@orchestraworks/cli 0.5.7 → 0.6.0

package/dist/constructs/environment.js

@@ -130,10 +130,30 @@ function normalizePaths(ruleName, paths) {
     }
     return [...paths];
 }
+/**
+ * The variables {@link EgressPolicy.routeModelsViaGateway} sets to the key Secret's reference: claude sends the
+ * first as its key, and the worker writes the second into codex's own auth file.
+ */
+const GATEWAY_KEY_ENV = ["ANTHROPIC_API_KEY", "ORCHESTRA_WORKER_OPENAI_API_KEY"];
+/** The edge reads this prefix where a request's token goes, and adds the credential the rest names. */
+const REFERENCE_PREFIX = "orchestra:";
+/**
+ * A Secret or a Connection as the platform names it, `secret/<id>` or `connection/<id>`, the id a reference
+ * token or the import as written until apply resolves it. Undefined for anything else.
+ */
+function credentialReference(value) {
+    if (typeof value !== "object" || value === null)
+        return undefined;
+    if ("connectionId" in value && typeof value.connectionId === "string")
+        return `connection/${value.connectionId}`;
+    if ("secretId" in value && typeof value.secretId === "string")
+        return `secret/${value.secretId}`;
+    return undefined;
+}
 /**
  * A rule that still names a credential is an authored statement that can no longer apply, so it fails here
- * with the Secret declaration that replaces it: the rule's hosts become the Secret's `hosts`, and the binder's
- * form becomes its `injection`.
+ * with the Secret declaration that replaces it: the binder's form becomes the Secret's `injection`, and the rule's
+ * hosts its `injection.hosts`.
  */
 function refuseRuleCredential(ruleName, options, hosts) {
     const declared = options.credentials !== undefined
@@ -148,7 +168,7 @@ function refuseRuleCredential(ruleName, options, hosts) {
     const remedies = declared.map((entry) => secretRemedy(entry, hosts));
     throw new Error(`egress rule '${ruleName}': a rule carries no credential, so 'credential'/'credentials' is not accepted. ` +
         `A credential declares where and how it is presented on its own resource: ` +
-        `${remedies.length > 0 ? remedies.join("; ") : "give the Secret 'hosts' and an 'injection' recipe"}. ` +
+        `${remedies.length > 0 ? remedies.join("; ") : "give the Secret an 'injection' recipe with its 'hosts'"}. ` +
         `Then keep this rule as a network rule, with no credential.`);
 }
 /** The Secret declaration one binder stands for, with no value: a recipe and host names only. */
@@ -157,7 +177,7 @@ function secretRemedy(entry, hosts) {
         ? entry._credentialBinding()
         : undefined;
     if (binding === undefined)
-        return "give the Secret 'hosts' and an 'injection' recipe";
+        return "give the Secret an 'injection' recipe with its 'hosts'";
     const name = isRefToken(binding.secretId)
         ? `Secret '${parseRefToken(binding.secretId).path.join("/")}'`
         : `secret '${binding.secretId}'`;
@@ -166,7 +186,7 @@ function secretRemedy(entry, hosts) {
         : binding.header !== undefined
             ? JSON.stringify({ headers: [{ name: binding.header, value: binding.valueTemplate }] })
             : "its own injection recipe";
-    return `${name} takes hosts: ${JSON.stringify(hosts)} and injection: ${injection}`;
+    return `${name} takes injection: ${injection}, with hosts: ${JSON.stringify(hosts)} inside it`;
 }
 /**
  * **The builder is mutating, and every chaining method returns `this`, not a copy.** `denyAll()` or
@@ -181,6 +201,7 @@ function secretRemedy(entry, hosts) {
 export class EgressPolicy {
     defaultAction;
     rules = [];
+    gatewayKey;
     constructor(defaultAction) {
         this.defaultAction = defaultAction;
     }
@@ -300,18 +321,27 @@ export class EgressPolicy {
         }
         if (key instanceof Secret) {
             const remedy = `Declare it as new Secret(scope, id, { value: SecretValue.fromGatewayKey(gatewayKey), ` +
-                `hosts: ["${host}"], injection: { headers: [{ name: "Authorization", value: "Bearer \${secret}" }], ` +
-                `removeHeaders: ["x-api-key"] } }).`;
+                `injection: { headers: [{ name: "Authorization", value: "Bearer \${secret}" }], ` +
+                `removeHeaders: ["x-api-key"], hosts: ["${host}"] } }).`;
             if (!key._presentsHeader()) {
                 throw new Error(`routeModelsViaGateway(): key Secret '${key.node.path.join("/")}' has no 'injection' header, so the ` +
                     `gateway key is never presented. ${remedy}`);
             }
             if (!key._hosts().some((pattern) => hostPatternCovers(pattern, host))) {
                 throw new Error(`routeModelsViaGateway(): key Secret '${key.node.path.join("/")}' does not cover '${host}' in its ` +
-                    `'hosts' ${JSON.stringify(key._hosts())}, so model calls would leave with no key. ${remedy}`);
+                    `'injection.hosts' ${JSON.stringify(key._hosts())}, so model calls would leave with no key. ${remedy}`);
             }
         }
