@orchestraworks/cli 0.5.5 → 0.5.8

package/dist/constructs/team.d.ts

@@ -0,0 +1,40 @@
+import { Construct } from "../core/construct.js";
+import type { PlanResource } from "../core/plan.js";
+import type { ITeam } from "./interfaces.js";
+/** The built-in team every organization has from creation. */
+export declare const SHARED_TEAM_SLUG = "shared";
+/** How a team hands an item assigned to it to one of its members. */
+export type TeamAssignment = "AGENT_FIRST" | "ROUND_ROBIN" | "BALANCED_WORKLOAD" | "QUEUE";
+export interface TeamProps {
+    slug?: string;
+    name?: string;
+    labels?: Record<string, string>;
+    /** Fixed at create. A sub-team sits under a team that is neither Shared, private, nor a sub-team itself. */
+    parent?: ITeam;
+    /** All-teams roles skip a private team unless they may enter it. */
+    private?: boolean;
+    /** Undeclared, the platform's default, `AGENT_FIRST`. */
+    assignment?: TeamAssignment;
+}
+export declare class Team extends Construct implements ITeam {
+    /** Accepts a platform id or a slug interchangeably — one rule, stated on `IResource`. */
+    readonly teamId: string;
+    private readonly explicitSlug;
+    private readonly displayName;
+    private readonly labels;
+    private readonly parent;
+    private readonly isPrivate;
+    private readonly assignment;
+    constructor(scope: Construct, id: string, props?: TeamProps);
+    /** @internal */
+    _resourceId(): string;
+    get slug(): string;
+    /** @internal */
+    _isSubTeam(): boolean;
+    /** @internal */
+    _isPrivate(): boolean;
+    _toPlanResource(): PlanResource;
+    /** `Team.fromSlug(scope, "shared")` names Shared. */
+    static fromSlug(scope: Construct, slug: string): ITeam;
+    static fromId(scope: Construct, id: string): ITeam;
+}

