@fourier-labs/harbour 0.1.32 → 0.1.33

package/dist/packages/harbour-cli/src/check.js

@@ -1,4 +1,4 @@
-import { readFile, readdir, writeFile } from "node:fs/promises";
+import { readFile, readdir, rm, writeFile } from "node:fs/promises";
 import { join } from "node:path";
 import { readAppSchema } from "./app-schema.js";
 import { describeRetainedChecks, syncRetainedChecks } from "./retained-checks.js";
@@ -128,8 +128,16 @@ export async function runKitGate(root, options) {
             const done = await request("/_gate/report");
             if (done?.status === 200) {
                 const result = await done.json();
-                if (result.report)
+                if (result.report) {
+                    // The app is mounted read-only and the gate works on a mirror, so
+                    // what it authored for the app to ship comes home here — today the
+                    // governed-AI inventory (`.harbour/ai-inventory.json`), which the
+                    // pipeline verifies against the source and which only the gate may
+                    // write. Written before the caller pins the tree digest, like the
+                    // regenerated retained checks.
+                    await writeGateFiles(root, result.files ?? {}, output);
                     return result.report;
+                }
                 throw new CliError("LOCAL_RUNTIME_FAILED", `The kit gate could not run: ${result.error ?? "no report"}.`);
             }
             if (!(await runtime.gateRunning(container)))
@@ -288,3 +296,19 @@ export async function readReport(root) {
 function lastLines(text, count = 5) { return text.trim().split("\n").slice(-count).join(" | ").slice(0, 600); }
 /** A multi-line detail (one gate violation per line) keeps its lines, each under the check name. */
 function indentLines(detail) { return detail.split("\n").map((line, index) => index ? `      ${line}` : line).join("\n"); }
+/** Files the gate authored for the app (path → content, or null to remove), confined to `.harbour/`. */
+export async function writeGateFiles(root, files, output) {
+    for (const [path, content] of Object.entries(files)) {
+        if (!/^\.harbour\/[A-Za-z0-9._-]+$/.test(path))
+            throw new CliError("LOCAL_RUNTIME_FAILED", `The kit gate named a file outside .harbour/: ${path}.`);
+        const target = join(root, path);
+        if (content === null) {
+            await rm(target, { force: true });
+            output(`Removed ${path}: the app no longer needs it.`);
+        }
+        else {
+            await writeFile(target, content);
+            output(`Wrote ${path}.`);
+        }
+    }
+}

package/dist/packages/harbour-cli/src/kit-bundle.manifest.js

@@ -1,6 +1,6 @@
 export const PUBLISHED_KIT_BUNDLE = {
     "schema": "harbour.kit-bundle/1.0",
-    "kitVersion": "0.1.32",
+    "kitVersion": "0.1.33",
     "sdk": {
         "package": "@harbour/app-sdk",
         "version": "1.1.0",
@@ -8,8 +8,8 @@ export const PUBLISHED_KIT_BUNDLE = {
         "url": "https://public.ecr.aws/v2/y6t4p3i8/harbour-kit-bundle/blobs/sha256:3f7ee9d3f7161e8fdb1f7eb89e045c6288a919a72902dbc5bf68ec73e6e578ce"
     },
     "images": {
-        "appGateway": "public.ecr.aws/y6t4p3i8/harbour-app-gateway@sha256:516f56cf83d9b270bd1163914781a216dac6f0dfe1e794150fafaefdd76feaf6",
-        "sessionFixture": "public.ecr.aws/y6t4p3i8/harbour-session-fixture@sha256:ac894b7490fd97ade2e646d2255bbc5ae8d386e800042ee25f8fc2049e51f5c8"
+        "appGateway": "public.ecr.aws/y6t4p3i8/harbour-app-gateway@sha256:7f96a6d1c4f78164d4c4b22fe49e784e87674600bbdae31d8098b2ea6833de11",
+        "sessionFixture": "public.ecr.aws/y6t4p3i8/harbour-session-fixture@sha256:573fb296161d57303bddf5e8134de0384ab4e9ae768d81ff09e84d6ef31c58a6"
     },
     "brief": {
         "fingerprint": "4b3c61acdce47995c15e5ce8c38d5e636a624cd79ef7bebb9401b6228d129d11"

package/dist/packages/harbour-cli/src/version.js

@@ -1 +1 @@
-export const CLI_VERSION = "0.1.32";
+export const CLI_VERSION = "0.1.33";

package/dist/src/analyzer.js

@@ -12,8 +12,8 @@ const MAX_FILE_BYTES = 256_000;
 // application files. Keeping them out also makes reruns idempotent after a
 // previous save has written a receipt into the selected workspace.
 const IGNORED_DIRS = new Set([".git", ".harbour", ".next", ".nuxt", ".svelte-kit", ".turbo", "coverage", "dist", "build", "node_modules", "vendor"]);
-/** The development kit commits its declaration, lock and journey checks under `.harbour` (see `isKitCommittedPath`); everything else there (local state, checks evidence, generated control files) stays out of the package. */
-const KIT_CONTROL_FILES = [".harbour/integrations.json", ".harbour/kit.lock.json"];
+/** The development kit commits its declaration, lock, governed-AI inventory and journey checks under `.harbour` (see `isKitCommittedPath`); everything else there (local state, checks evidence, generated control files) stays out of the package. The inventory is what the pipeline plans a kit app's AI over (data plane 0.78.2.0): the gate writes it under `harbour check`, the lane refuses an app whose source calls governed AI without it. */
+const KIT_CONTROL_FILES = [".harbour/integrations.json", ".harbour/kit.lock.json", ".harbour/ai-inventory.json"];
 const KIT_CHECKS_DIR = ".harbour/checks";
 const SECRET_FILE_NAMES = new Set([".env", ".env.local", ".env.production", ".env.development", ".npmrc"]);
 const TEXT_EXTENSIONS = new Set([".js", ".jsx", ".ts", ".tsx", ".mjs", ".cjs", ".json", ".html", ".css", ".py", ".rb", ".go", ".rs", ".java", ".cs", ".php", ".md", ".toml", ".yaml", ".yml", ".sh"]);

package/dist/src/secret-paths.js

@@ -25,7 +25,7 @@ export function isSourceIntakeExcludedPath(path) {
  * Everything else there (local state, generated control files) stays local.
  */
 export function isKitCommittedPath(path) {
-    return /(^|\/)\.harbour\/(?:integrations\.json|kit\.lock\.json|checks\/[^/]+\.(?:mjs|js|cjs))$/.test(path);
+    return /(^|\/)\.harbour\/(?:integrations\.json|kit\.lock\.json|ai-inventory\.json|checks\/[^/]+\.(?:mjs|js|cjs))$/.test(path);
 }
 /** Dependency and internal directories the intake never stages — `.harbour` except its committed kit files. */
 export function isInternalSourcePath(path) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fourier-labs/harbour",
-  "version": "0.1.32",
+  "version": "0.1.33",
   "description": "Harbour productionisation helper",
   "type": "module",
   "bin": {
@@ -34,7 +34,7 @@
   "harbour": {
     "kitBundle": {
       "repository": "public.ecr.aws/y6t4p3i8/harbour-kit-bundle",
-      "version": "0.1.32"
+      "version": "0.1.33"
     }
   }
 }