@lanes-sh/link 0.9.2 → 0.9.3

package/src/server/endpoint.ts

@@ -18,7 +18,7 @@ import {
   planReconcile,
   toPolicyDocument,
 } from '#registry';
-import { ensureProfileToken, openRuntime, type GlobalFlags, type Runtime } from '#cli/runtime.ts';
+import { openRuntime, type GlobalFlags, type Runtime } from '#cli/runtime.ts';
 
 /**
  * Bringing the endpoint up: open a runtime per profile, reconcile, and serve.
@@ -40,8 +40,6 @@ import { ensureProfileToken, openRuntime, type GlobalFlags, type Runtime } from
 export interface EndpointReporter {
   /** A profile whose runtime state differed from its config, and what was applied. */
   reconciled(input: { profile: string; plan: string; ofMany: boolean }): void;
-  /** No profile token existed and one was minted. */
-  tokenMinted(minted: { target: string }): void;
   /**
    * A sibling profile that could not be opened against this target.
    *
@@ -51,7 +49,7 @@ export interface EndpointReporter {
   skipped?(input: { profile: string; reason: string }): void;
 }
 
-const SILENT: EndpointReporter = { reconciled() {}, tokenMinted() {} };
+const SILENT: EndpointReporter = { reconciled() {} };
 
 /** The first line of an error, which is the part fit to print beside a name. */
 function message(error: unknown): string {
@@ -64,11 +62,6 @@ export interface EndpointOptions {
   readonly host?: string | undefined;
   /** Serve just the resolved profile, rather than every profile in the workspace. */
   readonly only?: boolean | undefined;
-  /**
-   * Mint a profile token when the store has none. True for `lanes link start`,
-   * false in a container — see the note above.
-   */
-  readonly mintToken?: boolean | undefined;
   readonly reporter?: EndpointReporter | undefined;
   /** Operational events. Silent when absent, which is what the tests want. */
   readonly log?: Logger | undefined;
@@ -203,26 +196,21 @@ export async function startEndpoint(options: EndpointOptions): Promise<RunningEn
   const { primary, runtimes } = await openReconciled(options);
 
   try {
-    if (options.mintToken) {
-      const { created } = await ensureProfileToken(
-        primary.credentials,
-        primary.config.auth.token_ref,
-      );
-      if (created) reporter.tokenMinted({ target: primary.target });
-    } else {
-      // Deployed, the token is written by the operator's CLI into the target's
-      // credential store and read back here. Refusing to start beats serving an
-      // endpoint whose token nobody holds.
-      const token = await primary.credentials.get(primary.config.auth.token_ref);
-      if (!token) {
-        throw new Error(
-          `No profile token at "${primary.config.auth.token_ref}" in this target's credential store. ` +
-            'A deployed instance never mints its own — run `lanes link token rotate --workspace <name>` ' +
-            'from your machine, or `lanes link secrets push --from local --to cloud`, then redeploy.',
-        );
-      }
-    }
-
+    // **No token is minted or required here any more** (ADR-068). Both halves of
+    // what used to be at this point are gone, and for the same reason.
+    //
+    // Minting: `start` did it because there was one token per endpoint and it
+    // had to exist for anything to connect. A token names the person it was
+    // issued to now, and `start` does not know who is about to connect — so
+    // inventing one would be binding a credential to a subject nobody chose.
+    //
+    // Refusing: a deployed revision used to fail to boot without one, on the
+    // reasoning that an endpoint whose token nobody holds is no use. Since
+    // ADR-062 that is backwards. A client discovers the protected-resource
+    // document, signs its owner in, and comes back with a token of its own; a
+    // static row is what CI uses because it has no browser. Zero rows is the
+    // ordinary state of a healthy endpoint, and refusing to serve was refusing
+    // the case the endpoint is now built for.
     // Read through a holder rather than closed over `runtimes`, because a
     // reload replaces that map and the gate is deliberately built once
     // (ADR-029). Without the indirection, a member added after start would

package/src/server/harness.ts

@@ -53,6 +53,16 @@ function harnessConnections(config: Config): ConnectionConfig[] {
 
 export const TEST_TOKEN = 'llk_test_token_value';
 
