@lanes-sh/link 0.9.2 → 0.9.3

package/src/cli/contract5.ts

@@ -0,0 +1,234 @@
+import {
+  CONNECTIONS_FILE,
+  layout,
+  listProfiles,
+  readWorkspaceFile,
+  workspaceFiles,
+} from '#profile';
+import { parseDocument } from 'yaml';
+import { ConfigDocument } from './config-edit.ts';
+import { openOrCreateConnections } from './config-repair-sweep.ts';
+import { ensureRegistryContract } from './config-repair-sweep.ts';
+
+/**
+ * Contract 4 to contract 5: the endpoint token becomes a person's.
+ *
+ * Contract 4 left `auth.token_ref` on every profile, defaulting to the constant
+ * `profile/token` out of a credential store that has been one per workspace
+ * since contract 3. So "the profile's token" was the workspace's wearing a
+ * per-profile name, which is why `profile remove` once deleted the token its
+ * siblings were being served by, and why every command whose subject is the
+ * endpoint had to name a profile in order to find it. ADR-068 moves it to
+ * `tokens:` in `connections.yaml`, one row per token, each naming the Lanes
+ * subject it was issued to.
+ *
+ * **The subject is what this migration cannot invent.** A row exists so a
+ * bearer token can resolve through `members:` the way an OAuth token does, and
+ * a row with the wrong subject is worse than no row: it is a credential that
+ * looks issued and reaches nothing, or reaches somebody else's profiles. So the
+ * subject comes from the profiles themselves — the owner-role member of a
+ * profile that actually holds the token — and when there is no such member this
+ * refuses and says which command fixes it.
+ *
+ * Three steps, ordered so a crash between any two leaves a workspace that still
+ * opens and a rerun that still finishes:
+ *
+ *   1. The row is written into `connections.yaml`, pointing at the ref the
+ *      value is *already* under. Nothing moves in the credential store, which
+ *      is what makes this safe to interrupt: the old key and the new row name
+ *      the same bytes.
+ *   2. `auth.token_ref` is removed from each profile.
+ *   3. Each profile is stamped `contract: 5`.
+ *
+ * **The stamp is last**, for the reason contract 4 records: contract 3 shipped
+ * with it first, which left profiles claiming the new contract with every byte
+ * at the old path and a rerun that read the stamp and found nothing to do.
+ *
+ * **The ref is not renamed to `tokens/tok1`.** It would read better and it
+ * would mean copying a live credential in a store that may be Secret Manager,
+ * then deleting the original — two writes and a window where a deployed
+ * revision reads neither. A row may name any ref; `profile/token` is a
+ * perfectly good one, and the one thing that must not break here is an endpoint
+ * that was working before the upgrade.
+ */
+
+export interface Contract5Migration {
+  readonly workspaceRoot: string;
+  readonly profiles: readonly string[];
+  readonly changes: readonly string[];
+  /** Written into `tokens:`, as `id → subject`. Empty when there was no token. */
+  readonly issued: readonly { readonly id: string; readonly subject: string }[];
+  readonly alreadyCurrent: boolean;
+}
+
+interface RawProfile {
+  readonly contract?: number;
+  readonly auth?: { readonly token_ref?: unknown };
+  readonly members?: readonly { readonly subject?: unknown; readonly role?: unknown }[];
+}
+
+/** Whether this workspace still holds anything at contract 4. */
+export async function needsContract5(workspaceRoot: string): Promise<boolean> {
+  for (const profile of await listProfiles(workspaceRoot)) {
+    const raw = await readProfile(workspaceRoot, profile);
+    if (raw !== null && (raw.contract ?? 0) === 4) return true;
+  }
+  return false;
+}
+
+export async function migrateToContract5(
+  workspaceRoot: string,
+  options: { apply: boolean; subject?: string } = { apply: true },
+): Promise<Contract5Migration> {
+  const legacy = new Map<string, RawProfile>();
+
+  for (const profile of await listProfiles(workspaceRoot)) {
+    const raw = await readProfile(workspaceRoot, profile);
+    if (raw !== null && (raw.contract ?? 0) === 4) legacy.set(profile, raw);
+  }
+
+  if (legacy.size === 0) {
+    return { workspaceRoot, profiles: [], changes: [], issued: [], alreadyCurrent: true };
+  }
+
+  const profiles = [...legacy.keys()];
+  const changes: string[] = [];
+  const issued: { id: string; subject: string }[] = [];
+
+  // Every distinct ref the profiles held, in the order they are declared. Almost
+  // always one — the template's constant — but a profile that overrode
+  // `token_ref` had a genuinely separate credential, and dropping it would take
+  // a working endpoint down.
+  const refs = new Map<string, string[]>();
+  for (const [profile, raw] of legacy) {
+    const ref = typeof raw.auth?.token_ref === 'string' ? raw.auth.token_ref : 'profile/token';
+    refs.set(ref, [...(refs.get(ref) ?? []), profile]);
+  }
+
+  if (!options.apply) {
+    for (const [ref, holders] of refs) {
+      changes.push(`${CONNECTIONS_FILE}: tokens += a row for "${ref}" (${holders.join(', ')})`);
+    }
+    for (const profile of profiles) changes.push(`${profile}: auth.token_ref removed`);
+    return { workspaceRoot, profiles, changes, issued: [], alreadyCurrent: false };
+  }
+
+  // **The one thing this cannot guess.** `--subject` from `update`, else the
