@orchestraworks/cli 0.5.8 → 0.6.0

package/dist/constructs/secret.js

@@ -77,6 +77,7 @@ export function cloneInjectionRecipe(recipe) {
     return {
         headers: (recipe.headers ?? []).map((h) => ({ name: h.name, value: h.value })),
         removeHeaders: [...recipe.removeHeaders],
+        ...(recipe.hosts !== undefined ? { hosts: [...recipe.hosts] } : {}),
     };
 }
 /**
@@ -319,16 +320,25 @@ function isIpv6Literal(host) {
 /**
  * The client-side mirror of the platform's write-time `hosts` checks, so a bad list fails at synth: each
  * entry is an exact host, `*.` and a suffix, or `*`, and a secret that covers a host needs a recipe header to
- * be presented by. The platform-origin and object-store refusals need the deployment's own addresses, so they
+ * be presented by. The deprecated top-level `hosts` is moved into the recipe, and refused when the recipe
+ * declares a different list, an empty one included. The platform-origin and object-store refusals need the deployment's own addresses, so they
  * stay the platform's `400`.
  */
-function normalizeSecretHosts(hosts, injection, label) {
-    if (hosts === undefined)
-        return [];
-    normalizeCredentialHosts(hosts, label);
+function normalizeSecretHosts(recipeHosts, deprecatedHosts, injection, label) {
+    if (recipeHosts !== undefined)
+        normalizeCredentialHosts(recipeHosts, `${label}: injection`);
+    if (deprecatedHosts !== undefined)
+        normalizeCredentialHosts(deprecatedHosts, label);
+    if (recipeHosts !== undefined &&
+        deprecatedHosts !== undefined &&
+        (recipeHosts.length !== deprecatedHosts.length || recipeHosts.some((host, index) => host !== deprecatedHosts[index]))) {
+        throw new Error(`${label}: 'hosts' and 'injection.hosts' name different hosts; declare 'injection.hosts' alone.`);
+    }
+    const hosts = recipeHosts ?? deprecatedHosts ?? [];
     if (hosts.length > 0 && (injection === undefined || (injection.headers ?? []).length === 0)) {
-        throw new Error(`${label}: a secret with 'hosts' needs an 'injection' recipe with at least one header, which is how it ` +
-            `is presented, such as injection: { headers: [{ name: "Authorization", value: "Bearer \${secret}" }] }.`);
+        throw new Error(`${label}: a secret with hosts needs an 'injection' recipe with at least one header, which is how it ` +
+            `is presented, such as injection: { headers: [{ name: "Authorization", value: "Bearer \${secret}" }], ` +
+            `hosts: ["api.example.com"] }.`);
     }
     return [...hosts];
 }
@@ -337,7 +347,6 @@ export class Secret extends Construct {
     secretId;
     #valueFrom;
     #injection;
-    #hosts;
     explicitSlug;
     displayName;
     description;
@@ -347,8 +356,9 @@ export class Secret extends Construct {
         validateExplicitSlug(this, props.slug, "secret");
         const label = `secret '${this.node.path.join("/")}'`;
         this.#valueFrom = props.value._toValueFrom();
-        this.#injection = props.injection === undefined ? undefined : normalizeInjectionRecipe(props.injection, label);
-        this.#hosts = normalizeSecretHosts(props.hosts, this.#injection, label);
+        const recipe = props.injection === undefined ? undefined : normalizeInjectionRecipe(props.injection, label);
+        const hosts = normalizeSecretHosts(props.injection?.hosts, props.hosts, recipe, label);
+        this.#injection = recipe === undefined ? undefined : { ...recipe, hosts };
         this.explicitSlug = props.slug;
         this.displayName = props.name ?? id;
         this.description = props.description ?? "";
@@ -368,7 +378,7 @@ export class Secret extends Construct {
     }
     /** @internal — a fresh copy of the declared hosts, for synth checks that read a declared secret. */
     _hosts() {
-        return [...this.#hosts];
+        return [...(this.#injection?.hosts ?? [])];
     }
     /** @internal — whether the declared recipe has a header to present this secret by. */
     _presentsHeader() {
@@ -385,16 +395,14 @@ export class Secret extends Construct {
         const slug = this.slug();
         // `description` is ALWAYS emitted, empty when unset, so it is never omit-masked; the only Secret PATCH
         // rides a value overwrite that sends name+description together, so a clear travels with that write.
-        // `hosts` is ALWAYS emitted, `[]` when undeclared, so apply sends it and a row at `[]` or with other hosts
-        // converges on the declaration.
-        // `injection` is emitted only when declared, keeping a recipe-less secret's payload byte-identical, and
-        // is DEEP-COPIED because the stored recipe is shared across synths: emitting it by reference would let a
+        // `injection` is emitted only when declared, its `hosts` always, `[]` when undeclared, so a live recipe with
+        // other hosts converges on the declaration and a dropped recipe is cleared, leaving the secret stored only.
+        // It is DEEP-COPIED because the stored recipe is shared across synths: emitting it by reference would let a
         // caller mutating one returned plan corrupt the validated recipe for every later synth.
         const payload = {
             name: this.displayName,
             slug,
             description: this.description,
-            hosts: [...this.#hosts],
             ...(this.#injection !== undefined ? { injection: cloneInjectionRecipe(this.#injection) } : {}),
             ...(this.team !== undefined ? { teamId: this.team.teamId } : {}),
         };

