@lanes-sh/link 0.7.2 → 0.8.0

package/src/cli/runtime/stores.ts

@@ -0,0 +1,53 @@
+import { layout } from '#profile';
+import type { BlobStore } from '#stores/blobs';
+import type { StorageFactory } from '#deployments/target.ts';
+
+/**
+ * Where the owner layer's bytes are, for a runtime being assembled.
+ *
+ * Split from `open.ts` so that file stays inside the size budget, on the seam
+ * it already had: `open.ts` decides what a runtime *is* and this decides where
+ * one store lives. Both roots are explicit areas rather than derived from
+ * `storage.path`, matching `openState` and `openAudit` — a workspace that moves
+ * its provider blobs does not move the reserved roots beside them.
+ */
+
+/**
+ * A store with nothing in it, for a profile that grants no skills connection.
+ *
+ * Written out rather than imported from `#stores/blobs/testing.ts`: that module
+ * exists for tests, and production code reaching into it is how a test double
+ * ends up on a real path. Five methods, none of which can fail, is cheaper than
+ * the import would be to justify.
+ */
+export const EMPTY_SKILL_STORE: BlobStore = {
+  get: async () => null,
+  put: async () => {
+    throw new Error('this profile grants no skills connection');
+  },
+  has: async () => false,
+  delete: async () => {},
+  list: async () => [],
+};
+
+/**
+ * Where a connection's skills live, in either workspace.
+ *
+ * `data/skills.d/<connection>/`, and deployed the same key under the bucket
+ * prefix. Going through the store rather than a filesystem path is what gives a
+ * deployment skills at all — a path is baked into a container image at build
+ * time and an object key is not, so before ADR-014 a deployed instance could
+ * only ever serve the skills that existed when its image was built.
+ *
+ * **Per connection**, which is the third answer this question has had. Policy
+ * gating `skills.<name>` was the whole isolation story while the bytes were
+ * shared (ADR-012 §1), and it is a weak one: it decides who may *run* a
+ * procedure, not who may read that it exists or what it says. ADR-030 made the
+ * bytes per profile; ADR-059 made them per connection, so two profiles granting
+ * one skills connection share a set and two granting different ones share
+ * nothing.
+ */
+export function skillStore(storage: StorageFactory, connection: string): BlobStore {
+  return storage(layout.skills(connection));
+}
+

package/src/cli/runtime/types.ts

@@ -0,0 +1,106 @@
+import type { BearerAuthenticator } from '#auth';
+import type { SecretStore } from '#secrets';
+import type { AuditReader } from '#audit';
+import type { RuntimeState } from '#stores/state';
+import type { BlobStore } from '#stores/blobs';
+import type { AnyConnector, ProviderManifest } from '#connectivity';
+import type {
+  Config,
+  ConnectionConfig,
+  Resolution,
+  SelectedConnection,
+  TargetConfig,
+} from '#profile';
+import type { ProviderRegistry } from '#registry';
+import type { Dispatcher } from '#dispatch';
+import type { VaultStore } from '#providers/owner.ts';
+import type { KnowledgeStores } from '#deployments/knowledge.ts';
+
+/**
+ * What a command is handed once a profile has been opened.
+ *
+ * Its own file so `open.ts` stays inside the size budget, and because this is
+ * the thing every command in the CLI is written against — a reader looking for
+ * "what do I get" should not have to read the assembly to find it.
+ */
+
+export interface Runtime {
+  readonly resolution: Resolution;
+  readonly config: Config;
+  readonly target: string;
+  /**
+   * The target's adapter set, from the workspace that declares it.
+   *
+   * Here because the config no longer carries it. Every caller that used to
+   * reach `config.targets[target]` — for a `deploy` block, a storage adapter, a
+   * knowledge repository — reads this instead, and reads it without following
+   * the pointer a second time (ADR-052).
+   */
+  readonly declared: TargetConfig;
+  /**
+   * The accounts this profile selects, joined to the grants that govern them.
+   *
+   * The join is done once, here, because everything that asks — status, doctor,
+   * reconcile, setup — wants the same answer and three implementations of it is
+   * three chances to disagree (`profile/connections.ts`).
+   */
+  readonly connections: readonly SelectedConnection[];
+  /** Every account the workspace holds, granted or not. `connection list` reads this. */
+  readonly workspaceConnections: readonly ConnectionConfig[];
+  /** Vendors this workspace registered a client of its own for (`oauth_apps`). */
+  readonly ownClients: readonly string[];
+  readonly state: RuntimeState;
+  /** The durable log, for reading. Copies, if any, are write-only and not here. */
+  readonly audit: AuditReader;
+  readonly credentials: SecretStore;
+  readonly storage: BlobStore;
+  /**
+   * Where this profile's skills are kept — `data/skills.d/<connection>/` locally.
+   *
+   * `undefined` when the profile grants no `skills` connection. That is a real
+   * state rather than an empty one, and it is worth the optionality: the owner
+   * layer arrives granted (ADR-050), so a profile without it was denied it on
+   * purpose, and handing back an empty store would report "no skills" for a
+   * profile that is not allowed to have any — the same answer for two different
+   * facts.
+   */
+  readonly skills: BlobStore | undefined;
+  /**
+   * Present only when this target keeps memory and skills in a repository.
+   *
+   * Nothing on the dispatch path reads it: `storage` and `skills` above are
+   * already pointed at the right bytes, which is the whole design. It is here
+   * so `target show` and `doctor` can say where those bytes are without
+   * re-reading the config, and so the migration can reach the repository it is
+   * committing to.
+   */
+  readonly knowledge?: KnowledgeStores | undefined;
+  /** The vault's own store, so `lanes link vault` reaches the same bytes MCP does. */
+  readonly vault: VaultStore;
+  readonly registry: ProviderRegistry;
+  /**
+   * Re-read the skills into the registry when they have changed on the store.
+   *
+   * Cheap and idempotent — one `list()`, and a rebuild only when the listing
+   * differs from the last one. The caller decides how often to ask.
+   */
+  refreshSkills(): Promise<void>;
+  readonly dispatcher: Dispatcher;
+  readonly authenticator: BearerAuthenticator;
+  /** Same factory the dispatcher uses, exposed for commands that probe upstream. */
+  connectorFor(providerId: string, connectionId: string): AnyConnector | undefined;
+  /**
+   * Same authorizer the dispatcher uses, for the same reason `connectorFor` is here.
+   *
+   * A command that probes upstream needs the credential on the request, and it
+   * must not learn how to put it there — that is one switch on the resolved
+   * shape (`connectivity/auth/authorize.ts`) and a second copy would be a
+   * second answer. `settleIdentity` is the caller: it asks a provider whose
+   * account was just authorised, over whatever method that provider declares.
+   */
+  authorizeRequest(providerId: string, connectionId: string, request: Request): Promise<Request>;
+  /** A provider's manifest, so an omitted `credential_ref` can be derived from it. */
+  manifestFor(providerId: string): ProviderManifest | undefined;
+  close(): Promise<void>;
+}
+

package/src/cli/runtime/vault.ts

@@ -1,4 +1,5 @@
-import { layout, workspacePath } from '#profile';
+import {
+  soleGrantFor, layout, vaultRef, workspacePath } from '#profile';
 import type { SecretStore } from '#secrets';
 import {
   createBlobVaultStore,
@@ -36,10 +37,15 @@ export function openVault(
   const { declared, config, root } = input;
   const vault = declared.vault ?? { adapter: 'file' as const };
 
+  // The vault connection this profile grants (ADR-059). `main` when it grants
+  // none, which keeps a profile that denied the vault opening against the same
+  // document every other profile uses rather than inventing a second one.
+  const connection = soleGrantFor(config, 'vault') ?? 'main';
+
   switch (vault.adapter) {
     case 'file':
       return createFileVaultStore({
-        path: workspacePath(root, vault.path ?? layout.vault(config.instance.profile)),
+        path: workspacePath(root, vault.path ?? layout.vault(connection)),
       });
 
     case 'secret':
@@ -47,15 +53,24 @@ export function openVault(
       // so the credential store holds ciphertext it cannot read. Separate
       // document, separate key, separate environment variable — the backend
       // was never what kept the two stores apart. ADR-022.
+      //
+      // Named per connection, like the file adapter. A `ref` written by hand
+      // still wins, because a deployment that already seals under one name has
+      // to keep opening it — but the default carries the instance, so two
+      // profiles granting different vaults share nothing. Without this only
+      // `file` honoured ADR-059 and every deployed workspace, which uses this
+      // adapter or `blob`, had one document behind every vault connection:
+      // ADR-059 calls that the worst of the three collisions, because the wrong
+      // answer is a credential.
       return createSecretVaultStore({
         store: credentials,
-        ...(vault.ref !== undefined ? { ref: vault.ref } : {}),
+        ref: vaultRef(declared, config),
       });
 
     case 'blob':
       return createBlobVaultStore({
         store: storage(),
-        ...(vault.path !== undefined ? { key: vault.path } : {}),
+        key: vault.path ?? layout.vaultKey(connection),
       });
   }
 }

package/src/cli/runtime/workspace.ts

@@ -0,0 +1,60 @@
+import { ConfigError, listProfiles, openTarget, resolveWorkspaceRoot } from '#profile';
+import { openRuntime, type Runtime } from './open.ts';
+import type { GlobalFlags } from './select.ts';
+
+/**
+ * A runtime for a workspace, when the command does not act on one profile.
+ *
+ * Contract 3 moved the credential store, the audit log, the state store and the
+ * blob root up to the workspace, so a command that opens any of them opens the
+ * same thing whichever profile it was handed. `openRuntime` still wants one,
+ * because a `Runtime` carries a resolved profile — so this picks one rather
+ * than making the caller ask a question with no answer.
+ *
+ * `--profile` still narrows where narrowing means something: the audit log is
+ * one chain and the flag filters it, rather than selecting which log to read.
+ * What it must never do is *decide* anything, which is why the profile chosen
+ * here when none is given is simply the first and is never reported as though
+ * it were the subject.
+ */
+export async function openWorkspaceRuntime(flags: GlobalFlags): Promise<Runtime> {
+  if (flags.profile !== undefined) return openRuntime(flags);
+
+  const root = resolveWorkspaceRoot();
+  const resolved = await openTarget(root, flags.target!);
+  const names = await listProfiles(resolved.workspaceRoot);
+
+  if (names.length === 0) {
+    throw new ConfigError(
+      `Workspace "${flags.target}" holds no profiles, so there is nothing to open.\n` +
+        `  Create one with: lanes link profile add <name> --workspace ${flags.target}`,
+    );
+  }
+
+  return openRuntime({ ...flags, profile: names[0]! });
+}
+
+/**
+ * Which profile a workspace-level command should act *as*.
+ *
+ * Distinct from `openWorkspaceRuntime` because the caller needs the name rather
+ * than a runtime — `start` puts it back into flags and hands them on. Same rule:
+ * `--profile` wins, and otherwise the first is taken without being reported as
+ * a choice, because for the things this is used for it is not one.
+ */
+export async function primaryProfile(flags: GlobalFlags): Promise<string> {
+  if (flags.profile !== undefined) return flags.profile;
+
+  const root = resolveWorkspaceRoot();
+  const resolved = await openTarget(root, flags.target!);
+  const names = await listProfiles(resolved.workspaceRoot);
+
+  if (names.length === 0) {
+    throw new ConfigError(
+      `Workspace "${flags.target}" holds no profiles, so there is nothing to serve.\n` +
+        `  Create one with: lanes link profile add <name> --workspace ${flags.target}`,
+    );
+  }
+
+  return names[0]!;
+}

package/src/cli/runtime.ts

@@ -32,4 +32,5 @@ export {
   type OwnerLayerOptions,
 } from './runtime/registry.ts';
 
-export { openRuntime, type OpenOptions, type Runtime } from './runtime/open.ts';
+export { grantedConnections, openRuntime, type OpenOptions, type Runtime } from './runtime/open.ts';
+export { openWorkspaceRuntime, primaryProfile } from './runtime/workspace.ts';

package/src/cli/selection-require.ts

@@ -1,5 +1,6 @@
 import {
   listProfiles,
+  readWorkspace,
   noProfileNamed,
   noTargetNamed,
   readRegistry,
@@ -7,7 +8,7 @@ import {
   resolveWorkspaceRoot,
 } from '#profile';
 import type { Flags } from './argv.ts';
-import { dispatchWillRefuse, requirementFor } from './selection.ts';
+import { EXPLICIT_WORKSPACE, dispatchWillRefuse, requirementFor, selectionKey } from './selection.ts';
 import { refuseIfUnmigrated } from './workspace-migrate.ts';
 
 /**
@@ -46,26 +47,40 @@ export async function requireSelection(
 
   const root = resolveWorkspaceRoot(env ? { env } : {});
 
-  // **Target before profile, for both levels.** It used to ask for the profile
-  // and read that profile's own target list — the ordering ADR-052 inverted,
-  // since the profile lives inside the target and there is nowhere to look for
-  // one until the target is known. `refuseIfUnmigrated` is on the refusal path
-  // only, so it costs nothing when the flag is present.
-  if (typeof flags['target'] !== 'string') {
-    await refuseIfUnmigrated(root);
-    throw noTargetNamed(await readRegistry(root), root, env);
+  // **Workspace before profile, for both levels.** It used to ask for the
+  // profile and read that profile's own target list — the ordering ADR-052
+  // inverted, since a profile lives inside a workspace and there is nowhere to
+  // look for one until the workspace is known. `refuseIfUnmigrated` is on the
+  // refusal path only, so it costs nothing when the flag is present.
+  if (typeof flags['workspace'] !== 'string') {
+    const fallback = EXPLICIT_WORKSPACE.has(selectionKey(first, second))
+      ? undefined
+      : (await readWorkspace(root))?.default_workspace;
+
+    if (fallback === undefined) {
+      await refuseIfUnmigrated(root);
+      throw noTargetNamed(await readRegistry(root), root, env, {
+        refusedDefault: EXPLICIT_WORKSPACE.has(selectionKey(first, second)),
+      });
+    }
+
+    // Written back onto the flags so every command downstream reads one key and
+    // cannot tell a default from a typed flag — the difference belongs in the
+    // line printed above the output, not in thirty call sites (ADR-061).
+    flags['workspace'] = fallback;
+    defaulted.add(fallback);
   }
 
-  // A named target the registry cannot know, because it does not exist yet.
-  if (!(flags['target'] in (await readRegistry(root)))) await refuseIfUnmigrated(root);
+  // A named workspace the registry cannot know, because it does not exist yet.
+  if (!(flags['workspace'] in (await readRegistry(root)))) await refuseIfUnmigrated(root);
 
-  if (needs === 'target') return;
+  if (needs === 'workspace') return;
 
   if (typeof flags['profile'] !== 'string') {
     // Listed from the target's own workspace, so the names offered are ones that
     // command could act on. An unreachable pointer degrades to the empty list
     // rather than failing — "which profile" is still the question being asked.
-    const where = await resolveTargetWorkspace(root, flags['target']).catch(() => root);
+    const where = await resolveTargetWorkspace(root, flags['workspace'] as string).catch(() => root);
     throw noProfileNamed(where, await listProfiles(where).catch(() => []), env);
   }
 }
@@ -77,3 +92,19 @@ export async function requireSelection(
  * that listing it per command would be noise. `--quiet` is read by `announce`
  * rather than by any one command.
  */
+
+/**
+ * Workspaces resolved from `default_workspace` rather than from a flag.
+ *
+ * A set rather than a boolean because `announce` is called from thirty places
+ * and none of them threads a resolution result through — and because the thing
+ * being remembered is small, true for one run, and read exactly once per line
+ * of output. If the echo is ever dropped for tidiness, ADR-061 has been
+ * reversed: the printed line is the whole of what makes a sticky default
+ * different from the dotfile nothing prints.
+ */
+const defaulted = new Set<string>();
+
+export function wasDefaulted(workspace: string): boolean {
+  return defaulted.has(workspace);
+}