@lanes-sh/link 0.8.0 → 0.9.1

package/src/cli/contract4.ts

@@ -0,0 +1,349 @@
+import {
+  ConfigError,
+  layout,
+  listProfiles,
+  readWorkspaceFile,
+  workspaceFiles,
+  writeWorkspaceFile,
+  WORKSPACE_FILE,
+  CONNECTIONS_FILE,
+  openTarget,
+} from '#profile';
+import { parseDocument } from 'yaml';
+import { ConfigDocument } from './config-edit.ts';
+import { C3 } from './contract3-layout.ts';
+import { grantingProfiles, planMoves, type DataPlan, type Renames } from './contract4-data.ts';
+import { planRenames } from './contract4-rename.ts';
+import { ensureRegistryContract } from './config-repair-sweep.ts';
+import {
+  assertConnectionsSavable,
+  readConnectionRows,
+  renameConnections,
+  rewriteGrants,
+} from './contract4-yaml.ts';
+import { applyMoves, assertOneObjectPerDestination } from './migrate-move.ts';
+import {
+  applyCredentialMoves,
+  planCredentialMoves,
+  planVaultMoves,
+} from './contract4-credentials.ts';
+import { openSecretStoreFor } from './runtime/select.ts';
+import { buildRegistryWithWorkspace } from './runtime/registry.ts';
+
+/**
+ * Contract 3 to contract 4: a profile owns its data again.
+ *
+ * Contract 3 moved every account up to the workspace and, in the same sweep,
+ * moved the owner layer's bytes beside the *connection* — so a profile owned
+ * nothing and the shipped default had every profile granting one memory.
+ * ADR-066 reverses that half; ADR-067 collapses a profile into one directory
+ * and retires `data/`, which had stopped meaning anything once the declaration
+ * moved in beside the bytes.
+ *
+ * Four steps, ordered so a crash between any two leaves a workspace that still
+ * opens:
+ *
+ *   1. The registry is renamed. One document, cannot half-apply.
+ *   2. Bytes move — the workspace's up out of `data/`, a profile's into its
+ *      directory.
+ *   3. Declarations move into the directories they now name.
+ *   4. Each profile is stamped `contract: 4`.
+ *
+ * **The stamp is last, and it is the record that this finished** rather than a
+ * step among steps. Contract 3 shipped with it written first, which left
+ * profiles claiming the new contract with every byte still at the old path and
+ * a rerun that read the stamp and found nothing to do.
+ *
+ * Every read here goes through `C3`, and every write through `layout`. A
+ * migration that asks the live layout for its *source* paths finds nothing to
+ * move the moment the next contract lands.
+ */
+
+export interface Contract4Migration {
+  readonly workspaceRoot: string;
+  readonly profiles: readonly string[];
+  readonly changes: readonly string[];
+  /** Copied into more than one profile, original left. The operator decides. */
+  readonly shared: DataPlan['shared'];
+  /** Granted by no profile. Left where it is. */
+  readonly orphaned: readonly string[];
+  readonly alreadyCurrent: boolean;
+}
+
+/** Whether this workspace still holds anything at contract 3. */
+export async function needsContract4(workspaceRoot: string): Promise<boolean> {
+  for (const profile of await listProfiles(workspaceRoot)) {
+    const raw = await readProfile(workspaceRoot, profile);
+    if (raw !== null && (raw.contract ?? 0) === 3) return true;
+  }
+  return false;
+}
+
+async function readProfile(
+  root: string,
+  profile: string,
+): Promise<{ contract?: number; grants?: { connection?: unknown }[] } | null> {
+  const files = workspaceFiles(root);
+  // The contract-3 path first: a profile still to be migrated is there, and one
+  // already migrated is at the new path. Reading only one shape makes a rerun
+  // after an interruption see half a workspace.
+  const text =
+    (await readWorkspaceFile(files, C3.profile(profile))) ??
+    (await readWorkspaceFile(files, layout.profileConfig(profile)));
+  if (text === null) return null;
+  try {
+    return parseDocument(text).toJSON() as { contract?: number };
+  } catch {
+    return null;
+  }
+}
+
+export async function migrateToContract4(
+  workspaceRoot: string,
+  options: { apply: boolean; target?: string } = { apply: true },
+): Promise<Contract4Migration> {
+  const target = options.target ?? 'local';
+  const names = await listProfiles(workspaceRoot);
+  const configs = new Map<string, { grants?: { connection?: unknown }[] }>();
+
+  for (const profile of names) {
+    const raw = await readProfile(workspaceRoot, profile);
+    if (raw !== null && (raw.contract ?? 0) === 3) configs.set(profile, raw);
+  }
+
+  if (configs.size === 0) {
+    return {
+      workspaceRoot,
+      profiles: [],
+      changes: [],
+      shared: [],
+      orphaned: [],
+      alreadyCurrent: true,
+    };
+  }
+
+  const profiles = [...configs.keys()];
