@lanes-sh/link 0.7.2 → 0.9.0

package/src/deployments/deploy.ts

@@ -14,10 +14,10 @@ import { recordDeployment, type DeploymentRecord } from './record.ts';
 import { printSteps, runSteps } from './steps.ts';
 import { driverFor } from './drivers.ts';
 import { prepareSecrets, readableRefs, rotatableRefs } from './prepare.ts';
-import { repairOwnerLayer } from '#cli/config-repair.ts';
-import { migrateWorkspace } from '#cli/workspace-migrate.ts';
+import { repairOwnerLayer } from '#cli/config-repair-sweep.ts';
+import { migrateToCurrentContract } from '#cli/workspace-migrate.ts';
 import { deployedWorkspace, uploadWorkspace } from './upload.ts';
-import { collidingRefs, collisionRefusal, servingProfiles } from './serving.ts';
+import { servingProfiles } from './serving.ts';
 import { healthLine, reachability, registerLine, reportUnauthorised } from './report.ts';
 
 /**
@@ -75,9 +75,14 @@ export async function deploy(flags: DeployFlags): Promise<void> {
   // declare anything: it reads this machine's pointer and stops. So the bucket is
   // located, migrated, and only then opened.
   //
-  // Idempotent, and silent on a workspace already at contract 2 — a listing and
-  // no writes. `--dry-run` reports what it would do and writes nothing, like
-  // every other step of this command.
+  // Idempotent, and silent on a workspace already current — a listing and no
+  // writes. `--dry-run` reports what it would do and writes nothing, like every
+  // other step of this command.
+  //
+  // It goes all the way to `SUPPORTED_CONTRACT`, which it did not use to: this
+  // ran the contract 1→2 step alone, so a contract-2 bucket passed straight
+  // through and the revision came up reading an empty `data/` while the bytes
+  // stayed under `data/<profile>/`. See `migrateToCurrentContract`.
   if (!(await migrateTargetWorkspace(requireTargetFlag(flags), flags.dryRun !== true))) return;
 
   // The one command allowed to name a target that does not exist yet: creating
@@ -112,14 +117,13 @@ export async function deploy(flags: DeployFlags): Promise<void> {
     print(style.dim(`         serving ${serving.join(', ')} — ${primary} owns the token`));
   }
 
-  // Before anything external, beside `check`, and for the same reason: two
-  // profiles writing one flat credential ref into one store is a failure with
-  // no later symptom worth having.
-  const colliding = await collidingRefs(resolution.workspaceRoot, serving);
-  if (colliding.length > 0) {
-    heading('Cannot share a credential store');
-    throw new ConfigError(collisionRefusal(colliding, target));
-  }
+  // The credential-collision preflight is gone. It existed because two profiles
+  // each held their own `gmail.main` and both derived the flat ref `gmail/main`
+  // into one store — the last deploy winning, with no later symptom worth
+  // having. A connection belongs to the workspace now and `<provider>.<id>` is
+  // unique by construction (ADR-057), so the state it guarded against cannot be
+  // written: `assertConnectionsUnique` refuses it at load, before a deploy runs
+  // at all.
 
   // `check` before anything external, per the gate order: a config that will be
   // rejected on boot should be rejected here, not after a five-minute build.
@@ -150,7 +154,7 @@ export async function deploy(flags: DeployFlags): Promise<void> {
   // below are, and read from config and manifests before anything opens a
   // store — `--dry-run` must reach the printed step list without touching a
   // credential.
-  const rotatable = await rotatableRefs(resolution.workspaceRoot, serving);
+  const rotatable = await rotatableRefs(resolution.workspaceRoot, serving, declared);
   const readable = await readableRefs(resolution.workspaceRoot, serving, declared);
   const provision = await driver.provision({
     deploy: deployConfig,
@@ -225,7 +229,7 @@ export async function deploy(flags: DeployFlags): Promise<void> {
     await runSteps(driver, provision);
   }
 
