@fourier-labs/harbour 0.1.11 → 0.1.12

package/dist/packages/harbour-cli/src/productionise.js

@@ -4,7 +4,7 @@ import { readFile } from "node:fs/promises";
 import { scanWorkspace } from "../../../src/analyzer.js";
 import { createSourceManifest } from "../../../src/source-intake.js";
 import { structured } from "./remote-mcp-client.js";
-import { archiveForManifest, putExact } from "./upload.js";
+import { archiveForManifest, putMultipart } from "./upload.js";
 import { CliError } from "./output.js";
 import { CLI_VERSION } from "./version.js";
 export async function productionise(rootArg, client, output, tenantId, includePaths = []) {
@@ -39,23 +39,28 @@ export async function productionise(rootArg, client, output, tenantId, includePa
         const submitted = structured(await client.call("harbour_submit_application_graph", { operationId: operationRef, surface: "codex", graph }));
         if (submitted.nextTool && !matchesTool(submitted.nextTool, "harbour_prepare_source_upload"))
             throw new CliError("UNSUPPORTED_NEXT_STEP", "Harbour returned an unsupported next step.", operationRef);
-        const appId = projectName(graph.deploymentScope.appRoot);
+        const appId = typeof submitted.appId === "string" ? submitted.appId.trim() : "";
+        if (!appId)
+            throw new CliError("APP_IDENTITY_MISSING", "Harbour did not return the app identity for this operation.", operationRef);
         const manifest = await createSourceManifest({ tenantId, appId, operationId: operationRef, graphDigest: graph.graphDigest, files });
-        const prepared = structured(await client.call("harbour_prepare_source_upload", { operationId: operationRef, surface: "codex", graph, manifest: { schema: "harbour.source-package-manifest/1.0", files: manifest.files.map(file => ({ path: file.path, size: file.bytes, sha256: file.sha256 })) } }));
+        const preliminaryArchive = await archiveForManifest(root, manifest);
+        const prepared = structured(await client.call("harbour_prepare_source_upload", { operationId: operationRef, appId, surface: "codex", graph, format: "zip", filename: `${appId}.zip`, compressedBytes: preliminaryArchive.body.byteLength, manifest: { schema: "harbour.source-package-manifest/1.0", files: manifest.files.map(file => ({ path: file.path, size: file.bytes, sha256: file.sha256 })) } }));
         if (!prepared.acceptedManifest || !prepared.sourceUpload)
             throw new CliError("UPLOAD_CONTRACT_MISSING", "Harbour did not return a safe upload contract.", operationRef);
-        if (prepared.nextAction?.tool && !matchesTool(prepared.nextAction.tool, "harbour_execute_source_control"))
+        if (prepared.nextAction?.tool && !matchesTool(prepared.nextAction.tool, "harbour_complete_source_upload"))
             throw new CliError("UNSUPPORTED_NEXT_STEP", "Harbour returned an unsupported next step.", operationRef);
         const archive = await archiveForManifest(root, prepared.acceptedManifest);
-        await putExact(prepared.sourceUpload, archive.body);
-        output("Harbour has prepared the secure app package.");
-        let execution = await execute(client, operationRef, graph);
+        const parts = await putMultipart(prepared.sourceUpload, archive.body, (sent, total) => output(`Harbour is uploading the app package (${Math.floor(sent * 100 / total)}%).`));
+        await client.call("harbour_complete_source_upload", { operationId: operationRef, intentId: prepared.sourceUpload.intentId, parts, clientSha256: archive.digest });
+        output("Harbour uploaded the secure app package and is inspecting it.");
+        await waitForIntake(client, operationRef);
+        let execution = await execute(client, operationRef, appId, graph);
         if (execution.status === "APPROVAL_REQUIRED" || execution.approvalRequiredBeforeExternalAction === true) {
             output(`Approval required: Harbour can copy ${files.length} app files to the approved company code system. Nothing will be deployed or released. Type Approved. then press Enter.`);
