@lanes-sh/link 0.1.0

package/src/cli/runtime/open.ts

@@ -0,0 +1,342 @@
+import { BearerAuthenticator, ownerPrincipal } from '#auth';
+import type { SecretStore } from '#secrets';
+import type { AuditReader } from '#audit';
+import type { RuntimeState } from '#stores/state';
+import type { BlobStore } from '#stores/blobs';
+import type { AnyConnector, ProviderManifest } from '#connectivity';
+import { RateLimiter, allowedConnections } from '#policy';
+import {
+  ConfigError,
+  layout,
+  listProfiles,
+  workspacePath,
+  type Config,
+  type Resolution,
+} from '#profile';
+import { ProviderRegistry, toPolicyDocument } from '#registry';
+import { Dispatcher, createConsoleLogger } from '#dispatch';
+import { PROVIDER_MANIFESTS } from '#providers/index.ts';
+import {
+  createBlobVaultStore,
+  createFileVaultStore,
+  createSecretVaultStore,
+  type VaultStore,
+} from '#providers/owner.ts';
+import {
+  openAuditSinks,
+  openState,
+  openSecrets,
+  openStorage,
+  type StorageFactory,
+  type TargetInput,
+} from '#deployments/target.ts';
+import { connectorFactory } from '#connectivity/transports';
+import { requestAuthorizer } from '#connectivity/auth/index.ts';
+import { resolveProfile, type GlobalFlags } from './select.ts';
+import { buildRegistryWithWorkspace, reloadSkills, skillFingerprint } from './registry.ts';
+import { discoveryProbe } from './discovery.ts';
+
+/**
+ * Assembling a profile's runtime from its declared target.
+ *
+ * The same config can run in more than one place; a target names an adapter
+ * set. Connections, providers, policy, and limits are declared once and apply
+ * to every target — only the adapters differ, which is what lets M2 change
+ * nothing at the application layer.
+ */
+
+export interface Runtime {
+  readonly resolution: Resolution;
+  readonly config: Config;
+  readonly target: string;
+  readonly state: RuntimeState;
+  /** The durable log, for reading. Copies, if any, are write-only and not here. */
+  readonly audit: AuditReader;
+  readonly credentials: SecretStore;
+  readonly storage: BlobStore;
+  /** Where skills are kept — `data/<profile>/skills.d/` locally. */
+  readonly skills: BlobStore;
+  /** The vault's own store, so `lanes link vault` reaches the same bytes MCP does. */
+  readonly vault: VaultStore;
+  readonly registry: ProviderRegistry;
+  /**
+   * Re-read the skills into the registry when they have changed on the store.
+   *
+   * Cheap and idempotent — one `list()`, and a rebuild only when the listing
+   * differs from the last one. The caller decides how often to ask.
+   */
+  refreshSkills(): Promise<void>;
+  readonly dispatcher: Dispatcher;
+  readonly authenticator: BearerAuthenticator;
+  /** Same factory the dispatcher uses, exposed for commands that probe upstream. */
+  connectorFor(providerId: string, connectionId: string): AnyConnector | undefined;
+  /** A provider's manifest, so an omitted `credential_ref` can be derived from it. */
+  manifestFor(providerId: string): ProviderManifest | undefined;
+  close(): Promise<void>;
+}
+
+/**
+ * Where this profile's skills live, in either target.
+ *
+ * Locally `data/<profile>/skills.d/`; deployed, the same key under the bucket
+ * prefix. Going through the store rather than a filesystem path is what gives a
+ * deployment skills at all — a path is baked into a container image at build
+ * time and an object key is not, so before ADR-014 a deployed instance could
+ * only ever serve the skills that existed when its image was built.
+ *
+ * **Per profile**, which reverses ADR-012 §1. Policy gating `skills.<name>`
+ * was the whole isolation story while the bytes were shared, and it is a weak
+ * one: it decides who may *run* a procedure, not who may read that it exists or
+ * what it says. A skill written for work names work's accounts and work's
+ * people. ADR-030.
+ *
+ * An explicit area, matching `openState` and `openAudit` — a profile that
+ * declares its own `storage.path` moves its provider blobs, not the reserved
+ * roots beside them.
+ */
+function skillStore(storage: StorageFactory, profile: string): BlobStore {
+  return storage(layout.skills(profile));
+}
+
+/**
+ * The vault's encrypted document, wherever this target keeps it.
