@lanes-sh/link 0.2.2 → 0.3.1

package/src/cli/commands/connect/client.ts

@@ -5,7 +5,7 @@ import {
   brokerOriginOverride,
   type BrokerConfig,
 } from '#connectivity/auth/index.ts';
-import type { ProviderManifest } from '#connectivity';
+import { hasOwnClientPath, type ProviderManifest } from '#connectivity';
 import type { SecretStore } from '#secrets';
 import { ConfigDocument } from '../../config-edit.ts';
 import { progress, style, warn } from '../../output.ts';
@@ -38,8 +38,15 @@ export interface ClientChoice {
   readonly changes: string[];
   /** No connection of this provider exists yet, so its console setup is undone. */
   readonly firstForProvider: boolean;
-  /** `--own-client`: register one rather than using the client the broker runs. */
-  readonly ownClient: boolean;
+  /**
+   * Which client, when the operator said which.
+   *
+   * `undefined` is the precedence this file has always applied and is what a
+   * provider with one browser route resolves to: a declared `oauth_apps` entry
+   * wins, otherwise the broker. The two explicit values come from the choice
+   * `connect` now prints, and they override that precedence in both directions.
+   */
+  readonly client: 'own' | 'hosted' | undefined;
   /** How the operator spelled the target, so a refusal names a command they typed. */
   readonly target: string;
   readonly profile: string;
@@ -54,9 +61,31 @@ export async function resolveOAuthClient(input: ClientChoice): Promise<OAuthClie
   }
 
   const { app, broker } = manifest.auth;
+  const ownClient = input.client === 'own';
+  // Hoisted: four of the branches below need the answer, and it reads the store.
+  const hasOwnClient = await profileHasOwnClient(app, document, credentials);
+
+  // Asked for outright, on a profile that registered a client of its own.
+  //
+  // Honoured rather than overruled, which is a change: the entry used to be
+  // final. It can be honoured safely because which client minted a token is
+  // stamped on the token — so this connection refreshes against the broker
+  // while every existing one keeps refreshing where it was issued. What it must
+  // not be is silent, because the profile's other connections do not move.
+  const insteadOfOwn = input.client === 'hosted' && broker !== undefined && hasOwnClient;
+
+  if (insteadOfOwn) {
+    progress(
+      style.dim(
+        `This profile has an OAuth client of its own, and this connection is being authorised ` +
+          `against ${broker.operator}'s instead. Existing connections are unaffected — they keep ` +
+          `refreshing against the client that issued them.`,
+      ),
+    );
+  }
 
-  if (!broker || (await profileHasOwnClient(app, document, credentials)) || input.ownClient) {
-    if (input.ownClient && broker && !hasClientPrompts(manifest)) {
+  if (!broker || (!insteadOfOwn && (hasOwnClient || ownClient))) {
+    if (ownClient && broker && !hasOwnClientPath(manifest)) {
       // `defineProvider` permits a broker with no prompts — a provider with no
       // bring-your-own path is a legal thing to be. This is where that absence
       // becomes a sentence rather than a prompt for a value nothing collects.
@@ -73,7 +102,7 @@ export async function resolveOAuthClient(input: ClientChoice): Promise<OAuthClie
       firstForProvider: input.firstForProvider,
       ...(input.prompter ? { prompter: input.prompter } : {}),
     });
-    if (input.ownClient) declareOwnClient(document, manifest, input.changes);
+    if (ownClient) declareOwnClient(document, manifest, input.changes);
 
     const [clientId, clientSecret] = app
       ? await Promise.all([
@@ -116,6 +145,7 @@ export async function resolveOAuthClient(input: ClientChoice): Promise<OAuthClie
       cause: cause instanceof Error ? cause.message : String(cause),
       ...(cause instanceof BrokerError && cause.notice ? { notice: cause.notice } : {}),
       docsUrl: broker.docs_url,
+      ownClient: hasOwnClientPath(manifest),
     });
   }
 
@@ -128,6 +158,7 @@ export async function resolveOAuthClient(input: ClientChoice): Promise<OAuthClie
       cause: 'it is not accepting new connections.',
       ...(config.notice ? { notice: config.notice } : {}),
       docsUrl: config.docsUrl ?? broker.docs_url,
+      ownClient: hasOwnClientPath(manifest),
     });
   }
 
