@lanes-sh/link 0.2.2 → 0.3.1

package/src/connectivity/auth/oauth-jwt/key.ts

@@ -0,0 +1,148 @@
+import { z } from 'zod';
+
+/**
+ * The key half of RFC 7523: a private key on disk, and the assertion it signs.
+ *
+ * Split from `index.ts` because it is the only part with no I/O — no store, no
+ * network — which is what makes the claim set and the signature testable
+ * against a locally generated key rather than against a live token endpoint.
+ *
+ * Nothing here knows which vendor issued the key. The layout below is the one
+ * every authorization server that accepts this grant ships, and the endpoint to
+ * present the assertion at comes from the key file itself rather than from a
+ * constant, so adding a second vendor is a manifest and no code.
+ */
+
+/**
+ * The issued key file, as the vendor's console writes it.
+ *
+ * Parsed rather than trusted: the common mistake is pasting the *client* JSON —
+ * the one with `installed` or `web` at the top level — which is a different
+ * file with a different purpose and would otherwise fail much later, at the
+ * token endpoint, as an unexplained 400.
+ */
+export const assertionKeySchema = z.object({
+  /** Who the assertion is from. Also the address a resource is shared with. */
+  client_email: z.string().min(1),
+  /** PKCS#8 PEM. */
+  private_key: z.string().min(1),
+  /** Where the assertion is exchanged. Read from the file so no vendor is named here. */
+  token_uri: z.url(),
+  /** Names which key signed it, for a server holding more than one. */
+  private_key_id: z.string().optional(),
+});
+
+export type AssertionKey = z.infer<typeof assertionKeySchema>;
+
+export function parseAssertionKey(raw: string, ref: string): AssertionKey {
+  let json: unknown;
+  try {
+    json = JSON.parse(raw);
+  } catch {
+    throw new Error(
+      `The key at ${ref} is not JSON. It should be the whole file the console downloaded, pasted verbatim.`,
+    );
+  }
+
+  const parsed = assertionKeySchema.safeParse(json);
+  if (parsed.success) return parsed.data;
+
+  // The two files are easy to confuse and the console offers both on adjacent
+  // pages, so say which one is in hand rather than listing missing fields.
+  const shape = json as Record<string, unknown> | null;
+  if (shape && (shape['installed'] !== undefined || shape['web'] !== undefined)) {
+    throw new Error(
+      `The key at ${ref} is an OAuth *client* file, not an account key. That one is for the ` +
+        'browser flow. The key needed here is downloaded from the account itself and has ' +
+        '"private_key" in it.',
+    );
+  }
+
+  throw new Error(
+    `The key at ${ref} is missing ${parsed.error.issues.map((issue) => issue.path.join('.')).join(', ')}.`,
+  );
+}
+
+/** JWT's own encoding: base64 with a URL-safe alphabet and no padding. */
+function base64url(bytes: Uint8Array | string): string {
+  const raw =
+    typeof bytes === 'string'
+      ? btoa(bytes)
+      : btoa(String.fromCharCode(...new Uint8Array(bytes)));
+  return raw.replaceAll('+', '-').replaceAll('/', '_').replaceAll('=', '');
+}
+
+/**
+ * PKCS#8 PEM to the DER bytes `importKey` wants.
+ *
+ * Tolerant of how the key arrives: a console download carries real newlines, a
+ * value pasted through an environment variable or a JSON string often carries
+ * literal `\n` instead, and both are the same key. Rejecting the second would
+ * be a failure whose cause is invisible in a terminal.
+ */
+function derFromPem(pem: string): Uint8Array {
+  const body = pem
+    .replaceAll('\\n', '\n')
+    .replace(/-----[^-]+-----/g, '')
+    .replace(/\s+/g, '');
+
+  const binary = atob(body);
+  const der = new Uint8Array(binary.length);
+  for (let index = 0; index < binary.length; index += 1) der[index] = binary.charCodeAt(index);
+  return der;
+}
+
+/** How long the assertion is good for. Kept short: it is minted per exchange. */
+const ASSERTION_LIFETIME_SECONDS = 3600;
+
+/**
+ * Sign the assertion this grant exchanges for a token.
+ *
+ * `sub` is what makes one identity act as another, and it is present only when
+ * the caller supplies one — an assertion carrying an empty `sub` is not the
+ * same request as one carrying none, and servers treat it as malformed rather
+ * than as absent.
+ */
+export async function signAssertion(input: {
+  readonly key: AssertionKey;
+  readonly scopes: readonly string[];
+  /** The account to act as, where the key is only permitted to borrow one. */
+  readonly subject?: string | undefined;
+  /** Injected by tests so the claim set is checkable. */
+  readonly now?: number;
+}): Promise<string> {
+  const issuedAt = Math.floor((input.now ?? Date.now()) / 1000);
+
+  const header = {
+    alg: 'RS256',
+    typ: 'JWT',
+    ...(input.key.private_key_id ? { kid: input.key.private_key_id } : {}),
+  };
+
+  const claims = {
+    iss: input.key.client_email,
+    scope: input.scopes.join(' '),
+    aud: input.key.token_uri,
+    iat: issuedAt,
+    exp: issuedAt + ASSERTION_LIFETIME_SECONDS,
+    ...(input.subject ? { sub: input.subject } : {}),
+  };
+
+  const signingInput = `${base64url(JSON.stringify(header))}.${base64url(JSON.stringify(claims))}`;
+
+  const privateKey = await crypto.subtle.importKey(
+    'pkcs8',
+    derFromPem(input.key.private_key) as unknown as ArrayBuffer,
+    { name: 'RSASSA-PKCS1-v1_5', hash: 'SHA-256' },
+    false,
+    ['sign'],
+  );
+
+  const signature = await crypto.subtle.sign(
+    'RSASSA-PKCS1-v1_5',
+    privateKey,
+    new TextEncoder().encode(signingInput) as unknown as ArrayBuffer,
+  );
+
+  return `${signingInput}.${base64url(new Uint8Array(signature))}`;
+}

