get \u00B7 create \u00B7 update \u00B7 delete.\n  Command endpoints keep their own verb: sessions interrupt, work-items move,\n  workflows revert.\n  Typed flows: user-grants grant (mint a user-grant and walk its consent flow) \u00B7\n               sessions wait (poll a session until it settles) \u00B7\n               sessions tail (print a session's items as they are saved) \u00B7\n               compute-providers check (show why a Launcher fails) \u00B7\n               artifacts preview (serve an HTML page locally).\n  Write verbs exist for trial and fallback; durable change belongs in code.\n  Writing to a factory-managed resource warns: the next apply reverts it.\n  orchestra <noun> --help lists a noun's verbs and flags.\n\nBACKUP\n  api <METHOD> </path>   Raw authenticated call (like gh api). For when a typed\n                         command is missing or wrong \u2014 needing it is a bug; file it.\n\nYOUR CODING AGENT\n  skills install         Link the two bundled skills, orchestra and orchestra-fdk,\n                         into Claude Code or Codex. Both flags are required:\n                         --harness claude|codex|both|other --scope user|project.\n\nTHIS MACHINE\n  install                Install the CLI globally, ask what this machine is, then\n                         install the worker and the harness families you choose.\n  worker run             Serve this machine: claim its identity, then register.\n  worker install         Install the worker here, taking every answer from flags.\n  worker enroll          Redeem an enrollment token, then serve this machine.\n\nRUN YOUR AGENT HERE    The local environment on this machine, and the machines it runs.\n  local up               Start it, and print the two lines a shell needs to reach it.\n  local status           Read its four checks: boot, content, turns, environment.\n  local down             Stop it, and the machines it launched.\n  outpost token          Mint an offer for a machine you already own.\n  outpost up             Enrol this machine, or this container, and hold its worker.\n  outpost down           Stop that worker and revoke its enrollment.\n  Every other command reaches it the ordinary way, by base URL.\n\nCONVENTIONS\n  --output json          On every platform command; the default is a human table.\n  --body @file.json      Full request body where flags are too coarse.\n  --file <path>          On files create and artifacts create / create-version:\n                         store the bytes at <path> and let the create name them.\n  Credential values in responses print masked; --reveal or --output-file is the\n  deliberate path.\n  fdk apply defaults to any-change: it confirms the whole pre-flight preview\n  before any write, and stays silent when nothing changes. A single platform\n  command defaults to sensitive-only \u2014 it asks for credential values and IAM only.\n  Override with --require-approval never | sensitive-only | any-change or with\n  ORCHESTRA_REQUIRE_APPROVAL; the legacy --approve-secrets is exactly never.\n  Prompts and bindings are written as prompt`\u2026` / binding`\u2026` tagged templates\n  over the typed context handle \u2014 never hand-spelled {{\u2026}} strings.\n\nEXAMPLES\n  orchestra fdk apply                                    # reconcile the factory in ./\n  orchestra secrets create --name deepseek --value-from-command-line\n  orchestra sessions list --status RUNNING --output json\n  orchestra work-items move bug-12 --stage review\n  orchestra gateway-keys create --slug ci-smoke --output-file key.json\n\nLEARN MORE\n  orchestra <command> --help \u00B7 orchestra skills install --harness <name>\n  --scope user (links the reference and setup skills into your coding agent \u2014\n  the same documents AI agents use)\n";
 /**
  * A function rather than a constant because the epilogue names an ABSOLUTE PATH that differs per install and
  * can only be resolved by the running process. `buildProgram` calls it once and pins the result, so the text

package/dist/cli/main.js

@@ -93,7 +93,7 @@ FACTORY AS CODE
 PLATFORM COMMANDS   orchestra <noun> <verb> — nouns match API paths exactly
   Build & run      agents  environments  sessions  machines  compute-enrollments
                    pipelines  work-items  workflows  decisions  skills
-                   files  artifacts  volumes  projects  room-tokens
+                   files  images  artifacts  volumes  room-tokens
                    compute-providers
   Events & wiring  triggers  events  deliveries  connections
                    connection-intents  install-links  connectors  providers
@@ -101,7 +101,8 @@ PLATFORM COMMANDS   orchestra <noun> <verb> — nouns match API paths exactly
                    model-provider-keys  gateway-keys
   Credentials      secrets  api-keys
   Organization     organizations  organization-memberships  organization-invitations
-                   users  groups  user-grants  service-accounts  roles  policies  me
+                   users  teams  team-memberships  user-grants  service-accounts
+                   roles  policies  me
   Observability    metrics  dashboards  health
 