+ *
+ * Defaults to `file`, so a profile written before ADR-014 needs no change and a
+ * local run needs no vault configuration at all. `blob` exists because the file
+ * adapter was unconditional before: a deployed instance wrote its vault to a
+ * container filesystem, and every item in it was discarded by the next
+ * revision without an error to say so.
+ */
+function openVault(
+  input: TargetInput,
+  storage: StorageFactory,
+  credentials: SecretStore,
+): VaultStore {
+  const { declared, config, root } = input;
+  const vault = declared.vault ?? { adapter: 'file' as const };
+
+  switch (vault.adapter) {
+    case 'file':
+      return createFileVaultStore({
+        path: workspacePath(root, vault.path ?? layout.vault(config.instance.profile)),
+      });
+
+    case 'secret':
+      // The document is sealed under LANES_LINK_VAULT_KEY before it gets here,
+      // so the credential store holds ciphertext it cannot read. Separate
+      // document, separate key, separate environment variable — the backend
+      // was never what kept the two stores apart. ADR-022.
+      return createSecretVaultStore({
+        store: credentials,
+        ...(vault.ref !== undefined ? { ref: vault.ref } : {}),
+      });
+
+    case 'blob':
+      return createBlobVaultStore({
+        store: storage(),
+        ...(vault.path !== undefined ? { key: vault.path } : {}),
+      });
+  }
+}
+
+export async function openRuntime(flags: GlobalFlags): Promise<Runtime> {
+  const { resolution, config, target } = await resolveProfile(flags);
+  const declared = config.targets[target];
+  if (!declared) throw new ConfigError(`Target "${target}" is not declared`);
+
+  const root = resolution.workspaceRoot;
+  const adapters: TargetInput = { declared, config, root, target };
+
+  // Credentials first: an S3 key pair is itself a credential reference, so the
+  // credential store has to exist before the blob store that names it. State
+  // and the log then ride that blob store rather than opening backends of
+  // their own, which is why there is no migrate step here any more — there is
+  // no schema left to migrate.
+  const credentials = await openSecrets(adapters);
+  const storageFor = await openStorage(adapters, credentials);
+  const storage = storageFor();
+  const state = openState(storageFor, config.instance.profile);
+
+  // The durable log, plus any copies the target declares. `sink` is what
+  // dispatch writes to; `audit` is what `tail` and `verify` read, and those are
+  // not the same object once a fan-out exists — a copy is not the log.
+  const logger = createConsoleLogger(flags.quiet ? 'error' : 'info');
+  const { sink: auditSink, reader: audit } = await openAuditSinks(
+    adapters,
+    storageFor,
+    credentials,
+    (message) => logger.warn(message),
+  );
+
+  const skills = skillStore(storageFor, config.instance.profile);
+
+  // The vault's own store, beside the credential store and never it: a separate
+  // document, a separate key, and a separate environment variable
+  // (`LANES_LINK_VAULT_KEY`). One master secret reused across purposes turns any
+  // single compromise into a total one — `docs/detailed/security.md`, and the boundary
+  // test that has existed since M1.
+  //
+  // Opened before the registry because each stored item becomes its own
+  // `vault.get.<id>` capability, which is what makes per-item policy
+  // expressible; an item written since the last start is therefore not readable
+  // until the next one, deliberately (ADR-012 §3).
+  const vaultStore = openVault(adapters, storageFor, credentials);
+
+  // `refreshSkills` is declared before the registry it mutates because the
+  // provider has to be handed it at construction: a `skills.manage.write` says
+  // that something changed, and this is what that means. It is only ever
+  // *called* after the registry exists.
+  let registry: ProviderRegistry;
+  let fingerprint = '';
+  const refreshSkills = async (): Promise<void> => {
+    fingerprint = await reloadSkills(registry, skills, fingerprint, refreshSkills);
+  };
+
+  // Computed before the registry because the setup surface is handed a way to
+  // ask what this principal may reach — through the *same* `allowedConnections`
+  // the dispatcher enforces with and `mergeCapabilities` builds the connection
+  // enum from. Computing visibility a second way is how discovery and
+  // enforcement drift, and a leak in discovery is still a leak.
+  const policy = toPolicyDocument(config);
+  // The owner, explicitly, rather than assumed: when a delegated principal
+  // arrives this becomes the seam, and `reachable` grows a parameter instead of
+  // being rewritten.
