@lanes-sh/link 0.7.1 → 0.8.0

package/src/deployments/serving.ts

@@ -1,8 +1,10 @@
 import {
+  readConnections,
   ConfigError,
   listProfiles,
   loadWorkspaceProfiles,
   readRegistry,
+  resolveTargetWorkspace,
   type WorkspaceProfiles,
 } from '#profile';
 import { rotatableCredentialRefsFor } from '#registry';
@@ -49,16 +51,25 @@ export async function servingProfiles(input: {
     return { profiles: [...named], primary: named[0]! };
   }
 
-  const living = await listProfiles(workspaceRoot);
+  // **Where the profiles actually are, which is not this machine.** After
+  // ADR-052 a deployed target's profiles live in its workspace, so listing the
+  // local root answered with whatever happened to be here: an empty workspace
+  // holding nothing but a pointer refused a redeploy of a live endpoint
+  // outright, and a local profile the bucket does not hold would have been sent
+  // to a revision that cannot open it. A declaration resolves back to the local
+  // root, which is the right answer there — a first deploy is exactly the case
+  // where the profiles are still on this machine and about to be uploaded.
+  const where = await resolveTargetWorkspace(workspaceRoot, target).catch(() => workspaceRoot);
+  const living = await listProfiles(where);
 
   if (living.length === 0) {
     throw new ConfigError(
       `No profile lives in "${target}", so there is no set to deploy.\n` +
         '  A first deploy creates the target, and has to be told which profile\n' +
         '  it belongs to:\n' +
-        `    lanes link deploy --target ${target} --profile <name>\n\n` +
+        `    lanes link deploy --workspace ${target} --profile <name>\n\n` +
         `  If "${target}" was deployed before and the pointer to it was lost:\n` +
-        `    lanes link sync targets --target ${target} --discover`,
+        `    lanes link sync targets --workspace ${target} --discover`,
     );
   }
 
@@ -89,7 +100,7 @@ async function choosePrimary(
       "of them owns the endpoint's token. One token opens the endpoint and\n" +
       'reaches every profile behind it, so this cannot be picked for you.\n\n' +
       `  Name it once and it is remembered:\n` +
-      `    lanes link deploy --target ${target} --profile ${declaring[0]!}` +
+      `    lanes link deploy --workspace ${target} --profile ${declaring[0]!}` +
       declaring
         .slice(1)
         .map((name) => ` --profile ${name}`)
@@ -97,73 +108,3 @@ async function choosePrimary(
   );
 }
 
-/**
- * A credential reference two profiles would both write, in one store.
- *
- * References are flat — `gmail/main`, not `personal/gmail/main` — and a target
- * has one credential store, so two profiles deployed to the same project share
- * a namespace. `https://lanes.sh/docs/link/configuration` admits this in an aside about
- * removing a profile; deploying both at once is where it stops being an aside.
- *
- * The failure is silent and it is the bad kind: `personal`'s Gmail refresh
- * token is overwritten by `work`'s, both profiles go on listing their own
- * account in config, and the first symptom is one of them reading the other's
- * mailbox. Nothing downstream can catch it, because by then there is one
- * credential and it is valid.
- *
- * `profile/token` is deliberately not a collision. Every profile defaults to
- * that ref and the endpoint has exactly one token by design — sharing it is
- * what ADR-009 says happens, rather than an accident.
- */
-export interface Collision {
-  readonly ref: string;
-  readonly profiles: string[];
-}
-
-export async function collidingRefs(
-  workspaceRoot: string,
-  profiles: readonly string[],
-  workspace?: WorkspaceProfiles,
-): Promise<Collision[]> {
-  const loaded = (workspace ?? (await loadWorkspaceProfiles(workspaceRoot))).loaded.filter(
-    (entry) => profiles.includes(entry.profile),
-  );
-
-  const owners = new Map<string, string[]>();
-
-  for (const entry of loaded) {
-    const registry = await buildRegistryWithWorkspace(workspaceRoot, entry.profile);
-    const refs = new Set<string>();
-
-    for (const connection of entry.config.connections) {
-      const manifest = registry.manifest(connection.provider);
-      for (const ref of rotatableCredentialRefsFor(connection, manifest)) refs.add(ref);
-      if (connection.credential_ref) refs.add(connection.credential_ref);
-    }
-
-    for (const ref of refs) {
-      if (ref === entry.config.auth.token_ref) continue;
-      owners.set(ref, [...(owners.get(ref) ?? []), entry.profile]);
-    }
-  }
-
-  return [...owners.entries()]
-    .filter(([, names]) => names.length > 1)
-    .map(([ref, names]) => ({ ref, profiles: names.sort() }))
-    .sort((a, b) => a.ref.localeCompare(b.ref));
-}
-
-/** The refusal, as a block, so the wording is testable without a deploy. */
-export function collisionRefusal(found: readonly Collision[], target: string): string {
-  const rows = found.map((one) => `    ${one.ref}   ${one.profiles.join(', ')}`).join('\n');
-
-  return (
-    `${found.length} credential reference(s) would be written by more than one\n` +
-    `profile into the one credential store "${target}" has:\n\n${rows}\n\n` +
-    '  References are flat, so these are the same secret and the last deploy\n' +
-    '  wins — after which one profile is reading the other\'s account, and\n' +
-    '  both still name their own in config.\n\n' +
-    '  Give the connections different ids, or deploy the profiles to targets\n' +
-    '  in separate projects.'
-  );
-}