-  const credentials = await openSecretStoreFor(config, resolution.workspaceRoot, target);
+  const credentials = await openSecretStoreFor(resolution.workspaceRoot, target);
   const prepared = await prepareSecrets({
     config,
     declared,
@@ -240,7 +244,7 @@ export async function deploy(flags: DeployFlags): Promise<void> {
     for (const problem of prepared.blocking) print(fail(problem));
     throw new ConfigError(
       'The deployed instance cannot start without these. Store them with ' +
-        `lanes link secrets set <ref> --profile ${resolution.profile} --target ${target}, or ` +
+        `lanes link secrets set <ref> --profile ${resolution.profile} --workspace ${target}, or ` +
         `copy a local setup with lanes link secrets push --profile ${resolution.profile} ` +
         `--from local --to ${target}.`,
     );
@@ -275,6 +279,17 @@ export async function deploy(flags: DeployFlags): Promise<void> {
     // workspace that this target cannot open, and nothing left to check.
     await repairOwnerLayer(resolution.workspaceRoot, serving);
 
+    // **The bucket's own contract, before anything is written over it.**
+    //
+    // The pass at the top of the command resolves the target through this
+    // machine's pointer, which a *first* deploy does not have: the entry is
+    // still a declaration, `resolveTargetWorkspace` answers with the local root,
+    // and it returns early. So this is the only pass that ever sees an existing
+    // bucket at contract 2 — and running it after the upload is the same as not
+    // running it, because the upload writes contract-3 profiles and
+    // `needsContract3` reads the profiles.
+    await migrateToCurrentContract(workspace, { apply: true, target });
+
     // Before the rollout, so the revision that comes up finds a config to read.
     // Uploading after would leave a window where the service is serving and the
     // workspace it was told to read is not there yet.
@@ -291,15 +306,9 @@ export async function deploy(flags: DeployFlags): Promise<void> {
       await uploadWorkspace(resolution.workspaceRoot, workspace, serving);
     }
 
-    // **The bucket's own migration, here and nowhere else.**
-    //
-    // A second pass, and it is not redundant. The one at the top of the command
-    // migrated whatever the bucket already held; this catches what the upload
-    // just put there — profiles from a workspace that is itself at contract 2
-    // arrive migrated, but a first deploy of a *newly created* bucket writes
-    // them here for the first time. Idempotent, so the ordinary case is one
-    // listing and no writes.
-    await migrateWorkspace(workspace, { apply: true });
+    // Again for what the upload put there: a newly created bucket gets its
+    // profiles written here for the first time. Idempotent — one listing.
+    await migrateToCurrentContract(workspace, { apply: true, target });
 
     // Where this deployment lives, in both registries — see `record.ts`. The
     // declaration has to land before the revision boots, so it goes here rather
@@ -325,7 +334,7 @@ export async function deploy(flags: DeployFlags): Promise<void> {
   if (!url) {
     print(
       warn(
-        `deployed, but the platform reported no URL yet — run: lanes link outputs --profile ${resolution.profile} --target ${target}`,
+        `deployed, but the platform reported no URL yet — run: lanes link outputs --profile ${resolution.profile} --workspace ${target}`,
       ),
     );
     return;
@@ -365,7 +374,7 @@ async function migrateTargetWorkspace(target: string, apply: boolean): Promise<b
   const workspace = await resolveTargetWorkspace(root, target).catch(() => null);
   if (workspace === null || workspace === root) return true;
 