package/src/connectivity/auth/resolve.ts

@@ -42,7 +42,7 @@ export function credentialResolver(
     const ref = credentialRefForConnection(manifest, connectionId)!;
     const value = await secrets.get(ref);
     if (!value) {
-      throw new Error(`No credential stored at ${ref}. Run: lanes link connect ${providerId}`);
+      throw new Error(`No credential stored at ${ref}. Connecting "${providerId}" again for this profile and target would store one.`);
     }
 
     switch (auth.kind) {

package/src/connectivity/auth/token.ts

@@ -2,6 +2,7 @@ import { type ProviderManifest } from '#connectivity';
 import type { ProviderRegistry } from '#registry';
 import type { SecretStore } from '#secrets';
 import { credentialResolver } from './resolve.ts';
+import { resolveAssertionToken, storedAssertionFor } from './oauth-jwt/index.ts';
 import { CredentialOAuthProvider } from './oauth-authcode/provider.ts';
 
 /**
@@ -81,6 +82,16 @@ export async function bearerTokenAsStored(
 ): Promise<string | null> {
   if (manifest.auth.kind !== 'oauth') return bearerToken(manifest, connectionId, secrets);
 
+  // An assertion credential has no token stored to prefer — the token is minted
+  // from the key, which is what "as stored" means here. Without this branch the
+  // identity call `connect` makes immediately after writing the pointer reads
+  // `access_token` off a blob that has none, sends no Authorization header, and
+  // reports the credential rejected.
+  const assertion = await storedAssertionFor(manifest, connectionId, secrets);
+  if (assertion) {
+    return resolveAssertionToken({ manifest, connectionId, stored: assertion, credentials: secrets });
+  }
+
   const provider = new CredentialOAuthProvider({
     manifest,
     connectionId,