+  const files = workspaceFiles(workspaceRoot);
+
+  // Every connection the workspace holds, and the id each ends up with. Built
+  // once and read by every rewrite below — the contract-3 mover's own bug was a
+  // map keyed one way and queried the other, which made the resolution a silent
+  // no-op and sent two profiles' blobs into one namespace.
+  await assertConnectionsSavable(workspaceRoot);
+
+  const rows = await readConnectionRows(workspaceRoot);
+  const renames = planRenames(rows);
+
+  const plan = await planMoves(files, grantingProfiles(configs), profiles, renames);
+
+  // Everything that can refuse, before the first byte moves. A `keep` move is
+  // exempt: two profiles granting one store are *meant* to write one source to
+  // two destinations, which is the shape this check exists to catch elsewhere.
+  assertOneObjectPerDestination(plan.moves.filter((move) => move.keep !== true));
+
+  const changes = [...describe(plan, profiles), ...repositoryNotes(configs, renames)];
+  if (!options.apply) {
+    return {
+      workspaceRoot,
+      profiles,
+      changes,
+      shared: plan.shared,
+      orphaned: plan.orphaned,
+      alreadyCurrent: false,
+    };
+  }
+
+  await renameRegistry(workspaceRoot);
+
+  // The registry's own stamp, which the byte-for-byte rename carries across
+  // unchanged. Here rather than inside `renameRegistry` because that function
+  // returns early on a workspace already holding `workspaces.yaml`, which is
+  // exactly the workspace whose stamp is stale.
+  await ensureRegistryContract(workspaceRoot);
+  await applyMoves(files, plan.moves);
+
+  // Credentials before the rows: a ref is derived from the id, so the rows must
+  // still name the old one for `planCredentialMoves` to compute the same pair
+  // on a rerun.
+  const credentials = await moveCredentials(workspaceRoot, target, rows, renames, configs);
+
+  // **The rows are renamed after the grants and before the stamp**, and every
+  // window that leaves is one a rerun closes. `connections.yaml` is the only
+  // source `planRenames` has, so renaming it before the grants destroyed the
+  // map mid-flight: the rerun read the new rows, computed `lan1 → lan1`, found
+  // no mapping for `memory.main`, and stamped a profile whose grants named a
+  // connection nothing declared — refused at load, and `needsContract4` false,
+  // so no migration would ever run again.
+  //
+  // Both rewrites are idempotent, which is what makes the order safe rather
+  // than merely better: a grant already naming the new ref is not in the map
+  // and is left alone, and so is a row.
+  await rewriteGrants(workspaceRoot, profiles, renames);
+  await renameConnections(workspaceRoot, renames);
+
+  // Last. The stamp is the record that the migration finished.
+  for (const profile of profiles) {
+    const document = await ConfigDocument.openKey(workspaceRoot, layout.profileConfig(profile));
+    document.setIn(['contract'], 4);
+    await document.save();
+  }
+
+  return {
+    workspaceRoot,
+    profiles,
+    changes: [...changes, ...credentials],
+    shared: plan.shared,
+    orphaned: plan.orphaned,
+    alreadyCurrent: false,
+  };
+}
+
+/**
+ * Move each stored credential to the ref its renamed connection now derives.
+ *
+ * **Throws rather than warns**, and that is the whole of its error handling. It
+ * warned once, and the rehearsal that found it showed why it must not: the
+ * warning was printed, `renameConnections` ran anyway, and the workspace came
+ * out with rows naming `gmail.con1` while the secret sat at
+ * `gmail/wjj_andrews`. A rerun cannot repair that — the rows are renamed, so
+ * the second run computes no rename for them and the old ref is orphaned with
+ * nothing left that knows what it belonged to.
+ *
+ * Failing here leaves the rows untouched, which is the state a rerun *can*
+ * finish from. Bytes that already moved are found in place and skipped.
+ */
+async function moveCredentials(
+  root: string,
+  target: string,
+  rows: readonly { id: string; provider: string }[],
+  renames: Renames,
+  profiles: ReadonlyMap<string, { grants?: { connection?: unknown }[] }>,
+): Promise<string[]> {
+  if (rows.length === 0) return [];
+
+  const [store, registry] = await Promise.all([
+    openSecretStoreFor(root, target),
+    buildRegistryWithWorkspace(root),
+  ]);
+
+  // `readConnectionRows`, not `readConnections`. The latter runs
+  // `assertNoRenamedProviders`, which refuses a `tasks` row — and a workspace
+  // holding one is exactly the workspace being migrated, so reading through the
+  // guard makes the refusal block its own fix. ADR-051's rule, met twice now: a
+  // refusal has to name a command, and the command has to be able to run.
