@lanes-sh/link 0.7.2 → 0.8.0

package/src/cli/commands/members.ts

@@ -0,0 +1,288 @@
+import { readSession } from '#auth/lanes/session.ts';
+import { recordConfigChange } from '../audit-change.ts';
+import {
+  ConfigError,
+  readRegistry,
+  resolveTargetWorkspace,
+  resolveWorkspaceRoot,
+} from '#profile';
+import { ConfigDocument } from '../config-edit.ts';
+import { describeMember, workspaceMembers } from '#auth/lanes/members.ts';
+import { announce, emit, heading, ok, print, style, table, warn } from '../output.ts';
+import { nextAfterEdit, publishProfileEdit } from '../publish.ts';
+import { resolveProfile, type GlobalFlags } from '../runtime.ts';
+
+/**
+ * `lanes link profile members` — who may consume a profile (ADR-060).
+ *
+ * CLI-only, like everything that authorises future agent behaviour (ADR-007),
+ * and for the sharpest version of that argument: an agent able to edit this
+ * could add itself.
+ *
+ * **This is a selection from the Lanes workspace, not a list beside it.**
+ * Membership is managed on the dashboard — invited, accepted, given a role,
+ * removed — and a workspace bound with `lanes_workspace:` is asked who it holds.
+ * Somebody added there shows up here the moment they accept, and granting them a
+ * profile is a local edit naming a subject the server already vouches for.
+ *
+ * For `local` there is no such list, so the only subject accepted is the
+ * signed-in one — a local workspace delegating to a stranger is a typo, not a
+ * use case.
+ */
+
+export interface MemberRow {
+  readonly subject: string;
+  readonly role: 'owner' | 'member';
+  /** Whether this is the identity running the command. */
+  readonly you: boolean;
+}
+
+export async function membersList(flags: GlobalFlags & { json?: boolean }): Promise<void> {
+  const { resolution, config, target } = await resolveProfile(flags);
+  const session = await readSession();
+
+  const rows: MemberRow[] = config.members.map((member) => ({
+    subject: member.subject,
+    role: member.role,
+    you: member.subject === session?.subject,
+  }));
+
+  // The workspace's own people, so this listing answers both halves of the
+  // question: who may use this profile, and who *could* be given it. Without
+  // the second, adding somebody means going to the dashboard to copy a subject
+  // out of it.
+  const held = await workspaceMembers(await boundWorkspace(target));
+  const granted = new Set(rows.map((row) => row.subject));
+  const available = held.members.filter(
+    (member) => member.subject === null || !granted.has(member.subject),
+  );
+
+  return emit(
+    flags.json,
+    { profile: resolution.profile, members: rows, available: available },
+    () => {
+      announce(resolution);
+
+      if (rows.length === 0) {
+        // Empty is nobody, and saying so matters: the natural reading of a blank
+        // list is "no restriction", which is the opposite of what it means.
+        print(style.dim('No members. Nobody may consume this profile.'));
+        print(style.dim('  Add yourself with: lanes link profile members add --me'));
+      } else {
+        heading(`May consume ${resolution.profile} (${rows.length})`);
+        table(
+          rows.map((row) => [
+            `  ${style.bold(row.subject)}`,
+            row.role,
+            row.you ? style.dim('you') : '',
+          ]),
+        );
+      }
+
+      if (available.length > 0) {
+        heading(`In the workspace, not granted (${available.length})`);
+        table(
+          available.map((member) => [
+            `  ${style.bold(describeMember(member))}`,
+            member.role,
+            member.status === 'pending'
+              ? style.dim('invitation not accepted')
+              : style.dim(member.subject ?? ''),
+          ]),
+        );
+      }
+
+      if (held.unavailable !== null && held.unavailable !== 'this workspace is not bound to a Lanes workspace') {
+        print('');
+        print(style.dim(`Could not list the workspace's members: ${held.unavailable}`));
+      }
+    },
+  );
+}
+
+/** The Lanes workspace this one is bound to, if any. */
+async function boundWorkspace(target: string): Promise<string | undefined> {
+  // **The workspace that declares the target, which is not this machine once it
+  // is deployed.** `lanes_workspace` is a declaration field, and
+  // `recordDeployment` writes the declaration into the bucket while leaving
+  // this machine a pointer carrying only `at`, `primary` and the deploy stamps.
+  // So reading it here found nothing the moment a target was deployed: binding
+  // a workspace stopped taking effect, `members add` refused everyone but the
+  // person at the keyboard, and the remedy it printed — add `lanes_workspace:`
+  // under `workspaces.<target>` — named the pointer entry, which the next
+  // deploy overwrites. A declaration resolves back to this root unchanged.
+  const local = resolveWorkspaceRoot();
+  const registry = await readRegistry(await resolveTargetWorkspace(local, target).catch(() => local));
+  return registry[target]?.lanes_workspace;
+}
+
+export interface MembersFlags extends GlobalFlags {
+  readonly json?: boolean | undefined;
+  /** Add the signed-in subject, rather than one typed out. */
+  readonly me?: boolean | undefined;
+  readonly role?: string | undefined;
+}
+
+export async function membersAdd(
+  subject: string | undefined,
+  flags: MembersFlags,
+): Promise<void> {
+  const { resolution, config, target } = await resolveProfile(flags);
+  const session = await readSession();
+
+  const wanted = flags.me === true ? session?.subject : subject;
+
+  if (wanted === undefined) {
+    throw new ConfigError(
+      flags.me === true
+        ? 'Not signed in, so there is no "me" to add. Run: lanes auth login'
