@lanes-sh/link 0.3.0 → 0.3.2

package/src/cli/main.ts

@@ -19,28 +19,15 @@ import {
 } from './commands/operate.ts';
 import { profileAdd, profileDefault, profileList } from './commands/profile.ts';
 import { removeProfile as profileRemove } from './commands/profile/remove.ts';
+import { syncTargets } from './commands/sync.ts';
 import { targetList, targetShow, targetUse } from './commands/target.ts';
 import { identityAdd, identityList, identityRemove } from './commands/identity.ts';
 import { setupPlan } from './commands/setup.ts';
 import { mcpAdd, mcpList, mcpStdio, skillDocument } from './commands/mcp.ts';
 import { deploy } from '#deployments/deploy.ts';
 import { secretsList, secretsPush, secretsSet } from './commands/secrets.ts';
-import {
-  memoryForget,
-  memoryGet,
-  memoryList,
-  memoryWrite,
-  skillsAdd,
-  skillsList,
-  skillsRemove,
-  skillsShow,
-  vaultGet,
-  vaultKeyGenerate,
-  vaultList,
-  vaultRemove,
-  vaultSet,
-} from './commands/owner.ts';
 import { knowledgeShow, knowledgeUse } from './commands/knowledge.ts';
+import { dispatchOwner } from './dispatch-owner.ts';
 import { update } from './commands/update.ts';
 import { all, globalFlags, knowledgeFlags, ownerFlags, parseArgv, text } from './argv.ts';
 import { assertKnownFlags, requireSelection } from './selection.ts';
@@ -235,38 +222,17 @@ export async function run(argv: readonly string[]): Promise<void> {
       if (second !== 'show' && second !== undefined) throw new Error(`Unknown: ${PROGRAM} config ${second}`);
       return configShow(global);
 
+    // memory, skills and vault — one subject, dispatched together.
+    // `vault key generate` is synchronous, so this returns the result rather
+    // than testing it for truthiness.
     case 'memory':
-      switch (second) {
-        case 'list':
-        case undefined:
-          return memoryList(owner);
-        case 'get':
-          return memoryGet(rest[0], owner);
-        case 'write':
-          return memoryWrite(rest[0], owner);
-        case 'forget':
-          return memoryForget(rest[0], owner);
-        default:
-          throw new Error(`Unknown: ${PROGRAM} memory ${second}`);
-      }
-
     case 'skills':
-      switch (second) {
-        case 'list':
-        case undefined:
-          return skillsList(owner);
-        case 'show':
-          return skillsShow(rest[0], owner);
-        case 'add':
-          return skillsAdd(rest[0], owner);
-        case 'remove':
-          return skillsRemove(rest[0], owner);
-        default:
-          throw new Error(`Unknown: ${PROGRAM} skills ${second}`);
-      }
+    case 'vault':
+      return dispatchOwner(first, second, rest, owner, PROGRAM);
 
     // Beside `memory` and `skills` because it is the question they raise next:
-    // those two say what is stored, and this says where it is kept.
+    // those two say what is stored, and this says where it is kept. Not one of
+    // them, though — it takes its own flags rather than the owner set.
     case 'knowledge':
       switch (second) {
         case 'show':
@@ -278,26 +244,6 @@ export async function run(argv: readonly string[]): Promise<void> {
           throw new Error(`Unknown: ${PROGRAM} knowledge ${second}`);
       }
 