+  // The vault's document is planned separately because `credentialRefFor`
+  // cannot name it — see `planVaultMoves`. One apply for both, so a source
+  // feeding several destinations is deleted once rather than per plan.
+  const declared = (await openTarget(root, target)).declared;
+
+  return await applyCredentialMoves(store, [
+    ...planCredentialMoves(await readConnectionRows(root, true), registry, renames),
+    ...(declared.vault?.adapter === 'secret'
+      ? planVaultMoves(profiles, renames, declared.vault.ref)
+      : []),
+  ]);
+}
+
+/**
+ * `lanes-link.yaml` becomes `workspaces.yaml`.
+ *
+ * Written then deleted rather than moved, so an interruption leaves both and
+ * `readWorkspace` — which prefers the new name — still opens the workspace.
+ * Losing this file is losing the address of every target.
+ */
+async function renameRegistry(root: string): Promise<void> {
+  const files = workspaceFiles(root);
+  if (await files.has(WORKSPACE_FILE)) return;
+
+  const text = await readWorkspaceFile(files, C3.workspace);
+  if (text === null) return;
+
+  await writeWorkspaceFile(files, WORKSPACE_FILE, text);
+  if ((await readWorkspaceFile(files, WORKSPACE_FILE)) === null) {
+    throw new ConfigError(
+      `${WORKSPACE_FILE} did not read back after being written. Nothing has been deleted; ` +
+        'fix the store and run this again.',
+    );
+  }
+  await files.delete(C3.workspace);
+}
+
+/**
+ * What a `knowledge:` repository needs done by hand, named rather than left.
+ *
+ * A profile keeping its memory and entities in GitHub addresses them by the
+ * connection id — an entry reaches the repository as `memory/<id>/<entry>.md`.
+ * Contract 4 renames the id, so the provider starts reading `memory/lan1/`
+ * while the repository still holds `memory/main/`: `memory_search` returns
+ * nothing and `entities_find` finds nobody, with the data sitting intact under
+ * the old name and nothing having failed.
+ *
+ * Not repaired here on purpose. Renaming directories in somebody's repository
+ * is a network write to a thing this migration does not own, and `applyMoves`
+ * cannot reach a GitHub store at all — so the honest move is to say exactly
+ * what to rename, which is one `git mv` per area. `removalPlan` warns about the
+ * same class for the same reason.
+ */
+function repositoryNotes(
+  configs: ReadonlyMap<string, { knowledge?: unknown; grants?: { connection?: unknown }[] }>,
+  renames: Renames,
+): string[] {
+  const notes: string[] = [];
+
+  for (const [profile, config] of configs) {
+    const repo = (config.knowledge as { repo?: unknown } | undefined)?.repo;
+    if (typeof repo !== 'string') continue;
+
+    for (const surface of ['memory', 'entities'] as const) {
+      const granted = (config.grants ?? [])
+        .map((grant) => grant.connection)
+        .find((ref): ref is string => typeof ref === 'string' && ref.startsWith(`${surface}.`));
+      if (granted === undefined) continue;
+
+      const to = renames.get(granted);
+      if (to === undefined) continue;
+
+      const was = granted.slice(granted.indexOf('.') + 1);
+      const now = to.slice(to.indexOf('.') + 1);
+      if (was === now) continue;
+
+      notes.push(
+        `${repo}: rename ${surface}/${was}/ to ${surface}/${now}/ — "${profile}" reads it by the ` +
+          'connection id, and nothing here can write to your repository',
+      );
+    }
+  }
+
+  return notes;
+}
+
+function describe(plan: DataPlan, profiles: readonly string[]): string[] {
+  const changes = [`${C3.workspace} → ${WORKSPACE_FILE}`];
+
+  for (const profile of profiles) {
+    changes.push(`${C3.profile(profile)} → ${layout.profileConfig(profile)}: contract 4`);
+  }
+
+  const moved = plan.moves.filter((move) => move.keep !== true).length;
+  if (moved > 0) changes.push(`${moved} object(s) moved out of data/`);
+
+  for (const { key, profiles: owners } of plan.shared) {
+    changes.push(`${key}: copied into ${owners.join(' and ')} — the original is left for you`);
+  }
+  for (const key of plan.orphaned) {
+    changes.push(`${key}: no profile grants it, so it stays where it is`);
+  }
+
+  // Said as what it is. Contract 3 merged these and deliberately did not delete
+  // them, so a workspace that came through it still holds a decryptable
+  // credential document per profile — and reporting that as an ungranted store
+  // reads as tidy-up rather than as a credential left on disk.
+  for (const key of plan.leftover) {
+    changes.push(
+      `${key}: a credential store contract 3 merged and left behind — its contents are in ` +
+        `${layout.credentials()} now, so delete it`,
+    );
+  }
+
+  return changes;
+}