+  const principal = ownerPrincipal(config.instance.profile).id;
+
+  // Lazy for the same reason `refreshSkills` is: it reads the registry it is
+  // registered into. Per call rather than a snapshot, so a policy the runtime
+  // was opened with is re-evaluated rather than remembered.
+  const reachable = (): ReadonlyArray<{ key: string; provider: string; account: string }> =>
+    config.connections
+      .filter((connection) =>
+        registry
+          .capabilities()
+          .some(
+            ({ id }) =>
+              id.startsWith(`${connection.provider}.`) &&
+              allowedConnections(
+                id,
+                [`${connection.provider}.${connection.id}`],
+                principal,
+                policy,
+              ).length > 0,
+          ),
+      )
+      .map((connection) => ({
+        key: `${connection.provider}.${connection.id}`,
+        provider: connection.provider,
+        account: connection.account,
+      }));
+
+  registry = await buildRegistryWithWorkspace(root, config.instance.profile, {
+    skillStore: skills,
+    onSkillsChanged: refreshSkills,
+    vault: { store: vaultStore, items: await vaultStore.ids() },
+    setup: {
+      profile: config.instance.profile,
+      profiles: await listProfiles(root),
+      catalogue: PROVIDER_MANIFESTS,
+      ownClients: Object.keys(config.oauth_apps),
+      reachable,
+    },
+  });
+  // Seeded from the build that just happened, so the first refresh compares
+  // against what is registered rather than rebuilding once to find out.
+  fingerprint = await skillFingerprint(skills);
+
+  // Discovered capabilities never come from a live call on the dispatch path —
+  // that is what keeps the server stateless. But "not live" is not the same as
+  // "cached", and conflating the two was a bug: `connect` was the only writer of
+  // this cache, so an operator who upgraded without re-authorising kept whatever
+  // their last consent screen happened to discover. Drive shipped nine
+  // operations and served six; Gmail served a `drafts.create` this repository
+  // had deleted, because the spec is read by the tests and the cache is read by
+  // the endpoint.
+  //
+  // So: derive it where deriving is free, and cache it only where it is not. An
+  // `http` provider's capabilities are a pure function of a document committed
+  // here — reviewed in a diff, not fetched from a vendor — which is the property
+  // that makes re-deriving safe as well as cheap.
+  for (const entry of registry.list()) {
+    if (entry.manifest.connector.kind === 'local') continue;
+
+    const probe = discoveryProbe(entry.manifest);
+    if (probe?.cost === 'offline') {
+      try {
+        registry.setDiscovered(entry.manifest.id, await probe.run());
+        continue;
+      } catch {
+        // A malformed committed spec is a build problem, not a reason to refuse
+        // to start — fall through to whatever the cache last held.
+      }
+    }
+
+    const cached = await state.kv.get('discovery', entry.manifest.id);
+    if (cached) {
+      try {
+        registry.setDiscovered(entry.manifest.id, JSON.parse(cached));
+      } catch {
+        // A corrupt cache entry means "not discovered yet", which `plan`
+        // reports and `connect` fixes — never a reason to fail startup.
+      }
+    }
+  }
+
+  // One factory for the whole runtime, so its cache actually holds. The
+  // dispatcher and the CLI share it deliberately: a stateful connector must be
+  // the *same instance* whichever side asks for it, or a held session is held
+  // twice.
+  const connectorFor = connectorFactory({ registry, credentials });
+  let closed = false;
+
+  const dispatcher = new Dispatcher({
+    config,
+    registry,
+    connectorFor,
+    authorizeRequest: requestAuthorizer(registry, credentials),
+    policy,
+    state,
+    audit: auditSink,
+    credentials,
+    storage,
+    limiter: new RateLimiter(),
+    log: logger,
+  });
+
+  return {
+    resolution,
+    config,
+    target,
+    state,
+    audit,
+    credentials,
+    storage,
+    skills,
+    vault: vaultStore,
+    registry,
+    refreshSkills,
+    dispatcher,
+    authenticator: new BearerAuthenticator({
+      profile: config.instance.profile,
+      tokenRef: config.auth.token_ref,
+      credentials,
+    }),
+    connectorFor,
+    manifestFor: (providerId: string) => registry.manifest(providerId),
+    // Sessions first, then the state: a connector may still want to log out
+    // cleanly, and LOGOUT is worth more than the microsecond it costs.
+    //
+    // Idempotent, because a command that finishes early closes explicitly and
+    // its `finally` then closes again — and closing a SQLite handle twice is an
+    // error that would surface as a crash after the work already succeeded.