             const approval = await readApproval();
             if (approval !== "Approved.")
                 throw new CliError("APPROVAL_NOT_GRANTED", "The Harbour save was not approved.", operationRef);
-            execution = await execute(client, operationRef, graph, { schema: "harbour.stage-approval/1.0", step: "save_source_baseline", approved: true, approvedByUser: true, userApprovalText: approval, userVisibleProgress: "Approved.", nextStepSummary: "Harbour can safely save the app.", dataOrActions: ["Save the app in the company code system."] });
+            execution = await execute(client, operationRef, appId, graph, { schema: "harbour.stage-approval/1.0", step: "save_source_baseline", approved: true, approvedByUser: true, userApprovalText: approval, userVisibleProgress: "Approved.", nextStepSummary: "Harbour can safely save the app.", dataOrActions: ["Save the app in the company code system."] });
         }
         if (execution.status === "ADMIN_SETUP_REQUIRED")
             throw new CliError("ADMIN_SETUP_REQUIRED", "The company code connection needs one-time administrator setup.", operationRef);
@@ -64,7 +69,7 @@ export async function productionise(rootArg, client, output, tenantId, includePa
         if (execution.status === "RETRYABLE_FAILURE")
             throw new CliError("RETRYABLE_FAILURE", "Harbour could not complete the save yet. Resume this operation safely.", operationRef);
         const evidence = await waitForSave(client, operationRef, graph, execution, output);
-        const report = structured(await client.call("harbour_build_verification_report", { operationId: operationRef, surface: "codex", graph, sourceControlEvidence: evidence.sourceControlEvidence, runnerEvidence: evidence.runnerEvidence }));
+        const report = structured(await client.call("harbour_build_verification_report", { operationId: operationRef, appId, surface: "codex", graph, sourceControlEvidence: evidence.sourceControlEvidence, runnerEvidence: evidence.runnerEvidence }));
         output("Harbour verified the saved app.");
         return { cliVersion: CLI_VERSION, operationRef, result: safeVerificationResult(report, evidence) };
     }
@@ -74,8 +79,18 @@ export async function productionise(rootArg, client, output, tenantId, includePa
         throw new CliError("OPERATION_FAILED", "Harbour could not complete the started operation.", operationRef);
     }
 }
-async function execute(client, operationRef, graph, approval) {
-    const args = { operationId: operationRef, surface: "codex", graph, action: "save_baseline", mode: "EXECUTE" };
+async function waitForIntake(client, operationRef) {
+    for (let attempt = 0; attempt < 60; attempt += 1) {
+        const status = structured(await client.call("harbour_get_operation_status", { operationId: operationRef, waitSeconds: 3 }));
+        if (status.operation?.stage === "awaiting-approval" || status.sourceSave?.status === "QUEUED")
+            return;
+        if (status.operation?.stage === "failed")
+            throw new CliError("PACKAGE_REJECTED", "Harbour could not safely accept this app package.", operationRef);
+    }
+    throw new CliError("INSPECTION_TIMEOUT", "Harbour is still inspecting the app package. Resume this operation safely.", operationRef);
+}
+async function execute(client, operationRef, appId, graph, approval) {
+    const args = { operationId: operationRef, appId, surface: "codex", graph, action: "save_baseline", mode: "EXECUTE" };
     if (approval)
         args.approval = approval;
     return structured(await client.call("harbour_execute_source_control", args)).sourceControlExecution ?? {};
@@ -136,7 +151,6 @@ function safeVerificationResult(value, statusEvidence) {
             : {})
     };
 }
-function projectName(value) { const name = value.split(/[\\/]/).filter(Boolean).at(-1) ?? "harbour-app"; return name.toLowerCase().replace(/[^a-z0-9._-]+/g, "-").replace(/^-+|-+$/g, "") || "harbour-app"; }
 async function readApproval() { if (!process.stdin.isTTY) {
     const chunks = [];
     for await (const chunk of process.stdin)

