@lanes-sh/link 0.5.4 → 0.6.1

package/src/cli/workspace-migrate.ts

@@ -0,0 +1,263 @@
+import { parseDocument } from 'yaml';
+import {
+  ConfigError,
+  SUPPORTED_CONTRACT,
+  WORKSPACE_FILE,
+  layout,
+  listProfiles,
+  readWorkspaceFile,
+  isRemoteWorkspace,
+  workspaceFiles,
+  isLegacyProfile,
+  legacyConfigSchema,
+  writeWorkspaceFile,
+  type LegacyTarget,
+  type WorkspaceTarget,
+} from '#profile';
+import { ConfigDocument } from './config-edit.ts';
+import { hoist, summarise } from './migrate-plan.ts';
+
+/**
+ * Contract 1 → 2: the target moves out of the profile and into the workspace.
+ *
+ * Under contract 1 every profile carried a `targets:` block naming the adapter
+ * sets it could be opened against. That is what made a deploy leave two copies
+ * of each profile — one in `~/.lanes-link`, one in the bucket the endpoint reads
+ * — and gave them nothing to keep them honest. It failed the way it was always
+ * going to: a local file was rewritten, lost its cloud target and eight
+ * connections, and `status --target cloud` reported seven where the endpoint was
+ * serving fifteen. `sync targets` and ADR-044's deployment index were both
+ * written in response to earlier rounds of the same thing.
+ *
+ * ADR-052 removes the second copy. A workspace *is* a target: it declares its
+ * adapters once, in its own `lanes-link.yaml`, and holds the profiles that live
+ * in it. This is the one-way trip that gets an existing workspace there.
+ *
+ * **What it does, per workspace:** hoists each profile's target blocks into the
+ * workspace registry, strips `targets:` from the profile, and sets `contract: 2`.
+ * A block whose storage names a bucket becomes a *pointer* locally — the bucket
+ * declares it — and the adapters travel to that workspace when `deploy` next
+ * runs, which is the only command that can put them there safely.
+ *
+ * **Where it runs** follows `commands/operate/migrate.ts`'s reasoning: an
+ * operator should not have to know a migration command exists before their
+ * config breaks. So `update` runs it on the local workspace automatically,
+ * `doctor --fix` runs it on demand, and `deploy` runs it on the target workspace
+ * as its first step — which is what keeps a bucket and the image reading it in
+ * step, given contract 1 is not read at all.
+ */
+
+export interface WorkspaceMigration {
+  readonly workspaceRoot: string;
+  /** Profiles rewritten to contract 2. */
+  readonly profiles: readonly string[];
+  /** Targets written into the registry, and how each was recorded. */
+  readonly targets: readonly { name: string; kind: 'declared' | 'pointer'; where?: string }[];
+  /** Human-readable lines, in the order they happened. */
+  readonly changes: readonly string[];
+  /** Nothing to do: every profile was already contract 2. */
+  readonly alreadyCurrent: boolean;
+}
+
+/** Whether this workspace still holds anything at contract 1. */
+export async function needsMigration(workspaceRoot: string): Promise<boolean> {
+  for (const profile of await listProfiles(workspaceRoot)) {
+    const text = await readWorkspaceFile(workspaceFiles(workspaceRoot), `profiles/${profile}.yaml`);
+    if (text === null) continue;
+    try {
+      if (isLegacyProfile(parseDocument(text).toJSON())) return true;
+    } catch {
+      // A file that will not parse is not this function's problem to report.
+      // `check` gives it a better sentence than "needs migrating" would.
+    }
+  }
+  return false;
+}
+
+/**
+ * Migrate one workspace. Safe to run on an already-migrated one.
+ *
+ * **Everything that can fail happens before the first write.** A refusal leaves
+ * the workspace exactly as it was rather than half-migrated, which matters more
+ * here than usual: the thing being rewritten is the only remaining description
+ * of where somebody's accounts live.
+ */
+export async function migrateWorkspace(
+  workspaceRoot: string,
+  options: { apply: boolean } = { apply: true },
+): Promise<WorkspaceMigration> {
+  const names = await listProfiles(workspaceRoot);
+  const legacy: { profile: string; document: ConfigDocument; targets: Record<string, LegacyTarget> }[] =
+    [];
+
+  for (const profile of names) {
+    const document = await ConfigDocument.open(workspaceRoot, profile);
+    const raw = document.toJSON();
+    if (!isLegacyProfile(raw)) continue;
+
+    const parsed = legacyConfigSchema.safeParse(raw);
+    if (!parsed.success) {
+      throw new ConfigError(
+        `${document.path} is contract 1 but its targets: block could not be read, so it cannot ` +
+          `be migrated:\n` +
+          parsed.error.issues.map((issue) => `  ${issue.path.join('.')}: ${issue.message}`).join('\n'),
+      );
+    }
+
+    legacy.push({ profile, document, targets: parsed.data.targets });
+  }
+
+  if (legacy.length === 0) {
+    return {
+      workspaceRoot,
+      profiles: [],
+      targets: [],
+      changes: [],
+      alreadyCurrent: true,
+    };
+  }
+
+  const registry = await hoist(legacy, workspaceRoot);
+
+  const changes: string[] = [];
+  for (const [name, entry] of Object.entries(registry)) {
+    changes.push(
+      entry.workspace !== undefined
+        ? `targets.${name}: pointer to ${entry.workspace}`
+        : `targets.${name}: declared in ${WORKSPACE_FILE}`,
+    );
+  }
+  for (const { profile } of legacy) changes.push(`profiles/${profile}.yaml: targets: removed, contract: 2`);
+
+  if (!options.apply) {
+    return {
