@lanes-sh/link 0.5.4 → 0.6.1

package/src/profile/workspace.ts

@@ -66,6 +66,16 @@ export interface ResolveOptions {
   readonly profileFlag?: string | undefined;
   readonly cwd?: string;
   readonly env?: Record<string, string | undefined>;
+  /**
+   * The workspace to look in, when the caller has already resolved a target.
+   *
+   * A profile lives in exactly one target's workspace (ADR-052), so a command
+   * naming a target has to follow it before it can say whether the profile
+   * exists — the answer for `cloud` lives in a bucket and is nowhere on this
+   * disk. Absent means the local root, which is what the commands taking no
+   * target want.
+   */
+  readonly root?: string;
 }
 
 /**
@@ -183,7 +193,7 @@ export async function listProfiles(workspaceRoot: string): Promise<string[]> {
  */
 export async function resolveSelection(options: ResolveOptions = {}): Promise<ProfileSelection> {
   const env = options.env ?? (process.env as Record<string, string | undefined>);
-  const workspaceRoot = resolveWorkspaceRoot(options);
+  const workspaceRoot = options.root ?? resolveWorkspaceRoot(options);
   const profile = options.profileFlag;
 
   if (!profile) throw noProfileNamed(workspaceRoot, await listProfiles(workspaceRoot), env);
@@ -296,27 +306,3 @@ export async function loadWorkspaceProfiles(workspaceRoot: string): Promise<Work
 
   return { workspaceRoot, loaded, unreadable };
 }
-
-/**
- * Which profiles declare each target name, across the whole workspace.
- *
- * A target is declared per profile and the endpoint serves every profile in the
- * workspace (ADR-009), so "who has `cloud`" is a question with a list for an
- * answer rather than a yes or no. The disagreement — one profile declaring it
- * and its sibling not — is the state that reads as a target having vanished.
- */
-export function targetsByName(
-  workspace: WorkspaceProfiles,
-): ReadonlyMap<string, readonly string[]> {
-  const byName = new Map<string, string[]>();
-
-  for (const { profile, config } of workspace.loaded) {
-    for (const target of Object.keys(config.targets)) {
-      const profiles = byName.get(target);
-      if (profiles) profiles.push(profile);
-      else byName.set(target, [profile]);
-    }
-  }
-
-  return byName;
-}

package/src/server/dashboard.ts

@@ -199,7 +199,10 @@ export async function handleDashboard(
       profile: name,
       profiles: generation.names(),
       target: runtime.target,
-      targets: Object.keys(runtime.config.targets),
+      // One, and it is the one being served. A revision serves exactly the
+      // target it was deployed as, and the config no longer carries a list of
+      // alternatives for it to offer (ADR-052).
+      targets: [runtime.target],
       connections,
       ownClients: Object.keys(runtime.config.oauth_apps),
     });

package/src/server/harness.ts

@@ -37,15 +37,10 @@ export const TEST_TOKEN = 'llk_test_token_value';
 
 export function configFor(profile: string, port: number, policy: string): Config {
   return parseConfig(`
-contract: 1
+contract: 2
 instance:
   profile: ${profile}
-  default_target: local
   port: ${port}
-targets:
-  local:
-    credentials: { adapter: file, path: ./data/${profile}/credentials.enc }
-    storage: { adapter: filesystem, path: ./data/${profile} }
 limits:
   requests_per_minute: 1000
   upstream_calls_per_minute: 1000