@@ -193,9 +224,6 @@ async function profileHasOwnClient(
   return Boolean(id && secret);
 }
 
-function hasClientPrompts(manifest: ProviderManifest): boolean {
-  return (manifest.setup?.prompts ?? []).some((prompt) => prompt.scope === 'shared');
-}
 
 /**
  * What is actually asked for, and what the broker cannot grant.

package/src/cli/commands/connect/discover.ts

@@ -0,0 +1,94 @@
+import { bearerTokenAsStored } from '#connectivity/auth/index.ts';
+import type { AnyConnector, DiscoveredCapability, ProviderManifest } from '#connectivity';
+import { createMcpConnector } from '#connectivity/transports';
+import type { RegisteredProvider } from '#registry';
+import type { SecretStore } from '#secrets';
+import { progress, style } from '../../output.ts';
+
+/**
+ * Step three of `connect`: ask the upstream what it exposes.
+ *
+ * A manifest never declares capabilities for a proxied server — the server is
+ * the source of truth, and a declared list would go stale the moment the vendor
+ * ships. So this is the one part of connecting that talks to the thing being
+ * connected for a reason other than authentication.
+ *
+ * Its own file because the three cases have nothing to do with one another: an
+ * MCP server is asked over a session, an HTTP provider is read from a
+ * description on disk, and a local provider already knows. Interleaved with the
+ * config writing around them, that was three shapes wearing one `if`.
+ */
+
+/**
+ * What discovery is actually doing, per kind, so the wait is explained.
+ *
+ * They differ enough to be worth saying: reading a local OpenAPI file is
+ * instant, while signing in to an IMAP server is a TLS handshake and a LOGIN
+ * against a host that sometimes takes its time.
+ */
+const DISCOVERY_NOTE: Record<string, string> = {
+  mcp: 'Discovering capabilities…',
+  http: 'Reading the API description…',
+};
+
+export async function discoverCapabilities(input: {
+  readonly entry: RegisteredProvider;
+  readonly manifest: ProviderManifest;
+  readonly connectionId: string;
+  readonly credentials: SecretStore;
+  readonly connectorFor: (providerId: string, connectionId: string) => AnyConnector | undefined;
+  /** Called with what was found, so the caller can cache and register it. */
+  readonly remember: (discovered: DiscoveredCapability[]) => Promise<void>;
+}): Promise<DiscoveredCapability[]> {
+  const { entry, manifest, connectionId, credentials } = input;
+
+  if (manifest.connector.kind === 'local') return localCapabilities(entry, manifest);
+
+  progress(style.dim(DISCOVERY_NOTE[manifest.connector.kind] ?? 'Discovering capabilities…'));
+
+  // MCP is the one kind that does not use the runtime's connector here: it
+  // wants the token exactly as just written, without the refresh machinery that
+  // `bearerToken` wraps around it. Every other kind carries whatever credential
+  // it needs from the factory.
+  const connector =
+    manifest.connector.kind === 'mcp'
+      ? createMcpConnector({
+          endpoint: manifest.connector.endpoint,
+          ...(manifest.connector.headers ? { headers: manifest.connector.headers } : {}),
+          accessToken: () => bearerTokenAsStored(manifest, connectionId, credentials),
+        })
+      : input.connectorFor(manifest.id, connectionId);
+
+  if (!connector) return [];
+
+  // Discovery takes the manifest and nothing else. What a provider exposes is a
+  // property of the provider, not of an account — which is just as well,
+  // because the connection being created does not exist in config until the
+  // step after this one.
+  const discovered = await connector.discover({ manifest });
+  await input.remember(discovered);
+  return discovered;
+}
+
+/**
+ * Local capabilities carry their bundle from the manifest.
+ *
+ * Resources are included alongside tools: they need a policy grant too, and
+ * leaving them out would register a resource nothing is allowed to read.
+ */
+function localCapabilities(
+  entry: RegisteredProvider,
+  manifest: ProviderManifest,
+): DiscoveredCapability[] {
+  if (!entry.definition) return [];
+
+  const bundleOf = (name: string): string | undefined =>
+    manifest.bundles?.find((candidate) => candidate.capabilities.includes(name))?.name;
+
+  return entry.definition.capabilities.map((capability) => ({
+    name: capability.name,
+    description: capability.description,
+    inputSchema: {},
+    ...(bundleOf(capability.name) ? { bundle: bundleOf(capability.name)! } : {}),
+  }));
+}

