@lanes-sh/link 0.5.4 → 0.6.0

package/instructions/agents/lanes-link-scout.md

@@ -68,7 +68,7 @@ stops a write is policy on the endpoint:
 
 ```console
 $ lanes link policy deny memory.write --profile <name> --target <name>
-$ lanes link policy list --profile <name>
+$ lanes link policy list --profile <name> --target <name>
 ```
 
 If you are running against a profile that grants writes, that is the owner's

package/instructions/skills/lanes-link/SKILL.md

@@ -22,7 +22,9 @@ and personal apart; they share no database and no credential store.
 **Ask which profile is meant when it is ambiguous. Do not default to whichever
 is listed first.** Quietly picking one crosses the line the profile exists to
 draw. There is no "current profile" to switch — the choice is made per call, and
-`lanes link profile list` shows what exists.
+`lanes link profile list --target <name>` shows what exists *in that target*. A
+profile lives in exactly one, so `personal` on `local` and `personal` on `cloud`
+are two profiles that share a name rather than one profile in two places.
 
 **What a command must be told is never inferred — but it is not always both.**
 Nothing resolves from an environment variable or a config default, so a command
@@ -30,12 +32,11 @@ missing what it needs refuses rather than acting somewhere else. Passing a flag
 command does not read is refused too, which makes "add both to be safe" its own
 failure. Four levels:
 
-- **Neither.** `lanes link profile list`, `lanes link mcp list`,
+- **Neither.** `lanes link target list`, `lanes link mcp list`,
   `lanes link version`.
-- **`--profile` alone.** `lanes link check`, `lanes link config show`,
-  `lanes link policy list`, `lanes link target list --profile <name>`,
-  `lanes link identity list`. Each is target-independent — one declaration in the
-  YAML that applies wherever the profile runs.
+- **`--target` alone.** `lanes link profile list`, `lanes link profile add`,
+  `lanes link profile remove`, `lanes link target show`. A profile lives inside
+  one target's workspace, so listing or creating one names which workspace.
 - **`--target`, with the profiles derived from it.** `lanes link status`,
   `lanes link deploy` and `lanes link sync targets` act on one endpoint serving
   every profile that declares that target. `--profile` is accepted and *narrows*
@@ -222,7 +223,7 @@ granted, and retrying will not reveal it. A call that *is* refused was refused b
 policy on purpose.
 
 Report it plainly and let the owner decide whether to widen the grant —
-`lanes link policy list --profile <name>` shows the rules, `lanes link policy allow <capability> --profile <name> --target <name>`
+`lanes link policy list --profile <name> --target <name>` shows the rules, `lanes link policy allow <capability> --profile <name> --target <name>`
 changes them, and that is their call, not yours. **Do not look for another route
 to the same data.** Every call is audited either way; `lanes link audit tail --profile <name> --target <name>`
 shows what was attempted, refusals included.
@@ -299,10 +300,12 @@ key on — do not treat the absence of JSON as a failure. `status`, `doctor`,
 `config show`, `audit tail` and every `mcp` subcommand do not.
 
 **A profile is created and removed, never switched.** `lanes link profile add
-<name>` writes a new one and takes `--target <name>`, repeated once per target it
-should declare. `lanes link profile remove <name>` takes `--dry-run` and then
-`--yes`; given a `--target` it decommissions that one target's stores and leaves
-the profile file in place. Neither reads `--profile`.
+<name> --target <name>` writes a new one *into that target's workspace* — one
+target, not a list, because a profile lives in exactly one.
+`lanes link profile remove <name> --target <name>` takes `--dry-run` and then
+`--yes`, and removes the profile itself along with its stores: the file is in
+that workspace, so there is nowhere left for it to survive. Neither reads
+`--profile`; both name the profile positionally.
 
 There is no current profile and no default target. `lanes link profile default`
 and `lanes link target use` are gone and now refuse with an explanation — if you
@@ -312,9 +315,9 @@ replacement to find. The choice is made per command, on purpose.
 ## Deploying, and what it decides
 
 `lanes link deploy` builds an image and rolls a revision. Its subject is a
-**target**, and the profiles behind it are every profile declaring that target,
-so one deploy serves all of them — there is no per-profile deploy to run and no
-reason to loop over them.
+**target**, and the profiles behind it are every profile *in* that target's
+workspace, so one deploy serves all of them — there is no per-profile deploy to
+run and no reason to loop over them.
 