-    case 'vault':
-      switch (second) {
-        case 'list':
-        case undefined:
-          return vaultList(owner);
-        case 'get':
-          return vaultGet(rest[0], owner);
-        case 'set':
-          return vaultSet(rest[0], owner);
-        case 'remove':
-          return vaultRemove(rest[0], owner);
-        case 'key':
-          if (rest[0] !== 'generate') {
-            throw new Error(`Usage: ${PROGRAM} vault key generate`);
-          }
-          return vaultKeyGenerate(owner);
-        default:
-          throw new Error(`Unknown: ${PROGRAM} vault ${second}`);
-      }
-
     case 'check':
       return check(global);
     case 'plan':
@@ -365,6 +311,10 @@ export async function run(argv: readonly string[]): Promise<void> {
     case 'deploy':
       return deploy({
         ...global,
+        // Repeatable, like `profile add --target`: a deploy sends every profile
+        // that declares the target, and this narrows that set rather than
+        // selecting from it. The first named is the primary (ADR-043).
+        profiles: all(argv, 'profile'),
         dryRun: flags['dry-run'] === true,
         // `--iam` was a boolean that meant "add the platform's own check on top".
         // It is now one of two values of a declared field, because the opposite
@@ -377,6 +327,21 @@ export async function run(argv: readonly string[]): Promise<void> {
         nonInteractive: flags['non-interactive'] === true,
       });
 
+    case 'sync':
+      switch (second) {
+        case undefined:
+        case 'targets':
+          return syncTargets({
+            ...global,
+            dryRun: flags['dry-run'] === true,
+            from: text(flags, 'from'),
+            discover: flags['discover'] === true,
+            prefer: text(flags, 'prefer'),
+          });
+        default:
+          throw new Error(`Unknown: ${PROGRAM} sync ${second}`);
+      }
+
     case 'secrets':
       switch (second) {
         case 'push':

package/src/cli/nearest.ts

@@ -0,0 +1,45 @@
+/**
+ * "Did you mean --profile?" — one edit away, and no further.
+ *
+ * Pulled out of `selection.ts`, which is the table of what each command needs
+ * and the checks that enforce it. Guessing at a misspelling is neither: it is
+ * string distance, it has no idea what a flag is, and the reason it lives
+ * beside that file rather than inside it is that the file kept growing every
+ * time a command was added and this never did.
+ */
+
+/**
+ * The closest accepted flag, when there is an obviously close one.
+ *
+ * One edit away, or one transposition — enough for `--porfile` and `--taget`,
+ * and short of guessing at something the operator did not mean. A wrong guess
+ * here costs more than no guess: it sends them to a flag that is not the answer.
+ */
+export function nearest(given: string, allowed: ReadonlySet<string>): string | undefined {
+  for (const candidate of allowed) {
+    if (Math.abs(candidate.length - given.length) > 1) continue;
+    if (distance(given, candidate) <= 1) return candidate;
+    if (sorted(given) === sorted(candidate)) return candidate;
+  }
+  return undefined;
+}
+
+const sorted = (text: string): string => [...text].sort().join('');
+
+function distance(a: string, b: string): number {
+  let row = Array.from({ length: b.length + 1 }, (_, index) => index);
+
+  for (let i = 1; i <= a.length; i++) {
+    const next = [i];
+    for (let j = 1; j <= b.length; j++) {
+      next[j] = Math.min(
+        row[j]! + 1,
+        next[j - 1]! + 1,
+        row[j - 1]! + (a[i - 1] === b[j - 1] ? 0 : 1),
+      );
+    }
+    row = next;
+  }
+
+  return row[b.length]!;
+}

package/src/cli/runtime/open.ts

@@ -6,10 +6,10 @@ import type { BlobStore } from '#stores/blobs';
 import type { AnyConnector, ProviderManifest } from '#connectivity';
 import { RateLimiter, allowedConnections } from '#policy';
 import {
-  ConfigError,
   KNOWLEDGE_LAYOUT,
   layout,
   listProfiles,
+  undeclaredTarget,
   workspacePath,
   type Config,
   type Resolution,
@@ -125,7 +125,12 @@ export async function openRuntime(
 ): Promise<Runtime> {
   const { resolution, config, target } = await resolveProfile(flags);
   const declared = config.targets[target];
-  if (!declared) throw new ConfigError(`Target "${target}" is not declared`);
+  // `resolveProfile` has already checked this, so reaching it means a caller
+  // passed `allowUndeclaredTarget`. Through the shared refusal all the same:
+  // this was a fourth spelling of that sentence with the profile name and the
+  // list of what exists both missing, and the comment on `undeclaredTarget`
+  // says why one copy is the most that survives.
+  if (!declared) throw undeclaredTarget(target, config, resolution.profile);
 
   const root = resolution.workspaceRoot;
   const adapters: TargetInput = { declared, config, root, target };

package/src/cli/selection.ts

@@ -2,11 +2,15 @@ import {
   ConfigError,
   listProfiles,
   loadProfileConfig,
+  loadWorkspaceProfiles,
   noProfileNamed,
+  noTargetInWorkspace,
   noTargetNamed,
   resolveWorkspaceRoot,
+  targetsByName,
 } from '#profile';
 import type { Flags } from './argv.ts';
+import { nearest } from './nearest.ts';
 