package/dist/constructs/team.js

@@ -0,0 +1,107 @@
+// A team is a prop on every team-able row, never a scope, so placing a row in a team changes neither its
+// construct path nor its slug. A row that names no team is created in Shared, and its plan resource
+// carries no `teamId` at all.
+import { Construct } from "../core/construct.js";
+import { validateDeclaredLabels } from "../core/labels.js";
+import { validateSlugOrKey } from "../core/naming.js";
+import { refToken } from "../core/tokens.js";
+import { registerImport, resolveManagedSlug, validateExplicitSlug } from "./references.js";
+/** The built-in team every organization has from creation. */
+export const SHARED_TEAM_SLUG = "shared";
+const TEAM_ASSIGNMENTS = ["AGENT_FIRST", "ROUND_ROBIN", "BALANCED_WORKLOAD", "QUEUE"];
+/** The complement of the slug grammar, which never carries `_`; the platform itself never parses an id. */
+const ENTITY_ID_PATTERN = /^[a-z][a-z0-9]*_[^_]+$/;
+export class Team extends Construct {
+    /** Accepts a platform id or a slug interchangeably — one rule, stated on `IResource`. */
+    teamId;
+    explicitSlug;
+    displayName;
+    labels;
+    parent;
+    isPrivate;
+    assignment;
+    constructor(scope, id, props = {}) {
+        super(scope, id);
+        const label = `team '${this.node.path.join("/")}'`;
+        validateDeclaredLabels(props.labels, `${label} labels`);
+        validateExplicitSlug(this, props.slug, "team");
+        if (props.assignment !== undefined && !TEAM_ASSIGNMENTS.includes(props.assignment)) {
+            throw new Error(`${label}: unknown assignment '${String(props.assignment)}'. Use one of ${JSON.stringify(TEAM_ASSIGNMENTS)}.`);
+        }
+        validateParent(label, props);
+        this.explicitSlug = props.slug;
+        this.displayName = props.name ?? id;
+        this.labels = props.labels !== undefined ? { ...props.labels } : undefined;
+        this.parent = props.parent;
+        this.isPrivate = props.private ?? false;
+        this.assignment = props.assignment ?? "AGENT_FIRST";
+        this.teamId = refToken("team", this.node.path);
+    }
+    /** @internal */
+    _resourceId() {
+        return this.teamId;
+    }
+    get slug() {
+        return resolveManagedSlug(this, this.explicitSlug, "team");
+    }
+    /** @internal */
+    _isSubTeam() {
+        return this.parent !== undefined;
+    }
+    /** @internal */
+    _isPrivate() {
+        return this.isPrivate;
+    }
+    _toPlanResource() {
+        const slug = this.slug;
+        // `description` is console-owned and never emitted; `labels` only when declared, as on every kind.
+        // `private` and `assignment` are always emitted, so code stays the source of a team's privacy.
+        const payload = {
+            name: this.displayName,
+            slug,
+            ...(this.labels !== undefined ? { labels: { ...this.labels } } : {}),
+            ...(this.parent !== undefined ? { parentTeamId: this.parent.teamId } : {}),
+            private: this.isPrivate,
+            assignment: this.assignment,
+        };
+        return { kind: "team", path: this.node.path.join("/"), slug, managed: true, payload };
+    }
+    /** `Team.fromSlug(scope, "shared")` names Shared. */
+    static fromSlug(scope, slug) {
+        validateSlugOrKey(slug, "Team.fromSlug slug", "To reference a team by its platform id instead, use Team.fromId.");
+        registerImport(scope, { kind: "team", ref: slug }, slug);
+        return { teamId: slug, _resourceId: () => slug };
+    }
+    static fromId(scope, id) {
+        if (!ENTITY_ID_PATTERN.test(id)) {
+            throw new Error(`Invalid team id ${JSON.stringify(id)} for Team.fromId: a platform id is a lowercase prefix word, ` +
+                `exactly one '_', then a '_'-free suffix (e.g. 'proj_01jq7v…'). To reference a team by its slug ` +
+                `instead, use Team.fromSlug.`);
+        }
+        registerImport(scope, { kind: "team", ref: id }, id);
+        return { teamId: id, _resourceId: () => id };
+    }
+}
+/**
+ * The platform refuses each of these at create too; the program can see them for its own teams, so they fail
+ * at the call site. An imported parent's privacy and depth are the platform's to judge.
+ */
+function validateParent(label, props) {
+    const parent = props.parent;
+    if (parent === undefined)
+        return;
+    if (parent.teamId === SHARED_TEAM_SLUG) {
+        throw new Error(`${label}: Shared has no sub-teams. Name another team as the parent, or declare no parent.`);
+    }
+    if (props.private === true) {
+        throw new Error(`${label}: a sub-team cannot be private. Make the team a top-level team to make it private.`);
+    }
+    if (parent instanceof Team) {
+        if (parent._isSubTeam()) {
+            throw new Error(`${label}: its parent is itself a sub-team, and teams nest one level deep. Name a top-level team as the parent.`);
+        }
+        if (parent._isPrivate()) {
+            throw new Error(`${label}: its parent is private, and a private team has no sub-teams.`);
+        }
+    }
+}

