@lanes-sh/link 0.4.0 → 0.5.0

package/src/cli/selection.ts

@@ -111,6 +111,11 @@ export const SELECTION: Record<string, Requires> = {
   'identity list': 'profile',
 
   connect: 'profile+target',
+  // Both edit the profile config, and `disconnect` also opens the target's
+  // credential store to delete from it. Same requirement as `connect` for the
+  // same reasons.
+  disconnect: 'profile+target',
+  relabel: 'profile+target',
   // Its own row rather than an inheritance from `connect`. Both need the same
   // two things, but the row is what makes `selectionKey` return the two-word
   // key — and that is what keeps thirty declaration flags off
@@ -153,6 +158,8 @@ export const SELECTION: Record<string, Requires> = {
   'mcp add': 'profile+target',
   'mcp stdio': 'profile+target',
   memory: 'profile+target',
+  tasks: 'profile+target',
+  assets: 'profile+target',
   skills: 'profile+target',
   vault: 'profile+target',
   // Both halves open the target's adapters — `show` counts what is in the
@@ -181,6 +188,8 @@ const SUBCOMMANDS: Record<string, readonly string[]> = {
   config: ['show'],
   setup: ['plan'],
   memory: ['list', 'get', 'write', 'forget'],
+  tasks: ['list', 'get', 'add', 'update', 'remove'],
+  assets: ['list', 'get', 'add', 'remove'],
   skills: ['list', 'show', 'add', 'remove'],
   vault: ['list', 'get', 'set', 'remove', 'key'],
   mcp: ['skill', 'add', 'stdio', 'list'],
@@ -310,6 +319,8 @@ const ACCEPTS: Record<string, readonly string[]> = {
   // `removalPlan`, and was refused here — the flag existed everywhere except in
   // the list that decides whether it may be typed.
   'profile remove': ['dry-run', 'yes', 'target'],
+  disconnect: ['yes', 'keep-credential'],
+  relabel: [],
   'target list': ['urls', 'target'],
   'target show': ['target'],
   'token show': ['show', 'raw'],
@@ -332,6 +343,9 @@ const ACCEPTS: Record<string, readonly string[]> = {
   update: ['check'],
   'identity add': ['note'],
   memory: ['connection', 'title', 'description', 'file', 'tag'],
+  // `--yes` on both, because both have a delete that asks first.
+  tasks: ['connection', 'title', 'status', 'due', 'tag', 'yes'],
+  assets: ['connection', 'name', 'content-type', 'yes'],
   skills: ['connection', 'title', 'description', 'file'],
   vault: ['connection'],
   // `no-migrate` is listed beside `migrate` because they are three states

package/src/cli/usage.ts

@@ -16,7 +16,7 @@ import { style } from './output.ts';
 /** How this CLI is invoked — the `link` area of the `lanes` command. */
 export const PROGRAM = 'lanes link';
 
-export const USAGE = `${style.bold(PROGRAM)} — a self-hostable MCP gateway for all your connections, memory, skills, and secrets
+export const USAGE = `${style.bold(PROGRAM)} — a self-hostable MCP gateway for all your connections, memory, tasks, files, and secrets
 
 ${style.bold('Everyday')}
   ${PROGRAM} setup plan [--json]        what each provider needs, and which are connected
@@ -26,6 +26,9 @@ ${style.bold('Everyday')}
   ${PROGRAM} connect <...> --replace    ask for the stored password or key again
   ${PROGRAM} connect <...> --auth <method>  pick how, where there is a choice
   ${PROGRAM} connect <...> --non-interactive [--json]
+  ${PROGRAM} disconnect <provider>.<id>  remove an account, and delete its credential
+  ${PROGRAM} disconnect <...> --keep-credential   leave the credential in the store
+  ${PROGRAM} relabel <provider>.<id> <name>      rename what an account is called
   ${PROGRAM} connect custom <id> --connector <kind> --auth <method>
                                  declare a service that is not built in, and connect it.
                                  kinds: mcp, http, imap, dav, fs. Omit a value and it is
@@ -78,6 +81,18 @@ ${style.bold('Your own context')}
   ${PROGRAM} memory write <id> --title <t> [--tag t]   body on stdin
   ${PROGRAM} memory forget <id>
 