+  // owner-role member of a profile that held the ref. Refusing beats writing a
+  // row nobody can use: a token bound to the wrong subject reaches the wrong
+  // profiles, and one bound to nobody reaches none while looking issued.
+  const document = await openOrCreateConnections(workspaceRoot);
+  // Through `toJSON`, not `getIn`. `getIn` hands back YAML nodes, so reading
+  // `row.ref` off one is `undefined` — the idempotence check below silently
+  // never matched, and a rerun after an interruption wrote the row twice.
+  const existing = asRows((document.toJSON() as { tokens?: unknown } | null)?.tokens);
+  let next = existing.length + 1;
+
+  for (const [ref, holders] of refs) {
+    // Already migrated, which is what an interrupted run looks like from here.
+    if (existing.some((row) => row.ref === ref)) continue;
+
+    const subject = options.subject ?? ownerSubject(legacy, holders);
+    if (subject === undefined) {
+      throw new ContractError(
+        `Cannot migrate the endpoint token at "${ref}": a token now names the person it was\n` +
+          'issued to (ADR-068), and no profile holding it lists an owner.\n' +
+          `  Holding it: ${holders.join(', ')}\n` +
+          '  Sign in and say who you are, then run this again:\n' +
+          '    lanes auth login\n' +
+          `    lanes link profile members add --me --profile ${holders[0]} --workspace <name>`,
+      );
+    }
+
+    const id = `tok${next++}`;
+    document.addTo(['tokens'], { id, subject, ref, label: 'migrated' });
+    issued.push({ id, subject });
+    changes.push(`${CONNECTIONS_FILE}: tokens += ${id} → ${subject} ("${ref}")`);
+
+    // **Say so when the row reaches nothing.** A subject that no profile lists
+    // is a token the endpoint refuses, and the operator's CI would fail with a
+    // 401 that reads as a bad credential. It happens on the path a signed-in
+    // operator upgrades a workspace whose `members:` is empty — legitimate, and
+    // contract 3 only fills that in for workspaces it migrates itself.
+    if (!listedAnywhere(legacy, subject)) {
+      changes.push(
+        `  warning: no profile lists ${subject}, so ${id} reaches nothing until one does — ` +
+          'lanes link profile members add --me --profile <name> --workspace <name>',
+      );
+    }
+  }
+
+  // The stamp, for the reason contract 4 gives where it does the same: nothing
+  // reads this field — every contract check is on a profile — which is exactly
+  // why it goes stale, and a marker that lies is worse than no marker for
+  // whoever writes the next migration.
+  document.setIn(['contract'], 5);
+
+  await document.save();
+
+  for (const profile of profiles) {
+    const config = await ConfigDocument.open(workspaceRoot, profile);
+    config.removeIn(['auth', 'token_ref']);
+    // Last, and the record that this profile finished.
+    config.setIn(['contract'], 5);
+    await config.save({ contract: 5 });
+    changes.push(`${profile}: auth.token_ref removed, contract 5`);
+  }
+
+  // After the profiles, so the registry never claims a contract they have not
+  // reached — `isUnmigrated` reads this field and nothing else.
+  await ensureRegistryContract(workspaceRoot, 5);
+
+  return { workspaceRoot, profiles, changes, issued, alreadyCurrent: false };
+}
+
+/** Raised so `doctor` and `update` can print it rather than a stack. */
+export class ContractError extends Error {}
+
+/** Whether any profile being migrated lists this subject as a member. */
+function listedAnywhere(legacy: ReadonlyMap<string, RawProfile>, subject: string): boolean {
+  for (const raw of legacy.values()) {
+    if ((raw.members ?? []).some((member) => member.subject === subject)) return true;
+  }
+  return false;
+}
+
+/**
+ * The subject to bind a ref to: an owner of a profile that held it.
+ *
+ * `owner` rather than any member, because `owner` is who may edit the member
+ * list (ADR-060) and is therefore the one role that cannot have been delegated
+ * a narrower reach than the token used to have. Falls back to any member, since
+ * a profile with members and no owner still has somebody this belonged to, and
+ * a workspace migrated by contract 3 while signed out has neither.
+ */
+function ownerSubject(
+  legacy: ReadonlyMap<string, RawProfile>,
+  holders: readonly string[],
+): string | undefined {
+  for (const role of ['owner', undefined]) {
+    for (const profile of holders) {
+      for (const member of legacy.get(profile)?.members ?? []) {
+        if (typeof member.subject !== 'string') continue;
+        if (role === undefined || member.role === role) return member.subject;
+      }
+    }
+  }
+  return undefined;
+}
+
+function asRows(value: unknown): readonly { ref?: string }[] {
+  return Array.isArray(value) ? (value as { ref?: string }[]) : [];
+}
+
+async function readProfile(root: string, profile: string): Promise<RawProfile | null> {
+  const text = await readWorkspaceFile(workspaceFiles(root), layout.profileConfig(profile));
+  if (text === null) return null;
+  try {
+    return parseDocument(text).toJSON() as RawProfile;
+  } catch {
+    // A file that will not parse is not this migration's problem to report;
+    // `check` has a better sentence for it than "needs migrating" would.
+    return null;
+  }
+}

