@lanes-sh/link 0.6.8 → 0.6.10

package/src/connectivity/auth/oauth-authcode/refresh.ts

@@ -1,6 +1,7 @@
 import type { ProviderManifest } from '#connectivity';
 import type { SecretStore } from '#secrets';
 import { BROKERED, BrokerError, brokerRefresh } from './broker.ts';
+import { ReauthRequired, statusMeansGrantIsDead } from '../reauth.ts';
 import type { CredentialOAuthProvider } from './provider.ts';
 
 /** What a stored OAuth credential carries beyond the tokens themselves. */
@@ -23,7 +24,10 @@ export async function refreshDirectly(
   const refreshToken = existing?.refresh_token;
 
   if (!refreshToken) {
-    throw new Error(
+    // Nothing to renew with, so this can only be settled by signing in again —
+    // the same remedy as a dead grant, and reported as the same thing.
+    throw new ReauthRequired(
+      `${manifest.id}.${provider.connectionId}`,
       `No refresh token stored for ${manifest.id}. Connecting it again for this profile and target would store one.`,
     );
   }
@@ -38,9 +42,19 @@ export async function refreshDirectly(
   const broker = auth?.broker;
   const brokered = broker !== undefined && existing?.authorized_via === BROKERED;
 
+  const connectionKey = `${manifest.id}.${provider.connectionId}`;
+
   const refreshed = brokered
-    ? await viaBroker(manifest, broker.url, refreshToken, existing, fetchImpl)
-    : await viaStoredClient(manifest, auth?.app, tokenUrl, refreshToken, credentials, fetchImpl);
+    ? await viaBroker(manifest, connectionKey, broker.url, refreshToken, existing, fetchImpl)
+    : await viaStoredClient(
+        manifest,
+        connectionKey,
+        auth?.app,
+        tokenUrl,
+        refreshToken,
+        credentials,
+        fetchImpl,
+      );
 
   // `existing` first, so what the response does not mention survives it. Neither
   // the vendor nor the broker echoes `refresh_token`, `id_token`, or
@@ -53,6 +67,7 @@ export async function refreshDirectly(
 
 async function viaBroker(
   manifest: ProviderManifest,
+  connectionKey: string,
   url: string,
   refreshToken: string,
   existing: StoredTokens,
@@ -70,17 +85,27 @@ async function viaBroker(
     // next step. Same shape as the stored-client message below, deliberately:
     // where the credential came from is not the reader's problem here.
     const notice = cause instanceof BrokerError && cause.notice ? `\n${cause.notice}` : '';
-    throw new Error(
+    const message =
       `The credential for ${manifest.id} could not be refreshed. ` +
-        `Re-authorise ${manifest.id} for this profile and target.\n${String(
-          cause instanceof Error ? cause.message : cause,
-        ).slice(0, 200)}${notice}`,
-    );
+      `Re-authorise ${manifest.id} for this profile and target.\n${String(
+        cause instanceof Error ? cause.message : cause,
+      ).slice(0, 200)}${notice}`;
+
+    // Only the broker refusing *this* credential means a person is needed. A
+    // broker that is down, or rate-limiting, says nothing about the grant, and
+    // reporting it as "sign in again" would send someone through a consent
+    // screen to fix an outage. A `cause` that is not a `BrokerError` never
+    // reached the broker at all, so it is the same case.
+    if (cause instanceof BrokerError && statusMeansGrantIsDead(cause.status)) {
+      throw new ReauthRequired(connectionKey, message);
+    }
+    throw new Error(message);
   }
 }
 
 async function viaStoredClient(
   manifest: ProviderManifest,
+  connectionKey: string,
   app: string | undefined,
   tokenUrl: string,
   refreshToken: string,
@@ -108,10 +133,17 @@ async function viaStoredClient(
   if (!response.ok) {
     // A revoked or expired refresh token is the common case here, and the fix
     // is always the same, so say it rather than surfacing the raw grant error.
-    throw new Error(
+    const message =
       `The credential for ${manifest.id} could not be refreshed (${response.status}). ` +
-        `Re-authorise ${manifest.id} for this profile and target.\n${text.slice(0, 200)}`,
-    );
+      `Re-authorise ${manifest.id} for this profile and target.\n${text.slice(0, 200)}`;
+
+    // 4xx is the authorization server rejecting this credential; 5xx is it
+    // being unwell. Only the first is something a person can fix, and only the
+    // first may be reported as such.
+    if (statusMeansGrantIsDead(response.status)) {
+      throw new ReauthRequired(connectionKey, message);
+    }
+    throw new Error(message);
   }
 