package/src/connectivity/index.ts

@@ -53,6 +53,7 @@ export { defineLocalProvider, defineProviderWithCapabilities } from './provider.
 export type {
   ProviderManifest,
   ConnectorConfig,
+  AuthAssertion,
   AuthBroker,
   AuthConfig,
   SetupDeclaration,
@@ -69,6 +70,7 @@ export {
   bundleSchema,
   credentialRefForConnection,
   rotatableCredentialRefs,
+  hasOwnClientPath,
   setupRequirements,
   UNNAMED_ID,
   RESERVED_PROVIDER_IDS,

package/src/connectivity/manifest/auth.ts

@@ -1,5 +1,6 @@
 import { z } from 'zod';
 import { credentialRef, identifier } from './primitives.ts';
+import { setupSchema } from './setup.ts';
 
 /**
  * Credential types — how we prove who we are, orthogonal to how we connect.
@@ -34,14 +35,86 @@ export const authBrokerSchema = z.object({
 
 export type AuthBroker = z.infer<typeof authBrokerSchema>;
 
+/**
+ * A second way in, for an authorization server that also accepts an assertion.
+ *
+ * RFC 7523: instead of a person approving a consent screen, the operator holds
+ * a private key, signs a short-lived JWT with it, and exchanges that for an
+ * access token. There is no refresh token because there is nothing to refresh —
+ * a new assertion is signed whenever the last token ages out — which is the
+ * whole reason this exists beside `oauth`. An authorization-code refresh token
+ * can be expired by the issuer's own policy; a key the operator holds cannot.
+ *
+ * Declared *on* the OAuth block rather than as a fourth `kind`, because it is
+ * an alternative arrangement for the same provider rather than a different
+ * provider. Everything that branches on `kind` — where the credential lands,
+ * what setup requires, which refs a deployed revision may rewrite — is
+ * unchanged, and a manifest that omits this reads and behaves exactly as before.
+ *
+ * Which one a connection actually uses is not recorded here or in config. The
+ * stored credential's *shape* is the switch, the same way an `oauth_apps` entry
+ * is the switch between a broker's client and the operator's own.
+ */
+export const authAssertionSchema = z.object({
+  /**
+   * What the operator types after `--auth`, and how a chosen method is named
+   * back to them.
+   *
+   * The provider's word rather than the protocol's. "Assertion" is what this is
+   * to the authorization server and means nothing to the person holding the
+   * file; they downloaded a service account key, and that is what the prompt
+   * and the flag should say. Keeping it here is also what stops the CLI from
+   * learning a vendor's vocabulary in order to print it.
+   */
+  method: identifier,
+  /** The short name shown beside the choice — a noun, not a sentence. */
+  label: z.string().min(1),
+  /**
+   * Whether the assertion may stand for itself, or must name a user to act as.
+   *
+   * `optional` — the key is an identity in its own right, and reaches whatever
+   * has been shared with it. `required` — it can only borrow someone else's,
+   * so a connection without a subject would authenticate cleanly and then find
+   * nothing there. The CLI refuses a blank subject on `required` for that
+   * reason: the failure is otherwise a 404 on every call with no explanation.
+   */
+  delegation: z.enum(['optional', 'required']).default('optional'),
+  /**
+   * Where the profile-shared key lives.
+   *
+   * Shared, not per-connection: one key covers every provider of a vendor, and
+   * asking for it once per provider would be seven pastes of the same file.
+   * The per-connection half is the subject, which is not a secret and is small
+   * enough to sit in the pointer the connection stores.
+   */
+  key_ref: credentialRef,
+  /** One line for the choice prompt: what this method reaches, and what it does not. */
+  reach: z.string().min(1),
+  /**
+   * What to call the account this acts as, when it acts as one.
+   *
+   * Asked per connection and stored beside the pointer. Not a secret — it is an
+   * address — but it lives in the credential store rather than in config
+   * because it is half of a credential, and splitting a credential across two
+   * files is how the halves come to disagree.
+   */
+  subject_label: z.string().min(1),
+  /** The console walkthrough for this method, rendered by the same code as `setup`. */
+  setup: setupSchema,
+});
+
+export type AuthAssertion = z.infer<typeof authAssertionSchema>;
+
 export const authOAuthSchema = z.object({
   kind: z.literal('oauth'),
   /**
    * `dynamic` — the authorization server offers Dynamic Client Registration, so
    * we register ourselves and the operator does nothing at all (Notion, Linear).
    *
-   * `manual` — the vendor requires a pre-registered client, so the operator
-   * supplies an id and secret (Google, including for Google's own MCP servers).
+   * `manual` — the vendor requires a pre-registered client. Who supplies it is
+   * the profile's to decide and not this field's: an id and secret the operator
+   * registered (Google, if they choose to), or the client behind `broker`.
+   * `manual` says only that self-registration is not on offer.
    */
   registration: z.enum(['dynamic', 'manual']).default('dynamic'),
   /** Which `oauth_apps` entry holds the client, for `manual`. Shared across providers of a vendor. */
@@ -57,6 +130,30 @@ export const authOAuthSchema = z.object({
    * that claimed one or the other would be wrong half the time.
    */
   broker: authBrokerSchema.optional(),
+  /**
+   * The other way in, where the vendor offers one. Absent means browser or nothing.
+   *
+   * Additive and inert on its own: declaring it makes `connect` offer a choice
+   * and makes the resolver able to read an assertion credential. It changes
+   * nothing about a connection that authorised in a browser.
+   */
+  assertion: authAssertionSchema.optional(),
+  /**
+   * Whether a token response carrying no refresh token is a failure.
+   *
+   * `required` — it is, and stopping is kinder than succeeding: the connection
+   * would work until the access token expires and then quietly stop. Google
+   * omits one when the account was already authorised for the app, which is a
+   * real and recoverable mistake.
+   *
+   * `optional` — the vendor issues a long-lived token and no refresh token is
+   * the normal, successful answer. Slack does this unless token rotation is
+   * enabled on the app, so demanding one would refuse every connection that
+   * worked.
+   */
+  refresh_token: z.enum(['required', 'optional']).default('required'),
+  /** Where the operator withdraws a grant, named in the refusal above. */
+  revoke_url: z.url().optional(),
   scopes: z.array(z.string()).default([]),
   /**
    * Usually discovered from the resource's metadata; set only to override.

