@lanes-sh/link 0.2.2 → 0.3.1

package/src/deployments/adapters/github-testing.ts

@@ -0,0 +1,258 @@
+import type { FetchLike } from './github-api.ts';
+
+/**
+ * A GitHub repository, in memory, for the adapter's tests.
+ *
+ * Test-only, behind the `-testing` suffix the blob and state stores already use
+ * for the same purpose, so application code does not reach it by habit. It is not
+ * a general GitHub simulator: it implements exactly the eight requests
+ * `github-repo.ts` and `github-commit.ts` make, and answers anything else with
+ * a 501 so an untested code path fails loudly rather than silently.
+ *
+ * What it does model faithfully, because the adapter's correctness rests on it:
+ * blob shas are content hashes (so "same sha, same bytes" is true, which is
+ * what makes the blob cache sound), commits snapshot the tree, the branch read
+ * answers 304 to a matching `If-None-Match`, and a Contents write with a stale
+ * `sha` answers 409.
+ */
+
+export interface FakeGithubOptions {
+  readonly repo?: string;
+  readonly private?: boolean;
+  readonly defaultBranch?: string;
+  readonly canPush?: boolean;
+  /** Start with commits already in place, rather than an empty repository. */
+  readonly files?: Readonly<Record<string, string>>;
+}
+
+export interface FakeGithub {
+  readonly fetch: FetchLike;
+  /** Every request, as `METHOD /path`, in order. */
+  readonly calls: string[];
+  /** The files at the branch tip. */
+  files(): Record<string, string>;
+  commitCount(): number;
+  /** Answer the next matching request with this instead. */
+  failNext(match: string, response: Response): void;
+  /**
+   * Answer every matching request this way, from now on.
+   *
+   * The shape a token that has expired actually has: not one bad response, but
+   * every response, until somebody replaces it. `failNext` models a race;
+   * this models a state.
+   */
+  failEvery(match: string, make: () => Response): void;
+  /** Change a file behind the adapter's back, as another writer would. */
+  writeBehind(path: string, text: string): void;
+}
+
+const encoder = new TextEncoder();
+const decoder = new TextDecoder();
+
+/** Content-addressed, so the adapter's blob cache is exercised honestly. */
+function blobSha(data: Uint8Array): string {
+  const hasher = new Bun.CryptoHasher('sha1');
+  hasher.update(data);
+  return hasher.digest('hex');
+}
+
+function decodeBase64(value: string): Uint8Array {
+  const binary = atob(value);
+  const bytes = new Uint8Array(binary.length);
+  for (let index = 0; index < binary.length; index += 1) bytes[index] = binary.charCodeAt(index);
+  return bytes;
+}
+
+function json(body: unknown, init: ResponseInit = {}): Response {
+  return new Response(JSON.stringify(body), {
+    ...init,
+    headers: { 'content-type': 'application/json', ...(init.headers ?? {}) },
+  });
+}
+
+export function createFakeGithub(options: FakeGithubOptions = {}): FakeGithub {
+  const repo = options.repo ?? 'my-org/my-notes';
+  const branch = options.defaultBranch ?? 'main';
+  const calls: string[] = [];
+  const overrides: Array<{ match: string; response: Response }> = [];
+  const standing: Array<{ match: string; make: () => Response }> = [];
+
+  /** Path → bytes, at the tip. */
+  let files = new Map<string, Uint8Array>();
+  /** Commit sha → the tree it points at. Trees are addressed by commit here. */
+  const commits = new Map<string, Map<string, Uint8Array>>();
+  /** Loose objects created by the Git Data API before a commit references them. */
+  const loose = new Map<string, Uint8Array>();
+  const trees = new Map<string, Map<string, Uint8Array>>();
+  let head: string | null = null;
+  let counter = 0;
+
+  const snapshot = (): string => {
+    counter += 1;
+    const sha = `commit${counter}`;
+    commits.set(sha, new Map(files));
+    head = sha;
+    return sha;
+  };
+
+  if (options.files) {
+    for (const [path, text] of Object.entries(options.files)) {
+      files.set(path, encoder.encode(text));
+    }
+    snapshot();
+  }
+
+  const treeOf = (sha: string): Map<string, Uint8Array> => commits.get(sha) ?? new Map();
+
+  const fetch: FetchLike = async (input, init = {}) => {
+    const url = new URL(String(input));
+    const method = init.method ?? 'GET';
+    const path = url.pathname;
+    calls.push(`${method} ${path}`);
+
+    const override = overrides.findIndex((entry) => `${method} ${path}`.includes(entry.match));
+    if (override !== -1) return overrides.splice(override, 1)[0]!.response;
+
+    const always = standing.find((entry) => `${method} ${path}`.includes(entry.match));
+    if (always) return always.make();
+
+    const body = init.body === undefined ? undefined : (JSON.parse(String(init.body)) as Record<string, unknown>);
+    const headers = (init.headers ?? {}) as Record<string, string>;
+
+    if (method === 'GET' && path === `/repos/${repo}`) {
+      return json({
+        full_name: repo,