   Standard verbs: list · get · create · update · delete.
@@ -375,7 +376,7 @@ export function buildProgram(handlers = defaultHandlers, pointer = bundledSkillP
     // The one command that installs this machine. It carries the auth flags because its first questions are a
     // sign-in, and `--no-browser` for the same reason `login` has it.
     addAuthOptions(program.command("install"))
-        .option("--project <id>", "project this machine's work belongs to (omitted: the organization's shared commons)")
+        .option("--team <id>", "team this machine's work belongs to (omitted: Shared)")
         .option("--role <role>", `what this machine is: ${MACHINE_ROLES.join(" | ")} (no default)`)
         .option("--harness <families>", `comma-separated harness families to install now: ${HARNESS_FAMILIES.join(", ")}`)
         .option("--root <dir>", "directory the worker installs its pinned runtime and harness families into")

package/dist/cli/upload.d.ts

@@ -19,6 +19,8 @@ export interface UploadedFile {
     readonly sizeBytes: number;
     readonly contentType: string;
     readonly filename: string;
+    /** True when the platform already held these bytes, so this call stored nothing. */
+    readonly alreadyStored: boolean;
 }
 export interface UploadOptions {
     /**
@@ -31,7 +33,7 @@ export interface UploadOptions {
     readonly io: CliIo;
     readonly organizationId?: string | undefined;
     /** Borrowed from the create's own body when it spells them, so both calls describe one file. */
-    readonly projectId?: string | undefined;
+    readonly teamId?: string | undefined;
     readonly filename?: string | undefined;
     readonly contentType?: string | undefined;
 }

package/dist/cli/upload.js

@@ -64,7 +64,14 @@ export async function uploadFile(path, options) {
             const parts = await push(declared, path, stats.size, options);
             await complete(declared, parts, options);
             report(declared, parts, filename, stats.size, options.io);
-            return { fileId: declared.file.id, sha256, sizeBytes: stats.size, contentType, filename };
+            return {
+                fileId: declared.file.id,
+                sha256,
+                sizeBytes: stats.size,
+                contentType,
+                filename,
+                alreadyStored: parts === undefined,
+            };
         }
         catch (failure) {
             if (!(failure instanceof PlanExpiredError) || attempt >= DECLARE_ATTEMPTS) {
@@ -103,7 +110,7 @@ async function declare(path, options, sha256, sizeBytes) {
             sizeBytes,
             filename: options.filename,
             contentType: options.contentType,
-            ...(options.projectId !== undefined ? { projectId: options.projectId } : {}),
+            ...(options.teamId !== undefined ? { teamId: options.teamId } : {}),
         },
         ...(options.organizationId !== undefined ? { xOrganizationId: options.organizationId } : {}),
     });

package/dist/constructs/agent.d.ts

@@ -1,7 +1,8 @@
 import { CreateAgentRequestSyncModeEnum, type AgentModelSettings, type StandbyCapacity } from "@orchestraworks/client";
 import { Construct } from "../core/construct.js";
 import type { PlanResource } from "../core/plan.js";
-import type { IAgent, IEnvironment, ISkill } from "./interfaces.js";
+import type { IAgent, IEnvironment, ISkill, ITeam } from "./interfaces.js";
+import { type TeamMembershipDeclaration } from "./team-membership.js";
 /**
  * Seeded into the agent's memory directory inside the harness home; a family that keeps no memory directory
  * resolves `path` under the workspace root instead.
@@ -46,6 +47,13 @@ export interface AgentProps {
     syncMode?: SyncMode;
     slug?: string;
     name?: string;
+    /** Fixed at create; undeclared, the agent is created in Shared. */
+    team?: ITeam;
+    /**
+     * The agent's full set of team membership rows. Undeclared, apply leaves the rows the platform wrote at
+     * create; declared, apply makes the live rows match it, and never removes the minted use policies.
+     */
+    memberships?: readonly TeamMembershipDeclaration[];
 }
 export declare class Agent extends Construct implements IAgent {
     /** Accepts a platform id or a slug interchangeably — one rule, stated on `IResource`. */

