@lanes-sh/link 0.8.0 → 0.9.0

package/src/deployments/target.ts

@@ -61,8 +61,21 @@ export interface TargetInput {
  */
 export type StorageFactory = (area?: string) => BlobStore;
 
-export async function openSecrets(input: TargetInput): Promise<SecretStore> {
-  const { declared, config, root, target } = input;
+/**
+ * The workspace's credential store.
+ *
+ * Takes the adapters and the root, not a `TargetInput` — it never read the
+ * profile, and since contract 3 there is nothing in one for it to read: the
+ * store is the workspace's. Narrowing the parameter is what lets a *migration*
+ * open it, which it must be able to do while the profiles on disk still
+ * declare the contract being migrated away from and therefore will not parse.
+ */
+export async function openSecrets(input: {
+  readonly declared: TargetConfig;
+  readonly root: string;
+  readonly target: string;
+}): Promise<SecretStore> {
+  const { declared, root, target } = input;
 
   switch (declared.credentials.adapter) {
     case 'file':
@@ -96,9 +109,17 @@ export async function openSecrets(input: TargetInput): Promise<SecretStore> {
  *
  * Its own root, `layout.state`, so it is not addressable from a provider's
  * blob namespace — the same containment `openAudit` relies on.
+ *
+ * Two roots, because state divides by what a key is *about*. Connection
+ * records, the discovery cache and the endpoint's own OAuth server belong to
+ * the workspace: a `connect` run once must read as connected from every
+ * profile. Cursors and each provider's own keys belong to the profile, because
+ * two agents reading one mailbox at different rates must not consume each
+ * other's cursor. `isWorkspaceNamespace` in `#stores/state` is the whole rule,
+ * and it is closed — a namespace it does not name is the profile's.
  */
-export function openState(storage: StorageFactory): RuntimeState {
-  return createRuntimeState(storage(layout.state()));
+export function openState(storage: StorageFactory, profile: string): RuntimeState {
+  return createRuntimeState(storage(layout.state()), storage(layout.profileState(profile)));
 }
 
 /**
@@ -201,7 +222,7 @@ export async function openStorage(
   switch (declared.storage.adapter) {
     case 'filesystem': {
       const { createFilesystemBlobStore } = await import('./adapters/filesystem.ts');
-      const base = declared.storage.path ?? layout.blobs();
+      const base = declared.storage.path ?? layout.blobs(config.instance.profile);
       return (area) =>
         createFilesystemBlobStore({ root: workspacePath(root, area === undefined ? base : area) });
     }
@@ -219,7 +240,7 @@ export async function openStorage(
 
       const { createGcsBlobStore } = await import('./adapters/gcs.ts');
       const base = prefix ?? '';
-      const root = layout.blobs();
+      const root = layout.blobs(config.instance.profile);
 
       return (area) =>
         createGcsBlobStore({
@@ -249,7 +270,7 @@ export async function openStorage(
 
       const { createS3BlobStore } = await import('./adapters/s3.ts');
       const base = prefix ?? '';
-      const root = layout.blobs();
+      const root = layout.blobs(config.instance.profile);
 