 /**
  * Which commands must name a profile and a target, and which flags each accepts.
@@ -30,8 +34,15 @@ import type { Flags } from './argv.ts';
  * default to requiring nothing.
  */
 
-/** What a command must be told before it can act. */
-export type Requires = 'none' | 'profile' | 'profile+target';
+/**
+ * What a command must be told before it can act.
+ *
+ * `target` is not a weaker `profile+target`. It says the command's subject *is*
+ * the target, and that the profiles behind it are every profile declaring it
+ * rather than one the operator picks (ADR-043). `--profile` stays accepted
+ * there, as a filter.
+ */
+export type Requires = 'none' | 'profile' | 'target' | 'profile+target';
 
 /**
  * The rule, per command path.
@@ -54,8 +65,17 @@ export type Requires = 'none' | 'profile' | 'profile+target';
  * answer as input is circular, and it has to keep working in the state every
  * other command fails in.
  *
- * `profile add` **rejects** both. The name is positional, and there is no
- * profile to select before it exists.
+ * `status`, `deploy` and `sync targets` take `target` rather than
+ * `profile+target`. One deployed endpoint serves every profile in the workspace
+ * (ADR-009), so the profile set behind a target is enumerable from the config
+ * and naming one of them describes a slice, not the subject. That is not the
+ * inference ADR-037 removed: there is nothing to guess at, and nothing is
+ * silently chosen.
+ *
+ * `profile add` and `profile remove` **reject** `--profile`. Both name their
+ * profile positionally, so a flag naming a second one could only disagree with
+ * it. `add` has no profile to select before it exists; `remove` takes an
+ * optional `--target` to decommission one target's stores and keep the file.
  */
 export const SELECTION: Record<string, Requires> = {
   help: 'none',
@@ -83,7 +103,7 @@ export const SELECTION: Record<string, Requires> = {
   'target list': 'profile',
   'target show': 'profile',
   'secrets push': 'profile',
-  'profile remove': 'profile',
+  'profile remove': 'none',
   // Target-independent for the same reason `policy list` is: the block is
   // declared once in the YAML and applies to every target the profile has.
   identity: 'profile',
@@ -96,7 +116,8 @@ export const SELECTION: Record<string, Requires> = {
   secrets: 'profile+target',
   plan: 'profile+target',
   doctor: 'profile+target',
-  status: 'profile+target',
+  // Target-scoped: see the note above. `--profile` narrows each to one profile.
+  status: 'target',
   outputs: 'profile+target',
   tools: 'profile+target',
   // It reads which target it is rendering for before it decides anything: a
@@ -104,7 +125,11 @@ export const SELECTION: Record<string, Requires> = {
   dashboard: 'profile+target',
   attach: 'profile+target',
   start: 'profile+target',
-  deploy: 'profile+target',
+  deploy: 'target',
+  // Both spellings: `sync` alone is `sync targets`, which is the only thing
+  // there is to sync, and naming it leaves room for the next one.
+  sync: 'target',
+  'sync targets': 'target',
   'policy allow': 'profile+target',
   'policy deny': 'profile+target',
   // Both, unlike `identity list`, and for the same reason the policy edits are:
@@ -154,6 +179,7 @@ const SUBCOMMANDS: Record<string, readonly string[]> = {
   mcp: ['skill', 'add', 'stdio', 'list'],
   secrets: ['push', 'set', 'list'],
   knowledge: ['show', 'use'],
+  sync: ['targets'],
 };
 