package/dist/constructs/trigger.d.ts

@@ -3,7 +3,7 @@ import type { Binding, ProviderEventHandle } from "./provider-types.js";
 import { type PromptEventScope, type TypedPrompt } from "./prompt-template.js";
 import type { SeedPromptRootName } from "../generated/contextShapes.js";
 import type { IConnection } from "./connection.js";
-import type { IAgent } from "./interfaces.js";
+import type { IAgent, ITeam } from "./interfaces.js";
 import type { IPipeline } from "./pipeline.js";
 import { type EventScope, type FilterNode, type FilterInput } from "./workflow-filter.js";
 /**
@@ -58,6 +58,7 @@ export interface TriggerDocument {
     target: TriggerTarget;
     status?: "active" | "paused";
     expiresAt?: string;
+    teamId?: string;
 }
 /** A generated event handle, or a raw `<provider>::<token>` wire string. */
 export type EventSelector<W extends string = string> = ProviderEventHandle<W> | W;
@@ -105,9 +106,8 @@ export interface AgentTargetProps<W extends string = string, WPrompt extends str
     requireEverParticipated?: boolean;
     /**
      * Stamp the minted session's server-owned `connectionId` from the routed event's attributed connection.
-     * Deliberately opt-in: a non-attributed session leaves the field null, so its egress rule selection is
-     * byte-identical to before. A conversation lane sets it so the agent's replies resolve against the right
-     * installation. Default false.
+     * Opt-in: a non-attributed session leaves the field null. It chooses no credential; a request names its
+     * own. Default false.
      */
     attributeConnection?: boolean;
 }
@@ -164,6 +164,8 @@ export interface TriggerProps<E extends readonly EventSelector[] = readonly Even
     target: AuthoredTarget<WiresOf<E>, WiresOf<E>>;
     status?: "active" | "paused";
     expiresAt?: string;
+    /** Fixed at create; undeclared, the trigger is created in Shared. */
+    team?: ITeam;
 }
 /** A durable routing entry `{ on → target }`, M:N, with its own lifecycle. */
 export declare class Trigger<const E extends readonly EventSelector[] = readonly EventSelector[]> extends Construct {
@@ -173,6 +175,7 @@ export declare class Trigger<const E extends readonly EventSelector[] = readonly
     private readonly target;
     private readonly status;
     private readonly expiresAt;
+    private readonly team;
     private readonly notes;
     constructor(scope: Construct, id: string, props: TriggerProps<E>);
     get slug(): string;

package/dist/constructs/trigger.js

@@ -99,6 +99,7 @@ export class Trigger extends Construct {
     target;
     status;
     expiresAt;
+    team;
     notes = [];
     constructor(scope, id, props) {
         super(scope, id);
@@ -140,6 +141,7 @@ export class Trigger extends Construct {
         this.target = { _fields: { ...props.target._fields }, _bindingDeclared: props.target._bindingDeclared };
         this.status = props.status;
         this.expiresAt = props.expiresAt;
+        this.team = props.team;
     }
     get slug() {
         return resolveManagedSlug(this, this.explicitSlug, "trigger");
@@ -172,6 +174,8 @@ export class Trigger extends Construct {
             doc.status = this.status;
         if (this.expiresAt !== undefined)
             doc.expiresAt = this.expiresAt;
+        if (this.team !== undefined)
+            doc.teamId = this.team.teamId;
         return doc;
     }
     /** A raw wire string carries no catalog knowledge, so it never contributes a canonical binding. */

package/dist/constructs/workflow.d.ts

@@ -8,7 +8,7 @@ export interface WorkflowProps {
     /** Defaults to the construct id. A rename appends no version. */
     name?: string;
     labels?: Record<string, string>;
-    /** The pipeline whose items the rules act on. The platform fixes it at create, and the workflow takes its project. */
+    /** The pipeline whose items the rules act on. The platform fixes it at create, and the workflow takes its team. */
     pipeline: IPipeline;
     /** What the rules do and why, at most 2,000 characters; it is versioned with them. */
     description?: string;

package/dist/core/factory.d.ts

@@ -1,17 +1,10 @@
-import type { IProject } from "../constructs/interfaces.js";
 import { Construct } from "./construct.js";
 import { type SynthResult } from "./plan.js";
 export declare class Factory extends Construct {
-    #private;
     readonly name: string;
     constructor(props: {
         name: string;
-        project?: IProject;
     });
-    /** Undefined for a commons factory. */
-    get project(): IProject | undefined;
-    /** @internal — called by a managed `Project`'s constructor, or by this one for the import form. */
-    _registerProject(project: IProject): void;
     /**
      * Idempotent and side-effect-free over the tree: repeated calls produce byte-identical output, which holds
      * only because nothing anywhere below reads a clock or a random source.