+        private: options.private ?? true,
+        default_branch: branch,
+        permissions: { push: options.canPush ?? true },
+      });
+    }
+
+    if (method === 'GET' && path === '/user') return json({ login: 'an-owner' });
+
+    if (method === 'GET' && path === `/repos/${repo}/branches/${branch}`) {
+      if (head === null) return json({ message: 'Branch not found' }, { status: 404 });
+      const etag = `"${head}"`;
+      if (headers['if-none-match'] === etag) return new Response(null, { status: 304 });
+
+      return json(
+        { commit: { sha: head, commit: { committer: { date: '2026-01-02T03:04:05Z' } } } },
+        { headers: { etag } },
+      );
+    }
+
+    if (method === 'GET' && path.startsWith(`/repos/${repo}/git/trees/`)) {
+      const sha = path.slice(`/repos/${repo}/git/trees/`.length);
+      const tree = commits.has(sha) ? treeOf(sha) : (trees.get(sha) ?? new Map());
+      return json({
+        sha,
+        tree: [...tree].map(([entry, data]) => ({
+          path: entry,
+          mode: '100644',
+          type: 'blob',
+          sha: blobSha(data),
+          size: data.byteLength,
+        })),
+        truncated: false,
+      });
+    }
+
+    if (method === 'GET' && path.startsWith(`/repos/${repo}/git/blobs/`)) {
+      const sha = path.slice(`/repos/${repo}/git/blobs/`.length);
+      for (const data of [...files.values(), ...loose.values()]) {
+        if (blobSha(data) === sha) return new Response(data);
+      }
+      for (const tree of commits.values()) {
+        for (const data of tree.values()) if (blobSha(data) === sha) return new Response(data);
+      }
+      return json({ message: 'Not Found' }, { status: 404 });
+    }
+
+    if (path.startsWith(`/repos/${repo}/contents/`)) {
+      const target = decodeURIComponent(path.slice(`/repos/${repo}/contents/`.length));
+      const existing = files.get(target);
+      const given = body?.['sha'] as string | undefined;
+
+      if (existing && given !== blobSha(existing)) {
+        return json({ message: 'does not match' }, { status: 409 });
+      }
+      if (!existing && given) return json({ message: 'not found' }, { status: 404 });
+
+      if (method === 'PUT') {
+        const data = decodeBase64(String(body?.['content'] ?? ''));
+        files.set(target, data);
+        const sha = snapshot();
+        return json({
+          content: { sha: blobSha(data), size: data.byteLength },
+          commit: { sha, committer: { date: '2026-01-02T03:04:05Z' } },
+        });
+      }
+
+      if (method === 'DELETE') {
+        if (!existing) return json({ message: 'Not Found' }, { status: 404 });
+        files.delete(target);
+        const sha = snapshot();
+        return json({ commit: { sha, committer: { date: '2026-01-02T03:04:05Z' } } });
+      }
+    }
+
+    if (method === 'POST' && path === `/repos/${repo}/git/blobs`) {
+      const data = decodeBase64(String(body?.['content'] ?? ''));
+      const sha = blobSha(data);
+      loose.set(sha, data);
+      return json({ sha });
+    }
+
+    if (method === 'POST' && path === `/repos/${repo}/git/trees`) {
+      const base = body?.['base_tree'] as string | undefined;
+      const tree = new Map(base ? treeOf(base) : []);
+
+      for (const entry of (body?.['tree'] ?? []) as Array<{ path: string; sha: string | null }>) {
+        if (entry.sha === null) tree.delete(entry.path);
+        else {
+          const data = loose.get(entry.sha);
+          if (data) tree.set(entry.path, data);
+        }
+      }
+
+      counter += 1;
+      const sha = `tree${counter}`;
+      trees.set(sha, tree);
+      return json({ sha });
+    }
+
+    if (method === 'POST' && path === `/repos/${repo}/git/commits`) {
+      counter += 1;
+      const sha = `commit${counter}`;
+      commits.set(sha, new Map(trees.get(String(body?.['tree'])) ?? new Map()));
+      return json({ sha });
+    }
+
+    // Creating the first ref, or moving an existing one. Both land the commit.
+    if (
+      (method === 'POST' && path === `/repos/${repo}/git/refs`) ||
+      (method === 'PATCH' && path === `/repos/${repo}/git/refs/heads/${branch}`)
+    ) {
+      const sha = String(body?.['sha']);
+      if (!commits.has(sha)) return json({ message: 'no such commit' }, { status: 422 });
+      head = sha;
+      files = new Map(treeOf(sha));
+      return json({ ref: `refs/heads/${branch}`, object: { sha } });
+    }
+
+    return json({ message: `the fake does not implement ${method} ${path}` }, { status: 501 });
+  };
+
+  return {
+    fetch,
+    calls,
+    files: () => Object.fromEntries([...files].map(([path, data]) => [path, decoder.decode(data)])),
+    commitCount: () => commits.size,
+    failNext: (match, response) => overrides.push({ match, response }),
+    failEvery: (match, make) => standing.push({ match, make }),
+    writeBehind: (path, text) => {
+      files.set(path, encoder.encode(text));
+      snapshot();
+    },
+  };
+}