 /**
@@ -208,6 +234,15 @@ export async function requireSelection(
   const needs = requirementFor(first, second);
   if (needs === 'none') return;
 
+  // Asked before the profile requirement, because for these there is none. The
+  // refusal has to describe the workspace rather than one profile's targets,
+  // since the command was never going to act on only one.
+  if (needs === 'target') {
+    if (typeof flags['target'] === 'string') return;
+    const root = resolveWorkspaceRoot(env ? { env } : {});
+    throw noTargetInWorkspace(targetsByName(await loadWorkspaceProfiles(root)), root, env);
+  }
+
   const profile = flags['profile'];
   if (typeof profile !== 'string') {
     const root = resolveWorkspaceRoot(env ? { env } : {});
@@ -258,7 +293,11 @@ const ACCEPTS: Record<string, readonly string[]> = {
   ],
   setup: ['id'],
   'profile add': ['target', 'non-interactive'],
-  'profile remove': ['dry-run', 'yes'],
+  // `--target` decommissions one target's stores and leaves the profile file in
+  // place (`removal.ts`). It is documented in `usage.ts` and read by
+  // `removalPlan`, and was refused here — the flag existed everywhere except in
+  // the list that decides whether it may be typed.
+  'profile remove': ['dry-run', 'yes', 'target'],
   'target list': ['urls', 'target'],
   'target show': ['target'],
   'token show': ['show', 'raw'],
@@ -271,13 +310,16 @@ const ACCEPTS: Record<string, readonly string[]> = {
   'mcp stdio': ['only'],
   'mcp add': ['name', 'scope', 'token-env', 'dry-run', 'force', 'no-skill'],
   'mcp skill': ['print', 'force'],
+  'mcp list': ['name', 'scope'],
   dashboard: ['print'],
   skill: ['print', 'force'],
   deploy: ['dry-run', 'iam', 'access', 'service-account', 'tag', 'yes', 'non-interactive'],
   'secrets push': ['from', 'to', 'overwrite', 'dry-run'],
+  sync: ['dry-run', 'from', 'discover', 'prefer'],
+  'sync targets': ['dry-run', 'from', 'discover', 'prefer'],
   update: ['check'],
   'identity add': ['note'],
-  memory: ['connection', 'title', 'description', 'file'],
+  memory: ['connection', 'title', 'description', 'file', 'tag'],
   skills: ['connection', 'title', 'description', 'file'],
   vault: ['connection'],
   // `no-migrate` is listed beside `migrate` because they are three states
@@ -303,8 +345,10 @@ export function assertKnownFlags(first: string, second: string | undefined, flag
   const allowed = new Set<string>([
     ...UNIVERSAL,
     ...(ACCEPTS[key] ?? []),
-    ...(needs === 'profile' || needs === 'profile+target' ? ['profile'] : []),
-    ...(needs === 'profile+target' ? ['target'] : []),
+    // `target` accepts both: the target is what it acts on, and `--profile`
+    // narrows it to one of the profiles behind it.
+    ...(needs !== 'none' ? ['profile'] : []),
+    ...(needs === 'target' || needs === 'profile+target' ? ['target'] : []),
   ]);
 
   const named = [first, second].filter(Boolean).join(' ');
@@ -319,39 +363,3 @@ export function assertKnownFlags(first: string, second: string | undefined, flag
     );
   }
 }
-
-/**
- * The closest accepted flag, when there is an obviously close one.
- *
- * One edit away, or one transposition — enough for `--porfile` and `--taget`,
- * and short of guessing at something the operator did not mean. A wrong guess
- * here costs more than no guess: it sends them to a flag that is not the answer.
- */
-function nearest(given: string, allowed: ReadonlySet<string>): string | undefined {
-  for (const candidate of allowed) {
-    if (Math.abs(candidate.length - given.length) > 1) continue;
-    if (distance(given, candidate) <= 1) return candidate;
-    if (sorted(given) === sorted(candidate)) return candidate;
-  }
-  return undefined;
-}
-
-const sorted = (text: string): string => [...text].sort().join('');
-
-function distance(a: string, b: string): number {
-  let row = Array.from({ length: b.length + 1 }, (_, index) => index);
-
-  for (let i = 1; i <= a.length; i++) {
-    const next = [i];
-    for (let j = 1; j <= b.length; j++) {
-      next[j] = Math.min(
-        row[j]! + 1,
-        next[j - 1]! + 1,
-        row[j - 1]! + (a[i - 1] === b[j - 1] ? 0 : 1),
-      );
-    }
-    row = next;
-  }
-
-  return row[b.length]!;
-}

