@fourier-labs/harbour 0.1.18 → 0.1.19

package/dist/packages/harbour-cli/src/check.js

@@ -1,6 +1,7 @@
 import { readFile, readdir, writeFile } from "node:fs/promises";
 import { join } from "node:path";
 import { loadDatabaseGate } from "./database-gate.js";
+import { CoverageLedger, createCoverageProxy, declaredCapabilities, missingFlowOperations, sourceTableVerbs } from "./flow-coverage.js";
 import { CliError } from "./output.js";
 import { DEPENDENT_READ_OPERATIONS, READ_OPERATIONS, kitPaths, readDeclaration, readKitLock, resourceNames, sourceDigest } from "./kit.js";
 import { LOCAL, LocalRuntime, runCommand, runningOrigin } from "./local-runtime.js";
@@ -49,15 +50,35 @@ export async function runChecks(root, options) {
     }
     const origin = await (options.localOrigin ?? (() => runningOrigin(root)))();
     const journeys = (await readdir(kitPaths(root).checks).catch(() => [])).filter(name => /\.(mjs|js|cjs)$/.test(name)).sort();
-    if (!journeys.length)
+    if (!journeys.length) {
         record("journeys", "not_run", "no checks under .harbour/checks/");
-    else if (!origin)
+        record("flow", "not_run", "no checks under .harbour/checks/ to exercise the app's operations");
+    }
+    else if (!origin) {
         record("journeys", "not_run", "harbour dev is not running; start it to exercise the journey checks");
-    else
-        for (const name of journeys) {
-            const result = await run("node", [join(kitPaths(root).checks, name)], { cwd: root, quiet: true, env: { HARBOUR_APP_URL: origin, HARBOUR_SDK_MODULE: join(root, "node_modules", "@harbour", "app-sdk", "dist", "index.js") } });
-            record(`journey:${name}`, result.code === 0 ? "pass" : "fail", result.code === 0 ? undefined : lastLines(result.stderr || result.stdout));
+        record("flow", "not_run", "harbour dev is not running; the pipeline's operation-coverage gate needs the checks to run");
+    }
+    else {
+        // The journeys run through a recording proxy so this reports what the
+        // pipeline reports: which converted operations and declared capabilities
+        // the checks actually exercised at the gateway.
+        const ledger = new CoverageLedger();
+        const proxy = createCoverageProxy(origin, ledger);
+        const appUrl = await proxy.listen();
+        try {
+            for (const name of journeys) {
+                const result = await run("node", [join(kitPaths(root).checks, name)], { cwd: root, quiet: true, env: { HARBOUR_APP_URL: appUrl, HARBOUR_SDK_MODULE: join(root, "node_modules", "@harbour", "app-sdk", "dist", "index.js") } });
+                record(`journey:${name}`, result.code === 0 ? "pass" : "fail", result.code === 0 ? undefined : lastLines(result.stderr || result.stdout));
+            }
+        }
+        finally {
+            await proxy.close();
         }
+        const missing = missingFlowOperations(await sourceTableVerbs(root), await declaredCapabilities(root), ledger);
+        record("flow", missing.length ? "fail" : "pass", missing.length
+            ? `${missing.join("; ")}. Exercise the converted application operations with source-valid inputs and assertions; an unrelated passing check is insufficient. The pipeline refuses this deployment as kit.check-failed: flow.check-failed.`
+            : "every operation the app performs and every capability it declares was exercised by a retained check");
+    }
     let integrations = "not tested";
     if (options.governance && lock?.appId && !declaration.errors.length) {
         integrations = await testIntegrationReads(lock.appId, options.governance, declaration.declaration, output);

