@lanes-sh/link 0.6.3 → 0.6.5

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lanes-sh/link",
-  "version": "0.6.3",
+  "version": "0.6.5",
   "description": "A self-hostable MCP gateway for all your connections, memory, tasks, files, and secrets",
   "license": "Apache-2.0",
   "homepage": "https://lanes.sh/link",
@@ -43,7 +43,6 @@
     "instructions",
     "README.md",
     "LICENSE",
-    "bun.lock",
     "bunfig.toml",
     ".dockerignore"
   ],

package/src/deployments/deploy.ts

@@ -157,6 +157,7 @@ export async function deploy(flags: DeployFlags): Promise<void> {
     target,
     rotatable,
     readable,
+    profiles: serving,
   });
 
   // Where the running instance will read its config. The bucket the target

package/src/deployments/driver.ts

@@ -92,6 +92,20 @@ export interface ProvisionInput {
    * what a target with no profile to walk still needs.
    */
   readonly readable?: readonly string[];
+  /**
+   * The profiles this revision serves, so the bucket conditions can name each
+   * one's provider manifests.
+   *
+   * Needed because Cloud Storage IAM conditions cannot express "any profile
+   * segment": their CEL is a restricted subset with no `matches`, so the only
+   * way to carve out `data/<profile>/providers.d/` is to enumerate the profiles
+   * and write one `startsWith` each. `deploy.ts` already resolved the list.
+   *
+   * Absent leaves the carve-out off entirely rather than guessing, which is the
+   * safe direction: the revision keeps write on its own data and the manifests
+   * inside it, exactly as it did before the carve-out existed.
+   */
+  readonly profiles?: readonly string[];
 }
 
 export interface SurveyInput {

package/src/deployments/gcp/Dockerfile

@@ -18,9 +18,31 @@ WORKDIR /app
 # The manifest first, so a source-only change reuses the install layer. One
 # package now, rather than fifteen manifests copied ahead of the install to
 # satisfy workspace resolution.
-COPY package.json bun.lock bunfig.toml ./
+#
+# `bun.lock*`, not `bun.lock`, and the star is the whole point: **npm strips a
+# root lockfile out of a published tarball whatever `files` says.** Verified
+# against npm 12, which is what `release.yml` installs before publishing; npm
+# 11.6 still packs it, so a local `npm pack` says the opposite and the gap only
+# shows up in what people actually install.
+#
+# This image is built from whichever tree `lanes link deploy` is run against, and
+# there are two of them. From a checkout the lockfile is present and pins the
+# whole transitive set. From a bun-global install — the only install method this
+# CLI documents — it cannot be there at all, and naming it outright made deploy
+# impossible for every one of those users: the build pulled the base image,
+# pushed a context, and then died on `stat bun.lock: file does not exist`.
+COPY package.json bunfig.toml bun.lock* ./
 
-RUN bun install --frozen-lockfile
+# Not `--frozen-lockfile || bun install`: that swallows a genuine
+# lockfile-versus-manifest disagreement in a checkout build, which is the one
+# thing the frozen flag is for. The branch says which tree it is building and
+# holds the guarantee that tree can offer.
+#
+# What the fallback gives up is narrower than it looks. Every runtime dependency
+# in `package.json` is an exact version, so the direct set is identical either
+# way; the lockfile pins what those depend on in turn, and a published package
+# has never been able to carry one.
+RUN if [ -f bun.lock ]; then bun install --frozen-lockfile; else bun install; fi
 
 COPY src/ src/
 

package/src/deployments/gcp/provision.ts

@@ -1,6 +1,7 @@
 import { VAULT_DOCUMENT_REF, type SecretRef } from '#secrets';
 import type { DeployStep, ProvisionInput } from '../driver.ts';
 import { encodeRef } from '../adapters/gcp-secret-manager.ts';
+import { layout } from '#profile';
 import { requireProject } from './gcloud.ts';
 
