@isomorph.ai/app-sdk 1.2.1

package/dist/index.js

@@ -0,0 +1,602 @@
+import { validateIntegrationExecuteInput } from './integration-execute-input-rules.js';
+export class IsomorphError extends Error {
+    category;
+    requestId;
+    details;
+    status;
+    constructor(category, message, requestId, details, 
+    /** The HTTP status the gateway answered, when the error came from a response. */
+    status) {
+        super(message);
+        this.category = category;
+        this.requestId = requestId;
+        this.details = details;
+        this.status = status;
+        this.name = 'IsomorphError';
+    }
+}
+/** The AI reason code carried by an error, when it is a governed-AI refusal. */
+export function aiErrorCode(error) {
+    const code = error instanceof IsomorphError ? error.details?.code : undefined;
+    return typeof code === 'string' && AI_ERROR_CODES.has(code) ? code : undefined;
+}
+const AI_ERROR_CODES = new Set(['AI_NOT_ENABLED', 'AI_POLICY_DENIED', 'AI_QUOTA_EXCEEDED', 'AI_PROVIDER_ERROR', 'AI_UNAVAILABLE', 'REQUEST_TOO_LARGE', 'VALIDATION_FAILED']);
+// Header names are case-insensitive, but a plain object is not: `Headers`
+// JOINS `X-Harbour-Identity-Context` and `x-harbour-identity-context` into one
+// value "a, b". The kit starter's retained checks attach the identity context
+// themselves through createClient({ fetch }) — the documented pattern — and
+// the runner attaches it too from ISOMORPH_IDENTITY_CONTEXT, so every check
+// sent a joined token the gateway refused (401) and identity.current()
+// answered null (fourier app-f3955673, 2026-09-11). Later layers win by
+// case-insensitive name; the first spelling is kept.
+function mergeHeaders(...layers) {
+    const merged = {};
+    const spelling = new Map();
+    for (const layer of layers) {
+        if (!layer)
+            continue;
+        for (const [key, value] of Object.entries(layer)) {
+            const canonical = key.toLowerCase();
+            const name = spelling.get(canonical) ?? key;
+            spelling.set(canonical, name);
+            if (value === undefined)
+                delete merged[name];
+            else
+                merged[name] = value;
+        }
+    }
+    return merged;
+}
+// A signed-in request carries the identity context header. In a browser the
+// platform edge attaches it; in Node nobody does, so a check that imported the
+// application's own client reached the gateway and was refused with "signed-in
+// identity is required". The runner exports the header name and the signed
+// token, so read them here — the same shape as the base URL above, and for the
+// same reason: the brief tells the agent to drive the converted module under
+// the runner and forbids patching fetch, so the SDK must make that true.
+//
+// Request-supplied headers still win the merge. That does NOT yet give a check
+// a way to use the second identity (ISOMORPH_IDENTITY_CONTEXT_SECOND_USER):
+// ClientOptions has no headers field, so a check needing it must build its own
+// client with createClient({ fetch }). The ownership and cross-user coverage
+// rules require that identity, so either the brief should sanction that option
+// or this transport should take a per-request identity.
+function runnerIdentityHeaders(identity) {
+    if (typeof location !== 'undefined')
+        return {};
+    const environment = globalThis.process?.env;
+    const name = environment?.ISOMORPH_IDENTITY_CONTEXT_HEADER;
+    const token = identity === 'second-user' ? environment?.ISOMORPH_IDENTITY_CONTEXT_SECOND_USER : environment?.ISOMORPH_IDENTITY_CONTEXT;
+    const workloadToken = environment?.ISOMORPH_WORKLOAD_TOKEN;
+    // Lower case on purpose: header names are case-insensitive on the wire but
+    // a plain header object is not. A retained check that attaches the same
+    // header itself (`createClient({ fetch })` spreading init.headers and adding
+    // 'x-harbour-identity-context') must replace this entry, not sit beside it —
+    // Headers joins two spellings into "a, b", which the gateway refuses.
