@lanes-sh/link 0.3.0 → 0.3.2

package/README.md

@@ -150,6 +150,7 @@ than being rebuilt.
 - **[Connect your accounts](docs/connect.md)** — every provider, and what each one needs
 - **[Add it to your agent](docs/clients.md)** — Claude Code, Codex, Claude Desktop, claude.ai, ChatGPT
 - **[Deploy to your own cloud](docs/deploy.md)** — five commands to a URL
+- **[Every command](docs/detailed/commands.md)** — arguments and flags, one entry each
 - **[Full reference](docs/detailed/)** — architecture, configuration, the CLI, the security model,
   writing a provider, and the decision records
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lanes-sh/link",
-  "version": "0.3.0",
+  "version": "0.3.2",
   "description": "A self-hostable MCP gateway for all your connections, memory, skills, and secrets",
   "license": "Apache-2.0",
   "homepage": "https://lanes.sh/link",

package/src/cli/commands/operate/inspect.ts

@@ -1,7 +1,7 @@
 import { credentialRefFor, formatPlan, planIsNoop, planReconcile } from '#registry';
-import { announce, emit, fail, ok, print, warn } from '../../output.ts';
+import { announce, announceProfile, emit, fail, ok, print, warn } from '../../output.ts';
 import { staleNudge } from '../../release.ts';
-import { openRuntime, resolveProfile, type GlobalFlags } from '../../runtime.ts';
+import { openRuntime, resolveProfileOnly, type GlobalFlags } from '../../runtime.ts';
 import type { FetchLike } from '#deployments/knowledge.ts';
 import { credentialAge, reportCapabilityDrift } from './findings.ts';
 
@@ -13,12 +13,13 @@ import { credentialAge, reportCapabilityDrift } from './findings.ts';
 
 /** Static validation only. No external calls, no database, no credentials. */
 export async function check(flags: GlobalFlags): Promise<void> {
-  const { resolution, config } = await resolveProfile(flags);
-  announce(resolution);
+  const { selection, config } = await resolveProfileOnly(flags);
+  announceProfile(selection);
 
   // Reaching here means the loader accepted it: contract major, no credential
-  // values, referential integrity, and target resolution all passed.
-  print(ok(`${resolution.profilePath} is valid`));
+  // values, and referential integrity all passed. Not target resolution — this
+  // validates a file, and the file is the same whichever target reads it.
+  print(ok(`${selection.profilePath} is valid`));
   print(
     `      ${config.connections.length} connection(s), ` +
       `${config.policy.allow.length} allow rule(s), ${config.policy.deny.length} deny rule(s)`,

package/src/cli/commands/operate/outputs.ts

@@ -142,7 +142,7 @@ export async function outputs(flags: OutputsFlags): Promise<void> {
 async function servable(workspaceRoot: string, target: string): Promise<string[]> {
   const all = await listProfiles(workspaceRoot);
   const cannot = new Set(
-    (await unservableProfiles({ workspaceRoot, profile: undefined, target })).map(
+    (await unservableProfiles({ workspaceRoot, profiles: undefined, target })).map(
       (one) => one.profile,
     ),
   );

package/src/cli/commands/operate/policy.ts

@@ -1,7 +1,7 @@
 import { loadConfigFile } from '#profile';
 import { ConfigDocument } from '../../config-edit.ts';
-import { announce, heading, ok, print, style, table } from '../../output.ts';
-import { resolveProfile, type GlobalFlags } from '../../runtime.ts';
+import { announce, announceProfile, heading, ok, print, style, table } from '../../output.ts';
+import { resolveProfile, resolveProfileOnly, type GlobalFlags } from '../../runtime.ts';
 import { nextAfterEdit, publishProfileEdit } from '../../publish.ts';
 
 /**
@@ -12,8 +12,8 @@ import { nextAfterEdit, publishProfileEdit } from '../../publish.ts';
  */
 
 export async function policyList(flags: GlobalFlags): Promise<void> {
-  const { resolution, config } = await resolveProfile(flags);
-  announce(resolution);
+  const { selection, config } = await resolveProfileOnly(flags);
+  announceProfile(selection);
 
   if (config.policy.allow.length === 0 && config.policy.deny.length === 0) {
     print(style.dim('No rules. Default deny is in effect: nothing is reachable.'));
@@ -73,8 +73,8 @@ export async function policyRule(
 }
 