+      workspaceRoot,
+      profiles: legacy.map((one) => one.profile),
+      targets: describe(registry),
+      changes,
+      alreadyCurrent: false,
+    };
+  }
+
+  // The registry first. A profile stripped of its targets while the workspace
+  // file has not learnt them yet is a profile nothing can open — and that is the
+  // window a crash would leave behind. This way round, the worst interruption
+  // leaves a workspace that declares its targets *and* profiles that still
+  // declare them too, which the next run reconciles by doing the same thing
+  // again.
+  await writeRegistry(workspaceRoot, registry);
+
+  for (const { document } of legacy) {
+    document.removeIn(['targets']);
+    document.setIn(['contract'], SUPPORTED_CONTRACT);
+    // `instance.default_target` went with the block it selected from. It has
+    // been inert since ADR-037 and there is now nothing for it to name.
+    document.removeIn(['instance', 'default_target']);
+    // Shape-only: a profile may carry an unrelated problem the full loader
+    // refuses — a connection row still spelling a renamed provider is the one
+    // that happens — and blocking the structural fix on it would strand the file
+    // at a contract nothing reads. `doctor --fix` names and repairs that one.
+    await document.save({ shapeOnly: true });
+  }
+
+  return {
+    workspaceRoot,
+    profiles: legacy.map((one) => one.profile),
+    targets: describe(registry),
+    changes,
+    alreadyCurrent: false,
+  };
+}
+
+/**
+ * Write the registry into the workspace file, creating it when absent.
+ *
+ * The whole object is assembled in plain JS and set once. Setting `targets` and
+ * then reaching back into it with `setIn(['targets', name, 'primary'])` does not
+ * work — the node written from a plain object is not one the document API will
+ * traverse — and the failure is a runtime "Expected YAML collection at targets"
+ * rather than anything a type would have caught.
+ */
+async function writeRegistry(
+  workspaceRoot: string,
+  registry: Record<string, WorkspaceTarget>,
+): Promise<void> {
+  const files = workspaceFiles(workspaceRoot);
+  const text = (await readWorkspaceFile(files, WORKSPACE_FILE)) ?? `contract: ${SUPPORTED_CONTRACT}\n`;
+  const document = parseDocument(text);
+  const current = (document.toJSON() ?? {}) as {
+    targets?: Record<string, WorkspaceTarget>;
+    deployments?: {
+      target?: string;
+      workspace?: string;
+      primary?: string;
+      last_deploy?: string;
+    }[];
+  };
+
+  // Anything already in the file wins over what was hoisted: a workspace part
+  // way through this has entries that are already right, and re-deriving them
+  // from a profile that still carries a stale block would undo a correction.
+  const merged: Record<string, WorkspaceTarget> = { ...registry, ...(current.targets ?? {}) };
+
+  // ADR-044's index, folded into the entries it described. `primary` and
+  // `last_deploy` were kept beside the declaration precisely because the
+  // declaration could be lost; they belong on it now that it cannot be.
+  for (const record of current.deployments ?? []) {
+    if (!record.target) continue;
+    const entry = merged[record.target];
+    if (!entry) continue;
+    merged[record.target] = {
+      ...entry,
+      ...(record.primary ? { primary: record.primary } : {}),
+      ...(record.last_deploy ? { last_deploy: record.last_deploy } : {}),
+    };
+  }
+
+  document.setIn(['contract'], SUPPORTED_CONTRACT);
+  document.setIn(
+    ['targets'],
+    Object.fromEntries(Object.entries(merged).sort(([a], [b]) => a.localeCompare(b))),
+  );
+  document.deleteIn(['deployments']);
+  document.deleteIn(['default_target']);
+
+  await writeWorkspaceFile(files, WORKSPACE_FILE, String(document));
+}
+
+function describe(
+  registry: Record<string, WorkspaceTarget>,
+): { name: string; kind: 'declared' | 'pointer'; where?: string }[] {
+  return Object.entries(registry).map(([name, entry]) =>
+    entry.workspace !== undefined
+      ? { name, kind: 'pointer' as const, where: entry.workspace }
+      : { name, kind: 'declared' as const },
+  );
+}
+
+/**
+ * Refuse a contract-1 workspace with the command that fixes it.
+ *
+ * `readRegistry` answers `{}` for one, because the `targets:` block it reads did
+ * not exist until contract 2 — so without this every command refuses with "this
+ * workspace declares no targets", which is a true sentence pointing in exactly
+ * the wrong direction.
+ *
+ * `update` is named rather than `doctor --fix`, and that is not arbitrary:
+ * `doctor` needs a `--target`, and on an unmigrated workspace there is no target
+ * to give it. `update` takes neither flag and migrates the local workspace as
+ * part of what it already means (ADR-052).
+ */
+export async function refuseIfUnmigrated(root: string): Promise<void> {
+  if (!(await needsMigration(root))) return;
+
+  throw new ConfigError(
+    `${root} is a contract 1 workspace, and this version does not read one.\n\n` +
+      '  Under contract 1 each profile declared its own targets. They are declared\n' +
+      '  once by the workspace now, which is what stopped a deploy leaving two\n' +
+      '  copies of every profile that could drift apart (ADR-052).\n\n' +
+      '  Migrate it:  lanes link update\n' +
+      '  A deployed target is migrated by the deploy that ships the image reading it:\n' +
+      '               lanes link deploy --target <name>',
+  );
+}