package/src/connectivity/manifest/identity.ts

@@ -30,6 +30,18 @@ export const identitySchema = z.discriminatedUnion('kind', [
     url: z.url(),
     /** Dotted path into the JSON body, e.g. `emailAddress` or `user.emailAddress`. */
     field: z.string().min(1),
+    /**
+     * A second path, shown in brackets, where `field` alone is not unique.
+     *
+     * Almost no provider needs one: an address identifies a Google or iCloud
+     * account globally, and a GitHub login is unique across GitHub. Slack is
+     * the exception, because the thing it calls a user is scoped to a
+     * workspace — the same person in two workspaces answers `auth.test` with
+     * the same `user`, and one account string is how `settleIdentity` decides a
+     * connect is a *reconnect*. Without this, connecting a second workspace
+     * matches the first and overwrites its credential.
+     */
+    qualifier: z.string().min(1).optional(),
   }),
   z.object({
     kind: z.literal('tool'),

package/src/connectivity/manifest/index.ts

@@ -22,11 +22,13 @@ export {
 
 export {
   authNoneSchema,
+  authAssertionSchema,
   authBrokerSchema,
   authOAuthSchema,
   authSchema,
   authStrategySchema,
   authTokenSchema,
+  type AuthAssertion,
   type AuthBroker,
   type AuthConfig,
 } from './auth.ts';
@@ -43,4 +45,4 @@ export {
 } from './provider.ts';
 
 export type { SetupRequirement, SetupNeeds } from './requirements.ts';
-export { setupRequirements, UNNAMED_ID } from './requirements.ts';
+export { hasOwnClientPath, setupRequirements, UNNAMED_ID } from './requirements.ts';

package/src/connectivity/manifest/provider.ts

@@ -65,7 +65,7 @@ export const providerManifestSchema = z.object({
 export type ProviderManifest = z.infer<typeof providerManifestSchema>;
 