package/src/deployments/adapters/github.ts

@@ -0,0 +1,125 @@
+import { containedKey, type BlobKey, type BlobMetadata, type BlobStore } from '#stores/blobs';
+import { inferContentType } from './filesystem.ts';
+import type { GithubRepository } from './github-repo.ts';
+
+/**
+ * A GitHub repository as a `BlobStore`.
+ *
+ * The one thing a profile can put here is what the owner wrote — memory entries
+ * and skills. Not state, not the audit log, not the credential store, and never
+ * the vault; `src/profile/knowledge.ts` says why, and says it as a schema with
+ * no field to set rather than as a default.
+ *
+ * **The API, not a clone.** A clone would be faster and would work offline, and
+ * it fails on the property this interface exists to provide: a container
+ * filesystem is discarded on every revision, so a deployed endpoint's clone
+ * would be re-fetched at best and silently empty at worst. That is precisely
+ * the bug ADR-014 §2 fixed for the vault, and re-introducing it for memory is
+ * not worth the latency. It also needs a `git` binary, which the image does not
+ * carry. ADR-041.
+ *
+ * Vendor-named, like `gcs.ts` and `gcp-secret-manager.ts` beside it: ADR-013's
+ * rule is that an adapter for a *protocol* takes the protocol's name, and a
+ * client for one vendor's API cannot honestly claim one.
+ *
+ * **Several of these share one `GithubRepository`.** Memory and skills are two
+ * roots in one repository, and pointing both at one client means one head, one
+ * tree, and one blob cache between them.
+ */
+
+export interface GithubBlobStoreOptions {
+  readonly repository: GithubRepository;
+  /**
+   * A directory inside the repository that this store is rooted at — `memory`,
+   * `skills`, or those under a profile's own `path` prefix. Keys never see it.
+   */
+  readonly root?: string | undefined;
+  /** What a write commit says it did. `%s` is the key. */
+  readonly message?: ((operation: 'store' | 'remove', key: string) => string) | undefined;
+}
+
+const DEFAULT_MESSAGE = (operation: 'store' | 'remove', key: string): string =>
+  `${operation === 'store' ? 'Store' : 'Remove'} ${key}`;
+
+export function createGithubBlobStore(options: GithubBlobStoreOptions): BlobStore {
+  const repository = options.repository;
+  const message = options.message ?? DEFAULT_MESSAGE;
+  const root = (options.root ?? '').replace(/^\/+/, '').replace(/\/+$/, '');
+  const prefix = root === '' ? '' : `${root}/`;
+
+  /**
+   * A key becomes a path in the repository.
+   *
+   * `containedKey` is `#stores/blobs`', not a second rule written here.
+   * `conformance.ts` asserts that a key one target refuses is not one another
+   * accepts, and that can only hold while there is exactly one answer to what
+   * a key resolves to.
+   */
+  const pathFor = (key: BlobKey): string => `${prefix}${containedKey(key)}`;
+
+  /** The reverse, for a listing. Null when the path is outside this root. */
+  const keyFor = (path: string): BlobKey | null =>
+    path.startsWith(prefix) ? path.slice(prefix.length) : null;
+
+  return {
+    async put(key, data, putOptions) {
+      // `putOptions.contentType` is accepted and not stored, which is the one
+      // place this adapter cannot match the others. There is nowhere to put it:
+      // a sidecar would be a file in the owner's own repository, listed beside
+      // their entries and loaded as one. `list` infers from the extension
+      // instead, using the same map the filesystem adapter infers from — which
+      // covers every type anything here writes.
+      void putOptions;
+      await repository.writeFile(pathFor(key), data, message('store', key));
+    },
+
+    async get(key) {
+      const path = pathFor(key);
+      const { entries } = await repository.entries();
+      const entry = entries.get(path);
+      // Absence is a value, not an error — every caller is written against null.
+      if (!entry) return null;
+
+      // An empty file has a real blob and zero bytes; `blob` returns the empty
+      // array rather than null, which is the case `conformance.ts` pins.
+      return repository.blob(entry.sha);
+    },
+
+    async has(key) {
+      const path = pathFor(key);
+      return (await repository.entries()).entries.has(path);
+    },
+
+    async delete(key) {
+      // Deleting what is not there is not a failure: callers use this to make
+      // absence true, and a sweep racing another sweep must not throw.
+      await repository.deleteFile(pathFor(key), message('remove', key));
+    },
+
+    async list(innerPrefix) {
+      const { entries, committedAt } = await repository.entries();
+      const wanted = innerPrefix ?? '';
+      const found: BlobMetadata[] = [];
+
+      for (const entry of entries.values()) {
+        const key = keyFor(entry.path);
+        if (key === null || !key.startsWith(wanted)) continue;
+
+        const contentType = inferContentType(key);
+        found.push({
+          key,
+          size: entry.size,
+          ...(contentType ? { contentType } : {}),
+          // The branch tip's date, the same for every entry in one listing.
+          // Per-file timestamps would be one `GET /commits?path=…` each, and
+          // nothing needs them: `skillFingerprint` only needs this to change
+          // when the tree does, and memory uses it as a fallback for a
+          // hand-written file with no `updated_at` in its frontmatter.
+          modifiedAt: committedAt,
+        });
+      }
+
+      return found.sort((a, b) => a.key.localeCompare(b.key));
+    },
+  };
+}

package/src/deployments/deploy.ts

@@ -1,4 +1,4 @@
-import { ConfigError, resolveDeployTarget, type DeployConfig } from '#profile';
+import { ConfigError, recordDeployment, resolveWorkspaceRoot, type DeployConfig } from '#profile';
 import { announce, fail, heading, ok, print, style, warn } from '#cli/output.ts';
 import { staleNudge } from '#cli/release.ts';
 import { confirm, isInteractive } from '#cli/prompt.ts';
@@ -8,6 +8,9 @@ import { printSteps, runSteps } from './steps.ts';
 import { driverFor } from './drivers.ts';
 import { prepareSecrets, readableRefs, rotatableRefs } from './prepare.ts';
 import { deployedWorkspace, repairSetupSurface, uploadWorkspace } from './upload.ts';
+import { unservableProfiles, unservableRefusal } from './servable.ts';
+import { collidingRefs, collisionRefusal, servingProfiles } from './serving.ts';
+import { healthLine, reachability, registerLine, reportUnauthorised } from './report.ts';
 