+  ${PROGRAM} tasks list [--status s]     what is outstanding; --status all for everything
+  ${PROGRAM} tasks get <id>
+  ${PROGRAM} tasks add <title> [--status s] [--due d] [--tag t]   notes on stdin
+  ${PROGRAM} tasks update <id> --status <s>   closing one is an update, not a remove
+  ${PROGRAM} tasks remove <id>
+                                 statuses: in_progress open blocked muted done dropped
+
+  ${PROGRAM} assets list                files kept in this profile
+  ${PROGRAM} assets get <name>          the bytes, to stdout — redirect them
+  ${PROGRAM} assets add <file> [--name n] [--content-type t]
+  ${PROGRAM} assets remove <name>
+
   ${PROGRAM} skills list                the procedures agents can invoke
   ${PROGRAM} skills show <name>
   ${PROGRAM} skills add <name> [--file f]             document on stdin
@@ -131,7 +146,8 @@ ${style.bold('Naming what a command acts on')}
                                  command that names neither refuses and lists what exists.
 
 ${style.bold('Other flags')}
-  --connection <id>              which memory/skills/vault connection, if a profile has several
+  --connection <id>              which memory/tasks/assets/skills/vault connection, where
+                                 a profile has several of one kind
   --yes                          skip the confirmation a destructive command would ask for
   --json                         machine-readable output, where a command offers it
   --non-interactive              never prompt: connect refuses with what to store,

package/src/connectivity/mail/attachments.ts

@@ -362,7 +362,11 @@ const CONTENT_TYPES: Readonly<Record<string, string>> = {
   // opens by extension anyway. Adding them back will fail the suite.
 };
 
-function guessContentType(filename: string): string {
+/**
+ * Exported because `assets` needs exactly this and the table above must not be
+ * copied — its `.pages`/`.numbers` note is a rule the copy would not carry.
+ */
+export function guessContentType(filename: string): string {
   const extension = filename.split('.').pop()?.toLowerCase();
   return (extension ? CONTENT_TYPES[extension] : undefined) ?? 'application/octet-stream';
 }

package/src/connectivity/mail/index.ts

@@ -21,7 +21,12 @@ export { receiptFor } from './message.ts';
 export { composeMime } from './compose.ts';
 
 export type { AttachmentRef, MailboxAttachmentSource, ResolveOptions } from './attachments.ts';
-export { attachmentRefSchema, attachmentsJsonSchema, resolveAttachments } from './attachments.ts';
+export {
+  attachmentRefSchema,
+  attachmentsJsonSchema,
+  guessContentType,
+  resolveAttachments,
+} from './attachments.ts';
 
 export type { StagedFile, StagedMetadata } from './staging.ts';
 export {

package/src/connectivity/manifest/provider.ts

@@ -64,8 +64,21 @@ export const providerManifestSchema = z.object({
 
 export type ProviderManifest = z.infer<typeof providerManifestSchema>;
 
-/** Provider ids reserved for the owner layer. */
-export const RESERVED_PROVIDER_IDS: readonly string[] = ['memory', 'skills', 'vault', 'setup', 'identity'];
+/**
+ * Provider ids reserved for the owner layer.
+ *
+ * The order is read: `#server/mcp`'s instructions emit one paragraph per
+ * reachable id in this sequence, so it is the order an agent meets them in.
+ */
+export const RESERVED_PROVIDER_IDS: readonly string[] = [
+  'memory',
+  'tasks',
+  'assets',
+  'skills',
+  'vault',
+  'setup',
+  'identity',
+];
 