+/**
+ * The subject the harness's one token row is issued to.
+ *
+ * A real subject shape rather than a placeholder, because `subjectRef` validates
+ * it wherever a config carries one — and the harness's `profilesFor` returns
+ * every wired profile for it, which is what the static token used to reach by
+ * having no list at all.
+ */
+export const HARNESS_SUBJECT = 'lanes:harness0000';
+
 /** A signed-in person no profile lists. See the federation stub below. */
 export const STRANGER = 'NOBODY_LISTS_THIS_PERSON';
 
@@ -75,7 +85,7 @@ export function configFor(profile: string, port: number, policy: string): Config
     `  - connection: example.${id}\n${rules.replace(/^ {4}(allow|deny):/gm, '    $1:')}`;
 
   return parseConfig(`
-contract: 4
+contract: 5
 instance:
   profile: ${profile}
   port: ${port}
@@ -133,6 +143,15 @@ export interface HarnessOptions {
   config?: Config;
   /** Extra profiles this one endpoint also serves, each with its own policy. */
   alsoServe?: ReadonlyArray<{ profile: string; policy: string }>;
+  /**
+   * The profiles the static token's subject is a member of.
+   *
+   * Absent means every profile wired, which is what a workspace owner's token
+   * reaches. Naming fewer is how a test expresses a delegated member — the
+   * caller ADR-068 exists for, and the one every disclosure surface has to be
+   * checked against.
+   */
+  reaches?: readonly string[];
   /**
    * What the endpoint calls to re-read skills before serving a request.
    *
@@ -192,7 +211,9 @@ export function wireProfiles(options: HarnessOptions): WiredProfiles {
 
   const state = createMemoryState();
   const audit = createBlobAuditStore({ storage: createMemoryBlobStore() });
-  const credentials = createMemoryCredentials({ 'profile/token': token, ...options.credentials });
+  // `tokens/tok1`, matching the row `startHarness` declares below. The old key
+  // was `profile/token`, the constant ADR-068 removed.
+  const credentials = createMemoryCredentials({ 'tokens/tok1': token, ...options.credentials });
   // `allowReserved` for the same reason `buildRegistry` passes it: the owner
   // layer claims `memory`, `skills`, and `vault`, and the guard still refuses
   // them everywhere else.
@@ -267,10 +288,14 @@ export function wireProfiles(options: HarnessOptions): WiredProfiles {
 export function startHarness(options: HarnessOptions): Harness {
   const { profiles, state, audit, dispatcher, credentials, token } = wireProfiles(options);
 
+  // One row, bound to a subject the harness's profiles list, so the static
+  // token resolves the way it does in production (ADR-068) rather than through
+  // a special case that would stop the tests covering the real path.
   const bearer = new BearerAuthenticator({
     profile: options.profile,
-    tokenRef: 'profile/token',
+    tokens: async () => [{ id: 'tok1', subject: HARNESS_SUBJECT, ref: 'tokens/tok1' }],
     credentials,
+    profilesFor: async () => options.reaches ?? [...profiles.keys()],
   });
 
   // The real wiring from `endpoint.ts`, not a stand-in: the flow under test is

package/src/server/index.ts

@@ -1,4 +1,4 @@
-import type { Authenticator } from '#auth';
+import { mayReach, type Authenticator } from '#auth';
 import type { Logger } from '#connectivity';
 import { capabilityIdForToolName } from '#server/mcp';
 import { ATTACHMENTS_PATH, handleAttachments } from './attachments.ts';
@@ -186,18 +186,18 @@ export function createRequestHandler(options: ServerOptions): RequestHandler {
       if (url.pathname === HEALTH_PATH) {
         // `status` is unauthenticated because the platform's own probe reads it
         // and a deploy waits on it. The profile *names* are not: on a public URL
-        // that is a list of what this endpoint holds, handed to anyone who asks,
-        // and `outputs` and `mcp add` — which are the reason it was ever
-        // published — both hold the token already.
+        // that is a list of what this endpoint holds, handed to anyone who asks.
+        // And they are the *caller's* since ADR-068: this listed every profile
+        // served to anybody holding a credential, so a delegated member read the
+        // ones `mayReach` keeps out of their own enum.
         const named = await options.authenticator.authenticate(
           request.headers.get('authorization'),
         );
-
+        const who = named.ok ? named.principal : null;
+        const mine = options.generations.current.names().filter((n) => who && mayReach(who, n));
         return Response.json({
           status: 'ok',
-          ...(named.ok
-            ? { profile: options.primary, profiles: options.generations.current.names() }
-            : {}),
+          ...(named.ok ? { profile: options.primary, profiles: mine } : {}),
         });
       }
 

