@lanes-sh/link 0.5.4 → 0.6.0

package/src/cli/runtime/select.ts

@@ -3,11 +3,15 @@ import type { SecretStore } from '#secrets';
 import type { BlobStore } from '#stores/blobs';
 import {
   loadProfileConfig,
+  openTarget,
+  readRegistry,
   resolveSelection,
+  resolveTargetWorkspace,
+  resolveWorkspaceRoot,
   requireTarget,
-  undeclaredTarget,
   type Config,
   type ProfileSelection,
+  type ResolvedTarget,
   type Resolution,
 } from '#profile';
 import { openSecrets, openStorage } from '#deployments/target.ts';
@@ -40,41 +44,78 @@ export async function resolveProfile(
   resolution: Resolution;
   config: Config;
   target: string;
+  /**
+   * The adapter set, already followed to whichever workspace declares it.
+   *
+   * `undefined` only under `allowUndeclaredTarget`, which is `deploy` on a first
+   * run: the target does not exist yet, so there is nothing to follow and
+   * nothing to open. Every other caller can rely on it.
+   */
+  resolved: ResolvedTarget | undefined;
 }> {
   // Spread rather than assigned: `exactOptionalPropertyTypes` makes an explicit
   // `env: undefined` a different type from an absent one, and the absent one is
   // what means "read the real environment".
   const env = options.env !== undefined ? { env: options.env } : {};
 
-  const selection = await resolveSelection({ profileFlag: flags.profile, ...env });
-
-  const { config } = await loadProfileConfig(selection.workspaceRoot, selection.profile);
-  const target = requireTarget(config, flags.target, {
+  // **Target first, and the order is the change.** It used to find the profile,
+  // read its config, and ask that config which targets existed — which is why
+  // "is `cloud` declared" had a different answer per profile, and why a profile
+  // rewritten without its cloud block reported a running deployment as gone.
+  //
+  // A target is a workspace now (ADR-052), so it has to be resolved before there
+  // is anywhere to look for a profile: `personal` on `local` and `personal` on
+  // `cloud` are two files, in two workspaces, and only the target says which one
+  // this command means.
+  const localRoot = resolveWorkspaceRoot(env);
+  const registry = await readRegistry(localRoot);
+  const target = requireTarget(registry, flags.target, {
     allowUndeclared: options.allowUndeclaredTarget === true,
-    profile: selection.profile,
+    root: localRoot,
   });
 
-  return { resolution: { ...selection, target }, config, target };
+  // `deploy` on a first run names a target nothing declares yet, and there is no
+  // workspace to follow. It resolves its own adapters from the flags it was
+  // given; everything else follows the pointer here, once.
+  const resolved = options.allowUndeclaredTarget === true && !(target in registry)
+    ? undefined
+    : await openTarget(localRoot, target);
+
+  const root = resolved?.workspaceRoot ?? localRoot;
+  const selection = await resolveSelection({ profileFlag: flags.profile, root, ...env });
+  const { config } = await loadProfileConfig(root, selection.profile);
+
+  return { resolution: { ...selection, target }, config, target, resolved };
 }
 
 /**
- * A profile without a target, for the commands that do not open one.
+ * A profile, without opening any of its stores.
  *
  * `check` validates a YAML file, `config show` prints the whole of it, and
- * `policy list` reads a block that is target-independent by construction. Making
- * those three demand a `--target` would be the ceremony that teaches people to
- * type `--target local` without reading it, which is how a required flag stops
- * being a guard.
+ * `policy list` reads a block that is the same wherever the profile runs. None
+ * of them needs a credential store or a bucket, and opening one would make all
+ * three fail on a target that is merely unreachable.
+ *
+ * It still needs `--target`, which it did not before. That is not ceremony: a
+ * profile lives in exactly one target's workspace now (ADR-052), so without one
+ * there is no file to validate — `personal` on `local` and `personal` on `cloud`
+ * are different documents. What the flag buys here is finding the file; what it
+ * still does not buy is opening anything.
  */
 export async function resolveProfileOnly(
   flags: GlobalFlags,
   options: { env?: Record<string, string | undefined> } = {},
-): Promise<{ selection: ProfileSelection; config: Config }> {
+): Promise<{ selection: ProfileSelection; config: Config; target: string }> {
   const env = options.env !== undefined ? { env: options.env } : {};
-  const selection = await resolveSelection({ profileFlag: flags.profile, ...env });
-  const { config } = await loadProfileConfig(selection.workspaceRoot, selection.profile);
+  const localRoot = resolveWorkspaceRoot(env);
+  const registry = await readRegistry(localRoot);
+  const target = requireTarget(registry, flags.target, { root: localRoot });
+  const root = await resolveTargetWorkspace(localRoot, target);
+
+  const selection = await resolveSelection({ profileFlag: flags.profile, root, ...env });
+  const { config } = await loadProfileConfig(root, selection.profile);
 