package/dist/constructs/agent.js

@@ -5,6 +5,7 @@ import { refToken } from "../core/tokens.js";
 import { MANAGED_SKILL_IDS } from "../generated/managed-skills.js";
 import { registerImport, resolveManagedSlug, validateExplicitSlug } from "./references.js";
 import { Skill } from "./skill.js";
+import { teamMembershipRows, TeamMemberships } from "./team-membership.js";
 const HARNESS_FAMILIES = ["claude", "codex", "pi", "script", "custom"];
 const SYNC_MODES = Object.values(CreateAgentRequestSyncModeEnum);
 /** The platform serves each managed skill under `skill_<key>`, and `<key>` is that skill's frontmatter `name`. */
@@ -121,6 +122,7 @@ export class Agent extends Construct {
             ...(props.labels !== undefined ? { labels: { ...props.labels } } : {}),
             ...(props.modelSettings !== undefined ? { modelSettings: { ...props.modelSettings } } : {}),
             ...(props.standbyCapacity !== undefined ? { standbyCapacity: structuredClone(props.standbyCapacity) } : {}),
+            ...(props.memberships !== undefined ? { memberships: [...props.memberships] } : {}),
         };
         validateStandbyCapacity(`agent '${this.node.path.join("/")}'`, this.props.standbyCapacity);
         this.managedSkillIds = this.receivesManagedSkills() ? managedIdsWithoutAuthoredNames(this.props.skills ?? []) : [];
@@ -131,6 +133,10 @@ export class Agent extends Construct {
         this.explicitSlug = props.slug;
         this.displayName = props.name ?? id;
         this.agentId = refToken("agent", this.node.path);
+        if (props.memberships !== undefined) {
+            const rows = teamMembershipRows(`agent '${this.node.path.join("/")}'`, props.memberships);
+            new TeamMemberships(this, "memberships", () => this.slug, { agentId: this.agentId }, rows);
+        }
     }
     get slug() {
         return resolveManagedSlug(this, this.explicitSlug, "agent");
@@ -171,6 +177,7 @@ export class Agent extends Construct {
             standbyCapacity: this.props.standbyCapacity !== undefined ? structuredClone(this.props.standbyCapacity) : null,
             // Sent only when declared: an agent that never names a mode keeps whatever the platform holds for it.
             ...(this.props.syncMode !== undefined ? { syncMode: this.props.syncMode } : {}),
+            ...(this.props.team !== undefined ? { teamId: this.props.team.teamId } : {}),
         };
         return { kind: "agent", path: this.node.path.join("/"), slug, managed: true, payload };
     }

package/dist/constructs/compute-provider.js

@@ -1,6 +1,6 @@
 // A self-hosted compute provider: the record a customer's Launcher signs in for, which runs the machines of
 // every environment that names it (`Environment`'s `computeProvider`). The record is organization-wide, so its
-// create carries no project. Its create answers the record's key once; apply prints that key on a terminal and
+// create carries no team. Its create answers the record's key once; apply prints that key on a terminal and
 // keeps it nowhere (`engine/compute-provider-reconcile.ts`). A key is never declared here: minting, rotating
 // and revoking one is the console's or the generated CLI's job.
 import { Construct } from "../core/construct.js";
@@ -48,7 +48,7 @@ export class ComputeProvider extends Construct {
         const slug = this.slug;
         // The azure block is ALWAYS emitted whole: a patch replaces it whole, so a list removed from the
         // declaration must arrive as an empty one to clear the record's, not as an absent block read as unchanged.
-        // No `projectId` ever: the record is organization-wide, and `Factory.synth()` stamps none on this kind.
+        // No `teamId` ever: the record is organization-wide.
         const payload = {
             slug,
             name: this.displayName,

