@lanes-sh/link 0.7.2 → 0.9.0

package/src/cli/config-edit.ts

@@ -1,13 +1,22 @@
 import { rename, writeFile } from 'node:fs/promises';
-import { Document, parseDocument, type Node } from 'yaml';
+import { Document, parseDocument, YAMLSeq, type Node } from 'yaml';
 import {
+  CONNECTIONS_FILE,
   ConfigError,
+  WORKSPACE_FILE,
+  LEGACY_WORKSPACE_FILE,
+  workspaceSchema,
+  assertConnectionsUnique,
+  connectionsFileSchema,
+  findSecrets,
+  formatSecretFindings,
   isRemoteWorkspace,
   readWorkspaceFile,
   validateConfig,
   validateConfigShape,
   workspaceFiles,
   writeWorkspaceFile,
+  layout,
 } from '#profile';
 
 /**
@@ -24,6 +33,59 @@ import {
  * refuses to run.
  */
 
+/**
+ * Validate a document against the schema for the file it is.
+ *
+ * The key is the discriminator because it is the only thing that is always
+ * right: a caller could be asked to say which shape it holds, and a caller that
+ * said the wrong one would get the wrong check silently.
+ */
+function validateDocument(
+  raw: unknown,
+  path: string,
+  key: string | undefined,
+  options: { shapeOnly?: boolean; contract?: number },
+): void {
+  // Either name. The contract-3 migration rewrites the registry under the name
+  // it still has, and a document checked against the wrong schema fails with
+  // "instance: expected object" — which reads as a corrupt profile rather than
+  // as a registry being validated as one.
+  if (key === WORKSPACE_FILE || key === LEGACY_WORKSPACE_FILE) {
+    const parsed = workspaceSchema.safeParse(raw);
+    if (!parsed.success) {
+      throw new ConfigError(
+        `${path}:\n${parsed.error.issues.map((issue) => `  ${issue.path.join('.')}: ${issue.message}`).join('\n')}`,
+      );
+    }
+    return;
+  }
+
+  if (key === CONNECTIONS_FILE) {
+    const secrets = findSecrets(raw);
+    if (secrets.length > 0) {
+      throw new ConfigError(
+        `${path}: ${formatSecretFindings(secrets)}`,
+        secrets.map((finding) => finding.path),
+      );
+    }
+
+    const parsed = connectionsFileSchema.safeParse(raw);
+    if (!parsed.success) {
+      throw new ConfigError(
+        `${path}:\n${parsed.error.issues.map((issue) => `  ${issue.path.join('.')}: ${issue.message}`).join('\n')}`,
+      );
+    }
+
+    assertConnectionsUnique(parsed.data.connections);
+    return;
+  }
+
+  // `contract` is the one a migration is *producing*, and it is only ever
+  // passed by one: every other caller writes the newest.
+  if (options.shapeOnly === true) validateConfigShape(raw, path, options.contract);
+  else validateConfig(raw, path, options.contract);
+}
+
 export class ConfigDocument {
   readonly #document: Document;
   readonly #path: string;
@@ -47,7 +109,20 @@ export class ConfigDocument {
    * `gs://` URL produces something that addresses nothing.
    */
   static async open(workspaceRoot: string, profile: string): Promise<ConfigDocument> {
-    const key = `profiles/${profile}.yaml`;
+    return ConfigDocument.openKey(workspaceRoot, layout.profileConfig(profile));
+  }
+
+  /**
+   * Open any document the workspace holds, by key.
+   *
+   * `open` above is this with the profile path spelled out, and stays because
+   * it is what almost every caller wants. This exists for `connections.yaml`,
+   * which is a workspace document rather than a profile's (ADR-057) and needs
+   * the same comment-preserving edit path — a connection row carries the
+   * account label an operator wrote, and rewriting the file through the schema
+   * would drop every comment beside it.
+   */
+  static async openKey(workspaceRoot: string, key: string): Promise<ConfigDocument> {
     const shown = isRemoteWorkspace(workspaceRoot)
       ? `${workspaceRoot}/${key}`
       : `${workspaceRoot}/${key}`;
@@ -132,7 +207,20 @@ export class ConfigDocument {
     // difference decided whether a command explained itself or crashed.
     const existing = this.#document.getIn(path as (string | number)[]);
     if (existing === undefined || existing === null) {
-      this.#document.setIn(path as (string | number)[], [node]);
+      // A `YAMLSeq` rather than the plain `[node]` this used to set. The array
+      // is not a collection the document API will traverse — the same hazard
+      // `setIn` above documents — so the *first* append landed and the second
+      // found a value with no `.add` and threw `existing.add is not a
+      // function`. `#expand` below reads `.items` and was silently a no-op for
+      // the same reason, leaving the sequence in flow style.
+      //
+      // Latent until contract 3: every path this was called with
+      // (`connections`, `policy.allow`) already existed, so the branch ran at
+      // most once per document. `grants:` is genuinely absent on a profile
+      // being repaired, which is what made the second append reachable.
+      const created = new YAMLSeq();
+      created.add(node);
+      this.#document.setIn(path as (string | number)[], created);
     } else {
       (existing as { add(item: unknown): void }).add(node);
     }
@@ -195,13 +283,18 @@ export class ConfigDocument {
    * The half it keeps is the half that matters for a write: the schema, and the
    * scan that stops a credential value being written into config.
    */
-  async save(options: { shapeOnly?: boolean } = {}): Promise<void> {
+  async save(options: { shapeOnly?: boolean; contract?: number } = {}): Promise<void> {
     const rendered = this.toString();
 