package/src/cli/commands/connect/family.ts

@@ -0,0 +1,72 @@
+import type { ProviderRegistry } from '#registry';
+import { progress, style } from '../../output.ts';
+import { credentialApp, familyNote } from './accounts.ts';
+import { familyOutcome, type ConnectOutcome } from './outcome.ts';
+
+/**
+ * `lanes link connect icloud` — an account rather than a provider.
+ *
+ * Everyone models iCloud this way: Apple's own Settings, macOS Internet
+ * Accounts, Thunderbird, DAVx⁵. One authorisation, three services. It is three
+ * *providers* underneath because mail and calendars are different protocols,
+ * and because a policy line per provider is what lets someone allow
+ * `icloud_calendar.*` while never granting mail — but nobody should have to
+ * know that to connect their account.
+ *
+ * Its own file because it is its own subject: `runConnect` is five numbered
+ * steps that add one account, and this is the fan-out that turns one name into
+ * several of those. Keeping them together made the interesting half — how a
+ * partial failure is reported — read as a preamble to be scrolled past.
+ */
+
+/**
+ * Which providers answer to this name as a shared account.
+ *
+ * Fewer than two is not a family. Asked of the registry rather than matched on
+ * the id, for the reason `siblingAccountId` gives: `app` is a manifest field,
+ * and a provider is free to declare `app: icloud` under any name it likes.
+ */
+export function familyMembers(registry: ProviderRegistry, name: string): readonly string[] {
+  return registry
+    .list()
+    .filter((candidate) => credentialApp(candidate.manifest) === name)
+    .map((candidate) => candidate.manifest.id);
+}
+
+/**
+ * Connect each member in turn, and report the account rather than the services.
+ *
+ * In sequence, and the order matters: the first settles the account id and
+ * stores the credential, and the rest find both already there.
+ *
+ * The id travels as a flag because the family members are addressed by their
+ * own names — `connect icloud.will` parses `will` off a target that is then
+ * thrown away, and recursing without it meant the command named an account and
+ * each member silently invented its own.
+ *
+ * `announced` is passed for the same reason and one axis over: the line naming
+ * the target belongs to the account, not to each service under it, so it is
+ * printed once here and suppressed in every member. Three copies of it is three
+ * times nothing new.
+ */
+export async function connectFamily<Options extends { readonly id?: string | undefined }>(input: {
+  readonly name: string;
+  readonly members: readonly string[];
+  readonly options: Options;
+  readonly namedId: string | undefined;
+  readonly connect: (
+    provider: string,
+    options: Options,
+    announced: boolean,
+  ) => Promise<ConnectOutcome>;
+}): Promise<ConnectOutcome> {
+  const { name, members, options, namedId, connect } = input;
+
+  progress(style.dim(familyNote(name, members)));
+
+  const inherited = { ...options, id: options.id ?? namedId };
+  const outcomes: ConnectOutcome[] = [];
+  for (const member of members) outcomes.push(await connect(member, inherited, true));
+
+  return familyOutcome(outcomes);
+}

package/src/cli/commands/connect/index.ts

@@ -1,18 +1,22 @@
-import { createMcpConnector } from '#connectivity/transports';
-import { bearerTokenAsStored } from '#connectivity/auth/index.ts';
-import type { DiscoveredCapability } from '#connectivity';
 import { credentialRefForConnection, WRITE_BUNDLE } from '#connectivity';
-import { ConfigDocument, ensureSetupConnection, repaired } from '../../config-edit.ts';
-import { emit, print, progress, style } from '../../output.ts';
+import { ConfigDocument } from '../../config-edit.ts';
+import { ensureSetupConnection, repaired } from '../../config-repair.ts';
+import { emit, print } from '../../output.ts';
 import { nonInteractivePrompter, terminalPrompter, type Prompter } from '../../prompt.ts';
 import { openRuntime, type GlobalFlags } from '../../runtime.ts';
-import { credentialApp, matchesRule, moveCredential, siblingAccountId } from './accounts.ts';
+import { matchesRule, moveCredential, siblingAccountId } from './accounts.ts';
+import { discoverCapabilities } from './discover.ts';
+import { connectFamily, familyMembers } from './family.ts';
+import { authoriseWithKey } from './assertion.ts';
 import { authorise } from './authorise.ts';
+import { authorisePastedToken } from './pasted-token.ts';
+import { chooseAuthMethod } from './method.ts';
 import { preflight } from './requirements.ts';
-import { ALREADY, NOTHING, renderOutcome, type ConnectOutcome } from './outcome.ts';
+import { ALREADY, NOTHING, renderOutcome, where, type ConnectOutcome } from './outcome.ts';
 import { nextAfterEdit, publishRuntimeEdit } from '#cli/publish.ts';
 import { ensureStaticCredential } from './setup.ts';
 import { settleIdentity } from './settle.ts';
+import { announceConnectTarget } from './target-note.ts';
 