+    close: async () => {
+      if (closed) return;
+      closed = true;
+      await connectorFor.closeAll();
+      // Closing the log is not releasing a handle: it writes the marker that
+      // lets `audit verify` tell a run that ended from one whose tail was cut
+      // off. A crash leaves the run open, which is the honest outcome.
+      await auditSink.close();
+    },
+  };
+}

package/src/cli/runtime/registry.ts

@@ -0,0 +1,185 @@
+import type { BlobStore } from '#stores/blobs';
+import type { ProviderDefinition } from '#connectivity';
+import { ConfigError } from '#profile';
+import { ProviderRegistry } from '#registry';
+import { loadProfileProviders } from '#providers/custom/index.ts';
+import { loadProfileSkills, type LoadedSkill } from '#providers/skills/store.ts';
+import { exampleProvider } from '#providers/example/provider.ts';
+import {
+  createMemoryVaultStore,
+  createSetupProvider,
+  createSkillsProvider,
+  createVaultProvider,
+  memoryProvider,
+  type SetupProviderOptions,
+  type VaultStore,
+} from '#providers/owner.ts';
+import { PROVIDERS, PROVIDER_MANIFESTS } from '#providers/index.ts';
+
+/**
+ * Which providers exist, and keeping the skills among them current.
+ *
+ * Separate from `./open.ts` because building a registry is synchronous and
+ * needs no adapters: `lanes link deploy` reads manifests and never opens a database.
+ */
+
+/** What the owner layer needs from its store before it can be built. */
+export interface OwnerLayerOptions {
+  /** Skills already loaded. Each becomes an MCP prompt. */
+  readonly skills?: readonly LoadedSkill[];
+  /**
+   * Where to load them from, and where authoring writes.
+   *
+   * Its presence is what gives the provider its `skills.manage.*` half: a
+   * registry built without one — `lanes link deploy` reads manifests and nothing else —
+   * gets the prompts and no way to author them, rather than four capabilities
+   * that would fail.
+   */
+  readonly skillStore?: BlobStore;
+  /** Called after a skill is written or removed, so the registry can catch up. */
+  readonly onSkillsChanged?: () => Promise<void>;
+  /**
+   * The vault store, and the items already in it.
+   *
+   * Both are resolved by the caller because opening an encrypted file is
+   * asynchronous and building a registry is not. The item list has to be known
+   * *here*: each item is its own `vault.get.<id>` capability, which is what
+   * makes per-item policy expressible without teaching the policy engine about
+   * arguments (ADR-012 §3).
+   */
+  readonly vault?: {
+    readonly store: VaultStore;
+    readonly items: ReadonlyArray<{ id: string; description?: string }>;
+  };
+  /**
+   * What the read-only setup surface describes.
+   *
+   * `reachable` is a function evaluated per call, and the caller supplies it
+   * because filtering it is a policy decision: `#providers` may not import
+   * `#policy`, and computing visibility anywhere but through
+   * `allowedConnections` is how discovery and enforcement drift apart.
+   *
+   * Absent for a registry built to read manifests — `lanes link deploy` — which
+   * then gets a surface describing the catalogue and no accounts, rather than
+   * two capabilities that would report an empty profile as the truth.
+   */
+  readonly setup?: SetupProviderOptions;
+}
+
+/**
+ * Built-in providers: the local reference, the owner layer, plus the manifests.
+ *
+ * Statically imported for now; the registry does not care where a manifest came
+ * from, which is what lets workspace YAML register alongside these.
+ *
+ * `allowReserved` is what admits `memory`, `skills`, and `vault`. The guard
+ * stays rather than being retired: it exists so a *third-party* provider cannot
+ * claim a namespace whose policy rules would then silently mean something else,
+ * and that reason survives the owner layer shipping. Only this one construction
+ * site opts in.
+ */
+export function buildRegistry(owner: OwnerLayerOptions = {}): ProviderRegistry {
+  const registry = new ProviderRegistry({ allowReserved: true });
+
+  registry.register(exampleProvider);
+  registry.register(memoryProvider);
+  registry.register(skillsProviderFor(owner));
+  registry.register(
+    createVaultProvider({
+      // No store means no reads to register; `vault.put` still works, and the
+      // items it writes become readable at the next start.