-        return this.allow(DEFAULT_MODEL_GATEWAY_RULE_NAME, { hosts: [host], priority: DEFAULT_MODEL_GATEWAY_PRIORITY });
+        this.allow(DEFAULT_MODEL_GATEWAY_RULE_NAME, { hosts: [host], priority: DEFAULT_MODEL_GATEWAY_PRIORITY });
+        this.gatewayKey = key;
+        return this;
+    }
+    /** @internal The variables this policy names a credential in, each set to its reference. */
+    _declaredEnv() {
+        if (this.gatewayKey === undefined)
+            return {};
+        const reference = REFERENCE_PREFIX + credentialReference(this.gatewayKey);
+        return Object.fromEntries(GATEWAY_KEY_ENV.map((name) => [name, reference]));
     }
     /**
      * Each entry lands as an ordinary allow rule — the same wire shape, in the same `rules` array, in the same
@@ -403,6 +433,16 @@ export class Environment extends Construct {
     constructor(scope, id, props) {
         super(scope, id);
         validateExplicitSlug(this, props.slug, "environment");
+        for (const [name, value] of Object.entries(props.env ?? {})) {
+            if (typeof value !== "string" && credentialReference(value) === undefined) {
+                throw new Error(`Environment '${id}': env '${name}' must be text, a Secret or a Connection.`);
+            }
+        }
+        props.credentials?.forEach((entry, index) => {
+            if (credentialReference(entry?.credential) === undefined) {
+                throw new Error(`Environment '${id}': credentials[${index}]: 'credential' must be a Secret or a Connection.`);
+            }
+        });
         const declaredOnStartMachine = props.hooks?.onStartMachine?.script;
         if (props.setup !== undefined && declaredOnStartMachine !== undefined && props.setup !== declaredOnStartMachine) {
             throw new Error(`Environment '${id}' declares both setup and hooks.onStartMachine with different scripts. ` +
@@ -435,6 +475,9 @@ export class Environment extends Construct {
             // Copied so a key added after the construct accepted the literal cannot ride a later synth into a
             // machine's env.
             ...(props.env !== undefined ? { env: { ...props.env } } : {}),
+            ...(props.credentials !== undefined
+                ? { credentials: props.credentials.map((entry) => ({ ...entry })) }
+                : {}),
         };
         this.explicitSlug = props.slug;
         this.displayName = props.name ?? id;
@@ -464,6 +507,19 @@ export class Environment extends Construct {
         const resources = this.props.resources ?? {};
         const cpu = resources.cpu ?? STANDARD_CPU;
         const onStartMachine = this.props.hooks?.onStartMachine ?? (this.props.setup ? { script: this.props.setup } : undefined);
+        // A FRESH object each synth: emitting the stored map by reference would let a caller mutating one returned
+        // plan's `payload.env` change every later synth.
+        const env = {};
+        for (const [name, value] of Object.entries(this.props.env ?? {})) {
+            env[name] = typeof value === "string" ? value : REFERENCE_PREFIX + credentialReference(value);
+        }
+        for (const [name, reference] of Object.entries(this.props.egress._declaredEnv())) {
+            if (env[name] !== undefined && env[name] !== reference) {
+                throw new Error(`Environment '${this.node.id}': env '${name}' is declared by routeModelsViaGateway() as the gateway ` +
+                    `key's reference, ${reference}. Drop it from env.`);
+            }
+            env[name] = reference;
+        }
         // The egress rules, `ingressPolicy.endpoints`, `volumeMounts` and `env` are ALWAYS emitted — empty when
         // unset — so clearing any of them reconciles through the platform's whole-object PATCH replace instead of
         // being masked as omitted. `env` inherits the known map residual: emptying a declared map as the SOLE
@@ -518,9 +574,7 @@ export class Environment extends Construct {
                     }),
                     ...(this.props.disks ?? []).map((disk) => ({ type: "disk", mountPath: disk.mountPath, size: disk.size })),
                 ],
-                // A FRESH object each synth: emitting the stored map by reference would let a caller mutating one
-                // returned plan's `payload.env` change every later synth.
-                env: { ...(this.props.env ?? {}) },
+                env,
                 // Always emitted — a token or an explicit null — so removing the credential reconciles to a cleared
                 // field. An omitted key would be dropped by JSON.stringify and the PATCH would read "unchanged".
                 imagePullSecretId: this.props.imagePullCredential?.secretId ?? null,
@@ -531,6 +585,16 @@ export class Environment extends Construct {
                     ? { computeProviderId: this.props.computeProvider?.computeProviderId ?? null }
                     : {}),
             },
+            // Only when declared, `[]` included: an omitted list must not clear defaults set in the console or by
+            // the platform's own seed.