package/dist/core/labels.d.ts

@@ -2,18 +2,23 @@
  * Reserving the whole prefix rather than one literal key is what makes the ownership marker unforgeable and
  * leaves room for the other markers `apply` writes without a second rule.
  */
-export declare const LABEL_KEY_PREFIX = "sfdk.";
+export declare const LABEL_KEY_PREFIX = "orchestra.";
+/**
+ * The prefix `apply` wrote before the rename. A factory applied then carries its markers under it until its next
+ * apply moves them, so every marker is read under both prefixes, the new key winning, and both stay reserved.
+ */
+export declare const OLD_LABEL_KEY_PREFIX = "sfdk.";
 /**
  * Stamped on every resource `apply` creates or adopts among the kinds whose API request exposes `labels`.
  * Its value is the root factory name, which is always present — even for a factory that declares no team — so a CLI
  * write against a managed resource can name the owning factory verbatim.
  */
-export declare const MANAGED_BY_LABEL_KEY = "sfdk.managedBy";
+export declare const MANAGED_BY_LABEL_KEY = "orchestra.managedBy";
 export declare function rejectTemplateBraces(map: Record<string, string> | undefined, where: string): void;
 /**
  * A synth-time rejection rather than an apply-time overwrite on purpose: a declared key that could shadow
- * `sfdk.managedBy` would make the ownership marker forgeable and make a re-apply fight itself over the same
- * key. Refusing at the authoring boundary leaves the marker exactly one writer.
+ * the managed-by marker, under either prefix, would make the ownership marker forgeable and make a re-apply
+ * fight itself over the same key. Refusing at the authoring boundary leaves the marker exactly one writer.
  */
 export declare function rejectReservedLabelKeys(map: Record<string, string> | undefined, where: string): void;
 /** Constructs call this rather than the two halves, so a new rule lands everywhere at once. */
@@ -28,12 +33,33 @@ export declare function stampManagedBy(labels: Record<string, string> | undefine
  * an explicit `null`. This record of the keys `apply` last wrote from a declaration is how a later apply
  * tells a key the declaration dropped, which it removes, from a key someone else set, which it leaves alone.
  */
-export declare const DECLARED_LABELS_KEY = "sfdk.declaredLabels";
+export declare const DECLARED_LABELS_KEY = "orchestra.declaredLabels";
+/**
+ * Set on a gateway key's paired Secret while a mint is in flight, so a mint whose token write never landed is
+ * seen and refused by name rather than read as a usable Secret.
+ */
+export declare const PENDING_GATEWAY_KEY_TOKEN_LABEL_KEY = "orchestra.pendingGatewayKeyToken";
+/** The key a marker had under the old prefix. */
+export declare function oldMarkerKey(key: string): string;
+/** A marker's value: under its key, else under the old prefix's, else `undefined`. */
+export declare function readMarker(labels: Record<string, unknown> | null | undefined, key: string): string | undefined;
+/** A merge patch removing each marker these labels carry under the old prefix. */
+export declare function oldMarkersCleared(labels: Record<string, unknown> | null | undefined): Record<string, null>;
+/**
+ * The merge patch that moves each marker found under the old prefix, for a resource whose labels apply does not
+ * otherwise reconcile: the old key sent as `null`, and the new key given the old value unless it is already
+ * live. `undefined` when no marker is under the old prefix.
+ */
+export declare function oldMarkersMoved(labels: Record<string, unknown> | null | undefined): Record<string, string | null> | undefined;
+/** The factory whose apply stamped these labels, read under either prefix. */
+export declare function managedByOf(labels: Record<string, unknown> | null | undefined): string | undefined;
 /** A create's labels: the declaration, the record of its keys when it declares any, and the stamps. */
 export declare function createLabels(declared: Record<string, string> | undefined, stamps?: Record<string, string>): Record<string, string>;
 /**
  * The merge patch that brings the live labels to the declaration, or `undefined` when they already agree: a
  * declared value that differs, a key an earlier apply declared and this one does not (as `null`), the record
- * of declared keys, and the stamps. A live key no apply declared is neither sent nor drift.
+ * of declared keys, and the stamps. A live key no apply declared is neither sent nor drift. A marker found under
+ * the old prefix is moved: its old key is sent as `null`, and its new key carries the stamp, or the old value
+ * when nothing stamps it.
  */
 export declare function labelsPatch(declared: Record<string, string> | undefined, live: Record<string, string> | null | undefined, stamps?: Record<string, string>): Record<string, string | null> | undefined;