     // Throws on any validation failure, including a credential value that has
     // crept in — so a CLI edit can never introduce one.
-    if (options.shapeOnly === true) validateConfigShape(this.#document.toJSON(), this.#path);
-    else validateConfig(this.#document.toJSON(), this.#path);
+    //
+    // Which schema, decided by the key rather than by the caller. This class
+    // edits two shapes now: a profile, and the workspace's `connections.yaml`
+    // (ADR-057). Validating one against the other's schema is not a stricter
+    // check, it is the wrong one — a connections file has no `instance:` block,
+    // so it would be refused for a field it is not supposed to have.
+    validateDocument(this.#document.toJSON(), this.#path, this.#location?.key, options);
 
     if (!this.#location) {
       throw new ConfigError(`${this.#path}: opened from text, so there is nowhere to save it`);
@@ -234,140 +327,3 @@ export class ConfigDocument {
  * Written with comments, because this is the file an operator will read first
  * and most of what it needs to say is *why*, not *what*.
  */
-export function newProfileTemplate(profile: string, port: number): string {
-  return `# Lanes Link profile: ${profile}
-#
-# This file is the source of truth for what exists. It never contains a
-# credential value — only "_ref" pointers into the credential store, which
-# lives beside it and is encrypted at rest.
-#
-# Edit it by hand or through the CLI; both are supported, and CLI edits
-# preserve your comments and ordering.
-contract: 2
-
-instance:
-  profile: ${profile}
-  port: ${port}
-  host: 127.0.0.1
-
-# This file says nothing about where it runs, and that is the point.
-#
-# A profile lives in exactly one target, and the target is the workspace holding
-# this file — which declares its own adapters, once, in lanes-link.yaml beside
-# the profiles/ directory (ADR-052). Moving this profile somewhere else is
-# copying the file there; there is no block in it to edit.
-#
-# Every command still names both, because neither is inferred (ADR-037):
-#
-#     lanes link status --profile ${profile} --target <name>
-#
-# The bearer token for the endpoint this profile serves.
-#
-# "lanes link start" serves every profile in the workspace from one URL, and this
-# token is what opens it — so it admits every profile that "lanes link outputs"
-# lists, not only this one. Each call names the profile it means. Run a separate
-# workspace if you need a token that cannot reach them all.
-auth:
-  mode: bearer
-  token_ref: profile/token
-
-limits:
-  requests_per_minute: 120      # per profile
-  upstream_calls_per_minute: 60 # per connection, protects vendor quota
-
-# App registrations, shared by every connection of that vendor.
-oauth_apps: {}
-
-# One entry per authorised account. "account" is the identity the provider
-# reports — an address, a workspace — so this list says whose data is reachable
-# without having to look anything up.
-#
-# The seven below hold no account, and that is why they are here already: they
-# reach your own material rather than anybody's API, so there was never anything
-# for a connect step to authorise (ADR-050). What each one is:
-#
-#   memory   what you want remembered between sessions
-#   tasks    what you have to do, each with a status
-#   assets   files you want kept, by name
-#   skills   procedures you have written, handed to an agent as instructions
-#   vault    passwords and API keys, released one at a time
-#   setup    what is connected here, and what connecting more would take
-#   entities the people, companies and projects you deal with, and how to
-#            reach each of them — so an agent looks an address up rather
-#            than recalling one
-#
-# Nothing is stored in any of them until you or an agent puts something there,
