@lanes-sh/link 0.7.2 → 0.9.0

package/src/deployments/target.ts

@@ -61,22 +61,35 @@ export interface TargetInput {
  */
 export type StorageFactory = (area?: string) => BlobStore;
 
-export async function openSecrets(input: TargetInput): Promise<SecretStore> {
-  const { declared, config, root, target } = input;
+/**
+ * The workspace's credential store.
+ *
+ * Takes the adapters and the root, not a `TargetInput` — it never read the
+ * profile, and since contract 3 there is nothing in one for it to read: the
+ * store is the workspace's. Narrowing the parameter is what lets a *migration*
+ * open it, which it must be able to do while the profiles on disk still
+ * declare the contract being migrated away from and therefore will not parse.
+ */
+export async function openSecrets(input: {
+  readonly declared: TargetConfig;
+  readonly root: string;
+  readonly target: string;
+}): Promise<SecretStore> {
+  const { declared, root, target } = input;
 
   switch (declared.credentials.adapter) {
     case 'file':
       return createFileSecretStore({
         path: workspacePath(
           root,
-          declared.credentials.path ?? layout.credentials(config.instance.profile),
+          declared.credentials.path ?? layout.credentials(),
         ),
       });
 
     case 'gcp-secret-manager': {
       if (!declared.credentials.project) {
         throw new ConfigError(
-          `targets.${target}.credentials.project is required for the gcp-secret-manager adapter.`,
+          `workspaces.${target}.credentials.project is required for the gcp-secret-manager adapter.`,
         );
       }
       const { GcpSecretManagerStore } = await import('./adapters/gcp-secret-manager.ts');
@@ -96,9 +109,17 @@ export async function openSecrets(input: TargetInput): Promise<SecretStore> {
  *
  * Its own root, `layout.state`, so it is not addressable from a provider's
  * blob namespace — the same containment `openAudit` relies on.
+ *
+ * Two roots, because state divides by what a key is *about*. Connection
+ * records, the discovery cache and the endpoint's own OAuth server belong to
+ * the workspace: a `connect` run once must read as connected from every
+ * profile. Cursors and each provider's own keys belong to the profile, because
+ * two agents reading one mailbox at different rates must not consume each
+ * other's cursor. `isWorkspaceNamespace` in `#stores/state` is the whole rule,
+ * and it is closed — a namespace it does not name is the profile's.
  */
 export function openState(storage: StorageFactory, profile: string): RuntimeState {
-  return createRuntimeState(storage(layout.state(profile)));
+  return createRuntimeState(storage(layout.state()), storage(layout.profileState(profile)));
 }
 
 /**
@@ -115,8 +136,8 @@ export function openState(storage: StorageFactory, profile: string): RuntimeStat
  * into (`layout.audit`), and that separation is what keeps ADR-007's wall
  * intact.
  */
-export function openAudit(storage: StorageFactory, profile: string): AuditStore {
-  return createBlobAuditStore({ storage: storage(layout.audit(profile)) });
+export function openAudit(storage: StorageFactory): AuditStore {
+  return createBlobAuditStore({ storage: storage(layout.audit()) });
 }
 
 /**
@@ -137,7 +158,7 @@ export async function openAuditSinks(
   secrets: SecretStore,
   log?: (message: string) => void,
 ): Promise<{ sink: AuditSink; reader: AuditReader }> {
-  const durable = openAudit(storage, input.config.instance.profile);
+  const durable = openAudit(storage);
   const declared = input.declared.audit?.sinks ?? [];
   if (declared.length === 0) return { sink: durable, reader: durable };
 
