@fourier-labs/harbour 0.1.13 → 0.1.14

package/dist/packages/harbour-cli/src/local-runtime.js

@@ -0,0 +1,355 @@
+import { spawn } from "node:child_process";
+import { createHash } from "node:crypto";
+import { mkdir, readFile, readdir, rm, writeFile } from "node:fs/promises";
+import { createServer } from "node:net";
+import { join, relative } from "node:path";
+import { kitPaths, projectName } from "./kit.js";
+import { CliError } from "./output.js";
+export const runCommand = (command, args, options = {}) => new Promise(resolve => {
+    const child = spawn(command, args, { cwd: options.cwd, env: { ...process.env, ...options.env }, stdio: [options.stdin === undefined ? "ignore" : "pipe", "pipe", "pipe"] });
+    let stdout = "";
+    let stderr = "";
+    child.stdout?.on("data", chunk => { stdout += chunk; });
+    child.stderr?.on("data", chunk => { stderr += chunk; if (!options.quiet)
+        process.stderr.write(chunk); });
+    child.on("error", error => resolve({ code: 127, stdout, stderr: `${stderr}${error.message}` }));
+    child.on("close", code => resolve({ code: code ?? 1, stdout, stderr }));
+    if (options.stdin !== undefined) {
+        child.stdin?.end(options.stdin);
+    }
+});
+export const LOCAL = {
+    tenant: "local-tenant",
+    app: "local-app",
+    userId: "local-user",
+    email: "local-user@example.test",
+    database: "harbour",
+    dbUser: "harbour",
+    dbPassword: "harbour-local",
+    bucket: "harbour-local",
+    s3Key: "harbour-local-access-key",
+    s3Secret: "harbour-local-secret-key",
+    gatewayRole: "harbour_app_gateway"
+};
+// ---- Compose ----------------------------------------------------------------------
+/**
+ * Compose file for one project: every port bound to 127.0.0.1, named volumes
+ * prefixed with the project name, images pinned from the bundle manifest.
+ * The fixture writes the session env (identity token) to the shared state dir.
+ */
+export function composeFile(project, bundle, ports, stateDir) {
+    const images = bundle.images;
+    const originUrl = `http://127.0.0.1:${ports.origin}`;
+    return [
+        `name: ${project}`,
+        "services:",
+        "  postgres:",
+        `    image: ${images.postgres ?? "postgres:16-alpine"}`,
+        `    environment: { POSTGRES_USER: ${LOCAL.dbUser}, POSTGRES_PASSWORD: ${LOCAL.dbPassword}, POSTGRES_DB: ${LOCAL.database} }`,
+        `    ports: ["127.0.0.1:${ports.postgres}:5432"]`,
+        "    volumes: [postgres-data:/var/lib/postgresql/data]",
+        `    healthcheck: { test: ["CMD-SHELL", "pg_isready -U ${LOCAL.dbUser} -d ${LOCAL.database}"], interval: 2s, timeout: 3s, retries: 30 }`,
+        "  minio:",
+        `    image: ${images.minio ?? "minio/minio:RELEASE.2025-07-23T15-54-02Z"}`,
+        "    command: server /data",
+        `    environment: { MINIO_ROOT_USER: ${LOCAL.s3Key}, MINIO_ROOT_PASSWORD: ${LOCAL.s3Secret} }`,
+        `    ports: ["127.0.0.1:${ports.minio}:9000"]`,
+        "    volumes: [minio-data:/data]",
+        "    healthcheck: { test: [\"CMD-SHELL\", \"curl -sf http://127.0.0.1:9000/minio/health/ready || wget -qO- http://127.0.0.1:9000/minio/health/ready\"], interval: 2s, timeout: 3s, retries: 30 }",
+        "  nats:",
+        `    image: ${images.nats ?? "nats:2.11.17-alpine"}`,