-# and none of them can read an account. To switch one off, deny it below —
-# deleting the entry no longer works, because the next connect or deploy puts it
-# back.
-connections:
-  - { id: main, provider: memory, account: Memory }
-  - { id: main, provider: tasks, account: Tasks }
-  - { id: main, provider: assets, account: Assets }
-  - { id: main, provider: skills, account: Skills }
-  - { id: main, provider: vault, account: Vault }
-  - { id: main, provider: setup, account: Setup }
-  - { id: main, provider: entities, account: Entities }
-
-# Only what is listed here is reachable, and an empty policy grants nothing.
-#
-# Rules name capabilities, never accounts: "gmail.*" covers every Gmail
-# connection in this profile. To grant two accounts differently, run a second
-# profile — profiles share no database and no credential store. They do now
-# share an endpoint and its token, so that separation is enforced per call
-# rather than per URL.
-#
-#   allow: ['*']                  everything, which is what connect writes
-#   allow: [notion.*, gmail.*]    two providers
-#   deny:  [gmail.send_message]   a deny always beats an allow
-#
-# The rules below grant each of the seven its whole namespace, writes included —
-# the same thing "connect memory" wrote when it was a command you had to run.
-# Narrowing is one line, and these are the three worth knowing:
-#
-#   deny: [memory.write, memory.forget]   memory becomes read-only
-#   deny: [skills.manage.*]               skills can be invoked but not authored
-#   deny: [vault.put, vault.remove]       nothing new can be stored
-#   deny: [entities.write, entities.link, entities.forget]
-#                                         entities becomes read-only
-#
-# Those lists are exhaustive on purpose: a namespace is read-only only when
-# every capability that changes something is named, so "deny: [memory.write]"
-# alone leaves "memory.forget" granted.
-#
-# A vault read is not granted by "vault.*" alone: each stored item is its own
-# "vault.get.<id>" capability and only appears after a restart, so a write can
-# never hand itself a read (ADR-012).
-policy:
-  allow: [memory.*, tasks.*, assets.*, skills.*, vault.*, setup.*, entities.*]
-  deny: []
-`;
-}
-
-export function newWorkspaceTemplate(): string {
-  return `# Lanes Link workspace
-#
-# A workspace holds one or more profiles, and one endpoint serves all of them:
-# every call names the profile it means, with --profile. Profiles never share a
-# database or a credential store, so what one holds is invisible to another.
-#
-# This workspace IS a target. "targets:" below says where its bytes go, once,
-# for every profile in it — a profile says nothing about where it runs, so
-# there is one copy of it and nothing to keep in step (ADR-052).
-#
-# A target somewhere else is a pointer, and "deploy" writes one:
-#
-#   targets:
-#     cloud:
-#       workspace: gs://your-bucket
-#
-# The workspace at that address declares its own adapters, and is the only
-# thing that does. Reading it is a network call, which is why "--target cloud"
-# needs that bucket reachable.
-contract: 2
-targets:
-  local:
-    credentials: { adapter: file }
-    storage: { adapter: filesystem }
-`;
-}

package/src/cli/config-migrate.ts

@@ -91,10 +91,12 @@ export function pendingRenames(document: ConfigDocument): PendingRename[] {
  * connection that lost its authorisation for no reason anyone can see.
  */
 export async function migrateRenamedProviders(
-  document: ConfigDocument,
+  connections: ConfigDocument,
+  profiles: readonly ConfigDocument[],
   credentials: SecretStore,
   options: { apply: boolean },
 ): Promise<RenameMigration> {
+  const document = connections;
   const rows = pendingRenames(document);
   if (rows.length === 0) return { rows, changes: [], blocked: [] };
 