   return JSON.parse(text) as Record<string, unknown>;

package/src/connectivity/auth/oauth-jwt/index.ts

@@ -1,4 +1,5 @@
 import type { ProviderManifest } from '#connectivity';
+import { ReauthRequired, statusMeansGrantIsDead } from '../reauth.ts';
 import type { SecretStore } from '#secrets';
 import { credentialRefForConnection } from '../../manifest/credential-ref.ts';
 import { parseAssertionKey, signAssertion } from './key.ts';
@@ -170,7 +171,17 @@ export async function resolveAssertionToken(input: {
   const body = (await response.json().catch(() => ({}))) as TokenResponse;
 
   if (!response.ok || !body.access_token) {
-    throw new Error(refusalMessage(manifest, stored, body, response.status));
+    const message = refusalMessage(manifest, stored, body, response.status);
+
+    // A key is refused for the same two reasons a refresh token is: the grant
+    // behind it is gone, or the token endpoint is unwell. The remedy differs
+    // from a consent screen — it is an admin grant in a console, or `connect
+    // --replace` — but "the owner has to re-authorise this connection" is the
+    // same claim, and `refusalMessage` already writes the specific sentence.
+    if (statusMeansGrantIsDead(response.status)) {
+      throw new ReauthRequired(`${manifest.id}.${connectionId}`, message);
+    }
+    throw new Error(message);
   }
 
   minted.set(cacheKey, {

package/src/connectivity/auth/reauth.ts

@@ -0,0 +1,48 @@
+/**
+ * The one failure a person has to fix, told apart from every other one.
+ *
+ * A stored credential stops working for two very different reasons, and until
+ * this existed they arrived as the same `Error`:
+ *
+ *   - the grant is gone — revoked, or expired because the client's publishing
+ *     status expires refresh tokens on a timer. Nothing retries its way out of
+ *     this; somebody has to sign in again.
+ *   - the token endpoint had a bad afternoon — a 502, a reset connection, DNS.
+ *     Retrying is exactly right, and telling the owner to re-authorise would be
+ *     a lie that costs them a consent screen.
+ *
+ * Both used to read as "could not be refreshed", so anything trying to *report*
+ * connection health had to match on the message text. That is why this is a
+ * class and not a string: `auth.ts` classifies on `instanceof`, and the messages
+ * stay free to be rewritten for whoever is reading them.
+ *
+ * The message is deliberately unchanged from what each throw site said before —
+ * this is a widening, not a rewrite. What is new is that the type now carries
+ * *which* connection, so a caller holding several can say which one to fix
+ * without parsing the sentence.
+ */
+export class ReauthRequired extends Error {
+  /** `provider.id`, e.g. `gmail.main`. The addressing form used everywhere. */
+  readonly connectionKey: string;
+
+  constructor(connectionKey: string, message: string) {
+    super(message);
+    this.name = 'ReauthRequired';
+    this.connectionKey = connectionKey;
+  }
+}
+
+/**
+ * Whether an HTTP status from a token endpoint means the grant itself is dead.
+ *
+ * 4xx is the authorization server saying no to *this credential* — `invalid_grant`
+ * for a revoked or expired refresh token, `invalid_client` for a client that no
+ * longer exists. Signing in again is the fix.
+ *
+ * 5xx is the server saying no to *everyone*, and 429 is it saying "not now".
+ * Neither is a statement about the credential, so neither may be reported as
+ * needing a human. 429 sits in the 4xx range and is excluded for that reason.
+ */
+export function statusMeansGrantIsDead(status: number): boolean {
+  return status >= 400 && status < 500 && status !== 429;
+}

package/src/deployments/gcp/Dockerfile

@@ -11,7 +11,21 @@
 # There is no build step: Bun runs TypeScript directly, so the image holds
 # source, and `bun install` only fetches the third-party dependencies.
 