package/dist/constructs/connection.d.ts

@@ -3,7 +3,7 @@ import type { PlanResource } from "../core/plan.js";
 import { type ProviderHandle } from "./provider-types.js";
 import { type EgressRuleBundle } from "./egress-preset.js";
 import type { IConnector } from "./connector.js";
-import type { IResource, ISecret } from "./interfaces.js";
+import type { IResource, ISecret, ITeam } from "./interfaces.js";
 import type { AutoRespondOf, InstallOf } from "../generated/providers.js";
 import { type FilterInput } from "./workflow-filter.js";
 export type AuthMode = "GITHUB_APP" | "OAUTH" | "CUSTOMER_MANAGED_TOKEN" | "WEBHOOK_SECRET" | "FORGE_APP";
@@ -64,23 +64,18 @@ export interface IConnection extends IResource {
     readonly connectionSlug?: string;
     readonly installValues?: Record<string, string>;
     /**
-     * The rule bundle an environment folds on with `EgressPolicy.applyPreset(...)`, carrying every rule that
-     * needs this connection's credential. A grant that needs narrower hosts, narrower paths, its own name or its
-     * own priority stays on `EgressPolicy.allow(connection, …)`; the bundle supersedes a plain
-     * `allow(connection)` because applying both collides on the rule name and is a synth error.
-     *
-     * Two same-provider bundles in one environment share provider hosts by design, and priority is deliberately
-     * NOT the remedy: attribution arbitrates only WITHIN the winning priority tier, so unequal priorities would
-     * hand every request — including one attributed to the other connection — the higher-priority connection's
-     * credential. Keep the bundles at their equal default and opt the dispatching triggers into
-     * `attributeConnection`, or put the connections in separate environments.
+     * The network rules an environment folds on with `EgressPolicy.applyPreset(...)`: the provider's API hosts
+     * and the git paths its catalog declares. The rules carry no credential; the connection itself is presented
+     * on the catalog hosts its own `hosts` cover. A grant that needs its own paths, name or priority stays on
+     * `EgressPolicy.allow(connection, …)`; the bundle supersedes a plain `allow(connection)` because applying
+     * both collides on the rule name and is a synth error.
      */
     egressPolicy(options?: ConnectionEgressPolicyOptions): EgressRuleBundle;
 }
 /**
- * How much of the provider's git transport a connection's bundle opens:
- *  - `"readWrite"` (the default) — the connection's full authority, because the credential itself is the write
- *    fence: an installation token without `contents:write` cannot push whatever the network admits;
+ * Which of the provider's git paths a connection's bundle opens — a network choice only, since the
+ * credential follows the connection's `hosts` on every path the network admits:
+ *  - `"readWrite"` (the default) — clone, fetch and push;
  *  - `"read"` — a push then fails at its *second* request: the `info/refs` discovery GET is a read and
  *    succeeds, then the push POST meets the policy's default deny as a structured 403;
  *  - `"none"` — narrows only THIS bundle: an environment that also applies the anonymous
@@ -101,8 +96,8 @@ export declare function connectionLabel(connection: IConnection): string;
 /**
  * The ONE implementation behind all four connection forms (the managed construct and the three imports), so an
  * imported reference expands to exactly what the construct does. Everything it emits is read off the provider
- * catalog — hosts, the credentialed-host partition, the transport's path families and credential carriage —
- * so a new provider's git transport is catalog data rather than a change here.
+ * catalog — hosts and the transport's path families — so a new provider's git transport is catalog data
+ * rather than a change here.
  */
 export declare function connectionEgressBundle(connection: IConnection, options?: ConnectionEgressPolicyOptions): EgressRuleBundle;
 export interface ConnectionProps<C extends ProviderHandle = ProviderHandle> {
@@ -128,6 +123,15 @@ export interface ConnectionProps<C extends ProviderHandle = ProviderHandle> {
      * but mints no bus row. Never a trust boundary — verification remains the gate.
      */
     where?: FilterInput[];
+    /** Fixed at create; undeclared, the connection is created in Shared. */
+    team?: ITeam;
+    /**
+     * The catalog hosts this connection's credential is presented on, in egress rule host syntax: an exact host,
+     * `*.suffix`, or `*`. A request to a catalog API or git host that one of these covers gets the credential at
+     * the egress edge; an environment's rules only decide whether the request may leave. Omitted, every catalog
+     * host (`["*"]`), and apply always sends the list, so a row at `[]` converges on it; `[]` covers none.
+     */
+    hosts?: string[];
 }
 export interface ConnectionImportOptions<C extends ProviderHandle = ProviderHandle> {
     provider: C;
@@ -143,6 +147,8 @@ export declare class Connection<C extends ProviderHandle = ProviderHandle> exten
     private readonly explicitSlug;
     private readonly displayName;
     private readonly whereConditions;
+    private readonly team;
+    private readonly hosts;
     constructor(scope: Construct, id: string, props: ConnectionProps<C>);
     get slug(): string;
     get connectionSlug(): string;

