@fourier-labs/harbour 0.1.20 → 0.1.21

package/dist/packages/harbour-cli/src/check.js

@@ -4,7 +4,7 @@ import { loadDatabaseGate } from "./database-gate.js";
 import { CoverageLedger, createCoverageProxy, declaredCapabilities, missingFlowOperations, sourceTableVerbs } from "./flow-coverage.js";
 import { CliError } from "./output.js";
 import { DEPENDENT_READ_OPERATIONS, READ_OPERATIONS, kitPaths, readDeclaration, readKitLock, resourceNames, sourceDigest } from "./kit.js";
-import { LOCAL, LocalRuntime, runCommand, runningOrigin } from "./local-runtime.js";
+import { LOCAL, LocalRuntime, identityEnvironment, runCommand, runningOrigin } from "./local-runtime.js";
 import { CLI_VERSION } from "./version.js";
 /** Runs the kit checks and writes `.harbour/local/check-report.json`; a source edit changes sourceDigest and so invalidates the previous report. */
 export async function runChecks(root, options) {
@@ -38,7 +38,7 @@ export async function runChecks(root, options) {
         else {
             const gate = await loadDatabaseGate(bundle, run);
             const violations = await throwaway.databaseGate(gate.sql);
-            record("database_gate", violations.length ? "fail" : "pass", violations.length ? violations.join("\n") : `row-level security, policy verbs and grants verified for ${LOCAL.gatewayRole} (gate from ${gate.source === "fixture" ? "the pinned session fixture" : "this CLI release"})`);
+            record("database_gate", violations.length ? "fail" : "pass", violations.length ? violations.join("\n") : `row-level security, policy verbs and grants verified for ${LOCAL.gatewayRole} (gate from ${gateSourceLabel(gate.source)})`);
         }
     }
     catch (error) {
@@ -61,13 +61,18 @@ export async function runChecks(root, options) {
     else {
         // The journeys run through a recording proxy so this reports what the
         // pipeline reports: which converted operations and declared capabilities
-        // the checks actually exercised at the gateway.
+        // the checks actually exercised at the gateway. They get the pipeline's
+        // three identity names from the running session (both signed users), so
+        // the SDK attaches the first identity itself and a cross-user check can
+        // act as the second — the same environment the retained-check runner
+        // gives them in CodeBuild.
+        const session = await new LocalRuntime(root, run).sessionEnv(1).catch(() => ({}));
         const ledger = new CoverageLedger();
         const proxy = createCoverageProxy(origin, ledger);
         const appUrl = await proxy.listen();
         try {
             for (const name of journeys) {
-                const result = await run("node", [join(kitPaths(root).checks, name)], { cwd: root, quiet: true, env: { HARBOUR_APP_URL: appUrl, HARBOUR_SDK_MODULE: join(root, "node_modules", "@harbour", "app-sdk", "dist", "index.js") } });
+                const result = await run("node", [join(kitPaths(root).checks, name)], { cwd: root, quiet: true, env: { HARBOUR_APP_URL: appUrl, HARBOUR_SDK_MODULE: join(root, "node_modules", "@harbour", "app-sdk", "dist", "index.js"), ...identityEnvironment(session) } });
                 record(`journey:${name}`, result.code === 0 ? "pass" : "fail", result.code === 0 ? undefined : lastLines(result.stderr || result.stdout));
             }
         }
@@ -170,13 +175,16 @@ export async function preflightDatabaseGate(root, bundle, output, run = runComma
         const violations = await throwaway.databaseGate(gate.sql);
         if (violations.length)
             throw new CliError("DATABASE_GATE_FAILED", `The migrations fail the pipeline's database gate (${violations.length} violation(s)):\n${violations.map(line => `  - ${line}`).join("\n")}\nFix migrations/ and run \`harbour check\`; the pipeline would refuse this deployment as kit.check-failed: aurora.database-gate.`);
-        output(`Migrations replayed and the database gate passed locally (${migrations.length} file(s), gate from ${gate.source === "fixture" ? "the pinned session fixture" : "this CLI release"}).`);
+        output(`Migrations replayed and the database gate passed locally (${migrations.length} file(s), gate from ${gateSourceLabel(gate.source)}).`);
         return "passed";
     }
     finally {
         await throwaway.down();
     }
 }
+function gateSourceLabel(source) {
+    return source === "gateway" ? "the pinned app gateway image" : source === "fixture" ? "the pinned session fixture" : "this CLI release";
+}
 export async function readReport(root) {
     try {
         return JSON.parse(await readFile(kitPaths(root).report, "utf8"));

package/dist/packages/harbour-cli/src/cli.js

@@ -6,7 +6,7 @@ import { safeError, CliError, renderSummary } from "./output.js";
 import { CLI_VERSION } from "./version.js";
 import { connectedAccount, login, logout, refreshStoredToken } from "./auth.js";
 import { connect, loadConfig, resolveConfig } from "./config.js";
-import { loadKitBundle } from "./kit-bundle.js";
+import { EMBEDDED_KIT_BUNDLE } from "./kit-bundle.js";
 import { appRoot } from "./kit.js";
 import { initKit } from "./starter.js";
 import { agentPaths, agentSetup } from "./agent-setup.js";
@@ -118,7 +118,7 @@ else {
         }
         else if (LOCAL_COMMANDS.includes(command)) {
             // Local commands run before the company config/login requirement: the base app needs neither.
-            const bundle = await loadKitBundle();
+            const bundle = EMBEDDED_KIT_BUNDLE;
             const target = appRoot(root);
             const config = resolveConfig(process.env, await loadConfig());
             const companyToken = async () => config ? (explicitToken || await refreshStoredToken(config.mcpUrl, config.tenantId)) : undefined;
@@ -208,14 +208,14 @@ else {
                     const governance = new GovernanceClient(config.apiUrl, token, tenant);
                     const result = subcommand === "status"
                         ? await integrationsStatus(target, governance)
-                        : await requestIntegrations(target, governance, tenant, await loadKitBundle(), { connection: args[2], reason: reason, environment, operations: operations?.split(",").map(value => value.trim()).filter(Boolean), expiresAt });
+                        : await requestIntegrations(target, governance, tenant, EMBEDDED_KIT_BUNDLE, { connection: args[2], reason: reason, environment, operations: operations?.split(",").map(value => value.trim()).filter(Boolean), expiresAt });
                     envelope = summaryEnvelope(result);
                     if (!json)
                         progress(subcommand === "status" ? renderIntegrationsStatus(result) : renderRequest(result));
                 }
                 else if (command === "productionise") {
                     // Kit apps: preview grants are checked (and the app linked) before any operation starts, so productionise never mints a second app for the same root.
-                    const result = await productionise(root, client, progress, tenant, includePaths, { waitForDeployment: !noWait, integrations: { governance: new GovernanceClient(config.apiUrl, token, tenant), bundle: await loadKitBundle() } });
+                    const result = await productionise(root, client, progress, tenant, includePaths, { waitForDeployment: !noWait, integrations: { governance: new GovernanceClient(config.apiUrl, token, tenant), bundle: EMBEDDED_KIT_BUNDLE } });
                     envelope = { schema: "harbour.cli-result/1.0", cliVersion: CLI_VERSION, status: "SUCCEEDED", operationStarted: true, operationRef: result.operationRef, result: result.result };
                 }
                 else {