package/dist/core/factory.js

@@ -10,7 +10,7 @@ import { validateSlugOrKey } from "./naming.js";
 import { outboundWarnings } from "./outbound-warning.js";
 import { PLAN_KINDS, stableStringify, } from "./plan.js";
 import { validateSynthTemplates } from "./templateValidation.js";
-import { isRefToken, scanRefTokens } from "./tokens.js";
+import { scanRefTokens } from "./tokens.js";
 let currentFactory;
 let beforeExitRegistered = false;
 const synthesizedFactories = new WeakSet();
@@ -28,8 +28,6 @@ function registerBeforeExit() {
 }
 export class Factory extends Construct {
     name;
-    /** A managed {@link Project} self-registers here; the `project` prop is only ever the import form. */
-    #project;
     constructor(props) {
         // Before super() so a bad name reports as a "factory name" error rather than a bare construct-id one.
         // Legal because the validation touches no `this` and this class declares no field initializers.
@@ -42,21 +40,6 @@ export class Factory extends Construct {
         this.name = props.name;
         currentFactory = this;
         registerBeforeExit();
-        if (props.project !== undefined) {
-            this._registerProject(props.project);
-        }
-    }
-    /** Undefined for a commons factory. */
-    get project() {
-        return this.#project;
-    }
-    /** @internal — called by a managed `Project`'s constructor, or by this one for the import form. */
-    _registerProject(project) {
-        if (this.#project !== undefined) {
-            throw new Error("a Factory declares at most one project; remove the extra Project " +
-                "declaration (a managed `new Project(factory, ...)` and a `Project.fromSlug(...)` prop cannot coexist).");
-        }
-        this.#project = project;
     }
     /**
      * Idempotent and side-effect-free over the tree: repeated calls produce byte-identical output, which holds
@@ -68,14 +51,10 @@ export class Factory extends Construct {
         const imports = [];
         const warnings = [];
         const triggers = [];
-        // The stamp lands on every plan resource, but ONLY when a project is declared — a deliberate exception to
-        // always-emit, so a commons factory's bytes are unchanged.
-        const projectId = this.#project?.projectId;
         for (const construct of constructs) {
             const resource = construct._toPlanResource();
-            if (resource !== undefined) {
-                resources.push(projectId !== undefined ? stampResourceProject(resource, projectId) : resource);
-            }
+            if (resource !== undefined)
+                resources.push(resource);
             const imported = construct._toImport();
             if (imported !== undefined)
                 imports.push(imported);
@@ -84,11 +63,6 @@ export class Factory extends Construct {
             if (rows !== undefined)
                 triggers.push(...rows);
         }
-        // A project importer has no scope to register under — it is evaluated before the Factory exists — so the
-        // Factory contributes its plan import here instead of through the walk.
-        if (this.#project !== undefined && !isRefToken(this.#project.projectId)) {
-            imports.push({ kind: "project", ref: this.#project.projectId });
-        }
         // Trigger slugs share the org trigger namespace, so the platform would 409 the second create.
         triggers.sort((a, b) => (a.slug < b.slug ? -1 : a.slug > b.slug ? 1 : 0));
         const seenTriggerSlugs = new Set();
@@ -110,6 +84,17 @@ export class Factory extends Construct {
             }
             seenWorkflowSlugs.add(resource.slug);
         }
+        // A custom role's name is its key in the organization, so the platform would 409 the second create.
+        const seenRoleNames = new Set();
+        for (const resource of resources) {
+            if (resource.kind !== "role")
+                continue;
+            if (seenRoleNames.has(resource.slug)) {
+                throw new Error(`two roles are named ${JSON.stringify(resource.slug)} in factory ${JSON.stringify(this.name)}; ` +
+                    `a custom role's name is unique in the organization.`);
+            }
+            seenRoleNames.add(resource.slug);
+        }
         // A managed slug that also appears as an import ref is ambiguous — no silent dedup.
         const managedSlugs = new Set(resources.map((resource) => resource.slug));
         for (const imported of imports) {
@@ -127,7 +112,7 @@ export class Factory extends Construct {
         assertEventSelectionValues(resources);
         // The advisory passes append after the tree-walk `_synthWarnings` entries, each block internally sorted,
         // so `warnings.json` stays byte-stable across re-synth.
-        warnings.push(...outboundWarnings(resources, triggers));
+        warnings.push(...outboundWarnings(resources, triggers, imports));
         warnings.push(...eventSelectionWarnings(resources, triggers));
         // The synth-time reference gate. A broken reference is caught on the author's machine instead of at the
         // platform's save-time 400, which stays authoritative; anything that cannot be said with certainty
@@ -171,29 +156,6 @@ export class Factory extends Construct {
         runAutoSynth();
     }
 }
-/**
- * A project is not stamped into itself, a model-provider-key row and a compute provider are organization-wide
- * with no project axis at all,
- * and a workflow takes its pipeline's project, so none of their bodies has a `projectId` field to fence. Every
- * other kind has a real `projectId` column and keeps the stamp.
- */
-const PROJECT_UNSTAMPED_KINDS = new Set([
-    "project",
-    "model-provider-key",
-    "compute-provider",
-    "workflow",
-]);
-/** Returns a fresh resource and payload, so the source construct's payload is never mutated. */
-function stampResourceProject(resource, projectId) {
-    if (PROJECT_UNSTAMPED_KINDS.has(resource.kind))
-        return resource;
-    return {
-        ...resource,
-        // Explicit key:value, never shorthand: the payload is an untyped `Record<string, unknown>`, so a
-        // shorthand `{ projectId }` would silently rename this WIRE key along with the parameter.
-        payload: { ...resource.payload, projectId: projectId },
-    };
-}
 /**
  * Read off the plan resource rather than the construct, so what is checked is exactly what is about to be
  * written: a `where` the construct holds but does not emit is not a stored reference.