package/src/deployments/target.ts

@@ -69,14 +69,14 @@ export async function openSecrets(input: TargetInput): Promise<SecretStore> {
       return createFileSecretStore({
         path: workspacePath(
           root,
-          declared.credentials.path ?? layout.credentials(config.instance.profile),
+          declared.credentials.path ?? layout.credentials(),
         ),
       });
 
     case 'gcp-secret-manager': {
       if (!declared.credentials.project) {
         throw new ConfigError(
-          `targets.${target}.credentials.project is required for the gcp-secret-manager adapter.`,
+          `workspaces.${target}.credentials.project is required for the gcp-secret-manager adapter.`,
         );
       }
       const { GcpSecretManagerStore } = await import('./adapters/gcp-secret-manager.ts');
@@ -97,8 +97,8 @@ export async function openSecrets(input: TargetInput): Promise<SecretStore> {
  * Its own root, `layout.state`, so it is not addressable from a provider's
  * blob namespace — the same containment `openAudit` relies on.
  */
-export function openState(storage: StorageFactory, profile: string): RuntimeState {
-  return createRuntimeState(storage(layout.state(profile)));
+export function openState(storage: StorageFactory): RuntimeState {
+  return createRuntimeState(storage(layout.state()));
 }
 
 /**
@@ -115,8 +115,8 @@ export function openState(storage: StorageFactory, profile: string): RuntimeStat
  * into (`layout.audit`), and that separation is what keeps ADR-007's wall
  * intact.
  */
-export function openAudit(storage: StorageFactory, profile: string): AuditStore {
-  return createBlobAuditStore({ storage: storage(layout.audit(profile)) });
+export function openAudit(storage: StorageFactory): AuditStore {
+  return createBlobAuditStore({ storage: storage(layout.audit()) });
 }
 
 /**
@@ -137,7 +137,7 @@ export async function openAuditSinks(
   secrets: SecretStore,
   log?: (message: string) => void,
 ): Promise<{ sink: AuditSink; reader: AuditReader }> {
-  const durable = openAudit(storage, input.config.instance.profile);
+  const durable = openAudit(storage);
   const declared = input.declared.audit?.sinks ?? [];
   if (declared.length === 0) return { sink: durable, reader: durable };
 