 /** Provider ids reserved for the owner layer. */
-export const RESERVED_PROVIDER_IDS: readonly string[] = ['memory', 'skills', 'vault', 'setup'];
+export const RESERVED_PROVIDER_IDS: readonly string[] = ['memory', 'skills', 'vault', 'setup', 'identity'];
 
 /**
  * Validate a manifest, with the cross-field rules the schema alone cannot
@@ -114,18 +114,47 @@ export function defineProvider(input: unknown): ProviderManifest {
         `Provider "${manifest.id}": a broker supplies a pre-registered client, so auth must declare registration "manual" and an "app" naming the oauth_apps entry that overrides it.`,
       );
     }
-    // An MCP provider hands the exchange to the SDK, which posts to the token
-    // endpoint with whatever `clientInformation()` returned. There is no seam
-    // to route that through a broker without reimplementing its auth path, so
-    // this is refused at definition rather than discovered after consent.
+    if (!manifest.auth.authorize_url) {
+      throw new Error(
+        `Provider "${manifest.id}": a broker performs the exchange, but the browser still goes to the vendor, so auth.authorize_url is required.`,
+      );
+    }
+    // An MCP provider hands the whole flow to the SDK, which posts to the token
+    // endpoint with whatever `clientInformation()` returned and has nowhere to
+    // route an exchange somebody else performs. Declaring both endpoints is
+    // what opts it off that path and onto the direct one, where the exchange is
+    // ours — so on an mcp connector the two arrive together or the manifest is
+    // describing a flow that cannot run. Refused here rather than discovered
+    // after the operator has already approved a consent screen. See ADR-040.
+    if (manifest.connector.kind === 'mcp' && !manifest.auth.token_url) {
+      throw new Error(
+        `Provider "${manifest.id}": an mcp connector runs the exchange through the SDK, which cannot route it through a broker, unless the manifest declares its own endpoints. Add auth.token_url beside auth.authorize_url, or drop the broker and register dynamically.`,
+      );
+    }
+  }
+
+  if (manifest.auth.kind === 'oauth' && manifest.auth.assertion) {
+    // Same seam, same absence as the broker rule above. The SDK owns an mcp
+    // provider's exchange and takes a client, not a signed assertion — so the
+    // choice would be offered, accepted, and then have nowhere to go.
     if (manifest.connector.kind === 'mcp') {
       throw new Error(
-        `Provider "${manifest.id}": an mcp connector runs the exchange through the SDK, which cannot route it through a broker. Register a client (registration "manual") or use dynamic registration.`,
+        `Provider "${manifest.id}": an mcp connector runs the exchange through the SDK, which cannot present a signed assertion. Remove auth.assertion.`,
       );
     }
-    if (!manifest.auth.authorize_url) {
+    // The assertion carries `aud` from the key file, but the *scopes* it claims
+    // come from the manifest. A provider requesting none would mint a token
+    // permitted to do nothing and only find out at the first call.
+    if (manifest.auth.scopes.length === 0) {
       throw new Error(
-        `Provider "${manifest.id}": a broker performs the exchange, but the browser still goes to the vendor, so auth.authorize_url is required.`,
+        `Provider "${manifest.id}": auth.assertion exchanges a signed assertion for a token scoped to auth.scopes, which is empty. There would be nothing to grant.`,
+      );
+    }
+    // The whole point of the alternative is that it asks for something. A block
+    // with no prompt reaches the walkthrough and then has nothing to collect.
+    if (manifest.auth.assertion.setup.prompts.length === 0) {
+      throw new Error(
+        `Provider "${manifest.id}": auth.assertion declares no setup prompts, so there is no way to learn what key to ask for.`,
       );
     }
   }