package/dist/core/gateway-key-recipe.js

@@ -21,6 +21,8 @@ export function containsGatewayKeyRecipe(valueFrom) {
         return containsGatewayKeyRecipe(valueFrom.basicAuth.source);
     if ("registryCredential" in valueFrom)
         return containsGatewayKeyRecipe(valueFrom.registryCredential.source);
+    if ("fields" in valueFrom)
+        return Object.values(valueFrom.fields).some(containsGatewayKeyRecipe);
     return (containsGatewayKeyRecipe(valueFrom.ecrCredential.accessKeyIdSource) ||
         containsGatewayKeyRecipe(valueFrom.ecrCredential.secretAccessKeySource));
 }
@@ -33,6 +35,14 @@ function firstGatewayKeyRef(valueFrom) {
         return firstGatewayKeyRef(valueFrom.basicAuth.source);
     if ("registryCredential" in valueFrom)
         return firstGatewayKeyRef(valueFrom.registryCredential.source);
+    if ("fields" in valueFrom) {
+        for (const field of Object.values(valueFrom.fields)) {
+            const ref = firstGatewayKeyRef(field);
+            if (ref !== undefined)
+                return ref;
+        }
+        return undefined;
+    }
     return (firstGatewayKeyRef(valueFrom.ecrCredential.accessKeyIdSource) ??
         firstGatewayKeyRef(valueFrom.ecrCredential.secretAccessKeySource));
 }
@@ -46,8 +56,8 @@ export function gatewayKeyNestingError(compositor, valueFrom) {
     return new Error(`SecretValue.fromGatewayKey${named} cannot be used inside ${compositor}: a gateway key's one-time ` +
         `token is written by the paired-Secret write protocol, which runs only when the recipe is the ` +
         `complete top-level value of exactly one managed Secret. Declare it directly instead — ` +
-        `new Secret(scope, id, { value: SecretValue.fromGatewayKey(gatewayKey) }) — and bind that Secret ` +
-        `wherever the token is needed.`);
+        `new Secret(scope, id, { value: SecretValue.fromGatewayKey(gatewayKey) }) — and give that Secret the ` +
+        `hosts it is presented on.`);
 }
 /**
  * Every declared `GatewayKey` has exactly one direct top-level `Secret` consumer. Nested occurrences never
@@ -55,12 +65,14 @@ export function gatewayKeyNestingError(compositor, valueFrom) {
  */
 export function assertGatewayKeyPairing(resources) {
     const consumersByRef = new Map();
+    const consumerTeamByPath = new Map();
     for (const resource of resources) {
         if (resource.kind !== "secret" || resource.valueFrom === undefined)
             continue;
         const ref = gatewayKeyRefOf(resource.valueFrom);
         if (ref === undefined)
             continue;
+        consumerTeamByPath.set(resource.path, teamOf(resource));
         const consumers = consumersByRef.get(ref);
         if (consumers === undefined)
             consumersByRef.set(ref, [resource.path]);
@@ -95,5 +107,14 @@ export function assertGatewayKeyPairing(resources) {
                 `exactly ONE Secret, so several consumers make the token write ambiguous and could strand the ` +
                 `token. Declare exactly one Secret for this gateway key.`);
         }
+        // The key and its Secret are one unit, so a row of the pair in another team could never be judged or
+        // remedied on its own.
+        if (consumerTeamByPath.get(consumers[0]) !== teamOf(resource)) {
+            throw new Error(`gateway key '${resource.path}' and its Secret '${consumers[0]}' name different teams. A gateway key ` +
+                `and the Secret that holds its token are one unit, so declare both in the same team.`);
+        }
     }
 }
+function teamOf(resource) {
+    return resource.payload?.teamId;
+}