-  const migrated = await migrateWorkspace(workspace, { apply });
+  const migrated = await migrateToCurrentContract(workspace, { apply, target });
   if (migrated.alreadyCurrent) return true;
 
   heading(apply ? 'Migrated' : 'Would migrate');
@@ -383,6 +392,6 @@ async function migrateTargetWorkspace(target: string, apply: boolean): Promise<b
   print(style.dim('  Nothing was written, and nothing else was checked: the rest of this'));
   print(style.dim('  command opens the target, which is not readable until this has run.'));
   print('');
-  print(style.dim(`  Run it for real:  lanes link deploy --target ${target}`));
+  print(style.dim(`  Run it for real:  lanes link deploy --workspace ${target}`));
   return false;
 }

package/src/deployments/gcp/bucket.ts

@@ -1,5 +1,5 @@
 import { join } from 'node:path';
-import { installRoot, layout } from '#profile';
+import { CONNECTIONS_FILE, WORKSPACE_FILE, installRoot, layout } from '#profile';
 import type { DeployStep } from '../driver.ts';
 import {
   removalStep,
@@ -51,6 +51,11 @@ export function bucketGrants(bucket: string, profiles: readonly string[]): Condi
     `resource.name.startsWith("projects/_/buckets/${bucket}/objects/${path}")`;
   const objectIs = (path: string): string =>
     `resource.name == "projects/_/buckets/${bucket}/objects/${path}"`;
+  // Parenthesised, because `!` binds tighter than `==` in CEL: `!resource.name
+  // == "…"` negates the *name* and compares that, which is not a type error and
+  // not what it reads as. Bracketing is the whole difference between excluding
+  // one object and excluding nothing.
+  const objectIsNot = (path: string): string => `!(${objectIs(path)})`;
   /**
    * The bucket itself, which is a different resource from anything in it.
    *
@@ -77,12 +82,44 @@ export function bucketGrants(bucket: string, profiles: readonly string[]): Condi
    */
   const theBucket = `resource.name == "projects/_/buckets/${bucket}"`;
 
-  const manifestPrefixes = profiles.map((profile) =>
-    objectsUnder(`${layout.providers(profile)}/`),
-  );
-  // No profiles leaves the carve-out off rather than guessing at one: the
-  // revision keeps write on its own data, as it did before this existed.
-  const manifests = manifestPrefixes.length > 0 ? `(${manifestPrefixes.join(' || ')})` : null;
+  // One prefix, not one per profile. Manifests are the workspace's since
+  // ADR-057 — a manifest defines a connection, and connections do not live in a
+  // profile — so the carve-out no longer varies with the profile set.
+  const manifests = `(${objectsUnder(`${layout.providers()}/`)})`;
+
+  /**
+   * What a running revision writes, named rather than carved out of `data/`.
+   *
+   * It used to be `objectsUnder('data/') && !manifests` — everything under one
+   * prefix, minus the exception. There is no `data/` any more (ADR-067), and
+   * naming the writable prefixes is the better shape regardless: an allowlist
+   * says what a compromised revision can reach, where a denylist says only what
+   * it cannot and grows silently every time something new lands under the
+   * prefix.
+   *
+   * `credentials.enc` is in it because `connect --from-endpoint` and a token
+   * refresh both write there (ADR-025), and its `.key` sits beside it.
+   */
+  // **Per profile, not `profiles/` wholesale.** Granting the whole tree and
+  // carving the served declarations back out left the revision `create` and
+  // `delete` on every *other* profile's `profile.yaml` — the configuration of a
+  // profile the same endpoint serves — and on any name it invented, which
+  // `listProfiles` would then pick up on the next boot. Before ADR-067 no
+  // declaration was writable at all, because `profiles/` sat outside `data/`;
+  // this restores that, one prefix per profile.
+  //
+  // `!==` on a whole object rather than a pattern, because Cloud Storage IAM
+  // conditions have no `matches` — see the note on the read binding below.
+  const writable = [
+    objectsUnder(`${layout.audit()}/`),
+    objectsUnder(`${layout.state()}/`),
+    objectsUnder(layout.credentials()),
+    ...profiles.map(
+      (profile) =>
+        `(${objectsUnder(`${layout.profileDir(profile)}/`)} && ` +
+        `${objectIsNot(layout.profileConfig(profile))})`,
+    ),
+  ].join(' || ');
 