package/src/cli/endpoint-url.ts

@@ -42,19 +42,33 @@ export function localUrl(config: Config): string {
  *
  * Anonymous would be enough to prove a socket is bound, but the profile list is
  * behind the token, and the profile is the whole point of asking.
+ *
+ * **The token is optional** since ADR-068, because a healthy workspace may have
+ * issued none: a person's client signs in for itself and needs no static
+ * credential. Without one this still tells a caller whether anything is
+ * answering, which is the half every caller uses; `profiles` comes back empty
+ * rather than absent, so a caller cannot mistake "withheld" for "none served".
  */
-export async function endpointHealth(url: string, token: string): Promise<EndpointHealth | null> {
+export async function endpointHealth(
+  url: string,
+  token?: string | undefined,
+): Promise<EndpointHealth | null> {
   try {
     const probe = new URL(url);
     probe.pathname = '/health';
     const response = await fetch(probe, {
-      headers: { authorization: `Bearer ${token}` },
+      ...(token === undefined ? {} : { headers: { authorization: `Bearer ${token}` } }),
       signal: AbortSignal.timeout(700),
     });
     if (!response.ok) return null;
 
     const body = (await response.json()) as Partial<EndpointHealth>;
-    return body.profile ? { profile: body.profile, profiles: body.profiles ?? [body.profile] } : null;
+    if (body.profile) {
+      return { profile: body.profile, profiles: body.profiles ?? [body.profile] };
+    }
+    // Answered, but withheld the list — which is what an unauthenticated probe
+    // gets. Reporting the endpoint as absent would be wrong: it is up.
+    return token === undefined ? { profile: '', profiles: [] } : null;
   } catch {
     return null;
   }

package/src/cli/main.ts

@@ -21,6 +21,9 @@ import {
   policyRule,
   start,
   status,
+  tokenIssue,
+  tokenList,
+  tokenRevoke,
   tokenRotate,
   tokenShow,
   tools,
@@ -284,16 +287,37 @@ export async function run(argv: readonly string[]): Promise<void> {
           throw new Error(`Unknown: ${PROGRAM} policy ${second}`);
       }
 