package/dist/packages/harbour-cli/src/upload.js

@@ -1,6 +1,6 @@
 import { readFile, lstat } from "node:fs/promises";
 import { relative, resolve, sep } from "node:path";
-import { createSourceArchive } from "../../../src/source-intake.js";
+import { deflateRawSync } from "node:zlib";
 import { sha256Bytes } from "../../../src/digest.js";
 const SECRET = /(^|\/)(?:(?!\.env\.example$)\.env(?:\.[^/]+)?|\.npmrc|id_rsa|[^/]+\.(?:pem|key))$/i;
 export async function archiveForManifest(root, manifest) {
@@ -30,9 +30,110 @@ export async function archiveForManifest(root, manifest) {
             throw new Error(`The app changed while it was being packaged (${entry.path}).`);
         files.push({ path: relative(rootAbsolute, absolute).split(sep).join("/"), content });
     }
-    const archive = await createSourceArchive(manifest, files);
-    const body = new TextEncoder().encode(JSON.stringify(archive));
-    return { body, digest: archive.archiveDigest };
+    const body = new Uint8Array(deterministicZip(files.sort((left, right) => left.path.localeCompare(right.path))));
+    return { body, digest: await sha256Bytes(body) };
+}
+function deterministicZip(files) {
+    const local = [];
+    const central = [];
+    let offset = 0;
+    for (const file of files) {
+        const name = Buffer.from(file.path, "utf8");
+        const raw = Buffer.from(file.content);
+        const compressed = deflateRawSync(raw, { level: 9 });
+        const crc = crc32(raw);
+        const header = Buffer.alloc(30);
+        header.writeUInt32LE(0x04034b50, 0);
+        header.writeUInt16LE(20, 4);
+        header.writeUInt16LE(0x0800, 6);
+        header.writeUInt16LE(8, 8);
+        header.writeUInt16LE(0, 10);
+        header.writeUInt16LE(0x21, 12);
+        header.writeUInt32LE(crc, 14);
+        header.writeUInt32LE(compressed.byteLength, 18);
+        header.writeUInt32LE(raw.byteLength, 22);
+        header.writeUInt16LE(name.byteLength, 26);
+        const directory = Buffer.alloc(46);
+        directory.writeUInt32LE(0x02014b50, 0);
+        directory.writeUInt16LE(0x0314, 4);
+        directory.writeUInt16LE(20, 6);
+        directory.writeUInt16LE(0x0800, 8);
+        directory.writeUInt16LE(8, 10);
+        directory.writeUInt16LE(0, 12);
+        directory.writeUInt16LE(0x21, 14);
+        directory.writeUInt32LE(crc, 16);
+        directory.writeUInt32LE(compressed.byteLength, 20);
+        directory.writeUInt32LE(raw.byteLength, 24);
+        directory.writeUInt16LE(name.byteLength, 28);
+        directory.writeUInt32LE((0o100644 << 16) >>> 0, 38);
+        directory.writeUInt32LE(offset, 42);
+        local.push(header, name, compressed);
+        central.push(directory, name);
+        offset += header.byteLength + name.byteLength + compressed.byteLength;
+    }
+    const centralBytes = central.reduce((sum, value) => sum + value.byteLength, 0);
+    const end = Buffer.alloc(22);
+    end.writeUInt32LE(0x06054b50, 0);
+    end.writeUInt16LE(files.length, 8);
+    end.writeUInt16LE(files.length, 10);
+    end.writeUInt32LE(centralBytes, 12);
+    end.writeUInt32LE(offset, 16);
+    return Buffer.concat([...local, ...central, end]);
+}
+function crc32(bytes) {
+    let crc = 0xffffffff;
+    for (const byte of bytes) {
+        crc ^= byte;
+        for (let bit = 0; bit < 8; bit += 1)
+            crc = (crc >>> 1) ^ (crc & 1 ? 0xedb88320 : 0);
+    }
+    return (crc ^ 0xffffffff) >>> 0;
+}
+export async function putMultipart(upload, body, progress) {
+    if (body.byteLength !== upload.compressedBytes)
+        throw new Error("Harbour ZIP changed after the upload session was prepared.");
+    const completed = new Map((upload.acknowledgedParts ?? []).map(part => [part.partNumber, part.etag]));
+    let acknowledgedBytes = [...completed.keys()].reduce((sum, partNumber) => sum + Math.min(upload.partSizeBytes, body.byteLength - (partNumber - 1) * upload.partSizeBytes), 0);
+    progress?.(acknowledgedBytes, body.byteLength);
+    await mapConcurrent(upload.parts, 3, async (part) => {
+        const start = (part.partNumber - 1) * upload.partSizeBytes;
+        const bytes = body.subarray(start, Math.min(body.byteLength, start + upload.partSizeBytes));
+        if (part.url.startsWith("local://")) {
+            completed.set(part.partNumber, `local-${part.partNumber}`);
+            acknowledgedBytes += bytes.byteLength;
+            progress?.(Math.min(acknowledgedBytes, body.byteLength), body.byteLength);
+            return;
+        }
+        let response;
+        for (let attempt = 0; attempt < 3; attempt += 1) {
+            try {
+                response = await fetch(part.url, { method: "PUT", headers: part.requiredHeaders ?? {}, body: Buffer.from(bytes), redirect: "error" });
+                if (response.ok)
+                    break;
+                if (![408, 429, 500, 502, 503, 504].includes(response.status))
+                    throw new Error(`Harbour ZIP part upload failed (${response.status}).`);
+            }
+            catch (error) {
+                if (attempt === 2)
+                    throw error;
+            }
+            await new Promise(resolve => setTimeout(resolve, 250 * 2 ** attempt));
+        }
+        if (!response?.ok)
+            throw new Error(`Harbour ZIP part upload failed (${response?.status ?? "network"}).`);
+        const etag = response.headers.get("etag");
+        if (!etag)
+            throw new Error("Harbour ZIP part upload did not return an ETag.");
+        completed.set(part.partNumber, etag);
+        acknowledgedBytes += bytes.byteLength;
+        progress?.(Math.min(acknowledgedBytes, body.byteLength), body.byteLength);
+    });
+    return [...completed].sort(([left], [right]) => left - right).map(([partNumber, etag]) => ({ partNumber, etag }));
+}
+async function mapConcurrent(items, concurrency, work) {
+    let cursor = 0;
+    await Promise.all(Array.from({ length: Math.min(concurrency, items.length) }, async () => { while (cursor < items.length)
+        await work(items[cursor++]); }));
 }
 export async function putExact(upload, body) {
     if (upload.url.startsWith("local://"))