   return [
     {
@@ -90,16 +127,26 @@ export function bucketGrants(bucket: string, profiles: readonly string[]): Condi
       // skills are all written by the running endpoint.
       role: 'roles/storage.objectAdmin',
       title: 'owns-its-data',
-      expression: `${objectsUnder('data/')}${manifests ? ` && !${manifests}` : ''}`,
+      expression: `(${writable})`,
     },
     {
       // `expression=true` was here, which is every object in the bucket — the
       // step title and ADR-023 both claim a narrowing this did not do. The
-      // config the revision reads is the workspace file, the profiles beside it,
-      // and each profile's own manifests, so name exactly those.
+      // config the revision reads is the workspace file, `connections.yaml`
+      // beside it, the profiles, and the manifests, so name exactly those.
+      //
+      // **Named by the constants, because the list went stale once already.**
+      // ADR-057 moved connections out of the profile into `connections.yaml` at
+      // the workspace root, and `upload.ts` puts it in the bucket because "the
+      // endpoint cannot resolve a single grant without it" — but this expression
+      // still enumerated the contract-2 set. Every fresh deploy built its image,
+      // rolled a revision, and died on `GCS refused to read "connections.yaml"
+      // (403)` before it could listen on its port. Nothing caught it: the
+      // condition is a string assembled here and asserted nowhere, so the suite
+      // saw a passing build and Cloud Run saw a container that never started.
       role: 'roles/storage.objectViewer',
       title: 'reads-its-config',
-      expression: `${theBucket} || ${objectsUnder('profiles/')} || ${objectIs('lanes-link.yaml')}${manifests ? ` || ${manifests}` : ''}`,
+      expression: `${theBucket} || ${objectsUnder(`${layout.profilesRoot()}/`)} || ${objectIs(WORKSPACE_FILE)} || ${objectIs(CONNECTIONS_FILE)} || ${manifests}`,
     },
   ];
 }

package/src/deployments/gcp/provision.ts

@@ -1,4 +1,4 @@
-import { VAULT_DOCUMENT_REF, type SecretRef } from '#secrets';
+import type { SecretRef } from '#secrets';
 import type { DeployStep, ProvisionInput } from '../driver.ts';
 import { encodeRef } from '../adapters/gcp-secret-manager.ts';
 import { bucketSteps } from './bucket.ts';
@@ -312,12 +312,12 @@ export async function provisionSteps(
     // mind: nothing here was wrong, it was incomplete, and being incomplete
     // looked exactly like being finished. Reading mail 403'd an hour after every
     // deploy.
-    const rotatable = [
-      ...(input.declared.vault?.adapter === 'secret'
-        ? [input.declared.vault.ref ?? VAULT_DOCUMENT_REF]
-        : []),
-      ...(input.rotatable ?? []),
-    ];
+    // Both kinds arrive already derived: the vault document is named per vault
+    // connection (ADR-059) and only `prepare.ts` has the profile configs to work
+    // it out. Naming `vault/document` here — the contract-2 constant — created
+    // and granted one secret while `openVault` asked for another, and the
+    // revision died on `PERMISSION_DENIED` before it could listen. See `vaultRef`.
+    const rotatable = [...(input.rotatable ?? [])];
 
     // Read, named one secret at a time, for the same reason the write side is:
     // a resource-level grant needs no condition to be scoped.