+    if (workloadToken)
+        return { authorization: `Bearer ${workloadToken}` };
+    return name && token ? { [name.toLowerCase()]: token } : {};
+}
+// The default realtime socket. In a browser the platform edge attaches the
+// identity to the upgrade; in Node nobody does, so the runner's identity
+// (the same ISOMORPH_IDENTITY_CONTEXT every HTTP request carries) goes on the
+// upgrade request too. Node's WebSocket accepts request headers as its
+// second argument; a browser's does not, and gets none. Before this a check
+// that subscribed through isomorph.realtime under the runner opened the
+// socket anonymously and waited for SUBSCRIBED until the deadline (fourier
+// app-f3955673, previews 000028 and 000030, 2026-09-11) — unless it read a
+// token name of its own and built the socket itself, which is the kind of
+// wrapper the kit gate now refuses.
+function defaultSocketFactory(url, identity) {
+    const headers = runnerIdentityHeaders(identity);
+    if (Object.keys(headers).length === 0)
+        return new WebSocket(url);
+    const Socket = WebSocket;
+    return new Socket(url, { headers });
+}
+const IDENTITY_PATH = '/_harbour/identity/current';
+// The platform edge attaches the signed identity context to every request
+// from a fresh context cookie, but when that cookie is absent or stale it can
+// only heal it on a GET/HEAD: healing is a redirect through
+// /__harbour/context/refresh (the browser lands back on the same URL with
+// `?__renewed=1`), and a POST cannot be redirected without losing its body,
+// so the edge forwards it as-is and the gateway answers 401 "signed Isomorph
+// identity is required". A page that mounts by firing identity.current()
+// (GET) and its first data reads (POST) concurrently hits this on every cold
+// load until the GET has minted the cookie, again whenever an open tab
+// outlives the context TTL (fourier app-f3955673, production, 2026-09-12),
+// and again on the first POST after an SSO login: the starter's addNote
+// awaited data.from('notes').insert(), the insert was refused, the promise
+// rejected and the note never existed (preview + production, 2026-09-16).
+//
+// The rule, uniform for every /_harbour/* call (data, files, actions,
+// integrations, ai, telemetry) from a browser: on a 401, renew the identity
+// ONCE through the GET the edge heals (identity.current()), then resend the
+// original request ONCE, then surface the error. Never twice, never on 403
+// or 5xx. The renewal has to be one that STARTED AFTER the refused request
+// left: an identity GET already in flight when the 401 arrives may have
+// passed the edge before the context rotated, and a resend on its word is
+// refused again — so such a GET is awaited and a fresh one made. Resending is
+// safe for a mutation because a 401 is refused before the gateway touches the
+// database: the handler never ran, so the retry is the first and only write.
+// The body is a JSON string, FormData or Blob — all replayable as-is.
+//
+// The identity GET itself is never renewed (it IS the renewal), and under Node
+// the runner's identity is a static token no GET can renew, so a refusal there
+// surfaces at once.
+function renewableOnUnauthorized(path) {
+    if (typeof location === 'undefined')
+        return false;
+    return path.startsWith('/_harbour/') && path !== IDENTITY_PATH;
+}
+class Transport {
+    onUnauthorized;
+    baseUrl;
+    fetch;
+    identity;
+    renewal;
+    constructor(options, onUnauthorized) {
+        this.onUnauthorized = onUnauthorized;
+        this.baseUrl = (options.baseUrl ?? applicationBaseUrl()).replace(/\/$/, '');
+        this.fetch = options.fetch ?? globalThis.fetch.bind(globalThis);
+        this.identity = options.identity;
+    }
+    json(path, init = {}) {
+        return this.request(path, init, renewableOnUnauthorized(path));
+    }
+    async request(path, init, renewOnUnauthorized) {
+        const sentAt = this.renewal?.renewals() ?? 0;
+        // (headers with an undefined value are removed so a multipart body can
+        // clear the JSON default and let the browser set its own boundary)
+        const response = await this.fetch(`${this.baseUrl}${path}`, {
+            credentials: 'same-origin',
+            ...init,
+            headers: mergeHeaders({ 'content-type': 'application/json' }, runnerIdentityHeaders(this.identity), init.headers),
+        });
+        const body = await response.json().catch(() => undefined);
+        if (!response.ok) {
+            if (response.status === 401) {
+                if (renewOnUnauthorized && this.renewal) {
+                    // One renewal, one resend, whatever the renewal answered: a resend
+                    // after a signed-out answer costs one request and yields the
+                    // definitive refusal below, with no second renewal.