 **Always `--dry-run` first, and show what it printed.** It creates cloud
 resources that cost money, it implements no `--json` to inspect instead, and that
@@ -326,9 +329,9 @@ Two things it refuses to guess, and both are the owner's to answer:
 - **Whose bearer token opens the endpoint.** One token reaches every profile
   behind that target, so this decides who gets in. With several candidates and
   nothing recorded, it refuses and prints the command that names one.
-- **A first deploy.** A target no profile declares yet has no set to derive from,
-  so `--profile` is required there. It may be repeated, and the first one named
-  is the primary.
+- **A first deploy.** A target that does not exist yet has no workspace to derive
+  a set from, so `--profile` is required there. It may be repeated, and the first
+  one named is the primary.
 
 **Never pass `--yes`, `--non-interactive`, `--access public` or
 `--service-account` yourself.** Each settles a question about who can reach their
@@ -338,22 +341,23 @@ this file already applies to `--accept-broad-scopes`.
 Deploying is how new code reaches the endpoint. It is not how an account gets
 connected and not how a config change lands; both of those publish themselves.
 
-## When the workspace and the endpoint disagree
+## When a machine has lost track of a deployment
 
-A deployment records where it lives, and a workspace can lose that record — a new
-machine, a reinstall, a profile file restored from something older. The endpoint
-is still serving; what went missing is the config that describes it. The symptom
-is a `lanes link status` that reports nothing deployed for a target you know is
-up.
+A workspace holds a *pointer* to each target it does not itself hold, and a
+machine can lose one — a new laptop, a reinstall, a workspace file restored from
+something older. The endpoint is still serving; what went missing is the line
+saying where it lives. The symptom is a `lanes link status` that reports nothing
+for a target you know is up.
 
-`lanes link sync targets` reconciles the two. `--discover` looks for a deployment
-the workspace has no record of, `--from <location>` names one directly, and
-`--dry-run` reports what it would merge without merging it. Run the dry run and
+`lanes link sync targets` adopts it. `--discover` looks for a deployment the
+workspace has no pointer to, `--from <location>` names one directly, and
+`--dry-run` reports what it would write without writing it. Run the dry run and
 show it.
 
-**`--prefer local` or `--prefer remote` is their answer, not yours.** It decides
-which side wins where the two disagree, and the losing value is the one nobody
-was asked about. Report what differs and let them pick.
+**It cannot lose anything.** Adopting writes one line — the pointer — and the
+workspace at the other end stays authoritative for everything else. There is no
+`--prefer` any more and passing one is refused: it chose a winner when a profile
+existed in two copies that could disagree, and there is one copy now.
 
 ## Registering it, and re-registering it
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lanes-sh/link",
-  "version": "0.5.4",
+  "version": "0.6.0",
   "description": "A self-hostable MCP gateway for all your connections, memory, tasks, files, and secrets",
   "license": "Apache-2.0",
   "homepage": "https://lanes.sh/link",
@@ -66,6 +66,7 @@
     "#dispatch": "./src/dispatch/index.ts",
     "#policy": "./src/policy/index.ts",
     "#profile": "./src/profile/index.ts",
+    "#profile/*": "./src/profile/*",
     "#providers/*": "./src/providers/*",
     "#registry": "./src/registry/index.ts",
     "#secrets": "./src/secrets/index.ts",

package/src/cli/commands/connect/target-note.ts

@@ -1,4 +1,4 @@
-import type { Config, Resolution } from '#profile';
+import type { Resolution } from '#profile';
 import { announce } from '../../output.ts';
 