 export async function configShow(flags: GlobalFlags): Promise<void> {
-  const { resolution } = await resolveProfile(flags);
-  announce(resolution);
-  const { config } = await loadConfigFile(resolution.profilePath);
+  const { selection } = await resolveProfileOnly(flags);
+  announceProfile(selection);
+  const { config } = await loadConfigFile(selection.profilePath);
   print(JSON.stringify(config, null, 2));
 }

package/src/cli/commands/operate/status.ts

@@ -1,4 +1,4 @@
-import { listProfiles } from '#profile';
+import { listProfiles, loadWorkspaceProfiles, resolveWorkspaceRoot } from '#profile';
 import { oneProfile, visibleCapabilities } from '#server/mcp';
 import { toPolicyDocument } from '#registry';
 import { announce, emit, heading, print, style, table } from '../../output.ts';
@@ -32,6 +32,8 @@ export interface StatusFlags extends GlobalFlags {
  * config-only command can say that much honestly.
  */
 export async function status(flags: StatusFlags): Promise<void> {
+  if (flags.profile === undefined) return workspaceStatus(flags);
+
   const runtime = await openRuntime(flags);
   try {
     const records = await runtime.state.connections.list();
@@ -131,3 +133,108 @@ export async function status(flags: StatusFlags): Promise<void> {
     await runtime.close();
   }
 }
+
+/**
+ * `lanes link status --target <t>` — the whole workspace at one target.
+ *
+ * The default, because the subject of this command is the endpoint and one
+ * endpoint serves every profile in the workspace (ADR-009, ADR-043). Naming a
+ * profile narrows it to the detailed view above; naming none is not a missing
+ * answer, it is the wider one.
+ *
+ * **Opens no store and makes no network call.** The view above already declines
+ * to probe, for the reasons in this file's header; this one additionally
+ * declines to open a target's adapters, so it stays instant and — more to the
+ * point — still answers for a target whose stores are unreachable, misdeclared,
+ * or gone. A summary that needs the deployment to be healthy cannot report that
+ * it is not.
+ *
+ * That is what makes the row it exists for legible: a target declared by one
+ * profile and not its sibling. From inside either profile that state is
+ * invisible, and it is what a vanished deployment looks like from the outside.
+ */
+async function workspaceStatus(flags: StatusFlags): Promise<void> {
+  const target = flags.target!;
+  const root = resolveWorkspaceRoot();
+  const workspace = await loadWorkspaceProfiles(root);
+
+  const profiles = workspace.loaded.map((entry) => ({
+    name: entry.profile,
+    declares: target in entry.config.targets,
+    connections: entry.config.connections.length,
+    deployment: deploymentIdentity(entry.config.targets[target]?.deploy),
+  }));
+
+  const declaring = profiles.filter((entry) => entry.declares);
+
+  // Distinct deployments, not the first one found. Two profiles declaring the
+  // same target name against different services is drift worth printing rather
+  // than a tie to break silently — and picking one would make the wrong half of
+  // the workspace look correctly configured.
+  const deployments = [
+    ...new Map(
+      declaring
+        .filter((entry) => entry.deployment !== null)
+        .map((entry) => [JSON.stringify(entry.deployment), entry.deployment!] as const),
+    ).values(),
+  ];
+
+  return emit(
+    flags.json,
+    { workspace: root, target, profiles, deployments, unreadable: workspace.unreadable },
+    () => {
+      print(style.dim(`workspace ${style.bold(root)}  target ${style.bold(target)}`));
+
+      heading('Profiles');
+      table(
+        profiles.map((entry) => [
+          `  ${style.bold(entry.name)}`,
+          entry.declares ? style.green(`${target} declared`) : style.yellow('not declared'),
+          style.dim(entry.declares ? `${entry.connections} connection(s)` : '—'),
+        ]),
+      );
+      for (const bad of workspace.unreadable) {
+        print(`  ${style.bold(bad.profile)}  ${style.yellow(bad.reason)}`);
+      }
+
+      heading('Endpoint');
+      if (declaring.length === 0) {
+        print(style.yellow(`  No profile declares "${target}".`));
+        print(
+          style.dim(
+            '  If it was deployed once, the deployment still exists and only the\n' +
+              `  declaration is gone — recover it with: lanes link sync targets --target ${target}`,
+          ),
+        );
+        return;
+      }
+
+      if (deployments.length === 0) {
+        print(style.dim('  No deployment — this target runs wherever the CLI does.'));
+        return;
+      }
+
+      for (const deployment of deployments) {
+        const { platform, service, region } = deployment;
+        print(`  ${platform} service ${style.bold(service)} in ${region}`);
+      }
+
+      if (deployments.length > 1) {
+        print(
+          style.yellow(
+            `  ${deployments.length} profiles declare "${target}" against different services.`,
+          ),
+        );
+        print(style.dim('  They are separate endpoints sharing a name. Check each profile.'));
+        return;
+      }
+
+      print(
+        style.dim(
+          "  the address is the platform's to assign — run: " +
+            `lanes link outputs --target ${target} --profile ${declaring[0]!.name}`,
+        ),
+      );
+    },
+  );
+}