package/src/cli/commands/profile/declare.ts

@@ -1,154 +0,0 @@
-import { listProfiles, loadProfileConfig, ConfigError, type TargetConfig } from '#profile';
-import { ask, isInteractive } from '../../prompt.ts';
-import { print, style } from '../../output.ts';
-
-/**
- * The targets a new profile declares, and where their values come from.
- *
- * `profile add` used to emit exactly one target — `local`, hard-coded in the
- * template — while accepting a `--target` it dropped on the floor. So the
- * command that creates a profile could not create the thing a profile is mostly
- * *for*: somewhere to run.
- *
- * A `local` target is derivable and never asked about: a path under the
- * workspace, an encrypted file beside it. Anything else names a cloud account,
- * and this is the one place in the CLI where guessing those is actively harmful.
- * `deploy`'s survey proposes a *fresh* project id (`lanes-link-<random>`),
- * which is right for a first deploy and exactly wrong here — pressing return
- * would build a second, separate deployment rather than adding this profile to
- * the one the operator already has. So the defaults come from a sibling profile
- * that already declares the same target name, and the service name is the only
- * one derived, because that is the one field that has to differ per profile.
- */
-
-export interface DeclaredTarget {
-  readonly name: string;
-  /** Rendered YAML, indented two spaces, ready to sit under `targets:`. */
-  readonly block: string;
-  /** Which profile the values were taken from, when they were taken from one. */
-  readonly from?: string;
-}
-
-/** The `local` target, which is the same shape in every profile. */
-export function localBlock(profile: string, name = 'local'): string {
-  return (
-    `  ${name}:\n` +
-    `    credentials: { adapter: file, path: ./data/${profile}/credentials.enc }\n` +
-    `    storage: { adapter: filesystem, path: ./data/${profile} }\n`
-  );
-}
-
-/**
- * A sibling profile's declaration of the same target name, if there is one.
- *
- * The first match wins rather than the operator being asked which — two
- * profiles declaring `cloud` against different projects is possible and rare,
- * and the values are shown and editable at the prompt either way.
- */
-export async function siblingTarget(
-  workspaceRoot: string,
-  target: string,
-  exclude: string,
-): Promise<{ profile: string; declared: TargetConfig } | null> {
-  for (const name of await listProfiles(workspaceRoot)) {
-    if (name === exclude) continue;
-
-    try {
-      const { config } = await loadProfileConfig(workspaceRoot, name);
-      const declared = config.targets[target];
-      if (declared) return { profile: name, declared };
-    } catch {
-      // A profile that will not parse is not a source of defaults, and saying
-      // so here would report a broken sibling as a problem with this command.
-    }
-  }
-
-  return null;
-}
-
-/**
- * Ask for what a non-local target needs, pre-filled from a sibling.
- *
- * Refuses rather than inventing when there is nobody to ask and nothing to copy
- * — the same bargain `connect --non-interactive` makes. A profile written with
- * a guessed project id parses, deploys, and points at the wrong account.
- */
-export async function askTarget(input: {
-  readonly target: string;
-  readonly profile: string;
-  readonly sibling: { profile: string; declared: TargetConfig } | null;
-  readonly nonInteractive?: boolean;
-}): Promise<DeclaredTarget> {
-  const { target, profile, sibling } = input;
-
-  if (!sibling) {
-    throw new ConfigError(
-      `No profile in this workspace declares a target called "${target}", so there is\n` +
-        'nothing to copy its adapters from.\n' +
-        `  lanes link profile add ${profile} --target local\n` +
-        `  lanes link deploy --profile ${profile} --target ${target}\n` +
-        '  The deploy surveys for what it does not know and writes the block.',
-    );
-  }
-
-  const declared = sibling.declared;
-  const project = declared.credentials.project ?? '';
-  const bucket = declared.storage.bucket ?? '';
-
-  // The one field that must differ: two profiles served by one project need two
-  // services, which is what makes them separately deployable.
-  const service = `lanes-link-${profile}-mcp`;
-
-  if (input.nonInteractive === true || !isInteractive()) {
-    return {
-      name: target,
-      block: cloudBlock({ target, project, bucket, service, declared }),
-      from: sibling.profile,
-    };
-  }
-
-  print(style.dim(`  ${target} — defaults from profile "${sibling.profile}"`));
-
-  const answeredProject = (await ask(`  Cloud project [${project}]: `)) || project;
-  const answeredBucket = (await ask(`  Bucket [${bucket}]: `)) || bucket;
-  const answeredService = (await ask(`  Service [${service}]: `)) || service;
-
-  return {
-    name: target,
-    block: cloudBlock({
-      target,
-      project: answeredProject,
-      bucket: answeredBucket,
-      service: answeredService,
-      declared,
-    }),
-    from: sibling.profile,
-  };
-}
-
-/** One target's YAML, carrying over the adapters the sibling chose. */
-function cloudBlock(input: {
-  target: string;
-  project: string;
-  bucket: string;
-  service: string;
-  declared: TargetConfig;
-}): string {
-  const { declared } = input;
-  const deploy = declared.deploy;
-
-  return (
-    `  ${input.target}:\n` +
-    `    credentials: { adapter: ${declared.credentials.adapter}, project: ${input.project} }\n` +
-    `    storage: { adapter: ${declared.storage.adapter}, bucket: ${input.bucket} }\n` +
-    `    vault: { adapter: ${declared.vault?.adapter ?? 'secret'} }\n` +
-    (deploy
-      ? `    deploy:\n` +
-        `      platform: ${deploy.platform}\n` +
-        `      project: ${input.project}\n` +
-        `      region: ${deploy.region}\n` +
-        `      service: ${input.service}\n` +
-        `      access: ${deploy.access}\n`
-      : '')
-  );
-}