package/src/cli/identity.ts

@@ -88,10 +88,10 @@ export async function resolveAccount(
       if (!primary || !identity.qualifier) return primary;
 
       // `alice (Acme)` rather than `alice`. The bracketed half is what makes
-      // two workspaces two accounts instead of one overwritten twice, and it
-      // survives into the connection id because `idFromAccount` slugifies the
-      // whole string when there is no `@` in it — `alice_acme`, which is a row
-      // somebody can read in `status`.
+      // two workspaces two accounts instead of one overwritten twice: the
+      // reconnect match below is on the account, so without it the second
+      // connect repairs the first row rather than adding one. It used to reach
+      // the id as well, back when the id was slugified from this.
       const qualifier = pluck(body, identity.qualifier);
       return qualifier ? `${primary} (${qualifier})` : primary;
     }
@@ -116,29 +116,47 @@ export async function resolveAccount(
 }
 
 /**
- * Turn an account into a connection id.
+ * `lan` for a surface built into Lanes, `con` for somebody's account.
  *
- * `ada.lovelace@example.com` becomes `ada_lovelace`, which is what appears in
- * `credential_ref` and in the agent's `connection` argument. The local part is
- * enough to tell accounts apart in practice, and the full address is still
- * right there in `account` when it is not.
+ * The prefix is the only thing an id says, and it says the one thing that is
+ * true forever: whether there is a vendor behind this row. Everything else a
+ * reader wants — whose mailbox, what the operator calls it — is `account` and
+ * `label`, one field each, both changeable without moving a reference.
  */
-export function idFromAccount(account: string, taken: readonly string[] = []): string {
-  const local = account.includes('@') ? (account.split('@')[0] ?? account) : account;
-
-  const base =
-    local
-      .toLowerCase()
-      .replace(/[^a-z0-9]+/g, '_')
-      .replace(/^_+|_+$/g, '')
-      .slice(0, 40) || 'main';
-
-  if (!taken.includes(base)) return base;
-
-  // A genuine collision — two accounts sharing a local part, e.g. the same
-  // name at two domains. Suffixing beats overwriting someone else's credential.
-  for (let n = 2; ; n++) {
-    const candidate = `${base}${n}`;
-    if (!taken.includes(candidate)) return candidate;
+export const OWNER_ID_PREFIX = 'lan';
+export const ACCOUNT_ID_PREFIX = 'con';
+
+/**
+ * The next free connection id.
+ *
+ * **Opaque, where this used to derive the id from the account.**
+ * `ada.lovelace@example.com` became `ada_lovelace`, on the reasoning that the
+ * local part tells accounts apart in practice. It does not: the same name at
+ * two domains produced `ada_lovelace` and `ada_lovelace2`, and an id that half
+ * describes its account is worse than one that does not, because it invites
+ * being trusted. What made that concrete is that the id is the whole of the
+ * `connection` enum a model chooses from.
+ *
+ * So the id is a key and nothing else. `account` carries the identity the
+ * provider reports and `label` the operator's own word, which means a `relabel`
+ * never moves a `credential_ref`, a blob path, or a grant.
+ *
+ * **A leading letter, not a bare number.** `id: 001` parses as the integer `1`
+ * in YAML, so `gmail.001` in a grant would match nothing and every id would need
+ * quoting forever. `con1` is a string unconditionally.
+ *
+ * Numbers are never reused: the highest taken plus one, so an id that appears
+ * in an audit log years later still means the row it meant then.
+ */
+export function nextConnectionId(taken: readonly string[], owner: boolean): string {
+  const prefix = owner ? OWNER_ID_PREFIX : ACCOUNT_ID_PREFIX;
+  const pattern = new RegExp(`^${prefix}([0-9]+)$`);
+
+  let highest = 0;
+  for (const id of taken) {
+    const match = pattern.exec(id);
+    if (match) highest = Math.max(highest, Number(match[1]));
   }
+
+  return `${prefix}${highest + 1}`;
 }

package/src/cli/main.ts

@@ -202,7 +202,8 @@ export async function run(argv: readonly string[]): Promise<void> {
         case 'remove':
           if (!rest[0]) {
             throw new Error(
-              `Usage: ${PROGRAM} profile remove <name> [--workspace <name>] [--dry-run] [--yes]`,
+              `Usage: ${PROGRAM} profile remove <name> [--workspace <name>] [--dry-run] [--yes] ` +
+                '[--delete-data | --migrate-to <profile>]',
             );
           }
           return profileRemove(rest[0], {
@@ -210,6 +211,10 @@ export async function run(argv: readonly string[]): Promise<void> {
             json,
             dryRun: flags['dry-run'] === true,
             yes: flags['yes'] === true,
+            deleteData: flags['delete-data'] === true,
+            ...(typeof flags['migrate-to'] === 'string'
+              ? { migrateTo: flags['migrate-to'] }
+              : {}),
           });
         default:
           throw new Error(`Unknown: ${PROGRAM} profile ${second}`);

