[camielvs]

Description

The first of three foundation PRs for workspace secrets under team impersonation. Inside a project whose workspace maps to a team, secrets are managed and runs are submitted as that team: the backend's impersonation header is added to those specific requests only, never globally. This PR decides which team, if any, a set of projects acts as. Nothing here sends the header or changes a screen yet.

• getTeamImpersonationHeaderName reads the header name the host page injects as window.__TANGLE_TEAM_IMPERSONATION__. With none configured, as in a default deployment, every team lookup resolves to none and the app behaves exactly as today.
• teamRequestHeaders(teamId) is the one place the header is built. It returns {} without a configured header name or a team id.
• resolveTeamId is the one place that knows a workspace names its team through data.teamId, the interim contract until the backend has a field for it.
• readTeamMemberships is the one place that knows the teams map on GET /api/users/me. That map is fetched without the header; with it, the response describes the team and carries no teams.
• fetchTeamIdentity asks /api/users/me with the header. A team only counts as active when the backend answers as that team. That's because the development backend ignores the header but still lists teams, and a nobody role passes impersonation with no access. canWrite comes from the permissions the backend returns rather than from role names.
• resolveTeam turns the lookups into one outcome, and useTeamForProjects gathers them. The outcome is one of none, resolving, active, not-member, unavailable, conflict (projects on different teams) or error.

Related Issue and Pull requests

• Stacked on fix(projects): say why the backend refused to create a project #2909.
• Followed by feat(secrets): scope secret storage to a team #2928 (team-scoped secret storage) and feat(runs): submit and manage runs as a team #2929 (run methods that act as a team).
• Supersedes the data-layer half of feat(projects): manage workspace secrets from a Tangent project #2886. That PR will be closed once its UI parts are extracted into the follow-up UI PRs.

Type of Change

• New feature

Line Breakdown

Category	Added	Removed
Production code	358	0
Tests	566	0
Config / CI / tooling	1	0
Total	925	0

Checklist

• I have tested this does not break current pipelines / runs functionality
• I have tested the changes on staging

Screenshots (if applicable)

None. There's no UI change.

Test Instructions

pnpm vitest run src/config/teamImpersonation.test.ts src/services/teams

pnpm validate (format, lint, typecheck, knip) passes. No screen calls these hooks yet, so there's nothing to click through.

Additional Comments

• src/services/teams is added to react-compiler.config.js.
• useTeamForProjects reads projects and workspaces through the existing ProjectsQueryKeys / WorkspacesQueryKeys caches and treats a deleted project as absent rather than as an error.

🤖 Generated with Claude Code

[github-actions]

🎩 Preview

A preview build has been created at: cvs/team-context/18c82f0