package/dist/packages/harbour-cli/src/dev.js

@@ -3,6 +3,7 @@ import { createForwarder } from "./forwarder.js";
 import { readKitLock } from "./kit.js";
 import { acquireDevLock, allocatePorts, ensureSdk, LocalRuntime, releaseDevLock, runCommand } from "./local-runtime.js";
 import { CliError } from "./output.js";
+import { ensureRealtimeStream } from "./realtime-stream.js";
 /**
  * Starts the project's Compose services, applies migrations, starts Vite and the
  * loopback origin. Resolves when the runtime is up; the returned `stop` runs
@@ -39,8 +40,15 @@ export async function startDev(root, options) {
         const applied = await runtime.migrate();
         options.output(`Applied ${applied.length} migration file(s).`);
         const watched = await runtime.installRealtimeOutbox();
-        if (watched > 0)
+        if (watched > 0) {
+            // The outbox relay publishes with JetStream, which refuses a subject no
+            // stream captures; without the stream harbour.realtime delivers nothing.
+            // The relay has already given up by now, so it is restarted against the
+            // stream this just created.
+            await ensureRealtimeStream(ports.nats);
+            await runtime.restartService("outbox");
             options.output(`Installed the Harbour realtime outbox for ${watched} table(s) (harbour.realtime change events).`);
+        }
         const origin = `http://127.0.0.1:${ports.origin}`;
         vite = spawn("npm", ["run", "dev"], { cwd: root, env: { ...env, HARBOUR_LOCAL_ORIGIN: origin, HARBOUR_VITE_PORT: String(ports.vite) }, stdio: ["ignore", "inherit", "inherit"] });
         vite.on("error", () => options.output("Vite could not be started; is npm installed and `npm install` done?"));

