@lanes-sh/link 0.2.2 → 0.3.1

package/src/cli/commands/operate/inspect.ts

@@ -1,18 +1,9 @@
-import { ownerPrincipal } from '#auth';
-import type { DiscoveredCapability } from '#connectivity';
-import { BROKERED } from '#connectivity/auth/index.ts';
-import { allowedConnections } from '#policy';
-import {
-  credentialRefFor,
-  formatPlan,
-  planIsNoop,
-  planReconcile,
-  toPolicyDocument,
-} from '#registry';
-import { announce, emit, fail, ok, print, warn } from '../../output.ts';
+import { credentialRefFor, formatPlan, planIsNoop, planReconcile } from '#registry';
+import { announce, announceProfile, emit, fail, ok, print, warn } from '../../output.ts';
 import { staleNudge } from '../../release.ts';
-import { capabilityDiff, discoveryProbe } from '../../runtime/discovery.ts';
-import { openRuntime, resolveProfile, type GlobalFlags } from '../../runtime.ts';
+import { openRuntime, resolveProfileOnly, type GlobalFlags } from '../../runtime.ts';
+import type { FetchLike } from '#deployments/knowledge.ts';
+import { credentialAge, reportCapabilityDrift } from './findings.ts';
 
 /**
  * The gate order — check, doctor, plan, start — exists so failures surface in
@@ -22,12 +13,13 @@ import { openRuntime, resolveProfile, type GlobalFlags } from '../../runtime.ts'
 
 /** Static validation only. No external calls, no database, no credentials. */
 export async function check(flags: GlobalFlags): Promise<void> {
-  const { resolution, config } = await resolveProfile(flags);
-  announce(resolution);
+  const { selection, config } = await resolveProfileOnly(flags);
+  announceProfile(selection);
 
   // Reaching here means the loader accepted it: contract major, no credential
-  // values, referential integrity, and target resolution all passed.
-  print(ok(`${resolution.profilePath} is valid`));
+  // values, and referential integrity all passed. Not target resolution — this
+  // validates a file, and the file is the same whichever target reads it.
+  print(ok(`${selection.profilePath} is valid`));
   print(
     `      ${config.connections.length} connection(s), ` +
       `${config.policy.allow.length} allow rule(s), ${config.policy.deny.length} deny rule(s)`,
@@ -48,16 +40,18 @@ export async function plan(flags: GlobalFlags): Promise<void> {
 
 export interface DoctorFlags extends GlobalFlags {
   readonly json?: boolean | undefined;
+  /** Injected for tests. A knowledge repository is the only thing doctor fetches. */
+  readonly fetch?: FetchLike | undefined;
 }
 
 /**
  * One thing doctor found: what is wrong, and the command that fixes it.
  *
- * `fix` carries `--profile` while the printed line does not. A person reading
- * the terminal just resolved a profile to get here and their next command
- * resolves the same one; something parsing this JSON has no shell context at
- * all, so leaving it off would hand an agent a command that acts on whichever
- * profile happens to be the default.
+ * `fix` carries both flags. That used to be an argument about JSON callers —
+ * a person reading the terminal had just resolved a profile and their next
+ * command would resolve the same one, while a parser had no shell context. The
+ * argument is moot now: nothing resolves on its own (ADR-037), so a command
+ * without them refuses whoever runs it. What survives is the shape.
  */
 export interface DoctorFinding {
   readonly kind: string;
@@ -68,15 +62,15 @@ export interface DoctorFinding {
 
 /** Read-only external checks: credentials resolve, stores reachable. */
 export async function doctor(flags: DoctorFlags): Promise<void> {
-  const runtime = await openRuntime(flags);
+  const runtime = await openRuntime(flags, { fetch: flags.fetch });
 
   const checks: string[] = [];
   const warnings: DoctorFinding[] = [];
   const problems: DoctorFinding[] = [];
 
   try {
-    const forProfile = (command: string) =>
-      `${command} --profile ${runtime.resolution.profile}`;
+    const forSelection = (command: string) =>
+      `${command} --profile ${runtime.resolution.profile} --target ${runtime.resolution.target}`;
 
     checks.push('config is valid');
     checks.push('state store is reachable');
@@ -90,7 +84,7 @@ export async function doctor(flags: DoctorFlags): Promise<void> {
       warnings.push({
         kind: 'no_profile_token',
         message: 'no profile token yet — lanes link start will mint one, or run: lanes link token rotate',
-        fix: forProfile('lanes link token rotate'),
+        fix: forSelection('lanes link token rotate'),
       });
     }
 