package/dist/packages/harbour-cli/src/database-gate.js

@@ -1,39 +1,47 @@
 import { mkdtemp, readFile, rm } from "node:fs/promises";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
-/** Where the session fixture image carries the gate (data plane build/session-fixture-image/Dockerfile). */
+/** Where the app gateway and session fixture images carry the gate (data plane build/*-image/Dockerfile). */
 export const DATABASE_GATE_IMAGE_PATH = "/harbour/kit/database-gate.sql";
 /**
  * The kit database gate: the pipeline's own assertions over a replayed
  * migration set, run by the in-loop probe (harbour-deployment-data-plane
  * packages/toolkit/transformbuild/kit_database_gate.sql, embedded by
  * containerprobe.go) right after the migrations replay. `harbour check`
- * runs the copy the pinned session fixture image ships at
- * DATABASE_GATE_IMAGE_PATH; this is the verbatim copy from data plane
- * 0.73.1.0 for a fixture that predates the file. It raises one exception
- * naming every violation (table / policy / grant) on its own line with the fix.
+ * runs the copy the pinned kit images ship at DATABASE_GATE_IMAGE_PATH; this
+ * is the verbatim copy from data plane 0.73.1.0 for images that predate the
+ * file. It raises one exception naming every violation (table / policy /
+ * grant) on its own line with the fix.
  */
 export const DATABASE_GATE_SQL = "-- Harbour kit database gate.\n--\n-- Runs after a kit app's migrations replayed on a scratch PostgreSQL that\n-- carries the platform role harbour_app_gateway (NOLOGIN, NOBYPASSRLS): the\n-- role the App Gateway executes every application statement as. It asserts,\n-- against the catalog rather than the migration text, the contract that role\n-- lives under:\n--\n--   1. every application table has row-level security enabled;\n--   2. an RLS-enabled table has at least one policy that applies to the\n--      gateway role (RLS with no policy is default-deny: the app sees no rows);\n--   3. every verb a policy allows is GRANTed to harbour_app_gateway — a policy\n--      without its grant is a feature that fails with permission-denied only\n--      for real users (`poll_votes`, 2026-09-10);\n--   4. tables, views and sequences are granted only to their owner and to\n--      harbour_app_gateway; the platform creates no other role, so any other\n--      grantee (PUBLIC included) is a silent production no-op at best.\n--\n-- The platform's own schema harbour_runtime (the realtime outbox) is not the\n-- app's and is skipped. One script, executed by the pipeline's in-loop probe\n-- (packages/toolkit/transformbuild/containerprobe.go) and, byte for byte, by\n-- `harbour check` from /harbour/kit/database-gate.sql in the session fixture\n-- image. It raises one exception naming every violation on its own line, with\n-- the fix; a clean database returns silently.\n\\set ON_ERROR_STOP 1\n\\set VERBOSITY terse\nDO $harbour_gate$\nDECLARE\n  gateway CONSTANT text := 'harbour_app_gateway';\n  violations text[] := ARRAY[]::text[];\n  rec record;\n  verb text;\nBEGIN\n  IF NOT EXISTS (SELECT 1 FROM pg_roles WHERE rolname = gateway) THEN\n    RAISE EXCEPTION 'harbour database gate: the platform role % does not exist on this database; the probe bootstrap must create it before the migrations replay', gateway;\n  END IF;\n\n  -- 1. Row-level security on every application table.\n  FOR rec IN\n    SELECT n.nspname AS schema_name, c.relname AS table_name, c.relrowsecurity AS rls\n    FROM pg_class c\n    JOIN pg_namespace n ON n.oid = c.relnamespace\n    WHERE c.relkind IN ('r', 'p')\n      AND n.nspname NOT IN ('pg_catalog', 'information_schema', 'harbour_runtime')\n      AND n.nspname NOT LIKE 'pg\\_toast%' AND n.nspname NOT LIKE 'pg\\_temp%'\n    ORDER BY 1, 2\n  LOOP\n    IF NOT rec.rls THEN\n      violations := violations || format(\n        'table %I.%I: row-level security is not enabled, so every signed-in person would see every row — fix: ALTER TABLE %I.%I ENABLE ROW LEVEL SECURITY; then CREATE POLICY ... ON %I.%I USING (...) WITH CHECK (...)',\n        rec.schema_name, rec.table_name, rec.schema_name, rec.table_name, rec.schema_name, rec.table_name);\n    -- 2. A policy the gateway role is subject to.\n    ELSIF NOT EXISTS (\n      SELECT 1 FROM pg_policy p\n      JOIN pg_class c ON c.oid = p.polrelid\n      JOIN pg_namespace n ON n.oid = c.relnamespace\n      WHERE n.nspname = rec.schema_name AND c.relname = rec.table_name\n        AND (p.polroles = '{0}'::oid[] OR (SELECT oid FROM pg_roles WHERE rolname = gateway) = ANY (p.polroles))\n    ) THEN\n      violations := violations || format(\n        'table %I.%I: row-level security is enabled but no policy applies to %s, so the app sees no rows and every write is refused — fix: CREATE POLICY %I ON %I.%I USING (owner_subject = current_setting(''harbour.user_id'', true)) WITH CHECK (owner_subject = current_setting(''harbour.user_id'', true))',\n        rec.schema_name, rec.table_name, gateway, rec.table_name || '_owner', rec.schema_name, rec.table_name);\n    END IF;\n  END LOOP;\n\n  -- 3. Every verb a policy allows is granted to the gateway role.\n  FOR rec IN\n    SELECT n.nspname AS schema_name, c.relname AS table_name, c.oid AS table_oid, p.polname AS policy_name,\n           CASE p.polcmd WHEN 'r' THEN ARRAY['SELECT'] WHEN 'a' THEN ARRAY['INSERT'] WHEN 'w' THEN ARRAY['UPDATE'] WHEN 'd' THEN ARRAY['DELETE']\n                         ELSE ARRAY['SELECT', 'INSERT', 'UPDATE', 'DELETE'] END AS verbs,\n           p.polroles = '{0}'::oid[] OR (SELECT oid FROM pg_roles WHERE rolname = gateway) = ANY (p.polroles) AS applies,\n           (SELECT string_agg(r.rolname, ', ' ORDER BY r.rolname) FROM pg_roles r WHERE r.oid = ANY (p.polroles)) AS role_names\n    FROM pg_policy p\n    JOIN pg_class c ON c.oid = p.polrelid\n    JOIN pg_namespace n ON n.oid = c.relnamespace\n    WHERE n.nspname NOT IN ('pg_catalog', 'information_schema', 'harbour_runtime')\n    ORDER BY 1, 2, 4\n  LOOP\n    IF NOT rec.applies THEN\n      violations := violations || format(\n        'policy %I on %I.%I: applies to role(s) %s, not to %s, so the App Gateway never satisfies it — fix: recreate the policy without a TO clause (or add TO %s)',\n        rec.policy_name, rec.schema_name, rec.table_name, coalesce(rec.role_names, '(none)'), gateway, gateway);\n      CONTINUE;\n    END IF;\n    FOREACH verb IN ARRAY rec.verbs LOOP\n      IF NOT has_table_privilege(gateway, rec.table_oid, verb) THEN\n        violations := violations || format(\n          'policy %I on %I.%I: allows %s but %s is never GRANTed %s on it, so the feature fails with permission-denied for real users — fix: GRANT %s ON %I.%I TO %s',\n          rec.policy_name, rec.schema_name, rec.table_name, verb, gateway, verb, verb, rec.schema_name, rec.table_name, gateway);\n      END IF;\n    END LOOP;\n  END LOOP;\n\n  -- 4. Grants go only to the owner and the gateway role.\n  FOR rec IN\n    SELECT n.nspname AS schema_name, c.relname AS object_name,\n           CASE c.relkind WHEN 'S' THEN 'SEQUENCE' WHEN 'v' THEN 'VIEW' WHEN 'm' THEN 'VIEW' ELSE 'TABLE' END AS object_kind,\n           coalesce(g.rolname, 'PUBLIC') AS grantee,\n           string_agg(a.privilege_type, ', ' ORDER BY a.privilege_type) AS privileges\n    FROM pg_class c\n    JOIN pg_namespace n ON n.oid = c.relnamespace\n    CROSS JOIN LATERAL aclexplode(c.relacl) a\n    LEFT JOIN pg_roles g ON g.oid = a.grantee\n    WHERE c.relkind IN ('r', 'p', 'v', 'm', 'S')\n      AND n.nspname NOT IN ('pg_catalog', 'information_schema', 'harbour_runtime')\n      AND n.nspname NOT LIKE 'pg\\_toast%' AND n.nspname NOT LIKE 'pg\\_temp%'\n      AND a.grantee <> c.relowner\n      AND coalesce(g.rolname, '') <> gateway\n    GROUP BY 1, 2, 3, 4\n    ORDER BY 1, 2, 4\n  LOOP\n    violations := violations || format(\n      'grant %s on %s %I.%I to %s: only the platform role %s may be granted, the platform never creates %s — fix: REVOKE %s ON %s %I.%I FROM %s',\n      rec.privileges, lower(rec.object_kind), rec.schema_name, rec.object_name, rec.grantee, gateway, rec.grantee,\n      rec.privileges, rec.object_kind, rec.schema_name, rec.object_name, rec.grantee);\n  END LOOP;\n\n  IF coalesce(array_length(violations, 1), 0) > 0 THEN\n    RAISE EXCEPTION 'harbour database gate: % violation(s)%', array_length(violations, 1), E'\\n' || array_to_string(violations, E'\\n');\n  END IF;\nEND\n$harbour_gate$;\n";
 /**
- * The gate script from the pinned session fixture image when the image is
- * present locally and carries it (`docker create --pull never` + `docker cp`;
- * the image is distroless, so there is no shell to cat it), else the vendored
+ * The gate script from a pinned kit image present locally that carries it
+ * (`docker create --pull never` + `docker cp`; the images are distroless, so
+ * there is no shell to cat it): the app gateway image first — the one
+ * `harbour dev` pulls — then the session fixture image, else the vendored
  * copy. Never pulls: `harbour check` must stay a local, seconds-long step.
  */
 export async function loadDatabaseGate(bundle, run) {
-    const vendored = { sql: DATABASE_GATE_SQL, source: "vendored" };
-    const created = await run("docker", ["create", "--pull", "never", bundle.images.sessionFixture], { quiet: true });
+    for (const [source, image] of [["gateway", bundle.images.appGateway], ["fixture", bundle.images.sessionFixture]]) {
+        const sql = await copyGateFromImage(image, run);
+        if (sql)
+            return { sql, source };
+    }
+    return { sql: DATABASE_GATE_SQL, source: "vendored" };
+}
+async function copyGateFromImage(image, run) {
+    const created = await run("docker", ["create", "--pull", "never", image], { quiet: true });
     const id = created.code === 0 ? created.stdout.trim().split("\n").at(-1)?.trim() ?? "" : "";
     if (!id)
-        return vendored;
+        return undefined;
     const dir = await mkdtemp(join(tmpdir(), "harbour-database-gate-"));
     try {
         const target = join(dir, "database-gate.sql");
         const copied = await run("docker", ["cp", `${id}:${DATABASE_GATE_IMAGE_PATH}`, target], { quiet: true });
         if (copied.code !== 0)
-            return vendored;
+            return undefined;
         const sql = await readFile(target, "utf8").catch(() => undefined);
-        return sql && sql.includes("harbour database gate") ? { sql, source: "fixture" } : vendored;
+        return sql && sql.includes("harbour database gate") ? sql : undefined;
     }
     finally {
         await rm(dir, { recursive: true, force: true });