 /**
  * `lanes link deploy` — set up what is missing, build the image, roll a revision,
@@ -41,18 +44,57 @@ export interface DeployFlags extends GlobalFlags {
    * this is for a terminal attached to a job nobody is watching.
    */
   readonly nonInteractive?: boolean | undefined;
+  /**
+   * Which profiles to send, narrowing the set the target implies.
+   *
+   * Repeatable, and absent means every profile declaring the target — the set
+   * the endpoint is going to open either way (ADR-043). The first one named is
+   * the primary.
+   */
+  readonly profiles?: readonly string[] | undefined;
 }
 
 export async function deploy(flags: DeployFlags): Promise<void> {
   // The one command allowed to name a target that does not exist yet: creating
   // it is what a first deploy is for.
-  const { resolution, config } = await resolveProfile(flags, { allowUndeclaredTarget: true });
+  //
+  // It used to work out its own target too — the one declaring a `deploy` block,
+  // guessing when there was one, refusing when there were two, and inventing
+  // `cloud` when there were none. That inference was a defence against
+  // `instance.default_target`, which is `local` on a scaffolded profile and
+  // never the answer to "deploy what". With the fallback gone (ADR-037) the
+  // defence has nothing to defend against, and what is left is three behaviours
+  // from one command line on the command that creates cloud resources and rolls
+  // a public URL — where `allowUndeclaredTarget` means a mistake is not refused
+  // but surveyed, written into the profile, and deployed as a new service.
+  //
+  // Which profiles is derived rather than named: every profile declaring the
+  // target, because that is the set the revision will try to open (ADR-009).
+  // `--profile` narrows it, and a first deploy still has to name one — a target
+  // nothing declares has no set to derive from.
+  const { profiles: serving, primary } = await servingProfiles({
+    workspaceRoot: resolveWorkspaceRoot(),
+    target: requireTargetFlag(flags),
+    named: flags.profiles ?? [],
+  });
 
-  // And the one command that can work out which target it meant. `resolveProfile`
-  // falls back to `instance.default_target`, which is the target commands *run*
-  // against — `local`, and never the answer to "deploy what".
-  const { target, source } = resolveDeployTarget(config, flags.target);
-  announce({ ...resolution, target, targetSource: source });
+  const { resolution, config, target } = await resolveProfile(
+    { ...flags, profile: primary },
+    { allowUndeclaredTarget: true },
+  );
+  announce(resolution);
+  if (serving.length > 1) {
+    print(style.dim(`         serving ${serving.join(', ')} — ${primary} owns the token`));
+  }
+
+  // Before anything external, beside `check`, and for the same reason: two
+  // profiles writing one flat credential ref into one store is a failure with
+  // no later symptom worth having.
+  const colliding = await collidingRefs(resolution.workspaceRoot, serving);
+  if (colliding.length > 0) {
+    heading('Cannot share a credential store');
+    throw new ConfigError(collisionRefusal(colliding, target));
+  }
 