@@ -120,7 +114,7 @@ export async function doctor(flags: DoctorFlags): Promise<void> {
             message:
               `${key} credential is ${staleness.days} days old — a Google app in "Testing" expires at 7. ` +
               `Run: lanes link connect ${key}`,
-            fix: forProfile(`lanes link connect ${key}`),
+            fix: forSelection(`lanes link connect ${key}`),
           });
         } else {
           const age = staleness
@@ -133,7 +127,45 @@ export async function doctor(flags: DoctorFlags): Promise<void> {
           kind: 'missing_credential',
           key,
           message: `${key} has no stored credential — run: lanes link connect ${key}`,
-          fix: forProfile(`lanes link connect ${key}`),
+          fix: forSelection(`lanes link connect ${key}`),
+        });
+      }
+    }
+
+    // A repository this profile stores memory and skills in is an external
+    // dependency the other checks here do not cover, and it fails in the way
+    // doctor exists for: a token expires, and memory stops working with nothing
+    // said until the next read. One request answers all of it.
+    if (runtime.knowledge) {
+      try {
+        const facts = await runtime.knowledge.repository.facts();
+
+        if (!facts.canPush) {
+          problems.push({
+            kind: 'knowledge_read_only',
+            key: facts.fullName,
+            message:
+              `memory and skills are kept in ${facts.fullName}, and the token can no longer write ` +
+              'to it — writes will fail. Regenerate it with Contents: read and write, then run: ' +
+              'lanes link knowledge use github --repo ' + facts.fullName + ' --replace',
+            fix: forSelection(`lanes link knowledge use github --repo ${facts.fullName} --replace`),
+          });
+        } else if (!facts.private) {
+          warnings.push({
+            kind: 'knowledge_public',
+            key: facts.fullName,
+            message: `${facts.fullName} is public — every memory entry and skill in it is world-readable`,
+          });
+        } else {
+          checks.push(`memory and skills reachable in ${facts.fullName}`);
+        }
+      } catch (error) {
+        problems.push({
+          kind: 'knowledge_unreachable',
+          key: runtime.knowledge.describe,
+          message:
+            `memory and skills are kept in ${runtime.knowledge.describe}, which could not be ` +
+            `reached: ${(error as Error).message}`,
         });
       }
     }
@@ -174,7 +206,7 @@ export async function doctor(flags: DoctorFlags): Promise<void> {
         message:
           `this profile ${hasSetupRow ? 'does not grant "setup.*"' : 'has no "setup" connection'}` +
           ', so an agent cannot see what is configured — run: lanes link connect setup',
-        fix: forProfile('lanes link connect setup'),
+        fix: forSelection('lanes link connect setup'),
       });
     }
 
@@ -205,7 +237,7 @@ export async function doctor(flags: DoctorFlags): Promise<void> {
       warnings.push({
         kind: 'reconcile_drift',
         message: 'runtime state differs from config — run: lanes link plan',
-        fix: forProfile('lanes link plan'),
+        fix: forSelection('lanes link plan'),
       });
     }
 
