@lanes-sh/link 0.7.1 → 0.8.0

package/src/cli/config-edit.ts

@@ -1,7 +1,14 @@
 import { rename, writeFile } from 'node:fs/promises';
 import { Document, parseDocument, type Node } from 'yaml';
 import {
+  CONNECTIONS_FILE,
   ConfigError,
+  WORKSPACE_FILE,
+  workspaceSchema,
+  assertConnectionsUnique,
+  connectionsFileSchema,
+  findSecrets,
+  formatSecretFindings,
   isRemoteWorkspace,
   readWorkspaceFile,
   validateConfig,
@@ -24,6 +31,53 @@ import {
  * refuses to run.
  */
 
+/**
+ * Validate a document against the schema for the file it is.
+ *
+ * The key is the discriminator because it is the only thing that is always
+ * right: a caller could be asked to say which shape it holds, and a caller that
+ * said the wrong one would get the wrong check silently.
+ */
+function validateDocument(
+  raw: unknown,
+  path: string,
+  key: string | undefined,
+  options: { shapeOnly?: boolean },
+): void {
+  if (key === WORKSPACE_FILE) {
+    const parsed = workspaceSchema.safeParse(raw);
+    if (!parsed.success) {
+      throw new ConfigError(
+        `${path}:\n${parsed.error.issues.map((issue) => `  ${issue.path.join('.')}: ${issue.message}`).join('\n')}`,
+      );
+    }
+    return;
+  }
+
+  if (key === CONNECTIONS_FILE) {
+    const secrets = findSecrets(raw);
+    if (secrets.length > 0) {
+      throw new ConfigError(
+        `${path}: ${formatSecretFindings(secrets)}`,
+        secrets.map((finding) => finding.path),
+      );
+    }
+
+    const parsed = connectionsFileSchema.safeParse(raw);
+    if (!parsed.success) {
+      throw new ConfigError(
+        `${path}:\n${parsed.error.issues.map((issue) => `  ${issue.path.join('.')}: ${issue.message}`).join('\n')}`,
+      );
+    }
+
+    assertConnectionsUnique(parsed.data.connections);
+    return;
+  }
+
+  if (options.shapeOnly === true) validateConfigShape(raw, path);
+  else validateConfig(raw, path);
+}
+
 export class ConfigDocument {
   readonly #document: Document;
   readonly #path: string;
@@ -47,7 +101,20 @@ export class ConfigDocument {
    * `gs://` URL produces something that addresses nothing.
    */
   static async open(workspaceRoot: string, profile: string): Promise<ConfigDocument> {
-    const key = `profiles/${profile}.yaml`;
+    return ConfigDocument.openKey(workspaceRoot, `profiles/${profile}.yaml`);
+  }
+
+  /**
+   * Open any document the workspace holds, by key.
+   *
+   * `open` above is this with the profile path spelled out, and stays because
+   * it is what almost every caller wants. This exists for `connections.yaml`,
+   * which is a workspace document rather than a profile's (ADR-057) and needs
+   * the same comment-preserving edit path — a connection row carries the
+   * account label an operator wrote, and rewriting the file through the schema
+   * would drop every comment beside it.
+   */
+  static async openKey(workspaceRoot: string, key: string): Promise<ConfigDocument> {
     const shown = isRemoteWorkspace(workspaceRoot)
       ? `${workspaceRoot}/${key}`
       : `${workspaceRoot}/${key}`;
@@ -200,8 +267,13 @@ export class ConfigDocument {
 