package/dist/core/host-pattern.d.ts

@@ -0,0 +1,5 @@
+/**
+ * The egress rule host syntax as the platform's matcher reads it: `*` covers every host, `*.` and a suffix
+ * covers that suffix's subdomains and the suffix itself, and anything else is one host, case-insensitively.
+ */
+export declare function hostPatternCovers(pattern: string, host: string): boolean;

package/dist/core/host-pattern.js

@@ -0,0 +1,14 @@
+/**
+ * The egress rule host syntax as the platform's matcher reads it: `*` covers every host, `*.` and a suffix
+ * covers that suffix's subdomains and the suffix itself, and anything else is one host, case-insensitively.
+ */
+export function hostPatternCovers(pattern, host) {
+    const lowerPattern = pattern.toLowerCase();
+    const lowerHost = host.toLowerCase();
+    if (lowerPattern === "*")
+        return true;
+    if (lowerPattern.startsWith("*.")) {
+        return lowerHost.endsWith(lowerPattern.slice(1)) || lowerHost === lowerPattern.slice(2);
+    }
+    return lowerPattern === lowerHost;
+}

package/dist/core/labels.d.ts

@@ -5,7 +5,7 @@
 export declare const LABEL_KEY_PREFIX = "sfdk.";
 /**
  * Stamped on every resource `apply` creates or adopts among the kinds whose API request exposes `labels`.
- * Its value is the root factory name, which is always present — even for a project-less factory — so a CLI
+ * Its value is the root factory name, which is always present — even for a factory that declares no team — so a CLI
  * write against a managed resource can name the owning factory verbatim.
  */
 export declare const MANAGED_BY_LABEL_KEY = "sfdk.managedBy";

package/dist/core/labels.js

@@ -7,7 +7,7 @@
 export const LABEL_KEY_PREFIX = "sfdk.";
 /**
  * Stamped on every resource `apply` creates or adopts among the kinds whose API request exposes `labels`.
- * Its value is the root factory name, which is always present — even for a project-less factory — so a CLI
+ * Its value is the root factory name, which is always present — even for a factory that declares no team — so a CLI
  * write against a managed resource can name the owning factory verbatim.
  */
 export const MANAGED_BY_LABEL_KEY = `${LABEL_KEY_PREFIX}managedBy`;

package/dist/core/outbound-warning.d.ts

@@ -1,3 +1,3 @@
-import type { PlanResource, TriggerDocument } from "./plan.js";
+import type { PlanImport, PlanResource, TriggerDocument } from "./plan.js";
 /** Output is sorted so `warnings.json` stays byte-stable across re-synth. */
-export declare function outboundWarnings(resources: PlanResource[], triggers: TriggerDocument[]): string[];
+export declare function outboundWarnings(resources: PlanResource[], triggers: TriggerDocument[], imports?: PlanImport[]): string[];