@@ -116,15 +118,14 @@ export async function migrateRenamedProviders(
     }
   }
 
-  // The policy rules second, because whether one can move depends on what is
-  // left declaring the old id once the rows above have.
-  for (const [from, to] of new Map(accepted.map((row) => [row.from, row.to]))) {
-    const policy = renamePolicyRules(document, { from, to }, {
-      stillDeclared: keepsDeclaring(document, from, accepted),
-      apply: options.apply,
-    });
-    changes.push(...policy.changes);
-    blocked.push(...policy.blocked);
+  // The grant rules second, because whether one can move depends on what is
+  // left declaring the old id once the rows above have — and because they live
+  // in the profiles now rather than beside the connection (ADR-057), so this is
+  // one pass per profile over a rename computed once.
+  for (const row of accepted) {
+    for (const profile of profiles) {
+      changes.push(...renameGrantRules(profile, row, { apply: options.apply }).changes);
+    }
   }
 
   if (!options.apply || accepted.length === 0) return { rows, changes, blocked };
@@ -137,8 +138,11 @@ export async function migrateRenamedProviders(
   }
 
   // Throws unless the result is a config that loads, which is the assertion
-  // worth having here — the whole premise was that it did not.
+  // worth having here — the whole premise was that it did not. Both files, in
+  // the order that survives a crash between them: a grant naming a connection
+  // that has not been renamed yet is refused at load, so the profiles go last.
   await document.save();
+  if (options.apply) for (const profile of profiles) await profile.save();
 
   for (const row of accepted) await credentials.delete(`${row.from}/${row.id}`);
 
@@ -146,7 +150,7 @@ export async function migrateRenamedProviders(
 }
 
 /**
- * Rewrite the policy rules that named the old id, where that is unambiguous.
+ * Rewrite the grant rules that named the old id, where that is unambiguous.
  *
  * A rule names a provider and never an account, so `tasks.*` written for Google
  * Tasks has to follow the rename or the migrated connection is granted nothing
@@ -154,66 +158,80 @@ export async function migrateRenamedProviders(
  * consulted, so the repair would land a row that serves exactly as little as
  * the broken one did.
  *
- * But a profile declaring *both* — a Google Tasks row and the built-in — has one
- * rule serving two providers, and moving it would silently revoke the one that
- * kept its name. That profile keeps its rule and is told to add the second,
- * which is a sentence rather than a guess at which was meant.
+ * The ambiguity this used to guard against is gone, and it is worth saying why.
+ * A rule lived in one flat block and named a provider, so a profile holding a
+ * Google Tasks row *and* the built-in had one `tasks.*` serving both — moving it
+ * would silently revoke whichever kept its name, so the migration reported
+ * rather than guessed. A rule lives inside the row that names one connection
+ * now (ADR-058), so `tasks.*` on a `google_tasks` row is not ambiguous: it is
+ * invalid, and `assertReferentialIntegrity` refuses it. There is nothing left to
+ * decide.
  *
- * Both lists. A `deny` written to switch Google Tasks off means it as firmly as
- * an allow means it on, and leaving it behind would re-enable something the
- * operator turned off.
+ * Both lists, on every row. A `deny` written to switch Google Tasks off means it
+ * as firmly as an allow means it on, and leaving it behind would re-enable
+ * something the operator turned off.
+ *
+ * The row's `connection` moves too, and that is new: a grant names the account
+ * rather than the provider now (ADR-058), so `tasks.main` becomes
+ * `google_tasks.main` or the grant resolves to nothing.
  */
-function renamePolicyRules(
+function renameGrantRules(
   document: ConfigDocument,
-  provider: { from: string; to: string },
-  options: { stillDeclared: boolean; apply: boolean },
-): { changes: string[]; blocked: string[] } {
+  moved: { from: string; to: string; id: string; key: string },
+  options: { apply: boolean },
+): { changes: string[] } {
   const changes: string[] = [];
-  const blocked: string[] = [];
 