 /**
  * Validate a manifest, with the cross-field rules the schema alone cannot

package/src/deployments/deploy.ts

@@ -7,7 +7,8 @@ import { resolveTarget, vaultEnv } from './bootstrap.ts';
 import { printSteps, runSteps } from './steps.ts';
 import { driverFor } from './drivers.ts';
 import { prepareSecrets, readableRefs, rotatableRefs } from './prepare.ts';
-import { deployedWorkspace, repairSetupSurface, uploadWorkspace } from './upload.ts';
+import { repairOwnerLayer } from '#cli/config-repair.ts';
+import { deployedWorkspace, uploadWorkspace } from './upload.ts';
 import { unservableProfiles, unservableRefusal } from './servable.ts';
 import { collidingRefs, collisionRefusal, servingProfiles } from './serving.ts';
 import { healthLine, reachability, registerLine, reportUnauthorised } from './report.ts';
@@ -255,7 +256,7 @@ export async function deploy(flags: DeployFlags): Promise<void> {
       throw new ConfigError(unservableRefusal(unservable, target));
     }
 
-    await repairSetupSurface(resolution.workspaceRoot, serving);
+    await repairOwnerLayer(resolution.workspaceRoot, serving);
 
     // Before the rollout, so the revision that comes up finds a config to read.
     // Uploading after would leave a window where the service is serving and the

package/src/deployments/prepare.ts

@@ -46,7 +46,7 @@ export interface PrepareResult {
  * path derives from the manifest and has never read config for. Sharing one list
  * would silently pick one answer for both.
  *
- * **Scoped exactly as the upload is**, for the reason `repairSetupSurface`
+ * **Scoped exactly as the upload is**, for the reason `repairOwnerLayer`
  * states and one more: a profile this deploy sends is a profile the endpoint may
  * serve, and a connection whose secret nobody bound fails an hour after the
  * revision reports healthy. The asymmetry decides it — an extra binding is a

package/src/deployments/servable.ts

@@ -30,7 +30,7 @@ export interface Unservable {
 /**
  * The profiles this deploy would send that the revision could not open.
  *
- * Scoped exactly as `uploadWorkspace` and `repairSetupSurface` are — by the
+ * Scoped exactly as `uploadWorkspace` and `repairOwnerLayer` are — by the
  * `--profile` flag, absent meaning the whole workspace — because the set that
  * gets uploaded is the set that gets served, and checking a different one would
  * be checking the wrong question.

package/src/deployments/upload.ts

@@ -7,8 +7,6 @@ import {
   type Config,
   type TargetConfig,
 } from '#profile';
-import { ConfigDocument } from '#cli/config-edit.ts';
-import { ensureSetupConnection, repairLines, repaired } from '#cli/config-repair.ts';
 import { ok, print, style, warn } from '#cli/output.ts';
 
 /**
@@ -100,57 +98,6 @@ function authoredAreaOwner(key: string): string | null {
   return area === layout.skills(owner) || area === layout.providers(owner) ? owner : null;
 }
 
-/**
- * Give every profile about to be uploaded its setup surface.
- *
- * **Scoped exactly as the upload is**, because a profile this deploy sends is a
- * profile the endpoint will serve: repairing a narrower set would leave a served
- * profile without the surface, which is this bug one profile over. Note what
- * `flags.profile` does not mean — it is the flag alone, so a profile resolved
- * from `LANES_LINK_PROFILE` leaves it undefined and both this and the upload
- * read that as the whole workspace. Surprising, pre-existing in the upload, and
- * fixed there rather than here so the two cannot drift apart.
- *
- * *Which files are profiles* comes from `listProfiles`, never from
- * `isWorkspaceConfig`: the allowlist decides what is safe to *copy*, so it
- * happily sends a committed `personal.example.yaml` and a nested
- * `profiles/archive/old.yaml` as bytes, while this opens and validates what it
- * is handed — which turned that template into a `ConfigError` aborting the
- * deploy after provisioning had already made cloud resources.
- *
- * A profile that cannot be read is warned about rather than fatal: the repair is
- * a courtesy on the way past, and the upload still sends the file. Not silent,
- * though — nothing else here widens a policy without being asked.
- */
-export async function repairSetupSurface(
-  workspaceRoot: string,
-  profiles: readonly string[] | undefined,
-): Promise<void> {
-  const wanted = profiles === undefined ? undefined : new Set(profiles);
-
-  for (const name of await listProfiles(workspaceRoot)) {
-    if (wanted !== undefined && !wanted.has(name)) continue;
-
-    try {
-      const document = await ConfigDocument.open(workspaceRoot, name);
-      const repair = ensureSetupConnection(document);
-      if (!repaired(repair)) continue;
-
-      await document.save();
-
-      print(ok(`gave ${style.bold(name)} the setup surface`));
-      for (const change of repairLines(repair)) print(`      ${style.dim(change)}`);
-      print(`      ${style.dim('an agent can now see what is connected here, instead of guessing')}`);
-    } catch (error) {
-      print(
-        warn(
-          `could not give ${name} the setup surface: ${error instanceof Error ? error.message.split('\n')[0] : String(error)}`,
-        ),
-      );
-    }
-  }
-}
-
 /**
  * Copy the workspace's config up.
  */