package/dist/core/labels.js

@@ -4,7 +4,13 @@
  * Reserving the whole prefix rather than one literal key is what makes the ownership marker unforgeable and
  * leaves room for the other markers `apply` writes without a second rule.
  */
-export const LABEL_KEY_PREFIX = "sfdk.";
+export const LABEL_KEY_PREFIX = "orchestra.";
+/**
+ * The prefix `apply` wrote before the rename. A factory applied then carries its markers under it until its next
+ * apply moves them, so every marker is read under both prefixes, the new key winning, and both stay reserved.
+ */
+export const OLD_LABEL_KEY_PREFIX = "sfdk.";
+const RESERVED_LABEL_KEY_PREFIXES = [LABEL_KEY_PREFIX, OLD_LABEL_KEY_PREFIX];
 /**
  * Stamped on every resource `apply` creates or adopts among the kinds whose API request exposes `labels`.
  * Its value is the root factory name, which is always present — even for a factory that declares no team — so a CLI
@@ -24,16 +30,17 @@ export function rejectTemplateBraces(map, where) {
 }
 /**
  * A synth-time rejection rather than an apply-time overwrite on purpose: a declared key that could shadow
- * `sfdk.managedBy` would make the ownership marker forgeable and make a re-apply fight itself over the same
- * key. Refusing at the authoring boundary leaves the marker exactly one writer.
+ * the managed-by marker, under either prefix, would make the ownership marker forgeable and make a re-apply
+ * fight itself over the same key. Refusing at the authoring boundary leaves the marker exactly one writer.
  */
 export function rejectReservedLabelKeys(map, where) {
     if (map === undefined)
         return;
     for (const key of Object.keys(map)) {
-        if (key.startsWith(LABEL_KEY_PREFIX)) {
+        const prefix = reservedPrefixOf(key);
+        if (prefix !== undefined) {
             throw new Error(`Label key ${JSON.stringify(key)} in ${where} uses the reserved ` +
-                `"${LABEL_KEY_PREFIX}" prefix, which belongs to orchestra itself (it is how apply marks the ` +
+                `"${prefix}" prefix, which belongs to orchestra itself (it is how apply marks the ` +
                 `resources it manages, e.g. ${JSON.stringify(MANAGED_BY_LABEL_KEY)}). Rename the key to ` +
                 `anything outside that prefix.`);
         }
@@ -57,6 +64,51 @@ export function stampManagedBy(labels, factory) {
  * tells a key the declaration dropped, which it removes, from a key someone else set, which it leaves alone.
  */
 export const DECLARED_LABELS_KEY = `${LABEL_KEY_PREFIX}declaredLabels`;
+/**
+ * Set on a gateway key's paired Secret while a mint is in flight, so a mint whose token write never landed is
+ * seen and refused by name rather than read as a usable Secret.
+ */
+export const PENDING_GATEWAY_KEY_TOKEN_LABEL_KEY = `${LABEL_KEY_PREFIX}pendingGatewayKeyToken`;
+const MARKER_KEYS = [MANAGED_BY_LABEL_KEY, DECLARED_LABELS_KEY, PENDING_GATEWAY_KEY_TOKEN_LABEL_KEY];
+/** The key a marker had under the old prefix. */
+export function oldMarkerKey(key) {
+    return OLD_LABEL_KEY_PREFIX + key.slice(LABEL_KEY_PREFIX.length);
+}
+/** A marker's value: under its key, else under the old prefix's, else `undefined`. */
+export function readMarker(labels, key) {
+    const value = labels?.[key] ?? labels?.[oldMarkerKey(key)];
+    return typeof value === "string" ? value : undefined;
+}
+/** A merge patch removing each marker these labels carry under the old prefix. */