@@ -227,136 +259,3 @@ export async function doctor(flags: DoctorFlags): Promise<void> {
     await runtime.close();
   }
 }
-
-/**
- * How old a stored OAuth credential is.
- *
- * Derived from the `expires_at` the OAuth provider stamps when saving tokens.
- * Returns null for anything that is not a token blob — an app password has no
- * meaningful age, and guessing one would produce a confusing warning.
- */
-async function credentialAge(
-  credentials: { get(ref: string): Promise<string | null> },
-  ref: string,
-): Promise<{ days: number; brokered: boolean } | null> {
-  const raw = await credentials.get(ref);
-  if (!raw) return null;
-
-  try {
-    const parsed = JSON.parse(raw) as {
-      expires_at?: number;
-      expires_in?: number;
-      authorized_via?: string;
-    };
-    if (typeof parsed.expires_at !== 'number') return null;
-
-    const issued = parsed.expires_at - (parsed.expires_in ?? 3600) * 1000;
-    return {
-      days: Math.floor((Date.now() - issued) / 86_400_000),
-      brokered: parsed.authorized_via === BROKERED,
-    };
-  } catch {
-    return null;
-  }
-}
-
-/**
- * Capabilities the upstream has grown since you connected.
- *
- * This is what replaced pinning an allow line per tool. `connect` writes
- * `provider.*`, which is readable and which a vendor can quietly widen by
- * shipping a new tool — so the widening has to be *visible* somewhere, and
- * doctor is where you look when you want to know what changed.
- *
- * Compared against the discovery cache rather than against config, because the
- * cache is what the running server actually serves. Failures are reported and
- * skipped: an upstream being down is not a reason for doctor to fail, and it is
- * already obvious from every other check.
- *
- * This used to open `if (kind !== 'mcp') continue`, which meant it watched the
- * one connector kind whose capabilities this repository does not ship and
- * ignored the two it does. Drive gained three operations in a commit and the
- * endpoint served six for as long as the operator did not re-authorise; the
- * check written to make exactly that visible never ran. `http` is no longer
- * listed here because it no longer can drift — `runtime/discovery.ts` re-derives
- * it at startup — so what is left is the kinds that genuinely still cache.
- */
-async function reportCapabilityDrift(
-  runtime: Awaited<ReturnType<typeof openRuntime>>,
-  say: (message: string) => void,
-): Promise<void> {
-  const policy = toPolicyDocument(runtime.config);
-  const principal = ownerPrincipal(runtime.config.instance.profile).id;
-
-  for (const entry of runtime.registry.list()) {
-    const connection = runtime.config.connections.find((c) => c.provider === entry.manifest.id);
-    if (!connection) continue;
-
-    const connector = runtime.connectorFor(entry.manifest.id, connection.id);
-    const probe = discoveryProbe(entry.manifest, connector);
-    // Re-derived every startup, so what is served is what is shipped. Probing
-    // it here would only ever compare a value against itself.
-    if (!probe || probe.cost === 'offline') continue;
-
-    const cached = runtime.registry.discovered(entry.manifest.id) ?? [];
-
-    let live: readonly DiscoveredCapability[];
-    try {
-      live = await probe.run();
-    } catch {
-      continue;
-    }
-
-    // A provider that was never discovered serves nothing at all, which reads
-    // from the outside like the provider being broken. Skipping it silently is
-    // how that stays a mystery.
-    if (cached.length === 0) {
-      say(
-        `${entry.manifest.name} has never been discovered, so none of its ${live.length} ` +
-          `capability(ies) are served — run: lanes link connect ${entry.manifest.id}`,
-      );
-      continue;
-    }
-
-    const diff = capabilityDiff(cached, live);
-
-    if (diff.added.length > 0) {
-      // Through the same `allowedConnections` the dispatcher enforces with,
-      // rather than reading `policy.allow` directly. The predicate this replaced
-      // ignored its own `name` argument, so the answer was all-or-nothing, and
-      // it never consulted `deny` — telling an operator their policy covered a
-      // capability they had explicitly withheld.
-      const reachable = diff.added.filter(
-        (name) =>
-          allowedConnections(
-            `${entry.manifest.id}.${name}`,
-            [`${entry.manifest.id}.${connection.id}`],
-            principal,
-            policy,
-          ).length > 0,
-      );
-
-      say(
-        `${entry.manifest.name} has ${diff.added.length} new capability(ies) since you connected: ` +
-          `${diff.added.slice(0, 5).join(', ')}${diff.added.length > 5 ? ', …' : ''}` +
-          (reachable.length > 0
-            ? `\n      Your policy covers ${reachable.length} of them — lanes link policy deny ${entry.manifest.id}.<name> to withhold one.`
-            : ''),
-      );
-    }
-
-    if (diff.removed.length > 0) {
-      say(`${entry.manifest.name} no longer offers: ${diff.removed.slice(0, 5).join(', ')}`);
-    }
-
-    // The case ADR-017 said `plan` structurally could not report: a schema or a
-    // description moved, the name did not, and the endpoint is serving the old
-    // shape until it restarts.
-    if (diff.changed.length > 0) {
-      say(
-        `${entry.manifest.name} changed the shape of: ${diff.changed.slice(0, 5).join(', ')}` +
-          `\n      Run: lanes link connect ${entry.manifest.id}, then restart the endpoint.`,
-      );
-    }
-  }
-}