package/src/connectivity/manifest/requirements.ts

@@ -55,6 +55,15 @@ export interface SetupNeeds {
    * `connect` will never ask for.
    */
   readonly brokered: boolean;
+  /**
+   * What `--auth pasted_token` would ask for, where the provider offers it.
+   *
+   * Separate from `requirements` because it is an alternative rather than a
+   * prerequisite: nothing needs it unless the browser route is closed to you.
+   * Reported only when it is *not* the chosen route, since when it is chosen it
+   * is a requirement above and naming it twice would read as two values.
+   */
+  readonly pastedCredential: string | undefined;
 }
 
 /**
@@ -64,8 +73,23 @@ export interface SetupNeeds {
  * command someone is told to paste and a command the CLI suggests should not be
  * two different sentences.
  */
-function storeCommand(ref: string, placeholder: string, profile: string): string {
-  return `printf %s "${placeholder}" | lanes link secrets set ${ref} --profile ${profile}`;
+function storeCommand(ref: string, placeholder: string, where: Selection): string {
+  return (
+    `printf %s "${placeholder}" | lanes link secrets set ${ref}` +
+    ` --profile ${where.profile} --target ${where.target}`
+  );
+}
+
+/**
+ * Which store a suggested command should write into.
+ *
+ * One object rather than two positional strings, because the pair travels
+ * together everywhere and a caller that transposed them would produce a command
+ * that runs, writes a credential, and puts it somewhere nobody looks.
+ */
+export interface Selection {
+  readonly profile: string;
+  readonly target: string;
 }
 
 /** How the value is spelled, for a ref that several prompts combine into. */
@@ -80,15 +104,79 @@ function placeholderFor(prompts: readonly SetupPrompt[]): string {
   return '<value>';
 }
 
+/**
+ * What the key route needs, which is the key and nothing else.
+ *
+ * Never `needsId`, and that is the substantive difference from the block below:
+ * the key is shared across every connection of a vendor, so its ref does not
+ * derive from a connection id and nothing has to be named before it can be
+ * stored. The subject does derive per connection — but it is not a requirement
+ * because it cannot be placed ahead of time: it lives inside the pointer that
+ * `connect` itself writes, and there is no `secrets set` that would put it
+ * there.
+ */
+function assertionRequirements(
+  assertion: NonNullable<Extract<ProviderManifest['auth'], { kind: 'oauth' }>['assertion']>,
+  where: Selection,
+): SetupNeeds {
+  const shared = assertion.setup.prompts.filter((prompt) => prompt.scope === 'shared');
+
+  return {
+    requirements: shared.map((prompt) => ({
+      ref: assertion.key_ref,
+      label: prompt.label,
+      secret: prompt.secret,
+      scope: 'shared' as const,
+      prompts: [prompt.key],
+      command: storeCommand(assertion.key_ref, '<value>', where),
+    })),
+    needsId: false,
+    brokered: false,
+    pastedCredential: undefined,
+  };
+}
+
+/**
+ * Whether the manifest describes an OAuth client of the operator's own.
+ *
+ * `defineProvider` permits a broker, or a shipped client id, with no client
+ * prompts — a provider with no bring-your-own path is a legal thing to be. Every
+ * surface that offers that path has to ask this first, or it offers a route with
+ * nothing behind it: the chooser, the client resolver, and the setup plan.
+ *
+ * Here rather than in any of the three because it was already written twice in
+ * two different components under two different names, and this change would
+ * have made it three.
+ */
+export function hasOwnClientPath(manifest: ProviderManifest): boolean {
+  return (manifest.setup?.prompts ?? []).some((prompt) => prompt.scope === 'shared');
+}
+
 export function setupRequirements(
   manifest: ProviderManifest,
   connectionId: string | undefined,
-  profile: string,
+  where: Selection,
   options: {
     /** `oauth_apps` entries this profile declares — the clients that are its own. */
     readonly ownClients?: readonly string[];
+    /**
+     * Which way in, for a provider offering two.
+     *
+     * Defaults to the browser flow, which is every provider's only route until
+     * one declares `auth.assertion` — so an omitted value reports exactly what
+     * it always reported. Passed by `connect` once the operator has chosen,
+     * because the two methods need different things and reporting the union
+     * would tell someone to store a client they are not going to use.
+     */
+    readonly method?: 'oauth' | 'assertion' | 'pasted';
   } = {},
 ): SetupNeeds {
+  const assertion = manifest.auth.kind === 'oauth' ? manifest.auth.assertion : undefined;
+
+  if (options.method === 'assertion' && assertion) {
+    return assertionRequirements(assertion, where);
+  }
+
   const prompts = manifest.setup?.prompts ?? [];
 