+export function oldMarkersCleared(labels) {
+    return Object.fromEntries(MARKER_KEYS.map(oldMarkerKey)
+        .filter((key) => labels?.[key] !== undefined)
+        .map((key) => [key, null]));
+}
+/**
+ * The merge patch that moves each marker found under the old prefix, for a resource whose labels apply does not
+ * otherwise reconcile: the old key sent as `null`, and the new key given the old value unless it is already
+ * live. `undefined` when no marker is under the old prefix.
+ */
+export function oldMarkersMoved(labels) {
+    const patch = {};
+    for (const key of MARKER_KEYS) {
+        const old = labels?.[oldMarkerKey(key)];
+        if (old === undefined)
+            continue;
+        patch[oldMarkerKey(key)] = null;
+        if (labels?.[key] === undefined && typeof old === "string")
+            patch[key] = old;
+    }
+    return Object.keys(patch).length > 0 ? patch : undefined;
+}
+/** The factory whose apply stamped these labels, read under either prefix. */
+export function managedByOf(labels) {
+    return readMarker(labels, MANAGED_BY_LABEL_KEY);
+}
+function reservedPrefixOf(key) {
+    return RESERVED_LABEL_KEY_PREFIXES.find((prefix) => key.startsWith(prefix));
+}
 /** A create's labels: the declaration, the record of its keys when it declares any, and the stamps. */
 export function createLabels(declared, stamps = {}) {
     return { ...withDeclaredKeys(declared ?? {}), ...stamps };
@@ -64,7 +116,9 @@ export function createLabels(declared, stamps = {}) {
 /**
  * The merge patch that brings the live labels to the declaration, or `undefined` when they already agree: a
  * declared value that differs, a key an earlier apply declared and this one does not (as `null`), the record
- * of declared keys, and the stamps. A live key no apply declared is neither sent nor drift.
+ * of declared keys, and the stamps. A live key no apply declared is neither sent nor drift. A marker found under
+ * the old prefix is moved: its old key is sent as `null`, and its new key carries the stamp, or the old value
+ * when nothing stamps it.
  */
 export function labelsPatch(declared, live, stamps = {}) {
     const current = live ?? {};
@@ -80,6 +134,14 @@ export function labelsPatch(declared, live, stamps = {}) {
     }
     if (!(DECLARED_LABELS_KEY in desired) && DECLARED_LABELS_KEY in current)
         patch[DECLARED_LABELS_KEY] = null;
+    for (const key of MARKER_KEYS) {
+        const old = oldMarkerKey(key);
+        if (!(old in current))
+            continue;
+        patch[old] = null;
+        if (key !== DECLARED_LABELS_KEY && !(key in desired) && !(key in current))
+            patch[key] = current[old];
+    }
     return Object.keys(patch).length > 0 ? patch : undefined;
 }
 function withDeclaredKeys(declared) {
@@ -88,13 +150,13 @@ function withDeclaredKeys(declared) {
 }
 /** A malformed record removes nothing, and a reserved key is never removed through it. */
 function previouslyDeclaredKeys(live) {
-    const record = live[DECLARED_LABELS_KEY];
+    const record = readMarker(live, DECLARED_LABELS_KEY);
     if (record === undefined)
         return [];
     try {
         const keys = JSON.parse(record);
         return Array.isArray(keys)
-            ? keys.filter((key) => typeof key === "string" && !key.startsWith(LABEL_KEY_PREFIX))
+            ? keys.filter((key) => typeof key === "string" && reservedPrefixOf(key) === undefined)
             : [];
     }
     catch {