+      store: owner.vault?.store ?? createMemoryVaultStore(),
+      items: owner.vault?.items ?? [],
+    }),
+  );
+
+  registry.register(
+    createSetupProvider(
+      owner.setup ?? { profile: '', catalogue: PROVIDER_MANIFESTS },
+    ),
+  );
+
+  for (const manifest of PROVIDERS) registry.register(manifest);
+  return registry;
+}
+
+/**
+ * Built-ins plus whatever the operator has dropped into this profile.
+ *
+ * A manifest registering under a built-in id is refused rather than silently
+ * overriding it — an operator shadowing `gmail` by accident would be very hard
+ * to diagnose from the outside.
+ *
+ * The profile is a parameter rather than read from a config here because two of
+ * the three callers do not have one: `deploy` walks every profile in turn, and
+ * `profile remove` is holding the name of the one being deleted. Passing it
+ * makes "which profile's manifests" a question the caller has already answered.
+ */
+export async function buildRegistryWithWorkspace(
+  root: string,
+  profile: string,
+  owner: OwnerLayerOptions = {},
+): Promise<ProviderRegistry> {
+  const skills =
+    owner.skills ?? (owner.skillStore ? await loadProfileSkills(owner.skillStore) : []);
+  const registry = buildRegistry({ ...owner, skills });
+
+  for (const { manifest, path } of await loadProfileProviders(root, profile)) {
+    if (registry.has(manifest.id)) {
+      throw new ConfigError(
+        `${path}: provider "${manifest.id}" is already built in. Rename it, or remove the file to use the built-in.`,
+      );
+    }
+    registry.register(manifest, 'workspace');
+  }
+
+  return registry;
+}
+
+function skillsProviderFor(owner: OwnerLayerOptions): ProviderDefinition {
+  return createSkillsProvider({
+    skills: owner.skills ?? [],
+    ...(owner.skillStore ? { store: owner.skillStore } : {}),
+    ...(owner.onSkillsChanged ? { onChange: owner.onSkillsChanged } : {}),
+  });
+}
+
+/**
+ * Re-read the skills and swap them into the registry, if anything changed.
+ *
+ * Each skill is its own capability, so both halves of ADR-014's promise need
+ * this: a skill written over MCP has to appear without a restart, and so does
+ * one written by `lanes link skills add` in another terminal while the endpoint runs.
+ *
+ * The listing is the change check as well as the source. `BlobMetadata` carries
+ * size and mtime, so a fingerprint costs one `list()` and no reads — which
+ * matters on S3, where the alternative is fetching every skill on every poll.
+ *
+ * Returns the fingerprint it settled on, so the caller can decide when to ask
+ * again rather than this deciding for it.
+ */
+export async function reloadSkills(
+  registry: ProviderRegistry,
+  store: BlobStore,
+  previous: string,
+  onChange: () => Promise<void>,
+): Promise<string> {
+  const fingerprint = await skillFingerprint(store);
+  if (fingerprint === previous) return previous;
+
+  registry.replace(
+    skillsProviderFor({
+      skills: await loadProfileSkills(store),
+      skillStore: store,
+      onSkillsChanged: onChange,
+    }),
+  );
+  return fingerprint;
+}
+
+export async function skillFingerprint(store: BlobStore): Promise<string> {
+  return (await store.list())
+    .map((blob) => `${blob.key}:${blob.size}:${blob.modifiedAt.getTime()}`)
+    .sort()
+    .join('\n');
+}

package/src/cli/runtime/select.ts

@@ -0,0 +1,124 @@
+import { generateProfileToken, ownerPrincipal } from '#auth';
+import type { SecretStore } from '#secrets';
+import type { BlobStore } from '#stores/blobs';
+import {
+  loadProfileConfig,
+  resolveSelection,
+  resolveTarget,
+  undeclaredTarget,
+  type Config,
+  type Resolution,
+} from '#profile';
+import { openSecrets, openStorage } from '#deployments/target.ts';
+
+/**
+ * Which profile and target a command acts on, and the credentials that go with
+ * them — everything that can be settled without opening a database.
+ *
+ * Kept apart from `./open.ts` because two callers need exactly this much and
+ * nothing more: `secrets push` holds two targets open at once, and `deploy`
+ * checks a cloud store only reachable from inside Google's
+ * network. A full runtime would fail on the part neither of them uses.