package/src/deployments/bootstrap.ts

@@ -1,4 +1,13 @@
-import { ConfigError, type Config, type DeployConfig, type TargetConfig } from '#profile';
+import {
+  ConfigError,
+  WORKSPACE_FILE,
+  declaredTarget,
+  readRegistry,
+  recordTarget,
+  type Config,
+  type DeployConfig,
+  type TargetConfig,
+} from '#profile';
 import { VAULT_KEY_ENV, VAULT_KEY_REF } from '#secrets';
 import { ok, print, style } from '#cli/output.ts';
 import { isInteractive } from '#cli/prompt.ts';
@@ -75,7 +84,11 @@ export async function resolveTarget(input: {
   flags: TargetBootstrap;
 }): Promise<TargetConfig> {
   const { config, flags, target } = input;
-  const declared = config.targets[target];
+  // From the workspace registry, not the profile. A profile declares no target
+  // (ADR-052), so the question "what does this workspace already know about
+  // `cloud`" is asked of the one file that answers it.
+  const entry = (await readRegistry(input.workspaceRoot))[target];
+  const declared = entry ? declaredTarget(entry) : undefined;
   const access = parseAccess(flags.access);
 
   const overrides = {
@@ -102,28 +115,35 @@ export async function resolveTarget(input: {
     adapters: declared === undefined,
   });
 