package/src/cli/commands/profile/remove.ts

@@ -12,12 +12,12 @@ import {
 import { parseDocument } from 'yaml';
 import { rm } from 'node:fs/promises';
 import { terminalPrompter, type Prompter } from '../../prompt.ts';
-import { announce, emit, fail, ok, print, style } from '../../output.ts';
+import { announceProfile, emit, fail, ok, print, style } from '../../output.ts';
 import {
   buildRegistryWithWorkspace,
   openBlobStoreFor,
   openSecretStoreFor,
-  resolveProfile,
+  resolveProfileOnly,
   type GlobalFlags,
 } from '../../runtime.ts';
 import { removalPlan, renderPlan, type RemovalItem, type RemovalPlan } from './removal.ts';
@@ -250,10 +250,10 @@ export interface RemoveFlags extends GlobalFlags {
  * in the tool.
  */
 export async function removeProfile(name: string, flags: RemoveFlags): Promise<void> {
-  const { resolution, config } = await resolveProfile({ ...flags, profile: name });
-  announce(resolution);
+  const { selection, config } = await resolveProfileOnly({ ...flags, profile: name });
+  announceProfile(selection);
 
-  const root = resolution.workspaceRoot;
+  const root = selection.workspaceRoot;
   const registry = await buildRegistryWithWorkspace(root, name);
   const files = workspaceFiles(root);
 

package/src/cli/commands/secrets.ts

@@ -1,7 +1,7 @@
 import { ConfigError } from '#profile';
 import { assertValidSecretRef } from '#secrets';
-import { announce, heading, ok, print, style } from '../output.ts';
-import { openSecretStoreFor, resolveProfile, type GlobalFlags } from '../runtime.ts';
+import { announce, announceProfile, heading, ok, print, style } from '../output.ts';
+import { openSecretStoreFor, resolveProfile, resolveProfileOnly, type GlobalFlags } from '../runtime.ts';
 
 /**
  * `lanes link secrets` — moving credential values between a profile's targets.
@@ -35,11 +35,11 @@ export async function secretsPush(flags: SecretsFlags): Promise<void> {
     throw new ConfigError(`--from and --to are both "${flags.from}"; there is nothing to copy.`);
   }
 
-  const { resolution, config } = await resolveProfile(flags);
-  announce(resolution);
+  const { selection, config } = await resolveProfileOnly(flags);
+  announceProfile(selection);
 
-  const source = await openSecretStoreFor(config, resolution.workspaceRoot, flags.from);
-  const destination = await openSecretStoreFor(config, resolution.workspaceRoot, flags.to);
+  const source = await openSecretStoreFor(config, selection.workspaceRoot, flags.from);
+  const destination = await openSecretStoreFor(config, selection.workspaceRoot, flags.to);
 