+                    await this.renewal.renew(sentAt).catch(() => undefined);
+                    return this.request(path, init, false);
+                }
+                // Not before the resend: a page listening to identity.onChange would
+                // otherwise see the user flicker to null while the edge was healing.
+                this.onUnauthorized?.();
+            }
+            throw new IsomorphError(body?.error?.category ?? (response.status === 401 ? 'AUTH_REQUIRED' : response.status === 403 ? 'FORBIDDEN' : 'INTERNAL'), body?.error?.message ?? `Isomorph request failed with ${response.status}`, body?.requestId ?? response.headers.get('x-request-id') ?? undefined, body?.error?.details, response.status);
+        }
+        return (body && Object.prototype.hasOwnProperty.call(body, 'data') ? body.data : body);
+    }
+}
+function applicationBaseUrl() {
+    if (typeof location === 'undefined') {
+        // No browser: this module is running under the retained-check runner in
+        // Node, which exports ISOMORPH_GATEWAY_URL. Returning '' here sent fetch a
+        // host-less path and Node refused it with ERR_INVALID_URL, so every check
+        // that imported the application's own client failed — and the agent
+        // improvised a different shim each run (a path rewrite, a second client, a
+        // fake `location`), none of which is the application's production code.
+        // The brief tells the agent to drive the converted client module against
+        // ISOMORPH_GATEWAY_URL; this is what makes that literally true.
+        const runtime = globalThis.process;
+        return (runtime?.env?.ISOMORPH_GATEWAY_URL ?? '').replace(/\/$/, '');
+    }
+    const match = /^\/p\/([a-z0-9-]+\.[a-z0-9-]+)(?:\/|$)/.exec(location.pathname);
+    return match ? `/p/${match[1]}` : '';
+}
+// Result is what awaiting the builder resolves to: T[] for a list query, T
+// after .single(), T | null after .maybeSingle(). The gateway applies the
+// cardinality; the type follows it so a reader of these declarations sees the
+// real contract (a wrapper written against `IsomorphResult<T[]>` for a
+// .single() query was wrong twice on one app).
+export class QueryBuilder {
+    transport;
+    table;
+    query;
+    constructor(transport, table, query) {
+        this.transport = transport;
+        this.table = table;
+        this.query = query ?? { operation: 'select', columns: '*', filters: [], orders: [] };
+    }
+    next(patch) {
+        return new QueryBuilder(this.transport, this.table, { ...this.query, ...patch });
+    }
+    select(columns = '*', options) {
+        // supabase-js: `.insert(v).select('*')` (and update/upsert/delete) means
+        // "return these columns of the written rows", not "turn this into a
+        // read". Resetting the operation here silently converted a converted
+        // app's writes into selects (trellix, 2026-09-05).
+        if (this.query.operation !== 'select') {
+            return this.next({ columns, count: options?.count, head: options?.head });
+        }
+        return this.next({ operation: 'select', columns, count: options?.count, head: options?.head });
+    }
+    insert(values) { return this.next({ operation: 'insert', values }); }
+    update(values) { return this.next({ operation: 'update', values }); }
+    upsert(values, options) {
+        // supabase-js allows upsert(row) with no options, meaning "conflict on the
+        // primary key". An unguarded options.onConflict dereference here made every
+        // optionless save in a converted app throw before any network call.