-  const document = await ConfigDocument.open(input.workspaceRoot, input.profile);
+  // The target goes to the workspace registry; the authorization block goes to
+  // the profile. Two files, because they are two different kinds of fact: where
+  // this target's bytes live is true of every profile here, and whether *this*
+  // profile issues its own tokens is true of one.
+  // `withoutUndefined` and its deep sibling type their result `Partial<T>`,
+  // which is stricter than what they do: they drop keys whose value is
+  // `undefined`, and a key that was required was never undefined. The casts say
+  // that, rather than the shape being genuinely unknown here.
+  const entryToWrite = declared
+    ? { ...declared, deploy: withoutUndefined(surveyed.target.deploy!) as DeployConfig }
+    : (deepWithoutUndefined(surveyed.target) as unknown as TargetConfig);
 
-  if (declared) {
-    document.setIn(['targets', target, 'deploy'], withoutUndefined(surveyed.target.deploy!));
-  } else {
-    document.setIn(['targets', target], deepWithoutUndefined(surveyed.target));
-  }
+  await recordTarget(input.workspaceRoot, target, entryToWrite);
 
   // `auth.authorization` is not part of the target and is written all the same:
   // the question that decides it is "will a remote client reach this", which
   // only a deploy is in a position to ask. See `SurveyResult`.
   if (surveyed.authorization) {
+    const document = await ConfigDocument.open(input.workspaceRoot, input.profile);
     document.setIn(['auth', 'authorization'], surveyed.authorization);
+    await document.save();
   }
-  await document.save();
 
   print('');
   print(
     ok(
       declared
-        ? `written to targets.${target}.deploy in ${input.profilePath}`
-        : `written to targets.${target} in ${input.profilePath}`,
+        ? `written to targets.${target}.deploy in ${WORKSPACE_FILE}`
+        : `written to targets.${target} in ${WORKSPACE_FILE}`,
     ),
   );
   if (surveyed.authorization) {

package/src/deployments/deploy.ts

@@ -1,4 +1,10 @@
-import { ConfigError, recordDeployment, resolveWorkspaceRoot, type DeployConfig } from '#profile';
+import {
+  ConfigError,
+  recordTarget,
+  resolveTargetWorkspace,
+  resolveWorkspaceRoot,
+  type DeployConfig,
+} from '#profile';
 import { announce, fail, heading, ok, print, style, warn } from '#cli/output.ts';
 import { staleNudge } from '#cli/release.ts';
 import { confirm, isInteractive } from '#cli/prompt.ts';
@@ -8,8 +14,8 @@ import { printSteps, runSteps } from './steps.ts';
 import { driverFor } from './drivers.ts';
 import { prepareSecrets, readableRefs, rotatableRefs } from './prepare.ts';
 import { repairOwnerLayer } from '#cli/config-repair.ts';
+import { migrateWorkspace } from '#cli/workspace-migrate.ts';
 import { deployedWorkspace, uploadWorkspace } from './upload.ts';
-import { unservableProfiles, unservableRefusal } from './servable.ts';
 import { collidingRefs, collisionRefusal, servingProfiles } from './serving.ts';
 import { healthLine, reachability, registerLine, reportUnauthorised } from './report.ts';
 
