@lanes-sh/link 0.1.0

package/src/deployments/steps.ts

@@ -0,0 +1,137 @@
+import { ConfigError } from '#profile';
+import { print, style, waiting, warn } from '#cli/output.ts';
+import type { DeployDriver, DeployStep } from './driver.ts';
+
+/**
+ * Running a driver's steps, and saying what happened to each.
+ *
+ * Split from `deploy.ts` because it is a different concern from the order those
+ * steps go in: this is what "a step succeeded", "a step is already done" and "a
+ * step is not ready yet" mean, and all three are decisions about a message
+ * rather than about a deployment. Keeping them together pushed that file past
+ * the size budget `src/architecture.test.ts` holds.
+ */
+
+export function printSteps(driver: DeployDriver, steps: readonly DeployStep[]): void {
+  print('');
+  for (const step of steps) {
+    print(`  ${style.dim(step.title)}`);
+    print(`    ${driver.tool} ${step.argv.join(' ')}`);
+  }
+}
+
+/**
+ * A failure that means "not yet" rather than "no".
+ *
+ * Enabling an API returns before the API is usable. The gap is seconds to a
+ * couple of minutes, and inside it Google answers calls to that service with a
+ * permission error rather than a "still starting" one — so the message an
+ * operator gets is indistinguishable from having the wrong role, on a project
+ * they own. This deploy enables seven APIs and then immediately uses all of
+ * them, which makes it the most likely thing in the repository to land in that
+ * window; a real deploy failed there, at the build, after uploading its source.
+ *
+ * `PERMISSION_DENIED` is genuinely ambiguous and is retried anyway. Waiting out
+ * a bounded budget before reporting a real permission problem costs a minute;
+ * failing a five-minute build because an API was enabled ninety seconds ago
+ * costs the whole deploy and reads as a misconfiguration nobody has.
+ */
+const UNREADY =
+  /SERVICE_DISABLED|has not been used in project|is not enabled|caller does not have permission|PERMISSION_DENIED/i;
+
+/** Exported for its tests: which failures are worth waiting out. */
+export function isUnready(stderr: string): boolean {
+  return UNREADY.test(stderr);
+}
+
+/**
+ * A failure that means the thing is already there.
+ *
+ * Every provisioning step is written to be run again, and on a second deploy all
+ * of them are. Google reports that as an error — `ALREADY_EXISTS`, `409`, "is
+ * the subject of a conflict", "you already own it" — and letting those through
+ * meant a successful deploy printed a screen of red for the expected case, which
+ * teaches an operator to skim past exactly the output that matters when
+ * something is actually wrong.
+ */
+const EXISTS = /ALREADY_EXISTS|already exists|subject of a conflict|already own it|HTTPError 409/i;
+
+export function isAlreadyThere(stderr: string): boolean {
+  return EXISTS.test(stderr);
+}
+
+/**
+ * Spent across the whole run rather than per step.
+ *
+ * The wait is for one event — the APIs this deploy just enabled becoming usable
+ * — so once any step has waited it out, the rest find them ready. A per-step
+ * budget would multiply one propagation delay by the number of steps behind it,
+ * and a deploy that can hang for a quarter of an hour is not more reliable than
+ * one that fails.
+ */
+const PROPAGATION_BUDGET_MS = 150_000;
+const BACKOFF_MS = [5_000, 10_000, 20_000, 30_000, 45_000];
+
+const sleep = (ms: number): Promise<void> => new Promise((resolve) => setTimeout(resolve, ms));
+
+export async function runSteps(
+  driver: DeployDriver,
+  steps: readonly DeployStep[],
+  /** Injectable so a test can assert the retry without sleeping through it. */
+  backoff: readonly number[] = BACKOFF_MS,
+): Promise<void> {
+  let budget = PROPAGATION_BUDGET_MS;
+
+  for (const step of steps) {
+    print('');
+    print(style.dim(`  ${step.title}`));
+
+    // A step that is allowed to have already happened is also one whose output
+    // is a wall of IAM policy. Captured rather than streamed, so this decides
+    // what to say about it — the long steps that need streaming are exactly the
+    // ones that are not allowed to fail.