package/dist/core/outbound-warning.js

@@ -1,18 +1,20 @@
 // Wiring a connection to an agent is a triad — the `Connection`, the inbound `Trigger`s, and the outbound
 // `.allow(connection)` on the agent's environment egress policy — and only the third side is invisible when
 // forgotten: everything synths, applies and routes, and then the agent's CLI takes a 403 from the egress
-// fence inside its own sandbox where nothing surfaces it but decision logs. Detection is by connection-bound
-// rule only, so a hand-written rule covering the provider's hosts still warns — an accepted false positive
-// the message acknowledges — and anything a check cannot prove stays silent, per check.
+// fence inside its own sandbox where nothing surfaces it but decision logs. Detection reads the hosts: an
+// allow rule covering any of the provider's interpolated api hosts counts, whoever wrote it, and anything a
+// check cannot prove (an unknown provider, a missing install value) stays silent, per check.
 //
 // The skill half's identity rule is a VERBATIM slug comparison, never {@link connectionSlugOf}'s
 // `_`-heuristic: a connection's id ≠ its slug, but a catalog skill's id IS its slug (`skill_zendesk`), so
 // reusing the heuristic would call every correct attachment indeterminate and silence the check forever.
 import { objectArrayFieldOf, objectFieldOf, stringArrayFieldOf, stringFieldOf, } from "./plan-payload.js";
-import { PROVIDER_HANDLE_NAMES, PROVIDER_SKILL_SLUGS } from "./provider-lookup.js";
+import { interpolateHost } from "../constructs/provider-types.js";
+import { hostPatternCovers } from "./host-pattern.js";
+import { PROVIDER_HANDLES, PROVIDER_HANDLE_NAMES, PROVIDER_SKILL_SLUGS } from "./provider-lookup.js";
 import { isRefToken, parseRefToken } from "./tokens.js";
 /** Output is sorted so `warnings.json` stays byte-stable across re-synth. */
-export function outboundWarnings(resources, triggers) {
+export function outboundWarnings(resources, triggers, imports = []) {
     const byRef = new Map();
     const connectionsBySlug = new Map();
     for (const resource of resources) {
@@ -22,7 +24,7 @@ export function outboundWarnings(resources, triggers) {
     }
     const pairs = new Map();
     for (const trigger of triggers) {
-        const pair = resolvePair(trigger, byRef, connectionsBySlug);
+        const pair = resolvePair(trigger, byRef, connectionsBySlug, imports);
         // Several triggers on one pair collapse to one entry — the verdict below is identical for all of them.
         if (pair !== undefined)
             pairs.set(`${pair.connectionSlug} ${pair.agent.path}`, pair);
@@ -30,7 +32,7 @@ export function outboundWarnings(resources, triggers) {
     return [...pairs.values()].sort(comparePairs).flatMap((pair) => {
         const messages = [];
         const environment = pair.environment;
-        if (environment !== undefined && lacksOutboundRule(environment, pair.connectionSlug, byRef)) {
+        if (environment !== undefined && lacksOutboundRule(environment, pair.installed)) {
             messages.push(outboundWarningMessage(pair, environment));
         }
         const missingSkill = missingProviderSkill(pair);
@@ -45,7 +47,7 @@ export function outboundWarnings(resources, triggers) {
  * `${ref:…}` token, so it is structurally invisible. An imported environment is NOT a skip: it leaves
  * `environment` undefined, silencing the egress half alone.
  */
-function resolvePair(trigger, byRef, connectionsBySlug) {
+function resolvePair(trigger, byRef, connectionsBySlug, imports) {
     const connectionSlug = trigger.on.connection;
     const agentId = trigger.target.agent;
     if (connectionSlug === undefined || agentId === undefined)
@@ -58,33 +60,54 @@ function resolvePair(trigger, byRef, connectionsBySlug) {
     return {
         connectionLabel: connection?.path ?? connectionSlug,
         connectionSlug,
+        installed: installedProvider(connection, imports.find((imported) => imported.kind === "connection" && imported.ref === connectionSlug)),
         providerId: stringFieldOf(connection?.payload, "provider"),
         agent,
         environment: environmentId === undefined ? undefined : resolveRef(environmentId, "environment", byRef),
     };
 }
+/** A managed connection's payload, else an import's `expect` (its `provider` and flat `install.<key>`). */
+function installedProvider(connection, imported) {
+    if (connection !== undefined) {
+        const providerId = stringFieldOf(connection.payload, "provider");