package/src/deployments/servable.ts

@@ -1,82 +0,0 @@
-import { listProfiles, loadProfileConfig } from '#profile';
-
-/**
- * Whether every profile a deploy sends can actually run on the target it sends them to.
- *
- * A deploy uploads config for a set of profiles and rolls a revision baked with
- * one `LANES_LINK_TARGET`. The endpoint then opens *every* profile it finds in
- * the bucket against that one target — see `openReconciled` — and a profile that
- * does not declare it throws on the way up. The catch there closes the runtimes
- * and rethrows, so the container exits and the revision never goes healthy.
- *
- * That is the whole failure, and its shape is what makes it worth a pre-flight:
- * the profile at fault is usually the one just scaffolded, the operator was not
- * thinking about the deployment when they made it, and the symptom is a revision
- * that will not start — which reads as a problem with the deploy, the image, or
- * the platform. Nothing points at the new profile. Refusing here costs one file
- * read per profile and names it.
- *
- * Its own file, not a private function in `deploy.ts`, for the reason
- * `handoff.ts` gives: `deploy.test.ts` does not import `deploy.ts`, and making
- * it do so would pull the whole CLI runtime into a unit test.
- */
-
-export interface Unservable {
-  readonly profile: string;
-  /** What it does declare, so the refusal says how far off it is. */
-  readonly declares: readonly string[];
-}
-
-/**
- * The profiles this deploy would send that the revision could not open.
- *
- * Scoped exactly as `uploadWorkspace` and `repairOwnerLayer` are — by the
- * `--profile` flag, absent meaning the whole workspace — because the set that
- * gets uploaded is the set that gets served, and checking a different one would
- * be checking the wrong question.
- *
- * A profile that cannot be parsed is not reported here. It is already fatal
- * further along, with a better message than this could give, and a YAML error
- * dressed up as "cannot run on cloud" would send someone looking at their
- * targets instead of their syntax.
- */
-export async function unservableProfiles(input: {
-  readonly workspaceRoot: string;
-  readonly profiles: readonly string[] | undefined;
-  readonly target: string;
-}): Promise<Unservable[]> {
-  const found: Unservable[] = [];
-  const wanted = input.profiles === undefined ? undefined : new Set(input.profiles);
-
-  for (const name of await listProfiles(input.workspaceRoot)) {
-    if (wanted !== undefined && !wanted.has(name)) continue;
-
-    let declared: string[];
-    try {
-      const { config } = await loadProfileConfig(input.workspaceRoot, name);
-      declared = Object.keys(config.targets);
-    } catch {
-      continue;
-    }
-
-    if (!declared.includes(input.target)) found.push({ profile: name, declares: declared });
-  }
-
-  return found;
-}
-
-/** The refusal, as a block, so the wording is testable without a deploy. */
-export function unservableRefusal(found: readonly Unservable[], target: string): string {
-  const rows = found
-    .map((one) => `        ${one.profile}   declares: ${one.declares.join(', ') || 'nothing'}`)
-    .join('\n');
-
-  return (
-    `${found.length} profile${found.length === 1 ? '' : 's'} would be uploaded that cannot run on "${target}":\n` +
-    `${rows}\n\n` +
-    '      The endpoint opens every profile in the bucket with this target, so the\n' +
-    '      revision would come up and refuse to start.\n' +
-    `        lanes link profile add <name> --target ${target}   declares it on a new one\n` +
-    '        --profile <name>                          deploys just the one'
-  );
-}