-    case 'token':
+    case 'token': {
+      const row = {
+        ...global,
+        show,
+        raw,
+        ...(typeof flags['id'] === 'string' ? { id: flags['id'] } : {}),
+        ...(typeof flags['subject'] === 'string' ? { subject: flags['subject'] } : {}),
+        me: flags['me'] === true,
+        ...(typeof flags['label'] === 'string' ? { label: flags['label'] } : {}),
+        json: flags['json'] === true,
+      };
       switch (second) {
-        case 'show':
+        // A bare `token` lists rather than showing one. It used to show, because
+        // there was one token and nothing to list; there are several now, and a
+        // command that printed a credential when asked for an inventory would be
+        // the wrong default in the more expensive direction.
+        case 'list':
         case undefined:
-          return tokenShow({ ...global, show, raw });
+          return tokenList(row);
+        case 'issue':
+          return tokenIssue(row);
+        case 'show':
+          return tokenShow(row);
         case 'rotate':
-          return tokenRotate({ ...global, show });
+          return tokenRotate(row);
+        case 'revoke':
+          return tokenRevoke(row);
         default:
           throw new Error(`Unknown: ${PROGRAM} token ${second}`);
       }
+    }
 
     case 'pair':
       return pair({

package/src/cli/publish.ts

@@ -1,5 +1,5 @@
 import type { SecretStore } from '#secrets';
-import { openTarget, type Config } from '#profile';
+import { anyIssuedToken, openTarget, type Config } from '#profile';
 import { publishWorkspace } from '#deployments/upload.ts';
 import { openSecretStoreFor, type Runtime } from './runtime.ts';
 import { endpointUrl } from './endpoint-url.ts';
@@ -131,14 +131,23 @@ async function notifyReload(input: {
     return { served: false, reason: `could not work out where the endpoint is: ${message(error)}` };
   }
 
-  const token = await input.credentials.get(input.config.auth.token_ref);
-  if (!token) {
+  // Any row the workspace holds (ADR-068). Which one is not a choice worth
+  // making here: this is the operator's own command reaching the operator's own
+  // endpoint, and `/reload` cares that the caller is authenticated rather than
+  // who they are.
+  const held = await anyIssuedToken(input.workspaceRoot, input.credentials);
+  if (!held) {
     return {
       served: false,
       url,
-      reason: `no profile token at "${input.config.auth.token_ref}" to authenticate with`,
+      // Not a failure to fix in most cases, which is why it reads as a reason
+      // rather than an error. An endpoint serving browser clients needs no
+      // static token; what it costs is that a config change is picked up on the
+      // next reconcile instead of immediately.
+      reason: 'no static token is issued in this workspace, so the endpoint cannot be notified',
     };
   }
+  const token = held.value;
 
   try {
     const response = await fetch(url, {

package/src/cli/runtime/open.ts

@@ -9,6 +9,7 @@ import {
   assertGrantsResolve,
   layout,
   listProfiles,
+  membersResolver,
   readConnections,
   selectConnections,
   soleGrantFor,
@@ -190,7 +191,12 @@ export async function openRuntime(
   // Lazy for the same reason `refreshSkills` is: it reads the registry it is
   // registered into. Per call rather than a snapshot, so a policy the runtime
   // was opened with is re-evaluated rather than remembered.
-  const reachable = (): ReadonlyArray<{ key: string; provider: string; account: string }> =>
+  const reachable = (): ReadonlyArray<{
+    key: string;
+    provider: string;
+    providerName: string;
+    account: string;
+  }> =>
     selected
       .filter(({ ref, connection }) =>
         registry
@@ -204,6 +210,11 @@ export async function openRuntime(
       .map(({ ref, connection }) => ({
         key: ref,
         provider: connection.provider,
+        // The manifest's display name, not the id. `defaultConnectionLabel`
+        // composes "Gmail (ada)" and needs the name — handed the id it produces
+        // "gmail (ada)", and for the owner layer, whose `account` is already the
+        // proper noun, "lanes_memory (Memory)".
+        providerName: registry.manifest(connection.provider)?.name ?? connection.provider,
         account: connection.account,
         ...(connection.label ? { label: connection.label } : {}),
       }));
@@ -329,10 +340,16 @@ export async function openRuntime(
     registry,
     refreshSkills,
     dispatcher,
+    // The workspace's issued tokens, not a profile's (ADR-068). The rows are
+    // re-read on every reload so a `token revoke` lands inside the cache
+    // window, and the subject on the matching row is resolved through
+    // `members:` — so a bearer token reaches what its holder is a member of
+    // rather than everything the workspace holds.
     authenticator: new BearerAuthenticator({
       profile: config.instance.profile,
-      tokenRef: config.auth.token_ref,
+      tokens: async () => (await readConnections(root)).tokens,
       credentials,
+      profilesFor: membersResolver(root),
     }),
     connectorFor,
     authorizeRequest,

package/src/cli/runtime/select.ts

@@ -159,17 +159,5 @@ export async function openBlobStoreFor(
   return area === undefined ? storage() : storage(area);
 }
 