       return (area) =>
         createS3BlobStore({

package/src/deployments/upload.ts

@@ -1,6 +1,5 @@
 import {
   openTarget,
-  DATA_DIR,
   CONNECTIONS_FILE,
   WORKSPACE_FILE,
   layout,
@@ -58,16 +57,17 @@ export function deployedWorkspace(declared: TargetConfig): string | undefined {
  *
  * **Two areas inside `data/` are authored rather than accumulated.** Skills and
  * provider manifests have to go up or a deployed instance loses both — the
- * regression ADR-014 §2 fixed for skills. So this reaches into `data/` for
- * exactly those two, by whole path segment and never by prefix:
- * `data/skills.detour/` is not `skills.d`, and the difference between matching
- * it and not is a credential in a bucket.
+ * regression ADR-014 §2 fixed for skills. So the allowlist names those two
+ * areas, by whole path segment and never by prefix:
+ * `profiles/work/skills.detour/` is not `skills.d`, and the difference between
+ * matching it and not is a credential in a bucket.
  *
- * Neither is filtered by the profile set any more. Both are keyed by connection
- * now rather than by profile (ADR-057, ADR-059), and a connection can be
- * granted by any profile in the workspace — so sending "only this profile's
- * skills" is not a thing that can be computed, and withholding them would
- * deploy an endpoint whose prompts are missing.
+ * The two are filtered differently, and that follows from where they sit.
+ * A manifest is the workspace's (ADR-057) and defines a connection any profile
+ * may grant, so it goes up whole. Skills are back inside a profile (ADR-066),
+ * so they are filtered by the profile set exactly as the declarations are —
+ * sending a profile's procedures on a deploy that does not carry that profile
+ * would put one profile's material in front of another's endpoint.
  */
 export function isWorkspaceConfig(key: string, profiles?: readonly string[]): boolean {
   // **Never the workspace file.** It was sent, and it is the one file that must
@@ -86,39 +86,48 @@ export function isWorkspaceConfig(key: string, profiles?: readonly string[]): bo
   // wherever the workspace is read from (ADR-057).
   if (key === CONNECTIONS_FILE) return true;
 
-  if (isAuthoredArea(key)) return true;
-
   // A set rather than one name, because a deploy now sends every profile that
   // declares the target rather than the single one it was told. `undefined`
   // still means the whole workspace, and an *empty* set means nothing — which
   // is a distinction a bare string could not make.
   const wanted = profiles === undefined ? undefined : new Set(profiles);
+  const carried = (profile: string): boolean => wanted === undefined || wanted.has(profile);
+
+  if (isManifest(key)) return true;
+
+  const segments = key.split('/');
+  if (segments[0] !== layout.profilesRoot()) return false;
+
+  const profile = segments[1];
+  if (profile === undefined || !carried(profile)) return false;
+
+  // The declaration itself.
+  if (key === layout.profileConfig(profile)) return true;
 
-  if (!key.startsWith('profiles/') || !key.endsWith('.yaml')) return false;
-  const name = key.slice('profiles/'.length, -'.yaml'.length);
-  return wanted === undefined || wanted.has(name);
+  // `profiles/<profile>/skills.d/<connection>/…`, and at least one segment
+  // past the connection — a directory is not a file to send. Both skill
+  // layouts satisfy it: `<name>.md` is five segments and `<name>/SKILL.md` is
+  // six.
+  if (`${segments[0]}/${segments[1]}/${segments[2]}` === layout.skillsRoot(profile)) {
+    return segments.length >= 5;
+  }
+
+  // Everything else under a profile is state, a sealed vault, or a provider's
+  // own blobs. None of it is configuration and the vault is a credential.
+  return false;
 }
 
 /**
- * Whether `key` is inside one of the two authored areas.
+ * Whether `key` is one of the workspace's own provider manifests.
  *
- * Composed back out of `layout` rather than compared against literals, so a
+ * Composed back out of `layout` rather than compared against a literal, so a
  * renamed directory moves both this and the store that reads it, or neither.
- *
- * The segment counts differ because the layouts do, and both are the "a
- * directory is not a file to send" rule: a manifest is `data/providers.d/<file>`
- * and a skill is `data/skills.d/<connection>/<file>`, so requiring one more
- * segment than the area itself has is what stops the bare directory key
- * matching.
+ * Two segments at least, which is the "a directory is not a file to send" rule
+ * — `providers.d` alone is the area, `providers.d/<file>` is a manifest.
  */
-function isAuthoredArea(key: string): boolean {
+function isManifest(key: string): boolean {
   const segments = key.split('/');
-  if (segments.length < 3 || segments[0] !== DATA_DIR) return false;
-
-  const area = `${DATA_DIR}/${segments[1]}`;
-  if (area === layout.providers()) return segments.length >= 3;
-  if (area === layout.skillsRoot()) return segments.length >= 4;
-  return false;
+  return segments.length >= 2 && segments[0] === layout.providers();
 }
 