package/src/cli/migrate-move.ts

@@ -0,0 +1,166 @@
+import { ConfigError } from '#profile';
+import type { BlobStore } from '#stores/blobs';
+
+/**
+ * Moving objects between two layouts, without losing one.
+ *
+ * Shared by every contract migration that relocates bytes rather than YAML —
+ * contract 3 hoisting a profile's data to the workspace, contract 4 carrying it
+ * back into the profile. Each learned the same rules the same hard way, so they
+ * live once: nothing is deleted until what replaced it has been read back, every
+ * destination is checked before the first byte moves, and a rerun after an
+ * interruption finishes rather than refusing.
+ */
+
+export interface Move {
+  readonly from: string;
+  readonly to: string;
+  /**
+   * Rewrite the object's bytes on the way across.
+   *
+   * Only a connection record needs this, and it needs it for a reason a plain
+   * copy cannot serve: `ConnectionRepository.list` reads `provider` and `id`
+   * out of the record *body*, not out of the key it was stored under. A renamed
+   * connection whose bytes were copied verbatim would sit at
+   * `connections.v1/vault.work` still calling itself `vault.main`, and the next
+   * `upsert` would write a second record beside it.
+   */
+  readonly rewrite?: (data: Uint8Array) => Uint8Array;
+  /**
+   * Write only where the destination is empty; leave the source alone if not.
+   *
+   * For the objects two profiles can legitimately both hold — a connection they
+   * share, a provider-keyed cache, one custom manifest — where a second copy is
+   * a duplicate rather than a clash. `claim` drops the loser within one run, but
+   * deletes the winner's source and leaves the loser's: the rerun then saw a
+   * different first claimant, found foreign bytes at the destination, and threw,
+   * permanently. `rewriteProfiles` stamps the contract *after* the moves, so an
+   * interruption during them forces exactly that rerun.
+   */
+  readonly whenAbsent?: boolean;
+  /**
+   * Copy, and leave the source where it is.
+   *
+   * For the one thing contract 4 cannot decide: a store two profiles both grant
+   * has to land in both, and neither copy may delete what the other still needs
+   * to read. The original is reported rather than removed — merging two sets of
+   * notes is not reversible, and picking one profile's would take the other's
+   * away silently.
+   */
+  readonly keep?: boolean;
+}
+
+/**
+ * Two objects aimed at one key, caught while this is still a plan.
+ *
+ * `applyMoves` checks the destination per object as well, but that check cannot
+ * see a collision between two objects *in this run* once the moves are applied
+ * concurrently — both would look at an absent destination and both would write.
+ * Hoisting it here also puts it where this file says it belongs: everything that
+ * can fail happens before the first byte moves, so a refusal leaves the
+ * workspace exactly as it was.
+ */
+export function assertOneObjectPerDestination(moves: readonly Move[]): void {
+  const seen = new Map<string, string>();
+
+  for (const move of moves) {
+    const first = seen.get(move.to);
+    if (first !== undefined) {
+      throw new ConfigError(
+        `Two objects want to be at ${move.to}, and this migration cannot merge them.\n` +
+          `  ${first} and ${move.from}. Nothing has been written.\n` +
+          '  Which one to keep is yours to decide, because both are your data: move or\n' +
+          '  delete one of the two, then run this again.',
+      );
+    }
+    seen.set(move.to, move.from);