   // `check` before anything external, per the gate order: a config that will be
   // rejected on boot should be rejected here, not after a five-minute build.
@@ -83,8 +125,8 @@ export async function deploy(flags: DeployFlags): Promise<void> {
   // below are, and read from config and manifests before anything opens a
   // store — `--dry-run` must reach the printed step list without touching a
   // credential.
-  const rotatable = await rotatableRefs(resolution.workspaceRoot, flags.profile);
-  const readable = await readableRefs(resolution.workspaceRoot, flags.profile, declared);
+  const rotatable = await rotatableRefs(resolution.workspaceRoot, serving);
+  const readable = await readableRefs(resolution.workspaceRoot, serving, declared);
   const provision = await driver.provision({
     deploy: deployConfig,
     declared,
@@ -103,7 +145,7 @@ export async function deploy(flags: DeployFlags): Promise<void> {
     deploy: deployConfig,
     tag,
     target,
-    ...(flags.profile !== undefined ? { profile: flags.profile } : {}),
+    profile: resolution.profile,
     ...(workspace !== undefined ? { workspace } : {}),
     ...(secretEnv ? { secretEnv } : {}),
   });
@@ -168,8 +210,9 @@ export async function deploy(flags: DeployFlags): Promise<void> {
     for (const problem of prepared.blocking) print(fail(problem));
     throw new ConfigError(
       'The deployed instance cannot start without these. Store them with ' +
-        `lanes link secrets set <ref> --target ${target}, or copy a local setup with ` +
-        `lanes link secrets push --from local --to ${target}.`,
+        `lanes link secrets set <ref> --profile ${resolution.profile} --target ${target}, or ` +
+        `copy a local setup with lanes link secrets push --profile ${resolution.profile} ` +
+        `--from local --to ${target}.`,
     );
   }
 
@@ -193,12 +236,41 @@ export async function deploy(flags: DeployFlags): Promise<void> {
   // the upload sends would leave a served profile without the surface — this
   // bug again, one profile over.
   if (workspace) {
-    await repairSetupSurface(resolution.workspaceRoot, flags.profile);
+    // Before anything is copied, and before the rollout: the endpoint opens
+    // every profile in the bucket against this one target, so a profile that
+    // does not declare it is not a profile that gets skipped — it is a revision
+    // that never goes healthy. `servable.ts` has the whole failure.
+    //
+    // Here rather than at the top of the command because it reads the same
+    // scope the upload does, and that scope is not settled until `workspace`
+    // says there is a bucket to send to at all.
+    const unservable = await unservableProfiles({
+      workspaceRoot: resolution.workspaceRoot,
+      profiles: serving,
+      target,
+    });
+
+    if (unservable.length > 0) {
+      heading('Cannot be served');
+      throw new ConfigError(unservableRefusal(unservable, target));
+    }
+
+    await repairSetupSurface(resolution.workspaceRoot, serving);
 
     // Before the rollout, so the revision that comes up finds a config to read.
     // Uploading after would leave a window where the service is serving and the
     // workspace it was told to read is not there yet.
-    await uploadWorkspace(resolution.workspaceRoot, workspace, flags.profile);
+    await uploadWorkspace(resolution.workspaceRoot, workspace, serving);
+
+    // Recorded once the bucket is known to hold this target's config. It is an
+    // index, not configuration (ADR-044) — the next recovery reads it instead
+    // of asking the platform.
+    await recordDeployment(resolution.workspaceRoot, {
+      target,
+      workspace,
+      primary: resolution.profile,
+      last_deploy: new Date().toISOString(),
+    });
   }
 