package/src/profile/load.ts

@@ -107,6 +107,49 @@ function formatZodIssues(error: z.ZodError): string {
  * left to resolve silently it grants nothing, which looks identical to a
  * working rule until the day someone relies on it.
  */
+/**
+ * A connection naming a provider whose id has moved out from under it.
+ *
+ * There is exactly one, and it is the reason this function exists: `tasks` was
+ * Google Tasks until the built-in task list took the plain noun (ADR-051). A row
+ * left saying `provider: tasks` does not fail — it resolves to the *built-in*,
+ * `reconcile` marks it active because a provider needing no credential is
+ * authorized by construction, and the operator is left with their Google Tasks
+ * tools gone, a task list wearing their old label, and nothing anywhere saying
+ * why. Refusing is the only outcome that names the fix.
+ *
+ * **The rule is a positive assertion, not a guess at what a vendor row looks
+ * like.** The built-in's row is written in exactly one spelling, by
+ * `newProfileTemplate` and by `ensureReservedConnection`: `account: Tasks`. So
+ * any other label on a `tasks` row is either a pre-rename Google Tasks row or a
+ * hand-edited built-in one, and the message names both fixes because either is
+ * one word.
+ *
+ * It was very nearly a guess, and the guess was wrong. The first version keyed
+ * on an `@` in the account, reasoning that `connect tasks` recorded the address
+ * the operator typed — Google Tasks publishes no identity, so `connect` asks.
+ * But what it asks for is a *label*: the real profile this was written for holds
+ * `account: personal`, so the check would have passed it and rebound their Google
+ * Tasks to the built-in in silence. That is the exact failure this exists to
+ * prevent, missed by one heuristic.
+ *
+ * Deliberately not a check on the connection *id*. Several task lists in one
+ * profile is a legitimate thing to want, exactly as several memory connections
+ * are, and keying on `id !== 'main'` would refuse a valid profile forever to
+ * catch a one-release migration. Labelling both `Tasks` is consistent with what
+ * the accountless providers already do — every memory connection is `Memory`.
+ */
+function renamedProvider(connection: { provider: string; account: string }): string | null {
+  if (connection.provider !== 'tasks' || connection.account === 'Tasks') return null;
+
+  return (
+    `"tasks" is now the built-in task list, and this row is labelled ` +
+    `"${connection.account}" rather than "Tasks".\n` +
+    '  If it was Google Tasks: set provider to google_tasks here, and rename any "tasks.*" policy rule.\n' +
+    '  If it is your own task list: set account to Tasks.'
+  );
+}
+
 function assertReferentialIntegrity(config: Config, source: string): void {
   const problems: string[] = [];
 
@@ -142,6 +185,9 @@ function assertReferentialIntegrity(config: Config, source: string): void {
       problems.push(`connections[${index}]: duplicate connection "${key}"`);
     }
     connectionKeys.add(key);
+
+    const renamed = renamedProvider(connection);
+    if (renamed) problems.push(`connections[${index}]: ${renamed}`);
   });
 