+  }
+}
+
+/** First claim on a destination wins; a later one is left where it is. */
+export function claim(claimed: Set<string>, move: Move): Move | null {
+  if (claimed.has(move.to)) return null;
+  claimed.add(move.to);
+  return { ...move, whenAbsent: true };
+}
+
+/**
+ * How many objects are in flight at once.
+ *
+ * Serial was fine while this only ever ran against a local disk. A deployed
+ * workspace's audit log is one object per event, so the first real bucket this
+ * migrated held 1,906 of them — three round trips each, in series, is minutes of
+ * a deploy spent with nothing on screen. The same 16 the read paths in
+ * `#providers/memory` and `#providers/tasks` settled on, and for the same
+ * reason: enough to hide the latency, not enough to look like an incident to the
+ * other end.
+ *
+ * Safe to widen only while each move stays independent, which is what
+ * `assertOneObjectPerDestination` guarantees.
+ */
+const MOVE_CONCURRENCY = 16;
+
+export async function applyMoves(files: BlobStore, moves: readonly Move[]): Promise<void> {
+  const pending = moves.filter((move) => move.from !== move.to);
+
+  for (let start = 0; start < pending.length; start += MOVE_CONCURRENCY) {
+    await Promise.all(
+      pending.slice(start, start + MOVE_CONCURRENCY).map((move) => applyMove(files, move)),
+    );
+  }
+}
+
+/** One object, moved or finished. Never deletes before the copy reads back. */
+async function applyMove(files: BlobStore, move: Move): Promise<void> {
+  const source = await files.get(move.from);
+  if (source === null) return;
+
+  // Before the comparison below as well as before the write. Comparing the
+  // *source* bytes against a destination that holds the rewritten ones would
+  // read an already-finished move as a collision, and refuse the one rerun this
+  // file promises.
+  const data = move.rewrite === undefined ? source : move.rewrite(source);
+
+  if (await files.has(move.to)) {
+    const held = await files.get(move.to);
+
+    // Raced away between the two calls, so there is nothing there after all and
+    // the ordinary path below is still the right one.
+    if (held !== null) {
+      // Another instance of the same connection, or another profile's copy of
+      // one shared cache, got there first. Left where it is rather than
+      // refused — and rerunnable, which is the whole point.
+      if (!sameBytes(held, data)) {
+        if (move.whenAbsent === true) return;
+        throw new ConfigError(
+          `Two objects want to be at ${move.to}, and this migration cannot merge them.\n` +
+            `  ${move.from} is the second, and what is already there is not a copy of it.\n` +
+            '  Nothing has been deleted. Please report it with the layout of your data ' +
+            'directory.',
+        );
+      }
+
+      // Already copied, by a run that did not get to the delete.
+      if (move.keep !== true) await files.delete(move.from);
+      return;
+    }
+  }
+
+  await files.put(move.to, data);
+  if ((await files.get(move.to)) === null) {
+    throw new ConfigError(
+      `${move.to} did not read back after being written. Nothing has been deleted; ` +
+        `fix the store and run this again.`,
+    );
+  }
+
+  if (move.keep !== true) await files.delete(move.from);
+}
+
+function sameBytes(left: Uint8Array, right: Uint8Array): boolean {
+  if (left.length !== right.length) return false;
+  for (let index = 0; index < left.length; index += 1) {
+    if (left[index] !== right[index]) return false;
+  }
+  return true;
+}