   heading('Rolling out');
@@ -208,7 +280,7 @@ export async function deploy(flags: DeployFlags): Promise<void> {
   if (!url) {
     print(
       warn(
-        `deployed, but the platform reported no URL yet — run: lanes link outputs --target ${target}`,
+        `deployed, but the platform reported no URL yet — run: lanes link outputs --profile ${resolution.profile} --target ${target}`,
       ),
     );
     return;
@@ -218,107 +290,15 @@ export async function deploy(flags: DeployFlags): Promise<void> {
   print(`  ${url}/mcp`);
   print(await healthLine(url));
   print('');
-  print(registerLine(target));
-
-  reportUnauthorised(prepared.warnings, target);
-}
-
-/**
- * How to register the endpoint, and when.
- *
- * The ordering is the whole point of the second half. A client captures
- * `tools/list` when it connects and keeps it: this endpoint is stateless, so
- * there is no stream on which to send `notifications/tools/list_changed`, and
- * `buildMcpServer` no longer pretends otherwise. A first deploy necessarily
- * publishes a profile whose only connection is `setup.main` — the accounts come
- * after — so a connector registered in that window captures a two-tool surface
- * and holds it. The endpoint is right, every reload lands, and the client shows
- * two tools until someone removes and re-adds it.
- *
- * Unconditional, and that is the correction that matters. This was gated on
- * `prepared.warnings.length`, which is zero in precisely the case it describes:
- * a fresh profile declares only `setup.main`, `setup` is a local provider with
- * no credential, so `prepareSecrets` has nothing to warn about. The advice
- * appeared only on a later re-deploy, by which point the connector is usually
- * registered and the ordering is no longer available to get right.
- */
-function registerLine(target: string): string {
-  return style.dim(
-    `  Connect your accounts first, then register with: lanes link outputs --target ${target}\n` +
-      '  A client keeps the tool list it fetched when it connected, so one registered\n' +
-      '  before the accounts holds a surface without them until it is re-added.',
-  );
-}
-
-/**
- * The accounts a browser still has to authorise, and the step after them.
- *
- * Printed last rather than before the build, because this is the only thing
- * left to do and a list eight steps up the scrollback is a list nobody reads.
- *
- * There is no second deploy at the end of it any more, and the reason the old
- * one existed is worth keeping. Connection *credentials* are read live on every
- * call, so a fresh `connect` looked like it should be picked up — but whether a
- * connection was usable at all was decided by a reconcile that ran once per
- * process, so a revision that came up with an account unauthorised went on
- * refusing it, naming the connection rather than the staleness. Reconcile now
- * runs again on every reload, and `connect` asks for one (ADR-029).
- */
-function reportUnauthorised(warnings: readonly string[], target: string): void {
-  if (warnings.length === 0) return;
-
-  heading('Not authorised yet');
-  for (const problem of warnings) print(warn(problem));
-  print('');
-  print(
-    style.dim(
-      '  A browser consent per account is the one step this cannot take for you:\n' +
-        `    lanes link connect <provider> --target ${target}\n` +
-        '  Each is served as soon as it is authorised. There is no second deploy —\n' +
-        '  deploying is how code gets here, and authorising an account changes none.',
-    ),
-  );
-}
+  print(registerLine(resolution.profile, target));
 
-/**
- * Who can reach the service once this lands.
- *
- * Printed on every deploy rather than only when it changes, because it is the
- * one property of a deployment that is invisible from the outside until someone
- * either cannot get in or should not have been able to.
- */
-function reachability(access: DeployConfig['access']): string {
-  return access === 'iam'
-    ? style.dim(
-        '  access:   iam — the platform admits only callers holding its own identity\n' +
-          '            token. No agent harness can mint one; use --access public with an\n' +
-          '            authorization block if a remote MCP client has to reach this.',
-      )
-    : style.dim(
-        '  access:   public — the platform lets requests through and this endpoint\n' +
-          '            authenticates them. The bearer token is what protects it.',
-      );
+  reportUnauthorised(prepared.warnings, resolution.profile, target);
 }
 
-/** Ask the deployed endpoint whether it came up. */
-async function healthLine(url: string): Promise<string> {
-  try {
-    const response = await fetch(`${url}/health`, { signal: AbortSignal.timeout(10_000) });
-    if (!response.ok) return warn(`the endpoint answered /health with ${response.status}`);
-
-    // Asked anonymously, so it reports that the revision is up and nothing
-    // about what it serves — the profile list is behind the token now.
-    // `lanes link outputs` holds one and prints the rest.
-    const body = (await response.json()) as { profiles?: string[] };
-    return ok(
-      body.profiles
-        ? `healthy — serving ${body.profiles.join(', ')}`
-        : 'healthy — run `lanes link outputs` for what it serves',
-    );
-  } catch {
-    // A cold start plus a database connect can outrun a short probe, and
-    // `access: iam` makes /health unreachable from here by design. Neither is a
-    // failed deploy.
-    return warn('could not reach /health from here — with access: iam that is expected');
+/** `--target` is required by `SELECTION`; this is the type narrowing, not a check. */
+function requireTargetFlag(flags: DeployFlags): string {
+  if (!flags.target) {
+    throw new ConfigError('--target is required. It names the deployment this acts on.');
   }
+  return flags.target;
 }