 /**
@@ -21,7 +21,7 @@ import { announce } from '../../output.ts';
  * is the same mistake caught where it is still cheap.
  */
 export function announceConnectTarget(
-  runtime: { readonly resolution: Resolution; readonly config: Pick<Config, 'targets'> },
+  runtime: { readonly resolution: Resolution },
   json?: boolean | undefined,
 ): void {
   // `emit`'s early return only protects lines printed *at* the emit, and this

package/src/cli/commands/knowledge/index.ts

@@ -230,7 +230,6 @@ async function useGithub(flags: KnowledgeFlags): Promise<void> {
 
     print('');
     print(ok(`memory and skills are now kept in ${facts.fullName}`));
-    reportOtherTargets(runtime.config, runtime.target, knowledge.token_ref);
   } finally {
     await runtime.close();
   }
@@ -242,7 +241,7 @@ async function useLocal(flags: KnowledgeFlags): Promise<void> {
     announce(runtime.resolution);
     const selection = ` --profile ${runtime.resolution.profile} --target ${runtime.target}`;
 
-    const knowledge = runtime.config.targets[runtime.target]?.knowledge;
+    const knowledge = runtime.config.knowledge;
     if (!knowledge) {
       print(style.dim('  This profile already keeps memory and skills on its own storage.'));
       return;
@@ -299,8 +298,7 @@ async function openLocalStores(
   runtime: Runtime,
 ): Promise<{ storage: BlobStore; skills: BlobStore }> {
   const { openStorage } = await import('#deployments/target.ts');
-  const declared = runtime.config.targets[runtime.target];
-  if (!declared) throw new ConfigError(`Target "${runtime.target}" is not declared`);
+  const declared = runtime.declared;
 
   const factory = await openStorage(
     {
@@ -314,7 +312,14 @@ async function openLocalStores(
   return { storage: factory(), skills: factory(layout.skills(runtime.config.instance.profile)) };
 }
 
-/** Write, or remove, the block on every target this profile declares. */
+/**
+ * Write, or remove, this profile's knowledge block.
+ *
+ * One place, not one per target. It used to loop over every target the profile
+ * declared and write the same block into each — which is what a per-target key
+ * holding a per-profile fact costs. The block is on the profile now (ADR-052),
+ * so there is one of it.
+ */
 async function writeBlock(
   config: Config,
   root: string,
@@ -322,12 +327,10 @@ async function writeBlock(
 ): Promise<void> {
   const document = await ConfigDocument.open(root, config.instance.profile);
 
-  for (const target of Object.keys(config.targets)) {
-    if (knowledge === undefined) {
-      document.removeIn(['targets', target, 'knowledge']);
-      continue;
-    }
-    document.setIn(['targets', target, 'knowledge'], {
+  if (knowledge === undefined) {
+    document.removeIn(['knowledge']);
+  } else {
+    document.setIn(['knowledge'], {
       adapter: knowledge.adapter,
       repo: knowledge.repo,
       ...(knowledge.branch ? { branch: knowledge.branch } : {}),
@@ -339,29 +342,6 @@ async function writeBlock(
   await document.save();
 }
 
-/**
- * The other targets need the same token in their own credential stores.
- *
- * Not written for them: a second target's store is Secret Manager, which needs
- * cloud credentials this command has no business assuming. `secrets push` is
- * the command that already does exactly this, so this points at it.
- */
-function reportOtherTargets(config: Config, current: string, ref: string): void {
-  const others = Object.keys(config.targets).filter((target) => target !== current);
-  if (others.length === 0) return;
-
-  const profile = config.instance.profile;
-
-  print(
-    style.dim(
-      `  Written into every target (${others.join(', ')} as well). Each reads "${ref}" from its own credential store:`,
-    ),
-  );
-  for (const target of others) {
-    print(style.dim(`    lanes link secrets push --from ${current} --to ${target} --profile ${profile}`));
-  }
-}
-
 async function decideMigration(hasContent: boolean, flags: KnowledgeFlags): Promise<boolean> {
   if (flags.migrate !== undefined) return flags.migrate;
   if (!hasContent) return false;

package/src/cli/commands/mcp/register.ts

@@ -77,7 +77,7 @@ export async function mcpAdd(target: string | undefined, options: McpAddOptions)
     // `http://<host>:<port>/mcp` unconditionally, so `mcp add --target cloud`
     // registered loopback with the agent: a registration that reports success,
     // names the right server, and points at a port with nothing behind it.
-    const url = await endpointUrl(runtime.config, runtime.target);
+    const url = await endpointUrl(runtime.config, runtime.declared);
     const input: AddInput = {
       name,
       url,

package/src/cli/commands/operate/dashboard.ts

@@ -36,10 +36,10 @@ export async function dashboard(flags: DashboardFlags): Promise<void> {
   // still be correct and nobody would ever read it, because a storage 403
   // arrives first. This is the seam `runtime.ts` documents `deploy` and
   // `secrets push` stopping at, for the same reason.
-  const { resolution, config, target } = await resolveProfile(flags);
+  const { resolution, config, target, resolved } = await resolveProfile(flags);
   announce(resolution);
 