-FROM oven/bun:1.3.11-slim
+# Pinned by digest, with the tag kept beside it so the next bump is legible.
+#
+# A tag is a pointer its publisher can move. `1.3.11-slim` is not a promise about
+# bytes — it resolves to whatever was last pushed under that name — so a rebuild
+# months from now can ship a base image nobody here reviewed, in a container that
+# holds live OAuth refresh tokens. The digest is the bytes.
+#
+# `bunfig.toml` already makes this argument about npm packages, with a seven-day
+# release-age floor; the base image is the larger half of the same supply chain
+# and had nothing.
+#
+# To bump: change the tag, then resolve it —
+#   docker buildx imagetools inspect oven/bun:<tag> --format '{{.Manifest.Digest}}'
+# The digest below is the multi-arch index, so it still resolves per architecture.
+FROM oven/bun:1.3.11-slim@sha256:478281fdd196871c7e51ba6a820b7803a8ae97042ec86cdbc2e1c6b6626442d9
 
 WORKDIR /app
 
@@ -42,7 +56,18 @@ COPY package.json bunfig.toml bun.lock* ./
 # in `package.json` is an exact version, so the direct set is identical either
 # way; the lockfile pins what those depend on in turn, and a published package
 # has never been able to carry one.
-RUN if [ -f bun.lock ]; then bun install --frozen-lockfile; else bun install; fi
+#
+# The fallback says so out loud. An unfrozen resolve is a real difference in what
+# ships and it used to be silent — the build log looked identical either way, so
+# "which transitive versions did this image get" was answerable only by opening
+# the image. One line makes it answerable from the build.
+RUN if [ -f bun.lock ]; then \
+      bun install --frozen-lockfile; \
+    else \
+      echo "no bun.lock in the build context: resolving transitive dependencies fresh." >&2; \
+      echo "Direct dependencies are exact in package.json, so the direct set is unchanged." >&2; \
+      bun install; \
+    fi
 
 COPY src/ src/
 

package/src/deployments/gcp/bucket.ts

@@ -1,4 +1,5 @@
-import { layout } from '#profile';
+import { join } from 'node:path';
+import { installRoot, layout } from '#profile';
 import type { DeployStep } from '../driver.ts';
 import {
   removalStep,
@@ -103,6 +104,68 @@ export function bucketGrants(bucket: string, profiles: readonly string[]): Condi
   ];
 }
 