+        "    command: [\"-js\", \"-m\", \"8222\"]",
+        `    ports: ["127.0.0.1:${ports.nats}:4222"]`,
+        "  fixture:",
+        `    image: ${images.sessionFixture}`,
+        "    command: [\"--listen\", \"0.0.0.0:8080\", \"--session\", \"" + project + "\", \"--base-url\", \"http://127.0.0.1:" + ports.fixture + "\", \"--tenant\", \"" + LOCAL.tenant + "\", \"--app\", \"" + LOCAL.app + "\", \"--user-id\", \"" + LOCAL.userId + "\", \"--email\", \"" + LOCAL.email + "\", \"--metadata-file\", \"/state/session.json\", \"--env-file\", \"/state/session.env\", \"--display-directory\", \"" + stateDir + "\"]",
+        "    environment:",
+        `      HARBOUR_LOCAL_COMPOSE_PROJECT: ${project}`,
+        `      HARBOUR_LOCAL_S3_INTERNAL_ENDPOINT: http://minio:9000`,
+        `      HARBOUR_LOCAL_S3_ENDPOINT: http://127.0.0.1:${ports.minio}`,
+        `      HARBOUR_LOCAL_S3_BUCKET: ${LOCAL.bucket}`,
+        `      HARBOUR_LOCAL_S3_ACCESS_KEY: ${LOCAL.s3Key}`,
+        `      HARBOUR_LOCAL_S3_SECRET_KEY: ${LOCAL.s3Secret}`,
+        `      HARBOUR_LOCAL_POSTGRES_INTERNAL_URL: ${internalDatabaseUrl()}`,
+        `      HARBOUR_LOCAL_POSTGRES_ADDRESS: 127.0.0.1:${ports.postgres}`,
+        `      HARBOUR_LOCAL_NATS_URL: nats://127.0.0.1:${ports.nats}`,
+        `      HARBOUR_LOCAL_NATS_INTERNAL_URL: nats://nats:4222`,
+        `    ports: ["127.0.0.1:${ports.fixture}:8080"]`,
+        `    volumes: ["${stateDir}:/state"]`,
+        "    depends_on: { postgres: { condition: service_healthy }, minio: { condition: service_healthy } }",
+        "  gateway:",
+        `    image: ${images.appGateway}`,
+        "    environment:",
+        "      HARBOUR_APP_GATEWAY_CONFIG_FILE: /config/app-gateway.json",
+        "      HARBOUR_APP_GATEWAY_UPLOAD_KEY: " + uploadKey(project),
+        "      HARBOUR_S3_ENDPOINT: http://minio:9000",
+        `      HARBOUR_S3_PUBLIC_ENDPOINT: http://127.0.0.1:${ports.minio}`,
+        "      HARBOUR_NATS_URL: nats://nats:4222",
+        `      AWS_ACCESS_KEY_ID: ${LOCAL.s3Key}`,
+        `      AWS_SECRET_ACCESS_KEY: ${LOCAL.s3Secret}`,
+        "      AWS_REGION: us-east-1",
+        "      AWS_EC2_METADATA_DISABLED: \"true\"",
+        `    ports: ["127.0.0.1:${ports.gateway}:8080"]`,
+        `    volumes: ["${stateDir}/app-gateway.json:/config/app-gateway.json:ro"]`,
+        "    depends_on: { postgres: { condition: service_healthy }, minio: { condition: service_healthy }, fixture: { condition: service_started } }",
+        "volumes:",
+        `  postgres-data: { name: ${project}-postgres }`,
+        `  minio-data: { name: ${project}-minio }`,
+        `# Browser origin: ${originUrl}`,
+        ""
+    ].join("\n");
+}
+/** App Gateway configuration in the shape cmd/appgateway/main.go decodes (unknown fields are rejected there). */
+export function gatewayConfig(ports) {
+    return {
+        listen: ":8080",
+        issuer: `http://127.0.0.1:${ports.fixture}`,
+        jwksUrl: "http://fixture:8080/.well-known/jwks.json",
+        environment: "development",
+        publicBaseUrl: `http://127.0.0.1:${ports.origin}`,
+        // Verified against the local images (docs/local-kit.md): the fixture's `iss` equals its --base-url, so `issuer`
+        // verifies; `unrestrictedFiles` with no filePolicies is the local cell's file policy.