package/src/deployments/sync-apply.ts

@@ -1,330 +0,0 @@
-import { parseDocument } from 'yaml';
-import {
-  ConfigError,
-  parseConfig,
-  readWorkspaceFile,
-  workspaceFiles,
-  writeWorkspaceFile,
-  type Config,
-} from '#profile';
-import { ConfigDocument } from '#cli/config-edit.ts';
-import { diffConfigs, keyOfElement, keyedArrayFor, type Change } from './sync.ts';
-import { isWorkspaceConfig } from './upload.ts';
-
-/**
- * Deciding a difference and writing it down.
- *
- * The rule is union, and refusal where a union is not possible. Anything one
- * side is missing is copied to it; anything both sides hold differently stops
- * the sync and prints the diff. Last-writer-wins was the alternative and it is
- * the failure this whole command exists because of — a copy of a profile
- * quietly replaced another that held six connections it did not.
- *
- * `--prefer` is how a conflict is resolved, and it is deliberately one flag for
- * the whole run rather than a prompt per key: a sync that asks twelve questions
- * is one answered by pressing return, and the twelfth answer is the one that
- * matters.
- */
-
-export type Prefer = 'local' | 'remote';
-
-export interface ProfileSync {
-  readonly profile: string;
-  readonly changes: readonly Change[];
-  /** Only on the local side: the remote file does not exist at all. */
-  readonly onlyRemote: boolean;
-  readonly onlyLocal: boolean;
-}
-
-const profileKey = (profile: string): string => `profiles/${profile}.yaml`;
-
-/** Parse a profile out of a workspace, or `undefined` when it is not there. */
-async function readProfile(root: string, profile: string): Promise<Config | undefined> {
-  const text = await readWorkspaceFile(workspaceFiles(root), profileKey(profile));
-  if (text === null) return undefined;
-
-  // A remote copy that will not parse is a conflict the operator has to look
-  // at, not something to overwrite with the local one — it may be the only copy
-  // of something.
-  try {
-    return parseConfig(text, `${root}/${profileKey(profile)}`).config;
-  } catch (error) {
-    throw new ConfigError(
-      `${root}/${profileKey(profile)} could not be read, so it cannot be merged:\n` +
-        `  ${error instanceof Error ? (error.message.split('\n')[0] ?? '') : String(error)}\n` +
-        '  Fix it there, or pass --prefer local to overwrite it.',
-    );
-  }
-}
-
-/**
- * The same file, unvalidated, as the source of what actually gets written.
- *
- * The diff compares *validated* configs, because that is the only comparison
- * that gets equality right: `policy.allow: [gmail.*]` and
- * `[{capability: gmail.*}]` are the same grant written two ways, and a raw
- * comparison would call that a conflict.
- *
- * What is written has to come from here all the same. Writing the validated
- * value back means writing every default zod filled in on the way through —
- * `min_instances: 0`, an OAuth token lifetime nobody set — into a file the
- * operator reads. Recovering six connections should not also silently expand
- * three policy rules into a shape they were not written in.
- *
- * The two cannot disagree about whether something is missing: a default is
- * filled in identically on both sides, so it is equal, so it is never a change.
- */
-async function readRawProfile(root: string, profile: string): Promise<unknown> {
-  const text = await readWorkspaceFile(workspaceFiles(root), profileKey(profile));
-  return text === null ? undefined : parseDocument(text).toJSON();
-}
-
-/** Every profile either side has, so one that exists only remotely is still seen. */
-export async function profilesInEither(local: string, remote: string): Promise<string[]> {
-  const names = async (root: string): Promise<string[]> =>
-    (await workspaceFiles(root).list('profiles/'))
-      .map((entry) => entry.key.slice('profiles/'.length))
-      .filter((name) => name.endsWith('.yaml') && !name.endsWith('.example.yaml'))
-      .filter((name) => !name.includes('/'))
-      .map((name) => name.slice(0, -'.yaml'.length));
-
-  return [...new Set([...(await names(local)), ...(await names(remote))])].sort();
-}
-
-/** What differs, for one profile, between the workspace and a target's copy. */
-export async function planProfile(
-  localRoot: string,
-  remoteRoot: string,
-  profile: string,
-  prefer: Prefer | undefined,
-): Promise<ProfileSync> {