 /**

package/src/profile/connections.ts

@@ -153,7 +153,19 @@ export function soleGrantFor(config: Config, provider: string): string | undefin
  * under one name has to keep opening it.
  */
 export function vaultRef(declared: TargetConfig | undefined, config: Config): string {
-  return declared?.vault?.ref ?? `vault/${soleGrantFor(config, 'vault') ?? 'main'}`;
+  // **The profile, then the connection.** This was `vault/<connection>`, which
+  // was distinct per profile only while each profile had its own vault
+  // instance. ADR-066 merges the owner layer to one row per surface, so every
+  // profile grants `lanes_vault.lan5` and every profile opened one sealed
+  // document — `vault_put` from `personal` overwriting `work`'s item of the
+  // same id, and `vault_get` reading the other profile's credential. The `file`
+  // and `blob` adapters take the profile from `layout`; this is the same fact
+  // for the adapter every deployment uses.
+  //
+  // A `ref` the target states outright still wins: a deployment already sealing
+  // under one name has to keep opening it.
+  const connection = soleGrantFor(config, 'lanes_vault') ?? 'main';
+  return declared?.vault?.ref ?? `vault/${config.instance.profile}/${connection}`;
 }
 
 /**

package/src/profile/deployments.ts

@@ -1,7 +1,13 @@
 import { parseDocument } from 'yaml';
 import { readWorkspaceFile, workspaceFiles, writeWorkspaceFile } from './files.ts';
-import { SUPPORTED_CONTRACT, workspaceSchema, type WorkspaceTarget } from './schema.ts';
+import {
+  SUPPORTED_CONTRACT,
+  workspaceSchema,
+  workspaceTargetSchema,
+  type WorkspaceTarget,
+} from './schema.ts';
 import { WORKSPACE_FILE } from './workspace.ts';
+import { LEGACY_WORKSPACE_FILE } from './layout.ts';
 
 /**
  * Writing the target registry.
@@ -74,24 +80,96 @@ async function editRegistry(
   edit: (targets: Record<string, WorkspaceTarget>) => void,
 ): Promise<void> {
   const files = workspaceFiles(workspaceRoot);
+
+  // **Either name, and the one it read is the one it writes.** Reading only the
+  // new name meant an unmigrated workspace fell through to a bare
+  // `contract: 4` document: `deploy` then wrote a registry holding one target
+  // beside the `lanes-link.yaml` that declared them all, and `readWorkspace`
+  // prefers the new name — so every other target vanished from a command whose
+  // job was to record one.
+  const held = await readWorkspaceFile(files, WORKSPACE_FILE);
+  const key = held === null ? LEGACY_WORKSPACE_FILE : WORKSPACE_FILE;
   const text =
-    (await readWorkspaceFile(files, WORKSPACE_FILE)) ?? `contract: ${SUPPORTED_CONTRACT}\n`;
+    held ??
+    (await readWorkspaceFile(files, LEGACY_WORKSPACE_FILE)) ??
+    `contract: ${SUPPORTED_CONTRACT}\n`;
 
   const document = parseDocument(text);
-  const targets = (document.toJSON()?.workspaces ?? {}) as Record<string, WorkspaceTarget>;
+  const raw = (document.toJSON() ?? {}) as {
+    workspaces?: Record<string, WorkspaceTarget>;
+    targets?: Record<string, LegacyTargetEntry>;
+  };
+
+  // **Whichever block this file already keeps its registry in.**
+  //
+  // This read and wrote `workspaces:` unconditionally. A contract-2 file keeps
+  // it under `targets:`, so recording a deploy into one found no registry,
+  // added the entry to an empty object, and wrote a *second* block beside the
+  // first. `workspaceSchema` has no `targets` key and zod strips what it does
+  // not declare, so the hybrid validated and landed.
+  //
+  // That is reachable from an ordinary command: `deploy` migrates the target
+  // workspace, never the local one, so deploying to a bucket from a laptop that
+  // has not run `update` yet does exactly this. The result is a file whose two
+  // registries disagree — and `rewriteRegistry` then rebuilds `workspaces:`
+  // from the stale `targets:`, discarding the newer record without a word.
+  //
+  // Writing into the block the file already has keeps it coherent at whatever
+  // contract it is, and leaves converting the two to the migration that owns
+  // that job.
+  const legacy = raw.workspaces === undefined && raw.targets !== undefined;
+  const block = legacy ? 'targets' : 'workspaces';
+  const targets = legacy ? current(raw.targets ?? {}) : (raw.workspaces ?? {});
 