 /**
  * `lanes link connect <provider>` — the one command that adds an account.
@@ -48,7 +52,23 @@ export interface ConnectOptions extends GlobalFlags {
    * and then forgotten, which is the right shape for a decision about a client
    * that is shared by every connection of that vendor.
    */
+  /**
+   * `--own-client`, the older spelling of one of the routes `--auth` now names.
+   *
+   * Kept because it is in scripts and in a year of documentation, and because
+   * it still says something true. It resolves to `--auth own_client`.
+   */
   readonly ownClient?: boolean | undefined;
+  /**
+   * `--auth <method>`: which way in, for a provider that offers more than one.
+   *
+   * Unset means ask, where there is somebody to ask and something to ask
+   * about. It is not sticky the way `--own-client` is: `--own-client` writes an
+   * `oauth_apps` entry that every connection of the vendor then reads, whereas
+   * this decides one connection's credential and is recorded by that credential
+   * existing. Two accounts on the same profile may honestly differ.
+   */
+  readonly auth?: string | undefined;
   /** Injected for tests. The broker is the only thing `connect` fetches. */
   readonly fetch?: typeof globalThis.fetch | undefined;
   readonly json?: boolean | undefined;
@@ -63,18 +83,6 @@ export interface ConnectOptions extends GlobalFlags {
  */
 const PROVISIONAL_ID = 'pending';
 
-/**
- * What discovery is actually doing, per kind, so the wait is explained.
- *
- * They differ enough to be worth saying: reading a local OpenAPI file is
- * instant, while signing in to an IMAP server is a TLS handshake and a LOGIN
- * against a host that sometimes takes its time.
- */
-const DISCOVERY_NOTE: Record<string, string> = {
-  mcp: 'Discovering capabilities…',
-  http: 'Reading the API description…',
-};
-
 export async function connect(target: string, options: ConnectOptions): Promise<void> {
   const outcome = await runConnect(target, options);
 
@@ -83,7 +91,12 @@ export async function connect(target: string, options: ConnectOptions): Promise<
   return emit(options.json, outcome, () => renderOutcome(outcome));
 }
 
-async function runConnect(target: string, options: ConnectOptions): Promise<ConnectOutcome> {
+async function runConnect(
+  target: string,
+  options: ConnectOptions,
+  /** A family member — the account this belongs to has already said where it goes. */
+  announced = false,
+): Promise<ConnectOutcome> {
   const separator = target.indexOf('.');
   const providerId = separator === -1 ? target : target.slice(0, separator);
   const namedId = separator === -1 ? undefined : target.slice(separator + 1);
@@ -93,52 +106,29 @@ async function runConnect(target: string, options: ConnectOptions): Promise<Conn
   const runtime = await openRuntime(options);
 
   try {
+    // After the runtime rather than before, like every other command that
+    // announces: the alternative is resolving the profile twice, which for a
+    // `gs://` workspace is a second network read of the same YAML. Still long
+    // before the browser opens, which is the part that matters. Inside the
+    // `try` so the `finally` closes the runtime if the rendering throws.
+    if (!announced) announceConnectTarget(runtime, options.json);
+
     const registry = runtime.registry;
     const entry = registry.get(providerId);
 
-    // `lanes link connect icloud` — an account rather than a provider.
-    //
-    // Everyone models iCloud this way: Apple's own Settings, macOS Internet
-    // Accounts, Thunderbird, DAVx⁵. One authorisation, three services. It is
-    // three *providers* underneath because mail and calendars are different
-    // protocols, and because a policy line per provider is what lets someone
-    // allow `icloud_calendar.*` while never granting mail — but nobody should
-    // have to know that to connect their account.
+    // One name, several providers. `family.ts` says why iCloud is three.
     if (!entry) {
-      const family = registry
-        .list()
-        .filter((candidate) => credentialApp(candidate.manifest) === providerId)
-        .map((candidate) => candidate.manifest.id);
+      const members = familyMembers(registry, providerId);
 