package/src/deployments/knowledge.ts

@@ -1,7 +1,7 @@
 import type { SecretStore } from '#secrets';
 import type { BlobStore } from '#stores/blobs';
 import type { BlobRoute } from '#stores/blobs/route.ts';
-import { KNOWLEDGE_LAYOUT, knowledgeRoot, type KnowledgeArea, type KnowledgeConfig } from '#profile';
+import { KNOWLEDGE_LAYOUT, KNOWLEDGE_PREFIX, knowledgeRoot, type KnowledgeArea, type KnowledgeConfig } from '#profile';
 import { requireSecret, type TargetInput } from './target.ts';
 import type { FetchLike } from './adapters/github-api.ts';
 // Type-only, so a target with no `knowledge` block never loads the adapter.
@@ -134,10 +134,15 @@ export async function knowledgeStores(
  * how they would come to disagree. `skills` is absent because it is not a
  * prefix of that root — it is a store of its own, handed over whole.
  */
-export function knowledgeRoutes(stores: KnowledgeStores): BlobRoute[] {
+export function knowledgeRoutes(
+  stores: Pick<KnowledgeStores, 'memory' | 'entities'>,
+): BlobRoute[] {
   return [
-    { prefix: `${KNOWLEDGE_LAYOUT.memory}/`, store: stores.memory },
-    { prefix: `${KNOWLEDGE_LAYOUT.entities}/`, store: stores.entities },
+    // The *provider's* prefix, which is what core scopes a store into. The
+    // repository directory it lands in is `KNOWLEDGE_LAYOUT`, and the two are
+    // different strings since contract 4 prefixed the owner layer.
+    { prefix: `${KNOWLEDGE_PREFIX.memory}/`, store: stores.memory },
+    { prefix: `${KNOWLEDGE_PREFIX.entities}/`, store: stores.entities },
   ];
 }
 

package/src/deployments/prepare.ts

@@ -1,5 +1,7 @@
 import { credentialRefFor, ownClientRefsFor, rotatableCredentialRefsFor } from '#registry';
-import { listProfiles, loadProfileConfig, type Config, type TargetConfig } from '#profile';
+import {
+  PAIR_TOKEN_REF,
+  readConnections, listProfiles, loadProfileConfig, vaultRef, type Config, type TargetConfig } from '#profile';
 import { VAULT_DOCUMENT_REF, VAULT_KEY_REF, generateVaultKey, type SecretStore } from '#secrets';
 import { ok, print, style, warn } from '#cli/output.ts';
 import { buildRegistryWithWorkspace, ensureProfileToken } from '#cli/runtime.ts';
@@ -66,6 +68,7 @@ export interface PrepareResult {
 export async function rotatableRefs(
   root: string,
   profiles: readonly string[] | undefined,
+  declared: TargetConfig | undefined,
 ): Promise<string[]> {
   const refs = new Set<string>();
   const wanted = profiles === undefined ? undefined : new Set(profiles);
@@ -80,16 +83,27 @@ export async function rotatableRefs(
       continue;
     }
 
-    // Inside the loop because manifests are the profile's own (ADR-030): a
-    // connection in `work` naming a provider only `work` declares resolves to
-    // nothing against `personal`'s registry, and a missed ref here is a 403 an
-    // hour after the revision reports healthy.
-    const registry = await buildRegistryWithWorkspace(root, name);
+    // `vault.put` is a capability an agent may hold under policy (ADR-022), so
+    // the revision rewrites this one — and it is per vault connection, which is
+    // what makes this a per-profile pass rather than a target-level constant.
+    // The loop had been reduced to `void config` when the derivation moved out;
+    // this is it moving back, next to the config it needs.
+    if (declared?.vault?.adapter === 'secret') refs.add(vaultRef(declared, config));
+  }
 
-    for (const connection of config.connections) {
-      const manifest = registry.manifest(connection.provider);
-      for (const ref of rotatableCredentialRefsFor(connection, manifest)) refs.add(ref);
-    }
+  // Once, outside the profile loop. Connections and the manifests that describe
+  // them belong to the workspace (ADR-057), so the per-profile registry ADR-030
+  // required is gone — and with it the failure it guarded against, where a
+  // connection in `work` resolved to nothing against `personal`'s registry and
+  // the missed ref became a 403 an hour after the revision reported healthy.
+  //
+  // Every connection, not just granted ones: a credential a revision cannot read
+  // is a broken account, and whether some profile currently grants it is a
+  // question that changes without redeploying.
+  const registry = await buildRegistryWithWorkspace(root);
+  for (const connection of (await readConnections(root)).connections) {
+    const manifest = registry.manifest(connection.provider);
+    for (const ref of rotatableCredentialRefsFor(connection, manifest)) refs.add(ref);
   }
 