     // Throws on any validation failure, including a credential value that has
     // crept in — so a CLI edit can never introduce one.
-    if (options.shapeOnly === true) validateConfigShape(this.#document.toJSON(), this.#path);
-    else validateConfig(this.#document.toJSON(), this.#path);
+    //
+    // Which schema, decided by the key rather than by the caller. This class
+    // edits two shapes now: a profile, and the workspace's `connections.yaml`
+    // (ADR-057). Validating one against the other's schema is not a stricter
+    // check, it is the wrong one — a connections file has no `instance:` block,
+    // so it would be refused for a field it is not supposed to have.
+    validateDocument(this.#document.toJSON(), this.#path, this.#location?.key, options);
 
     if (!this.#location) {
       throw new ConfigError(`${this.#path}: opened from text, so there is nowhere to save it`);
@@ -234,140 +306,3 @@ export class ConfigDocument {
  * Written with comments, because this is the file an operator will read first
  * and most of what it needs to say is *why*, not *what*.
  */
-export function newProfileTemplate(profile: string, port: number): string {
-  return `# Lanes Link profile: ${profile}
-#
-# This file is the source of truth for what exists. It never contains a
-# credential value — only "_ref" pointers into the credential store, which
-# lives beside it and is encrypted at rest.
-#
-# Edit it by hand or through the CLI; both are supported, and CLI edits
-# preserve your comments and ordering.
-contract: 2
-
-instance:
-  profile: ${profile}
-  port: ${port}
-  host: 127.0.0.1
-
-# This file says nothing about where it runs, and that is the point.
-#
-# A profile lives in exactly one target, and the target is the workspace holding
-# this file — which declares its own adapters, once, in lanes-link.yaml beside
-# the profiles/ directory (ADR-052). Moving this profile somewhere else is
-# copying the file there; there is no block in it to edit.
-#
-# Every command still names both, because neither is inferred (ADR-037):
-#
-#     lanes link status --profile ${profile} --target <name>
-#
-# The bearer token for the endpoint this profile serves.
-#
-# "lanes link start" serves every profile in the workspace from one URL, and this
-# token is what opens it — so it admits every profile that "lanes link outputs"
-# lists, not only this one. Each call names the profile it means. Run a separate
-# workspace if you need a token that cannot reach them all.
-auth:
-  mode: bearer
-  token_ref: profile/token
-
-limits:
-  requests_per_minute: 120      # per profile
-  upstream_calls_per_minute: 60 # per connection, protects vendor quota
-
-# App registrations, shared by every connection of that vendor.
-oauth_apps: {}
-
-# One entry per authorised account. "account" is the identity the provider
-# reports — an address, a workspace — so this list says whose data is reachable
-# without having to look anything up.
-#
-# The seven below hold no account, and that is why they are here already: they
-# reach your own material rather than anybody's API, so there was never anything
-# for a connect step to authorise (ADR-050). What each one is:
-#
-#   memory   what you want remembered between sessions
-#   tasks    what you have to do, each with a status
-#   assets   files you want kept, by name
-#   skills   procedures you have written, handed to an agent as instructions
-#   vault    passwords and API keys, released one at a time
-#   setup    what is connected here, and what connecting more would take
-#   entities the people, companies and projects you deal with, and how to
-#            reach each of them — so an agent looks an address up rather
-#            than recalling one
-#
-# Nothing is stored in any of them until you or an agent puts something there,
-# and none of them can read an account. To switch one off, deny it below —
-# deleting the entry no longer works, because the next connect or deploy puts it
-# back.
-connections:
-  - { id: main, provider: memory, account: Memory }
-  - { id: main, provider: tasks, account: Tasks }
-  - { id: main, provider: assets, account: Assets }
-  - { id: main, provider: skills, account: Skills }
-  - { id: main, provider: vault, account: Vault }
-  - { id: main, provider: setup, account: Setup }
-  - { id: main, provider: entities, account: Entities }
-
-# Only what is listed here is reachable, and an empty policy grants nothing.
-#
-# Rules name capabilities, never accounts: "gmail.*" covers every Gmail
-# connection in this profile. To grant two accounts differently, run a second
-# profile — profiles share no database and no credential store. They do now
-# share an endpoint and its token, so that separation is enforced per call
-# rather than per URL.
-#
-#   allow: ['*']                  everything, which is what connect writes
-#   allow: [notion.*, gmail.*]    two providers
-#   deny:  [gmail.send_message]   a deny always beats an allow
-#
-# The rules below grant each of the seven its whole namespace, writes included —
-# the same thing "connect memory" wrote when it was a command you had to run.
-# Narrowing is one line, and these are the three worth knowing:
-#
-#   deny: [memory.write, memory.forget]   memory becomes read-only
-#   deny: [skills.manage.*]               skills can be invoked but not authored
-#   deny: [vault.put, vault.remove]       nothing new can be stored
-#   deny: [entities.write, entities.link, entities.forget]
-#                                         entities becomes read-only
-#
-# Those lists are exhaustive on purpose: a namespace is read-only only when
-# every capability that changes something is named, so "deny: [memory.write]"
-# alone leaves "memory.forget" granted.
-#
-# A vault read is not granted by "vault.*" alone: each stored item is its own
-# "vault.get.<id>" capability and only appears after a restart, so a write can
-# never hand itself a read (ADR-012).
-policy:
-  allow: [memory.*, tasks.*, assets.*, skills.*, vault.*, setup.*, entities.*]
-  deny: []
-`;
-}
-
-export function newWorkspaceTemplate(): string {
-  return `# Lanes Link workspace
-#
-# A workspace holds one or more profiles, and one endpoint serves all of them:
-# every call names the profile it means, with --profile. Profiles never share a
-# database or a credential store, so what one holds is invisible to another.
-#
-# This workspace IS a target. "targets:" below says where its bytes go, once,
-# for every profile in it — a profile says nothing about where it runs, so
-# there is one copy of it and nothing to keep in step (ADR-052).
-#
-# A target somewhere else is a pointer, and "deploy" writes one:
-#
-#   targets:
-#     cloud:
-#       workspace: gs://your-bucket
-#
-# The workspace at that address declares its own adapters, and is the only
-# thing that does. Reading it is a network call, which is why "--target cloud"
-# needs that bucket reachable.
-contract: 2
-targets:
-  local:
-    credentials: { adapter: file }
-    storage: { adapter: filesystem }
-`;
-}