-  const deployed = deploymentIdentity(config.targets[target]?.deploy);
+  const deployed = deploymentIdentity(resolved?.declared.deploy);
   if (deployed) {
     throw new Error(
       `Target "${target}" is deployed to ${deployed.platform}, and the dashboard is served only ` +

package/src/cli/commands/operate/inspect.ts

@@ -5,7 +5,7 @@ import { staleNudge } from '../../release.ts';
 import { openRuntime, resolveProfileOnly, type GlobalFlags, type Runtime } from '../../runtime.ts';
 import type { FetchLike } from '#deployments/knowledge.ts';
 import { credentialAge, reportCapabilityDrift } from './findings.ts';
-import { migratedRenamedProviders } from './migrate.ts';
+import { migratedContract, migratedRenamedProviders } from './migrate.ts';
 
 /**
  * The gate order — check, doctor, plan, start — exists so failures surface in
@@ -75,6 +75,10 @@ export async function doctor(flags: DoctorFlags): Promise<void> {
   try {
     runtime = await openRuntime(flags, { fetch: flags.fetch });
   } catch (refusal) {
+    // Contract first: it is checked before the schema, so a profile carrying
+    // both problems reports the contract one and the rename cannot be seen until
+    // that is settled.
+    if (await migratedContract(flags, refusal)) return;
     if (await migratedRenamedProviders(flags, refusal)) return;
     throw refusal;
   }

package/src/cli/commands/operate/migrate.ts

@@ -1,6 +1,7 @@
-import { ConfigError, resolveSelection } from '#profile';
+import { ConfigError, resolveSelection, resolveTargetWorkspace, resolveWorkspaceRoot } from '#profile';
 import { ConfigDocument } from '../../config-edit.ts';
 import { migrateRenamedProviders, pendingRenames, shapeOf } from '../../config-migrate.ts';
+import { migrateWorkspace, needsMigration } from '../../workspace-migrate.ts';
 import { emit, fail, ok, print, style, warn } from '../../output.ts';
 import { openSecretStoreFor, type GlobalFlags } from '../../runtime.ts';
 
@@ -98,3 +99,86 @@ export async function migratedRenamedProviders(
 
   return true;
 }
+
+
+/**
+ * Whether a refusal to load was a stale contract, and — with `--fix` — raise it.
+ *
+ * The sibling of `migratedRenamedProviders` above, and asked *before* it: a
+ * contract-1 profile is refused by `assertSupportedContract`, which runs before
+ * the schema, so a file with both problems reports this one and the rename is
+ * invisible until it is fixed.
+ *
+ * Here for the reason this file's header already gives — `doctor` is what
+ * someone runs when something is broken, so it has to be the command that works
+ * when everything else refuses. `update` migrates the local workspace on its own
+ * and most people will never reach this; the ones who do are the ones whose
+ * `--target` is a bucket, which `update` deliberately leaves alone.
+ *
+ * **It will migrate a remote workspace, and says what that costs.** The endpoint
+ * in front of a bucket runs a pinned image, and one built before contract 2
+ * cannot read what this writes. That is a real consequence and it is the
+ * operator's to accept, so the line naming the redeploy is printed whether or
+ * not `--fix` was passed.
+ */
+export async function migratedContract(flags: RenameFlags, refusal: unknown): Promise<boolean> {
+  if (!(refusal instanceof ConfigError)) return false;
+
+  const root = resolveWorkspaceRoot();
+  const target = flags.target ?? '';
+  // Where the profiles actually are. For a pointer that is the bucket, which is
+  // the case this exists for; a target the registry cannot resolve is not a
+  // migration problem and falls through to the original refusal.
+  const where = await resolveTargetWorkspace(root, target).catch(() => null);
+  if (where === null) return false;
+
+  if (!(await needsMigration(where))) return false;
+
+  const migration = await migrateWorkspace(where, { apply: flags.fix === true });
+  const applied = flags.fix === true;
+  const remote = where !== root;
+
+  if (!applied) process.exitCode = 1;
+
+  await emit(
+    flags.json,
+    {
+      ok: applied,
+      workspace: where,
+      target,
+      applied,
+      remote,
+      profiles: migration.profiles,
+      targets: migration.targets,
+      changes: migration.changes,
+    },
+    () => {
+      print(`workspace ${style.bold(where)}  target ${style.bold(target)}`);
+      print();
+      print(
+        applied
+          ? ok('migrated to contract 2 — a target is declared by the workspace, not by each profile')
+          : warn('this workspace is contract 1, and nothing here reads that any more'),
+      );
+      for (const change of migration.changes) print(`  ${change}`);
+
+      if (remote) {
+        print();
+        print(
+          style.dim(
+            applied
+              ? '  The endpoint serving this bucket is running an older image and cannot read\n' +
+                `  what was just written. Roll a new one: lanes link deploy --target ${target}`
+              : `  lanes link deploy --target ${target} migrates it and ships the image that\n` +
+                '  understands it, in one step. Prefer that to --fix here.',
+          ),
+        );
+        return;
+      }
+
+      if (!applied) print(style.dim(`  Fix it with: lanes link doctor --fix --target ${target}`));
+    },
+  );
+
+  return true;
+}