   // Same reason as a duplicate connection: two entries with the same kind and

package/src/providers/assets/provider.ts

@@ -0,0 +1,337 @@
+import { z } from 'zod';
+import {
+  attachmentRefSchema,
+  guessContentType,
+  receiptFor,
+  resolveAttachments,
+} from '#connectivity/mail';
+import { defineLocalProvider, keepKeys, type ProviderDefinition } from '#connectivity';
+import {
+  allAssets,
+  assertAssetName,
+  describeAsset,
+  digestOf,
+  findAsset,
+  humanBytes,
+  isTextual,
+} from './store.ts';
+
+/**
+ * `assets` — files the owner wants kept.
+ *
+ * **This exists because memory holds Markdown.** A PDF, an image, an export had
+ * nowhere to live except the owner's own filesystem — which a deployed endpoint
+ * cannot reach at all, so on any target but `local` the answer was that there
+ * was no answer. An asset is a file in the profile's own store, named, listed,
+ * and served from wherever that profile runs. ADR-051.
+ *
+ * **Bytes never pass through the model, in either direction.** A write names one
+ * of the five sources `#connectivity/mail` already resolves — a path on the
+ * endpoint's machine, an HTTPS URL, a staged handle, an attachment on a message,
+ * or inline base64 as the last resort — and the endpoint reads them itself. That
+ * is not a new rule: it is ADR-017's, reused rather than restated, which also
+ * buys the size ceiling, the refusal when two sources are named, and the
+ * SHA-256 receipt that makes "what exactly was stored" answerable.
+ *
+ * A read is the same rule the other way. `ResourceContents` carries text and
+ * nothing else (`#connectivity`'s `capability.ts`), so a text asset comes back
+ * as text and a binary one comes back *described* — name, type, size, digest.
+ * A 239 KB PDF is roughly 320,000 characters of base64, and handing that to a
+ * model is the cost the five sources exist to avoid; there is no reason to pay
+ * it on the way in that would not also apply on the way out.
+ *
+ * **Getting an asset into a mail is not done here**, and that is a boundary
+ * rather than a gap. A staged handle is scoped to `<provider>/<connection>`
+ * (`#dispatch`'s `stageAttachment`), so a handle minted under `assets/main` is
+ * deliberately unresolvable from `gmail/main` — bridging the two means crossing
+ * the isolation every provider relies on, and that belongs in dispatch if it
+ * belongs anywhere. `lanes link attach <file> --connection <provider>.<account>`
+ * already prints a handle the mail tools accept.
+ */
+
+const DEFAULT_LIMIT = 30;
+
+/**
+ * The ceiling on one stored asset.
+ *
+ * Not a vendor limit — there is no vendor. It bounds what a `url` source can
+ * pull into the endpoint's memory in one call, which is the only place an
+ * unbounded read could come from, and it is sized so an ordinary document,
+ * spreadsheet, or photograph goes through and a video does not.
+ */
+const MAX_ASSET_BYTES = 25 * 1024 * 1024;
+
+/** How much text a read will return before it describes the file instead. */
+const MAX_TEXT_BYTES = 256 * 1024;
+
+export const assetsProvider: ProviderDefinition = defineLocalProvider({
+  id: 'assets',
+  name: 'Assets',
+  version: '1.0.0',
+  description:
+    "Files the owner wants kept, addressed by filename. Storing one names a source — a path, a URL, a staged handle — and the endpoint reads the bytes; they are never encoded into a call. Writing is a separate capability from reading.",
+
+  configSchema: z.object({}),
+  connectionSchema: z.object({}),
+
+  bundles: [
+    {
+      name: 'read',
+      description: 'List and read stored files.',
+      oauth_scopes: [],
+      capabilities: ['file', 'list', 'get'],
+      default: true,
+    },
+    {
+      name: 'write',
+      description: 'Store and delete files.',
+      oauth_scopes: [],
+      capabilities: ['store', 'remove'],
+    },
+  ],
+
+  capabilities: [
+    {
+      kind: 'resource',
+      name: 'file',
+      title: 'Stored file',
+      description:
+        'One stored file, addressed by its name. Text comes back as text; anything else is described rather than encoded.',
+      uriTemplate: 'assets://file/{name}',
+      redact: keepKeys('uri'),
+
+      async list(context) {
+        return (await allAssets(context.storage)).map((asset) => ({
+          uri: `assets://file/${encodeURIComponent(asset.name)}`,