package/dist/packages/harbour-cli/src/dev.js

@@ -3,7 +3,6 @@ import { createForwarder } from "./forwarder.js";
 import { readKitLock } from "./kit.js";
 import { acquireDevLock, allocatePorts, ensureSdk, LocalRuntime, releaseDevLock, runCommand } from "./local-runtime.js";
 import { CliError } from "./output.js";
-import { ensureRealtimeStream } from "./realtime-stream.js";
 /**
  * Starts the project's Compose services, applies migrations, starts Vite and the
  * loopback origin. Resolves when the runtime is up; the returned `stop` runs
@@ -32,23 +31,19 @@ export async function startDev(root, options) {
         await runtime.writeFiles(options.bundle, ports);
         options.output("Pulling the kit images by digest (public registry, no login).");
         await runtime.pull(options.bundle);
-        options.output("Starting local Harbour services (postgres, storage, realtime, identity fixture, app gateway).");
+        options.output("Starting local Harbour services (postgres, storage, one Harbour gateway with the session identities, fixtures and realtime relay).");
         await runtime.up();
-        // The fixture writes the session env and the app's realtime outbox
-        // migration together, so waiting for the session also waits for the SQL.
+        // The gateway writes the session env and the app's realtime outbox
+        // migration together once it is serving, so waiting for the session also
+        // waits for the SQL and for the gateway.
         const session = await runtime.sessionEnv();
         const applied = await runtime.migrate();
         options.output(`Applied ${applied.length} migration file(s).`);
         const watched = await runtime.installRealtimeOutbox();
-        if (watched > 0) {
-            // The outbox relay publishes with JetStream, which refuses a subject no
-            // stream captures; without the stream harbour.realtime delivers nothing.
-            // The relay has already given up by now, so it is restarted against the
-            // stream this just created.
-            await ensureRealtimeStream(ports.nats);
-            await runtime.restartService("outbox");
+        // The gateway's in-process relay starts publishing as soon as the outbox
+        // table exists; nothing to create or restart.
+        if (watched > 0)
             options.output(`Installed the Harbour realtime outbox for ${watched} table(s) (harbour.realtime change events).`);
-        }
         const origin = `http://127.0.0.1:${ports.origin}`;
         vite = spawn("npm", ["run", "dev"], { cwd: root, env: { ...env, HARBOUR_LOCAL_ORIGIN: origin, HARBOUR_VITE_PORT: String(ports.vite) }, stdio: ["ignore", "inherit", "inherit"] });
         vite.on("error", () => options.output("Vite could not be started; is npm installed and `npm install` done?"));
@@ -56,7 +51,7 @@ export async function startDev(root, options) {
         let warnedAuth = false;
         let lockAppId = (await readKitLock(root))?.appId || undefined;
         forwarder = createForwarder({
-            port: ports.origin, vitePort: ports.vite, gatewayPort: ports.gateway, identityToken: session.HARBOUR_IDENTITY_CONTEXT_TOKEN,
+            port: ports.origin, vitePort: ports.vite, gatewayPort: ports.gateway, identityToken: session.HARBOUR_IDENTITY_CONTEXT,
             apiUrl: company?.apiUrl ?? "", tenantId: company?.tenantId ?? "",
             appId: () => lockAppId,
             accessToken: async () => company ? company.accessToken() : undefined,
@@ -72,7 +67,7 @@ export async function startDev(root, options) {
         options.output([
             "",
             `Harbour dev is running: ${origin}`,
-            `  App identity (local fixture): ${session.HARBOUR_LOCAL_USER_EMAIL ?? "local-user@example.test"}`,
+            `  App identity (local session): ${session.HARBOUR_LOCAL_USER_EMAIL ?? "local-user@example.test"}; second user for cross-user checks: ${session.HARBOUR_LOCAL_SECOND_USER_EMAIL ?? "teammate@example.test"}`,
             `  Company account for integrations: ${account ?? (company ? "not signed in — run `harbour login`" : "not connected — run `harbour connect`")}`,
             lockAppId ? `  Linked app: ${lockAppId}` : "  App not linked yet (harbour integrations request links it).",
             "  Ctrl-C or `harbour stop` stops the services and keeps local data; `harbour dev --reset` deletes it.",