package/src/server/mcp/visibility.ts

@@ -185,7 +185,15 @@ export function visibleToolCount(options: BuildServerOptions): number {
  * entities: ordering is not selection, and a caller that cannot tell two
  * candidates apart must be given what tells them apart.
  *
- * The enum stays bare ids, because the id is what the caller passes.
+ * **The key is the grant ref, not the bare id.** `connectionsOf` fills the enum
+ * from the grant rows (ADR-058), so `reachable` carries `gmail.con1`, and
+ * `accountsByProfile` keys on that same `ref` — one string from one source, so
+ * the two sides cannot drift. Keyed on `connection.id` instead it missed every
+ * lookup, and no served description carried an account at all, while
+ * `connection-choice.test.ts` passed bare ids in by hand and stayed green.
+ * Contract 4 is what turned that from cosmetic into a real loss: the ids used to
+ * carry the account and are `con1`, `con2` now, so the id says nothing about
+ * which mailbox it is and this annotation is the only thing that does.
  */
 export function describeWithConnections(
   description: string,
@@ -215,9 +223,9 @@ export function accountsByProfile(
 
   for (const [name, runtime] of options.profiles) {
     const rows = new Map<string, string>();
-    for (const { connection } of runtime.connections ?? []) {
+    for (const { ref, connection } of runtime.connections ?? []) {
       rows.set(
-        connection.id,
+        ref,
         connection.label === undefined
           ? connection.account
           : `${connection.account} (${connection.label})`,

package/src/server/read/deployed.ts

@@ -40,6 +40,10 @@ export function deployedReadDeps(input: {
     audit: primary.audit,
     connections: async () =>
       (await readConnections(primary.resolution.workspaceRoot)).connections,
+    // The names the dashboard shows for a row nobody has labelled. From the
+    // registry rather than a catalogue, so the owner layer, the vendors and a
+    // workspace's own manifests are all named the same way.
+    providerName: (id) => primary.registry.manifest(id)?.name,
     // Cached, unlike loopback's. `GcpSecretManagerStore` holds nothing between
     // calls, so a dashboard polling `/state` would be one network round trip per
     // poll and a stranger sending a wrong token one per request — which is the

package/src/server/read/open.ts

@@ -62,6 +62,10 @@ export async function openReadListener(
       audit: primary.audit,
       connections: async () =>
         (await readConnections(primary.resolution.workspaceRoot)).connections,
+      // The names the dashboard shows for a row nobody has labelled. From the
+      // registry rather than a catalogue, so the owner layer, the vendors and a
+      // workspace's own manifests are all named the same way.
+      providerName: (id) => primary.registry.manifest(id)?.name,
       // Read on every presentation, so `pair --rotate` takes effect on a
       // running endpoint. Affordable here because the store is a local file;
       // the deployed bind caches for exactly this reason. `refresh()` drops the

package/src/server/read/routes.ts

@@ -1,7 +1,12 @@
 import type { Logger } from '#connectivity';
 import type { ProfileRuntime } from '../mcp/visibility.ts';
 import type { PairingCredential } from './credential.ts';
-import { readState, type ConnectionRow, type ReadEndpoint } from './state.ts';
+import {
+  readState,
+  type ConnectionRow,
+  type ProviderNames,
+  type ReadEndpoint,
+} from './state.ts';
 