+          name: asset.name,
+        }));
+      },
+
+      async read(uri, params, context) {
+        const raw = params['name'];
+        if (!raw) throw new Error(`Malformed asset URI: ${uri}`);
+
+        const name = decodeURIComponent(raw);
+        const asset = await findAsset(context.storage, name);
+        if (asset === null) throw new Error(`No asset "${name}" on ${context.connection.key}`);
+
+        const bytes = await context.storage.get(name);
+        if (bytes === null) throw new Error(`No asset "${name}" on ${context.connection.key}`);
+
+        return textOrSummary(uri, name, asset.contentType, bytes);
+      },
+    },
+
+    {
+      kind: 'tool',
+      name: 'list',
+      title: 'List stored files',
+      description:
+        'Every file kept in this profile, newest first, with its type and size. This is the whole index — an asset carries no description, so what a file is for belongs in memory.',
+      inputSchema: z.object({
+        query: z.string().optional().describe('Restrict to names containing this text'),
+        limit: z
+          .number()
+          .int()
+          .min(1)
+          .max(200)
+          .optional()
+          .describe(`Maximum results (default ${DEFAULT_LIMIT})`),
+      }),
+      // Nothing kept: a filename is the owner's own material, the same call
+      // `memory.search` makes about a query.
+      async handler({ query, limit }, context) {
+        const needle = query?.toLowerCase();
+        const all = await allAssets(context.storage);
+        const found = needle ? all.filter((a) => a.name.toLowerCase().includes(needle)) : all;
+        const shown = found.slice(0, limit ?? DEFAULT_LIMIT);
+
+        context.audit.annotate({ scanned: all.length, matched: found.length });
+
+        if (shown.length === 0) {
+          return {
+            content: [
+              {
+                type: 'text',
+                text: `No ${needle ? 'matching ' : ''}assets on ${context.connection.key}.`,
+              },
+            ],
+          };
+        }
+
+        return {
+          content: [
+            ...shown.flatMap((asset) => [
+              {
+                type: 'resource_link' as const,
+                uri: `assets://file/${encodeURIComponent(asset.name)}`,
+                name: asset.name,
+              },
+              { type: 'text' as const, text: describeAsset(asset) },
+            ]),
+            ...(found.length > shown.length
+              ? [
+                  {
+                    type: 'text' as const,
+                    text: `… ${found.length - shown.length} more. Raise limit, or narrow with query.`,
+                  },
+                ]
+              : []),
+          ],
+        };
+      },
+    },
+
+    {
+      kind: 'tool',
+      name: 'get',
+      title: 'Read a stored file',
+      description:
+        'Return a text file\'s contents. A binary file is described instead — name, type, size, digest — because encoding it here is the cost this provider exists to avoid. The resource assets://file/{name} is the same content.',
+      inputSchema: z.object({ name: z.string().min(1).describe('The file name') }),
+      redact: keepKeys('name'),
+      async handler({ name }, context) {
+        const asset = await findAsset(context.storage, name);
+        const bytes = asset === null ? null : await context.storage.get(name);
+
+        if (asset === null || bytes === null) {
+          return {
+            content: [{ type: 'text', text: `No asset "${name}" on ${context.connection.key}.` }],
+            isError: true,
+          };
+        }
+
+        const { text } = textOrSummary('', name, asset.contentType, bytes);
+        return { content: [{ type: 'text', text }] };
+      },
+    },
+
+    {
+      kind: 'tool',
+      name: 'store',
+      title: 'Store a file',
+      description:
+        'Keep a file in this profile. Name exactly one source — path, url, handle, message_id, or data — and the endpoint reads the bytes itself; never base64 a file into this call when any other source will do. Storing under a name that exists replaces it.',
+      inputSchema: z.object({
+        source: attachmentRefSchema.describe(
+          'Where the bytes come from. Exactly one of path, url, handle, message_id, or data.',
+        ),
+        name: z