package/src/cli/config-migrate.ts

@@ -91,10 +91,12 @@ export function pendingRenames(document: ConfigDocument): PendingRename[] {
  * connection that lost its authorisation for no reason anyone can see.
  */
 export async function migrateRenamedProviders(
-  document: ConfigDocument,
+  connections: ConfigDocument,
+  profiles: readonly ConfigDocument[],
   credentials: SecretStore,
   options: { apply: boolean },
 ): Promise<RenameMigration> {
+  const document = connections;
   const rows = pendingRenames(document);
   if (rows.length === 0) return { rows, changes: [], blocked: [] };
 
@@ -116,15 +118,14 @@ export async function migrateRenamedProviders(
     }
   }
 
-  // The policy rules second, because whether one can move depends on what is
-  // left declaring the old id once the rows above have.
-  for (const [from, to] of new Map(accepted.map((row) => [row.from, row.to]))) {
-    const policy = renamePolicyRules(document, { from, to }, {
-      stillDeclared: keepsDeclaring(document, from, accepted),
-      apply: options.apply,
-    });
-    changes.push(...policy.changes);
-    blocked.push(...policy.blocked);
+  // The grant rules second, because whether one can move depends on what is
+  // left declaring the old id once the rows above have — and because they live
+  // in the profiles now rather than beside the connection (ADR-057), so this is
+  // one pass per profile over a rename computed once.
+  for (const row of accepted) {
+    for (const profile of profiles) {
+      changes.push(...renameGrantRules(profile, row, { apply: options.apply }).changes);
+    }
   }
 
   if (!options.apply || accepted.length === 0) return { rows, changes, blocked };
@@ -137,8 +138,11 @@ export async function migrateRenamedProviders(
   }
 