+/**
+ * How long a deleted or overwritten object can still be recovered.
+ *
+ * The revision holds `objectAdmin` on everything under `data/`, and
+ * `objectAdmin` contains `storage.objects.delete`. That grant is correct — the
+ * endpoint writes state, memory, tasks, assets and the audit log, and rewriting
+ * an object is deleting the old one — but it means the process most exposed to
+ * the internet is also the one that can erase the record of what it did.
+ * `audit.tamper-evident` already says deleting a run whole is not *detectable*;
+ * without this it was not *recoverable* either.
+ *
+ * Thirty days rather than the platform's default seven, because the gap this
+ * closes is noticing late. A compromise found the same afternoon needs no
+ * retention policy at all.
+ */
+const SOFT_DELETE_DURATION = '30d';
+
+/**
+ * The three protections a deploy applies to the bucket every time it runs.
+ *
+ * `update` rather than flags on `create`, so they reach a bucket that already
+ * exists — see the call site. Idempotent: setting a policy to what it already is
+ * is a no-op that costs one API call.
+ *
+ * - **Public access prevention**, enforced. Nothing in this bucket is served to
+ *   a browser and nothing in it should ever be anonymous-readable, so the useful
+ *   setting is the one that makes granting that impossible rather than merely
+ *   absent. Uniform bucket-level access already removes per-object ACLs; this
+ *   removes the bucket-level way to do the same thing.
+ * - **Soft delete**, so a deletion is recoverable — see above.
+ * - **Object versioning**, with the lifecycle rule that bounds it. Versioning
+ *   covers what soft delete does not: an object *overwritten* in place, where
+ *   the previous content is the thing worth keeping. The rule is a file shipped
+ *   beside this one rather than written at plan time, because `--dry-run` writes
+ *   nothing and prints what it would run — a temporary file would break both.
+ */
+function durabilitySteps(bucket: string): DeployStep[] {
+  const lifecycle = join(installRoot(import.meta.dir), 'src/deployments/gcp/lifecycle.json');
+
+  return [
+    {
+      title: 'make the bucket unable to be shared publicly, and its deletions recoverable',
+      argv: [
+        'storage',
+        'buckets',
+        'update',
+        `gs://${bucket}`,
+        '--public-access-prevention',
+        '--soft-delete-duration',
+        SOFT_DELETE_DURATION,
+        '--versioning',
+        // Without this, versioning keeps every prior copy of every state key
+        // forever, and state is the one thing here that is rewritten rather than
+        // appended. The rule bounds it by age and by count.
+        '--lifecycle-file',
+        lifecycle,
+      ],
+      tolerateFailure: true,
+    },
+  ];
+}
+
 const TITLES: Record<string, string> = {
   'owns-its-data': 'let the revision write its own data, but not the manifests in it',
   'reads-its-config': 'let the revision read its config, and only read it',
@@ -133,20 +196,30 @@ export async function bucketSteps(input: {
         // served publicly; uniform access removes per-object ACLs as a way to
         // get that wrong.
         '--uniform-bucket-level-access',
-        // Autoclass rather than a lifecycle rule, because no one fixed class is
-        // right for this bucket: it holds the config the endpoint reads on every
-        // boot next to assets and audit rows nobody opens again. Inside an
-        // Autoclass bucket there are no retrieval and no early-deletion fees,
-        // which is what makes ARCHIVE safe as the floor rather than a bet on
-        // never reading the thing again — a read pulls the object back to
-        // Standard at no charge. Objects under 128 KiB never leave Standard, so
-        // this costs the config and the log nothing and saves on attachments.
+        // Autoclass rather than a storage-class lifecycle rule, because no one
+        // fixed class is right for this bucket: it holds the config the endpoint
+        // reads on every boot next to assets and audit rows nobody opens again.
+        // Inside an Autoclass bucket there are no retrieval and no
+        // early-deletion fees, which is what makes ARCHIVE safe as the floor
+        // rather than a bet on never reading the thing again — a read pulls the
+        // object back to Standard at no charge. Objects under 128 KiB never
+        // leave Standard, so this costs the config and the log nothing and saves
+        // on attachments.
         '--enable-autoclass',
         '--autoclass-terminal-storage-class',
         'ARCHIVE',
       ],
       tolerateFailure: true,
     },
+    // Everything about durability, applied separately from the create.
+    //
+    // **Not folded into the flags above, and that is the whole point.** Every
+    // step here tolerates failure, so the create is refused as `ALREADY_EXISTS`
+    // on the second deploy onwards — which means a protection added to that
+    // argv reaches a bucket made after this commit and no other. Every
+    // deployment that already exists is exactly the one that has an audit log
+    // worth keeping.
+    ...durabilitySteps(input.bucket),
   ];
 
   if (!input.serviceAccount) return steps;

package/src/deployments/gcp/driver.ts

@@ -126,12 +126,43 @@ export function deployPlan(input: PlanInput): DeployStep[] {
         // harness can mint one — so a target reached by a remote MCP client
         // declares `public` and gates the request in the application instead.
         cloudrun.access === 'iam' ? '--no-allow-unauthenticated' : '--allow-unauthenticated',
-        // Always passed, including the zero. Config is the source of truth here
-        // (ADR-004), and a flag sent only when non-zero would let a value be
-        // raised and never lowered — the revision would keep whatever the last
-        // deploy that bothered to mention it had set.
+        // What the platform will accept a connection from at all, which is a
+        // different question from who it lets through. An `iam` target is by
+        // definition not reached by an MCP client — no agent harness can mint the
+        // identity token Cloud Run wants — so it is reached by other cloud
+        // workloads or by nothing, and neither needs an internet-facing listener.
+        // `public` is the case where the listener *is* the point.
+        '--ingress',
+        cloudrun.access === 'iam' ? 'internal-and-cloud-load-balancing' : 'all',
+        // Always passed, including the zero and including every default below
+        // it. Config is the source of truth here (ADR-004), and a flag sent only
+        // when non-zero would let a value be raised and never lowered — the
+        // revision would keep whatever the last deploy that bothered to mention
+        // it had set.
         '--min-instances',
         String(cloudrun.min_instances),
+        // The five that used to be absent, and absent meant the platform's own
+        // defaults: a hundred instances, eighty concurrent requests each, and
+        // 512 MiB to serve a 64 MiB upload in. Each one is argued at its field in
+        // `deployTargetSchema`; what they have in common is that a public URL
+        // with no ceiling on any of them is an endpoint whose cost and whose
+        // credential-store traffic are decided by whoever is calling it.
+        '--max-instances',
+        String(cloudrun.max_instances),
+        '--concurrency',
+        String(cloudrun.concurrency),
+        '--timeout',
+        String(cloudrun.timeout_seconds),
+        '--memory',
+        cloudrun.memory,
+        '--cpu',
+        cloudrun.cpu,
+        // Named rather than inherited, like the five above. gen2 is the current
+        // default and the one this image is tested on; pinning it means a
+        // platform migration is a commit here rather than a change under a
+        // running endpoint.
+        '--execution-environment',
+        'gen2',
       ],
     },
   ];
@@ -151,7 +182,14 @@ export function deployPlan(input: PlanInput): DeployStep[] {
  */
 function secretMounts(secretEnv: PlanInput['secretEnv']): string[] {
   const entries = Object.entries(secretEnv ?? {});
-  if (entries.length === 0) return [];
+
+  // `--clear-secrets`, not nothing. `gcloud run deploy` leaves a setting it is
+  // not told about exactly as the last revision had it, so an empty map used to
+  // mean "keep whatever is mounted" rather than "mount nothing" — and removing a
+  // vault from config left its secret still resolved into the new revision's
+  // environment, indefinitely, with nothing in the config saying so. The same
+  // argument `--min-instances` makes about always passing the zero.
+  if (entries.length === 0) return ['--clear-secrets'];
 