+        bindings: [{
+                tenant: LOCAL.tenant,
+                app: LOCAL.app,
+                databaseUrl: internalDatabaseUrl(LOCAL.gatewayRole),
+                bucket: LOCAL.bucket,
+                prefix: `${LOCAL.tenant}/${LOCAL.app}/development/`,
+                publicBaseUrl: `http://127.0.0.1:${ports.minio}/${LOCAL.bucket}`,
+                capabilities: ["data", "files", "realtime", "telemetry"],
+                filePolicies: [],
+                unrestrictedFiles: true
+            }]
+    };
+}
+function internalDatabaseUrl(user = LOCAL.dbUser) { return `postgresql://${user}:${LOCAL.dbPassword}@postgres:5432/${LOCAL.database}?sslmode=disable`; }
+function uploadKey(project) { return createHash("sha256").update(`upload-key:${project}`).digest("base64"); }
+// ---- Ports and lock ------------------------------------------------------------------
+export async function freePort() {
+    return new Promise((resolve, reject) => {
+        const server = createServer();
+        server.on("error", reject);
+        server.listen(0, "127.0.0.1", () => { const address = server.address(); server.close(() => typeof address === "object" && address ? resolve(address.port) : reject(new Error("no port"))); });
+    });
+}
+export async function allocatePorts() {
+    const [postgres, minio, nats, fixture, gateway, vite, origin] = await Promise.all([freePort(), freePort(), freePort(), freePort(), freePort(), freePort(), freePort()]);
+    return { postgres: postgres, minio: minio, nats: nats, fixture: fixture, gateway: gateway, vite: vite, origin: origin };
+}
+/** Acquires `.harbour/local/dev.lock`; a lock whose process is gone is stale and replaced. */
+export async function acquireDevLock(root, ports, isAlive = pidAlive) {
+    const existing = await readDevLock(root);
+    if (existing && existing.pid !== process.pid && isAlive(existing.pid))
+        throw new CliError("DEV_ALREADY_RUNNING", `harbour dev is already running for this app (pid ${existing.pid}, ${existing.origin}). Run \`harbour stop\` first.`);
+    const lock = { pid: process.pid, startedAt: new Date().toISOString(), ports, origin: `http://127.0.0.1:${ports.origin}` };
+    await mkdir(kitPaths(root).local, { recursive: true });
+    await writeFile(kitPaths(root).devLock, JSON.stringify(lock));
+    return lock;
+}
+export async function readDevLock(root) {
+    try {
+        return JSON.parse(await readFile(kitPaths(root).devLock, "utf8"));
+    }
+    catch {
+        return undefined;
+    }
+}
+export async function releaseDevLock(root) { await rm(kitPaths(root).devLock, { force: true }); }
+/** The running dev origin for this app, if its lock holder is alive. */
+export async function runningOrigin(root, isAlive = pidAlive) {
+    const lock = await readDevLock(root);
+    return lock && isAlive(lock.pid) ? lock.origin : undefined;
+}
+export function pidAlive(pid) { try {
+    process.kill(pid, 0);
+    return true;
+}
+catch {
+    return false;
+} }
+// ---- Compose lifecycle ----------------------------------------------------------------
+export class LocalRuntime {
+    root;
+    run;
+    project;
+    composePath;
+    constructor(root, run = runCommand, project = projectName(root), composePath = kitPaths(root).compose) {
+        this.root = root;
+        this.run = run;
+        this.project = project;
+        this.composePath = composePath;
+    }
+    /** Disposable postgres-only project for `harbour check` migrations: separate name, separate volume, torn down after. */
+    static forCheck(root, run = runCommand) {
+        return new LocalRuntime(root, run, projectName(root, "-check"), join(kitPaths(root).local, "check-compose.yml"));
+    }
+    compose(args, options = {}) {
+        return this.run("docker", ["compose", "-p", this.project, "-f", this.composePath, ...args], { cwd: this.root, ...options });
+    }
+    async writeCheckFiles(bundle) {
+        await mkdir(kitPaths(this.root).local, { recursive: true });
+        await writeFile(this.composePath, [`name: ${this.project}`, "services:", "  postgres:", `    image: ${bundle.images.postgres ?? "postgres:16-alpine"}`, `    environment: { POSTGRES_USER: ${LOCAL.dbUser}, POSTGRES_PASSWORD: ${LOCAL.dbPassword}, POSTGRES_DB: ${LOCAL.database} }`, "    volumes: [postgres-data:/var/lib/postgresql/data]", `    healthcheck: { test: ["CMD-SHELL", "pg_isready -U ${LOCAL.dbUser} -d ${LOCAL.database}"], interval: 1s, timeout: 3s, retries: 30 }`, "volumes:", `  postgres-data: { name: ${this.project}-postgres }`, ""].join("\n"));
+    }
+    /** Removes this project's containers and volumes without the reset banner (check teardown). */
+    async down() { await this.compose(["down", "-v", "--remove-orphans"], { quiet: true }); }
+    async writeFiles(bundle, ports) {
+        const paths = kitPaths(this.root);
+        await mkdir(paths.state, { recursive: true });
+        await writeFile(paths.compose, composeFile(this.project, bundle, ports, paths.state));
+        await writeFile(join(paths.state, "app-gateway.json"), `${JSON.stringify(gatewayConfig(ports), null, 2)}\n`);
+    }
+    /**
+     * Pulls the pinned images before `up`, so a registry problem is named as such
+     * rather than surfacing as a failed start. Every kit image is a public
+     * `repository@sha256:<digest>` reference: no registry login is needed and
+     * a tag can never substitute other bytes.