-/** Mint the profile token if it does not exist yet. Returns it either way. */
-export async function ensureProfileToken(
-  credentials: SecretStore,
-  tokenRef: string,
-): Promise<{ token: string; created: boolean }> {
-  const existing = await credentials.get(tokenRef);
-  if (existing) return { token: existing, created: false };
-
-  const token = generateProfileToken();
-  await credentials.set(tokenRef, token);
-  return { token, created: true };
-}
 
 export { ownerPrincipal };

package/src/cli/runtime.ts

@@ -17,7 +17,6 @@
  */
 
 export {
-  ensureProfileToken,
   openBlobStoreFor,
   openSecretStoreFor,
   ownerPrincipal,

package/src/cli/selection.ts

@@ -145,7 +145,14 @@ export const SELECTION: Record<string, Requires> = {
   // ignored, which is the defect this whole file exists for.
   'connect custom': 'workspace',
   setup: 'profile+workspace',
-  token: 'profile+workspace',
+  // A token belongs to the workspace and names the person it was issued to
+  // (ADR-068). It used to sit at `auth.token_ref` on a profile, whose default
+  // was the same constant for every profile in a store that is one per
+  // workspace — so `--profile` was demanded here and could not change the
+  // answer. These commands refuse it outright rather than accept and ignore it:
+  // somebody passing `--profile work` believes they scoped the credential, and
+  // it is the member lists that decide.
+  token: 'workspace',
   // One chain per workspace since contract 3, so the workspace is the subject
   // and `--profile` filters the rows rather than choosing which log to read.
   audit: 'workspace',
@@ -160,7 +167,14 @@ export const SELECTION: Record<string, Requires> = {
   auth: 'workspace',
   // Target-scoped: see the note above. `--profile` narrows each to one profile.
   status: 'workspace',
-  outputs: 'profile+workspace',
+  // Its subject has always been the endpoint rather than a profile — its own
+  // doc comment said so — and one endpoint serves every profile in the
+  // workspace. It named a profile only to find the endpoint's token. `--profile`
+  // stays accepted and picks whose `instance.port` the local URL names, which
+  // is the one thing profiles can still disagree about here.
+  outputs: 'workspace',
+  // Unlike the two above: this reports what *one profile's* policy resolves to,
+  // beside what the endpoint advertises. The profile is the subject.
   tools: 'profile+workspace',
   // It resolves nothing and opens nothing — it hands macOS a URL (ADR-053).
   // `target list` is the precedent for a `'none'` command that still takes a
@@ -171,8 +185,9 @@ export const SELECTION: Record<string, Requires> = {
   desktop: 'none',
   attach: 'profile+workspace',
   // One endpoint serves every profile in the workspace (ADR-009), so naming one
-  // described a slice of what it does. `--profile` picks the primary, whose
-  // token opens it, and `--only` is what narrows what is served.
+  // described a slice of what it does. `--profile` picks the primary — which is
+  // now only whose host and port it binds, since the token stopped being a
+  // profile's (ADR-068) — and `--only` is what narrows what is served.
   start: 'workspace',
   deploy: 'workspace',
   // Both spellings: `sync` alone is `sync targets`, which is the only thing
@@ -193,14 +208,24 @@ export const SELECTION: Record<string, Requires> = {
   // which profile was a question with no answer. `--profile` still narrows, and
   // is how a port is chosen when profiles disagree about one.
   pair: 'workspace',
-  'token show': 'profile+workspace',
-  'token rotate': 'profile+workspace',
+  'token show': 'workspace',
+  'token rotate': 'workspace',
+  'token issue': 'workspace',
+  'token list': 'workspace',
+  'token revoke': 'workspace',
   'audit tail': 'workspace',
   'audit verify': 'workspace',
   'secrets set': 'workspace',
   'secrets list': 'workspace',
-  'mcp add': 'profile+workspace',
-  'mcp stdio': 'profile+workspace',
+  // One registration serves every profile, and each call names one in its
+  // `profile` argument — so two `--profile` values produced byte-identical
+  // harness commands. What kept the flag required was reading the endpoint's
+  // token, which is the workspace's now (ADR-068). `--profile` still picks
+  // whose port the local URL names.
+  'mcp add': 'workspace',
+  // Matches `start`, which it is: the pipe serves every profile in the
+  // workspace and `--only` is what narrows that to one.
+  'mcp stdio': 'workspace',
   memory: 'profile+workspace',
   tasks: 'profile+workspace',
   assets: 'profile+workspace',
@@ -230,7 +255,7 @@ const SUBCOMMANDS: Record<string, readonly string[]> = {
   target: ['list', 'use', 'show'],
   policy: ['list', 'allow', 'deny'],
   identity: ['add', 'list', 'remove'],
-  token: ['show', 'rotate'],
+  token: ['show', 'rotate', 'issue', 'list', 'revoke'],
   audit: ['tail', 'verify'],
   config: ['show'],
   setup: ['plan'],
@@ -242,7 +267,12 @@ const SUBCOMMANDS: Record<string, readonly string[]> = {
   // No `list`: a bare `entities` is a listing, which is `find` with no
   // criteria. One concept, one word.
   entities: ['find', 'get', 'write', 'link', 'forget', 'reindex'],
-  mcp: ['skill', 'add', 'stdio', 'list'],
+  // `install-instructions` was absent, which is not cosmetic: `dispatchWillRefuse`
+  // returns true for a second word it does not know, and both `assertKnownFlags`
+  // and `requireSelection` then return early — so `mcp install-instructions
+  // --bogus` was accepted and ignored, which is the defect this whole file
+  // exists to prevent.
+  mcp: ['skill', 'add', 'stdio', 'list', 'install-instructions'],
   secrets: ['push', 'set', 'list'],
   knowledge: ['show', 'use'],
   sync: ['targets', 'workspaces'],