   // Sorted, and a set: two Gmail connections share one dynamically registered
@@ -132,9 +146,41 @@ export async function readableRefs(
 ): Promise<string[]> {
   const refs = new Set<string>();
 
+  // Unconditionally, for every deploy, whether or not this workspace has ever
+  // been paired — and that is the point rather than a rounding up.
+  //
+  // Secret Manager answers a *missing binding* with 403, not 404, so that an
+  // identity cannot enumerate secrets by their error codes. The adapter returns
+  // null for the 404 and throws for the 403, so an unbound ref is a thrown
+  // error on the read path — and that is the failure `server/read/open.ts`
+  // records: a deployed revision asked for refs no binding covered and never
+  // went healthy.
+  //
+  // Bound, the deployed-but-never-paired case becomes the 404 instead — a
+  // secret that exists with no version — which reads back as null and renders
+  // as `401 {error:'unpaired'}`. The grant is what turns a crash into a
+  // refusal.
+  //
+  // Deciding it by asking *whether the workspace is paired* is the thing that
+  // cannot happen: that means opening a credential store inside `readableRefs`,
+  // which `--dry-run` reaches and must not do.
+  //
+  // Deliberately not in `rotatableRefs`. The revision never writes this one —
+  // minting is `lanes link pair`, from the operator's machine — and
+  // `secretVersionAdder` here would let a compromised revision issue itself a
+  // credential that reads the whole workspace.
+  //
+  // The cert and key refs are absent for a different reason: Cloud Run
+  // terminates TLS with a certificate a browser already trusts, so a deployed
+  // revision never calls `serveRead` and never reads either.
+  refs.add(PAIR_TOKEN_REF);
+
+  // Only the key is the target's. The *document* is named per vault connection
+  // (ADR-059), so it is added inside the profile loop below — naming it here
+  // meant `vault/document`, which is not what `openVault` opens, and the
+  // revision 403'd on a ref nothing had created. See `vaultRef`.
   if (declared?.vault?.adapter === 'secret') {
     refs.add(VAULT_KEY_REF);
-    refs.add(declared.vault.ref ?? VAULT_DOCUMENT_REF);
   } else if (declared?.vault?.adapter === 'blob') {
     // Ciphertext lives in the bucket, but the key that opens it is still here.
     refs.add(VAULT_KEY_REF);
@@ -153,22 +199,24 @@ export async function readableRefs(
     }
 
     refs.add(config.auth.token_ref);
+    if (declared?.vault?.adapter === 'secret') refs.add(vaultRef(declared, config));
     // The OIDC audience check reads this on every verify (`server/endpoint.ts`).
     if (config.auth.authorization?.mode === 'oidc') {
       refs.add(config.auth.authorization.client_id_ref);
     }
 
-    // Per profile, for the reason `rotatableRefs` gives: a manifest is this
-    // profile's, so the registry that resolves its connections must be too.
-    const registry = await buildRegistryWithWorkspace(root, name);
+  }
 
-    for (const connection of config.connections) {
-      const manifest = registry.manifest(connection.provider);
-      const ref = credentialRefFor(connection, manifest);
-      if (ref) refs.add(ref);
-      for (const rotatable of rotatableCredentialRefsFor(connection, manifest)) refs.add(rotatable);
-      for (const client of ownClientRefsFor(manifest, config.oauth_apps)) refs.add(client);
-    }
+  // Once, for the reason `rotatableRefs` gives.
+  const connectionsFile = await readConnections(root);
+  const registry = await buildRegistryWithWorkspace(root);
+
+  for (const connection of connectionsFile.connections) {
+    const manifest = registry.manifest(connection.provider);
+    const ref = credentialRefFor(connection, manifest);
+    if (ref) refs.add(ref);
+    for (const rotatable of rotatableCredentialRefsFor(connection, manifest)) refs.add(rotatable);
+    for (const client of ownClientRefsFor(manifest, connectionsFile.oauth_apps)) refs.add(client);
   }
 