package/src/cli/commands/operate/outputs.ts

@@ -1,4 +1,5 @@
 import { listProfiles } from '#profile';
+import { unservableProfiles } from '#deployments/servable.ts';
 import { fileURLToPath } from 'node:url';
 import { deployedUrl, endpointHealth, localUrl } from '../../endpoint-url.ts';
 import { announce, heading, print, style, warn } from '../../output.ts';
@@ -36,11 +37,14 @@ export async function outputs(flags: OutputsFlags): Promise<void> {
     const live = await endpointHealth(url, token);
     const mine = live?.profile === runtime.resolution.profile;
 
-    // Live if it is up, otherwise what `start` would serve: the whole
-    // workspace, since `--only` is the exception rather than the default.
+    // Live if it is up, otherwise what `start` would serve — which is every
+    // profile in the workspace *that declares this target*, not every profile
+    // full stop. `start` opens them all against one target and skips the ones
+    // that cannot run on it, so listing those here would promise a reach the
+    // endpoint will not have.
     const profiles = mine
       ? live.profiles
-      : await listProfiles(runtime.resolution.workspaceRoot);
+      : await servable(runtime.resolution.workspaceRoot, runtime.target);
 
     if (flags.json) {
       print(
@@ -99,7 +103,11 @@ export async function outputs(flags: OutputsFlags): Promise<void> {
     );
     print('');
 
-    const invocation = await tokenInvocation(runtime.config.auth.token_ref, token, flags.profile);
+    const invocation = await tokenInvocation(
+      token,
+      runtime.resolution.profile,
+      runtime.resolution.target,
+    );
 
     print(
       `  claude mcp add --transport http lanes-link ${url} \\\n` +
@@ -130,6 +138,18 @@ export async function outputs(flags: OutputsFlags): Promise<void> {
   }
 }
 
+/** The profiles a `start` on this target would actually open. */
+async function servable(workspaceRoot: string, target: string): Promise<string[]> {
+  const all = await listProfiles(workspaceRoot);
+  const cannot = new Set(
+    (await unservableProfiles({ workspaceRoot, profiles: undefined, target })).map(
+      (one) => one.profile,
+    ),
+  );
+
+  return all.filter((name) => !cannot.has(name));
+}
+
 /**
  * The command that prints this endpoint's token, verified to actually work.
  *
@@ -140,18 +160,25 @@ export async function outputs(flags: OutputsFlags): Promise<void> {
  * checking it returns *this* token; otherwise the printed command names this
  * checkout, which always works.
  */
-async function tokenInvocation(
-  tokenRef: string,
+export async function tokenInvocation(
   expected: string,
-  profile: string | undefined,
+  profile: string,
+  target: string,
 ): Promise<{ command: string; onPath: boolean }> {
-  const suffix = profile ? ` --profile ${profile}` : '';
-  const short = `lanes link token show --raw${suffix}`;
+  // Both, always, and from the *resolved* selection rather than the flags. A
+  // token is per-target, so `outputs --target cloud` printing a bare
+  // `token show --raw` hands over the local one beside a deployed URL — a
+  // credential that looks like an answer and fails as a wrong password. Naming
+  // the profile as well makes the line pasteable into any shell rather than
+  // only into one where the same default happens to resolve.
+  const selection = ` --profile ${profile} --target ${target}`;
+  const short = `lanes link token show --raw${selection}`;
+  const argv = ['link', 'token', 'show', '--raw', '--profile', profile, '--target', target];
 
   const resolved = Bun.which('lanes');
   if (resolved) {
     try {
-      const result = Bun.spawnSync([resolved, 'link', 'token', 'show', '--raw', ...(profile ? ['--profile', profile] : [])]);
+      const result = Bun.spawnSync([resolved, ...argv]);
       // Compared against the token rather than merely checking it exited zero:
       // a `lanes` on PATH could belong to a different workspace entirely,
       // and would hand the harness a token this endpoint rejects.
@@ -168,6 +195,6 @@ async function tokenInvocation(
   // which is the empty-token failure this whole function exists to avoid,
   // reintroduced by the fallback meant to prevent it.
   const entry = fileURLToPath(new URL('../../lanes.ts', import.meta.url));
-  return { command: `bun run ${entry} link token show --raw${suffix}`, onPath: false };
+  return { command: `bun run ${entry} link token show --raw${selection}`, onPath: false };
 }
 