package/src/cli/commands/operate/outputs.ts

@@ -1,5 +1,4 @@
 import { listProfiles } from '#profile';
-import { unservableProfiles } from '#deployments/servable.ts';
 import { fileURLToPath } from 'node:url';
 import { deployedUrl, endpointHealth, localUrl } from '../../endpoint-url.ts';
 import { announce, heading, print, style, warn } from '../../output.ts';
@@ -28,7 +27,7 @@ export async function outputs(flags: OutputsFlags): Promise<void> {
 
   try {
     const { token } = await ensureProfileToken(runtime.credentials, runtime.config.auth.token_ref);
-    const declared = runtime.config.targets[runtime.target]?.deploy;
+    const declared = runtime.declared.deploy;
     const deployed = await deployedUrl(declared);
     // Not `endpointUrl`, which would ask the platform a second time for an
     // answer this line already has.
@@ -37,14 +36,12 @@ export async function outputs(flags: OutputsFlags): Promise<void> {
     const live = await endpointHealth(url, token);
     const mine = live?.profile === runtime.resolution.profile;
 
-    // Live if it is up, otherwise what `start` would serve — which is every
-    // profile in the workspace *that declares this target*, not every profile
-    // full stop. `start` opens them all against one target and skips the ones
-    // that cannot run on it, so listing those here would promise a reach the
-    // endpoint will not have.
-    const profiles = mine
-      ? live.profiles
-      : await servable(runtime.resolution.workspaceRoot, runtime.target);
+    // Live if it is up, otherwise every profile in this target's workspace.
+    // Those are the same set now: a profile lives in exactly one target
+    // (ADR-052), so every profile here is one this target can open. The filter
+    // that used to sit between them answered "which of these declare it", a
+    // question no profile has an opinion on any more.
+    const profiles = mine ? live.profiles : await listProfiles(runtime.resolution.workspaceRoot);
 
     if (flags.json) {
       print(
@@ -138,18 +135,6 @@ export async function outputs(flags: OutputsFlags): Promise<void> {
   }
 }
 
-/** The profiles a `start` on this target would actually open. */
-async function servable(workspaceRoot: string, target: string): Promise<string[]> {
-  const all = await listProfiles(workspaceRoot);
-  const cannot = new Set(
-    (await unservableProfiles({ workspaceRoot, profiles: undefined, target })).map(
-      (one) => one.profile,
-    ),
-  );
-
-  return all.filter((name) => !cannot.has(name));
-}
-
 /**
  * The command that prints this endpoint's token, verified to actually work.
  *