package/dist/packages/harbour-cli/src/flow-coverage.js

@@ -0,0 +1,322 @@
+import { createServer, request as httpRequest } from "node:http";
+import { connect } from "node:net";
+import { readdir, readFile } from "node:fs/promises";
+import { extname, join } from "node:path";
+/**
+ * The pipeline's operation-coverage gate, run locally.
+ *
+ * The deployment pipeline replays `.harbour/checks/` against a real App Gateway
+ * and then refuses the deployment (`flow.check-failed`) unless every database
+ * operation the browser code performs, and every capability the kit lane
+ * derives from that code, was actually exercised while those checks ran. Before
+ * this module `harbour check` ran the same journey scripts but asserted nothing
+ * about what they exercised, so an app whose checks never touched a converted
+ * operation passed locally and failed in the pipeline — the parity gap this
+ * closes.
+ *
+ * The inventory and the wording below deliberately mirror the data plane's
+ * packages/toolkit/transformbuild (write_probe.go `inventorySDKTableVerbs`,
+ * local_operation_coverage.go `requireOperationCoverage`) so a local failure
+ * reads exactly like the pipeline's.
+ */
+/** Capabilities the coverage gate demands evidence for, in the pipeline's order. */
+export const COVERED_CAPABILITIES = ["data", "files", "actions", "telemetry", "realtime"];
+/** Every capability the kit lane derives from the browser SDK surface. */
+const SDK_CAPABILITIES = ["data", "files", "actions", "realtime", "telemetry", "integrations"];
+const SOURCE_EXTENSIONS = new Set([".ts", ".tsx", ".js", ".jsx", ".mjs"]);
+const SKIPPED_DIRECTORIES = new Set(["node_modules", ".git", "dist", "build", ".harbour"]);
+const TABLE_CHAIN = /\.from\(\s*["'`]([A-Za-z0-9_]+)["'`]\s*\)/g;
+const VERB_CALL = /\.(select|insert|update|delete|upsert)\s*\(/g;
+/** `createClient()` bindings name the identifier a capability call must be made on. */
+const CLIENT_BINDING = /(?:const|let|var)\s+([A-Za-z_$][A-Za-z0-9_$]*)\s*(?::[^=]+)?=\s*(?:await\s+)?createClient\s*\(/g;
+/** Records the gateway operations observed while the retained checks ran. */
+export class CoverageLedger {
+    seen = new Set();
+    add(key) { this.seen.add(key); }
+    has(key) { return this.seen.has(key); }
+    keys() { return [...this.seen].sort(); }
+    /**
+     * The gateway's data boundary. A write that changed no row proves nothing, so
+     * only a select — or a mutation that returned rows — counts (observeData in
+     * local_operation_coverage.go).
+     */
+    observeData(table, operation, rows) {
+        if (operation !== "select" && rows === 0)
+            return;
+        this.add("data");
+        this.add(`data:${table}:${operation}`);
+    }
+}
+async function sourceFiles(root) {
+    const found = [];
+    const walk = async (directory) => {
+        const entries = await readdir(directory, { withFileTypes: true }).catch(() => []);
+        for (const entry of entries) {
+            const path = join(directory, entry.name);
+            if (entry.isDirectory()) {
+                if (!SKIPPED_DIRECTORIES.has(entry.name))
+                    await walk(path);
+                continue;
+            }
+            if (SOURCE_EXTENSIONS.has(extname(entry.name)))
+                found.push(path);
+        }
+    };
+    await walk(root);
+    return found.sort();
+}
+/**
+ * Every `<table> <verb>` the browser code performs. The verb chain is what
+ * follows THIS `.from(...)` up to the end of its statement or the next
+ * `.from(` — never a later chain's verbs.
+ */
+export async function sourceTableVerbs(root) {
+    const inventory = new Map();
+    for (const path of await sourceFiles(root)) {
+        const text = await readFile(path, "utf8");
+        for (const match of text.matchAll(TABLE_CHAIN)) {
+            const start = match.index ?? 0;
+            if (text.slice(0, start).trimEnd().endsWith(".storage"))
+                continue;
+            let tail = text.slice(start + match[0].length);
+            const semicolon = tail.indexOf(";");
+            if (/[;\n]/.test(tail) && semicolon >= 0)
+                tail = tail.slice(0, semicolon);
+            const next = tail.indexOf(".from(");
+            if (next > 0)
+                tail = tail.slice(0, next);
+            tail = tail.slice(0, 200);
+            const table = match[1];
+            const verbs = inventory.get(table) ?? new Set();
+            for (const verb of tail.matchAll(VERB_CALL))
+                verbs.add(verb[1]);
+            inventory.set(table, verbs);
+        }
+    }
+    return inventory;
+}
+/**
+ * The capabilities the kit lane declares for this app: a namespace called as
+ * `<client>.<namespace>.<method>(` on an identifier bound to `createClient()`.
+ * TypeScript type arguments may sit between the method and its call.