+            ...(this.props.credentials !== undefined
+                ? {
+                    credentials: this.props.credentials.map((entry) => ({
+                        credential: credentialReference(entry.credential),
+                        replace: entry.replace ?? true,
+                    })),
+                }
+                : {}),
             ...(this.props.team !== undefined ? { teamId: this.props.team.teamId } : {}),
         };
         return { kind: "environment", path: this.node.path.join("/"), slug, managed: true, payload };

package/dist/constructs/secret.d.ts

@@ -3,9 +3,14 @@ import { Construct } from "../core/construct.js";
 import type { PlanResource, ValueFrom } from "../core/plan.js";
 import type { CredentialBindingData, IGatewayKey, ISecret, ITeam } from "./interfaces.js";
 /**
- * The request mutations the broker applies from this secret: `headers` are injected after credential
- * rendering, `removeHeaders` strips client-sent headers before injection. `removeHeaders` is optional here
- * and normalized to `[]` on the wire, so an inject-only recipe round-trips against the server's shape.
+ * The request mutations the broker applies from this secret, and where: `headers` are injected after credential
+ * rendering, `removeHeaders` strips client-sent headers first, and `hosts` names the hosts the recipe applies on.
+ * Both lists are optional here and `[]` on the wire, so an inject-only recipe round-trips against the server's
+ * shape. A secret with no recipe is stored only: the broker presents it on no request.
+ *
+ * For git over HTTPS, store `base64("<user>:<token>")` and present it as `Basic ${secret}`; GitHub's user is
+ * `x-access-token`. Encode it first, `printf 'x-access-token:%s' "$TOKEN" | base64 | tr -d '\n'`, or let
+ * `SecretValue.basicAuth` encode it at apply.
  */
 export interface InjectionRecipeProps {
     readonly headers: {
@@ -13,6 +18,12 @@ export interface InjectionRecipeProps {
         readonly value: string;
     }[];
     readonly removeHeaders?: string[];
+    /**
+     * The hosts this secret is presented on, in egress rule host syntax: an exact host, `*.suffix`, or `*`. A
+     * request to a covered host gets the `headers` at the egress edge; an environment's rules only decide whether
+     * the request may leave. Omitted, the recipe covers no host.
+     */
+    readonly hosts?: string[];
 }
 /**
  * Shared with the egress `inject()` binding factory so a bad recipe fails at synth identically whether it
@@ -84,12 +95,11 @@ export interface SecretProps {
     slug?: string;
     name?: string;
     description?: string;
+    /** How and where the secret is presented. Omitted, the secret is stored only. */
     injection?: InjectionRecipeProps;
     /**
-     * The hosts this secret is presented on, in egress rule host syntax: an exact host, `*.suffix`, or `*`. A
-     * request to a covered host gets the `injection` headers at the egress edge; an environment's rules only
-     * decide whether the request may leave. Omitted, the secret covers no host, and apply sends `[]`, so
-     * removing the prop clears the list.
+     * @deprecated Declare `injection.hosts` instead. Accepted for one release and moved into the recipe; refused
+     * when the recipe declares a different list.
      */
     hosts?: string[];
     /** Fixed at create; undeclared, the secret is created in Shared. */

package/dist/constructs/secret.js

@@ -77,6 +77,7 @@ export function cloneInjectionRecipe(recipe) {
     return {
         headers: (recipe.headers ?? []).map((h) => ({ name: h.name, value: h.value })),
         removeHeaders: [...recipe.removeHeaders],
+        ...(recipe.hosts !== undefined ? { hosts: [...recipe.hosts] } : {}),
     };
 }
 /**
@@ -319,16 +320,25 @@ function isIpv6Literal(host) {
 /**
  * The client-side mirror of the platform's write-time `hosts` checks, so a bad list fails at synth: each
  * entry is an exact host, `*.` and a suffix, or `*`, and a secret that covers a host needs a recipe header to
- * be presented by. The platform-origin and object-store refusals need the deployment's own addresses, so they
+ * be presented by. The deprecated top-level `hosts` is moved into the recipe, and refused when the recipe
+ * declares a different list, an empty one included. The platform-origin and object-store refusals need the deployment's own addresses, so they
  * stay the platform's `400`.