package/dist/packages/harbour-cli/src/forwarder.js

@@ -2,6 +2,11 @@ import { createServer, request as httpRequest } from "node:http";
 import { connect } from "node:net";
 const INTEGRATION_ROUTES = { "/_harbour/integrations/execute": ["POST"], "/_harbour/integrations/connect": ["POST", "DELETE"] };
 const HOP_HEADERS = new Set(["connection", "keep-alive", "proxy-authorization", "te", "trailer", "transfer-encoding", "upgrade", "host", "content-length"]);
+const IDENTITY_HEADER = "x-harbour-identity-context";
+/** The session identity for a gateway leg, unless the request already names one. */
+function identityHeaders(request, token) {
+    return request.headers[IDENTITY_HEADER] ? {} : { [IDENTITY_HEADER]: token };
+}
 export function createForwarder(options) {
     const origin = `http://127.0.0.1:${options.port}`;
     const host = `127.0.0.1:${options.port}`;
@@ -12,7 +17,7 @@ export function createForwarder(options) {
             return;
         }
         if (path.startsWith("/_harbour/")) {
-            pipe(request, response, options.gatewayPort, { "x-harbour-identity-context": options.identityToken });
+            pipe(request, response, options.gatewayPort, identityHeaders(request, options.identityToken));
             return;
         }
         pipe(request, response, options.vitePort);
@@ -22,7 +27,7 @@ export function createForwarder(options) {
             socket.destroy();
             return;
         }
-        tunnel(request, socket, head, (request.url ?? "/").startsWith("/_harbour/") ? options.gatewayPort : options.vitePort, (request.url ?? "/").startsWith("/_harbour/") ? { "x-harbour-identity-context": options.identityToken } : {});
+        tunnel(request, socket, head, (request.url ?? "/").startsWith("/_harbour/") ? options.gatewayPort : options.vitePort, (request.url ?? "/").startsWith("/_harbour/") ? identityHeaders(request, options.identityToken) : {});
     });
     return server;
 }

package/dist/packages/harbour-cli/src/kit-bundle.js

@@ -1,48 +1,20 @@
-import { readFile } from "node:fs/promises";
+import { PUBLISHED_KIT_BUNDLE } from "./kit-bundle.manifest.js";
+/** The local stack's supporting services. Not part of the published bundle: they run only under `harbour dev`. */
+const LOCAL_SERVICE_IMAGES = {
+    postgres: "postgres:16-alpine",
+    minio: "minio/minio:RELEASE.2025-07-23T15-54-02Z"
+};
 /**
- * The bundle this CLI was released with: `manifest.json` from the
- * harbour-deployment-data-plane `publish-kit-bundle` run for this kit version,
- * copied verbatim (the images and the tarball live in the kit's public
- * registry, `public.ecr.aws/<alias>/`, pinned by digest so no login and no
- * tag can substitute other bytes). `harbour init` records it in the app's
- * kit.lock; `harbour init --upgrade` shows the digest diff against it; the
- * hosted pipeline compares `sdk.tarballSha256` with the SDK it bakes.
+ * The bundle this CLI was built with: `manifest.json` of the
+ * harbour-deployment-data-plane `publish-kit-bundle` artifact for the kit
+ * version pinned in package.json `harbour.kitBundle`, fetched at build time
+ * into `kit-bundle.manifest.ts` (the images and the tarball live in the kit's
+ * public registry, `public.ecr.aws/<alias>/`, pinned by digest so no login
+ * and no tag can substitute other bytes). `harbour init` records it in the
+ * app's kit.lock; `harbour init --upgrade` shows the digest diff against it;
+ * the hosted pipeline compares `sdk.tarballSha256` with the SDK it bakes.
  */
-export const EMBEDDED_KIT_BUNDLE = {
-    schema: "harbour.kit-bundle/1.0",
-    kitVersion: "0.1.16",
-    sdk: {
-        package: "@harbour/app-sdk",
-        version: "1.0.0",
-        tarballSha256: "62954161ec29148c20223316d83367b781dd9291665ea16f74a003b16e304a3b",
-        url: "https://public.ecr.aws/v2/y6t4p3i8/harbour-kit-bundle/blobs/sha256:62954161ec29148c20223316d83367b781dd9291665ea16f74a003b16e304a3b"
-    },
-    images: {
-        appGateway: "public.ecr.aws/y6t4p3i8/harbour-app-gateway@sha256:4c8d359ee18f1fa6f96dde80379fa30a3c5a7675b6e9c2150e56d5ec41ba3e7c",
-        sessionFixture: "public.ecr.aws/y6t4p3i8/harbour-session-fixture@sha256:32cbb4f1820fd84b9e790b8559db5aae632b3deb77a7de87b916f75a4ca37ddc",
-        postgres: "postgres:16-alpine",
-        minio: "minio/minio:RELEASE.2025-07-23T15-54-02Z",
-        nats: "nats:2.11.17-alpine"
-    },
-    brief: { fingerprint: "ebc897c539526c5537017b49b99dc970053ba9999e346029883e96d61b98ef13" },
-    declarationSchema: "harbour.app-integrations/2.0"
-};
-/** The manifest the CLI ships with, or the one named by HARBOUR_KIT_BUNDLE for local testing against unreleased images. */
-export async function loadKitBundle(env = process.env) {
-    const override = env.HARBOUR_KIT_BUNDLE?.trim();
-    if (!override)
-        return EMBEDDED_KIT_BUNDLE;
-    let parsed;
-    try {
-        parsed = JSON.parse(await readFile(override, "utf8"));
-    }
-    catch {
-        throw new Error(`HARBOUR_KIT_BUNDLE does not point at a readable manifest: ${override}`);
-    }
-    if (!isKitBundle(parsed))
-        throw new Error("HARBOUR_KIT_BUNDLE is not a harbour.kit-bundle/1.0 manifest.");
-    return { ...EMBEDDED_KIT_BUNDLE, ...parsed, images: { ...EMBEDDED_KIT_BUNDLE.images, ...parsed.images } };
-}
+export const EMBEDDED_KIT_BUNDLE = { ...PUBLISHED_KIT_BUNDLE, images: { ...LOCAL_SERVICE_IMAGES, ...PUBLISHED_KIT_BUNDLE.images } };
 export function isKitBundle(value) {
     const record = value;
     return Boolean(record && typeof record === "object" && record.schema === "harbour.kit-bundle/1.0" && typeof record.kitVersion === "string"

package/dist/packages/harbour-cli/src/kit-bundle.manifest.js

@@ -0,0 +1,18 @@
+export const PUBLISHED_KIT_BUNDLE = {
+    "schema": "harbour.kit-bundle/1.0",
+    "kitVersion": "0.1.21",
+    "sdk": {
+        "package": "@harbour/app-sdk",
+        "version": "1.0.0",
+        "tarballSha256": "561297368f61eb3a81ca64d8d360a353746d059547a2d01cfcc3ad6e3ff7dd84",
+        "url": "https://public.ecr.aws/v2/y6t4p3i8/harbour-kit-bundle/blobs/sha256:561297368f61eb3a81ca64d8d360a353746d059547a2d01cfcc3ad6e3ff7dd84"
+    },
+    "images": {
+        "appGateway": "public.ecr.aws/y6t4p3i8/harbour-app-gateway@sha256:8a838e05694da93a84def78898807dea177b0cd7bab60697b365151be511f47c",
+        "sessionFixture": "public.ecr.aws/y6t4p3i8/harbour-session-fixture@sha256:6f7142d34ba3f8d7879a71658555c38eaf2f416bb9580461cb74b47a627d16e9"
+    },
+    "brief": {
+        "fingerprint": "3b9d305bf6eedad1f48f704d3f29c33fcbc3e746bae395b41a3f71b3a809ab8f"
+    },
+    "declarationSchema": "harbour.app-integrations/2.0"
+};