package/src/cli/migrate-plan.ts

@@ -1,5 +1,5 @@
 import {
-  DATA_DIR, ConfigError, layout, isRemoteWorkspace, type LegacyTarget, type WorkspaceTarget } from '#profile';
+  LEGACY_DATA_DIR, ConfigError, layout, isRemoteWorkspace, type LegacyTarget, type WorkspaceTarget } from '#profile';
 import { deployedWorkspace } from '#deployments/upload.ts';
 
 /**
@@ -111,8 +111,8 @@ export function toEntry(
   // and `layout` describes where things live *now* — workspace-level since
   // ADR-057. Asking it would compare a contract-1 path against a contract-3
   // default and refuse every profile that had written the ordinary one.
-  const defaultStorage = `./${DATA_DIR}/${profile}`;
-  const defaultCredentials = `./${DATA_DIR}/${profile}/credentials.enc`;
+  const defaultStorage = `./${LEGACY_DATA_DIR}/${profile}`;
+  const defaultCredentials = `./${LEGACY_DATA_DIR}/${profile}/credentials.enc`;
 
   refuseCustomPath(name, profile, workspaceRoot, 'storage.path', storagePath, defaultStorage);
   refuseCustomPath(

package/src/cli/publish.ts

@@ -102,11 +102,7 @@ export async function publishProfileEdit(input: {
   /** Every profile the edit touched, where it reached more than the one named. */
   readonly touched?: readonly string[] | undefined;
 }): Promise<PublishOutcome> {
-  const credentials = await openSecretStoreFor(
-    input.config,
-    input.resolution.workspaceRoot,
-    input.target,
-  );
+  const credentials = await openSecretStoreFor(input.resolution.workspaceRoot, input.target);
 
   return publishAndNotify({
     config: input.config,