-  for (const field of ['allow', 'deny'] as const) {
-    const rules = document.getIn(['policy', field]) as { items?: unknown[] } | null;
-
-    (rules?.items ?? []).forEach((_item, index) => {
-      // Either spelling: a bare pattern, or `{ capability, expires_at }`. The
-      // path to it differs; the decision does not.
-      const bare = document.getIn(['policy', field, index]);
-      const path =
-        typeof bare === 'string'
-          ? (['policy', field, index] as const)
-          : (['policy', field, index, 'capability'] as const);
-
-      const capability = typeof bare === 'string' ? bare : document.getIn(path);
-      if (typeof capability !== 'string') return;
-
-      const [named, ...rest] = capability.split('.');
-      if (named !== provider.from) return;
-
-      const moved = [provider.to, ...rest].join('.');
-
-      if (options.stillDeclared) {
-        blocked.push(
-          `policy.${field} keeps "${capability}" — this profile still declares a ` +
-            `"${provider.from}" connection, so add "${moved}" rather than moving it`,
-        );
-        return;
-      }
-
-      if (options.apply) document.setIn(path, moved);
-      changes.push(`policy.${field}: ${capability} → ${moved}`);
-    });
-  }
+  const provider = { from: moved.from, to: moved.to };
+  const grants = document.getIn(['grants']) as { items?: unknown[] } | null;
+
+  (grants?.items ?? []).forEach((_row, at) => {
+    const connection = document.getIn(['grants', at, 'connection']);
+    if (typeof connection !== 'string') return;
+
+    // The *exact* connection that moved, not every grant naming the old
+    // provider. A workspace holding a Google Tasks row beside the built-in has
+    // two `tasks.` grants and only one of them is being renamed — moving both
+    // would point the built-in's grant at a connection that does not exist.
+    if (connection !== moved.key) return;
+
+    // The `connection` field always follows, and this is the one place the
+    // ambiguity does not reach. It names the exact row being renamed, so there
+    // is nothing to guess — and leaving it behind would point the grant at a
+    // connection that no longer exists, which `assertGrantsResolve` refuses at
+    // load. The rename would have made the workspace unopenable.
+    const renamedConnection = `${provider.to}.${moved.id}`;
+    if (options.apply) document.setIn(['grants', at, 'connection'], renamedConnection);
+    changes.push(`grants[${at}].connection: ${connection} → ${renamedConnection}`);
 
-  return { changes, blocked };
+    for (const field of ['allow', 'deny'] as const) {
+      const rules = document.getIn(['grants', at, field]) as { items?: unknown[] } | null;
+
+      (rules?.items ?? []).forEach((_item, index) => {
+        // Either spelling: a bare pattern, or `{ capability, expires_at }`. The
+        // path to it differs; the decision does not.
+        const bare = document.getIn(['grants', at, field, index]);
+        const path =
+          typeof bare === 'string'
+            ? (['grants', at, field, index] as const)
+            : (['grants', at, field, index, 'capability'] as const);
+
+        const capability = typeof bare === 'string' ? bare : document.getIn(path);
+        if (typeof capability !== 'string') return;
+
+        const [head, ...rest] = capability.split('.');
+        if (head !== provider.from) return;
+
+        const renamed = [provider.to, ...rest].join('.');
+        if (options.apply) document.setIn(path, renamed);
+        changes.push(`grants[${at}].${field}: ${capability} → ${renamed}`);
+      });
+    }
+  });
+
+  return { changes };
 }
 
-/**
- * Whether a row naming the old provider survives the migration.
- *
- * Computed against the accepted set rather than by re-reading the document,
- * because the same answer has to hold on a report-only run, where nothing has
- * been rewritten yet.
- */
 function keepsDeclaring(
   document: ConfigDocument,
   provider: string,