+    const quiet = step.tolerateFailure === true;
+    let result = await driver.run(step.argv, { quiet });
+
+    for (const pause of backoff) {
+      if (result.ok || budget < pause || !isUnready(result.stderr)) break;
+      budget -= pause;
+
+      await waiting(
+        `not ready yet — an API this needs may have been enabled moments ago; retrying in ${Math.round(pause / 1000)}s`,
+        () => sleep(pause),
+      );
+      result = await driver.run(step.argv, { quiet });
+    }
+
+    if (result.ok) {
+      if (quiet) print(style.dim(`    ${style.green('+')} done`));
+      continue;
+    }
+
+    if (step.tolerateFailure) {
+      // The expected case on every deploy after the first, said as such.
+      // Anything else it tolerated is still worth seeing, because a tolerated
+      // failure that is not "already there" is how a deploy rolls a revision
+      // with no service account and finds out several minutes later.
+      print(
+        isAlreadyThere(result.stderr)
+          ? style.dim(`    ${style.green('=')} already there`)
+          : warn(`  ${firstLine(result.stderr)}`),
+      );
+      continue;
+    }
+
+    throw new ConfigError(`Deploy stopped: ${step.title} failed. ${result.stderr}`.trim());
+  }
+}
+
+/** The line of a `gcloud` failure that says what went wrong, without the trace. */
+function firstLine(stderr: string): string {
+  return (
+    stderr
+      .split('\n')
+      .map((line) => line.trim())
+      .find((line) => line.startsWith('ERROR:') || line.length > 0) ?? 'failed with no message'
+  );
+}

package/src/deployments/target.ts

@@ -0,0 +1,295 @@
+import type { AuditReader, AuditSink, AuditStore } from '#audit';
+import { ConfigError, layout, workspacePath, type Config, type TargetConfig } from '#profile';
+import type { SecretStore } from '#secrets';
+import { createFileSecretStore } from '#secrets';
+import type { BlobStore } from '#stores/blobs';
+import { createRuntimeState, type RuntimeState } from '#stores/state';
+import { createBlobAuditStore } from './adapters/audit-blob.ts';
+
+/**
+ * Turning a declared target into a set of open adapters.
+ *
+ * A target names where a profile runs — `local`, `cloud` — and the whole of
+ * that difference is the two backends below: where credentials are kept, and
+ * where bytes go. State and the audit log ride the second of those rather than
+ * declaring backends of their own. Connections, providers, policy
+ * and limits are declared once and apply to every target, which is what lets a
+ * deployment change nothing at the application layer.
+ *
+ * **This is the only place the mapping exists.** It used to be three `switch`
+ * statements two hundred lines apart inside the CLI's runtime assembly, which
+ * meant adding a target meant finding all three and meant the CLI knew what
+ * Cloud Run was. Adding one is now a folder beside this file and a case here.
+ *
+ * Adapters are named for the *protocol* and deployments for the *vendor*
+ * (ADR-013). `s3` needs an endpoint and a key pair; R2, MinIO, Supabase Storage
+ * and AWS differ only in those values, so a vendor name on the adapter would
+ * claim a coupling that does not exist. The host is a deploy-time choice; the
+ * protocol is the interface.
+ *
+ * Cloud adapters are imported *inside* their branch, deliberately: a local run
+ * never loads the S3 or Secret Manager client, so a missing GCP credential
+ * cannot fail a `lanes link start` that was never going to talk to Google.
+ */
+
+export interface TargetInput {
+  readonly declared: TargetConfig;
+  readonly config: Config;
+  readonly root: string;
+  readonly target: string;
+}
+
+/**
+ * Blob storage, rooted per area.
+ *
+ * Three consumers want it with different roots — the provider blobs a
+ * `ProviderContext` is scoped from, the skills directory, and the vault document
+ * — and resolving the S3 key pair once rather than three times is why this is a
+ * factory rather than a store. On a Secret Manager credential store each of
+ * those resolutions is a network call.
+ *
+ * `area` is a location *within* the target: a workspace-relative directory for
+ * the filesystem adapter, a key prefix for S3. Omitting it gives the profile's
+ * own blob root, which is what providers get.
+ *
+ * That last sentence was true of `filesystem` and false of the two bucket
+ * adapters, which read an omitted area as the empty prefix — so a deployed
+ * instance scattered memory and attachments across the root of the bucket while
+ * its state and log sat under `data/<profile>/`. One profile per bucket made it
+ * look deliberate. It was not: it put provider blobs outside the prefix the
+ * write grant is conditioned on, so the first write 403'd.