   edit(targets);
 
-  if (Object.keys(targets).length === 0) document.deleteIn(['workspaces']);
-  else document.setIn(['workspaces'], sorted(targets));
+  if (Object.keys(targets).length === 0) document.deleteIn([block]);
+  else document.setIn([block], sorted(legacy ? asLegacy(targets) : targets));
 
   // Validated before it lands, on the rendered tree rather than the input, so
   // what is checked is what would be read back.
-  workspaceSchema.parse(document.toJSON());
+  //
+  // `workspaceSchema` declares no `targets` key and zod strips what it does not
+  // declare, so on the legacy branch parsing the whole document checks nothing
+  // at all — an entry that is neither pointer nor declaration, or one trying to
+  // be both, landed silently and only surfaced weeks later when the migration
+  // converted it and refused. The entries are checked directly there, in the
+  // contract-3 shape `current` normalised them to.
+  if (legacy) for (const entry of Object.values(targets)) workspaceTargetSchema.parse(entry);
+  else workspaceSchema.parse(document.toJSON());
 
-  await writeWorkspaceFile(files, WORKSPACE_FILE, String(document));
+  await writeWorkspaceFile(files, key, String(document));
 }
 
-function sorted(targets: Record<string, WorkspaceTarget>): Record<string, WorkspaceTarget> {
+function sorted<T>(targets: Record<string, T>): Record<string, T> {
   return Object.fromEntries(Object.entries(targets).sort(([a], [b]) => a.localeCompare(b)));
 }
+
+/**
+ * A contract-2 entry spelled a pointer `workspace:`; contract 3 spells it `at:`.
+ *
+ * Normalised on the way in and back on the way out, so `edit` and `pick` see one
+ * shape and never have to ask which contract they are looking at — and so a
+ * legacy file keeps the spelling its own schema expects.
+ */
+interface LegacyTargetEntry extends Omit<WorkspaceTarget, 'at'> {
+  workspace?: string;
+}
+
+function current(targets: Record<string, LegacyTargetEntry>): Record<string, WorkspaceTarget> {
+  return Object.fromEntries(
+    Object.entries(targets).map(([name, entry]) => {
+      const { workspace, ...rest } = entry;
+      return [name, workspace === undefined ? rest : { at: workspace, ...rest }];
+    }),
+  );
+}
+
+function asLegacy(targets: Record<string, WorkspaceTarget>): Record<string, LegacyTargetEntry> {
+  return Object.fromEntries(
+    Object.entries(targets).map(([name, entry]) => {
+      const { at, ...rest } = entry;
+      return [name, at === undefined ? rest : { workspace: at, ...rest }];
+    }),
+  );
+}

package/src/profile/index.ts

@@ -56,6 +56,7 @@ export { PAIR_CERT_REF, PAIR_KEY_REF, PAIR_TOKEN_REF } from './pairing.ts';
 
 export {
   KNOWLEDGE_LAYOUT,
+  KNOWLEDGE_PREFIX,
   knowledgeRoot,
   knowledgeTargetSchema,
   parseRepository,
@@ -135,6 +136,9 @@ export {
 } from './workspace.ts';
 