@@ -201,7 +201,7 @@ export async function openStorage(
   switch (declared.storage.adapter) {
     case 'filesystem': {
       const { createFilesystemBlobStore } = await import('./adapters/filesystem.ts');
-      const base = declared.storage.path ?? layout.blobs(config.instance.profile);
+      const base = declared.storage.path ?? layout.blobs();
       return (area) =>
         createFilesystemBlobStore({ root: workspacePath(root, area === undefined ? base : area) });
     }
@@ -214,12 +214,12 @@ export async function openStorage(
       // by hand in a console.
       const { bucket, prefix } = declared.storage;
       if (!bucket) {
-        throw new ConfigError(`targets.${target}.storage.bucket is required for the gcs adapter.`);
+        throw new ConfigError(`workspaces.${target}.storage.bucket is required for the gcs adapter.`);
       }
 
       const { createGcsBlobStore } = await import('./adapters/gcs.ts');
       const base = prefix ?? '';
-      const root = layout.blobs(config.instance.profile);
+      const root = layout.blobs();
 
       return (area) =>
         createGcsBlobStore({
@@ -231,25 +231,25 @@ export async function openStorage(
     case 's3': {
       const { bucket, endpoint, region, prefix } = declared.storage;
       if (!bucket) {
-        throw new ConfigError(`targets.${target}.storage.bucket is required for the s3 adapter.`);
+        throw new ConfigError(`workspaces.${target}.storage.bucket is required for the s3 adapter.`);
       }
 
       const accessKeyId = await requireSecret(
         secrets,
         declared.storage.access_key_id_ref,
-        `targets.${target}.storage.access_key_id_ref`,
+        `workspaces.${target}.storage.access_key_id_ref`,
         target,
       );
       const secretAccessKey = await requireSecret(
         secrets,
         declared.storage.secret_access_key_ref,
-        `targets.${target}.storage.secret_access_key_ref`,
+        `workspaces.${target}.storage.secret_access_key_ref`,
         target,
       );
 
       const { createS3BlobStore } = await import('./adapters/s3.ts');
       const base = prefix ?? '';
-      const root = layout.blobs(config.instance.profile);
+      const root = layout.blobs();
 
       return (area) =>
         createS3BlobStore({
@@ -289,7 +289,7 @@ export async function requireSecret(
   if (!value) {
     throw new ConfigError(
       `${field} names "${ref}", which is not in this target's secret store. ` +
-        `Store it with: lanes link secrets set ${ref} --target ${target}`,
+        `Store it with: lanes link secrets set ${ref} --workspace ${target}`,
     );
   }
   return value;

package/src/deployments/upload.ts

@@ -1,6 +1,7 @@
 import {
   openTarget,
   DATA_DIR,
+  CONNECTIONS_FILE,
   WORKSPACE_FILE,
   layout,
   listProfiles,
@@ -55,13 +56,18 @@ export function deployedWorkspace(declared: TargetConfig): string | undefined {
  * forgets means an endpoint that will not boot, and a credential this includes
  * by accident means a credential in a bucket. Forgetting is loud.
  *
- * **Two areas inside `data/` are authored rather than accumulated**, since
- * ADR-030 moved skills and provider manifests into the profile that owns them.
- * They have to go up or a deployed instance loses both — the regression ADR-014
- * §2 fixed for skills, reintroduced by where they now live. So this reaches
- * into `data/` for exactly those two, by whole path segment and never by
- * prefix: `data/personal/skills.detour/` is not `skills.d`, and the difference
- * between matching it and not is a credential in a bucket.
+ * **Two areas inside `data/` are authored rather than accumulated.** Skills and
+ * provider manifests have to go up or a deployed instance loses both — the
+ * regression ADR-014 §2 fixed for skills. So this reaches into `data/` for
+ * exactly those two, by whole path segment and never by prefix:
+ * `data/skills.detour/` is not `skills.d`, and the difference between matching
+ * it and not is a credential in a bucket.
+ *
+ * Neither is filtered by the profile set any more. Both are keyed by connection
+ * now rather than by profile (ADR-057, ADR-059), and a connection can be
+ * granted by any profile in the workspace — so sending "only this profile's
+ * skills" is not a thing that can be computed, and withholding them would
+ * deploy an endpoint whose prompts are missing.
  */
 export function isWorkspaceConfig(key: string, profiles?: readonly string[]): boolean {
   // **Never the workspace file.** It was sent, and it is the one file that must
@@ -74,37 +80,45 @@ export function isWorkspaceConfig(key: string, profiles?: readonly string[]): bo
   // the upload is done.
   if (key === WORKSPACE_FILE) return false;
 