package/src/cli/usage.ts

@@ -62,10 +62,10 @@ ${style.bold('Profiles')}
   ${PROGRAM} profile list [--json]
   ${PROGRAM} profile remove <name> [--workspace <name>] [--dry-run] [--yes] [--json]
                                  [--delete-data | --migrate-to <profile>]
-                                 the profile and its own token. Say which of
-                                 --delete-data or --migrate-to for its memory,
-                                 tasks, assets and skills — there is no default.
-                                 Accounts outlive it; disconnect removes those.
+                                 Say which of --delete-data or --migrate-to for
+                                 its memory, tasks, assets and skills — there is
+                                 no default. Accounts outlive it; disconnect
+                                 removes those, and token revoke the tokens.
 
 ${style.bold('Workspaces')}
   ${PROGRAM} workspace list [--urls]   every workspace this one knows
@@ -90,8 +90,13 @@ ${style.bold('Permissions')}
   ${PROGRAM} profile members list       who may consume this profile, and who could
   ${PROGRAM} profile members add <subject>|--me [--role owner|member]
   ${PROGRAM} profile members remove <subject>
-  ${PROGRAM} token show [--show|--raw]  CI only: --raw prints only the token, for $(…)
-  ${PROGRAM} token rotate [--show]      also ends every session a member holds
+  ${PROGRAM} token list [--json]        static tokens, and what each one reaches
+  ${PROGRAM} token issue --me|--subject <id> [--label <t>]
+                                 CI only: a token for one person. It reaches
+                                 every profile whose members list them
+  ${PROGRAM} token show [--id t] [--show|--raw]   --raw prints only it, for $(…)
+  ${PROGRAM} token rotate [--id t] [--show]
+  ${PROGRAM} token revoke --id <t>
 