 /**
@@ -296,22 +297,34 @@ export function provisionSteps(input: ProvisionInput): Promise<DeployStep[]> {
         `resource.name == "projects/_/buckets/${bucket}/objects/${path}"`;
 
       // A provider manifest is configuration that happens to live inside the
-      // profile's directory (ADR-030), so `data/` alone no longer separates
-      // what the revision owns from what declares what it is. Anchored to the
-      // profile segment rather than matched loosely: `contains("/providers.d/")`
-      // would also catch a blob whose own key happened to spell it.
+      // profile's directory (ADR-030), so `data/` alone no longer separates what
+      // the revision owns from what declares what it is.
       //
-      // The dot is a character class, not `\.`, and that is the fix rather than
-      // a style: this string is a *CEL string literal* holding a regex, so it is
-      // unescaped once by CEL before the regex engine ever sees it. `\.` is not
-      // a CEL escape sequence, so the whole expression failed to compile —
-      // `token recognition error at: '"^projects/_/buckets/...providers\.'` —
-      // and both bindings below carry `tolerateFailure`, so a deploy printed two
-      // warnings and carried on with the scoping silently not applied. `[.]` is
-      // the same regex and survives a layer of string unescaping unchanged,
-      // which is what keeps the next person from reintroducing it.
+      // **One `startsWith` per profile, because Cloud Storage IAM conditions
+      // cannot express anything else.** Their CEL is a restricted subset —
+      // `resource.type`, `resource.name` with `startsWith`/`endsWith`/`==`, and
+      // the date functions — and it has no `matches`. This was a regex, and it
+      // was refused twice over: first because it spelled the dot `\.`, which is
+      // not a CEL escape, so the string literal would not parse; then, with that
+      // fixed, because `matches` is `undeclared` in this dialect.
+      //
+      // Both bindings carry `tolerateFailure`, so each attempt printed a warning
+      // and left whatever conditions the bucket already had. On a real
+      // deployment that was `expression=true` on the read binding — every object
+      // in the bucket, the exact opposite of the narrowing the step title claims,
+      // and the state ADR-007 says must not exist.
+      //
+      // Enumerating the served profiles is expressible in the subset that does
+      // exist, and it makes `grants.test.ts` honest as a side effect: that file
+      // evaluates these as JavaScript, where `startsWith` means what it means
+      // here and `matches` quietly did not.
+      const manifestPrefixes = (input.profiles ?? []).map((profile) =>
+        objectsUnder(`${layout.providers(profile)}/`),
+      );
+      // No profiles leaves the carve-out off rather than guessing at one: the
+      // revision keeps write on its own data, as it did before this existed.
       const providerManifests =
-        `resource.name.matches("^projects/_/buckets/${bucket}/objects/data/[^/]+/providers[.]d/")`;
+        manifestPrefixes.length > 0 ? `(${manifestPrefixes.join(' || ')})` : null;
 
       steps.push({
         title: 'let the revision write its own data, but not the manifests in it',
@@ -327,7 +340,7 @@ export function provisionSteps(input: ProvisionInput): Promise<DeployStep[]> {
           '--role',
           'roles/storage.objectAdmin',
           '--condition',
-          `title=owns-its-data,expression=${objectsUnder('data/')} && !${providerManifests}`,
+          `title=owns-its-data,expression=${objectsUnder('data/')}${providerManifests ? ` && !${providerManifests}` : ''}`,
         ],
         tolerateFailure: true,
       });
@@ -348,7 +361,7 @@ export function provisionSteps(input: ProvisionInput): Promise<DeployStep[]> {
           // The config the revision reads is the workspace file, the profiles
           // beside it, and each profile's own manifests, so name exactly those.
           '--condition',
-          `title=reads-its-config,expression=${objectsUnder('profiles/')} || ${objectIs('lanes-link.yaml')} || ${providerManifests}`,
+          `title=reads-its-config,expression=${objectsUnder('profiles/')} || ${objectIs('lanes-link.yaml')}${providerManifests ? ` || ${providerManifests}` : ''}`,
         ],
         tolerateFailure: true,
       });