+ */
+export type StorageFactory = (area?: string) => BlobStore;
+
+export async function openSecrets(input: TargetInput): Promise<SecretStore> {
+  const { declared, config, root, target } = input;
+
+  switch (declared.credentials.adapter) {
+    case 'file':
+      return createFileSecretStore({
+        path: workspacePath(
+          root,
+          declared.credentials.path ?? layout.credentials(config.instance.profile),
+        ),
+      });
+
+    case 'gcp-secret-manager': {
+      if (!declared.credentials.project) {
+        throw new ConfigError(
+          `targets.${target}.credentials.project is required for the gcp-secret-manager adapter.`,
+        );
+      }
+      const { GcpSecretManagerStore } = await import('./adapters/gcp-secret-manager.ts');
+      return new GcpSecretManagerStore({ project: declared.credentials.project });
+    }
+  }
+}
+
+/**
+ * Runtime state — connections, provider state, cursors.
+ *
+ * Not a switch, for the same reason `openAudit` is not one: state is one
+ * object per key in whatever `BlobStore` the target already opened. It used to
+ * be `sqlite` or `postgres` behind a `database:` block, which was a query
+ * engine and a second service bought for a workload that is entirely point
+ * reads. See `#stores/state`.
+ *
+ * Its own root, `layout.state`, so it is not addressable from a provider's
+ * blob namespace — the same containment `openAudit` relies on.
+ */
+export function openState(storage: StorageFactory, profile: string): RuntimeState {
+  return createRuntimeState(storage(layout.state(profile)));
+}
+
+/**
+ * The audit log.
+ *
+ * Not a switch, because there is only one answer: objects in whatever blob
+ * store the target already opened. That is the point of the layout — a
+ * directory under the profile locally and a prefix in the bucket deployed are
+ * the same tree, so there is one sink rather than one per target and no
+ * conformance question about whether the two agree.
+ *
+ * Named as its own factory rather than folded into `openStorage` because the
+ * log is not provider blobs: it gets a root a provider cannot be namespaced
+ * into (`layout.audit`), and that separation is what keeps ADR-007's wall
+ * intact.
+ */
+export function openAudit(storage: StorageFactory, profile: string): AuditStore {
+  return createBlobAuditStore({ storage: storage(layout.audit(profile)) });
+}
+
+/**
+ * The log, plus whatever copies the target asks for.
+ *
+ * The blob sink is always first and always awaited — `fanOutAudit` treats the
+ * first as the record of truth and everything after it as best-effort. That
+ * ordering is fixed here rather than declared in config, because "which sink
+ * is the log" is not a preference: a sink that can fail cannot carry a
+ * guarantee that says every invocation is recorded.
+ *
+ * Returned as `{ sink, reader }` because the two halves diverge once copies
+ * exist: `tail` and `verify` mean the durable log, never the fan-out.
+ */
+export async function openAuditSinks(
+  input: TargetInput,
+  storage: StorageFactory,
+  secrets: SecretStore,
+  log?: (message: string) => void,
+): Promise<{ sink: AuditSink; reader: AuditReader }> {
+  const durable = openAudit(storage, input.config.instance.profile);
+  const declared = input.declared.audit?.sinks ?? [];
+  if (declared.length === 0) return { sink: durable, reader: durable };
+
+  const secondaries: AuditSink[] = [];
+  for (const sink of declared) {
+    if (sink.kind === 'stdout') {
+      const { createStdoutAuditSink } = await import('#audit/stdout.ts');
+      secondaries.push(createStdoutAuditSink());
+      continue;
+    }
+
+    const headers = sink.headers_ref ? await secrets.get(sink.headers_ref) : null;
+    const { createOtlpAuditSink } = await import('./adapters/otlp.ts');
+    secondaries.push(
+      createOtlpAuditSink({
+        endpoint: sink.endpoint,
+        ...(headers ? { headers: parseHeaders(headers, sink.headers_ref!) } : {}),
+        ...(sink.service_name ? { serviceName: sink.service_name } : {}),
+      }),
+    );
+  }
+
+  const { fanOutAudit } = await import('#audit/fanout.ts');
+  return {
+    sink: fanOutAudit({
+      primary: durable,
+      secondaries,
+      ...(log ? { onError: log } : {}),
+    }),
+    reader: durable,
+  };
+}
+
+/**
+ * `key=value,key=value`, the form the OTel SDKs use for `OTEL_EXPORTER_*_HEADERS`.