@@ -56,6 +62,23 @@ export interface DeployFlags extends GlobalFlags {
 }
 
 export async function deploy(flags: DeployFlags): Promise<void> {
+  // **The target's own workspace is migrated before anything resolves it.**
+  //
+  // This is the first thing the command does, and it has to be. `deploy` is what
+  // the refusal on a contract-1 bucket tells you to run — and every other read of
+  // that bucket goes through `openTarget`, which refuses it for the same reason.
+  // Migrating after resolution made the instruction circular: the command named
+  // as the fix could not get past the problem it fixes.
+  //
+  // `resolveTargetWorkspace` is the one lookup that does not need the far end to
+  // declare anything: it reads this machine's pointer and stops. So the bucket is
+  // located, migrated, and only then opened.
+  //
+  // Idempotent, and silent on a workspace already at contract 2 — a listing and
+  // no writes. `--dry-run` reports what it would do and writes nothing, like
+  // every other step of this command.
+  if (!(await migrateTargetWorkspace(requireTargetFlag(flags), flags.dryRun !== true))) return;
+
   // The one command allowed to name a target that does not exist yet: creating
   // it is what a first deploy is for.
   //
@@ -200,6 +223,7 @@ export async function deploy(flags: DeployFlags): Promise<void> {
   const credentials = await openSecretStoreFor(config, resolution.workspaceRoot, target);
   const prepared = await prepareSecrets({
     config,
+    declared,
     credentials,
     root: resolution.workspaceRoot,
     target,
@@ -237,25 +261,12 @@ export async function deploy(flags: DeployFlags): Promise<void> {
   // the upload sends would leave a served profile without the surface — this
   // bug again, one profile over.
   if (workspace) {
-    // Before anything is copied, and before the rollout: the endpoint opens
-    // every profile in the bucket against this one target, so a profile that
-    // does not declare it is not a profile that gets skipped — it is a revision
-    // that never goes healthy. `servable.ts` has the whole failure.
-    //
-    // Here rather than at the top of the command because it reads the same
-    // scope the upload does, and that scope is not settled until `workspace`
-    // says there is a bucket to send to at all.
-    const unservable = await unservableProfiles({
-      workspaceRoot: resolution.workspaceRoot,
-      profiles: serving,
-      target,
-    });
-
-    if (unservable.length > 0) {
-      heading('Cannot be served');
-      throw new ConfigError(unservableRefusal(unservable, target));
-    }
-
+    // The pre-flight that used to sit here is gone with contract 1. It refused
+    // a deploy carrying a profile that did not declare the target, because the
+    // endpoint opens every profile in the bucket against one target and one
+    // that could not run on it took the whole revision down. A profile declares
+    // no target now (ADR-052) — it lives in one — so there is no profile in this
+    // workspace that this target cannot open, and nothing left to check.
     await repairOwnerLayer(resolution.workspaceRoot, serving);
 
     // Before the rollout, so the revision that comes up finds a config to read.
@@ -263,14 +274,40 @@ export async function deploy(flags: DeployFlags): Promise<void> {
     // workspace it was told to read is not there yet.
     await uploadWorkspace(resolution.workspaceRoot, workspace, serving);
 
-    // Recorded once the bucket is known to hold this target's config. It is an
-    // index, not configuration (ADR-044) — the next recovery reads it instead
-    // of asking the platform.
-    await recordDeployment(resolution.workspaceRoot, {
-      target,
+    // **The bucket's own migration, here and nowhere else.**
+    //
+    // A second pass, and it is not redundant. The one at the top of the command
+    // migrated whatever the bucket already held; this catches what the upload
+    // just put there — profiles from a workspace that is itself at contract 2
+    // arrive migrated, but a first deploy of a *newly created* bucket writes
+    // them here for the first time. Idempotent, so the ordinary case is one
+    // listing and no writes.
+    await migrateWorkspace(workspace, { apply: true });
+
+    // **The target hands itself over to the workspace it now lives in.**
+    //
+    // Two writes, and the order matters. The declaration goes into the bucket's
+    // own `lanes-link.yaml` first, because that is the file the revision coming
+    // up will read to learn where its credentials and bytes are — and a
+    // revision that boots before it lands has nothing to open.
+    //
+    // The local entry then becomes a *pointer*. That is the whole of ADR-052 in
+    // two lines: after this, exactly one file declares this target, and this
+    // machine holds a reference to it rather than a copy. ADR-044's index
+    // existed because the profile's own block was the only record and could be
+    // lost in one edit; there is no second copy left to lose.
+    const stamped = new Date().toISOString();
+
+    await recordTarget(workspace, target, {
+      ...declared,
+      primary: resolution.profile,
+      last_deploy: stamped,
+    });
+
+    await recordTarget(resolution.workspaceRoot, target, {
       workspace,
       primary: resolution.profile,
-      last_deploy: new Date().toISOString(),
+      last_deploy: stamped,
     });
   }
 