@@ -214,7 +235,7 @@ export async function openStorage(
       // by hand in a console.
       const { bucket, prefix } = declared.storage;
       if (!bucket) {
-        throw new ConfigError(`targets.${target}.storage.bucket is required for the gcs adapter.`);
+        throw new ConfigError(`workspaces.${target}.storage.bucket is required for the gcs adapter.`);
       }
 
       const { createGcsBlobStore } = await import('./adapters/gcs.ts');
@@ -231,19 +252,19 @@ export async function openStorage(
     case 's3': {
       const { bucket, endpoint, region, prefix } = declared.storage;
       if (!bucket) {
-        throw new ConfigError(`targets.${target}.storage.bucket is required for the s3 adapter.`);
+        throw new ConfigError(`workspaces.${target}.storage.bucket is required for the s3 adapter.`);
       }
 
       const accessKeyId = await requireSecret(
         secrets,
         declared.storage.access_key_id_ref,
-        `targets.${target}.storage.access_key_id_ref`,
+        `workspaces.${target}.storage.access_key_id_ref`,
         target,
       );
       const secretAccessKey = await requireSecret(
         secrets,
         declared.storage.secret_access_key_ref,
-        `targets.${target}.storage.secret_access_key_ref`,
+        `workspaces.${target}.storage.secret_access_key_ref`,
         target,
       );
 
@@ -289,7 +310,7 @@ export async function requireSecret(
   if (!value) {
     throw new ConfigError(
       `${field} names "${ref}", which is not in this target's secret store. ` +
-        `Store it with: lanes link secrets set ${ref} --target ${target}`,
+        `Store it with: lanes link secrets set ${ref} --workspace ${target}`,
     );
   }
   return value;

package/src/deployments/upload.ts

@@ -1,6 +1,6 @@
 import {
   openTarget,
-  DATA_DIR,
+  CONNECTIONS_FILE,
   WORKSPACE_FILE,
   layout,
   listProfiles,
@@ -55,13 +55,19 @@ export function deployedWorkspace(declared: TargetConfig): string | undefined {
  * forgets means an endpoint that will not boot, and a credential this includes
  * by accident means a credential in a bucket. Forgetting is loud.
  *
- * **Two areas inside `data/` are authored rather than accumulated**, since
- * ADR-030 moved skills and provider manifests into the profile that owns them.
- * They have to go up or a deployed instance loses both — the regression ADR-014
- * §2 fixed for skills, reintroduced by where they now live. So this reaches
- * into `data/` for exactly those two, by whole path segment and never by
- * prefix: `data/personal/skills.detour/` is not `skills.d`, and the difference
- * between matching it and not is a credential in a bucket.
+ * **Two areas inside `data/` are authored rather than accumulated.** Skills and
+ * provider manifests have to go up or a deployed instance loses both — the
+ * regression ADR-014 §2 fixed for skills. So the allowlist names those two
+ * areas, by whole path segment and never by prefix:
+ * `profiles/work/skills.detour/` is not `skills.d`, and the difference between
+ * matching it and not is a credential in a bucket.
+ *
+ * The two are filtered differently, and that follows from where they sit.
+ * A manifest is the workspace's (ADR-057) and defines a connection any profile
+ * may grant, so it goes up whole. Skills are back inside a profile (ADR-066),
+ * so they are filtered by the profile set exactly as the declarations are —
+ * sending a profile's procedures on a deploy that does not carry that profile
+ * would put one profile's material in front of another's endpoint.
  */
 export function isWorkspaceConfig(key: string, profiles?: readonly string[]): boolean {
   // **Never the workspace file.** It was sent, and it is the one file that must
@@ -74,37 +80,54 @@ export function isWorkspaceConfig(key: string, profiles?: readonly string[]): bo
   // the upload is done.
   if (key === WORKSPACE_FILE) return false;
 
+  // **The connections file always goes up.** It is configuration, the endpoint
+  // cannot resolve a single grant without it, and unlike the registry above
+  // there is nothing machine-specific in it — a connection is a connection
+  // wherever the workspace is read from (ADR-057).
+  if (key === CONNECTIONS_FILE) return true;
+
   // A set rather than one name, because a deploy now sends every profile that
   // declares the target rather than the single one it was told. `undefined`
   // still means the whole workspace, and an *empty* set means nothing — which
   // is a distinction a bare string could not make.
   const wanted = profiles === undefined ? undefined : new Set(profiles);
+  const carried = (profile: string): boolean => wanted === undefined || wanted.has(profile);
+
+  if (isManifest(key)) return true;
+
+  const segments = key.split('/');
+  if (segments[0] !== layout.profilesRoot()) return false;
 