  */
-function normalizeSecretHosts(hosts, injection, label) {
-    if (hosts === undefined)
-        return [];
-    normalizeCredentialHosts(hosts, label);
+function normalizeSecretHosts(recipeHosts, deprecatedHosts, injection, label) {
+    if (recipeHosts !== undefined)
+        normalizeCredentialHosts(recipeHosts, `${label}: injection`);
+    if (deprecatedHosts !== undefined)
+        normalizeCredentialHosts(deprecatedHosts, label);
+    if (recipeHosts !== undefined &&
+        deprecatedHosts !== undefined &&
+        (recipeHosts.length !== deprecatedHosts.length || recipeHosts.some((host, index) => host !== deprecatedHosts[index]))) {
+        throw new Error(`${label}: 'hosts' and 'injection.hosts' name different hosts; declare 'injection.hosts' alone.`);
+    }
+    const hosts = recipeHosts ?? deprecatedHosts ?? [];
     if (hosts.length > 0 && (injection === undefined || (injection.headers ?? []).length === 0)) {
-        throw new Error(`${label}: a secret with 'hosts' needs an 'injection' recipe with at least one header, which is how it ` +
-            `is presented, such as injection: { headers: [{ name: "Authorization", value: "Bearer \${secret}" }] }.`);
+        throw new Error(`${label}: a secret with hosts needs an 'injection' recipe with at least one header, which is how it ` +
+            `is presented, such as injection: { headers: [{ name: "Authorization", value: "Bearer \${secret}" }], ` +
+            `hosts: ["api.example.com"] }.`);
     }
     return [...hosts];
 }
@@ -337,7 +347,6 @@ export class Secret extends Construct {
     secretId;
     #valueFrom;
     #injection;
-    #hosts;
     explicitSlug;
     displayName;
     description;
@@ -347,8 +356,9 @@ export class Secret extends Construct {
         validateExplicitSlug(this, props.slug, "secret");
         const label = `secret '${this.node.path.join("/")}'`;
         this.#valueFrom = props.value._toValueFrom();
-        this.#injection = props.injection === undefined ? undefined : normalizeInjectionRecipe(props.injection, label);
-        this.#hosts = normalizeSecretHosts(props.hosts, this.#injection, label);
+        const recipe = props.injection === undefined ? undefined : normalizeInjectionRecipe(props.injection, label);
+        const hosts = normalizeSecretHosts(props.injection?.hosts, props.hosts, recipe, label);
+        this.#injection = recipe === undefined ? undefined : { ...recipe, hosts };
         this.explicitSlug = props.slug;
         this.displayName = props.name ?? id;
         this.description = props.description ?? "";
@@ -368,7 +378,7 @@ export class Secret extends Construct {
     }
     /** @internal — a fresh copy of the declared hosts, for synth checks that read a declared secret. */
     _hosts() {
-        return [...this.#hosts];
+        return [...(this.#injection?.hosts ?? [])];
     }
     /** @internal — whether the declared recipe has a header to present this secret by. */
     _presentsHeader() {
@@ -385,16 +395,14 @@ export class Secret extends Construct {
         const slug = this.slug();
         // `description` is ALWAYS emitted, empty when unset, so it is never omit-masked; the only Secret PATCH
         // rides a value overwrite that sends name+description together, so a clear travels with that write.
-        // `hosts` is ALWAYS emitted, `[]` when undeclared, so apply sends it and a row at `[]` or with other hosts
-        // converges on the declaration.
-        // `injection` is emitted only when declared, keeping a recipe-less secret's payload byte-identical, and
-        // is DEEP-COPIED because the stored recipe is shared across synths: emitting it by reference would let a
+        // `injection` is emitted only when declared, its `hosts` always, `[]` when undeclared, so a live recipe with
+        // other hosts converges on the declaration and a dropped recipe is cleared, leaving the secret stored only.
+        // It is DEEP-COPIED because the stored recipe is shared across synths: emitting it by reference would let a
         // caller mutating one returned plan corrupt the validated recipe for every later synth.
         const payload = {
             name: this.displayName,
             slug,
             description: this.description,
-            hosts: [...this.#hosts],
             ...(this.#injection !== undefined ? { injection: cloneInjectionRecipe(this.#injection) } : {}),
             ...(this.team !== undefined ? { teamId: this.team.teamId } : {}),
         };

package/dist/core/labels.d.ts

@@ -2,18 +2,23 @@
  * Reserving the whole prefix rather than one literal key is what makes the ownership marker unforgeable and
  * leaves room for the other markers `apply` writes without a second rule.
  */
-export declare const LABEL_KEY_PREFIX = "sfdk.";
+export declare const LABEL_KEY_PREFIX = "orchestra.";
+/**
+ * The prefix `apply` wrote before the rename. A factory applied then carries its markers under it until its next
+ * apply moves them, so every marker is read under both prefixes, the new key winning, and both stay reserved.
+ */
+export declare const OLD_LABEL_KEY_PREFIX = "sfdk.";
 /**
  * Stamped on every resource `apply` creates or adopts among the kinds whose API request exposes `labels`.