@@ -303,3 +340,42 @@ function requireTargetFlag(flags: DeployFlags): string {
   }
   return flags.target;
 }
+
+/**
+ * Bring a target's own workspace to the current contract, before it is opened.
+ *
+ * Deliberately tolerant of a target this workspace has no pointer for: that is a
+ * first deploy, where there is nothing to migrate and `deploy` is about to create
+ * the workspace itself.
+ *
+ * Narrated when it does something. This rewrites every profile in somebody's
+ * bucket, and a command that reshapes that silently is one they cannot audit
+ * afterwards.
+ */
+async function migrateTargetWorkspace(target: string, apply: boolean): Promise<boolean> {
+  const root = resolveWorkspaceRoot();
+
+  const workspace = await resolveTargetWorkspace(root, target).catch(() => null);
+  if (workspace === null || workspace === root) return true;
+
+  const migrated = await migrateWorkspace(workspace, { apply });
+  if (migrated.alreadyCurrent) return true;
+
+  heading(apply ? 'Migrated' : 'Would migrate');
+  print(style.dim(`  ${workspace}`));
+  for (const change of migrated.changes) print(`  ${change}`);
+  if (apply) {
+    print(style.dim('  The revision this deploy rolls is the first that can read it.'));
+    return true;
+  }
+
+  // A dry run stops here rather than pressing on to survey and plan. Everything
+  // past this point opens the target, and the target is not readable until the
+  // migration above has actually happened — so continuing would report a second,
+  // confusing refusal about the thing the first paragraph just offered to fix.
+  print(style.dim('  Nothing was written, and nothing else was checked: the rest of this'));
+  print(style.dim('  command opens the target, which is not readable until this has run.'));
+  print('');
+  print(style.dim(`  Run it for real:  lanes link deploy --target ${target}`));
+  return false;
+}

package/src/deployments/knowledge.ts

@@ -57,8 +57,11 @@ export async function openKnowledge(
   /** Injected for tests. The repository is the only thing these stores reach. */
   call?: FetchLike,
 ): Promise<KnowledgeStores | undefined> {
-  const { declared, target } = input;
-  const knowledge = declared.knowledge;
+  const { config, target } = input;
+  // On the profile since contract 2: it says where *this profile's* memory and
+  // skills live, and a profile lives in exactly one target (ADR-052), so the
+  // per-target spelling it replaced could no longer say anything extra.
+  const knowledge = config.knowledge;
   if (!knowledge) return undefined;
 
   const token = await requireSecret(

package/src/deployments/prepare.ts

@@ -22,6 +22,8 @@ import { buildRegistryWithWorkspace, ensureProfileToken } from '#cli/runtime.ts'
 
 export interface PrepareInput {
   readonly config: Config;
+  /** The target's adapter set, from the workspace that declares it (ADR-052). */
+  readonly declared: TargetConfig;
   readonly credentials: SecretStore;
   readonly root: string;
   readonly target: string;
@@ -178,7 +180,7 @@ export async function prepareSecrets(input: PrepareInput): Promise<PrepareResult
   const warnings: string[] = [];
 
   await seedProfileToken({ config, credentials, readOnly, blocking });
-  await seedVaultKey({ declared: config.targets[target], credentials, readOnly });
+  await seedVaultKey({ declared: input.declared, credentials, readOnly });
 