package/dist/packages/harbour-cli/src/version.js

@@ -1 +1 @@
-export const CLI_VERSION = "0.1.11";
+export const CLI_VERSION = "0.1.12";

package/dist/src/analyzer.js

@@ -317,6 +317,204 @@ function detectGitProvider(locator) {
         return "bitbucket";
     return "git";
 }
+const MANIFEST_DRIVER_MAP = {
+    pg: "postgres",
+    postgres: "postgres",
+    mssql: "sqlserver",
+    tedious: "sqlserver",
+    "snowflake-sdk": "snowflake",
+    "@google-cloud/bigquery": "bigquery",
+    "@databricks/sql": "databricks",
+    mysql: "mysql",
+    mysql2: "mysql",
+    mongodb: "mongodb",
+    redis: "redis",
+    ioredis: "redis",
+    "@supabase/supabase-js": "supabase"
+};
+const CONNECTION_SCHEME_DRIVERS = {
+    postgres: "postgres",
+    postgresql: "postgres",
+    mysql: "mysql",
+    mongodb: "mongodb",
+    "mongodb+srv": "mongodb",
+    redis: "redis",
+    rediss: "redis"
+};
+const JDBC_SCHEME_DRIVERS = {
+    postgresql: "postgres",
+    sqlserver: "sqlserver",
+    snowflake: "snowflake",
+    mysql: "mysql",
+    bigquery: "bigquery",
+    databricks: "databricks"
+};
+const CONNECTION_STRING_PATTERN = /\b(postgres(?:ql)?|mysql|mongodb(?:\+srv)?|rediss?):\/\/([^\s"'`<>\\]+)/gi;
+const JDBC_PATTERN = /\bjdbc:([a-z0-9]+):\/\/([^\s"'`<>\\]+)/gi;
+const HTTP_URL_PATTERN = /\bhttps?:\/\/([a-z0-9][a-z0-9.-]*\.[a-z]{2,})(?::\d+)?(?=[/"'`\s?#),;]|$)/gi;
+const BARE_HOSTNAME_PATTERN = /^[a-z0-9][a-z0-9.-]*\.[a-z]{2,}(?::\d+)?$/i;
+function isEnvExampleFile(path) {
+    const name = path.split("/").pop() ?? path;
+    return name === ".env.example" || name.endsWith(".env.example") || name === ".env.sample" || name === ".env.template";
+}
+/** Extract the hostname from a connection-string authority, discarding any
+ * credentials, port, path, or query. Never returns secret material. */
+function hostFromAuthority(authority) {
+    const withoutCredentials = authority.split("@").pop() ?? "";
+    const host = withoutCredentials.split(/[/:?#,]/)[0] ?? "";
+    return /^[a-z0-9][a-z0-9.-]*$/i.test(host) ? host.toLowerCase() : undefined;
+}
+function detectManifestDrivers(files) {
+    const drivers = new Set();
+    for (const file of files) {
+        const name = file.path.split("/").pop() ?? file.path;
+        if (!file.content)
+            continue;
+        if (name === "package.json") {
+            try {
+                const parsed = JSON.parse(file.content);
+                for (const dependency of [...Object.keys(parsed.dependencies ?? {}), ...Object.keys(parsed.devDependencies ?? {})]) {
+                    const driver = MANIFEST_DRIVER_MAP[dependency.toLowerCase()];
+                    if (driver)
+                        drivers.add(driver);
+                }
+            }
+            catch {
+                // Malformed manifest: skip, extraction stays best-effort.
+            }
+        }
+        else if (name === "requirements.txt") {
+            for (const line of file.content.split(/\r?\n/)) {
+                const requirement = line.trim().split(/[=<>!~\[;\s]/)[0]?.toLowerCase() ?? "";
+                const driver = MANIFEST_DRIVER_MAP[requirement];
+                if (driver)
+                    drivers.add(driver);
+            }
+        }
+    }
+    return drivers;
+}
+function recordHost(hosts, host, driver, envName) {
+    const existing = hosts.get(host) ?? { host, driver: undefined, envNames: new Set() };
+    if (driver && !existing.driver)
+        existing.driver = driver;
+    if (envName)
+        existing.envNames.add(envName);
+    hosts.set(host, existing);
+}
+/** Scan one text fragment for connection strings, JDBC URLs, and http(s)
+ * base URLs, recording hostnames (never credentials or secret values). */
+function scanFragmentForHosts(hosts, fragment, envName) {
+    for (const match of fragment.matchAll(CONNECTION_STRING_PATTERN)) {
+        const driver = CONNECTION_SCHEME_DRIVERS[(match[1] ?? "").toLowerCase()];
+        const host = hostFromAuthority(match[2] ?? "");
+        if (host)
+            recordHost(hosts, host, driver, envName);
+    }
+    for (const match of fragment.matchAll(JDBC_PATTERN)) {
+        const driver = JDBC_SCHEME_DRIVERS[(match[1] ?? "").toLowerCase()];
+        const host = hostFromAuthority(match[2] ?? "");
+        if (host)
+            recordHost(hosts, host, driver, envName);
+    }
+    for (const match of fragment.matchAll(HTTP_URL_PATTERN)) {
+        const host = (match[1] ?? "").toLowerCase();
+        if (host)
+            recordHost(hosts, host, undefined, envName);
+    }
+}
+export function extractDataDependencies(files, declared) {
+    const drivers = detectManifestDrivers(files);