package/src/cli/commands/operate/status.ts

@@ -1,4 +1,13 @@
-import { listProfiles, loadWorkspaceProfiles, resolveWorkspaceRoot } from '#profile';
+import {
+  isPointer,
+  listProfiles,
+  loadWorkspaceProfiles,
+  notInRegistry,
+  openTarget,
+  readRegistry,
+  resolveWorkspaceRoot,
+  type ResolvedTarget,
+} from '#profile';
 import { oneProfile, visibleCapabilities } from '#server/mcp';
 import { toPolicyDocument } from '#registry';
 import { announce, emit, heading, print, style, table } from '../../output.ts';
@@ -77,7 +86,7 @@ export async function status(flags: StatusFlags): Promise<void> {
     // replaces it. Silently turning a string into an object would be a cost
     // paid by every reader for the benefit of none.
     const local = `http://${runtime.config.instance.host}:${runtime.config.instance.port}/mcp`;
-    const deployment = deploymentIdentity(runtime.config.targets[runtime.target]?.deploy);
+    const deployment = deploymentIdentity(runtime.declared.deploy);
     const endpoint = deployment ? null : local;
 
     return emit(
@@ -152,97 +161,103 @@ export async function status(flags: StatusFlags): Promise<void> {
  * profile narrows it to the detailed view above; naming none is not a missing
  * answer, it is the wider one.
  *
- * **Opens no store and makes no network call.** The view above already declines
- * to probe, for the reasons in this file's header; this one additionally
- * declines to open a target's adapters, so it stays instant and — more to the
- * point — still answers for a target whose stores are unreachable, misdeclared,
- * or gone. A summary that needs the deployment to be healthy cannot report that
- * it is not.
+ * **Opens no profile store.** The view above already declines to probe, for the
+ * reasons in this file's header; this one additionally declines to open a
+ * target's adapters, so it stays fast and — more to the point — still answers
+ * for a target whose stores are unreachable or gone. A summary that needs the
+ * deployment to be healthy cannot report that it is not.
  *
- * That is what makes the row it exists for legible: a target declared by one
- * profile and not its sibling. From inside either profile that state is
- * invisible, and it is what a vanished deployment looks like from the outside.
+ * It does read the target's workspace, which for a pointer is a bucket. That is
+ * the one call it cannot avoid: the profiles it is reporting on live there
+ * (ADR-052). When that read fails it says so under the target's own heading
+ * rather than printing an empty profile list, because "no profiles" and "could
+ * not look" are the two answers this command must never blur.
+ *
+ * The row it used to exist for — a target declared by one profile and not its
+ * sibling — cannot happen now. A target is declared once, by its workspace, so
+ * there is no per-profile disagreement left to surface.
  */
 async function workspaceStatus(flags: StatusFlags): Promise<void> {
   const target = flags.target!;
-  const root = resolveWorkspaceRoot();
-  const workspace = await loadWorkspaceProfiles(root);
-
-  const profiles = workspace.loaded.map((entry) => ({
-    name: entry.profile,
-    declares: target in entry.config.targets,
-    connections: entry.config.connections.length,
-    deployment: deploymentIdentity(entry.config.targets[target]?.deploy),
-  }));
+  const localRoot = resolveWorkspaceRoot();
+  const registry = await readRegistry(localRoot);
+  const entry = registry[target];
 
-  const declaring = profiles.filter((entry) => entry.declares);
+  if (!entry) throw notInRegistry(target, registry, localRoot);
 
-  // Distinct deployments, not the first one found. Two profiles declaring the
-  // same target name against different services is drift worth printing rather
-  // than a tie to break silently — and picking one would make the wrong half of
-  // the workspace look correctly configured.
-  const deployments = [
-    ...new Map(
-      declaring
-        .filter((entry) => entry.deployment !== null)
-        .map((entry) => [JSON.stringify(entry.deployment), entry.deployment!] as const),
-    ).values(),
-  ];
+  let resolved: ResolvedTarget | undefined;
+  let unreachable: string | undefined;
+  try {
+    resolved = await openTarget(localRoot, target);
+  } catch (error) {
+    // The whole message, not its first line. Truncating to `split('\n')[0]` is
+    // exactly what the sync command used to do, and it is why a bucket refusing
+    // for a nameable reason reported an empty one instead — a `ConfigError`
+    // carries its fix on the lines after the first.
+    unreachable = error instanceof Error ? error.message : String(error);
+  }
+
+  const root = resolved?.workspaceRoot ?? (isPointer(entry) ? entry.workspace : localRoot);
+  const workspace = resolved ? await loadWorkspaceProfiles(root) : undefined;
+
+  const profiles = (workspace?.loaded ?? []).map((loaded) => ({
+    name: loaded.profile,
+    connections: loaded.config.connections.length,
+  }));
+
+  const deployment = deploymentIdentity(resolved?.declared.deploy);
 