   return [...refs].sort();
@@ -190,13 +238,13 @@ export async function prepareSecrets(input: PrepareInput): Promise<PrepareResult
   // The command is spelled out rather than described. This is the one manual
   // step a deploy genuinely cannot take for you, so it should cost a paste
   // rather than a trip to the docs to work out how the id is spelled.
-  const registry = await buildRegistryWithWorkspace(root, config.instance.profile);
-  for (const connection of config.connections) {
+  const registry = await buildRegistryWithWorkspace(root);
+  for (const connection of (await readConnections(root)).connections) {
     const ref = credentialRefFor(connection, registry.manifest(connection.provider));
     if (!ref || (await credentials.has(ref))) continue;
     warnings.push(
       `${connection.provider}.${connection.id} is not authorised yet — no credential at "${ref}"\n` +
-        `    lanes link connect ${connection.provider} --profile ${input.config.instance.profile} --target ${target} --id ${connection.id}`,
+        `    lanes link connect ${connection.provider} --profile ${input.config.instance.profile} --workspace ${target} --id ${connection.id}`,
     );
   }
 

package/src/deployments/record.ts

@@ -56,7 +56,7 @@ export async function recordDeployment(record: DeploymentRecord): Promise<void>
   // there pointed the bucket at itself, and the revision that came up refused to
   // open its own target.
   await recordTarget(resolveWorkspaceRoot(), record.target, {
-    workspace: record.workspace,
+    at: record.workspace,
     ...stamp,
   });
 }

package/src/deployments/report.ts

@@ -37,7 +37,7 @@ import { heading, ok, print, style, warn } from '#cli/output.ts';
 export function registerLine(profile: string, target: string): string {
   return style.dim(
     `  Connect your accounts first, then register with:\n` +
-      `    lanes link outputs --profile ${profile} --target ${target}\n` +
+      `    lanes link outputs --profile ${profile} --workspace ${target}\n` +
       '  A client keeps the tool list it fetched when it connected, so one registered\n' +
       '  before the accounts holds a surface without them until it is re-added.',
   );
@@ -66,7 +66,7 @@ export function reportUnauthorised(warnings: readonly string[], profile: string,
   print(
     style.dim(
       '  A browser consent per account is the one step this cannot take for you:\n' +
-        `    lanes link connect <provider> --profile ${profile} --target ${target}\n` +
+        `    lanes link connect <provider> --profile ${profile} --workspace ${target}\n` +
         '  Each is served as soon as it is authorised. There is no second deploy —\n' +
         '  deploying is how code gets here, and authorising an account changes none.',
     ),

package/src/deployments/serving.ts

@@ -1,8 +1,10 @@
 import {
+  readConnections,
   ConfigError,
   listProfiles,
   loadWorkspaceProfiles,
   readRegistry,
+  resolveTargetWorkspace,
   type WorkspaceProfiles,
 } from '#profile';
 import { rotatableCredentialRefsFor } from '#registry';
@@ -49,16 +51,25 @@ export async function servingProfiles(input: {
     return { profiles: [...named], primary: named[0]! };
   }
 
-  const living = await listProfiles(workspaceRoot);
+  // **Where the profiles actually are, which is not this machine.** After
+  // ADR-052 a deployed target's profiles live in its workspace, so listing the
+  // local root answered with whatever happened to be here: an empty workspace
+  // holding nothing but a pointer refused a redeploy of a live endpoint
+  // outright, and a local profile the bucket does not hold would have been sent
+  // to a revision that cannot open it. A declaration resolves back to the local
+  // root, which is the right answer there — a first deploy is exactly the case
+  // where the profiles are still on this machine and about to be uploaded.
+  const where = await resolveTargetWorkspace(workspaceRoot, target).catch(() => workspaceRoot);
+  const living = await listProfiles(where);
 
   if (living.length === 0) {
     throw new ConfigError(
       `No profile lives in "${target}", so there is no set to deploy.\n` +
         '  A first deploy creates the target, and has to be told which profile\n' +
         '  it belongs to:\n' +
-        `    lanes link deploy --target ${target} --profile <name>\n\n` +
+        `    lanes link deploy --workspace ${target} --profile <name>\n\n` +
         `  If "${target}" was deployed before and the pointer to it was lost:\n` +
-        `    lanes link sync targets --target ${target} --discover`,
+        `    lanes link sync targets --workspace ${target} --discover`,
     );
   }
 