  * Its value is the root factory name, which is always present — even for a factory that declares no team — so a CLI
  * write against a managed resource can name the owning factory verbatim.
  */
-export declare const MANAGED_BY_LABEL_KEY = "sfdk.managedBy";
+export declare const MANAGED_BY_LABEL_KEY = "orchestra.managedBy";
 export declare function rejectTemplateBraces(map: Record<string, string> | undefined, where: string): void;
 /**
  * A synth-time rejection rather than an apply-time overwrite on purpose: a declared key that could shadow
- * `sfdk.managedBy` would make the ownership marker forgeable and make a re-apply fight itself over the same
- * key. Refusing at the authoring boundary leaves the marker exactly one writer.
+ * the managed-by marker, under either prefix, would make the ownership marker forgeable and make a re-apply
+ * fight itself over the same key. Refusing at the authoring boundary leaves the marker exactly one writer.
  */
 export declare function rejectReservedLabelKeys(map: Record<string, string> | undefined, where: string): void;
 /** Constructs call this rather than the two halves, so a new rule lands everywhere at once. */
@@ -28,12 +33,33 @@ export declare function stampManagedBy(labels: Record<string, string> | undefine
  * an explicit `null`. This record of the keys `apply` last wrote from a declaration is how a later apply
  * tells a key the declaration dropped, which it removes, from a key someone else set, which it leaves alone.
  */
-export declare const DECLARED_LABELS_KEY = "sfdk.declaredLabels";
+export declare const DECLARED_LABELS_KEY = "orchestra.declaredLabels";
+/**
+ * Set on a gateway key's paired Secret while a mint is in flight, so a mint whose token write never landed is
+ * seen and refused by name rather than read as a usable Secret.
+ */
+export declare const PENDING_GATEWAY_KEY_TOKEN_LABEL_KEY = "orchestra.pendingGatewayKeyToken";
+/** The key a marker had under the old prefix. */
+export declare function oldMarkerKey(key: string): string;
+/** A marker's value: under its key, else under the old prefix's, else `undefined`. */
+export declare function readMarker(labels: Record<string, unknown> | null | undefined, key: string): string | undefined;
+/** A merge patch removing each marker these labels carry under the old prefix. */
+export declare function oldMarkersCleared(labels: Record<string, unknown> | null | undefined): Record<string, null>;
+/**
+ * The merge patch that moves each marker found under the old prefix, for a resource whose labels apply does not
+ * otherwise reconcile: the old key sent as `null`, and the new key given the old value unless it is already
+ * live. `undefined` when no marker is under the old prefix.
+ */
+export declare function oldMarkersMoved(labels: Record<string, unknown> | null | undefined): Record<string, string | null> | undefined;
+/** The factory whose apply stamped these labels, read under either prefix. */
+export declare function managedByOf(labels: Record<string, unknown> | null | undefined): string | undefined;
 /** A create's labels: the declaration, the record of its keys when it declares any, and the stamps. */
 export declare function createLabels(declared: Record<string, string> | undefined, stamps?: Record<string, string>): Record<string, string>;
 /**
  * The merge patch that brings the live labels to the declaration, or `undefined` when they already agree: a
  * declared value that differs, a key an earlier apply declared and this one does not (as `null`), the record
- * of declared keys, and the stamps. A live key no apply declared is neither sent nor drift.
+ * of declared keys, and the stamps. A live key no apply declared is neither sent nor drift. A marker found under
+ * the old prefix is moved: its old key is sent as `null`, and its new key carries the stamp, or the old value
+ * when nothing stamps it.
  */
 export declare function labelsPatch(declared: Record<string, string> | undefined, live: Record<string, string> | null | undefined, stamps?: Record<string, string>): Record<string, string | null> | undefined;

package/dist/core/labels.js

@@ -4,7 +4,13 @@
  * Reserving the whole prefix rather than one literal key is what makes the ownership marker unforgeable and
  * leaves room for the other markers `apply` writes without a second rule.
  */
-export const LABEL_KEY_PREFIX = "sfdk.";
+export const LABEL_KEY_PREFIX = "orchestra.";
+/**
+ * The prefix `apply` wrote before the rename. A factory applied then carries its markers under it until its next
+ * apply moves them, so every marker is read under both prefixes, the new key winning, and both stay reserved.
+ */
+export const OLD_LABEL_KEY_PREFIX = "sfdk.";
+const RESERVED_LABEL_KEY_PREFIXES = [LABEL_KEY_PREFIX, OLD_LABEL_KEY_PREFIX];
 /**
  * Stamped on every resource `apply` creates or adopts among the kinds whose API request exposes `labels`.