+    const hosts = new Map();
+    for (const file of files) {
+        const content = file.content;
+        if (!content)
+            continue;
+        if (isEnvExampleFile(file.path)) {
+            // Env-example files associate the env var NAME with any hostname found
+            // in its value. Values that are not hostnames/URLs are never emitted.
+            for (const line of content.split(/\r?\n/)) {
+                const envMatch = /^([A-Z0-9_]{3,})=(.*)$/.exec(line.trim());
+                if (!envMatch)
+                    continue;
+                const [, envName, value] = envMatch;
+                const trimmed = (value ?? "").trim().replace(/^["']|["']$/g, "");
+                scanFragmentForHosts(hosts, trimmed, envName);
+                if (BARE_HOSTNAME_PATTERN.test(trimmed)) {
+                    const host = hostFromAuthority(trimmed);
+                    if (host)
+                        recordHost(hosts, host, undefined, envName);
+                }
+            }
+        }
+        else {
+            scanFragmentForHosts(hosts, content, undefined);
+        }
+    }
+    // Classify each host: database when a DB driver or DB connection-string
+    // scheme is implicated for that host, otherwise api. Supabase hosts count
+    // as database when the supabase client library is a declared dependency.
+    const databaseByDriver = new Map();
+    const apiHosts = [];
+    for (const detected of hosts.values()) {
+        let driver = detected.driver;
+        if (!driver && drivers.has("supabase") && /\.supabase\.(?:co|in)$/i.test(detected.host))
+            driver = "supabase";
+        if (driver) {
+            const group = databaseByDriver.get(driver) ?? { hosts: new Set(), envNames: new Set() };
+            group.hosts.add(detected.host);
+            for (const envName of detected.envNames)
+                group.envNames.add(envName);
+            databaseByDriver.set(driver, group);
+        }
+        else {
+            apiHosts.push(detected);
+        }
+    }
+    // Manifest drivers with no host still surface as a hostless database entry.
+    for (const driver of drivers) {
+        if (!databaseByDriver.has(driver))
+            databaseByDriver.set(driver, { hosts: new Set(), envNames: new Set() });
+    }
+    const detectedEntries = [];
+    for (const [driver, group] of [...databaseByDriver.entries()].sort(([a], [b]) => a.localeCompare(b))) {
+        detectedEntries.push({ kind: "database", identifiers: { hosts: [...group.hosts].sort(), driver, envNames: [...group.envNames].sort() }, origin: "detected" });
+    }
+    for (const detected of apiHosts.sort((a, b) => a.host.localeCompare(b.host))) {
+        detectedEntries.push({ kind: "api", identifiers: { hosts: [detected.host], envNames: [...detected.envNames].sort() }, origin: "detected" });
+    }
+    // Merge declared entries: declared wins on host collision; origin stays
+    // faithful to what the caller supplied (defaulting to "declared").
+    const declaredEntries = (declared ?? []).map(entry => ({
+        kind: entry.kind,
+        identifiers: {
+            hosts: [...new Set(entry.identifiers.hosts.map(host => host.toLowerCase()))].sort(),
+            ...(entry.identifiers.driver ? { driver: entry.identifiers.driver } : {}),
+            envNames: [...new Set(entry.identifiers.envNames)].sort()
+        },
+        origin: entry.origin ?? "declared"
+    }));
+    const declaredHosts = new Set(declaredEntries.flatMap(entry => entry.identifiers.hosts));
+    const merged = [...declaredEntries];
+    for (const entry of detectedEntries) {
+        const hadHosts = entry.identifiers.hosts.length > 0;
+        const survivingHosts = entry.identifiers.hosts.filter(host => !declaredHosts.has(host));
+        if (hadHosts && survivingHosts.length === 0)
+            continue;
+        merged.push({ ...entry, identifiers: { ...entry.identifiers, hosts: survivingHosts } });
+    }
+    return merged;
+}
+/** Additive export: run the analyzer's existing env-name detection over an
+ * in-memory {path, content} file list (e.g. files unpacked from an upload). */
+export function detectEnvironmentVariableNames(files) {
+    return detectEnvNames(files.map(file => ({
+        path: file.path,
+        basename: file.path.split("/").pop() ?? file.path,
+        size: file.content?.length ?? 0,
+        ...(file.content !== undefined ? { content: file.content } : {})
+    })));
+}
 export async function scanWorkspace(root, options = {}) {
     const rootInfo = await lstat(root);
     if (rootInfo.isSymbolicLink() || !rootInfo.isDirectory())