+        : 'Which subject? Run: lanes link profile members add <subject> --profile <name>\n' +
+          '  Or add yourself: lanes link profile members add --me --profile <name>',
+    );
+  }
+
+  const role = flags.role === 'owner' ? 'owner' : 'member';
+
+  if (config.members.some((member) => member.subject === wanted)) {
+    print(style.dim(`${resolution.profile} already lists ${wanted}.`));
+    return;
+  }
+
+  await assertDelegatable(wanted, target, session?.subject);
+
+  const document = await ConfigDocument.open(resolution.workspaceRoot, resolution.profile);
+  document.addTo(['members'], { subject: wanted, role }, { inline: true });
+  await document.save();
+
+  await recordConfigChange(
+    config,
+    resolution.workspaceRoot,
+    target,
+    {
+      capability: 'config.member.add',
+      scope: resolution.profile,
+      arguments: { subject: wanted, role },
+    },
+    (note) => print(warn(note)),
+  );
+
+  const published = nextAfterEdit(await publishProfileEdit({ resolution, config, target }));
+
+  return emit(flags.json, { profile: resolution.profile, subject: wanted, role }, () => {
+    announce(resolution);
+    print(ok(`${wanted} may now consume ${style.bold(resolution.profile)} as ${role}`));
+    print(style.dim('      They reach exactly what this profile grants, and nothing else.'));
+    if (published) print(style.dim(`      ${published}`));
+  });
+}
+
+export async function membersRemove(
+  subject: string | undefined,
+  flags: MembersFlags,
+): Promise<void> {
+  const { resolution, config, target } = await resolveProfile(flags);
+  if (!subject) throw new ConfigError('Which subject? Run: lanes link profile members list');
+
+  const at = config.members.findIndex((member) => member.subject === subject);
+  if (at === -1) {
+    print(style.dim(`${resolution.profile} does not list ${subject}.`));
+    return;
+  }
+
+  const document = await ConfigDocument.open(resolution.workspaceRoot, resolution.profile);
+  document.removeFrom(['members'], at);
+  await document.save();
+
+  await recordConfigChange(
+    config,
+    resolution.workspaceRoot,
+    target,
+    { capability: 'config.member.remove', scope: resolution.profile, arguments: { subject } },
+    (note) => print(warn(note)),
+  );
+
+  const published = nextAfterEdit(await publishProfileEdit({ resolution, config, target }));
+
+  return emit(flags.json, { profile: resolution.profile, subject }, () => {
+    announce(resolution);
+    print(ok(`${subject} may no longer consume ${style.bold(resolution.profile)}`));
+
+    // The half that is not obvious, and is the difference between this and a
+    // session manager. A token already issued keeps working until it expires:
+    // membership is read when one is minted, not on every call (ADR-060).
+    print(
+      style.dim(
+        '      A token they already hold keeps working until it expires.\n' +
+          `      To close that window now: lanes link token rotate --workspace ${target}`,
+      ),
+    );
+    if (published) print(style.dim(`      ${published}`));
+  });
+}
+
+/**
+ * Whether this workspace may delegate to that subject.
+ *
+ * The check exists because the alternative is a profile listing a subject
+ * nobody can produce a token for — which reads exactly like a working
+ * delegation until the person tries to use it.
+ *
+ * Bound to a Lanes workspace, the answer is the workspace's own member list:
+ * somebody added on the dashboard is delegatable here, and nobody else is.
+ * Unbound, there is no list to ask, so the only verifiable subject is the one at
+ * the keyboard.
+ */
+async function assertDelegatable(
+  subject: string,
+  target: string,
+  signedIn: string | undefined,
+): Promise<void> {
+  const bound = await boundWorkspace(target);
+
+  if (bound === undefined) {
+    if (subject === signedIn) return;
+
+    throw new ConfigError(
+      `Workspace "${target}" is not bound to a Lanes workspace, so it can only delegate to you.\n` +
+        '  Add yourself with: lanes link profile members add --me\n' +
+        '  To delegate to somebody else, bind the workspace:\n' +
+        `    lanes_workspace: <id>   # in lanes-link.yaml, under workspaces.${target}\n` +
+        '  Run "lanes auth workspaces" for the ids you belong to.',
+    );
+  }
+
+  const held = await workspaceMembers(bound);
+
+  // Unreachable rather than empty. Refusing on a network failure would make a
+  // local edit depend on our uptime, and the endpoint verifies the subject when
+  // it mints a token regardless — so this warns and proceeds.
+  if (held.unavailable !== null) {
+    print(
+      style.dim(
+        `  Could not check the workspace's members (${held.unavailable}), so this was not verified.`,
+      ),
+    );
+    return;
+  }
+
+  const match = held.members.find((member) => member.subject === subject);
+  if (match !== undefined) return;
+
+  // A pending invitation is the interesting refusal: the person exists, the
+  // operator can see them on the dashboard, and there is still no subject to
+  // write down. Saying "not a member" would send them to add somebody who is
+  // already there.
+  const pending = held.members.filter((member) => member.status === 'pending');
+
+  throw new ConfigError(
+    `${subject} is not a member of the Lanes workspace behind "${target}".\n` +
+      (held.members.length > 0
+        ? `  It holds: ${held.members.map(describeMember).join(', ')}\n`
+        : '  It holds nobody yet.\n') +
+      (pending.length > 0
+        ? `  ${pending.map(describeMember).join(', ')} ${pending.length === 1 ? 'has' : 'have'} not ` +
+          'accepted the invitation yet, so there is no subject for them to be granted.\n'
+        : '') +
+      '  Invite them on the dashboard first: https://lanes.sh/dashboard/settings/members',
+  );
+}