package/src/cli/commands/operate/policy.ts

@@ -1,7 +1,7 @@
 import { loadConfigFile } from '#profile';
 import { ConfigDocument } from '../../config-edit.ts';
-import { announce, heading, ok, print, style, table } from '../../output.ts';
-import { resolveProfile, type GlobalFlags } from '../../runtime.ts';
+import { announce, announceProfile, heading, ok, print, style, table } from '../../output.ts';
+import { resolveProfile, resolveProfileOnly, type GlobalFlags } from '../../runtime.ts';
 import { nextAfterEdit, publishProfileEdit } from '../../publish.ts';
 
 /**
@@ -12,8 +12,8 @@ import { nextAfterEdit, publishProfileEdit } from '../../publish.ts';
  */
 
 export async function policyList(flags: GlobalFlags): Promise<void> {
-  const { resolution, config } = await resolveProfile(flags);
-  announce(resolution);
+  const { selection, config } = await resolveProfileOnly(flags);
+  announceProfile(selection);
 
   if (config.policy.allow.length === 0 && config.policy.deny.length === 0) {
     print(style.dim('No rules. Default deny is in effect: nothing is reachable.'));
@@ -73,8 +73,8 @@ export async function policyRule(
 }
 
 export async function configShow(flags: GlobalFlags): Promise<void> {
-  const { resolution } = await resolveProfile(flags);
-  announce(resolution);
-  const { config } = await loadConfigFile(resolution.profilePath);
+  const { selection } = await resolveProfileOnly(flags);
+  announceProfile(selection);
+  const { config } = await loadConfigFile(selection.profilePath);
   print(JSON.stringify(config, null, 2));
 }

package/src/cli/commands/operate/serve.ts

@@ -24,6 +24,9 @@ export async function start(
     port: flags.port,
     only: flags.only,
     mintToken: true,
+    // Local, so there is a browser and a person at it. `container.ts` does not
+    // pass this — see `#server/dashboard.ts`.
+    dashboard: true,
     // Stderr, not stdout: `--json` and `--raw` callers parse the other stream.
     // A refused credential is the event worth seeing while this runs in the
     // foreground, and until now nothing printed it.