package/src/cli/usage.ts

@@ -49,6 +49,11 @@ ${style.bold('Profiles')}
 ${style.bold('Targets')}
   ${PROGRAM} target list [--urls]      where this profile can run
   ${PROGRAM} target show <name>        one target's adapters, and the address it answers on
+  ${PROGRAM} sync targets --target t [--from gs://bucket] [--discover]
+                                 [--prefer local|remote] [--dry-run]
+                                 reconcile this workspace with the copy the
+                                 deployment reads; recovers a target a profile
+                                 has lost
 
 ${style.bold('Who you are')}
   ${PROGRAM} identity add <kind> <value> [--note text] [--json]
@@ -89,10 +94,13 @@ ${style.bold('Your own context')}
   ${PROGRAM} vault key generate         a fresh LANES_LINK_VAULT_KEY, printed once
 
 ${style.bold('Deploying')}
-  ${PROGRAM} deploy [--dry-run]         set up, build, and roll a revision
+  ${PROGRAM} deploy --target t [--dry-run]
+                                 set up, build, and roll one revision serving
+                                 every profile that declares the target
+  ${PROGRAM} deploy --target t --profile a --profile b
+                                 only these; the first owns the endpoint token
   ${PROGRAM} deploy --non-interactive   take the stored answers, never prompt
   ${PROGRAM} deploy --access iam|public who gets past the platform's own door
-  ${PROGRAM} deploy --target <name>     deploy a second one, under its own name
   ${PROGRAM} secrets list               credential references in this target
   ${PROGRAM} secrets set <ref>          store one value, read from stdin
   ${PROGRAM} secrets push --from local --to cloud

package/src/deployments/deploy.ts

@@ -1,4 +1,4 @@
-import { ConfigError, type DeployConfig } from '#profile';
+import { ConfigError, recordDeployment, resolveWorkspaceRoot, type DeployConfig } from '#profile';
 import { announce, fail, heading, ok, print, style, warn } from '#cli/output.ts';
 import { staleNudge } from '#cli/release.ts';
 import { confirm, isInteractive } from '#cli/prompt.ts';
@@ -9,6 +9,8 @@ import { driverFor } from './drivers.ts';
 import { prepareSecrets, readableRefs, rotatableRefs } from './prepare.ts';
 import { deployedWorkspace, repairSetupSurface, uploadWorkspace } from './upload.ts';
 import { unservableProfiles, unservableRefusal } from './servable.ts';
+import { collidingRefs, collisionRefusal, servingProfiles } from './serving.ts';
+import { healthLine, reachability, registerLine, reportUnauthorised } from './report.ts';
 
 /**
  * `lanes link deploy` — set up what is missing, build the image, roll a revision,
@@ -42,6 +44,14 @@ export interface DeployFlags extends GlobalFlags {
    * this is for a terminal attached to a job nobody is watching.
    */
   readonly nonInteractive?: boolean | undefined;
+  /**
+   * Which profiles to send, narrowing the set the target implies.
+   *
+   * Repeatable, and absent means every profile declaring the target — the set
+   * the endpoint is going to open either way (ADR-043). The first one named is
+   * the primary.
+   */
+  readonly profiles?: readonly string[] | undefined;
 }
 