+  // **The connections file always goes up.** It is configuration, the endpoint
+  // cannot resolve a single grant without it, and unlike the registry above
+  // there is nothing machine-specific in it — a connection is a connection
+  // wherever the workspace is read from (ADR-057).
+  if (key === CONNECTIONS_FILE) return true;
+
+  if (isAuthoredArea(key)) return true;
+
   // A set rather than one name, because a deploy now sends every profile that
   // declares the target rather than the single one it was told. `undefined`
   // still means the whole workspace, and an *empty* set means nothing — which
   // is a distinction a bare string could not make.
   const wanted = profiles === undefined ? undefined : new Set(profiles);
 
-  const owner = authoredAreaOwner(key);
-  if (owner !== null) return wanted === undefined || wanted.has(owner);
-
   if (!key.startsWith('profiles/') || !key.endsWith('.yaml')) return false;
   const name = key.slice('profiles/'.length, -'.yaml'.length);
   return wanted === undefined || wanted.has(name);
 }
 
 /**
- * The profile whose authored area holds `key`, or null for anything else.
+ * Whether `key` is inside one of the two authored areas.
  *
  * Composed back out of `layout` rather than compared against literals, so a
  * renamed directory moves both this and the store that reads it, or neither.
- * Requires a fourth segment: `data/personal/skills.d` names the directory, and
- * a directory is not a file to send.
+ *
+ * The segment counts differ because the layouts do, and both are the "a
+ * directory is not a file to send" rule: a manifest is `data/providers.d/<file>`
+ * and a skill is `data/skills.d/<connection>/<file>`, so requiring one more
+ * segment than the area itself has is what stops the bare directory key
+ * matching.
  */
-function authoredAreaOwner(key: string): string | null {
+function isAuthoredArea(key: string): boolean {
   const segments = key.split('/');
-  if (segments.length < 4 || segments[0] !== DATA_DIR) return null;
-
-  const owner = segments[1]!;
-  if (owner.length === 0) return null;
+  if (segments.length < 3 || segments[0] !== DATA_DIR) return false;
 
-  const area = `${DATA_DIR}/${owner}/${segments[2]}`;
-  return area === layout.skills(owner) || area === layout.providers(owner) ? owner : null;
+  const area = `${DATA_DIR}/${segments[1]}`;
+  if (area === layout.providers()) return segments.length >= 3;
+  if (area === layout.skillsRoot()) return segments.length >= 4;
+  return false;
 }
 
 /**
@@ -157,7 +171,16 @@ export async function publishWorkspace(input: {
   readonly config: Config;
   readonly workspaceRoot: string;
   readonly target: string;
-  readonly profile: string;
+  /**
+   * The profiles this edit touched, not just the one it was run under.
+   *
+   * `disconnect` removes a connection from the workspace and drops the grant
+   * from *every* profile that named it, so publishing one profile left the
+   * bucket holding a `connections.yaml` without the connection and a sibling
+   * profile still granting it — which `assertGrantsResolve` refuses at load, so
+   * `openReconciled` skipped that profile and it silently stopped being served.
+   */
+  readonly profile: string | readonly string[];
 }): Promise<string | null> {
   // Resolution failures are swallowed rather than thrown. The config edit that
   // called this has already succeeded and is on disk; a target that cannot be
@@ -173,6 +196,7 @@ export async function publishWorkspace(input: {
   const destination = deployedWorkspace(declared);
   if (!destination) return null;
 
-  await uploadWorkspace(input.workspaceRoot, destination, [input.profile]);
+  const touched = typeof input.profile === 'string' ? [input.profile] : input.profile;
+  await uploadWorkspace(input.workspaceRoot, destination, touched);
   return destination;
 }