+ *
+ * Read from the credential store rather than the config file: these carry an
+ * API key, and `profile/secret-detection.ts` would refuse one written inline.
+ */
+function parseHeaders(raw: string, ref: string): Record<string, string> {
+  const headers: Record<string, string> = {};
+
+  for (const pair of raw.split(',')) {
+    const at = pair.indexOf('=');
+    if (at === -1) {
+      throw new ConfigError(
+        `The value at "${ref}" is not OTLP headers. Expected key=value pairs separated by commas.`,
+      );
+    }
+    headers[pair.slice(0, at).trim()] = pair.slice(at + 1).trim();
+  }
+  return headers;
+}
+
+export async function openStorage(
+  input: TargetInput,
+  secrets: SecretStore,
+): Promise<StorageFactory> {
+  const { declared, config, root, target } = input;
+
+  switch (declared.storage.adapter) {
+    case 'filesystem': {
+      const { createFilesystemBlobStore } = await import('./adapters/filesystem.ts');
+      const base = declared.storage.path ?? layout.blobs(config.instance.profile);
+      return (area) =>
+        createFilesystemBlobStore({ root: workspacePath(root, area === undefined ? base : area) });
+    }
+
+    case 'gcs': {
+      // No key pair: this authenticates as whatever identity is already
+      // present — the Cloud Run service account the deploy granted
+      // objectAdmin, or the operator's own gcloud credentials locally. That is
+      // the whole reason it exists beside `s3`, which needs HMAC keys minted
+      // by hand in a console.
+      const { bucket, prefix } = declared.storage;
+      if (!bucket) {
+        throw new ConfigError(`targets.${target}.storage.bucket is required for the gcs adapter.`);
+      }
+
+      const { createGcsBlobStore } = await import('./adapters/gcs.ts');
+      const base = prefix ?? '';
+      const root = layout.blobs(config.instance.profile);
+
+      return (area) =>
+        createGcsBlobStore({
+          bucket,
+          prefix: `${base}${area ?? root}/`,
+        });
+    }
+
+    case 's3': {
+      const { bucket, endpoint, region, prefix } = declared.storage;
+      if (!bucket) {
+        throw new ConfigError(`targets.${target}.storage.bucket is required for the s3 adapter.`);
+      }
+
+      const accessKeyId = await requireSecret(
+        secrets,
+        declared.storage.access_key_id_ref,
+        `targets.${target}.storage.access_key_id_ref`,
+        target,
+      );
+      const secretAccessKey = await requireSecret(
+        secrets,
+        declared.storage.secret_access_key_ref,
+        `targets.${target}.storage.secret_access_key_ref`,
+        target,
+      );
+
+      const { createS3BlobStore } = await import('./adapters/s3.ts');
+      const base = prefix ?? '';
+      const root = layout.blobs(config.instance.profile);
+
+      return (area) =>
+        createS3BlobStore({
+          bucket,
+          accessKeyId,
+          secretAccessKey,
+          ...(endpoint !== undefined ? { endpoint } : {}),
+          ...(region !== undefined ? { region } : {}),
+          prefix: `${base}${area ?? root}/`,
+        });
+    }
+  }
+}
+
+/**
+ * Resolve a declared secret ref, or say which one is missing and how to store
+ * it.
+ *
+ * Two refs make the same two mistakes available twice over, and "undefined is
+ * not a string" from inside an S3 client is not a diagnosis.
+ */
+async function requireSecret(
+  secrets: SecretStore,
+  ref: string | undefined,
+  field: string,
+  target: string,
+): Promise<string> {
+  if (!ref) {
+    throw new ConfigError(
+      `${field} is required for the s3 adapter — the key is a credential, so config names it ` +
+        'rather than carrying it.',
+    );
+  }
+
+  const value = await secrets.get(ref);
+  if (!value) {
+    throw new ConfigError(
+      `${field} names "${ref}", which is not in this target's secret store. ` +
+        `Store it with: lanes link secrets set ${ref} --target ${target}`,
+    );
+  }
+  return value;
+}

package/src/deployments/upload.ts

@@ -0,0 +1,207 @@
+import {
+  DATA_DIR,
+  WORKSPACE_FILE,
+  layout,
+  listProfiles,
+  workspaceFiles,
+  type Config,
+  type TargetConfig,
+} from '#profile';
+import { ConfigDocument, ensureSetupConnection, repairLines, repaired } from '#cli/config-edit.ts';
+import { ok, print, style, warn } from '#cli/output.ts';
+
+/**
+ * What a deploy sends up, and the state it sends it in.