   // Throws unless the result is a config that loads, which is the assertion
-  // worth having here — the whole premise was that it did not.
+  // worth having here — the whole premise was that it did not. Both files, in
+  // the order that survives a crash between them: a grant naming a connection
+  // that has not been renamed yet is refused at load, so the profiles go last.
   await document.save();
+  if (options.apply) for (const profile of profiles) await profile.save();
 
   for (const row of accepted) await credentials.delete(`${row.from}/${row.id}`);
 
@@ -146,7 +150,7 @@ export async function migrateRenamedProviders(
 }
 
 /**
- * Rewrite the policy rules that named the old id, where that is unambiguous.
+ * Rewrite the grant rules that named the old id, where that is unambiguous.
  *
  * A rule names a provider and never an account, so `tasks.*` written for Google
  * Tasks has to follow the rename or the migrated connection is granted nothing
@@ -154,66 +158,80 @@ export async function migrateRenamedProviders(
  * consulted, so the repair would land a row that serves exactly as little as
  * the broken one did.
  *
- * But a profile declaring *both* — a Google Tasks row and the built-in — has one
- * rule serving two providers, and moving it would silently revoke the one that
- * kept its name. That profile keeps its rule and is told to add the second,
- * which is a sentence rather than a guess at which was meant.
+ * The ambiguity this used to guard against is gone, and it is worth saying why.
+ * A rule lived in one flat block and named a provider, so a profile holding a
+ * Google Tasks row *and* the built-in had one `tasks.*` serving both — moving it
+ * would silently revoke whichever kept its name, so the migration reported
+ * rather than guessed. A rule lives inside the row that names one connection
+ * now (ADR-058), so `tasks.*` on a `google_tasks` row is not ambiguous: it is
+ * invalid, and `assertReferentialIntegrity` refuses it. There is nothing left to
+ * decide.
  *
- * Both lists. A `deny` written to switch Google Tasks off means it as firmly as
- * an allow means it on, and leaving it behind would re-enable something the
- * operator turned off.
+ * Both lists, on every row. A `deny` written to switch Google Tasks off means it
+ * as firmly as an allow means it on, and leaving it behind would re-enable
+ * something the operator turned off.
+ *
+ * The row's `connection` moves too, and that is new: a grant names the account
+ * rather than the provider now (ADR-058), so `tasks.main` becomes
+ * `google_tasks.main` or the grant resolves to nothing.
  */
-function renamePolicyRules(
+function renameGrantRules(
   document: ConfigDocument,
-  provider: { from: string; to: string },
-  options: { stillDeclared: boolean; apply: boolean },
-): { changes: string[]; blocked: string[] } {
+  moved: { from: string; to: string; id: string; key: string },
+  options: { apply: boolean },
+): { changes: string[] } {
   const changes: string[] = [];
-  const blocked: string[] = [];
 
-  for (const field of ['allow', 'deny'] as const) {
-    const rules = document.getIn(['policy', field]) as { items?: unknown[] } | null;
-
-    (rules?.items ?? []).forEach((_item, index) => {
-      // Either spelling: a bare pattern, or `{ capability, expires_at }`. The
-      // path to it differs; the decision does not.
-      const bare = document.getIn(['policy', field, index]);
-      const path =
-        typeof bare === 'string'
-          ? (['policy', field, index] as const)
-          : (['policy', field, index, 'capability'] as const);
-
-      const capability = typeof bare === 'string' ? bare : document.getIn(path);
-      if (typeof capability !== 'string') return;
-
-      const [named, ...rest] = capability.split('.');
-      if (named !== provider.from) return;
-
-      const moved = [provider.to, ...rest].join('.');
-
-      if (options.stillDeclared) {
-        blocked.push(
-          `policy.${field} keeps "${capability}" — this profile still declares a ` +
-            `"${provider.from}" connection, so add "${moved}" rather than moving it`,
-        );
-        return;
-      }
-
-      if (options.apply) document.setIn(path, moved);
-      changes.push(`policy.${field}: ${capability} → ${moved}`);
-    });
-  }
+  const provider = { from: moved.from, to: moved.to };
+  const grants = document.getIn(['grants']) as { items?: unknown[] } | null;
+
+  (grants?.items ?? []).forEach((_row, at) => {
+    const connection = document.getIn(['grants', at, 'connection']);
+    if (typeof connection !== 'string') return;
+
+    // The *exact* connection that moved, not every grant naming the old
+    // provider. A workspace holding a Google Tasks row beside the built-in has
+    // two `tasks.` grants and only one of them is being renamed — moving both
+    // would point the built-in's grant at a connection that does not exist.
+    if (connection !== moved.key) return;
+
+    // The `connection` field always follows, and this is the one place the
+    // ambiguity does not reach. It names the exact row being renamed, so there
+    // is nothing to guess — and leaving it behind would point the grant at a
+    // connection that no longer exists, which `assertGrantsResolve` refuses at
+    // load. The rename would have made the workspace unopenable.
+    const renamedConnection = `${provider.to}.${moved.id}`;
+    if (options.apply) document.setIn(['grants', at, 'connection'], renamedConnection);
+    changes.push(`grants[${at}].connection: ${connection} → ${renamedConnection}`);
 