-  const owner = authoredAreaOwner(key);
-  if (owner !== null) return wanted === undefined || wanted.has(owner);
+  const profile = segments[1];
+  if (profile === undefined || !carried(profile)) return false;
 
-  if (!key.startsWith('profiles/') || !key.endsWith('.yaml')) return false;
-  const name = key.slice('profiles/'.length, -'.yaml'.length);
-  return wanted === undefined || wanted.has(name);
+  // The declaration itself.
+  if (key === layout.profileConfig(profile)) return true;
+
+  // `profiles/<profile>/skills.d/<connection>/…`, and at least one segment
+  // past the connection — a directory is not a file to send. Both skill
+  // layouts satisfy it: `<name>.md` is five segments and `<name>/SKILL.md` is
+  // six.
+  if (`${segments[0]}/${segments[1]}/${segments[2]}` === layout.skillsRoot(profile)) {
+    return segments.length >= 5;
+  }
+
+  // Everything else under a profile is state, a sealed vault, or a provider's
+  // own blobs. None of it is configuration and the vault is a credential.
+  return false;
 }
 
 /**
- * The profile whose authored area holds `key`, or null for anything else.
+ * Whether `key` is one of the workspace's own provider manifests.
  *
- * Composed back out of `layout` rather than compared against literals, so a
+ * Composed back out of `layout` rather than compared against a literal, so a
  * renamed directory moves both this and the store that reads it, or neither.
- * Requires a fourth segment: `data/personal/skills.d` names the directory, and
- * a directory is not a file to send.
+ * Two segments at least, which is the "a directory is not a file to send" rule
+ * — `providers.d` alone is the area, `providers.d/<file>` is a manifest.
  */
-function authoredAreaOwner(key: string): string | null {
+function isManifest(key: string): boolean {
   const segments = key.split('/');
-  if (segments.length < 4 || segments[0] !== DATA_DIR) return null;
-
-  const owner = segments[1]!;
-  if (owner.length === 0) return null;
-
-  const area = `${DATA_DIR}/${owner}/${segments[2]}`;
-  return area === layout.skills(owner) || area === layout.providers(owner) ? owner : null;
+  return segments.length >= 2 && segments[0] === layout.providers();
 }
 
 /**
@@ -157,7 +180,16 @@ export async function publishWorkspace(input: {
   readonly config: Config;
   readonly workspaceRoot: string;
   readonly target: string;
-  readonly profile: string;
+  /**
+   * The profiles this edit touched, not just the one it was run under.
+   *
+   * `disconnect` removes a connection from the workspace and drops the grant
+   * from *every* profile that named it, so publishing one profile left the
+   * bucket holding a `connections.yaml` without the connection and a sibling
+   * profile still granting it — which `assertGrantsResolve` refuses at load, so
+   * `openReconciled` skipped that profile and it silently stopped being served.
+   */
+  readonly profile: string | readonly string[];
 }): Promise<string | null> {
   // Resolution failures are swallowed rather than thrown. The config edit that
   // called this has already succeeded and is on disk; a target that cannot be
@@ -173,6 +205,7 @@ export async function publishWorkspace(input: {
   const destination = deployedWorkspace(declared);
   if (!destination) return null;
 
-  await uploadWorkspace(input.workspaceRoot, destination, [input.profile]);
+  const touched = typeof input.profile === 'string' ? [input.profile] : input.profile;
+  await uploadWorkspace(input.workspaceRoot, destination, touched);
   return destination;
 }