   return [
     '--set-secrets',

package/src/deployments/gcp/lifecycle.json

@@ -0,0 +1,12 @@
+{
+  "rule": [
+    {
+      "action": { "type": "Delete" },
+      "condition": { "daysSinceNoncurrentTime": 30 }
+    },
+    {
+      "action": { "type": "Delete" },
+      "condition": { "numNewerVersions": 10 }
+    }
+  ]
+}

package/src/deployments/gcp/survey.ts

@@ -1,4 +1,4 @@
-import { ConfigError, type DeployConfig, type TargetConfig } from '#profile';
+import { ConfigError, DEPLOY_DEFAULTS, type DeployConfig, type TargetConfig } from '#profile';
 import { heading, print, style, waiting } from '#cli/output.ts';
 import { ask, confirm } from '#cli/prompt.ts';
 import type { SurveyInput, SurveyResult } from '../driver.ts';
@@ -130,6 +130,17 @@ export async function surveyCloudRun(input: SurveyInput): Promise<SurveyResult>
     // Not asked about. Zero is right for almost every target and the question
     // would cost every operator a decision to buy one of them a knob.
     min_instances: current.min_instances ?? 0,
+    // Not asked about either, and for a stronger version of the same reason: a
+    // ceiling is only interesting to somebody who has already hit it, and the
+    // defaults are the ones a single-user endpoint wants. Carried through from
+    // what the target already says so that an operator who *has* edited them
+    // keeps their edit — pressing return through the survey changes nothing,
+    // which is the property every other field here has too.
+    max_instances: current.max_instances ?? DEPLOY_DEFAULTS.max_instances,
+    concurrency: current.concurrency ?? DEPLOY_DEFAULTS.concurrency,
+    timeout_seconds: current.timeout_seconds ?? DEPLOY_DEFAULTS.timeout_seconds,
+    memory: current.memory ?? DEPLOY_DEFAULTS.memory,
+    cpu: current.cpu ?? DEPLOY_DEFAULTS.cpu,
     project,
     region,
     service,

package/src/policy/limits.ts

@@ -27,6 +27,29 @@ interface Bucket {
   lastRefill: number;
 }
 
+/**
+ * How many keys one limiter will hold.
+ *
+ * The bound exists because a key is not always something the endpoint chose. At
+ * the HTTP edge a caller is identified by the first `X-Forwarded-For` hop, which
+ * on a public deployment is a header a stranger writes — so an unbounded map is
+ * an unbounded allocation driven from outside, in a container that now has an
+ * explicit memory limit to exceed.
+ *
+ * Ten thousand is far above any real caller count for a single-user endpoint and
+ * far below a problem: a bucket is two numbers and a string key.
+ */
+const DEFAULT_MAX_KEYS = 10_000;
+
+/**
+ * How many go at once when the cap is reached.
+ *
+ * A batch rather than one, so the sort that finds them is amortised. Evicting a
+ * single key per overflow would run an O(n log n) pass on every request once the
+ * map is full, which turns the bound into its own denial of service.
+ */
+const EVICTION_FRACTION = 10;
+
 /**
  * Token bucket, refilled continuously rather than on a fixed window boundary.
  *
@@ -37,9 +60,16 @@ interface Bucket {
 export class RateLimiter {
   readonly #buckets = new Map<string, Bucket>();
   readonly #now: () => number;
+  readonly #maxKeys: number;
 