-  return { changes, blocked };
+    for (const field of ['allow', 'deny'] as const) {
+      const rules = document.getIn(['grants', at, field]) as { items?: unknown[] } | null;
+
+      (rules?.items ?? []).forEach((_item, index) => {
+        // Either spelling: a bare pattern, or `{ capability, expires_at }`. The
+        // path to it differs; the decision does not.
+        const bare = document.getIn(['grants', at, field, index]);
+        const path =
+          typeof bare === 'string'
+            ? (['grants', at, field, index] as const)
+            : (['grants', at, field, index, 'capability'] as const);
+
+        const capability = typeof bare === 'string' ? bare : document.getIn(path);
+        if (typeof capability !== 'string') return;
+
+        const [head, ...rest] = capability.split('.');
+        if (head !== provider.from) return;
+
+        const renamed = [provider.to, ...rest].join('.');
+        if (options.apply) document.setIn(path, renamed);
+        changes.push(`grants[${at}].${field}: ${capability} → ${renamed}`);
+      });
+    }
+  });
+
+  return { changes };
 }
 
-/**
- * Whether a row naming the old provider survives the migration.
- *
- * Computed against the accepted set rather than by re-reading the document,
- * because the same answer has to hold on a report-only run, where nothing has
- * been rewritten yet.
- */
 function keepsDeclaring(
   document: ConfigDocument,
   provider: string,

package/src/cli/config-repair.ts

@@ -1,4 +1,5 @@
-import { listProfiles } from '#profile';
+import { newConnectionsTemplate } from './config-templates.ts';
+import { CONNECTIONS_FILE, listProfiles, workspaceFiles, writeWorkspaceFile } from '#profile';
 import { ConfigDocument } from './config-edit.ts';
 import { ok, print, style, warn } from './output.ts';
 
@@ -100,61 +101,97 @@ export interface SurfaceRepair {
  * (ADR-023) so it could not write this even if the code let it.
  */
 export function ensureReservedConnection(
-  document: ConfigDocument,
+  connections: ConfigDocument,
+  profile: ConfigDocument,
   provider: ReservedSurface,
+  options: { grants?: boolean } = {},
 ): SurfaceRepair {
+  // Whether the profile half is written at all. `connect` without `--profile`
+  // repairs the workspace's connection rows and touches no profile, because it
+  // was not told which one to touch (ADR-057).
+  const grants = options.grants ?? true;
   // Raw YAML, so nothing here has been through a schema: this runs over sibling
   // profiles that were never validated, and every field is whatever was typed.
-  const config = document.toJSON() as {
-    connections?: unknown;
-    policy?: { allow?: unknown; deny?: unknown };
-  } | null;
+  const workspace = connections.toJSON() as { connections?: unknown } | null;
+  const config = profile.toJSON() as { grants?: unknown } | null;
 
   const rule = `${provider}.*`;
   const covers = (pattern: string): boolean => pattern === '*' || pattern === rule;
 