package/src/dispatch/deps.ts

@@ -0,0 +1,88 @@
+import type { Principal } from '#auth';
+import type { AuditSink } from '#audit';
+import type { PolicyDocument, ProfilePolicy, RateLimiter } from '#policy';
+import type { Config, ConnectionConfig } from '#profile';
+import type { ProviderRegistry } from '#registry';
+import type { SecretStore } from '#secrets';
+import type { BlobStore } from '#stores/blobs';
+import type { RuntimeState } from '#stores/state';
+import type { AnyConnector } from '#connectivity';
+import type { Logger } from '#connectivity';
+
+/**
+ * What the dispatcher is given, and what it is asked.
+ *
+ * Split from the dispatcher itself so that file stays inside the size budget.
+ * The seam is real rather than arithmetic: everything here is what a *caller*
+ * assembles, and the class next door is the fixed order in which a call is
+ * authorised and run. Reading one has never required reading the other.
+ */
+
+/**
+ * The dispatch path.
+ *
+ * Every invocation goes through here in one fixed order — authenticate,
+ * resolve, authorize, rate-limit, dispatch, audit — with no way around it.
+ * The ordering is not stylistic: policy is evaluated before a provider is
+ * reached, so a provider never sees a request it was not authorised to serve,
+ * and authorization is never something provider code could get wrong.
+ *
+ * Exactly one audit event is written per invocation, on every path including
+ * denials. That is enforced structurally by `finally` rather than by
+ * remembering to call it at each return.
+ */
+
+export interface DispatchDeps {
+  readonly config: Config;
+  /**
+   * The accounts this workspace holds, and the clients it registered (ADR-057).
+   *
+   * Separate from `config` because neither is the profile's to declare. The
+   * *gate* stays policy: a connection that exists and is not granted resolves
+   * and is then denied `denied_default`, which is the same answer a caller gets
+   * for one that does not exist — two shapes of "no" that read alike, so probing
+   * is not an oracle for what the workspace holds.
+   */
+  readonly connections: readonly ConnectionConfig[];
+  readonly oauthApps: readonly string[];
+  readonly registry: ProviderRegistry;
+  /**
+   * Resolve the connector for a provider. Supplied by the caller so core does
+   * not import connector implementations, keeping the dependency direction
+   * intact: infrastructure -> sdk -> core -> connectors.
+   */
+  readonly connectorFor: (providerId: string, connectionId: string) => AnyConnector | undefined;
+  /** Attach whatever the manifest's auth kind requires to an outbound request. */
+  readonly authorizeRequest?: (
+    providerId: string,
+    connectionId: string,
+    request: Request,
+  ) => Promise<Request>;
+  readonly policy: ProfilePolicy;
+  /** Optional instance floor. Empty in M1; composition is tighten-only. */
+  readonly floor?: PolicyDocument;
+  readonly state: RuntimeState;
+  /**
+   * Where events go. Separate from `state` because the log is no longer in
+   * it — and because dispatch only ever writes, so taking the sink rather than
+   * the whole store means this path structurally cannot read the log back.
+   */
+  readonly audit: AuditSink;
+  readonly credentials: SecretStore;
+  readonly storage: BlobStore;
+  readonly limiter: RateLimiter;
+  readonly log: Logger;
+  readonly now?: () => number;
+}
+
+export interface DispatchRequest {
+  readonly principal: Principal;
+  /** Fully qualified, e.g. `example.echo`. */
+  readonly capabilityId: string;
+  /** Fully qualified, e.g. `example.a`. */
+  readonly connectionKey: string;
+  readonly arguments: Readonly<Record<string, unknown>>;
+  /** Self-reported by the client. Observability only — never authorization. */
+  readonly clientLabel?: string | undefined;
+  readonly signal?: AbortSignal;
+}

package/src/dispatch/dispatch.ts

@@ -1,9 +1,9 @@
 import type { AuditDraft, AuditLogger, AuditSink, AuthorizationResult } from '#audit';
 import { keepKeys, redactAllValues } from '#audit';
-import type { Principal } from '#auth';
+import { mayReach, type Principal } from '#auth';
 import type { SecretStore } from '#secrets';
 import type { RuntimeState } from '#stores/state';
-import type { PolicyDocument } from '#policy';
+import type { PolicyDocument, ProfilePolicy } from '#policy';
 import { RateLimiter, evaluate } from '#policy';
 import type { BlobStore } from '#stores/blobs';
 import type {
@@ -14,69 +14,14 @@ import type {
   Logger,
 } from '#connectivity';
 import { isToolResult, strategyContextFrom, strategyFor } from '#connectivity';
-import type { Config } from '#profile';
+import type { Config, ConnectionConfig } from '#profile';
 import { buildProviderContext, createProviderLogger } from './context.ts';
 import { fetchStaged, stageAttachment } from './staging.ts';
 import type { FetchStagedRequest, StagedAttachment, StageRequest } from './staging.ts';
 import type { ProviderRegistry } from '#registry';
 