package/src/cli/commands/operate/attach.ts

@@ -2,7 +2,7 @@ import { readFile } from 'node:fs/promises';
 import { basename } from 'node:path';
 import { ownerPrincipal } from '#auth';
 import { announce, print, style } from '../../output.ts';
-import { openRuntime, type GlobalFlags } from '../../runtime.ts';
+import { grantedConnections, openRuntime, type GlobalFlags } from '../../runtime.ts';
 
 /**
  * `lanes link attach <file> --connection <provider>.<account>`
@@ -44,11 +44,11 @@ export async function attachFile(
 
     // Checked against config rather than trusted, so a typo names the mistake
     // instead of staging into a namespace nothing will ever read.
-    const known = runtime.config.connections.some(
+    const known = grantedConnections(runtime).some(
       (connection) => connection.provider === providerId && connection.id === connectionId,
     );
     if (!known) {
-      const have = runtime.config.connections.map((c) => `${c.provider}.${c.id}`);
+      const have = grantedConnections(runtime).map((c) => `${c.provider}.${c.id}`);
       throw new Error(
         `No connection "${flags.connection}" in this profile. Configured: ${have.join(', ') || 'none'}.`,
       );

package/src/cli/commands/operate/audit.ts

@@ -1,5 +1,5 @@
-import { announce, print, style, table } from '../../output.ts';
-import { openRuntime, type GlobalFlags } from '../../runtime.ts';
+import { announceWorkspace, print, style, table } from '../../output.ts';
+import { openWorkspaceRuntime, type GlobalFlags } from '../../runtime.ts';
 
 /** `lanes link audit tail` — the log the dispatcher writes, rendered for a terminal. */
 
@@ -15,11 +15,11 @@ export async function auditTail(
   }
   const markdown = flags.format === 'md';
 
-  const runtime = await openRuntime(flags);
+  const runtime = await openWorkspaceRuntime(flags);
   try {
     // The banner is chrome around a table; in Markdown it is a stray line in
     // the middle of a document someone is pasting somewhere.
-    if (!markdown) announce(runtime.resolution);
+    if (!markdown) announceWorkspace(runtime.resolution);
 
     const events = await runtime.audit.tail({
       limit: flags.limit ?? 25,
@@ -35,7 +35,11 @@ export async function auditTail(
       // The log lives in the database; this is a rendering of it, not a second
       // copy of it. See ADR-013 — storage format and display format are not the
       // same decision.
-      print(`# Audit — ${runtime.resolution.profile}\n`);
+      // The workspace, not the profile. Contract 3 gave the workspace one
+      // chain covering every profile in it, and a heading naming whichever
+      // profile happened to open the store described a log that does not
+      // exist. Each row carries its own profile.
+      print(`# Audit — ${runtime.resolution.target}\n`);
       print('| Time | Result | Capability | Connection | Duration | Arguments |');
       print('|---|---|---|---|---|---|');
       for (const event of events) {
@@ -81,9 +85,9 @@ export async function auditTail(
  * can see how much was looked at.
  */
 export async function auditVerify(flags: GlobalFlags): Promise<void> {
-  const runtime = await openRuntime(flags);
+  const runtime = await openWorkspaceRuntime(flags);
   try {
-    announce(runtime.resolution);
+    announceWorkspace(runtime.resolution);
     const report = await runtime.audit.verify();
 
     const scope = `${report.events} event${report.events === 1 ? '' : 's'} across ${report.runs} run${report.runs === 1 ? '' : 's'}`;

package/src/cli/commands/operate/auth.ts

@@ -1,8 +1,15 @@
+import type { ConnectionConfig } from '#profile';
 import { credentialResolver, ReauthRequired } from '#connectivity/auth/index.ts';
 import type { ResolvedCredential } from '#connectivity/auth/credential.ts';
 import { credentialRefFor } from '#registry';
-import { announce, emit, fail, ok, print, warn } from '../../output.ts';
-import { openRuntime, type GlobalFlags, type Runtime } from '../../runtime.ts';
+import { announceWorkspace, emit, fail, ok, print, warn } from '../../output.ts';
+import { readConnections } from '#profile';
+import {
+  grantedConnections,
+  openWorkspaceRuntime,
+  type GlobalFlags,
+  type Runtime,
+} from '../../runtime.ts';
 
 /**
  * Whether each connection could still authenticate, asked rather than guessed.
@@ -146,13 +153,13 @@ export interface AuthFlags extends GlobalFlags {
  */
 export async function probeConnections(
   runtime: Runtime,
-  connections: readonly Runtime['config']['connections'][number][],
+  connections: readonly ConnectionConfig[],
   forSelection: (command: string) => string,
 ): Promise<ConnectionAuth[]> {
   const resolve = credentialResolver(runtime.registry, runtime.credentials);
 
   const probe = async (
-    connection: Runtime['config']['connections'][number],
+    connection: ConnectionConfig,
   ): Promise<ConnectionAuth> => {
     const key = `${connection.provider}.${connection.id}`;
     const manifest = runtime.manifestFor(connection.provider);
@@ -245,20 +252,30 @@ export async function probeConnections(
 }
 
 export async function auth(flags: AuthFlags): Promise<void> {
-  const runtime = await openRuntime(flags);
+  const runtime = await openWorkspaceRuntime(flags);
 
   try {
     const { profile, target } = runtime.resolution;
-    const forSelection = (command: string) => `${command} --profile ${profile} --target ${target}`;
+    const forSelection = (command: string) => `${command} --workspace ${target}`;
+
+    // Every connection the workspace holds, not the ones one profile grants.
+    // Whether an account can still authenticate is a fact about the account
+    // (ADR-057), and scoping it to a profile's grants meant an account that had
+    // just been connected could not be checked until somebody granted it —
+    // which is exactly the moment you want to check.
+    //
+    // `--profile` narrows to what that profile can reach, because "can the
+    // things this profile uses still sign in" is also a real question.
+    const all = flags.profile === undefined
+      ? (await readConnections(runtime.resolution.workspaceRoot)).connections
+      : grantedConnections(runtime);
 
     const wanted = flags.connection;
-    const connections = wanted
-      ? runtime.config.connections.filter((c) => `${c.provider}.${c.id}` === wanted)
-      : runtime.config.connections;
+    const connections = wanted ? all.filter((c) => `${c.provider}.${c.id}` === wanted) : all;
 
     if (wanted && connections.length === 0) {
       throw new Error(
-        `No connection "${wanted}" in profile ${profile}. Run: ${forSelection('lanes link status')}`,
+        `No connection "${wanted}" in workspace ${target}. Run: ${forSelection('lanes link connection list')}`,
       );
     }
 
@@ -270,7 +287,7 @@ export async function auth(flags: AuthFlags): Promise<void> {
     // why it cannot read `doctor`. A connection needing a person is the answer
     // this command was asked for, not a failure to produce one.
     return emit(flags.json, { profile, target, ok: needsSomeone.length === 0, connections: results }, () => {
-      announce(runtime.resolution);
+      announceWorkspace(runtime.resolution);
 
       for (const result of results) {
         const line = `${result.key} — ${describe(result.verdict)}`;

package/src/cli/commands/operate/findings.ts

@@ -1,3 +1,4 @@
+import { grantedConnections } from '../../runtime.ts';
 import { ownerPrincipal } from '#auth';
 import type { DiscoveredCapability } from '#connectivity';
 import { allowedConnections } from '#policy';
@@ -49,7 +50,7 @@ export async function reportCapabilityDrift(
   const principal = ownerPrincipal(runtime.config.instance.profile).id;
 
   for (const entry of runtime.registry.list()) {
-    const connection = runtime.config.connections.find((c) => c.provider === entry.manifest.id);
+    const connection = grantedConnections(runtime).find((c) => c.provider === entry.manifest.id);
     if (!connection) continue;
 
     const connector = runtime.connectorFor(entry.manifest.id, connection.id);

package/src/cli/commands/operate/inspect.ts

@@ -1,4 +1,5 @@
 import { formatPlan, planIsNoop, planReconcile } from '#registry';
+import type { ConnectionConfig, SelectedConnection } from '#profile';
 import { DEFAULT_SURFACES } from '../../config-repair.ts';
 import { announce, announceProfile, emit, fail, ok, print, warn } from '../../output.ts';
 import { staleNudge } from '../../release.ts';
@@ -16,6 +17,18 @@ import { migratedContract, migratedRenamedProviders } from './migrate.ts';
  */
 
 /** Static validation only. No external calls, no database, no credentials. */
+/**
+ * The accounts this profile actually reaches, as reconcile wants them.
+ *
+ * A profile grants a subset of the workspace's connections (ADR-057), and
+ * reconcile is about the ones it reaches: an account granted to nobody has no
+ * state to keep in step, and marking it `disabled` here would fight with the
+ * profile next door that does grant it.
+ */
+function grantedConnections(runtime: { connections: readonly SelectedConnection[] }): ConnectionConfig[] {
+  return runtime.connections.map(({ connection }) => connection);
+}
+
 export async function check(flags: GlobalFlags): Promise<void> {
   const { selection, config } = await resolveProfileOnly(flags);
   announceProfile(selection);
@@ -25,8 +38,10 @@ export async function check(flags: GlobalFlags): Promise<void> {
   // validates a file, and the file is the same whichever target reads it.
   print(ok(`${selection.profilePath} is valid`));
   print(
-    `      ${config.connections.length} connection(s), ` +
-      `${config.policy.allow.length} allow rule(s), ${config.policy.deny.length} deny rule(s)`,
+    `      ${config.grants.length} grant(s), ` +
+      `${config.grants.reduce((n, g) => n + g.allow.length, 0)} allow rule(s), ` +
+      `${config.grants.reduce((n, g) => n + g.deny.length, 0)} deny rule(s), ` +
+      `${config.members.length} member(s)`,
   );
 }
 
@@ -35,7 +50,7 @@ export async function plan(flags: GlobalFlags): Promise<void> {
   const runtime = await openRuntime(flags);
   try {
     announce(runtime.resolution);
-    const result = await planReconcile(runtime.config, runtime.state, runtime.credentials, runtime.manifestFor);
+    const result = await planReconcile(grantedConnections(runtime), runtime.state, runtime.credentials, runtime.manifestFor);
     print(formatPlan(result));
   } finally {
     await runtime.close();
@@ -100,7 +115,7 @@ export async function doctor(flags: DoctorFlags): Promise<void> {
 
   try {
     const forSelection = (command: string) =>
-      `${command} --profile ${runtime.resolution.profile} --target ${runtime.resolution.target}`;
+      `${command} --profile ${runtime.resolution.profile} --workspace ${runtime.resolution.target}`;
 
     checks.push('config is valid');
     checks.push('state store is reachable');
@@ -134,7 +149,7 @@ export async function doctor(flags: DoctorFlags): Promise<void> {
     // `probeConnections` answers it by attempting the renewal, which is the only
     // thing that actually knows. Same classifier as `lanes link auth`, so the two
     // cannot drift apart again.
-    const probed = await probeConnections(runtime, runtime.config.connections, forSelection);
+    const probed = await probeConnections(runtime, grantedConnections(runtime), forSelection);
 
     for (const result of probed) {
       switch (result.verdict) {
@@ -209,7 +224,7 @@ export async function doctor(flags: DoctorFlags): Promise<void> {
       }
     }
 
-    for (const name of new Set(runtime.config.connections.map((c) => c.provider))) {
+    for (const name of new Set(grantedConnections(runtime).map((one) => one.provider))) {
       if (!runtime.registry.has(name)) {
         problems.push({
           kind: 'unknown_provider',
@@ -236,22 +251,25 @@ export async function doctor(flags: DoctorFlags): Promise<void> {
     // covering it is not reported. That is the same rule the repair follows, and
     // reading it here from `policy.deny` rather than asking the repair keeps
     // `doctor` a read.
-    const denied = (rule: string): boolean =>
-      runtime.config.policy.deny.some(
-        (entry) => entry.capability === '*' || entry.capability === rule,
-      );
+    // A grant row *is* the connection and the rule together now (ADR-058), so
+    // "has a row but no rule" is a state that stopped existing — which removes
+    // the half-repaired case this check was originally written for. What is left
+    // is one question per surface: does this profile grant one, and is the grant
+    // more than a deny.
+    const grantFor = (provider: string) =>
+      runtime.config.grants.find((grant) => grant.connection.startsWith(`${provider}.`));
 
     const missing = DEFAULT_SURFACES.filter((provider) => {
-      const rule = `${provider}.*`;
-      if (denied(rule)) return false;
+      const grant = grantFor(provider);
+      if (grant === undefined) return true;
 
-      const hasRow = runtime.config.connections.some(
-        (connection) => connection.provider === provider,
-      );
-      const granted = runtime.config.policy.allow.some(
+      const rule = `${provider}.*`;
+      const denied = grant.deny.some(
         (entry) => entry.capability === '*' || entry.capability === rule,
       );
-      return !hasRow || !granted;
+      if (denied) return false;
+
+      return !grant.allow.some((entry) => entry.capability === '*' || entry.capability === rule);
     });
 
     if (missing.length > 0) {
@@ -287,7 +305,7 @@ export async function doctor(flags: DoctorFlags): Promise<void> {
       warnings.push({ kind: 'capability_drift', message }),
     );
 
-    const drift = await planReconcile(runtime.config, runtime.state, runtime.credentials, runtime.manifestFor);
+    const drift = await planReconcile(grantedConnections(runtime), runtime.state, runtime.credentials, runtime.manifestFor);
     if (!planIsNoop(drift)) {
       warnings.push({
         kind: 'reconcile_drift',
@@ -309,7 +327,7 @@ export async function doctor(flags: DoctorFlags): Promise<void> {
     const rotation = await unboundRotatableRefs({
       deploy: runtime.declared.deploy,
       target: runtime.target,
-      connections: runtime.config.connections,
+      connections: grantedConnections(runtime),
       manifestFor: runtime.manifestFor,
     });
     if (rotation.unbound.length > 0) {

package/src/cli/commands/operate/migrate.ts

@@ -1,7 +1,10 @@
-import { ConfigError, resolveSelection, resolveTargetWorkspace, resolveWorkspaceRoot } from '#profile';
+import {
+  CONNECTIONS_FILE,
+  listProfiles, ConfigError, resolveSelection, resolveTargetWorkspace, resolveWorkspaceRoot,
+  SUPPORTED_CONTRACT } from '#profile';
 import { ConfigDocument } from '../../config-edit.ts';
 import { migrateRenamedProviders, pendingRenames, shapeOf } from '../../config-migrate.ts';
-import { migrateWorkspace, needsMigration } from '../../workspace-migrate.ts';
+import { migrateToCurrentContract } from '../../workspace-migrate.ts';
 import { emit, fail, ok, print, style, warn } from '../../output.ts';
 import { openSecretStoreFor, type GlobalFlags } from '../../runtime.ts';
 
@@ -52,16 +55,25 @@ export async function migratedRenamedProviders(
   const root = await resolveTargetWorkspace(localRoot, target).catch(() => localRoot);
 
   const selection = await resolveSelection({ profileFlag: flags.profile, root });
-  const document = await ConfigDocument.open(root, selection.profile);
+
+  // The rename is a property of the *connection*, so it is found in the
+  // workspace's file (ADR-057) — and applied across every profile, because any
+  // of them may grant the row being renamed.
+  const document = await ConfigDocument.openKey(root, CONNECTIONS_FILE);
   if (pendingRenames(document).length === 0) return false;
 
+  const profiles: ConfigDocument[] = [];
+  for (const name of await listProfiles(root)) {
+    profiles.push(await ConfigDocument.open(root, name));
+  }
+
   // Shape-only, because the check this document fails runs after the schema.
   // Throws when it is malformed beyond a rename, which is a better sentence
   // than the referential one it would otherwise be reported under.
-  const config = shapeOf(document);
+  const config = shapeOf(await ConfigDocument.open(root, selection.profile));
   const credentials = await openSecretStoreFor(config, root, target);
 
-  const migration = await migrateRenamedProviders(document, credentials, {
+  const migration = await migrateRenamedProviders(document, profiles, credentials, {
     apply: flags.fix === true,
   });
 
@@ -141,9 +153,14 @@ export async function migratedContract(flags: RenameFlags, refusal: unknown): Pr
   const where = await resolveTargetWorkspace(root, target).catch(() => null);
   if (where === null) return false;
 
-  if (!(await needsMigration(where))) return false;
+  // Running the migration is how "is there anything to do" is answered, rather
+  // than a predicate beside it. The predicate was `needsMigration`, which asks
+  // only about contract 1 — so a contract-2 bucket, the exact thing this
+  // function exists to rescue, returned false here and fell through to the
+  // refusal it was supposed to fix. With `--fix` absent this writes nothing.
+  const migration = await migrateToCurrentContract(where, { apply: flags.fix === true });
+  if (migration.alreadyCurrent) return false;
 
-  const migration = await migrateWorkspace(where, { apply: flags.fix === true });
   const applied = flags.fix === true;
   const remote = where !== root;
 
@@ -166,8 +183,8 @@ export async function migratedContract(flags: RenameFlags, refusal: unknown): Pr
       print();
       print(
         applied
-          ? ok('migrated to contract 2 — a target is declared by the workspace, not by each profile')
-          : warn('this workspace is contract 1, and nothing here reads that any more'),
+          ? ok(`migrated to contract ${SUPPORTED_CONTRACT} — a workspace declares its own adapters, and holds the connections a profile grants`)
+          : warn(`this workspace is behind contract ${SUPPORTED_CONTRACT}, and nothing here reads that any more`),
       );
       for (const change of migration.changes) print(`  ${change}`);
 
@@ -177,15 +194,15 @@ export async function migratedContract(flags: RenameFlags, refusal: unknown): Pr
           style.dim(
             applied
               ? '  The endpoint serving this bucket is running an older image and cannot read\n' +
-                `  what was just written. Roll a new one: lanes link deploy --target ${target}`
-              : `  lanes link deploy --target ${target} migrates it and ships the image that\n` +
+                `  what was just written. Roll a new one: lanes link deploy --workspace ${target}`
+              : `  lanes link deploy --workspace ${target} migrates it and ships the image that\n` +
                 '  understands it, in one step. Prefer that to --fix here.',
           ),
         );
         return;
       }
 
-      if (!applied) print(style.dim(`  Fix it with: lanes link doctor --fix --target ${target}`));
+      if (!applied) print(style.dim(`  Fix it with: lanes link doctor --fix --workspace ${target}`));
     },
   );