package/src/cli/config-repair-sweep.ts

@@ -0,0 +1,119 @@
+import { CONNECTIONS_FILE, listProfiles, workspaceFiles, writeWorkspaceFile } from '#profile';
+import { newConnectionsTemplate } from './config-templates.ts';
+import { ConfigDocument } from './config-edit.ts';
+import { ok, print, style, warn } from './output.ts';
+import { DEFAULT_SURFACES, ensureOwnerLayer, repairLines, repaired } from './config-repair.ts';
+
+/**
+ * Applying the owner-layer repair across a whole workspace.
+ *
+ * Split from `config-repair.ts` when that file outgrew the budget, on the seam
+ * it already had: that file decides what one profile is missing, and this one
+ * walks the workspace applying it. The decision is a pure function of two
+ * documents and is tested as one; the sweep is all filesystem, ordering and
+ * what to say when a profile will not open.
+ */
+
+/** `memory, tasks, assets, skills, vault, setup and entities`, in repair order. */
+function listSurfaces(): string {
+  const names = [...DEFAULT_SURFACES];
+  const last = names.pop();
+  return names.length === 0 ? String(last) : `${names.join(', ')} and ${last}`;
+}
+
+/** The workspace's connections document, written from the template if missing. */
+async function openOrCreateConnections(workspaceRoot: string): Promise<ConfigDocument> {
+  try {
+    return await ConfigDocument.openKey(workspaceRoot, CONNECTIONS_FILE);
+  } catch {
+    await writeWorkspaceFile(
+      workspaceFiles(workspaceRoot),
+      CONNECTIONS_FILE,
+      newConnectionsTemplate(),
+    );
+    return ConfigDocument.openKey(workspaceRoot, CONNECTIONS_FILE);
+  }
+}
+
+/**
+ * Apply that repair across a workspace, saving and reporting what changed.
+ *
+ * Here rather than in `#deployments`, where it was, because `start` needs it as
+ * much as `deploy` does — more, in fact: `start` is the one command an existing
+ * install runs without being asked to, so it is the path by which a profile
+ * written before ADR-050 gets the layer at all. Two copies of a function that
+ * widens a policy is not a thing to have.
+ *
+ * **The caller scopes it**, and for `deploy` that is exactly the set being
+ * uploaded: a profile it sends is a profile the endpoint will serve, so
+ * repairing a narrower set would leave a served profile without the surfaces.
+ * Note what a `--profile` flag does not mean — it is the flag alone, so a
+ * profile resolved from the environment leaves it undefined and that reads as
+ * the whole workspace.
+ *
+ * *Which files are profiles* comes from `listProfiles`, never from an allowlist
+ * of what is safe to copy: that would happily hand over a committed
+ * `personal.example.yaml` or a nested `profiles/archive/old.yaml`, and this
+ * opens and validates what it is given — which once turned a template into a
+ * `ConfigError` aborting a deploy after provisioning had made cloud resources.
+ *
+ * A profile that cannot be read is warned about rather than fatal: the repair is
+ * a courtesy on the way past, and the caller's real work should still happen.
+ * Not silent, though — nothing else widens a policy without being asked.
+ *
+ * CLI-side by construction, like everything else in this file: a deployed
+ * revision holds `objectViewer` on `profiles/` (ADR-023) and could not write
+ * this even if the code let it.
+ */
+export async function repairOwnerLayer(
+  workspaceRoot: string,
+  profiles: readonly string[] | undefined,
+  options: { report?: (line: string) => void } = {},
+): Promise<void> {
+  // stdout by default, because every caller but one is printing a report a
+  // person reads. `update --json` passes `progress` instead: what it produces is
+  // a document, and a line of prose in front of it corrupts whatever is parsing.
+  // Routed rather than silenced — nothing else here widens a policy without
+  // saying so, and this must not be the exception.
+  const say = options.report ?? print;
+  const wanted = profiles === undefined ? undefined : new Set(profiles);
+
+  // One connections document for the whole sweep. The owner layer is the
+  // workspace's now (ADR-059), so repairing three profiles must not add three
+  // `memory.main` rows — opening it once and saving it once is what makes the
+  // second profile see what the first one created.
+  // Created if absent rather than refused. A contract-3 workspace always has
+  // one, but a hand-made or half-migrated one may not — and this is the repair,
+  // so the file it needs is a thing to write rather than a reason to stop.
+  const connections = await openOrCreateConnections(workspaceRoot);
+  let connectionsChanged = false;
+
+  for (const name of await listProfiles(workspaceRoot)) {
+    if (wanted !== undefined && !wanted.has(name)) continue;
+
+    try {
+      const document = await ConfigDocument.open(workspaceRoot, name);
+      const repair = ensureOwnerLayer(connections, document);
+      if (!repaired(repair)) continue;
+
+      connectionsChanged = true;
+      await document.save();
+
+      say(ok(`gave ${style.bold(name)} its own owner layer`));
+      for (const change of repairLines(repair)) say(`      ${style.dim(change)}`);
+      // Built from `DEFAULT_SURFACES` rather than typed out. The typed-out
+      // version still named six after a seventh had been added, so a person
+      // watching a deploy was told entities had arrived on the line above and
+      // that the layer was six things on the line below.
+      say(`      ${style.dim(`${listSurfaces()} — your own material, no account behind any of them`)}`);
+    } catch (error) {
+      say(
+        warn(
+          `could not give ${name} its owner layer: ${error instanceof Error ? error.message.split('\n')[0] : String(error)}`,
+        ),
+      );
+    }
+  }
+
+  if (connectionsChanged) await connections.save();
+}