-/**
- * The dispatch path.
- *
- * Every invocation goes through here in one fixed order — authenticate,
- * resolve, authorize, rate-limit, dispatch, audit — with no way around it.
- * The ordering is not stylistic: policy is evaluated before a provider is
- * reached, so a provider never sees a request it was not authorised to serve,
- * and authorization is never something provider code could get wrong.
- *
- * Exactly one audit event is written per invocation, on every path including
- * denials. That is enforced structurally by `finally` rather than by
- * remembering to call it at each return.
- */
-
-export interface DispatchDeps {
-  readonly config: Config;
-  readonly registry: ProviderRegistry;
-  /**
-   * Resolve the connector for a provider. Supplied by the caller so core does
-   * not import connector implementations, keeping the dependency direction
-   * intact: infrastructure -> sdk -> core -> connectors.
-   */
-  readonly connectorFor: (providerId: string, connectionId: string) => AnyConnector | undefined;
-  /** Attach whatever the manifest's auth kind requires to an outbound request. */
-  readonly authorizeRequest?: (
-    providerId: string,
-    connectionId: string,
-    request: Request,
-  ) => Promise<Request>;
-  readonly policy: PolicyDocument;
-  /** Optional instance floor. Empty in M1; composition is tighten-only. */
-  readonly floor?: PolicyDocument;
-  readonly state: RuntimeState;
-  /**
-   * Where events go. Separate from `state` because the log is no longer in
-   * it — and because dispatch only ever writes, so taking the sink rather than
-   * the whole store means this path structurally cannot read the log back.
-   */
-  readonly audit: AuditSink;
-  readonly credentials: SecretStore;
-  readonly storage: BlobStore;
-  readonly limiter: RateLimiter;
-  readonly log: Logger;
-  readonly now?: () => number;
-}
-
-export interface DispatchRequest {
-  readonly principal: Principal;
-  /** Fully qualified, e.g. `example.echo`. */
-  readonly capabilityId: string;
-  /** Fully qualified, e.g. `example.a`. */
-  readonly connectionKey: string;
-  readonly arguments: Readonly<Record<string, unknown>>;
-  /** Self-reported by the client. Observability only — never authorization. */
-  readonly clientLabel?: string | undefined;
-  readonly signal?: AbortSignal;
-}
+export type { DispatchDeps, DispatchRequest } from './deps.ts';
+import type { DispatchDeps, DispatchRequest } from './deps.ts';
 
 /**
  * `result` is a union because a capability is not necessarily a tool — a
@@ -198,7 +143,21 @@ export class Dispatcher {
 
       auditArguments = (redact ?? redactAllValues)(request.arguments);
 
-      const declared = config.connections.find(
+      // **Who, before what.** A caller reaches a profile only if that profile's
+      // `members:` names them (ADR-060), and this is checked before the
+      // connection is even resolved: a refusal that first said "no such
+      // connection" would answer a question the caller was not entitled to ask.
+      // The profile is the principal's: the MCP layer routes on the `profile`
+      // argument and builds the principal for it, so this is the same value the
+      // caller named and the one the audit event records.
+      if (!mayReach(request.principal, request.principal.profile)) {
+        return (outcome = deny(
+          'denied_default',
+          `Profile ${request.principal.profile} is not available`,
+        ));
+      }
+
+      const declared = this.#deps.connections.find(
         (connection) => `${connection.provider}.${connection.id}` === request.connectionKey,
       );
       if (!declared || declared.provider !== providerId) {
@@ -311,7 +270,7 @@ export class Dispatcher {
         // Which vendors this profile registered a client of its own for. A
         // provider that could be brokered but is not reads its client from the
         // store, so it has to be able to.
-        ownClients: Object.keys(this.#deps.config.oauth_apps),
+        ownClients: this.#deps.oauthApps,
         ...(entry.manifest.connector.kind === 'local' ? {} : { authorize }),
       });
 