package/dist/src/contracts.js

@@ -1,4 +1,14 @@
 export const PROTOCOL_VERSION = "2025-11-25";
+export const WAITING_FOR_DATA_ACCESS_PLAIN_ENGLISH = "Your app uses a company data source that isn't set up for apps yet. I've asked your IT admin — I'll continue automatically once it's approved.";
+export function waitingForSecretsPlainEnglish(missingNames) {
+    const count = missingNames.length;
+    return `Your app uses ${count} key${count === 1 ? "" : "s"} (${missingNames.join(", ")}). Enter them securely in your Harbour console — I'll continue once they're set.`;
+}
+/** Stage → plain-English templates for the two waiting stages. */
+export const OPERATION_WAITING_STAGE_PLAIN_ENGLISH = {
+    WAITING_FOR_DATA_ACCESS: WAITING_FOR_DATA_ACCESS_PLAIN_ENGLISH,
+    WAITING_FOR_SECRETS: "Your app needs one or more keys entered securely in your Harbour console before it can be deployed."
+};
 export function isRecord(value) {
     return typeof value === "object" && value !== null && !Array.isArray(value);
 }

package/package.json

@@ -1,10 +1,10 @@
 {
   "name": "@fourier-labs/harbour",
-  "version": "0.1.11",
+  "version": "0.1.12",
   "description": "Harbour productionisation helper",
   "type": "module",
   "bin": { "harbour": "./dist/packages/harbour-cli/src/cli.js" },
-  "repository": { "type": "git", "url": "https://github.com/Fourier-Labs-AI/harbour-control-plane.git" },
+  "repository": { "type": "git", "url": "https://github.com/Fourier-Labs-AI/harbour-governance-control-plane.git" },
   "publishConfig": { "access": "public" },
   "files": ["dist/packages/harbour-cli/src", "dist/src/analyzer.js", "dist/src/contracts.js", "dist/src/digest.js", "dist/src/source-intake.js", "package.json"],
   "engines": { "node": ">=22.13.0" },