package/dist/packages/harbour-cli/src/local-runtime.js

@@ -24,6 +24,9 @@ export const LOCAL = {
     app: "local-app",
     userId: "local-user",
     email: "local-user@example.test",
+    /** The second signed-in person of every local session: what a cross-user check runs as. */
+    secondUserId: "local-teammate",
+    secondEmail: "teammate@example.test",
     database: "harbour",
     dbUser: "harbour",
     dbPassword: "harbour-local",
@@ -34,11 +37,15 @@ export const LOCAL = {
 };
 // ---- Compose ----------------------------------------------------------------------
 /**
- * Compose file for one project: every port bound to 127.0.0.1, named volumes
- * prefixed with the project name, images pinned from the bundle manifest.
- * The fixture writes the session env (identity token) and the platform's
- * realtime outbox migration (generated from the app's migrations, staged under
- * state/migrations) to the shared state dir.
+ * Compose file for one project — three containers: Postgres, MinIO and one
+ * Harbour process, the app gateway in local-session mode. Every port bound to
+ * 127.0.0.1, named volumes prefixed with the project name, images pinned from
+ * the bundle manifest. The gateway mints the session identities and serves
+ * their JWKS itself, serves the provider fixtures beside its routes, relays
+ * the realtime outbox in-process, and writes the session env (both identity
+ * tokens) and the platform's realtime outbox migration (generated from the
+ * app's migrations, staged under state/migrations) to the shared state dir
+ * (data plane docs/local-kit.md).
  */
 export function composeFile(project, bundle, ports, stateDir) {
     const images = bundle.images;
@@ -59,27 +66,6 @@ export function composeFile(project, bundle, ports, stateDir) {
         `    ports: ["127.0.0.1:${ports.minio}:9000"]`,
         "    volumes: [minio-data:/data]",
         "    healthcheck: { test: [\"CMD-SHELL\", \"curl -sf http://127.0.0.1:9000/minio/health/ready || wget -qO- http://127.0.0.1:9000/minio/health/ready\"], interval: 2s, timeout: 3s, retries: 30 }",
-        "  nats:",
-        `    image: ${images.nats ?? "nats:2.11.17-alpine"}`,
-        "    command: [\"-js\", \"-m\", \"8222\"]",
-        `    ports: ["127.0.0.1:${ports.nats}:4222"]`,
-        "  fixture:",
-        `    image: ${images.sessionFixture}`,
-        "    command: [\"--listen\", \"0.0.0.0:8080\", \"--session\", \"" + project + "\", \"--base-url\", \"http://127.0.0.1:" + ports.fixture + "\", \"--tenant\", \"" + LOCAL.tenant + "\", \"--app\", \"" + LOCAL.app + "\", \"--user-id\", \"" + LOCAL.userId + "\", \"--email\", \"" + LOCAL.email + "\", \"--metadata-file\", \"/state/session.json\", \"--env-file\", \"/state/session.env\", \"--display-directory\", \"" + stateDir + "\", \"--migrations-dir\", \"/state/migrations\", \"--realtime-outbox-file\", \"/state/realtime-outbox.sql\"]",
-        "    environment:",
-        `      HARBOUR_LOCAL_COMPOSE_PROJECT: ${project}`,
-        `      HARBOUR_LOCAL_S3_INTERNAL_ENDPOINT: http://minio:9000`,
-        `      HARBOUR_LOCAL_S3_ENDPOINT: http://127.0.0.1:${ports.minio}`,
-        `      HARBOUR_LOCAL_S3_BUCKET: ${LOCAL.bucket}`,
-        `      HARBOUR_LOCAL_S3_ACCESS_KEY: ${LOCAL.s3Key}`,
-        `      HARBOUR_LOCAL_S3_SECRET_KEY: ${LOCAL.s3Secret}`,
-        `      HARBOUR_LOCAL_POSTGRES_INTERNAL_URL: ${internalDatabaseUrl()}`,
-        `      HARBOUR_LOCAL_POSTGRES_ADDRESS: 127.0.0.1:${ports.postgres}`,
-        `      HARBOUR_LOCAL_NATS_URL: nats://127.0.0.1:${ports.nats}`,
-        `      HARBOUR_LOCAL_NATS_INTERNAL_URL: nats://nats:4222`,
-        `    ports: ["127.0.0.1:${ports.fixture}:8080"]`,
-        `    volumes: ["${stateDir}:/state"]`,
-        "    depends_on: { postgres: { condition: service_healthy }, minio: { condition: service_healthy } }",
         "  gateway:",
         `    image: ${images.appGateway}`,
         "    environment:",
@@ -87,34 +73,13 @@ export function composeFile(project, bundle, ports, stateDir) {
         "      HARBOUR_APP_GATEWAY_UPLOAD_KEY: " + uploadKey(project),
         "      HARBOUR_S3_ENDPOINT: http://minio:9000",
         `      HARBOUR_S3_PUBLIC_ENDPOINT: http://127.0.0.1:${ports.minio}`,
-        "      HARBOUR_NATS_URL: nats://nats:4222",
         `      AWS_ACCESS_KEY_ID: ${LOCAL.s3Key}`,
         `      AWS_SECRET_ACCESS_KEY: ${LOCAL.s3Secret}`,
         "      AWS_REGION: us-east-1",
         "      AWS_EC2_METADATA_DISABLED: \"true\"",
         `    ports: ["127.0.0.1:${ports.gateway}:8080"]`,
-        `    volumes: ["${stateDir}/app-gateway.json:/config/app-gateway.json:ro"]`,
-        "    depends_on: { postgres: { condition: service_healthy }, minio: { condition: service_healthy }, fixture: { condition: service_started } }",
-        // The relay that moves committed rows from harbour_runtime.event_outbox to
-        // JetStream (docs/local-kit.md "Outbox relay container"): the hosted
-        // gateway starts it per app, the static local configuration does not.
-        // It shares the gateway's configuration and so fetches the fixture's JWKS
-        // before it reaches its own mode, even though a relay verifies no token:
-        // it therefore waits for the fixture like the gateway does, and restarts
-        // when it still wins the race (the fixture opens its listener only after
-        // its bucket is ready, so `service_started` is not `serving`).
-        "  outbox:",
-        `    image: ${images.appGateway}`,
-        "    environment:",
-        "      HARBOUR_APP_GATEWAY_MODE: outbox",
-        "      HARBOUR_APP_GATEWAY_CONFIG_FILE: /config/app-gateway.json",
-        "      HARBOUR_APP_GATEWAY_UPLOAD_KEY: " + uploadKey(project),
-        "      HARBOUR_NATS_URL: nats://nats:4222",
-        "      AWS_REGION: us-east-1",
-        "      AWS_EC2_METADATA_DISABLED: \"true\"",
-        `    volumes: ["${stateDir}/app-gateway.json:/config/app-gateway.json:ro"]`,
-        "    restart: on-failure",
-        "    depends_on: { postgres: { condition: service_healthy }, nats: { condition: service_started }, fixture: { condition: service_started } }",
+        `    volumes: ["${stateDir}/app-gateway.json:/config/app-gateway.json:ro", "${stateDir}:/state"]`,
+        "    depends_on: { postgres: { condition: service_healthy }, minio: { condition: service_healthy } }",
         "volumes:",
         `  postgres-data: { name: ${project}-postgres }`,
         `  minio-data: { name: ${project}-minio }`,
@@ -122,16 +87,18 @@ export function composeFile(project, bundle, ports, stateDir) {
         ""
     ].join("\n");
 }
-/** App Gateway configuration in the shape cmd/appgateway/main.go decodes (unknown fields are rejected there). */
-export function gatewayConfig(ports) {
+/**
+ * App Gateway configuration in the shape cmd/appgateway/main.go decodes (unknown fields are rejected there).
+ * `localSession` is what makes the gateway the whole local runtime: issuer = its own published origin (the
+ * tokens' `iss`), no jwksUrl (the keys are in-process), the session's bucket, users and state files.
+ */
+export function gatewayConfig(project, ports, stateDir) {
     return {
         listen: ":8080",
-        issuer: `http://127.0.0.1:${ports.fixture}`,
-        jwksUrl: "http://fixture:8080/.well-known/jwks.json",
+        issuer: `http://127.0.0.1:${ports.gateway}`,
         environment: "development",
         publicBaseUrl: `http://127.0.0.1:${ports.origin}`,
-        // Verified against the local images (docs/local-kit.md): the fixture's `iss` equals its --base-url, so `issuer`
-        // verifies; `unrestrictedFiles` with no filePolicies is the local cell's file policy.