package/dist/engine/diff.js

@@ -10,13 +10,12 @@ import { createHash } from "node:crypto";
 import { CONNECTOR_SECRET_WIRE_FIELDS } from "../constructs/connector.js";
 import { isEnvImportMarker, parseEnvImportMarker } from "../constructs/references.js";
 import { gatewayKeyRefOf } from "../core/gateway-key-recipe.js";
-import { labelsPatch, MANAGED_BY_LABEL_KEY } from "../core/labels.js";
+import { labelsPatch, MANAGED_BY_LABEL_KEY, oldMarkersMoved, PENDING_GATEWAY_KEY_TOKEN_LABEL_KEY, readMarker, } from "../core/labels.js";
 import { isRefToken, refToken } from "../core/tokens.js";
 import { createTeamResolver, mapError, modelSettingsUnchanged, standbyCapacityUnchanged, platformErrorMessage, } from "./apply-core.js";
 import { httpStatusOf } from "./client.js";
 import { describeRefusal, describeStageEffects, leftoverRefusals, pipelineChange, pipelineUnchanged, previewPipelineChange, resolveGateReferences, workflowStagesAfterApply, } from "./pipeline-reconcile.js";
 import { describeEntryChange, describeOverlaps, entriesUnchanged, pipelineEntryChange, proposedWorkflows, } from "./pipeline-workflow-reconcile.js";
-import { PENDING_GATEWAY_KEY_TOKEN_LABEL_KEY } from "./gateway-key-reconcile.js";
 import { scanModelProviderKeys } from "./model-provider-key-reconcile.js";
 import { computeProviderPatch, } from "./compute-provider-reconcile.js";
 import { paginate } from "./pages.js";
@@ -25,7 +24,7 @@ import { reservedProviderSecretIds } from "./preflight.js";
 import { gatewayKeyPairRefusal, refusalOf, } from "./refusals.js";
 import { connectionUnchanged, environmentUnchanged, getBySlugOrUndefined, subsetDeepEqual, } from "./reconcile.js";
 import { removedConfigurationNotice } from "./connector-configuration.js";
-import { containsCommandLineRecipe, declaredSecretHosts, metadataHostsChange, metadataInjectionChange, pendingCredentialWrite, replacesLiveCredentialValue, resolveSecretValueSource, rootEnvName, } from "./secrets-apply.js";
+import { containsCommandLineRecipe, declaredSecretInjection, metadataInjectionChange, pendingCredentialWrite, replacesLiveCredentialValue, resolveSecretValueSource, rootEnvName, } from "./secrets-apply.js";
 /** Overridable for tests. */
 export const ORPHAN_SCAN_CAP = 5;
 /**
@@ -428,20 +427,30 @@ async function diffSecret(resource, pass) {
     }
     return entry(resource, "no-change", unsetNote, marks);
 }
-/** Value-free: a recipe and a host list are shape, never credential material. */
+/** Value-free: a recipe and its host list are shape, never credential material. */
 const INJECTION_RECIPE_CHANGE = "injection recipe changes";
 const HOSTS_CHANGE = "hosts change";
+const OWNERSHIP_LABELS_MOVE = "ownership labels move to the orchestra. prefix";
 function secretMetadataDetail(resource, live) {
     const details = [
-        ...(metadataInjectionChange(declaredInjection(resource), live.injection) !== undefined
-            ? [INJECTION_RECIPE_CHANGE]
-            : []),
-        ...(metadataHostsChange(declaredSecretHosts(resource.payload), live.hosts) !== undefined ? [HOSTS_CHANGE] : []),
+        ...secretRecipeDetails(resource, live),
+        ...(oldMarkersMoved(live.labels) !== undefined ? [OWNERSHIP_LABELS_MOVE] : []),
     ];
     return details.length > 0 ? details.join("; ") : undefined;
 }
-function declaredInjection(resource) {
-    return resource.payload.injection;
+function secretRecipeDetails(resource, live) {
+    const declared = declaredSecretInjection(resource.payload);
+    if (metadataInjectionChange(declared, live.injection) === undefined)
+        return [];
+    if (declared === undefined || live.injection === undefined)
+        return [INJECTION_RECIPE_CHANGE];
+    const { hosts: desiredHosts = [], ...desiredRecipe } = declared;
+    const { hosts: liveHosts = [], ...liveRecipe } = live.injection;
+    const sameHosts = desiredHosts.length === liveHosts.length && desiredHosts.every((host, index) => host === liveHosts[index]);
+    return [
+        ...(metadataInjectionChange(desiredRecipe, liveRecipe) !== undefined ? [INJECTION_RECIPE_CHANGE] : []),
+        ...(sameHosts ? [] : [HOSTS_CHANGE]),
+    ];
 }
 function withDetail(note, detail) {
     return note === undefined ? detail : `${note}; ${detail}`;
@@ -480,7 +489,7 @@ async function diffGatewayKey(resource, plan, pass) {
     return entry(resource, keyUnchanged(body, live) ? "no-change" : "update", undefined, marks);
 }
 function hasPendingMarker(secret) {
-    return secret?.labels?.[PENDING_GATEWAY_KEY_TOKEN_LABEL_KEY] !== undefined;
+    return readMarker(secret?.labels, PENDING_GATEWAY_KEY_TOKEN_LABEL_KEY) !== undefined;
 }
 /**
  * Mirrors apply's `pairedSecretResource` lookup but returns `undefined` instead of throwing when the plan
@@ -630,6 +639,16 @@ async function diffEnvironment(resource, pass) {
     if (typeof providerRef === "string" && providerRef.length > 0) {
         launchSpec.computeProviderId = await resolveIdForDiff(providerRef, "compute-provider", pass);
     }
+    // Each credential reference an env value or a default names, resolved to the id apply writes.
+    const env = (launchSpec.env ?? {});
+    for (const [name, value] of Object.entries(env)) {
+        if (!value.startsWith("orchestra:"))
+            continue;
+        env[name] = `orchestra:${await credentialReferenceForDiff(value.slice("orchestra:".length), pass)}`;
+    }
+    for (const entry of (body.credentials ?? [])) {
+        entry.credential = await credentialReferenceForDiff(String(entry.credential), pass);
+    }
     const bound = pullSecrets.length === 0
         ? null
         : verdictFor(resource, live, {
@@ -929,6 +948,14 @@ async function orphanReport(plan, apis, cap) {
 function refKeyOf(resource) {
     return refToken(resource.kind, resource.path.split("/"));
 }
+/** `secret/<ref>` or `connection/<ref>` with its ref resolved as {@link resolveIdForDiff} resolves one. */
+async function credentialReferenceForDiff(text, pass) {
+    const match = /^(secret|connection)\/(.+)$/.exec(text);
+    if (match === null)
+        return text;
+    const kind = match[1];
+    return `${kind}/${await resolveIdForDiff(match[2], kind, pass)}`;
+}
 /** Lenient: any miss leaves the ref unchanged, so the compare simply reports `update`. */
 async function resolveIdForDiff(ref, literalKind, pass) {
     if (isRefToken(ref)) {