+          .string()
+          .optional()
+          .describe('What to call it. Taken from the source when omitted.'),
+      }),
+      // The name and the source shape are the record of what happened; the bytes
+      // are the content. `annotate` below adds the resolved facts, which is the
+      // half that makes a write log worth reading — see ADR-017.
+      redact: keepKeys('name'),
+      async handler({ source, name }, context) {
+        const [resolved] = await resolveAttachments([source], {
+          maxTotalBytes: MAX_ASSET_BYTES,
+          storage: context.storage,
+          signal: context.signal,
+        });
+
+        if (!resolved) throw new Error('source named no file.');
+
+        const assetName = name ?? resolved.filename;
+        assertAssetName(assetName);
+
+        // Renaming can improve the type. `resolveAttachments` guesses from the
+        // *source's* filename, so storing a URL that ended `/download` as
+        // `report.csv` arrives as octet-stream; the name the owner chose is the
+        // better evidence, but only where the source had none to offer.
+        const contentType =
+          name && resolved.contentType === 'application/octet-stream'
+            ? guessContentType(assetName)
+            : resolved.contentType;
+        const replaced = await context.storage.has(assetName);
+
+        await context.storage.put(assetName, resolved.bytes, { contentType });
+
+        // The resolved facts rather than the argument: `source` may literally be
+        // a file, so keeping it verbatim would put base64 in the log. This is
+        // the same annotation `gmail.send_message` records.
+        context.audit.annotate({ asset: assetName, replaced, ...receiptFor(resolved), origin: resolved.origin });
+
+        return {
+          content: [
+            {
+              type: 'text',
+              text:
+                `${replaced ? 'Replaced' : 'Stored'} "${assetName}" on ${context.connection.key} — ` +
+                `${contentType}, ${humanBytes(resolved.bytes.byteLength)}, sha256 ${resolved.sha256.slice(0, 12)}…`,
+            },
+            {
+              type: 'resource_link',
+              uri: `assets://file/${encodeURIComponent(assetName)}`,
+              name: assetName,
+            },
+          ],
+        };
+      },
+    },
+
+    {
+      kind: 'tool',
+      name: 'remove',
+      title: 'Delete a stored file',
+      description: 'Remove a file and its bytes. There is no trash.',
+      inputSchema: z.object({ name: z.string().min(1).describe('The file name') }),
+      redact: keepKeys('name'),
+      async handler({ name }, context) {
+        assertAssetName(name);
+
+        const existed = await context.storage.has(name);
+        await context.storage.delete(name);
+
+        return {
+          content: [
+            {
+              type: 'text',
+              text: existed
+                ? `Deleted "${name}" from ${context.connection.key}.`
+                : `No asset "${name}" on ${context.connection.key}.`,
+            },
+          ],
+          ...(existed ? {} : { isError: true }),
+        };
+      },
+    },
+  ],
+});
+
+/**
+ * Text if it can be, a description if it cannot.
+ *
+ * One function for both the tool and the resource, so the two cannot come to
+ * different conclusions about the same file — which is the failure that would
+ * make "read it as a resource instead" a workaround for a refusal.
+ */
+function textOrSummary(
+  uri: string,
+  name: string,
+  contentType: string,
+  bytes: Uint8Array,
+): { uri: string; mimeType: string; text: string } {
+  if (isTextual(contentType, bytes) && bytes.byteLength <= MAX_TEXT_BYTES) {
+    return { uri, mimeType: contentType, text: new TextDecoder().decode(bytes) };
+  }
+
+  const why =
+    bytes.byteLength > MAX_TEXT_BYTES
+      ? `larger than the ${humanBytes(MAX_TEXT_BYTES)} a read returns`
+      : 'not text';
+
+  return {
+    uri,
+    mimeType: 'text/plain',
+    text:
+      `${name} — ${contentType}, ${humanBytes(bytes.byteLength)}, sha256 ${digestOf(bytes)}.\n` +
+      `Its contents are ${why}, so they are not returned. ` +
+      'To attach it to something, ask the owner for a handle: ' +
+      'lanes link attach <file> --connection <provider>.<account>',
+  };
+}
+
+export default assetsProvider;