+ */
+export async function declaredCapabilities(root) {
+    const files = await sourceFiles(root);
+    const texts = await Promise.all(files.map(path => readFile(path, "utf8").catch(() => "")));
+    const clients = new Set();
+    for (const text of texts)
+        for (const match of text.matchAll(CLIENT_BINDING))
+            clients.add(match[1]);
+    const used = new Set();
+    if (!clients.size)
+        return used;
+    const namespaces = SDK_CAPABILITIES.join("|");
+    for (const client of clients) {
+        const call = new RegExp(`\\b${client}\\s*\\.\\s*(${namespaces})\\s*\\.\\s*[A-Za-z_$][A-Za-z0-9_$]*\\s*(?:<[^<>()]*>\\s*)?\\(`, "g");
+        for (const text of texts)
+            for (const match of text.matchAll(call))
+                used.add(match[1]);
+    }
+    return used;
+}
+/**
+ * What the pipeline would refuse, in its own words: an inventoried operation or
+ * a declared capability with no successful observation while the checks ran.
+ */
+export function missingFlowOperations(inventory, capabilities, ledger) {
+    const missing = [];
+    for (const [table, verbs] of inventory) {
+        for (const verb of verbs) {
+            if (!ledger.has(`data:${table}:${verb}`))
+                missing.push(`${table} ${verb.toUpperCase()}: no successful converted application operation observed`);
+        }
+    }
+    for (const capability of COVERED_CAPABILITIES) {
+        if (capabilities.has(capability) && !ledger.has(capability))
+            missing.push(`${capability}: retained checks did not exercise this declared component`);
+    }
+    return missing.sort();
+}
+const HOP_HEADERS = new Set(["connection", "keep-alive", "proxy-authorization", "te", "trailer", "transfer-encoding", "upgrade", "host", "content-length"]);
+/**
+ * A loopback reverse proxy in front of the running `harbour dev` origin that
+ * records what the retained checks exercise. The pipeline observes the same
+ * boundary from inside its own gateway; observing it here needs no second
+ * gateway and no change to the checks, which keep using HARBOUR_APP_URL.
+ */
+export function createCoverageProxy(origin, ledger) {
+    const target = new URL(origin);
+    const port = Number(target.port || 80);
+    const host = target.hostname;
+    const upstreamOrigin = target.origin;
+    const server = createServer((incoming, response) => {
+        const path = (incoming.url ?? "/").split("?")[0];
+        const chunks = [];
+        incoming.on("data", chunk => { if (chunks.length < 64)
+            chunks.push(chunk); });
+        const upstream = httpRequest({ host, port, method: incoming.method, path: incoming.url, headers: forwardable(incoming.headers, upstreamOrigin) }, upstreamResponse => {
+            const body = [];
+            upstreamResponse.on("data", chunk => { if (body.length < 64)
+                body.push(chunk); });
+            upstreamResponse.on("end", () => {
+                const status = upstreamResponse.statusCode ?? 0;
+                if (status >= 200 && status < 300)
+                    record(ledger, path, incoming.method ?? "GET", Buffer.concat(chunks).toString("utf8"), Buffer.concat(body).toString("utf8"));
+            });
+            response.writeHead(upstreamResponse.statusCode ?? 502, upstreamResponse.headers);
+            upstreamResponse.pipe(response);
+        });
+        upstream.on("error", () => { if (!response.headersSent)
+            response.writeHead(502); response.end(); });
+        incoming.pipe(upstream);
+    });
+    // Realtime is a WebSocket: the proxy tunnels it untouched and reads the
+    // server's frames as they pass. Only a delivered event counts — the gateway
+    // fires OnRealtimeDelivery for postgres_changes, broadcast and presence, and
+    // never for the `subscribed` acknowledgement, so a check that subscribes and
+    // receives nothing does not clear the capability here either.
+    server.on("upgrade", (incoming, socket, head) => {
+        const path = (incoming.url ?? "/").split("?")[0];
+        const upstream = connect(port, host, () => {
+            const headers = Object.entries({ ...forwardable(incoming.headers, upstreamOrigin), host: `${host}:${port}`, connection: "Upgrade", upgrade: "websocket" })
+                .map(([key, value]) => `${key}: ${value}`);
+            upstream.write(`${incoming.method} ${incoming.url} HTTP/1.1\r\n${headers.join("\r\n")}\r\n\r\n`);
+            if (head?.length)
+                upstream.write(head);
+            if (path === "/_harbour/realtime") {
+                const frames = websocketTextFrames();
+                upstream.on("data", (chunk) => { for (const message of frames(chunk))
+                    if (isRealtimeDelivery(message))
+                        ledger.add("realtime"); });
+            }