@@ -89,7 +100,7 @@ async function choosePrimary(
       "of them owns the endpoint's token. One token opens the endpoint and\n" +
       'reaches every profile behind it, so this cannot be picked for you.\n\n' +
       `  Name it once and it is remembered:\n` +
-      `    lanes link deploy --target ${target} --profile ${declaring[0]!}` +
+      `    lanes link deploy --workspace ${target} --profile ${declaring[0]!}` +
       declaring
         .slice(1)
         .map((name) => ` --profile ${name}`)
@@ -97,73 +108,3 @@ async function choosePrimary(
   );
 }
 
-/**
- * A credential reference two profiles would both write, in one store.
- *
- * References are flat — `gmail/main`, not `personal/gmail/main` — and a target
- * has one credential store, so two profiles deployed to the same project share
- * a namespace. `https://lanes.sh/docs/link/configuration` admits this in an aside about
- * removing a profile; deploying both at once is where it stops being an aside.
- *
- * The failure is silent and it is the bad kind: `personal`'s Gmail refresh
- * token is overwritten by `work`'s, both profiles go on listing their own
- * account in config, and the first symptom is one of them reading the other's
- * mailbox. Nothing downstream can catch it, because by then there is one
- * credential and it is valid.
- *
- * `profile/token` is deliberately not a collision. Every profile defaults to
- * that ref and the endpoint has exactly one token by design — sharing it is
- * what ADR-009 says happens, rather than an accident.
- */
-export interface Collision {
-  readonly ref: string;
-  readonly profiles: string[];
-}
-
-export async function collidingRefs(
-  workspaceRoot: string,
-  profiles: readonly string[],
-  workspace?: WorkspaceProfiles,
-): Promise<Collision[]> {
-  const loaded = (workspace ?? (await loadWorkspaceProfiles(workspaceRoot))).loaded.filter(
-    (entry) => profiles.includes(entry.profile),
-  );
-
-  const owners = new Map<string, string[]>();
-
-  for (const entry of loaded) {
-    const registry = await buildRegistryWithWorkspace(workspaceRoot, entry.profile);
-    const refs = new Set<string>();
-
-    for (const connection of entry.config.connections) {
-      const manifest = registry.manifest(connection.provider);
-      for (const ref of rotatableCredentialRefsFor(connection, manifest)) refs.add(ref);
-      if (connection.credential_ref) refs.add(connection.credential_ref);
-    }
-
-    for (const ref of refs) {
-      if (ref === entry.config.auth.token_ref) continue;
-      owners.set(ref, [...(owners.get(ref) ?? []), entry.profile]);
-    }
-  }
-
-  return [...owners.entries()]
-    .filter(([, names]) => names.length > 1)
-    .map(([ref, names]) => ({ ref, profiles: names.sort() }))
-    .sort((a, b) => a.ref.localeCompare(b.ref));
-}
-
-/** The refusal, as a block, so the wording is testable without a deploy. */
-export function collisionRefusal(found: readonly Collision[], target: string): string {
-  const rows = found.map((one) => `    ${one.ref}   ${one.profiles.join(', ')}`).join('\n');
-
-  return (
-    `${found.length} credential reference(s) would be written by more than one\n` +
-    `profile into the one credential store "${target}" has:\n\n${rows}\n\n` +
-    '  References are flat, so these are the same secret and the last deploy\n' +
-    '  wins — after which one profile is reading the other\'s account, and\n' +
-    '  both still name their own in config.\n\n' +
-    '  Give the connections different ids, or deploy the profiles to targets\n' +
-    '  in separate projects.'
-  );
-}