  * Its value is the root factory name, which is always present — even for a factory that declares no team — so a CLI
@@ -24,16 +30,17 @@ export function rejectTemplateBraces(map, where) {
 }
 /**
  * A synth-time rejection rather than an apply-time overwrite on purpose: a declared key that could shadow
- * `sfdk.managedBy` would make the ownership marker forgeable and make a re-apply fight itself over the same
- * key. Refusing at the authoring boundary leaves the marker exactly one writer.
+ * the managed-by marker, under either prefix, would make the ownership marker forgeable and make a re-apply
+ * fight itself over the same key. Refusing at the authoring boundary leaves the marker exactly one writer.
  */
 export function rejectReservedLabelKeys(map, where) {
     if (map === undefined)
         return;
     for (const key of Object.keys(map)) {
-        if (key.startsWith(LABEL_KEY_PREFIX)) {
+        const prefix = reservedPrefixOf(key);
+        if (prefix !== undefined) {
             throw new Error(`Label key ${JSON.stringify(key)} in ${where} uses the reserved ` +
-                `"${LABEL_KEY_PREFIX}" prefix, which belongs to orchestra itself (it is how apply marks the ` +
+                `"${prefix}" prefix, which belongs to orchestra itself (it is how apply marks the ` +
                 `resources it manages, e.g. ${JSON.stringify(MANAGED_BY_LABEL_KEY)}). Rename the key to ` +
                 `anything outside that prefix.`);
         }
@@ -57,6 +64,51 @@ export function stampManagedBy(labels, factory) {
  * tells a key the declaration dropped, which it removes, from a key someone else set, which it leaves alone.
  */
 export const DECLARED_LABELS_KEY = `${LABEL_KEY_PREFIX}declaredLabels`;
+/**
+ * Set on a gateway key's paired Secret while a mint is in flight, so a mint whose token write never landed is
+ * seen and refused by name rather than read as a usable Secret.
+ */
+export const PENDING_GATEWAY_KEY_TOKEN_LABEL_KEY = `${LABEL_KEY_PREFIX}pendingGatewayKeyToken`;
+const MARKER_KEYS = [MANAGED_BY_LABEL_KEY, DECLARED_LABELS_KEY, PENDING_GATEWAY_KEY_TOKEN_LABEL_KEY];
+/** The key a marker had under the old prefix. */
+export function oldMarkerKey(key) {
+    return OLD_LABEL_KEY_PREFIX + key.slice(LABEL_KEY_PREFIX.length);
+}
+/** A marker's value: under its key, else under the old prefix's, else `undefined`. */
+export function readMarker(labels, key) {
+    const value = labels?.[key] ?? labels?.[oldMarkerKey(key)];
+    return typeof value === "string" ? value : undefined;
+}
+/** A merge patch removing each marker these labels carry under the old prefix. */
+export function oldMarkersCleared(labels) {
+    return Object.fromEntries(MARKER_KEYS.map(oldMarkerKey)
+        .filter((key) => labels?.[key] !== undefined)
+        .map((key) => [key, null]));
+}
+/**
+ * The merge patch that moves each marker found under the old prefix, for a resource whose labels apply does not
+ * otherwise reconcile: the old key sent as `null`, and the new key given the old value unless it is already
+ * live. `undefined` when no marker is under the old prefix.
+ */
+export function oldMarkersMoved(labels) {
+    const patch = {};
+    for (const key of MARKER_KEYS) {
+        const old = labels?.[oldMarkerKey(key)];
+        if (old === undefined)
+            continue;
+        patch[oldMarkerKey(key)] = null;
+        if (labels?.[key] === undefined && typeof old === "string")
+            patch[key] = old;
+    }
+    return Object.keys(patch).length > 0 ? patch : undefined;
+}
+/** The factory whose apply stamped these labels, read under either prefix. */
+export function managedByOf(labels) {
+    return readMarker(labels, MANAGED_BY_LABEL_KEY);
+}
+function reservedPrefixOf(key) {
+    return RESERVED_LABEL_KEY_PREFIXES.find((prefix) => key.startsWith(prefix));
+}
 /** A create's labels: the declaration, the record of its keys when it declares any, and the stamps. */
 export function createLabels(declared, stamps = {}) {
     return { ...withDeclaredKeys(declared ?? {}), ...stamps };
@@ -64,7 +116,9 @@ export function createLabels(declared, stamps = {}) {
 /**
  * The merge patch that brings the live labels to the declaration, or `undefined` when they already agree: a
  * declared value that differs, a key an earlier apply declared and this one does not (as `null`), the record
- * of declared keys, and the stamps. A live key no apply declared is neither sent nor drift.
+ * of declared keys, and the stamps. A live key no apply declared is neither sent nor drift. A marker found under
+ * the old prefix is moved: its old key is sent as `null`, and its new key carries the stamp, or the old value
+ * when nothing stamps it.