+        const declared = options?.onConflict;
+        const onConflict = declared === undefined ? [] :
+            Array.isArray(declared) ? declared :
+                declared.split(',').map((item) => item.trim());
+        return this.next({ operation: 'upsert', values, onConflict });
+    }
+    delete() { return this.next({ operation: 'delete' }); }
+    eq(column, value) { return this.filter(column, 'eq', value); }
+    neq(column, value) { return this.filter(column, 'neq', value); }
+    gt(column, value) { return this.filter(column, 'gt', value); }
+    gte(column, value) { return this.filter(column, 'gte', value); }
+    lt(column, value) { return this.filter(column, 'lt', value); }
+    lte(column, value) { return this.filter(column, 'lte', value); }
+    is(column, value) { return this.filter(column, 'is', value); }
+    in(column, values) { return this.filter(column, 'in', values); }
+    ilike(column, value) { return this.filter(column, 'ilike', value); }
+    or(expression) { return this.filter('', 'or', expression); }
+    not(column, operator, value) {
+        return this.filter(column, 'not', value, operator);
+    }
+    filter(column, operator, value, secondaryOperator) {
+        return this.next({ filters: [...this.query.filters, { column, operator, value, secondaryOperator }] });
+    }
+    order(column, options = {}) {
+        return this.next({ orders: [...this.query.orders, { column, ascending: options.ascending ?? true, nullsFirst: options.nullsFirst }] });
+    }
+    limit(value) { return this.next({ limit: value }); }
+    range(from, to) { return this.next({ range: { from, to } }); }
+    single() { return this.next({ cardinality: 'single' }); }
+    maybeSingle() { return this.next({ cardinality: 'maybeSingle' }); }
+    async execute() {
+        return this.transport.json(`/_harbour/data/${encodeURIComponent(this.table)}/query`, {
+            method: 'POST', body: JSON.stringify(this.query),
+        });
+    }
+    then(onfulfilled, onrejected) {
+        return this.execute().then(onfulfilled, onrejected);
+    }
+}
+class RealtimeChannelBuilder {
+    channel;
+    connect;
+    handlers = [];
+    constructor(channel, connect) {
+        this.channel = channel;
+        this.connect = connect;
+    }
+    on(event, filter, handler) {
+        this.handlers.push({ event, filter, handler });
+        return this;
+    }
+    subscribe(callback) {
+        try {
+            return this.connect(this.channel, [...this.handlers], callback);
+        }
+        catch (error) {
+            callback?.('CHANNEL_ERROR');
+            throw error;
+        }
+    }
+}
+export function createClient(options = {}) {
+    const authListeners = new Set();
+    let currentUser;
+    let refreshTimer;
+    let refreshInFlight;
+    let refreshesStarted = 0;
+    const setTimer = options.setTimeout ?? globalThis.setTimeout.bind(globalThis);
+    const clearTimer = options.clearTimeout ?? globalThis.clearTimeout.bind(globalThis);
+    const identityRefreshMs = options.identityRefreshMs ?? 60_000;
+    const notifyIdentity = (user, force = false) => {
+        const changed = currentUser === undefined || currentUser?.id !== user?.id || currentUser?.email !== user?.email;
+        currentUser = user;
+        if (changed || force)
+            for (const listener of authListeners)
+                listener(user);
+    };
+    const transport = new Transport(options, () => notifyIdentity(null));
+    const socketFactory = options.websocket ?? ((url) => defaultSocketFactory(url, options.identity));
+    const refreshIdentity = () => {
+        if (refreshInFlight)
+            return refreshInFlight;
+        refreshesStarted += 1;
+        refreshInFlight = transport.json(IDENTITY_PATH)
+            .then((user) => {
+            notifyIdentity(user, true);
+            return user;
+        })
+            .catch((error) => {
+            if (error instanceof IsomorphError && error.category === 'AUTH_REQUIRED') {
+                notifyIdentity(null);
+                return null;
+            }
+            throw error;
+        })
+            .finally(() => { refreshInFlight = undefined; });
+        return refreshInFlight;
+    };
+    // A refused /_harbour/* request renews the identity through the same GET
+    // the edge heals. Every request refused while that GET is in flight shares
+    // it; a GET that was already in flight when the request LEFT does not
+    // count (it may have passed the edge before the context rotated) — it is
+    // awaited and a fresh one started, which the next refusals then share.