 export async function deploy(flags: DeployFlags): Promise<void> {
@@ -57,10 +67,34 @@ export async function deploy(flags: DeployFlags): Promise<void> {
   // from one command line on the command that creates cloud resources and rolls
   // a public URL — where `allowUndeclaredTarget` means a mistake is not refused
   // but surveyed, written into the profile, and deployed as a new service.
-  const { resolution, config, target } = await resolveProfile(flags, {
-    allowUndeclaredTarget: true,
+  //
+  // Which profiles is derived rather than named: every profile declaring the
+  // target, because that is the set the revision will try to open (ADR-009).
+  // `--profile` narrows it, and a first deploy still has to name one — a target
+  // nothing declares has no set to derive from.
+  const { profiles: serving, primary } = await servingProfiles({
+    workspaceRoot: resolveWorkspaceRoot(),
+    target: requireTargetFlag(flags),
+    named: flags.profiles ?? [],
   });
+
+  const { resolution, config, target } = await resolveProfile(
+    { ...flags, profile: primary },
+    { allowUndeclaredTarget: true },
+  );
   announce(resolution);
+  if (serving.length > 1) {
+    print(style.dim(`         serving ${serving.join(', ')} — ${primary} owns the token`));
+  }
+
+  // Before anything external, beside `check`, and for the same reason: two
+  // profiles writing one flat credential ref into one store is a failure with
+  // no later symptom worth having.
+  const colliding = await collidingRefs(resolution.workspaceRoot, serving);
+  if (colliding.length > 0) {
+    heading('Cannot share a credential store');
+    throw new ConfigError(collisionRefusal(colliding, target));
+  }
 
   // `check` before anything external, per the gate order: a config that will be
   // rejected on boot should be rejected here, not after a five-minute build.
@@ -91,8 +125,8 @@ export async function deploy(flags: DeployFlags): Promise<void> {
   // below are, and read from config and manifests before anything opens a
   // store — `--dry-run` must reach the printed step list without touching a
   // credential.
-  const rotatable = await rotatableRefs(resolution.workspaceRoot, flags.profile);
-  const readable = await readableRefs(resolution.workspaceRoot, flags.profile, declared);
+  const rotatable = await rotatableRefs(resolution.workspaceRoot, serving);
+  const readable = await readableRefs(resolution.workspaceRoot, serving, declared);
   const provision = await driver.provision({
     deploy: deployConfig,
     declared,
@@ -212,7 +246,7 @@ export async function deploy(flags: DeployFlags): Promise<void> {
     // says there is a bucket to send to at all.
     const unservable = await unservableProfiles({
       workspaceRoot: resolution.workspaceRoot,
-      profile: flags.profile,
+      profiles: serving,
       target,
     });
 
@@ -221,12 +255,22 @@ export async function deploy(flags: DeployFlags): Promise<void> {
       throw new ConfigError(unservableRefusal(unservable, target));
     }
 
-    await repairSetupSurface(resolution.workspaceRoot, flags.profile);
+    await repairSetupSurface(resolution.workspaceRoot, serving);
 
     // Before the rollout, so the revision that comes up finds a config to read.
     // Uploading after would leave a window where the service is serving and the
     // workspace it was told to read is not there yet.
-    await uploadWorkspace(resolution.workspaceRoot, workspace, flags.profile);
+    await uploadWorkspace(resolution.workspaceRoot, workspace, serving);
+
+    // Recorded once the bucket is known to hold this target's config. It is an
+    // index, not configuration (ADR-044) — the next recovery reads it instead
+    // of asking the platform.
+    await recordDeployment(resolution.workspaceRoot, {
+      target,
+      workspace,
+      primary: resolution.profile,
+      last_deploy: new Date().toISOString(),
+    });
   }
 
   heading('Rolling out');
@@ -251,103 +295,10 @@ export async function deploy(flags: DeployFlags): Promise<void> {
   reportUnauthorised(prepared.warnings, resolution.profile, target);
 }
 