   return emit(
     flags.json,
-    { workspace: root, target, profiles, deployments, unreadable: workspace.unreadable },
+    {
+      workspace: root,
+      target,
+      remote: resolved?.remote ?? isPointer(entry),
+      reachable: unreachable === undefined,
+      ...(unreachable ? { error: unreachable } : {}),
+      profiles,
+      deployment,
+      unreadable: workspace?.unreadable ?? [],
+    },
     () => {
       print(style.dim(`workspace ${style.bold(root)}  target ${style.bold(target)}`));
 
-      heading('Profiles');
-      table(
-        profiles.map((entry) => [
-          `  ${style.bold(entry.name)}`,
-          entry.declares ? style.green(`${target} declared`) : style.yellow('not declared'),
-          style.dim(entry.declares ? `${entry.connections} connection(s)` : '—'),
-        ]),
-      );
-      for (const bad of workspace.unreadable) {
-        print(`  ${style.bold(bad.profile)}  ${style.yellow(bad.reason)}`);
-      }
-
-      heading('Endpoint');
-      if (declaring.length === 0) {
-        print(style.yellow(`  No profile declares "${target}".`));
-        print(
-          style.dim(
-            '  If it was deployed once, the deployment still exists and only the\n' +
-              `  declaration is gone — recover it with: lanes link sync targets --target ${target}`,
-          ),
-        );
+      if (unreachable !== undefined) {
+        heading('Unreachable');
+        // The refusal's own wording, and nothing after it. A generic trailer
+        // here read as a second, vaguer diagnosis of a problem the message above
+        // had already named precisely.
+        for (const line of unreachable.split('\n')) print(`  ${style.yellow(line)}`);
         return;
       }
 
-      if (deployments.length === 0) {
-        print(style.dim('  No deployment — this target runs wherever the CLI does.'));
-        return;
+      heading('Profiles');
+      if (profiles.length === 0) {
+        print(style.dim('  None yet.'));
+        print(style.dim(`  Create one with: lanes link profile add <name> --target ${target}`));
+      } else {
+        table(
+          profiles.map((profile) => [
+            `  ${style.bold(profile.name)}`,
+            style.dim(`${profile.connections} connection(s)`),
+          ]),
+        );
       }
-
-      for (const deployment of deployments) {
-        const { platform, service, region } = deployment;
-        print(`  ${platform} service ${style.bold(service)} in ${region}`);
+      for (const bad of workspace?.unreadable ?? []) {
+        print(`  ${style.bold(bad.profile)}  ${style.yellow(bad.reason)}`);
       }
 
-      if (deployments.length > 1) {
-        print(
-          style.yellow(
-            `  ${deployments.length} profiles declare "${target}" against different services.`,
-          ),
-        );
-        print(style.dim('  They are separate endpoints sharing a name. Check each profile.'));
+      heading('Endpoint');
+      if (!deployment) {
+        print(style.dim('  No deployment — this target runs wherever the CLI does.'));
         return;
       }
 
+      print(`  ${deployment.platform} service ${style.bold(deployment.service)} in ${deployment.region}`);
       print(
         style.dim(
           "  the address is the platform's to assign — run: " +
-            `lanes link outputs --target ${target} --profile ${declaring[0]!.name}`,
+            `lanes link outputs --target ${target} --profile ${profiles[0]?.name ?? '<name>'}`,
         ),
       );
     },

package/src/cli/commands/operate/tools.ts

@@ -28,7 +28,7 @@ export async function tools(flags: ToolsFlags): Promise<void> {
 
   try {
     const { token } = await ensureProfileToken(runtime.credentials, runtime.config.auth.token_ref);
-    const declared = runtime.config.targets[runtime.target]?.deploy;
+    const declared = runtime.declared.deploy;
     const deployed = await deployedUrl(declared);
     // Not `endpointUrl`, which asks the platform a second time for an answer
     // this line already has.