package/src/dispatch/deps.ts

@@ -0,0 +1,88 @@
+import type { Principal } from '#auth';
+import type { AuditSink } from '#audit';
+import type { PolicyDocument, ProfilePolicy, RateLimiter } from '#policy';
+import type { Config, ConnectionConfig } from '#profile';
+import type { ProviderRegistry } from '#registry';
+import type { SecretStore } from '#secrets';
+import type { BlobStore } from '#stores/blobs';
+import type { RuntimeState } from '#stores/state';
+import type { AnyConnector } from '#connectivity';
+import type { Logger } from '#connectivity';
+
+/**
+ * What the dispatcher is given, and what it is asked.
+ *
+ * Split from the dispatcher itself so that file stays inside the size budget.
+ * The seam is real rather than arithmetic: everything here is what a *caller*
+ * assembles, and the class next door is the fixed order in which a call is
+ * authorised and run. Reading one has never required reading the other.
+ */
+
+/**
+ * The dispatch path.
+ *
+ * Every invocation goes through here in one fixed order — authenticate,
+ * resolve, authorize, rate-limit, dispatch, audit — with no way around it.
+ * The ordering is not stylistic: policy is evaluated before a provider is
+ * reached, so a provider never sees a request it was not authorised to serve,
+ * and authorization is never something provider code could get wrong.
+ *
+ * Exactly one audit event is written per invocation, on every path including
+ * denials. That is enforced structurally by `finally` rather than by
+ * remembering to call it at each return.
+ */
+
+export interface DispatchDeps {
+  readonly config: Config;
+  /**
+   * The accounts this workspace holds, and the clients it registered (ADR-057).
+   *
+   * Separate from `config` because neither is the profile's to declare. The
+   * *gate* stays policy: a connection that exists and is not granted resolves
+   * and is then denied `denied_default`, which is the same answer a caller gets
+   * for one that does not exist — two shapes of "no" that read alike, so probing
+   * is not an oracle for what the workspace holds.
+   */
+  readonly connections: readonly ConnectionConfig[];
+  readonly oauthApps: readonly string[];
+  readonly registry: ProviderRegistry;
+  /**
+   * Resolve the connector for a provider. Supplied by the caller so core does
+   * not import connector implementations, keeping the dependency direction
+   * intact: infrastructure -> sdk -> core -> connectors.
+   */
+  readonly connectorFor: (providerId: string, connectionId: string) => AnyConnector | undefined;
+  /** Attach whatever the manifest's auth kind requires to an outbound request. */
+  readonly authorizeRequest?: (
+    providerId: string,
+    connectionId: string,
+    request: Request,
+  ) => Promise<Request>;
+  readonly policy: ProfilePolicy;
+  /** Optional instance floor. Empty in M1; composition is tighten-only. */
+  readonly floor?: PolicyDocument;
+  readonly state: RuntimeState;
+  /**
+   * Where events go. Separate from `state` because the log is no longer in
+   * it — and because dispatch only ever writes, so taking the sink rather than
+   * the whole store means this path structurally cannot read the log back.
+   */
+  readonly audit: AuditSink;
+  readonly credentials: SecretStore;
+  readonly storage: BlobStore;
+  readonly limiter: RateLimiter;
+  readonly log: Logger;
+  readonly now?: () => number;
+}
+
+export interface DispatchRequest {
+  readonly principal: Principal;
+  /** Fully qualified, e.g. `example.echo`. */
+  readonly capabilityId: string;
+  /** Fully qualified, e.g. `example.a`. */
+  readonly connectionKey: string;
+  readonly arguments: Readonly<Record<string, unknown>>;
+  /** Self-reported by the client. Observability only — never authorization. */
+  readonly clientLabel?: string | undefined;
+  readonly signal?: AbortSignal;
+}

package/src/dispatch/dispatch.ts

@@ -1,9 +1,9 @@
 import type { AuditDraft, AuditLogger, AuditSink, AuthorizationResult } from '#audit';
 import { keepKeys, redactAllValues } from '#audit';
-import type { Principal } from '#auth';
+import { mayReach, type Principal } from '#auth';
 import type { SecretStore } from '#secrets';
 import type { RuntimeState } from '#stores/state';
-import type { PolicyDocument } from '#policy';
+import type { PolicyDocument, ProfilePolicy } from '#policy';
 import { RateLimiter, evaluate } from '#policy';
 import type { BlobStore } from '#stores/blobs';
 import type {
@@ -14,69 +14,14 @@ import type {
   Logger,
 } from '#connectivity';
 import { isToolResult, strategyContextFrom, strategyFor } from '#connectivity';
-import type { Config } from '#profile';
+import type { Config, ConnectionConfig } from '#profile';
 import { buildProviderContext, createProviderLogger } from './context.ts';
 import { fetchStaged, stageAttachment } from './staging.ts';
 import type { FetchStagedRequest, StagedAttachment, StageRequest } from './staging.ts';
 import type { ProviderRegistry } from '#registry';
 