+    transport.renewal = {
+        renewals: () => refreshesStarted,
+        renew: async (sentAt) => {
+            if (refreshInFlight && refreshesStarted <= sentAt)
+                await refreshInFlight.catch(() => undefined);
+            await refreshIdentity();
+        },
+    };
+    const scheduleIdentityRefresh = () => {
+        if (refreshTimer !== undefined || authListeners.size === 0 || identityRefreshMs <= 0)
+            return;
+        refreshTimer = setTimer(() => {
+            refreshTimer = undefined;
+            void refreshIdentity().catch(() => undefined).finally(scheduleIdentityRefresh);
+        }, identityRefreshMs);
+        const timer = refreshTimer;
+        timer.unref?.();
+    };
+    const upload = async (path, body, checksum) => {
+        const instruction = await transport.json('/_harbour/files/uploads', {
+            method: 'POST',
+            body: JSON.stringify({ path, contentType: body.type || 'application/octet-stream', size: body.size, checksum }),
+        });
+        if (instruction.mode === 'single') {
+            const result = await transport.fetch(instruction.uploadUrl, { method: 'PUT', headers: instruction.headers, body });
+            if (!result.ok)
+                throw new IsomorphError('UNAVAILABLE', `Object upload failed with ${result.status}`);
+            return transport.json('/_harbour/files/uploads/complete', {
+                method: 'POST', body: JSON.stringify({ uploadId: instruction.uploadId, checksum }),
+            });
+        }
+        const completed = [];
+        for (const part of instruction.parts) {
+            const start = (part.partNumber - 1) * instruction.partSize;
+            const result = await transport.fetch(part.uploadUrl, {
+                method: 'PUT', headers: part.headers, body: body.slice(start, Math.min(start + instruction.partSize, body.size)),
+            });
+            if (!result.ok)
+                throw new IsomorphError('UNAVAILABLE', `Object part ${part.partNumber} failed with ${result.status}`);
+            const etag = result.headers.get('etag');
+            if (!etag)
+                throw new IsomorphError('UNAVAILABLE', `Object part ${part.partNumber} returned no ETag`);
+            completed.push({ partNumber: part.partNumber, etag });
+        }
+        return transport.json('/_harbour/files/uploads/complete', {
+            method: 'POST', body: JSON.stringify({ uploadId: instruction.uploadId, parts: completed, checksum }),
+        });
+    };
+    const connectRealtime = (channel, handlers, status) => {
+        const configured = `${transport.baseUrl}/_harbour/realtime`;
+        const locationOrigin = typeof location === 'undefined' ? 'http://localhost' : location.origin;
+        const url = new URL(configured, locationOrigin);
+        url.protocol = url.protocol === 'https:' ? 'wss:' : 'ws:';
+        const presence = {};
+        let socket;
+        let stopped = false;
+        let open = false;
+        let connectedOnce = false;
+        let reconnectAttempt = 0;
+        let reconnectTimer;
+        let trackedState;
+        const subscribeMessage = JSON.stringify({ type: 'subscribe', channel, handlers: handlers.map(({ event, filter }) => ({ event, filter })) });
+        let openSocket;
+        const scheduleReconnect = () => {
+            if (stopped)
+                return;
+            status?.('RECONNECTING');
+            const delay = Math.min((options.realtimeReconnectMs ?? 500) * 2 ** reconnectAttempt, 30_000);
+            reconnectAttempt += 1;
+            reconnectTimer = setTimer(openSocket, delay);
+            const timer = reconnectTimer;
+            timer.unref?.();
+        };
+        openSocket = () => {
+            try {
+                socket = socketFactory(url.toString());
+            }
+            catch (error) {
+                status?.('CHANNEL_ERROR');
+                if (!connectedOnce)
+                    throw error;
+                scheduleReconnect();
+                return;
+            }
+            socket.addEventListener('open', () => {
+                open = true;
+                socket.send(subscribeMessage);
+                if (trackedState)
+                    socket.send(JSON.stringify({ type: 'presence.track', channel, state: trackedState }));
+            });
+            socket.addEventListener('message', (event) => {
+                let message;
+                try {
+                    message = JSON.parse(String(event.data));
+                }
+                catch {
+                    return;
+                }
+                if (message.type === 'subscribed') {
+                    reconnectAttempt = 0;
+                    if (connectedOnce)
+                        status?.('REFETCH_REQUIRED');
+                    else
+                        status?.('SUBSCRIBED');
+                    connectedOnce = true;
+                    return;
+                }
+                if (message.type === 'presence' && message.state)
+                    Object.assign(presence, message.state);
+                if (typeof message.index === 'number')
+                    handlers[message.index]?.handler(message.payload);
+            });
+            socket.addEventListener('error', () => status?.('CHANNEL_ERROR'));
+            socket.addEventListener('close', () => {
+                open = false;
+                if (stopped) {
+                    status?.('CLOSED');
+                    return;
+                }
+                scheduleReconnect();
+            });
+        };
+        openSocket();
+        return {
+            unsubscribe: () => {
+                stopped = true;
+                if (reconnectTimer !== undefined)
+                    clearTimer(reconnectTimer);
+                socket.close(1000, 'client unsubscribe');
+            },
+            track: (state) => {
+                trackedState = state;
+                if (open)
+                    socket.send(JSON.stringify({ type: 'presence.track', channel, state }));
+            },
+            presenceState: () => ({ ...presence }),
+        };
+    };
+    return {
+        identity: {
+            current: refreshIdentity,
+            signIn: (returnTo = typeof location === 'undefined' ? '/' : location.href) => {
+                // Authentication is owned by Isomorph governance, not the shared data
+                // gateway. Use the edge control path so an anonymous browser can enter
+                // SSO before any signed application context exists.