   // A shared prompt exists to collect a client the operator registers. When a
@@ -101,7 +189,20 @@ export function setupRequirements(
     !(manifest.auth.app !== undefined && (options.ownClients ?? []).includes(manifest.auth.app));
 
   const shared = brokered ? [] : prompts.filter((prompt) => prompt.scope === 'shared');
-  const perConnection = prompts.filter((prompt) => prompt.scope === 'connection');
+
+  // An OAuth provider's per-connection prompt belongs to one route, not to the
+  // provider — it is what `--auth pasted_token` asks for, and nothing the
+  // browser route ever needs. Reporting it either way would put a
+  // mandatory-looking field in front of somebody whose whole path is a browser
+  // round trip, which is the same mistake `brokered` avoids one line above.
+  //
+  // No OAuth manifest had one of these until Slack kept its pasted token as the
+  // way past a workspace that has not approved the Lanes app.
+  const connectionPrompts = prompts.filter((prompt) => prompt.scope === 'connection');
+  const routed = manifest.auth.kind !== 'oauth' || options.method === 'pasted';
+
+  const pasted = routed ? [] : connectionPrompts;
+  const perConnection = routed ? connectionPrompts : [];
 
   const requirements: SetupRequirement[] = [];
 
@@ -115,7 +216,7 @@ export function setupRequirements(
       secret: prompt.secret,
       scope: 'shared',
       prompts: [prompt.key],
-      command: storeCommand(prompt.credential_ref, '<value>', profile),
+      command: storeCommand(prompt.credential_ref, '<value>', where),
     });
   }
 
@@ -133,7 +234,7 @@ export function setupRequirements(
         secret: perConnection.some((prompt) => prompt.secret),
         scope: 'connection',
         prompts: perConnection.map((prompt) => prompt.key),
-        command: storeCommand(ref, placeholderFor(perConnection), profile),
+        command: storeCommand(ref, placeholderFor(perConnection), where),
       });
     }
   }
@@ -142,5 +243,7 @@ export function setupRequirements(
     requirements,
     needsId: perConnection.length > 0 && connectionId === undefined,
     brokered,
+    pastedCredential:
+      pasted.length > 0 ? pasted.map((prompt) => prompt.label).join(', then ') : undefined,
   };
 }

package/src/deployments/adapters/filesystem.ts

@@ -166,7 +166,16 @@ const BY_EXTENSION: Record<string, string> = {
   '.yml': 'application/yaml',
 };
 
-function inferContentType(path: string): string | undefined {
+/**
+ * Exported so `github.ts` answers identically.
+ *
+ * That adapter has nowhere to *store* a content type — a sidecar there would be
+ * a file in the owner's own repository, listed beside their entries — so the
+ * extension is all it has. Sharing the map means a `.md` written locally and
+ * the same `.md` in a repository do not report different types, which is what
+ * `#stores/blobs/conformance.ts` exists to hold.
+ */
+export function inferContentType(path: string): string | undefined {
   const dot = path.lastIndexOf('.');
   return dot === -1 ? undefined : BY_EXTENSION[path.slice(dot).toLowerCase()];
 }