-  return { selection, config };
+  return { selection, config, target };
 }
 
 /**
@@ -90,9 +131,16 @@ export async function openSecretStoreFor(
   root: string,
   target: string,
 ): Promise<SecretStore> {
-  const declared = config.targets[target];
-  if (!declared) throw undeclaredTarget(target, config);
-  return openSecrets({ declared, config, root, target });
+  // Resolved here rather than taken from the caller, so `secrets push --from
+  // local --to cloud` can hold two targets that live in two different workspaces
+  // without the caller having to follow either pointer itself.
+  const resolved = await openTarget(root, target);
+  return openSecrets({
+    declared: resolved.declared,
+    config,
+    root: resolved.workspaceRoot,
+    target,
+  });
 }
 
 /**
@@ -113,10 +161,9 @@ export async function openBlobStoreFor(
   target: string,
   area?: string,
 ): Promise<BlobStore> {
-  const declared = config.targets[target];
-  if (!declared) throw undeclaredTarget(target, config);
+  const resolved = await openTarget(root, target);
 
-  const input = { declared, config, root, target };
+  const input = { declared: resolved.declared, config, root: resolved.workspaceRoot, target };
   const storage = await openStorage(input, await openSecrets(input));
   return area === undefined ? storage() : storage(area);
 }

package/src/cli/selection-require.ts

@@ -0,0 +1,79 @@
+import {
+  listProfiles,
+  noProfileNamed,
+  noTargetNamed,
+  readRegistry,
+  resolveTargetWorkspace,
+  resolveWorkspaceRoot,
+} from '#profile';
+import type { Flags } from './argv.ts';
+import { dispatchWillRefuse, requirementFor } from './selection.ts';
+import { refuseIfUnmigrated } from './workspace-migrate.ts';
+
+/**
+ * Refusing a command that has not said what it acts on.
+ *
+ * Apart from `selection.ts`, which holds the two tables — what each command
+ * requires, and which flags it accepts — and argues for keeping *those two*
+ * together. This is the third thing: actually resolving a selection, which under
+ * ADR-052 means reading the registry, following a pointer to the workspace that
+ * declares the target, and listing the profiles that live there. Table lookups
+ * and network reads are not the same job, and the file-size budget noticed
+ * before anyone else did.
+ */
+
+/**
+ * Refuse before the command runs, naming what it wants and what there is.
+ *
+ * Async, and it reads the workspace — but only on the way to throwing. The
+ * useful half of "which profile did you mean" is the list of them, and the same
+ * for targets; a refusal that only restates the flag name leaves someone to go
+ * and look it up. Both messages come from `#profile` so this file and the
+ * resolver cannot describe the same refusal differently, and both name an
+ * exported variable that no longer counts — the shell still configured for the
+ * old world is the state hardest to diagnose from the inside.
+ */
+export async function requireSelection(
+  first: string,
+  second: string | undefined,
+  flags: Flags,
+  env?: Record<string, string | undefined>,
+): Promise<void> {
+  if (dispatchWillRefuse(first, second)) return;
+
+  const needs = requirementFor(first, second);
+  if (needs === 'none') return;
+
+  const root = resolveWorkspaceRoot(env ? { env } : {});
+
+  // **Target before profile, for both levels.** It used to ask for the profile
+  // and read that profile's own target list — the ordering ADR-052 inverted,
+  // since the profile lives inside the target and there is nowhere to look for
+  // one until the target is known. `refuseIfUnmigrated` is on the refusal path
+  // only, so it costs nothing when the flag is present.
+  if (typeof flags['target'] !== 'string') {
+    await refuseIfUnmigrated(root);
+    throw noTargetNamed(await readRegistry(root), root, env);
+  }
+
+  // A named target the registry cannot know, because it does not exist yet.
+  if (!(flags['target'] in (await readRegistry(root)))) await refuseIfUnmigrated(root);
+
+  if (needs === 'target') return;
+
+  if (typeof flags['profile'] !== 'string') {
+    // Listed from the target's own workspace, so the names offered are ones that
+    // command could act on. An unreachable pointer degrades to the empty list
+    // rather than failing — "which profile" is still the question being asked.
+    const where = await resolveTargetWorkspace(root, flags['target']).catch(() => root);
+    throw noProfileNamed(where, await listProfiles(where).catch(() => []), env);
+  }
+}
+
+/**
+ * Flags every command accepts, whatever it does.
+ *
+ * `--help` short-circuits before dispatch, and `--json` is offered widely enough
+ * that listing it per command would be noise. `--quiet` is read by `announce`
+ * rather than by any one command.
+ */