+ *
+ * Split out of `deploy.ts`, which had grown to hold two subjects: rolling a
+ * revision, and the workspace that revision reads its config from. They meet at
+ * one line in `deploy` and share nothing else — no state, no ordering beyond
+ * "before the rollout" — and keeping them apart is what makes the pair of rules
+ * below legible as a pair.
+ *
+ * Those rules are the reason this is a subject rather than a utility. Which
+ * files go up is an allowlist, and which files get repaired on the way is
+ * `listProfiles`, and the two must be scoped identically without being the same
+ * question. Answering them forty lines apart, among rollout steps, is how they
+ * drift.
+ */
+
+/**
+ * The store URL a deployed instance reads its config from.
+ *
+ * The same bucket the target already declares — config sits beside state, the
+ * log, memory and skills rather than in a place of its own. `undefined` for a
+ * target on the filesystem adapter, which is not a thing anyone deploys but is
+ * a thing `--dry-run` can be pointed at.
+ */
+export function deployedWorkspace(declared: TargetConfig): string | undefined {
+  const { adapter, bucket, prefix } = declared.storage;
+  if (adapter !== 'gcs' && adapter !== 's3') return undefined;
+  if (!bucket) return undefined;
+
+  return prefix ? `gs://${bucket}/${prefix.replace(/\/$/, '')}` : `gs://${bucket}`;
+}
+
+/**
+ * What a deploy sends up: an allowlist, never a sync with exclusions.
+ *
+ * `data/` holds the encrypted credential store **and its key file**, and the
+ * deployed target reads credentials from Secret Manager instead. Sending it
+ * would put a decryptable credential document in a bucket — the exact thing
+ * the `.dockerignore` exclusion exists to prevent, which is why that comment
+ * calls itself load-bearing rather than an optimisation.
+ *
+ * An allowlist because the failure modes are not symmetric: a config file this
+ * forgets means an endpoint that will not boot, and a credential this includes
+ * by accident means a credential in a bucket. Forgetting is loud.
+ *
+ * **Two areas inside `data/` are authored rather than accumulated**, since
+ * ADR-030 moved skills and provider manifests into the profile that owns them.
+ * They have to go up or a deployed instance loses both — the regression ADR-014
+ * §2 fixed for skills, reintroduced by where they now live. So this reaches
+ * into `data/` for exactly those two, by whole path segment and never by
+ * prefix: `data/personal/skills.detour/` is not `skills.d`, and the difference
+ * between matching it and not is a credential in a bucket.
+ */
+export function isWorkspaceConfig(key: string, profile?: string | undefined): boolean {
+  if (key === WORKSPACE_FILE) return true;
+
+  // One profile when the deploy names one, so a workspace holding personal and
+  // work does not push both into a bucket only one of them is for. The same
+  // question for both shapes, asked once.
+  const owner = authoredAreaOwner(key);
+  if (owner !== null) return profile === undefined || owner === profile;
+
+  if (!key.startsWith('profiles/') || !key.endsWith('.yaml')) return false;
+  return profile === undefined || key === `profiles/${profile}.yaml`;
+}
+
+/**
+ * The profile whose authored area holds `key`, or null for anything else.
+ *
+ * Composed back out of `layout` rather than compared against literals, so a
+ * renamed directory moves both this and the store that reads it, or neither.
+ * Requires a fourth segment: `data/personal/skills.d` names the directory, and
+ * a directory is not a file to send.
+ */
+function authoredAreaOwner(key: string): string | null {
+  const segments = key.split('/');
+  if (segments.length < 4 || segments[0] !== DATA_DIR) return null;
+
+  const owner = segments[1]!;
+  if (owner.length === 0) return null;
+
+  const area = `${DATA_DIR}/${owner}/${segments[2]}`;
+  return area === layout.skills(owner) || area === layout.providers(owner) ? owner : null;
+}
+
+/**
+ * Give every profile about to be uploaded its setup surface.