package/dist/constructs/connection.js

@@ -3,7 +3,8 @@
 import { Construct } from "../core/construct.js";
 import { refToken } from "../core/tokens.js";
 import { assertAuthorableInstallFields, assertDeclaredAutoRespondFields, interpolateHost, } from "./provider-types.js";
-import { ARCHIVE_RULE_SUFFIX, AUTHORIZATION_TEMPLATE, CONNECTION_RULE_PRIORITY, CONNECTION_RULE_SUFFIXES, CREDENTIAL_FREE_RULE_SUFFIX, GIT_READ_RULE_SUFFIX, GIT_WRITE_RULE_SUFFIX, connectionCredentialedRule, } from "./egress-preset.js";
+import { ARCHIVE_RULE_SUFFIX, CONNECTION_RULE_PRIORITY, CONNECTION_RULE_SUFFIXES, GIT_READ_RULE_SUFFIX, GIT_WRITE_RULE_SUFFIX, } from "./egress-preset.js";
+import { normalizeCredentialHosts } from "./secret.js";
 import { envImportMarker, isEnvImportMarker, parseEnvImportMarker, registerImport, resolveManagedSlug, validateExplicitSlug, } from "./references.js";
 import { copyConditions, flattenConditions } from "./workflow-filter.js";
 const MANAGED_CHAT_PROVIDER_IDS = new Set(["slack", "teams"]);
@@ -52,11 +53,11 @@ export const Auth = {
 const GIT_TRANSPORT_MODES = ["readWrite", "read", "none"];
 const EVERY_PATH = ["*"];
 const EVERY_METHOD = ["*"];
+const EVERY_HOST = ["*"];
 /**
  * The catalog declares an archive HOST but no path families for it, because there is no protocol conversation
  * there to describe: a clone is redirected to it and downloads a pack. So the rule is the read verbs on every
- * path, credential-free — the host serves public archives and is reached by a redirect the client did not
- * authenticate.
+ * path.
  */
 const ARCHIVE_METHODS = ["GET", "HEAD"];
 /**
@@ -78,8 +79,8 @@ export function connectionLabel(connection) {
 /**
  * The ONE implementation behind all four connection forms (the managed construct and the three imports), so an
  * imported reference expands to exactly what the construct does. Everything it emits is read off the provider
- * catalog — hosts, the credentialed-host partition, the transport's path families and credential carriage —
- * so a new provider's git transport is catalog data rather than a change here.
+ * catalog — hosts and the transport's path families — so a new provider's git transport is catalog data
+ * rather than a change here.
  */
 export function connectionEgressBundle(connection, options = {}) {
     const provider = connection.provider;
@@ -92,7 +93,7 @@ export function connectionEgressBundle(connection, options = {}) {
     const entries = [
         ...providerApiRules(connection, baseName),
         ...(provider.gitTransport !== undefined && gitMode !== "none"
-            ? gitTransportRules(connection, provider.gitTransport, baseName, gitMode)
+            ? gitTransportRules(provider.gitTransport, baseName, gitMode)
             : []),
     ];
     // An EMPTY bundle is a certain authoring mistake, not a no-op: the provider declares no api hosts and no git
@@ -126,21 +127,7 @@ function assertUnreservedLabel(label, baseName) {
         `by something that does not: the label is a managed connection's slug, an import's verbatim slug or ` +
         `id, or — for Connection.fromEnv — the env variable's NAME.`);
 }
-function connectionCredential(connection, valueTemplate) {
-    return { connectionId: connection.connectionId, valueTemplate };
-}
-/**
- * The interpolated `apiHosts`, partitioned by the catalog's declared credentialed subset; an ABSENT
- * `credentialedApiHosts` means every host may carry the credential and emits the single unsuffixed rule.
- *
- * A declared subset still puts the BASE name on one of its two halves, and that is load-bearing: every bundle
- * must claim the name a plain `EgressPolicy.allow(connection)` claims, since the duplicate-name synth error is
- * the whole mechanism behind the bundle superseding it. A bundle claiming neither half would let a retained
- * `allow(connection)` synthesize silently beside it and credential every api host at the same priority — and
- * at that tie the platform prefers the credentialed rule, so the host the partition keeps anonymous would get
- * the token pushed at it. So the base name goes to the credentialed half whenever it names any host, and
- * either half is omitted when it would name none.
- */
+/** The interpolated `apiHosts` as one rule under the base name, the name `allow(connection)` also claims. */
 function providerApiRules(connection, baseName) {
     const provider = connection.provider;
     const ctx = { providerId: provider.id, ruleName: baseName };
@@ -148,58 +135,16 @@ function providerApiRules(connection, baseName) {
     // A rule over no hosts matches no request, so a provider with no api hosts contributes no API rule at all.
     if (hosts.length === 0)
         return [];
-    const credential = connectionCredential(connection, AUTHORIZATION_TEMPLATE);
-    const declared = provider.credentialedApiHosts;
-    if (declared === undefined) {
-        return [
-            connectionCredentialedRule({
-                name: baseName,
-                hosts,
-                priority: CONNECTION_RULE_PRIORITY,
-                paths: EVERY_PATH,
-                methods: EVERY_METHOD,
-                credential,
-            }),
-        ];
-    }
-    const credentialed = new Set(declared.map((host) => interpolateHost(host, connection.installValues, ctx)));
-    // A declared credentialed host that is not one of the provider's own api hosts is a silent CATALOG defect:
-    // the intended-credentialed host would fall into the credential-free remainder and every request to it would
-    // go out anonymous. Named here rather than discovered as a 401 in a sandbox.
-    const stranger = [...credentialed].find((host) => !hosts.includes(host));
-    if (stranger !== undefined) {
-        throw new Error(`connection egress bundle '${baseName}': provider '${provider.id}' declares credentialed api host ` +
-            `'${stranger}', which is not one of its api hosts ${JSON.stringify(hosts)}. This is a provider ` +