 ${style.bold('Your own context')}
   ${PROGRAM} memory list [--tag t]      what you have stored
@@ -146,7 +151,7 @@ ${style.bold('Deploying')}
                                  set up, build, and roll one revision serving
                                  every profile that declares the target
   ${PROGRAM} deploy --workspace <name> --profile a --profile b
-                                 only these; the first owns the endpoint token
+                                 only these; the first is the primary
   ${PROGRAM} deploy --non-interactive   take the stored answers, never prompt
   ${PROGRAM} deploy --access iam|public who gets past the platform's own door
   ${PROGRAM} secrets list               credential references in this target

package/src/cli/workspace-migrate.ts

@@ -1,4 +1,5 @@
 import { migrateToContract4, type Contract4Migration } from './contract4.ts';
+import { migrateToContract5, type Contract5Migration } from './contract5.ts';
 import { migrateToContract3, needsContract3, type Contract3Migration } from './contract3.ts';
 import { readSession } from '#auth/lanes/session.ts';
 import { parseDocument } from 'yaml';
@@ -196,6 +197,8 @@ export interface ContractMigration {
   /** The contract 2 → 3 half, when this workspace needed one. */
   readonly contract3: Contract3Migration | null;
   readonly contract4: Contract4Migration | null;
+  /** The contract 4 → 5 half: the endpoint token becomes a person's (ADR-068). */
+  readonly contract5: Contract5Migration | null;
   /** Every profile either half rewrote, deduplicated. */
   readonly profiles: readonly string[];
   /** Targets written into the registry by the contract 1 → 2 half. */
@@ -250,10 +253,10 @@ export async function migrateToCurrentContract(
 
   const subject = options.subject ?? (await readSession().catch(() => null))?.subject;
 
-  const contract3 = await migrateToContract3(workspaceRoot, {
-    apply: options.apply,
-    ...(subject === undefined ? {} : { subject }),
-  });
+  // Contract 3 writes `members:` from it; contract 5 binds the token to it.
+  const signed = { apply: options.apply, ...(subject === undefined ? {} : { subject }) };
+
+  const contract3 = await migrateToContract3(workspaceRoot, signed);
 
   // In sequence, not in parallel: contract 4 moves what contract 3 produced, so
   // it has to run against the tree the previous step left. With `apply: false`
@@ -264,20 +267,23 @@ export async function migrateToCurrentContract(
     ...(options.target === undefined ? {} : { target: options.target }),
   });
 
+  // In sequence again, for contract 4's reason.
+  const contract5 = await migrateToContract5(workspaceRoot, signed);
+
+  // Collected, not spelled out per step: a step left out of `alreadyCurrent`
+  // reports a migration as finished when it is not.
+  const steps = [legacy, contract3, contract4, contract5].filter((s) => s !== null);
+
   return {
     workspaceRoot,
     legacy: legacy !== null && !legacy.alreadyCurrent ? legacy : null,
     contract3: contract3.alreadyCurrent ? null : contract3,
     contract4: contract4.alreadyCurrent ? null : contract4,
-    profiles: [
-      ...new Set([...(legacy?.profiles ?? []), ...contract3.profiles, ...contract4.profiles]),
-    ],
+    contract5: contract5.alreadyCurrent ? null : contract5,
+    profiles: [...new Set(steps.flatMap((step) => step.profiles))],
     targets: legacy?.targets ?? [],
-    changes: [...(legacy?.changes ?? []), ...contract3.changes, ...contract4.changes],
-    alreadyCurrent:
-      (legacy === null || legacy.alreadyCurrent) &&
-      contract3.alreadyCurrent &&
-      contract4.alreadyCurrent,
+    changes: steps.flatMap((step) => step.changes),
+    alreadyCurrent: steps.every((step) => step.alreadyCurrent),
   };
 }
 

package/src/connectivity/context.ts

@@ -53,6 +53,23 @@ export interface ConnectionInfo {
  */
 export interface ProviderContext {
   readonly connection: ConnectionInfo;
+  /**
+   * Every profile this caller may reach, this one included.
+   *
+   * The narrowest widening of this interface that could carry it, and worth
+   * saying why it belongs at all given the rule above. It is not a backend, a
+   * credential or a store: it is the same routing fact the client already holds
+   * in the `profile` enum on every tool it was shown, which `visibility.ts`
+   * filters by `mayReach`. A provider cannot *act* in any of these — dispatch
+   * still resolves one profile per call — so this grants no reach.
+   *
+   * It exists because a surface that describes what a caller can get to has to
+   * be given the caller's answer rather than the workspace's.
+   * `lanes_setup.overview` was handed every profile on disk and named them all,
+   * which told a delegated member about profiles `mayReach` deliberately hides
+   * from their enum (ADR-068).
+   */
+  readonly profiles: readonly string[];
   readonly state: ScopedStore;
   readonly storage: BlobStore;
   readonly credentials: ScopedSecrets;