package/dist/engine/gateway-key-reconcile.d.ts

@@ -8,7 +8,7 @@ import { PreflightError } from "./preflight.js";
  * second column — and is removed by the final token PATCH. It lives in a leaf module because the aggregate
  * refusal classifier's rotation message names it too.
  */
-export { PENDING_GATEWAY_KEY_TOKEN_LABEL_KEY } from "./refusals.js";
+export { PENDING_GATEWAY_KEY_TOKEN_LABEL_KEY } from "../core/labels.js";
 /**
  * The platform requires a non-empty `value` on create and the token does not exist yet, so a reservation
  * writes this inert literal and the final PATCH replaces it. The Secret is detectably pending for exactly as
@@ -38,7 +38,6 @@ export interface LiveSecretRow {
     id: string;
     teamId?: string;
     injection?: InjectionRecipe;
-    hosts?: string[];
     labels?: Record<string, string>;
 }
 /** Value-free. */

package/dist/engine/gateway-key-reconcile.js

@@ -13,17 +13,17 @@
 import { gatewayKeyRefOf } from "../core/gateway-key-recipe.js";
 import { refToken } from "../core/tokens.js";
 import { credentialValueWritten, driftedFields, failing, getBySlugOrUndefined, pushOutcome, stampTeam, } from "./apply-core.js";
-import { PENDING_GATEWAY_KEY_TOKEN_LABEL_KEY, refuseIf } from "./refusals.js";
+import { refuseIf } from "./refusals.js";
 import { httpStatusOf } from "./client.js";
 import { PreflightError } from "./preflight.js";
-import { createLabels, labelsPatch, MANAGED_BY_LABEL_KEY } from "../core/labels.js";
-import { declaredSecretHosts, metadataHostsChange, metadataInjectionChange, pendingSecretWrite, reconcileInjection, } from "./secrets-apply.js";
+import { createLabels, labelsPatch, MANAGED_BY_LABEL_KEY, oldMarkersCleared, oldMarkersMoved, PENDING_GATEWAY_KEY_TOKEN_LABEL_KEY, readMarker, } from "../core/labels.js";
+import { declaredSecretInjection, metadataInjectionChange, pendingSecretWrite, reconcileInjection, } from "./secrets-apply.js";
 /**
  * The reserved marker rides the ordinary labels wire field — never smuggled into the write-only value or a
  * second column — and is removed by the final token PATCH. It lives in a leaf module because the aggregate
  * refusal classifier's rotation message names it too.
  */
-export { PENDING_GATEWAY_KEY_TOKEN_LABEL_KEY } from "./refusals.js";
+export { PENDING_GATEWAY_KEY_TOKEN_LABEL_KEY } from "../core/labels.js";
 /**
  * The platform requires a non-empty `value` on create and the token does not exist yet, so a reservation
  * writes this inert literal and the final PATCH replaces it. The Secret is detectably pending for exactly as
@@ -149,14 +149,17 @@ async function applySteadyGatewayKey(decision, apis, outcomes, applied) {
         action = "updated";
     }
     pushOutcome(outcomes, applied, decision.resource, live.id, action);
-    // The paired Secret needs no value write in steady state, but a recipe or hosts edit still reconciles
+    // The paired Secret needs no value write in steady state, but a recipe edit, its hosts included, still reconciles
     // through a value-less PATCH — exactly what `applySecrets` would have done had this lane not owned it.
     const liveSecret = decision.liveSecret;
     const injectionChange = metadataInjectionChange(secretInjection(decision.secretResource), liveSecret.injection);
-    const hostsChange = metadataHostsChange(declaredSecretHosts(decision.secretResource.payload), liveSecret.hosts);
+    const labelsMove = oldMarkersMoved(liveSecret.labels);
     let secretAction = "unchanged";
-    if (injectionChange !== undefined || hostsChange !== undefined) {
-        const body = { ...injectionChange, ...hostsChange };
+    if (injectionChange !== undefined || labelsMove !== undefined) {
+        const body = {
+            ...injectionChange,
+            ...(labelsMove !== undefined ? { labels: labelsMove } : {}),
+        };
         await failing(() => apis.secrets.updateSecret({ id: liveSecret.id, updateSecretRequest: body }), { kind: "secret", slug: decision.secretSlug, op: "update" }, outcomes);
         secretAction = "updated";
     }
@@ -174,9 +177,12 @@ async function mintGatewayKey(decision, apis, outcomes, applied, tokens, factory
     const refKey = refToken("gateway-key", decision.resource.path.split("/"));
     // The FINAL patch removes the pending marker and stamps ownership; the merge keeps every caller-authored entry