-            `catalog defect — report it rather than working around it in the app.`);
-    }
-    const credentialedHosts = hosts.filter((host) => credentialed.has(host));
-    const remainder = hosts.filter((host) => !credentialed.has(host));
-    const credentialFreeRule = (name) => ({
-        name,
-        action: "allow",
-        hosts: remainder,
-        priority: CONNECTION_RULE_PRIORITY,
-        paths: [...EVERY_PATH],
-        methods: [...EVERY_METHOD],
-    });
-    // The declared subset names no host at all: there is no credentialed half, so the credential-free half IS
-    // the bundle's api rule and takes the base name over every host (`hosts` was checked non-empty above).
-    if (credentialedHosts.length === 0)
-        return [credentialFreeRule(baseName)];
-    const rules = [
-        connectionCredentialedRule({
+    return [
+        {
             name: baseName,
-            hosts: credentialedHosts,
+            action: "allow",
+            hosts,
             priority: CONNECTION_RULE_PRIORITY,
-            paths: EVERY_PATH,
-            methods: EVERY_METHOD,
-            credential,
-        }),
+            paths: [...EVERY_PATH],
+            methods: [...EVERY_METHOD],
+        },
     ];
-    // Omitted when the declared subset is every host: an empty-host rule would allow nothing.
-    if (remainder.length > 0)
-        rules.push(credentialFreeRule(`${baseName}${CREDENTIAL_FREE_RULE_SUFFIX}`));
-    return rules;
 }
 /**
  * Each path family becomes ONE rule carrying that family's methods and paths, because the platform matches a
@@ -208,16 +153,15 @@ function providerApiRules(connection, baseName) {
  * under `{ git: "read" }` no rule names the push path at all, so the default deny refuses it structurally
  * rather than by a fence someone has to remember to write.
  */
-function gitTransportRules(connection, transport, baseName, mode) {
-    const credential = connectionCredential(connection, gitCarriageTemplate(connection, transport, baseName));
+function gitTransportRules(transport, baseName, mode) {
     const rules = [];
     // The suffixes come from the shared reserved vocabulary rather than being spelled here, so the set a label
     // is checked against and the set this function emits cannot drift apart.
-    const read = pathFamilyRule(`${baseName}${GIT_READ_RULE_SUFFIX}`, transport.host, transport.readPaths, credential);
+    const read = pathFamilyRule(`${baseName}${GIT_READ_RULE_SUFFIX}`, transport.host, transport.readPaths);
     if (read !== undefined)
         rules.push(read);
     if (mode === "readWrite") {
-        const write = pathFamilyRule(`${baseName}${GIT_WRITE_RULE_SUFFIX}`, transport.host, transport.writePaths, credential);
+        const write = pathFamilyRule(`${baseName}${GIT_WRITE_RULE_SUFFIX}`, transport.host, transport.writePaths);
         if (write !== undefined)
             rules.push(write);
     }
@@ -237,31 +181,17 @@ function gitTransportRules(connection, transport, baseName, mode) {
  * The family's distinct methods and paths, in catalog declaration order. `undefined` when the family is empty,
  * so a catalog declaring no write paths yields no write rule rather than a rule matching nothing.
  */
-function pathFamilyRule(name, host, family, credential) {
+function pathFamilyRule(name, host, family) {
     if (family.length === 0)
         return undefined;
-    return connectionCredentialedRule({
+    return {
         name,
+        action: "allow",
         hosts: [host],
         priority: CONNECTION_RULE_PRIORITY,
         paths: [...new Set(family.map((entry) => entry.path))],
         methods: [...new Set(family.map((entry) => entry.method))],
-        credential,
-    });
-}
-/**
- * `${authorization.<carriage>}` is the platform's placeholder for this connection's credential shaped for that
- * carriage. The name comes from the catalog and the rendering is the broker's; orchestra composes the address and
- * nothing else.
- */
-function gitCarriageTemplate(connection, transport, baseName) {
-    const carriage = transport.carriage;
-    if (typeof carriage !== "string" || carriage.trim() === "") {
-        throw new Error(`connection egress bundle '${baseName}': provider '${connection.provider.id}' declares a git transport ` +
-            `with no credential carriage, so its transport rules cannot say how the credential is presented. ` +
-            `This is a provider catalog defect — report it rather than working around it in the app.`);
-    }
-    return `\${authorization.${carriage}}`;
+    };
 }
 /**
  * Refuses the two shapes that are certainly a mistake rather than a preference: an option this surface does
@@ -303,6 +233,8 @@ export class Connection extends Construct {
     explicitSlug;
     displayName;
     whereConditions;
+    team;
+    hosts;
     constructor(scope, id, props) {
         super(scope, id);
         validateExplicitSlug(this, props.slug, "connection");
@@ -329,6 +261,8 @@ export class Connection extends Construct {
         this.explicitSlug = props.slug;
         this.displayName = props.name ?? id;
         this.whereConditions = props.where !== undefined ? flattenConditions(props.where) : [];
+        this.team = props.team;
+        this.hosts = props.hosts !== undefined ? normalizeCredentialHosts(props.hosts, label) : [...EVERY_HOST];
         this.connectionId = refToken("connection", this.node.path);
     }
     get slug() {
@@ -362,7 +296,10 @@ export class Connection extends Construct {
             slug,
             auth,
             install: { provider: structuredClone(this.installValues ?? {}) },
+            hosts: [...this.hosts],
         };
+        if (this.team !== undefined)
+            payload.teamId = this.team.teamId;
         // Emitted only when declared, so a filter-less connection's canonical bytes are unchanged.
         if (this.whereConditions.length > 0)
             payload.where = copyConditions(this.whereConditions);