+     */
+    async pull(bundle) {
+        const result = await this.compose(["pull", "--quiet"]);
+        if (result.code !== 0)
+            throw new CliError("KIT_IMAGES_UNAVAILABLE", `Docker could not pull the kit images (${bundle.images.appGateway}, ${bundle.images.sessionFixture}): ${result.stderr.trim().split("\n").at(-1) ?? "docker error"}. They are public and pinned by digest; \`docker compose\` (Compose v2) must be installed and Docker running with access to the registry.`);
+    }
+    async up() {
+        const result = await this.compose(["up", "-d", "--wait"]);
+        if (result.code !== 0)
+            throw new CliError("LOCAL_RUNTIME_FAILED", "Docker could not start the local Harbour services. Is Docker running and are the kit images available (see .harbour/kit.lock.json)?");
+    }
+    /** Stops containers and keeps volumes; safe to repeat. */
+    async stop() {
+        const result = await this.compose(["stop"], { quiet: true });
+        return { stopped: result.code === 0 };
+    }
+    /** Removes this project's containers and named volumes only. */
+    async reset(output) {
+        output(`Deleting local data for this app only: compose project ${this.project}, volumes ${this.project}-postgres and ${this.project}-minio.`);
+        const result = await this.compose(["down", "-v", "--remove-orphans"], { quiet: true });
+        if (result.code !== 0)
+            throw new CliError("LOCAL_RESET_FAILED", "Docker could not remove the local Harbour services for this app.");
+        await rm(kitPaths(this.root).state, { recursive: true, force: true });
+    }
+    /** Applies `migrations/*.sql` in name order through psql inside the postgres container, after ensuring the runtime role. */
+    async migrate() {
+        const dir = join(this.root, "migrations");
+        const names = (await readdir(dir).catch(() => [])).filter(name => name.endsWith(".sql")).sort();
+        const psql = (sql) => this.compose(["exec", "-T", "postgres", "psql", "-v", "ON_ERROR_STOP=1", "-U", LOCAL.dbUser, "-d", LOCAL.database], { stdin: sql, quiet: true });
+        const role = await psql(`DO $$ BEGIN IF NOT EXISTS (SELECT 1 FROM pg_roles WHERE rolname = '${LOCAL.gatewayRole}') THEN CREATE ROLE ${LOCAL.gatewayRole} LOGIN PASSWORD '${LOCAL.dbPassword}'; END IF; END $$;`);
+        if (role.code !== 0)
+            throw new CliError("MIGRATION_FAILED", "Could not prepare the local database role.");
+        for (const name of names) {
+            const result = await psql(await readFile(join(dir, name), "utf8"));
+            if (result.code !== 0)
+                throw new CliError("MIGRATION_FAILED", `Migration ${name} failed: ${result.stderr.trim().split("\n").at(-1) ?? "psql error"}`);
+        }
+        return names;
+    }
+    /** The fixture's session env (identity token for the local app user) once the fixture has written it. */
+    async sessionEnv(attempts = 60) {
+        const path = join(kitPaths(this.root).state, "session.env");
+        for (let attempt = 0; attempt < attempts; attempt += 1) {
+            try {
+                const env = parseSessionEnv(await readFile(path, "utf8"));
+                if (env.HARBOUR_IDENTITY_CONTEXT_TOKEN)
+                    return env;
+            }
+            catch { /* not written yet */ }
+            await new Promise(resolve => setTimeout(resolve, 500));
+        }
+        throw new CliError("LOCAL_RUNTIME_FAILED", "The local identity fixture did not publish a session.");
+    }
+}
+/** The fixture writes a shell-sourceable file: `export KEY='value'`, a literal quote written as `'"'"'`. */
+export function parseSessionEnv(text) {
+    const env = {};
+    for (const line of text.split("\n")) {
+        const match = /^(?:export\s+)?([A-Za-z_][A-Za-z0-9_]*)=(.*)$/.exec(line.trim());
+        if (!match)
+            continue;
+        const raw = match[2];
+        env[match[1]] = raw.startsWith("'") && raw.endsWith("'") && raw.length >= 2 ? raw.slice(1, -1).replace(/'"'"'/g, "'") : raw;
+    }
+    return env;
+}
+// ---- SDK tarball ---------------------------------------------------------------------------
+/**
+ * The SDK ships in the kit bundle, not the public registry. Stages the tarball
+ * named by HARBOUR_KIT_SDK_TARBALL or downloaded from the manifest's sdk.url under
+ * `.harbour/local/sdk/` (so package.json gets a relative `file:` dependency), checks
+ * its sha256 against the bundle and installs it with the app's other dependencies.