   const refs = await source.list();
   if (refs.length === 0) {

package/src/cli/commands/sync.ts

@@ -0,0 +1,262 @@
+import {
+  ConfigError,
+  findDeployment,
+  loadWorkspaceProfiles,
+  recordDeployment,
+  resolveWorkspaceRoot,
+} from '#profile';
+import {
+  applyBlobs,
+  applyPulls,
+  applyPushes,
+  planBlobs,
+  planProfile,
+  profilesInEither,
+  resolved,
+  type Prefer,
+  type ProfileSync,
+} from '#deployments/sync-apply.ts';
+import { conflictsIn, type Change } from '#deployments/sync.ts';
+import { deployedWorkspace } from '#deployments/upload.ts';
+import { discoverDeployments, holdsWorkspace } from '#deployments/discover.ts';
+import { emit, heading, ok, print, style, waiting, warn } from '../output.ts';
+import { confirm, isInteractive } from '../prompt.ts';
+import type { GlobalFlags } from '../runtime.ts';
+
+/**
+ * `lanes link sync targets` — the workspace and a target's copy of it, reconciled.
+ *
+ * A deploy leaves two copies of every profile: the one in the workspace and the
+ * one in the bucket the endpoint reads. They are meant to agree, and when they
+ * stop there was no way to find out, let alone to say which side had lost
+ * something. The reported case: a local profile was rewritten and lost its
+ * cloud target, `auth.authorization`, and six connections, while the bucket
+ * still held every one of them and the service went on answering.
+ *
+ * Union, and refuse where a union is impossible (ADR-044). Nothing here
+ * overwrites a value that exists on both sides — that is `--prefer`, asked for
+ * explicitly, because silently choosing one copy over the other is the failure
+ * this command was written in response to.
+ */
+
+export interface SyncFlags extends GlobalFlags {
+  readonly json?: boolean | undefined;
+  readonly dryRun?: boolean | undefined;
+  readonly from?: string | undefined;
+  readonly discover?: boolean | undefined;
+  readonly prefer?: string | undefined;
+}
+
+function parsePrefer(value: string | undefined): Prefer | undefined {
+  if (value === undefined) return undefined;
+  if (value !== 'local' && value !== 'remote') {
+    throw new ConfigError(`--prefer must be "local" or "remote", not "${value}"`);
+  }
+  return value;
+}
+
+/**
+ * Where the target's copy lives, tried cheapest first.
+ *
+ * The order is the point. A declared target answers instantly and is right
+ * whenever anything is; the index answers instantly and is right when the
+ * declaration is what went missing; `--from` is for when the operator knows and
+ * the workspace does not; and discovery is the one that works from nothing, at
+ * the cost of a `gcloud` call per project.
+ */
+async function locateRemote(
+  root: string,
+  target: string,
+  flags: SyncFlags,
+): Promise<{ workspace: string; how: string }> {
+  if (flags.from) {
+    if (!(await holdsWorkspace(flags.from))) {
+      throw new ConfigError(
+        `${flags.from} does not hold a workspace — no ${'lanes-link.yaml'} in it.\n` +
+          '  Check the bucket name, or run with --discover to search for one.',
+      );
+    }
+    return { workspace: flags.from.replace(/\/$/, ''), how: '--from' };
+  }
+
+  for (const entry of (await loadWorkspaceProfiles(root)).loaded) {
+    const declared = entry.config.targets[target];
+    const workspace = declared ? deployedWorkspace(declared) : undefined;
+    if (workspace) return { workspace, how: `declared by ${entry.profile}` };
+  }
+
+  const recorded = await findDeployment(root, target);
+  if (recorded) return { workspace: recorded.workspace, how: 'recorded by a previous deploy' };
+
+  if (flags.discover !== true) {
+    throw new ConfigError(
+      `Nothing here says where "${target}" lives.\n` +
+        '  No profile declares it, and no deploy recorded it in lanes-link.yaml.\n\n' +
+        '  If you know the bucket:  lanes link sync targets --target ' +
+        `${target} --from gs://<bucket>\n` +
+        `  If you do not:           lanes link sync targets --target ${target} --discover`,
+    );
+  }
+
+  const candidates = (
+    await waiting('searching your projects for a deployment', () =>
+      discoverDeployments(),
+    )
+  ).filter((candidate) => candidate.workspace !== undefined);
+
+  if (candidates.length === 0) {
+    throw new ConfigError(
+      'Found no deployment holding a workspace in any project this login can see.\n' +
+        '  Check you are logged in as the right account: gcloud auth list',
+    );
+  }
+
+  print('');
+  for (const candidate of candidates) {
+    print(`  ${style.bold(candidate.service)}  ${candidate.region}  ${candidate.project}`);
+    print(style.dim(`    workspace ${candidate.workspace}`));
+  }
+
+  // One is offered rather than chosen: adopting the wrong deployment would
+  // merge a stranger's config into this workspace.
+  const first = candidates[0]!;
+  if (candidates.length > 1 || !isInteractive()) {
+    throw new ConfigError(
+      `Found ${candidates.length} deployment(s). Name the one you mean:\n` +