  */
 export function labelsPatch(declared, live, stamps = {}) {
     const current = live ?? {};
@@ -80,6 +134,14 @@ export function labelsPatch(declared, live, stamps = {}) {
     }
     if (!(DECLARED_LABELS_KEY in desired) && DECLARED_LABELS_KEY in current)
         patch[DECLARED_LABELS_KEY] = null;
+    for (const key of MARKER_KEYS) {
+        const old = oldMarkerKey(key);
+        if (!(old in current))
+            continue;
+        patch[old] = null;
+        if (key !== DECLARED_LABELS_KEY && !(key in desired) && !(key in current))
+            patch[key] = current[old];
+    }
     return Object.keys(patch).length > 0 ? patch : undefined;
 }
 function withDeclaredKeys(declared) {
@@ -88,13 +150,13 @@ function withDeclaredKeys(declared) {
 }
 /** A malformed record removes nothing, and a reserved key is never removed through it. */
 function previouslyDeclaredKeys(live) {
-    const record = live[DECLARED_LABELS_KEY];
+    const record = readMarker(live, DECLARED_LABELS_KEY);
     if (record === undefined)
         return [];
     try {
         const keys = JSON.parse(record);
         return Array.isArray(keys)
-            ? keys.filter((key) => typeof key === "string" && !key.startsWith(LABEL_KEY_PREFIX))
+            ? keys.filter((key) => typeof key === "string" && reservedPrefixOf(key) === undefined)
             : [];
     }
     catch {

package/dist/engine/diff.js

@@ -10,13 +10,12 @@ import { createHash } from "node:crypto";
 import { CONNECTOR_SECRET_WIRE_FIELDS } from "../constructs/connector.js";
 import { isEnvImportMarker, parseEnvImportMarker } from "../constructs/references.js";
 import { gatewayKeyRefOf } from "../core/gateway-key-recipe.js";
-import { labelsPatch, MANAGED_BY_LABEL_KEY } from "../core/labels.js";
+import { labelsPatch, MANAGED_BY_LABEL_KEY, oldMarkersMoved, PENDING_GATEWAY_KEY_TOKEN_LABEL_KEY, readMarker, } from "../core/labels.js";
 import { isRefToken, refToken } from "../core/tokens.js";
 import { createTeamResolver, mapError, modelSettingsUnchanged, standbyCapacityUnchanged, platformErrorMessage, } from "./apply-core.js";
 import { httpStatusOf } from "./client.js";
 import { describeRefusal, describeStageEffects, leftoverRefusals, pipelineChange, pipelineUnchanged, previewPipelineChange, resolveGateReferences, workflowStagesAfterApply, } from "./pipeline-reconcile.js";
 import { describeEntryChange, describeOverlaps, entriesUnchanged, pipelineEntryChange, proposedWorkflows, } from "./pipeline-workflow-reconcile.js";
-import { PENDING_GATEWAY_KEY_TOKEN_LABEL_KEY } from "./gateway-key-reconcile.js";
 import { scanModelProviderKeys } from "./model-provider-key-reconcile.js";
 import { computeProviderPatch, } from "./compute-provider-reconcile.js";
 import { paginate } from "./pages.js";
@@ -25,7 +24,7 @@ import { reservedProviderSecretIds } from "./preflight.js";
 import { gatewayKeyPairRefusal, refusalOf, } from "./refusals.js";
 import { connectionUnchanged, environmentUnchanged, getBySlugOrUndefined, subsetDeepEqual, } from "./reconcile.js";
 import { removedConfigurationNotice } from "./connector-configuration.js";
-import { containsCommandLineRecipe, declaredSecretHosts, metadataHostsChange, metadataInjectionChange, pendingCredentialWrite, replacesLiveCredentialValue, resolveSecretValueSource, rootEnvName, } from "./secrets-apply.js";
+import { containsCommandLineRecipe, declaredSecretInjection, metadataInjectionChange, pendingCredentialWrite, replacesLiveCredentialValue, resolveSecretValueSource, rootEnvName, } from "./secrets-apply.js";
 /** Overridable for tests. */
 export const ORPHAN_SCAN_CAP = 5;
 /**
@@ -428,20 +427,30 @@ async function diffSecret(resource, pass) {
     }
     return entry(resource, "no-change", unsetNote, marks);
 }
-/** Value-free: a recipe and a host list are shape, never credential material. */
+/** Value-free: a recipe and its host list are shape, never credential material. */
 const INJECTION_RECIPE_CHANGE = "injection recipe changes";
 const HOSTS_CHANGE = "hosts change";
+const OWNERSHIP_LABELS_MOVE = "ownership labels move to the orchestra. prefix";
 function secretMetadataDetail(resource, live) {
     const details = [
-        ...(metadataInjectionChange(declaredInjection(resource), live.injection) !== undefined