 export {
-  DATA_DIR,
+  PROFILE_FILE,
+  LEGACY_DATA_DIR,
+  LEGACY_WORKSPACE_FILE,
+  legacyProfileConfig,
   layout,
 } from './layout.ts';

package/src/profile/knowledge.ts

@@ -96,11 +96,17 @@ export type KnowledgeConfig = z.infer<typeof knowledgeTargetSchema>;
 /**
  * Where each area sits inside the repository.
  *
- * Three directories, named after the three things that move. `memory` is also
- * the memory provider's own blob namespace — the prefix core scopes it into under
- * the profile's blob root — which is why the same word does both jobs: the
- * route that redirects it and the directory it lands in are the same fact, and
- * spelling them separately is how they would come to disagree.
+ * Three directories, named after the three things that move — and named for a
+ * *reader*, because a knowledge repository is somebody's own and they browse it
+ * on GitHub. `memory/` is what belongs at the top of that tree, not
+ * `lanes_memory/`.
+ *
+ * **This used to be the provider's blob prefix as well**, on the reasoning that
+ * one word doing both jobs could not come to disagree with itself. Contract 4
+ * prefixed the owner layer (`lanes_memory`), so the two are no longer the same
+ * string and the choice has to be made rather than avoided: the route below
+ * reads `PROVIDER_PREFIX`, and this stays the readable name. `KNOWLEDGE_ROUTES`
+ * pairs them in one place so a rename still cannot move one without the other.
  *
  * Declared here, beside the schema, so the runtime that opens these stores and
  * the command that migrates into them read one definition.
@@ -113,6 +119,13 @@ export const KNOWLEDGE_LAYOUT = {
 
 export type KnowledgeArea = keyof typeof KNOWLEDGE_LAYOUT;
 
+/** The blob prefix each area is scoped into locally — the provider's own id. */
+export const KNOWLEDGE_PREFIX = {
+  memory: 'lanes_memory',
+  skills: 'lanes_skills',
+  entities: 'lanes_entities',
+} as const;
+
 /** The directory one area occupies, under the profile's optional path prefix. */
 export function knowledgeRoot(knowledge: KnowledgeConfig, area: KnowledgeArea): string {
   const directory = KNOWLEDGE_LAYOUT[area];