+ *
+ * **Scoped exactly as the upload is**, because a profile this deploy sends is a
+ * profile the endpoint will serve: repairing a narrower set would leave a served
+ * profile without the surface, which is this bug one profile over. Note what
+ * `flags.profile` does not mean — it is the flag alone, so a profile resolved
+ * from `LANES_LINK_PROFILE` leaves it undefined and both this and the upload
+ * read that as the whole workspace. Surprising, pre-existing in the upload, and
+ * fixed there rather than here so the two cannot drift apart.
+ *
+ * *Which files are profiles* comes from `listProfiles`, never from
+ * `isWorkspaceConfig`: the allowlist decides what is safe to *copy*, so it
+ * happily sends a committed `personal.example.yaml` and a nested
+ * `profiles/archive/old.yaml` as bytes, while this opens and validates what it
+ * is handed — which turned that template into a `ConfigError` aborting the
+ * deploy after provisioning had already made cloud resources.
+ *
+ * A profile that cannot be read is warned about rather than fatal: the repair is
+ * a courtesy on the way past, and the upload still sends the file. Not silent,
+ * though — nothing else here widens a policy without being asked.
+ */
+export async function repairSetupSurface(
+  workspaceRoot: string,
+  profile: string | undefined,
+): Promise<void> {
+  for (const name of await listProfiles(workspaceRoot)) {
+    if (profile !== undefined && name !== profile) continue;
+
+    try {
+      const document = await ConfigDocument.open(workspaceRoot, name);
+      const repair = ensureSetupConnection(document);
+      if (!repaired(repair)) continue;
+
+      await document.save();
+
+      print(ok(`gave ${style.bold(name)} the setup surface`));
+      for (const change of repairLines(repair)) print(`      ${style.dim(change)}`);
+      print(`      ${style.dim('an agent can now see what is connected here, instead of guessing')}`);
+    } catch (error) {
+      print(
+        warn(
+          `could not give ${name} the setup surface: ${error instanceof Error ? error.message.split('\n')[0] : String(error)}`,
+        ),
+      );
+    }
+  }
+}
+
+/**
+ * Copy the workspace's config up.
+ */
+export async function uploadWorkspace(
+  root: string,
+  destination: string,
+  profile: string | undefined,
+): Promise<void> {
+  const local = workspaceFiles(root);
+  const remote = workspaceFiles(destination);
+
+  let copied = 0;
+  for (const entry of await local.list('')) {
+    if (!isWorkspaceConfig(entry.key, profile)) continue;
+
+    const bytes = await local.get(entry.key);
+    if (bytes === null) continue;
+
+    await remote.put(entry.key, bytes, { contentType: 'application/yaml' });
+    copied += 1;
+  }
+
+  print(ok(`uploaded ${copied} config file${copied === 1 ? '' : 's'} to ${destination}`));
+}
+
+/**
+ * Put the config where this target's endpoint reads it.
+ *
+ * Split from `deploy` because the two answer different questions. A deploy
+ * asks "what should this revision run"; this asks "where does the config a
+ * running endpoint reads actually live", and the answer stopped being "in the
+ * image" at ADR-023. Once config lives in a bucket, copying it there is a
+ * consequence of *editing* it, not of rolling a revision — which is what lets
+ * `connect` stop ending in `lanes link deploy` (ADR-029).
+ *
+ * `null` when the target reads the same files the CLI just wrote: a local
+ * target's endpoint opens the workspace directly, so there is nowhere to
+ * publish to and nothing to copy.
+ *
+ * Scoped to the profile that was edited, deliberately more narrowly than
+ * `deploy` scopes itself. `deploy` passes `flags.profile` — the flag alone —
+ * so a profile resolved from `LANES_LINK_PROFILE` leaves it undefined and the
+ * whole workspace goes up. An edit knows exactly which profile it touched, and
+ * sending a sibling profile to a bucket because someone edited this one is a
+ * surprise nobody asked for.
+ */
+export async function publishWorkspace(input: {
+  readonly config: Config;
+  readonly workspaceRoot: string;
+  readonly target: string;
+  readonly profile: string;
+}): Promise<string | null> {
+  const declared = input.config.targets[input.target];
+  if (!declared) return null;
+
+  const destination = deployedWorkspace(declared);
+  if (!destination) return null;
+
+  await uploadWorkspace(input.workspaceRoot, destination, input.profile);
+  return destination;
+}