package/src/cli/selection.ts

@@ -1,14 +1,4 @@
-import {
-  ConfigError,
-  listProfiles,
-  loadProfileConfig,
-  loadWorkspaceProfiles,
-  noProfileNamed,
-  noTargetInWorkspace,
-  noTargetNamed,
-  resolveWorkspaceRoot,
-  targetsByName,
-} from '#profile';
+import { ConfigError } from '#profile';
 import type { Flags } from './argv.ts';
 import { CONNECT_CUSTOM_FLAGS } from './commands/connect/custom/spec.ts';
 import { nearest } from './nearest.ts';
@@ -39,11 +29,17 @@ import { nearest } from './nearest.ts';
  * What a command must be told before it can act.
  *
  * `target` is not a weaker `profile+target`. It says the command's subject *is*
- * the target, and that the profiles behind it are every profile declaring it
- * rather than one the operator picks (ADR-043). `--profile` stays accepted
+ * the target, and that the profiles behind it are every profile *in* it rather
+ * than one the operator picks (ADR-043, ADR-052). `--profile` stays accepted
  * there, as a filter.
+ *
+ * There is no `profile`-alone level any more. Five commands sat there — the ones
+ * that read a profile's file and open nothing — and it stopped being reachable
+ * when a profile came to live inside one target's workspace: without a target
+ * there is no file to read. The level is gone rather than left empty, so nobody
+ * adds a sixth command to a level that cannot resolve.
  */
-export type Requires = 'none' | 'profile' | 'target' | 'profile+target';
+export type Requires = 'none' | 'target' | 'profile+target';
 
 /**
  * The rule, per command path.
@@ -87,28 +83,33 @@ export const SELECTION: Record<string, Requires> = {
   'mcp list': 'none',
   // The bare forms, which each dispatch to a `case undefined` in `main.ts`.
   // `lanes link profile` is `profile list`, and needs the same as it.
-  profile: 'none',
   mcp: 'none',
-  'profile list': 'none',
-  'profile add': 'none',
   'profile default': 'none',
   'target use': 'none',
   'vault key': 'none',
+  // Listing the registry is what you run to find out what `--target` accepts, so
+  // requiring the answer as input would be circular (ADR-052).
+  target: 'none',
+  'target list': 'none',
+
+  // A profile lives in one target's workspace, so listing or creating one names
+  // which workspace. `target show` follows the pointer, which `list` does not.
+  profile: 'target',
+  'profile list': 'target',
+  'profile add': 'target',
+  'profile remove': 'target',
+  'target show': 'target',
 
-  check: 'profile',
-  config: 'profile',
-  policy: 'profile',
-  target: 'profile',
-  'config show': 'profile',
-  'policy list': 'profile',
-  'target list': 'profile',
-  'target show': 'profile',
-  'secrets push': 'profile',
-  'profile remove': 'none',
-  // Target-independent for the same reason `policy list` is: the block is
-  // declared once in the YAML and applies to every target the profile has.
-  identity: 'profile',
-  'identity list': 'profile',
+  // These read one profile's file and open nothing. The target is what says
+  // which workspace holds it — required to *locate* the profile, not to open it.
+  check: 'profile+target',
+  config: 'profile+target',
+  'config show': 'profile+target',
+  policy: 'profile+target',
+  'policy list': 'profile+target',
+  identity: 'profile+target',
+  'identity list': 'profile+target',
+  'secrets push': 'profile+target',
 
   connect: 'profile+target',
   // Both edit the profile config, and `disconnect` also opens the target's
@@ -205,7 +206,7 @@ const SUBCOMMANDS: Record<string, readonly string[]> = {
  * bogus" is the useful sentence, and a complaint about `--profile` on a command
  * that does not exist sends someone off to fix the wrong thing.
  */
-function dispatchWillRefuse(first: string, second: string | undefined): boolean {
+export function dispatchWillRefuse(first: string, second: string | undefined): boolean {
   const known = SUBCOMMANDS[first];
   if (!known || second === undefined) return false;
   return !known.includes(second);
@@ -228,65 +229,6 @@ export function requirementFor(first: string, second: string | undefined): Requi
   return SELECTION[selectionKey(first, second)] ?? 'profile+target';
 }
 