+  const rows = Array.isArray(workspace?.connections) ? workspace.connections : [];
+  const held_grants = Array.isArray(config?.grants) ? config.grants : [];
+
+  // The row this profile would use. Any instance of the provider will do, and
+  // the *first* one is taken rather than `main` specifically: an operator who
+  // renamed theirs should not get a second one bolted on beside it.
+  const existing = rows.find(
+    (row) => (row as { provider?: unknown } | null)?.provider === provider,
+  ) as { id?: unknown } | undefined;
+  const id = typeof existing?.id === 'string' ? existing.id : 'main';
+  const key = `${provider}.${id}`;
+
+  const held = held_grants.find(
+    (row) => (row as { connection?: unknown } | null)?.connection === key,
+  ) as { allow?: unknown; deny?: unknown } | undefined;
+
   // Denied on purpose, and a deny beats an allow — so writing the rule would
   // widen nothing while announcing that an agent can now read the surface,
-  // which would be false. For `setup`, deleting the two lines no longer removes
-  // it either, because the next `connect` or `deploy` puts them back; a deny is
-  // the way it stays off, so it is the one thing this must not undo. The same
-  // holds for `identity`, where the next `identity add` is what would put them
-  // back.
+  // which would be false. Deleting the row no longer removes the surface
+  // either, because the next `connect` or `deploy` puts it back; a deny is the
+  // way it stays off, so it is the one thing this must not undo.
   //
   // Only a rule covering the whole surface counts. `deny: [setup.provider]` is
   // an operator narrowing it, not switching it off, and that narrowing survives
   // the repair untouched — which is the point of denying one capability.
-  if (patternsIn(config?.policy?.deny).some(covers)) return { changes: [], granted: [] };
+  if (patternsIn(held?.deny).some(covers)) return { changes: [], granted: [] };
 
   const changes: string[] = [];
   const granted: string[] = [];
 
-  const connections = Array.isArray(config?.connections) ? config.connections : [];
-  const declared = (row: unknown): boolean =>
-    (row as { provider?: unknown } | null)?.provider === provider;
-
-  if (!connections.some(declared)) {
-    // Inline, and `main` for the id, so a repaired profile is spelled exactly
-    // like `newProfileTemplate` writes a fresh one. Two spellings of one row is
-    // how a template and its repair drift apart.
-    document.addTo(
+  if (existing === undefined) {
+    // Inline, and `main` for the id, so a repaired workspace is spelled exactly
+    // like `newConnectionsTemplate` writes a fresh one. Two spellings of one row
+    // is how a template and its repair drift apart.
+    connections.addTo(
       ['connections'],
       { id: 'main', provider, account: RESERVED_SURFACES[provider] },
       { inline: true },
     );
-    changes.push(`connections += ${provider}.main`);
+    changes.push(`connections.yaml += ${key}`);
   }
 
-  // `*` already covers it. Re-stating the rule under a blanket allow would be
-  // noise in the file and a diff the operator did not ask for.
-  if (!patternsIn(config?.policy?.allow).some(covers)) {
-    document.addTo(['policy', 'allow'], rule, { inline: true });
+  if (!grants) return { changes, granted };
+
+  if (held === undefined) {
+    profile.addTo(['grants'], { connection: key, allow: [rule], deny: [] }, { inline: true });
+    changes.push(`grants += ${key}`);
+    granted.push(rule);
+  } else if (!patternsIn(held.allow).some(covers)) {
+    // A row that exists and grants nothing is a surface that is present and
+    // silent. Widening it back is the repair; the deny check above is what stops
+    // this undoing a deliberate narrowing.
+    const at = held_grants.indexOf(held as never);
+    profile.addTo(['grants', at, 'allow'], rule, { inline: true });
     granted.push(rule);
   }
 