-      if (family.length > 1) {
+      if (members.length > 1) {
         await runtime.close();
-        progress(
-          style.dim(`${providerId} is ${family.length} services on one account: ${family.join(', ')}`),
-        );
-        // In sequence, and the order matters: the first settles the account id
-        // and stores the credential, and the rest find both already there.
-        //
-        // The id travels as a flag because the family members are addressed by
-        // their own names: `connect icloud.will` parses `will` off a target
-        // that is then thrown away, and recursing with `options` alone dropped
-        // it — the command named an account and each member silently invented
-        // its own.
-        const inherited = { ...options, id: options.id ?? namedId };
-        const members: ConnectOutcome[] = [];
-        for (const member of family) members.push(await runConnect(member, inherited));
-
-        // The whole account succeeded only if every service did. A partial
-        // result is the case worth surfacing: one member blocked on a value
-        // leaves an account half connected, which `status` shows and prose does
-        // not.
-        return {
-          ...NOTHING,
-          ok: members.every((outcome) => outcome.ok),
+        return connectFamily({
+          name: providerId,
           members,
-          ...(members.find((outcome) => !outcome.ok)?.reason
-            ? { reason: members.find((outcome) => !outcome.ok)!.reason }
-            : {}),
-        };
+          options,
+          namedId,
+          connect: runConnect,
+        });
       }
     }
 
@@ -175,7 +165,26 @@ async function runConnect(target: string, options: ConnectOptions): Promise<Conn
 
     const profile = runtime.resolution.profile;
 
-    // 0. With nobody to ask, resolve everything up front or refuse saying why.
+    const prompter: Prompter =
+      options.nonInteractive === true
+        ? nonInteractivePrompter(`lanes link setup plan ${providerId} --profile ${profile}`)
+        : terminalPrompter;
+
+    // 0a. Which way in, before anything is resolved or written.
+    //
+    //     Ahead of the preflight because it changes the answer: one route needs
+    //     a browser and the other needs a key, and refusing a scripted run for
+    //     want of a browser it was never going to open is a refusal about the
+    //     wrong thing. Inert for every provider declaring one method, which is
+    //     all of them but one vendor's.
+    const method = await chooseAuthMethod({
+      manifest,
+      requested: options.auth,
+      ownClient: options.ownClient === true,
+      prompter,
+    });
+
+    // 0b. With nobody to ask, resolve everything up front or refuse saying why.
     //
     //    Before any write, so a refusal leaves the profile exactly as it was.
     //    The whole list comes back at once: discovering a missing value a
@@ -185,19 +194,36 @@ async function runConnect(target: string, options: ConnectOptions): Promise<Conn
         manifest,
         connectionId: named ?? adopted,
         profile,
+        target: runtime.target,
         credentials: runtime.credentials,
-        target,
+        spec: target,
+        method: method.kind,
       });
 
       if (blocked) return { ...NOTHING, ok: false, ...blocked };
     }
 
-    const prompter: Prompter =
-      options.nonInteractive === true
-        ? nonInteractivePrompter(`lanes link setup plan ${providerId} --profile ${profile}`)
-        : terminalPrompter;
-
-    if (manifest.auth.kind === 'oauth') {
+    if (method.kind === 'assertion') {
+      await authoriseWithKey({
+        manifest,
+        assertion: method.assertion,
+        connectionId: provisionalId,
+        credentials: runtime.credentials,
+        changes,
+        // Same reading as the static-credential arm below: naming a connection,
+        // or asking outright, is how someone says "that one again" — which is
+        // what a rotated key calls for.
+        replace: options.nonInteractive !== true && (options.replace === true || named !== undefined),
+        prompter,
+      });
+    } else if (method.kind === 'pasted') {
+      await authorisePastedToken({
+        manifest,
+        connectionId: provisionalId,
+        credentials: runtime.credentials,
+        prompter,
+      });
+    } else if (manifest.auth.kind === 'oauth') {
       await authorise({
         manifest,
         connectionId: provisionalId,
@@ -207,7 +233,7 @@ async function runConnect(target: string, options: ConnectOptions): Promise<Conn
         firstForProvider: !runtime.config.connections.some((c) => c.provider === providerId),
         target,
         profile,
-        ownClient: options.ownClient === true,
+        client: method.client,
         prompter,
         acceptBroadScopes: options.acceptBroadScopes === true,
         ...(options.fetch ? { fetch: options.fetch } : {}),
@@ -257,52 +283,18 @@ async function runConnect(target: string, options: ConnectOptions): Promise<Conn
       if (from && to && from !== to) await moveCredential(runtime.credentials, from, to);
     }
 