     // an adopted Secret carries.
-    const finalLabels = { [MANAGED_BY_LABEL_KEY]: factory, [PENDING_GATEWAY_KEY_TOKEN_LABEL_KEY]: null };
+    const finalLabels = {
+        [MANAGED_BY_LABEL_KEY]: factory,
+        [PENDING_GATEWAY_KEY_TOKEN_LABEL_KEY]: null,
+        ...oldMarkersCleared(decision.liveSecret?.labels),
+    };
     const declaredInjection = secretInjection(decision.secretResource);
-    const declaredHosts = declaredSecretHosts(decision.secretResource.payload);
     // (1) Make the paired Secret detectably pending BEFORE the mint.
     let secretId;
     if (decision.action === "mint-new") {
@@ -188,7 +194,6 @@ async function mintGatewayKey(decision, apis, outcomes, applied, tokens, factory
             labels: { [PENDING_GATEWAY_KEY_TOKEN_LABEL_KEY]: decision.slug },
             ...placement,
             ...(declaredInjection !== undefined ? { injection: declaredInjection } : {}),
-            ...(declaredHosts !== undefined ? { hosts: declaredHosts } : {}),
         };
         const created = await failing(() => apis.secrets.createSecret({ createSecretRequest: createBody }), { kind: "secret", slug: decision.secretSlug, op: "create" }, outcomes);
         secretId = created.id;
@@ -202,6 +207,7 @@ async function mintGatewayKey(decision, apis, outcomes, applied, tokens, factory
             await patchSecretPendingMarker(apis, outcomes, decision.secretSlug, secretId, {
                 [MANAGED_BY_LABEL_KEY]: factory,
                 [PENDING_GATEWAY_KEY_TOKEN_LABEL_KEY]: decision.slug,
+                ...oldMarkersCleared(liveSecret.labels),
             });
         }
     }
@@ -237,8 +243,6 @@ async function mintGatewayKey(decision, apis, outcomes, applied, tokens, factory
             // No team: a `mint-new` reservation already placed the create, and an adopted or resumed Secret is
             // only here because the decide phase found it already in the declared team.
             ...(injection !== undefined ? { injection } : {}),
-            // A `mint-new` reservation already carried the hosts on its create.
-            ...(decision.action !== "mint-new" && declaredHosts !== undefined ? { hosts: declaredHosts } : {}),
         },
     }), { kind: "secret", slug: decision.secretSlug, op: "update" }, outcomes);
     // The pinned asymmetry between the pair's two rows: the `gateway-key` row is the MINT, whose sensitivity
@@ -277,7 +281,7 @@ function pairedSecretResource(plan, key) {
     return paired[0];
 }
 function hasPendingMarker(secret) {
-    return secret.labels?.[PENDING_GATEWAY_KEY_TOKEN_LABEL_KEY] !== undefined;
+    return readMarker(secret.labels, PENDING_GATEWAY_KEY_TOKEN_LABEL_KEY) !== undefined;
 }
 /**
  * Exactly the fields the update request accepts and the construct emits. `monthlyCreditCap` is present only
@@ -293,5 +297,5 @@ function declaredKeyState(payload) {
     };
 }
 function secretInjection(secretResource) {
-    return secretResource.payload.injection;
+    return declaredSecretInjection(secretResource.payload);
 }

package/dist/engine/pipeline-reconcile.js

@@ -11,7 +11,7 @@
 import { OPEN_CATEGORIES } from "../constructs/pipeline.js";
 import { resolveConditionReferences, resolveStageInField } from "./condition-references.js";
 import { wireNode } from "../constructs/workflow-filter.js";
-import { createLabels, labelsPatch, MANAGED_BY_LABEL_KEY } from "../core/labels.js";
+import { createLabels, labelsPatch, managedByOf } from "../core/labels.js";
 import { refToken } from "../core/tokens.js";
 import { exactDeepEqual, failing, getBySlugOrUndefined, stampTeam, } from "./apply-core.js";
 import { PreflightError } from "./preflight-errors.js";
@@ -242,7 +242,7 @@ export async function workflowStagesAfterApply(pipeline, live, resources, factor
         const versions = [
             ...declaredEntries.filter((entry) => refs.has(entry.workflow)).map((entry) => entry.version),
             ...liveEntries
-                .filter((entry) => entry.labels[MANAGED_BY_LABEL_KEY] !== factory && refs.has(entry.workflow.id))
+                .filter((entry) => managedByOf(entry.labels) !== factory && refs.has(entry.workflow.id))
                 .map((entry) => entry.version ?? null),
         ];
         if (versions.some((version) => typeof version === "number"))