-  const local = await readProfile(localRoot, profile);
-  const remote = prefer === 'local' && local !== undefined
-    ? // Told local wins outright: there is nothing to ask the remote copy, and
-      // reading it could only produce conflicts already decided.
-      undefined
-    : await readProfile(remoteRoot, profile);
-
-  return {
-    profile,
-    changes: diffConfigs(local, remote),
-    onlyRemote: local === undefined && remote !== undefined,
-    onlyLocal: remote === undefined && local !== undefined,
-  };
-}
-
-/** The changes that will be written, once `--prefer` has decided the rest. */
-export function resolved(changes: readonly Change[], prefer: Prefer | undefined): Change[] {
-  return changes.map((change) => {
-    if (change.direction !== 'conflict') return change;
-    if (prefer === undefined) return change;
-    return { ...change, direction: prefer === 'remote' ? 'pull' : 'push' } as Change;
-  });
-}
-
-/**
- * Write everything the local copy is missing into the local profile.
- *
- * Through `ConfigDocument`, so the comments an operator wrote survive a
- * recovery, and so the result is validated before it lands — a merged config
- * that would not load is a worse outcome than the one being fixed.
- *
- * A keyed-array element is written by rewriting its array. A YAML sequence has
- * no addressable slot for "the entry whose provider is gmail", and merging by
- * index is exactly the comparison this avoided making in the first place.
- */
-export async function applyPulls(
-  localRoot: string,
-  remoteRoot: string,
-  profile: string,
-  changes: readonly Change[],
-): Promise<number> {
-  const pulls = changes.filter((change) => change.direction === 'pull');
-  if (pulls.length === 0) return 0;
-
-  // A profile local does not have at all is a file copy: there is no document
-  // to edit, and every key in it is a pull.
-  if (pulls.some((change) => change.path.length === 0)) {
-    const text = await readWorkspaceFile(workspaceFiles(remoteRoot), profileKey(profile));
-    if (text === null) return 0;
-    await writeWorkspaceFile(workspaceFiles(localRoot), profileKey(profile), text);
-    return 1;
-  }
-
-  const document = await ConfigDocument.open(localRoot, profile);
-  const remote = await readRawProfile(remoteRoot, profile);
-  if (remote === undefined) return 0;
-
-  const local = document.toJSON();
-  const written = new Set<string>();
-
-  for (const change of pulls) {
-    const array = keyedArrayFor(change.path);
-
-    if (array) {
-      // One write per array, however many of its elements were missing — and
-      // the value written is the *merge*, never the remote array.
-      //
-      // It used to be `setIn(array, remoteArray)`, which reads as "pull the
-      // connections" and means "replace the connections". A profile that had
-      // gained six accounts locally since the last deploy lost all six to a
-      // command whose entire purpose is not losing things. The tests missed it
-      // because every one of them had a local array that was a subset of the
-      // remote — the case where replacing and merging agree.
-      const key = array.join('.');
-      if (written.has(key)) continue;
-      written.add(key);
-
-      const merged = mergeKeyed(
-        array,
-        valueAt(local, array),
-        valueAt(remote, array),
-        pulls
-          .filter((one) => keyedArrayFor(one.path)?.join('.') === key)
-          .map((one) => one.path[array.length])
-          .filter((name): name is string => name !== undefined),
-      );
-      if (merged !== undefined) document.setIn([...array], merged);
-      continue;
-    }
-
-    const value = valueAt(remote, change.path);
-    // Absent from the raw document means the remote side only has it as a
-    // default, which the local side fills in identically. Nothing to write.
-    if (value === undefined) continue;
-
-    document.setIn([...change.path], value);
-  }
-
-  await document.save();
-  return written.size;
-}
-
-/**
- * The local array, with the named elements taken from the remote one.
- *
- * Element order is local's, with anything new appended, so a pull reads as a
- * diff in the file rather than as a reshuffle. An element named in `wanted` and
- * absent from the remote array is skipped rather than removed: the diff said it
- * was missing locally, so it cannot also be missing remotely.