+        // `unrestrictedFiles` with no filePolicies is the local cell's file policy.
         bindings: [{
                 tenant: LOCAL.tenant,
                 app: LOCAL.app,
@@ -142,7 +109,14 @@ export function gatewayConfig(ports) {
                 capabilities: ["data", "files", "realtime", "telemetry"],
                 filePolicies: [],
                 unrestrictedFiles: true
-            }]
+            }],
+        localSession: {
+            session: project, tenant: LOCAL.tenant, app: LOCAL.app, userId: LOCAL.userId, email: LOCAL.email,
+            secondUserId: LOCAL.secondUserId, secondEmail: LOCAL.secondEmail,
+            metadataFile: "/state/session.json", envFile: "/state/session.env", displayDirectory: stateDir,
+            migrationsDir: "/state/migrations", realtimeOutboxFile: "/state/realtime-outbox.sql",
+            bucket: LOCAL.bucket
+        }
     };
 }
 /** `migrations/*.sql` in name order — what `harbour dev` applies and what the fixture derives the outbox from. */
@@ -160,8 +134,8 @@ export async function freePort() {
     });
 }
 export async function allocatePorts() {
-    const [postgres, minio, nats, fixture, gateway, vite, origin] = await Promise.all([freePort(), freePort(), freePort(), freePort(), freePort(), freePort(), freePort()]);
-    return { postgres: postgres, minio: minio, nats: nats, fixture: fixture, gateway: gateway, vite: vite, origin: origin };
+    const [postgres, minio, gateway, vite, origin] = await Promise.all([freePort(), freePort(), freePort(), freePort(), freePort()]);
+    return { postgres: postgres, minio: minio, gateway: gateway, vite: vite, origin: origin };
 }
 /** Acquires `.harbour/local/dev.lock`; a lock whose process is gone is stale and replaced. */
 export async function acquireDevLock(root, ports, isAlive = pidAlive) {
@@ -223,8 +197,8 @@ export class LocalRuntime {
         const paths = kitPaths(this.root);
         await mkdir(paths.state, { recursive: true });
         await writeFile(paths.compose, composeFile(this.project, bundle, ports, paths.state));
-        await writeFile(join(paths.state, "app-gateway.json"), `${JSON.stringify(gatewayConfig(ports), null, 2)}\n`);
-        // The fixture derives the realtime outbox from the app's migrations; they
+        await writeFile(join(paths.state, "app-gateway.json"), `${JSON.stringify(gatewayConfig(this.project, ports, paths.state), null, 2)}\n`);
+        // The gateway derives the realtime outbox from the app's migrations; they
         // are staged into the state dir (already mounted at /state) rather than
         // bind-mounting migrations/, which Docker would create as root if absent.
         const staged = join(paths.state, "migrations");
@@ -243,15 +217,13 @@ export class LocalRuntime {
     async pull(bundle) {
         const result = await this.compose(["pull", "--quiet"]);
         if (result.code !== 0)
-            throw new CliError("KIT_IMAGES_UNAVAILABLE", `Docker could not pull the kit images (${bundle.images.appGateway}, ${bundle.images.sessionFixture}): ${result.stderr.trim().split("\n").at(-1) ?? "docker error"}. They are public and pinned by digest; \`docker compose\` (Compose v2) must be installed and Docker running with access to the registry.`);
+            throw new CliError("KIT_IMAGES_UNAVAILABLE", `Docker could not pull the kit images (${bundle.images.appGateway}): ${result.stderr.trim().split("\n").at(-1) ?? "docker error"}. They are public and pinned by digest; \`docker compose\` (Compose v2) must be installed and Docker running with access to the registry.`);
     }
     async up() {
         const result = await this.compose(["up", "-d", "--wait"]);
         if (result.code !== 0)
             throw new CliError("LOCAL_RUNTIME_FAILED", "Docker could not start the local Harbour services. Is Docker running and are the kit images available (see .harbour/kit.lock.json)?");
     }
-    /** Restarts one service; the outbox relay needs it once its JetStream stream exists. */
-    async restartService(service) { await this.compose(["restart", service], { quiet: true }); }
     /** Stops containers and keeps volumes; safe to repeat. */
     async stop() {
         const result = await this.compose(["stop"], { quiet: true });
@@ -293,10 +265,11 @@ export class LocalRuntime {
         return this.compose(["exec", "-T", "postgres", "psql", "-v", "ON_ERROR_STOP=1", "-U", LOCAL.dbUser, "-d", LOCAL.database], { stdin: sql, quiet: true });
     }
     /**
-     * Applies the platform's realtime outbox migration the session fixture
-     * generated for this app's tables (state/realtime-outbox.sql: the data
-     * plane's one generator, the same text the hosted pipeline appends to the
-     * app's bundle) — after the app's migrations, idempotent on every start.
+     * Applies the platform's realtime outbox migration the gateway generated
+     * for this app's tables (state/realtime-outbox.sql: the data plane's one
+     * generator, the same text the hosted pipeline appends to the app's
+     * bundle) — after the app's migrations, idempotent on every start. The
+     * gateway's in-process relay starts publishing once the table exists.
      * Returns the number of watched tables; 0 when the app has no tables.
      */
     async installRealtimeOutbox() {
@@ -309,22 +282,35 @@ export class LocalRuntime {
             throw new CliError("MIGRATION_FAILED", `The realtime outbox migration failed: ${result.stderr.trim().split("\n").at(-1) ?? "psql error"}`);
         return (sql.match(/harbour_runtime\.watch_table\(/g) ?? []).length;
     }
-    /** The fixture's session env (identity token for the local app user) once the fixture has written it. */
+    /**
+     * The gateway's session env — both signed identities under the pipeline's
+     * names (HARBOUR_IDENTITY_CONTEXT, _HEADER, _SECOND_USER) — once the
+     * gateway has bound its listener and written it.
+     */
     async sessionEnv(attempts = 60) {
         const path = join(kitPaths(this.root).state, "session.env");
         for (let attempt = 0; attempt < attempts; attempt += 1) {
             try {
                 const env = parseSessionEnv(await readFile(path, "utf8"));
-                if (env.HARBOUR_IDENTITY_CONTEXT_TOKEN)
+                if (env.HARBOUR_IDENTITY_CONTEXT && env.HARBOUR_IDENTITY_CONTEXT_SECOND_USER)
                     return env;
             }
             catch { /* not written yet */ }
-            await new Promise(resolve => setTimeout(resolve, 500));
+            if (attempts > 1)
+                await new Promise(resolve => setTimeout(resolve, 500));
         }
-        throw new CliError("LOCAL_RUNTIME_FAILED", "The local identity fixture did not publish a session.");
+        throw new CliError("LOCAL_RUNTIME_FAILED", "The local Harbour gateway did not publish a session.");
     }
 }
-/** The fixture writes a shell-sourceable file: `export KEY='value'`, a literal quote written as `'"'"'`. */
+/** The three names the pipeline's retained-check runner exports for the signed identities, from a session env. */
+export function identityEnvironment(session) {
+    return {
+        HARBOUR_IDENTITY_CONTEXT: session.HARBOUR_IDENTITY_CONTEXT ?? "",
+        HARBOUR_IDENTITY_CONTEXT_HEADER: session.HARBOUR_IDENTITY_CONTEXT_HEADER ?? "X-Harbour-Identity-Context",
+        HARBOUR_IDENTITY_CONTEXT_SECOND_USER: session.HARBOUR_IDENTITY_CONTEXT_SECOND_USER ?? ""
+    };
+}
+/** The gateway writes a shell-sourceable file: `export KEY='value'`, a literal quote written as `'"'"'`. */
 export function parseSessionEnv(text) {
     const env = {};
     for (const line of text.split("\n")) {