+            upstream.pipe(socket);
+            socket.pipe(upstream);
+        });
+        upstream.on("error", () => socket.destroy());
+        socket.on("error", () => upstream.destroy());
+    });
+    return {
+        listen: () => new Promise((resolve, reject) => {
+            server.on("error", reject);
+            server.listen(0, "127.0.0.1", () => resolve(`http://127.0.0.1:${server.address().port}`));
+        }),
+        close: () => new Promise(resolve => { server.closeAllConnections?.(); server.close(() => resolve()); })
+    };
+}
+/**
+  * `harbour dev` serves one origin and refuses anything that does not carry it,
+  * so the proxy presents the upstream's own Host and Origin. Forwarding its own
+  * address instead is what made the realtime upgrade fail before this: the
+  * forwarder dropped the socket and the channel never subscribed.
+  */
+function forwardable(headers, origin) {
+    const result = {};
+    for (const [key, value] of Object.entries(headers)) {
+        if (HOP_HEADERS.has(key.toLowerCase()) || value === undefined)
+            continue;
+        result[key] = key.toLowerCase() === "origin" ? origin : Array.isArray(value) ? value.join(", ") : value;
+    }
+    return result;
+}
+/** One successful gateway request, classified exactly as the pipeline's coverage handler does. */
+export function record(ledger, path, method, requestBody, responseBody) {
+    const data = /^\/_harbour\/data\/([A-Za-z0-9_]+)\/query$/.exec(path);
+    if (data) {
+        const operation = String(readJson(requestBody)?.operation ?? "");
+        if (!operation)
+            return;
+        const envelope = readJson(responseBody)?.data;
+        const rows = Array.isArray(envelope?.data) ? envelope.data.length : envelope?.count ?? 0;
+        if (operation === "rpc") {
+            ledger.add("data");
+            ledger.add(`rpc:${data[1]}`);
+            return;
+        }
+        ledger.observeData(data[1], operation, rows);
+        return;
+    }
+    if (path.startsWith("/_harbour/actions/")) {
+        ledger.add("actions");
+        ledger.add(`action:${path.slice("/_harbour/actions/".length)}`);
+        return;
+    }
+    if (path === "/_harbour/files/uploads/complete") {
+        ledger.add("files");
+        ledger.add("files:upload");
+        return;
+    }
+    if (path === "/_harbour/files" && method === "GET") {
+        ledger.add("files");
+        ledger.add("files:list");
+        return;
+    }
+    if (path === "/_harbour/files/remove") {
+        ledger.add("files");
+        ledger.add("files:remove");
+        return;
+    }
+    if (path === "/_harbour/telemetry")
+        ledger.add("telemetry");
+}
+/** The event types the gateway counts as a delivery (appgateway/realtime.go). */
+export function isRealtimeDelivery(message) {
+    const type = readJson(message)?.type;
+    return type === "postgres_changes" || type === "broadcast" || type === "presence";
+}
+/**
+ * Reads complete text frames out of a server-to-client WebSocket byte stream.
+ * Server frames are never masked, so the payload is the bytes themselves; the
+ * head of the stream is the HTTP 101 response, which carries no frame.
+ */
+export function websocketTextFrames() {
+    let buffer = Buffer.alloc(0);
+    let started = false;
+    return chunk => {
+        buffer = Buffer.concat([buffer, chunk]);
+        if (!started) {
+            const end = buffer.indexOf("\r\n\r\n");
+            if (end < 0)
+                return [];
+            buffer = buffer.subarray(end + 4);
+            started = true;
+        }
+        const messages = [];
+        for (;;) {
+            if (buffer.length < 2)
+                break;
+            const opcode = buffer[0] & 0x0f;
+            const masked = (buffer[1] & 0x80) !== 0;
+            let length = buffer[1] & 0x7f;
+            let offset = 2;
+            if (length === 126) {
+                if (buffer.length < 4)
+                    break;
+                length = buffer.readUInt16BE(2);
+                offset = 4;
+            }
+            else if (length === 127) {
+                if (buffer.length < 10)
+                    break;
+                length = Number(buffer.readBigUInt64BE(2));
+                offset = 10;
+            }
+            if (masked)
+                offset += 4;
+            if (buffer.length < offset + length)
+                break;
+            if (opcode === 1 && !masked)
+                messages.push(buffer.subarray(offset, offset + length).toString("utf8"));
+            buffer = buffer.subarray(offset + length);
+        }
+        return messages;
+    };
+}
+function readJson(body) {
+    try {
+        const value = JSON.parse(body);
+        return value && typeof value === "object" ? value : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}