+        `  lanes link sync targets --target ${target} --from ${first.workspace}`,
+    );
+  }
+
+  if (!(await confirm(`  Sync "${target}" against ${first.workspace}?`))) {
+    throw new ConfigError('Nothing was read or written.');
+  }
+
+  return { workspace: first.workspace!, how: 'discovered' };
+}
+
+const arrow = (direction: Change['direction']): string =>
+  direction === 'pull' ? style.green('←') : direction === 'push' ? style.cyan('→') : style.yellow('!');
+
+const describe = (change: Change): string => {
+  const path = change.path.length === 0 ? 'the whole profile' : change.path.join('.');
+  if (change.direction === 'pull') return `${path}  ${style.dim('missing locally')}`;
+  if (change.direction === 'push') return `${path}  ${style.dim('missing remotely')}`;
+  return `${path}  ${style.dim(`local ${short(change.local)} ≠ remote ${short(change.remote)}`)}`;
+};
+
+const short = (value: unknown): string => {
+  const text = typeof value === 'string' ? value : JSON.stringify(value);
+  return (text ?? 'nothing').length > 40 ? `${(text ?? '').slice(0, 37)}…` : (text ?? 'nothing');
+};
+
+export async function syncTargets(flags: SyncFlags): Promise<void> {
+  const target = flags.target!;
+  const prefer = parsePrefer(flags.prefer);
+  const root = resolveWorkspaceRoot();
+
+  const { workspace: remote, how } = await locateRemote(root, target, flags);
+
+  const names = flags.profile ? [flags.profile] : await profilesInEither(root, remote);
+  const plans: ProfileSync[] = [];
+  for (const profile of names) plans.push(await planProfile(root, remote, profile, prefer));
+
+  const blobs = await planBlobs(root, remote);
+  const conflicts = [
+    ...plans.flatMap((plan) => conflictsIn(plan.changes)),
+    ...blobs.filter((blob) => blob.direction === 'conflict'),
+  ];
+
+  const payload = {
+    workspace: root,
+    remote,
+    target,
+    profiles: plans.map((plan) => ({ profile: plan.profile, changes: plan.changes })),
+    blobs,
+    conflicts: conflicts.length,
+    applied: false,
+  };
+
+  const render = (): void => {
+    print(style.dim(`workspace ${style.bold(root)}  target ${style.bold(target)}`));
+    print(style.dim(`remote    ${remote}  (${how})`));
+
+    let anything = false;
+    for (const plan of plans) {
+      if (plan.changes.length === 0) continue;
+      anything = true;
+
+      heading(plan.profile);
+      for (const change of plan.changes) print(`  ${arrow(change.direction)} ${describe(change)}`);
+    }
+
+    if (blobs.length > 0) {
+      anything = true;
+      heading('Skills and manifests');
+      for (const blob of blobs) print(`  ${arrow(blob.direction)} ${blob.key}`);
+    }
+
+    if (!anything) print(ok('already in step — nothing to copy in either direction'));
+  };
+
+  if (conflicts.length > 0 && prefer === undefined) {
+    render();
+    print('');
+    throw new ConfigError(
+      `${conflicts.length} conflict(s): both copies hold these, and they disagree.\n` +
+        '  Nothing was written. Re-run with --prefer local or --prefer remote,\n' +
+        '  or edit one side so they agree.',
+    );
+  }
+
+  if (flags.dryRun === true) {
+    return emit(flags.json, payload, () => {
+      render();
+      print('');
+      print(style.dim('  --dry-run: nothing was written on either side.'));
+    });
+  }
+
+  if (flags.json !== true) render();
+
+  let pulled = 0;
+  let pushed = 0;
+  for (const plan of plans) {
+    const changes = resolved(plan.changes, prefer);
+    pulled += await applyPulls(root, remote, plan.profile, changes);
+    if (await applyPushes(root, remote, plan.profile, changes)) pushed += 1;
+  }
+
+  const copied = await applyBlobs(
+    root,
+    remote,
+    resolvedBlobs(blobs, prefer),
+  );
+
+  // Recorded now that a bucket has been confirmed to hold this target's
+  // workspace: the next recovery does not have to discover it again.
+  await recordDeployment(root, { target, workspace: remote });
+
+  return emit(flags.json, { ...payload, applied: true, pulled, pushed, copied }, () => {
+    print('');
+    if (pulled === 0 && pushed === 0 && copied === 0) return;
+
+    print(ok(`${pulled} key(s) pulled, ${pushed} profile(s) pushed, ${copied} file(s) copied`));
+    print(style.dim(`  recorded ${remote} in lanes-link.yaml, so this is findable next time`));
+    if (pushed > 0) {
+      print(style.dim(`  the endpoint re-reads its config on the next call — or run:`));
+      print(style.dim(`    lanes link status --target ${target}`));
+    }
+  });
+}
+
+/** A conflicting file follows `--prefer` like a conflicting key does. */
+function resolvedBlobs(
+  blobs: readonly { key: string; direction: 'pull' | 'push' | 'conflict' }[],
+  prefer: Prefer | undefined,
+): { key: string; direction: 'pull' | 'push' }[] {
+  return blobs.flatMap((blob) => {
+    if (blob.direction !== 'conflict') return [{ key: blob.key, direction: blob.direction }];
+    if (prefer === undefined) return [];
+    return [{ key: blob.key, direction: prefer === 'remote' ? ('pull' as const) : ('push' as const) }];
+  });
+}