package/src/profile/layout.ts

@@ -1,63 +1,85 @@
 /**
- * Where a workspace's data lives, in one place.
+ * Where a workspace's files live, in one place.
  *
  * ```
  * ~/.lanes-link/
- * ├── lanes-link.yaml           the workspaces this machine knows, and the default
+ * ├── workspaces.yaml           the workspaces this machine knows, and the default
  * ├── connections.yaml          every account authorised in this workspace
- * ├── profiles/<name>.yaml      which of them a profile selects, and who may use it
- * └── data/
- *     ├── state.kv/             state, connections, cursors
- *     ├── audit.log/            one object per event, one chain
- *     ├── credentials.enc       system credentials, and its .key
- *     ├── vault.d/<id>.enc      one sealed document per vault connection
- *     ├── skills.d/<id>/        procedures, one <name>/SKILL.md each
- *     ├── providers.d/          the operator's own provider manifests
- *     └── <provider>/<connection>/…   whatever that provider stores
+ * ├── credentials.enc           system credentials, and its .key
+ * ├── providers.d/              the operator's own provider manifests
+ * ├── audit.log/                one object per event, one chain
+ * ├── state.kv/                 connections, discovery, the endpoint's own OAuth server
+ * └── profiles/
+ *     └── <profile>/            everything one profile is
+ *         ├── profile.yaml      what it selects, and who may use it
+ *         ├── state.kv/         cursors, and each provider's own keys
+ *         ├── vault.d/<id>.enc  one sealed document per vault connection
+ *         ├── skills.d/<id>/    procedures, one <name>/SKILL.md each
+ *         └── <provider>/<connection>/…   whatever that provider stores
  * ```
  *
- * **Nothing here takes a profile.** It used to take one for everything: a
- * profile owned a directory, and `rm -r data/work` was the whole answer to
- * "remove the work profile's data". A connection belongs to the workspace now
- * (ADR-057) and so do the stores behind the owner layer (ADR-059), so a profile
- * owns no bytes at all — it owns a selection, and the thing a selection points
- * at outlives it. `profile remove` prints what survives rather than letting the
- * difference go unnoticed.
+ * **A profile is one directory, and it owns its bytes.** Both halves reverse
+ * something recent. ADR-059 put the owner layer's bytes beside the *connection*,
+ * so a profile owned nothing and two profiles granting `memory.lan1` read one
+ * note; ADR-066 makes the profile the container again, so they read two. And the
+ * declaration used to sit at `profiles/<name>.yaml` while the data sat under
+ * `data/<name>/` — the same structure in two places, for no reason anybody could
+ * state (ADR-067).
  *
- * **The dot is load-bearing, and it is the only thing keeping these apart from
- * a provider.** The blob root is `data/` and a provider is namespaced
- * `<provider>/<connection>` under it; a provider id is `[a-z][a-z0-9_]*`, so a
- * name carrying a dot is one no provider can be scoped into. That is not
- * hypothetical for three of the five names below — `skills`, `vault` and
- * `audit` are all real provider ids, and without the dot each would be handed a
- * store rooted inside the thing it is meant to be walled off from, which is a
- * hole in ADR-007's wall rather than an untidy filename.
+ * **There is no `data/` any more.** It meant "what a deployed revision writes,
+ * as against the config it reads", which was worth a directory. `profile.yaml`
+ * lives beside the bytes now, so that line has to be drawn inside it regardless
+ * — and a directory holding everything names nothing. The IAM grant says which
+ * prefixes are writable instead of saying which one is not.
  *
- * `vault.d/<id>.enc` rather than `vault/<id>.enc` for exactly that reason. The
- * sealed document is not a blob the vault provider serves, and a `vault/`
- * prefix shared between the two would put the ciphertext inside the namespace
- * the provider is given.
+ * **The dot is load-bearing one level down, not here.** The root is not a
+ * provider blob root; a *profile's* directory is. A provider is namespaced
+ * `<provider>/<connection>` under it and a provider id is `[a-z][a-z0-9_]*`, so
+ * a name carrying a dot is one no provider can be scoped into. That is not
+ * hypothetical for three of the four names there — `skills`, `vault` and `state`
+ * would each otherwise be handed a store rooted inside the thing it is meant to
+ * be walled off from, which is a hole in ADR-007's wall rather than an untidy
+ * filename. `profile.yaml` carries one for the same reason.
+ *
+ * `vault.d/<id>.enc` rather than `vault/<id>.enc` on the same grounds: the
+ * sealed document is not a blob the vault provider serves, and a shared `vault/`
+ * prefix would put the ciphertext inside the namespace the provider is given.
+ *
+ * `audit.log/` and `state.kv/` stay at the workspace. One endpoint serves every
+ * profile and every event already records the profile it acted in, so one chain
+ * is both sufficient and better evidence than several; and a connection's
+ * reconcile status is a fact about an account, which a `connect` in one profile
+ * must not have to repeat in the next. What follows the profile is what a
+ * profile's use of an account produces — cursors, and the provider's own keys.
  *
  * These are **defaults**. A workspace that declares its own paths keeps them.
  */
 
-/** The directory under the workspace root that holds everything the workspace owns. */
-export const DATA_DIR = 'data';
+/** The directory holding one subdirectory per profile. */
+export const PROFILES_DIR = 'profiles';
+
+/**
+ * What a profile's declaration is called inside its own directory.
+ *
+ * Named here rather than spelled at the two call sites that need it — the path
+ * builder below and `listProfiles`, which matches on it to tell a profile
+ * directory from anything else under `profiles/`. Two spellings of one filename
+ * is how a listing and a loader come to disagree about what exists.
+ */
+export const PROFILE_FILE = 'profile.yaml';
 