-  constructor(now: () => number = Date.now) {
+  constructor(now: () => number = Date.now, maxKeys: number = DEFAULT_MAX_KEYS) {
     this.#now = now;
+    this.#maxKeys = maxKeys;
+  }
+
+  /** How many callers are currently held. For tests, and for nothing else. */
+  get size(): number {
+    return this.#buckets.size;
   }
 
   /**
@@ -52,7 +82,13 @@ export class RateLimiter {
 
     const now = this.#now();
     const refillPerMs = perMinute / 60_000;
-    const bucket = this.#buckets.get(key) ?? { tokens: perMinute, lastRefill: now };
+    const existing = this.#buckets.get(key);
+
+    // Before the insert, not after: the cap is on what this map holds, and
+    // checking afterwards means it is briefly one over on every overflow.
+    if (!existing) this.#makeRoom();
+
+    const bucket = existing ?? { tokens: perMinute, lastRefill: now };
 
     bucket.tokens = Math.min(perMinute, bucket.tokens + (now - bucket.lastRefill) * refillPerMs);
     bucket.lastRefill = now;
@@ -67,11 +103,48 @@ export class RateLimiter {
     return { allowed: true, retryAfterMs: 0 };
   }
 
-  /** Drop idle buckets so a long-lived process does not accumulate keys forever. */
+  /**
+   * Drop idle buckets so a long-lived process does not accumulate keys forever.
+   *
+   * Public because it reads as the obvious lever, and because the tests drive it
+   * directly. It is **not** what bounds the map, and nothing's correctness may
+   * depend on a caller remembering it: for most of this file's life nothing did
+   * call it, `edge.ts` claimed idle callers were dropped, and the map grew for
+   * as long as the process lived. `#makeRoom` is the bound now, and it runs on
+   * the insert path where it cannot be forgotten.
+   */
   prune(idleMs = 300_000): void {
     const cutoff = this.#now() - idleMs;
     for (const [key, bucket] of this.#buckets) {
       if (bucket.lastRefill < cutoff) this.#buckets.delete(key);
     }
   }
+
+  /**
+   * Make space for one more key, if the map is full.
+   *
+   * Idle callers first, because dropping one costs nothing — a bucket that has
+   * not been touched in five minutes has refilled to full, so re-creating it
+   * gives back exactly what was discarded.
+   *
+   * Only when that is not enough does this evict a live caller, oldest first by
+   * last use. That *does* forgive whatever the evicted caller had spent, which
+   * is the honest cost of a bounded map: an attacker who can mint ten thousand
+   * distinct keys can push their own bucket out and start again. What they
+   * cannot do is grow the map, and on the paths this limiter guards there is a
+   * second bucket keyed on nothing at all — see `edge.ts` — which is the one
+   * that holds when the per-caller key is worthless.
+   */
+  #makeRoom(): void {
+    if (this.#buckets.size < this.#maxKeys) return;
+
+    this.prune();
+    if (this.#buckets.size < this.#maxKeys) return;
+
+    const oldest = [...this.#buckets.entries()]
+      .sort((a, b) => a[1].lastRefill - b[1].lastRefill)
+      .slice(0, Math.max(1, Math.ceil(this.#maxKeys / EVICTION_FRACTION)));
+
+    for (const [key] of oldest) this.#buckets.delete(key);
+  }
 }

package/src/profile/index.ts

@@ -12,6 +12,7 @@
  */
 
 export {
+  DEPLOY_DEFAULTS,
   SUPPORTED_CONTRACT,
   configSchema,
   declaredTarget,