   return { changes, granted };
 }
 
+/** The workspace's connections document, written from the template if missing. */
+async function openOrCreateConnections(workspaceRoot: string): Promise<ConfigDocument> {
+  try {
+    return await ConfigDocument.openKey(workspaceRoot, CONNECTIONS_FILE);
+  } catch {
+    await writeWorkspaceFile(
+      workspaceFiles(workspaceRoot),
+      CONNECTIONS_FILE,
+      newConnectionsTemplate(),
+    );
+    return ConfigDocument.openKey(workspaceRoot, CONNECTIONS_FILE);
+  }
+}
+
 /** Whether a repair did anything, without a caller adding up two lists. */
 /** `memory, tasks, assets, skills, vault, setup and entities`, in repair order. */
 function listSurfaces(): string {
@@ -169,7 +206,7 @@ export function repaired(repair: SurfaceRepair): boolean {
 
 /** The repair as display lines, in the order the two halves are applied. */
 export function repairLines(repair: SurfaceRepair): string[] {
-  return [...repair.changes, ...repair.granted.map((rule) => `policy.allow += ${rule}`)];
+  return [...repair.changes, ...repair.granted.map((rule) => `grants[].allow += ${rule}`)];
 }
 
 /**
@@ -219,12 +256,16 @@ function patternsIn(rules: unknown, now = Date.now()): string[] {
  * Each surface is still decided independently, so a profile that denied exactly
  * one of them keeps that decision while the rest are repaired.
  */
-export function ensureOwnerLayer(document: ConfigDocument): SurfaceRepair {
+export function ensureOwnerLayer(
+  connections: ConfigDocument,
+  profile: ConfigDocument,
+  options: { grants?: boolean } = {},
+): SurfaceRepair {
   const changes: string[] = [];
   const granted: string[] = [];
 
   for (const provider of DEFAULT_SURFACES) {
-    const repair = ensureReservedConnection(document, provider);
+    const repair = ensureReservedConnection(connections, profile, provider, options);
     changes.push(...repair.changes);
     granted.push(...repair.granted);
   }
@@ -241,8 +282,11 @@ export function ensureOwnerLayer(document: ConfigDocument): SurfaceRepair {
  * paragraph of the instructions budget to say so. `identity add` is the only
  * caller, so the grant arrives exactly when there is something behind it.
  */
-export function ensureIdentityConnection(document: ConfigDocument): SurfaceRepair {
-  return ensureReservedConnection(document, 'identity');
+export function ensureIdentityConnection(
+  connections: ConfigDocument,
+  profile: ConfigDocument,
+): SurfaceRepair {
+  return ensureReservedConnection(connections, profile, 'identity');
 }
 
 /**
@@ -288,14 +332,25 @@ export async function repairOwnerLayer(
   const say = options.report ?? print;
   const wanted = profiles === undefined ? undefined : new Set(profiles);
 
+  // One connections document for the whole sweep. The owner layer is the
+  // workspace's now (ADR-059), so repairing three profiles must not add three
+  // `memory.main` rows — opening it once and saving it once is what makes the
+  // second profile see what the first one created.
+  // Created if absent rather than refused. A contract-3 workspace always has
+  // one, but a hand-made or half-migrated one may not — and this is the repair,
+  // so the file it needs is a thing to write rather than a reason to stop.
+  const connections = await openOrCreateConnections(workspaceRoot);
+  let connectionsChanged = false;
+
   for (const name of await listProfiles(workspaceRoot)) {
     if (wanted !== undefined && !wanted.has(name)) continue;
 
     try {
       const document = await ConfigDocument.open(workspaceRoot, name);
-      const repair = ensureOwnerLayer(document);
+      const repair = ensureOwnerLayer(connections, document);
       if (!repaired(repair)) continue;
 
+      connectionsChanged = true;
       await document.save();
 
       say(ok(`gave ${style.bold(name)} its own owner layer`));
@@ -313,4 +368,6 @@ export async function repairOwnerLayer(
       );
     }
   }
+
+  if (connectionsChanged) await connections.save();
 }