+ * Returns "present" when the staged tarball is already installed, "missing" when
+ * no tarball is available and node_modules lacks the package.
+ */
+export async function ensureSdk(root, bundle, env, run, output, fetchImpl = fetch) {
+    const installed = await readFile(join(root, "node_modules", ...bundle.sdk.package.split("/"), "package.json")).then(() => true, () => false);
+    const stageDir = join(kitPaths(root).local, "sdk");
+    const staged = join(stageDir, `harbour-app-sdk-${bundle.sdk.tarballSha256.slice(0, 12)}.tgz`);
+    const source = env.HARBOUR_KIT_SDK_TARBALL?.trim();
+    if (!(await exists(staged))) {
+        let bytes;
+        if (source)
+            bytes = await readFile(source).catch(() => { throw new CliError("SDK_UNAVAILABLE", `HARBOUR_KIT_SDK_TARBALL is not readable: ${source}`); });
+        else if (bundle.sdk.url) {
+            output(`Downloading ${bundle.sdk.package} from the kit bundle (sha256 ${bundle.sdk.tarballSha256.slice(0, 12)}…).`);
+            bytes = await downloadSdk(bundle.sdk.url, fetchImpl);
+        }
+        if (!bytes)
+            return installed ? "present" : "missing";
+        const digest = createHash("sha256").update(bytes).digest("hex");
+        if (bundle.sdk.tarballSha256 !== "unknown" && digest !== bundle.sdk.tarballSha256)
+            throw new CliError("KIT_BUNDLE_INCOMPATIBLE", `The SDK tarball digest ${digest} does not match the kit bundle ${bundle.sdk.tarballSha256}. Run \`harbour init --upgrade\` or use the matching tarball.`);
+        await mkdir(stageDir, { recursive: true });
+        await writeFile(staged, bytes);
+    }
+    else if (installed && (await readFile(join(root, "package.json"), "utf8").catch(() => "")).includes(relative(root, staged)))
+        return "present";
+    output(`Installing ${bundle.sdk.package} from the kit bundle.`);
+    const result = await run("npm", ["install", "--no-audit", "--no-fund", relative(root, staged)], { cwd: root, quiet: true });
+    if (result.code !== 0)
+        throw new CliError("SDK_INSTALL_FAILED", `npm could not install the kit SDK tarball: ${result.stderr.trim().split("\n").at(-1) ?? "npm error"}`);
+    return "installed";
+}
+/**
+ * Fetches the SDK tarball from the bundle's `sdk.url`. The published bundle
+ * stores it as a content-addressed OCI blob on a public registry, which answers
+ * an anonymous GET with a Bearer challenge naming a token endpoint that hands
+ * out pull tokens without credentials; the challenge is followed once and the
+ * request repeated. Redirects (a blob served from object storage) are followed;
+ * the bearer token is not forwarded across origins by fetch itself. The caller
+ * verifies the bytes against `sdk.tarballSha256` — a token or a redirect can
+ * change where the bytes come from, never which bytes are accepted.