 /**
  * The two routes a browser origin may read, and everything that guards them.
@@ -100,6 +105,14 @@ export interface ReadDeps {
    */
   readonly connections: () => Promise<readonly ConnectionRow[]>;
   readonly credential: PairingCredential;
+  /**
+   * What each provider is called, for the row nobody has labelled.
+   *
+   * Optional so a harness can omit it: absent, an unlabelled row reports a null
+   * label and its reader falls back to the id, which is what every reader did
+   * before. Both real binds pass their runtime's registry.
+   */
+  readonly providerName?: ProviderNames | undefined;
   /** What this endpoint says about itself. Fixed for the life of the bind. */
   readonly endpoint: ReadEndpoint;
   readonly allowedOrigins?: readonly string[] | undefined;
@@ -166,7 +179,7 @@ export async function readRoutes(request: Request, deps: ReadDeps): Promise<Resp
   if (url.pathname === STATE_PATH) {
     const rows = await deps.connections().catch(() => []);
     return json(
-      readState(deps.workspace, deps.profiles(), rows, deps.endpoint),
+      readState(deps.workspace, deps.profiles(), rows, deps.endpoint, deps.providerName),
       200,
       cors(origin, allowed),
     );

package/src/server/read/state.ts

@@ -1,4 +1,5 @@
 import { allowedConnections } from '#policy';
+import { defaultConnectionLabel } from '#profile';
 import type { ProfileRuntime } from '../mcp/visibility.ts';
 
 /**
@@ -19,11 +20,20 @@ export interface ReadConnection {
   readonly provider: string;
   readonly id: string;
   /**
-   * The operator's own word for it, and what a reader should be shown.
+   * What a reader should be shown: the operator's own word for it, or the name
+   * derived from the provider and the account when they never gave one.
    *
    * `gmail.ada_lovelace` is an address, not a name. A dashboard listing refs is
    * asking somebody to read identifiers when they gave the thing a label
    * precisely so they would not have to.
+   *
+   * **Filled rather than left null**, which reverses what this said. Null meant
+   * "they never gave one" and every consumer answered it the same way, by
+   * showing the id — so a dashboard's whole Label column read `con8`, `lan7`,
+   * `con5`. `connect` writes no label that only repeats the lines above it
+   * (`declareConnection`), so an unlabelled row is the ordinary case and not an
+   * omission worth reporting. `null` survives for the row nothing can name: a
+   * grant pointing at a connection the workspace no longer holds.
    */
   readonly label: string | null;
   /** The identity the provider reported at connect time. */
@@ -32,6 +42,20 @@ export interface ReadConnection {
   readonly profiles: readonly string[];
 }
 
+/**
+ * What a provider is called, asked of whoever built the registry.
+ *
+ * A function rather than a catalogue, because `server` may not import
+ * `#providers` — the read surface has no business knowing the vendor list, and
+ * the rule that says so is `architecture.test.ts`. Both binds already hold a
+ * `Runtime`, whose registry names the owner layer, the catalogue and a
+ * workspace's own manifests alike, so the caller passes a closure over that.
+ *
+ * Defaulted to naming nothing. A caller that supplies none gets `label: null`
+ * on an unlabelled row, which is what every reader saw before this existed.
+ */
+export type ProviderNames = (provider: string) => string | undefined;
+
 /** The connection rows as `connections.yaml` holds them. */
 export interface ConnectionRow {
   readonly provider: string;
@@ -97,6 +121,7 @@ export function readState(
   profiles: ReadonlyMap<string, ProfileRuntime>,
   rows: readonly ConnectionRow[],
   endpoint: ReadEndpoint,
+  providerName: ProviderNames = () => undefined,
 ): ReadState {
   // The workspace's own list is the source of truth for *which connections
   // exist*. Deriving it from the grants instead made an account that no profile
@@ -138,11 +163,14 @@ export function readState(
 
   const connections: ReadConnection[] = rows.map((row) => {
     const ref = `${row.provider}.${row.id}`;
+    const named = providerName(row.provider);
     return {
       ref,
       provider: row.provider,
       id: row.id,
-      label: row.label ?? null,
+      // The same rule `connect` offers and `connection list` prints, so one
+      // connection is called one thing wherever somebody reads it.
+      label: row.label ?? (named ? defaultConnectionLabel(named, row.account) : null),
       account: row.account ?? null,
       profiles: grantedBy.get(ref) ?? [],
     };