+ */
+
+export interface GlobalFlags {
+  readonly profile?: string | undefined;
+  readonly target?: string | undefined;
+  readonly quiet?: boolean;
+}
+
+export async function resolveProfile(
+  flags: GlobalFlags,
+  options: {
+    /** `deploy` creates the target it is given; see `resolveTarget`. */
+    allowUndeclaredTarget?: boolean;
+    /** Injected by tests. Both resolutions must read the same one. */
+    env?: Record<string, string | undefined>;
+  } = {},
+): Promise<{
+  resolution: Resolution;
+  config: Config;
+  target: string;
+}> {
+  // Spread rather than assigned: `exactOptionalPropertyTypes` makes an explicit
+  // `env: undefined` a different type from an absent one, and the absent one is
+  // what means "read the real environment".
+  const env = options.env !== undefined ? { env: options.env } : {};
+
+  const selection = await resolveSelection({
+    profileFlag: flags.profile,
+    targetFlag: flags.target,
+    ...env,
+  });
+
+  const { config } = await loadProfileConfig(selection.workspaceRoot, selection.profile);
+  const { target, source } = resolveTarget(config, flags.target, {
+    allowUndeclared: options.allowUndeclaredTarget === true,
+    ...env,
+  });
+
+  return {
+    resolution: { ...selection, target, targetSource: source },
+    config,
+    target,
+  };
+}
+
+/**
+ * One target's secret store, without opening its database.
+ *
+ * `secrets push` holds two targets open at once and touches neither state,
+ * and `deploy` checks the cloud store while its Postgres is only reachable from
+ * inside Google's network. Opening a full runtime for either would fail on the
+ * part that is not needed.
+ */
+export async function openSecretStoreFor(
+  config: Config,
+  root: string,
+  target: string,
+): Promise<SecretStore> {
+  const declared = config.targets[target];
+  if (!declared) throw undeclaredTarget(target, config);
+  return openSecrets({ declared, config, root, target });
+}
+
+/**
+ * One target's blob store, for a caller with no use for a runtime.
+ *
+ * The sibling of `openSecretStoreFor` above, and here for the reason this file
+ * already gives: removal enumerates a target's objects and never dispatches a
+ * call, so a registry and a reconcile would only add parts that can fail.
+ *
+ * `area` reaches a root other than the profile's own. The default is the
+ * profile's blob tree; `profiles` is where a deployed revision reads its config
+ * from (ADR-023), which lives outside that tree and still belongs to the
+ * profile being removed.
+ */
+export async function openBlobStoreFor(
+  config: Config,
+  root: string,
+  target: string,
+  area?: string,
+): Promise<BlobStore> {
+  const declared = config.targets[target];
+  if (!declared) throw undeclaredTarget(target, config);
+
+  const input = { declared, config, root, target };
+  const storage = await openStorage(input, await openSecrets(input));
+  return area === undefined ? storage() : storage(area);
+}
+
+/** Mint the profile token if it does not exist yet. Returns it either way. */
+export async function ensureProfileToken(
+  credentials: SecretStore,
+  tokenRef: string,
+): Promise<{ token: string; created: boolean }> {
+  const existing = await credentials.get(tokenRef);
+  if (existing) return { token: existing, created: false };
+
+  const token = generateProfileToken();
+  await credentials.set(tokenRef, token);
+  return { token, created: true };
+}
+
+export { ownerPrincipal };

package/src/cli/runtime.ts

@@ -0,0 +1,34 @@
+/**
+ * The CLI's composition root — what a command gets handed before it runs.
+ *
+ * Three files, split along what each caller actually needs:
+ *
+ *   select.ts    which profile and target, and that target's secrets — the
+ *                part that opens no database
+ *   registry.ts  which providers exist, and keeping the skills among them
+ *                current; synchronous, and needs no adapters
+ *   open.ts      the whole runtime: database, storage, vault, dispatcher
+ *
+ * The seam is not cosmetic. `secrets push` holds two targets open at once and
+ * `deploy` reads manifests against a bucket it cannot reach, so both stop at
+ * `select.ts` and would fail on what `open.ts` does. This file stays a barrel
+ * because `#cli/runtime.ts` is the spelling `#server` and `#deployments` bind,
+ * and two test files import it directly.
+ */
+
+export {
+  ensureProfileToken,
+  openBlobStoreFor,
+  openSecretStoreFor,
+  ownerPrincipal,
+  resolveProfile,
+  type GlobalFlags,
+} from './runtime/select.ts';
+
+export {
+  buildRegistry,
+  buildRegistryWithWorkspace,
+  type OwnerLayerOptions,
+} from './runtime/registry.ts';
+
+export { openRuntime, type Runtime } from './runtime/open.ts';