package/dist/engine/pipeline-workflow-reconcile.js

@@ -1,4 +1,4 @@
-// A pipeline's workflow entries. Apply owns only the entries it stamped with this factory's `sfdk.managedBy`:
+// A pipeline's workflow entries. Apply owns only the entries it stamped with this factory's managed-by marker:
 // each declared entry takes a stamped live entry of its workflow, an identical one first and then the next in
 // order, and a changed one is patched field by field; a declared entry left over is added with the stamp, and
 // a stamped entry nothing declares is removed. Every other entry stays where it is and is named, since an
@@ -9,11 +9,11 @@
 // new rules before its entry says so; the entries phase then sets each to its declared version.
 import { APPLIED_VERSION } from "../constructs/pipeline.js";
 import { wireNode } from "../constructs/workflow-filter.js";
-import { MANAGED_BY_LABEL_KEY } from "../core/labels.js";
+import { MANAGED_BY_LABEL_KEY, managedByOf, oldMarkersCleared } from "../core/labels.js";
 import { exactDeepEqual, failing, getBySlugOrUndefined } from "./apply-core.js";
 import { rawJsonBody } from "./raw-json-request.js";
 export function entryChange(declared, live, factory) {
-    const stamped = live.filter((entry) => entry.labels[MANAGED_BY_LABEL_KEY] === factory);
+    const stamped = live.filter((entry) => managedByOf(entry.labels) === factory);
     const taken = new Set();
     const take = (entry, fits) => {
         const found = stamped.find((candidate) => !taken.has(candidate.id) && names(entry, candidate) && fits(candidate));
@@ -21,18 +21,18 @@ export function entryChange(declared, live, factory) {
             taken.add(found.id);
         return found;
     };
-    const exact = declared.map((entry) => take(entry, (candidate) => patchOf(entry, candidate) === undefined));
+    const exact = declared.map((entry) => take(entry, (candidate) => patchOf(entry, candidate, factory) === undefined));
     const matched = declared.map((entry, index) => exact[index] ?? take(entry, () => true));
     return {
         declared: declared.map((entry, index) => ({ entry, ...(matched[index] ? { liveId: matched[index].id } : {}) })),
         create: declared.filter((_, index) => matched[index] === undefined),
         update: declared.flatMap((entry, index) => {
             const live = matched[index];
-            const patch = live !== undefined ? patchOf(entry, live) : undefined;
+            const patch = live !== undefined ? patchOf(entry, live, factory) : undefined;
             return live !== undefined && patch !== undefined ? [{ id: live.id, patch }] : [];
         }),
         remove: stamped.filter((entry) => !taken.has(entry.id)),
-        unmanaged: live.filter((entry) => entry.labels[MANAGED_BY_LABEL_KEY] !== factory),
+        unmanaged: live.filter((entry) => managedByOf(entry.labels) !== factory),
     };
 }
 export function entriesUnchanged(change) {
@@ -87,7 +87,7 @@ export async function applyEntriesPhase(apis, pipelines, versions, factory, outc
  */
 export async function pinFollowingEntries(apis, pipeline, workflow, version, factory) {
     const live = await getBySlugOrUndefined(() => apis.pipelines.getPipeline({ id: pipeline }));
-    const following = (live?.workflows ?? []).filter((entry) => entry.labels[MANAGED_BY_LABEL_KEY] === factory && entry.workflow.id === workflow.id && entry.version === undefined);
+    const following = (live?.workflows ?? []).filter((entry) => managedByOf(entry.labels) === factory && entry.workflow.id === workflow.id && entry.version === undefined);
     for (const entry of following)
         await patchEntry(apis, live.id, entry.id, { version });
     return following.length;
@@ -165,9 +165,15 @@ export function describeOverlaps(proposedList, overlaps) {
 function names(entry, live) {
     return entry.workflow === live.workflow.slug || entry.workflow === live.workflow.id;
 }
-/** The fields a patch must send to make [live] the declared entry, null resetting; `undefined` when none. */
-function patchOf(entry, live) {
+/**
+ * The fields a patch must send to make [live] the declared entry, null resetting; `undefined` when none. An entry
+ * stamped under the old prefix has its stamp moved.
+ */
+function patchOf(entry, live, factory) {
     const patch = {};
+    const moved = oldMarkersCleared(live.labels);
+    if (Object.keys(moved).length > 0)
+        patch.labels = { ...moved, [MANAGED_BY_LABEL_KEY]: factory };
     if (entry.version !== (live.version ?? null))
         patch.version = entry.version;
     const where = entry.where === null ? null : wireNode(entry.where);