   // Connection credentials are written by `connect`, against a real account, in
   // a browser. Nothing here can produce one, and a deploy that stopped for one

package/src/deployments/serving.ts

@@ -1,7 +1,8 @@
 import {
   ConfigError,
-  findDeployment,
+  listProfiles,
   loadWorkspaceProfiles,
+  readRegistry,
   type WorkspaceProfiles,
 } from '#profile';
 import { rotatableCredentialRefsFor } from '#registry';
@@ -17,10 +18,16 @@ import { buildRegistryWithWorkspace } from '#cli/runtime.ts';
  * profile did not declare yet — which the survey then offered to create
  * somewhere new. The way to deploy both was to know that already.
  *
- * The set is derived rather than guessed: it is every profile declaring the
- * target, which is exactly the set the endpoint will try to open. `--profile`
- * narrows it, and naming one is still how a first deploy works, because a
- * target nothing declares has no set to derive (ADR-043).
+ * The set is derived rather than guessed: it is every profile *in* the target's
+ * workspace, which is exactly the set the endpoint will try to open. `--profile`
+ * narrows it, and naming one is still how a first deploy works, because a target
+ * that does not exist yet has no workspace to derive from (ADR-043, ADR-052).
+ *
+ * It used to be "every profile declaring the target", read out of each profile's
+ * own file. That is the shape ADR-052 removed: the same question had a different
+ * answer per profile, so a rewritten file could drop a profile out of the set
+ * silently and the deploy would quietly send fewer profiles than the endpoint
+ * was serving.
  */
 
 export interface Serving {
@@ -42,23 +49,20 @@ export async function servingProfiles(input: {
     return { profiles: [...named], primary: named[0]! };
   }
 
-  const workspace = await loadWorkspaceProfiles(workspaceRoot);
-  const declaring = workspace.loaded
-    .filter((entry) => target in entry.config.targets)
-    .map((entry) => entry.profile);
+  const living = await listProfiles(workspaceRoot);
 
-  if (declaring.length === 0) {
+  if (living.length === 0) {
     throw new ConfigError(
-      `No profile declares "${target}", so there is no set to deploy.\n` +
+      `No profile lives in "${target}", so there is no set to deploy.\n` +
         '  A first deploy creates the target, and has to be told which profile\n' +
         '  it belongs to:\n' +
         `    lanes link deploy --target ${target} --profile <name>\n\n` +
-        `  If "${target}" was deployed before and the declaration was lost:\n` +
+        `  If "${target}" was deployed before and the pointer to it was lost:\n` +
         `    lanes link sync targets --target ${target} --discover`,
     );
   }
 
-  return { profiles: declaring, primary: await choosePrimary(workspaceRoot, target, declaring) };
+  return { profiles: living, primary: await choosePrimary(workspaceRoot, target, living) };
 }
 
 /**
@@ -75,13 +79,13 @@ async function choosePrimary(
   target: string,
   declaring: readonly string[],
 ): Promise<string> {
-  const recorded = (await findDeployment(workspaceRoot, target))?.primary;
+  const recorded = (await readRegistry(workspaceRoot))[target]?.primary;
   if (recorded !== undefined && declaring.includes(recorded)) return recorded;
 
   if (declaring.length === 1) return declaring[0]!;
 
   throw new ConfigError(
-    `${declaring.length} profiles declare "${target}", and nothing records which\n` +
+    `${declaring.length} profiles live in "${target}", and nothing records which\n` +
       "of them owns the endpoint's token. One token opens the endpoint and\n" +
       'reaches every profile behind it, so this cannot be picked for you.\n\n' +
       `  Name it once and it is remembered:\n` +

package/src/deployments/upload.ts

@@ -1,4 +1,5 @@
 import {
+  openTarget,
   DATA_DIR,
   WORKSPACE_FILE,
   layout,
@@ -150,7 +151,15 @@ export async function publishWorkspace(input: {
   readonly target: string;
   readonly profile: string;
 }): Promise<string | null> {
-  const declared = input.config.targets[input.target];
+  // Resolution failures are swallowed rather than thrown. The config edit that
+  // called this has already succeeded and is on disk; a target that cannot be
+  // resolved — undeclared, or a pointer to a bucket that is not answering — is
+  // something for `check` and `status` to report, not a reason to fail an edit
+  // that is done. Returning null is "published nowhere", which is exactly what
+  // happened.
+  const declared = await openTarget(input.workspaceRoot, input.target)
+    .then((resolved) => resolved.declared)
+    .catch(() => undefined);
   if (!declared) return null;
 
   const destination = deployedWorkspace(declared);