+                const url = `/__harbour/login?returnTo=${encodeURIComponent(returnTo)}`;
+                if (typeof location !== 'undefined')
+                    location.assign(url);
+                return url;
+            },
+            signOut: (returnTo = typeof location === 'undefined' ? '/' : location.href) => {
+                const url = `/__harbour/logout?returnTo=${encodeURIComponent(returnTo)}`;
+                notifyIdentity(null, true);
+                if (typeof location !== 'undefined')
+                    location.assign(url);
+                return url;
+            },
+            onChange: (listener) => {
+                authListeners.add(listener);
+                void refreshIdentity().catch(() => undefined);
+                scheduleIdentityRefresh();
+                return () => {
+                    authListeners.delete(listener);
+                    if (authListeners.size === 0 && refreshTimer !== undefined) {
+                        clearTimer(refreshTimer);
+                        refreshTimer = undefined;
+                    }
+                };
+            },
+        },
+        data: {
+            from: (table) => new QueryBuilder(transport, table),
+            rpc: (name, args = {}) => transport.json(`/_harbour/data/rpc/${encodeURIComponent(name)}`, { method: 'POST', body: JSON.stringify(args) }),
+        },
+        files: {
+            createUpload: (input) => transport.json('/_harbour/files/uploads', { method: 'POST', body: JSON.stringify(input) }),
+            upload,
+            list: (prefix = '') => transport.json(`/_harbour/files?prefix=${encodeURIComponent(prefix)}`),
+            remove: (paths) => transport.json('/_harbour/files/remove', { method: 'POST', body: JSON.stringify({ paths }) }),
+            getPublicUrl: (path) => `${transport.baseUrl}/_harbour/files/public/${encodeURIComponent(path)}`,
+            createSignedUrl: (path, expiresIn = 3600) => transport.json('/_harbour/files/signed-url', {
+                method: 'POST', body: JSON.stringify({ path, expiresIn }),
+            }),
+            createSignedUrls: (paths, expiresIn = 3600) => transport.json('/_harbour/files/signed-urls', {
+                method: 'POST', body: JSON.stringify({ paths, expiresIn }),
+            }),
+        },
+        realtime: {
+            channel: (name) => new RealtimeChannelBuilder(name, connectRealtime),
+        },
+        actions: {
+            invoke: (name, input) => {
+                // supabase-js accepts FormData/Blob bodies and sends them as
+                // multipart; JSON.stringify(FormData) silently becomes "{}", which
+                // turned a verbatim-ported multipart action into a guaranteed 500.
+                // Pass binary bodies through and let the browser set the boundary.