package/dist/constructs/connector.d.ts

@@ -1,7 +1,7 @@
 import { Construct } from "../core/construct.js";
 import type { PlanResource } from "../core/plan.js";
 import type { ProviderHandle } from "./provider-types.js";
-import type { IResource, ISecret } from "./interfaces.js";
+import type { IResource, ISecret, ITeam } from "./interfaces.js";
 export interface IConnector extends IResource {
     /** Accepts a platform id or a slug interchangeably — one rule, stated on `IResource`. */
     readonly connectorId: string;
@@ -32,6 +32,8 @@ export interface ConnectorProps<C extends ProviderHandle = ProviderHandle> {
     botSecret?: ISecret;
     webhookSecret?: ISecret;
     privateKey?: ISecret;
+    /** Fixed at create; undeclared, the connector is created in Shared. */
+    team?: ITeam;
 }
 /**
  * `[construct prop, wire field]` pairs — the ONE list the construct serializes through and the apply/diff

package/dist/constructs/connector.js

@@ -124,6 +124,8 @@ export class Connector extends Construct {
             if (secret !== undefined)
                 payload[wire] = secret.secretId;
         }
+        if (this.props.team !== undefined)
+            payload.teamId = this.props.team.teamId;
         return { kind: "connector", path: this.node.path.join("/"), slug, managed: true, payload };
     }
     static fromSlug(scope, slug) {