package/src/profile/legacy.ts

@@ -2,6 +2,7 @@ import { z } from 'zod';
 import {
   auditTargetSchema,
   credentialsTargetSchema,
+  DEPLOY_DEFAULTS,
   deployTargetSchema,
   storageTargetSchema,
   vaultTargetSchema,
@@ -54,14 +55,18 @@ export const legacyTargetSchema = z
       ? target
       : {
           ...target,
-          // The pre-`deploy` spelling predates both of these, so it gets the
-          // same defaults the current one would: the closed door, and no
-          // instance kept warm.
+          // The pre-`deploy` spelling predates all of these, so it gets the
+          // same defaults the current one would: the closed door, no instance
+          // kept warm, and the ceilings a public URL is deployed under. Built by
+          // hand here rather than parsed, so `DEPLOY_DEFAULTS` is spread rather
+          // than left to zod — a block that reaches `deployPlan` without them
+          // sends `undefined` to `gcloud` as the string "undefined".
           deploy: {
             ...cloudrun,
             platform: 'cloudrun' as const,
             access: 'iam' as const,
             min_instances: 0,
+            ...DEPLOY_DEFAULTS,
           },
         },
   );

package/src/profile/schema.ts

@@ -158,6 +158,25 @@ export const vaultTargetSchema = z.object({
  * discriminated union per platform — buys precision this file cannot use and
  * costs a schema edit on every field any host ever adds.
  */
+/**
+ * The ceilings a deployed revision runs under, in one place.
+ *
+ * A named constant rather than five literals inside `z.default()` because two
+ * callers need the same numbers and neither can read a zod default out of a
+ * schema: the survey writes a target's block field by field, and the deploy plan
+ * sends every one of them on every rollout. Two spellings of a ceiling is a
+ * ceiling that is one value in a fresh profile and another in a surveyed one.
+ *
+ * Each is argued at its own field below.
+ */
+export const DEPLOY_DEFAULTS = {
+  max_instances: 4,
+  concurrency: 40,
+  timeout_seconds: 300,
+  memory: '1Gi',
+  cpu: '1',
+} as const;
+
 export const deployTargetSchema = z.object({
   platform: z.enum(['cloudrun']),
   // Non-empty here rather than in a referential check further down. Under
@@ -210,6 +229,52 @@ export const deployTargetSchema = z.object({
    * Raise it if a re-authorization ever lines up with a cold `/token`.
    */
   min_instances: z.number().int().min(0).max(10).default(0),
+  /**
+   * The ceiling on instances, and the only thing bounding what a public URL can
+   * spend.
+   *
+   * Four, not the platform's hundred. `access: public` is a routable address on
+   * the internet, and every instance that starts reads the credential store and
+   * lists the bucket — so scaling out multiplies cost *and* traffic against the
+   * two things this endpoint most wants kept quiet. A single-user endpoint that
+   * genuinely needs a fifth concurrent instance has an agent in a loop, which is
+   * the case the ceiling is for.
+   *
+   * It is also what makes `limits.requests_per_minute` mean something in
+   * aggregate. Those limits are per instance and always were; with no ceiling
+   * the aggregate had no value at all, and `docs/detailed/deployment-cloudrun.md`
+   * told the reader to cap this themselves because nothing here did.
+   */
+  max_instances: z.number().int().min(1).max(100).default(DEPLOY_DEFAULTS.max_instances),
+  /**
+   * Requests one instance serves at once.
+   *
+   * Forty rather than the platform's eighty, paired with `memory` below: an
+   * attachment upload is capped at 64 MiB and is buffered before it is written,
+   * so what bounds this is memory per instance rather than CPU.
+   */
+  concurrency: z.number().int().min(1).max(1000).default(DEPLOY_DEFAULTS.concurrency),
+  /**
+   * How long one request may run before the platform cuts it.
+   *
+   * The platform's own default, stated rather than inherited — the point is that
+   * it is written down and always sent, so a platform changing its default is
+   * not a silent change to what this serves.
+   */
+  timeout_seconds: z.number().int().min(1).max(3600).default(DEPLOY_DEFAULTS.timeout_seconds),
+  /**
+   * Memory per instance.
+   *
+   * A gigabyte because 512 MiB is not enough for what the endpoint already
+   * accepts: `MAX_UPLOAD_BYTES` is 64 MiB, and staging one costs roughly twice
+   * that at peak — the chunks as they arrive, and the single buffer they are
+   * copied into. At the platform default that is one upload away from an
+   * out-of-memory kill, and an OOM is a 503 for every request the instance was
+   * also serving.
+   */
+  memory: z.string().min(1).default(DEPLOY_DEFAULTS.memory),
+  /** CPU per instance. Explicit for the same reason `timeout_seconds` is. */
+  cpu: z.string().min(1).default(DEPLOY_DEFAULTS.cpu),
 });
 
 /**