+ */
+export async function downloadSdk(url, fetchImpl = fetch) {
+    if (!/^https:\/\//.test(url))
+        throw new CliError("SDK_UNAVAILABLE", `The kit bundle's sdk.url must be https: ${url}`);
+    const attempt = (headers = {}) => fetchImpl(url, { redirect: "follow", headers }).catch(error => { throw new CliError("SDK_UNAVAILABLE", `The kit SDK tarball could not be downloaded from ${url}: ${error instanceof Error ? error.message : String(error)}`); });
+    let response = await attempt();
+    if (response.status === 401) {
+        const challenge = parseBearerChallenge(response.headers.get("www-authenticate"));
+        if (challenge && /^https:\/\//.test(challenge.realm)) {
+            const tokenUrl = new URL(challenge.realm);
+            if (challenge.service)
+                tokenUrl.searchParams.set("service", challenge.service);
+            if (challenge.scope)
+                tokenUrl.searchParams.set("scope", challenge.scope);
+            const tokenResponse = await fetchImpl(tokenUrl, { redirect: "follow" }).catch(() => undefined);
+            const body = tokenResponse?.ok ? await tokenResponse.json().catch(() => undefined) : undefined;
+            const token = typeof body?.token === "string" ? body.token : typeof body?.access_token === "string" ? body.access_token : undefined;
+            if (token)
+                response = await attempt({ authorization: `Bearer ${token}` });
+        }
+    }
+    if (!response.ok)
+        throw new CliError("SDK_UNAVAILABLE", `The kit SDK tarball could not be downloaded from ${url} (HTTP ${response.status}).`);
+    return new Uint8Array(await response.arrayBuffer());
+}
+/** `Bearer realm="…",service="…",scope="…"` (RFC 6750 / distribution token auth); anything else is no challenge. */
+export function parseBearerChallenge(header) {
+    if (!header || !/^\s*bearer\s/i.test(header))
+        return undefined;
+    const params = {};
+    for (const match of header.slice(header.search(/\s/)).matchAll(/([a-z_]+)="([^"]*)"/gi))
+        params[match[1].toLowerCase()] = match[2];
+    if (!params.realm)
+        return undefined;
+    return { realm: params.realm, service: params.service, scope: params.scope };
+}
+const exists = (path) => readFile(path).then(() => true, () => false);

package/dist/packages/harbour-cli/src/operations.js

@@ -75,6 +75,8 @@ export async function waitForSettled(client, operationRef, output, options = {})
             // transiently (gateway timeout, dropped connection). The operation is
             // unaffected by our polling, so keep watching; give up only after a run
             // of failures, and say what the last one was instead of a generic error.
+            if (error instanceof CliError)
+                throw error; // e.g. AUTH_REQUIRED: retrying cannot help.
             consecutiveFailures += 1;
             if (consecutiveFailures >= 5)
                 throw new CliError("DEPLOYMENT_STATUS_UNAVAILABLE", `Harbour stopped answering status checks (${safeMessage(error)}). The deployment may still be running; check again with \`harbour status\`.`, operationRef);

package/dist/packages/harbour-cli/src/productionise.js

@@ -9,6 +9,8 @@ import { CliError } from "./output.js";
 import { getAppSetup, outcomeFor, readLine, waitForSettled } from "./operations.js";
 import { CLI_VERSION } from "./version.js";
 import { isProhibitedSecretPath } from "../../../src/secret-paths.js";
+import { assertPreviewIntegrationsReady } from "./integrations.js";
+import { recordKitAppId } from "./kit.js";
 export async function productionise(rootArg, client, output, tenantId, includePaths = [], options = {}) {
     const root = resolve(rootArg);
     output(`Harbour is checking ${basename(root)}.`);
@@ -21,6 +23,9 @@ export async function productionise(rootArg, client, output, tenantId, includePa
         throw new CliError("PREFLIGHT_SECRET_PATH", "The selected app boundary contains a prohibited secret file.");
     const files = await Promise.all(graph.deploymentScope.includedFiles.map(async (path) => ({ path, content: new Uint8Array(await readFile(resolve(root, path))) })));
     output(`Harbour found ${files.length} app files.`);
+    // A declared connection without its preview grant would only park the
+    // deployment after the save; refuse here, before any operation exists.