- */
-function mergeKeyed(
-  arrayPath: readonly string[],
-  local: unknown,
-  remote: unknown,
-  wanted: readonly string[],
-): unknown[] | undefined {
-  if (!Array.isArray(remote)) return undefined;
-
-  const merged = Array.isArray(local) ? [...(local as unknown[])] : [];
-  const keyOf = (item: unknown): string | undefined => keyOfElement(arrayPath, item);
-
-  for (const name of new Set(wanted)) {
-    const incoming = remote.find((item) => keyOf(item) === name);
-    if (incoming === undefined) continue;
-
-    const at = merged.findIndex((item) => keyOf(item) === name);
-    if (at >= 0) merged[at] = incoming;
-    else merged.push(incoming);
-  }
-
-  return merged;
-}
-
-/** Read a path out of the raw document, for handing to `setIn`. */
-function valueAt(config: unknown, path: readonly string[]): unknown {
-  let value: unknown = config;
-  for (const step of path) {
-    if (!(typeof value === 'object' && value !== null)) return undefined;
-    value = (value as Record<string, unknown>)[step];
-  }
-  return value;
-}
-
-/**
- * Send the local profile up, once it holds everything both sides had.
- *
- * Wholesale rather than key by key, and only *after* the pulls have been
- * applied: at that point the local file is the union, so copying it up makes
- * the remote one the union too. The remote copy has no comments of its own to
- * lose — `uploadWorkspace` wrote it — so there is nothing finer-grained to
- * preserve, and one PUT cannot half-apply a merge.
- */
-export async function applyPushes(
-  localRoot: string,
-  remoteRoot: string,
-  profile: string,
-  changes: readonly Change[],
-): Promise<boolean> {
-  if (!changes.some((change) => change.direction === 'push')) return false;
-
-  const text = await readWorkspaceFile(workspaceFiles(localRoot), profileKey(profile));
-  if (text === null) return false;
-
-  await writeWorkspaceFile(workspaceFiles(remoteRoot), profileKey(profile), text);
-  return true;
-}
-
-/**
- * The authored areas inside `data/` — skills and provider manifests.
- *
- * They ride the same allowlist a deploy uploads by, and for the reason that
- * comment gives at length: the list is what keeps a credential store out of a
- * bucket, and a second answer to "which files" is how the two drift. Compared
- * by content, since they are documents rather than config, and differing
- * content is a conflict like any other.
- */
-export interface BlobSync {
-  readonly key: string;
-  readonly direction: 'pull' | 'push' | 'conflict';
-}
-
-export async function planBlobs(localRoot: string, remoteRoot: string): Promise<BlobSync[]> {
-  const read = async (root: string): Promise<Map<string, Uint8Array>> => {
-    const files = workspaceFiles(root);
-    const found = new Map<string, Uint8Array>();
-
-    for (const entry of await files.list('')) {
-      // `undefined` profile: every profile's authored areas, since sync is
-      // scoped to the target and not to one of them.
-      if (!isWorkspaceConfig(entry.key) || entry.key.endsWith('.yaml')) continue;
-      const bytes = await files.get(entry.key);
-      if (bytes !== null) found.set(entry.key, bytes);
-    }
-    return found;
-  };
-
-  const here = await read(localRoot);
-  const there = await read(remoteRoot);
-  const equal = (a: Uint8Array, b: Uint8Array): boolean =>
-    a.length === b.length && a.every((byte, index) => byte === b[index]);
-
-  return [...new Set([...here.keys(), ...there.keys()])].sort().flatMap((key): BlobSync[] => {
-    const local = here.get(key);
-    const remote = there.get(key);
-    if (local === undefined) return [{ key, direction: 'pull' }];
-    if (remote === undefined) return [{ key, direction: 'push' }];
-    return equal(local, remote) ? [] : [{ key, direction: 'conflict' }];
-  });
-}
-
-export async function applyBlobs(
-  localRoot: string,
-  remoteRoot: string,
-  blobs: readonly BlobSync[],
-): Promise<number> {
-  let copied = 0;
-
-  for (const blob of blobs) {
-    const from = blob.direction === 'pull' ? remoteRoot : localRoot;
-    const to = blob.direction === 'pull' ? localRoot : remoteRoot;
-
-    const bytes = await workspaceFiles(from).get(blob.key);
-    if (bytes === null) continue;
-
-    await workspaceFiles(to).put(blob.key, bytes, { contentType: 'application/octet-stream' });
-    copied += 1;
-  }
-
-  return copied;
-}