-    // 3. Ask the upstream what it exposes. A manifest never declares
-    //    capabilities for a proxied server — the server is the source of truth,
-    //    and a declared list would go stale the moment the vendor ships.
-    let discovered: DiscoveredCapability[] = [];
-
-    if (manifest.connector.kind !== 'local') {
-      progress(style.dim(DISCOVERY_NOTE[manifest.connector.kind] ?? 'Discovering capabilities…'));
-
-      // MCP is the one kind that does not use the runtime's connector here: it
-      // wants the token exactly as just written, without the refresh machinery
-      // that `bearerToken` wraps around it. Every other kind carries whatever
-      // credential it needs from the factory.
-      const connector =
-        manifest.connector.kind === 'mcp'
-          ? createMcpConnector({
-              endpoint: manifest.connector.endpoint,
-              ...(manifest.connector.headers ? { headers: manifest.connector.headers } : {}),
-              accessToken: () =>
-                bearerTokenAsStored(manifest, connectionId, runtime.credentials),
-            })
-          : runtime.connectorFor(providerId, connectionId);
-
-      if (connector) {
-        // Discovery takes the manifest and nothing else. What a provider exposes
-        // is a property of the provider, not of an account — which is just as
-        // well, because the connection being created does not exist in config
-        // until step 4 below.
-        discovered = await connector.discover({ manifest });
-
-        await runtime.state.kv.set('discovery', providerId, JSON.stringify(discovered));
-        registry.setDiscovered(providerId, discovered);
-      }
-    } else if (entry.definition) {
-      // Local capabilities carry their bundle from the manifest. Resources are
-      // included alongside tools: they need a policy grant too, and leaving
-      // them out would register a resource nothing is allowed to read.
-      const bundleOf = (name: string): string | undefined =>
-        manifest.bundles?.find((candidate) => candidate.capabilities.includes(name))?.name;
-
-      discovered = entry.definition.capabilities.map((capability) => ({
-        name: capability.name,
-        description: capability.description,
-        inputSchema: {},
-        ...(bundleOf(capability.name) ? { bundle: bundleOf(capability.name)! } : {}),
-      }));
-    }
+    // 3. Ask the upstream what it exposes.
+    const discovered = await discoverCapabilities({
+      entry,
+      manifest,
+      connectionId,
+      credentials: runtime.credentials,
+      connectorFor: runtime.connectorFor.bind(runtime),
+      remember: async (found) => {
+        await runtime.state.kv.set('discovery', providerId, JSON.stringify(found));
+        registry.setDiscovered(providerId, found);
+      },
+    });
 
     // 4. Declare the connection, or update the one this account already has.
     const existingIndex = runtime.config.connections.findIndex(
@@ -323,7 +315,11 @@ async function runConnect(target: string, options: ConnectOptions): Promise<Conn
         document.setIn(['connections', existingIndex, 'account'], account);
         changes.push(`connections.${connectionKey}.account = ${account}`);
       }
-      changes.push(`re-authorised ${connectionKey}`);
+      // Named where the provider offered a choice, because this is the line an
+      // operator reads to see that a re-connect swapped the route rather than
+      // refreshed it — and `--auth` reaches here having asked nothing. Unnamed
+      // for a provider with one way in, whose output is unchanged.
+      changes.push(`re-authorised ${connectionKey}${method.id ? ` with ${method.id}` : ''}`);
     }
 
     // 5. Grant it.
@@ -369,6 +365,7 @@ async function runConnect(target: string, options: ConnectOptions): Promise<Conn
         ok: true,
         key: connectionKey,
         account,
+        ...where(runtime),
         discovered: discovered.length,
         next: ALREADY,
       };
@@ -384,6 +381,7 @@ async function runConnect(target: string, options: ConnectOptions): Promise<Conn
       ok: true,
       key: connectionKey,
       account,
+      ...where(runtime),
       changes,
       granted,
       ...(notes.length > 0 ? { notes } : {}),