package/dist/packages/harbour-cli/src/local-runtime.js

@@ -250,6 +250,8 @@ export class LocalRuntime {
         if (result.code !== 0)
             throw new CliError("LOCAL_RUNTIME_FAILED", "Docker could not start the local Harbour services. Is Docker running and are the kit images available (see .harbour/kit.lock.json)?");
     }
+    /** Restarts one service; the outbox relay needs it once its JetStream stream exists. */
+    async restartService(service) { await this.compose(["restart", service], { quiet: true }); }
     /** Stops containers and keeps volumes; safe to repeat. */
     async stop() {
         const result = await this.compose(["stop"], { quiet: true });

package/dist/packages/harbour-cli/src/realtime-stream.js

@@ -0,0 +1,79 @@
+import { connect } from "node:net";
+import { randomUUID } from "node:crypto";
+import { LOCAL } from "./local-runtime.js";
+/**
+ * The JetStream stream the local realtime path needs.
+ *
+ * The App Gateway's outbox relay publishes committed row changes with a
+ * JetStream publish (appgateway/outbox.go); a JetStream publish to a subject no
+ * stream captures is refused with "no response from stream", so without this
+ * the relay retries forever and `harbour.realtime` never delivers anything
+ * locally — while the deployment pipeline, which creates the same stream for
+ * its probe (toolkit/transformbuild/local_component_runtime.go), delivers
+ * normally. A realtime app therefore could not be exercised locally at all.
+ *
+ * Creating it needs three NATS protocol lines, so the CLI speaks them itself
+ * rather than taking a client dependency.
+ */
+export const REALTIME_STREAM = "HARBOUR_LOCAL";
+export const REALTIME_SUBJECTS = `harbour.app.${LOCAL.tenant}.${LOCAL.app}.>`;
+/** JetStream's "stream name already in use": the stream from an earlier `harbour dev`. */
+const ALREADY_EXISTS = 10058;
+export async function ensureRealtimeStream(port, host = "127.0.0.1", timeoutMs = 10_000) {
+    const inbox = `_INBOX.${randomUUID()}`;
+    const request = JSON.stringify({ name: REALTIME_STREAM, subjects: [REALTIME_SUBJECTS], storage: "memory", retention: "limits", num_replicas: 1, discard: "old" });
+    const reply = await natsRequest(host, port, `$JS.API.STREAM.CREATE.${REALTIME_STREAM}`, inbox, request, timeoutMs);
+    const answer = JSON.parse(reply);
+    if (!answer.error)
+        return "created";
+    if (answer.error.err_code === ALREADY_EXISTS)
+        return "present";
+    throw new Error(`the local realtime stream could not be created: ${answer.error.description ?? reply}`);
+}
+/** CONNECT, SUB the inbox, PUB the request, and return the first reply. */
+function natsRequest(host, port, subject, inbox, payload, timeoutMs) {
+    return new Promise((resolve, reject) => {
+        const socket = connect(port, host);
+        const finish = (error, value) => { clearTimeout(timer); socket.destroy(); error ? reject(error) : resolve(value); };
+        const timer = setTimeout(() => finish(new Error("the local NATS server did not answer the JetStream request")), timeoutMs);
+        timer.unref?.();
+        let buffer = "";
+        let greeted = false;
+        socket.on("error", error => finish(error));
+        socket.setEncoding("utf8");
+        socket.on("data", chunk => {
+            buffer += chunk;
+            if (!greeted && buffer.includes("\r\n")) {
+                greeted = true;
+                socket.write(`CONNECT {"verbose":false,"pedantic":false,"tls_required":false,"name":"harbour-cli","lang":"node","version":"1"}\r\n`);
+                socket.write(`SUB ${inbox} 1\r\n`);
+                socket.write(`PUB ${subject} ${inbox} ${Buffer.byteLength(payload)}\r\n${payload}\r\n`);
+                buffer = buffer.slice(buffer.indexOf("\r\n") + 2);
+            }
+            if (buffer.startsWith("PING\r\n")) {
+                socket.write("PONG\r\n");
+                buffer = buffer.slice(6);
+            }
+            const message = readMessage(buffer);
+            if (message)
+                finish(undefined, message);
+        });
+    });
+}
+/** One `MSG <subject> <sid> <bytes>\r\n<payload>\r\n`, once its payload has arrived. */
+export function readMessage(buffer) {
+    const start = buffer.indexOf("MSG ");
+    if (start < 0)
+        return undefined;
+    const headerEnd = buffer.indexOf("\r\n", start);
+    if (headerEnd < 0)
+        return undefined;
+    const parts = buffer.slice(start + 4, headerEnd).trim().split(/\s+/);
+    const bytes = Number(parts.at(-1));
+    if (!Number.isFinite(bytes))
+        return undefined;
+    const payloadEnd = headerEnd + 2 + bytes;
+    if (buffer.length < payloadEnd)
+        return undefined;
+    return buffer.slice(headerEnd + 2, payloadEnd);
+}

package/dist/packages/harbour-cli/src/starter.js

@@ -360,7 +360,7 @@ CREATE POLICY notes_owner ON notes
 GRANT SELECT, INSERT, UPDATE, DELETE ON notes TO harbour_app_gateway;
 GRANT USAGE, SELECT ON SEQUENCE notes_id_seq TO harbour_app_gateway;
 `;
-const JOURNEY_CHECK = `// Journey check: the signed-in identity can create, read and delete a note through
+const JOURNEY_CHECK = `// Journey check: the signed-in identity can create, read, tick and delete a note through
 // the running app (HARBOUR_APP_URL). Runs under \`harbour check\` while \`harbour dev\`
 // is up, and in the deployment pipeline's retained-check container.
 import assert from "node:assert/strict";
@@ -378,6 +378,12 @@ const title = \`journey \${Date.now()}\`;
 await harbour.data.from("notes").insert({ title });
 const { data: notes } = await harbour.data.from("notes").select("*").eq("title", title);
 assert.equal(notes.length, 1, "the inserted note is readable by its owner");
+// The tick box in src/App.tsx is an UPDATE. The deployment pipeline refuses an
+// app whose checks never exercise an operation its own code performs, so the
+// journey toggles the note and reads the new value back.
+await harbour.data.from("notes").update({ done: true }).eq("id", notes[0].id);
+const { data: toggled } = await harbour.data.from("notes").select("*").eq("id", notes[0].id);
+assert.equal(toggled[0].done, true, "the note is marked done for its owner");
 await harbour.data.from("notes").delete().eq("id", notes[0].id);
 const { data: remaining } = await harbour.data.from("notes").select("id").eq("title", title);
 assert.equal(remaining.length, 0, "the note is deleted");

package/dist/packages/harbour-cli/src/version.js

@@ -1 +1 @@
-export const CLI_VERSION = "0.1.18";
+export const CLI_VERSION = "0.1.19";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fourier-labs/harbour",
-  "version": "0.1.18",
+  "version": "0.1.19",
   "description": "Harbour productionisation helper",
   "type": "module",
   "bin": { "harbour": "./dist/packages/harbour-cli/src/cli.js" },