package/dist/constructs/egress-preset.d.ts

@@ -1,11 +1,7 @@
 /**
- * The anonymous, credential-free allow rule shape, and deliberately nothing more. There is **no credential
- * field of any kind** on this type — an author cannot hand-construct a bundle entry that binds a credential to
- * hosts of their choosing, which keeps that split a property of the type system rather than a convention.
- *
- * The fields are the platform's own `EgressPolicyRule` fields, so `applyPreset` folds an entry onto the
- * builder verbatim rather than translating it: `paths` are globs matched query-blind, and a higher `priority`
- * is evaluated first.
+ * The allow rule shape a bundle entry has. The fields are the platform's own `EgressPolicyRule` fields, so
+ * `applyPreset` folds an entry onto the builder verbatim rather than translating it: `paths` are globs matched
+ * query-blind, and a higher `priority` is evaluated first.
  */
 export type PresetRule = {
     name: string;
@@ -22,23 +18,11 @@ export type PresetRule = {
  */
 export type EgressRuleBundle = ReadonlyArray<PresetRule>;
 /**
- * @internal — strictly above the preset's 100, so a connection's credentialed rule always wins a host an
- * anonymous preset row also opens, and equal to itself, so two connections' bundles tie deliberately
- * (attribution, not priority, arbitrates between them).
- *
- * It lives in this module, which imports nothing at runtime, because both `environment.ts` and `connection.ts`
- * read it and neither may import the other.
+ * @internal — strictly above the preset's 100, so a connection's rule wins a host an anonymous preset row
+ * also opens. It lives in this module, which imports nothing at runtime, because both `environment.ts` and
+ * `connection.ts` read it.
  */
 export declare const CONNECTION_RULE_PRIORITY = 300;
-/**
- * @internal — the two reserved suffixes of the credentialed/credential-free host split. The author-declared
- * split (`allow(connection, { credentialHosts })`) emits BOTH, because its base name is the author's own
- * `name:` and neither partition may quietly take it. The catalog-declared one (`connection.egressPolicy()`)
- * emits only `-credential-free`, because there the base name is derived and the bundle must claim it — that
- * ownership is the fence keeping a retained `allow(connection)` from coexisting with a bundle.
- */
-export declare const CREDENTIAL_RULE_SUFFIX = "-credential";
-export declare const CREDENTIAL_FREE_RULE_SUFFIX = "-credential-free";
 /**
  * @internal — declared here rather than inline at their one mint site because the whole set is a single
  * reserved vocabulary (see {@link CONNECTION_RULE_SUFFIXES}): a tail spelled in one file and reserved in
@@ -57,38 +41,9 @@ export declare const ARCHIVE_RULE_SUFFIX = "-archive";
  * second, and it reports a duplicate rule when the thing that can actually be changed is the connection's
  * slug. With it the derived names are collision-free by construction, because a collision between distinct
  * labels would require one suffix here to be a proper suffix of another, and none is (pinned by a test, so a
- * sixth tail cannot quietly break the argument).
+ * fourth tail cannot quietly break the argument).
  */
 export declare const CONNECTION_RULE_SUFFIXES: readonly string[];
-/**
- * @internal — the platform's placeholder for the connection's fully-shaped `Authorization` value: at hydration
- * the broker derives the scheme from the connection's auth mode and the provider catalog's carriage
- * declaration, rather than from a scheme this SDK hardcoded.
- */
-export declare const AUTHORIZATION_TEMPLATE = "${authorization}";
-/**
- * @internal — `valueTemplate` is a NAME of a rendering the platform performs, never a credential value:
- * `${authorization.gitBasic}` is the git smart-HTTP shape (HTTP Basic with the minted installation token, the
- * only carriage GitHub's git transport accepts). Which one an entry gets is read off the provider catalog, so
- * no carriage knob ever reaches an author.
- */
-export interface ConnectionRuleCredential {
-    readonly connectionId: string;
-    readonly valueTemplate: string;
-}
-/** @internal */
-export interface ConnectionRuleFields {
-    readonly name: string;
-    readonly hosts: readonly string[];
-    readonly priority: number;
-    readonly paths: readonly string[];
-    readonly methods: readonly string[];
-    readonly credential: ConnectionRuleCredential;
-}
-/** @internal — the single call site is `connection.egressPolicy()`, which composes every field from catalog data. */
-export declare function connectionCredentialedRule(fields: ConnectionRuleFields): PresetRule;
-/** @internal */
-export declare function connectionCredentialOf(entry: PresetRule): ConnectionRuleCredential | undefined;
 /**
  * Each entry is a **function**, not a constant, for two reasons: it returns a fresh bundle per call (nothing
  * shared, nothing mutable in common), and future configuration — optional extra domains, tenant-scoping the