+                if (typeof FormData !== 'undefined' && input instanceof FormData) {
+                    return transport.json(`/_harbour/actions/${encodeURIComponent(name)}`, {
+                        method: 'POST', body: input, headers: { 'content-type': undefined },
+                    });
+                }
+                if (typeof Blob !== 'undefined' && input instanceof Blob) {
+                    return transport.json(`/_harbour/actions/${encodeURIComponent(name)}`, {
+                        method: 'POST', body: input, headers: { 'content-type': input.type || 'application/octet-stream' },
+                    });
+                }
+                return transport.json(`/_harbour/actions/${encodeURIComponent(name)}`, {
+                    method: 'POST', body: JSON.stringify(input),
+                });
+            },
+        },
+        telemetry: {
+            track: (name, properties = {}) => transport.json('/_harbour/telemetry', {
+                method: 'POST', body: JSON.stringify({ name, properties }),
+            }),
+            page: (path = typeof location === 'undefined' ? '/' : location.pathname) => transport.json('/_harbour/telemetry', {
+                method: 'POST', body: JSON.stringify({ name: 'page_view', properties: { path } }),
+            }),
+        },
+        integrations: {
+            execute: (connection, request) => {
+                // The contract's per-operation rules, refused here before any request
+                // is made, with the platform's own sentence and the field named — so
+                // `isomorph check` (which runs retained journeys through this client)
+                // and the deployed app fail the same way at build time, not at runtime.
+                const checked = validateIntegrationExecuteInput(request.operation, request.input);
+                if (!checked.ok) {
+                    return Promise.reject(new IsomorphError('VALIDATION_FAILED', checked.problem.message, undefined, { code: 'INPUT_INVALID', field: checked.problem.field }));
+                }
+                if (request.operation === 'warehouse.view.read' && Array.isArray(request.input?.columns) && request.input.columns.includes('*') && request.input.columns.length !== 1) {
+                    return Promise.reject(new IsomorphError('VALIDATION_FAILED', 'columns may use "*" only as the sole entry', undefined, { code: 'INPUT_INVALID', field: 'columns' }));
+                }
+                // Exactly the contract's fields go on the wire: `mode` is one of them
+                // for a Slack post only (which approved mode it runs under); an
+                // `identity` or any other stray field is not sent.
+                const { operation, resource, input, idempotencyKey, mode } = request;
+                return transport.json('/_harbour/integrations/execute', {
+                    method: 'POST', body: JSON.stringify({ connection, operation, resource, ...(input !== undefined ? { input } : {}), ...(idempotencyKey !== undefined ? { idempotencyKey } : {}), ...(operation === 'slack.message.post' && mode !== undefined ? { mode } : {}) }),
+                });
+            },
+            connect: (connection) => transport.json('/_harbour/integrations/connect', {
+                method: 'POST', body: JSON.stringify({ connection }),
+            }),
+            disconnect: (connection) => transport.json('/_harbour/integrations/connect', {
+                method: 'DELETE', body: JSON.stringify({ connection }),
+            }),
+        },
+        ai: {
+            chat: (request) => transport.json('/_harbour/ai/chat', {
+                method: 'POST', body: JSON.stringify(request),
+            }),
+            embed: (request) => transport.json('/_harbour/ai/embed', {
+                method: 'POST', body: JSON.stringify(request),
+            }),
+        },
+    };
+}
+// The contract's integration input rules (vendored verbatim from
+// @fourier-labs/harbour-contracts gen-ts/integration-execute-input-rules.ts;
+// test/integration-input-rules.test.mjs pins the copy's digest), so an app or
+// a check can read a bound instead of restating it.
+export { IntegrationExecuteInputRules, integrationExecuteInputMaximum, validateIntegrationExecuteInput, } from './integration-execute-input-rules.js';
+// supabase-js compatibility layer (additive; see src/supabase-compat.ts).
+export { createSupabaseCompatClient, decodeSupabaseCompatResponse, SupabaseCompatQueryBuilder, } from './supabase-compat.js';
+// The old names, kept ONLY for the deployment pipeline's internal
+// transformation agent, whose brief and playbooks
+// (harbour-deployment-control-plane internal/application/transformation)
+// still write `@harbour/app-sdk` code against `HarbourError`, `HarbourUser`
+// and the other five; the pipeline bakes this same source under that
+// package name for that lane, and these aliases keep its output compiling.
+// They are not part of the kit: an app built with the Isomorph development
+// kit that imports one is refused by `isomorph check` and the deployment
+// gate (the kit gate's SDK-surface check knows only the Isomorph names), and
+// nothing a kit builder or their tool reads mentions them.
+/** @deprecated Internal transformation lane only; a kit app uses IsomorphError. */
+export const HarbourError = IsomorphError;