package/src/cli/config-edit.ts

@@ -296,6 +296,11 @@ export function newWorkspaceTemplate(): string {
 # A workspace holds one or more profiles, and one endpoint serves all of them:
 # every call names the profile it means, with --profile. Profiles never share a
 # database or a credential store, so what one holds is invisible to another.
+#
+# "deploy" adds a "deployments:" list here. It is an index, not configuration —
+# nothing resolves from it. It records where a deployment lives so that losing
+# the target block out of a profile does not lose the service, the bucket, and
+# the credential store along with it. "lanes link sync targets" reads it.
 contract: 1
 `;
 }

package/src/cli/dispatch-owner.ts

@@ -0,0 +1,93 @@
+import {
+  memoryForget,
+  memoryGet,
+  memoryList,
+  memoryWrite,
+  skillsAdd,
+  skillsList,
+  skillsRemove,
+  skillsShow,
+  vaultGet,
+  vaultKeyGenerate,
+  vaultList,
+  vaultRemove,
+  vaultSet,
+  type OwnerFlags,
+} from './commands/owner.ts';
+
+/**
+ * The three commands over the owner's own data: memory, skills, and the vault.
+ *
+ * Split out of `main.ts` for the reason the budget in `src/architecture.test.ts`
+ * exists to find, rather than to satisfy a line count. These three are one
+ * subject — what the owner put here themselves, as against what a provider
+ * holds on their behalf — they already live together in `commands/owner/`, and
+ * they are the only commands in the grammar sharing a flag shape of their own.
+ *
+ * `main.ts` keeps the grammar. This keeps one branch of it.
+ */
+export function dispatchOwner(
+  first: string,
+  second: string | undefined,
+  rest: readonly string[],
+  owner: OwnerFlags,
+  program: string,
+): Promise<void> | void {
+  switch (first) {
+    case 'memory':
+      switch (second) {
+        case 'list':
+        case undefined:
+          return memoryList(owner);
+        case 'get':
+          return memoryGet(rest[0], owner);
+        case 'write':
+          return memoryWrite(rest[0], owner);
+        case 'forget':
+          return memoryForget(rest[0], owner);
+        default:
+          throw new Error(`Unknown: ${program} memory ${second}`);
+      }
+
+    case 'skills':
+      switch (second) {
+        case 'list':
+        case undefined:
+          return skillsList(owner);
+        case 'show':
+          return skillsShow(rest[0], owner);
+        case 'add':
+          return skillsAdd(rest[0], owner);
+        case 'remove':
+          return skillsRemove(rest[0], owner);
+        default:
+          throw new Error(`Unknown: ${program} skills ${second}`);
+      }
+
+    case 'vault':
+      switch (second) {
+        case 'list':
+        case undefined:
+          return vaultList(owner);
+        case 'get':
+          return vaultGet(rest[0], owner);
+        case 'set':
+          return vaultSet(rest[0], owner);
+        case 'remove':
+          return vaultRemove(rest[0], owner);
+        case 'key':
+          if (rest[0] !== 'generate') {
+            throw new Error(`Usage: ${program} vault key generate`);
+          }
+          return vaultKeyGenerate(owner);
+        default:
+          throw new Error(`Unknown: ${program} vault ${second}`);
+      }
+
+    default:
+      // Unreachable: `main.ts` narrows to the three above before calling. Kept
+      // so that adding a fourth case there and forgetting it here is a thrown
+      // error rather than a command that silently does nothing.
+      throw new Error(`Unknown: ${program} ${first}`);
+  }
+}