-/**
- * The dispatch path.
- *
- * Every invocation goes through here in one fixed order — authenticate,
- * resolve, authorize, rate-limit, dispatch, audit — with no way around it.
- * The ordering is not stylistic: policy is evaluated before a provider is
- * reached, so a provider never sees a request it was not authorised to serve,
- * and authorization is never something provider code could get wrong.
- *
- * Exactly one audit event is written per invocation, on every path including
- * denials. That is enforced structurally by `finally` rather than by
- * remembering to call it at each return.
- */
-
-export interface DispatchDeps {
-  readonly config: Config;
-  readonly registry: ProviderRegistry;
-  /**
-   * Resolve the connector for a provider. Supplied by the caller so core does
-   * not import connector implementations, keeping the dependency direction
-   * intact: infrastructure -> sdk -> core -> connectors.
-   */
-  readonly connectorFor: (providerId: string, connectionId: string) => AnyConnector | undefined;
-  /** Attach whatever the manifest's auth kind requires to an outbound request. */
-  readonly authorizeRequest?: (
-    providerId: string,
-    connectionId: string,
-    request: Request,
-  ) => Promise<Request>;
-  readonly policy: PolicyDocument;
-  /** Optional instance floor. Empty in M1; composition is tighten-only. */
-  readonly floor?: PolicyDocument;
-  readonly state: RuntimeState;
-  /**
-   * Where events go. Separate from `state` because the log is no longer in
-   * it — and because dispatch only ever writes, so taking the sink rather than
-   * the whole store means this path structurally cannot read the log back.
-   */
-  readonly audit: AuditSink;
-  readonly credentials: SecretStore;
-  readonly storage: BlobStore;
-  readonly limiter: RateLimiter;
-  readonly log: Logger;
-  readonly now?: () => number;
-}
-
-export interface DispatchRequest {
-  readonly principal: Principal;
-  /** Fully qualified, e.g. `example.echo`. */
-  readonly capabilityId: string;
-  /** Fully qualified, e.g. `example.a`. */
-  readonly connectionKey: string;
-  readonly arguments: Readonly<Record<string, unknown>>;
-  /** Self-reported by the client. Observability only — never authorization. */
-  readonly clientLabel?: string | undefined;
-  readonly signal?: AbortSignal;
-}
+export type { DispatchDeps, DispatchRequest } from './deps.ts';
+import type { DispatchDeps, DispatchRequest } from './deps.ts';
 
 /**
  * `result` is a union because a capability is not necessarily a tool — a
@@ -198,7 +143,21 @@ export class Dispatcher {
 
       auditArguments = (redact ?? redactAllValues)(request.arguments);
 
-      const declared = config.connections.find(
+      // **Who, before what.** A caller reaches a profile only if that profile's
+      // `members:` names them (ADR-060), and this is checked before the
+      // connection is even resolved: a refusal that first said "no such
+      // connection" would answer a question the caller was not entitled to ask.
+      // The profile is the principal's: the MCP layer routes on the `profile`
+      // argument and builds the principal for it, so this is the same value the
+      // caller named and the one the audit event records.
+      if (!mayReach(request.principal, request.principal.profile)) {
+        return (outcome = deny(
+          'denied_default',
+          `Profile ${request.principal.profile} is not available`,
+        ));
+      }
+
+      const declared = this.#deps.connections.find(
         (connection) => `${connection.provider}.${connection.id}` === request.connectionKey,
       );
       if (!declared || declared.provider !== providerId) {
@@ -311,7 +270,7 @@ export class Dispatcher {
         // Which vendors this profile registered a client of its own for. A
         // provider that could be brokered but is not reads its client from the
         // store, so it has to be able to.
-        ownClients: Object.keys(this.#deps.config.oauth_apps),
+        ownClients: this.#deps.oauthApps,
         ...(entry.manifest.connector.kind === 'local' ? {} : { authorize }),
       });
 