package/src/policy/index.ts

@@ -14,6 +14,11 @@
  *      withheld. The floor is empty in M1 — the invariant is implemented
  *      anyway, because it is what makes delegated access safe to add later,
  *      and retrofitting it once rules exist in the wild is not possible.
+ *
+ * Since contract 3 a profile's rules are grouped by the connection they govern
+ * (ADR-058). Both invariants are unchanged and one is now sharper: a connection
+ * with no rules at all is not merely unmatched, it is absent, so default deny
+ * bites before a capability is even considered.
  */
 
 export type { AuthorizationResult } from '#audit';
@@ -43,6 +48,26 @@ export interface PolicyDocument {
 
 export const EMPTY_POLICY: PolicyDocument = { rules: [] };
 
+/**
+ * A profile's rules, grouped by the connection each governs (ADR-058).
+ *
+ * A map rather than one list carrying a connection per rule, because the
+ * lookup is the decision: a call names exactly one connection, and the rules
+ * for any other are not evidence about it. Flattening them into one list would
+ * mean every evaluation re-filtered, and a filter that was ever wrong would let
+ * one account's `allow` answer for another.
+ *
+ * A connection absent from the map is not granted. That is default deny on the
+ * connection axis, and it is why `grants:` with an empty `allow` is a different
+ * thing from no row at all — the first says "reachable, nothing permitted", the
+ * second says "not reachable".
+ */
+export interface ProfilePolicy {
+  readonly byConnection: ReadonlyMap<string, PolicyDocument>;
+}
+
+export const EMPTY_PROFILE_POLICY: ProfilePolicy = { byConnection: new Map() };
+
 export interface PolicyRequest {
   /**
    * The authenticated principal. One per profile in M1 (the owner). Carried
@@ -131,14 +156,21 @@ export function evaluateDocument(
  */
 export function evaluate(
   request: PolicyRequest,
-  profile: PolicyDocument,
+  profile: ProfilePolicy,
   floor?: PolicyDocument,
 ): PolicyDecision {
   if (floor) {
     const floorDecision = evaluateDocument(floor, request);
     if (!floorDecision.allowed) return floorDecision;
   }
-  return evaluateDocument(profile, request);
+
+  // The floor is still evaluated against the whole request, because a floor is
+  // an instance-wide narrowing and knows nothing about which connections a
+  // profile happens to hold. Only the profile's half is per connection.
+  const granted = profile.byConnection.get(request.connection);
+  if (granted === undefined) return { allowed: false, reason: 'denied_default' };
+
+  return evaluateDocument(granted, request);
 }
 
 /**
@@ -153,7 +185,7 @@ export function allowedConnections(
   capability: string,
   connections: readonly string[],
   principal: string,
-  profile: PolicyDocument,
+  profile: ProfilePolicy,
   floor?: PolicyDocument,
   at?: Date,
 ): string[] {
@@ -164,16 +196,16 @@ export function allowedConnections(
   const provider = capability.slice(0, capability.indexOf('.'));
   const ofProvider = connections.filter((connection) => connection.startsWith(`${provider}.`));
 
-  // All or nothing beyond that, since rules do not discriminate between
-  // accounts. The list shape is kept because it is what the `connection` enum
-  // wants, and because a future principal-scoped rule would restore the
-  // filtering without touching any caller.
-  const first = ofProvider[0];
-  if (first === undefined) return [];
-
-  const request: PolicyRequest = at
-    ? { principal, capability, connection: first, at }
-    : { principal, capability, connection: first };
-
-  return evaluate(request, profile, floor).allowed ? ofProvider : [];
+  // One evaluation per account, where this used to be all-or-nothing. That
+  // difference is the whole of ADR-058 at the discovery boundary: a profile
+  // holding two mailboxes with different rules now advertises the `connection`
+  // enum each capability actually permits, instead of offering both wherever
+  // either was allowed.
+  return ofProvider.filter((connection) => {
+    const request: PolicyRequest = at
+      ? { principal, capability, connection, at }
+      : { principal, capability, connection };
+
+    return evaluate(request, profile, floor).allowed;
+  });
 }