 /**
  * No leading `./` on any of these.
  *
  * It used to carry one, which `path.resolve` discards and an object key does
- * not: a bucket read `./data/state.kv/x` as a directory literally named `.`, so
+ * not: a bucket read `./state.kv/x` as a directory literally named `.`, so
  * every deployed key landed one level away from where the config said it did.
  * The visible cost was that the conditioned IAM binding
- * `deployments/gcp/provision.ts` writes — which grants writes under
- * `objects/data/` — matched nothing, and the first revision 403'd on its boot
- * reconcile. A relative path is relative without being spelled that way.
+ * `deployments/gcp/provision.ts` writes matched nothing, and the first revision
+ * 403'd on its boot reconcile. A relative path is relative without being
+ * spelled that way.
  */
 export const layout = {
-  /** Connections, provider state, and cursors: one object per key. */
-  state: (): string => `${DATA_DIR}/state.kv`,
   /**
    * System credentials — OAuth refresh tokens, the CI token. Never reachable
    * from MCP.
@@ -69,45 +91,16 @@ export const layout = {
    * "silent until one profile is reading the other's account" (ADR-043,
    * ADR-057).
    */
-  credentials: (): string => `${DATA_DIR}/credentials.enc`,
-  /** Every vault connection's sealed document lives under here. */
-  vaultRoot: (): string => `${DATA_DIR}/vault.d`,
-  /** One sealed document per vault connection, each under its own key. */
-  vault: (connection: string): string => `${DATA_DIR}/vault.d/${connection}.enc`,
-  /**
-   * The same document, keyed relative to the blob store.
-   *
-   * `blobs()` is already rooted at `data/`, so a blob adapter handed the path
-   * above would write `data/data/vault.d/...`. Two spellings of one location is
-   * exactly what this file exists to prevent, so the second one lives here
-   * beside the first rather than being assembled at the call site.
-   */
-  vaultKey: (connection: string): string => `vault.d/${connection}.enc`,
-  /**
-   * Every skills connection's procedures live under here.
-   *
-   * The root is exported beside the per-connection path because `deploy` needs
-   * to recognise the *area* without knowing which connections exist — and
-   * `upload.ts` composes its allowlist back out of these rather than comparing
-   * against literals, so a renamed directory moves the store and the thing that
-   * sends it together, or neither.
-   */
-  skillsRoot: (): string => `${DATA_DIR}/skills.d`,
-  /** One skills connection's procedures — `<name>.md` or `<name>/SKILL.md`, either layout. */
-  skills: (connection: string): string => `${DATA_DIR}/skills.d/${connection}`,
+  credentials: (): string => 'credentials.enc',
   /**
    * The provider manifests this workspace declares.
    *
    * Workspace-level, where ADR-030 put them in the profile. A manifest names a
    * host, an OpenAPI document, and the credential refs that reach them — which
    * is to say it *defines a connection*, and connections do not live in a
-   * profile any more. ADR-030's argument was about a procedure being as private
-   * as the knowledge it operates on; that argument is answered by ADR-059's
-   * instances, not by where a manifest sits.
+   * profile any more (ADR-057).
    */
-  providers: (): string => `${DATA_DIR}/providers.d`,
-  /** The blob root every provider is namespaced under. */
-  blobs: (): string => DATA_DIR,
+  providers: (): string => 'providers.d',
   /**
    * The audit log: one object per event, one chain for the workspace.
    *
@@ -116,5 +109,88 @@ export const layout = {
    * also what lets `audit tail` filter where it used to select, and what gives
    * the dashboard a single log to read.
    */
-  audit: (): string => `${DATA_DIR}/audit.log`,
+  audit: (): string => 'audit.log',
+  /**
+   * What the workspace knows about its accounts, and about itself.
+   *
+   * Connection records and the discovery cache, because both are facts about an
+   * account or a provider rather than about anybody's selection of it — a