-            ? [INJECTION_RECIPE_CHANGE]
-            : []),
-        ...(metadataHostsChange(declaredSecretHosts(resource.payload), live.hosts) !== undefined ? [HOSTS_CHANGE] : []),
+        ...secretRecipeDetails(resource, live),
+        ...(oldMarkersMoved(live.labels) !== undefined ? [OWNERSHIP_LABELS_MOVE] : []),
     ];
     return details.length > 0 ? details.join("; ") : undefined;
 }
-function declaredInjection(resource) {
-    return resource.payload.injection;
+function secretRecipeDetails(resource, live) {
+    const declared = declaredSecretInjection(resource.payload);
+    if (metadataInjectionChange(declared, live.injection) === undefined)
+        return [];
+    if (declared === undefined || live.injection === undefined)
+        return [INJECTION_RECIPE_CHANGE];
+    const { hosts: desiredHosts = [], ...desiredRecipe } = declared;
+    const { hosts: liveHosts = [], ...liveRecipe } = live.injection;
+    const sameHosts = desiredHosts.length === liveHosts.length && desiredHosts.every((host, index) => host === liveHosts[index]);
+    return [
+        ...(metadataInjectionChange(desiredRecipe, liveRecipe) !== undefined ? [INJECTION_RECIPE_CHANGE] : []),
+        ...(sameHosts ? [] : [HOSTS_CHANGE]),
+    ];
 }
 function withDetail(note, detail) {
     return note === undefined ? detail : `${note}; ${detail}`;
@@ -480,7 +489,7 @@ async function diffGatewayKey(resource, plan, pass) {
     return entry(resource, keyUnchanged(body, live) ? "no-change" : "update", undefined, marks);
 }
 function hasPendingMarker(secret) {
-    return secret?.labels?.[PENDING_GATEWAY_KEY_TOKEN_LABEL_KEY] !== undefined;
+    return readMarker(secret?.labels, PENDING_GATEWAY_KEY_TOKEN_LABEL_KEY) !== undefined;
 }
 /**
  * Mirrors apply's `pairedSecretResource` lookup but returns `undefined` instead of throwing when the plan
@@ -630,6 +639,16 @@ async function diffEnvironment(resource, pass) {
     if (typeof providerRef === "string" && providerRef.length > 0) {
         launchSpec.computeProviderId = await resolveIdForDiff(providerRef, "compute-provider", pass);
     }
+    // Each credential reference an env value or a default names, resolved to the id apply writes.
+    const env = (launchSpec.env ?? {});
+    for (const [name, value] of Object.entries(env)) {
+        if (!value.startsWith("orchestra:"))
+            continue;
+        env[name] = `orchestra:${await credentialReferenceForDiff(value.slice("orchestra:".length), pass)}`;
+    }
+    for (const entry of (body.credentials ?? [])) {
+        entry.credential = await credentialReferenceForDiff(String(entry.credential), pass);
+    }
     const bound = pullSecrets.length === 0
         ? null
         : verdictFor(resource, live, {
@@ -929,6 +948,14 @@ async function orphanReport(plan, apis, cap) {
 function refKeyOf(resource) {
     return refToken(resource.kind, resource.path.split("/"));
 }
+/** `secret/<ref>` or `connection/<ref>` with its ref resolved as {@link resolveIdForDiff} resolves one. */
+async function credentialReferenceForDiff(text, pass) {
+    const match = /^(secret|connection)\/(.+)$/.exec(text);
+    if (match === null)
+        return text;
+    const kind = match[1];
+    return `${kind}/${await resolveIdForDiff(match[2], kind, pass)}`;
+}
 /** Lenient: any miss leaves the ref unchanged, so the compare simply reports `update`. */
 async function resolveIdForDiff(ref, literalKind, pass) {
     if (isRefToken(ref)) {

package/dist/engine/gateway-key-reconcile.d.ts

@@ -8,7 +8,7 @@ import { PreflightError } from "./preflight.js";
  * second column — and is removed by the final token PATCH. It lives in a leaf module because the aggregate
  * refusal classifier's rotation message names it too.
  */
-export { PENDING_GATEWAY_KEY_TOKEN_LABEL_KEY } from "./refusals.js";
+export { PENDING_GATEWAY_KEY_TOKEN_LABEL_KEY } from "../core/labels.js";
 /**
  * The platform requires a non-empty `value` on create and the token does not exist yet, so a reservation
  * writes this inert literal and the final PATCH replaces it. The Secret is detectably pending for exactly as
@@ -38,7 +38,6 @@ export interface LiveSecretRow {
     id: string;
     teamId?: string;
     injection?: InjectionRecipe;
-    hosts?: string[];
     labels?: Record<string, string>;
 }
 /** Value-free. */