package/dist/packages/harbour-cli/src/starter.js

@@ -108,7 +108,7 @@ description: Build, run and check this Harbour app with the Harbour CLI (dev, ch
 
 Follow the "Harbour development kit" block in CLAUDE.md / AGENTS.md. Workflow:
 
-1. \`harbour dev --app-root .\` starts Postgres, storage, the identity fixture, the app gateway and Vite behind one loopback origin printed in the banner.
+1. \`harbour dev --app-root .\` starts Postgres, storage and one Harbour gateway (session identities, fixtures, realtime) plus Vite behind one loopback origin printed in the banner.
 2. Edit \`src/\`, \`migrations/\` and \`.harbour/integrations.json\`. Use the SDK only; declare integrations before calling them.
 3. \`harbour check --app-root .\` before every hand-off; read \`.harbour/local/check-report.json\`. Real integrations are reported as not tested unless \`--integrations\` is passed (read operations only).
 4. \`harbour integrations request <connection> --reason "<why>" --app-root .\` asks IT for development access; pending is not ready.
@@ -128,7 +128,10 @@ function kitFiles() {
         // One retained check per capability the starter's UI uses: the pipeline's
         // flow gate refuses an app whose checks never exercise a declared capability.
         ".harbour/checks/notes-journey.mjs": JOURNEY_CHECK,
-        ".harbour/checks/files-journey.mjs": FILES_JOURNEY_CHECK
+        ".harbour/checks/files-journey.mjs": FILES_JOURNEY_CHECK,
+        // The pipeline's cross-user denial, run locally: the last gate class that
+        // used to exist only in CodeBuild.
+        ".harbour/checks/notes-cross-user.mjs": CROSS_USER_CHECK
     };
 }
 function starterFiles(bundle) {
@@ -150,7 +153,7 @@ function starterFiles(bundle) {
         "src/harbour.client.ts": HARBOUR_CLIENT,
         "src/App.tsx": APP,
         "src/SlackPanel.tsx": SLACK_PANEL,
-        "README.md": "# Harbour app\n\nCreated by `harbour init`. Run `harbour dev --app-root .` and open the printed origin. See CLAUDE.md / AGENTS.md for the kit rules.\n\n`.harbour/checks/` holds one journey per capability the app uses (`notes-journey.mjs` for data, `files-journey.mjs` for files); `harbour check` and the deployment pipeline refuse an app whose checks never exercise an operation its own code performs, so a new feature needs its own retained check.\n\n`.harbour/integrations.json` declares `company-slack` only. Declare a connection only when the app calls it: `harbour productionise` refuses to deploy until every declared connection has a preview grant (`harbour integrations request <connection> --environment preview --reason \"<why>\" --app-root .`). The warehouse example (`sales-warehouse` / `warehouse.view.read`) is in a comment in `src/App.tsx`.\n"
+        "README.md": "# Harbour app\n\nCreated by `harbour init`. Run `harbour dev --app-root .` and open the printed origin. See CLAUDE.md / AGENTS.md for the kit rules.\n\n`.harbour/checks/` holds one journey per capability the app uses (`notes-journey.mjs` for data, `files-journey.mjs` for files) and `notes-cross-user.mjs`, which proves a second signed-in person cannot read, update or delete another person's note — the same denial the deployment pipeline's write probe asserts; `harbour check` and the deployment pipeline refuse an app whose checks never exercise an operation its own code performs, so a new feature needs its own retained check.\n\n`.harbour/integrations.json` declares `company-slack` only. Declare a connection only when the app calls it: `harbour productionise` refuses to deploy until every declared connection has a preview grant (`harbour integrations request <connection> --environment preview --reason \"<why>\" --app-root .`). The warehouse example (`sales-warehouse` / `warehouse.view.read`) is in a comment in `src/App.tsx`.\n"
     };
 }
 const VITE_CONFIG = `import { defineConfig } from "vite";
@@ -371,9 +374,9 @@ import assert from "node:assert/strict";
 const appUrl = process.env.HARBOUR_APP_URL;
 assert.ok(appUrl, "HARBOUR_APP_URL is required");
 const sdk = await import(process.env.HARBOUR_SDK_MODULE ?? "@harbour/app-sdk");
-const token = process.env.HARBOUR_IDENTITY_CONTEXT_TOKEN;
-const fetchWithIdentity = (input, init = {}) => fetch(input, { ...init, headers: { ...(init.headers ?? {}), ...(token ? { "x-harbour-identity-context": token } : {}) } });
-const harbour = sdk.createClient({ baseUrl: appUrl, fetch: fetchWithIdentity });
+// The signed-in identity is attached by the SDK itself (HARBOUR_IDENTITY_CONTEXT
+// from \`harbour check\` and from the pipeline's runner): one injector per request.
+const harbour = sdk.createClient({ baseUrl: appUrl });
 
 const user = await harbour.identity.current();
 assert.ok(user && user.email, "identity/current must return the signed-in user");
@@ -391,6 +394,54 @@ await harbour.data.from("notes").delete().eq("id", notes[0].id);
 const { data: remaining } = await harbour.data.from("notes").select("id").eq("title", title);
 assert.equal(remaining.length, 0, "the note is deleted");
 `;
+const CROSS_USER_CHECK = `// Cross-user check: a second signed-in person cannot read, update or delete the first
+// person's note through the running app (HARBOUR_APP_URL). The deployment pipeline's
+// write probe makes exactly these three assertions, with a second identity, against every
+// owner-scoped table; this is the same check run locally, so user isolation can no longer
+// be green under \`harbour check\` and red in CodeBuild. Runs while \`harbour dev\` is up,
+// and in the pipeline's retained-check container.
+import assert from "node:assert/strict";
+
+const appUrl = process.env.HARBOUR_APP_URL;
+assert.ok(appUrl, "HARBOUR_APP_URL is required");
+const secondUser = process.env.HARBOUR_IDENTITY_CONTEXT_SECOND_USER;
+assert.ok(secondUser, "HARBOUR_IDENTITY_CONTEXT_SECOND_USER is required (set by harbour check and by the pipeline)");
+const sdk = await import(process.env.HARBOUR_SDK_MODULE ?? "@harbour/app-sdk");
+// The first person: the SDK attaches HARBOUR_IDENTITY_CONTEXT itself.
+const owner = sdk.createClient({ baseUrl: appUrl });
+// The second person: the same SDK, with that person's signed identity replacing the first on every request.
+const header = (process.env.HARBOUR_IDENTITY_CONTEXT_HEADER ?? "X-Harbour-Identity-Context").toLowerCase();
+const asSecondUser = (input, init = {}) => fetch(input, { ...init, headers: { ...(init.headers ?? {}), [header]: secondUser } });
+const other = sdk.createClient({ baseUrl: appUrl, fetch: asSecondUser });
+
+const me = await owner.identity.current();
+const them = await other.identity.current();
+assert.ok(me && them && me.id !== them.id, "the two signed-in identities must be different people");
+
+const title = \`cross-user \${Date.now()}\`;
+await owner.data.from("notes").insert({ title });
+const { data: mine } = await owner.data.from("notes").select("*").eq("title", title);
+assert.equal(mine.length, 1, "the owner reads the note back");
+const id = mine[0].id;
+
+// 1. SELECT by id as the second person: no row.
+const { data: seen } = await other.data.from("notes").select("*").eq("id", id);
+assert.equal(seen.length, 0, "notes: a second signed-in user can read another user's row — the owner policy does not isolate users");
+
+// 2. UPDATE and 3. DELETE by id as the second person: refused (403) or no row affected.
+const denied = async (verb, operation) => {
+  let affected;
+  try { affected = (await operation()).data ?? []; }
+  catch (error) { if (error?.category === "FORBIDDEN") return; throw error; }
+  assert.equal(affected.length, 0, \`notes \${verb}: a second user mutated another user's row despite an owner-scoped source policy\`);
+};
+await denied("UPDATE", () => other.data.from("notes").update({ done: true }).eq("id", id));
+await denied("DELETE", () => other.data.from("notes").delete().eq("id", id));
+const { data: after } = await owner.data.from("notes").select("*").eq("id", id);
+assert.equal(after.length, 1, "the owner's note still exists after the second user's attempts");
+assert.equal(after[0].done, false, "the owner's note is unchanged after the second user's attempts");
+await owner.data.from("notes").delete().eq("id", id);
+`;
 const FILES_JOURNEY_CHECK = `// Journey check: the signed-in identity can upload a private file and list it back
 // through the running app (HARBOUR_APP_URL) — the two operations the "Private
 // files" section of src/App.tsx performs (\`harbour.files.upload\` / \`harbour.files.list\`).
@@ -402,9 +453,9 @@ import assert from "node:assert/strict";
 const appUrl = process.env.HARBOUR_APP_URL;
 assert.ok(appUrl, "HARBOUR_APP_URL is required");
 const sdk = await import(process.env.HARBOUR_SDK_MODULE ?? "@harbour/app-sdk");
-const token = process.env.HARBOUR_IDENTITY_CONTEXT_TOKEN;
-const fetchWithIdentity = (input, init = {}) => fetch(input, { ...init, headers: { ...(init.headers ?? {}), ...(token ? { "x-harbour-identity-context": token } : {}) } });
-const harbour = sdk.createClient({ baseUrl: appUrl, fetch: fetchWithIdentity });
+// The signed-in identity is attached by the SDK itself (HARBOUR_IDENTITY_CONTEXT
+// from \`harbour check\` and from the pipeline's runner): one injector per request.
+const harbour = sdk.createClient({ baseUrl: appUrl });
 