-/**
- * How to register the endpoint, and when.
- *
- * The ordering is the whole point of the second half. A client captures
- * `tools/list` when it connects and keeps it: this endpoint is stateless, so
- * there is no stream on which to send `notifications/tools/list_changed`, and
- * `buildMcpServer` no longer pretends otherwise. A first deploy necessarily
- * publishes a profile whose only connection is `setup.main` — the accounts come
- * after — so a connector registered in that window captures a two-tool surface
- * and holds it. The endpoint is right, every reload lands, and the client shows
- * two tools until someone removes and re-adds it.
- *
- * Unconditional, and that is the correction that matters. This was gated on
- * `prepared.warnings.length`, which is zero in precisely the case it describes:
- * a fresh profile declares only `setup.main`, `setup` is a local provider with
- * no credential, so `prepareSecrets` has nothing to warn about. The advice
- * appeared only on a later re-deploy, by which point the connector is usually
- * registered and the ordering is no longer available to get right.
- */
-function registerLine(profile: string, target: string): string {
-  return style.dim(
-    `  Connect your accounts first, then register with:\n` +
-      `    lanes link outputs --profile ${profile} --target ${target}\n` +
-      '  A client keeps the tool list it fetched when it connected, so one registered\n' +
-      '  before the accounts holds a surface without them until it is re-added.',
-  );
-}
-
-/**
- * The accounts a browser still has to authorise, and the step after them.
- *
- * Printed last rather than before the build, because this is the only thing
- * left to do and a list eight steps up the scrollback is a list nobody reads.
- *
- * There is no second deploy at the end of it any more, and the reason the old
- * one existed is worth keeping. Connection *credentials* are read live on every
- * call, so a fresh `connect` looked like it should be picked up — but whether a
- * connection was usable at all was decided by a reconcile that ran once per
- * process, so a revision that came up with an account unauthorised went on
- * refusing it, naming the connection rather than the staleness. Reconcile now
- * runs again on every reload, and `connect` asks for one (ADR-029).
- */
-function reportUnauthorised(warnings: readonly string[], profile: string, target: string): void {
-  if (warnings.length === 0) return;
-
-  heading('Not authorised yet');
-  for (const problem of warnings) print(warn(problem));
-  print('');
-  print(
-    style.dim(
-      '  A browser consent per account is the one step this cannot take for you:\n' +
-        `    lanes link connect <provider> --profile ${profile} --target ${target}\n` +
-        '  Each is served as soon as it is authorised. There is no second deploy —\n' +
-        '  deploying is how code gets here, and authorising an account changes none.',
-    ),
-  );
-}
-
-/**
- * Who can reach the service once this lands.
- *
- * Printed on every deploy rather than only when it changes, because it is the
- * one property of a deployment that is invisible from the outside until someone
- * either cannot get in or should not have been able to.
- */
-function reachability(access: DeployConfig['access']): string {
-  return access === 'iam'
-    ? style.dim(
-        '  access:   iam — the platform admits only callers holding its own identity\n' +
-          '            token. No agent harness can mint one; use --access public with an\n' +
-          '            authorization block if a remote MCP client has to reach this.',
-      )
-    : style.dim(
-        '  access:   public — the platform lets requests through and this endpoint\n' +
-          '            authenticates them. The bearer token is what protects it.',
-      );
-}
-
-/** Ask the deployed endpoint whether it came up. */
-async function healthLine(url: string): Promise<string> {
-  try {
-    const response = await fetch(`${url}/health`, { signal: AbortSignal.timeout(10_000) });
-    if (!response.ok) return warn(`the endpoint answered /health with ${response.status}`);
-
-    // Asked anonymously, so it reports that the revision is up and nothing
-    // about what it serves — the profile list is behind the token now.
-    // `lanes link outputs` holds one and prints the rest.
-    const body = (await response.json()) as { profiles?: string[] };
-    return ok(
-      body.profiles
-        ? `healthy — serving ${body.profiles.join(', ')}`
-        : 'healthy — run `lanes link outputs` with this profile and target for what it serves',
-    );
-  } catch {
-    // A cold start plus a database connect can outrun a short probe, and
-    // `access: iam` makes /health unreachable from here by design. Neither is a
-    // failed deploy.
-    return warn('could not reach /health from here — with access: iam that is expected');
+/** `--target` is required by `SELECTION`; this is the type narrowing, not a check. */
+function requireTargetFlag(flags: DeployFlags): string {
+  if (!flags.target) {
+    throw new ConfigError('--target is required. It names the deployment this acts on.');
   }
+  return flags.target;
 }