+    const kitAppId = options.integrations ? await assertPreviewIntegrationsReady(root, options.integrations.governance, tenantId, options.integrations.bundle, output) : options.appId;
     try {
         await client.initialize();
     }
@@ -28,8 +33,9 @@ export async function productionise(rootArg, client, output, tenantId, includePa
         throw new CliError("NOT_STARTED", "Harbour could not be reached before the operation started.");
     }
     let start;
+    const linked = kitAppId ? { appId: kitAppId } : {};
     try {
-        start = structured(await client.call("harbour_start_productionization", { appPath: basename(root), appName: basename(root), surface: "codex" }));
+        start = structured(await client.call("harbour_start_productionization", { appPath: basename(root), appName: basename(root), surface: "codex", ...linked }));
     }
     catch {
         throw new CliError("NOT_STARTED", "Harbour could not start the productionisation operation.");
@@ -38,12 +44,16 @@ export async function productionise(rootArg, client, output, tenantId, includePa
     if (!operationRef)
         throw new CliError("NOT_STARTED", "Harbour did not start the productionisation operation.");
     try {
-        const submitted = structured(await client.call("harbour_submit_application_graph", { operationId: operationRef, surface: "codex", graph }));
+        const submitted = structured(await client.call("harbour_submit_application_graph", { operationId: operationRef, surface: "codex", graph, ...linked }));
         if (submitted.nextTool && !matchesTool(submitted.nextTool, "harbour_prepare_source_upload"))
             throw new CliError("UNSUPPORTED_NEXT_STEP", "Harbour returned an unsupported next step.", operationRef);
         const appId = typeof submitted.appId === "string" ? submitted.appId.trim() : "";
         if (!appId)
             throw new CliError("APP_IDENTITY_MISSING", "Harbour did not return the app identity for this operation.", operationRef);
+        if (kitAppId && appId !== kitAppId)
+            throw new CliError("APP_IDENTITY_MISMATCH", "Harbour returned a different app identity than the one linked in .harbour/kit.lock.json.", operationRef);
+        // The canonical identity lands in kit.lock so a later `integrations request` reuses it instead of linking a second app.
+        await recordKitAppId(root, appId, tenantId);
         const manifest = await createSourceManifest({ tenantId, appId, operationId: operationRef, graphDigest: graph.graphDigest, files });
         const preliminaryArchive = await archiveForManifest(root, manifest);
         const prepared = structured(await client.call("harbour_prepare_source_upload", { operationId: operationRef, appId, surface: "codex", graph, format: "zip", filename: `${appId}.zip`, compressedBytes: preliminaryArchive.body.byteLength, manifest: { schema: "harbour.source-package-manifest/1.0", files: manifest.files.map(file => ({ path: file.path, size: file.bytes, sha256: file.sha256 })) } }));

package/dist/packages/harbour-cli/src/remote-mcp-client.js

@@ -1,14 +1,15 @@
 import { CLI_VERSION } from "./version.js";
+import { CliError } from "./output.js";
 export class RemoteMcpClient {
     url;
-    token;
     tenant;
     id = 0;
     initialized = false;
+    token;
     constructor(url, token, tenant) {
         this.url = url;
-        this.token = token;
         this.tenant = tenant;
+        this.token = typeof token === "string" ? async () => token : token;
     }
     async initialize() {
         if (this.initialized)
@@ -25,17 +26,28 @@ export class RemoteMcpClient {
         return result;
     }
     async request(method, params, expectResponse = true) {
-        const headers = { "content-type": "application/json", "mcp-protocol-version": "2025-11-25" };
-        if (this.token)
-            headers.authorization = `Bearer ${this.token}`;
-        headers["x-harbour-tenant"] = this.tenant;
-        const response = await fetch(this.url, { method: "POST", headers, body: JSON.stringify({ jsonrpc: "2.0", id: ++this.id, method, ...(params === undefined ? {} : { params }) }) });
+        const body = JSON.stringify({ jsonrpc: "2.0", id: ++this.id, method, ...(params === undefined ? {} : { params }) });
+        let response = await this.post(body);
+        // A 401 mid-command usually means the stored token was rotated by another
+        // process; re-resolve (which reloads the store) and retry once. A second
+        // 401 means the sign-in itself is gone.
+        if (response.status === 401)
+            response = await this.post(body);
+        if (response.status === 401)
+            throw new CliError("AUTH_REQUIRED", "Harbour sign-in expired or was revoked. Run `harbour login` again.");
         if (!expectResponse)
             return undefined;
-        const body = await response.json();
-        if (!response.ok || body.error)
-            throw new Error(body.error?.message ?? `Harbour request failed (${response.status}).`);
-        return body.result;
+        const parsed = await response.json();
+        if (!response.ok || parsed.error)
+            throw new Error(parsed.error?.message ?? `Harbour request failed (${response.status}).`);
+        return parsed.result;
+    }
+    async post(body) {
+        const headers = { "content-type": "application/json", "mcp-protocol-version": "2025-11-25", "x-harbour-tenant": this.tenant };
+        const token = await this.token();
+        if (token)
+            headers.authorization = `Bearer ${token}`;
+        return fetch(this.url, { method: "POST", headers, body });
     }
 }
 export function structured(result) {