 const user = await harbour.identity.current();
 assert.ok(user && user.email, "identity/current must return the signed-in user");

package/dist/packages/harbour-cli/src/version.js

@@ -1 +1 @@
-export const CLI_VERSION = "0.1.20";
+export const CLI_VERSION = "0.1.21";

package/package.json

@@ -1,15 +1,40 @@
 {
   "name": "@fourier-labs/harbour",
-  "version": "0.1.20",
+  "version": "0.1.21",
   "description": "Harbour productionisation helper",
   "type": "module",
-  "bin": { "harbour": "./dist/packages/harbour-cli/src/cli.js" },
-  "repository": { "type": "git", "url": "https://github.com/Fourier-Labs-AI/harbour-governance-control-plane.git" },
-  "publishConfig": { "access": "public" },
-  "files": ["dist/packages/harbour-cli/src", "dist/src/analyzer.js", "dist/src/contracts.js", "dist/src/digest.js", "dist/src/secret-paths.js", "dist/src/source-intake.js", "package.json"],
-  "engines": { "node": ">=22.13.0" },
+  "bin": {
+    "harbour": "./dist/packages/harbour-cli/src/cli.js"
+  },
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/Fourier-Labs-AI/harbour-governance-control-plane.git"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "files": [
+    "dist/packages/harbour-cli/src",
+    "dist/src/analyzer.js",
+    "dist/src/contracts.js",
+    "dist/src/digest.js",
+    "dist/src/secret-paths.js",
+    "dist/src/source-intake.js",
+    "package.json"
+  ],
+  "engines": {
+    "node": ">=22.13.0"
+  },
   "scripts": {
+    "prebuild": "node scripts/kit-bundle.mjs verify",
     "build": "tsc -p tsconfig.json",
+    "kit-bundle:sync": "node scripts/kit-bundle.mjs sync",
     "pack:check": "npm pack --dry-run"
+  },
+  "harbour": {
+    "kitBundle": {
+      "repository": "public.ecr.aws/y6t4p3i8/harbour-kit-bundle",
+      "version": "0.1.21"
+    }
   }
 }

package/dist/packages/harbour-cli/src/realtime-stream.js

@@ -1,79 +0,0 @@
-import { connect } from "node:net";
-import { randomUUID } from "node:crypto";
-import { LOCAL } from "./local-runtime.js";
-/**
- * The JetStream stream the local realtime path needs.
- *
- * The App Gateway's outbox relay publishes committed row changes with a
- * JetStream publish (appgateway/outbox.go); a JetStream publish to a subject no
- * stream captures is refused with "no response from stream", so without this
- * the relay retries forever and `harbour.realtime` never delivers anything
- * locally — while the deployment pipeline, which creates the same stream for
- * its probe (toolkit/transformbuild/local_component_runtime.go), delivers
- * normally. A realtime app therefore could not be exercised locally at all.
- *
- * Creating it needs three NATS protocol lines, so the CLI speaks them itself
- * rather than taking a client dependency.
- */
-export const REALTIME_STREAM = "HARBOUR_LOCAL";
-export const REALTIME_SUBJECTS = `harbour.app.${LOCAL.tenant}.${LOCAL.app}.>`;
-/** JetStream's "stream name already in use": the stream from an earlier `harbour dev`. */
-const ALREADY_EXISTS = 10058;
-export async function ensureRealtimeStream(port, host = "127.0.0.1", timeoutMs = 10_000) {
-    const inbox = `_INBOX.${randomUUID()}`;
-    const request = JSON.stringify({ name: REALTIME_STREAM, subjects: [REALTIME_SUBJECTS], storage: "memory", retention: "limits", num_replicas: 1, discard: "old" });
-    const reply = await natsRequest(host, port, `$JS.API.STREAM.CREATE.${REALTIME_STREAM}`, inbox, request, timeoutMs);
-    const answer = JSON.parse(reply);
-    if (!answer.error)
-        return "created";
-    if (answer.error.err_code === ALREADY_EXISTS)
-        return "present";
-    throw new Error(`the local realtime stream could not be created: ${answer.error.description ?? reply}`);
-}
-/** CONNECT, SUB the inbox, PUB the request, and return the first reply. */
-function natsRequest(host, port, subject, inbox, payload, timeoutMs) {
-    return new Promise((resolve, reject) => {
-        const socket = connect(port, host);
-        const finish = (error, value) => { clearTimeout(timer); socket.destroy(); error ? reject(error) : resolve(value); };
-        const timer = setTimeout(() => finish(new Error("the local NATS server did not answer the JetStream request")), timeoutMs);
-        timer.unref?.();
-        let buffer = "";
-        let greeted = false;
-        socket.on("error", error => finish(error));
-        socket.setEncoding("utf8");
-        socket.on("data", chunk => {
-            buffer += chunk;
-            if (!greeted && buffer.includes("\r\n")) {
-                greeted = true;
-                socket.write(`CONNECT {"verbose":false,"pedantic":false,"tls_required":false,"name":"harbour-cli","lang":"node","version":"1"}\r\n`);
-                socket.write(`SUB ${inbox} 1\r\n`);
-                socket.write(`PUB ${subject} ${inbox} ${Buffer.byteLength(payload)}\r\n${payload}\r\n`);
-                buffer = buffer.slice(buffer.indexOf("\r\n") + 2);
-            }
-            if (buffer.startsWith("PING\r\n")) {
-                socket.write("PONG\r\n");
-                buffer = buffer.slice(6);
-            }
-            const message = readMessage(buffer);
-            if (message)
-                finish(undefined, message);
-        });
-    });
-}
-/** One `MSG <subject> <sid> <bytes>\r\n<payload>\r\n`, once its payload has arrived. */
-export function readMessage(buffer) {
-    const start = buffer.indexOf("MSG ");
-    if (start < 0)
-        return undefined;
-    const headerEnd = buffer.indexOf("\r\n", start);
-    if (headerEnd < 0)
-        return undefined;
-    const parts = buffer.slice(start + 4, headerEnd).trim().split(/\s+/);
-    const bytes = Number(parts.at(-1));
-    if (!Number.isFinite(bytes))
-        return undefined;
-    const payloadEnd = headerEnd + 2 + bytes;
-    if (buffer.length < payloadEnd)
-        return undefined;
-    return buffer.slice(headerEnd + 2, payloadEnd);
-}