-/**
- * Refuse before the command runs, naming what it wants and what there is.
- *
- * Async, and it reads the workspace — but only on the way to throwing. The
- * useful half of "which profile did you mean" is the list of them, and the same
- * for targets; a refusal that only restates the flag name leaves someone to go
- * and look it up. Both messages come from `#profile` so this file and the
- * resolver cannot describe the same refusal differently, and both name an
- * exported variable that no longer counts — the shell still configured for the
- * old world is the state hardest to diagnose from the inside.
- */
-export async function requireSelection(
-  first: string,
-  second: string | undefined,
-  flags: Flags,
-  env?: Record<string, string | undefined>,
-): Promise<void> {
-  if (dispatchWillRefuse(first, second)) return;
-
-  const needs = requirementFor(first, second);
-  if (needs === 'none') return;
-
-  // Asked before the profile requirement, because for these there is none. The
-  // refusal has to describe the workspace rather than one profile's targets,
-  // since the command was never going to act on only one.
-  if (needs === 'target') {
-    if (typeof flags['target'] === 'string') return;
-    const root = resolveWorkspaceRoot(env ? { env } : {});
-    throw noTargetInWorkspace(targetsByName(await loadWorkspaceProfiles(root)), root, env);
-  }
-
-  const profile = flags['profile'];
-  if (typeof profile !== 'string') {
-    const root = resolveWorkspaceRoot(env ? { env } : {});
-    throw noProfileNamed(root, await listProfiles(root), env);
-  }
-
-  if (needs !== 'profile+target' || typeof flags['target'] === 'string') return;
-
-  // The profile is known by here, so the target list is the one belonging to it
-  // rather than a guess. A profile that does not exist is a different refusal,
-  // and `resolveSelection` gives it a better one a moment later.
-  const root = resolveWorkspaceRoot(env ? { env } : {});
-  try {
-    const { config } = await loadProfileConfig(root, profile);
-    throw noTargetNamed(config, profile, env);
-  } catch (error) {
-    if (error instanceof ConfigError) throw error;
-    throw new ConfigError(`--target is required for "${[first, second].filter(Boolean).join(' ')}".`);
-  }
-}
-
-/**
- * Flags every command accepts, whatever it does.
- *
- * `--help` short-circuits before dispatch, and `--json` is offered widely enough
- * that listing it per command would be noise. `--quiet` is read by `announce`
- * rather than by any one command.
- */
 const UNIVERSAL = ['help', 'json', 'quiet'];
 
 /**
@@ -367,6 +309,16 @@ const ACCEPTS: Record<string, readonly string[]> = {
  * `parseArgv` returns every `--anything` it sees and no command ever inspected
  * the leftovers. A typo was swallowed the same way on every command in the CLI.
  */
+/**
+ * Commands that name their profile as an argument, and so refuse the flag.
+ *
+ * A `--profile` here could only name a *second* profile and disagree with the
+ * positional one. They needed no exception while both sat at `none`; ADR-052
+ * moved them to `target`, which made them inherit `--profile` from the rule
+ * below.
+ */
+const POSITIONAL_PROFILE = new Set(['profile add', 'profile remove']);
+
 export function assertKnownFlags(first: string, second: string | undefined, flags: Flags): void {
   if (dispatchWillRefuse(first, second)) return;
 
@@ -378,7 +330,7 @@ export function assertKnownFlags(first: string, second: string | undefined, flag
     ...(ACCEPTS[key] ?? []),
     // `target` accepts both: the target is what it acts on, and `--profile`
     // narrows it to one of the profiles behind it.
-    ...(needs !== 'none' ? ['profile'] : []),
+    ...(needs !== 'none' && !POSITIONAL_PROFILE.has(key) ? ['profile'] : []),
     ...(needs === 'target' || needs === 'profile+target' ? ['target'] : []),
   ]);