package/src/cli/commands/operate/status.ts

@@ -1,4 +1,4 @@
-import { listProfiles } from '#profile';
+import { listProfiles, loadWorkspaceProfiles, resolveWorkspaceRoot } from '#profile';
 import { oneProfile, visibleCapabilities } from '#server/mcp';
 import { toPolicyDocument } from '#registry';
 import { announce, emit, heading, print, style, table } from '../../output.ts';
@@ -32,6 +32,8 @@ export interface StatusFlags extends GlobalFlags {
  * config-only command can say that much honestly.
  */
 export async function status(flags: StatusFlags): Promise<void> {
+  if (flags.profile === undefined) return workspaceStatus(flags);
+
   const runtime = await openRuntime(flags);
   try {
     const records = await runtime.state.connections.list();
@@ -131,3 +133,108 @@ export async function status(flags: StatusFlags): Promise<void> {
     await runtime.close();
   }
 }
+
+/**
+ * `lanes link status --target <t>` — the whole workspace at one target.
+ *
+ * The default, because the subject of this command is the endpoint and one
+ * endpoint serves every profile in the workspace (ADR-009, ADR-043). Naming a
+ * profile narrows it to the detailed view above; naming none is not a missing
+ * answer, it is the wider one.
+ *
+ * **Opens no store and makes no network call.** The view above already declines
+ * to probe, for the reasons in this file's header; this one additionally
+ * declines to open a target's adapters, so it stays instant and — more to the
+ * point — still answers for a target whose stores are unreachable, misdeclared,
+ * or gone. A summary that needs the deployment to be healthy cannot report that
+ * it is not.
+ *
+ * That is what makes the row it exists for legible: a target declared by one
+ * profile and not its sibling. From inside either profile that state is
+ * invisible, and it is what a vanished deployment looks like from the outside.
+ */
+async function workspaceStatus(flags: StatusFlags): Promise<void> {
+  const target = flags.target!;
+  const root = resolveWorkspaceRoot();
+  const workspace = await loadWorkspaceProfiles(root);
+
+  const profiles = workspace.loaded.map((entry) => ({
+    name: entry.profile,
+    declares: target in entry.config.targets,
+    connections: entry.config.connections.length,
+    deployment: deploymentIdentity(entry.config.targets[target]?.deploy),
+  }));
+
+  const declaring = profiles.filter((entry) => entry.declares);
+
+  // Distinct deployments, not the first one found. Two profiles declaring the
+  // same target name against different services is drift worth printing rather
+  // than a tie to break silently — and picking one would make the wrong half of
+  // the workspace look correctly configured.
+  const deployments = [
+    ...new Map(
+      declaring
+        .filter((entry) => entry.deployment !== null)
+        .map((entry) => [JSON.stringify(entry.deployment), entry.deployment!] as const),
+    ).values(),
+  ];
+
+  return emit(
+    flags.json,
+    { workspace: root, target, profiles, deployments, unreadable: workspace.unreadable },
+    () => {
+      print(style.dim(`workspace ${style.bold(root)}  target ${style.bold(target)}`));
+
+      heading('Profiles');
+      table(
+        profiles.map((entry) => [
+          `  ${style.bold(entry.name)}`,
+          entry.declares ? style.green(`${target} declared`) : style.yellow('not declared'),
+          style.dim(entry.declares ? `${entry.connections} connection(s)` : '—'),
+        ]),
+      );
+      for (const bad of workspace.unreadable) {
+        print(`  ${style.bold(bad.profile)}  ${style.yellow(bad.reason)}`);
+      }
+
+      heading('Endpoint');
+      if (declaring.length === 0) {
+        print(style.yellow(`  No profile declares "${target}".`));
+        print(
+          style.dim(
+            '  If it was deployed once, the deployment still exists and only the\n' +
+              `  declaration is gone — recover it with: lanes link sync targets --target ${target}`,
+          ),
+        );
+        return;
+      }
+
+      if (deployments.length === 0) {
+        print(style.dim('  No deployment — this target runs wherever the CLI does.'));
+        return;
+      }
+
+      for (const deployment of deployments) {
+        const { platform, service, region } = deployment;
+        print(`  ${platform} service ${style.bold(service)} in ${region}`);
+      }
+
+      if (deployments.length > 1) {
+        print(
+          style.yellow(
+            `  ${deployments.length} profiles declare "${target}" against different services.`,
+          ),
+        );
+        print(style.dim('  They are separate endpoints sharing a name. Check each profile.'));
+        return;
+      }
+
+      print(
+        style.dim(
+          "  the address is the platform's to assign — run: " +
+            `lanes link outputs --target ${target} --profile ${declaring[0]!.name}`,
+        ),
+      );
+    },
+  );
+}

package/src/cli/commands/operate/token.ts

@@ -63,7 +63,7 @@ export async function tokenRotate(
     // than the command, so nothing re-reads this on its own.
     print(warn('every agent configured with the old token must be re-registered'));
     print(style.dim('  A harness stores the token it was given, not the command that produced it.'));
-    print(style.dim('  Run: lanes link outputs   for the command to re-run.'));
+    print(style.dim('  Run: lanes link outputs with this profile and target for the command to re-run.'));
   } finally {
     await runtime.close();
   }

package/src/cli/commands/operate.ts

@@ -8,6 +8,7 @@
  *   inspect.ts   check, plan, doctor — the gate order, cheapest failure first
  *   status.ts    connections, reachable capabilities, endpoint
  *   outputs.ts   what an agent harness needs, and proving the short form works
+ *   dashboard.ts opening the page a local endpoint serves, with the key it needs
  *   serve.ts     start
  *   audit.ts     audit tail and verify, and the Markdown rendering of tail
  *   token.ts     token show, token rotate
@@ -22,6 +23,7 @@ export { status } from './operate/status.ts';
 export { outputs, type OutputsFlags } from './operate/outputs.ts';
 export { tools, type ToolsFlags } from './operate/tools.ts';
 export { start } from './operate/serve.ts';
+export { dashboard, type DashboardFlags } from './operate/dashboard.ts';
 export { auditTail, auditVerify, markdownCell } from './operate/audit.ts';
 export { attachFile } from './operate/attach.ts';
 export { tokenRotate, tokenShow } from './operate/token.ts';