package/src/policy/index.ts

@@ -14,6 +14,11 @@
  *      withheld. The floor is empty in M1 — the invariant is implemented
  *      anyway, because it is what makes delegated access safe to add later,
  *      and retrofitting it once rules exist in the wild is not possible.
+ *
+ * Since contract 3 a profile's rules are grouped by the connection they govern
+ * (ADR-058). Both invariants are unchanged and one is now sharper: a connection
+ * with no rules at all is not merely unmatched, it is absent, so default deny
+ * bites before a capability is even considered.
  */
 
 export type { AuthorizationResult } from '#audit';
@@ -43,6 +48,26 @@ export interface PolicyDocument {
 
 export const EMPTY_POLICY: PolicyDocument = { rules: [] };
 
+/**
+ * A profile's rules, grouped by the connection each governs (ADR-058).
+ *
+ * A map rather than one list carrying a connection per rule, because the
+ * lookup is the decision: a call names exactly one connection, and the rules
+ * for any other are not evidence about it. Flattening them into one list would
+ * mean every evaluation re-filtered, and a filter that was ever wrong would let
+ * one account's `allow` answer for another.
+ *
+ * A connection absent from the map is not granted. That is default deny on the
+ * connection axis, and it is why `grants:` with an empty `allow` is a different
+ * thing from no row at all — the first says "reachable, nothing permitted", the
+ * second says "not reachable".
+ */
+export interface ProfilePolicy {
+  readonly byConnection: ReadonlyMap<string, PolicyDocument>;
+}
+
+export const EMPTY_PROFILE_POLICY: ProfilePolicy = { byConnection: new Map() };
+
 export interface PolicyRequest {
   /**
    * The authenticated principal. One per profile in M1 (the owner). Carried
@@ -131,14 +156,21 @@ export function evaluateDocument(
  */
 export function evaluate(
   request: PolicyRequest,
-  profile: PolicyDocument,
+  profile: ProfilePolicy,
   floor?: PolicyDocument,
 ): PolicyDecision {
   if (floor) {
     const floorDecision = evaluateDocument(floor, request);
     if (!floorDecision.allowed) return floorDecision;
   }
-  return evaluateDocument(profile, request);
+
+  // The floor is still evaluated against the whole request, because a floor is
+  // an instance-wide narrowing and knows nothing about which connections a
+  // profile happens to hold. Only the profile's half is per connection.
+  const granted = profile.byConnection.get(request.connection);
+  if (granted === undefined) return { allowed: false, reason: 'denied_default' };
+
+  return evaluateDocument(granted, request);
 }
 
 /**
@@ -153,7 +185,7 @@ export function allowedConnections(
   capability: string,
   connections: readonly string[],
   principal: string,
-  profile: PolicyDocument,
+  profile: ProfilePolicy,
   floor?: PolicyDocument,
   at?: Date,
 ): string[] {
@@ -164,16 +196,16 @@ export function allowedConnections(
   const provider = capability.slice(0, capability.indexOf('.'));
   const ofProvider = connections.filter((connection) => connection.startsWith(`${provider}.`));
 
-  // All or nothing beyond that, since rules do not discriminate between
-  // accounts. The list shape is kept because it is what the `connection` enum
-  // wants, and because a future principal-scoped rule would restore the
-  // filtering without touching any caller.
-  const first = ofProvider[0];
-  if (first === undefined) return [];
-
-  const request: PolicyRequest = at
-    ? { principal, capability, connection: first, at }
-    : { principal, capability, connection: first };
-
-  return evaluate(request, profile, floor).allowed ? ofProvider : [];
+  // One evaluation per account, where this used to be all-or-nothing. That
+  // difference is the whole of ADR-058 at the discovery boundary: a profile
+  // holding two mailboxes with different rules now advertises the `connection`
+  // enum each capability actually permits, instead of offering both wherever
+  // either was allowed.
+  return ofProvider.filter((connection) => {
+    const request: PolicyRequest = at
+      ? { principal, capability, connection, at }
+      : { principal, capability, connection };
+
+    return evaluate(request, profile, floor).allowed;
+  });
 }