+   * `connect` run once must read as connected from every profile. And the
+   * endpoint's own OAuth authorization-server state, which is not about a
+   * connection at all: it is the clients that have signed in *to* this endpoint,
+   * and there is one endpoint.
+   */
+  state: (): string => 'state.kv',
+
+  /** Every profile's directory sits under here. */
+  profilesRoot: (): string => PROFILES_DIR,
+  /** Everything one profile is. Also the blob root its providers are scoped under. */
+  profileDir: (profile: string): string => `${PROFILES_DIR}/${profile}`,
+  /**
+   * What this profile selects, and who may use it.
+   *
+   * Inside the profile's own directory, which is the whole of ADR-067 — but it
+   * is therefore inside the tree a running endpoint writes, so the IAM condition
+   * carves it back out. ADR-007 says a deployed revision never mutates its own
+   * configuration, and that rule is older than where the file sits.
+   */
+  profileConfig: (profile: string): string => `${PROFILES_DIR}/${profile}/${PROFILE_FILE}`,
+  /** Cursors, and each provider's own keys, for this profile's use of an account. */
+  profileState: (profile: string): string => `${PROFILES_DIR}/${profile}/state.kv`,
+  /** Every vault connection's sealed document, for this profile. */
+  vaultRoot: (profile: string): string => `${PROFILES_DIR}/${profile}/vault.d`,
+  /** One sealed document per vault connection, each under its own key. */
+  vault: (profile: string, connection: string): string =>
+    `${PROFILES_DIR}/${profile}/vault.d/${connection}.enc`,
+  /**
+   * The same document, keyed relative to the blob store.
+   *
+   * `blobs()` is already rooted at the profile's directory, so a blob adapter
+   * handed the path above would write `profiles/p/profiles/p/vault.d/...`. Two
+   * spellings of one location is exactly what this file exists to prevent, so
+   * the second one lives here beside the first rather than being assembled at
+   * the call site.
+   */
+  vaultKey: (connection: string): string => `vault.d/${connection}.enc`,
+  /**
+   * Every skills connection's procedures, for this profile.
+   *
+   * The root is exported beside the per-connection path because `deploy` needs
+   * to recognise the *area* without knowing which connections exist — and
+   * `upload.ts` composes its allowlist back out of these rather than comparing
+   * against literals, so a renamed directory moves the store and the thing that
+   * sends it together, or neither.
+   */
+  skillsRoot: (profile: string): string => `${PROFILES_DIR}/${profile}/skills.d`,
+  /** One skills connection's procedures — `<name>.md` or `<name>/SKILL.md`, either layout. */
+  skills: (profile: string, connection: string): string =>
+    `${PROFILES_DIR}/${profile}/skills.d/${connection}`,
+  /** The blob root this profile's providers are namespaced under. */
+  blobs: (profile: string): string => `${PROFILES_DIR}/${profile}`,
 } as const;
+
+/**
+ * `data/`, which no longer exists — kept for the migrations that address it.
+ *
+ * Contracts 1 through 3 put everything a profile owned under `data/<profile>/`,
+ * and contract 4 moves it out (ADR-067). A migration reads the layout it is
+ * migrating *from*, and that layout is frozen: asking `layout` above would
+ * compare a contract-3 path against a contract-4 default and match nothing.
+ * `migrate-plan.ts` already spells the contract-1 defaults out for the same
+ * reason. Nothing outside a migration should import this.
+ */
+export const LEGACY_DATA_DIR = 'data';
+
+/**
+ * The registry's name, and a profile's path, through contract 3.
+ *
+ * Recognised, never written. Two live functions answer to these — the ancestor
+ * walk and `listProfiles` — for one reason: a workspace that needs migrating
+ * has to be findable by the command that migrates it, or `doctor --fix` reports
+ * no workspace here and the operator has a wall with no door.
+ */
+export const LEGACY_WORKSPACE_FILE = 'lanes-link.yaml';
+
+export function legacyProfileConfig(profile: string): string {
+  return `${PROFILES_DIR}/${profile}.yaml`;
+}