+        const install = objectFieldOf(objectFieldOf(connection.payload, "install"), "provider") ?? {};
+        return providerId === undefined ? undefined : { providerId, install: install };
+    }
+    const expect = imported?.expect;
+    if (expect?.provider === undefined)
+        return undefined;
+    const install = {};
+    for (const [key, value] of Object.entries(expect)) {
+        if (key.startsWith("install."))
+            install[key.slice("install.".length)] = value;
+    }
+    return { providerId: expect.provider, install };
+}
 /**
- * A rule whose `connectionId` cannot be correlated to a slug makes the whole environment indeterminate and
- * silences the pair, rather than risking a warning that is wrong.
+ * True only when the provider's hosts are provable and no allow rule covers any of them under a deny-all
+ * default: an open default, an unknown provider or a missing install value is indeterminate and stays silent
+ * rather than risking a warning that is wrong.
  */
-function lacksOutboundRule(environment, connectionSlug, byRef) {
-    let indeterminate = false;
-    for (const rule of objectArrayFieldOf(objectFieldOf(environment.payload, "egressPolicy"), "rules")) {
-        for (const binding of objectArrayFieldOf(rule, "credentialBindings")) {
-            const boundId = stringFieldOf(binding, "connectionId");
-            // A secret binding (`bearer`/`basic`/`header`/`inject`) names no connection at all.
-            if (boundId === undefined)
-                continue;
-            const boundSlug = connectionSlugOf(boundId, byRef);
-            if (boundSlug === undefined) {
-                indeterminate = true;
-                continue;
-            }
-            if (boundSlug === connectionSlug)
-                return false;
-        }
+function lacksOutboundRule(environment, installed) {
+    const egress = objectFieldOf(environment.payload, "egressPolicy");
+    if (stringFieldOf(egress, "defaultAction") !== "deny")
+        return false;
+    const hosts = providerApiHosts(installed);
+    if (hosts === undefined || hosts.length === 0)
+        return false;
+    return !objectArrayFieldOf(egress, "rules").some((rule) => stringFieldOf(rule, "action") === "allow" &&
+        stringArrayFieldOf(rule, "hosts").some((pattern) => hosts.some((host) => hostPatternCovers(pattern, host))));
+}
+function providerApiHosts(installed) {
+    const handle = installed === undefined ? undefined : PROVIDER_HANDLES.get(installed.providerId);
+    if (handle === undefined || installed === undefined)
+        return undefined;
+    try {
+        return handle.apiHosts.map((host) => interpolateHost(host, installed.install, { providerId: handle.id, ruleName: "" }));
+    }
+    catch {
+        return undefined;
     }
-    return !indeterminate;
 }
 /**
  * Presence is a plain verbatim comparison because a catalog row's id equals its slug, so
@@ -105,17 +128,6 @@ function missingProviderSkill(pair) {
         return undefined;
     return { providerId, catalogSlug };
 }
-/**
- * `undefined` means indeterminate: an import marker resolved only at apply, an id-shaped value (ids carry
- * `_`, slugs never do, so identity is unprovable at synth), or a token naming a resource this plan lacks.
- */
-function connectionSlugOf(connectionId, byRef) {
-    if (isRefToken(connectionId))
-        return resolveRef(connectionId, "connection", byRef)?.slug;
-    if (connectionId.startsWith("${") || connectionId.includes("_"))
-        return undefined;
-    return connectionId;
-}
 function resolveRef(value, kind, byRef) {
     if (!isRefToken(value))
         return undefined;
@@ -127,9 +139,8 @@ function resolveRef(value, kind, byRef) {
 /** Carries no `warning:` prefix — the CLI's `printWarnings` prepends it. */
 function outboundWarningMessage(pair, environment) {
     return (`connection '${pair.connectionLabel}' is wired inbound to agent '${pair.agent.path}' but its ` +
-        `environment '${environment.path}' has no outbound rule for it — add ` +
-        `.allow(${pair.connectionLabel}) to its egress, or ignore this if that is deliberate ` +
-        `(listener-only, or the hosts are covered by a hand-written rule).`);
+        `environment '${environment.path}' has no allow rule covering its provider's hosts — add ` +
+        `.allow(${pair.connectionLabel}) to its egress, or ignore this if that is deliberate (listener-only).`);
 }
 /**
  * The remedy names the generated handle plus the catalog slug, because the `skills` prop takes an `ISkill`: