@lanes-sh/link 0.7.2 → 0.9.0

package/src/cli/commands/profile/removal.ts

@@ -1,8 +1,22 @@
-import { layout, profilePath, workspacePath, type Config, type TargetConfig } from '#profile';
+import {
+  layout,
+  PROFILE_FILE,
+  profilePath,
+  vaultRef,
+  workspacePath,
+  type Config,
+  type TargetConfig,
+} from '#profile';
 import type { SecretStore } from '#secrets';
 import type { BlobStore } from '#stores/blobs';
 import { credentialRefFor, ownClientRefsFor, type ProviderRegistry } from '#registry';
 import { print, style, warn } from '../../output.ts';
+import {
+  migratesAcross,
+  refuseSealedVault,
+  resolveCollisions,
+  type Disposition,
+} from './disposition.ts';
 
 /**
  * What a profile's removal is allowed to delete, worked out before any of it
@@ -32,37 +46,69 @@ import { print, style, warn } from '../../output.ts';
  */
 export function declaredRefs(
   config: Config,
-  registry: ProviderRegistry,
   declared: TargetConfig,
+  /**
+   * What the profiles that are staying declare.
+   *
+   * Nothing in here is deleted, however plainly the profile being removed also
+   * declares it. The credential store is one file per *workspace* since
+   * contract 3, and every profile takes the template default
+   * `token_ref: profile/token` — so removing one profile deleted the endpoint
+   * token the others are served by, and the deployed revision then refused every
+   * request with "No profile token in this target's credential store". The vault
+   * ref is read off the target and is identical for every profile there, which
+   * made the sibling's sealed items unrecoverable in the same command.
+   */
+  survivors: readonly Config[] = [],
 ): string[] {
   const refs = new Set<string>([config.auth.token_ref]);
 
   // Read off the *target*, not the profile. `vaultTargetSchema` sits inside
-  // `targetSchema`, so two targets may seal the same profile's items in
-  // different places; taking it from the profile would attach one target's
-  // vault to another target's removal.
+  // `targetSchema`, so two targets may seal the same items in different places;
+  // taking it from the profile would attach one target's vault to another
+  // target's removal.
+  //
+  // **Through `vaultRef`, because the name carries the connection.** This said
+  // `vault/document`, the contract-2 constant, while `openVault` seals under
+  // `vault/<connection>` (ADR-059) — so removing a profile queued a ref nothing
+  // had ever written and left the real document behind. Under-deletion rather
+  // than over, since the survivor set was wrong the same way and they cancelled,
+  // but what stayed behind is sealed credential material belonging to a profile
+  // the operator asked to be gone. Per connection also makes the survivor check
+  // mean something: two profiles granting different vaults no longer look like
+  // one document to it.
   if (declared.vault?.adapter === 'secret') {
-    refs.add(declared.vault.ref ?? 'vault/document');
+    refs.add(vaultRef(declared, config));
   }
 
-  for (const connection of config.connections) {
-    const manifest = registry.manifest(connection.provider);
-
-    // `credentialRefFor` rather than `credentialRefForConnection`: it is the
-    // single authority on where a connection's credential lives, and it exists
-    // because two callers once derived the answer differently and disagreed.
-    // Asking the lower-level one here would open that gap again from a third
-    // side — and it would miss a `local` provider, whose only ref is the one
-    // the connection declares itself.
-    const ref = credentialRefFor(connection, manifest);
-    if (ref) refs.add(ref);
-
-    if (manifest) {
-      for (const own of ownClientRefsFor(manifest, config.oauth_apps)) refs.add(own);
-    }
+  // **No connection credentials.** They belong to the workspace now (ADR-057),
+  // and every one of them may be granted by a profile that is staying. Removing
+  // a profile therefore removes no account and no credential — `lanes link
+  // disconnect` is the command that does that, and it is the one that knows how
+  // to check whether anybody else still needs the credential first.
+  //
+  // This is the sharpest edge in the whole decoupling, so `renderPlan` says it
+  // out loud rather than leaving an operator to infer it from a short list:
+  // "remove the work profile" used to mean "revoke what work could reach", and
+  // it does not any more.
+  if (config.auth.authorization?.mode === 'oidc') {
+    refs.add(config.auth.authorization.client_id_ref);
   }
 
-  return [...refs];
+  // Shared with a profile that is staying, so not ours to delete. Computed the
+  // same way for the survivors as for this one, because "what does a profile
+  // declare" has to have one answer.
+  const kept = new Set(
+    survivors.flatMap((other) => [
+      other.auth.token_ref,
+      ...(declared.vault?.adapter === 'secret' ? [vaultRef(declared, other)] : []),
+      ...(other.auth.authorization?.mode === 'oidc'
+        ? [other.auth.authorization.client_id_ref]
+        : []),
+    ]),
+  );
+
+  return [...refs].filter((ref) => !kept.has(ref));
 }
 
 export interface RemovalItem {
@@ -71,8 +117,21 @@ export interface RemovalItem {
   readonly kind: 'secret' | 'blob' | 'file' | 'config' | 'workspace-key';
   readonly id: string;
   readonly note?: string;
+  /**
+   * The area `id` is a key within, for a blob.
+   *
+   * Carried rather than derived: the two ends of a migration are two areas and
+   * the executor opens both. Derived once, the plan prefixed the profile
+   * directory onto `id` while the executor opened its default area — the copy
+   * found nothing at the doubled path, wrote nothing, and the directory removal
+   * took the bytes. A `--migrate-to` reported success and lost the data.
+   */
+  readonly area?: string;
+  /** Where this object goes instead of being deleted, as `[area, key]`. */
+  readonly movedTo?: readonly [string, string];
 }
 
+
 export interface RemovalPlan {
   readonly profile: string;
   readonly items: readonly RemovalItem[];
@@ -96,10 +155,21 @@ export interface PlanOptions {
   readonly openSecrets: (target: string) => Promise<SecretStore>;
   readonly openBlobs: (target: string, area?: string) => Promise<BlobStore>;
   readonly readDefaultProfile?: (() => Promise<string | undefined>) | undefined;
+  /** What becomes of this profile's own bytes. */
+  readonly disposition: Disposition;
+  /**
+   * The profiles that are staying.
+   *
+   * So a credential both this one and a survivor declares is left alone — see
+   * `declaredRefs`. Defaulted to empty, which is the single-profile workspace
+   * and the shape every existing caller had.
+   */
+  readonly survivors?: readonly Config[] | undefined;
 }
 
 const reason = (cause: unknown): string => (cause instanceof Error ? cause.message : String(cause));
 
+
 /**
  * Everything removing this profile would delete, before any of it is deleted.
  *
@@ -116,6 +186,9 @@ export async function removalPlan(
   options: PlanOptions,
 ): Promise<RemovalPlan> {
   const items: RemovalItem[] = [];
+  const migrateInto =
+    options.disposition.kind === 'migrate' ? options.disposition.into : undefined;
+  const sealed: string[] = [];
   const untouched: { target: string; refs: string[] }[] = [];
   const warnings: string[] = [];
 
@@ -144,15 +217,16 @@ export async function removalPlan(
       );
     }
 
-    // Secrets first, and this ordering is load-bearing rather than tidy:
-    // `layout.credentials(p)` is `data/<p>/credentials.enc`, *inside* the blob
-    // root `data/<p>`. For the file adapter the credential store is itself a
-    // blob, so blobs-first would delete the store the secret deletions read
-    // through and turn every one of them into a failure.
+    // Secrets, and there is nothing left to order them against. This used to
+    // run before a blob sweep because `layout.credentials(p)` was
+    // `data/<p>/credentials.enc`, *inside* the blob root `data/<p>`, so
+    // blobs-first deleted the store the secret deletions read through. Both the
+    // sweep and the per-profile root are gone (ADR-057, ADR-059) — see the note
+    // below — and the credential store is the workspace's now.
     try {
       const secrets = await options.openSecrets(name);
       const present = await secrets.list();
-      const mine = new Set(declaredRefs(config, registry, declared));
+      const mine = new Set(declaredRefs(config, declared, options.survivors ?? []));
 
       for (const ref of present) if (mine.has(ref)) items.push({ target: name, kind: 'secret', id: ref });
 
@@ -164,53 +238,57 @@ export async function removalPlan(
       );
     }
 
+    // **The sweep is back, bounded by the profile's own directory.** It went
+    // away under ADR-059, when a profile owned no bytes and the blob root was
+    // the whole workspace — listing it then queued every byte in the workspace
+    // for deletion because one profile was going. ADR-066 gives the directory
+    // back, so it means what it used to: what this profile owns, and nothing an
+    // account owns. `lanes link disconnect` is still the command for an
+    // account, and nothing here touches one.
     try {
-      const blobs = await options.openBlobs(name);
-      for (const blob of await blobs.list()) items.push({ target: name, kind: 'blob', id: blob.key });
+      const blobs = await options.openBlobs(name, layout.profileDir(profile));
+      for (const blob of await blobs.list()) {
+        // **Not the declaration.** It is config rather than data, deleted below
+        // as its own item after everything it is the record of. Swept here it
+        // would be counted twice, and on a `--migrate-to` copied into the
+        // destination as a second `profile.yaml` — one profile's grants and
+        // members landing inside another's directory.
+        if (blob.key === PROFILE_FILE) continue;
+
+        const migratable = migrateInto !== undefined && migratesAcross(blob.key);
+
+        items.push({
+          target: name,
+          kind: 'blob',
+          id: blob.key,
+          area: layout.profileDir(profile),
+          ...(migratable
+            ? { movedTo: [layout.profileDir(migrateInto), blob.key] as const }
+            : {}),
+          ...(migrateInto !== undefined && !migratable
+            ? { note: 'not migrated — deleted with the profile' }
+            : {}),
+        });
+
+        if (migrateInto !== undefined && blob.key.startsWith('vault.d/')) sealed.push(blob.key);
+      }
     } catch (cause) {
       warnings.push(
         `Target "${name}": its storage could not be opened (${reason(cause)}), so nothing in it will be removed.`,
       );
     }
 
-    // The blob store's root is the profile's own directory, and an adapter must
-    // never delete the root it was configured with — so emptying it leaves the
-    // directory. `layout.ts` frames that directory as the unit ("rm -r
-    // data/work is exactly remove the work profile's data"), and one left
-    // behind is silently reused by a later `profile add` of the same name.
+    // The store's root is the profile's own directory, and an adapter must never
+    // delete the root it was configured with — so emptying it leaves the
+    // directory, and one left behind is silently reused by a later `profile add`
+    // of the same name.
     if (declared.storage.adapter === 'filesystem') {
-      const blobRoot = declared.storage.path ?? layout.blobs(profile);
       items.push({
         target: name,
         kind: 'file',
-        id: blobRoot,
+        id: layout.profileDir(profile),
         note: 'the profile directory, once emptied',
       });
-
-      // Skills and manifests sit at fixed areas under `data/<profile>/`, the
-      // same way state and the log do — an explicit area, so a profile that
-      // declares its own `storage.path` moves its provider blobs and leaves
-      // these where `layout` says they are. The sweep above walks the blob root
-      // and would then walk straight past them, so they are named. Ordinary
-      // case: both are already inside `blobRoot` and the sweep has them, which
-      // is why this only fires when the two have been pointed apart.
-      //
-      // Resolved before comparing, because they are not compared as paths
-      // otherwise: `newProfileTemplate` writes `./data/<profile>` and
-      // `layout.blobs` returns `data/<profile>`, which is one directory spelled
-      // two ways — the same leading `./` that `profile/layout.ts` has a
-      // paragraph about. Comparing the strings names every default profile's
-      // skills twice in the preview an operator confirms.
-      if (workspacePath(root, blobRoot) !== workspacePath(root, layout.blobs(profile))) {
-        for (const area of [layout.skills(profile), layout.providers(profile)]) {
-          items.push({
-            target: name,
-            kind: 'file',
-            id: area,
-            note: 'outside the declared storage path, so not swept with it',
-          });
-        }
-      }
     }
 
     // A deployed revision reads its config from the bucket rather than the
@@ -220,7 +298,7 @@ export async function removalPlan(
       items.push({
         target: name,
         kind: 'config',
-        id: `profiles/${profile}.yaml`,
+        id: layout.profileConfig(profile),
         note: 'the copy a deployed revision reads',
       });
     }
@@ -250,6 +328,16 @@ export async function removalPlan(
     });
   }
 
+  if (sealed.length > 0) refuseSealedVault(profile, migrateInto!);
+
+  if (migrateInto !== undefined) {
+    warnings.push(
+      ...(await resolveCollisions(items, migrateInto, layout.profileDir(migrateInto), (area) =>
+        options.openBlobs(options.target, area),
+      )),
+    );
+  }
+
   // Last. It is the only record of where everything else lives, so a failure
   // before this point leaves data a later run can still find.
   items.push({ target: null, kind: 'config', id: profilePath(root, profile) });
@@ -287,7 +375,9 @@ export function renderPlan(plan: RemovalPlan): void {
     print(`  ${style.bold(target ?? 'workspace')}`);
     for (const item of items) {
       const note = item.note ? style.dim(` — ${item.note}`) : '';
-      print(`    ${KIND_LABEL[item.kind].padEnd(10)} ${item.id}${note}`);
+      const shown = item.area === undefined ? item.id : `${item.area}/${item.id}`;
+      const into = item.movedTo ? style.dim(` → ${item.movedTo[0]}/${item.movedTo[1]}`) : '';
+      print(`    ${KIND_LABEL[item.kind].padEnd(10)} ${shown}${into}${note}`);
     }
     print();
   }

package/src/cli/commands/profile/remove.ts

@@ -13,6 +13,7 @@ import {
 import { parseDocument } from 'yaml';
 import { rm } from 'node:fs/promises';
 import { terminalPrompter, type Prompter } from '../../prompt.ts';
+import { recordConfigChange } from '../../audit-change.ts';
 import { announceProfile, emit, fail, ok, print, style } from '../../output.ts';
 import {
   buildRegistryWithWorkspace,
@@ -21,7 +22,9 @@ import {
   resolveProfileOnly,
   type GlobalFlags,
 } from '../../runtime.ts';
+import { loadWorkspaceProfiles } from '#profile';
 import { removalPlan, renderPlan, type RemovalItem, type RemovalPlan } from './removal.ts';
+import { settleDisposition, type Disposition } from './disposition.ts';
 
 /**
  * Performing a removal, and being honest about the parts that did not happen.
@@ -60,9 +63,21 @@ export interface RunDeps {
 
 const reason = (cause: unknown): string => (cause instanceof Error ? cause.message : String(cause));
 
-/** The items that only make sense once everything else is actually gone. */
+/**
+ * The items that only make sense once everything else is actually gone.
+ *
+ * **`file` is in here, and that is the whole of its reason.** It is
+ * `rm -rf profiles/<profile>`, and it carries a target rather than `null`, so
+ * the original `target === null` test let it run after a failed object — taking
+ * the bytes a `--migrate-to` had not managed to copy, and `profile.yaml`, which
+ * the sweep deliberately leaves for last. `renderOutcome` then printed "the
+ * profile's config was kept, so nothing is stranded" about a directory that no
+ * longer existed. Same shape as the defect this file records having shipped
+ * once already.
+ */
 const isRecordOfWhereThingsAre = (item: RemovalItem): boolean =>
-  item.target === null && (item.kind === 'config' || item.kind === 'workspace-key');
+  item.kind === 'file' ||
+  (item.target === null && (item.kind === 'config' || item.kind === 'workspace-key'));
 
 export async function executeRemoval(
   plan: RemovalPlan,
@@ -105,9 +120,30 @@ export async function executeRemoval(
           await (await secretStore(item.target!)).delete(item.id);
           break;
 
-        case 'blob':
-          await (await blobStore(item.target!)).delete(item.id);
+        case 'blob': {
+          const store = await blobStore(item.target!, item.area);
+
+          // Read across *before* deleting, and verify it landed — the same rule
+          // the contract migrations follow, for the same reason: a copy that
+          // half happened and a source that is already gone is the one state
+          // with nothing to retry from. A collision was resolved while this was
+          // still a plan, so the destination is free.
+          if (item.movedTo !== undefined) {
+            const [area, key] = item.movedTo;
+            const bytes = await store.get(item.id);
+
+            if (bytes !== null) {
+              const into = await blobStore(item.target!, area);
+              await into.put(key, bytes);
+              if ((await into.get(key)) === null) {
+                throw new Error(`${area}/${key} did not read back after being written`);
+              }
+            }
+          }
+
+          await store.delete(item.id);
           break;
+        }
 
         case 'config':
           if (item.target === null) await deps.removeConfig(item.id);
@@ -239,10 +275,15 @@ export interface RemoveFlags extends GlobalFlags {
   readonly dryRun?: boolean | undefined;
   readonly yes?: boolean | undefined;
   readonly json?: boolean | undefined;
+  /** Delete this profile's memory, tasks, assets, entities, vault and skills. */
+  readonly deleteData?: boolean | undefined;
+  /** Move them into this profile instead. */
+  readonly migrateTo?: string | undefined;
   /** Injected by a caller that has already asked — the console, and tests. */
   readonly prompter?: Prompter | undefined;
 }
 
+
 /**
  * `lanes link profile remove <name>` — the profile, and everything it owns.
  *
@@ -255,16 +296,43 @@ export async function removeProfile(name: string, flags: RemoveFlags): Promise<v
   announceProfile(selection);
 
   const root = selection.workspaceRoot;
-  const registry = await buildRegistryWithWorkspace(root, name);
+  const registry = await buildRegistryWithWorkspace(root);
   const files = workspaceFiles(root);
   const { declared } = await openTarget(root, target);
 
+  const prompter = flags.prompter ?? terminalPrompter;
+  const someoneToAsk = flags.prompter ? prompter.interactive : process.stdin.isTTY;
+  const disposition = await settleDisposition(name, flags, prompter, someoneToAsk);
+
+  if (disposition === null) {
+    print(style.dim('  cancelled — nothing was removed'));
+    return;
+  }
+
+  if (disposition.kind === 'migrate') {
+    // Before the plan, because a plan against a profile that does not exist
+    // would name destinations nothing will ever read.
+    const staying = (await loadWorkspaceProfiles(root)).loaded.map((one) => one.profile);
+    if (disposition.into === name || !staying.includes(disposition.into)) {
+      throw new ConfigError(
+        `Cannot migrate "${name}" into "${disposition.into}".\n` +
+          `  Staying: ${staying.filter((one) => one !== name).join(', ') || 'nothing'}`,
+      );
+    }
+  }
+
   const plan = await removalPlan(config, root, name, registry, {
     target,
     declared,
-    openSecrets: (target) => openSecretStoreFor(config, root, target),
+    disposition,
+    openSecrets: (target) => openSecretStoreFor(root, target),
     openBlobs: (target, area) => openBlobStoreFor(config, root, target, area),
     readDefaultProfile: async () => (await readWorkspace(root))?.default_profile,
+    // What the workspace keeps. The credential store is one file for all of
+    // them now, so anything a survivor declares is not this removal's to delete.
+    survivors: (await loadWorkspaceProfiles(root)).loaded
+      .filter((one) => one.profile !== name)
+      .map((one) => one.config),
   });
 
   renderPlan(plan);
@@ -278,7 +346,7 @@ export async function removeProfile(name: string, flags: RemoveFlags): Promise<v
   if (!(await confirmedByName(name, { yes: flags.yes, prompter: flags.prompter }))) return;
 
   const outcome = await executeRemoval(plan, {
-    openSecrets: (target) => openSecretStoreFor(config, root, target),
+    openSecrets: (target) => openSecretStoreFor(root, target),
     openBlobs: (target, area) => openBlobStoreFor(config, root, target, area),
     removeConfig: async (path) => await files.delete(relativeToRoot(root, path)),
     removeDirectory: async (path) => await rm(workspacePath(root, path), { recursive: true, force: true }),
@@ -286,6 +354,14 @@ export async function removeProfile(name: string, flags: RemoveFlags): Promise<v
     retry: retryCommand,
   });
 
+  // Before the render, and against the config loaded above — the profile's file
+  // is gone by now, so a helper that re-read it would find nothing.
+  await recordConfigChange(config, root, target, {
+    capability: 'config.profile.remove',
+    scope: name,
+    arguments: { connections: config.grants.map((grant) => grant.connection) },
+  });
+
   return emit(flags.json, outcome, () => renderOutcome(outcome));
 }
 

package/src/cli/commands/profile.ts

@@ -1,9 +1,13 @@
+import { newConnectionsTemplate, newProfileTemplate, newWorkspaceTemplate } from '../config-templates.ts';
 import { mkdir, writeFile } from 'node:fs/promises';
 import { existsSync } from 'node:fs';
 import { join } from 'node:path';
 import {
+  CONNECTIONS_FILE,
   ConfigError,
   WORKSPACE_FILE,
+  LEGACY_WORKSPACE_FILE,
+  legacyProfileConfig,
   listProfiles,
   profilePath,
   readWorkspace,
@@ -12,9 +16,13 @@ import {
   writeWorkspaceFile,
   resolveTargetWorkspace,
   resolveWorkspaceRoot,
+  layout,
 } from '#profile';
-import { newProfileTemplate, newWorkspaceTemplate } from '../config-edit.ts';
+
+import { recordConfigChange } from '../audit-change.ts';
+import { resolveProfile } from '../runtime.ts';
 import { emit, ok, print, style, table } from '../output.ts';
+import { readSession } from '#auth/lanes/session.ts';
 
 /**
  * Profile management.
@@ -58,7 +66,7 @@ export interface ProfileListing {
  *
  * It now decides *where the file goes* rather than what is written in it: a
  * profile lives in one target's workspace and declares nothing about it
- * (ADR-052), so `--target cloud` writes into the bucket and the endpoint there
+ * (ADR-052), so `--workspace cloud` writes into the bucket and the endpoint there
  * serves it on its next reconcile.
  */
 export async function createProfile(
@@ -69,19 +77,51 @@ export async function createProfile(
   const target = options.targets[0]!;
 
   // The workspace file before the target is resolved, not after. `profile add
-  // <name> --target local` on an empty directory is how a workspace comes into
+  // <name> --workspace local` on an empty directory is how a workspace comes into
   // existence, and the target it names is declared *by* that file — so writing
   // it second means resolving a target nothing has declared yet.
-  if (!isRemoteWorkspace(local) && !existsSync(join(local, WORKSPACE_FILE))) {
-    await mkdir(local, { recursive: true });
-    await writeFile(join(local, WORKSPACE_FILE), newWorkspaceTemplate(), { mode: 0o600 });
+  // **Either name, and an unmigrated workspace is refused rather than
+  // shadowed.** `resolveWorkspaceRoot` accepts both markers, so this ran
+  // against a contract-3 workspace, found no `workspaces.yaml`, and wrote a
+  // fresh template beside `lanes-link.yaml` — `readWorkspace` prefers the new
+  // name, so every declared target and deployment record vanished, and
+  // `renameRegistry` returns early once the new file exists, so no migration
+  // could put them back.
+  if (!isRemoteWorkspace(local)) {
+    if (existsSync(join(local, LEGACY_WORKSPACE_FILE)) && !existsSync(join(local, WORKSPACE_FILE))) {
+      throw new ConfigError(
+        `${local} is still laid out the way contract 3 kept it, and adding a profile here would ` +
+          'write a second registry beside the one it already has.\n' +
+          '  Migrate it first: lanes link doctor --fix --profile <name> --workspace <name>',
+      );
+    }
+
+    if (!existsSync(join(local, WORKSPACE_FILE))) {
+      await mkdir(local, { recursive: true });
+      await writeFile(join(local, WORKSPACE_FILE), newWorkspaceTemplate(), { mode: 0o600 });
+    }
   }
 
   const root = await resolveTargetWorkspace(local, target);
   const path = profilePath(root, name);
 
-  if (await workspaceFiles(root).has(`profiles/${name}.yaml`)) {
-    throw new Error(`Profile "${name}" already exists at ${path}`);
+  // The connections file comes into existence with the workspace, carrying the
+  // owner layer. It is written before the profile because the profile's grants
+  // name rows in it, and `assertGrantsResolve` refuses a grant with nothing
+  // behind it — so a profile written first would not load until this existed.
+  if (!(await workspaceFiles(root).has(CONNECTIONS_FILE))) {
+    await writeWorkspaceFile(workspaceFiles(root), CONNECTIONS_FILE, newConnectionsTemplate());
+  }
+
+  // Both shapes, for the same reason: `listProfiles` sees a contract-3
+  // `profiles/<name>.yaml` and this did not, so `profile add personal` wrote a
+  // fresh template alongside the operator's own — one name, two files, and the
+  // empty one opened. `doctor --fix` then planned a move onto an occupied
+  // destination and threw on every rerun.
+  for (const key of [layout.profileConfig(name), legacyProfileConfig(name)]) {
+    if (await workspaceFiles(root).has(key)) {
+      throw new Error(`Profile "${name}" already exists at ${root}/${key}`);
+    }
   }
 
   // Only a directory needs making. A bucket has no directories, and the write
@@ -99,10 +139,23 @@ export async function createProfile(
   // sibling's, or asked. It declares no target now (ADR-052): it is written into
   // the workspace of the target it was named with, and that workspace already
   // says where its bytes go.
+  // The signed-in subject, so the profile reaches somebody the moment it
+  // exists. Without it every new profile shipped `members: []` while the
+  // template writes `authorization: mode: self` — an endpoint that advertises
+  // OAuth and lists nobody, where the owner signs in at lanes.sh and is told no
+  // profile lists them. A local stdio or CI caller still worked, which is why a
+  // smoke test passed: those carry `profiles: undefined` and `mayReach` admits
+  // everything.
+  //
+  // Null when nobody is signed in, which is a real state — `lanes auth login`
+  // has not been run yet — and the template then says how to fix it rather than
+  // inventing a subject.
+  const session = await readSession();
+
   await writeWorkspaceFile(
     workspaceFiles(root),
-    `profiles/${name}.yaml`,
-    newProfileTemplate(name, port),
+    layout.profileConfig(name),
+    newProfileTemplate(name, port, session?.subject),
   );
 
   return { name, path, port, targets: options.targets, copiedFrom: {} };
@@ -142,8 +195,8 @@ export async function profileAdd(
   if (options.targets.length === 0) {
     throw new ConfigError(
       'Say which targets this profile declares:\n' +
-        `  lanes link profile add ${name} --target local\n` +
-        `  lanes link profile add ${name} --target local --target cloud\n` +
+        `  lanes link profile add ${name} --workspace local\n` +
+        `  lanes link profile add ${name} --workspace local --workspace cloud\n` +
         '\n' +
         '  A target is where a profile runs — a credential store and a blob store.\n' +
         '  There is no default to inherit before the profile exists.',
@@ -152,11 +205,21 @@ export async function profileAdd(
 
   const created = await createProfile(name, options);
 
+  // Re-read rather than assembled from `created`, because the file on disk is
+  // what a workspace with a remote credential store needs to open one.
+  const primary = created.targets[0]!;
+  const { resolution, config } = await resolveProfile({ profile: created.name, target: primary });
+  await recordConfigChange(config, resolution.workspaceRoot, primary, {
+    capability: 'config.profile.add',
+    scope: created.name,
+    arguments: { port: created.port, workspace: primary },
+  });
+
   return emit(options.json, created, () => {
     print(ok(`created profile ${style.bold(created.name)}`));
     print(`      config   ${created.path}`);
     print(`      port     ${created.port}`);
-    print(`      targets  ${created.targets.join(', ')}`);
+    print(`      workspace  ${created.targets.join(', ')}`);
 
     for (const [target, from] of Object.entries(created.copiedFrom)) {
       print(`      ${style.dim(`${target} adapters copied from profile "${from}"`)}`);
@@ -165,7 +228,7 @@ export async function profileAdd(
     print();
     print(
       style.dim(
-        `Next: lanes link connect example --profile ${created.name} --target ${created.targets[0]}`,
+        `Next: lanes link connect example --profile ${created.name} --workspace ${created.targets[0]}`,
       ),
     );
   });
@@ -180,7 +243,7 @@ export async function profileList(
   return emit(options.json, listing, () => {
     if (listing.profiles.length === 0) {
       print(style.dim(`No profiles in ${listing.root}.`));
-      print(style.dim('Create one with: lanes link profile add personal --target local'));
+      print(style.dim('Create one with: lanes link profile add personal --workspace local'));
       return;
     }
 
@@ -210,7 +273,7 @@ export function profileDefault(name: string | undefined): never {
   throw new ConfigError(
     'lanes link profile default was removed.\n' +
       '  Nothing reads default_profile any more — pass --profile on every command:\n' +
-      `    lanes link status --profile ${name ?? '<name>'} --target <target>\n` +
+      `    lanes link status --profile ${name ?? '<name>'} --workspace <name>\n` +
       '  If the key is still in lanes-link.yaml it is inert, and safe to delete.',
   );
 }